elanous 0.2.23 → 0.2.24

package/src/models/prompts.ts

@@ -63,7 +63,8 @@ export function getModelFamily(modelId: string | undefined): ModelFamily {
   // OpenRouter gateway ids only (`openrouter/<vendor>/<model>`). Bare vendor ids such as
   // `qwen/qwen3-coder-30b` stay 'other' on purpose: LM Studio publishes native ids in that
   // same shape (see getModelTier's local pattern), and this family must not reach local runs.
-  if (m.startsWith('openrouter/') && (m.includes('glm') || m.includes('kimi') || m.includes('qwen'))) {
+  // OR-DEEPSEEK-TUNE (2026-10-11) — `openrouter/deepseek/*` 도 같은 군(종전 'other' → 도구 규율 null).
+  if (m.startsWith('openrouter/') && (m.includes('glm') || m.includes('kimi') || m.includes('qwen') || m.startsWith('openrouter/deepseek/'))) {
     return 'open-weight';
   }
   return 'other';

package/src/mss/logging/log-store.ts

@@ -101,13 +101,27 @@ export const STORE_SAFETY_MAX = 100_000;
 export const LOG_STORE_READONLY_BUSY_TIMEOUT_MS = 2_000;
 const LOG_STORE_WRITE_BUSY_TIMEOUT_MS = 5_000;
 const LOG_STORE_OPEN_RETRY_DELAYS_MS = [100, 200, 400, 800, 1600] as const;
+const LOG_STORE_BUSY_RETRY_MAX_ATTEMPTS = 3;
+const LOG_STORE_BUSY_RETRY_BUFFER_MAX_ROWS = 2_000;
+type LogStoreInsertRow = { rec: LogRecord; surface: string };
+type LogStoreRetryBatch = { rows: LogStoreInsertRow[]; attempts: number; preserveRows: boolean };
 const sqliteOpenWait = new Int32Array(new SharedArrayBuffer(4));
 let pendingBusyOpenLosses: Array<{ path: string; loss: { store: 'logs'; op: 'open'; waitedMs: number } }> = [];
-
 function sqliteBusy(error: unknown): boolean {
   return /SQLITE_BUSY|SQLITE_LOCKED|database is locked|database is busy/i.test(String(error));
 }
 
+function emitInsertBusyLost(data: Record<string, unknown>): void {
+  try { process.stderr.write(`[store.sqlite] busy-lost ${JSON.stringify(data)}\n`); } catch { /* diagnostics must not block callers */ }
+  try { debug.log('store.sqlite', 'busy-lost', data); } catch { /* diagnostics must not block callers */ }
+}
+
+function topCategories(rows: readonly LogStoreInsertRow[]): string[] {
+  const counts = new Map<string, number>();
+  for (const { rec } of rows) counts.set(rec.category, (counts.get(rec.category) ?? 0) + 1);
+  return [...counts].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).slice(0, 3).map(([category]) => category);
+}
+
 export class LogCursorNotFoundError extends Error {
   constructor(public readonly beforeId: number) {
     super(`page cursor row ${beforeId} not found in this store`);
@@ -196,6 +210,7 @@ export class LogStore {
   readonly instance: string;
   /** read-only open (LF7-b 연합 조회) — 스키마 생성/마이그레이션/insert 불가. */
   readonly readonly: boolean;
+  private busyRetryBuffer: LogStoreRetryBatch[] = [];
 
   /** 타 인스턴스 스토어의 연합 조회용 read-only open — "연합은 read-only 로만"
    *  불변식의 구조적 집행(마이그레이션 포함 어떤 write 도 발생 불가). */
@@ -296,10 +311,12 @@ export class LogStore {
     })();
   }
 
-  /** 배치 insert(단일 트랜잭션). 실패는 throw — fail-soft 는 호출측(StoreSink)
-   *  책임(ops-log 의 recordOpsEvent/Safe 분업 동형). */
+  /** 배치 insert(단일 트랜잭션). SQLITE_BUSY 는 bounded in-memory buffer 후 throw — fail-soft 는 호출측(StoreSink) 책임. */
   insertBatch(rows: Array<{ rec: LogRecord; surface: string }>, opts: { preserveRows?: boolean } = {}): void {
     if (rows.length === 0) return;
+    const retrying = this.busyRetryBuffer;
+    const current: LogStoreRetryBatch = { rows, attempts: 0, preserveRows: opts.preserveRows === true };
+    const batches = [...retrying, current];
     const stmt = this.db.prepare(
       `INSERT INTO logs (ts, ts_ms, level, instance, host_id, surface, category, event, session_id, trace_id, data)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
@@ -307,8 +324,8 @@ export class LogStore {
     const decisionRow = this.db.prepare(`SELECT id FROM logs WHERE instance = ? AND category = 'loop.steward' AND event = 'decision'
       AND json_valid(data) AND json_extract(data, '$.runId') = ? ORDER BY id DESC LIMIT 1`);
     const updateDecision = this.db.prepare(`UPDATE logs SET ts = ?, ts_ms = ?, level = ?, surface = ?, data = ? WHERE id = ?`);
-    const insertAll = this.db.transaction((batch: Array<{ rec: LogRecord; surface: string }>) => {
-      for (const { rec, surface } of batch) {
+    const insertAll = this.db.transaction((batch: Array<{ row: LogStoreInsertRow; preserveRows: boolean }>) => {
+      for (const { row: { rec, surface }, preserveRows } of batch) {
         const tsMs = Date.parse(rec.ts);
         const timestamp = Number.isFinite(tsMs) ? tsMs : Date.now();
         const level = deriveLogLevel(rec);
@@ -316,7 +333,7 @@ export class LogStore {
         const runId = rec.category === 'loop.steward' && rec.event === 'decision' &&
           rec.data && typeof rec.data === 'object' && !Array.isArray(rec.data)
           ? (rec.data as Record<string, unknown>).runId : undefined;
-        const existing = !opts.preserveRows && typeof runId === 'string' && runId
+        const existing = !preserveRows && typeof runId === 'string' && runId
           ? decisionRow.get(this.instance, runId) as { id: number } | undefined : undefined;
         if (existing) {
           updateDecision.run(rec.ts, timestamp, level, surface, data, existing.id);
@@ -340,14 +357,43 @@ export class LogStore {
         );
       }
     });
+    const allRows = batches.flatMap((batch) => batch.rows.map((row) => ({ row, preserveRows: batch.preserveRows })));
     const startedAt = Date.now();
     try {
-      insertAll(rows);
+      insertAll(allRows);
+      this.busyRetryBuffer = [];
+      for (const batch of retrying) {
+        try { debug.log('store.sqlite', 'busy-recovered', { rows: batch.rows.length, attempts: batch.attempts + 1 }); }
+        catch { /* diagnostics must not affect writes */ }
+      }
     } catch (error) {
-      if (sqliteBusy(error)) {
-        const loss = { store: 'logs', op: 'insertBatch', waitedMs: Date.now() - startedAt };
-        try { process.stderr.write(`[store.sqlite] busy-lost ${JSON.stringify(loss)}\n`); } catch { /* diagnostics must not block callers */ }
-        debug.log('store.sqlite', 'busy-lost', loss);
+      if (!sqliteBusy(error)) throw error;
+      emitInsertBusyLost({
+        store: 'logs', op: 'insertBatch', waitedMs: Date.now() - startedAt,
+        rows: allRows.length, categories: topCategories(allRows.map(({ row }) => row)),
+      });
+      const retained: LogStoreRetryBatch[] = [];
+      for (const batch of batches) {
+        const attempts = batch.attempts + 1;
+        if (attempts >= LOG_STORE_BUSY_RETRY_MAX_ATTEMPTS) {
+          emitInsertBusyLost({ store: 'logs', op: 'insertBatch', reason: 'retry-exhausted', droppedRows: batch.rows.length });
+        } else {
+          retained.push({ ...batch, attempts });
+        }
+      }
+      let bufferedRows = retained.reduce((count, batch) => count + batch.rows.length, 0);
+      let droppedRows = 0;
+      while (bufferedRows > LOG_STORE_BUSY_RETRY_BUFFER_MAX_ROWS && retained.length > 0) {
+        const oldest = retained[0]!;
+        const drop = Math.min(bufferedRows - LOG_STORE_BUSY_RETRY_BUFFER_MAX_ROWS, oldest.rows.length);
+        oldest.rows.splice(0, drop);
+        bufferedRows -= drop;
+        droppedRows += drop;
+        if (oldest.rows.length === 0) retained.shift();
+      }
+      this.busyRetryBuffer = retained;
+      if (droppedRows > 0) {
+        emitInsertBusyLost({ store: 'logs', op: 'insertBatch', reason: 'retry-buffer-full', droppedRows });
       }
       throw error;
     }
@@ -835,6 +881,7 @@ export class StoreSink implements LogSink {
     const batch = this.buf;
     this.buf = [];
     try {
+      // insertBatch retries SQLITE_BUSY batches on the next write; this sink remains fail-soft on final failure.
       this.store.insertBatch(batch);
     } catch {
       /* fail-soft — 파일 트레일이 진실원. 배치는 버린다(재시도 루프 금지 —

package/src/nexus/api/missions.ts

@@ -35,6 +35,18 @@ import {
   type MissionStatus,
 } from '../../task-orchestrator/mission.js';
 import type { Task } from '../../task-orchestrator/types.js';
+import {
+  openSchedulesDb,
+  listSchedules,
+  scheduleHealth,
+} from '../../domains/schedule-registry.js';
+import {
+  cronRowsToDerived,
+  rollupDerived,
+  taskStatusToDerived,
+  type DerivedJob,
+  type MissionRollup,
+} from '../../autopilot/mission-trace.js';
 
 import { checkAuth, type MetaApiOpts } from './meta-api.js';
 import { jsonResponse } from './http-server.js';
@@ -68,12 +80,63 @@ export interface MissionCardWire {
    *  Mission. 자율 Mission 이면 실행모델·apm 상태·계보 키를 담아 통합 Missions
    *  표면이 autopilot 여부와 lineage 를 한눈에 렌더한다. */
   autopilot: MissionAutopilot | null;
+  /** 파생 작업 롤업(태스크 + 크론). ⛔ **결손 수리(MISSIONS-STALE-MARK · 2026-10-11)**:
+   *  이 칸이 없어 PWA 미션 카드의 `RollupChips` 는 항상 `undefined` 를 받아
+   *  «아무것도» 안 그렸다 — 그래서 «파생 0»과 «파생 미측정»을 화면이 «구분 못 했다».
+   *  카드는 목록 엔드포인트만 보므로(미션별 `traceAutopilotMission` 을 안 부름)
+   *  여기서 «이미 로드한 태스크» ⊕ «요청당 한 번 읽은 schedule_registry」로
+   *  계산한다. 자율행동(surface_events)·자식 미션은 상세 트레이스
+   *  (`ops_status action=mission`)의 몫으로 남는다(목록에서 N× 무거운 조인 금지).
+   *  매핑은 `rollupDerived`·`taskStatusToDerived`·`cronRowsToDerived` — «단일 소유»라
+   *  트레이스와 갈림이 없다. `total: 0` = «파생이 정말 0». */
+  derived: MissionRollup;
   createdAt: number;
   updatedAt: number;
   closedAt: number | null;
 }
 
-export function summarise(mission: Mission, tasks: readonly Task[]): MissionCardWire {
+/** 태스크 행 → 파생물(순수). 트레이스의 `fetchTaskDerived` 와 같은 상태 매핑
+ *  (`taskStatusToDerived`)을 쓴다 — «두 가지 상태 어휘»를 만들지 않는다. */
+export function taskRowsToDerived(tasks: readonly Task[]): DerivedJob[] {
+  return tasks.map((t) => ({
+    kind: 'task',
+    id: t.id,
+    name: t.title,
+    status: taskStatusToDerived(t.status),
+  }));
+}
+
+/** 요청당 «한 번» schedule_registry 를 읽어 apmId 별 크론 파생물을 나눠 담는다.
+ *  ⛔ 미션별로 DB 를 열면 목록 N건 = N× 열기 — 그래서 한 번 읽고 in-process 분배.
+ *  fail-soft: 레지스트리가 없으면 빈 Map(derived 는 태스크만 집계). */
+export function loadCronDerivedByMission(): Map<string, DerivedJob[]> {
+  const out = new Map<string, DerivedJob[]>();
+  try {
+    const db = openSchedulesDb();
+    try {
+      const rows = listSchedules(db);
+      const staleIds = new Set(scheduleHealth(rows).stale.map((s) => s.id));
+      const rowsByMission = new Map<string, typeof rows>();
+      for (const row of rows) {
+        const apmId = row.autopilot_id;
+        if (!apmId) continue;
+        const bucket = rowsByMission.get(apmId);
+        if (bucket) bucket.push(row);
+        else rowsByMission.set(apmId, [row]);
+      }
+      for (const [apmId, missionRows] of rowsByMission) {
+        out.set(apmId, cronRowsToDerived(missionRows, staleIds));
+      }
+    } finally { db.close(); }
+  } catch { /* fail-soft */ }
+  return out;
+}
+
+export function summarise(
+  mission: Mission,
+  tasks: readonly Task[],
+  crons: readonly DerivedJob[] = [],
+): MissionCardWire {
   const taskStatusCounts: Record<string, number> = {};
   const surfaceKindCounts: Record<string, number> = {};
   for (const t of tasks) {
@@ -92,6 +155,7 @@ export function summarise(mission: Mission, tasks: readonly Task[]): MissionCard
     taskStatusCounts,
     surfaceKindCounts,
     autopilot: mission.autopilot ?? null,
+    derived: rollupDerived([...taskRowsToDerived(tasks), ...crons]),
     createdAt: mission.createdAt,
     updatedAt: mission.updatedAt,
     closedAt: mission.closedAt ?? null,
@@ -115,8 +179,15 @@ export function handleMissionsList(
   const store = new TaskStore();
   try {
     const missions = store.listMissions(filter);
+    // 크론 레지스트리는 «요청당 한 번»만 읽고 apmId 로 분배(미션별 DB 열기 금지).
+    const cronsByMission = loadCronDerivedByMission();
     const cards = missions.map((m) =>
-      summarise(m, store.listTasksForMission(m.id)),
+      summarise(
+        m,
+        store.listTasksForMission(m.id),
+        // schedule_registry.autopilot_id 는 계보 키(apmId)다 — TOX 미션 id 와 다를 수 있다.
+        cronsByMission.get(m.autopilot?.apmId ?? m.id) ?? cronsByMission.get(m.id) ?? [],
+      ),
     );
     return jsonResponse({
       total: cards.length,

package/src/nexus/api/ops-api.ts

@@ -9,6 +9,8 @@ import { jsonResponse } from './json-response.js';
 import { operatorSignal } from './operator.js';
 import { createSeatsCache, todayKst } from './ops-seats.js';
 import { liveSeatsSources } from './ops-seats-sources.js';
+import { createOverviewCache } from '../../ops/overview-cache.js';
+import { parseSince } from '../../ops/overview-collect.js';
 import type { MetaApiOpts } from './meta-api.js';
 
 const VERSION = /^\d+\.\d+\.\d+(?:-(?:rc|alpha|beta)\.\d+)?$/;
@@ -17,6 +19,11 @@ const DATE = /^\d{4}-\d{2}-\d{2}$/;
 let seatsCache: ReturnType<typeof createSeatsCache> | null = null;
 /** Tests swap the sources; production builds them lazily on first use. */
 export function setSeatsCacheForTest(cache: ReturnType<typeof createSeatsCache> | null): void { seatsCache = cache; }
+let overviewCache: ReturnType<typeof createOverviewCache> | null = null;
+export function setOverviewCacheForTest(cache: ReturnType<typeof createOverviewCache> | null): void {
+  overviewCache?.stop();
+  overviewCache = cache;
+}
 const LOG_PATH = /^\/v1\/ops\/release\/runs\/([^/]+)\/nodes\/([^/]+)\/log$/;
 
 interface RunNode { nodeId: string; ok?: unknown; output?: unknown; startedAt?: unknown; endedAt?: unknown }
@@ -190,6 +197,17 @@ export function handleOpsApi(req: Request, metaApi: MetaApiOpts | undefined): Re
     response.headers.set('cache-control', 'no-store');
     return response;
   };
+  if (pathname === '/v1/ops/overview') {
+    let since: ReturnType<typeof parseSince>;
+    try { since = parseSince(url.searchParams.get('since') ?? undefined); }
+    catch { return jsonResponse({ error: 'invalid-since' }, 400); }
+    const version = url.searchParams.get('version');
+    if (version !== null && !VERSION.test(version)) return jsonResponse({ error: 'invalid-version' }, 400);
+    overviewCache ??= createOverviewCache();
+    return overviewCache.get({ sinceMs: since.ms, sinceLabel: since.label,
+      ...(version ? { version } : {}), ...(url.searchParams.has('owner') ? { owner: url.searchParams.get('owner')! } : {}) })
+      .then((overview) => served(jsonResponse(overview)), () => jsonResponse({ error: 'overview-unavailable' }, 500));
+  }
   if (pathname === '/v1/ops/seats') {
     const date = url.searchParams.get('date') ?? todayKst();
     if (!DATE.test(date) || Number.isNaN(Date.parse(`${date}T00:00:00+09:00`))) return jsonResponse({ error: 'invalid-date' }, 400);

package/src/nexus/index.ts

@@ -4021,78 +4021,10 @@ function shouldRegisterWebterm(): boolean {
 // `boot/register-daemon.ts` and re-exported above (line 32) so existing
 // test imports (`from '../src/nexus/index.js'`) keep working.
 
-/** Resolve the active daemon tool surface kind for runNexus.
- *
- *  Resolution order (parity with `deriveChildEnv` for daemon tab spawn —
- *  the same switch fed into a daemon child env should govern the in-
- *  process path too):
- *
- *    1. CLI flag (`opts.tools`)                                     ← 1회 boot
- *    2. `ELANOUS_TOOLS` env                                           ← shell session
- *    3. UserConfig switch `global.tools` (PWA Settings 토글이 여기) ← 영구
- *    4. switch default = `'webterm'` (`builtins/global.ts:12`)       ← fallback
- *
- *  Pre-fix the in-process branch fell back to `'none'` while
- *  `deriveChildEnv` fell back to the switch default `'webterm'`. That
- *  meant a clean-machine `elanous nexus` (no flag/env) gave the in-process
- *  LLM call an empty tool catalog while a separately-launched
- *  `elanous serve` daemon honored the switch default's full surface —
- *  surprising divergence the user had no way to discover.
- *
- *  `'all'` is in the switch enum but has no `toolSurface()` impl yet;
- *  fall back to `'webterm'` (the most-capable wired surface). */
-const daemonToolSurfaceKinds: Record<DaemonToolSurfaceKind, true> = {
-  none: true,
-  readonly: true,
-  chat: true,
-  webterm: true,
-};
-
-function resolveKnownToolsKind(raw: string): DaemonToolSurfaceKind | undefined {
-  return Object.hasOwn(daemonToolSurfaceKinds, raw)
-    ? raw as DaemonToolSurfaceKind
-    : undefined;
-}
-
-export function resolveToolsKind(opts: { tools?: string }): DaemonToolSurfaceKind {
-  let raw: string | undefined = opts.tools;
-  if (!raw) raw = process.env.ELANOUS_TOOLS?.trim();
-  if (!raw) {
-    try {
-      const cfg = readUserConfig();
-      const v = readSwitchValue(cfg, 'global.tools');
-      if (typeof v === 'string') raw = v;
-    } catch { /* swallow — boot must not fail on a malformed config */ }
-  }
-  if (!raw) raw = 'webterm';
-  return resolveKnownToolsKind(raw) ?? 'webterm';
-}
-
-/** Resolve the `:agent` (통합 모드 webterm dock) tool surface kind.
- *
- *  Distinct from {@link resolveToolsKind} because the integrated
- *  webterm-dock chat is **defined by** its PTY surface — WebTerminal*
- *  tools (Snapshot · Input · Screenshot) are what make `:agent`
- *  meaningful next to a live terminal. If the user has narrowed their
- *  user-config (`global.tools chat` / `readonly`) to keep the
- *  standalone `/chat` lighter, that preference must NOT bleed into the
- *  integrated dock — otherwise the `:agent` LLM loses access to the
- *  very terminal it's supposed to drive.
- *
- *  Resolution order:
- *    1. CLI flag (`opts.tools`)         ← explicit operator intent wins
- *    2. **`'webterm'`** (hardcoded)     ← env + global.tools intentionally
- *                                         skipped vs. resolveToolsKind
- *
- *  CLI flag is honored so a developer debugging tool selection
- *  (`elanous nexus run --tools readonly`) still sees a readonly `:agent`;
- *  but a clean-machine boot or a config-narrowed boot always gets
- *  webterm for the integrated dock. */
-export function resolveAgentTurnToolsKind(opts: { tools?: string }): DaemonToolSurfaceKind {
-  const raw = opts.tools?.trim();
-  if (!raw) return 'webterm';
-  // 'all' (or any unrecognized string) → webterm fallback, same as
-  // resolveToolsKind so the two resolvers stay consistent for valid
-  // CLI input.
-  return resolveKnownToolsKind(raw) ?? 'webterm';
-}
+// C-2a (same pattern as `shouldRegisterDaemon` above): the tool-surface
+// resolution block (`daemonToolSurfaceKinds` · `resolveKnownToolsKind` ·
+// `resolveToolsKind` · `resolveAgentTurnToolsKind`) moved to
+// `nexus/tools-kind.ts` and re-exported here so existing test imports
+// (`from '../src/nexus/index.js'`) keep working.
+import { resolveAgentTurnToolsKind, resolveToolsKind } from './tools-kind.js';
+export { resolveToolsKind, resolveAgentTurnToolsKind } from './tools-kind.js';

package/src/nexus/tools-kind.ts

@@ -0,0 +1,78 @@
+import { readUserConfig, readSwitchValue } from './config/user-config.js';
+import type { DaemonToolSurfaceKind } from '../boot/daemon-tools/types.js';
+
+/** Resolve the active daemon tool surface kind for runNexus.
+ *
+ *  Resolution order (parity with `deriveChildEnv` for daemon tab spawn —
+ *  the same switch fed into a daemon child env should govern the in-
+ *  process path too):
+ *
+ *    1. CLI flag (`opts.tools`)                                     ← 1회 boot
+ *    2. `ELANOUS_TOOLS` env                                           ← shell session
+ *    3. UserConfig switch `global.tools` (PWA Settings 토글이 여기) ← 영구
+ *    4. switch default = `'webterm'` (`builtins/global.ts:12`)       ← fallback
+ *
+ *  Pre-fix the in-process branch fell back to `'none'` while
+ *  `deriveChildEnv` fell back to the switch default `'webterm'`. That
+ *  meant a clean-machine `elanous nexus` (no flag/env) gave the in-process
+ *  LLM call an empty tool catalog while a separately-launched
+ *  `elanous serve` daemon honored the switch default's full surface —
+ *  surprising divergence the user had no way to discover.
+ *
+ *  `'all'` is in the switch enum but has no `toolSurface()` impl yet;
+ *  fall back to `'webterm'` (the most-capable wired surface). */
+const daemonToolSurfaceKinds: Record<DaemonToolSurfaceKind, true> = {
+  none: true,
+  readonly: true,
+  chat: true,
+  webterm: true,
+};
+
+function resolveKnownToolsKind(raw: string): DaemonToolSurfaceKind | undefined {
+  return Object.hasOwn(daemonToolSurfaceKinds, raw)
+    ? raw as DaemonToolSurfaceKind
+    : undefined;
+}
+
+export function resolveToolsKind(opts: { tools?: string }): DaemonToolSurfaceKind {
+  let raw: string | undefined = opts.tools;
+  if (!raw) raw = process.env.ELANOUS_TOOLS?.trim();
+  if (!raw) {
+    try {
+      const cfg = readUserConfig();
+      const v = readSwitchValue(cfg, 'global.tools');
+      if (typeof v === 'string') raw = v;
+    } catch { /* swallow — boot must not fail on a malformed config */ }
+  }
+  if (!raw) raw = 'webterm';
+  return resolveKnownToolsKind(raw) ?? 'webterm';
+}
+
+/** Resolve the `:agent` (통합 모드 webterm dock) tool surface kind.
+ *
+ *  Distinct from {@link resolveToolsKind} because the integrated
+ *  webterm-dock chat is **defined by** its PTY surface — WebTerminal*
+ *  tools (Snapshot · Input · Screenshot) are what make `:agent`
+ *  meaningful next to a live terminal. If the user has narrowed their
+ *  user-config (`global.tools chat` / `readonly`) to keep the
+ *  standalone `/chat` lighter, that preference must NOT bleed into the
+ *  integrated dock — otherwise the `:agent` LLM loses access to the
+ *  very terminal it's supposed to drive.
+ *
+ *  Resolution order:
+ *    1. CLI flag (`opts.tools`)         ← explicit operator intent wins
+ *    2. **`'webterm'`** (hardcoded)     ← env + global.tools intentionally
+ *                                         skipped vs. resolveToolsKind
+ *
+ *  CLI flag is honored so a developer debugging tool selection
+ *  (`elanous nexus run --tools readonly`) still sees a readonly `:agent`;
+ *  but a clean-machine boot or a config-narrowed boot always gets
+ *  webterm for the integrated dock. */
+export function resolveAgentTurnToolsKind(opts: { tools?: string }): DaemonToolSurfaceKind {
+  const raw = opts.tools?.trim();
+  if (!raw) return 'webterm';
+  // 'all' (or any unrecognized string) → webterm fallback, same as
+  // resolveToolsKind so the two resolvers stay consistent for valid
+  // CLI input.
+  return resolveKnownToolsKind(raw) ?? 'webterm';
+}

package/src/oauth/codex-account-rotation.ts

@@ -29,6 +29,7 @@ export interface RotationCandidate {
   /** 선불 크레딧 잔액·보유(모르면 없다). 크레딧 정책에서 «어느 계정 크레딧으로» 갈지 고른다. */
   readonly creditBalance?: number;
   readonly hasCredits?: boolean;
+  readonly resetCreditAvailability?: 'available' | 'unavailable' | 'unknown';
 }
 
 /** ⛔ 비공개 — 밖에서 이름으로 부를 소비처가 없다(리뷰 must-fix: dead export 금지). */
@@ -69,6 +70,10 @@ interface RotationDecision {
   }[];
   /** 넘겼을 때만 있다. */
   readonly to?: RotationCandidate;
+  /** 다른 계정의 리셋권이 이 판정을 연 경우의 관측용 이름. 소비 대상은 소비기가 별도로 고른다. */
+  readonly resetCreditAccount?: string;
+  /** SUBSCRIPTION-EXHAUST-REROUTE — 크레딧 예비분에 닿아 `no-candidate` 로 넘겼을 때만 있다(잔액은 «알려진» 값). */
+  readonly creditReserveHit?: { readonly balance: number; readonly reserve: number };
 }
 
 /** ⛔ 비공개 — 호출자는 객체 리터럴로 준다(구조적 타이핑). */
@@ -104,6 +109,9 @@ interface RotationInput {
   readonly currentCreditBalance?: number;
   readonly currentHasCredits?: boolean;
   readonly creditPace?: { active: boolean };
+  /** SUBSCRIPTION-EXHAUST-REROUTE (`llm.codexCreditReserve`) — 크레딧 잔액이 이 값 «이하»면 크레딧을 쓰지 않는다.
+   *  ⛔ 없으면 종전(잔액 > 0 이면 쓴다). 잔액을 «모르면» 이 값으로 막지 않는다(fail-open). */
+  readonly creditReserve?: number;
 }
 
 /**
@@ -215,6 +223,10 @@ export function decideCodexRotation(input: RotationInput): RotationDecision {
   const to = usable[0];
   if (!to) {
     if (input.resetCreditAvailability === 'available') return { reason: 'reset-credit-available', candidateCount, accountThresholds };
+    const resetCreditAccount = otherCandidates
+      .filter((candidate) => candidate.home.trim() && candidate.resetCreditAvailability === 'available')
+      .sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)[0]?.name;
+    if (resetCreditAccount) return { reason: 'reset-credit-available', candidateCount, accountThresholds, resetCreditAccount };
     if (input.creditPace?.active) {
       const self = input.candidates.find((candidate) => candidate.name === input.current.name);
       const eligible = (name: string, balance: number | undefined, hasCredits: boolean | undefined, home: string | undefined): boolean =>
@@ -235,18 +247,27 @@ export function decideCodexRotation(input: RotationInput): RotationDecision {
     //   한 계정 크레딧이 바닥나면 남은 크레딧을 두고 폴백(grok)으로 갔다. ⇒ 크레딧이 «더 많이» 남은 계정으로 옮긴다.
     //   흔들림 방지: 지금 계정 크레딧이 없거나(보유 false · 잔액 ≤0) 다른 계정이 20% 넘게 많을 때만.
     if (input.creditsAllowed === true) {
+      // SUBSCRIPTION-EXHAUST-REROUTE — 예비분이 있으면 «예비분 초과»만 쓸 크레딧이다(없으면 종전 > 0).
+      const reserve = typeof input.creditReserve === 'number' && Number.isFinite(input.creditReserve) && input.creditReserve >= 0
+        ? input.creditReserve : undefined;
+      const floor = reserve ?? 0;
       const richest = otherCandidates
-        .filter((c) => c.home.length > 0 && c.hasCredits !== false && typeof c.creditBalance === 'number' && c.creditBalance > 0)
+        .filter((c) => c.home.length > 0 && c.hasCredits !== false && typeof c.creditBalance === 'number' && c.creditBalance > floor)
         .sort((a, b) => (b.creditBalance! - a.creditBalance!) || (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))[0];
       // 지금 계정 신호를 귀속할 수 없을 때(기본 계정 `source=default`)는 후보 목록의 같은 이름 줄을 쓴다 —
       //   후보는 같은 홈 해석으로 신호를 읽었다(09-28 운영: default 가 «사용=? · 찼나=모름»이라 잔액을 못 봐 머물렀다).
       const self = input.candidates.find((c) => c.name === input.current.name);
       const cur = input.currentCreditBalance ?? self?.creditBalance;
       const curHas = input.currentHasCredits ?? self?.hasCredits;
-      const currentDry = curHas === false || (typeof cur === 'number' && cur <= 0);
+      const currentDry = curHas === false || (typeof cur === 'number' && cur <= floor);
       if (richest && (currentDry || (typeof cur === 'number' && richest.creditBalance! > cur * 1.2))) {
         return { reason: 'rotated', candidateCount, accountThresholds, to: richest };
       }
+      // 🩸 10-11: 크레딧이 0 이 돼도 여기 머물러 codex 로 계속 쐈다. 잔액이 «알려져 있고» 예비분 이하이며
+      //   예비분을 넘는 다른 계정도 없으면 «갈 곳 없음» — 폴백 체인이 다음 칸을 정한다. 모르면 종전대로 머문다.
+      if (reserve !== undefined && typeof cur === 'number' && Number.isFinite(cur) && cur <= reserve) {
+        return { reason: 'no-candidate', candidateCount, accountThresholds, creditReserveHit: { balance: cur, reserve } };
+      }
       return { reason: 'credits-allowed', candidateCount, accountThresholds };
     }
     return { reason: 'no-candidate', candidateCount, accountThresholds };
@@ -255,6 +276,21 @@ export function decideCodexRotation(input: RotationInput): RotationDecision {
   return { reason: 'rotated', candidateCount, accountThresholds, to };
 }
 
+/** SUBSCRIPTION-EXHAUST-REROUTE — 크레딧 예비분 기본(`llm.codexCreditReserve` 가 없을 때 · 근거는 codex-account-store 주석).
+ *  여기 두는 이유: Pod 계획(pod-account-broker)이 store 를 끌어오지 않고 같은 값을 쓴다. */
+export const CODEX_CREDIT_RESERVE_DEFAULT = 2000;
+
+/** CODEX-CREDITS-STEP — 크레딧 잔액이 «확인된» 후보(잔액 > 예비분 · 보유 ≠ false · 홈을 안다)를 잔액 많은 순으로.
+ *  잔액을 모르면 넣지 않는다(돈 · fail-closed). 회전 수집기와 Pod 계획이 «같은 자»를 쓴다. */
+export function creditCandidatesByBalance(candidates: readonly RotationCandidate[], reserve = 0): RotationCandidate[] {
+  // SUBSCRIPTION-EXHAUST-REROUTE — 잔액이 예비분(`llm.codexCreditReserve`) «초과»인 계정만(0 = 종전 > 0).
+  const floor = Number.isFinite(reserve) && reserve >= 0 ? reserve : 0;
+  return candidates
+    .filter((c) => c.home.length > 0 && c.hasCredits !== false
+      && typeof c.creditBalance === 'number' && Number.isFinite(c.creditBalance) && c.creditBalance > floor)
+    .sort((a, b) => (b.creditBalance! - a.creditBalance!) || (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+}
+
 /**
  * ⛔⭐⭐⭐⭐⭐ **회전한 계정을 «자식 env»로 내려보낼 덧칠** (2026-08-07 · 크레딧 유출 차단).
  *
@@ -285,6 +321,7 @@ export function observeRotation(decision: RotationDecision, from: string): void
     from,
     to: decision.to?.name,
     reason: decision.reason,
+    ...(decision.resetCreditAccount ? { resetCreditAccount: decision.resetCreditAccount } : {}),
     candidateCount: decision.candidateCount ?? 'unknown',
     ...(decision.reason === 'disabled' && decision.disabledProvenance
       ? { disabledProvenance: decision.disabledProvenance }