elanous 0.2.20 → 0.2.22

package/src/steward/triage.ts

@@ -57,6 +57,8 @@ export interface StewardDeps {
   cardStore?: StewardCardDeps['store'];
   warn?: (message: string) => void;
   ask?: StewardAsk;
+  /** Maximum time for each working-backwards wish draft in schedule (milliseconds). */
+  draftItemMs?: number;
   launchSettings?: Pick<StewardSettings, 'mode' | 'launch' | 'maxParallel' | 'podPool'>;
   launchCommand?: LaunchDeps['command'];
   spawnLaunch?: LaunchDeps['spawn'];
@@ -413,20 +415,35 @@ export async function runStewardStage(stage: 'sync' | 'triage' | 'schedule' | 'r
       const wishes = rows.filter(row => present.has(row.issue) && row.capability === 'new-capability' && row.rung !== 'hitl');
       const store = wishes.length ? deps.cardStore ?? new CardStore(root) : undefined;
       const invalid = new Set<string>();
+      const carried = new Set<string>();
       if (store) try {
         recordTriageOnCards(wishes, issues, { root, store, now: deps.now });
         for (const wish of wishes) {
-          try { await recordWorkingBackwardsOnCards([wish], issues, store, deps.ask ?? askSteward); }
-          catch (error) {
-            if (!(error instanceof InvalidWorkingBackwardsDraft)) throw error;
-            invalid.add(wish.issue);
-            debug.log('steward.stage', 'draft-invalid', { issue: wish.issue });
-          }
+          const timedOut = Symbol('draft-timeout');
+          let timer: ReturnType<typeof setTimeout> | undefined;
+          const timeout = new Promise<never>((_, reject) => {
+            timer = setTimeout(() => reject(timedOut), deps.draftItemMs ?? 120_000);
+          });
+          // The draft may finish without ever racing this promise (no ask needed) — never leave its rejection unhandled.
+          timeout.catch(() => undefined);
+          try {
+            // Bound the ask itself so a late answer cannot write to a store closed after this tick.
+            const ask: StewardAsk = (prompt, role) => Promise.race([(deps.ask ?? askSteward)(prompt, role), timeout]);
+            await recordWorkingBackwardsOnCards([wish], issues, store, ask);
+          } catch (error) {
+            if (error instanceof InvalidWorkingBackwardsDraft) {
+              invalid.add(wish.issue);
+              debug.log('steward.stage', 'draft-invalid', { issue: wish.issue });
+            } else {
+              carried.add(wish.issue);
+              debug.log('steward.schedule', 'draft-carried', { issue: wish.issue, reason: error === timedOut ? 'timeout' : 'error' });
+            }
+          } finally { if (timer) clearTimeout(timer); }
         }
       } finally { if (!deps.cardStore) store.close(); }
-      if (invalid.size) rows = rows.map(row => invalid.has(row.issue)
+      if (invalid.size || carried.size) rows = rows.map(row => invalid.has(row.issue)
         ? { ...row, rung: 'hitl' as const, disposition: 'hitl' as const, hitlReason: 'other' as const, why: 'working-backwards draft invalid' }
-        : row);
+        : carried.has(row.issue) ? { ...row, deferred: true as const, disposition: 'wait' as const } : row);
     }
     for (const row of rows) try { debug.log('steward.schedule', 'decision', {
       kind: row.disposition, target: row.issue, wouldAct: row.disposition === 'now' && liveLike(settings.mode),

package/src/storage/file-lock.ts

@@ -27,9 +27,13 @@ const STALE_MS = 30_000;
 const RETRY_BUSY_MS = 25;
 const MAX_TRIES = 240; // ~6s upper bound
 
+const SLEEP_CELL = new Int32Array(new SharedArrayBuffer(4));
+
 function busyWaitMs(ms: number): void {
+  // ⭐ A real sleep, not a CPU spin — a waiter may wait minutes (pod image ship lock, 10-08 flood).
+  try { Atomics.wait(SLEEP_CELL, 0, 0, ms); return; }
+  catch { /* Atomics.wait unavailable on this thread · fall back to the spin */ }
   const target = Date.now() + ms;
-  // Trivial busy-loop. Nothing else to do synchronously.
   while (Date.now() < target) { /* spin */ }
 }
 
@@ -37,6 +41,22 @@ export interface LockOpts {
   staleMs?: number;
   retryBusyMs?: number;
   maxTries?: number;
+  /**
+   * Sync lock only: also break the lock when the pid on its first line is a dead process
+   * (a holder killed with -9 must not wedge waiters for `staleMs`).
+   */
+  breakDeadHolder?: boolean;
+  /** Sync lock only: called once, the first time the lock is found held by someone else. */
+  onWait?: (holder: string) => void;
+}
+
+function holderIsDead(lockPath: string): boolean {
+  let pid: number;
+  try { pid = Number.parseInt(readFileSync(lockPath, 'utf8').split(/[\n:]/)[0] ?? '', 10); }
+  catch { return false; }
+  if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid) return false;
+  try { process.kill(pid, 0); return false; }
+  catch (err) { return (err as NodeJS.ErrnoException).code === 'ESRCH'; }
 }
 
 export type ReleaseLock = () => void;
@@ -45,6 +65,7 @@ export function acquireLockSync(lockPath: string, opts: LockOpts = {}): ReleaseL
   const staleMs = opts.staleMs ?? STALE_MS;
   const retryBusyMs = opts.retryBusyMs ?? RETRY_BUSY_MS;
   const maxTries = opts.maxTries ?? MAX_TRIES;
+  let waited = false;
 
   for (let attempt = 0; attempt < maxTries; attempt += 1) {
     try {
@@ -63,15 +84,23 @@ export function acquireLockSync(lockPath: string, opts: LockOpts = {}): ReleaseL
       if (code !== 'EEXIST') throw err;
       // Lock exists · check for staleness.
       try {
-        const age = Date.now() - statSync(lockPath).mtimeMs;
-        if (age > staleMs) {
-          try { unlinkSync(lockPath); } catch { /* race · retry */ }
+        const seen = statSync(lockPath);
+        const age = Date.now() - seen.mtimeMs;
+        if (age > staleMs || (opts.breakDeadHolder && holderIsDead(lockPath))) {
+          // Narrow the race: only unlink the file we judged (a fresh holder may have replaced it meanwhile).
+          try { if (statSync(lockPath).ino === seen.ino) unlinkSync(lockPath); } catch { /* race · retry */ }
           continue;
         }
       } catch {
         // Race: lock disappeared between EEXIST and stat → retry.
         continue;
       }
+      if (!waited && opts.onWait) {
+        waited = true;
+        let holder = '';
+        try { holder = readFileSync(lockPath, 'utf8').trim(); } catch { /* gone */ }
+        try { opts.onWait(holder); } catch { /* observer only */ }
+      }
       busyWaitMs(retryBusyMs);
     }
   }

package/src/task-agent/card-evidence.ts

@@ -139,6 +139,12 @@ async function defaultLoadLedger(): Promise<(runId: string) => RunLedgerEntry[]
   // 연합 목록을 못 읽으면 이 우주만 읽되, 여기서 못 찾으면 «없음»이 아니라 실패로 올린다(card-bind-failed).
   let federationFailure: unknown;
   try { dirs = [...new Set([...dirs, ...resolveFederatedRunLedgerDirectories({})])]; } catch (error) { federationFailure = new Error(`federated run-ledger lookup failed: ${error instanceof Error ? error.message : String(error)}`); }
+  // HARNESS-PARENT-ON-MSB1: 원격 부모 런의 원장 거울(`tasks show` 가 ssh 로 당긴다) — 이 우주 ⊕ 연합 «뒤»에만 붙는다.
+  try {
+    const { remoteLedgerMirrorDirs } = await import('./parent-host.js');
+    const { prodInstanceRoot } = await import('../instance/resolve.js');
+    dirs = [...new Set([...dirs, ...remoteLedgerMirrorDirs(prodInstanceRoot())])];
+  } catch { /* 거울이 없으면 종전 그대로 */ }
   return ledgerLoader(dirs, (runId, dir) => loadRunLedger(runId, dir), federationFailure);
 }
 

package/src/task-agent/completion-evidence.ts

@@ -1,10 +1,10 @@
-import { readFileSync, statSync } from 'node:fs';
+import { readFileSync, realpathSync, statSync } from 'node:fs';
 import { extname, isAbsolute, relative, resolve, sep } from 'node:path';
 import type { Database } from 'bun:sqlite';
 import type { DecisionLedger } from '../decisions/decision-ledger.js';
 import { getLastStatus } from '../domains/schedule-registry.js';
 
-export type CompletionEvidenceKind = 'research-report' | 'artifact' | 'content' | 'ops-action' | 'watch-brief' | 'decision-support';
+export type CompletionEvidenceKind = 'research-report' | 'artifact' | 'content' | 'ops-action' | 'watch-brief' | 'decision-support' | 'deliverable';
 export interface CompletionEvidenceDeps {
   ledger?: Pick<DecisionLedger, 'list'>;
   schedulesDb?: Database;
@@ -13,7 +13,7 @@ export interface CompletionEvidenceDeps {
 /** A missing record is negative evidence; a failed read is explicitly unmeasured. No store is opened or mutated here. */
 export function checkCompletionEvidence(
   kind: CompletionEvidenceKind,
-  input: { dir: string; ref: string },
+  input: { dir: string; ref: string; receipt?: boolean },
   deps: CompletionEvidenceDeps = {},
 ): { ok: boolean; ref: string; missing: string[] } {
   const missing: string[] = [];
@@ -38,6 +38,34 @@ export function checkCompletionEvidence(
   };
 
   switch (kind) {
+    case 'deliverable': {
+      const ref = input.ref.trim();
+      if (/^https?:\/\//i.test(ref)) {
+        try {
+          const url = new URL(ref);
+          if (!url.hostname || !['http:', 'https:'].includes(url.protocol)) add('산출물 링크');
+        } catch { add('산출물 링크'); }
+      } else if (!ref || /^[a-z][a-z\d+.-]*:/i.test(ref)) {
+        add('산출물 경로 또는 링크');
+      } else {
+        const path = pathFor(ref);
+        if (!path) add('못 쟀다: 경로');
+        else {
+          try {
+            const root = realpathSync(input.dir);
+            const actual = realpathSync(path);
+            const rel = relative(root, actual);
+            if (rel === '..' || rel.startsWith(`..${sep}`)) add('못 쟀다: 경로');
+            else {
+              const stat = statSync(actual);
+              if (!stat.isFile() || stat.size === 0) add('산출물 파일');
+            }
+          } catch (error) { add((error as NodeJS.ErrnoException).code === 'ENOENT' ? '산출물 파일' : '못 쟀다: 산출물 파일 읽기'); }
+        }
+      }
+      if (input.receipt !== true) add('수신 확인');
+      break;
+    }
     case 'research-report': {
       const path = file();
       if (!path) break;

package/src/task-agent/cover.ts

@@ -0,0 +1,61 @@
+import type { NextActionKind } from './actions.js';
+
+type CoverVerb = 'land' | 'review' | 'retry' | 'green';
+export interface CoverRow {
+  verb: CoverVerb;
+  /** null means the TASK-AGENT action source could not be fully read. */
+  byTaskAgent: number | null;
+  /** Total work by all seats; null when no independent denominator is available. */
+  total: number | null;
+  /** TASK-AGENT events observed for this verb, including non-done outcomes; null if unreadable. */
+  observedActions: number | null;
+  ratio: number | null;
+  state: 'measured' | 'no-denominator' | 'unreadable';
+  /** Non-shadow action events, including failures; null if the action source is incomplete. */
+  liveActions: number | null;
+  /** Shadow action events; null if the action source is incomplete. */
+  shadowActions: number | null;
+  /** A transition is observable only with an independent denominator and a completed TA action. */
+  stewardTransition: 'observed' | 'not-observed' | 'unmeasured';
+}
+
+/** null means the source could not be read; [] means it was read and had no matching events. */
+export interface TaskAgentCoverInput {
+  taskAgentActions: readonly { kind: NextActionKind; result: string }[] | null;
+  allLands: readonly { step: string; ok: boolean }[] | null;
+  /** A source reached the query safety limit; its aggregate is not known to be complete. */
+  truncated?: { taskAgentActions: boolean; allLands: boolean };
+}
+
+/** Only land has an independent denominator. The other three verbs have no hand-work source yet. */
+export function measureTaskAgentCover(input: TaskAgentCoverInput): CoverRow[] {
+  const verbs: CoverVerb[] = ['land', 'review', 'retry', 'green'];
+  return verbs.map((verb) => {
+    const actions = input.taskAgentActions?.filter((action) => action.kind === verb);
+    const actionsUnreadable = actions === undefined || input.truncated?.taskAgentActions === true;
+    const byTaskAgent = actionsUnreadable ? null : actions.filter((action) => action.result === 'done').length;
+    const observedActions = actionsUnreadable ? null : actions.length;
+    const liveActions = actionsUnreadable ? null : actions.filter((action) => action.result !== 'shadow').length;
+    const shadowActions = actionsUnreadable ? null : actions.filter((action) => action.result === 'shadow').length;
+    const counts = { liveActions, shadowActions };
+    if (verb !== 'land') return {
+      verb, byTaskAgent, total: null, observedActions, ratio: null,
+      state: actionsUnreadable ? 'unreadable' : 'no-denominator',
+      ...counts, stewardTransition: 'unmeasured' as const,
+    };
+    const total = input.allLands === null || input.truncated?.allLands
+      ? null : input.allLands.filter((land) => land.step === 'merge' && land.ok === true).length;
+    const state = actionsUnreadable || total === null ? 'unreadable'
+      : total === 0 ? 'no-denominator' : 'measured';
+    const ratio = state === 'measured' && byTaskAgent !== null && total !== null ? byTaskAgent / total : null;
+    return { verb, byTaskAgent, total, observedActions, ratio, state, ...counts,
+      stewardTransition: ratio === null ? 'unmeasured' : byTaskAgent !== null && byTaskAgent > 0 ? 'observed' : 'not-observed',
+    };
+  });
+}
+
+/** A single human-readable line per verb; unknown numbers are never rendered as zero. */
+export function formatTaskAgentCover(row: CoverRow): string {
+  const value = (count: number | null): string => count === null ? '-' : String(count);
+  return `${row.verb}: TA ${value(row.byTaskAgent)}/${value(row.total)} (${row.ratio === null ? '-' : `${(row.ratio * 100).toFixed(1)}%`}) · live ${value(row.liveActions)} · shadow ${value(row.shadowActions)} · steward-transition ${row.stewardTransition}`;
+}

package/src/task-agent/live-moves.ts

@@ -1,9 +1,10 @@
 /**
- * TA-JUDGE-LIVE-SAFE — 판단부의 «안전한 수» 둘만 실제로 한다(10-07 승인 · 그 밖의 수는 그림자 그대로).
+ * TA-JUDGE-LIVE-SAFE — 설정에서 명시한 review · propose-green · propose-land 만 실제로 한다.
  *
  * - `review`: 수확 가능 런의 PR 에 elanous 리뷰를 «한 번» 요청한다 — PR 머리(sha)마다 한 번(카드 `reviewRequests` 이력).
  *   요청만 한다: 결과로 착지·재발사로 잇지 않는다(실행부 `executeNextAction` 의 review→land 사슬을 타지 않는다).
  * - `propose-green`: 카드에 green «제안»(`greenProposal`)만 적는다 — 체크리스트는 손대지 않는다.
+ * - `propose-land`: 카드·현재 머리의 self review pass·non-draft 를 확인하고 기존 `pr land` 를 머리 고정으로 한 번 부른다.
  * - 설정 `taskAgent.liveMoves`(config > env `ELANOUS_TASK_AGENT_LIVE_MOVES` > 없음). 모르는 항목은 경고하고 버린다.
  * - 관측: 실행한 수마다 `debug.log('task-agent', 'live-move', {kind, card, ok, detail, live:true})`.
  */
@@ -16,7 +17,7 @@ import { getUserConfig } from '../user-config.js';
 import type { DetachedSpawn } from '../cli/tasks-cli.js';
 import { taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
 
-export const TASK_AGENT_LIVE_MOVES = ['review', 'propose-green'] as const;
+export const TASK_AGENT_LIVE_MOVES = ['review', 'propose-green', 'propose-land'] as const;
 export type TaskAgentLiveMove = typeof TASK_AGENT_LIVE_MOVES[number];
 export const TASK_AGENT_LIVE_MOVES_ENV = 'ELANOUS_TASK_AGENT_LIVE_MOVES';
 
@@ -62,12 +63,16 @@ export interface LiveMoveDeps {
   repoCandidates?: (card: TaskCard) => readonly ReviewRepoCandidate[];
   /** 리뷰 요청(떼어 띄운다) — 시험은 반드시 주입한다. */
   requestReview?: (pr: number, intent: string, cwd?: string) => Promise<void>;
+  /** Fresh PR head and draft flag for landing; separate from the unchanged review lookup. */
+  landPrHead?: (pr: number, cwd: string) => Promise<(PrHeadView & { isDraft: boolean }) | null>;
+  /** One existing pr land operation; inject in tests instead of invoking the CLI. */
+  land?: (pr: number, head: string, cwd: string) => Promise<{ status: number; stdout: string; stderr?: string }>;
   log?: (category: string, event: string, data: Record<string, unknown>) => void;
 }
 
 /** `executed` = 부작용을 실제로 냈다(리뷰를 띄웠다 · 제안을 적었다). ok 이지만 이미 한 수(같은 머리·이미 제안)면 false. */
 export interface LiveMoveResult {
-  kind: TaskAgentLiveMove; card: string | null; ok: boolean; executed: boolean; detail: string;
+  kind: TaskAgentLiveMove | 'land'; card: string | null; ok: boolean; executed: boolean; detail: string;
   /** TA-LIVE-REVIEW-POD — 작업 트리 없이 리뷰 저장소를 찾았을 때(또는 못 찾았을 때)의 근거 한 줄. */
   reviewRepo?: { resolved: boolean; source?: ReviewRepoCandidate['source']; cwd?: string; proof?: 'head-sha' | 'branch'; reason: string };
 }
@@ -183,6 +188,52 @@ export async function defaultRequestReview(pr: number, intent: string, cwd?: str
   await spawnDetachedConfirmed(opts.spawn ?? (spawn as unknown as DetachedSpawn), process.execPath, liveReviewArgs(opts.entry ?? ELANOUS_CLI_ENTRY, configDir, pr, intent), undefined, cwd);
 }
 
+export function liveLandArgs(entry: string, configDir: string, pr: number, head: string, cwd: string): string[] {
+  return [resolve(entry), '--config-dir', configDir, 'pr', 'land', '--cwd', cwd, '--pr', String(pr), '--expected-head', head];
+}
+
+/** The CLI owns the freeze, gate and merge checks; no direct gh merge or bypass flags. */
+export async function defaultLand(pr: number, head: string, cwd: string): Promise<{ status: number; stdout: string; stderr?: string }> {
+  const { ELANOUS_CLI_ENTRY } = await import('../cli/tasks-cli.js');
+  const { getElanousConfigDirOverride } = await import('../elanous-config-dir.js');
+  const { effectiveInstanceRoot } = await import('../instance/resolve.js');
+  const args = liveLandArgs(ELANOUS_CLI_ENTRY, getElanousConfigDirOverride() ?? effectiveInstanceRoot(), pr, head, cwd);
+  return new Promise((resolveResult, reject) => {
+    const child = spawn(process.execPath, args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (chunk: Buffer) => { stdout = (stdout + chunk.toString()).slice(-300); });
+    child.stderr.on('data', (chunk: Buffer) => { stderr = (stderr + chunk.toString()).slice(-300); });
+    child.once('error', reject);
+    child.once('close', (code) => {
+      if (code !== 0) { resolveResult({ status: code ?? 1, stdout, stderr }); return; }
+      void defaultLandPrHead(pr, cwd).then((view) => {
+        resolveResult(view?.state === 'MERGED'
+          ? { status: 0, stdout, stderr }
+          : { status: 1, stdout, stderr: (stderr || stdout || 'landing completed without confirmed merge').slice(-300) });
+      }).catch((error) => resolveResult({ status: 1, stdout, stderr: String(error).slice(-300) }));
+    });
+  });
+}
+
+export async function defaultLandPrHead(pr: number, cwd: string): Promise<(PrHeadView & { isDraft: boolean }) | null> {
+  const view = (env: NodeJS.ProcessEnv) => runGh(['pr', 'view', String(pr), '--json', 'headRefOid,headRefName,state,url,isDraft'], { env, cwd });
+  let out = view(process.env);
+  if (out.status !== 0) {
+    const noProxy = { ...process.env };
+    for (const key of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy']) delete noProxy[key];
+    out = view(noProxy);
+  }
+  if (out.status !== 0) return null;
+  try {
+    const value = JSON.parse(out.stdout) as { headRefOid?: unknown; headRefName?: unknown; state?: unknown; url?: unknown; isDraft?: unknown };
+    if (typeof value.headRefOid !== 'string' || !/^[a-f0-9]{40}$/i.test(value.headRefOid) || typeof value.state !== 'string' || typeof value.isDraft !== 'boolean') return null;
+    return { head: value.headRefOid, state: value.state, isDraft: value.isDraft,
+      ...(typeof value.headRefName === 'string' ? { branch: value.headRefName } : {}),
+      ...(typeof value.url === 'string' ? { url: value.url } : {}) };
+  } catch { return null; }
+}
+
 export function liveReviewIntent(card: TaskCard, runId: string | null, stopReason: string): string {
   const goal = card.text.split('\n')[0]!.trim().slice(0, 300);
   return [
@@ -255,6 +306,78 @@ export async function executeLiveReview(
   return observe(deps, withRepo({ kind, executed: true, card: card.id, ok: true, detail: `review requested for #${pr} head ${head.head.slice(0, 12)}` }));
 }
 
+const landedCycles = new Set<string>();
+
+/** `propose-land` — only a passing self review of this exact OPEN, non-draft head may invoke pr land. */
+export async function executeLiveLand(
+  card: TaskCard | undefined, pr: number | undefined,
+  ctx: { runId?: string | null; cycleId?: string; cwd?: string; produced?: { headCommit?: string; branch?: string; prUrl?: string }; review?: { verdict: 'pass' | 'fail'; head: string } },
+  deps: LiveMoveDeps = {},
+): Promise<LiveMoveResult> {
+  const kind = 'land' as const;
+  const reject = (cardId: string | null, detail: string, reviewRepo?: LiveMoveResult['reviewRepo']) =>
+    observe(deps, { kind, card: cardId, ok: false, executed: false, detail, ...(reviewRepo ? { reviewRepo } : {}) });
+  if (!card) return reject(null, 'no task card — stays shadow');
+  if (!pr || !Number.isSafeInteger(pr) || pr < 1) return reject(card.id, 'no PR — stays shadow');
+  let cwd = ctx.cwd;
+  let reviewRepo: LiveMoveResult['reviewRepo'];
+  if (!cwd) {
+    const found = await resolveReviewRepo(card, pr, ctx.produced, deps);
+    if (!found.resolved) return reject(card.id, `PR #${pr} worktree unknown — stays shadow`, { resolved: false, reason: found.reason });
+    cwd = found.cwd;
+    reviewRepo = { resolved: true, source: found.source, cwd, proof: found.proof, reason: found.reason };
+  }
+  const withRepo = (result: LiveMoveResult): LiveMoveResult => reviewRepo ? { ...result, reviewRepo } : result;
+  let view: (PrHeadView & { isDraft: boolean }) | null;
+  try { view = await (deps.landPrHead ?? defaultLandPrHead)(pr, cwd); } catch { view = null; }
+  if (!view || !/^[0-9a-f]{40}$/i.test(view.head)) return reject(card.id, `PR #${pr} head unknown`, reviewRepo);
+  if (view.state !== 'OPEN') return reject(card.id, `PR #${pr} is ${view.state}`, reviewRepo);
+  if (view.isDraft !== false) return reject(card.id, `PR #${pr} is draft or draft status unknown`, reviewRepo);
+  if (ctx.produced?.prUrl && (!view.url || view.url.trim().replace(/\/+$/, '').toLowerCase() !== ctx.produced.prUrl.trim().replace(/\/+$/, '').toLowerCase())) {
+    return reject(card.id, `PR #${pr} URL mismatches run evidence`, reviewRepo);
+  }
+  if (ctx.review?.verdict !== 'pass') return reject(card.id, `PR #${pr} self review pass missing`, reviewRepo);
+  if (!/^[0-9a-f]{40}$/i.test(ctx.review.head) || ctx.review.head.toLowerCase() !== view.head.toLowerCase()) {
+    return reject(card.id, `PR #${pr} review head mismatch: ${ctx.review.head.slice(0, 12)} ≠ ${view.head.slice(0, 12)}`, reviewRepo);
+  }
+  const cycle = ctx.cycleId ?? ctx.runId;
+  if (cycle && landedCycles.has(cycle)) return reject(card.id, `cycle ${cycle} already landed — stays shadow`, reviewRepo);
+  const path = deps.statePath ?? taskAgentStatePath();
+  const at = (deps.now ?? (() => new Date()))().toISOString();
+  let claimed = false;
+  let missing = false;
+  try {
+    updateTaskCard(path, card.id, (current) => {
+      if (!current) { missing = true; return undefined; }
+      if ((current.landAttempts ?? []).some(entry => entry.pr === pr && entry.head.toLowerCase() === view!.head.toLowerCase())) return undefined;
+      claimed = true;
+      return { ...current, landAttempts: [...(current.landAttempts ?? []), { pr, head: view!.head, at }] };
+    });
+  } catch (error) {
+    return reject(card.id, `land attempt could not be recorded: ${String(error).slice(-250)}`, reviewRepo);
+  }
+  if (missing) return reject(card.id, 'task card not in state file', reviewRepo);
+  if (!claimed) return observe(deps, withRepo({ kind, card: card.id, ok: true, executed: false, detail: `already attempted land for #${pr} head ${view.head.slice(0, 12)}` }));
+  if (cycle) landedCycles.add(cycle);
+  let ok = false;
+  let detail: string;
+  try {
+    // The CLI rechecks the pinned PR/head immediately before merge, after its own gates and freeze admission.
+    const outcome = await (deps.land ?? defaultLand)(pr, view.head, cwd);
+    ok = outcome.status === 0;
+    detail = (ok ? outcome.stdout || `land merged #${pr} head ${view.head.slice(0, 12)}` : outcome.stderr || outcome.stdout || `exit ${outcome.status}`).slice(-300);
+  } catch (error) { detail = (error instanceof Error ? error.message : String(error)).slice(-300); }
+  try {
+    updateTaskCard(path, card.id, (current) => current?.landAttempts?.some(entry => entry.pr === pr && entry.head === view!.head && entry.at === at)
+      ? { ...current, landAttempts: current.landAttempts.map(entry => entry.pr === pr && entry.head === view!.head && entry.at === at ? { ...entry, ok, detail } : entry) }
+      : undefined);
+  } catch (error) {
+    return observe(deps, withRepo({ kind, card: card.id, ok: false, executed: true,
+      detail: `land ${ok ? 'succeeded' : 'failed'} but card update failed: ${String(error).slice(-230)}` }));
+  }
+  return observe(deps, withRepo({ kind, card: card.id, ok, executed: true, detail }));
+}
+
 /** `propose-green` — 비지 않은 근거가 있을 때만 카드에 제안을 적는다(한 번). 체크리스트는 쓰지 않는다. */
 export function executeLiveGreenProposal(card: TaskCard | undefined, evidence: Record<string, string>, deps: LiveMoveDeps = {}): LiveMoveResult {
   const kind = 'propose-green' as const;