elanous 0.2.15 → 0.2.16

package/src/cli/usage-cli.ts

@@ -10,6 +10,7 @@ import type { Command } from 'commander';
 import { collectUnifiedUsage, formatUnifiedUsage } from '../budget/unified-usage.js';
 import { consumeCodexResetCredits, listCodexResetCredits } from '../budget/codex-reset-credits.js';
 import { rollupRunUsage, type RunUsageInput } from '../budget/run-usage-rollup.js';
+import { formatUsageOutcomes, outcomeTableHasCodexGrokUnknown, queryUsageOutcomes, type UsageOutcomesDeps, type UsageOutcomesReport } from '../budget/usage-outcomes.js';
 import { LogStore, logsDbPath, type LogQuery, type LogStoreRow } from '../mss/logging/log-store.js';
 import { LOGS_SINCE_OPTION, parseSince } from './logs-cli.js';
 import { formatCodexCreditPlan, type CodexCreditPlan } from '../budget/codex-credit-plan.js';
@@ -28,6 +29,9 @@ export interface UsageCliDeps {
   /** 계정 이름 → CODEX_HOME. ⛔ 여기 없는 이름은 «거부»한다(모르는 곳에 쓰지 않는다). */
   readonly homes?: Readonly<Record<string, string>>;
   readonly exit?: (code: number) => never;
+  /** 런 원장 결과 표. 시험은 디렉터리를 주입한다. */
+  readonly outcomes?: (sinceDays: number) => UsageOutcomesReport;
+  readonly outcomeDeps?: UsageOutcomesDeps;
 }
 
 /** 계정 이름 → CODEX_HOME 기본 표.
@@ -134,6 +138,28 @@ export function registerUsageCommand(program: Command, deps: UsageCliDeps = {}):
   //   🩸 그래서 ⑴ `--yes` 없이는 «안 쓴다» ⑵ 쓰기 «전»에 남은 수를 보여 준다
   //      ⑶ 쓴 «뒤»에도 다시 조회해 「줄었나」를 값으로 낸다.
   //   📏 2026-09-24 현황 예: default 100%·team 100%·third 46% ⇒ third 에 쓰면 54% 가 버려진다.
+  const outcomes = deps.outcomes ?? ((sinceDays: number) => queryUsageOutcomes(sinceDays, deps.outcomeDeps));
+  usage
+    .command('outcomes')
+    .description('프로바이더별 무인 착지율 · 라운드 수 · 막힘 사유 분포 (런 원장 childProvider · 미기록은 불명)')
+    .option('--days <n>', '최근 N일', '2')
+    .option('--json', 'JSON 출력')
+    .action((opts: { days?: string; json?: boolean }, command: Command) => {
+      const json = opts.json || command.optsWithGlobals<{ json?: boolean }>().json;
+      const days = Number(opts.days);
+      if (!Number.isFinite(days) || days <= 0) {
+        out.log(`⛔ --days 는 양의 수: '${opts.days}'`);
+        exit(2);
+        return;
+      }
+      const report = outcomes(days);
+      if (json) {
+        out.log(JSON.stringify({ ...report, hasCodexGrokUnknown: outcomeTableHasCodexGrokUnknown(report) }, null, 2));
+        return;
+      }
+      out.log(formatUsageOutcomes(report));
+    });
+
   const list = deps.list ?? listCodexResetCredits;
   const consume = deps.consume ?? consumeCodexResetCredits;
   const homes = deps.homes ?? defaultHomes();

package/src/discord-self-message.ts

@@ -66,6 +66,7 @@ import { localOcrText } from './telegram-card-followup.js';
 import type { runGraph } from './graph-runner/runner.js';
 import { readSlashContextNow, renderTelegramNow } from './context-bus/context-now-surfaces.js';
 import type { ContextNowDeps } from './context-bus/context-now.js';
+import { botUnavailableSlashReply, deriveTuiSlashAvailability, type TuiSlashAvailability } from './maturity/tui-slash-availability.js';
 
 const SLASH_FOCUS_TURNS_DEFAULT = 8;
 
@@ -142,6 +143,8 @@ export interface DiscordSelfMessageDeps {
   log?: (msg: string) => void;
   cardFollowupDeps?: { ocrText?: (path: string) => Promise<string | null>; runGraph?: typeof runGraph; rootDir?: () => string };
   nowDeps?: ContextNowDeps;
+  /** Override the TUI slash projection for isolated message-path tests. */
+  tuiSlashAvailability?: readonly TuiSlashAvailability[];
 }
 
 /** Compose the full discord self+interweave onMessage handler. */
@@ -399,6 +402,12 @@ export function buildDiscordSelfOnMessage(deps: DiscordSelfMessageDeps): DcMessa
       log(`session cmd: ${ctx.text.trim().slice(0, 40)}`);
       return sessionReply;
     }
+    const slashName = /^\/([a-z0-9_-]{1,32})(?:\s|$)/i.exec(ctx.text.trim())?.[1]?.toLowerCase();
+    if (slashName) {
+      const entry = (deps.tuiSlashAvailability ?? deriveTuiSlashAvailability()).find(({ name }) => name === slashName);
+      const unavailable = botUnavailableSlashReply(entry, 'discord');
+      if (unavailable) return unavailable;
+    }
     log(`◀ ${ctx.userName ?? ctx.userId}: ${ctx.text.slice(0, 80)}${ctx.attachments.length ? ` (+첨부 ${ctx.attachments.length})` : ''}`);
     debug.log('discord.self.turn', 'inbound', { channelId: ctx.channelId, chars: ctx.text.length, attachments: ctx.attachments.length });
     // C2+ — 첨부 기억(사진만 먼저 올리는 패턴 지원). 명령 여부와 무관.

package/src/flow-loop/split.ts

@@ -0,0 +1,24 @@
+import type { TaskCard } from '../task-cards/card-store.js';
+
+export interface SplitCell { id: string; title: string; seat?: string; host?: string }
+
+/** FLOW1: only explicitly assigned work may enter a seat's queue. The same proposal is used in shadow and live. */
+export function splitCard(card: TaskCard, _opts: { shadow?: boolean } = {}): SplitCell[] {
+  const intake = [...card.sections].reverse().find(section => section.key.startsWith('intake:wish:'));
+  let text = card.title;
+  if (intake) {
+    let body: unknown;
+    try { body = JSON.parse(intake.content); } catch { body = intake.content; }
+    if (typeof body === 'string') text = body;
+    else if (body && typeof body === 'object' && typeof (body as { text?: unknown }).text === 'string') text = (body as { text: string }).text;
+  }
+  const lines = text.split(/\r?\n/).map(line => line.trim()).filter(Boolean);
+  const cells: SplitCell[] = lines.map((line, index) => {
+    const match = /^(?:[-*]|\d+[.)])?\s*\[(OP|MK|TC|UX)\]\s*(.+)$/u.exec(line);
+    if (match) return { id: `${card.id}-${index + 1}`, title: match[2]!.trim(), seat: match[1]! };
+    // 담당 없는 행도 칸으로 남긴다 — seat 가 없으니 대기열엔 못 들어가고 tick 이 unplaced-no-owner 로 센다.
+    return { id: `${card.id}-${index + 1}`, title: line.replace(/^(?:[-*]|\d+[.)])\s*/u, '') };
+  });
+  // 의뢰 본문이 있으면 담당이 하나도 없어도 행마다 칸으로 남긴다. 본문 없이 제목뿐일 때만 카드 한 칸.
+  return intake || cells.some(cell => cell.seat) ? cells : [{ id: card.id, title: card.title }];
+}

package/src/harness/harness-cli-command.ts

@@ -23,6 +23,7 @@ import { queryRunningRuns } from '../self-implement/running-runs.js';
 import { DevPipelineError } from '../self-dev/dev-pipeline.js';
 import { runDraftSweep, sweepFailureReason, type DraftSweepAdapters, type DraftSweepResult, type SweepDraft, type SweepMergedPr, type SweepReviewGate } from '../self-dev/draft-sweep.js';
 import { debug } from '../debug/log.js';
+import { decideNestedElanousLaunch, readNestedElanousDepth } from './nested-elanous-policy.js';
 import { dispatchTask, type DispatchTaskInput, type DispatchTaskDeps } from '../execution-loop/dispatch-task.js';
 import { launchRequestId, preLaunchGate, type PreLaunchGateDeps } from '../execution-loop/launch-gate.js';
 import { PR_LABELS } from '../github/pr-labels.js';
@@ -110,6 +111,8 @@ export interface HarnessAskSayOptions {
   supervisorSource?: HarnessSupervisorSource;
   goalType?: GoalType;
   correlation?: string;
+  /** Depth 0 only. At depth >= 1 this flag is ignored and the launch stays refused. */
+  nestedElanous?: 'allow';
 }
 
 export interface ResolvedHarnessSupervisor {
@@ -174,7 +177,8 @@ function registerHarnessCommonOptions(command: Command): Command {
     .option('--merge-by-host', 'Pod: merge-ready 까지 실행하고 병합은 발사 호스트가 재게이트')
     .option('--observe-only', 'elanous: child boot부터 SelfImplement 호출을 기록만 한다')
     .addOption(new Option('--no-supervise', 'self: supervisor 재개를 끔').hideHelp())
-    .option('--dry-run', '변경 없이 발사 계획만 출력');
+    .option('--dry-run', '변경 없이 발사 계획만 출력')
+    .addOption(new Option('--nested-elanous <policy>', '깊이 0만: 중첩 elanous 발사를 허용(allow). 깊이 1 이상은 무시되고 거부가 유지된다').choices(['allow']));
 }
 
 type HarnessDryRunOpts = { dryRun?: boolean };
@@ -299,9 +303,33 @@ function normalizeHarnessCommonOptions(opts: HarnessAskSayOptions): HarnessAskSa
     ...(opts.observeOnly ? { observeOnly: true } : {}),
     ...(opts.goalType !== undefined ? { goalType: opts.goalType } : {}),
     ...resolveHarnessSupervisor(opts),
+    ...resolveNestedElanousOption(opts),
   };
 }
 
+export class NestedElanousRefused extends Error {
+  constructor(readonly depth: number) {
+    super(`nested elanous refused (allow-ignored, depth ${depth})`);
+    this.name = 'NestedElanousRefused';
+  }
+}
+
+/**
+ * Depth 0 may keep `--nested-elanous allow`.
+ * Depth >= 1 cannot flip the refusal: the flag is ignored, logged, and the launch stops.
+ * No flag means an ordinary launch — unset depth is 0 and nothing is refused here.
+ */
+export function resolveNestedElanousOption(
+  opts: Pick<HarnessAskSayOptions, 'nestedElanous'>,
+  env: Record<string, string | undefined> = process.env,
+): { nestedElanous?: 'allow' } {
+  if (opts.nestedElanous !== 'allow') return {};
+  const decision = decideNestedElanousLaunch({ depth: readNestedElanousDepth(env), allow: true });
+  if (decision.reason === 'allow-ignored') throw new NestedElanousRefused(decision.depth);
+  if (!decision.allowed) return {};
+  return { nestedElanous: 'allow' };
+}
+
 function normalizeHarnessAskSayOptions(opts: HarnessAskSayChildLlmOptions): HarnessAskSayChildLlmOptions {
   return {
     ...normalizeHarnessCommonOptions(opts),
@@ -704,7 +732,13 @@ async function dispatchHarnessAskSay(
     const podSeat = resolved.substrate === 'pod' && ['OP', 'TC', 'MK', 'UX'].includes(inheritedSeat ?? '')
       ? inheritedSeat as QueueSeat : undefined;
     const stampedSeat = resolved.substrate === 'pod' ? opts.seat ?? queueSeat ?? podSeat ?? assigned : assigned;
-    const stampedOpts = stampedSeat ? { ...opts, seat: stampedSeat } : opts;
+    // Depth >= 1 cannot re-allow. Drop the flag here so the launch sees the refusal, not the raw argv.
+    const nested = resolveNestedElanousOption(opts);
+    const stampedOpts = {
+      ...opts,
+      ...(stampedSeat ? { seat: stampedSeat } : {}),
+      ...(nested.nestedElanous ? { nestedElanous: nested.nestedElanous } : { nestedElanous: undefined }),
+    };
     const launch = async () => {
       const previous = process.env.ELANOUS_HARNESS_SEAT;
       if (stampedSeat) process.env.ELANOUS_HARNESS_SEAT = stampedSeat;

package/src/harness/harness-pod-dispatch.ts

@@ -7,10 +7,14 @@
  *    매니페스트가 실은 런 계약(`ELANOUS_RUN_CONTRACT`)으로 자기가 Pod 인 줄 안다(graph-run-contract.ts).
  */
 import { spawn } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { hostname } from 'node:os';
 import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { selfDevRunsDir } from '../self-dev/run-store.js';
 import { findGitDir } from '../git-fs/locate.js';
+import { logsDbPath } from '../mss/logging/log-store.js';
+import { POD_REEMIT_LOGS_DB_ENV } from '../task-orchestrator/surfaces/pod-ledger-prod-sink.js';
 import { debug } from '../debug/log.js';
 import { ELANOUS_ENTRY_SCRIPT } from '../self-implement/seams.js';
 import { parsePodSourceSpec } from '../task-orchestrator/surfaces/pod-source-spec.js';
@@ -18,6 +22,7 @@ import { declaredGoalType, type GoalType } from '../self-implement/goal-author.j
 import { appendRunLedgerEntry } from '../self-implement/run-ledger.js';
 import { HARNESS_RUN_ID_ENV } from './harness-space.js';
 import { podMemoryLimitFor, type PodMemoryTier } from '../task-orchestrator/surfaces/self-implement-pod.js';
+import { oldDoorInternalEnv } from '../self-dev/old-door.js';
 import { selectPodMemoryTier } from './pod-memory-policy.js';
 
 export interface HarnessPodDispatchInput {
@@ -46,44 +51,6 @@ export interface HarnessPodDispatchInput {
   readonly authorOnPod?: boolean;
 }
 
-/** 골 본문에 넣을 문장 — 코드 펜스가 문장을 삼키지 않게 백틱 런을 늘린다. */
-export function fenceVerbatimSentence(sentence: string): { fence: string; body: string } {
-  const body = sentence.replace(/\r\n/g, '\n');
-  const longest = body.match(/`+/g)?.reduce((n, run) => Math.max(n, run.length), 0) ?? 0;
-  return { fence: '`'.repeat(Math.max(3, longest + 1)), body };
-}
-
-/** Pod 가 문장 그대로 `harness say` 를 돌리게 하는 골. 자격·풀은 기존 Pod 주입을 그대로 쓴다. */
-export function authorOnPodGoal(sentence: string): string {
-  const { fence, body } = fenceVerbatimSentence(sentence);
-  return [
-    '# 골: Pod 안에서 harness say 저작',
-    '',
-    '- GoalType: implement',
-    '- 대상 경로: src/harness/harness-pod-dispatch.ts',
-    '',
-    '## 할 일',
-    '',
-    '이 Pod 안에서, 그리고 이 Pod 안에서만, 아래 펜스의 문장을 한 글자도 바꾸지 않고',
-    '`elanous harness say --substrate local` 의 인자로 실행한다.',
-    '그 한 발이 골 저작·리뷰·게이트·구현·PR 까지 이 Pod 안에서 끝낸다.',
-    '호스트에는 발사 영수증과 원장만 남는다. 호스트에서 저작·리뷰·게이트를 지휘하지 않는다.',
-    '저작 자격은 이 Job 에 이미 주입된 Pod 자격 규칙을 그대로 쓴다.',
-    '',
-    '## 문장 (verbatim)',
-    '',
-    fence,
-    body,
-    fence,
-    '',
-    '## 수용 기준',
-    '',
-    '- 위 펜스 문장만으로 `elanous harness say --substrate local` 한 발이 이 Pod 에서 저작부터 PR 까지 간다.',
-    '- 그 명령의 종료 코드가 0 이 아니면 이 골은 실패다.',
-    '',
-  ].join('\n');
-}
-
 export function podOrchestrateArgs(input: HarnessPodDispatchInput, goalFile: string): string[] {
   return [
     ELANOUS_ENTRY_SCRIPT, 'self', 'orchestrate', '--goal-file', goalFile,
@@ -116,7 +83,9 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
       return 2;
     }
   }
-  const env = { ...process.env };
+  const env = { ...process.env, ...oldDoorInternalEnv('self-orchestrate') };
+  // POD-OBS(10-06): 자식 orchestrate 는 트리 파생 우주에서 돈다 — Pod 원장 재방출을 «발사한 집»의 logs.db 에도 남기게 경로를 넘긴다.
+  env[POD_REEMIT_LOGS_DB_ENV] = logsDbPath();
   let tempDir: string | undefined;
   let goalFile = '';
   let goalText: string;
@@ -124,21 +93,22 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
     goalFile = resolve(cwd, input.input);
     goalText = (deps.readFile ?? ((p) => readFileSync(p, 'utf8')))(goalFile);
   } else if (input.authorOnPod) {
-    const goal = authorOnPodGoal(input.input);
-    goalText = goal;
-    const root = findGitDir(cwd)?.root ?? cwd;
-    const runsDir = join(root, 'docs', 'goals');
+    // AUTHOR-POD2 (10-06) — the Pod runs `harness say` on the verbatim sentence itself (podJobManifest
+    // authorSentence branch). No wrapper goal and no host-side file under docs/goals: the 10-06 live run
+    // showed a wrapper goal is implemented as code by the Pod child instead of being executed.
+    goalText = input.input;
+    const runsDir = selfDevRunsDir();
     mkdirSync(runsDir, { recursive: true });
-    tempDir = mkdtempSync(join(runsDir, '.pod-author-'));
-    goalFile = join(tempDir, 'GOAL-pod-author-2026-10-05.md');
-    writeFileSync(goalFile, goal, { mode: 0o600 });
-    const runId = env[HARNESS_RUN_ID_ENV]?.trim();
-    const receipt = { entrance: input.entrance, host: 'receipt-only', authorOnPod: true, goalFile };
+    tempDir = mkdtempSync(join(runsDir, 'pod-author-'));
+    goalFile = join(tempDir, 'sentence.txt');
+    writeFileSync(goalFile, input.input, { mode: 0o600 });
+    const runId = env[HARNESS_RUN_ID_ENV]?.trim() || `run-${randomUUID()}`;
+    env[HARNESS_RUN_ID_ENV] = runId;
+    const receipt = { entrance: input.entrance, host: hostname(), runId, authorOnPod: true,
+      sentenceChars: input.input.length, sentenceSha256: createHash('sha256').update(input.input).digest('hex') };
     debug.log('harness.substrate', 'author-on-pod-receipt', receipt);
-    if (runId) {
-      try { appendRunLedgerEntry({ runId, event: 'author-on-pod-receipt', data: receipt }); }
-      catch (error) { debug.log('harness.substrate', 'author-on-pod-receipt-unwritten', { reason: error instanceof Error ? error.message : String(error) }); }
-    }
+    try { appendRunLedgerEntry({ runId, event: 'author-on-pod-receipt', data: receipt }); }
+    catch (error) { debug.log('harness.substrate', 'author-on-pod-receipt-unwritten', { reason: error instanceof Error ? error.message : String(error) }); }
   } else {
     const goal = input.input;
     goalText = goal;
@@ -176,9 +146,9 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
   if (input.after) env.ELANOUS_POD_AFTER = input.after;
   if (input.authorOnPod) env.ELANOUS_POD_AUTHOR_ON_POD = '1';
   else delete env.ELANOUS_POD_AUTHOR_ON_POD;
-  if (input.entrance === 'cli-harness-ask' || input.authorOnPod) {
+  if (input.entrance === 'cli-harness-ask') {
     const root = findGitDir(cwd)?.root;
-    const path = input.authorOnPod ? goalFile : resolve(cwd, input.input);
+    const path = resolve(cwd, input.input);
     const relativePath = root ? relative(realpathSync(root), realpathSync(path)) : '';
     if (relativePath && relativePath !== '..' && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath)) {
       env.ELANOUS_POD_GOAL_DOC = relativePath;
@@ -208,7 +178,7 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
     child.once('error', () => { cleanup(); resolveStatus(1); });
     child.once('close', (code, signal) => { cleanup(); resolveStatus(code ?? ((signal ?? forwarded) === 'SIGINT' ? 130 : 143)); });
   }));
-  const cleanup = () => { if (tempDir && !input.authorOnPod) rmSync(tempDir, { recursive: true, force: true }); };
+  const cleanup = () => { if (tempDir) rmSync(tempDir, { recursive: true, force: true }); };
   try {
     const status = run(process.execPath, args, env);
     if (typeof status === 'number' || status === null) {

package/src/harness/harness-seams.ts

@@ -727,10 +727,13 @@ export function buildHarnessSeams(deps: HarnessSeamsDeps): StagedHarnessSeams {
       let inspectionError: string | undefined;
       try {
         if (!deps.seams.readPrFiles) throw new Error('readPrFiles seam unavailable');
-        const prFiles = await deps.seams.readPrFiles({ number: pr.number, cwd });
+        const prFiles = await deps.seams.readPrFiles({ number: pr.number, cwd, ...(deps.base ? { base: deps.base } : {}) });
         if (!Array.isArray(prFiles) || !prFiles.every((path) => typeof path === 'string')) throw new Error('invalid PR file list');
         holdPath = releasePathHold(prFiles);
-      } catch (error) { inspectionError = String(error); }
+      } catch (error) {
+        const rateLimited = error instanceof Error && (error as { rateLimited?: boolean }).rateLimited === true;
+        inspectionError = rateLimited ? `rate-limit: ${String(error)}` : String(error);
+      }
       if (holdPath) {
         const protectedPath = holdPath;
         const prCwd = cwd;
@@ -745,7 +748,14 @@ export function buildHarnessSeams(deps: HarnessSeamsDeps): StagedHarnessSeams {
         observe('deployed-pr', { number: pr.number, url: pr.url, autoReview: false, mergeReason: 'release-path-hold' });
       } else if (inspectionError) {
         observe('release-path-inspection-failed', { number: pr.number, error: inspectionError });
-        observe('deployed-pr', { number: pr.number, url: pr.url, autoReview: false, mergeReason: 'release-path-inspection-failed' });
+        observe('deployed-pr', {
+          number: pr.number,
+          url: pr.url,
+          autoReview: false,
+          mergeReason: inspectionError.startsWith('rate-limit:')
+            ? 'release-path-inspection-failed: rate-limit'
+            : 'release-path-inspection-failed',
+        });
       } else {
         let autoReviewLabeled = false;
         if (labels?.includes(AUTO_REVIEW_LABEL)) {

package/src/harness/helper-repair.ts

@@ -2,6 +2,9 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { dirname, join } from 'node:path';
 import { debug } from '../debug/log.js';
+import { releasePathHold, releasePrFilePaths } from '../self-dev/release-path-guard.js';
+import { getUserConfig, type UserConfig } from '../user-config.js';
+import type { QueueItem, QueueSeat } from './harness-queue.js';
 import type { RunGh, ScannedStoppedPr, StoppedPrCategory } from './helper-scan.js';
 
 export interface RepairGoalInput {
@@ -62,26 +65,154 @@ export function repairInputsFromBody(body: string): { originalRequest: string; m
 
 export type RepairShadowRow = { pr: number; category: StoppedPrCategory; goalHash: string; at: string };
 
-/** 그림자: 수리 골을 저작해 헬퍼 원장에만 남긴다(발사·라벨 0) · 같은 PR 은 한 번만. */
-export async function recordRepairShadows(rows: readonly ScannedStoppedPr[], deps: { runGh: RunGh; root: string; now?: Date }): Promise<RepairShadowRow[]> {
+type RepairLedgerResult = 'shadow' | 'launched' | 'cap' | 'needs-human' | 'launch-failed';
+
+type RepairLedgerLine = {
+  pr: number; category: StoppedPrCategory; goalHash: string; at: string;
+  mode: 'shadow' | 'live'; goal: string; result: RepairLedgerResult;
+  /** Harness queue item id — the run itself starts on a later queue tick. */ queueId?: string; reason?: string;
+};
+
+const RELEASE_FILE_PAGE = 100;
+
+/** Changed files of the original PR. A failed read is a reason to hold, never a reason to launch. */
+async function changedFiles(pr: number, runGh: RunGh): Promise<string[]> {
+  const pages: unknown[] = [];
+  for (let page = 1; ; page++) {
+    const raw = await runGh(['api', '--method', 'GET', '--raw-field', `per_page=${RELEASE_FILE_PAGE}`, '--raw-field', `page=${page}`, `repos/{owner}/{repo}/pulls/${pr}/files`]);
+    const parsed: unknown = JSON.parse(raw);
+    if (!Array.isArray(parsed)) throw new Error('gh api PR files returned an invalid file list');
+    pages.push(parsed);
+    if (parsed.length < RELEASE_FILE_PAGE) break;
+  }
+  return releasePrFilePaths(pages);
+}
+
+const QUEUE_SEATS = ['OP', 'TC', 'MK', 'UX'] as const;
+
+/** 원 PR 의 자리 라벨(elanous:seat-<자리> 또는 자리 이름 라벨). 없거나 둘 이상이면 MK. */
+function seatOf(labels: readonly { name?: string }[] | undefined): QueueSeat {
+  const found = new Set<QueueSeat>();
+  for (const label of labels ?? []) {
+    const name = label.name ?? '';
+    const prefixed = /^elanous:seat-(OP|TC|MK|UX)$/.exec(name)?.[1];
+    const bare = (QUEUE_SEATS as readonly string[]).includes(name) ? name : undefined;
+    const seat = prefixed ?? bare;
+    if (seat) found.add(seat as QueueSeat);
+  }
+  return found.size === 1 ? [...found][0]! : 'MK';
+}
+
+function helperSettings(config: UserConfig | undefined): { mode: 'shadow' | 'live'; perDay: number } {
+  const helper = config?.harness?.helper;
+  return {
+    mode: helper?.repair === 'live' ? 'live' : 'shadow',
+    perDay: typeof helper?.repairPerDay === 'number' && Number.isSafeInteger(helper.repairPerDay) && helper.repairPerDay >= 0
+      ? helper.repairPerDay : 3,
+  };
+}
+
+/** 그림자(기본): 수리 골을 원장에만 남긴다. live: 같은 함수로 대기열에 넣고 원 PR 을 superseded 로 표시한다. 같은 PR 은 평생 한 번. */
+export async function recordRepairShadows(rows: readonly ScannedStoppedPr[], deps: {
+  runGh: RunGh; root: string; now?: Date;
+  config?: UserConfig;
+  /** 대기열 추가. 생략하면 addHarnessQueue — 실제 발사는 기존 대기열 틱이 한다. */
+  enqueue?: (input: { seat: QueueSeat; say: string; idempotencyKey: string }) => Promise<Pick<QueueItem, 'id'>>;
+}): Promise<RepairShadowRow[]> {
   const ledger = join(deps.root, 'helper', 'repairs.jsonl');
-  const seen = new Set<number>();
+  const prior: RepairLedgerLine[] = [];
   if (existsSync(ledger)) for (const line of readFileSync(ledger, 'utf8').split('\n')) {
     if (!line.trim()) continue;
-    try { seen.add((JSON.parse(line) as { pr: number }).pr); } catch { /* malformed line is skipped */ }
+    try { prior.push(JSON.parse(line) as RepairLedgerLine); } catch { /* malformed line is skipped */ }
+  }
+  const { mode, perDay } = helperSettings(deps.config ?? getUserConfig());
+  const day = (deps.now ?? new Date()).toISOString().slice(0, 10);
+  // Terminal results end a PR for good. A shadow line blocks only while still in shadow (live must still launch it),
+  // and a cap or failed launch blocks only for the same UTC day so the PR is retried tomorrow (ACP must-fix).
+  // Ledger lines written before results existed have no `result`; they were shadow records.
+  for (const line of prior) if (!line.result) line.result = 'shadow';
+  const seen = new Set(prior.filter((line) => line.result === 'launched' || line.result === 'needs-human'
+    || (line.result === 'shadow' && mode === 'shadow')
+    || ((line.result === 'cap' || line.result === 'launch-failed') && line.at.slice(0, 10) === day)).map((line) => line.pr));
+  // Distinct PRs: a follow-up repair line for an already launched PR is not a second launch.
+  let launchedToday = new Set(prior.filter((line) => line.result === 'launched' && line.at.slice(0, 10) === day).map((line) => line.pr)).size;
+  // A launched line whose label/comment failed is repaired here — the follow-up only, never a second enqueue.
+  if (mode === 'live') {
+    const latest = new Map<number, RepairLedgerLine>();
+    for (const line of prior) latest.set(line.pr, line);
+    for (const line of latest.values()) {
+      if (line.result !== 'launched' || !line.reason?.startsWith('후속 실패') || !line.queueId) continue;
+      const followups: string[] = [];
+      if (line.reason.includes('label ·')) {
+        try { await deps.runGh(['pr', 'edit', String(line.pr), '--add-label', 'elanous:superseded']); }
+        catch (error) { followups.push(`label · ${error instanceof Error ? error.message : String(error)}`); }
+      }
+      if (line.reason.includes('comment ·')) {
+        try { await deps.runGh(['pr', 'comment', String(line.pr), '--body', `수리 대기열 항목 ${line.queueId} 로 대체(런은 대기열 틱에서 시작)`]); }
+        catch (error) { followups.push(`comment · ${error instanceof Error ? error.message : String(error)}`); }
+      }
+      const repaired: RepairLedgerLine = { ...line, at: (deps.now ?? new Date()).toISOString(), ...(followups.length ? { reason: `후속 실패 · ${followups.join(' · ')}` } : { reason: '후속 복구' }) };
+      appendFileSync(ledger, JSON.stringify(repaired) + '\n');
+      debug.log('harness.helper', 'repair-followup-retried', { pr: line.pr, queueId: line.queueId, remaining: followups.length });
+    }
   }
+  const enqueue = deps.enqueue ?? (async (input) => {
+    const { addHarnessQueue } = await import('./harness-queue.js');
+    return addHarnessQueue(input, { root: deps.root });
+  });
   const written: RepairShadowRow[] = [];
   for (const row of rows) {
     if ((row.category !== 'review-budget' && row.category !== 'review-oscillation') || seen.has(row.pr)) continue;
     const view = JSON.parse(await deps.runGh(['pr', 'view', String(row.pr), '--json', 'body'])) as { body: string };
+    // 자리 라벨은 본문 조회와 분리한다 — 기존 본문 조회 계약(--json body)을 그대로 둔다. 못 읽으면 MK.
+    let labels: { name?: string }[] | undefined;
+    if (mode === 'live') {
+      try { labels = (JSON.parse(await deps.runGh(['pr', 'view', String(row.pr), '--json', 'labels'])) as { labels?: { name?: string }[] }).labels; }
+      catch { labels = undefined; }
+    }
     const goal = authorRepairGoal({ pr: row.pr, category: row.category, ...repairInputsFromBody(view.body) });
     if (!goal) continue;
-    const entry: RepairShadowRow = { pr: row.pr, category: row.category, goalHash: createHash('sha256').update(goal).digest('hex').slice(0, 16), at: (deps.now ?? new Date()).toISOString() };
+    const at = (deps.now ?? new Date()).toISOString();
+    const base = { pr: row.pr, category: row.category, goalHash: createHash('sha256').update(goal).digest('hex').slice(0, 16), at, goal };
+    let record: RepairLedgerLine = { ...base, mode: 'shadow', result: 'shadow' };
+    if (mode === 'live') {
+      let files: string[] | undefined;
+      try { files = await changedFiles(row.pr, deps.runGh); }
+      catch (error) { files = undefined; debug.log('harness.helper', 'repair-files-unreadable', { pr: row.pr, reason: String(error) }); }
+      const release = files && releasePathHold(files);
+      // 상한은 «발사한 수»의 상한이다. 사람 승인이 필요한 PR 은 그 수를 쓰지 않으므로 상한보다 먼저 가른다.
+      if (files && !release && launchedToday >= perDay) {
+        record = { ...base, mode: 'live', result: 'cap', reason: '상한' };
+      } else if (!files) {
+        // An unreadable file list is transient: hold today, retry on a later day (never a permanent needs-human) (ACP must-fix).
+        record = { ...base, mode: 'live', result: 'launch-failed', reason: '변경 파일 조회 실패 · 다음 날 재시도' };
+      } else if (release) {
+        record = { ...base, mode: 'live', result: 'needs-human', reason: '사람 승인 필요' };
+      } else {
+        let item: Pick<QueueItem, 'id'> | undefined;
+        try {
+          item = await enqueue({ seat: seatOf(labels), say: goal, idempotencyKey: `helper-repair-${row.pr}` });
+          // The queue item exists from here on: a later label/comment failure is recorded on the launched line,
+          // never as launch-failed (which would let the next scan enqueue a second repair) (ACP must-fix).
+          const followups: string[] = [];
+          try { await deps.runGh(['pr', 'edit', String(row.pr), '--add-label', 'elanous:superseded']); }
+          catch (error) { followups.push(`label · ${error instanceof Error ? error.message : String(error)}`); }
+          try { await deps.runGh(['pr', 'comment', String(row.pr), '--body', `수리 대기열 항목 ${item.id} 로 대체(런은 대기열 틱에서 시작)`]); }
+          catch (error) { followups.push(`comment · ${error instanceof Error ? error.message : String(error)}`); }
+          record = { ...base, mode: 'live', result: 'launched', queueId: item.id, ...(followups.length ? { reason: `후속 실패 · ${followups.join(' · ')}` } : {}) };
+          launchedToday += 1;
+          debug.log('harness.helper', 'repair-launched', { pr: row.pr, queueId: item.id, mode: 'live', followupFailures: followups.length });
+        } catch (error) {
+          record = { ...base, mode: 'live', result: 'launch-failed', reason: `발사 실패 · ${error instanceof Error ? error.message : String(error)}` };
+          debug.log('harness.helper', 'repair-launch-failed', { pr: row.pr, reason: record.reason });
+        }
+      }
+    }
     mkdirSync(dirname(ledger), { recursive: true });
-    appendFileSync(ledger, JSON.stringify({ ...entry, mode: 'shadow', goal }) + '\n');
-    debug.log('harness.helper', 'repair-authored', { pr: row.pr, category: row.category, mode: 'shadow' });
+    appendFileSync(ledger, JSON.stringify(record) + '\n');
+    if (record.result === 'shadow') debug.log('harness.helper', 'repair-authored', { pr: row.pr, category: row.category, mode: 'shadow' });
     seen.add(row.pr);
-    written.push(entry);
+    written.push({ pr: base.pr, category: base.category, goalHash: base.goalHash, at: base.at });
   }
   return written;
 }

package/src/harness/helper-scan.ts

@@ -139,8 +139,19 @@ if (import.meta.main) {
       // 명시적 그림자 기록에서만 추가 PR 조회와 헬퍼 원장 쓰기를 수행한다(발사 0).
       const { recordRepairShadows } = await import('./helper-repair.js');
       const { effectiveInstanceRoot } = await import('../instance/resolve.js');
-      const shadows = await recordRepairShadows(rows, { runGh, root: effectiveInstanceRoot() });
-      if (shadows.length) console.log(`수리 골 그림자 ${shadows.length}건 → helper/repairs.jsonl`);
+      const { getUserConfig } = await import('../user-config.js');
+      const root = effectiveInstanceRoot();
+      const config = getUserConfig();
+      const live = config.harness?.helper?.repair === 'live';
+      const shadows = await recordRepairShadows(rows, {
+        runGh, root, config,
+        // live 만 대기열에 넣는다. 실제 발사는 기존 대기열 틱이 한다(새 발사 경로 0).
+        ...(live ? { enqueue: async (input) => {
+          const { addHarnessQueue } = await import('./harness-queue.js');
+          return addHarnessQueue(input, { root });
+        } } : {}),
+      });
+      if (shadows.length) console.log(live ? `수리 골 ${shadows.length}건 → helper/repairs.jsonl` : `수리 골 그림자 ${shadows.length}건 → helper/repairs.jsonl`);
     }
     if (json) console.log(JSON.stringify(rows, null, 2));
     else for (const row of rows) {