elanous 0.2.35 → 0.2.37

package/src/skills/tools/schedule-wakeup.ts

@@ -33,6 +33,11 @@ export const WAKEUP_MIN_DELAY_MS = 60_000;
 export const WAKEUP_MAX_ENTRIES = 5;
 export const WAKEUP_REPEAT_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 export const WAKEUP_RETRY_DELAY_MS = 60_000;
+/** 바쁨(NotIdle)·사람 입력 중(HumanTyping)으로 못 연 깨움을 «버리지 않고» 미루는 상한 — 첫 예정 시각부터.
+ *  TUI-WAKEUP-DEFER-NOT-DROP(10-22 OPT w7: 02:38·02:39 NotIdle → dropped · codex 는 idle 때 골을 이어가고 바쁘면 미룬다). */
+export const WAKEUP_DEFER_MAX_MS = 30 * 60_000;
+/** 미룸 대상인 거부 이유 — 곧 풀리는 «지금 바쁨» 뿐이다(Disabled·Cap·Superseded 는 미뤄도 안 풀린다). */
+const WAKEUP_DEFERRABLE_REASONS: ReadonlySet<string> = new Set(['NotIdle', 'HumanTyping']);
 /** 일회성 지연의 상한 — 반복 TTL 과 같은 7일(그보다 먼 일은 cron `schedule_manage` 몫). */
 export const WAKEUP_MAX_DELAY_MS = WAKEUP_REPEAT_TTL_MS;
 /** 한 턴 안 schedule·cancel 호출 합계 상한 — 넘으면 «다음 턴에» 로 거부(예약·취소 고리 차단). */
@@ -260,18 +265,32 @@ export function createWakeupScheduler(deps: WakeupSchedulerDeps): WakeupSchedule
     log('tui.wakeup', 'rejected', {
       id, reason: result.reason, ...(result.detail ? { detail: result.detail } : {}), retried: entry.retried,
     });
-    if (!entry.retried) {
-      // 바쁨·사람 입력 중 — 1분 뒤 한 번만 다시 청한다(같은 회차).
+    const deferrable = WAKEUP_DEFERRABLE_REASONS.has(result.reason);
+    if (deferrable) {
+      // 바쁨·사람 입력 중 — 버리지 않고 1분마다 다시 청한다(같은 회차). 상한 = 첫 예정 시각 + WAKEUP_DEFER_MAX_MS,
+      // 반복이면 다음 회차 시각도 상한(그 회차가 이 깨움을 대신한다).
+      const nextTry = t + WAKEUP_RETRY_DELAY_MS;
+      // 상한 시각의 시도까지는 한다(<=) · 반복은 다음 회차 시각과 겹치면 그 회차에 넘긴다(<).
+      const withinDeferCap = nextTry <= entry.dueAt + WAKEUP_DEFER_MAX_MS;
+      const beforeNextTick = !entry.repeatMs || nextTry < entry.dueAt + entry.repeatMs;
+      if (withinDeferCap && beforeNextTick) {
+        entry.retried = true;
+        timers.set(id, setTimer(() => fire(id), WAKEUP_RETRY_DELAY_MS));
+        return;
+      }
+    } else if (!entry.retried) {
+      // 바쁨이 아닌 거부 — 1분 뒤 한 번만 다시 청한다(기존 계약).
       entry.retried = true;
       timers.set(id, setTimer(() => fire(id), WAKEUP_RETRY_DELAY_MS));
       return;
     }
+    const exhausted = deferrable ? 'defer-exhausted' : 'retry-exhausted';
     if (entry.repeatMs) {
-      log('tui.wakeup', 'skipped', { id, reason: 'retry-exhausted', next: 'repeat' });
+      log('tui.wakeup', 'skipped', { id, reason: exhausted, next: 'repeat' });
       advance(entry, t);
       return;
     }
-    log('tui.wakeup', 'skipped', { id, reason: 'retry-exhausted', next: 'dropped' });
+    log('tui.wakeup', 'skipped', { id, reason: exhausted, next: 'dropped' });
     deps.notify?.(`⏰ 예약 깨움 놓침(${id}): ${entry.reason} — ${result.reason}`);
     drop(id);
   };

package/src/skills/tools/shell.ts

@@ -32,7 +32,7 @@ import {
   getShellRunnerDeps,
 } from '../../shell-runner/dispatch.js';
 import type { ShellHandle, ShellResult as RunnerResult } from '../../shell-runner/types.js';
-import { debug } from '../../debug/log.js';
+import { debug, redactSecretText, redactSecrets } from '../../debug/log.js';
 import { getSessionCwd } from '../../session/working-dir.js';
 import { getUserConfig } from '../../user-config.js';
 import { SCHEDULE_WAKEUP_TOOL_NAME } from './schedule-wakeup.js';
@@ -515,8 +515,62 @@ function withLongSleepWarning(
   return { ...result, output: `${formatLongSleepWarning(finding, bgAvailable, resumeHint)}\n${result.output}` };
 }
 
-function logShellDispatch(event: string, data: Record<string, unknown>): void {
-  debug.log('shell.dispatch', event, data);
+/** The per-event cap holds for the whole recorded args text, including the
+ *  truncation marker. Source: TUI-OBS-TRACE-PERSIST GOAL STEPS (2048 chars). */
+export const SHELL_DISPATCH_ARGS_TEXT_LIMIT = 2048;
+
+interface BoundedShellArgsText {
+  /** Redacted JSON text of the arguments received by dispatchRunShell. */
+  argsText: string;
+  /** True when argsText was cut to the cap. */
+  argsTextTruncated: boolean;
+  /** Length of the full redacted JSON text before bounding. */
+  argsTextChars: number;
+  /** Short scalar remains readable even if argsText itself is compacted. */
+  argsTextMarker?: string;
+}
+
+function stringifyShellArgs(rawArgs: unknown): string {
+  try {
+    const json = JSON.stringify(redactSecrets(rawArgs));
+    if (json !== undefined) return json;
+  } catch { /* circular / BigInt args — redact fallback text too */ }
+  try {
+    return redactSecretText(String(rawArgs));
+  } catch {
+    return '[unserializable shell args]';
+  }
+}
+
+/** Bounded, secret-redacted serialization for one RunShell dispatch record. */
+export function boundedShellArgsText(
+  rawArgs: unknown,
+): BoundedShellArgsText {
+  const full = stringifyShellArgs(rawArgs);
+  if (full.length <= SHELL_DISPATCH_ARGS_TEXT_LIMIT) {
+    return { argsText: full, argsTextTruncated: false, argsTextChars: full.length };
+  }
+  const argsTextMarker = '[truncated]';
+  const prefixLen = SHELL_DISPATCH_ARGS_TEXT_LIMIT - argsTextMarker.length - 1;
+  return {
+    argsText: `${full.slice(0, prefixLen)} ${argsTextMarker}`,
+    argsTextTruncated: true,
+    argsTextChars: full.length,
+    argsTextMarker,
+  };
+}
+
+function logShellDispatch(
+  event: string,
+  data: Record<string, unknown>,
+  argsTrace?: BoundedShellArgsText,
+): void {
+  debug.log(
+    'shell.dispatch',
+    event,
+    argsTrace ? { ...data, ...argsTrace } : data,
+    { compact: { stringMax: SHELL_DISPATCH_ARGS_TEXT_LIMIT } },
+  );
 }
 
 // ── bg completion → turn notification queue (TUI-BG-SHELL) ───────────
@@ -588,8 +642,9 @@ export async function dispatchRunShell(
   const network = asNetwork(rawArgs.network);
   const mode = asMode(rawArgs.mode);
   const description = typeof rawArgs.description === 'string' ? rawArgs.description : undefined;
+  const argsTrace = boundedShellArgsText(rawArgs);
   if (command[0] === 'cd') {
-    logShellDispatch('cd.rejected', { reason: 'argv-state-does-not-persist' });
+    logShellDispatch('cd.rejected', { reason: 'argv-state-does-not-persist' }, argsTrace);
     return rejectedCdResult();
   }
   const ledgerCliMatch = matchLedgerCli(command, opts.availableToolNames);
@@ -627,7 +682,7 @@ export async function dispatchRunShell(
       signal: opts.signal,
       deps,
     });
-    logShellDispatch(`runner.${result.outcome}`, { cwd: effectiveCwd, cwdSource });
+    logShellDispatch(`runner.${result.outcome}`, { cwd: effectiveCwd, cwdSource }, argsTrace);
     return withLongSleepWarning(result, longSleep, bgAvailable, resumeHint);
   }
 
@@ -641,7 +696,7 @@ export async function dispatchRunShell(
     signal: opts.signal,
   });
 
-  logShellDispatch(`legacy.${result.outcome}`, { cwd: effectiveCwd, cwdSource });
+  logShellDispatch(`legacy.${result.outcome}`, { cwd: effectiveCwd, cwdSource }, argsTrace);
   const summary = formatSummary(result);
   return withLongSleepWarning({
     output: summary,

package/src/skills/tools/terminal-modal-inject.ts

@@ -18,7 +18,6 @@
 //     overflowed.
 
 import type { LLMToolSpec } from '../../llm.js';
-import { getDashboardTerminalSessions } from '../../dashboard/terminal/session.js';
 import type { TerminalSessionRegistry } from '../../terminal/session-registry.js';
 
 const CHUNK_BYTES = 256;
@@ -92,7 +91,7 @@ export async function dispatchTerminalModalInject(
   rawArgs: Record<string, unknown>,
   deps: DispatchInjectDeps = {},
 ): Promise<{ output: string }> {
-  const registry = deps.registry ?? getDashboardTerminalSessions();
+  const registry = deps.registry ?? (await import('../../dashboard/terminal/session.js')).getDashboardTerminalSessions();
   const id = String(rawArgs.id ?? '').trim();
   if (!id) throw new Error(`'id' is required`);
   const session = registry.get(id);

package/src/skills/tools/terminal-modal.ts

@@ -14,11 +14,13 @@
 import type { LLMToolSpec } from '../../llm.js';
 import { truncateOutput } from '../../output-truncation.js';
 import { getSessionCwd } from '../../session/working-dir.js';
-import {
-  getDashboardTerminalSessions,
-} from '../../dashboard/terminal/session.js';
 import type { TerminalSession, TerminalSessionRegistry } from '../../terminal/session-registry.js';
 
+async function getDashboardTerminalSessions(): Promise<TerminalSessionRegistry> {
+  const { getDashboardTerminalSessions: getSessions } = await import('../../dashboard/terminal/session.js');
+  return getSessions() as TerminalSessionRegistry;
+}
+
 const DEFAULT_MAX_BYTES = 64 * 1024;
 
 // ─── terminal_modal_list ────────────────────────────────────────
@@ -43,7 +45,7 @@ export async function dispatchTerminalModalList(
   rawArgs: Record<string, unknown>,
   deps?: { registry?: TerminalSessionRegistry },
 ): Promise<{ output: string }> {
-  const registry = deps?.registry ?? getDashboardTerminalSessions();
+  const registry = deps?.registry ?? await getDashboardTerminalSessions();
   const includeExited = rawArgs.include_exited === true;
   const sessions = registry.list().filter(s => includeExited || s.state !== 'exited');
   if (sessions.length === 0) {
@@ -92,7 +94,7 @@ export async function dispatchTerminalModalObserve(
   rawArgs: Record<string, unknown>,
   deps?: { registry?: TerminalSessionRegistry },
 ): Promise<{ output: string }> {
-  const registry = deps?.registry ?? getDashboardTerminalSessions();
+  const registry = deps?.registry ?? await getDashboardTerminalSessions();
   const id = String(rawArgs.id ?? '').trim();
   if (!id) throw new Error(`'id' is required`);
   const session = registry.get(id);
@@ -155,7 +157,7 @@ export async function dispatchTerminalModalFocus(
     termRows?: number;
   },
 ): Promise<{ output: string }> {
-  const registry = deps?.registry ?? getDashboardTerminalSessions();
+  const registry = deps?.registry ?? await getDashboardTerminalSessions();
   const id = String(rawArgs.id ?? '').trim();
   if (!id) throw new Error(`'id' is required`);
   const prior = registry.foreground()?.id ?? null;
@@ -191,7 +193,7 @@ export async function dispatchTerminalModalDetach(
   rawArgs: Record<string, unknown>,
   deps?: { registry?: TerminalSessionRegistry },
 ): Promise<{ output: string }> {
-  const registry = deps?.registry ?? getDashboardTerminalSessions();
+  const registry = deps?.registry ?? await getDashboardTerminalSessions();
   const id = typeof rawArgs.id === 'string' && rawArgs.id.length > 0
     ? rawArgs.id
     : registry.foreground()?.id;
@@ -227,7 +229,7 @@ export async function dispatchTerminalModalKill(
   rawArgs: Record<string, unknown>,
   deps?: { registry?: TerminalSessionRegistry },
 ): Promise<{ output: string }> {
-  const registry = deps?.registry ?? getDashboardTerminalSessions();
+  const registry = deps?.registry ?? await getDashboardTerminalSessions();
   const id = String(rawArgs.id ?? '').trim();
   if (!id) throw new Error(`'id' is required`);
   const session = registry.kill(id);

package/src/skills/url-router.ts

@@ -108,11 +108,50 @@ function containsAny(haystack: string, needles: string[]): string | null {
   return null;
 }
 
+// ── Work-context guard (URL-ROUTE-WORK-CONTEXT-GUARD · 10-22) ──
+// Observed: a long n8n work instruction carrying «RSS URL https://hnrss.org/frontpage
+// · Limit 5 …» (a value to type into a node) was rewritten into an omni-digest run.
+// The config guardKeywords did not stop it, and a user config replaces that list
+// wholesale — so this guard lives in code and always applies.
+
+/** «Put this value into a field» phrasing — the URL is data, not a digest target. */
+const FIELD_INPUT_WORDS = [
+  '입력', '넣어', '넣고', '넣기', '붙여넣', '칸에', '노드에', '필드에', '란에',
+  '로 설정', '으로 설정', '에 설정', '설정해',
+  'paste into', 'type into', 'fill in', 'into the field', 'enter it',
+];
+/** Text outside the URLs longer than this is a work instruction, not «summarize this». */
+export const WORK_INSTRUCTION_MIN_CHARS = 160;
+/** Step separators (`·` `→` `->`, numbered/bulleted lines) that mark a multi-step task. */
+const STEP_MARKER_RE = /·|→|->|^\s*(?:\d+[.)]|[-*•])\s+/gmu;
+
+/** A URL written as a labelled value — «RSS URL https://…», «Webhook URL: https://…», «endpoint=https://…».
+ *  Matched against the text with each URL replaced by a marker, so a label inside a URL
+ *  (`https://a.com/?url=https://b.com`) is never read as one. */
+const URL_MARK = '\u0000';
+/** Words that ask for a digest of the URL — they exempt the labelled-URL check (not the other guards). */
+const DIGEST_REQUEST_WORDS = ['요약', '정리', '분석', 'summar', 'digest', 'tl;dr', 'tldr'];
+const LABELLED_URL_RE = /(?:^|[^\p{L}\p{N}])(?:url|uri|endpoint)\s*[:=]?\s*\u0000/iu;
+
+/** Why this URL-bearing text must stay on the LLM path, or null when it may route. */
+export function workContextGuardReason(text: string): string | null {
+  const rest = text.replace(URL_RE, ' ').replace(/\s+/g, ' ').trim();
+  const field = containsAny(rest.toLowerCase(), FIELD_INPUT_WORDS);
+  if (field) return `field-input("${field}")`;
+  // An explicit digest request («URL https://… 요약해줘») names the URL to summarize, so the label alone does not hold it back.
+  if (LABELLED_URL_RE.test(text.replace(URL_RE, URL_MARK)) && !containsAny(rest.toLowerCase(), DIGEST_REQUEST_WORDS)) return 'labelled-url-value';
+  if (rest.length > WORK_INSTRUCTION_MIN_CHARS) return `long-instruction(${rest.length})`;
+  const steps = text.replace(URL_RE, ' ').match(STEP_MARKER_RE)?.length ?? 0;
+  if (steps >= 2) return `multi-step(${steps})`;
+  return null;
+}
+
 /** Main entry. Returns a routing decision when the text contains a URL
  *  that should be auto-processed, or null when:
  *   - routing disabled,
  *   - no URL present,
- *   - a guard keyword is present (defer to the LLM — R5/R8).
+ *   - a guard keyword is present (defer to the LLM — R5/R8),
+ *   - the URL sits inside a work instruction (`workContextGuardReason`).
  *
  *  Callers (TUI dashboard / Telegram agent) then decide auto-fire vs
  *  suggest, and run the mapped skill (two-stage per P4). */
@@ -132,6 +171,7 @@ export function detectUrlRoute(
   // "반박해봐", "구현해줘") is NOT a digest request — defer to the LLM.
   const guardHit = containsAny(haystack, cfg.guardKeywords);
   if (guardHit) return null;
+  if (workContextGuardReason(text)) return null;
 
   const url = urls[0]!;
   const kind = classifyUrl(url);

package/src/smart-wizard/run.ts

@@ -0,0 +1,66 @@
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { runGraph, type GraphRunState } from '../graph-runner/runner.js';
+import type { WorkflowDeps } from '../workflow-runtime/types.js';
+
+const WIZARD_GRAPH = resolve(import.meta.dir, '../../graphs/wizard/wizard-loop.yaml');
+const FIRST_RESEARCH_PATH = ['intake', 'classify', 'ground'] as const;
+
+export interface WizardRequestRunOptions {
+  /** Stable caller-supplied identity, or generated for this request. */
+  runId?: string;
+  /** Isolated graph-run ledger root. */
+  stateRoot?: string;
+  /** Injected for controlled runs; omitted to use the graph runner's production LLM. */
+  callLLM?: (prompt: string) => Promise<string>;
+  /** Injected command runner for isolated execution and deterministic verification. */
+  runBash?: WorkflowDeps['runBash'];
+  log?: (event: string, data: Record<string, unknown>) => void;
+}
+
+export interface WizardRequestRun {
+  runId: string;
+  status: GraphRunState['status'];
+  path: string[];
+  /** Observed graph edges; every record is stamped with the enclosing run identity. */
+  transitions: Array<{ from: string; to: string; runId: string }>;
+  state: GraphRunState;
+}
+
+/** Run one request through the wizard graph and expose its first research transition. */
+export async function runWizardRequest(
+  request: string,
+  options: WizardRequestRunOptions = {},
+): Promise<WizardRequestRun> {
+  const normalizedRequest = request.trim();
+  if (!normalizedRequest) throw new TypeError('wizard request must not be empty');
+  if (!existsSync(WIZARD_GRAPH)) throw new Error(`wizard-loop graph is missing: ${WIZARD_GRAPH}`);
+
+  const runId = options.runId ?? randomUUID();
+  const state = await runGraph(WIZARD_GRAPH, {
+    runId,
+    input: { request: normalizedRequest },
+    quiet: true,
+    deps: {
+      ...(options.stateRoot ? { root: options.stateRoot } : {}),
+      ...(options.callLLM ? { callLLM: options.callLLM } : {}),
+      ...(options.runBash ? { runBash: options.runBash } : {}),
+      ...(options.log ? { log: options.log } : {}),
+    },
+  });
+
+  if (state.runId !== runId) throw new Error(`wizard run identity changed: expected ${runId}, got ${state.runId}`);
+  const transitions = state.path.slice(1).map((to, index) => ({
+    from: state.path[index]!,
+    to,
+    runId: state.runId,
+  }));
+  const firstResearchPath = state.path.slice(0, Math.min(state.path.length, FIRST_RESEARCH_PATH.length));
+  if (!firstResearchPath.every((nodeId, index) => nodeId === FIRST_RESEARCH_PATH[index]) ||
+      (state.status === 'awaiting-approval' && firstResearchPath.length !== FIRST_RESEARCH_PATH.length)) {
+    throw new Error(`wizard request did not reach the first research steps: ${firstResearchPath.join(' → ')}`);
+  }
+
+  return { runId: state.runId, status: state.status, path: [...state.path], transitions, state };
+}

package/src/status/bar.ts

@@ -290,6 +290,25 @@ export function runningBuildSegment(state: RunningBuildState | null | undefined,
   return strongText(`${label} ⟳ 재기동 필요${target}`, 'yellow', opts);
 }
 
+/** 이번 턴 «실제로» 응답한 공급자·모델 (TUI-MODEL-BADGE-ACTUAL · 10-16 · #24·#66).
+ *
+ *  턴 «시작»에 고른 결정(`RouteDecision`)과 실제 응답은 다를 수 있다 — 폴백 체인이
+ *  다른 공급자로 넘기면(예 codex → grok) 배지가 «지금» 으로 보여야 하는 것은 이쪽이다.
+ *  완료 배지(`src/tui/chat/execution-badge.ts`)와 같은 원천(`src/llm/route-decision.ts`)을 쓴다. */
+export interface ModelExecutionActual {
+  provider?: string;
+  /** 실제로 응답한 모델 id — 있으면 배지의 «지금» 은 이 값이다. */
+  model: string;
+  /** 폴백이면 턴이 «고른» 모델 — 배지가 `고른 → 실제` 로 드러낸다(폴백 아니면 없음/null). */
+  fallbackFrom?: string | null;
+}
+
+/** 상태줄 배지 입력 — 설정/런타임 값 ⊕ (있으면) 이번 턴 실제 실행.
+ *  `actual` 이 없는 호출자는 종전과 완전히 같은 배지를 얻는다(추가 필드는 선택). */
+export interface StatusModelInfo extends Pick<ActiveProviderInfo, 'provider' | 'model'> {
+  actual?: ModelExecutionActual | null;
+}
+
 /** Truncate a model id at the first parameter-size marker (e.g.
  *  `qwen3.6-35b-a3b-ud-mlx` → `qwen3.6-35b`). The marker pattern
  *  matches one or more digits followed by `b`/`B` (e.g. `7b`, `35b`,
@@ -319,19 +338,22 @@ function truncateAtParamSize(model: string): string {
  *   - `local:qwen3.6-35b-a3b-ud-mlx` → `local:qwen3.6-35b`
  *   - `node-b:qwen2.5-72b-instruct`    → `node-b:qwen2.5-72b`
  *   - `claude-opus-4-6`              → unchanged (no `\d+b` marker) */
-export function modelSegment(info: Pick<ActiveProviderInfo, 'provider' | 'model'>, opts: StatusBarRenderOptions = {}): string {
-  if (!info.model || info.model === '(none)') {
-    return strongText(info.provider, 'pink', opts);
+export function modelSegment(info: StatusModelInfo, opts: StatusBarRenderOptions = {}): string {
+  // 이번 턴 실제 실행이 있으면 그 값이 «지금» 이다 — 설정/런타임 값은 실행 전 기본값일 뿐.
+  const actual = info.actual?.model && info.actual.model !== '(none)' ? info.actual : null;
+  const provider = actual?.provider?.trim() || info.provider;
+  const model = actual?.model ?? info.model;
+  if (!model || model === '(none)') {
+    return strongText(provider, 'pink', opts);
   }
   // Step 1 — derive the display string with node prefix when local.
   let display: string;
-  let model = info.model;
   if (model.startsWith('local-llm:')) {
     const rest = model.slice('local-llm:'.length);
     display = rest.includes(':') ? rest : `local:${rest}`;
   } else if (model.startsWith('local:')) {
     display = model;
-  } else if (info.provider === 'local') {
+  } else if (provider === 'local') {
     display = `local:${model}`;
   } else {
     display = model;
@@ -349,6 +371,11 @@ export function modelSegment(info: Pick<ActiveProviderInfo, 'provider' | 'model'
       display = truncateAtParamSize(display);
     }
   }
+  // Step 3 — 폴백이면 «처음 → 실제». 고른 값과 실제가 같으면 화살표를 꾸미지 않는다.
+  const from = actual?.fallbackFrom?.trim();
+  if (from && from !== model) {
+    display = `${opts.compact ? truncateAtParamSize(from) : from} → ${display}`;
+  }
   return strongText(display, 'pink', opts);
 }
 
@@ -798,7 +825,8 @@ function dockStripDetail(dockedCount: number, dormantCount: number): string {
 
 export interface StatusBarState {
   cwd: string;
-  providerInfo: ActiveProviderInfo;
+  /** 설정/런타임 공급자·모델 ⊕ (있으면) 이번 턴 실제 실행 — 배지는 실제를 «지금» 으로 쓴다. */
+  providerInfo: StatusModelInfo;
   gitBranch?: string;
   contextUsedTokens?: number;
   tmuxLabel?: string | null;

package/src/status/metrics.ts

@@ -16,7 +16,7 @@
 
 import { costForUsageDetailed, type TokenUsage } from '../models/costs.js';
 import { resolveModelContextWindow } from '../models/context-window.js';
-import { DEFAULT_TOKEN_BUDGET, estimateTokens } from '../tokens.js';
+import { DEFAULT_TOKEN_BUDGET, estimateMessagesTokens, estimateTokens } from '../tokens.js';
 
 export interface SessionMetrics {
   /** Cumulative input tokens sent this session. */
@@ -119,6 +119,17 @@ export function recordTurn(input: RecordTurnInput): SessionMetrics {
   return singleton;
 }
 
+/**
+ * A conversation was just restored (`/session load` · `--resume`): the next turn will send all of it,
+ * so the ctx readout shows that size now instead of 0 until the first turn reports real usage
+ * (TUI-RESUME-PICKER ④). The first `recordTurn` replaces it with the provider's number.
+ */
+export function noteRestoredContext(history: readonly { role: string; content: unknown }[]): number {
+  const used = estimateMessagesTokens(history.map((m) => ({ role: m.role, content: typeof m.content === 'string' ? m.content : JSON.stringify(m.content ?? '') })));
+  singleton.lastContextUsed = used;
+  return used;
+}
+
 /** Elapsed time since session start, in seconds. Updated on every
  *  call (doesn't depend on recordTurn firing). */
 export function sessionElapsedSec(): number {

package/src/status/status-provider-info.ts

@@ -10,8 +10,29 @@
 
 import { inspectActiveProvider, type ActiveProviderInfo } from '../provider-summary.js';
 import { getUserConfig, type UserConfig } from '../user-config.js';
+import { currentRouteDecision, currentRouteExecution } from '../llm/route-decision.js';
+import type { ModelExecutionActual } from './bar.js';
 
-export type StatusProviderInfo = Pick<ActiveProviderInfo, 'provider' | 'model'>;
+export type StatusProviderInfo = Pick<ActiveProviderInfo, 'provider' | 'model'> & {
+  /** TUI-MODEL-BADGE-ACTUAL (10-16) — 이번 턴 «실제» 실행. 있으면 배지는 이 값을 «지금» 으로 쓴다. */
+  actual?: ModelExecutionActual | null;
+};
+
+/** 표면의 이번 턴 «실제» 실행을 배지 입력 꼴로 옮긴다 — 결정(턴 시작에 고른 값)과 다르면
+ *  `fallbackFrom` 이 채워져 배지가 `고른 → 실제` 를 보인다. 실행 기록이 없으면 null(꾸미지 않는다).
+ *  원천은 완료 배지와 «같은» 맵(`src/llm/route-decision.ts`)이다 — 두 표면이 다른 말을 하지 않게. */
+export function statusModelActual(surface = 'dashboard'): ModelExecutionActual | null {
+  const execution = currentRouteExecution(surface);
+  const model = execution?.model?.trim();
+  if (!model) return null;
+  const provider = execution?.provider?.trim();
+  const planned = currentRouteDecision(surface)?.model?.trim();
+  return {
+    model,
+    ...(provider ? { provider } : {}),
+    ...(planned && planned !== model ? { fallbackFrom: planned } : {}),
+  };
+}
 
 export interface StatusProviderInfoReaderDeps {
   readConfig?: () => UserConfig;
@@ -23,9 +44,15 @@ export interface StatusProviderInfoReaderDeps {
   maxAgeMs?: number;
 }
 
+/** 상태줄이 매 렌더 부르는 리더 — `actual`(이번 턴 실제 실행)은 선택이라 종전 호출 그대로도 된다. */
+export type StatusProviderInfoReader = (
+  runtimeModel?: string,
+  actual?: ModelExecutionActual | null,
+) => StatusProviderInfo;
+
 export function createStatusProviderInfoReader(
   deps: StatusProviderInfoReaderDeps = {},
-): (runtimeModel?: string) => StatusProviderInfo {
+): StatusProviderInfoReader {
   const readConfig = deps.readConfig ?? (() => getUserConfig());
   const inspect = deps.inspect ?? ((cfg, runtimeModel) => inspectActiveProvider(cfg, runtimeModel));
   const now = deps.now ?? Date.now;
@@ -39,20 +66,24 @@ export function createStatusProviderInfoReader(
     inspectedAt: number;
   } | null = null;
 
-  return (runtimeModel?: string): StatusProviderInfo => {
+  /** `actual` — 이번 턴 실제 실행(있으면). 기억은 설정/런타임 값만 하고, 실행은 «매 렌더»
+   *  달라지므로 기억 밖에서 덧씌운다(낡은 실행이 굳지 않게). */
+  return (runtimeModel?: string, actual?: ModelExecutionActual | null): StatusProviderInfo => {
     const t = now();
     // ⛔ 조기 반환에도 최대 수명을 건다 — TTL 만 보면 «29초에 설정 확인 → 30.001초 렌더»가 재판정 없이 지나간다.
     const fresh = memo !== null && t - memo.inspectedAt < maxAgeMs;
-    if (memo && fresh && memo.runtimeModel === runtimeModel && t - memo.checkedAt < ttlMs) return memo.info;
+    if (memo && fresh && memo.runtimeModel === runtimeModel && t - memo.checkedAt < ttlMs) {
+      return actual ? { ...memo.info, actual } : memo.info;
+    }
     // getUserConfig() 는 파일 mtime 이 같으면 «같은 객체»를, 바뀌면 새 객체를 돌려준다(user-config.ts getUserConfig).
     const cfg = readConfig();
     if (memo && fresh && memo.cfg === cfg && memo.runtimeModel === runtimeModel) {
       memo.checkedAt = t;
-      return memo.info;
+      return actual ? { ...memo.info, actual } : memo.info;
     }
     const full = inspect(cfg, runtimeModel);
     const info: StatusProviderInfo = { provider: full.provider, model: full.model };
     memo = { info, cfg, runtimeModel, checkedAt: t, inspectedAt: t };
-    return info;
+    return actual ? { ...info, actual } : info;
   };
 }

package/src/steward/rejudge-tick.ts

@@ -19,7 +19,7 @@ import { debug } from '../debug/log.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { spawnElanous } from '../instance/spawn-elanous.js';
 import { getUserConfig } from '../user-config.js';
-import { resyncPendingPath } from './resync-tick.js';
+import { resyncPendingPath, resyncPendingRecoveryPath } from './resync-tick.js';
 
 export const REJUDGE_TICK_EVENT = 'rejudge-tick';
 export const REJUDGE_DEFAULT_MAX_LOAD = 60;
@@ -63,8 +63,16 @@ function defaultStampPath(): string {
 function readStamp(path: string): string | null {
   try {
     const value = (JSON.parse(readFileSync(path, 'utf8')) as { startedAt?: unknown }).startedAt;
-    return typeof value === 'string' && Number.isFinite(Date.parse(value)) ? value : null;
-  } catch { return null; }
+    if (typeof value !== 'string' || !Number.isFinite(Date.parse(value))) {
+      throw new Error(`invalid steward stamp startedAt: ${path}`);
+    }
+    return value;
+  } catch (error) {
+    // A missing stamp is the first tick. A corrupt or unreadable existing stamp is not:
+    // claiming it would overwrite the evidence and could launch an overlapping rejudge.
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null;
+    throw error;
+  }
 }
 
 /** Same universe as this process (env inherited) · same installed version (entry next to this module). */
@@ -137,11 +145,18 @@ export async function rejudgeTick(deps: RejudgeTickDeps = {}): Promise<RejudgeTi
   }
 }
 
+/**
+ * The resync marker, or its recovery sibling when the primary record could not be written after a push. Both carry
+ * `{ savedAt }`, so a same-tick rejudge still sees the new head instead of falling back to the cadence alone.
+ */
 function readPending(path: string): string | null {
-  try {
-    const value = (JSON.parse(readFileSync(path, 'utf8')) as { savedAt?: unknown }).savedAt;
-    return typeof value === 'string' && Number.isFinite(Date.parse(value)) ? value : null;
-  } catch { return null; }
+  for (const candidate of [path, resyncPendingRecoveryPath(path)]) {
+    try {
+      const value = (JSON.parse(readFileSync(candidate, 'utf8')) as { savedAt?: unknown }).savedAt;
+      if (typeof value === 'string' && Number.isFinite(Date.parse(value))) return value;
+    } catch { /* missing or unreadable: fall through to the recovery marker */ }
+  }
+  return null;
 }
 
 if (import.meta.main) {

package/src/steward/resync-tick.ts

@@ -16,6 +16,36 @@ type ResyncTickResult = { decision: 'ran' | 'failed' | 'skipped-release' | 'skip
 
 export function resyncPendingPath(): string { return join(effectiveInstanceRoot(), 'steward', 'resync-pending.json'); }
 
+/**
+ * Fallback marker for the same-tick rejudge node when the primary marker cannot be written after a successful
+ * remote push. It lives next to the primary marker and carries the same `{ savedAt }` shape, so the consumer
+ * contract does not change — only the location the marker is read from.
+ */
+export function resyncPendingRecoveryPath(pendingPath: string = resyncPendingPath()): string {
+  return join(dirname(pendingPath), 'resync-pending-recovery.json');
+}
+
+/** Best-effort marker write: a record failure must not undo the completed push or hide its new head. */
+function recordResyncPending(pendingPath: string): void {
+  const savedAt = new Date().toISOString();
+  try {
+    mkdirSync(dirname(pendingPath), { recursive: true });
+    writeFileSync(pendingPath, JSON.stringify({ savedAt }));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`steward resync: pending record write failed — ${message}`);
+    try {
+      const recoveryPath = resyncPendingRecoveryPath(pendingPath);
+      mkdirSync(dirname(recoveryPath), { recursive: true });
+      writeFileSync(recoveryPath, JSON.stringify({ savedAt }));
+      console.error(`steward resync: pending record recovered at ${recoveryPath}`);
+    } catch (fallbackError) {
+      // Nothing left to write: the tick still reports `ran` with the pushed summary, and the failure stays observable.
+      console.error(`steward resync: pending record recovery failed — ${fallbackError instanceof Error ? fallbackError.message : String(fallbackError)}`);
+    }
+  }
+}
+
 /** The same registered, detached OP checkout used by steward launch; the installed package is not a git repository. */
 export function stewardResyncRepoRoot(
   resolveSeat: typeof resolveHqLaunchSeat = resolveHqLaunchSeat,
@@ -185,10 +215,7 @@ export async function resyncTickWithReleaseProbe(
           result = { decision: 'skipped-release-window', reason: window === 'inside' ? 'scheduled release window' : 'release schedule unavailable' };
         } else {
           const summary = await run();
-          if (summary.saved > 0) {
-            mkdirSync(dirname(pendingPath), { recursive: true });
-            writeFileSync(pendingPath, JSON.stringify({ savedAt: new Date().toISOString() }));
-          }
+          if (summary.saved > 0) recordResyncPending(pendingPath);
           result = { decision: 'ran', summary };
         }
       }