elanous 0.2.27 → 0.2.29

package/src/telegram.ts

@@ -79,6 +79,8 @@ import { handleTelegramFieldNote } from './field-note/telegram.js';
 import type { TranscriptionEngine, FieldAudio } from './field-note/transcribe.js';
 import { maybeHandleCardPhoto, type CardPhotoDeps } from './telegram-card-followup.js';
 import { attachTelegramProjectButtons } from './telegram-project-command.js';
+import { BriefItemsLedger } from './briefing/brief-items.js';
+import { recordBriefTelegramUpdate } from './cli/brief-cli.js';
 import { attachTelegramFabricPlan } from './telegram-fabric-plan.js';
 import { contextNow as readContextNow, type ContextNowDeps } from './context-bus/context-now.js';
 import { renderContextFirstOpening } from './context-bus/context-now-surfaces.js';
@@ -123,6 +125,7 @@ export interface TgIncoming {
   botId?: string;
   /** 답장 대상 메시지의 텍스트(force_reply 정정 가로채기용). parseUpdate 가 채운다. */
   replyToText?: string;
+  replyToMessageId?: number;
   /** 앨범(media group) id — `#현장` 캡션은 앨범의 첫 항목에만 붙으므로 나머지를 같은 행사로 묶는 데 쓴다. */
   mediaGroupId?: string;
   /** 영상 — `#현장` 저장 전용. `attachments` 에 넣지 않는다(LLM 경로의 동작을 안 바꾸려고). */
@@ -239,6 +242,8 @@ export interface TelegramBotOpts {
   /** 시험 seam — `/v1/context/now` 와 같은 `contextNow` 읽기. 던지면 «맥락 못 읽음». */
   readContextNow?: typeof readContextNow;
   contextNowDeps?: ContextNowDeps;
+  /** Optional test-isolated briefing ledger for inbound feedback. */
+  briefLedger?: BriefItemsLedger;
   /** Keeps last-utterance times across a daemon restart so a restart does not re-send the context-first opening. */
   contextFirstStore?: ContextFirstStore;
 }
@@ -301,6 +306,7 @@ export class TelegramBot {
   readonly botId: string;
   private readonly allowedUsers: Set<number>;
   private readonly onMessage: TelegramBotOpts['onMessage'];
+  private readonly briefLedger: BriefItemsLedger | undefined;
   private readonly fetchImpl: typeof fetch;
   private readonly errorBackoffMs: number;
   private readonly pollTimeoutSec: number;
@@ -381,6 +387,7 @@ export class TelegramBot {
     this.botId = opts.token.split(':')[0] || opts.token;
     this.allowedUsers = new Set(opts.allowedUsers);
     this.onMessage = opts.onMessage;
+    this.briefLedger = opts.briefLedger ?? (opts.nowImpl === undefined && opts.fetchImpl === undefined ? new BriefItemsLedger() : undefined);
     this.homeChannel = opts.homeChannel;
     this.fetchImpl = opts.fetchImpl ?? fetch;
     this.errorBackoffMs = opts.errorBackoffMs ?? DEFAULT_ERROR_BACKOFF;
@@ -1229,7 +1236,7 @@ export class TelegramBot {
     while (this.running) {
       try {
         await deliverSeatAnswers(this.seatWorkDeps.askDeps!);
-        const wantCallbackQuery = this.callbackHandlers.size > 0;
+        const wantCallbackQuery = this.callbackHandlers.size > 0 || this.briefLedger !== undefined;
         const wantReaction = this.reactionHandlers.size > 0;
         // allowed_updates 는 명시한 것만 받으므로 등록된 핸들러 종류만 추가(비파괴 — 핸들러
         // 없으면 종전 ['message']/['message','callback_query'] 그대로).
@@ -1274,6 +1281,19 @@ export class TelegramBot {
               messageId: cq.message?.message_id,
               data: cq.data ?? '',
             };
+            if (this.briefLedger && payload.chatId !== undefined && payload.messageId !== undefined && /^brief-item:[1-9]\d*:(?:read|button|ignore)$/.test(payload.data)) {
+              try {
+                const recorded = recordBriefTelegramUpdate(this.briefLedger, {
+                  botId: this.botId, chatId: payload.chatId, messageId: payload.messageId,
+                  updateId: String(u.update_id), callbackData: payload.data,
+                });
+                await this.answerCallbackQuery(payload.id, { text: recorded ? '브리핑 반응 기록됨' : '브리핑 항목을 찾을 수 없습니다' });
+              } catch (err) {
+                this.log(`brief feedback failed: ${err instanceof Error ? err.message : String(err)}`);
+                try { await this.answerCallbackQuery(payload.id, { text: '브리핑 반응 기록 실패' }); } catch { /* polling continues */ }
+              }
+              continue;
+            }
             for (const h of this.callbackHandlers) {
               try { await h(payload); } catch (err) {
                 this.log(`callback handler error: ${err instanceof Error ? err.message : String(err)}`);
@@ -1315,6 +1335,14 @@ export class TelegramBot {
             await this.refuseMessage(incoming);
             continue;
           }
+          if (this.briefLedger && incoming.replyToMessageId && incoming.text.trim() && !incoming.text.trim().startsWith('/')) {
+            try {
+              recordBriefTelegramUpdate(this.briefLedger, {
+                botId: this.botId, chatId: incoming.chatId, messageId: incoming.replyToMessageId,
+                updateId: String(incoming.updateId), text: incoming.text,
+              });
+            } catch (err) { this.log(`brief feedback failed: ${err instanceof Error ? err.message : String(err)}`); }
+          }
           // HITL "Other" free-text: consume inline (before the turn
           // chain) so it isn't queued behind the turn awaiting it.
           if (this.tryConsumeTextCapture(incoming)) continue;
@@ -2494,6 +2522,7 @@ export function parseUpdate(u: RawUpdate): TgIncoming | null {
     isGroup: !isDm,
     attachments,
     ...(m.reply_to_message?.text ? { replyToText: m.reply_to_message.text } : {}),
+    ...(m.reply_to_message?.message_id ? { replyToMessageId: m.reply_to_message.message_id } : {}),
     ...(m.media_group_id ? { mediaGroupId: m.media_group_id } : {}),
     ...(video ? { video } : {}),
   };

package/src/terminal/session-registry.ts

@@ -158,6 +158,12 @@ export class TerminalSessionRegistry {
         shellArgs: spec.shellArgs,
         env: spec.env,
         termName: spec.termName,
+        useRegistry: spec.useRegistry,
+        registryKind: spec.registryKind,
+        registryNickname: spec.registryNickname,
+        registryOrigin: spec.registryOrigin,
+        registryPurpose: spec.registryPurpose,
+        registrySeat: spec.registrySeat,
         bounds: spec.bounds,
         sizePreset: spec.sizePreset,
         onExit: (code) => {

package/src/thinking-line.ts

@@ -295,10 +295,19 @@ export function startPinnedThinking(opts: StartPinnedThinkingOpts): ThinkingHand
   const interval = opts.intervalMs ?? INTERVAL_MS;
   const timer = interval > 0 ? setInterval(tick, interval) : null;
 
+  // ⛔ stop() 뒤엔 칠하지 않는다 — 멈춘 손잡이에 늦게 온 update/updateMetrics(다음 반복이 같은 손잡이를
+  //   재사용하거나 턴 마감 뒤 도착한 이벤트)가 «✢ Thinking…» 프레임을 footer 에 다시 써서, 타이머 없는
+  //   멈춘 표시로 남았다(TUI 결함 #5 · 10-14 13:43 오류 뒤 «Thinking…» 정지).
+  const repaint = (): void => {
+    if (stopped) return;
+    paint();
+    opts.onFrame();
+  };
+
   return {
-    update: (m) => { message = m; messageFactory = null; paint(); opts.onFrame(); },
-    updateAnimated: (fn) => { messageFactory = fn; paint(); opts.onFrame(); },
-    updateMetrics: (m) => { metrics = { ...metrics, ...m }; paint(); opts.onFrame(); },
+    update: (m) => { message = m; messageFactory = null; repaint(); },
+    updateAnimated: (fn) => { messageFactory = fn; repaint(); },
+    updateMetrics: (m) => { metrics = { ...metrics, ...m }; repaint(); },
     reflow: () => { if (!stopped) paint(); opts.onFrame(); },
     stop: (stopOpts) => {
       if (stopped) return;

package/src/tool-runtime/index.ts

@@ -32,6 +32,7 @@ import { agentReplyRuntime } from './agent-reply-runtime.js';
 import { agentStopRuntime } from './agent-stop-runtime.js';
 import { ALL_TEAM_TOOL_RUNTIMES } from './team-tool-runtimes.js';
 import { ALL_OPS_FLEET_RUNTIMES } from './ops-fleet-runtimes.js';
+import { ALL_OPS_LEDGER_RUNTIMES } from './ops-ledger-runtimes.js';
 import { ALL_AUTO_RESEARCH_RUNTIMES } from './auto-research-runtimes.js';
 import { ALL_INTELLIGENCE_MAP_RUNTIMES } from './intelligence-map-runtimes.js';
 import { ALL_CFT_ANDON_RUNTIMES } from './cft-andon-runtimes.js';
@@ -115,6 +116,9 @@ export function registerAllDefaultToolRuntimes(): void {
   registerToolRuntime(agentStopRuntime);
   for (const rt of ALL_TEAM_TOOL_RUNTIMES) registerToolRuntime(rt);
   for (const rt of ALL_OPS_FLEET_RUNTIMES) registerToolRuntime(rt);
+  // Ops-ledger (우편 msg · 판 release checklist) — in-process ledger tools so
+  // TUI OP turns stop paying 1.3–2s of `eln` CLI startup per msg/checklist op.
+  for (const rt of ALL_OPS_LEDGER_RUNTIMES) registerToolRuntime(rt);
   for (const rt of ALL_AUTO_RESEARCH_RUNTIMES) registerToolRuntime(rt);
   for (const rt of ALL_INTELLIGENCE_MAP_RUNTIMES) registerToolRuntime(rt);
   for (const rt of ALL_CFT_ANDON_RUNTIMES) registerToolRuntime(rt);

package/src/tool-runtime/ops-ledger-runtimes.ts

@@ -0,0 +1,84 @@
+// ── Ops-ledger tool runtimes (우편 msg · 판 release checklist) ──
+//
+// Registers the eight in-process ledger tools with the tool-runtime
+// layer so every surface (skill-runner, TUI) can call them by name:
+// MsgList / MsgPost / MsgAck and ChecklistList / ChecklistAdd /
+// ChecklistSet / ChecklistEdit / ChecklistMove. Dispatchers live in
+// src/skills/tools/ops-ledger.ts; this file is a thin adapter — the
+// same pattern as team-tool-runtimes.ts. Every call goes through
+// `observeLedgerCall` — one `ops-ledger` `call` line with the tool, the
+// elapsed ms, ok, the seat actor and ids (never bodies or evidence).
+
+import {
+  buildMsgListTool, dispatchMsgList,
+  buildMsgPostTool, dispatchMsgPost,
+  buildMsgAckTool, dispatchMsgAck,
+  buildChecklistListTool, dispatchChecklistList,
+  buildChecklistAddTool, dispatchChecklistAdd,
+  buildChecklistSetTool, dispatchChecklistSet,
+  buildChecklistMoveTool, dispatchChecklistMove,
+  buildChecklistEditTool, dispatchChecklistEdit,
+  type ChecklistAddResult, type ChecklistEditResult, type ChecklistListResult, type ChecklistMoveResult,
+  type ChecklistSetResult, type MsgAckResult, type MsgListResult, type MsgPostResult,
+  observeLedgerCall,
+} from '../skills/tools/ops-ledger.js';
+import type { ToolRuntime } from './types.js';
+
+export const msgListRuntime: ToolRuntime<Record<string, unknown>, MsgListResult> = {
+  id: 'msg_list',
+  spec: buildMsgListTool(),
+  async run(req) { return observeLedgerCall('MsgList', req, () => dispatchMsgList(req), (a, r) => ({ to: a.to, ...(r ? { count: r.count, after: r.after } : {}) })); },
+};
+
+export const msgPostRuntime: ToolRuntime<Record<string, unknown>, MsgPostResult> = {
+  id: 'msg_post',
+  spec: buildMsgPostTool(),
+  async run(req) { return observeLedgerCall('MsgPost', req, () => dispatchMsgPost(req), (a, r) => ({ from: a.from, to: a.to, ...(r ? { id: r.message.id } : {}) })); },
+};
+
+export const msgAckRuntime: ToolRuntime<Record<string, unknown>, MsgAckResult> = {
+  id: 'msg_ack',
+  spec: buildMsgAckTool(),
+  async run(req) { return observeLedgerCall('MsgAck', req, () => dispatchMsgAck(req), (a, r) => ({ to: a.to, id: a.id, ...(r ? { cursor: r.cursor } : {}) })); },
+};
+
+export const checklistListRuntime: ToolRuntime<Record<string, unknown>, ChecklistListResult> = {
+  id: 'checklist_list',
+  spec: buildChecklistListTool(),
+  async run(req) { return observeLedgerCall('ChecklistList', req, () => dispatchChecklistList(req), (a, r) => ({ version: r?.version ?? a.version, ...(r ? { items: r.items.length, history: r.history.length } : {}) })); },
+};
+
+export const checklistAddRuntime: ToolRuntime<Record<string, unknown>, ChecklistAddResult> = {
+  id: 'checklist_add',
+  spec: buildChecklistAddTool(),
+  async run(req) { return observeLedgerCall('ChecklistAdd', req, () => dispatchChecklistAdd(req), (a, r) => ({ id: a.id, version: r?.version ?? a.version })); },
+};
+
+export const checklistSetRuntime: ToolRuntime<Record<string, unknown>, ChecklistSetResult> = {
+  id: 'checklist_set',
+  spec: buildChecklistSetTool(),
+  async run(req) { return observeLedgerCall('ChecklistSet', req, () => dispatchChecklistSet(req), (a, r) => ({ id: a.id, version: r?.version ?? a.version, ...(a.status === undefined ? {} : { status: a.status }) })); },
+};
+
+export const checklistEditRuntime: ToolRuntime<Record<string, unknown>, ChecklistEditResult> = {
+  id: 'checklist_edit',
+  spec: buildChecklistEditTool(),
+  async run(req) { return observeLedgerCall('ChecklistEdit', req, () => dispatchChecklistEdit(req), (a, r) => ({ id: a.id, version: r?.version ?? a.version, field: a.field })); },
+};
+
+export const checklistMoveRuntime: ToolRuntime<Record<string, unknown>, ChecklistMoveResult> = {
+  id: 'checklist_move',
+  spec: buildChecklistMoveTool(),
+  async run(req) { return observeLedgerCall('ChecklistMove', req, () => dispatchChecklistMove(req), (a) => ({ id: a.id, from: a.from, to: a.to })); },
+};
+
+export const ALL_OPS_LEDGER_RUNTIMES: ToolRuntime<any, any>[] = [
+  msgListRuntime,
+  msgPostRuntime,
+  msgAckRuntime,
+  checklistListRuntime,
+  checklistAddRuntime,
+  checklistSetRuntime,
+  checklistEditRuntime,
+  checklistMoveRuntime,
+];

package/src/tool-runtime/ref-consult-runtime.ts

@@ -23,7 +23,7 @@ import { join } from 'node:path';
 import { homedir } from 'node:os';
 import type { LLMToolSpec } from '../llm.js';
 import type { ToolRuntime, ToolRuntimeContext } from './types.js';
-import { DEFAULT_REFERENCE_ROOTS } from '../agent/ref-grounding.js';   // ★ F3 — 로컬 canonical ref 루트
+import { DEFAULT_REFERENCE_ROOTS, denyNonPublicReference } from '../agent/ref-grounding.js';   // ★ F3 — 로컬 canonical ref 루트
 import { debug } from '../debug/log.js';
 
 const CACHE_ROOT_DEFAULT = join(homedir(), '.cache', 'elanous-refs');
@@ -123,6 +123,17 @@ export function dispatchRefConsult(
 ): RefConsultResult {
   const host = args.host ?? 'github.com';
   const cacheRoot = args.cacheRoot ?? CACHE_ROOT_DEFAULT;
+  // 대표 2026-10-14 — 비공개 소스(Claude Code 사본)는 캐시·로컬 ref 어느 쪽이든 조회하지 않는다.
+  //   owner·repo 는 단일 경로 성분이어야 한다 — `<사본 이름>/.` 같은 값이 join() 정규화로 이름 판정을 우회하지 못하게.
+  for (const [field, value] of [['owner', args.owner], ['repo', args.repo]] as const) {
+    if (!/^[A-Za-z0-9._-]+$/.test(value) || value === '.' || value === '..') {
+      throw new Error(`RefConsult: ${field} must be a single path segment (got ${JSON.stringify(value)})`);
+    }
+  }
+  //   판정은 `repo` 칸만 — 공개 저장소 owner 이름이 우연히 같아도 막지 않는다(로컬 중첩 경로는 아래에서 따로 거른다).
+  if (denyNonPublicReference(args.repo)) {
+    throw new Error(`RefConsult: ${args.owner}/${args.repo} is a non-public source and is not consulted. Use public documentation instead.`);
+  }
   // ★ F3(2026-07-22) — repo 경로 해석을 fallback 체인으로: ①에이전트 scratch 캐시(SyncRepo 산출·있으면 우선)
   //   → ②로컬 canonical ref(~/source/ref/<repo>·flat bare-name·재클론 없이 90 repo 즉시 grep) → ③둘 다 없으면
   //   throw. 종전엔 캐시만 봐서 캐시 미존재 시 canonical ref 가 놀아도 "SyncRepo 먼저" 로 죽던 단절을 연결.
@@ -133,7 +144,11 @@ export function dispatchRefConsult(
   if (!existsSync(join(cachePath, '.git'))) {
     const roots = args.referenceRoots ?? DEFAULT_REFERENCE_ROOTS;
     const localHit = roots
-      .flatMap((root) => [join(root, args.repo), join(root, args.owner, args.repo)])
+      .flatMap((root) => [
+        join(root, args.repo),
+        // 로컬 ref 의 <owner>/<repo> 중첩은 owner 디렉터리가 비공개 사본이면 그 아래로 내려가지 않는다.
+        ...(denyNonPublicReference(args.owner) ? [] : [join(root, args.owner, args.repo)]),
+      ])
       .find((p) => existsSync(join(p, '.git')));
     if (localHit) { repoPath = localHit; source = 'local-ref'; }
     else {

package/src/tool-runtime/run-shell-runtime.ts

@@ -31,6 +31,9 @@ export const runShellRuntime: ToolRuntime<Record<string, unknown>, RunShellDispa
       ctx.surface === 'dashboard' && req.sandbox === undefined
         ? { ...req, sandbox: 'auto' }
         : req;
-    return dispatchRunShell(effectiveReq, { signal: ctx.signal });
+    return dispatchRunShell(effectiveReq, {
+      signal: ctx.signal,
+      availableToolNames: ctx.agentHostTools?.map(tool => tool.name),
+    });
   },
 };

package/src/tool-runtime/self-cognition-runtimes.ts

@@ -195,7 +195,11 @@ export const SELF_COGNITION_RUNTIMES: readonly ToolRuntime[] = SELF_COGNITION_TO
     return coreSpec(name);
   },
   run: async (args, ctx) => name === 'context_now'
-    ? (await import('../context-bus/context-now.js')).contextNow({ ...(typeof args.topic === 'string' ? { topic: args.topic } : {}) })
+    ? (() => {
+      const options = { ...(typeof args.topic === 'string' ? { topic: args.topic } : {}) };
+      return import('../context-bus/context-now.js').then(now => ctx.surface === 'tui'
+        ? now.contextNowInWorker(options) : now.contextNow(options));
+    })()
     : name === 'memory_recall' || name === 'self_recall'
       ? runRecall(name, args, ctx)
       : toToolRunResult(await coreTools().buildCoreTools().dispatch(name, args)),

package/src/tui.ts

@@ -965,6 +965,11 @@ export function injectKey(key: Key): boolean {
   return true;
 }
 
+/** 아직 readKey 가 소비하지 않은 키 수 — 외부 입력 대기열이 «사용자 키보다 앞서» 끼어들지 않게 본다. */
+export function pendingKeyCount(): number {
+  return _keyQueue.length;
+}
+
 export function termSize(): { rows: number; cols: number } {
   return { rows: process.stdout.rows || 24, cols: process.stdout.columns || 80 };
 }

package/src/user-config.ts

@@ -1190,6 +1190,8 @@ export interface SelfImplementToolConfig {
    *  Overload failover (OVERLOAD-FAILOVER) may move an unpinned codex child to
    *  grok. A pinned codex provider is never moved. */
   childLlm?: ChildLlmPreferenceConfig;
+  /** Explicit same-provider child escalation map. Absent preserves the existing model ladder. */
+  escalateChild?: Readonly<Record<string, string>>;
   /** SUBSCRIPTION-EXHAUST-REROUTE (0.2.24) — `--child-llm-*` 없이 뜬 Pod 구현 자식의 기본 모델.
    *  `{ provider, model? }` · `'off'`(종전 codex 기본). 없으면 `openrouter/z-ai/glm-5.3`. 원값 — `resolvePodChildDefault` 가 검사한다. */
   podChildDefault?: unknown;
@@ -1657,6 +1659,10 @@ export interface DashboardConfig {
    *  Defaults off so optional pane/window controls do not occupy keys
    *  required by essential input, reading, and escape controls. */
   enableSupplementalGlobalKeys: boolean;
+  /** First-screen boot banner. Absent = `minimal`: only failures and first-run
+   *  guidance reach the transcript; healthy daemon/PWA/hitl-port rows move to
+   *  `/status`. `full` restores the historical band. */
+  bootBanner?: 'minimal' | 'full';
 }
 
 export interface DashboardPromptBankConfig {
@@ -2737,6 +2743,11 @@ function parseToolsConfig(raw: unknown): ToolsConfig {
     ? selfImplRaw.autoheal as Record<string, unknown> : undefined;
   // ⛔ 모르는 값은 좁은 쪽(shadow) — 오타가 live 를 켜면 안 된다.
   const autoheal = autohealRaw ? { mode: autohealRaw.mode === 'live' ? 'live' as const : 'shadow' as const } : undefined;
+  const escalateChildRaw = selfImplRaw.escalateChild;
+  const escalateChild = escalateChildRaw && typeof escalateChildRaw === 'object' && !Array.isArray(escalateChildRaw)
+    ? Object.fromEntries(Object.entries(escalateChildRaw).filter(([from, to]) => from.trim() && typeof to === 'string' && to.trim())
+      .map(([from, to]) => [from.trim(), (to as string).trim()])) as Record<string, string>
+    : undefined;
   // ⭐ 관측(리뷰 should-fix) — 오타/비-boolean 은 기본값(ON)으로 수렴하는데, 그게 조용하면
   //   "껐다고 믿었는데 자동 개설되는" 운영 사고가 된다. 값이 **있는데 boolean 이 아닐 때만**
   //   경고한다(부재는 정상). 로거 대신 stderr — 이 파일의 기존 경고와 동형(부트 시점·의존 0).
@@ -2772,7 +2783,7 @@ function parseToolsConfig(raw: unknown): ToolsConfig {
     runDevHarness,
     selfOrchestrate,
     nativeStructure,
-    selfImplement: { worktreeRoot, childInstanceMode, prApprovalDelivery, observeOnly, goalRecordInDoc, goalAuthorPersistentGrounding, fabricDecompose, fabricDecomposeAutoPathThreshold, autoOpenPr, draftOnStop, salvageRetention, autoStop, autoAssist, screenStallTermination, reworkBudget, decompositionShadow, clarificationEscalation, ...(childLlm ? { childLlm } : {}), ...(selfImplRaw.podChildDefault !== undefined ? { podChildDefault: selfImplRaw.podChildDefault } : {}), ...(runTtlHours !== undefined ? { runTtlHours } : {}), ...(draftSweepCloseCap !== undefined ? { draftSweepCloseCap } : {}), ...(runTtl ? { runTtl } : {}), ...(autoheal ? { autoheal } : {}) },
+    selfImplement: { worktreeRoot, childInstanceMode, prApprovalDelivery, observeOnly, goalRecordInDoc, goalAuthorPersistentGrounding, fabricDecompose, fabricDecomposeAutoPathThreshold, autoOpenPr, draftOnStop, salvageRetention, autoStop, autoAssist, screenStallTermination, reworkBudget, decompositionShadow, clarificationEscalation, ...(childLlm ? { childLlm } : {}), ...(escalateChild && Object.keys(escalateChild).length ? { escalateChild } : {}), ...(selfImplRaw.podChildDefault !== undefined ? { podChildDefault: selfImplRaw.podChildDefault } : {}), ...(runTtlHours !== undefined ? { runTtlHours } : {}), ...(draftSweepCloseCap !== undefined ? { draftSweepCloseCap } : {}), ...(runTtl ? { runTtl } : {}), ...(autoheal ? { autoheal } : {}) },
   };
 }
 
@@ -3330,7 +3341,8 @@ export interface AutoReviewConfig {
   };
 }
 
-export type ModelRole = 'implement' | 'review' | 'research' | 'planning' | 'audit' | 'classify' | 'graph-grow';
+export type ModelRole = 'implement' | 'review' | 'research' | 'planning' | 'audit' | 'classify' | 'graph-grow' | 'coordinator' | 'guardian';
+export type AgentModelRole = 'coordinator' | 'guardian';
 
 export interface RoleModelConfig {
   implement?: string;
@@ -3340,6 +3352,8 @@ export interface RoleModelConfig {
   audit?: string;
   classify?: string;
   'graph-grow'?: string;
+  coordinator?: string;
+  guardian?: string;
 }
 
 /** Sparse provider-agnostic model tier preferences by execution role. */
@@ -3422,6 +3436,10 @@ export const ROLE_MODEL_DEFAULTS: Record<ModelRole, { environment: string; tier:
   audit: { environment: 'ELANOUS_MEMORY_JUDGE_MODEL', tier: 'better' },
   classify: { environment: 'ELANOUS_ACTION_CLASSIFIER_MODEL', tier: 'budget' },
   'graph-grow': { environment: 'ELANOUS_GRAPH_GROW_MODEL', tier: 'better' },
+  // 이 티어는 provider 만 명시했을 때 쓰인다. 에이전트 기동은
+  // resolveConfiguredAgentRoleLlm 이 명시 설정을 먼저 요구한다.
+  coordinator: { environment: 'ELANOUS_COORDINATOR_MODEL', tier: 'balanced' },
+  guardian: { environment: 'ELANOUS_GUARDIAN_MODEL', tier: 'balanced' },
 };
 
 /** Resolve `auto` through the same runtime provider selector that dispatches LLM calls.
@@ -3576,6 +3594,24 @@ export function resolveRoleLlm(role: ModelRole, opts: RoleLlmResolveOptions = {}
   return baseline;
 }
 
+/** 조율자·수호자는 사용자 선택이 없으면 기동하지 않는다.
+ *  일반 역할의 기본 모델 사다리와 구분해, 발사 인자·env pin·roleLlm 설정 중
+ *  실제 모델 선택(provider/tier/model)이 있을 때만 해석한다. effort 단독은 선택이 아니다. */
+export function resolveConfiguredAgentRoleLlm(
+  role: AgentModelRole,
+  opts: RoleLlmResolveOptions = {},
+): RoleLlmResolution | undefined {
+  const config = opts.config ?? getUserConfig();
+  const hasSelection = (spec: RoleLlmSpec | undefined): boolean =>
+    Boolean(spec?.provider || spec?.tier || spec?.model?.trim());
+  const configured = [
+    (opts.overrides ?? launchRoleLlmOverrides)?.[role],
+    roleLlmEnvPin(role, opts.env ?? process.env),
+    config.roleLlm?.[role],
+  ].some(hasSelection);
+  return configured ? resolveRoleLlm(role, { ...opts, config }) : undefined;
+}
+
 /** POD-ROLE-LLM — 역할 고정을 «프로세스 env» 로 받는 칸. `ELANOUS_ROLE_LLM_<ROLE>` = RoleLlmSpec JSON
  *  (예 `{"provider":"openai-codex","tier":"best","model":"gpt-6-sol"}`).
  *  ⭐ 왜 env 인가: `--role-llm` 은 부모 프로세스 메모리 값이고 Pod 안엔 운영 config 가 없다 —
@@ -3833,9 +3869,9 @@ export interface UserConfig {
   /** GUARD-ONE-a: omitted means shadow. `live` is parsed for the later cutover, but `elanous guardian tick`
    *  refuses it until a human-confirmed operational change (GUARD-ONE-a ships shadow only). */
   guardian?: { mode?: 'shadow' | 'live'; /** Orphan CLI GC on the guardian tick: off = no ps collection, shadow (default) = evidence only, on = evidence then SIGTERM. */ orphanGc?: 'off' | 'shadow' | 'on' };
-  /** TA-JUDGE-LIVE-SAFE: task-agent judge moves executed for real. Only `review` · `propose-green` are honoured
-   *  (`src/task-agent/live-moves.ts` drops anything else with a warning). Absent = env ELANOUS_TASK_AGENT_LIVE_MOVES, else none (pure shadow). */
-  taskAgent?: { liveMoves?: string[]; /** TA-REJUDGE-PERIODIC — steward tick runs `tasks rejudge --all` every N minutes (absent/0 = off). */ rejudgeEveryMinutes?: number; /** 1-minute load average above which that tick is skipped (default 60). */ rejudgeMaxLoad?: number; parentHost?: { host?: string; cwd?: string; elanous?: string; configDir?: string; podPool?: string; approvalCapacity?: number } | Array<{ host?: string; cwd?: string; elanous?: string; configDir?: string; podPool?: string; approvalCapacity?: number }> };
+  /** Task-agent live move allow-list (`src/task-agent/live-moves.ts` validates its vocabulary).
+   *  Absent = env ELANOUS_TASK_AGENT_LIVE_MOVES, else none (pure shadow). */
+  taskAgent?: { liveMoves?: string[]; /** TA-REJUDGE-PERIODIC — steward tick runs `tasks rejudge --all` every N minutes (absent/0 = off). */ rejudgeEveryMinutes?: number; /** 1-minute load average above which that tick is skipped (default 60). */ rejudgeMaxLoad?: number; /** TA-REPAIR-TICK-CAP — new repair launches per `tasks rejudge --all` (default 3, 0 = none). */ repairMaxPerTick?: number; parentHost?: { host?: string; cwd?: string; elanous?: string; configDir?: string; podPool?: string; approvalCapacity?: number } | Array<{ host?: string; cwd?: string; elanous?: string; configDir?: string; podPool?: string; approvalCapacity?: number }> };
   events?: EventsConfig;
   /** GATE-REMOTE — see GateRemoteConfig. Absent = defaults (auto on · node-b · load 20 · cap 2). */
   gateRemote?: GateRemoteConfig;
@@ -4039,7 +4075,7 @@ export function parseRoleLlmEntry(raw: unknown): { ok: true; spec: RoleLlmSpec }
   return { ok: true, spec };
 }
 
-export const MODEL_ROLES: readonly ModelRole[] = ['implement', 'review', 'research', 'planning', 'audit', 'classify', 'graph-grow'];
+export const MODEL_ROLES: readonly ModelRole[] = ['implement', 'review', 'research', 'planning', 'audit', 'classify', 'graph-grow', 'coordinator', 'guardian'];
 
 export function isModelRole(v: unknown): v is ModelRole {
   return typeof v === 'string' && (MODEL_ROLES as readonly string[]).includes(v);
@@ -4147,13 +4183,18 @@ function parseTaskAgentConfig(raw: unknown): UserConfig['taskAgent'] {
   }
   const parentHost = parseTaskAgentParentHost((raw as Record<string, unknown>).parentHost);
   // TA-REJUDGE-PERIODIC — 음이 아닌 유한수만 산다(0 = 끔). 그 밖은 경고하고 버린다(= 끔 · 기본 부하 상한).
-  const rejudge: { rejudgeEveryMinutes?: number; rejudgeMaxLoad?: number } = {};
+  const rejudge: { rejudgeEveryMinutes?: number; rejudgeMaxLoad?: number; repairMaxPerTick?: number } = {};
   for (const key of ['rejudgeEveryMinutes', 'rejudgeMaxLoad'] as const) {
     const value = (raw as Record<string, unknown>)[key];
     if (value === undefined) continue;
     if (typeof value === 'number' && Number.isFinite(value) && value >= 0) rejudge[key] = value;
     else warnUserConfigDrop(`taskAgent.${key}`, `음이 아닌 수가 아니다(${JSON.stringify(value)}) — 버림`);
   }
+  const repairMaxPerTick = (raw as Record<string, unknown>).repairMaxPerTick;
+  if (repairMaxPerTick !== undefined) {
+    if (Number.isSafeInteger(repairMaxPerTick) && (repairMaxPerTick as number) >= 0) rejudge.repairMaxPerTick = repairMaxPerTick as number;
+    else warnUserConfigDrop('taskAgent.repairMaxPerTick', `음이 아닌 정수가 아니다(${JSON.stringify(repairMaxPerTick)}) — 기본 3`);
+  }
   const extras = { ...rejudge, ...(parentHost ? { parentHost } : {}) };
   const liveMoves = (raw as Record<string, unknown>).liveMoves;
   if (liveMoves === undefined) return Object.keys(extras).length ? extras : undefined;
@@ -4254,6 +4295,10 @@ function parseRoleLlmConfig(raw: unknown): RoleLlmConfig | undefined {
         if (effort === 'low' || effort === 'medium' || effort === 'high') spec.effort = effort;
         else warnUserConfigDrop(`roleLlm.${role}.effort`, `low|medium|high 가 아니다(${JSON.stringify(effort)}) — 버림`);
       }
+      if ((role === 'coordinator' || role === 'guardian') && !spec.provider && !spec.tier && !spec.model) {
+        dropped.push({ role, reason: 'provider·tier·model 중 하나는 있어야 한다 (effort 단독은 기동 설정이 아니다)' });
+        continue;
+      }
       if (Object.keys(spec).length > 0) parsed[role] = spec;
     } else {
       const entry = parseRoleLlmEntry(rawEntry);
@@ -4268,6 +4313,11 @@ function parseRoleLlmConfig(raw: unknown): RoleLlmConfig | undefined {
   //   사용자는 「왜 내 설정이 안 먹지」를 영영 못 푼다(CLI 는 이름을 대며 거부하는데 여기만 조용했다).
   //   ⇒ 버린 것을 «이름과 이유»로 남긴다. 로딩 자체는 계속한다.
   if (dropped.length > 0) {
+    for (const { role, reason } of dropped) {
+      if (role === 'coordinator' || role === 'guardian') {
+        warnUserConfigDrop(`roleLlm.${role}`, `${reason} — 버림; 명시 모델 없이는 에이전트 기동 거부`);
+      }
+    }
     try {
       // eslint-disable-next-line @typescript-eslint/no-require-imports
       const { debug } = require('./debug/log.js') as typeof import('./debug/log.js');
@@ -5715,6 +5765,7 @@ export function buildUserConfig(path: string = defaultPath()): UserConfig {
         ? dash.foldMode
         : 'task-unit',
       benchmark: dash.benchmark === true ? true : undefined,
+      bootBanner: dash.bootBanner === 'minimal' || dash.bootBanner === 'full' ? dash.bootBanner : undefined,
       enableVirtualWindowSwitchKeys: dash.enableVirtualWindowSwitchKeys === true,
       enableSupplementalGlobalKeys: dash.enableSupplementalGlobalKeys === true,
       promptBank: {
@@ -6528,6 +6579,9 @@ export function saveUserConfig(
       answerPriority: cfg.llm.answerPriority,
       maxTurns: cfg.llm.maxTurns,
       missionRouting: cfg.llm.missionRouting,
+      // ⛔ 로드(parseLlmRoutePolicy)만 있고 저장이 없으면 `config set llm.routePolicy` 가 «조용히» 떨어진다
+      //   (10-14 OP 실측 — set 뒤 get 이 undefined · TUI-MODEL-SESSION-SCOPE ①).
+      routePolicy: cfg.llm.routePolicy,
     }),
     skills: stripUndef({
       activeSet: cfg.skills.activeSet,
@@ -6691,6 +6745,7 @@ export function saveUserConfig(
       promptBank: cfg.dashboard.promptBank,
       foldMode: cfg.dashboard.foldMode,
       benchmark: cfg.dashboard.benchmark,
+      bootBanner: cfg.dashboard.bootBanner,
       enableVirtualWindowSwitchKeys: cfg.dashboard.enableVirtualWindowSwitchKeys,
       enableSupplementalGlobalKeys: cfg.dashboard.enableSupplementalGlobalKeys,
     }),

package/src/ux-sim/fake-llm.ts

@@ -0,0 +1,29 @@
+/**
+ * Deterministic, network-free LLM for gate tests without provider credentials.
+ * The opt-in is deliberately explicit; production never selects this provider.
+ */
+import type { LLMMessage, LLMOpts, LLMProvider, LLMStreamEvent } from '../llm.js';
+
+export const TEST_FAKE_LLM_ENV = 'ELANOUS_TEST_FAKE_LLM';
+export const TEST_FAKE_LLM_RESPONSE_ENV = 'ELANOUS_TEST_FAKE_LLM_RESPONSE';
+
+export function testFakeLlmEnabled(): boolean {
+  return process.env[TEST_FAKE_LLM_ENV] === '1';
+}
+
+export function testFakeLlmResponse(): string {
+  return process.env[TEST_FAKE_LLM_RESPONSE_ENV] ?? '[test-fake-llm] OK';
+}
+
+/** Shares the real LLMProvider contract; only the external model call is replaced. */
+export const testFakeLlmProvider: LLMProvider = {
+  name: 'test-fake-llm',
+  defaultModel: 'test-fake-llm',
+  available: testFakeLlmEnabled,
+  async *chat(_messages: LLMMessage[], _opts?: LLMOpts): AsyncGenerator<string, void, unknown> {
+    yield testFakeLlmResponse();
+  },
+  async *streamChat(_messages: LLMMessage[], _opts?: LLMOpts): AsyncGenerator<LLMStreamEvent, void, unknown> {
+    yield { type: 'text', delta: testFakeLlmResponse() };
+  },
+};

package/src/ux-sim/fault-sqlite-busy.ts

@@ -0,0 +1,50 @@
+// SQLite의 실제 write lock 아래에서 LogStore.insertBatch의 busy 버퍼와 복구를 관측한다.
+import { Database } from 'bun:sqlite';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { LogStore } from '../mss/logging/log-store.js';
+
+export interface SqliteBusyObservation {
+  readonly busy: boolean;
+  readonly beforeRelease: number;
+  readonly afterRelease: number;
+  readonly events: string[];
+}
+
+export function simSqliteBusy(): SqliteBusyObservation {
+  const dir = mkdtempSync(join(tmpdir(), 'ux-sim-sqlite-busy-'));
+  const path = join(dir, 'logs.db');
+  let store: LogStore | undefined;
+  let locker: Database | undefined;
+  try {
+    store = new LogStore(path, { instance: 'ux-sim' });
+    locker = new Database(path);
+    locker.run('BEGIN IMMEDIATE');
+    const rec = (event: string) => ({ rec: { ts: new Date().toISOString(), category: 'ux-sim.sqlite', event }, surface: 'ux-sim' });
+    let busy = false;
+    try { store.insertBatch([rec('locked')]); }
+    catch (error) {
+      if (!/SQLITE_BUSY|database is locked/i.test(String(error))) throw error;
+      busy = true;
+    }
+    const beforeRelease = store.count();
+    locker.run('ROLLBACK');
+    store.insertBatch([rec('recovered')]);
+    const events = store.query({ exactCategories: ['ux-sim.sqlite'] }).map((row) => row.event);
+    return { busy, beforeRelease, afterRelease: store.count(), events };
+  } finally {
+    try { locker?.run('ROLLBACK'); } catch { /* transaction already ended */ }
+    locker?.close();
+    store?.close();
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+export function renderSqliteBusy(result: SqliteBusyObservation): string[] {
+  return [
+    'sqlite-busy · 실제 SQLite write lock → LogStore.insertBatch 재시도',
+    `  SQLite busy=${result.busy} · 잠금 중 행=${result.beforeRelease} · 해제 후 행=${result.afterRelease}`,
+    `  복구된 이벤트=${result.events.join(', ')}`,
+  ];
+}