elanous 0.2.31 → 0.2.32

package/scripts/measure-si-task-cpu.ts

@@ -0,0 +1,143 @@
+#!/usr/bin/env bun
+/** Read-only, point-in-time CPU measurement of si-task Pods. No Jobs or Pods are created. */
+import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+
+type Pod = {
+  metadata?: { name?: string; creationTimestamp?: string };
+  status?: { phase?: string; containerStatuses?: Array<{ state?: { terminated?: { finishedAt?: string } } }> };
+  spec?: { containers?: Array<{ name?: string; resources?: { requests?: { cpu?: string } } }> };
+};
+type PodMetric = { metadata?: { name?: string }; timestamp?: string; containers?: Array<{ name?: string; usage?: { cpu?: string } }> };
+type KubeList<T> = { items?: T[] };
+
+export type CpuObservation = {
+  dateKst: string;
+  context: string;
+  namespace: string;
+  measuredAt: string;
+  coverage: 'point-in-time-current-pods-only';
+  podsSeenToday: number;
+  unknownOverlapPods: number;
+  podsWithMetric: number;
+  podsWithoutMetric: number;
+  oldestMetricAgeSeconds: number | null;
+  cpuMillis: { p50: number | null; p95: number | null; max: number | null };
+  candidates: Array<{ request: string; requestMillis: number; p95OfRequest: number | null; observedComparison: string; decision: string }>;
+  pods: Array<{ name: string; phase: string; requestMillis: number | null; usageMillis: number | null; metricTimestamp: string | null; metricAgeSeconds: number | null }>;
+};
+
+/** Kubernetes CPU quantity to millicores; null means unusable evidence. */
+export function cpuMillis(value: unknown): number | null {
+  if (typeof value !== 'string') return null;
+  const match = /^(\d+(?:\.\d+)?)(n|u|m)?$/.exec(value);
+  if (!match) return null;
+  const factor = match[2] === 'n' ? 0.000001 : match[2] === 'u' ? 0.001 : match[2] === 'm' ? 1 : 1000;
+  const result = Number(match[1]) * factor;
+  return Number.isFinite(result) ? result : null;
+}
+
+function percentile(sorted: readonly number[], fraction: number): number | null {
+  if (!sorted.length) return null;
+  return Math.round(sorted[Math.ceil(fraction * sorted.length) - 1]! * 100) / 100;
+}
+
+export function measureSiTaskCpu(
+  pods: KubeList<Pod>, metrics: KubeList<PodMetric>,
+  options: { dateKst: string; context: string; namespace: string; now?: Date },
+): CpuObservation {
+  const start = Date.parse(`${options.dateKst}T00:00:00+09:00`);
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(options.dateKst) || !Number.isFinite(start)
+    || new Date(start + 9 * 60 * 60 * 1000).toISOString().slice(0, 10) !== options.dateKst)
+    throw new Error(`invalid KST date: ${options.dateKst}`);
+  const end = start + 24 * 60 * 60 * 1000;
+  const now = options.now ?? new Date();
+  const byName = new Map((metrics.items ?? []).map((metric) => [metric.metadata?.name, metric]));
+  let unknownOverlapPods = 0;
+  const rows = (pods.items ?? []).filter((pod) => {
+    const name = pod.metadata?.name ?? '';
+    const created = Date.parse(pod.metadata?.creationTimestamp ?? '');
+    const finished = pod.status?.containerStatuses?.map((item) => Date.parse(item.state?.terminated?.finishedAt ?? ''))
+      .filter(Number.isFinite).sort((a, b) => b - a)[0];
+    const terminal = ['Succeeded', 'Failed'].includes(pod.status?.phase ?? '');
+    if (!name.startsWith('si-task-') || !Number.isFinite(created) || created >= end) return false;
+    if (created < start && terminal && finished === undefined) {
+      unknownOverlapPods++;
+      return false;
+    }
+    return !terminal || finished === undefined || finished >= start;
+  }).map((pod) => {
+    const name = pod.metadata!.name!;
+    const metric = byName.get(name);
+    const timestamp = Date.parse(metric?.timestamp ?? '');
+    const values = metric?.containers?.map((item) => cpuMillis(item.usage?.cpu)) ?? [];
+    const expected = pod.spec?.containers ?? [];
+    const namesMatch = expected.every((container) => !container.name || metric?.containers?.some((item) => item.name === container.name));
+    const containersComplete = expected.length > 0 && values.length === expected.length && namesMatch;
+    // Missing any container value is missing Pod usage, not a zero.
+    const ageSeconds = Math.round((now.getTime() - timestamp) / 1000);
+    const usageMillis = Number.isFinite(timestamp) && timestamp >= start && timestamp < end
+      && ageSeconds >= -120 && ageSeconds <= 120
+      && containersComplete && values.every((value) => value !== null)
+      ? Math.round((values as number[]).reduce((sum, value) => sum + value, 0) * 100) / 100 : null;
+    const requests = pod.spec?.containers?.map((item) => cpuMillis(item.resources?.requests?.cpu)) ?? [];
+    return {
+      name, phase: pod.status?.phase ?? 'Unknown',
+      requestMillis: requests.length > 0 && requests.every((value) => value !== null)
+        ? Math.round((requests as number[]).reduce((sum, value) => sum + value, 0) * 100) / 100 : null,
+      usageMillis, metricTimestamp: Number.isFinite(timestamp) ? metric!.timestamp! : null,
+      metricAgeSeconds: Number.isFinite(timestamp) ? ageSeconds : null,
+    };
+  }).sort((a, b) => a.name.localeCompare(b.name));
+  const measured = rows.flatMap((row) => row.usageMillis === null ? [] : [row.usageMillis]).sort((a, b) => a - b);
+  const ages = rows.flatMap((row) => row.metricAgeSeconds === null ? [] : [row.metricAgeSeconds]);
+  const oldestMetricAgeSeconds = ages.length ? Math.max(...ages) : null;
+  const stale = rows.some((row) => row.metricTimestamp !== null && row.metricAgeSeconds !== null
+    && (Date.parse(row.metricTimestamp) < start || Date.parse(row.metricTimestamp) >= end
+      || row.metricAgeSeconds < -120 || row.metricAgeSeconds > 120));
+  const p95 = percentile(measured, 0.95);
+  const candidates = [250, 500, 1000].map((requestMillis) => ({
+    request: requestMillis === 1000 ? '1' : `${requestMillis}m`, requestMillis,
+    p95OfRequest: p95 === null ? null : Math.round(p95 / requestMillis * 1000) / 10,
+    observedComparison: p95 === null ? 'unmeasured' : p95 <= requestMillis ? 'observed-p95-within-request' : 'observed-p95-above-request',
+    // A single metrics-server snapshot cannot justify a request change, even with full current-Pod coverage.
+    decision: stale ? 'stale-snapshot' : p95 === null ? 'unmeasured'
+      : measured.length < rows.length || unknownOverlapPods > 0 ? 'incomplete-coverage' : 'needs-time-series',
+  }));
+  return {
+    dateKst: options.dateKst, context: options.context, namespace: options.namespace,
+    measuredAt: now.toISOString(), coverage: 'point-in-time-current-pods-only',
+    podsSeenToday: rows.length, unknownOverlapPods, podsWithMetric: measured.length, podsWithoutMetric: rows.length - measured.length,
+    oldestMetricAgeSeconds,
+    cpuMillis: { p50: percentile(measured, 0.5), p95, max: measured.at(-1) ?? null }, candidates, pods: rows,
+  };
+}
+
+function kubectl(args: string[]): unknown {
+  const result = spawnSync('kubectl', args, { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, timeout: 20_000 });
+  if (result.error || result.status !== 0) throw new Error(`kubectl ${args.at(-1)} failed: ${result.error?.message ?? result.stderr?.trim() ?? result.status}`);
+  return JSON.parse(result.stdout);
+}
+
+if (import.meta.main) {
+  const args = process.argv.slice(2);
+  const option = (flag: string): string | undefined => {
+    const index = args.indexOf(flag);
+    return index < 0 ? undefined : args[index + 1];
+  };
+  const usage = 'Usage: bun scripts/measure-si-task-cpu.ts [--context pool-node-b] [--namespace elanous-test] [--date YYYY-MM-DD] [--pods-json FILE --metrics-json FILE]';
+  const known = new Set(['--context', '--namespace', '--date', '--pods-json', '--metrics-json']);
+  if (args.includes('--help')) { console.log(usage); process.exit(0); }
+  if (args.some((arg, index) => index % 2 === 0 ? !known.has(arg) : arg.startsWith('--')) || args.length % 2) throw new Error(usage);
+  const podsPath = option('--pods-json');
+  const metricsPath = option('--metrics-json');
+  const offline = Boolean(podsPath || metricsPath);
+  const context = option('--context') ?? (offline ? 'unknown' : 'pool-node-b');
+  const namespace = option('--namespace') ?? (offline ? 'unknown' : 'elanous-test');
+  const dateKst = option('--date') ?? new Intl.DateTimeFormat('en-CA', { timeZone: 'Asia/Seoul', year: 'numeric', month: '2-digit', day: '2-digit' }).format(new Date());
+  if (Boolean(podsPath) !== Boolean(metricsPath)) throw new Error('both --pods-json and --metrics-json are required for offline input');
+  const pods = podsPath ? JSON.parse(readFileSync(podsPath, 'utf8')) : kubectl(['--context', context, '-n', namespace, 'get', 'pods', '-o', 'json']);
+  const metrics = metricsPath ? JSON.parse(readFileSync(metricsPath, 'utf8'))
+    : kubectl(['--context', context, 'get', '--raw', `/apis/metrics.k8s.io/v1beta1/namespaces/${encodeURIComponent(namespace)}/pods`]);
+  console.log(JSON.stringify(measureSiTaskCpu(pods, metrics, { dateKst, context, namespace }), null, 2));
+}

package/scripts/ratchets/test-interference-patterns.allowlist.txt

@@ -77,7 +77,6 @@ body-dynamic-import	src/nexus/index.test.ts	1
 body-dynamic-import	src/pty-shell/pty-control-stance.test.ts	12
 body-dynamic-import	src/pty-shell/tui-run-state.test.ts	1
 body-dynamic-import	src/registry/catalog-discovery-fold.test.ts	1
-body-dynamic-import	src/self-dev/ask-launch-flow.test.ts	2
 body-dynamic-import	src/self-dev/dev-cli.test.ts	1
 body-dynamic-import	src/self-dev/dev-pipeline.test.ts	1
 body-dynamic-import	src/self-dev/entrance-registry.test.ts	3
@@ -222,7 +221,6 @@ chdir-without-restore	src/task-orchestrator/surfaces/dev-harness.test.ts	1
 chdir-without-restore	src/task-orchestrator/surfaces/pod-no-result.test.ts	2
 chdir-without-restore	src/task-orchestrator/surfaces/pod-ta-land-owner.test.ts	1
 chdir-without-restore	src/task-orchestrator/surfaces/self-implement-pod-oom-retry.test.ts	1
-chdir-without-restore	src/task-orchestrator/surfaces/self-implement-pod.test.ts	19
 chdir-without-restore	src/task-orchestrator/surfaces/self-implement.test.ts	1
 chdir-without-restore	test/llm-codex-dedup-guard.test.ts	1
 chdir-without-restore	test/oauth/codex-account-mirror.test.ts	1

package/scripts/release-loop/prepare-node.ts

@@ -1,19 +1,117 @@
 #!/usr/bin/env bun
-import { existsSync } from 'node:fs';
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { debug } from '../../src/debug/log.js';
 import { effectiveInstanceRoot } from '../../src/instance/resolve.js';
 import { errorResult, finishNode, lastResult, nodeOutput, readGraphContext, runCommand, type CommandRunner } from './node-verdict.js';
+import { isReleaseVersion } from './release-version.js';
 
-export function runPrepare(run: CommandRunner = runCommand) {
+/** Apparent bytes of the preserved archive; never follow a symlink out of its private directory. */
+function archiveBytes(path: string): number {
+  const entry = lstatSync(path);
+  if (!entry.isDirectory()) return entry.size;
+  return readdirSync(path).reduce((sum, name) => sum + archiveBytes(join(path, name)), 0);
+}
+
+function readRegularManifest(path: string): Buffer {
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    if (!fstatSync(fd).isFile()) throw new Error(`prepared manifest is not a regular file: ${path}`);
+    return readFileSync(fd);
+  } finally { closeSync(fd); }
+}
+
+export function runPrepare(run: CommandRunner = runCommand, move: typeof renameSync = renameSync) {
   const context = readGraphContext();
   const { version, previousVersion } = context.input;
+  if (!isReleaseVersion(version)) throw new Error(`invalid release version: ${version}`);
   const commit = nodeOutput(context, 'version-release', 'commit');
   for (const node of ['gate', 'pwa']) if (context.outputs[node]?.outcome !== 'ok') throw new Error(`${node} did not pass`);
-  const out = join(effectiveInstanceRoot(), 'release', version, 'prepared');
-  if (existsSync(out)) throw new Error(`prepare output already exists: ${out}`);
+  const root = effectiveInstanceRoot();
+  const out = join(root, 'release', version, 'prepared');
+  if ([join(root, 'release'), join(root, 'release', version)]
+    .some((path) => lstatSync(path, { throwIfNoEntry: false })?.isSymbolicLink()))
+    throw new Error(`prepare output escapes release root: ${out}`);
+  let staleSource: string | undefined;
+  let staleManifestBytes: Buffer | undefined;
+  let staleParents: Array<{ path: string; dev: number; ino: number; real: string }> | undefined;
+  const occupied = lstatSync(out, { throwIfNoEntry: false });
+  if (occupied) {
+    // Only a tip refresh can prove that this archive belongs to the prior commit. An incomplete or unknown
+    // archive is left untouched for investigation; never erase it merely because the path is occupied.
+    const old = context.outputs['version-release']?.refreshedFrom;
+    const manifestPath = join(out, 'release.json');
+    if (typeof old !== 'string' || !/^[0-9a-f]{40}$/i.test(old) || old === commit
+      || !occupied.isDirectory() || !existsSync(manifestPath) || !lstatSync(manifestPath).isFile())
+      throw new Error(`prepare output already exists with unverified source: ${out}`);
+    if (realpathSync(out) !== join(realpathSync(root), 'release', version, 'prepared'))
+      throw new Error(`prepare output escapes release root: ${out}`);
+    let manifest: { version?: unknown; sourceCommit?: unknown };
+    try { staleManifestBytes = readRegularManifest(manifestPath); manifest = JSON.parse(staleManifestBytes.toString('utf8')) as typeof manifest; }
+    catch { throw new Error(`prepare output already exists with unreadable manifest: ${out}`); }
+    if (manifest.version !== version || manifest.sourceCommit !== old)
+      throw new Error(`prepare output already exists for another source: ${out}`);
+    staleParents = [join(root, 'release'), join(root, 'release', version)].map((path) => {
+      const stat = lstatSync(path);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error(`prepare output escapes release root: ${out}`);
+      return { path, dev: stat.dev, ino: stat.ino, real: realpathSync(path) };
+    });
+    staleSource = old;
+  }
   const ref = `v${previousVersion}^{commit}`;
   const prev = run('git', ['rev-parse', '--verify', ref]);
   if (prev.status !== 0 || !/^[0-9a-f]{40}\s*$/i.test(prev.stdout)) throw new Error(`previous release ref unavailable: ${ref}`);
+  if (staleSource) {
+    const current = lstatSync(out, { throwIfNoEntry: false });
+    const manifestPath = join(out, 'release.json');
+    if (!current?.isDirectory() || current.dev !== occupied?.dev || current.ino !== occupied?.ino
+      || !lstatSync(manifestPath, { throwIfNoEntry: false })?.isFile()
+      || [join(root, 'release'), join(root, 'release', version)]
+        .some((path) => lstatSync(path, { throwIfNoEntry: false })?.isSymbolicLink()))
+      throw new Error(`prepared output changed before cleanup: ${out}`);
+    if (realpathSync(out) !== join(realpathSync(root), 'release', version, 'prepared'))
+      throw new Error(`prepare output escapes release root: ${out}`);
+    let manifestBytes: Buffer;
+    try { manifestBytes = readRegularManifest(manifestPath); }
+    catch { throw new Error(`prepared manifest changed before cleanup: ${out}`); }
+    if (!staleManifestBytes?.equals(manifestBytes))
+      throw new Error(`prepared manifest changed before cleanup: ${out}`);
+    // Rename is atomic on this filesystem. Preserve the moved inode even if it differs from the checked one;
+    // no later operation deletes a quarantine directory or follows a link inside the archive.
+    const quarantine = mkdtempSync(join(realpathSync(root), '.prepared-cleanup-'));
+    const moved = join(quarantine, 'prepared');
+    move(out, moved);
+    const movedStat = lstatSync(moved);
+    let movedManifestBytes: Buffer | undefined;
+    try { movedManifestBytes = readRegularManifest(join(moved, 'release.json')); }
+    catch { /* preserve the quarantined archive for inspection */ }
+    if (!movedStat.isDirectory() || movedStat.dev !== occupied?.dev || movedStat.ino !== occupied?.ino
+      || !staleManifestBytes || !movedManifestBytes?.equals(staleManifestBytes))
+      throw new Error(`prepared output changed during cleanup; preserved at ${moved}`);
+    const receipt = join(quarantine, 'receipt.json');
+    const record = { version, old: staleSource, commit, from: out, to: moved, movedAt: new Date().toISOString(),
+      bytes: null as number | null, sizeStatus: 'pending' as 'pending' | 'measured' | 'unmeasured', sizeError: undefined as string | undefined };
+    try { writeFileSync(receipt, JSON.stringify(record, null, 2) + '\n', { flag: 'wx', mode: 0o600 }); }
+    catch (error) { throw new Error(`prepared archive preserved at ${moved}; receipt write failed: ${String(error)}`); }
+    try { record.bytes = archiveBytes(moved); record.sizeStatus = 'measured'; }
+    catch (error) { record.sizeStatus = 'unmeasured'; record.sizeError = String(error).slice(0, 200); }
+    const receiptNext = join(quarantine, 'receipt.next.json');
+    try {
+      writeFileSync(receiptNext, JSON.stringify(record, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+      renameSync(receiptNext, receipt);
+    } catch (error) { throw new Error(`prepared archive preserved at ${moved}; receipt update failed: ${String(error)}`); }
+    debug.log('release-loop.prepare', 'stale-prepared-quarantined', { version, old: staleSource, commit,
+      from: out, to: moved, bytes: record.bytes, sizeStatus: record.sizeStatus, receipt });
+    const parentsStable = staleParents?.every(({ path, dev, ino, real }) => {
+      try {
+        const stat = lstatSync(path);
+        return stat.isDirectory() && !stat.isSymbolicLink() && stat.dev === dev && stat.ino === ino
+          && realpathSync(path) === real;
+      } catch { return false; }
+    });
+    if (!parentsStable || lstatSync(out, { throwIfNoEntry: false }))
+      throw new Error(`prepare parent changed after quarantine; preserved at ${moved}`);
+  }
   const command = run('bun', ['bin/elanous.mjs', 'release', 'prepare', '--version', version, '--source', commit, '--notes-from', prev.stdout.trim(), '--out', out, '--json']);
   if (command.stderr) process.stderr.write(command.stderr);
   const manifest = lastResult(command)?.manifest as { version?: string; sourceCommit?: string; distDir?: string } | undefined;

package/src/acp/core-turn-bridge.ts

@@ -67,8 +67,9 @@ const QUICK_TOOLS: Record<QuickTuiRoute, readonly string[]> = {
   '조회': ['decisions_pending', 'ops_seats', 'ops_status', 'release_status', 'logs_query', 'context_now', 'memory_recall', 'Read'],
   '설정 변경': ['DashboardConfigGet', 'DashboardConfigSet', 'LlmListAvailableModels', 'prompt_getRuntimeConfig', 'prompt_setRuntimeConfig', 'view_getConfig', 'view_applyRuntimeConfig', 'view_saveConfig', 'memory_recall'],
   // MsgList is a read-only ledger listing (never acks); MsgPost · MsgAck · RunShell · Bash stay out (TUI-QUICK-ROUTE-EXPLICIT-CMD).
-  '조사': ['WebSearch', 'OmniSearch', 'Grep', 'Glob', 'Read', 'fact_check', 'memory_recall', 'MsgList'],
-  '상시 일': ['schedule_manage', 'schedule_list', 'schedule_create', 'schedule_update', 'session_manage', 'ops_status', 'memory_recall'],
+  '조사': ['WebSearch', 'OmniSearch', 'Grep', 'Glob', 'Read', 'fact_check', 'memory_recall', 'MsgList', 'Agent'],
+  // ScheduleWakeup (H5) wakes this TUI in-process; schedule_manage is OS cron — both belong to «상시 일».
+  '상시 일': ['schedule_manage', 'schedule_list', 'schedule_create', 'schedule_update', 'ScheduleWakeup', 'session_manage', 'ops_status', 'memory_recall'],
 };
 
 export function toolsForTuiRoute(tools: readonly LLMToolSpec[], route: QuickTuiRoute): LLMToolSpec[] {
@@ -248,7 +249,7 @@ export function bridgeCoreTurnToAcp(
           })
         : { route: '코딩·구현' as const, reason: harness ? 'harness' : 'legacy', goalLoop: true };
       const tools = !route.goalLoop && route.route !== '코딩·구현' && route.route !== '읽기·분석'
-        ? toolsForTuiRoute(availableTools, route.route)
+        ? toolsForTuiRoute(availableTools, route.route) // bridgeCoreTurnToAcp applies route allowlists here.
         : availableTools;
       if (deps.tuiRouting) {
         debug.log('chat.route', 'decided', { route: route.route, reason: route.reason, goalLoop: route.goalLoop, seat, seatKnown });
@@ -317,6 +318,7 @@ export function bridgeCoreTurnToAcp(
       let finalSupplement: { answer: string; supplement: string; finalText: string } | null = null;
       // turnFamily 는 관측용으로만 유지(goal loop 아밍 판정은 위 사실 질문 판정 앞에서 한다).
       const turnModel = modelOverride ?? getUserConfig().llm.model;
+      let resolvedRoute: { provider: string; model: string } | null = null;
       const turnFamily = getModelFamily(turnModel);
       if (armGoalLoop) {
         // 관측 — 어느 family/모델에서 across-turn goal-loop 가 아밍됐나(전-family 개방 검증).
@@ -421,8 +423,18 @@ export function bridgeCoreTurnToAcp(
             void turnCtx.pushToolCall(call);
           },
           onToolResult: (call) => { void turnCtx.pushToolResult(call); },
+          // 실제로 응답한 공급자·모델을 기억한다 — 폴백 체인이 넘기면(예 codex → grok) 턴 모델(turnModel)과 달라진다.
+          //   streamLLMWithTools 가 스트림을 (다시) 열 때마다 부른다 → 사용량 직전 값 = 그 사용량을 낸 쪽.
+          onResolvedProvider: (provider, model) => { resolvedRoute = { provider, model }; },
           // 턴 모델(라우팅 결과)을 실어 보낸다 — 대시보드 턴 지표가 설정 모델로 ctx·단가를 잡지 않게.
-          onUsage: (usage) => { void turnCtx.pushUsage({ ...usage, model: usage.model ?? turnModel }); },
+          //   ⭐ 폴백이면 «넘어간» 모델·공급자를 싣는다(TUI-MODEL-BADGE-ACTUAL · 완료 배지가 읽는다 · 상태줄·/model 은 후속 TUI-MODEL-BADGE-SOURCE).
+          onUsage: (usage) => {
+            void turnCtx.pushUsage({
+              ...usage,
+              model: usage.model ?? resolvedRoute?.model ?? turnModel,
+              ...(resolvedRoute ? { routeProvider: resolvedRoute.provider } : {}),
+            });
+          },
           // Codex Responses API reasoning summary stream. Currently
           // surfaced via forensic only (debug.log) — acts as the
           // "did the model actually emit reasoning?" verification

package/src/acp/elanous-extensions.ts

@@ -81,6 +81,9 @@ export interface ElanousUiUsagePayload {
   provider?: 'anthropic' | 'openai';
   /** 그 턴이 실제로 요청한 모델(라우팅 결과 — 설정 모델과 다를 수 있다). */
   model?: string;
+  /** 이 사용량을 낸 «실제» 공급자(폴백 체인이 넘겼으면 넘어간 쪽 · 예 `grok`). `provider` 는 과금 계열 축이라 따로 둔다
+   *  (TUI-MODEL-BADGE-ACTUAL · 10-16). */
+  routeProvider?: string;
   inputTokens?: number;
   outputTokens?: number;
   cacheReadInputTokens?: number;

package/src/acp/server.ts

@@ -838,6 +838,8 @@ export interface AcpTurnContext {
   pushUsage: (usage: {
     provider?: 'anthropic' | 'openai';
     model?: string;
+    /** 실제로 응답한 공급자(폴백이면 넘어간 쪽). */
+    routeProvider?: string;
     inputTokens?: number;
     outputTokens?: number;
     cacheReadInputTokens?: number;
@@ -1839,6 +1841,7 @@ function wireAcpConnection(
           id: `turn:${Date.now()}`,
           ...(usage.provider !== undefined ? { provider: usage.provider } : {}),
           ...(usage.model !== undefined ? { model: usage.model } : {}),
+          ...(usage.routeProvider !== undefined ? { routeProvider: usage.routeProvider } : {}),
           ...(usage.inputTokens !== undefined ? { inputTokens: usage.inputTokens } : {}),
           ...(usage.outputTokens !== undefined ? { outputTokens: usage.outputTokens } : {}),
           ...(usage.cacheReadInputTokens !== undefined

package/src/acp/tool-trace.ts

@@ -1,4 +1,4 @@
-import { appendMessage } from '../session/index.js';
+import { appendMessage, onSessionCreated } from '../session/index.js';
 // ⛔ 메시지 «모양»은 `session/chat.ts` 가 갖는다 — 여기서 베끼지 않는다.
 //   같은 계약을 두 벌로 두면 한쪽만 자라고, 그때 「어느 표면의 기록인가」가 갈린다.
 import { buildToolTraceMessage } from '../session/chat.js';
@@ -24,9 +24,13 @@ import { debug } from '../debug/log.js';
  *  Goodhart 시험이었다. ⇒ 주입 가능한 함수로 떼어 **실행으로** 문다. */
 /** ⛔ 이 저장소 «밖»으로 열지 않는다 — 소비처가 이 파일과 그 시험뿐이다(리뷰 must-fix:
  *  쓰이지 않는 공개 표면). 시험은 리터럴로 넘기므로 이름을 export 할 필요가 없다. */
+type TraceMessage = ReturnType<typeof buildToolTraceMessage>;
+type AppendFn = (sessionId: string, msg: TraceMessage) => unknown;
+type FailureObserver = (info: { sessionId: string; tool: string; id: string; reason: string }) => void;
+
 interface AcpToolTraceDeps {
   /** 시험 주입점. 기본은 실제 세션 저장소. */
-  readonly append?: (sessionId: string, msg: ReturnType<typeof buildToolTraceMessage>) => unknown;
+  readonly append?: AppendFn;
   /** ⛔⭐ 메시지 «모양»을 만드는 자리 — 기본은 `session/chat.ts` 의 공유 빌더.
    *
    *  📏 무인 리뷰 must-fix(PR #11120): 산출 필드(`role`/`toolName`/…)만 검사하면
@@ -35,7 +39,166 @@ interface AcpToolTraceDeps {
    *  ⇒ 주입점으로 열어 **「공유 빌더를 쓴다」를 시험이 «실행으로» 확인**할 수 있게 한다. */
   readonly buildMessage?: typeof buildToolTraceMessage;
   /** 실패를 «이름으로» 남기는 자리. 기본은 관측 로그. */
-  readonly observeFailure?: (info: { sessionId: string; tool: string; id: string; reason: string }) => void;
+  readonly observeFailure?: FailureObserver;
+  /** 지연·회수·상한을 남기는 자리(`trace-persist-deferred|flushed|dropped`). 기본은 관측 로그. */
+  readonly observe?: (event: TraceDeferEvent, data: Record<string, unknown>) => void;
+  /** 「세션이 원장에 생겼다」를 듣는 자리. 기본은 `session/index.ts` 의 `onSessionCreated`. */
+  readonly subscribeSessionCreated?: (listener: (meta: { readonly id: string }) => void) => () => void;
+}
+
+type TraceDeferEvent = 'trace-persist-deferred' | 'trace-persist-flushed' | 'trace-persist-dropped';
+
+/** ⛔⭐⭐ **「세션이 아직 원장에 없다」는 실패가 아니라 «순서»다 — 지연 기록한다.**
+ *
+ *  📏 2026-10-16 실측(TUI 결함 #30·#64 · `eln logs --category acp.tool` 12h):
+ *    `trace-persist-failed «session not found: elanous-session-ndusg6»` 7건이 **13:12:03~15Z 한 턴**에 몰렸고,
+ *    그 세션 파일의 첫 줄은 **13:12:48Z**(턴 «끝»)였다.
+ *  🔑 원인(호출부): ACP 서버는 세션 id 를 «메모리에만» 민팅하고(`acpServerRegisterSession` · `server.ts`),
+ *    원장 채택은 **턴이 «끝난 뒤»** 에 일어난다 — `persistCompletedTuiAcpTurn`(서버 · origin 메타가 있을 때) 또는
+ *    대시보드의 `adoptChatSession`(SESSION-RESUME-ISOLATED · 턴 완료 뒤). 그런데 툴 흔적은 «턴 도중»
+ *    `pushToolResult` → 이 함수에서 쓴다. ⇒ ***새 세션의 «첫 턴» 도구 흔적은 전부 잃었다***
+ *    (`/session new`·ACP 갱신마다 새 id 라 첫 턴이 반복된다).
+ *  ⇒ 그 오류면 메시지를 세션별로 붙잡아 두고, 세션이 원장에 생기는 순간(`onSessionCreated`) 또는
+ *    같은 세션의 다음 호출 때 «원래 시각(ts) 그대로» 붙인다. 경고는 세션당 «한 번»(지연) ⊕ 회수 때 «수»로.
+ *  ⛔ 출처(`source`)를 짐작해 여기서 세션을 «만들지» 않는다 — 같은 ACP 경로를 PWA 도 타므로
+ *    TUI 로 낙인찍으면 남의 세션 속성을 틀리게 박는다. 만드는 일은 원래 주인(턴 완료 채택)에게 둔다. */
+/*  ⚠️ 상한은 «메모리 바닥»만 지킨다 — 영영 채택되지 않는 세션(턴 도중 종료)이 쌓이지 않게.
+ *    세션당 100 을 넘으면 그 뒤 흔적은 버리고, 세션 32 를 넘으면 가장 오래 기다린 세션을 통째로 버린다.
+ *    어느 쪽이든 `trace-persist-dropped` 를 «한 줄» 남길 뿐 버린 «수»를 세거나 간격을 두지 않는다
+ *    (버림 계수·보고 방식은 연결 골 `ASK-ACP-TRACE-EVICTION-ACCOUNTING` 이 정한다).
+ *    축출된 id 가 다시 오면 「한 번」 경고부터 다시 시작한다 — id 는 base36 무작위 6자라 드물다. */
+const MAX_PENDING_PER_SESSION = 100;
+const MAX_PENDING_SESSIONS = 32;
+const SESSION_NOT_FOUND = /^session not found: /;
+
+interface PendingSession {
+  readonly entries: Array<{
+    readonly append: AppendFn;
+    readonly msg: TraceMessage;
+    readonly tool: string;
+    readonly id: string;
+    readonly observeFailure: FailureObserver | undefined;
+  }>;
+  /** 세션당 상한에 한 번 닿았나 — `trace-persist-dropped` 를 세션당 한 줄만 남기려고. */
+  capped: boolean;
+  readonly observe: (event: TraceDeferEvent, data: Record<string, unknown>) => void;
+}
+
+const pendingBySession = new Map<string, PendingSession>();
+let unsubscribeCreated: (() => void) | null = null;
+
+const defaultObserve = (event: TraceDeferEvent, data: Record<string, unknown>): void => {
+  debug.log('acp.tool', event, data);
+};
+
+const safeObserve = (fn: () => void): void => {
+  // ⛔ 관측 자체가 던져도 턴을 깨지 않는다 — 그러면 fail-soft 가 무의미해진다.
+  try { fn(); } catch { /* 관측은 마지막 방어선이다 */ }
+};
+
+const errorReason = (err: unknown): string =>
+  err instanceof Error ? err.message.slice(0, 200) : String(err).slice(0, 200);
+
+function observeFailureOf(
+  sessionId: string,
+  call: { readonly tool: string; readonly id: string },
+  reason: string,
+  observeFailure: FailureObserver | undefined,
+): void {
+  const observe = observeFailure
+    ?? ((info) => { debug.log('acp.tool', 'trace-persist-failed', info); });
+  safeObserve(() => observe({ sessionId, tool: call.tool, id: call.id, reason }));
+}
+
+/** 붙잡아 둔 흔적을 원래 순서대로 붙인다. 세션이 여전히 없으면 그대로 둔다(`'missing'`). */
+function flushPending(sessionId: string): 'missing' | 'flushed' | 'none' {
+  const p = pendingBySession.get(sessionId);
+  if (!p) return 'none';
+  let flushed = 0;
+  let failed = 0;
+  while (p.entries.length > 0) {
+    const entry = p.entries[0]!;
+    try {
+      entry.append(sessionId, entry.msg);
+      flushed += 1;
+    } catch (err) {
+      const reason = errorReason(err);
+      // ⛔ 회수 «도중» 세션이 사라져도(이미 몇 행을 붙인 뒤라도) 그 행과 나머지는 «지연» 그대로 둔다 — 실패가 아니다.
+      if (SESSION_NOT_FOUND.test(reason)) {
+        // ⭐ 그때까지 붙인 행 수는 «지금» 남긴다 — 다음 회수 보고는 그 뒤의 행만 센다.
+        if (flushed > 0 || failed > 0) {
+          safeObserve(() => p.observe('trace-persist-flushed', { sessionId, flushed, failed, partial: true }));
+        }
+        return 'missing';
+      }
+      failed += 1;
+      // ⛔ 회수 중 실패도 «같은» `trace-persist-failed` 로 — `flushed.failed` 합계에만 묻으면 실패가 안 보인다.
+      observeFailureOf(sessionId, { tool: entry.tool, id: entry.id }, reason, entry.observeFailure);
+    }
+    p.entries.shift();
+  }
+  pendingBySession.delete(sessionId);
+  safeObserve(() => p.observe('trace-persist-flushed', { sessionId, flushed, failed }));
+  if (pendingBySession.size === 0 && unsubscribeCreated) {
+    const off = unsubscribeCreated;
+    unsubscribeCreated = null;
+    try { off(); } catch { /* 구독 해제 실패는 무해 — 다음 지연이 다시 건다 */ }
+  }
+  return 'flushed';
+}
+
+function deferTrace(
+  sessionId: string,
+  call: { readonly id: string; readonly name: string },
+  append: AppendFn,
+  msg: TraceMessage,
+  reason: string,
+  deps: AcpToolTraceDeps,
+): void {
+  let p = pendingBySession.get(sessionId);
+  if (!p) {
+    if (pendingBySession.size >= MAX_PENDING_SESSIONS) {
+      // 가장 오래 기다린 세션부터 버린다 — 원장에 영영 안 생긴 세션(턴 도중 종료)이 쌓이지 않게.
+      const [oldestId, oldest] = pendingBySession.entries().next().value as [string, PendingSession];
+      pendingBySession.delete(oldestId);
+      safeObserve(() => oldest.observe('trace-persist-dropped', { sessionId: oldestId, reason: 'pending-session-cap' }));
+    }
+    p = { entries: [], capped: false, observe: deps.observe ?? defaultObserve };
+    pendingBySession.set(sessionId, p);
+    // ⭐ 경고는 세션당 «한 번» — 호출마다 같은 줄을 찍던 것이 결함 #64 의 다른 반쪽이다.
+    safeObserve(() => p!.observe('trace-persist-deferred', { sessionId, tool: call.name, id: call.id, reason }));
+  }
+  if (p.entries.length < MAX_PENDING_PER_SESSION) {
+    p.entries.push({ append, msg, tool: call.name, id: call.id, observeFailure: deps.observeFailure });
+  } else if (!p.capped) {
+    p.capped = true;
+    safeObserve(() => p!.observe('trace-persist-dropped', {
+      sessionId, tool: call.name, id: call.id, reason: 'pending-per-session-cap',
+    }));
+  }
+  if (!unsubscribeCreated) {
+    const subscribe = deps.subscribeSessionCreated ?? onSessionCreated;
+    try {
+      unsubscribeCreated = subscribe((meta) => {
+        if (!pendingBySession.has(meta.id)) return;
+        // ⭐ 채택 «직후» 같은 동기 구간에서 user/assistant 가 이어 붙는다(`persistCompletedTuiAcpTurn`).
+        //   마이크로태스크로 미뤄 그 뒤에 붙인다 — 그래야 「마지막 user 뒤의 tool 행」(다음 턴 관찰)이 산다.
+        queueMicrotask(() => { try { flushPending(meta.id); } catch { /* fail-soft */ } });
+      });
+    } catch { unsubscribeCreated = null; }
+  }
+}
+
+/** 시험 전용 — 모듈 상태(지연 큐·구독)를 비운다. */
+export function _resetAcpToolTraceStateForTest(): void {
+  pendingBySession.clear();
+  if (unsubscribeCreated) { try { unsubscribeCreated(); } catch { /* 무해 */ } }
+  unsubscribeCreated = null;
+}
+
+/** 시험·관측용 — 세션별로 붙잡아 둔 흔적 수. */
+export function pendingAcpToolTraceCount(sessionId: string): number {
+  return pendingBySession.get(sessionId)?.entries.length ?? 0;
 }
 
 /** 한 번의 툴 호출을 감사 기록으로 남긴다.
@@ -44,8 +207,9 @@ interface AcpToolTraceDeps {
  *    (`session/chat.ts` 가 세운 규율).
  *  ⚠️ **그러나 «조용히 삼키지 않는다»** — 실패하면 이름을 대고 관측에 남긴다.
  *    ***조용한 실패야말로 16차가 내내 잡던 형태고, 이 PR 초판이 또 만들었다.***
+ *  ⭐ 「세션이 아직 원장에 없다」면 지연 기록한다(위 `MAX_PENDING_*` 주석) — 이때도 `false` 다.
  *
- *  @returns 저장을 시도해 «성공»했으면 `true`. ⛔ 「안 했다」와 「했는데 실패했다」는 다른 값이다. */
+ *  @returns 지금 저장에 «성공»했으면 `true`. ⛔ 「안 했다」와 「했는데 실패했다」·「미뤘다」는 다른 값이다. */
 export function persistAcpToolTrace(
   sessionId: string,
   call: { readonly id: string; readonly name: string; readonly result?: unknown },
@@ -56,14 +220,25 @@ export function persistAcpToolTrace(
   // ⛔ 모양은 «공유 빌더»가 만든다 — 여기서 손으로 조립하지 않는다(계약을 두 벌로 두지 않는다).
   const build = deps.buildMessage ?? buildToolTraceMessage;
   try {
-    append(sessionId, build(call.name, args, call.result));
-    return true;
+    const msg = build(call.name, args, call.result);
+    // 앞서 미뤄 둔 흔적이 있으면 먼저 붙인다(순서 보존). 여전히 세션이 없으면 이것도 뒤에 줄 세운다.
+    if (pendingBySession.has(sessionId) && flushPending(sessionId) === 'missing') {
+      deferTrace(sessionId, call, append, msg, 'session not found (pending)', deps);
+      return false;
+    }
+    try {
+      append(sessionId, msg);
+      return true;
+    } catch (err) {
+      const reason = errorReason(err);
+      if (SESSION_NOT_FOUND.test(reason)) {
+        deferTrace(sessionId, call, append, msg, reason, deps);
+        return false;
+      }
+      throw err;
+    }
   } catch (err) {
-    const reason = err instanceof Error ? err.message.slice(0, 200) : String(err).slice(0, 200);
-    const observe = deps.observeFailure
-      ?? ((info) => { debug.log('acp.tool', 'trace-persist-failed', info); });
-    // ⛔ 관측 자체가 던져도 턴을 깨지 않는다 — 그러면 fail-soft 가 무의미해진다.
-    try { observe({ sessionId, tool: call.name, id: call.id, reason }); } catch { /* 관측은 마지막 방어선이다 */ }
+    observeFailureOf(sessionId, { tool: call.name, id: call.id }, errorReason(err), deps.observeFailure);
     return false;
   }
 }