elanous 0.2.18 → 0.2.20

package/src/instance/test-write-guard-spy-first.fixture.ts

@@ -0,0 +1,13 @@
+// Child fixture for test-write-guard.test.ts: a bare spy installed BEFORE outbound-alert is imported must not
+// make the captured «real» curl look like a fake. Prints {refused, curlCalls}.
+import { spyOn } from 'bun:test';
+import * as childProcess from 'node:child_process';
+
+const bare = spyOn(childProcess, 'execFileSync');
+const { sendTelegramDirect } = await import('../domains/outbound-alert.js');
+const { getUserConfig } = await import('../user-config.js');
+const base = getUserConfig();
+const config = { ...base, telegram: { ...base.telegram, channels: undefined, botToken: '2:fake', homeChannel: 2 } } as typeof base;
+let refused = '';
+try { sendTelegramDirect('private-alert-body', 'ops-alert', { config }); } catch (e) { refused = e instanceof Error ? e.name : String(e); }
+console.log(JSON.stringify({ refused, curlCalls: bare.mock.calls.length }));

package/src/instance/test-write-guard.ts

@@ -0,0 +1,200 @@
+// Last line of defense: a test process never writes ops state or sends real alerts, even without the test preload.
+// 10-07 incident: the public-export tree ran `bun test` without bunfig.toml (#24629), so tests wrote the ops deferred
+// queue, ops logs.db and sent real Telegram messages. This guard does not depend on the preload or on HOME.
+import { lstatSync, readFileSync, readlinkSync } from 'node:fs';
+import { homedir, userInfo } from 'node:os';
+import { delimiter, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { debug } from '../debug/log.js';
+
+export class TestOpsWriteRefusedError extends Error {
+  constructor(what: string, path: string, signal: string) {
+    super(`[test-guard] refused: a test process (${signal}) tried to ${what} in the operational root (${path}). `
+      + 'Point the test at an isolated root (ELANOUS_STATE_DIR / --config-dir tmp) or inject a fake sender.');
+    this.name = 'TestOpsWriteRefusedError';
+  }
+}
+
+const TEST_FILE = /\.(test|spec)\.[cm]?[jt]sx?$/;
+
+/** Which signal marks this process as a test, or null for a real run.
+ *  Measured under bun 1.4.2: `bun test` sets NODE_ENV=test unless the caller set another value, and `Bun.main` is the
+ *  running test file (argv carries no «test» word). ELANOUS_TEST_HOME is set by the deterministic runner and inherited
+ *  by children it spawns. A real CLI/daemon has none of the three. */
+export function testProcessSignal(env: NodeJS.ProcessEnv = process.env, main: string | undefined = bunMain()): string | null {
+  if (env.NODE_ENV === 'test') return 'NODE_ENV=test';
+  if (env.ELANOUS_TEST_HOME?.trim()) return 'ELANOUS_TEST_HOME';
+  if (main && TEST_FILE.test(main)) return 'Bun.main=test-file';
+  return null;
+}
+
+function isTestProcess(): boolean { return testProcessSignal() !== null; }
+
+function bunMain(): string | undefined {
+  try { return (globalThis as { Bun?: { main?: string } }).Bun?.main; } catch { return undefined; }
+}
+
+/** Real path of `path` with the kernel's lookup order: components left to right, each symlink (live or dangling)
+ *  expanded before a later `..` applies — `alias/../x` with `alias → ops/child` is `ops/x`. Missing tails are kept. */
+export function physicalPath(path: string): string {
+  const pending = (isAbsolute(path) ? path : `${process.cwd()}/${path}`).split('/').filter(Boolean);
+  let current = '/';
+  let links = 0;
+  while (pending.length) {
+    const part = pending.shift()!;
+    if (part === '.') continue;
+    if (part === '..') { current = dirname(current); continue; }
+    const next = current === '/' ? `/${part}` : `${current}/${part}`;
+    let target: string | null = null;
+    try { if (lstatSync(next).isSymbolicLink()) target = readlinkSync(next); } catch { /* missing: keep the name */ }
+    if (target !== null && links++ < 40) {
+      pending.unshift(...target.split('/').filter(Boolean));
+      if (isAbsolute(target)) current = '/';
+      continue;
+    }
+    current = next;
+  }
+  return current;
+}
+
+type SpawnSync = (cmd: string[]) => { exitCode: number; stdout: { toString(): string } };
+
+/** The OS account's home from the account database, not HOME — test runners redirect HOME. Null when unresolvable. */
+function lookupAccountHome(): string | null {
+  try {
+    const spawnSync = (globalThis as { Bun?: { spawnSync: SpawnSync } }).Bun?.spawnSync;
+    const user = userInfo().username;
+    const uid = process.getuid?.();
+    const valid = (home: string | undefined): string | null => (home && isAbsolute(home) ? home : null);
+    if (process.platform === 'darwin' && spawnSync) {
+      const r = spawnSync(['/usr/bin/dscl', '.', '-read', `/Users/${user}`, 'NFSHomeDirectory']);
+      const home = valid(r.exitCode === 0 ? r.stdout.toString().trim().split(/\s+/).at(-1) : undefined);
+      if (home) return home;
+    }
+    if (process.platform !== 'darwin' && uid !== undefined) {
+      try {
+        const home = valid(readFileSync('/etc/passwd', 'utf8').split('\n')
+          .map((line) => line.split(':')).find((f) => Number(f[2]) === uid)?.[5]);
+        if (home) return home;
+      } catch { /* try getent */ }
+      if (spawnSync) {
+        const r = spawnSync(['getent', 'passwd', String(uid)]);
+        const home = valid(r.exitCode === 0 ? r.stdout.toString().trim().split(':')[5] : undefined);
+        if (home) return home;
+      }
+    }
+  } catch { /* unresolvable */ }
+  return null;
+}
+
+let accountHomeLookup: () => string | null = lookupAccountHome;
+let opsRootsOverride: string[] | null = null; // added roots, never a replacement
+let cachedOpsRoots: string[] | null = null;
+
+/** Tests add «ops-like» roots to prove the refusal; the real account root stays protected. null clears them. */
+export function setOpsRootsForTesting(roots: string[] | null): void { opsRootsOverride = roots ? roots.map(physicalPath) : null; }
+
+/** Tests inject a failing account lookup to prove the fallback; null restores the real one. Clears the cache. */
+export function setAccountHomeLookupForTesting(lookup: (() => string | null) | null): void {
+  accountHomeLookup = lookup ?? lookupAccountHome;
+  cachedOpsRoots = null;
+  accountHomeUnresolved = false;
+}
+
+/** The operational instance root(s) the guard protects — the account's real `~/.elanous`.
+ *  When the account database cannot be read, fail toward protection: every conventional home of this user plus HOME. */
+export function opsRoots(): string[] {
+  // Widening only: injected roots and the env list add to the real account root; nothing can remove it.
+  const extra = (process.env[EXTRA_OPS_ROOTS_ENV] ?? '').split(delimiter).filter((p) => isAbsolute(p)).map(physicalPath);
+  const added = [...(opsRootsOverride ?? []), ...extra];
+  return added.length ? [...new Set([...accountOpsRoots(), ...added])] : accountOpsRoots();
+}
+
+/** Extra roots the guard protects in this process (path-delimited). Used to prove the guard in a real child entry. */
+export const EXTRA_OPS_ROOTS_ENV = 'ELANOUS_TEST_GUARD_EXTRA_OPS_ROOTS';
+
+function accountOpsRoots(): string[] {
+  if (cachedOpsRoots) return cachedOpsRoots;
+  const home = accountHomeLookup();
+  let homes: string[];
+  if (home) homes = [home];
+  else {
+    let user = '';
+    try { user = userInfo().username; } catch { /* unknown user */ }
+    homes = [...(user ? [`/Users/${user}`, `/home/${user}`] : []), ...(process.getuid?.() === 0 ? ['/root'] : []), homedir()];
+    try { debug.log('test-guard', 'account-home-unresolved', { protected: homes.length }); } catch { /* observation only */ }
+  }
+  accountHomeUnresolved = !home;
+  cachedOpsRoots = [...new Set(homes.map((h) => physicalPath(join(h, '.elanous'))))];
+  return cachedOpsRoots;
+}
+
+let accountHomeUnresolved = false;
+
+export function isInsideOpsRoot(path: string, roots: string[] = opsRoots()): boolean {
+  const target = physicalPath(path);
+  // Unknown account home (non-standard, unreadable): any `<dir>/.elanous` tree may be the ops root — protect them all.
+  // Isolated test roots are temp dirs or `<root>/state`, never a directory named `.elanous` under a home.
+  // Both spellings: a `.elanous` that is itself a symlink to an oddly named directory is still that tree.
+  if (accountHomeUnresolved && [resolve(path), target].some((p) => p.split(sep).includes('.elanous'))) return true;
+  return roots.some((root) => {
+    const rel = relative(root, target);
+    return rel === '' || (rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+  });
+}
+
+function refuse(what: string, path: string, signal: string): never {
+  try { debug.log('test-guard', 'ops-write-refused', { what, path, signal }); } catch { /* the refusal stands */ }
+  throw new TestOpsWriteRefusedError(what, path, signal);
+}
+
+/** Throw when a test process is about to write `path` inside the operational root. No-op in real runs. */
+export function assertNotTestWritingOps(path: string, what: string): void {
+  const signal = testProcessSignal();
+  if (!signal) return;
+  if (path === ':memory:' || !isInsideOpsRoot(path)) return;
+  refuse(what, path, signal);
+}
+
+/** Throw when a test process is about to perform a network send it must not make.
+ *  - Routing (config dir · state root · conatus dir · acp-token dir) inside the ops root: always refused, faked or
+ *    not — a test that resolved the ops universe is the leak itself, whatever its transport does.
+ *  - `external` (a third-party bot API — Telegram, Discord): refused unless the transport is a test double that
+ *    replaces the real one (`transportFaked`), whatever root the credentials came from. A double that deliberately
+ *    calls the original is an explicit choice to send and is out of this guard's reach. */
+export function assertNoRealSendFromTest(what: string, opts: {
+  transportFaked: boolean; routingRoots: string[]; external?: boolean;
+}): void {
+  const signal = testProcessSignal();
+  if (!signal) return;
+  const opsRoot = opts.routingRoots.find((root) => root && isInsideOpsRoot(root));
+  if (opsRoot) refuse(what, opsRoot, signal);
+  if (opts.external && !opts.transportFaked) refuse(what, 'a real third-party bot API', signal);
+}
+
+/** True when `fn` is a bun:test/jest double whose behaviour replaces `real`. A bare `spyOn` keeps calling the
+ *  original (its implementation IS `real`), so it is not a fake. */
+export function isTestDouble(fn: unknown, real?: unknown): boolean {
+  if (!isMockFn(fn)) return false;
+  const impl = fn.getMockImplementation?.();
+  return real === undefined || impl !== unwrapMock(real);
+}
+
+type MockFn = { mock: object; getMockImplementation?: () => unknown };
+function isMockFn(fn: unknown): fn is MockFn {
+  return typeof fn === 'function' && typeof (fn as { mock?: unknown }).mock === 'object' && (fn as { mock?: unknown }).mock !== null;
+}
+
+/** The function under a chain of spies — a «real» captured after a bare spy was installed is the spy itself.
+ *  Unwrapping a fake yields the fake, so a capture taken under a fake refuses rather than allows. */
+function unwrapMock(fn: unknown): unknown {
+  let current = fn;
+  for (let i = 0; i < 8 && isMockFn(current); i++) {
+    const impl: unknown = current.getMockImplementation?.();
+    if (typeof impl !== 'function' || impl === (current as unknown)) break;
+    current = impl;
+  }
+  return current;
+}
+
+// Resolve the account home while no test has mocked anything yet; real runs never pay the lookup.
+try { if (typeof process !== 'undefined' && isTestProcess()) opsRoots(); } catch { /* resolved lazily */ }

package/src/intake-plane/digest.ts

@@ -1,14 +1,15 @@
 // 흡수 하루 다이제스트 — 그날 흡수한 것을 사람이 «발견»하는 자리. 노트 절(마크다운) ⊕ 텔레그램 짧은 판.
 // 결정론만: 요약 한 줄은 각 노트가 이미 쓴 「한 줄 결론」을 뽑는다(LLM 을 다시 부르지 않는다).
-import { existsSync, readFileSync } from 'node:fs';
-import { basename, join } from 'node:path';
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
 import { loadIntakeLedger, type IntakeItem } from './items.js';
+import { canonicalSeat } from './intake-sources.js';
 import { readSavedCursorAt } from './collect-telegram-saved.js';
 import { intakeOutboxDir, kstDay } from './route.js';
 
 export type DigestLensVerdict = '대체 후보' | '보강' | '경쟁 대조';
 export interface DigestEntry { id: string; sources: string[]; url?: string; note?: string; noteName?: string; oneLiner?: string; axis: string; impact?: { verdict: DigestLensVerdict; why: string; target: string } }
-export interface IntakeDigest { day: string; absorbed: DigestEntry[]; goals: { fact: string; url?: string }[]; news?: { title: string; url: string; summary: string[]; implication: string[] }[]; shadowSuggestions?: { fact: string; url?: string; verdict: string }[]; review?: { fact: string; note?: string }[]; grounding: number; release: number; manual: number; savedSilence?: { days: number; lastNewAt: string } }
+export interface IntakeDigest { day: string; seat?: string; absorbed: DigestEntry[]; goals: { fact: string; url?: string }[]; news?: { title: string; url: string; summary: string[]; implication: string[] }[]; shadowSuggestions?: { fact: string; url?: string; verdict: string }[]; review?: { fact: string; note?: string }[]; grounding: number; release: number; manual: number; savedSilence?: { days: number; lastNewAt: string } }
 
 const AXIS_LABEL: Record<string, string> = {
   video_automation: '영상 자동화', agent_basics: '에이전트 기본', agent_applied: '에이전트 응용', unrelated: '그 밖',
@@ -51,9 +52,27 @@ export function pathOnly(why: string): boolean {
   return rest.length < 4;
 }
 
-export function buildIntakeDigest(root: string, day: string, readFile: (p: string) => string | undefined = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : undefined), now: Date = new Date()): IntakeDigest {
+/** Seat briefing receipts — `outbox/brief/<seat>.jsonl` rows `{ id, day }`: an item already sent on an earlier day is not «new» again. */
+export function seatBriefFile(root: string, seat: string): string { return join(intakeOutboxDir(root), 'brief', `${seat}.jsonl`); }
+
+/** Record the items a seat briefing delivered (called only after a successful send). */
+export function recordSeatBriefed(root: string, seat: string, day: string, ids: readonly string[]): void {
+  if (!ids.length) return;
+  const file = seatBriefFile(root, seat);
+  mkdirSync(dirname(file), { recursive: true });
+  appendFileSync(file, ids.map((id) => JSON.stringify({ id, day })).join('\n') + '\n');
+}
+
+export function buildIntakeDigest(root: string, day: string, readFile: (p: string) => string | undefined = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : undefined), now: Date = new Date(), seat?: string): IntakeDigest {
+  const selectedSeat = seat === undefined ? undefined : canonicalSeat(seat);
+  // Re-collecting the same search result moves lastSeenAt to today; without receipts it would be «new» every morning.
+  const briefedEarlier = new Set(selectedSeat
+    ? readJsonl(seatBriefFile(root, selectedSeat)).filter((r) => typeof r.id === 'string' && r.day !== day).map((r) => r.id as string)
+    : []);
   const items = [...loadIntakeLedger(root).items.values()]
-    .filter((i) => (i.status === 'absorbed' || i.status === 'routed') && kstDay(i.lastSeenAt) === day && i.outputs.some((o) => o.kind === 'note'));
+    .filter((i) => (selectedSeat === undefined || (i.seat === selectedSeat && !briefedEarlier.has(i.id)))
+      && (selectedSeat ? i.status !== 'discarded' : (i.status === 'absorbed' || i.status === 'routed') && i.outputs.some((o) => o.kind === 'note'))
+      && kstDay(i.lastSeenAt) === day);
   const out = intakeOutboxDir(root);
   const relevant = new Map<string, NonNullable<DigestEntry['impact']>>();
   // The lens (src/intake-plane/lens.ts) writes its verdicts to outbox/lens/<day>.jsonl; route folders carry none.
@@ -76,13 +95,13 @@ export function buildIntakeDigest(root: string, day: string, readFile: (p: strin
     return {
       id: i.id, sources: i.sources, ...(i.url ? { url: i.url } : {}),
       ...(note ? { note, noteName: basename(note, '.md') } : {}),
-      ...(md ? { oneLiner: noteOneLiner(md) } : {}),
+      ...(md ? { oneLiner: noteOneLiner(md) } : selectedSeat && i.title ? { oneLiner: i.title } : {}),
       axis: AXIS_LABEL[i.judgement?.axis ?? i.axis ?? ''] ?? (i.sources.includes('telegram-saved') ? '내가 저장한 것' : '그 밖'),
       ...(impact ? { impact } : {}),
     };
   });
-  const goals = readJsonl(join(out, 'goals', `${day}.jsonl`)).map((g) => ({ fact: String(g.fact ?? ''), ...(g.url ? { url: String(g.url) } : {}) }));
-  const lensRows = readJsonl(join(out, 'lens', `${day}.jsonl`));
+  const goals = selectedSeat ? [] : readJsonl(join(out, 'goals', `${day}.jsonl`)).map((g) => ({ fact: String(g.fact ?? ''), ...(g.url ? { url: String(g.url) } : {}) }));
+  const lensRows = selectedSeat ? [] : readJsonl(join(out, 'lens', `${day}.jsonl`));
   const news = lensRows.flatMap((row) =>
     typeof row.title === 'string' && typeof row.url === 'string' && Array.isArray(row.summary) && Array.isArray(row.implication)
       ? [{ title: row.title, url: row.url, summary: row.summary.filter((s): s is string => typeof s === 'string'), implication: row.implication.filter((s): s is string => typeof s === 'string') }]
@@ -94,15 +113,15 @@ export function buildIntakeDigest(root: string, day: string, readFile: (p: strin
       if (suggestion.status !== '제안' || typeof suggestion.fact !== 'string' || !suggestion.fact.trim()) return [];
       return [{ fact: suggestion.fact, ...(typeof row.url === 'string' ? { url: row.url } : {}), verdict: typeof suggestion.verdict === 'string' ? suggestion.verdict : '판단 필요' }];
     }) : []);
-  const review = readJsonl(join(out, 'review', `${day}.jsonl`)).map((r) => ({ fact: String(r.fact ?? ''), ...(r.note ? { note: String(r.note) } : {}) }));
-  const grounding = readJsonl(join(out, 'grounding.jsonl')).filter((g) => typeof g.at === 'string' && kstDay(g.at) === day).length;
-  const lastNewAt = readSavedCursorAt(root);
+  const review = selectedSeat ? [] : readJsonl(join(out, 'review', `${day}.jsonl`)).map((r) => ({ fact: String(r.fact ?? ''), ...(r.note ? { note: String(r.note) } : {}) }));
+  const grounding = selectedSeat ? 0 : readJsonl(join(out, 'grounding.jsonl')).filter((g) => typeof g.at === 'string' && kstDay(g.at) === day).length;
+  const lastNewAt = selectedSeat ? undefined : readSavedCursorAt(root);
   const silentMs = lastNewAt ? now.getTime() - Date.parse(lastNewAt) : NaN;
   return {
-    day, absorbed, goals, ...(news.length ? { news } : {}), ...(shadowSuggestions.length ? { shadowSuggestions } : {}), review, grounding,
-    release: readJsonl(join(out, 'release', `${day}.jsonl`)).length,
-    manual: readJsonl(join(out, 'manual', `${day}.jsonl`)).length,
-    ...(lastNewAt && silentMs > SAVED_SILENCE_MS ? { savedSilence: { days: Math.floor(silentMs / 86_400_000), lastNewAt } } : {}),
+    day, ...(selectedSeat ? { seat: selectedSeat } : {}), absorbed, goals, ...(news.length ? { news } : {}), ...(shadowSuggestions.length ? { shadowSuggestions } : {}), review, grounding,
+    release: selectedSeat ? 0 : readJsonl(join(out, 'release', `${day}.jsonl`)).length,
+    manual: selectedSeat ? 0 : readJsonl(join(out, 'manual', `${day}.jsonl`)).length,
+    ...(!selectedSeat && lastNewAt && silentMs > SAVED_SILENCE_MS ? { savedSilence: { days: Math.floor(silentMs / 86_400_000), lastNewAt } } : {}),
   };
 }
 
@@ -146,6 +165,11 @@ export function renderDigestMarkdown(d: IntakeDigest): string {
 
 /** 텔레그램 — 흡수 렌즈가 대조한 항목만 SCQA 짧은 판으로 낸다. */
 export function renderDigestTelegram(d: IntakeDigest, _opts: { vaultRoot?: string; notePath?: string } = {}): string {
+  if (d.seat && !d.absorbed.length) return '오늘 새 소식 없음';
+  if (d.seat) return [
+    `흡수 ${d.absorbed.length}`,
+    ...d.absorbed.map((item) => `- ${item.oneLiner ?? item.noteName ?? item.id}${item.url ? ` · ${item.url}` : ''}`),
+  ].join('\n');
   // «Touching» is decided by the lens verdict alone; a missing note summary only changes how S reads (ACP must-fix).
   const touching = d.absorbed.filter((e) => e.impact);
   const L = [`흡수 ${d.absorbed.length} → 우리에게 닿는 것 ${touching.length}`];

package/src/intake-plane/harness-target.ts

@@ -3,14 +3,15 @@ export type DaemonHarnessTarget =
   | { ok: false; reason: string };
 
 /** Read-only target selection. An explicitly configured path must never fall back to the daemon cwd. */
-export function resolveDaemonHarnessTarget({ configured, cwd, isGitRepo }: {
+export function resolveDaemonHarnessTarget({ configured, cwd, isGitRepo, allowNonGit = false }: {
   configured?: string;
   cwd: string;
   isGitRepo: (path: string) => boolean;
+  allowNonGit?: boolean;
 }): DaemonHarnessTarget {
   if (configured !== undefined) {
-    if (isGitRepo(configured)) return { ok: true, repo: configured, source: 'config' };
-  } else if (isGitRepo(cwd)) {
+    if (allowNonGit || isGitRepo(configured)) return { ok: true, repo: configured, source: 'config' };
+  } else if (allowNonGit || isGitRepo(cwd)) {
     return { ok: true, repo: cwd, source: 'cwd' };
   }
   return {

package/src/intake-plane/intake-sources.ts

@@ -20,6 +20,7 @@ export interface RegisteredIntakeSource {
 }
 
 export function canonicalSeat(value: string): string {
+  if (value.trim() === 'user') return 'user';
   const seat = findTrack(value.trim());
   if (!seat) throw new Error(`알 수 없는 자리: ${value}`);
   return seat.id;

package/src/intake-plane/items.ts

@@ -84,6 +84,7 @@ export function canonicalUrl(raw: string): string | undefined {
 function normalizedSeat(seat: unknown): string | undefined {
   if (seat === undefined) return undefined;
   if (typeof seat !== 'string') throw new Error(`알 수 없는 자리: ${String(seat)}`);
+  if (seat.trim() === 'user') return 'user';
   const track = findTrack(seat.trim());
   if (!track) throw new Error(`알 수 없는 자리: ${seat}`);
   return track.id;

package/src/loops/orchestrator/degradation.ts

@@ -0,0 +1,57 @@
+// COORD-HA (0.2.19) — the signal the orchestrator tick reads for its degradation ladder (RFC loop map §A8b ④⑤):
+// L1 = no usable LLM (rules only) · L2 = the task board cannot take a write (no new assignment). The tick already acts on
+// `TickDeps.degradation`; until now nothing supplied it in production. Each probe answers «false» only on a measured
+// failure — an unknown is not a degradation.
+import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { Database } from 'bun:sqlite';
+import { cardIndexPath, taskCardsDir } from '../../task-cards/card-store.js';
+import { resolveUsableLlm } from '../../llm/usable-llm.js';
+
+export interface DegradationSignal { llm: boolean; board: boolean; why: string[] }
+
+/** The task board takes a write: its folder is a directory a file can be created in (created and removed — a permission
+ *  bit is not proof · review r1), and its index can take a write lock (busy 2 s · rolled back). */
+export function probeBoardWritable(root: string): { ok: boolean; why?: string } {
+  const dir = taskCardsDir(root);
+  try {
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+    if (!statSync(dir).isDirectory()) return { ok: false, why: 'board dir not writable: not a directory' };
+    // A fresh name each time — a leftover from a crashed probe can never make a writable board look full (review r2).
+    const probe = join(dir, `.degradation-probe-${randomUUID()}`);
+    try { writeFileSync(probe, '', { flag: 'wx', mode: 0o600 }); }
+    finally { rmSync(probe, { force: true }); }
+  } catch (error) { return { ok: false, why: `board dir not writable: ${(error as NodeJS.ErrnoException).code ?? String(error)}` }; }
+  const index = cardIndexPath(root);
+  // No index yet: the card store creates it on first open — a writable folder is enough.
+  if (!existsSync(index)) return { ok: true };
+  let db: Database | undefined;
+  try {
+    db = new Database(index, { readwrite: true, create: false });
+    db.exec('PRAGMA busy_timeout = 2000');
+    db.exec('BEGIN IMMEDIATE');
+    db.exec('ROLLBACK');
+    return { ok: true };
+  } catch (error) {
+    return { ok: false, why: `board index write lock: ${String(error instanceof Error ? error.message : error).slice(0, 160)}` };
+  } finally { try { db?.close(); } catch { /* closing a failed handle is best effort */ } }
+}
+
+export interface DegradationDeps {
+  usableLlm?: () => { usable: boolean; why: string };
+  board?: (root: string) => { ok: boolean; why?: string };
+}
+
+export function probeDegradation(root: string, deps: DegradationDeps = {}): DegradationSignal {
+  const why: string[] = [];
+  let llm = true;
+  try {
+    const usable = (deps.usableLlm ?? resolveUsableLlm)();
+    llm = usable.usable;
+    if (!llm) why.push(`llm: ${usable.why}`);
+  } catch (error) { why.push(`llm unknown: ${String(error).slice(0, 120)}`); }
+  const board = (deps.board ?? probeBoardWritable)(root);
+  if (!board.ok) why.push(board.why ?? 'board not writable');
+  return { llm, board: board.ok, why };
+}

package/src/loops/orchestrator/finish-rate.ts

@@ -15,6 +15,8 @@ export type FinishMetric = 'launched' | 'landed' | 'landingRate' | 'staleDrafts'
 export type FinishMetrics = {
   launched: number | null;
   launchedUnreadable?: number;
+  /** Launched Pod runs whose child ledger never came back (`pod-ledger-incomplete`) — counted in `launched`, result unknown. */
+  launchedIncomplete?: number;
   landed: number | null;
   landingRate: number | null;
   staleDrafts: number | null;
@@ -97,7 +99,9 @@ export function recordFinishHistory(root: string, metrics: FinishMetrics, now: D
 }
 
 type Start = { runId: string; startedAt: string };
-type StartObservation = { starts: readonly Start[]; unreadable: readonly { runId: string; reason: string }[]; unreadableDirectories?: number };
+type StartObservation = { starts: readonly Start[]; unreadable: readonly { runId: string; reason: string }[]; unreadableDirectories?: number;
+  /** Runs counted as launched although their child ledger never came back (reason = the host marker's data.reason). */
+  incomplete?: readonly { runId: string; reason: string }[] };
 type Pr = { number: number; headRefName: string; mergedAt?: string; createdAt?: string; mergeable?: string; labels?: { name: string }[] };
 export interface MeasureFinishDeps {
   listStarts?: (cutoff: number) => StartObservation;
@@ -113,6 +117,7 @@ function defaultListStarts(cutoff: number, targets?: readonly LogTarget[]): Star
   let unreadableDirectories = 0;
   let unresolvedDirectories = 0;
   const launchOnlyIds = new Set<string>();
+  const incomplete = new Map<string, { runId: string; reason: string }>();
   for (const { ledgerDirectory } of resolveFederatedRunLedgerTargets({ includeTest: true, ...(targets ? { targets } : {}) })) {
     let dir: string;
     try {
@@ -143,6 +148,20 @@ function defaultListStarts(cutoff: number, targets?: readonly LogTarget[]): Star
         continue;
       }
       const start = entries.find(entry => entry.event === 'start');
+      // ORCH-LIVE-1008 ①: the host writes `pod-ledger-incomplete` on a Pod child run's ledger when the child's own ledger
+      // never came back (OOM · logs unavailable · partial collection). The Job did run — it is a launch with an unknown
+      // result, not a ledger without a start. Its time is the marker's timestamp, else the ledger mtime.
+      const incompleteMarker = !start ? entries.find(entry => entry.event === 'pod-ledger-incomplete') : undefined;
+      if (incompleteMarker) {
+        // Only a real `start` (from any directory) outranks the marker; a host launch-only record does not — the same
+        // run read as launch-only first is still a launch whose result never came back.
+        if (starts.has(runId) && !launchOnlyIds.has(runId)) continue;
+        if (!starts.has(runId)) starts.set(runId, { runId, startedAt: incompleteMarker.timestamp ?? new Date(statSync(path).mtimeMs).toISOString() });
+        const why = (incompleteMarker.data as { reason?: unknown } | undefined)?.reason;
+        incomplete.set(runId, { runId, reason: typeof why === 'string' && why ? why : 'unknown' });
+        unreadable.delete(runId);
+        continue;
+      }
       // A Pod-dispatched launch leaves only a host launch record (launch-quota-policy · author-on-pod-receipt) — the run
       // itself starts inside the Pod. That is still a launch: its time is the record's timestamp, else the ledger mtime.
       const launchRecord = !start ? entries.find(entry => LAUNCH_ONLY_EVENTS.has(entry.event)) : undefined;
@@ -157,12 +176,14 @@ function defaultListStarts(cutoff: number, targets?: readonly LogTarget[]): Star
       if (launchRecord) launchOnlyIds.add(runId); else launchOnlyIds.delete(runId);
       starts.set(runId, { runId, startedAt });
       unreadable.delete(runId);
+      incomplete.delete(runId);
     }
   }
   debug.log('loop.orchestrator', 'finish-launch-population', {
     directories: directories.size + unresolvedDirectories, launched: starts.size, launchOnly: launchOnlyIds.size, childLedgers: childLedgers.size, unreadable: unreadable.size,
+    ...(incomplete.size > 0 ? { incomplete: incomplete.size } : {}),
   });
-  return { starts: [...starts.values()], unreadable: [...unreadable.values()], unreadableDirectories };
+  return { starts: [...starts.values()], unreadable: [...unreadable.values()], unreadableDirectories, incomplete: [...incomplete.values()] };
 }
 
 function defaultRunGh(args: string[]): string {
@@ -184,6 +205,7 @@ export function measureFinish(deps: MeasureFinishDeps = {}, now: Date = new Date
   const cutoff = now.getTime() - DAY_MS;
   let launched: number | null = null;
   let launchedUnreadable = 0;
+  let launchedIncomplete = 0;
   let landed: number | null = null;
   let staleDrafts: number | null = null;
   let conflictRatio: number | null = null;
@@ -196,6 +218,14 @@ export function measureFinish(deps: MeasureFinishDeps = {}, now: Date = new Date
       || observation.unreadable.some(entry => !entry || typeof entry.runId !== 'string' || typeof entry.reason !== 'string')) throw new Error('invalid run start observation');
     launched = new Set(observation.starts.filter(start => Date.parse(start.startedAt) >= cutoff && Date.parse(start.startedAt) <= now.getTime()).map(start => start.runId)).size;
     launchedUnreadable = observation.unreadable.length;
+    const incompleteRuns = (observation.incomplete ?? []).filter(entry => observation.starts.some(start => start.runId === entry.runId
+      && Date.parse(start.startedAt) >= cutoff && Date.parse(start.startedAt) <= now.getTime()));
+    launchedIncomplete = incompleteRuns.length;
+    if (launchedIncomplete > 0) {
+      const byReason: Record<string, number> = {};
+      for (const entry of incompleteRuns) byReason[entry.reason] = (byReason[entry.reason] ?? 0) + 1;
+      debug.log('loop.orchestrator', 'finish-ledger-incomplete', { count: launchedIncomplete, byReason, sample: incompleteRuns.slice(0, 5) });
+    }
     if (launchedUnreadable > 0) {
       reasons.launched = `${launchedUnreadable}개 원장 시작 줄 없음(하한값)`;
       debug.log('loop.orchestrator', 'finish-ledger-unreadable', { count: launchedUnreadable, sample: observation.unreadable.slice(0, 5) });
@@ -234,7 +264,7 @@ export function measureFinish(deps: MeasureFinishDeps = {}, now: Date = new Date
     : 'no harness runs launched in the last 24 hours';
   else if (landed > launched) reasons.landingRate = `landed exceeds launched — population mismatch (launched=${launched}, landed=${landed})`;
   else landingRate = landed / launched;
-  return { launched, ...(launchedUnreadable > 0 ? { launchedUnreadable } : {}), landed, landingRate, staleDrafts, conflictRatio, unknownMergeable, reasons };
+  return { launched, ...(launchedUnreadable > 0 ? { launchedUnreadable } : {}), ...(launchedIncomplete > 0 ? { launchedIncomplete } : {}), landed, landingRate, staleDrafts, conflictRatio, unknownMergeable, reasons };
 }
 
 /** Advice only: no launch cap, PR, or config is changed. */