elanous 0.2.31 → 0.2.34

package/src/cli/release-run-if-ready.ts

@@ -1,10 +1,9 @@
-import { closeSync, mkdirSync, openSync, rmSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
 import { debug } from '../debug/log.js';
 import { releaseLedgerRoot } from '../instance/resolve.js';
 import { adviseLaunch, compareLaunchAdvice } from '../harness/launch-advice.js';
 import type { QueuePool } from '../harness/harness-queue.js';
 import type { ReleaseReadiness } from '../../scripts/release-loop/release-readiness.js';
+import { ReleaseRunClaimConflict, releaseRunLockOwnerAlive, withDirectReleaseRunLock, withForceReleaseRunMarker } from './release-single-flight.js';
 
 export type ReleaseIfReadySkip = { skipped: true; reason: Exclude<ReleaseReadiness, { ready: true }>['reason']; detail: string };
 
@@ -16,6 +15,8 @@ export async function runReleaseIfReady<T>(version: string, deps: {
   now?: () => Date;
   advice?: typeof adviseLaunch;
   pool?: () => QueuePool | undefined;
+  /** Explicit operator override: keep readiness checks, bypass only the same-version lock. */
+  forceNew?: boolean;
 }): Promise<ReleaseIfReadySkip | { skipped: false; result: T }> {
   const skip = (readiness: Exclude<ReleaseReadiness, { ready: true }>): ReleaseIfReadySkip => {
     const detail = readiness.reason === 'checklist-blocked'
@@ -24,36 +25,36 @@ export async function runReleaseIfReady<T>(version: string, deps: {
     debug.log('release-loop.readiness', readiness.reason, { version, detail });
     return { skipped: true, reason: readiness.reason, detail };
   };
-  const readiness = await deps.readiness(version);
+  const ledgerRoot = deps.ledgerRoot ?? releaseLedgerRoot();
+  const readiness = await deps.readiness(version, { isPidAlive: deps.forceNew ? () => false
+    : (pid) => releaseRunLockOwnerAlive(version, ledgerRoot, pid) });
   if (!readiness.ready) return skip(readiness);
 
-  const dir = join(deps.ledgerRoot ?? releaseLedgerRoot(), 'release', version);
-  mkdirSync(dir, { recursive: true });
-  const lock = join(dir, 'run.lock');
-  let fd: number;
-  try { fd = openSync(lock, 'wx', 0o600); }
-  catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+  if (deps.forceNew) return withForceReleaseRunMarker(version, ledgerRoot, async () => {
+    const atStart = await deps.readiness(version, { isPidAlive: () => false });
+    if (!atStart.ready) return skip(atStart);
+    return { skipped: false, result: await deps.run() };
+  });
+
+  try {
+    return await withDirectReleaseRunLock(version, ledgerRoot, async () => {
+      // This call still checks publication and checklist, but must not treat our own lock as another runner.
+      const insideLock = await deps.readiness(version, { isPidAlive: () => false });
+      if (!insideLock.ready) return skip(insideLock);
+      debug.log('release-loop.readiness', 'ready', { version });
+      try {
+        const advice = (deps.advice ?? adviseLaunch)({ pool: deps.pool?.(), caller: 'release-run' });
+        const { kind } = compareLaunchAdvice(advice, 'launched');
+        debug.log('resource.advice', 'launch-advice', { caller: 'release-run', verdict: advice.verdict, why: advice.why, actual: 'launched', kind, version });
+      } catch {
+        // Shadow only: a throwing advice seam must never affect the launch decision or result.
+      }
+      return { skipped: false, result: await deps.run() };
+    }, { pid: deps.pid, now: deps.now });
+  } catch (error) {
+    if (!(error instanceof ReleaseRunClaimConflict)) throw error;
     const detail = 'run.lock already exists';
     debug.log('release-loop.readiness', 'already-running', { version, detail });
     return { skipped: true, reason: 'already-running', detail };
   }
-  try {
-    writeFileSync(fd, `${JSON.stringify({ pid: deps.pid ?? process.pid, startedAt: (deps.now ?? (() => new Date()))().toISOString() })}\n`);
-    // This call still checks publication and checklist, but must not treat our own lock as another runner.
-    const insideLock = await deps.readiness(version, { isPidAlive: () => false });
-    if (!insideLock.ready) return skip(insideLock);
-    debug.log('release-loop.readiness', 'ready', { version });
-    try {
-      const advice = (deps.advice ?? adviseLaunch)({ pool: deps.pool?.(), caller: 'release-run' });
-      const { kind } = compareLaunchAdvice(advice, 'launched');
-      debug.log('resource.advice', 'launch-advice', { caller: 'release-run', verdict: advice.verdict, why: advice.why, actual: 'launched', kind, version });
-    } catch {
-      // Shadow only: a throwing advice seam must never affect the launch decision or result.
-    }
-    return { skipped: false, result: await deps.run() };
-  } finally {
-    closeSync(fd);
-    rmSync(lock);
-  }
 }

package/src/cli/release-single-flight.ts

@@ -0,0 +1,178 @@
+import { closeSync, mkdirSync, openSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+import { Database } from 'bun:sqlite';
+import { graphRunAlive, type GraphRunState } from '../graph-runner/runner.js';
+import { psProcessStartMs, START_TOLERANCE_MS } from '../harness/harness-stop.js';
+
+export interface ActiveReleaseRun {
+  runId: string;
+  pid: number;
+  startedAt: string;
+}
+
+export class ReleaseRunClaimConflict extends Error {
+  readonly code = 'EEXIST';
+  constructor() { super('release run claim already exists'); }
+}
+
+function isPidAlive(pid: number): boolean {
+  try { process.kill(pid, 0); return true; }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ESRCH') return false;
+    if ((error as NodeJS.ErrnoException).code === 'EPERM') return true;
+    throw error;
+  }
+}
+
+/** The saved graph run is the authority for an active release, not a process-name match. */
+export function findActiveReleaseRun(version: string, ledgerRoot: string): ActiveReleaseRun | undefined {
+  const dir = join(ledgerRoot, 'graph-runs', 'release-loop');
+  let names: string[];
+  try { names = readdirSync(dir).filter((name) => name.endsWith('.json')); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined;
+    throw error;
+  }
+  const runs: ActiveReleaseRun[] = [];
+  for (const name of names) {
+    try {
+      const state = JSON.parse(readFileSync(join(dir, name), 'utf8')) as {
+        graphId?: unknown; runId?: unknown; status?: unknown; pid?: unknown; pidStartedAt?: unknown; startedAt?: unknown;
+        input?: { version?: unknown };
+      };
+      if (state.graphId !== 'release-loop' || state.status !== 'running' || state.input?.version !== version
+        || typeof state.runId !== 'string' || typeof state.startedAt !== 'string'
+        || typeof state.pid !== 'number' || !Number.isSafeInteger(state.pid) || state.pid <= 0
+        || graphRunAlive(state as GraphRunState) !== true) continue;
+      runs.push({ runId: state.runId, pid: state.pid, startedAt: state.startedAt });
+    } catch (error) {
+      if (error instanceof SyntaxError || (error as NodeJS.ErrnoException).code === 'ENOENT') continue;
+      throw error;
+    }
+  }
+  return runs.sort((a, b) => b.startedAt.localeCompare(a.startedAt))[0];
+}
+
+export function readReleaseRunLock(version: string, ledgerRoot: string): { pid?: number; startedAt?: string; pidStartedAt?: string } | undefined {
+  try {
+    const value = JSON.parse(readFileSync(join(ledgerRoot, 'release', version, 'run.lock'), 'utf8')) as { pid?: unknown; startedAt?: unknown; pidStartedAt?: unknown };
+    return { pid: typeof value.pid === 'number' ? value.pid : undefined,
+      startedAt: typeof value.startedAt === 'string' ? value.startedAt : undefined,
+      pidStartedAt: typeof value.pidStartedAt === 'string' ? value.pidStartedAt : undefined };
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined;
+    if (error instanceof SyntaxError) return {};
+    throw error;
+  }
+}
+
+/** A live PID belongs to this lock only if its process birth still matches. */
+export function releaseRunLockOwnerAlive(version: string, ledgerRoot: string, pid: number): boolean {
+  const owner = readReleaseRunLock(version, ledgerRoot);
+  if (!owner || owner.pid !== pid || !isPidAlive(pid)) return false;
+  const actual = psProcessStartMs(pid);
+  // A failed birth probe must not let a second launch reclaim a live PID's lock.
+  if (actual === null) return true;
+  const recorded = Date.parse(owner.pidStartedAt ?? '');
+  if (Number.isFinite(recorded)) return Math.abs(actual - recorded) <= START_TOLERANCE_MS;
+  // Older locks have only their claim time. A process born after that claim reused the PID.
+  const claimedAt = Date.parse(owner.startedAt ?? '');
+  return Number.isFinite(claimedAt) && actual <= claimedAt + START_TOLERANCE_MS;
+}
+
+function claimDb(ledgerRoot: string): Database {
+  mkdirSync(join(ledgerRoot, 'release'), { recursive: true });
+  const db = new Database(join(ledgerRoot, 'release', 'run-lock-claim.sqlite'), { create: true });
+  db.exec('PRAGMA busy_timeout = 5000');
+  db.exec('CREATE TABLE IF NOT EXISTS force_starts (token TEXT PRIMARY KEY, version TEXT NOT NULL, pid INTEGER NOT NULL, pid_started_at TEXT NOT NULL, started_at TEXT NOT NULL)');
+  return db;
+}
+
+type ForceStart = { token: string; version: string; pid: number; pid_started_at: string; started_at: string };
+function forceStartAlive(row: ForceStart): boolean {
+  if (!isPidAlive(row.pid)) return false;
+  const actual = psProcessStartMs(row.pid);
+  return actual === null || Math.abs(actual - Date.parse(row.pid_started_at)) <= START_TOLERANCE_MS;
+}
+
+function liveForceStart(db: Database, version: string): ForceStart | undefined {
+  const rows = db.query('SELECT token, version, pid, pid_started_at, started_at FROM force_starts WHERE version = ?').all(version) as ForceStart[];
+  for (const row of rows) {
+    if (forceStartAlive(row)) return row;
+    db.query('DELETE FROM force_starts WHERE token = ?').run(row.token);
+  }
+  return undefined;
+}
+
+export function readActiveForceReleaseRun(version: string, ledgerRoot: string): ActiveReleaseRun | undefined {
+  const db = claimDb(ledgerRoot);
+  try {
+    const row = liveForceStart(db, version);
+    return row && { runId: 'pending', pid: row.pid, startedAt: row.started_at };
+  } finally { db.close(); }
+}
+
+/** Force runs bypass refusal but publish a claim before launching so later normal runs refuse. */
+export async function withForceReleaseRunMarker<T>(version: string, ledgerRoot: string, run: () => Promise<T>): Promise<T> {
+  const db = claimDb(ledgerRoot);
+  const token = randomUUID();
+  try {
+    db.exec('BEGIN IMMEDIATE');
+    try {
+      const pidStartedAt = psProcessStartMs(process.pid) ?? Date.now() - process.uptime() * 1000;
+      db.query('INSERT INTO force_starts (token, version, pid, pid_started_at, started_at) VALUES (?, ?, ?, ?, ?)')
+        .run(token, version, process.pid, new Date(pidStartedAt).toISOString(), new Date().toISOString());
+      db.exec('COMMIT');
+    } catch (error) { db.exec('ROLLBACK'); throw error; }
+    return await run();
+  } finally {
+    db.query('DELETE FROM force_starts WHERE token = ?').run(token);
+    db.close();
+  }
+}
+
+/**
+ * Atomic claim closes the gap before the graph's first saved state. SQLite serializes
+ * stale-lock reclamation among direct entrants; a scheduled entrant only uses O_EXCL,
+ * so it either wins after removal or sees the direct entrant's new file.
+ */
+export async function withDirectReleaseRunLock<T>(version: string, ledgerRoot: string, run: () => Promise<T>,
+  owner: { pid?: number; now?: () => Date } = {}): Promise<T> {
+  const dir = join(ledgerRoot, 'release', version);
+  mkdirSync(dir, { recursive: true });
+  const lock = join(dir, 'run.lock');
+  const db = claimDb(ledgerRoot);
+  const token = randomUUID();
+  let fd: number | undefined;
+  try {
+    db.exec('BEGIN IMMEDIATE');
+    try {
+      if (liveForceStart(db, version)) {
+        throw new ReleaseRunClaimConflict();
+      }
+      const existing = readReleaseRunLock(version, ledgerRoot);
+      if (existing?.pid && !releaseRunLockOwnerAlive(version, ledgerRoot, existing.pid)) rmSync(lock, { force: true });
+      fd = openSync(lock, 'wx', 0o600);
+      const pid = owner.pid ?? process.pid;
+      const pidStartedAt = psProcessStartMs(pid) ?? Date.now() - process.uptime() * 1000;
+      writeFileSync(fd, `${JSON.stringify({ pid, pidStartedAt: new Date(pidStartedAt).toISOString(), startedAt: (owner.now ?? (() => new Date()))().toISOString(), token })}\n`);
+      db.exec('COMMIT');
+    } catch (error) {
+      if (fd !== undefined) { closeSync(fd); rmSync(lock, { force: true }); fd = undefined; }
+      db.exec('ROLLBACK');
+      if ((error as NodeJS.ErrnoException).code === 'EEXIST') throw new ReleaseRunClaimConflict();
+      throw error;
+    }
+  } finally { db.close(); }
+  try { return await run(); }
+  finally {
+    if (fd !== undefined) closeSync(fd);
+    try {
+      const current = JSON.parse(readFileSync(lock, 'utf8')) as { token?: unknown };
+      if (current.token === token) rmSync(lock);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    }
+  }
+}

package/src/cli/seat-cli.ts

@@ -3,6 +3,7 @@ import { existsSync, lstatSync, readFileSync, realpathSync, statSync } from 'nod
 import { homedir } from 'node:os';
 import { dirname, join, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { LAST_SESSION_FILE } from '../dashboard/seat-local-instructions.js';
 import { redactSecretText } from '../debug/log.js';
 import { defaultMsgStorePath, readUnreadCount } from '../msg/msg-store.js';
 import { parseKnowhowItems, splitKnowhow } from '../seat-loop/seat-knowhow.js';
@@ -96,6 +97,40 @@ export function renderSeatBootCard(seat: string, sections: ReadonlyArray<SeatBoo
   return out.join('\n');
 }
 
+/** 자리의 현재 역할 선언 한 줄만 부트 카드에 싣는다. 긴 지시문 본문은 카드로 복사하지 않는다. */
+function seatRoleSection(home: string, seat: string): { source: string; updated: string; rows: readonly string[]; reason?: string } {
+  const root = join(home, 'elanous-hq');
+  const path = join(root, 'seats', seat, 'AGENTS.local.md');
+  if (!existsSync(path)) return { source: path, updated: '미상', rows: [], reason: '미관측: 파일 없음' };
+  try {
+    if (!isRegularSeatPath(home, root, path)) return { source: path, updated: '미상', rows: [], reason: '미관측: 일반 경로가 아님' };
+    const role = readFileSync(path, 'utf8').slice(0, 4096).split(/\r?\n/)
+      .map(line => line.match(/^\s*#?\s*역할\s*=\s*(.+)$/)?.[1])
+      .find(Boolean);
+    return { source: path, updated: statSync(path).mtime.toISOString(), rows: role ? [`역할: ${clean(role)}`] : [],
+      ...(role ? {} : { reason: '미관측: 역할 선언 없음' }) };
+  } catch {
+    return { source: path, updated: '미상', rows: [], reason: '미관측: 읽기 실패' };
+  }
+}
+
+/** «지난 세션» 절 — TUI 가 대화 끝마다 자리 작업 디렉터리 루트에 갈아 쓰는 `LAST_SESSION_FILE`(`dashboard/seat-local-instructions.ts`)이 곧 지난 세션의 정본이다.
+ *  카드도 같은 정본을 읽는다 — 머리 보일러플레이트(`## …`)는 빼고 요약 줄만 실는다. */
+function lastSessionSection(home: string, seat: string): { source: string; updated: string; rows: readonly string[]; reason?: string } {
+  const path = join(home, 'elanous-hq', 'seats', seat, LAST_SESSION_FILE);
+  if (!existsSync(path)) return { source: path, updated: '미상', rows: [], reason: '미관측: 파일 없음' };
+  try {
+    if (!isRegularSeatPath(home, join(home, 'elanous-hq'), path)) return { source: path, updated: '미상', rows: [], reason: '미관측: 일반 경로가 아님' };
+    const rows = readFileSync(path, 'utf8').slice(0, 256_000).split(/\r?\n/)
+      .filter(line => line.trim() && !/^#{1,6}\s/.test(line))
+      .slice(0, MAX_ROWS)
+      .map(line => clean(line.replace(/^[-*]\s*/, '')));
+    return { source: path, updated: statSync(path).mtime.toISOString(), rows, ...(rows.length ? {} : { reason: '미관측: 요약 줄 없음' }) };
+  } catch {
+    return { source: path, updated: '미상', rows: [], reason: '미관측: 읽기 실패' };
+  }
+}
+
 /** 자리 카드의 파일·우편 절(동기) — `eln seat boot` 와 TUI 세션 부트(`dashboard/seat-boot-preamble.ts`)가 같이 쓴다. */
 export function collectSeatBootSections(seat: string, options: { home: string; msgPath: string }): { sections: SeatBootSection[]; unread: number | null } {
   const root = join(options.home, 'elanous-hq', 'seat-state');
@@ -104,11 +139,13 @@ export function collectSeatBootSections(seat: string, options: { home: string; m
   try { unread = readUnreadCount(seat, options.msgPath); }
   catch { /* unavailable is not a measured zero */ }
   const sections: SeatBootSection[] = [
+    { title: '자리 역할', ...seatRoleSection(options.home, seat) },
     { title: 'msg 원장', source: options.msgPath, updated: unread === null ? '미상' : new Date().toISOString(), rows: [`안 읽은 msg ${unread ?? '미관측'} (${seat})`] },
     { title: 'HANDOFF', ...metadata(options.home, root, join(seatDir, 'HANDOFF.md'), 'markdown') },
     { title: 'inbox', ...metadata(options.home, root, join(seatDir, 'inbox.md'), 'markdown') },
     { title: '수확 주장', ...metadata(options.home, root, join(seatDir, 'harvest-claims.tsv'), 'tsv') },
     { title: '예약', ...metadata(options.home, root, join(seatDir, 'scheduled.tsv'), 'tsv') },
+    { title: '지난 세션', ...lastSessionSection(options.home, seat) },
     { title: '공통 메모리 색인', ...metadata(options.home, root, join(root, 'memory', 'MEMORY.md'), 'memory') },
   ];
   return { sections, unread };

package/src/cli/setup-cli.ts

@@ -182,10 +182,47 @@ function reportCliSkills(deps: SetupCliDeps, apply: boolean): string[] {
   return lines;
 }
 
+/** 최초 셋업 묶음 제안(읽기 전용). 등급·승인 어휘는 문서 원전을 그대로 쓴다 —
+ *  묶음·층 구성 = 내부 문서 `RESEARCH-plugins-connectors-baseline-2026-09-30` §4(0층 «키 없이 항상 켬»),
+ *  항목별 보안 등급·승인 = 같은 문서 §5. §5 표에 등급이 없는 0층 항목(Edge/macOS TTS·스킬)은
+ *  등급을 지어내지 않기 위해 목록에서 뺀다. 실제 설치·자격 부여는 승인 뒤 후속 조각(plan-then-apply). */
+interface SetupBundleItem {
+  name: string;
+  grade: string;
+  approval: string;
+}
+
+const DEFAULT_SETUP_BUNDLE: readonly SetupBundleItem[] = [
+  { name: '셸·파일(작업 트리 안)', grade: '쓰기(로컬)', approval: '기존 모래상자·워크트리 규칙' },
+  { name: 'WebFetch', grade: '읽기', approval: '불요' },
+  { name: 'WebSearch(무료 DuckDuckGo·Jina)', grade: '읽기', approval: '불요' },
+  { name: 'GitHub 공개 읽기(무인증)', grade: '읽기', approval: '불요' },
+  { name: 'PDF/HWP 읽기', grade: '읽기', approval: '불요' },
+  { name: '비전', grade: '읽기', approval: '불요' },
+  { name: 'Obsidian 검색', grade: '읽기', approval: '불요' },
+  { name: 'Obsidian 쓰기', grade: '쓰기(로컬)', approval: 'vault-write-guard' },
+  { name: '기억·일정', grade: '쓰기(로컬)', approval: '기존 모래상자·워크트리 규칙' },
+  { name: 'CDP 브라우저 탐색·읽기', grade: '읽기(네트워크)', approval: '불요(클릭·입력은 쓰기 → 승인)' },
+];
+
+function formatDefaultBundleProposal(): string[] {
+  return [
+    'Setup: 기본 플러그인·커넥터 묶음 제안 (읽기 전용)',
+    `묶음 1/1: 기본 묶음 — 키 없이 항상 켬(0층) · 항목 ${DEFAULT_SETUP_BUNDLE.length}개`,
+    ...DEFAULT_SETUP_BUNDLE.map((item) => `- ${item.name} — 보안 등급: ${item.grade} · 승인: ${item.approval}`),
+    '후속 층(승인 뒤 조각): 1층 로그인된 CLI 재사용 · 2층 원격 MCP 한 번 OAuth · 3층 채널',
+    '제안은 표시만 합니다 — 승인 전 설치 0 · 자격 쓰기 0 · 승인 뒤 설치는 `elanous plugin add <spec>` 경로로(후속 조각)',
+  ];
+}
+
 export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}): void {
   const out = deps.out ?? { log: (value: string) => console.log(value), error: (value: string) => console.error(value) };
   const setExitCode = deps.setExitCode ?? ((code: number) => { process.exitCode = code; });
   const doctorRunner = deps.runDoctor ?? runDoctor;
+  const isFirstRunSetup = (): boolean => deps.firstRunTopics ?? (!deps.getUserConfig && !existsSync(userConfigPath()));
+  const showDefaultBundleProposal = (): void => {
+    for (const line of formatDefaultBundleProposal()) out.log(line);
+  };
   const showCliSkills = (apply: boolean) => {
     out.log('Setup: CLI skills (public GitHub repository reads remain available without login)');
     for (const line of reportCliSkills(deps, apply)) out.log(line);
@@ -206,6 +243,7 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
       if (opts.nonInteractive) {
         out.log(formatSetupReport(doctor, setupSteps(deps), true));
         showCliSkills(false);
+        if (isFirstRunSetup()) showDefaultBundleProposal();
         for (const line of recommendedSetup((deps.getUserConfig ?? getUserConfig)())) out.log(line);
         setExitCode(0);
         return;
@@ -215,7 +253,7 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
         setExitCode(1);
         return;
       }
-      const isFirstRun = deps.firstRunTopics ?? (!deps.getUserConfig && !existsSync(userConfigPath()));
+      const isFirstRun = isFirstRunSetup();
       let steps = setupSteps(deps);
       const provider = steps[1]!;
       if (!provider.complete) {
@@ -230,6 +268,7 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
       }
       out.log(formatSetupReport(doctor, steps, false));
       showCliSkills(false);
+      if (isFirstRun) showDefaultBundleProposal();
       for (const line of recommendedSetup((deps.getUserConfig ?? getUserConfig)())) out.log(line);
       let configured = (deps.getUserConfig ?? getUserConfig)();
       if (!configured.starter?.topics && configured.watch?.enabled !== false

package/src/cli/sim-cli.ts

@@ -0,0 +1,18 @@
+import type { Command } from 'commander';
+import { runScenarioFile } from '../ux-sim/scenario.js';
+
+export function registerSimCommands(program: Command): void {
+  const sim = program.command('sim').description('격리 시나리오를 실행하고 화면·로그 기대값을 대조한다');
+  sim.command('run <scenario-file>')
+    .description('등록된 UX simulation 시나리오를 test 우주에서 실행한다')
+    .action(async (scenarioFile: string) => {
+      try {
+        const result = await runScenarioFile(scenarioFile);
+        console.log(JSON.stringify(result));
+        if (!result.pass) process.exitCode = 1;
+      } catch (error) {
+        console.error(`sim run: ${error instanceof Error ? error.message : String(error)}`);
+        process.exitCode = 2;
+      }
+    });
+}

package/src/cli/tasks-cli.ts

@@ -162,10 +162,17 @@ export interface DefaultTaskLauncherDeps {
   launchHoldActive?: () => boolean;
   /** HQ 판(시험 주입). */
   localVersion?: string;
+  /** HQ-owned, refresh-less Codex access mirror to install before a remote parent launch. */
+  codexAccessMirror?: () => Promise<{ elanousAuth: string; codexAuth: string; account?: string; usedPercent?: number; thresholdPercent?: number } | null>;
+  /** Isolated integration seam; production still reads the HQ rotation snapshot and config directly. */
+  ownerCodexRotation?: () => ReturnType<typeof import('../oauth/codex-account-store.js').inspectCodexRotation>;
+  ownerCodexRotationConfig?: { accountOrder?: readonly string[]; thresholdPercentByAccount?: Readonly<Record<string, unknown>> };
   /** 원격 → 로컬 되돌림 알림(시험 주입). 기본 = stderr 한 줄. */
   notice?: (line: string) => void;
 }
 
+class NoEligibleOwnerCodexAccountError extends Error {}
+
 /**
  * HARNESS-PARENT-ON-MSB1 — 켜져 있고 발사 전 점검이 통과하면 원격(ssh)에서 부모를 띄운다(PR 까지만 · 병합은 HQ).
  * 막히면 null — 호출부가 종전 로컬 발사로 간다(관측: task-agent parent-host-fallback).
@@ -185,6 +192,52 @@ async function tryRemoteParent(args: string[], cwd: string | undefined, context:
     try { debug.log('task-agent', 'parent-host-fallback', { host: target.host, runId: context.runId, gaps, facts }); } catch { /* fail-soft */ }
     notice(`[parent-host] ${target.host} 로 못 띄움 — ${multi ? '다음 호스트 또는 로컬 발사로 간다' : '로컬 발사로 간다'}: ${gaps.join(' · ')}`);
   };
+  let accessMirror: { elanousAuth: string; codexAuth: string; account?: string; usedPercent?: number; thresholdPercent?: number } | null | undefined;
+  const getAccessMirror = async (): Promise<{ elanousAuth: string; codexAuth: string; account?: string; usedPercent?: number; thresholdPercent?: number } | null> => {
+    if (accessMirror !== undefined) return accessMirror;
+    if (deps.codexAccessMirror) {
+      accessMirror = await deps.codexAccessMirror();
+      return accessMirror;
+    }
+    const [pod, authStore, codex, hq] = await Promise.all([
+      import('../task-orchestrator/surfaces/self-implement-pod.js'),
+      import('../oauth/store.js'),
+      import('../oauth/codex.js'),
+      import('../hq/hq.js'),
+    ]);
+    const { inspectCodexRotation } = await import('../oauth/codex-account-store.js');
+    const { planOwnerCodexMirrorCandidates, podAccountThresholdPercent } = await import('../task-orchestrator/surfaces/pod-account-broker.js');
+    const { getUserConfig } = await import('../user-config.js');
+    const rotation = deps.ownerCodexRotation?.() ?? inspectCodexRotation();
+    const config = getUserConfig();
+    const ownerConfig = deps.ownerCodexRotationConfig;
+    const candidates = [...rotation.candidates];
+    const eligible = planOwnerCodexMirrorCandidates(candidates, {
+      accountOrder: ownerConfig?.accountOrder ?? config.llm?.codexAccountOrder ?? [],
+      thresholdPercentByAccount: ownerConfig?.thresholdPercentByAccount ?? config.llm?.codexAccountRotationThresholdPercentByAccount,
+    });
+    if (candidates.length > 0 && eligible.length === 0) throw new NoEligibleOwnerCodexAccountError('HQ 소유 Codex 계정이 모두 사용 임계에 도달해 원격 부모 발사를 거부한다');
+    const prerefreshDeps = {
+      credentials: (account: string) => pod.hostCredentials(account, authStore.authStorePath(), () => '', { requireExplicitChatgptAuthMode: true }),
+      refresh: (account: string) => codex.refreshCodexAccountHome(account),
+      isLeaseHolder: () => hq.hqFenceDecision('ledger-cli').run,
+    };
+    for (const candidate of eligible) {
+      // The account's refresh token stays on HQ. Only the selected account's access-only mirror crosses SSH.
+      let credential: Awaited<ReturnType<typeof pod.podCodexCredentialWithPrerefresh>> = null;
+      try { credential = await pod.podCodexCredentialWithPrerefresh(candidate.name, prerefreshDeps); }
+      catch { continue; }
+      if (!credential) continue;
+      accessMirror = { elanousAuth: credential.elanousAuth, codexAuth: credential.codexAuth, account: candidate.name,
+        ...(candidate.usedPercent !== undefined ? { usedPercent: candidate.usedPercent } : {}),
+        thresholdPercent: podAccountThresholdPercent(candidate.name, {
+          thresholdPercentByAccount: ownerConfig?.thresholdPercentByAccount ?? config.llm?.codexAccountRotationThresholdPercentByAccount,
+        }) };
+      return accessMirror;
+    }
+    accessMirror = null;
+    return accessMirror;
+  };
   if (cwd) {
     failed(targets[0]!, ['project-target-is-local']);
     return null;
@@ -204,8 +257,37 @@ async function tryRemoteParent(args: string[], cwd: string | undefined, context:
       launchHoldActive = readLandingFreeze(prodInstanceRoot())?.holdLaunches === true;
     }
   } catch { launchHoldActive = true; /* 못 읽으면 막힌 것으로(fail-closed) */ }
-  const capacities = Object.fromEntries(multi ? targets.map((target) => [target.host, parentHostModule.readParentHostCapacity(target, deps.ssh)]) : []);
-  const ordered = multi ? parentHostModule.orderParentHosts(targets, context.runId, capacities) : targets;
+  const podGoal = context.substrate === 'pod' ? context.podGoal : undefined;
+  // 부모에서 잰 메모리 선택자만 원격 자식에도 넘긴다. 로컬의 나머지 환경·자격은 SSH 로 복사하지 않는다.
+  const remoteEnv = { ...context.env };
+  // These labels describe an HQ-selected Codex access mirror; never forward an inherited label by itself.
+  delete remoteEnv.ELANOUS_REMOTE_CODEX_ACCOUNT;
+  delete remoteEnv.ELANOUS_REMOTE_CODEX_USED_PERCENT;
+  delete remoteEnv.ELANOUS_REMOTE_CODEX_THRESHOLD_PERCENT;
+  if (podGoal) for (const key of ['ELANOUS_POD_MEMORY_TIER', 'ELANOUS_POD_MEMORY', 'ELANOUS_POD_MEMORY_HIGH', 'ELANOUS_POD_MEMORY_LITE', 'ELANOUS_POD_GOAL_TYPE'] as const) {
+    const value = context.env[key] ?? process.env[key];
+    if (value !== undefined) remoteEnv[key] = value;
+  }
+  const memoryLimit = podGoal ? (await import('../task-orchestrator/surfaces/self-implement-pod.js')).podMemoryLimitFor(podGoal, remoteEnv).limit : undefined;
+  const fits = Object.fromEntries(targets.map((target) => {
+    const fit = memoryLimit
+      ? parentHostModule.readParentHostPodFit(target, memoryLimit, deps.ssh)
+      : { state: 'unmeasured' as const, memoryLimit: '', requiredBytes: null, allocatableBytes: null, reason: 'pod-context-unmeasured' };
+    try { debug.log('task-agent.parent-host', 'pod-fit', { host: target.host, runId: context.runId, ...fit }); } catch { /* fail-soft */ }
+    if (fit.state === 'never-fits') notice(`[parent-host] ${target.host} 제외 — ${fit.reason}: Pod ${fit.memoryLimit} (${fit.requiredBytes} bytes) > node allocatable ${fit.allocatableBytes} bytes`);
+    return [target.host, fit];
+  }));
+  const eligible = targets.filter((target) => fits[target.host]?.state !== 'never-fits');
+  if (!eligible.length) {
+    const details = targets.map((target) => `${target.host}: Pod ${fits[target.host]!.memoryLimit} (${fits[target.host]!.requiredBytes} bytes) > node allocatable ${fits[target.host]!.allocatableBytes} bytes`).join(' · ');
+    throw new Error(`parent-host memory-never-fits — ${details}; local fallback refused`);
+  }
+  const capacities = Object.fromEntries(multi ? eligible.map((target) => [target.host, parentHostModule.readParentHostCapacity(target, deps.ssh)]) : []);
+  const measured = eligible.filter((target) => fits[target.host]?.state === 'fits');
+  const unknown = eligible.filter((target) => fits[target.host]?.state !== 'fits');
+  const ordered = multi
+    ? [...parentHostModule.orderParentHosts(measured, context.runId, capacities), ...parentHostModule.orderParentHosts(unknown, context.runId, capacities)]
+    : eligible;
   for (const target of ordered) {
     if (multi && (!capacities[target.host] || capacities[target.host]!.approvalHeadroom <= 0)) {
       failed(target, ['capacity-unavailable']);
@@ -217,7 +299,27 @@ async function tryRemoteParent(args: string[], cwd: string | undefined, context:
     if (!preflight.ok) { failed(target, preflight.gaps, preflight.facts); continue; }
     if (preflight.warnings.length) notice(`⚠ ${target.host} 자격: ${preflight.warnings.join(' · ')}`);
     try {
-      const launched = parentHostModule.launchRemoteParent(target, args, context.env, deps.ssh);
+      if (parentHostModule.shouldInstallRemoteCodexAccess(context.effectiveChildProvider)) {
+        let mirror: { elanousAuth: string; codexAuth: string; account?: string; usedPercent?: number; thresholdPercent?: number } | null = null;
+        let mirrorReason = 'credential-source-empty';
+        try { mirror = await getAccessMirror(); }
+        catch (error) {
+          if (error instanceof NoEligibleOwnerCodexAccountError) throw error;
+          mirrorReason = 'credential-source-error';
+        }
+        if (mirror) parentHostModule.installRemoteCodexAccess(target, mirror, deps.ssh);
+        else {
+          try { debug.log('task-agent.parent-host', 'codex-access-mirror-unavailable', { host: target.host, runId: context.runId, reason: mirrorReason }); } catch { /* fail-soft */ }
+          failed(target, ['codex-access-mirror-unavailable']);
+          return null;
+        }
+        if (mirror.account) {
+          remoteEnv.ELANOUS_REMOTE_CODEX_ACCOUNT = mirror.account;
+          remoteEnv.ELANOUS_REMOTE_CODEX_USED_PERCENT = mirror.usedPercent === undefined ? 'unknown' : String(mirror.usedPercent);
+          if (mirror.thresholdPercent !== undefined) remoteEnv.ELANOUS_REMOTE_CODEX_THRESHOLD_PERCENT = String(mirror.thresholdPercent);
+        }
+      }
+      const launched = parentHostModule.launchRemoteParent(target, args, remoteEnv, deps.ssh);
       try { debug.log('task-agent', 'parent-host-launched', { host: target.host, runId: context.runId, pid: launched.pid, log: launched.log }); } catch { /* fail-soft */ }
       return { runId: context.runId, parentHost: { host: target.host, ...(target.configDir ? { configDir: target.configDir } : {}), pid: launched.pid, log: launched.log } };
     } catch (error) {
@@ -398,6 +500,7 @@ function taskCardLines(card: TaskCard): string[] {
   return [
     [card.id, card.status, card.seat ?? '-', card.checklistId ?? '-', card.createdAt, card.text].join('\t'),
     ...cardIdentityLines(card),
+    ...(card.targetPaths !== undefined ? [`대상 경로: ${card.targetPaths.length ? card.targetPaths.join(' · ') : '(유효한 경로 없음)'}`] : []),
     ...(card.mission ? [`미션: ${card.mission} · after: ${card.after?.length ? card.after.join(', ') : '-'}`] : []),
     ...runLinkLine(card),
     ...liveMoveLines(card),
@@ -1578,7 +1681,45 @@ export function registerTasksCommands(program: Command, deps: TasksCliDeps = {})
             : {});
           try { debug.log('task-agent', 'remote-rejudge-bind', binding); } catch { /* fail-soft */ }
         }
-        ids = id ? [id] : rejudgeCandidates(readTaskAgentState<{ tasks?: Record<string, TaskCard> }>(statePath).tasks ?? {});
+        if (id) ids = [id];
+        else {
+          const maxAgeHours = (await import('../user-config.js')).getUserConfig().taskAgent?.rejudgeMaxAgeHours ?? 72;
+          const cards = readTaskAgentState<{ tasks?: Record<string, TaskCard> }>(statePath).tasks ?? {};
+          const candidates = rejudgeCandidates(cards, { maxAgeHours, onAgeSkip: (card, ageHours) => {
+            try { debug.log('task-agent', 'rejudge-age-skip', { card: card.id, ageHours, maxAgeHours }); } catch { /* fail-soft */ }
+          } });
+          const { capturedLandReview } = await import('../task-agent/review-result-capture.js');
+          const { defaultPrHead, defaultReviewRepoCandidates } = await import('../task-agent/live-moves.js');
+          const currentHeads = new Map<string, string>();
+          // Priority is a hint, not a gate. Consider only the three newest candidates;
+          // a non-mf0 card still consumes one of those three places. Everyone else runs in age order.
+          const priorityCandidates = candidates.slice(0, 3);
+          let headProbes = 0;
+          for (const cardId of priorityCandidates) {
+            const card = cards[cardId];
+            if (!card || typeof card.pr !== 'object' || !card.pr?.url) continue;
+            const pr = card.pr.number;
+            const lastHead = card.reviewRequests?.filter((entry) => entry.pr === pr).at(-1)?.head;
+            if (!lastHead || capturedLandReview(card, pr, lastHead)?.mustFixCount !== 0) continue;
+            let repos: readonly import('../task-agent/live-moves.js').ReviewRepoCandidate[] = [];
+            try { repos = (deps.rejudge?.live?.repoCandidates ?? defaultReviewRepoCandidates)(card); } catch { /* no trusted repo */ }
+            const repo = repos[0];
+            if (!repo) continue;
+            headProbes++;
+            let view: Awaited<ReturnType<typeof defaultPrHead>>;
+            try { view = await (deps.rejudge?.live?.prHead
+              ? deps.rejudge.live.prHead(pr, repo.cwd)
+              : defaultPrHead(pr, repo.cwd, (args, options) => spawnSync('gh', args, {
+                encoding: 'utf8', timeout: 3_000, env: options.env, ...(options.cwd ? { cwd: options.cwd } : {}),
+              }))); } catch { view = null; }
+            if (view?.state === 'OPEN' && view.url === card.pr.url) currentHeads.set(cardId, view.head);
+          }
+          if (candidates.length > priorityCandidates.length) {
+            try { debug.log('task-agent', 'rejudge-head-priority-probe-cap', { considered: priorityCandidates.length,
+              probed: headProbes, totalCandidates: candidates.length, max: 3 }); } catch { /* fail-soft */ }
+          }
+          ids = rejudgeCandidates(cards, { maxAgeHours, currentHeads });
+        }
       } catch (error) {
         out(error instanceof Error ? error.message : '과제 카드 읽기 실패'); process.exitCode = 1; return;
       }
@@ -1586,6 +1727,8 @@ export function registerTasksCommands(program: Command, deps: TasksCliDeps = {})
       const liveMoves = deps.rejudge?.liveMoves ?? await configuredTaskAgentLiveMoves();
       const repairBudget = opts.all ? { max: (await import('../user-config.js')).getUserConfig().taskAgent?.repairMaxPerTick ?? 3,
         requested: 0, capped: 0 } : undefined;
+      const reviewBudget = opts.all ? { max: 1, requested: 0 } : undefined;
+      const landBudget = opts.all ? { max: 1, requested: 0 } : undefined;
       const all = [];
       for (const cardId of ids) {
         await mirrorRemoteCardLedger(cardId, deps);
@@ -1594,7 +1737,8 @@ export function registerTasksCommands(program: Command, deps: TasksCliDeps = {})
         }
         let outcomes: Awaited<ReturnType<typeof rejudgeCardOnHead>>;
         try { outcomes = await rejudgeCardOnHead(cardId, { ...deps.rejudge, liveMoves,
-          ...(repairBudget ? { repairBudget } : {}), live: { ...deps.rejudge?.live, statePath } }); } catch (error) {
+          ...(repairBudget ? { repairBudget } : {}), ...(reviewBudget ? { reviewBudget } : {}), ...(landBudget ? { landBudget } : {}),
+          live: { ...deps.rejudge?.live, statePath } }); } catch (error) {
           // 카드 하나의 예외가 --all 의 나머지 카드 판단을 멈추지 않게 — 사유를 남기고 다음 카드로.
           const reason = (error instanceof Error ? error.message : String(error)).slice(-300);
           try { debug.log('task-agent', 'rejudge-on-head', { card: cardId, pr: null, fromHead: null, toHead: null, step: 'target', decision: 'rejudge-threw', reason }, { level: 'warn' }); } catch { /* fail-soft */ }