elanous 0.2.35 → 0.2.36

package/src/cli/make-cli.ts

@@ -4,40 +4,276 @@ import { judge } from '../llm/judge-layer.js';
 import { runPluginMake } from './plugin-cli.js';
 import { workflowRun } from './workflow.js';
 
-type MakeKind = 'plugin' | 'workflow';
+export type MakeKind = 'plugin' | 'workflow';
+
+/** A cell the route ruled out, together with the evidence that ruled it out. */
+export type MakeExclusion = { kind: MakeKind; reason: string };
+
+/** A classify-judge answer. It only counts when the judge supplied BOTH
+ *  rationales: a bare `{"kind":"workflow"}` carries no reason and no exclusion
+ *  ground, so the route treats it as an unanswered (unmeasured) request. */
+export type MakeJudgeVerdict = { kind: MakeKind; reason: string; excluded: string };
+
+/** What the production `cli.make/route` path judged for one natural-language request. */
+export type MakeRouteEvidence = {
+  request: string;
+  /** Selected cell, or null when the request carries no usable evidence. */
+  kind: MakeKind | null;
+  /** Which arm produced `kind`. */
+  decidedBy: 'request-evidence' | 'classify-judge' | 'none';
+  /** false means "unmeasured": no rationale existed for any cell. */
+  measured: boolean;
+  /** Why the selected cell won. Never empty; a judge row quotes the judge's own reason verbatim. */
+  reason: string;
+  /** Phrases from the request that support the selected cell. A judge-decided row
+   *  carries a `judge:<kind>` marker instead: the request had no phrases to cite. */
+  signals: string[];
+  /** Every cell that was not selected, with the reason it was excluded. */
+  excluded: MakeExclusion[];
+};
+
+type JudgeCall = (args: { prompt: string; provider: string; model: string }) => Promise<{ text: string }>;
+
 type MakeDeps = {
-  decide?: (request: string) => Promise<MakeKind | null>;
+  /** Test-only classify transport: only ever throws, so it can never deliver an answer. */
+  judgeCall?: JudgeCall;
   pluginMake?: (request: string) => Promise<void>;
   workflowMake?: (request: string) => Promise<number>;
 };
 
-export async function classifyMakeRequest(request: string, call?: (args: { prompt: string; provider: string; model: string }) => Promise<{ text: string }>): Promise<MakeKind | null> {
+const CELL_LABEL: Record<MakeKind, string> = { plugin: '플러그인', workflow: '워크플로' };
+
+const OTHER_CELL: Record<MakeKind, MakeKind> = { plugin: 'workflow', workflow: 'plugin' };
+
+/** A request that names a cell explicitly outranks every softer signal. */
+const NAMED_CELL_WORDS: Record<MakeKind, readonly string[]> = {
+  plugin: ['플러그인', 'plugin'],
+  workflow: ['워크플로', 'workflow'],
+};
+
+/** Signal words that must not fire when every occurrence lives inside a longer
+ *  compound: `메일` inside `이메일` is an email-domain word, not a mailing task,
+ *  so '이메일 파싱 API' must not reach the workflow cell through it. */
+const COMPOUND_GUARDS: ReadonlyArray<{ word: string; inside: string }> = [
+  { word: '메일', inside: '이메일' },
+  { word: '로드', inside: '업로드' },
+];
+
+/** Request phrases that point at each cell. Workflow is the upper cell: a workflow
+ *  may use a connector, so its signals win over connector signals.
+ *
+ *  판정 기준(위에서 아래로):
+ *  1. 이름 지목 — '플러그인/plugin', '워크플로/workflow' 가 직접 나오면 그 칸.
+ *  2. 합성어 가드 — 신호 단어가 더 긴 합성어 안에만 있으면(예: '메일' ⊂ '이메일')
+ *     그 단어는 신호로 치지 않는다. '이메일 파싱 API' 는 이메일 도메인 처리
+ *     요청이지 메일 발송 워크플로가 아니다.
+ *  3. 가드를 통과한 신호가 한쪽에만 있으면 그 칸을 채택한다.
+ *  4. 양쪽에 신호가 남아 있으면(충돌) 상위 칸 워크플로가 하위 칸 플러그인을
+ *     흡수한다 — 워크플로는 커넥터를 부품으로 쓸 수 있지만 그 반대는 안 된다. */
+const CELL_WORDS: Record<MakeKind, readonly string[]> = {
+  plugin: [
+    '읽', '파싱', 'parse', '불러', 'load', '로드', '열어', '변환', 'convert', '추출', 'extract',
+    '연동', '연결', '커넥터', 'connector', '스킬', 'skill', '도구', 'tool', 'api', '조회',
+    'ocr', 'hwp', 'pdf', 'xlsx', 'docx', 'csv', 'json', '이미지', '사진', '엑셀', '워드',
+    '번역', 'translate', '검색', 'search',
+  ],
+  workflow: [
+    '매일', '매주', '매월', '매년', '매시간', '매번', '정기', '주기적', '스케줄', 'schedule',
+    'cron', '크론', '반복', 'daily', 'weekly', 'hourly', 'every ',
+    '올려', '올리', '게시', '발행', '포스팅', '업로드', 'upload', '배포', 'deploy', 'publish',
+    '보내', '전송', 'send', '알림', 'notify', '메일',
+    '하고 나서', '그다음', '순서대로', '단계별', '파이프라인', 'pipeline', '자동화', 'automation',
+    '자동으로', '일괄', 'batch', '모아', '수집해서', '시리즈',
+  ],
+};
+
+function countOccurrences(text: string, needle: string): number {
+  let count = 0;
+  let at = text.indexOf(needle);
+  while (at >= 0) {
+    count += 1;
+    at = text.indexOf(needle, at + needle.length);
+  }
+  return count;
+}
+
+function matchWords(text: string, words: readonly string[]): string[] {
+  const hits: string[] = [];
+  for (const word of words) {
+    if (!text.includes(word)) continue;
+    const guarded = COMPOUND_GUARDS.some(
+      g => g.word === word && countOccurrences(text, g.inside) >= countOccurrences(text, word),
+    );
+    if (!guarded) hits.push(word);
+  }
+  return hits;
+}
+
+/** Deterministic judgement over the request text: picks a cell and says why it won
+ *  and why the sibling cell lost. Runs before any model call, so the route always
+ *  has a rationale to report. */
+function evidenceFromRequest(request: string): MakeRouteEvidence {
+  const text = request.toLowerCase();
+  const pluginWords = matchWords(text, CELL_WORDS.plugin);
+  const workflowWords = matchWords(text, CELL_WORDS.workflow);
+  const namedPlugin = matchWords(text, NAMED_CELL_WORDS.plugin);
+  const namedWorkflow = matchWords(text, NAMED_CELL_WORDS.workflow);
+  const named: MakeKind | null = namedPlugin.length && !namedWorkflow.length
+    ? 'plugin'
+    : namedWorkflow.length && !namedPlugin.length ? 'workflow' : null;
+
+  let kind: MakeKind | null = null;
+  let reason: string;
+  let signals: string[] = [];
+
+  if (named) {
+    kind = named;
+    signals = named === 'plugin' ? namedPlugin : namedWorkflow;
+    reason = `요청이 ${CELL_LABEL[named]} 칸을 이름으로 지목(${signals.join(', ')}) — 명시 지목이 최상위 근거`;
+  } else if (workflowWords.length) {
+    kind = 'workflow';
+    signals = workflowWords;
+    reason = `반복·게시·시퀀스 신호(${workflowWords.join(', ')}) — 상위 칸 워크플로 채택`;
+  } else if (pluginWords.length) {
+    kind = 'plugin';
+    signals = pluginWords;
+    reason = `커넥터·역량·형식 신호(${pluginWords.join(', ')}) — 하위 칸 플러그인 채택`;
+  } else {
+    reason = '필수 근거 없음 — 요청에서 플러그인·워크플로 신호를 찾지 못했다';
+  }
+
+  const excluded: MakeExclusion[] = [];
+  if (kind === 'workflow') {
+    excluded.push({
+      kind: 'plugin',
+      reason: [
+        named === 'workflow'
+          ? `요청이 워크플로를 이름으로 지목(${namedWorkflow.join(', ')})`
+          : `반복·게시·시퀀스 신호(${workflowWords.join(', ')})`,
+        pluginWords.length
+          ? `플러그인 신호(${pluginWords.join(', ')})는 커넥터 단품이라 상위 칸에 흡수`
+          : '플러그인 신호 0건',
+      ].join(' · '),
+    });
+  } else if (kind === 'plugin') {
+    excluded.push({
+      kind: 'workflow',
+      reason: [
+        named === 'plugin'
+          ? `요청이 플러그인을 이름으로 지목(${namedPlugin.join(', ')})`
+          : `커넥터·역량 신호(${pluginWords.join(', ')})`,
+        workflowWords.length
+          ? `워크플로 신호(${workflowWords.join(', ')})가 있으나 단품 칸이 채택`
+          : '워크플로 신호 0건',
+      ].join(' · '),
+    });
+  } else {
+    excluded.push(
+      { kind: 'plugin', reason: '플러그인 신호 0건 — 필수 근거 없음' },
+      { kind: 'workflow', reason: '워크플로 신호 0건 — 필수 근거 없음' },
+    );
+  }
+
+  return {
+    request,
+    kind,
+    decidedBy: kind ? 'request-evidence' : 'none',
+    measured: kind !== null,
+    reason,
+    signals,
+    excluded,
+  };
+}
+
+export async function classifyMakeRequest(request: string, call?: JudgeCall): Promise<MakeJudgeVerdict | null> {
   if (!request.trim()) return null;
-  const result = await judge<MakeKind>({
+  const result = await judge<MakeJudgeVerdict>({
     site: 'cli.make',
     ...(call ? { call } : {}),
-    prompt: `Classify this request for an Elanous creator. Choose "plugin" for a reusable connector, integration, skill, or capability (including reading a file format). Choose "workflow" for a sequence of jobs, recurring schedule, automation, or publishing task, even when it uses a connector. If you cannot decide, return {"kind":"unclear"}. Respond with JSON only, exactly {"kind":"plugin"} or {"kind":"workflow"} or {"kind":"unclear"}. Do not execute the request.\nRequest: ${JSON.stringify(request)}`,
+    prompt: `Classify this request for an Elanous creator. Choose "plugin" for a reusable connector, integration, skill, or capability (including reading a file format). Choose "workflow" for a sequence of jobs, recurring schedule, automation, or publishing task, even when it uses a connector. Respond with JSON only, exactly {"kind":"plugin"|"workflow","reason":"<한 문장: 이 칸을 고른 근거>","excluded":"<한 문장: 다른 칸을 뺀 근거>"}. Return {"kind":"unclear"} when you cannot decide. An answer missing either rationale field is rejected as unmeasured. Do not execute the request.\nRequest: ${JSON.stringify(request)}`,
     schema: value => {
       if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
       const kind = (value as { kind?: unknown }).kind;
-      return kind === 'plugin' || kind === 'workflow' ? kind : null;
+      if (kind !== 'plugin' && kind !== 'workflow') return null;
+      const reason = (value as { reason?: unknown }).reason;
+      const excluded = (value as { excluded?: unknown }).excluded;
+      if (typeof reason !== 'string' || !reason.trim()) return null;
+      if (typeof excluded !== 'string' || !excluded.trim()) return null;
+      return { kind, reason: reason.trim(), excluded: excluded.trim() };
     },
   });
   return result.ok ? result.value : null;
 }
 
+/** Production judgement path for `elanous make`: request evidence first, the
+ *  classify judge only when the request carries no evidence at all. A judge
+ *  answer without both rationales is reported as unmeasured, never as success;
+ *  `skipJudge` leaves the judge uncalled so --route-only dumps stay
+ *  deterministic (no model call, no dispatch). */
+export async function routeMakeRequest(
+  request: string,
+  opts: { call?: JudgeCall; skipJudge?: boolean } = {},
+): Promise<MakeRouteEvidence> {
+  const evidence = evidenceFromRequest(request);
+  if (evidence.measured) return evidence;
+
+  let verdict: MakeJudgeVerdict | null = null;
+  let note: string;
+  if (opts.skipJudge) {
+    note = '판정기 호출 생략(증거 전용 경로)';
+  } else {
+    try {
+      verdict = await classifyMakeRequest(request, opts.call);
+      note = verdict
+        ? `classify judge 가 ${CELL_LABEL[verdict.kind]} 를 근거와 함께 반환`
+        : 'classify judge 가 근거 있는 판정을 반환하지 않음';
+    } catch (err) {
+      note = `classify judge 호출 실패(${err instanceof Error ? err.message : String(err)})`;
+    }
+  }
+
+  if (!verdict) {
+    return { ...evidence, decidedBy: 'none', measured: false, reason: `${evidence.reason} · ${note}` };
+  }
+  const other = OTHER_CELL[verdict.kind];
+  return {
+    request,
+    kind: verdict.kind,
+    decidedBy: 'classify-judge',
+    measured: true,
+    reason: `요청 근거 없음(플러그인·워크플로 신호 0건) → ${note} — ${CELL_LABEL[verdict.kind]} 칸 채택 · 판정기 근거: ${verdict.reason}`,
+    signals: [`judge:${verdict.kind}`],
+    excluded: [{ kind: other, reason: `요청 근거 없음 · 판정기 배제 근거: ${verdict.excluded}` }],
+  };
+}
+
 export function registerMakeCommand(program: Command, deps: MakeDeps = {}): void {
   program.command('make <request>')
     .description('Classify a one-line request and make a plugin or build a workflow')
-    .action(async (request: string) => {
-      const kind = await (deps.decide ?? classifyMakeRequest)(request).catch(() => null);
-      debug.log('cli.make', 'route', { kind: kind ?? 'undecided' });
-      if (!kind) {
+    .option('--route-only', 'print the cli.make/route evidence JSON and exit — no judge call, no plugin or workflow dispatch')
+    .action(async (request: string, opts: { routeOnly?: boolean }) => {
+      const evidence = await routeMakeRequest(request, {
+        ...(deps.judgeCall ? { call: deps.judgeCall } : {}),
+        ...(opts.routeOnly ? { skipJudge: true } : {}),
+      });
+      debug.log('cli.make', 'route', evidence);
+      if (!evidence.measured) {
+        debug.log('cli.make', 'route-unmeasured', {
+          request: evidence.request,
+          reason: evidence.reason,
+          excluded: evidence.excluded,
+        });
+      }
+      if (opts.routeOnly) {
+        console.log(JSON.stringify(evidence));
+        return;
+      }
+      if (!evidence.kind) {
         console.log('플러그인(커넥터·스킬)을 만들까요, 워크플로(잡)를 만들까요?');
         process.exitCode = 1;
         return;
       }
-      if (kind === 'plugin') await (deps.pluginMake ?? runPluginMake)(request);
+      if (evidence.kind === 'plugin') await (deps.pluginMake ?? runPluginMake)(request);
       else process.exitCode = await (deps.workflowMake ?? ((text: string) => workflowRun('build-workflow', text)))(request);
     });
 }

package/src/cli/msg-cli.ts

@@ -1,9 +1,16 @@
 import type { Command } from 'commander';
 import { ensureAuthToken } from '../auth/acp-token.js';
+import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { canonicalSeatId, openMsgStore, openMsgStoreReadOnly, type Message, type MsgStore } from '../msg/msg-store.js';
+import { clearPostOffice, ensurePostOffice, writePostOffice } from '../msg/msg-post-office.js';
 import { startMsgSseServer } from '../msg/msg-sse-server.js';
+import type { AgentReplyAddress, AgentReplyInput, AgentReplyResult } from '../loops/agent-reply.js';
 import { messageRouteFor, noReplyBodyNotice, unsupportedLoopAddressNotice } from '../loops/msg-address.js';
 import { resolveWake, wakeRecipient, type WakeDeps, type WakeOutcome } from '../loops/msg-wake.js';
+import type { RoleLlmSpec } from '../user-config.js';
+
+/** The loop rows whose reply body is an LLM agent: `--agent-reply` picks one of these. */
+const AGENT_REPLY_ROLES = { COORDINATOR: 'coordinator', GUARDIAN: 'guardian' } as const;
 
 export interface MsgCliDeps {
   openStore?: () => MsgStore;
@@ -21,6 +28,24 @@ export interface MsgCliDeps {
   registerLogSink?: () => Promise<unknown>;
   /** Wake the recipient after a durable post; never changes the post outcome. */
   wake?: (address: string, msgId: number, message: { from: string; kind?: string }, deps: WakeDeps) => Promise<WakeOutcome>;
+  /**
+   * Agent auto-reply producer (`--agent-reply`). The default resolves the selected role LLM, loads its pack,
+   * and calls the real `replyWithAgent`; the seams exist so a test still traverses that producer.
+   */
+  agentReply?: {
+    role?: RoleLlmSpec;
+    pack?: string;
+    /** Test seam: a fake turn still goes through `replyWithAgent` and its ledger transaction. */
+    runAgent?: AgentReplyInput['runAgent'];
+    /** Test seam for the role ladder — `undefined` means «역할 LLM 미설정». */
+    resolveRole?: (address: AgentReplyAddress) => RoleLlmSpec | undefined;
+    observationRoot?: string;
+  };
+  /** `msg serve --sse` discovery file root (default: the state root). `msg post` restarts a dead service found here. */
+  postOfficeStateRoot?: string;
+  postOfficeAlive?: (pid: number) => boolean;
+  postOfficeProbe?: (url: string) => Promise<boolean>;
+  postOfficeLaunch?: (input: { port: number }) => void;
   /** Test seams for the existing self-send transport and the selected task-card ledger. */
   readCard?: typeof import('../task-agent/task-hand.js').readTaskCard;
   podFragmentsForRun?: typeof import('../harness/self-send-target.js').listPodFragmentsForRun;
@@ -160,16 +185,94 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
     if (json) out.log(JSON.stringify(value));
     else human();
   };
+  const officeRoot = () => deps.postOfficeStateRoot ?? elanousStateRoot();
+
+  /** `--agent-reply <address>` — only the loop rows that answer with an LLM body. */
+  const agentReplyAddress = (raw: string | undefined): AgentReplyAddress | null => {
+    if (raw === undefined) return null;
+    const name = raw.trim().toUpperCase();
+    if (!Object.hasOwn(AGENT_REPLY_ROLES, name)) throw new Error('--agent-reply must be COORDINATOR or GUARDIAN');
+    return name as AgentReplyAddress;
+  };
+  const requireAgentTarget = (address: AgentReplyAddress, to: string): void => {
+    if (address !== to) throw new Error(`--agent-reply ${address} requires --to ${address}`);
+  };
+
+  /**
+   * Human-free live conversation: the selected address's LLM body answers the message that was just saved.
+   * The durable ledger stays authoritative — `replyWithAgent` owns the one-reply-per-request transaction and
+   * its dedupe, so a retry finds the existing link instead of generating again. A failure never changes the
+   * post's exit code; it is reported as one line on stderr.
+   */
+  const autoReply = async (address: AgentReplyAddress, request: Message, json: boolean | undefined): Promise<void> => {
+    const seam = deps.agentReply;
+    let role = seam?.role;
+    if (role === undefined) {
+      if (seam?.resolveRole) role = seam.resolveRole(address);
+      else {
+        const { resolveConfiguredAgentRoleLlm } = await import('../user-config.js');
+        // Only an explicitly selected provider/tier/model starts an agent body; effort alone is not a selection.
+        role = resolveConfiguredAgentRoleLlm(AGENT_REPLY_ROLES[address]);
+      }
+    }
+    if (role === undefined) {
+      out.error(`msg: ${address} 역할 LLM 미설정 — 자동 답 없음`);
+      return;
+    }
+    let pack = seam?.pack;
+    if (pack === undefined) {
+      try {
+        const { loadAgentRolePack } = await import('../loops/agent-reply.js');
+        pack = loadAgentRolePack(AGENT_REPLY_ROLES[address]);
+      } catch (error) {
+        out.error(`msg: ${address} 역할 팩 없음 — 자동 답 없음: ${error instanceof Error ? error.message : String(error)}`);
+        return;
+      }
+    }
+    try {
+      const { replyWithAgent } = await import('../loops/agent-reply.js');
+      const store = open();
+      let result: AgentReplyResult;
+      try {
+        result = await replyWithAgent({ address, role, pack, store,
+          request: { id: request.id, from: request.from, body: request.body,
+            ...(request.kind === undefined ? {} : { kind: request.kind }) },
+          ...(seam?.runAgent ? { runAgent: seam.runAgent } : {}),
+          ...(seam?.observationRoot ? { observationRoot: seam.observationRoot } : {}) });
+      } finally { store.close(); }
+      emit({ agentReply: { address, requestId: request.id, ...result } }, json,
+        () => out.log(`자동 답 ${result.replyId === null ? '없음' : `#${result.replyId}`} (${address} → ${request.from})${result.posted ? '' : ' — 이미 있음'}`));
+    } catch (error) {
+      out.error(`msg: 자동 답 실패: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  };
+
+  /**
+   * Installed post-office supervision: a registered `msg serve --sse` that no longer answers is restarted on
+   * its recorded port. Nothing is spawned when no service registered itself, so a plain post is unchanged.
+   */
+  const supervisePostOffice = async (): Promise<void> => {
+    const result = await ensurePostOffice({ stateRoot: officeRoot(),
+      ...(deps.postOfficeAlive ? { alive: deps.postOfficeAlive } : {}),
+      ...(deps.postOfficeProbe ? { probe: deps.postOfficeProbe } : {}),
+      ...(deps.postOfficeLaunch ? { launch: deps.postOfficeLaunch } : {}) });
+    if (result.state === 'restarted')
+      out.error(`msg: post office 재시작 (port ${result.port}) — 원장이 정본이라 저장된 글은 다시 밀린다`);
+  };
 
   msg.command('post [body]').description('Post a message; use - or omit body to read stdin')
     .option('--from <seat>').option('--to <seat>').option('--kind <kind>').option('--body <text>')
     .option('--reply-to <id>', 'point this reply at a question message ID')
+    .option('--agent-reply <address>', 'let this address\'s agent body (COORDINATOR · GUARDIAN) answer the saved message once')
     .option('--origin-key <key>', 'deduplicate a channel mirror by coord:<commentId>:<recipient>').option('--json')
-    .action((body: string | undefined, opts: CommonOptions & { from?: string; to?: string; kind?: string; body?: string; replyTo?: string; originKey?: string }) => run(async () => {
+    .action((body: string | undefined, opts: CommonOptions & { from?: string; to?: string; kind?: string; body?: string; replyTo?: string; originKey?: string; agentReply?: string }) => run(async () => {
       const from = seat(opts.from, '--from');
       const unsupported = opts.to === undefined ? null : unsupportedLoopAddressNotice(opts.to);
       if (unsupported) out.error(unsupported);
       const to = seat(opts.to, '--to');
+      // Validate the auto-reply target before saving — a mismatched flag must not leave a stored message behind.
+      const agentAddress = agentReplyAddress(opts.agentReply);
+      if (agentAddress !== null) requireAgentTarget(agentAddress, to);
       if (body !== undefined && body !== '-' && opts.body !== undefined) throw new Error('provide body once (argument or --body)');
       const text = opts.body ?? (body !== undefined && body !== '-' ? body : await readStdin());
       const envelope = { from, to, body: text,
@@ -192,10 +295,14 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
           new Promise<void>(resolve => { sinkTimer = setTimeout(resolve, 1000); }),
         ]).finally(() => clearTimeout(sinkTimer));
       } catch { /* observability is fail-open */ }
+      // 설치본을 갈아 끼우면 우편국(SSE)은 조용히 사라진다 — 등록해 둔 서비스가 응답하지 않으면 같은 포트로 다시 띄운다.
+      // 재시작도 관측도 post 의 성패를 바꾸지 않는다.
+      try { await supervisePostOffice(); } catch { /* post office is fail-open */ }
       try {
         await (deps.wake ?? wakeRecipient)(to, posted.id, { from, ...(opts.kind === undefined ? {} : { kind: opts.kind }) },
           { ...deps.wakeDeps, warn: noBody ? () => {} : line => out.error(line) });
       } catch { /* the wake outcome is logged by wakeRecipient; the post is already durable */ }
+      if (agentAddress !== null) await autoReply(agentAddress, posted, opts.json);
     })());
 
   msg.command('route <address>').description('Show how a post to this address is read (replyBody) and woken (wake)')
@@ -344,11 +451,14 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
 
   msg.command('ask <recipient> <question>').description('Post a question and wait for its first reply')
     .option('--from <seat>', 'asking seat (required)').option('--wait <seconds>', 'seconds to wait for a reply (default 60)', '60')
+    .option('--agent-reply <address>', 'let this address\'s agent body (COORDINATOR · GUARDIAN) answer before waiting')
     .option('--json')
-    .action((recipient: string, question: string, opts: CommonOptions & { from?: string; wait?: string }) => run(async () => {
+    .action((recipient: string, question: string, opts: CommonOptions & { from?: string; wait?: string; agentReply?: string }) => run(async () => {
       const from = seat(opts.from, '--from');
       const to = canonicalSeatId(recipient);
       const waitSeconds = integer(opts.wait, '--wait', 60, 0, 86400);
+      const agentAddress = agentReplyAddress(opts.agentReply);
+      if (agentAddress !== null) requireAgentTarget(agentAddress, to);
       const interrupt = deps.signal === undefined ? new AbortController() : undefined;
       const signal = deps.signal ?? interrupt!.signal;
       const onInterrupt = () => interrupt?.abort();
@@ -362,6 +472,8 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
         emit(asked, opts.json, () => out.log(`#${asked.id}`));
         // msg ask uses the same saved-message handler before waiting for its linked reply.
         await handleTaMessage(asked);
+        // 사람 없는 live 대화: 답할 몸이 있으면 «기다리기 전»에 답을 원장에 남긴다 — 같은 대기 루프가 그 답을 집는다.
+        if (agentAddress !== null) await autoReply(agentAddress, asked, opts.json);
         const deadline = Date.now() + waitSeconds * 1000;
         let reply: Message | undefined;
         store = open();
@@ -419,8 +531,10 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
       try {
         const service = startMsgSseServer({ store, token: (deps.authToken ?? (() => ensureAuthToken().token))(),
           port, hostname: opts.host });
+        // 발견 줄 — 설치본을 갈아 끼운 뒤 `msg post` 가 이 줄을 읽어 죽은 서비스를 같은 포트로 다시 띄운다.
+        writePostOffice(officeRoot(), { port: service.port });
         out.log(`msg SSE listening on ${opts.host}:${service.port}`);
-        const stop = () => { service.stop(); store.close(); };
+        const stop = () => { service.stop(); store.close(); clearPostOffice(officeRoot()); };
         process.once('SIGINT', stop);
         process.once('SIGTERM', stop);
       } catch (error) { store.close(); throw error; }

package/src/cli/pr-cli.ts

@@ -62,8 +62,8 @@ import { admitLandingMerge } from '../self-implement/frozen-merges.js';
 import { resolveOverlapEvidencePath, verifyAllSameHeadReviews, verifyAncestorAutoPass, verifyOverlapEvidence, verifyOverlapEvidenceVirtualRebase } from './pr-land-overlap-evidence.js';
 import type { VerifyOverlapEvidenceInput } from './pr-land-overlap-evidence.js';
 import { verifyVirtualRebasePatch } from './pr-land-virtual-rebase.js';
-import { observeDirectPrLandRefusal, observePrLandRefusal } from './pr-land-refusal.js';
-import { planPrLandRecovery } from './pr-land-recovery.js';
+import { classifyPrLandRefusal, observeDirectPrLandRefusal, observePrLandRefusal } from './pr-land-refusal.js';
+import { bindPrLandRefusalToRecover, PR_LAND_CARD_ID_ENV } from './pr-land-recovery.js';
 import { ensurePrLandHeavyRemote, type HeavyRemoteInput, type HeavyRemoteResult } from './pr-land-heavy-remote.js';
 import { readPrBaseNameWithRetry } from './pr-land-base-read.js';
 import { runHeavyOnPodShadow } from './pr-land-pod-shadow.js';
@@ -1319,26 +1319,39 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   };
   // Observe actual merge refusals, including the measured remote gate and public export leak.
   // Option syntax and unmeasured prerequisite errors do not describe a recovery edge.
+  // LAND-REFUSAL-EDGES — a pinned refusal is also bound to the recover@1 edge with its raw line and card.
+  // The card arrives only through the child env set by TA defaultLand — never a shell export.
+  const cardId = process.env[PR_LAND_CARD_ID_ENV]?.trim() || undefined;
+  const bindRecover = (message: string, context: { isDraft?: boolean } = {}) => {
+    const pr = Number(opts.pr);
+    if (!Number.isSafeInteger(pr) || pr <= 0 || !opts.expectedHead) return undefined;
+    try { return bindPrLandRefusalToRecover({ refusal: message, pr, head: opts.expectedHead, isDraft: context.isDraft, cardId }); }
+    catch { return undefined; }
+  };
   const refuse = (message: string, context: { isDraft?: boolean } = {}): void => {
     out.error(message);
     observePrLandRefusal(message, context);
-    const pr = Number(opts.pr);
-    if (Number.isSafeInteger(pr) && pr > 0 && opts.expectedHead) {
-      try {
-        const plan = planPrLandRecovery({ refusal: message, pr, head: opts.expectedHead, isDraft: context.isDraft });
-        debug.log('pr.land', 'recover-shadow', {
-          pr, head: opts.expectedHead, label: plan.evidence.label, route: plan.evidence.route,
-          outcome: plan.outcome, action: plan.result.action, reason: plan.result.reason,
-          delayMs: plan.result.delayMs ?? null, execution: 'none',
-        });
-      } catch {
-        // Recovery observation must never replace the original landing refusal.
-      }
+    const plan = bindRecover(message, context);
+    if (!plan) return;
+    try {
+      debug.log('pr.land', 'recover-shadow', {
+        pr: Number(opts.pr), head: opts.expectedHead, label: plan.evidence.label, route: plan.evidence.route,
+        outcome: plan.outcome, action: plan.result.action, reason: plan.result.reason,
+        delayMs: plan.result.delayMs ?? null, execution: 'none',
+      });
+    } catch {
+      // Recovery observation must never replace the original landing refusal.
     }
   };
+  // A direct failure binds only when today's refusal shape is recognized — the same measured sample
+  // as observeDirectPrLandRefusal (#28939). An unclassified direct error is not a landing refusal.
+  const observeDirect = (message: string): void => {
+    observeDirectPrLandRefusal(message);
+    if (classifyPrLandRefusal(message) !== 'other') bindRecover(message);
+  };
   const refuseDirect = (message: string): void => {
     out.error(message);
-    observeDirectPrLandRefusal(message);
+    observeDirect(message);
   };
   if (opts.title !== undefined && opts.titleFile !== undefined) {
     out.error('✗ title: --title과 --title-file은 함께 사용할 수 없습니다.');
@@ -2043,7 +2056,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   nextMdWarning(body ?? '', changedPaths, out);
   if (!conflictMarkerBlock(changedPaths, cwd, out)) return 1;
   publicLeakWarning(changedPaths, deps.runPublicLeakGate ?? ((files, sink) => runPrLandPublicLeakGate(files, sink, cwd, base)), out);
-  if (!exportLeakBlock(changedPaths, () => (deps.runExportLeakCheck ?? runPrLandExportLeakCheck)(changedPaths ?? [], cwd), opts.allowPublicLeak === true, out, cwd, observeDirectPrLandRefusal)) return 1;
+  if (!exportLeakBlock(changedPaths, () => (deps.runExportLeakCheck ?? runPrLandExportLeakCheck)(changedPaths ?? [], cwd), opts.allowPublicLeak === true, out, cwd, observeDirect)) return 1;
   if (!await exportImportBlock(changedPaths, () => (deps.runExportImportCheck ?? runPrLandExportImportCheck)(changedPaths ?? [], cwd), out)) return 1;
   if (publicDocPaths(changedPaths, () => true).length > 0) {
     const top = run('git', ['rev-parse', '--show-toplevel'], { cwd });

package/src/cli/pr-land-base-read.ts

@@ -1,7 +1,16 @@
 import type { CmdRunner } from '../autopilot/pr-manager.js';
 
 export const PR_LAND_BASE_READ_RETRIES = 2;
-export const PR_LAND_BASE_READ_RETRY_DELAY_MS = 100;
+/** Increasing backoff: 1s after the first unreadable read, 3s after the second (OPT #24215). */
+export const PR_LAND_BASE_READ_RETRY_DELAYS_MS = [1_000, 3_000] as const;
+/** Fixed ceiling: no retry sleep ever exceeds the last scheduled delay. */
+export const PR_LAND_BASE_READ_RETRY_DELAY_CAP_MS = 3_000;
+
+/** Backoff for the sleep that follows `attempt`; the schedule stops growing at the cap. */
+export function prLandBaseReadRetryDelayMs(attempt: number): number {
+  const index = Math.min(Math.max(attempt, 1), PR_LAND_BASE_READ_RETRY_DELAYS_MS.length) - 1;
+  return Math.min(PR_LAND_BASE_READ_RETRY_DELAYS_MS[index], PR_LAND_BASE_READ_RETRY_DELAY_CAP_MS);
+}
 
 export interface PrBaseReadResult {
   baseRefName: string | null;
@@ -30,7 +39,7 @@ export async function readPrBaseNameWithRetry(input: {
 
     if (baseRefName !== null) return { baseRefName, attempts: attempt };
     input.onUnreadable?.(attempt, viewed.err);
-    if (attempt <= PR_LAND_BASE_READ_RETRIES) await input.sleep(PR_LAND_BASE_READ_RETRY_DELAY_MS);
+    if (attempt <= PR_LAND_BASE_READ_RETRIES) await input.sleep(prLandBaseReadRetryDelayMs(attempt));
   }
   return { baseRefName: null, attempts: PR_LAND_BASE_READ_RETRIES + 1 };
 }

package/src/cli/pr-land-heavy-remote.ts

@@ -8,8 +8,11 @@ import { debug, redactSecretText } from '../debug/log.js';
 import { gateRemoteHostCap, realGateRemoteRunner, resolveGateRemoteSettings, runOnRemote, type GateRemoteRunner, type RemoteRunOutcome } from '../self-implement/gate-remote.js';
 
 const SHA = /^[0-9a-f]{40}$/i;
-// WSL is excluded until its push permissions and gate environment are proven stable.
-export const PR_LAND_HEAVY_HOSTS = ['node-b', 'node-c'] as const;
+// WSL still lands last: its gate environment was repaired (WSL-GATE-ENV, 2026-10-17 — baselineWorkspaceRoot in
+// scripts/ci-typecheck-changed.ts now picks the host disk /var/tmp instead of WSL's 20GiB tmpfs), so the host is
+// allowlisted as the third slot while node-b/node-c keep discovery order — the recorded host order stays part of the
+// evidence contract.
+export const PR_LAND_HEAVY_HOSTS = ['node-b', 'node-c', 'host-e-wsl'] as const;
 export const PR_LAND_HEAVY_HOST = PR_LAND_HEAVY_HOSTS[0];
 export type PrLandHeavyHost = typeof PR_LAND_HEAVY_HOSTS[number];
 const allowedHost = (host: string): host is PrLandHeavyHost => PR_LAND_HEAVY_HOSTS.some((candidate) => candidate === host);
@@ -234,7 +237,7 @@ export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemo
       // A completed run or infrastructure failure is a verdict. Only a full host slot asks for another host.
       if (outcome.kind !== 'busy') break wait;
     }
-    // Both allowlisted hosts were busy. Wait the same slotWaitSeconds window as self gate, then retry.
+    // Every allowlisted host was busy. Wait the same slotWaitSeconds window as self gate, then retry.
     debug.log('pr.land', 'host-busy', { host: selectedHost, occupied: outcome.occupied ?? null, slotWaitSeconds: settings.slotWaitSeconds });
     const left = deadline - now();
     if (left <= 0) break;