elanous 0.2.28 → 0.2.31

package/src/agent-mission/review-loop.ts

@@ -361,9 +361,12 @@ export function extractAppliedReviewItems(comments: readonly NonNullable<LatestR
 /** 브랜치의 열린 PR 코멘트에서 이전 self-dev 반영분을 fail-soft로 읽는다. */
 export function fetchAppliedReviewItemsForBranch(branch: string, runGh: (args: string[]) => string = gh): AppliedReviewItems {
   try {
-    const raw = runGh(['pr', 'view', branch, '--json', 'comments']);
-    const source = JSON.parse(raw) as LatestReviewSource;
-    const signals = filterReviewSignals(source);
+    // A Pod repair uses the synthetic worktree base `pr-N`; GitHub knows that
+    // source by PR number, not by the synthetic branch name.
+    const source = /^pr[:-]([1-9]\d*)$/.exec(branch)?.[1] ?? branch;
+    const raw = runGh(['pr', 'view', source, '--json', 'comments']);
+    const reviewSource = JSON.parse(raw) as LatestReviewSource;
+    const signals = filterReviewSignals(reviewSource);
     return { basePrLocated: true, ...analyzeAppliedReviewItems(signals.selfAuthoredComments) };
   } catch {
     return { basePrLocated: false, items: [], headlineComments: 0 };

package/src/agent-substrate/acp-implementer.ts

@@ -85,6 +85,18 @@ export interface AcpImplementerResult {
 
 const OBS = 'agent-substrate.acp-implementer';
 
+/** Claude ACP's default preset imports user/project plugins and MCP servers into every
+ * prompt snapshot. The implementation child only needs the built-in coding tools. */
+export const CLAUDE_IMPLEMENTER_META = {
+  claudeCode: { options: {
+    tools: ['Read', 'Write', 'Edit', 'Bash', 'Glob', 'Grep'],
+    settingSources: [],
+    plugins: [],
+    mcpServers: {},
+    strictMcpConfig: true,
+  } },
+} as const;
+
 export function makeAcpImplementer(opts: AcpImplementerOpts): (prompt: string) => Promise<AcpImplementerResult> {
   return async (prompt) => {
     const spawn = subscriptionReviewerSpawn(opts.spec ?? { provider: 'claude-acp' }, opts.env ?? process.env, opts.proxyBaseUrl);
@@ -119,10 +131,10 @@ export function makeAcpImplementer(opts: AcpImplementerOpts): (prompt: string) =
       await withinHandshake(agent.start());
       let sid: string;
       if (opts.resumeSessionId) {
-        await withinHandshake(agent.loadSession({ sessionId: opts.resumeSessionId, cwd: opts.worktree }));
+        await withinHandshake(agent.loadSession({ sessionId: opts.resumeSessionId, cwd: opts.worktree, _meta: CLAUDE_IMPLEMENTER_META }));
         sid = opts.resumeSessionId;
       } else {
-        sid = await withinHandshake(agent.newSession());
+        sid = await withinHandshake(agent.newSession(CLAUDE_IMPLEMENTER_META));
       }
       if (opts.model) await withinHandshake(agent.selectSessionModel(sid, opts.model));
       debug.log(OBS, 'start', { cwd: opts.worktree, model: opts.model ?? '(default)', resumed: Boolean(opts.resumeSessionId) });

package/src/agent-substrate/pr-reviewer.ts

@@ -652,6 +652,20 @@ export function buildReviewPrompt(
  *  `none of the tests …`. 표지 낱말로 시작하는 실제 블로커를 지우면 PASS/WARN 리뷰에서 블로커가 사라진다. */
 const NONE_WORD = String.raw`(?:없음|해당\s*없음|n\/a|none|nothing)`;
 const BARE_SENTINEL = new RegExp(String.raw`^${NONE_WORD}\s*[.。]?$`, 'i');
+// GLM 은 비어 있는 mustFix 항목이나 괄호 안의 한 문장으로 무소견을 적는다.
+// 괄호 전체만 검사한다. 중간에 "no blockers" 가 있어도 뒤에 지적이 이어지면 버리지 않는다.
+const BRACKETED_PLACEHOLDER = /^[（(]\s*([\s\S]*?)\s*[）)]$/;
+const PLACEHOLDER_ONLY = /^(?:없음|해당\s*없음|none|n\/a|no\s+blockers?)$/i;
+const PLACEHOLDER_END = /(?:블로커|차단)\s*없음$|no\s+blockers?$/i;
+function isBracketedPlaceholder(text: string): boolean {
+  const bracketed = BRACKETED_PLACEHOLDER.exec(text);
+  if (!bracketed) return false;
+  const inside = bracketed[1]!.trim().replace(/(?:\s*(?:…|\.{2,}|[.。]))+\s*$/, '').trim();
+  return PLACEHOLDER_ONLY.test(inside) || PLACEHOLDER_END.test(inside);
+}
+const DASH_ONLY_SENTINEL = /^[([（【]\s*[-—–]\s*[)\]）】]$/;
+// 목록 항목의 바깥 `- `와 별개로, 리뷰어가 괄호 안에도 장식 대시를 둘 수 있다: `- (- 없음 -)`.
+const DASH_WRAPPED_BRACKETED_SENTINEL = new RegExp(String.raw`^[([（【]\s*(?:[-—–]+\s*)?${NONE_WORD}\s*(?:[-—–]+\s*)?[)\]）】]$`, 'i');
 const BRACKETED_SENTINEL = new RegExp(String.raw`^[([（【]\s*${NONE_WORD}(?:\s*[—–\-:.,;·]\s*([^)\]）】]*))?\s*[)\]）】]$`, 'i');
 // ⭐ 설명 «전체»가 「지적 없음」 한 문장일 때만 — 일부만 맞아도 접으면 `(none: no blockers are checked because …)` 같은 지적이 사라진다.
 const NO_FINDING_REMARK = new RegExp([
@@ -662,41 +676,39 @@ const NO_FINDING_REMARK = new RegExp([
   String.raw`^수용\s*기준(?:을|이)?\s*(?:(?:모두|전부)\s*)?충족(?:함|됨|했다|합니다)?[.。]?$`,
   String.raw`^(?:all\s+)?acceptance\s+criteria\s+(?:are\s+)?(?:all\s+)?met\.?$`,
 ].join('|'), 'i');
-// REVIEW-MUSTFIX-NONE-SENTINEL 후속 — GLM 이 괄호 안에 «무소견 머리 + 긴 근거»를 쓴다(10-11 TC `pr land` 가 `review-must-fix-1` 로 거부):
-//   `(없음 — 수용기준 충족: 머리말에 … 반영됨 …)` · `(없음 — 수용기준 3항 모두 충족: … (\`'failed'\` 반환) · …)`(근거 안에 괄호가 또 있다).
-//   ⭐ 길이 무관 0 은 «머리»가 무소견 서술이고 바로 구분자가 올 때만 — 머리가 결함 서술이면(`(없음 — 하지만 X 가 깨진다)`) 지적으로 남긴다.
-//   ⛔ 근거에 역접·미충족(`하지만`·`다만`·`미충족`·`but`·`except`·`not met` …)이 있으면 보수적으로 지적으로 남긴다.
-const LONG_BRACKETED_SENTINEL = new RegExp(String.raw`^[([（【]\s*${NONE_WORD}\s*[—–\-:·]\s*([\s\S]+?)\s*[)\]）】]$`, 'i');
-const NO_FINDING_HEAD = new RegExp('^(?:' + [
-  String.raw`수용\s*기준(?:\s*\d+\s*(?:항|개|건)(?:목)?)?(?:을|이)?\s*(?:(?:모두|전부)\s*)?충족(?:함|됨|했다|합니다)?`,
-  String.raw`(?:all\s+)?acceptance\s+criteria\s+(?:are\s+)?(?:all\s+)?met`,
-  String.raw`must-?fix\s*(?:항목)?(?:은|는|이|가)?\s*(?:없(?:음|다|습니다)|0\s*건)`,
-  String.raw`(?:no|zero)\s+(?:blocking\s+)?(?:blockers?|must-?fix(?:es)?)(?:\s+found)?`,
-  String.raw`(?:(?:블로커|차단)\s*)?(?:수준의?\s*)?(?:결함|블로커)(?:은|는|이|가)?\s*(?:발견되지\s*않(?:음|았(?:다|습니다)?)|없(?:음|다|습니다))`,
-].join('|') + String.raw`)\s*(?:[:：—–\-·,;.。(]|$)`, 'i');
-const LONG_REMARK_DISSENT = /하지만|그러나|다만|(?<![가-힣])단(?:,|\s)|미\s*충족|불\s*충족|충족하지|충족되지|\bbut\b|\bhowever\b|\bexcept\b|\balthough\b|\bnot\s+(?:yet\s+)?met\b|\bunmet\b/i;
-/** 괄호 안이 «없음 + 구분자 + 무소견 머리 …» 인가 — 길이 무관(근거 안 괄호도 허용). `isNoneSentinelFinding` 의 갈래. */
+// OP #3173 — 설명은 의미 추정하지 않는다. 실측으로 무소견임을 확인한 문장만 등록한다.
+// 문법 밖 `없음 — 설명`은 실제 결함일 수 있으므로 mustFix에 남긴다.
+const LONG_BRACKETED_SENTINEL = new RegExp(String.raw`^[([（【]\s*(?:[-—–]+\s*)?${NONE_WORD}\s*[—–\-:·]\s*([\s\S]+?)\s*[)\]）】]$`, 'i');
+const KNOWN_NO_FINDING_REMARKS = new Set([
+  // #27349 저장 JSON의 실제 무소견 문구.
+  '문서 전용 변경이고 의도된 산출물이 실제로 존재하며 배선 누락·죽은 코드·Goodhart 해당 없음',
+]);
+/** 괄호 안 `없음` 뒤 설명이 닫힌 무소견 문법에 정확히 들어가는가. */
 function isLongNoFindingBracket(text: string): boolean {
   const m = LONG_BRACKETED_SENTINEL.exec(text.trim());
   if (!m) return false;
   const remark = m[1]!.trim();
-  return NO_FINDING_HEAD.test(remark) && !LONG_REMARK_DISSENT.test(remark);
+  const bareRemark = remark.replace(/\s*[-—–]+\s*$/, '').trim();
+  return NO_FINDING_REMARK.test(bareRemark) || KNOWN_NO_FINDING_REMARKS.has(bareRemark);
 }
 /** must-fix 항목이 «지적 없음» 표지인가 — must-fix 를 세는 자리는 전부 `parseReviewResult` 를 거친다
  *  (`self review --json` 의 `mustFix` → TA `parseReviewResultOutput` → `pr land --overlap-evidence` 의 `review-must-fix-N`).
  *  ⭐ export — `parseReviewResultOutput` 가 «같은» 판정으로 저장된 결과의 표지 줄을 다시 접는다(PR-LAND-MUSTFIX-NONE · 복제 금지). */
 export function isNoneSentinelFinding(finding: string): boolean {
   const text = finding.trim();
-  if (BARE_SENTINEL.test(text)) return true;
-  const bracketed = BRACKETED_SENTINEL.exec(text);
+  if (!text || isBracketedPlaceholder(text)) return true;
+  if (/^[-—–]+$/.test(text)) return true;
+  const markerText = text.replace(/^[—–-]+\s*|\s*[—–-]+$/g, '').trim();
+  if (markerText && (BARE_SENTINEL.test(markerText) || DASH_ONLY_SENTINEL.test(markerText) || DASH_WRAPPED_BRACKETED_SENTINEL.test(markerText))) return true;
+  const bracketed = BRACKETED_SENTINEL.exec(markerText);
   if (bracketed) {
     const remark = bracketed[1]?.trim();
     if (!remark || NO_FINDING_REMARK.test(remark)) return true;
   }
-  return isLongNoFindingBracket(text);
+  return isLongNoFindingBracket(markerText);
 }
 
-/** critic 응답 파싱 → ReviewResult. 순수함수. VERDICT + MUST-FIX/SHOULD-FIX/REQUIREMENTS 섹션 분해.
+/** critic 응답 파싱 → ReviewResult. VERDICT + MUST-FIX/SHOULD-FIX/REQUIREMENTS 섹션 분해.
  *  verdict=FAIL 인데 must-fix 미기재면 첫 finding 을 must 로 승격(블로커 근거 보존). */
 /** ⭐ `VERDICT: PASS|WARN|FAIL` 판정 줄 — `parseReviewResult` 와 `reviewedResultFromRaw` 가 «같은» 정규식을 쓴다(존재 판정이 갈리면 안 된다). */
 const VERDICT_LINE = /VERDICT:\s*(PASS|WARN|FAIL)/i;
@@ -709,6 +721,7 @@ export function parseReviewResult(text: string): ReviewResult {
   const shouldFix: string[] = [];
   const requirements: string[] = [];
   let fallbackFinding: string | undefined;
+  let droppedNonePlaceholders = 0;
   let section: 'must' | 'should' | 'requirements' | null = null;
   for (const l of lines) {
     if (/^MUST-?FIX/i.test(l)) { section = 'must'; continue; }
@@ -718,12 +731,19 @@ export function parseReviewResult(text: string): ReviewResult {
     if (l.startsWith('- ')) {
       const f = l.slice(2).trim();
       if (!f) continue;
-      if (section === 'must') { if (!isNoneSentinelFinding(f)) mustFix.push(f); }
-      else if (section === 'should') shouldFix.push(f);
+      if (section === 'must') {
+        if (isNoneSentinelFinding(f)) droppedNonePlaceholders++;
+        else mustFix.push(f);
+      } else if (section === 'should') shouldFix.push(f);
       else if (section === 'requirements') requirements.push(f);
       else fallbackFinding ??= f;
     }
   }
+  if (droppedNonePlaceholders > 0) {
+    try {
+      debug.log('review.parse', 'none-placeholder-dropped', { count: droppedNonePlaceholders });
+    } catch { /* observation must not change parsed review data */ }
+  }
   if (verdict === 'fail' && mustFix.length === 0) {
     const first = shouldFix.shift() ?? fallbackFinding;
     mustFix.push(first ?? 'PR 리뷰 FAIL — 재작업 필요(구체 지적 미파싱).');

package/src/agent-substrate/self-review-cli.ts

@@ -1125,6 +1125,24 @@ function roleAcpErrorReason(error: unknown): 'acp-handshake-timeout' | 'acp-erro
 
 type AcpFallbackSkip = { backend: string; reason: string };
 
+function validateReviewDenyBackends(value: unknown, now: number): string[] | null {
+  if (value === undefined) return [];
+  if (!Array.isArray(value)) return null;
+  const denied: string[] = [];
+  for (const entry of value) {
+    if (typeof entry === 'string' && entry.trim()) { denied.push(entry); continue; }
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return null;
+    const item = entry as Record<string, unknown>;
+    if (Object.keys(item).some((key) => key !== 'backend' && key !== 'expiresAt')
+      || typeof item.backend !== 'string' || !item.backend.trim()
+      || typeof item.expiresAt !== 'string' || !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?Z$/.test(item.expiresAt)
+      || !Number.isFinite(Date.parse(item.expiresAt)) || new Date(item.expiresAt).toISOString().slice(0, 19) !== item.expiresAt.slice(0, 19)
+      || Date.parse(item.expiresAt) <= now) return null;
+    denied.push(item.backend);
+  }
+  return denied;
+}
+
 function orderedAcpReviewFallbackBackends(configuredBackend: string | undefined, denyBackends: readonly string[] = []): {
   backends: string[];
   skipped: AcpFallbackSkip[];
@@ -1294,10 +1312,17 @@ async function runSelfReviewCliCommandPinned(
   const acpBackend = acpBackendResolution.backend;
   const requestedModel = opts.model?.trim() || undefined;
   const rawReviewDenyBackends = (getUserConfig().raw?.acp as { reviewDenyBackends?: unknown } | undefined)?.reviewDenyBackends;
-  const configuredReviewDenyBackends = Array.isArray(rawReviewDenyBackends)
-    ? rawReviewDenyBackends.filter((backend): backend is string => typeof backend === 'string')
-    : [];
-  const automaticFallbacks = orderedAcpReviewFallbackBackends(opts.configuredAcpBackend, opts.reviewDenyBackends ?? configuredReviewDenyBackends);
+  const denyCheckedAt = Date.now();
+  const configuredReviewDenyBackends = validateReviewDenyBackends(rawReviewDenyBackends, denyCheckedAt);
+  const reviewDenyBackends = validateReviewDenyBackends(opts.reviewDenyBackends, denyCheckedAt);
+  if (configuredReviewDenyBackends === null || reviewDenyBackends === null) {
+    const message = 'acp.reviewDenyBackends 설정이 유효하지 않거나 만료됐습니다 — 리뷰를 실행하지 않습니다.';
+    deps.log('review-deny-invalid', { reason: 'invalid-or-expired-review-deny-backends' }, { level: 'warn' });
+    deps.error(message);
+    return { results: opts.json ? [{ error: message }] : [], failed: 1 };
+  }
+  const automaticFallbacks = orderedAcpReviewFallbackBackends(opts.configuredAcpBackend,
+    opts.reviewDenyBackends === undefined ? configuredReviewDenyBackends : reviewDenyBackends);
   const fallbackAcpBackends = opts.acpBackend
     ? [canonicalizeBackendId(opts.acpBackend)]
     : automaticFallbacks.backends;
@@ -1632,6 +1657,7 @@ async function runSelfReviewCliCommandPinned(
     const reviewProvenance = {
       reviewRoute,
       fallbackAttempted,
+      ...(requestedModel ? { requestedModel } : {}),
       ...(fallbackBackend ? { fallbackBackend } : {}),
       ...(fallbackBackend ? { requestedModel: primaryModel, actualBackend: `acp:${fallbackBackend}` } : {}),
       ...(fallbackNotAttemptedReason ? { fallbackNotAttemptedReason } : {}),

package/src/autopilot/pr-manager.ts

@@ -17,6 +17,7 @@ import { DEFAULT_BRANCH_WORKTREE_BASE } from '../git-fs/worktree.js';
 import { isElanousRuntimeArtifactPath } from '../self-implement/gate-scope.js';
 import { isTransientExecutionFailure } from '../self-dev/execution-transient.js';
 import { withGhRestFallback } from './gh-rest-fallback.js';
+import { cellIdFromBody, guardNewPr, parseDiffHunks, readOpenPrs, recordGuardUnmeasured, type GuardVerdict, type Seat } from '../pr-tool/census.js';
 
 /** ★ stderr 캡처(대표 2026-07-21·관측 갭) — 종전엔 stdout 만 담아 git/gh 실패 사유가 소실됐다
  *  (705308: makePr 실패가 bare null 로 뭉뚱그려져 triage 가 "인증·네트워크"로 환각 오라우팅).
@@ -99,6 +100,8 @@ export interface UpsertPrInput {
   draft?: boolean;
   /** PR 라벨 — 신규 생성 시 `--label`, 재사용 시 `--add-label` 로 부착(무인 리뷰 진입 라벨이 재실행에도 유지). */
   labels?: readonly string[];
+  /** Harness caller's seat; stamped on newly created PRs for later census. */
+  seat?: Seat;
   /** 기존 PR 재사용 시 남길 코멘트(재구현 반영 안내·비평 해소). */
   reuseComment?: string;
   /**
@@ -115,7 +118,7 @@ export interface UpsertPrResult { url: string; reused: boolean }
  *  나머지 reason(add/commit/push/gh)은 진짜 실패로 detail(stderr)과 함께 관측·pr-failed. */
 export type UpsertPrOutcome =
   | { ok: true; url: string; reused: boolean; labelsApplied?: boolean; labelsOmitted?: boolean }
-  | { ok: false; reason: 'add' | 'commit' | 'base' | 'noop' | 'push' | 'gh'; detail: string };
+  | { ok: false; reason: 'add' | 'commit' | 'base' | 'noop' | 'push' | 'gh' | 'guard'; detail: string };
 
 /** 관측된 문면 두 가지:
  *    could not add label: 'auto-review' not found
@@ -312,9 +315,29 @@ function isTransientPushFailure(detail: string): boolean {
   return isTransientExecutionFailure(pushFailureMessageForTransientCheck(detail));
 }
 
+function seatFromEnvironment(): Seat | null {
+  // Production launchers stamp this in harness-pod-dispatch.ts and harness-cli-command.ts.
+  const value = process.env.ELANOUS_HARNESS_SEAT;
+  return value === 'OP' || value === 'TC' || value === 'MK' || value === 'UX' ? value : null;
+}
+
+function defaultPrCreateGuard(input: { cwd: string; base: string | undefined; seat: Seat | null; body: string }, run: CmdRunner): GuardVerdict {
+  if (!input.base) return guardNewPr({ files: null, seat: input.seat }, { status: 'unknown', reason: '비교 base 없음' });
+  const diff = run('git', ['-C', input.cwd, 'diff', '--name-only', '-z', `${input.base}...HEAD`]);
+  const files = diff.ok ? diff.out.split('\0').filter(Boolean) : null;
+  const patch = run('git', ['-C', input.cwd, 'diff', '--unified=0', `${input.base}...HEAD`]);
+  if (!patch.ok) return guardNewPr({ files: null, seat: input.seat }, { status: 'unknown', reason: `후보 수정 줄 조회 실패: ${patch.err || patch.out}` });
+  return guardNewPr({ files, seat: input.seat, cellId: cellIdFromBody(input.body), hunks: parseDiffHunks(patch.out) }, readOpenPrs(run, { cwd: input.cwd, ...(files ? { candidateFiles: files } : {}) }));
+}
+
 /** ★ PR 매니저 팩토리(대표 2026-07-12) — CmdRunner 주입(테스트 스텁). 실 배선은 기본 러너. */
-export function makePrManager(runner: CmdRunner = defaultCmdRunner): PrManager {
+export function makePrManager(
+  runner: CmdRunner = defaultCmdRunner,
+  createGuard?: (input: { cwd: string; base: string | undefined; seat: Seat | null; body: string }, run: CmdRunner) => GuardVerdict,
+  recordUnmeasured: typeof recordGuardUnmeasured = recordGuardUnmeasured,
+): PrManager {
   const run = withGhRestFallback(runner);
+  const checkCreate = createGuard ?? (runner === defaultCmdRunner ? defaultPrCreateGuard : undefined);
   const findPrForBranchOutcome = (branch: string, cwd?: string): FindPrForBranchOutcome => {
     // ⛔ 표식은 base 를 「생략했다」는 뜻이지 브랜치 이름이 아니다. 그대로 `gh --head` 로 넘기면
     //    gh 가 `no pull requests found for branch "elanous:default-branch"` 를 stderr 로 뱉는다.
@@ -499,8 +522,8 @@ export function makePrManager(runner: CmdRunner = defaultCmdRunner): PrManager {
         //   트림은 신규 경로(resolveDeliverableBase)와 동일하게 — 공백 전용 base 는 미지정으로 본다(리뷰 should-fix).
         const explicitBase = input.base?.trim();
         if (explicitBase && !isBranchSelfRef(explicitBase, input.branch)) editArgs.push('--base', prBaseFromComparison(explicitBase));
-        for (const label of input.labels ?? []) if (label.trim()) editArgs.push('--add-label', label.trim());
-        const edited = run('gh', editArgs, opts);
+        for (const label of new Set((input.labels ?? []).map(label => label.trim()).filter(Boolean))) editArgs.push('--add-label', label);
+        let edited = run('gh', editArgs, opts);
         if (!edited.ok) return { ok: false, reason: 'gh', detail: detailOf(edited) || 'gh pr edit 실패' };
         if (input.draft !== undefined) {
           // 현재 draft 상태 조회 — 조회 실패/비정상 출력은 fail-closed(요청 draft 를 적용 못했는데
@@ -522,13 +545,43 @@ export function makePrManager(runner: CmdRunner = defaultCmdRunner): PrManager {
         if (input.reuseComment) run('gh', ['pr', 'comment', existing.url, '--body', input.reuseComment], opts);
         return { ok: true, url: existing.url, reused: true };
       }
+      let guardUnmeasured = false;
+      if (checkCreate) {
+        const seat = input.seat ?? seatFromEnvironment();
+        const verdict = checkCreate({ cwd, base: comparisonBase, seat, body: input.body }, run);
+        if (verdict.status === 'unknown' && verdict.reasons.length === 1 && verdict.reasons[0]?.code === 'inventory-unknown') {
+          const inPod = process.env.ELANOUS_SUBSTRATE === 'pod'
+            || Object.keys(process.env).some(key => key.startsWith('ELANOUS_POD_'));
+          if (inPod) {
+            // Pod state and mailbox are local to this Job. Count and alert only
+            // in the host parent, where the shared instance root is authoritative.
+            debug.log('pr-tool.open-guard', 'pod-unmeasured', { seat, reason: verdict.reasons[0].detail });
+          } else {
+            const count = recordUnmeasured({ seat, reason: verdict.reasons[0].detail });
+            if (count.blocked) {
+              const alert = run('eln', ['msg', 'post', '--from', seat ?? 'HARNESS', '--to', 'OP', '--kind', 'alert', '--body', `PR open-guard 판정 불가 1시간 ${count.count}회 · 새 PR 차단 · ${count.reason ?? verdict.reasons[0].detail}`]);
+              if (!alert.ok) debug.log('pr-tool.open-guard', 'op-alert-failed', { seat, reason: alert.err || alert.out || 'eln msg post 실패' });
+              return { ok: false, reason: 'guard', detail: `inventory-unknown: 1시간 ${count.count}회 · 새 PR 차단${count.reason ? ` (${count.reason})` : ''}` };
+            }
+          }
+          guardUnmeasured = true;
+        } else if (verdict.status !== 'allow') {
+          return { ok: false, reason: 'guard', detail: verdict.reasons.map(reason => `${reason.code}: ${reason.detail}${reason.prs?.length ? ` (${reason.prs.map(number => `#${number}`).join(', ')})` : ''}`).join('; ') };
+        }
+      }
       const createArgs = ['pr', 'create', '--head', input.branch, '--title', input.title, '--body', input.body];
       if (prBase) createArgs.push('--base', prBase);
       if (input.draft) createArgs.push('--draft');
-      const requestedLabels = (input.labels ?? []).map((label) => label.trim()).filter(Boolean);
+      const seat = input.seat ?? seatFromEnvironment();
+      const requiredLabels = [...(seat ? [`seat:${seat}`] : []), ...(guardUnmeasured ? ['pr-guard:unmeasured'] : [])];
+      const requestedLabels = [...new Set([...(input.labels ?? []), ...requiredLabels].map((label) => label.trim()).filter(Boolean))];
       const labeledArgs = [...createArgs];
       for (const label of requestedLabels) labeledArgs.push('--label', label);
-      const created = run('gh', labeledArgs, opts);
+      let created = run('gh', labeledArgs, opts);
+      if (!created.ok && requiredLabels.length && isLabelNotFoundFailure(created, requiredLabels)) {
+        for (const label of requiredLabels) run('gh', ['label', 'create', label, '--color', 'BFDADC'], opts);
+        created = run('gh', labeledArgs, opts);
+      }
       if (created.ok && created.out) {
         return {
           ok: true,
@@ -538,7 +591,9 @@ export function makePrManager(runner: CmdRunner = defaultCmdRunner): PrManager {
         };
       }
       if (requestedLabels.length > 0 && isLabelNotFoundFailure(created, requestedLabels)) {
-        const retry = run('gh', createArgs, opts);
+        const retryArgs = [...createArgs];
+        for (const label of requiredLabels) retryArgs.push('--label', label);
+        const retry = run('gh', retryArgs, opts);
         if (retry.ok && retry.out) {
           debug.log('autopilot.pr-manager', 'create.labels-omitted', {
             branch: input.branch,

package/src/briefing/brief-items.ts

@@ -105,6 +105,25 @@ function needsDecision(item: BriefItem, today: string): boolean {
   return item.priority === 'P0' || (item.deadline !== null && deadlineDate(item.deadline) === today);
 }
 
+/**
+ * Reorder BRIEF_DOMAINS from already-recorded weekly action rates.
+ * Domains with total>0 sort by action rate (not raw event count).
+ * Domains with total=0 keep their relative fixed BRIEF_DOMAINS order.
+ * Missing rate data returns the default BRIEF_DOMAINS order unchanged.
+ */
+export function orderBriefDomains(actions?: BriefWeeklyActions | null): BriefDomain[] {
+  if (actions == null) return [...BRIEF_DOMAINS];
+  const byKind = actions.byKind;
+  if (!BRIEF_DOMAINS.some(domain => (byKind[domain]?.total ?? 0) > 0)) return [...BRIEF_DOMAINS];
+  return [...BRIEF_DOMAINS].sort((a, b) => {
+    const xTotal = byKind[a]?.total ?? 0;
+    const yTotal = byKind[b]?.total ?? 0;
+    const xRate = xTotal > 0 ? byKind[a]!.rate : 0;
+    const yRate = yTotal > 0 ? byKind[b]!.rate : 0;
+    return yRate - xRate || BRIEF_DOMAINS.indexOf(a) - BRIEF_DOMAINS.indexOf(b);
+  });
+}
+
 /** Unsent decisions needing immediate delivery, using the same KST deadline rule as slot pages. */
 export function pendingRealtime(items: readonly BriefItem[], now: Date): BriefItem[] {
   const today = dateKey(now, { timeZone: KST });
@@ -113,8 +132,9 @@ export function pendingRealtime(items: readonly BriefItem[], now: Date): BriefIt
 
 /**
  * One briefing page. Item text is copied verbatim.
- * Order: decisions due (P0, then a deadline of today) → domain groups →
- * duplicate claims dropped (same normalized sentence, most urgent kept).
+ * Order: decisions due (P0, then a deadline of today) → domain groups ordered
+ * by recorded weekly action rate (sampled high-rate first; zero-sample kinds
+ * keep BRIEF_DOMAINS order) → duplicate claims dropped (same normalized sentence, most urgent kept).
  */
 export function composeBriefMarkdown(items: readonly BriefItem[], slot: BriefSlot, now: Date): string {
   return composeBriefPage(items, slot, now).markdown;
@@ -124,7 +144,6 @@ export function composeBriefMarkdown(items: readonly BriefItem[], slot: BriefSlo
 export function composeBriefPage(
   items: readonly BriefItem[], slot: BriefSendSlot, now: Date,
   actions?: BriefWeeklyActions,
-  observedKinds?: ReadonlySet<BriefDomain>,
 ): { markdown: string; ids: number[] } {
   const today = dateKey(now, { timeZone: KST });
   // A duplicate left out of a delivered page stays unsent in the ledger, but must not reappear on a later page.
@@ -151,17 +170,7 @@ export function composeBriefPage(
     for (const item of decisions) lines.push(itemLine(item));
     lines.push('');
   }
-  const domains = [...BRIEF_DOMAINS];
-  // Measured action leads. An unobserved kind keeps its normal position; a sent-but-unobserved
-  // item is not evidence of being ignored. Keep every domain heading in this first slice.
-  if (actions && Object.values(actions.byKind).some(count => count.acted > 0)) {
-    domains.sort((a, b) => {
-      const x = actions.byKind[a], y = actions.byKind[b];
-      const xRate = observedKinds?.has(a) ? x.rate : 0;
-      const yRate = observedKinds?.has(b) ? y.rate : 0;
-      return yRate - xRate || BRIEF_DOMAINS.indexOf(a) - BRIEF_DOMAINS.indexOf(b);
-    });
-  }
+  const domains = orderBriefDomains(actions);
   for (const domain of domains) {
     const group = unique.filter(item => item.domain === domain && !decisionIds.has(item.id));
     if (group.length === 0) continue;
@@ -463,14 +472,7 @@ export class BriefItemsLedger {
         this.log('briefing.items', 'requirement-funnel-failed', { slot, error: error instanceof Error ? error.message : String(error) });
       }
     }
-    const since = this.weekStart(now);
-    const until = now.toISOString();
-    const observedKinds = new Set((db.query(`SELECT DISTINCT i.domain FROM items i
-      JOIN reactions r ON r.item_id = i.id
-      WHERE r.reacted_at >= ? AND r.reacted_at <= ? AND EXISTS (
-        SELECT 1 FROM sends s WHERE s.item_id = i.id AND s.sent_at >= ? AND s.sent_at <= ?
-      )`).all(since, until, since, until) as Array<{ domain: BriefDomain }>).map(row => row.domain));
-    const composed = composeBriefPage([...items, ...funnelItems], slot, now, this.weeklyActionsFromDb(db, now), observedKinds);
+    const composed = composeBriefPage([...items, ...funnelItems], slot, now, this.weeklyActionsFromDb(db, now));
     // Ephemeral funnel lines appear on the page but have no ledger row to mark sent.
     const page = { markdown: composed.markdown, ids: composed.ids.filter(id => id > 0) };
     const candidates = (slot === 'realtime' ? pendingRealtime(items, now) : items.filter(item => item.sent_at === null && beforeSlot(item.created_at, slot, now))).length;

package/src/budget/pty-usage-reemit.ts

@@ -12,6 +12,10 @@ export interface PtyUsageReemitOpts {
   readonly workdir: string;
   /** Codex session UUID observed from this child PTY; empty when unavailable (emit nothing). */
   readonly sessionId: string;
+  /** Caller-observed metadata only. Never infer a Codex account from CODEX_HOME. */
+  readonly role?: string;
+  readonly stage?: string;
+  readonly account?: string;
   /** Child start time: do not attribute older sessions in a shared CODEX_HOME to this child. */
   readonly sinceMs?: number;
   /** Override the dedup ledger location in isolated tests. */
@@ -40,6 +44,9 @@ export function reemitPtyUsage(opts: PtyUsageReemitOpts): number {
       if (Number(insert.run(home, turn.turnId).changes) === 0) continue;
       debug.log('llm.usage', 'llm-usage', {
         runId: opts.runId,
+        ...(opts.role !== undefined ? { role: opts.role } : {}),
+        ...(opts.stage !== undefined ? { stage: opts.stage } : {}),
+        ...(opts.account !== undefined ? { account: opts.account } : {}),
         substrate: 'pty',
         site: 'pty-rollup:codex',
         turnId: turn.turnId,

package/src/budget/run-usage-rollup.ts

@@ -16,6 +16,15 @@ export interface RunUsageInput {
   cost?: { kind?: string; usd?: number; apiEquivalentUsd?: number } | null;
 }
 
+/** A returned Pod raw usage row is covered only by a measured rollup from the same Job. */
+export function excludeCoveredPodRawRows<T extends { origin?: unknown; podJob?: unknown; job?: unknown; site?: unknown; measured?: unknown }>(rows: readonly T[]): T[] {
+  const rolledUpJobs = new Set(rows.flatMap((row) =>
+    typeof row.job === 'string' && row.job.length > 0
+      && typeof row.site === 'string' && row.site.startsWith('pod-rollup:')
+      && row.site !== 'pod-rollup:missing' && row.measured !== false ? [row.job] : []));
+  return rows.filter((row) => row.origin !== 'pod' || typeof row.podJob !== 'string' || !rolledUpJobs.has(row.podJob));
+}
+
 export interface RunUsageRow {
   runId: string;
   role?: string;

package/src/budget/usage-daily-store.ts

@@ -0,0 +1,98 @@
+/** Read-only UTC usage buckets from the portion of logs.db still retained. */
+import { existsSync } from 'node:fs';
+import { LogStore, logsDbPath, type LogStoreRow } from '../mss/logging/log-store.js';
+
+type Metrics = {
+  calls: number; inputTokens: number; outputTokens: number; cacheReadInputTokens: number;
+  cacheCreationInputTokens: number; reasoningOutputTokens: number; usdKnown: number;
+  unknownCostCalls: number; includedCalls: number; apiEquivalentUsd: number;
+};
+const ZERO: Metrics = { calls: 0, inputTokens: 0, outputTokens: 0, cacheReadInputTokens: 0,
+  cacheCreationInputTokens: 0, reasoningOutputTokens: 0, usdKnown: 0, unknownCostCalls: 0,
+  includedCalls: 0, apiEquivalentUsd: 0 };
+const FIELDS = Object.keys(ZERO) as Array<keyof Metrics>;
+const finite = (value: unknown): number => typeof value === 'number' && Number.isFinite(value) ? value : 0;
+const nonnegativeOr = (value: unknown, fallback: number): number =>
+  typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : fallback;
+const label = (value: unknown): string => typeof value === 'string' && value.length > 0 ? value : '(none)';
+const obj = (value: unknown): Record<string, unknown> | null => value && typeof value === 'object' && !Array.isArray(value)
+  ? value as Record<string, unknown> : null;
+
+function metrics(data: Record<string, unknown>): Metrics {
+  const cost = obj(data.cost);
+  const calls = nonnegativeOr(data.calls, 1);
+  const kind = cost?.kind;
+  return {
+    calls, inputTokens: finite(data.inputTokens), outputTokens: finite(data.outputTokens),
+    cacheReadInputTokens: finite(data.cacheReadInputTokens), cacheCreationInputTokens: finite(data.cacheCreationInputTokens),
+    reasoningOutputTokens: finite(data.reasoningOutputTokens),
+    usdKnown: kind === 'known' || kind === 'actual' || kind === 'partial' ? finite(cost?.usd) : 0,
+    unknownCostCalls: kind === 'unknown' || kind === 'partial' ? nonnegativeOr(cost?.unknownCostCalls, calls)
+      : kind === 'known' || kind === 'actual' || kind === 'included' ? 0 : calls,
+    includedCalls: kind === 'included' ? nonnegativeOr(cost?.includedCalls, calls) : finite(cost?.includedCalls),
+    apiEquivalentUsd: finite(cost?.apiEquivalentUsd),
+  };
+}
+
+function classify(row: LogStoreRow): { kind: 'host'; data: Record<string, unknown> } | { kind: 'pod' } | { kind: 'unclassified' } {
+  let data: Record<string, unknown> | null = null;
+  try { data = obj(JSON.parse(row.data ?? '')); } catch { /* unreadable payload stays unmeasured */ }
+  if (!data) return { kind: 'unclassified' };
+  if (data.origin === 'pod' || typeof data.podJob === 'string' || data.substrate === 'pod'
+    || typeof data.site === 'string' && data.site.startsWith('pod-rollup:')) return { kind: 'pod' };
+  if (data.measured === false) return { kind: 'unclassified' };
+  return { kind: 'host', data };
+}
+
+export interface DailyUsageRow extends Metrics {
+  day: string; hour: string; role: string; stage: string; account: string; model: string;
+  billingProvider: string; billing: string; site: string; hostId: string;
+}
+export interface UsageDailyRead {
+  rows: DailyUsageRow[];
+  podObservedRows: number;
+  unclassifiedRows: number;
+  sourceMaxId: number;
+}
+
+/** Query every llm.usage event in bounded pages. No database or retention writes occur. */
+export function readUsageDaily(path = logsDbPath(), sinceDay?: string): UsageDailyRead | null {
+  if (!existsSync(path)) return null;
+  const logs = LogStore.openReadOnly(path);
+  try {
+    const upper = logs.maxId();
+    const groups = new Map<string, DailyUsageRow>();
+    let afterId = 0;
+    let podObservedRows = 0;
+    let unclassifiedRows = 0;
+    const sinceMs = sinceDay === undefined ? undefined : Date.parse(`${sinceDay}T00:00:00Z`);
+    while (afterId < upper) {
+      const page = logs.query({ exactCategories: ['llm.usage'], sinceMs, afterId, limit: 1000 });
+      if (!page.length) break;
+      for (const row of page) {
+        if (row.id > upper) break;
+        const classified = classify(row);
+        if (classified.kind === 'pod') { podObservedRows++; continue; }
+        if (classified.kind === 'unclassified') { unclassifiedRows++; continue; }
+        const { data } = classified;
+        const hour = new Date(row.ts_ms).toISOString().slice(0, 13);
+        const day = hour.slice(0, 10);
+        const dimensions = [label(data.role), label(data.stage), label(data.account), label(data.model),
+          label(data.billingProvider ?? data.provider), label(data.billing), label(data.site), label(data.hostId ?? row.host_id)];
+        const key = JSON.stringify([hour, ...dimensions]);
+        let value = groups.get(key);
+        if (!value) {
+          const [role, stage, account, model, billingProvider, billing, site, hostId] = dimensions;
+          value = { day, hour, role: role!, stage: stage!, account: account!, model: model!, billingProvider: billingProvider!,
+            billing: billing!, site: site!, hostId: hostId!, ...ZERO };
+          groups.set(key, value);
+        }
+        const delta = metrics(data);
+        for (const field of FIELDS) value[field] += delta[field];
+      }
+      afterId = page.at(-1)!.id;
+    }
+    return { rows: [...groups.values()].sort((a, b) => a.hour.localeCompare(b.hour)),
+      podObservedRows, unclassifiedRows, sourceMaxId: upper };
+  } finally { logs.close(); }
+}