elanous 0.2.21 → 0.2.23

package/src/harness/harness-cli-command.ts

@@ -1,15 +1,17 @@
-import { execFile, execFileSync, spawn } from 'node:child_process';
+import { execFile, execFileSync, spawn, spawnSync } from 'node:child_process';
 import { promisify } from 'node:util';
 import { dlopen, FFIType } from 'bun:ffi';
 import { createHash } from 'node:crypto';
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { constants as osConstants, hostname } from 'node:os';
 import { basename, dirname, join, resolve, sep } from 'node:path';
+import { HarnessCliInputError } from '../cli/cli-user-error.js';
 import { findGitDir } from '../git-fs/locate.js';
 import { LogStore, logsDbPath } from '../mss/logging/log-store.js';
 import { loadSelfDevRun } from '../self-dev/run-store.js';
 import { normalizeRunId } from './harness-space.js';
 import { effectiveInstanceRoot, prodInstanceRoot } from '../instance/resolve.js';
+import { stateDirSourceForChild } from '../agent/identity-env.js';
 import { lookupGoal, type GoalLookupOptions, type GoalLookupResult } from '../self-implement/goal-lookup.js';
 import { archiveGoals, type GoalArchiveOptions } from '../self-implement/goal-archive.js';
 import { detectBursts, formatIncidentBurstWarning, incidentLastLines, readRunExits, recentBurst, recordRunExit } from './harness-incidents.js';
@@ -19,17 +21,22 @@ import { GOAL_TYPES, lintGoalFile, parseGoalId, parseGoalType, resolveGoalAuthor
 import { templateForGoalType } from '../self-implement/graph-templates.js';
 import { listRunLedgers, loadFederatedRunLedger, loadRunLedger, queryRunScreenKey, runLedgerDir, type RunLedgerMatch } from '../self-implement/run-ledger.js';
 import { classifyPodExitStop, recordRunStop, runStopRecorded, RUN_STOP_EVENT } from '../self-implement/run-stop.js';
-import { resolveChildLlmEffort, resolveImplementationChildModel } from '../self-dev/dev-cli.js';
+import { ensureOpenRouterChildModelLive, resolveChildLlmEffort, resolveImplementationChildModel } from '../self-dev/dev-cli.js';
 import { resolveHarnessTarget } from '../self-implement/harness-target-options.js';
 import { queryRunningRuns } from '../self-implement/running-runs.js';
 import { DevPipelineError } from '../self-dev/dev-pipeline.js';
-import { collectDraftMetrics, DRAFT_SWEEP_CONCURRENCY, mapBounded, runDraftSweep, sweepFailureReason, type DraftSweepAdapters, type DraftSweepResult, type SweepDraft, type SweepMergedPr, type SweepReviewGate } from '../self-dev/draft-sweep.js';
+import { collectDraftMetrics, collectOverlapMetrics, DRAFT_SWEEP_CONCURRENCY, mapBounded, resolveDraftSweepCloseCap, runDraftSweep, sweepFailureReason, type DraftSweepAdapters, type DraftSweepResult, type OverlapMetricAdapters, type SweepDraft, type SweepMergedPr, type SweepReviewGate } from '../self-dev/draft-sweep.js';
+import { readAskPreflightRowsSince, readSalvagedRowsSince } from '../self-dev/ask-launch-io.js';
+import { replayPodTerminals, type DraftResidueReplayOptions, type PrTerminalRecord } from '../self-dev/draft-residue.js';
+import { draftClaimComment, draftReleaseComment } from '../self-dev/draft-triage-rules.js';
+import { readTaskAgentState, taskAgentStatePath, type TaskCard } from '../task-agent/task-hand.js';
 import { debug } from '../debug/log.js';
 import { installHarnessSalvageCommand, installHarnessSalvageRetentionCommand } from './harness-salvage-cli.js';
 import { decideNestedElanousLaunch, readNestedElanousDepth } from './nested-elanous-policy.js';
 import { dispatchTask, type DispatchTaskInput, type DispatchTaskDeps } from '../execution-loop/dispatch-task.js';
 import { launchRequestId, preLaunchGate, type PreLaunchGateDeps } from '../execution-loop/launch-gate.js';
 import { PR_LABELS } from '../github/pr-labels.js';
+import { ghAutomationEnv } from '../autopilot/pr-manager.js';
 import { CODEX_PROVIDER, GROK_PROVIDER, decideBudget, decideLaunchBudget, readBudgetInputsLive, type BudgetDecision, type BudgetInputs } from '../self-implement/budget-gate.js';
 import { DEFAULT_FALLBACK_CHAIN } from '../oauth/fallback-chain.js';
 import { installDeliverableVerifyCliCommand, type InstallDeliverableVerifyCliDeps } from './deliverable-verify-cli.js';
@@ -41,8 +48,10 @@ import { resolveRepositoryName } from './repository-name.js';
 import { installHarnessCliSinkHook } from './harness-cli-sink.js';
 import { addHarnessQueue, HarnessQueueDuplicateError, harnessQueueReceiptPath, listHarnessQueue, queueSeatForCwd, reconcileHarnessQueue, removeHarnessQueue, setHarnessQueuePriority, tickHarnessQueue, type HarnessQueueDeps, type QueueItem, type QueueSeat } from './harness-queue.js';
 import { writeHarnessQueueReceipt } from './harness-queue-child.js';
+import { decideBackpressure, readBackpressureSignals, type BackpressureReadDeps } from './dispatch-backpressure.js';
 import { parseDoorSince, queryLaunchDoors, renderLaunchDoors, type DoorTable } from './launch-stamp.js';
 import { resolveHarnessSubstrate, type ResolvedHarnessSubstrate } from './harness-substrate-default.js';
+import { podChildProviderRefusal } from '../task-orchestrator/surfaces/pod-child-providers.js';
 import { runHarnessPlanRfc } from './harness-plan-rfc.js';
 import { classifyGarbage, isGarbageProcessTarget, type GarbageProcess } from './process-garbage.js';
 import type { MissionSolveOutcome } from './mission-solve-loop.js';
@@ -94,16 +103,9 @@ export function setHarnessPlanRfcForTesting(fn: typeof runHarnessPlanRfc | undef
   harnessPlanRfcForTesting = fn;
 }
 
-export type HarnessSupervisorSource = 'flag' | 'default';
+export { HarnessCliInputError } from '../cli/cli-user-error.js';
 
-/** A command-line value was rejected before any harness work began. */
-export class HarnessCliInputError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = 'HarnessCliInputError';
-    Object.defineProperty(this, Symbol.for('elanous.cli.HarnessCliInputError'), { value: true });
-  }
-}
+export type HarnessSupervisorSource = 'flag' | 'default';
 
 export interface HarnessAskSayOptions {
   seat?: QueueSeat;
@@ -424,6 +426,7 @@ export function classifyHarnessPodExit(
 ): { lines: string[]; reason: PodExitReason | 'pod-failure' } {
   let podFailure: string | undefined;
   let podJobFailed = false;
+  let podChildFailed = false;
   for (const line of output.split('\n').reverse()) {
     if (!line.trimStart().startsWith('[{') || !line.includes('"error"')) continue;
     try {
@@ -435,6 +438,7 @@ export function classifyHarnessPodExit(
         if (typeof error?.code !== 'string' || typeof error.message !== 'string' || !error.code.startsWith('pod-')) continue;
         podFailure = error.message;
         podJobFailed = error.code === 'pod-job-failed';
+        podChildFailed = error.code === 'pod-child-failed';
         break;
       }
     } catch { /* Non-result stdout cannot establish that a Pod child ran. */ }
@@ -444,6 +448,8 @@ export function classifyHarnessPodExit(
     const summary = output.split('\n').find((line) => /\s❌\sfailed · .* — pod-[\w-]+: /.test(line));
     podFailure = summary?.split(/\s❌\sfailed · .* — pod-[\w-]+: /)[1];
     podJobFailed = summary?.includes(' — pod-job-failed: ') ?? false;
+    // src/self-dev/orchestrate-summary-line.ts prints the pod-child-failed message (the Pod reason) on this line.
+    podChildFailed = summary?.includes(' — pod-child-failed: ') ?? false;
   }
   // Only the run announced at launch — another run id quoted in the output is not this run (review round 3).
   const observedRunId = deps.runId ?? harnessPodRunId(output);
@@ -451,9 +457,11 @@ export function classifyHarnessPodExit(
   if (podFailure) {
     const childError = podJobFailed ? podFailure.split('childError=')[1]?.split('\\n', 1)[0]?.split('\n', 1)[0] : undefined;
     try { debug.log('harness.pod', 'exit-classified', { runId, reason: 'pod-failure', status: exit.status, signal: exit.signal ?? null }); } catch { /* observation is fail-soft */ }
-    return { reason: 'pod-failure', lines: [podJobFailed && childError && childError !== 'no-result-line'
-      ? `Pod 안 자식이 실패했다 — ${childError}`
-      : `Pod 실행이 실패했다 — ${podFailure.split('\\n', 1)[0]}`] };
+    return { reason: 'pod-failure', lines: [podChildFailed
+      ? `Pod 안 자식이 실패했다 — ${podFailure.split('\\n', 1)[0]}`
+      : podJobFailed && childError && childError !== 'no-result-line'
+        ? `Pod 안 자식이 실패했다 — ${childError}`
+        : `Pod 실행이 실패했다 — ${podFailure.split('\\n', 1)[0]}`] };
   }
   let ledger: ReturnType<typeof loadRunLedger> = null;
   let ledgerReadable = false;
@@ -674,6 +682,7 @@ async function onPod(opts: unknown, entrance: 'cli-harness-ask' | 'cli-harness-s
       output = (output + text).slice(-16_000);
     } });
   if (status !== 0) {
+    // onPod is the existing ask/say caller: classify the dispatchHarnessOnPod output for both entrances.
     const classified = classifyHarnessPodExit({ status }, output, { ...(runId ? { runId } : {}) });
     recordClassifiedHarnessPodExit(runId ?? harnessPodRunId(output), classified.reason, status,
       { entrance, seat: o.seat, output });
@@ -711,6 +720,25 @@ export function recordHarnessPodStop(
   } catch { return false; /* ledger observation cannot change Pod output or exit */ }
 }
 
+/**
+ * POD-ANTHROPIC-PROVIDER ⓓ — 발사 관문과 Pod 가 «한 목록»(`POD_CHILD_PROVIDERS`)을 본다.
+ * 🩸 10-10: 관문은 anthropic 을 «예산 판정 밖» 으로 통과시켰고 Pod 단계가 rc=2 로 죽었다(관문·Pod 목록 엇갈림).
+ * Pod 기질에서 목록 밖 provider 는 발사 «전»에 Pod 와 같은 문면으로 거부한다 — 로컬 기질은 판정하지 않는다.
+ */
+export function podChildProviderLaunchRefusal(substrate: ResolvedHarnessSubstrate['substrate'], childLlmProvider: string | undefined): string | undefined {
+  return substrate === 'pod' ? podChildProviderRefusal(childLlmProvider) : undefined;
+}
+
+function refusePodChildProviderBeforeLaunch(resolved: ResolvedHarnessSubstrate, opts: { readonly childLlmProvider?: string }): boolean {
+  const refusal = podChildProviderLaunchRefusal(resolved.substrate, opts.childLlmProvider);
+  if (!refusal) return false;
+  console.error(`❌ launch gate: ${refusal}`);
+  try { debug.log('execution-loop.launch-gate', 'pod-child-provider-refused', { provider: opts.childLlmProvider?.trim() ?? null, substrate: resolved.substrate }); }
+  catch { /* observation is fail-soft */ }
+  process.exitCode = 2;
+  return true;
+}
+
 const LAUNCH_BUDGET_PROVIDER: Readonly<Record<string, string>> = { 'codex-rotate': CODEX_PROVIDER, grok: GROK_PROVIDER };
 
 /**
@@ -782,6 +810,10 @@ async function dispatchHarnessAskSay(
   // HARNESS-FULL-GRAPH — 여정 조인 키는 이 발사 동안만 환경에 싣는다(자식은 그동안 물려받는다).
   const journeyPreset = Boolean(process.env[JOURNEY_KEY_ENV]?.trim());
   try { await runInjectedHarnessHandler(async () => {
+    // POD-ANTHROPIC-PROVIDER ⓓ — Pod 가 못 받는 provider 는 모델 검사·대기열·관문 «전»에(그리고 `--dry-run` 머리 줄보다 먼저) 거부한다 —
+    //   Pod 와 같은 목록·같은 문면. 기질 판정은 아래 resolveLaunchSubstrate 와 같은 리졸버(같은 입력)다.
+    if (refusePodChildProviderBeforeLaunch(resolveHarnessSubstrate({ flag: opts as HarnessSubstrateOpts, config: getUserConfig(), env: process.env }), opts)) return;
+    if (opts.childLlmModel !== undefined) await ensureOpenRouterChildModelLive(opts.childLlmProvider, opts.childLlmModel, { persist: !isHarnessDryRun(opts) });
     assertHarnessChildLlmModel(opts);
     if (isHarnessDryRun(opts)) {
       resolveLaunchSubstrate(opts);
@@ -1589,6 +1621,28 @@ function readProcessCwd(pid: number): Pick<HarnessProcessRecord, 'cwd' | 'cwdSta
   }
 }
 
+/** One `lsof` for many pids (a per-pid lsof costs ~0.1–0.3 s); lsof exits 1 when some pid is gone yet prints the rest. */
+function batchProcessCwdReader(pids: readonly number[]): (pid: number) => Pick<HarnessProcessRecord, 'cwd' | 'cwdStatus' | 'cwdFailureReason'> {
+  const cwds = new Map<number, string>();
+  let failure: string | undefined;
+  if (pids.length) {
+    const result = spawnSync('lsof', ['-a', '-d', 'cwd', '-Fpn', '-p', pids.join(',')],
+      { encoding: 'utf8', timeout: 5_000, maxBuffer: 16 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'] });
+    if (result.error || typeof result.stdout !== 'string') failure = observationFailureReason(result.error ?? new Error('lsof output missing'));
+    else {
+      let current: number | undefined;
+      for (const line of result.stdout.split('\n')) {
+        if (line.startsWith('p')) current = Number(line.slice(1));
+        else if (line.startsWith('n') && current !== undefined && line.length > 1) cwds.set(current, line.slice(1).trim());
+      }
+    }
+  }
+  return (pid) => {
+    const cwd = cwds.get(pid);
+    return cwd ? { cwd, cwdStatus: 'observed' } : { cwdStatus: 'unknown', cwdFailureReason: failure ?? 'lsof cwd missing' };
+  };
+}
+
 const OWNERSHIP_ENV_KEYS = new Set<string>(Object.values(HARNESS_PROCESS_OWNERSHIP_ENV));
 
 function ownershipValueFromEntry(entry: string, key: string): string | undefined {
@@ -1744,10 +1798,23 @@ export function readProcessOwnership(
   }
 }
 
-export function defaultListHarnessProcesses(): HarnessProcessListObservation {
+/** Narrows the per-process reads (`lsof` cwd ≈ 0.1 s each · `ps eww`) of `defaultListHarnessProcesses`. */
+export interface HarnessProcessListOptions {
+  /** Keep only matching records; the others are dropped before any per-process read. */
+  readonly include?: (record: HarnessProcessRecord) => boolean;
+  /** Skip the ownership (`ps eww`) read — for callers that only need the cwd. */
+  readonly cwdOnly?: boolean;
+  /** Wall-clock budget for the per-process reads; records past it keep `cwdStatus: 'unknown'` (reason names the budget). */
+  readonly deadlineMs?: number;
+  readonly readCwd?: (pid: number) => Pick<HarnessProcessRecord, 'cwd' | 'cwdStatus' | 'cwdFailureReason'>;
+  readonly psOutput?: () => string;
+  readonly clock?: () => number;
+}
+
+export function defaultListHarnessProcesses(options: HarnessProcessListOptions = {}): HarnessProcessListObservation {
   let out: string;
   try {
-    out = execFileSync('ps', ['-axo', 'pid=,ppid=,pcpu=,etime=,command='], {
+    out = options.psOutput ? options.psOutput() : execFileSync('ps', ['-axo', 'pid=,ppid=,pcpu=,etime=,command='], {
       encoding: 'utf8',
       timeout: 5_000,
       stdio: ['ignore', 'pipe', 'ignore'],
@@ -1757,11 +1824,21 @@ export function defaultListHarnessProcesses(): HarnessProcessListObservation {
   }
   const parsed = parseHarnessProcessPsOutput(out);
   if (parsed.status === 'failed') return parsed;
-  const records = parsed.records.map((record) => ({
-    ...record,
-    ...readProcessCwd(record.pid),
-    ownership: readProcessOwnership(record.pid),
-  }));
+  const clock = options.clock ?? Date.now;
+  const selected = options.include ? parsed.records.filter(options.include) : parsed.records;
+  const readCwd = options.readCwd ?? (options.cwdOnly ? batchProcessCwdReader(selected.map((record) => record.pid)) : readProcessCwd);
+  const deadline = options.deadlineMs === undefined ? Infinity : clock() + options.deadlineMs;
+  const records = selected.map((record) => {
+    // A host with hundreds of harness processes made the serial reads take minutes (10-08 queue tick hang).
+    if (clock() >= deadline) {
+      return { ...record, cwdStatus: 'unknown' as const, cwdFailureReason: `observation deadline ${options.deadlineMs}ms exceeded` };
+    }
+    return {
+      ...record,
+      ...readCwd(record.pid),
+      ...(options.cwdOnly ? {} : { ownership: readProcessOwnership(record.pid) }),
+    };
+  });
   if (parsed.status === 'incomplete') {
     return {
       status: 'incomplete',
@@ -1877,12 +1954,30 @@ type GithubPull = {
 
 type GhExecute = (args: string[]) => string;
 
-// ⛔ `env: process.env` is required: Bun resolves the executable against the PATH it started with, not the one
-//    ensure-bin-path augments. Under cron's minimal PATH the hourly sweep died with «Executable not found: gh» (2026-09-28).
-const executeGh: GhExecute = (args) => execFileSync('gh', args, {
-  encoding: 'utf8', timeout: 30_000, maxBuffer: 16 * 1024 * 1024,
-  stdio: ['ignore', 'pipe', 'pipe'], env: process.env,
-});
+// Explicit env preserves the augmented PATH under Bun (cron may start with a minimal PATH).
+// Authentication comes from the same automation policy used by the PR manager, not the user's keyring.
+// Failure details are bounded and redact the token before reaching the sweep result or debug log.
+function ghFailure(args: string[], error: unknown, token: string | undefined): Error {
+  const failure = error as { status?: number | null; code?: number | string; stderr?: string | Buffer };
+  const exit = failure.status ?? (typeof failure.code === 'number' ? failure.code : 'unknown');
+  const stderr = String(failure.stderr ?? '');
+  const stderrTail = (token ? stderr.replaceAll(token, '[REDACTED]') : stderr).slice(-300).replace(/[\r\n]+/g, ' ').trim();
+  try { debug.log('harness.drafts', 'gh-failed', { args0: args[0], exit, stderrTail }); }
+  catch { /* Logging must not hide the gh failure. */ }
+  // gh never ran (e.g. «Executable not found: gh»): no exit or stderr to report, so keep the spawn error itself.
+  if (typeof failure.status !== 'number' && !stderrTail && error instanceof Error) return error;
+  return new Error(`gh ${args.slice(0, 2).join(' ')} exit=${exit}: ${stderrTail}`);
+}
+
+const executeGh: GhExecute = (args) => {
+  const env = ghAutomationEnv(process.env);
+  try {
+    return execFileSync('gh', args, {
+      encoding: 'utf8', timeout: 30_000, maxBuffer: 16 * 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'pipe'], env,
+    });
+  } catch (error) { throw ghFailure(args, error, env.GH_TOKEN); }
+};
 
 /** Merge-time adapter: reuse the sweep's GitHub inventory and worktree liveness without a second triage implementation. */
 export async function supersedeMergedGoalDrafts(
@@ -1986,9 +2081,14 @@ function deliverResyncMemo(spaceId: string, memo: ControlMemoPayload,
 }
 
 const execFileAsync = promisify(execFile);
-const executeGhAsync = async (args: string[]): Promise<string> => (await execFileAsync('gh', args, {
-  encoding: 'utf8', timeout: 30_000, maxBuffer: 16 * 1024 * 1024, env: process.env,
-})).stdout;
+const executeGhAsync = async (args: string[]): Promise<string> => {
+  const env = ghAutomationEnv(process.env);
+  try {
+    return (await execFileAsync('gh', args, {
+      encoding: 'utf8', timeout: 30_000, maxBuffer: 16 * 1024 * 1024, env,
+    })).stdout;
+  } catch (error) { throw ghFailure(args, error, env.GH_TOKEN); }
+};
 
 /** RUN-TTL adapters: open self-impl PRs, head commit time (async, bounded by the core), owning run, memo, label. */
 export async function githubRunTtlAdapters(repository: string, execute: GhExecute = executeGh,
@@ -2321,6 +2421,16 @@ export function githubDraftSweepAdapters(execute: GhExecute = executeGh, git: Dr
       ...(gatePass && !gateFail ? { gate: 'pass' as const } : gateFail ? { gate: 'fail' as const } : {}),
     };
   };
+  const claimCommentsFor = async (repository: string, number: number): Promise<string[]> => {
+    const batched = (await detailFor(repository, number))?.comments;
+    if (batched) return batched;
+    const pages = ghJson<Array<Array<{ body: string; created_at: string }>>>(['api', '--paginate', '--slurp',
+      `repos/${repository}/issues/${number}/comments?per_page=100`], execute);
+    if (!Array.isArray(pages) || pages.some((page) => !Array.isArray(page)
+      || page.some((comment) => typeof comment.body !== 'string' || !Number.isFinite(Date.parse(comment.created_at)))))
+      throw new Error('Incomplete claim comments');
+    return pages.flat().sort((a, b) => Date.parse(a.created_at) - Date.parse(b.created_at)).map((comment) => comment.body);
+  };
   const landingCommentsFor = async (repository: string, number: number): Promise<string[]> =>
     ((await detailFor(repository, number))?.comments ?? await issueCommentsFor(repository, number, 'landing'))
       .filter((body) => /\blanding-verified\b/i.test(body));
@@ -2449,30 +2559,32 @@ export function githubDraftSweepAdapters(execute: GhExecute = executeGh, git: Dr
       execute(['pr', 'close', String(number), '--repo', repository, '--comment', comment]);
     },
     getClaimOwner: async (repository, number) => claimCommentOwner(repository, number, execute),
-    getActiveClaimOwner: async (repository, number) => {
-      // DRAFT-METRIC: the batched GraphQL comments (oldest first, proven complete) answer without a per-draft REST call.
-      const batched = (await detailFor(repository, number))?.comments;
-      if (batched) return activeClaimOwnerFromBodies(batched);
-      const pages = ghJson<Array<Array<{ body: string; created_at: string }>>>(['api', '--paginate', '--slurp',
-        `repos/${repository}/issues/${number}/comments?per_page=100`], execute);
-      if (!Array.isArray(pages) || pages.some((page) => !Array.isArray(page)
-        || page.some((comment) => typeof comment.body !== 'string' || !Number.isFinite(Date.parse(comment.created_at)))))
-        throw new Error('Incomplete claim comments');
-      return activeClaimOwnerFromBodies(pages.flat().sort((a, b) => Date.parse(a.created_at) - Date.parse(b.created_at))
-        .map((comment) => comment.body));
-    },
+    getActiveClaimOwner: async (repository, number) => activeClaimOwnerFromBodies(await claimCommentsFor(repository, number)),
+    getActiveClaimRunId: async (repository, number) => activeClaimRunIdFromBodies(await claimCommentsFor(repository, number)),
+    getLastClaimReleaseAt: async (repository, number) => lastClaimReleaseAtFromBodies(await claimCommentsFor(repository, number)),
+    listTaskCards: async () => Object.values(readTaskAgentState<{ tasks?: Record<string, TaskCard> }>(taskAgentStatePath()).tasks ?? {}),
+    listPrTerminals: async () => listRunLedgers().matches.flatMap((match) => match.entries.filter((entry) => entry.event === 'pr-terminal')
+      .map((entry) => entry.data as unknown as PrTerminalRecord)),
+    commentDraft: async (repository, number, body) => { execute(['pr', 'comment', String(number), '--repo', repository, '--body', body]); },
+    removeLabel: async (repository, number, name) => { execute(['pr', 'edit', String(number), '--repo', repository, '--remove-label', name]); },
     getReviewGate: async (draft, repository) => reviewGateForDraft(draft, repository),
   };
 }
 
 export interface HarnessDraftSweepDeps {
   readonly adapters?: DraftSweepAdapters;
+  /** Optional overlap source injection; tests do not read GitHub or logs.db. */
+  readonly overlapAdapters?: OverlapMetricAdapters;
   readonly repository?: () => string;
   readonly write?: (line: string) => void;
   readonly execute?: GhExecute;
   readonly now?: () => Date;
   /** RUN-TTL step adapters. Omitted with injected `adapters` ⇒ the step is skipped (fakes never reach real gh). */
   readonly runTtl?: RunTtlAdapters;
+  /** Test seam for `tools.selfImplement.draftSweepCloseCap`; omitted ⇒ the user config. */
+  readonly closeCapConfig?: () => unknown;
+  /** Replay test seam; production reads this instance's host run-ledger directory. */
+  readonly residueReplay?: DraftResidueReplayOptions;
 }
 
 /** RUN-TTL step inside the draft sweep — fail-soft: its failure never changes the sweep verdict. */
@@ -2501,6 +2613,18 @@ export function activeClaimOwnerFromBodies(bodies: readonly string[]): string |
   return last ? draftClaimOwner(last) : undefined;
 }
 
+export function activeClaimRunIdFromBodies(bodies: readonly string[]): string | undefined {
+  const last = [...bodies].reverse().find((body) => draftClaimOwner(body) !== undefined || body.startsWith('🔧 처리 끝 —'));
+  return last && draftClaimOwner(last) ? / · run (\S+)/.exec(last)?.[1] : undefined;
+}
+
+/** Timestamp of the latest marker when it is a release ('' when its time is unreadable); undefined otherwise. */
+export function lastClaimReleaseAtFromBodies(bodies: readonly string[]): string | undefined {
+  const last = [...bodies].reverse().find((body) => draftClaimOwner(body) !== undefined || body.startsWith('🔧 처리 끝 —'));
+  if (!last || draftClaimOwner(last) !== undefined) return undefined;
+  return /^🔧 처리 끝 — (\S+)/.exec(last)?.[1] ?? '';
+}
+
 function draftClaimOwner(body: string): string | undefined {
   return /^🔧 처리 중 — owner ([^\n·]+?) · /m.exec(body)?.[1]?.trim();
 }
@@ -2544,12 +2668,12 @@ function installHarnessDraftSweepCommand(harnessCmd: Command, deps: HarnessDraft
           }
           const stalled = PR_LABELS.find((label) => label.axis === 'state' && label.sweep.action === 'close' && label.name.endsWith(':stalled'))!.name;
           execute(['pr', 'edit', number, '--repo', repository, '--add-label', stalled, '--remove-label', running]);
-          execute(['pr', 'comment', number, '--repo', repository, '--body', `🔧 처리 끝 — ${(deps.now?.() ?? new Date()).toISOString()}`]);
+          execute(['pr', 'comment', number, '--repo', repository, '--body', draftReleaseComment(deps.now?.() ?? new Date())]);
         } else {
           execute(['pr', 'edit', number, '--repo', repository, '--add-label', running,
             ...otherStates.flatMap((item) => ['--remove-label', item.name])]);
           execute(['pr', 'comment', number, '--repo', repository, '--body',
-            `🔧 처리 중 — owner ${owner} · ${(deps.now?.() ?? new Date()).toISOString()}${opts.note?.trim() ? ` · ${opts.note.trim()}` : ''}`]);
+            draftClaimComment(owner!, deps.now?.() ?? new Date(), opts.note)]);
         }
         (deps.write ?? console.log)(`#${number} ${opts.release ? 'release' : 'claim'}: ${repository}`);
       } catch (error) {
@@ -2566,10 +2690,22 @@ function installHarnessDraftSweepCommand(harnessCmd: Command, deps: HarnessDraft
         const repository = resolveRepositoryName({ repo: opts.repo ?? deps.repository?.(), executeGh: (args) => execute(args) });
         if (!DRAFT_SWEEP_REPOSITORY.test(repository) || repository.includes('..')) throw new HarnessCliInputError(`invalid --repo (expected owner/name): ${repository}`);
         const started = Date.now();
-        const metrics = await collectDraftMetrics(repository, deps.adapters ?? githubDraftSweepAdapters(deps.execute), deps.now?.() ?? new Date());
+        const adapters = deps.adapters ?? githubDraftSweepAdapters(deps.execute);
+        const now = deps.now?.() ?? new Date();
+        const metrics = await collectDraftMetrics(repository, adapters, now);
+        let overlap: Awaited<ReturnType<typeof collectOverlapMetrics>> | null = null;
+        try {
+          overlap = await collectOverlapMetrics(repository, deps.overlapAdapters ?? {
+            ...adapters,
+            listPreflightRows: readAskPreflightRowsSince,
+            listSalvagedRows: readSalvagedRowsSince,
+          }, now);
+        } catch (error) {
+          try { debug.log('self-dev.draft-metrics', 'overlap-failed', { repository, reason: sweepFailureReason(error) }); } catch { /* fail-soft */ }
+        }
         try { debug.log('self-dev.draft-metrics', 'collected', { repository, ms: Date.now() - started, ...metrics }); } catch { /* fail-soft */ }
         const write = deps.write ?? console.log;
-        if (opts.json) write(JSON.stringify({ repository, ...metrics }));
+        if (opts.json) write(JSON.stringify({ repository, ...metrics, overlap }));
         else write(`draft 재고 ${metrics.inventory} · 최장 나이 ${metrics.oldestAgeHours === null ? '해당 없음' : `${metrics.oldestAgeHours.toFixed(1)}h`} · needs-owner ${metrics.needsOwner} · 48h 전환율 ${metrics.conversion48h === null ? '표본 없음' : `${(metrics.conversion48h * 100).toFixed(1)}% (${metrics.converted48h}/${metrics.cohort48h})`}`);
       } catch (error) {
         console.error(humanErrorLine(error));
@@ -2580,7 +2716,8 @@ function installHarnessDraftSweepCommand(harnessCmd: Command, deps: HarnessDraft
     .option('--apply', '판정한 라벨 변경과 종료를 적용')
     .option('--json', '판정 결과를 JSON 으로 출력')
     .option('--repo <owner/name>', '조회할 GitHub 저장소')
-    .action(async (opts: { apply?: boolean; json?: boolean; repo?: string }) => {
+    .option('--close-cap <n>', '이번 틱 최대 종료 수 (1~100 · config tools.selfImplement.draftSweepCloseCap 보다 우선 · 기본 10)')
+    .action(async (opts: { apply?: boolean; json?: boolean; repo?: string; closeCap?: string }) => {
       try {
         const write = deps.write ?? console.log;
         const execute = deps.execute ?? executeGh;
@@ -2593,7 +2730,27 @@ function installHarnessDraftSweepCommand(harnessCmd: Command, deps: HarnessDraft
         }
         // One adapter instance per sweep: its open listing and ledger scan are shared with the RUN-TTL step.
         const github = deps.adapters ? undefined : githubDraftSweepAdapters(deps.execute);
-        const result: DraftSweepResult = await runDraftSweep({ repository, apply: opts.apply === true, adapters: deps.adapters ?? github! });
+        const configCap = deps.closeCapConfig
+          ? deps.closeCapConfig()
+          : (() => { try { return getUserConfig().tools?.selfImplement?.draftSweepCloseCap; } catch { return undefined; } })();
+        const cap = resolveDraftSweepCloseCap({ flag: opts.closeCap, config: configCap });
+        for (const warning of cap.warnings) {
+          console.error(`⚠ ${warning}`);
+          try { debug.log('self-dev.draft-sweep', 'close-cap-rejected', { warning, closeCap: cap.closeCap, closeCapSource: cap.closeCapSource }); } catch { /* fail-soft */ }
+        }
+        let replayClosed = 0;
+        if (opts.apply && (!deps.adapters || deps.residueReplay)) {
+          try {
+            replayClosed = (await replayPodTerminals({ ...deps.residueReplay, repository, closeCap: cap.closeCap })).closed;
+          } catch (error) {
+            // Review r5: a replay that throws may already have closed PRs — spend the whole cap so this tick cannot exceed it.
+            replayClosed = cap.closeCap;
+            debug.log('draft.residue', 'failed', { childRunId: null, prNumber: null, terminalClass: null,
+              owner: 'unknown', ownerSource: 'unknown', step: 'replay', reason: sweepFailureReason(error) });
+          }
+        }
+        const result: DraftSweepResult = await runDraftSweep({ repository, apply: opts.apply === true, adapters: deps.adapters ?? github!,
+          closeCap: cap.closeCap, closeCapSource: cap.closeCapSource, alreadyClosed: replayClosed });
         const reason = result.error ? sweepFailureReason(result.error) : undefined;
         const ttlStarted = Date.now();
         const runTtl = await draftSweepRunTtl(repository, deps, github);
@@ -2858,6 +3015,7 @@ export interface HarnessCliCommandDeps {
   processObservation?: HarnessProcessObservationDeps;
   draftSweep?: HarnessDraftSweepDeps;
   queue?: HarnessQueueDeps;
+  backpressure?: BackpressureReadDeps;
   goalLookup?: GoalLookupOptions;
   goalArchive?: GoalArchiveOptions;
   ask?: HarnessAskHandler;
@@ -2937,6 +3095,24 @@ export function installHarnessCliCommand(program: Command, deps: HarnessCliComma
   installHarnessGoalCommand(harnessCmd, deps.goalLookup, deps.goalArchive);
   installHarnessDraftSweepCommand(harnessCmd, deps.draftSweep);
   const queue = harnessCmd.command('queue').description('자리별 영속 발사 대기열');
+  queue.command('backpressure').description('읽기 전용 발사 역압 판정')
+    .option('--json', '판정 객체 JSON 한 줄').option('--max <n>', '주기당 발사 상한 (기본 6)')
+    .action((opts: { json?: boolean; max?: string }) => {
+      if (opts.max !== undefined && (!/^(0|[1-9][0-9]*)$/.test(opts.max) || !Number.isSafeInteger(Number(opts.max)))) {
+        console.error('❌ --max 는 0 이상의 정수여야 합니다');
+        process.exitCode = 2;
+        return;
+      }
+      try {
+        const signals = readBackpressureSignals(deps.backpressure);
+        const verdict = decideBackpressure(signals, { maxPerCycle: opts.max === undefined ? 6 : Number(opts.max) });
+        debug.log('traffic.backpressure', 'verdict', { launchBudget: verdict.launchBudget, reasons: verdict.reasons, signals: verdict.signals });
+        console.log(opts.json ? JSON.stringify(verdict) : `발사 예산 ${verdict.launchBudget} · 이유 ${verdict.reasons.join(', ') || '없음'}`);
+      } catch (error) {
+        console.error(`❌ backpressure: ${error instanceof Error ? error.message : String(error)}`);
+        process.exitCode = 1;
+      }
+    });
   const queueDeps = deps.queue ?? {};
   let launchedExit: Promise<number> | undefined;
   const immediateLaunch: NonNullable<HarnessQueueDeps['launch']> = queueDeps.launch ?? (async (item: QueueItem, args: string[], root: string) => {
@@ -2944,7 +3120,8 @@ export function installHarnessCliCommand(program: Command, deps: HarnessCliComma
       harnessQueueReceiptPath(root, item.launchId!), queueDeps.launchCommand ?? join(import.meta.dir, '../../bin/elanous.mjs'),
       ...(resolve(root) === prodInstanceRoot() ? [] : [`--test=${root}`]), ...args], {
       cwd: item.launchCwd ?? resolve(import.meta.dir, '../..'), stdio: 'inherit',
-      env: { ...process.env, ELANOUS_STATE_DIR: root, ELANOUS_HARNESS_SEAT: item.seat,
+      env: { ...process.env, ELANOUS_STATE_DIR: root,
+        ELANOUS_STATE_DIR_SOURCE: stateDirSourceForChild(root), ELANOUS_HARNESS_SEAT: item.seat,
         ELANOUS_HARNESS_QUEUE_LAUNCH: item.launchId! },
     });
     // Capture the end at spawn time: a child that already closed (or died by a signal) must not leave the parent waiting.