elanous 0.2.18 → 0.2.20

package/src/dashboard/slash-runtime/model-choices.ts

@@ -0,0 +1,125 @@
+// TUI-SLASH-DECIDE-NOW C · 2026-10-07 — `/model` offered only code names (terra·sol·luna…), so a first
+// user had nothing to choose by (F14). Three human words now sit in front: 빠름·보통·깊음 resolve to
+// the CURRENT provider's budget·better·best tiers via `lookupLlmTierSpec` (no hard-coded model ids).
+// The seven code names keep going to the same model and provider as before.
+// A tier is «model ⊕ reasoning level» — on several ladders better and best share a model and differ only
+// in reasoning (codex gpt-6-sol medium/high · opus medium/medium), so a human word also carries the tier's
+// reasoning level; otherwise 보통 and 깊음 would be the same choice. Code names leave reasoning alone.
+import type { LLMProviderName, ReasoningLevel } from '../../user-config.js';
+import { lookupLlmTierSpec } from '../../model-tier/index.js';
+import type { ModelTier } from '../../model-tier/types.js';
+
+export interface ModelTarget {
+  readonly model: string;
+  readonly provider: LLMProviderName;
+}
+
+// 명시 target 맵(id + provider) — catalog/prefix 추론 대신 확정값. 핵심:
+// Codex 계열(gpt-5.5/5.6-sol/terra/luna)은 gpt- prefix 라 자동 추론은
+// 'openai'(Chat Completions)로 오분류하나, 실제론 Responses API 필수라
+// provider=openai-codex 여야 한다(omni-crawl 2026-07-17 확인). GPT(openai·
+// Chat Completions)는 노출하지 않는다(대표 지시 — 혼란 방지·codex만).
+// 비-OpenAI fallback 은 claude(anthropic)·grok.
+export const MODEL_TARGETS: Readonly<Record<string, ModelTarget>> = {
+  codex:  { model: 'gpt-5.5',        provider: 'openai-codex' },
+  // 🩸 2026-09-23 — GPT-6 에는 terra 가 없다(결정). 별칭은 남기되 codex 사다리 better 칸(sol 한 칸 아래 자리)을 가리킨다.
+  terra:  { model: lookupLlmTierSpec('openai-codex', 'better').model, provider: 'openai-codex' },
+  sol:    { model: lookupLlmTierSpec('openai-codex', 'best').model, provider: 'openai-codex' },
+  luna:   { model: lookupLlmTierSpec('openai-codex', 'budget').model, provider: 'openai-codex' },
+  opus:   { model: 'claude-opus-4-8',   provider: 'anthropic' },
+  sonnet: { model: 'claude-sonnet-5', provider: 'anthropic' },
+  // ⭐ 티어 표를 따른다(옆 luna 와 같은 형태) — 하드코딩이면 표를 바꿔도 «안 따라온다»(2026-08-18 대표 4.6 재편)
+  grok:   { model: lookupLlmTierSpec('grok', 'best').model, provider: 'grok' },
+};
+
+export const MODEL_CODE_NAMES: readonly string[] = Object.keys(MODEL_TARGETS);
+
+export interface HumanModelChoice {
+  readonly word: '빠름' | '보통' | '깊음';
+  readonly english: 'fast' | 'normal' | 'deep';
+  readonly tier: ModelTier;
+}
+
+export const HUMAN_MODEL_CHOICES: readonly HumanModelChoice[] = [
+  { word: '빠름', english: 'fast', tier: 'budget' },
+  { word: '보통', english: 'normal', tier: 'better' },
+  { word: '깊음', english: 'deep', tier: 'best' },
+];
+
+export const HUMAN_MODEL_WORDS: readonly string[] = HUMAN_MODEL_CHOICES.map(({ word }) => word);
+
+export type ModelChoiceResolution =
+  | { readonly kind: 'human'; readonly word: HumanModelChoice['word']; readonly tier: ModelTier; readonly target: ModelTarget; readonly reasoningLevel?: ReasoningLevel }
+  | { readonly kind: 'code'; readonly name: string; readonly target: ModelTarget }
+  /** A human word while the provider is `auto` — there is no single ladder to read. */
+  | { readonly kind: 'needs-provider'; readonly word: HumanModelChoice['word'] }
+  | { readonly kind: 'unknown'; readonly arg: string };
+
+/** Resolve a `/model` argument against the provider that is active right now. */
+export function resolveModelChoice(rawArg: string, currentProvider: LLMProviderName): ModelChoiceResolution {
+  const arg = rawArg.trim().toLowerCase();
+  const human = HUMAN_MODEL_CHOICES.find(({ word, english }) => arg === word || arg === english);
+  if (human) {
+    if (currentProvider === 'auto') return { kind: 'needs-provider', word: human.word };
+    const spec = lookupLlmTierSpec(currentProvider, human.tier);
+    return {
+      kind: 'human', word: human.word, tier: human.tier, target: { model: spec.model, provider: currentProvider },
+      ...(spec.reasoningLevel ? { reasoningLevel: spec.reasoningLevel } : {}),
+    };
+  }
+  const target = MODEL_TARGETS[arg];
+  if (target) return { kind: 'code', name: arg, target };
+  return { kind: 'unknown', arg };
+}
+
+/**
+ * The human word for (`model`, `reasoning`) on `provider`: an exact tier match first; without a reasoning
+ * level (or no exact match) only a model that names a single tier counts — an ambiguous model gets no word.
+ */
+export function humanWordForModel(
+  provider: LLMProviderName,
+  model: string | undefined | null,
+  reasoning?: ReasoningLevel,
+): HumanModelChoice['word'] | undefined {
+  if (!model || provider === 'auto') return undefined;
+  const sameModel = HUMAN_MODEL_CHOICES.filter(({ tier }) => lookupLlmTierSpec(provider, tier).model === model);
+  if (reasoning) {
+    const exact = sameModel.find(({ tier }) => {
+      const level = lookupLlmTierSpec(provider, tier).reasoningLevel;
+      return level === undefined || level === reasoning;
+    });
+    if (exact) return exact.word;
+  }
+  return sameModel.length === 1 ? sameModel[0]!.word : undefined;
+}
+
+function currentLabel(provider: LLMProviderName, model: string | undefined | null, reasoning?: ReasoningLevel): string {
+  return humanWordForModel(provider, model, reasoning) ?? (model?.trim() || '기본 모델');
+}
+
+/** `/model` with no argument: the current choice, then how to choose. The second line is muted by the caller. */
+export function modelOverviewLines(
+  provider: LLMProviderName,
+  model: string | undefined | null,
+  reasoning?: ReasoningLevel,
+): [string, string] {
+  const word = humanWordForModel(provider, model, reasoning);
+  const now = word ? `${word} (${model})` : (model?.trim() || '기본 모델');
+  return [
+    `지금: ${now} · 고르기: /model ${HUMAN_MODEL_WORDS.join(' | ')}`,
+    `  코드명도 됨: ${MODEL_CODE_NAMES.join(' · ')}  ·  provider ${provider}  ·  생각 깊이: /reasoning`,
+  ];
+}
+
+/** Confirmation after a switch: «보통 → 깊음 (<model>)». */
+export function modelChangeLine(
+  before: { provider: LLMProviderName; model: string | undefined | null; reasoning?: ReasoningLevel },
+  resolution: Extract<ModelChoiceResolution, { kind: 'human' | 'code' }>,
+): string {
+  const after = resolution.kind === 'human'
+    ? resolution.word
+    : humanWordForModel(resolution.target.provider, resolution.target.model) ?? resolution.name;
+  const reasoningNote = resolution.kind === 'human' && resolution.reasoningLevel ? ` · 생각 ${resolution.reasoningLevel}` : '';
+  const providerNote = resolution.target.provider === before.provider ? '' : `  · provider ${resolution.target.provider}`;
+  return `모델: ${currentLabel(before.provider, before.model, before.reasoning)} → ${after} (${resolution.target.model}${reasoningNote})${providerNote}`;
+}

package/src/domains/guardian-tick.ts

@@ -0,0 +1,138 @@
+import type { Database } from 'bun:sqlite';
+import { fileURLToPath } from 'node:url';
+import { debug } from '../debug/log.js';
+import { calendarFields, resolveTimeZone } from '../time/format.js';
+import { cronMatches } from './cron-match.js';
+import { listScheduleRuns } from './schedule-runs.js';
+import { listSchedules, openSchedulesDb, type ScheduleRow } from './schedule-registry.js';
+import type { SpawnOutcome } from './schedule-runner.js';
+
+export interface GuardianPlan {
+  jobs: readonly (Pick<ScheduleRow, 'id' | 'cron' | 'enabled' | 'source' | 'run_via'> & Partial<Pick<ScheduleRow, 'command'>>)[];
+  timeZone?: string;
+}
+
+export interface GuardianDeps {
+  config?: { guardian?: { mode?: 'shadow' | 'live' } };
+  /** Inject a cron-run-compatible executor in tests; shadow never calls it. */
+  execute?: (command: string) => Promise<SpawnOutcome>;
+}
+
+function shellQuote(value: string): string {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+
+function matchedJobs(plan: GuardianPlan): GuardianPlan['jobs'] {
+  return plan.jobs.filter(job => job.source === 'crontab' && job.run_via === 'crontab' && !!job.enabled && !!job.cron);
+}
+
+/** The wrapper prefix a live run may reuse as-is: `<bun> <…/>cron-run.ts --schedule-id <id> …` as the command's own
+ * first program (cron-run honours --schedule-id only as argv[0]). Fail-closed: any other mention of cron-run.ts —
+ * e.g. inside a `sh -c` body, behind `cd … &&`, or with shell control operators — is ambiguous and refused, so a run
+ * can never be attributed to the wrong (or no) schedule id. Unwrapped commands are wrapped with this job's id. */
+function liveCommand(jobId: string, raw: string): string {
+  if (!/cron-run\.ts/.test(raw)) {
+    return `${shellQuote(process.execPath)} ${shellQuote(fileURLToPath(new URL('../../scripts/cron-run.ts', import.meta.url)))} --schedule-id ${shellQuote(jobId)} --shell /bin/sh -c ${shellQuote(raw)}`;
+  }
+  // First program must be bun itself (bare `bun`, a path ending in /bun, or this process's executable).
+  const prefix = /^\s*(?:'(?:[^']*\/)?bun'|(?:[^\s'"]*\/)?bun)\s+(?:'[^']*\/)?(?:[^\s'"]*\/)?cron-run\.ts'?\s+--schedule-id\s+(?:'([^']*)'|([^\s'"]+))(?:\s|$)/.exec(raw);
+  const declaredId = prefix ? (prefix[1] ?? prefix[2]) : undefined;
+  const controls = /[;&|`\n]|\$\(/.test(raw);
+  if (declaredId !== jobId || controls || (raw.match(/cron-run\.ts/g) ?? []).length !== 1) {
+    throw new Error(`guardian live job ${jobId}: cron-run --schedule-id is ${declaredId ?? 'missing'}${controls ? ' (shell control operators)' : ''} — refusing misattributed run`);
+  }
+  return raw;
+}
+
+/** One five-minute guardian observation. No schedule state or crontab is mutated in shadow mode. */
+export async function guardianTick(now: Date, plan: GuardianPlan, deps: GuardianDeps = {}): Promise<{ mode: 'shadow' | 'live'; wouldRun: string[]; executed: number }> {
+  if (!Number.isFinite(now.getTime())) throw new RangeError('invalid tick time');
+  const mode = deps.config?.guardian?.mode === 'live' ? 'live' : 'shadow';
+  const timeZone = plan.timeZone ?? resolveTimeZone().timeZone;
+  const wouldRun: string[] = [];
+  let executed = 0;
+  for (const job of matchedJobs(plan)) {
+    if (!cronMatches(job.cron!, now, { timeZone })) continue;
+    wouldRun.push(job.id);
+    debug.log('guardian.tick', 'would-run', { job: job.id, cron: job.cron });
+    if (mode === 'live') {
+      if (!job.command) throw new Error(`guardian live job has no command: ${job.id}`);
+      const command = liveCommand(job.id, job.command);
+      const execute = deps.execute ?? (await import('./schedule-runner.js')).defaultSpawnJob;
+      const outcome = await execute(command);
+      executed++;
+      if (outcome.code !== 0) throw new Error(`guardian job ${job.id} exited ${outcome.code}`);
+    }
+  }
+  return { mode, wouldRun, executed };
+}
+
+export interface GuardianDayDeps {
+  db: Database;
+  plan: GuardianPlan;
+  /** Optional measured alert counts, keyed by stable schedule id. Absent means unmeasured, not zero. */
+  alertsActual?: (jobId: string, day: string) => number | null;
+}
+
+export interface GuardianComparison {
+  day: string;
+  timeZone: string;
+  jobs: Array<{ job: string; would: number; actual: number; alertsActual: number | null }>;
+  diff: Array<{ job: string; would: number; actual: number; alertsActual: number | null }>;
+  same: boolean;
+  /** Jobs whose measured alert count differs from would. Empty when alerts are unmeasured. */
+  alertDiff: Array<{ job: string; would: number; actual: number; alertsActual: number | null }>;
+}
+
+/** Count the 5-minute shadow ticks for a calendar day in the scheduler's time zone — using the CURRENT plan
+ * (today's cron/enabled), so a past day is judged against the present schedule, not the one in force that day —
+ * then compare actual fire history by stable id and instant (never by job name). */
+export function guardianShadowDay(day: string, deps?: GuardianDayDeps): GuardianComparison {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(day) || !Number.isFinite(Date.parse(`${day}T00:00:00Z`))
+    || new Date(`${day}T00:00:00Z`).toISOString().slice(0, 10) !== day) {
+    throw new RangeError('day must be a valid YYYY-MM-DD');
+  }
+  if (!deps) {
+    const db = openSchedulesDb();
+    try { return guardianShadowDay(day, { db, plan: { jobs: listSchedules(db) } }); }
+    finally { db.close(); }
+  }
+  const timeZone = deps.plan.timeZone ?? resolveTimeZone().timeZone;
+  const jobs = matchedJobs(deps.plan);
+  const counts = new Map(jobs.map(job => [job.id, 0]));
+  const date = Date.parse(`${day}T00:00:00Z`);
+  // Bracket every possible IANA civil-day offset, including daylight-saving transitions.
+  for (let ms = date - 14 * 3600_000; ms < date + 38 * 3600_000; ms += 5 * 60_000) {
+    const at = new Date(ms);
+    const fields = calendarFields(at, { timeZone });
+    if (`${fields.year}-${String(fields.month).padStart(2, '0')}-${String(fields.day).padStart(2, '0')}` !== day) continue;
+    for (const job of jobs) {
+      if (cronMatches(job.cron!, at, { timeZone })) counts.set(job.id, counts.get(job.id)! + 1);
+    }
+  }
+  const rows = jobs.map(job => {
+    // schedule_runs retains only the latest 500 fires per id: older days can be incomplete.
+    const runs = listScheduleRuns(deps.db, job.id, { limit: 500 });
+    const actual = runs.filter(run => {
+      const fields = calendarFields(new Date(run.fired_at), { timeZone });
+      return `${fields.year}-${String(fields.month).padStart(2, '0')}-${String(fields.day).padStart(2, '0')}` === day;
+    }).length;
+    if (runs.length === 500 && runs.length > 0) {
+      const oldest = calendarFields(new Date(runs[runs.length - 1]!.fired_at), { timeZone });
+      const oldestDay = `${oldest.year}-${String(oldest.month).padStart(2, '0')}-${String(oldest.day).padStart(2, '0')}`;
+      if (oldestDay >= day) throw new Error(`guardian comparison incomplete: schedule_runs history truncated for ${job.id} on ${day}`);
+    }
+    const alertsActual = deps.alertsActual?.(job.id, day) ?? null;
+    if (alertsActual !== null && (!Number.isSafeInteger(alertsActual) || alertsActual < 0)) {
+      throw new RangeError('alertsActual must be a non-negative integer or null');
+    }
+    return { job: job.id, would: counts.get(job.id)!, actual, alertsActual };
+  });
+  // `same` judges scheduled vs recorded fires only. Alert counts are a separate axis: unmeasured (null) by default,
+  // and a measured mismatch is reported in alertDiff without changing the fire verdict.
+  const diff = rows.filter(row => row.would !== row.actual);
+  const same = diff.length === 0;
+  const alertDiff = rows.filter(row => row.alertsActual !== null && row.would !== row.alertsActual);
+  debug.log('guardian.compare', 'day', { same, diff, alertDiff });
+  return { day, timeZone, jobs: rows, diff, same, alertDiff };
+}

package/src/domains/outbound-alert.ts

@@ -15,7 +15,7 @@ import { openSurfaceEventsDb, recordEvent } from './surface-events.js';
 import { latestUserIntentTs } from '../user-intent/index.js';
 import { getUserConfig, type UserConfig } from '../user-config.js';
 import { resolveChannelBotToken } from '../channel-bot-token.js';
-import { isOperationalKind, kindRouteTarget, logKindRouteFallback, mainHomeTarget } from './telegram-kind-route.js';
+import { explainReportRoute, isOperationalKind, kindRouteTarget, logKindRouteFallback, mainHomeTarget } from './telegram-kind-route.js';
 import { debug } from '../debug/log.js';
 import { registerLogStoreSink, setLogInstanceName } from '../mss/logging/log-store.js';
 import type { LogSink } from '../mss/logging/sink.js';
@@ -24,7 +24,8 @@ import { effectiveInstanceRoot, prodInstanceRoot } from '../instance/resolve.js'
 // ★ origin 되돌림(대표 2026-07-12) — 미션 알림을 발신 채널(메인 Q&A 봇)로 되돌린다. type-only
 //   import 라 런타임 순환 없음(발송 로직은 이 파일에 self-contained). origin 없으면 report 폴백.
 import type { MissionOrigin } from '../autopilot/mission-origin.js';
-import { conatusPath } from './conatus-data-dir.js';
+import { conatusDataDir, conatusPath } from './conatus-data-dir.js';
+import { assertNoRealSendFromTest, assertNotTestWritingOps, isTestDouble } from '../instance/test-write-guard.js';
 
 /** Explicit `ELANOUS_NEXUS_URL` wins. Otherwise ask the daemon endpoint resolver.
  *  A missing daemon is not a guessed port — the caller falls through to direct send. */
@@ -37,6 +38,8 @@ function nexusUrl(): string | null {
 // /v1/outbound 로 POST — getElanousConfigDir() 치환은 prod 동치(~/.elanous) + --config-dir 정합.
 const ACP_TOKEN_PATH = join(getElanousConfigDir(), 'acp-token');
 const DEFERRED_PATH = conatusPath('outbound_deferred.jsonl');
+// The real transport, captured before any test can spy on it — a pass-through spy is not a fake.
+const REAL_EXEC_FILE_SYNC = childProcess.execFileSync;
 
 // CLI/cron do not inherit the daemon's StoreSink. Register once before the first
 // send, but never attach a second sink to a daemon which already owns one.
@@ -139,6 +142,7 @@ export function userRecentlyActive(now: Date = new Date()): boolean {
 /** 야간 보류 적재 (jsonl append — 크론 동시 실행에 안전). origin 있으면 함께 적재 —
  *  아침 flush 가 그 origin(발신 채널)으로 되돌려 발송(없으면 report 묶음). */
 export function deferOutbound(text: string, kind: string, origin?: MissionOrigin | null, path = DEFERRED_PATH): boolean {
+  assertNotTestWritingOps(path, 'append the deferred-alert queue');
   try {
     mkdirSync(dirname(path), { recursive: true });
     const rec = { ts: new Date().toISOString(), kind, text, ...(origin ? { origin } : {}) };
@@ -171,9 +175,12 @@ function resolveBotToken(botId?: string): string | null {
 function deliverToOrigin(origin: MissionOrigin, text: string, onBot?: (bot: string) => void): boolean {
   if (origin.channel === 'discord') {
     if (!origin.channelId) return false;
+    let token: string | undefined;
+    try { token = resolveChannelBotToken('discord', getUserConfig())?.token; } catch { return false; }
+    if (!token) return false;
+    // Outside the swallowing try below: a refused test send must surface, not read as «delivery failed».
+    assertTestSendFaked('send a real Discord message');
     try {
-      const token = resolveChannelBotToken('discord', getUserConfig())?.token;
-      if (!token) return false;
       onBot?.('discord:configured');
       const channelId = origin.discordThreadId || origin.channelId;
       const out = spillLongContent(text).text;
@@ -184,6 +191,7 @@ function deliverToOrigin(origin: MissionOrigin, text: string, onBot?: (bot: stri
           `https://discord.com/api/v10/channels/${channelId}/messages`,
           JSON.stringify({ content: out.slice(start, end) }),
           [`Authorization: Bot ${token}`, 'Content-Type: application/json'],
+          'send a real Discord message',
         );
         if (typeof response?.id !== 'string' || !response.id) return false;
         start = end;
@@ -195,6 +203,7 @@ function deliverToOrigin(origin: MissionOrigin, text: string, onBot?: (bot: stri
   const token = resolveBotToken(origin.botId);
   if (!token) return false;
   onBot?.(botLabel(token));
+  assertTestSendFaked('send a real Telegram message to the origin');
   try { return sendTelegramRaw(token, origin.chatId, text, origin.threadId); } catch { return false; }
 }
 
@@ -287,6 +296,7 @@ export type FlushDeferredDeps = {
  *  ⭐ 실패한 묶음의 항목만 큐에 남긴다(성공 묶음은 다시 보내지 않는다 · 10-07 야간 11회 재발송 사고).
  *  실패가 `maxAttempts` 번 쌓인 항목은 `<name>.failed.jsonl` 로 격리한다. */
 export function flushDeferred(path = DEFERRED_PATH, deps: FlushDeferredDeps = {}): number {
+  assertNotTestWritingOps(path, 'flush the deferred-alert queue');
   ensureOutboundLogSink();
   const observeFlush = (
     count: number, lagMin: number, kinds: string[],
@@ -452,8 +462,18 @@ export function flushDeferred(path = DEFERRED_PATH, deps: FlushDeferredDeps = {}
   return delivered;
 }
 
-/** 동기 curl(POST). body 는 stdin. 파싱 실패/에러 → null. */
-function curlPost(url: string, body: string, headers: string[]): any {
+/** TEST-PROD-LEAK — a test process may not reach a real bot or the ops daemon. `external` = a third-party bot API
+ *  (refused unless curl is a test double replacing the real one); the local daemon is refused only when ops-routed. */
+function assertTestSendFaked(what: string, external = true): void {
+  let roots: string[] = [];
+  try { roots = [getElanousConfigDir(), dirname(ACP_TOKEN_PATH), effectiveInstanceRoot(), conatusDataDir(), dirname(DEFERRED_PATH)]; }
+  catch { roots = [dirname(ACP_TOKEN_PATH), dirname(DEFERRED_PATH)]; }
+  assertNoRealSendFromTest(what, { transportFaked: isTestDouble(childProcess.execFileSync, REAL_EXEC_FILE_SYNC), routingRoots: roots, external });
+}
+
+/** 동기 curl(POST). body 는 stdin. 파싱 실패/에러 → null. `what` names the send for the test guard (never the URL — it carries the token). */
+function curlPost(url: string, body: string, headers: string[], what = 'send a real outbound message', external = true): any {
+  assertTestSendFaked(what, external);
   const args = ['-s', '-m', '25', '-X', 'POST'];
   for (const h of headers) args.push('-H', h);
   args.push('--data', '@-', url);
@@ -560,6 +580,7 @@ export function setInProcessOutbound(send: InProcessOutbound | null): void { inP
 export function deliver(text: string, kind = 'alert', onBot?: (bot: string) => void, source?: string): 'daemon' | 'direct' | false {
   // 0) inside the daemon — route in-process, asynchronously; the caller's synchronous answer is «accepted».
   if (inProcessOutbound && process.env.SEND_VIA_ELANOUS !== '0') {
+    assertTestSendFaked('route through the in-process daemon sender', false);
     onBot?.('daemon:configured');
     const send = inProcessOutbound;
     const fallback = (): void => {
@@ -592,7 +613,9 @@ export function deliver(text: string, kind = 'alert', onBot?: (bot: string) => v
       ...(token ? [`Authorization: Bearer ${token}`] : [])];
     const nexus = nexusUrl();
     const j = nexus
-      ? curlPost(`${nexus}/v1/outbound`, JSON.stringify({ text, markdown: false, kind }), headers)
+      // An explicit ELANOUS_NEXUS_URL can name any daemon, the ops one included: a test treats it like a real bot API.
+      ? curlPost(`${nexus}/v1/outbound`, JSON.stringify({ text, markdown: false, kind }), headers, 'post to the daemon /v1/outbound',
+        Boolean(process.env.ELANOUS_NEXUS_URL?.trim()))
       : null;
     const classification = classifyDaemonResponse(j);
     if (classification === 'ok') { onBot?.('daemon:configured'); return 'daemon'; }
@@ -602,27 +625,33 @@ export function deliver(text: string, kind = 'alert', onBot?: (bot: string) => v
     logDaemonPath(classification, kind, extra);
   }
   // 2) fallback: 텔레그램 sendMessage 직접(3900자 분할) — 데몬 미경유라 클라가 원장 기록.
-  if (sendTelegramDirect(text, kind, {}, onBot)) return 'direct';
-  reportUndeliverable(kind, daemonPath);
+  //    The same config judges the route and explains a failure (review r1).
+  let cfg: UserConfig | undefined;
+  try { cfg = getUserConfig(); } catch { /* sendTelegramDirect fails closed without config */ }
+  if (sendTelegramDirect(text, kind, cfg ? { config: cfg } : {}, onBot)) return 'direct';
+  reportUndeliverable(kind, daemonPath, cfg);
   return false;
 }
 
 /** OB8b — both paths failed: say so loudly, with the universe this process resolved, instead of a silent false.
  *  The usual cause (10-01 · MK): an ad-hoc `bun -e` or a script from a source tree resolves a cwd-derived test
  *  universe, so it finds neither the production daemon nor the production bot token. */
-function reportUndeliverable(kind: string, daemonPath: DaemonPathClass | 'not-found' | 'disabled'): void {
+function reportUndeliverable(kind: string, daemonPath: DaemonPathClass | 'not-found' | 'disabled', cfg?: UserConfig): void {
   let root = '?';
   let universe: 'prod' | 'test' | '?' = '?';
   try {
     root = effectiveInstanceRoot();
     universe = root === prodInstanceRoot() ? 'prod' : 'test';
   } catch { /* the report still goes out */ }
+  // Which routing rule closed the direct path — «토큰 없음 또는 전송 실패» hid a missing role for four days (BRIEF-DELIVERY-1007).
+  let route: ReturnType<typeof explainReportRoute> | null = null;
+  try { if (cfg) route = explainReportRoute(cfg, kind); } catch { /* the report still goes out */ }
   ensureOutboundLogSink();
-  try { debug.log('outbound.send', 'undeliverable', { kind: safeObservationLabel(kind), daemonPath, universe, root }); } catch { /* fail-soft */ }
+  try { debug.log('outbound.send', 'undeliverable', { kind: safeObservationLabel(kind), daemonPath, universe, root, route: route?.reason ?? 'unknown' }); } catch { /* fail-soft */ }
   const hint = universe === 'prod'
     ? '운영 데몬이 떠 있는지 확인: elanous nexus show'
     : '운영으로 보내려면 설치본 elanous 로 실행하거나 ELANOUS_STATE_DIR=~/.elanous 와 --config-dir ~/.elanous 를 준다';
-  try { console.error(`[outbound] ⛔ 못 보냄(${kind}) — 데몬 ${daemonPath} · 직접 발송도 실패(토큰 없음 또는 전송 실패) · 이 프로세스의 우주 ${universe} (${root}) · ${hint}`); } catch { /* fail-soft */ }
+  try { console.error(`[outbound] ⛔ 못 보냄(${kind}) — 데몬 ${daemonPath} · 직접 발송도 실패(${route && route.reason !== 'routed' ? `${route.reason}: ${route.hint}` : '토큰 없음 또는 전송 실패'}) · 이 프로세스의 우주 ${universe} (${root}) · ${hint}`); } catch { /* fail-soft */ }
 }
 
 /** 텔레그램 raw 발송(토큰·chatId 명시) — spill + 3900자 분할(줄 경계). thread 지원. */
@@ -641,7 +670,7 @@ function sendTelegramRaw(token: string, chatId: string | number, text: string, t
   for (const ch of chunks) {
     const params: Record<string, string> = { chat_id: String(chatId), text: ch, disable_web_page_preview: 'true' };
     if (threadId !== undefined) params.message_thread_id = String(threadId);
-    if (!curlPost(url, new URLSearchParams(params).toString(), ['Content-Type: application/x-www-form-urlencoded'])) ok = false;
+    if (!curlPost(url, new URLSearchParams(params).toString(), ['Content-Type: application/x-www-form-urlencoded'], 'send a real Telegram message')) ok = false;
   }
   return ok;
 }
@@ -653,6 +682,8 @@ export function sendTelegramDirect(
   onBot?: (bot: string) => void,
 ): boolean {
   const sendRaw = deps.sendRaw ?? sendTelegramRaw;
+  // An injected sender still may not run in a test that resolved the ops universe.
+  if (deps.sendRaw) assertTestSendFaked('send a Telegram message from the ops universe', false);
   let cfg: UserConfig | undefined;
   try { cfg = deps.config ?? getUserConfig(); } catch { /* unavailable config: operational delivery still fails closed */ }
   if (cfg) {

package/src/domains/outbound-log-probe.ts

@@ -2,7 +2,12 @@ import { inQuietHours, kstMinutes, sendOutbound, setInProcessOutbound } from './
 import { setUserConfigOverlay } from '../user-config.js';
 
 // Focused subprocess fixture: isolated state/config roots and a fake curl on PATH.
-setUserConfigOverlay(cfg => ({ ...cfg, telegram: { ...cfg.telegram, botToken: '123456:private-secret', homeChannel: 98765 } }));
+// Hermetic: the shared `.elanous-test` config may carry a routing table another test left behind (a declared
+// `channels` table is authoritative and never falls back to the main home), so the fixture owns every routing key.
+setUserConfigOverlay(cfg => ({ ...cfg, telegram: {
+  ...cfg.telegram, channels: undefined, reportChannel: undefined, testChannel: undefined,
+  botToken: '123456:private-secret', homeChannel: 98765,
+} }));
 process.env.SEND_VIA_ELANOUS = '0';
 // Quiet hours (00:00~06:30 KST) defer instead of sending, so a gate run at night saw no `sent` row.
 // Shift this fixture's clock back to 23:59 KST of the previous day; the shift stays inside this process.

package/src/domains/schedule-registry.ts

@@ -18,6 +18,9 @@ import { dirname, join } from 'node:path';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { prevScheduledFire } from './cron-match.js';
 import { debug } from '../debug/log.js';
+import { listSources } from '../intake-plane/intake-sources.js';
+import { getUserConfig } from '../user-config.js';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { deriveScheduleName, ensureScheduleRunsSchema, recordScheduleRun } from './schedule-runs.js';
 
 /** 스케줄 레지스트리 DB 정본 경로 — state-dir 존중(lazy · Phase B). prod(ELANOUS_STATE_DIR
@@ -490,6 +493,9 @@ export interface InventoryInternalOpts {
   discoveryIntervalMs?: number;
   /** 테스트 seam — workflow-runtime schedule 트리거 주입(미지정 시 discoverWorkflows). */
   workflowSchedules?: Array<{ workflowName: string; nodeId: string; cron?: string | null; intervalMs?: number | null }>;
+  /** Test seams for the installed instance; production reads the active config and instance root. */
+  watchRoot?: string;
+  watchEnabled?: boolean;
 }
 
 /** 데몬 내부 스케줄을 레지스트리에 upsert(멱등·고정 id). 등록 수 반환. */
@@ -513,6 +519,23 @@ export function inventoryInternalSchedules(db: Database, opts: InventoryInternal
   // 회고(retro loop = retro-aggregate/report/rebalance)와는 별개.
   const hour = opts.reflectionHour ?? (Number.isFinite(Number.parseInt(process.env.ELANOUS_REFLECTION_HOUR ?? '', 10)) ? Number.parseInt(process.env.ELANOUS_REFLECTION_HOUR!, 10) : 21);
   upsert('internal:daily-reflection', 'daily-reflection', 'daily-reflection', `0 ${hour} * * *`, null, 'daemon: elanous 활동 회고(노트/OCR/세션) 스냅샷 푸시', 'report', 'elanous');
+  // WATCH-DEFAULT — fail-soft: a broken sources file or config must not stop the other internal rows.
+  let watchSources: ReturnType<typeof listSources> = [];
+  try {
+    const watchEnabled = opts.watchEnabled ?? (getUserConfig().watch?.enabled !== false);
+    watchSources = watchEnabled ? listSources({ seat: 'user' }, opts.watchRoot ?? effectiveInstanceRoot()) : [];
+  } catch (error) {
+    debug.log('watch.default', 'failed', { stage: 'inventory', reason: error instanceof Error ? error.message : String(error) });
+  }
+  if (watchSources.length > 0) {
+    upsert('internal:watch-collect', 'watch-collect', 'watch-default', '0 7 * * *', null,
+      'intake source run-due --seat user', 'ingest', 'elanous');
+    upsert('internal:watch-brief', 'watch-brief', 'watch-default', '30 8 * * *', null,
+      'intake digest --seat user --telegram', 'digest', 'elanous');
+    debug.log('watch.default', 'scheduled', { topics: watchSources.length, items: 0, sent: false });
+  } else {
+    db.run("DELETE FROM schedule_registry WHERE id IN ('internal:watch-collect', 'internal:watch-brief') AND source = 'watch-default'");
+  }
   // discovery (env 설정 시에만 가동) — 코어 인프라 → elanous.
   const dm = opts.discoveryIntervalMs ?? Number.parseInt(process.env.ELANOUS_DISCOVERY_CRON_INTERVAL_MS ?? '', 10);
   if (Number.isFinite(dm) && dm > 0) {

package/src/domains/telegram-kind-route.ts

@@ -75,3 +75,42 @@ export function kindRouteTarget(cfg: UserConfig, kind?: string): { botToken: str
   if (!ch || !Number.isFinite(ch.chatId)) return null;
   return { botToken: ch.botToken, chatId: ch.chatId };
 }
+
+export type ReportRouteReason =
+  | 'routed' | 'report-role-missing' | 'no-role-channel'
+  | 'no-report-channel' | 'report-bot-not-distinct' | 'report-chat-invalid' | 'no-main-home';
+
+/** Why a kind has (or lacks) a delivery target — no logging, no sending. Mirrors
+ *  `resolveReportTarget` so a skipped send can say *which* rule closed it instead of
+ *  «no report channel configured» (BRIEF-DELIVERY-1007: a channels table without a
+ *  `report` role closed the morning brief for four days while reportChannel was set). */
+export function explainReportRoute(cfg: UserConfig, kind?: string): { reason: ReportRouteReason; role: string; hint: string } {
+  const role = roleForKind(cfg, kind);
+  const trading = isTradingKind(kind);
+  if (cfg.telegram.channels?.length) {
+    if (kindRouteTarget(cfg, kind)) return { reason: 'routed', role, hint: '' };
+    const hasRole = resolveTelegramChannels(cfg.telegram).some(c => c.roles.includes(role));
+    if (trading && !hasRole && cfg.telegram.reportChannel) {
+      return {
+        reason: 'report-role-missing', role,
+        hint: `채널 표에 «${role}» 역할 칸이 없다 — telegram.reportChannel 은 채널 표가 있으면 쓰지 않는다. `
+          + `telegram.channels[].roles 에 "${role}" 를 더하거나 telegram.kindRoles.${kind ?? '<kind>'} 로 있는 역할을 고른다`,
+      };
+    }
+    return { reason: 'no-role-channel', role, hint: `채널 표에 «${role}» 역할을 가진 허용된 봇 칸이 없다 — telegram.channels 를 확인` };
+  }
+  if (!trading) {
+    return mainHomeTarget(cfg)
+      ? { reason: 'routed', role, hint: '' }
+      : { reason: 'no-main-home', role, hint: '운영 봇 또는 telegram.homeChannel·allowedUsers 가 없다' };
+  }
+  const rc = cfg.telegram.reportChannel;
+  if (!rc) return { reason: 'no-report-channel', role, hint: 'telegram.reportChannel 이 없다' };
+  const mainToken = resolveChannelBotToken('telegram', cfg).token;
+  if (!rc.botToken || rc.botToken === mainToken) {
+    return { reason: 'report-bot-not-distinct', role, hint: 'telegram.reportChannel 의 봇이 없거나 운영 봇과 같다 — 매매 보고는 별도 봇만 쓴다' };
+  }
+  return Number.isFinite(rc.chatId)
+    ? { reason: 'routed', role, hint: '' }
+    : { reason: 'report-chat-invalid', role, hint: 'telegram.reportChannel.chatId 가 숫자가 아니다' };
+}

package/src/domains/watch-default-scheduler.ts

@@ -0,0 +1,95 @@
+import { debug } from '../debug/log.js';
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { getUserConfig } from '../user-config.js';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { listSources, runDue } from '../intake-plane/intake-sources.js';
+import { runIntakeDigestCli } from '../cli/intake-cli.js';
+import { resolveTimeZone } from '../time/format.js';
+import { inventoryInternalSchedules, openSchedulesDb } from './schedule-registry.js';
+import type { Database } from 'bun:sqlite';
+
+export interface WatchDefaultSchedulerOpts {
+  root?: string;
+  enabled?: () => boolean;
+  now?: () => Date;
+  timeZone?: string;
+  collect?: () => Promise<unknown>;
+  brief?: () => Promise<unknown>;
+  setInterval?: (tick: () => void, ms: number) => ReturnType<typeof setInterval>;
+  openDb?: () => Database;
+}
+
+/** Daemon-owned watch jobs: the inventory rows describe these two actual timers. */
+export function startWatchDefaultScheduler(opts: WatchDefaultSchedulerOpts = {}): { stop(): void; tickNow(): Promise<void> } {
+  const root = opts.root ?? effectiveInstanceRoot();
+  const enabled = opts.enabled ?? (() => getUserConfig().watch?.enabled !== false);
+  const timeZone = opts.timeZone ?? resolveTimeZone().timeZone;
+  const now = opts.now ?? (() => new Date());
+  const collect = opts.collect ?? (() => runDue({ seat: 'user', deps: { stateDir: root } }));
+  // The CLI sets process.exitCode on an unsent report; inside the daemon that would leak into the daemon's own exit status.
+  const brief = opts.brief ?? (async () => {
+    const before = process.exitCode;
+    try { return await runIntakeDigestCli({ seat: 'user', telegram: true }, { root }); }
+    finally { process.exitCode = before; }
+  });
+  const lastRunFile = join(root, 'intake', 'watch-default-last-run.json');
+  const lastRun = new Map<string, string>();
+  let lastInventory: string | undefined;
+  let lastFailure: string | undefined;
+  try {
+    if (existsSync(lastRunFile)) {
+      const saved = JSON.parse(readFileSync(lastRunFile, 'utf8')) as Record<string, string>;
+      for (const [job, day] of Object.entries(saved)) if (typeof day === 'string') lastRun.set(job, day);
+    }
+  } catch (error) { debug.log('watch.default', 'failed', { reason: `last-run: ${String(error)}` }); }
+  let running = false;
+  let stopped = false;
+  const tickNow = async (): Promise<void> => {
+    if (stopped || running) return;
+    running = true;
+    try {
+      const active = enabled() && listSources({ seat: 'user' }, root).length > 0;
+      const registryDay = now().toISOString().slice(0, 10);
+      const inventoryKey = `${registryDay}:${active}`;
+      if (lastInventory !== inventoryKey) {
+        // The registry row is a view; a registry failure must not skip the real collect/brief of this minute.
+        try {
+          const db = (opts.openDb ?? openSchedulesDb)();
+          try { inventoryInternalSchedules(db, { watchRoot: root, watchEnabled: active }); lastInventory = inventoryKey; }
+          finally { if (!opts.openDb) db.close(); }
+        } catch (error) { debug.log('watch.default', 'failed', { stage: 'registry', reason: String(error) }); }
+      }
+      lastFailure = undefined;
+      if (!active) return;
+      const parts = new Intl.DateTimeFormat('en-CA', {
+        timeZone, year: 'numeric', month: '2-digit', day: '2-digit', hour: '2-digit', minute: '2-digit', hourCycle: 'h23',
+      }).formatToParts(now());
+      const part = (type: string) => parts.find((entry) => entry.type === type)?.value ?? '';
+      const day = `${part('year')}-${part('month')}-${part('day')}`;
+      const clock = `${part('hour')}:${part('minute')}`;
+      for (const [job, at, fire] of [['watch-collect', '07:00', collect], ['watch-brief', '08:30', brief]] as const) {
+        if (clock !== at || lastRun.get(job) === day) continue;
+        try {
+          const outcome = await fire();
+          if (job === 'watch-brief' && (!outcome || (outcome as { sent?: boolean }).sent !== true)) continue;
+          if (job === 'watch-collect' && typeof outcome === 'object' && outcome && 'ran' in outcome
+            && (outcome as { ran: Array<{ error?: string }> }).ran.some((row) => row.error)) continue;
+          lastRun.set(job, day);
+          mkdirSync(join(root, 'intake'), { recursive: true });
+          const temp = `${lastRunFile}.${process.pid}.tmp`;
+          writeFileSync(temp, JSON.stringify(Object.fromEntries(lastRun)) + '\n');
+          renameSync(temp, lastRunFile);
+        } catch (error) { debug.log('watch.default', 'failed', { job, reason: String(error) }); }
+      }
+    } catch (error) {
+      const reason = String(error);
+      if (reason !== lastFailure) debug.log('watch.default', 'failed', { reason });
+      lastFailure = reason;
+    } finally { running = false; }
+  };
+  const timer = (opts.setInterval ?? setInterval)(() => { void tickNow(); }, 60_000);
+  if (typeof timer === 'object') timer.unref?.();
+  void tickNow();
+  return { stop() { stopped = true; clearInterval(timer); }, tickNow };
+}