elanous 0.2.14 → 0.2.16

package/src/seat-loop/seat-loop.ts

@@ -21,6 +21,7 @@ import { loadLayeredPersonaDirs, resolveRepositoryPersonaDir, resolveStatePerson
 import { orderedPersonaTodos, personaTodoPath, readPersonaTodos, type PersonaTodo } from '../persona/persona-todo.js';
 import { PersonaRegistry } from '../persona/registry.js';
 import { recordSeatAskShadow } from '../seat-dispatch/seat-ask.js';
+import { appendSeatRequestRows, listSeatRequests, withSeatRequestLedgerLock } from '../seat-dispatch/seat-request-ledger.js';
 import { answerCrossCheck, answerSeat, askCrossCheck, askSeat, crossCheckAnswer, deliveredSeatQuestion, hasSeatAnswer, isSeatId, seatCrossChecks, seatQuestions, type CrossCheckJudgment, type SeatId } from '../seat-dispatch/seat-questions.js';
 import { queryRunningRuns } from '../self-implement/running-runs.js';
 import { checklistHistory, listChecklist, type Checklist } from '../release-loop/checklist.js';
@@ -42,10 +43,18 @@ export type TcCandidate =
   | { kind: 'publication-pr-approval-wait'; pr: number; title: string; readyAt: string; approvalWaitAt: string; paths: string[] }
   | { kind: 'other-seat-cell-defect'; version: string; id: string; title: string; to: SeatId };
 export type TcPullRequest = { number: number; title: string; body?: string; state: 'OPEN' | 'MERGED' | 'CLOSED'; isDraft: boolean; createdAt: string; updatedAt?: string; mergedAt?: string | null; readyAt?: string; approvalWaitAt?: string; paths?: string[]; reviewDecision?: string };
-export type SeatEntry = { seat: string; ts?: string; at: string; status: 'shadow' | 'attempting' | 'outcome-unknown' | 'queued' | 'refused' | 'launched' | 'hitl' | 'wait' | 'asked' | 'answered' | 'awaiting-answer' | 'awaiting-xcheck' | 'awaiting-resolution' | 'resolved-by-neighbor' | 'rejected-no-evidence' | 'skipped-budget' | 'skipped-empty'; item?: SeatItem; candidate?: OpCandidate | TcCandidate; action?: SeatAction; reason?: string; runId?: string; queueId?: string; inquiry?: SeatInquiry; answer?: string; escalated?: boolean; xcheckRequestedAt?: string; xcheckQuestionId?: number; xcheckNeighbor?: SeatId; xcheckNote?: string; xcheckJudgmentEvidence?: string; xcheckWaitMinutes?: number };
-export type SeatLoopResult = SeatEntry | { seat: string; status: 'skipped-off' };
+export type SeatEntry = { seat: string; ts?: string; at: string; modeDowngradeReason?: string; status: 'shadow' | 'attempting' | 'outcome-unknown' | 'queued' | 'refused' | 'held' | 'launched' | 'hitl' | 'wait' | 'asked' | 'answered' | 'awaiting-answer' | 'awaiting-xcheck' | 'awaiting-resolution' | 'resolved-by-neighbor' | 'rejected-no-evidence' | 'skipped-budget' | 'skipped-empty'; item?: SeatItem; candidate?: OpCandidate | TcCandidate; action?: SeatAction; reason?: string; runId?: string; queueId?: string; inquiry?: SeatInquiry; answer?: string; escalated?: boolean; xcheckRequestedAt?: string; xcheckQuestionId?: number; xcheckNeighbor?: SeatId; xcheckNote?: string; xcheckJudgmentEvidence?: string; xcheckWaitMinutes?: number };
+export type SeatLoopResult = SeatEntry | { seat: string; status: 'skipped-off'; modeDowngradeReason?: string };
+
+export function seatLoopTickLine(result: SeatLoopResult): string {
+  const suffix = (result.status === 'shadow' || result.status === 'skipped-off') && result.modeDowngradeReason
+    ? ` (live-safe 요청 · 이유: ${result.modeDowngradeReason})` : '';
+  return `seat loop ${result.seat}: ${result.status}${'runId' in result && result.runId ? ` ${result.runId}` : ''}${suffix}`;
+}
 export type PersonaShadowEntry = { personaId: string; ts: string; status: 'shadow' | 'skipped-empty'; todo: PersonaTodo | null; action?: 'decision' | 'harness' | 'wait'; what?: string };
 export type SeatDeps = {
+  /** Version stamp for decision cards the seat loop raises. Default = the ledger's resolver (`git reflog` on the repo, up to 10 s) — tests inject a fixed one. */
+  resolveDecisionVersion?: (at: string) => { released: string | null; dev: string | null; codename: string | null };
   personaConfig?: PersonaLoopConfig;
   personaRegistry?: PersonaRegistry;
   personaDir?: string;
@@ -77,6 +86,8 @@ export type SeatDeps = {
   stallDelivery?: (message: MessageEnvelope, key: string, root: string) => boolean;
   /** Open cards from the decision ledger; injected only for isolated ledger tests. */
   pendingDecisions?: () => Array<Pick<DecisionEntry, 'id' | 'title' | 'category' | 'dueAt'>>;
+  /** Running-run observation for OP cutoff; incomplete observations cannot establish that a run is absent. */
+  cutoffRuns?: (runIds: readonly string[]) => Pick<ReturnType<typeof queryRunningRuns>, 'completeness' | 'entries' | 'pty'>;
   /** Read-only PR snapshot for TC judgment; defaults to GitHub CLI reads. */
   pullRequests?: () => Promise<TcPullRequest[]>;
   ledgerFiles?: (directory: string) => string[];
@@ -200,6 +211,10 @@ async function pickPersonaShadows(deps: SeatDeps, name?: string): Promise<Person
 
 export async function runSeatLoopTurn(seat: string, deps: SeatDeps = {}): Promise<SeatLoopResult> {
   const result = await runSeatLoopOnce(seat, deps);
+  if ((result.status === 'shadow' || result.status === 'skipped-off') && result.modeDowngradeReason) {
+    try { debug.log('seat-loop', 'mode-downgraded', { seat, requested: 'live-safe', effective: result.status, reason: result.modeDowngradeReason }); }
+    catch { /* logging cannot change execution */ }
+  }
   try { await runPersonaShadowOnce(deps); }
   catch (error) { observe('persona-shadow-error', { error: String(error).slice(0, 200) }); }
   try {
@@ -243,6 +258,59 @@ function queueKey(seat: string, item: SeatItem): string {
   return `seat-loop:${seat}:${createHash('sha256').update(handledItemKey(item)).digest('hex')}`;
 }
 
+/** A decision ledger that raises cards — forwards the injected version resolver so tests never run the repo's `git reflog`. */
+function cardLedger(root: string, deps: SeatDeps, now?: Date): DecisionLedger {
+  return new DecisionLedger({ stateDir: root, ...(now ? { now: () => now } : {}), ...(deps.resolveDecisionVersion ? { resolveVersion: deps.resolveDecisionVersion } : {}) });
+}
+
+const DEFAULT_REPEAT_STOP = 3;
+
+function repeatStopLimit(config: SeatLoopConfig): number {
+  const value = config.repeatStop;
+  return typeof value === 'number' && Number.isSafeInteger(value) && value > 0 ? value : DEFAULT_REPEAT_STOP;
+}
+
+/** A finished attempt that never landed (no merged-PR evidence). `attempting` is the intent row of the same launch. A `refused` row whose reason is the AUTOQ retry note is the reconcile of a queued row, not a second try. */
+function unlandedAttempt(entry: SeatEntry): boolean {
+  if (!entry.item || entry.action === 'seat-question' || entry.action === 'seat-answer' || entry.inquiry) return false;
+  if (entry.status === 'launched' || entry.status === 'hitl' || entry.status === 'held' || entry.status === 'attempting') return false;
+  if (entry.status === 'refused' && entry.reason === 'AUTOQ failed or cancelled; eligible for retry') return false;
+  return entry.status === 'queued' || entry.status === 'refused' || entry.status === 'outcome-unknown';
+}
+
+function repeatStopReason(attempts: number): string {
+  return `같은 칸 ${attempts}회 착지 0 — 사람 판단`;
+}
+
+function personReopened(ledger: readonly SeatEntry[], seat: string, item: SeatItem, root: string): boolean {
+  const key = handledItemKey(item);
+  const lastHold = [...ledger].reverse().find((entry) => entry.seat === seat && entry.item && handledItemKey(entry.item) === key && entry.status === 'held');
+  if (!lastHold) return false;
+  const heldAt = Date.parse(lastHold.at || lastHold.ts || '');
+  if (!Number.isFinite(heldAt)) return false;
+  const ref = decisionRef(seat, item);
+  return new DecisionLedger({ stateDir: root }).list({ status: 'all' }).some((card) => {
+    if (!card.refs?.includes(ref) || card.status !== 'decided' || !card.decidedAt) return false;
+    const decidedAt = Date.parse(card.decidedAt);
+    return Number.isFinite(decidedAt) && decidedAt > heldAt;
+  });
+}
+
+/** Prior attempts of this seat and handled item that finished without a landing. A queued row whose queue is still retryable has not finished. Queue rows with the same key count when the ledger has no receipt. */
+function unlandedAttemptCount(seat: string, item: SeatItem, ledger: readonly SeatEntry[], root: string, deps: SeatDeps): number {
+  const key = handledItemKey(item);
+  const idem = queueKey(seat, item);
+  const outcome = deps.queueOutcome ?? ((id: string, stateRoot: string) => harnessQueueOutcome(id, { root: stateRoot }));
+  const finished = (entry: SeatEntry) => unlandedAttempt(entry) && !(entry.status === 'queued' && entry.queueId && outcome(entry.queueId, root) === 'retryable');
+  const fromLedger = ledger.filter((entry) => entry.seat === seat && entry.item && handledItemKey(entry.item) === key && finished(entry));
+  const seen = new Set(fromLedger.flatMap((entry) => entry.queueId ? [entry.queueId] : []));
+  let rows: ReturnType<typeof listHarnessQueue> = [];
+  try { rows = (deps.queueItems ?? ((stateRoot: string) => listHarnessQueue({ root: stateRoot })))(root); }
+  catch (error) { observe('repeat-stop-queue-unreadable', { seat, item: item.id, error: String(error).slice(0, 200) }); }
+  const fromQueue = rows.filter((row) => row.seat === seat && row.idempotencyKey === idem && row.status === 'finished' && !seen.has(row.id));
+  return fromLedger.length + fromQueue.length;
+}
+
 /** A crash (or a failed write) between AUTOQ enqueue and the `queued` row leaves an `attempting`/`outcome-unknown` row with no queue id. Find its queue row by the
  *  seat-loop idempotency key so the outcome below (retry · launched · still queued) applies to it too (LOOP-LIVE1 review must-fix). */
 function recoverAttemptingQueueIds(ledger: readonly SeatEntry[], root: string, deps: SeatDeps): SeatEntry[] {
@@ -301,8 +369,18 @@ function decisionRef(seat: string, item: SeatItem): string {
   return `seat-loop:${seat}:${encodeURIComponent(itemKey(item))}`;
 }
 
+// The decision ledger counts Unicode characters and sentence boundaries before it stores a card.
+function decisionSummary(text: string): string {
+  const sentences = text.replace(/\s+/g, ' ').trim().split(/(?<=[.!?。！？])\s+/u).slice(0, 2).join(' ');
+  return Array.from(sentences).slice(0, 240).join('').trim();
+}
+
+function decisionSourceRef(seat: string, item: SeatItem): string {
+  return item.source === 'request' && item.id.startsWith('coord:') ? item.id : decisionRef(seat, item);
+}
+
 function decisionReceipt(root: string, seat: string, item: SeatItem): DecisionEntry | undefined {
-  const ref = decisionRef(seat, item);
+  const ref = decisionSourceRef(seat, item);
   return new DecisionLedger({ stateDir: root }).list({ status: 'all' }).find((card) => card.refs?.includes(ref));
 }
 
@@ -315,7 +393,7 @@ function handledKeys(ledger: readonly SeatEntry[], shadow: boolean, root?: strin
     || (entry.status === 'shadow' && entry.candidate?.kind === 'other-seat-cell-defect')
     || (entry.status === 'hitl' && (!entry.inquiry || (!!root && !!entry.item && !!decisionReceipt(root, entry.seat, entry.item))))
     || (entry.inquiry?.to === 'CEO' && !!root && !!entry.item && !!decisionReceipt(root, entry.seat, entry.item))
-    || (!inquiryRow(entry) && (entry.status === 'queued' || entry.status === 'outcome-unknown'))
+    || (!inquiryRow(entry) && (entry.status === 'queued' || entry.status === 'outcome-unknown' || (entry.status === 'held' && !personReopened(ledger, entry.seat, entry.item!, root ?? ''))))
     || (!inquiryRow(entry) && entry.status === 'attempting' && !(entry.item?.source === 'checklist' && ledger.slice(index + 1).some((later) =>
       later.seat === entry.seat && later.status === 'launched' && later.item?.source === 'checklist'
       && later.item.version === entry.item?.version && later.item.id === entry.item?.id
@@ -456,6 +534,62 @@ export async function gatherSeatInputs(seat: string, deps: SeatDeps = {}, ledger
   return { requests: pending, checklist, role: read(join(deps.repo ?? repoRoot, 'docs', 'roles', `${seat}.md`)).slice(0, 4_000) };
 }
 
+const OP_CUTOFF_WINDOW_MS = 2 * 60 * 60_000;
+const RUN_REFERENCE = /\brun-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/gi;
+
+function checkOpLandingCutoff(deps: SeatDeps, now: Date, path: string, stateRoot: string): SeatEntry | undefined {
+  const releaseRoot = deps.root ?? releaseLedgerRoot();
+  const shipped = releasedVersion(releaseRoot);
+  const schedule = (deps.schedules ?? (() => readSchedules(releaseRoot)))()
+    .filter((row) => /^\d+\.\d+\.\d+$/.test(row.version) && (!shipped || versionOrder(row.version, shipped) > 0))
+    .sort((a, b) => versionOrder(a.version, b.version))[0];
+  if (!schedule?.landBy) return;
+  const untilLanding = Date.parse(schedule.landBy) - now.getTime();
+  if (!Number.isFinite(untilLanding) || untilLanding < 0 || untilLanding > OP_CUTOFF_WINDOW_MS) return;
+  const append = deps.append ?? defaultAppend;
+  let items: ReturnType<NonNullable<SeatDeps['checklistItems']>>;
+  try { items = (deps.checklistItems ?? ((version: string) => listChecklist(version, releaseRoot).items))(schedule.version); }
+  catch (error) {
+    const entry: SeatEntry = { seat: 'OP', ts: now.toISOString(), at: now.toISOString(), status: 'shadow',
+      reason: `체크리스트 못 읽음: ${schedule.version} (${String(error).slice(0, 200)})`,
+      modeDowngradeReason: 'OP 판정은 shadow 기록만 구현' };
+    append(path, entry);
+    return entry;
+  }
+  const yellow = items.filter((item) => item.status === 'yellow');
+  const runIds = [...new Set(yellow.flatMap((item) => [...(item.evidence ?? '').matchAll(RUN_REFERENCE)].map(([id]) => id.toLowerCase())))];
+  let running = new Set<string>();
+  if (runIds.length) {
+    try {
+      const observed = (deps.cutoffRuns ?? ((ids: readonly string[]) => queryRunningRuns({ runIds: ids, caller: 'seat-loop.op-cutoff' })))(runIds);
+      if (observed.completeness !== 'complete' || observed.pty.unreadable.length) {
+        observe('op-cutoff-runs-unreadable', { version: schedule.version });
+        return;
+      }
+      running = new Set(observed.entries.filter((row) => row.status === 'running' || row.status === 'probable-running' || row.status === 'unknown')
+        .map((row) => row.runId.toLowerCase()));
+    } catch (error) {
+      observe('op-cutoff-runs-unreadable', { version: schedule.version, error: String(error).slice(0, 200) });
+      return;
+    }
+  }
+  const candidates = yellow.filter((item) => ![...(item.evidence ?? '').matchAll(RUN_REFERENCE)]
+    .some(([id]) => running.has(id.toLowerCase())))
+    .sort((a, b) => a.id.localeCompare(b.id))
+    .map(({ id, title, owner }) => ({ id, title, owner: owner ?? '미배정' }));
+  try { debug.log('seat-loop', 'op-cutoff-check', { version: schedule.version, landBy: schedule.landBy, candidates }); }
+  catch { /* Observation cannot change a request. */ }
+  if (!candidates.length) return;
+  const key = `seat-loop:op-cutoff:${schedule.version}:${seatDay(now)}`;
+  const requestPath = join(stateRoot, 'seat-requests', 'requests.jsonl');
+  withSeatRequestLedgerLock(requestPath, () => {
+    if (listSeatRequests(stateRoot).some((row) => row.key === key)) return;
+    appendSeatRequestRows(requestPath, [{ key, seat: 'OP', status: 'pending' as const, queuedAt: now.toISOString(),
+      text: `${schedule.version} 착지 마감 ${schedule.landBy} 전 노랑 칸 점검 — 다음 판으로 옮길지 OP 판단:\n${candidates.map((item) => `${item.id} · ${item.title} · 주인 ${item.owner}`).join('\n')}`,
+      version: schedule.version, landBy: schedule.landBy, candidates }]);
+  });
+}
+
 function opCandidates(deps: SeatDeps, now: Date): OpCandidate[] {
   const releaseRoot = deps.root ?? releaseLedgerRoot();
   const shipped = releasedVersion(releaseRoot);
@@ -802,7 +936,7 @@ function judgeSeatNeighbors(seat: string, config: SeatLoopConfig, deps: SeatDeps
       if (judgment.state === 'absent') {
         if (config.mode === 'live-safe' && judgment.action?.action === 'escalate' && isRescueAllowedAction('decision-card')) {
           const ref = `seat-loop:neighbor:${seat}:${neighbor.id}:${lastSeenAt}`;
-          new DecisionLedger({ stateDir: root, now: () => now }).raiseOnce({ title: `${seat}: 이웃 ${neighbor.id} 결측`, category: 'other',
+          cardLedger(root, deps, now).raiseOnce({ title: `${seat}: 이웃 ${neighbor.id} 결측`, category: 'other',
             scqa: { s: `${seat} 이웃 ${neighbor.id}의 마지막 맥락 버스 사건: ${lastSeenAt}.`,
               c: `설정한 heartbeat ${neighbor.heartbeat.everyMinutes}분 × ${neighbor.heartbeat.missedTicks}회 동안 새 사건이 없다.`,
               q: '결측 이웃의 업무를 어떻게 처리할까?' },
@@ -827,10 +961,16 @@ function judgeSeatNeighbors(seat: string, config: SeatLoopConfig, deps: SeatDeps
 export async function runSeatLoopOnce(seat: string, deps: SeatDeps = {}): Promise<SeatLoopResult> {
   if (!/^(?:MK|OP|TC|UX)$/.test(seat)) throw new Error(`unknown seat: ${seat}`);
   const config = deps.config ?? getUserConfig().loops?.seat ?? { mode: 'shadow' };
-  if (config.mode === 'off' || !(config.seats ?? ['MK']).includes(seat)) {
+  if (config.mode === 'off') {
     observe('skipped-off', { seat });
     return { seat, status: 'skipped-off' };
   }
+  if (!(config.seats ?? ['MK']).includes(seat)) {
+    // An excluded seat does not read inputs or run the shadow loop; never report it as shadow.
+    observe('skipped-off', { seat });
+    return { seat, status: 'skipped-off',
+      ...(config.mode === 'live-safe' ? { modeDowngradeReason: '자리 목록에 없음 (loops.seat.seats)' } : {}) };
+  }
   const now = (deps.now ?? (() => new Date()))();
   const path = seatLedgerPath(seat, deps.root ?? effectiveInstanceRoot(), now);
   const directory = dirname(path);
@@ -928,6 +1068,7 @@ export async function runSeatLoopOnce(seat: string, deps: SeatDeps = {}): Promis
       return entry;
     }
   }
+  let tcDowngrade: SeatEntry | undefined;
   if (seat === 'TC') {
     const candidates = await tcCandidates(deps, now);
     for (const candidate of candidates) {
@@ -938,19 +1079,27 @@ export async function runSeatLoopOnce(seat: string, deps: SeatDeps = {}): Promis
           && row.candidate.version === candidate.version && row.candidate.id === candidate.id && row.candidate.to === candidate.to);
         if (!inLedger) {
           const entry: SeatEntry = { seat, ts: now.toISOString(), at: now.toISOString(), status: 'shadow', candidate,
+            ...(config.mode === 'live-safe' ? { modeDowngradeReason: 'TC 타 자리 결함 질문은 shadow 기록만 구현' } : {}),
             item: { source: 'checklist', kind: 'cell', id: candidate.id, title: candidate.title, text: candidate.title, version: candidate.version, seat: candidate.to },
             action: 'seat-question', inquiry: { to: candidate.to, question } };
           (deps.append ?? defaultAppend)(path, entry);
+          tcDowngrade ??= entry;
         }
         if (!inLedger || recorded) observe('ask-shadow', { from: seat, to: candidate.to, itemId: candidate.id });
         continue;
       }
       if (ledger.some((row) => row.status === 'shadow' && JSON.stringify(row.candidate) === JSON.stringify(candidate))) continue;
-      const entry: SeatEntry = { seat, ts: now.toISOString(), at: now.toISOString(), status: 'shadow', candidate };
+      const entry: SeatEntry = { seat, ts: now.toISOString(), at: now.toISOString(), status: 'shadow', candidate,
+        ...(config.mode === 'live-safe' ? { modeDowngradeReason: 'TC PR 판정은 shadow 기록만 구현' } : {}) };
       (deps.append ?? defaultAppend)(path, entry);
+      tcDowngrade ??= entry;
       observe('tc-shadow-candidate', { seat, candidate });
     }
   }
+  if (seat === 'OP' && config.mode === 'live-safe') {
+    const unreadable = checkOpLandingCutoff(deps, now, path, stateRoot);
+    if (unreadable) return unreadable;
+  }
   if (seat === 'OP' && !seatQuestions(stateRoot, 'OP').some((question) =>
     !hasSeatAnswer(stateRoot, question)
     && !handledKeys(ledger, config.mode !== 'on' || (config.questions ?? 'shadow') !== 'on', stateRoot).has(`seat-question::${question.id}`))) {
@@ -987,7 +1136,8 @@ export async function runSeatLoopOnce(seat: string, deps: SeatDeps = {}): Promis
         if (id !== currentDecision.id) candidates.push({ kind: 'decision-delegation', id, verdict: 'none' });
       }
     }
-    const entries = candidates.map((candidate): SeatEntry => ({ seat, ts: now.toISOString(), at: now.toISOString(), status: 'shadow', candidate }));
+    const entries = candidates.map((candidate): SeatEntry => ({ seat, ts: now.toISOString(), at: now.toISOString(), status: 'shadow', candidate,
+      ...(config.mode === 'live-safe' ? { modeDowngradeReason: 'OP 판정은 shadow 기록만 구현' } : {}) }));
     for (const entry of entries) {
       const candidate = entry.candidate!;
       const previous = [...ledger].reverse().find((row) => row.candidate?.kind === candidate.kind &&
@@ -1003,7 +1153,12 @@ export async function runSeatLoopOnce(seat: string, deps: SeatDeps = {}): Promis
     }
     return entries[0]!;
   }
+  const failedDecisions = new Set<string>();
+  let lastDecisionFailure: SeatEntry | undefined;
+  while (true) {
   const inputs = await gatherSeatInputs(seat, deps, ledger);
+  inputs.requests = inputs.requests.filter((candidate) => !failedDecisions.has(itemKey(candidate)));
+  inputs.checklist = inputs.checklist.filter((candidate) => !failedDecisions.has(itemKey(candidate)));
   const questionsMode = config.mode === 'on' ? config.questions ?? 'shadow' : 'shadow';
   const questionHandled = handledKeys(ledger, questionsMode !== 'on', stateRoot);
   const pendingQuestion = inputs.requests.find((candidate) => candidate.source === 'seat-question'
@@ -1085,6 +1240,7 @@ export async function runSeatLoopOnce(seat: string, deps: SeatDeps = {}): Promis
         entry.action = 'decision';
       }
       if (questionsMode !== 'on') {
+        if (config.mode === 'live-safe') entry.modeDowngradeReason = '질문 전달 선행 조건 미충족 (questions shadow)';
         if (config.mode === 'live-safe' && !isRescueAllowedAction('seat-question')) {
           observe('refused', { seat, item: item.id, action: 'seat-question', reason: 'question delivery is shadow-only' });
         }
@@ -1192,9 +1348,11 @@ export async function runSeatLoopOnce(seat: string, deps: SeatDeps = {}): Promis
   if (item && config.mode === 'live-safe' && deps.inquire && !isRescueAllowedAction('seat-question')) {
     observe('refused', { seat, item: item.id, action: 'seat-question', reason: 'outbound inquiry not in rescue policy' });
   }
+  if (!item && config.mode === 'live-safe' && tcDowngrade) return tcDowngrade;
   const entry: SeatEntry = { seat, ts: now.toISOString(), at: now.toISOString(), status: item ? 'shadow' : 'skipped-empty',
     ...(item ? { item, action: planned!.kind, ...(planned!.reason ? { reason: planned!.reason } : {}) } : { action: 'skipped-empty' as const }) };
   if (config.mode === 'shadow' || !item) {
+    if (!item && lastDecisionFailure) return lastDecisionFailure;
     append(path, entry);
     if (config.mode === 'shadow') observe('shadow', { seat, item, status: entry.status });
     return entry;
@@ -1282,11 +1440,14 @@ export async function runSeatLoopOnce(seat: string, deps: SeatDeps = {}): Promis
   append(path, { ...entry, status: 'attempting' });
   try {
     if (action.kind === 'decision') {
-      const title = `${seat}: ${action.text.replace(/[\r\n]+/g, ' ')}`;
+      const title = `${seat}: ${decisionSummary(action.text)}`;
+      const source = decisionSourceRef(seat, item);
       const raised = await run(['decisions', 'raise', '--title', title, '--category', 'other',
-        '--s', `${seat} 배정 항목: ${action.text.replace(/[\r\n]+/g, ' ')}\n역할: ${inputs.role}`, '--c', '자동 실행 금지 문면에 해당하여 사람 결정이 필요하다',
+        '--s', decisionSummary(`${seat} 배정 항목: ${action.text.replace(/[\r\n]+/g, ' ')} 역할: ${inputs.role}`),
+        '--c', '자동 실행 금지 문면에 해당하여 사람 결정이 필요하다',
         '--option', 'a=사람 승인:승인 후 별도로 집행', '--option', 'b=보류:집행하지 않음',
-        '--skip-recommend', '금지 문면은 자동으로 권고하지 않는다', '--no-xcheck', '자리 루프 · 이웃 교환은 DEC-XCHECK ②', '--agent', 'seat-loop', '--json']);
+        '--skip-recommend', '금지 문면은 자동으로 권고하지 않는다', '--no-xcheck', '자리 루프 · 이웃 교환은 DEC-XCHECK ②',
+        '--agent', 'seat-loop', '--ref', source, '--json']);
       const decision: unknown = JSON.parse(raised.trim());
       if (!decision || typeof decision !== 'object' || typeof (decision as { id?: unknown }).id !== 'string') {
         throw new Error('decisions raise returned no decision id');
@@ -1297,6 +1458,38 @@ export async function runSeatLoopOnce(seat: string, deps: SeatDeps = {}): Promis
       return entry;
     }
     if (config.mode === 'live-safe') {
+      const limit = repeatStopLimit(config);
+      const attempts = unlandedAttemptCount(seat, item, ledger, stateRoot, deps);
+      if (attempts >= limit && !personReopened(ledger, seat, item, stateRoot)) {
+        const reason = repeatStopReason(attempts);
+        entry.status = 'held';
+        entry.reason = reason;
+        const ref = decisionRef(seat, item);
+        const prior = new DecisionLedger({ stateDir: stateRoot }).list({ status: 'all' }).find((card) => card.refs?.includes(ref) && card.status === 'open');
+        if (!prior) {
+          cardLedger(stateRoot, deps, now).raiseOnce({
+            title: `${seat}: ${item.id} 반복 착지 0`,
+            category: 'other',
+            scqa: {
+              s: `${seat} 칸 ${item.id} 가 착지 없이 ${attempts}회 끝났다.`,
+              c: '같은 칸을 다시 발사하지 않고 사람 판단을 기다린다.',
+              q: '이 칸을 계속할까, 멈출까?',
+            },
+            options: [
+              { key: 'a', label: '다시 연다', consequence: '결정 뒤에 자리 루프가 한 번 더 시도할 수 있다' },
+              { key: 'b', label: '멈춘다', consequence: '같은 칸은 다시 발사하지 않는다' },
+            ],
+            recommendation: { skipped: true, reason: '착지 없는 반복만으로 계속할지 자동 결정하지 않는다' },
+            raisedBy: { agent: 'seat-loop' },
+            refs: [ref],
+            raisedAt: now.toISOString(),
+            crossCheckSkipped: '반복 정지는 사람 판단',
+          }, ref);
+        }
+        append(path, entry);
+        observe('repeat-stopped', { seat, item: item.id, attempts, lastQueueId: [...ledger].reverse().find((row) => row.seat === seat && row.item && handledItemKey(row.item) === handledItemKey(item) && row.queueId)?.queueId ?? null });
+        return entry;
+      }
       let queued: { id: string };
       try {
         queued = await (deps.enqueue ?? ((assigned, text, root, idempotencyKey) => addHarnessQueue({ seat: assigned, say: text, idempotencyKey }, { root })))(seat, action.text, stateRoot, queueKey(seat, item));
@@ -1332,9 +1525,19 @@ export async function runSeatLoopOnce(seat: string, deps: SeatDeps = {}): Promis
     observe('launched', { seat, item, runId });
     return entry;
   } catch (error) {
-    append(path, { ...entry, status: 'outcome-unknown' });
+    const failure: SeatEntry = { ...entry, status: 'outcome-unknown' };
+    append(path, failure);
+    if (action.kind === 'decision') {
+      lastDecisionFailure = failure;
+      const source = decisionSourceRef(seat, item);
+      try { debug.log('seat-loop', 'decision-raise-failed', { source, error: String(error) }); }
+      catch { /* A failed observation cannot interrupt the remaining items. */ }
+      failedDecisions.add(itemKey(item));
+      continue;
+    }
     throw error;
   }
+  }
   } catch (error) {
     turnError = error;
     throw error;

package/src/self-dev/ask-launch-flow.ts

@@ -11,6 +11,7 @@
 // ⛔ 종료(`process.exit`)는 여기가 «안» 한다 — 호출자가 자기 표면에 맞게 끝낸다.
 //   그래서 결과를 «세 값»으로 낸다: 발사 / 저작 전 중단 / 전제 검사 중단.
 import { linesOutsideFencedCode } from '../self-implement/goal-author.js';
+import { recordAuthoredGoal } from './authored-goal-trace.js';
 import { retiredEntranceNotice, type EntranceDeclaration } from './entrance-registry.js';
 import {
   classifyConcurrentAuthoring,
@@ -58,7 +59,7 @@ function resolveSelfResolveClarifications(explicit: boolean | undefined): Resolv
 /** 저작기 산출 — `runGoalAuthorCli` 의 반환에서 이 흐름이 «실제로 쓰는» 것만. */
 export interface AskAuthoredGoal {
   readonly path: string;
-  readonly authored?: { readonly document?: string; readonly grounded?: boolean | null } | null;
+  readonly authored?: { readonly document?: string; readonly grounded?: boolean | null; readonly authorRunId?: string } | null;
 }
 
 export type LaunchingTreeProbe =
@@ -158,6 +159,8 @@ export interface AskLaunchFlowDeps {
   /** ⛔ 못 얻으면 `null` — 같은 이유. */
   recentAuthoringSamples(): RecentAuthoringSample[] | null;
   authorGoal(args: readonly string[], options: Record<string, unknown>): Promise<AskAuthoredGoal>;
+  /** AUTHOR-TRACE seam (tests). */
+  recordAuthoredGoal?: typeof recordAuthoredGoal;
   /** Pod launches reserve a host slot before goal authoring begins. */
   beforeAuthoring?(): Promise<void>;
   /** 발사 전 권고용 분해 seam. 생략하면 전용 관측명을 준 기존 분해기를 쓴다. */
@@ -861,6 +864,24 @@ export async function runAskLaunchFlow(
       selfResolveClarifications: selfResolveClarifications.value,
     });
     deps.print(`[ask] 저작됨: ${authored.path}`);
+    // AUTHOR-TRACE: the authored goal file can be cleaned up later — keep path ⊕ sha256 ⊕ size in the run ledger and
+    // archive the body, so authoring length is measurable after the fact (GOAL-BENCH · AUTHOR-LITE).
+    const traceIds = {
+      ...(input.runId === undefined ? {} : { runId: input.runId }),
+      ...(authored.authored?.authorRunId === undefined ? {} : { authorRunId: authored.authored.authorRunId }),
+    };
+    if (authored.authored?.document !== undefined && (traceIds.runId !== undefined || traceIds.authorRunId !== undefined)) {
+      try {
+        const trace = (deps.recordAuthoredGoal ?? recordAuthoredGoal)(traceIds, authored.path, authored.authored.document);
+        deps.log('goal-authored-trace', { ...traceIds, ...trace }, 'info');
+      } catch (error) {
+        deps.log('goal-authored-trace-failed', { ...traceIds, error: error instanceof Error ? error.message : String(error) }, 'warn');
+      }
+    } else {
+      deps.log('goal-authored-trace-skipped', {
+        reason: authored.authored?.document === undefined ? 'no-authored-document' : 'no-run-or-author-id', path: authored.path,
+      }, 'warn');
+    }
     const markerCounts = authored.authored?.document === undefined
       ? null
       : countMissingAuthoredConstraintMarkers(input.askText, authored.authored.document);

package/src/self-dev/authored-goal-trace.ts

@@ -0,0 +1,64 @@
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { appendRunLedgerEntry, runLedgerDir } from '../self-implement/run-ledger.js';
+import { debug } from '../debug/log.js';
+
+/** AUTHOR-TRACE: what `harness say`/`ask` authored, kept with the run — the goal file itself may be cleaned up later,
+ *  so the ledger carries path ⊕ sha256 ⊕ size and the body is archived next to the ledger. */
+export interface AuthoredGoalTrace {
+  path: string;
+  sha256: string;
+  chars: number;
+  sections: number;
+  archivedAt: string;
+}
+
+/** `## ` headings outside fenced code (a fence closes only on the same marker, at least as long). */
+function countSections(document: string): number {
+  let fence: { char: string; length: number } | null = null;
+  let count = 0;
+  for (const line of document.split('\n')) {
+    const marker = /^ {0,3}(`{3,}|~{3,})/.exec(line);
+    if (fence) {
+      if (marker && marker[1]![0] === fence.char && marker[1]!.length >= fence.length && line.trim() === marker[1]) fence = null;
+      continue;
+    }
+    if (marker) { fence = { char: marker[1]![0]!, length: marker[1]!.length }; continue; }
+    if (/^ {0,3}##\s/.test(line)) count += 1;
+  }
+  return count;
+}
+
+export function authoredGoalTrace(path: string, document: string, archivedAt: string): AuthoredGoalTrace {
+  return {
+    path,
+    sha256: createHash('sha256').update(document).digest('hex'),
+    chars: [...document].length,
+    sections: countSections(document),
+    archivedAt,
+  };
+}
+
+/** Archive the body, emit one `goal-author`/`goal-authored` observation and — when the run id is already known —
+ *  append a `goal-authored` run-ledger event. At `harness say` authoring time the run id usually does not exist yet;
+ *  the authoring run id (`authorRunId`, joined to the goal by `goal-id-assigned`) keys the record then. */
+export function recordAuthoredGoal(
+  ids: { runId?: string; authorRunId?: string },
+  path: string,
+  document: string,
+  options: { ledgerDir?: string; archiveDir?: string } = {},
+): AuthoredGoalTrace {
+  const key = ids.runId ?? ids.authorRunId;
+  if (!key) throw new Error('recordAuthoredGoal needs a runId or an authorRunId');
+  const ledgerDir = options.ledgerDir ?? runLedgerDir();
+  const archiveDir = options.archiveDir ?? join(dirname(ledgerDir), 'authored-goals');
+  const digest = createHash('sha256').update(document).digest('hex');
+  const archived = join(archiveDir, `${key}-${digest.slice(0, 12)}.md`);
+  if (!existsSync(archiveDir)) mkdirSync(archiveDir, { recursive: true });
+  writeFileSync(archived, document, 'utf8');
+  const trace = authoredGoalTrace(path, document, archived);
+  debug.log('goal-author', 'goal-authored', { ...ids, ...trace });
+  if (ids.runId) appendRunLedgerEntry({ runId: ids.runId, event: 'goal-authored', data: { ...trace, ...(ids.authorRunId ? { authorRunId: ids.authorRunId } : {}) } }, ledgerDir);
+  return trace;
+}

package/src/self-dev/dev-cli.ts

@@ -43,6 +43,7 @@ import { observeDeliverables, type DeliverableObservationResult, type Deliverabl
 import { debug } from '../debug/log.js';
 import { getUserConfig, type UserConfig } from '../user-config.js';
 import { resolveChildLlmPreference, type ChildLlmPreferenceInput, type ResolvedChildLlmPreference } from '../self-implement/child-llm-preference.js';
+import { applyLaunchOverloadFailover, codexProviderNamed } from '../oauth/overload-failover-launch.js';
 import { readCachedGrokQuota } from '../oauth/codex-account-store.js';
 import { queryAbandonedDraftPrs, type AbandonedDraftPr } from '../cli/logs-abandoned-draft-prs.js';
 import { branchLineageSlug } from '../cli/pr-lineage.js';
@@ -1631,6 +1632,18 @@ function resolveChildLlmFromParts(
   return undefined;
 }
 
+/** Pinned `tools.selfImplement.childLlm` naming codex. Fallback-chain codex is not pinned. */
+function childLlmCodexPinned(flagProvider: string | undefined): boolean {
+  if (flagProvider !== undefined) return false;
+  try {
+    const preference = resolveChildLlmPreference(getUserConfig());
+    const provider = preference.chain[0]?.provider;
+    return preference.mode === 'pinned' && preference.source.chain === 'pinned' && codexProviderNamed(provider);
+  } catch {
+    return false;
+  }
+}
+
 export function buildChildLlmSelection(
   opts: Pick<DevCliOpts, 'childLlmProvider' | 'childLlmModel' | 'childLlmEffort'> & {
     /** 발사 인자가 있을 때 관측용 선호를 읽는다. 없으면 getUserConfig. 기존 두 인자 시그니처는 그대로다. */
@@ -1967,7 +1980,12 @@ export function buildDevCliSpec(
   }
 
   if (path === 'self-mission') {
-    const childLlm = buildChildLlmSelection({ ...opts, readPreference: () => getUserConfig() });
+    const builtChild = buildChildLlmSelection({ ...opts, readPreference: () => getUserConfig() });
+    const childLlm = applyLaunchOverloadFailover(builtChild, {
+      provider: opts.childLlmProvider,
+      model: opts.childLlmModel,
+      codexPinned: childLlmCodexPinned(opts.childLlmProvider),
+    });
     // 잔량 조회(약 3초)는 한 발사에 한 번만 — 자식·부모가 같은 값을 쓴다.
     let grokQuotaOnce: ReturnType<typeof readCachedGrokQuota> | undefined;
     const readGrokQuotaOnce = () => (grokQuotaOnce ??= readGrokQuota());

package/src/self-dev/dev-pipeline.ts

@@ -35,6 +35,7 @@ import type { DocumentReferenceStatus } from '../self-implement/self-implement-r
 import type { SelfDevGoal, OrchestrateSelfDevOptions, SelfDevJobResult } from './orchestrate.js';
 import { launchCapabilityObservation, resolveLaunchCapabilities } from './launch-capabilities.js';
 import { lookupEntrance, type EntranceId } from './entrance-registry.js';
+import { resolveLaunchStamp } from '../harness/launch-stamp.js';
 import type { IngestionEntry } from '../agent-substrate/execution/ingestion-policy.js';
 import type { ReviewerContextItem } from '../agent-substrate/pr-reviewer.js';
 import { resolveRunIdentity, type RunIdSource } from '../harness/harness-space.js';
@@ -42,7 +43,7 @@ import { addSelfDevRunParticipant, processBirthId, saveSelfDevRun } from './run-
 import { getUserConfig, resolveRoleLlm } from '../user-config.js';
 import { reviewReasoningEffort } from '../model-tier/review-effort.js';
 import { getProvider, inferProviderFromModel } from '../llm.js';
-import { buildReviewProviderAttempts, runReviewWithFallback, reviewFallbackModelsFromConfig } from './review-provider-fallback.js';
+import { buildReviewProviderAttempts, defaultReviewFallbackModel, runReviewWithFallback, reviewFallbackModelsFromConfig } from './review-provider-fallback.js';
 import type { DefaultSeamsOptions } from '../self-implement/seams.js';
 import { harnessTargetOptions, resolveHarnessTarget, revalidateHarnessTarget, type HarnessTargetResolution } from '../self-implement/harness-target-options.js';
 import { provisionRepository, type RepoProvisionResult } from '../self-implement/repo-provision.js';
@@ -609,6 +610,7 @@ export function toSelfImplementOptions(text: string, plan: ResolvedDevPlan, seam
     ...(s.correlationId !== undefined ? { correlationId: s.correlationId } : {}),
     ...(s.branchName ? { branchName: s.branchName } : {}),
     ...(s.maxReworkRounds !== undefined ? { maxReworkRounds: s.maxReworkRounds } : {}),
+    launch: resolveLaunchStamp({ entrance: plan.entrance, queueId: process.env.ELANOUS_HARNESS_QUEUE_LAUNCH }),
   };
 }
 
@@ -1093,10 +1095,12 @@ export async function buildDefaultSelfImplementSeams(
     provider: inferProviderFromModel(model) ? getProvider(model) : undefined,
     label,
   });
+  const primaryReviewAttempt = reviewAttemptForModel(reviewModel, 'primary');
   const reviewAttempts = buildReviewProviderAttempts(
-    reviewAttemptForModel(reviewModel, 'primary'),
-    reviewFallbackModels.map((model) => reviewAttemptForModel(model, model)),
-  );
+    primaryReviewAttempt,
+    [...reviewFallbackModels, defaultReviewFallbackModel(primaryReviewAttempt.provider?.name)]
+      .map((model) => reviewAttemptForModel(model, model)),
+  ).slice(0, 2);
   const defaultApiReview = async (prompt: string): Promise<string> => {
     const r = await runReviewWithFallback(
       reviewAttempts,
@@ -1859,9 +1863,9 @@ async function observeDevTaskDispatch(spec: DevPipelineSpec, plan: ResolvedDevPl
   }
 }
 
-async function inspectReleasePathBeforeMerge(seams: SelfImplementSeams, number: number, cwd: string): Promise<string | undefined> {
+async function inspectReleasePathBeforeMerge(seams: SelfImplementSeams, number: number, cwd: string, base?: string): Promise<string | undefined> {
   if (!seams.readPrFiles) throw new Error('release-path inspection unavailable — automatic merge refused');
-  const files = await seams.readPrFiles({ number, cwd });
+  const files = await seams.readPrFiles({ number, cwd, ...(base ? { base } : {}) });
   if (!Array.isArray(files) || !files.every((path) => typeof path === 'string')) throw new Error('invalid PR file list — automatic merge refused');
   const path = releasePathHold(files);
   if (!path) return undefined;
@@ -2103,10 +2107,11 @@ async function runDevPipelineDispatch(
       ...assembledSeams,
       ...(assembledSeams.mergePr ? { mergePr: async (input) => {
         let path: string | undefined;
-        try { path = await inspectReleasePathBeforeMerge(assembledSeams, input.number, input.cwd); }
+        try { path = await inspectReleasePathBeforeMerge(assembledSeams, input.number, input.cwd, plan.base); }
         catch (error) {
-          debug.log('self-dev.merge', 'release-path-inspection-failed', { number: input.number, error: String(error) });
-          return { merged: false, detail: `automatic merge refused: ${String(error)}` };
+          const rateLimited = error instanceof Error && (error as { rateLimited?: boolean }).rateLimited === true;
+          debug.log('self-dev.merge', 'release-path-inspection-failed', { number: input.number, error: String(error), ...(rateLimited ? { rateLimit: true } : {}) });
+          return { merged: false, detail: rateLimited ? `automatic merge refused: rate-limit: ${String(error)}` : `automatic merge refused: ${String(error)}` };
         }
         if (path) return { merged: false, detail: `OP approval required: ${path}` };
         return assembledSeams.mergePr!(input);