elanous 0.2.36 → 0.2.37

package/src/loops/checker.ts

@@ -33,6 +33,9 @@ export interface CheckEntry {
   expectedVersion?: string;
   /** Registry graph path, supplied only by graph inventory. */
   file?: string;
+  /** LOOP-PRUNE-1021-FU 판정 재료 — cron-shell·미등록 행이 실은 crontab 명세(그래프 루프에는 없다). */
+  cron?: string;
+  command?: string;
   enabled: boolean;
   registered: boolean;
 }
@@ -317,3 +320,100 @@ export function observeLoopCheck(results: CheckResult[], scope: LoopScope, deps:
   catch (error) { if (existsSync(tmp)) unlinkSync(tmp); throw error; }
   return counts;
 }
+
+// ── LOOP-PRUNE-1021-FU 정리 판정 (내부 문서 `loop-lineage-1021` · 0.2.36) ─────
+/** 무실행 은퇴 한계 — off 상태가 원장으로 최근 14일 실행이 증명될 때만 은퇴 후보가 된다. */
+export const PRUNE_IDLE_DAYS = 14;
+/** 활성 루프 상한 — alive 가 25 를 넘으면 접기·은퇴 판정을 먼저 치른다. */
+export const PRUNE_ALIVE_LIMIT = 25;
+
+export interface PruneFoldGroup { family: string; ids: string[]; }
+export interface PruneUnregisteredRow { id: string; cron?: string; command?: string; }
+export interface PruneJudgment {
+  /** 14일 무실행이 원장으로 증명된 은퇴 후보(off). */
+  idleRetire: string[];
+  /** 실행 기록이 없어 무실행을 증명할 수 없는 항목 — 은퇴 후보에서 제외한다. */
+  idleUnproven: string[];
+  /** 등록되지 않은 elanous 크론 행 — 등록/제거 판정에 넘긴다. */
+  unregistered: PruneUnregisteredRow[];
+  /** 같은 일을 하는 elanous:* 형제 슬롯 가족 — 그래프 루프·원장 해시는 접지 않는다. */
+  foldGroups: PruneFoldGroup[];
+  /** 활성 루프 수와 25 한도 판정. */
+  alive: { count: number; limit: number; within: boolean };
+  /** 운영 이름이 없는 원장 해시 id — 명명 대상. */
+  unnamed: string[];
+}
+
+/** elanous:* 슬롯의 가족 이름 — namedCronIds 의 -N 접미와 자리 슬롯(:SEAT)을 원래 가족으로 되돌린다. */
+function pruneFoldFamily(id: string): string | undefined {
+  if (!id.startsWith('elanous:')) return undefined;
+  const seat = /^elanous:([^:]+):[^:]+$/.exec(id);
+  if (seat) return `elanous:${seat[1]}`;
+  const sibling = /^elanous:(.+)-\d+$/.exec(id);
+  return `elanous:${sibling ? sibling[1] : id.slice('elanous:'.length)}`;
+}
+
+/** LOOP-PRUNE-1021-FU — CheckResult 원장 위에서 무실행 은퇴·미등록 정리·형제 접기·alive ≤ 25·이름 없는 해시를 판정한다. */
+export function pruneJudgment(results: readonly CheckResult[], opts: { now?: Date } = {}): PruneJudgment {
+  const now = opts.now ?? new Date();
+  const idleMs = PRUNE_IDLE_DAYS * 24 * 60 * 60_000;
+  const idleRetire: string[] = [];
+  const idleUnproven: string[] = [];
+  const unregistered: PruneUnregisteredRow[] = [];
+  const unnamed: string[] = [];
+  const families = new Map<string, string[]>();
+  let aliveCount = 0;
+  for (const result of results) {
+    if (result.state === 'alive') aliveCount++;
+    if (result.state === 'unregistered') {
+      unregistered.push({
+        id: result.id,
+        ...(result.cron ? { cron: result.cron } : {}),
+        ...(result.command ? { command: result.command } : {}),
+      });
+    }
+    if (result.state === 'off') {
+      const ran = result.lastRunAt && Number.isFinite(Date.parse(result.lastRunAt)) ? Date.parse(result.lastRunAt) : undefined;
+      if (ran === undefined) idleUnproven.push(result.id);
+      else if (now.getTime() - ran > idleMs) idleRetire.push(result.id);
+    }
+    if (/^[0-9a-f]{8,}$/.test(result.id)) unnamed.push(result.id);
+    const family = pruneFoldFamily(result.id);
+    if (family) {
+      const group = families.get(family) ?? [];
+      group.push(result.id);
+      families.set(family, group);
+    }
+  }
+  const foldGroups: PruneFoldGroup[] = [];
+  for (const [family, ids] of families) {
+    if (ids.length < 2) continue;
+    foldGroups.push({ family, ids: [...ids].sort() });
+  }
+  const judgment: PruneJudgment = {
+    idleRetire,
+    idleUnproven,
+    unregistered,
+    foldGroups,
+    alive: { count: aliveCount, limit: PRUNE_ALIVE_LIMIT, within: aliveCount <= PRUNE_ALIVE_LIMIT },
+    unnamed,
+  };
+  debug.log('loop.checker', 'prune', {
+    idleRetire: idleRetire.length, idleUnproven: idleUnproven.length, unregistered: unregistered.length,
+    folds: foldGroups.length, alive: aliveCount, unnamed: unnamed.length,
+  });
+  return judgment;
+}
+
+/** LOOP-PRUNE-1021-FU — PruneJudgment 을 사람용 정리 판정 줄로 렌더한다(loop status --all 인간 출력 꼬리). */
+export function pruneText(judgment: PruneJudgment): string {
+  const lines = [
+    `무실행 은퇴 ${judgment.idleRetire.length}: ${judgment.idleRetire.join(', ') || '없음'}`,
+    `무실행 미증명 ${judgment.idleUnproven.length}: ${judgment.idleUnproven.join(', ') || '없음'}`,
+    `미등록 ${judgment.unregistered.length}: ${judgment.unregistered.map(row => row.command ? `${row.id} (${row.command})` : row.id).join(', ') || '없음'}`,
+    `형제 접기 ${judgment.foldGroups.length}: ${judgment.foldGroups.map(group => `${group.family}[${group.ids.join('+')}]`).join(', ') || '없음'}`,
+    `alive ${judgment.alive.count}/${judgment.alive.limit} ${judgment.alive.within ? '한도 이내' : '한도 초과'}`,
+    `이름 없는 해시 ${judgment.unnamed.length}: ${judgment.unnamed.join(', ') || '없음'}`,
+  ];
+  return lines.join('\n');
+}

package/src/loops/consensus.ts

@@ -45,6 +45,8 @@ export const CROWN_MARK = String.fromCodePoint(0x1F451);
 export interface ProposalCard {
   id: string;
   category: ConsensusCategory;
+  /** Stable orchestrator work key (orch:<card>:<cell>) for a cross-branch split cell. */
+  workKey?: string;
   title: string;
   /** 사실 id — 제안의 근거 관측. */
   factId: string;
@@ -152,8 +154,14 @@ export class ConsensusEngine {
 
   propose(input: {
     by: ConsensusRepresentative; category: ConsensusCategory; title: string; factId: string; cost: string; undo: string;
-    thresholds?: DecisionCategory[]; provider?: string;
+    thresholds?: DecisionCategory[]; provider?: string; workKey?: string;
   }): ProposalCard {
+    if (input.workKey !== undefined) {
+      if (input.category !== 'cross-branch-change' || !/^orch:[a-zA-Z0-9_-]+:[a-zA-Z0-9_-]+$/.test(input.workKey))
+        throw new Error('invalid cross-branch work key');
+      const existing = this.list().find(proposal => proposal.workKey === input.workKey);
+      if (existing) throw new Error(`cross-branch work already proposed: ${existing.id}`);
+    }
     if (!CONSENSUS_REPRESENTATIVES.includes(input.by)) throw new Error(`invalid representative: ${input.by} (coordinator|guardian)`);
     if (!CONSENSUS_CATEGORIES.includes(input.category)) throw new Error(`invalid consensus category: ${input.category} (${CONSENSUS_CATEGORIES.join('|')})`);
     const thresholds = [...new Set(input.thresholds ?? [])];
@@ -164,6 +172,7 @@ export class ConsensusEngine {
     const proposal: ProposalCard = {
       id: this.nextId('C', at),
       category: input.category,
+      ...(input.workKey ? { workKey: input.workKey } : {}),
       title: oneLine(input.title, 'title'),
       factId: oneLine(input.factId, 'fact id'),
       cost: oneLine(input.cost, 'cost'),
@@ -210,11 +219,24 @@ export class ConsensusEngine {
     return proposal;
   }
 
+  proposalForWork(workKey: string): ProposalCard | undefined {
+    return this.list().find(entry => entry.workKey === workKey);
+  }
+
   crownCards(): CrownCard[] {
     return [...this.state().cards]
       .sort((a, b) => b.raisedAt.localeCompare(a.raisedAt) || a.id.localeCompare(b.id));
   }
 
+  /** The same durable execution gate is used by CLI replies, hooks and loop consumers. */
+  canExecute(id: string): boolean {
+    const proposal = this.show(id);
+    return proposal.status === 'agreed' && proposal.thresholds.length === 0
+      && proposal.roundTrips >= 1 && proposal.roundTrips <= MAX_REVIEW_ROUND_TRIPS
+      && proposal.reviews.at(-1)?.verdict === 'agree'
+      && proposal.reviews.at(-1)?.by !== proposal.proposedBy;
+  }
+
   /** 판정선 — 합의 원장의 agreed 이벤트를 ISO 주 단위로 센다 (한 주 N건의 기전). */
   weeklyAgreementCounts(): Array<{ week: string; count: number }> {
     const counts = new Map<string, number>();
@@ -230,7 +252,9 @@ export class ConsensusEngine {
   private conclude(id: string, verdict: ReviewRecord['verdict'], input: { by: ConsensusRepresentative; claim?: string; provider?: string }): { proposal: ProposalCard; crownCard?: CrownCard } {
     const proposal = this.show(id);
     if (proposal.status !== 'open') throw new Error(`합의가 이미 결론났다: ${id} (${proposal.status === 'agreed' ? '합의' : '불합의'})`);
+    if (!CONSENSUS_REPRESENTATIVES.includes(input.by)) throw new Error(`invalid representative: ${input.by}`);
     if (input.by === proposal.proposedBy) throw new Error('메아리 방지 — 제안한 대표는 자기 제안을 검토하지 않는다');
+    if (proposal.roundTrips >= MAX_REVIEW_ROUND_TRIPS) throw new Error(`상대 검토는 최대 ${MAX_REVIEW_ROUND_TRIPS}왕복이다`);
     if (verdict === 'revise' && proposal.roundTrips + 1 >= MAX_REVIEW_ROUND_TRIPS)
       throw new Error(`상대 검토는 최대 ${MAX_REVIEW_ROUND_TRIPS}왕복이다 — 마지막 왕복에는 합의 또는 불합의로 끝낸다`);
     const claim = oneLine(input.claim ?? (verdict === 'agree' ? '동의 — 제안대로 실행한다' : ''), 'claim');
@@ -249,7 +273,7 @@ export class ConsensusEngine {
     this.appendLens(input.by, { action: 'reviewed', proposalId: proposal.id, at, verdict, ...(provider ? { provider } : {}) });
     debug.log('loops.consensus', 'reviewed', { proposalId: proposal.id, verdict, roundTrip: review.roundTrip, by: input.by });
     const updated = this.show(proposal.id);
-    if (verdict === 'agree') this.executeHook(updated);
+    if (this.canExecute(updated.id)) this.executeHook(updated);
     return { proposal: updated, ...(crownCard ? { crownCard } : {}) };
   }
 

package/src/loops/loop-cli.ts

@@ -1,7 +1,7 @@
 import type { Command } from 'commander';
 import { writeStdoutJson } from '../cli/stdout-json.js';
 import { listAllLoops, listLoops, loopStatus, runLoop, setLoopEnabled, unregisteredCronLoops, type AllLoopEntry, type LoopRegistryOptions } from './registry.js';
-import { checkLoops, countLoopStates, entriesFromRegistry, LOOP_STATES, notifyOwners, observeLoopCheck, type RegistryAdapterDeps } from './checker.js';
+import { checkLoops, countLoopStates, entriesFromRegistry, LOOP_STATES, notifyOwners, observeLoopCheck, pruneJudgment, pruneText, type RegistryAdapterDeps } from './checker.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { verifyLoopPackage } from './package/verify.js';
 import { loopActivity } from './activity.js';
@@ -56,7 +56,8 @@ export function registerLoopCommands(program: Command, checkerDeps: RegistryAdap
     }));
   loop.command('status [id]').option('--all', 'Check all registered loops')
     .option('--json', 'Print JSON').option('--notify', 'Queue late/failing loops for their owners')
-    .action((id: string | undefined, opts: { all?: boolean; json?: boolean; notify?: boolean }) => handle(async () => {
+    .option('--prune', 'Judge idle retire · unregistered cleanup · sibling folding · alive ≤ 25')
+    .action((id: string | undefined, opts: { all?: boolean; json?: boolean; notify?: boolean; prune?: boolean }) => handle(async () => {
       if (!opts.all) {
         if (!id) throw new Error('loop status requires an id or --all');
         await output(loopStatus(id), !!opts.json);
@@ -65,15 +66,19 @@ export function registerLoopCommands(program: Command, checkerDeps: RegistryAdap
       if (id) throw new Error('loop status --all does not take an id');
       const now = checkerDeps.now ?? new Date();
       const root = checkerDeps.root ?? effectiveInstanceRoot();
-      const { entries, scope } = entriesFromRegistry({ ...checkerDeps, now });
+      const registryOpts = checkerDeps.registryOptions;
+      const { entries, scope } = entriesFromRegistry({ ...checkerDeps, now,
+        listAllLoops: checkerDeps.listAllLoops ?? (registryOpts ? () => listAllLoops(registryOpts) : undefined) });
       const results = checkLoops(entries, now);
       const counts = countLoopStates(results);
+      const prune = pruneJudgment(results, { now });
       observeLoopCheck(results, scope, { root, now });
       if (opts.notify) notifyOwners(results, { root, now });
-      if (opts.json) { await output({ results, counts, scope }, true); return; }
+      if (opts.json) { await output({ results, counts, scope, prune }, true); return; }
       console.log('id\tstate\tlast run\texpected interval\towner\treason');
       for (const result of results) console.log(`${result.id}\t${result.state}\t${result.lastRunAt ?? '—'}\t${result.expectEveryMinutes === undefined ? '—' : `${result.expectEveryMinutes}m`}\t${result.owner ?? '—'}\t${result.reason}`);
       console.log(`${LOOP_STATES.map(state => `${state} ${counts[state]}`).join(' · ')} · scope ${scope}`);
+      if (opts.prune) console.log(pruneText(prune));
     }));
   for (const [name, enabled] of [['start', true], ['stop', false]] as const) {
     loop.command(`${name} <id>`).option('--yes', 'Apply the crontab change (otherwise preview only)')

package/src/loops/orchestrator/anomaly-cluster.ts

@@ -0,0 +1,243 @@
+/**
+ * ANOMALY-CLUSTER-PRODUCT — repeated failure signatures hold relaunches.
+ *
+ * Reference contract (read-only, unchanged): `seat-state/OP/tools/anomaly-cluster.{sh,py}` groups the same
+ * failures for an OP seat by eye and never holds anything automatically. This module is the product
+ * transfer of that reading contract: it computes a signature and turns it into a hold/release decision.
+ *
+ * Boundary: when the SAME signature shows up in 3+ DIFFERENT runs, relaunches of that goal·host are held
+ * automatically until a cause verdict (`release`) clears them. The host is a hold key, never part of the
+ * signature. When there is nothing measured for a goal·host, the hold reason says so ("원천 미측정").
+ *
+ * Pure module: no fs, no network, no clock reads unless a `now` seam is injected.
+ */
+
+/** Runs of the same signature required before relaunches are held. */
+export const ANOMALY_HOLD_THRESHOLD = 3;
+
+/** Signature components: failure kind · container exit · stage · tail of `lastLines` reason. */
+export interface FailureObservation {
+  /** Goal identifier — a hold key, not part of the signature. */
+  goal: string;
+  /** Host (seat / surface / launch host) — a hold key, not part of the signature. */
+  host: string;
+  /** Run identifier — the unit counted as "a different run". */
+  runId: string;
+  /** Failure kind (`preflight` · `exit` · `timeout` · adapter name …). */
+  kind: string;
+  /** Container exit code when observed; `null`/absent when the failure never reached a container. */
+  containerExit?: number | null;
+  /** Stage the failure was observed at (`launch` · `delegate` · `monitor` …). */
+  stage: string;
+  /** Tail lines of the failure; the last non-empty line is the "reason tail" that splits signatures. */
+  lastLines?: readonly string[];
+  at?: string;
+}
+
+export interface HoldDecision {
+  /** `true` when relaunches of this goal·host are held. */
+  hold: boolean;
+  /** Korean explanation — includes "원천 미측정" when nothing was measured. */
+  reason: string;
+  signature?: string;
+  /** Distinct runs counted for the holding signature. */
+  runs?: number;
+}
+
+export interface ReleaseDecision {
+  released: boolean;
+  reason: string;
+}
+
+const REASON_TAIL_LIMIT = 160;
+
+/** Collapse whitespace and cap length — the reason tail is a signature component, not a payload. */
+function reasonTail(lines: readonly string[] | undefined): string {
+  if (!lines || lines.length === 0) return 'none';
+  for (let i = lines.length - 1; i >= 0; i -= 1) {
+    const line = (lines[i] ?? '').replace(/\s+/g, ' ').trim().replace(/^reason\s*[:=]\s*/i, '');
+    if (line) return line.slice(0, REASON_TAIL_LIMIT);
+  }
+  return 'none';
+}
+
+/** Pull a container exit code out of free text (`exited with code 137`, `exit status 1`, `exit=137`). */
+export function extractContainerExit(text: string): number | null {
+  const match = /(?:exit(?:ed)?(?: with)?(?: code| status)?|exit=)\s*[:=]?\s*(\d+)/i.exec(text ?? '');
+  if (!match) return null;
+  const value = Number.parseInt(match[1]!, 10);
+  return Number.isFinite(value) ? value : null;
+}
+
+/**
+ * Signature = kind · exit · stage · reason tail. Host and run are deliberately excluded: the host is a
+ * hold key and the run is the counter.
+ */
+export function failureSignature(obs: FailureObservation): string {
+  const exit = obs.containerExit === undefined || obs.containerExit === null ? 'none' : String(obs.containerExit);
+  return `kind=${obs.kind}|exit=${exit}|stage=${obs.stage}|reason=${reasonTail(obs.lastLines)}`;
+}
+
+interface ClusterState {
+  goal: string;
+  host: string;
+  signature: string;
+  runs: Set<string>;
+  held: boolean;
+  /** First `FailureObservation.at` read into this cluster — the observation window shown in the reason. */
+  firstAt?: string;
+  /** Latest `FailureObservation.at` read into this cluster. */
+  lastAt?: string;
+}
+
+function keyOf(goal: string, host: string): string {
+  return `${goal}\u0000${host}`;
+}
+
+/** In-memory grouping state — written by the failure observation point, read by the relaunch point. */
+export class AnomalyCluster {
+  private readonly threshold: number;
+  private readonly now: () => Date;
+  private readonly clusters = new Map<string, ClusterState>();
+  /**
+   * Observations of a DIFFERENT signature that arrived while its goal·host was held. They are kept
+   * counting in a side bucket so a late-arriving observation can never drop a hold before a cause
+   * verdict — the hold is only ever cleared by `release`.
+   */
+  private readonly parked = new Map<string, ClusterState>();
+
+  constructor(opts: { threshold?: number; now?: () => Date } = {}) {
+    this.threshold = Math.max(1, Math.trunc(opts.threshold ?? ANOMALY_HOLD_THRESHOLD));
+    this.now = opts.now ?? (() => new Date());
+  }
+
+  /** Record one failure observation and return the resulting hold decision for its goal·host. */
+  record(obs: FailureObservation): { signature: string; runs: number; hold: HoldDecision } {
+    const signature = failureSignature(obs);
+    const key = keyOf(obs.goal, obs.host);
+    const at = typeof obs.at === 'string' && obs.at.trim() ? obs.at.trim() : undefined;
+    let cluster = this.clusters.get(key);
+    if (cluster && cluster.signature !== signature && cluster.held) {
+      // Held: the signature is frozen until a cause verdict. A late observation of another signature is
+      // counted in the parked bucket — replacing the cluster here would silently drop the hold.
+      const parkedKey = keyOf(key, signature);
+      let parked = this.parked.get(parkedKey);
+      if (!parked) {
+        parked = { goal: obs.goal, host: obs.host, signature, runs: new Set(), held: false };
+        this.parked.set(parkedKey, parked);
+      }
+      this.touch(parked, obs.runId, at);
+      const held = this.describe(cluster);
+      return {
+        signature: cluster.signature,
+        runs: cluster.runs.size,
+        hold: {
+          ...held,
+          reason: `${held.reason} · 보류 중 도착한 다른 서명 ${parked.runs.size}건은 해제 없이 별도 보관(판정 뒤 재판정)`,
+        },
+      };
+    }
+    if (!cluster || cluster.signature !== signature) {
+      // Not held: a different signature takes over. A parked bucket of that same signature keeps its runs.
+      const parkedKey = keyOf(key, signature);
+      const resumed = this.parked.get(parkedKey);
+      for (const stale of [...this.parked.keys()]) {
+        if (stale !== parkedKey && stale.startsWith(`${key}\u0000`)) this.parked.delete(stale);
+      }
+      if (resumed) this.parked.delete(parkedKey);
+      cluster = resumed ?? { goal: obs.goal, host: obs.host, signature, runs: new Set(), held: false };
+      this.clusters.set(key, cluster);
+    }
+    this.touch(cluster, obs.runId, at);
+    return { signature, runs: cluster.runs.size, hold: this.describe(cluster) };
+  }
+
+  /** Relaunch gate. A hold is decided before any cause verdict; the reason names an unmeasured source. */
+  hold(goal: string, host: string): HoldDecision {
+    const cluster = this.clusters.get(keyOf(goal, host));
+    if (!cluster) {
+      return { hold: false, reason: `원천 미측정: ${goal}·${host} 의 실패 관측이 없다 — 보류 판정 근거 없음` };
+    }
+    return this.describe(cluster);
+  }
+
+  isHeld(goal: string, host: string): boolean {
+    return this.clusters.get(keyOf(goal, host))?.held ?? false;
+  }
+
+  /** Cause verdict — clears the hold. Returns `released: false` when nothing was held. */
+  release(goal: string, host: string, cause: string): ReleaseDecision {
+    const key = keyOf(goal, host);
+    const cluster = this.clusters.get(key);
+    if (!cluster || !cluster.held) {
+      return { released: false, reason: `${goal}·${host} 는 보류 상태가 아니다` };
+    }
+    const judged = cluster.signature;
+    const judgedRuns = cluster.runs.size;
+    cluster.held = false;
+    cluster.runs.clear();
+    cluster.firstAt = undefined;
+    cluster.lastAt = undefined;
+    const promoted = this.takeStrongestParked(key);
+    if (promoted) this.clusters.set(key, promoted);
+    const head = `보류 해제: ${cause} (${this.now().toISOString()}) — 판정한 서명 ${judged} ${judgedRuns}건`;
+    return {
+      released: true,
+      reason: promoted
+        ? `${head} · 보류 중 보관한 다른 서명 ${promoted.signature} ${promoted.runs.size}건을 재판정 대상으로 승격${promoted.held ? ' (임계 도달 — 새 서명 기준 재보류)' : ''}`
+        : head,
+    };
+  }
+
+  private touch(cluster: ClusterState, runId: string, at: string | undefined): void {
+    cluster.runs.add(runId);
+    if (at) {
+      cluster.firstAt ??= at;
+      cluster.lastAt = at;
+    }
+    if (cluster.runs.size >= this.threshold) cluster.held = true;
+  }
+
+  /** The parked bucket of this goal·host with the most runs — the next signature to judge. */
+  private takeStrongestParked(key: string): ClusterState | undefined {
+    let best: ClusterState | undefined;
+    let bestKey: string | undefined;
+    for (const [parkedKey, state] of this.parked) {
+      if (!parkedKey.startsWith(`${key}\u0000`)) continue;
+      if (!best || state.runs.size > best.runs.size) {
+        best = state;
+        bestKey = parkedKey;
+      }
+    }
+    if (best && bestKey) this.parked.delete(bestKey);
+    return best;
+  }
+
+  private describe(cluster: ClusterState): HoldDecision {
+    const runs = cluster.runs.size;
+    const window = cluster.firstAt ? ` · 관측 ${cluster.firstAt}${cluster.lastAt && cluster.lastAt !== cluster.firstAt ? `..${cluster.lastAt}` : ''}` : '';
+    if (cluster.held) {
+      return {
+        hold: true,
+        reason: `같은 서명 ${runs}건(임계 ${this.threshold}) — 원인 판정 전 ${cluster.goal}·${cluster.host} 재발사 보류${window}`,
+        signature: cluster.signature,
+        runs,
+      };
+    }
+    return {
+      hold: false,
+      reason: `같은 서명 ${runs}건 < 임계 ${this.threshold} — 보류하지 않는다${window}`,
+      signature: cluster.signature,
+      runs,
+    };
+  }
+}
+
+/** Process-wide cluster shared by the tick failure record point and the dispatcher relaunch gate. */
+let shared: AnomalyCluster | undefined;
+
+/** Lazily created shared instance — no fs side effects, process-wide by design. */
+export function defaultAnomalyCluster(): AnomalyCluster {
+  shared ??= new AnomalyCluster();
+  return shared;
+}

package/src/loops/orchestrator/tick.ts

@@ -11,12 +11,14 @@ import { getUserConfig, ORCHESTRATOR_DEFAULTS, resolveConfiguredAgentRoleLlm, ty
 import { rubricPriority } from '../../release-loop/rubric.js';
 import { debug } from '../../debug/log.js';
 import { emitLoopHeartbeat } from '../neighbor-runtime.js';
+import { ConsensusEngine } from '../consensus.js';
 import { listSelfDevRuns, runSummaryLine, selfDevRunsDir } from '../../self-dev/run-store.js';
 import { planAction, runSeatLoopOnce, type SeatDeps, type SeatItem } from '../../seat-loop/seat-loop.js';
 import { addHarnessQueue, harnessQueueOutcome, setQueuedPoolHint } from '../../harness/harness-queue.js';
 import { placeOnGrid, type GridHost } from './grid-place.js';
 import { checkPodPool, parsePodPool, resolvePodPoolSpec } from '../../task-orchestrator/surfaces/pod-pool.js';
 import { leaseKubectl } from '../../task-orchestrator/surfaces/pod-lease.js';
+import { defaultAnomalyCluster, extractContainerExit, type AnomalyCluster } from './anomaly-cluster.js';
 import { isLaunchEligible, isTrafficLaunch, recordDispatchCycle, seatOfTree, type TrafficProcess } from './traffic.js';
 import { defaultListHarnessProcesses } from '../../harness/harness-cli-command.js';
 import * as testGuard from '../../instance/test-write-guard.js';
@@ -32,7 +34,7 @@ export type Window = '08' | '12' | '18';
 export type Node = 'intake' | 'split' | 'place' | 'delegate' | 'launch' | 'reconcile' | 'report';
 export type Mode = 'off' | 'shadow' | 'live';
 const SEAT_LOOP_IDS: Readonly<Record<string, string>> = { OP: 'op-seat', MK: 'cmo-seat', TC: 'tc-seat', UX: 'ux-seat' };
-export interface Cell { id: string; title: string; kind?: string; seat?: string; host?: string; gridHost?: boolean; version?: string; cardId: string; origin: 'candidate' | 'flow1a'; priority?: 'P0' | 'P1' | 'P2' | 'P3' | 'P4'; predecessors?: string[] }
+export interface Cell { id: string; title: string; kind?: string; seat?: string; host?: string; gridHost?: boolean; version?: string; cardId: string; origin: 'candidate' | 'flow1a'; priority?: 'P0' | 'P1' | 'P2' | 'P3' | 'P4'; predecessors?: string[]; consensusProposalId?: string }
 export interface TickState {
   runId: string; window: Window; mode: Mode; day: string;
   cards: TaskCard[]; skippedCards: Array<{ id: string; reason: string }>; cells: Cell[]; placed: number; unplaced?: number; delegated: number; wouldDelegate: number; rebalanced?: number; rebalanceBlocked?: Array<{ id: string; reason: string }>;
@@ -58,7 +60,7 @@ export interface TickState {
   missing: string[];
 }
 /** FLOW1a contract: with `{ shadow: true }` the splitter only proposes cells and writes nothing (cards, ledgers, LLM side effects excepted). */
-export type SplitAdapter = (card: TaskCard, opts?: { shadow?: boolean }) => Promise<Array<{ id: string; title: string; kind?: string; seat?: string; host?: string }>> | Array<{ id: string; title: string; kind?: string; seat?: string; host?: string }>;
+export type SplitAdapter = (card: TaskCard, opts?: { shadow?: boolean }) => Promise<Array<{ id: string; title: string; kind?: string; seat?: string; host?: string; consensusProposalId?: string }>> | Array<{ id: string; title: string; kind?: string; seat?: string; host?: string; consensusProposalId?: string }>;
 /** RELPLAN1 `placeCell(input: PlacementCell)` — owner·priority·predecessors are required; the result carries no seat. */
 export type PlacementInput = { id: string; title: string; owner: string; priority: 'P0' | 'P1' | 'P2'; predecessors: string[] };
 export type PlaceAdapter = (cell: PlacementInput, deps?: { dryRun?: boolean; now?: Date }) => Promise<{ version?: string } | null> | { version?: string } | null;
@@ -73,6 +75,8 @@ export interface TickDeps {
   gridHosts?: readonly GridHost[];
   seatTurn?: (seat: string, root: string, host?: string, options?: Pick<SeatDeps, 'enqueue'>) => Promise<{ status: string; queueId?: string; runId?: string; item?: { source: string; id: string } }>;
   queueOutcome?: (queueId: string, root: string) => 'pending' | 'unknown' | 'retryable' | 'succeeded';
+  /** ANOMALY-CLUSTER — grouping state shared with the dispatcher relaunch gate; defaults to the process-wide instance. */
+  anomalyCluster?: AnomalyCluster;
   /** Snapshot of running harness processes for launch-cap decisions; an unreadable snapshot blocks launches. */
   launchProcesses?: () => { status: 'ok'; records: readonly TrafficProcess[] } | { status: 'incomplete' };
   /** 발사 전 대기열 항목의 풀 힌트 갱신(주입 안 하면 harness-queue `setQueuedPoolHint`). */
@@ -453,6 +457,22 @@ export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Prom
   const root = deps.root ?? effectiveInstanceRoot();
   const runId = deps.runId ?? graphRunId() ?? `${kstDay(now)}-${window}`;
   const path = stateFile(root, runId);
+  const consensus = new ConsensusEngine({ stateDir: root });
+  const consensusAllows = (cell: Cell): boolean => {
+    if (cell.kind !== 'cross-branch-change' && !cell.consensusProposalId) return true;
+    const workKey = `orch:${cell.cardId}:${cell.id}`;
+    try {
+      if (cell.kind === 'cross-branch-change') {
+        const proposal = consensus.proposalForWork(workKey);
+        if (!proposal || (cell.consensusProposalId && cell.consensusProposalId !== proposal.id)) return false;
+        cell.consensusProposalId = proposal.id;
+      }
+      return !!cell.consensusProposalId && consensus.canExecute(cell.consensusProposalId);
+    } catch (error) {
+      debug.log('loop.orchestrator', 'consensus-gate-failed', { id: cell.consensusProposalId, workKey, error: String(error) }, { level: 'warn' });
+      return false;
+    }
+  };
   const orchestratorConfig = getUserConfig().loops?.orchestrator;
   const configured = deps.mode ?? orchestratorConfig?.mode;
   const mode: Mode = configured === 'off' || configured === 'live' ? configured : 'shadow';
@@ -529,9 +549,12 @@ export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Prom
         const cells = ruleOnly ? [{ id: card.id, title: card.title }] : split ? await split(card, { shadow: mode === 'shadow' }) : [{ id: card.id, title: card.title }];
         for (const cell of cells) {
           if (!cell.id?.trim() || !cell.title?.trim()) throw new Error('invalid split cell');
+          const workKey = `orch:${card.id}:${cell.id}`;
+          const proposalId = cell.consensusProposalId ?? (cell.kind === 'cross-branch-change' ? consensus.proposalForWork(workKey)?.id : undefined);
           state.cells.push({ cardId: card.id, id: cell.id, title: cell.title, origin: split ? 'flow1a' : 'candidate',
             ...(ruleOnly ? { priority: rubricPriority(card.sections.map(section => section.content).join('\n')) } : {}),
-            ...(cell.kind !== undefined ? { kind: cell.kind } : {}), ...(cell.seat ? { seat: cell.seat } : {}), ...(cell.host !== undefined ? { host: cell.host } : {}) });
+            ...(cell.kind !== undefined ? { kind: cell.kind } : {}), ...(cell.seat ? { seat: cell.seat } : {}), ...(cell.host !== undefined ? { host: cell.host } : {}),
+            ...(proposalId ? { consensusProposalId: proposalId } : {}) });
         }
         observe('exchange', `split:${card.id}`, cells.length);
         if (split && cells.length && mode === 'live') {
@@ -567,6 +590,7 @@ export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Prom
         }
         if (available && (mode === 'live' || !deps.placeCell)) for (const cell of state.cells) {
           if (cell.origin !== 'flow1a' || !cell.seat || !SEAT_LOOP_IDS[cell.seat]) continue;
+          if (!consensusAllows(cell)) { observe('consensus-blocked', cell.consensusProposalId, 1); continue; }
           // RELPLAN's dryRun calculates the same release without writing a checklist in shadow.
           try {
             const priority = cell.priority === 'P3' || cell.priority === 'P4' ? 'P2' : cell.priority ?? 'P2';
@@ -645,6 +669,7 @@ export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Prom
       };
       for (const cell of state.cells) {
         if (cell.origin !== 'flow1a' || !cell.seat) continue;
+        if (!consensusAllows(cell)) { observe('consensus-blocked', cell.consensusProposalId, 1); continue; }
         const targetLoopId = SEAT_LOOP_IDS[cell.seat];
         if (!targetLoopId) continue;
         const key = `orch:${cell.cardId}:${cell.id}`;
@@ -674,6 +699,17 @@ export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Prom
           // shadow 표본은 따로 센다 — 자리 경로로 아직 안 간 칸(shadow 틱·배치 전)이 나중에 live 로 바뀌면 그때 뜬다.
           // ⚠️ 이미 자리 저널에 들어간 칸은 live 로 바꿔도 다시 안 넘긴다(keys.has 에서 끝) — 한 칸의 발사 주체는 하나다(의도).
           const handKey = handLive ? key : `shadow:${key}`;
+          // ANOMALY-CLUSTER: the goal·host pair is the hold key (never part of the failure signature). While a
+          // signature with 3+ runs is un-judged, its relaunch is held and the cell is carried to the next tick.
+          const anomalyGoal = cell.cardId;
+          const anomalyHost = cell.seat;
+          const anomaly = deps.anomalyCluster ?? defaultAnomalyCluster();
+          const hold = anomaly.hold(anomalyGoal, anomalyHost);
+          if (hold.hold) {
+            (state.deferredCells ??= []).push(cell);
+            observe('anomaly-cluster-hold', `${key}:${hold.reason}`, 1, 'task-agent');
+            continue;
+          }
           mkdirSync(dirname(ledger), { recursive: true });
           mkdirSync(dirname(path), { recursive: true });
           // Claim under the seat-journal lock — the same lock the seat append takes, so a live claim and a seat row never both land.
@@ -693,9 +729,18 @@ export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Prom
               withFileLockSync(`${path}.lock`, () => appendFileSync(ledger, `${JSON.stringify({ key: handKey, cell: cell.id, cardId: result.card.id, mode: result.mode, launched: result.launched, status: 'handed', runId, at: now.toISOString() })}\n`));
               (state.handed ??= []).push({ key, cell: cell.id, cardId: result.card.id, mode: result.mode, launched: result.launched });
               observe('hand-to-task-agent', `${key}:${result.card.id}:${result.mode}${result.launched ? ':launched' : ''}`, 1, 'task-agent');
+              // A hand that went through is the cause verdict for this goal·host — clear a pending hold.
+              if (anomaly.isHeld(anomalyGoal, anomalyHost)) anomaly.release(anomalyGoal, anomalyHost, '원인 판정: hand-to-task-agent 성공');
               // A live hand is an assignment: it counts toward maxDelegatePerTick like a seat row (COORD-HA ②).
               if (handLive) { keys.add(key); state.delegatedKeys?.push(key); continue; }
             } catch (error) {
+              // ANOMALY-CLUSTER record point: signature from kind·container exit·stage·reason tail of lastLines.
+              const failureLines = [String(error)];
+              anomaly.record({
+                goal: anomalyGoal, host: anomalyHost, runId,
+                kind: 'hand-to-task-agent-failed', containerExit: extractContainerExit(failureLines[0]!),
+                stage: 'delegate', lastLines: failureLines, at: now.toISOString(),
+              });
               observe('hand-to-task-agent-failed', `${key}:${String(error).slice(0, 160)}`, 1, 'task-agent');
               // A failed live hand stays claimed (no relaunch loop) and does not fall back to the seat path — one launcher per cell.
               if (handLive) { keys.add(key); continue; }
@@ -754,7 +799,7 @@ export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Prom
       // shadow 는 저널을 읽지 않는다 — 깨진 live 저널이 관측 전용 틱을 넘어뜨리지 않게.
       const latestRequests = new Map(mode === 'live' && state.degradation?.level !== 2 ? readRequests(root).map(row => [row.key, row]) : []);
       const eligible = state.cells.filter(cell => state.degradation?.level !== 2 && cell.origin === 'flow1a' && cell.seat && SEAT_LOOP_IDS[cell.seat]
-        && validVersion(cell.version) && (mode === 'shadow' || latestRequests.get(`orch:${cell.cardId}:${cell.id}`)?.status === 'queued')
+        && consensusAllows(cell) && validVersion(cell.version) && (mode === 'shadow' || latestRequests.get(`orch:${cell.cardId}:${cell.id}`)?.status === 'queued')
         && (orchestratorConfig?.maxDelegatePerTick === undefined || state.delegatedKeys?.includes(`orch:${cell.cardId}:${cell.id}`)
           || (mode === 'live' && latestRequests.has(`orch:${cell.cardId}:${cell.id}`))));
       const seats = [...new Set(eligible.map(cell => cell.seat!))];