elanous 0.2.0 → 0.2.4

package/src/task-orchestrator/surfaces/self-implement.ts

@@ -50,6 +50,9 @@ export interface SelfImplementDisposition {
   branch?: string;
   prUrl?: string;
   prNumber?: number;
+  /** Head SHA checked by the Pod before host regate. */
+  checkedHeadCommit?: string;
+  hostRegate?: { passed: boolean; failures: Array<{ step: string; detail: string }>; os: string };
   merged?: boolean;
   detail?: string;
   /** Terminal error emitted by a failed child `--json` result. */
@@ -72,6 +75,8 @@ export interface SelfImplementDisposition {
   providerErrors?: { count: number; provider: string; category: 'quota' | 'credential' | 'request' | 'other' };
   /** Stable self-implement run identity for ledger-backed consumers. */
   runId?: string;
+  /** Pod child run identity, distinct from the host parent run attached to logs. */
+  childRunId?: string;
   /** E4(2026-09-25 · 벤치 비교 칸) — 자식 `--json` 의 `gate.passed`. 없으면 «못 쟀다»(false 가 아니다). */
   gatePassed?: boolean;
   /** 자식 `--json` 의 `review.verdict`(마지막 리뷰). `review.reviewed=false` 면 싣지 않는다 — 리뷰 안 한 판을 pass 로 읽지 않게. */
@@ -445,6 +450,8 @@ export function parseSelfImplementJson(stdout: string): SelfImplementDisposition
         ...(typeof o.branch === 'string' ? { branch: o.branch } : {}),
         ...(typeof o.prUrl === 'string' ? { prUrl: o.prUrl } : {}),
         ...(typeof o.prNumber === 'number' ? { prNumber: o.prNumber } : {}),
+        ...(typeof o.checkedHeadCommit === 'string' ? { checkedHeadCommit: o.checkedHeadCommit } : {}),
+        ...(typeof o.hostRegate === 'object' && o.hostRegate !== null ? { hostRegate: o.hostRegate as SelfImplementDisposition['hostRegate'] } : {}),
         ...(typeof o.merged === 'boolean' ? { merged: o.merged } : {}),
         ...(typeof o.detail === 'string' ? { detail: o.detail } : {}),
         ...(typeof o.error === 'string' && o.error.trim() ? { error: o.error } : {}),
@@ -461,7 +468,7 @@ export function parseSelfImplementJson(stdout: string): SelfImplementDisposition
           && typeof (o.providerErrors as Record<string, unknown>).provider === 'string'
           && ['quota', 'credential', 'request', 'other'].includes(String((o.providerErrors as Record<string, unknown>).category))
           ? { providerErrors: o.providerErrors as SelfImplementDisposition['providerErrors'] } : {}),
-        ...(typeof o.runId === 'string' && o.runId.trim() ? { runId: o.runId } : {}),
+        ...(typeof o.runId === 'string' && o.runId.trim() ? { runId: o.runId, childRunId: o.runId } : {}),
         ...reviewGateFields(o),
       };
       reportUnmappedDispositionFields(o, mapped);

package/src/task-orchestrator/tox-loop.ts

@@ -0,0 +1,204 @@
+import { OpportunisticLauncher, type LaunchCandidate } from '../dispatch/opportunistic-launcher.js';
+import { ResourceScheduler } from '../dispatch/resource-scheduler.js';
+import { TimeSlotManager } from '../dispatch/time-slot.js';
+import { debug } from '../debug/log.js';
+import type { TaskGraph } from './graph.js';
+import type { DispatchTickResult, TaskDispatcher } from './dispatcher.js';
+import type { TaskEventBus } from './events.js';
+import type { BudgetGate } from './feedback-loop.js';
+import { PRIORITY_RANK } from './priority.js';
+import type { Task } from './types.js';
+import { decideBudget, readBudgetInputsLive, type ReadBudgetInputsDeps } from '../self-implement/budget-gate.js';
+import { getUserConfig } from '../user-config.js';
+import { getSecretAsync } from '../nexus/config/secrets/index.js';
+import { projectLinearTask } from '../connectors/linear-projector.js';
+import type { TaskStore } from './store.js';
+
+async function defaultBudgetCheck(readBudget?: ReadBudgetInputsDeps & { readLiveGrok?: () => Promise<number | undefined> }): Promise<{ canAfford: boolean; tripped: readonly string[] }> {
+  const inputs = await readBudgetInputsLive({ config: getUserConfig(), ...readBudget });
+  const maxUsedPercent = {
+    ...inputs.maxUsedPercent,
+    'openai-codex': Math.min(inputs.maxUsedPercent['openai-codex'] ?? 60, 60),
+    grok: Math.min(inputs.maxUsedPercent.grok ?? 50, 50),
+  };
+  const decision = decideBudget({ ...inputs, maxUsedPercent });
+  // TOX adapters do not receive the selected fallback provider. Do not admit
+  // a next-provider decision until that provider can actually be routed.
+  const canAfford = decision.action === 'proceed';
+  return {
+    canAfford,
+    tripped: canAfford ? [] : decision.reasons,
+  };
+}
+
+export interface ToxLoopOptions {
+  graph: TaskGraph;
+  dispatcher: Pick<TaskDispatcher, 'tickTask'>;
+  bus?: TaskEventBus;
+  store?: TaskStore;
+  /** Optional projection IO seams for isolated TOX tests. */
+  linearProjection?: {
+    getApiKey: () => Promise<string | undefined>;
+    project: typeof projectLinearTask;
+  };
+  maxConcurrent?: number;
+  intervalMs?: number;
+  budgetCheck?: BudgetGate;
+  /** Usage-reader seam; still exercises the default P15 evaluator. */
+  readBudget?: ReadBudgetInputsDeps & { readLiveGrok?: () => Promise<number | undefined> };
+  /** Test seam; production hands each admitted task to the TOX dispatcher. */
+  launch?: (task: Task) => Promise<void> | void;
+  log?: (event: 'tick' | 'launched' | 'waiting-capacity' | 'budget-hold' | 'skipped', data: {
+    taskId?: string; priority?: Task['priority']; running: number; ready: number;
+    traceId?: string; reason?: string;
+  }) => void;
+}
+
+export function startToxLoop({ graph, dispatcher, bus, store, linearProjection, maxConcurrent = 2, intervalMs = 1000,
+  budgetCheck, readBudget, launch, log }: ToxLoopOptions): { tick: () => Promise<DispatchTickResult>; stop: () => void } {
+  if (!Number.isInteger(maxConcurrent) || maxConcurrent < 1) throw new RangeError('maxConcurrent must be a positive integer');
+  if (!Number.isFinite(intervalMs) || intervalMs < 1) throw new RangeError('intervalMs must be positive');
+  const slot = new TimeSlotManager();
+  const scheduler = new ResourceScheduler({ slot: () => slot.currentSlot() });
+  const inflight = new Set<string>();
+  const gate = budgetCheck ?? (() => defaultBudgetCheck(readBudget));
+  let stopped = false;
+  const projections = new Map<string, Promise<void>>();
+  let pending = false;
+  let tickPromise: Promise<DispatchTickResult> | undefined;
+  let currentResult: DispatchTickResult | undefined;
+  const emit: NonNullable<ToxLoopOptions['log']> = (event, data) => {
+    try { (log ?? ((kind, fields) => debug.log('tox.loop', kind, fields)))(event, data); }
+    catch { /* observation cannot interrupt dispatch */ }
+  };
+  const runningCount = () => graph.listRunning().length + [...inflight].filter((id) => graph.getTask(id)?.status !== 'running').length;
+  const snapshot = () => ({ running: runningCount(), ready: graph.countByStatus().ready });
+  let wakeTimer: ReturnType<typeof setTimeout> | undefined;
+  const wake = () => {
+    if (stopped || wakeTimer) return;
+    wakeTimer = setTimeout(() => {
+      wakeTimer = undefined;
+      void tick();
+    }, 0);
+  };
+  const launcher = new OpportunisticLauncher({
+    slot: () => slot.currentSlot(), scheduler, intervalMs, onTick: () => tick(),
+    readyTasks: () => graph.listAll()
+      .filter((task) => task.status === 'ready' && !inflight.has(task.id))
+      .sort((a, b) => a.createdAt - b.createdAt || a.id.localeCompare(b.id))
+      .map((task): LaunchCandidate => ({
+        id: task.id, ready: true, priorityRank: -PRIORITY_RANK[task.priority],
+        surface: task.surface.kind,
+      })),
+    perTickCap: maxConcurrent,
+    concurrencyOK: () => runningCount() < maxConcurrent,
+    admit: async (candidate) => {
+      const task = graph.getTask(candidate.id);
+      if (stopped || !task || task.status !== 'ready' || inflight.has(task.id)) return 'not-ready';
+      const decision = await gate(task.goalSlug ?? '', task.estimateUsd);
+      if (!decision.canAfford || decision.tripped.length > 0) return 'budget-hold';
+      return undefined;
+    },
+    launch: (candidate) => {
+      const task = graph.getTask(candidate.id);
+      if (!task || task.status !== 'ready' || stopped) throw new Error('not-ready');
+      let completion: Promise<void> | void;
+      if (launch) {
+        completion = launch(task);
+      } else {
+        const result = dispatcher.tickTask(task.id);
+        const started = result.dispatched[0];
+        if (!started) {
+          currentResult?.deferred.push(...result.deferred);
+          throw new Error(result.deferred[0]?.reason ?? 'not-dispatched');
+        }
+        currentResult?.dispatched.push(started);
+        completion = started.promise;
+      }
+      inflight.add(task.id);
+      emit('launched', { taskId: task.id, priority: task.priority, ...snapshot() });
+      void Promise.resolve(completion).catch((err) => {
+        emit('skipped', { taskId: task.id, priority: task.priority, ...snapshot(), reason: String(err) });
+      }).finally(() => {
+        inflight.delete(task.id);
+        if (!stopped) wake();
+      });
+    },
+  });
+
+  function tick(): Promise<DispatchTickResult> {
+    if (stopped) return Promise.resolve({ dispatched: [], deferred: [] });
+    if (tickPromise) { pending = true; return tickPromise; }
+    const result: DispatchTickResult = { dispatched: [], deferred: [] };
+    tickPromise = (async () => {
+      currentResult = result;
+      try {
+        do {
+          pending = false;
+          emit('tick', snapshot());
+          const outcomes = await launcher.tick();
+          for (const outcome of outcomes) {
+            if (outcome.ok) continue;
+            const task = graph.getTask(outcome.taskId);
+            const reason = outcome.reason ?? 'unknown';
+            emit(reason === 'concurrency-cap' ? 'waiting-capacity' : reason === 'budget-hold' || reason.startsWith('admission-error:') ? 'budget-hold' : 'skipped', {
+              taskId: outcome.taskId, priority: task?.priority, ...snapshot(), reason,
+            });
+          }
+        } while (pending && !stopped);
+      } catch (err) {
+        emit('skipped', { ...snapshot(), reason: `tick-error:${err instanceof Error ? err.message : String(err)}` });
+      } finally {
+        currentResult = undefined;
+      }
+      return result;
+    })();
+    void tickPromise.finally(() => { tickPromise = undefined; });
+    return tickPromise;
+  }
+
+  const subscription = bus?.subscribe((event) => {
+    if (event.kind === 'task-created' || (event.kind === 'task-status-changed' && event.to === 'ready')) wake();
+    if (event.kind === 'task-completed' || event.kind === 'task-failed' || event.kind === 'task-cancelled') wake();
+
+    const status = event.kind === 'task-status-changed' ? event.to
+      : event.kind === 'task-started' ? 'running'
+      : event.kind === 'task-completed' ? 'done'
+      : event.kind === 'task-failed' ? 'failed' : undefined;
+    if (status !== 'running' && status !== 'review' && status !== 'done' && status !== 'failed') return;
+    if (event.kind === 'task-status-changed' && (event.from === event.to || event.to !== 'review')) return;
+    if (!event.taskId) return;
+    const task = graph.getTask(event.taskId);
+    if (task?.generatedBy?.kind !== 'external' || task.generatedBy.provider !== 'linear') return;
+    const projectionTask = { ...task, status };
+    const executionId = event.kind === 'task-started' || event.kind === 'task-completed' || event.kind === 'task-failed'
+      ? event.executionId : task.lastExecutionId;
+    if (executionId) projectionTask.lastExecutionId = executionId;
+    const previous = projections.get(task.id);
+    const current = (async () => {
+      if (previous) await previous;
+      if (stopped) return;
+      try {
+        const apiKey = await (linearProjection?.getApiKey ?? (() => getSecretAsync('connector.linear.apiKey')))();
+        if (!apiKey || stopped) return;
+        const execution = executionId ? store?.getExecution(executionId) ?? undefined : undefined;
+        await (linearProjection?.project ?? projectLinearTask)({ task: projectionTask, apiKey, execution });
+      } catch (error) {
+        emit('skipped', { taskId: task.id, ...snapshot(), reason: `linear-projection:${String(error)}` });
+      }
+    })();
+    projections.set(task.id, current);
+    void current.finally(() => { if (projections.get(task.id) === current) projections.delete(task.id); });
+  }, { kinds: ['task-created', 'task-status-changed', 'task-started', 'task-completed', 'task-failed', 'task-cancelled'] });
+  launcher.start();
+  wake();
+  return {
+    tick,
+    stop() {
+      stopped = true;
+      launcher.stop();
+      if (wakeTimer) clearTimeout(wakeTimer);
+      subscription?.dispose();
+    },
+  };
+}

package/src/task-orchestrator/types.ts

@@ -406,7 +406,21 @@ export type TaskGeneratedBy =
   | { kind: 'llm'; modelId?: string; turn?: number }
   | { kind: 'cron'; jobRef: string }
   | { kind: 'followUp'; parentTaskId: string }
-  | { kind: 'regenerate'; parentTaskId?: string; depth: number };
+  | { kind: 'regenerate'; parentTaskId?: string; depth: number }
+  | { kind: 'external'; provider: 'asana' | 'linear' | 'telegram' | 'github' | 'agent-plugin' | 'intake' | 'other'; ref: string; url?: string };
+
+export type ExternalTaskSource = Extract<TaskGeneratedBy, { kind: 'external' }>;
+export interface TaskApproval {
+  /** pending = waits for a person · auto = matched a `tox.external.autoRun` rule ·
+   *  approved = a person approved it (`POST /v1/tasks/:id/approve`). */
+  state: 'pending' | 'auto' | 'approved';
+  /** The autoRun rule that matched (state `auto` only). */
+  rule?: string;
+  /** Who approved it (state `approved` only). */
+  approvedBy?: 'manual';
+  approvedAt?: number;
+  fingerprint?: string;
+}
 
 // ──────────────────── Task ───────────────────────────────────────────
 
@@ -464,6 +478,7 @@ export interface Task {
 
   // provenance
   generatedBy?: TaskGeneratedBy;
+  approval?: TaskApproval;
   triggerChain: readonly string[]; // parent taskIds (hop ≤ 5)
 
   /** Cascade-zyu Z0 (2026-05-12) — optional anchor to an existing
@@ -495,6 +510,7 @@ export interface TaskInit {
   timeoutMs?: number;
   acceptance?: TaskAcceptance;
   generatedBy?: TaskGeneratedBy;
+  approval?: TaskApproval;
   triggerChain?: readonly string[];
   /** Optional override — default is `'backlog'`. */
   status?: TaskStatus;
@@ -527,6 +543,8 @@ export interface TaskExecution {
    */
   surfaceAddress?: string;
   output?: string;                 // ≤ 4 KB tail; larger goes to outputPath
+  /** The agent ran, but its reported outcome needs human review rather than automatic completion. */
+  reviewRequired?: boolean;
   outputPath?: string;
   error?: { code: string; message: string; stack?: string };
   tokenUsage?: { input: number; output: number };
@@ -647,6 +665,7 @@ export function createTask(
     acceptance: init.acceptance,
     notes: initialNotes,
     generatedBy: init.generatedBy,
+    approval: init.approval,
     triggerChain: Object.freeze([...triggerChain]),
     showroomSessionId: init.showroomSessionId,
   };
@@ -737,6 +756,7 @@ export function serializeTask(t: Task): Record<string, unknown> {
     reviewVerdicts: t.reviewVerdicts,
     notes: [...t.notes],
     generatedBy: t.generatedBy,
+    approval: t.approval,
     triggerChain: [...t.triggerChain],
     showroomSessionId: t.showroomSessionId,
   };

package/src/telegram-commands.ts

@@ -762,6 +762,14 @@ export function defaultTelegramCommands(): TgSlashCommand[] {
         });
       },
     },
+    {
+      name: 'work',
+      description: '글을 알맞은 곳(흡수·태스크·하니스)에 넣고 결과를 여기로 답합니다 — /work [absorb|tasks|graph] <글>',
+      handler: async (args, ctx) => {
+        const { handleTelegramWork } = await import('./intake-plane/telegram-work.js');
+        return handleTelegramWork(args, { chatId: ctx.chatId, messageId: ctx.messageId, ...(ctx.botId ? { botId: ctx.botId } : {}), ...(ctx.threadId != null ? { threadId: ctx.threadId } : {}) });
+      },
+    },
     {
       name: 'harness',
       description: 'Capture a task and launch its harness implementation',

package/src/telegram-report.ts

@@ -11,6 +11,7 @@
 // the report channel while interactive Q&A stays on the main bot.
 
 import { TelegramBot } from './telegram.js';
+import { resolveChannelBotToken } from './channel-bot-token.js';
 import type { UserConfig } from './user-config.js';
 import { findSessionByTelegramChat, createSession, appendMessage } from './session/index.js';
 
@@ -55,7 +56,7 @@ export interface ReportTarget {
 export function resolveReportTarget(cfg: UserConfig): ReportTarget | null {
   const rc = cfg.telegram.reportChannel;
   if (!rc || !Number.isFinite(rc.chatId)) return null;
-  const botToken = rc.botToken ?? cfg.telegram.botToken;
+  const botToken = rc.botToken ?? resolveChannelBotToken('telegram', cfg)?.token;
   if (!botToken) return null;
   return { botToken, chatId: rc.chatId };
 }

package/src/telegram-run.ts

@@ -12,6 +12,7 @@
 
 import { debug } from './debug/log.js';
 import { getUserConfig } from './user-config.js';
+import { resolveChannelBotToken } from './channel-bot-token.js';
 import { forwardTelegramDispatch } from './telegram-dispatch-forward.js';
 import type { NexusTelegramQaPollerWireHandle } from './nexus/index.js';
 
@@ -40,11 +41,23 @@ export async function retryingAcquire<T extends { ok: boolean }>(
   }
 }
 
+let pollLockForTesting: {
+  acquire: typeof import('./telegram-poll-lock.js').acquireTelegramPollLock;
+  retry: typeof retryingAcquire;
+} | undefined;
+
+export function setTelegramPollLockForTesting(deps: typeof pollLockForTesting): () => void {
+  const previous = pollLockForTesting;
+  pollLockForTesting = deps;
+  return () => { pollLockForTesting = previous; };
+}
+
 /** 폴러를 띄우고 핸들을 돌려준다(시험용으로 분리 — 대기는 `runTelegramPoller` 가 한다). */
 export async function startTelegramPollers(): Promise<TelegramRunResult> {
   const cfg = getUserConfig();
-  if (!cfg.telegram.enabled || !cfg.telegram.botToken) {
-    throw new Error('telegram run: telegram.enabled 가 꺼져 있거나 telegram.botToken 이 없다');
+  const mainToken = resolveChannelBotToken('telegram', cfg)?.token;
+  if (!cfg.telegram.enabled || !mainToken) {
+    throw new Error('telegram run: telegram.enabled 가 꺼져 있거나 bot token 이 없다');
   }
   if (cfg.telegram.poller !== 'standalone') {
     console.warn('[telegram run] ⚠️ telegram.poller 가 standalone 이 아니다 — 넥서스도 같은 토큰을 폴링하려 한다. 토큰 잠금이 먼저 잡은 쪽만 띄운다.');
@@ -57,12 +70,12 @@ export async function startTelegramPollers(): Promise<TelegramRunResult> {
     import('./telegram-poll-lock.js'),
   ]);
   // 토큰마다 잠금을 «먼저» 기다려 잡는다(넥서스 재시작 겹침이면 30초 안에 풀린다).
-  const tokens = channels.interactivePollerTokens(channels.resolveTelegramChannels(cfg.telegram)).map((c) => c.botToken);
+  const tokens = channels.interactivePollerTokens(channels.resolveTelegramChannels({ ...cfg.telegram, botToken: mainToken })).map((c) => c.botToken);
   const held = new Map<string, () => void>();
   const refusedBotIds: string[] = [];
   const late: NexusTelegramQaPollerWireHandle[] = [];
   for (const token of tokens) {
-    const r = await lock.acquireTelegramPollLock(token, 'telegram-run');
+    const r = await (pollLockForTesting?.acquire ?? lock.acquireTelegramPollLock)(token, 'telegram-run');
     if (r.ok) held.set(token, r.release);
     else refusedBotIds.push(lock.telegramBotId(token));
   }
@@ -79,7 +92,7 @@ export async function startTelegramPollers(): Promise<TelegramRunResult> {
         return release ? { ok: true, release } : { ok: false };
       },
       // 처음에 못 잡은 토큰 — 잡힐 때까지 되풀이한다(넥서스가 놓는 순간 이어받는다).
-      acquire: (token) => retryingAcquire(() => lock.acquireTelegramPollLock(token, 'telegram-run'), {
+      acquire: (token) => (pollLockForTesting?.retry ?? retryingAcquire)(() => lock.acquireTelegramPollLock(token, 'telegram-run'), {
         onRetry: (attempt) => { if (attempt === 1 || attempt % 20 === 0) debug.log('telegram.run', 'late-acquire-retry', { botId: lock.telegramBotId(token), attempt }); },
       }),
     },

package/src/telegram.ts

@@ -25,6 +25,7 @@ import { randomUUID } from 'node:crypto';
 import { buildTurnOutputTextBlocks } from './input/turn-output-block.js';
 import { selectTurnOutputTextForSink } from './input/turn-output-sink-registry.js';
 import { debug } from './debug/log.js';
+import { resolveChannelBotToken } from './channel-bot-token.js';
 import type { TelegramVoiceAdapter } from './voice/channel-adapters/telegram-voice-adapter.js';
 import { createTelegramSurfaceHitl, type TelegramSurfaceHitl } from './hitl/telegram-surface-hitl.js';
 import { beginCancelableTurn, endCancelableTurn, cancelAcpTurn } from './acp/turn-runner.js';
@@ -63,6 +64,9 @@ import { selfToolArgHint } from './telegram-exec-footer.js';
 import { detectUrlRoute, type UrlRouteDecision } from './skills/url-router.js';
 import { observeDevRequestRouteFailSoft } from './skills/dev-request-router.js';
 import { runUrlRoute } from './skills/url-route-exec.js';
+import { recordRoutedLinkAbsorbed } from './intake-plane/link-ledger.js';
+import { classifyFrontInput } from './intake-plane/front-classifier.js';
+import { effectiveInstanceRoot } from './instance/resolve.js';
 
 export type TgAttachmentKind = 'photo' | 'voice' | 'audio' | 'document';
 
@@ -220,6 +224,7 @@ const DEFAULT_ERROR_BACKOFF = 5000;
 const DEFAULT_PER_CHAT_GAP_MS = 900;
 const DEFAULT_GLOBAL_MAX_PER_SEC = 28;
 const DEFAULT_STREAM_EDIT_GAP_MS = 1100;
+const EMPTY_ALLOWLIST_NOTICE_GAP_MS = 10 * 60 * 1000;
 // A turn slower than this delivers its result as FRESH messages (which
 // push-notify) instead of a silent placeholder edit — so a long /cc job
 // or HITL-approved task the user walked away from actually pings them.
@@ -280,6 +285,7 @@ export class TelegramBot {
    *  means no recent send. Telegram's documented limit is 1 msg/sec
    *  per chat — we enforce 900ms to leave jitter slack. */
   private readonly chatLastSentAt = new Map<number, number>();
+  private readonly emptyAllowlistNoticeAt = new Map<number, number>();
   /** T2-P6 — callback_query subscribers. When any is registered the
    *  getUpdates poller also asks for callback_query updates so
    *  inline-keyboard taps reach a handler. */
@@ -341,6 +347,33 @@ export class TelegramBot {
     }
   }
 
+  private isOwnerAllowed(userId: number): boolean {
+    return this.allowedUsers.size > 0 && this.allowedUsers.has(userId);
+  }
+
+  private async refuseMessage(ctx: TgIncoming): Promise<void> {
+    const empty = this.allowedUsers.size === 0;
+    debug.log('telegram.owner-gate', 'refused', {
+      kind: 'message', reason: empty ? 'empty-allowlist' : 'not-allowed', userId: ctx.userId,
+    });
+    if (!empty) this.log(`telegram: refusing unknown user ${ctx.userId}`);
+    if (empty) {
+      const now = this.nowImpl();
+      const previous = this.emptyAllowlistNoticeAt.get(ctx.chatId);
+      if (previous !== undefined && now - previous < EMPTY_ALLOWLIST_NOTICE_GAP_MS) return;
+      this.emptyAllowlistNoticeAt.set(ctx.chatId, now);
+    }
+    try {
+      await this.sendMessage(
+        ctx.chatId,
+        empty
+          ? `이 봇은 아직 소유자가 정해지지 않았습니다. 당신의 사용자 ID 는 ${ctx.userId} 입니다 — 기계에서 \`elanous config set telegram.allowedUsers '[${ctx.userId}]'\` 로 등록하면 쓸 수 있습니다.`
+          : 'This bot is private. Your user ID is not on the allowlist.',
+        { replyTo: ctx.messageId, threadId: ctx.threadId },
+      );
+    } catch { /* swallow — refusal must not enter the turn */ }
+  }
+
   private apiUrl(method: string): string {
     return `https://api.telegram.org/bot${this.token}/${method}`;
   }
@@ -564,7 +597,7 @@ export class TelegramBot {
     });
   }
 
-  /** §C5-enh reactions-as-status — 사용자 메시지에 이모지 리액션(👀 큐 → ✅/❌). 편집보다 저비용
+  /** §C5-enh reactions-as-status — 사용자 메시지에 이모지 리액션(👀 큐 → 👍/👎). 편집보다 저비용
    *  상태채널(hermes/openclaw 선례). emoji=null 이면 리액션 제거. Bot API 7.0+ setMessageReaction.
    *  fail-soft(리액션 실패가 배달을 막지 않음). */
   async setMessageReaction(chatId: number, messageId: number, emoji: string | null): Promise<void> {
@@ -919,7 +952,7 @@ export class TelegramBot {
    *  slash command resolves the capture with `null` (cancel). */
   private tryConsumeTextCapture(ctx: TgIncoming): boolean {
     if (!ctx.text || ctx.attachments.length > 0) return false;
-    if (this.allowedUsers.size > 0 && !this.allowedUsers.has(ctx.userId)) return false;
+    if (!this.isOwnerAllowed(ctx.userId)) return false;
     const key = `${ctx.chatId}:${ctx.threadId ?? ''}`;
     const capture = this.pendingTextCaptures.get(key);
     if (!capture) return false;
@@ -1034,6 +1067,7 @@ export class TelegramBot {
   async start(): Promise<void> {
     this.running = true;
     this.log(`telegram bot starting (allowlist size ${this.allowedUsers.size})`);
+    if (this.allowedUsers.size === 0) this.log('telegram.owner-gate empty-allowlist');
 
     // Publish the slash-command menu to Telegram. Clients pick up the
     // update automatically next time they open the chat — no user-side
@@ -1091,6 +1125,13 @@ export class TelegramBot {
           // parser.
           if (u.callback_query) {
             const cq = u.callback_query;
+            if (!this.isOwnerAllowed(cq.from.id)) {
+              debug.log('telegram.owner-gate', 'refused', {
+                kind: 'callback', reason: this.allowedUsers.size === 0 ? 'empty-allowlist' : 'not-allowed', userId: cq.from.id,
+              });
+              await this.answerCallbackQuery(cq.id, { text: '권한이 없습니다' });
+              continue;
+            }
             const payload: TgCallbackQuery = {
               id: cq.id,
               userId: cq.from.id,
@@ -1110,6 +1151,13 @@ export class TelegramBot {
           // (UX 에이전트 NORMALIZE). No `message`/`text`, so handle before the parser.
           if (u.message_reaction) {
             const mr = u.message_reaction;
+            // 리액션도 미션 카드 흐름을 앞으로 민다(ux-reaction-router) — 소유자 것만 받는다. 익명(user 없음)은 거절.
+            if (!mr.user || !this.isOwnerAllowed(mr.user.id)) {
+              debug.log('telegram.owner-gate', 'refused', {
+                kind: 'reaction', reason: this.allowedUsers.size === 0 ? 'empty-allowlist' : mr.user ? 'not-allowed' : 'anonymous', userId: mr.user?.id,
+              });
+              continue;
+            }
             const payload: TgMessageReaction = {
               chatId: mr.chat.id,
               messageId: mr.message_id,
@@ -1129,6 +1177,10 @@ export class TelegramBot {
           // scoped per channel — a private chat's chatId is the same user
           // id across every bot, so without this two bots' DMs merge.
           incoming.botId = this.botId;
+          if (!this.isOwnerAllowed(incoming.userId)) {
+            await this.refuseMessage(incoming);
+            continue;
+          }
           // HITL "Other" free-text: consume inline (before the turn
           // chain) so it isn't queued behind the turn awaiting it.
           if (this.tryConsumeTextCapture(incoming)) continue;
@@ -1250,10 +1302,19 @@ export class TelegramBot {
     const typingTimer = setInterval(typing, 4000);
 
     let posted = 0;
+    let recorded = false;
     let result: Awaited<ReturnType<typeof runUrlRoute>>;
     try {
       result = await runUrlRoute(dec, {
-        onStageDone: async (_kind, text) => {
+        onStageDone: async (kind, text, meta) => {
+          if (!recorded && (kind === 'detailed' || kind === 'absorb') && meta.obsidianPath) {
+            recorded = true;
+            try {
+              recordRoutedLinkAbsorbed(effectiveInstanceRoot(), {
+                source: 'telegram-bot', url: dec.url, notePath: meta.obsidianPath,
+              });
+            } catch { /* instance root lookup is best-effort too */ }
+          }
           const t = (text ?? '').trim();
           if (!t) return;
           // ★ 공개 URL → 클릭 가능한 링크. legacy markdown 은 URL 내 `_` 를 이탤릭으로 파싱해 raw URL 이
@@ -1287,6 +1348,10 @@ export class TelegramBot {
   }
 
   private async handleIncoming(ctx: TgIncoming): Promise<void> {
+    if (!this.isOwnerAllowed(ctx.userId)) {
+      await this.refuseMessage(ctx);
+      return;
+    }
     // Cascade-zyu U2 — capture utterance intent at update ingress.
     try {
       const { userIntentLogger } = await import('./user-intent/index.js');
@@ -1301,18 +1366,6 @@ export class TelegramBot {
       });
     } catch { /* logging must never break the chat path */ }
 
-    if (this.allowedUsers.size > 0 && !this.allowedUsers.has(ctx.userId)) {
-      this.log(`telegram: refusing unknown user ${ctx.userId}`);
-      try {
-        await this.sendMessage(
-          ctx.chatId,
-          'This bot is private. Your user ID is not on the allowlist.',
-          { replyTo: ctx.messageId, threadId: ctx.threadId },
-        );
-      } catch { /* swallow — we already logged */ }
-      return;
-    }
-
     // ★ 미션 언급 추적(맥락-인지 revise·대표 2026-07-14) — 이 메시지가 apm_id 를 언급하면 이 방의
     //   "최근 논의 미션"으로 기록. 이후 id 없는 "개정해줘"가 이 미션을 recency 보다 우선 채택하도록.
     if (ctx.text && ctx.text.includes('apm_')) {
@@ -1322,6 +1375,19 @@ export class TelegramBot {
       } catch { /* fail-soft */ }
     }
 
+    // Explicit directive ingress precedes mission/HITL text interceptors.
+    if (ctx.text.startsWith('지시:') || ctx.text.startsWith('/directive ')) {
+      try {
+        const { addDirective } = await import('./steward/directive.js');
+        const text = ctx.text.startsWith('지시:') ? ctx.text.slice('지시:'.length) : ctx.text.slice('/directive '.length);
+        const result = await addDirective(text, { source: 'telegram' });
+        await this.sendMessage(ctx.chatId, `${result.issue}: ${result.status}`, { replyTo: ctx.messageId, threadId: ctx.threadId });
+      } catch {
+        await this.sendMessage(ctx.chatId, '지시 등록 실패 — Linear 연결과 자격을 확인하세요.', { replyTo: ctx.messageId, threadId: ctx.threadId });
+      }
+      return;
+    }
+
     // ★ 미션 정정 답장 가로채기(force_reply·대표 2026-07-12) — reply_to 가 정정요청이면
     //   runTurn(Q&A) 대신 재분해로. dynamic import 로 autopilot 결합 최소·fail-soft.
     if (ctx.replyToText && ctx.text.trim()) {
@@ -1632,6 +1698,9 @@ export class TelegramBot {
         ? getActiveDelegation(delegationChatKey(this.botId, ctx.chatId, ctx.threadId))
         : null;
       if (!activeDeleg) {
+        try {
+          classifyFrontInput({ text: ctx.text, surface: 'telegram' }, { urlRouting: getUserConfig().skills.urlRouting });
+        } catch { /* observation must not interrupt URL routing */ }
         const urlDec = detectUrlRoute(ctx.text, getUserConfig().skills.urlRouting);
         if (urlDec) {
           const handled = await this.runUrlRouteReply(ctx, urlDec);
@@ -1656,8 +1725,9 @@ export class TelegramBot {
     debug.log('telegram.deliver', 'route', {
       chatId: ctx.chatId, path: streamingFlip ? 'flip-fanout' : 'legacy', streamingCfgOn, daemonBound: daemonBoundForFlip,
     });
-    // §C5-enh reactions-as-status — 턴 시작 👀(저비용 상태채널). 완료 ✅ / 실패 ❌ 는 아래. fail-soft.
-    const reactionsOn = getUserConfig().sessionFabric?.telegram?.reactions === true;
+    // §C5-enh reactions-as-status — 턴 시작 👀(저비용 상태채널). 종료 👍/👎는 Bot API 허용 집합에 따른다.
+    // https://core.telegram.org/bots/api#reactiontypeemoji — ✅/❌는 ReactionTypeEmoji에 없다.
+    const reactionsOn = true;
     debug.log('telegram.deliver', 'reaction', { chatId: ctx.chatId, phase: 'start', emoji: '👀', on: reactionsOn });
     if (reactionsOn && ctx.messageId != null) void this.setMessageReaction(ctx.chatId, ctx.messageId, '👀');
 
@@ -1835,15 +1905,14 @@ export class TelegramBot {
       } else {
         debug.log('telegram.deliver', 'flip-suppress-legacy', { chatId: ctx.chatId, chars: reply.length });
       }
-      // §C5-enh reactions — 완료 👍. ⚠️ 텔레그램은 리액션 이모지가 제한 세트(✅/❌ 불가·REACTION_INVALID)
-      // → 유효 이모지(👀/👍/👎/🎉/😢…) 사용. fail-soft.
+      // §C5-enh reactions — 완료 👍 (Bot API ReactionTypeEmoji). fail-soft.
       debug.log('telegram.deliver', 'reaction', { chatId: ctx.chatId, phase: 'done', emoji: '👍', on: reactionsOn });
       if (reactionsOn && ctx.messageId != null) void this.setMessageReaction(ctx.chatId, ctx.messageId, '👍');
       recordStreamingSlashHandled('completed');
     } catch (err: any) {
       streamer?.flushCancel();
       recordStreamingSlashHandled(streamingSlashResult ?? 'post-processing-failed');
-      // §C5-enh reactions — 실패 👎(텔레그램 유효 세트).
+      // §C5-enh reactions — 실패 👎 (Bot API ReactionTypeEmoji).
       debug.log('telegram.deliver', 'reaction', { chatId: ctx.chatId, phase: 'fail', emoji: '👎', on: reactionsOn });
       if (reactionsOn && ctx.messageId != null) void this.setMessageReaction(ctx.chatId, ctx.messageId, '👎');
       this.log(`telegram handler error: ${err?.message ?? String(err)}`);
@@ -2302,7 +2371,8 @@ export interface BotDaemonBridge {
 export function botFromConfig(opts: BotFromConfigOpts): TelegramBot {
   const tg = opts.userConfig.telegram;
   if (!tg.enabled) throw new Error('telegram disabled in user-config');
-  if (!tg.botToken) throw new Error('telegram.botToken missing in user-config');
+  const botToken = opts.telegramBotOpts?.token ?? resolveChannelBotToken('telegram', opts.userConfig)?.token;
+  if (!botToken) throw new Error('telegram.botToken missing in user-config');
   const log = opts.log ?? (() => {});
   const cap = opts.maxAttachments ?? 8;
   const runTurnImpl = opts.runTurnImpl ?? runTurn;
@@ -2603,7 +2673,7 @@ export function botFromConfig(opts: BotFromConfigOpts): TelegramBot {
   const voiceAdapter = buildTelegramVoiceAdapterFromConfig(opts.userConfig, opts.log);
 
   botRef = new TelegramBot({
-    token: tg.botToken,
+    token: botToken,
     allowedUsers: tg.allowedUsers,
     homeChannel: tg.homeChannel,
     onMessage: handler,