elanous 0.2.14 → 0.2.16

package/src/harness/pod-memory-policy.ts

@@ -0,0 +1,15 @@
+import type { GoalType } from '../self-implement/goal-author.js';
+import type { PodMemoryTier } from '../task-orchestrator/surfaces/self-implement-pod.js';
+
+export type PodMemorySelectionReason = 'explicit-option' | 'goal-type-default' | 'existing-tier';
+
+/** Select the harness Pod tier without discarding the existing implementation/operate decision. */
+export function selectPodMemoryTier(
+  goalType: GoalType,
+  explicitPodMemory: PodMemoryTier | undefined,
+  existingTier: PodMemoryTier = 'standard',
+): { tier: PodMemoryTier; reason: PodMemorySelectionReason } {
+  if (explicitPodMemory !== undefined) return { tier: explicitPodMemory, reason: 'explicit-option' };
+  if (goalType === 'research' || goalType === 'document') return { tier: 'lite', reason: 'goal-type-default' };
+  return { tier: existingTier, reason: 'existing-tier' };
+}

package/src/harness/repository-name.ts

@@ -0,0 +1,55 @@
+import { execFileSync } from 'node:child_process';
+import { getUserConfig, type UserConfig } from '../user-config.js';
+
+const REPOSITORY_NAME = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+
+export interface RepositoryNameOptions {
+  /** Explicit --repo value. */
+  repo?: string;
+  config?: Pick<UserConfig, 'harness'>;
+  env?: NodeJS.ProcessEnv;
+  cwd?: string;
+  executeGh?: (args: string[]) => string;
+  /** Test seam. Default asks git whether cwd is a work tree. */
+  insideGitWorkTree?: (cwd: string) => boolean;
+}
+
+/** Resolve the GitHub owner/name without asking gh outside a git checkout. */
+export function resolveRepositoryName(options: RepositoryNameOptions = {}): string {
+  const env = options.env ?? process.env;
+  const cwd = options.cwd ?? process.cwd();
+  const valid = (source: string, candidate: string | undefined): string | undefined => {
+    if (!candidate?.trim()) return undefined;
+    const name = candidate.trim();
+    if (!REPOSITORY_NAME.test(name) || name.includes('..')) {
+      throw new Error(`invalid ${source} (expected owner/name): ${candidate}`);
+    }
+    return name;
+  };
+  const flag = valid('--repo', options.repo);
+  if (flag) return flag;
+  const configured = valid('harness.repo', (options.config ?? getUserConfig()).harness?.repo);
+  if (configured) return configured;
+  const inherited = valid('GH_REPO', env.GH_REPO);
+  if (inherited) return inherited;
+  const insideGit = options.insideGitWorkTree ?? ((dir) => {
+    try {
+      return execFileSync('git', ['rev-parse', '--is-inside-work-tree'], {
+        cwd: dir, encoding: 'utf8', timeout: 5_000, stdio: ['ignore', 'pipe', 'pipe'],
+      }).trim() === 'true';
+    } catch { return false; }
+  });
+  if (insideGit(cwd)) {
+    try {
+      const name = (options.executeGh ?? ((args) => execFileSync('gh', args, {
+        cwd, encoding: 'utf8', timeout: 30_000, stdio: ['ignore', 'pipe', 'pipe'], env,
+      })))(['repo', 'view', '--json', 'nameWithOwner', '--jq', '.nameWithOwner']).trim();
+      if (REPOSITORY_NAME.test(name) && !name.includes('..')) return name;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const line = message.split(/\r?\n/).map((row) => row.trim()).find((row) => row && !/^at\s/.test(row));
+      throw new Error(line || '저장소 이름 없음 — --repo 또는 harness.repo 설정');
+    }
+  }
+  throw new Error('저장소 이름 없음 — --repo 또는 harness.repo 설정');
+}

package/src/hq/fence-audit.ts

@@ -0,0 +1,90 @@
+// Read-only HQ fence inventory: use the installed crontab, never install a proposed replacement.
+import { debug } from '../debug/log.js';
+import { FENCE_ROLES } from './hq.js';
+import { inventoryCrontab, listSchedules, openSchedulesDb, parseCronLine, readCrontab } from '../domains/schedule-registry.js';
+import { cronLaunchedActionsWithFence, listAllLoops, shellSegments, type LoopRegistryOptions } from '../loops/registry.js';
+
+type SuggestedRole = 'cron' | 'seat-loop' | 'release-run' | 'conatus' | 'git-push' | 'ledger-cli' | 'unknown';
+export interface UnfencedCron {
+  raw: string;
+  cron: string;
+  command: string;
+  recommendedRole: SuggestedRole;
+  suggestedLine: string;
+  /** Unknown roles are not executable fence arguments; the operator must choose a role. */
+  manualReview?: true;
+}
+
+/** Only infer a specific role where the launched command names that activity. */
+function roleFor(command: string): SuggestedRole {
+  const launched = shellSegments(command).map(segment => segment.replace(/^cd\s+\S+\s*&&\s*/, '').replace(/(?:^|\s)(?:--message|--label|--note)\s+(?:'[^']*'|"[^"]*")/g, '')).join(' ');
+  if (/(?:^|[\s;&|])(?:\S*\/)?git\s+push\b|(?:^|[\s/])git-push\b|tree-sync\.sh\b/i.test(launched)) return 'git-push';
+  if (/(?:^|[\s/])(?:seat-loop|(?:op|tc|mk|ux)-seat|coord-bridge)(?:[.\s/-]|$)/i.test(launched)) return 'seat-loop';
+  if (/(?:^|[\s/])(?:release-run|landing-heal)(?:[.\s/-]|$)|\brelease\s+(?:run|publish|place|rebalance)\b/i.test(launched)) return 'release-run';
+  if (/(?:^|[\s/])conatus(?:[.\s/-]|$)/i.test(launched)) return 'conatus';
+  if (/\b(?:ledger|checklist)\s+(?:set|write|update|add|create|delete)\b|(?:^|[\s/])ledger-cli(?:[.\s/-]|$)/i.test(launched)) return 'ledger-cli';
+  if (/(?:^|[\s/])(?:steward|draft-cleanup|test-diet|contract-coordinator|market-posture|mission-request-judge)(?:[.\s/-]|$)/i.test(launched)) return 'cron';
+  if (/\b(?:graph\s+run|harness\s+queue\s+tick|card\s+intake-scan|flow\s+tick)\b/i.test(launched)) return 'cron';
+  return 'unknown';
+}
+
+const READ_ONLY = /^(?:hq (?:heartbeat|arbiter-check|seen|lease status|fence-audit)|(?:logs|config) (?:query|get|list)|loop (?:status|list)|card list|harness queue list)(?: |$)/i;
+/** `hq fence --role <x>` with a role the CLI rejects never runs the payload fenced. */
+function isFenceRole(role: string | undefined): boolean {
+  return !!role && (FENCE_ROLES as readonly string[]).includes(role);
+}
+function isReadOnly(script: string, args: string[]): boolean {
+  if (/^(?:cd|echo|printf|date|true)$/.test(script.split('/').pop() ?? '')) return true;
+  if (!/^(?:elanous|elanous\.mjs|eln)$/.test(script.split('/').pop() ?? '')) return false;
+  return READ_ONLY.test(args.slice(0, 3).join(' '));
+}
+const quote = (command: string) => `'${command.replaceAll("'", "'\"'\"'")}'`;
+
+/** Reuse the installed loop inventory without touching the production schedule DB. A registry fenceRole
+ * may describe only one job or segment, so each launched action is checked independently below. */
+export function hqFenceAudit(deps: {
+  read?: () => string;
+  loops?: typeof listAllLoops;
+  loopOptions?: LoopRegistryOptions;
+  log?: typeof debug.log;
+} = {}): UnfencedCron[] {
+  const text = (deps.read ?? readCrontab)();
+  const parsed = text.split('\n').map(raw => ({ raw, job: parseCronLine(raw) })).filter(
+    (entry): entry is { raw: string; job: { cron: string; command: string } } => entry.job !== null,
+  );
+  // Inventory into an in-memory registry so the production schedule DB is never written by an audit.
+  let schedules: ReturnType<typeof listSchedules> = [];
+  try {
+    const db = openSchedulesDb(':memory:');
+    try {
+      inventoryCrontab(db, { crontab: text });
+      schedules = listSchedules(db);
+    } finally { db.close(); }
+  } catch { /* schedule metadata is advisory; the installed crontab is the source */ }
+  // Registry rows are hints only: a fenceRole on one segment must not hide an unfenced sibling.
+  // A broken graph or schedule inventory must not prevent auditing the installed crontab.
+  let loops: ReturnType<typeof listAllLoops> = [];
+  try { loops = (deps.loops ?? listAllLoops)({ ...deps.loopOptions, schedules }); } catch { /* cron inspection remains available */ }
+  const results: UnfencedCron[] = [];
+  for (const { raw, job: { cron, command } } of parsed) {
+    const launches = cronLaunchedActionsWithFence(command);
+    const unfenced = launches.filter(({ script, args, fenceRole }) => script && !isFenceRole(fenceRole) && !isReadOnly(script, args));
+    if (!unfenced.length) continue;
+    const unfencedCommand = unfenced.map(({ script, args }) => [script, ...args].join(' ')).join(' ; ');
+    const registered = loops.find(loop => loop.cron === cron && loop.command === command);
+    // An unfenced registered orchestrator can supply a role for an opaque launch.
+    // If the aggregate inventory carries a fenceRole from another segment, do not
+    // borrow that segment's classification for the unfenced sibling.
+    const inferred = roleFor(unfencedCommand);
+    const recommendedRole = inferred === 'unknown' && registered?.kind === 'orchestrator' && !registered.fenceRole ? 'cron' : inferred;
+    results.push({ raw, cron, command, recommendedRole,
+      ...(recommendedRole === 'unknown' ? { manualReview: true as const } : {}),
+      suggestedLine: recommendedRole === 'unknown'
+        ? `# manual review (unknown role): ${cron} ${command}`
+        : `${cron} hq-fence ${recommendedRole} ${quote(command)}` });
+  }
+  try { (deps.log ?? debug.log.bind(debug))('hq.fence-audit', 'listed', {
+    unfenced: results.length, unknownRole: results.filter(row => row.recommendedRole === 'unknown').length,
+  }); } catch { /* observation is fail-soft */ }
+  return results;
+}

package/src/hq/hq.ts

@@ -4,10 +4,14 @@ import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync,
 import { homedir, hostname } from 'node:os';
 import { dirname, join } from 'node:path';
 import { spawnSync } from 'node:child_process';
+import type { Command } from 'commander';
+import { writeStdoutJson } from '../cli/stdout-json.js';
 import { debug } from '../debug/log.js';
 import { DEFAULT_NEXUS_HTTP_PORT } from '../nexus/default-port.js';
 import { getElanousConfigDir } from '../elanous-config-dir.js';
 import { getUserConfig, type HqConfig, type HqFenceRole } from '../user-config.js';
+import { promoteHq, proposeHqPromotion, writeOpSeatRequest } from './promote.js';
+import type { HqOpRequestWriter, PromoteResult } from './promote.js';
 import {
   DEFAULT_TTL_SECONDS, decideAcquire, decideArbiterCheck, decideFence, decideRelease, decideRenew, defaultSshRunner,
   fileLeaseStore, leaseExpired, parseLease, probeReachable, recordView, serializeLease, sshLeaseStore, sshReachable, localShellRunner,
@@ -16,6 +20,21 @@ import {
 
 export const FENCE_ROLES: readonly HqFenceRole[] = ['telegram-poller', 'cron', 'seat-loop', 'release-run', 'conatus', 'git-push', 'ledger-cli'];
 
+/** Register only the read-only move inventory; keep it outside lease/fence mutation flows. */
+export function registerHqMovePlanCommand(hqCmd: Command): void {
+  hqCmd.command('move-plan').description('현재 호스트의 작업·launchd 및 대상 호스트 파일을 조회(읽기 전용)')
+    .requiredOption('--to <host>', '이동 대상 호스트')
+    .option('--json', 'JSON 출력')
+    .action(async (opts: { to: string; json?: boolean }) => {
+      try {
+        const { hqMovePlan, formatMovePlan } = await import('./move-plan.js');
+        const result = hqMovePlan(opts.to);
+        if (opts.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
+        else console.log(formatMovePlan(result));
+      } catch (error) { console.error(`hq move-plan: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
+    });
+}
+
 export interface HqDeps {
   config?: HqConfig;
   store?: LeaseStore;
@@ -29,6 +48,9 @@ export interface HqDeps {
   seenPath?: string;
   now?: () => number;
   log?: typeof debug.log;
+  /** Injection points for the OP seat request and the promotion runbook; production uses durable defaults. */
+  opRequest?: HqOpRequestWriter;
+  promote?: (host: string, apply: boolean) => PromoteResult;
 }
 
 interface Resolved { me: string; arbiter: string; standby: string; ttl: number; failOpen: Set<HqFenceRole>; store: LeaseStore; ssh: SshRunner; probe: HostProbe; localPath: string; seenPath: string; now: () => number; log: typeof debug.log }
@@ -184,7 +206,7 @@ function mutate(r: Resolved, decide: (record: LeaseRecord | null, now: number) =
 }
 
 export type LeaseAction = 'acquire' | 'renew' | 'status' | 'release';
-export function hqLease(action: LeaseAction, deps: HqDeps = {}, opts: { host?: string } = {}) {
+export function hqLease(action: LeaseAction, deps: HqDeps = {}, opts: { host?: string; expectedHolder?: string; expectedGeneration?: number } = {}) {
   const r0 = resolve(deps);
   const r = opts.host ? { ...r0, me: opts.host } : r0;
   if (action === 'status') {
@@ -193,9 +215,15 @@ export function hqLease(action: LeaseAction, deps: HqDeps = {}, opts: { host?: s
     noteSeen(r, record);
     return { ok: true as const, action, record, ageSeconds: record ? now - record.renewedAt : null, expired: record ? leaseExpired(record, now) : null };
   }
+  if (action === 'release' && ((opts.expectedHolder === undefined) !== (opts.expectedGeneration === undefined)
+    || (opts.expectedGeneration !== undefined && (!Number.isSafeInteger(opts.expectedGeneration) || opts.expectedGeneration < 1))
+    || (opts.expectedHolder !== undefined && !opts.expectedHolder)))
+    throw new Error('hq lease release: expected holder and positive generation must be supplied together');
   const local = readLocal(r.localPath);
+  const expected = opts.expectedHolder !== undefined && opts.expectedGeneration !== undefined
+    ? { holder: opts.expectedHolder, generation: opts.expectedGeneration } : undefined;
   const result = mutate(r, (record, now) => action === 'acquire' ? decideAcquire(record, r.me, now, r.ttl)
-    : action === 'renew' ? decideRenew(record, r.me, local.generation, now) : decideRelease(record, r.me));
+    : action === 'renew' ? decideRenew(record, r.me, local.generation, now) : decideRelease(record, r.me, expected));
   noteSeen(r, result.record);
   if (result.ok && action !== 'release') writeLocal(r.localPath, { holder: result.record.holder, generation: result.record.generation, confirmedAt: r.now(), ttlSeconds: result.record.ttlSeconds });
   if (result.ok && action === 'release') writeLocal(r.localPath, { ...local, holder: undefined, confirmedAt: undefined });
@@ -247,19 +275,55 @@ export function hqHeartbeat(deps: HqDeps = {}) {
 
 /**
  * Arbiter check (cron on cloud-vm every 10 min, next to the file): probe the holder over the tailnet
- * (`tailscale ping` ⊕ nexus health · no ssh into home machines) and promote per rule ②.
+ * (`tailscale ping` ⊕ nexus health · no ssh into home machines); propose to OP by default.
  */
 export function hqArbiterCheck(deps: HqDeps & { leasePath?: string } = {}) {
   const r0 = resolve(deps);
   const r = deps.store ? r0 : { ...r0, store: fileLeaseStore(deps.leasePath ?? join(process.env.HOME ?? '', '.elanous-hq', 'lease.json')) };
-  let outcome: { promoted: boolean; streak: number; holder?: string; generation?: number; ping?: boolean; health?: boolean } = { promoted: false, streak: 0 };
+  let outcome: { promoted: boolean; streak: number; holder?: string; generation?: number; ping?: boolean; health?: boolean; runbookFailed?: string } = { promoted: false, streak: 0 };
+  let proposal: { holder: string; generation: number; streak: number } | undefined;
+  const config = deps.config ?? getUserConfig().hq ?? {};
+  const threshold = config.autoPromote?.streak ?? 3;
+  const autoPromote = config.autoPromote?.enabled === true;
+  let leaseMoved: { from: string; to: string; generation: number } | undefined;
   const result = mutate(r, (record, now) => {
     if (!record) return { ok: false, reason: 'no lease' };
     const seen = probeReachable(record.holder, r.probe);
-    const checked = decideArbiterCheck(record, { arbiter: r.me, standby: r.standby, arbiterReachesHolder: seen.reachable, now });
-    outcome = { promoted: checked.promoted, streak: checked.streak, holder: checked.next.holder, generation: checked.next.generation, ping: seen.ping, health: seen.health };
+    const checked = decideArbiterCheck(record, { arbiter: r.me, standby: r.standby, arbiterReachesHolder: seen.reachable, now,
+      promote: autoPromote, promoteAfterChecks: threshold });
+    proposal = !autoPromote && !seen.reachable && record.holder !== r.standby && checked.streak >= threshold
+      ? { holder: record.holder, generation: record.generation, streak: checked.streak } : undefined;
+    // promoteHq's own precondition is «lease holder = target», so the lease moves first and the runbook follows.
+    if (checked.promoted) leaseMoved = { from: record.holder, to: checked.next.holder, generation: checked.next.generation };
+    outcome = { promoted: false, streak: checked.streak, holder: checked.next.holder, generation: checked.next.generation, ping: seen.ping, health: seen.health };
     return { ok: true, next: checked.next };
   });
+  const moved = leaseMoved as { from: string; to: string; generation: number } | undefined; // assigned inside the mutate callback
+  if (result.ok && moved) {
+    let promotion: PromoteResult | undefined;
+    let failure: string | undefined;
+    try {
+      promotion = (deps.promote ?? ((host: string, apply: boolean) => promoteHq(host, apply)))(moved.to, true);
+      if (!promotion.ok) failure = promotion.lines.filter((line) => line.status === 'failed').map((line) => `${line.step}: ${line.measurement}`).join(' · ') || 'runbook returned ok=false';
+    } catch (error) { failure = String(error); }
+    if (failure === undefined) outcome = { ...outcome, promoted: true };
+    else {
+      // The lease already names the standby but the services did not move — never report this as a promotion.
+      outcome = { ...outcome, promoted: false, runbookFailed: failure };
+      try { r.log('hq.arbiter', 'promote-runbook-failed', { ...moved, error: failure }); } catch { /* observation is fail-soft */ }
+      try {
+        (deps.opRequest ?? ((request) => writeOpSeatRequest(request)))({
+          key: `hq:promote-failed:${moved.to}:${moved.generation}`,
+          text: `자동 승격 런북 실패 — 임대는 ${moved.to}(세대 ${moved.generation})로 옮겨졌지만 서비스 이전이 끝나지 않았다: ${failure}. OP 가 \`eln hq promote --to ${moved.to}\` 로 확인한다.`,
+        });
+      } catch (error) { try { r.log('hq.arbiter', 'promote-request-failed', { ...moved, error: String(error) }); } catch { /* fail-soft */ } }
+    }
+  }
+  const proposed = proposal as { holder: string; generation: number; streak: number } | undefined;
+  if (result.ok && proposed) {
+    try { proposeHqPromotion({ ...proposed, standby: r.standby }, { request: deps.opRequest, log: r.log }); }
+    catch (error) { try { r.log('hq.arbiter', 'promote-proposal-failed', { ...proposed, error: String(error) }); } catch { /* observation is fail-soft */ } }
+  }
   observe(r, 'hq.lease', outcome.promoted ? 'promoted' : 'arbiter-check', { ...outcome, ok: result.ok });
   return { ok: result.ok, ...outcome };
 }

package/src/hq/lease.ts

@@ -1,5 +1,5 @@
 // HQ lease (본부 임대) — single writer across mbp · node-b · cloud-vm with a 2-of-3 quorum (OP 10-04 08:33 · 08:40).
-// The arbiter (cloud-vm) keeps one record; only the arbiter promotes the standby, and only after two consecutive
+// The arbiter (cloud-vm) keeps one record; promotion requires an explicit opt-in and consecutive
 // checks in which neither the arbiter nor the standby can reach the holder. Fenced work carries the generation.
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, renameSync, rmdirSync, statSync, writeFileSync } from 'node:fs';
@@ -39,8 +39,8 @@ export const leaseExpired = (record: LeaseRecord, now: number): boolean => recor
 /** acquire: only when there is no lease or it has expired; a new holder gets the next generation. */
 export function decideAcquire(record: LeaseRecord | null, me: string, now: number, ttlSeconds = DEFAULT_TTL_SECONDS):
   { ok: true; next: LeaseRecord } | { ok: false; reason: string } {
-  if (record && record.holder === me && !leaseExpired(record, now)) return { ok: true, next: { ...record, renewedAt: now, ttlSeconds } };
-  if (record && !leaseExpired(record, now)) return { ok: false, reason: `held by ${record.holder} (generation ${record.generation})` };
+  if (record && record.renewedAt !== 0 && record.holder === me && !leaseExpired(record, now)) return { ok: true, next: { ...record, renewedAt: now, ttlSeconds } };
+  if (record && record.renewedAt !== 0 && !leaseExpired(record, now)) return { ok: false, reason: `held by ${record.holder} (generation ${record.generation})` };
   return { ok: true, next: { holder: me, generation: (record?.generation ?? 0) + 1, acquiredAt: now, renewedAt: now, ttlSeconds, views: {}, dualUnreachableStreak: 0 } };
 }
 
@@ -52,8 +52,10 @@ export function decideRenew(record: LeaseRecord | null, me: string, generation:
   return { ok: true, next: { ...record, renewedAt: now, dualUnreachableStreak: 0 } };
 }
 
-export function decideRelease(record: LeaseRecord | null, me: string): { ok: true; next: LeaseRecord } | { ok: false; reason: string } {
+export function decideRelease(record: LeaseRecord | null, me: string, expected?: { holder: string; generation: number }): { ok: true; next: LeaseRecord } | { ok: false; reason: string } {
   if (!record || record.holder !== me) return { ok: false, reason: record ? `held by ${record.holder}` : 'no lease' };
+  if (expected && (record.holder !== expected.holder || record.generation !== expected.generation))
+    return { ok: false, reason: `lease changed: expected ${expected.holder} generation ${expected.generation}, observed ${record.holder} generation ${record.generation}` };
   return { ok: true, next: { ...record, renewedAt: 0 } };
 }
 
@@ -64,9 +66,9 @@ export function recordView(record: LeaseRecord, observer: string, reachable: boo
 
 /**
  * Arbiter check (rule ②). Records the arbiter's own view; counts a dual-unreachable check only when the standby's
- * fresh view of the same holder also says unreachable; promotes the standby after PROMOTE_AFTER_CHECKS in a row.
+ * fresh view of the same holder also says unreachable; promotion is optional and its threshold is configurable.
  */
-export function decideArbiterCheck(record: LeaseRecord, input: { arbiter: string; standby: string; arbiterReachesHolder: boolean; now: number }):
+export function decideArbiterCheck(record: LeaseRecord, input: { arbiter: string; standby: string; arbiterReachesHolder: boolean; now: number; promote?: boolean; promoteAfterChecks?: number }):
   { next: LeaseRecord; promoted: boolean; streak: number } {
   let next = recordView(record, input.arbiter, input.arbiterReachesHolder, input.now);
   const view = next.views?.[input.standby];
@@ -74,7 +76,7 @@ export function decideArbiterCheck(record: LeaseRecord, input: { arbiter: string
   const dual = !input.arbiterReachesHolder && standbyDown && record.holder !== input.standby;
   const streak = dual ? (record.dualUnreachableStreak ?? 0) + 1 : 0;
   next = { ...next, dualUnreachableStreak: streak, lastCheckAt: input.now };
-  if (streak < PROMOTE_AFTER_CHECKS) return { next, promoted: false, streak };
+  if (input.promote === false || streak < (input.promoteAfterChecks ?? PROMOTE_AFTER_CHECKS)) return { next, promoted: false, streak };
   return {
     next: { holder: input.standby, generation: record.generation + 1, acquiredAt: input.now, renewedAt: input.now, ttlSeconds: record.ttlSeconds, views: {}, dualUnreachableStreak: 0, lastCheckAt: input.now, promotedFrom: record.holder },
     promoted: true, streak,

package/src/hq/move-plan.ts

@@ -0,0 +1,126 @@
+// Read-only inventory of work tied to the current HQ host before moving it.
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { homedir, hostname } from 'node:os';
+import { join } from 'node:path';
+import { inventoryCrontab, listSchedules, openSchedulesDb, parseCronLine } from '../domains/schedule-registry.js';
+import { cronLaunchedActionsWithFence, listAllLoops, type AllLoopEntry, type LoopRegistryOptions } from '../loops/registry.js';
+import { defaultSshRunner, type SshRunner } from './lease.js';
+import { FENCE_ROLES } from './hq.js';
+
+type Measurement<T> = { status: 'measured'; value: T } | { status: '못 잼'; reason: string };
+interface MovePlan {
+  to: string;
+  from: string | null;
+  unfencedCron: Measurement<Array<{ raw: string; cron: string; command: string }>>;
+  hostLoops: Measurement<AllLoopEntry[]>;
+  targetHost: Measurement<{ exists: boolean; name: string | null }>;
+  nexusLaunchd: Measurement<{ present: boolean; measuredOn: 'local' }>;
+}
+
+type CommandResult = { status: number | null; stdout: string; stderr: string };
+interface MovePlanDeps {
+  crontab?: () => CommandResult;
+  loops?: typeof listAllLoops;
+  loopOptions?: LoopRegistryOptions;
+  ssh?: SshRunner;
+  launchctl?: () => CommandResult;
+  localHost?: () => string;
+  hostFile?: string;
+}
+
+const measured = <T>(value: T): Measurement<T> => ({ status: 'measured', value });
+const unknown = <T>(reason: string): Measurement<T> => ({ status: '못 잼', reason });
+const run = (command: string, args: string[]): CommandResult => {
+  const r = spawnSync(command, args, { encoding: 'utf8', timeout: 15_000, env: process.env });
+  return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? String(r.error ?? '') };
+};
+const message = (error: unknown) => error instanceof Error ? error.message : String(error);
+
+// Only known HQ jobs qualify by script name; a random scripts/*.ts is not HQ work.
+const HQ_SCRIPTS = new Set([
+  'steward.ts', 'draft-cleanup.ts', 'test-diet.ts', 'contract-coordinator.ts',
+  'market-posture.ts', 'mission-request-judge.ts',
+]);
+function isHqAction(script: string): boolean {
+  if (/(?:^|\/)(?:eln|elanous|elanous\.mjs)$/i.test(script)) return true;
+  if (/(?:^|\/)\.elanous(?:\/|$)/i.test(script)) return true;
+  const match = script.match(/(?:^|\/)scripts\/([^/\s]+\.ts)$/);
+  return !!match && HQ_SCRIPTS.has(match[1]!);
+}
+
+export function hqMovePlan(to: string, deps: MovePlanDeps = {}): MovePlan {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9.-]*$/.test(to) || to.includes('..')) throw new Error('hq move-plan: invalid host');
+  let unfencedCron: MovePlan['unfencedCron'];
+  let hostLoops: MovePlan['hostLoops'];
+  let localName: string | undefined;
+  let localHostError: string | undefined;
+  try {
+    const value = readFileSync(deps.hostFile ?? join(homedir(), '.elanous-hq', 'host'), 'utf8');
+    const name = value.endsWith('\n') ? value.slice(0, -1) : value;
+    if (!name || name !== name.trim() || /[\r\n]/.test(name)) throw new Error('invalid local HQ host file');
+    localName = name;
+  } catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') localHostError = message(error); }
+  const from = deps.localHost?.() ?? localName ?? null;
+  let text = '';
+  try {
+    const r = (deps.crontab ?? (() => run('crontab', ['-l'])))();
+    if (r.status !== 0 && !(r.status === 1 && /no crontab for /i.test(r.stderr))) {
+      throw new Error(r.stderr.trim() || `crontab -l exit=${r.status}`);
+    }
+    text = r.status === 0 ? r.stdout : '';
+    const rows = text.split('\n').map(raw => ({ raw, parsed: parseCronLine(raw) }))
+      .filter((row): row is { raw: string; parsed: { cron: string; command: string } } => row.parsed !== null);
+    unfencedCron = measured(rows.filter(({ parsed }) =>
+      cronLaunchedActionsWithFence(parsed.command).some(action =>
+        !!action.script && !(FENCE_ROLES as readonly string[]).includes(action.fenceRole ?? '')
+        && isHqAction(action.script)))
+      .map(({ raw, parsed }) => ({ raw, cron: parsed.cron, command: parsed.command })));
+  } catch (error) { unfencedCron = unknown(message(error)); }
+  try {
+    if (unfencedCron.status !== 'measured') throw new Error(unfencedCron.reason);
+    // The registry accepts an already-inventoried schedule set. Never open the production DB.
+    const db = openSchedulesDb(':memory:');
+    let schedules: ReturnType<typeof listSchedules>;
+    try { inventoryCrontab(db, { crontab: text }); schedules = listSchedules(db); }
+    finally { db.close(); }
+    if (localHostError) throw new Error(localHostError);
+    if (!from) throw new Error('local HQ host identity not confirmed (~/.elanous-hq/host missing)');
+    // Cron rows use os.hostname(); match that label only after confirming this machine's HQ identity.
+    const names = new Set([from, hostname()]);
+    hostLoops = measured((deps.loops ?? listAllLoops)({ ...deps.loopOptions, schedules })
+      .filter(loop => !!loop.host && names.has(loop.host)));
+  } catch (error) { hostLoops = unknown(message(error)); }
+  let targetHost: MovePlan['targetHost'];
+  try {
+    const r = (deps.ssh ?? defaultSshRunner)(to,
+      'if [ -f "$HOME/.elanous-hq/host" ]; then printf "present\\n"; cat "$HOME/.elanous-hq/host"; elif [ ! -e "$HOME/.elanous-hq/host" ]; then printf "absent\\n"; else exit 2; fi');
+    if (r.status !== 0) throw new Error(r.stderr.trim() || `ssh exit=${r.status}`);
+    const [presence, ...lines] = r.stdout.split('\n');
+    if (presence === 'absent') targetHost = measured({ exists: false, name: null });
+    else if (presence === 'present' && lines.join('\n').trim() && !/[\r\n]/.test(lines.join('\n').trim()))
+      targetHost = measured({ exists: true, name: lines.join('\n').trim() });
+    else throw new Error('target host file unreadable or empty');
+  } catch (error) { targetHost = unknown(message(error)); }
+  let nexusLaunchd: MovePlan['nexusLaunchd'];
+  try {
+    const r = (deps.launchctl ?? (() => run('launchctl', ['list', 'com.elanous.nexus'])))();
+    if (r.status === 0) nexusLaunchd = measured({ present: true, measuredOn: 'local' });
+    else if (r.status !== null && /Could not find service|service not found|not found/i.test(r.stderr)) nexusLaunchd = measured({ present: false, measuredOn: 'local' });
+    else throw new Error(r.stderr.trim() || `launchctl exit=${r.status}`);
+  } catch (error) { nexusLaunchd = unknown(message(error)); }
+  return { to, from, unfencedCron, hostLoops, targetHost, nexusLaunchd };
+}
+
+export function formatMovePlan(plan: MovePlan): string {
+  const lines = [`hq move-plan: ${plan.from ?? '못 잼'} → ${plan.to} (read-only)`];
+  const section = <T>(name: string, result: Measurement<T>, render: (value: T) => string[]) => {
+    lines.push(`${name}: ${result.status === 'measured' ? '' : `못 잼 (${result.reason})`}`.trimEnd());
+    if (result.status === 'measured') lines.push(...render(result.value));
+  };
+  section('① unfenced elanous crontab', plan.unfencedCron, rows => rows.length ? rows.map(row => `  ${row.raw}`) : ['  none']);
+  section('② local host loops (loop status --all)', plan.hostLoops, rows => rows.length ? rows.map(row => `  ${row.id} · ${row.host} · ${row.title}`) : ['  none']);
+  section('③ target ~/.elanous-hq/host', plan.targetHost, host => [`  ${host.exists ? host.name : 'absent'}`]);
+  section('④ local launchd com.elanous.nexus', plan.nexusLaunchd, service => [`  ${service.present ? 'present' : 'absent'} (measured on local machine)`]);
+  return lines.join('\n');
+}

package/src/hq/promote.ts

@@ -1,6 +1,10 @@
 // HQ promotion runbook: read-only preview by default; all remote mutations are behind --apply.
 import { spawnSync } from 'node:child_process';
 import { getUserConfig } from '../user-config.js';
+import { debug } from '../debug/log.js';
+import { join } from 'node:path';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { appendSeatRequestRows, listSeatRequests, withSeatRequestLedgerLock } from '../seat-dispatch/seat-request-ledger.js';
 import { parseLease, sshLeaseStore, defaultSshRunner, localShellRunner } from './lease.js';
 
 export interface PromoteRunner {
@@ -295,6 +299,33 @@ export function promoteHq(host: string, apply = false, runner: PromoteRunner = d
   }
 }
 
+/** One OP seat request (never a CEO decision card · 대표 10-05 10:03); idempotent by key. */
+export type HqOpRequest = { key: string; text: string; [field: string]: unknown };
+export type HqOpRequestWriter = (request: HqOpRequest) => { key: string; created: boolean };
+
+export function writeOpSeatRequest(request: HqOpRequest, root = effectiveInstanceRoot()): { key: string; created: boolean } {
+  const path = join(root, 'seat-requests', 'requests.jsonl');
+  return withSeatRequestLedgerLock(path, () => {
+    if (listSeatRequests(root).some((row) => row.key === request.key)) return { key: request.key, created: false };
+    appendSeatRequestRows(path, [{ ...request, seat: 'OP', status: 'pending' as const, queuedAt: new Date().toISOString(), source: 'hq-arbiter' }]);
+    return { key: request.key, created: true };
+  });
+}
+
+/** Propose promotion to the OP seat for a silent lease generation; the runbook runs only under explicit opt-in (see hqArbiterCheck). */
+export function proposeHqPromotion(
+  input: { holder: string; standby: string; generation: number; streak: number },
+  deps: { request?: HqOpRequestWriter; log?: typeof debug.log } = {},
+): { promoted: false; requestKey: string; created: boolean } {
+  const key = `hq:promote:${input.holder}:${input.generation}`;
+  const written = (deps.request ?? writeOpSeatRequest)({ key,
+    text: `본부 ${input.holder}(임대 세대 ${input.generation}) 연속 무응답 ${input.streak}회 — ${input.standby} 승격을 OP 가 판단한다(자동 승격 꺼짐). 승격하면 \`eln hq promote --to ${input.standby} --apply\`.`,
+    holder: input.holder, standby: input.standby, generation: input.generation, streak: input.streak });
+  try { (deps.log ?? debug.log.bind(debug))('hq.arbiter', 'promote-proposed', { ...input, ref: key, mode: 'op-request', created: written.created }); }
+  catch { /* observation cannot change the proposal */ }
+  return { promoted: false, requestKey: key, created: written.created };
+}
+
 export function formatPromote(result: PromoteResult): string {
   return [`hq promote --to ${result.host} ${result.apply ? '--apply' : '(dry-run)'}`,
     ...result.lines.map(line => `${line.step}: ${line.status} · ${line.measurement}${line.status === 'ready' ? ` · ${line.command}` : ''}`)].join('\n');