elanous 0.2.20 → 0.2.22

package/src/context-bus/nightly-condense.ts

@@ -1,14 +1,58 @@
-import { readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync } from 'node:fs';
+import { readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, unlinkSync } from 'node:fs';
+import { gzipSync, gunzipSync } from 'node:zlib';
 import { dirname, join, resolve } from 'node:path';
 import { streamLLM } from '../llm.js';
-import { condenseContextDay, type MemoryItem, type MemorySource, type MemorySummary } from './long-term-memory.js';
-import { listCoordEvents, type CoordEvent } from './coord-events.js';
+import { condenseContextDay, guardianRetireAged, readCondenseEvents, type MemoryItem, type MemorySource, type MemorySummary } from './long-term-memory.js';
+import type { CoordEvent } from './coord-events.js';
 import { DecisionLedger, type DecisionEntry } from '../decisions/decision-ledger.js';
 import { acquireLockAsync } from '../storage/file-lock.js';
 
 type Stage = 'collect' | 'condense' | 'record' | 'conflict-candidates';
 type Input = { day?: string; events?: CoordEvent[]; decisions?: DecisionEntry[]; summaries?: Record<string, MemorySummary> };
-type Context = { graphId?: string; nodeId?: string; input: Input | null; outputs: Record<string, { day?: string; events?: CoordEvent[]; decisions?: DecisionEntry[]; items?: MemoryItem[] } | null> };
+type Context = { graphId?: string; nodeId?: string; input: Input | null; outputs: Record<string, { day?: string; events?: CoordEvent[]; decisions?: DecisionEntry[]; items?: MemoryItem[]; memoryItems?: MemoryItem[] } | null> };
+type NightlyTask = (source: MemorySource, assignee: 'nightly-task-agent', recipe: 'sleep-review') => Promise<MemorySummary>;
+type GuardianTask = (items: readonly MemoryItem[], assignee: 'guardian', now: Date) => MemoryItem[] | Promise<MemoryItem[]>;
+type NightlyAssignment = { owner: 'coordinator'; assignee: 'nightly-task-agent'; contract: 'librarian'; recipe: 'sleep-review'; source: MemorySource; summary?: MemorySummary };
+type GuardianAssignment = { owner: 'guardian'; assignee: 'guardian'; recipe: 'retire-aged'; items: readonly MemoryItem[]; now: string }
+  | { owner: 'guardian'; assignee: 'guardian'; recipe: 'store-snapshot'; root: string; project: string; seat: string; value: MemoryItem[] }
+  | { owner: 'guardian'; assignee: 'guardian'; recipe: 'store-candidates'; root: string; value: unknown[] };
+type Assignment = NightlyAssignment | GuardianAssignment;
+
+/** Execute an assigned recipe in a separate, short-lived task worker, never in the coordinator's stage process. */
+async function dispatchAssignment<T>(assignment: Assignment): Promise<{ result: T; workerPid: number }> {
+  const worker = Bun.spawn([process.execPath, import.meta.path, '--assigned-task'], {
+    stdin: 'pipe', stdout: 'pipe', stderr: 'pipe',
+  });
+  worker.stdin.write(JSON.stringify(assignment));
+  worker.stdin.end();
+  const [stdout, stderr, exit] = await Promise.all([
+    new Response(worker.stdout).text(), new Response(worker.stderr).text(), worker.exited,
+  ]);
+  if (exit !== 0) throw new Error(`nightly ${assignment.recipe} task failed: ${stderr.trim()}`);
+  return { result: JSON.parse(stdout) as T, workerPid: worker.pid };
+}
+
+async function executeAssignment(assignment: Assignment): Promise<MemorySummary | MemoryItem[] | { stored: true }> {
+  if (assignment.owner === 'coordinator' && assignment.assignee === 'nightly-task-agent'
+    && assignment.contract === 'librarian' && assignment.recipe === 'sleep-review') {
+    return summarize(assignment.source, assignment.summary ? { [assignment.source.source]: assignment.summary } : undefined, assignment.recipe);
+  }
+  if (assignment.owner === 'guardian' && assignment.assignee === 'guardian') {
+    if (assignment.recipe === 'retire-aged') return guardianRetireAged(assignment.items, new Date(assignment.now));
+    if (assignment.recipe === 'store-snapshot') {
+      if (!assignment.value.every(item => item.project === assignment.project && item.seat === assignment.seat)) {
+        throw new Error('guardian memory group mismatch');
+      }
+      guardianSave(snapshotPath(assignment.root, assignment.project, assignment.seat), assignment.value);
+      return { stored: true };
+    }
+    if (assignment.recipe === 'store-candidates') {
+      guardianSave(join(assignment.root, 'context-memory', 'conflict-candidates.json'), assignment.value);
+      return { stored: true };
+    }
+  }
+  throw new Error('invalid nightly assignment');
+}
 
 const dayBefore = (date: Date) => new Date(date.getTime() - 86_400_000).toISOString().slice(0, 10);
 const fileName = (value: string) => encodeURIComponent(value).replace(/\./g, '%2E');
@@ -25,6 +69,39 @@ function save(file: string, value: unknown): void {
   renameSync(temp, file);
 }
 
+const GUARDIAN_SIZE_BUDGET_BYTES = 16 * 1024 * 1024;
+
+/** Guardian-owned snapshot hygiene. The JSON ledger stays byte-for-byte in its existing format. */
+function guardianSave(file: string, value: unknown): void {
+  const text = JSON.stringify(value, null, 2) + '\n';
+  const previous = existsSync(file) ? readFileSync(file) : undefined;
+  const backup = `${file}.gz`;
+  if (previous) {
+    // Write the new backup beside the old one and verify it on disk before it replaces the old backup,
+    // so a failed or corrupt backup write never destroys the previous backup.
+    const backupTemp = `${backup}.${process.pid}.tmp`;
+    try {
+      writeFileSync(backupTemp, gzipSync(previous));
+      if (!gunzipSync(readFileSync(backupTemp)).equals(previous)) throw new Error('guardian backup integrity check failed');
+      renameSync(backupTemp, backup);
+    } catch (error) {
+      if (existsSync(backupTemp)) unlinkSync(backupTemp);
+      throw error;
+    }
+  }
+  try {
+    if (Buffer.byteLength(text) > GUARDIAN_SIZE_BUDGET_BYTES) throw new Error('guardian memory size budget exceeded');
+    save(file, value);
+    if (readFileSync(file, 'utf8') !== text) throw new Error('guardian memory integrity check failed');
+  } catch (error) {
+    if (previous) writeFileSync(file, gunzipSync(readFileSync(backup)));
+    else if (existsSync(file)) unlinkSync(file);
+    const temp = `${file}.${process.pid}.tmp`;
+    if (existsSync(temp)) unlinkSync(temp);
+    throw error;
+  }
+}
+
 async function withCurrentDay<T>(root: string, day: string, write: () => T): Promise<T> {
   const dir = join(root, 'context-memory');
   mkdirSync(dir, { recursive: true });
@@ -39,7 +116,7 @@ async function withCurrentDay<T>(root: string, day: string, write: () => T): Pro
     if (!lock.stillHeld()) throw new Error('nightly memory write lock lost');
     // Reserve the day before touching either output, so a failed writer cannot let an older run overwrite it.
     if (!latest || latest < day) save(marker, day);
-    return write();
+    return await write();
   } finally { lock.release(); }
 }
 
@@ -64,20 +141,38 @@ function storedItems(root: string): MemoryItem[] {
   return items;
 }
 
-export async function summarize(source: MemorySource, injected?: Record<string, MemorySummary>): Promise<MemorySummary> {
+/** A sleep-review rejection: counted as `not-promoted` by the condenser, never as a malformed summary. */
+function notPromoted(value: Record<string, unknown>): MemorySummary {
+  const text = (key: string) => typeof value[key] === 'string' ? value[key] as string : '';
+  return { promote: false, project: text('project'), topic: text('topic'), summary: text('summary') };
+}
+
+export function summaryInstruction(recipe: 'standard' | 'sleep-review' = 'standard'): string {
+  const system = 'Summarize this one-line context event as a compact project/seat memory item. Return ONLY JSON: {"project":"...","topic":"...","summary":"...","claim":{"key":"...","value":"..."}}. Omit claim when the event makes no comparable factual assertion. Never invent a project, topic or claim.';
+  if (recipe === 'standard') return system;
+  // SLEEP1 builds on this librarian recipe; the guardian owns storage hygiene, not promotion judgments.
+  return `${system.replace('"project":"..."', '"promote":false,"project":"..."')} You are the nightly task agent (librarian). Sleep review (librarian contract): apply the coordinator promotion policy. Return a boolean "promote" for every source. Set promote=true only for sourced, durable project/seat facts or decisions; set promote=false for chatter or speculative claims. A correction with a later timestamp wins; return a comparable claim only for an explicit factual assertion so opposing claims can become OP conflict candidates. Do not perform guardian hygiene (retention, compression, size, backup, integrity or rollback).`;
+}
+
+export async function summarize(source: MemorySource, injected?: Record<string, MemorySummary>, recipe: 'standard' | 'sleep-review' = 'standard'): Promise<MemorySummary> {
   if (injected) {
     const result = injected[source.source];
     if (!result) throw new Error(`missing test summary: ${source.source}`);
+    if (recipe === 'sleep-review' && typeof result.promote !== 'boolean') throw new Error('invalid memory summary');
+    if (recipe === 'sleep-review' && result.promote === false) return notPromoted(result as unknown as Record<string, unknown>);
     return result;
   }
   const response = await streamLLM([
-    { role: 'system', content: 'Summarize this one-line context event as a compact project/seat memory item. Return ONLY JSON: {"project":"...","topic":"...","summary":"...","claim":{"key":"...","value":"..."}}. Omit claim when the event makes no comparable factual assertion. Never invent a project, topic or claim.' },
+    { role: 'system', content: summaryInstruction(recipe) },
     { role: 'user', content: JSON.stringify(source) },
   ], () => {}, { maxTokens: 350, usageRole: 'research' });
   const parsed: unknown = JSON.parse(response.replace(/^```(?:json)?\s*|\s*```$/g, '').trim());
   if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error('invalid memory summary');
   const value = parsed as Record<string, unknown>;
+  // A librarian rejection needs no project/topic/summary — chatter often has none to give.
+  if (recipe === 'sleep-review' && value.promote === false) return notPromoted(value);
   if (typeof value.project !== 'string' || typeof value.topic !== 'string' || typeof value.summary !== 'string' ||
+    (recipe === 'sleep-review' && typeof value.promote !== 'boolean') ||
     (value.claim !== undefined && (!value.claim || typeof value.claim !== 'object' || Array.isArray(value.claim) ||
       typeof (value.claim as Record<string, unknown>).key !== 'string' || typeof (value.claim as Record<string, unknown>).value !== 'string'))) {
     throw new Error('invalid memory summary');
@@ -85,8 +180,14 @@ export async function summarize(source: MemorySource, injected?: Record<string,
   return value as unknown as MemorySummary;
 }
 
+const defaultGuardianTask: GuardianTask = (items, assignee, now) => {
+  if (assignee !== 'guardian') throw new Error('invalid guardian assignee');
+  return guardianRetireAged(items, now);
+};
+
 /** Stage outputs travel only through the graph runner's per-run contexts. No decision ledger write occurs here. */
-export async function runNightlyStage(stage: Stage, context: Context, root: string, dryRun: boolean, now = new Date()): Promise<Record<string, unknown>> {
+export async function runNightlyStage(stage: Stage, context: Context, root: string, dryRun: boolean, now = new Date(),
+  nightlyTask?: NightlyTask, guardianTask: GuardianTask = defaultGuardianTask): Promise<Record<string, unknown>> {
   const input = context.input ?? {};
   if (dryRun && stage !== 'collect' && (!input.events || !input.decisions || !input.summaries)) {
     throw new Error('dry-run requires fake events, decisions and summaries');
@@ -103,51 +204,98 @@ export async function runNightlyStage(stage: Stage, context: Context, root: stri
     if (dryRun && (!input.events || !input.decisions || !input.summaries)) {
       throw new Error('dry-run requires fake events, decisions and summaries');
     }
-    const events = input.events ?? listCoordEvents({ since: new Date(Date.parse(`${day}T00:00:00Z`) - 86_400_000).toISOString() });
-    const decisions = input.decisions ?? (dryRun ? [] : new DecisionLedger().list({ status: 'all' }));
+    const events = input.events ?? readCondenseEvents(new Date(Date.parse(`${day}T00:00:00Z`) - 86_400_000).toISOString());
+    const decisions = input.decisions ?? (dryRun ? [] : new DecisionLedger({ stateDir: root }).list({ status: 'all' })
+      .filter(decision => decision.raisedBy.agent !== 'context-condense'));
     return { outcome: 'ok', day, events, decisions };
   }
   const collected = context.outputs.collect;
   if (!collected?.day || !collected.events || !collected.decisions) throw new Error('collect output missing');
   if (stage === 'condense') {
+    const assignments: Array<{ owner: 'coordinator'; assignee: 'nightly-task-agent'; contract: 'librarian'; recipe: 'sleep-review'; workerPid: number }> = [];
     const items = await condenseContextDay(collected.day, dryRun ? [] : storedItems(root).filter(item => Date.parse(item.updatedAt) < Date.parse(`${collected.day}T00:00:00Z`)), {
       events: () => collected.events!, decisions: () => collected.decisions!,
-      summarize: source => summarize(source, input.summaries),
-    }, now);
-    return { outcome: 'ok', items };
+      summarize: async source => {
+        if (dryRun) return summarize(source, input.summaries, 'sleep-review');
+        if (nightlyTask) return nightlyTask(source, 'nightly-task-agent', 'sleep-review');
+        const { result, workerPid } = await dispatchAssignment<MemorySummary>({ owner: 'coordinator', assignee: 'nightly-task-agent',
+          contract: 'librarian', recipe: 'sleep-review', source, ...(input.summaries ? { summary: input.summaries[source.source] } : {}) });
+        assignments.push({ owner: 'coordinator', assignee: 'nightly-task-agent', contract: 'librarian', recipe: 'sleep-review', workerPid });
+        return result;
+      },
+    }, now, { promotion: 'sleep-review', retention: 'guardian' });
+    return { outcome: 'ok', items, assignments };
   }
   const items = context.outputs.condense?.items;
   if (!items) throw new Error('condense output missing');
   if (stage === 'record') {
     const grouped = new Map<string, MemoryItem[]>();
-    for (const item of items) {
+    // The guardian task owns retirement; the librarian never mutates the stored status.
+    const guardianRun = guardianTask === defaultGuardianTask && !dryRun
+      ? await dispatchAssignment<MemoryItem[]>({ owner: 'guardian', assignee: 'guardian', recipe: 'retire-aged', items, now: now.toISOString() })
+      : { result: await guardianTask(items, 'guardian', now), workerPid: undefined };
+    const memoryItems = guardianRun.result;
+    for (const item of memoryItems) {
       const file = snapshotPath(root, item.project, item.seat);
       grouped.set(file, [...grouped.get(file) ?? [], item]);
     }
-    if (!dryRun) await withCurrentDay(root, day, () => {
-      for (const [file, group] of grouped) save(file, group);
+    if (!dryRun) await withCurrentDay(root, day, async () => {
+      // The record is all-or-nothing: each guardian write rolls back its own file, and if a later group
+      // fails (size budget, integrity, worker error) the files this record already wrote are restored too.
+      const written: Array<{ file: string; previous: Buffer | undefined; previousBackup: Buffer | undefined }> = [];
+      const snapshot = (path: string) => existsSync(path) ? readFileSync(path) : undefined;
+      try {
+        for (const [file, group] of grouped) {
+          const first = group[0]!;
+          written.push({ file, previous: snapshot(file), previousBackup: snapshot(`${file}.gz`) });
+          const stored = await dispatchAssignment<{ stored: true }>({ owner: 'guardian', assignee: 'guardian', recipe: 'store-snapshot',
+            root, project: first.project, seat: first.seat, value: group });
+          if (!stored.result.stored) throw new Error('guardian snapshot not stored');
+        }
+      } catch (error) {
+        // Restore both the snapshot and its backup to what they were before this record started.
+        for (const { file, previous, previousBackup } of written.reverse()) {
+          for (const [path, before] of [[file, previous], [`${file}.gz`, previousBackup]] as const) {
+            if (before) writeFileSync(path, before);
+            else if (existsSync(path)) unlinkSync(path);
+          }
+        }
+        throw error;
+      }
     });
-    return { outcome: 'ok', files: [...grouped.keys()], items: items.length, memoryItems: dryRun ? items : undefined, dryRun };
+    return { outcome: 'ok', files: [...grouped.keys()], items: items.length, memoryItems, dryRun,
+      guardian: { assignee: 'guardian', recipe: 'retire-aged', retired: memoryItems.filter(item => item.status === 'retired').length,
+        workerPid: guardianRun.workerPid } };
   }
   if (stage === 'conflict-candidates') {
     if (!context.outputs.record) throw new Error('record output missing');
-    const candidates = items.filter(item => item.conflict && item.status === 'active').map(item => ({
+    const recorded = context.outputs.record.memoryItems;
+    if (!recorded) throw new Error('guardian record output missing');
+    const candidates = recorded.filter(item => item.conflict && item.status === 'active').map(item => ({
       project: item.project, topic: item.topic, owner: item.conflict!.owner,
       sources: item.conflict!.sources, status: 'candidate' as const,
     }));
-    if (!dryRun) await withCurrentDay(root, day, () => save(join(root, 'context-memory', 'conflict-candidates.json'), candidates));
+    if (!dryRun) await withCurrentDay(root, day, async () => {
+      const stored = await dispatchAssignment<{ stored: true }>({ owner: 'guardian', assignee: 'guardian', recipe: 'store-candidates',
+        root, value: candidates });
+      if (!stored.result.stored) throw new Error('guardian candidates not stored');
+    });
     return { outcome: 'ok', candidates, published: 0 };
   }
   throw new Error(`unknown stage: ${stage}`);
 }
 
-if (import.meta.main) {
+if (import.meta.main && process.argv[2] === '--assigned-task') {
+  const assignment = await new Response(Bun.stdin.stream()).json() as Assignment;
+  console.log(JSON.stringify(await executeAssignment(assignment)));
+} else if (import.meta.main) {
   const stage = process.argv[2] as Stage;
   const path = process.env.ELANOUS_GRAPH_CONTEXT;
   if (!path || !['collect', 'condense', 'record', 'conflict-candidates'].includes(stage)) throw new Error('invalid nightly graph stage');
   const context = JSON.parse(readFileSync(path, 'utf8')) as Context;
   if (context.graphId !== 'nightly-condense' || context.nodeId !== stage) throw new Error('nightly graph context mismatch');
   const statePath = resolve(path, '..', '..', '..', '..');
-  const result = await runNightlyStage(stage, context, statePath, process.env.ELANOUS_GRAPH_DRY_RUN === '1');
+  const result = await runNightlyStage(stage, context, statePath, process.env.ELANOUS_GRAPH_DRY_RUN === '1',
+    new Date());
   console.log(JSON.stringify(result));
 }

package/src/control/control-status.ts

@@ -0,0 +1,87 @@
+import { readHqLease } from '../hq/hq.js';
+import { fileLeaseStore } from '../hq/lease.js';
+import { join } from 'node:path';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { getElanousConfigDirOverride } from '../elanous-config-dir.js';
+import { readLandingFreeze } from '../release-loop/landing-freeze.js';
+import { entriesFromRegistry, checkLoops, countLoopStates } from '../loops/checker.js';
+import { computeDrift, discoverUniverses } from '../cli/config-drift.js';
+import { debug } from '../debug/log.js';
+
+export type ControlStatusState = 'ok' | 'warn' | 'unmeasured';
+export type ControlStatusRowName = '집' | '판' | '자원' | '자격' | '동결·몫' | '루프' | 'config';
+export interface ControlStatusRow {
+  row: ControlStatusRowName;
+  state: ControlStatusState;
+  text: string;
+  reason?: string;
+}
+
+export interface ControlStatusDeps {
+  readLease?: () => ReturnType<typeof readHqLease> | Promise<ReturnType<typeof readHqLease>>;
+  readVersion?: () => ControlStatusRow | Promise<ControlStatusRow>;
+  readResources?: () => ControlStatusRow | Promise<ControlStatusRow>;
+  readCredentials?: () => ControlStatusRow | Promise<ControlStatusRow>;
+  readFreeze?: () => ReturnType<typeof readLandingFreeze> | Promise<ReturnType<typeof readLandingFreeze>>;
+  readLoops?: () => ReturnType<typeof entriesFromRegistry> | Promise<ReturnType<typeof entriesFromRegistry>>;
+  readDrift?: () => ReturnType<typeof computeDrift> | Promise<ReturnType<typeof computeDrift>>;
+  now?: () => Date;
+  log?: typeof debug.log;
+}
+
+const missing = (row: ControlStatusRowName, reason: string): ControlStatusRow => ({ row, state: 'unmeasured', text: '못 쟀다', reason });
+
+/** Read-only snapshot: each source fails independently; no lease renewal, freeze mutation or config sync. */
+export async function collectControlStatus(deps: ControlStatusDeps = {}): Promise<ControlStatusRow[]> {
+  const rows: ControlStatusRow[] = [];
+  const add = async (row: ControlStatusRowName, read: () => ControlStatusRow | Promise<ControlStatusRow>) => {
+    let result: ControlStatusRow;
+    try { result = await read(); }
+    catch (error) {
+      // Source errors may contain file contents or credentials; report the failure class, not the raw message.
+      result = missing(row, error instanceof Error ? `읽기 실패(${error.name})` : '읽기 실패');
+    }
+    rows.push(result);
+    try { (deps.log ?? debug.log.bind(debug))('control.status', 'row', { row, state: result.state }); }
+    catch { /* logging must not mask another row */ }
+  };
+
+  await add('집', async () => {
+    const readLease = deps.readLease ?? (() => readHqLease(getElanousConfigDirOverride() !== undefined
+      ? { store: fileLeaseStore(join(effectiveInstanceRoot(), 'hq', 'lease.json')), hostPath: join(effectiveInstanceRoot(), 'hq', 'host') }
+      : {}));
+    const { record, ageSeconds, expired } = await readLease();
+    if (!record) return missing('집', '본부 임대 기록 없음');
+    return { row: '집', state: expired ? 'warn' : 'ok',
+      text: `본부 ${record.holder} · 세대 ${record.generation} · ${ageSeconds}초 전 · ${expired ? '만료' : '유효'}` };
+  });
+  await add('판', deps.readVersion ?? (() => missing('판', '기계별 install.json·데몬 판·공개 판 원천 미연결')));
+  await add('자원', deps.readResources ?? (() => missing('자원', '기계별 Pod 실행/대기/실패·풀 상한·호스트 부하 원천 미연결')));
+  await add('자격', deps.readCredentials ?? (() => missing('자격', '계정별 만료·쿼터·갱신자 원천 미연결')));
+  await add('동결·몫', async () => {
+    const freeze = await (deps.readFreeze ?? readLandingFreeze)();
+    return { row: '동결·몫', state: freeze ? 'warn' : 'unmeasured',
+      text: freeze ? `동결 켬 · ${freeze.reason} · 끝 ${freeze.until ?? '미지정'} · 자리별 몫 못 쟀다` : '동결 끔 · 자리별 몫 못 쟀다',
+      reason: '자리별 몫/도는 수 원천 미연결' };
+  });
+  await add('루프', async () => {
+    const { entries, scope } = await (deps.readLoops ?? entriesFromRegistry)();
+    if (entries.length === 0) return missing('루프', `${scope} 루프 목록에 측정 대상 없음`);
+    const results = checkLoops(entries, (deps.now ?? (() => new Date()))());
+    const counts = countLoopStates(results);
+    if (counts.unknown + counts.unregistered + counts.off === results.length) return missing('루프', '활성 등록 루프의 마지막 실행/예정 시각을 잴 수 없음');
+    const failing = results.filter(result => result.state === 'failing').map(result => result.id);
+    const late = results.filter(result => result.state === 'late').map(result => result.id);
+    return { row: '루프', state: failing.length || late.length || counts.unknown || counts.unregistered || counts.off ? 'warn' : 'ok',
+      text: `failing ${counts.failing}${failing.length ? ` (${failing.join(', ')})` : ''} · late ${counts.late}${late.length ? ` (${late.join(', ')})` : ''} · unknown ${counts.unknown} · unregistered ${counts.unregistered} · off ${counts.off}` };
+  });
+  await add('config', async () => {
+    const report = await (deps.readDrift ?? (() => computeDrift(discoverUniverses(getElanousConfigDirOverride() !== undefined
+      ? { prodRoot: effectiveInstanceRoot(), registryPath: null, treeScanRoots: [] } : {}))))();
+    if (report.prodStatus !== 'ok' || !report.registry.ok || report.universes.unreadable > 0 || report.universes.compared === 0) {
+      return missing('config', `드리프트 비교 불가(집 ${report.prodStatus} · 레지스트리 ${report.registry.ok ? '읽음' : '못 읽음'} · 비교 ${report.universes.compared} · 못 읽은 우주 ${report.universes.unreadable})`);
+    }
+    return { row: 'config', state: report.rows.length ? 'warn' : 'ok', text: `드리프트 키 ${report.rows.length}` };
+  });
+  return rows;
+}

package/src/control-plane/light-member.ts

@@ -67,12 +67,14 @@ export async function runLightMember(opts: LightMemberOptions): Promise<LightMem
   const root = opts.root ?? effectiveInstanceRoot();
   const configured = readMachineProfile(root);
   if (configured) assertJoinedMachineId(configured.id, root);
-  const machineAttrs = () => {
+  // measureLoad is async (harness parents · disk I/O); a pending Promise would serialize as `{}` and blank `load`.
+  const pageoutBaseline: { value: number } = { value: Number.NaN };
+  const machineAttrs = async () => {
     const profile = readMachineProfile(root);
     if (profile && profile.id !== machine) {
       throw new Error(`machine id ${profile.id} differs from joined machine ${machine}`);
     }
-    return { load: measureLoad(now), ...(profile ? { duties: profile.duties, seats: profile.seats } : {}) };
+    return { load: await measureLoad(now, pageoutBaseline), ...(profile ? { duties: profile.duties, seats: profile.seats } : {}) };
   };
   const interval = opts.intervalMs ?? DEFAULT_INTERVAL_MS;
   if (!Number.isFinite(interval) || interval <= 0 || interval > MAX_RETRY_MS) throw new Error('invalid member heartbeat interval');
@@ -119,7 +121,7 @@ export async function runLightMember(opts: LightMemberOptions): Promise<LightMem
   while (!signal.aborted) {
     const resources: LightMemberResult['resources'] = [];
     try {
-      const attrs = machineAttrs();
+      const attrs = await machineAttrs();
       await post(machineId, registered.has(machineId) ? { attrs } : {
         id: machineId, kind: 'machine', machine, name: machine, owner: '',
         attrs, observedAt: now(), ttlMs: TTL_MS,

package/src/control-plane/member.ts

@@ -1,5 +1,7 @@
-import { readFileSync } from 'node:fs';
-import { cpus, freemem, loadavg, totalmem } from 'node:os';
+import { execFile } from 'node:child_process';
+import { readFileSync, promises as fs } from 'node:fs';
+import { promisify } from 'node:util';
+import { cpus, freemem, loadavg, platform, totalmem } from 'node:os';
 import { join } from 'node:path';
 import { debug } from '../debug/log.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
@@ -12,13 +14,173 @@ const MAX_RETRY_MS = 300_000;
 // Ordinary ticks start within the 10-minute TTL; first failure retries within 30 seconds.
 const MAX_INTERVAL_MS = MAX_RETRY_MS;
 const REQUEST_TIMEOUT_MS = 5_000;
+const PROCESS_PROBE_TIMEOUT_MS = 2_000;
+const execFileAsync = promisify(execFile);
 
-export function measureLoad(now: () => number = Date.now): {
+type Measurement<T> = { value: T; source: string; observedAt: number; status: 'ok' }
+  | { value: null; source: string; observedAt: number; status: 'unmeasured'; reason: string };
+
+function unmeasured<T>(source: string, observedAt: number, reason: string): Measurement<T> {
+  return { value: null, source, observedAt, status: 'unmeasured', reason };
+}
+
+export interface HarnessParentSummary {
+  count: Measurement<number>;
+  oldestAgeSeconds: Measurement<number>;
+  versionMismatchCount: Measurement<number>;
+}
+
+// Pod image commit is fixed at process startup; file paths and mutable package versions are not process identities.
+const STARTUP_IMAGE_COMMIT = process.env.ELANOUS_IMAGE_COMMIT?.trim();
+const HARNESS_PARENT_COMMAND = /^(?:(?:\S*\/)?(?:bun|node)\s+)?(?:\S*\/)?elanous\.mjs\s+harness\s+(?:say|ask)(?:\s|$)/;
+
+export function parseHarnessParentPs(text: string): HarnessProcessList {
+  if (!text.trim()) return { status: 'incomplete', stage: 'ps-parse' };
+  const records: Array<{ pid: number; command: string; elapsedSeconds: number }> = [];
+  let incomplete = false;
+  for (const line of text.split('\n')) {
+    const candidate = line.trim().match(/^\d+\s+\S+\s+(.+)$/)?.[1];
+    if (!candidate || !HARNESS_PARENT_COMMAND.test(candidate)) continue;
+    const match = line.trim().match(/^(\d+)\s+(?:(\d+)-)?(?:(\d+):)?(\d+):(\d+)\s+(.+)$/);
+    if (!match) { incomplete = true; continue; }
+    const pid = Number(match[1]);
+    const days = Number(match[2] ?? 0);
+    const hours = Number(match[3] ?? 0);
+    const minutes = Number(match[4]);
+    const seconds = Number(match[5]);
+    if (!Number.isSafeInteger(pid) || pid <= 0 || minutes >= 60 || seconds >= 60 || (match[3] !== undefined && hours >= 24)) { incomplete = true; continue; }
+    records.push({ pid, elapsedSeconds: days * 86_400 + hours * 3_600 + minutes * 60 + seconds, command: match[6]! });
+  }
+  return incomplete ? { status: 'incomplete', stage: 'ps-parse' } : { status: 'ok', records };
+}
+
+interface HarnessProcessList {
+  status: 'ok' | 'incomplete' | 'failed';
+  stage?: string;
+  records?: readonly { pid: number; command: string; elapsedSeconds: number; version?: string }[];
+}
+
+async function readHarnessProcessVersion(pid: number): Promise<string | undefined> {
+  if (platform() !== 'linux') return undefined;
+  try {
+    const env = await fs.readFile(`/proc/${pid}/environ`, { encoding: 'utf8', signal: AbortSignal.timeout(PROCESS_PROBE_TIMEOUT_MS) });
+    const versions = env.split('\0').filter(entry => entry.startsWith('ELANOUS_IMAGE_COMMIT='))
+      .map(entry => entry.slice('ELANOUS_IMAGE_COMMIT='.length).trim());
+    return versions.length === 1 && versions[0] ? versions[0] : undefined;
+  } catch { return undefined; }
+}
+
+export async function listHarnessParents(
+  run: typeof execFileAsync = execFileAsync,
+  readVersion: (pid: number) => Promise<string | undefined> = readHarnessProcessVersion,
+): Promise<HarnessProcessList> {
+  try {
+    const { stdout } = await run('ps', ['-axo', 'pid=,etime=,command='], {
+      encoding: 'utf8', timeout: PROCESS_PROBE_TIMEOUT_MS, maxBuffer: 4 * 1024 * 1024,
+    });
+    const parsed = parseHarnessParentPs(stdout);
+    if (parsed.status !== 'ok' || !parsed.records) return parsed;
+    const records = await Promise.all(parsed.records.map(async record => {
+      const version = await readVersion(record.pid).catch(() => undefined);
+      return { ...record, ...(version ? { version } : {}) };
+    }));
+    return { status: 'ok', records };
+  } catch { return { status: 'failed', stage: 'ps-exec' }; }
+}
+
+/** A process command/path is not the version loaded into a running process. Only startup-stamped identities count. */
+export function measureHarnessParents(
+  observedAt = Date.now(),
+  observation: HarnessProcessList = { status: 'failed', stage: 'ps-exec' },
+  currentVersion?: string,
+): HarnessParentSummary {
+  const source = 'ps:harness-processes';
+  if (observation.status !== 'ok' || !observation.records) {
+    const reason = observation.status === 'incomplete' ? 'ps-parse incomplete' : (observation.stage ?? 'ps-exec');
+    return { count: unmeasured(source, observedAt, reason), oldestAgeSeconds: unmeasured(source, observedAt, reason),
+      versionMismatchCount: unmeasured(source, observedAt, reason) };
+  }
+  const ok = (value: number): Measurement<number> => ({ value, source, observedAt, status: 'ok' });
+  const records = observation.records.filter(record => HARNESS_PARENT_COMMAND.test(record.command));
+  const count = ok(records.length);
+  const oldestAgeSeconds = records.length === 0
+    ? unmeasured<number>(source, observedAt, 'no-parents')
+    : records.every(record => Number.isFinite(record.elapsedSeconds) && record.elapsedSeconds >= 0)
+      ? ok(Math.max(...records.map(record => record.elapsedSeconds)))
+      : unmeasured<number>(source, observedAt, 'elapsed-unavailable');
+  const versionMismatchCount = records.length === 0 ? ok(0)
+    : currentVersion && records.every(record => typeof record.version === 'string' && record.version.length > 0)
+      ? ok(records.filter(record => record.version !== currentVersion).length)
+      : unmeasured<number>(source, observedAt, 'version-unavailable');
+  return { count, oldestAgeSeconds, versionMismatchCount };
+}
+
+export interface DiskIoPressure {
+  pageouts: Measurement<number>;
+  io: Measurement<{ someAvg10: number; fullAvg10: number }>;
+}
+
+export async function measureDiskIoPressure(
+  observedAt = Date.now(),
+  deps: { platform?: NodeJS.Platform; vmStat?: () => Promise<string> | string; readPressure?: () => Promise<string> | string } = {},
+  pageoutBaseline?: { value: number },
+): Promise<DiskIoPressure> {
+  const os = deps.platform ?? platform();
+  let pageouts: Measurement<number> = unmeasured('vm_stat:pageouts', observedAt, 'platform');
+  if (os === 'darwin') {
+    try {
+      const text = await (deps.vmStat ?? (async () => (await execFileAsync('vm_stat', [], {
+        encoding: 'utf8', timeout: PROCESS_PROBE_TIMEOUT_MS, maxBuffer: 1024 * 1024,
+      })).stdout))();
+      // Real macOS vm_stat prints `Pageouts:`; older/other formats print `Pages paged out:`.
+      const value = text.match(/^(?:Pageouts|Pages paged out):\s*([\d,]+)\s*\.?\s*$/m)?.[1];
+      if (value && Number.isSafeInteger(Number(value.replaceAll(',', '')))) {
+        const total = Number(value.replaceAll(',', ''));
+        pageouts = pageoutBaseline
+          ? Number.isFinite(pageoutBaseline.value) && total >= pageoutBaseline.value
+            ? { value: total - pageoutBaseline.value, source: 'vm_stat:pageouts', observedAt, status: 'ok' }
+            : unmeasured('vm_stat:pageouts', observedAt, 'baseline-unavailable')
+          : { value: total, source: 'vm_stat:pageouts', observedAt, status: 'ok' };
+        if (pageoutBaseline) pageoutBaseline.value = total;
+      }
+      else pageouts = unmeasured('vm_stat:pageouts', observedAt, 'invalid-output');
+    } catch { pageouts = unmeasured('vm_stat:pageouts', observedAt, 'vm_stat-failed'); }
+  }
+  let io: DiskIoPressure['io'] = unmeasured('/proc/pressure/io', observedAt, 'platform');
+  if (os === 'linux') {
+    try {
+      const text = await (deps.readPressure ?? (() => fs.readFile('/proc/pressure/io', {
+        encoding: 'utf8', signal: AbortSignal.timeout(PROCESS_PROBE_TIMEOUT_MS),
+      })))();
+      const some = text.match(/^some\s+avg10=(\d+(?:\.\d+)?)(?:\s|$)/m)?.[1];
+      const full = text.match(/^full\s+avg10=(\d+(?:\.\d+)?)(?:\s|$)/m)?.[1];
+      if (some !== undefined && full !== undefined && Number.isFinite(Number(some)) && Number.isFinite(Number(full)))
+        io = { value: { someAvg10: Number(some), fullAvg10: Number(full) }, source: '/proc/pressure/io', observedAt, status: 'ok' };
+      else io = unmeasured('/proc/pressure/io', observedAt, 'invalid-output');
+    } catch { io = unmeasured('/proc/pressure/io', observedAt, 'pressure-read-failed'); }
+  }
+  return { pageouts, io };
+}
+
+export async function measureLoad(
+  now: () => number = Date.now,
+  pageoutBaseline?: { value: number },
+  deps: { listParents?: () => Promise<HarnessProcessList>; diskIo?: (at: number, baseline?: { value: number }) => Promise<DiskIoPressure>; currentVersion?: string } = {},
+): Promise<{
   loadAvg: number[]; cpuCount: number; freeMem: number; totalMem: number; observedAt: number;
-} {
+  harnessParents: HarnessParentSummary; diskIo: DiskIoPressure;
+}> {
+  const observedAt = now();
+  const [parents, diskIo] = await Promise.all([
+    (deps.listParents ?? listHarnessParents)().catch((): HarnessProcessList => ({ status: 'failed', stage: 'ps-exec' })),
+    (deps.diskIo ?? ((at, baseline) => measureDiskIoPressure(at, {}, baseline)))(observedAt, pageoutBaseline)
+      .catch((): DiskIoPressure => ({ pageouts: unmeasured<number>('vm_stat:pageouts', observedAt, 'probe-failed'),
+        io: unmeasured<{ someAvg10: number; fullAvg10: number }>('/proc/pressure/io', observedAt, 'probe-failed') })),
+  ]);
   return {
     loadAvg: loadavg(), cpuCount: cpus().length,
-    freeMem: freemem(), totalMem: totalmem(), observedAt: now(),
+    freeMem: freemem(), totalMem: totalmem(), observedAt,
+    harnessParents: measureHarnessParents(observedAt, parents, deps.currentVersion ?? STARTUP_IMAGE_COMMIT), diskIo,
   };
 }
 
@@ -50,6 +212,7 @@ export interface MemberHeartbeatOptions {
   intervalMs?: number;
   fetch?: (input: URL | RequestInfo, init?: RequestInit) => Promise<Response>;
   now?: () => number;
+  measure?: (now: () => number, pageoutBaseline: { value: number }) => Promise<Awaited<ReturnType<typeof measureLoad>>>;
 }
 
 /** 넥서스 멤버의 기계 신원 — OS hostname 이 아니라 임대·관제가 쓰는 기계 식별자(`resolveMachineName`)를 쓴다.
@@ -81,6 +244,8 @@ export function startMemberHeartbeat(opts: MemberHeartbeatOptions): () => void {
   let failures = 0;
   let lastFailure: string | undefined;
   const machineId = opts.machine.id;
+  const pageoutBaseline: { value: number } = { value: Number.NaN };
+  const machineLoad = () => (opts.measure ?? measureLoad)(now, pageoutBaseline);
   // 자원의 `machine` 칸 = 기계 «이름»(가벼운 멤버·임대와 같은 값). 기계 범위 토큰은 이 칸을 토큰의 기계와 대조한다(server.ts requireMachine).
   const machineName = opts.machine.name;
 
@@ -106,7 +271,7 @@ export function startMemberHeartbeat(opts: MemberHeartbeatOptions): () => void {
   const register = async (): Promise<void> => {
     await post('/v1/resources/register', {
       ...opts.machine, kind: 'machine', machine: machineName, owner: '',
-      attrs: { ...opts.machine.attrs, load: measureLoad(now) }, observedAt: now(), ttlMs: MAX_RETRY_MS * 2,
+      attrs: { ...opts.machine.attrs, load: await machineLoad() }, observedAt: now(), ttlMs: MAX_RETRY_MS * 2,
     });
     await post('/v1/resources/register', {
       ...opts.instance, kind: 'instance', machine: machineName, owner: '',
@@ -125,7 +290,7 @@ export function startMemberHeartbeat(opts: MemberHeartbeatOptions): () => void {
     try {
       if (!registered) await register();
       else {
-        await post(`/v1/resources/${encodeURIComponent(machineId)}/heartbeat`, { attrs: { load: measureLoad(now) } });
+        await post(`/v1/resources/${encodeURIComponent(machineId)}/heartbeat`, { attrs: { load: await machineLoad() } });
         heartbeatsSinceInstanceRefresh++;
         if (heartbeatsSinceInstanceRefresh * interval >= MAX_RETRY_MS) {
           await post(`/v1/resources/${encodeURIComponent(opts.instance.id)}/heartbeat`, {});