elanous 0.2.35 → 0.2.37

package/src/chat/turn-typeahead.ts

@@ -8,6 +8,8 @@
 // elanous: 스트리밍 키 사다리에서 printable/backspace/enter 를 이 버퍼로 보존
 // (에코는 호출측이 composer zone 에 직접 페인트), 턴 종료 시 FIFO로 넘긴다.
 
+import { pasteFoldToken, shouldFoldPaste } from './paste-fold.js';
+
 export interface TurnTypeaheadState {
   /** 아직 Enter 하지 않은 현재 작성 중 입력. */
   buffer: string;
@@ -23,6 +25,32 @@ export interface TurnTypeaheadState {
   steerPriority?: boolean;
   /** 이번 턴에 도구 경계로 들어간 수 — 큐가 비었을 때 «✓ 넣음» 줄로 보인다. 턴이 끝나면 지운다. */
   injectedCount?: number;
+  /**
+   * 턴 중 긴 붙여넣기 — 버퍼엔 `[붙여넣음 #k · N줄 · M자]` 토큰, 원문은 여기(TUI-PASTE-WHILE-STREAMING · 10-22).
+   * 제출·넘김 때 토큰을 원문으로 되돌린다. 짝이 없으면 칸을 두지 않는다.
+   */
+  pastes?: Array<[token: string, raw: string]>;
+  /** 토큰 번호 — 한 버퍼 안에서 겹치지 않게. */
+  pasteSeq?: number;
+}
+
+/** 버퍼 속 붙여넣기 토큰을 원문으로 되돌린다(한 번에 훑는다). 순수. */
+export function expandTurnTypeaheadPastes(text: string, pastes: TurnTypeaheadState['pastes']): { text: string; used: number } {
+  const held = (pastes ?? []).filter(([token]) => text.includes(token));
+  if (held.length === 0) return { text, used: 0 };
+  const map = new Map(held);
+  const re = new RegExp(held.map(([t]) => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|'), 'g');
+  return { text: text.replace(re, (m) => map.get(m) ?? m), used: held.length };
+}
+
+/** 버퍼(와 남길 글)에 더는 없는 붙여넣기 짝을 놓는다. 비면 칸을 뗀다. 순수. */
+function prunePastes(state: TurnTypeaheadState): TurnTypeaheadState {
+  if (!state.pastes) return state;
+  const live = state.pastes.filter(([token]) => state.buffer.includes(token));
+  if (live.length === state.pastes.length) return state;
+  if (live.length > 0) return { ...state, pastes: live };
+  const { pastes: _p, pasteSeq: _s, ...rest } = state;
+  return rest;
 }
 
 /** 큐 길이에 맞춘 id 짝(모자라면 null 로 채운다). 순수. */
@@ -95,6 +123,8 @@ export type TurnTypeaheadKeyResult = {
   releasedPendingIds?: string[];
   /** 빈 입력에서 Enter(대기 항목이 있을 때) = «지금 밀어 넣기» 요청. 판정·실행은 호출측의 책임이다. */
   pushNowRequested?: boolean;
+  /** 붙여넣기를 버퍼에 받았다 — 관측(`tui.paste`)은 호출측이 남긴다. */
+  pasted?: { folded: boolean; lines: number; chars: number };
 };
 
 /** 등록소 소유의 관측용 표시 조회. 이름·문법·실행 정책은 이 순수 판정기에 두지 않는다. */
@@ -123,17 +153,41 @@ export function applyTurnTypeaheadKey(
   state: TurnTypeaheadState,
   // ⭐ `shift`·`meta` 도 선언한다 — 상류 대시보드가 실제로 싣는 필드다. 구조적 타이핑이라
   //    선언이 없어도 런타임엔 들어오므로, 빠뜨리면 정확한 조합 판정을 타입으로 못 쓴다.
-  key: { name: string; ctrl?: boolean; alt?: boolean; shift?: boolean; meta?: boolean; mouse?: unknown; kind?: string },
+  key: { name: string; ctrl?: boolean; alt?: boolean; shift?: boolean; meta?: boolean; mouse?: unknown; kind?: string; paste?: string },
   isImmediateSubmission?: TurnTypeaheadImmediateSubmissionLookup,
 ): TurnTypeaheadKeyResult {
   if (key.mouse) return { state, consumed: false, changed: false };
   if (key.kind && key.kind !== 'press') return { state, consumed: false, changed: false };
 
+  // ⭐ 턴 중 붙여넣기 — 종전엔 소유하지 않아 스트리밍 사다리에서 조용히 버려졌다(10-22 설치본 99edcfa 재현).
+  //    짧은 글은 버퍼에 그대로 · 긴 글은 자리표시 토큰(원문은 `pastes`) · 제출하면 원문 전부가 FIFO 로 간다.
+  if (key.name === 'paste') {
+    // 원문(끝 줄바꿈 포함)은 그대로 쥐고 제출한다 — 줄 수·글자 수 표시만 끝 줄바꿈 하나를 빼고 센다(r1 must-fix · paste-fold 와 같은 규칙).
+    const raw = typeof key.paste === 'string' ? key.paste.replace(/\r\n?/g, '\n') : '';
+    const shown = raw.replace(/\n$/, '');
+    if (!raw) return { state, consumed: true, changed: false };
+    const lines = shown.split('\n').length;
+    if (!shouldFoldPaste(shown)) {
+      return { state: { ...state, buffer: state.buffer + raw }, consumed: true, changed: true, pasted: { folded: false, lines, chars: shown.length } };
+    }
+    const seq = (state.pasteSeq ?? 0) + 1;
+    const token = pasteFoldToken(seq, shown);
+    return {
+      state: { ...state, buffer: state.buffer + token, pastes: [...(state.pastes ?? []), [token, raw]], pasteSeq: seq },
+      consumed: true,
+      changed: true,
+      pasted: { folded: true, lines, chars: shown.length },
+    };
+  }
+
   if (key.name === 'backspace' && !key.ctrl && !key.alt) {
     if (!state.buffer) return { state, consumed: false, changed: false };
+    // 토큰 끝에서 지우면 토큰 «통째로»(반쯤 지운 토큰은 원문도 글도 아니다).
+    const tail = state.pastes?.find(([token]) => state.buffer.endsWith(token));
+    if (tail) return { state: prunePastes({ ...state, buffer: state.buffer.slice(0, -tail[0].length) }), consumed: true, changed: true };
     const cps = [...state.buffer];
     cps.pop();
-    return { state: { ...state, buffer: cps.join('') }, consumed: true, changed: true };
+    return { state: prunePastes({ ...state, buffer: cps.join('') }), consumed: true, changed: true };
   }
 
   // ⭐ 턴 중에도 Shift+Enter(⊕ Alt+Enter · Ctrl+J)는 «줄바꿈»이다 — 유휴 입력창과 같은 계약.
@@ -150,13 +204,15 @@ export function applyTurnTypeaheadKey(
       if (state.queuedSubmissions.length === 0) return { state, consumed: false, changed: false };
       return { state, consumed: true, changed: false, pushNowRequested: true };
     }
+    const submitted = expandTurnTypeaheadPastes(state.buffer, state.pastes).text;
+    const cleared = prunePastes({ ...state, buffer: '' });
     try {
       if (state.buffer.startsWith('/') && isImmediateSubmission?.(state.buffer)) {
         return {
-          state: { ...state, buffer: '' },
+          state: cleared,
           consumed: true,
           changed: true,
-          immediateSubmission: state.buffer,
+          immediateSubmission: submitted,
           submissionDisposition: 'immediate',
         };
       }
@@ -166,7 +222,7 @@ export function applyTurnTypeaheadKey(
     return {
       state: {
         buffer: '',
-        queuedSubmissions: [...state.queuedSubmissions, state.buffer],
+        queuedSubmissions: [...state.queuedSubmissions, submitted],
         ...idsField([...turnTypeaheadPendingIds(state), null]),
       },
       consumed: true,
@@ -213,7 +269,7 @@ export function restoreTurnTypeaheadSubmission(
 
 export type TurnTypeaheadHandoff =
   | { kind: 'none' }
-  | { kind: 'prefill'; text: string }
+  | { kind: 'prefill'; text: string; pastes?: Array<[token: string, raw: string]> }
   | { kind: 'submit'; text: string; pendingId?: string };
 
 /** 턴 종료 때 FIFO의 다음 항목 하나를 꺼낸다. 큐가 비면 미제출 buffer는 prefill한다. */
@@ -229,7 +285,9 @@ export function dequeueTurnTypeaheadHandoff(
     };
   }
   if (!state.buffer) return { handoff: { kind: 'none' }, state };
-  return { handoff: { kind: 'prefill', text: state.buffer }, state: createTurnTypeaheadState() };
+  // 토큰째 넘기고 짝도 같이 넘긴다 — 받는 입력창이 짝을 넘겨받아(`initialPastes`) 토큰으로 보이고 제출 때 편다.
+  const pastes = state.pastes?.filter(([token]) => state.buffer.includes(token));
+  return { handoff: { kind: 'prefill', text: state.buffer, ...(pastes?.length ? { pastes } : {}) }, state: createTurnTypeaheadState() };
 }
 
 /** 턴 범위 표시(최우선·넣음 수)를 지운다 — 다음 턴으로 넘기지 않는다. 순수. */
@@ -263,15 +321,19 @@ export function drainTurnTypeaheadOnce(
    *   composer 로 돌아간 글이 고치기 전 문면으로 모델에 들어간다(중단 복원).
    */
   releasedPendingIds: string[];
+  /** `nextInitial` 속 붙여넣기 토큰의 원문 — 받는 입력창에 `initialPastes` 로 넘긴다. */
+  initialPastes?: Array<[token: string, raw: string]>;
 } {
   state = clearTurnScopedMarks(state);
   if (opts?.interrupted && state.queuedSubmissions.length > 0) {
     const restored = [...state.queuedSubmissions, ...(state.buffer ? [state.buffer] : [])].join('\n');
+    const pastes = state.pastes?.filter(([token]) => state.buffer.includes(token));
     return {
       state: createTurnTypeaheadState(),
       nextInitial: carriedInitial ? `${carriedInitial}\n${restored}` : restored,
       injectEnter: false,
       releasedPendingIds: presentIds(turnTypeaheadPendingIds(state)),
+      ...(pastes?.length ? { initialPastes: pastes } : {}),
     };
   }
   const { handoff, state: remaining } = dequeueTurnTypeaheadHandoff(state);
@@ -283,6 +345,7 @@ export function drainTurnTypeaheadOnce(
     nextInitial: carriedInitial ? `${carriedInitial}${handoff.text}` : handoff.text,
     injectEnter: handoff.kind === 'submit',
     releasedPendingIds: handoff.kind === 'submit' && handoff.pendingId ? [handoff.pendingId] : [],
+    ...(handoff.kind === 'prefill' && handoff.pastes ? { initialPastes: handoff.pastes } : {}),
   };
 }
 

package/src/cli/autopilot-cli.ts

@@ -9,6 +9,8 @@ import { writeStdoutJson } from './stdout-json.js';
 export interface AutopilotCliDeps {
   /** logs.db 싱크 등록(시험 주입). 기본 = `registerStandaloneLogSink`. `task-agent-action` 이 부른다. */
   registerSink?: (surface: string) => Promise<unknown>;
+  /** Deterministic action execution ports for isolated dispatcher tests. */
+  actionDeps?: Pick<import('../task-agent/actions.js').ActionDeps, 'mode' | 'command' | 'observe'>;
 }
 
 export function registerAutopilotCommands(program: Command, cliDeps: AutopilotCliDeps = {}): void {
@@ -22,7 +24,7 @@ export function registerAutopilotCommands(program: Command, cliDeps: AutopilotCl
       // 독립 프로세스 — 싱크를 붙이지 않으면 `task-agent`/`action` 관측이 logs.db 에 안 닿는다(fail-open).
       const { registerTaskAgentSink } = await import('./tasks-cli.js');
       await registerTaskAgentSink(cliDeps.registerSink);
-      const { executeNextAction } = await import('../task-agent/actions.js');
+      const { executeEntranceTick, executeNextAction } = await import('../task-agent/actions.js');
       const { getUserConfig } = await import('../user-config.js');
       const { spawnSync } = await import('node:child_process');
       const { writeFileSync, mkdirSync } = await import('node:fs');
@@ -41,15 +43,23 @@ export function registerAutopilotCommands(program: Command, cliDeps: AutopilotCl
         process.exitCode = 1;
         return;
       }
-      const action = JSON.parse(actionJson) as import('../task-agent/actions.js').NextAction;
+      const parsedInput = JSON.parse(actionJson) as import('../task-agent/actions.js').NextAction | import('../task-agent/actions.js').EntranceTickCandidate[];
+      const isEntranceTick = Array.isArray(parsedInput);
+      const action = isEntranceTick ? parsedInput[0]?.action : parsedInput;
+      if (!action) {
+        process.stderr.write('task-agent-action: action or non-empty entrance tick is required\n');
+        process.exitCode = 1;
+        return;
+      }
       const deps: import('../task-agent/actions.js').ActionDeps = {
         ...state,
+        ...cliDeps.actionDeps,
         failureCounts: state.failureCounts ?? {},
         saveState: () => {
           mkdirSync(dirname(statePath), { recursive: true });
           // 실패 횟수는 incrementFailure 가 잠금 안에서 키별로 더한다 — 여기선 덮어쓰지 않는다.
         },
-        mode: config.taskAgent?.mode,
+        mode: cliDeps.actionDeps?.mode ?? config.taskAgent?.mode,
         // 하루 착지 칸은 상태 파일 잠금 안에서 확보·반환한다 — 두 CLI 프로세스가 같은 잔여 칸을 쓰지 않게.
         reserveLanding: (day, limit) => withFileLockSync(`${statePath}.lock`, () => {
           const disk = readTaskAgentState<ActionState>(statePath);
@@ -74,18 +84,23 @@ export function registerAutopilotCommands(program: Command, cliDeps: AutopilotCl
           writeFileSync(statePath, JSON.stringify({ ...disk, landingsToday: disk.landingsToday - 1 }));
           deps.landingsToday = disk.landingsToday - 1;
         }),
-        observe: (_event, data) => debug.log('task-agent', 'action', data),
-        command: async args => {
+        observe: cliDeps.actionDeps?.observe ?? ((_event, data) => debug.log('task-agent', 'action', data)),
+        command: cliDeps.actionDeps?.command ?? (async (args, cwd) => {
           const p = args[0] === 'gh'
-            // PR 조회는 착지할 작업 트리에서 — 다른 저장소에서 불러도 엉뚱한 PR 을 읽지 않게.
-            ? spawnSync('gh', args.slice(1), { encoding: 'utf8', ...(action.cwd ? { cwd: action.cwd } : {}) })
+            // PR 조회는 해당 후보의 작업 트리에서 — 배열 후보 간 저장소가 섞이지 않게.
+            ? spawnSync('gh', args.slice(1), { encoding: 'utf8', ...(cwd ? { cwd } : {}) })
             // 지금 돌고 있는 진입점으로 부른다 — 저장소 밖(설치본)에서 불러도 같은 elanous 를 쓴다.
             : spawnSync(process.execPath, [process.argv[1]!, ...(process.argv.includes('--test') ? ['--test'] : []), ...args], { encoding: 'utf8' });
           return { status: p.status ?? 1, stdout: p.stdout ?? '', stderr: p.stderr ?? '' };
-        },
+        }),
       };
       let result: string;
-      try { result = await executeNextAction(action, deps); } catch (error) {
+      try {
+        if (isEntranceTick) {
+          const results = await executeEntranceTick(parsedInput, deps);
+          result = results.join('\n');
+        } else result = await executeNextAction(action, deps);
+      } catch (error) {
         // 잠금 안 읽기가 손상을 만나면 쓰지 않고 여기로 온다 — 실패로 끝낸다. 그 밖의 오류는 종전대로 올린다.
         if (!(error instanceof TaskAgentStateError)) throw error;
         process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);

package/src/cli/config-audit.ts

@@ -110,6 +110,13 @@ export function recordConfigChange(change: ConfigChange, dbPath?: string): Confi
   }
 }
 
+/** 화면 표시용 값 — 원장과 «같은 가림 자»(비밀 경로 ⊕ 비밀 모양 값 → MASK). set/unset 되읽기 줄이 쓴다. */
+export function maskConfigDisplayValue(key: string, value: unknown): unknown {
+  if (value === undefined) return undefined;
+  if (isSecretPath(key) || isSecretValue(value)) return MASK;
+  return maskDeep(value);
+}
+
 /** 한 키의 감사 이력 — 시간 오름차순. db 파일이 없으면 빈 배열(읽기가 파일을 만들지 않는다). */
 export function readConfigHistory(key: string, dbPath?: string): ConfigChangeRow[] {
   const path = configAuditDbPath(dbPath);
@@ -121,3 +128,115 @@ export function readConfigHistory(key: string, dbPath?: string): ConfigChangeRow
     if (path !== ':memory:') db.close();
   }
 }
+
+// ── CFG-STORE2-HISTORY-REVERT · 조회·되돌림 (0.2.36 · 2026-10-22) ──
+//
+// CFG-STORE2 가 남긴 원장(위)을 «읽어서» 되돌린다. 원장은 append 전용이다 — 되돌림도 UPDATE/DELETE 없이
+// 새 행 하나(prev=지금 값 · next=복원 값 · why='config revert')로만 남는다. 그래서 이력은 «왜 그 값인가» 의
+// 사슬로 남고, 되돌린 되돌림도 다시 한 행이다.
+//
+// ⛔ 불변식
+//   • 되돌릴 «이전 값» 이 MASK 면 복원하지 않는다(원문을 원장에 남기지 않았으므로 복원할 원문이 없다) —
+//     가린 값을 값으로 되쓰는 조용한 오염 대신 «거부» 한다. 그 키는 사람이 다시 set 한다.
+//   • 출력은 언제나 가림을 거친다(maskDeep 재적용) — 화면·JSON 어디에도 비밀 원문이 없다.
+//   • 도메인 합성(아래 configDomainOf)은 «같은 원장 경로» 만 쓴다 — 특수 도메인용 별도 저장소를 만들지 않는다.
+
+/** config 도메인 — 한 키가 어느 특수 도메인의 합성 경계에 속하는가. */
+export type ConfigDomain =
+  | 'llm-policy'
+  | 'account-limits'
+  | 'fallback-chain'
+  | 'pod-pool'
+  | 'author-on-pod'
+  | 'config';
+
+/** 도메인 경계 — 구체 접두가 먼저다(넓은 'llm.' 이 좁은 'llm.limits' 를 삼키지 않게). */
+const CONFIG_DOMAIN_PREFIXES: readonly (readonly [ConfigDomain, readonly string[]])[] = [
+  ['pod-pool', ['podPool', 'harness.podPool']],
+  ['author-on-pod', ['authorOnPod', 'harness.authorOnPod']],
+  ['fallback-chain', ['llm.fallback', 'llm.fallbackChain', 'llm.rotation.fallback', 'llm.providerFallback']],
+  ['account-limits', ['llm.limits', 'llm.accountLimits', 'llm.accountLimit', 'account.']],
+  ['llm-policy', ['llm.']],
+];
+
+/** 한 키의 도메인 — 어느 특수 도메인 접두에도 안 맞으면 'config'(일반 키). */
+export function configDomainOf(key: string): ConfigDomain {
+  const normalized = key.trim();
+  for (const [domain, prefixes] of CONFIG_DOMAIN_PREFIXES) {
+    for (const prefix of prefixes) {
+      if (normalized === prefix) return domain;
+      if (prefix.endsWith('.')) {
+        if (normalized.startsWith(prefix)) return domain;
+      } else if (normalized.startsWith(`${prefix}.`)) {
+        return domain;
+      }
+    }
+  }
+  return 'config';
+}
+
+/** 원장 값 → 실제 값. null = 그 자리에 값이 없었다(undefined) · MASK = 가려서 모른다. */
+export function decodeConfigChangeValue(raw: string | null): unknown {
+  if (raw === null) return undefined;
+  if (raw === MASK) return MASK;
+  try {
+    return JSON.parse(raw) as unknown;
+  } catch {
+    return raw;
+  }
+}
+
+/** 되돌림 계획 — 원장만 보고 정한다(값을 쓰지는 않는다). */
+export type ConfigRevertPlan =
+  | { status: 'no-history' }
+  | { status: 'masked'; last: ConfigChangeRow }
+  | { status: 'already'; last: ConfigChangeRow }
+  | { status: 'restore'; last: ConfigChangeRow; value: unknown };
+
+/**
+ * 값 «전체» 에 가림 자(MASK)가 있는가 — 원시·배열·객체를 깊이 순회한다.
+ * 최상위 문자열 비교만 하면 `["***MASK***"]` 처럼 배열·객체 «속» 에 남은 가림 자를 놓친다.
+ */
+export function containsMaskValue(value: unknown): boolean {
+  if (value === MASK) return true;
+  if (Array.isArray(value)) return value.some((item) => containsMaskValue(item));
+  if (value !== null && typeof value === 'object') {
+    return Object.values(value as Record<string, unknown>).some((item) => containsMaskValue(item));
+  }
+  return false;
+}
+
+/** 그 키의 «마지막 변경» 을 되돌릴 계획. value===undefined 면 그 자리를 지우는 복원이다. */
+export function planConfigRevert(key: string, dbPath?: string): ConfigRevertPlan {
+  const last = readConfigHistory(key, dbPath).at(-1);
+  if (!last) return { status: 'no-history' };
+  // 이전 값이 «어디든» 가려져 있으면 원문 복원 불가 — 가린 값을 값으로 되쓰지 않는다.
+  // 깊이 탐색인 이유: llm.fallbackChain 같은 배열·객체 값은 원장에 ["***MASK***"] 로 남아
+  // 최상위 비교(prev === MASK)로는 안 걸리고, 그대로 되쓰면 MASK 리터럴이 실제 config 값이 된다.
+  if (containsMaskValue(decodeConfigChangeValue(last.prev))) return { status: 'masked', last };
+  if (last.prev === last.next) return { status: 'already', last };
+  return { status: 'restore', last, value: decodeConfigChangeValue(last.prev) };
+}
+
+/** 화면용 값 — 가림을 «한 번 더» 거친다(원장이 이미 가렸어도 표시 자에서 재적용). */
+function renderConfigChangeValue(raw: string | null): string {
+  if (raw === null) return '∅';
+  const decoded = decodeConfigChangeValue(raw);
+  if (decoded === MASK) return MASK;
+  return JSON.stringify(maskDeep(decoded)) ?? 'null';
+}
+
+/** `config history <key>` 출력 — 도메인 ⊕ 행 수 ⊕ (시각 · prev → next · by · why). */
+export function formatConfigHistory(key: string, rows: readonly ConfigChangeRow[]): string {
+  const header = `config history ${key} [${configDomainOf(key)}] — ${rows.length}행`;
+  const lines = rows.map((row) => {
+    const why = row.why ? ` why=${row.why}` : '';
+    return `${row.at}  ${renderConfigChangeValue(row.prev)} → ${renderConfigChangeValue(row.next)}  by=${row.by}${why}`;
+  });
+  return [header, ...lines].join('\n');
+}
+
+/** 되돌림 감사 행 — 같은 원장에 append 만 한다(why 기본값 'config revert'). */
+export function recordConfigRevert(change: ConfigChange, dbPath?: string): ConfigChangeRow {
+  return recordConfigChange({ ...change, why: change.why?.trim() ? change.why.trim() : 'config revert' }, dbPath);
+}

package/src/cli/decisions-cli.ts

@@ -64,7 +64,7 @@ export function formatSeatDecisionRow(e: SeatDecisionRecord): string {
 }
 
 export function formatProposalRow(p: ProposalCard): string {
-  return `${p.id} · ${categoryLabel(p.category)} · ${p.title} · 사실 ${p.factId} · 비용 ${p.cost} · 되돌리기 ${p.undo}${p.thresholds.length ? ` · ${CROWN_MARK} 몫 ${p.thresholds.join('|')}` : ''} · 제안 ${representativeLabel(p.proposedBy)} · ${kst(p.proposedAt)} · 왕복 ${p.roundTrips}/${MAX_REVIEW_ROUND_TRIPS} · ${p.status === 'open' ? '검토 중' : p.status === 'agreed' ? '합의·실행·기록' : '불합의'}`;
+  return `${p.id} · ${categoryLabel(p.category)} · ${p.title} · 사실 ${p.factId} · 비용 ${p.cost} · 되돌리기 ${p.undo}${p.thresholds.length ? ` · ${CROWN_MARK} 몫 ${p.thresholds.join('|')}` : ''} · 제안 ${representativeLabel(p.proposedBy)} · ${kst(p.proposedAt)} · 왕복 ${p.roundTrips}/${MAX_REVIEW_ROUND_TRIPS} · ${p.status === 'open' ? '검토 중' : p.status === 'agreed' ? (p.thresholds.length ? '합의·승인 대기' : '합의·실행·기록') : '불합의'}`;
 }
 
 export function formatCrownCardRow(c: CrownCard): string {
@@ -235,14 +235,15 @@ export function registerDecisionsCommands(program: Command, config: DecisionLedg
     .requiredOption('--category <category>', `합의 범주 (${CONSENSUS_CATEGORIES.join('|')})`)
     .requiredOption('--title <text>').requiredOption('--fact-id <id>', '사실 id')
     .requiredOption('--cost <text>', '비용').requiredOption('--undo <text>', '되돌리기')
+    .option('--work-key <orch:card:cell>', 'splitter 교차 영향 작업 키')
     .option('--threshold <category>', `${CROWN_MARK} 몫 임계 범주 (반복: ${CROWN_THRESHOLD_CATEGORIES.join('|')})`, repeat, [])
     .option('--provider <name>', 'LLM 제공자 표식 — 가능하면 상대와 다른 제공자 (메아리 방지)')
     .option('--json').option('--hq-override')
-    .action((o: { by: string; category: string; title: string; factId: string; cost: string; undo: string; threshold: string[]; provider?: string; json?: boolean; hqOverride?: boolean }) => fail(() => {
+    .action((o: { by: string; category: string; title: string; factId: string; cost: string; undo: string; workKey?: string; threshold: string[]; provider?: string; json?: boolean; hqOverride?: boolean }) => fail(() => {
       if (!mayWrite('consensus propose', o.hqOverride)) return;
       const proposal = consensusEngine().propose({
         by: o.by as ConsensusRepresentative, category: o.category as ConsensusCategory, title: o.title, factId: o.factId, cost: o.cost, undo: o.undo,
-        thresholds: o.threshold.map(threshold => threshold as DecisionCategory), provider: o.provider,
+        workKey: o.workKey, thresholds: o.threshold.map(threshold => threshold as DecisionCategory), provider: o.provider,
       });
       return emit(proposal, o.json, `제안: ${formatProposalRow(proposal)}`);
     }));
@@ -263,7 +264,9 @@ export function registerDecisionsCommands(program: Command, config: DecisionLedg
     .option('--json').option('--hq-override')
     .action((id: string, o: { by: string; claim?: string; provider?: string; json?: boolean; hqOverride?: boolean }) => fail(() => {
       if (!mayWrite('consensus agree', o.hqOverride)) return;
-      const { proposal, crownCard } = consensusEngine().agree(id, { by: o.by as ConsensusRepresentative, claim: o.claim, provider: o.provider });
+      const consensus = consensusEngine();
+      const { proposal, crownCard } = consensus.agree(id, { by: o.by as ConsensusRepresentative, claim: o.claim, provider: o.provider });
+      if (!crownCard && !consensus.canExecute(proposal.id)) throw new Error(`합의 실행 관문 거부: ${proposal.id}`);
       return emit({ proposal, ...(crownCard ? { crownCard } : {}) }, o.json,
         `합의: ${formatProposalRow(proposal)}${crownCard ? `\n${CROWN_MARK} 카드: ${formatCrownCardRow(crownCard)}` : ''}`);
     }));

package/src/cli/doctor-cli.ts

@@ -44,9 +44,12 @@ import {
   DOCTOR_SYMPTOMS,
   DOCTOR_VISIT_SOURCES,
   doctorVisitRunExists,
+  doctorReviewVisits,
   isDoctorSymptom,
   isDoctorVisitSource,
   readDoctorVisits,
+  readDoctorReviewBrief,
+  recordAutoLongRunVisit,
   recordDoctorVisit,
   type DoctorSymptom,
 } from '../self-implement/doctor-visit.js';
@@ -54,6 +57,8 @@ import { formatHostDoctorLines, runHostDoctor, type HostDoctorExpected, type Hos
 import { listMachineResources } from './control-cli.js';
 import type { ResourceView } from '../control-plane/ledger.js';
 import { loadMachineLedger } from '../machines/machine-ledger.js';
+import { LogStore, logsDbPath, type LogStoreRow } from '../mss/logging/log-store.js';
+import { reviewBriefEvidence } from '../self-implement/review-round-brief.js';
 
 function defaultCheckPythonEnv(): { status: 'ok' | 'fixable' | 'manual'; evidence: string; remedy?: string } {
   const c = checkPythonEnv(false);
@@ -222,8 +227,49 @@ export interface DoctorCliDeps extends DoctorOptions, Pick<DoctorFixDeps, 'home'
   hostDoctorMachineResources?: () => Promise<ResourceView[]>;
   /** `doctor visit`/`doctor status` 원장 디렉터리(시험 seam) — 기본 = `runLedgerDir()`. */
   doctorVisitLedgerDir?: string;
+  /** Isolated saved-review and PR metadata seams. */
+  reviewResultsDir?: string;
+  readReviewBriefPr?: Parameters<typeof readDoctorReviewBrief>[1];
+  /** Optional isolated observation transport and status reader for CLI tests. */
+  reviewBriefLog?: (event: Record<string, unknown>) => void;
+  readReviewBriefEvents?: (runId?: string) => Array<{ timestamp?: string; sequence?: number; runId?: string; key?: string; evidence?: string }>;
   /** `doctor visit` 사고 선례 연결 루트(시험 seam) — 기본 = `doctorVisitIncidentRoot()` · `null` 이면 건너뛴다. */
   doctorVisitIncidentRoot?: string | null;
+  /** Deterministic clock for `doctor auto-long-run` isolated CLI tests. */
+  doctorAutoLongRunNow?: () => string;
+  /** Standalone logs.db registration seam for the two run-doctor CLI emitters. */
+  registerDoctorLogSink?: () => Promise<unknown>;
+  /** Flush seam paired with registerDoctorLogSink. */
+  flushDoctorLogs?: () => void;
+}
+
+export function parseReviewBriefLogData(raw: unknown): Record<string, unknown> {
+  let data: unknown;
+  try { data = typeof raw === 'string' ? JSON.parse(raw) : raw; }
+  catch (error) { throw new Error(`malformed doctor.review/brief-issued event: ${error instanceof Error ? error.message : String(error)}`); }
+  if (!data || typeof data !== 'object' || Array.isArray(data)) throw new Error('malformed doctor.review/brief-issued event: expected object data');
+  const value = data as Record<string, unknown>;
+  if (typeof value.pr !== 'number' || typeof value.head !== 'string' || typeof value.round !== 'number') {
+    throw new Error('malformed doctor.review/brief-issued event: required pr/head/round fields are missing');
+  }
+  return value;
+}
+
+function readReviewBriefEventsFromLogs(dbPath = logsDbPath(), runId?: string): Array<{ timestamp?: string; sequence?: number; runId?: string; key?: string; evidence?: string }> {
+  if (!existsSync(dbPath)) return [];
+  let store: LogStore | undefined;
+  try {
+    store = LogStore.openReadOnly(dbPath);
+    return store.queryAll({ exactCategories: ['doctor.review'], events: ['brief-issued'] }).flatMap((row: LogStoreRow) => {
+      const data = parseReviewBriefLogData(row.data);
+      const rowRunId = typeof data.runId === 'string' && data.runId ? data.runId : undefined;
+      if (runId !== undefined && rowRunId !== runId) return [];
+      return [{ timestamp: new Date(row.ts_ms).toISOString(), sequence: row.id, ...(rowRunId ? { runId: rowRunId } : {}), key: String(data.pr), evidence: `PR #${data.pr} head ${data.head.slice(0, 12)} r${data.round} rx=${String(data.rx)}${data.source === 'pr-disposition' ? ' source=pr-disposition' : ''}` }];
+    });
+  } catch (error) {
+    throw new Error(`review event logs could not be read: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  finally { store?.close(); }
 }
 
 const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
@@ -1290,6 +1336,9 @@ export function registerDoctorCommand(program: Command, deps: DoctorCliDeps = {}
   const out = deps.out ?? { log: (value: string) => console.log(value) };
   const err = deps.err ?? { error: (value: string) => console.error(value) };
   const setExitCode = deps.setExitCode ?? ((code: number) => { process.exitCode = code; });
+  const registerDoctorLogSink = deps.registerDoctorLogSink ?? (async () =>
+    (await import('../domains/standalone-log-sink.js')).registerStandaloneLogSink('cli'));
+  const flushDoctorLogs = deps.flushDoctorLogs ?? (() => debug.flush());
   const doctor = program.command('doctor')
     .description('Reports whether credentials resolve and where each resolution comes from')
     .option('--json', 'structured output');
@@ -1350,6 +1399,28 @@ export function registerDoctorCommand(program: Command, deps: DoctorCliDeps = {}
       out.log(json ? JSON.stringify(report, null, 2) : formatHostDoctorLines(report).join('\n'));
       if (!report.ok) setExitCode(1);
     });
+  doctor.command('auto-long-run')
+    .description('Record one automatic doctor visit when a running Pod crosses 60 minutes')
+    .argument('<runId>', 'run id whose ledger receives the visit')
+    .requiredOption('--started-at <iso>', 'Pod status.startTime as an ISO timestamp')
+    .option('--json', 'structured output')
+    .action(async (runId: string, opts: { startedAt: string; json?: boolean }, command: Command) => {
+      const json = opts.json === true || command.parent?.opts().json === true;
+      try {
+        await registerDoctorLogSink();
+        const result = recordAutoLongRunVisit({ runId, startedAt: opts.startedAt,
+          ...(deps.doctorAutoLongRunNow ? { now: deps.doctorAutoLongRunNow() } : {}),
+          ...(deps.doctorVisitLedgerDir !== undefined ? { dir: deps.doctorVisitLedgerDir } : {}) });
+        out.log(json ? JSON.stringify(result) : `doctor auto-long-run: runId=${runId} status=${result.status}`);
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        if (json) out.log(JSON.stringify({ status: 'rejected', reason }));
+        else err.error(reason);
+        setExitCode(1);
+      } finally {
+        flushDoctorLogs();
+      }
+    });
   doctor.command('visit')
     .description('Record a doctor visit (triage symptom) in the run ledger of that run')
     .argument('<runId>', 'run id whose ledger receives the visit')
@@ -1357,7 +1428,7 @@ export function registerDoctorCommand(program: Command, deps: DoctorCliDeps = {}
     .requiredOption('--from <who>', `closed sender list: ${DOCTOR_VISIT_SOURCES.join(', ')}`)
     .option('--evidence <text>', 'free-text evidence recorded with the visit')
     .option('--json', 'structured output')
-    .action((runId: string, opts: { symptom: string; from: string; evidence?: string; json?: boolean }, command: Command) => {
+    .action(async (runId: string, opts: { symptom: string; from: string; evidence?: string; json?: boolean }, command: Command) => {
       const json = opts.json === true || command.parent?.opts().json === true;
       if (!isDoctorSymptom(opts.symptom)) {
         const reason = `unknown symptom: ${opts.symptom} — closed list: ${DOCTOR_SYMPTOMS.join(', ')}`;
@@ -1374,6 +1445,7 @@ export function registerDoctorCommand(program: Command, deps: DoctorCliDeps = {}
         return;
       }
       try {
+        await registerDoctorLogSink();
         const visit = recordDoctorVisit({
           runId,
           from: opts.from,
@@ -1388,6 +1460,54 @@ export function registerDoctorCommand(program: Command, deps: DoctorCliDeps = {}
         if (json) out.log(JSON.stringify({ status: 'rejected', reason }));
         else err.error(reason);
         setExitCode(1);
+      } finally {
+        flushDoctorLogs();
+      }
+    });
+  doctor.command('review-brief')
+    .description('Build a review-round card from saved reviews for the current PR head')
+    .requiredOption('--pr <number>', 'PR number')
+    .option('--json', 'structured output')
+    .action(async (opts: { pr: string; json?: boolean }, command: Command) => {
+      const json = opts.json === true || command.parent?.opts().json === true;
+      const pr = Number(opts.pr);
+      if (!Number.isSafeInteger(pr) || pr <= 0) {
+        const reason = 'PR number must be a positive integer';
+        if (json) out.log(JSON.stringify({ status: 'rejected', reason })); else err.error(reason);
+        setExitCode(1);
+        return;
+      }
+      try {
+        const brief = readDoctorReviewBrief(pr, deps.readReviewBriefPr, deps.reviewResultsDir);
+        const event = reviewBriefEvidence(brief);
+        const intentBlock = typeof event.intentBlock === 'string' ? event.intentBlock : null;
+        if (deps.reviewBriefLog) deps.reviewBriefLog(event);
+        else {
+          await (await import('../domains/standalone-log-sink.js')).registerStandaloneLogSink('cli');
+          debug.log('doctor.review', 'brief-issued', event);
+          debug.flush();
+        }
+        out.log(json ? JSON.stringify({ ...brief, intentBlock }, null, 2) : [
+          `PR #${pr} · ${brief.status} · rounds=${brief.rounds} · head=${brief.head.slice(0, 12)} · verdict=${brief.reviewedVerdict} · rx=${brief.rx}`,
+          ...(brief.dispositionEvidence ? [`Source: PR author disposition (current head review unmeasured) · ${brief.dispositionEvidence}`] : []),
+          ...(brief.goalQuestion ? [`Original question: ${brief.goalQuestion}`] : []),
+          ...(brief.acceptanceSignal.length ? ['Acceptance signal:', ...brief.acceptanceSignal.map((item) => `  - ${item}`)] : []),
+          `Core items (${brief.coreItems.length}/${brief.totalCoreItems}):`,
+          ...brief.coreItems.map((item) => `  [${item.kind}] ${item.text}`),
+          ...(brief.omittedCoreItems ? [`Core items omitted: ${brief.omittedCoreItems}; source files: ${brief.resultPaths.join(', ')}`] : []),
+          `Prior findings (${brief.priorFindings.length}/${brief.totalPriorFindings}):`, ...brief.priorFindings.map((item) => `  [${item.kind} · ${item.sourceHead.slice(0, 12)}] ${item.text}`),
+          ...(brief.omittedPriorFindings ? [`Prior findings omitted: ${brief.omittedPriorFindings}; source files: ${brief.resultPaths.join(', ')}`] : []),
+          `Scope candidates (${brief.scopeItems.length}/${brief.totalScopeItems}):`, ...brief.scopeItems.map((item) => `  [${item.kind}] ${item.text}`),
+          ...(brief.omittedScopeItems ? [`Scope candidates omitted: ${brief.omittedScopeItems}; source files: ${brief.resultPaths.join(', ')}`] : []),
+          ...(brief.resultPaths.length ? [`Review source files: ${brief.resultPaths.join(', ')}`] : []),
+          `Scope boundary: ${brief.scopeBoundary}`,
+          ...(intentBlock ? ['R3 intent shadow output:', intentBlock] : []),
+          ...(brief.reason ? [`Reason: ${brief.reason}`] : []),
+        ].join('\n'));
+      } catch (error) {
+        const reason = observationError(error);
+        if (json) out.log(JSON.stringify({ status: 'unavailable', pr, reason })); else err.error(reason);
+        setExitCode(1);
       }
     });
   doctor.command('status')
@@ -1405,18 +1525,29 @@ export function registerDoctorCommand(program: Command, deps: DoctorCliDeps = {}
         return;
       }
       const visits = readDoctorVisits(opts.run, ledgerScope);
+      let reviewEvents: Array<{ timestamp?: string; sequence?: number; runId?: string; key?: string; evidence?: string }>;
+      try {
+        reviewEvents = (deps.readReviewBriefEvents ?? ((runId?: string) => readReviewBriefEventsFromLogs(logsDbPath(), runId)))(opts.run);
+      } catch (error) {
+        const reason = observationError(error);
+        if (json) out.log(JSON.stringify({ status: 'unavailable', reason, recordedVisits: visits }, null, 2));
+        else out.log(`Doctor status unavailable: ${reason}\nRecorded doctor visits: ${visits.length}`);
+        setExitCode(1);
+        return;
+      }
+      const statusVisits = [...visits, ...doctorReviewVisits(reviewEvents)];
       const counts = Object.fromEntries(DOCTOR_SYMPTOMS.map((symptom: DoctorSymptom) => [symptom, 0])) as Record<DoctorSymptom, number>;
-      for (const visit of visits) counts[visit.symptom] += 1;
+      for (const visit of statusVisits) counts[visit.symptom] += 1;
       if (json) {
-        out.log(JSON.stringify({ total: visits.length, counts, visits }, null, 2));
+        out.log(JSON.stringify({ total: statusVisits.length, counts, visits: statusVisits }, null, 2));
         return;
       }
       out.log([
-        `Doctor visits: ${visits.length}`,
+        `Doctor visits: ${statusVisits.length}`,
         ...DOCTOR_SYMPTOMS.map((symptom: DoctorSymptom) => `  ${symptom}: ${counts[symptom]}`),
         'Recent visits:',
-        ...visits.map((visit) => `  ${visit.timestamp ?? 'unknown-time'} runId=${visit.runId} from=${visit.from} symptom=${visit.symptom}${visit.evidence !== undefined ? ` evidence=${visit.evidence}` : ''}`),
-        ...(visits.length === 0 ? ['  none'] : []),
+        ...statusVisits.map((visit) => `  ${visit.timestamp ?? 'unknown-time'}${visit.runId ? ` runId=${visit.runId}` : ''} from=${visit.from} symptom=${visit.symptom}${visit.evidence !== undefined ? ` evidence=${visit.evidence}` : ''}`),
+        ...(statusVisits.length === 0 ? ['  none'] : []),
       ].join('\n'));
     });
   doctor

package/src/cli/guardian-cli.ts

@@ -19,6 +19,16 @@ async function guardianPlan(): Promise<{ db: Database; plan: GuardianPlan }> {
 
 export function registerGuardianCommands(program: Command): void {
   const guardian = program.command('guardian').description('크론 수호자 그림자 관측(기존 크론·알림 무변경)');
+  guardian.command('doctor-shadow')
+    .description('기록된 admit-starved 진료 요청을 재평가 처방으로 기록(집행 없음)')
+    .requiredOption('--run <runId>', '진료 요청이 기록된 런')
+    .option('--json', 'JSON 출력')
+    .action(async (opts: { run: string; json?: boolean }) => {
+      const { recordShadowDoctorReevaluation } = await import('../self-implement/doctor-visit.js');
+      const result = recordShadowDoctorReevaluation(opts.run);
+      if (opts.json) await writeStdoutJson(JSON.stringify(result) + '\n');
+      else console.log(`doctor shadow: runId=${opts.run} status=${result.status} rx=${result.rx ?? 'none'} outcome=${result.outcome ?? 'none'} executed=0`);
+    });
   guardian.command('grok-expiry').description('현재 호스트 Grok 구독 만료 시각과 4시간 경보 상태 출력')
     .action(async () => {
       const { readGrokSubscriptionExpiry } = await import('../grok/credential.js');