elanous 0.2.28 → 0.2.29

package/src/native-tool-catalog.ts

@@ -388,6 +388,131 @@ export const nativeToolCatalog: NativeToolCatalogEntry[] = [
     alwaysLoad: false,
     shouldDefer: true,
   },
+  // ── Ops-ledger native tools (우편 msg · 판 release checklist) ──────────────
+  // OP TUI turns drove msg list/post/ack and release checklist
+  // list/move/set/add through `eln` RunShell calls — 1.3–2s of CLI
+  // startup each, 30+ spawns per turn, shell stdout amplifying screen
+  // defects. These eight tools reuse the SAME durable services
+  // in-process (msg-store SQLite ledger · release-loop checklist
+  // ledger), preserving the structured results, the seat/OP permission
+  // boundaries (ELANOUS_TRACK actor routing, seatMove rules, the HQ
+  // lease fence) and the claim-history audit. Every call is a local
+  // ledger read/write — no process spawn, no network, no running-runs
+  // sweep — so a TUI OP turn needs zero RunShell round-trips (RunShell
+  // steers these exact CLI shapes to the native tools; see
+  // src/skills/tools/shell.ts). Dispatchers: src/skills/tools/ops-ledger.ts.
+  {
+    id: 'msg_list',
+    kind: 'other',
+    aliases: ['MsgList', 'msg_list'],
+    displayName: 'MsgList',
+    description: 'List durable seat-addressed messages for one recipient WITHOUT acknowledging them. Same SQLite ledger as `elanous msg list`, in-process — no CLI startup. Reading never advances the acknowledgement cursor; `after` pages beyond it.',
+    promptSummary: '`MsgList(to, after?, limit?)` (durable seat mailbox listing · read never acks · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['read-only'],
+    supportsParallel: true,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
+  {
+    id: 'msg_post',
+    kind: 'other',
+    aliases: ['MsgPost', 'msg_post'],
+    displayName: 'MsgPost',
+    description: 'Post a durable seat-addressed message. Same SQLite ledger as `elanous msg post`, in-process — no CLI startup. ALL may receive but never send; `kind` tags the message; `replyTo` points a reply at a question message ID.',
+    promptSummary: '`MsgPost(from, to, body, kind?, replyTo?)` (post durable seat message · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['mutating'],
+    supportsParallel: false,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
+  {
+    id: 'msg_ack',
+    kind: 'other',
+    aliases: ['MsgAck', 'msg_ack'],
+    displayName: 'MsgAck',
+    description: 'Acknowledge durable messages for one recipient through an ID, advancing their cursor so later MsgList calls start after them. Same SQLite ledger as `elanous msg ack`, in-process.',
+    promptSummary: '`MsgAck(to, id)` (advance a seat’s ack cursor through id · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['mutating'],
+    supportsParallel: false,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
+  {
+    id: 'checklist_list',
+    kind: 'other',
+    aliases: ['ChecklistList', 'checklist_list'],
+    displayName: 'ChecklistList',
+    description: 'List the release-checklist cells for one version with per-status summary, blocked cells, per-owner counts and screen-parity warnings. Same ledger as `elanous release checklist list --json`, in-process. Read-only.',
+    promptSummary: '`ChecklistList(version?, owner?)` (판 checklist snapshot + summary + parity · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['read-only'],
+    supportsParallel: true,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
+  {
+    id: 'checklist_add',
+    kind: 'other',
+    aliases: ['ChecklistAdd', 'checklist_add'],
+    displayName: 'ChecklistAdd',
+    description: 'Add one cell to a release checklist (owner · priority · deadlineVersion · predecessors · refs; kind/dispatchKind/CEO load/accelerator afterwards via ChecklistEdit). Same ledger, HQ lease fence and claim-history audit as `elanous release checklist add`, in-process.',
+    promptSummary: '`ChecklistAdd(id, title, version?, owner?, kind?, …)` (add a release checklist cell · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['mutating'],
+    supportsParallel: false,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
+  {
+    id: 'checklist_set',
+    kind: 'other',
+    aliases: ['ChecklistSet', 'checklist_set'],
+    displayName: 'ChecklistSet',
+    description: 'Set one release-checklist cell’s status and/or evidence line (⊕ additive refs). Same ledger, HQ lease fence, actor audit and screen-parity warning as `elanous release checklist set`, in-process. Other metadata goes through ChecklistEdit.',
+    promptSummary: '`ChecklistSet(id, version?, status?, evidence?, refs?)` (cell status/evidence · seat-audited · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['mutating'],
+    supportsParallel: false,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
+  {
+    id: 'checklist_edit',
+    kind: 'other',
+    aliases: ['ChecklistEdit', 'checklist_edit'],
+    displayName: 'ChecklistEdit',
+    description: 'Change exactly one metadata field of a release-checklist cell (owner · priority · disposition · kind · dispatchKind · deadlineVersion · predecessors · ceoMinutes · ceoDate · accelerator) — one field per call so a model that fills every property cannot clobber the rest. Same ledger, HQ lease fence and actor audit as `elanous release checklist set`, in-process.',
+    promptSummary: '`ChecklistEdit(id, field, value, version?)` (one cell metadata field · seat-audited · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['mutating'],
+    supportsParallel: false,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
+  {
+    id: 'checklist_move',
+    kind: 'other',
+    aliases: ['ChecklistMove', 'checklist_move'],
+    displayName: 'ChecklistMove',
+    description: 'Move one checklist cell to another release version in a single transaction. Permission routing preserved: a seat moves only its own cell into the next version (capacity-checked), OP moves unrestricted, no ELANOUS_TRACK runs unchecked as anonymous. Same ledger and history audit as `elanous release checklist move`, in-process.',
+    promptSummary: '`ChecklistMove(id, from, to, reason)` (move a cell across versions · seat/OP rules preserved · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['mutating'],
+    supportsParallel: false,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
   // Input-policy tools — Phase 6 of the unified-input plan.
   // SetInputMode is mutating but side-effect is tiny (context tag +
   // onEnter/onExit). GetInputPolicy is read-only. SetInputBinding is

package/src/nexus/api/http-server.ts

@@ -176,6 +176,7 @@ import { dispatchPersonaRoute } from './personas.js';
 import { handleMe, operatorSignal } from './operator.js';
 import { handleGraphRunRoute } from '../../graph-runner/graph-run-api.js';
 import { handleOpsApi } from './ops-api.js';
+import { handleProjectAutopsy } from './project-autopsy.js';
 import { handleRoleJudge } from './role-judge.js';
 import { handleAudioStt } from './audio-stt.js';
 import { handleLlmModels } from './llm-models.js';
@@ -1499,6 +1500,10 @@ export async function routeRequest(
     if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
     return method === 'GET' ? handleProjectsGet() : handleProjectsPost(req);
   }
+  if (pathname.startsWith('/v1/projects/') && pathname.endsWith('/autopsy') && method === 'GET') {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return handleProjectAutopsy(req, pathname.slice('/v1/projects/'.length, pathname.length - '/autopsy'.length));
+  }
 
   // Polling must remain outside the non-GET dispatch below.
   if (method === 'GET' && pathname.startsWith(`${SKILL_EXEC_PATH}/`) && !pathname.slice(SKILL_EXEC_PATH.length + 1).includes('/')) {

package/src/nexus/api/ops-api.ts

@@ -131,6 +131,8 @@ export function releaseNodeFacts(output: unknown): ReleaseNodeFacts {
 }
 export interface ReleaseRunView {
   runId: string; status: string; startedAt: string; version: string | null; path: string[]; nodes: ReleaseRunNodeView[];
+  /** Explicit project ownership. The release ledger does not currently populate this field. */
+  projectId?: string;
   /** GATE-LIVE-OBS — 지금 gate 노드에 있는 런에만 싣는다(발행 원장 `gate-logs/cut/shards.json`). 파일이 없으면 생략. */
   gateShards?: GateShardsFile & { summary: GateShardsSummary };
 }

package/src/nexus/api/project-autopsy.ts

@@ -0,0 +1,127 @@
+import { jsonResponse } from './json-response.js';
+import { readReleaseRuns, type ReleaseRunView } from './ops-api.js';
+import { listPendingApprovals, type PendingApprovalSummary } from './workflow-approvals.js';
+import { getProject, type Project } from '../../project/project-store.js';
+import { classifyMergeFailure, type MergeFailureKind } from '../../self-implement/regate-detail.js';
+
+/** One failed node of a release run explicitly assigned to the project. */
+export interface ProjectAutopsyFailure {
+  runId: string;
+  nodeId: string;
+  summary: string;
+  kind: MergeFailureKind;
+  status: string;
+  startedAt?: string;
+  endedAt?: string;
+  verdict?: string;
+}
+
+/** Failure-kind rollup across the project's failed rows (desc by count, kind asc). */
+export interface ProjectAutopsyCause {
+  kind: MergeFailureKind;
+  count: number;
+  runs: string[];
+}
+
+/** A project's autopsy: failed rows + causes + pending proposals, read-only over the existing ledgers. */
+export interface ProjectAutopsyReport {
+  project: { id: string; name: string; primaryFolder?: string };
+  attribution: { status: 'measured' | 'partial' | 'unavailable'; reason?: 'ledger-project-id-missing' };
+  coverage: { failuresTruncated: boolean; proposalsTruncated: boolean; causeCounts: 'returned-failures' };
+  failures: ProjectAutopsyFailure[];
+  causes: ProjectAutopsyCause[];
+  proposals: PendingApprovalSummary[];
+  pendingApprovals: number;
+}
+
+export interface ProjectAutopsyDeps {
+  getProject?: (id: string) => Project | null;
+  readRuns?: (version: string | null) => ReleaseRunView[] | 'unavailable';
+  listApprovals?: () => PendingApprovalSummary[];
+}
+
+const FAILURE_LIMIT = 50;
+const PROPOSAL_LIMIT = 20;
+const PROJECT_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+const defaultReadRuns = (version: string | null): ReleaseRunView[] | 'unavailable' =>
+  readReleaseRuns(version, undefined, { facts: true });
+
+function projectViewOf(project: Project): ProjectAutopsyReport['project'] {
+  return {
+    id: project.id,
+    name: project.name,
+    ...(project.primaryFolder !== undefined ? { primaryFolder: project.primaryFolder } : {}),
+  };
+}
+
+/** GET /v1/projects/:id/autopsy — 실패·원인·제안 rows for one project, fail-soft per the ops-route pattern. */
+export function handleProjectAutopsy(req: Request, rawId: string, deps: ProjectAutopsyDeps = {}): Response {
+  if (req.method !== 'GET') return jsonResponse({ error: 'method-not-allowed' }, 405);
+  let projectId: string;
+  try {
+    projectId = decodeURIComponent(rawId);
+  } catch {
+    return jsonResponse({ error: 'bad_request', reason: 'invalid project id' }, 400);
+  }
+  if (!PROJECT_ID.test(projectId)) return jsonResponse({ error: 'bad_request', reason: 'invalid project id' }, 400);
+  const project = (deps.getProject ?? getProject)(projectId);
+  if (!project) return jsonResponse({ error: 'not-found' }, 404);
+  const pending = deps.listApprovals ? deps.listApprovals() : listPendingApprovals();
+  const runs = (deps.readRuns ?? defaultReadRuns)(null);
+  if (runs === 'unavailable') return jsonResponse({ error: 'runs-unavailable' }, 500);
+  if (!runs.some((run) => Boolean(run.projectId))) {
+    return jsonResponse({ project: projectViewOf(project),
+      attribution: { status: 'unavailable', reason: 'ledger-project-id-missing' },
+      coverage: { failuresTruncated: false, proposalsTruncated: false, causeCounts: 'returned-failures' },
+      failures: [], causes: [], proposals: [], pendingApprovals: 0 });
+  }
+  const unattributed = runs.some((run) => !run.projectId) || pending.some((approval) => !approval.projectId);
+  const attributed = runs.some((run) => Boolean(run.projectId)) || pending.some((approval) => Boolean(approval.projectId));
+  const attribution: ProjectAutopsyReport['attribution'] = unattributed || !attributed
+    ? { status: attributed ? 'partial' : 'unavailable', reason: 'ledger-project-id-missing' }
+    : { status: 'measured' };
+  const failures: ProjectAutopsyFailure[] = [];
+  for (const run of runs) {
+    if (run.projectId !== project.id) continue;
+    for (const node of run.nodes) {
+      if (node.ok !== false) continue;
+      failures.push({
+        runId: run.runId,
+        nodeId: node.nodeId,
+        summary: node.summary,
+        kind: classifyMergeFailure(node.summary),
+        status: run.status,
+        ...(node.startedAt !== undefined ? { startedAt: node.startedAt } : {}),
+        ...(node.endedAt !== undefined ? { endedAt: node.endedAt } : {}),
+        ...(node.facts?.verdict !== undefined ? { verdict: node.facts.verdict } : {}),
+      });
+      if (failures.length > FAILURE_LIMIT) break;
+    }
+    if (failures.length > FAILURE_LIMIT) break;
+  }
+  const failuresTruncated = failures.length > FAILURE_LIMIT;
+  if (failuresTruncated) failures.length = FAILURE_LIMIT;
+  const counts = new Map<MergeFailureKind, { count: number; runs: Set<string> }>();
+  for (const failure of failures) {
+    const entry = counts.get(failure.kind) ?? { count: 0, runs: new Set<string>() };
+    entry.count += 1;
+    entry.runs.add(failure.runId);
+    counts.set(failure.kind, entry);
+  }
+  const causes: ProjectAutopsyCause[] = [...counts.entries()]
+    .map(([kind, entry]) => ({ kind, count: entry.count, runs: [...entry.runs].sort() }))
+    .sort((a, b) => b.count - a.count || (a.kind < b.kind ? -1 : 1));
+  const projectApprovals = pending.filter((summary) => summary.projectId === project.id);
+  const proposals = projectApprovals.slice(0, PROPOSAL_LIMIT);
+  return jsonResponse({
+    project: projectViewOf(project),
+    attribution,
+    coverage: { failuresTruncated, proposalsTruncated: projectApprovals.length > PROPOSAL_LIMIT,
+      causeCounts: 'returned-failures' },
+    failures,
+    causes,
+    proposals,
+    pendingApprovals: projectApprovals.length,
+  });
+}

package/src/nexus/api/terminals.ts

@@ -74,6 +74,7 @@ export interface TerminalSummary {
   cmd: string;
   workdir?: string;
   nickname?: string;
+  purpose?: string;
   treeName: string;
   worktreeName: string;
   parentPtyId: string;
@@ -278,6 +279,7 @@ function summarize(
     cmd: handle.cmd,
     ...(handle.workdir ? { workdir: handle.workdir } : {}),
     ...(manifest?.nickname ? { nickname: manifest.nickname } : {}),
+    ...(manifest?.purpose ? { purpose: manifest.purpose } : {}),
     ...names,
     parentPtyId: manifest?.parentPtyId ?? '',
     parentPid: manifest?.parentPid ?? 0,
@@ -322,6 +324,7 @@ function summarizeManifest(
     id: row.id, cmd: row.cmd,
     ...(row.workdir ? { workdir: row.workdir } : {}),
     ...(row.nickname ? { nickname: row.nickname } : {}),
+    ...(row.purpose ? { purpose: row.purpose } : {}),
     ...terminalTreeNames(row.workdir),
     parentPtyId: row.parentPtyId, parentPid: row.parentPid, parentKind: row.parentKind, runId: row.runId,
     ...(row.chainOrigin === undefined ? {} : { chainOrigin: row.chainOrigin }),

package/src/nexus/api/workflow-approvals.ts

@@ -21,6 +21,8 @@ export interface PendingApprovalSummary {
   runId: string;
   message: string;
   requestedAt: number;
+  /** Explicit project ownership. The approval registry does not currently populate this field. */
+  projectId?: string;
 }
 
 interface PendingApprovalEntry extends PendingApprovalSummary {

package/src/nexus/onboarding/first-boot-wizard.ts

@@ -1,6 +1,7 @@
 import type { WizardIO } from '../../onboarding.js';
 import type { SetupCheckResult } from '../setup-status.js';
 import type { TailscaleProbe } from './tailscale-probe.js';
+import { createManagementStarterContract } from '../../persona/presets.js';
 
 export interface FirstBootWizardDeps {
   io: WizardIO;
@@ -18,14 +19,32 @@ export interface FirstBootWizardDeps {
   pwaBuilt?: boolean;
   /** Tailscale probe 결과 (alive 시 magicDNS / IP 도 banner 에 노출). */
   tailscale?: TailscaleProbe;
+  /** 0.2.29 PERSONA-STARTER — «경영» 스타터 계약을 쓸 persona 저장소 경로.
+   *  생략하면 기본 상태 저장소(resolveStatePersonaDir) — 운영 첫 실행 경로. */
+  starterContractDir?: string;
 }
 
 export type FirstBootStep = 'llm' | 'tailscale';
 
+/** 0.2.29 PERSONA-STARTER — 직업 질문에서 «경영»을 골랐을 때 만들어진 스타터 계약 한 장. */
+export interface StarterContractSummary {
+  personaId: string;
+  displayName: string;
+  path: string;
+}
+
 export type FirstBootResult =
-  | { action: 'completed'; stepsRun: FirstBootStep[] }
+  | { action: 'completed'; stepsRun: FirstBootStep[]; starterContract?: StarterContractSummary }
   | { action: 'skipped'; reason: 'no-tty' | 'all-set-up' };
 
+/** 직업 질문 답의 정규화 — «1»·«경영»·«management» 는 경영,
+ *  나머지(빈 답 포함)는 일반(현재 첫 실행 동작 유지). */
+export function normalizeOccupationChoice(input: string): 'management' | 'general' {
+  const v = input.trim().toLowerCase();
+  if (v === '1' || v === '경영' || v === 'management') return 'management';
+  return 'general';
+}
+
 function isTty(force?: boolean): boolean {
   if (force === true) return true;
   if (force === false) return false;
@@ -89,6 +108,39 @@ function printPwaSetupBanner(deps: FirstBootWizardDeps): void {
   deps.io.print('');
 }
 
+/** 0.2.29 PERSONA-STARTER — 직업 질문. «경영»이면 경영 스타터 계약 한 장을
+ *  만들고, 일반이면 계약 없이 현재 흐름 그대로. 계약 생성이 실패해도
+ *  wizard 결과는 completed 로 유지한다(fail-soft). */
+async function askOccupationAndCreateStarter(
+  deps: FirstBootWizardDeps,
+  out: { log: (s: string) => void; error: (s: string) => void },
+): Promise<StarterContractSummary | undefined> {
+  const io = deps.io;
+  if (io.nonInteractive) return undefined;
+  io.print('');
+  io.print('  어떤 일을 하세요? 고르면 스타터 계약 한 장을 만듭니다.');
+  io.print('    1) 경영 — 방향·판단·운영을 함께 세우는 경영 스타터');
+  io.print('    2) 일반 — 지금처럼 계속 (스타터 계약 없이)');
+  let answer: string;
+  try {
+    answer = await io.ask('  선택 (1/2 · Enter=일반): ');
+  } catch (err) {
+    out.error(`first-boot wizard: occupation question failed: ${(err as Error).message}`);
+    return undefined;
+  }
+  if (normalizeOccupationChoice(answer) !== 'management') return undefined;
+  try {
+    const written = createManagementStarterContract(
+      deps.starterContractDir ? { dir: deps.starterContractDir } : {},
+    );
+    io.print(`  ✓ 경영 스타터 계약이 만들어졌습니다: ${written.path}`);
+    return { personaId: written.personaId, displayName: written.displayName, path: written.path };
+  } catch (err) {
+    out.error(`first-boot wizard: starter contract failed: ${(err as Error).message}`);
+    return undefined;
+  }
+}
+
 export async function runFirstBootWizard(
   deps: FirstBootWizardDeps,
 ): Promise<FirstBootResult> {
@@ -127,5 +179,7 @@ export async function runFirstBootWizard(
     }
   }
 
-  return { action: 'completed', stepsRun };
+  const starterContract = await askOccupationAndCreateStarter(deps, out);
+
+  return { action: 'completed', stepsRun, ...(starterContract ? { starterContract } : {}) };
 }

package/src/oauth/codex-account-store.ts

@@ -17,6 +17,7 @@ import {
 import { authStorePath, defaultCodexHome, isUnderTestRunner, listProviders, loadTokens, saveTokens } from './store.js';
 import { readFreshAvailabilityState, quotaSignalDir, readQuotaSignal, readQuotaSignalCredits, readQuotaSignalUsedPercent, readQuotaSignalObservedAt, readQuotaSignalObservedAtRaw } from '../budget/codex-reset-credit-state.js';
 import { creditPaceStatus } from '../budget/codex-credit-pace.js';
+import { noteCodexBillingDecision, type CodexCreditSpendReason } from './codex-billing-route.js';
 import { loadLlmPolicy } from '../policy/llm-policy.js';
 import { getUserConfig } from '../user-config.js';
 import {
@@ -204,6 +205,8 @@ interface RunPin {
   readonly resolution: CodexAccountResolution;
   /** ⛔ 핀이 «갇혔는지»를 싸게 재려면 그 계정의 홈이 필요하다. 모르면 재지 못하므로 그대로 둔다. */
   readonly home: string | undefined;
+  /** 핀을 박은 판정이 크레딧 소진이었나 — 핀으로 돌려줄 때도 과금 경로를 같이 남긴다. */
+  readonly creditReason?: CodexCreditSpendReason;
 }
 const pinnedByRun = new Map<string, RunPin>();
 /** ⛔ 상한 — 장수 프로세스에서 runId 수만큼 «영구히» 자라면 안 된다(리뷰 should-fix).
@@ -213,6 +216,8 @@ const PIN_MAX = 256;
 /** ⛔ 테스트 심 — 고정을 푼다. 프로덕션에서는 부르지 않는다. */
 export function _resetCodexRotationPinForTesting(): void {
   pinnedByRun.clear();
+  // 판정이 남긴 과금 경로도 같이 푼다 — 안 풀면 다음 시험 파일의 codex usage 가 credit 으로 읽힌다.
+  noteCodexBillingDecision(undefined);
 }
 
 /** ⛔⭐⭐ 후보 조립은 «한 자»여야 한다 — 실행 경로와 조회(dry-run)가 다른 자를 쓰면
@@ -728,7 +733,7 @@ export function resolveCodexAccountForRun(
   const explicit = Boolean(env.ELANOUS_CODEX_ACCOUNT?.trim());
   // ⛔⭐ 사람이 «명시»했으면 고정보다 «먼저» 이긴다(결정 ③) — 고정을 읽지도 쓰지도 않는다.
   //   고정이 앞서면, 앞선 호출이 만든 회전 결과가 「명시한 계정」을 덮는다.
-  if (explicit) { observeRotation({ reason: 'explicit' }, current.name); return current; }
+  if (explicit) { observeRotation({ reason: 'explicit' }, current.name); noteCodexBillingDecision(undefined); return current; }
   // ⛔⭐⭐⭐ 설정 판정이 «핀보다 먼저»다(리뷰 must-fix).
   //   핀을 먼저 보면, 같은 런에서 이미 회전·핀된 뒤 설정이 false 로 바뀌어도
   //   ***계속 회전 계정을 돌려준다*** — 「config false 로만 꺼진다」가 핀 경유로 깨진다.
@@ -736,6 +741,7 @@ export function resolveCodexAccountForRun(
   const enabled = rotationConfig.enabled;
   if (!enabled) {
     observeRotation({ reason: 'disabled', disabledProvenance: rotationConfig.state }, current.name);
+    noteCodexBillingDecision(undefined);
     return current;
   }
   // ⛔⭐⭐⭐ 고정은 «런 신원이 있을 때만» 한다.
@@ -763,7 +769,7 @@ export function resolveCodexAccountForRun(
       //   🔑 전환은 «소진당 한 번»으로 갇히고, 그 뒤 다시 핀이 박힌다.
       const pinnedHome = pinned.home;
       const exhausted = pinnedHome !== undefined && pinnedAccountExhausted(pinnedHome, pinned.resolution.name);
-      if (!exhausted) return pinned.resolution;
+      if (!exhausted) { noteCodexBillingDecision(pinned.creditReason); return pinned.resolution; }
       pinnedByRun.delete(runKey);
       debug.log('oauth.codex-account', 'pin-released',
         { account: pinned.resolution.name, why: 'threshold-reached' }, { level: 'warn' });
@@ -806,6 +812,8 @@ export function resolveCodexAccountForRun(
   // CREDIT-SPEND-ORDER(10-12) — «다른 계정의 선불 크레딧으로 옮김»(`rotated` ⊕ creditEntry)도 크레딧 진입이다.
   const creditSpendReason = decision.reason === 'credits-allowed' || decision.reason === 'credit-pace' ? decision.reason
     : decision.reason === 'rotated' && decision.creditEntry ? 'credits-rotated' as const : undefined;
+  // CREDIT-BILLING-LABEL(10-14) — 이 판정으로 나가는 호출의 `llm.usage` 가 `billing='credit'` 이 되게 남긴다.
+  noteCodexBillingDecision(creditSpendReason);
   if (creditSpendReason && !deps.counterPath && isUnderTestRunner(process.env)) {
     // 시험 러너 가드(autoConsume 의 test-runtime-guard 와 같은 관용구) — 카운터를 주입 안 한 시험이 실제 카운터·송신기에 닿지 않는다.
     debug.log('oauth.codex-account', 'credit-spend-alert-skipped', { account: decision.to?.name ?? current.name, reason: 'test-runtime-guard' });
@@ -833,7 +841,11 @@ export function resolveCodexAccountForRun(
       const oldest = pinnedByRun.keys().next().value;
       if (oldest !== undefined) pinnedByRun.delete(oldest);
     }
-    pinnedByRun.set(runKey, { resolution: resolved, home: effectiveCodexHome(resolved, loadTokens(resolved.storeKey, path), env).home });
+    pinnedByRun.set(runKey, {
+      resolution: resolved,
+      home: effectiveCodexHome(resolved, loadTokens(resolved.storeKey, path), env).home,
+      ...(creditSpendReason ? { creditReason: creditSpendReason } : {}),
+    });
   }
   return resolved;
 }

package/src/oauth/codex-billing-route.ts

@@ -0,0 +1,31 @@
+/**
+ * codex 호출의 «과금 경로» 기억 — 회전 판정이 크레딧 소진을 정했으면 그 호출의 `llm.usage` 가 `billing='credit'` 이다.
+ *
+ * 🩸 10-14 운영 실측: 세 계정이 주간 100% 라 회전이 `credits-allowed` 로 default 계정 크레딧을 쓰는데,
+ *   같은 턴의 `llm.usage` 는 `billing=subscription` · `cost.kind=included($0)` 였다 — 원장·토큰 경보가 크레딧 지출을 $0 로 봤다.
+ *   자격 종류(oauth)만으로 과금 경로를 정하면 «구독 한도를 넘어 크레딧으로 나간 호출»을 구분 못 한다.
+ *
+ * 경로: `loadFreshCodexAuthState` → `resolveCodexAccountForRun`(요청마다 · 판정·핀) → 여기 기록
+ *   → 응답 끝 `logAgentTurnUsage` → `billingRouteForProvider('openai-codex')` 가 여기를 읽는다.
+ * ⚠️ 프로세스 단위 «마지막 판정»이다 — 같은 프로세스에서 다른 런이 동시에 다른 판정을 내리면 섞일 수 있다
+ *   (판정은 같은 스토어·설정을 읽으므로 보통 같은 답이다).
+ */
+
+export type CodexCreditSpendReason = 'credits-allowed' | 'credit-pace' | 'credits-rotated';
+
+let lastCreditReason: CodexCreditSpendReason | undefined;
+
+/** 계정 해석이 끝날 때마다 부른다 — 크레딧 소진이 아니면 `undefined` 로 지운다(앞 판정이 남지 않게). */
+export function noteCodexBillingDecision(reason: CodexCreditSpendReason | undefined): void {
+  lastCreditReason = reason;
+}
+
+/** 마지막 codex 계정 해석이 크레딧 소진이었으면 그 이유. */
+export function codexCreditSpendReason(): CodexCreditSpendReason | undefined {
+  return lastCreditReason;
+}
+
+/** ⛔ 테스트 심 — 프로덕션에서는 부르지 않는다. */
+export function _resetCodexBillingDecisionForTesting(): void {
+  lastCreditReason = undefined;
+}

package/src/ops/overview-collect.ts

@@ -10,7 +10,8 @@ import { effectiveInstanceRoot } from '../instance/resolve.js';
 import type { Checklist, ChecklistItem } from '../release-loop/checklist.js';
 import type { ReleaseSchedule } from '../release-loop/release-schedule.js';
 import type { ResourceView } from '../control-plane/ledger.js';
-import type { TaskCard } from '../task-agent/task-hand.js';
+import { cardPrNumber, type TaskCard } from '../task-agent/task-hand.js';
+import { measureLandingThroughput, type LandingThroughput } from '../task-agent/cover.js';
 import {
   okCell, unmeasured, type Cell, type CapacityInfo, type ChecklistCounts, type LaunchableInfo, type LoopRow, type MachineRow,
   type OverviewSnapshot, type OwnerTaskRow, type ParentsInfo, type PodMemberRow, type ReleaseRunInfo, type ScheduleInfo,
@@ -269,6 +270,22 @@ export async function collectOverview(opts: CollectOptions, injected: CollectDep
   const byOwner: Cell<Record<string, OwnerTaskRow>> = cards instanceof Error
     ? unmeasured('task-agent ledger', errText(cards))
     : okCell(ownerRows(cards, kstMidnight, opts.owner), `task-agent ledger(오늘 KST · owner=seat 키)`, iso(now));
+  const launchedCards = cards instanceof Error ? [] : cards.filter((card) => card.createdAt >= kstMidnight && card.status === 'launched');
+  const throughput = cards instanceof Error
+    ? unmeasured<LandingThroughput>('task-agent ledger', errText(cards))
+    : okCell(measureLandingThroughput({
+      launched: launchedCards.length,
+      cardPrs: launchedCards.filter((card) => cardPrNumber(card) !== undefined).length,
+      taskAgentActions: launchedCards.flatMap((card) => (card.landAttempts ?? [])
+        .filter((attempt) => attempt.at >= kstMidnight)
+        .map((attempt) => ({
+          kind: 'land' as const,
+          result: attempt.ok === true ? 'done' : attempt.ok === false ? 'failed' : 'pending',
+          reason: attempt.reason ?? attempt.detail,
+        }))),
+      allLands: null,
+      pendingLandingAgeSeconds: null,
+    }), 'task-agent ledger(오늘 KST · landAttempts)', iso(now));
   const done = unmeasured<number>('task-agent ledger', '착지 판정은 PR 조회가 필요 — owner 모델(OVW-OWNER)·card-evidence 연결 전');
 
   // 발사 가능 — 열린 판(앞으로의 컷) 전부.
@@ -334,7 +351,7 @@ export async function collectOverview(opts: CollectOptions, injected: CollectDep
       beat: okCell({ lastAt: b.lastAt, ageSeconds: b.ageSeconds, alive: b.alive }, `${SEAT_ERA_SOURCE} dispatcher-${b.seat}.pid`, b.lastAt) });
   }
 
-  return { generatedAt: iso(now), instanceRoot: root, since: opts.sinceLabel, release, tasks, machines, landings, loops };
+  return { generatedAt: iso(now), instanceRoot: root, since: opts.sinceLabel, release, tasks, machines, landings, throughput, loops };
 }
 
 export function parseSince(raw: string | undefined): { ms: number; label: string } {