elanous 0.2.35 → 0.2.37

package/src/maturity/feature-maturity.ts

@@ -62,7 +62,7 @@ export const FEATURE_MATURITY = {
     preview: 'beta', pty: 'beta', pr: 'beta', repo: 'beta', role: 'beta', machine: 'beta', image: 'beta', 'agent-env': 'beta',
     where: 'stable', bench: 'beta', shadow: 'beta', llm: 'beta', storage: 'beta', leader: 'beta',
     pod: 'beta', browser: 'beta', questions: 'beta', usage: 'stable', live: 'beta',
-    research: 'beta', release: 'beta', rfc: 'beta', know: 'beta', freeze: 'beta', flow: 'beta', seat: 'beta', hq: 'beta', steward: 'beta', coord: 'beta', context: 'beta', 'model-watch': 'beta', doctor: 'stable',
+    research: 'beta', release: 'beta', rfc: 'beta', know: 'beta', freeze: 'beta', herdr: 'beta', flow: 'beta', seat: 'beta', hq: 'beta', steward: 'beta', coord: 'beta', context: 'beta', 'model-watch': 'beta', doctor: 'stable',
     control: 'beta', resources: 'beta', hooks: 'beta', setup: 'stable', start: 'stable',
     grounding: 'beta', graph: 'beta', loop: 'stable', resource: 'beta', card: 'stable', 'launch-head': 'beta',
     a2a: 'beta', plugin: 'stable', make: 'beta', skills: 'beta', connect: 'beta', import: 'beta',

package/src/model-tier/llm-tier-map.ts

@@ -431,23 +431,17 @@ const OPENGATEWAY: TierMap = {
 };
 
 // ── AWS Bedrock (BEDROCK-PROVIDER · 2026-10-11) ───────────────────
-//   ⭐ 판단: ANTHROPIC 사다리의 «추론 수준·역할 배치»를 그대로 두고, 모델은 Bedrock 메시지 엔드포인트에서
-//   확인한 5.5 계열 id(`src/llm/bedrock.ts` BEDROCK_MODELS · 출처 platform.claude.com «Claude in Amazon Bedrock»
-//   Supported models)로만 채운다. 아래 칸(budget·balanced)은 ANTHROPIC 이 haiku-4-5·sonnet-5 를 쓰지만, 이 PR 이
-//   카탈로그에 올린 Bedrock id 는 5.5 셋뿐이라 같은 등급의 5.5(haiku-5-5·sonnet-5-5)로 올렸다.
 //   ⛔ bedrock 은 명시 선택 전용 — 이 표는 `--role-llm <role>=bedrock/<tier>` 같은 «명시» 해석에만 쓰인다.
-//   ⚠️ status = `wip`: 실 AWS 호출(계정별 5.5 접근 조건)을 아직 안 쟀고, 셋업 키 감지 표(PROVIDER_ENV_SPEC)에도
-//      없다(자격이 API 키가 아니라 AWS 체인이라). 첫 실호출 스모크 뒤 `shipping` 으로 올린다.
-//   ⭐ BEDROCK-RUNTIME-PATH(10-11): 메시지 엔드포인트(mantle)에 5.5 가 없어(📏 `GET /v1/models`) 사다리 id 를 전역 추론 프로필
-//      `global.anthropic.…`(runtime 경로 · bedrock.ts BEDROCK_MODELS 의 `route` 칸)로 옮겼다. 공급자 이름은 그대로 `bedrock`.
-//      📏 budget·balanced(haiku/sonnet 5.5)는 runtime 실호출 200 실측(ap-northeast-2) · opus 5.5 는 «추론 프로필 목록에 있음»까지만(호출 0).
-//      status 는 그대로 `wip` — `shipping` 은 셋업 키 감지 표(PROVIDER_ENV_SPEC) 칸을 요구한다(provider-wiring-contract 시험 · 범위 밖).
+//   ⚠️ status = `wip`: mantle-openai 모델의 실제 호출 가능성은 계정별 IAM 접근 조건을 따르며,
+//      셋업 키 감지 표(PROVIDER_ENV_SPEC)에도 없다(자격이 API 키가 아니라 AWS 체인이라).
+//   runtime Converse 모델(GLM 5.3·Kimi K3·Grok 4.7)은 OP/IAM 확인 뒤 별도 추가한다.
+//   ⛔ 아래 비-Anthropic id 들은 `src/llm/bedrock.ts` BEDROCK_MODELS 에 등록된 mantle-openai 행만 사용한다.
 const BEDROCK: TierMap = {
-  budget:   { model: 'global.anthropic.claude-haiku-5-5',  reasoningLevel: 'off',    label: 'Claude Haiku 5.5 (Bedrock)',  rationale: 'Fast · cheap · bulk/classification', status: 'wip' },
-  balanced: { model: 'global.anthropic.claude-sonnet-5-5', reasoningLevel: 'off',    label: 'Claude Sonnet 5.5 (Bedrock)', rationale: 'Default · everyday coding (BEDROCK_DEFAULT_MODEL)', status: 'wip' },
-  better:   { model: 'global.anthropic.claude-opus-5-5',   reasoningLevel: 'medium', label: 'Claude Opus 5.5 · thinking medium (Bedrock)', rationale: 'ANTHROPIC better 와 같은 배치(구현 = Opus 5.5)', status: 'wip' },
-  best:     { model: 'global.anthropic.claude-opus-5-5',   reasoningLevel: 'medium', label: 'Claude Opus 5.5 · thinking medium (Bedrock)', rationale: 'Best reasoning · architecture', status: 'wip' },
-  loaded:   { model: 'global.anthropic.claude-opus-5-5',   reasoningLevel: 'high',   label: 'Claude Opus 5.5 · extended thinking (Bedrock)', rationale: 'Loaded · deep multi-step', status: 'wip' },
+  budget:   { model: 'zai.glm-4.7-flash',         reasoningLevel: 'off',    label: 'GLM 4.7 Flash (Bedrock)', rationale: 'Fast · cheap · bulk/classification', status: 'wip' },
+  balanced: { model: 'openai.gpt-6-luna',         reasoningLevel: 'off',    label: 'GPT-6 Luna (Bedrock)', rationale: 'Default · balanced Bedrock mantle-openai model', status: 'wip' },
+  better:   { model: 'deepseek.v3.2',             reasoningLevel: 'medium', label: 'DeepSeek V3.2 (Bedrock)', rationale: 'Higher quality · mantle-openai', status: 'wip' },
+  best:     { model: 'zai.glm-5',                 reasoningLevel: 'medium', label: 'GLM 5 (Bedrock)', rationale: 'Best reasoning · mantle-openai', status: 'wip' },
+  loaded:   { model: 'openai.gpt-6-sol',          reasoningLevel: 'high',   label: 'GPT-6 Sol (Bedrock)', rationale: 'Loaded · deep multi-step · mantle-openai', status: 'wip' },
 };
 
 /** 가격·창 미측정이라 기존 tier 배치를 바꾸지 않고 명시 모델로만 고르는 칸.
@@ -523,8 +517,9 @@ export function lookupOpenRouterModelSpec(model: string): LlmTierSpec | undefine
  *  `auto` and unknown providers have no concrete provider ladder, so both use
  *  Anthropic's balanced default instead of crossing into the Codex family.
  *  Existing execution path: src/llm/model-defaults.ts tierModel() calls this
- *  function to fill the active provider's model at runtime. Explicit providers
- *  keep their own ladders; CLI catalog commands reject unknown/'auto' directly. */
+ *  function (`lookupLlmTierSpec(activeProviderForDefaults(provider), tier)`) to
+ *  fill the active provider's model at runtime. Explicit providers keep their
+ *  own ladders; CLI catalog commands reject unknown/'auto' directly. */
 export function lookupLlmTierSpec(
   provider: LLMProviderName,
   tier: ModelTier,

package/src/models/prompts.ts

@@ -189,7 +189,14 @@ export function getModelTier(
 
 /** Minimal tool-call hygiene for older GPT/o-series models. Kept
  *  short and generic so stronger providers do not get burdened with
- *  Codex-specific anti-loop rules they do not need. */
+ *  Codex-specific anti-loop rules they do not need.
+ *
+ *  TUI-OPS-TURN-GUARD gap ② (2026-10-22): rule 4 states the ops-turn
+ *  guard split — it must live here too, not only in the codex addon,
+ *  because gpt-6 ids stay in the 'gpt' family (usesCodexBehaviorGuards
+ *  widens the behavior predicate, not the family) and gpt-6 models run
+ *  those llm.ts phase guards. The tool names mirror the allow lists in
+ *  src/llm/tool-loop-steered-rejection.ts that llm.ts consumes. */
 const TOOL_DISCIPLINE_GPT = [
   '',
   '## Tool-call hygiene',
@@ -197,6 +204,7 @@ const TOOL_DISCIPLINE_GPT = [
   '1. NEVER call the same tool with identical arguments twice in a row. If you already Read a file, use its previous tool_result from history — do not re-Read.',
   '2. After each tool_result, emit AT LEAST one sentence of reasoning (what you learned, what you will do next) BEFORE issuing the next tool call. Silent tool-spam is a failure mode we actively block.',
   '3. If any tool_result contains "DUPLICATE CALL", "RUNTIME BLOCKED", "TOOL CALL REJECTED", or "SYSTEM BUDGET NOTICE" — STOP. Your next output MUST be plain text (the final answer or a clear "impossible because X"), not another tool call.',
+  '4. Ops turns (TUI-OPS-TURN-GUARD): read-only ops observation tools (`logs_query`, `PtyShellPoll`) stay runnable mid-ops-turn — keep observing the run with them. Write-capable ops tools (`schedule_manage`, `se_build`) are phase-governed: when one returns "TOOL CALL REJECTED" it is out of phase for this turn — do not retry it; rule 3 applies (finish in plain text).',
   '',
 ].join('\n');
 
@@ -204,7 +212,13 @@ const TOOL_DISCIPLINE_GPT = [
  *  Their common failure mode is read-only polling on stable state
  *  (Read / GetDashboardState / similar) instead of acting on the
  *  result they already have. Keep this focused on tool-loop hygiene,
- *  not orchestration prose. */
+ *  not orchestration prose.
+ *
+ *  TUI-OPS-TURN-GUARD gap ② (2026-10-22): rule 5 states the ops-turn
+ *  guard split so the prompt half matches the ACTION_PHASE_OPS_TOOLS /
+ *  REPAIR_PHASE_READ_ONLY_OPS_TOOLS allow lists llm.ts consumes —
+ *  read-only ops observation stays runnable mid-ops-turn, write-capable
+ *  ops tools stay phase-governed. */
 const TOOL_DISCIPLINE_CODEX = [
   '',
   '## Tool-call hygiene',
@@ -213,6 +227,7 @@ const TOOL_DISCIPLINE_CODEX = [
   '2. Treat read-only state tools as stable within the current turn. Do NOT re-call a state-inspection tool unless an intervening action could have changed the state.',
   '3. After each tool_result, emit AT LEAST one sentence of reasoning (what you learned, what you will do next) BEFORE issuing the next tool call.',
   '4. If any tool_result contains "DUPLICATE CALL", "RUNTIME BLOCKED", "TOOL CALL REJECTED", or "SYSTEM BUDGET NOTICE" — STOP. Your next output MUST be plain text, not another tool call.',
+  '5. Ops turns (TUI-OPS-TURN-GUARD): read-only ops observation tools (`logs_query`, `PtyShellPoll`) stay runnable mid-ops-turn — keep observing the run with them. Write-capable ops tools (`schedule_manage`, `se_build`) are phase-governed: when one returns "TOOL CALL REJECTED" it is out of phase for this turn — do not retry it; rule 4 applies (finish in plain text).',
   '',
 ].join('\n');
 

package/src/msg/msg-post-office.ts

@@ -0,0 +1,116 @@
+// ── 우편국(post office) 발견 ⊕ 재시작 — `msg serve --sse` 가 자기 포트를 적고, `msg post` 가 죽은 것을 다시 띄운다 ──
+//
+// 왜 «발견 파일» 인가: `eln msg serve --sse` 는 원장을 빨리 밀어 주는 별도 프로세스이고 설치본을 갈아 끼우면
+// 그 프로세스는 조용히 사라진다. `watch --sse` 는 폴링으로 돌아가므로 «동작은 하지만» 구독자는 늦어진다.
+// 서비스가 자기 포트·pid 를 `<상태 루트>/msg/sse.json` 에 적으면, 글을 저장한 «뒤» post 경로가
+// 그 줄을 읽어 «응답하지 않는 우편국» 을 같은 포트로 한 번 다시 띄울 수 있다.
+//
+// ⛔ 원장이 정본이다 — 다시 띄운 서비스는 저장된 글을 처음부터(=`since`·`Last-Event-ID`) 재생하므로
+//    서비스가 죽어 있던 동안 저장된 글도 잃지 않는다.
+// ⛔ 재시작은 글의 성패를 바꾸지 않는다 — 어떤 실패도 결과 값으로만 돌아온다(fail-open).
+// ⛔ 시험 우주에서는 실제 프로세스를 띄우지 않는다 — `ELANOUS_MSG_SSE_LIVE=1` 로만 연다(격리 실물 시험용).
+
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+import { effectiveInstanceRoot, prodInstanceRoot } from '../instance/resolve.js';
+
+export interface PostOfficeInfo {
+  /** Loopback port the SSE service answers on. */
+  port: number;
+  /** Process that wrote the line; a dead pid means the service is gone. */
+  pid: number;
+  url: string;
+}
+
+export type PostOfficeEnsure =
+  | { state: 'absent' }
+  | { state: 'skipped'; reason: string }
+  | { state: 'listening'; port: number }
+  | { state: 'restarted'; port: number };
+
+/** `<상태 루트>/msg/sse.json` — the ledger directory `msg serve` and `msg post` already share. */
+export function postOfficeFile(stateRoot: string): string {
+  return join(stateRoot, 'msg', 'sse.json');
+}
+
+/** The recorded service, or null when nothing registered one — 파일이 없으면 «모름»이지 «서비스 없음»의 측정이 아니다. */
+export function readPostOffice(stateRoot: string): PostOfficeInfo | null {
+  let raw: unknown;
+  try { raw = JSON.parse(readFileSync(postOfficeFile(stateRoot), 'utf8')); }
+  catch { return null; }
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null;
+  const { port, pid } = raw as { port?: unknown; pid?: unknown };
+  if (typeof port !== 'number' || !Number.isSafeInteger(port) || port < 0 || port > 65535) return null;
+  if (typeof pid !== 'number' || !Number.isSafeInteger(pid) || pid <= 0) return null;
+  return { port, pid, url: `http://127.0.0.1:${port}` };
+}
+
+/** Called by `msg serve --sse` right after the service binds its port. */
+export function writePostOffice(stateRoot: string, info: { port: number; pid?: number }): PostOfficeInfo {
+  const path = postOfficeFile(stateRoot);
+  mkdirSync(dirname(path), { recursive: true });
+  const value: PostOfficeInfo = { port: info.port, pid: info.pid ?? process.pid, url: `http://127.0.0.1:${info.port}` };
+  writeFileSync(path, `${JSON.stringify(value)}\n`);
+  return value;
+}
+
+/** Called when the service stops — only the writer's own line is removed, never a newer one. */
+export function clearPostOffice(stateRoot: string, pid: number = process.pid): boolean {
+  const current = readPostOffice(stateRoot);
+  if (current !== null && current.pid !== pid) return false;
+  try { rmSync(postOfficeFile(stateRoot), { force: true }); return true; }
+  catch { return false; }
+}
+
+function pidAlive(pid: number): boolean {
+  try { process.kill(pid, 0); return true; } catch { return false; }
+}
+
+/** Any HTTP answer (401 included) means the service is listening; silence means it is gone. */
+async function probePostOffice(url: string): Promise<boolean> {
+  try {
+    const response = await fetch(`${url}/stream`, { signal: AbortSignal.timeout(500) });
+    try { await response.body?.cancel(); } catch { /* body already closed */ }
+    return true;
+  } catch { return false; }
+}
+
+function liveUniverse(): boolean {
+  return effectiveInstanceRoot() === prodInstanceRoot() || process.env.ELANOUS_MSG_SSE_LIVE === '1';
+}
+
+/** Restart the same installed CLI entry that is running this command — `eln msg serve --sse --port <p>`. */
+function spawnPostOffice({ port }: { port: number }): void {
+  const entry = process.argv[1];
+  if (!entry) throw new Error('post office restart needs the running CLI entry (process.argv[1])');
+  const child = Bun.spawn([process.execPath, entry, 'msg', 'serve', '--sse', '--port', String(port)], {
+    detached: true, stdio: ['ignore', 'ignore', 'ignore'], env: process.env,
+  });
+  (child as unknown as { unref?: () => void }).unref?.();
+}
+
+export interface EnsurePostOfficeInput {
+  /** State root that holds `msg/sse.json`. */
+  stateRoot: string;
+  /** Test seam — liveness of the recorded pid (default: signal 0). */
+  alive?: (pid: number) => boolean;
+  /** Test seam — does the recorded service answer on its port? (default: one HTTP probe). */
+  probe?: (url: string) => Promise<boolean>;
+  /** Test seam / fake-bin — start a new service on the recorded port. */
+  launch?: (input: { port: number }) => void;
+}
+
+/**
+ * Restart a registered post office that no longer answers. Absent registration and a live service are no-ops,
+ * so a plain `msg post` keeps its current behavior.
+ */
+export async function ensurePostOffice(input: EnsurePostOfficeInput): Promise<PostOfficeEnsure> {
+  const info = readPostOffice(input.stateRoot);
+  if (info === null) return { state: 'absent' };
+  const alive = (input.alive ?? pidAlive)(info.pid);
+  if (alive && await (input.probe ?? probePostOffice)(info.url)) return { state: 'listening', port: info.port };
+  if (input.launch === undefined && !liveUniverse()) return { state: 'skipped', reason: 'test-universe' };
+  (input.launch ?? spawnPostOffice)({ port: info.port });
+  return { state: 'restarted', port: info.port };
+}

package/src/msg/msg-store.ts

@@ -278,6 +278,23 @@ export class MsgStore {
       : []);
   }
 
+  /** A request and its direct replies, in insertion order, independent of recipient cursors. */
+  listThread(messageId: number, after: number = 0, limit: number = 100): Message[] {
+    if (!Number.isSafeInteger(messageId) || messageId < 1) throw new Error('message ID must be a positive integer');
+    validCursor(after);
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000) throw new Error('limit must be between 1 and 1000');
+    return this.readWithSchema(hasReplyTo => {
+      const target = this.db.query(`SELECT id, ${hasReplyTo ? 'reply_to' : 'NULL AS reply_to'} FROM msg_messages WHERE id = ?`)
+        .get(messageId) as { id: number; reply_to: number | null } | null;
+      if (target === null) throw new Error(`message not found: #${messageId}`);
+      const rootId = target.reply_to ?? target.id;
+      const rows = this.db.query(`SELECT id, sender, recipient, body, kind, ${hasReplyTo ? 'reply_to' : 'NULL AS reply_to'}, created_at FROM msg_messages
+        WHERE id > ? AND (id = ? ${hasReplyTo ? 'OR reply_to = ?' : ''}) ORDER BY id ASC LIMIT ?`)
+        .all(...(hasReplyTo ? [after, rootId, rootId, limit] : [after, rootId, limit])) as MessageRow[];
+      return rows.map(fromRow);
+    });
+  }
+
   list(recipient: string, after: number = 0, limit: number = 100): Message[] {
     return this.listByRecipient(recipient, after, limit);
   }

package/src/mss/logging/log-store.ts

@@ -30,6 +30,7 @@ import type { LogSink } from './sink.js';
 import { setInstanceName, resolveInstanceName } from '../../instance-identity.js';
 import * as nestDepth from '../../agent/nest-depth.js';
 import { debug } from '../../debug/log.js';
+import { DebugLogBatchQueue, defaultDebugBatchScheduler, type DebugBatchScheduler } from '../../debug/batch-queue.js';
 import { assertNotTestWritingOps } from '../../instance/test-write-guard.js';
 
 /** 스토어 경로 — `ELANOUS_STATE_DIR` 존중(격리 테스트/`nexus run --test` 의
@@ -822,6 +823,21 @@ export interface StoreSinkOpts {
   /** Register beforeExit / SIGINT / SIGTERM flush hooks lazily on first
    *  emit. Default true; tests/isolated fixtures can pass false. */
   installExitHandlers?: boolean;
+  /** TUI-TYPING-LAG — 임계 뒤 detach drain 이 한 틱에 넣는 최대 행 수. 기본 = `Infinity`(옛 동작 ·
+   *  한 틱에 전부 — CLI 는 그대로). TUI 는 `TUI_LOG_STORE_DRAIN_CHUNK_ROWS` 로 켠다: 남은 행은 «다음»
+   *  틱으로 넘겨 그 사이 stdin(키)이 배달된다. */
+  drainChunkSize?: number;
+  /** 시계 seam — 기본 setImmediate/setTimeout(unref). ux-sim 무대가 가짜 시계를 꽂는다. */
+  scheduler?: DebugBatchScheduler;
+}
+
+/** TUI-TYPING-LAG — TUI 프로세스의 StoreSink 가 한 틱에 넣는 최대 행 수(키 하나가 기다리는 상한). */
+export const TUI_LOG_STORE_DRAIN_CHUNK_ROWS = 64;
+
+/** 어느 surface 의 StoreSink 가 덩어리 drain 을 쓰나 — 키 입력을 받는 TUI 만. CLI·데몬은 옛 동작
+ *  (한 틱에 전부 · SQLITE_BUSY 때 막힘이 한 번으로 끝난다)을 그대로 둔다. */
+export function logStoreDrainChunkForSurface(surface: string): number | undefined {
+  return surface === 'tui' ? TUI_LOG_STORE_DRAIN_CHUNK_ROWS : undefined;
 }
 
 /** StoreSink가 버린 레코드의 누적 관측값. 스토어에 쓰지 않아 자기참조하지 않는다. */
@@ -833,8 +849,11 @@ export interface StoreSinkDropCounts {
 
 export class StoreSink implements LogSink {
   readonly name = 'store';
-  private buf: Array<{ rec: LogRecord; surface: string }> = [];
-  private timer: ReturnType<typeof setTimeout> | null = null;
+  private readonly queue: DebugLogBatchQueue<{ rec: LogRecord; surface: string }>;
+  private timer: unknown = null;
+  private hasTimer = false;
+  /** 덩어리 insert 가 실패한 뒤 다음 성공까지 — 임계를 넘어도 덩어리 틱을 다시 걸지 않는다(주기 flush 만). */
+  private chunkingPaused = false;
   private exitHandlersInstalled = false;
   private onBeforeExit: (() => void) | null = null;
   private onSigInt: (() => void) | null = null;
@@ -843,6 +862,9 @@ export class StoreSink implements LogSink {
   private readonly flushBatchSize: number;
   private readonly bufferCap: number;
   private readonly installExit: boolean;
+  private readonly scheduler: DebugBatchScheduler;
+  /** 덩어리 drain 한 틱의 최대 행 수(`Infinity` = 옛 동작 · 한 틱에 전부). 등록 배선을 시험이 잠그는 관측 칸. */
+  readonly drainChunkSize: number;
   private readonly dropCounts: StoreSinkDropCounts = { total: 0, flushFailure: 0, bufferCap: 0 };
 
   constructor(
@@ -854,49 +876,79 @@ export class StoreSink implements LogSink {
     this.flushBatchSize = opts.flushBatchSize ?? 64;
     this.bufferCap = opts.bufferCap ?? 2048;
     this.installExit = opts.installExitHandlers ?? true;
+    this.scheduler = opts.scheduler ?? defaultDebugBatchScheduler;
+    this.drainChunkSize = opts.drainChunkSize ?? Number.POSITIVE_INFINITY;
+    this.queue = new DebugLogBatchQueue({
+      batchSize: this.drainChunkSize,
+      flushDelayMs: 0,
+      scheduler: this.scheduler,
+      drain: (batch) => this.insert(batch),
+    });
   }
 
   emit(rec: LogRecord): void {
     // 자기참조 가드 — 로그 평면 자신의 이벤트는 스토어 재진입 금지.
     if (rec.category.startsWith('logs.')) return;
-    this.buf.push({ rec, surface: this.surface });
-    if (this.buf.length > this.bufferCap) {
-      const dropped = this.buf.length - this.bufferCap;
-      this.buf.splice(0, dropped);
-      this.recordDrop('bufferCap', dropped);
+    this.queue.push({ rec, surface: this.surface });
+    if (this.queue.pending > this.bufferCap) {
+      this.recordDrop('bufferCap', this.queue.dropOldest(this.queue.pending - this.bufferCap));
     }
     if (this.installExit) this.installExitHandlersOnce();
-    if (this.buf.length >= this.flushBatchSize) {
-      // 핫 틱 비블록 — insert 는 다음 매크로태스크로(FileSink detach 동형).
-      if (this.timer) { clearTimeout(this.timer); this.timer = null; }
-      setImmediate(() => this.flush());
+    if (this.queue.pending >= this.flushBatchSize && !this.chunkingPaused) {
+      // 핫 틱 비블록 — insert 는 다음 매크로태스크로, 그것도 «덩어리 하나씩»(TUI-TYPING-LAG).
+      this.cancelTimer();
+      this.queue.schedule();
       return;
     }
-    if (this.timer === null) {
-      this.timer = setTimeout(() => this.flush(), this.flushIntervalMs);
-      (this.timer as unknown as { unref?: () => void }).unref?.();
-    }
+    if (!this.queue.scheduled) this.armIntervalFlush();
   }
 
   flush(): void {
-    if (this.timer) { clearTimeout(this.timer); this.timer = null; }
-    if (this.buf.length === 0) return;
-    const batch = this.buf;
-    this.buf = [];
+    this.cancelTimer();
+    this.queue.flushAll();
+  }
+
+  private cancelTimer(): void {
+    if (!this.hasTimer) return;
+    this.scheduler.cancel(this.timer);
+    this.timer = null;
+    this.hasTimer = false;
+  }
+
+  private insert(batch: Array<{ rec: LogRecord; surface: string }>): boolean {
     try {
       // insertBatch retries SQLITE_BUSY batches on the next write; this sink remains fail-soft on final failure.
       this.store.insertBatch(batch);
+      this.chunkingPaused = false;
+      return true;
     } catch {
       /* fail-soft — 파일 트레일이 진실원. 배치는 버린다(재시도 루프 금지 —
          디스크 장애 시 무한 적체 방지). */
       this.recordDrop('flushFailure', batch.length);
+      // 덩어리 drain 중 실패(예: SQLITE_BUSY 는 busy_timeout 만큼 막는다)면 남은 덩어리를 틱마다 또
+      // 막게 두지 않는다 — 잘게 쪼개기를 멈추고(다음 성공까지 · 새 emit 도 덩어리 틱을 다시 걸지 않는다)
+      // 나머지는 다음 주기 flush 한 번으로 넘긴다.
+      this.chunkingPaused = true;
+      this.queue.cancelScheduled();
+      this.armIntervalFlush();
+      return false;
     }
   }
 
+  private armIntervalFlush(): void {
+    if (this.hasTimer) return;
+    this.hasTimer = true;
+    this.timer = this.scheduler.schedule(() => {
+      this.timer = null;
+      this.hasTimer = false;
+      this.flush();
+    }, this.flushIntervalMs);
+  }
+
   /** 누적 유실 관측값의 복사본. 로그 스토어에 쓰지 않아 자기참조하지 않는다. */
   get dropped(): StoreSinkDropCounts { return { ...this.dropCounts }; }
 
-  get pending(): number { return this.buf.length; }
+  get pending(): number { return this.queue.pending; }
 
   /** Flush the buffer and drop only this sink's exit/signal listeners. */
   close(): void {
@@ -1313,11 +1365,16 @@ export function registerLogStoreSink(
   registerSink: (sink: LogSink) => () => void,
   surface: string,
   retention: LogStoreRetention = LOG_RETENTION_DEFAULTS,
-  opts: { retentionOwner?: boolean } = {},
+  opts: { retentionOwner?: boolean; drainChunkSize?: number } = {},
 ): (() => void) | null {
   const store = getDefaultLogStore();
   if (!store) return null;
-  const sink = new StoreSink(store, surface, { installExitHandlers: true });
+  // 덩어리 크기 기본값은 surface 로 여기서 정한다 — 어느 등록 경로(standalone·nexus·직접 호출)든 TUI 면 덩어리 drain.
+  const drainChunkSize = opts.drainChunkSize ?? logStoreDrainChunkForSurface(surface);
+  const sink = new StoreSink(store, surface, {
+    installExitHandlers: true,
+    ...(drainChunkSize !== undefined ? { drainChunkSize } : {}),
+  });
   const off = registerSink(sink);
   try { nestDepth.observeNestAtBoot(); } catch { /* fail-soft — 관측 실패가 싱크 등록을 막지 않는다. */ }
   const owner = opts.retentionOwner ?? surface === 'nexus';

package/src/native-tool-catalog.ts

@@ -7,7 +7,7 @@
 
 import type { VerifierSpec } from './verifier/types.js';
 import type { GuardianSpec } from './guardian/types.js';
-import { ptyAvailable } from './pty-shell/registry.js';
+import { ptyAvailable } from './pty-shell/availability.js';
 import { krFlowAvailable } from './skills/tools/kr-flow.js';
 import { SELF_COGNITION_MCP_CATALOG_ENTRIES } from './tool-runtime/self-cognition-catalog.js';
 import { SKILLS_LIST_DESCRIPTION } from './onboarding/entry-hints.js';

package/src/nexus/api/decisions-route.ts

@@ -24,24 +24,44 @@ export async function handleDecisions(req: Request, deps: DecisionsRouteDeps = {
       debug.log('decisions.api', 'rejected', { reason: 'invalid-status' });
       return jsonResponse({ error: 'bad_request' }, 400);
     }
-    const decisions = ledger.list({ status: 'open' }).map(entry => ({
-      id: entry.id,
-      title: entry.title,
-      situation: entry.scqa.s.slice(0, 200),
-      options: entry.options.map(option => ({ id: option.key, label: option.label, consequence: option.consequence })),
-      recommendation: entry.recommendation,
-      raisedAt: entry.raisedAt,
-      dueAt: entry.dueAt,
-      scqa: entry.scqa,
-      category: entry.category,
-      irreversible: isIrreversible(entry),
-      raisedBy: { agent: entry.raisedBy.agent, ...(entry.raisedBy.track ? { track: entry.raisedBy.track } : {}) },
-      alternative: entry.alternative,
-      dissent: entry.dissent,
-      crossCheck: entry.crossCheck,
-      crossCheckSkipped: entry.crossCheckSkipped,
-      pendingQuestion: entry.pendingQuestion,
-    }));
+    const decided = ledger.list({ status: 'decided' });
+    const decisions = ledger.list({ status: 'open' }).map(entry => {
+      const precedent = decided
+        .filter(other => other.id !== entry.id && other.category === entry.category && other.choice)
+        .sort((a, b) => (b.decidedAt ?? '').localeCompare(a.decidedAt ?? ''))[0];
+      return {
+        id: entry.id,
+        title: entry.title,
+        situation: entry.scqa.s.slice(0, 200),
+        options: entry.options.map(option => ({ id: option.key, label: option.label, consequence: option.consequence })),
+        recommendation: entry.recommendation,
+        raisedAt: entry.raisedAt,
+        dueAt: entry.dueAt,
+        scqa: entry.scqa,
+        category: entry.category,
+        irreversible: isIrreversible(entry),
+        raisedBy: { agent: entry.raisedBy.agent, ...(entry.raisedBy.track ? { track: entry.raisedBy.track } : {}) },
+        alternative: entry.alternative,
+        dissent: entry.dissent,
+        crossCheck: entry.crossCheck,
+        crossCheckSkipped: entry.crossCheckSkipped,
+        pendingQuestion: entry.pendingQuestion,
+        history: entry.history.map(event => ({
+          type: event.type,
+          ...(event.at ? { at: event.at } : {}),
+          by: event.by,
+          ...(event.choice ? { choice: event.choice } : {}),
+          ...(event.reason ? { reason: event.reason } : {}),
+        })),
+        precedent: precedent ? {
+          id: precedent.id,
+          title: precedent.title,
+          choice: precedent.options.find(option => option.key === precedent.choice)?.label ?? precedent.choice ?? '',
+          ...(precedent.decidedAt ? { decidedAt: precedent.decidedAt } : {}),
+          ...(precedent.decidedBy ? { decidedBy: precedent.decidedBy.kind } : {}),
+        } : null,
+      };
+    });
     debug.log('decisions.api', 'listed', { count: decisions.length });
     return jsonResponse({ decisions });
   }

package/src/nexus/api/graph-wizard-api.ts

@@ -1,5 +1,8 @@
 import { debug } from '../../debug/log.js';
-import { GraphWizardInputError, generateGraphFromPrompt, wizardInstalledPacks, type GraphWizardDeps, type GraphWizardTurn } from '../../graph-wizard/generate.js';
+import { GraphWizardInputError, designGraphVariantPlan, generateGraphFromPrompt, wizardInstalledPacks, type GraphWizardDeps, type GraphWizardTurn } from '../../graph-wizard/generate.js';
+import { defaultGraphsDir } from '../../self-implement/graph-templates.js';
+import { loadGraphTemplates } from '../../self-implement/graph-yaml.js';
+import type { NexusEventBus } from './event-bus.js';
 import { jsonResponse } from './json-response.js';
 
 export function handleGraphWizardPacksGet(deps: GraphWizardDeps = {}): Response {
@@ -9,14 +12,38 @@ export function handleGraphWizardPacksGet(deps: GraphWizardDeps = {}): Response
 const MAX_PROMPT = 4000;
 const MAX_YAML = 200_000;
 
+/** 호출 경계에서 variant 한 턴의 결말을 버스에 남긴다 — mode·reason ⊕ 조작 growth 좌표. */
+function publishGraphCompose(eventBus: NexusEventBus | undefined, input: {
+  readonly result: Awaited<ReturnType<typeof designGraphVariantPlan>>;
+  readonly goal: string;
+  readonly templateId: string;
+}): void {
+  const { result, goal, templateId } = input;
+  eventBus?.publish({
+    ts: Date.now(),
+    kind: 'graph.compose',
+    detail: {
+      mode: result.mode,
+      status: result.status,
+      reason: result.reason,
+      goal,
+      templateId,
+      ...(result.growth ? { growth: result.growth } : {}),
+      ...(result.status === 'composed' ? { overlayId: result.variant.overlay.overlayId, patches: result.variant.patches.length } : {}),
+    },
+  });
+}
+
 /**
- * POST /v1/graphs/wizard {prompt, kind?, currentYaml?, history?}
+ * POST /v1/graphs/wizard {prompt, kind?, currentYaml?, history?} or
+ * {mode:'variant', prompt, goal, templateId} for one validated L2 plan (no YAML generation).
  * → 200 {ok:true, id, yaml, base, baseReason, issues:[], attempts, summary, labels, steps, recipes, dryRun} · 422 {ok:false, …} · 400 빈 prompt.
  * (labels·steps·recipes·dryRun·baseReason 는 v2 추가 필드 — 기존 필드는 그대로.)
  * currentYaml 이 빈 문자열이면 «빈 캔버스»로 보고 새 그래프를 짓는다(의도) · 내용이 있는데 id 가 없거나 형식 밖이면 400.
  * 저장하지 않는다 — 저장은 POST /v1/graphs(새 그래프) 또는 PUT /v1/graphs/<id>/yaml(내 그래프).
+ * variant 요청은 결말(mode·reason·조작 growth)을 주입된 버스에 `graph.compose` 이벤트로 남긴다.
  */
-export async function handleGraphWizardPost(req: Request, deps: GraphWizardDeps = {}): Promise<Response> {
+export async function handleGraphWizardPost(req: Request, deps: GraphWizardDeps = {}, eventBus?: NexusEventBus): Promise<Response> {
   let body: Record<string, unknown>;
   try {
     const parsed: unknown = await req.json();
@@ -26,6 +53,9 @@ export async function handleGraphWizardPost(req: Request, deps: GraphWizardDeps
   const prompt = typeof body.prompt === 'string' ? body.prompt.trim() : '';
   if (!prompt) return jsonResponse({ error: 'bad_request', reason: 'prompt required' }, 400);
   if (prompt.length > MAX_PROMPT) return jsonResponse({ error: 'bad_request', reason: `prompt longer than ${MAX_PROMPT}` }, 400);
+  if (body.mode !== undefined && body.mode !== 'variant') {
+    return jsonResponse({ error: 'bad_request', reason: 'mode must be variant when supplied' }, 400);
+  }
   if (body.kind !== undefined && body.kind !== 'harness' && body.kind !== 'workflow') {
     return jsonResponse({ error: 'bad_request', reason: 'kind must be harness or workflow' }, 400);
   }
@@ -44,6 +74,19 @@ export async function handleGraphWizardPost(req: Request, deps: GraphWizardDeps
     history = body.history as GraphWizardTurn[];
   }
   try {
+    if (body.mode === 'variant') {
+      if (typeof body.goal !== 'string' || !/^g_[a-z0-9_-]+$/i.test(body.goal) ||
+          typeof body.templateId !== 'string' || !/^[a-z0-9-]+$/.test(body.templateId) ||
+          body.kind === 'workflow' || body.currentYaml !== undefined || body.packId !== undefined || history !== undefined) {
+        return jsonResponse({ error: 'bad_request', reason: 'variant requires goal and templateId; YAML, workflow, pack and history are unsupported' }, 400);
+      }
+      // Resolve the base on the server. Client-supplied graph YAML never becomes variant authority.
+      const template = loadGraphTemplates(deps.graphsDir ?? defaultGraphsDir()).templates[body.templateId];
+      if (!template) return jsonResponse({ error: 'bad_request', reason: `unknown templateId: ${body.templateId}` }, 400);
+      const result = await designGraphVariantPlan({ goal: body.goal, prompt, template }, deps);
+      publishGraphCompose(eventBus, { result, goal: body.goal, templateId: body.templateId });
+      return jsonResponse(result);
+    }
     const result = await generateGraphFromPrompt({
       prompt,
       ...(body.kind ? { kind: body.kind as 'harness' | 'workflow' } : {}),

package/src/nexus/api/grid.ts

@@ -1,13 +1,17 @@
 import { getUserConfig } from '../../user-config.js';
 import { readHqLease, type HqDeps } from '../../hq/hq.js';
-import { measurePoolLease, type PoolLeaseMeasure } from '../../task-orchestrator/surfaces/pod-lease.js';
+import { measurePoolLease, type PoolLeaseMeasure, type PodLeaseMember } from '../../task-orchestrator/surfaces/pod-lease.js';
 import { parsePodPool, resolvePodPoolSpec, type PodPoolMember, type PoolKubectl } from '../../task-orchestrator/surfaces/pod-pool.js';
+import type { GateReservation } from '../../ops/overview.js';
 
 export interface GridData {
   /** null means the arbiter could not be read, not that no lease exists. */
   hq: { record: ReturnType<typeof readHqLease>['record']; ageSeconds: number | null; expired: boolean | null; reason: string | null };
-  /** Configured member order; capacity comes from measurePoolLease when available. occupied is running + pending, or null on measurement failure. */
-  members: Array<{ context: string; capacity: number; running: number | null; pending: number | null; occupied: number | null; reason: string | null }>;
+  /**
+   * Configured member order; capacity comes from measurePoolLease when available. occupied is running + pending, or null on measurement failure.
+   * `gate` is GATE-RESERVE-AUTO's reservation for this member — absent when the job/cpu reading failed (unmeasured, not «no gate»).
+   */
+  members: Array<{ context: string; capacity: number; running: number | null; pending: number | null; occupied: number | null; reason: string | null; gate?: GateReservation }>;
   poolReason: string | null;
 }
 
@@ -20,6 +24,21 @@ export interface GridDeps {
   measure?: (members: readonly PodPoolMember[]) => PoolLeaseMeasure;
 }
 
+/**
+ * GATE-RESERVE-AUTO 의 예약 몫을 자원 지도 축 꼴로 옮긴다. Job/CPU 읽기가 실패한 멤버는 undefined 다 —
+ * «게이트 없음»이 아니라 «못 잼»이므로 구속 조건 후보에서 빠진다(0 으로도 무한으로도 읽지 않는다).
+ * 게이트가 안 도는 멤버(jobs 0)는 값으로 남는다: 축은 «게이트 없음»이라고 말할 수 있어야 한다.
+ */
+function gateOf(row: PodLeaseMember | undefined): GateReservation | undefined {
+  if (!row || typeof row.gateJobs !== 'number') return undefined;
+  return {
+    jobs: row.gateJobs,
+    unbound: typeof row.gateUnboundJobs === 'number' ? row.gateUnboundJobs : Number.NaN,
+    reservedMillicores: typeof row.gateCpuMillicores === 'number' ? row.gateCpuMillicores : Number.NaN,
+    schedulableMillicores: typeof row.schedulableCpuMillicores === 'number' ? row.schedulableCpuMillicores : Number.NaN,
+  };
+}
+
 /** Independent, fail-soft read snapshots. No lease status/heartbeat, DNS probe Pod, host reservation or writes. */
 export function buildGridData(deps: GridDeps = {}): GridData {
   let hq: GridData['hq'];
@@ -45,9 +64,10 @@ export function buildGridData(deps: GridDeps = {}): GridData {
           const row = byContext.get(member.context);
           const running = row?.running ?? null;
           const pending = row?.pending ?? null;
+          const gate = gateOf(row);
           return { context: member.context, capacity: row?.capacity ?? member.capacity, running, pending,
             occupied: running === null || pending === null ? null : running + pending,
-            reason: row?.reason ?? (row ? null : '측정 불가') };
+            reason: row?.reason ?? (row ? null : '측정 불가'), ...(gate ? { gate } : {}) };
         });
       } catch (error) {
         poolReason = String(error);