elanous 0.2.23 → 0.2.24

package/src/harness/harness-substrate-default.ts

@@ -5,6 +5,9 @@ import { effectiveInstanceRoot, prodInstanceRoot, treeDerivedRootFor } from '../
 import { getElanousConfigDirOverride } from '../elanous-config-dir.js';
 import { buildUserConfig, getUserConfig, type UserConfig } from '../user-config.js';
 import { resolveCodexQuotaPolicy } from '../oauth/codex-quota-policy.js';
+import { debug } from '../debug/log.js';
+import type { PoolLeaseRecommendation } from '../task-orchestrator/surfaces/pod-lease.js';
+import type { PodPoolMember, PoolKubectl } from '../task-orchestrator/surfaces/pod-pool.js';
 
 /** Key-order-insensitive JSON so equal per-account caps written in another order do not warn. */
 function stableJson(value: unknown): string {
@@ -79,22 +82,154 @@ export interface ResolvedHarnessSubstrate {
   source: 'flag' | 'config' | 'default';
 }
 
-/** Only inspect the current context when no explicit pool is available. Never turn a failed Pod selection into local. */
+/** Conservative local headroom for one standard harness goal (the Pod lease's default per-goal size). */
+export const AUTO_LOCAL_MIN_AVAILABLE_MEMORY_BYTES = 16 * 1024 ** 3;
+
+export interface AutoSubstrateSignals {
+  /** A blocked memory admission has recommended=0 and limitedBy=memory; unknown is not blocked. */
+  podAdmission: Pick<PoolLeaseRecommendation, 'recommended' | 'limitedBy'> | null;
+  load1: number | null;
+  cores: number | null;
+  availableMemoryBytes: number | null;
+  localLaneOpen: boolean;
+}
+
+export interface AutoSubstrateDecision {
+  substrate: HarnessSubstrate;
+  reason: string;
+}
+
+export interface NextLocalLaneCapInput {
+  current: number;
+  wanted: number;
+  lastRaisedAtMs: number | null;
+  nowMs: number;
+  load1: number | null;
+  cores: number | null;
+}
+
+export interface NextLocalLaneCapDecision {
+  cap: number;
+  action: 'raise' | 'hold' | 'lower';
+  reason: string;
+}
+
+/** Decide one conservative local-lane cap adjustment from the current observations. */
+export function nextLocalLaneCap({ current, wanted, lastRaisedAtMs, nowMs, load1, cores }: NextLocalLaneCapInput): NextLocalLaneCapDecision {
+  let decision: NextLocalLaneCapDecision;
+  if (load1 === null || cores === null || !Number.isFinite(load1) || !Number.isFinite(cores) || load1 < 0 || cores <= 0) {
+    decision = { cap: current, action: 'hold', reason: 'load-unreadable' };
+  } else if (load1 >= cores) {
+    decision = { cap: Math.max(0, current - 5), action: 'lower', reason: 'local-load-overloaded' };
+  } else if (!Number.isFinite(current) || !Number.isFinite(wanted) || !Number.isFinite(nowMs)) {
+    decision = { cap: current, action: 'hold', reason: 'cap-or-time-unreadable' };
+  } else if (wanted <= current) {
+    decision = { cap: current, action: 'hold', reason: 'no-increase-requested' };
+  } else if (load1 >= cores / 2) {
+    decision = { cap: current, action: 'hold', reason: 'local-load-not-spare' };
+  } else if (lastRaisedAtMs !== null && (!Number.isFinite(lastRaisedAtMs) || nowMs - lastRaisedAtMs < 15 * 60 * 1000)) {
+    decision = { cap: current, action: 'hold', reason: 'raise-cooldown' };
+  } else {
+    decision = { cap: Math.min(wanted, current + 5), action: 'raise', reason: 'local-load-spare' };
+  }
+  debug.log('harness.guardian', 'lane-step', { current, wanted, lastRaisedAtMs, nowMs, load1, cores, ...decision });
+  return decision;
+}
+
+/** Pure routing judgment. Missing/invalid observations are not evidence that the host has room. */
+export function routeAutoSubstrate(signals: AutoSubstrateSignals): AutoSubstrateDecision {
+  const { podAdmission, load1, cores, availableMemoryBytes, localLaneOpen } = signals;
+  if (podAdmission === null || podAdmission.recommended === null || podAdmission.limitedBy === null)
+    return { substrate: 'pod', reason: 'pod-admission-unobserved' };
+  if (podAdmission.recommended !== 0 || podAdmission.limitedBy !== 'memory')
+    return { substrate: 'pod', reason: 'pod-admission-not-memory-blocked' };
+  if (!localLaneOpen) return { substrate: 'pod', reason: 'local-lane-closed' };
+  if (cores === null || !Number.isFinite(cores) || cores <= 0 || load1 === null || !Number.isFinite(load1) || load1 < 0 || load1 >= cores / 2)
+    return { substrate: 'pod', reason: 'local-load-not-spare' };
+  if (availableMemoryBytes === null || !Number.isFinite(availableMemoryBytes) || availableMemoryBytes < AUTO_LOCAL_MIN_AVAILABLE_MEMORY_BYTES)
+    return { substrate: 'pod', reason: 'local-memory-not-spare' };
+  return { substrate: 'local', reason: 'pod-memory-blocked-local-spare' };
+}
+
+/**
+ * POD-POOL-UNCAPPED-SPEC — the pre-launch pool check of an «implicit» Pod pool (the current kube context),
+ * reported in context names. `unmeasured` = kubectl itself could not run, so nothing was measured:
+ * «unknown» is not «unfit» (same rule as LAUNCH-STALL's unreadable member memory).
+ */
+export interface HarnessPoolCheck {
+  ok: boolean;
+  ready: string[];
+  dropped: { context: string; reason: string }[];
+  unmeasured?: string | null;
+}
+
+/** `checkPodPool` over one pool spec — a kube context that cannot answer before launch is refused, not silently kept. */
+export function checkHarnessPodPool(pool: string, run?: PoolKubectl): HarnessPoolCheck {
+  // Lazy require: the Pod surface pulls `bun:ffi`, and only a Pod launch without an explicit pool needs it.
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const surface = require('../task-orchestrator/surfaces/pod-pool.js') as typeof import('../task-orchestrator/surfaces/pod-pool.js');
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const leaseKubectl = run ?? (require('../task-orchestrator/surfaces/pod-lease.js') as typeof import('../task-orchestrator/surfaces/pod-lease.js')).leaseKubectl;
+  let members: PodPoolMember[];
+  try { members = surface.parsePodPool(pool); }
+  catch (error) {
+    return { ok: false, ready: [], dropped: [{ context: pool, reason: error instanceof Error ? error.message : String(error) }] };
+  }
+  let calls = 0;
+  let unrunnable = 0;
+  const kubectl: PoolKubectl = (args, input) => {
+    const r = leaseKubectl(args, input);
+    calls++;
+    // Only «kubectl is not installed» (spawn ENOENT) is no verdict about the cluster. A kubectl that started but
+    // timed out (status null · ETIMEDOUT) is a cluster that did not answer — that stays a measured refusal.
+    if (r.status === null && /\bENOENT\b/.test(r.stderr)) unrunnable++;
+    return r;
+  };
+  const checked = surface.checkPodPool(members, kubectl);
+  if (!checked.ok && calls > 0 && unrunnable === calls) return { ok: true, ready: [], dropped: checked.dropped, unmeasured: 'kubectl 을 실행할 수 없다' };
+  return { ok: checked.ok, ready: checked.ready.map((m) => m.context), dropped: checked.dropped };
+}
+
+/** Only inspect the current context when no explicit pool is available. Never turn an explicit Pod selection into local. */
 export function resolveHarnessSubstrate({ flag, config, env, currentContext = () => {
   const result = spawnSync('kubectl', ['config', 'current-context'], { encoding: 'utf8', timeout: 5000 });
   return result.status === 0 ? result.stdout?.trim() : undefined;
-} }: {
-  flag?: { substrate?: HarnessSubstrate; podPool?: string };
+}, autoSignals, poolCheck = checkHarnessPodPool }: {
+  flag?: { substrate?: HarnessSubstrate | 'auto'; podPool?: string };
   config?: Pick<UserConfig, 'harness' | 'pod'>;
   env?: NodeJS.ProcessEnv;
   currentContext?: () => string | undefined;
+  /** Signals must come from the launch host and Pod admission, not a worktree's cached config. */
+  autoSignals?: AutoSubstrateSignals;
+  /** POD-POOL-UNCAPPED-SPEC — pre-launch check of the implicit kube context; tests inject it instead of shelling out. */
+  poolCheck?: (pool: string) => HarnessPoolCheck;
 }): ResolvedHarnessSubstrate {
-  const substrate = flag?.substrate ?? config?.harness?.substrate ?? 'local';
-  if (substrate !== 'local' && substrate !== 'pod') throw new Error('harness.substrate: local 또는 pod 만 허용한다');
+  const requested = flag?.substrate ?? config?.harness?.substrate ?? 'local';
+  if (requested !== 'local' && requested !== 'pod' && requested !== 'auto') throw new Error('harness.substrate: local, pod 또는 auto 만 허용한다');
   const source = flag?.substrate ? 'flag' : config?.harness?.substrate ? 'config' : 'default';
+  // Missing signals mean admission was not observed, not that the Pod has room.
+  const decision = requested === 'auto' ? routeAutoSubstrate(autoSignals ?? {
+    podAdmission: null, load1: null, cores: null, availableMemoryBytes: null, localLaneOpen: false,
+  }) : null;
+  const substrate: HarnessSubstrate = requested === 'auto' ? decision!.substrate : requested;
+  if (decision) debug.log('harness.substrate', 'route', { substrate, reason: decision.reason, source });
   if (substrate === 'local') return { substrate, pool: null, source };
-  const pool = flag?.podPool?.trim() || env?.ELANOUS_POD_POOL?.trim() || config?.harness?.podPool?.trim() || config?.pod?.pool?.trim() || currentContext()?.trim();
-  if (!pool) throw new Error('harness.substrate=pod: Pod 풀 또는 현재 컨텍스트에 닿지 못했다 — 풀을 설정하거나 `--substrate local` 로 명시하라');
+  const explicit = flag?.podPool?.trim() || env?.ELANOUS_POD_POOL?.trim() || config?.harness?.podPool?.trim() || config?.pod?.pool?.trim();
+  const pool = explicit || currentContext()?.trim();
+  if (!pool) throw new Error(`harness.substrate=${decision ? `auto→pod(${decision.reason})` : 'pod'}: Pod 풀 또는 현재 컨텍스트에 닿지 못했다 — 풀을 설정하거나 \`--substrate local\` 로 명시하라`);
+  // POD-POOL-UNCAPPED-SPEC — an explicit pool is the operator's own statement and gets `checkPodPool` at the launch
+  //   site (`src/index.ts` self orchestrate · `src/loops/orchestrator/tick.ts` · `pod-command-job.ts`). The implicit
+  //   kube context had no such gate: a context whose cluster is gone, or whose `elanous-test` namespace is missing,
+  //   sailed through here and then sat on `recommended=0` for 35 minutes (10-10 probe, 6 runs). Check before launch.
+  if (!explicit) {
+    const checked = poolCheck(pool);
+    debug.log('harness.substrate', 'pool-check', { pool, origin: 'current-context', ok: checked.ok, ready: checked.ready, dropped: checked.dropped, unmeasured: checked.unmeasured ?? null });
+    if (!checked.ok) {
+      const why = checked.dropped.map((d) => `${d.context}: ${d.reason}`).join(' · ') || '노드가 하나도 준비되지 않았다';
+      throw new Error(`harness.substrate=pod: 현재 컨텍스트 「${pool}」 이 발사 전 풀 점검을 넘지 못했다 — ${why} · 풀을 설정하거나 \`--substrate local\` 로 명시하라`);
+    }
+    if (checked.unmeasured) debug.log('harness.substrate', 'pool-check-unmeasured', { pool, reason: checked.unmeasured }, { level: 'warn' });
+  }
   return { substrate, pool, source };
 }
 

package/src/harness/launch-registry.ts

@@ -19,6 +19,10 @@ export interface LaunchBinding {
   readonly goalPath?: string;
   /** The `self-dev-runs` directory that holds this run's `pid.json` — tells a stop which universe launched it. */
   readonly runsDir?: string;
+  /** `ELANOUS_POD_NAME` at launch — a Pod child's run (TA backfill skips it like the launch-time hook does). */
+  readonly podName?: string;
+  /** `ELANOUS_TASK_CARD_ID` at launch — a handed run that already owns a card (TA backfill skips it). */
+  readonly taskCardId?: string;
 }
 
 const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
@@ -72,6 +76,8 @@ export function readLaunchBinding(runId: string, dir = launchRegistryDir()): Lau
       ...(typeof value.argv0 === 'string' ? { argv0: value.argv0 } : {}),
       ...(typeof value.goalPath === 'string' && isAbsolute(value.goalPath) ? { goalPath: value.goalPath } : {}),
       ...(typeof value.runsDir === 'string' && isAbsolute(value.runsDir) ? { runsDir: value.runsDir } : {}),
+      ...(typeof value.podName === 'string' && value.podName ? { podName: value.podName } : {}),
+      ...(typeof value.taskCardId === 'string' && value.taskCardId ? { taskCardId: value.taskCardId } : {}),
     };
   } catch { return null; }
 }

package/src/harness/worktree-branch-prefix.ts

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto';
+import { branchGoalId } from '../cli/pr-lineage.js';
 
 /** Prefix for disposable worktree branches created by self-implement and inspected by harness clean.
  * A successfully merged run cleans up its own worktree.
@@ -31,3 +32,11 @@ export function plannedSelfImplBranch(feature: string, goalId?: string, runId?:
   const digest = createHash('sha256').update(id).digest('hex').slice(0, 8);
   return `${WORKTREE_BRANCH_PREFIX}goalid-${id}-${readable}-${digest}${runSuffix}`;
 }
+
+/** 같은 골의 재실행이 공유하는 «안정한» 계보 키. `plannedSelfImplBranch` 가 싣는 `goalid-<id>-` 구간만 읽는다 —
+ *  feature 문구·다이제스트·런 접미(`-r<runId>`)는 재실행마다 달라지므로 키에 넣지 않는다.
+ *  ⛔ 골 식별자가 없는 옛 브랜치는 `null` — 읽기용 슬러그는 서로 다른 골이 같은 값을 낼 수 있어(`grounded-N-…`) 키가 될 수 없다. */
+export function branchLineageKey(branch: string): string | null {
+  const id = branchGoalId(branch);
+  return id ? `goalid:${id.toLowerCase()}` : null;
+}

package/src/hq/fence.ts

@@ -0,0 +1,187 @@
+import { spawnSync } from 'node:child_process';
+import { readFileSync, readlinkSync, readdirSync } from 'node:fs';
+import { cronMatches } from '../domains/cron-match.js';
+import { resolveTimeZone } from '../time/format.js';
+
+export interface CliProcess { pid: number; ppid: number; ageSeconds: number; cpuSeconds: number; command: string }
+export interface OrphanCandidate { process: CliProcess; tree: CliProcess[]; periodMinutes: number }
+export interface FenceGcDeps {
+  snapshot?: () => CliProcess[];
+  run?: (binary: string, args: string[]) => string;
+  sleep?: (ms: number) => Promise<void>;
+  kill?: (pid: number) => void;
+  timeZone?: string;
+}
+
+export function cliFingerprint(command: string): string {
+  return command.replace(/^\s*(?:\S*\/)?bun\s+(?:\S*\/)?elanous\.mjs\s+/, 'elanous ')
+    .replace(/^\s*(?:\S*\/)?(?:elanous\.mjs|eln)\s+/, 'elanous ')
+    .trim();
+}
+
+function seconds(text: string): number {
+  const parts = text.split(':').map(Number);
+  return parts.reduce((total, part) => total * 60 + part, 0);
+}
+
+/** ps gives command after the four numeric fields; never split command on whitespace. */
+export function processSnapshot(): CliProcess[] {
+  const result = spawnSync('ps', ['-axo', 'pid=,ppid=,etime=,time=,command='], { encoding: 'utf8', timeout: 10_000, maxBuffer: 4 * 1024 * 1024 });
+  if (result.status !== 0) throw new Error(`ps failed: ${result.stderr}`);
+  return result.stdout.split('\n').flatMap(line => {
+    const fields = /^\s*(\d+)\s+(\d+)\s+([\d:-]+)\s+([\d:.]+)\s+(.+)$/.exec(line);
+    if (!fields) return [];
+    const elapsed = fields[3]!.split('-');
+    const ageSeconds = seconds(elapsed.at(-1)!) + (elapsed.length === 2 ? Number(elapsed[0]) * 86_400 : 0);
+    const cpuSeconds = seconds(fields[4]!);
+    if (!Number.isFinite(ageSeconds) || !Number.isFinite(cpuSeconds)) return [];
+    return [{ pid: Number(fields[1]), ppid: Number(fields[2]), ageSeconds, cpuSeconds, command: fields[5]! }];
+  });
+}
+
+/** Only installed elanous one-shot CLI launches, not shells, daemons, or an incidental flag inside a quoted payload. */
+export function oneShotCommand(command: string): boolean {
+  const invocation = /^(?:(?:\S*\/)?bun\s+(?:\S*\/)?elanous\.mjs|(?:\S*\/)?(?:elanous|elanous\.mjs|eln))\s+/.exec(command);
+  if (!invocation) return false;
+  const args = command.slice(invocation[0].length).split(/\s+--\s+|\s+-c\s+/)[0] ?? '';
+  const payload = /\s+--\s+(.+)$/.exec(command)?.[1] ?? '';
+  const shellBody = /\s+--\s+(?:\S*\/)?(?:sh|bash)\s+-c\s+(.+)$/.exec(command)?.[1];
+  if (shellBody !== undefined) {
+    if (!/^['"]?(?:\S*\/)?bun\s+(?:\S*\/)?elanous\.mjs\s+/.test(shellBody)
+      || /[;|`&]/.test(shellBody) || /\bnexus\s+run\b/.test(shellBody)
+      || !/(?:^|\s)(?:--once|tick|--refresh|--notify)(?:\s|['"]|$)/.test(shellBody)) return false;
+  }
+  // Test-universe and help invocations are never collected — on the fence itself, in its payload, or in a wrapped shell body.
+  for (const part of [args, payload, shellBody ?? '']) {
+    if (/(?:^|\s|['"])--test(?:\s|=|['"]|$)/.test(part) || /(?:^|\s)(?:--help|-h)(?:\s|['"]|$)/.test(part)) return false;
+  }
+  // The daemon is never a one-shot, whatever flag rides along (`nexus run --once`), directly or as a fence payload.
+  if (/(?:^|\s)nexus\s+run\b/.test(args) || /(?:^|\s)nexus\s+run\b/.test(payload) || /&&|\|\||[;|`&]/.test(payload)) return false;
+  if (/^hq\s+fence\s+--role\s+(?:cron|seat-loop|conatus|release-run)\b/.test(args) && payload) {
+    return /(?:^|\s)(?:--once|tick|--refresh|--notify)(?:\s|['"]|$)/.test(payload);
+  }
+  return /(?:^|\s)hq\s+fence\s+--role\s+(?:cron|seat-loop|conatus|release-run)\b/.test(args)
+    || /(?:^|\s)--once(?:\s|$)/.test(args)
+    || /(?:^|\s)(?:tick|--refresh|--notify)(?:\s|$)/.test(args);
+}
+
+/** Unknown/mismatched schedules are not assigned a made-up period. Match the launched action (including fence payload). */
+export function scheduledPeriodMinutes(command: string, schedules: readonly { command: string; cron: string }[], now: Date, timeZone = resolveTimeZone().timeZone): number | null {
+  const current = cliFingerprint(command);
+  const matches = schedules.filter(job => {
+    const action = job.command.trim().replace(/^cd\s+\S+\s*&&\s*/, '').replace(/\s+>>?\s+\S+(?:\s+2>&1)?\s*$/, '');
+    if (action.length < 16) return false;
+    if (current === cliFingerprint(action)) return true;
+    // The installed hq-fence shell wrapper execs the CLI with an explicit role and -- payload.
+    // Accept only a single, unambiguous quoted command; never infer a period from a substring.
+    const wrapper = /^(?:\S*\/)?hq-fence\s+(cron|seat-loop|conatus|release-run)\s+'([^']+)'$/.exec(action);
+    if (!wrapper) return false;
+    return current === `elanous hq fence --role ${wrapper[1]} -- ${wrapper[2]}`;
+  });
+  if (matches.length !== 1) return null;
+  const cron = matches[0]!.cron;
+  if (cron.trim().split(/\s+/).length !== 5) return null;
+  const start = Math.floor(now.getTime() / 60_000) * 60_000;
+  // A 7-day minute scan per process is costly with many hung trees; one tick asks the same (cron, zone, minute) often.
+  const memoKey = `${cron}\0${timeZone}\0${start}`;
+  if (periodMemo.has(memoKey)) return periodMemo.get(memoKey)!;
+  const period = cronPeriodMinutes(cron, start, timeZone);
+  if (periodMemo.size > 256) periodMemo.clear();
+  periodMemo.set(memoKey, period);
+  return period;
+}
+
+const periodMemo = new Map<string, number | null>();
+
+function cronPeriodMinutes(cron: string, start: number, timeZone: string): number | null {
+  const fires: number[] = [];
+  try {
+    // Every fire in the next 7 days, not just the first few: a weekday-hours cron (`0 9-17 * * 1-5`) is hourly
+    // for three gaps and then pauses for a night or a weekend — that is no single period.
+    for (let i = 0; i < 7 * 24 * 60; i++) {
+      const at = start + i * 60_000;
+      if (cronMatches(cron, new Date(at), { timeZone })) fires.push(at);
+    }
+  } catch { return null; }
+  // An irregular schedule (any unequal gap within the window, e.g. `0 9,18 * * *`, weekday hours) has no single period
+  // to multiply — unknown, never collected. Fewer than three fires in 7 days (weekly) is unknown too (safe side).
+  if (fires.length < 3) return null;
+  const gap = fires[1]! - fires[0]!;
+  for (let i = 2; i < fires.length; i++) if (fires[i]! - fires[i - 1]! !== gap) return null;
+  return gap / 60_000;
+}
+
+export function orphanCandidates(first: readonly CliProcess[], second: readonly CliProcess[], schedules: readonly { command: string; cron: string }[], now: Date, timeZone?: string): OrphanCandidate[] {
+  const byPid = new Map(second.map(row => [row.pid, row]));
+  const initial = new Map(first.map(row => [row.pid, row]));
+  const candidates: OrphanCandidate[] = [];
+  // The collector itself and every ancestor of it (the guardian tick's cron/fence parents) are never signalled.
+  const self = new Set<number>([process.pid]);
+  for (let pid: number | undefined = byPid.get(process.pid)?.ppid; pid !== undefined && pid > 1 && !self.has(pid); pid = byPid.get(pid)?.ppid) self.add(pid);
+  for (const root of first) {
+    if (root.pid === process.pid || !oneShotCommand(root.command)) continue;
+    const current = byPid.get(root.pid);
+    if (!current || current.command !== root.command || current.ppid !== root.ppid || current.cpuSeconds !== root.cpuSeconds) continue;
+    // Identity: a reused PID restarts its age; the same process can only have grown older between snapshots.
+    if (current.ageSeconds < root.ageSeconds) continue;
+    const periodMinutes = scheduledPeriodMinutes(root.command, schedules, now, timeZone);
+    if (!periodMinutes || root.ageSeconds <= periodMinutes * 3 * 60) continue;
+    // An old ancestor with an actively executing payload is not an orphan.
+    if (second.some(row => row.ppid === root.pid && !initial.has(row.pid))) continue;
+    const tree = [current];
+    for (let i = 0; i < tree.length; i++) {
+      for (const child of second) if (child.ppid === tree[i]!.pid && !tree.some(row => row.pid === child.pid)) tree.push(child);
+    }
+    if (tree.some(row => {
+      const before = initial.get(row.pid);
+      return !before || before.command !== row.command || before.cpuSeconds !== row.cpuSeconds || before.ppid !== row.ppid
+        || Math.abs((row.ageSeconds - before.ageSeconds) - (current.ageSeconds - root.ageSeconds)) > 2;
+    })) continue;
+    if (tree.some(row => self.has(row.pid))) continue;
+    candidates.push({ process: current, tree, periodMinutes });
+  }
+  return candidates.filter(candidate => !candidates.some(parent => parent !== candidate && parent.tree.some(row => row.pid === candidate.process.pid)));
+}
+
+export function gcTools(deps: FenceGcDeps = {}) {
+  return {
+    snapshot: deps.snapshot ?? processSnapshot,
+    sleep: deps.sleep ?? ((ms: number) => new Promise<void>(resolve => setTimeout(resolve, ms))),
+    run: deps.run ?? ((binary: string, args: string[]) => {
+      // Linux has no macOS sample. Over one second, sample each thread's wait channel and state (readable by the
+      // process owner); the kernel stack is root-only on most hosts, so it is added only when readable.
+      if (binary === 'sample' && process.platform === 'linux') {
+        const pid = args[0];
+        const samples: string[] = [];
+        const deadline = Date.now() + 1_000;
+        do {
+          for (const tid of readdirSync(`/proc/${pid}/task`)) {
+            const base = `/proc/${pid}/task/${tid}`;
+            const state = /^State:\s*(.+)$/m.exec(readFileSync(`${base}/status`, 'utf8'))?.[1] ?? '?';
+            let stack = '';
+            // Root-only on most kernels: carried when readable, otherwise the evidence says so (not a collection gate).
+            try { stack = `\n${readFileSync(`${base}/stack`, 'utf8')}`; } catch (error) { stack = ` kernel-stack=unreadable(${(error as NodeJS.ErrnoException).code ?? 'error'})`; }
+            samples.push(`tid=${tid} state=${state} wchan=${readFileSync(`${base}/wchan`, 'utf8') || '0'}${stack}`);
+          }
+          if (Date.now() < deadline) Bun.sleepSync(Math.min(100, deadline - Date.now()));
+        } while (Date.now() < deadline);
+        if (samples.length === 0) throw new Error(`sample: no threads for PID ${pid}`);
+        return samples.join('\n');
+      }
+      // macOS `sample` by absolute path: a PATH shim (e.g. pyenv's `sample`) must not stand in for the profiler.
+      const resolved = binary === 'sample' && process.platform === 'darwin' ? '/usr/bin/sample' : binary;
+      // sample symbolicates a large Bun binary after its 1s window — allow time and room, or it would never succeed.
+      const result = spawnSync(resolved, args, { encoding: 'utf8', timeout: binary === 'sample' ? 30_000 : 10_000, maxBuffer: 8 * 1024 * 1024 });
+      if (result.status !== 0) throw new Error(`${binary}: ${result.error ?? result.stderr ?? 'failed'}`);
+      return result.stdout;
+    }),
+    kill: deps.kill ?? ((pid: number) => process.kill(pid, 'SIGTERM')),
+  };
+}
+
+/** The target's own Bun binary — read from the target PID, so a PID that died (or was reused) fails closed. */
+export function bunVersion(pid: number, run: (binary: string, args: string[]) => string): string {
+  const bin = process.platform === 'linux' ? readlinkSync(`/proc/${pid}/exe`) : run('ps', ['-o', 'comm=', '-p', String(pid)]).trim();
+  if (!/(?:^|\/)bun(?:$|\s)/.test(bin)) throw new Error(`PID ${pid} is not a Bun process`);
+  return run(bin, ['--version']).trim();
+}

package/src/hq/seats.ts

@@ -47,6 +47,12 @@ export function resolveHqLaunchSeat(role: string, home: string, options: { root?
   if (head.status !== 1) throw new Error(`git symbolic-ref --quiet HEAD: ${head.stderr.trim() || `exit ${head.status}`}`);
   return path;
 }
+
+/** Installed-CLI argv: absolute runtime + absolute CLI entry, so a launch never resolves `bin/elanous.mjs` against its cwd. */
+export function installedCliArgv(args: readonly string[] = []): string[] {
+  return [process.execPath, resolve(import.meta.dir, '../../bin/elanous.mjs'), ...args];
+}
+
 function readLedger(root: string): HouseLedger {
   const ledger = JSON.parse(readFileSync(ledgerPath(root), 'utf8')) as HouseLedger;
   if (!ledger.home?.path || !ledger.sandboxes || typeof ledger.sandboxes !== 'object') throw new Error('invalid house.json; refusing to guess houses');
@@ -157,7 +163,7 @@ export function proveMergedPr(repo: string, branch: string, tip: string, gh: (ar
     : { status: parsed.length >= MERGED_PR_QUERY_LIMIT ? 'unknown' : 'not-merged' };
 }
 
-// Every tip checked by done is tied to its own branch, including a different attached branch.
+// Attached tips use their branch; a detached HEAD is checked separately from the registered work tip.
 function landedTip(repo: string, branch: string, tip: string, gh: (args: string[]) => GhCliResult): 'ancestor' | 'pr-merged' | 'tree-equal' | null {
   if (mergedIntoMain(repo, tip)) return 'ancestor';
   if (proveMergedPr(repo, branch, tip, gh, 'main').status === 'pr-merged') return 'pr-merged';
@@ -170,8 +176,8 @@ function judgeLandedTip(repo: string, branch: string, tip: string, gh: (args: st
   return rule !== null;
 }
 
-// Squash changes the commit identity. Prove the original commit changed at least one path and
-// that every one of those paths has the same content and mode in the fetched main tree.
+// Squash changes commit identity. Check the changed paths together against a fetched main
+// snapshot, not merely the latest tree: a later main commit may have edited those paths again.
 function treeEqualToMain(repo: string, tip: string): boolean {
   const main = 'refs/remotes/origin/main';
   const base = git(repo, 'merge-base', tip, main);
@@ -179,9 +185,15 @@ function treeEqualToMain(repo: string, tip: string): boolean {
   if (changed.status !== 0) throw new Error(`cannot verify changed files: ${changed.stderr.trim() || `exit ${changed.status}`}`);
   const files = changed.stdout.split('\0').filter(Boolean);
   if (files.length === 0) return false;
-  const equal = runGitCommand(repo, ['diff', '--quiet', tip, main, '--', ...files], { encoding: 'utf8' });
-  if (equal.status !== 0 && equal.status !== 1) throw new Error(`cannot verify tree equality: ${equal.stderr.trim() || `exit ${equal.status}`}`);
-  return equal.status === 0;
+  const equalAt = (commit: string): boolean => {
+    const equal = runGitCommand(repo, ['diff', '--quiet', tip, commit, '--', ...files], { encoding: 'utf8' });
+    if (equal.status !== 0 && equal.status !== 1) throw new Error(`cannot verify tree equality: ${equal.stderr.trim() || `exit ${equal.status}`}`);
+    return equal.status === 0;
+  };
+  if (equalAt(main)) return true;
+  // Only first-parent main snapshots can establish a previous landing; a side branch alone cannot.
+  const history = git(repo, 'log', '--first-parent', '--format=%H', `${base}..${main}`, '--', ...files);
+  return history.split('\n').filter(Boolean).some(equalAt);
 }
 // Git lock files are created exclusively; ours carry our pid. A lock left by a killed `work done` is never
 // removed automatically (between our check and a delete, a live git could have re-taken it): the error names it.
@@ -398,49 +410,53 @@ export function hqWork(action: 'new' | 'done', value: string, nameValue: string,
     // Resume: an interrupted done left the work detached at its recorded merged tip, with the branch either
     // still at that tip (stopped before the delete) or already deleted (stopped before the removal).
     const branchPresent = branchTip.status === 0;
-    const resuming = attached.status !== 0 && entry.reclaiming !== undefined
-      && git(path, 'rev-parse', 'HEAD') === (entry.checkoutTip ?? entry.reclaiming)
+    const head = git(path, 'rev-parse', 'HEAD');
+    const resuming = attached.status === 1 && entry.reclaiming !== undefined
+      && head === (entry.checkoutTip ?? entry.reclaiming)
       && (!branchPresent || branchTip.stdout.trim() === entry.reclaiming);
-    if (!resuming && (attached.status !== 0 || !branchPresent)) throw new Error(`work branch mismatch: ${path}`);
+    if (!resuming && (attached.status !== 0 && attached.status !== 1 || !branchPresent)) throw new Error(`work branch mismatch: ${path}`);
     const ownTip = resuming ? entry.reclaiming! : branchTip.stdout.trim();
-    const checkoutBranch = resuming ? entry.checkoutBranch ?? branch : attached.stdout.trim();
+    const detached = !resuming && attached.status === 1;
+    const detachedCheckout = detached || (resuming && entry.checkoutBranch === branch && entry.checkoutTip !== undefined && entry.checkoutTip !== ownTip);
+    const checkoutBranch = resuming ? entry.checkoutBranch ?? branch : detached ? branch : attached.stdout.trim();
     const checkoutRef = `refs/heads/${checkoutBranch}`;
     const differentBranch = checkoutBranch !== branch;
-    const tip = differentBranch
-      ? (resuming ? entry.checkoutTip! : git(repo, 'rev-parse', '--verify', checkoutRef))
-      : ownTip;
-    if (!resuming && differentBranch && git(path, 'rev-parse', 'HEAD') !== tip) throw new Error(`work branch moved before the merge check: ${checkoutBranch}`);
+    const tip = detached ? head : resuming && entry.checkoutTip ? entry.checkoutTip : differentBranch
+      ? git(repo, 'rev-parse', '--verify', checkoutRef) : ownTip;
+    if (!resuming && !detached && differentBranch && head !== tip) throw new Error(`work branch moved before the merge check: ${checkoutBranch}`);
     // The ancestor check is against origin/main, not bare HEAD (which may still point to master).
     if (!judgeLandedTip(repo, checkoutBranch, tip, options.gh ?? runGhCliWithResult)) throw new Error(`work is not merged into origin/main: ${checkoutBranch}`);
-    if (differentBranch && !judgeLandedTip(repo, branch, ownTip, options.gh ?? runGhCliWithResult)) throw new Error(`work is not merged into origin/main: ${branch}`);
+    if ((differentBranch || detachedCheckout) && tip !== ownTip && !judgeLandedTip(repo, branch, ownTip, options.gh ?? runGhCliWithResult)) throw new Error(`work is not merged into origin/main: ${branch}`);
     if (differentBranch && !resuming) {
       const current = runGitCommand(repo, ['rev-parse', '--verify', checkoutRef], { encoding: 'utf8' });
       if (current.status !== 0 || current.stdout.trim() !== tip || git(path, 'rev-parse', 'HEAD') !== tip) throw new Error(`work branch moved before removal: ${checkoutBranch}`);
     }
     // Removal order keeps every interruption resumable: record the proven checkout tip and original branch tip
     // → detach → hold the work's git locks → compare-and-delete the original branch → remove the worktree
-    // → drop the registration last. A different attached branch is proven but its ref is never deleted.
+    // → drop the registration last. A different attached branch is proven but its ref is never deleted;
+    // a pre-existing detached HEAD is checked independently and never reattached on a failed removal.
     // Holding this worktree's HEAD.lock and index.lock makes git refuse every commit and `add` in it until the
     // removal ends (`worktree remove` itself does not need them), so no commit can land between the last
     // check and the removal. The locks live in the worktree's admin dir, which the removal deletes.
     updateLedgerLocked(root, ledger => { ledger.sandboxes[path] = { ...entry, reclaiming: ownTip,
-      ...(differentBranch ? { checkoutTip: tip, checkoutBranch } : {}) }; });
+      ...(differentBranch || (detachedCheckout && tip !== ownTip) ? { checkoutTip: tip, checkoutBranch } : {}) }; });
     const admin = git(path, 'rev-parse', '--absolute-git-dir');
     const held: string[] = [];
     const release = (): void => { for (const lock of held.splice(0)) rmSync(lock, { force: true }); };
     const restore = (): string => {
       release();
       const head = runGitCommand(path, ['rev-parse', '--verify', 'HEAD'], { encoding: 'utf8' });
-      runGitCommand(repo, ['update-ref', ref, differentBranch ? ownTip : head.status === 0 ? head.stdout.trim() : tip, ''], { encoding: 'utf8' });
-      const reattached = runGitCommand(path, ['symbolic-ref', 'HEAD', checkoutRef], { encoding: 'utf8' }).status === 0;
-      // If HEAD could not be re-attached (e.g. a stale HEAD.lock), keep `reclaiming` so the next done resumes.
+      runGitCommand(repo, ['update-ref', ref, differentBranch || detachedCheckout ? ownTip : head.status === 0 ? head.stdout.trim() : tip, ''], { encoding: 'utf8' });
+      const reattached = detachedCheckout ? head.status === 0 && head.stdout.trim() === tip
+        : runGitCommand(path, ['symbolic-ref', 'HEAD', checkoutRef], { encoding: 'utf8' }).status === 0;
+      // If HEAD could not be restored (e.g. a stale HEAD.lock), keep `reclaiming` so the next done resumes.
       const restored = reattached ? { kind: entry.kind, path: entry.path, owner: entry.owner } : { ...entry, reclaiming: ownTip,
-        ...(differentBranch ? { checkoutTip: tip, checkoutBranch } : {}) };
+        ...(differentBranch || (detachedCheckout && tip !== ownTip) ? { checkoutTip: tip, checkoutBranch } : {}) };
       try { updateLedgerLocked(root, ledger => { ledger.sandboxes[path] = restored; }); return reattached ? 'registration restored' : 'left resumable'; }
       catch (error) { return `REGISTRATION NOT RESTORED (fix ${path} in house.json by hand): ${error instanceof Error ? error.message : String(error)}`; }
     };
     const fail = (message: string): never => { throw new Error(`${message}; nothing removed: ${path} · ${restore()}`); };
-    if (!resuming) git(path, 'checkout', '--quiet', '--detach');
+    if (!resuming && !detached) git(path, 'checkout', '--quiet', '--detach');
     for (const name of ['HEAD.lock', 'index.lock']) {
       const lock = join(admin, name);
       try { takeLock(lock); held.push(lock); }