elanous 0.2.32 → 0.2.34

package/src/cli/seat-cli.ts

@@ -3,6 +3,7 @@ import { existsSync, lstatSync, readFileSync, realpathSync, statSync } from 'nod
 import { homedir } from 'node:os';
 import { dirname, join, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { LAST_SESSION_FILE } from '../dashboard/seat-local-instructions.js';
 import { redactSecretText } from '../debug/log.js';
 import { defaultMsgStorePath, readUnreadCount } from '../msg/msg-store.js';
 import { parseKnowhowItems, splitKnowhow } from '../seat-loop/seat-knowhow.js';
@@ -96,6 +97,40 @@ export function renderSeatBootCard(seat: string, sections: ReadonlyArray<SeatBoo
   return out.join('\n');
 }
 
+/** 자리의 현재 역할 선언 한 줄만 부트 카드에 싣는다. 긴 지시문 본문은 카드로 복사하지 않는다. */
+function seatRoleSection(home: string, seat: string): { source: string; updated: string; rows: readonly string[]; reason?: string } {
+  const root = join(home, 'elanous-hq');
+  const path = join(root, 'seats', seat, 'AGENTS.local.md');
+  if (!existsSync(path)) return { source: path, updated: '미상', rows: [], reason: '미관측: 파일 없음' };
+  try {
+    if (!isRegularSeatPath(home, root, path)) return { source: path, updated: '미상', rows: [], reason: '미관측: 일반 경로가 아님' };
+    const role = readFileSync(path, 'utf8').slice(0, 4096).split(/\r?\n/)
+      .map(line => line.match(/^\s*#?\s*역할\s*=\s*(.+)$/)?.[1])
+      .find(Boolean);
+    return { source: path, updated: statSync(path).mtime.toISOString(), rows: role ? [`역할: ${clean(role)}`] : [],
+      ...(role ? {} : { reason: '미관측: 역할 선언 없음' }) };
+  } catch {
+    return { source: path, updated: '미상', rows: [], reason: '미관측: 읽기 실패' };
+  }
+}
+
+/** «지난 세션» 절 — TUI 가 대화 끝마다 자리 작업 디렉터리 루트에 갈아 쓰는 `LAST_SESSION_FILE`(`dashboard/seat-local-instructions.ts`)이 곧 지난 세션의 정본이다.
+ *  카드도 같은 정본을 읽는다 — 머리 보일러플레이트(`## …`)는 빼고 요약 줄만 실는다. */
+function lastSessionSection(home: string, seat: string): { source: string; updated: string; rows: readonly string[]; reason?: string } {
+  const path = join(home, 'elanous-hq', 'seats', seat, LAST_SESSION_FILE);
+  if (!existsSync(path)) return { source: path, updated: '미상', rows: [], reason: '미관측: 파일 없음' };
+  try {
+    if (!isRegularSeatPath(home, join(home, 'elanous-hq'), path)) return { source: path, updated: '미상', rows: [], reason: '미관측: 일반 경로가 아님' };
+    const rows = readFileSync(path, 'utf8').slice(0, 256_000).split(/\r?\n/)
+      .filter(line => line.trim() && !/^#{1,6}\s/.test(line))
+      .slice(0, MAX_ROWS)
+      .map(line => clean(line.replace(/^[-*]\s*/, '')));
+    return { source: path, updated: statSync(path).mtime.toISOString(), rows, ...(rows.length ? {} : { reason: '미관측: 요약 줄 없음' }) };
+  } catch {
+    return { source: path, updated: '미상', rows: [], reason: '미관측: 읽기 실패' };
+  }
+}
+
 /** 자리 카드의 파일·우편 절(동기) — `eln seat boot` 와 TUI 세션 부트(`dashboard/seat-boot-preamble.ts`)가 같이 쓴다. */
 export function collectSeatBootSections(seat: string, options: { home: string; msgPath: string }): { sections: SeatBootSection[]; unread: number | null } {
   const root = join(options.home, 'elanous-hq', 'seat-state');
@@ -104,11 +139,13 @@ export function collectSeatBootSections(seat: string, options: { home: string; m
   try { unread = readUnreadCount(seat, options.msgPath); }
   catch { /* unavailable is not a measured zero */ }
   const sections: SeatBootSection[] = [
+    { title: '자리 역할', ...seatRoleSection(options.home, seat) },
     { title: 'msg 원장', source: options.msgPath, updated: unread === null ? '미상' : new Date().toISOString(), rows: [`안 읽은 msg ${unread ?? '미관측'} (${seat})`] },
     { title: 'HANDOFF', ...metadata(options.home, root, join(seatDir, 'HANDOFF.md'), 'markdown') },
     { title: 'inbox', ...metadata(options.home, root, join(seatDir, 'inbox.md'), 'markdown') },
     { title: '수확 주장', ...metadata(options.home, root, join(seatDir, 'harvest-claims.tsv'), 'tsv') },
     { title: '예약', ...metadata(options.home, root, join(seatDir, 'scheduled.tsv'), 'tsv') },
+    { title: '지난 세션', ...lastSessionSection(options.home, seat) },
     { title: '공통 메모리 색인', ...metadata(options.home, root, join(root, 'memory', 'MEMORY.md'), 'memory') },
   ];
   return { sections, unread };

package/src/cli/setup-cli.ts

@@ -182,10 +182,47 @@ function reportCliSkills(deps: SetupCliDeps, apply: boolean): string[] {
   return lines;
 }
 
+/** 최초 셋업 묶음 제안(읽기 전용). 등급·승인 어휘는 문서 원전을 그대로 쓴다 —
+ *  묶음·층 구성 = 내부 문서 `RESEARCH-plugins-connectors-baseline-2026-09-30` §4(0층 «키 없이 항상 켬»),
+ *  항목별 보안 등급·승인 = 같은 문서 §5. §5 표에 등급이 없는 0층 항목(Edge/macOS TTS·스킬)은
+ *  등급을 지어내지 않기 위해 목록에서 뺀다. 실제 설치·자격 부여는 승인 뒤 후속 조각(plan-then-apply). */
+interface SetupBundleItem {
+  name: string;
+  grade: string;
+  approval: string;
+}
+
+const DEFAULT_SETUP_BUNDLE: readonly SetupBundleItem[] = [
+  { name: '셸·파일(작업 트리 안)', grade: '쓰기(로컬)', approval: '기존 모래상자·워크트리 규칙' },
+  { name: 'WebFetch', grade: '읽기', approval: '불요' },
+  { name: 'WebSearch(무료 DuckDuckGo·Jina)', grade: '읽기', approval: '불요' },
+  { name: 'GitHub 공개 읽기(무인증)', grade: '읽기', approval: '불요' },
+  { name: 'PDF/HWP 읽기', grade: '읽기', approval: '불요' },
+  { name: '비전', grade: '읽기', approval: '불요' },
+  { name: 'Obsidian 검색', grade: '읽기', approval: '불요' },
+  { name: 'Obsidian 쓰기', grade: '쓰기(로컬)', approval: 'vault-write-guard' },
+  { name: '기억·일정', grade: '쓰기(로컬)', approval: '기존 모래상자·워크트리 규칙' },
+  { name: 'CDP 브라우저 탐색·읽기', grade: '읽기(네트워크)', approval: '불요(클릭·입력은 쓰기 → 승인)' },
+];
+
+function formatDefaultBundleProposal(): string[] {
+  return [
+    'Setup: 기본 플러그인·커넥터 묶음 제안 (읽기 전용)',
+    `묶음 1/1: 기본 묶음 — 키 없이 항상 켬(0층) · 항목 ${DEFAULT_SETUP_BUNDLE.length}개`,
+    ...DEFAULT_SETUP_BUNDLE.map((item) => `- ${item.name} — 보안 등급: ${item.grade} · 승인: ${item.approval}`),
+    '후속 층(승인 뒤 조각): 1층 로그인된 CLI 재사용 · 2층 원격 MCP 한 번 OAuth · 3층 채널',
+    '제안은 표시만 합니다 — 승인 전 설치 0 · 자격 쓰기 0 · 승인 뒤 설치는 `elanous plugin add <spec>` 경로로(후속 조각)',
+  ];
+}
+
 export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}): void {
   const out = deps.out ?? { log: (value: string) => console.log(value), error: (value: string) => console.error(value) };
   const setExitCode = deps.setExitCode ?? ((code: number) => { process.exitCode = code; });
   const doctorRunner = deps.runDoctor ?? runDoctor;
+  const isFirstRunSetup = (): boolean => deps.firstRunTopics ?? (!deps.getUserConfig && !existsSync(userConfigPath()));
+  const showDefaultBundleProposal = (): void => {
+    for (const line of formatDefaultBundleProposal()) out.log(line);
+  };
   const showCliSkills = (apply: boolean) => {
     out.log('Setup: CLI skills (public GitHub repository reads remain available without login)');
     for (const line of reportCliSkills(deps, apply)) out.log(line);
@@ -206,6 +243,7 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
       if (opts.nonInteractive) {
         out.log(formatSetupReport(doctor, setupSteps(deps), true));
         showCliSkills(false);
+        if (isFirstRunSetup()) showDefaultBundleProposal();
         for (const line of recommendedSetup((deps.getUserConfig ?? getUserConfig)())) out.log(line);
         setExitCode(0);
         return;
@@ -215,7 +253,7 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
         setExitCode(1);
         return;
       }
-      const isFirstRun = deps.firstRunTopics ?? (!deps.getUserConfig && !existsSync(userConfigPath()));
+      const isFirstRun = isFirstRunSetup();
       let steps = setupSteps(deps);
       const provider = steps[1]!;
       if (!provider.complete) {
@@ -230,6 +268,7 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
       }
       out.log(formatSetupReport(doctor, steps, false));
       showCliSkills(false);
+      if (isFirstRun) showDefaultBundleProposal();
       for (const line of recommendedSetup((deps.getUserConfig ?? getUserConfig)())) out.log(line);
       let configured = (deps.getUserConfig ?? getUserConfig)();
       if (!configured.starter?.topics && configured.watch?.enabled !== false

package/src/cli/tasks-cli.ts

@@ -162,10 +162,17 @@ export interface DefaultTaskLauncherDeps {
   launchHoldActive?: () => boolean;
   /** HQ 판(시험 주입). */
   localVersion?: string;
+  /** HQ-owned, refresh-less Codex access mirror to install before a remote parent launch. */
+  codexAccessMirror?: () => Promise<{ elanousAuth: string; codexAuth: string; account?: string; usedPercent?: number; thresholdPercent?: number } | null>;
+  /** Isolated integration seam; production still reads the HQ rotation snapshot and config directly. */
+  ownerCodexRotation?: () => ReturnType<typeof import('../oauth/codex-account-store.js').inspectCodexRotation>;
+  ownerCodexRotationConfig?: { accountOrder?: readonly string[]; thresholdPercentByAccount?: Readonly<Record<string, unknown>> };
   /** 원격 → 로컬 되돌림 알림(시험 주입). 기본 = stderr 한 줄. */
   notice?: (line: string) => void;
 }
 
+class NoEligibleOwnerCodexAccountError extends Error {}
+
 /**
  * HARNESS-PARENT-ON-MSB1 — 켜져 있고 발사 전 점검이 통과하면 원격(ssh)에서 부모를 띄운다(PR 까지만 · 병합은 HQ).
  * 막히면 null — 호출부가 종전 로컬 발사로 간다(관측: task-agent parent-host-fallback).
@@ -185,6 +192,52 @@ async function tryRemoteParent(args: string[], cwd: string | undefined, context:
     try { debug.log('task-agent', 'parent-host-fallback', { host: target.host, runId: context.runId, gaps, facts }); } catch { /* fail-soft */ }
     notice(`[parent-host] ${target.host} 로 못 띄움 — ${multi ? '다음 호스트 또는 로컬 발사로 간다' : '로컬 발사로 간다'}: ${gaps.join(' · ')}`);
   };
+  let accessMirror: { elanousAuth: string; codexAuth: string; account?: string; usedPercent?: number; thresholdPercent?: number } | null | undefined;
+  const getAccessMirror = async (): Promise<{ elanousAuth: string; codexAuth: string; account?: string; usedPercent?: number; thresholdPercent?: number } | null> => {
+    if (accessMirror !== undefined) return accessMirror;
+    if (deps.codexAccessMirror) {
+      accessMirror = await deps.codexAccessMirror();
+      return accessMirror;
+    }
+    const [pod, authStore, codex, hq] = await Promise.all([
+      import('../task-orchestrator/surfaces/self-implement-pod.js'),
+      import('../oauth/store.js'),
+      import('../oauth/codex.js'),
+      import('../hq/hq.js'),
+    ]);
+    const { inspectCodexRotation } = await import('../oauth/codex-account-store.js');
+    const { planOwnerCodexMirrorCandidates, podAccountThresholdPercent } = await import('../task-orchestrator/surfaces/pod-account-broker.js');
+    const { getUserConfig } = await import('../user-config.js');
+    const rotation = deps.ownerCodexRotation?.() ?? inspectCodexRotation();
+    const config = getUserConfig();
+    const ownerConfig = deps.ownerCodexRotationConfig;
+    const candidates = [...rotation.candidates];
+    const eligible = planOwnerCodexMirrorCandidates(candidates, {
+      accountOrder: ownerConfig?.accountOrder ?? config.llm?.codexAccountOrder ?? [],
+      thresholdPercentByAccount: ownerConfig?.thresholdPercentByAccount ?? config.llm?.codexAccountRotationThresholdPercentByAccount,
+    });
+    if (candidates.length > 0 && eligible.length === 0) throw new NoEligibleOwnerCodexAccountError('HQ 소유 Codex 계정이 모두 사용 임계에 도달해 원격 부모 발사를 거부한다');
+    const prerefreshDeps = {
+      credentials: (account: string) => pod.hostCredentials(account, authStore.authStorePath(), () => '', { requireExplicitChatgptAuthMode: true }),
+      refresh: (account: string) => codex.refreshCodexAccountHome(account),
+      isLeaseHolder: () => hq.hqFenceDecision('ledger-cli').run,
+    };
+    for (const candidate of eligible) {
+      // The account's refresh token stays on HQ. Only the selected account's access-only mirror crosses SSH.
+      let credential: Awaited<ReturnType<typeof pod.podCodexCredentialWithPrerefresh>> = null;
+      try { credential = await pod.podCodexCredentialWithPrerefresh(candidate.name, prerefreshDeps); }
+      catch { continue; }
+      if (!credential) continue;
+      accessMirror = { elanousAuth: credential.elanousAuth, codexAuth: credential.codexAuth, account: candidate.name,
+        ...(candidate.usedPercent !== undefined ? { usedPercent: candidate.usedPercent } : {}),
+        thresholdPercent: podAccountThresholdPercent(candidate.name, {
+          thresholdPercentByAccount: ownerConfig?.thresholdPercentByAccount ?? config.llm?.codexAccountRotationThresholdPercentByAccount,
+        }) };
+      return accessMirror;
+    }
+    accessMirror = null;
+    return accessMirror;
+  };
   if (cwd) {
     failed(targets[0]!, ['project-target-is-local']);
     return null;
@@ -204,8 +257,37 @@ async function tryRemoteParent(args: string[], cwd: string | undefined, context:
       launchHoldActive = readLandingFreeze(prodInstanceRoot())?.holdLaunches === true;
     }
   } catch { launchHoldActive = true; /* 못 읽으면 막힌 것으로(fail-closed) */ }
-  const capacities = Object.fromEntries(multi ? targets.map((target) => [target.host, parentHostModule.readParentHostCapacity(target, deps.ssh)]) : []);
-  const ordered = multi ? parentHostModule.orderParentHosts(targets, context.runId, capacities) : targets;
+  const podGoal = context.substrate === 'pod' ? context.podGoal : undefined;
+  // 부모에서 잰 메모리 선택자만 원격 자식에도 넘긴다. 로컬의 나머지 환경·자격은 SSH 로 복사하지 않는다.
+  const remoteEnv = { ...context.env };
+  // These labels describe an HQ-selected Codex access mirror; never forward an inherited label by itself.
+  delete remoteEnv.ELANOUS_REMOTE_CODEX_ACCOUNT;
+  delete remoteEnv.ELANOUS_REMOTE_CODEX_USED_PERCENT;
+  delete remoteEnv.ELANOUS_REMOTE_CODEX_THRESHOLD_PERCENT;
+  if (podGoal) for (const key of ['ELANOUS_POD_MEMORY_TIER', 'ELANOUS_POD_MEMORY', 'ELANOUS_POD_MEMORY_HIGH', 'ELANOUS_POD_MEMORY_LITE', 'ELANOUS_POD_GOAL_TYPE'] as const) {
+    const value = context.env[key] ?? process.env[key];
+    if (value !== undefined) remoteEnv[key] = value;
+  }
+  const memoryLimit = podGoal ? (await import('../task-orchestrator/surfaces/self-implement-pod.js')).podMemoryLimitFor(podGoal, remoteEnv).limit : undefined;
+  const fits = Object.fromEntries(targets.map((target) => {
+    const fit = memoryLimit
+      ? parentHostModule.readParentHostPodFit(target, memoryLimit, deps.ssh)
+      : { state: 'unmeasured' as const, memoryLimit: '', requiredBytes: null, allocatableBytes: null, reason: 'pod-context-unmeasured' };
+    try { debug.log('task-agent.parent-host', 'pod-fit', { host: target.host, runId: context.runId, ...fit }); } catch { /* fail-soft */ }
+    if (fit.state === 'never-fits') notice(`[parent-host] ${target.host} 제외 — ${fit.reason}: Pod ${fit.memoryLimit} (${fit.requiredBytes} bytes) > node allocatable ${fit.allocatableBytes} bytes`);
+    return [target.host, fit];
+  }));
+  const eligible = targets.filter((target) => fits[target.host]?.state !== 'never-fits');
+  if (!eligible.length) {
+    const details = targets.map((target) => `${target.host}: Pod ${fits[target.host]!.memoryLimit} (${fits[target.host]!.requiredBytes} bytes) > node allocatable ${fits[target.host]!.allocatableBytes} bytes`).join(' · ');
+    throw new Error(`parent-host memory-never-fits — ${details}; local fallback refused`);
+  }
+  const capacities = Object.fromEntries(multi ? eligible.map((target) => [target.host, parentHostModule.readParentHostCapacity(target, deps.ssh)]) : []);
+  const measured = eligible.filter((target) => fits[target.host]?.state === 'fits');
+  const unknown = eligible.filter((target) => fits[target.host]?.state !== 'fits');
+  const ordered = multi
+    ? [...parentHostModule.orderParentHosts(measured, context.runId, capacities), ...parentHostModule.orderParentHosts(unknown, context.runId, capacities)]
+    : eligible;
   for (const target of ordered) {
     if (multi && (!capacities[target.host] || capacities[target.host]!.approvalHeadroom <= 0)) {
       failed(target, ['capacity-unavailable']);
@@ -217,7 +299,27 @@ async function tryRemoteParent(args: string[], cwd: string | undefined, context:
     if (!preflight.ok) { failed(target, preflight.gaps, preflight.facts); continue; }
     if (preflight.warnings.length) notice(`⚠ ${target.host} 자격: ${preflight.warnings.join(' · ')}`);
     try {
-      const launched = parentHostModule.launchRemoteParent(target, args, context.env, deps.ssh);
+      if (parentHostModule.shouldInstallRemoteCodexAccess(context.effectiveChildProvider)) {
+        let mirror: { elanousAuth: string; codexAuth: string; account?: string; usedPercent?: number; thresholdPercent?: number } | null = null;
+        let mirrorReason = 'credential-source-empty';
+        try { mirror = await getAccessMirror(); }
+        catch (error) {
+          if (error instanceof NoEligibleOwnerCodexAccountError) throw error;
+          mirrorReason = 'credential-source-error';
+        }
+        if (mirror) parentHostModule.installRemoteCodexAccess(target, mirror, deps.ssh);
+        else {
+          try { debug.log('task-agent.parent-host', 'codex-access-mirror-unavailable', { host: target.host, runId: context.runId, reason: mirrorReason }); } catch { /* fail-soft */ }
+          failed(target, ['codex-access-mirror-unavailable']);
+          return null;
+        }
+        if (mirror.account) {
+          remoteEnv.ELANOUS_REMOTE_CODEX_ACCOUNT = mirror.account;
+          remoteEnv.ELANOUS_REMOTE_CODEX_USED_PERCENT = mirror.usedPercent === undefined ? 'unknown' : String(mirror.usedPercent);
+          if (mirror.thresholdPercent !== undefined) remoteEnv.ELANOUS_REMOTE_CODEX_THRESHOLD_PERCENT = String(mirror.thresholdPercent);
+        }
+      }
+      const launched = parentHostModule.launchRemoteParent(target, args, remoteEnv, deps.ssh);
       try { debug.log('task-agent', 'parent-host-launched', { host: target.host, runId: context.runId, pid: launched.pid, log: launched.log }); } catch { /* fail-soft */ }
       return { runId: context.runId, parentHost: { host: target.host, ...(target.configDir ? { configDir: target.configDir } : {}), pid: launched.pid, log: launched.log } };
     } catch (error) {
@@ -398,6 +500,7 @@ function taskCardLines(card: TaskCard): string[] {
   return [
     [card.id, card.status, card.seat ?? '-', card.checklistId ?? '-', card.createdAt, card.text].join('\t'),
     ...cardIdentityLines(card),
+    ...(card.targetPaths !== undefined ? [`대상 경로: ${card.targetPaths.length ? card.targetPaths.join(' · ') : '(유효한 경로 없음)'}`] : []),
     ...(card.mission ? [`미션: ${card.mission} · after: ${card.after?.length ? card.after.join(', ') : '-'}`] : []),
     ...runLinkLine(card),
     ...liveMoveLines(card),
@@ -1578,7 +1681,45 @@ export function registerTasksCommands(program: Command, deps: TasksCliDeps = {})
             : {});
           try { debug.log('task-agent', 'remote-rejudge-bind', binding); } catch { /* fail-soft */ }
         }
-        ids = id ? [id] : rejudgeCandidates(readTaskAgentState<{ tasks?: Record<string, TaskCard> }>(statePath).tasks ?? {});
+        if (id) ids = [id];
+        else {
+          const maxAgeHours = (await import('../user-config.js')).getUserConfig().taskAgent?.rejudgeMaxAgeHours ?? 72;
+          const cards = readTaskAgentState<{ tasks?: Record<string, TaskCard> }>(statePath).tasks ?? {};
+          const candidates = rejudgeCandidates(cards, { maxAgeHours, onAgeSkip: (card, ageHours) => {
+            try { debug.log('task-agent', 'rejudge-age-skip', { card: card.id, ageHours, maxAgeHours }); } catch { /* fail-soft */ }
+          } });
+          const { capturedLandReview } = await import('../task-agent/review-result-capture.js');
+          const { defaultPrHead, defaultReviewRepoCandidates } = await import('../task-agent/live-moves.js');
+          const currentHeads = new Map<string, string>();
+          // Priority is a hint, not a gate. Consider only the three newest candidates;
+          // a non-mf0 card still consumes one of those three places. Everyone else runs in age order.
+          const priorityCandidates = candidates.slice(0, 3);
+          let headProbes = 0;
+          for (const cardId of priorityCandidates) {
+            const card = cards[cardId];
+            if (!card || typeof card.pr !== 'object' || !card.pr?.url) continue;
+            const pr = card.pr.number;
+            const lastHead = card.reviewRequests?.filter((entry) => entry.pr === pr).at(-1)?.head;
+            if (!lastHead || capturedLandReview(card, pr, lastHead)?.mustFixCount !== 0) continue;
+            let repos: readonly import('../task-agent/live-moves.js').ReviewRepoCandidate[] = [];
+            try { repos = (deps.rejudge?.live?.repoCandidates ?? defaultReviewRepoCandidates)(card); } catch { /* no trusted repo */ }
+            const repo = repos[0];
+            if (!repo) continue;
+            headProbes++;
+            let view: Awaited<ReturnType<typeof defaultPrHead>>;
+            try { view = await (deps.rejudge?.live?.prHead
+              ? deps.rejudge.live.prHead(pr, repo.cwd)
+              : defaultPrHead(pr, repo.cwd, (args, options) => spawnSync('gh', args, {
+                encoding: 'utf8', timeout: 3_000, env: options.env, ...(options.cwd ? { cwd: options.cwd } : {}),
+              }))); } catch { view = null; }
+            if (view?.state === 'OPEN' && view.url === card.pr.url) currentHeads.set(cardId, view.head);
+          }
+          if (candidates.length > priorityCandidates.length) {
+            try { debug.log('task-agent', 'rejudge-head-priority-probe-cap', { considered: priorityCandidates.length,
+              probed: headProbes, totalCandidates: candidates.length, max: 3 }); } catch { /* fail-soft */ }
+          }
+          ids = rejudgeCandidates(cards, { maxAgeHours, currentHeads });
+        }
       } catch (error) {
         out(error instanceof Error ? error.message : '과제 카드 읽기 실패'); process.exitCode = 1; return;
       }
@@ -1586,6 +1727,8 @@ export function registerTasksCommands(program: Command, deps: TasksCliDeps = {})
       const liveMoves = deps.rejudge?.liveMoves ?? await configuredTaskAgentLiveMoves();
       const repairBudget = opts.all ? { max: (await import('../user-config.js')).getUserConfig().taskAgent?.repairMaxPerTick ?? 3,
         requested: 0, capped: 0 } : undefined;
+      const reviewBudget = opts.all ? { max: 1, requested: 0 } : undefined;
+      const landBudget = opts.all ? { max: 1, requested: 0 } : undefined;
       const all = [];
       for (const cardId of ids) {
         await mirrorRemoteCardLedger(cardId, deps);
@@ -1594,7 +1737,8 @@ export function registerTasksCommands(program: Command, deps: TasksCliDeps = {})
         }
         let outcomes: Awaited<ReturnType<typeof rejudgeCardOnHead>>;
         try { outcomes = await rejudgeCardOnHead(cardId, { ...deps.rejudge, liveMoves,
-          ...(repairBudget ? { repairBudget } : {}), live: { ...deps.rejudge?.live, statePath } }); } catch (error) {
+          ...(repairBudget ? { repairBudget } : {}), ...(reviewBudget ? { reviewBudget } : {}), ...(landBudget ? { landBudget } : {}),
+          live: { ...deps.rejudge?.live, statePath } }); } catch (error) {
           // 카드 하나의 예외가 --all 의 나머지 카드 판단을 멈추지 않게 — 사유를 남기고 다음 카드로.
           const reason = (error instanceof Error ? error.message : String(error)).slice(-300);
           try { debug.log('task-agent', 'rejudge-on-head', { card: cardId, pr: null, fromHead: null, toHead: null, step: 'target', decision: 'rejudge-threw', reason }, { level: 'warn' }); } catch { /* fail-soft */ }

package/src/control/control-status.ts

@@ -33,6 +33,13 @@ export interface ControlStatusDeps {
   log?: typeof debug.log;
 }
 
+/** The same read-only HQ source used by `control status` and HQ-fenced control serve. */
+export function readControlHqLease(): ReturnType<typeof readHqLease> {
+  return readHqLease(getElanousConfigDirOverride() !== undefined
+    ? { store: fileLeaseStore(join(effectiveInstanceRoot(), 'hq', 'lease.json')), hostPath: join(effectiveInstanceRoot(), 'hq', 'host') }
+    : {});
+}
+
 const missing = (row: ControlStatusRowName, reason: string): ControlStatusRow => ({ row, state: 'unmeasured', text: '못 쟀다', reason });
 
 function localInstallRoot(): string {
@@ -76,9 +83,7 @@ export async function collectControlStatus(deps: ControlStatusDeps = {}): Promis
   };
 
   await add('집', async () => {
-    const readLease = deps.readLease ?? (() => readHqLease(getElanousConfigDirOverride() !== undefined
-      ? { store: fileLeaseStore(join(effectiveInstanceRoot(), 'hq', 'lease.json')), hostPath: join(effectiveInstanceRoot(), 'hq', 'host') }
-      : {}));
+    const readLease = deps.readLease ?? readControlHqLease;
     const { record, ageSeconds, expired } = await readLease();
     if (!record) return missing('집', '본부 임대 기록 없음');
     return { row: '집', state: expired ? 'warn' : 'ok',

package/src/control-plane/ledger.ts

@@ -23,6 +23,7 @@ export interface PodWorkerKey { context: string; imageDigest: string; lockHash:
 type PodWorkerState = 'idle' | 'leased' | 'sanitizing' | 'quarantined';
 interface PodWorkerLeaseAttrs {
   key: PodWorkerKey;
+  podUid: string;
   state: PodWorkerState;
   generation: number;
   idleTtlMs: number;
@@ -203,20 +204,20 @@ export class ResourceLedger {
   }
 
   /** A trusted host registers a clean instance; canary verification is a separate, still unwired step. */
-  registerPodWorker(request: { workerId: string; machine: string; key: PodWorkerKey; owner: string; ttlMs: number }, now?: number): ResourceRecord {
+  registerPodWorker(request: { workerId: string; machine: string; podUid: string; key: PodWorkerKey; owner: string; ttlMs: number }, now?: number): ResourceRecord {
     return this.mutate(() => {
+    if (typeof request.podUid !== 'string' || !request.podUid.trim()) throw new ResourceLedgerError(400, 'invalid-pod-worker-uid');
     now ??= Date.now();
     const rows = this.read();
     const id = `pod-worker-lease:${request.workerId}`;
     const index = rows.findIndex(row => row.id === id);
     const previous = index < 0 ? undefined : rows[index]!;
     if (previous && previous.kind !== 'pod-worker-lease') throw new ResourceLedgerError(409, 'worker-id-conflict');
-    if (previous && previous.owner !== request.owner) throw new ResourceLedgerError(403, 'not-owner');
     // A workerId identifies one Pod instance. Expiry never proves that a leased or quarantined Pod was cleaned.
     if (previous) throw new ResourceLedgerError(409, 'worker-id-used');
     const generation = 0;
     const row: ResourceRecord = { id, kind: 'pod-worker-lease', machine: request.machine, name: request.workerId,
-      owner: request.owner, attrs: { key: request.key, state: 'idle', generation, idleTtlMs: request.ttlMs }, observedAt: now, ttlMs: request.ttlMs };
+      owner: request.owner, attrs: { key: request.key, podUid: request.podUid, state: 'idle', generation, idleTtlMs: request.ttlMs }, observedAt: now, ttlMs: request.ttlMs };
     if (index < 0) rows.push(row); else rows[index] = row;
     this.write(rows);
     return row;
@@ -229,6 +230,7 @@ export class ResourceLedger {
     const rows = this.read();
     const index = rows.findIndex(row => row.kind === 'pod-worker-lease' && (!request.machine || row.machine === request.machine)
       && Math.max(0, at - row.observedAt) < row.ttlMs && workerAttrs(row).state === 'idle'
+      && typeof workerAttrs(row).podUid === 'string' && workerAttrs(row).podUid.trim().length > 0
       && sameWorkerKey(workerAttrs(row).key, request.key));
     if (index < 0) throw new ResourceLedgerError(409, 'no-warm-worker');
     const row = rows[index]!;

package/src/control-plane/server.ts

@@ -164,15 +164,16 @@ export function startControlServer(opts: ControlServerOptions = {}): {
           if (workerRegister) {
             if (!machine) throw new ResourceLedgerError(403, 'worker-host-required');
             const body = podWorkerBody(await req.json());
-            const { workerId, machine: workerMachine, key, ttlMs } = body;
+            const { workerId, machine: workerMachine, podUid, key, ttlMs } = body;
             if (typeof workerId !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,95}$/.test(workerId)
               || typeof workerMachine !== 'string' || !workerMachine.trim()
+              || typeof podUid !== 'string' || !podUid.trim()
               || typeof ttlMs !== 'number' || !Number.isSafeInteger(ttlMs) || ttlMs <= 0 || ttlMs > MAX_POD_WORKER_TTL_MS) throw new ResourceLedgerError(400, 'invalid-pod-worker-lease');
             requireMachine(workerMachine);
             const stale = await currentWorkerPrimary();
             if (stale) return stale;
             return json(await ledger.withGuardedWorkerMutation(async () => !(await currentWorkerPrimary()),
-              () => ledger.registerPodWorker({ workerId, machine: workerMachine, key: podWorkerKey(key), ttlMs, owner })));
+              () => ledger.registerPodWorker({ workerId, machine: workerMachine, podUid, key: podWorkerKey(key), ttlMs, owner })));
           }
           if (workerAcquire) {
             if (scope !== 'member') throw new ResourceLedgerError(403, 'worker-consumer-required');
@@ -244,7 +245,8 @@ export function startControlServer(opts: ControlServerOptions = {}): {
               name: url.searchParams.get('name') || undefined,
             });
             return json({ resources: rows.map(row => row.kind === 'pod-worker-lease'
-              ? { ...row, attrs: { key: row.attrs.key, state: row.attrs.state, generation: row.attrs.generation } }
+              ? { ...row, attrs: { key: row.attrs.key, podUid: row.attrs.podUid,
+                state: row.attrs.state, generation: row.attrs.generation, idleTtlMs: row.attrs.idleTtlMs } }
               : row.kind === 'port-lease'
               ? { ...row, attrs: { ...row.attrs, leaseId: undefined } }
               : row) });

package/src/core-turn/short-question.ts

@@ -105,7 +105,11 @@ function classifyTuiChatIntentBase(text: string, ctx: ShortQuestionContext): Tui
   if (!q || ctx.hasAttachments) return coding(ctx.hasAttachments ? 'attachment' : 'empty');
   if (/(?:하니스|구현|코딩|버그|리팩터|커밋|패치|테스트|시험\s*돌|빌드|배포|\b(?:implement|coding|refactor|commit|patch|tests?|build|deploy)\b)/i.test(q)) return coding('coding');
   // Destructive or executing verbs in any form (not only «…줘») are never a quick turn.
-  if (/(?:지워|지우|삭제|제거|옮겨|옮기|돌려|실행(?!\s*중(?:인)?(?:\s|[?!.~]|$))|설치|되돌려|롤백|재시작|죽여|\b(?:delete|remove|rm|rename|move|run|install|revert|rollback|drop|kill|restart)\b)/i.test(q)) return coding('write-verb');
+  // A no-tool answer can transcribe its first line. Keep the verb for file changes and
+  // remove only this copy phrase, so another write request in the same answer is still caught.
+  const answerOnly = /도구\s*쓰지\s*말고\s*답해\s*:/i.test(q);
+  const writeVerbInput = answerOnly ? q.replace(/첫\s*줄(?:을|를)?\s*그대로\s*옮기고/g, '') : q;
+  if (/(?:지워|지우|삭제|제거|옮겨|옮기|돌려|실행(?!\s*중(?:인)?(?:\s|[?!.~]|$))|설치|되돌려|롤백|재시작|죽여|\b(?:delete|remove|rm|rename|move|run|install|revert|rollback|drop|kill|restart)\b)/i.test(writeVerbInput)) return coding('write-verb');
   // Allowlist, not denylist: every «…줘» request verb must be one a quick turn can do; anything else
   // (지워줘 · 돌려줘 · 옮겨줘 …) keeps the coding goal loop.
   for (const match of q.matchAll(/([가-힣]+?)\s*(?:줘|주세요|줄래|주라)/g)) {

package/src/dashboard/index.ts

@@ -306,13 +306,20 @@ import {
 } from './render/renderer.js';
 import { buildPromptFrameDividerRows } from '../display/prompt-frame-paint.js';
 import {
-  drawTurnTypeaheadPromptRows,
   paintTurnTypeaheadEchoRow,
   resolveEssentialFrameCursorDecision,
   type EssentialFrameCursorDecision,
-  type TurnTypeaheadPromptPaintSink,
-  type TurnTypeaheadPromptRowsInput,
 } from './input/turn-typeahead-prompt.js';
+import {
+  buildDashboardTurnTypeaheadPromptZone,
+  drawDashboardTurnTypeaheadPromptRows,
+  observeDashboardTurnTypeaheadPromptZone,
+} from './turn-typeahead-prompt-zone.js';
+export {
+  buildDashboardTurnTypeaheadPromptZone,
+  drawDashboardTurnTypeaheadPromptRows,
+  observeDashboardTurnTypeaheadPromptZone,
+} from './turn-typeahead-prompt-zone.js';
 import { DashboardStateStore } from './runtime/state-store.js';
 import { perf } from '../perf-counters.js';
 import { createSearchModal, type SearchModalHandle, type SearchItem } from '../chat/search/modal.js';
@@ -1467,30 +1474,6 @@ export function resolveDashboardSlashSurfaceUx(
     : undefined;
 }
 
-/** Dashboard draw entry for the input-prompt zone. Streaming redraws reach
- * this production binding through the zone renderer below. */
-export function drawDashboardTurnTypeaheadPromptRows(
-  input: TurnTypeaheadPromptRowsInput,
-  sink?: TurnTypeaheadPromptPaintSink,
-): string[] {
-  return drawTurnTypeaheadPromptRows(input, sink);
-}
-
-/** Essential frames own the fallback prompt caret; Z-axis state only wins
- * when a modal has made a visible claim. */
-export function buildDashboardTurnTypeaheadPromptZone(input: TurnTypeaheadPromptRowsInput & {
-  suppressPromptArea: boolean;
-}): LayoutZone {
-  return {
-    id: 'input-prompt',
-    height: input.frame.inputHeight,
-    render: (height, width) => {
-      if (input.suppressPromptArea) return Array.from({ length: height }, () => ' '.repeat(width));
-      return drawDashboardTurnTypeaheadPromptRows({ ...input, height, width });
-    },
-  };
-}
-
 /** The chat-main submit branch calls this before any model dispatch. Keeping
  * the decision here lets the dashboard test execute the same entry point. */
 export function resolveDashboardHarnessSubmitIntent(
@@ -1501,42 +1484,6 @@ export function resolveDashboardHarnessSubmitIntent(
   return routeDevHarnessSubmitIntent(resolveIntent(text, options));
 }
 
-/** 프롬프트 zone 에 관측만 덧입힌다 — 렌더 산출은 `inner` 가 소유한다.
- *
- *  ⭐ **왜 뽑았나**(무인 리뷰 must-fix · 2026-08-01): 종전엔 이 래퍼가 `zones.push({...})` 안에
- *  인라인이라, 테스트가 `inner`(=`buildDashboardTurnTypeaheadPromptZone`)만 불러도 통과했다.
- *  ⇒ ***래퍼가 `inner.render` 를 부르는 것을 끊어도 검사가 침묵***했다. 이제 그 결선이 검사된다.
- *
- *  ⛔⚠️ **여전히 검사 밖인 한 겹**: 이 함수의 반환이 실제로 `zones` 배열에 **push 되는지**는
- *  `showDashboard` 안의 지역 조립부라 단위 검사가 닿지 않는다. ***무한 후퇴이므로 여기서 경계를 긋는다*** —
- *  그 한 겹은 **라이브 검증**(`dev --elanous --hold` ⊕ `pty snapshot`)이 맡는다. */
-export function observeDashboardTurnTypeaheadPromptZone(
-  inner: LayoutZone,
-  deps: {
-    promptBottomRow: number;
-    state: { buffer: string; queuedSubmissions: string[] };
-    isDebugEnabled?: () => boolean;
-    log?: (category: string, event: string, data: Record<string, unknown>) => void;
-  },
-): LayoutZone {
-  return {
-    ...inner,
-    render: (height, width) => {
-      const rows = inner.render(height, width);
-      const enabled = deps.isDebugEnabled ? deps.isDebugEnabled() : debug.enabled;
-      if (deps.state.buffer && enabled) {
-        (deps.log ?? ((c, e, d) => debug.log(c, e, d)))('dashboard.turn-typeahead-prompt', 'dashboard-draw-prompt', {
-          row: deps.promptBottomRow,
-          text: rows.at(-1) ?? '',
-          bufferLength: deps.state.buffer.length,
-          queuedSubmissionCount: deps.state.queuedSubmissions.length,
-        });
-      }
-      return rows;
-    },
-  };
-}
-
 type DashboardFrameRenderer = (lines: string[], options: RenderOptions) => void;
 
 /** Compose coordinator-owned modal surfaces into the dashboard's single frame overlay. */
@@ -1915,6 +1862,20 @@ export function renderDashboardStatusLines(input: Omit<DashboardStatusLinesInput
   return buildDashboardStatusLines({ ...input, seatsNow });
 }
 
+/** The pending-input registry is process-local; a remote ACP loop cannot drain it. */
+export function activeDashboardTypeaheadSessionId(acpSessionId: string | null, daemonAttached: boolean): string | null {
+  return daemonAttached ? null : acpSessionId;
+}
+
+/** The streaming keyboard's production typeahead transition. */
+export function applyDashboardStreamingTypeaheadKey(
+  state: Parameters<typeof applyTurnTypeaheadKey>[0],
+  key: Parameters<typeof applyTurnTypeaheadKey>[1],
+  isImmediate: Parameters<typeof applyTurnTypeaheadKey>[2],
+): ReturnType<typeof applyTurnTypeaheadKey> {
+  return applyTurnTypeaheadKey(state, key, isImmediate);
+}
+
 export async function showDashboard(opts: ShowDashboardOptions = {}): Promise<DashboardAction> {
   let firstDashboardFrameRendered = false;
   await awaitGlobalPersonaLoad().catch(() => {});
@@ -3404,6 +3365,8 @@ Mode- and sync-specific instructions are injected per-turn when relevant — do
     getCwd: () => workingDir.cwd,
     notify: (line) => { chatLines.push(C.muted(line)); draw(); },
   });
+  // Set only by the failed-turn callback and consumed by that turn's streaming cleanup.
+  let autowakeTurnFailureRaw: string | null = null;
   const internalTurnYieldPort = wrapAgentWakePort(seatAutowake.wrapPort(internalTurnGate.port));
   // ⭐ H5 자기 예약 깨움(TUI-H5-SCHEDULE-WAKEUP) — 프로세스 안 타이머가 그 시각에 H2 문으로 한 턴을 청한다.
   //   직전 회차 판정 = 그 예약이 연 내부 턴이 아직 도나. 도구 등록은 아래 host tool 자리(하니스 자식 제외).
@@ -3416,7 +3379,6 @@ Mode- and sync-specific instructions are injected per-turn when relevant — do
   const acpSessionIdRef: { current: string | null } = { current: null };
   const adoptedAcpSessionIds = new Set<string>();
   let activeAcpSessionId: string | null = null;
-  const activeSessionIdForTypeahead = (): string | null => acpSessionIdRef.current;
   const paintTurnTypeaheadEcho = (): void => {
     const { rows: tr, cols: tc } = termSize();
     const pf = currentPromptFrame(tr);
@@ -6857,7 +6819,7 @@ Mode- and sync-specific instructions are injected per-turn when relevant — do
             } catch { /* 승격 실패가 스트리밍을 막지 않는다 */ }
             return 'consumed';
           }
-          const r = applyTurnTypeaheadKey(turnTypeaheadRef.state, k, isStreamingImmediateSlash);
+          const r = applyDashboardStreamingTypeaheadKey(turnTypeaheadRef.state, k, isStreamingImmediateSlash);
           if (r.consumed) {
             turnTypeaheadRef.state = r.state;
             if (r.submissionDisposition) {
@@ -6873,7 +6835,7 @@ Mode- and sync-specific instructions are injected per-turn when relevant — do
               // ⛔ H2 — 내부 턴 중의 사람 입력은 그 턴에 끼워 넣지 않는다(턴 끝 FIFO 로 기다린다).
               if (r.submissionDisposition === 'fifo' && !r.immediateSubmission && !internalTurnGate.isInternalTurnActive()) {
                 const queuedText = turnTypeaheadRef.state.queuedSubmissions.at(-1);
-                const sid = activeSessionIdForTypeahead();
+                const sid = activeDashboardTypeaheadSessionId(acpSessionIdRef.current, daemonAttached);
                 if (queuedText && sid) {
                   const queuedHistoryEntry = inputHistoryStore.record({
                     text: queuedText,
@@ -7165,7 +7127,9 @@ Mode- and sync-specific instructions are injected per-turn when relevant — do
         userScrolledDuringStream = false;
         streamingInFlight = false;
         reportTuiTurn('idle');
-        seatAutowake.noteTurnEnded();
+        const failedTurnRaw = autowakeTurnFailureRaw;
+        autowakeTurnFailureRaw = null;
+        seatAutowake.noteTurnEnded({ sessionId: currentChatPersonaSessionId(), lastLine: chatLines.at(-1) ?? '', errorDetail: failedTurnRaw ?? undefined });
       }
     };
   };
@@ -18570,6 +18534,10 @@ Mode- and sync-specific instructions are injected per-turn when relevant — do
                   settleEscAbortToolCall(escAbortToolState, toolCall);
                   escHarnessSpacesByCallId.delete(toolCall.id);
                 },
+                onThought: (text) => {
+                  turnStreamRuntime.onThought?.(text);
+                  draw();
+                },
               };
             },
             runTurnUsageRuntime: (usage) => {
@@ -18690,6 +18658,7 @@ Mode- and sync-specific instructions are injected per-turn when relevant — do
             warningLine: (message) => C.warning(`${ICONS.warning} ${message}`),
             pushErrorLine: (message) => { chatLines.push(C.error(`Error: ${message}`)); },
             pushFailureNotice: (notice, raw) => {
+              autowakeTurnFailureRaw = raw;
               chatLines.push(C.warning(notice));
               detailViewerRuntime.stage('turn error', raw.split(/\r?\n/));
             },