elanous 0.2.21 → 0.2.22

package/src/storage/file-lock.ts

@@ -27,9 +27,13 @@ const STALE_MS = 30_000;
 const RETRY_BUSY_MS = 25;
 const MAX_TRIES = 240; // ~6s upper bound
 
+const SLEEP_CELL = new Int32Array(new SharedArrayBuffer(4));
+
 function busyWaitMs(ms: number): void {
+  // ⭐ A real sleep, not a CPU spin — a waiter may wait minutes (pod image ship lock, 10-08 flood).
+  try { Atomics.wait(SLEEP_CELL, 0, 0, ms); return; }
+  catch { /* Atomics.wait unavailable on this thread · fall back to the spin */ }
   const target = Date.now() + ms;
-  // Trivial busy-loop. Nothing else to do synchronously.
   while (Date.now() < target) { /* spin */ }
 }
 
@@ -37,6 +41,22 @@ export interface LockOpts {
   staleMs?: number;
   retryBusyMs?: number;
   maxTries?: number;
+  /**
+   * Sync lock only: also break the lock when the pid on its first line is a dead process
+   * (a holder killed with -9 must not wedge waiters for `staleMs`).
+   */
+  breakDeadHolder?: boolean;
+  /** Sync lock only: called once, the first time the lock is found held by someone else. */
+  onWait?: (holder: string) => void;
+}
+
+function holderIsDead(lockPath: string): boolean {
+  let pid: number;
+  try { pid = Number.parseInt(readFileSync(lockPath, 'utf8').split(/[\n:]/)[0] ?? '', 10); }
+  catch { return false; }
+  if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid) return false;
+  try { process.kill(pid, 0); return false; }
+  catch (err) { return (err as NodeJS.ErrnoException).code === 'ESRCH'; }
 }
 
 export type ReleaseLock = () => void;
@@ -45,6 +65,7 @@ export function acquireLockSync(lockPath: string, opts: LockOpts = {}): ReleaseL
   const staleMs = opts.staleMs ?? STALE_MS;
   const retryBusyMs = opts.retryBusyMs ?? RETRY_BUSY_MS;
   const maxTries = opts.maxTries ?? MAX_TRIES;
+  let waited = false;
 
   for (let attempt = 0; attempt < maxTries; attempt += 1) {
     try {
@@ -63,15 +84,23 @@ export function acquireLockSync(lockPath: string, opts: LockOpts = {}): ReleaseL
       if (code !== 'EEXIST') throw err;
       // Lock exists · check for staleness.
       try {
-        const age = Date.now() - statSync(lockPath).mtimeMs;
-        if (age > staleMs) {
-          try { unlinkSync(lockPath); } catch { /* race · retry */ }
+        const seen = statSync(lockPath);
+        const age = Date.now() - seen.mtimeMs;
+        if (age > staleMs || (opts.breakDeadHolder && holderIsDead(lockPath))) {
+          // Narrow the race: only unlink the file we judged (a fresh holder may have replaced it meanwhile).
+          try { if (statSync(lockPath).ino === seen.ino) unlinkSync(lockPath); } catch { /* race · retry */ }
           continue;
         }
       } catch {
         // Race: lock disappeared between EEXIST and stat → retry.
         continue;
       }
+      if (!waited && opts.onWait) {
+        waited = true;
+        let holder = '';
+        try { holder = readFileSync(lockPath, 'utf8').trim(); } catch { /* gone */ }
+        try { opts.onWait(holder); } catch { /* observer only */ }
+      }
       busyWaitMs(retryBusyMs);
     }
   }

package/src/task-agent/completion-evidence.ts

@@ -1,10 +1,10 @@
-import { readFileSync, statSync } from 'node:fs';
+import { readFileSync, realpathSync, statSync } from 'node:fs';
 import { extname, isAbsolute, relative, resolve, sep } from 'node:path';
 import type { Database } from 'bun:sqlite';
 import type { DecisionLedger } from '../decisions/decision-ledger.js';
 import { getLastStatus } from '../domains/schedule-registry.js';
 
-export type CompletionEvidenceKind = 'research-report' | 'artifact' | 'content' | 'ops-action' | 'watch-brief' | 'decision-support';
+export type CompletionEvidenceKind = 'research-report' | 'artifact' | 'content' | 'ops-action' | 'watch-brief' | 'decision-support' | 'deliverable';
 export interface CompletionEvidenceDeps {
   ledger?: Pick<DecisionLedger, 'list'>;
   schedulesDb?: Database;
@@ -13,7 +13,7 @@ export interface CompletionEvidenceDeps {
 /** A missing record is negative evidence; a failed read is explicitly unmeasured. No store is opened or mutated here. */
 export function checkCompletionEvidence(
   kind: CompletionEvidenceKind,
-  input: { dir: string; ref: string },
+  input: { dir: string; ref: string; receipt?: boolean },
   deps: CompletionEvidenceDeps = {},
 ): { ok: boolean; ref: string; missing: string[] } {
   const missing: string[] = [];
@@ -38,6 +38,34 @@ export function checkCompletionEvidence(
   };
 
   switch (kind) {
+    case 'deliverable': {
+      const ref = input.ref.trim();
+      if (/^https?:\/\//i.test(ref)) {
+        try {
+          const url = new URL(ref);
+          if (!url.hostname || !['http:', 'https:'].includes(url.protocol)) add('산출물 링크');
+        } catch { add('산출물 링크'); }
+      } else if (!ref || /^[a-z][a-z\d+.-]*:/i.test(ref)) {
+        add('산출물 경로 또는 링크');
+      } else {
+        const path = pathFor(ref);
+        if (!path) add('못 쟀다: 경로');
+        else {
+          try {
+            const root = realpathSync(input.dir);
+            const actual = realpathSync(path);
+            const rel = relative(root, actual);
+            if (rel === '..' || rel.startsWith(`..${sep}`)) add('못 쟀다: 경로');
+            else {
+              const stat = statSync(actual);
+              if (!stat.isFile() || stat.size === 0) add('산출물 파일');
+            }
+          } catch (error) { add((error as NodeJS.ErrnoException).code === 'ENOENT' ? '산출물 파일' : '못 쟀다: 산출물 파일 읽기'); }
+        }
+      }
+      if (input.receipt !== true) add('수신 확인');
+      break;
+    }
     case 'research-report': {
       const path = file();
       if (!path) break;

package/src/task-agent/cover.ts

@@ -0,0 +1,61 @@
+import type { NextActionKind } from './actions.js';
+
+type CoverVerb = 'land' | 'review' | 'retry' | 'green';
+export interface CoverRow {
+  verb: CoverVerb;
+  /** null means the TASK-AGENT action source could not be fully read. */
+  byTaskAgent: number | null;
+  /** Total work by all seats; null when no independent denominator is available. */
+  total: number | null;
+  /** TASK-AGENT events observed for this verb, including non-done outcomes; null if unreadable. */
+  observedActions: number | null;
+  ratio: number | null;
+  state: 'measured' | 'no-denominator' | 'unreadable';
+  /** Non-shadow action events, including failures; null if the action source is incomplete. */
+  liveActions: number | null;
+  /** Shadow action events; null if the action source is incomplete. */
+  shadowActions: number | null;
+  /** A transition is observable only with an independent denominator and a completed TA action. */
+  stewardTransition: 'observed' | 'not-observed' | 'unmeasured';
+}
+
+/** null means the source could not be read; [] means it was read and had no matching events. */
+export interface TaskAgentCoverInput {
+  taskAgentActions: readonly { kind: NextActionKind; result: string }[] | null;
+  allLands: readonly { step: string; ok: boolean }[] | null;
+  /** A source reached the query safety limit; its aggregate is not known to be complete. */
+  truncated?: { taskAgentActions: boolean; allLands: boolean };
+}
+
+/** Only land has an independent denominator. The other three verbs have no hand-work source yet. */
+export function measureTaskAgentCover(input: TaskAgentCoverInput): CoverRow[] {
+  const verbs: CoverVerb[] = ['land', 'review', 'retry', 'green'];
+  return verbs.map((verb) => {
+    const actions = input.taskAgentActions?.filter((action) => action.kind === verb);
+    const actionsUnreadable = actions === undefined || input.truncated?.taskAgentActions === true;
+    const byTaskAgent = actionsUnreadable ? null : actions.filter((action) => action.result === 'done').length;
+    const observedActions = actionsUnreadable ? null : actions.length;
+    const liveActions = actionsUnreadable ? null : actions.filter((action) => action.result !== 'shadow').length;
+    const shadowActions = actionsUnreadable ? null : actions.filter((action) => action.result === 'shadow').length;
+    const counts = { liveActions, shadowActions };
+    if (verb !== 'land') return {
+      verb, byTaskAgent, total: null, observedActions, ratio: null,
+      state: actionsUnreadable ? 'unreadable' : 'no-denominator',
+      ...counts, stewardTransition: 'unmeasured' as const,
+    };
+    const total = input.allLands === null || input.truncated?.allLands
+      ? null : input.allLands.filter((land) => land.step === 'merge' && land.ok === true).length;
+    const state = actionsUnreadable || total === null ? 'unreadable'
+      : total === 0 ? 'no-denominator' : 'measured';
+    const ratio = state === 'measured' && byTaskAgent !== null && total !== null ? byTaskAgent / total : null;
+    return { verb, byTaskAgent, total, observedActions, ratio, state, ...counts,
+      stewardTransition: ratio === null ? 'unmeasured' : byTaskAgent !== null && byTaskAgent > 0 ? 'observed' : 'not-observed',
+    };
+  });
+}
+
+/** A single human-readable line per verb; unknown numbers are never rendered as zero. */
+export function formatTaskAgentCover(row: CoverRow): string {
+  const value = (count: number | null): string => count === null ? '-' : String(count);
+  return `${row.verb}: TA ${value(row.byTaskAgent)}/${value(row.total)} (${row.ratio === null ? '-' : `${(row.ratio * 100).toFixed(1)}%`}) · live ${value(row.liveActions)} · shadow ${value(row.shadowActions)} · steward-transition ${row.stewardTransition}`;
+}

package/src/task-agent/live-moves.ts

@@ -1,9 +1,10 @@
 /**
- * TA-JUDGE-LIVE-SAFE — 판단부의 «안전한 수» 둘만 실제로 한다(10-07 승인 · 그 밖의 수는 그림자 그대로).
+ * TA-JUDGE-LIVE-SAFE — 설정에서 명시한 review · propose-green · propose-land 만 실제로 한다.
  *
  * - `review`: 수확 가능 런의 PR 에 elanous 리뷰를 «한 번» 요청한다 — PR 머리(sha)마다 한 번(카드 `reviewRequests` 이력).
  *   요청만 한다: 결과로 착지·재발사로 잇지 않는다(실행부 `executeNextAction` 의 review→land 사슬을 타지 않는다).
  * - `propose-green`: 카드에 green «제안»(`greenProposal`)만 적는다 — 체크리스트는 손대지 않는다.
+ * - `propose-land`: 카드·현재 머리의 self review pass·non-draft 를 확인하고 기존 `pr land` 를 머리 고정으로 한 번 부른다.
  * - 설정 `taskAgent.liveMoves`(config > env `ELANOUS_TASK_AGENT_LIVE_MOVES` > 없음). 모르는 항목은 경고하고 버린다.
  * - 관측: 실행한 수마다 `debug.log('task-agent', 'live-move', {kind, card, ok, detail, live:true})`.
  */
@@ -16,7 +17,7 @@ import { getUserConfig } from '../user-config.js';
 import type { DetachedSpawn } from '../cli/tasks-cli.js';
 import { taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
 
-export const TASK_AGENT_LIVE_MOVES = ['review', 'propose-green'] as const;
+export const TASK_AGENT_LIVE_MOVES = ['review', 'propose-green', 'propose-land'] as const;
 export type TaskAgentLiveMove = typeof TASK_AGENT_LIVE_MOVES[number];
 export const TASK_AGENT_LIVE_MOVES_ENV = 'ELANOUS_TASK_AGENT_LIVE_MOVES';
 
@@ -62,12 +63,16 @@ export interface LiveMoveDeps {
   repoCandidates?: (card: TaskCard) => readonly ReviewRepoCandidate[];
   /** 리뷰 요청(떼어 띄운다) — 시험은 반드시 주입한다. */
   requestReview?: (pr: number, intent: string, cwd?: string) => Promise<void>;
+  /** Fresh PR head and draft flag for landing; separate from the unchanged review lookup. */
+  landPrHead?: (pr: number, cwd: string) => Promise<(PrHeadView & { isDraft: boolean }) | null>;
+  /** One existing pr land operation; inject in tests instead of invoking the CLI. */
+  land?: (pr: number, head: string, cwd: string) => Promise<{ status: number; stdout: string; stderr?: string }>;
   log?: (category: string, event: string, data: Record<string, unknown>) => void;
 }
 
 /** `executed` = 부작용을 실제로 냈다(리뷰를 띄웠다 · 제안을 적었다). ok 이지만 이미 한 수(같은 머리·이미 제안)면 false. */
 export interface LiveMoveResult {
-  kind: TaskAgentLiveMove; card: string | null; ok: boolean; executed: boolean; detail: string;
+  kind: TaskAgentLiveMove | 'land'; card: string | null; ok: boolean; executed: boolean; detail: string;
   /** TA-LIVE-REVIEW-POD — 작업 트리 없이 리뷰 저장소를 찾았을 때(또는 못 찾았을 때)의 근거 한 줄. */
   reviewRepo?: { resolved: boolean; source?: ReviewRepoCandidate['source']; cwd?: string; proof?: 'head-sha' | 'branch'; reason: string };
 }
@@ -183,6 +188,52 @@ export async function defaultRequestReview(pr: number, intent: string, cwd?: str
   await spawnDetachedConfirmed(opts.spawn ?? (spawn as unknown as DetachedSpawn), process.execPath, liveReviewArgs(opts.entry ?? ELANOUS_CLI_ENTRY, configDir, pr, intent), undefined, cwd);
 }
 
+export function liveLandArgs(entry: string, configDir: string, pr: number, head: string, cwd: string): string[] {
+  return [resolve(entry), '--config-dir', configDir, 'pr', 'land', '--cwd', cwd, '--pr', String(pr), '--expected-head', head];
+}
+
+/** The CLI owns the freeze, gate and merge checks; no direct gh merge or bypass flags. */
+export async function defaultLand(pr: number, head: string, cwd: string): Promise<{ status: number; stdout: string; stderr?: string }> {
+  const { ELANOUS_CLI_ENTRY } = await import('../cli/tasks-cli.js');
+  const { getElanousConfigDirOverride } = await import('../elanous-config-dir.js');
+  const { effectiveInstanceRoot } = await import('../instance/resolve.js');
+  const args = liveLandArgs(ELANOUS_CLI_ENTRY, getElanousConfigDirOverride() ?? effectiveInstanceRoot(), pr, head, cwd);
+  return new Promise((resolveResult, reject) => {
+    const child = spawn(process.execPath, args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (chunk: Buffer) => { stdout = (stdout + chunk.toString()).slice(-300); });
+    child.stderr.on('data', (chunk: Buffer) => { stderr = (stderr + chunk.toString()).slice(-300); });
+    child.once('error', reject);
+    child.once('close', (code) => {
+      if (code !== 0) { resolveResult({ status: code ?? 1, stdout, stderr }); return; }
+      void defaultLandPrHead(pr, cwd).then((view) => {
+        resolveResult(view?.state === 'MERGED'
+          ? { status: 0, stdout, stderr }
+          : { status: 1, stdout, stderr: (stderr || stdout || 'landing completed without confirmed merge').slice(-300) });
+      }).catch((error) => resolveResult({ status: 1, stdout, stderr: String(error).slice(-300) }));
+    });
+  });
+}
+
+export async function defaultLandPrHead(pr: number, cwd: string): Promise<(PrHeadView & { isDraft: boolean }) | null> {
+  const view = (env: NodeJS.ProcessEnv) => runGh(['pr', 'view', String(pr), '--json', 'headRefOid,headRefName,state,url,isDraft'], { env, cwd });
+  let out = view(process.env);
+  if (out.status !== 0) {
+    const noProxy = { ...process.env };
+    for (const key of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy']) delete noProxy[key];
+    out = view(noProxy);
+  }
+  if (out.status !== 0) return null;
+  try {
+    const value = JSON.parse(out.stdout) as { headRefOid?: unknown; headRefName?: unknown; state?: unknown; url?: unknown; isDraft?: unknown };
+    if (typeof value.headRefOid !== 'string' || !/^[a-f0-9]{40}$/i.test(value.headRefOid) || typeof value.state !== 'string' || typeof value.isDraft !== 'boolean') return null;
+    return { head: value.headRefOid, state: value.state, isDraft: value.isDraft,
+      ...(typeof value.headRefName === 'string' ? { branch: value.headRefName } : {}),
+      ...(typeof value.url === 'string' ? { url: value.url } : {}) };
+  } catch { return null; }
+}
+
 export function liveReviewIntent(card: TaskCard, runId: string | null, stopReason: string): string {
   const goal = card.text.split('\n')[0]!.trim().slice(0, 300);
   return [
@@ -255,6 +306,78 @@ export async function executeLiveReview(
   return observe(deps, withRepo({ kind, executed: true, card: card.id, ok: true, detail: `review requested for #${pr} head ${head.head.slice(0, 12)}` }));
 }
 
+const landedCycles = new Set<string>();
+
+/** `propose-land` — only a passing self review of this exact OPEN, non-draft head may invoke pr land. */
+export async function executeLiveLand(
+  card: TaskCard | undefined, pr: number | undefined,
+  ctx: { runId?: string | null; cycleId?: string; cwd?: string; produced?: { headCommit?: string; branch?: string; prUrl?: string }; review?: { verdict: 'pass' | 'fail'; head: string } },
+  deps: LiveMoveDeps = {},
+): Promise<LiveMoveResult> {
+  const kind = 'land' as const;
+  const reject = (cardId: string | null, detail: string, reviewRepo?: LiveMoveResult['reviewRepo']) =>
+    observe(deps, { kind, card: cardId, ok: false, executed: false, detail, ...(reviewRepo ? { reviewRepo } : {}) });
+  if (!card) return reject(null, 'no task card — stays shadow');
+  if (!pr || !Number.isSafeInteger(pr) || pr < 1) return reject(card.id, 'no PR — stays shadow');
+  let cwd = ctx.cwd;
+  let reviewRepo: LiveMoveResult['reviewRepo'];
+  if (!cwd) {
+    const found = await resolveReviewRepo(card, pr, ctx.produced, deps);
+    if (!found.resolved) return reject(card.id, `PR #${pr} worktree unknown — stays shadow`, { resolved: false, reason: found.reason });
+    cwd = found.cwd;
+    reviewRepo = { resolved: true, source: found.source, cwd, proof: found.proof, reason: found.reason };
+  }
+  const withRepo = (result: LiveMoveResult): LiveMoveResult => reviewRepo ? { ...result, reviewRepo } : result;
+  let view: (PrHeadView & { isDraft: boolean }) | null;
+  try { view = await (deps.landPrHead ?? defaultLandPrHead)(pr, cwd); } catch { view = null; }
+  if (!view || !/^[0-9a-f]{40}$/i.test(view.head)) return reject(card.id, `PR #${pr} head unknown`, reviewRepo);
+  if (view.state !== 'OPEN') return reject(card.id, `PR #${pr} is ${view.state}`, reviewRepo);
+  if (view.isDraft !== false) return reject(card.id, `PR #${pr} is draft or draft status unknown`, reviewRepo);
+  if (ctx.produced?.prUrl && (!view.url || view.url.trim().replace(/\/+$/, '').toLowerCase() !== ctx.produced.prUrl.trim().replace(/\/+$/, '').toLowerCase())) {
+    return reject(card.id, `PR #${pr} URL mismatches run evidence`, reviewRepo);
+  }
+  if (ctx.review?.verdict !== 'pass') return reject(card.id, `PR #${pr} self review pass missing`, reviewRepo);
+  if (!/^[0-9a-f]{40}$/i.test(ctx.review.head) || ctx.review.head.toLowerCase() !== view.head.toLowerCase()) {
+    return reject(card.id, `PR #${pr} review head mismatch: ${ctx.review.head.slice(0, 12)} ≠ ${view.head.slice(0, 12)}`, reviewRepo);
+  }
+  const cycle = ctx.cycleId ?? ctx.runId;
+  if (cycle && landedCycles.has(cycle)) return reject(card.id, `cycle ${cycle} already landed — stays shadow`, reviewRepo);
+  const path = deps.statePath ?? taskAgentStatePath();
+  const at = (deps.now ?? (() => new Date()))().toISOString();
+  let claimed = false;
+  let missing = false;
+  try {
+    updateTaskCard(path, card.id, (current) => {
+      if (!current) { missing = true; return undefined; }
+      if ((current.landAttempts ?? []).some(entry => entry.pr === pr && entry.head.toLowerCase() === view!.head.toLowerCase())) return undefined;
+      claimed = true;
+      return { ...current, landAttempts: [...(current.landAttempts ?? []), { pr, head: view!.head, at }] };
+    });
+  } catch (error) {
+    return reject(card.id, `land attempt could not be recorded: ${String(error).slice(-250)}`, reviewRepo);
+  }
+  if (missing) return reject(card.id, 'task card not in state file', reviewRepo);
+  if (!claimed) return observe(deps, withRepo({ kind, card: card.id, ok: true, executed: false, detail: `already attempted land for #${pr} head ${view.head.slice(0, 12)}` }));
+  if (cycle) landedCycles.add(cycle);
+  let ok = false;
+  let detail: string;
+  try {
+    // The CLI rechecks the pinned PR/head immediately before merge, after its own gates and freeze admission.
+    const outcome = await (deps.land ?? defaultLand)(pr, view.head, cwd);
+    ok = outcome.status === 0;
+    detail = (ok ? outcome.stdout || `land merged #${pr} head ${view.head.slice(0, 12)}` : outcome.stderr || outcome.stdout || `exit ${outcome.status}`).slice(-300);
+  } catch (error) { detail = (error instanceof Error ? error.message : String(error)).slice(-300); }
+  try {
+    updateTaskCard(path, card.id, (current) => current?.landAttempts?.some(entry => entry.pr === pr && entry.head === view!.head && entry.at === at)
+      ? { ...current, landAttempts: current.landAttempts.map(entry => entry.pr === pr && entry.head === view!.head && entry.at === at ? { ...entry, ok, detail } : entry) }
+      : undefined);
+  } catch (error) {
+    return observe(deps, withRepo({ kind, card: card.id, ok: false, executed: true,
+      detail: `land ${ok ? 'succeeded' : 'failed'} but card update failed: ${String(error).slice(-230)}` }));
+  }
+  return observe(deps, withRepo({ kind, card: card.id, ok, executed: true, detail }));
+}
+
 /** `propose-green` — 비지 않은 근거가 있을 때만 카드에 제안을 적는다(한 번). 체크리스트는 쓰지 않는다. */
 export function executeLiveGreenProposal(card: TaskCard | undefined, evidence: Record<string, string>, deps: LiveMoveDeps = {}): LiveMoveResult {
   const kind = 'propose-green' as const;

package/src/task-agent/shadow.ts

@@ -16,12 +16,16 @@ import { readTaskAgentState, readTaskCard, taskAgentStatePath, type CompletionKi
 import type { SupervisorJobResult, SupervisorStopReason } from '../self-dev/run-supervisor.js';
 import { executeNextAction, type DeliveryKind, type NextAction } from './actions.js';
 import { judgeNextMove, type TaskJudgeInput, type TaskJudgement } from './judge.js';
-import { configuredTaskAgentLiveMoves, executeLiveGreenProposal, executeLiveReview, type LiveMoveDeps, type LiveMoveResult, type TaskAgentLiveMove } from './live-moves.js';
+import { configuredTaskAgentLiveMoves, executeLiveGreenProposal, executeLiveLand, executeLiveReview, type LiveMoveDeps, type LiveMoveResult, type TaskAgentLiveMove } from './live-moves.js';
 
 export interface TaskAgentShadowInput {
   runId: string | null;
   stopReason: SupervisorStopReason;
   results: readonly SupervisorJobResult[];
+  /** One judgement cycle can attempt at most one land, even across PRs. */
+  cycleId?: string;
+  /** Reviewed SHA is mandatory for land; a bare pass cannot authorize merging. */
+  selfReview?: { verdict: 'pass' | 'fail'; head: string };
 }
 
 export interface TaskAgentShadowMove {
@@ -47,7 +51,7 @@ export interface TaskAgentShadowDeps {
   readCard?: (taskId: string) => TaskCard | undefined;
   /** Explicit live invocation only; supervisor's default hook always uses shadow. */
   mode?: 'shadow' | 'live';
-  /** TA-JUDGE-LIVE-SAFE — 실제로 할 안전한 수(`review`·`propose-green`). 비면 설정 `taskAgent.liveMoves` 를 읽는다. */
+  /** TA-JUDGE-LIVE-SAFE — 실제로 할 수(`review`·`propose-green`·`propose-land`). 없으면 설정 `taskAgent.liveMoves` 를 읽는다. */
   liveMoves?: ReadonlySet<TaskAgentLiveMove>;
   /** live 수의 부작용(리뷰 띄우기·PR 머리 조회·상태 파일) — 시험은 주입한다. */
   live?: LiveMoveDeps;
@@ -161,6 +165,7 @@ export async function recordTaskAgentShadowMove(input: TaskAgentShadowInput, dep
   }
   const kind = card?.completion;
   const judgeInput = shadowJudgeInput(input.stopReason, input.results, kind);
+  if (input.selfReview) judgeInput.review = input.selfReview.verdict;
   const delivery = successful?.worktreePath && card?.project?.target && isDeliveryKind(kind)
     ? { kind, worktreePath: successful.worktreePath, projectTarget: card.project.target, files: selectDeliveryCandidates(successful.worktreePath, kind) }
     : undefined;
@@ -209,8 +214,8 @@ export async function recordTaskAgentShadowMove(input: TaskAgentShadowInput, dep
     move.reason = wouldDo ?? judgement.reason;
     move.wouldDo = null;
   }
-  const liveKind: TaskAgentLiveMove | null = move.move === 'review' || move.move === 'propose-green' ? move.move : null;
-  // 판단마다 해석한다 — 안전하지 않은 수를 판단할 때도 모르는 항목 경고가 남게(실행은 아래 두 수뿐).
+  const liveKind: TaskAgentLiveMove | null = move.move === 'review' || move.move === 'propose-green' || move.move === 'propose-land' ? move.move : null;
+  // 판단마다 해석한다 — 허용되지 않은 수를 판단할 때도 모르는 항목 경고가 남게.
   const liveMoves = deps.liveMoves ?? await configuredTaskAgentLiveMoves();
   const live = liveKind !== null && liveMoves.has(liveKind);
   // 카드 id 는 모든 판단 관측에 싣는다(그림자 일치율을 카드로 잇는다) — 읽기 전용 조회.
@@ -237,6 +242,16 @@ export async function recordTaskAgentShadowMove(input: TaskAgentShadowInput, dep
             ...(prResult.prUrl ? { prUrl: prResult.prUrl } : {}),
           } } : {}),
         }, { ...(deps.log ? { log: deps.log } : {}), ...deps.live });
+    } else if (liveKind === 'propose-land') {
+      liveMove = await executeLiveLand(boundCard, prResult?.prNumber,
+        { runId: input.runId, cycleId: input.cycleId, review: input.selfReview,
+          ...(prResult?.worktreePath ? { cwd: prResult.worktreePath } : {}),
+          ...(prResult && !prResult.worktreePath ? { produced: {
+            ...(prResult.checkedHeadCommit !== undefined ? { headCommit: prResult.checkedHeadCommit } : {}),
+            ...(prResult.branch ? { branch: prResult.branch } : {}),
+            ...(prResult.prUrl ? { prUrl: prResult.prUrl } : {}),
+          } } : {}),
+        }, { ...(deps.log ? { log: deps.log } : {}), ...deps.live });
     } else {
       const evidence: Record<string, string> = {};
       if (boundCard && !delivery && judgeInput.prState === 'MERGED' && prResult) evidence[boundCard.id] = `#${prResult.prNumber}`;

package/src/task-agent/task-hand.ts

@@ -83,6 +83,8 @@ export interface TaskCard {
   greenProposal?: { at: string; checklistId: string | null; evidence: Record<string, string> };
   /** TA-JUDGE-LIVE-SAFE — live `review` 수가 리뷰를 요청한 PR 머리들(머리마다 한 번 · 띄우기 실패면 error · 이력은 지우지 않는다). */
   reviewRequests?: Array<{ pr: number; head: string; at: string; error?: string }>;
+  /** Live land attempts, claimed before invocation, once per PR head even if the command fails. */
+  landAttempts?: Array<{ pr: number; head: string; at: string; ok?: boolean; detail?: string }>;
 }
 
 /** 런 원장에서 묶은 PR — url 은 원장(pr-opened · Pod job-finished)에 있을 때만(지어내지 않는다). */

package/src/task-orchestrator/surfaces/pod-pool.ts

@@ -16,13 +16,14 @@
  * 풀을 안 주면 종전처럼 «현재 컨텍스트» 하나다(동작 불변).
  */
 import { spawn, spawnSync } from 'node:child_process';
-import { existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, rmSync, utimesSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { debug } from '../../debug/log.js';
 import { PodLeaseAdmission, type PodLeasePredecessor, type PodLeaseRelease } from '../../pod-lease/admission.js';
 import { predecessorState, type PredecessorState } from '../../pod-lease/dependency-state.js';
-import { HostPoolLease, leaseHasPendingPod } from '../../pod-lease/host-lease.js';
+import { HostPoolLease, hostLeaseBaseDir, leaseHasPendingPod } from '../../pod-lease/host-lease.js';
+import { acquireLockSync } from '../../storage/file-lock.js';
 import { harnessCpuSlotsBesideGate, measurePoolLease, recommendConcurrency, type PodLeaseMember, type PoolDnsProbe, type PoolLeaseRecommendation } from './pod-lease.js';
 
 export interface PodPoolMember {
@@ -473,13 +474,64 @@ type LocalImageInspect = (image: string) => { status: number | null; stdout: str
 /** `docker save | ssh docker load` 한 번. 시험이 실제 전송 대신 호출 횟수만 센다. */
 type ImageShip = (member: PodPoolMember, image: string) => { status: number | null; stderr: string };
 
+const IMAGE_SHIP_TIMEOUT_MS = 1_800_000;
+const REMOTE_RUN_TIMEOUT_MS = 900_000;
+
+/**
+ * Runs a shell pipeline in its «own process group» and kills the whole group, not just bash (flood 10-08:
+ * 186 orphaned `docker save | gzip | ssh` pipes after runs timed out or died).
+ *   - `perl setpgrp` gives the pipeline a group of its own, so `kill 0` cannot reach the caller.
+ *   - The pipeline runs in the background and bash `wait`s, because bash defers a trap until a «foreground»
+ *     command finishes — a TERM from the spawnSync timeout would otherwise wait out `docker save`.
+ *   - A watchdog in the group polls the parent pid: if the caller dies (kill -9 included), the group goes too.
+ *   - On a normal finish the group is swept as well (watchdog and its `sleep`).
+ * ⚠️ The background pipeline's stdin is /dev/null (non-interactive bash) — fine for `docker save`.
+ */
+export function runProcessGroupPipeline(pipeline: string, opts: { timeoutMs: number; parentPid?: number; watchIntervalSec?: number }): { status: number | null; stderr: string; timedOut: boolean } {
+  const script = [
+    `trap 'trap "" TERM HUP INT; kill -TERM 0 2>/dev/null; exit 143' TERM HUP INT`,
+    `( while kill -0 "$ELANOUS_PIPE_PARENT" 2>/dev/null; do sleep "$ELANOUS_PIPE_WATCH"; done; kill -TERM 0 2>/dev/null ) &`,
+    `( set -o pipefail; eval "$ELANOUS_PIPE_CMD" ) &`,
+    'wait $!',
+    'rc=$?',
+    `trap "" TERM HUP INT`,
+    'kill -TERM 0 2>/dev/null',
+    'exit $rc',
+  ].join('\n');
+  const r = spawnSync('perl', ['-e', 'setpgrp(0,0) or die "setpgrp: $!"; exec @ARGV or die "exec: $!"', 'bash', '-c', script], {
+    encoding: 'utf8',
+    timeout: opts.timeoutMs,
+    killSignal: 'SIGTERM',
+    env: { ...process.env, ELANOUS_PIPE_CMD: pipeline, ELANOUS_PIPE_PARENT: String(opts.parentPid ?? process.pid), ELANOUS_PIPE_WATCH: String(opts.watchIntervalSec ?? 2) },
+  });
+  const timedOut = (r.error as NodeJS.ErrnoException | undefined)?.code === 'ETIMEDOUT';
+  return { status: r.status, stderr: (r.stderr ?? '') + (timedOut ? ` · timed out after ${opts.timeoutMs}ms (process group killed)` : r.error ? ` · ${String(r.error)}` : ''), timedOut };
+}
+
 function defaultImageShip(member: PodPoolMember, image: string): { status: number | null; stderr: string } {
-  const ship = spawnSync('bash', ['-c', `set -o pipefail; docker save ${image} | gzip -1 | ssh -o BatchMode=yes -o ConnectTimeout=10 ${member.sshHost} 'export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; gunzip | docker load'`], { encoding: 'utf8', timeout: 1_800_000 });
-  return { status: ship.status, stderr: ship.stderr ?? '' };
+  const ship = runProcessGroupPipeline(`docker save ${image} | gzip -1 | ssh -o BatchMode=yes -o ConnectTimeout=10 ${member.sshHost} 'export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; gunzip | docker load'`, { timeoutMs: IMAGE_SHIP_TIMEOUT_MS });
+  return { status: ship.status, stderr: ship.stderr };
+}
+
+/** This machine's image ID (`sha256:…` — `docker save | docker load` keeps it). Null when unreadable. */
+function defaultLocalImageId(image: string): { status: number | null; stdout: string } {
+  const r = spawnSync('docker', ['image', 'inspect', image, '--format', '{{.Id}}'], { encoding: 'utf8', timeout: 30_000 });
+  return { status: r.status, stdout: r.stdout ?? '' };
+}
+
+function imageIdFrom(r: { status: number | null; stdout: string }): string | null {
+  const v = r.status === 0 ? r.stdout.trim() : '';
+  return /^sha256:[0-9a-f]{64}$/.test(v) ? v : null;
+}
+
+/** The remote node's image ID. Null when unreadable — never read as «same». */
+export function remoteImageId(member: PodPoolMember, image: string, run: RemoteRun = defaultRemoteRun): string | null {
+  if (!member.sshHost) return null;
+  return imageIdFrom(run(member.sshHost, `docker image inspect ${image} --format '{{.Id}}'`));
 }
 
 export function defaultRemoteRun(host: string, script: string): { status: number | null; stdout: string; stderr: string } {
-  const r = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', host, `export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; unset HTTPS_PROXY https_proxy HTTP_PROXY http_proxy ALL_PROXY all_proxy; ${script}`], { encoding: 'utf8', timeout: 900_000 });
+  const r = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', host, `export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; unset HTTPS_PROXY https_proxy HTTP_PROXY http_proxy ALL_PROXY all_proxy; ${script}`], { encoding: 'utf8', timeout: REMOTE_RUN_TIMEOUT_MS });
   return { status: r.status, stdout: r.stdout ?? '', stderr: (r.stderr ?? '') + (r.error ? String(r.error) : '') };
 }
 
@@ -491,29 +543,100 @@ export function remoteImageCommit(member: PodPoolMember, image: string, run: Rem
   return v && v !== '<no value>' ? v : null;
 }
 
+/** Cross-process lock options for one image ship per host (tests shrink them). */
+export interface ImageShipLockOptions {
+  /** Directory for the per-host lock files. Default = the machine-wide pod lease dir (shared by every universe on this machine). */
+  dir?: string;
+  retryMs?: number;
+  /** A lock older than this is a crash leftover. Default = ship timeout ⊕ import timeout ⊕ 2 min. */
+  staleMs?: number;
+  maxTries?: number;
+}
+
+export function imageShipLockPath(host: string, dir: string = join(hostLeaseBaseDir(), 'image-ship')): string {
+  return join(dir, `${host.replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 120) || 'host'}.lock`);
+}
+
 /**
  * 원격 노드에 이 기계의 이미지를 보낸다(판이 다를 때만) — `docker save | ssh docker load` ⊕ `k3d image import`.
  * ⛔ Pod 의 elanous 는 이미지 판이다(피드백: Pod 는 main 이 아니라 이미지를 돈다) — 노드마다 판이 다르면 같은 골이 노드마다 다른 코드로 돈다.
+ * 🩸 10-08 flood: many runs saw the same stale label at once and all shipped together — ssh refused them
+ *   (`Session open refused by peer` · `kex_exchange_identification`). Now:
+ *   ① «same image» = commit label OR (label missing) the same image ID on both sides — never ship it twice.
+ *   ② one ship per host, under a cross-process lock; whoever gets the lock re-checks and skips if another process shipped.
+ *   ③ the ship pipeline runs in its own process group (`runProcessGroupPipeline`).
  */
-export function syncPoolImage(member: PodPoolMember, image: string, localCommit: string | null, run: RemoteRun | { run?: RemoteRun; inspect?: LocalImageInspect; transfer?: ImageShip } = defaultRemoteRun): { ok: boolean; action: 'local' | 'fresh' | 'built' | 'shipped' | 'failed'; detail: string } {
-  const opts = typeof run === 'function' ? { run } : { run: run.run ?? defaultRemoteRun, inspect: run.inspect, transfer: run.transfer };
+export function syncPoolImage(member: PodPoolMember, image: string, localCommit: string | null, run: RemoteRun | { run?: RemoteRun; inspect?: LocalImageInspect; inspectId?: LocalImageInspect; transfer?: ImageShip; lock?: ImageShipLockOptions } = defaultRemoteRun): { ok: boolean; action: 'local' | 'fresh' | 'built' | 'shipped' | 'failed'; detail: string } {
+  const opts = typeof run === 'function' ? { run } : { run: run.run ?? defaultRemoteRun, inspect: run.inspect, inspectId: run.inspectId, transfer: run.transfer, lock: run.lock };
   const remote = opts.run ?? defaultRemoteRun;
   const inspect = opts.inspect ?? defaultLocalImageInspect;
+  // An injected label inspect without an ID inspect = a hermetic caller: the ID check is off (no real docker call).
+  const inspectId = opts.inspectId ?? (opts.inspect ? null : defaultLocalImageId);
   const transfer = opts.transfer ?? defaultImageShip;
   if (!member.sshHost) return { ok: true, action: 'local', detail: 'this machine' };
+  const host = member.sshHost;
   const before = remoteImageCommit(member, image, remote);
   if (localCommit && before === localCommit) return { ok: true, action: 'fresh', detail: before.slice(0, 12) };
   // 통째 전송은 이 기계 이미지의 커밋 라벨이 목표와 같을 때만. 다르면 낡은 판을 보내지 않는다.
   const here = localImageCommit(image, inspect);
   if (localCommit && here !== localCommit) return { ok: false, action: 'failed', detail: '로컬 이미지 판이 다르다 · 보내지 않음' };
-  const ship = transfer(member, image);
-  if (ship.status !== 0) return { ok: false, action: 'failed', detail: `docker load rc=${ship.status}: ${(ship.stderr ?? '').slice(-300)}` };
-  const imp = remote(member.sshHost, `k3d image import ${image} -c ${member.k3dCluster}`);
-  if (imp.status !== 0) return { ok: false, action: 'failed', detail: `k3d import rc=${imp.status}: ${imp.stderr.slice(-300)}` };
-  const after = remoteImageCommit(member, image, remote);
-  return after && (!localCommit || after === localCommit)
-    ? { ok: true, action: 'shipped', detail: `${before?.slice(0, 12) ?? '없음'} → ${after.slice(0, 12)}` }
-    : { ok: false, action: 'failed', detail: `보낸 뒤 판이 ${after ?? '없음'} — 기대 ${localCommit ?? '?'}` };
+  const localId = inspectId ? imageIdFrom(inspectId(image)) : null;
+  /** Fresh = the commit label matches, or the very same image (ID) is already there. Null = not fresh. */
+  const freshDetail = (label: string | null): string | null => {
+    if (localCommit && label === localCommit) return label.slice(0, 12);
+    if (localId && remoteImageId(member, image, remote) === localId) return `same image id ${localId.slice(7, 19)}`;
+    return null;
+  };
+  const sameId = freshDetail(before);
+  if (sameId) {
+    debug.log('pod.pool', 'image-ship-skipped-same-id', { host, image, localCommit, remoteCommit: before, detail: sameId });
+    return { ok: true, action: 'fresh', detail: sameId };
+  }
+
+  const lockOpts = opts.lock ?? {};
+  const retryMs = lockOpts.retryMs ?? 2_000;
+  const staleMs = lockOpts.staleMs ?? IMAGE_SHIP_TIMEOUT_MS + REMOTE_RUN_TIMEOUT_MS + 120_000;
+  const lockDir = lockOpts.dir ?? join(hostLeaseBaseDir(), 'image-ship');
+  const lockPath = imageShipLockPath(host, lockDir);
+  const t0 = Date.now();
+  let waited = false;
+  let release: () => void;
+  try {
+    mkdirSync(lockDir, { recursive: true });
+    release = acquireLockSync(lockPath, {
+      staleMs,
+      retryBusyMs: retryMs,
+      maxTries: lockOpts.maxTries ?? Math.ceil(staleMs / retryMs) + 10,
+      breakDeadHolder: true,
+      onWait: (holder) => { waited = true; debug.log('pod.pool', 'image-ship-lock-wait', { host, image, lockPath, holder }); },
+    });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    debug.log('pod.pool', 'image-ship-lock-failed', { host, image, lockPath, reason }, { level: 'warn' });
+    return { ok: false, action: 'failed', detail: `image ship lock: ${reason}` };
+  }
+  try {
+    debug.log('pod.pool', 'image-ship-lock-acquired', { host, image, lockPath, waited, waitedMs: Date.now() - t0 });
+    // ⭐ Re-check after the lock: the holder we waited for may have shipped this very image.
+    const labelNow = waited ? remoteImageCommit(member, image, remote) : before;
+    const fresh = waited ? freshDetail(labelNow) : null;
+    if (fresh) {
+      debug.log('pod.pool', 'image-ship-skipped-fresh-after-wait', { host, image, localCommit, remoteCommit: labelNow, detail: fresh, waitedMs: Date.now() - t0 });
+      return { ok: true, action: 'fresh', detail: `${fresh} (shipped by another process while waiting)` };
+    }
+    const ship = transfer(member, image);
+    if (ship.status !== 0) return { ok: false, action: 'failed', detail: `docker load rc=${ship.status}: ${(ship.stderr ?? '').slice(-300)}` };
+    // The import phase gets its own stale window (the lock file's age restarts here).
+    try { const now = new Date(); utimesSync(lockPath, now, now); } catch { /* lock gone · finish anyway */ }
+    const imp = remote(host, `k3d image import ${image} -c ${member.k3dCluster}`);
+    if (imp.status !== 0) return { ok: false, action: 'failed', detail: `k3d import rc=${imp.status}: ${imp.stderr.slice(-300)}` };
+    const after = remoteImageCommit(member, image, remote);
+    return after && (!localCommit || after === localCommit)
+      ? { ok: true, action: 'shipped', detail: `${labelNow?.slice(0, 12) ?? '없음'} → ${after.slice(0, 12)}` }
+      : { ok: false, action: 'failed', detail: `보낸 뒤 판이 ${after ?? '없음'} — 기대 ${localCommit ?? '?'}` };
+  } finally {
+    release();
+  }
 }
 
 export type PoolKubectl = (args: readonly string[], input?: string) => { status: number | null; stdout: string; stderr: string };