@triflux/core 10.46.0 → 10.48.0

package/hooks/codex-session-hook.mjs

@@ -3,6 +3,7 @@
 import { spawn } from "node:child_process";
 import { argv, exit, stdin, stdout } from "node:process";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { writeCodexSessionRecord } from "../hub/lib/codex-session-registry.mjs";
 import { drainPendingSynapse as defaultDrainPendingSynapse } from "../hub/team/synapse-http.mjs";
 import {
   heartbeatInteractiveSession as defaultHeartbeatInteractiveSession,
@@ -145,6 +146,7 @@ export async function runCodexSessionHook(stdinData, opts = {}) {
   const mode = parsed.ok
     ? normalizeMode(opts.argvMode ?? argv[2], parsed.payload)
     : "";
+  const writeSessionRecord = opts.writeSessionRecord || writeCodexSessionRecord;
   const hubEnsureRun = opts.hubEnsureRun || defaultHubEnsureRun;
   const registerInteractiveSession =
     opts.registerInteractiveSession || defaultRegisterInteractiveSession;
@@ -157,6 +159,11 @@ export async function runCodexSessionHook(stdinData, opts = {}) {
 
   try {
     await runHookSideEffectsWithStdoutSuppressed(async () => {
+      if (mode === "register" || mode === "heartbeat") {
+        try {
+          writeSessionRecord(parsed.payload);
+        } catch {}
+      }
       if (mode === "register") {
         try {
           launchPresenceRegistration(parsed.payload);

package/hooks/session-start-fast.mjs

@@ -13,6 +13,7 @@
 import { execFile, execFileSync } from "node:child_process";
 import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { resolveRoleControlSnapshot } from "../hub/lib/cto-env.mjs";
 import {
   buildSynapseTaskSummary,
   drainPendingSynapse,
@@ -95,6 +96,11 @@ async function defaultResolveParticipantLakeRoot(cwd) {
  */
 export async function emitParticipantSessionStarted(stdinData, seams = {}) {
   try {
+    if (
+      !resolveRoleControlSnapshot(seams.env || process.env).auto_collect_enabled
+    ) {
+      return null;
+    }
     const payload = parseStartPayload(stdinData);
     const sessionId = String(payload?.session_id || "").trim();
     if (!sessionId) return null;

package/hub/dynamic-routing-engine.mjs

@@ -45,7 +45,7 @@ function makeFallback(policy, trigger, inputsHash, now) {
       {
         cli: fb.default_cli ?? "codex",
         accountId: null,
-        model: fb.default_model ?? "gpt-6-sol",
+        model: fb.default_model ?? "gpt-6.1-sol",
         riskTier: "safe",
         reason: trigger,
       },

package/hub/lib/codex-session-registry.mjs

@@ -0,0 +1,306 @@
+import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import {
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { basename, join } from "node:path";
+
+export function registryDir(env = process.env) {
+  if (env.TFX_CODEX_SESSION_REGISTRY_DIR) {
+    return env.TFX_CODEX_SESSION_REGISTRY_DIR;
+  }
+  return join(
+    env.XDG_STATE_HOME || join(env.HOME || homedir(), ".local", "state"),
+    "triflux",
+    "codex-sessions",
+  );
+}
+
+function defaultPsFn(pid) {
+  try {
+    const output = execFileSync(
+      "ps",
+      ["-o", "ppid=,comm=", "-p", String(pid)],
+      {
+        encoding: "utf8",
+        timeout: 1000,
+      },
+    );
+    const match = output.match(/^\s*(\d+)\s+(.+?)\s*$/);
+    return match ? { ppid: Number(match[1]), comm: match[2] } : null;
+  } catch {
+    return null;
+  }
+}
+
+export function findCodexAncestorPid({
+  startPid = process.ppid,
+  psFn = defaultPsFn,
+  maxDepth = 8,
+} = {}) {
+  const seen = new Set();
+  let pid = startPid;
+  for (let depth = 0; depth < maxDepth; depth += 1) {
+    if (!Number.isInteger(pid) || pid <= 0 || seen.has(pid)) return null;
+    seen.add(pid);
+    let processInfo;
+    try {
+      processInfo = psFn(pid);
+    } catch {
+      return null;
+    }
+    if (!processInfo) return null;
+    if (basename(String(processInfo.comm || "")) === "codex") return pid;
+    pid = Number(processInfo.ppid);
+  }
+  return null;
+}
+
+function defaultTmuxFn(paneId) {
+  return execFileSync(
+    "tmux",
+    [
+      "display-message",
+      "-p",
+      "-t",
+      paneId,
+      "#{session_name}:#{window_id}.#{pane_id}",
+    ],
+    { encoding: "utf8", timeout: 1000 },
+  );
+}
+
+function defaultPanePidFn(paneId) {
+  return execFileSync(
+    "tmux",
+    ["display-message", "-p", "-t", paneId, "#{pane_pid}"],
+    { encoding: "utf8", timeout: 1000 },
+  );
+}
+
+function defaultCommandFn(pid) {
+  return execFileSync("ps", ["-o", "command=", "-p", String(pid)], {
+    encoding: "utf8",
+    timeout: 1000,
+  });
+}
+
+export function resolveTmuxCoordinate({ paneId, tmuxFn = defaultTmuxFn } = {}) {
+  if (typeof paneId !== "string" || !paneId.trim()) return null;
+  try {
+    const coordinate = tmuxFn(paneId).trim();
+    return /^.+:@\d+\.%\d+$/.test(coordinate) ? coordinate : null;
+  } catch {
+    return null;
+  }
+}
+
+function aliveFromPid(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code !== "ESRCH";
+  }
+}
+
+function pruneDeadRecords(dir) {
+  try {
+    for (const fileName of readdirSync(dir)) {
+      if (!/^\d+\.json$/.test(fileName)) continue;
+      const pid = Number(fileName.slice(0, -5));
+      if (Number.isSafeInteger(pid) && pid > 0 && !aliveFromPid(pid)) {
+        try {
+          unlinkSync(join(dir, fileName));
+        } catch {
+          // Registry upkeep must never affect the hook response.
+        }
+      }
+    }
+  } catch {
+    // A concurrent removal or permission change must not affect the write.
+  }
+}
+
+export function writeCodexSessionRecord(
+  payload,
+  {
+    env = process.env,
+    now = Date.now,
+    psFn = defaultPsFn,
+    tmuxFn,
+    panePidFn = defaultPanePidFn,
+    commandFn = defaultCommandFn,
+    dir = registryDir(env),
+  } = {},
+) {
+  if (typeof payload?.session_id !== "string" || !payload.session_id.trim()) {
+    return false;
+  }
+  const paneId = typeof env.TMUX_PANE === "string" ? env.TMUX_PANE.trim() : "";
+  if (!paneId) return false;
+  const pid = findCodexAncestorPid({ psFn });
+  if (pid === null) return false;
+
+  try {
+    const command = commandFn(pid);
+    if (
+      typeof command !== "string" ||
+      !command.trim() ||
+      command.includes("app-server")
+    ) {
+      return false;
+    }
+    // Split ps argv on whitespace; the first non-option after the binary is the subcommand.
+    const subcommand = command
+      .trim()
+      .split(/\s+/)
+      .slice(1)
+      .find((arg) => !arg.startsWith("-"));
+    if (subcommand === "exec") return false;
+    const panePidOutput = String(panePidFn(paneId)).trim();
+    const panePid = Number(panePidOutput);
+    if (
+      !/^\d+$/.test(panePidOutput) ||
+      !Number.isSafeInteger(panePid) ||
+      panePid <= 0
+    ) {
+      return false;
+    }
+    const seen = new Set();
+    let ancestor = pid;
+    for (let depth = 0; depth < 8 && ancestor !== panePid; depth += 1) {
+      if (
+        !Number.isSafeInteger(ancestor) ||
+        ancestor <= 0 ||
+        seen.has(ancestor)
+      ) {
+        return false;
+      }
+      seen.add(ancestor);
+      ancestor = Number(psFn(ancestor)?.ppid);
+    }
+    if (ancestor !== panePid) return false;
+  } catch {
+    // Daemons and stale panes cannot prove which TUI owns this thread.
+    return false;
+  }
+
+  const timestamp = typeof now === "function" ? now() : now;
+  const targetDir = dir;
+  const target = join(targetDir, `${pid}.json`);
+  let startedAt = timestamp;
+  let source = payload.source || null;
+  try {
+    const existing = JSON.parse(readFileSync(target, "utf8"));
+    if (existing.pid === pid && existing.sessionId === payload.session_id) {
+      if (Number.isFinite(existing.startedAt)) startedAt = existing.startedAt;
+      if (payload.source === undefined) source = existing.source || null;
+    }
+  } catch {
+    // New record, or an invalid previous record.
+  }
+
+  const record = {
+    version: 1,
+    writer: "triflux",
+    pid,
+    sessionId: payload.session_id,
+    cwd: payload.cwd || process.cwd(),
+    tmux: resolveTmuxCoordinate({ paneId, tmuxFn }),
+    tmuxPane: paneId,
+    source,
+    startedAt,
+    updatedAt: timestamp,
+  };
+
+  mkdirSync(targetDir, { recursive: true, mode: 0o700 });
+  const temporary = join(
+    targetDir,
+    `.${pid}.${process.pid}.${randomUUID()}.tmp`,
+  );
+  try {
+    writeFileSync(temporary, `${JSON.stringify(record)}\n`, {
+      mode: 0o600,
+      flag: "wx",
+    });
+    renameSync(temporary, target);
+  } catch (error) {
+    try {
+      unlinkSync(temporary);
+    } catch {
+      // Keep the original write error.
+    }
+    throw error;
+  }
+  pruneDeadRecords(targetDir);
+  return true;
+}
+
+export function readCodexSessionRecords({
+  dir = registryDir(),
+  isAlive = aliveFromPid,
+} = {}) {
+  let fileNames;
+  try {
+    fileNames = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const records = [];
+  for (const fileName of fileNames) {
+    if (!fileName.endsWith(".json")) continue;
+    try {
+      const record = JSON.parse(readFileSync(join(dir, fileName), "utf8"));
+      if (
+        record &&
+        Number.isSafeInteger(record.pid) &&
+        record.pid > 0 &&
+        typeof record.sessionId === "string" &&
+        record.sessionId &&
+        isAlive(record.pid)
+      ) {
+        records.push(record);
+      }
+    } catch {
+      // Ignore a malformed or concurrently removed record.
+    }
+  }
+  return records;
+}
+
+export function codexThreadNames({ indexPath } = {}) {
+  const path =
+    indexPath ||
+    join(
+      process.env.CODEX_HOME || join(process.env.HOME || homedir(), ".codex"),
+      "session_index.jsonl",
+    );
+  let data;
+  try {
+    data = readFileSync(path, "utf8");
+  } catch {
+    return new Map();
+  }
+  const names = new Map();
+  for (const line of data.split("\n")) {
+    try {
+      const entry = JSON.parse(line);
+      if (
+        typeof entry.id === "string" &&
+        typeof entry.thread_name === "string"
+      ) {
+        names.set(entry.id, entry.thread_name);
+      }
+    } catch {
+      // Ignore malformed or incomplete lines.
+    }
+  }
+  return names;
+}

package/hub/lib/cto-env.mjs

@@ -38,10 +38,9 @@ export function resolveRoleControlSnapshot(env = process.env, options = {}) {
   const ctoManagerEnabled = masterEnabled && isEnvOn(env, "TFX_CTO_MANAGER");
   const leadManagerEnabled =
     ctoManagerEnabled && isEnvOn(env, "TFX_LEAD_MANAGER");
-  const northStarEnabled =
-    masterEnabled && !isEnvOff(env, "TFX_CTO_NORTH_STAR");
+  const northStarEnabled = masterEnabled && isEnvOn(env, "TFX_CTO_NORTH_STAR");
   const autoCollectEnabled =
-    masterEnabled && !isEnvOff(env, "TFX_CTO_AUTO_COLLECT");
+    masterEnabled && isEnvOn(env, "TFX_CTO_AUTO_COLLECT");
   const values = {
     master_enabled: masterEnabled,
     cto_manager_enabled: ctoManagerEnabled,

package/hud/context-monitor.mjs

@@ -15,7 +15,7 @@ const MAX_CAPTURE_BYTES = 256 * 1024;
 const MAX_TOP_KEYS = 20;
 
 // stdin 이 context_window_size 를 제공하지 않을 때 모델 ID 로 한도를 추정한다.
-// Anthropic 공식 문서(2026-09-22 기준): Opus 4.6 이상, Sonnet 4.6/5,
+// Anthropic 공식 문서(2026-09-30 기준): Opus 4.6 이상, Sonnet 4.6/5/5.5,
 // Fable 5/5.1 = 1M. Sonnet 4.5 / Haiku 4.5 = 200K이며 [1m]도 유지한다.
 const MODEL_HINT_1M_PREFIXES = [
   "claude-sonnet-4-6",

package/hud/providers/codex.mjs

@@ -38,6 +38,8 @@ export function classifyBucket(bucket) {
 
 // primary/secondary를 window_minutes 기준으로 정규화
 // HUD 규약: primary=5h, secondary=1w
+// window_minutes 가 비어 있으면 길이를 모르므로 보고된 칸에 둔다(app-server 스키마에서
+// windowDurationMins 는 선택 필드). 길이를 알지만 5h/1w 가 아닌 버킷은 버린다.
 export function normalizeBuckets(rl) {
   let primary = null;
   let secondary = null;
@@ -46,6 +48,12 @@ export function normalizeBuckets(rl) {
     if (kind === "five_hour") primary = bucket;
     else if (kind === "weekly") secondary = bucket;
   }
+  if (!primary && rl.primary && rl.primary.window_minutes == null) {
+    primary = rl.primary;
+  }
+  if (!secondary && rl.secondary && rl.secondary.window_minutes == null) {
+    secondary = rl.secondary;
+  }
   return { primary, secondary };
 }
 
@@ -104,7 +112,35 @@ function isNewerSnapshot(candidate, current) {
   );
 }
 
-function selectCodexWindowSnapshot(snapshots, nowSec, windowKey) {
+function positiveWindowMinutes(bucket) {
+  const minutes = Number(bucket?.window_minutes);
+  return minutes > 0 ? minutes : null;
+}
+
+// 계정 하나에는 같은 종류의 창이 한 번에 하나만 열린다. 브로커 계정이 없으면
+// ~/.codex/sessions 와 HUD 라벨이 모두 ~/.codex/auth.json 계정 하나의 것이다. 그래서
+// 세션 로그에 더 늦게 리셋되는 창이 나타났고 옛 창이 그 창이 열리기 전에만 관측됐다면,
+// 옛 창은 조기 리셋(2026-09-23 실측)이나 계정 전환으로 끝난 창이다. 프로브로만 본 창은
+// 다른 계정일 수 있어 근거로 쓰지 않는다. 새 창이 열린 뒤에도 관측된 창은 함께 도는
+// 계정이므로 max-used 후보로 남긴다.
+function isReplacedWindowGroup(group, other) {
+  if (other === group || !other.seenInSessions) return false;
+  if (other.minResetAt <= group.maxResetAt || !other.windowMinutes) {
+    return false;
+  }
+  const lastSeenMs = Date.parse(group.latest.timestamp);
+  if (!Number.isFinite(lastSeenMs)) return false;
+  // resets_at 은 실측으로 아래로 약 30초, 위로 1초 흔들리므로 가장 늦은 값으로 개시 시각을 잡는다.
+  const otherOpenedAtMs = (other.maxResetAt - other.windowMinutes * 60) * 1000;
+  return lastSeenMs <= otherOpenedAtMs;
+}
+
+function selectCodexWindowSnapshot(
+  snapshots,
+  nowSec,
+  windowKey,
+  replaceEndedWindows,
+) {
   const groups = [];
   const ungrouped = [];
 
@@ -126,19 +162,29 @@ function selectCodexWindowSnapshot(snapshots, nowSec, windowKey) {
         minResetAt: resetAt,
         maxResetAt: resetAt,
         latest: snapshot,
+        seenInSessions: !snapshot.probe,
+        windowMinutes: positiveWindowMinutes(snapshot[windowKey]),
       };
       groups.push(group);
       continue;
     }
 
+    if (!snapshot.probe) group.seenInSessions = true;
+    group.windowMinutes ??= positiveWindowMinutes(snapshot[windowKey]);
     group.minResetAt = Math.min(group.minResetAt, resetAt);
     group.maxResetAt = Math.max(group.maxResetAt, resetAt);
     if (isNewerSnapshot(snapshot, group.latest)) group.latest = snapshot;
   }
 
-  const activeGroups = groups.filter(
+  const openGroups = groups.filter(
     (group) => Number(group.latest[windowKey]?.resets_at) > nowSec,
   );
+  const activeGroups = replaceEndedWindows
+    ? openGroups.filter(
+        (group) =>
+          !openGroups.some((other) => isReplacedWindowGroup(group, other)),
+      )
+    : openGroups;
   let selected = null;
   if (activeGroups.length > 0) {
     selected = activeGroups
@@ -168,16 +214,18 @@ function selectCodexWindowSnapshot(snapshots, nowSec, windowKey) {
   return { snapshot: selected, activeGroupCount: activeGroups.length };
 }
 
-function selectCodexSnapshot(snapshots, nowSec) {
+function selectCodexSnapshot(snapshots, nowSec, replaceEndedWindows) {
   const primarySelection = selectCodexWindowSnapshot(
     snapshots,
     nowSec,
     "primary",
+    replaceEndedWindows,
   );
   const secondarySelection = selectCodexWindowSnapshot(
     snapshots,
     nowSec,
     "secondary",
+    replaceEndedWindows,
   );
   const primarySnapshot = primarySelection.snapshot;
   if (!primarySnapshot) return null;
@@ -198,7 +246,7 @@ function selectCodexSnapshot(snapshots, nowSec) {
   return selected;
 }
 
-function mergeRateLimitSnapshots(snapshots, nowSec) {
+function mergeRateLimitSnapshots(snapshots, nowSec, replaceEndedWindows) {
   const merged = {};
   const codexSnapshots = [];
   for (const snapshot of snapshots) {
@@ -211,7 +259,11 @@ function mergeRateLimitSnapshots(snapshots, nowSec) {
     }
   }
 
-  const codex = selectCodexSnapshot(codexSnapshots, nowSec);
+  const codex = selectCodexSnapshot(
+    codexSnapshots,
+    nowSec,
+    replaceEndedWindows,
+  );
   if (codex) merged.codex = codex;
   return merged;
 }
@@ -227,9 +279,16 @@ export function getCodexRateLimits({
   now = new Date(),
   maxLinesPerFile = 800,
   extraSnapshots = [],
+  // 교체된 창 판정(isReplacedWindowGroup). 브로커 Codex 계정이 있으면 끈다.
+  replaceEndedWindows = true,
 } = {}) {
   let syntheticBucket = null; // 최근 token_count에서 합성 (행 활성화 + 토큰 데이터용)
-  const recentSnapshots = [...extraSnapshots];
+  // 프로브도 세션 로그와 같은 window_minutes 기준으로 5h/1w 슬롯을 정한다.
+  // app-server 는 5h 창이 없으면 주간 창을 primary 로 보낸다(2026-09-23 실측).
+  const recentSnapshots = extraSnapshots.map((snapshot) => ({
+    ...snapshot,
+    ...normalizeBuckets(snapshot),
+  }));
   const nowSec = Math.floor(now.getTime() / 1000);
 
   // 7일간 스캔: 실제 rate_limits 우선, 합성 버킷은 폴백
@@ -313,7 +372,11 @@ export function getCodexRateLimits({
     }
 
     const snapshots = dayOffset <= 1 ? recentSnapshots : daySnapshots;
-    const mergedBuckets = mergeRateLimitSnapshots(snapshots, nowSec);
+    const mergedBuckets = mergeRateLimitSnapshots(
+      snapshots,
+      nowSec,
+      replaceEndedWindows,
+    );
     if (Object.keys(mergedBuckets).length > 0) {
       if (syntheticBucket) {
         const main =
@@ -369,10 +432,30 @@ export async function collectProbeSnapshots(now = new Date()) {
   );
 }
 
+// 브로커 계정은 자기 CODEX_HOME 에서 돌기 때문에, 옛 창이 전환 전 계정의 창이어도 그
+// 계정이 아직 쓰이고 있을 수 있다. accounts.json 의 codex 항목과 프로브용 인증 캐시로 판정한다.
+export function hasBrokerCodexAccounts({
+  brokerDir = CODEX_BROKER_AUTH_CACHE_DIR,
+} = {}) {
+  const accounts = readJson(join(brokerDir, "accounts.json"), null);
+  if (Array.isArray(accounts?.codex) && accounts.codex.length > 0) return true;
+  try {
+    return readdirSync(brokerDir).some((file) =>
+      /^codex-auth-.+\.json$/.test(file),
+    );
+  } catch {
+    return false;
+  }
+}
+
 export async function refreshCodexRateLimitsCache() {
   const now = new Date();
   const extraSnapshots = await collectProbeSnapshots(now);
-  const buckets = getCodexRateLimits({ now, extraSnapshots });
+  const buckets = getCodexRateLimits({
+    now,
+    extraSnapshots,
+    replaceEndedWindows: !hasBrokerCodexAccounts(),
+  });
   // buckets가 null이어도 캐시 갱신 (stale 데이터 제거)
   writeJsonSafe(CODEX_QUOTA_CACHE_PATH, { timestamp: Date.now(), buckets });
   return buckets;

package/hud/providers/cto.mjs

@@ -1,5 +1,6 @@
 import { readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
+import { resolveRoleControlSnapshot } from "../../hub/lib/cto-env.mjs";
 import {
   CTO_LAKE_CURRENT_RELATIVE_PATH,
   CTO_STATUS_LINE_MAX_CHARS,
@@ -53,6 +54,8 @@ function extractStatusLine(lines) {
 }
 
 export function readCtoStatus(options = {}) {
+  if (!resolveRoleControlSnapshot(options.env).auto_collect_enabled)
+    return null;
   try {
     const currentPath = resolveCurrentPath(options);
     const stat = statSync(currentPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@triflux/core",
-  "version": "10.46.0",
+  "version": "10.48.0",
   "description": "triflux core — CLI routing, pipeline, adapters. Zero native dependencies.",
   "type": "module",
   "main": "hub/index.mjs",

package/scripts/lib/agent-route-policy.mjs

@@ -7,7 +7,7 @@ import {
 
 const policy = {
   executor: {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1080,
     runMode: "fg",
     opusOversight: false,
@@ -15,7 +15,7 @@ const policy = {
     subcommand: "exec",
   },
   codex: {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1080,
     runMode: "fg",
     opusOversight: false,
@@ -31,7 +31,7 @@ const policy = {
     subcommand: "exec",
   },
   cleanup: {
-    profile: "gpt6_sol_med",
+    profile: "gpt61_sol_med",
     timeoutSec: 540,
     runMode: "fg",
     opusOversight: false,
@@ -39,7 +39,7 @@ const policy = {
     subcommand: "exec",
   },
   deslop: {
-    profile: "gpt6_sol_med",
+    profile: "gpt61_sol_med",
     timeoutSec: 540,
     runMode: "fg",
     opusOversight: false,
@@ -95,7 +95,7 @@ const policy = {
     subcommand: "exec",
   },
   "code-reviewer": {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1800,
     runMode: "bg",
     opusOversight: false,
@@ -103,7 +103,7 @@ const policy = {
     subcommand: "review",
   },
   "quality-reviewer": {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1800,
     runMode: "bg",
     opusOversight: false,
@@ -119,7 +119,7 @@ const policy = {
     subcommand: "review",
   },
   scientist: {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1440,
     runMode: "bg",
     opusOversight: false,
@@ -127,7 +127,7 @@ const policy = {
     subcommand: "exec",
   },
   "document-specialist": {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1440,
     runMode: "bg",
     opusOversight: false,
@@ -143,7 +143,7 @@ const policy = {
     subcommand: "exec",
   },
   verifier: {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1200,
     runMode: "fg",
     opusOversight: false,
@@ -151,7 +151,7 @@ const policy = {
     subcommand: "review",
   },
   "test-engineer": {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1200,
     runMode: "bg",
     opusOversight: false,
@@ -159,7 +159,7 @@ const policy = {
     subcommand: "exec",
   },
   "qa-tester": {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1200,
     runMode: "bg",
     opusOversight: false,
@@ -212,8 +212,8 @@ export const CANONICAL_CODEX_PROFILE_OVERRIDES = Object.freeze(
   new Set([
     "gpt6_luna_low",
     "gpt6_luna_high",
-    "gpt6_sol_med",
-    "gpt6_sol_high",
+    "gpt61_sol_med",
+    "gpt61_sol_high",
     "gpt6_astra_xhigh",
     "gpt6_astra_max",
     "gpt6_astra_ultra",

package/scripts/lib/codex-profile-config.mjs

@@ -21,22 +21,25 @@ const EFFORT_BY_SUFFIX = {
 const CANONICAL_PROFILE_VALUES = Object.freeze({
   gpt6_luna_low: { model: "gpt-6-luna", effort: "low" },
   gpt6_luna_high: { model: "gpt-6-luna", effort: "high" },
-  gpt6_sol_med: { model: "gpt-6-sol", effort: "medium" },
-  gpt6_sol_high: { model: "gpt-6-sol", effort: "high" },
+  gpt61_sol_med: { model: "gpt-6.1-sol", effort: "medium" },
+  gpt61_sol_high: { model: "gpt-6.1-sol", effort: "high" },
   gpt6_astra_xhigh: { model: "gpt-6-astra", effort: "xhigh" },
   gpt6_astra_max: { model: "gpt-6-astra", effort: "max" },
   gpt6_astra_ultra: { model: "gpt-6-astra", effort: "ultra" },
 });
 
 // GPT-5.6 lane names map to the GPT-6 lane with the same effort. GPT-6 has no
-// Terra tier, so Terra lanes move to Sol.
+// Terra tier, so Terra lanes move to Sol. GPT-6 Sol lane names map to GPT-6.1
+// Sol with the same effort.
 const LEGACY_CANONICAL_PROFILE_ALIASES = Object.freeze({
   gpt56_sol_xhigh: "gpt6_astra_xhigh",
   gpt56_sol_max: "gpt6_astra_max",
   gpt56_sol_ultra: "gpt6_astra_ultra",
-  gpt56_terra_high: "gpt6_sol_high",
-  gpt56_terra_med: "gpt6_sol_med",
+  gpt56_terra_high: "gpt61_sol_high",
+  gpt56_terra_med: "gpt61_sol_med",
   gpt56_luna_low: "gpt6_luna_low",
+  gpt6_sol_high: "gpt61_sol_high",
+  gpt6_sol_med: "gpt61_sol_med",
 });
 
 export function normalizeCodexProfileName(profileName) {
@@ -65,7 +68,7 @@ function readProfileScalar(raw, key) {
 }
 
 /**
- * Resolve a Codex effort profile name (e.g. "gpt6_sol_high") to the `-c key=value`
+ * Resolve a Codex effort profile name (e.g. "gpt61_sol_high") to the `-c key=value`
  * config overrides that `codex exec` accepts, so the headless CLI lanes can
  * select a profile WITHOUT `codex exec --profile <name>`. codex 0.134+ rejects
  * `--profile X` whenever config.toml still contains an inline `[profiles.X]`
@@ -83,7 +86,7 @@ function readProfileScalar(raw, key) {
  *
  * @param {string} profileName
  * @param {{ codexHome?: string }} [opts]
- * @returns {string[]} e.g. ['model="gpt-6-sol"', 'model_reasoning_effort="high"']
+ * @returns {string[]} e.g. ['model="gpt-6.1-sol"', 'model_reasoning_effort="high"']
  */
 export function resolveCodexProfileConfigValues(profileName, opts = {}) {
   if (typeof profileName !== "string" || !profileName) {

package/scripts/lib/codex-recovery.sh

@@ -8,9 +8,16 @@
 # 4차 FALLBACK_FAILED → 모두 실패 시 marker + stderr_log 경로 출력
 
 recover_codex_stdout() {
+  # 복구 진입 여부 플래그(전역, local 아님) — 아우터 no-op 가드가 읽는다.
+  # 0 = 진짜 stdout 존재(복구 미진입), 1 = stdout 이 애초에 비어 복구 진입함.
+  CODEX_STDOUT_WAS_RECOVERED=0
   if [[ -s "$STDOUT_LOG" || ! -s "$STDERR_LOG" ]]; then
     return 0
   fi
+  # 여기 도달 = stdout 이 애초에 비어있었다. 아래에서 STDOUT_LOG 에 채워지는 내용은
+  # 전부 stderr 에서 복구된 것이지 워커의 진짜 산출물이 아니다. 이 플래그로 아우터
+  # 가드가 "복구된 stderr 노이즈"를 성공 출력으로 오인하지 않게 한다(#result-verification).
+  CODEX_STDOUT_WAS_RECOVERED=1
 
   # 1차: codex marker
   sed 's/\r$//' "$STDERR_LOG" \
@@ -48,3 +55,15 @@ recover_codex_stdout() {
     echo "[tfx-route] 경고: codex stdout 비어있음, stderr 복구도 실패. 위 stderr_log 경로에서 raw codex 출력 확인 가능." >&2
   fi
 }
+
+# ── MCP transport 채널 사망 판정 ──
+# Codex MCP transport 채널이 실행 중 죽으면 codex exec 가 exit 0 + 빈 stdout 으로
+# 끝나는 변형이 있다(래퍼 부재로 인한 pre-flight CODEX_MCP_TRANSPORT_EXIT_CODE=70
+# 과 구분됨 — 이건 런타임 채널 사망). stderr 의 하드 크래시 서명으로 이 사망을
+# 검출한다. 아우터 가드가 exit 0 이어도 결과를 실패로 승격하는 근거로 쓴다.
+# 인자: [stderr_log] (미지정 시 $STDERR_LOG). 반환: 0=크래시 서명 있음, 1=없음.
+codex_stdout_transport_crashed() {
+  local stderr_log="${1:-${STDERR_LOG:-}}"
+  [[ -n "$stderr_log" && -f "$stderr_log" ]] || return 1
+  grep -qE 'Transport channel closed|rmcp::transport worker quit with fatal' "$stderr_log" 2>/dev/null
+}