elanous 0.2.36 → 0.2.38

package/src/self-implement/seams.ts

@@ -23,7 +23,6 @@ import { createArtifactStore } from '../artifact/index.js';
 import { tmpdir } from 'node:os';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { promisify } from 'node:util';
-import { forkSessionById, HARNESS_SESSION_ORIGIN, isHarnessSessionOrigin } from '../session/index.js';
 import { configuredWorktreeRoot, getUserConfig, resolveActiveProvider, resolveRoleLlm } from '../user-config.js';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { addHarnessQueue } from '../harness/harness-queue.js';
@@ -1287,7 +1286,7 @@ export interface SameCellCardRebindObservation {
   detail?: string;
 }
 
-export type OpenPrOutcome = { url: string; number: number; rebind?: SameCellCardRebindObservation };
+export type OpenPrOutcome = { url: string; number: number; boundCardReuse?: { headRefName: string }; rebind?: SameCellCardRebindObservation };
 
 type DefaultSeamsResult = Omit<SelfImplementSeams, 'diagnose' | 'openPr'> & {
   diagnose: (ctx: DefaultSeamsDiagnoseInput) => Promise<string>;
@@ -1305,7 +1304,9 @@ type SameCellRebindDecision =
 type SameCellRebindExtra = { boundPr?: number; detail?: string };
 
 /** 같은 칸 새 draft 뒤 카드 재결속 — 사유를 다섯 갈래로 나눠 남기고, 카드 저장소가 없는 실행은 던지지 않고
- *  deferred 로 돌려준다(Pod 자식은 본부 카드 저장소가 없다 · 부모 pr-terminal 결속은 #29948 이 맡는다). */
+ *  deferred 로 돌려준다(Pod 자식은 본부 카드 저장소가 없다 · 부모 pr-terminal 결속은 #29948 이 맡는다).
+ *  카드 저장소가 있는 호스트에서 card-missing·card-id-absent 는 조용한 성공이 아니라
+ *  debug.log('self-implement.same-cell','rebind-missing-on-host',{reason}) 경고로 분리한다(#30021 r4 shouldFix). */
 function rebindSameCellCardToPr(input: {
   taskCardId: string | undefined;
   storePath: string;
@@ -1329,8 +1330,14 @@ function rebindSameCellCardToPr(input: {
     debug.log('self-implement.pr', 'same-cell-card-rebind-failed', { ...base, ...extra, reason }, { level: 'warn' });
     throw new Error(`same-cell 새 draft ${input.url} 개설됨; 카드 재결속 실패(${reasonText}) — 새 PR 수확 필요`);
   };
-  if (!input.taskCardId) return deferred('card-id-absent');
-  if (!existsSync(input.storePath)) return deferred('card-store-absent');
+  const hostStore = existsSync(input.storePath);
+  /** 호스트(카드 저장소 있음)인데 결속 대상이 없으면 deferred 로 조용히 지나가지 않고 경고 이벤트로 분리한다. */
+  const missingOnHost = (reason: SameCellCardRebindReason): SameCellCardRebindObservation => {
+    debug.log('self-implement.same-cell', 'rebind-missing-on-host', { ...base, reason }, { level: 'warn' });
+    return deferred(reason);
+  };
+  if (!input.taskCardId) return hostStore ? missingOnHost('card-id-absent') : deferred('card-id-absent');
+  if (!hostStore) return deferred('card-store-absent');
   let decision: SameCellRebindDecision | undefined;
   let updated: ReturnType<typeof updateTaskCard>;
   try {
@@ -1372,7 +1379,7 @@ function rebindSameCellCardToPr(input: {
     case 'manual-ref':
       return failed('manual-ref');
     case 'card-missing':
-      return deferred('card-missing');
+      return missingOnHost('card-missing');
     case 'already-rebound':
       observe('already-rebound');
       return { outcome: 'already-rebound', reason: 'already-rebound', cardId, oldPr: input.oldPr, newPr: input.newPr };
@@ -1674,6 +1681,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
     },
 
     forkSession: async (parentSessionId) => {
+      const { forkSessionById, HARNESS_SESSION_ORIGIN, isHarnessSessionOrigin } = await import('../session/index.js');
       const forked = forkSessionById(parentSessionId, { origin: HARNESS_SESSION_ORIGIN });
       if (!forked) throw new Error(`self-implement fork: source session not found — ${parentSessionId}`);
       if (!isHarnessSessionOrigin(forked.meta.origin)) {
@@ -1738,7 +1746,11 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
       }
       // P1 — 대상 repo: 명시 repoRoot(외부 개발) 우선, 없으면 데몬 cwd 의 repo(=elanous 자신·현행).
       const repoRoot = o.repoRoot ?? resolveMainRepoRoot(process.cwd()) ?? process.cwd();
-      const r = createWorktree({
+      // Keep the optional Pod-only implementation out of the TUI's static module graph.
+      const inPlaceCandidate = process.env.ELANOUS_POD_INPLACE_WORKTREE === '1'
+        ? (await import('./pod-inplace-worktree.js')).tryCreatePodInplaceWorktree({ repoRoot, cwd: process.cwd(), branch, ...(base ? { base } : {}), runId, ...(goalFile ? { goalFile } : {}), env: process.env })
+        : null;
+      const r = inPlaceCandidate ?? createWorktree({
         repoRoot,
         branch,
         worktreeRoot: configuredWorktreeRoot(),
@@ -1748,6 +1760,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         ...(base ? { base } : {}),
         ...(runId ? { currentOwner: `dev:${runId}` } : {}),
       });
+      const inPlace = 'inPlace' in r && r.inPlace === true;
       if (r.resolvedBase) baselineRefs.set(r.path, r.resolvedBase);
       const benchId = benchIdFromBase(base);
       if (benchId) benchWorktrees.set(r.path, benchId);
@@ -1775,6 +1788,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
           baseIsIntegration: baseIsIntegration(r.path, r.resolvedBase),
           baseFreshness: r.baseFreshness,
           ...(r.reused ? { reused: true } : {}),
+          ...(inPlace ? { inPlace: true } : {}),
           ...provenance,
         };
         const goalMetadata: HarnessWorktreeGoalMetadata = {
@@ -1795,6 +1809,8 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         const provenanceError = error instanceof Error ? error.message : String(error);
         // Manual creation rolls back on a metadata failure; self-implement retains its workspace and continues.
         debug.log('self-implement', 'worktree-provenance-failed', { path: r.path, ...(provenance ?? {}), reason: provenanceError }, { level: 'warn' });
+        // This source tree is also the Pod's recovery anchor. Never continue in-place without an owner marker.
+        if (inPlace) throw new Error(`pod in-place provenance unavailable: ${provenanceError}`);
         return {
           path: r.path,
           branch: r.branch,
@@ -1804,6 +1820,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
           baseIsIntegration: baseIsIntegration(r.path, r.resolvedBase),
           baseFreshness: r.baseFreshness,
           ...(r.reused ? { reused: true } : {}),
+          ...(inPlace ? { inPlace: true } : {}),
           provenanceError,
         };
       }
@@ -2590,26 +2607,32 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         "if (!testLine) process.exit(1);",
         "const m = testLine.match(/(\\d+)\\s+fail/); if (!m) process.exit(1);",
         "const failFromLog = Number(m[1]); if (failFromLog !== 0) process.exit(1);",
-        "if (log.indexOf('[gate-baseline] introduced=0, preexisting=0, unknown=0, precondition-unmet=0') < 0) process.exit(1);",
+        // PASS는 시험 자체의 0 fail을 잰다. 실패 귀속 baseline이 없으면 'not run'으로만 기록한다.
         // 문서가 적은 관측값이 **로그에서 읽은 값과 같아야** 한다.
         "const sections = [body('## 불변식'), body('## 판정 신호')];",
-        "if (sections.some((p) => p.indexOf('UNVERIFIABLE') >= 0)) process.exit(1);",
+        "if (sections.some((p) => /^- UNVERIFIABLE(?:[ \t]*:|[ \t]*$)/m.test(p))) process.exit(1);",
         "if (sections.some((p) => p.indexOf('filled-by: supervisor@round-' + e.round) < 0)) process.exit(1);",
                 // ⛔ writer 가 넘긴 command 를 믿지 않는다 — **로그에서 직접** 뽑아 문서와 대조한다(리뷰 must-fix).
         "const cm = testLine.match(/^\\[test\\]\\s+PASS\\s+(.+?)\\s*(?:—|$)/); if (!cm) process.exit(1);",
         "const cmdFromLog = cm[1].trim();",
-        "if (sections.some((p) => p.indexOf(cmdFromLog) < 0)) process.exit(1);",
+        "if (body('## 불변식').indexOf(cmdFromLog) < 0) process.exit(1);",
         // 문서가 baseline 문면도 담고 있어야 한다 — 근거가 문서 안에서 재검증 가능해야 한다.
                 // ⛔ 부분 문자열이 아니라 **로그의 baseline 줄 전체**와 대조한다 — `preexisting=9` 같은
         //   불일치가 통과하면 근거가 근거가 아니다(리뷰 must-fix).
-        "const bl = log.split('\\n').find((l) => l.indexOf('[gate-baseline]') === 0); if (!bl) process.exit(1);",
-        "if (body('## 불변식').indexOf(bl.trim()) < 0) process.exit(1);",
-        // ② 조건 줄의 명령을 **그 필드에서** 파싱해 대조한다 — 절 어딘가에 있으면 통과하던 것을 막는다.
+        "const bl = log.split('\\n').find((l) => l.indexOf('[gate-baseline]') === 0);",
+        "if (bl) { if (!/^\\[gate-baseline\\] introduced=0, preexisting=0, unknown=0, precondition-unmet=0(?:,|$)/.test(bl)) process.exit(1); if (e.baselineLine !== bl.trim()) process.exit(1); if (sections.some((p) => p.indexOf(bl.trim()) < 0)) process.exit(1); }",
+        "else { if (e.baselineLine !== undefined) process.exit(1); if (sections.some((p) => p.indexOf('baseline not run (test PASS)') < 0)) process.exit(1); }",
+        // ② 조건 줄의 저작 명령을 **그 필드에서** 파싱하고, 해당 명령의 별도 실행 결과가
+        // 정확히 일치하며 0으로 끝났는지 확인한다. 게이트 측정 명령은 독립된 증거다.
         "const condLine = body('## 불변식').split('\\n').find((l) => l.indexOf('조건 —') >= 0); if (!condLine) process.exit(1);",
+        // 불변식에는 writer가 측정한 명령 전문을 기록하므로, 원문 gate 명령이 해당 필드에도 있어야 한다.
         "if (condLine.indexOf(cmdFromLog) < 0) process.exit(1);",
+        "const signalLine = body('## 판정 신호').split('\\n').find((l) => l.indexOf('- Condition:') >= 0);",
+        "const authoredCommand = signalLine?.match(/- Condition:\\s*(.+?)\\s*$/)?.[1]?.trim().replace(/^`([^`]+)`(?=\\s|를|$)/, '$1').replace(/\\s*를\\s*실행한다[.。]?$/, '').replace(/[.。]$/, '').trim();",
+        "if (authoredCommand) { const s = e.authoredSignal; if (!s || s.command !== authoredCommand || s.exitCode !== 0) process.exit(1); const rendered = body('## 판정 신호'); if (!rendered.includes('exit 0') || !rendered.includes(s.command)) process.exit(1); const raw = (s.stdout + '\\n' + s.stderr).trim().slice(-1200) || '(출력 없음)'; if (!rendered.includes(raw.replace(/\\r?\\n/g, ' ⏎ '))) process.exit(1); }",
         // ⭐ 핵심 — 문서의 관측값이 로그의 값과 다르면 거부한다.
         "if (String(e.observedFail) !== String(failFromLog)) process.exit(1);",
-        "if (body('## 판정 신호').indexOf('fail ' + failFromLog) < 0) process.exit(1);",
+        "if (!e.authoredSignal && body('## 판정 신호').indexOf('fail ' + failFromLog) < 0) process.exit(1);",
         // ⛔ 불변식 쪽 관측값도 대조한다 — 한쪽만 보면 다른 쪽에 거짓 수치가 들어간다(리뷰 must-fix).
         "if (body('## 불변식').indexOf('관측됨 — fail ' + failFromLog) < 0) process.exit(1);",
         // 문서 어디에도 로그와 **다른** fail 수치가 있으면 안 된다(정규식은 런타임에 만든다).
@@ -2622,8 +2645,9 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         //   그 안에 게이트 로그가 통째로 들어 있어 `$(...)`·백틱이 **셸에서 실행**될 수 있었다(리뷰 must-fix).
         //   ⇒ 파일로 넘기고 검사기가 읽는다. 명령 문자열에는 **고정 리터럴만** 남는다.
         writeFileSync(join(root, 'evidence.json'), JSON.stringify(evidence));
+        writeFileSync(join(root, 'checker.cjs'), checker);
         const rule = withIndependentChecker({ kind: 'and', rules: [] }, {
-          command: `bun -e ${JSON.stringify(checker)}`,
+          command: 'bun checker.cjs',
           timeoutMs: 5_000,
         });
         const outcome = await evaluateTermination(rule, { vault: {} as never, budget: {} as never, goalRoot: root });
@@ -2686,7 +2710,12 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
           taskCardId, storePath: taskAgentStatePath(), oldPr: outcome.supersededPr, newPr: number, url: outcome.url,
         });
       }
-      const opened: OpenPrOutcome = { url: outcome.url, number: Number.isFinite(number) ? number : 0, ...(rebind ? { rebind } : {}) };
+      // `reused` also covers unbound legacy branches. The manager supplies the
+      // proven old head only after exact same-card identity and lease checks.
+      const boundCardReuse = outcome.reused && outcome.boundCardHeadRefName
+        && !!taskCardId && /^[A-Za-z0-9][A-Za-z0-9._:-]{2,}$/.test(taskCardId)
+        ? { headRefName: outcome.boundCardHeadRefName } : undefined;
+      const opened: OpenPrOutcome = { url: outcome.url, number: Number.isFinite(number) ? number : 0, ...(boundCardReuse ? { boundCardReuse } : {}), ...(rebind ? { rebind } : {}) };
       return opened;
     },
 

package/src/self-implement/self-implement-cli.ts

@@ -19,6 +19,7 @@ import type { DocumentReferenceStatus } from './self-implement-runtime.js';
 import { resolveObserveOnlyDecision } from './observe-only.js';
 import { getUserConfig } from '../user-config.js';
 import { resolveAutoReview } from './context-capsule.js';
+import { readDecomposeProposals } from '../self-dev/decompose-proposal.js';
 
 /** self implement CLI 옵션(commander) — `--no-draft` 는 draft:false 로, `--max-wait` 는 문자열로 도착. */
 export interface SelfImplementCliOpts {
@@ -71,6 +72,28 @@ export interface SelfImplementCliDeps {
   }>;
   /** runDevPipeline 내부 배선 주입(runSelfImplement/seams 등·테스트). */
   pipelineDeps?: DevPipelineDeps;
+  /** Parent-side run-ledger observation, injected to verify terminal JSON evidence. */
+  readGoalPlanRevision?: typeof readDecomposeProposals;
+}
+
+function attachGoalPlanRevisionObservation(
+  result: SelfImplementResult,
+  deps: SelfImplementCliDeps,
+): SelfImplementResult {
+  if (result.goalPlanRevision !== undefined || typeof result.runId !== 'string' || !result.runId.trim()) return result;
+  try {
+    // The ledger reader joins by shardId when present and otherwise by runId; a single-run
+    // child uses its runId as either key depending on the writer, so query both explicitly.
+    const scan = (deps.readGoalPlanRevision ?? readDecomposeProposals)({
+      shardIds: [result.runId],
+      runIds: [result.runId],
+    });
+    const observation = scan.goalPlanRevisions.get(result.runId) ?? scan.readFailure;
+    return observation ? { ...result, goalPlanRevision: observation } : result;
+  } catch {
+    // An unavailable observation stays absent; the supervisor treats that as a hold.
+    return result;
+  }
 }
 
 /**
@@ -210,6 +233,7 @@ export async function runSelfImplementCliCommand(
       : deps.pipelineDeps;
     const exec = deps.executeReroute ?? executeSelfImplementReroute;
     let { result, exitCode } = await exec(spec, pipelineDeps ? { pipelineDeps } : undefined);
+    result = attachGoalPlanRevisionObservation(result, deps);
 
     // ⭐⭐⭐ 단일 실행도 «루프»를 지난다 (E2) — 판정자는 연합과 «같은 자»다.
     //   ⛔ 종전엔 단일이 실패하면 그냥 끝났다. 아무도 「다시 걸까」를 묻지 않았다.
@@ -257,9 +281,9 @@ export async function runSelfImplementCliCommand(
         rerun: async (_, invocation) => {
           const repairGoal = invocation.repairGoals?.[initialJob.taskId];
           const next = await exec(repairGoal ? { ...spec, input: { ...spec.input, text: repairGoal } } : spec, pipelineDeps ? { pipelineDeps } : undefined);
-          result = next.result;
+          result = attachGoalPlanRevisionObservation(next.result, deps);
           exitCode = next.exitCode;
-          return [{ ...singleRunAsJobResult(feature, next.result), taskId: initialJob.taskId }];
+          return [{ ...singleRunAsJobResult(feature, result), taskId: initialJob.taskId }];
         },
       });
     }

package/src/self-implement/stop-autoheal.ts

@@ -51,6 +51,7 @@ export const AUTOHEAL_ACTION_BY_CLASS: Readonly<Record<RunStopClass, AutohealAct
   'env-unrelated': 'clean-workspace-regate',
   'main-sync': 'rebase-regate',
   'pod-died': 'resume-from-salvage',
+  'pod-vanished': 'needs-owner',
   'evidence-uncovered': 'derive-evidence-rejudge',
   'review-repeat': 'needs-owner',
   'review-out-of-scope': 'needs-owner',

package/src/self-implement/test-seams.ts

@@ -11,7 +11,8 @@ export function seams(over: Partial<SelfImplementSeams> & { gateResults?: boolea
   const gateResults = over.gateResults ?? [true];
   let gateCall = 0;
   const features = over.features ?? [];
-  return {
+  let openedHead = '';
+  const defaults: SelfImplementSeams = {
     // ⭐ 테스트는 «환경(실제 stdin)»이 아니라 계약을 검사한다 — 기본은 「사람이 있다」로 둔다.
     //    비-TTY 게이트 자체는 아래 전용 테스트가 «명시»로 확인한다.
     stdinIsInteractive: () => true,
@@ -41,4 +42,15 @@ export function seams(over: Partial<SelfImplementSeams> & { gateResults?: boolea
     decomposeShadowGoals: async () => ({ goals: [], decomposition: { recommendedMaxTasks: 6, actualTaskCount: 0, truncatedAtHardMax: false, exceededRecommendedMax: false, outcome: 'single-no-subtasks' } }),
     ...over,
   };
+  const openPr = defaults.openPr;
+  const defaultPrAttribution = Object.assign(async () => ({
+    headRefName: openedHead, createdAt: new Date(Date.now() + 60_000).toISOString(),
+  }), { testDefaultPrAttribution: true });
+  return {
+    ...defaults,
+    openPr: async (input) => { openedHead = input.head; return openPr(input); },
+    // Unit seams represent the PR just opened by this run. Tests of mismatch
+    // and metadata failures override this explicitly, without invoking gh.
+    readPrAttribution: over.readPrAttribution ?? defaultPrAttribution,
+  };
 }

package/src/self-implement/train-reach-grouping.ts

@@ -2,6 +2,7 @@ import { spawnSync } from 'node:child_process';
 import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
 import { isAbsolute } from 'node:path';
 import { selectGateTestFiles } from './gate-cli.js';
+import { defineTrainGrouping } from '../../scripts/release-loop/gate-closure.js';
 
 export interface TrainReachCandidate {
   pr: string;
@@ -126,9 +127,14 @@ export function buildTrainReachDecision(input: TrainReachInput, inspect: Inspect
   const edges: Array<{ left: number; right: number; tests: string[]; paths: string[] }> = [];
   for (let left = 0; left < measured.length; left++) {
     for (let right = left + 1; right < measured.length; right++) {
-      const tests = measured[left].tests.filter((path) => measured[right].tests.includes(path));
+      // 도달 시험 집합의 교집합이 «같은 열차»를 정한다 — TRAIN-REACH-GROUPING 원장(gate-closure.ts).
+      const grouping = defineTrainGrouping(
+        { pr: measured[left].candidate.pr, tests: measured[left].tests },
+        { pr: measured[right].candidate.pr, tests: measured[right].tests },
+      );
+      const tests = [...grouping.intersection];
       const paths = measured[left].files.filter((path) => measured[right].files.includes(path));
-      if (!tests.length && !paths.length) continue;
+      if (!grouping.sameTrain && !paths.length) continue;
       edges.push({ left, right, tests, paths });
       parent[find(right)] = find(left);
     }

package/src/session/channel-ask-op-envelope.ts

@@ -0,0 +1,36 @@
+export interface AskOpQuestionEnvelope {
+  surface: 'telegram';
+  botId: string;
+  chatId: number | string;
+  threadId?: number | string;
+  messageId: number | string;
+  updateId: number | string;
+  question: string;
+}
+
+export const ASK_OP_COMMAND = 'askop';
+
+export function formatAskOpQuestionEnvelope(input: AskOpQuestionEnvelope): string {
+  return [
+    `Telegram /${ASK_OP_COMMAND}`,
+    `botId=${input.botId}`,
+    `chatId=${input.chatId}`,
+    `threadId=${input.threadId ?? 'none'}`,
+    `messageId=${input.messageId}`,
+    `updateId=${input.updateId}`,
+    `question: ${input.question.trim()}`,
+  ].join('\n');
+}
+
+export function parseAskOpQuestionEnvelope(body: string): AskOpQuestionEnvelope | null {
+  const telegram = /^Telegram \/(?:askop|ask-op)\nbotId=([A-Za-z0-9_-]+)\nchatId=(-?\d+)\nthreadId=(none|\d+)\nmessageId=(\d+)\nupdateId=(\d+)\nquestion: ([\s\S]+)$/.exec(body);
+  if (telegram) {
+    const [, botId, chatId, threadId, messageId, updateId, question] = telegram;
+    return {
+      surface: 'telegram', botId: botId!, chatId: chatId!,
+      ...(threadId === 'none' ? {} : { threadId: threadId! }),
+      messageId: messageId!, updateId: updateId!, question: question!,
+    };
+  }
+  return null;
+}

package/src/session/channel-op-reply-route.ts

@@ -0,0 +1,200 @@
+import { openMsgStore, openMsgStoreReadOnly, type Message, type MsgStore } from '../msg/msg-store.js';
+import { subscribeMsgStream, type MsgStreamHandle } from '../msg/msg-sse-client.js';
+import { join } from 'node:path';
+import { elanousStateRoot } from '../autopilot/state-paths.js';
+import { debug } from '../debug/log.js';
+import { isOwnInstanceEndpoint, parseTelegramEndpoint, telegramEndpointKey } from './session-endpoint-key.js';
+import type { TelegramBot } from '../telegram.js';
+import { parseAskOpQuestionEnvelope } from './channel-ask-op-envelope.js';
+
+export type ChannelOpEndpoint = { surface: 'telegram'; key: string } & NonNullable<ReturnType<typeof parseTelegramEndpoint>>;
+
+export interface ChannelOpReplyTransport {
+  /** Must reject endpoint keys whose instance or bot is not served by this transport. */
+  canSend(endpoint: ChannelOpEndpoint): boolean;
+  /** The stable idempotency key lets a transport suppress retries if it supports them. */
+  send(endpoint: ChannelOpEndpoint, body: string, idempotencyKey: string): Promise<{ receiptId: string }>;
+}
+
+export function createTelegramChannelOpReplyTransport(input: {
+  bot: Pick<TelegramBot, 'sendMessage'>;
+  botId: string;
+  instance: string;
+}): ChannelOpReplyTransport {
+  return {
+    canSend(endpoint) {
+      return endpoint.surface === 'telegram'
+        && isOwnInstanceEndpoint(endpoint.instance, input.instance)
+        && endpoint.botId === input.botId;
+    },
+    async send(endpoint, body, idempotencyKey) {
+      if (endpoint.surface !== 'telegram') throw new Error('Telegram transport cannot send to Discord');
+      const sent = await input.bot.sendMessage(Number(endpoint.chatId), body, {
+        ...(endpoint.threadId !== '0' ? { threadId: Number(endpoint.threadId) } : {}),
+      });
+      return { receiptId: sent && 'messageId' in sent ? `telegram:${sent.messageId}` : `telegram:${idempotencyKey}` };
+    },
+  };
+}
+
+export type ChannelOpReplyResult =
+  | { status: 'delivered'; receiptId: string }
+  | { status: 'already-delivered'; receiptId: string }
+  | { status: 'held' }
+  | { status: 'unknown' }
+  | { status: 'failed-permanent'; errorCode: number }
+  | { status: 'rejected'; reason: 'not-op-reply' | 'missing-question' | 'invalid-question' | 'invalid-endpoint' | 'unknown-endpoint' | 'already-answered' };
+
+const CREATE_RECEIPTS = `CREATE TABLE IF NOT EXISTS channel_op_reply_receipts (
+  question_id INTEGER PRIMARY KEY REFERENCES msg_messages(id),
+  answer_id INTEGER NOT NULL UNIQUE REFERENCES msg_messages(id),
+  endpoint_key TEXT NOT NULL,
+  status TEXT NOT NULL CHECK(status IN ('sending', 'delivered', 'unknown', 'retry', 'failed-permanent')),
+  transport_receipt TEXT,
+  transport_error_code INTEGER,
+  updated_at TEXT NOT NULL
+)`;
+
+function telegramEndpoint(questionBody: string, instance: string): ChannelOpEndpoint | null {
+  const source = parseAskOpQuestionEnvelope(questionBody);
+  if (!source) return null;
+  const threadId = source.threadId ?? '0';
+  if (!Number.isSafeInteger(Number(source.chatId)) || !Number.isSafeInteger(Number(threadId))) return null;
+  const key = telegramEndpointKey({ instance, botId: source.botId, chatId: source.chatId, threadId });
+  const parsed = parseTelegramEndpoint(key);
+  return parsed ? { surface: 'telegram', key, ...parsed } : null;
+}
+
+function parseQuestionEndpoint(questionBody: string, instance: string): ChannelOpEndpoint | null {
+  return telegramEndpoint(questionBody, instance);
+}
+
+/**
+ * Resolve an OP reply through its durable replyTo link, claim one channel receipt,
+ * and send only to the endpoint captured in that question's stored envelope.
+ * An interrupted/ambiguous attempt is held rather than resent. Telegram 4xx
+ * responses other than rate limiting are terminal because the request cannot succeed unchanged.
+ */
+export async function deliverChannelOpReply(
+  store: MsgStore,
+  answerId: number,
+  transport: ChannelOpReplyTransport,
+  options: { instance: string },
+): Promise<ChannelOpReplyResult> {
+  store.db.exec(CREATE_RECEIPTS);
+  const answer = store.getMessage(answerId);
+  if (!answer || answer.from !== 'OP' || answer.replyTo === undefined) return { status: 'rejected', reason: 'not-op-reply' };
+  const question = store.getMessage(answer.replyTo);
+  if (!question) return { status: 'rejected', reason: 'missing-question' };
+  if (question.to !== 'COORDINATOR' || question.kind !== 'question' || question.from !== 'TELEGRAM') {
+    return { status: 'rejected', reason: 'invalid-question' };
+  }
+  const source = parseAskOpQuestionEnvelope(question.body);
+  if (!source) return { status: 'rejected', reason: 'invalid-endpoint' };
+  const provenanceKey = `coord:tg-${source.botId}-${source.updateId}:COORDINATOR`;
+  const provenance = store.db.query(`SELECT 1 FROM msg_provenance WHERE provenance_key = ? AND message_id = ?`)
+    .get(provenanceKey, question.id);
+  if (!provenance) return { status: 'rejected', reason: 'invalid-question' };
+  const endpoint = parseQuestionEndpoint(question.body, options.instance);
+  if (!endpoint) return { status: 'rejected', reason: 'invalid-endpoint' };
+  if (!transport.canSend(endpoint)) return { status: 'rejected', reason: 'unknown-endpoint' };
+
+  const claim = store.db.transaction(() => {
+    const existing = store.db.query(`SELECT answer_id, endpoint_key, status, transport_receipt, transport_error_code
+      FROM channel_op_reply_receipts WHERE question_id = ?`).get(question.id) as {
+        answer_id: number; endpoint_key: string; status: 'sending' | 'delivered' | 'unknown' | 'retry' | 'failed-permanent'; transport_receipt: string | null; transport_error_code: number | null;
+      } | null;
+    if (existing) {
+      if (existing.answer_id !== answer.id || existing.endpoint_key !== endpoint.key) return { kind: 'already-answered' as const };
+      if (existing.status === 'delivered') return { kind: 'delivered' as const, receiptId: existing.transport_receipt ?? '' };
+      if (existing.status === 'failed-permanent') return { kind: 'failed-permanent' as const, errorCode: existing.transport_error_code ?? 400 };
+      if (existing.status !== 'retry') return { kind: 'held' as const };
+      store.db.query(`UPDATE channel_op_reply_receipts SET status = 'sending', updated_at = ?
+        WHERE question_id = ? AND answer_id = ? AND status = 'retry'`)
+        .run(new Date().toISOString(), question.id, answer.id);
+      return { kind: 'claimed' as const };
+    }
+    store.db.query(`INSERT INTO channel_op_reply_receipts(question_id, answer_id, endpoint_key, status, updated_at)
+      VALUES (?, ?, ?, 'sending', ?)`).run(question.id, answer.id, endpoint.key, new Date().toISOString());
+    return { kind: 'claimed' as const };
+  }).immediate();
+  if (claim.kind === 'already-answered') return { status: 'rejected', reason: 'already-answered' };
+  if (claim.kind === 'delivered') return { status: 'already-delivered', receiptId: claim.receiptId };
+  if (claim.kind === 'failed-permanent') return { status: 'failed-permanent', errorCode: claim.errorCode };
+  if (claim.kind === 'held') return { status: 'held' };
+
+  try {
+    const receipt = await transport.send(endpoint, answer.body, `ask-op-reply:${question.id}`);
+    store.db.transaction(() => {
+      store.db.query(`UPDATE channel_op_reply_receipts SET status = 'delivered', transport_receipt = ?, updated_at = ?
+        WHERE question_id = ? AND answer_id = ? AND status = 'sending'`)
+        .run(receipt.receiptId, new Date().toISOString(), question.id, answer.id);
+    }).immediate();
+    return { status: 'delivered', receiptId: receipt.receiptId };
+  } catch (error) {
+    const errorCode = error && typeof error === 'object' && 'errorCode' in error
+      ? (error as { errorCode?: unknown }).errorCode
+      : undefined;
+    const permanent4xx = typeof errorCode === 'number' && Number.isInteger(errorCode)
+      && errorCode >= 400 && errorCode < 500 && errorCode !== 429;
+    const permanentErrorCode = permanent4xx ? errorCode as number : null;
+    store.db.transaction(() => {
+      store.db.query(`UPDATE channel_op_reply_receipts SET status = ?, transport_error_code = ?, updated_at = ?
+        WHERE question_id = ? AND answer_id = ? AND status = 'sending'`)
+        .run(permanent4xx ? 'failed-permanent' : 'unknown', permanentErrorCode, new Date().toISOString(), question.id, answer.id);
+    }).immediate();
+    if (permanentErrorCode !== null) return { status: 'failed-permanent', errorCode: permanentErrorCode };
+    return { status: 'unknown' };
+  }
+}
+
+/** Explicit operator reconciliation for an ambiguous Telegram send. */
+export function reconcileChannelOpReply(
+  store: MsgStore,
+  questionId: number,
+  decision: { status: 'delivered'; receiptId: string } | { status: 'not-delivered' },
+): boolean {
+  store.db.exec(CREATE_RECEIPTS);
+  if (decision.status === 'delivered' && !decision.receiptId.trim()) throw new Error('receiptId is required for delivered reconciliation');
+  const status = decision.status === 'delivered' ? 'delivered' : 'retry';
+  const receiptId = decision.status === 'delivered' ? decision.receiptId : null;
+  return store.db.transaction(() => store.db.query(`UPDATE channel_op_reply_receipts
+    SET status = ?, transport_receipt = ?, updated_at = ? WHERE question_id = ? AND status IN ('sending', 'unknown')`)
+    .run(status, receiptId, new Date().toISOString(), questionId).changes === 1).immediate();
+}
+
+export interface StartChannelOpReplyRouteOptions {
+  transport: ChannelOpReplyTransport;
+  instance: string;
+  botId: string;
+  cursorPath?: string;
+  openReadStore?: () => MsgStore;
+  openWriteStore?: () => MsgStore;
+}
+
+/** Listen to the Telegram seat mailbox and route only linked OP replies. */
+export function startChannelOpReplyRoute(options: StartChannelOpReplyRouteOptions): MsgStreamHandle {
+  const cursorPath = options.cursorPath ?? join(
+    elanousStateRoot(), 'msg', 'sse-cursor', `TELEGRAM-channel-op-replies-${options.botId}.json`,
+  );
+  return subscribeMsgStream({
+    address: 'TELEGRAM',
+    cursorPath,
+    pollMs: 500,
+    openStore: options.openReadStore ?? (() => openMsgStoreReadOnly()),
+    onMessage: async (message: Message) => {
+      if (message.to !== 'TELEGRAM' || message.from !== 'OP' || message.replyTo === undefined) return;
+      const store = (options.openWriteStore ?? (() => openMsgStore()))();
+      try {
+        const result = await deliverChannelOpReply(store, message.id, options.transport, { instance: options.instance });
+        if (result.status === 'unknown' || result.status === 'rejected' || result.status === 'held' || result.status === 'failed-permanent') {
+          debug.log('channel-op-reply-route', result.status, {
+            answerId: message.id,
+            reason: result.status === 'rejected' ? result.reason : undefined,
+            errorCode: result.status === 'failed-permanent' ? result.errorCode : undefined,
+          });
+        }
+      } finally { store.close(); }
+    },
+  });
+}

package/src/session/chat.ts

@@ -58,6 +58,8 @@ export interface RunTurnOpts {
   /** Optional callback for each streamed text delta — telegram uses this to
    *  accumulate; CLI uses it to render live. */
   onDelta?: (delta: string) => void;
+  /** Optional transient stream recovery status for the originating UI. */
+  onStatusLine?: (line: string) => void;
   /** Optional provider override — for tests. */
   provider?: LLMProvider;
   /** Originating utterance surface. Omit only when the caller cannot
@@ -183,7 +185,7 @@ function toLLM(messages: SerializedMessage[], systemPrompt?: string): LLMMessage
   for (const m of messages) {
     // 'tool' = durable tool-telemetry (추적성·audit-only). Excluded from replay
     // so persisted tool rounds don't pollute the next turn's conversation context.
-    if (m.role === 'tool') continue;
+    if (m.role === 'tool' || m.goalInterim === true) continue;
     const role: LLMMessage['role'] =
       m.role === 'user' ? 'user'
       : m.role === 'assistant' ? 'assistant'
@@ -473,6 +475,12 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
         signal: opts.signal ?? new AbortController().signal,
         callbacks: {
           onText: (delta) => { opts.onDelta?.(delta); },
+          onGoalInterim: (interimText) => {
+            appendMessage(opts.sessionId, {
+              role: 'assistant', content: interimText, ts: new Date().toISOString(),
+              tokenEstimate: estimateTokens(interimText), goalInterim: true,
+            });
+          },
           onToolCall: (call) => { toolCallArgs.set(call.id, call.args); opts.onToolCall?.(call); },
           onToolResult: (call) => {
             try {
@@ -494,6 +502,7 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
         onText: (delta /*, full */) => {
           opts.onDelta?.(delta);
         },
+        onStatus: (line) => { opts.onStatusLine?.(line); },
         dispatchTool: async (name, args, ctx) => dispatchTool(name, args, ctx),
         onToolCall: (call) => { toolCallArgs.set(call.id, call.args); opts.onToolCall?.(call); },
         onToolResult: (call) => {

package/src/session/id-prefix.ts

@@ -0,0 +1,60 @@
+// Shortest session-id prefix that still names exactly one session (TUI-RESUME-PICKER).
+// Lists used to cut every id to 8 characters, so two sessions sharing those 8 looked the same and
+// `/session load <shown prefix>` failed as ambiguous. `resolveSessionId` searches the whole index,
+// so uniqueness is measured against every id there — not only the rows on screen.
+import { listSessions } from './index.js';
+
+/** Never shorter than this, so short lists keep the familiar 8-character look. */
+export const SESSION_ID_PREFIX_MIN = 8;
+
+function commonPrefixLength(a: string, b: string): number {
+  const n = Math.min(a.length, b.length);
+  let i = 0;
+  while (i < n && a.charCodeAt(i) === b.charCodeAt(i)) i++;
+  return i;
+}
+
+/**
+ * For each id in `ids`, the shortest prefix (≥ `min`) that no other id in `universe` starts with.
+ * An id that is itself a prefix of another id gets the whole id (resolveSessionId takes an exact match).
+ */
+export function uniqueIdPrefixes(ids: readonly string[], universe: readonly string[], min = SESSION_ID_PREFIX_MIN): Map<string, string> {
+  const sorted = [...new Set([...universe, ...ids])].sort();
+  const position = new Map(sorted.map((id, i) => [id, i]));
+  const out = new Map<string, string>();
+  for (const id of ids) {
+    if (out.has(id)) continue;
+    const i = position.get(id)!;
+    // In sorted order the longest shared prefix is always with a direct neighbour.
+    const shared = Math.max(
+      i > 0 ? commonPrefixLength(id, sorted[i - 1]!) : 0,
+      i + 1 < sorted.length ? commonPrefixLength(id, sorted[i + 1]!) : 0,
+    );
+    out.set(id, id.slice(0, Math.min(id.length, Math.max(min, shared + 1))));
+  }
+  return out;
+}
+
+/** `uniqueIdPrefixes` against every session in the store (the set `/session load` resolves in). */
+export function sessionIdPrefixes(ids: readonly string[], root?: string): Map<string, string> {
+  const universe = (root === undefined ? listSessions() : listSessions({}, root)).map((m) => m.id);
+  return uniqueIdPrefixes(ids, universe);
+}
+
+/** Display helper: the unique prefix of one id, padded so a column stays aligned. */
+export function idPrefixCell(prefixes: ReadonlyMap<string, string>, id: string): string {
+  const width = Math.max(SESSION_ID_PREFIX_MIN, ...[...prefixes.values()].map((p) => p.length));
+  return (prefixes.get(id) ?? id.slice(0, SESSION_ID_PREFIX_MIN)).padEnd(width);
+}
+
+const pad2 = (n: number) => String(n).padStart(2, '0');
+
+/**
+ * `MM-DD HH:mm` in the viewer's local time zone. Lists used to slice the stored UTC ISO string
+ * (`updatedAt.slice(5, 16)`), so a KST viewer saw 16:24 for a session touched at 01:24.
+ */
+export function sessionListTime(iso: string): string {
+  const d = new Date(iso);
+  if (Number.isNaN(d.getTime())) return iso.slice(5, 16).replace('T', ' ');
+  return `${pad2(d.getMonth() + 1)}-${pad2(d.getDate())} ${pad2(d.getHours())}:${pad2(d.getMinutes())}`;
+}