elanous 0.2.28 → 0.2.29

package/src/acp/core-turn-bridge.ts

@@ -35,7 +35,8 @@
 // Core really can run headless.
 
 import type { LLMMessage, LLMToolSpec, ContentBlock } from '../llm.js';
-import { debug } from '../debug/log.js';
+import { debug, redactSecretText } from '../debug/log.js';
+import { CoreTurnAuthRejectedError } from '../core-turn/auth-rejected-notice.js';
 import {
   runCoreTurn,
   runGoalLoop,
@@ -49,20 +50,25 @@ import type { AcpServerOptions, AcpTurnContext } from './server.js';
 import { acpToolDenialResult } from './tool-approval.js';
 import { readOriginSessionMeta } from './origin-session-meta.js';
 import { isFactQuestion } from './fact-question.js';
-import { classifyTuiChatIntent, type TuiChatRoute } from '../core-turn/short-question.js';
+import { classifyTuiChatIntent, formatTuiRouteLine, type TuiChatRoute } from '../core-turn/short-question.js';
 import { HARNESS_ROLE_ENV } from '../harness/harness-space.js';
 
 const FACT_QUESTION_INSTRUCTION = '사실·최신 정보 질문이다. WebSearch 를 1~2회 쓰고 검색 결과(제목·스니펫·URL)로 답하라. 출처 링크를 붙여라. 셸·브라우저·파일 도구는 검색 결과로 부족할 때만. 도구 예산에 닿으면 지금까지 근거로 답하고 끝에 «더 찾아볼까요?»를 붙여라.';
 
+// 읽기·분석 keeps every tool (it reads files and state) and only leaves the goal loop.
+type QuickTuiRoute = Exclude<TuiChatRoute, '코딩·구현' | '읽기·분석'>;
+
 // An allowlist, not a denylist: a new repository writer cannot slip into a quick turn.
-const QUICK_TOOLS: Record<Exclude<TuiChatRoute, '코딩·구현'>, readonly string[]> = {
+// memory_recall is read-only and on every quick route: the self-access discipline (agent/self-ambient.ts) tells
+// every turn to recall before judging, so a route without it asked for a tool it could not call (TUI-SEAT-MEMORY-SCOPE).
+const QUICK_TOOLS: Record<QuickTuiRoute, readonly string[]> = {
   '조회': ['decisions_pending', 'ops_seats', 'ops_status', 'release_status', 'logs_query', 'context_now', 'memory_recall', 'Read'],
-  '설정 변경': ['DashboardConfigGet', 'DashboardConfigSet', 'LlmListAvailableModels', 'prompt_getRuntimeConfig', 'prompt_setRuntimeConfig', 'view_getConfig', 'view_applyRuntimeConfig', 'view_saveConfig'],
-  '조사': ['WebSearch', 'OmniSearch', 'Grep', 'Glob', 'Read', 'fact_check'],
-  '상시 일': ['schedule_manage', 'schedule_list', 'schedule_create', 'schedule_update', 'session_manage', 'ops_status'],
+  '설정 변경': ['DashboardConfigGet', 'DashboardConfigSet', 'LlmListAvailableModels', 'prompt_getRuntimeConfig', 'prompt_setRuntimeConfig', 'view_getConfig', 'view_applyRuntimeConfig', 'view_saveConfig', 'memory_recall'],
+  '조사': ['WebSearch', 'OmniSearch', 'Grep', 'Glob', 'Read', 'fact_check', 'memory_recall'],
+  '상시 일': ['schedule_manage', 'schedule_list', 'schedule_create', 'schedule_update', 'session_manage', 'ops_status', 'memory_recall'],
 };
 
-export function toolsForTuiRoute(tools: readonly LLMToolSpec[], route: Exclude<TuiChatRoute, '코딩·구현'>): LLMToolSpec[] {
+export function toolsForTuiRoute(tools: readonly LLMToolSpec[], route: QuickTuiRoute): LLMToolSpec[] {
   const preferred = QUICK_TOOLS[route];
   return preferred.flatMap((name) => tools.filter((tool) => tool.name === name));
 }
@@ -155,6 +161,10 @@ export function acpApprovalGatedDispatch(
   };
 }
 
+/** 사용자 답에서 뺀 검증 보충을 로그에 남길 때 한 조각의 글자 수 — 로그 저장의 문자열 상한
+ *  (`compactForLog` stringMax 256)보다 작아야 조각이 저장 중에 안 잘린다(리뷰 r4). */
+const FINAL_SUPPLEMENT_LOG_CHUNK = 240;
+
 /** Extract the trailing assistant message text from runCoreTurn's
  *  `newMessages` array. emitTurnComplete (src/llm.ts:3835) appends
  *  `{role:'assistant', content:[{type:'text', text:finalAssistantText}]}`
@@ -223,7 +233,7 @@ export function bridgeCoreTurnToAcp(
             hasAttachments: turnCtx.promptBlocks?.some((block) => block.type !== 'text') ?? false,
           })
         : { route: '코딩·구현' as const, reason: harness ? 'harness' : 'legacy', goalLoop: true };
-      const tools = !route.goalLoop && route.route !== '코딩·구현'
+      const tools = !route.goalLoop && route.route !== '코딩·구현' && route.route !== '읽기·분석'
         ? toolsForTuiRoute(availableTools, route.route)
         : availableTools;
       if (deps.tuiRouting) {
@@ -231,12 +241,27 @@ export function bridgeCoreTurnToAcp(
         // Only a quick route is announced: a coding turn's transcript stays exactly as before (preservation).
         // Awaited so the route line precedes the answer; a failed write is observed, not fatal to the turn.
         if (!route.goalLoop) {
-          try { await turnCtx.push(`라우팅: ${route.route}\n`); }
+          try { await turnCtx.push(formatTuiRouteLine(route.route)); }
           catch (error) { debug.log('chat.route', 'push-failed', { route: route.route, error: String(error) }); }
         }
       }
       const modelOverride = deps.resolveModel?.({ sessionId: turnCtx.sessionId, userText: turnCtx.userText });
-      const factQuestion = isFactQuestion(turnCtx.userText);
+      // Tier 2 arming(config-gated·2026-07-19 goal-exec → 아크4 전-family) — llm.goalLoop.enabled
+      // 면 across-turn goal loop(runGoalLoop)로 감싸 목표 완료(update_goal 증거게이트)까지 지속·
+      // continuation 재주입. **family 무관**(runGoalLoop 프롬프트·update_goal 툴 전부 provider-generic·
+      // 백스톱=max-iter·spin·blocked-3strike·context-pressure). 그 외엔 단일 turn(runCoreTurn).
+      // 하드코딩 기본 ON 아님 — config 로 아밍(안전).
+      const goalLoopCfg = getUserConfig().llm.goalLoop;
+      const armGoalLoop = goalLoopCfg?.enabled === true && route.goalLoop;
+      // 사실 질문 예산은 «단일 턴» 전용이다 — goal loop 와 겹치면 예산을 다 쓴 뒤에도 루프가 계속 재촉해
+      // 매 continuation 이 «Tool budget reached» 로 거부되고, 모델은 그것을 도구 장애로 읽어 blocked 를 남긴다
+      // (10-14 13:48 운영 TUI OP: route short-question·goalLoop ⊕ factQuestion → 소진 뒤 헛호출 7회).
+      const factShaped = isFactQuestion(turnCtx.userText);
+      const factQuestion = factShaped && !armGoalLoop;
+      if (factShaped && armGoalLoop) {
+        try { debug.log('chat.turn', 'fact-budget-skipped', { reason: 'goal-loop-armed', route: route.route }); }
+        catch { /* observation cannot interrupt a turn */ }
+      }
       const explicitMaxToolTurns = deps.resolveMaxToolTurns?.({ sessionId: turnCtx.sessionId });
       const maxToolTurns = explicitMaxToolTurns ?? (factQuestion ? getUserConfig().chat.factQuestion.maxToolTurns : undefined);
       const turnMessages: LLMMessage[] = factQuestion
@@ -262,15 +287,12 @@ export function bridgeCoreTurnToAcp(
       // `delta=''` (synthesizedText lost to ACP). The dashboard never
       // saw the substantive answer — only the streamed narration.
       let streamedTextSum = '';
-      // Tier 2 arming(config-gated·2026-07-19 goal-exec → 아크4 전-family) — llm.goalLoop.enabled
-      // 면 across-turn goal loop(runGoalLoop)로 감싸 목표 완료(update_goal 증거게이트)까지 지속·
-      // continuation 재주입. **family 무관**(runGoalLoop 프롬프트·update_goal 툴 전부 provider-generic·
-      // 백스톱=max-iter·spin·blocked-3strike·context-pressure). 그 외엔 단일 turn(runCoreTurn).
-      // 하드코딩 기본 ON 아님 — config 로 아밍(안전). turnFamily 는 관측용으로만 유지.
-      const goalLoopCfg = getUserConfig().llm.goalLoop;
+      // 런타임이 최종 답 꼬리에 붙인 검증 보충(변경 파일·검증 최신성·루프 마감 상태 — goal loop 내부 판정).
+      // 사용자 답에서는 빼고 로그로 보낸다(TUI 결함 #25). 코어 턴이 끝날 때마다(goal loop 반복 경계) 비운다.
+      let finalSupplement: { answer: string; supplement: string; finalText: string } | null = null;
+      // turnFamily 는 관측용으로만 유지(goal loop 아밍 판정은 위 사실 질문 판정 앞에서 한다).
       const turnModel = modelOverride ?? getUserConfig().llm.model;
       const turnFamily = getModelFamily(turnModel);
-      const armGoalLoop = goalLoopCfg?.enabled === true && route.goalLoop;
       if (armGoalLoop) {
         // 관측 — 어느 family/모델에서 across-turn goal-loop 가 아밍됐나(전-family 개방 검증).
         debug.log('goal.loop', 'arm', { family: turnFamily, model: turnModel });
@@ -326,7 +348,7 @@ export function bridgeCoreTurnToAcp(
             return approvedDispatch(name, args, dispatchCtx);
           }
         : approvedDispatch;
-      await runTurnDispatch({
+      const dispatchResult = await runTurnDispatch({
         sessionId: turnCtx.sessionId,
         ...(originSessionId ? { originSessionId } : {}),
         ...(turnCtx.userText ? { userText: turnCtx.userText } : {}),
@@ -338,7 +360,11 @@ export function bridgeCoreTurnToAcp(
         ...(maxToolTurns !== undefined ? { maxToolTurns } : {}),
         ...((!factQuestion || explicitMaxToolTurns !== undefined) && deps.budgetGrant !== undefined ? { budgetGrant: deps.budgetGrant } : {}),
         callbacks: {
-          onText: (delta) => {
+          onText: (delta, full) => {
+            // ⛔ 검증 보충이 붙은 최종 답의 재방출(`onText('', 답+보충)`)은 흘리지 않는다 — 빈 청크를 TUI 는
+            //   «확정(commit)»으로 읽어 이미 그린 답을 굳히고, 아래 onTurnComplete 재표면화가 같은 답을
+            //   «한 번 더» 그렸다(TUI 결함 #25 · 10-14 18:36 OPT). 답 표시는 onTurnComplete 가 정한다.
+            if (delta === '' && finalSupplement !== null && full === finalSupplement.finalText) return;
             // Fire-and-forget: ACP `push` is async but the core-turn
             // contract is synchronous onText. Chunks are delivered in
             // order because `sessionUpdate` is serialized per-
@@ -353,6 +379,7 @@ export function bridgeCoreTurnToAcp(
           // callers see today. Fire-and-forget for the same reason
           // onText is: callbacks are synchronous, `turnCtx.push*` is
           // async, ordering is preserved by the SDK.
+          onFinalAnswerSupplement: (info) => { finalSupplement = info; },
           onToolCall: (call) => {
             if (!factQuestion || maxToolTurns === undefined || maxToolTurns <= 0) {
               toolCallCount += 1;
@@ -362,7 +389,8 @@ export function bridgeCoreTurnToAcp(
             void turnCtx.pushToolCall(call);
           },
           onToolResult: (call) => { void turnCtx.pushToolResult(call); },
-          onUsage: (usage) => { void turnCtx.pushUsage(usage); },
+          // 턴 모델(라우팅 결과)을 실어 보낸다 — 대시보드 턴 지표가 설정 모델로 ctx·단가를 잡지 않게.
+          onUsage: (usage) => { void turnCtx.pushUsage({ ...usage, model: usage.model ?? turnModel }); },
           // Codex Responses API reasoning summary stream. Currently
           // surfaced via forensic only (debug.log) — acts as the
           // "did the model actually emit reasoning?" verification
@@ -438,8 +466,15 @@ export function bridgeCoreTurnToAcp(
               visibleFinalText !== null
               && visibleFinalText.length > 0
               && streamedTextSum.endsWith(visibleFinalText);
+            // ⭐ 최종 답 = 모델 답 ⊕ 런타임 검증 보충이면 사용자에겐 «모델 답»만 보인다 — 보충은 로그로(#25).
+            //   대화 이력(completedMessages)엔 그대로 남아 다음 턴 맥락은 바뀌지 않는다.
+            const supplement = finalSupplement !== null && finalAssistantText === finalSupplement.finalText
+              ? finalSupplement
+              : null;
+            finalSupplement = null;
             const needsReSurface =
-              visibleFinalText !== null
+              supplement === null
+              && visibleFinalText !== null
               && visibleFinalText !== streamedTextSum
               && !synthesisAlreadyStreamed
               && !originalFinalStreamed;
@@ -452,9 +487,34 @@ export function bridgeCoreTurnToAcp(
                   && visibleFinalText.startsWith(streamedTextSum),
                 endsWithStreamedTail: synthesisAlreadyStreamed,
                 needsReSurface,
+                supplementChars: supplement?.supplement.length ?? 0,
               });
             }
-            if (originalFinalStreamed) {
+            if (supplement !== null) {
+              const answerStreamed = supplement.answer.length > 0 && streamedTextSum.trimEnd().endsWith(supplement.answer);
+              try {
+                // 보충 «전체»를 남긴다 — 한 행이 저장 전에 잘리지 않게 조각(part/parts)으로 나눈다(리뷰 r3·r4).
+                const redacted = redactSecretText(supplement.supplement);
+                const parts = Math.max(1, Math.ceil(redacted.length / FINAL_SUPPLEMENT_LOG_CHUNK));
+                for (let part = 0; part < parts; part += 1) {
+                  debug.log('acp.turn', 'final-supplement-withheld', {
+                    sessionId: turnCtx.sessionId,
+                    answerChars: supplement.answer.length,
+                    answerStreamed,
+                    supplementChars: supplement.supplement.length,
+                    part: part + 1,
+                    parts,
+                    supplement: redacted.slice(part * FINAL_SUPPLEMENT_LOG_CHUNK, (part + 1) * FINAL_SUPPLEMENT_LOG_CHUNK),
+                  });
+                }
+              } catch { /* observation cannot interrupt a turn */ }
+              if (!answerStreamed && supplement.answer.length > 0) {
+                void turnCtx.push('');
+                void turnCtx.push(needsFollowup ? `${supplement.answer}${followupSuffix}` : supplement.answer);
+              } else if (needsFollowup) {
+                void turnCtx.push(followupSuffix);
+              }
+            } else if (originalFinalStreamed) {
               void turnCtx.push(followupSuffix);
             } else if (needsReSurface) {
               // Emit a clear-then-replace pair so clients that follow
@@ -476,6 +536,22 @@ export function bridgeCoreTurnToAcp(
           },
         },
       });
+      // ⭐ 인증 거절은 코어 턴이 «던지지 않고» 돌려준다 — 여기서 안 읽으면 서버는 end_turn 을 내고
+      //   TUI 엔 «✔ 완료»만 남는다(TUI 결함 #22). 던져서 실패 경로(prompt-failed · 오류 줄)로 보낸다.
+      const stopReason = (dispatchResult as { stopReason?: unknown } | null | undefined)?.stopReason;
+      if (stopReason === 'auth_rejected') {
+        const rawError = (dispatchResult as { errorMessage?: unknown }).errorMessage;
+        const error = new CoreTurnAuthRejectedError(typeof rawError === 'string' ? rawError : undefined);
+        try {
+          debug.log('acp.turn', 'auth-rejected', {
+            sessionId: turnCtx.sessionId,
+            model: turnModel,
+            goalLoop: armGoalLoop,
+            error: error.rawMessage.slice(0, 300),
+          }, { level: 'warn' });
+        } catch { /* observation cannot interrupt a turn */ }
+        throw error;
+      }
     } finally {
       clearInterval(poll);
     }

package/src/acp/elanous-extensions.ts

@@ -79,6 +79,8 @@ export interface ElanousUiUsagePayload {
   /** Opaque correlation id. Dashboard uses `turn:<epoch>` per turn. */
   id: string;
   provider?: 'anthropic' | 'openai';
+  /** 그 턴이 실제로 요청한 모델(라우팅 결과 — 설정 모델과 다를 수 있다). */
+  model?: string;
   inputTokens?: number;
   outputTokens?: number;
   cacheReadInputTokens?: number;

package/src/acp/server.ts

@@ -837,6 +837,7 @@ export interface AcpTurnContext {
    *  didn't advertise `elanous.ui.usage` in its ClientCapabilities. */
   pushUsage: (usage: {
     provider?: 'anthropic' | 'openai';
+    model?: string;
     inputTokens?: number;
     outputTokens?: number;
     cacheReadInputTokens?: number;
@@ -1837,6 +1838,7 @@ function wireAcpConnection(
         const payload: ElanousUiUsagePayload = {
           id: `turn:${Date.now()}`,
           ...(usage.provider !== undefined ? { provider: usage.provider } : {}),
+          ...(usage.model !== undefined ? { model: usage.model } : {}),
           ...(usage.inputTokens !== undefined ? { inputTokens: usage.inputTokens } : {}),
           ...(usage.outputTokens !== undefined ? { outputTokens: usage.outputTokens } : {}),
           ...(usage.cacheReadInputTokens !== undefined

package/src/agent/ref-grounding.ts

@@ -18,6 +18,23 @@ import { debug } from '../debug/log.js';
 /** 로컬 참조 루트(기본 ~/source/ref). 다른 환경엔 없으면 무동작(graceful). */
 export const DEFAULT_REFERENCE_ROOTS = [join(homedir(), 'source', 'ref')];
 
+// 대표 2026-10-14 — 비공개 소스(Claude Code 사본) 통로 차단. Claude Code 는 공개 계약(code.claude.com)만 본다.
+// ref 루트 아래 디렉터리가 실존해도 이 이름이면 그라운딩·조회 대상에서 뺀다(대소문자·`_`/`-` 변형 포함).
+const NON_PUBLIC_REFERENCE_PATTERN = /^claude[-_]?code[-_]?(?:fork|src|source|leak|leaked)$/i;
+
+/** 공개 계약이 아닌 참조 사본 이름인가. `owner/repo` 꼴이면 마지막 칸으로 본다. */
+export function isNonPublicReferenceName(name: string): boolean {
+  const last = name.trim().replace(/\/+$/, '').split('/').pop() ?? '';
+  return NON_PUBLIC_REFERENCE_PATTERN.test(last);
+}
+
+/** 거부 판정 ⊕ 관측 한 줄. 거부면 true. */
+export function denyNonPublicReference(name: string): boolean {
+  if (!isNonPublicReferenceName(name)) return false;
+  try { debug.log('ref.grounding', 'denied', { name, reason: 'non-public-source' }); } catch { /* fail-soft */ }
+  return true;
+}
+
 function expandTilde(p: string): string {
   return p.startsWith('~') ? join(homedir(), p.slice(1)) : p;
 }
@@ -91,6 +108,7 @@ export function localRefGroundingDigest(taskText: string, roots: string[] = DEFA
     if (!existsSync(root)) continue;
     for (const token of tokens) {
       if (seen.has(token)) continue;
+      if (denyNonPublicReference(token)) { seen.add(token); continue; }
       try {
         const path = join(root, token);
         if (statSync(path).isDirectory()) { found.push({ path, root, token }); seen.add(token); }

package/src/agent-substrate/pr-reviewer.ts

@@ -652,6 +652,9 @@ export function buildReviewPrompt(
  *  `none of the tests …`. 표지 낱말로 시작하는 실제 블로커를 지우면 PASS/WARN 리뷰에서 블로커가 사라진다. */
 const NONE_WORD = String.raw`(?:없음|해당\s*없음|n\/a|none|nothing)`;
 const BARE_SENTINEL = new RegExp(String.raw`^${NONE_WORD}\s*[.。]?$`, 'i');
+const DASH_ONLY_SENTINEL = /^[([（【]\s*[-—–]\s*[)\]）】]$/;
+// 목록 항목의 바깥 `- `와 별개로, 리뷰어가 괄호 안에도 장식 대시를 둘 수 있다: `- (- 없음 -)`.
+const DASH_WRAPPED_BRACKETED_SENTINEL = new RegExp(String.raw`^[([（【]\s*(?:[-—–]+\s*)?${NONE_WORD}\s*(?:[-—–]+\s*)?[)\]）】]$`, 'i');
 const BRACKETED_SENTINEL = new RegExp(String.raw`^[([（【]\s*${NONE_WORD}(?:\s*[—–\-:.,;·]\s*([^)\]）】]*))?\s*[)\]）】]$`, 'i');
 // ⭐ 설명 «전체»가 「지적 없음」 한 문장일 때만 — 일부만 맞아도 접으면 `(none: no blockers are checked because …)` 같은 지적이 사라진다.
 const NO_FINDING_REMARK = new RegExp([
@@ -662,41 +665,38 @@ const NO_FINDING_REMARK = new RegExp([
   String.raw`^수용\s*기준(?:을|이)?\s*(?:(?:모두|전부)\s*)?충족(?:함|됨|했다|합니다)?[.。]?$`,
   String.raw`^(?:all\s+)?acceptance\s+criteria\s+(?:are\s+)?(?:all\s+)?met\.?$`,
 ].join('|'), 'i');
-// REVIEW-MUSTFIX-NONE-SENTINEL 후속 — GLM 이 괄호 안에 «무소견 머리 + 긴 근거»를 쓴다(10-11 TC `pr land` 가 `review-must-fix-1` 로 거부):
-//   `(없음 — 수용기준 충족: 머리말에 … 반영됨 …)` · `(없음 — 수용기준 3항 모두 충족: … (\`'failed'\` 반환) · …)`(근거 안에 괄호가 또 있다).
-//   ⭐ 길이 무관 0 은 «머리»가 무소견 서술이고 바로 구분자가 올 때만 — 머리가 결함 서술이면(`(없음 — 하지만 X 가 깨진다)`) 지적으로 남긴다.
-//   ⛔ 근거에 역접·미충족(`하지만`·`다만`·`미충족`·`but`·`except`·`not met` …)이 있으면 보수적으로 지적으로 남긴다.
-const LONG_BRACKETED_SENTINEL = new RegExp(String.raw`^[([（【]\s*${NONE_WORD}\s*[—–\-:·]\s*([\s\S]+?)\s*[)\]）】]$`, 'i');
-const NO_FINDING_HEAD = new RegExp('^(?:' + [
-  String.raw`수용\s*기준(?:\s*\d+\s*(?:항|개|건)(?:목)?)?(?:을|이)?\s*(?:(?:모두|전부)\s*)?충족(?:함|됨|했다|합니다)?`,
-  String.raw`(?:all\s+)?acceptance\s+criteria\s+(?:are\s+)?(?:all\s+)?met`,
-  String.raw`must-?fix\s*(?:항목)?(?:은|는|이|가)?\s*(?:없(?:음|다|습니다)|0\s*건)`,
-  String.raw`(?:no|zero)\s+(?:blocking\s+)?(?:blockers?|must-?fix(?:es)?)(?:\s+found)?`,
-  String.raw`(?:(?:블로커|차단)\s*)?(?:수준의?\s*)?(?:결함|블로커)(?:은|는|이|가)?\s*(?:발견되지\s*않(?:음|았(?:다|습니다)?)|없(?:음|다|습니다))`,
-].join('|') + String.raw`)\s*(?:[:：—–\-·,;.。(]|$)`, 'i');
-const LONG_REMARK_DISSENT = /하지만|그러나|다만|(?<![가-힣])단(?:,|\s)|미\s*충족|불\s*충족|충족하지|충족되지|\bbut\b|\bhowever\b|\bexcept\b|\balthough\b|\bnot\s+(?:yet\s+)?met\b|\bunmet\b/i;
-/** 괄호 안이 «없음 + 구분자 + 무소견 머리 …» 인가 — 길이 무관(근거 안 괄호도 허용). `isNoneSentinelFinding` 의 갈래. */
+// OP #3173 — 설명은 의미 추정하지 않는다. 실측으로 무소견임을 확인한 문장만 등록한다.
+// 문법 밖 `없음 — 설명`은 실제 결함일 수 있으므로 mustFix에 남긴다.
+const LONG_BRACKETED_SENTINEL = new RegExp(String.raw`^[([（【]\s*(?:[-—–]+\s*)?${NONE_WORD}\s*[—–\-:·]\s*([\s\S]+?)\s*[)\]）】]$`, 'i');
+const KNOWN_NO_FINDING_REMARKS = new Set([
+  // #27349 저장 JSON의 실제 무소견 문구.
+  '문서 전용 변경이고 의도된 산출물이 실제로 존재하며 배선 누락·죽은 코드·Goodhart 해당 없음',
+]);
+/** 괄호 안 `없음` 뒤 설명이 닫힌 무소견 문법에 정확히 들어가는가. */
 function isLongNoFindingBracket(text: string): boolean {
   const m = LONG_BRACKETED_SENTINEL.exec(text.trim());
   if (!m) return false;
   const remark = m[1]!.trim();
-  return NO_FINDING_HEAD.test(remark) && !LONG_REMARK_DISSENT.test(remark);
+  const bareRemark = remark.replace(/\s*[-—–]+\s*$/, '').trim();
+  return NO_FINDING_REMARK.test(bareRemark) || KNOWN_NO_FINDING_REMARKS.has(bareRemark);
 }
 /** must-fix 항목이 «지적 없음» 표지인가 — must-fix 를 세는 자리는 전부 `parseReviewResult` 를 거친다
  *  (`self review --json` 의 `mustFix` → TA `parseReviewResultOutput` → `pr land --overlap-evidence` 의 `review-must-fix-N`).
  *  ⭐ export — `parseReviewResultOutput` 가 «같은» 판정으로 저장된 결과의 표지 줄을 다시 접는다(PR-LAND-MUSTFIX-NONE · 복제 금지). */
 export function isNoneSentinelFinding(finding: string): boolean {
   const text = finding.trim();
-  if (BARE_SENTINEL.test(text)) return true;
-  const bracketed = BRACKETED_SENTINEL.exec(text);
+  if (/^[-—–]+$/.test(text)) return true;
+  const markerText = text.replace(/^[—–-]+\s*|\s*[—–-]+$/g, '').trim();
+  if (markerText && (BARE_SENTINEL.test(markerText) || DASH_ONLY_SENTINEL.test(markerText) || DASH_WRAPPED_BRACKETED_SENTINEL.test(markerText))) return true;
+  const bracketed = BRACKETED_SENTINEL.exec(markerText);
   if (bracketed) {
     const remark = bracketed[1]?.trim();
     if (!remark || NO_FINDING_REMARK.test(remark)) return true;
   }
-  return isLongNoFindingBracket(text);
+  return isLongNoFindingBracket(markerText);
 }
 
-/** critic 응답 파싱 → ReviewResult. 순수함수. VERDICT + MUST-FIX/SHOULD-FIX/REQUIREMENTS 섹션 분해.
+/** critic 응답 파싱 → ReviewResult. VERDICT + MUST-FIX/SHOULD-FIX/REQUIREMENTS 섹션 분해.
  *  verdict=FAIL 인데 must-fix 미기재면 첫 finding 을 must 로 승격(블로커 근거 보존). */
 /** ⭐ `VERDICT: PASS|WARN|FAIL` 판정 줄 — `parseReviewResult` 와 `reviewedResultFromRaw` 가 «같은» 정규식을 쓴다(존재 판정이 갈리면 안 된다). */
 const VERDICT_LINE = /VERDICT:\s*(PASS|WARN|FAIL)/i;
@@ -709,6 +709,7 @@ export function parseReviewResult(text: string): ReviewResult {
   const shouldFix: string[] = [];
   const requirements: string[] = [];
   let fallbackFinding: string | undefined;
+  let droppedNonePlaceholders = 0;
   let section: 'must' | 'should' | 'requirements' | null = null;
   for (const l of lines) {
     if (/^MUST-?FIX/i.test(l)) { section = 'must'; continue; }
@@ -718,12 +719,19 @@ export function parseReviewResult(text: string): ReviewResult {
     if (l.startsWith('- ')) {
       const f = l.slice(2).trim();
       if (!f) continue;
-      if (section === 'must') { if (!isNoneSentinelFinding(f)) mustFix.push(f); }
-      else if (section === 'should') shouldFix.push(f);
+      if (section === 'must') {
+        if (isNoneSentinelFinding(f)) droppedNonePlaceholders++;
+        else mustFix.push(f);
+      } else if (section === 'should') shouldFix.push(f);
       else if (section === 'requirements') requirements.push(f);
       else fallbackFinding ??= f;
     }
   }
+  if (droppedNonePlaceholders > 0) {
+    try {
+      debug.log('review.parse', 'none-placeholder-dropped', { count: droppedNonePlaceholders });
+    } catch { /* observation must not change parsed review data */ }
+  }
   if (verdict === 'fail' && mustFix.length === 0) {
     const first = shouldFix.shift() ?? fallbackFinding;
     mustFix.push(first ?? 'PR 리뷰 FAIL — 재작업 필요(구체 지적 미파싱).');

package/src/budget/pty-usage-reemit.ts

@@ -12,6 +12,10 @@ export interface PtyUsageReemitOpts {
   readonly workdir: string;
   /** Codex session UUID observed from this child PTY; empty when unavailable (emit nothing). */
   readonly sessionId: string;
+  /** Caller-observed metadata only. Never infer a Codex account from CODEX_HOME. */
+  readonly role?: string;
+  readonly stage?: string;
+  readonly account?: string;
   /** Child start time: do not attribute older sessions in a shared CODEX_HOME to this child. */
   readonly sinceMs?: number;
   /** Override the dedup ledger location in isolated tests. */
@@ -40,6 +44,9 @@ export function reemitPtyUsage(opts: PtyUsageReemitOpts): number {
       if (Number(insert.run(home, turn.turnId).changes) === 0) continue;
       debug.log('llm.usage', 'llm-usage', {
         runId: opts.runId,
+        ...(opts.role !== undefined ? { role: opts.role } : {}),
+        ...(opts.stage !== undefined ? { stage: opts.stage } : {}),
+        ...(opts.account !== undefined ? { account: opts.account } : {}),
         substrate: 'pty',
         site: 'pty-rollup:codex',
         turnId: turn.turnId,

package/src/budget/run-usage-rollup.ts

@@ -16,6 +16,15 @@ export interface RunUsageInput {
   cost?: { kind?: string; usd?: number; apiEquivalentUsd?: number } | null;
 }
 
+/** A returned Pod raw usage row is covered only by a measured rollup from the same Job. */
+export function excludeCoveredPodRawRows<T extends { origin?: unknown; podJob?: unknown; job?: unknown; site?: unknown; measured?: unknown }>(rows: readonly T[]): T[] {
+  const rolledUpJobs = new Set(rows.flatMap((row) =>
+    typeof row.job === 'string' && row.job.length > 0
+      && typeof row.site === 'string' && row.site.startsWith('pod-rollup:')
+      && row.site !== 'pod-rollup:missing' && row.measured !== false ? [row.job] : []));
+  return rows.filter((row) => row.origin !== 'pod' || typeof row.podJob !== 'string' || !rolledUpJobs.has(row.podJob));
+}
+
 export interface RunUsageRow {
   runId: string;
   role?: string;

package/src/budget/usage-daily-store.ts

@@ -0,0 +1,98 @@
+/** Read-only UTC usage buckets from the portion of logs.db still retained. */
+import { existsSync } from 'node:fs';
+import { LogStore, logsDbPath, type LogStoreRow } from '../mss/logging/log-store.js';
+
+type Metrics = {
+  calls: number; inputTokens: number; outputTokens: number; cacheReadInputTokens: number;
+  cacheCreationInputTokens: number; reasoningOutputTokens: number; usdKnown: number;
+  unknownCostCalls: number; includedCalls: number; apiEquivalentUsd: number;
+};
+const ZERO: Metrics = { calls: 0, inputTokens: 0, outputTokens: 0, cacheReadInputTokens: 0,
+  cacheCreationInputTokens: 0, reasoningOutputTokens: 0, usdKnown: 0, unknownCostCalls: 0,
+  includedCalls: 0, apiEquivalentUsd: 0 };
+const FIELDS = Object.keys(ZERO) as Array<keyof Metrics>;
+const finite = (value: unknown): number => typeof value === 'number' && Number.isFinite(value) ? value : 0;
+const nonnegativeOr = (value: unknown, fallback: number): number =>
+  typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : fallback;
+const label = (value: unknown): string => typeof value === 'string' && value.length > 0 ? value : '(none)';
+const obj = (value: unknown): Record<string, unknown> | null => value && typeof value === 'object' && !Array.isArray(value)
+  ? value as Record<string, unknown> : null;
+
+function metrics(data: Record<string, unknown>): Metrics {
+  const cost = obj(data.cost);
+  const calls = nonnegativeOr(data.calls, 1);
+  const kind = cost?.kind;
+  return {
+    calls, inputTokens: finite(data.inputTokens), outputTokens: finite(data.outputTokens),
+    cacheReadInputTokens: finite(data.cacheReadInputTokens), cacheCreationInputTokens: finite(data.cacheCreationInputTokens),
+    reasoningOutputTokens: finite(data.reasoningOutputTokens),
+    usdKnown: kind === 'known' || kind === 'actual' || kind === 'partial' ? finite(cost?.usd) : 0,
+    unknownCostCalls: kind === 'unknown' || kind === 'partial' ? nonnegativeOr(cost?.unknownCostCalls, calls)
+      : kind === 'known' || kind === 'actual' || kind === 'included' ? 0 : calls,
+    includedCalls: kind === 'included' ? nonnegativeOr(cost?.includedCalls, calls) : finite(cost?.includedCalls),
+    apiEquivalentUsd: finite(cost?.apiEquivalentUsd),
+  };
+}
+
+function classify(row: LogStoreRow): { kind: 'host'; data: Record<string, unknown> } | { kind: 'pod' } | { kind: 'unclassified' } {
+  let data: Record<string, unknown> | null = null;
+  try { data = obj(JSON.parse(row.data ?? '')); } catch { /* unreadable payload stays unmeasured */ }
+  if (!data) return { kind: 'unclassified' };
+  if (data.origin === 'pod' || typeof data.podJob === 'string' || data.substrate === 'pod'
+    || typeof data.site === 'string' && data.site.startsWith('pod-rollup:')) return { kind: 'pod' };
+  if (data.measured === false) return { kind: 'unclassified' };
+  return { kind: 'host', data };
+}
+
+export interface DailyUsageRow extends Metrics {
+  day: string; hour: string; role: string; stage: string; account: string; model: string;
+  billingProvider: string; billing: string; site: string; hostId: string;
+}
+export interface UsageDailyRead {
+  rows: DailyUsageRow[];
+  podObservedRows: number;
+  unclassifiedRows: number;
+  sourceMaxId: number;
+}
+
+/** Query every llm.usage event in bounded pages. No database or retention writes occur. */
+export function readUsageDaily(path = logsDbPath(), sinceDay?: string): UsageDailyRead | null {
+  if (!existsSync(path)) return null;
+  const logs = LogStore.openReadOnly(path);
+  try {
+    const upper = logs.maxId();
+    const groups = new Map<string, DailyUsageRow>();
+    let afterId = 0;
+    let podObservedRows = 0;
+    let unclassifiedRows = 0;
+    const sinceMs = sinceDay === undefined ? undefined : Date.parse(`${sinceDay}T00:00:00Z`);
+    while (afterId < upper) {
+      const page = logs.query({ exactCategories: ['llm.usage'], sinceMs, afterId, limit: 1000 });
+      if (!page.length) break;
+      for (const row of page) {
+        if (row.id > upper) break;
+        const classified = classify(row);
+        if (classified.kind === 'pod') { podObservedRows++; continue; }
+        if (classified.kind === 'unclassified') { unclassifiedRows++; continue; }
+        const { data } = classified;
+        const hour = new Date(row.ts_ms).toISOString().slice(0, 13);
+        const day = hour.slice(0, 10);
+        const dimensions = [label(data.role), label(data.stage), label(data.account), label(data.model),
+          label(data.billingProvider ?? data.provider), label(data.billing), label(data.site), label(data.hostId ?? row.host_id)];
+        const key = JSON.stringify([hour, ...dimensions]);
+        let value = groups.get(key);
+        if (!value) {
+          const [role, stage, account, model, billingProvider, billing, site, hostId] = dimensions;
+          value = { day, hour, role: role!, stage: stage!, account: account!, model: model!, billingProvider: billingProvider!,
+            billing: billing!, site: site!, hostId: hostId!, ...ZERO };
+          groups.set(key, value);
+        }
+        const delta = metrics(data);
+        for (const field of FIELDS) value[field] += delta[field];
+      }
+      afterId = page.at(-1)!.id;
+    }
+    return { rows: [...groups.values()].sort((a, b) => a.hour.localeCompare(b.hour)),
+      podObservedRows, unclassifiedRows, sourceMaxId: upper };
+  } finally { logs.close(); }
+}

package/src/capture/tui-self-report.ts

@@ -42,7 +42,9 @@ import {
   upsertPtyManifest, updatePtyManifestFrame, touchLivePtyManifest, markPtyManifestClosed, removePtyManifest,
 } from '../pty-shell/pty-manifest.js';
 import { writeHarnessScreen } from '../harness/harness-screen.js';
+import { startTuiRunStateRecorder } from '../pty-shell/tui-run-state.js';
 import { debug } from '../debug/log.js';
+import { routeExternalInput, type ExternalInputRoute } from '../input/external-input-queue.js';
 
 export interface TuiFrameObserverCfg {
   surfaceId: string;
@@ -99,6 +101,8 @@ export interface TuiControlTargetDeps {
   splitKeys?: (input: string) => Key[];
   /** The foreground terminal's real size; `undefined` when it cannot be known (stdout is not a TTY). */
   dims?: () => { readonly cols: number; readonly rows: number } | undefined;
+  /** 외부 주입 라우터 — 글 한 줄을 사용자 버퍼에 섞지 않고 별도 대기열로 돌린다(`input/external-input-queue`). */
+  routeExternal?: (chars: string) => ExternalInputRoute;
 }
 
 function stdoutDims(): { cols: number; rows: number } | undefined {
@@ -116,6 +120,7 @@ export function createTuiControlTarget(surfaceId: string, deps: TuiControlTarget
   const inject = deps.injectKey ?? injectKey;
   const parse = deps.splitKeys ?? splitKeys;
   const dims = deps.dims ?? stdoutDims;
+  const routeExternal = deps.routeExternal ?? routeExternalInput;
   let alive = true;
   let accessMode: PtyAccessMode = 'write';
   let transitionPolicy: PtyTransitionPolicy = 'open';
@@ -135,6 +140,8 @@ export function createTuiControlTarget(surfaceId: string, deps: TuiControlTarget
     isAlive: () => alive,
     canWrite: (actor: PtyWriteActor = 'human') => resolveWriteDecision(accessMode, actor).allow,
     write(chars: string): void {
+      // ⭐ 이 write 는 «바깥»(제어 IPC)에서만 온다 — 키보드와 섞이기 전에 라우터가 먼저 가른다.
+      if (routeExternal(chars) !== 'passthrough') return;
       const keys = parse(chars);
       if (!keys.length || !keys.every(inject)) throw new Error('tui-input-undelivered');
     },
@@ -145,11 +152,13 @@ export function createTuiControlTarget(surfaceId: string, deps: TuiControlTarget
 
 export interface TuiSelfReportDeps {
   surfaceId?: string;
+  /** `elanous --name <name>` — 자기 manifest 행 별명. `pty list`·`pty snapshot <name>` 이 이것으로 부른다. */
+  nickname?: string;
   throttleMs?: number;
   now?: () => number;
   register?: (fn: ((lines: readonly string[], dims: { rows: number; cols: number }) => void) | null) => void;
   publishFrame?: (frame: SelfReportFrame) => void;
-  registerRow?: (surfaceId: string, now: number) => void;
+  registerRow?: (surfaceId: string, now: number, nickname?: string) => void;
   writeFrame?: (surfaceId: string, text: string, now: number) => void;
   /** B(harness-screens 파일) sink — `elanous self screen` 이 읽는 substrate.
    *  자식 harness 발행과 대칭(tmux 없이 L2 대시보드 자기 화면 관측). */
@@ -174,6 +183,8 @@ export interface TuiSelfReportDeps {
   startControlPoller?: () => (() => void);
   reportControlInitFailure?: (stage: TuiControlInitStage, error: unknown) => void;
   reportControlCleanupFailure?: (stage: TuiControlCleanupStage, error: unknown) => void;
+  /** 행 등록 직후 실행 판 ⊕ 턴(idle) 기록을 연다 — `elanous pty state` 가 읽는다. 반환 = 정리. */
+  startRunState?: (surfaceId: string) => (() => void);
 }
 
 export type TuiControlInitStage = 'create-target' | 'register-target' | 'start-poller' | 'publish-manifest';
@@ -235,7 +246,9 @@ export function startTuiSelfReport(deps: TuiSelfReportDeps = {}): () => void {
     initDisposers.push({ stage: 'stop-poller', dispose: stopControlPoller });
     controlInitStage = 'publish-manifest';
     initDisposers.push({ stage: 'rollback-manifest', dispose: () => rollbackRow(surfaceId) });
-    registerRow(surfaceId, now());
+    const nickname = deps.nickname?.trim() || undefined;
+    registerRow(surfaceId, now(), nickname);
+    if (nickname) debug.log('pty.rename', 'tui-launch-name', { ptyId: surfaceId, nickname });
   } catch (error) {
     for (let disposer = initDisposers.pop(); disposer; disposer = initDisposers.pop()) {
       try { disposer.dispose(); } catch (cleanupError) {
@@ -246,6 +259,10 @@ export function startTuiSelfReport(deps: TuiSelfReportDeps = {}): () => void {
     return () => {};
   }
   const activeControlTarget = controlTarget;
+  let stopRunState: () => void = () => {};
+  // 행 등록을 갈아 끼운 호출자(시험)는 실 manifest 를 안 건드린다 — 기본 녹음기는 기본 행 등록과 짝일 때만.
+  const startRunState = deps.startRunState ?? (deps.registerRow ? () => () => {} : startTuiRunStateRecorder);
+  try { stopRunState = startRunState(surfaceId); } catch { /* fail-soft — recorder logs its own write failures */ }
   const driveTicks = deps.driveTicks ?? ((tick, ms) => {
     const t = setInterval(tick, ms);
     (t as { unref?: () => void }).unref?.();
@@ -320,6 +337,7 @@ export function startTuiSelfReport(deps: TuiSelfReportDeps = {}): () => void {
     try { stopSource(); } catch { /* fail-soft — unregisters observer / clears tick timer */ }
     try { mirror?.stop(); } catch { /* fail-soft — restores stdout.write */ }
     clearInterval(hb);
+    try { stopRunState(); } catch { /* fail-soft */ }
     try { markClosed(surfaceId, now()); } catch { /* fail-soft */ }
     try { activeControlTarget?.deactivate(); } catch { /* fail-soft */ }
     try { stopControlPoller(); } catch { /* fail-soft */ }
@@ -357,8 +375,8 @@ function defaultPublishFrame(frame: SelfReportFrame): void {
   publishSelfReportFrame(getChannelBus(), frame);
 }
 
-function defaultRegisterRow(surfaceId: string, now: number): void {
-  upsertPtyManifest({ id: surfaceId, kind: 'tui', cmd: 'elanous', startedAt: now, now });
+function defaultRegisterRow(surfaceId: string, now: number, nickname?: string): void {
+  upsertPtyManifest({ id: surfaceId, kind: 'tui', ...(nickname ? { nickname } : {}), cmd: 'elanous', startedAt: now, now });
 }
 
 function defaultWriteFrame(surfaceId: string, text: string, now: number): void {