elanous 0.2.38 → 0.2.41

package/src/domains/guardian-tick.ts

@@ -1,12 +1,18 @@
 import type { Database } from 'bun:sqlite';
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { hostname } from 'node:os';
+import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { debug } from '../debug/log.js';
+import { withFileLockSync } from '../storage/file-lock.js';
 import { calendarFields, resolveTimeZone } from '../time/format.js';
 import { cronMatches } from './cron-match.js';
 import { listScheduleRuns } from './schedule-runs.js';
 import { listSchedules, openSchedulesDb, type ScheduleRow } from './schedule-registry.js';
 import type { SpawnOutcome } from './schedule-runner.js';
+import { classifyTcellHealthCards, type TcellHealthCard, type TcellHealthClassification } from '../harness/harness-incidents.js';
 
 export interface GuardianPlan {
   jobs: readonly (Pick<ScheduleRow, 'id' | 'cron' | 'enabled' | 'source' | 'run_via'> & Partial<Pick<ScheduleRow, 'command'>>)[];
@@ -21,9 +27,147 @@ export interface GuardianDeps {
   grokExpiry?: () => string | null;
   /** Injected in tests; production reevaluates recorded doctor visits without dispatching a prescription. */
   doctorShadow?: () => void | Promise<void>;
+  /** Read-only health-card source. T-cell classification remains shadow-only and never dispatches an action. */
+  readTcellHealthCards?: (now: Date) => readonly TcellHealthCard[] | Promise<readonly TcellHealthCard[]>;
+  /** Test-only path override; production uses the resolved state root. */
+  tcellDedupeStatePath?: string;
   hostName?: string;
 }
 
+type TcellPatrolSummary = Pick<TcellHealthClassification, 'total' | 'measured' | 'counts'> & { unmeasured: number };
+
+type TcellShadowMailTarget = 'doctor' | 'macrophage';
+interface TcellShadowMailProposal {
+  causeGroupId: string;
+  target: TcellShadowMailTarget;
+  reason: 'no-progress-30m' | 'risk-signal' | 'cause-quorum';
+  runIds: string[];
+  runIdsTruncated: boolean;
+  causeGroupSize: number;
+}
+
+const TCELL_SHADOW_DEDUPE_WINDOW_MS = 60 * 60_000;
+interface TcellShadowDedupeState {
+  version: 1;
+  lastProposedAt: Record<string, number>;
+}
+interface TcellShadowMailSuppression {
+  proposal: TcellShadowMailProposal;
+  lastProposedAt?: number;
+  eligibleAt?: number;
+  suppressionReason: 'hourly-dedupe' | 'dedupe-state-unavailable';
+}
+
+function tcellShadowDedupePath(): string {
+  return join(elanousStateRoot(), 'guardian', 'tcell-dedupe.json');
+}
+
+function loadTcellShadowDedupeState(path: string): TcellShadowDedupeState {
+  let raw: string;
+  try { raw = readFileSync(path, 'utf8'); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return { version: 1, lastProposedAt: {} };
+    throw error;
+  }
+  const parsed: unknown = JSON.parse(raw);
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error('invalid T-cell dedupe state');
+  const record = parsed as Record<string, unknown>;
+  if (record.version !== 1 || !record.lastProposedAt || typeof record.lastProposedAt !== 'object' || Array.isArray(record.lastProposedAt)) {
+    throw new Error('invalid T-cell dedupe state shape');
+  }
+  const lastProposedAt: Record<string, number> = Object.create(null) as Record<string, number>;
+  for (const [causeGroupId, at] of Object.entries(record.lastProposedAt)) {
+    if (!causeGroupId || !Number.isSafeInteger(at) || (at as number) < 0) throw new Error('invalid T-cell dedupe timestamp');
+    lastProposedAt[causeGroupId] = at as number;
+  }
+  return { version: 1, lastProposedAt };
+}
+
+/** Reserve the per-cause hourly shadow proposal before logging it, so concurrent guardian ticks share the limit. */
+function reserveTcellShadowMail(proposals: readonly TcellShadowMailProposal[], nowMs: number, statePath?: string): {
+  proposed: TcellShadowMailProposal[];
+  suppressed: TcellShadowMailSuppression[];
+  stateError?: unknown;
+} {
+  if (proposals.length === 0) return { proposed: [], suppressed: [] };
+  const path = statePath ?? tcellShadowDedupePath();
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    return withFileLockSync(`${path}.lock`, () => {
+      const state = loadTcellShadowDedupeState(path);
+      const lastProposedAt = Object.assign(Object.create(null) as Record<string, number>, state.lastProposedAt);
+      let changed = false;
+      for (const [causeGroupId, at] of Object.entries(lastProposedAt)) {
+        if (nowMs - at >= TCELL_SHADOW_DEDUPE_WINDOW_MS) {
+          delete lastProposedAt[causeGroupId];
+          changed = true;
+        }
+      }
+
+      const proposed: TcellShadowMailProposal[] = [];
+      const suppressed: TcellShadowMailSuppression[] = [];
+      for (const proposal of proposals) {
+        const last = lastProposedAt[proposal.causeGroupId];
+        if (last !== undefined && nowMs - last < TCELL_SHADOW_DEDUPE_WINDOW_MS) {
+          suppressed.push({ proposal, lastProposedAt: last, eligibleAt: last + TCELL_SHADOW_DEDUPE_WINDOW_MS,
+            suppressionReason: 'hourly-dedupe' });
+          continue;
+        }
+        lastProposedAt[proposal.causeGroupId] = nowMs;
+        changed = true;
+        proposed.push(proposal);
+      }
+
+      if (changed) {
+        const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+        try {
+          writeFileSync(tmp, `${JSON.stringify({ version: 1, lastProposedAt }, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+          renameSync(tmp, path);
+        } finally {
+          try { unlinkSync(tmp); } catch { /* rename succeeded or temp was never created */ }
+        }
+      }
+      return { proposed, suppressed };
+    });
+  } catch (stateError) {
+    return { proposed: [], suppressed: proposals.map(proposal => ({ proposal, suppressionReason: 'dedupe-state-unavailable' })), stateError };
+  }
+}
+
+function proposeTcellShadowMail(classification: TcellHealthClassification): {
+  proposals: TcellShadowMailProposal[]; proposalsTruncated: number; missingCause: number;
+} {
+  const byCause = new Map<string, typeof classification.decisions>();
+  let missingCause = 0;
+  for (const decision of classification.decisions) {
+    if (decision.classification !== 'stalled' && decision.classification !== 'infected') continue;
+    if (!decision.causeGroupId || !decision.causeGroupSize) { missingCause++; continue; }
+    const group = byCause.get(decision.causeGroupId) ?? [];
+    group.push(decision);
+    byCause.set(decision.causeGroupId, group);
+  }
+
+  const proposals: TcellShadowMailProposal[] = [];
+  for (const [causeGroupId, decisions] of byCause) {
+    const infected = decisions.filter(decision => decision.classification === 'infected');
+    const selected = infected.length ? infected : decisions;
+    const first = selected[0]!;
+    const reason = infected.length
+      ? (infected.some(decision => decision.reason === 'cause-quorum') ? 'cause-quorum' : 'risk-signal')
+      : 'no-progress-30m';
+    const runIds = [...new Set(selected.map(decision => decision.runId))];
+    proposals.push({
+      causeGroupId,
+      target: infected.length ? 'macrophage' : 'doctor',
+      reason,
+      runIds: runIds.slice(0, 25),
+      runIdsTruncated: runIds.length > 25,
+      causeGroupSize: first.causeGroupSize!,
+    });
+  }
+  return { proposals: proposals.slice(0, 100), proposalsTruncated: Math.max(0, proposals.length - 100), missingCause };
+}
+
 export const GROK_EXPIRY_ALERT_WINDOW_MS = 4 * 60 * 60 * 1000;
 
 function durationLabel(ms: number): string {
@@ -85,7 +229,7 @@ function liveCommand(jobId: string, raw: string): string {
 }
 
 /** One five-minute guardian observation. No schedule state or crontab is mutated in shadow mode. */
-export async function guardianTick(now: Date, plan: GuardianPlan, deps: GuardianDeps = {}): Promise<{ mode: 'shadow' | 'live'; wouldRun: string[]; executed: number; credentialAlert?: string }> {
+export async function guardianTick(now: Date, plan: GuardianPlan, deps: GuardianDeps = {}): Promise<{ mode: 'shadow' | 'live'; wouldRun: string[]; executed: number; credentialAlert?: string; tcellPatrol?: TcellPatrolSummary }> {
   if (!Number.isFinite(now.getTime())) throw new RangeError('invalid tick time');
   const mode = deps.config?.guardian?.mode === 'live' ? 'live' : 'shadow';
   let expiryLine: string | null = null;
@@ -109,6 +253,51 @@ export async function guardianTick(now: Date, plan: GuardianPlan, deps: Guardian
       errorName: error instanceof Error ? error.name : 'unknown',
     });
   }
+  let tcellPatrol: TcellPatrolSummary | undefined;
+  if (deps.readTcellHealthCards) {
+    try {
+      const cards = await deps.readTcellHealthCards(now);
+      const classification = classifyTcellHealthCards(cards, now.getTime());
+      const shadowMail = proposeTcellShadowMail(classification);
+      const reservedMail = reserveTcellShadowMail(shadowMail.proposals, now.getTime(), deps.tcellDedupeStatePath);
+      tcellPatrol = { total: classification.total, measured: classification.measured,
+        unmeasured: classification.unmeasuredRunIds.length, counts: classification.counts };
+      // One bounded shadow observation per guardian tick. Cause signatures are represented only by a digest.
+      debug.log('guardian.tcell', 'shadow-classification', {
+        mode: 'shadow', ...tcellPatrol,
+        shadowMailProposed: reservedMail.proposed.length,
+        shadowMailSuppressed: reservedMail.suppressed.length,
+        shadowMailProposalsTruncated: shadowMail.proposalsTruncated,
+        shadowMailMissingCause: shadowMail.missingCause,
+        decisions: classification.decisions.slice(0, 100).map(({ runId, stage, classification: verdict, reason, causeGroupId, causeGroupSize }) => ({
+          runId, stage, classification: verdict, reason, ...(causeGroupId ? { causeGroupId, causeGroupSize } : {}),
+        })),
+        decisionsTruncated: classification.decisions.length > 100,
+      });
+      if (reservedMail.stateError) {
+        debug.log('guardian.tcell', 'shadow-mail-dedupe-unavailable', {
+          mode: 'shadow', errorName: reservedMail.stateError instanceof Error ? reservedMail.stateError.name : 'unknown',
+          suppressed: reservedMail.suppressed.length,
+        });
+      }
+      for (const suppressed of reservedMail.suppressed) {
+        debug.log('guardian.tcell', 'shadow-mail-suppressed', {
+          mode: 'shadow', ...suppressed.proposal, suppressionReason: suppressed.suppressionReason,
+          ...(suppressed.lastProposedAt !== undefined ? { lastProposedAt: suppressed.lastProposedAt } : {}),
+          ...(suppressed.eligibleAt !== undefined ? { eligibleAt: suppressed.eligibleAt } : {}),
+        });
+      }
+      for (const proposal of reservedMail.proposed) {
+        debug.log('guardian.tcell', 'shadow-mail-proposed', {
+          mode: 'shadow', recipientCandidate: 'OP', ownerRule: 'first-recipient-ack', ...proposal,
+        });
+      }
+    } catch (error) {
+      debug.log('guardian.tcell', 'observation-failed', {
+        mode: 'shadow', errorName: error instanceof Error ? error.name : 'unknown',
+      });
+    }
+  }
   const timeZone = plan.timeZone ?? resolveTimeZone().timeZone;
   const wouldRun: string[] = [];
   let executed = 0;
@@ -125,7 +314,7 @@ export async function guardianTick(now: Date, plan: GuardianPlan, deps: Guardian
       if (outcome.code !== 0) throw new Error(`guardian job ${job.id} exited ${outcome.code}`);
     }
   }
-  return { mode, wouldRun, executed, ...(expiryLine ? { credentialAlert: expiryLine } : {}) };
+  return { mode, wouldRun, executed, ...(expiryLine ? { credentialAlert: expiryLine } : {}), ...(tcellPatrol ? { tcellPatrol } : {}) };
 }
 
 export interface GuardianDayDeps {

package/src/domains/knowledge.ts

@@ -52,7 +52,7 @@ export interface KnowledgeDoc {
   //     의미검색으로 회상(domain='elanous'). [[self-awareness]].
   //   memory = M3 consolidation(2026-07-08): 흐린 에피소드 다수를 의미 umbrella 1건으로
   //     압축·영속(에피소드→의미·수면 공고화). 원본은 consolidated 마킹.
-  kind: 'signal' | 'dig' | 'alpha' | 'xreport' | 'morning' | 'outbound' | 'docs' | 'memory' | 'taste';
+  kind: 'signal' | 'dig' | 'alpha' | 'xreport' | 'morning' | 'outbound' | 'docs' | 'memory' | 'taste' | 'reference';
   sector_tags: string | null;
   text: string;
   source_ref: string | null;

package/src/esc-abort-gate.ts

@@ -33,7 +33,7 @@ import type { ModalBounds, ModalSurface } from './display/modal-stack.js';
 import type { KeyEvent } from './display/types.js';
 import type { ThemeTokens } from './theme/tokens.js';
 import { debug } from './debug/log.js';
-import { abortTurnOnly } from './turn-abort-scope.js';
+import { abortAndKillChildren, abortTurnOnly } from './turn-abort-scope.js';
 import { SELF_IMPLEMENT_TOOL_NAMES } from './boot/daemon-tools/self-implement-names.js';
 
 export const DASHBOARD_CLARIFICATION_REQUEST = Symbol.for('elanous.dashboard.clarification-request');
@@ -57,6 +57,10 @@ export interface EscAbortGateDeps {
   getWaitingTargetNames?: () => readonly string[];
   /** Only an identified foreground harness run may bypass the sub-agent confirmation. */
   shouldAbortImmediately?: () => boolean;
+  /** Seat mode can have no operator to answer a confirmation: Esc stops this turn and its children without opening a modal. */
+  forceStopWithoutModal?: () => boolean;
+  /** Non-modal replacement for the approval surface in unattended TUI mode. Timeout/cancel resolves false. */
+  confirmStopInline?: () => Promise<boolean>;
   /** Called before abortTurnOnly so the UI can paint a visible pending state immediately. */
   onAbortPending?: (event: { running: number; repeat: number; targets: readonly string[] }) => void;
   /** Called when another Escape arrives after the first abort request. */
@@ -218,7 +222,9 @@ export function createEscAbortGate(deps: EscAbortGateDeps): EscAbortGate {
   let current: ApprovalModalHandle | null = null;
   let currentDispose: (() => void) | null = null;
   let abortPending = false;
+  let inlineConfirmationPending = false;
   let escapePresses = 0;
+  let disposed = false;
 
   const redraw = (): void => {
     try { deps.requestRedraw?.(); } catch { /* ignore */ }
@@ -282,6 +288,31 @@ export function createEscAbortGate(deps: EscAbortGateDeps): EscAbortGate {
         return;
       }
       const running = deps.getRunningCount();
+      if (running > 0 && deps.forceStopWithoutModal?.()) {
+        if (inlineConfirmationPending) return;
+        if (!deps.confirmStopInline) {
+          debug.log('esc.abort', 'unattended-force-stop', { running, repeat: Math.max(0, escapePresses - 1) });
+          abortAndKillChildren(deps.abortCtrl);
+          redraw();
+          return;
+        }
+        inlineConfirmationPending = true;
+        debug.log('esc.abort', 'unattended-inline-confirmation', { running, repeat: Math.max(0, escapePresses - 1) });
+        void deps.confirmStopInline().then((confirmed) => {
+          if (confirmed && !disposed && !deps.abortCtrl.signal.aborted) {
+            debug.log('esc.abort', 'unattended-inline-confirmed', { running });
+            abortAndKillChildren(deps.abortCtrl);
+          } else {
+            debug.log('esc.abort', 'unattended-inline-cancelled', { running, reason: 'declined-or-timeout' });
+            resetAbortRequestState();
+          }
+        }).catch((error) => {
+          debug.log('esc.abort', 'unattended-inline-failed', { reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' });
+          resetAbortRequestState();
+        }).finally(() => { inlineConfirmationPending = false; redraw(); });
+        redraw();
+        return;
+      }
       if (running <= 0 || deps.shouldAbortImmediately?.()) {
         debug.log('esc.abort', 'abort-immediately', { running, repeat: Math.max(0, escapePresses - 1) });
         abortPendingTurn(running);
@@ -347,6 +378,7 @@ export function createEscAbortGate(deps: EscAbortGateDeps): EscAbortGate {
       resetAbortRequestState();
     },
     dispose(): void {
+      disposed = true;
       if (current) current.dispose(false);
       resetAbortRequestState();
       close();

package/src/execution-loop/launch-gate.ts

@@ -1,6 +1,9 @@
 import { createHash } from 'node:crypto';
-import { readFileSync } from 'node:fs';
+import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, writeSync } from 'node:fs';
+import { join, resolve } from 'node:path';
 import { debug } from '../debug/log.js';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { assertLedgerPathPolicy } from '../harness/launch-utterance-ledger.js';
 import { extractVerbatimOriginalAsk } from '../self-implement/goal-author.js';
 import { loadRunLedger } from '../self-implement/run-ledger.js';
 import { queryRunningRuns, type QueriedRunningRunsResult } from '../self-implement/running-runs.js';
@@ -252,6 +255,8 @@ export interface PreLaunchGateInput {
 
 export interface PreLaunchGateDeps extends ActiveRunsForGoalDeps {
   activeRuns?: (goalId: string) => ActiveRunsForGoal;
+  /** LAUNCH-SINGLE-DOOR-1C — 주입 우선 단일문: 시험 우주가 격리 루트의 문을 끼워 생산 배선을 그대로 검증한다. */
+  launchDoor?: LaunchRequestDoor;
 }
 
 export interface PreLaunchGateDecision {
@@ -279,3 +284,203 @@ function decidePreLaunch(input: PreLaunchGateInput, deps: PreLaunchGateDeps): Pr
   }
   return { action: 'proceed', sameGoalActiveRuns, budget, reason: sameGoalActiveRuns === 'unknown' ? 'active runs unknown' : input.forceLaunch && sameGoalActiveRuns.length > 0 ? 'duplicate overridden by force-launch' : 'no confirmed duplicate' };
 }
+
+// ─────────────────────────────────────────────────────────────────────────────────────
+// LAUNCH-SINGLE-DOOR-1C — 발사 요청의 단일 문.
+// ─────────────────────────────────────────────────────────────────────────────────────
+
+/** Env contract: hand 가 소비한 requestId 를 자식 say 가 물려받아 같은 문을 다시 두드리지 않게 한다(한 번만 상속). */
+export const LAUNCH_DOOR_RECEIPT_ENV = 'ELANOUS_LAUNCH_DOOR_RECEIPT';
+
+/** append 전용 요청 원장의 행 종류 — 요청(중복 포함)·소비·거절·강제·실패·단일문 사용 불가 관측. */
+export type LaunchRequestLedgerEvent = 'requested' | 'consumed' | 'refused-duplicate' | 'forced-duplicate' | 'launch-failed' | 'door-unavailable';
+
+/** append 전용 요청 원장의 한 행 — 행은 지우거나 고치지 않는다(관측 전용). */
+export interface LaunchRequestLedgerRow {
+  readonly event: LaunchRequestLedgerEvent;
+  readonly requestId: string;
+  readonly at: string;
+  readonly source?: string;
+  readonly receiptId?: string;
+  readonly reason?: string;
+}
+
+/** requestId 단위 소비 영수증 — 최초 1회만 발급된다(O_EXCL 파일이 곧 영수증이다). */
+export interface LaunchRequestReceipt {
+  readonly requestId: string;
+  readonly receiptId: string;
+  readonly at: string;
+  readonly source?: string;
+}
+
+/** `consume` 의 답 — `refused` 는 기존 영수증을 읽어 사유와 함께 거절한 것이다. */
+export type LaunchRequestConsumption =
+  | { readonly status: 'consumed'; readonly requestId: string; readonly receiptId: string; readonly receiptAt: string; readonly inherited?: true }
+  | { readonly status: 'forced'; readonly requestId: string; readonly receiptId: string | null; readonly receiptAt: string | null; readonly reason: string }
+  | { readonly status: 'refused'; readonly requestId: string; readonly receiptId: string | null; readonly receiptAt: string | null; readonly reason: string }
+  | { readonly status: 'unavailable'; readonly requestId: string; readonly reason: string };
+
+/** 발사 요청의 단일 문 — 원장 append · 단일 소비 · 실패 기록 · 원장 조회. */
+export interface LaunchRequestDoor {
+  /** 요청 한 건을 원장에 append 하고 그 requestId 를 돌려준다(중복 재요청도 매번 append 된다). */
+  requestId(ask: string): string;
+  /** requestId 단위 단일 소비 — 영수증은 최초 1회만 발급된다(두 번째는 기존 영수증과 사유로 거절). */
+  consume(requestId: string, opts?: { readonly force?: boolean; readonly inheritedReceipt?: string }): LaunchRequestConsumption;
+  /** 발사 실패 사유를 원장에 append 한다(관측 — 발사를 막지 않는다). */
+  fail(requestId: string, reason: string): void;
+  /** 원장 조회 — 중복 거절·실패·재시도 사유를 읽는다(인자를 주면 그 requestId 의 행만). */
+  rows(requestId?: string): readonly LaunchRequestLedgerRow[];
+}
+
+/** 단일문 deps — 원장 뿌리(기본 = 이 우주의 실효 인스턴스 루트)·시계·요청 출처 표지. */
+export interface LaunchRequestDoorDeps {
+  readonly root?: string;
+  readonly now?: () => Date;
+  readonly source?: string;
+}
+
+const LAUNCH_REQUEST_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const LAUNCH_REQUEST_DATE_FILE = /^\d{4}-\d{2}-\d{2}\.jsonl$/;
+
+function launchRequestLedgerDir(root: string): string {
+  return join(resolve(root), 'launch-requests');
+}
+
+/** 단일문을 연다 — 문 자체는 상태를 갖지 않고, 원장·영수증은 이 우주의 인스턴스 루트 아래 파일로 남는다. */
+export function openLaunchRequestDoor(deps: LaunchRequestDoorDeps = {}): LaunchRequestDoor {
+  const dir = launchRequestLedgerDir(deps.root ?? effectiveInstanceRoot());
+  const receiptsDir = join(dir, 'receipts');
+  const now = deps.now ?? (() => new Date());
+  const source = deps.source;
+
+  const observe = (event: string, data: Record<string, unknown>): void => {
+    try { debug.log('execution-loop.launch-gate', event, data, { level: 'warn' }); } catch { /* 관측은 fail-soft */ }
+  };
+
+  const appendRow = (row: LaunchRequestLedgerRow): boolean => {
+    try {
+      assertLedgerPathPolicy(dir);
+      mkdirSync(dir, { recursive: true, mode: 0o700 });
+      assertLedgerPathPolicy(dir);
+      if (!lstatSync(dir).isDirectory()) throw new Error(`launch request ledger dir is not a directory: ${dir}`);
+      const file = join(dir, `${row.at.slice(0, 10)}.jsonl`);
+      const fd = openSync(file, constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | constants.O_NOFOLLOW, 0o600);
+      try {
+        if (!fstatSync(fd).isFile()) throw new Error(`launch request ledger file is not a regular file: ${file}`);
+        writeSync(fd, `${JSON.stringify(row)}\n`);
+      } finally { closeSync(fd); }
+      return true;
+    } catch (error) {
+      observe('request-ledger-unwritten', { event: row.event, requestId: row.requestId, reason: error instanceof Error ? error.message : String(error) });
+      return false;
+    }
+  };
+
+  const readReceipt = (requestId: string): LaunchRequestReceipt | null => {
+    try {
+      const fd = openSync(join(receiptsDir, `${requestId}.json`), constants.O_RDONLY | constants.O_NOFOLLOW);
+      try {
+        if (!fstatSync(fd).isFile()) return null;
+        const parsed = JSON.parse(readFileSync(fd, 'utf8')) as LaunchRequestReceipt;
+        return parsed && typeof parsed === 'object' && parsed.requestId === requestId
+          && typeof parsed.receiptId === 'string' && typeof parsed.at === 'string' ? parsed : null;
+      } finally { closeSync(fd); }
+    } catch { return null; }
+  };
+
+  const requestId = (ask: string): string => {
+    const id = launchRequestId(ask);
+    appendRow({ event: 'requested', requestId: id, at: now().toISOString(), ...(source ? { source } : {}) });
+    return id;
+  };
+
+  const consume = (id: string, opts: { readonly force?: boolean; readonly inheritedReceipt?: string } = {}): LaunchRequestConsumption => {
+    if (!LAUNCH_REQUEST_ID_PATTERN.test(id)) {
+      return { status: 'unavailable', requestId: id, reason: `requestId 가 원장 키로 쓸 수 없다: ${JSON.stringify(id)}` };
+    }
+    const at = now().toISOString();
+    // 부모(hand)가 같은 requestId 를 이미 소비했다면 상속 영수증으로 지나간다 — 새 영수증을 만들지 않는다.
+    if (opts.inheritedReceipt !== undefined && opts.inheritedReceipt === id) {
+      const inherited = readReceipt(id);
+      if (inherited !== null) {
+        try { debug.log('execution-loop.launch-gate', 'request-consumption-inherited', { requestId: id, receiptId: inherited.receiptId }); } catch { /* 관측은 fail-soft */ }
+        return { status: 'consumed', requestId: id, receiptId: inherited.receiptId, receiptAt: inherited.at, inherited: true };
+      }
+    }
+    const receipt: LaunchRequestReceipt = { requestId: id,
+      receiptId: `receipt-${createHash('sha256').update(`${id}:${at}`).digest('hex').slice(0, 12)}`, at,
+      ...(source ? { source } : {}) };
+    let created = true;
+    try {
+      assertLedgerPathPolicy(receiptsDir);
+      mkdirSync(receiptsDir, { recursive: true, mode: 0o700 });
+      assertLedgerPathPolicy(receiptsDir);
+      const fd = openSync(join(receiptsDir, `${id}.json`), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+      try {
+        if (!fstatSync(fd).isFile()) throw new Error(`소비 영수증이 일반 파일이 아니다: ${id}`);
+        writeSync(fd, JSON.stringify(receipt));
+      } finally { closeSync(fd); }
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException)?.code !== 'EEXIST') {
+        const reason = error instanceof Error ? error.message : String(error);
+        observe('request-receipt-unavailable', { requestId: id, reason });
+        appendRow({ event: 'door-unavailable', requestId: id, at, ...(source ? { source } : {}), reason });
+        return { status: 'unavailable', requestId: id, reason: `소비 영수증을 만들지 못했다 — 발사를 막지 않는다: ${reason}` };
+      }
+      created = false;
+    }
+    if (created) {
+      appendRow({ event: 'consumed', requestId: id, at, ...(source ? { source } : {}), receiptId: receipt.receiptId });
+      return { status: 'consumed', requestId: id, receiptId: receipt.receiptId, receiptAt: receipt.at };
+    }
+    const existing = readReceipt(id);
+    if (existing === null) {
+      const reason = `requestId ${id} 의 소비 영수증이 이미 있지만 읽지 못했다 — 중복 발사 거절`;
+      appendRow({ event: 'refused-duplicate', requestId: id, at, ...(source ? { source } : {}), reason });
+      return { status: 'refused', requestId: id, receiptId: null, receiptAt: null, reason };
+    }
+    if (opts.force === true) {
+      const reason = `requestId ${id} 는 영수증 ${existing.receiptId} (${existing.at}) 로 이미 소비됐다 — force 로 다시 띄운다`;
+      appendRow({ event: 'forced-duplicate', requestId: id, at, ...(source ? { source } : {}), receiptId: existing.receiptId, reason });
+      return { status: 'forced', requestId: id, receiptId: existing.receiptId, receiptAt: existing.at, reason };
+    }
+    const reason = `requestId ${id} 는 영수증 ${existing.receiptId} (${existing.at}) 로 이미 소비됐다 — 중복 발사 거절`;
+    appendRow({ event: 'refused-duplicate', requestId: id, at, ...(source ? { source } : {}), receiptId: existing.receiptId, reason });
+    return { status: 'refused', requestId: id, receiptId: existing.receiptId, receiptAt: existing.at, reason };
+  };
+
+  const fail = (id: string, reason: string): void => {
+    appendRow({ event: 'launch-failed', requestId: id, at: now().toISOString(),
+      ...(source ? { source } : {}), reason: reason.trim() || '사유 없음' });
+  };
+
+  const rows = (requestId?: string): readonly LaunchRequestLedgerRow[] => {
+    const result: LaunchRequestLedgerRow[] = [];
+    let names: string[];
+    try {
+      assertLedgerPathPolicy(dir);
+      names = readdirSync(dir);
+    } catch { return result; }
+    for (const name of names.filter((candidate) => LAUNCH_REQUEST_DATE_FILE.test(candidate)).sort()) {
+      let text: string;
+      try {
+        const fd = openSync(join(dir, name), constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+          if (!fstatSync(fd).isFile()) continue;
+          text = readFileSync(fd, 'utf8');
+        } finally { closeSync(fd); }
+      } catch { continue; }
+      for (const line of text.split('\n')) {
+        if (!line) continue;
+        try {
+          const row = JSON.parse(line) as LaunchRequestLedgerRow;
+          if (row && typeof row === 'object' && typeof row.event === 'string' && typeof row.requestId === 'string'
+            && typeof row.at === 'string' && (requestId === undefined || row.requestId === requestId)) result.push(row);
+        } catch { /* 찢어진 줄은 건너뛴다 */ }
+      }
+    }
+    return result;
+  };
+
+  return { requestId, consume, fail, rows };
+}

package/src/graph-runner/graph-cli.ts

@@ -31,19 +31,21 @@ export function registerGraphCommands(program: Command, runsDeps: { root?: strin
   graph.command('adapt-report')
     .description('Measure recorded graph path diversity, unit calls, adaptations and landings for one goal')
     .requiredOption('--goal <id>', 'Goal ID to measure')
+    .option('--from <timestamp>', 'Include runs started at or after this ISO timestamp')
+    .option('--to <timestamp>', 'Exclude runs started at or after this ISO timestamp')
     .option('--json', 'Print measurement as JSON')
-    .action(async (opts: { goal: string; json?: boolean }) => {
+    .action(async (opts: { goal: string; from?: string; to?: string; json?: boolean }) => {
       try {
         const { queryGraphAdaptReport } = await import('../self-implement/run-ledger.js');
-        const report = queryGraphAdaptReport(opts.goal);
+        const report = queryGraphAdaptReport(opts.goal, undefined, { since: opts.from, until: opts.to });
         if (opts.json) await writeStdoutJson(JSON.stringify(report) + '\n');
-        else if (report.runCount === 0) console.log(`graph adapt-report: ${opts.goal} · 표본 0 · 제외 ${report.excludedCount} ${JSON.stringify(report.exclusionReasons)}`);
+        else if (report.runCount === 0) console.log(`graph adapt-report: ${opts.goal} · 표본 0 · 제외 ${report.excludedCount} ${JSON.stringify(report.exclusionReasons)} · 미측정 ${report.unmeasuredCount} ${JSON.stringify(report.unmeasuredReasons)}`);
         else {
           const landing = (group: typeof report.adapted) => group.denominator
             ? `${group.landed}/${group.denominator} (${(group.rate! * 100).toFixed(1)}%)` : '표본 0';
           console.log(`graph adapt-report: ${opts.goal} · 경로 ${report.uniquePathSignatures} · 유닛 호출 ${report.unitCallCount} · 적응 ${report.adaptationCount}`);
           console.log(`적응 착지율 ${landing(report.adapted)} · 비적응 착지율 ${landing(report.nonAdapted)}`);
-          console.log(`제외 ${report.excludedCount} ${JSON.stringify(report.exclusionReasons)}`);
+          console.log(`제외 ${report.excludedCount} ${JSON.stringify(report.exclusionReasons)} · 미측정 ${report.unmeasuredCount} ${JSON.stringify(report.unmeasuredReasons)}`);
         }
       } catch (error) {
         console.error(`graph adapt-report: ${error instanceof Error ? error.message : String(error)}`);
@@ -256,10 +258,31 @@ export function registerGraphCommands(program: Command, runsDeps: { root?: strin
           const { createScheduleSource } = await import('../workflow-runtime/triggers/schedule-source.js');
           const graphFile = resolve(file);
           const source = createScheduleSource();
+          const graphDocument = parseYaml(readFileSync(graphFile, 'utf8')) as { graph_id?: string; loop?: { trigger?: { events?: string[] } } };
+          const cutEventSubscribed = graphDocument.graph_id === 'release-loop'
+            && graphDocument.loop?.trigger?.events?.includes('release.cut.due') === true;
           // The CLI tick callback is the graph counterpart of the workflow scheduler's onEmit.
           const onScheduledTick = async () => {
             try {
               const { notifyGraphEvents } = await import('./graph-notify.js');
+              if (cutEventSubscribed) {
+                const { emitDueReleaseCutEvents } = await import('../release-loop/release-schedule.js');
+                const { runUnattendedRelease } = await import('../../scripts/release-loop/unattended-release.js');
+                try {
+                  await emitDueReleaseCutEvents(new Date().toISOString(), async event => {
+                    const fired = await runUnattendedRelease({ version: event.version, triggerEvent: event });
+                    await notifyGraphEvents();
+                    if (fired.state?.status === 'failed') console.error(`graph tick: ${fired.state.runId}: failed`);
+                  });
+                } catch (error) {
+                  debug.log('graph.runner', 'cut-event-failed', { file: graphFile, error: error instanceof Error ? error.message : String(error) });
+                  console.error(`graph cut event: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                const resumed = await graphTick(graphFile, { deps: { notify: async () => { await notifyGraphEvents(); } } });
+                if (resumed.status === 'refused') console.error(`graph tick: refused: ${resumed.reason}`);
+                else if (resumed.status === 'failed') console.error(`graph tick: ${resumed.runId}: failed`);
+                return;
+              }
               const result = await graphTick(graphFile, { startIfIdle: true, deps: { notify: async () => { await notifyGraphEvents(); } } });
               if (result.status === 'refused') console.error(`graph tick: refused: ${result.reason}`);
               else if (result.status === 'failed') console.error(`graph tick: ${result.runId}: failed`);

package/src/graph-runner/in-process-registry.ts

@@ -0,0 +1,37 @@
+/** A run-scoped registry keeps in-process graph effects out of YAML and shell recipes. */
+export interface InProcessHandlerContext {
+  readonly graphId: string;
+  readonly runId: string;
+  readonly nodeId: string;
+  readonly input: unknown;
+  readonly outputs: Readonly<Record<string, unknown>>;
+}
+
+export interface InProcessHandlerResult {
+  readonly ok: boolean;
+  /** Named edge outcome from the graph's declared map. */
+  readonly outcome: string;
+  readonly evidence?: Readonly<Record<string, unknown>>;
+  readonly error?: string;
+}
+
+export type InProcessHandler = (context: InProcessHandlerContext) =>
+  InProcessHandlerResult | Promise<InProcessHandlerResult>;
+
+export type InProcessHandlerRegistry = Readonly<Record<string, InProcessHandler>>;
+
+function inProcessHandlerName(recipe: string): string | undefined {
+  if (!recipe.startsWith('handler:')) return undefined;
+  const name = recipe.slice('handler:'.length);
+  if (!/^[a-z][a-z0-9-]*$/.test(name)) throw new Error(`invalid in-process handler recipe: ${recipe}`);
+  return name;
+}
+
+export function requireInProcessHandler(recipe: string, nodeId: string,
+  registry: InProcessHandlerRegistry | undefined): InProcessHandler | undefined {
+  const name = inProcessHandlerName(recipe);
+  if (name === undefined) return undefined;
+  const handler = registry && Object.hasOwn(registry, name) ? registry[name] : undefined;
+  if (typeof handler !== 'function') throw new Error(`unknown in-process handler for ${nodeId}: ${name}`);
+  return handler;
+}