elanous 0.2.36 → 0.2.38

package/src/index.ts

@@ -3919,8 +3919,11 @@ selfCmd
   .option('--json', '한 줄에 한 항목으로 재직렬화해 출력한다(원문 공백·빈 줄은 보존되지 않는다)')
   .option('--all', 'logs와 같은 전 인스턴스 연합 원장 조회를 한다')
   .option('--include-test', '--all 연합에 격리 test 인스턴스도 포함한다')
-  .action(async (runId: string, opts: { json?: boolean; all?: boolean; includeTest?: boolean }) => {
-    const { describeFederatedMissingRunLedger, describeMissingRunLedger, lookupRunLedger, renderRunLedger } = await import('./self-implement/run-ledger.js');
+  // ⛔⭐ 합성 exit 를 «쓰지» 않고 enter/exit/orphan 만 대조한다 — 원장을 읽기만 하는 분류다.
+  //    중단된 런이 exit 없이 남긴 graph.unit 방문을 «완료»로 오해하지 않게 CLI 에서 직접 잰다.
+  .option('--unit-visits', 'graph.unit enter/exit/orphan 대조만 출력한다(원장은 읽기만 한다)')
+  .action(async (runId: string, opts: { json?: boolean; all?: boolean; includeTest?: boolean; unitVisits?: boolean }) => {
+    const { classifyGraphUnitVisits, describeFederatedMissingRunLedger, describeMissingRunLedger, lookupRunLedger, renderRunLedger } = await import('./self-implement/run-ledger.js');
     try {
       const lookup = lookupRunLedger(runId, { all: opts.all, ...(opts.includeTest === undefined ? {} : { includeTest: opts.includeTest }) });
       if (lookup.matches.length === 0) {
@@ -3947,6 +3950,18 @@ selfCmd
       const match = lookup.matches[0]!;
       if (opts.json && match.skippedTrailingBytes !== undefined) console.error(`skipped incomplete trailing run ledger line: ${match.skippedTrailingBytes} bytes`);
       if (opts.all && !opts.json) console.log(`run ledger found in universe: ${match.targetName ?? 'current'} (${match.ledgerDirectory})`);
+      if (opts.unitVisits) {
+        const classification = classifyGraphUnitVisits(match.entries);
+        if (opts.json) {
+          await writeStdoutJson(JSON.stringify(classification) + '\n');
+          return;
+        }
+        console.log(`graph.unit enter=${classification.enterCount} exit=${classification.exitCount} orphan=${classification.orphanCount}`);
+        for (const visit of classification.orphanUnitVisits) {
+          console.log(`orphan unit=${visit.unit ?? '-'} node=${visit.nodeId ?? '-'} childRunId=${visit.childRunId ?? '-'} enteredAt=${visit.enteredAt ?? '-'}`);
+        }
+        return;
+      }
       if (opts.json) await writeStdoutJson(match.entries.map((entry) => JSON.stringify(entry)).join('\n') + '\n');
       else console.log(renderRunLedger(match.entries));
     } catch (error) {
@@ -4201,12 +4216,17 @@ selfCmd
 selfCmd
   .command('running-runs')
   .description('원장과 살아 있는 PTY를 함께 읽어 현재 자율 런 판정을 출력한다')
+  .argument('[runId]', '같은 ID로 단일 런의 원본 완료 결과(kind·reason·next)를 재조회한다 (생략 시 전체)')
   .option('--json', '구조화된 JSON으로 출력한다')
   .option('--include-test', '연합 관측에 격리 test 인스턴스도 포함한다')
-  .action(async (opts: { json?: boolean; includeTest?: boolean }) => {
+  .action(async (runId: string | undefined, opts: { json?: boolean; includeTest?: boolean }) => {
     try {
       const { queryRunningRuns, renderRunningRuns } = await import('./self-implement/running-runs.js');
-      const result = queryRunningRuns({ includeTest: opts.includeTest, caller: 'cli' });
+      const result = queryRunningRuns({
+        includeTest: opts.includeTest,
+        caller: 'cli',
+        ...(runId === undefined ? {} : { runIds: [runId] }),
+      });
       const output = `${opts.json ? JSON.stringify(result) : renderRunningRuns(result)}\n`;
       await writeStdoutJson(output);
     } catch (error) {
@@ -4461,6 +4481,9 @@ selfCmd
     try {
       const { runGoalAuthorCli, formatGoalAuthorSelfInspection, formatGoalInterviewRound } = await import('./self-implement/goal-author-cli.js');
       // 설정 졸업 1-c(2026-09-26): 되묻기 자동 답변은 늘 켠다 — `harness ask/say` 와 같은 동작(옵션 없음).
+      // Production self author → runGoalAuthorCli → writeAuthoredGoal → tracedPathsSection:
+      // missing traced paths are corrected or skipped; a required correction ledger write
+      // failure propagates through this call to the error handler instead of reporting success.
       const result = await runGoalAuthorCli(parts, { ...opts, selfResolveClarifications: true });
       console.log(result.path);
       // ⭐ grounding 상태를 함께 알린다 — 이 장치의 알려진 약점이 여기서 드러나야 한다.
@@ -4713,15 +4736,24 @@ selfCmd
   .option('--base <ref>', '커밋됐지만 PR 없는 변경의 비교 기준(ref...HEAD)')
   .option('--pr <number>', '열린 PR 번호에서 gh pr view files로 변경 파일을 읽는다')
   .option('--shards [number]', '메모리 예산에 맞춰 시험을 별도 프로세스로 분할한다 (기본 2)')
+  .option('--shard-concurrency <number>', '동시에 실행할 조각 묶음 수 (1–4, 기본 3)')
   .option('--fixed-shard-distribution', '--shards N 과 함께만: RSS 사전 측정 없이 정렬된 파일을 N 조각에 라운드로빈 고정 배정한다(opt-in · 메모리 보증 아님 · 조각 타임아웃/OOM = unmeasured)')
   .option('--include-importers', '변경 모듈을 가져오는 importer 시험도 실행한다 (기본 caller 한도 밖까지)')
   .option('--remote [host]', 'GATE-REMOTE — 같은 커밋을 원격 호스트(기본 config gateRemote.host=node-b)에서 돌리고 결과만 가져온다(깨끗한 트리 · --pr 은 로컬)')
   .option('--local', '원격 실행을 끄고 명시적으로 로컬에서 돌린다')
   .option('--artifact-dir <dir>', '조각별 지금/기준 JUnit ⊕ summary.json 을 이 디렉토리에 남긴다(판정 불변 · JUnit 은 --shards 경로만 · 원격 실행이면 그 호스트에서 가져온다)')
-  .action(async (opts: { changed?: boolean; base?: string; pr?: string; shards?: string | boolean; fixedShardDistribution?: boolean; includeImporters?: boolean; remote?: string | boolean; local?: boolean; artifactDir?: string }) => {
+  .option('--orchestration-id <id>', 'GATE-REMOTE-SHARD-PLAN — 조각 오케스트레이션 id. --shard-id · --shard-position 와 세벌 세트로만 쓰고 원격 명령줄에 그대로 실린다')
+  .option('--shard-id <id>', 'GATE-REMOTE-SHARD-PLAN — 조각 id(예: <orchestration-id>/shard-2). 원격 명령줄에 그대로 실린다')
+  .option('--shard-position <n>', 'GATE-REMOTE-SHARD-PLAN — 조각 위치(1부터 정수). 원격 명령줄에 그대로 실린다')
+  .option('--shard-plan <path>', 'GATE-REMOTE-SHARD-PLAN — 조각 계획 파일 경로. 주면 원격 명령줄에 --shard-plan 으로 실린다')
+  .action(async (opts: { changed?: boolean; base?: string; pr?: string; shards?: string | boolean; shardConcurrency?: string; fixedShardDistribution?: boolean; includeImporters?: boolean; remote?: string | boolean; local?: boolean; artifactDir?: string; orchestrationId?: string; shardId?: string; shardPosition?: string; shardPlan?: string }) => {
     if (!opts.changed && opts.shards === undefined) { ui.error('self gate requires --changed or --shards'); process.exitCode = 2; return; }
     if (opts.fixedShardDistribution && opts.shards === undefined) { ui.error('self gate: --fixed-shard-distribution requires --shards <n>'); process.exitCode = 2; return; }
+    if (opts.shardConcurrency !== undefined && (!/^[1-4]$/.test(opts.shardConcurrency))) { ui.error('self gate: --shard-concurrency must be 1–4'); process.exitCode = 2; return; }
     if (opts.artifactDir !== undefined && !opts.artifactDir.trim()) { ui.error('self gate: --artifact-dir needs a non-empty directory'); process.exitCode = 2; return; }
+    const shardIdentityFlags = [opts.orchestrationId, opts.shardId, opts.shardPosition].filter((value) => value !== undefined).length;
+    if (shardIdentityFlags !== 0 && shardIdentityFlags !== 3) { ui.error('self gate: --orchestration-id, --shard-id and --shard-position are used as a set'); process.exitCode = 2; return; }
+    if (opts.shardPosition !== undefined && !/^[1-9]\d*$/.test(opts.shardPosition)) { ui.error('self gate: --shard-position needs a positive integer'); process.exitCode = 2; return; }
     // The root strips `--local` from argv anywhere (remote-bookmark attach · src/cli/remote-resolve.ts) before Commander
     // sees it, so this subcommand reads it from the untouched process.argv.
     opts.local = !!opts.local || process.argv.slice(2).includes('--local');
@@ -4733,11 +4765,11 @@ selfCmd
     const shards = opts.shards === undefined ? undefined : opts.shards === true ? 2 : Number(opts.shards);
     let ranLocal = false;
     let remoteArtifacts: { dir: string; fetch?: { ok: true; summaryPath: string; junitFiles: string[]; remoteDirKept: boolean } | { ok: false; reason: string } } | { unsupported: true } | undefined;
-    const runLocal = () => {
+    const runLocal = async () => {
       ranLocal = true;
       try {
-        const { runSelfGateCli } = require('./self-implement/gate-cli.js') as typeof import('./self-implement/gate-cli.js');
-        const result = runSelfGateCli(process.cwd(), { base: opts.base, pr: opts.pr, shards, ...(opts.fixedShardDistribution ? { fixedShardDistribution: true } : {}), includeImporterTests: !!opts.includeImporters, ...(opts.artifactDir !== undefined ? { artifactDir: opts.artifactDir } : {}) });
+        const { runSelfGateCliAsync } = require('./self-implement/gate-cli.js') as typeof import('./self-implement/gate-cli.js');
+        const result = await runSelfGateCliAsync(process.cwd(), { base: opts.base, pr: opts.pr, shards, ...(opts.shardConcurrency !== undefined ? { shardConcurrency: Number(opts.shardConcurrency) } : {}), ...(opts.fixedShardDistribution ? { fixedShardDistribution: true } : {}), includeImporterTests: !!opts.includeImporters, ...(opts.artifactDir !== undefined ? { artifactDir: opts.artifactDir } : {}) });
         console.log(result.lines.join('\n'));
         return result.exitCode;
       } catch (error) {
@@ -4766,12 +4798,23 @@ selfCmd
         remoteArtifacts = remoteCommitSupportsArtifactDir(repo) ? { dir: newRemoteArtifactDir() } : { unsupported: true };
       }
       // origin/main is pinned to this machine's origin/main on the host; any other base is passed as its resolved sha.
-      const remoteArgv = (sha: (ref: string) => string) => remoteSelfGateArgv({
-        changed: opts.changed, base: opts.base, shards, fixedShardDistribution: opts.fixedShardDistribution,
-        includeImporters: opts.includeImporters,
-        // A measured commit without this option rejects it (exit ≠ 0) — read as not passed, never as a silent measured run.
-        artifactDir: remoteArtifacts && 'dir' in remoteArtifacts ? remoteArtifacts.dir : undefined,
-      }, sha);
+      const remoteArgv = (sha: (ref: string) => string) => {
+        const argv = remoteSelfGateArgv({
+          changed: opts.changed, base: opts.base, shards, shardConcurrency: opts.shardConcurrency === undefined ? undefined : Number(opts.shardConcurrency), fixedShardDistribution: opts.fixedShardDistribution,
+          includeImporters: opts.includeImporters,
+          // A measured commit without this option rejects it (exit ≠ 0) — read as not passed, never as a silent measured run.
+          artifactDir: remoteArtifacts && 'dir' in remoteArtifacts ? remoteArtifacts.dir : undefined,
+        }, sha);
+        // GATE-REMOTE-SHARD-PLAN — the shard identity rides the remote command line so each host run is attributable to its
+        // shard. A measured commit without these options rejects them (exit ≠ 0): unmeasured, never a silent pass.
+        if (opts.orchestrationId === undefined) return argv;
+        const { remoteShardArgArgs } = require('./self-dev/shard-run.js') as typeof import('./self-dev/shard-run.js');
+        return [...argv, ...remoteShardArgArgs({
+          orchestrationId: opts.orchestrationId, shardId: opts.shardId!,
+          totalShards: typeof shards === 'number' && Number.isSafeInteger(shards) && shards >= 1 ? shards : 1,
+          position: Number(opts.shardPosition),
+        }, { planFile: opts.shardPlan })];
+      };
       const { gateHostReservationRoot } = await import('./release-loop/gate-host-reservation.js');
       process.exitCode = await dispatchHeavyCheck({
         tool: 'self-gate', repo, installPwa: true, remoteArgv, refs: opts.base ? [opts.base] : [], reservationRoot: gateHostReservationRoot(),
@@ -4796,7 +4839,7 @@ selfCmd
       const reason = error instanceof Error ? error.message : String(error);
       if (opts.local) {
         ui.error(`self gate dispatch failed: ${reason}`);
-        process.exitCode = runLocal();
+        process.exitCode = await runLocal();
       } else {
         ui.error(opts.remote !== undefined
           ? `self gate remote unmeasured — ${reason.replace(/\s+/g, ' ').trim()}`
@@ -6283,6 +6326,7 @@ selfCmd
         return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? '' };
       },
       reviewPullRequest,
+      reviewRepositoryPath: process.cwd(),
       readReferencedFile: createRepositoryReferencedFileReader(process.cwd()),
       renderReview,
       // ⛔⭐ 하드코딩 금지(🩸 2026-09-23 실측: 여기 'medium' 이 박혀 있었다) — 무인 리뷰와 «같은» 규칙.
@@ -7898,6 +7942,16 @@ const selfDevCmd = program
           // ⭐ 저작 «전»에 끊는다 — 100초를 쓰지 않는다. 우회는 --force-preflight 로 그대로 열려 있다.
           throw new DevPipelineError('저작 전 예비 검사에서 막혔다 — 위 이름을 확인하라 (우회: --force-preflight)');
         }
+        if (flowResult.kind === 'stopped-by-timebox') {
+          // ⭐⭐ AUTHOR-TIMEBOX NOT-GROUNDED — 저작 결과 줄은 흐름이 이미 썼다. 발사하지 않고 여기서 끝낸다.
+          releaseAuthoringLease();
+          if (opts.json) {
+            const terminalResult = { kind: 'self', ok: false, stage: 'author-timebox-not-grounded', goalFile: flowResult.goalFile };
+            await writeStdoutJson(`${JSON.stringify(terminalResult)}\n`);
+          }
+          completionGuard.conclude();
+          process.exit(1);
+        }
         askAuthoredFile = flowResult.goalFile;
         if (flowResult.kind === 'stopped-by-preflight') {
           releaseAuthoringLease();
@@ -12159,6 +12213,83 @@ export function rootResumeIdAt(rawArgs: readonly string[], resumeFlagIdx: number
   return next !== undefined && !next.startsWith('-') ? next : undefined;
 }
 
+/** TUI-CONTINUE-SESSION (0.2.35) — `--continue` 가 «어느 세션» 을 이어받나를 정하는 조회 창구. */
+export interface ContinueSessionLookup {
+  /** cwd 가 속한 프로젝트 id — 매칭 없으면 null. */
+  projectIdForCwd: (cwd: string) => string | null;
+  /** 그 프로젝트의 최신 세션 id — 없으면 null. */
+  latestForProject: (projectId: string) => string | null;
+  /** 전역 최신 세션 id — 없으면 null. */
+  latestGlobal: () => string | null;
+  /** 지금 활성 표지가 가리키는 세션 id — 없으면 null. */
+  activeSessionId: () => string | null;
+}
+
+const realContinueSessionLookup: ContinueSessionLookup = {
+  projectIdForCwd: (cwd) => suggestProjectForFolder(cwd)?.id ?? null,
+  latestForProject: (projectId) => listSessions({ limit: 1, projectId })[0]?.id ?? null,
+  latestGlobal: () => listSessions({ limit: 1 })[0]?.id ?? null,
+  activeSessionId: () => getActiveSessionId(),
+};
+
+const realNextTuiContinueSessionLookup: ContinueSessionLookup = {
+  projectIdForCwd: (cwd) => suggestProjectForFolder(cwd)?.id ?? null,
+  latestForProject: (projectId) => listSessions({ limit: 1, projectId, source: 'tui' })[0]?.id ?? null,
+  latestGlobal: () => listSessions({ limit: 1, source: 'tui' })[0]?.id ?? null,
+  activeSessionId: () => {
+    const id = getActiveSessionId();
+    return id && (loadSession(id) as unknown as { source?: string } | null)?.source === 'tui' ? id : null;
+  },
+};
+
+/**
+ * TUI-CONTINUE-SESSION (0.2.35) — `--continue`(id 없는 `--resume`)의 «최근 세션» 을 cwd 기준으로
+ * 먼저 좁힌다: cwd 가 속한 프로젝트(`primaryFolder` 또는 그 하위 디렉토리)의 최신 세션 id.
+ * 프로젝트가 없거나 그 프로젝트에 세션이 없으면 전역 최신으로 폴백한다.
+ */
+export function latestSessionIdForContinue(
+  cwd: string = process.cwd(),
+  lookup: ContinueSessionLookup = realContinueSessionLookup,
+): string | null {
+  const projectId = lookup.projectIdForCwd(cwd);
+  const localId = projectId ? lookup.latestForProject(projectId) : null;
+  return localId ?? lookup.latestGlobal();
+}
+
+/** Next TUI only: resume a project TUI session, never an automation or cross-project session. */
+export function latestNextTuiSessionIdForContinue(
+  cwd: string = process.cwd(),
+  lookup: ContinueSessionLookup = realNextTuiContinueSessionLookup,
+): string | null {
+  const projectId = lookup.projectIdForCwd(cwd);
+  return projectId ? lookup.latestForProject(projectId) : lookup.latestGlobal();
+}
+
+/** Keep the source-filtered session selection scoped to the Next TUI entry. */
+export function latestRootSessionIdForContinue(
+  tuiEntry: 'classic' | 'next',
+  cwd: string = process.cwd(),
+  lookup?: ContinueSessionLookup,
+): string | null {
+  return tuiEntry === 'next'
+    ? latestNextTuiSessionIdForContinue(cwd, lookup ?? realNextTuiContinueSessionLookup)
+    : latestSessionIdForContinue(cwd, lookup ?? realContinueSessionLookup);
+}
+
+/**
+ * cwd 가 프로젝트 안이면 활성 표지보다 cwd 프로젝트의 최신 세션 선택을 우선한다.
+ * 프로젝트 밖에서는 종전처럼 활성 표지가 전역 최신보다 우선한다.
+ */
+export function activeSessionIdForContinue(
+  cwd: string = process.cwd(),
+  lookup: ContinueSessionLookup = realContinueSessionLookup,
+): string | null {
+  const active = lookup.activeSessionId();
+  if (!active) return null;
+  const cwdProjectId = lookup.projectIdForCwd(cwd);
+  return cwdProjectId ? null : active;
+}
+
 export function filterDashboardArgs(rawArgs: readonly string[], resumeFlagIdx?: number): string[] {
   const rootResumeFlagIdx = resumeFlagIdx ?? rawArgs.findIndex((arg, index) =>
     // ⛔ `-r` 은 «더 이상» resume 의 별칭이 아니다 — 원격 북마크(`--remote`)의 단축형이다.
@@ -12401,14 +12532,16 @@ async function main(): Promise<void> {
   // 우선순위: `--resume <id>` > `--continue`·id 없는 `--resume`(최신) > (폐기 예정) ELANOUS_RESUME_SESSION.
   //   ⛔ 명시 인자가 있으면 환경변수가 이기지 않는다(TUI-H8 r1 must-fix).
   const { resolveLatestSessionId, resolveRootResumeSessionId } = await import('./session/session-start.js');
+  const continueLookup = tuiEntry === 'next' ? realNextTuiContinueSessionLookup : realContinueSessionLookup;
   const rootResume = resolveRootResumeSessionId({
     ...(resumeFromFlag !== undefined ? { flagId: resumeFromFlag } : {}),
     continueLatest,
     // 명시 인자가 있으면 env 를 «읽지도» 않는다(폐기 경고가 명시 이어하기에 섞이지 않게).
     readEnvId: () => readDeprecatedEnvForResume('ELANOUS_RESUME_SESSION').value ?? null,
     latest: () => resolveLatestSessionId({
-      activeSessionId: () => getActiveSessionId(),
-      latestSessionId: () => listSessions({ limit: 1 })[0]?.id ?? null,
+      // Next TUI는 사람 TUI 세션만 이어가고, classic dashboard의 기존 선택은 보존한다.
+      activeSessionId: () => activeSessionIdForContinue(process.cwd(), continueLookup),
+      latestSessionId: () => latestRootSessionIdForContinue(tuiEntry),
       // TUI-H8-FOLLOW ① — 활성 표지가 사라진 세션이면 최신 세션으로(#28509 리뷰 should-fix).
       sessionExists: (id) => loadSession(id) !== null,
     }),
@@ -12611,7 +12744,7 @@ async function main(): Promise<void> {
       return;
     }
     const { showNextTui } = await import('./tui/entry.js');
-    await showNextTui({ resumeSessionId });
+    await showNextTui({ resumeSessionId, sidetabMode: getUserConfig().tui?.sidetab ?? 'collapsed' });
     bootTimer.phase('show-next');
     bootTimer.done();
   } else {

package/src/instance/test-write-guard-real-transport.fixture.ts

@@ -0,0 +1,52 @@
+// Child fixture for test-write-guard.test.ts (TEST-PROD-LEAK-2 ledger): call-through wrappers installed over
+// the ORIGINAL spill and send functions must not soften the outbound-alert guard. spillLongContent gets a
+// mock.module call-through wrapper (not a fake — it delegates to the original) that counts operational S3
+// upload attempts, and the original curl send primitive gets a bare pass-through spy that counts external
+// sends. The refusal must fire BEFORE spillLongContent runs, so the ledger prints 0 s3Uploads and 0
+// curlCalls alongside the refusal reason. Prints {refused, refusalReason, curlCalls, s3Uploads}.
+import { mock, spyOn } from 'bun:test';
+import * as childProcess from 'node:child_process';
+
+// Pass-through wrapper over the original external-send primitive (curl via execFileSync), installed before
+// outbound-alert is imported so even the module-load capture of the «real» sender sees a wrapper, not a fake.
+const sendWrapper = spyOn(childProcess, 'execFileSync');
+
+const spill = await import('../storage/content-spill.js');
+const originalSpill = spill.spillLongContent;
+let s3Uploads = 0;
+await mock.module('../storage/content-spill.js', () => ({
+  ...spill,
+  spillLongContent: (...args: Parameters<typeof originalSpill>) => {
+    s3Uploads += 1; // every spill that reaches the original is an operational S3 upload attempt
+    return originalSpill(...args);
+  },
+}));
+
+const { sendTelegramDirect } = await import('../domains/outbound-alert.js');
+const { getUserConfig } = await import('../user-config.js');
+const base = getUserConfig();
+const config = { ...base, telegram: { ...base.telegram, channels: undefined, botToken: '2:fake', homeChannel: 2 } } as typeof base;
+type DirectDeps = NonNullable<Parameters<typeof sendTelegramDirect>[2]>;
+const deps = { config } as DirectDeps;
+// LEAK2_INJECT_SENDRAW=1 also injects a real (non-test-double) send transport into the delivery deps — a
+// plain curl-invoking function, no mock scaffolding — so the companion ledger proves the guard refuses an
+// injected external transport, not merely an empty one.
+if (process.env.LEAK2_INJECT_SENDRAW === '1') {
+  (deps as { sendRaw?: (url: string) => string }).sendRaw = (url) =>
+    childProcess.execFileSync('curl', ['-sS', url], { encoding: 'utf8' }) as string;
+  // An injected transport turns the external branch off (:710 — a test double cannot target the ops
+  // universe), so the companion ledger proves the ops-routed branch: the routing roots resolve inside the
+  // ops universe, exactly as production does, and the guard refuses it faked or not.
+  const { EXTRA_OPS_ROOTS_ENV } = await import('../instance/test-write-guard.js');
+  const { getElanousConfigDir } = await import('../elanous-config-dir.js');
+  process.env[EXTRA_OPS_ROOTS_ENV] = getElanousConfigDir();
+}
+let refused = false;
+let refusalReason = '';
+try {
+  sendTelegramDirect('private-alert-body', 'ops-alert', deps);
+} catch (e) {
+  refused = true;
+  refusalReason = e instanceof Error ? `${e.name}: ${e.message}` : String(e);
+}
+console.log(JSON.stringify({ refused, refusalReason, curlCalls: sendWrapper.mock.calls.length, s3Uploads }));

package/src/intake-plane/collect-telegram-saved.ts

@@ -37,7 +37,50 @@ function writeSavedCursor(root: string, lastId: number): void {
   writeFileSync(cursorFile(root), JSON.stringify({ lastId, at: new Date().toISOString() }) + '\n');
 }
 
-export interface CollectSavedResult { cursorBefore: number; cursorAfter: number; messages: number; raws: number; dryRun: boolean; ingest?: IngestResult }
+export interface CollectSavedResult {
+  cursorBefore: number;
+  cursorAfter: number;
+  /** fetch 가 돌려준 «저장된 메시지» 수 — 커서 이후 읽은 것. */
+  messages: number;
+  /** 그중 savedMessageToRaws 가 0줄로 버린 메시지 수(빈 몸통) — «필터» 축. */
+  droppedByFilter: number;
+  /** 원장에 넣으려고 만든 입력 줄 수 — «원장 입력» 축. messages 와 다른 값이다. */
+  raws: number;
+  dryRun: boolean;
+  ingest?: IngestResult;
+}
+
+/** «메시지 0»·«원장 입력 0» 의 까닭 — 필터로 비었는지 다른 주체가 이미 가져갔는지 갈라 읽는다. */
+export type SavedCollectDiagnosis = 'new-items' | 'no-new-messages' | 'filtered-out' | 'already-consumed';
+
+export function diagnoseSavedCollect(res: CollectSavedResult): SavedCollectDiagnosis {
+  // 원장 입력이 있고 새로/합쳐 들어간 것이 있으면 정상 흡수다(dry-run 은 넣을 예정).
+  if (res.raws > 0 && (!res.ingest || res.ingest.added + res.ingest.merged > 0)) return 'new-items';
+  if (res.messages === 0) return 'no-new-messages';
+  if (res.droppedByFilter === res.messages) return 'filtered-out';
+  return 'already-consumed';
+}
+
+/** 사람이 읽는 한 덩이 — «메시지 0» 과 «원장 입력 0» 을 다른 줄로 갈라 보여준다. */
+export function renderCollectTelegramSavedResult(res: CollectSavedResult): string {
+  const lines = [
+    `텔레그램 저장된 메시지: 읽음 ${res.messages} · 필터로 버림 ${res.droppedByFilter} · 원장 입력 ${res.raws} · 커서 ${res.cursorBefore} → ${res.cursorAfter}${res.dryRun ? ' (dry-run · 안 씀)' : ''}`,
+  ];
+  if (res.ingest) lines.push(`원장: 새 ${res.ingest.added} · 합침 ${res.ingest.merged} · 이미 끝난 것 ${res.ingest.seen} · 버림 ${res.ingest.skipped}`);
+  const diagnosis = diagnoseSavedCollect(res);
+  if (diagnosis === 'no-new-messages') {
+    lines.push(`메시지 0 — 커서 ${res.cursorBefore} 이후 새 저장 메시지가 없다${res.cursorBefore > 0 ? ' (커서는 이미 다른 주체가 넘겼을 수 있다)' : ''}`);
+  } else if (diagnosis === 'filtered-out') {
+    lines.push(`원장 입력 0 은 필터 때문이다 — 링크·메모 문장이 없는 빈 메시지 ${res.droppedByFilter}건`);
+  } else if (diagnosis === 'already-consumed') {
+    lines.push(`원장 입력 ${res.raws} · 새 0 — 같은 항목을 다른 주체(queue)가 이미 가져갔다 (이미 끝난 것 ${res.ingest?.seen ?? 0})`);
+  } else if (res.dryRun) {
+    lines.push(`원장에 들어갈 것 ${res.raws}건 (dry-run — 쓰지 않았다)`);
+  } else {
+    lines.push(`원장에 새 것 ${res.ingest?.added ?? 0}건이 들어갔다`);
+  }
+  return lines.join('\n');
+}
 
 /**
  * 커서 이후 메시지를 한 번에 최대 max 개 읽어 원장에 넣고 커서를 옮긴다.
@@ -47,15 +90,21 @@ export interface CollectSavedResult { cursorBefore: number; cursorAfter: number;
 export async function collectTelegramSaved(root: string, fetch: FetchSavedMessages, opts: { max: number; dryRun?: boolean }): Promise<CollectSavedResult> {
   const cursorBefore = readSavedCursor(root);
   const messages = await fetch(cursorBefore, opts.max);
-  const raws = messages.flatMap(savedMessageToRaws);
+  const rowsPerMessage = messages.map(savedMessageToRaws);
+  const raws = rowsPerMessage.flat();
+  const droppedByFilter = rowsPerMessage.filter((rows) => rows.length === 0).length;
   const cursorAfter = messages.reduce((mx, m) => Math.max(mx, m.id), cursorBefore);
-  const result: CollectSavedResult = { cursorBefore, cursorAfter, messages: messages.length, raws: raws.length, dryRun: !!opts.dryRun };
+  const result: CollectSavedResult = { cursorBefore, cursorAfter, messages: messages.length, droppedByFilter, raws: raws.length, dryRun: !!opts.dryRun };
   if (!opts.dryRun) {
     result.ingest = ingestIntakeItems(root, 'telegram-saved', raws);
     if (cursorAfter > cursorBefore) writeSavedCursor(root, cursorAfter);
   }
-  // ⛔ 본문·링크는 싣지 않는다 — 커서와 건수만.
-  debug.log('intake.collect', 'telegram-saved', { cursorBefore, cursorAfter, messages: messages.length, raws: raws.length, dryRun: !!opts.dryRun });
+  // ⛔ 본문·링크는 싣지 않는다 — 커서와 건수만. 두 축(메시지·원장 입력)을 따로 남겨 사흘 0 을 갈라 읽게.
+  debug.log('intake.collect', 'telegram-saved', {
+    cursorBefore, cursorAfter, messages: messages.length, droppedByFilter, raws: raws.length,
+    ...(result.ingest ? { added: result.ingest.added, merged: result.ingest.merged, seen: result.ingest.seen, skipped: result.ingest.skipped } : {}),
+    diagnosis: diagnoseSavedCollect(result), dryRun: !!opts.dryRun,
+  });
   return result;
 }
 

package/src/interactive-terminal-modal.ts

@@ -55,6 +55,8 @@ export interface InteractiveTerminalModalSpec {
    *  of a plain local shell. Empty default keeps the legacy behaviour. */
   shellArgs?: readonly string[];
   env?: Record<string, string>;
+  /** Remove captured login-shell environment keys after composition. */
+  unsetEnv?: readonly string[];
   /** Ghostty-compatible terminfo name. Defaults via PreviewTerminal
    *  to xterm-256color. */
   termName?: string;
@@ -212,6 +214,7 @@ export function createInteractiveTerminalModal(
     shell: spec.shell,
     shellArgs: spec.shellArgs,
     env: spec.env,
+    unsetEnv: spec.unsetEnv,
     termName: spec.termName,
     useRegistry: spec.useRegistry,
     registryKind: spec.registryKind,

package/src/keybindings.ts

@@ -54,32 +54,27 @@ export const KEYBINDINGS: KeyBinding[] = [
   { keys: ['Ctrl+K', 'Ctrl+ㅏ'],   action: 'Open SSH remote picker',         context: 'global', note: 'FU-1 — registerKeyBinding({handler})' },
   { keys: ['Ctrl+P', 'Ctrl+ㅔ'],   action: 'Open finder (file picker)',      context: 'global', note: 'FU-1 — registerKeyBinding({handler})' },
   { keys: ['Ctrl+M', 'Ctrl+ㅡ'],   action: 'Arm pane-modal chord (1 s window; next letter opens deferred pane)', context: 'global', note: 'FU-1 — coordinator chord, SHORTCUT_TABLE' },
-  { keys: ['Ctrl+B', 'Ctrl+ㅠ'],   action: 'Arm virtual-window chord (1 s window; see §14)', context: 'global', note: 'FU-2 — coordinator chord' },
-  { keys: ['Ctrl+B w'],            action: 'Focus working-dir browser',      context: 'global', note: 'tmux-style prefix chord' },
-  { keys: ['Ctrl+B o'],            action: 'Focus Obsidian browser',         context: 'global' },
-  { keys: ['Ctrl+B s'],            action: 'Reopen scratchpad (pane-browse) · Enter sync mode (chat input) — A3',  context: 'global', note: 'input-focus route added P5 / unified in C1' },
-  { keys: ['Ctrl+B g'],            action: 'Exit sync/control mode → general (chat input)',                       context: 'global', note: 'P5 input-focus only' },
-  { keys: ['Ctrl+B S'],            action: 'Focus sessions sidebar',         context: 'global', note: 'ST4 — jumps focus to the leadColumn session list' },
-  { keys: ['Ctrl+B n'],            action: 'Next VW / advance to next session + focus sidebar', context: 'global', note: 'ST4 + VW chord — context gated' },
-  { keys: ['Ctrl+B p'],            action: 'Prev VW / retreat to previous session + focus sidebar', context: 'global', note: 'ST4 + VW chord — context gated' },
-  { keys: ['Ctrl+B 0'],            action: 'Open window picker (VW chord)',  context: 'global', note: 'FU-2' },
-  { keys: ['Ctrl+B 1'],            action: 'Switch to VW 1 (Ctrl+1 also works)', context: 'global', note: 'FU-2 — also 2..9' },
-  { keys: ['Ctrl+B c'],            action: 'New virtual window — terminal (pane-browse) · Enter control mode (chat input)', context: 'global', note: 'FU-2 + P5 input-focus chord overlay' },
-  { keys: ['Ctrl+B t'],            action: 'Toggle modal ↔ virtual-window session', context: 'global', note: 'FU-2' },
-  { keys: ['Ctrl+B x'],            action: 'Close focused pane (VW chord)',  context: 'global', note: 'FU-2' },
-  { keys: ['Ctrl+B Shift+X'],      action: 'Close whole window (VW chord)',  context: 'global', note: 'FU-2 — Shift+X dispatch fixed' },
-  { keys: ['Ctrl+B %', 'Ctrl+B s'], action: 'Horizontal split',              context: 'global', note: 'FU-2' },
-  { keys: ['Ctrl+B "', 'Ctrl+B v'], action: 'Vertical split',                context: 'global', note: 'FU-2' },
-  { keys: ['Ctrl+B ?'],            action: 'Open VW chord help popup (transient modal, 8 s)', context: 'global', note: 'FU-2 — upgraded from chatLines' },
-  { keys: ['Ctrl+B z'],            action: 'Toggle zoom on focused pane (fullscreen within VW)', context: 'global', note: 'VW-U5' },
-  { keys: ['Ctrl+B Tab'],          action: 'Focus last pane (alt-tab within VW)',             context: 'global', note: 'VW-U5' },
-  { keys: ['Ctrl+B R'],            action: 'Rename foreground window (input modal)',          context: 'global', note: 'VW-B1 — tmux `,` 는 prev 이라 R 사용' },
-  { keys: ['Ctrl+B A'],            action: 'Rename focused pane (VW-local override, empty clears)', context: 'global', note: 'VW-B2' },
+  { keys: ['Ctrl+B'],             action: 'Background running child tasks (while streaming; turn continues)', context: 'global' },
+  { keys: ['Ctrl+X', 'Ctrl+ㅌ'],   action: 'Arm dashboard pane chord (1 s window)', context: 'pane' },
+  { keys: ['Ctrl+X Ctrl+W'],       action: 'Focus working-dir browser',      context: 'global', note: 'pane-browse chord' },
+  { keys: ['Ctrl+X Ctrl+O'],       action: 'Focus Obsidian browser',         context: 'global', note: 'pane-browse chord' },
+  { keys: ['Ctrl+X Ctrl+S'],       action: 'Reopen scratchpad (pane-browse)', context: 'global' },
+  { keys: ['Ctrl+X s'],            action: 'Enter sync mode (chat input)',   context: 'input' },
+  { keys: ['Ctrl+X g'],            action: 'Exit sync/control mode → general (chat input)', context: 'input' },
+  { keys: ['Ctrl+X S'],            action: 'Focus sessions sidebar',        context: 'pane' },
+  { keys: ['Ctrl+X n'],            action: 'Advance to next session + focus sidebar', context: 'pane' },
+  { keys: ['Ctrl+X p'],            action: 'Retreat to previous session + focus sidebar', context: 'pane' },
+  { keys: ['Ctrl+X c'],            action: 'Enter control mode (chat input)', context: 'input' },
+  { keys: ['Ctrl+X x'],            action: 'Close focused pane',             context: 'pane' },
+  { keys: ['Ctrl+X z'],            action: 'Toggle log zoom',               context: 'pane' },
+  { keys: ['Ctrl+X t'],            action: 'Open preview terminal',          context: 'pane' },
+  { keys: ['Ctrl+X e'],            action: 'Toggle preview terminal expansion', context: 'pane' },
+  { keys: ['Ctrl+X f'],            action: 'Toggle all log folds',          context: 'pane' },
   { keys: ['Alt+N', 'Alt+ㅜ'],     action: 'Next virtual window (fast-switch, no chord)',       context: 'global', note: 'VW-U2 — guarded by list().length>1' },
   { keys: ['Alt+P', 'Alt+ㅔ'],     action: 'Prev virtual window (fast-switch, no chord)',       context: 'global', note: 'VW-U2' },
   { keys: ['Alt+1..9'],            action: 'Switch directly to Nth virtual window',             context: 'global', note: 'VW-U2 — guarded by list().length>1' },
   { keys: ['Alt+0'],               action: 'Open window picker (fast, no chord)',               context: 'global', note: 'VW-U2' },
-  { keys: ['Ctrl+B b'],            action: 'Toggle notification bell modal',  context: 'global', note: 'NT5 — open/close bell modal with unread + error filter' },
+  { keys: ['Ctrl+X b'],            action: 'Toggle notification bell modal',  context: 'pane', note: 'NT5 — open/close bell modal with unread + error filter' },
   { keys: ['Ctrl+Shift+V', 'Ctrl+Shift+ㅍ'], action: 'Enter Voice mode (Space hold push-to-talk · Esc to exit)', context: 'global', note: 'PR-S1V.4 — voice-input-host · kitty >3u on entry · brand prefix routing' },
   { keys: ['Alt+S', 'Alt+ㄴ'], action: 'Toggle continuous voice-chat mode (real-time STT + auto-TTS · ESC or chord again to exit)', context: 'global', note: '2026-05-03 — moved from Alt+R to free R for reasoning cycle (V/D/R mnemonic)' },
   { keys: ['Alt+R', 'Alt+ㄱ'], action: 'Cycle reasoning level (off → low → medium → high → xhigh). Codex / Claude reasoning models only — no-op on grok/gemini', context: 'global', note: '2026-05-03 — provider-agnostic ReasoningLevel cycle, same effect as `/reasoning` slash. V/D/R mnemonic: V=voice control (Ctrl+Shift+V), D=batch dictation (Space-longpress), R=reasoning' },

package/src/llm/provider-credentials.ts

@@ -209,7 +209,7 @@ export function resolveProviderCredential(input: ResolveCredentialInput): Resolv
   // 목표 provider 의 엔드포인트 — 키와 **같은 규율**로 rotation 에서만 가져온다(10R).
   //   전환이면 옛 baseUrl 은 틀린 주소이므로, rotation 에 명시가 없으면 undefined(provider 기본).
   // ⛔⭐ local 은 «런 단위 env»(`LOCAL_LLM_URL`)가 config rotation 을 이긴다 — `ELANOUS_LLM_PROVIDER` 가 config 를 이기는 것과 같은 규칙(BACKLOG B13).
-  //   🩸 2026-09-25: 부모에 `LOCAL_LLM_URL=<node-b 경유>` 를 줬는데 rotation 의 `local → localhost:1234` 가 이겨 자식이 «호스트»
+  //   🩸 2026-09-25: 부모에 `LOCAL_LLM_URL=<원격 프록시>` 를 줬는데 rotation 의 `local → localhost:1234` 가 이겨 자식이 «호스트»
   //     LM Studio 로 갔다. Pod(config 없음)에선 안 드러났다.
   const envEndpoint = provider === 'local' ? env.LOCAL_LLM_URL?.trim() : undefined;
   const endpoint = envEndpoint || rotation?.find((r) => r.provider === provider && typeof r.baseUrl === 'string' && r.baseUrl.trim().length > 0)?.baseUrl?.trim();

package/src/llm/route-decision.ts

@@ -8,6 +8,7 @@
 
 import type { LLMProviderName, ReasoningLevel, LlmRoutePolicyConfig } from '../user-config.js';
 import { classifyMissionTier1, type MissionKind } from './mission-router.js';
+import type { SessionSource } from '../session/index.js';
 import { lookupLlmTierSpec } from '../model-tier/llm-tier-map.js';
 
 export type RouteDecisionSource = 'explicit-pin' | 'codex-tier-policy' | 'legacy-default' | 'active-provider-default' | 'execution-backend';
@@ -111,6 +112,8 @@ export interface ResolveRouteDecisionInput {
   provider: LLMProviderName;
   configuredModel?: string;
   text: string;
+  /** Telegram keeps its non-deep coding tier; other surfaces retain the configured quick model. */
+  surface?: SessionSource;
   /** A per-turn/slash/user model choice.  It always wins. */
   explicitModel?: string;
   routePolicy?: LlmRoutePolicyConfig;
@@ -145,6 +148,16 @@ export function resolveRouteDecision(input: ResolveRouteDecisionInput): RouteDec
     };
   }
   const policyMode = input.routePolicy?.mode;
+  // Unspecified callers keep the configured quick model for compatibility; Telegram alone owns the coding-tier exception.
+  if (input.provider === 'openai-codex' && input.surface !== 'telegram' && policyMode === undefined && mission === 'quick' && input.configuredModel) {
+    return {
+      provider: input.provider,
+      model: input.configuredModel,
+      source: 'active-provider-default',
+      rationale: 'configured model preserved for quick mission',
+      mission,
+    };
+  }
   if (input.provider === 'openai-codex' && policyMode !== 'active-provider') {
     const deep = mission === 'plan' || mission === 'review';
     const tier = deep ? 'best' : 'better';

package/src/llm-tool-name.ts

@@ -0,0 +1,37 @@
+/** Provider wire names have a deliberately smaller alphabet than MCP names.
+ * Keep the source name in the TUI/tool catalog and use this reversible map
+ * only for one provider request and its returned tool calls. */
+export interface ProviderToolNameMap {
+  toProviderName(name: string): string;
+  toOriginalName(name: string): string;
+}
+
+export function sanitizeProviderToolName(name: string): string {
+  const sanitized = name.replace(/[^a-zA-Z0-9_-]/g, '_');
+  return sanitized.length > 0 ? sanitized : 'tool';
+}
+
+/** Build a deterministic, collision-free mapping for the complete request
+ * namespace. Repeated source names intentionally share one wire name. */
+export function createProviderToolNameMap(names: readonly string[]): ProviderToolNameMap {
+  const originalToProvider = new Map<string, string>();
+  const providerToOriginal = new Map<string, string>();
+
+  for (const original of names) {
+    if (originalToProvider.has(original)) continue;
+
+    const base = sanitizeProviderToolName(original);
+    let candidate = base;
+    let suffix = 2;
+    while (providerToOriginal.has(candidate)) {
+      candidate = `${base}__${suffix++}`;
+    }
+    originalToProvider.set(original, candidate);
+    providerToOriginal.set(candidate, original);
+  }
+
+  return {
+    toProviderName: (name) => originalToProvider.get(name) ?? sanitizeProviderToolName(name),
+    toOriginalName: (name) => providerToOriginal.get(name) ?? name,
+  };
+}