elanous 0.2.29 → 0.2.32

package/src/harness/harness-queue.ts

@@ -21,8 +21,10 @@ import { hostLeaseCounts, leaseHasPendingPod } from '../pod-lease/host-lease.js'
 import { leaseKubectl, measurePoolLease } from '../task-orchestrator/surfaces/pod-lease.js';
 import { parsePodPool, podPoolHostLease, resolvePodPoolSpec } from '../task-orchestrator/surfaces/pod-pool.js';
 import { writeHarnessQueueReceipt } from './harness-queue-child.js';
+import { detectReleaseGateActive, gateReserve } from './gate-reserve.js';
 import { adviseLaunch, compareLaunchAdvice, type LaunchAdvice } from './launch-advice.js';
 import { finishAdvice, measureFinish, recordFinishHistory, type FinishMetrics } from '../loops/orchestrator/finish-rate.js';
+import { collectDraftMetrics, DRAFT_NEEDS_OWNER_SEAT_CAP, shouldHoldSeatNewLaunch, type DraftMetrics } from '../self-dev/draft-sweep.js';
 
 export type QueueSeat = 'OP' | 'TC' | 'MK' | 'UX';
 export type QueueItem = {
@@ -74,9 +76,18 @@ export interface HarnessQueueDeps {
   root?: string;
   configPath?: string;
   cap?: (seat: QueueSeat) => number;
+  /** Fresh GitHub draft inventory for the dispatch boundary; tests inject an isolated source. */
+  draftMetrics?: (now: Date) => Promise<DraftMetrics>;
+  /** Explicit needs-owner hold gate — the hold is an autonomous-launch guard. Cron `harness queue tick`
+   *  and the seat-loop launch/wake sites pass true; the direct `harness say`/`ask` immediate-launch tick
+   *  passes false (a person-initiated command answers itself, pre-hold launch behavior preserved).
+   *  Tests assert this option instead of inferring the boundary from which seams are injected. */
+  needsOwnerGate?: boolean;
   pool?: () => QueuePool;
   /** Shadow-only advice seam; exceptions must not affect the queue decision. */
   advice?: typeof adviseLaunch;
+  /** Gate-reserve observation only; never changes seatCapDetails or decideSpawn inputs. */
+  releaseGateActive?: () => boolean | Promise<boolean>;
   launch?: (item: QueueItem, args: string[], root: string) => Promise<number>;
   /** Test seam: runs after a direct CLI call enqueued its row and before that call's own tick (race tests). */
   afterEnqueue?: (item: QueueItem) => void | Promise<void>;
@@ -322,8 +333,8 @@ function defaultQueuePriority(cellId: string | undefined, root: string, deps: Ha
   }
 }
 
-/** Seat head order: priority descending (none = lowest), then arrival ascending, then file order. */
-function queueHeadBefore(a: QueueItem, b: QueueItem): boolean {
+/** Seat head order: priority descending (none = lowest), then arrival ascending, then file order. RUN-IDENTITY — 신분에서 온 `runPriority` 가 여기서 승인·선점 순서를 정한다. */
+export function queueHeadBefore(a: QueueItem, b: QueueItem): boolean {
   const pa = a.priority ?? -Infinity, pb = b.priority ?? -Infinity;
   if (pa !== pb) return pa > pb;
   const ta = Date.parse(a.at), tb = Date.parse(b.at);
@@ -336,7 +347,7 @@ export class HarnessQueueDuplicateError extends Error {
   }
 }
 
-export async function addHarnessQueue(input: { seat: string; say?: string; ask?: string; hold?: boolean; heavy?: boolean; idempotencyKey?: string; launchArgs?: string[]; poolHint?: string; poolHintSource?: 'grid'; launchCwd?: string; refuseDuplicate?: boolean }, deps: HarnessQueueDeps = {}): Promise<QueueItem> {
+export async function addHarnessQueue(input: { seat: string; say?: string; ask?: string; hold?: boolean; heavy?: boolean; idempotencyKey?: string; launchArgs?: string[]; poolHint?: string; poolHintSource?: 'grid'; launchCwd?: string; refuseDuplicate?: boolean; runPriority?: number }, deps: HarnessQueueDeps = {}): Promise<QueueItem> {
   const assigned = seat(input.seat);
   if ((input.say === undefined) === (input.ask === undefined)) throw new Error('harness queue add: --say 또는 --ask 중 하나만 필요');
   const kind = input.ask === undefined ? 'say' : 'ask';
@@ -370,7 +381,8 @@ export async function addHarnessQueue(input: { seat: string; say?: string; ask?:
         throw new HarnessQueueDuplicateError(existing, key);
       }
     }
-    const priority = defaultQueuePriority(cellId, root, deps);
+    // RUN-IDENTITY — 신분에서 온 줄 우선순위가 칸 러브릭보다 위다(승인·선점이 신분을 읽는다 · GATE-PRIORITY 흡수).
+    const priority = input.runPriority ?? defaultQueuePriority(cellId, root, deps);
     const item: QueueItem = { id: `hq-${randomUUID()}`, seat: assigned, kind, input: value,
       hold: input.hold === true, heavy: input.heavy === true, at: new Date().toISOString(), status: 'queued',
       ...(input.launchArgs === undefined ? {} : { launchArgs: input.launchArgs }),
@@ -1486,10 +1498,39 @@ async function tickHarnessQueueOnce(deps: HarnessQueueDeps, requestedId: string
       }
       return waiting();
     }
+    // Shadow measurement runs outside the approval path. One async probe serves all candidates in this tick.
+    const gateActivePromise = !childUniverses?.unreadable.length
+      ? Promise.resolve().then(() => (deps.releaseGateActive ?? detectReleaseGateActive)()).catch(() => false)
+      : undefined;
+    // NEEDS-OWNER-CENSUS: one draft census per tick, shared by every candidate. A full census pages all
+    // open drafts, the 48h closed cohort, and one claim-comment gh call per open draft — re-running it
+    // per candidate multiplied those calls by the seat count and raced the rate limit the seat-loop tick
+    // also spends. The memo lives in this tick only; the next tick re-collects.
+    const needsOwnerGate = deps.needsOwnerGate ?? false;
+    let draftCensus: Promise<DraftMetrics> | undefined;
+    const censusOnce = (): Promise<DraftMetrics> => {
+      draftCensus ??= (deps.draftMetrics
+        ? deps.draftMetrics((deps.now ?? (() => new Date()))())
+        : (async () => {
+          const [{ resolveRepositoryName }, { githubDraftSweepAdapters }] = await Promise.all([
+            import('./repository-name.js'), import('./harness-cli-command.js'),
+          ]);
+          return collectDraftMetrics(resolveRepositoryName({}), githubDraftSweepAdapters(), (deps.now ?? (() => new Date()))());
+        })());
+      return draftCensus;
+    };
     for (const item of candidates) {
       const injectedCap = deps.cap?.(item.seat);
       const details = seatCapDetails({ seat: item.seat, caps, gate, injectedCap });
       const active = seatActive(item.seat);
+      // An unreadable child universe makes the running count incomplete; do not emit a misleading cap sample.
+      if (gateActivePromise) void gateActivePromise.then((gateActive) => {
+        try {
+          const reserve = gateReserve({ releaseGateActive: gateActive === true, seat: item.seat, configuredGateCap: gate?.[item.seat] ?? 4 });
+          debug.log('harness.queue', 'gate-reserve-shadow', { seat: item.seat, active: reserve.active, wouldCap: reserve.wouldCap,
+            cap: details.cap, running: active });
+        } catch { /* Shadow observation cannot affect the decision. */ }
+      });
       if (active >= details.cap) { blocked.set(item.seat, { reason: seatLine(item.seat, active, details), active }); continue; }
       if (!pool && !poolReason) {
         try { pool = (deps.pool ?? readHarnessQueuePool)(); }
@@ -1545,6 +1586,29 @@ async function tickHarnessQueueOnce(deps: HarnessQueueDeps, requestedId: string
         catch { /* Observation cannot affect dispatch. */ }
         return { outcome: 'waiting', item: { ...item, waitingReason: lateHold.reason }, reason: lateHold.reason };
       }
+      // A queued request can outlive the seat's earlier census: check again at the actual launcher boundary.
+      // NEEDS-OWNER-BOUNDARY: the hold is an autonomous-launch guard — cron `harness queue tick` (and any
+      // embedder) opts in via deps.needsOwnerGate; the direct `harness say`/`ask` immediate-launch tick does
+      // not, because a person-initiated command answers itself. The census itself is shared: one call per
+      // tick (censusOnce), never one per candidate.
+      if (needsOwnerGate) {
+        let metrics: DraftMetrics | undefined;
+        try {
+          metrics = await censusOnce();
+          if (!metrics.needsOwnerBySeat) throw new Error('per-seat draft inventory missing');
+        } catch (error) {
+          // NEEDS-OWNER-POLICY: an unreadable census — gh unavailable, rate-limited, or one unreadable
+          // claim comment — is unobserved, not failed-closed. Unobserved input never holds any seat's
+          // launch; only an observed count over the cap does. The next tick re-collects.
+          try {
+            debug.log('loop.orchestrator', 'needs-owner-unobserved', { seat: item.seat, reason: String(error).slice(0, 140) });
+          } catch { /* observation must not affect the dispatch decision */ }
+        }
+        if (metrics && shouldHoldSeatNewLaunch(item.seat, metrics.needsOwnerBySeat ?? {})) {
+          blocked.set(item.seat, { reason: `needs-owner ${item.seat}: ${metrics.needsOwnerBySeat?.[item.seat]} > ${DRAFT_NEEDS_OWNER_SEAT_CAP}`, active });
+          continue;
+        }
+      }
       // QUEUE-BURST: scheduled launches stay `launchStaggerMs` after the last queue launch — any tick or process, a direct
       // launch included — so an overlapping cron tick cannot double a burst. A requested (direct say/ask) tick keeps its
       // launch-at-once contract (ONEDOOR-2) and only records its time for the next scheduled tick.

package/src/harness/harness-stop.ts

@@ -14,6 +14,7 @@
 import { existsSync, readdirSync, readFileSync, readlinkSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
 import { debug } from '../debug/log.js';
 import { selfDevRunsDir } from '../self-dev/run-store.js';
 import { launchBindingRunIds, launchRegistryDir, readLaunchBinding } from './launch-registry.js';
@@ -124,7 +125,7 @@ export function discoverStopProcesses(runId: string, goalPath: string | null, ta
 function stopProcessCwd(pid: number): string | null {
   try {
     if (process.platform === 'linux') return readlinkSync(`/proc/${pid}/cwd`);
-    const r = spawnSync('lsof', ['-a', '-p', String(pid), '-d', 'cwd', '-Fn'], { encoding: 'utf8', timeout: 5_000 });
+    const r = spawnSync('lsof', ['-a', '-p', String(pid), '-d', 'cwd', '-Fn'], { encoding: 'utf8', timeout: 5_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
     if (r.error || r.status !== 0 || typeof r.stdout !== 'string') return null;
     return r.stdout.split(/\r?\n/).find((line) => line.startsWith('n/'))?.slice(1) ?? null;
   } catch { return null; }
@@ -206,7 +207,7 @@ export function pidRecordFromLaunchBinding(runId: string, registryDir = launchRe
 /** macOS·Linux 공통 — UTC 시작 시각과 상태를 같은 ps 관측에서 읽는다. */
 export function psProcessStartMs(pid: number): number | null {
   const r = spawnSync('ps', ['-o', 'lstart=,stat=', '-p', String(pid)], {
-    encoding: 'utf8', timeout: 5_000, env: { ...process.env, TZ: 'UTC' },
+    encoding: 'utf8', timeout: 5_000, env: { ...process.env, TZ: 'UTC' }, maxBuffer: SPAWN_SYNC_MAX_BUFFER,
   });
   if (r.status !== 0) return null;
   const match = /^\s*((?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)\s+\w+\s+\d+\s+\d\d:\d\d:\d\d\s+\d{4})\s+(\S+)\s*$/.exec(r.stdout);
@@ -220,7 +221,7 @@ export function defaultHarnessStopDeps(overrides: Partial<HarnessStopDeps> = {},
   const env = { ...process.env };
   for (const key of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'ALL_PROXY', 'all_proxy']) delete env[key];
   const kubectl = (args: readonly string[]) => {
-    const r = spawnSync('kubectl', [...args], { encoding: 'utf8', timeout: 15_000, env });
+    const r = spawnSync('kubectl', [...args], { encoding: 'utf8', timeout: 15_000, env, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
     return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? String(r.error ?? '') };
   };
   return {

package/src/harness/harness-substrate-default.ts

@@ -1,6 +1,7 @@
 import { spawnSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { loadavg, cpus, freemem } from 'node:os';
 import { effectiveInstanceRoot, prodInstanceRoot, treeDerivedRootFor } from '../instance/resolve.js';
 import { getElanousConfigDirOverride } from '../elanous-config-dir.js';
 import { buildUserConfig, getUserConfig, type UserConfig } from '../user-config.js';
@@ -99,6 +100,60 @@ export interface AutoSubstrateDecision {
   reason: string;
 }
 
+export interface AutoSubstrateReadDeps {
+  loadavg?: typeof loadavg;
+  cpus?: typeof cpus;
+  freemem?: typeof freemem;
+  podAdmission?: () => AutoSubstrateSignals['podAdmission'];
+  localLaneOpen?: () => boolean;
+  /** Resolved by the launch decision, using its flag → env → config → context precedence. */
+  pool?: string | null;
+  config?: Pick<UserConfig, 'harness' | 'pod'>;
+  measurePoolLease?: typeof import('../task-orchestrator/surfaces/pod-lease.js').measurePoolLease;
+}
+
+/** Read Pod admission using the same pool, usage and account inputs as dispatch backpressure. */
+function readAutoPodAdmission(deps: AutoSubstrateReadDeps): AutoSubstrateSignals['podAdmission'] {
+  // Keep Pod lease dependencies lazy for local-only launches.
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const { leaseKubectl, measurePoolLease, recommendConcurrency } = require('../task-orchestrator/surfaces/pod-lease.js') as typeof import('../task-orchestrator/surfaces/pod-lease.js');
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const { parsePodPool, resolvePodPoolSpec } = require('../task-orchestrator/surfaces/pod-pool.js') as typeof import('../task-orchestrator/surfaces/pod-pool.js');
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const { listCodexAccountsInStore } = require('../oauth/codex-account-store.js') as typeof import('../oauth/codex-account-store.js');
+  // A direct collector call can resolve its own pool. The launch resolver passes a string or null
+  // explicitly so it never substitutes another universe's pool when the launch pool is unreadable.
+  const fallback = deps.pool === undefined ? (deps.config ?? getUserConfig()) : null;
+  const spec = fallback ? resolvePodPoolSpec(undefined, process.env, () => fallback.harness?.podPool ?? fallback.pod?.pool) : null;
+  const current = fallback && !spec ? leaseKubectl(['config', 'current-context']) : null;
+  const pool = deps.pool === undefined ? (spec ?? (current?.status === 0 ? current.stdout.trim() : null)) : deps.pool;
+  if (!pool) return null;
+  const members = parsePodPool(pool);
+  const measure = (deps.measurePoolLease ?? measurePoolLease)(members, { measureUsage: true, skipDnsProbe: true });
+  let accounts = -1;
+  try { accounts = listCodexAccountsInStore().length; } catch { /* Accounts are only observed, not a limit. */ }
+  const { recommended, limitedBy } = recommendConcurrency(measure, {
+    capacity: members.reduce((sum, member) => sum + member.capacity, 0),
+    accounts, perAccount: (deps.config ?? getUserConfig()).pod?.lease?.perAccount ?? 4,
+  });
+  return recommended === null || limitedBy === null ? null : { recommended, limitedBy };
+}
+
+/** Collect observations on the launch host; an unreadable Pod recommendation is not a refusal. */
+export function readAutoSubstrateSignals(deps: AutoSubstrateReadDeps = {}): AutoSubstrateSignals {
+  let podAdmission: AutoSubstrateSignals['podAdmission'];
+  try { podAdmission = (deps.podAdmission ?? (() => readAutoPodAdmission(deps)))() ?? null; }
+  catch { podAdmission = null; }
+  if (podAdmission?.recommended === null || podAdmission?.limitedBy === null) podAdmission = null;
+  return {
+    load1: (deps.loadavg ?? loadavg)()[0],
+    cores: (deps.cpus ?? cpus)().length,
+    availableMemoryBytes: (deps.freemem ?? freemem)(),
+    podAdmission,
+    localLaneOpen: deps.localLaneOpen?.() ?? false,
+  };
+}
+
 export interface NextLocalLaneCapInput {
   current: number;
   wanted: number;
@@ -194,28 +249,44 @@ export function checkHarnessPodPool(pool: string, run?: PoolKubectl): HarnessPoo
 export function resolveHarnessSubstrate({ flag, config, env, currentContext = () => {
   const result = spawnSync('kubectl', ['config', 'current-context'], { encoding: 'utf8', timeout: 5000 });
   return result.status === 0 ? result.stdout?.trim() : undefined;
-}, autoSignals, poolCheck = checkHarnessPodPool }: {
+  }, autoSignals, readAutoSignals, autoReadDeps, poolCheck = checkHarnessPodPool }: {
   flag?: { substrate?: HarnessSubstrate | 'auto'; podPool?: string };
   config?: Pick<UserConfig, 'harness' | 'pod'>;
   env?: NodeJS.ProcessEnv;
   currentContext?: () => string | undefined;
   /** Signals must come from the launch host and Pod admission, not a worktree's cached config. */
   autoSignals?: AutoSubstrateSignals;
+  /** Inject the collector at the decision boundary; explicit requests never invoke it. */
+  readAutoSignals?: () => AutoSubstrateSignals;
+  /** Inject measurement dependencies without bypassing the default collector or pool selection. */
+  autoReadDeps?: Omit<AutoSubstrateReadDeps, 'pool' | 'config' | 'podAdmission'>;
   /** POD-POOL-UNCAPPED-SPEC — pre-launch check of the implicit kube context; tests inject it instead of shelling out. */
   poolCheck?: (pool: string) => HarnessPoolCheck;
 }): ResolvedHarnessSubstrate {
   const requested = flag?.substrate ?? config?.harness?.substrate ?? 'local';
   if (requested !== 'local' && requested !== 'pod' && requested !== 'auto') throw new Error('harness.substrate: local, pod 또는 auto 만 허용한다');
   const source = flag?.substrate ? 'flag' : config?.harness?.substrate ? 'config' : 'default';
-  // Missing signals mean admission was not observed, not that the Pod has room.
-  const decision = requested === 'auto' ? routeAutoSubstrate(autoSignals ?? {
-    podAdmission: null, load1: null, cores: null, availableMemoryBytes: null, localLaneOpen: false,
-  }) : null;
+  const explicit = flag?.podPool?.trim() || env?.ELANOUS_POD_POOL?.trim() || config?.harness?.podPool?.trim() || config?.pod?.pool?.trim();
+  // Reuse the same pool choice for admission and launch; do not fall back to a different universe's pool.
+  let implicit: string | undefined;
+  let contextRead = false;
+  const selectedPool = () => {
+    if (explicit) return explicit;
+    if (!contextRead) { implicit = currentContext()?.trim(); contextRead = true; }
+    return implicit;
+  };
+  const signals = requested === 'auto'
+    ? (autoSignals ?? (readAutoSignals ?? (() => readAutoSubstrateSignals({ ...autoReadDeps, pool: selectedPool() ?? null, config })))())
+    : null;
+  if (signals && autoSignals === undefined) debug.log('harness.substrate', 'auto-signals', {
+    load1: signals.load1, cores: signals.cores, availableMemoryBytes: signals.availableMemoryBytes,
+    podAdmission: signals.podAdmission, localLaneOpen: signals.localLaneOpen,
+  });
+  const decision = signals ? routeAutoSubstrate(signals) : null;
   const substrate: HarnessSubstrate = requested === 'auto' ? decision!.substrate : requested;
   if (decision) debug.log('harness.substrate', 'route', { substrate, reason: decision.reason, source });
   if (substrate === 'local') return { substrate, pool: null, source };
-  const explicit = flag?.podPool?.trim() || env?.ELANOUS_POD_POOL?.trim() || config?.harness?.podPool?.trim() || config?.pod?.pool?.trim();
-  const pool = explicit || currentContext()?.trim();
+  const pool = selectedPool();
   if (!pool) throw new Error(`harness.substrate=${decision ? `auto→pod(${decision.reason})` : 'pod'}: Pod 풀 또는 현재 컨텍스트에 닿지 못했다 — 풀을 설정하거나 \`--substrate local\` 로 명시하라`);
   // POD-POOL-UNCAPPED-SPEC — an explicit pool is the operator's own statement and gets `checkPodPool` at the launch
   //   site (`src/index.ts` self orchestrate · `src/loops/orchestrator/tick.ts` · `pod-command-job.ts`). The implicit

package/src/harness/harness-worktree-auto.ts

@@ -1,4 +1,5 @@
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
 import { readFileSync } from 'node:fs';
 import { resolveMainRepoRoot, type HarnessWorktreeCommand } from '../git-fs/worktree.js';
 import { goalTitleFromDocument } from '../self-implement/seams.js';
@@ -25,7 +26,7 @@ interface DevWorktreeGoal {
 }
 
 function git(cwd: string, args: string[]): string {
-  const result = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  const result = spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   if (result.status !== 0) {
     const message = (result.stderr || result.stdout || '').trim() || `git exited ${result.status}`;
     throw new Error(`dev auto-worktree inspection failed — ${message}`);

package/src/harness/harness-worktrees.ts

@@ -1,4 +1,5 @@
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
 import { resolve } from 'node:path';
 import { debug } from '../debug/log.js';
 import { gitStdout, type GitRunner } from './harness-clean.js';
@@ -146,7 +147,7 @@ export function renderHarnessWorktreesReport(report: WorktreeAssessmentReport, r
 
 export type GhWorktreeRunner = (args: string[], cwd: string) => { status: number | null; stdout: string };
 const defaultGhRunner: GhWorktreeRunner = (args, cwd) => {
-  const result = spawnSync('gh', args, { cwd, encoding: 'utf8', timeout: 25_000 });
+  const result = spawnSync('gh', args, { cwd, encoding: 'utf8', timeout: 25_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   return { status: result.status, stdout: result.stdout ?? '' };
 };
 
@@ -366,7 +367,7 @@ export function execHarnessWorktrees(deps: {
   progress?: (line: string) => void;
 } = {}): WorktreeAssessmentReport {
   const run: GitRunner = deps.run ?? ((args) => {
-    const result = spawnSync('git', args, { encoding: 'utf8', timeout: 25_000 });
+    const result = spawnSync('git', args, { encoding: 'utf8', timeout: 25_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
     return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
   });
   const worktrees = listRegisteredWorktrees(run);

package/src/hooks/dispatch.ts

@@ -24,7 +24,8 @@ const DEFAULT_SEAT_ROUTES = [
  *  So a delivered card with the seat loop off is not retried (the card waits in the inbox), and a shadow loop's wake is
  *  recorded as `wake_status = 'shadow'` — visible as «not executed», not mistaken for a real run. */
 export async function dispatchHook(event: QueuedHook, root: string, config: EventsConfig,
-  wake: HookWake = seat => runSeatLoopOnce(seat, { root, config: getUserConfig().loops?.seat ?? { mode: 'off' } }),
+  // Autonomous hook wake: the needs-owner hold stays on (NEEDS-OWNER-BOUNDARY).
+  wake: HookWake = seat => runSeatLoopOnce(seat, { root, needsOwnerGate: true, config: getUserConfig().loops?.seat ?? { mode: 'off' } }),
   now: () => number = Date.now): Promise<void> {
   const key = `${event.provider}:${event.eventId}`;
   const route = config.routes.find(candidate => candidate.source === event.provider && candidate.kind === event.kind);