elanous 0.2.34 → 0.2.36

package/src/model-tier/llm-tier-map.ts

@@ -24,6 +24,7 @@
 // surfaces tier label + model id + per-turn rationale only.
 
 import type { LLMProviderName, ReasoningLevel } from '../user-config.js';
+import { OPENGATEWAY_DEFAULT_MODEL } from '../llm/opengateway-models.js';
 import type { ModelTier } from './types.js';
 
 export interface LlmTierSpec {
@@ -417,6 +418,18 @@ const OPENROUTER: TierMap = {
   loaded:   { model: 'openrouter/moonshotai/kimi-k3', reasoningLevel: 'high', label: 'Kimi K3 · reasoning high (OpenRouter)', rationale: 'Loaded · deep multi-step', status: 'shipping' },
 };
 
+// First OpenGateway slice has one measured model. Every explicit tier resolves to the same model
+// until distinct tiers have their own live evidence; no quality or price ordering is implied.
+const OPENGATEWAY_MODEL = OPENGATEWAY_DEFAULT_MODEL;
+// The provider has no effort/thinking control; all five tiers use the verified model without reasoning options.
+const OPENGATEWAY: TierMap = {
+  budget:   { model: OPENGATEWAY_MODEL, reasoningLevel: 'off', label: 'DeepSeek V4.1 Flash Ultrafast (OpenGateway)', rationale: 'Single verified first-slice model', status: 'shipping' },
+  balanced: { model: OPENGATEWAY_MODEL, reasoningLevel: 'off', label: 'DeepSeek V4.1 Flash Ultrafast (OpenGateway)', rationale: 'Single verified first-slice model', status: 'shipping' },
+  better:   { model: OPENGATEWAY_MODEL, reasoningLevel: 'off', label: 'DeepSeek V4.1 Flash Ultrafast (OpenGateway)', rationale: 'Single verified first-slice model', status: 'shipping' },
+  best:     { model: OPENGATEWAY_MODEL, reasoningLevel: 'off', label: 'DeepSeek V4.1 Flash Ultrafast (OpenGateway)', rationale: 'Single verified first-slice model', status: 'shipping' },
+  loaded:   { model: OPENGATEWAY_MODEL, reasoningLevel: 'off', label: 'DeepSeek V4.1 Flash Ultrafast (OpenGateway)', rationale: 'Single verified first-slice model', status: 'shipping' },
+};
+
 // ── AWS Bedrock (BEDROCK-PROVIDER · 2026-10-11) ───────────────────
 //   ⭐ 판단: ANTHROPIC 사다리의 «추론 수준·역할 배치»를 그대로 두고, 모델은 Bedrock 메시지 엔드포인트에서
 //   확인한 5.5 계열 id(`src/llm/bedrock.ts` BEDROCK_MODELS · 출처 platform.claude.com «Claude in Amazon Bedrock»
@@ -466,6 +479,7 @@ export const LLM_TIER_MAP_BY_PROVIDER: Readonly<Record<LlmTierProvider, TierMap>
   glm: GLM,
   grok: GROK,
   openrouter: OPENROUTER,
+  opengateway: OPENGATEWAY,
   bedrock: BEDROCK,
 } as const;
 
@@ -488,7 +502,7 @@ export function parseTierArg(raw: string): ModelTier | undefined {
  *  tsc 는 배열 누락을 못 잡는다(2026-09-23 `#19900` 이 `openrouter` 를 빠뜨려 배선 계약 자가 그것을
  *  한 번도 누르지 않았다). 자 = `provider-wiring-contract.test.ts`. */
 export const TIER_PROVIDERS: readonly LlmTierProvider[] = [
-  'anthropic', 'openai', 'openai-codex', 'gemini', 'grok', 'local', 'kimi', 'qwen', 'glm', 'openrouter', 'bedrock',
+  'anthropic', 'openai', 'openai-codex', 'gemini', 'grok', 'local', 'kimi', 'qwen', 'glm', 'openrouter', 'opengateway', 'bedrock',
 ];
 
 /** OpenRouter 모델 id(`openrouter/<vendor>/<model>` 또는 `<vendor>/<model>`)의 tier-map 칸.

package/src/models/prompts.ts

@@ -189,7 +189,14 @@ export function getModelTier(
 
 /** Minimal tool-call hygiene for older GPT/o-series models. Kept
  *  short and generic so stronger providers do not get burdened with
- *  Codex-specific anti-loop rules they do not need. */
+ *  Codex-specific anti-loop rules they do not need.
+ *
+ *  TUI-OPS-TURN-GUARD gap ② (2026-10-22): rule 4 states the ops-turn
+ *  guard split — it must live here too, not only in the codex addon,
+ *  because gpt-6 ids stay in the 'gpt' family (usesCodexBehaviorGuards
+ *  widens the behavior predicate, not the family) and gpt-6 models run
+ *  those llm.ts phase guards. The tool names mirror the allow lists in
+ *  src/llm/tool-loop-steered-rejection.ts that llm.ts consumes. */
 const TOOL_DISCIPLINE_GPT = [
   '',
   '## Tool-call hygiene',
@@ -197,6 +204,7 @@ const TOOL_DISCIPLINE_GPT = [
   '1. NEVER call the same tool with identical arguments twice in a row. If you already Read a file, use its previous tool_result from history — do not re-Read.',
   '2. After each tool_result, emit AT LEAST one sentence of reasoning (what you learned, what you will do next) BEFORE issuing the next tool call. Silent tool-spam is a failure mode we actively block.',
   '3. If any tool_result contains "DUPLICATE CALL", "RUNTIME BLOCKED", "TOOL CALL REJECTED", or "SYSTEM BUDGET NOTICE" — STOP. Your next output MUST be plain text (the final answer or a clear "impossible because X"), not another tool call.',
+  '4. Ops turns (TUI-OPS-TURN-GUARD): read-only ops observation tools (`logs_query`, `PtyShellPoll`) stay runnable mid-ops-turn — keep observing the run with them. Write-capable ops tools (`schedule_manage`, `se_build`) are phase-governed: when one returns "TOOL CALL REJECTED" it is out of phase for this turn — do not retry it; rule 3 applies (finish in plain text).',
   '',
 ].join('\n');
 
@@ -204,7 +212,13 @@ const TOOL_DISCIPLINE_GPT = [
  *  Their common failure mode is read-only polling on stable state
  *  (Read / GetDashboardState / similar) instead of acting on the
  *  result they already have. Keep this focused on tool-loop hygiene,
- *  not orchestration prose. */
+ *  not orchestration prose.
+ *
+ *  TUI-OPS-TURN-GUARD gap ② (2026-10-22): rule 5 states the ops-turn
+ *  guard split so the prompt half matches the ACTION_PHASE_OPS_TOOLS /
+ *  REPAIR_PHASE_READ_ONLY_OPS_TOOLS allow lists llm.ts consumes —
+ *  read-only ops observation stays runnable mid-ops-turn, write-capable
+ *  ops tools stay phase-governed. */
 const TOOL_DISCIPLINE_CODEX = [
   '',
   '## Tool-call hygiene',
@@ -213,6 +227,7 @@ const TOOL_DISCIPLINE_CODEX = [
   '2. Treat read-only state tools as stable within the current turn. Do NOT re-call a state-inspection tool unless an intervening action could have changed the state.',
   '3. After each tool_result, emit AT LEAST one sentence of reasoning (what you learned, what you will do next) BEFORE issuing the next tool call.',
   '4. If any tool_result contains "DUPLICATE CALL", "RUNTIME BLOCKED", "TOOL CALL REJECTED", or "SYSTEM BUDGET NOTICE" — STOP. Your next output MUST be plain text, not another tool call.',
+  '5. Ops turns (TUI-OPS-TURN-GUARD): read-only ops observation tools (`logs_query`, `PtyShellPoll`) stay runnable mid-ops-turn — keep observing the run with them. Write-capable ops tools (`schedule_manage`, `se_build`) are phase-governed: when one returns "TOOL CALL REJECTED" it is out of phase for this turn — do not retry it; rule 4 applies (finish in plain text).',
   '',
 ].join('\n');
 

package/src/msg/msg-post-office.ts

@@ -0,0 +1,116 @@
+// ── 우편국(post office) 발견 ⊕ 재시작 — `msg serve --sse` 가 자기 포트를 적고, `msg post` 가 죽은 것을 다시 띄운다 ──
+//
+// 왜 «발견 파일» 인가: `eln msg serve --sse` 는 원장을 빨리 밀어 주는 별도 프로세스이고 설치본을 갈아 끼우면
+// 그 프로세스는 조용히 사라진다. `watch --sse` 는 폴링으로 돌아가므로 «동작은 하지만» 구독자는 늦어진다.
+// 서비스가 자기 포트·pid 를 `<상태 루트>/msg/sse.json` 에 적으면, 글을 저장한 «뒤» post 경로가
+// 그 줄을 읽어 «응답하지 않는 우편국» 을 같은 포트로 한 번 다시 띄울 수 있다.
+//
+// ⛔ 원장이 정본이다 — 다시 띄운 서비스는 저장된 글을 처음부터(=`since`·`Last-Event-ID`) 재생하므로
+//    서비스가 죽어 있던 동안 저장된 글도 잃지 않는다.
+// ⛔ 재시작은 글의 성패를 바꾸지 않는다 — 어떤 실패도 결과 값으로만 돌아온다(fail-open).
+// ⛔ 시험 우주에서는 실제 프로세스를 띄우지 않는다 — `ELANOUS_MSG_SSE_LIVE=1` 로만 연다(격리 실물 시험용).
+
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+import { effectiveInstanceRoot, prodInstanceRoot } from '../instance/resolve.js';
+
+export interface PostOfficeInfo {
+  /** Loopback port the SSE service answers on. */
+  port: number;
+  /** Process that wrote the line; a dead pid means the service is gone. */
+  pid: number;
+  url: string;
+}
+
+export type PostOfficeEnsure =
+  | { state: 'absent' }
+  | { state: 'skipped'; reason: string }
+  | { state: 'listening'; port: number }
+  | { state: 'restarted'; port: number };
+
+/** `<상태 루트>/msg/sse.json` — the ledger directory `msg serve` and `msg post` already share. */
+export function postOfficeFile(stateRoot: string): string {
+  return join(stateRoot, 'msg', 'sse.json');
+}
+
+/** The recorded service, or null when nothing registered one — 파일이 없으면 «모름»이지 «서비스 없음»의 측정이 아니다. */
+export function readPostOffice(stateRoot: string): PostOfficeInfo | null {
+  let raw: unknown;
+  try { raw = JSON.parse(readFileSync(postOfficeFile(stateRoot), 'utf8')); }
+  catch { return null; }
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null;
+  const { port, pid } = raw as { port?: unknown; pid?: unknown };
+  if (typeof port !== 'number' || !Number.isSafeInteger(port) || port < 0 || port > 65535) return null;
+  if (typeof pid !== 'number' || !Number.isSafeInteger(pid) || pid <= 0) return null;
+  return { port, pid, url: `http://127.0.0.1:${port}` };
+}
+
+/** Called by `msg serve --sse` right after the service binds its port. */
+export function writePostOffice(stateRoot: string, info: { port: number; pid?: number }): PostOfficeInfo {
+  const path = postOfficeFile(stateRoot);
+  mkdirSync(dirname(path), { recursive: true });
+  const value: PostOfficeInfo = { port: info.port, pid: info.pid ?? process.pid, url: `http://127.0.0.1:${info.port}` };
+  writeFileSync(path, `${JSON.stringify(value)}\n`);
+  return value;
+}
+
+/** Called when the service stops — only the writer's own line is removed, never a newer one. */
+export function clearPostOffice(stateRoot: string, pid: number = process.pid): boolean {
+  const current = readPostOffice(stateRoot);
+  if (current !== null && current.pid !== pid) return false;
+  try { rmSync(postOfficeFile(stateRoot), { force: true }); return true; }
+  catch { return false; }
+}
+
+function pidAlive(pid: number): boolean {
+  try { process.kill(pid, 0); return true; } catch { return false; }
+}
+
+/** Any HTTP answer (401 included) means the service is listening; silence means it is gone. */
+async function probePostOffice(url: string): Promise<boolean> {
+  try {
+    const response = await fetch(`${url}/stream`, { signal: AbortSignal.timeout(500) });
+    try { await response.body?.cancel(); } catch { /* body already closed */ }
+    return true;
+  } catch { return false; }
+}
+
+function liveUniverse(): boolean {
+  return effectiveInstanceRoot() === prodInstanceRoot() || process.env.ELANOUS_MSG_SSE_LIVE === '1';
+}
+
+/** Restart the same installed CLI entry that is running this command — `eln msg serve --sse --port <p>`. */
+function spawnPostOffice({ port }: { port: number }): void {
+  const entry = process.argv[1];
+  if (!entry) throw new Error('post office restart needs the running CLI entry (process.argv[1])');
+  const child = Bun.spawn([process.execPath, entry, 'msg', 'serve', '--sse', '--port', String(port)], {
+    detached: true, stdio: ['ignore', 'ignore', 'ignore'], env: process.env,
+  });
+  (child as unknown as { unref?: () => void }).unref?.();
+}
+
+export interface EnsurePostOfficeInput {
+  /** State root that holds `msg/sse.json`. */
+  stateRoot: string;
+  /** Test seam — liveness of the recorded pid (default: signal 0). */
+  alive?: (pid: number) => boolean;
+  /** Test seam — does the recorded service answer on its port? (default: one HTTP probe). */
+  probe?: (url: string) => Promise<boolean>;
+  /** Test seam / fake-bin — start a new service on the recorded port. */
+  launch?: (input: { port: number }) => void;
+}
+
+/**
+ * Restart a registered post office that no longer answers. Absent registration and a live service are no-ops,
+ * so a plain `msg post` keeps its current behavior.
+ */
+export async function ensurePostOffice(input: EnsurePostOfficeInput): Promise<PostOfficeEnsure> {
+  const info = readPostOffice(input.stateRoot);
+  if (info === null) return { state: 'absent' };
+  const alive = (input.alive ?? pidAlive)(info.pid);
+  if (alive && await (input.probe ?? probePostOffice)(info.url)) return { state: 'listening', port: info.port };
+  if (input.launch === undefined && !liveUniverse()) return { state: 'skipped', reason: 'test-universe' };
+  (input.launch ?? spawnPostOffice)({ port: info.port });
+  return { state: 'restarted', port: info.port };
+}

package/src/mss/logging/log-store.ts

@@ -30,6 +30,7 @@ import type { LogSink } from './sink.js';
 import { setInstanceName, resolveInstanceName } from '../../instance-identity.js';
 import * as nestDepth from '../../agent/nest-depth.js';
 import { debug } from '../../debug/log.js';
+import { DebugLogBatchQueue, defaultDebugBatchScheduler, type DebugBatchScheduler } from '../../debug/batch-queue.js';
 import { assertNotTestWritingOps } from '../../instance/test-write-guard.js';
 
 /** 스토어 경로 — `ELANOUS_STATE_DIR` 존중(격리 테스트/`nexus run --test` 의
@@ -822,6 +823,21 @@ export interface StoreSinkOpts {
   /** Register beforeExit / SIGINT / SIGTERM flush hooks lazily on first
    *  emit. Default true; tests/isolated fixtures can pass false. */
   installExitHandlers?: boolean;
+  /** TUI-TYPING-LAG — 임계 뒤 detach drain 이 한 틱에 넣는 최대 행 수. 기본 = `Infinity`(옛 동작 ·
+   *  한 틱에 전부 — CLI 는 그대로). TUI 는 `TUI_LOG_STORE_DRAIN_CHUNK_ROWS` 로 켠다: 남은 행은 «다음»
+   *  틱으로 넘겨 그 사이 stdin(키)이 배달된다. */
+  drainChunkSize?: number;
+  /** 시계 seam — 기본 setImmediate/setTimeout(unref). ux-sim 무대가 가짜 시계를 꽂는다. */
+  scheduler?: DebugBatchScheduler;
+}
+
+/** TUI-TYPING-LAG — TUI 프로세스의 StoreSink 가 한 틱에 넣는 최대 행 수(키 하나가 기다리는 상한). */
+export const TUI_LOG_STORE_DRAIN_CHUNK_ROWS = 64;
+
+/** 어느 surface 의 StoreSink 가 덩어리 drain 을 쓰나 — 키 입력을 받는 TUI 만. CLI·데몬은 옛 동작
+ *  (한 틱에 전부 · SQLITE_BUSY 때 막힘이 한 번으로 끝난다)을 그대로 둔다. */
+export function logStoreDrainChunkForSurface(surface: string): number | undefined {
+  return surface === 'tui' ? TUI_LOG_STORE_DRAIN_CHUNK_ROWS : undefined;
 }
 
 /** StoreSink가 버린 레코드의 누적 관측값. 스토어에 쓰지 않아 자기참조하지 않는다. */
@@ -833,8 +849,11 @@ export interface StoreSinkDropCounts {
 
 export class StoreSink implements LogSink {
   readonly name = 'store';
-  private buf: Array<{ rec: LogRecord; surface: string }> = [];
-  private timer: ReturnType<typeof setTimeout> | null = null;
+  private readonly queue: DebugLogBatchQueue<{ rec: LogRecord; surface: string }>;
+  private timer: unknown = null;
+  private hasTimer = false;
+  /** 덩어리 insert 가 실패한 뒤 다음 성공까지 — 임계를 넘어도 덩어리 틱을 다시 걸지 않는다(주기 flush 만). */
+  private chunkingPaused = false;
   private exitHandlersInstalled = false;
   private onBeforeExit: (() => void) | null = null;
   private onSigInt: (() => void) | null = null;
@@ -843,6 +862,9 @@ export class StoreSink implements LogSink {
   private readonly flushBatchSize: number;
   private readonly bufferCap: number;
   private readonly installExit: boolean;
+  private readonly scheduler: DebugBatchScheduler;
+  /** 덩어리 drain 한 틱의 최대 행 수(`Infinity` = 옛 동작 · 한 틱에 전부). 등록 배선을 시험이 잠그는 관측 칸. */
+  readonly drainChunkSize: number;
   private readonly dropCounts: StoreSinkDropCounts = { total: 0, flushFailure: 0, bufferCap: 0 };
 
   constructor(
@@ -854,49 +876,79 @@ export class StoreSink implements LogSink {
     this.flushBatchSize = opts.flushBatchSize ?? 64;
     this.bufferCap = opts.bufferCap ?? 2048;
     this.installExit = opts.installExitHandlers ?? true;
+    this.scheduler = opts.scheduler ?? defaultDebugBatchScheduler;
+    this.drainChunkSize = opts.drainChunkSize ?? Number.POSITIVE_INFINITY;
+    this.queue = new DebugLogBatchQueue({
+      batchSize: this.drainChunkSize,
+      flushDelayMs: 0,
+      scheduler: this.scheduler,
+      drain: (batch) => this.insert(batch),
+    });
   }
 
   emit(rec: LogRecord): void {
     // 자기참조 가드 — 로그 평면 자신의 이벤트는 스토어 재진입 금지.
     if (rec.category.startsWith('logs.')) return;
-    this.buf.push({ rec, surface: this.surface });
-    if (this.buf.length > this.bufferCap) {
-      const dropped = this.buf.length - this.bufferCap;
-      this.buf.splice(0, dropped);
-      this.recordDrop('bufferCap', dropped);
+    this.queue.push({ rec, surface: this.surface });
+    if (this.queue.pending > this.bufferCap) {
+      this.recordDrop('bufferCap', this.queue.dropOldest(this.queue.pending - this.bufferCap));
     }
     if (this.installExit) this.installExitHandlersOnce();
-    if (this.buf.length >= this.flushBatchSize) {
-      // 핫 틱 비블록 — insert 는 다음 매크로태스크로(FileSink detach 동형).
-      if (this.timer) { clearTimeout(this.timer); this.timer = null; }
-      setImmediate(() => this.flush());
+    if (this.queue.pending >= this.flushBatchSize && !this.chunkingPaused) {
+      // 핫 틱 비블록 — insert 는 다음 매크로태스크로, 그것도 «덩어리 하나씩»(TUI-TYPING-LAG).
+      this.cancelTimer();
+      this.queue.schedule();
       return;
     }
-    if (this.timer === null) {
-      this.timer = setTimeout(() => this.flush(), this.flushIntervalMs);
-      (this.timer as unknown as { unref?: () => void }).unref?.();
-    }
+    if (!this.queue.scheduled) this.armIntervalFlush();
   }
 
   flush(): void {
-    if (this.timer) { clearTimeout(this.timer); this.timer = null; }
-    if (this.buf.length === 0) return;
-    const batch = this.buf;
-    this.buf = [];
+    this.cancelTimer();
+    this.queue.flushAll();
+  }
+
+  private cancelTimer(): void {
+    if (!this.hasTimer) return;
+    this.scheduler.cancel(this.timer);
+    this.timer = null;
+    this.hasTimer = false;
+  }
+
+  private insert(batch: Array<{ rec: LogRecord; surface: string }>): boolean {
     try {
       // insertBatch retries SQLITE_BUSY batches on the next write; this sink remains fail-soft on final failure.
       this.store.insertBatch(batch);
+      this.chunkingPaused = false;
+      return true;
     } catch {
       /* fail-soft — 파일 트레일이 진실원. 배치는 버린다(재시도 루프 금지 —
          디스크 장애 시 무한 적체 방지). */
       this.recordDrop('flushFailure', batch.length);
+      // 덩어리 drain 중 실패(예: SQLITE_BUSY 는 busy_timeout 만큼 막는다)면 남은 덩어리를 틱마다 또
+      // 막게 두지 않는다 — 잘게 쪼개기를 멈추고(다음 성공까지 · 새 emit 도 덩어리 틱을 다시 걸지 않는다)
+      // 나머지는 다음 주기 flush 한 번으로 넘긴다.
+      this.chunkingPaused = true;
+      this.queue.cancelScheduled();
+      this.armIntervalFlush();
+      return false;
     }
   }
 
+  private armIntervalFlush(): void {
+    if (this.hasTimer) return;
+    this.hasTimer = true;
+    this.timer = this.scheduler.schedule(() => {
+      this.timer = null;
+      this.hasTimer = false;
+      this.flush();
+    }, this.flushIntervalMs);
+  }
+
   /** 누적 유실 관측값의 복사본. 로그 스토어에 쓰지 않아 자기참조하지 않는다. */
   get dropped(): StoreSinkDropCounts { return { ...this.dropCounts }; }
 
-  get pending(): number { return this.buf.length; }
+  get pending(): number { return this.queue.pending; }
 
   /** Flush the buffer and drop only this sink's exit/signal listeners. */
   close(): void {
@@ -1313,11 +1365,16 @@ export function registerLogStoreSink(
   registerSink: (sink: LogSink) => () => void,
   surface: string,
   retention: LogStoreRetention = LOG_RETENTION_DEFAULTS,
-  opts: { retentionOwner?: boolean } = {},
+  opts: { retentionOwner?: boolean; drainChunkSize?: number } = {},
 ): (() => void) | null {
   const store = getDefaultLogStore();
   if (!store) return null;
-  const sink = new StoreSink(store, surface, { installExitHandlers: true });
+  // 덩어리 크기 기본값은 surface 로 여기서 정한다 — 어느 등록 경로(standalone·nexus·직접 호출)든 TUI 면 덩어리 drain.
+  const drainChunkSize = opts.drainChunkSize ?? logStoreDrainChunkForSurface(surface);
+  const sink = new StoreSink(store, surface, {
+    installExitHandlers: true,
+    ...(drainChunkSize !== undefined ? { drainChunkSize } : {}),
+  });
   const off = registerSink(sink);
   try { nestDepth.observeNestAtBoot(); } catch { /* fail-soft — 관측 실패가 싱크 등록을 막지 않는다. */ }
   const owner = opts.retentionOwner ?? surface === 'nexus';

package/src/native-tool-catalog.ts

@@ -392,7 +392,7 @@ export const nativeToolCatalog: NativeToolCatalogEntry[] = [
   // OP TUI turns drove msg list/post/ack and release checklist
   // list/move/set/add through `eln` RunShell calls — 1.3–2s of CLI
   // startup each, 30+ spawns per turn, shell stdout amplifying screen
-  // defects. These eight tools reuse the SAME durable services
+  // defects. These ledger tools reuse the SAME durable services
   // in-process (msg-store SQLite ledger · release-loop checklist
   // ledger), preserving the structured results, the seat/OP permission
   // boundaries (ELANOUS_TRACK actor routing, seatMove rules, the HQ
@@ -429,6 +429,20 @@ export const nativeToolCatalog: NativeToolCatalogEntry[] = [
     intentScope: 'ops-fleet',
     cleanerFitThanShell: true,
   },
+  {
+    id: 'msg_ask',
+    kind: 'other',
+    aliases: ['MsgAsk', 'msg_ask'],
+    displayName: 'MsgAsk',
+    description: 'Post a durable seat question and wait for its first replyTo-linked reply. On timeout the question remains in the ledger and its ID is returned.',
+    promptSummary: '`MsgAsk(from, to, question, waitSeconds?)` (durable question + linked reply · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['mutating'],
+    supportsParallel: false,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
   {
     id: 'msg_ack',
     kind: 'other',

package/src/nexus/api/decisions-route.ts

@@ -24,24 +24,44 @@ export async function handleDecisions(req: Request, deps: DecisionsRouteDeps = {
       debug.log('decisions.api', 'rejected', { reason: 'invalid-status' });
       return jsonResponse({ error: 'bad_request' }, 400);
     }
-    const decisions = ledger.list({ status: 'open' }).map(entry => ({
-      id: entry.id,
-      title: entry.title,
-      situation: entry.scqa.s.slice(0, 200),
-      options: entry.options.map(option => ({ id: option.key, label: option.label, consequence: option.consequence })),
-      recommendation: entry.recommendation,
-      raisedAt: entry.raisedAt,
-      dueAt: entry.dueAt,
-      scqa: entry.scqa,
-      category: entry.category,
-      irreversible: isIrreversible(entry),
-      raisedBy: { agent: entry.raisedBy.agent, ...(entry.raisedBy.track ? { track: entry.raisedBy.track } : {}) },
-      alternative: entry.alternative,
-      dissent: entry.dissent,
-      crossCheck: entry.crossCheck,
-      crossCheckSkipped: entry.crossCheckSkipped,
-      pendingQuestion: entry.pendingQuestion,
-    }));
+    const decided = ledger.list({ status: 'decided' });
+    const decisions = ledger.list({ status: 'open' }).map(entry => {
+      const precedent = decided
+        .filter(other => other.id !== entry.id && other.category === entry.category && other.choice)
+        .sort((a, b) => (b.decidedAt ?? '').localeCompare(a.decidedAt ?? ''))[0];
+      return {
+        id: entry.id,
+        title: entry.title,
+        situation: entry.scqa.s.slice(0, 200),
+        options: entry.options.map(option => ({ id: option.key, label: option.label, consequence: option.consequence })),
+        recommendation: entry.recommendation,
+        raisedAt: entry.raisedAt,
+        dueAt: entry.dueAt,
+        scqa: entry.scqa,
+        category: entry.category,
+        irreversible: isIrreversible(entry),
+        raisedBy: { agent: entry.raisedBy.agent, ...(entry.raisedBy.track ? { track: entry.raisedBy.track } : {}) },
+        alternative: entry.alternative,
+        dissent: entry.dissent,
+        crossCheck: entry.crossCheck,
+        crossCheckSkipped: entry.crossCheckSkipped,
+        pendingQuestion: entry.pendingQuestion,
+        history: entry.history.map(event => ({
+          type: event.type,
+          ...(event.at ? { at: event.at } : {}),
+          by: event.by,
+          ...(event.choice ? { choice: event.choice } : {}),
+          ...(event.reason ? { reason: event.reason } : {}),
+        })),
+        precedent: precedent ? {
+          id: precedent.id,
+          title: precedent.title,
+          choice: precedent.options.find(option => option.key === precedent.choice)?.label ?? precedent.choice ?? '',
+          ...(precedent.decidedAt ? { decidedAt: precedent.decidedAt } : {}),
+          ...(precedent.decidedBy ? { decidedBy: precedent.decidedBy.kind } : {}),
+        } : null,
+      };
+    });
     debug.log('decisions.api', 'listed', { count: decisions.length });
     return jsonResponse({ decisions });
   }

package/src/nexus/api/graph-wizard-api.ts

@@ -1,5 +1,7 @@
 import { debug } from '../../debug/log.js';
-import { GraphWizardInputError, generateGraphFromPrompt, wizardInstalledPacks, type GraphWizardDeps, type GraphWizardTurn } from '../../graph-wizard/generate.js';
+import { GraphWizardInputError, designGraphVariantPlan, generateGraphFromPrompt, wizardInstalledPacks, type GraphWizardDeps, type GraphWizardTurn } from '../../graph-wizard/generate.js';
+import { defaultGraphsDir } from '../../self-implement/graph-templates.js';
+import { loadGraphTemplates } from '../../self-implement/graph-yaml.js';
 import { jsonResponse } from './json-response.js';
 
 export function handleGraphWizardPacksGet(deps: GraphWizardDeps = {}): Response {
@@ -10,7 +12,8 @@ const MAX_PROMPT = 4000;
 const MAX_YAML = 200_000;
 
 /**
- * POST /v1/graphs/wizard {prompt, kind?, currentYaml?, history?}
+ * POST /v1/graphs/wizard {prompt, kind?, currentYaml?, history?} or
+ * {mode:'variant', prompt, goal, templateId} for one validated L2 plan (no YAML generation).
  * → 200 {ok:true, id, yaml, base, baseReason, issues:[], attempts, summary, labels, steps, recipes, dryRun} · 422 {ok:false, …} · 400 빈 prompt.
  * (labels·steps·recipes·dryRun·baseReason 는 v2 추가 필드 — 기존 필드는 그대로.)
  * currentYaml 이 빈 문자열이면 «빈 캔버스»로 보고 새 그래프를 짓는다(의도) · 내용이 있는데 id 가 없거나 형식 밖이면 400.
@@ -26,6 +29,9 @@ export async function handleGraphWizardPost(req: Request, deps: GraphWizardDeps
   const prompt = typeof body.prompt === 'string' ? body.prompt.trim() : '';
   if (!prompt) return jsonResponse({ error: 'bad_request', reason: 'prompt required' }, 400);
   if (prompt.length > MAX_PROMPT) return jsonResponse({ error: 'bad_request', reason: `prompt longer than ${MAX_PROMPT}` }, 400);
+  if (body.mode !== undefined && body.mode !== 'variant') {
+    return jsonResponse({ error: 'bad_request', reason: 'mode must be variant when supplied' }, 400);
+  }
   if (body.kind !== undefined && body.kind !== 'harness' && body.kind !== 'workflow') {
     return jsonResponse({ error: 'bad_request', reason: 'kind must be harness or workflow' }, 400);
   }
@@ -44,6 +50,18 @@ export async function handleGraphWizardPost(req: Request, deps: GraphWizardDeps
     history = body.history as GraphWizardTurn[];
   }
   try {
+    if (body.mode === 'variant') {
+      if (typeof body.goal !== 'string' || !/^g_[a-z0-9_-]+$/i.test(body.goal) ||
+          typeof body.templateId !== 'string' || !/^[a-z0-9-]+$/.test(body.templateId) ||
+          body.kind === 'workflow' || body.currentYaml !== undefined || body.packId !== undefined || history !== undefined) {
+        return jsonResponse({ error: 'bad_request', reason: 'variant requires goal and templateId; YAML, workflow, pack and history are unsupported' }, 400);
+      }
+      // Resolve the base on the server. Client-supplied graph YAML never becomes variant authority.
+      const template = loadGraphTemplates(deps.graphsDir ?? defaultGraphsDir()).templates[body.templateId];
+      if (!template) return jsonResponse({ error: 'bad_request', reason: `unknown templateId: ${body.templateId}` }, 400);
+      const result = await designGraphVariantPlan({ goal: body.goal, prompt, template }, deps);
+      return jsonResponse({ mode: 'variant', ...result });
+    }
     const result = await generateGraphFromPrompt({
       prompt,
       ...(body.kind ? { kind: body.kind as 'harness' | 'workflow' } : {}),

package/src/nexus/api/loop-resources.ts

@@ -38,13 +38,25 @@ export function observeLoopResources(deps: {
   });
 }
 
+/** The waiting cell a seat is served: the single ID the Nexus API and the PWA resource screen agree on. */
+export function waitingCellId(cell: { id?: unknown } | null | undefined): string | null {
+  const id = cell?.id;
+  return typeof id === 'string' && id.trim() !== '' ? id : null;
+}
+
+/** A seat names a waiting cell only when that cell has a real ID; a blank ID is served as no cell. */
+export function withWaitingCellIds(resource: TrafficResult): TrafficResult {
+  return { ...resource, seats: resource.seats.map(row =>
+    row.nextCell && waitingCellId(row.nextCell) === null ? { ...row, nextCell: null } : row) };
+}
+
 /** The Nexus resource view reads the existing control ledger; it never allocates a second pool ledger. */
 export function handleLoopResourcesGet(
   observe: () => TrafficResult = observeLoopResources,
   listPodWorkers: () => ResourceView[] = () => new ResourceLedger(effectiveInstanceRoot()).list({ kind: 'pod-worker-lease' }),
 ): Response {
   try {
-    const resource = observe();
+    const resource = withWaitingCellIds(observe());
     try {
       const podWorkers = listPodWorkers().map(row => ({ id: row.id, machine: row.machine, workerId: row.name,
         key: row.attrs.key, state: row.attrs.state, generation: row.attrs.generation, ageMs: row.ageMs, expired: row.expired }));