elanous 0.2.40 → 0.2.42

package/src/cli/pr-land-pod-shadow-job.ts

@@ -4,6 +4,7 @@ import { join } from 'node:path';
 import { runPodCommand, type RunPodCommandOptions, type PodCommandResult } from '../task-orchestrator/surfaces/pod-command-job.js';
 import { redactSecretText } from '../debug/log.js';
 import type { RootPlanSummary } from './pr-land-heavy-remote.js';
+import type { WarmReuseEvidence, WarmReuseEvidenceByConsumer } from '../task-orchestrator/surfaces/pod-warm-switch.js';
 
 const SHA = /^[0-9a-f]{40}$/i;
 const MARKER = 'ELANOUS_PRLAND_SHADOW';
@@ -107,3 +108,62 @@ export async function runLandingPodShadowJob(input: LandingPodShadowInput, deps:
   const gateRc = Number(match[2]);
   return { measured: true, ok: tscRc === 0 && gateRc === 0, rootPlan, tscRc, gateRc, job: job.job };
 }
+
+/** WARM-REUSE-LAND-CONSUMER-WIRE — land shadow Job 결과 표본(착지쌍·lock·lease·카나리아·그림자 일치). */
+export interface LandingShadowSample {
+  /** shadow Job 이 잰 착지쌍 — 원격 게이트가 잰 head/main 와 정확히 같아야 표본으로 센다. */
+  head: string;
+  main: string;
+  /** shadow Job 이 돈 Pod generation lock — 원값 그대로 대조한다. */
+  lock: string;
+  /** shadow Job 이 lease 를 잡고 끝까지 쟀나. */
+  leaseValid: boolean;
+  /** shadow Job 카나리아(착지 tsc+gate) 통과. */
+  canaryPassed: boolean;
+  /** 같은 착지의 fresh(원격 게이트) 판정과 그림자 비교 일치 — 불일치 표본은 최근 mismatch 로 센다. */
+  agree: boolean;
+}
+
+/** land 소비자 판정 증거 입력 — 최근 창 표본 ⊕ 이번 착지가 기대하는 warm 워커 lock ⊕ 선행 소비자 증거. */
+export interface LandShadowSampleWindow {
+  /** 최근 창 — 마지막 원소가 가장 최근 shadow 결과다. */
+  samples: LandingShadowSample[];
+  /** 이번 착지가 기대하는 warm 워커 lock(현재 Pod generation). */
+  lock: string;
+  /** 선행 소비자(gate-recheck)의 자기 증거 — land 는 이 칸이 live 여야 live 가 될 수 있다(비면 off). */
+  gateRecheck?: WarmReuseEvidence;
+}
+
+/**
+ * WARM-REUSE-LAND-CONSUMER-WIRE — land shadow Job 결과에서 소비자('land') 판정 증거를 만든다.
+ * 판정 본체는 pod-warm-switch.ts `decideWarmReuse` — 이 모듈은 증거의 산지만 담당한다.
+ * 창이 없거나 비면 land 증거 칸이 비어 off 다 — 못 잰 증거는 통과가 아니다.
+ * 원값은 고쳐 읽지 않고 정확히 비교한다(신원 형식 어긋남은 pod-warm-switch 판정이 끊는다).
+ */
+export function buildLandWarmEvidence(
+  window: LandShadowSampleWindow | undefined,
+  expected: { head: string; main: string },
+): WarmReuseEvidenceByConsumer {
+  const evidence: WarmReuseEvidenceByConsumer = window?.gateRecheck ? { 'gate-recheck': window.gateRecheck } : {};
+  if (!window || window.samples.length === 0) return evidence;
+  const latest = window.samples[window.samples.length - 1]!;
+  let consecutiveMatchSamples = 0;
+  for (let index = window.samples.length - 1; index >= 0; index--) {
+    const sample = window.samples[index]!;
+    if (sample.head !== expected.head || sample.main !== expected.main || sample.lock !== window.lock
+      || sample.leaseValid !== true || sample.canaryPassed !== true || sample.agree !== true) break;
+    consecutiveMatchSamples++;
+  }
+  const recentMismatchCount = window.samples.filter((sample) => sample.agree === false).length;
+  return {
+    ...evidence,
+    land: {
+      consecutiveMatchSamples,
+      recentMismatchCount,
+      leaseValid: latest.leaseValid,
+      canaryPassed: latest.canaryPassed,
+      expected: { head: expected.head, main: expected.main, lock: window.lock },
+      worker: { head: latest.head, main: latest.main, lock: latest.lock },
+    },
+  };
+}

package/src/cli/release-checklist-read-cli.ts

@@ -109,8 +109,11 @@ export function collectChecklistEvidenceStages(item: ReturnType<typeof listCheck
       const origin = run('git', ['remote', 'get-url', 'origin']);
       const pinObject = run('git', ['cat-file', '-e', `${pinSha}^{commit}`]);
       const repoUrl = origin.stdout.trim().replace(/^git@github\.com:/i, 'https://github.com/').replace(/\.git$/i, '').replace(/\/$/u, '').toLowerCase();
-      const expectedRepo = 'https://github.com/elanvitalai/elanous';
-      if (repoRoot.status !== 0 || !repoRoot.stdout.trim() || origin.status !== 0 || repoUrl !== expectedRepo || pinObject.status !== 0) {
+      const expectedRepos = new Set([
+        'https://github.com/elanvitalai/elanous',
+        'https://github.com/ElanvitalAI/elanous',
+      ]);
+      if (repoRoot.status !== 0 || !repoRoot.stdout.trim() || origin.status !== 0 || !expectedRepos.has(repoUrl) || pinObject.status !== 0) {
         e3.reason = '현재 git 저장소가 elanous 원본이 아니거나 설치본 pin 객체가 없어 조상 관계를 판정할 수 없다';
       } else {
       const ancestry = run('git', ['merge-base', '--is-ancestor', mergeSha, pinSha]);
@@ -122,11 +125,15 @@ export function collectChecklistEvidenceStages(item: ReturnType<typeof listCheck
     }
   }
 
-  const runId = /\b(run-[a-f0-9]{8}-[a-f0-9-]{27,})\b/i.exec(evidence)?.[1]
-    ?? /\b([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})\b/i.exec(evidence)?.[1];
+  const identityToken = '(?:run-[a-f0-9]{8}-[a-f0-9-]{27,}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}|[a-z0-9][a-z0-9._:-]{2,})';
+  const labelledIdentity = new RegExp(`\\b(runId|missionId|taskId)\\s*[:=]?\\s*(${identityToken})\\b`, 'i').exec(evidence);
+  const runId = labelledIdentity?.[2]
+    ?? /\b(run-[a-f0-9]{8}-[a-f0-9-]{27,}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})\b/i.exec(evidence)?.[1];
+  const identityLabel = labelledIdentity?.[1]?.toLowerCase();
+  const identityField = identityLabel === 'missionid' ? 'missionId' : identityLabel === 'taskid' ? 'taskId' : 'runId';
   const event = /(?:event|이벤트)\s*[:=]\s*([A-Za-z0-9_.:-]+)/iu.exec(evidence)?.[1];
   const verificationCommand = /(?:완료 경계 증거 명령|증거 명령|verification command)\s*[:=]\s*([^\r\n]+)/iu.exec(`${item.title}\n${evidence}`)?.[1]?.trim() ?? null;
-  const e4: ChecklistEvidenceStage = { id: 'E4', state: 'missing', source: null, measuredAt, verificationCommand, reason: '근거에 runId·event·원문 검증 명령이 모두 필요하다' };
+  const e4: ChecklistEvidenceStage = { id: 'E4', state: 'missing', source: null, measuredAt, verificationCommand, reason: '근거에 runId·missionId·taskId 중 하나와 event·원문 검증 명령이 모두 필요하다' };
   if (runId && event && verificationCommand) {
     const logs = run('eln', ['logs', '--grep', runId, '--since', '365d', '--all', '--include-test', '--limit', '1000', '--json'], 30_000);
     if (logs.status !== 0) { e4.state = 'unmeasurable'; e4.reason = `runId 로그 조회 실패${logs.error ? `: ${logs.error}` : ''}`; }
@@ -135,16 +142,19 @@ export function collectChecklistEvidenceStages(item: ReturnType<typeof listCheck
       const truncated = rows.length >= 1000 || rows.some((row) => row._meta && typeof row._meta === 'object' && (row._meta as { limitReached?: unknown }).limitReached === true);
       const observed = rows.some((row) => {
         if (row.event !== event || typeof row.data !== 'string') return false;
-        try { return (JSON.parse(row.data) as { runId?: unknown }).runId === runId; } catch { return false; }
+        try {
+          const data = JSON.parse(row.data) as { runId?: unknown; missionId?: unknown; taskId?: unknown };
+          return data[identityField] === runId;
+        } catch { return false; }
       });
-      e4.source = `eln logs --grep ${runId} --since 365d --all --include-test --limit 1000 --json (event=${event})`;
-      if (observed) { e4.state = 'observed'; e4.reason = `같은 runId의 ${event} 실물 이벤트를 찾았다`; }
+      e4.source = `eln logs --grep ${runId} --since 365d --all --include-test --limit 1000 --json (${identityField}=${runId}, event=${event})`;
+      if (observed) { e4.state = 'observed'; e4.reason = `같은 ${identityField}의 ${event} 실물 이벤트를 찾았다`; }
       else if (truncated) { e4.state = 'unmeasurable'; e4.reason = '로그 결과가 잘려 사건 부재를 판정할 수 없다'; }
-      else { e4.reason = `같은 runId의 ${event} 이벤트가 없다`; }
+      else { e4.reason = `같은 ${identityField}의 ${event} 이벤트가 없다`; }
     }
   }
 
-  const acceptance = /- 완료 경계 실물:([^\r\n]+)/u.exec(item.title)?.[1]?.trim();
+  const acceptance = /^\s*(?:[-*]\s*)?완료 경계 실물\s*:\s*([^\r\n]+)/mu.exec(item.title)?.[1]?.trim();
   const e5Observed = Boolean(acceptance && evidence.includes(acceptance));
   const e5: ChecklistEvidenceStage = { id: 'E5', state: e5Observed ? 'observed' : 'missing', source: 'checklist title/evidence exact acceptance-text comparison', measuredAt,
     reason: e5Observed ? '완료 경계 실물 문구가 기록된 근거와 일치한다' : '완료 경계 실물 문구와 일치하는 근거가 없다' };

package/src/cli/release-cli.ts

@@ -9,6 +9,7 @@
 //   elanous release resume  --run <runId> --from <node> [--waive <node> --reason <text>] [--accepted-regressions <json>] [--gate-executor <pod|host> [--gate-host <ssh-host>]] [--gate-pod-pool <pool>] [--json]
 //   elanous release auto-start [--window-minutes <n>] [--apply] [--json]
 //   elanous release recover --run <runId> --pick <sha...> [--from export-check] [--command-root <path>] [--repo-root <path>] [--no-partial] [--json]
+//   elanous release recover-landing --run <runId> --merge <full-sha> [--from export-check] [--repo-root <path>] [--no-partial] [--json]
 //   elanous release rehearsal tick [--apply] [--checkout <dir>] [--shards <n>] [--remote <host>] [--recovery-run <id>] [--json]
 //   elanous release preflight --version <x.y.z> [--publish-at <iso>] [--json]   (컷 − 60분 main export 포함 사전 점검 · 읽기 전용 · ⛔ 있으면 exit 1)
 //   elanous release cut-branch --version <x.y.z> [--base <sha>] --pick <sha>... [--append] [--dry-run]
@@ -45,7 +46,7 @@ import { isIsolatedLedgerWriteRoot } from '../hq/ledger-write-target.js';
 import { runUnattendedRelease, type UnattendedReleaseDeps } from '../../scripts/release-loop/unattended-release.js';
 import { publishAtError } from '../../scripts/release-loop/publish-at.js';
 import { cutReleaseBranch } from '../../scripts/release-loop/cut-branch.js';
-import { planResumeReleaseRun, recoverReleaseRun, resumeReleaseRun, ReleaseRecoverStopped, type RecoverReleaseDeps } from '../../scripts/release-loop/resume-release.js';
+import { planResumeReleaseRun, recoverLandingPartialOption, recoverReleaseRun, recoverReleaseRunFromLanding, resumeReleaseRun, ReleaseRecoverStopped, type RecoverReleaseDeps } from '../../scripts/release-loop/resume-release.js';
 import type { AcceptedRegression } from '../../scripts/release-loop/resume.js';
 import type { PrereleaseKind } from '../../scripts/release-loop/release-version.js';
 import { releaseReadiness } from '../../scripts/release-loop/release-readiness.js';
@@ -1388,6 +1389,31 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
         }
       }, (r) => r.stages.every((stage) => stage.outcome === 'ok'));
     });
+  release.command('recover-landing')
+    .description('착지 알림 수동 재생 입구 — merge SHA로 중복을 억제하고 append → tip 고정 → export-check 재개를 수행한다. release-loop event hook 착지 전에는 사람이 직접 호출한다')
+    .requiredOption('--run <runId>', '실패한 release-loop 런 ID')
+    .requiredOption('--merge <sha>', 'main에 착지한 수리 커밋의 전체 40자리 SHA')
+    .option('--from <node>', '재개 시작 노드 — 기본 export-check')
+    .option('--command-root <path>', '재개 명령을 실행할 checkout — 생략 시 append tip 임시 checkout')
+    .option('--repo-root <path>', 'append를 실행할 checkout — origin remote 필요')
+    .option('--no-partial', 'Pod image digest 등이 맞지 않으면 전체 gate를 실행하며 부분 재검을 사용하지 않음')
+    .option('--json', '결과 한 줄 JSON(stdout) · 사람 줄은 stderr')
+    .action(async (o: { run: string; merge: string; from?: string; commandRoot?: string; repoRoot?: string; partial?: boolean; json?: boolean }) => {
+      await jsonAction(o.json, async (log) => {
+        try {
+          const partial = recoverLandingPartialOption(o.partial);
+          return await recoverReleaseRunFromLanding({ runId: o.run, mergeSha: o.merge,
+            ...(o.from === undefined ? {} : { from: o.from }),
+            ...(o.commandRoot === undefined ? {} : { commandRoot: o.commandRoot }),
+            ...(o.repoRoot === undefined ? {} : { repoRoot: o.repoRoot }),
+            ...(partial === undefined ? {} : { partial }) },
+          { ...resumeDeps, onSource: log });
+        } catch (caught) {
+          if (!(caught instanceof ReleaseRecoverStopped)) throw caught;
+          return { ok: false as const, error: caught.message, stages: [...caught.stages], notRun: [...caught.notRun], duplicate: false };
+        }
+      }, (r) => r.duplicate || r.stages.every((stage) => stage.outcome === 'ok'));
+    });
   release.command('gate-history')
     .description('GATE-FAIL-HISTORY (0.2.29) — 판을 넘는 게이트 실패 표 — 모든 release-loop·light-rc 런 원장 ⊕ gate-verdict 에서 시험 파일별 introduced·preexisting·env·flaky 횟수 · 마지막 실패 판 · 원인 PR(수리 PR 본문 «원인 #N»)')
     .option('--since <판|일>', '이 판(x.y.z)부터 · 또는 그 날(YYYY-MM-DD) 이후 시작된 런부터')

package/src/cli/research-cli.ts

@@ -1,12 +1,11 @@
 import type { Command } from 'commander';
 import { debug } from '../debug/log.js';
 import { isLiveDetailOn } from '../live/detail-switch.js';
-import { dispatchOmniSearch } from '../skills/tools/omni-search.js';
-import { getAvailableWebSearchProviders } from '../web-search/index.js';
+import { dispatchResearchOmniSearch, getAvailableResearchSearchEngineIds } from '../skills/tools/omni-search.js';
 
 export interface ResearchCliDeps {
   readonly out?: { log: (line: string) => void; error: (line: string) => void };
-  readonly search?: typeof dispatchOmniSearch;
+  readonly search?: typeof dispatchResearchOmniSearch;
   readonly availableEngines?: () => string[];
   readonly maxDetailOn?: (runId?: string) => boolean;
   readonly log?: typeof debug.log;
@@ -23,7 +22,7 @@ export function registerResearchCommand(program: Command, deps: ResearchCliDeps
       const query = parts.join(' ').trim();
       const limit = Number(opts.limit);
       const engines = opts.engines?.split(',').map(id => id.trim()).filter(Boolean);
-      const available = (deps.availableEngines ?? (() => getAvailableWebSearchProviders().map(p => p.id)))();
+      const available = (deps.availableEngines ?? getAvailableResearchSearchEngineIds)();
       const unknown = engines?.filter(id => !available.some(p => p.toLowerCase() === id.toLowerCase())) ?? [];
       if (!query || !Number.isInteger(limit) || limit < 1 || limit > 20 || (opts.engines !== undefined && !engines?.length) || unknown.length) {
         out.error(unknown.length ? `research: 사용할 수 없는 엔진: ${unknown.join(', ')} (사용 가능: ${available.join(', ') || '없음'})`
@@ -41,7 +40,7 @@ export function registerResearchCommand(program: Command, deps: ResearchCliDeps
       if (!wanted.length) log('research.query', 'query', { query, engines: [], limit });
       for (const engine of wanted) log('research.query', 'query', { query, engine, limit });
       try {
-        const result = await (deps.search ?? dispatchOmniSearch)({ query, ...(engines?.length ? { engines } : {}), limit }, {
+        const result = await (deps.search ?? dispatchResearchOmniSearch)({ query, ...(engines?.length ? { engines } : {}), limit }, {
           onEngine: event => {
             if (event.phase === 'complete') log('research.result', 'result', { query, engine: event.engine, hits: event.hits, durationMs: event.durationMs, ...(event.error ? { error: event.error } : {}) });
           },

package/src/cli/sim-cli.ts

@@ -1,4 +1,6 @@
 import type { Command } from 'commander';
+import { getTestStateRoot } from '../nexus/paths.js';
+import { runReleaseSimRigIfFile } from '../ux-sim/release-sim-rig.js';
 import { runScenarioFile } from '../ux-sim/scenario.js';
 
 export function registerSimCommands(program: Command): void {
@@ -7,7 +9,11 @@ export function registerSimCommands(program: Command): void {
     .description('등록된 UX simulation 시나리오를 test 우주에서 실행한다')
     .action(async (scenarioFile: string) => {
       try {
-        const result = await runScenarioFile(scenarioFile);
+        // Enforce isolation before either runner inspects the supplied path. Otherwise
+        // release-graph dispatch can leak a path-validation error outside test mode.
+        if (!getTestStateRoot()) throw new Error('scenario runner requires --test isolated mode');
+        const releaseResult = await runReleaseSimRigIfFile(scenarioFile);
+        const result = releaseResult ?? await runScenarioFile(scenarioFile);
         console.log(JSON.stringify(result));
         if (!result.pass) process.exitCode = 1;
       } catch (error) {

package/src/cli/tasks-cli.ts

@@ -66,6 +66,10 @@ export interface TasksCliDeps {
   taskStatePath?: string;
   /** 조합 선택 시험에서만 그래프 저장소 루트를 바꾼다. */
   taskCompositionRoot?: string;
+  /** COORD-ENTRANCE-FOLD test seam; production uses the invoking repository root. */
+  coordinatorShadowRoot?: string;
+  /** Deterministic task-hand time in isolated tests. */
+  taskNow?: () => Date;
   /** DRAFT-CLAIM-AUTO-2-FU — `tasks hand --draft-claim <pr>` 의 관측·게시·수확 리뷰 포트(시험 주입). 기본 = `defaultDraftClaimGhPorts()`(gh CLI ⊕ 생산 리뷰 러너). */
   draftClaimGh?: DraftClaimGhPorts;
   /** logs.db 싱크 등록(시험 주입). 기본 = `registerStandaloneLogSink`. `hand`·`show` 가 부른다. */
@@ -473,14 +477,15 @@ async function tryRemoteParent(args: string[], cwd: string | undefined, context:
   return null;
 }
 
-/** stderr 파일의 첫 비어 있지 않은 줄(최대 4KB 만 읽는다 — 원 로그 꼬리를 싣지 않는다). */
-function firstStderrLine(path: string): string {
+/** Advisory lines may precede the actual fatal error. Keep the full stderr as evidence. */
+function actionableStderrLine(path: string): string {
   try {
     const fd = openSync(path, 'r');
     try {
       const buf = Buffer.alloc(4096);
       const n = readSync(fd, buf, 0, buf.length, 0);
-      return buf.subarray(0, n).toString('utf8').split(/\r?\n/).map((line) => line.trim()).find((line) => line.length > 0) ?? '';
+      const lines = buf.subarray(0, n).toString('utf8').split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+      return lines.find((line) => /^(?:❌|error:|fatal:)/i.test(line)) ?? lines[0] ?? '';
     } finally { closeSync(fd); }
   } catch { return ''; }
 }
@@ -529,7 +534,7 @@ export async function defaultTaskLauncher(args: string[], cwd?: string, context?
     : undefined;
   if (timer) clearTimeout(timer);
   if (early && early.code !== 0) {
-    const first = firstStderrLine(stderrPath);
+    const first = actionableStderrLine(stderrPath);
     const cause = `child rc=${early.code ?? early.signal ?? 'unknown'}${first ? `: ${first}` : ''}`;
     const { boundRunStopCause, recordRunStop, runStopRecorded, RUN_STOP_EVENT } = await import('../self-implement/run-stop.js');
     const hasStop = deps.hasStop ?? ((id: string) => {
@@ -2335,6 +2340,9 @@ export function registerTasksCommands(program: Command, deps: TasksCliDeps = {})
         }
         const handOpts = {
           text: resolved.text,
+          ...(resolved.kind === 'work-order' ? { workOrder: resolved.order } : {}),
+          ...(deps.coordinatorShadowRoot ? { coordinatorShadowRoot: deps.coordinatorShadowRoot } : {}),
+          ...(deps.taskNow ? { now: deps.taskNow } : {}),
           ...(opts.project !== undefined && opts.target !== undefined ? { project: { id: opts.project, target: opts.target } } : {}),
           ...(opts.goal !== undefined ? { goal: opts.goal } : {}),
           ...(opts.milestone !== undefined ? { milestone: opts.milestone } : {}),

package/src/codex/models.ts

@@ -1,8 +1,7 @@
 // ── OpenAI Codex model catalog ──
 //
-// Curated subset of the full OpenAI Codex CLI model roster — the six
-// options that cover the most common use cases without overwhelming
-// the onboarding picker. Source: omni-crawl sweep on 2026-04-14 across
+// Curated subset of the full OpenAI Codex CLI model roster, covering
+// common use cases without overwhelming the onboarding picker. Source: omni-crawl sweep on 2026-04-14 across
 //   - developers.openai.com/api/docs/models/{all,codex-mini-latest,gpt-5-codex}
 //   - developers.openai.com/codex/models
 //   - platform.openai.com/docs/models
@@ -20,10 +19,9 @@
 // 2026-09-09 refresh (live 1차 대조 — developers.openai.com/api/내부 문서 `gpt-6-astra`
 // ⊕ openai.com/api/pricing/ ⊕ `codex exec --model gpt-6-astra` 실호출):
 //   + gpt-6-astra  (2026-09-03 출시 · 현 최상단)
-//   + gpt-5.6-terra (elanous 가 «실제로» 기본으로 쓰는 모델 — llm.model 이 이 값이다)
-// ⛔ recommended 를 gpt-5.5 → gpt-5.6-terra 로 옮겼다. 이 표의 recommended 는 「가장 센 것」이
-//   아니라 「기본으로 골라도 되는 것」이고, 그 자리에 두 세대 전 모델이 앉아 있었다.
-//   astra 는 recommended 가 «아니다» — terra 대비 input 4배·output 3.3배라 기본값이 될 수 없다.
+//   + gpt-5.6-terra (at the time, the configured `llm.model` default)
+// GPT-6.1 refresh (2026-10-28): recommended is GPT-6.1 Terra; Sol is available for higher-cost deep work.
+// `recommended` means a safe default, not the strongest model; Astra remains opt-in due to its higher cost.
 
 export type CodexModelTier = 'flagship' | 'balanced' | 'cheap' | 'specialist' | 'legacy';
 
@@ -44,11 +42,21 @@ export interface CodexModel {
   recommended?: boolean;
 }
 
-/** Six curated models for the 1-point setup picker. Ordering
- *  reflects the UI: recommended first, then by descending tier. */
+/** Curated models for the 1-point setup picker. Ordering reflects the UI:
+ *  recommended first, then by descending tier. */
 export const CODEX_MODELS: CodexModel[] = [
   {
-    // 📏 2026-09-25 캐시 읽기 단가 = 입력의 10%(OpenRouter 목록 gpt-6-astra 1.0 · sol 0.2 · luna 0.01) — 없으면 캐시분이 입력 단가로 10배 매겨졌다.
+    id: 'gpt-6.1-terra',
+    label: 'GPT-6.1 Terra',
+    tier: 'balanced',
+    description: 'Recommended everyday Codex model. 500K context; $1/$5 per million tokens, cached input $0.05.',
+    contextWindow: 500_000,
+    pricingUsd: { inputPerM: 1.0, outputPerM: 5.0, cacheReadPerM: 0.05 },
+    recommended: true,
+  },
+  {
+    // Cache-read rates: Astra $1.00/M, GPT-6.1 Sol $0.10/M, Terra $0.05/M, Luna $0.01/M.
+    // Per OP 2026-10-28 price direction, legacy GPT-6 Sol also uses $0.10/M for cost estimates.
     id: 'gpt-6-astra',
     label: 'GPT-6 Astra (frontier)',
     tier: 'flagship',
@@ -56,14 +64,21 @@ export const CODEX_MODELS: CodexModel[] = [
     contextWindow: 1_050_000,
     pricingUsd: { inputPerM: 10.0, outputPerM: 50.0, cacheReadPerM: 1.0 },
   },
+  {
+    id: 'gpt-6.1-sol',
+    label: 'GPT-6.1 Sol',
+    tier: 'flagship',
+    description: 'Higher-capability reasoning and coding model. 500K context; $2/$10 per million tokens, cached input $0.10.',
+    contextWindow: 500_000,
+    pricingUsd: { inputPerM: 2.0, outputPerM: 10.0, cacheReadPerM: 0.1 },
+  },
   {
     id: 'gpt-6-sol',
-    label: 'GPT-6 Sol',   // «recommended» 표시는 목록이 `recommended: true` 로 붙인다 — 라벨에도 쓰면 두 번 뜬다(UX 8)
-    tier: 'balanced',
-    description: 'elanous 운영 기본(대표 2026-09-23). 복합 코딩·agentic 워크플로. Reasoning «Highest» 인데 가격은 5.6 Terra 와 같은 입력·더 싼 출력. 1.05M ctx, effort none..max(기본 medium).',
+    label: 'GPT-6 Sol',
+    tier: 'legacy',
+    description: 'Legacy GPT-6 Sol retained for compatibility; GPT-6.1 Sol is its higher-performing successor at the same price, while Terra is a lower-cost default.',
     contextWindow: 1_050_000,
-    pricingUsd: { inputPerM: 2.0, outputPerM: 10.0, cacheReadPerM: 0.2 },
-    recommended: true,
+    pricingUsd: { inputPerM: 2.0, outputPerM: 10.0, cacheReadPerM: 0.1 },
   },
   {
     id: 'gpt-6-luna',

package/src/compact/auto.ts

@@ -31,8 +31,15 @@ export function shouldAutoCompact(
   messages: MessageLike[],
   modelId: string | undefined,
   config: ChatAutoCompactConfig,
+  observedInputTokens?: number,
 ): AutoCompactDecision {
-  const usedTokens = estimateMessagesTokens(messages);
+  const hasObservedInputTokens = typeof observedInputTokens === 'number'
+    && Number.isFinite(observedInputTokens)
+    && observedInputTokens >= 0;
+  const estimatedTokens = estimateMessagesTokens(messages);
+  // Provider usage captures model/tokenizer overhead; current history also
+  // includes tool output appended since that provider response.
+  const usedTokens = hasObservedInputTokens ? Math.max(observedInputTokens, estimatedTokens) : estimatedTokens;
   const windowTokens = resolveModelContextWindow(modelId) ?? inferContextWindow(modelId);
   const configuredBudget = config.workingBudgetTokens;
   const budgetTokens = typeof configuredBudget === 'number'

package/src/control-plane/ledger.ts

@@ -20,7 +20,7 @@ export interface ResourceRecord {
 export type ResourceView = ResourceRecord & { ageMs: number; expired: boolean };
 
 export interface PodWorkerKey { context: string; imageDigest: string; lockHash: string; architecture: string }
-type PodWorkerState = 'idle' | 'leased' | 'sanitizing' | 'quarantined';
+type PodWorkerState = 'idle' | 'leased' | 'sanitizing' | 'timeout-fenced' | 'quarantined';
 interface PodWorkerLeaseAttrs {
   key: PodWorkerKey;
   podUid: string;
@@ -32,6 +32,9 @@ interface PodWorkerLeaseAttrs {
   /** The just-sanitized generation remains fenceable until the next acquisition. */
   lastLeaseId?: string;
   lastLeaseOwner?: string;
+  timeoutFenceUntil?: number;
+  timeoutRunId?: string;
+  timeoutAttemptId?: string;
   runId?: string;
   attemptId?: string;
   reason?: string;
@@ -231,17 +234,35 @@ export class ResourceLedger {
     return this.mutate(() => {
     const at = now ?? Date.now();
     const rows = this.read();
+    let expiredFenceChanged = false;
+    for (let rowIndex = 0; rowIndex < rows.length; rowIndex++) {
+      const candidate = rows[rowIndex]!;
+      if (candidate.kind !== 'pod-worker-lease') continue;
+      const candidateAttrs = workerAttrs(candidate);
+      if (candidateAttrs.state !== 'timeout-fenced' || candidateAttrs.timeoutFenceUntil === undefined
+        || candidateAttrs.timeoutFenceUntil > at || candidateAttrs.leaseId) continue;
+      const idleAttrs: PodWorkerLeaseAttrs = { ...candidateAttrs, state: 'idle' };
+      delete idleAttrs.leaseId; delete idleAttrs.leaseOwner; delete idleAttrs.runId; delete idleAttrs.attemptId;
+      delete idleAttrs.timeoutFenceUntil; delete idleAttrs.timeoutRunId; delete idleAttrs.timeoutAttemptId;
+      rows[rowIndex] = { ...candidate, attrs: idleAttrs as unknown as Record<string, unknown>, observedAt: at,
+        ttlMs: candidateAttrs.idleTtlMs };
+      expiredFenceChanged = true;
+    }
     const index = rows.findIndex(row => row.kind === 'pod-worker-lease' && (!request.machine || row.machine === request.machine)
       && Math.max(0, at - row.observedAt) < row.ttlMs && workerAttrs(row).state === 'idle'
       && typeof workerAttrs(row).podUid === 'string' && workerAttrs(row).podUid.trim().length > 0
       && sameWorkerKey(workerAttrs(row).key, request.key));
-    if (index < 0) throw new ResourceLedgerError(409, 'no-warm-worker');
+    if (index < 0) {
+      if (expiredFenceChanged) this.write(rows);
+      throw new ResourceLedgerError(409, 'no-warm-worker');
+    }
     const row = rows[index]!;
     const attrs = workerAttrs(row);
     const nextAttrs: PodWorkerLeaseAttrs = { ...attrs, state: 'leased', generation: attrs.generation + 1,
       leaseId: randomUUID(), leaseOwner: request.owner, runId: request.runId, attemptId: request.attemptId };
     delete nextAttrs.lastLeaseId;
     delete nextAttrs.lastLeaseOwner;
+    delete nextAttrs.timeoutFenceUntil; delete nextAttrs.timeoutRunId; delete nextAttrs.timeoutAttemptId;
     const next: ResourceRecord = { ...row, attrs: nextAttrs as unknown as Record<string, unknown>,
       observedAt: at, ttlMs: request.ttlMs };
     rows[index] = next;
@@ -250,6 +271,31 @@ export class ResourceLedger {
     });
   }
 
+  fenceTimedOutPodWorker(id: string, request: { owner: string; runId: string; attemptId: string; fenceMs: number }, now?: number): ResourceRecord {
+    return this.mutate(() => {
+      const at = now ?? Date.now();
+      const rows = this.read();
+      const index = rows.findIndex(row => row.id === id && row.kind === 'pod-worker-lease');
+      if (index < 0) throw new ResourceLedgerError(404, 'not-found');
+      const row = rows[index]!;
+      const attrs = workerAttrs(row);
+      const sameFence = attrs.state === 'timeout-fenced' && attrs.timeoutRunId === request.runId
+        && attrs.timeoutAttemptId === request.attemptId;
+      const sameLease = attrs.state === 'leased' && attrs.leaseOwner === request.owner
+        && attrs.runId === request.runId && attrs.attemptId === request.attemptId;
+      const available = attrs.state === 'idle';
+      if (!request.owner || !request.runId || !request.attemptId || !Number.isSafeInteger(request.fenceMs)
+        || request.fenceMs < 1 || !(sameFence || sameLease || available))
+        throw new ResourceLedgerError(409, 'stale-timeout-fence');
+      const nextAttrs: PodWorkerLeaseAttrs = { ...attrs, state: 'timeout-fenced',
+        timeoutFenceUntil: at + request.fenceMs, timeoutRunId: request.runId, timeoutAttemptId: request.attemptId };
+      const next: ResourceRecord = { ...row, attrs: nextAttrs as unknown as Record<string, unknown>, observedAt: at };
+      rows[index] = next;
+      this.write(rows);
+      return next;
+    });
+  }
+
   transitionPodWorker(id: string, request: { owner: string; leaseId: string; generation: number; action: 'renew' | 'release' | 'sanitize' | 'quarantine'; ttlMs?: number; reason?: string }, now?: number): ResourceRecord {
     return this.mutate(() => {
     now ??= Date.now();
@@ -260,11 +306,14 @@ export class ResourceLedger {
     const attrs = workerAttrs(row);
     const lateIdleQuarantine = request.action === 'quarantine' && attrs.state === 'idle'
       && attrs.lastLeaseId === request.leaseId && attrs.generation === request.generation;
+    const timeoutFencedQuarantine = request.action === 'quarantine' && attrs.state === 'timeout-fenced'
+      && attrs.leaseId === request.leaseId && attrs.generation === request.generation;
     if (!request.leaseId || (attrs.leaseId !== request.leaseId && !lateIdleQuarantine)
       || attrs.generation !== request.generation) throw new ResourceLedgerError(409, 'stale-worker-lease');
     const permitted = request.action === 'sanitize' ? row.owner === request.owner
       : request.action === 'quarantine' ? row.owner === request.owner || attrs.leaseOwner === request.owner
         || (lateIdleQuarantine && attrs.lastLeaseOwner === request.owner)
+        || (timeoutFencedQuarantine && attrs.leaseOwner === request.owner)
       : attrs.leaseOwner === request.owner;
     if (!permitted) {
       throw new ResourceLedgerError(403, 'not-owner');
@@ -283,6 +332,7 @@ export class ResourceLedger {
     } else if (state === 'quarantined') {
       delete nextAttrs.lastLeaseId;
       delete nextAttrs.lastLeaseOwner;
+      delete nextAttrs.timeoutFenceUntil; delete nextAttrs.timeoutRunId; delete nextAttrs.timeoutAttemptId;
     }
     const ttlMs = state === 'idle' ? attrs.idleTtlMs : request.ttlMs ?? row.ttlMs;
     const next: ResourceRecord = { ...row, attrs: nextAttrs as unknown as Record<string, unknown>, observedAt: now, ttlMs };

package/src/control-plane/server.ts

@@ -10,6 +10,7 @@ import type { LeaseHolderView } from './lease-holder.js';
 export const DEFAULT_CONTROL_PORT = PORT_BANDS.reserved[0];
 export const CONTROL_HOSTNAME = '127.0.0.1';
 const MAX_POD_WORKER_TTL_MS = 24 * 60 * 60 * 1000;
+const POD_WORKER_TIMEOUT_FENCE_MS = 150_000;
 
 export function allowedControlHostname(hostname: string): boolean {
   if (hostname === '127.0.0.1' || hostname === '::1') return true;
@@ -126,7 +127,7 @@ export function startControlServer(opts: ControlServerOptions = {}): {
         const leaseRenewal = /^\/v1\/leases\/port\/([^/]+)\/heartbeat$/.exec(path);
         const workerRegister = path === '/v1/workers/pod' && method === 'POST';
         const workerAcquire = path === '/v1/leases/pod-worker' && method === 'POST';
-        const workerTransition = /^\/v1\/leases\/pod-worker\/([^/]+)\/(renew|release|sanitize|quarantine)$/.exec(path);
+        const workerTransition = /^\/v1\/leases\/pod-worker\/([^/]+)\/(renew|release|sanitize|quarantine|timeout)$/.exec(path);
         if (!resourcePath && !registerPath && !leaseRequest && !workerRegister && !workerAcquire && !(workerTransition && method === 'POST') && !(leaseDeletion && method === 'DELETE') && !(leaseRenewal && method === 'POST') && !(heartbeat && method === 'POST') && !(deletion && method === 'DELETE')) {
           return json({ error: 'not-found' }, 404);
         }
@@ -191,7 +192,20 @@ export function startControlServer(opts: ControlServerOptions = {}): {
           if (workerTransition) {
             const workerId = decodeURIComponent(workerTransition[1]!);
             if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,95}$/.test(workerId)) throw new ResourceLedgerError(400, 'invalid-worker-id');
-            const action = workerTransition[2] as 'renew' | 'release' | 'sanitize' | 'quarantine';
+            const action = workerTransition[2] as 'renew' | 'release' | 'sanitize' | 'quarantine' | 'timeout';
+            if (action === 'timeout') {
+              if (scope !== 'member') throw new ResourceLedgerError(403, 'worker-timeout-scope');
+              const body = podWorkerBody(await req.json());
+              const { runId, attemptId } = body;
+              if (typeof runId !== 'string' || !runId.trim() || typeof attemptId !== 'string' || !attemptId.trim())
+                throw new ResourceLedgerError(400, 'invalid-pod-worker-timeout');
+              const id = `pod-worker-lease:${workerId}`;
+              requireTarget(id);
+              const stale = await currentWorkerPrimary();
+              if (stale) return stale;
+              return json(await ledger.withGuardedWorkerMutation(async () => !(await currentWorkerPrimary()),
+                () => ledger.fenceTimedOutPodWorker(id, { owner, runId, attemptId, fenceMs: POD_WORKER_TIMEOUT_FENCE_MS })));
+            }
             if (action === 'sanitize' ? !machine : (action === 'renew' || action === 'release') && scope !== 'member') {
               throw new ResourceLedgerError(403, 'worker-scope');
             }