elanous 0.2.5 → 0.2.7

package/src/release-loop/checklist.ts

@@ -4,14 +4,17 @@ import { dirname, join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { debug } from '../debug/log.js';
 import { releaseLedgerRoot } from '../instance/resolve.js';
+import { CliUserError } from '../cli/cli-user-error.js';
 
 export type ChecklistStatus = 'green' | 'yellow' | 'red' | 'done';
+export type ChecklistDisposition = 'move' | 'known-issue' | 'block';
 export interface ChecklistItem {
   id: string;
   title: string;
   status: ChecklistStatus;
   owner?: string;
   evidence?: string;
+  disposition?: ChecklistDisposition;
   updatedAt: string;
   updatedBy: string;
 }
@@ -52,7 +55,7 @@ function releasedVersion(): string {
 }
 
 function pathFor(v: string): string {
-  if (!/^\d+\.\d+\.\d+(?:-(?:rc|alpha|beta)\.\d+)?$/.test(v)) throw new Error(`체크리스트 판이 아니다: ${v}`);
+  if (!/^\d+\.\d+\.\d+(?:-(?:rc|alpha|beta)\.\d+)?$/.test(v)) throw new CliUserError(`체크리스트 판이 아니다: ${v}`);
   return join(releaseLedgerRoot(), 'release', v, 'checklist.json');
 }
 
@@ -108,10 +111,10 @@ function change(data: Checklist, id: string, field: string, from: unknown, to: u
 function refresh(data: Checklist): void { data.released = releasedVersion(); data.dev = devVersion(); }
 
 export function addItem(v: string, input: { id: string; title: string; owner?: string }): Checklist {
-  if (!input.id.trim()) throw new Error('칸 id 가 비었다');
-  if (!input.title.trim()) throw new Error('칸 제목이 비었다');
+  if (!input.id.trim()) throw new CliUserError('칸 id 가 비었다');
+  if (!input.title.trim()) throw new CliUserError('칸 제목이 비었다');
   return mutate(v, (data) => {
-    if (data.items.some((item) => item.id === input.id)) throw new Error(`이미 있는 칸: ${input.id}`);
+    if (data.items.some((item) => item.id === input.id)) throw new CliUserError(`이미 있는 칸: ${input.id}`, 'set <id> 로 고친다');
     const by = process.env.ELANOUS_TRACK || 'cli';
     const at = new Date().toISOString();
     const item: ChecklistItem = { id: input.id, title: input.title, status: 'yellow', ...(input.owner !== undefined ? { owner: input.owner } : {}), updatedAt: at, updatedBy: by };
@@ -121,12 +124,13 @@ export function addItem(v: string, input: { id: string; title: string; owner?: s
   });
 }
 
-export function setItem(v: string, id: string, patch: { status?: ChecklistStatus; evidence?: string; owner?: string }, by: string): Checklist {
+export function setItem(v: string, id: string, patch: { status?: ChecklistStatus; evidence?: string; owner?: string; disposition?: ChecklistDisposition }, by: string): Checklist {
   return mutate(v, (data) => {
     const item = data.items.find((i) => i.id === id);
-    if (!item) throw new Error(`없는 칸: ${id}`);
-    if (patch.status !== undefined && !['green', 'yellow', 'red', 'done'].includes(patch.status)) throw new Error(`잘못된 상태: ${patch.status}`);
-    const fields = (['evidence', 'owner', 'status'] as const).filter((field) => patch[field] !== undefined && patch[field] !== item[field]);
+    if (!item) throw new CliUserError(`없는 칸: ${id}`, 'list 로 칸 목록을 본다');
+    if (patch.status !== undefined && !['green', 'yellow', 'red', 'done'].includes(patch.status)) throw new CliUserError(`잘못된 상태: ${patch.status}`);
+    if (patch.disposition !== undefined && !['move', 'known-issue', 'block'].includes(patch.disposition)) throw new CliUserError(`잘못된 처분: ${patch.disposition}`);
+    const fields = (['evidence', 'owner', 'status', 'disposition'] as const).filter((field) => patch[field] !== undefined && patch[field] !== item[field]);
     if (fields.length === 0) return false;
     const at = new Date().toISOString();
     for (const field of fields) {
@@ -144,7 +148,7 @@ export function setItem(v: string, id: string, patch: { status?: ChecklistStatus
 export function removeItem(v: string, id: string, by: string): Checklist {
   return mutate(v, (data) => {
     const index = data.items.findIndex((i) => i.id === id);
-    if (index < 0) throw new Error(`없는 칸: ${id}`);
+    if (index < 0) throw new CliUserError(`없는 칸: ${id}`, 'list 로 칸 목록을 본다');
     const at = new Date().toISOString();
     const [item] = data.items.splice(index, 1);
     change(data, id, 'remove', item, null, by, at);
@@ -169,6 +173,29 @@ export function summarizeChecklist(data: Checklist): ChecklistSummary {
   return summary;
 }
 
+export interface ChecklistGate {
+  ok: boolean;
+  red: string[];
+  undecided: string[];
+  blocked: string[];
+  moved: string[];
+  knownIssues: Array<{ id: string; title: string; evidence: string }>;
+}
+
+export function checklistGate(v: string): ChecklistGate {
+  const result: ChecklistGate = { ok: true, red: [], undecided: [], blocked: [], moved: [], knownIssues: [] };
+  for (const item of listChecklist(v).items) {
+    if (item.status === 'red') result.red.push(item.id);
+    if (item.status !== 'yellow') continue;
+    if (item.disposition === 'block') result.blocked.push(item.id);
+    else if (item.disposition === 'move') result.moved.push(item.id);
+    else if (item.disposition === 'known-issue') result.knownIssues.push({ id: item.id, title: item.title, evidence: item.evidence ?? '' });
+    else result.undecided.push(item.id);
+  }
+  result.ok = result.red.length === 0 && result.undecided.length === 0 && result.blocked.length === 0;
+  return result;
+}
+
 export function seedFromRoadmap(v: string, markdown: string): Checklist {
   return mutate(v, (data) => {
     let added = false;

package/src/seat-address/seat-address.ts

@@ -0,0 +1,34 @@
+import trackData from '../../scripts/coord-tracks.json';
+
+export type SeatEntry = {
+  id: string;
+  title?: string;
+  alias?: string;
+};
+
+export type SeatAddress = { seats: string[]; body: string };
+
+const registry: readonly SeatEntry[] = trackData.tracks.filter((entry) => 'title' in entry);
+const addressLine = /^@([A-Za-z][A-Za-z0-9_-]*(?:,[A-Za-z][A-Za-z0-9_-]*)*)(?:[ \t]+|\r?\n|(?![\s\S]))/gm;
+
+/** Parse an address only when its @ begins a line; leave the instruction text intact. */
+export function parseSeatAddress(text: string): SeatAddress | null {
+  const match = addressLine.exec(text);
+  addressLine.lastIndex = 0;
+  if (!match) return null;
+
+  const seats = match[1]!.split(',');
+  const body = `${text.slice(0, match.index)}${text.slice(match.index + match[0].length)}`;
+  return { seats, body };
+}
+
+/** Resolve against the seat registry, preferring titles to ids to legacy aliases. */
+export function resolveSeat(address: string, seats: readonly SeatEntry[] = registry): SeatEntry | undefined {
+  const needle = address.replace(/^@/, '').toLocaleLowerCase();
+  if (!needle) return undefined;
+  for (const field of ['title', 'id', 'alias'] as const) {
+    const found = seats.find((seat) => seat[field]?.toLocaleLowerCase() === needle);
+    if (found) return found;
+  }
+  return undefined;
+}

package/src/self-dev/decompose.ts

@@ -341,6 +341,7 @@ export function buildSelfDevDecomposePrompt(feature: string, maxTasks = DEFAULT_
     '## Rules',
     `- Emit at most ${maxTasks} sub-features. Fewer is better — do NOT over-split, except when a sub-feature mixes ${SELF_DEV_CONCERN_SPLIT_THRESHOLD} or more concern classes — ${SELF_DEV_CONCERN_CLASSES.join(' / ')} — split it into sibling sub-features.`,
     '- SEPARATE DEFINE FROM WIRE: adding a new function/type/export is a SEPARATE task from wiring it into an existing runtime call site. A task that both defines a new symbol AND integrates it across modules tends to leave dead-code (defined but never called) that fails integration gates. Pattern: (a) add the function + its unit test; then (b) a dependent task that wires it into the specific existing call site — name the exact `file.ts:function` to modify.',
+    '- Exception to SEPARATE DEFINE FROM WIRE: Keep a definition and its registration/wiring in the same sub-feature — a handler with its route, a command with its CLI registration, a node with its graph/recipe entry.',
     '- Each sub-feature must be a self-contained, mergeable unit of work.',
     '- `dependsOn`: list the `id`s of sub-features that MUST land first (e.g. a shared',
     '  type/interface before its consumers). Independent sub-features share NO dependency',

package/src/self-dev/dev-pipeline.ts

@@ -1871,7 +1871,10 @@ async function runDevPipelineDispatch(
   observeDevSelection('completion', plan.completion, plan.completionSource, plan.completionSource === 'request' ? spec.completion : undefined, entryRoute, spec.runId, plan.entrance, plan.entranceUnstamped);
   observeDevSelection('autoReview', plan.autoReview, plan.autoReviewSource, plan.autoReviewSource === 'request' ? spec.autoReview : undefined, entryRoute, spec.runId, plan.entrance, plan.entranceUnstamped);
   assertDispatchHonorsOptions(plan); // 미이행 옵션 거부(수락 후 무시 금지)
-  emitHumanProgress(completionAnnouncement(plan.completion), spec.humanReadableOutput !== false, deps.progress);
+  // CHAT1 — a plain chat turn (`interactive`) is not a dev run: its completion/base lines are noise to a person.
+  //   The selection is still observed above; only the human-facing lines are dev-run-only.
+  const devRunLines = plan.dispatch !== 'interactive';
+  if (devRunLines) emitHumanProgress(completionAnnouncement(plan.completion), spec.humanReadableOutput !== false, deps.progress);
   if (spec.notice) emitHumanProgress(spec.notice, spec.humanReadableOutput !== false, deps.progress);
 
   if (plan.dispatch === 'parallel') {
@@ -1899,8 +1902,8 @@ async function runDevPipelineDispatch(
     rule: plan.baseSelection?.rule ?? 'unspecified',
     evidence: plan.baseSelection?.evidence ?? 'not applicable',
   });
-  emitHumanProgress(formatDevBaseSelectionAnnouncement(plan), spec.humanReadableOutput !== false, deps.progress);
-  const nonDefaultBaseWarning = formatDevNonDefaultBaseWarning(plan);
+  if (devRunLines) emitHumanProgress(formatDevBaseSelectionAnnouncement(plan), spec.humanReadableOutput !== false, deps.progress);
+  const nonDefaultBaseWarning = devRunLines ? formatDevNonDefaultBaseWarning(plan) : undefined;
   if (nonDefaultBaseWarning) {
     emitHumanProgress(nonDefaultBaseWarning, spec.humanReadableOutput !== false, deps.progress);
   }

package/src/self-dev/run-record-mirror.ts

@@ -0,0 +1,44 @@
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { debug } from '../debug/log.js';
+import { releaseLedgerRoot } from '../instance/resolve.js';
+import type { SelfDevRunState } from './run-store.js';
+
+export function mirrorDir(): string {
+  return join(releaseLedgerRoot(), 'self-dev-runs');
+}
+
+function mirrorPath(runId: string, dir: string): string {
+  if (!/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(runId)) throw new Error(`invalid self-dev run ID: ${runId}`);
+  return join(dir, `${runId}.json`);
+}
+
+/** Best-effort atomic copy in the machine ledger; never disrupts the primary checkpoint. */
+export function mirrorRunRecord(state: SelfDevRunState, primaryDir: string): void {
+  let temp: string | undefined;
+  try {
+    const dir = mirrorDir();
+    if (resolve(primaryDir) === resolve(dir)) return;
+    const path = mirrorPath(state.runId, dir);
+    mkdirSync(dir, { recursive: true });
+    temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    writeFileSync(temp, JSON.stringify(state, null, 2), { mode: 0o600 });
+    renameSync(temp, path);
+  } catch (error) {
+    if (temp) { try { unlinkSync(temp); } catch { /* no temporary file to remove */ } }
+    try { debug.log('self-dev.run-store', 'mirror-failed', { runId: state.runId, reason: String(error) }); } catch { /* keep the primary save fail-soft */ }
+  }
+}
+
+export function loadMirroredRunRecord(runId: string): SelfDevRunState | null {
+  try {
+    const record = JSON.parse(readFileSync(mirrorPath(runId, mirrorDir()), 'utf8')) as SelfDevRunState | null;
+    return record && record.runId === runId
+      && typeof record.createdAt === 'number' && Number.isFinite(record.createdAt)
+      && typeof record.updatedAt === 'number' && Number.isFinite(record.updatedAt)
+      && Array.isArray(record.results) ? record : null;
+  } catch {
+    return null;
+  }
+}

package/src/self-dev/run-store.ts

@@ -27,6 +27,7 @@ import type { RunIdSource } from '../harness/harness-space.js';
 import { withFileLockSync } from '../storage/file-lock.js';
 import type { SelfDevJobResult, SelfDevGoal } from './orchestrate.js';
 import type { SupervisorStopReason } from './run-supervisor.js';
+import { loadMirroredRunRecord, mirrorRunRecord } from './run-record-mirror.js';
 
 export interface SelfDevRunParticipant {
   id: string;
@@ -151,18 +152,26 @@ export function saveSelfDevRun(state: SelfDevRunState, dir = selfDevRunsDir()):
     withFileLockSync(join(dir, `${state.runId}.lock`), () => {
       const current = loadSelfDevRunFromPath(runPath(state.runId, dir));
       const participants = mergeParticipants(current?.participants, state.participants);
-      writeSelfDevRun({
+      const saved = {
         ...state,
         ...(participants === undefined ? {} : { participants }),
         ...(current?.parkedResolution && !state.parkedResolution ? { parkedResolution: current.parkedResolution } : {}),
-      }, dir);
+      };
+      writeSelfDevRun(saved, dir);
+      mirrorRunRecord(saved, dir);
     });
   } catch { /* fail-soft — a lost checkpoint just means no resume, not a crash */ }
 }
 
 /** Load a run checkpoint by id, or null if absent/corrupt. */
 export function loadSelfDevRun(runId: string, dir = selfDevRunsDir()): SelfDevRunState | null {
-  return loadSelfDevRunFromPath(runPath(runId, dir));
+  const primary = loadSelfDevRunFromPath(runPath(runId, dir));
+  if (primary) return primary;
+  const mirrored = loadMirroredRunRecord(runId);
+  if (mirrored) {
+    try { debug.log('self-dev.run-store', 'read-from-mirror', { runId }); } catch { /* preserve fail-soft reads */ }
+  }
+  return mirrored;
 }
 
 /** Add one participant without losing registrations made by another caller for this run. */

package/src/self-implement/harness-policy-gates.ts

@@ -4,8 +4,9 @@ import { runIsolationHardcodeGate } from '../../scripts/ci-isolation-hardcode-ga
 import { runMockModuleRestoreGate } from '../../scripts/ci-mock-module-restore-gate.js';
 import { runModelHardcodeGate } from '../../scripts/ci-model-hardcode-gate.js';
 import { runDaemonPortGate } from '../../scripts/ci-daemon-port-gate.js';
+import { runPublicExportLeakGate } from '../../scripts/ci-public-export-leak-gate.js';
 
-type GateName = 'isolation-gate' | 'mock-module-restore-gate' | 'model-hardcode-gate' | 'daemon-port-gate';
+type GateName = 'isolation-gate' | 'mock-module-restore-gate' | 'model-hardcode-gate' | 'daemon-port-gate' | 'public-export-leak';
 type GateOutput = { args: string[]; cwd: string; log: (line: string) => void; error: (line: string) => void };
 type GateRunner = (out: GateOutput) => number;
 
@@ -27,6 +28,8 @@ export function runHarnessPolicyGates(input: {
     ['mock-module-restore-gate', input.gates?.['mock-module-restore-gate'] ?? runMockModuleRestoreGate],
     ['model-hardcode-gate', input.gates?.['model-hardcode-gate'] ?? runModelHardcodeGate],
     ['daemon-port-gate', input.gates?.['daemon-port-gate'] ?? ((out) => runDaemonPortGate({ log: out.log, error: out.error, cwd: out.cwd, args: [] }))],
+    // LEAK1 — the check release prepare fails on, before the harness lands (0.2.7: a mark in a test title).
+    ['public-export-leak', input.gates?.['public-export-leak'] ?? runPublicExportLeakGate],
   ];
   const failures: Array<{ gate: GateName; lines: string[] }> = [];
   for (const [gate, run] of runners) {

package/src/self-implement/report-origin.ts

@@ -2,12 +2,23 @@ import type { MissionOrigin } from '../autopilot/mission-origin.js';
 
 export const REPORT_ORIGIN_ENV = 'ELANOUS_REPORT_ORIGIN';
 
-const CHANNELS = new Set<MissionOrigin['channel']>(['telegram', 'pwa', 'voice', 'cli', 'api', 'tui']);
+const CHANNELS = new Set<MissionOrigin['channel']>(['telegram', 'pwa', 'voice', 'cli', 'api', 'tui', 'discord']);
+const SNOWFLAKE = /^\d{1,20}$/;
 
 function isReportOrigin(value: unknown): value is MissionOrigin {
   if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;
   const origin = value as Record<string, unknown>;
   if (!CHANNELS.has(origin.channel as MissionOrigin['channel'])) return false;
+  // Discord carries its own reply target (channel ⊕ optional thread snowflakes) — same shape as MissionOrigin.
+  if (origin.channel === 'discord') {
+    for (const key of Object.keys(origin)) {
+      if (!['channel', 'channelId', 'discordThreadId', 'botId', 'hitlMessageId'].includes(key)) return false;
+    }
+    return typeof origin.channelId === 'string' && SNOWFLAKE.test(origin.channelId)
+      && (origin.discordThreadId === undefined || (typeof origin.discordThreadId === 'string' && SNOWFLAKE.test(origin.discordThreadId)))
+      && (origin.botId === undefined || (typeof origin.botId === 'string' && origin.botId.length > 0))
+      && (origin.hitlMessageId === undefined || Number.isSafeInteger(origin.hitlMessageId));
+  }
   if (origin.channel === 'telegram' && (!Number.isSafeInteger(origin.chatId) || origin.chatId === 0)) return false;
   for (const key of Object.keys(origin)) {
     if (!['channel', 'chatId', 'botId', 'threadId', 'hitlMessageId'].includes(key)) return false;

package/src/self-implement/run-ledger-compact.ts

@@ -280,7 +280,7 @@ function recordedString(entries: readonly RunLedgerEntry[], field: string): stri
   return undefined;
 }
 
-function summarizeTerminalLedger(runId: string, entries: readonly RunLedgerEntry[]): RunLedgerSummary {
+export function summarizeTerminalLedger(runId: string, entries: readonly RunLedgerEntry[]): RunLedgerSummary {
   const last = entries.at(-1)?.timestamp;
   if (!last || !Number.isFinite(Date.parse(last)) || !hasTerminalRunStatus(entries)) throw new Error('ledger changed since plan');
   const terminator = [...entries].reverse().find((entry) => entry.event === 'human-stop' || entry.event === 'terminal'

package/src/session/chat.ts

@@ -30,6 +30,7 @@ import {
 import { buildMemoryInjection, buildMemoryInjectionLLM } from '../memory.js';
 import { getUserConfig } from '../user-config.js';
 import { budgetModel } from '../llm/model-defaults.js';
+import { explicitTurnTier } from '../model-tier/turn-tier.js';
 import { recordTurn } from '../status/metrics.js';
 import {
   buildTerminalCapableTurn,
@@ -375,7 +376,18 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
     return trimToBudget(wire, opts.maxTokens ?? DEFAULT_TOKEN_BUDGET);
   };
 
-  const provider = opts.provider ?? getProviderForConfig(opts.userConfig, opts.llmOpts?.model);
+  const explicitTier = opts.llmOpts?.model ? undefined : explicitTurnTier(opts.userConfig, opts.sessionId);
+  const llmOpts = explicitTier ? {
+    ...(opts.llmOpts ?? {}), model: explicitTier.model,
+    ...(explicitTier.reasoningEffort && !opts.llmOpts?.reasoningEffort ? { reasoningEffort: explicitTier.reasoningEffort } : {}),
+  } : opts.llmOpts;
+  if (explicitTier) {
+    debug.log('llm.tier', 'turn-tier-applied', {
+      sessionId: opts.sessionId, tier: explicitTier.tier, source: explicitTier.source, model: explicitTier.model,
+      reasoningEffort: llmOpts?.reasoningEffort ?? null,
+    });
+  }
+  const provider = opts.provider ?? getProviderForConfig(opts.userConfig, llmOpts?.model);
   let kept: LLMMessage[] = [];
   let dropped = 0;
   let used = 0;
@@ -394,7 +406,7 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
       specs: opts.tools,
       dispatch: rawDispatchTool,
       systemPromptParts: effectiveSystemPrompt ? [effectiveSystemPrompt] : [],
-      ...(opts.llmOpts ? { llmOpts: opts.llmOpts } : {}),
+      ...(llmOpts ? { llmOpts } : {}),
     };
     const terminal = hasPtyShellTool
       ? isTerminalCapableTurn(terminalBase)
@@ -409,7 +421,7 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
     if (terminal) {
       effectiveSystemPrompt = terminal.systemPromptParts.join('\n\n');
     }
-    const turnLlmOpts = terminal ? terminal.llmOpts : opts.llmOpts;
+    const turnLlmOpts = terminal ? terminal.llmOpts : llmOpts;
     ({ kept, dropped, used } = assembleTurnMessages(effectiveSystemPrompt));
     // Durable tool telemetry (추적성) — pair each call's args (onToolCall) with its
     // result (onToolResult) and persist a role:'tool' message so later "어떤 도구
@@ -477,7 +489,7 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
     }
   } else {
     ({ kept, dropped, used } = assembleTurnMessages(effectiveSystemPrompt));
-    const plainOpts = opts.signal ? { ...(opts.llmOpts ?? {}), signal: opts.signal } : (opts.llmOpts ?? {});
+    const plainOpts = opts.signal ? { ...(llmOpts ?? {}), signal: opts.signal } : (llmOpts ?? {});
     const stream = provider.streamChat
       ? provider.streamChat(kept, plainOpts)
       : wrapTextOnly(provider.chat(kept, plainOpts));
@@ -529,7 +541,7 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
   // status bar (CTX bar · $ · 🚀) reflects the latest numbers. Uses
   // rough estimates — providers that expose real `usage` fields can
   // override via opts.llmOpts in a later phase.
-  const resolvedModel = opts.llmOpts?.model ?? provider.defaultModel;
+  const resolvedModel = llmOpts?.model ?? provider.defaultModel;
   recordTurn({
     model: resolvedModel,
     estimatedPromptText: [...messages, userMsg].map(m =>

package/src/session/index.ts

@@ -434,12 +434,20 @@ function readIndex(root: string = sessionRoot()): SessionMeta[] {
   }
 }
 
-function writeIndex(entries: SessionMeta[], root: string = sessionRoot()): void {
+// 여러 프로세스(`elanous ask` 동시 실행 등)가 같은 목록을 «읽고-고치고-통째로 쓰기» 한다.
+// 쓰기 직전 잠금 안에서 디스크의 최신 목록을 다시 읽어 id 로 합치고, 임시 파일 이름은 프로세스마다 다르게 한다
+// (10-01 MK 재현: 고정 `index.json.tmp` → 한쪽 ENOENT · 덮어쓰기로 남의 세션이 목록에서 사라짐).
+function writeIndex(entries: SessionMeta[], root: string = sessionRoot(), removed: Iterable<string> = []): void {
   ensureRoots(root);
   const p = indexPath(root);
-  const tmp = p + '.tmp';
-  writeFileSync(tmp, JSON.stringify(entries, null, 2) + '\n', 'utf-8');
-  renameSync(tmp, p);
+  withDirLock(join(root, '.index.lock'), INDEX_LOCK_TIMEOUT_MS, () => {
+    const mine = new Set(entries.map((m) => m.id));
+    const gone = new Set(removed);
+    const peers = readIndex(root).filter((m) => !mine.has(m.id) && !gone.has(m.id));
+    const tmp = `${p}.${process.pid}.${randomUUID().slice(0, 8)}.tmp`;
+    writeFileSync(tmp, JSON.stringify([...peers, ...entries], null, 2) + '\n', 'utf-8');
+    renameSync(tmp, p);
+  });
 }
 
 // ── Tier 1 Phase 3 — listener primitive ──────────────────────────────
@@ -661,7 +669,7 @@ export function rewriteSessionMessages(
   const body = messages
     .map(m => JSON.stringify(m.turn_id !== undefined ? m : { ...m, turn_id: mintTurnUri() }))
     .join('\n');
-  const tmp = file + '.tmp';
+  const tmp = `${file}.${process.pid}.${randomUUID().slice(0, 8)}.tmp`;
   writeFileSync(tmp, body ? body + '\n' : '', 'utf-8');
   renameSync(tmp, file);
 
@@ -800,8 +808,13 @@ function residentSessionLockPath(root: string): string {
 
 function withResidentSessionLock<T>(root: string, action: () => T): T {
   ensureRoots(root);
-  const lock = residentSessionLockPath(root);
-  const deadline = Date.now() + RESIDENT_SESSION_LOCK_TIMEOUT_MS;
+  return withDirLock(residentSessionLockPath(root), RESIDENT_SESSION_LOCK_TIMEOUT_MS, action);
+}
+
+const INDEX_LOCK_TIMEOUT_MS = 10_000;
+
+function withDirLock<T>(lock: string, timeoutMs: number, action: () => T): T {
+  const deadline = Date.now() + timeoutMs;
   for (;;) {
     try {
       mkdirSync(lock);
@@ -814,7 +827,7 @@ function withResidentSessionLock<T>(root: string, action: () => T): T {
           continue;
         }
       } catch { continue; }
-      if (Date.now() >= deadline) throw new Error(`timed out acquiring resident session lock for ${root}`);
+      if (Date.now() >= deadline) throw new Error(`timed out acquiring lock ${lock}`);
       Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
       void error;
     }
@@ -855,7 +868,7 @@ export function deleteSession(id: string, root: string = sessionRoot()): boolean
   const before = idx.length;
   const next = idx.filter(m => m.id !== id);
   if (next.length === before) return false;
-  writeIndex(next, root);
+  writeIndex(next, root, [id]);
   // Clear active marker if it pointed at the deleted session.
   if (getActiveSessionId() === id) clearActiveSessionId();
   return true;
@@ -876,7 +889,7 @@ export function deleteSessions(ids: string[], root: string = sessionRoot()): num
   const idx = readIndex(root);
   const next = idx.filter(m => !set.has(m.id));
   const removed = idx.length - next.length;
-  if (removed > 0) writeIndex(next, root);
+  if (removed > 0) writeIndex(next, root, set);
   const active = getActiveSessionId();
   if (active && set.has(active)) clearActiveSessionId();
   return removed;

package/src/skills/shared-agent-skill-roots.ts

@@ -0,0 +1,25 @@
+import { statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+export interface SharedAgentSkillRootsOptions {
+  home?: string;
+  /** Directory-existence probe; defaults to a read-only filesystem stat. */
+  exists?: (dir: string) => boolean;
+  includeSharedAgentSkills?: boolean;
+}
+
+/** Discover the shared user skill root without creating or modifying it. */
+export function sharedAgentSkillRoots({
+  home = homedir(),
+  exists = (dir: string) => statSync(dir).isDirectory(),
+  includeSharedAgentSkills = true,
+}: SharedAgentSkillRootsOptions): string[] {
+  if (!includeSharedAgentSkills) return [];
+  const root = join(home, '.agents', 'skills');
+  try {
+    return exists(root) ? [root] : [];
+  } catch {
+    return [];
+  }
+}

package/src/steward/failure-streak.ts

@@ -0,0 +1,78 @@
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { redactSecretText } from '../debug/log.js';
+
+export type StewardStage = 'sync' | 'triage' | 'schedule' | 'report';
+export interface FailureStreak {
+  consecutive: number;
+  lastStage: StewardStage;
+  lastReason: string;
+  lastAt: string;
+  alertedAt?: string;
+  open?: { stage: StewardStage; startedAt: string };
+}
+
+const stages: readonly string[] = ['sync', 'triage', 'schedule', 'report'];
+const empty = (): FailureStreak => ({ consecutive: 0, lastStage: 'sync', lastReason: '', lastAt: '' });
+const pathFor = (root: string): string => join(root, 'steward', 'streak.json');
+
+export function readFailureStreak(root: string): FailureStreak {
+  try {
+    const value: unknown = JSON.parse(readFileSync(pathFor(root), 'utf8'));
+    if (!value || typeof value !== 'object' || Array.isArray(value)) return empty();
+    const s = value as Record<string, unknown>;
+    if (!Number.isSafeInteger(s.consecutive) || (s.consecutive as number) < 0 ||
+        !stages.includes(s.lastStage as string) || typeof s.lastReason !== 'string' || typeof s.lastAt !== 'string' ||
+        (s.alertedAt !== undefined && typeof s.alertedAt !== 'string')) return empty();
+    if (s.open !== undefined && (!s.open || typeof s.open !== 'object' || Array.isArray(s.open) ||
+        !stages.includes((s.open as Record<string, unknown>).stage as string) ||
+        typeof (s.open as Record<string, unknown>).startedAt !== 'string')) return empty();
+    return s as unknown as FailureStreak;
+  } catch { return empty(); }
+}
+
+export function writeFailureStreak(root: string, state: FailureStreak): void {
+  const dir = join(root, 'steward');
+  mkdirSync(dir, { recursive: true });
+  const path = pathFor(root);
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(state));
+  renameSync(tmp, path);
+}
+
+export function markStageStart(root: string, stage: StewardStage, now: Date = new Date()): FailureStreak {
+  const state = readFailureStreak(root);
+  if (state.open) {
+    state.consecutive += 1;
+    state.lastStage = state.open.stage;
+    state.lastReason = `killed or timed out: ${state.open.stage}`;
+    state.lastAt = now.toISOString();
+  }
+  state.open = { stage, startedAt: now.toISOString() };
+  writeFailureStreak(root, state);
+  return state;
+}
+
+export function markStageEnd(root: string, stage: StewardStage, ok: boolean, reason = '', now: Date = new Date()): FailureStreak {
+  const state = readFailureStreak(root);
+  delete state.open;
+  if (ok) {
+    state.consecutive = 0;
+    delete state.alertedAt;
+  } else {
+    state.consecutive += 1;
+  }
+  state.lastStage = stage;
+  state.lastReason = ok ? '' : redactSecretText(reason);
+  state.lastAt = now.toISOString();
+  writeFailureStreak(root, state);
+  return state;
+}
+
+export function shouldAlert(state: FailureStreak, threshold: number): boolean {
+  return state.consecutive >= threshold && !state.alertedAt;
+}
+
+export function failureAlertText(state: FailureStreak): string {
+  return `스튜어드 연속 실패 ${state.consecutive}회 · 마지막 ${state.lastStage} · ${redactSecretText(state.lastReason).slice(0, 120)} · 로그 /tmp/elanous-loop-steward.log`;
+}

package/src/steward/steward-cards.ts

@@ -43,3 +43,27 @@ export function recordTriageOnCards(decisions: ScheduledDecision[], issues: Tria
     if (!deps.store) store.close();
   }
 }
+
+function recordOnCard(section: 'launch' | 'outcome', issue: Pick<TriageIssue, 'identifier' | 'title'>, value: object, deps: StewardCardDeps): void {
+  const store = deps.store ?? new CardStore(deps.root);
+  try {
+    const content = redactSecrets(JSON.stringify(value));
+    const key = `${section}:${createHash('sha256').update(content).digest('hex')}`;
+    const card = store.createCard({ goalId: `linear:${issue.identifier}`, title: redactSecrets(issue.title) });
+    if (!card.sections.some(item => item.key === key)) {
+      store.appendSection(card.id, { key, owner: 'steward', content });
+    }
+  } finally {
+    if (!deps.store) store.close();
+  }
+}
+
+/** Append a launch revision to the issue card; an identical retry keeps its original section. */
+export function recordLaunchOnCard(issue: Pick<TriageIssue, 'identifier' | 'title'>, launch: object, deps: StewardCardDeps = {}): void {
+  recordOnCard('launch', issue, launch, deps);
+}
+
+/** Append an outcome revision to the issue card without replacing earlier sections. */
+export function recordOutcomeOnCard(issue: Pick<TriageIssue, 'identifier' | 'title'>, outcome: object, deps: StewardCardDeps = {}): void {
+  recordOnCard('outcome', issue, outcome, deps);
+}