elanous 0.2.16 → 0.2.17

package/src/hq/fence-wrapper.ts

@@ -0,0 +1,123 @@
+import { spawnSync } from 'node:child_process';
+import { chmodSync, constants, copyFileSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, join } from 'node:path';
+import { homedir } from 'node:os';
+import { createPatch } from 'diff';
+
+const quote = (value: string): string => `'${value.replaceAll("'", "'\"'\"'")}'`;
+
+/** Only the installed entrypoint runs the fence; never use a checkout as a fallback.
+ * Arbiter (cloud-vm) outage retains the current lease and forbids promotion;
+ * this wrapper does not change the fence's lease or promotion decisions.
+ * cron runs with PATH=/usr/bin:/bin, so bun is baked in as an absolute path (OP 10-06 NO-GO). */
+export function renderHqFenceWrapper({ entry, configDir, bun, logFile }: { entry: string; configDir: string; bun: string; logFile?: string }): string {
+  if (!isAbsolute(bun)) throw new Error(`hq-fence: bun must be an absolute path: ${bun}`);
+  const log = logFile ?? join(configDir, 'logs', 'hq-fence.log');
+  return `#!/bin/sh
+# Arbiter (cloud-vm) outage: retain the lease, do not promote; hq fence owns that decision.
+ENTRY=${quote(entry)}
+CONFIG_DIR=${quote(configDir)}
+# cron has no PATH for bun — the absolute path was resolved when this wrapper was installed.
+BUN=${quote(bun)}
+LOG=${quote(log)}
+# Last resort when no alert path works: one line in a log file, no bun needed.
+log_line() {
+  mkdir -p "$(dirname "$LOG")" 2>/dev/null
+  printf '%s %s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$1" >> "$LOG" 2>/dev/null
+}
+# The alert goes through the same installed entry; PATH \`elanous\` is only a fallback when the entry itself is missing.
+# Alert bun: the installed one first, then usual absolute install locations (still no PATH lookup).
+alert_bun() {
+  for b in "$BUN" "$HOME/.bun/bin/bun" /opt/homebrew/bin/bun /usr/local/bin/bun; do
+    if [ -x "$b" ]; then echo "$b"; return 0; fi
+  done
+  return 1
+}
+alert() {
+  if [ -f "$ENTRY" ] && AB=$(alert_bun); then
+    if "$AB" "$ENTRY" --config-dir "$CONFIG_DIR" hq fence-wrapper alert "$1"; then return 0; fi
+    echo "hq-fence: owner alert failed: $1" >&2
+    log_line "owner alert failed: $1"
+    return 0
+  fi
+  if command -v elanous >/dev/null 2>&1 && elanous --config-dir "$CONFIG_DIR" hq fence-wrapper alert "$1"; then return 0; fi
+  echo "hq-fence: owner alert failed: $1" >&2
+  log_line "owner alert failed: $1"
+}
+if [ ! -x "$BUN" ]; then
+  echo "hq-fence: bun missing or not executable: $BUN" >&2
+  # Exactly one line on disk; the alert is tried only through an absolute fallback bun (never PATH).
+  log_line "bun missing or not executable: $BUN (rc=127)"
+  if [ -f "$ENTRY" ] && AB=$(alert_bun); then
+    "$AB" "$ENTRY" --config-dir "$CONFIG_DIR" hq fence-wrapper alert "hq-fence: bun missing or not executable: $BUN (rc=127)" || echo "hq-fence: owner alert failed (fallback bun $AB)" >&2
+  fi
+  exit 127
+fi
+if [ ! -f "$ENTRY" ] || [ ! -r "$ENTRY" ]; then
+  echo "hq-fence: installed entrypoint missing: $ENTRY" >&2
+  alert "hq-fence: installed entrypoint missing: $ENTRY"
+  exit 1
+fi
+cd "$(dirname "$ENTRY")/.." || { alert "hq-fence: installed directory missing"; exit 1; }
+if [ $# -lt 1 ] || [ -z "$1" ]; then
+  echo "hq-fence: role required" >&2
+  alert "hq-fence: role required"
+  exit 2
+fi
+ROLE=$1
+shift
+"$BUN" "$ENTRY" --config-dir "$CONFIG_DIR" hq fence --role "$ROLE" -- /bin/sh -c "$*"
+rc=$?
+if [ "$rc" -ne 0 ]; then alert "hq-fence: fence failed (rc=$rc, role=$ROLE)"; fi
+exit "$rc"
+`;
+}
+
+/** Absolute bun for the wrapper: this process when it is bun, else `command -v bun` resolved now (install time). */
+export function resolveHqFenceBun(deps: { isBun?: boolean; execPath?: string; lookup?: () => string } = {}): string {
+  const isBun = deps.isBun ?? typeof process.versions.bun === 'string';
+  const candidate = isBun
+    ? (deps.execPath ?? process.execPath)
+    : (deps.lookup ?? (() => spawnSync('/bin/sh', ['-c', 'command -v bun'], { encoding: 'utf8' }).stdout ?? ''))().trim();
+  if (!candidate || !isAbsolute(candidate)) throw new Error(`hq-fence: cannot resolve an absolute bun path (got ${JSON.stringify(candidate)})`);
+  return realpathSync(candidate);
+}
+
+export function installedHqFenceEntry(home = homedir()): string {
+  return join(home, '.local', 'share', 'elanous', 'current', 'node_modules', 'elanous', 'bin', 'elanous.mjs');
+}
+
+/** Literal \`cd <path>\` lines only — a worktree path built from a variable is not detected. */
+export function repositoryWorktreeCdWarning(body: string): string | undefined {
+  return body.split('\n').some(line => /^\s*cd\s+(?:['"]?[^\s'";]+\/)?(?:wt-[^\s'";]+|[^\s'";]+\/repo\.worktrees\/[^\s'";]+)(?:['"]?\s*(?:&&|\|\||;|#|$))/.test(line))
+    ? 'hq fence-audit: warning — hq-fence wrapper cd targets a repository worktree' : undefined;
+}
+
+export function installHqFenceWrapper(configDir: string, body: string, yes: boolean, deps: {
+  now?: () => Date;
+} = {}): { path: string; preview: string; backup?: string } {
+  const path = join(configDir, 'bin', 'hq-fence');
+  let present = false;
+  try { present = !!lstatSync(path); } catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error; }
+  if (present && !lstatSync(path).isFile()) throw new Error(`hq-fence: refusing non-regular wrapper: ${path}`);
+  const old = present ? readFileSync(path, 'utf8') : undefined;
+  const preview = `hq-fence proposed: ${path}\n${body}\n${createPatch(path, old ?? '', body, 'existing', 'proposed')}`;
+  if (!yes) return { path, preview };
+  let backup: string | undefined;
+  if (present) {
+    const backups = join(configDir, 'backups');
+    mkdirSync(backups, { recursive: true });
+    const stamp = (deps.now ?? (() => new Date()))().toISOString().replaceAll(':', '-');
+    backup = join(backups, `hq-fence.${stamp}`);
+    copyFileSync(path, backup, constants.COPYFILE_EXCL);
+  }
+  mkdirSync(dirname(path), { recursive: true });
+  const tempDir = mkdtempSync(join(dirname(path), '.hq-fence-'));
+  try {
+    const temp = join(tempDir, 'hq-fence');
+    writeFileSync(temp, body, { flag: 'wx', mode: 0o755 });
+    chmodSync(temp, 0o755);
+    renameSync(temp, path);
+  } finally { rmSync(tempDir, { recursive: true, force: true }); }
+  return { path, preview, ...(backup ? { backup } : {}) };
+}

package/src/hq/hq.ts

@@ -205,6 +205,14 @@ function mutate(r: Resolved, decide: (record: LeaseRecord | null, now: number) =
   return { ok: false, reason: 'lost the race five times', record: null };
 }
 
+/** Snapshot for read-only consumers: never advances the seen-generation marker or CASes the arbiter. */
+export function readHqLease(deps: HqDeps = {}) {
+  const { store } = resolve(deps);
+  const { now, raw } = store.read();
+  const record = parseLease(raw);
+  return { record, ageSeconds: record ? now - record.renewedAt : null, expired: record ? leaseExpired(record, now) : null };
+}
+
 export type LeaseAction = 'acquire' | 'renew' | 'status' | 'release';
 export function hqLease(action: LeaseAction, deps: HqDeps = {}, opts: { host?: string; expectedHolder?: string; expectedGeneration?: number } = {}) {
   const r0 = resolve(deps);

package/src/index.ts

@@ -259,7 +259,7 @@ interface RunDevAskFromGoalFileDeps {
   runSayLaunchFlow: (
     sayText: string,
     entrance?: import('./self-dev/entrance-registry.js').EntranceDeclaration,
-    selection?: { readonly forcePreflight?: boolean; readonly goalType?: import('./self-implement/goal-author.js').GoalType; readonly groundingCwd?: string },
+    selection?: { readonly forcePreflight?: boolean; readonly goalType?: import('./self-implement/goal-author.js').GoalType; readonly groundingCwd?: string; readonly authorGrade?: import('./self-implement/goal-author.js').GoalAuthorGradeSelection },
   ) => Promise<RunDevAskFlowResult>;
   runAskFileLaunchFlow: (
     askPath: string,
@@ -294,7 +294,7 @@ export function assembleAskLaunchPolicy(selection: {
 async function runDefaultSayLaunchFlow(
   sayText: string,
   entrance?: import('./self-dev/entrance-registry.js').EntranceDeclaration,
-  selection: { readonly forcePreflight?: boolean; readonly goalType?: import('./self-implement/goal-author.js').GoalType; readonly groundingCwd?: string } = {},
+  selection: { readonly forcePreflight?: boolean; readonly goalType?: import('./self-implement/goal-author.js').GoalType; readonly groundingCwd?: string; readonly authorGrade?: import('./self-implement/goal-author.js').GoalAuthorGradeSelection } = {},
 ): Promise<RunDevAskFlowResult> {
   const { readFileSync, writeFileSync } = await import('node:fs');
   const [flowMod, { runGoalAuthorCli }, { relative: relativeToCwdPath }, { CLI_HARNESS_SAY_ENTRANCE }] = await Promise.all([
@@ -319,6 +319,7 @@ async function runDefaultSayLaunchFlow(
     ...assembleAskLaunchPolicy(selection),
     ...(selection.goalType === undefined ? {} : { goalType: selection.goalType }),
     ...(selection.groundingCwd === undefined ? {} : { groundingCwd: selection.groundingCwd }),
+    ...(selection.authorGrade === undefined ? {} : { authorGrade: selection.authorGrade }),
   }, {
     print: (line) => console.error(line),
     log: (event, data, level) => debug.log('dev-pipeline', event, data, { level }),
@@ -328,6 +329,9 @@ async function runDefaultSayLaunchFlow(
     cwd: () => process.cwd(),
     now: () => Date.now(),
     isInteractive: () => process.stdin.isTTY === true && process.stdout.isTTY === true,
+    // POD-SELF-ANSWER: non-TTY (Pod) authoring self-answers clarifications with the author resolver.
+    selfResolveClarification: (await import('./self-implement/goal-author-clarification.js')).defaultGoalAuthorSelfResolve,
+    writeGoalDocument: (await import('./self-implement/goal-document-write.js')).writeGoalDocumentAtomic,
     buildPreflightDeps: askIo.buildAskPreflightDeps,
     priorBlockSamples: () => askIo.priorBlockSamplesFrom(askLogRows),
     recentAuthoringSamples: () => askIo.recentAuthoringSamplesFrom(askLogRows),
@@ -376,6 +380,9 @@ async function runDefaultAskFileLaunchFlow(
     cwd: () => process.cwd(),
     now: () => Date.now(),
     isInteractive: () => process.stdin.isTTY === true && process.stdout.isTTY === true,
+    // POD-SELF-ANSWER: non-TTY (Pod) authoring self-answers clarifications with the author resolver.
+    selfResolveClarification: (await import('./self-implement/goal-author-clarification.js')).defaultGoalAuthorSelfResolve,
+    writeGoalDocument: (await import('./self-implement/goal-document-write.js')).writeGoalDocumentAtomic,
     buildPreflightDeps: askIo.buildAskPreflightDeps,
     priorBlockSamples: () => askIo.priorBlockSamplesFrom(askLogRows),
     recentAuthoringSamples: () => askIo.recentAuthoringSamplesFrom(askLogRows),
@@ -818,6 +825,7 @@ async function runDevSayFromWords(
     authoringEntrance,
     {
       ...(opts.forcePreflight === undefined ? {} : { forcePreflight: opts.forcePreflight }),
+      ...(opts.authorGrade === undefined ? {} : { authorGrade: { grade: opts.authorGrade, source: opts.authorGradeSource ?? 'flag' } }),
       ...(grounding.groundingCwd === undefined ? {} : { groundingCwd: grounding.groundingCwd }),
     },
   );
@@ -977,12 +985,47 @@ hqCmd.command('seen').description('이 호스트가 본 가장 높은 임대 세
     process.exitCode = result.seen ? 0 : 3;
   });
 registerHqMovePlanCommand(hqCmd);
+const fenceWrapperCmd = hqCmd.command('fence-wrapper').description('설치본 HQ 울타리 크론 래퍼');
+fenceWrapperCmd.command('install').description('래퍼 제안 또는 백업 후 원자적 설치')
+  .option('--dry-run', '변경 내용만 출력 (기본)')
+  .option('--yes', '기존 파일 백업 후 설치')
+  .action(async (opts: { dryRun?: boolean; yes?: boolean }) => {
+    try {
+      if (opts.dryRun && opts.yes) throw new Error('--dry-run and --yes cannot be used together');
+      const { getElanousConfigDir } = await import('./elanous-config-dir.js');
+      const { installedHqFenceEntry, installHqFenceWrapper, renderHqFenceWrapper, resolveHqFenceBun } = await import('./hq/fence-wrapper.js');
+      const configDir = getElanousConfigDir();
+      const bun = resolveHqFenceBun();
+      const body = renderHqFenceWrapper({ entry: installedHqFenceEntry(), configDir, bun });
+      const result = installHqFenceWrapper(configDir, body, opts.yes === true);
+      if (opts.yes) console.log(`hq-fence installed: ${result.path} · bun: ${bun}${result.backup ? ` · backup: ${result.backup}` : ''}`);
+      else console.log(`hq-fence bun (absolute · cron has no PATH): ${bun}\n${result.preview}`);
+    } catch (error) { console.error(`hq fence-wrapper install: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
+  });
+fenceWrapperCmd.command('alert <reason>').description('HQ 울타리 실패를 기존 루프 소유자 요청 원장에 적재')
+  .action(async (reason: string) => {
+    try {
+      const { notifyOwners } = await import('./loops/checker.js');
+      const { getElanousConfigDir } = await import('./elanous-config-dir.js');
+      notifyOwners([{ id: `hq-fence:${Date.now()}:${process.pid}`, owner: 'TC', enabled: true, registered: true,
+        state: 'failing', reason }], { root: getElanousConfigDir() });
+    } catch (error) { console.error(`hq fence-wrapper alert: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
+  });
 hqCmd.command('fence-audit').description('운영 crontab 의 HQ 울타리 밖 쓰기 잡 목록과 감싼 줄 제안(읽기 전용)')
   .option('--json', 'JSON 출력')
   .action(async (opts: { json?: boolean }) => {
     try {
       await hqSink();
       const rows = (await import('./hq/fence-audit.js')).hqFenceAudit();
+      const { getElanousConfigDir } = await import('./elanous-config-dir.js');
+      const { repositoryWorktreeCdWarning } = await import('./hq/fence-wrapper.js');
+      const wrapper = _joinPath(getElanousConfigDir(), 'bin', 'hq-fence');
+      if (existsSync(wrapper)) {
+        try {
+          const warning = repositoryWorktreeCdWarning(readFileSync(wrapper, 'utf8'));
+          if (warning) console.error(warning);
+        } catch (error) { console.error(`hq fence-audit: wrapper inspection unavailable: ${error instanceof Error ? error.message : String(error)}`); }
+      }
       if (opts.json) await writeStdoutJson(`${JSON.stringify(rows)}\n`);
       else if (!rows.length) console.log('hq fence-audit: unfenced 0');
       else for (const row of rows) console.log(`${row.raw}\n  role: ${row.recommendedRole}\n  suggested: ${row.suggestedLine}`);
@@ -1255,7 +1298,7 @@ pythonCmd.command('setup').description('elanous venv(~/.local/share/elanous/pyth
 
 program.command('self-update')
   .alias('update')
-  .description('설치본은 릴리스로, 체크아웃은 깨끗한 체크아웃으로 갱신하고 승인 시 넥서스 재시작 · `elanous update` 와 같다 · `--auto on` 이면 매일 자동')
+  .description('설치본은 릴리스로, 체크아웃은 깨끗한 체크아웃으로 갱신 · --auto 는 캐너리 자동 판단, --auto on|off|status 는 기존 자동 갱신 서비스 관리')
   .option('--from <checkout>', '설치할 체크아웃 (기본: 설치본은 릴리스, 체크아웃은 현재 체크아웃)')
   .option('--version <version>', '설치본에서 지정한 릴리스 버전 설치 (기본: latest)')
   .option('--restart', '넥서스 재시작 승인')
@@ -1265,9 +1308,13 @@ program.command('self-update')
   .option('--skip-pwa-build', '체크아웃 설치 전 PWA 빌드를 명시적으로 건너뜀')
   .option('--dev', '판 사이 dev 빌드 설치 — versions/<판>-dev.<sha12> · install.json channel=dev · 이전 versionDir 보존 (사람 승인 · 자동 아님)')
   .option('--rollback', 'install.json 의 이전 versionDir 로 current 를 되돌린다 (이전이 없으면 거부)')
-  .option('--auto <on|off|status>', '자동 갱신 — macOS launchd · Linux systemd 타이머가 매일 04:17 에 `self-update --restart --alert` (크론이 이미 부르면 켜지 않는다)')
-  .action(async (opts: { from?: string; version?: string; restart?: boolean; json?: boolean; keep?: string; alert?: boolean; skipPwaBuild?: boolean; dev?: boolean; rollback?: boolean; auto?: string }) => {
-    if (opts.auto !== undefined) {
+  .option('--auto [on|off|status]', '인자 없이: 에지 레일 계획/실행 · on|off|status: 기존 자동 갱신 서비스 관리')
+  .option('--dry-run', '에지 레일 계획만 출력; 설치·되돌림·상태 쓰기 없음')
+  .option('--seat <seat>', '에지 레일 자리 (OP|TC|MK|UX)')
+  .option('--quiet-window', '상주 프로세스 재시작이 가능한 조용한 창이라고 명시')
+  .option('--canary-run-id <id>', '캐너리 성공 런의 고유 ID (독립 검증된 성공 런에서만 입력; 같은 ID 는 중복 적중하지 않음)')
+  .action(async (opts: { from?: string; version?: string; restart?: boolean; json?: boolean; keep?: string; alert?: boolean; skipPwaBuild?: boolean; dev?: boolean; rollback?: boolean; auto?: string | boolean; dryRun?: boolean; seat?: string; quietWindow?: boolean; canaryRunId?: string }) => {
+    if (typeof opts.auto === 'string') {
       if (!['on', 'off', 'status'].includes(opts.auto)) { console.error(`--auto 는 on · off · status 중 하나: ${opts.auto}`); process.exitCode = 2; return; }
       const { runAutoUpdate } = await import('./cli/update-auto.js');
       process.exitCode = (await runAutoUpdate(opts.auto as 'on' | 'off' | 'status')).exitCode;
@@ -1275,9 +1322,9 @@ program.command('self-update')
     }
     const { runUpdateForInstallation } = await import('./cli/self-update.js');
     // ⭐ 한 번 도는 CLI 는 logs.db 싱크를 스스로 붙여야 `debug.log('self-update', …)` 가 저장된다(없으면 조용히 사라진다 · 09-24 실측).
-    try { const { registerStandaloneLogSink } = await import('./domains/standalone-log-sink.js'); await registerStandaloneLogSink('self-update'); } catch { /* 관측 실패가 갱신을 막지 않는다 */ }
+    if (!opts.dryRun) try { const { registerStandaloneLogSink } = await import('./domains/standalone-log-sink.js'); await registerStandaloneLogSink('self-update'); } catch { /* 관측 실패가 갱신을 막지 않는다 */ }
     const keep = Number.parseInt(opts.keep ?? '3', 10);
-    const result = await runUpdateForInstallation({ ...opts, skipPwaBuild: opts.skipPwaBuild, keep: Number.isFinite(keep) ? keep : 3 }, { cliRoot: REPOSITORY_ROOT });
+    const result = await runUpdateForInstallation({ ...opts, auto: opts.auto === true, quietWindow: opts.quietWindow === true, skipPwaBuild: opts.skipPwaBuild, keep: Number.isFinite(keep) ? keep : 3 }, { cliRoot: REPOSITORY_ROOT });
     process.exitCode = result.exitCode;
   });
 
@@ -7001,6 +7048,8 @@ const selfDevCmd = program
           now: () => Date.now(),
           // ⛔ 「대화형인가」는 «두 쪽»을 본다 — 파이프로 몰면 물어도 답이 안 온다.
           isInteractive: () => process.stdin.isTTY === true && process.stdout.isTTY === true,
+          selfResolveClarification: (await import('./self-implement/goal-author-clarification.js')).defaultGoalAuthorSelfResolve,
+          writeGoalDocument: (await import('./self-implement/goal-document-write.js')).writeGoalDocumentAtomic,
           buildPreflightDeps: buildAskPreflightDeps,
           priorBlockSamples: () => askIo.priorBlockSamplesFrom(askLogRows),
           recentAuthoringSamples: () => askIo.recentAuthoringSamplesFrom(askLogRows),

package/src/intake-plane/digest.ts

@@ -8,7 +8,7 @@ import { intakeOutboxDir, kstDay } from './route.js';
 
 export type DigestLensVerdict = '대체 후보' | '보강' | '경쟁 대조';
 export interface DigestEntry { id: string; sources: string[]; url?: string; note?: string; noteName?: string; oneLiner?: string; axis: string; impact?: { verdict: DigestLensVerdict; why: string; target: string } }
-export interface IntakeDigest { day: string; absorbed: DigestEntry[]; goals: { fact: string; url?: string }[]; review?: { fact: string; note?: string }[]; grounding: number; release: number; manual: number; savedSilence?: { days: number; lastNewAt: string } }
+export interface IntakeDigest { day: string; absorbed: DigestEntry[]; goals: { fact: string; url?: string }[]; news?: { title: string; url: string; summary: string[]; implication: string[] }[]; shadowSuggestions?: { fact: string; url?: string; verdict: string }[]; review?: { fact: string; note?: string }[]; grounding: number; release: number; manual: number; savedSilence?: { days: number; lastNewAt: string } }
 
 const AXIS_LABEL: Record<string, string> = {
   video_automation: '영상 자동화', agent_basics: '에이전트 기본', agent_applied: '에이전트 응용', unrelated: '그 밖',
@@ -82,12 +82,24 @@ export function buildIntakeDigest(root: string, day: string, readFile: (p: strin
     };
   });
   const goals = readJsonl(join(out, 'goals', `${day}.jsonl`)).map((g) => ({ fact: String(g.fact ?? ''), ...(g.url ? { url: String(g.url) } : {}) }));
+  const lensRows = readJsonl(join(out, 'lens', `${day}.jsonl`));
+  const news = lensRows.flatMap((row) =>
+    typeof row.title === 'string' && typeof row.url === 'string' && Array.isArray(row.summary) && Array.isArray(row.implication)
+      ? [{ title: row.title, url: row.url, summary: row.summary.filter((s): s is string => typeof s === 'string'), implication: row.implication.filter((s): s is string => typeof s === 'string') }]
+      : []);
+  const shadowSuggestions = lensRows.flatMap((row) =>
+    Array.isArray(row.suggestions) ? row.suggestions.flatMap((raw: unknown) => {
+      if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return [];
+      const suggestion = raw as Record<string, unknown>;
+      if (suggestion.status !== '제안' || typeof suggestion.fact !== 'string' || !suggestion.fact.trim()) return [];
+      return [{ fact: suggestion.fact, ...(typeof row.url === 'string' ? { url: row.url } : {}), verdict: typeof suggestion.verdict === 'string' ? suggestion.verdict : '판단 필요' }];
+    }) : []);
   const review = readJsonl(join(out, 'review', `${day}.jsonl`)).map((r) => ({ fact: String(r.fact ?? ''), ...(r.note ? { note: String(r.note) } : {}) }));
   const grounding = readJsonl(join(out, 'grounding.jsonl')).filter((g) => typeof g.at === 'string' && kstDay(g.at) === day).length;
   const lastNewAt = readSavedCursorAt(root);
   const silentMs = lastNewAt ? now.getTime() - Date.parse(lastNewAt) : NaN;
   return {
-    day, absorbed, goals, review, grounding,
+    day, absorbed, goals, ...(news.length ? { news } : {}), ...(shadowSuggestions.length ? { shadowSuggestions } : {}), review, grounding,
     release: readJsonl(join(out, 'release', `${day}.jsonl`)).length,
     manual: readJsonl(join(out, 'manual', `${day}.jsonl`)).length,
     ...(lastNewAt && silentMs > SAVED_SILENCE_MS ? { savedSilence: { days: Math.floor(silentMs / 86_400_000), lastNewAt } } : {}),
@@ -98,7 +110,8 @@ export function buildIntakeDigest(root: string, day: string, readFile: (p: strin
 export function renderDigestMarkdown(d: IntakeDigest): string {
   const L: string[] = [`## 📰 오늘의 흡수 요약 (${d.absorbed.length})`, ''];
   if (d.savedSilence) L.push(`> ⚠️ 텔레그램 «저장된 메시지»에서 새 글을 ${d.savedSilence.days}일째 못 받았다(마지막 새 글 수집 ${kstDay(d.savedSilence.lastNewAt)}) — 저장했는데 안 들어왔다면 저장한 곳(본인 «저장된 메시지»인지)을 확인한다.`, '');
-  if (!d.absorbed.length) { L.push('오늘 흡수한 것이 없다.', ''); return L.join('\n'); }
+  if (!d.absorbed.length) L.push('오늘 흡수한 것이 없다.', '');
+  if (!d.absorbed.length && !d.news?.length) return L.join('\n');
   const byAxis = new Map<string, DigestEntry[]>();
   for (const e of d.absorbed) (byAxis.get(e.axis) ?? byAxis.set(e.axis, []).get(e.axis)!).push(e);
   for (const [axis, rows] of byAxis) {
@@ -106,11 +119,25 @@ export function renderDigestMarkdown(d: IntakeDigest): string {
     for (const e of rows) L.push(`- ${e.noteName ? `[[${e.noteName}]]` : e.url ?? e.id} — ${e.oneLiner ?? '(요약 줄 없음)'}`);
     L.push('');
   }
+  if (d.news?.length) {
+    L.push(`### 📰 관심 뉴스 (${d.news.length})`, '');
+    for (const article of d.news.slice(0, 10)) {
+      L.push(`- [${article.title}](${article.url})`);
+      for (const line of article.summary) L.push(`  - ${line}`);
+      for (const line of article.implication) L.push(`  - 엘라누스 함의: ${line}`);
+    }
+    L.push('');
+  }
   if (d.goals.length) {
     L.push(`### 🔴 엘라누스에 없는 것 — 골 후보 (${d.goals.length})`, '');
     for (const g of d.goals.slice(0, 10)) L.push(`- ${g.fact}${g.url ? ` · [원본](${g.url})` : ''}`);
     L.push('');
   }
+  if (d.shadowSuggestions?.length) {
+    L.push(`### 📰 뉴스 칸 제안 — 그림자, 판 미등록 (${d.shadowSuggestions.length})`, '');
+    for (const s of d.shadowSuggestions.slice(0, 10)) L.push(`- [${s.verdict}] ${s.fact}${s.url ? ` · [원본](${s.url})` : ''}`);
+    L.push('');
+  }
   const undecided = d.absorbed.filter((e) => !e.impact).length;
   if (undecided) L.push(`렌즈 판정 못 함 ${undecided} — 원장 \`elanous intake items\``, '');
   L.push(`> 매뉴얼 후보 ${d.manual} · 릴리스 노트 맥락 ${d.release} · 그라운딩 후보 ${d.grounding} — 흡수 원장 \`elanous intake items\` · 큐 \`<인스턴스>/intake/outbox/\``, '');
@@ -122,7 +149,15 @@ export function renderDigestTelegram(d: IntakeDigest, _opts: { vaultRoot?: strin
   // «Touching» is decided by the lens verdict alone; a missing note summary only changes how S reads (ACP must-fix).
   const touching = d.absorbed.filter((e) => e.impact);
   const L = [`흡수 ${d.absorbed.length} → 우리에게 닿는 것 ${touching.length}`];
-  if (!touching.length) return L[0];
+  // 관심 뉴스는 최대 셋 — 기사마다 S(요약 첫 줄) · A(엘라누스 함의 첫 줄) · 링크를 한 덩어리로(NEWS-INTAKE).
+  for (const article of (d.news ?? []).slice(0, 3)) {
+    L.push(`📰 ${article.title}`);
+    if (article.summary[0]) L.push(`S: ${article.summary[0]}`);
+    if (article.implication[0]) L.push(`A: ${article.implication[0]}`);
+    L.push(article.url);
+  }
+  if (d.shadowSuggestions?.length) L.push(`뉴스 칸 제안 ${d.shadowSuggestions.length}건 (그림자·판 미등록): ${d.shadowSuggestions.slice(0, 3).map((s) => `[${s.verdict}] ${s.fact}${s.url ? ` ${s.url}` : ''}`).join(' · ')}`);
+  if (!touching.length) return L.join('\n');
   // At most three items are shown, each as its own S·C·A·link block so context and source stay paired;
   // a later item sharing (verdict, target) says «위와 같은 행동» instead of repeating the A sentence (ACP must-fix).
   // S must be the note's own summary: items without one still count as touching but are not shown (ACP must-fix).

package/src/nexus/api/grid.ts

@@ -0,0 +1,61 @@
+import { getUserConfig } from '../../user-config.js';
+import { readHqLease, type HqDeps } from '../../hq/hq.js';
+import { measurePoolLease, type PoolLeaseMeasure } from '../../task-orchestrator/surfaces/pod-lease.js';
+import { parsePodPool, resolvePodPoolSpec, type PodPoolMember, type PoolKubectl } from '../../task-orchestrator/surfaces/pod-pool.js';
+
+export interface GridData {
+  /** null means the arbiter could not be read, not that no lease exists. */
+  hq: { record: ReturnType<typeof readHqLease>['record']; ageSeconds: number | null; expired: boolean | null; reason: string | null };
+  /** Configured member order; capacity comes from measurePoolLease when available. occupied is running + pending, or null on measurement failure. */
+  members: Array<{ context: string; capacity: number; running: number | null; pending: number | null; occupied: number | null; reason: string | null }>;
+  poolReason: string | null;
+}
+
+export interface GridDeps {
+  hq?: HqDeps;
+  readHq?: () => ReturnType<typeof readHqLease>;
+  poolSpec?: () => string | null;
+  /** Optional read-only kubectl seam; never use a probe that creates Pods. */
+  kubectl?: PoolKubectl;
+  measure?: (members: readonly PodPoolMember[]) => PoolLeaseMeasure;
+}
+
+/** Independent, fail-soft read snapshots. No lease status/heartbeat, DNS probe Pod, host reservation or writes. */
+export function buildGridData(deps: GridDeps = {}): GridData {
+  let hq: GridData['hq'];
+  try {
+    hq = { ...(deps.readHq ?? (() => readHqLease(deps.hq)))(), reason: null };
+  } catch (error) {
+    hq = { record: null, ageSeconds: null, expired: null, reason: String(error) };
+  }
+
+  let members: GridData['members'] = [];
+  let poolReason: string | null = null;
+  try {
+    const spec = (deps.poolSpec ?? (() => resolvePodPoolSpec(undefined, process.env, () => {
+      const config = getUserConfig();
+      return config.harness?.podPool ?? config.pod?.pool;
+    })))();
+    if (spec) {
+      const configured = parsePodPool(spec);
+      try {
+        const measured = (deps.measure ?? ((pool) => measurePoolLease(pool, { skipDnsProbe: true, ...(deps.kubectl ? { kubectl: deps.kubectl } : {}) })))(configured);
+        const byContext = new Map(measured.members.map((m) => [m.context, m]));
+        members = configured.map((member) => {
+          const row = byContext.get(member.context);
+          const running = row?.running ?? null;
+          const pending = row?.pending ?? null;
+          return { context: member.context, capacity: row?.capacity ?? member.capacity, running, pending,
+            occupied: running === null || pending === null ? null : running + pending,
+            reason: row?.reason ?? (row ? null : '측정 불가') };
+        });
+      } catch (error) {
+        poolReason = String(error);
+        members = configured.map(({ context, capacity }) => ({ context, capacity, running: null, pending: null, occupied: null, reason: poolReason }));
+      }
+    } else poolReason = 'pool not configured';
+  } catch (error) {
+    poolReason = String(error);
+  }
+  return { hq, members, poolReason };
+}

package/src/nexus/api/http-server.ts

@@ -22,6 +22,7 @@ import { spawnSync } from 'node:child_process';
 import { isAbsolute } from 'node:path';
 import { createProject, listProjects } from '../../project/project-store.js';
 import { handleOutputsGet, type OutputsDeps } from './outputs-route.js';
+import { buildGridData, type GridDeps } from './grid.js';
 import { DECISIONS_PATH, handleDecisions, type DecisionsRouteDeps } from './decisions-route.js';
 import { CARD_FOLLOWUP_PATH, createCardFollowupJobs, type CardFollowupJobs } from './card-followup-route.js';
 import { SKILL_EXEC_PATH, createSkillExecJobs, type SkillExecJobs } from './skill-exec-route.js';
@@ -341,7 +342,7 @@ import {
   handleTasksList,
   handleTaskDetail,
 } from './tasks-scheduler.js';
-import { handleTaskCardsGet, handleTaskCardsWishPost } from './task-cards-api.js';
+import { handleTaskCardsGet, handleTaskCardsWishPost, handleTaskCardsClosePost } from './task-cards-api.js';
 import { handleTaskCreatePost, handleTaskApprovePost } from './tasks-create.js';
 import { matchIngestAuthorization } from './ingest-token.js';
 import {
@@ -478,6 +479,8 @@ export interface NexusHttpServerOpts {
   /** Optional installer state root for isolated API consumers and tests. */
   pluginStateRoot?: string;
   outputs?: OutputsDeps;
+  /** Read-only grid measurement seam; omitted in production for live HQ and Pod pool reads. */
+  grid?: GridDeps;
   decisions?: Pick<DecisionsRouteDeps, 'ledger'>;
   cardFollowup?: CardFollowupJobs;
   skillExec?: SkillExecJobs;
@@ -1385,6 +1388,12 @@ export async function routeRequest(
     });
   }
 
+  // routeRequest is the live GET-only caller of buildGridData; keep it behind the owner auth gate.
+  if (pathname === '/v1/grid') {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    if (method !== 'GET') return jsonResponse({ error: 'method-not-allowed', method }, 405);
+    return jsonResponse(buildGridData(opts.grid));
+  }
   if (method === 'GET' && pathname === '/v1/outputs') {
     if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
     return handleOutputsGet(req, opts.outputs);
@@ -1457,6 +1466,15 @@ export async function routeRequest(
       const mutated = await handleGraphsMutation(pathname, req);
       if (mutated) return mutated;
     }
+    const cardClose = /^\/v1\/task-cards\/([^/]+)\/close$/.exec(pathname);
+    if (method === 'POST' && cardClose) {
+      if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+      if (bearerCredential(req, opts.metaApi) !== 'bearer-match') return jsonResponse({ error: 'forbidden' }, 403);
+      let id: string;
+      try { id = decodeURIComponent(cardClose[1]!); }
+      catch { return jsonResponse({ error: 'not_found' }, 404); }
+      return handleTaskCardsClosePost(req, id);
+    }
     if (method === 'POST' && pathname === '/v1/task-cards/wish') {
       if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
       return handleTaskCardsWishPost(req);

package/src/nexus/api/task-cards-api.ts

@@ -25,6 +25,25 @@ export async function handleTaskCardsWishPost(req: Request, root?: string): Prom
   }
 }
 
+export async function handleTaskCardsClosePost(req: Request, id: string, root?: string): Promise<Response> {
+  if (!/^[a-zA-Z0-9_-]+$/.test(id)) return jsonResponse({ error: 'not_found' }, 404);
+  let body: unknown;
+  try { body = await req.json(); }
+  catch { return jsonResponse({ error: 'bad_request' }, 400); }
+  if (!body || typeof body !== 'object' || Array.isArray(body)) return jsonResponse({ error: 'bad_request' }, 400);
+  const { reason } = body as Record<string, unknown>;
+  if (typeof reason !== 'string' || !reason.trim() || reason.trim().includes('\n') || reason.trim().includes('\r')) {
+    return jsonResponse({ error: 'bad_request' }, 400);
+  }
+  const store = new CardStore(root);
+  try {
+    if (!store.getCard(id)) return jsonResponse({ error: 'not_found' }, 404);
+    return jsonResponse({ card: store.closeCard(id, reason) });
+  } finally {
+    store.close();
+  }
+}
+
 export interface WishPlacement { cellId: string; cellTitle: string; version: string; status: 'green' | 'yellow' | 'red' | 'done' }
 
 export function isSplitCell(cell: unknown): cell is { id: string } {

package/src/oauth/codex.ts

@@ -24,9 +24,11 @@
 // the official CLI stays in sync.
 
 import { execFileSync } from 'node:child_process';
+import { chmodSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { resolveCodexAccount, effectiveCodexHome, type CodexAccountResolution } from './codex-account.js';
-import { resolveCodexAccountForRun } from './codex-account-store.js';
+import { DEFAULT_CODEX_ACCOUNT, codexStoreKey, isValidAccountName, resolveCodexAccount, effectiveCodexHome, type CodexAccountResolution } from './codex-account.js';
+import { importCodexAccountFromHome, resolveCodexAccountForRun } from './codex-account-store.js';
+import { decodeJWTPayload } from './jwt.js';
 import { authStorePath } from './store.js';
 import { platform, release, arch } from 'node:os';
 import {
@@ -533,3 +535,81 @@ export async function getCodexAccessToken(
   const state = await loadFreshCodexAuthState(opts);
   return state ? state.tokens : null;
 }
+
+// ── Named-account host refresh (POD-TOKEN-PREREFRESH · 10-06) ─────────
+//
+// 🩸 10-06 05:3x team · 09:47 third — Pod launches refused a codex account whose access token had
+// under 3 h left, and a human refreshed it by hand (refreshCodexTokens → atomic 0600 write → account
+// import). This is that path as one function: backup → refresh → atomic write → canonical store via
+// the same import path. ⛔ Token values never leave this function — the result carries hours only.
+
+export type CodexAccountRefreshResult =
+  | { ok: true; storeKey: string; codexHome: string; beforeH: number | null; afterH: number | null; backupPath: string }
+  | { ok: false; kind: 'bad-name' | 'default-refused' | 'unknown-account' | 'unreadable' | 'no-tokens' | 'refresh-failed' | 'write-failed' | 'import-failed'; message: string };
+
+/** Hours left on a JWT access token (one decimal) — null when the token carries no readable `exp`. */
+export function codexAccessHoursLeft(accessToken: unknown, now: number = Date.now()): number | null {
+  if (typeof accessToken !== 'string') return null;
+  const exp = decodeJWTPayload(accessToken)?.exp;
+  return typeof exp === 'number' ? Math.round(((exp * 1000 - now) / 3_600_000) * 10) / 10 : null;
+}
+
+export async function refreshCodexAccountHome(
+  name: string,
+  opts: {
+    /** ⛔ Test isolation seam — default is the canonical store. */
+    storePath?: string;
+    /** ⛔ Test seam — tests inject a fake refresher; never the network. */
+    refresh?: (refreshToken: string) => Promise<TokenResponse>;
+    now?: () => number;
+  } = {},
+): Promise<CodexAccountRefreshResult> {
+  // ⛔ The CEO's default account (~/.codex) is shared with the official CLI — refreshing it here
+  //   rotates the refresh token out from under that CLI. Named accounts only.
+  if (name === DEFAULT_CODEX_ACCOUNT) {
+    return { ok: false, kind: 'default-refused', message: `'${DEFAULT_CODEX_ACCOUNT}'(~/.codex) 는 대표 기본 계정이다 — 여기서 갱신하지 않는다` };
+  }
+  if (!isValidAccountName(name)) return { ok: false, kind: 'bad-name', message: `계정 이름이 부적격이다: ${name}` };
+  const storePath = opts.storePath ?? authStorePath();
+  const now = opts.now ?? Date.now;
+  const storeKey = codexStoreKey(name);
+  const codexHome = loadTokens(storeKey, storePath)?.codexHome;
+  if (!codexHome) return { ok: false, kind: 'unknown-account', message: `${storeKey} 계정이 없거나 codexHome 을 모른다 — 먼저 account import` };
+  const authPath = join(codexHome, 'auth.json');
+  let raw: string;
+  let parsed: { tokens?: Record<string, unknown> } & Record<string, unknown>;
+  try { raw = readFileSync(authPath, 'utf8'); parsed = JSON.parse(raw); }
+  catch (error) { return { ok: false, kind: 'unreadable', message: `${authPath} 를 못 읽었다 (${error instanceof Error ? error.name : 'error'})` }; }
+  const refreshToken = parsed.tokens?.refresh_token;
+  if (typeof refreshToken !== 'string' || !refreshToken) return { ok: false, kind: 'no-tokens', message: '그 홈에 refresh 토큰이 없다 — 그 홈으로 codex login' };
+  const beforeH = codexAccessHoursLeft(parsed.tokens?.access_token, now());
+  // Backup first — the server rotates the refresh token, so a failed write after refresh must leave something to recover from.
+  const backupPath = `${authPath}.bak-${new Date(now()).toISOString().replace(/[:.]/g, '-')}`;
+  try { writeFileSync(backupPath, raw, { mode: 0o600, flag: 'wx' }); }
+  catch (error) { return { ok: false, kind: 'write-failed', message: `백업을 못 썼다 (${error instanceof Error ? error.name : 'error'})` }; }
+  let fresh: TokenResponse;
+  try { fresh = await (opts.refresh ?? ((token) => refreshCodexTokens(token)))(refreshToken); }
+  catch (error) {
+    // refreshCodexTokens' message is `codex refresh failed: status=N` — no token. Anything else: a fixed line.
+    const message = error instanceof Error && /^codex refresh failed: status=\d+$/.test(error.message) ? error.message : 'codex refresh failed';
+    return { ok: false, kind: 'refresh-failed', message };
+  }
+  const next = {
+    ...parsed,
+    tokens: { ...parsed.tokens, access_token: fresh.access_token, refresh_token: fresh.refresh_token, ...(fresh.id_token ? { id_token: fresh.id_token } : {}) },
+    last_refresh: new Date(now()).toISOString(),
+  };
+  const tmp = `${authPath}.tmp-${process.pid}-${now()}`;
+  try {
+    writeFileSync(tmp, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(tmp, 0o600);
+    renameSync(tmp, authPath);
+  } catch (error) {
+    try { rmSync(tmp, { force: true }); } catch { /* best effort */ }
+    return { ok: false, kind: 'write-failed', message: `${authPath} 원자적 쓰기 실패 (${error instanceof Error ? error.name : 'error'}) — 백업: ${backupPath}` };
+  }
+  // ⭐ Canonical store through the same path as `account import` — not a second writer.
+  const imported = await importCodexAccountFromHome(name, codexHome, storePath);
+  if (!imported.ok) return { ok: false, kind: 'import-failed', message: imported.message };
+  return { ok: true, storeKey, codexHome, beforeH, afterH: codexAccessHoursLeft(fresh.access_token, now()), backupPath };
+}