elanous 0.2.22 → 0.2.24

package/src/mss/logging/log-store.ts

@@ -17,7 +17,8 @@
 //     severity 는 SCHEME(이벤트 접미사) → `level` 컬럼으로 물질화.
 
 import { Database } from 'bun:sqlite';
-import { mkdirSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmdirSync, rmSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
 import { elanousStateRoot } from '../../autopilot/state-paths.js';
 import { dirname, join } from 'node:path';
 
@@ -81,9 +82,13 @@ export interface LogStoreRetention {
   maxAgeDays: number;
   /** DB 상한(MB). 초과 시 오래된 행부터 삭제. 0 이하 = 크기 정리 안 함. 기본 500. */
   maxDbMb: number;
+  /** 🩸 LOGS-RETENTION-WINDOW-1(10-10): size-cap floor in hours — the size pass never deletes rows newer than
+   *  this; when rows outside the floor are not enough it stops and logs `retention-floor-held`.
+   *  0 = legacy behaviour (oldest-first with no floor). Missing = 24. Age pass (`maxAgeDays`) is unaffected. */
+  minRetainHours?: number;
 }
 
-export const LOG_RETENTION_DEFAULTS: LogStoreRetention = { maxAgeDays: 7, maxDbMb: 500 };
+export const LOG_RETENTION_DEFAULTS: LogStoreRetention = { maxAgeDays: 7, maxDbMb: 500, minRetainHours: 24 };
 
 /** 스토어 OOM 백스톱 — 정책 상한이 아니다. 정책은 각 경계(HTTP·툴)가 갖는다. */
 export const STORE_SAFETY_MAX = 100_000;
@@ -96,13 +101,27 @@ export const STORE_SAFETY_MAX = 100_000;
 export const LOG_STORE_READONLY_BUSY_TIMEOUT_MS = 2_000;
 const LOG_STORE_WRITE_BUSY_TIMEOUT_MS = 5_000;
 const LOG_STORE_OPEN_RETRY_DELAYS_MS = [100, 200, 400, 800, 1600] as const;
+const LOG_STORE_BUSY_RETRY_MAX_ATTEMPTS = 3;
+const LOG_STORE_BUSY_RETRY_BUFFER_MAX_ROWS = 2_000;
+type LogStoreInsertRow = { rec: LogRecord; surface: string };
+type LogStoreRetryBatch = { rows: LogStoreInsertRow[]; attempts: number; preserveRows: boolean };
 const sqliteOpenWait = new Int32Array(new SharedArrayBuffer(4));
 let pendingBusyOpenLosses: Array<{ path: string; loss: { store: 'logs'; op: 'open'; waitedMs: number } }> = [];
-
 function sqliteBusy(error: unknown): boolean {
   return /SQLITE_BUSY|SQLITE_LOCKED|database is locked|database is busy/i.test(String(error));
 }
 
+function emitInsertBusyLost(data: Record<string, unknown>): void {
+  try { process.stderr.write(`[store.sqlite] busy-lost ${JSON.stringify(data)}\n`); } catch { /* diagnostics must not block callers */ }
+  try { debug.log('store.sqlite', 'busy-lost', data); } catch { /* diagnostics must not block callers */ }
+}
+
+function topCategories(rows: readonly LogStoreInsertRow[]): string[] {
+  const counts = new Map<string, number>();
+  for (const { rec } of rows) counts.set(rec.category, (counts.get(rec.category) ?? 0) + 1);
+  return [...counts].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).slice(0, 3).map(([category]) => category);
+}
+
 export class LogCursorNotFoundError extends Error {
   constructor(public readonly beforeId: number) {
     super(`page cursor row ${beforeId} not found in this store`);
@@ -191,6 +210,7 @@ export class LogStore {
   readonly instance: string;
   /** read-only open (LF7-b 연합 조회) — 스키마 생성/마이그레이션/insert 불가. */
   readonly readonly: boolean;
+  private busyRetryBuffer: LogStoreRetryBatch[] = [];
 
   /** 타 인스턴스 스토어의 연합 조회용 read-only open — "연합은 read-only 로만"
    *  불변식의 구조적 집행(마이그레이션 포함 어떤 write 도 발생 불가). */
@@ -291,10 +311,12 @@ export class LogStore {
     })();
   }
 
-  /** 배치 insert(단일 트랜잭션). 실패는 throw — fail-soft 는 호출측(StoreSink)
-   *  책임(ops-log 의 recordOpsEvent/Safe 분업 동형). */
+  /** 배치 insert(단일 트랜잭션). SQLITE_BUSY 는 bounded in-memory buffer 후 throw — fail-soft 는 호출측(StoreSink) 책임. */
   insertBatch(rows: Array<{ rec: LogRecord; surface: string }>, opts: { preserveRows?: boolean } = {}): void {
     if (rows.length === 0) return;
+    const retrying = this.busyRetryBuffer;
+    const current: LogStoreRetryBatch = { rows, attempts: 0, preserveRows: opts.preserveRows === true };
+    const batches = [...retrying, current];
     const stmt = this.db.prepare(
       `INSERT INTO logs (ts, ts_ms, level, instance, host_id, surface, category, event, session_id, trace_id, data)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
@@ -302,8 +324,8 @@ export class LogStore {
     const decisionRow = this.db.prepare(`SELECT id FROM logs WHERE instance = ? AND category = 'loop.steward' AND event = 'decision'
       AND json_valid(data) AND json_extract(data, '$.runId') = ? ORDER BY id DESC LIMIT 1`);
     const updateDecision = this.db.prepare(`UPDATE logs SET ts = ?, ts_ms = ?, level = ?, surface = ?, data = ? WHERE id = ?`);
-    const insertAll = this.db.transaction((batch: Array<{ rec: LogRecord; surface: string }>) => {
-      for (const { rec, surface } of batch) {
+    const insertAll = this.db.transaction((batch: Array<{ row: LogStoreInsertRow; preserveRows: boolean }>) => {
+      for (const { row: { rec, surface }, preserveRows } of batch) {
         const tsMs = Date.parse(rec.ts);
         const timestamp = Number.isFinite(tsMs) ? tsMs : Date.now();
         const level = deriveLogLevel(rec);
@@ -311,7 +333,7 @@ export class LogStore {
         const runId = rec.category === 'loop.steward' && rec.event === 'decision' &&
           rec.data && typeof rec.data === 'object' && !Array.isArray(rec.data)
           ? (rec.data as Record<string, unknown>).runId : undefined;
-        const existing = !opts.preserveRows && typeof runId === 'string' && runId
+        const existing = !preserveRows && typeof runId === 'string' && runId
           ? decisionRow.get(this.instance, runId) as { id: number } | undefined : undefined;
         if (existing) {
           updateDecision.run(rec.ts, timestamp, level, surface, data, existing.id);
@@ -335,14 +357,43 @@ export class LogStore {
         );
       }
     });
+    const allRows = batches.flatMap((batch) => batch.rows.map((row) => ({ row, preserveRows: batch.preserveRows })));
     const startedAt = Date.now();
     try {
-      insertAll(rows);
+      insertAll(allRows);
+      this.busyRetryBuffer = [];
+      for (const batch of retrying) {
+        try { debug.log('store.sqlite', 'busy-recovered', { rows: batch.rows.length, attempts: batch.attempts + 1 }); }
+        catch { /* diagnostics must not affect writes */ }
+      }
     } catch (error) {
-      if (sqliteBusy(error)) {
-        const loss = { store: 'logs', op: 'insertBatch', waitedMs: Date.now() - startedAt };
-        try { process.stderr.write(`[store.sqlite] busy-lost ${JSON.stringify(loss)}\n`); } catch { /* diagnostics must not block callers */ }
-        debug.log('store.sqlite', 'busy-lost', loss);
+      if (!sqliteBusy(error)) throw error;
+      emitInsertBusyLost({
+        store: 'logs', op: 'insertBatch', waitedMs: Date.now() - startedAt,
+        rows: allRows.length, categories: topCategories(allRows.map(({ row }) => row)),
+      });
+      const retained: LogStoreRetryBatch[] = [];
+      for (const batch of batches) {
+        const attempts = batch.attempts + 1;
+        if (attempts >= LOG_STORE_BUSY_RETRY_MAX_ATTEMPTS) {
+          emitInsertBusyLost({ store: 'logs', op: 'insertBatch', reason: 'retry-exhausted', droppedRows: batch.rows.length });
+        } else {
+          retained.push({ ...batch, attempts });
+        }
+      }
+      let bufferedRows = retained.reduce((count, batch) => count + batch.rows.length, 0);
+      let droppedRows = 0;
+      while (bufferedRows > LOG_STORE_BUSY_RETRY_BUFFER_MAX_ROWS && retained.length > 0) {
+        const oldest = retained[0]!;
+        const drop = Math.min(bufferedRows - LOG_STORE_BUSY_RETRY_BUFFER_MAX_ROWS, oldest.rows.length);
+        oldest.rows.splice(0, drop);
+        bufferedRows -= drop;
+        droppedRows += drop;
+        if (oldest.rows.length === 0) retained.shift();
+      }
+      this.busyRetryBuffer = retained;
+      if (droppedRows > 0) {
+        emitInsertBusyLost({ store: 'logs', op: 'insertBatch', reason: 'retry-buffer-full', droppedRows });
       }
       throw error;
     }
@@ -360,22 +411,65 @@ export class LogStore {
     }
     if (policy.maxDbMb > 0) {
       const pageCount = (this.db.query('PRAGMA page_count').get() as { page_count: number }).page_count;
+      const freePages = (this.db.query('PRAGMA freelist_count').get() as { freelist_count: number }).freelist_count;
       const pageSize = (this.db.query('PRAGMA page_size').get() as { page_size: number }).page_size;
-      const sizeMb = (pageCount * pageSize) / (1024 * 1024);
+      // 🩸 OBS-RET-RATCHET(2026-10-09): 빈 페이지까지 세면 VACUUM 없는 파일은 안 줄어든다 → 뜰 때마다 오래된 행 ≈5% 를
+      //   또 지우는 래칫이 됐다(운영 logs.db 528MB · 01:08Z 이전 행 소실). 상한은 «쓰는 페이지»로 잰다.
+      const sizeMb = ((pageCount - freePages) * pageSize) / (1024 * 1024);
       if (sizeMb > policy.maxDbMb) {
         // 초과분 비율만큼 오래된 행 삭제(대략 — 정밀 계산보다 반복 수렴 선호).
         const total = (this.db.query('SELECT COUNT(*) AS c FROM logs').get() as { c: number }).c;
         const dropCount = Math.max(1, Math.floor(total * Math.min(0.5, 1 - policy.maxDbMb / sizeMb)));
-        const r = this.db.run(
-          'DELETE FROM logs WHERE id IN (SELECT id FROM logs ORDER BY ts_ms ASC LIMIT ?)',
-          [dropCount],
-        );
-        deletedBySize = Number(r.changes ?? 0);
+        // 🩸 LOGS-RETENTION-WINDOW-1(10-10): prod write volume made this pass keep only ≈2h of rows, so evidence
+        //   for incidents a few hours old read as «0 rows». Rows inside the floor are never size-deleted.
+        const floorHours = policy.minRetainHours ?? LOG_RETENTION_DEFAULTS.minRetainHours ?? 0;
+        if (floorHours > 0) {
+          const floorCutoff = Date.now() - floorHours * 3_600_000;
+          // Byte-weighted split (payload text + fixed per-row overhead) — row counts alone misjudge mixed row sizes.
+          const split = this.db.query(
+            `SELECT COALESCE(SUM(CASE WHEN ts_ms < ? THEN w ELSE 0 END), 0) AS outsideBytes, COALESCE(SUM(w), 0) AS allBytes
+               FROM (SELECT ts_ms, 64 + LENGTH(ts) + LENGTH(category) + LENGTH(event) + COALESCE(LENGTH(data), 0) AS w FROM logs)`,
+          ).get(floorCutoff) as { outsideBytes: number; allBytes: number };
+          const r = this.db.run(
+            'DELETE FROM logs WHERE id IN (SELECT id FROM logs WHERE ts_ms < ? ORDER BY ts_ms ASC LIMIT ?)',
+            [floorCutoff, dropCount],
+          );
+          deletedBySize = Number(r.changes ?? 0);
+          // dropCount is capped at 50% per run; judge the floor against the full overshoot (by bytes) so a cap the
+          // floor can never reach is reported even when this run's capped batch was fully served from outside rows.
+          const neededShare = 1 - policy.maxDbMb / sizeMb;
+          const outsideShare = split.allBytes > 0 ? split.outsideBytes / split.allBytes : 0;
+          if (outsideShare < neededShare) {
+            debug.log('mss.logging', 'retention-floor-held', {
+              totalMb: Math.round(sizeMb * 10) / 10, maxTotalMb: policy.maxDbMb, floorHours,
+              neededShare: Math.round(neededShare * 1000) / 1000, outsideShare: Math.round(outsideShare * 1000) / 1000,
+              deletedRows: deletedBySize,
+            });
+          }
+        } else {
+          const r = this.db.run(
+            'DELETE FROM logs WHERE id IN (SELECT id FROM logs ORDER BY ts_ms ASC LIMIT ?)',
+            [dropCount],
+          );
+          deletedBySize = Number(r.changes ?? 0);
+        }
       }
     }
+    if (deletedByAge > 0 || deletedBySize > 0) {
+      const oldest = (this.db.query('SELECT MIN(ts_ms) AS t FROM logs').get() as { t: number | null }).t;
+      debug.log('log-store.retention', 'deleted', { deletedByAge, deletedBySize, oldestTs: oldest === null ? null : new Date(oldest).toISOString() });
+    }
     return { deletedByAge, deletedBySize };
   }
 
+  /** Reclaim a bounded number of free pages after retention; legacy databases with auto_vacuum=NONE remain unchanged. */
+  reclaimFreePages(): void {
+    const mode = (this.db.query('PRAGMA auto_vacuum').get() as { auto_vacuum: number }).auto_vacuum;
+    if (mode !== 2) return;
+    const free = (this.db.query('PRAGMA freelist_count').get() as { freelist_count: number }).freelist_count;
+    if (free > 0) this.db.run(`PRAGMA incremental_vacuum(${Math.min(free, 128)})`);
+  }
+
   /**
    * ⛔⭐⭐⭐ **이 스토어에 «실제로 뜬» 카테고리와 그 수**(2026-08-19 · `OBS-T122`).
    *
@@ -658,6 +752,12 @@ export class LogStore {
     return (this.db.query('SELECT COUNT(*) AS c FROM logs').get() as { c: number }).c;
   }
 
+  /** Earliest retained event timestamp, regardless of insertion order. No schema or row writes. */
+  horizon(): { status: 'present'; oldestTsMs: number } | { status: 'empty' } {
+    const { oldestTsMs } = this.db.query('SELECT MIN(ts_ms) AS oldestTsMs FROM logs').get() as { oldestTsMs: number | null };
+    return oldestTsMs === null ? { status: 'empty' } : { status: 'present', oldestTsMs };
+  }
+
   close(): void {
     try { this.db.close(); } catch { /* noop */ }
   }
@@ -781,6 +881,7 @@ export class StoreSink implements LogSink {
     const batch = this.buf;
     this.buf = [];
     try {
+      // insertBatch retries SQLITE_BUSY batches on the next write; this sink remains fail-soft on final failure.
       this.store.insertBatch(batch);
     } catch {
       /* fail-soft — 파일 트레일이 진실원. 배치는 버린다(재시도 루프 금지 —
@@ -850,28 +951,163 @@ export class StoreSink implements LogSink {
   }
 }
 
+const RETENTION_INTERVAL_MS = 6 * 3600 * 1000;
+type RetentionLockOwner = { token: string; pid: number; start: string | null };
+
+/** PID reuse must not let a new process inherit a dead process's ownership. */
+function processStart(pid: number): string | null {
+  try {
+    const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
+    return stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19] ?? null;
+  } catch { return null; }
+}
+
+function ownerDead(owner: RetentionLockOwner): boolean {
+  if (!Number.isSafeInteger(owner.pid) || owner.pid <= 0) return false;
+  try {
+    process.kill(owner.pid, 0);
+    const currentStart = processStart(owner.pid);
+    if (owner.start !== null && currentStart !== null && owner.start !== currentStart) return true;
+    // A zombie still answers kill(pid, 0), but can no longer run retention.
+    try {
+      const stat = readFileSync(`/proc/${owner.pid}/stat`, 'utf8');
+      return stat.slice(stat.lastIndexOf(')') + 2).startsWith('Z ');
+    } catch { return false; }
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === 'ESRCH';
+  }
+}
+
+/** Only the guard row can authorize removal. A pre-publication temp file belongs to its row's token. */
+function removeRetentionLockDirectory(lockPath: string, token: string, interrupted: boolean): void {
+  if (!existsSync(lockPath)) return;
+  const marker = join(lockPath, 'owner');
+  const temporaryName = `owner.${token}.tmp`;
+  if (readdirSync(lockPath).some((name) => name !== 'owner' && name !== temporaryName)) {
+    throw new Error('retention lock has unknown entries');
+  }
+  if (existsSync(marker)) {
+    const published = readFileSync(marker, 'utf8');
+    if (published !== token && !(interrupted && token.startsWith(published))) {
+      throw new Error('retention lock owner changed');
+    }
+    rmSync(marker);
+  }
+  rmSync(join(lockPath, temporaryName), { force: true });
+  rmdirSync(lockPath);
+}
+
+/** The SQLite guard serializes stale-lock recovery and ownership changes, including process death mid-acquisition. */
+function acquireRetentionLock(lockPath: string): (() => void) | null {
+  const guard = new Database(`${lockPath}.db`);
+  const token = randomUUID();
+  let handedOff = false;
+  try {
+    guard.run('PRAGMA busy_timeout = 100');
+    guard.run('CREATE TABLE IF NOT EXISTS owner (slot INTEGER PRIMARY KEY CHECK(slot = 1), token TEXT NOT NULL, pid INTEGER NOT NULL, start TEXT)');
+    let acquired = false;
+    guard.run('BEGIN IMMEDIATE');
+    try {
+      const previous = guard.query('SELECT token, pid, start FROM owner WHERE slot = 1').get() as RetentionLockOwner | null;
+      if (previous && !ownerDead(previous)) return null;
+      if (existsSync(lockPath)) {
+        // A pre-guard lock has no provable owner: never remove it.
+        if (!previous) return null;
+        try { removeRetentionLockDirectory(lockPath, previous.token, true); }
+        catch { return null; }
+      }
+      guard.run('INSERT OR REPLACE INTO owner (slot, token, pid, start) VALUES (1, ?, ?, ?)', [token, process.pid, processStart(process.pid)]);
+      guard.run('COMMIT');
+      acquired = true;
+    } finally {
+      if (!acquired) guard.run('ROLLBACK');
+    }
+    // The ownership row is committed before mkdir: a crash in this gap is recoverable too.
+    try {
+      mkdirSync(lockPath);
+      const temporary = join(lockPath, `owner.${token}.tmp`);
+      writeFileSync(temporary, token, { flag: 'wx' });
+      renameSync(temporary, join(lockPath, 'owner'));
+    } catch (error) {
+      guard.run('BEGIN IMMEDIATE');
+      try {
+        // Keep the ownership row if cleanup fails: the next process can then
+        // prove who left the directory behind and recover it after this PID dies.
+        removeRetentionLockDirectory(lockPath, token, true);
+        guard.run('DELETE FROM owner WHERE slot = 1 AND token = ?', [token]);
+        guard.run('COMMIT');
+      } catch { guard.run('ROLLBACK'); }
+      throw error;
+    }
+    handedOff = true;
+    return () => {
+      try {
+        guard.run('BEGIN IMMEDIATE');
+        try {
+          const current = guard.query('SELECT token FROM owner WHERE slot = 1').get() as { token: string } | null;
+          if (current?.token === token) {
+            removeRetentionLockDirectory(lockPath, token, false);
+            guard.run('DELETE FROM owner WHERE slot = 1 AND token = ?', [token]);
+          }
+          guard.run('COMMIT');
+        } catch (error) { guard.run('ROLLBACK'); throw error; }
+      } finally { guard.close(); }
+    };
+  } finally { if (!handedOff) guard.close(); }
+}
+
+/** A shared stamp prevents short-lived non-owner processes from repeatedly pruning the same DB. */
+function runStampedRetention(store: LogStore, retention: LogStoreRetention, owner: boolean): void {
+  const stampPath = `${store.path}.retention.stamp`;
+  const lockPath = `${store.path}.retention.lock`;
+  const isFresh = (): boolean => {
+    try {
+      const age = Date.now() - Number(readFileSync(stampPath, 'utf8'));
+      return age >= 0 && age < RETENTION_INTERVAL_MS;
+    } catch { return false; }
+  };
+  if (!owner && isFresh()) return;
+  const release = acquireRetentionLock(lockPath);
+  if (!release) return;
+  try {
+    if (!owner && isFresh()) return;
+    store.enforceRetention(retention);
+    try { store.reclaimFreePages(); }
+    catch (error) { debug.log('log-store.retention', 'reclaim-failed', { reason: error instanceof Error ? error.message : String(error) }); }
+    const temporary = `${stampPath}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+      writeFileSync(temporary, String(Date.now()));
+      renameSync(temporary, stampPath);
+    } finally { rmSync(temporary, { force: true }); }
+  } finally { release(); }
+}
+
 /** 부팅 1줄 등록 헬퍼 — 데몬/TUI/러너가 자기 surface 를 선언하고 스토어
  *  싱크를 단다. retention 은 호출측이 config 에서 읽어 전달(user-config
- *  순환 의존 회피). 반환 = unregister(테스트용) 또는 null(store 불가). */
+ *  순환 의존 회피). 반환 = unregister(테스트용) 또는 null(store 불가).
+ *  nexus owns the periodic job unless the caller explicitly opts in. */
 export function registerLogStoreSink(
   registerSink: (sink: LogSink) => () => void,
   surface: string,
   retention: LogStoreRetention = LOG_RETENTION_DEFAULTS,
+  opts: { retentionOwner?: boolean } = {},
 ): (() => void) | null {
   const store = getDefaultLogStore();
   if (!store) return null;
   const sink = new StoreSink(store, surface, { installExitHandlers: true });
   const off = registerSink(sink);
   try { nestDepth.observeNestAtBoot(); } catch { /* fail-soft — 관측 실패가 싱크 등록을 막지 않는다. */ }
-  // 보존정책 — 부팅 직후 1회(디퍼) + 6시간 주기. 실패는 조용히.
+  const owner = opts.retentionOwner ?? surface === 'nexus';
   const runRetention = (): void => {
-    try { store.enforceRetention(retention); } catch { /* fail-soft */ }
+    try { runStampedRetention(store, retention, owner); }
+    catch (error) { debug.log('log-store.retention', 'failed', { reason: error instanceof Error ? error.message : String(error) }); }
   };
-  setImmediate(runRetention);
-  const h = setInterval(runRetention, 6 * 3600 * 1000);
-  (h as unknown as { unref?: () => void }).unref?.();
+  const startup = setImmediate(runRetention);
+  const h = owner ? setInterval(runRetention, RETENTION_INTERVAL_MS) : null;
+  (h as unknown as { unref?: () => void } | null)?.unref?.();
   return () => {
-    clearInterval(h);
+    clearImmediate(startup);
+    if (h) clearInterval(h);
     sink.close();
     off();
   };

package/src/native-tool-catalog.ts

@@ -9,7 +9,7 @@ import type { VerifierSpec } from './verifier/types.js';
 import type { GuardianSpec } from './guardian/types.js';
 import { ptyAvailable } from './pty-shell/registry.js';
 import { krFlowAvailable } from './skills/tools/kr-flow.js';
-import { SELF_COGNITION_MCP_CATALOG_ENTRIES } from './tool-runtime/self-cognition-runtimes.js';
+import { SELF_COGNITION_MCP_CATALOG_ENTRIES } from './tool-runtime/self-cognition-catalog.js';
 import { SKILLS_LIST_DESCRIPTION } from './onboarding/entry-hints.js';
 
 export type { NativeToolHost } from './tool-surface.js';

package/src/nexus/api/consult-requests.ts

@@ -2,7 +2,7 @@ import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, re
 import { randomUUID } from 'node:crypto';
 import { dirname, join } from 'node:path';
 import { debug } from '../../debug/log.js';
-import { routeOutbound } from '../outbound/router.js';
+import { sendTelegramReport } from '../../telegram-report.js';
 import { getUserConfig } from '../../user-config.js';
 import { effectiveInstanceRoot } from '../../instance/resolve.js';
 import { jsonResponse } from './json-response.js';
@@ -23,7 +23,7 @@ interface ConsultRequest {
 export interface ConsultRequestsDeps {
   root?: () => string;
   now?: () => string;
-  /** Owner alert. Default = the daemon's own in-process router (the same one `/v1/outbound` uses).
+  /** Owner alert. Default = the daemon's in-process Telegram sender (operations role only).
    *  ⛔ Never `sendOutbound` here: it is a synchronous curl to this very daemon's `/v1/outbound`, so inside the
    *  daemon it blocks the event loop until it times out (~25 s · `unreachable`) and the alert is lost (CS1 · 10-01). */
   send?: (text: string, kind: string) => unknown;
@@ -88,9 +88,9 @@ export async function handleConsultRequests(req: Request, deps: ConsultRequestsD
   if (!body || typeof body !== 'object' || Array.isArray(body)) return rejected('body');
   const input = body as Record<string, unknown>;
   for (const field of ['name', 'contact'] as const) {
-    if (typeof input[field] !== 'string' || !input[field].trim()) return rejected(field);
+    if (typeof input[field] !== 'string' || !input[field].trim() || input[field].length > (field === 'name' ? 256 : 512)) return rejected(field);
   }
-  if (input.org !== undefined && (typeof input.org !== 'string' || !input.org.trim())) return rejected('org');
+  if (input.org !== undefined && (typeof input.org !== 'string' || !input.org.trim() || input.org.length > 256)) return rejected('org');
   if (input.kind !== 'company' && input.kind !== 'personal') return rejected('kind');
   if (input.interest !== 'A' && input.interest !== 'B') return rejected('interest');
   if (input.consent !== true) return rejected('consent');
@@ -114,15 +114,12 @@ export async function handleConsultRequests(req: Request, deps: ConsultRequestsD
   const alert = `📮 상담 문의 ${entry.receiptId} · ${entry.name}(${entry.kind === 'personal' ? '개인' : (entry.org ?? '회사')}) · 관심 ${entry.interest}\n앱에서 보기`;
   // Fire and forget — the receipt is already on disk; the answer must not wait for the channel.
   void Promise.resolve()
-    .then(() => (deps.send ?? notifyInProcess)(alert, 'alert'))
+    .then(() => (deps.send ?? notifyInProcess)(alert, 'ops-alert'))
     .catch((error: unknown) => { debug.log('consult.request', 'notify-failed', { receiptId: entry.receiptId, reason: error instanceof Error ? error.message : String(error) }); });
   return jsonResponse({ receiptId: entry.receiptId, receivedAt: entry.receivedAt }, 202);
 }
 
 async function notifyInProcess(text: string, kind: string): Promise<void> {
-  const result = await routeOutbound(getUserConfig(), { text, markdown: false, kind });
-  debug.log('consult.request', result.delivered ? 'notified' : 'notify-failed', {
-    delivered: result.delivered,
-    channels: result.channels.map((channel) => `${channel.type}:${channel.ok ? 'ok' : 'fail'}`),
-  });
+  const delivered = await sendTelegramReport(getUserConfig(), text, { markdown: false, kind });
+  debug.log('consult.request', delivered ? 'notified' : 'notify-failed', { delivered, channels: [`telegram:${delivered ? 'ok' : 'fail'}`] });
 }

package/src/nexus/api/discord-trigger-bot.ts

@@ -36,6 +36,7 @@ import { parseDiscordEndpoint, isOwnInstanceEndpoint } from '../../session/sessi
 import { createDiscordStreamSink } from '../../session/streaming/discord-stream-sink.js';
 import { splitForDiscord } from '../../discord.js';
 import { formatForDiscord } from '../../discord-markdown.js';
+import { receiveChannelEvent } from '../outbound/router.js';
 
 export interface NexusDiscordTriggerBotOpts {
   /** Bot token (without `Bot ` prefix). Production reads
@@ -109,11 +110,13 @@ export function createDiscordTriggerLogger(
  *  (`src/discord.ts:160-172` comment) so the wire is a near-identity
  *  with `raw` carrying the full gateway payload for debugging. */
 export function toDiscordEvent(tap: DcTriggerEvent): DiscordEvent {
+  const envelope = receiveChannelEvent('discord', tap);
+  if (!envelope || envelope instanceof Promise) throw new Error('discord connector cannot normalize accepted tap');
   return {
     kind: tap.kind,
-    channel: tap.channel,
-    user: tap.user,
-    body: tap.body,
+    channel: envelope.channel ?? tap.channel,
+    user: envelope.senderId ?? tap.user,
+    body: envelope.text,
     raw: tap,
   };
 }

package/src/nexus/api/error-reports.ts

@@ -25,19 +25,21 @@ function storeDir(root: string): string { return join(root, 'error-reports'); }
 /** Removes day folders older than the keep window. Returns how many days were removed. */
 export function pruneErrorReports(root: string, now: number): number {
   const base = storeDir(root);
-  if (!existsSync(base)) return 0;
   let removed = 0;
-  for (const year of readdirSync(base).filter((n) => /^\d{4}$/.test(n))) {
-    for (const month of readdirSync(join(base, year)).filter((n) => /^\d{2}$/.test(n))) {
-      for (const day of readdirSync(join(base, year, month)).filter((n) => /^\d{2}$/.test(n))) {
-        const at = Date.parse(`${year}-${month}-${day}T00:00:00Z`);
-        if (Number.isFinite(at) && now - at > ERROR_REPORT_KEEP_DAYS * DAY_MS + DAY_MS) {
-          rmSync(join(base, year, month, day), { recursive: true, force: true });
-          removed++;
+  if (existsSync(base)) {
+    for (const year of readdirSync(base).filter((n) => /^\d{4}$/.test(n))) {
+      for (const month of readdirSync(join(base, year)).filter((n) => /^\d{2}$/.test(n))) {
+        for (const day of readdirSync(join(base, year, month)).filter((n) => /^\d{2}$/.test(n))) {
+          const at = Date.parse(`${year}-${month}-${day}T00:00:00Z`);
+          if (Number.isFinite(at) && now - at > ERROR_REPORT_KEEP_DAYS * DAY_MS + DAY_MS) {
+            rmSync(join(base, year, month, day), { recursive: true, force: true });
+            removed++;
+          }
         }
       }
     }
   }
+  debug.log('error-report.prune', 'done', { pruned: removed });
   return removed;
 }
 
@@ -77,6 +79,26 @@ function count24h(root: string, dedupe: string, now: number): number {
   return n;
 }
 
+/** Retention without a receipt: prune once at daemon boot and then once a day (the ingest path still prunes too). */
+export function startErrorReportPruneTick(deps: {
+  root?: () => string;
+  now?: () => number;
+  schedule?: (tick: () => void, ms: number) => { unref?: () => void };
+} = {}): { stop(): void } {
+  const root = deps.root ?? effectiveInstanceRoot;
+  const now = deps.now ?? Date.now;
+  const run = (trigger: 'boot' | 'tick') => {
+    // pruneErrorReports emits error-report.prune/done { pruned }; only a failure is logged here.
+    try { pruneErrorReports(root(), now()); }
+    catch (error) { debug.log('error-report.prune', 'failed', { trigger, reason: error instanceof Error ? error.message : String(error) }); }
+  };
+  run('boot');
+  let stopped = false;
+  const handle = (deps.schedule ?? ((tick, ms) => setInterval(tick, ms)))(() => { if (!stopped) run('tick'); }, DAY_MS);
+  handle.unref?.();
+  return { stop: () => { stopped = true; if (!deps.schedule) clearInterval(handle as ReturnType<typeof setInterval>); } };
+}
+
 /** POST /v1/reports/ingest — the caller (router) has already checked the ingest token. */
 export async function handleErrorReportIngest(req: Request, deps: ErrorReportIngestDeps = {}): Promise<Response> {
   const root = (deps.root ?? effectiveInstanceRoot)();

package/src/nexus/api/http-server.ts

@@ -170,6 +170,7 @@ import { handleBuildsGet, parseBuildsPath } from './builds-api.js';
 import { handleHarnessAskPost, handleHarnessAskStatusGet, handleHarnessRunEventsGet, handleHarnessRunScreenGet, handleHarnessRunsGet, handleHarnessStopPost } from './harness-api.js';
 import { handleHarnessRunTraversalGet } from './harness-traversal.js';
 import { handleLoopEdgesGet } from './loop-edges.js';
+import { handleLoopResourcesGet } from './loop-resources.js';
 import { handleFabricPlans, type FabricPlansRouteOpts } from './fabric-plans.js';
 import { dispatchPersonaRoute } from './personas.js';
 import { handleMe, operatorSignal } from './operator.js';
@@ -498,6 +499,8 @@ export interface NexusHttpServerOpts {
   outputs?: OutputsDeps;
   /** Read-only grid measurement seam; omitted in production for live HQ and Pod pool reads. */
   grid?: GridDeps;
+  /** Resource observation seam; production reads the same ORCH traffic decision. */
+  loopResources?: Parameters<typeof handleLoopResourcesGet>[0];
   /** DRAFT-METRIC cached source seam; omitted in production for the process-wide TTL cache. */
   draftMetrics?: DraftMetricsSource;
   decisions?: Pick<DecisionsRouteDeps, 'ledger'>;
@@ -1396,6 +1399,11 @@ export async function routeRequest(
 
   // Same owner auth as the neighbouring GETs (short-lived owner tokens · same-origin PWA); #23932 compared the admin
   // bearer only, so a PWA on a short-lived token got 401 and the loop map stayed empty.
+  if (pathname === '/v1/loops/resources' && method === 'GET') {
+    if (!opts.metaApi) return jsonResponse({ error: 'meta-api-runtime-not-wired' }, 503);
+    if (!checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return handleLoopResourcesGet(opts.loopResources);
+  }
   if (pathname === '/v1/loops/edges' && method === 'GET') {
     if (!opts.metaApi) return jsonResponse({ error: 'meta-api-runtime-not-wired' }, 503);
     if (!checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);

package/src/nexus/api/loop-resources.ts

@@ -0,0 +1,42 @@
+import { defaultListHarnessProcesses } from '../../harness/harness-cli-command.js';
+import { devVersion, listChecklist } from '../../release-loop/checklist.js';
+import { listSchedules } from '../../release-loop/release-schedule.js';
+import { releaseLedgerRoot } from '../../instance/resolve.js';
+import { getUserConfig, ORCHESTRATOR_DEFAULTS } from '../../user-config.js';
+import { seatOfTree, trafficTick, TRAFFIC_SEATS, type TrafficCell, type TrafficResult } from '../../loops/orchestrator/traffic.js';
+import { finishAdvice, measureFinish } from '../../loops/orchestrator/finish-rate.js';
+import { jsonResponse } from './json-response.js';
+
+/** Read-only snapshot of the same ORCH traffic decision used by the scheduled tick. */
+export function observeLoopResources(deps: {
+  now?: Date;
+  processes?: ReturnType<typeof defaultListHarnessProcesses>;
+  version?: string;
+  openCells?: readonly TrafficCell[];
+  nextRound?: readonly TrafficCell[];
+  totalSlots?: number;
+} = {}): TrafficResult {
+  const now = deps.now ?? new Date();
+  const cfg = getUserConfig().loops?.orchestrator ?? ORCHESTRATOR_DEFAULTS;
+  const observation = deps.processes ?? defaultListHarnessProcesses();
+  if (observation.status !== 'ok') throw new Error(`process observation ${observation.status}`);
+  const version = deps.version ?? devVersion().replace(/-dev\.\d+$/, '');
+  const upcoming = deps.nextRound === undefined ? listSchedules(releaseLedgerRoot()).filter(row => Date.parse(row.cutAt) > now.getTime())
+    .sort((a, b) => Date.parse(a.cutAt) - Date.parse(b.cutAt)) : [];
+  const currentIndex = upcoming.findIndex(row => row.version === version);
+  const nextVersion = currentIndex < 0 ? upcoming[0]?.version : upcoming[currentIndex + 1]?.version;
+  const totalSlots = deps.totalSlots ?? finishAdvice(measureFinish({}, now),
+    TRAFFIC_SEATS.reduce((sum, seat) => sum + cfg.seatCaps[seat], 0)).launchSlots;
+  return trafficTick({
+    processes: observation.records.map(process => ({ ...process, seat: seatOfTree(process.cwdStatus === 'unknown' ? undefined : process.cwd, cfg) })),
+    now, caps: cfg.seatCaps, openCells: deps.openCells ?? listChecklist(version).items, totalSlots,
+    ...(deps.nextRound !== undefined ? { nextRound: deps.nextRound }
+      : nextVersion ? { nextRound: listChecklist(nextVersion).items } : {}),
+    retainQueuedCells: true,
+  });
+}
+
+export function handleLoopResourcesGet(observe: () => TrafficResult = observeLoopResources): Response {
+  try { return jsonResponse({ resource: observe() }); }
+  catch { return jsonResponse({ error: 'resource-unavailable' }, 503); }
+}