elanous 0.2.29 → 0.2.32

package/src/harness/gate-reserve.ts

@@ -0,0 +1,87 @@
+import { execFile } from 'node:child_process';
+import { promises as fs } from 'node:fs';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+import { releaseLedgerRoot } from '../instance/resolve.js';
+import type { QueueSeat } from './harness-queue.js';
+
+/** Shadow calculation only: reserve one of the configured per-seat gate slots while the release gate runs. */
+export function gateReserve({ releaseGateActive, seat, configuredGateCap }: {
+  releaseGateActive: boolean; seat: QueueSeat; configuredGateCap: number;
+}): { active: boolean; wouldCap: number } {
+  void seat;
+  return { active: releaseGateActive, wouldCap: releaseGateActive ? Math.max(0, configuredGateCap - 1) : configuredGateCap };
+}
+
+const execFileAsync = promisify(execFile);
+const MAX_LEDGER_READS = 32;
+const MAX_PROBE_MS = 1_500;
+
+/** Read-only, bounded process and graph-run probe; unavailable or incomplete observation is inactive. */
+export async function detectReleaseGateActive(deps: {
+  processes?: () => string | Promise<string>;
+  runsRoot?: string;
+  read?: (path: string) => string | Promise<string>;
+  list?: (path: string) => string[] | Promise<string[]>;
+  modifiedAt?: (path: string) => number | Promise<number>;
+  /** Test seam for the shared probe deadline; production defaults to 1.5 seconds. */
+  timeoutMs?: number;
+} = {}): Promise<boolean> {
+  const controller = new AbortController();
+  const timeoutMs = deps.timeoutMs ?? MAX_PROBE_MS;
+  const deadline = Date.now() + timeoutMs;
+  let timeoutId: ReturnType<typeof setTimeout> | undefined;
+  const timeout = new Promise<never>((_, reject) => {
+    timeoutId = setTimeout(() => {
+      controller.abort();
+      reject(new Error('release gate observation timed out'));
+    }, timeoutMs);
+  });
+  const bounded = <T>(operation: T | Promise<T>): Promise<T> => Promise.race([Promise.resolve(operation), timeout]);
+  try {
+    const argv = await bounded((deps.processes ?? (async () => {
+      const result = await execFileAsync('ps', ['-eo', 'pid=,args='],
+        { encoding: 'utf8', timeout: 1_000, maxBuffer: 4 * 1024 * 1024, signal: controller.signal });
+      return result.stdout;
+    }))());
+    if (Date.now() >= deadline) return false;
+    const pids = new Set(argv.split('\n').flatMap((line) => {
+      const match = /^\s*(\d+)\s+(.+)$/.exec(line);
+      // Same release run/resume argv fingerprint as RAIL-SAFE, bound here to the graph-run owner's PID.
+      return match && /(?:^|\s)(?:\S*\/)?elanous\.mjs\s+(?:(?:--test(?:=\S+)?|--config-dir\s+\S+)\s+)*release\s+(?:run|resume)(?=\s|$)/.test(match[2]!)
+        ? [Number(match[1])] : [];
+    }));
+    if (!pids.size) return false;
+    const dir = join(deps.runsRoot ?? releaseLedgerRoot(), 'graph-runs', 'release-loop');
+    let files: string[];
+    try { files = await bounded(deps.list ? deps.list(dir) : fs.readdir(dir)); }
+    catch (error) { if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false; throw error; }
+    // Inspect metadata for every ledger before choosing the newest: directory order is not recency.
+    // A slow or huge directory expires the common deadline, then fails open without scanning further.
+    const candidates = files.filter((file) => /^[A-Za-z0-9][A-Za-z0-9._-]*\.json$/.test(file));
+    const modifiedAt = deps.modifiedAt ?? (async (path: string) => (await fs.stat(path)).mtimeMs);
+    const recent: { file: string; at: number }[] = [];
+    for (let offset = 0; offset < candidates.length && Date.now() < deadline; offset += 32) {
+      const batch = candidates.slice(offset, offset + 32);
+      const times = await bounded(Promise.all(batch.map(async (file) => {
+        try { return await modifiedAt(join(dir, file)); } catch { return -1; }
+      })));
+      for (let i = 0; i < batch.length; i++) if (times[i]! >= 0) recent.push({ file: batch[i]!, at: times[i]! });
+    }
+    recent.sort((a, b) => b.at - a.at);
+    for (const { file } of recent.slice(0, MAX_LEDGER_READS)) {
+      if (Date.now() >= deadline) return false;
+      let run: {
+        pid?: number; status?: string; currentNode?: { nodeId: string }; path?: string[]; nodes?: { nodeId: string; ok: boolean }[];
+      };
+      try { run = JSON.parse(await bounded((deps.read ?? ((path: string) => fs.readFile(path,
+        { encoding: 'utf8', signal: controller.signal })))(join(dir, file)))) as typeof run; }
+      catch { continue; }
+      if (run?.status === 'running' && run.pid && pids.has(run.pid)
+        && run.currentNode?.nodeId === 'gate' && run.path?.at(-1) === 'gate'
+        && Array.isArray(run.nodes) && run.path.length === run.nodes.length + 1) return true;
+    }
+    return false;
+  } catch { return false; }
+  finally { clearTimeout(timeoutId); controller.abort(); }
+}

package/src/harness/harness-clean.ts

@@ -5,6 +5,7 @@
 // planHarnessClean = 순수 분류(테스트). execHarnessClean = git/gh IO + 실제 제거.
 
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
 import { existsSync, readdirSync, statSync } from 'node:fs';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { listPtyManifest, type PtyManifestRow } from '../pty-shell/pty-manifest.js';
@@ -466,7 +467,7 @@ export type { GitRunner, GitRunResult } from '../git-fs/retry.js';
 
 const defaultGitRunner: GitRunner = (args) => {
   // git-spawn-allow: This is the injected low-level runner consumed by direct runGitWithRetry callers; routing it through runGitCommand would recurse through the retry seam.
-  const r = spawnSync('git', args, { encoding: 'utf8', timeout: 20_000 });
+  const r = spawnSync('git', args, { encoding: 'utf8', timeout: 20_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? '' };
 };
 

package/src/harness/harness-cli-command.ts

@@ -15,7 +15,7 @@ import { stateDirSourceForChild } from '../agent/identity-env.js';
 import { lookupGoal, type GoalLookupOptions, type GoalLookupResult } from '../self-implement/goal-lookup.js';
 import { archiveGoals, type GoalArchiveOptions } from '../self-implement/goal-archive.js';
 import { detectBursts, formatIncidentBurstWarning, incidentLastLines, readRunExits, recentBurst, recordRunExit } from './harness-incidents.js';
-import { Command, Option } from 'commander';
+import { Command, InvalidArgumentError, Option } from 'commander';
 import { runGitCommand } from '../git-fs/runner.js';
 import { GOAL_TYPES, lintGoalFile, parseGoalId, parseGoalType, resolveGoalAuthorGrade, tracedPathReferences, type GoalAuthorGrade, type GoalAuthorGradeSelection, type GoalType } from '../self-implement/goal-author.js';
 import { templateForGoalType } from '../self-implement/graph-templates.js';
@@ -132,6 +132,8 @@ export interface HarnessAskSayOptions {
   /** Depth 0 only. At depth >= 1 this flag is ignored and the launch stays refused. */
   nestedElanous?: 'allow';
   queue?: boolean;
+  /** RUN-IDENTITY — 태스크 카드 신분이 대기열 줄 우선순위로 옮겨온 값(승인·선점이 신분을 읽는다 · 칸 러브릭보다 위). */
+  runPriority?: number;
 }
 
 export interface ResolvedHarnessSupervisor {
@@ -294,6 +296,11 @@ function registerHarnessAskSayOptions(command: Command): Command {
     .option('--correlation <id>', '요청과 런을 잇는 불투명 correlation 값')
     .addOption(new Option('--seat <seat>', '런 귀속 자리 (OP|TC|MK|UX)').choices(['OP', 'TC', 'MK', 'UX']))
     .option('--no-queue', '비상시 자리별 대기열을 건너뛰고 직접 발사')
+    .option('--run-priority <n>', 'RUN-IDENTITY — 태스크 카드 신분이 대기열 줄 우선순위로 옮겨온 값(승인·선점이 신분을 읽는다 · 칸 러브릭보다 위)', (value: string) => {
+      const n = Number(value);
+      if (!Number.isFinite(n)) throw new InvalidArgumentError('유한한 숫자여야 한다');
+      return n;
+    })
     .addOption(new Option('--goal-type <type>', `골 종류 (${GOAL_TYPES.join('|')})`).choices([...GOAL_TYPES]))
     .option('--force-preflight', '전제 검사 막힘을 명시 요청으로 우회(관측에 남음)')
     .option('--force-gate', '같은 골 실행 중 막힘을 명시 요청으로 우회(관측에 남음; 예산 막힘은 우회 불가)')
@@ -371,6 +378,7 @@ function normalizeHarnessAskSayOptions(opts: HarnessAskSayChildLlmOptions): Harn
     ...(opts.target !== undefined ? { target: opts.target } : {}),
     ...(opts.correlation !== undefined ? { correlation: opts.correlation } : {}),
     ...(opts.forcePreflight === true ? { forcePreflight: true } : {}),
+    ...(opts.runPriority !== undefined ? { runPriority: opts.runPriority } : {}),
     ...(opts.childLlmProvider !== undefined ? { childLlmProvider: opts.childLlmProvider } : {}),
     ...(opts.childLlmModel !== undefined ? { childLlmModel: opts.childLlmModel } : {}),
     // ⛔⭐⭐ 🩸 2026-09-12 — ***이 줄이 «없어서» `--child-llm-effort` 가 조용히 삼켜졌다.***
@@ -408,7 +416,7 @@ function resolveLaunchSubstrate(opts: HarnessSubstrateOpts): ResolvedHarnessSubs
   return resolved;
 }
 type PodExit = { status: number | null; signal?: string | null };
-type PodExitReason = 'signal' | 'human-stop' | 'supervisor' | 'no-launch' | 'unknown'
+type PodExitReason = 'signal' | 'human-stop' | 'supervisor' | 'no-launch' | 'unknown' | 'preflight-refused'
   | 'pod-error' | 'launch-gate-blocked' | 'ENOBUFS' | 'OOMKilled';
 
 function unknownPodExitTailReason(output: string): PodExitReason | undefined {
@@ -442,6 +450,28 @@ export function classifyHarnessPodExit(
     runId?: string;
   } = {},
 ): { lines: string[]; reason: PodExitReason | 'pod-failure' } {
+  const occupiedNewLine = output.split('\n').find((line) =>
+    /^\[self-dev\] run run-[a-z0-9_-]{8,64} \[preflight:new-path-occupied:[0-9a-f-]{36}\] /.test(line));
+  const observedRunId = deps.runId ?? harnessPodRunId(output);
+  const preflightRunId = occupiedNewLine ? harnessPodRunId(occupiedNewLine) : undefined;
+  const preflightAttemptId = occupiedNewLine?.match(/\[preflight:new-path-occupied:([0-9a-f-]{36})\]/)?.[1];
+  const preflightPath = occupiedNewLine?.match(/신설 traced path 가 이미 점유됨: (.+) — 골의 신설: 경로를 바로잡아야 한다$/)?.[1];
+  let preflightReceipt = false;
+  if (exit.status === 2 && !exit.signal && occupiedNewLine && preflightRunId && preflightRunId === observedRunId && preflightPath && preflightAttemptId) {
+    try {
+      const entries = (deps.loadLedger ?? loadRunLedger)(preflightRunId) ?? [];
+      const receiptIndex = entries.findIndex((entry) => entry.runId === preflightRunId && entry.event === 'preflight-refused'
+        && entry.data.kind === 'occupied-new-traced-path' && entry.data.path === preflightPath
+        && entry.data.attemptId === preflightAttemptId);
+      preflightReceipt = receiptIndex >= 0 && !entries.slice(receiptIndex + 1).some((entry) => LAUNCH_EVIDENCE_EVENTS.has(entry.event));
+    } catch { /* Unreadable run evidence cannot establish a host refusal. */ }
+  }
+  if (preflightReceipt && occupiedNewLine) {
+    const runId = preflightRunId;
+    try { debug.log('harness.pod', 'exit-classified', { runId, reason: 'preflight-refused', status: exit.status, signal: exit.signal ?? null }); }
+    catch { /* observation is fail-soft */ }
+    return { reason: 'preflight-refused', lines: [occupiedNewLine] };
+  }
   let podFailure: string | undefined;
   let podJobFailed = false;
   let podChildFailed = false;
@@ -470,7 +500,6 @@ export function classifyHarnessPodExit(
     podChildFailed = summary?.includes(' — pod-child-failed: ') ?? false;
   }
   // Only the run announced at launch — another run id quoted in the output is not this run (review round 3).
-  const observedRunId = deps.runId ?? harnessPodRunId(output);
   const runId = observedRunId ? normalizeRunId(observedRunId) : undefined;
   if (podFailure) {
     const childError = podJobFailed ? podFailure.split('childError=')[1]?.split('\\n', 1)[0]?.split('\n', 1)[0] : undefined;
@@ -726,6 +755,15 @@ export function recordHarnessPodStop(
   try {
     if (runStopRecorded(runId)) return false;
     if ((deps.loadLedger ?? loadRunLedger)(runId)?.some((entry) => entry.event === RUN_STOP_EVENT)) return false;
+    if (classified.reason === 'preflight-refused') {
+      (deps.record ?? recordRunStop)({
+        runId, site: 'preflight', class: 'launch-failed',
+        cause: 'Preflight refused: occupied new traced path',
+        evidenceRef: `run-ledger:${runId}:preflight-refused`,
+        nextMove: 'Correct the declared new path in the goal before relaunch',
+      }, ...(deps.write ? [deps.write] : []));
+      return true;
+    }
     const nextMove = classified.reason === 'no-launch' ? 'Check Pod launch gate and pool, then relaunch'
       : 'Inspect Pod exit classification and harvest the branch before relaunch';
     const evidenceRef = `logs:harness.pod/exit-classified:${runId}`;
@@ -943,6 +981,8 @@ async function dispatchHarnessAskSay(
         ['--child-llm-model', opts.childLlmModel], ['--child-llm-effort', opts.childLlmEffort],
         ['--pod-pool', (opts as HarnessSubstrateOpts).podPool], ['--pod-memory', (opts as HarnessSubstrateOpts).podMemory],
         ['--after', (opts as HarnessSubstrateOpts).after], ['--source', (opts as HarnessSubstrateOpts).source], ['--repair-commit-only', (opts as HarnessSubstrateOpts).repairCommitOnly],
+        // RUN-IDENTITY — 신분이 줄 우선순위로 흐른다(승인·선점이 읽는다 · 대기열 자식이 다시 상속).
+        ['--run-priority', opts.runPriority !== undefined ? String(opts.runPriority) : undefined],
       ];
       for (const [flag, value] of values) if (value !== undefined) flags.push(flag, value);
       if ((opts as HarnessSubstrateOpts).source !== undefined && resolved.substrate !== 'pod') {
@@ -967,6 +1007,7 @@ async function dispatchHarnessAskSay(
       try {
         row = await addHarnessQueue({ seat: stampedSeat, launchCwd: process.cwd(), refuseDuplicate: true,
         ...(dryRunPreview.goalPath ? { ask: dryRunPreview.goalPath } : { say: dryRunPreview.input }),
+        ...(opts.runPriority !== undefined ? { runPriority: opts.runPriority } : {}),
         launchArgs: ['harness', dryRunPreview.goalPath ? 'ask' : 'say', dryRunPreview.goalPath ?? dryRunPreview.input,
           '--seat', stampedSeat, ...((opts as HarnessSubstrateOpts).substrate ? ['--substrate', (opts as HarnessSubstrateOpts).substrate!] : []), ...flags,
           ...(opts.nestedElanous ? ['--nested-elanous', opts.nestedElanous] : [])],
@@ -982,7 +1023,11 @@ async function dispatchHarnessAskSay(
         process.exitCode = 1;
         return;
       }
-      const result = await withJourneyNode('queue', journey, () => tickHarnessQueue({ ...queueDeps, ...(immediateLaunch ? { launch: immediateLaunch } : {}) }, row.id));
+      // NEEDS-OWNER-BOUNDARY (direct say/ask): the immediate-launch tick stays ungated — a person-initiated
+      // command answers itself, so pre-hold launch behavior is preserved. An embedder can still opt in via
+      // deps.queue.needsOwnerGate.
+      const result = await withJourneyNode('queue', journey, () => tickHarnessQueue(
+        { ...queueDeps, ...(immediateLaunch ? { launch: immediateLaunch } : {}), needsOwnerGate: queueDeps?.needsOwnerGate ?? false }, row.id));
       exitJourneyNode('queue', { ...journey, outcome: result.outcome === 'launched' && result.item?.id === row.id ? 'launched' : 'waiting', data: { queueItemId: row.id, queueTick: result.outcome } });
       if (result.outcome === 'launched' && result.item?.id === row.id) {
         if (immediateExit) process.exitCode = await immediateExit();
@@ -3336,7 +3381,9 @@ export function installHarnessCliCommand(program: Command, deps: HarnessCliComma
     console.log(`${id} ${await reconcileHarnessQueue(id, queueDeps)}`);
   }));
   queue.command('tick').description('자리별 맨 앞 항목을 라운드로빈으로 돌며 자리 몫·Pod 풀 여유·마무리 관문을 확인하고 발사 — 여유가 있으면 한 tick 에 여러 건(30초 간격 · harness.queue.burstMax 기본 5)').action(() => queueAction(async () => {
-    const result = await tickHarnessQueue(queueDeps);
+    // NEEDS-OWNER-BOUNDARY (queue tick = autonomous): the needs-owner hold defaults ON here — this is
+    // the cron surface. The census runs once per tick and is shared across every candidate seat.
+    const result = await tickHarnessQueue({ ...queueDeps, needsOwnerGate: queueDeps.needsOwnerGate ?? true });
     console.log(`${result.outcome}${result.item ? ` ${result.item.id}` : ''}: ${result.reason}`);
     // QUEUE-BURST: the first line stays as before; every further launch of the burst gets its own line.
     for (const row of result.launched?.slice(1) ?? []) console.log(`launched ${row.id}: spawned`);

package/src/harness/harness-gc.ts

@@ -1,4 +1,5 @@
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
 import { mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
 import { debug } from '../debug/log.js';
@@ -104,7 +105,7 @@ export function discoverHarnessGcRepos(root: string, expired: () => boolean = ()
 }
 
 function defaultRun(args: string[]) {
-  const result = spawnSync('git', args, { encoding: 'utf8', timeout: 20_000 });
+  const result = spawnSync('git', args, { encoding: 'utf8', timeout: 20_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
 }
 

package/src/harness/harness-incidents.ts

@@ -26,6 +26,7 @@ export interface IncidentBurst {
   runIds: string[];
   entrance?: string;
   seat?: string;
+  hostname?: string;
 }
 
 /** Scrub before bounding: a token crossing the 200-character boundary must not leak. */
@@ -111,33 +112,82 @@ export function recordRunExit(row: RunExit, root: string): void {
   }
 }
 
-/** Non-overlapping, maximal same-reason/seat/entrance windows; no run contributes to two bursts. */
-export function detectBursts(rows: readonly RunExit[], { windowMs = 60_000, threshold = 3 }: {
-  windowMs?: number; threshold?: number;
-} = {}): IncidentBurst[] {
-  const bursts: IncidentBurst[] = [];
-  const byIdentity = new Map<string, RunExit[]>();
+const HOSTNAME_BURST_WINDOW_MS = 60 * 60_000;
+
+function uniqueRunExits(rows: readonly RunExit[]): RunExit[] {
+  const unique: RunExit[] = [];
   const seen = new Set<string>();
   for (const row of rows) {
     if (!row.runId || seen.has(row.runId) || !Number.isFinite(Date.parse(row.at))) continue;
     seen.add(row.runId);
-    const key = JSON.stringify([row.reason, row.seat ?? null, row.entrance ?? null]);
+    unique.push(row);
+  }
+  return unique;
+}
+
+function groupRunExits(rows: readonly RunExit[], keyOf: (row: RunExit) => string): RunExit[][] {
+  const byIdentity = new Map<string, RunExit[]>();
+  for (const row of rows) {
+    const key = keyOf(row);
     const group = byIdentity.get(key) ?? [];
     group.push(row);
     byIdentity.set(key, group);
   }
-  for (const group of byIdentity.values()) {
-    const { reason, seat, entrance } = group[0]!;
-    group.sort((a, b) => Date.parse(a.at) - Date.parse(b.at) || a.runId.localeCompare(b.runId));
-    for (let start = 0; start < group.length;) {
-      let end = start + 1;
-      while (end < group.length && Date.parse(group[end]!.at) - Date.parse(group[start]!.at) <= windowMs) end++;
-      if (end - start < threshold) { start++; continue; }
-      const members = group.slice(start, end);
-      bursts.push({ reason, count: members.length, firstAt: members[0]!.at,
-        lastAt: members[members.length - 1]!.at, runIds: members.map((row) => row.runId),
-        ...(seat ? { seat } : {}), ...(entrance ? { entrance } : {}) });
-      start = end;
+  return [...byIdentity.values()];
+}
+
+function burstMemberWindows(group: RunExit[], windowMs: number, threshold: number): RunExit[][] {
+  const sorted = group.slice().sort((a, b) => Date.parse(a.at) - Date.parse(b.at) || a.runId.localeCompare(b.runId));
+  const windows: RunExit[][] = [];
+  for (let start = 0; start < sorted.length;) {
+    let end = start + 1;
+    while (end < sorted.length && Date.parse(sorted[end]!.at) - Date.parse(sorted[start]!.at) <= windowMs) end++;
+    if (end - start < threshold) { start++; continue; }
+    windows.push(sorted.slice(start, end));
+    start = end;
+  }
+  return windows;
+}
+
+function burstFromMembers(members: RunExit[], extra: Pick<IncidentBurst, 'seat' | 'entrance' | 'hostname'>): IncidentBurst {
+  return {
+    reason: members[0]!.reason, count: members.length, firstAt: members[0]!.at,
+    lastAt: members[members.length - 1]!.at, runIds: members.map((row) => row.runId),
+    ...(extra.seat ? { seat: extra.seat } : {}),
+    ...(extra.entrance ? { entrance: extra.entrance } : {}),
+    ...(extra.hostname ? { hostname: extra.hostname } : {}),
+  };
+}
+
+/** Non-overlapping windows within each identity; seat and host are independent views of an exit. */
+export function detectBursts(rows: readonly RunExit[], { windowMs = 60_000, threshold = 3 }: {
+  windowMs?: number; threshold?: number;
+} = {}): IncidentBurst[] {
+  const unique = uniqueRunExits(rows);
+  const bursts: IncidentBurst[] = [];
+  for (const group of groupRunExits(unique, (row) => JSON.stringify([row.reason, row.seat ?? null, row.entrance ?? null]))) {
+    const { seat, entrance } = group[0]!;
+    for (const members of burstMemberWindows(group, windowMs, threshold)) {
+      bursts.push(burstFromMembers(members, { ...(seat ? { seat } : {}), ...(entrance ? { entrance } : {}) }));
+    }
+  }
+  for (const group of groupRunExits(unique.filter((row) => row.hostname), (row) => JSON.stringify([row.reason, row.hostname]))) {
+    const hostname = group[0]!.hostname;
+    for (const members of burstMemberWindows(group, HOSTNAME_BURST_WINDOW_MS, 3)) {
+      bursts.push(burstFromMembers(members, { ...(hostname ? { hostname } : {}) }));
+    }
+  }
+  return bursts.sort((a, b) => Date.parse(a.firstAt) - Date.parse(b.firstAt) || a.reason.localeCompare(b.reason));
+}
+
+/** Common-cause candidates: same hostname+reason exits within a 60-minute window, across seats and entrances; hostless rows stay unobserved. */
+export function detectCommonCauseBursts(rows: readonly RunExit[]): IncidentBurst[] {
+  const unique = uniqueRunExits(rows).filter((row) => row.hostname);
+  const bursts: IncidentBurst[] = [];
+  for (const group of groupRunExits(unique, (row) => JSON.stringify([row.reason, row.hostname]))) {
+    const hostname = group[0]!.hostname;
+    for (const members of burstMemberWindows(group, HOSTNAME_BURST_WINDOW_MS, 3)) {
+      bursts.push(burstFromMembers(members, { ...(hostname ? { hostname } : {}) }));
     }
   }
   return bursts.sort((a, b) => Date.parse(a.firstAt) - Date.parse(b.firstAt) || a.reason.localeCompare(b.reason));
@@ -149,7 +199,7 @@ export function recentBurst(root: string, now: Date | number, { lookbackMs = 15
   const time = typeof now === 'number' ? now : now.getTime();
   const recent = detectBursts(readRunExits(root)).filter((burst) => {
     const last = Date.parse(burst.lastAt);
-    return last <= time && last >= time - lookbackMs
+    return !burst.hostname && last <= time && last >= time - lookbackMs
       && burst.seat === seat && burst.entrance === entrance;
   });
   return recent.sort((a, b) => Date.parse(a.lastAt) - Date.parse(b.lastAt)).at(-1) ?? null;

package/src/harness/harness-pod-dispatch.ts

@@ -13,17 +13,20 @@ import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSy
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { selfDevRunsDir } from '../self-dev/run-store.js';
 import { findGitDir } from '../git-fs/locate.js';
+import { runGitCommand } from '../git-fs/runner.js';
 import { logsDbPath } from '../mss/logging/log-store.js';
 import { POD_REEMIT_LOGS_DB_ENV } from '../task-orchestrator/surfaces/pod-ledger-prod-sink.js';
 import { debug } from '../debug/log.js';
 import { ELANOUS_ENTRY_SCRIPT } from '../self-implement/seams.js';
 import { parsePodSourceSpec } from '../task-orchestrator/surfaces/pod-source-spec.js';
-import { declaredGoalType, type GoalType } from '../self-implement/goal-author.js';
+import { declaredGoalType, extractVerbatimOriginalAsk, tracedPathReferences, type GoalType } from '../self-implement/goal-author.js';
+import { declaredNewFilePaths } from '../self-implement/goal-new-paths.js';
 import { appendRunLedgerEntry } from '../self-implement/run-ledger.js';
 import { HARNESS_RUN_ID_ENV } from './harness-space.js';
 import { podMemoryLimitFor, type PodMemoryTier } from '../task-orchestrator/surfaces/self-implement-pod.js';
 import { oldDoorInternalEnv } from '../self-dev/old-door.js';
 import { selectPodMemoryTier } from './pod-memory-policy.js';
+import { preflightGoalDoneBoundary } from '../self-dev/dev-pipeline.js';
 
 export interface HarnessPodDispatchInput {
   readonly entrance: 'cli-harness-ask' | 'cli-harness-say';
@@ -73,7 +76,24 @@ export function podOrchestrateArgs(input: HarnessPodDispatchInput, goalFile: str
   ];
 }
 
-type PodDispatchDeps = { run?: (cmd: string, args: readonly string[], env: NodeJS.ProcessEnv) => number | null; readFile?: (path: string) => string; cwd?: string; spawnChild?: typeof spawn; onOutput?: (text: string) => void };
+type PodDispatchDeps = { run?: (cmd: string, args: readonly string[], env: NodeJS.ProcessEnv) => number | null; readFile?: (path: string) => string; cwd?: string; spawnChild?: typeof spawn; onOutput?: (text: string) => void; recordRunLedgerEntry?: typeof appendRunLedgerEntry; nowMs?: number };
+
+/** Default Pod source clones origin HEAD. Never infer its file occupation from an unrelated worktree. */
+function defaultPodSourceHeadAt(root: string): string | undefined {
+  const localResult = runGitCommand(root, ['rev-parse', 'HEAD'], { encoding: 'utf8', timeout: 5_000 });
+  if (localResult.status !== 0 || localResult.signal) return undefined;
+  const local = localResult.stdout.trim();
+  const remoteResult = runGitCommand(root, ['ls-remote', 'origin', 'HEAD'], { encoding: 'utf8', timeout: 5_000 });
+  if (remoteResult.status !== 0 || remoteResult.signal) return undefined;
+  const remote = remoteResult.stdout.trim().split(/\s+/, 1)[0];
+  return /^[0-9a-f]{40}$/.test(remote ?? '') && remote === local ? local : undefined;
+}
+
+function occupiedInTree(root: string, head: string, path: string): boolean | undefined {
+  const result = runGitCommand(root, ['ls-tree', head, '--', path], { encoding: 'utf8', timeout: 5_000 });
+  if (result.status !== 0 || result.signal) return undefined;
+  return result.stdout.trim() !== '';
+}
 
 export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDispatchDeps & { run: NonNullable<PodDispatchDeps['run']> }): number;
 export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps?: PodDispatchDeps): number | Promise<number>;
@@ -111,13 +131,6 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
     tempDir = mkdtempSync(join(runsDir, 'pod-author-'));
     goalFile = join(tempDir, 'sentence.txt');
     writeFileSync(goalFile, input.input, { mode: 0o600 });
-    const runId = env[HARNESS_RUN_ID_ENV]?.trim() || `run-${randomUUID()}`;
-    env[HARNESS_RUN_ID_ENV] = runId;
-    const receipt = { entrance: input.entrance, host: hostname(), runId, authorOnPod: true,
-      sentenceChars: input.input.length, sentenceSha256: createHash('sha256').update(input.input).digest('hex') };
-    debug.log('harness.substrate', 'author-on-pod-receipt', receipt);
-    try { appendRunLedgerEntry({ runId, event: 'author-on-pod-receipt', data: receipt }); }
-    catch (error) { debug.log('harness.substrate', 'author-on-pod-receipt-unwritten', { reason: error instanceof Error ? error.message : String(error) }); }
   } else {
     const goal = input.input;
     goalText = goal;
@@ -127,8 +140,72 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
     goalFile = join(tempDir, 'goal.txt');
     writeFileSync(goalFile, goal, { mode: 0o600 });
   }
+  let pinnedDefaultSource: string | undefined;
+  // AUTHOR-NEW-FILE-PATHS: when the Pod will use this very repository tree, reject a
+  // deterministically occupied new path before creating a Job. A different --source or
+  // --base can have different files; the Pod remains responsible for those cases.
+  if (!input.source && !input.base && input.entrance === 'cli-harness-ask') {
+    const declaration = extractVerbatimOriginalAsk(goalText)?.ask ?? '';
+    const newPaths = declaredNewFilePaths(declaration);
+    const traced = new Set(tracedPathReferences(goalText).map(({ path }) => path.replace(/^\.\//, '')));
+    const candidates = newPaths.filter((path) => traced.has(path));
+    const repositoryRoot = candidates.length > 0 ? findGitDir(cwd)?.root : undefined;
+    const defaultSourceHead = repositoryRoot ? defaultPodSourceHeadAt(repositoryRoot) : undefined;
+    if (candidates.length > 0 && !defaultSourceHead) {
+      debug.log('harness.substrate', 'new-path-preflight-unmeasured', {
+        entrance: input.entrance, reason: 'default-source-head-unverified', candidateCount: candidates.length,
+      });
+    }
+    // The preflight checks this exact tree, so pin the Pod job to the same commit.
+    // Otherwise origin/HEAD could move between this check and the Job's clone.
+    if (candidates.length > 0 && defaultSourceHead) pinnedDefaultSource = `commit:${defaultSourceHead}`;
+    for (const path of candidates) {
+      if (!repositoryRoot || !defaultSourceHead) break; // Unmeasured source parity is never a refusal.
+      const occupied = occupiedInTree(repositoryRoot, defaultSourceHead, path);
+      if (occupied === undefined) {
+        debug.log('harness.substrate', 'new-path-preflight-unmeasured', {
+          entrance: input.entrance, reason: 'default-source-tree-query-failed', candidate: path,
+        });
+        continue;
+      }
+      if (!occupied) continue;
+      const runId = env[HARNESS_RUN_ID_ENV]?.trim() || `run-${randomUUID()}`;
+      const attemptId = randomUUID();
+      const line = `[self-dev] run ${runId} [preflight:new-path-occupied:${attemptId}] 신설 traced path 가 이미 점유됨: ${path} — 골의 신설: 경로를 바로잡아야 한다\n`;
+      try {
+        (deps.recordRunLedgerEntry ?? appendRunLedgerEntry)({ runId, event: 'preflight-refused', data: { kind: 'occupied-new-traced-path', path, entrance: input.entrance, sourceHead: defaultSourceHead, attemptId } });
+      } catch (error) {
+        debug.log('harness.substrate', 'preflight-receipt-unwritten', { reason: String(error) });
+        break; // Without the host receipt, let Pod-side validation decide instead of claiming a host refusal.
+      }
+      deps.onOutput?.(line);
+      if (!deps.onOutput) process.stderr.write(line);
+      if (tempDir) rmSync(tempDir, { recursive: true, force: true });
+      return 2;
+    }
+  }
+  if (input.authorOnPod && input.entrance === 'cli-harness-say') {
+    const runId = env[HARNESS_RUN_ID_ENV]?.trim() || `run-${randomUUID()}`;
+    env[HARNESS_RUN_ID_ENV] = runId;
+    const receipt = { entrance: input.entrance, host: hostname(), runId, authorOnPod: true,
+      sentenceChars: input.input.length, sentenceSha256: createHash('sha256').update(input.input).digest('hex') };
+    debug.log('harness.substrate', 'author-on-pod-receipt', receipt);
+    try { (deps.recordRunLedgerEntry ?? appendRunLedgerEntry)({ runId, event: 'author-on-pod-receipt', data: receipt }); }
+    catch (error) { debug.log('harness.substrate', 'author-on-pod-receipt-unwritten', { reason: error instanceof Error ? error.message : String(error) }); }
+  }
+  // This is the common host-side Pod launch boundary for harness ask/say and
+  // dev ask. A say sentence is the source request; an ask file is the GOAL.
+  // Check before the orchestrator child can place or create a Pod Job.
+  try {
+    preflightGoalDoneBoundary({ file: goalFile }, goalText, env.ELANOUS_TASK_CARD_ID, input.entrance,
+      input.entrance === 'cli-harness-say' ? 'request' : 'goal', deps.nowMs ?? Date.now());
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    if (tempDir) rmSync(tempDir, { recursive: true, force: true });
+    return 2;
+  }
   const goalChars = goalText.length;
-  const args = podOrchestrateArgs(input, goalFile);
+  const args = podOrchestrateArgs(pinnedDefaultSource ? { ...input, source: pinnedDefaultSource } : input, goalFile);
   debug.log('harness.substrate', 'goal-file', { entrance: input.entrance, mode: tempDir ? 'temp' : 'path' });
   const goalType = input.goalType ?? declaredGoalType(goalText);
   // A process-level memory tier is already an explicit selection; do not replace it with a goal-type default.