elanous 0.2.0 → 0.2.4

package/src/design/system-schema.ts

@@ -0,0 +1,123 @@
+// 번들 디자인 시스템 tokens.css 가 공유하는 토큰 이름.
+// 순서는 docs/design/systems/*/tokens.css 의 :root 선언 순서와 같다.
+// 2026-09-28 요구는 «57»이라 적었으나 그 목록과 번들 52 의 교집합은 56 이다.
+// 값은 여기 없다 — 못 잰 칸을 지어내지 않기 위해서다.
+
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { defaultDesignSystemsDir } from './design-systems.js';
+
+export const BUNDLED_TOKEN_SCHEMA = [
+  'bg',
+  'surface',
+  'surface-warm',
+  'fg',
+  'fg-2',
+  'muted',
+  'meta',
+  'border',
+  'border-soft',
+  'accent',
+  'accent-on',
+  'accent-hover',
+  'accent-active',
+  'success',
+  'warn',
+  'danger',
+  'font-display',
+  'font-body',
+  'font-mono',
+  'text-xs',
+  'text-sm',
+  'text-base',
+  'text-lg',
+  'text-xl',
+  'text-2xl',
+  'text-3xl',
+  'text-4xl',
+  'leading-body',
+  'leading-tight',
+  'tracking-display',
+  'space-1',
+  'space-2',
+  'space-3',
+  'space-4',
+  'space-5',
+  'space-6',
+  'space-8',
+  'space-12',
+  'section-y-desktop',
+  'section-y-tablet',
+  'section-y-phone',
+  'radius-sm',
+  'radius-md',
+  'radius-lg',
+  'radius-pill',
+  'elev-flat',
+  'elev-ring',
+  'elev-raised',
+  'focus-ring',
+  'motion-fast',
+  'motion-base',
+  'ease-standard',
+  'container-max',
+  'container-gutter-desktop',
+  'container-gutter-tablet',
+  'container-gutter-phone',
+] as const;
+
+/** base 를 안 주면 이 번들 시스템에서 못 잰 칸을 채운다. */
+export const DEFAULT_BASE_SYSTEM = 'minimal';
+
+const TOKEN_DECL = /(?:^|\n)\s*(--[a-z0-9-]+)\s*:/gi;
+
+/** 한 tokens.css 의 :root 선언 이름(접두 `--` 를 뗀 것)을 등장 순서로. */
+export function tokenNamesInCss(css: string): string[] {
+  const stripped = css.replace(/\/\*[\s\S]*?\*\//g, '');
+  const root = /:root\s*\{([\s\S]*?)\}/.exec(stripped)?.[1] ?? '';
+  const names: string[] = [];
+  for (const match of root.matchAll(TOKEN_DECL)) {
+    const name = match[1]!.slice(2);
+    if (!names.includes(name)) names.push(name);
+  }
+  return names;
+}
+
+/**
+ * 번들 폴더마다 tokens.css 를 읽어 이름 교집합을 낸다.
+ * 순서는 첫 시스템의 선언 순서를 따른다(전부 같으면 스키마 순서와 같다).
+ */
+export function readBundledSchema(systemsDir?: string): readonly string[] {
+  const dir = systemsDir ?? defaultDesignSystemsDir();
+  let folders: string[];
+  try {
+    folders = readdirSync(dir, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => entry.name)
+      .sort();
+  } catch {
+    return [];
+  }
+  let intersection: string[] | null = null;
+  let order: readonly string[] = [];
+  for (const folder of folders) {
+    let css = '';
+    try {
+      css = readFileSync(join(dir, folder, 'tokens.css'), 'utf8');
+    } catch {
+      continue;
+    }
+    const names = tokenNamesInCss(css);
+    if (names.length === 0) continue;
+    if (intersection === null) {
+      intersection = [...names];
+      order = names;
+      continue;
+    }
+    const present = new Set(names);
+    intersection = intersection.filter((name) => present.has(name));
+  }
+  if (!intersection || intersection.length === 0) return [];
+  const keep = new Set(intersection);
+  return order.filter((name) => keep.has(name));
+}

package/src/discord-slash-wire.ts

@@ -21,6 +21,7 @@ import { makeCommandRest } from './discord/slash-registry.js';
 import { normalizeInteractionPayload } from './discord/slash-router.js';
 import type { SlashCommandSchema } from './discord/slash-types.js';
 import { debug } from './debug/log.js';
+import { resolveChannelBotToken } from './channel-bot-token.js';
 
 const REST_BASE = 'https://discord.com/api/v10';
 
@@ -111,7 +112,7 @@ export interface DiscordSlashWire {
 export function buildDiscordSlashWire(deps: DiscordSlashWireDeps): DiscordSlashWire {
   const log = deps.log ?? ((m: string): void => { console.log(m); });
   const fetchImpl = deps.__fetchImpl ?? fetch;
-  const token = deps.userConfig.discord.botToken?.trim() ?? '';
+  const token = resolveChannelBotToken('discord', deps.userConfig)?.token.trim() ?? '';
 
   async function registerCommands(): Promise<void> {
     if (!token) { log('[slash] no bot token — skip registration'); return; }

package/src/discord-test-runner.ts

@@ -32,6 +32,7 @@ import { getUserConfig, reloadUserConfig, userConfigPath, type UserConfig } from
 import { setElanousConfigDir } from './elanous-config-dir.js';
 import { syncTestConfig, isTestConfigStale } from './cli/config-test-sync.js';
 import { DiscordBot } from './discord.js';
+import { resolveChannelBotToken } from './channel-bot-token.js';
 import { debug } from './debug/log.js';
 
 /** Canonical isolated-state dir for the Discord test bot. */
@@ -98,7 +99,7 @@ export async function runDiscordTestMessenger(opts: DiscordTestRunnerOpts = {}):
       + '(the dedicated guild text channel, e.g. #elanous_test) or pass --channel.',
     );
   }
-  const token = (opts.token?.trim()) || testChannel?.botToken?.trim() || prod.discord.botToken?.trim() || '';
+  const token = (opts.token?.trim()) || testChannel?.botToken?.trim() || resolveChannelBotToken('discord', prod)?.token.trim() || '';
   if (!token) {
     throw new Error('discord-test: no token. Set `discord.botToken` (same-app default) or `discord.testChannel.botToken`.');
   }

package/src/discord-voice-wire.ts

@@ -35,6 +35,7 @@
 // gate. Production behavior is unchanged until the operator opts in.
 
 import type { UserConfig } from './user-config.js';
+import { resolveChannelBotToken } from './channel-bot-token.js';
 import type { runTurn } from './session/chat.js';
 import type { DiscordBot, DcIncoming, DiscordVoiceDispatchTap } from './discord.js';
 import { createSession } from './session/index.js';
@@ -280,7 +281,7 @@ export function buildDiscordVoiceWire(deps: DiscordVoiceWireDeps): DiscordVoiceW
   function discover(): Promise<{ guildId: string | null; voiceChannelId: string | null }> {
     if (discovered) return discovered;
     discovered = (async () => {
-      const token = cfg.discord.botToken?.trim();
+      const token = resolveChannelBotToken('discord', cfg)?.token.trim();
       if (!token) return { guildId: null, voiceChannelId: null };
       try {
         const auth = { headers: { Authorization: `Bot ${token}` } };

package/src/discord.ts

@@ -795,7 +795,7 @@ export class DiscordBot {
     const dcStreamingFlip = getUserConfig().sessionFabric?.streaming?.discord === true;
     debug.log('discord.deliver', 'route', { channelId: ctx.channelId, path: dcStreamingFlip ? 'flip-fanout' : 'legacy' });
     // §C5-enh reactions-as-status — 턴 시작 👀. 완료 ✅ / 실패 ❌ 는 아래. fail-soft.
-    const dcReactionsOn = getUserConfig().sessionFabric?.discord?.reactions === true;
+    const dcReactionsOn = true;
     debug.log('discord.deliver', 'reaction', { channelId: ctx.channelId, phase: 'start', emoji: '👀', on: dcReactionsOn });
     if (dcReactionsOn && ctx.messageId) void this.addReaction(ctx.channelId, ctx.messageId, '👀');
 

package/src/dispatch/opportunistic-launcher.ts

@@ -74,6 +74,8 @@ export interface LauncherDeps {
   launch: (task: LaunchCandidate, slot: ResolvedSlot) => Promise<void> | void;
   /** Surface concurrency check — return false to skip the task. */
   concurrencyOK?: (surface: string | undefined) => boolean;
+  /** Admission check before taking a resource reservation or launching. */
+  admit?: (task: LaunchCandidate) => Promise<string | undefined> | string | undefined;
   /** D8.2 (FU8 PR #1) — observer hook fired once per evaluated task.
    *  Production wiring (NEXUS daemon) injects
    *  `createDispatchOutcomeRecorder()` so each decision flows into the
@@ -88,6 +90,8 @@ export interface LauncherDeps {
   perTickCap?: number;
   /** Tick interval (ms). Default 1000. */
   intervalMs?: number;
+  /** Optional caller-owned interval observer; defaults to tick(). */
+  onTick?: () => Promise<unknown>;
 }
 
 export interface OpportunisticLauncherOptions extends LauncherDeps {}
@@ -107,7 +111,7 @@ export class OpportunisticLauncher {
     if (this.timer) return;
     const interval = this.deps.intervalMs ?? 1000;
     this.timer = setInterval(() => {
-      void this.tick();
+      void (this.deps.onTick ? this.deps.onTick() : this.tick());
     }, interval);
   }
 
@@ -164,6 +168,25 @@ export class OpportunisticLauncher {
       return outcome;
     }
 
+    // Admission (budget and other caller-owned gates).
+    if (this.deps.admit) {
+      try {
+        const reason = await this.deps.admit(task);
+        if (reason) {
+          const outcome: LaunchOutcome = { ok: false, taskId: task.id, reason };
+          this.recordOutcome(task, slot, outcome, 'rejected');
+          return outcome;
+        }
+      } catch (err) {
+        const outcome: LaunchOutcome = {
+          ok: false, taskId: task.id,
+          reason: `admission-error:${err instanceof Error ? err.message : String(err)}`,
+        };
+        this.recordOutcome(task, slot, outcome, 'errored');
+        return outcome;
+      }
+    }
+
     // Resource
     let reservation: ReservationOutcome | undefined;
     if (task.capabilities && task.capabilities.length > 0) {

package/src/domains/ops-status.ts

@@ -23,7 +23,9 @@ import { proposalDraftPath } from '../autopilot/build/build-target.js';
 import { readFileSync, existsSync } from 'node:fs';
 import { openSchedulesDb, inventoryCrontab, listSchedules, installedCronRoot, repoRoot, scheduleHealth, type ScheduleHealth, type ScheduleRow } from './schedule-registry.js';
 import { loadMandate, type TradeMandate } from './trade-mandate.js';
-import { debug } from '../debug/log.js';
+import { debug, redactSecretText } from '../debug/log.js';
+import { LogStore, logsDbPath, type LogStoreRow } from '../mss/logging/log-store.js';
+import { detectRepeatedFailures, explainFailure } from './repeated-failure.js';
 
 /** 예약 레지스트리 조회 관측 — 실패가 0으로 접히지 않게 남기는 창구. */
 export const OPS_STATUS_LOG_CATEGORY = 'ops.status';
@@ -43,6 +45,8 @@ export interface OpsStatusOpts {
   mandate?: TradeMandate | null;
   /** 플랜 초안 아티팩트 경로 resolver(테스트 seam). 기본 proposalDraftPath. */
   planDraftFor?: (missionId: string) => string;
+  /** Health-only log reader seam; the default reads the current instance's last ten minutes read-only. */
+  recentLogs?: () => LogStoreRow[];
 }
 
 export interface CountByStatus { [status: string]: number }
@@ -281,7 +285,7 @@ function safeMandate(): TradeMandate | null {
 }
 
 export interface OpsAnomaly {
-  kind: 'blocked_task' | 'errored_loop' | 'orchestrator_stale' | 'schedule_stale' | 'schedule_error';
+  kind: 'blocked_task' | 'errored_loop' | 'orchestrator_stale' | 'schedule_stale' | 'schedule_error' | 'repeated_failure';
   entity: string;
   detail: string;
   since?: string;
@@ -293,6 +297,14 @@ export interface OpsHealthReport {
   generatedAt: string;
 }
 
+/** Newest rows first, bounded: the health check must not load an unbounded 10-minute window into memory (review must-fix). */
+export const REPEATED_FAILURE_SCAN_LIMIT = 20_000;
+export function readRecentFailureLogs(store: Pick<LogStore, 'query'>, nowMs: number, limit = REPEATED_FAILURE_SCAN_LIMIT): LogStoreRow[] {
+  const rows = store.query({ sinceMs: nowMs - 10 * 60_000, limit });
+  if (rows.length >= limit) debug.log('ops.health', 'repeated-failure-scan-capped', { limit });
+  return rows;
+}
+
 /** 이상 판정(순수 집계) — 셀프교정(P3)의 입력. scheduleHealth 패턴 미러. */
 export function opsHealth(opts: OpsStatusOpts = {}): OpsHealthReport {
   const snap = opsSnapshot(opts);
@@ -329,6 +341,27 @@ export function opsHealth(opts: OpsStatusOpts = {}): OpsHealthReport {
     }
   }
 
+  // Independent log check: an unreadable log store must not hide task/loop/schedule anomalies.
+  try {
+    const recentLogs = opts.recentLogs ?? (() => {
+      const path = logsDbPath();
+      if (!existsSync(path)) return [];
+      const store = LogStore.openReadOnly(path);
+      try { return readRecentFailureLogs(store, (opts.now ?? new Date()).getTime()); }
+      finally { store.close(); }
+    });
+    const groups = detectRepeatedFailures(recentLogs());
+    for (const group of groups) {
+      anomalies.push({
+        kind: 'repeated_failure', entity: redactSecretText(group.key),
+        detail: redactSecretText(explainFailure(group)), since: group.firstTs,
+      });
+    }
+    debug.log('ops.health', 'repeated-failure', { groups: groups.length, topCount: groups[0]?.count ?? 0 });
+  } catch (err) {
+    debug.log('ops.health', 'repeated-failure-skipped', { reason: redactSecretText(err instanceof Error ? err.message : String(err)) });
+  }
+
   return { healthy: anomalies.length === 0, anomalies, generatedAt: snap.generatedAt };
 }
 

package/src/domains/outbound-alert.ts

@@ -13,13 +13,21 @@ import { spillLongContent } from '../storage/content-spill.js';
 import { openSurfaceEventsDb, recordEvent } from './surface-events.js';
 import { latestUserIntentTs } from '../user-intent/index.js';
 import { getUserConfig } from '../user-config.js';
+import { resolveChannelBotToken } from '../channel-bot-token.js';
 import { debug } from '../debug/log.js';
+import { resolveDaemonEndpoint } from '../nexus/daemon-endpoint.js';
 // ★ origin 되돌림(대표 2026-07-12) — 미션 알림을 발신 채널(메인 Q&A 봇)로 되돌린다. type-only
 //   import 라 런타임 순환 없음(발송 로직은 이 파일에 self-contained). origin 없으면 report 폴백.
 import type { MissionOrigin } from '../autopilot/mission-origin.js';
 import { conatusPath } from './conatus-data-dir.js';
 
-const NEXUS_URL = process.env.ELANOUS_NEXUS_URL || 'http://localhost:31415';
+/** Explicit `ELANOUS_NEXUS_URL` wins. Otherwise ask the daemon endpoint resolver.
+ *  A missing daemon is not a guessed port — the caller falls through to direct send. */
+function nexusUrl(): string | null {
+  const explicit = process.env.ELANOUS_NEXUS_URL?.trim();
+  if (explicit) return explicit;
+  return resolveDaemonEndpoint()?.baseUrl ?? null;
+}
 // 로컬 데몬이 getElanousConfigDir()/acp-token 에 발행한 loopback 토큰을 읽어 로컬
 // /v1/outbound 로 POST — getElanousConfigDir() 치환은 prod 동치(~/.elanous) + --config-dir 정합.
 const ACP_TOKEN_PATH = join(getElanousConfigDir(), 'acp-token');
@@ -122,10 +130,11 @@ function resolveBotToken(botId?: string): string | null {
       botToken?: string; reportChannel?: { botToken?: string }; testChannel?: { botToken?: string };
     } | undefined;
     if (!tg) return null;
-    const candidates = [tg.botToken, tg.reportChannel?.botToken, tg.testChannel?.botToken]
+    const mainToken = resolveChannelBotToken('telegram', getUserConfig())?.token;
+    const candidates = [mainToken, tg.reportChannel?.botToken, tg.testChannel?.botToken]
       .filter((t): t is string => typeof t === 'string' && t.length > 0);
     if (botId) { const m = candidates.find((t) => t.split(':')[0] === botId); if (m) return m; }
-    return tg.botToken ?? candidates[0] ?? null;
+    return mainToken ?? candidates[0] ?? null;
   } catch { return null; }
 }
 
@@ -275,7 +284,10 @@ export function deliver(text: string, kind = 'alert'): 'daemon' | 'direct' | fal
     let token = '';
     try { if (existsSync(ACP_TOKEN_PATH)) token = readFileSync(ACP_TOKEN_PATH, 'utf-8').trim(); } catch { /* no token */ }
     const headers = ['Content-Type: application/json', ...(token ? [`Authorization: Bearer ${token}`] : [])];
-    const j = curlPost(`${NEXUS_URL}/v1/outbound`, JSON.stringify({ text, markdown: false, kind }), headers);
+    const nexus = nexusUrl();
+    const j = nexus
+      ? curlPost(`${nexus}/v1/outbound`, JSON.stringify({ text, markdown: false, kind }), headers)
+      : null;
     const classification = classifyDaemonResponse(j);
     if (classification === 'ok') return 'daemon';
     const extra: Record<string, unknown> = { hasToken: token.length > 0 };

package/src/domains/repeated-failure.ts

@@ -0,0 +1,89 @@
+import type { LogStoreRow } from '../mss/logging/log-store.js';
+import { redactSecretText } from '../debug/log.js';
+
+export interface RepeatedFailureGroup {
+  key: string;
+  area: string;
+  reason: string;
+  count: number;
+  events: string[];
+  firstTs: string;
+  lastTs: string;
+}
+
+/** Only failure-shaped events with a structured reason count; severity is deliberately ignored. */
+export function failureReason(row: Pick<LogStoreRow, 'event' | 'category' | 'data'>): string | null {
+  const failureSuffix = /(?:^|[.\-_])(?:error|failed|fail|close|handshake-failed)$/i;
+  if (!failureSuffix.test(row.event) && !failureSuffix.test(row.category)) return null;
+  if (!row.data) return null;
+  try {
+    const data: unknown = JSON.parse(row.data);
+    if (!data || typeof data !== 'object' || Array.isArray(data)) return null;
+    const fields = data as Record<string, unknown>;
+    for (const field of ['reason', 'error', 'message']) {
+      if (typeof fields[field] !== 'string' || !fields[field].trim()) continue;
+      const reason = fields[field].trim();
+      if (/(?:^|[.\-_])close$/i.test(row.event) || /(?:^|[.\-_])close$/i.test(row.category)) {
+        const socketCode = /\bsocket closed:\s*(\d+)\b/i.exec(reason);
+        if (/\b(?:normal closure|going away|closed by (?:user|client)|client closed|clean close)\b/i.test(reason)) return null;
+        if (socketCode && (socketCode[1] === '1000' || socketCode[1] === '1001')) return null;
+        // Transport errors name themselves by code, not by the word «failed» (review must-fix: ECONNRESET was dropped).
+        const explicitFailure = /(?:fail(?:ed|ure)?|error|reject(?:ed|ion)?|denied|timeout|timed out|refused|unauthori[sz]ed|lost|broken|reset|abort(?:ed)?|hang ?up|\bE[A-Z]{3,}\b)/i.test(reason);
+        const failureCode = socketCode && /^(?:100[236789]|101[0-4])$/.test(socketCode[1]!);
+        if (field !== 'error' && !explicitFailure && !failureCode) return null;
+      }
+      return reason;
+    }
+  } catch { /* malformed log data is not evidence of a failure reason */ }
+  return null;
+}
+
+export function normalizeReason(s: string): string {
+  return redactSecretText(s)
+    .replace(/\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/gi, '#')
+    .replace(/\b[0-9a-f]{8,}\b/gi, '#')
+    .replace(/\d+/g, '#')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .slice(0, 120);
+}
+
+export function detectRepeatedFailures(
+  rows: readonly LogStoreRow[],
+  { threshold = 20 }: { threshold?: number } = {},
+): RepeatedFailureGroup[] {
+  const groups = new Map<string, RepeatedFailureGroup>();
+  for (const row of rows) {
+    const rawReason = failureReason(row);
+    if (!rawReason) continue;
+    // The same socket failure may be serialized as `Error: ...` on one call site and plain text on another.
+    const reason = normalizeReason(rawReason.replace(/^Error:\s*/i, ''));
+    if (!reason) continue;
+    const area = row.category.split('.').slice(0, 2).join('.');
+    const key = `${area}:${reason}`;
+    const current = groups.get(key);
+    if (current) {
+      current.count++;
+      if (!current.events.includes(row.event)) current.events.push(row.event);
+      if (Date.parse(row.ts) < Date.parse(current.firstTs)) current.firstTs = row.ts;
+      if (Date.parse(row.ts) > Date.parse(current.lastTs)) current.lastTs = row.ts;
+    } else {
+      groups.set(key, { key, area, reason, count: 1, events: [row.event], firstTs: row.ts, lastTs: row.ts });
+    }
+  }
+  return [...groups.values()].filter((g) => g.count >= threshold).sort((a, b) => b.count - a.count || a.key.localeCompare(b.key));
+}
+
+export function explainFailure(group: RepeatedFailureGroup): string {
+  // Any web-terminal area carrying the ACP socket's auth_failed close is the same cause — measured 2026-09-28 19:20:
+  // the first live tick saw it as `webterm.tabs` (list errors re-raise the socket close) and sent the generic line.
+  if (group.area.startsWith('webterm.') && /^socket closed: #: auth_failed$/i.test(group.reason)) {
+    // Same words as the PWA banners (🅞 #21591·#21602 · 🅕 #21599) so the alert and the screen say one thing.
+    return '이 기기(브라우저)에 소유자 토큰이 없거나 틀리거나 만료돼 데몬이 연결을 거절한다 — 이미 연결된 기기의 설정 › Connect token 에서 토큰을 만들어, 이 기기의 설정 › Daemon › Bearer token 칸(/app/settings/#bearer-token)에 붙인다';
+  }
+  const span = Date.parse(group.lastTs) - Date.parse(group.firstTs);
+  const minutes = Number.isFinite(span) ? Math.max(1, Math.ceil(span / 60_000)) : 10;
+  const age = Date.now() - Date.parse(group.firstTs);
+  const sinceMinutes = Number.isFinite(age) ? Math.max(1, Math.ceil(age / 60_000)) : 10;
+  return `${group.area} 가 ${minutes}분에 ${group.count}번 같은 사유로 실패: ${group.reason} — \`elanous logs --category ${group.area} --since ${sinceMinutes}m\` 로 본다`;
+}

package/src/domains/schedule-manage-tool.ts

@@ -9,11 +9,12 @@
 // 상세 = 내부 문서 `PLAN-scheduler-registry-2026-07-07`.
 
 import { existsSync } from 'node:fs';
+import { join } from 'node:path';
 import type { LLMToolSpec } from '../llm.js';
 import {
   openSchedulesDb, inventoryCrontab, inventoryInternalSchedules, listSchedules, readCrontab,
-  buildCronLine, addLineToCrontab, removeLineFromCrontab, setLineEnabled, applyCrontab, setRunVia, setScheduleMission,
-  deleteScheduleRow, setNote, parseCronLine, scriptName, wrapCronLine, unwrapCronLine, sharesCrontabLine, reindexCrontabEntry,
+  buildCronLine, addLineToCrontab, removeLineFromCrontab, setLineEnabled, applyCrontab, setScheduleMission,
+  deleteScheduleRow, setNote, parseCronLine, scriptName, wrapCronLine, wrapShellCronLine, unwrapCronLine, sharesCrontabLine, reindexCrontabEntry, repoRoot,
   type ScheduleRow,
 } from './schedule-registry.js';
 import { surfaceEventsDbPath, openSurfaceEventsDb, recallEvents } from './surface-events.js';
@@ -154,26 +155,36 @@ export async function dispatchScheduleManage(args: Record<string, unknown>): Pro
       const onlyName = idArg ? (listSchedules(sdb).find(r => r.id.startsWith(idArg) || r.name === idArg)?.name ?? null) : null;
       if (idArg && !onlyName) return { error: `잡 없음: ${idArg} (list로 id 확인).` };
       const changes: Array<{ name: string; after: string }> = [];
+      let skippedShell = 0;
       const newLines = current.split('\n').map((line) => {
         const parsed = parseCronLine(line);
         if (!parsed) return line;
         const nm = scriptName(parsed.command);
         if (onlyName && nm !== onlyName) return line;
-        // wrap 은 bun .ts 잡만(.sh 는 bun 미실행). unwrap 은 래핑된 라인만.
-        if (isWrap && !/\bbun\s+\S*scripts\/[\w.-]+\.ts/.test(parsed.command)) return line;
-        const after = isWrap ? wrapCronLine(line) : unwrapCronLine(line);
+        // 기존 bun .ts 래핑을 보존하고, 명시적 해석기가 있는 .sh만 셸 래퍼로 보낸다.
+        // 앞선 쪽이 발화 주체다 — `env bun scripts/x.ts` 는 bun, `zsh x.sh --runner bun scripts/y.ts` 는 셸.
+        const bunAt = parsed.command.search(/\bbun\s+\S*scripts\/[\w.-]+\.ts/);
+        const shellAt = parsed.command.search(/(?:^|\s)(?:\S*\/)?(?:bash|zsh|sh)\s+\S+\.sh(?=\s|$)/);
+        const bunJob = bunAt >= 0 && (shellAt < 0 || bunAt < shellAt);
+        const after = isWrap
+          ? bunJob ? wrapCronLine(line) : wrapShellCronLine(line, { bun: process.execPath, cronRun: join(repoRoot(), 'scripts', 'cron-run.ts') })
+          : unwrapCronLine(line);
+        if (isWrap && after === line && !bunJob && !/cron-run\.ts/.test(line)
+          && /^(?:cd\s+\S+\s*&&\s*)?(?:\.\/|\S*\/)?[\w.-]+\.sh(?=\s|$)/.test(parsed.command)) skippedShell++;
         if (after === line) return line;
         changes.push({ name: nm, after: after.trim() });
         return after;
       });
-      if (!changes.length) return { [isWrap ? 'wrapped' : 'unwrapped']: 0, note: isWrap ? '래핑할 .ts 크론 없음(이미 전부 래핑?).' : '언래핑할 래퍼 없음.' };
+      if (!changes.length) return { [isWrap ? 'wrapped' : 'unwrapped']: 0, ...(isWrap ? { skippedShell } : {}), note: isWrap ? '래핑할 .ts/.sh 크론 없음(이미 전부 래핑?).' : '언래핑할 래퍼 없음.' };
       if (args.yes !== true) {
         return { dryRun: true, action, count: changes.length, jobs: changes.map(c => c.name),
+          ...(isWrap ? { skippedShell } : {}),
           note: `${changes.length}건 ${isWrap ? '래핑' : '언래핑'} 예정 — 적용하려면 yes:true(백업 자동·crontab 재작성).` };
       }
       const backup = applyCrontab(newLines.join('\n'));
       inventoryCrontab(sdb); // unwrap-aware 파생 → id/계보 승계.
       return { [isWrap ? 'wrapped' : 'unwrapped']: changes.length, jobs: changes.map(c => c.name), backup,
+        ...(isWrap ? { skippedShell } : {}),
         note: `${changes.length}건 ${isWrap ? '래핑' : '언래핑'} 완료(백업 완료). ${isWrap ? '다음 발화부터 3계층(logs.db·레지스트리·자기기억) 관측' : '관측 래퍼 제거'}.` };
     }
     const target = byId(String(args.id ?? ''));
@@ -304,9 +315,18 @@ export async function dispatchScheduleManage(args: Record<string, unknown>): Pro
       const line = target.raw ?? (target.cron && target.command ? buildCronLine(target.cron, target.command) : '');
       if (!line) return { error: 'release: 복원할 라인 없음(raw/cron 부재).' };
       const backup = applyCrontab(addLineToCrontab(current, line));
-      setRunVia(sdb, target.id, 'crontab');
+      sdb.run(`UPDATE schedule_registry SET run_via = 'crontab', source = 'crontab', enabled = 1, disabled_reason = NULL WHERE id = ?`, [target.id]);
       inventoryCrontab(sdb);
-      return { released: target.name, id: target.id, backup, note: 'crontab 실행으로 복원. (trigger 이관잡은 데몬 재시작해야 trigger 발화 정지.)' };
+      // 파생 tox task 도 지운다 — delete 와 같은 규칙(안 지우면 부팅 sweep 이 다시 트리거로 등록한다).
+      // run_via 가 이미 crontab 이어도 지운다(앞선 release 가 남긴 고아를 이 명령으로 치울 수 있게).
+      const { deleteTriggerJob } = await import('./schedule-migrate.js');
+      const { TaskStore } = await import('../task-orchestrator/store.js');
+      const store = new TaskStore();
+      let taskDeleted = false;
+      try { taskDeleted = deleteTriggerJob(store, target.id).taskDeleted; } finally { store.close(); }
+      return { released: target.name, id: target.id, backup, taskDeleted, note: taskDeleted
+        ? 'crontab 실행으로 복원 · 파생 tox task 삭제(재시작 뒤 트리거 소멸).'
+        : 'crontab 실행으로 복원(파생 tox task 없음).' };
     }
     return { error: `알 수 없는 action: ${action}` };
   } catch (e) {

package/src/domains/schedule-migrate.ts

@@ -13,15 +13,21 @@
 // 제거는 주입(테스트 가능·nexus 가 실핸들 배선).
 
 import type { Database } from 'bun:sqlite';
+import { debug } from '../debug/log.js';
 import type { WorkflowEntry } from '../workflow-runtime/types.js';
 import type { TaskStore } from '../task-orchestrator/store.js';
 import { taskToWorkflowEntry } from '../task-orchestrator/task-to-workflow.js';
 import { isTerminalStatus } from '../task-orchestrator/types.js';
-import { listSchedules, markResult, setRunVia, type ScheduleRow } from './schedule-registry.js';
+import { listSchedules, markResult, type ScheduleRow } from './schedule-registry.js';
 import { defaultCatchupEligible, type SpawnOutcome } from './schedule-runner.js';
 import { prevScheduledFire } from './cron-match.js';
 import { scheduleJobToTask } from './schedule-to-task.js';
 
+/** Disabled schedules must not be re-registered just because their run_via is trigger. */
+export function scheduledRunViaById(rows: readonly ScheduleRow[]): Map<string, string | null> {
+  return new Map(rows.map(row => [row.id, row.enabled ? row.run_via : null]));
+}
+
 /**
  * 부팅 재등록 — TaskStore 의 scheduleText 달린 비-terminal task 를 workflow 데몬에
  * Schedule Trigger 로 등록. 이관잡(U3c)이 데몬 재시작 후에도 발화하도록 보완.
@@ -30,12 +36,24 @@ import { scheduleJobToTask } from './schedule-to-task.js';
 export function registerScheduledToxTasks(
   store: TaskStore,
   registerWorkflow: (entry: WorkflowEntry) => void,
-): { registered: number; skipped: number } {
+  /** 레지스트리의 그 잡이 지금 무엇으로 도나(`run_via`). Disabled 잡은 null 로 전달한다. 주면 `trigger` 가 아닌 잡의 파생 task 는 등록하지 않는다.
+   *  🩸 2026-09-27: `schedule release` 뒤 남은 파생 task 가 재시작마다 트리거로 다시 등록돼 crontab ⊕ 트리거 두 번 돌 뻔했다. */
+  runViaOf?: (jobId: string) => string | null,
+): { registered: number; skipped: number; skippedNotTrigger: number } {
   let registered = 0;
   let skipped = 0;
+  let skippedNotTrigger = 0;
   for (const task of store.listTasks()) {
     if (!task.scheduleText) continue;
     if (isTerminalStatus(task.status)) { skipped++; continue; }
+    if (task.schedulerJobId && runViaOf) {
+      const runVia = runViaOf(task.schedulerJobId);
+      if (runVia !== 'trigger') {
+        skippedNotTrigger++;
+        debug.log('schedule.migrate', 'boot-register-skipped', { taskId: task.id, jobId: task.schedulerJobId, runVia });
+        continue;
+      }
+    }
     try {
       registerWorkflow(taskToWorkflowEntry(task, task.scheduleText));
       registered++;
@@ -43,7 +61,7 @@ export function registerScheduledToxTasks(
       skipped++;
     }
   }
-  return { registered, skipped };
+  return { registered, skipped, skippedNotTrigger };
 }
 
 export interface MigrateJobDeps {
@@ -84,7 +102,7 @@ export function migrateJobToTrigger(deps: MigrateJobDeps, jobId: string): Migrat
     registered = true;
   }
 
-  setRunVia(deps.scheduleDb, jobId, 'trigger');
+  deps.scheduleDb.run(`UPDATE schedule_registry SET source = 'trigger', enabled = 1, disabled_reason = NULL, run_via = 'trigger' WHERE id = ?`, [jobId]);
 
   let crontabRemoved = false;
   if (job.raw && deps.removeCrontabLine) {