elanous 0.2.15 → 0.2.16

package/src/harness/nested-elanous-policy.ts

@@ -0,0 +1,114 @@
+// Nested elanous launch policy.
+//
+// Codex children drop parent env under shell_environment_policy inherit=core, so a
+// depth marker that only lives in the environment never arrives. Depth is therefore
+// carried on the codex argv (`-c shell_environment_policy.set.ELANOUS_NESTED_DEPTH=<n>`).
+//
+// Unset ELANOUS_NESTED_DEPTH is depth 0 (the outer launcher). A missing marker is
+// not "depth unknown" and does not refuse an ordinary mission spawn.
+// Refusal for a backend that cannot carry the marker applies only when a nested
+// elanous launch was actually requested (allow flag or config allow).
+//
+// Only depth 0 (the outer launcher) may allow a nested elanous launch. At depth >= 1
+// an allow flag is ignored and the launch stays refused.
+
+import { debug } from '../debug/log.js';
+
+export const ELANOUS_NESTED_DEPTH_ENV = 'ELANOUS_NESTED_DEPTH';
+
+/** Codex config key that sets the depth marker inside the child's shell policy. */
+export const CODEX_NESTED_DEPTH_CONFIG_KEY = `shell_environment_policy.set.${ELANOUS_NESTED_DEPTH_ENV}`;
+
+export type NestedElanousBackendName = 'codex' | 'claude' | 'gemini' | 'grok' | 'aside' | (string & {});
+
+export interface NestedElanousDecision {
+  readonly allowed: boolean;
+  readonly depth: number;
+  /** True when depth >= 1 supplied allow and it was ignored. */
+  readonly allowIgnored: boolean;
+  readonly reason: 'depth-0' | 'depth-0-allow' | 'depth-unknown' | 'nested-refused' | 'allow-ignored';
+}
+
+/** Current process depth from the nested-depth marker. Unset or unreadable = 0 (outer launcher). */
+export function readNestedElanousDepth(env: Record<string, string | undefined> = process.env): number {
+  const raw = env[ELANOUS_NESTED_DEPTH_ENV];
+  if (raw === undefined || raw.trim() === '') return 0;
+  if (!/^\d+$/.test(raw.trim())) return 0;
+  return Number(raw);
+}
+
+/** True when this backend can carry the depth marker to its child. Only codex can. */
+export function backendCarriesNestedDepth(backendName: string): boolean {
+  return backendName === 'codex';
+}
+
+/**
+ * Codex argv fragment that sets the child's depth marker.
+ * `depth` is the child's depth (parent + 1). Non-codex backends return [] — they cannot carry it.
+ */
+export function nestedDepthCodexArgs(backendName: string, childDepth: number): string[] {
+  if (backendName !== 'codex') return [];
+  if (!Number.isInteger(childDepth) || childDepth < 0) return [];
+  return ['-c', `${CODEX_NESTED_DEPTH_CONFIG_KEY}=${childDepth}`];
+}
+
+/**
+ * Allow decision. Depth 0 allows only when `allow` is true.
+ * Depth >= 1 always refuses; a supplied allow is ignored and logged.
+ */
+export function decideNestedElanousLaunch(input: {
+  readonly depth: number;
+  readonly allow?: boolean;
+}): NestedElanousDecision {
+  const depth = Number.isInteger(input.depth) && input.depth >= 0 ? input.depth : 0;
+  if (depth >= 1) {
+    if (input.allow === true) {
+      debug.log('agent-mission.nested', 'allow-ignored', { depth });
+      return { allowed: false, depth, allowIgnored: true, reason: 'allow-ignored' };
+    }
+    return { allowed: false, depth, allowIgnored: false, reason: 'nested-refused' };
+  }
+  if (input.allow === true) {
+    return { allowed: true, depth, allowIgnored: false, reason: 'depth-0-allow' };
+  }
+  return { allowed: false, depth, allowIgnored: false, reason: 'depth-0' };
+}
+
+/** Config `harness.nestedElanous`. Only `'allow'` counts, and only at depth 0. */
+export function configAllowsNestedElanous(
+  config: { harness?: { nestedElanous?: string } } | undefined,
+  depth: number,
+): boolean {
+  if (depth !== 0) return false;
+  return config?.harness?.nestedElanous === 'allow';
+}
+
+/**
+ * Gate a nested elanous launch.
+ *
+ * Ordinary mission spawn is not this gate: call it only when a nested elanous
+ * launch was requested. A backend that cannot carry the depth marker is then
+ * refused (`depth-unknown`) — including depth 0 with allow — because the child
+ * would not know its own depth. Unset depth is 0, not unknown.
+ *
+ * `allow` is the flag. Config allow counts only at depth 0 and never overrides
+ * a depth >= 1 refusal.
+ */
+export function gateNestedElanousLaunch(input: {
+  readonly backendName: string;
+  readonly depth: number;
+  /** True only when this call is gating a requested nested elanous launch. */
+  readonly nestedLaunchRequested: boolean;
+  readonly allow?: boolean;
+  readonly configAllow?: boolean;
+}): NestedElanousDecision {
+  const depth = Number.isInteger(input.depth) && input.depth >= 0 ? input.depth : 0;
+  if (!input.nestedLaunchRequested) {
+    return decideNestedElanousLaunch({ depth, allow: false });
+  }
+  if (!backendCarriesNestedDepth(input.backendName)) {
+    return { allowed: false, depth, allowIgnored: false, reason: 'depth-unknown' };
+  }
+  const allow = input.allow === true || (depth === 0 && input.configAllow === true);
+  return decideNestedElanousLaunch({ depth, allow });
+}

package/src/hq/hq.ts

@@ -206,7 +206,7 @@ function mutate(r: Resolved, decide: (record: LeaseRecord | null, now: number) =
 }
 
 export type LeaseAction = 'acquire' | 'renew' | 'status' | 'release';
-export function hqLease(action: LeaseAction, deps: HqDeps = {}, opts: { host?: string } = {}) {
+export function hqLease(action: LeaseAction, deps: HqDeps = {}, opts: { host?: string; expectedHolder?: string; expectedGeneration?: number } = {}) {
   const r0 = resolve(deps);
   const r = opts.host ? { ...r0, me: opts.host } : r0;
   if (action === 'status') {
@@ -215,9 +215,15 @@ export function hqLease(action: LeaseAction, deps: HqDeps = {}, opts: { host?: s
     noteSeen(r, record);
     return { ok: true as const, action, record, ageSeconds: record ? now - record.renewedAt : null, expired: record ? leaseExpired(record, now) : null };
   }
+  if (action === 'release' && ((opts.expectedHolder === undefined) !== (opts.expectedGeneration === undefined)
+    || (opts.expectedGeneration !== undefined && (!Number.isSafeInteger(opts.expectedGeneration) || opts.expectedGeneration < 1))
+    || (opts.expectedHolder !== undefined && !opts.expectedHolder)))
+    throw new Error('hq lease release: expected holder and positive generation must be supplied together');
   const local = readLocal(r.localPath);
+  const expected = opts.expectedHolder !== undefined && opts.expectedGeneration !== undefined
+    ? { holder: opts.expectedHolder, generation: opts.expectedGeneration } : undefined;
   const result = mutate(r, (record, now) => action === 'acquire' ? decideAcquire(record, r.me, now, r.ttl)
-    : action === 'renew' ? decideRenew(record, r.me, local.generation, now) : decideRelease(record, r.me));
+    : action === 'renew' ? decideRenew(record, r.me, local.generation, now) : decideRelease(record, r.me, expected));
   noteSeen(r, result.record);
   if (result.ok && action !== 'release') writeLocal(r.localPath, { holder: result.record.holder, generation: result.record.generation, confirmedAt: r.now(), ttlSeconds: result.record.ttlSeconds });
   if (result.ok && action === 'release') writeLocal(r.localPath, { ...local, holder: undefined, confirmedAt: undefined });

package/src/hq/lease.ts

@@ -39,8 +39,8 @@ export const leaseExpired = (record: LeaseRecord, now: number): boolean => recor
 /** acquire: only when there is no lease or it has expired; a new holder gets the next generation. */
 export function decideAcquire(record: LeaseRecord | null, me: string, now: number, ttlSeconds = DEFAULT_TTL_SECONDS):
   { ok: true; next: LeaseRecord } | { ok: false; reason: string } {
-  if (record && record.holder === me && !leaseExpired(record, now)) return { ok: true, next: { ...record, renewedAt: now, ttlSeconds } };
-  if (record && !leaseExpired(record, now)) return { ok: false, reason: `held by ${record.holder} (generation ${record.generation})` };
+  if (record && record.renewedAt !== 0 && record.holder === me && !leaseExpired(record, now)) return { ok: true, next: { ...record, renewedAt: now, ttlSeconds } };
+  if (record && record.renewedAt !== 0 && !leaseExpired(record, now)) return { ok: false, reason: `held by ${record.holder} (generation ${record.generation})` };
   return { ok: true, next: { holder: me, generation: (record?.generation ?? 0) + 1, acquiredAt: now, renewedAt: now, ttlSeconds, views: {}, dualUnreachableStreak: 0 } };
 }
 
@@ -52,8 +52,10 @@ export function decideRenew(record: LeaseRecord | null, me: string, generation:
   return { ok: true, next: { ...record, renewedAt: now, dualUnreachableStreak: 0 } };
 }
 
-export function decideRelease(record: LeaseRecord | null, me: string): { ok: true; next: LeaseRecord } | { ok: false; reason: string } {
+export function decideRelease(record: LeaseRecord | null, me: string, expected?: { holder: string; generation: number }): { ok: true; next: LeaseRecord } | { ok: false; reason: string } {
   if (!record || record.holder !== me) return { ok: false, reason: record ? `held by ${record.holder}` : 'no lease' };
+  if (expected && (record.holder !== expected.holder || record.generation !== expected.generation))
+    return { ok: false, reason: `lease changed: expected ${expected.holder} generation ${expected.generation}, observed ${record.holder} generation ${record.generation}` };
   return { ok: true, next: { ...record, renewedAt: 0 } };
 }
 

package/src/hq/transfer.ts

@@ -0,0 +1,185 @@
+import { appendFileSync, mkdirSync, readSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { getElanousConfigDir } from '../elanous-config-dir.js';
+import { getUserConfig } from '../user-config.js';
+import { defaultSshRunner, localShellRunner, parseLease, sshLeaseStore, type LeaseStore, type SshRunner } from './lease.js';
+import { promoteHq, type PromoteResult } from './promote.js';
+
+type Direction = 'promote' | 'handback';
+export interface TransferStep { step: string; status: 'done' | 'failed' | 'ready'; measurement: string }
+export interface TransferResult { ok: boolean; direction: Direction; from: string; to: string; runId: string; journal: string | null; steps: TransferStep[] }
+export interface TransferDeps {
+  store: LeaseStore;
+  run: SshRunner;
+  confirm: (question: string) => boolean;
+  promote: (host: string) => PromoteResult;
+  journalDir: string;
+}
+
+const aliases: Record<string, string[]> = { mbp: ['mbp', 'MacBookProM5'], node-b: ['node-b', 'MacStudioB1'] };
+const valid = (alias: string, holder: string) => aliases[alias]?.includes(holder) ?? false;
+const leaseCommand = (action: 'release' | 'acquire', expected?: { holder: string; generation: number }) =>
+  `elanous hq lease ${action}${expected ? ` --expected-holder '${expected.holder}' --expected-generation ${expected.generation}` : ''} --json`;
+const identityCommand = `python3 - <<'PY'
+import json, pathlib
+home=pathlib.Path.home()
+local=home/'.elanous-hq/host'
+config=home/'.elanous-hqcfg/config.json'
+name=local.read_text().strip() if local.exists() else json.loads(config.read_text())['hq']['hostName']
+print(name)
+PY`;
+const cronCommand = `crontab -l && printf '\\n---HQ-AUDIT---\\n' && elanous hq fence-audit --json`;
+const fenceCommand = `elanous hq fence --role cron -- sh -c 'printf "HQ_FENCE_ALLOWED:%s\\n" "$ELANOUS_HQ_GENERATION"'`;
+
+export function defaultTransferDeps(): TransferDeps {
+  const arbiter = getUserConfig().hq?.arbiter ?? 'cloud-vm';
+  return {
+    store: sshLeaseStore(arbiter, arbiter === 'local' ? localShellRunner : defaultSshRunner),
+    run: defaultSshRunner,
+    confirm: (question) => {
+      if (!process.stdin.isTTY) return false;
+      process.stderr.write(`${question}\nType TRANSFER to continue: `);
+      const buffer = Buffer.alloc(128);
+      const count = requireRead(buffer);
+      return buffer.toString('utf8', 0, count).trim() === 'TRANSFER';
+    },
+    promote: (host) => promoteHq(host, true),
+    journalDir: join(getElanousConfigDir(), 'hq', 'transfers'),
+  };
+}
+
+function requireRead(buffer: Buffer): number {
+  // Read one terminal line without treating EOF or a non-interactive caller as consent.
+  let size = 0;
+  while (size < buffer.length) {
+    const n = requireReadByte(buffer, size);
+    if (n === 0) break;
+    size += n;
+    if (buffer[size - 1] === 10) break;
+  }
+  return size;
+}
+
+function requireReadByte(buffer: Buffer, offset: number): number {
+  return readSync(0, buffer, offset, 1, null);
+}
+
+export function transferHq(direction: Direction, apply = false, deps: TransferDeps = defaultTransferDeps()): TransferResult {
+  const from = direction === 'promote' ? 'mbp' : 'node-b';
+  const to = direction === 'promote' ? 'node-b' : 'mbp';
+  const runId = randomUUID();
+  const journal = apply ? join(deps.journalDir, `${runId}.jsonl`) : null;
+  const steps: TransferStep[] = [];
+  const result = (ok: boolean): TransferResult => ({ ok, direction, from, to, runId, journal, steps });
+  const record = (step: string, status: TransferStep['status'], measurement: string) => {
+    const row = { step, status, measurement };
+    steps.push(row);
+    if (journal) {
+      mkdirSync(deps.journalDir, { recursive: true, mode: 0o700 });
+      appendFileSync(journal, `${JSON.stringify({ at: new Date().toISOString(), runId, direction, from, to, ...row })}\n`, { mode: 0o600 });
+    }
+    return status !== 'failed';
+  };
+  const lease = () => {
+    const { now, raw } = deps.store.read();
+    const current = parseLease(raw);
+    return { current, now };
+  };
+  const remote = (host: string, command: string) => {
+    const r = deps.run(host, command);
+    if (r.status !== 0) throw new Error(`${host}: ${r.stderr.trim() || r.stdout.trim() || `exit=${r.status}`}`);
+    return r.stdout.trim();
+  };
+  try {
+    const before = lease();
+    if (!before.current || !valid(from, before.current.holder) || before.current.renewedAt + before.current.ttlSeconds < before.now) {
+      record('① current lease', 'failed', `holder=${before.current?.holder ?? 'none'} generation=${before.current?.generation ?? 'none'} expired=${before.current ? before.current.renewedAt + before.current.ttlSeconds < before.now : true}`);
+      return result(false);
+    }
+    const source = remote(from, identityCommand);
+    const target = remote(to, identityCommand);
+    if (source !== before.current.holder || !valid(to, target) || source === target) {
+      record('② host identities', 'failed', `source=${source} holder=${before.current.holder} target=${target}`);
+      return result(false);
+    }
+    record('① current lease', 'done', `holder=${source} generation=${before.current.generation}`);
+    record('② host identities', 'done', `source=${source} target=${target}`);
+    for (const host of [from, to]) {
+      const inventory = remote(host, cronCommand);
+      const marker = '\n---HQ-AUDIT---\n';
+      const index = inventory.lastIndexOf(marker);
+      if (index < 0) throw new Error(`${host}: missing cron audit`);
+      const cron = inventory.slice(0, index);
+      const audit = JSON.parse(inventory.slice(index + marker.length)) as unknown;
+      const live = cron.split('\n').filter(line => line.trim() && !line.trimStart().startsWith('#'));
+      if (!Array.isArray(audit) || audit.length > 0 || !live.some(line => /hq heartbeat\b/.test(line)) || !live.some(line => /hq fence --role cron\b/.test(line))) {
+        record(`③ cron fence ${host}`, 'failed', `unfenced=${Array.isArray(audit) ? audit.length : 'invalid'} heartbeat=${live.some(line => /hq heartbeat\b/.test(line))} fenced=${live.some(line => /hq fence --role cron\b/.test(line))}`);
+        return result(false);
+      }
+      record(`③ cron fence ${host}`, 'done', `unfenced=0 heartbeat=true fenced=true`);
+    }
+    const oldFence = remote(from, fenceCommand);
+    const newFence = remote(to, fenceCommand);
+    if (oldFence !== `HQ_FENCE_ALLOWED:${before.current.generation}` || newFence.includes('HQ_FENCE_ALLOWED:')) {
+      record('④ pre-transfer fence', 'failed', `source=${oldFence} target=${newFence}`);
+      return result(false);
+    }
+    record('④ pre-transfer fence', 'done', `source=allowed generation=${before.current.generation} target=skipped`);
+    if (!apply) {
+      record('⑤ human confirmation', 'ready', 'dry-run: no writes; --apply requires interactive TRANSFER confirmation');
+      return result(true);
+    }
+    if (!deps.confirm(`Release ${source} generation ${before.current.generation}, acquire ${target}, and switch cron fence? This cannot undo work already sent.`)) {
+      record('⑤ human confirmation', 'failed', 'confirmation declined');
+      return result(false);
+    }
+    record('⑤ human confirmation', 'done', 'operator typed TRANSFER');
+    const still = lease().current;
+    if (!still || still.holder !== source || still.generation !== before.current.generation || still.renewedAt + still.ttlSeconds < deps.store.read().now) {
+      record('⑥ release old lease', 'failed', 'lease changed before release');
+      return result(false);
+    }
+    let released: { ok?: boolean; record?: { holder?: string; generation?: number } };
+    try { released = JSON.parse(remote(from, leaseCommand('release', { holder: source, generation: before.current.generation }))); }
+    catch (error) {
+      record('⑥ release old lease', 'failed', error instanceof Error ? error.message : String(error));
+      return result(false);
+    }
+    if (released.ok !== true || released.record?.holder !== source || released.record.generation !== before.current.generation) {
+      record('⑥ release old lease', 'failed', 'release not confirmed');
+      return result(false);
+    }
+    record('⑥ release old lease', 'done', `holder=${source} generation=${released.record.generation} released=true`);
+    const acquired = JSON.parse(remote(to, leaseCommand('acquire'))) as { ok?: boolean; record?: { holder?: string; generation?: number } };
+    const current = lease().current;
+    if (acquired.ok !== true || acquired.record?.holder !== target || acquired.record.generation !== before.current.generation + 1 || current?.holder !== target || current.generation !== acquired.record.generation) {
+      record('⑦ acquire new lease', 'failed', `expected=${target} generation=${before.current.generation + 1} observed=${current?.holder ?? 'none'} generation=${current?.generation ?? 'none'}; keep old host fenced, recover manually`);
+      return result(false);
+    }
+    record('⑦ acquire new lease', 'done', `holder=${target} generation=${current.generation}`);
+    if (direction === 'promote') {
+      const promoted = deps.promote(to);
+      for (const line of promoted.lines) record(`⑧ promotion ${line.step}`, line.status, line.measurement);
+      if (!promoted.ok) return result(false);
+    }
+    const sourceAfter = remote(from, fenceCommand);
+    const targetAfter = remote(to, fenceCommand);
+    const observed = lease().current;
+    if (sourceAfter.includes('HQ_FENCE_ALLOWED:') || targetAfter !== `HQ_FENCE_ALLOWED:${current.generation}` || observed?.holder !== target || observed.generation !== current.generation) {
+      record('⑨ final fence', 'failed', `source=${sourceAfter} target=${targetAfter} lease=${observed?.holder ?? 'none'} generation=${observed?.generation ?? 'none'}`);
+      return result(false);
+    }
+    record('⑨ final fence', 'done', `source=skipped target=allowed generation=${current.generation}`);
+    return result(true);
+  } catch (error) {
+    record('halt', 'failed', error instanceof Error ? error.message : String(error));
+    return result(false);
+  }
+}
+
+export function formatTransfer(result: TransferResult): string {
+  return [`hq ${result.direction}: ${result.ok ? 'ok' : 'failed'} · ${result.from} → ${result.to} · run=${result.runId}`,
+    ...result.steps.map(s => `${s.step}: ${s.status} · ${s.measurement}`),
+    ...(result.journal ? [`journal=${result.journal}`] : [])].join('\n');
+}

package/src/index.ts

@@ -27,10 +27,12 @@ import { installDevCompletionGuard } from './self-dev/dev-completion-guard.js';
 import { buildOrchestrateDecomposePrepareArgs, normalizeOrchestrateRequest, splitOrchestrateGoalTexts } from './self-dev/self-orchestrate-runtime.js';
 import { CLI_ENTRANCE_BASELINE, evaluateCommandEntranceBaseline } from './self-dev/entrance-baseline.js';
 import { CLI_HARNESS_DOGFOOD_ENTRANCE, CLI_HARNESS_ORCHESTRATE_ENTRANCE, describeEntranceCommand, listEntrancesWithModelExposure, renderLaunchEntrances, summarizeEntrances, type EntranceId } from './self-dev/entrance-registry.js';
+import { isOldDoorInternalCall, refuseOldDoor } from './self-dev/old-door.js';
 import { collectCommandEntrances, renderCommandEntrances } from './self-dev/entrance-inventory.js';
 import { isGoalAuthorFileName } from './self-implement/goal-document.js';
 import { DEV_PIPELINE_SINK_SURFACE } from './self-implement/self-cli-sink-surface.js';
 import { registerPrivateLedgerCommands } from './cli/private-ledger-commands.js';
+import { registerKnowCommand } from './cli/know-cli.js';
 import { registerSeatRequestsCommands } from './cli/seat-requests-cli.js';
 import { applyTestStateDirFlagFromArgv } from './cli/test-state-dir-flag.js';
 import { applyTestFlagFromArgv, observeTestFlagOwnership, uncoveredTestFlagPaths, staleTestFlagPaths } from './cli/test-flag.js';
@@ -53,6 +55,7 @@ export { runSchedule, scheduleCreatePlan } from './cli/schedule-cli.js';
 export type { ScheduleDispatch } from './cli/schedule-cli.js';
 import { registerReviewLoopOptions, buildReviewLoopOpts } from './agent-mission/review-loop-cli.js';
 import { registerCapabilitiesCommand } from './agent-mission/capabilities-cli.js';
+import { registerSupervisorMetricsCommand } from './agent-mission/supervisor-metrics-cli.js';
 import { agentBackendNames } from './agent-mission/driver.js';
 import { registerWhereCommand } from './cli/where-cli.js';
 import { registerShadowCommand } from './cli/shadow-cli.js';
@@ -70,6 +73,7 @@ import { registerFlowCommands } from './cli/flow-cli.js';
 import { registerModelWatchCommand } from './cli/model-watch-cli.js';
 import { registerIntakeCommands } from './cli/intake-cli.js';
 import { registerTasksCommands } from './cli/tasks-cli.js';
+import { registerBriefCommands } from './cli/brief-cli.js';
 import { registerLabelsCommands } from './cli/labels-cli.js';
 import { registerMsgCommands } from './cli/msg-cli.js';
 import { registerDoctorCommand } from './cli/doctor-cli.js';
@@ -875,6 +879,7 @@ registerUsageCommand(program);
 registerLiveCommands(program);
 registerResearchCommand(program);
 registerReleaseCommands(program);
+registerKnowCommand(program);
 registerFreezeCommands(program);
 registerFlowCommands(program);
 // HQ-HB · HQ-FENCE (10-04): one writer across mbp · node-b · cloud-vm — lease on the arbiter, 2-of-3 quorum, generation fencing.
@@ -893,24 +898,42 @@ hqCmd.command('host').description('이 머신의 HQ 호스트 이름 설정')
   });
 hqCmd.command('lease').argument('<action>', 'acquire|renew|status|release')
   .option('--host <name>', '이 호스트 이름(기본 ~/.elanous-hq/host · hq.hostName · os.hostname)')
+  .option('--expected-holder <name>', 'release CAS: 해제할 임대의 예상 소유자')
+  .option('--expected-generation <number>', 'release CAS: 해제할 임대의 예상 세대')
   .option('--json', 'JSON 출력')
-  .action(async (action: string, opts: { host?: string; json?: boolean }) => {
+  .action(async (action: string, opts: { host?: string; expectedHolder?: string; expectedGeneration?: string; json?: boolean }) => {
     try {
       if (!['acquire', 'renew', 'status', 'release'].includes(action)) throw new CliUserError(`hq lease: unknown action ${action}`, 'acquire|renew|status|release');
+      if ((opts.expectedHolder !== undefined || opts.expectedGeneration !== undefined) && action !== 'release')
+        throw new CliUserError('hq lease: expected holder/generation are only valid for release');
+      if ((opts.expectedHolder === undefined) !== (opts.expectedGeneration === undefined)
+        || (opts.expectedGeneration !== undefined && (!/^[1-9]\d*$/.test(opts.expectedGeneration) || !Number.isSafeInteger(Number(opts.expectedGeneration)))))
+        throw new CliUserError('hq lease release: supply both --expected-holder and --expected-generation (positive integer)');
       await hqSink();
       const { hqLease } = await import('./hq/hq.js');
-      const result = hqLease(action as 'acquire', {}, opts.host ? { host: opts.host } : {});
+      const result = hqLease(action as 'acquire', {}, {
+        ...(opts.host ? { host: opts.host } : {}),
+        ...(opts.expectedHolder !== undefined ? { expectedHolder: opts.expectedHolder, expectedGeneration: Number(opts.expectedGeneration) } : {}),
+      });
       if (opts.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
       else console.log(result.ok ? `hq lease ${action}: ok${'record' in result && result.record ? ` · holder ${result.record.holder} · generation ${result.record.generation}` : ''}` : `hq lease ${action}: refused — ${'reason' in result ? result.reason : ''}`);
       if (!result.ok) process.exitCode = 2;
     } catch (error) { if (error instanceof CliUserError) throw error; console.error(`hq lease: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
   });
 hqCmd.command('promote').description('HQ 승격 런북 (기본 dry-run · --apply 일 때만 변경)')
-  .requiredOption('--to <host>', '승격 대상 호스트')
-  .option('--apply', '대기 사본을 승격 우주에 반영하고 넥서스·rescue 실행')
+  .option('--to <host>', '기존 임대 취득 후 승격 대상 호스트 (생략하면 mbp → node-b 전환 포함)')
+  .option('--apply', '임대 이전 및 승격 실행 · 터미널 확인 필수 (기존 --to 경로는 임대 보유 필요)')
   .option('--json', 'JSON 출력')
   .action(async (opts: { to: string; apply?: boolean; json?: boolean }) => {
     try {
+      if (!opts.to) {
+        const { transferHq, formatTransfer } = await import('./hq/transfer.js');
+        const result = transferHq('promote', opts.apply === true);
+        if (opts.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
+        else console.log(formatTransfer(result));
+        if (!result.ok) process.exitCode = 1;
+        return;
+      }
       const { promoteHq, formatPromote } = await import('./hq/promote.js');
       const result = promoteHq(opts.to, opts.apply === true);
       if (opts.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
@@ -918,6 +941,18 @@ hqCmd.command('promote').description('HQ 승격 런북 (기본 dry-run · --appl
       if (!result.ok) process.exitCode = 1;
     } catch (error) { console.error(`hq promote: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
   });
+hqCmd.command('handback').description('node-b → mbp 임대·크론 울타리 복귀 (기본 읽기 전용)')
+  .option('--apply', '각 검사를 통과한 뒤 터미널 확인을 받고 이전 실행')
+  .option('--json', '단계별 결과·저널 경로 JSON 출력')
+  .action(async (opts: { apply?: boolean; json?: boolean }) => {
+    try {
+      const { transferHq, formatTransfer } = await import('./hq/transfer.js');
+      const result = transferHq('handback', opts.apply === true);
+      if (opts.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
+      else console.log(formatTransfer(result));
+      if (!result.ok) process.exitCode = 1;
+    } catch (error) { console.error(`hq handback: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
+  });
 hqCmd.command('heartbeat').description('보유자는 갱신 · 아니면 대기(보유자에 닿는지 중재자에 보고)').option('--json', 'JSON 출력')
   .action(async (opts: { json?: boolean }) => {
     try {
@@ -967,9 +1002,59 @@ registerSeatRequestsCommands(seatCmd);
 seatCmd.command('answer <askId> <answer>').description('자리 질문에 답을 남기고 원래 표면으로 회신 예약')
   .action(async (askId: string, answer: string) => {
     try {
-      const { answerSeatAsk } = await import('./seat-dispatch/seat-ask.js');
+      try { await (await import('./domains/standalone-log-sink.js')).registerStandaloneLogSink('seat-answer'); } catch { /* file trail remains available */ }
+      const { debug } = await import('./debug/log.js');
+      const { answerSeatAsk, deliverSeatAnswers, seatAskDeliveryInProgress, seatAskReplyInfo } = await import('./seat-dispatch/seat-ask.js');
       answerSeatAsk(askId, answer);
+      const { origin, askedAt, answeredAt } = seatAskReplyInfo(askId);
       console.log(`자리 답변 기록: ${askId}`);
+      if (origin.channel !== 'telegram') {
+        debug.log('seat.ask', 'reply-no-target', { id: askId, via: origin.channel });
+        console.log(`전달 대상 없음: ${askId} (${origin.channel})`);
+        return;
+      }
+      const token = process.env.TELEGRAM_BOT_TOKEN?.trim();
+      const elapsedMs = askedAt === null ? null : Math.max(0, answeredAt - askedAt);
+      if (!token) {
+        debug.log('seat.ask', 'reply-failed', { id: askId, via: 'telegram', reason: 'token-missing', elapsedMs });
+        console.log(`텔레그램 토큰 없음 (TELEGRAM_BOT_TOKEN): ${askId} · 회신 대기`);
+        return;
+      }
+      const botId = token.split(':')[0];
+      if (origin.botId && origin.botId !== botId) {
+        debug.log('seat.ask', 'reply-no-target', { id: askId, via: 'telegram', reason: 'bot-mismatch' });
+        console.log(`전달 대상 없음: ${askId} (수신 봇 불일치) · 회신 대기`);
+        return;
+      }
+      try {
+        let sent = false;
+        await deliverSeatAnswers({ askId, channel: 'telegram', botId, send: async (target, text) => {
+          if (target.channel !== 'telegram') throw new Error('seat ask belongs to another surface');
+          const response = await fetch(`https://api.telegram.org/bot${token}/sendMessage`, {
+            method: 'POST', headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ chat_id: target.chatId, text, reply_to_message_id: target.messageId,
+              ...(target.threadId === undefined ? {} : { message_thread_id: target.threadId }) }),
+          });
+          const result = await response.json() as { ok?: boolean; description?: string };
+          if (!response.ok || result.ok !== true) throw new Error(result.description ?? `Telegram HTTP ${response.status}`);
+          sent = true;
+        } });
+        if (!sent) {
+          if (seatAskDeliveryInProgress(askId)) {
+            debug.log('seat.ask', 'reply-in-progress', { id: askId, via: 'telegram', reason: 'claimed-by-other-worker' });
+            console.log(`다른 작업자가 전달 중: ${askId}`);
+          } else {
+            debug.log('seat.ask', 'reply-no-target', { id: askId, via: 'telegram', reason: 'not-claimed' });
+            console.log(`전달 대상 없음: ${askId} (회신 대기)`);
+          }
+          return;
+        }
+        debug.log('seat.ask', 'reply-sent', { id: askId, via: 'telegram', elapsedMs });
+        console.log(`텔레그램 회신 전달: ${askId} · 지연 ${elapsedMs === null ? '미상' : `${elapsedMs}ms`}`);
+      } catch (error) {
+        debug.log('seat.ask', 'reply-failed', { id: askId, via: 'telegram', reason: error instanceof Error ? error.message : String(error), elapsedMs });
+        console.log(`텔레그램 회신 실패: ${askId} · 회신 대기`);
+      }
     } catch (error) { console.error(`seat answer: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
   });
 seatCmd.command('loop').requiredOption('--seat <SEAT>', 'MK|OP|TC|UX')
@@ -1178,8 +1263,10 @@ program.command('self-update')
   .option('--keep <n>', '설치 뒤 남길 최근 판 수(설치본은 current·직전 판, 체크아웃은 current·데몬 판 보호 · 0 이면 정리 안 함)', '3')
   .option('--alert', '실패(exit≠0)를 알림으로도 보냄 — 크론(무인) 실행용')
   .option('--skip-pwa-build', '체크아웃 설치 전 PWA 빌드를 명시적으로 건너뜀')
+  .option('--dev', '판 사이 dev 빌드 설치 — versions/<판>-dev.<sha12> · install.json channel=dev · 이전 versionDir 보존 (사람 승인 · 자동 아님)')
+  .option('--rollback', 'install.json 의 이전 versionDir 로 current 를 되돌린다 (이전이 없으면 거부)')
   .option('--auto <on|off|status>', '자동 갱신 — macOS launchd · Linux systemd 타이머가 매일 04:17 에 `self-update --restart --alert` (크론이 이미 부르면 켜지 않는다)')
-  .action(async (opts: { from?: string; version?: string; restart?: boolean; json?: boolean; keep?: string; alert?: boolean; skipPwaBuild?: boolean; auto?: string }) => {
+  .action(async (opts: { from?: string; version?: string; restart?: boolean; json?: boolean; keep?: string; alert?: boolean; skipPwaBuild?: boolean; dev?: boolean; rollback?: boolean; auto?: string }) => {
     if (opts.auto !== undefined) {
       if (!['on', 'off', 'status'].includes(opts.auto)) { console.error(`--auto 는 on · off · status 중 하나: ${opts.auto}`); process.exitCode = 2; return; }
       const { runAutoUpdate } = await import('./cli/update-auto.js');
@@ -4259,6 +4346,12 @@ selfCmd
   .option('--supervise-rounds <n>', '슈퍼바이저 재개 라운드 상한 (기본 3 · 끄려면 --no-supervise)')
   .option('--json', '구조화 출력 {stage, ok, branch, worktree, prUrl?, merged?}')
   .action(async (parts: string[], opts: { featureFile?: string; base?: string; draft?: boolean; openPr?: boolean; autoMerge?: boolean; autoReview?: boolean; maxWait?: string; json?: boolean; plan?: boolean; enhance?: boolean; ground?: boolean; observeOnly?: boolean }) => {
+    if (!isOldDoorInternalCall('self-implement')) {
+      const refused = refuseOldDoor('self-implement');
+      debug.log('harness.entrance', 'old-door-refused', { door: refused.door, caller: refused.caller });
+      ui.error(refused.message);
+      process.exit(refused.exitCode);
+    }
     if (opts.featureFile && parts.length > 0) { ui.error('--feature-file 과 위치 인자 feature 는 함께 줄 수 없다'); process.exit(2); }
     let feature: string;
     try { feature = (opts.featureFile ? readFileSync(opts.featureFile, 'utf8') : parts.join(' ')).trim(); }
@@ -4418,6 +4511,12 @@ const selfOrchestrateCmd = selfCmd
   .option('--help-all', '모든 orchestrate 옵션 표시')
   .action(function (this: Command, parts: string[], opts: { goalFile?: string[]; concurrency?: string; autoMerge?: boolean; autoReview?: boolean; openPr?: boolean; base?: string; teardown?: boolean; resume?: string; board?: boolean; decompose?: boolean; fabricDecompose?: boolean; maxTasks?: string; supervise?: boolean; superviseRounds?: string; json?: boolean }) {
     return (async () => {
+    if (!isOldDoorInternalCall('self-orchestrate')) {
+      const refused = refuseOldDoor('self-orchestrate');
+      debug.log('harness.entrance', 'old-door-refused', { door: refused.door, caller: refused.caller });
+      ui.error(refused.message);
+      process.exit(refused.exitCode);
+    }
     // 위치 인자는 종전처럼 분리하고 파일 입력은 파일당 한 골이다.
     let inputGoals: ReturnType<typeof readSelfOrchestrateGoals>;
     try { inputGoals = readSelfOrchestrateGoals(parts, opts.goalFile); }
@@ -5943,6 +6042,7 @@ agentCmd.hook('preAction', async (_thisCommand, actionCommand) => {
 });
 
 registerCapabilitiesCommand(agentCmd);
+registerSupervisorMetricsCommand(agentCmd);
 
 agentCmd.command('install-from-docs <tool>')
   .description('공식 설치 문서를 읽고 안전한 설치 줄을 선택한다 — sudo는 사람에게 넘긴다')
@@ -6814,6 +6914,11 @@ const selfDevCmd = program
       // ⭐ `--ask`/`--say` — 발사 절차 넷을 «한 로직»으로. 저작 → 전제 검사 → 발사.
       //   ⛔ 여기서 저작한 골 파일을 아래 `--file` 자리에 그대로 넘긴다(새 실행 경로를 만들지 않는다).
       let askAuthoredFile: string | undefined;
+      if (opts.ask !== undefined && !isOldDoorInternalCall('dev-ask')) {
+        const refused = refuseOldDoor('dev-ask');
+        debug.log('harness.entrance', 'old-door-refused', { door: refused.door, caller: refused.caller });
+        throw new DevPipelineError(refused.message);
+      }
       const retirementInput = opts.ask !== undefined
         ? { kind: 'ask' as const, value: opts.ask }
         : opts.say !== undefined
@@ -7538,6 +7643,7 @@ missionCmd
   });
 
 registerTasksCommands(program);
+registerBriefCommands(program);
 registerLabelsCommands(program);
 registerMsgCommands(program);