elanous 0.2.9 → 0.2.11

package/src/harness/harness-cli-command.ts

@@ -1,7 +1,15 @@
 import { execFileSync } from 'node:child_process';
+import { dlopen, FFIType } from 'bun:ffi';
 import { createHash } from 'node:crypto';
-import { readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { existsSync, readFileSync } from 'node:fs';
+import { constants as osConstants } from 'node:os';
+import { resolve, sep } from 'node:path';
+import { findGitDir } from '../git-fs/locate.js';
+import { LogStore, logsDbPath } from '../mss/logging/log-store.js';
+import { loadSelfDevRun } from '../self-dev/run-store.js';
+import { normalizeRunId } from './harness-space.js';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { detectBursts, formatIncidentBurstWarning, readRunExits, recentBurst, recordRunExit } from './harness-incidents.js';
 import { Command, Option } from 'commander';
 import { runGitCommand } from '../git-fs/runner.js';
 import { GOAL_TYPES, lintGoalFile, parseGoalId, parseGoalType, tracedPathReferences, type GoalType } from '../self-implement/goal-author.js';
@@ -14,8 +22,10 @@ import { DevPipelineError } from '../self-dev/dev-pipeline.js';
 import { runDraftSweep, type DraftSweepAdapters, type DraftSweepResult, type SweepDraft, type SweepMergedPr } from '../self-dev/draft-sweep.js';
 import { debug } from '../debug/log.js';
 import { dispatchTask, type DispatchTaskInput, type DispatchTaskDeps } from '../execution-loop/dispatch-task.js';
+import { launchRequestId, preLaunchGate, type PreLaunchGateDeps } from '../execution-loop/launch-gate.js';
 import { PR_LABELS } from '../github/pr-labels.js';
-import { decideBudget, readBudgetInputsLive, type BudgetDecision, type BudgetInputs } from '../self-implement/budget-gate.js';
+import { CODEX_PROVIDER, GROK_PROVIDER, decideBudget, readBudgetInputsLive, type BudgetDecision, type BudgetInputs } from '../self-implement/budget-gate.js';
+import { DEFAULT_FALLBACK_CHAIN } from '../oauth/fallback-chain.js';
 import { installDeliverableVerifyCliCommand, type InstallDeliverableVerifyCliDeps } from './deliverable-verify-cli.js';
 import { getUserConfig } from '../user-config.js';
 import { installHarnessCliSinkHook } from './harness-cli-sink.js';
@@ -86,6 +96,7 @@ export interface HarnessAskSayOptions {
   target?: string;
   yes?: boolean;
   forcePreflight?: boolean;
+  forceGate?: boolean;
   autoMerge?: boolean;
   mergeByHost?: boolean;
   observeOnly?: boolean;
@@ -243,12 +254,14 @@ function registerHarnessAskSayOptions(command: Command): Command {
     .option('--correlation <id>', '요청과 런을 잇는 불투명 correlation 값')
     .addOption(new Option('--goal-type <type>', `골 종류 (${GOAL_TYPES.join('|')})`).choices([...GOAL_TYPES]))
     .option('--force-preflight', '전제 검사 막힘을 명시 요청으로 우회(관측에 남음)')
+    .option('--force-gate', '같은 골 실행 중 막힘을 명시 요청으로 우회(관측에 남음; 예산 막힘은 우회 불가)')
     .option('--child-llm-provider <id>', 'self: 구현 자식 LLM provider(--child-llm-model과 함께)')
     .option('--child-llm-model <id>', 'self: 구현 자식 LLM model(--child-llm-provider와 함께)')
     .option('--child-llm-effort <level>', 'self: 구현 자식 추론 노력 minimal|low|medium|high|xhigh|max — 모델 상한을 넘으면 «거부»한다(--child-llm-provider와 함께)')
     .addOption(new Option('--substrate <kind>', '실행 칸 — local(설정 없을 때 기본 · 이 기계) | pod(k8s Pod · 같은 그래프가 원격에서 돈다)').choices(['local', 'pod']))
     .option('--pod-pool <spec>', 'pod: 풀 — 인자 > ELANOUS_POD_POOL > harness.podPool > 기존 pod.pool > 현재 컨텍스트')
-    .addOption(new Option('--pod-memory <tier>', 'pod: 메모리 등급 — standard(16Gi) | high(32Gi) · 없으면 골 문면 `Pod 메모리: high` 줄 · 그것도 없으면 골이 apps/pwa/ 를 담을 때 high').choices(['standard', 'high']))
+    .addOption(new Option('--pod-memory <tier>', 'pod: 메모리 등급 — lite(2Gi · 문서·조사·네트워크 스킬 골 · OOM 이면 high 로 한 번 재시도) | standard(16Gi) | high(32Gi) · 없으면 골 문면 `Pod 메모리: <등급>` 한 줄 · 그것도 없으면 골이 apps/pwa/ 를 담을 때 high').choices(['lite', 'standard', 'high']))
+    .option('--after <goal-or-pr>', 'pod: 선행 — 이 골 ID(16자) 또는 PR(#N) 이 병합될 때까지 Pod 발사가 큐에서 이유와 함께 기다린다(병합 없이 닫히면 blocked) · 골 문면 `선행: #N` 한 줄과 같다 · 대상 파일만 겹치면 선행이 아니다(경고만)')
     .option('--source <spec>', 'pod: 원천 — commit:<40자 sha> | pr:<정수> | worktree:<경로> | files:<경로>[,<경로>…] · `--substrate pod` 와 함께');
 }
 
@@ -314,7 +327,7 @@ function assertHarnessChildLlmModel(opts: HarnessAskSayChildLlmOptions): void {
 }
 
 /** Shared post-parse gate: validate child model before any ask/say early return (including `--dry-run`). */
-type HarnessSubstrateOpts = { substrate?: 'local' | 'pod'; podPool?: string; podMemory?: string; autoMerge?: boolean; base?: string; json?: boolean; target?: string; source?: string };
+type HarnessSubstrateOpts = { substrate?: 'local' | 'pod'; podPool?: string; podMemory?: string; after?: string; autoMerge?: boolean; base?: string; json?: boolean; target?: string; source?: string };
 function resolveLaunchSubstrate(opts: HarnessSubstrateOpts): ResolvedHarnessSubstrate {
   const resolved = resolveHarnessSubstrate({ flag: opts, config: getUserConfig(), env: process.env });
   debug.log('harness.substrate', 'resolved', resolved);
@@ -323,6 +336,191 @@ function resolveLaunchSubstrate(opts: HarnessSubstrateOpts): ResolvedHarnessSubs
   else console.log(head);
   return resolved;
 }
+type PodExit = { status: number | null; signal?: string | null };
+type PodExitReason = 'signal' | 'human-stop' | 'supervisor' | 'no-launch' | 'unknown';
+const STOPPING_SUPERVISOR_VERDICTS = new Set(['UNCONVERGEABLE', 'CONTRACT-CONFLICT']);
+// Ledger events that only exist once the child actually ran — any of them rules out «never reached the Pod».
+const LAUNCH_EVIDENCE_EVENTS = new Set(['job-applied', 'pod-child-run', 'reviewed', 'rework-budget', 'pr-opened']);
+
+/** Keep the run identity seen at launch even if the bounded output tail later drops it. */
+export function harnessPodRunId(output: string): string | undefined {
+  return output.match(/\[self-dev\][^\r\n]*\brun\s+(run-[a-z0-9_-]{8,64})(?=\s|$)/i)?.[1];
+}
+
+/** Classify a missing Pod result from run-scoped evidence, never from a nonzero exit alone. */
+export function classifyHarnessPodExit(
+  exit: PodExit,
+  output: string,
+  deps: {
+    loadLedger?: typeof loadRunLedger;
+    hasJobApplied?: (runId: string | undefined, output: string) => boolean | undefined;
+    supervisorDecision?: (runId: string) => { stopReason?: string; why?: string } | undefined;
+    loadCheckpoint?: typeof loadSelfDevRun;
+    runId?: string;
+  } = {},
+): { lines: string[]; reason: PodExitReason | 'pod-failure' } {
+  let podFailure: string | undefined;
+  let podJobFailed = false;
+  for (const line of output.split('\n').reverse()) {
+    if (!line.trimStart().startsWith('[{') || !line.includes('"error"')) continue;
+    try {
+      const results: unknown = JSON.parse(line);
+      if (!Array.isArray(results)) continue;
+      for (const result of results) {
+        if (!result || typeof result !== 'object') continue;
+        const error = (result as { error?: { code?: string; message?: string } }).error;
+        if (typeof error?.code !== 'string' || typeof error.message !== 'string' || !error.code.startsWith('pod-')) continue;
+        podFailure = error.message;
+        podJobFailed = error.code === 'pod-job-failed';
+        break;
+      }
+    } catch { /* Non-result stdout cannot establish that a Pod child ran. */ }
+    if (podFailure) break;
+  }
+  if (!podFailure) {
+    const summary = output.split('\n').find((line) => /\s❌\sfailed · .* — pod-[\w-]+: /.test(line));
+    podFailure = summary?.split(/\s❌\sfailed · .* — pod-[\w-]+: /)[1];
+    podJobFailed = summary?.includes(' — pod-job-failed: ') ?? false;
+  }
+  // Only the run announced at launch — another run id quoted in the output is not this run (review round 3).
+  const observedRunId = deps.runId ?? harnessPodRunId(output);
+  const runId = observedRunId ? normalizeRunId(observedRunId) : undefined;
+  if (podFailure) {
+    const childError = podJobFailed ? podFailure.split('childError=')[1]?.split('\\n', 1)[0]?.split('\n', 1)[0] : undefined;
+    try { debug.log('harness.pod', 'exit-classified', { runId, reason: 'pod-failure', status: exit.status, signal: exit.signal ?? null }); } catch { /* observation is fail-soft */ }
+    return { reason: 'pod-failure', lines: [podJobFailed && childError && childError !== 'no-result-line'
+      ? `Pod 안 자식이 실패했다 — ${childError}`
+      : `Pod 실행이 실패했다 — ${podFailure.split('\\n', 1)[0]}`] };
+  }
+  let ledger: ReturnType<typeof loadRunLedger> = null;
+  let ledgerReadable = false;
+  if (runId) {
+    try { ledger = (deps.loadLedger ?? loadRunLedger)(runId); ledgerReadable = ledger !== null; } catch { /* unreadable is not absent */ }
+  }
+  const signal = exit.signal ?? (exit.status !== null && exit.status > 128
+    ? Object.entries(osConstants.signals).find(([, number]) => number === exit.status! - 128)?.[0] : undefined);
+  const humanStop = ledger?.some((entry) => entry.event === 'human-stop');
+  // A continuing verdict (EXTEND · SUFFICIENT) is not why the run ended — only stopping verdicts count.
+  const supervisor = [...(ledger ?? [])].reverse().find((entry) =>
+    (entry.event === 'supervisor-decision' || entry.event === 'supervisor-verdict' || entry.event === 'rework-budget')
+      && STOPPING_SUPERVISOR_VERDICTS.has(String(entry.data.supervisorVerdict ?? entry.data.verdict))
+    || entry.event === 'run-status' && entry.data.stage === 'review-blocked');
+  let decision: { stopReason?: string; why?: string } | undefined;
+  if (runId) {
+    try { decision = (deps.supervisorDecision ?? lookupHarnessSupervisorDecision)(runId); } catch { /* unknown */ }
+  }
+  const verdict = decision?.stopReason ?? supervisor?.data.supervisorVerdict ?? supervisor?.data.verdict
+    ?? (supervisor?.event === 'run-status' ? supervisor.data.stage : undefined);
+  const reasonText = decision?.why ?? supervisor?.data.supervisorReason ?? supervisor?.data.reason;
+  const ledgerPrUrl = [...(ledger ?? [])].reverse().find((entry) => entry.event === 'pr-opened'
+    && (typeof entry.data.url === 'string' || typeof entry.data.prUrl === 'string'))?.data;
+  let checkpoint: ReturnType<typeof loadSelfDevRun> = null;
+  if (runId) {
+    try { checkpoint = (deps.loadCheckpoint ?? loadSelfDevRun)(runId); } catch { /* unreadable is not absent */ }
+  }
+  const pr = output.match(/https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/pull\/\d+\b/)?.[0]
+    ?? (typeof ledgerPrUrl?.url === 'string' ? ledgerPrUrl.url
+      : typeof ledgerPrUrl?.prUrl === 'string' ? ledgerPrUrl.prUrl : undefined)
+    ?? checkpoint?.results.find((result) => result.prUrl)?.prUrl;
+  let reason: PodExitReason;
+  let line: string;
+  if (humanStop) {
+    reason = 'human-stop';
+    line = '사람이 멈춘 런이다';
+  } else if (signal) {
+    reason = 'signal';
+    line = `런이 멈췄다(${signal}) — \`harness stop\` 이나 세션 종료일 수 있다 · 그 전까지 만든 PR 은 남아 있다`;
+  } else if (typeof verdict === 'string' || checkpoint?.supervisorStopReason) {
+    reason = 'supervisor';
+    line = `감독 판정: ${verdict ?? checkpoint?.supervisorStopReason}${typeof reasonText === 'string' && reasonText.trim() ? ` — ${reasonText.trim().split(/\r?\n/, 1)[0]}` : ''}`;
+  } else {
+    let applied: boolean | undefined;
+    try { applied = (deps.hasJobApplied ?? hasHarnessPodJobApplied)(runId, output); } catch { /* unknown */ }
+    const noLaunch = ledgerReadable && !ledger?.some((entry) => LAUNCH_EVIDENCE_EVENTS.has(entry.event))
+      && applied === false && !pr;
+    reason = noLaunch ? 'no-launch' : 'unknown';
+    line = noLaunch
+      ? 'Pod 실행에 닿지 못했다 — 풀·컨텍스트·SSH 연결을 확인하거나 `--substrate local` 로 명시하라'
+      : 'Pod 실행 여부 또는 종료 이유를 확인하지 못했다';
+  }
+  try { debug.log('harness.pod', 'exit-classified', { runId, reason, status: exit.status, signal: signal ?? null }); } catch { /* observation is fail-soft */ }
+  return { reason, lines: [line, ...(pr ? [`PR 이 남아 있다: ${pr}`] : [])] };
+}
+
+/** The classified status is the same exit handed to the launcher; ledger failure is never an exit failure. */
+export function recordClassifiedHarnessPodExit(runId: string | undefined, reason: string, status: number): void {
+  if (!runId) return;
+  try {
+    const signal = status > 128
+      ? Object.entries(osConstants.signals).find(([, number]) => number === status - 128)?.[0] ?? null : null;
+    recordRunExit({ runId, reason, status, signal, at: new Date().toISOString() }, effectiveInstanceRoot());
+  } catch { /* incident writes cannot change Pod output or exit */ }
+}
+
+/** Every Pod launch entrance (harness ask/say · dev ask --substrate pod) warns once after a recent burst; it never blocks the launch. */
+export function warnRecentIncidentBurst(
+  root: string = effectiveInstanceRoot(), now: Date = new Date(), write: (line: string) => void = (line) => console.error(line),
+): boolean {
+  try {
+    const burst = recentBurst(root, now);
+    if (!burst) return false;
+    write(formatIncidentBurstWarning(burst));
+    try { debug.log('harness.incident', 'burst', { reason: burst.reason, count: burst.count }); } catch { /* observation is fail-soft */ }
+    return true;
+  } catch { return false; /* incident reads cannot block a launch */ }
+}
+
+function lookupHarnessSupervisorDecision(runId: string): { stopReason?: string; why?: string } | undefined {
+  const path = logsDbPath();
+  if (!existsSync(path)) return undefined;
+  const store = LogStore.openReadOnly(path);
+  try {
+    let beforeId: number | undefined;
+    for (;;) {
+      const rows = store.query({ exactCategories: ['self-dev.supervisor'], events: ['decision'], grep: runId,
+        limit: 1_000, ...(beforeId === undefined ? {} : { beforeId }) });
+      for (const row of rows) {
+        try {
+          const data = JSON.parse(row.data ?? '{}') as Record<string, unknown>;
+          if (data.runId !== runId) continue;
+          return data.action === 'stop' && typeof data.stopReason === 'string'
+            ? { stopReason: data.stopReason, ...(typeof data.why === 'string' ? { why: data.why } : {}) }
+            : undefined;
+        } catch { /* Malformed observation is not evidence. */ }
+      }
+      if (rows.length < 1_000) return undefined;
+      beforeId = rows.at(-1)!.id;
+    }
+  } finally { store.close(); }
+}
+
+function hasHarnessPodJobApplied(runId: string | undefined, output: string): boolean | undefined {
+  const job = output.match(/\bsi-[a-z0-9-]+\b/i)?.[0];
+  if (!runId && !job) return undefined;
+  const path = logsDbPath();
+  if (!existsSync(path)) return undefined;
+  const store = LogStore.openReadOnly(path);
+  try {
+    for (const needle of new Set([runId, job].filter((value): value is string => value !== undefined))) {
+      let beforeId: number | undefined;
+      for (;;) {
+        const rows = store.query({ exactCategories: ['self-implement.pod'], events: ['job-applied'],
+          grep: needle, limit: 1_000, ...(beforeId === undefined ? {} : { beforeId }) });
+        if (rows.some((row) => {
+          try {
+            const data = JSON.parse(row.data ?? '{}') as Record<string, unknown>;
+            return (runId !== undefined && data.runId === runId)
+              || (job !== undefined && data.job === job && (runId === undefined || data.runId === undefined || data.runId === runId));
+          } catch { return false; }
+        })) return true;
+        if (rows.length < 1_000) break;
+        beforeId = rows.at(-1)!.id;
+      }
+    }
+    return false;
+  } finally { store.close(); }
+}
+
 /** ⭐ 런 계약의 실행 칸 = pod — 호스트는 그래프를 안 돌리고 Pod 로 보낸다(harness-pod-dispatch.ts). */
 async function onPod(opts: unknown, entrance: 'cli-harness-ask' | 'cli-harness-say', input: string, pool: string,
   recordDispatch: (input: DispatchTaskInput, deps?: DispatchTaskDeps) => ReturnType<typeof dispatchTask> = dispatchTask): Promise<void> {
@@ -334,6 +532,12 @@ async function onPod(opts: unknown, entrance: 'cli-harness-ask' | 'cli-harness-s
     process.exitCode = 2;
     return;
   }
+  if (o.after !== undefined && !/^(?:#?[1-9]\d*|[a-f0-9]{16})$/.test(o.after.trim())) {
+    console.error(`--after 는 PR 번호(#N) 또는 골 ID(16자 16진수)여야 한다: ${o.after}`);
+    process.exitCode = 2;
+    return;
+  }
+  warnRecentIncidentBurst();
   let dispatchRecorded = false;
   try {
     const goalText = entrance === 'cli-harness-ask' ? readFileSync(input, 'utf8') : input;
@@ -351,46 +555,66 @@ async function onPod(opts: unknown, entrance: 'cli-harness-ask' | 'cli-harness-s
   }
   const { dispatchHarnessOnPod } = await import('./harness-pod-dispatch.js');
   let output = '';
-  const status = await dispatchHarnessOnPod({ entrance, input, podPool: pool, ...(dispatchRecorded ? { dispatchRecorded: true } : {}), ...(o.podMemory ? { podMemory: o.podMemory } : {}), ...(o.autoMerge === false ? { autoMerge: false } : {}), ...(o.base ? { base: o.base } : {}), ...(o.json ? { json: true } : {}), ...(o.source ? { source: o.source } : {}) },
-    entrance === 'cli-harness-ask' ? { onOutput: (text) => { output = (output + text).slice(-16_000); } } : {});
+  let runId: string | undefined;
+  const status = await dispatchHarnessOnPod({ entrance, input, podPool: pool, ...(dispatchRecorded ? { dispatchRecorded: true } : {}), ...(o.podMemory ? { podMemory: o.podMemory } : {}), ...(o.after ? { after: o.after } : {}), ...(o.autoMerge === false ? { autoMerge: false } : {}), ...(o.base ? { base: o.base } : {}), ...(o.json ? { json: true } : {}), ...(o.source ? { source: o.source } : {}) },
+    { onOutput: (text) => {
+      runId ??= harnessPodRunId(output + text);
+      output = (output + text).slice(-16_000);
+    } });
   if (status !== 0) {
-    let childError: string | undefined;
-    let podFailure: string | undefined;
-    let podJobFailed = false;
-    if (entrance === 'cli-harness-ask') {
-      for (const line of output.split('\n').reverse()) {
-        if (!line.trimStart().startsWith('[{') || !line.includes('"error"')) continue;
-        try {
-          const results: unknown = JSON.parse(line);
-          if (!Array.isArray(results)) continue;
-          for (const result of results) {
-            if (!result || typeof result !== 'object') continue;
-            const error = (result as { error?: { code?: string; message?: string } }).error;
-            if (typeof error?.code !== 'string' || typeof error.message !== 'string' || !error.code.startsWith('pod-')) continue;
-            if (error.code === 'pod-job-failed') {
-              podJobFailed = true;
-              childError = error.message.split('childError=')[1]?.split('\n', 1)[0];
-            }
-            podFailure = error.message;
-            break;
-          }
-        } catch { /* Non-result stdout cannot establish that a Pod child ran. */ }
-        if (podFailure) break;
-      }
-      if (!podFailure) {
-        const summary = output.split('\n').find((line) => /\s❌\sfailed · .* — pod-[\w-]+: /.test(line));
-        podFailure = summary?.split(/\s❌\sfailed · .* — pod-[\w-]+: /)[1];
-        podJobFailed = summary?.includes(' — pod-job-failed: ') ?? false;
-        if (podJobFailed) childError = podFailure?.split('childError=')[1]?.split('\n', 1)[0];
-      }
-    }
-    if (podJobFailed && childError && childError !== 'no-result-line') console.error(`Pod 안 자식이 실패했다 — ${childError}`);
-    else if (podFailure) console.error(`Pod 실행이 실패했다 — ${podFailure.split('\n', 1)[0]}`);
-    else console.error('Pod 실행에 닿지 못했다 — 풀·컨텍스트·SSH 연결을 확인하거나 `--substrate local` 로 명시하라');
+    const classified = classifyHarnessPodExit({ status }, output, { ...(runId ? { runId } : {}) });
+    recordClassifiedHarnessPodExit(runId ?? harnessPodRunId(output), classified.reason, status);
+    for (const line of classified.lines) console.error(line);
     process.exitCode = status;
   }
 }
 
+const LAUNCH_BUDGET_PROVIDER: Readonly<Record<string, string>> = { 'codex-rotate': CODEX_PROVIDER, grok: GROK_PROVIDER };
+
+/**
+ * L6 발사 관문의 예산 입력 보정 — 발사 우주의 config 에 체인이 없으면(작업 트리 = 시험 우주) 막지 않고
+ * 코드 기본 체인으로 판단한다. `--child-llm-provider` 를 명시했으면 그것이 체인이다(예산 판정 밖 provider 는 통과).
+ */
+export function harnessLaunchBudgetDecision(
+  inputs: BudgetInputs,
+  opts: { readonly childLlmProvider?: string; readonly childLlmModel?: string } = {},
+): { readonly decision: BudgetDecision; readonly warning?: string } {
+  const explicit = opts.childLlmProvider?.trim();
+  if (explicit) {
+    if (explicit !== CODEX_PROVIDER && explicit !== GROK_PROVIDER) {
+      return {
+        decision: { action: 'proceed', provider: explicit, ...(opts.childLlmModel ? { model: opts.childLlmModel } : {}), reasons: [`${explicit}: 명시 provider — 예산 판정 밖`] },
+        warning: `budget: ${explicit} is outside the budget gate — launched as requested`,
+      };
+    }
+    const chain = [{ provider: explicit, ...(opts.childLlmModel ? { model: opts.childLlmModel } : {}) }];
+    return { decision: decideBudget({ ...inputs, preference: { ...inputs.preference, chain } }) };
+  }
+  if (inputs.preference.chain.length > 0) return { decision: decideBudget(inputs) };
+  const chain = DEFAULT_FALLBACK_CHAIN.map((step) => ({ provider: LAUNCH_BUDGET_PROVIDER[step] ?? step }));
+  return {
+    decision: decideBudget({ ...inputs, preference: { ...inputs.preference, chain } }),
+    warning: `budget: no chain in this universe's config — judged with the code default ${DEFAULT_FALLBACK_CHAIN.join(',')}`,
+  };
+}
+
+async function readHarnessLaunchBudget(
+  opts: { readonly childLlmProvider?: string; readonly childLlmModel?: string } = {},
+): Promise<BudgetDecision | 'unknown'> {
+  try {
+    const { decision, warning } = harnessLaunchBudgetDecision(await readBudgetInputsLive(), opts);
+    if (warning) {
+      console.error(`⚠️ launch gate: ${warning}`);
+      try { debug.log('execution-loop.launch-gate', 'budget-chain-defaulted', { warning, action: decision.action, provider: decision.provider }); } catch { /* observation is fail-soft */ }
+    }
+    return decision;
+  }
+  catch (error) {
+    try { debug.log('execution-loop.launch-gate', 'budget-unavailable', { reason: String(error) }); } catch { /* observation is fail-soft */ }
+    return 'unknown';
+  }
+}
+
 async function dispatchHarnessAskSay(
   opts: HarnessAskSayChildLlmOptions & HarnessDryRunOpts,
   dryRunPreview: {
@@ -400,6 +624,7 @@ async function dispatchHarnessAskSay(
     readonly goalPath?: string;
   },
   dispatch: (resolved: ResolvedHarnessSubstrate) => Promise<void>,
+  gate: PreLaunchGateDeps & { readBudget?: () => Promise<BudgetDecision | 'unknown'> } = {},
 ): Promise<void> {
   await runInjectedHarnessHandler(async () => {
     assertHarnessChildLlmModel(opts);
@@ -408,6 +633,35 @@ async function dispatchHarnessAskSay(
       printHarnessLaunchDryRun(dryRunPreview);
       return;
     }
+    // Without a GoalId, match the request to a live run's exact verbatim original ask; still check budget.
+    let identity = dryRunPreview.input;
+    let goalId: string | null = null;
+    if (dryRunPreview.goalPath) {
+      try {
+        identity = readFileSync(dryRunPreview.goalPath, 'utf8');
+        goalId = parseGoalId(identity);
+      } catch { /* The launch handler owns file-read errors. */ }
+    }
+    goalId ??= launchRequestId(identity);
+    // Under bun test with no injected gate deps, skip the live reads (≈5 s of codex rotation + run scans) —
+    // CLI wiring tests time out on them. Gate tests inject deps and still run the gate (0.2.11 gate 10-03).
+    if (process.env.NODE_ENV === 'test' && Object.keys(gate).length === 0) {
+      try { debug.log('execution-loop.launch-gate', 'skipped-test-env', { goalId }); } catch { /* observation is fail-soft */ }
+      await dispatch(resolved);
+      return;
+    }
+    const budget = await (gate.readBudget ?? (() => readHarnessLaunchBudget(opts)))();
+    const decision = preLaunchGate({ goalId, budget, forceLaunch: opts.forceGate === true }, gate);
+    if (decision.action !== 'proceed') {
+      console.error(`❌ launch gate: ${decision.action} — ${decision.reason.split(/\r?\n/, 1)[0]}`);
+      process.exitCode = 3;
+      return;
+    }
+    const warnings = [
+      ...(decision.sameGoalActiveRuns === 'unknown' ? ['active runs unknown'] : []),
+      ...(decision.budget === 'unknown' ? ['budget unknown'] : decision.budget.action === 'next-provider' ? [decision.budget.reasons.join(' · ') || 'next-provider'] : []),
+    ];
+    if (warnings.length > 0) console.error(`⚠️ launch gate: ${warnings.join(' · ').split(/\r?\n/, 1)[0]}`);
     await dispatch(resolved);
   });
 }
@@ -541,6 +795,8 @@ export const HARNESS_PROCESS_LAST_ACTIVITY_SCOPE_LINE =
 
 export interface HarnessProcessLedgerEntry {
   readonly timestamp?: string;
+  readonly event?: string;
+  readonly data?: Record<string, unknown>;
 }
 
 export type HarnessProcessLedgerLookup = (
@@ -575,6 +831,9 @@ export interface HarnessProcessObservationDeps {
   listWorktrees?: () => HarnessWorktreeListObservation | readonly string[];
   observeLaunchdPids?: () => HarnessLaunchdPidObservation;
   lookupLedger?: HarnessProcessLedgerLookup;
+  openProcessHandle?: (pid: number) => HarnessProcessSignalHandle;
+  readStartTime?: (pid: number) => string;
+  repositoryRoot?: string;
   nowMs?: number;
   thresholds?: HarnessProcessClassificationThresholds;
   write?: (text: string) => void;
@@ -1548,6 +1807,140 @@ function installHarnessBudgetCommand(harnessCmd: Command): Command {
     });
 }
 
+export interface HarnessProcessSignalHandle {
+  signal(signal: NodeJS.Signals): void;
+  close(): void;
+}
+
+// macOS has no pidfd: bind to the process by its microsecond start time (libproc PROC_PIDTBSDINFO) and
+// re-read it immediately before signalling — a reused pid within the same microsecond is not distinguishable, anything else is.
+function readDarwinStartMicros(pid: number): bigint | null {
+  const libproc = dlopen('/usr/lib/libproc.dylib', {
+    proc_pidinfo: { args: [FFIType.i32, FFIType.i32, FFIType.u64, FFIType.ptr, FFIType.i32], returns: FFIType.i32 },
+  });
+  try {
+    const buf = new Uint8Array(136); // sizeof(struct proc_bsdinfo)
+    const n = libproc.symbols.proc_pidinfo(pid, 3 /* PROC_PIDTBSDINFO */, 0n, buf, buf.length);
+    if (n !== buf.length) return null;
+    const view = new DataView(buf.buffer);
+    if (view.getUint32(12, true) !== pid) return null; // pbi_pid
+    return view.getBigUint64(120, true) * 1_000_000n + view.getBigUint64(128, true); // pbi_start_tvsec · pbi_start_tvusec
+  } finally { libproc.close(); }
+}
+
+function openDarwinProcessHandle(pid: number): HarnessProcessSignalHandle {
+  const start = readDarwinStartMicros(pid);
+  if (start === null) throw new Error('proc_pidinfo failed');
+  let closed = false;
+  return {
+    signal(signal) {
+      if (closed) throw new Error('process handle already closed');
+      if (signal !== 'SIGTERM') throw new Error('only SIGTERM is supported');
+      if (readDarwinStartMicros(pid) !== start) throw new Error('pid no longer names the same process');
+      process.kill(pid, 'SIGTERM');
+    },
+    close() { closed = true; },
+  };
+}
+
+export function openHarnessProcessHandle(pid: number): HarnessProcessSignalHandle {
+  if (process.platform === 'darwin') return openDarwinProcessHandle(pid);
+  if (process.platform !== 'linux' || !['x64', 'arm64'].includes(process.arch)) {
+    throw new Error('pid-bound signaling unavailable on this platform');
+  }
+  const libc = dlopen('libc.so.6', {
+    syscall: { args: [FFIType.i64, FFIType.i64, FFIType.i64, FFIType.i64, FFIType.i64], returns: FFIType.i64 },
+    close: { args: [FFIType.i32], returns: FFIType.i32 },
+  });
+  const fd = Number(libc.symbols.syscall(434, pid, 0, 0, 0)); // pidfd_open
+  if (fd < 0) {
+    libc.close();
+    throw new Error('pidfd_open failed');
+  }
+  let closed = false;
+  return {
+    signal(signal) {
+      if (closed) throw new Error('pidfd already closed');
+      if (signal !== 'SIGTERM' || libc.symbols.syscall(424, fd, osConstants.signals.SIGTERM, 0, 0) !== 0n) {
+        throw new Error('pidfd_send_signal failed');
+      }
+    },
+    close() {
+      if (closed) return;
+      closed = true;
+      libc.symbols.close(fd);
+      libc.close();
+    },
+  };
+}
+
+export function killHarnessProcess(
+  pid: number,
+  force: boolean,
+  deps: HarnessProcessObservationDeps = {},
+): { outcome: 'sent' | 'refused'; owned: boolean; runState: string; reason: string } {
+  const refuse = (reason: string, owned = false, runState = 'unknown') => ({ outcome: 'refused' as const, owned, runState, reason });
+  let result: ReturnType<typeof refuse> | { outcome: 'sent'; owned: true; runState: string; reason: string };
+  let handle: HarnessProcessSignalHandle | undefined;
+  let handleFailure: string | undefined;
+  if (Number.isSafeInteger(pid) && pid > 1) {
+    try { handle = (deps.openProcessHandle ?? openHarnessProcessHandle)(pid); }
+    catch (error) { handleFailure = observationFailureReason(error); }
+  }
+  try {
+    const root = deps.repositoryRoot ?? findGitDir(process.cwd())?.root;
+  const listed = normalizeProcessListObservation(deps.listProcesses?.() ?? defaultListHarnessProcesses());
+  const row = listed.status === 'ok' ? listed.records.find((record) => record.pid === pid) : undefined;
+  const prefix = root ? `${resolve(root)}${sep}` : '';
+  const entry = prefix ? `${prefix}bin/elanous.mjs` : '';
+  const argv = row?.command ?? '';
+  const entryIndex = entry && [
+    `bun ${entry} `, `${process.execPath} ${entry} `,
+    `bun bin/elanous.mjs `,
+  ].find((start) => argv.startsWith(start));
+  const fromRepo = Boolean(entryIndex && (entryIndex !== 'bun bin/elanous.mjs ' || row?.cwd && resolve(row.cwd) === resolve(root!)));
+  if (!Number.isSafeInteger(pid) || pid <= 1) result = refuse('invalid pid');
+  else if (listed.status !== 'ok') result = refuse('process observation incomplete');
+  else if (!row) result = refuse('pid not found in harness process population');
+  else if (!fromRepo || !/\belanous\.mjs\s+(?:(?:--test|--config-dir\s+\S+)\s+)?(?:self\s+(?:orchestrate|implement)|harness\s+(?:ask|say))\b/.test(row.command)) result = refuse('not a harness process from this repository');
+  else if (!handle) result = refuse(`pid-bound signaling unavailable: ${handleFailure ?? 'unknown failure'}`);
+  else {
+    let startTime: string | undefined;
+    try {
+      startTime = (deps.readStartTime ?? ((target) => execFileSync('ps', ['-p', String(target), '-o', 'lstart='], { encoding: 'utf8', timeout: 2_000 }).trim()))(pid);
+    } catch { /* unavailable is not a timestamp */ }
+    if (!startTime || !Number.isFinite(Date.parse(startTime))) result = refuse('process start time unreadable');
+    else {
+      const ownership = row.ownership ?? readProcessOwnership(pid);
+      const runId = ownership.status === 'observed' ? ownership.runId : undefined;
+      if (!runId) result = refuse('owning run unconfirmed');
+      else {
+        let ledger: readonly HarnessProcessLedgerEntry[] | null = null;
+        try { ledger = (deps.lookupLedger ?? defaultLookupHarnessProcessLedger)(runId, ownership.status === 'observed' ? ownership.stateDir : undefined); }
+        catch { /* fail closed */ }
+        const last = [...(ledger ?? [])].reverse().find((entry) => entry.event === 'run-status');
+        const runState = typeof last?.data?.runStatus === 'string' ? last.data.runStatus : 'unknown';
+        if (!ledger || !last) result = refuse('owning run ledger unavailable', true, runState);
+        else if (!['running', 'completed', 'failed', 'cancelled', 'abandoned'].includes(runState)) result = refuse('owning run status unconfirmed', true, runState);
+        else if (runState === 'running' && !force) result = refuse('owning run is not terminal (use --force)', true, runState);
+        else {
+          try {
+            const currentStart = (deps.readStartTime ?? ((target) => execFileSync('ps', ['-p', String(target), '-o', 'lstart='], { encoding: 'utf8', timeout: 2_000 }).trim()))(pid);
+            if (currentStart !== startTime) result = refuse('pid start time changed', true, runState);
+            else {
+              handle.signal('SIGTERM');
+              result = { outcome: 'sent', owned: true, runState, reason: 'SIGTERM sent' };
+            }
+          } catch (error) { result = refuse(`SIGTERM failed: ${observationFailureReason(error)}`, true, runState); }
+        }
+      }
+    }
+  }
+  debug.log('harness.processes', 'kill', { pid, ...result });
+  return result;
+  } finally { handle?.close(); }
+}
+
 function installHarnessProcessObservationCommand(
   harnessCmd: Command,
   deps: HarnessProcessObservationDeps = {},
@@ -1555,8 +1948,18 @@ function installHarnessProcessObservationCommand(
   const write = deps.write ?? ((text: string) => { console.log(text); });
   return harnessCmd
     .command('processes')
-    .description('이 저장소가 띄운 OS 프로세스를 읽기 전용으로 분류한다. 자원을 먹는 무리와 오래 떠 있는 무리를 가른다. 죽이지 않는다.')
-    .action(() => {
+    .description('기본 읽기 전용 분류. --kill <pid> 는 소유 런 확인 후 단일 PID 에만 SIGTERM 한다.')
+    .option('--kill <pid>', '소유 런을 확인한 뒤 지정한 PID 하나만 SIGTERM')
+    .option('--force', '소유 런이 진행 중이어도 지정한 PID 하나를 종료')
+    .action((opts: { kill?: string; force?: boolean }) => {
+      if (opts.kill !== undefined) {
+        const pid = Number(opts.kill);
+        const result = killHarnessProcess(pid, opts.force === true, deps);
+        write(`pid=${opts.kill} ${result.outcome}: ${result.reason}`);
+        if (result.outcome === 'refused') process.exitCode = 1;
+        return;
+      }
+      if (opts.force) { write('--force requires --kill <pid>'); process.exitCode = 2; return; }
       const records = deps.listProcesses?.() ?? defaultListHarnessProcesses();
       const worktrees = deps.listWorktrees?.() ?? defaultListHarnessWorktreePaths();
       const launchd = deps.observeLaunchdPids?.() ?? observeHarnessLaunchdPids();
@@ -1583,6 +1986,7 @@ export interface HarnessCliCommandDeps {
   say?: HarnessSayHandler;
   /** Observe-only Pod host dispatch seam. */
   podDispatchTask?: (input: DispatchTaskInput, deps?: DispatchTaskDeps) => ReturnType<typeof dispatchTask>;
+  launchGate?: PreLaunchGateDeps & { readBudget?: () => Promise<BudgetDecision | 'unknown'> };
   plan?: HarnessPlanHandler;
   /** ⭐ `plan` 주입이 «없을 때» 가는 기본 분기. 시험이 이 자리로 «CLI 의 기본 배선»을 문다
    *  (⛔ 주입된 `plan` 이 파일을 스스로 만들면 그 시험은 배선을 «못 답한다» — 무인 리뷰 GOODHART 지적). */
@@ -1596,6 +2000,36 @@ export function installHarnessCliCommand(program: Command, deps: HarnessCliComma
     .command('harness')
     .description('dev-harness worktree 수명 — 워크트리 생성(worktree add)·조회(worktrees)·정리(clean)·프로세스 관찰(processes)');
   installHarnessCliSinkHook(harnessCmd, deps.registerSink, deps.resolveSurface);
+  harnessCmd.command('incidents').description('최근 하니스 Pod 종료 사고 원장을 읽는다')
+    .option('--since <minutes>', '최근 몇 분의 종료를 볼지 (기본 15분)', '15')
+    .option('--json', '구조화 출력')
+    .action((opts: { since: string; json?: boolean }) => {
+      const since = Number(opts.since);
+      if (!Number.isFinite(since) || since < 0) {
+        console.error('❌ --since 는 0 이상의 분이어야 합니다');
+        process.exitCode = 2;
+        return;
+      }
+      try {
+        const root = effectiveInstanceRoot();
+        const rows = readRunExits(root);
+        if (rows.length === 0) {
+          console.log(opts.json ? JSON.stringify({ rows: [], bursts: [] }) : '기록 없음 — 사고 0 이 아니라 아직 기록이 없다');
+          return;
+        }
+        const now = Date.now();
+        const selected = rows.filter((row) => Date.parse(row.at) >= now - since * 60_000 && Date.parse(row.at) <= now);
+        const bursts = detectBursts(rows).filter((burst) => Date.parse(burst.lastAt) >= now - since * 60_000 && Date.parse(burst.lastAt) <= now);
+        if (opts.json) console.log(JSON.stringify({ rows: selected, bursts }));
+        else {
+          for (const row of selected) console.log(`${row.at} run ${row.runId} · ${row.reason} · status=${row.status} signal=${row.signal ?? '-'}`);
+          for (const burst of bursts) console.log(`${burst.firstAt}–${burst.lastAt} 묶음 ${burst.reason} ×${burst.count} · ${burst.runIds.join(', ')}`);
+        }
+      } catch (error) {
+        console.error(humanErrorLine(error));
+        process.exitCode = 1;
+      }
+    });
   installDeliverableVerifyCliCommand(harnessCmd, deps.deliverableVerify);
   installHarnessProcessObservationCommand(harnessCmd, deps.processObservation);
   installHarnessBudgetCommand(harnessCmd);
@@ -1623,6 +2057,7 @@ export function installHarnessCliCommand(program: Command, deps: HarnessCliComma
             }
             return resolved.substrate === 'pod' ? onPod(opts, 'cli-harness-ask', goalPath, resolved.pool!, deps.podDispatchTask) : ask(goalPath, normalizeHarnessAskSayOptions(opts));
           },
+          deps.launchGate,
         );
       });
   }
@@ -1647,6 +2082,7 @@ export function installHarnessCliCommand(program: Command, deps: HarnessCliComma
             }
             return resolved.substrate === 'pod' ? onPod(opts, 'cli-harness-say', sentence.join(' '), resolved.pool!, deps.podDispatchTask) : say(sentence, normalizeHarnessAskSayOptions(opts));
           },
+          deps.launchGate,
         );
       });
   }