elanous 0.2.25 → 0.2.28

package/src/msg/msg-store.ts

@@ -1,5 +1,5 @@
 import { Database } from 'bun:sqlite';
-import { mkdirSync } from 'node:fs';
+import { existsSync, mkdirSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 
@@ -8,6 +8,7 @@ export interface MessageEnvelope {
   to: string;
   body: string;
   kind?: string;
+  replyTo?: number;
 }
 
 export interface Message extends MessageEnvelope {
@@ -20,7 +21,7 @@ export interface UnreadRecipient {
   count: number;
 }
 
-const SEAT_ALIASES: Readonly<Record<string, string>> = {
+export const SEAT_ALIASES: Readonly<Record<string, string>> = {
   S: 'OP', OP: 'OP', COO: 'OP',
   T: 'MK', MK: 'MK', CMO: 'MK',
   O: 'TC', TC: 'TC', CTO: 'TC',
@@ -41,12 +42,21 @@ export function validateMessageEnvelope(input: unknown): MessageEnvelope {
   const record = input as Record<string, unknown>;
   const from = canonicalSeatId(record.from as string);
   const to = canonicalSeatId(record.to as string);
+  if (from === 'ALL') throw new Error('ALL cannot send messages');
   if (typeof record.body !== 'string' || !record.body.trim()) throw new Error('message body must be nonempty');
   if (record.kind !== undefined && (typeof record.kind !== 'string' || !/^[a-z][a-z0-9_-]{0,63}$/.test(record.kind))) {
     throw new Error('invalid message kind');
   }
-  if (Object.keys(record).some(key => !['from', 'to', 'body', 'kind'].includes(key))) throw new Error('unknown message field');
-  return record.kind === undefined ? { from, to, body: record.body } : { from, to, body: record.body, kind: record.kind as string };
+  const replyTo = record.replyTo;
+  if (replyTo !== undefined && (typeof replyTo !== 'number' || !Number.isSafeInteger(replyTo) || replyTo < 1)) {
+    throw new Error('replyTo must be a positive integer message ID');
+  }
+  if (Object.keys(record).some(key => !['from', 'to', 'body', 'kind', 'replyTo'].includes(key))) throw new Error('unknown message field');
+  return {
+    from, to, body: record.body,
+    ...(record.kind === undefined ? {} : { kind: record.kind as string }),
+    ...(replyTo === undefined ? {} : { replyTo }),
+  };
 }
 
 function validCursor(cursor: number): number {
@@ -54,48 +64,109 @@ function validCursor(cursor: number): number {
   return cursor;
 }
 
+function unreadCountOn(db: Database, to: string): number {
+  return (db.query(`SELECT COUNT(*) AS count FROM msg_messages m
+    WHERE m.id > COALESCE((SELECT last_id FROM msg_cursors WHERE recipient = ?), 0)
+      AND (m.recipient = ? OR (m.recipient = 'ALL' AND m.sender <> ?))`)
+    .get(to, to, to) as { count: number }).count;
+}
+
 interface MessageRow {
   id: number;
   sender: string;
   recipient: string;
   body: string;
   kind: string | null;
+  reply_to: number | null;
   created_at: string;
 }
 
 function fromRow(row: MessageRow): Message {
   return { id: row.id, from: row.sender, to: row.recipient, body: row.body,
-    ...(row.kind === null ? {} : { kind: row.kind }), createdAt: row.created_at };
+    ...(row.kind === null ? {} : { kind: row.kind }),
+    ...(row.reply_to == null ? {} : { replyTo: row.reply_to }),
+    createdAt: row.created_at };
 }
 
 /** SQLite owns both append order and per-recipient acknowledgement progress. */
 export class MsgStore {
   readonly db: Database;
 
-  constructor(path: string = defaultMsgStorePath()) {
-    if (path !== ':memory:') mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    this.db = new Database(path);
+  // A read-only SSE connection may outlive another process's in-place migration.
+  private get hasReplyTo(): boolean {
+    return (this.db.query(`SELECT COUNT(*) AS count FROM pragma_table_info('msg_messages') WHERE name = 'reply_to'`)
+      .get() as { count: number }).count > 0;
+  }
+
+  private readWithSchema<T>(read: (hasReplyTo: boolean) => T): T {
+    // The schema projection and rows must share one SQLite snapshot. Otherwise a writer can
+    // migrate between them and a reader could advance past a reply with its link erased.
+    return this.db.transaction(() => read(this.hasReplyTo)).deferred();
+  }
+
+  constructor(path: string = defaultMsgStorePath(), options: { readOnly?: boolean } = {}) {
+    if (options.readOnly && (path === ':memory:' || !existsSync(path))) throw new Error('message ledger unavailable for read-only SSE service');
+    if (!options.readOnly && path !== ':memory:') mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    this.db = options.readOnly ? new Database(path, { readonly: true }) : new Database(path);
     this.db.exec('PRAGMA busy_timeout = 5000');
-    this.db.exec(`CREATE TABLE IF NOT EXISTS msg_messages (
+    if (!options.readOnly) this.db.exec(`CREATE TABLE IF NOT EXISTS msg_messages (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
       sender TEXT NOT NULL,
       recipient TEXT NOT NULL,
       body TEXT NOT NULL,
       kind TEXT,
+      reply_to INTEGER,
       created_at TEXT NOT NULL
     );
     CREATE INDEX IF NOT EXISTS idx_msg_messages_recipient_id ON msg_messages(recipient, id);
     CREATE TABLE IF NOT EXISTS msg_cursors (
       recipient TEXT PRIMARY KEY,
       last_id INTEGER NOT NULL DEFAULT 0 CHECK(last_id >= 0)
+    );
+    CREATE TABLE IF NOT EXISTS msg_provenance (
+      provenance_key TEXT PRIMARY KEY,
+      message_id INTEGER NOT NULL REFERENCES msg_messages(id)
     );`);
+    // Serialize the schema check and ALTER across processes opening an old ledger at once.
+    if (!options.readOnly) this.db.transaction(() => {
+      const replyToColumn = (this.db.query(`SELECT COUNT(*) AS count FROM pragma_table_info('msg_messages') WHERE name = 'reply_to'`)
+        .get() as { count: number }).count;
+      if (replyToColumn === 0) this.db.exec('ALTER TABLE msg_messages ADD COLUMN reply_to INTEGER');
+      this.db.exec('CREATE INDEX IF NOT EXISTS idx_msg_messages_reply_to ON msg_messages(reply_to, id)');
+    }).immediate();
   }
 
   append(input: MessageEnvelope): Message {
+    return this.insertMessage(input);
+  }
+
+  /** Append once for a coordination comment or a task failure incident. */
+  appendWithProvenance(input: MessageEnvelope, provenanceKey: string): Message {
+    if (typeof provenanceKey !== 'string' || !/^(?:coord|ta-failure):[^:]+:[^:]+$/.test(provenanceKey)) {
+      throw new Error('invalid message provenance key');
+    }
     const msg = validateMessageEnvelope(input);
+    if (provenanceKey.split(':')[2] !== msg.to) throw new Error('provenance recipient does not match message recipient');
+    return this.db.transaction(() => {
+      const existing = this.db.query(`SELECT m.id, m.sender, m.recipient, m.body, m.kind, m.reply_to, m.created_at
+        FROM msg_provenance p JOIN msg_messages m ON m.id = p.message_id WHERE p.provenance_key = ?`)
+        .get(provenanceKey) as MessageRow | null;
+      if (existing) return fromRow(existing);
+      const message = this.insertMessage(msg);
+      this.db.query('INSERT INTO msg_provenance(provenance_key, message_id) VALUES (?, ?)')
+        .run(provenanceKey, message.id);
+      return message;
+    }).immediate();
+  }
+
+  private insertMessage(input: MessageEnvelope): Message {
+    const msg = validateMessageEnvelope(input);
+    if (msg.replyTo !== undefined && this.db.query('SELECT 1 FROM msg_messages WHERE id = ?').get(msg.replyTo) === null) {
+      throw new Error(`reply target not found: #${msg.replyTo}`);
+    }
     const createdAt = new Date().toISOString();
-    const result = this.db.query(`INSERT INTO msg_messages(sender, recipient, body, kind, created_at)
-      VALUES (?, ?, ?, ?, ?)`).run(msg.from, msg.to, msg.body, msg.kind ?? null, createdAt);
+    const result = this.db.query(`INSERT INTO msg_messages(sender, recipient, body, kind, reply_to, created_at)
+      VALUES (?, ?, ?, ?, ?, ?)`).run(msg.from, msg.to, msg.body, msg.kind ?? null, msg.replyTo ?? null, createdAt);
     return { id: Number(result.lastInsertRowid), ...msg, createdAt };
   }
 
@@ -104,24 +175,61 @@ export class MsgStore {
   /** Messages strictly after the supplied cursor, ordered by durable insertion ID. */
   listByRecipient(recipient: string, after: number = 0, limit: number = 100): Message[] {
     const to = canonicalSeatId(recipient);
+    if (to === 'ALL') throw new Error('ALL is a topic, not a recipient');
     validCursor(after);
     if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000) throw new Error('limit must be between 1 and 1000');
-    return (this.db.query(`SELECT id, sender, recipient, body, kind, created_at FROM msg_messages
-      WHERE recipient = ? AND id > ? ORDER BY id ASC LIMIT ?`).all(to, after, limit) as MessageRow[]).map(fromRow);
+    return this.readWithSchema(hasReplyTo => (this.db.query(`SELECT id, sender, recipient, body, kind, ${hasReplyTo ? 'reply_to' : 'NULL AS reply_to'}, created_at FROM msg_messages
+      WHERE id > ? AND (recipient = ? OR (recipient = 'ALL' AND sender <> ?))
+      ORDER BY id ASC LIMIT ?`).all(after, to, to, limit) as MessageRow[]).map(fromRow));
+  }
+
+  /** One message by durable ID, or null when absent. */
+  getMessage(messageId: number): Message | null {
+    if (!Number.isSafeInteger(messageId) || messageId < 1) throw new Error('message ID must be a positive integer');
+    return this.readWithSchema(hasReplyTo => {
+      const row = this.db.query(`SELECT id, sender, recipient, body, kind, ${hasReplyTo ? 'reply_to' : 'NULL AS reply_to'}, created_at FROM msg_messages
+        WHERE id = ?`).get(messageId) as MessageRow | null;
+      return row === null ? null : fromRow(row);
+    });
+  }
+
+  /** Replies pointing at the supplied message, ordered by durable insertion ID. */
+  listReplies(messageId: number, limit: number = 100, afterId: number = 0): Message[] {
+    if (!Number.isSafeInteger(messageId) || messageId < 1) throw new Error('message ID must be a positive integer');
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000) throw new Error('limit must be between 1 and 1000');
+    validCursor(afterId);
+    return this.readWithSchema(hasReplyTo => hasReplyTo
+      ? (this.db.query(`SELECT id, sender, recipient, body, kind, reply_to, created_at FROM msg_messages
+        WHERE reply_to = ? AND id > ? ORDER BY id ASC LIMIT ?`).all(messageId, afterId, limit) as MessageRow[]).map(fromRow)
+      : []);
   }
 
   list(recipient: string, after: number = 0, limit: number = 100): Message[] {
     return this.listByRecipient(recipient, after, limit);
   }
 
+  /** One ordered scan for every SSE subscriber; recipient filtering happens in the server. */
+  listAfter(after: number, limit: number = 1000): Message[] {
+    validCursor(after);
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000) throw new Error('limit must be between 1 and 1000');
+    return this.readWithSchema(hasReplyTo => (this.db.query(`SELECT id, sender, recipient, body, kind, ${hasReplyTo ? 'reply_to' : 'NULL AS reply_to'}, created_at FROM msg_messages
+      WHERE id > ? ORDER BY id ASC LIMIT ?`).all(after, limit) as MessageRow[]).map(fromRow));
+  }
+
+  latestId(): number {
+    return (this.db.query('SELECT COALESCE(MAX(id), 0) AS id FROM msg_messages').get() as { id: number }).id;
+  }
+
   getCursor(recipient: string): number {
     const to = canonicalSeatId(recipient);
+    if (to === 'ALL') throw new Error('ALL is a topic, not a recipient');
     return (this.db.query('SELECT last_id FROM msg_cursors WHERE recipient = ?').get(to) as { last_id: number } | null)?.last_id ?? 0;
   }
 
   /** Atomically reject future IDs and keep concurrent or stale acknowledgements from rewinding. */
   advanceCursor(recipient: string, cursor: number): number {
     const to = canonicalSeatId(recipient);
+    if (to === 'ALL') throw new Error('ALL is a topic, not a recipient');
     validCursor(cursor);
     const result = this.db.query(`INSERT INTO msg_cursors(recipient, last_id)
       SELECT ?, ? WHERE ? <= (SELECT COALESCE(MAX(id), 0) FROM msg_messages)
@@ -133,11 +241,24 @@ export class MsgStore {
 
   ack(recipient: string, cursor: number): number { return this.advanceCursor(recipient, cursor); }
 
+  unreadCount(recipient: string): number {
+    const to = canonicalSeatId(recipient);
+    if (to === 'ALL') throw new Error('ALL is a topic, not a recipient');
+    return unreadCountOn(this.db, to);
+  }
+
   unreadRecipients(): UnreadRecipient[] {
-    return this.db.query(`SELECT m.recipient AS recipient, COUNT(*) AS count
-      FROM msg_messages m LEFT JOIN msg_cursors c ON c.recipient = m.recipient
-      WHERE m.id > COALESCE(c.last_id, 0)
-      GROUP BY m.recipient ORDER BY m.recipient ASC`).all() as UnreadRecipient[];
+    return this.db.query(`WITH recipients(recipient) AS (
+        SELECT 'OP' UNION SELECT 'MK' UNION SELECT 'TC' UNION SELECT 'UX'
+        UNION SELECT recipient FROM msg_messages WHERE recipient <> 'ALL'
+        UNION SELECT recipient FROM msg_cursors WHERE recipient <> 'ALL'
+      )
+      SELECT r.recipient AS recipient, COUNT(m.id) AS count
+      FROM recipients r
+      LEFT JOIN msg_cursors c ON c.recipient = r.recipient
+      JOIN msg_messages m ON m.id > COALESCE(c.last_id, 0)
+        AND (m.recipient = r.recipient OR (m.recipient = 'ALL' AND m.sender <> r.recipient))
+      GROUP BY r.recipient ORDER BY r.recipient ASC`).all() as UnreadRecipient[];
   }
 
   unread(): UnreadRecipient[] { return this.unreadRecipients(); }
@@ -147,3 +268,14 @@ export class MsgStore {
 
 export function defaultMsgStorePath(): string { return join(elanousStateRoot(), 'msg', 'messages.db'); }
 export function openMsgStore(path?: string): MsgStore { return new MsgStore(path); }
+export function openMsgStoreReadOnly(path?: string): MsgStore { return new MsgStore(path, { readOnly: true }); }
+
+/** Observe one recipient without creating a store or advancing its acknowledgement. */
+export function readUnreadCount(recipient: string, path: string = defaultMsgStorePath()): number | null {
+  const to = canonicalSeatId(recipient);
+  if (to === 'ALL') throw new Error('ALL is a topic, not a recipient');
+  if (!existsSync(path)) return null;
+  const db = new Database(path, { readonly: true });
+  try { return unreadCountOn(db, to); }
+  finally { db.close(); }
+}

package/src/ops/overview-collect.ts

@@ -16,6 +16,7 @@ import {
   type OverviewSnapshot, type OwnerTaskRow, type ParentsInfo, type PodMemberRow, type ReleaseRunInfo, type ScheduleInfo,
 } from './overview.js';
 import { SEAT_ERA_SOURCE, readDispatcherBeats, readDispatcherCapacity, readSeatEraHanded, seatEraFeederDir } from './overview-seat-era.js';
+import { matchesOverviewOwner, normalizeOverviewOwner } from './overview-owner.js';
 
 const GB = 1024 ** 3;
 /** 하트비트 주기 30 s × 2 (RFC §A2 «낡음»). */
@@ -77,8 +78,8 @@ export function ownerRows(cards: readonly TaskCard[], sinceIso: string, ownerFil
   const rows: Record<string, OwnerTaskRow> = {};
   for (const card of cards) {
     if (!card || typeof card.createdAt !== 'string' || card.createdAt < sinceIso) continue;
-    const owner = card.seat ? `seat:${card.seat}` : 'unassigned';
-    if (ownerFilter && ownerFilter !== 'all' && owner !== ownerFilter && owner !== `seat:${ownerFilter}`) continue;
+    const owner = normalizeOverviewOwner(card.seat);
+    if (ownerFilter !== undefined && !matchesOverviewOwner(owner, ownerFilter)) continue;
     const row = rows[owner] ??= { handed: 0, launched: 0, prBound: 0, failed: 0, launchFailed: 0 };
     if (card.status === 'handed') row.handed++;
     else if (card.status === 'launched') row.launched++;

package/src/ops/overview-owner.ts

@@ -0,0 +1,29 @@
+/** Owner labels used by ops overview task rows and the --owner filter. */
+type OverviewOwnerKind = 'seat' | 'steward' | 'orchestrator' | 'external';
+type OverviewOwner = `${OverviewOwnerKind}:${string}` | 'unassigned';
+
+const OWNER_KINDS = new Set<OverviewOwnerKind>(['seat', 'steward', 'orchestrator', 'external']);
+
+/** Normalize a task-card owner into a stable kind-prefixed overview key. */
+export function normalizeOverviewOwner(value: unknown): OverviewOwner {
+  if (typeof value !== 'string' || value.trim() === '') return 'unassigned';
+  const normalized = value.trim();
+  const separator = normalized.indexOf(':');
+  if (separator >= 0) {
+    const kind = normalized.slice(0, separator).toLowerCase() as OverviewOwnerKind;
+    const name = normalized.slice(separator + 1).trim();
+    if (OWNER_KINDS.has(kind) && name) return `${kind}:${name}`;
+  }
+  const kind = normalized.toLowerCase();
+  if (kind === 'steward' || kind === 'orchestrator' || kind === 'external') return `${kind}:default`;
+  return `seat:${normalized}`;
+}
+
+/** Whether a normalized owner key matches a CLI filter, accepting either the full key or its kind. */
+export function matchesOverviewOwner(owner: OverviewOwner, filter?: string): boolean {
+  if (!filter || filter === 'all') return true;
+  const normalizedFilter = filter.trim();
+  if (!normalizedFilter) return true;
+  if (normalizedFilter.toLowerCase() === 'unassigned') return owner === 'unassigned';
+  return owner === normalizeOverviewOwner(normalizedFilter) || owner.startsWith(`${normalizedFilter.toLowerCase()}:`);
+}

package/src/patents/ledger.ts

@@ -0,0 +1,128 @@
+import { Database } from 'bun:sqlite';
+import { chmodSync, mkdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { elanousStateRoot } from '../autopilot/state-paths.js';
+import { debug } from '../debug/log.js';
+
+/** 특허 후보의 갈래 — 구체 후보와 기전은 비공개 원장에만 둔다. */
+const PATENT_TRACKS = ['비공개', '출원', '신규'] as const;
+/** 특허 후보의 상태 — 조사/명세/출원/공개 허용 중 공개 허용 상태만 공개 읽기 통로에 나온다. */
+const PATENT_STATUSES = ['조사', '명세', '출원', '공개 허용'] as const;
+
+export type PatentTrack = (typeof PATENT_TRACKS)[number];
+export type PatentStatus = (typeof PATENT_STATUSES)[number];
+
+export class PatentsInputError extends Error {
+  override name = 'PatentsInputError';
+}
+
+export interface PatentCandidate {
+  id: string;
+  title: string;
+  track: PatentTrack;
+  status: PatentStatus;
+  deadline: string | null;
+  created_at: string;
+  updated_at: string;
+}
+export interface PatentLedgerOptions { stateDir?: string; now?: () => Date }
+
+function required(value: string, field: string): string {
+  if (typeof value !== 'string' || !value.trim()) throw new PatentsInputError(`${field} is required`);
+  return value.trim();
+}
+
+function trackOf(value: PatentTrack): PatentTrack {
+  if (!PATENT_TRACKS.includes(value)) throw new PatentsInputError(`invalid track: ${value}`);
+  return value;
+}
+
+function statusOf(value: PatentStatus): PatentStatus {
+  if (!PATENT_STATUSES.includes(value)) throw new PatentsInputError(`invalid status: ${value}`);
+  return value;
+}
+
+function isoDate(value: string, field: string): string {
+  if (typeof value !== 'string' || !/^\d{4}-\d\d-\d\d$/.test(value)) throw new PatentsInputError(`invalid ${field}: ${value}`);
+  const date = new Date(`${value}T00:00:00.000Z`);
+  if (Number.isNaN(date.getTime()) || date.toISOString().slice(0, 10) !== value) throw new PatentsInputError(`invalid ${field}: ${value}`);
+  return value;
+}
+
+/** 후보 식별자·갈래·상태·마감일의 비공개 원장 — 공개 허용 상태 후보만 읽기 통로로 노출한다. */
+export class PatentLedger {
+  readonly path: string;
+  private readonly now: () => Date;
+
+  constructor(options: PatentLedgerOptions = {}) {
+    this.path = join(options.stateDir ?? elanousStateRoot(), 'patents', 'patents.sqlite');
+    this.now = options.now ?? (() => new Date());
+  }
+
+  private open(): Database {
+    mkdirSync(dirname(this.path), { recursive: true });
+    const db = new Database(this.path, { create: true, strict: true });
+    try {
+      chmodSync(this.path, 0o600);
+      db.exec('PRAGMA busy_timeout = 10000');
+      db.exec('PRAGMA journal_mode = WAL');
+      db.exec(`CREATE TABLE IF NOT EXISTS patent_candidates (
+        id TEXT PRIMARY KEY, title TEXT NOT NULL,
+        track TEXT NOT NULL CHECK(track IN ('비공개','출원','신규')),
+        status TEXT NOT NULL CHECK(status IN ('조사','명세','출원','공개 허용')),
+        deadline TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);`);
+      return db;
+    } catch (error) { db.close(); throw error; }
+  }
+
+  private using<T>(work: (db: Database) => T): T {
+    const db = this.open();
+    try { return work(db); } finally { db.close(); }
+  }
+
+  private transaction<T>(db: Database, work: () => T): T {
+    db.exec('BEGIN IMMEDIATE');
+    try { const result = work(); db.exec('COMMIT'); return result; }
+    catch (error) { db.exec('ROLLBACK'); throw error; }
+  }
+
+  private row(db: Database, id: string): PatentCandidate {
+    const row = db.query('SELECT id, title, track, status, deadline, created_at, updated_at FROM patent_candidates WHERE id = ?').get(id) as PatentCandidate | null;
+    if (!row) throw new PatentsInputError(`patent candidate not found: ${id}`);
+    return row;
+  }
+
+  add(input: { id: string; title: string; track: PatentTrack; status?: PatentStatus; deadline?: string }): PatentCandidate {
+    const id = required(input.id, 'id');
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(id)) throw new PatentsInputError('invalid patent candidate id');
+    const title = required(input.title, 'title');
+    const track = trackOf(input.track);
+    const status = statusOf(input.status ?? '조사');
+    const deadline = input.deadline === undefined ? null : isoDate(input.deadline, 'deadline');
+    return this.using(db => this.transaction(db, () => {
+      if (db.query('SELECT 1 FROM patent_candidates WHERE id = ?').get(id)) throw new PatentsInputError(`patent candidate already exists: ${id}`);
+      const at = this.now().toISOString();
+      db.query('INSERT INTO patent_candidates (id, title, track, status, deadline, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)')
+        .run(id, title, track, status, deadline, at, at);
+      debug.log('patents.ledger', 'add', { id, status });
+      return this.row(db, id);
+    }));
+  }
+
+  setStatus(id: string, status: PatentStatus): PatentCandidate {
+    const next = statusOf(status);
+    return this.using(db => this.transaction(db, () => {
+      this.row(db, id);
+      const at = this.now().toISOString();
+      db.query('UPDATE patent_candidates SET status = ?, updated_at = ? WHERE id = ?').run(next, at, id);
+      debug.log('patents.ledger', 'status', { id, status: next });
+      return this.row(db, id);
+    }));
+  }
+
+  /** 이 원장의 유일한 공개 읽기 통로 — 공개 허용 상태 후보만 나온다(조사·명세·출원 상태 후보는 나오지 않는다). */
+  listPublicCandidates(): PatentCandidate[] {
+    return this.using(db =>
+      db.query(`SELECT id, title, track, status, deadline, created_at, updated_at FROM patent_candidates WHERE status = '공개 허용' ORDER BY created_at, id`).all() as PatentCandidate[]);
+  }
+}

package/src/plugin-hooks/shell-hook.ts

@@ -118,6 +118,7 @@ function runShell(opts: RunShellOpts): Promise<RunShellResult> {
     let stdout = '';
     let stderrBuffer = '';
     let killed = false;
+    let stdinError: string | undefined;
     const onAbort = () => {
       if (!killed) {
         killed = true;
@@ -132,6 +133,14 @@ function runShell(opts: RunShellOpts): Promise<RunShellResult> {
     opts.abortSignal.addEventListener('abort', onAbort, { once: true });
 
     child.stdout?.on('data', (chunk) => { stdout += String(chunk); });
+    // A short-lived command can close its read end before end() finishes.
+    // EPIPE says only that stdin was unread; stdout and exit status still
+    // determine the hook result. Other pipe errors are real I/O failures.
+    child.stdin?.on('error', (err: NodeJS.ErrnoException) => {
+      if (err.code === 'EPIPE') return;
+      stdinError = `stdin error: ${err.message}`;
+      opts.onStderr(stdinError);
+    });
     child.stderr?.on('data', (chunk) => {
       stderrBuffer += String(chunk);
       let idx;
@@ -145,13 +154,19 @@ function runShell(opts: RunShellOpts): Promise<RunShellResult> {
       clearTimeout(timer);
       if (stderrBuffer.trim()) opts.onStderr(stderrBuffer.trim());
       // killed => treat as a non-zero exit so dispatcher abort.
-      resolve({ stdout, exitCode: killed ? 124 : (code ?? 1) });
+      resolve({ stdout, exitCode: killed ? 124 : stdinError ? 127 : (code ?? 1), error: stdinError });
     });
     child.on('error', (err) => {
       clearTimeout(timer);
       opts.onStderr(`spawn error: ${err.message}`);
       resolve({ stdout, exitCode: 127 });
     });
-    try { child.stdin?.end(opts.stdin); } catch { /* pipe may have closed */ }
+    try { child.stdin?.end(opts.stdin); }
+    catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== 'EPIPE') {
+        stdinError = `stdin error: ${(err as Error).message}`;
+        opts.onStderr(stdinError);
+      }
+    }
   });
 }

package/src/plugin-missions/evaluator-runner.ts

@@ -137,6 +137,7 @@ function runShell(opts: RunShellOpts): Promise<RunShellResult> {
     let stderrBuf = '';
     let killed = false;
     let timedOut = false;
+    let stdinError: string | undefined;
     const kill = (timeout: boolean) => {
       if (killed) return;
       killed = true;
@@ -150,6 +151,14 @@ function runShell(opts: RunShellOpts): Promise<RunShellResult> {
     opts.abortSignal.addEventListener('abort', () => kill(false), { once: true });
 
     child.stdout?.on('data', (chunk) => { stdout += String(chunk); });
+    // Early exit may close stdin before end() finishes. A broken pipe must
+    // not replace the child's stdout/exit result; other write errors must
+    // surface as evaluator errors.
+    child.stdin?.on('error', (err: NodeJS.ErrnoException) => {
+      if (err.code === 'EPIPE') return;
+      stdinError = `stdin error: ${err.message}`;
+      opts.onStderr(stdinError);
+    });
     child.stderr?.on('data', (chunk) => {
       stderrBuf += String(chunk);
       let idx;
@@ -164,8 +173,9 @@ function runShell(opts: RunShellOpts): Promise<RunShellResult> {
       if (stderrBuf.trim()) opts.onStderr(stderrBuf.trim());
       resolve({
         stdout,
-        exitCode: timedOut ? 124 : (code ?? 1),
+        exitCode: timedOut ? 124 : stdinError ? 127 : (code ?? 1),
         timedOut,
+        error: stdinError,
       });
     });
     child.on('error', (err) => {
@@ -173,6 +183,12 @@ function runShell(opts: RunShellOpts): Promise<RunShellResult> {
       opts.onStderr(`spawn error: ${err.message}`);
       resolve({ stdout, exitCode: 127, timedOut: false });
     });
-    try { child.stdin?.end(opts.stdin); } catch { /* pipe may have closed */ }
+    try { child.stdin?.end(opts.stdin); }
+    catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== 'EPIPE') {
+        stdinError = `stdin error: ${(err as Error).message}`;
+        opts.onStderr(stdinError);
+      }
+    }
   });
 }

package/src/plugins/install/market-fetch.ts

@@ -1,7 +1,8 @@
 import { createHash } from 'node:crypto';
 import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { withFileLockSync } from '../../storage/file-lock.js';
-import { dirname, join, resolve } from 'node:path';
+import { loadPluginManifestFromDir } from '../core/manifest.js';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { elanousStateRoot } from '../../autopilot/state-paths.js';
 import { userConfigPath } from '../../user-config.js';
 import { OFFICIAL_INDEX_KEYS } from '../../market/official-keys.js';
@@ -37,6 +38,36 @@ export interface MarketIndex {
   signature: 'ok';
   keyId: string;
 }
+/** Resolve only an installed, available Codex plugin package to the local-path input
+ *  already accepted by `plugin add`. Codex marketplace records are not Elanous signed indices. */
+export function codexPluginPackagePath(response: unknown, name: string, marketplace: string): string {
+  if (!NAME.test(name) || !NAME.test(marketplace)) throw new MarketFetchError('io', 'invalid Codex plugin or marketplace name');
+  const inventory = response as { marketplaces?: unknown } | null;
+  if (!inventory || !Array.isArray(inventory.marketplaces)) throw new MarketFetchError('io', 'invalid Codex plugin/list response');
+  const matches: string[] = [];
+  for (const rawMarket of inventory.marketplaces) {
+    if (!rawMarket || typeof rawMarket !== 'object') throw new MarketFetchError('io', 'invalid Codex marketplace');
+    const market = rawMarket as { name?: unknown; plugins?: unknown };
+    if (market.name !== marketplace) continue;
+    if (!Array.isArray(market.plugins)) throw new MarketFetchError('io', 'invalid Codex marketplace plugins');
+    for (const rawPlugin of market.plugins) {
+      if (!rawPlugin || typeof rawPlugin !== 'object') continue;
+      const plugin = rawPlugin as Record<string, unknown>;
+      if (plugin.name !== name || plugin.installed !== true) continue;
+      if (typeof plugin.availability === 'string' && plugin.availability.toUpperCase() !== 'AVAILABLE') continue;
+      const path = plugin.installPath ?? plugin.path;
+      if (typeof path !== 'string' || !isAbsolute(path) || !existsSync(path) || !statSync(path).isDirectory()) {
+        throw new MarketFetchError('io', 'Codex installed plugin package directory unavailable');
+      }
+      const manifest = loadPluginManifestFromDir(path, { id: name }).manifest;
+      if (manifest.id !== name) throw new MarketFetchError('io', 'Codex package name differs from inventory');
+      matches.push(path);
+    }
+  }
+  if (matches.length !== 1) throw new MarketFetchError('io', `Codex plugin not installed or ambiguous: ${name}@${marketplace}`);
+  return matches[0]!;
+}
+
 export class MarketFetchError extends Error {
   constructor(public readonly reason: 'io' | 'signature', message: string) {
     super(message);

package/src/plugins/install/plugin-install.ts

@@ -438,6 +438,13 @@ function declaresMain(packageRoot: string): boolean {
   return !existsSync(join(packageRoot, 'plugin.json')) && !existsSync(join(packageRoot, '.codex-plugin', 'plugin.json'));
 }
 
+/** [wiring] Caller: installPlugin. The PluginManifest normalized by
+ * loadPluginManifestFromDir is handed into the install path here — the install
+ * destination follows the manifest identity, never the source spec/dir name. */
+export function pluginInstallPath(root: string, market: string, manifest: PluginManifest): string {
+  return join(root, 'plugins', market, manifest.id, manifest.version);
+}
+
 export async function installPlugin(spec: string, opts: InstallOptions = {}): Promise<InstalledPlugin> {
   const root = resolve(opts.root ?? elanousStateRoot());
   const stageRoot = join(root, 'plugins', '.staging');
@@ -466,6 +473,10 @@ export async function installPlugin(spec: string, opts: InstallOptions = {}): Pr
     const manifest: PluginManifest = loadPluginManifestFromDir(join(stage, 'package'), { id: source.expectedName ?? basename(spec) }).manifest;
     if (!NAME.test(manifest.id) || !VERSION.test(manifest.version)) fail('io', 'invalid plugin name or version');
     if (source.expectedName && (manifest.id !== source.expectedName || manifest.version !== source.expectedVersion)) fail('conflict', 'market name or version differs from manifest');
+    // [wiring] installPlugin is the caller: the PluginManifest normalized above by
+    // loadPluginManifestFromDir (present manifest or the loader's manifest-absent
+    // fallback) is handed into the install path here, past the NAME/VERSION gates.
+    const destination = pluginInstallPath(root, source.market, manifest);
     const packageRoot = join(stage, 'package');
     const mainPath = inside(packageRoot, manifest.main);
     // A skills/graphs-only pack (official `elanous-basics`) declares no `main` — the default `./plugin.ts` is not a promise.
@@ -480,7 +491,6 @@ export async function installPlugin(spec: string, opts: InstallOptions = {}): Pr
       const path = inside(packageRoot, asset);
       if (!existsSync(path) || !realpathSync(path).startsWith(`${realpathSync(packageRoot)}${sep}`)) fail('io', `plugin asset not found or unsafe: ${asset}`);
     }
-    const destination = join(root, 'plugins', source.market, name, version);
     const emit = (event: InstallEvent) => opts.onEvent?.(event);
     emit({ event: 'resolve', plugin: name, version, sha256: source.sha256 });
     let security: ReturnType<typeof inspectPluginSecurity>;