elanous 0.2.23 → 0.2.24

package/src/budget/llm-cost.ts

@@ -11,6 +11,7 @@ import { findGrokModel } from '../grok/models.js';
 import { getUserConfig } from '../user-config.js';
 import { BUILTIN_CATALOG } from '../intelligence-map/model-catalog.js';
 import { getCatalog } from '../registry/loader.js';
+import { byokCostFor, type ByokActualCost, type ByokPartialCost } from '../llm/openrouter-byok-cost.js';
 
 export interface LlmPricingUsd {
   inputPerM: number;
@@ -23,6 +24,13 @@ export interface LlmPricingUsd {
   longContext?: { thresholdTokens: number; inputPerM: number; outputPerM: number; cacheReadPerM?: number; cacheWritePerM?: number };
 }
 
+/** AWS Bedrock Global Standard prices, USD per million tokens (AWS pricing API, ap-northeast-2). */
+export const BEDROCK_PRICING_USD: Readonly<Record<string, LlmPricingUsd>> = {
+  'claude-haiku-5-5': { inputPerM: 0.1, outputPerM: 0.5, cacheWritePerM: 0.125, cacheReadPerM: 0.01 },
+  'claude-sonnet-5-5': { inputPerM: 2, outputPerM: 10, cacheWritePerM: 2.5, cacheReadPerM: 0.1 },
+  'claude-opus-5-5': { inputPerM: 4, outputPerM: 20, cacheWritePerM: 5, cacheReadPerM: 0.2 },
+};
+
 export interface LlmCostUsage {
   model: string;
   inputTokens?: number;
@@ -46,7 +54,7 @@ export type LlmCostEstimate =
       kind: 'known';
       model: string;
       usd: number;
-      source: 'catalog' | 'config' | 'registry';
+      source: 'catalog' | 'bedrock-catalog' | 'config' | 'registry';
       cacheReadPricedAt: 'cache-read' | 'input-rate';
       cacheWritePricedAt: 'cache-write' | 'input-rate';
       /** 장문맥 단가로 매겼으면 `'long-context'` — 없으면 기본 단가. */
@@ -56,7 +64,7 @@ export type LlmCostEstimate =
       kind: 'partial';
       model: string;
       usd: number;
-      source: 'catalog' | 'config' | 'registry';
+      source: 'catalog' | 'bedrock-catalog' | 'config' | 'registry';
       cacheReadPricedAt: 'cache-read' | 'input-rate';
       cacheWritePricedAt: 'cache-write' | 'input-rate';
       pricedTier?: 'long-context';
@@ -147,6 +155,21 @@ export function normalizePricingModelId(model: string): string {
   return m;
 }
 
+/** Normalize a Bedrock Anthropic model id to its bare Claude pricing id. */
+export function bedrockPricingModelId(model: string): string {
+  return model.trim()
+    .replace(/^bedrock\//, '')
+    .replace(/^[a-z0-9-]+\.anthropic\./i, '')
+    .replace(/^anthropic\./, '')
+    .replace(/-v1:0$/, '');
+}
+
+function isBedrockPricingModel(model: string): boolean {
+  const trimmed = model.trim();
+  return /^(?:bedrock\/|[a-z0-9-]+\.anthropic\.|anthropic\.)/i.test(trimmed)
+    && bedrockPricingModelId(trimmed).startsWith('claude-');
+}
+
 /** 저장소의 모델 정본(intelligence-map BUILTIN_CATALOG) — 손 카탈로그 넷에 없는 모델(Claude 5 계열 등)의 입력·출력 단가.
  *  캐시 단가는 거기 없다 → Anthropic 모델은 공식 규칙(읽기 0.1× · 쓰기 5분 1.25×)으로 파생한다. 다른 벤더는 입력 단가로 매기고
  *  `cacheReadPricedAt: 'input-rate'` 로 그 사실을 드러낸다(추측하지 않는다). */
@@ -174,8 +197,8 @@ function registryPricing(model: string): LlmPricingUsd | undefined {
 function resolvePricing(
   model: string,
   opts?: EstimateLlmCostOptions,
-): { pricing: LlmPricingUsd; source: 'catalog' | 'config' | 'registry' } | undefined {
-  // ⭐ 순서: 손 카탈로그(정확) → 정규화 id → config 오버레이 → 저장소 정본 → 레지스트리. 앞이 이긴다.
+): { pricing: LlmPricingUsd; source: 'catalog' | 'bedrock-catalog' | 'config' | 'registry' } | undefined {
+  // ⭐ 순서: 손 카탈로그(정확) → 정규화 id → config 오버레이 → Bedrock 표 → 저장소 정본 → 레지스트리. 앞이 이긴다.
   const normalized = normalizePricingModelId(model);
   for (const id of normalized === model ? [model] : [model, normalized]) {
     const catalog = catalogPricing(id);
@@ -185,6 +208,10 @@ function resolvePricing(
     const overlay = opts?.configPricing?.[id];
     if (validPricing(overlay)) return { pricing: overlay, source: 'config' };
   }
+  if (isBedrockPricingModel(model)) {
+    const bedrock = BEDROCK_PRICING_USD[bedrockPricingModelId(model)];
+    if (validPricing(bedrock)) return { pricing: bedrock, source: 'bedrock-catalog' };
+  }
   const builtin = builtinCatalogPricing(normalized);
   if (validPricing(builtin)) return { pricing: builtin, source: 'catalog' };
   const registry = registryPricing(model);
@@ -297,11 +324,16 @@ export function llmUsageCostFields(
   usage: Omit<LlmCostUsage, 'model'>,
   opts?: EstimateLlmCostOptions,
   billing?: BillingRoute,
-): { cost: LlmCostEstimate | IncludedLlmCost | ActualLlmCost } {
+): { cost: LlmCostEstimate | IncludedLlmCost | ActualLlmCost | ByokActualCost | ByokPartialCost } {
   const resolved = opts ?? { configPricing: readLlmConfigPricing() };
   const estimate = estimateLlmCost({ model, ...usage }, resolved);
   // ⛔⭐ 구독을 API 단가로 «known» 이라 적지 않는다 — 09-25 벤치에서 codex 구독 팔이 `$7.81 known` 으로 보였다.
   // ⭐ BACKLOG C7 — provider 가 실어 보낸 «실제 청구액»이 있으면 그것이 비용이다(추정은 곁에 남긴다).
+  // OR-BYOK-COST — BYOK 면 «OR 청구 + 상류 청구»가 비용이다(상류를 모르면 partial · 0 으로 가정하지 않는다).
+  if (billing !== 'subscription' && billing !== 'local') {
+    const byok = byokCostFor(model, usage as Parameters<typeof byokCostFor>[1], estimate.kind === 'known' || estimate.kind === 'partial' ? estimate.usd : undefined);
+    if (byok) return { cost: byok };
+  }
   const reported = (usage as { reportedCostUsd?: unknown }).reportedCostUsd;
   if (typeof reported === 'number' && Number.isFinite(reported) && billing !== 'subscription' && billing !== 'local') {
     return { cost: { kind: 'actual', model, usd: reported, source: 'provider-reported', ...(estimate.kind === 'known' || estimate.kind === 'partial' ? { estimateUsd: estimate.usd } : {}) } };

package/src/budget/types.ts

@@ -158,18 +158,24 @@ export type ResetCreditExpiryAxis =
   | { readonly status: 'expired'; readonly expiresAt: string; readonly hasUnknownExpiry: boolean };
 
 export interface AccountUsageRow {
-  readonly provider: 'codex' | 'grok' | 'openrouter';
+  /** `zai` = GLM Coding Plan(ZAI-CODING-PLAN-PROVIDER) — `ZAI_API_KEY` 가 있을 때만 행이 생긴다. */
+  readonly provider: 'codex' | 'grok' | 'openrouter' | 'zai';
   readonly accountName: string;
   readonly accountCount: number;
   readonly soleAccount: boolean;
   readonly credits: CreditAxis;
   readonly subscription: SubscriptionAxis;
   readonly resetCredits: ResetCreditExpiryAxis;
+  /** 행 끝에 붙는 한 줄(출처·실수치) — 없으면 종전 문면과 바이트 동일. */
+  readonly note?: string;
 }
 
 export interface UnifiedUsageReport {
   readonly rows: readonly AccountUsageRow[];
-  readonly accountCounts: Readonly<Record<'codex' | 'grok' | 'openrouter', number>>;
+  /** `zai` 는 키가 있을 때만 실린다(없으면 종전 JSON 과 같다). */
+  readonly accountCounts: Readonly<Record<'codex' | 'grok' | 'openrouter', number>> & { readonly zai?: number };
+  /** GLM Coding Plan 상세(창 · 우리 적산 · 잔액 사용 · 마지막 한도 코드) — 키가 있을 때만. */
+  readonly zaiCodingPlan?: import('../llm/zai-coding-plan.js').ZaiUsageView;
 }
 
 export interface TurnSummary {

package/src/budget/unified-usage.ts

@@ -9,6 +9,7 @@ import { createCodexFetcher, type CodexFetcherOpts } from './fetchers/codex.js';
 import {
   fetchGrokUsage,
   GROK_SUBSCRIPTION_AXIS,
+  grokUsageToSubscriptionAxis,
   grokUsageToCreditAxis,
   type GrokUsageResult,
 } from '../grok/usage.js';
@@ -20,6 +21,10 @@ import { envLiteral } from '../platform/env-literal.js';
 import { describeResetCreditExpiry } from './codex-reset-credit-state.js';
 import { visibleWidth } from '../tui.js';
 import { listCodexResetCredits, type CodexResetCreditsResult } from './codex-reset-credits.js';
+import {
+  buildZaiUsageView, fetchZaiQuota, getZaiApiKey, readZaiLedger,
+  type ZaiLedgerRecord, type ZaiQuotaResult, type ZaiUsageView,
+} from '../llm/zai-coding-plan.js';
 import type {
   AccountUsageRow,
   CreditAxis,
@@ -50,24 +55,93 @@ export interface UnifiedUsageDeps {
   /** 결정 2026-09-23 — OpenRouter 선불 크레딧 조회 seam. 없으면 실키로 `/api/v1/credits`. */
   readonly openRouterKey?: () => string | undefined;
   readonly fetchOpenRouterImpl?: typeof fetch;
+  /** ZAI-CODING-PLAN-PROVIDER seam — 키 «있음» 판정(값은 안 쓴다) · 공식 조회 · 원장. */
+  readonly zaiKey?: () => string | undefined;
+  readonly fetchZaiQuota?: () => Promise<ZaiQuotaResult>;
+  readonly readZaiLedger?: () => ZaiLedgerRecord[];
 }
 
 export async function collectUnifiedUsage(deps: UnifiedUsageDeps = {}): Promise<UnifiedUsageReport> {
-  const [codexRows, grokRows, openRouterRows] = await Promise.all([
+  const [codexRows, grokRows, openRouterRows, zai] = await Promise.all([
     collectCodexRows(deps),
     collectGrokRows(deps),
     collectOpenRouterRows(deps),
+    collectZaiRows(deps),
   ]);
   return {
-    rows: [...codexRows, ...grokRows, ...openRouterRows],
+    rows: [...codexRows, ...grokRows, ...openRouterRows, ...(zai?.rows ?? [])],
     accountCounts: {
       codex: codexRows.length,
       grok: grokRows.length,
       openrouter: openRouterRows.length,
+      // ⛔ 키가 없으면 칸 자체를 안 싣는다 — 종전 JSON·문면과 바이트 동일.
+      ...(zai ? { zai: 1 } : {}),
     },
+    ...(zai ? { zaiCodingPlan: zai.view } : {}),
   };
 }
 
+/** ZAI-CODING-PLAN-PROVIDER — GLM Coding Plan 의 5h·주 창 ⊕ 잔액(extra usage) 사용.
+ *  ⓒ 공식 조회(`/api/monitor/usage/quota/limit`)가 되면 그 값 · 안 되면 ⓐ 우리 적산 ⊕ ⓑ 429 리셋 시각으로 «추정».
+ *  ⛔ 키가 없으면 행을 «안» 만든다. ⛔ 시험 런타임은 seam 이 없으면 «키 없음»(키 캐시는 파일이라 스크럽을 통과한다). */
+async function collectZaiRows(deps: UnifiedUsageDeps): Promise<{ rows: AccountUsageRow[]; view: ZaiUsageView } | null> {
+  // ⛔ 시험 런타임(NODE_ENV=test)은 seam 이 없으면 «env 의 ZAI_API_KEY 만» 본다 — 키 캐시 «파일»은 env 스크럽을 통과해
+  //   seam 을 모르는 옛 usage 시험이 실제 Z.ai 를 치게 되기 때문이다. env 로 키를 주면 test 에서도 행이 선다.
+  const key = (deps.zaiKey ?? (process.env.NODE_ENV === 'test' ? () => process.env.ZAI_API_KEY?.trim() || undefined : () => getZaiApiKey()))();
+  if (!key) return null;
+  const nowMs = (deps.now ?? Date.now)();
+  // ⛔ 조회가 «던져도» usage 전체를 죽이지 않는다 — 실패는 결과값으로 바꿔 추정 표로 간다.
+  const quota: ZaiQuotaResult = await (deps.fetchZaiQuota ?? (() => fetchZaiQuota()))()
+    .catch((error: unknown) => ({ status: 'error' as const, detail: error instanceof Error ? error.message : String(error) }));
+  const view = buildZaiUsageView(quota, (deps.readZaiLedger ?? (() => readZaiLedger()))(), nowMs);
+  const base = { provider: 'zai' as const, accountCount: 1, soleAccount: true, resetCredits: { status: 'not-applicable' } as const };
+  const sourceLabel = { official: '공식', next_flush_time: 'next_flush_time', estimated: '추정' } as const;
+  const rows: AccountUsageRow[] = view.windows.map((w) => {
+    const windowMs = w.window === '5h' ? 5 * 3_600_000 : 7 * 86_400_000;
+    const usedPercent = w.limit > 0 ? Math.round((w.used / w.limit) * 1000) / 10 : null;
+    const end = w.resetAt !== null && isValidEpochMs(w.resetAt) ? new Date(w.resetAt) : null;
+    const kind: WindowKind = w.window === '5h' ? 'session' : 'weekly';
+    return {
+      ...base,
+      accountName: w.window === '5h' ? 'plan-5h' : 'plan-week',
+      credits: {
+        status: 'ok',
+        usedPercent,
+        periodType: kind,
+        periodStart: end ? new Date(end.getTime() - windowMs).toISOString() : null,
+        periodEnd: end?.toISOString() ?? null,
+        monthlyLimit: null,
+        used: w.used,
+        onDemandCap: null,
+        onDemandUsed: null,
+        prepaidBalance: null,
+        balance: null,
+        hasCredits: null,
+        unlimited: false,
+      },
+      // 리셋 시각을 모르면 «available» 로 NaN 을 흘리지 않는다.
+      subscription: usedPercent === null || !end
+        ? { status: 'unavailable', reason: 'query-does-not-supply' }
+        : { status: 'available', remainingPercent: Math.round((100 - usedPercent) * 10) / 10, resetsAt: end.getTime(), windowKind: kind },
+      // ⓐ 우리 적산을 공식 값 옆에 같이 둔다 — 공식은 정수 크레딧으로 내려 작은 호출이 0 으로 보인다(10-11 실측).
+      note: `${w.used}/${w.limit} 크레딧 · 출처=${sourceLabel[w.source]}${w.resetAt === null ? ' · 리셋 시각 모름' : ''}`
+        + (w.source === 'official' ? ` · elanous 적산 ${w.window === '5h' ? view.local.fiveHour.used : view.local.weekly.used}` : ''),
+    };
+  });
+  rows.push({
+    ...base,
+    accountName: 'extra-usage',
+    credits: {
+      status: 'ok', usedPercent: null, periodType: 'extra-usage', periodStart: null, periodEnd: null,
+      monthlyLimit: null, used: view.balanceCredits, onDemandCap: null, onDemandUsed: null,
+      prepaidBalance: null, balance: null, hasCredits: null, unlimited: false,
+    },
+    subscription: { status: 'unavailable', reason: 'not-a-subscription' },
+    note: `잔액 사용 ${view.balanceCredits} 크레딧(추정 · 최근 7일)${view.lastLimit ? ` · 마지막 한도 코드 ${view.lastLimit.code}` : ''}`,
+  });
+  return { rows, view };
+}
+
 async function collectCodexRows(deps: UnifiedUsageDeps): Promise<AccountUsageRow[]> {
   const listed = (deps.listCodexAccounts ?? listCodexAccountsInStore)();
   const accounts = listed;
@@ -138,7 +212,11 @@ async function collectGrokRows(deps: UnifiedUsageDeps): Promise<AccountUsageRow[
     resetCredits: { status: 'not-applicable' } as const,
   };
   if (result.status === 'ok') {
-    return [{ ...base, credits: grokUsageToCreditAxis(result.usage) }];
+    return [{
+      ...base,
+      subscription: grokUsageToSubscriptionAxis(result.usage),
+      credits: grokUsageToCreditAxis(result.usage),
+    }];
   }
   if (result.status === 'no-subscription') {
     return [{ ...base, credits: { status: 'no-subscription' } }];
@@ -284,7 +362,7 @@ export function formatUsageCompact(report: UnifiedUsageReport, options: { width:
     const reset = subscription.status === 'available' ? subscription.resetsAt
       : credits.status === 'ok' && credits.periodEnd ? Date.parse(credits.periodEnd) : Number.NaN;
     const periodLabel = period ? `${formatCompactPeriod(period)} ` : '';
-    const when = period === 'prepaid-usd' ? '' : !isValidEpochMs(reset)
+    const when = period === 'prepaid-usd' || period === 'extra-usage' ? '' : !isValidEpochMs(reset)
       ? ` · ${periodLabel}시각 모름`
       : reset <= options.nowMs
         ? ` · ${periodLabel}재조회 필요`
@@ -351,6 +429,8 @@ export function formatUnifiedUsage(report: UnifiedUsageReport): string {
     const count = report.accountCounts[provider];
     lines.push(`  ${provider}  accounts=${count}${count === 1 ? '  (하나뿐)' : count === 0 ? '  (없음)' : ''}`);
   }
+  // ⛔ 키가 없으면 줄을 안 낸다 — 종전 문면과 바이트 동일.
+  if (report.accountCounts.zai !== undefined) lines.push(`  zai  accounts=${report.accountCounts.zai}  (GLM Coding Plan)`);
   lines.push('  provider    account     accounts  credits.usedPercent  credits.window              window-resets-in       reset-credit-expiry                  subscription');
   for (const row of report.rows) {
     lines.push(formatRow(row));
@@ -364,7 +444,7 @@ function formatRow(row: AccountUsageRow): string {
   const resetsIn = formatWindowResetsIn(row.credits);
   const resetCredits = formatResetCreditExpiryCell(row.resetCredits);
   const subscription = formatSubscriptionCell(row.subscription);
-  return `  ${row.provider.padEnd(10)} ${row.accountName.padEnd(11)} ${String(row.accountCount).padEnd(8)} ${credits.padEnd(20)} ${window.padEnd(26)} ${resetsIn.padEnd(22)} ${resetCredits.padEnd(36)} ${subscription}`;
+  return `  ${row.provider.padEnd(10)} ${row.accountName.padEnd(11)} ${String(row.accountCount).padEnd(8)} ${credits.padEnd(20)} ${window.padEnd(26)} ${resetsIn.padEnd(22)} ${resetCredits.padEnd(36)} ${subscription}${row.note ? `  — ${row.note}` : ''}`;
 }
 
 function formatResetCreditExpiryCell(expiry: ResetCreditExpiryAxis): string {
@@ -381,6 +461,7 @@ function formatResetCreditExpiryCell(expiry: ResetCreditExpiryAxis): string {
 
 function formatCreditsCell(credits: CreditAxis): string {
   if (credits.status !== 'ok') return credits.status;
+  if (credits.periodType === 'extra-usage') return `${credits.used ?? 0} cr`;
   if (credits.usedPercent === null) return 'unknown';
   // 선불 달러 — 퍼센트만으로는 «얼마 남았나»를 못 읽는다.
   if (credits.periodType === 'prepaid-usd' && credits.balance !== null) return `${credits.usedPercent}% ($${credits.balance} left)`;
@@ -390,6 +471,7 @@ function formatCreditsCell(credits: CreditAxis): string {
 function formatCreditsWindow(credits: CreditAxis): string {
   if (credits.status !== 'ok') return '—';
   if (credits.periodType === 'prepaid-usd') return 'prepaid (창 없음)';
+  if (credits.periodType === 'extra-usage') return 'extra-usage (잔액)';
   const type = credits.periodType ?? '—';
   if (credits.periodStart && credits.periodEnd) {
     return `${type} ${credits.periodStart.slice(0, 10)}~${credits.periodEnd.slice(0, 10)}`;
@@ -407,7 +489,7 @@ function formatCreditsWindow(credits: CreditAxis): string {
  */
 export function formatWindowResetsIn(credits: CreditAxis, nowMs: number = Date.now()): string {
   if (credits.status !== 'ok') return '—';
-  if (credits.periodType === 'prepaid-usd') return 'n/a (리셋 없음)';
+  if (credits.periodType === 'prepaid-usd' || credits.periodType === 'extra-usage') return 'n/a (리셋 없음)';
   const end = credits.periodEnd ? Date.parse(credits.periodEnd) : Number.NaN;
   if (!Number.isFinite(end)) return 'unknown';
   const remainMs = end - nowMs;

package/src/cli/bench-cli.ts

@@ -0,0 +1,34 @@
+/** BENCH-ISOLATED-ARMS ④ — `elanous bench ls <id>`: 벤치 원장(`<config dir>/bench/<id>.jsonl`)을 읽는 한 자리. */
+import type { Command } from 'commander';
+import { benchLedgerPath, parseBenchSpec, readBenchLedger, renderBenchLs } from '../bench/bench.js';
+import { getElanousConfigDir } from '../elanous-config-dir.js';
+
+export interface BenchCliDeps {
+  readonly configDir?: () => string;
+  readonly write?: (line: string) => void;
+}
+
+export function registerBenchCommands(program: Command, deps: BenchCliDeps = {}): Command {
+  const bench = program.command('bench').description('벤치 팔(같은 골 · 모델만 다른 발사) 원장 — harness ask/say --bench 가 쓴다');
+  bench.command('ls <id>')
+    .description('벤치 원장 줄(bench id · base sha · 이미지 pin · 자식 모델 · 라운드)을 읽는다')
+    .option('--json', 'JSON 배열로')
+    .action((id: string, opts: { json?: boolean }) => {
+      const write = deps.write ?? ((line: string) => console.log(line));
+      let benchId: string;
+      try { benchId = parseBenchSpec(id).id; }
+      catch (error) {
+        console.error(`❌ ${error instanceof Error ? error.message : String(error)}`);
+        process.exitCode = 2;
+        return;
+      }
+      const configDir = (deps.configDir ?? getElanousConfigDir)();
+      const rows = readBenchLedger(benchId, configDir);
+      if (opts.json) write(JSON.stringify(rows));
+      else {
+        write(renderBenchLs(benchId, rows));
+        if (rows.length === 0) write(`원장 경로: ${benchLedgerPath(benchId, configDir)}`);
+      }
+    });
+  return bench;
+}

package/src/cli/guardian-cli.ts

@@ -27,7 +27,32 @@ export function registerGuardianCommands(program: Command): void {
         const cfg = getUserConfig();
         // Live activation (and crontab retirement) is a separate operational change.
         if (cfg.guardian?.mode === 'live') throw new Error('guardian live activation is outside GUARD-ONE-a');
-        const result = await guardianTick(new Date(), plan, { config: cfg });
+        // The shadow observation is for the tick's entry time, however long the GC's evidence collection takes.
+        const tickAt = new Date();
+        // Local orphan GC is separate from the guardian's shadow-only schedule execution.
+        const orphanGc = cfg.guardian?.orphanGc ?? 'shadow';
+        try {
+          // off never loads the collector, so no ps snapshot is taken.
+          if (orphanGc !== 'off') {
+            // Loading the collector is inside the guard too: a GC that cannot even load only observes.
+            const { runMachineHeartbeat } = await import('../ops/machine-heartbeat.js');
+            await runMachineHeartbeat(plan.jobs.filter((job): job is typeof job & { command: string; cron: string } =>
+              job.source === 'crontab' && job.run_via === 'crontab' && !!job.enabled
+              && typeof job.command === 'string' && typeof job.cron === 'string')
+              .map(job => ({ command: job.command, cron: job.cron })), { timeZone: plan.timeZone, mode: orphanGc });
+          } else {
+            // Still one decision line per tick, so «switched off» is distinguishable from «tick never ran».
+            const { debug } = await import('../debug/log.js');
+            debug.log('ops.orphan-cli', 'decision', { mode: 'off', candidates: 0, collected: 0, alreadyEvidenced: 0, killed: 0 });
+          }
+        } catch (error) {
+          // The logger import is inside the guard as well: if it is the failing module, the shadow tick still runs.
+          try {
+            const { debug } = await import('../debug/log.js');
+            debug.log('ops.orphan-cli', 'observation-failed', { error: String(error) });
+          } catch { /* guardian shadow still runs */ }
+        }
+        const result = await guardianTick(tickAt, plan, { config: cfg });
         await writeStdoutJson(JSON.stringify(result, null, 2) + '\n');
       } finally { db.close(); }
     });

package/src/cli/image-cli.ts

@@ -0,0 +1,101 @@
+import type { Command } from 'commander';
+import { debug } from '../debug/log.js';
+import {
+  appendImageLedgerEvent, baselinePinEvent, foldImageLedger, imageLedgerPath, readImageLedger, readRegistryTags,
+  type ImageLedgerRow, type RegistryRead,
+} from '../images/image-ledger.js';
+import { isPodImageCommit, podImageRegistry } from '../task-orchestrator/surfaces/pod-image-source.js';
+
+const SSH_HOST = /^[A-Za-z0-9][A-Za-z0-9._@-]*$/u;
+
+export interface ImageLsDeps {
+  readonly ledgerPath?: string;
+  readonly readRegistry?: (opts: { port: string; sshHost?: string }) => RegistryRead;
+  readonly env?: NodeJS.ProcessEnv;
+  readonly out?: (line: string) => void;
+}
+
+export interface ImageLsResult {
+  readonly ledger: { readonly path: string; readonly exists: boolean; readonly events: number; readonly unreadableLines: number };
+  readonly registry: { readonly read: boolean; readonly where: string; readonly tags: number | null; readonly reason?: string };
+  readonly rows: readonly ImageLedgerRow[];
+  readonly counts: { readonly baseline: number; readonly transient: number | null; readonly ledgered: number };
+}
+
+/** `image ls` — read only: ledger rows ⊕ registry tags without a ledger row (= transient). */
+export function imageLs(opts: { json?: boolean; ssh?: string; registry?: boolean }, deps: ImageLsDeps = {}): ImageLsResult {
+  const out = deps.out ?? ((line: string) => console.log(line));
+  if (opts.ssh !== undefined && !SSH_HOST.test(opts.ssh)) throw new Error(`invalid --ssh host: ${opts.ssh}`);
+  const ledger = readImageLedger(deps.ledgerPath ?? imageLedgerPath());
+  const registryAddr = podImageRegistry(deps.env ?? process.env);
+  const port = registryAddr.slice(registryAddr.lastIndexOf(':') + 1);
+  const where = `${opts.ssh ?? 'this machine'} localhost:${port}`;
+  let registry: RegistryRead | null = null;
+  if (opts.registry !== false) {
+    registry = /^[1-9][0-9]{0,4}$/u.test(port) && Number(port) <= 65535
+      ? (deps.readRegistry ?? readRegistryTags)({ port, ...(opts.ssh ? { sshHost: opts.ssh } : {}) })
+      : { ok: false, reason: `invalid registry port: ${registryAddr}` };
+  }
+  const tags = registry?.ok ? registry.tags : null;
+  const rows = foldImageLedger(ledger.events, tags);
+  const result: ImageLsResult = {
+    ledger: { path: ledger.path, exists: ledger.exists, events: ledger.events.length, unreadableLines: ledger.unreadableLines },
+    registry: registry === null
+      ? { read: false, where, tags: null, reason: 'skipped (--no-registry)' }
+      : registry.ok ? { read: true, where, tags: registry.tags.length } : { read: false, where, tags: null, reason: registry.reason },
+    rows,
+    counts: {
+      baseline: rows.filter((r) => r.current).length,
+      transient: tags === null ? null : rows.filter((r) => r.unledgered).length,
+      ledgered: rows.filter((r) => !r.unledgered).length,
+    },
+  };
+  try { debug.log('image.ledger', 'ls', { ledgerEvents: result.ledger.events, unreadableLines: result.ledger.unreadableLines, registryRead: result.registry.read, registryTags: result.registry.tags, transient: result.counts.transient }); } catch { /* log sink optional */ }
+  if (opts.json) { out(JSON.stringify(result, null, 2)); return result; }
+  out(`image ledger · ${ledger.path}${ledger.exists ? '' : ' (no ledger yet)'} · events ${ledger.events.length}${ledger.unreadableLines ? ` · ⚠️ unreadable lines ${ledger.unreadableLines}` : ''}`);
+  out(result.registry.read
+    ? `registry · ${where} · tags ${result.registry.tags}`
+    : `registry · ${where} · ⚠️ not read — ${result.registry.reason} (transient count unknown, not 0)`);
+  for (const r of rows.filter((x) => !x.unledgered)) {
+    const reg = r.inRegistry === null ? '?' : r.inRegistry ? 'reg' : '⚠️ not-in-registry';
+    out(`  ${r.tag}  ${r.role}${r.role === 'baseline' ? (r.current ? '*' : ' (previous)') : ''}  keep=${r.keep}  ${r.origin ? `${r.origin.reason}@${r.origin.host}` : '-'}  ${r.lastTs}  ${reg}`);
+  }
+  const transient = rows.filter((x) => x.unledgered);
+  if (transient.length > 0) out(`  transient (registry tags without a ledger row) · ${transient.length} · ${transient.slice(0, 8).map((r) => r.tag).join(' ')}${transient.length > 8 ? ' …' : ''}`);
+  out(`baseline ${result.counts.baseline} · ledgered ${result.counts.ledgered} · transient ${result.counts.transient ?? 'unknown'}`);
+  return result;
+}
+
+/**
+ * Recording site: `config set harness.imageCommit <commit>` (the rail pins the baseline through it).
+ * Appends a `baseline ⊕ pin` event (none when that tag is already the current baseline). A failed ledger write never fails the config write; it warns
+ * and leaves an observation.
+ */
+export function recordImagePinFromConfigSet(path: string, value: unknown, deps: { ledgerPath?: string; warn?: (msg: string) => void; now?: () => Date; host?: string } = {}): 'recorded' | 'unchanged' | 'skipped' | 'failed' {
+  if (path !== 'harness.imageCommit' || !isPodImageCommit(value)) return 'skipped';
+  const ledgerPath = deps.ledgerPath ?? imageLedgerPath();
+  try {
+    // The rail re-pins the same commit on quiet cycles — one event per baseline change, not per call.
+    const current = foldImageLedger(readImageLedger(ledgerPath).events, null).find((r) => r.current);
+    if (current && current.tag === value.trim().toLowerCase().slice(0, 12)) return 'unchanged';
+    const event = baselinePinEvent(value, { ...(deps.now ? { now: deps.now } : {}), ...(deps.host ? { host: deps.host } : {}) });
+    appendImageLedgerEvent(event, ledgerPath);
+    try { debug.log('image.ledger', 'baseline-pinned', { tag: event.tag, commit: event.commit, reason: event.origin.reason, host: event.origin.host, ledgerPath }); } catch { /* */ }
+    return 'recorded';
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    try { debug.log('image.ledger', 'baseline-pin-record-failed', { error: message, ledgerPath }); } catch { /* */ }
+    (deps.warn ?? ((m: string) => console.error(m)))(`⚠️ image ledger: baseline pin was set in config but not recorded in ${ledgerPath} — ${message}`);
+    return 'failed';
+  }
+}
+
+export function registerImageCommands(program: Command): void {
+  const image = program.command('image').description('하니스 이미지 원장 — 신분 표지(역할·보존·출신) · 원장 없는 레지스트리 태그 = transient');
+  image.command('ls')
+    .description('원장 행 ⊕ 레지스트리 태그(원장에 없으면 transient) — 읽기 전용')
+    .option('--json', 'JSON 출력')
+    .option('--ssh <host>', '레지스트리가 있는 노드(그 노드의 localhost 포트로 조회)')
+    .option('--no-registry', '레지스트리를 읽지 않는다(원장만)')
+    .action((opts: { json?: boolean; ssh?: string; registry?: boolean }) => { imageLs(opts); });
+}

package/src/cli/log-event-names.ts

@@ -121,7 +121,9 @@ export const KNOWN_LOG_EVENT_NAMES: ReadonlySet<string> = new Set([
   "background-drain",
   "background-finish",
   "barge.in",
+  "base-ensured",
   "base-preexisting",
+  "base-refused",
   "base-selection",
   "base.default-branch",
   "base.remote-unreachable",
@@ -736,6 +738,7 @@ export const KNOWN_LOG_EVENT_NAMES: ReadonlySet<string> = new Set([
   "launch-overrides",
   "layered-load",
   "ledger",
+  "ledger-unwritten",
   "ledger-write-failed",
   "legacy-codex-invoked",
   "legacy-finalize",
@@ -773,6 +776,7 @@ export const KNOWN_LOG_EVENT_NAMES: ReadonlySet<string> = new Set([
   "luna-failed",
   "luna-no-allowlist",
   "made-public",
+  "main-sync-skipped",
   "main-tree-reject",
   "malformed-tail",
   "manifest-frame-fail",

package/src/cli/pr-cli.ts

@@ -1,5 +1,5 @@
-import { existsSync, readFileSync, statSync } from 'node:fs';
-import { basename, join, relative, resolve } from 'node:path';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { basename, dirname, join, relative, resolve } from 'node:path';
 import { createInterface } from 'node:readline';
 import type { Command } from 'commander';
 import {
@@ -57,7 +57,8 @@ import { branchLineageSlug, findSiblingPrs } from './pr-lineage.js';
 import { parseReleaseNoteSection } from '../release-loop/release-note.js';
 import { landingFreezeMessage } from '../release-loop/landing-freeze.js';
 import { admitLandingMerge } from '../self-implement/frozen-merges.js';
-import { verifyOverlapEvidence } from './pr-land-overlap-evidence.js';
+import { verifyAncestorAutoPass, verifyOverlapEvidence } from './pr-land-overlap-evidence.js';
+import { taskAgentStatePath } from '../task-agent/task-hand.js';
 import { enqueueL8ShadowQueue, runL8ShadowQueue, shadowPrNumber, statusL8ShadowQueue, type L8ShadowQueueDeps } from '../self-implement/l8-merge-queue.js';
 
 export { branchLineageSlug, findSiblingPrs };
@@ -107,6 +108,8 @@ export interface PrLandDeps {
   resolveBase?: (run: CmdRunner, cwd: string, explicit?: string) => string | undefined;
   currentBranch?: (cwd: string) => string | undefined;
   readFile?: (path: string) => string;
+  /** 증거 파일 없는 already-ancestor 자동 판정이 리뷰 결과를 찾는 자리(기본 `<TA 상태 디렉터리>/review-results`). */
+  reviewResultsDir?: string;
   listUnfinishedRuns?: () => FederatedUnfinishedRunLedgerQuery | readonly FederatedUnfinishedRunLedgerEntry[];
   queryRunningRuns?: () => RunningRunsResult;
   listOpenPrs?: () => readonly { number: number; headRefName: string }[] | null;
@@ -1038,6 +1041,8 @@ const SOURCE_SPLIT_PR_LIST_LIMIT = 200;
  */
 const MERGED_PR_LOOKUP_RUNAWAY_CAP = 1000;
 const SOURCE_LOOKUP_FAILED_LINE = '⚠ source: 브랜치 조회에 실패해 갈래를 내지 못했습니다.';
+/** BENCH-ISOLATED-ARMS — 벤치 팔 PR 라벨(착지 금지). */
+export const BENCH_LABEL = 'elanous:bench';
 
 type MergedPrHeadRefsLookup = {
   map: Map<number, string>;
@@ -1616,9 +1621,23 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     if (verdict.ok) {
       out.log(verdict.mode === 'already-ancestor'
         ? `✓ overlap-evidence: already-ancestor — 겹친 최근 착지 ${overlappingLandings.length}개가 전부 head ${opts.expectedHead!.slice(0, 12)} 의 조상 · review pass must-fix 0 (${verdict.reviewResult})`
-        : `✓ overlap-evidence: ${ref.remote}/${ref.branch} ${verdict.baseTip.slice(0, 12)} ⊂ head ${opts.expectedHead!.slice(0, 12)} · gate passed on that base · review pass must-fix 0 (${verdict.reviewResult})`);
+        : verdict.mode === 'base-advanced-disjoint'
+          ? `✓ overlap-evidence: base-advanced-disjoint — gate base ${verdict.gateBase.slice(0, 12)} ⊂ head ${opts.expectedHead!.slice(0, 12)} · ${ref.remote}/${ref.branch} ${verdict.baseTip.slice(0, 12)} 까지 ${verdict.windowCommits}개 커밋이 PR 파일을 안 건드린다 · review pass|warn must-fix 0 (${verdict.reviewResult})`
+          : `✓ overlap-evidence: ${ref.remote}/${ref.branch} ${verdict.baseTip.slice(0, 12)} ⊂ head ${opts.expectedHead!.slice(0, 12)} · gate passed on that base · review pass must-fix 0 (${verdict.reviewResult})`);
     }
     else out.error(`✗ overlap-evidence: ${verdict.reason}`);
+  } else if (pinned && overlapDecision?.outcome === 'unavailable') {
+    // 증거 파일이 없을 때 — 겹친 착지가 전부 머리의 조상이고 표준 자리의 리뷰가 pass|warn ⊕ must-fix 0 이면 통과(아니면 종전 거부).
+    const verdict = verifyAncestorAutoPass({
+      pr: Number(opts.pr), expectedHead: opts.expectedHead!, cwd, run, readFile, overlappingLandings,
+      reviewResultsDir: deps.reviewResultsDir ?? join(dirname(taskAgentStatePath()), 'review-results'),
+      listDir: (dir) => readdirSync(dir),
+    });
+    overlapEvidenceAccepted = verdict.ok;
+    if (verdict.ok) {
+      out.log(`✓ overlap-evidence: already-ancestor-auto — 겹친 최근 착지 ${overlappingLandings.length}개가 전부 head ${opts.expectedHead!.slice(0, 12)} 의 조상 · review pass|warn must-fix 0 (${verdict.reviewResult})`);
+    }
+    else out.error(`✗ ancestor-auto: ${verdict.reason}`);
   }
   if (pinned && overlapDecision && overlapDecision.outcome !== 'user-merge' && !overlapEvidenceAccepted) {
     out.error('✗ expected-head: overlap merge approval unavailable for the reviewed head');
@@ -1695,6 +1714,37 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     }
   }
 
+  // LAND-BASE-GUARD-ORDER — 재사용할 PR 의 base·라벨은 upsert «전에» 본다(10-11 #26150: upsert 가 base 를 main 으로
+  //   바꾼 뒤에 읽어 #26117 base-guard 가 무력 · 거부돼도 PR 이 바뀌어 남았다). 거부는 PR 을 건드리지 않는다.
+  // LAND-BASE-MAIN-GUARD — 재사용한 PR 의 base 가 기본 가지가 아니면 병합 «전에» 거부한다(10-11 #26022 가 bench/base-night-* 로 병합됨).
+  //   명시 --base 를 준 경우만 통과한다. 못 읽은 base 는 종전 흐름대로 둔다(병합 뒤 되읽기).
+  // BENCH-ISOLATED-ARMS — `elanous:bench` 라벨 PR 은 벤치 팔 산출이라 착지하지 않는다(승자는 주인이 main 위로 따로 수확).
+  //   명시 --base 로도 통과하지 않는다. 못 읽은 라벨은 base-guard 와 같이 종전 흐름대로 둔다.
+  const refuseReusedPr = (url: string): number | undefined => {
+    const reusedNumber = /\/(\d+)$/.exec(url)?.[1] ?? url;
+    if (!opts.base?.trim()) {
+      const reusedBase = run('gh', ['pr', 'view', url, '--json', 'baseRefName', '--jq', '.baseRefName'], { cwd });
+      const reusedBaseName = reusedBase.ok ? reusedBase.out.trim() : '';
+      if (reusedBaseName && reusedBaseName !== baseBranchName) {
+        record('base-guard', false, { url, prBase: reusedBaseName, expected: baseBranchName });
+        out.error(`✗ base-guard: base=${reusedBaseName} ≠ ${baseBranchName} · gh pr edit ${reusedNumber} --base ${baseBranchName} 뒤 다시`);
+        return 1;
+      }
+    }
+    const reusedLabels = run('gh', ['pr', 'view', url, '--json', 'labels', '--jq', '.labels[].name'], { cwd });
+    if (reusedLabels.ok && reusedLabels.out.split('\n').some((name) => name.trim() === BENCH_LABEL)) {
+      record('bench-guard', false, { url, label: BENCH_LABEL });
+      out.error(`✗ bench-guard: #${reusedNumber} 은 ${BENCH_LABEL} 벤치 팔 PR 이라 착지하지 않는다 · 승자 diff 를 main 위 새 가지로 옮겨 착지`);
+      return 1;
+    }
+    return undefined;
+  };
+  const guardedBeforeUpsert = !hold && !!existing.url;
+  if (guardedBeforeUpsert) {
+    const refused = refuseReusedPr(existing.url!);
+    if (refused !== undefined) return refused;
+  }
+
   // A pinned, already-reviewed commit must not go through upsertPr (git add/commit/force-push/PR edit).
   const upsert = pinned
     ? existing.status === 'ok OUTPUT' && existing.url === pinnedUrl
@@ -1703,7 +1753,8 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     : manager.upsertPr({
     branch,
     worktreePath: cwd,
-    base,
+    // 기존 PR 재사용이면 명시 --base 일 때만 넘긴다 — 추론한 base 는 PR 을 main 으로 재타기팅한다(#26150).
+    ...(opts.base?.trim() || !existing.url ? { base } : {}),
     draft: hold,
     title: title ?? `Land ${branch}`,
     // ⛔⭐ 본문 기본값도 «내용이 있는» 쪽으로 — 종전 34자 플레이스홀더는 ***아무에게도 쓸모가 없었고***
@@ -1741,6 +1792,12 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     return 0;
   }
 
+  // 착지 전 PR 을 못 찾았는데(조회 실패) upsert 가 기존 PR 을 재사용했다면 여기서 한 번 더 본다.
+  if (upsert.reused && !guardedBeforeUpsert) {
+    const refused = refuseReusedPr(upsert.url);
+    if (refused !== undefined) return refused;
+  }
+
   const prNumber = Number(/\/(\d+)$/.exec(upsert.url)?.[1]);
   const landedHead = run('git', ['rev-parse', 'HEAD'], { cwd });
   const headCommit = landedHead.ok && /^[a-f0-9]{40}$/i.test(landedHead.out.trim()) ? landedHead.out.trim() : undefined;