elanous 0.2.8 → 0.2.10

package/src/harness/browser-verify.ts

@@ -22,6 +22,8 @@ import { IMAGE_LOAD_STATE_SOURCE } from './image-load-state.js';
 const execFileAsync = promisify(execFile);
 // Longer than aside's own ~10 s daemon auth-challenge timeout, so «Aside isn't running» reaches stderr before we kill it (10-01 live).
 const DEFAULT_ASIDE_TIMEOUT_MS = 30_000;
+const ASIDE_SHOT_MAX_BYTES = 8 * 1024 * 1024;
+const ASIDE_SHOT_MARKER = 'ELANOUS_SHOT_BASE64:';
 // Observed load events and complete page content arrive within this window; timeout remains non-blocking.
 const CDP_LOAD_WAIT_TIMEOUT_MS = 3_000;
 
@@ -188,6 +190,7 @@ function buildAsideScript(url: string): string {
     `    const state = await page.evaluate(() => { const imageCounts = ${IMAGE_COUNTS_EXPRESSION}; return { bodyLength: document.body?.innerText.length ?? 0, unloadedImageCount: imageCounts.broken, pendingLazyImages: imageCounts.pendingLazy }; });`,
     '    const screenshot = await page.screenshot({ fullPage: true });',
     '    console.log(JSON.stringify({ title, ...state, screenshotBytes: screenshot?.length ?? 0 }));',
+    `    if (screenshot?.length > 0 && screenshot.length <= ${ASIDE_SHOT_MAX_BYTES}) console.log('${ASIDE_SHOT_MARKER}' + Buffer.from(screenshot).toString('base64'));`,
     '  } finally { try { await closeTab(page); } catch {} }',
     '})();',
   ].join('\n');
@@ -223,6 +226,18 @@ function parseAsideObservation(stdout: string): { title: string; bodyLength: num
   throw new Error('aside observation output missing JSON');
 }
 
+function decodeAsideScreenshot(stdout: string, screenshotBytes: number): Buffer | undefined {
+  if (screenshotBytes === 0 || screenshotBytes > ASIDE_SHOT_MAX_BYTES) return undefined;
+  const lines = stripScreenAnsi(stdout).split(/\r?\n/);
+  const shots = lines.filter((line) => line.startsWith(ASIDE_SHOT_MARKER));
+  if (shots.length !== 1) return undefined;
+  const encoded = shots[0]!.slice(ASIDE_SHOT_MARKER.length);
+  if (encoded.length > Math.ceil(ASIDE_SHOT_MAX_BYTES / 3) * 4 || !/^[A-Za-z0-9+/]+={0,2}$/.test(encoded)) return undefined;
+  const buf = Buffer.from(encoded, 'base64');
+  if (buf.length !== screenshotBytes || buf.toString('base64') !== encoded) return undefined;
+  return buf;
+}
+
 function asideErrorResult(url: string, error: unknown, kind?: AsideRunStatus['kind']): DeployVerifyResult {
   const message = error instanceof Error ? error.message : String(error);
   const errorFinding = finding('aside-error', `aside 검증 오류: ${message.slice(0, 120)}${kind ? ` (${kind})` : ''}`, 'confirmed');
@@ -240,7 +255,7 @@ async function verifyAsidePage(url: string, deps: DeployVerifyDeps): Promise<Dep
     const script = await readFile(scriptPath, 'utf8');
     const runAside = deps.runAside ?? (async (command, args, options) => {
       try {
-        const result = await execFileAsync(command, args, { ...options, encoding: 'utf8' });
+        const result = await execFileAsync(command, args, { ...options, encoding: 'utf8', maxBuffer: Math.ceil(ASIDE_SHOT_MAX_BYTES / 3) * 4 + 1024 * 1024 });
         return { stdout: result.stdout, stderr: result.stderr, exitCode: 0 };
       } catch (error) {
         if ((error as NodeJS.ErrnoException).code === 'ENOENT') throw error;
@@ -273,12 +288,20 @@ async function verifyAsidePage(url: string, deps: DeployVerifyDeps): Promise<Dep
     if (status.kind === 'repl-error') return asideErrorResult(url, new Error('aside repl reported error'), status.kind);
     if (status.kind === 'no-marker') return asideErrorResult(url, new Error('aside observation output missing completion marker'), status.kind);
     const state = parseAsideObservation(observation.stdout);
+    const screenshot = decodeAsideScreenshot(observation.stdout, state.screenshotBytes);
+    let shotReason = state.screenshotBytes === 0 ? '스크린샷 0바이트' : state.screenshotBytes > ASIDE_SHOT_MAX_BYTES ? '8MB 상한 초과' : screenshot ? undefined : '스크린샷 데이터 없음 또는 불일치';
+    if (screenshot && deps.onScreenshot) {
+      try { deps.onScreenshot(screenshot); }
+      catch (error) { shotReason = (error as NodeJS.ErrnoException)?.code ?? '저장 콜백 오류'; }
+    }
+    observe('aside-shot', { bytes: state.screenshotBytes, written: !!screenshot && !shotReason && !!deps.onScreenshot, reason: shotReason ?? (deps.onScreenshot ? '없음' : '저장 요청 없음') });
     const structuredFindings: DeployVerifyFinding[] = [];
+    if (state.screenshotBytes === 0) structuredFindings.push(finding('aside-error', '스크린샷 0바이트 — 렌더 증거 없음', 'confirmed'));
     if (state.bodyLength < minBody) structuredFindings.push(finding('empty-body', `페이지 본문이 비어있음(len=${state.bodyLength}·렌더 실패 의심)`, 'suspected'));
     if (state.unloadedImageCount) structuredFindings.push(finding('unloaded-image', `로드되지 못한 그림 ${state.unloadedImageCount}개`, 'confirmed'));
     if (!state.title.trim()) structuredFindings.push(finding('empty-title', '문서 제목이 비어있음', 'confirmed'));
     const findings = structuredFindings.map(({ message }) => message);
-    const result: DeployVerifyResult = { ok: findings.length === 0, url, title: state.title, bodyLength: state.bodyLength, screenshotBytes: state.screenshotBytes, findings, unmeasured: ['javascript-errors'], ...(state.pendingLazyImages ? { pendingLazyImages: state.pendingLazyImages } : {}), ...(structuredFindings.length ? { structuredFindings } : {}) };
+    const result: DeployVerifyResult = { ok: findings.length === 0, url, title: state.title, bodyLength: state.bodyLength, screenshotBytes: state.screenshotBytes, findings, unmeasured: shotReason && (state.screenshotBytes === 0 || state.screenshotBytes > ASIDE_SHOT_MAX_BYTES || !!deps.onScreenshot) ? ['javascript-errors', 'screenshot'] : ['javascript-errors'], ...(state.pendingLazyImages ? { pendingLazyImages: state.pendingLazyImages } : {}), ...(structuredFindings.length ? { structuredFindings } : {}) };
     observe('verified-aside', { url: url.slice(0, 80), ok: result.ok, bodyLength: state.bodyLength, bytes: state.screenshotBytes, findings: findings.length, unmeasured: result.unmeasured });
     return result;
   } catch (error) {

package/src/harness/harness-cli-command.ts

@@ -1,7 +1,13 @@
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { readFileSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
+import { constants as osConstants } from 'node:os';
 import { resolve } from 'node:path';
+import { LogStore, logsDbPath } from '../mss/logging/log-store.js';
+import { loadSelfDevRun } from '../self-dev/run-store.js';
+import { normalizeRunId } from './harness-space.js';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { detectBursts, formatIncidentBurstWarning, readRunExits, recentBurst, recordRunExit } from './harness-incidents.js';
 import { Command, Option } from 'commander';
 import { runGitCommand } from '../git-fs/runner.js';
 import { GOAL_TYPES, lintGoalFile, parseGoalId, parseGoalType, tracedPathReferences, type GoalType } from '../self-implement/goal-author.js';
@@ -323,6 +329,191 @@ function resolveLaunchSubstrate(opts: HarnessSubstrateOpts): ResolvedHarnessSubs
   else console.log(head);
   return resolved;
 }
+type PodExit = { status: number | null; signal?: string | null };
+type PodExitReason = 'signal' | 'human-stop' | 'supervisor' | 'no-launch' | 'unknown';
+const STOPPING_SUPERVISOR_VERDICTS = new Set(['UNCONVERGEABLE', 'CONTRACT-CONFLICT']);
+// Ledger events that only exist once the child actually ran — any of them rules out «never reached the Pod».
+const LAUNCH_EVIDENCE_EVENTS = new Set(['job-applied', 'pod-child-run', 'reviewed', 'rework-budget', 'pr-opened']);
+
+/** Keep the run identity seen at launch even if the bounded output tail later drops it. */
+export function harnessPodRunId(output: string): string | undefined {
+  return output.match(/\[self-dev\][^\r\n]*\brun\s+(run-[a-z0-9_-]{8,64})(?=\s|$)/i)?.[1];
+}
+
+/** Classify a missing Pod result from run-scoped evidence, never from a nonzero exit alone. */
+export function classifyHarnessPodExit(
+  exit: PodExit,
+  output: string,
+  deps: {
+    loadLedger?: typeof loadRunLedger;
+    hasJobApplied?: (runId: string | undefined, output: string) => boolean | undefined;
+    supervisorDecision?: (runId: string) => { stopReason?: string; why?: string } | undefined;
+    loadCheckpoint?: typeof loadSelfDevRun;
+    runId?: string;
+  } = {},
+): { lines: string[]; reason: PodExitReason | 'pod-failure' } {
+  let podFailure: string | undefined;
+  let podJobFailed = false;
+  for (const line of output.split('\n').reverse()) {
+    if (!line.trimStart().startsWith('[{') || !line.includes('"error"')) continue;
+    try {
+      const results: unknown = JSON.parse(line);
+      if (!Array.isArray(results)) continue;
+      for (const result of results) {
+        if (!result || typeof result !== 'object') continue;
+        const error = (result as { error?: { code?: string; message?: string } }).error;
+        if (typeof error?.code !== 'string' || typeof error.message !== 'string' || !error.code.startsWith('pod-')) continue;
+        podFailure = error.message;
+        podJobFailed = error.code === 'pod-job-failed';
+        break;
+      }
+    } catch { /* Non-result stdout cannot establish that a Pod child ran. */ }
+    if (podFailure) break;
+  }
+  if (!podFailure) {
+    const summary = output.split('\n').find((line) => /\s❌\sfailed · .* — pod-[\w-]+: /.test(line));
+    podFailure = summary?.split(/\s❌\sfailed · .* — pod-[\w-]+: /)[1];
+    podJobFailed = summary?.includes(' — pod-job-failed: ') ?? false;
+  }
+  // Only the run announced at launch — another run id quoted in the output is not this run (review round 3).
+  const observedRunId = deps.runId ?? harnessPodRunId(output);
+  const runId = observedRunId ? normalizeRunId(observedRunId) : undefined;
+  if (podFailure) {
+    const childError = podJobFailed ? podFailure.split('childError=')[1]?.split('\\n', 1)[0]?.split('\n', 1)[0] : undefined;
+    try { debug.log('harness.pod', 'exit-classified', { runId, reason: 'pod-failure', status: exit.status, signal: exit.signal ?? null }); } catch { /* observation is fail-soft */ }
+    return { reason: 'pod-failure', lines: [podJobFailed && childError && childError !== 'no-result-line'
+      ? `Pod 안 자식이 실패했다 — ${childError}`
+      : `Pod 실행이 실패했다 — ${podFailure.split('\\n', 1)[0]}`] };
+  }
+  let ledger: ReturnType<typeof loadRunLedger> = null;
+  let ledgerReadable = false;
+  if (runId) {
+    try { ledger = (deps.loadLedger ?? loadRunLedger)(runId); ledgerReadable = ledger !== null; } catch { /* unreadable is not absent */ }
+  }
+  const signal = exit.signal ?? (exit.status !== null && exit.status > 128
+    ? Object.entries(osConstants.signals).find(([, number]) => number === exit.status! - 128)?.[0] : undefined);
+  const humanStop = ledger?.some((entry) => entry.event === 'human-stop');
+  // A continuing verdict (EXTEND · SUFFICIENT) is not why the run ended — only stopping verdicts count.
+  const supervisor = [...(ledger ?? [])].reverse().find((entry) =>
+    (entry.event === 'supervisor-decision' || entry.event === 'supervisor-verdict' || entry.event === 'rework-budget')
+      && STOPPING_SUPERVISOR_VERDICTS.has(String(entry.data.supervisorVerdict ?? entry.data.verdict))
+    || entry.event === 'run-status' && entry.data.stage === 'review-blocked');
+  let decision: { stopReason?: string; why?: string } | undefined;
+  if (runId) {
+    try { decision = (deps.supervisorDecision ?? lookupHarnessSupervisorDecision)(runId); } catch { /* unknown */ }
+  }
+  const verdict = decision?.stopReason ?? supervisor?.data.supervisorVerdict ?? supervisor?.data.verdict
+    ?? (supervisor?.event === 'run-status' ? supervisor.data.stage : undefined);
+  const reasonText = decision?.why ?? supervisor?.data.supervisorReason ?? supervisor?.data.reason;
+  const ledgerPrUrl = [...(ledger ?? [])].reverse().find((entry) => entry.event === 'pr-opened'
+    && (typeof entry.data.url === 'string' || typeof entry.data.prUrl === 'string'))?.data;
+  let checkpoint: ReturnType<typeof loadSelfDevRun> = null;
+  if (runId) {
+    try { checkpoint = (deps.loadCheckpoint ?? loadSelfDevRun)(runId); } catch { /* unreadable is not absent */ }
+  }
+  const pr = output.match(/https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/pull\/\d+\b/)?.[0]
+    ?? (typeof ledgerPrUrl?.url === 'string' ? ledgerPrUrl.url
+      : typeof ledgerPrUrl?.prUrl === 'string' ? ledgerPrUrl.prUrl : undefined)
+    ?? checkpoint?.results.find((result) => result.prUrl)?.prUrl;
+  let reason: PodExitReason;
+  let line: string;
+  if (humanStop) {
+    reason = 'human-stop';
+    line = '사람이 멈춘 런이다';
+  } else if (signal) {
+    reason = 'signal';
+    line = `런이 멈췄다(${signal}) — \`harness stop\` 이나 세션 종료일 수 있다 · 그 전까지 만든 PR 은 남아 있다`;
+  } else if (typeof verdict === 'string' || checkpoint?.supervisorStopReason) {
+    reason = 'supervisor';
+    line = `감독 판정: ${verdict ?? checkpoint?.supervisorStopReason}${typeof reasonText === 'string' && reasonText.trim() ? ` — ${reasonText.trim().split(/\r?\n/, 1)[0]}` : ''}`;
+  } else {
+    let applied: boolean | undefined;
+    try { applied = (deps.hasJobApplied ?? hasHarnessPodJobApplied)(runId, output); } catch { /* unknown */ }
+    const noLaunch = ledgerReadable && !ledger?.some((entry) => LAUNCH_EVIDENCE_EVENTS.has(entry.event))
+      && applied === false && !pr;
+    reason = noLaunch ? 'no-launch' : 'unknown';
+    line = noLaunch
+      ? 'Pod 실행에 닿지 못했다 — 풀·컨텍스트·SSH 연결을 확인하거나 `--substrate local` 로 명시하라'
+      : 'Pod 실행 여부 또는 종료 이유를 확인하지 못했다';
+  }
+  try { debug.log('harness.pod', 'exit-classified', { runId, reason, status: exit.status, signal: signal ?? null }); } catch { /* observation is fail-soft */ }
+  return { reason, lines: [line, ...(pr ? [`PR 이 남아 있다: ${pr}`] : [])] };
+}
+
+/** The classified status is the same exit handed to the launcher; ledger failure is never an exit failure. */
+export function recordClassifiedHarnessPodExit(runId: string | undefined, reason: string, status: number): void {
+  if (!runId) return;
+  try {
+    const signal = status > 128
+      ? Object.entries(osConstants.signals).find(([, number]) => number === status - 128)?.[0] ?? null : null;
+    recordRunExit({ runId, reason, status, signal, at: new Date().toISOString() }, effectiveInstanceRoot());
+  } catch { /* incident writes cannot change Pod output or exit */ }
+}
+
+/** Every Pod launch entrance (harness ask/say · dev ask --substrate pod) warns once after a recent burst; it never blocks the launch. */
+export function warnRecentIncidentBurst(
+  root: string = effectiveInstanceRoot(), now: Date = new Date(), write: (line: string) => void = (line) => console.error(line),
+): boolean {
+  try {
+    const burst = recentBurst(root, now);
+    if (!burst) return false;
+    write(formatIncidentBurstWarning(burst));
+    try { debug.log('harness.incident', 'burst', { reason: burst.reason, count: burst.count }); } catch { /* observation is fail-soft */ }
+    return true;
+  } catch { return false; /* incident reads cannot block a launch */ }
+}
+
+function lookupHarnessSupervisorDecision(runId: string): { stopReason?: string; why?: string } | undefined {
+  const path = logsDbPath();
+  if (!existsSync(path)) return undefined;
+  const store = LogStore.openReadOnly(path);
+  try {
+    let beforeId: number | undefined;
+    for (;;) {
+      const rows = store.query({ exactCategories: ['self-dev.supervisor'], events: ['decision'], grep: runId,
+        limit: 1_000, ...(beforeId === undefined ? {} : { beforeId }) });
+      for (const row of rows) {
+        try {
+          const data = JSON.parse(row.data ?? '{}') as Record<string, unknown>;
+          if (data.runId !== runId) continue;
+          return data.action === 'stop' && typeof data.stopReason === 'string'
+            ? { stopReason: data.stopReason, ...(typeof data.why === 'string' ? { why: data.why } : {}) }
+            : undefined;
+        } catch { /* Malformed observation is not evidence. */ }
+      }
+      if (rows.length < 1_000) return undefined;
+      beforeId = rows.at(-1)!.id;
+    }
+  } finally { store.close(); }
+}
+
+function hasHarnessPodJobApplied(runId: string | undefined, output: string): boolean | undefined {
+  const job = output.match(/\bsi-[a-z0-9-]+\b/i)?.[0];
+  if (!runId && !job) return undefined;
+  const path = logsDbPath();
+  if (!existsSync(path)) return undefined;
+  const store = LogStore.openReadOnly(path);
+  try {
+    for (const needle of new Set([runId, job].filter((value): value is string => value !== undefined))) {
+      let beforeId: number | undefined;
+      for (;;) {
+        const rows = store.query({ exactCategories: ['self-implement.pod'], events: ['job-applied'],
+          grep: needle, limit: 1_000, ...(beforeId === undefined ? {} : { beforeId }) });
+        if (rows.some((row) => {
+          try {
+            const data = JSON.parse(row.data ?? '{}') as Record<string, unknown>;
+            return (runId !== undefined && data.runId === runId)
+              || (job !== undefined && data.job === job && (runId === undefined || data.runId === undefined || data.runId === runId));
+          } catch { return false; }
+        })) return true;
+        if (rows.length < 1_000) break;
+        beforeId = rows.at(-1)!.id;
+      }
+    }
+    return false;
+  } finally { store.close(); }
+}
+
 /** ⭐ 런 계약의 실행 칸 = pod — 호스트는 그래프를 안 돌리고 Pod 로 보낸다(harness-pod-dispatch.ts). */
 async function onPod(opts: unknown, entrance: 'cli-harness-ask' | 'cli-harness-say', input: string, pool: string,
   recordDispatch: (input: DispatchTaskInput, deps?: DispatchTaskDeps) => ReturnType<typeof dispatchTask> = dispatchTask): Promise<void> {
@@ -334,6 +525,7 @@ async function onPod(opts: unknown, entrance: 'cli-harness-ask' | 'cli-harness-s
     process.exitCode = 2;
     return;
   }
+  warnRecentIncidentBurst();
   let dispatchRecorded = false;
   try {
     const goalText = entrance === 'cli-harness-ask' ? readFileSync(input, 'utf8') : input;
@@ -351,42 +543,16 @@ async function onPod(opts: unknown, entrance: 'cli-harness-ask' | 'cli-harness-s
   }
   const { dispatchHarnessOnPod } = await import('./harness-pod-dispatch.js');
   let output = '';
+  let runId: string | undefined;
   const status = await dispatchHarnessOnPod({ entrance, input, podPool: pool, ...(dispatchRecorded ? { dispatchRecorded: true } : {}), ...(o.podMemory ? { podMemory: o.podMemory } : {}), ...(o.autoMerge === false ? { autoMerge: false } : {}), ...(o.base ? { base: o.base } : {}), ...(o.json ? { json: true } : {}), ...(o.source ? { source: o.source } : {}) },
-    entrance === 'cli-harness-ask' ? { onOutput: (text) => { output = (output + text).slice(-16_000); } } : {});
+    { onOutput: (text) => {
+      runId ??= harnessPodRunId(output + text);
+      output = (output + text).slice(-16_000);
+    } });
   if (status !== 0) {
-    let childError: string | undefined;
-    let podFailure: string | undefined;
-    let podJobFailed = false;
-    if (entrance === 'cli-harness-ask') {
-      for (const line of output.split('\n').reverse()) {
-        if (!line.trimStart().startsWith('[{') || !line.includes('"error"')) continue;
-        try {
-          const results: unknown = JSON.parse(line);
-          if (!Array.isArray(results)) continue;
-          for (const result of results) {
-            if (!result || typeof result !== 'object') continue;
-            const error = (result as { error?: { code?: string; message?: string } }).error;
-            if (typeof error?.code !== 'string' || typeof error.message !== 'string' || !error.code.startsWith('pod-')) continue;
-            if (error.code === 'pod-job-failed') {
-              podJobFailed = true;
-              childError = error.message.split('childError=')[1]?.split('\n', 1)[0];
-            }
-            podFailure = error.message;
-            break;
-          }
-        } catch { /* Non-result stdout cannot establish that a Pod child ran. */ }
-        if (podFailure) break;
-      }
-      if (!podFailure) {
-        const summary = output.split('\n').find((line) => /\s❌\sfailed · .* — pod-[\w-]+: /.test(line));
-        podFailure = summary?.split(/\s❌\sfailed · .* — pod-[\w-]+: /)[1];
-        podJobFailed = summary?.includes(' — pod-job-failed: ') ?? false;
-        if (podJobFailed) childError = podFailure?.split('childError=')[1]?.split('\n', 1)[0];
-      }
-    }
-    if (podJobFailed && childError && childError !== 'no-result-line') console.error(`Pod 안 자식이 실패했다 — ${childError}`);
-    else if (podFailure) console.error(`Pod 실행이 실패했다 — ${podFailure.split('\n', 1)[0]}`);
-    else console.error('Pod 실행에 닿지 못했다 — 풀·컨텍스트·SSH 연결을 확인하거나 `--substrate local` 로 명시하라');
+    const classified = classifyHarnessPodExit({ status }, output, { ...(runId ? { runId } : {}) });
+    recordClassifiedHarnessPodExit(runId ?? harnessPodRunId(output), classified.reason, status);
+    for (const line of classified.lines) console.error(line);
     process.exitCode = status;
   }
 }
@@ -1596,6 +1762,36 @@ export function installHarnessCliCommand(program: Command, deps: HarnessCliComma
     .command('harness')
     .description('dev-harness worktree 수명 — 워크트리 생성(worktree add)·조회(worktrees)·정리(clean)·프로세스 관찰(processes)');
   installHarnessCliSinkHook(harnessCmd, deps.registerSink, deps.resolveSurface);
+  harnessCmd.command('incidents').description('최근 하니스 Pod 종료 사고 원장을 읽는다')
+    .option('--since <minutes>', '최근 몇 분의 종료를 볼지 (기본 15분)', '15')
+    .option('--json', '구조화 출력')
+    .action((opts: { since: string; json?: boolean }) => {
+      const since = Number(opts.since);
+      if (!Number.isFinite(since) || since < 0) {
+        console.error('❌ --since 는 0 이상의 분이어야 합니다');
+        process.exitCode = 2;
+        return;
+      }
+      try {
+        const root = effectiveInstanceRoot();
+        const rows = readRunExits(root);
+        if (rows.length === 0) {
+          console.log(opts.json ? JSON.stringify({ rows: [], bursts: [] }) : '기록 없음 — 사고 0 이 아니라 아직 기록이 없다');
+          return;
+        }
+        const now = Date.now();
+        const selected = rows.filter((row) => Date.parse(row.at) >= now - since * 60_000 && Date.parse(row.at) <= now);
+        const bursts = detectBursts(rows).filter((burst) => Date.parse(burst.lastAt) >= now - since * 60_000 && Date.parse(burst.lastAt) <= now);
+        if (opts.json) console.log(JSON.stringify({ rows: selected, bursts }));
+        else {
+          for (const row of selected) console.log(`${row.at} run ${row.runId} · ${row.reason} · status=${row.status} signal=${row.signal ?? '-'}`);
+          for (const burst of bursts) console.log(`${burst.firstAt}–${burst.lastAt} 묶음 ${burst.reason} ×${burst.count} · ${burst.runIds.join(', ')}`);
+        }
+      } catch (error) {
+        console.error(humanErrorLine(error));
+        process.exitCode = 1;
+      }
+    });
   installDeliverableVerifyCliCommand(harnessCmd, deps.deliverableVerify);
   installHarnessProcessObservationCommand(harnessCmd, deps.processObservation);
   installHarnessBudgetCommand(harnessCmd);

package/src/harness/harness-incidents-writer.fixture.ts

@@ -0,0 +1,24 @@
+import { Database } from 'bun:sqlite';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { recordRunExit, type RunExit } from './harness-incidents.js';
+
+const [root, json, mode] = process.argv.slice(2);
+if (!root || !json) throw new Error('root and exit are required');
+const exit = JSON.parse(json) as RunExit;
+if (mode === 'hold') {
+  const db = new Database(join(root, '.incident-write-lock.sqlite'));
+  db.exec('BEGIN IMMEDIATE');
+  process.stdout.write('locked\n');
+  // Released by a file, not a signal: SIGUSR2 handlers are not delivered reliably under Bun on macOS.
+  const release = join(root, 'release-hold');
+  await new Promise<void>((done) => {
+    const timer = setInterval(() => { if (existsSync(release)) { clearInterval(timer); done(); } }, 20);
+  });
+  db.exec('COMMIT');
+  db.close();
+  recordRunExit(exit, root);
+  process.exit(0);
+} else {
+  recordRunExit(exit, root);
+}

package/src/harness/harness-incidents.ts

@@ -0,0 +1,129 @@
+import { Database } from 'bun:sqlite';
+import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+export interface RunExit {
+  runId: string;
+  reason: string;
+  status: number | null;
+  signal: string | null;
+  at: string;
+}
+
+export interface IncidentBurst {
+  reason: string;
+  count: number;
+  firstAt: string;
+  lastAt: string;
+  runIds: string[];
+}
+
+const KST_OFFSET_MS = 9 * 60 * 60_000;
+const INCIDENT_FILE = /^\d{4}-\d{2}-\d{2}\.jsonl$/;
+
+function kstDate(at: number): string {
+  return new Date(at + KST_OFFSET_MS).toISOString().slice(0, 10);
+}
+
+/** Read only recorded exits. Missing ledgers are not evidence that no runs failed. */
+export function readRunExits(root: string): RunExit[] {
+  const dir = join(root, 'incidents');
+  if (!existsSync(dir)) return [];
+  const rows: RunExit[] = [];
+  const seen = new Set<string>();
+  for (const file of readdirSync(dir).filter((name) => INCIDENT_FILE.test(name)).sort()) {
+    const path = join(dir, file);
+    let text: string;
+    try {
+      if (!statSync(path).isFile()) continue;
+      text = readFileSync(path, 'utf8');
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue;
+      throw error;
+    }
+    for (const line of text.split('\n')) {
+      if (!line.trim()) continue;
+      let value: unknown;
+      try { value = JSON.parse(line); } catch { continue; }
+      if (!value || typeof value !== 'object') continue;
+      const row = value as Partial<RunExit>;
+      if (typeof row.runId !== 'string' || !row.runId.trim() || seen.has(row.runId)
+        || typeof row.reason !== 'string' || typeof row.at !== 'string' || !Number.isFinite(Date.parse(row.at))
+        || !(row.status === null || typeof row.status === 'number')
+        || !(row.signal === null || typeof row.signal === 'string')) continue;
+      seen.add(row.runId);
+      rows.push(row as RunExit);
+    }
+  }
+  return rows.sort((a, b) => Date.parse(a.at) - Date.parse(b.at) || a.runId.localeCompare(b.runId));
+}
+
+/** SQLite's process-owned write lock serializes ledger checks and appends across processes. */
+export function recordRunExit(row: RunExit, root: string): void {
+  if (!row.runId?.trim()) return;
+  const at = Date.parse(row.at);
+  if (!Number.isFinite(at)) throw new Error('invalid incident exit time');
+  const dir = join(root, 'incidents');
+  mkdirSync(dir, { recursive: true });
+  const lock = new Database(join(root, '.incident-write-lock.sqlite'));
+  try {
+    lock.exec('PRAGMA busy_timeout = 60000');
+    lock.exec('BEGIN IMMEDIATE');
+    try {
+      if (!readRunExits(root).some((record) => record.runId === row.runId)) {
+        appendFileSync(join(dir, `${kstDate(at)}.jsonl`), `${JSON.stringify(row)}\n`);
+      }
+      lock.exec('COMMIT');
+    } catch (error) {
+      lock.exec('ROLLBACK');
+      throw error;
+    }
+  } finally {
+    lock.close();
+  }
+}
+
+/** Non-overlapping, maximal same-reason windows; no run contributes to two bursts. */
+export function detectBursts(rows: readonly RunExit[], { windowMs = 60_000, threshold = 3 }: {
+  windowMs?: number; threshold?: number;
+} = {}): IncidentBurst[] {
+  const bursts: IncidentBurst[] = [];
+  const byReason = new Map<string, RunExit[]>();
+  const seen = new Set<string>();
+  for (const row of rows) {
+    if (!row.runId || seen.has(row.runId) || !Number.isFinite(Date.parse(row.at))) continue;
+    seen.add(row.runId);
+    const group = byReason.get(row.reason) ?? [];
+    group.push(row);
+    byReason.set(row.reason, group);
+  }
+  for (const [reason, group] of byReason) {
+    group.sort((a, b) => Date.parse(a.at) - Date.parse(b.at) || a.runId.localeCompare(b.runId));
+    for (let start = 0; start < group.length;) {
+      let end = start + 1;
+      while (end < group.length && Date.parse(group[end]!.at) - Date.parse(group[start]!.at) <= windowMs) end++;
+      if (end - start < threshold) { start++; continue; }
+      const members = group.slice(start, end);
+      bursts.push({ reason, count: members.length, firstAt: members[0]!.at,
+        lastAt: members[members.length - 1]!.at, runIds: members.map((row) => row.runId) });
+      start = end;
+    }
+  }
+  return bursts.sort((a, b) => Date.parse(a.firstAt) - Date.parse(b.firstAt) || a.reason.localeCompare(b.reason));
+}
+
+export function recentBurst(root: string, now: Date | number, { lookbackMs = 15 * 60_000 }: {
+  lookbackMs?: number;
+} = {}): IncidentBurst | null {
+  const time = typeof now === 'number' ? now : now.getTime();
+  const recent = detectBursts(readRunExits(root)).filter((burst) => {
+    const last = Date.parse(burst.lastAt);
+    return last <= time && last >= time - lookbackMs;
+  });
+  return recent.sort((a, b) => Date.parse(a.lastAt) - Date.parse(b.lastAt)).at(-1) ?? null;
+}
+
+export function formatIncidentBurstWarning(burst: IncidentBurst): string {
+  const time = new Date(Date.parse(burst.lastAt) + KST_OFFSET_MS).toISOString().slice(11, 16);
+  return `⚠ 최근 묶음 사고: ${burst.reason} ×${burst.count} (${time} KST) — 원인 확인 전 재발사는 중복·재사고 위험 · elanous harness incidents`;
+}

package/src/harness/harness-stop.ts

@@ -7,15 +7,51 @@
 //
 // ⛔ 불변식: 기록된 시작 시각과 실제 프로세스 시작 시각이 다르면 신호를 보내지 않는다(PID 재사용 방지).
 // ⛔ 불변식: `elanous.run=<runId>` 라벨이 붙은 Job 만 지운다.
+// ⛔ 불변식: 짧은 runId 의 후보가 둘 이상이면 프로세스 신호·Job 삭제 전에 중단한다.
 
-import { readFileSync, readlinkSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync, readlinkSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { debug } from '../debug/log.js';
 import { selfDevRunsDir } from '../self-dev/run-store.js';
-import { loadRunLedger, runLedgerDir } from '../self-implement/run-ledger.js';
+import { loadRunLedger, resolveFederatedRunLedgerDirectories, runLedgerDir } from '../self-implement/run-ledger.js';
 
 const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+const FULL_RUN_ID = /^run-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+export class AmbiguousHarnessStopRunIdError extends Error {
+  constructor(given: string, candidates: readonly string[]) {
+    super(`harness stop ${given}: 더 긴 id 를 주십시오\n${candidates.map((id) => `  ${id}`).join('\n')}`);
+    this.name = 'AmbiguousHarnessStopRunIdError';
+  }
+}
+
+/** List names, not ledger bodies: a run may have written its pid.json before its ledger. */
+export function stopRunIdCandidates(given: string, ledgerDirs: readonly string[], runsDir: string): string[] {
+  const found = new Set<string>();
+  for (const dir of ledgerDirs) {
+    let names: string[];
+    try { names = readdirSync(dir); }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue;
+      throw error;
+    }
+    for (const name of names) {
+      if (!name.endsWith('.jsonl')) continue;
+      const id = name.slice(0, -'.jsonl'.length);
+      if (FULL_RUN_ID.test(id) && id.startsWith(given)) found.add(id);
+    }
+  }
+  try {
+    for (const entry of readdirSync(runsDir, { withFileTypes: true })) {
+      if (entry.isDirectory() && entry.name.startsWith(given) && FULL_RUN_ID.test(entry.name)
+        && existsSync(join(runsDir, entry.name, 'pid.json'))) found.add(entry.name);
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+  }
+  return [...found].sort();
+}
 /** `pid.json` 의 `startedAt` 은 `Date.now() − uptime` 근삿값이다 — 이만큼의 차이는 같은 프로세스로 본다. */
 export const START_TOLERANCE_MS = 5_000;
 
@@ -101,6 +137,7 @@ function scanStopProcessTable(runId: string, goalPath: string | null): StopProce
 
 export interface HarnessStopDeps {
   readPidRecord: (runId: string) => PidRecord | null;
+  runIdCandidates?: (given: string) => string[];
   readGoalPath: (runId: string) => string | null;
   scanProcesses: (runId: string, goalPath: string | null) => StopProcessScan;
   /** 살아 있는 프로세스의 시작 시각(ms) · 없으면 null. */
@@ -115,6 +152,7 @@ export interface HarnessStopDeps {
 
 export interface HarnessStopResult {
   runId: string;
+  givenRunId?: string;
   process: 'stopped' | 'killed' | 'absent' | 'owner-mismatch' | 'unmeasured' | 'dry-run';
   pid?: number;
   candidates: StopProcessCandidate[];
@@ -154,6 +192,10 @@ export function defaultHarnessStopDeps(overrides: Partial<HarnessStopDeps> = {})
   };
   return {
     readPidRecord: (runId) => readPidRecordFrom(selfDevRunsDir(), runId),
+    runIdCandidates: (given) => {
+      const ledgerDirs = new Set([runLedgerDir(), ...resolveFederatedRunLedgerDirectories({})]);
+      return stopRunIdCandidates(given, [...ledgerDirs], selfDevRunsDir());
+    },
     readGoalPath: stopGoalPathFromLedger,
     scanProcesses: scanStopProcessTable,
     processStartMs: psProcessStartMs,
@@ -172,6 +214,13 @@ export function defaultHarnessStopDeps(overrides: Partial<HarnessStopDeps> = {})
 
 export async function stopHarnessRun(runId: string, deps: HarnessStopDeps, contexts?: readonly string[], dryRun = false): Promise<HarnessStopResult> {
   if (!RUN_ID.test(runId)) throw new Error(`invalid run id: ${runId}`);
+  const given = runId;
+  if (!FULL_RUN_ID.test(given)) {
+    const matches = [...new Set(deps.runIdCandidates?.(given) ?? [])].sort();
+    if (matches.length === 1) runId = matches[0]!;
+    debug.log('harness.stop', 'run-id-resolved', { given, resolved: runId, candidates: matches });
+    if (matches.length > 1) throw new AmbiguousHarnessStopRunIdError(given, matches);
+  }
   // ── ⓐ 프로세스 ────────────────────────────────────────────
   let processState: HarnessStopResult['process'] = 'absent';
   const record = deps.readPidRecord(runId);
@@ -235,7 +284,7 @@ export async function stopHarnessRun(runId: string, deps: HarnessStopDeps, conte
     if (r.status === 0) jobsDeleted += r.stdout.split('\n').filter((line) => line.startsWith('job.batch/')).length;
     else debug.log('harness.stop', 'job-delete-failed', { runId, context, error: r.stderr.slice(0, 200) }, { level: 'warn' });
   }
-  const result: HarnessStopResult = { runId, process: processState, ...(record ? { pid: record.pid } : {}), candidates, scanned: scan.status === 'ok', pidRecordFound: record !== null, dryRun, jobsDeleted, contexts: targets };
+  const result: HarnessStopResult = { runId, ...(given !== runId ? { givenRunId: given } : {}), process: processState, ...(record ? { pid: record.pid } : {}), candidates, scanned: scan.status === 'ok', pidRecordFound: record !== null, dryRun, jobsDeleted, contexts: targets };
   debug.log('harness.stop', 'stopped', { runId, process: processState, jobsDeleted, contexts: targets.length });
   return result;
 }
@@ -249,6 +298,7 @@ export function formatHarnessStop(r: HarnessStopResult): string {
     'owner-mismatch': '소유 불일치(건드리지 않음 — PID 가 다른 프로세스로 재사용됐다)',
   };
   return [
+    ...(r.givenRunId ? [`↳ ${r.givenRunId} → ${r.runId}(전체)`] : []),
     `harness stop ${r.runId}`,
     `  프로세스: ${label[r.process]}${r.pid ? ` · pid ${r.pid}` : ''}`,
     ...(!r.scanned && r.process !== 'unmeasured' ? ['  프로세스 표: 못 잼(기록 밖 발사 프로세스는 확인하지 못함)'] : []),

package/src/hitl/clarification-policy.ts

@@ -182,7 +182,7 @@ export function decideAndObserveClarification(
     impact: candidate.impact,
     action: decision.action,
     reason: decision.reason,
-    recommendedOption: decision.recommendedOption,
+    ...(context.phase === 'execution' ? {} : { recommendedOption: decision.recommendedOption }),
     budgetUsed: context.budget.used,
     budgetLimit: context.budget.limit,
   });
@@ -210,6 +210,8 @@ export function toAskUserQuestionRequest(decision: ClarificationDecision): AskUs
     header: 'Direction',
     question: `${candidate.prompt}\n\nRecommended: ${decision.recommendedOption}. ${candidate.whyNow}`,
     options: candidate.options.map(({ recommended: _recommended, ...option }) => option),
+    impact: candidate.impact,
+    recommendedIndex: candidate.options.findIndex(option => option.recommended),
     includeOther: true,
   };
   return { questions: [question] };