@kylecheng3146/agent-ops 0.11.3 → 0.11.5

package/README.md

@@ -53,8 +53,14 @@ agent-ops run logs <run-id>
 agent-ops run respond <run-id> --question-id <id> --answer "Clarification"
 agent-ops run stop <run-id>
 agent-ops run resume <run-id>
+agent-ops run land <run-id> [--task <task-id>]... --yes
 ```
 
+`run land` merges the delivered children of a paused, blocked or budget-limited
+run ahead of the rest: it verifies them, runs the two-round review and finishes
+with a receipt in a separate landing worktree, while the run stays resumable and
+its final proof re-verifies the whole goal.
+
 `--host claude` uses Claude Code; `--wait` waits for a terminal or input state.
 The coordinator counts toward the two writer slots. Native processes write only
 under current leases in separate worktrees. Active time counts once across parallel
@@ -268,7 +274,8 @@ question through `agent-ops run respond`. A start refused with
 `WORKTREE_NESTED` falls back to the subtask flow; `RUN_REPO_UNTRUSTED` stops and
 asks you. A run that ends without completing is reported with its status, last
 log events, and the `agent-ops run resume <id>` / `agent-ops run stop <id>`
-commands; it is never resumed automatically. agy keeps the subtask flow.
+commands (plus `agent-ops run land <id> --yes` when it has delivered tasks); it
+is never resumed or landed automatically. agy keeps the subtask flow.
 Init and update pre-authorize `agent-ops run` for Claude Code and Codex.
 
 ```bash

package/dist/packages/cli/src/args.js

@@ -922,7 +922,7 @@ export function parseArgs(argv) {
     };
 }
 function parseRunArgs(argv) {
-    const actions = ["start", "status", "logs", "resume", "stop", "respond"];
+    const actions = ["start", "status", "logs", "resume", "stop", "respond", "land"];
     if (argv.includes("--help") || argv.includes("-h"))
         return { command: "help", helpTopic: "run", profiles: [], dryRun: false, json: false, yes: false, rerun: false };
     const action = actions.includes(argv[0]) ? argv[0] : "start";
@@ -937,21 +937,30 @@ function parseRunArgs(argv) {
             positional = token;
             continue;
         }
-        if (seen.has(token) && token !== "--retry-approval")
+        if (seen.has(token) && token !== "--retry-approval" && token !== "--task")
             duplicate(token);
         seen.add(token);
         if (token === "--json") {
             args.json = true;
             continue;
         }
+        if (token === "--yes") {
+            args.yes = true;
+            continue;
+        }
         if (token === "--wait") {
             args.wait = true;
             continue;
         }
-        if (!["--host", "--goal-file", "--time-budget", "--jobs", "--question-id", "--answer", "--answer-file", "--retry-approval", "--retry-delivery"].includes(token))
+        if (!["--host", "--goal-file", "--time-budget", "--jobs", "--question-id", "--answer", "--answer-file", "--retry-approval", "--retry-delivery", "--task"].includes(token))
             throw new CliArgumentError("CLI_UNKNOWN_OPTION", `Unknown run option: ${token}`, token);
         const value = readOptionValue(argv, i++, token);
         switch (token) {
+            case "--task":
+                if (!/^[A-Za-z0-9._:/-]{1,256}$/u.test(value) || args.landTaskIds?.includes(value))
+                    invalidValue(token, value);
+                args.landTaskIds = [...(args.landTaskIds ?? []), value];
+                break;
             case "--retry-delivery":
                 if (!/^task-[a-z0-9-]{1,128}$/u.test(value))
                     invalidValue(token, value);
@@ -991,6 +1000,12 @@ function parseRunArgs(argv) {
     }
     if (args.retryApprovalIds !== undefined && action !== "resume")
         throw new CliArgumentError("CLI_INVALID_OPTION", "--retry-approval requires run resume.");
+    if (args.landTaskIds !== undefined && action !== "land")
+        throw new CliArgumentError("CLI_INVALID_OPTION", "--task requires run land.");
+    if (args.yes !== (action === "land"))
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", action === "land"
+            ? "Run land requires --yes to authorize its verification and both reviewer sessions."
+            : "--yes is accepted only by run land.");
     if (args.retryDeliveryTaskId !== undefined && (action !== "resume" || args.retryApprovalIds !== undefined))
         throw new CliArgumentError("CLI_INVALID_OPTION", "--retry-delivery requires run resume without --retry-approval.");
     if (action === "start") {

package/dist/packages/cli/src/cli.js

@@ -130,6 +130,7 @@ The URL carries an access token; do not share it.
        agent-ops run resume <run-id> [--retry-approval <auth-event-id>]... [--json]
        agent-ops run resume <run-id> --retry-delivery <task-id> [--json]
        agent-ops run respond <run-id> --question-id <id> <--answer <text>|--answer-file <path>> [--json]
+       agent-ops run land <run-id> [--task <task-id>]... --yes [--json]
 
 New runs have no total time cap. Manual resume upgrades legacy finite runs and keeps accounting.
 Command/review timeouts, provider limits and stop controls remain effective.
@@ -144,6 +145,10 @@ Status includes phase, original cause, recorded sealed proof, cleanup state,
 resumability and remediation. Resume revalidates authority and sealed artifacts;
 receipt-bound recovery executes only missing cleanup steps. Resolve the saved
 blocker before retrying: unchanged cleanup inputs are refused.
+land merges delivered children of a paused, blocked or budget-limited run ahead
+of the rest: it verifies them, runs the two-round review and finishes with a
+receipt, leaving the run resumable. --task picks a subset; each one's
+dependencies must be picked too or already landed.
 `,
     init: `Usage: agent-ops init [options]
 

package/dist/packages/cli/src/commands/advance.js

@@ -102,7 +102,7 @@ export async function runAdvanceCommand(options) {
     if (parent.status !== "active" || parent.task.parentTaskId !== undefined) {
         throw new AgentOpsError("ADVANCE_PARENT_INVALID", "Advance requires an active root task in the coordinator worktree.");
     }
-    const children = await integrateSessionChildren(deps, record, parent.task.id);
+    const children = await integrateSessionChildren(deps, record, parent.task.id, undefined, options.children);
     const step = options.step ?? runAdvanceStep;
     for (let attempt = 0; attempt < 2; attempt += 1) {
         const target = await git(deps, mainRoot, ["rev-parse", `${record.targetBranch}^{commit}`]);
@@ -159,6 +159,7 @@ export async function runAdvanceCommand(options) {
             ...(noChangePaths === undefined ? {} : { noChangePaths }) });
         const sourceFingerprint = await calculateSourceFingerprint(record.path, scope, runner(deps, record.path));
         const finalProof = { target, head, sourceFingerprint, children,
+            ...(options.children === undefined ? {} : { keepChildren: true }),
             ...(noChangePaths === undefined ? {} : { noChange: { sourceCommit: head,
                     contractDigest: await deps.tasks(record.path).treeContract(parent.task.id), reviewScope: scope,
                     artifactRefs: Object.values((await deps.tasks(record.path).status({ taskId: parent.task.id })).evidence).flat() } }) };

package/dist/packages/cli/src/commands/init.js

@@ -127,13 +127,10 @@ export async function runInitCommand(options) {
             : { worktree: worktreeConfig })
     });
     const trust = await trustChange(options, plan);
-    // An installation with no verifier looks finished and is not: every task
-    // completion needs current PASS evidence from a required verifier, so the
-    // loop can never close. Detection stays conservative on purpose — it will
-    // not guess a test command — which makes saying so out loud the whole fix.
+    // Empty commands block legacy criteria, not typed acceptance backed by runners.
     const verificationWarnings = plan.config.verification.commands.length === 0
         ? [
-            "No verification command is configured, so no task can be completed. " +
+            "No verification command is configured; legacy criteria need a required verifier. " +
                 "Add verification.commands to .agent-ops/config.json." +
                 (plan.verificationBlockers.length === 0
                     ? ""

package/dist/packages/cli/src/commands/review.js

@@ -317,6 +317,7 @@ const SURFACE_REASONS = {
     SURFACE_UNCLASSIFIED: "surface-unclassified",
     SURFACE_QUERY_TOO_BROAD: "surface-query-too-broad",
     SURFACE_EXCLUSION_TOO_BROAD: "surface-exclusion-too-broad",
+    SURFACE_INCLUSION_TOO_BROAD: "surface-inclusion-too-broad",
     SCENARIO_MISSING: "scenario-missing",
     SURFACE_BUDGET_EXCEEDED: "surface-budget-exceeded",
     SURFACE_UNASSIGNED: "surface-unassigned",

package/dist/packages/cli/src/commands/run.js

@@ -9,7 +9,7 @@ function actionOf(args) {
     const value = dynamic(args).runAction ?? dynamic(args).action;
     if (value === undefined || value === "start")
         return "start";
-    if (["status", "logs", "resume", "stop", "respond"].includes(String(value)))
+    if (["status", "logs", "resume", "stop", "respond", "land"].includes(String(value)))
         return value;
     throw new AgentOpsError("RUN_ACTION_INVALID", `Unsupported run action: ${String(value)}`);
 }
@@ -109,6 +109,14 @@ export async function runRunCommand(options) {
         }
         if (action === "resume")
             return okEnvelope("RUN_RESUMED", data(action, await options.service.resume(runId, options.args.retryApprovalIds, true, options.args.retryDeliveryTaskId)));
+        if (action === "land") {
+            if (options.service.land === undefined)
+                throw new AgentOpsError("RUN_LAND_UNSUPPORTED", "This CLI cannot land run deliveries.");
+            const landed = await options.service.land(runId, options.args.landTaskIds);
+            const message = `Landed ${landed.taskIds.join(", ")} from run ${runId}. Receipt: ${landed.receipt}.\n` +
+                `The run stays ${landed.state.status}; continue the rest with: agent-ops run resume ${runId}`;
+            return okEnvelope("RUN_LANDED", { ...data(action, { state: landed.state, message }), landedTaskIds: landed.taskIds, receipt: landed.receipt });
+        }
         if (action === "stop")
             return okEnvelope("RUN_STOP_REQUESTED", data(action, await options.service.stop(runId, options.args.answer ?? "user requested stop")));
         const questionId = options.args.questionId;

package/dist/packages/cli/src/run-deps.js

@@ -9,7 +9,8 @@ import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
 import { sha256 } from "../../../runtime/src/fs/hash.js";
 import { resolveCheckouts, readWorktreeRecord, sessionWorktreeName } from "../../../runtime/src/parallel/service.js";
 import { createLaunchdDescriptor, LaunchdController, readBootIdentity, readGuiLoginIdentity } from "../../../runtime/src/run/macOS.js";
-import { FileRunRepository, RunService, validateDeliveryRetry } from "../../../runtime/src/run/service.js";
+import { FileRunRepository, RunService, landingMarkerLive, validateDeliveryRetry } from "../../../runtime/src/run/service.js";
+import { landRun } from "../../../runtime/src/run/land.js";
 import { readPrivateFile, writePrivateFile } from "../../../runtime/src/security/permissions.js";
 import { collectChangeSurface } from "../../../runtime/src/verify/change-surface.js";
 import { worktreeDependencies, gitRunner, trustStore } from "./parallel-deps.js";
@@ -28,6 +29,7 @@ import { nativeProcessIdentity } from "../../../runtime/src/run/transport.js";
 import { redactSecrets } from "../../../runtime/src/security/redact.js";
 import { RunControlService } from "../../../runtime/src/run/controls.js";
 import { recordRunPhase } from "../../../runtime/src/run/phase.js";
+import { runAdvanceCommand } from "./commands/advance.js";
 /** Worktree construction happens before a native lease exists; it must never write global trust. */
 export async function runWorktreeDependencies(deps, state) {
     state = await ensureRunPolicy(new FileRunRepository(join(state.commonDir, "agent-ops/runs"), state.commonDir), state);
@@ -213,6 +215,8 @@ export async function productionRunContext(cwd, options = {}) {
     };
     const resume = async (runId, retryApprovalIds = [], upgradeBudget = true, retryDeliveryTaskId) => {
         const before = await service.status(runId);
+        if (landingMarkerLive(before.landing))
+            throw new AgentOpsError("RUN_LANDING_IN_PROGRESS", `Run ${runId} is landing delivered work; wait for run land to finish.`);
         const retry = retryDeliveryTaskId === undefined ? null : validateDeliveryRetry(before, retryDeliveryTaskId);
         const runtimeHash = await runRuntimeHash();
         const policy = await readRunPolicy(before, before.policyBinding?.runtimeHash ?? runtimeHash, Date.now(), true);
@@ -315,6 +319,18 @@ export async function productionRunContext(cwd, options = {}) {
         }
         return { state, message: `Run ${runId} stopped; registered native process death was confirmed.` };
     };
+    const land = async (runId, taskIds) => {
+        if (checkouts.currentRoot !== checkouts.mainRoot)
+            throw new AgentOpsError("WORKTREE_NESTED", "Land a run from the main checkout.");
+        return await landRun({ repository, runId, ...(taskIds === undefined ? {} : { taskIds }), deps,
+            advance: async (input) => {
+                const result = await runAdvanceCommand({ ...input, deps });
+                const receipt = result.data?.receipt;
+                if (result.status !== "ok" || typeof receipt !== "string")
+                    throw new AgentOpsError(result.code, "Landing proof did not finish with a receipt.");
+                return { receipt };
+            } });
+    };
     const respond = async (runId, questionId, answer) => {
         const state = await service.status(runId);
         if (!state.questions.some(q => q.questionId === questionId && q.answeredAt === null))
@@ -331,7 +347,7 @@ export async function productionRunContext(cwd, options = {}) {
         }
     };
     return { ...checkouts, targetBranch: target.stdout.trim(), ownerSessionId: randomUUID(), repository,
-        service: { start, resume, stop, respond, status: service.status.bind(service), logs: service.logs.bind(service) },
+        service: { start, resume, stop, respond, land, status: service.status.bind(service), logs: service.logs.bind(service) },
         waitForCompletion: async (runId) => {
             for (;;) {
                 const state = await service.status(runId);

package/dist/runtime/src/install/doctor.js

@@ -380,17 +380,15 @@ async function checkRegistrationDrift(root, manifest, config) {
     }
 }
 /**
- * Whether anything can ever be verified here. Completion requires current PASS
- * evidence from a required verifier, so an empty list is not a light
- * configuration — it is a loop that cannot close, and an installation reaches
- * that state quietly whenever stack detection declines to guess.
+ * Legacy criteria need required verifiers; typed acceptance can use runners
+ * even when no ordinary verification command is configured.
  */
 function checkVerificationCommands(config) {
     if (config === undefined) {
         return check("verification-commands", "UNKNOWN", "Configuration could not be read, so verifiers are unknown.");
     }
     if (config.verification.commands.length === 0) {
-        return check("verification-commands", "DEGRADED", "No verification command is configured, so no task can be completed.", 
+        return check("verification-commands", "DEGRADED", "No verification command is configured; legacy criteria need a required verifier.", 
         // Codeless on purpose: the fix is an edit to the configuration file, not
         // an agent-ops command, and a code here would force a non-zero exit on
         // every installation whose stack detection declined to guess.

package/dist/runtime/src/install/harness.js

@@ -347,7 +347,8 @@ function autoRunInstruction(descriptor, context) {
         "report the `agent-ops run status",
         "<id>` state and code, the last `agent-ops run logs <id>` events, and the",
         "exact `agent-ops run resume <id>` and `agent-ops run stop <id>` commands,",
-        "then stop: never resume automatically or take over the run's work.",
+        "plus `agent-ops run land <id> --yes` when it has delivered tasks,",
+        "then stop: never resume or land automatically or take over the run's work.",
         ""
     ];
 }

package/dist/runtime/src/install/plan.js

@@ -88,7 +88,7 @@ function buildConfig(profiles, existing, reviewTargets = [], detectedCommands =
     const verification = existing?.verification !== undefined &&
         existing.verification.commands.length > 0
         ? existing.verification
-        : { commands: [...detectedCommands] };
+        : { ...existing?.verification, commands: [...detectedCommands] };
     // Pre-0.11 DEBUG budget settings are dropped on rewrite.
     const existingFeatures = existing === undefined ? undefined : (({ debug: _legacyDebug, ...rest }) => rest)(existing.features);
     const effectiveWorktree = worktree !== undefined

package/dist/runtime/src/parallel/finish.js

@@ -318,9 +318,12 @@ export async function finishWorktree(deps, options) {
     return await withActivity(commonDir, { kind: "finish", root: record.path, sessionId: record.sessionId, worktree: name }, async () => await withFinishLock(deps, commonDir, async () => {
         const listing = await git(deps, mainRoot, ["worktree", "list", "--porcelain"], "WORKTREE_LIST_FAILED", "Cannot list cleanup worktrees.");
         const records = await Promise.all(parseWorktreeListPorcelain(listing).map(child => readWorktreeRecord(child.path)));
+        const keepChildren = options.finalProof?.keepChildren === true;
         const sessionChildren = records
-            .filter((child) => child !== null && child.path !== record.path && child.sessionId === record.sessionId &&
-            (child.agentId !== undefined || (record.runId !== undefined && child.runId === record.runId)));
+            .filter((child) => child !== null && child.path !== record.path && (keepChildren
+            ? options.finalProof.children.some(({ name }) => name === child.name)
+            : child.sessionId === record.sessionId &&
+                (child.agentId !== undefined || (record.runId !== undefined && child.runId === record.runId))));
         if (options.finalProof?.recovery === true && record.runId !== undefined) {
             const saved = await new FileRunRepository(join(commonDir, "agent-ops/runs"), commonDir).read(record.runId);
             if (["receipt-written", "cleaned"].includes(saved?.integration?.status ?? ""))
@@ -579,7 +582,7 @@ export async function finishWorktree(deps, options) {
                 // this session began would leave it reading the merge as its own change.
                 // Only this worktree leaves the session; its other roots stay covered.
                 await mainGate.afterFinish(record.sessionId, record.path, after);
-                if (options.finalProof !== undefined) {
+                if (options.finalProof !== undefined && !keepChildren) {
                     for (const child of sessionChildren) {
                         await mainGate.afterFinish(record.sessionId, child.path, after);
                     }
@@ -593,7 +596,7 @@ export async function finishWorktree(deps, options) {
         await attempt("trust", async () => await deps.trust.revoke(record.path, worktreeConfig));
         if (receiptOptions !== undefined)
             await markRunIntegration(commonDir, record, "receipt-written", "trust");
-        if (options.finalProof !== undefined) {
+        if (options.finalProof !== undefined && !keepChildren) {
             for (const child of sessionChildren) {
                 await attempt(`child ${child.name}`, async () => {
                     const pinnedHead = await assertPinnedChild(child);

package/dist/runtime/src/parallel/integrate.js

@@ -156,11 +156,13 @@ async function previous(record) {
     return value;
 }
 /** Integrate only this session's agent-owned branches; local proof is never promoted as final proof. */
-export async function integrateSessionChildren(deps, coordinator, parentTaskId, eligibleRunWorkerIds) {
-    const statuses = await listWorktrees(deps, coordinator.mainRoot);
-    const children = statuses.map(({ record }) => record)
+export async function integrateSessionChildren(deps, coordinator, parentTaskId, eligibleRunWorkerIds, 
+/** Another session's children chosen by the caller (`run land`); replaces the session filter only. */
+explicitChildren) {
+    const statuses = explicitChildren === undefined ? await listWorktrees(deps, coordinator.mainRoot) : [];
+    const children = (explicitChildren ?? statuses.map(({ record }) => record)
         .filter((record) => record.name !== coordinator.name && record.sessionId === coordinator.sessionId &&
-        (record.agentId !== undefined || (coordinator.runId !== undefined && record.runId === coordinator.runId)))
+        (record.agentId !== undefined || (coordinator.runId !== undefined && record.runId === coordinator.runId))))
         .filter(record => eligibleRunWorkerIds === undefined || (record.workerId !== undefined && eligibleRunWorkerIds.includes(record.workerId)))
         .sort((a, b) => a.name.localeCompare(b.name));
     const integrated = await previous(coordinator);

package/dist/runtime/src/review/runner.js

@@ -108,6 +108,8 @@ function taskDataBlock(invocation) {
 function surfaceBlock(invocation, round) {
     if (invocation.packet.surface === undefined)
         return [];
+    const discovery = invocation.packet.surface.discovery;
+    const skipped = round === "adversarial" ? discovery?.skipped ?? [] : [];
     return [
         "",
         "Surface coverage (narrow exception to \"Do not survey\"): task data carries the surface audit, its revision " +
@@ -121,7 +123,10 @@ function surfaceBlock(invocation, round) {
                 "and indirect consumer. Do not run other searches beyond callers a specific question needs."
             : "Round 2: check the five fixed scenarios (initialState, redo, timeBoundary, identitySwitch, concurrency) against " +
                 "the code, and hunt unlisted surfaces with at most 3 new `git grep -F` queries per axis (dependents, duplicates, " +
-                "otherPaths, sharedState); cite each query you ran in evidence."
+                "otherPaths, sharedState); cite each query you ran in evidence.",
+        ...(skipped.length === 0 ? [] : ["Skipped derived queries (over 10 files outside the diff, so discovery never gated them; " +
+                `fewest first): ${skipped.map(row => `\`${row.query}\` (${row.files})`).join(", ")}. Beyond the per-axis budget, run at most 3 ` +
+                "extra `git grep -F` queries in total over these to find copied siblings the change missed; cite each in evidence."])
     ];
 }
 /** Escape Loop: both rounds adjudicate the earliest-gate label of each declared escape. */

package/dist/runtime/src/run/land.js

@@ -0,0 +1,145 @@
+import { randomUUID } from "node:crypto";
+import { hostname } from "node:os";
+import { join } from "node:path";
+import { calculateConfigHash } from "../config/hash.js";
+import { sha256 } from "../fs/hash.js";
+import { AgentOpsError } from "../fs/paths.js";
+import { listWorktrees } from "../parallel/manage.js";
+import { addWorktree, readWorktreeRecord, removeCheckout, sessionWorktreeName } from "../parallel/service.js";
+import { readPrivateFile, writePrivateFile } from "../security/permissions.js";
+import { landingMarkerLive, MAX_EVENTS } from "./service.js";
+const LIVE_WORKER = ["assigned", "starting", "running", "idle", "handing-off"];
+const LANDABLE = ["paused", "blocked", "budget-limited"];
+/** Inside the landing worktree; names the run that owns it so another run never reuses it. */
+const OWNER_FILE = join(".agent-ops", "tasks", "run-landing.json");
+export function assertLandable(state) {
+    if (!LANDABLE.includes(state.status) || state.rootTaskId === null ||
+        state.workers.some(worker => LIVE_WORKER.includes(worker.status)))
+        throw new AgentOpsError("RUN_LAND_STATE_INVALID", `Run ${state.runId} is ${state.status}; land needs a paused, blocked or budget-limited run with a root task and no live worker.`);
+}
+/** Unlanded delivered children, or the requested ones; every dependency must be selected or already landed. */
+export function selectLanding(state, requested) {
+    const landed = new Set((state.landings ?? []).flatMap(landing => landing.taskIds));
+    const eligible = state.tasks.filter(task => task.taskId !== state.rootTaskId && task.status === "delivered" &&
+        task.sourceCommit !== null && !landed.has(task.taskId));
+    for (const id of requested ?? [])
+        if (!eligible.some(task => task.taskId === id))
+            throw new AgentOpsError("RUN_LAND_TASK_INVALID", `${id} is not an unlanded delivered task of run ${state.runId}.`);
+    const selected = requested === undefined ? eligible : eligible.filter(task => requested.includes(task.taskId));
+    if (selected.length === 0)
+        throw new AgentOpsError("RUN_LAND_NOTHING", `Run ${state.runId} has no unlanded delivered task.`);
+    const ids = new Set(selected.map(task => task.taskId));
+    for (const task of selected)
+        for (const dependency of task.dependencies)
+            if (!ids.has(dependency) && !landed.has(dependency))
+                throw new AgentOpsError("RUN_LAND_DEPENDENCY_OPEN", `${task.taskId} depends on ${dependency}, which is neither selected nor landed.`);
+    return selected;
+}
+/**
+ * One landing session per attempt: a non-hex first letter keeps it apart from
+ * UUID sessions, and a fresh path per attempt never reuses a removed checkout.
+ */
+export function landingSessionId(runId, nonce = randomUUID()) {
+    return `l${sha256(`${runId}:${nonce}`).slice(0, 7)}${LANDING_SUFFIX}${runId}`;
+}
+const LANDING_SUFFIX = "-land-";
+async function git(deps, cwd, args) {
+    const result = await deps.git(cwd, args);
+    if (result.exitCode !== 0)
+        throw new AgentOpsError("RUN_LAND_GIT_FAILED", `${args.join(" ")}: ${result.stderr.trim()}`);
+    return result.stdout.trim();
+}
+/** The worker checkout whose committed head is the frozen delivery. */
+async function deliveredCheckout(deps, state, task) {
+    for (const worker of state.workers.filter(worker => worker.taskId === task.taskId && worker.worktree !== null)) {
+        const record = await readWorktreeRecord(worker.worktree);
+        if (record !== null && await git(deps, record.path, ["rev-parse", "HEAD"]) === task.sourceCommit)
+            return record;
+    }
+    throw new AgentOpsError("RUN_LAND_DELIVERY_MISSING", `No preserved checkout of ${task.taskId} is at its delivered commit ${task.sourceCommit}.`);
+}
+async function ownerOf(path) {
+    try {
+        const owner = JSON.parse(await readPrivateFile(join(path, OWNER_FILE), path) ?? "null");
+        return typeof owner?.runId === "string" ? owner.runId : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Worktrees kept by this run's failed attempts are removed first; one that claims the run without proof is refused. */
+async function freshLandingWorktree(deps, state, sessionId) {
+    const claimed = (await listWorktrees(deps, state.root)).map(({ record }) => record)
+        .filter(record => record.sessionId.endsWith(LANDING_SUFFIX + state.runId));
+    for (const record of claimed)
+        if (await ownerOf(record.path) !== state.runId)
+            throw new AgentOpsError("RUN_LAND_WORKTREE_FOREIGN", `${record.path} claims run ${state.runId} without its owner record; it was left untouched.`);
+    for (const record of claimed)
+        await removeCheckout(deps, record, true);
+    const record = (await addWorktree(deps, { cwd: state.root, name: sessionWorktreeName(sessionId), sessionId,
+        from: state.targetBranch, targetBranch: state.targetBranch })).record;
+    await writePrivateFile(join(record.path, OWNER_FILE), JSON.stringify({ runId: state.runId }), record.path);
+    return record;
+}
+async function createLandingRoot(deps, state, record, selected) {
+    const config = await deps.loadConfig(record.path);
+    const required = config.verification.commands.filter(command => command.required).map(command => command.id);
+    if (required.length === 0)
+        throw new AgentOpsError("RUN_LAND_VERIFIER_REQUIRED", "Landing proof needs at least one required verification command.");
+    const coordinator = state.workers.find(worker => worker.workerId === state.coordinatorId)?.worktree ?? null;
+    const root = coordinator === null ? null : await deps.tasks(coordinator).status({ taskId: state.rootTaskId }).catch(() => null);
+    const ids = selected.map(task => task.taskId);
+    const base = await git(deps, record.path, ["rev-parse", "HEAD"]);
+    const criteria = [
+        { id: "landed-verifiers", description: "Every required project verifier passes on the integrated candidate of the landed tasks.", verifierIds: required },
+        { id: "landed-coherent", verifierIds: [],
+            description: "The landed subset is coherent on its own: it exposes no half-finished behavior and references no work of an undelivered run task.",
+            acceptance: { mode: "review-only", baselineCommit: base, bindings: [],
+                reviewOnlyReason: "partial-landing coherence: whether a subset stands alone without the undelivered tasks is a reviewer judgment, not a mechanical check" } }
+    ];
+    // Typed acceptance needs repository context; the target head is the landing baseline.
+    const created = await deps.tasks(record.path, base).create({
+        title: `Land ${ids.join(", ")} from ${state.runId}`,
+        goal: `Land delivered tasks ${ids.join(", ")} of run ${state.runId} ahead of the rest of its goal:\n${state.goal}`.slice(0, 64_000),
+        intent: "Merge only the frozen deliveries of the listed run tasks; the run, its root task and its checkouts stay as they are.",
+        criteria, createdSourceCommit: base, policyConfigHash: calculateConfigHash(config), sessionId: record.sessionId,
+        ...(root?.task.surface === undefined ? {} : { surface: root.task.surface })
+    });
+    return created.task.id;
+}
+/**
+ * `agent-ops run land`: prove and merge delivered children of a stopped run
+ * while the run stays resumable. Landed tasks remain delivered, so a later
+ * resume and finalize re-verify the whole goal on the new target.
+ */
+export async function landRun(options) {
+    const now = options.now ?? (() => new Date().toISOString());
+    let selected = [];
+    const held = await options.repository.mutate(options.runId, current => {
+        if (landingMarkerLive(current.landing))
+            throw new AgentOpsError("RUN_LANDING_IN_PROGRESS", `Run ${current.runId} is already landing delivered work.`);
+        assertLandable(current);
+        selected = selectLanding(current, options.taskIds);
+        return { ...current, landing: { processId: process.pid, hostname: hostname(), startedAt: now() } };
+    });
+    const taskIds = selected.map(task => task.taskId);
+    try {
+        const children = [];
+        for (const task of selected)
+            children.push(await deliveredCheckout(options.deps, held, task));
+        const sessionId = landingSessionId(held.runId);
+        const record = await freshLandingWorktree(options.deps, held, sessionId);
+        const parentTaskId = await createLandingRoot(options.deps, held, record, selected);
+        const { receipt } = await options.advance({ cwd: held.root, sessionId, parentTaskId, children });
+        const target = await git(options.deps, held.root, ["rev-parse", `${held.targetBranch}^{commit}`]);
+        const state = await options.repository.mutate(options.runId, current => ({ ...current, landing: null,
+            landings: [...(current.landings ?? []), { taskIds, receipt, target, landedAt: now() }],
+            events: [...current.events, { id: randomUUID(), at: now(), type: "integration", code: "RUN_PARTIAL_LANDED",
+                    workerId: null, taskId: null, detail: `Landed ${taskIds.join(", ")} at ${target}; receipt ${receipt}.` }].slice(-MAX_EVENTS) }));
+        return { state, taskIds, receipt };
+    }
+    catch (cause) {
+        await options.repository.mutate(options.runId, current => ({ ...current, landing: null })).catch(() => undefined);
+        throw cause;
+    }
+}

package/dist/runtime/src/run/service.js

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir } from "node:fs/promises";
+import { hostname } from "node:os";
 import { basename, join } from "node:path";
 import { sha256 } from "../fs/hash.js";
 import { AgentOpsError } from "../fs/paths.js";
@@ -10,6 +11,28 @@ import { redactSecrets } from "../security/redact.js";
 export const RUN_PHASES = ["planning", "implementing", "verifying", "reviewing", "integrating"];
 /** Writer slots are deliberately bounded; the coordinator may occupy one. */
 export const MAX_ACTIVE_WORKERS = 2;
+/**
+ * A marker from another host is treated as live: its process cannot be probed.
+ *
+ * ponytail: a reused pid on this host reads as live; clear the marker by hand if that ever bites.
+ */
+export function landingMarkerLive(marker) {
+    if (marker == null)
+        return false;
+    if (marker.hostname !== hostname())
+        return true;
+    try {
+        process.kill(marker.processId, 0);
+        return true;
+    }
+    catch (cause) {
+        return cause.code === "EPERM";
+    }
+}
+function refuseWhileLanding(state) {
+    if (landingMarkerLive(state.landing))
+        throw new AgentOpsError("RUN_LANDING_IN_PROGRESS", `Run ${state.runId} is landing delivered work; wait for run land to finish.`);
+}
 const RUN_ID = /^[a-z][a-z0-9-]{7,63}$/u;
 const ID = /^[A-Za-z0-9._:/-]{1,256}$/u;
 const SHA = /^[a-f0-9]{40,64}$/u;
@@ -127,6 +150,15 @@ export function assertRunState(value) {
         return invalid("Run phase or task progress is invalid.");
     if (state.policyBinding !== undefined && !validPolicyBinding(state.policyBinding))
         return invalid("Invalid run policy binding.");
+    if (state.landings !== undefined && (!boundedArray(state.landings, 512) || state.landings.some(l => !plain(l) ||
+        !boundedArray(l.taskIds, 512) || l.taskIds.length === 0 || l.taskIds.some(id => !ID.test(String(id))) ||
+        typeof l.receipt !== "string" || l.receipt.length === 0 || l.receipt.length > 4096 ||
+        !SHA.test(String(l.target)) || !Number.isFinite(Date.parse(String(l.landedAt))))))
+        return invalid("Invalid run landing record.");
+    if (state.landing != null && (!plain(state.landing) || !Number.isSafeInteger(state.landing.processId) ||
+        state.landing.processId < 1 || typeof state.landing.hostname !== "string" || state.landing.hostname.length > 256 ||
+        !Number.isFinite(Date.parse(String(state.landing.startedAt)))))
+        return invalid("Invalid run landing marker.");
     if (state.proofProcess != null && (!plain(state.proofProcess) || !Number.isSafeInteger(state.proofProcess.processId) ||
         state.proofProcess.processId < 1 || typeof state.proofProcess.processIdentity !== "string" ||
         state.proofProcess.processIdentity.length === 0 || state.proofProcess.processIdentity.length > 256))
@@ -442,6 +474,7 @@ export class RunService {
     }
     async resume(runId, retryApprovalIds = [], upgradeBudget = true, retryDeliveryTaskId, expectedFailureId) {
         const state = await this.#repository.mutate(runId, async (current) => {
+            refuseWhileLanding(current);
             if (retryDeliveryTaskId !== undefined && retryApprovalIds.length > 0)
                 throw new AgentOpsError("RUN_DELIVERY_RETRY_INVALID", "Delivery and approval retries require separate explicit controls.");
             const retry = retryDeliveryTaskId === undefined ? null : validateDeliveryRetry(current, retryDeliveryTaskId, Date.parse(this.#now()));
@@ -491,6 +524,7 @@ export class RunService {
         const cleanAnswer = bounded(answer.trim(), "answer", MAX_GOAL_LENGTH);
         const state = await this.#repository.mutate(runId, (current) => {
             const question = current.questions.find((item) => item.questionId === cleanQuestion);
+            refuseWhileLanding(current);
             if (current.status !== "awaiting-input" || current.disableRestart)
                 throw new AgentOpsError("RUN_NOT_AWAITING_INPUT", "Respond cannot restart a stopped or terminal run.");
             if (question === undefined)

package/dist/runtime/src/surface/discovery.js

@@ -11,8 +11,8 @@ import { globMatcher, isCovers, missingScenarios, parseSurface, SURFACE_AXES } f
 /** Cheapest first: a budget overrun stops before the long tail of diff tokens. */
 export const DISCOVERY_SOURCES = ["agent", "hunk-header", "template-fragment", "diff-token"];
 export const SURFACE_LIMITS = {
-    // ponytail: derived queries over 10 files are skipped as generic; incidental ones under that are dismissed by query.
-    agentQueryFiles: 200, derivedQueryFiles: 10, exclusionFiles: 10, dismissals: 128, dismissMinFiles: 4, budgetMs: 120_000, queryTimeoutMs: 30_000,
+    // ponytail: derived queries over 10 files outside the diff are skipped as generic; incidental ones under that are dismissed by query.
+    agentQueryFiles: 200, derivedQueryFiles: 10, exclusionFiles: 10, inclusionFiles: 10, dismissals: 128, dismissMinFiles: 4, budgetMs: 120_000, queryTimeoutMs: 30_000,
     tokenLength: 6, fragmentLength: 4, derivedQueries: 400
 };
 /** argv only: queries are task text and must never meet a shell or a regex engine. */
@@ -142,14 +142,23 @@ export async function runSurfaceGate(input) {
     const tracked = await git(input.root, ["ls-files", "-z"], Math.min(SURFACE_LIMITS.queryTimeoutMs, Math.max(1, remaining())));
     if (tracked.timedOut || remaining() <= 0)
         return notRun("SURFACE_BUDGET_EXCEEDED", "Discovery budget exhausted listing files.", []);
+    const trackedFiles = zList(tracked.stdout);
     const exclusions = surface.excluded.map(row => ({ ...row, match: globMatcher(row.glob) }));
     for (const row of exclusions) {
-        const files = zList(tracked.stdout).filter(row.match);
+        const files = trackedFiles.filter(row.match);
         const diffFiles = [...changed].filter(row.match);
         if (files.length > SURFACE_LIMITS.exclusionFiles || diffFiles.length > 0)
             return notRun("SURFACE_EXCLUSION_TOO_BROAD", diffFiles.length > 0 ? "Files in the diff cannot be excluded."
                 : `One exclusion may hide at most ${SURFACE_LIMITS.exclusionFiles} files.`, [{ glob: row.glob, files: files.length, diffFiles }]);
     }
+    // An included or UNKNOWN glob classifies every hit it matches, so it is capped like an exclusion.
+    for (const glob of [...surface.included.map(row => row.path), ...surface.unknown.flatMap(row => row.path === undefined ? [] : [row.path])]) {
+        const match = globMatcher(glob);
+        const files = trackedFiles.filter(path => match(path) && !changed.has(path)).length;
+        if (files > SURFACE_LIMITS.inclusionFiles)
+            return notRun("SURFACE_INCLUSION_TOO_BROAD", `One included or UNKNOWN glob may cover at most ${SURFACE_LIMITS.inclusionFiles} ` +
+                "files outside the diff; list narrower paths, each with its own behavior.", [{ glob, files }]);
+    }
     const head = (await git(input.root, ["rev-parse", "HEAD"], SURFACE_LIMITS.queryTimeoutMs)).stdout.toString("utf8").trim();
     const diff = (await git(input.root, ["diff", "-U0", "--no-color", "--no-ext-diff", input.base ?? "HEAD", "--"], SURFACE_LIMITS.queryTimeoutMs)).stdout.toString("utf8");
     const derived = extractDiffQueries(diff);
@@ -217,7 +226,7 @@ export async function runSurfaceGate(input) {
             return notRun("SURFACE_DISMISSAL_INVALID", "A recorded axis query cannot be dismissed; classify its hits.", [{ query }]);
         const hit = hits.find(row => row.query === query && row.source !== "agent");
         const outside = hit === undefined ? [] : hit.files.filter(path => !changed.has(path));
-        if (hit !== undefined && outside.length < SURFACE_LIMITS.dismissMinFiles && hit.files.length <= SURFACE_LIMITS.derivedQueryFiles)
+        if (hit !== undefined && outside.length < SURFACE_LIMITS.dismissMinFiles)
             return notRun("SURFACE_DISMISSAL_INVALID", `A query reaching fewer than ${SURFACE_LIMITS.dismissMinFiles} files outside the diff ` +
                 "is the likeliest sibling signal and cannot be dismissed; classify its files.", [{ query, files: outside }]);
         if (hit !== undefined)
@@ -227,8 +236,9 @@ export async function runSurfaceGate(input) {
         sources[hit.source].queries += 1;
         if (hit.source === "agent" && hit.files.length > SURFACE_LIMITS.agentQueryFiles)
             return notRun("SURFACE_QUERY_TOO_BROAD", `Query hits more than ${SURFACE_LIMITS.agentQueryFiles} files; record a more specific fixed string.`, [{ query: hit.query, files: hit.files.length }]);
-        if (hit.source !== "agent" && hit.files.length > SURFACE_LIMITS.derivedQueryFiles) {
-            skipped.push({ source: hit.source, query: hit.query, files: hit.files.length });
+        const outside = hit.files.filter(path => !changed.has(path)).length;
+        if (hit.source !== "agent" && outside > SURFACE_LIMITS.derivedQueryFiles) {
+            skipped.push({ source: hit.source, query: hit.query, files: outside });
             continue;
         }
         if (hit.source !== "agent" && dismissals.has(hit.query))
@@ -284,7 +294,8 @@ export async function runSurfaceGate(input) {
         return notRun("ESCAPE_RULE_NO_EXCLUDE", "A learned escape rule marks these places noExclude: include them or mark them UNKNOWN.", noExclude);
     for (const source of DISCOVERY_SOURCES)
         sources[source].files = metrics.get(source).hits.size;
-    const discovery = { cached, sources, skipped: skipped.slice(0, 50), postBlockExclusions, dismissed };
+    const discovery = { cached, sources, skipped: skipped
+            .sort((a, b) => a.files - b.files || (a.query < b.query ? -1 : a.query > b.query ? 1 : 0)).slice(0, 50), postBlockExclusions, dismissed };
     if (input.metrics === true)
         await logMetrics(input.logHome ?? process.env.AGENT_OPS_HOME ?? homedir(), DISCOVERY_SOURCES.map(source => ({ source,
             hits: metrics.get(source).hits.size, included: metrics.get(source).included.size, excluded: metrics.get(source).excluded.size,

package/docs/en/spec/acceptance-and-evidence.md

@@ -99,6 +99,9 @@ Every new task MUST record a surface audit of where else its change lands before
   `glob` and a reason saying why the surface is unaffected ("out of scope" is
   not a reason); `unknown` rows name a reader the repository cannot see.
   `contracts` declare `compatible` or `breaking`. A single surface is allowed.
+  An `included` or `unknown` path glob may cover at most 10 tracked files
+  outside the diff, like an exclusion; list narrower paths, each with its own
+  behavior.
 - `valueChanges` `[{producer, kind, change, consumers, indirectConsumers}]`
   list two hops whenever a value's semantics change (clear, redact, default,
   normalize, unit/format).
@@ -114,8 +117,9 @@ Every new task MUST record a surface audit of where else its change lands before
   template-literal fixed fragments (at least 4 characters, separator-bounded,
   such as `order:`, `user_`, `menu.`); compound identifiers (snake_case,
   camelCase or containing digits, so prose words are not queries) and string
-  literals from added and removed lines (at least 6 characters; skipped as too
-  generic above 10 file hits, changed files included). Every hit outside the diff and the surface lists stops review.
+  literals from added and removed lines (at least 6 characters). A derived
+  query is skipped as too generic above 10 hit files outside the diff; skipped
+  queries, fewest hits first, go to the second reviewer. Every hit outside the diff and the surface lists stops review.
 - A derived query (diff token, template fragment or hunk-header name) whose hits
   are incidental may be dismissed once in the surface's optional `dismissed`
   list (`{query, reason}`, reason at most 256 characters, "out of scope" is
@@ -132,7 +136,8 @@ Every new task MUST record a surface audit of where else its change lands before
   also refused at create), `SURFACE_UNCLASSIFIED`,
   `SURFACE_QUERY_TOO_BROAD` (one recorded query over 200 files),
   `SURFACE_EXCLUSION_TOO_BROAD` (one glob over 10 files, or any file in the
-  diff), `SURFACE_DISMISSAL_TOO_BROAD` (over 128 dismissals),
+  diff), `SURFACE_INCLUSION_TOO_BROAD` (one included or UNKNOWN glob over 10
+  files outside the diff), `SURFACE_DISMISSAL_TOO_BROAD` (over 128 dismissals),
   `SURFACE_DISMISSAL_INVALID` (a recorded or rare query), `SCENARIO_MISSING`, `SURFACE_BUDGET_EXCEEDED` (120 s total, never
   silently skipped) or `SURFACE_UNASSIGNED` (children's covers differ from the
   parent's included list; checked by every review, including advance and batch).

package/docs/en/spec/harness-adapters.md

@@ -174,7 +174,8 @@ removes only `run` and keeps `loop`.
   ends without completing (blocked, budget exhausted, stopped, failing review)
   is reported with its `run status` state and code, its last `run logs` events,
   and the exact `agent-ops run resume <id>` and `agent-ops run stop <id>`
-  commands, and is never resumed automatically or taken over by the session.
+  commands, plus `agent-ops run land <id> --yes` when it has delivered tasks,
+  and is never resumed or landed automatically or taken over by the session.
   With worktree auto mode, the Claude `PreToolUse` worktree guard allows a
   write to exactly `.agent-ops/state/run-goal.md` in the main checkout without
   creating a worktree. Confirmed init/update pre-authorizes `agent-ops run`:

package/docs/en/spec/loop-engineering.md

@@ -73,6 +73,19 @@
   Interrupted controlled proof MUST record bounded redacted exit/signal, result
   failure stage and subprocess diagnostics without treating invalid output or a
   nonzero successful envelope as proof.
+- `run land <id> [--task <task-id>]... --yes` MAY merge delivered children of a
+  paused, blocked or budget-limited run with no live worker ahead of the rest.
+  Every selected task's dependencies MUST be selected or already landed
+  (`RUN_LAND_DEPENDENCY_OPEN`). Proof runs in a fresh landing worktree from the
+  target under a generated root task (required verifiers plus a review-only
+  coherence criterion, the run root's surface), then the usual verification,
+  two-round tree review and receipt-bound finish. The run's checkouts are pinned
+  and never removed; landed tasks stay delivered, the run stays resumable and
+  records `landings[]` and `RUN_PARTIAL_LANDED`, and its final proof re-verifies
+  the whole goal on the new target. While landing, a marker refuses resume,
+  respond and another land (`RUN_LANDING_IN_PROGRESS`); a marker of a process
+  that no longer exists does not block. A failure leaves the target unchanged
+  and keeps the landing worktree until the next land removes it.
   Initial recovery after a current manual resume MAY ignore an owned Codex limit
   snapshot received before activation whose native update second strictly predates
   that resume. Automatic restarts, unknown/equal/future timestamps, clock rollback,

package/docs/en/spec/review.md

@@ -108,7 +108,9 @@ successful refutation MUST make the run FAIL.
   session. A FAIL is already terminal and is never re-checked.
 - Note: For a surfaced task the second round also hunts unlisted surfaces and
   scenarios under `surface-coverage`: it checks the five fixed scenario
-  dimensions and may run at most 3 new `git grep -F` queries per axis. Round 1
+  dimensions and may run at most 3 new `git grep -F` queries per axis, plus at
+  most 3 in total over the derived queries discovery skipped as too generic,
+  which the prompt names with their hit counts. Round 1
   replays the recorded queries and reads every listed `valueChanges` consumer;
   this is the only exception to "do not survey the repository".
 

package/docs/zh-TW/spec/acceptance-and-evidence.md

@@ -62,7 +62,8 @@ English source version: 2026-10-20. Revalidate: when the English specification c
 - `included` 列含 `id`、`path` glob 與 `behavior`；`excluded` 列含 `glob` 與說明
   該 surface 為何不受影響的理由（「out of scope」不是理由）；`unknown` 列記錄
   repository 看不到的讀取者。`contracts` 宣告 `compatible` 或 `breaking`。只有單一
-  surface 也可以。
+  surface 也可以。`included` 或 `unknown` 的 path glob 與排除一樣，至多涵蓋 diff
+  以外 10 個 tracked 檔案；請改列更窄的路徑，各自寫出 behavior。
 - 值的語意改變（clear、redact、default、normalize、unit/format）時，
   `valueChanges` `[{producer, kind, change, consumers, indirectConsumers}]` 列出兩層
   consumer。
@@ -75,8 +76,8 @@ English source version: 2026-10-20. Revalidate: when the English specification c
   不以 task 文字組 regex），由便宜的來源先跑：記錄的查詢；diff hunk header 的外層
   函式名；template literal 固定片段（至少 4 字元且以分隔符界定，例如 `order:`、
   `user_`、`menu.`）；新增與刪除行的複合識別字（snake_case、camelCase 或含數字，
-  因此一般文字單字不會成為查詢）與字串常值（至少 6 字元；命中超過 10 個檔案〈含
-  變更檔案〉視為太通用而略過）。diff 與 surface 清單之外的任何命中都會擋下 review。
+  因此一般文字單字不會成為查詢）與字串常值（至少 6 字元）。衍生查詢在 diff 以外命中
+  超過 10 個檔案時視為太通用而略過；略過的查詢依命中數由少到多交給第二輪 reviewer。diff 與 surface 清單之外的任何命中都會擋下 review。
 - 衍生查詢（diff 字詞、template 片段或 hunk header 函式名）的命中若只是巧合，可在
   surface 選用的 `dismissed` 清單中以一筆 `{query, reason}` 排除（理由至多 256
   字元，「out of scope」不是理由），不必逐檔排除。記錄的軸查詢與 escape rule 命中
@@ -88,7 +89,8 @@ English source version: 2026-10-20. Revalidate: when the English specification c
 - Review 以 NOT_RUN 回報：`SURFACE_MISSING`（沒有或無法解析的 surface；
   task 建立時也會拒絕）、`SURFACE_UNCLASSIFIED`、`SURFACE_QUERY_TOO_BROAD`（單一
   記錄查詢超過 200 個檔案）、`SURFACE_EXCLUSION_TOO_BROAD`（單一 glob 超過 10 個
-  檔案，或包含 diff 內的檔案）、`SURFACE_DISMISSAL_TOO_BROAD`（超過 128 筆排除）、
+  檔案，或包含 diff 內的檔案）、`SURFACE_INCLUSION_TOO_BROAD`（單一 included 或
+  UNKNOWN glob 涵蓋 diff 以外超過 10 個檔案）、`SURFACE_DISMISSAL_TOO_BROAD`（超過 128 筆排除）、
   `SURFACE_DISMISSAL_INVALID`（記錄的查詢或稀有查詢）、`SCENARIO_MISSING`、`SURFACE_BUDGET_EXCEEDED`
   （總計 120 秒，絕不默默略過）或 `SURFACE_UNASSIGNED`（子 task covers 與父 task
   included 不一致；每次 review 都檢查，包含 advance 與 batch）。

package/docs/zh-TW/spec/harness-adapters.md

@@ -150,8 +150,8 @@ byte-identical。Update MUST 保留此 profile，除非提供 `--auto-run on|off
   一行說明該 code，並退回 subtask flow；`RUN_REPO_UNTRUSTED` 則停止並詢問使用者。
   未完成即結束的 run（blocked、budget exhausted、stopped、review 失敗）須回報其
   `run status` state 與 code、最後的 `run logs` event，以及確切的
-  `agent-ops run resume <id>` 與 `agent-ops run stop <id>` command，且永不自動
-  resume 或由 session 接手。在 worktree auto mode 下，Claude `PreToolUse`
+  `agent-ops run resume <id>` 與 `agent-ops run stop <id>` command；有已交付 task
+  時另附 `agent-ops run land <id> --yes`，且永不自動 resume、land 或由 session 接手。在 worktree auto mode 下，Claude `PreToolUse`
   worktree guard 允許在 main checkout 寫入恰為 `.agent-ops/state/run-goal.md`
   的路徑，且不建立 worktree。確認後的 init/update 會預先授權 `agent-ops run`：
   Claude Code 為 `Bash(agent-ops run *)`，Codex 為

package/docs/zh-TW/spec/loop-engineering.md

@@ -22,6 +22,7 @@
 - 執行中的 run 僅在原始 repository trust、config、可執行 runtime 與操作範圍完全相同時，自動續期過期的有限授權。續期以 digest 綁定前一版本並保留既有評估，拒絕無效／倒退時鐘；並行 stop、denial 或 scope 變更使續期失敗。權限已變更或撤銷時須沿既有 trust/resume 流程取得真正授權；續期不授予永久 trust，也不消除 denial。明確 resume 先核對不可變 renewal lineage，再同步 policy。回答問題也沿用相同恢復檢查；兩者皆不得復活已被明確拒絕的工作。
 - `run resume <id> --retry-approval <auth-event-id>` MAY 明確重試以額度不足 wrapper 失敗的 Codex 自動審批。每筆指定失敗 MUST 保有原始 private artifact、digest、worker identity 與 policy lineage；真正或未指定的拒絕仍阻擋。多筆失敗可重複旗標。成功確認會留存並在後續 resume 重新驗證；此操作不授予命令權限，原生審批必須重跑，既有 writer 死亡、checkout、trust 與預算檢查仍適用。
 - `run resume <id> --retry-delivery <task-id>` MAY 在修復 harness 原因後，明確重新排程一個被 `RUN_FINAL_PROOF_INTERRUPTED` 阻擋的 child。MUST 核對同一筆中斷 handoff、所有 writer 與 proof 已確認停止、所屬 checkout 乾淨及目前 trust/policy；保留 run、task、goal、baselines、commits、耗用與失敗歷史，記錄已確認的 attempt，並要求新 native generation 及正常交付驗證。MUST NOT 直接標記交付、解除其他阻擋或確認命令拒絕；approval retry 是獨立操作。一般 resume 保留 no-progress 阻擋。受控 proof 中斷 MUST 記錄有界且已遮蔽的 exit/signal、失敗階段與子程序診斷；無效輸出或非零退出的成功 envelope 不得視為證據。
+- `run land <id> [--task <task-id>]... --yes` MAY 在 run 為 paused、blocked 或 budget-limited 且無存活 worker 時，先行合併已交付的 child。每個選取 task 的依賴 MUST 已選取或已落地（`RUN_LAND_DEPENDENCY_OPEN`）。證明在由 target 建立的全新 landing worktree 中進行，使用自動產生的 root task（required verifier 加上 review-only 一致性條件，surface 沿用 run root），再走一般驗證、兩輪 tree review 與綁定 receipt 的 finish。run 的 checkout 只被釘住、永不移除；已落地 task 維持 delivered，run 仍可 resume 並記錄 `landings[]` 與 `RUN_PARTIAL_LANDED`，其最終證明會在新 target 上重新驗證整個 goal。落地期間的標記會拒絕 resume、respond 與另一次 land（`RUN_LANDING_IN_PROGRESS`）；已不存在的程序留下的標記不會阻擋。失敗時 target 不變，landing worktree 保留到下次 land 移除。
 - 當次人工 resume 的初始恢復 MAY 忽略啟用前收到、且 native 更新秒數嚴格早於該次 resume 的本執行緒 Codex 額度快照。自動重啟、未知／同秒／未來時間、時鐘倒退，以及啟用開始後收到的所有額度事件仍有效。Native 啟用 MUST 確認 goal 為 active，才能啟動或轉向 turn。人工 resume 可解除衍生的 `RUN_POLICY_DISABLED` task 阻擋，但保留 ID、耗用、歷史及其他產品失敗。
 - 收斂判斷比較實際 per-check 狀態及未解除的 finding pins；source fingerprint、時間或診斷文字本身不能算進展。
 

package/docs/zh-TW/spec/review.md

@@ -98,7 +98,7 @@ PASS MUST 交給第二個規劃的 target 嘗試反駁，且反駁成立時 MUST
 - Positive: `codex 判 PASS，claude 找到 blocking 缺陷，整體判定 FAIL。`
 - Negative: `為了讓複查看起來有效而編造反駁。`
 - Note: 只有一個設定 target 時，會在全新 session 再呼叫同一 target。FAIL 已是終局，不再複查。
-- Note: 有 surface 的 task，第二輪也會在 `surface-coverage` 下搜尋未列出的 surface 與情境：檢查五個固定情境維度，每個軸向最多可新增 3 個 `git grep -F` 查詢。第一輪重放記錄的查詢並閱讀每個列出的 `valueChanges` consumer；這是「不要普查 repository」唯一的例外。
+- Note: 有 surface 的 task，第二輪也會在 `surface-coverage` 下搜尋未列出的 surface 與情境：檢查五個固定情境維度，每個軸向最多可新增 3 個 `git grep -F` 查詢，另外可針對 discovery 因太通用而略過的衍生查詢（prompt 會列出它們與命中數）總計最多再跑 3 個。第一輪重放記錄的查詢並閱讀每個列出的 `valueChanges` consumer；這是「不要普查 repository」唯一的例外。
 
 ## REVIEW-ORIGIN-001
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kylecheng3146/agent-ops",
-  "version": "0.11.3",
+  "version": "0.11.5",
   "description": "Evidence-driven development loops for agy, Codex, Claude Code, and opencode",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",