elanous 0.2.28 → 0.2.31

package/src/harness/harness-cli-command.ts

@@ -15,7 +15,7 @@ import { stateDirSourceForChild } from '../agent/identity-env.js';
 import { lookupGoal, type GoalLookupOptions, type GoalLookupResult } from '../self-implement/goal-lookup.js';
 import { archiveGoals, type GoalArchiveOptions } from '../self-implement/goal-archive.js';
 import { detectBursts, formatIncidentBurstWarning, incidentLastLines, readRunExits, recentBurst, recordRunExit } from './harness-incidents.js';
-import { Command, Option } from 'commander';
+import { Command, InvalidArgumentError, Option } from 'commander';
 import { runGitCommand } from '../git-fs/runner.js';
 import { GOAL_TYPES, lintGoalFile, parseGoalId, parseGoalType, resolveGoalAuthorGrade, tracedPathReferences, type GoalAuthorGrade, type GoalAuthorGradeSelection, type GoalType } from '../self-implement/goal-author.js';
 import { templateForGoalType } from '../self-implement/graph-templates.js';
@@ -132,6 +132,8 @@ export interface HarnessAskSayOptions {
   /** Depth 0 only. At depth >= 1 this flag is ignored and the launch stays refused. */
   nestedElanous?: 'allow';
   queue?: boolean;
+  /** RUN-IDENTITY — 태스크 카드 신분이 대기열 줄 우선순위로 옮겨온 값(승인·선점이 신분을 읽는다 · 칸 러브릭보다 위). */
+  runPriority?: number;
 }
 
 export interface ResolvedHarnessSupervisor {
@@ -294,6 +296,11 @@ function registerHarnessAskSayOptions(command: Command): Command {
     .option('--correlation <id>', '요청과 런을 잇는 불투명 correlation 값')
     .addOption(new Option('--seat <seat>', '런 귀속 자리 (OP|TC|MK|UX)').choices(['OP', 'TC', 'MK', 'UX']))
     .option('--no-queue', '비상시 자리별 대기열을 건너뛰고 직접 발사')
+    .option('--run-priority <n>', 'RUN-IDENTITY — 태스크 카드 신분이 대기열 줄 우선순위로 옮겨온 값(승인·선점이 신분을 읽는다 · 칸 러브릭보다 위)', (value: string) => {
+      const n = Number(value);
+      if (!Number.isFinite(n)) throw new InvalidArgumentError('유한한 숫자여야 한다');
+      return n;
+    })
     .addOption(new Option('--goal-type <type>', `골 종류 (${GOAL_TYPES.join('|')})`).choices([...GOAL_TYPES]))
     .option('--force-preflight', '전제 검사 막힘을 명시 요청으로 우회(관측에 남음)')
     .option('--force-gate', '같은 골 실행 중 막힘을 명시 요청으로 우회(관측에 남음; 예산 막힘은 우회 불가)')
@@ -371,6 +378,7 @@ function normalizeHarnessAskSayOptions(opts: HarnessAskSayChildLlmOptions): Harn
     ...(opts.target !== undefined ? { target: opts.target } : {}),
     ...(opts.correlation !== undefined ? { correlation: opts.correlation } : {}),
     ...(opts.forcePreflight === true ? { forcePreflight: true } : {}),
+    ...(opts.runPriority !== undefined ? { runPriority: opts.runPriority } : {}),
     ...(opts.childLlmProvider !== undefined ? { childLlmProvider: opts.childLlmProvider } : {}),
     ...(opts.childLlmModel !== undefined ? { childLlmModel: opts.childLlmModel } : {}),
     // ⛔⭐⭐ 🩸 2026-09-12 — ***이 줄이 «없어서» `--child-llm-effort` 가 조용히 삼켜졌다.***
@@ -408,7 +416,7 @@ function resolveLaunchSubstrate(opts: HarnessSubstrateOpts): ResolvedHarnessSubs
   return resolved;
 }
 type PodExit = { status: number | null; signal?: string | null };
-type PodExitReason = 'signal' | 'human-stop' | 'supervisor' | 'no-launch' | 'unknown'
+type PodExitReason = 'signal' | 'human-stop' | 'supervisor' | 'no-launch' | 'unknown' | 'preflight-refused'
   | 'pod-error' | 'launch-gate-blocked' | 'ENOBUFS' | 'OOMKilled';
 
 function unknownPodExitTailReason(output: string): PodExitReason | undefined {
@@ -442,6 +450,28 @@ export function classifyHarnessPodExit(
     runId?: string;
   } = {},
 ): { lines: string[]; reason: PodExitReason | 'pod-failure' } {
+  const occupiedNewLine = output.split('\n').find((line) =>
+    /^\[self-dev\] run run-[a-z0-9_-]{8,64} \[preflight:new-path-occupied:[0-9a-f-]{36}\] /.test(line));
+  const observedRunId = deps.runId ?? harnessPodRunId(output);
+  const preflightRunId = occupiedNewLine ? harnessPodRunId(occupiedNewLine) : undefined;
+  const preflightAttemptId = occupiedNewLine?.match(/\[preflight:new-path-occupied:([0-9a-f-]{36})\]/)?.[1];
+  const preflightPath = occupiedNewLine?.match(/신설 traced path 가 이미 점유됨: (.+) — 골의 신설: 경로를 바로잡아야 한다$/)?.[1];
+  let preflightReceipt = false;
+  if (exit.status === 2 && !exit.signal && occupiedNewLine && preflightRunId && preflightRunId === observedRunId && preflightPath && preflightAttemptId) {
+    try {
+      const entries = (deps.loadLedger ?? loadRunLedger)(preflightRunId) ?? [];
+      const receiptIndex = entries.findIndex((entry) => entry.runId === preflightRunId && entry.event === 'preflight-refused'
+        && entry.data.kind === 'occupied-new-traced-path' && entry.data.path === preflightPath
+        && entry.data.attemptId === preflightAttemptId);
+      preflightReceipt = receiptIndex >= 0 && !entries.slice(receiptIndex + 1).some((entry) => LAUNCH_EVIDENCE_EVENTS.has(entry.event));
+    } catch { /* Unreadable run evidence cannot establish a host refusal. */ }
+  }
+  if (preflightReceipt && occupiedNewLine) {
+    const runId = preflightRunId;
+    try { debug.log('harness.pod', 'exit-classified', { runId, reason: 'preflight-refused', status: exit.status, signal: exit.signal ?? null }); }
+    catch { /* observation is fail-soft */ }
+    return { reason: 'preflight-refused', lines: [occupiedNewLine] };
+  }
   let podFailure: string | undefined;
   let podJobFailed = false;
   let podChildFailed = false;
@@ -470,7 +500,6 @@ export function classifyHarnessPodExit(
     podChildFailed = summary?.includes(' — pod-child-failed: ') ?? false;
   }
   // Only the run announced at launch — another run id quoted in the output is not this run (review round 3).
-  const observedRunId = deps.runId ?? harnessPodRunId(output);
   const runId = observedRunId ? normalizeRunId(observedRunId) : undefined;
   if (podFailure) {
     const childError = podJobFailed ? podFailure.split('childError=')[1]?.split('\\n', 1)[0]?.split('\n', 1)[0] : undefined;
@@ -726,6 +755,15 @@ export function recordHarnessPodStop(
   try {
     if (runStopRecorded(runId)) return false;
     if ((deps.loadLedger ?? loadRunLedger)(runId)?.some((entry) => entry.event === RUN_STOP_EVENT)) return false;
+    if (classified.reason === 'preflight-refused') {
+      (deps.record ?? recordRunStop)({
+        runId, site: 'preflight', class: 'launch-failed',
+        cause: 'Preflight refused: occupied new traced path',
+        evidenceRef: `run-ledger:${runId}:preflight-refused`,
+        nextMove: 'Correct the declared new path in the goal before relaunch',
+      }, ...(deps.write ? [deps.write] : []));
+      return true;
+    }
     const nextMove = classified.reason === 'no-launch' ? 'Check Pod launch gate and pool, then relaunch'
       : 'Inspect Pod exit classification and harvest the branch before relaunch';
     const evidenceRef = `logs:harness.pod/exit-classified:${runId}`;
@@ -943,6 +981,8 @@ async function dispatchHarnessAskSay(
         ['--child-llm-model', opts.childLlmModel], ['--child-llm-effort', opts.childLlmEffort],
         ['--pod-pool', (opts as HarnessSubstrateOpts).podPool], ['--pod-memory', (opts as HarnessSubstrateOpts).podMemory],
         ['--after', (opts as HarnessSubstrateOpts).after], ['--source', (opts as HarnessSubstrateOpts).source], ['--repair-commit-only', (opts as HarnessSubstrateOpts).repairCommitOnly],
+        // RUN-IDENTITY — 신분이 줄 우선순위로 흐른다(승인·선점이 읽는다 · 대기열 자식이 다시 상속).
+        ['--run-priority', opts.runPriority !== undefined ? String(opts.runPriority) : undefined],
       ];
       for (const [flag, value] of values) if (value !== undefined) flags.push(flag, value);
       if ((opts as HarnessSubstrateOpts).source !== undefined && resolved.substrate !== 'pod') {
@@ -967,6 +1007,7 @@ async function dispatchHarnessAskSay(
       try {
         row = await addHarnessQueue({ seat: stampedSeat, launchCwd: process.cwd(), refuseDuplicate: true,
         ...(dryRunPreview.goalPath ? { ask: dryRunPreview.goalPath } : { say: dryRunPreview.input }),
+        ...(opts.runPriority !== undefined ? { runPriority: opts.runPriority } : {}),
         launchArgs: ['harness', dryRunPreview.goalPath ? 'ask' : 'say', dryRunPreview.goalPath ?? dryRunPreview.input,
           '--seat', stampedSeat, ...((opts as HarnessSubstrateOpts).substrate ? ['--substrate', (opts as HarnessSubstrateOpts).substrate!] : []), ...flags,
           ...(opts.nestedElanous ? ['--nested-elanous', opts.nestedElanous] : [])],
@@ -982,7 +1023,11 @@ async function dispatchHarnessAskSay(
         process.exitCode = 1;
         return;
       }
-      const result = await withJourneyNode('queue', journey, () => tickHarnessQueue({ ...queueDeps, ...(immediateLaunch ? { launch: immediateLaunch } : {}) }, row.id));
+      // NEEDS-OWNER-BOUNDARY (direct say/ask): the immediate-launch tick stays ungated — a person-initiated
+      // command answers itself, so pre-hold launch behavior is preserved. An embedder can still opt in via
+      // deps.queue.needsOwnerGate.
+      const result = await withJourneyNode('queue', journey, () => tickHarnessQueue(
+        { ...queueDeps, ...(immediateLaunch ? { launch: immediateLaunch } : {}), needsOwnerGate: queueDeps?.needsOwnerGate ?? false }, row.id));
       exitJourneyNode('queue', { ...journey, outcome: result.outcome === 'launched' && result.item?.id === row.id ? 'launched' : 'waiting', data: { queueItemId: row.id, queueTick: result.outcome } });
       if (result.outcome === 'launched' && result.item?.id === row.id) {
         if (immediateExit) process.exitCode = await immediateExit();
@@ -3336,7 +3381,9 @@ export function installHarnessCliCommand(program: Command, deps: HarnessCliComma
     console.log(`${id} ${await reconcileHarnessQueue(id, queueDeps)}`);
   }));
   queue.command('tick').description('자리별 맨 앞 항목을 라운드로빈으로 돌며 자리 몫·Pod 풀 여유·마무리 관문을 확인하고 발사 — 여유가 있으면 한 tick 에 여러 건(30초 간격 · harness.queue.burstMax 기본 5)').action(() => queueAction(async () => {
-    const result = await tickHarnessQueue(queueDeps);
+    // NEEDS-OWNER-BOUNDARY (queue tick = autonomous): the needs-owner hold defaults ON here — this is
+    // the cron surface. The census runs once per tick and is shared across every candidate seat.
+    const result = await tickHarnessQueue({ ...queueDeps, needsOwnerGate: queueDeps.needsOwnerGate ?? true });
     console.log(`${result.outcome}${result.item ? ` ${result.item.id}` : ''}: ${result.reason}`);
     // QUEUE-BURST: the first line stays as before; every further launch of the burst gets its own line.
     for (const row of result.launched?.slice(1) ?? []) console.log(`launched ${row.id}: spawned`);

package/src/harness/harness-gc.ts

@@ -1,4 +1,5 @@
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
 import { mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
 import { debug } from '../debug/log.js';
@@ -104,7 +105,7 @@ export function discoverHarnessGcRepos(root: string, expired: () => boolean = ()
 }
 
 function defaultRun(args: string[]) {
-  const result = spawnSync('git', args, { encoding: 'utf8', timeout: 20_000 });
+  const result = spawnSync('git', args, { encoding: 'utf8', timeout: 20_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
 }
 
@@ -304,11 +305,37 @@ export function runHarnessGcTick(opts: HarnessGcOptions = {}, deps: HarnessGcDep
   } finally { release(); }
 }
 
-function cliArgs(args: string[]): HarnessGcOptions {
-  const opts: HarnessGcOptions = {};
+interface HarnessGcCliOptions extends HarnessGcOptions {
+  human: boolean;
+  json: boolean;
+}
+
+export function formatHarnessGcReport(result: HarnessGcResult): string {
+  const value = (count: number | undefined): string => count === undefined ? 'unknown' : String(count);
+  const lines = [
+    `Harness GC · ${result.outcome}${result.reason ? ` (${result.reason})` : ''}`,
+    `repos=${result.repos} removed=${result.removed} preserved=${result.preserved} deferred=${result.deferred} failed=${result.failed}`,
+    `unseenOutsideWindow=${value(result.unseenOutsideWindow)} unseenOutsidePrefix=${value(result.unseenOutsidePrefix)}`,
+    `orphanScanUnavailable=${result.orphanScanUnavailable} budgetMs=${result.budgetMs} elapsedMs=${result.elapsedMs} budgetExhausted=${result.budgetExhausted ?? false}`,
+  ];
+  if (result.repositories.length === 0) lines.push('orphanScan=not-requested (no repository result)');
+  for (const repo of result.repositories) {
+    lines.push(`repo=${repo.gitDir} orphanScan=${repo.orphanScan} removed=${repo.removed} preserved=${repo.preserved} deferred=${repo.deferred} failed=${repo.failed}`);
+  }
+  for (const failure of result.repoFailures ?? []) lines.push(`repoFailure=${failure.gitDir}: ${failure.error}`);
+  return lines.join('\n');
+}
+
+export function formatHarnessGcOutput(result: HarnessGcResult, format: Pick<HarnessGcCliOptions, 'human' | 'json'>): string {
+  return format.human && !format.json ? formatHarnessGcReport(result) : JSON.stringify(result);
+}
+
+function cliArgs(args: string[]): HarnessGcCliOptions {
+  const opts: HarnessGcCliOptions = { human: false, json: false };
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
-    if (arg === '--json') continue;
+    if (arg === '--json') { opts.json = true; continue; }
+    if (arg === '--human') { opts.human = true; continue; }
     if (arg === '--dry-run') { opts.dryRun = true; continue; }
     if (arg === '--repo') { (opts.repos ??= []).push(args[++i] ?? ''); continue; }
     const key = arg === '--window' ? 'window' : arg === '--max-remove' ? 'maxRemove' : arg === '--budget-ms' ? 'budgetMs' : null;
@@ -321,8 +348,9 @@ function cliArgs(args: string[]): HarnessGcOptions {
 
 if (import.meta.main) {
   try {
-    const result = runHarnessGcTick(cliArgs(process.argv.slice(2)));
-    console.log(JSON.stringify(result));
+    const opts = cliArgs(process.argv.slice(2));
+    const result = runHarnessGcTick(opts);
+    console.log(formatHarnessGcOutput(result, opts));
     if (result.outcome === 'fail') process.exitCode = 1;
   } catch (error) {
     console.log(JSON.stringify({ outcome: 'fail', reason: String(error) }));

package/src/harness/harness-incidents.ts

@@ -26,6 +26,7 @@ export interface IncidentBurst {
   runIds: string[];
   entrance?: string;
   seat?: string;
+  hostname?: string;
 }
 
 /** Scrub before bounding: a token crossing the 200-character boundary must not leak. */
@@ -111,33 +112,69 @@ export function recordRunExit(row: RunExit, root: string): void {
   }
 }
 
-/** Non-overlapping, maximal same-reason/seat/entrance windows; no run contributes to two bursts. */
-export function detectBursts(rows: readonly RunExit[], { windowMs = 60_000, threshold = 3 }: {
-  windowMs?: number; threshold?: number;
-} = {}): IncidentBurst[] {
-  const bursts: IncidentBurst[] = [];
-  const byIdentity = new Map<string, RunExit[]>();
+const HOSTNAME_BURST_WINDOW_MS = 60 * 60_000;
+
+function uniqueRunExits(rows: readonly RunExit[]): RunExit[] {
+  const unique: RunExit[] = [];
   const seen = new Set<string>();
   for (const row of rows) {
     if (!row.runId || seen.has(row.runId) || !Number.isFinite(Date.parse(row.at))) continue;
     seen.add(row.runId);
-    const key = JSON.stringify([row.reason, row.seat ?? null, row.entrance ?? null]);
+    unique.push(row);
+  }
+  return unique;
+}
+
+function groupRunExits(rows: readonly RunExit[], keyOf: (row: RunExit) => string): RunExit[][] {
+  const byIdentity = new Map<string, RunExit[]>();
+  for (const row of rows) {
+    const key = keyOf(row);
     const group = byIdentity.get(key) ?? [];
     group.push(row);
     byIdentity.set(key, group);
   }
-  for (const group of byIdentity.values()) {
-    const { reason, seat, entrance } = group[0]!;
-    group.sort((a, b) => Date.parse(a.at) - Date.parse(b.at) || a.runId.localeCompare(b.runId));
-    for (let start = 0; start < group.length;) {
-      let end = start + 1;
-      while (end < group.length && Date.parse(group[end]!.at) - Date.parse(group[start]!.at) <= windowMs) end++;
-      if (end - start < threshold) { start++; continue; }
-      const members = group.slice(start, end);
-      bursts.push({ reason, count: members.length, firstAt: members[0]!.at,
-        lastAt: members[members.length - 1]!.at, runIds: members.map((row) => row.runId),
-        ...(seat ? { seat } : {}), ...(entrance ? { entrance } : {}) });
-      start = end;
+  return [...byIdentity.values()];
+}
+
+function burstMemberWindows(group: RunExit[], windowMs: number, threshold: number): RunExit[][] {
+  const sorted = group.slice().sort((a, b) => Date.parse(a.at) - Date.parse(b.at) || a.runId.localeCompare(b.runId));
+  const windows: RunExit[][] = [];
+  for (let start = 0; start < sorted.length;) {
+    let end = start + 1;
+    while (end < sorted.length && Date.parse(sorted[end]!.at) - Date.parse(sorted[start]!.at) <= windowMs) end++;
+    if (end - start < threshold) { start++; continue; }
+    windows.push(sorted.slice(start, end));
+    start = end;
+  }
+  return windows;
+}
+
+function burstFromMembers(members: RunExit[], extra: Pick<IncidentBurst, 'seat' | 'entrance' | 'hostname'>): IncidentBurst {
+  return {
+    reason: members[0]!.reason, count: members.length, firstAt: members[0]!.at,
+    lastAt: members[members.length - 1]!.at, runIds: members.map((row) => row.runId),
+    ...(extra.seat ? { seat: extra.seat } : {}),
+    ...(extra.entrance ? { entrance: extra.entrance } : {}),
+    ...(extra.hostname ? { hostname: extra.hostname } : {}),
+  };
+}
+
+/** Non-overlapping windows within each identity; seat and host are independent views of an exit. */
+export function detectBursts(rows: readonly RunExit[], { windowMs = 60_000, threshold = 3 }: {
+  windowMs?: number; threshold?: number;
+} = {}): IncidentBurst[] {
+  const unique = uniqueRunExits(rows);
+  const bursts: IncidentBurst[] = [];
+  for (const group of groupRunExits(unique, (row) => JSON.stringify([row.reason, row.seat ?? null, row.entrance ?? null]))) {
+    const { seat, entrance } = group[0]!;
+    for (const members of burstMemberWindows(group, windowMs, threshold)) {
+      bursts.push(burstFromMembers(members, { ...(seat ? { seat } : {}), ...(entrance ? { entrance } : {}) }));
+    }
+  }
+  for (const group of groupRunExits(unique.filter((row) => row.hostname), (row) => JSON.stringify([row.reason, row.hostname]))) {
+    const hostname = group[0]!.hostname;
+    for (const members of burstMemberWindows(group, HOSTNAME_BURST_WINDOW_MS, 3)) {
+      bursts.push(burstFromMembers(members, { ...(hostname ? { hostname } : {}) }));
     }
   }
   return bursts.sort((a, b) => Date.parse(a.firstAt) - Date.parse(b.firstAt) || a.reason.localeCompare(b.reason));
@@ -149,7 +186,7 @@ export function recentBurst(root: string, now: Date | number, { lookbackMs = 15
   const time = typeof now === 'number' ? now : now.getTime();
   const recent = detectBursts(readRunExits(root)).filter((burst) => {
     const last = Date.parse(burst.lastAt);
-    return last <= time && last >= time - lookbackMs
+    return !burst.hostname && last <= time && last >= time - lookbackMs
       && burst.seat === seat && burst.entrance === entrance;
   });
   return recent.sort((a, b) => Date.parse(a.lastAt) - Date.parse(b.lastAt)).at(-1) ?? null;

package/src/harness/harness-pod-dispatch.ts

@@ -13,17 +13,20 @@ import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSy
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { selfDevRunsDir } from '../self-dev/run-store.js';
 import { findGitDir } from '../git-fs/locate.js';
+import { runGitCommand } from '../git-fs/runner.js';
 import { logsDbPath } from '../mss/logging/log-store.js';
 import { POD_REEMIT_LOGS_DB_ENV } from '../task-orchestrator/surfaces/pod-ledger-prod-sink.js';
 import { debug } from '../debug/log.js';
 import { ELANOUS_ENTRY_SCRIPT } from '../self-implement/seams.js';
 import { parsePodSourceSpec } from '../task-orchestrator/surfaces/pod-source-spec.js';
-import { declaredGoalType, type GoalType } from '../self-implement/goal-author.js';
+import { declaredGoalType, extractVerbatimOriginalAsk, tracedPathReferences, type GoalType } from '../self-implement/goal-author.js';
+import { declaredNewFilePaths } from '../self-implement/goal-new-paths.js';
 import { appendRunLedgerEntry } from '../self-implement/run-ledger.js';
 import { HARNESS_RUN_ID_ENV } from './harness-space.js';
 import { podMemoryLimitFor, type PodMemoryTier } from '../task-orchestrator/surfaces/self-implement-pod.js';
 import { oldDoorInternalEnv } from '../self-dev/old-door.js';
 import { selectPodMemoryTier } from './pod-memory-policy.js';
+import { preflightGoalDoneBoundary } from '../self-dev/dev-pipeline.js';
 
 export interface HarnessPodDispatchInput {
   readonly entrance: 'cli-harness-ask' | 'cli-harness-say';
@@ -73,7 +76,24 @@ export function podOrchestrateArgs(input: HarnessPodDispatchInput, goalFile: str
   ];
 }
 
-type PodDispatchDeps = { run?: (cmd: string, args: readonly string[], env: NodeJS.ProcessEnv) => number | null; readFile?: (path: string) => string; cwd?: string; spawnChild?: typeof spawn; onOutput?: (text: string) => void };
+type PodDispatchDeps = { run?: (cmd: string, args: readonly string[], env: NodeJS.ProcessEnv) => number | null; readFile?: (path: string) => string; cwd?: string; spawnChild?: typeof spawn; onOutput?: (text: string) => void; recordRunLedgerEntry?: typeof appendRunLedgerEntry; nowMs?: number };
+
+/** Default Pod source clones origin HEAD. Never infer its file occupation from an unrelated worktree. */
+function defaultPodSourceHeadAt(root: string): string | undefined {
+  const localResult = runGitCommand(root, ['rev-parse', 'HEAD'], { encoding: 'utf8', timeout: 5_000 });
+  if (localResult.status !== 0 || localResult.signal) return undefined;
+  const local = localResult.stdout.trim();
+  const remoteResult = runGitCommand(root, ['ls-remote', 'origin', 'HEAD'], { encoding: 'utf8', timeout: 5_000 });
+  if (remoteResult.status !== 0 || remoteResult.signal) return undefined;
+  const remote = remoteResult.stdout.trim().split(/\s+/, 1)[0];
+  return /^[0-9a-f]{40}$/.test(remote ?? '') && remote === local ? local : undefined;
+}
+
+function occupiedInTree(root: string, head: string, path: string): boolean | undefined {
+  const result = runGitCommand(root, ['ls-tree', head, '--', path], { encoding: 'utf8', timeout: 5_000 });
+  if (result.status !== 0 || result.signal) return undefined;
+  return result.stdout.trim() !== '';
+}
 
 export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDispatchDeps & { run: NonNullable<PodDispatchDeps['run']> }): number;
 export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps?: PodDispatchDeps): number | Promise<number>;
@@ -111,13 +131,6 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
     tempDir = mkdtempSync(join(runsDir, 'pod-author-'));
     goalFile = join(tempDir, 'sentence.txt');
     writeFileSync(goalFile, input.input, { mode: 0o600 });
-    const runId = env[HARNESS_RUN_ID_ENV]?.trim() || `run-${randomUUID()}`;
-    env[HARNESS_RUN_ID_ENV] = runId;
-    const receipt = { entrance: input.entrance, host: hostname(), runId, authorOnPod: true,
-      sentenceChars: input.input.length, sentenceSha256: createHash('sha256').update(input.input).digest('hex') };
-    debug.log('harness.substrate', 'author-on-pod-receipt', receipt);
-    try { appendRunLedgerEntry({ runId, event: 'author-on-pod-receipt', data: receipt }); }
-    catch (error) { debug.log('harness.substrate', 'author-on-pod-receipt-unwritten', { reason: error instanceof Error ? error.message : String(error) }); }
   } else {
     const goal = input.input;
     goalText = goal;
@@ -127,8 +140,72 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
     goalFile = join(tempDir, 'goal.txt');
     writeFileSync(goalFile, goal, { mode: 0o600 });
   }
+  let pinnedDefaultSource: string | undefined;
+  // AUTHOR-NEW-FILE-PATHS: when the Pod will use this very repository tree, reject a
+  // deterministically occupied new path before creating a Job. A different --source or
+  // --base can have different files; the Pod remains responsible for those cases.
+  if (!input.source && !input.base && input.entrance === 'cli-harness-ask') {
+    const declaration = extractVerbatimOriginalAsk(goalText)?.ask ?? '';
+    const newPaths = declaredNewFilePaths(declaration);
+    const traced = new Set(tracedPathReferences(goalText).map(({ path }) => path.replace(/^\.\//, '')));
+    const candidates = newPaths.filter((path) => traced.has(path));
+    const repositoryRoot = candidates.length > 0 ? findGitDir(cwd)?.root : undefined;
+    const defaultSourceHead = repositoryRoot ? defaultPodSourceHeadAt(repositoryRoot) : undefined;
+    if (candidates.length > 0 && !defaultSourceHead) {
+      debug.log('harness.substrate', 'new-path-preflight-unmeasured', {
+        entrance: input.entrance, reason: 'default-source-head-unverified', candidateCount: candidates.length,
+      });
+    }
+    // The preflight checks this exact tree, so pin the Pod job to the same commit.
+    // Otherwise origin/HEAD could move between this check and the Job's clone.
+    if (candidates.length > 0 && defaultSourceHead) pinnedDefaultSource = `commit:${defaultSourceHead}`;
+    for (const path of candidates) {
+      if (!repositoryRoot || !defaultSourceHead) break; // Unmeasured source parity is never a refusal.
+      const occupied = occupiedInTree(repositoryRoot, defaultSourceHead, path);
+      if (occupied === undefined) {
+        debug.log('harness.substrate', 'new-path-preflight-unmeasured', {
+          entrance: input.entrance, reason: 'default-source-tree-query-failed', candidate: path,
+        });
+        continue;
+      }
+      if (!occupied) continue;
+      const runId = env[HARNESS_RUN_ID_ENV]?.trim() || `run-${randomUUID()}`;
+      const attemptId = randomUUID();
+      const line = `[self-dev] run ${runId} [preflight:new-path-occupied:${attemptId}] 신설 traced path 가 이미 점유됨: ${path} — 골의 신설: 경로를 바로잡아야 한다\n`;
+      try {
+        (deps.recordRunLedgerEntry ?? appendRunLedgerEntry)({ runId, event: 'preflight-refused', data: { kind: 'occupied-new-traced-path', path, entrance: input.entrance, sourceHead: defaultSourceHead, attemptId } });
+      } catch (error) {
+        debug.log('harness.substrate', 'preflight-receipt-unwritten', { reason: String(error) });
+        break; // Without the host receipt, let Pod-side validation decide instead of claiming a host refusal.
+      }
+      deps.onOutput?.(line);
+      if (!deps.onOutput) process.stderr.write(line);
+      if (tempDir) rmSync(tempDir, { recursive: true, force: true });
+      return 2;
+    }
+  }
+  if (input.authorOnPod && input.entrance === 'cli-harness-say') {
+    const runId = env[HARNESS_RUN_ID_ENV]?.trim() || `run-${randomUUID()}`;
+    env[HARNESS_RUN_ID_ENV] = runId;
+    const receipt = { entrance: input.entrance, host: hostname(), runId, authorOnPod: true,
+      sentenceChars: input.input.length, sentenceSha256: createHash('sha256').update(input.input).digest('hex') };
+    debug.log('harness.substrate', 'author-on-pod-receipt', receipt);
+    try { (deps.recordRunLedgerEntry ?? appendRunLedgerEntry)({ runId, event: 'author-on-pod-receipt', data: receipt }); }
+    catch (error) { debug.log('harness.substrate', 'author-on-pod-receipt-unwritten', { reason: error instanceof Error ? error.message : String(error) }); }
+  }
+  // This is the common host-side Pod launch boundary for harness ask/say and
+  // dev ask. A say sentence is the source request; an ask file is the GOAL.
+  // Check before the orchestrator child can place or create a Pod Job.
+  try {
+    preflightGoalDoneBoundary({ file: goalFile }, goalText, env.ELANOUS_TASK_CARD_ID, input.entrance,
+      input.entrance === 'cli-harness-say' ? 'request' : 'goal', deps.nowMs ?? Date.now());
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    if (tempDir) rmSync(tempDir, { recursive: true, force: true });
+    return 2;
+  }
   const goalChars = goalText.length;
-  const args = podOrchestrateArgs(input, goalFile);
+  const args = podOrchestrateArgs(pinnedDefaultSource ? { ...input, source: pinnedDefaultSource } : input, goalFile);
   debug.log('harness.substrate', 'goal-file', { entrance: input.entrance, mode: tempDir ? 'temp' : 'path' });
   const goalType = input.goalType ?? declaredGoalType(goalText);
   // A process-level memory tier is already an explicit selection; do not replace it with a goal-type default.

package/src/harness/harness-queue.ts

@@ -23,6 +23,7 @@ import { parsePodPool, podPoolHostLease, resolvePodPoolSpec } from '../task-orch
 import { writeHarnessQueueReceipt } from './harness-queue-child.js';
 import { adviseLaunch, compareLaunchAdvice, type LaunchAdvice } from './launch-advice.js';
 import { finishAdvice, measureFinish, recordFinishHistory, type FinishMetrics } from '../loops/orchestrator/finish-rate.js';
+import { collectDraftMetrics, DRAFT_NEEDS_OWNER_SEAT_CAP, shouldHoldSeatNewLaunch, type DraftMetrics } from '../self-dev/draft-sweep.js';
 
 export type QueueSeat = 'OP' | 'TC' | 'MK' | 'UX';
 export type QueueItem = {
@@ -74,6 +75,13 @@ export interface HarnessQueueDeps {
   root?: string;
   configPath?: string;
   cap?: (seat: QueueSeat) => number;
+  /** Fresh GitHub draft inventory for the dispatch boundary; tests inject an isolated source. */
+  draftMetrics?: (now: Date) => Promise<DraftMetrics>;
+  /** Explicit needs-owner hold gate — the hold is an autonomous-launch guard. Cron `harness queue tick`
+   *  and the seat-loop launch/wake sites pass true; the direct `harness say`/`ask` immediate-launch tick
+   *  passes false (a person-initiated command answers itself, pre-hold launch behavior preserved).
+   *  Tests assert this option instead of inferring the boundary from which seams are injected. */
+  needsOwnerGate?: boolean;
   pool?: () => QueuePool;
   /** Shadow-only advice seam; exceptions must not affect the queue decision. */
   advice?: typeof adviseLaunch;
@@ -322,8 +330,8 @@ function defaultQueuePriority(cellId: string | undefined, root: string, deps: Ha
   }
 }
 
-/** Seat head order: priority descending (none = lowest), then arrival ascending, then file order. */
-function queueHeadBefore(a: QueueItem, b: QueueItem): boolean {
+/** Seat head order: priority descending (none = lowest), then arrival ascending, then file order. RUN-IDENTITY — 신분에서 온 `runPriority` 가 여기서 승인·선점 순서를 정한다. */
+export function queueHeadBefore(a: QueueItem, b: QueueItem): boolean {
   const pa = a.priority ?? -Infinity, pb = b.priority ?? -Infinity;
   if (pa !== pb) return pa > pb;
   const ta = Date.parse(a.at), tb = Date.parse(b.at);
@@ -336,7 +344,7 @@ export class HarnessQueueDuplicateError extends Error {
   }
 }
 
-export async function addHarnessQueue(input: { seat: string; say?: string; ask?: string; hold?: boolean; heavy?: boolean; idempotencyKey?: string; launchArgs?: string[]; poolHint?: string; poolHintSource?: 'grid'; launchCwd?: string; refuseDuplicate?: boolean }, deps: HarnessQueueDeps = {}): Promise<QueueItem> {
+export async function addHarnessQueue(input: { seat: string; say?: string; ask?: string; hold?: boolean; heavy?: boolean; idempotencyKey?: string; launchArgs?: string[]; poolHint?: string; poolHintSource?: 'grid'; launchCwd?: string; refuseDuplicate?: boolean; runPriority?: number }, deps: HarnessQueueDeps = {}): Promise<QueueItem> {
   const assigned = seat(input.seat);
   if ((input.say === undefined) === (input.ask === undefined)) throw new Error('harness queue add: --say 또는 --ask 중 하나만 필요');
   const kind = input.ask === undefined ? 'say' : 'ask';
@@ -370,7 +378,8 @@ export async function addHarnessQueue(input: { seat: string; say?: string; ask?:
         throw new HarnessQueueDuplicateError(existing, key);
       }
     }
-    const priority = defaultQueuePriority(cellId, root, deps);
+    // RUN-IDENTITY — 신분에서 온 줄 우선순위가 칸 러브릭보다 위다(승인·선점이 신분을 읽는다 · GATE-PRIORITY 흡수).
+    const priority = input.runPriority ?? defaultQueuePriority(cellId, root, deps);
     const item: QueueItem = { id: `hq-${randomUUID()}`, seat: assigned, kind, input: value,
       hold: input.hold === true, heavy: input.heavy === true, at: new Date().toISOString(), status: 'queued',
       ...(input.launchArgs === undefined ? {} : { launchArgs: input.launchArgs }),
@@ -1486,6 +1495,23 @@ async function tickHarnessQueueOnce(deps: HarnessQueueDeps, requestedId: string
       }
       return waiting();
     }
+    // NEEDS-OWNER-CENSUS: one draft census per tick, shared by every candidate. A full census pages all
+    // open drafts, the 48h closed cohort, and one claim-comment gh call per open draft — re-running it
+    // per candidate multiplied those calls by the seat count and raced the rate limit the seat-loop tick
+    // also spends. The memo lives in this tick only; the next tick re-collects.
+    const needsOwnerGate = deps.needsOwnerGate ?? false;
+    let draftCensus: Promise<DraftMetrics> | undefined;
+    const censusOnce = (): Promise<DraftMetrics> => {
+      draftCensus ??= (deps.draftMetrics
+        ? deps.draftMetrics((deps.now ?? (() => new Date()))())
+        : (async () => {
+          const [{ resolveRepositoryName }, { githubDraftSweepAdapters }] = await Promise.all([
+            import('./repository-name.js'), import('./harness-cli-command.js'),
+          ]);
+          return collectDraftMetrics(resolveRepositoryName({}), githubDraftSweepAdapters(), (deps.now ?? (() => new Date()))());
+        })());
+      return draftCensus;
+    };
     for (const item of candidates) {
       const injectedCap = deps.cap?.(item.seat);
       const details = seatCapDetails({ seat: item.seat, caps, gate, injectedCap });
@@ -1545,6 +1571,29 @@ async function tickHarnessQueueOnce(deps: HarnessQueueDeps, requestedId: string
         catch { /* Observation cannot affect dispatch. */ }
         return { outcome: 'waiting', item: { ...item, waitingReason: lateHold.reason }, reason: lateHold.reason };
       }
+      // A queued request can outlive the seat's earlier census: check again at the actual launcher boundary.
+      // NEEDS-OWNER-BOUNDARY: the hold is an autonomous-launch guard — cron `harness queue tick` (and any
+      // embedder) opts in via deps.needsOwnerGate; the direct `harness say`/`ask` immediate-launch tick does
+      // not, because a person-initiated command answers itself. The census itself is shared: one call per
+      // tick (censusOnce), never one per candidate.
+      if (needsOwnerGate) {
+        let metrics: DraftMetrics | undefined;
+        try {
+          metrics = await censusOnce();
+          if (!metrics.needsOwnerBySeat) throw new Error('per-seat draft inventory missing');
+        } catch (error) {
+          // NEEDS-OWNER-POLICY: an unreadable census — gh unavailable, rate-limited, or one unreadable
+          // claim comment — is unobserved, not failed-closed. Unobserved input never holds any seat's
+          // launch; only an observed count over the cap does. The next tick re-collects.
+          try {
+            debug.log('loop.orchestrator', 'needs-owner-unobserved', { seat: item.seat, reason: String(error).slice(0, 140) });
+          } catch { /* observation must not affect the dispatch decision */ }
+        }
+        if (metrics && shouldHoldSeatNewLaunch(item.seat, metrics.needsOwnerBySeat ?? {})) {
+          blocked.set(item.seat, { reason: `needs-owner ${item.seat}: ${metrics.needsOwnerBySeat?.[item.seat]} > ${DRAFT_NEEDS_OWNER_SEAT_CAP}`, active });
+          continue;
+        }
+      }
       // QUEUE-BURST: scheduled launches stay `launchStaggerMs` after the last queue launch — any tick or process, a direct
       // launch included — so an overlapping cron tick cannot double a burst. A requested (direct say/ask) tick keeps its
       // launch-at-once contract (ONEDOOR-2) and only records its time for the next scheduled tick.

package/src/harness/harness-stop.ts

@@ -14,6 +14,7 @@
 import { existsSync, readdirSync, readFileSync, readlinkSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
 import { debug } from '../debug/log.js';
 import { selfDevRunsDir } from '../self-dev/run-store.js';
 import { launchBindingRunIds, launchRegistryDir, readLaunchBinding } from './launch-registry.js';
@@ -124,7 +125,7 @@ export function discoverStopProcesses(runId: string, goalPath: string | null, ta
 function stopProcessCwd(pid: number): string | null {
   try {
     if (process.platform === 'linux') return readlinkSync(`/proc/${pid}/cwd`);
-    const r = spawnSync('lsof', ['-a', '-p', String(pid), '-d', 'cwd', '-Fn'], { encoding: 'utf8', timeout: 5_000 });
+    const r = spawnSync('lsof', ['-a', '-p', String(pid), '-d', 'cwd', '-Fn'], { encoding: 'utf8', timeout: 5_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
     if (r.error || r.status !== 0 || typeof r.stdout !== 'string') return null;
     return r.stdout.split(/\r?\n/).find((line) => line.startsWith('n/'))?.slice(1) ?? null;
   } catch { return null; }
@@ -206,7 +207,7 @@ export function pidRecordFromLaunchBinding(runId: string, registryDir = launchRe
 /** macOS·Linux 공통 — UTC 시작 시각과 상태를 같은 ps 관측에서 읽는다. */
 export function psProcessStartMs(pid: number): number | null {
   const r = spawnSync('ps', ['-o', 'lstart=,stat=', '-p', String(pid)], {
-    encoding: 'utf8', timeout: 5_000, env: { ...process.env, TZ: 'UTC' },
+    encoding: 'utf8', timeout: 5_000, env: { ...process.env, TZ: 'UTC' }, maxBuffer: SPAWN_SYNC_MAX_BUFFER,
   });
   if (r.status !== 0) return null;
   const match = /^\s*((?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)\s+\w+\s+\d+\s+\d\d:\d\d:\d\d\s+\d{4})\s+(\S+)\s*$/.exec(r.stdout);
@@ -220,7 +221,7 @@ export function defaultHarnessStopDeps(overrides: Partial<HarnessStopDeps> = {},
   const env = { ...process.env };
   for (const key of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'ALL_PROXY', 'all_proxy']) delete env[key];
   const kubectl = (args: readonly string[]) => {
-    const r = spawnSync('kubectl', [...args], { encoding: 'utf8', timeout: 15_000, env });
+    const r = spawnSync('kubectl', [...args], { encoding: 'utf8', timeout: 15_000, env, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
     return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? String(r.error ?? '') };
   };
   return {