elanous 0.2.36 → 0.2.37

package/src/dashboard/synchronized-frame-output.ts

@@ -0,0 +1,74 @@
+/**
+ * TUI-FLICKER-DRAW-INTEGRATION — one synchronized-output owner per dashboard frame.
+ *
+ * A dashboard frame is not a single write: the transient-overlay cleanup, the
+ * base frame, the coordinator modal overlay, the prompt repaint and the
+ * post-frame overlay stamp are flushed one after another. Under tmux each of
+ * those flushes is presented on its own, so a tick that rewrites the frame is
+ * visible as a flicker. Wrapping the whole compose in DEC synchronized output
+ * (`CSI ? 2026 h` … `CSI ? 2026 l`) lets the terminal present the composite
+ * frame atomically.
+ *
+ * The owner is deliberately tiny and synchronous: callers open it, draw, and
+ * close it in a `finally` so a throw inside the draw still emits the ESU and
+ * the *next* frame is not swallowed by a dangling synchronized-output region.
+ *
+ * The wrap nests with the display coordinator, which opens the same region
+ * around its own flush and whose `onRender` hook is what calls `drawNow()`.
+ * `src/display/synchronized-output-region.ts` keeps that single-owner: an
+ * inner open contributes no bytes, so the coordinator's overlay + cursor stamp
+ * stays inside the one presentation instead of being pushed out by an early
+ * inner ESU.
+ */
+
+import {
+  SYNCHRONIZED_OUTPUT_BEGIN,
+  SYNCHRONIZED_OUTPUT_END,
+  openSynchronizedOutputRegion,
+  synchronizedOutputDisabledByEnv,
+} from '../display/synchronized-output-region.js';
+
+export { SYNCHRONIZED_OUTPUT_BEGIN, SYNCHRONIZED_OUTPUT_END };
+
+export interface SynchronizedFrameOutputDeps {
+  /** Sink for the control sequences — production passes `process.stdout.write`. */
+  write: (chunk: string) => void;
+  /**
+   * Whether the sink may receive DEC 2026. Defaults to `true`. Production
+   * passes `process.stdout.isTTY` so piped/captured output stays
+   * byte-identical to what it was before this seam existed.
+   */
+  supported?: boolean;
+  /** Environment escape hatch (`ELANOUS_SYNC_OUTPUT=off`). Defaults to `process.env`. */
+  env?: Record<string, string | undefined>;
+}
+
+export interface SynchronizedFrameOutput {
+  /** Closes the region. Idempotent — a second call writes nothing. */
+  close: () => void;
+}
+
+export function beginSynchronizedFrameOutput(
+  deps: SynchronizedFrameOutputDeps,
+): SynchronizedFrameOutput {
+  const region = openSynchronizedOutputRegion();
+  const enabled =
+    region.outermost && deps.supported !== false && !synchronizedOutputDisabledByEnv(deps.env);
+  let closed = false;
+  if (enabled) {
+    try {
+      deps.write(SYNCHRONIZED_OUTPUT_BEGIN);
+    } catch (err) {
+      region.close();
+      throw err;
+    }
+  }
+  return {
+    close: () => {
+      if (closed) return;
+      closed = true;
+      if (enabled) deps.write(SYNCHRONIZED_OUTPUT_END);
+      region.close();
+    },
+  };
+}

package/src/display/coordinator.ts

@@ -22,6 +22,10 @@ import { TIER_ORDER, tierRank, tiersCompatible } from './types.js';
 import { resolveKeyAlias } from '../input-core/key-alias-table.js';
 import type { DisplayEventBus } from './events.js';
 import { paintCursor, type CursorState } from './cursor-state.js';
+import {
+  openSynchronizedOutputRegion,
+  synchronizedOutputDisabledByEnv,
+} from './synchronized-output-region.js';
 import { deriveCursor, type CursorDecision } from './cursor-owner.js';
 import {
   createVirtualCursorRegistry,
@@ -261,7 +265,6 @@ export class DisplayCoordinator {
    *  even when its bytes are unchanged, because the base rows under it
    *  were just repainted. Replaces the old forceNext follow-up. */
   private overlayRowsInvalidated = false;
-
   private surfaces = new Map<SurfaceId, DisplaySurface>();
   private focusNodes = new Map<SurfaceId, FocusNode>();
   private keyBindings = new Map<string, DisplayKeyBinding>();
@@ -288,6 +291,7 @@ export class DisplayCoordinator {
   private dirty = new Set<SurfaceId | 'all' | 'status' | 'dock'>();
   private forceNext = false;
   private scheduled: Timer | null = null;
+  private scheduleGeneration = 0;
   // P2.2.b — cursor state. Last-writer-wins. cursorVersion bumps on
   // every setCursor; lastEmittedCursorVersion tracks what's been
   // written so flushCursor only emits on change.
@@ -966,6 +970,36 @@ export class DisplayCoordinator {
     }, 'dashboard');
   }
 
+  /** Mark a render dirty and flush it before returning. Used when a host
+   *  already owns a synchronized output batch around the render. */
+  requestRenderNow(opts?: { region?: SurfaceId | 'all'; force?: boolean }): void {
+    this.markDirty(opts?.region ?? 'all');
+    if (opts?.force) this.forceNext = true;
+    this.scheduleGeneration += 1;
+    this.scheduled = null;
+    this.flush();
+  }
+
+  /** Run synchronous terminal writes inside DECSET 2026 when enabled.
+   *  Coordinator flushes, the dashboard draw seam, and host paint batches
+   *  share the same re-entrant region instead of emitting nested markers. */
+  withSynchronizedOutput<T>(paint: () => T): T {
+    const syncRegion = openSynchronizedOutputRegion();
+    const syncOutput = syncRegion.outermost && this.syncOutputEnabled;
+    try {
+      if (syncOutput) {
+        this.writeOverlay?.('\x1b[?2026h');
+      }
+      return paint();
+    } finally {
+      try {
+        if (syncOutput) this.writeOverlay?.('\x1b[?2026l');
+      } finally {
+        syncRegion.close();
+      }
+    }
+  }
+
   handle(owner: SurfaceOwner): DisplayHandle {
     return {
       owner,
@@ -2629,10 +2663,16 @@ export class DisplayCoordinator {
 
   private requestFrame(): void {
     if (this.scheduled !== null) return;
-    this.scheduled = this.scheduleFn(() => {
+    const generation = ++this.scheduleGeneration;
+    const marker = {} as Timer;
+    let scheduled: Timer | undefined;
+    this.scheduled = marker;
+    scheduled = this.scheduleFn(() => {
+      if (generation !== this.scheduleGeneration || (this.scheduled !== marker && this.scheduled !== scheduled)) return;
       this.scheduled = null;
       this.flush();
     }, this.frameMs);
+    if (this.scheduled === marker) this.scheduled = scheduled;
   }
 
   private flush(): void {
@@ -2661,9 +2701,7 @@ export class DisplayCoordinator {
     // `ELANOUS_SYNC_OUTPUT=off` for buggy terminals (none observed in
     // practice, 2026-04-21). Pattern matches Textual (synchronized
     // output since v0.47) + Ratatui backend buffer-swap semantics.
-    const syncOutput = this.syncOutputEnabled;
-    if (syncOutput) this.writeOverlay?.('\x1b[?2026h');
-    try {
+    this.withSynchronizedOutput(() => {
       // H1.6 · W2 shadow flush. Fires rc.on('before-flush') +
       // rc.on('after-flush') synchronously. Subscriber paints (if any
       // are wired in Phase γ) land INSIDE the DECSET 2026 atomic-frame
@@ -2696,11 +2734,7 @@ export class DisplayCoordinator {
       // so the prior cursor position may have been overwritten. Always
       // re-assert. The bypass-batch path calls flushCursor(false).
       this.flushCursor(true);
-    } finally {
-      // Always close the sync block — a throw inside render hooks
-      // must not leave the terminal stuck in "buffering" mode.
-      if (syncOutput) this.writeOverlay?.('\x1b[?2026l');
-    }
+    });
     this.eventBus?.emit({ type: 'render:after', request, snapshot });
     this.pendingWidgetPatches = [];
     this.pendingLogLines = [];
@@ -2713,8 +2747,7 @@ export class DisplayCoordinator {
    *  not a TTY (unit-test + CI environment) so overlay assertions
    *  don't have to strip the ?2026h / ?2026l pair. */
   private get syncOutputEnabled(): boolean {
-    const v = (process.env.ELANOUS_SYNC_OUTPUT ?? 'on').toLowerCase();
-    if (v === 'off' || v === '0' || v === 'false') return false;
+    if (synchronizedOutputDisabledByEnv()) return false;
     // Non-TTY environments (tests, piped output) gain nothing from
     // atomic frame wrapping and the sequences would pollute assertions.
     if (typeof process !== 'undefined' && process.stdout && process.stdout.isTTY !== true) {

package/src/display/resize-listener.ts

@@ -5,10 +5,9 @@
 // resize produced a stale paint (old input prompt row + ghost tab
 // bar) until the next keystroke triggered a redraw.
 //
-// Strategy: on every stdout resize event, (1) push a forced dashboard
-// redraw and (2) invoke the prompt's repaint hook so input-mode
-// overlays catch up too. Both calls are wrapped in try/catch so a
-// transient paint error doesn't kill the listener.
+// Strategy: debounce resize bursts for one frame (16ms), then paint the
+// dashboard, prompt, and overlays synchronously inside one atomic output
+// block. Transient paint errors do not kill the listener.
 //
 // (3) TUI-PICKER-RESIZE-SHRINK (#76 · 2026-10-17) — then ask the
 // coordinator for one FORCED frame. Steps (1)+(2) bypass the
@@ -28,6 +27,8 @@
 
 import { debug } from '../debug/log.js';
 
+const RESIZE_DEBOUNCE_MS = 16;
+
 export interface ResizeListenerDeps {
   draw: (opts?: { force?: boolean }) => void;
   promptCtl: { repaint: () => void };
@@ -35,6 +36,9 @@ export interface ResizeListenerDeps {
    *  re-emitted on top of the chrome the prompt repaint just wrote.
    *  Optional: hosts without a coordinator keep the legacy two-step. */
   requestOverlayFrame?: () => void;
+  /** Run the whole resize repaint batch inside the host's atomic output
+   *  block. Nested coordinator frames must share this outer block. */
+  withSynchronizedOutput?: (paint: () => void) => void;
 }
 
 /** Registers the resize listener and returns a dispose fn that
@@ -42,26 +46,43 @@ export interface ResizeListenerDeps {
  *  fresh listener; the caller is responsible for disposing previous
  *  installations. */
 export function installResizeListener(deps: ResizeListenerDeps): () => void {
-  const handler = (): void => {
-    try { deps.draw({ force: true }); } catch { /* swallow — paint errors shouldn't break resize */ }
-    try { deps.promptCtl.repaint(); } catch { /* swallow */ }
-    let overlayFrame: 'requested' | 'absent' | 'failed' = 'absent';
-    if (deps.requestOverlayFrame) {
-      try {
-        deps.requestOverlayFrame();
-        overlayFrame = 'requested';
-      } catch {
-        overlayFrame = 'failed';
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let disposed = false;
+  const repaint = (): void => {
+    timer = undefined;
+    if (disposed) return;
+    const paint = (): void => {
+      try { deps.draw({ force: true }); } catch { /* swallow — paint errors shouldn't break resize */ }
+      try { deps.promptCtl.repaint(); } catch { /* swallow */ }
+      let overlayFrame: 'requested' | 'absent' | 'failed' = 'absent';
+      if (deps.requestOverlayFrame) {
+        try {
+          deps.requestOverlayFrame();
+          overlayFrame = 'requested';
+        } catch {
+          overlayFrame = 'failed';
+        }
       }
-    }
-    debug.log('display.resize', 'repaint', {
-      cols: process.stdout.columns ?? null,
-      rows: process.stdout.rows ?? null,
-      overlayFrame,
-    });
+      debug.log('display.resize', 'repaint', {
+        cols: process.stdout.columns ?? null,
+        rows: process.stdout.rows ?? null,
+        overlayFrame,
+      });
+    };
+    try {
+      if (deps.withSynchronizedOutput) deps.withSynchronizedOutput(paint);
+      else paint();
+    } catch { /* resize painting must not detach the listener */ }
+  };
+  const handler = (): void => {
+    if (timer !== undefined) clearTimeout(timer);
+    timer = setTimeout(repaint, RESIZE_DEBOUNCE_MS);
   };
   process.stdout.on('resize', handler);
   return (): void => {
+    disposed = true;
+    if (timer !== undefined) clearTimeout(timer);
+    timer = undefined;
     process.stdout.removeListener('resize', handler);
   };
 }

package/src/display/synchronized-output-region.ts

@@ -0,0 +1,60 @@
+/**
+ * DECSET 2026 (synchronized output) region registry.
+ *
+ * Two owners wrap their writes in `CSI ? 2026 h` … `CSI ? 2026 l`: the
+ * display coordinator (`flush()`) and the dashboard draw seam
+ * (`src/dashboard/synchronized-frame-output.ts`). They nest — the
+ * coordinator opens a region and its `onRender` hook runs `drawNow()`,
+ * which wants the same wrap for the frame + prompt repaint. A second pair
+ * emitted inside the outer one is not harmless: the inner ESU flushes the
+ * terminal early, so everything the coordinator writes afterwards (modal
+ * overlay, cursor) lands in a separate presentation — exactly the flicker
+ * the wrap exists to prevent.
+ *
+ * The registry makes the wrap re-entrant: whoever opens first owns the
+ * byte pair; nested openers contribute no bytes and never close the outer
+ * region. Every opener must close its handle (idempotent) so the depth
+ * stays balanced even when a draw throws.
+ */
+
+export const SYNCHRONIZED_OUTPUT_BEGIN = '\x1b[?2026h';
+export const SYNCHRONIZED_OUTPUT_END = '\x1b[?2026l';
+
+export interface SynchronizedOutputRegion {
+  /** true when this region owns the emitted BSU/ESU pair. */
+  readonly outermost: boolean;
+  /** Idempotent — closes this region exactly once. */
+  close(): void;
+}
+
+let openDepth = 0;
+
+/** True while any owner holds a synchronized-output region open. */
+export function isSynchronizedOutputRegionOpen(): boolean {
+  return openDepth > 0;
+}
+
+/**
+ * `ELANOUS_SYNC_OUTPUT=off|0|false` escape hatch for terminals that
+ * mishandle DEC 2026. Anything else (including unset) keeps the wrap on.
+ */
+export function synchronizedOutputDisabledByEnv(
+  env: Record<string, string | undefined> = process.env,
+): boolean {
+  const value = (env.ELANOUS_SYNC_OUTPUT ?? 'on').toLowerCase();
+  return value === 'off' || value === '0' || value === 'false';
+}
+
+export function openSynchronizedOutputRegion(): SynchronizedOutputRegion {
+  const outermost = openDepth === 0;
+  openDepth += 1;
+  let closed = false;
+  return {
+    outermost,
+    close(): void {
+      if (closed) return;
+      closed = true;
+      if (openDepth > 0) openDepth -= 1;
+    },
+  };
+}

package/src/domains/surface-events.ts

@@ -172,10 +172,58 @@ export function recordInboundTurn(
   finally { if (ownDb) db.close(); }
 }
 
+/** 발화 «원천» — 사람이 말한 것과 시험 fixture·외부 CLI agent 가 던진 것을 계측상 구분한다.
+ *  ⛔ 원천 표기가 없는 0건을 «사람 표본 0» 으로 오인하면 안 되고, 반대로 시험 fixture 가
+ *  사람과 같은 서피스(cli·telegram)에 기록됐다는 이유로 사람 표본으로 세어도 안 된다. */
+export type SurfaceUtteranceOrigin = 'human' | 'test-fixture' | 'external-cli-agent' | 'elanous-self' | 'unknown';
+
+const TEST_FIXTURE_ORIGIN = /^(?:test-fixture|test_fixture|fixture|test|test-runner|bun-test)$/i;
+const HUMAN_ORIGIN = /^(?:human|user|tui|pwa|telegram|discord|cli)$/i;
+const EXTERNAL_CLI_AGENT_ORIGIN = /^(?:claude-code|codex|gemini|agent|external|external-cli-agent|external:[\w-]+|ext:[\w-]+)$/i;
+const HUMAN_PROSE_SURFACE = /^(?:cli|tui|pwa|telegram|discord|ipad|watch)$/i;
+
+function refsOf(raw: string | null): Record<string, unknown> {
+  if (!raw) return {};
+  try {
+    const value: unknown = JSON.parse(raw);
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {};
+  } catch { return {}; }
+}
+
+/** 원천 분류기 — provenance(recordInboundTurn opts.origin → refs.origin/tags.origin:<origin>)
+ *  표기를 먼저 읽고, 표기가 없을 때만 서피스로 추정한다. 시험 fixture 는 서피스 추정 «전에» 가른다. */
+export function classifySurfaceUtteranceOrigin(
+  row: Pick<SurfaceEventRow, 'direction' | 'surface' | 'kind' | 'refs' | 'tags'>,
+): SurfaceUtteranceOrigin {
+  if (row.direction !== 'inbound') return 'unknown';
+  const refs = refsOf(row.refs);
+  const explicit = typeof refs.origin === 'string' ? refs.origin : undefined;
+  const utteranceOrigin = typeof refs.utteranceOrigin === 'string' ? refs.utteranceOrigin : undefined;
+  const fixtureTagged = (row.tags ?? '').split(/\s+/).filter(Boolean)
+    .some((tag) => TEST_FIXTURE_ORIGIN.test(tag.split(':').pop() ?? ''));
+  if ((utteranceOrigin && TEST_FIXTURE_ORIGIN.test(utteranceOrigin)) || (explicit && TEST_FIXTURE_ORIGIN.test(explicit)) || fixtureTagged) {
+    return 'test-fixture';
+  }
+  if (utteranceOrigin === 'human') return 'human';
+  if (utteranceOrigin === 'agent') return 'external-cli-agent';
+  if (explicit) {
+    if (HUMAN_ORIGIN.test(explicit)) return 'human';
+    if (EXTERNAL_CLI_AGENT_ORIGIN.test(explicit)) return 'external-cli-agent';
+  }
+  // recordInboundTurn marks its recorder as elanous-self; on chat Q&A the speaker is the human.
+  if (row.kind === 'qna' && /^(?:telegram|discord)$/i.test(row.surface)) return 'human';
+  if (explicit === 'elanous-self') return 'elanous-self';
+  if (/^ext:/i.test(row.surface)) return 'external-cli-agent';
+  if (HUMAN_PROSE_SURFACE.test(row.surface)) return 'human';
+  return 'unknown';
+}
+
 export interface SurfaceUtteranceQuery {
   from: string;
   to: string;
   surface?: string;
+  /** 원천 필터(선택) — 미지정이면 종전과 같이 창 안의 모든 발화를 읽는다(보존 계약). */
+  origin?: SurfaceUtteranceOrigin | readonly SurfaceUtteranceOrigin[];
 }
 
 /** Read every event in a half-open UTC interval without touching recall state. */
@@ -183,9 +231,40 @@ export function querySurfaceUtterances(db: Database, opts: SurfaceUtteranceQuery
   const where = ["julianday(e.ts) >= julianday(?)", "julianday(e.ts) < julianday(?)", "e.direction = 'inbound'", "e.kind IN ('utterance', 'qna')"];
   const params: string[] = [opts.from, opts.to];
   if (opts.surface) { where.push('e.surface = ?'); params.push(opts.surface); }
-  return db.prepare(
+  const rows = db.prepare(
     `SELECT e.* FROM events e WHERE ${where.join(' AND ')} ORDER BY julianday(e.ts) ASC, e.id ASC`,
   ).all(...params) as SurfaceEventRow[];
+  if (opts.origin === undefined) return rows;
+  const wanted = new Set<SurfaceUtteranceOrigin>(typeof opts.origin === 'string' ? [opts.origin] : opts.origin);
+  return rows.filter((row) => wanted.has(classifySurfaceUtteranceOrigin(row)));
+}
+
+/** 원천별 발화 수 — «사람 원천 0» 을 사람 표본으로 읽지 않게 하는 계측 입구(read-only·recall 무접촉). */
+export interface SurfaceUtteranceOriginCounts {
+  human: number;
+  testFixture: number;
+  externalCliAgent: number;
+  elanousSelf: number;
+  unknown: number;
+  total: number;
+}
+
+export function countSurfaceUtterancesByOrigin(
+  db: Database,
+  opts: Omit<SurfaceUtteranceQuery, 'origin'>,
+): SurfaceUtteranceOriginCounts {
+  const counts: SurfaceUtteranceOriginCounts = { human: 0, testFixture: 0, externalCliAgent: 0, elanousSelf: 0, unknown: 0, total: 0 };
+  for (const row of querySurfaceUtterances(db, opts)) {
+    counts.total += 1;
+    switch (classifySurfaceUtteranceOrigin(row)) {
+      case 'human': counts.human += 1; break;
+      case 'test-fixture': counts.testFixture += 1; break;
+      case 'external-cli-agent': counts.externalCliAgent += 1; break;
+      case 'elanous-self': counts.elanousSelf += 1; break;
+      default: counts.unknown += 1;
+    }
+  }
+  return counts;
 }
 
 export interface QueryEventsOpts {

package/src/exec-requests/planner.ts

@@ -10,6 +10,41 @@ import { debug } from '../debug/log.js';
 import { peerEditRunGate } from '../nexus/api/graph-peer-edit.js';
 import { OUTPUT_KINDS, pickDefaultOutput, type OutputKind } from './default-outputs.js';
 
+/**
+ * 코드포인트 순서 비교 — `localeCompare` 는 «실행 로케일의 ICU 콜레이션» 을 쓰므로 같은 문자열 쌍의 대소가
+ * 플랫폼/로케일마다 뒤집힌다(실측: '🎉party' vs '2026-10-23', 'alpha' vs 'Zebra' 는 콜레이션과 코드포인트가 반대).
+ * 순서가 실행 환경에 따라 달라지면 «가장 새 것» 선택이 재현 불가능해진다 — 그래서 코드포인트로 고정한다.
+ */
+export function compareCodePoints(a: string, b: string): number {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+/** 숫자 구간의 선행 0 을 지운다(01 == 1). */
+const stripLeadingZeros = (digits: string): string => digits.replace(/^0+(?=\d)/, '');
+
+/**
+ * 버전 문자열 비교 — 숫자 구간만 «수치» 로, 나머지는 «코드포인트» 로 비교한다.
+ * `localeCompare(..., { numeric: true })` 의 수치 규칙은 그대로 두고 콜레이션 의존만 걷어낸 등가물이다.
+ */
+export function compareVersionish(a: string, b: string): number {
+  const chunks = (value: string): string[] => value.match(/\d+|\D+/g) ?? [];
+  const left = chunks(a);
+  const right = chunks(b);
+  for (let index = 0; index < Math.min(left.length, right.length); index += 1) {
+    const [x, y] = [left[index]!, right[index]!];
+    if (/^\d/.test(x) && /^\d/.test(y)) {
+      const [dx, dy] = [stripLeadingZeros(x), stripLeadingZeros(y)];
+      if (dx.length !== dy.length) return dx.length < dy.length ? -1 : 1;
+      const digits = compareCodePoints(dx, dy);
+      if (digits !== 0) return digits;
+      continue;
+    }
+    const text = compareCodePoints(x, y);
+    if (text !== 0) return text;
+  }
+  return left.length === right.length ? 0 : left.length < right.length ? -1 : 1;
+}
+
 export interface InstalledGraph {
   id: string;
   title: string;
@@ -43,7 +78,7 @@ export function installedPluginGraphs(pluginsRoot = join(elanousStateRoot(), 'pl
   };
   for (const market of dirs(pluginsRoot)) {
     for (const name of dirs(join(pluginsRoot, market))) {
-      const versions = dirs(join(pluginsRoot, market, name)).sort((a, b) => b.localeCompare(a, undefined, { numeric: true }));
+      const versions = dirs(join(pluginsRoot, market, name)).sort((a, b) => compareVersionish(b, a));
       const version = versions[0];
       if (!version) continue;
       const root = join(pluginsRoot, market, name, version);
@@ -146,7 +181,7 @@ export function latestFieldFolder(configRoot = getElanousConfigDir()): string |
         const photos = readdirSync(path, { withFileTypes: true }).filter(file => file.isFile() && /\.(?:png|jpe?g|webp|heic)$/i.test(file.name));
         for (const photo of photos) {
           const time = statSync(join(path, photo.name)).mtimeMs;
-          if (!latest || time > latest.time || (time === latest.time && path.localeCompare(latest.path) > 0)) latest = { path, time };
+          if (!latest || time > latest.time || (time === latest.time && compareCodePoints(path, latest.path) > 0)) latest = { path, time };
         }
       } catch { /* Unreadable event does not supply photos. */ }
     }

package/src/execution-loop/launch-gate.ts

@@ -88,8 +88,6 @@ export function activeRunsForGoal(goalId: string, deps: ActiveRunsForGoalDeps =
   }
 }
 
-const LAUNCH_BUDGET_PROVIDER: Readonly<Record<string, string>> = { 'codex-rotate': CODEX_PROVIDER, grok: GROK_PROVIDER };
-
 /**
  * L6 발사 관문의 예산 입력 보정 — 발사 우주의 config 에 체인이 없으면(작업 트리 = 시험 우주) 막지 않고
  * 코드 기본 체인으로 판단한다. `--child-llm-provider` 를 명시했으면 그것이 체인이다(예산 판정 밖 provider 는 통과).
@@ -98,6 +96,9 @@ export function harnessLaunchBudgetDecision(
   inputs: BudgetInputs,
   opts: { readonly childLlmProvider?: string; readonly childLlmModel?: string } = {},
 ): { readonly decision: BudgetDecision; readonly warning?: string; readonly unmeasuredProvider?: string } {
+  // Resolve imported provider constants only when the launch gate is called.
+  // This module participates in the CLI/tool catalog import cycle.
+  const launchBudgetProvider: Readonly<Record<string, string>> = { 'codex-rotate': CODEX_PROVIDER, grok: GROK_PROVIDER };
   const explicit = opts.childLlmProvider?.trim();
   const judged = (selected: BudgetInputs) => {
     const { decision, unmeasuredProvider } = decideLaunchBudget(selected);
@@ -114,7 +115,7 @@ export function harnessLaunchBudgetDecision(
     return judged({ ...inputs, preference: { ...inputs.preference, chain } });
   }
   if (inputs.preference.chain.length > 0) return judged(inputs);
-  const chain = DEFAULT_FALLBACK_CHAIN.map((step) => ({ provider: LAUNCH_BUDGET_PROVIDER[step] ?? step }));
+  const chain = DEFAULT_FALLBACK_CHAIN.map((step) => ({ provider: launchBudgetProvider[step] ?? step }));
   const result = judged({ ...inputs, preference: { ...inputs.preference, chain } });
   return {
     ...result,

package/src/git-fs/cli-stderr.ts

@@ -0,0 +1,45 @@
+import { debug } from '../debug/log.js';
+
+export type CliStderrRecord = {
+  readonly source: 'git' | 'gh';
+  readonly exitCode: number;
+  readonly raw: Buffer;
+};
+
+export type CliStderrSink = (record: CliStderrRecord) => void;
+
+let activeSink: CliStderrSink | null = null;
+
+export function hasCliStderrSink(): boolean {
+  return activeSink !== null;
+}
+
+/** Install a surface-specific sink; without one, CLI stderr keeps its process contract. */
+export function setCliStderrSink(sink: CliStderrSink | null): () => void {
+  const previous = activeSink;
+  activeSink = sink;
+  return () => {
+    if (activeSink === sink) activeSink = previous;
+  };
+}
+
+/** Preserve raw bytes for the caller and keep ordinary CLI invocations on process.stderr. */
+export function writeCliStderr(record: CliStderrRecord): void {
+  const sink = activeSink;
+  if (!sink) {
+    process.stderr.write(record.raw);
+    return;
+  }
+  // A failed screen redraw must not fall through to the physical TTY and overwrite its prompt.
+  try { sink(record); } catch (error) {
+    // Keep the prompt isolated, but leave a forensic breadcrumb for a failed presentation path.
+    try {
+      debug.log('tui.cli-stderr', 'sink-failed', {
+        source: record.source,
+        exitCode: record.exitCode,
+        byteLength: record.raw.length,
+        errorName: error instanceof Error ? error.name : typeof error,
+      });
+    } catch { /* never fall through to the physical TTY */ }
+  }
+}

package/src/git-fs/gh-cli.ts

@@ -1,5 +1,6 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { debug } from '../debug/log.js';
+import { writeCliStderr } from './cli-stderr.js';
 
 const LF = 0x0a;
 const MAX_GH_RETRY_ATTEMPTS = 3;
@@ -195,14 +196,16 @@ export function runGhCli(args: string[]): void {
   const auxiliaryFailure = exitCode === 0 ? undefined : auxiliaryFailureSignature(stderr);
 
   if (stdout.length) process.stdout.write(stdout);
-  if (stderr.length) process.stderr.write(stderr);
+  const stderrChunks: Buffer[] = [];
+  if (stderr.length) stderrChunks.push(stderr);
   // ⛔⭐⭐⭐⭐⭐ **상태 줄은 `stderr` 로** — `git-cli.ts` 의 같은 주석이 canonical.
   //   `--json` 산출 뒤에 비-JSON 한 줄이 붙으면 ***모든 JSON 소비자가 죽는다***(`jq: parse error` 실측).
   //   stdout 은 ***원 바이트 그대로만*** 나간다.
   const endsWithoutLf = (buffer: Buffer): boolean => buffer.length > 0 && buffer[buffer.length - 1] !== LF;
-  if (endsWithoutLf(stderr)) process.stderr.write('\n');
+  if (endsWithoutLf(stderr)) stderrChunks.push(Buffer.from('\n'));
 
-  process.stderr.write(`${statusLine(label, result, auxiliaryFailure)}\n`);
+  stderrChunks.push(Buffer.from(`${statusLine(label, result, auxiliaryFailure)}\n`));
+  writeCliStderr({ source: 'gh', exitCode, raw: Buffer.concat(stderrChunks) });
   process.exitCode = exitCode;
   if (auxiliaryFailure) {
     debug.log('gh.cli', 'partial-outcome', {

package/src/git-fs/git-cli.ts

@@ -2,6 +2,7 @@ import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { debug } from '../debug/log.js';
+import { hasCliStderrSink, writeCliStderr } from './cli-stderr.js';
 import { runGitWithRetry, type GitRunner } from './retry.js';
 
 const LF = 0x0a;
@@ -134,7 +135,11 @@ export function runGitCli(args: string[]): void {
   // ⛔ 실행 «전» 스냅샷 — 이 명령이 마커를 남길 수 있는 종류일 때만 잰다(무관한 명령엔 비용 0).
   const probesForRun = SUBCOMMAND_PROBES[subcommand];
   const probesBefore = probesForRun ? probeSnapshot(args, probesForRun, process.env) : undefined;
-  if (HELP_ARGUMENTS.has(args[0] ?? '')) process.stderr.write(HELP_GUIDANCE);
+  const stderrChunks: Buffer[] = [];
+  if (HELP_ARGUMENTS.has(args[0] ?? '')) {
+    if (hasCliStderrSink()) stderrChunks.push(Buffer.from(HELP_GUIDANCE));
+    else process.stderr.write(HELP_GUIDANCE);
+  }
   let attempts = 0;
   let rawStdout: Buffer = Buffer.alloc(0);
   let rawStderr: Buffer = Buffer.alloc(0);
@@ -154,7 +159,7 @@ export function runGitCli(args: string[]): void {
   const result = runGitWithRetry(args, runner);
 
   if (rawStdout.length) process.stdout.write(rawStdout);
-  if (rawStderr.length) process.stderr.write(rawStderr);
+  if (rawStderr.length) stderrChunks.push(rawStderr);
 
   // ⛔⭐⭐⭐⭐⭐ **상태 줄은 `stderr` 로 나간다** — 2026-08-09 정정(라이브에서 «둘이» 밟았다).
   //   초판은 stdout 에 썼다. 그러면 ***산출을 값으로 쓰는 모든 소비자가 깨진다***:
@@ -166,7 +171,7 @@ export function runGitCli(args: string[]): void {
   //     `git`·`gh` 자신의 오류도 똑같이 사라지므로 일관된다.
   //   ⇒ 📌 stdout 은 이제 ***원 바이트 그대로만*** 나간다(separator 도 안 붙인다).
   const endsWithoutLf = (buf: Buffer): boolean => buf.length > 0 && buf[buf.length - 1] !== LF;
-  if (endsWithoutLf(rawStderr)) process.stderr.write('\n');
+  if (endsWithoutLf(rawStderr)) stderrChunks.push(Buffer.from('\n'));
 
   const exitCode = result.status ?? 1;
   const leftKind = exitCode !== 0 && probesForRun
@@ -176,11 +181,12 @@ export function runGitCli(args: string[]): void {
   const leftReason = leftKind
     ? `${leftKind}-${hasUnmergedPaths(args, process.env) ? 'conflict' : 'in-progress'}`
     : undefined;
-  process.stderr.write(
+  stderrChunks.push(Buffer.from(
     `[git] ${subcommand} ${exitCode === 0 ? 'ok' : 'FAILED'} rc=${exitCode}`
     + (leftReason ? ` worktree-changed=yes reason=${leftReason}` : '')
     + '\n',
-  );
+  ));
+  writeCliStderr({ source: 'git', exitCode, raw: Buffer.concat(stderrChunks) });
   process.exitCode = exitCode;
   debug.log('git.cli', 'completed', {
     subcommand,