elanous 0.2.15 → 0.2.17

package/src/harness/harness-queue.ts

@@ -22,6 +22,7 @@ export type QueueSeat = 'OP' | 'TC' | 'MK' | 'UX';
 export type QueueItem = {
   id: string; seat: QueueSeat; kind: 'say' | 'ask'; input: string; hold: boolean; heavy: boolean;
   at: string; status: 'queued' | 'launching' | 'launched' | 'finished'; pid?: number; launchId?: string; idempotencyKey?: string; waitingReason?: string;
+  launchArgs?: string[]; launchCwd?: string; cellId?: string;
 };
 export type QueuePool = { running: number; pending: number; reserved: number; limit: number };
 export type QueueTick = { outcome: 'launched' | 'waiting' | 'skipped'; item?: QueueItem; reason: string };
@@ -53,6 +54,10 @@ export interface HarnessQueueDeps {
   cap?: (seat: QueueSeat) => number;
   pool?: () => QueuePool;
   launch?: (item: QueueItem, args: string[], root: string) => Promise<number>;
+  /** Test seam: runs after a direct CLI call enqueued its row and before that call's own tick (race tests). */
+  afterEnqueue?: (item: QueueItem) => void | Promise<void>;
+  /** Script the default launcher runs under the queue child wrapper (default bin/elanous.mjs). */
+  launchCommand?: string;
   alive?: (pid: number) => boolean;
   processes?: () => readonly QueueProcess[];
   receipt?: (root: string, launchId: string) => 'started' | 'finished' | 'not-started' | null;
@@ -143,6 +148,9 @@ function read(path: string): QueueItem[] {
     && (row.pid === undefined || Number.isSafeInteger(row.pid))
     && (row.launchId === undefined || typeof row.launchId === 'string')
     && (row.idempotencyKey === undefined || typeof row.idempotencyKey === 'string')
+    && (row.launchArgs === undefined || Array.isArray(row.launchArgs) && row.launchArgs.every((arg: unknown) => typeof arg === 'string'))
+    && (row.launchCwd === undefined || typeof row.launchCwd === 'string' && row.launchCwd.startsWith('/'))
+    && (row.cellId === undefined || typeof row.cellId === 'string')
     && (row.waitingReason === undefined || typeof row.waitingReason === 'string'))) {
     throw new Error('harness queue: invalid queue file (no launch)');
   }
@@ -207,7 +215,24 @@ function seat(value: string): QueueSeat {
   return value as QueueSeat;
 }
 
-export async function addHarnessQueue(input: { seat: string; say?: string; ask?: string; hold?: boolean; heavy?: boolean; idempotencyKey?: string }, deps: HarnessQueueDeps = {}): Promise<QueueItem> {
+/** Cell id named in a goal text (`칸: ONEDOOR-2` · `칸 ONEDOOR-2`) — ids carry at least one hyphen. */
+export function queueCellId(text: string): string | undefined {
+  return /칸[:\s]\s*([A-Z][A-Z0-9]*(?:-[A-Z0-9]+)+)/u.exec(text)?.[1];
+}
+
+/** A say row names its cell in the sentence; an ask row names it inside the goal document (unreadable → none). */
+function queueRowCellId(kind: QueueItem['kind'], input: string): string | undefined {
+  if (kind === 'say') return queueCellId(input);
+  try { return queueCellId(readFileSync(input, 'utf8')); } catch { return undefined; }
+}
+
+export class HarnessQueueDuplicateError extends Error {
+  constructor(existing: QueueItem, key: string) {
+    super(`같은 ${key} 이 이미 대기열에 있거나 도는 중이다 — ${existing.id} (${existing.status})`);
+  }
+}
+
+export async function addHarnessQueue(input: { seat: string; say?: string; ask?: string; hold?: boolean; heavy?: boolean; idempotencyKey?: string; launchArgs?: string[]; launchCwd?: string; refuseDuplicate?: boolean }, deps: HarnessQueueDeps = {}): Promise<QueueItem> {
   const assigned = seat(input.seat);
   if ((input.say === undefined) === (input.ask === undefined)) throw new Error('harness queue add: --say 또는 --ask 중 하나만 필요');
   const kind = input.ask === undefined ? 'say' : 'ask';
@@ -228,8 +253,24 @@ export async function addHarnessQueue(input: { seat: string; say?: string; ask?:
         return existing;
       }
     }
+    // Recorded at enqueue: a later edit or deletion of an ask document cannot reopen its cell.
+    const cellId = queueRowCellId(kind, value);
+    if (input.refuseDuplicate) {
+      const cell = cellId;
+      const existing = rows.find((row) => row.status !== 'finished'
+        && !['retryable', 'succeeded'].includes(queueRowOutcome(row, root))
+        && ((row.kind === kind && row.input === value) || (cell !== undefined && (row.cellId ?? queueRowCellId(row.kind, row.input)) === cell)));
+      if (existing) {
+        const key = existing.kind === kind && existing.input === value ? '골' : `칸 ${cell}`;
+        observe('skipped', { id: existing.id, seat: assigned, reason: 'duplicate', key }, deps);
+        throw new HarnessQueueDuplicateError(existing, key);
+      }
+    }
     const item: QueueItem = { id: `hq-${randomUUID()}`, seat: assigned, kind, input: value,
       hold: input.hold === true, heavy: input.heavy === true, at: new Date().toISOString(), status: 'queued',
+      ...(input.launchArgs === undefined ? {} : { launchArgs: input.launchArgs }),
+      ...(input.launchCwd === undefined ? {} : { launchCwd: input.launchCwd }),
+      ...(cellId === undefined ? {} : { cellId }),
       ...(input.idempotencyKey === undefined ? {} : { idempotencyKey: input.idempotencyKey }) };
     save(path, [...rows, item]);
     observe('enqueued', { id: item.id, seat: item.seat, kind }, deps);
@@ -318,6 +359,7 @@ export async function removeHarnessQueue(id: string, deps: HarnessQueueDeps = {}
 }
 
 export function queueLaunchArgs(item: QueueItem): string[] {
+  if (item.launchArgs) return item.launchArgs;
   return ['harness', item.kind, item.input, '--substrate', 'pod',
     ...(item.hold ? ['--no-auto-merge'] : []), ...(item.heavy ? ['--pod-memory', 'high'] : [])];
 }
@@ -468,15 +510,19 @@ function receipt(root: string, launchId: string): 'started' | 'finished' | 'not-
   }
 }
 
-async function launch(item: QueueItem, args: string[], root: string): Promise<number> {
+function defaultLaunch(command?: string) {
+  return (item: QueueItem, args: string[], root: string) => launch(item, args, root, command);
+}
+
+async function launch(item: QueueItem, args: string[], root: string, command?: string): Promise<number> {
   const repo = resolve(import.meta.dir, '../..');
   const logPath = join(root, 'harness', `${item.id}.log`);
   const fd = openSync(logPath, 'a', 0o600);
   try {
     const child = spawn(process.execPath, [join(repo, 'src', 'harness', 'harness-queue-child.ts'),
-      harnessQueueReceiptPath(root, item.launchId!), join(repo, 'bin', 'elanous.mjs'),
+      harnessQueueReceiptPath(root, item.launchId!), command ?? join(repo, 'bin', 'elanous.mjs'),
       ...(resolve(root) === prodInstanceRoot() ? [] : [`--test=${root}`]), ...args], {
-      cwd: repo, detached: true, stdio: ['ignore', fd, fd],
+      cwd: item.launchCwd ?? repo, detached: true, stdio: ['ignore', fd, fd],
       env: { ...process.env, ELANOUS_STATE_DIR: root, ELANOUS_HARNESS_SEAT: item.seat,
         ELANOUS_HARNESS_QUEUE_LAUNCH: item.launchId! },
     });
@@ -675,7 +721,7 @@ export function requestIdleSeats(root: string, now: Date, items: readonly QueueI
   }
 }
 
-export async function tickHarnessQueue(deps: HarnessQueueDeps = {}): Promise<QueueTick> {
+export async function tickHarnessQueue(deps: HarnessQueueDeps = {}, requestedId?: string): Promise<QueueTick> {
   const root = deps.root ?? effectiveInstanceRoot();
   return locked(root, async (path) => {
     try {
@@ -699,10 +745,20 @@ export async function tickHarnessQueue(deps: HarnessQueueDeps = {}): Promise<Que
     }
     const heads = new Map<QueueSeat, QueueItem>();
     for (const row of items) if (row.status === 'queued' && !heads.has(row.seat)) heads.set(row.seat, row);
+    if (requestedId && ![...heads.values()].some((row) => row.id === requestedId)) {
+      const row = items.find((item) => item.id === requestedId);
+      if (!row || row.status !== 'queued') return { outcome: 'skipped', item: row, reason: '이미 처리됨 또는 항목 없음' };
+      const reason = '앞선 대기열 항목 차례';
+      if (row.waitingReason !== reason) save(path, items.map((item) => item.id === requestedId ? { ...item, waitingReason: reason } : item));
+      observe('waiting', { id: row.id, seat: row.seat, reason }, deps);
+      return { outcome: 'waiting', item: { ...row, waitingReason: reason }, reason };
+    }
     if (!heads.size) { observe('skipped', { reason: 'empty' }, deps); return { outcome: 'skipped', reason: 'empty' }; }
     const lastSeat = lastLaunchedSeat(path);
     const first = lastSeat ? (queueSeatNames.indexOf(lastSeat) + 1) % queueSeatNames.length
       : queueSeatNames.indexOf(items.find((row) => row.status === 'queued')!.seat);
+    // A requested tick (direct CLI call) keeps the seat round-robin: it launches its row only when that row is the first
+    // head with room; an earlier seat's head with room means the requested row waits for its turn.
     const candidates = [...queueSeatNames.slice(first), ...queueSeatNames.slice(0, first)]
       .flatMap((name) => heads.get(name) ? [heads.get(name)!] : []);
     const config = deps.configPath === undefined ? getUserConfig() : getUserConfig(deps.configPath);
@@ -729,7 +785,9 @@ export async function tickHarnessQueue(deps: HarnessQueueDeps = {}): Promise<Que
           ...(details.injectedCap === undefined ? {} : { injectedCap: details.injectedCap }), capKeys: details.winners,
           attributed, unattributed }, deps);
       }
-      return { outcome: 'waiting', item: { ...candidates[0]!, waitingReason: blocked.get(candidates[0]!.seat)!.reason }, reason };
+      const subject = (requestedId ? candidates.find((item) => item.id === requestedId) : undefined) ?? candidates[0]!;
+      const subjectReason = blocked.get(subject.seat)!.reason;
+      return { outcome: 'waiting', item: { ...subject, waitingReason: subjectReason }, reason: requestedId ? subjectReason : reason };
     };
     for (const item of candidates) {
       const injectedCap = deps.cap?.(item.seat);
@@ -799,11 +857,32 @@ export async function tickHarnessQueue(deps: HarnessQueueDeps = {}): Promise<Que
           + current.filter((row) => row.status === 'launching' || row.status === 'launched').length, pool!.limit, deps);
       }
       if (finishHeld) { blocked.set(item.seat, { reason: finishHeld, active }); continue; }
+      if (requestedId && item.id !== requestedId) {
+        const requested = current.find((row) => row.id === requestedId)!;
+        // The requested row's own block is the truthful reason — even when its seat comes later in the rotation and was not
+        // evaluated yet; «another seat's turn» only when the requested seat itself has room.
+        const own = blocked.get(requested.seat)?.reason ?? (() => {
+          const ownCap = deps.cap?.(requested.seat);
+          const details = seatCapDetails({ seat: requested.seat, caps, gate, injectedCap: ownCap });
+          const charged = runs.filter((run) => !run.seat || run.seat === requested.seat);
+          const launchIds = new Set(charged.flatMap((run) => [...run.launchIds]));
+          const active = charged.length + current.filter((row) => row.seat === requested.seat &&
+            (row.status === 'launching' || row.status === 'launched')
+            && (!row.launchId || !launchIds.has(row.launchId))).length;
+          if (active >= details.cap) return seatCapReason(requested.seat, active, details);
+          const budget = decideSpawn({ seat: requested.seat, running: active, caps, gate, injectedCap: ownCap });
+          return budget.allow ? undefined : `${budget.reason}: ${seatCapReason(requested.seat, active, details)}`;
+        })();
+        const reason = own ?? `다른 자리 차례 — ${item.seat}`;
+        if (requested.waitingReason !== reason) save(path, current.map((row) => row.id === requestedId ? { ...row, waitingReason: reason } : row));
+        observe('waiting', { id: requested.id, seat: requested.seat, reason }, deps);
+        return { outcome: 'waiting', item: { ...requested, waitingReason: reason }, reason };
+      }
       const launching: QueueItem = { ...item, status: 'launching', launchId: `hq-${randomUUID()}` };
       delete launching.waitingReason;
       save(path, current.map((row) => row.id === item.id ? launching : row));
       try {
-        const pid = await (deps.launch ?? launch)(launching, queueLaunchArgs(launching), root);
+        const pid = await (deps.launch ?? defaultLaunch(deps.launchCommand))(launching, queueLaunchArgs(launching), root);
         if (!Number.isSafeInteger(pid) || pid < 1) throw new Error('launcher returned no pid');
         const launched: QueueItem = { ...launching, pid, status: 'launched' };
         save(path, current.map((row) => row.id === item.id ? launched : row));

package/src/harness/harness-seams.ts

@@ -727,10 +727,13 @@ export function buildHarnessSeams(deps: HarnessSeamsDeps): StagedHarnessSeams {
       let inspectionError: string | undefined;
       try {
         if (!deps.seams.readPrFiles) throw new Error('readPrFiles seam unavailable');
-        const prFiles = await deps.seams.readPrFiles({ number: pr.number, cwd });
+        const prFiles = await deps.seams.readPrFiles({ number: pr.number, cwd, ...(deps.base ? { base: deps.base } : {}) });
         if (!Array.isArray(prFiles) || !prFiles.every((path) => typeof path === 'string')) throw new Error('invalid PR file list');
         holdPath = releasePathHold(prFiles);
-      } catch (error) { inspectionError = String(error); }
+      } catch (error) {
+        const rateLimited = error instanceof Error && (error as { rateLimited?: boolean }).rateLimited === true;
+        inspectionError = rateLimited ? `rate-limit: ${String(error)}` : String(error);
+      }
       if (holdPath) {
         const protectedPath = holdPath;
         const prCwd = cwd;
@@ -745,7 +748,14 @@ export function buildHarnessSeams(deps: HarnessSeamsDeps): StagedHarnessSeams {
         observe('deployed-pr', { number: pr.number, url: pr.url, autoReview: false, mergeReason: 'release-path-hold' });
       } else if (inspectionError) {
         observe('release-path-inspection-failed', { number: pr.number, error: inspectionError });
-        observe('deployed-pr', { number: pr.number, url: pr.url, autoReview: false, mergeReason: 'release-path-inspection-failed' });
+        observe('deployed-pr', {
+          number: pr.number,
+          url: pr.url,
+          autoReview: false,
+          mergeReason: inspectionError.startsWith('rate-limit:')
+            ? 'release-path-inspection-failed: rate-limit'
+            : 'release-path-inspection-failed',
+        });
       } else {
         let autoReviewLabeled = false;
         if (labels?.includes(AUTO_REVIEW_LABEL)) {

package/src/harness/helper-repair.ts

@@ -2,6 +2,9 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { dirname, join } from 'node:path';
 import { debug } from '../debug/log.js';
+import { releasePathHold, releasePrFilePaths } from '../self-dev/release-path-guard.js';
+import { getUserConfig, type UserConfig } from '../user-config.js';
+import type { QueueItem, QueueSeat } from './harness-queue.js';
 import type { RunGh, ScannedStoppedPr, StoppedPrCategory } from './helper-scan.js';
 
 export interface RepairGoalInput {
@@ -62,26 +65,154 @@ export function repairInputsFromBody(body: string): { originalRequest: string; m
 
 export type RepairShadowRow = { pr: number; category: StoppedPrCategory; goalHash: string; at: string };
 
-/** 그림자: 수리 골을 저작해 헬퍼 원장에만 남긴다(발사·라벨 0) · 같은 PR 은 한 번만. */
-export async function recordRepairShadows(rows: readonly ScannedStoppedPr[], deps: { runGh: RunGh; root: string; now?: Date }): Promise<RepairShadowRow[]> {
+type RepairLedgerResult = 'shadow' | 'launched' | 'cap' | 'needs-human' | 'launch-failed';
+
+type RepairLedgerLine = {
+  pr: number; category: StoppedPrCategory; goalHash: string; at: string;
+  mode: 'shadow' | 'live'; goal: string; result: RepairLedgerResult;
+  /** Harness queue item id — the run itself starts on a later queue tick. */ queueId?: string; reason?: string;
+};
+
+const RELEASE_FILE_PAGE = 100;
+
+/** Changed files of the original PR. A failed read is a reason to hold, never a reason to launch. */
+async function changedFiles(pr: number, runGh: RunGh): Promise<string[]> {
+  const pages: unknown[] = [];
+  for (let page = 1; ; page++) {
+    const raw = await runGh(['api', '--method', 'GET', '--raw-field', `per_page=${RELEASE_FILE_PAGE}`, '--raw-field', `page=${page}`, `repos/{owner}/{repo}/pulls/${pr}/files`]);
+    const parsed: unknown = JSON.parse(raw);
+    if (!Array.isArray(parsed)) throw new Error('gh api PR files returned an invalid file list');
+    pages.push(parsed);
+    if (parsed.length < RELEASE_FILE_PAGE) break;
+  }
+  return releasePrFilePaths(pages);
+}
+
+const QUEUE_SEATS = ['OP', 'TC', 'MK', 'UX'] as const;
+
+/** 원 PR 의 자리 라벨(elanous:seat-<자리> 또는 자리 이름 라벨). 없거나 둘 이상이면 MK. */
+function seatOf(labels: readonly { name?: string }[] | undefined): QueueSeat {
+  const found = new Set<QueueSeat>();
+  for (const label of labels ?? []) {
+    const name = label.name ?? '';
+    const prefixed = /^elanous:seat-(OP|TC|MK|UX)$/.exec(name)?.[1];
+    const bare = (QUEUE_SEATS as readonly string[]).includes(name) ? name : undefined;
+    const seat = prefixed ?? bare;
+    if (seat) found.add(seat as QueueSeat);
+  }
+  return found.size === 1 ? [...found][0]! : 'MK';
+}
+
+function helperSettings(config: UserConfig | undefined): { mode: 'shadow' | 'live'; perDay: number } {
+  const helper = config?.harness?.helper;
+  return {
+    mode: helper?.repair === 'live' ? 'live' : 'shadow',
+    perDay: typeof helper?.repairPerDay === 'number' && Number.isSafeInteger(helper.repairPerDay) && helper.repairPerDay >= 0
+      ? helper.repairPerDay : 3,
+  };
+}
+
+/** 그림자(기본): 수리 골을 원장에만 남긴다. live: 같은 함수로 대기열에 넣고 원 PR 을 superseded 로 표시한다. 같은 PR 은 평생 한 번. */
+export async function recordRepairShadows(rows: readonly ScannedStoppedPr[], deps: {
+  runGh: RunGh; root: string; now?: Date;
+  config?: UserConfig;
+  /** 대기열 추가. 생략하면 addHarnessQueue — 실제 발사는 기존 대기열 틱이 한다. */
+  enqueue?: (input: { seat: QueueSeat; say: string; idempotencyKey: string }) => Promise<Pick<QueueItem, 'id'>>;
+}): Promise<RepairShadowRow[]> {
   const ledger = join(deps.root, 'helper', 'repairs.jsonl');
-  const seen = new Set<number>();
+  const prior: RepairLedgerLine[] = [];
   if (existsSync(ledger)) for (const line of readFileSync(ledger, 'utf8').split('\n')) {
     if (!line.trim()) continue;
-    try { seen.add((JSON.parse(line) as { pr: number }).pr); } catch { /* malformed line is skipped */ }
+    try { prior.push(JSON.parse(line) as RepairLedgerLine); } catch { /* malformed line is skipped */ }
+  }
+  const { mode, perDay } = helperSettings(deps.config ?? getUserConfig());
+  const day = (deps.now ?? new Date()).toISOString().slice(0, 10);
+  // Terminal results end a PR for good. A shadow line blocks only while still in shadow (live must still launch it),
+  // and a cap or failed launch blocks only for the same UTC day so the PR is retried tomorrow (ACP must-fix).
+  // Ledger lines written before results existed have no `result`; they were shadow records.
+  for (const line of prior) if (!line.result) line.result = 'shadow';
+  const seen = new Set(prior.filter((line) => line.result === 'launched' || line.result === 'needs-human'
+    || (line.result === 'shadow' && mode === 'shadow')
+    || ((line.result === 'cap' || line.result === 'launch-failed') && line.at.slice(0, 10) === day)).map((line) => line.pr));
+  // Distinct PRs: a follow-up repair line for an already launched PR is not a second launch.
+  let launchedToday = new Set(prior.filter((line) => line.result === 'launched' && line.at.slice(0, 10) === day).map((line) => line.pr)).size;
+  // A launched line whose label/comment failed is repaired here — the follow-up only, never a second enqueue.
+  if (mode === 'live') {
+    const latest = new Map<number, RepairLedgerLine>();
+    for (const line of prior) latest.set(line.pr, line);
+    for (const line of latest.values()) {
+      if (line.result !== 'launched' || !line.reason?.startsWith('후속 실패') || !line.queueId) continue;
+      const followups: string[] = [];
+      if (line.reason.includes('label ·')) {
+        try { await deps.runGh(['pr', 'edit', String(line.pr), '--add-label', 'elanous:superseded']); }
+        catch (error) { followups.push(`label · ${error instanceof Error ? error.message : String(error)}`); }
+      }
+      if (line.reason.includes('comment ·')) {
+        try { await deps.runGh(['pr', 'comment', String(line.pr), '--body', `수리 대기열 항목 ${line.queueId} 로 대체(런은 대기열 틱에서 시작)`]); }
+        catch (error) { followups.push(`comment · ${error instanceof Error ? error.message : String(error)}`); }
+      }
+      const repaired: RepairLedgerLine = { ...line, at: (deps.now ?? new Date()).toISOString(), ...(followups.length ? { reason: `후속 실패 · ${followups.join(' · ')}` } : { reason: '후속 복구' }) };
+      appendFileSync(ledger, JSON.stringify(repaired) + '\n');
+      debug.log('harness.helper', 'repair-followup-retried', { pr: line.pr, queueId: line.queueId, remaining: followups.length });
+    }
   }
+  const enqueue = deps.enqueue ?? (async (input) => {
+    const { addHarnessQueue } = await import('./harness-queue.js');
+    return addHarnessQueue(input, { root: deps.root });
+  });
   const written: RepairShadowRow[] = [];
   for (const row of rows) {
     if ((row.category !== 'review-budget' && row.category !== 'review-oscillation') || seen.has(row.pr)) continue;
     const view = JSON.parse(await deps.runGh(['pr', 'view', String(row.pr), '--json', 'body'])) as { body: string };
+    // 자리 라벨은 본문 조회와 분리한다 — 기존 본문 조회 계약(--json body)을 그대로 둔다. 못 읽으면 MK.
+    let labels: { name?: string }[] | undefined;
+    if (mode === 'live') {
+      try { labels = (JSON.parse(await deps.runGh(['pr', 'view', String(row.pr), '--json', 'labels'])) as { labels?: { name?: string }[] }).labels; }
+      catch { labels = undefined; }
+    }
     const goal = authorRepairGoal({ pr: row.pr, category: row.category, ...repairInputsFromBody(view.body) });
     if (!goal) continue;
-    const entry: RepairShadowRow = { pr: row.pr, category: row.category, goalHash: createHash('sha256').update(goal).digest('hex').slice(0, 16), at: (deps.now ?? new Date()).toISOString() };
+    const at = (deps.now ?? new Date()).toISOString();
+    const base = { pr: row.pr, category: row.category, goalHash: createHash('sha256').update(goal).digest('hex').slice(0, 16), at, goal };
+    let record: RepairLedgerLine = { ...base, mode: 'shadow', result: 'shadow' };
+    if (mode === 'live') {
+      let files: string[] | undefined;
+      try { files = await changedFiles(row.pr, deps.runGh); }
+      catch (error) { files = undefined; debug.log('harness.helper', 'repair-files-unreadable', { pr: row.pr, reason: String(error) }); }
+      const release = files && releasePathHold(files);
+      // 상한은 «발사한 수»의 상한이다. 사람 승인이 필요한 PR 은 그 수를 쓰지 않으므로 상한보다 먼저 가른다.
+      if (files && !release && launchedToday >= perDay) {
+        record = { ...base, mode: 'live', result: 'cap', reason: '상한' };
+      } else if (!files) {
+        // An unreadable file list is transient: hold today, retry on a later day (never a permanent needs-human) (ACP must-fix).
+        record = { ...base, mode: 'live', result: 'launch-failed', reason: '변경 파일 조회 실패 · 다음 날 재시도' };
+      } else if (release) {
+        record = { ...base, mode: 'live', result: 'needs-human', reason: '사람 승인 필요' };
+      } else {
+        let item: Pick<QueueItem, 'id'> | undefined;
+        try {
+          item = await enqueue({ seat: seatOf(labels), say: goal, idempotencyKey: `helper-repair-${row.pr}` });
+          // The queue item exists from here on: a later label/comment failure is recorded on the launched line,
+          // never as launch-failed (which would let the next scan enqueue a second repair) (ACP must-fix).
+          const followups: string[] = [];
+          try { await deps.runGh(['pr', 'edit', String(row.pr), '--add-label', 'elanous:superseded']); }
+          catch (error) { followups.push(`label · ${error instanceof Error ? error.message : String(error)}`); }
+          try { await deps.runGh(['pr', 'comment', String(row.pr), '--body', `수리 대기열 항목 ${item.id} 로 대체(런은 대기열 틱에서 시작)`]); }
+          catch (error) { followups.push(`comment · ${error instanceof Error ? error.message : String(error)}`); }
+          record = { ...base, mode: 'live', result: 'launched', queueId: item.id, ...(followups.length ? { reason: `후속 실패 · ${followups.join(' · ')}` } : {}) };
+          launchedToday += 1;
+          debug.log('harness.helper', 'repair-launched', { pr: row.pr, queueId: item.id, mode: 'live', followupFailures: followups.length });
+        } catch (error) {
+          record = { ...base, mode: 'live', result: 'launch-failed', reason: `발사 실패 · ${error instanceof Error ? error.message : String(error)}` };
+          debug.log('harness.helper', 'repair-launch-failed', { pr: row.pr, reason: record.reason });
+        }
+      }
+    }
     mkdirSync(dirname(ledger), { recursive: true });
-    appendFileSync(ledger, JSON.stringify({ ...entry, mode: 'shadow', goal }) + '\n');
-    debug.log('harness.helper', 'repair-authored', { pr: row.pr, category: row.category, mode: 'shadow' });
+    appendFileSync(ledger, JSON.stringify(record) + '\n');
+    if (record.result === 'shadow') debug.log('harness.helper', 'repair-authored', { pr: row.pr, category: row.category, mode: 'shadow' });
     seen.add(row.pr);
-    written.push(entry);
+    written.push({ pr: base.pr, category: base.category, goalHash: base.goalHash, at: base.at });
   }
   return written;
 }

package/src/harness/helper-scan.ts

@@ -139,8 +139,19 @@ if (import.meta.main) {
       // 명시적 그림자 기록에서만 추가 PR 조회와 헬퍼 원장 쓰기를 수행한다(발사 0).
       const { recordRepairShadows } = await import('./helper-repair.js');
       const { effectiveInstanceRoot } = await import('../instance/resolve.js');
-      const shadows = await recordRepairShadows(rows, { runGh, root: effectiveInstanceRoot() });
-      if (shadows.length) console.log(`수리 골 그림자 ${shadows.length}건 → helper/repairs.jsonl`);
+      const { getUserConfig } = await import('../user-config.js');
+      const root = effectiveInstanceRoot();
+      const config = getUserConfig();
+      const live = config.harness?.helper?.repair === 'live';
+      const shadows = await recordRepairShadows(rows, {
+        runGh, root, config,
+        // live 만 대기열에 넣는다. 실제 발사는 기존 대기열 틱이 한다(새 발사 경로 0).
+        ...(live ? { enqueue: async (input) => {
+          const { addHarnessQueue } = await import('./harness-queue.js');
+          return addHarnessQueue(input, { root });
+        } } : {}),
+      });
+      if (shadows.length) console.log(live ? `수리 골 ${shadows.length}건 → helper/repairs.jsonl` : `수리 골 그림자 ${shadows.length}건 → helper/repairs.jsonl`);
     }
     if (json) console.log(JSON.stringify(rows, null, 2));
     else for (const row of rows) {

package/src/harness/nested-elanous-policy.ts

@@ -0,0 +1,133 @@
+// Nested elanous launch policy.
+//
+// Codex children drop parent env under shell_environment_policy inherit=core, so a
+// depth marker that only lives in the environment never arrives. Depth is therefore
+// carried on the codex argv (`-c shell_environment_policy.set.ELANOUS_NESTED_DEPTH=<n>`).
+//
+// Unset ELANOUS_NESTED_DEPTH is depth 0 (the outer launcher). A missing marker is
+// not "depth unknown" and does not refuse an ordinary mission spawn.
+// Refusal for a backend that cannot carry the marker applies only when a nested
+// elanous launch was actually requested (allow flag or config allow).
+//
+// Only depth 0 (the outer launcher) may allow a nested elanous launch. At depth >= 1
+// an allow flag is ignored and the launch stays refused.
+
+import { debug } from '../debug/log.js';
+import { getUserConfig } from '../user-config.js';
+
+export const ELANOUS_NESTED_DEPTH_ENV = 'ELANOUS_NESTED_DEPTH';
+
+/** Codex config key that sets the depth marker inside the child's shell policy. */
+export const CODEX_NESTED_DEPTH_CONFIG_KEY = `shell_environment_policy.set.${ELANOUS_NESTED_DEPTH_ENV}`;
+
+export type NestedElanousBackendName = 'codex' | 'claude' | 'gemini' | 'grok' | 'aside' | (string & {});
+
+export interface NestedElanousDecision {
+  readonly allowed: boolean;
+  readonly depth: number;
+  /** True when depth >= 1 supplied allow and it was ignored. */
+  readonly allowIgnored: boolean;
+  readonly reason: 'depth-0' | 'depth-0-allow' | 'depth-unknown' | 'nested-refused' | 'allow-ignored' | 'depth-cap';
+}
+
+/** Current process depth from the nested-depth marker. Unset or unreadable = 0 (outer launcher). */
+export function readNestedElanousDepth(env: Record<string, string | undefined> = process.env): number {
+  const raw = env[ELANOUS_NESTED_DEPTH_ENV];
+  if (raw === undefined || raw.trim() === '') return 0;
+  if (!/^\d+$/.test(raw.trim())) return 0;
+  return Number(raw);
+}
+
+/** True when this backend can carry the depth marker to its child. Only codex can. */
+export function backendCarriesNestedDepth(backendName: string): boolean {
+  return backendName === 'codex';
+}
+
+/**
+ * Codex argv fragment that sets the child's depth marker.
+ * `depth` is the child's depth (parent + 1). Non-codex backends return [] — they cannot carry it.
+ */
+export function nestedDepthCodexArgs(backendName: string, childDepth: number): string[] {
+  if (backendName !== 'codex') return [];
+  if (!Number.isInteger(childDepth) || childDepth < 0) return [];
+  return ['-c', `${CODEX_NESTED_DEPTH_CONFIG_KEY}=${childDepth}`];
+}
+
+/**
+ * Allow decision. Depth 0 allows only when `allow` is true.
+ * Depth >= 1 always refuses; a supplied allow is ignored and logged.
+ */
+/** Nested depth cap: explicit value, else `harness.nestedElanousMaxDepth`, else 2. */
+export function resolveNestedDepthCap(maxDepth?: number): number {
+  const configured = maxDepth ?? getUserConfig().harness?.nestedElanousMaxDepth;
+  return typeof configured === 'number' && Number.isSafeInteger(configured) && configured > 0 ? configured : 2;
+}
+
+export function decideNestedElanousLaunch(input: {
+  readonly depth: number;
+  readonly allow?: boolean;
+  readonly maxDepth?: number;
+  /** False for an ordinary mission spawn that did not request a nested launch — no cap log. */
+  readonly logCap?: boolean;
+}): NestedElanousDecision {
+  const depth = Number.isInteger(input.depth) && input.depth >= 0 ? input.depth : 0;
+  const cap = resolveNestedDepthCap(input.maxDepth);
+  if (depth >= cap) {
+    if (input.logCap !== false) debug.log('agent-mission.nested', 'depth-cap', { depth, cap });
+    return { allowed: false, depth, allowIgnored: input.allow === true, reason: 'depth-cap' };
+  }
+  if (depth >= 1) {
+    if (input.allow === true) {
+      debug.log('agent-mission.nested', 'allow-ignored', { depth });
+      return { allowed: false, depth, allowIgnored: true, reason: 'allow-ignored' };
+    }
+    return { allowed: false, depth, allowIgnored: false, reason: 'nested-refused' };
+  }
+  if (input.allow === true) {
+    return { allowed: true, depth, allowIgnored: false, reason: 'depth-0-allow' };
+  }
+  return { allowed: false, depth, allowIgnored: false, reason: 'depth-0' };
+}
+
+/** Config `harness.nestedElanous`. Only `'allow'` counts, and only at depth 0. */
+export function configAllowsNestedElanous(
+  config: { harness?: { nestedElanous?: string } } | undefined,
+  depth: number,
+): boolean {
+  if (depth !== 0) return false;
+  return config?.harness?.nestedElanous === 'allow';
+}
+
+/**
+ * Gate a nested elanous launch.
+ *
+ * Ordinary mission spawn is not this gate: call it only when a nested elanous
+ * launch was requested. A backend that cannot carry the depth marker is then
+ * refused (`depth-unknown`) — including depth 0 with allow — because the child
+ * would not know its own depth. Unset depth is 0, not unknown.
+ *
+ * `allow` is the flag. Config allow counts only at depth 0 and never overrides
+ * a depth >= 1 refusal.
+ */
+export function gateNestedElanousLaunch(input: {
+  readonly backendName: string;
+  readonly depth: number;
+  /** True only when this call is gating a requested nested elanous launch. */
+  readonly nestedLaunchRequested: boolean;
+  readonly allow?: boolean;
+  readonly configAllow?: boolean;
+  readonly maxDepth?: number;
+}): NestedElanousDecision {
+  const depth = Number.isInteger(input.depth) && input.depth >= 0 ? input.depth : 0;
+  const allow = input.nestedLaunchRequested && (input.allow === true || (depth === 0 && input.configAllow === true));
+  if (!input.nestedLaunchRequested) {
+    return decideNestedElanousLaunch({ depth, allow: false, logCap: false, ...(input.maxDepth === undefined ? {} : { maxDepth: input.maxDepth }) });
+  }
+  if (!backendCarriesNestedDepth(input.backendName)) {
+    // The depth-unknown refusal stands; reaching the cap is still recorded.
+    const cap = resolveNestedDepthCap(input.maxDepth);
+    if (depth >= cap) debug.log('agent-mission.nested', 'depth-cap', { depth, cap, backend: input.backendName });
+    return { allowed: false, depth, allowIgnored: false, reason: 'depth-unknown' };
+  }
+  return decideNestedElanousLaunch({ depth, allow, ...(input.maxDepth === undefined ? {} : { maxDepth: input.maxDepth }) });
+}