elanous 0.2.29 → 0.2.32

package/src/nexus/DAEMON-THIN-inventory-2026-10-15.md

@@ -0,0 +1,122 @@
+# DAEMON-THIN 1단계 산출물 — 데몬 안 로직 목록 ⊕ 뺄 순서 (측정 먼저)
+
+- 골: 27fa65fa79651b12 · 칸 [OP · 0.2.35 DAEMON-THIN · TASK-AGENT(OP 디스패처)]
+- 준거: RFC-universe-by-house §4 · 루브릭 A1 E2 R2 D0 M1 B0 S2 X1 · 기둥 B(데몬 얇게, 재시작 없는 받침 강건성)
+- 대상 파일: `src/nexus/index.ts` (runNexus 본체, 4,030줄) · `src/workflow-runtime/daemon.ts` (createWorkflowRuntimeDaemon, 440줄)
+- 이 문서는 1단계(측정) 산출물이다 — **코드 동작은 바꾸지 않는다.**
+
+## 1. 데몬 안 로직 목록 — src/nexus/index.ts (runNexus)
+
+### A. 남길 것 (얇은 데몬에 그대로)
+
+| # | 로직 | 위치(줄) | 비고 |
+|---|---|---|---|
+| A1 | 싱글인스턴스 락 (`~/.elanous/nexus/.lock`) | 부트 초반 | 보존 계약 |
+| A2 | `runtime.json` 사이드카 (pid·startedAt·phase·httpPort·httpAuth·tailnetUrl·template — `NexusRuntimeMeta`, `src/nexus/runtime.ts`) | 부트 + `onRuntimeSidecarWrite` | 외부 발견 계약 — 형식 무변 |
+| A3 | HTTP 서버 `startNexusHttpServer` 배선 | L2951(DI 기본값 `opts.startNexusHttpServerFn ?? startNexusHttpServer`) · L2988(호출 `httpServer = startHttpServer({`) | 데몬 표면의 핵심 |
+| A4 | PWA static (staticDir) | L3004(`...(pwaStaticDir ? { staticDir: pwaStaticDir } : {})`) | 남긴다 |
+| A5 | SSE 이벤트버스 (`NexusEventBus` + bridge) | 생성 L1069(`const eventBus = new NexusEventBus();`) · 배선 시 `eventBus` 인자(L2991 인접) · L2999(`...(wsBridgeOpts ? { wsBridge: wsBridgeOpts } : {})`) | 남긴다 |
+| A6 | 발송 substrate (`buildOutboundSubstrate` — telegram/discord 발송) | L2784(선언) · L2788(`outboundSubstrate = buildOutboundSubstrate({`) | 발송은 남긴다 |
+| A7 | 카드 webPushDecisionTimer | L2762(`webPushDecisionTimer = setInterval(`) · L2767(`.unref()`) | 카드는 남긴다(발송 타이머 자체) |
+| A8 | 종결 훅: `gracefulExit`/`cleanExit` · `wrappedRelease` · `drainTelegramThen` | 임포트 L251(`gracefulExit, cleanExit`) · `wrappedRelease` 정의 L3312 · `drainTelegramThen` 정의 L3514 · 발화 L3710·L3770(`drainTelegramThen(() => gracefulExit({`) · `cleanExit` L3730·L3790 | **무조건 보존** — 재시작 0·깨끗한 종료의 받침 |
+| A9 | supervisor 배선 (`createSupervisor` + TabRegistry + 종결 순서) | L1854(`supervisor = createSupervisor({`) | 운영 레일의 받침 |
+| A10 | 워크플로 데몬 배선 (`createWorkflowRuntimeDaemon` — 트리거 소스 구독) | L2438(`workflowDaemon = createWorkflowRuntimeDaemon({`) | emit→디스패치 경계는 유지(2단계 이후 슬림화) |
+
+### B. 뺄 것 (짧게 사는 프로세스로 이전)
+
+| # | 로직 | 위치(줄) | 이전 형태 |
+|---|---|---|---|
+| B1 | §5-③ continuation scheduler (자율 idle-continuation) | L2272–2419 (주석 L2272 · try L2278 · catch L2417–2419) | bun 자식 프로세스 |
+| B2 | TOX (`wireTox` 부트 + subagent surface bridge) | L2242–2269 (`wireTox({` L2242 · catch 경고 L2269) | bun 자식 프로세스 |
+| B3 | thread sweep | L2546–2589 (주석 L2546 `★ UR4b 조율자 상주 thread-awareness sweep` · try L2550 · `setInterval`(180초 주기) L2575 · catch L2587–2589) | bun 자식 프로세스 |
+| B4 | dig/replay armer (dig L2387–2400 · replay L2402–2415) | L2387–2415 — **B1 try 블록 내부에 중첩**(L2387 > B1 try L2278 · L2415 < B1 catch L2417) ⇒ B1과 분리해 이전 불가, 같은 조각으로만 | bun 자식 프로세스(B1 조각에 동승) |
+| B5 | catch-up sweep | L2489–2518 (주석 L2489 `Mission Fabric 통합 U4b — 이관잡(run_via='trigger') catch-up 자기회복` · try L2494 · catch L2515–2517) | bun 자식 프로세스 |
+| B6 | patcher substrate (`buildPatcherSubstrate`) | L2869(`patcherSubstrateHandle = buildPatcherSubstrate({`) | bun 자식 프로세스 |
+| B7 | devices cron (`buildDevicesSubstrate`) | L2897(`devicesSubstrateHandle = buildDevicesSubstrate({`) | bun 자식 프로세스 |
+| B8 | 텔레그램/디스코드 폴러 (`wireNexusTelegramQaPollers` 정의 L301 · 호출 L2715·L2727) — **폴링** 로직. 발송(A6)과 구분 | 부트 배선 | bun 자식 프로세스 |
+| B9 | 카드 decision 판단 로직 (webPushDecisionTimer의 «판단» 부분 — 타이머·발송은 A7로 남김) | L2752–2767 (판단 게이트 L2752 — 타이머 A7 L2762와 같은 블록) | bun 자식 프로세스 |
+
+### B-제외 검토 (빼지 «않는» 것 — 목록 대조용)
+
+- `startSessionDecisionForward` — 발송 표면(A6 계열)과 결합 → 이번 칸에서는 남긴다.
+- workflow 트리거 소스 구독(daemon.ts) — dispatch 경계는 데몬에 유지(TASK-AGENT가 붙는 지점이므로 칸 근거 끝 반영).
+
+## 2. 데몬 안 로직 목록 — src/workflow-runtime/daemon.ts (createWorkflowRuntimeDaemon)
+
+| # | 로직 | 상태 |
+|---|---|---|
+| C1 | 트리거 소스 구독 (schedule/webhook/discord/telegram/chat) | **남긴다** — 데몬의 디스패치 표면 |
+| C2 | emit→`runWorkflowToCompletion` 디스패치 | 남긴다 (슬림화는 후속 조각) |
+| C3 | `registerWorkflow` 라이브 등록 | 남긴다 |
+| C4 | dispatchWebhook/Chat/Discord/Telegram | 남긴다 |
+| C5 | L212 `lifecycle === 'draft'` 게이트 (recordSkip 3-sink) | **남긴다** — 칸 근거 끝(draft #27303 닫음)의 반영 지점. TASK-AGENT(OP 디스패처)가 붙는 경계 |
+| C6 | run-to-completion 내부의 판단·루프·하니스 성 로직 — **구체 경계(실측)**: `emit` 트리거 콜백 전체 L183–261(페이로드 정규화 → C5 draft 게이트 L212 → runId 생성 L228 → `await runFn(...)` L231–234). `runFn` = `runWorkflowToCompletion`(임포트 L14 · 주입 L152 `const runFn = opts.runWorkflow ?? runWorkflowToCompletion;`) | 뺄 후보 — 별도 조각에서 자식 프로세스로 (이번 1단계에서는 경계 실측만) |
+
+## 3. 뺄 순서 (확정)
+
+1. **B1 continuation scheduler (L2272–2418)** — 첫 조각. §5-③ 자율 발화라 위험도가 가장 높고 경계가 가장 깨끗하다. **B4 dig/replay armer(L2387–2415)는 이 조각에 동승한다** — §1 B4 행대로 B1 try 블록 내부에 중첩되어 분리 이전 불가(별도 단계 없음).
+2. **B2 TOX wireTox (L2242–2269)** — B1과 같은 조각으로 함께 이전 가능(분해 권고 조각 2의 첫 명세: "continuation·TOX 등 목록 상 첫 번째").
+3. B3 thread sweep (L2546–2589)
+4. B5 catch-up sweep
+5. B6 patcher substrate
+6. B7 devices cron
+7. B8 텔레그램/디스코드 폴러
+8. B9 카드 decision 판단
+9. C6 run-to-completion 내부 판단·루프·하니스 성 로직(daemon.ts emit 콜백 L183–261) — 별도 조각(§2 C6 행의 구체 경계대로)
+
+## 4. 이전 형태(수송 계약) — running-runs 패턴 복제
+
+- 짧게 사는 **bun 자식 프로세스** (`src/nexus/api/running-runs-background.ts` / `running-runs-child.ts` 선례):
+  - 자식 스크립트가 로직을 실행하고 결과를 stdout JSON으로 인쇄
+  - 부모는 15s refresh · 60s timeout · in-flight dedup로 스냅샷만 즉시 반환
+- supervisor TabSpec (`src/nexus/kinds/daemon.ts` `createDaemonTabSpec` 계약): socket health 10s · on-crash backoff [5s,15s,60s] · maxPerHour 5 — **재시작 0 운영 레일**.
+- 호출자: `runNexus()`(src/nexus/index.ts) 안 해당 로직의 기존 위치 — diff에서 호출 치환이 보여야 한다(wiring 증거).
+
+## 5. 보존 지점 (무조건)
+
+- `gracefulExit`/`cleanExit` · `wrappedRelease` · `drainTelegramThen` 종결 훅 — 이전되는 로직의 자식 프로세스는 이 훅에서 함께 정지되어야 한다.
+- `runtime.json` 사이드카 형식(`NexusRuntimeMeta`) — 무변.
+- 다른 명령·화면의 기본 동작 · 원장 형식 — 무변.
+- 칸 범위 밖(src/nexus/index.ts · src/workflow-runtime/daemon.ts 외)은 건드리지 않는다. (자식 스크립트·TabSpec 신규 파일은 이 목적의 산출물로 칸 근거가 허용하는 범위에서 후속 조각이 판단한다.)
+
+## 6. 남은 것 (칸 근거 끝 반영)
+
+- 이번 런(1단계) = 이 문서(목록 ⊕ 순서)까지. 가지 보존, 재발사는 디스패처·TA 판단.
+- 미이전 항목: 위 §3 전부 (B1–B9 · C6) — 순서 확정만 됨.
+
+## 7. 검증 기록 (1단계 실측 · 줄 단위 대조)
+
+이 절은 §1 목록이 실제 코드와 대응하는지 `rg -n`으로 대조한 실측 기록이다. 이 라운드에 코드는 건드리지 않았다(1단계 = 측정 먼저).
+
+| 문서 항목 | 실측 (rg -n on src/nexus/index.ts) | 일치 |
+|---|---|---|
+| B1 continuation | L2272 `nexus boot: autonomous continuation scheduler` … L2418 | ✅ |
+| B2 TOX | L2242 `nexus boot: TOX` … L2269 | ✅ |
+| B3 thread sweep | L2546 `UR4b 조율자 상주 thread-awareness sweep` … L2589 | ✅ |
+| B4 dig/replay armer | L2387 `nexus boot: dig/replay armer` (continuation 블록 내부) | ✅ |
+| B5 catch-up sweep | L2489 `이관잡 catch-up 자기회복` | ✅ |
+| A3 HTTP 배선 | `rg -n 'startNexusHttpServer\('` → L2951 호출 | ✅ |
+| A7 카드 타이머 | `rg -n 'webPushDecisionTimer'` → L2762 | ✅ |
+| A8 종결 훅 | L3312 `Awaiting completion of async termination tasks (p0)` · L3514 `drainTelegramThen(…)` · L3710 `wireTox` 자동 해제 | ✅ |
+| B6/B7 | `buildPatcherSubstrate`·`buildDevicesSubstrate` 임포트 + `wireSubstrates` L3170 | ✅ |
+
+### 판정선 시험
+
+골이 지정한 11개 경로 중 이 트리에 실재하는 8개와 그 자리의 실물 시험(총 12파일)을 실행했다:
+
+```
+bun test src/nexus/index.test.ts test/workflow-runtime-daemon.test.ts \
+  src/nexus/api/running-runs-background.test.ts test/nexus-supervisor-health.test.ts \
+  test/nexus-supervisor-restart.test.ts test/nexus-kinds-daemon.test.ts \
+  test/nexus-daemon-tab-default-off.test.ts test/nexus-runtime-integration.test.ts \
+  test/nexus-prompt-stream-sse.test.ts src/nexus/api/task-cards-api.test.ts \
+  test/nexus-headless-mode.test.ts test/nexus-graceful-exit.test.ts
+```
+
+결과: **182 pass · 0 fail · 1 skip**. 골이 지정한 3개 경로(`supervisor/index`·`kinds/daemon`·`sse-heartbeat`)는 이 트리에 존재하지 않고(경로 실측: `bun test 'src/nexus/supervisor/index.test.ts'` → `error: Could not find`), 같은 단위를 커버하는 실물 시험이 위 목록으로 돌았다.
+
+### §간 정합 대조 (must-fix 수리 기록)
+
+- §1 B4 행(«B1 try 블록 내부 중첩 ⇒ 분리 이전 불가, 같은 조각으로만(B1 조각에 동승)») ↔ §3: B4는 §3에서 독립 단계로 존재하지 «않고» 1번 B1 항에 «B4 dig/replay armer는 이 조각에 동승한다»로 명시 — 모순 0건. 재현: `rg -n '같은 조각|이 조각에 동승' src/nexus/DAEMON-THIN-inventory-2026-10-15.md` → §1 B4 행·§3 1번만 B4를 언급(§3 4번 독립 단계 행은 삭제됨).
+- §2 C6 행(구체 경계: emit 콜백 L183–261 · runFn = runWorkflowToCompletion) ↔ §3: C6가 §3 9번에 같은 경계로 배치 — §3가 C6 없이 끝나던 공백 제거.
+- 골 문서 U층 ↔ 게이트 관측: 이 diff에는 실행 코드 변경이 없다(`Verify-by-breaking: skipped; reason=no-changes`). 골 U층의 «데몬 얇음·자식 프로세스 이전·재시작 0» 줄은 «이 조각에서 미측정 — 후속 조각(이전 완료 후) 판정»으로 정정했다(§6 미이전 명시와 정합). `runNexus()` 실경로 관측은 후속 조각의 수용 기준으로 이관된다.

package/src/nexus/api/http-server.ts

@@ -861,29 +861,53 @@ function isWithinRoot(path: string, root: string): boolean {
   return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
 }
 
+/** realpath-resolved folder-root allow-list; a missing root grants nothing. */
+function resolveFolderRoots(roots: string[]): string[] {
+  const allowed: string[] = [];
+  for (const root of roots) {
+    try { allowed.push(realpathSync(root)); } catch { /* a missing root grants nothing */ }
+  }
+  return allowed;
+}
+
+/** Outcome of the folder-root allow-list check shared by the picker and project creation. */
+type FolderRootResolution =
+  | { ok: true; path: string }
+  | { ok: false; error: 'folder_unavailable' | 'outside_allowed_roots'; status: 404 | 403 };
+
+/**
+ * Resolves a folder path against the allow-listed roots with realpath first,
+ * so `..` segments and symlinks cannot escape the roots. A path that cannot
+ * be resolved is unavailable (404); a resolved path outside every root is
+ * refused (403).
+ */
+function resolveWithinFolderRoots(requested: string, allowed: string[]): FolderRootResolution {
+  let path: string;
+  try { path = realpathSync(requested); }
+  catch { return { ok: false, error: 'folder_unavailable', status: 404 }; }
+  if (!allowed.some(root => isWithinRoot(path, root))) {
+    return { ok: false, error: 'outside_allowed_roots', status: 403 };
+  }
+  return { ok: true, path };
+}
+
 /**
  * Remote folder picker: lists sub-folders under an allow-listed root only.
  * Every path is resolved with realpath first, so `..` segments and symlinks cannot escape the roots;
  * dot-folders are hidden and symlinked entries that point outside the roots are not listed.
  */
 export function handleProjectFoldersGet(req: Request, roots: string[] = [homedir()]): Response {
-  const allowed: string[] = [];
-  for (const root of roots) {
-    try { allowed.push(realpathSync(root)); } catch { /* a missing root grants nothing */ }
-  }
+  const allowed = resolveFolderRoots(roots);
   if (allowed.length === 0) return jsonResponse({ error: 'folder_unavailable' }, 404);
   const requested = new URL(req.url).searchParams.get('path') ?? allowed[0]!;
   if (!isAbsolute(requested) || requested.includes('\0')) return jsonResponse({ error: 'invalid_folder' }, 400);
-  let path: string;
-  try { path = realpathSync(requested); }
-  catch {
-    debug.log('nexus.projects', 'folders-unavailable', { reason: 'missing' });
-    return jsonResponse({ error: 'folder_unavailable' }, 404);
-  }
-  if (!allowed.some(root => isWithinRoot(path, root))) {
-    debug.log('nexus.projects', 'folders-refused', { reason: 'outside-roots' });
-    return jsonResponse({ error: 'outside_allowed_roots' }, 403);
+  const resolved = resolveWithinFolderRoots(requested, allowed);
+  if (!resolved.ok) {
+    if (resolved.status === 403) debug.log('nexus.projects', 'folders-refused', { reason: 'outside-roots' });
+    else debug.log('nexus.projects', 'folders-unavailable', { reason: 'missing' });
+    return jsonResponse({ error: resolved.error }, resolved.status);
   }
+  const path = resolved.path;
   try {
     if (!statSync(path).isDirectory()) return jsonResponse({ error: 'not_directory' }, 400);
     const folders = readdirSync(path, { withFileTypes: true })
@@ -905,7 +929,12 @@ export function handleProjectFoldersGet(req: Request, roots: string[] = [homedir
   }
 }
 
-export async function handleProjectsPost(req: Request): Promise<Response> {
+/**
+ * Project creation. A `primaryFolder`, when given, must pass the same
+ * projectFolderRoots allow-list as the remote folder picker: realpath first,
+ * so `..` segments and symlinks cannot persist a folder outside the roots.
+ */
+export async function handleProjectsPost(req: Request, roots: string[] = [homedir()]): Promise<Response> {
   let body: unknown;
   try { body = await req.json(); }
   catch { return jsonResponse({ error: 'invalid_json' }, 400); }
@@ -919,6 +948,16 @@ export async function handleProjectsPost(req: Request): Promise<Response> {
   if (primaryFolder !== undefined && (typeof primaryFolder !== 'string' || !isAbsolute(primaryFolder))) {
     return jsonResponse({ error: 'invalid_primary_folder' }, 400);
   }
+  if (typeof primaryFolder === 'string') {
+    const allowed = resolveFolderRoots(roots);
+    if (allowed.length === 0) return jsonResponse({ error: 'folder_unavailable' }, 404);
+    const resolved = resolveWithinFolderRoots(primaryFolder, allowed);
+    if (!resolved.ok) {
+      if (resolved.status === 403) debug.log('nexus.projects', 'post-primary-folder-refused', { reason: 'outside-roots' });
+      else debug.log('nexus.projects', 'post-primary-folder-unavailable', { reason: 'missing' });
+      return jsonResponse({ error: resolved.error }, resolved.status);
+    }
+  }
   return jsonResponse({ project: createProject({ name, ...(primaryFolder !== undefined ? { primaryFolder } : {}) }) }, 201);
 }
 
@@ -1498,7 +1537,7 @@ export async function routeRequest(
   }
   if (pathname === '/v1/projects' && (method === 'GET' || method === 'POST')) {
     if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
-    return method === 'GET' ? handleProjectsGet() : handleProjectsPost(req);
+    return method === 'GET' ? handleProjectsGet() : handleProjectsPost(req, opts.projectFolderRoots);
   }
   if (pathname.startsWith('/v1/projects/') && pathname.endsWith('/autopsy') && method === 'GET') {
     if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);

package/src/nexus/api/loop-resources.ts

@@ -1,11 +1,13 @@
 import { defaultListHarnessProcesses } from '../../harness/harness-cli-command.js';
 import { devVersion, listChecklist } from '../../release-loop/checklist.js';
 import { listSchedules } from '../../release-loop/release-schedule.js';
-import { releaseLedgerRoot } from '../../instance/resolve.js';
+import { effectiveInstanceRoot, releaseLedgerRoot } from '../../instance/resolve.js';
+import { ResourceLedger, type ResourceView } from '../../control-plane/ledger.js';
 import { getUserConfig, ORCHESTRATOR_DEFAULTS } from '../../user-config.js';
 import { seatOfTree, trafficTick, TRAFFIC_SEATS, type TrafficCell, type TrafficResult } from '../../loops/orchestrator/traffic.js';
 import { finishAdvice, measureFinish } from '../../loops/orchestrator/finish-rate.js';
 import { jsonResponse } from './json-response.js';
+import { debug } from '../../debug/log.js';
 
 /** Read-only snapshot of the same ORCH traffic decision used by the scheduled tick. */
 export function observeLoopResources(deps: {
@@ -36,7 +38,21 @@ export function observeLoopResources(deps: {
   });
 }
 
-export function handleLoopResourcesGet(observe: () => TrafficResult = observeLoopResources): Response {
-  try { return jsonResponse({ resource: observe() }); }
+/** The Nexus resource view reads the existing control ledger; it never allocates a second pool ledger. */
+export function handleLoopResourcesGet(
+  observe: () => TrafficResult = observeLoopResources,
+  listPodWorkers: () => ResourceView[] = () => new ResourceLedger(effectiveInstanceRoot()).list({ kind: 'pod-worker-lease' }),
+): Response {
+  try {
+    const resource = observe();
+    try {
+      const podWorkers = listPodWorkers().map(row => ({ id: row.id, machine: row.machine, workerId: row.name,
+        key: row.attrs.key, state: row.attrs.state, generation: row.attrs.generation, ageMs: row.ageMs, expired: row.expired }));
+      return jsonResponse({ resource, podWorkers });
+    } catch (error) {
+      debug.log('nexus.resource', 'pod-worker-ledger-unmeasured', { errorKind: error instanceof Error ? error.name : typeof error });
+      return jsonResponse({ resource, podWorkers: null, podWorkersError: 'unmeasured' });
+    }
+  }
   catch { return jsonResponse({ error: 'resource-unavailable' }, 503); }
 }

package/src/nexus/api/ops-api.ts

@@ -10,6 +10,7 @@ import { operatorSignal } from './operator.js';
 import { createSeatsCache, todayKst } from './ops-seats.js';
 import { liveSeatsSources } from './ops-seats-sources.js';
 import { createOverviewCache } from '../../ops/overview-cache.js';
+import { resourcesFromOverview } from '../../ops/resources.js';
 import { parseSince } from '../../ops/overview-collect.js';
 import type { MetaApiOpts } from './meta-api.js';
 
@@ -192,6 +193,8 @@ export function handleOpsApi(req: Request, metaApi: MetaApiOpts | undefined): Re
   const signal = metaApi ? operatorSignal(req, metaApi) : { operator: false, operatorSource: null };
   if (!signal.operator) {
     debug.log('ops.api', 'refused', { path: pathname, source: signal.operatorSource });
+    // RES-FLOOR-API: no credential was offered at all — this endpoint names it 401; every other path keeps 403.
+    if (pathname === '/v1/ops/resources') return jsonResponse({ error: 'unauthorized' }, 401);
     return jsonResponse({ error: 'forbidden' }, 403);
   }
   const served = (response: Response): Response => {
@@ -210,6 +213,14 @@ export function handleOpsApi(req: Request, metaApi: MetaApiOpts | undefined): Re
       ...(version ? { version } : {}), ...(url.searchParams.has('owner') ? { owner: url.searchParams.get('owner')! } : {}) })
       .then((overview) => served(jsonResponse(overview)), () => jsonResponse({ error: 'overview-unavailable' }, 500));
   }
+  if (pathname === '/v1/ops/resources') {
+    // RES-FLOOR-API — shares the overview cache; no new collection, no kubectl/ssh call, never waits.
+    overviewCache ??= createOverviewCache();
+    const peeked = overviewCache.peek();
+    return Promise.resolve(peeked
+      ? served(jsonResponse(resourcesFromOverview(peeked.snapshot, peeked.pods, peeked.at)))
+      : served(jsonResponse({ stale: true })));
+  }
   if (pathname === '/v1/ops/seats') {
     const date = url.searchParams.get('date') ?? todayKst();
     if (!DATE.test(date) || Number.isNaN(Date.parse(`${date}T00:00:00+09:00`))) return jsonResponse({ error: 'invalid-date' }, 400);

package/src/nexus/daemon-thin-inventory.md

@@ -0,0 +1,37 @@
+## stay
+http | src/nexus/api/http-server.ts:startNexusHttpServer | HTTP
+pwa | src/nexus/pwa-registration.ts:createPwaRegistration | PWA
+workflow-dispatch | src/workflow-runtime/daemon.ts:dispatchWebhook | 발송/dispatch
+outbound | src/notifications/outbound-boot.ts:buildOutboundSubstrate | 발송/dispatch
+sse-bus | src/nexus/api/event-bus.ts:NexusEventBus | SSE
+sse-events | src/nexus/api/events.ts:handleSseEvents | SSE
+sse-heartbeat | src/nexus/api/sse-heartbeat.ts:SSE_HEARTBEAT_MS | SSE
+task-cards | src/nexus/api/task-cards-api.ts:handleTaskCardsGet | cards
+decision-cards | src/decisions/decision-cards.ts:DecisionCardService | cards
+hitl-pending | src/nexus/api/hitl-runtime.ts:createHitlPendingCallbacks | cards
+
+## leave
+executor | src/workflow-runtime/executor.ts:runWorkflowToCompletion | judgment/executor; daemon emit awaits this in-process — ops rail must consume a short-lived run instead (process extraction is remaining work, out of stage 1)
+harness | src/boot/daemon-tools/self-implement.ts:dispatchSelfImplement | harness/self-implement wired into TOX externalExec on this boot — already process-shaped; must leave the daemon
+agent-loop | src/telegram-agent.ts:makeTelegramAgentRunTurn | agent loop started on this boot (telegram Q&A; discord makeDiscordAgentRunTurn and ACP createAgentTurnRunner siblings). AutopilotLoopDriver in src/autopilot/agent-loop.ts is not started here
+tox | src/task-orchestrator/boot.ts:wireTox | TOX TaskFeedbackLoop + startToxLoop long-lived dispatcher started on this boot
+continuation | src/dispatch/continuation-scheduler.ts:ContinuationScheduler.start | idle-continuation scheduler constructed on this boot (starts when dispatch.enabled)
+workflow-schedule | src/workflow-runtime/daemon.ts:start | scheduleSource.start is a long-lived trigger scheduler; dispatch methods stay
+intent-prediction | src/intent-prediction/index.ts:createIntentPredictionService | long-lived ranker tick / judgment scheduler
+patcher | src/background-reasoning/patcher-boot.ts:buildPatcherSubstrate | self-improving patcher loop started on this boot
+daily-reflection | src/notes/daily-reflection-scheduler.ts:startDailyReflectionScheduler | daily reflection scheduler
+discovery-cron | src/registry/discovery/cron.ts:startDiscoveryCron | discovery cron scheduler
+watch-default | src/domains/watch-default-scheduler.ts:startWatchDefaultScheduler | watch default scheduler
+
+## removalOrder
+executor
+harness
+agent-loop
+tox
+continuation
+workflow-schedule
+intent-prediction
+patcher
+daily-reflection
+discovery-cron
+watch-default

package/src/nexus/index.ts

@@ -88,6 +88,7 @@ import type { McpReloadOutcome, McpReloadServerResult } from './api/admin-mcp-re
 import { loadOrCreateSigningKey, NonceStore } from './api/edit-in-pwa-core.js';
 import { subscribeErrorSnapshotWriter } from './supervisor/error-snapshot.js';
 import { NexusEventBus } from './api/event-bus.js';
+import { startTaRepairEventCollector } from '../steward/ta-repair-event-collect.js';
 import type { SessionSurface } from '../session/index.js';
 import { wireWorkflowApprovalEvents } from './api/workflow-event-bridge.js';
 import { wireAgentStatusEvents } from './api/agent-status-event-bridge.js';
@@ -275,6 +276,73 @@ import { packageVersion } from '../version/code-revision.js';
 export const NEXUS_VERSION = packageVersion();
 export const NEXUS_PHASE = 'N-5 PR χ (graceful exit + restart pending)';
 
+// DAEMON-THIN stage 1 — inventory only (RFC-universe-by-house §4).
+// Intentional wiring boundary: do not call daemonThinStage1 from runNexus.
+// A runtime caller would change process composition, which stage 1 forbids.
+export const DAEMON_THIN_STAY_ALLOWLIST = ['HTTP', 'PWA', '발송/dispatch', 'SSE', 'cards'] as const;
+export type DaemonThinStayAllowlistClass = (typeof DAEMON_THIN_STAY_ALLOWLIST)[number];
+
+export interface DaemonThinStayEntry {
+  id: string;
+  fileFunction: string;
+  allowlistClass: DaemonThinStayAllowlistClass;
+}
+
+export interface DaemonThinLeaveEntry {
+  id: string;
+  fileFunction: string;
+  why: string;
+}
+
+export interface DaemonThinStage1 {
+  stay: readonly DaemonThinStayEntry[];
+  leave: readonly DaemonThinLeaveEntry[];
+  removalOrder: readonly string[];
+}
+
+export function daemonThinStage1(): DaemonThinStage1 {
+  return {
+    stay: [
+      { id: 'http', fileFunction: 'src/nexus/api/http-server.ts:startNexusHttpServer', allowlistClass: 'HTTP' },
+      { id: 'pwa', fileFunction: 'src/nexus/pwa-registration.ts:createPwaRegistration', allowlistClass: 'PWA' },
+      { id: 'workflow-dispatch', fileFunction: 'src/workflow-runtime/daemon.ts:dispatchWebhook', allowlistClass: '발송/dispatch' },
+      { id: 'outbound', fileFunction: 'src/notifications/outbound-boot.ts:buildOutboundSubstrate', allowlistClass: '발송/dispatch' },
+      { id: 'sse-bus', fileFunction: 'src/nexus/api/event-bus.ts:NexusEventBus', allowlistClass: 'SSE' },
+      { id: 'sse-events', fileFunction: 'src/nexus/api/events.ts:handleSseEvents', allowlistClass: 'SSE' },
+      { id: 'sse-heartbeat', fileFunction: 'src/nexus/api/sse-heartbeat.ts:SSE_HEARTBEAT_MS', allowlistClass: 'SSE' },
+      { id: 'task-cards', fileFunction: 'src/nexus/api/task-cards-api.ts:handleTaskCardsGet', allowlistClass: 'cards' },
+      { id: 'decision-cards', fileFunction: 'src/decisions/decision-cards.ts:DecisionCardService', allowlistClass: 'cards' },
+      { id: 'hitl-pending', fileFunction: 'src/nexus/api/hitl-runtime.ts:createHitlPendingCallbacks', allowlistClass: 'cards' },
+    ],
+    leave: [
+      { id: 'executor', fileFunction: 'src/workflow-runtime/executor.ts:runWorkflowToCompletion', why: 'judgment/executor; daemon emit awaits this in-process — ops rail must consume a short-lived run instead (process extraction is remaining work, out of stage 1)' },
+      { id: 'harness', fileFunction: 'src/boot/daemon-tools/self-implement.ts:dispatchSelfImplement', why: 'harness/self-implement wired into TOX externalExec on this boot — already process-shaped; must leave the daemon' },
+      { id: 'agent-loop', fileFunction: 'src/telegram-agent.ts:makeTelegramAgentRunTurn', why: 'agent loop started on this boot (telegram Q&A; discord makeDiscordAgentRunTurn and ACP createAgentTurnRunner siblings). AutopilotLoopDriver in src/autopilot/agent-loop.ts is not started here' },
+      { id: 'tox', fileFunction: 'src/task-orchestrator/boot.ts:wireTox', why: 'TOX TaskFeedbackLoop + startToxLoop long-lived dispatcher started on this boot' },
+      { id: 'continuation', fileFunction: 'src/dispatch/continuation-scheduler.ts:ContinuationScheduler.start', why: 'idle-continuation scheduler constructed on this boot (starts when dispatch.enabled)' },
+      { id: 'workflow-schedule', fileFunction: 'src/workflow-runtime/daemon.ts:start', why: 'scheduleSource.start is a long-lived trigger scheduler; dispatch methods stay' },
+      { id: 'intent-prediction', fileFunction: 'src/intent-prediction/index.ts:createIntentPredictionService', why: 'long-lived ranker tick / judgment scheduler' },
+      { id: 'patcher', fileFunction: 'src/background-reasoning/patcher-boot.ts:buildPatcherSubstrate', why: 'self-improving patcher loop started on this boot' },
+      { id: 'daily-reflection', fileFunction: 'src/notes/daily-reflection-scheduler.ts:startDailyReflectionScheduler', why: 'daily reflection scheduler' },
+      { id: 'discovery-cron', fileFunction: 'src/registry/discovery/cron.ts:startDiscoveryCron', why: 'discovery cron scheduler' },
+      { id: 'watch-default', fileFunction: 'src/domains/watch-default-scheduler.ts:startWatchDefaultScheduler', why: 'watch default scheduler' },
+    ],
+    removalOrder: [
+      'executor',
+      'harness',
+      'agent-loop',
+      'tox',
+      'continuation',
+      'workflow-schedule',
+      'intent-prediction',
+      'patcher',
+      'daily-reflection',
+      'discovery-cron',
+      'watch-default',
+    ],
+  };
+}
+
 type TelegramAgentRunTurnFactory = typeof import('../telegram-agent.js').makeTelegramAgentRunTurn;
 type TelegramChannelResolver = typeof import('../domains/telegram-channels.js').resolveTelegramChannels;
 type TelegramInteractivePollerSelector = typeof import('../domains/telegram-channels.js').interactivePollerTokens;
@@ -1067,6 +1135,7 @@ export async function runNexus(opts: RunNexusOptions = {}): Promise<RunNexusHand
   }
 
   const eventBus = new NexusEventBus();
+  const stopTaRepairEventCollector = startTaRepairEventCollector(eventBus);
   const state = createNexusState({ nexusVersion: NEXUS_VERSION, phase: NEXUS_PHASE });
   state.bus = eventBus;
   // BACKLOG #9 — fan workflow approval lifecycle into `/v1/events` SSE
@@ -3315,6 +3384,7 @@ export async function runNexus(opts: RunNexusOptions = {}): Promise<RunNexusHand
     pushEvent(state, { kind: 'nexus.shutdown' });
     pwaRegistration.unregister();
     try { unsubscribeWebtermTabLifecycle(); } catch { /* swallow */ }
+    try { stopTaRepairEventCollector(); } catch { /* swallow */ }
     try { unsubscribeErrorSnapshots(); } catch { /* swallow */ }
     if (supervisor) {
       void supervisor.shutdown({ graceMs: 0 });

package/src/nexus/state/state.ts

@@ -104,6 +104,7 @@ export interface NexusEvent {
     // FeedbackEnvelope so `<StatusChip>` hydrates wherever chat is
     // rendered (PWA tab · iOS native · future Telegram bot).
     | 'agent.status'
+    | 'ta.repair.completed'
     // PLAN-chat-hud-multi-surface-port-2026-05-13 §4 M2 — HudStore
     // (process-wide HUD segment map) lifecycle. The bridge in
     // `hud-event-bridge.ts` subscribes to the store and publishes one

package/src/oauth/store.ts

@@ -27,10 +27,10 @@
 
 import {
   existsSync, readFileSync, writeFileSync, mkdirSync, renameSync,
-  chmodSync, realpathSync,
+  chmodSync, lstatSync, readlinkSync,
 } from 'node:fs';
 import { homedir } from 'node:os';
-import { join, dirname, basename, resolve } from 'node:path';
+import { join, dirname, parse, resolve, sep } from 'node:path';
 import { extractChatGPTClaims, decodeJWTPayload, type ChatGPTClaims } from './jwt.js';
 import { debug } from '../debug/log.js';
 import { isCodexStoreKey } from './codex-account.js';
@@ -347,12 +347,37 @@ export function listProviders(path: string = authStorePath()): string[] {
 /** 두 경로가 «실체로» 같은 파일인가. ⛔ 문자열 비교로는 심볼릭 링크가 가드를 통과한다
  *  (`CODEX_HOME` 이 `~/.codex` 로 가는 링크면 resolve() 결과가 다르다 · 리뷰 must-fix).
  *  ⚠️ 파일이 아직 없을 수 있으므로 «부모까지» 실체화하고 이름을 붙인다. */
+export function resolveMirrorGuardPath(path: string): string {
+  let candidate = resolve(path);
+  const visited = new Set<string>();
+  for (let hop = 0; hop < 40; hop++) {
+    if (visited.has(candidate)) throw new Error('mirror path symlink cycle');
+    visited.add(candidate);
+    const root = parse(candidate).root;
+    const parts = candidate.slice(root.length).split(sep).filter(Boolean);
+    let prefix = root;
+    let expanded = false;
+    for (const [index, part] of parts.entries()) {
+      const next = join(prefix, part);
+      let link = false;
+      try { link = lstatSync(next).isSymbolicLink(); }
+      catch (error) {
+        if (!['ENOENT', 'ENOTDIR'].includes((error as NodeJS.ErrnoException).code ?? '')) throw error;
+      }
+      if (link) {
+        candidate = resolve(dirname(next), readlinkSync(next), ...parts.slice(index + 1));
+        expanded = true;
+        break;
+      }
+      prefix = next;
+    }
+    if (!expanded) return candidate;
+  }
+  throw new Error('mirror path symlink depth exceeded');
+}
+
 function sameRealFile(a: string, b: string): boolean {
-  const norm = (p: string): string => {
-    try { return realpathSync(p); } catch { /* 아직 없다 — 부모로 내려간다 */ }
-    try { return join(realpathSync(dirname(p)), basename(p)); } catch { return resolve(p); }
-  };
-  return norm(a) === norm(b);
+  return resolveMirrorGuardPath(a) === resolveMirrorGuardPath(b);
 }
 
 /** ⛔ 테스트 러너 판정 — 이 값이 «거짓»이면 가드는 영영 안 도는 장식이 된다.

package/src/onboarding/first-run.ts

@@ -27,13 +27,38 @@ export function orderProviderChoices(detected: readonly LLMProviderName[] = []):
   return [...detected, ...CHOICE_BASE.filter((name) => !detected.includes(name))];
 }
 
-async function chooseProvider(detected: readonly LLMProviderName[] = []): Promise<LLMProviderName | null> {
+export type MenuAnswer =
+  | { kind: 'chosen'; provider: LLMProviderName }
+  | { kind: 'cancel' }
+  | { kind: 'miss' };
+
+// FIRST10-FIX: 첫 화면의 오타 한 번이 first-run 전체를 취소하던 마찰 — 빈 입력(취소 의사)과 달리
+// 선택지를 가리키지 못하는 입력(오타·범위 밖·전각 숫자)은 취소가 아니라 다시 묻는다.
+export function parseMenuAnswer(answer: string, choices: readonly LLMProviderName[]): MenuAnswer {
+  const trimmed = answer.trim();
+  if (trimmed === '') return { kind: 'cancel' };
+  const index = Number(trimmed) - 1;
+  const provider = Number.isInteger(index) && index >= 0 ? choices[index] : undefined;
+  return provider !== undefined ? { kind: 'chosen', provider } : { kind: 'miss' };
+}
+
+export async function promptProviderMenu(
+  ask: (prompt: string) => Promise<string>,
+  detected: readonly LLMProviderName[] = [],
+): Promise<LLMProviderName | null> {
   const choices = orderProviderChoices(detected);
   const menu = choices.map((name, i) => `${i + 1} ${CHOICE_LABEL[name] ?? name}`).join(', ');
+  for (;;) {
+    const parsed = parseMenuAnswer(await ask(`Choose LLM (${menu}; Enter to cancel): `), choices);
+    if (parsed.kind === 'chosen') return parsed.provider;
+    if (parsed.kind === 'cancel') return null;
+  }
+}
+
+async function chooseProvider(detected: readonly LLMProviderName[] = []): Promise<LLMProviderName | null> {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   try {
-    const answer = (await rl.question(`Choose LLM (${menu}; Enter to cancel): `)).trim();
-    return choices[Number(answer) - 1] ?? null;
+    return await promptProviderMenu((prompt) => rl.question(prompt), detected);
   } finally {
     rl.close();
   }

package/src/ops/overview-cache.ts

@@ -106,10 +106,10 @@ export function createOverviewCache(deps: {
     podTimer = schedule(() => { void refreshPods(); }, POD_MS);
     podTimer.unref();
   };
-  const present = (entry: Entry): OverviewData => {
-    const at = now();
+  /** Response-time Pod occupancy overlay — shared by /v1/ops/overview and /v1/ops/resources. */
+  const overlayPods = (snapshot: OverviewSnapshot, at: number): PodMemberRow[] => {
     const byContext = new Map(podRows.map((row) => [row.context, row]));
-    const pods: PodMemberRow[] = entry.snapshot.machines.pods.map((pod) => {
+    return snapshot.machines.pods.map((pod) => {
       const row = byContext.get(pod.context);
       const stale = row && at - row.observedAt >= POD_STALE_MS;
       const occupied = !podFailure && row && !stale && row.occupied !== null
@@ -117,11 +117,23 @@ export function createOverviewCache(deps: {
         : unmeasured<number>('pod pool background measure', podFailure ?? (stale ? '낡음(120초)' : row?.reason ?? '측정 대기'), row ? new Date(row.observedAt).toISOString() : null);
       return { ...pod, occupied };
     });
+  };
+  const present = (entry: Entry): OverviewData => {
+    const at = now();
+    const pods = overlayPods(entry.snapshot, at);
     const full = { ...entry.snapshot, machines: { ...entry.snapshot.machines, pods } };
     return { ...full, ...computeVerdict(full), durationMs: entry.durationMs,
       sources: [full.release.run.source, full.tasks.launchable.source, full.tasks.capacity.source],
       cacheAgeMs: Math.max(0, at - entry.at), refreshFailed: entry.failure ?? null };
   };
+  /** Read-only view of the freshest memo entry (RES-FLOOR-API) — never collects, never measures, never waits. */
+  const peek = (): { snapshot: OverviewSnapshot; pods: PodMemberRow[]; at: number } | null => {
+    let freshest: Entry | null = null;
+    for (const entry of memo.values()) if (!freshest || entry.at > freshest.at) freshest = entry;
+    if (!freshest) return null;
+    const at = now();
+    return { snapshot: freshest.snapshot, pods: overlayPods(freshest.snapshot, at), at };
+  };
   const get = async (options: Pick<CollectOptions, 'version' | 'owner'> & { sinceMs?: number; sinceLabel?: string } = {}): Promise<OverviewData> => {
     start();
     const key = JSON.stringify([options.version ?? null, options.owner ?? null, options.sinceMs ?? 3_600_000]);
@@ -171,5 +183,5 @@ export function createOverviewCache(deps: {
     }
     return present(memo.get(key)!);
   };
-  return { get, memoSize: () => memo.size, stop: () => { if (podTimer) clearInterval(podTimer); podTimer = null; memo.clear(); } };
+  return { get, peek, memoSize: () => memo.size, stop: () => { if (podTimer) clearInterval(podTimer); podTimer = null; memo.clear(); } };
 }