elanous 0.2.21 → 0.2.23

package/src/task-agent/live-moves.ts

@@ -1,22 +1,27 @@
 /**
- * TA-JUDGE-LIVE-SAFE — 판단부의 «안전한 수» 둘만 실제로 한다(10-07 승인 · 그 밖의 수는 그림자 그대로).
+ * TA-JUDGE-LIVE-SAFE — 설정에서 명시한 review · propose-green · propose-land 만 실제로 한다.
  *
  * - `review`: 수확 가능 런의 PR 에 elanous 리뷰를 «한 번» 요청한다 — PR 머리(sha)마다 한 번(카드 `reviewRequests` 이력).
  *   요청만 한다: 결과로 착지·재발사로 잇지 않는다(실행부 `executeNextAction` 의 review→land 사슬을 타지 않는다).
+ *   TA-REVIEW-RESULT-CAPTURE — 자식 stdout(`--json`)은 결과 파일로 받고, 회수(`review-result-capture.ts`)는 «다음» 판단 틱이 한다 —
+ *   회수한 pass 는 그 틱의 판단부·land 관문 입력(`selfReview`)이 될 뿐 land 판정 로직은 그대로다.
  * - `propose-green`: 카드에 green «제안»(`greenProposal`)만 적는다 — 체크리스트는 손대지 않는다.
+ * - `propose-land`: 카드·현재 머리의 self review 통과(pass «또는» warn ⊕ must-fix 0 · TA-LAND-WARN-MUSTFIX0)·non-draft 를 확인하고 기존 `pr land` 를 머리 고정으로 한 번 부른다.
  * - 설정 `taskAgent.liveMoves`(config > env `ELANOUS_TASK_AGENT_LIVE_MOVES` > 없음). 모르는 항목은 경고하고 버린다.
  * - 관측: 실행한 수마다 `debug.log('task-agent', 'live-move', {kind, card, ok, detail, live:true})`.
  */
 import { spawn, spawnSync } from 'node:child_process';
-import { statSync } from 'node:fs';
-import { isAbsolute, resolve } from 'node:path';
+import { closeSync, mkdirSync, openSync, statSync } from 'node:fs';
+import { dirname, isAbsolute, resolve } from 'node:path';
 import { debug } from '../debug/log.js';
 import { findGitDir } from '../git-fs/locate.js';
 import { getUserConfig } from '../user-config.js';
 import type { DetachedSpawn } from '../cli/tasks-cli.js';
 import { taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
+import { reviewResultPath } from './review-result-capture.js';
+import { createLandWorktree, localHead, observeLandWorktree, type LandWorktree, type LandWorktreeFailure, type LandWorktreeInput, type LandWorktreeRemoval } from './land-worktree.js';
 
-export const TASK_AGENT_LIVE_MOVES = ['review', 'propose-green'] as const;
+export const TASK_AGENT_LIVE_MOVES = ['review', 'propose-green', 'propose-land'] as const;
 export type TaskAgentLiveMove = typeof TASK_AGENT_LIVE_MOVES[number];
 export const TASK_AGENT_LIVE_MOVES_ENV = 'ELANOUS_TASK_AGENT_LIVE_MOVES';
 
@@ -60,16 +65,28 @@ export interface LiveMoveDeps {
   prHead?: (pr: number, cwd?: string) => Promise<PrHeadView | null>;
   /** TA-LIVE-REVIEW-POD — 작업 트리가 없는 런(Pod)의 리뷰 저장소 후보. 기본은 카드 project.target → harness.defaultRepo → 호스트 checkout. */
   repoCandidates?: (card: TaskCard) => readonly ReviewRepoCandidate[];
-  /** 리뷰 요청(떼어 띄운다) — 시험은 반드시 주입한다. */
-  requestReview?: (pr: number, intent: string, cwd?: string) => Promise<void>;
+  /**
+   * 리뷰 요청(떼어 띄운다) — 시험은 반드시 주입한다.
+   * TA-REVIEW-RESULT-CAPTURE — `capture.resultPath` 가 오면 자식 `--json` stdout 을 그 파일로 받는다(회수 = `review-result-capture.ts`).
+   */
+  requestReview?: (pr: number, intent: string, cwd?: string, capture?: { resultPath: string }) => Promise<void>;
+  /** Fresh PR head and draft flag for landing; separate from the unchanged review lookup. */
+  landPrHead?: (pr: number, cwd: string) => Promise<(PrHeadView & { isDraft: boolean }) | null>;
+  /** One existing pr land operation; inject in tests instead of invoking the CLI. */
+  /** TA-REJUDGE-ON-HEAD — `opts.overlapEvidence` 가 있으면 `pr land --overlap-evidence <file>` 로 넘긴다(없으면 종전 인자). */
+  land?: (pr: number, head: string, cwd: string, opts?: { overlapEvidence?: string }) => Promise<{ status: number; stdout: string; stderr?: string }>;
   log?: (category: string, event: string, data: Record<string, unknown>) => void;
+  /** TA-LAND-WORKTREE — cwd HEAD 읽기 · PR 머리 임시 워크트리 만들기(시험 주입 · 기본 = git). */
+  landWorktree?: { localHead?: (cwd: string) => string | null; create?: (input: LandWorktreeInput) => Promise<LandWorktree | LandWorktreeFailure> };
 }
 
 /** `executed` = 부작용을 실제로 냈다(리뷰를 띄웠다 · 제안을 적었다). ok 이지만 이미 한 수(같은 머리·이미 제안)면 false. */
 export interface LiveMoveResult {
-  kind: TaskAgentLiveMove; card: string | null; ok: boolean; executed: boolean; detail: string;
+  kind: TaskAgentLiveMove | 'land'; card: string | null; ok: boolean; executed: boolean; detail: string;
   /** TA-LIVE-REVIEW-POD — 작업 트리 없이 리뷰 저장소를 찾았을 때(또는 못 찾았을 때)의 근거 한 줄. */
   reviewRepo?: { resolved: boolean; source?: ReviewRepoCandidate['source']; cwd?: string; proof?: 'head-sha' | 'branch'; reason: string };
+  /** TA-REVIEW-RESULT-CAPTURE — 띄운 review 의 결과 파일(자식 stdout) — 실행한 review 에만 실린다. */
+  resultPath?: string;
 }
 
 export interface PrHeadView { head: string; state: string; branch?: string; url?: string }
@@ -173,14 +190,83 @@ export function liveReviewArgs(entry: string, configDir: string, pr: number, int
 
 /**
  * 지금 도는 진입점으로 같은 우주의 리뷰를 떼어 띄운다 — 기다리지 않는다(결과는 self review 자기 관측에 남는다).
+ * TA-REVIEW-RESULT-CAPTURE — `resultPath` 가 있으면 자식 stdout(`--json` 결과)만 그 파일로 받는다(stdin·stderr 는 종전대로 버린다 ·
+ * 파이프가 아니라 파일 — 부모가 먼저 끝나도 자식이 EPIPE 로 죽지 않는다). 없으면 종전과 같다(stdio ignore).
  * `opts` 는 시험 몫(spawn·진입점·우주) — 기본은 실물.
  */
-export async function defaultRequestReview(pr: number, intent: string, cwd?: string, opts: { spawn?: DetachedSpawn; entry?: string; configDir?: string } = {}): Promise<void> {
+export async function defaultRequestReview(pr: number, intent: string, cwd?: string, opts: { spawn?: DetachedSpawn; entry?: string; configDir?: string; resultPath?: string } = {}): Promise<void> {
   const { spawnDetachedConfirmed, ELANOUS_CLI_ENTRY } = await import('../cli/tasks-cli.js');
   const { getElanousConfigDirOverride } = await import('../elanous-config-dir.js');
   const { effectiveInstanceRoot } = await import('../instance/resolve.js');
   const configDir = opts.configDir ?? getElanousConfigDirOverride() ?? effectiveInstanceRoot();
-  await spawnDetachedConfirmed(opts.spawn ?? (spawn as unknown as DetachedSpawn), process.execPath, liveReviewArgs(opts.entry ?? ELANOUS_CLI_ENTRY, configDir, pr, intent), undefined, cwd);
+  const base = opts.spawn ?? (spawn as unknown as DetachedSpawn);
+  const args = liveReviewArgs(opts.entry ?? ELANOUS_CLI_ENTRY, configDir, pr, intent);
+  if (!opts.resultPath) { await spawnDetachedConfirmed(base, process.execPath, args, undefined, cwd); return; }
+  let fd: number;
+  try {
+    mkdirSync(dirname(opts.resultPath), { recursive: true });
+    fd = openSync(opts.resultPath, 'w');
+  } catch (error) {
+    // 결과 파일을 못 열어도 리뷰는 막지 않는다(종전처럼 stdio ignore) — 회수는 상한 뒤 «no result» 줄로 드러난다.
+    try { debug.log('task-agent', 'review-result-file-open-failed', { pr, resultPath: opts.resultPath, reason: (error instanceof Error ? error.message : String(error)).slice(-300) }, { level: 'warn' }); } catch { /* fail-soft */ }
+    await spawnDetachedConfirmed(base, process.execPath, args, undefined, cwd);
+    return;
+  }
+  const toFile: DetachedSpawn = (command, spawnArgs, options) =>
+    (base as unknown as (c: string, a: string[], o: unknown) => ReturnType<DetachedSpawn>)(command, spawnArgs, { ...options, stdio: ['ignore', fd, 'ignore'] });
+  try {
+    await spawnDetachedConfirmed(toFile, process.execPath, args, undefined, cwd);
+  } finally {
+    try { closeSync(fd); } catch { /* the child keeps its own copy */ }
+  }
+}
+
+export function liveLandArgs(entry: string, configDir: string, pr: number, head: string, cwd: string, overlapEvidence?: string): string[] {
+  return [resolve(entry), '--config-dir', configDir, 'pr', 'land', '--cwd', cwd, '--pr', String(pr), '--expected-head', head,
+    // TA-REJUDGE-ON-HEAD — 겹침 관문의 비대화형 증거(#26023) · 없으면 종전 인자 그대로.
+    ...(overlapEvidence ? ['--overlap-evidence', overlapEvidence] : [])];
+}
+
+/** The CLI owns the freeze, gate and merge checks; no direct gh merge or bypass flags. */
+export async function defaultLand(pr: number, head: string, cwd: string, opts: { overlapEvidence?: string } = {}): Promise<{ status: number; stdout: string; stderr?: string }> {
+  const { ELANOUS_CLI_ENTRY } = await import('../cli/tasks-cli.js');
+  const { getElanousConfigDirOverride } = await import('../elanous-config-dir.js');
+  const { effectiveInstanceRoot } = await import('../instance/resolve.js');
+  const args = liveLandArgs(ELANOUS_CLI_ENTRY, getElanousConfigDirOverride() ?? effectiveInstanceRoot(), pr, head, cwd, opts.overlapEvidence);
+  return new Promise((resolveResult, reject) => {
+    const child = spawn(process.execPath, args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (chunk: Buffer) => { stdout = (stdout + chunk.toString()).slice(-300); });
+    child.stderr.on('data', (chunk: Buffer) => { stderr = (stderr + chunk.toString()).slice(-300); });
+    child.once('error', reject);
+    child.once('close', (code) => {
+      if (code !== 0) { resolveResult({ status: code ?? 1, stdout, stderr }); return; }
+      void defaultLandPrHead(pr, cwd).then((view) => {
+        resolveResult(view?.state === 'MERGED'
+          ? { status: 0, stdout, stderr }
+          : { status: 1, stdout, stderr: (stderr || stdout || 'landing completed without confirmed merge').slice(-300) });
+      }).catch((error) => resolveResult({ status: 1, stdout, stderr: String(error).slice(-300) }));
+    });
+  });
+}
+
+export async function defaultLandPrHead(pr: number, cwd: string): Promise<(PrHeadView & { isDraft: boolean }) | null> {
+  const view = (env: NodeJS.ProcessEnv) => runGh(['pr', 'view', String(pr), '--json', 'headRefOid,headRefName,state,url,isDraft'], { env, cwd });
+  let out = view(process.env);
+  if (out.status !== 0) {
+    const noProxy = { ...process.env };
+    for (const key of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy']) delete noProxy[key];
+    out = view(noProxy);
+  }
+  if (out.status !== 0) return null;
+  try {
+    const value = JSON.parse(out.stdout) as { headRefOid?: unknown; headRefName?: unknown; state?: unknown; url?: unknown; isDraft?: unknown };
+    if (typeof value.headRefOid !== 'string' || !/^[a-f0-9]{40}$/i.test(value.headRefOid) || typeof value.state !== 'string' || typeof value.isDraft !== 'boolean') return null;
+    return { head: value.headRefOid, state: value.state, isDraft: value.isDraft,
+      ...(typeof value.headRefName === 'string' ? { branch: value.headRefName } : {}),
+      ...(typeof value.url === 'string' ? { url: value.url } : {}) };
+  } catch { return null; }
 }
 
 export function liveReviewIntent(card: TaskCard, runId: string | null, stopReason: string): string {
@@ -233,18 +319,21 @@ export async function executeLiveReview(
   if (head.state !== 'OPEN') return observe(deps, withRepo({ kind, executed: false, card: card.id, ok: false, detail: `PR #${pr} is ${head.state}` }));
   const path = deps.statePath ?? taskAgentStatePath();
   const at = (deps.now ?? (() => new Date()))().toISOString();
+  // TA-REVIEW-RESULT-CAPTURE — 머리마다 한 번이라 경로도 머리마다 하나다. 요청 칸에 먼저 적는다(회수가 이 칸을 본다).
+  const resultPath = reviewResultPath(path, card.id, pr, head.head);
   const claim = { claimed: false, missing: false };
   updateTaskCard(path, card.id, (current) => {
     if (!current) { claim.missing = true; return undefined; }
     // 머리 «이력»으로 본다 — A→B→A 로 돌아와도 A 는 다시 요청하지 않는다.
     if ((current.reviewRequests ?? []).some((entry) => entry.pr === pr && entry.head === head!.head)) return undefined;
     claim.claimed = true;
-    return { ...current, reviewRequests: [...(current.reviewRequests ?? []), { pr, head: head!.head, at }] };
+    return { ...current, reviewRequests: [...(current.reviewRequests ?? []), { pr, head: head!.head, at, resultPath }] };
   });
   if (claim.missing) return observe(deps, withRepo({ kind, executed: false, card: card.id, ok: false, detail: 'task card not in state file' }));
   if (!claim.claimed) return observe(deps, withRepo({ kind, executed: false, card: card.id, ok: true, detail: `already requested for #${pr} head ${head.head.slice(0, 12)}` }));
   try {
-    await (deps.requestReview ?? defaultRequestReview)(pr, liveReviewIntent(card, ctx.runId, ctx.stopReason), cwd);
+    const intent = liveReviewIntent(card, ctx.runId, ctx.stopReason);
+    await (deps.requestReview ? deps.requestReview(pr, intent, cwd, { resultPath }) : defaultRequestReview(pr, intent, cwd, { resultPath }));
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     updateTaskCard(path, card.id, (current) => current?.reviewRequests?.some((entry) => entry.pr === pr && entry.head === head!.head && entry.at === at)
@@ -252,7 +341,128 @@ export async function executeLiveReview(
       : undefined);
     return observe(deps, withRepo({ kind, executed: false, card: card.id, ok: false, detail: `review request failed for #${pr} head ${head.head.slice(0, 12)}: ${reason}` }));
   }
-  return observe(deps, withRepo({ kind, executed: true, card: card.id, ok: true, detail: `review requested for #${pr} head ${head.head.slice(0, 12)}` }));
+  return observe(deps, withRepo({ kind, executed: true, card: card.id, ok: true, detail: `review requested for #${pr} head ${head.head.slice(0, 12)}`, resultPath }));
+}
+
+const landedCycles = new Set<string>();
+
+/** `propose-land` — only a passing self review (pass or warn, with must-fix 0) of this exact OPEN, non-draft head may invoke pr land. */
+export async function executeLiveLand(
+  card: TaskCard | undefined, pr: number | undefined,
+  ctx: { runId?: string | null; cycleId?: string; cwd?: string; produced?: { headCommit?: string; branch?: string; prUrl?: string }; review?: { verdict: 'pass' | 'warn' | 'fail'; head: string; /** TA-LAND-WARN-MUSTFIX0 — `false` 면 리뷰가 실제로 안 돌았다 → land 거부. 슈퍼바이저 입력은 reviewed 리뷰로만 만들어져 칸이 없다. */ reviewed?: boolean };
+    /** TA-REJUDGE-ON-HEAD — 겹침 증거 파일(있으면 land 에 넘길 뿐 · 판정은 그대로). */ overlapEvidence?: string },
+  deps: LiveMoveDeps = {},
+): Promise<LiveMoveResult> {
+  const kind = 'land' as const;
+  const reject = (cardId: string | null, detail: string, reviewRepo?: LiveMoveResult['reviewRepo']) =>
+    observe(deps, { kind, card: cardId, ok: false, executed: false, detail, ...(reviewRepo ? { reviewRepo } : {}) });
+  if (!card) return reject(null, 'no task card — stays shadow');
+  if (!pr || !Number.isSafeInteger(pr) || pr < 1) return reject(card.id, 'no PR — stays shadow');
+  let cwd = ctx.cwd;
+  let reviewRepo: LiveMoveResult['reviewRepo'];
+  if (!cwd) {
+    const found = await resolveReviewRepo(card, pr, ctx.produced, deps);
+    if (!found.resolved) return reject(card.id, `PR #${pr} worktree unknown — stays shadow`, { resolved: false, reason: found.reason });
+    cwd = found.cwd;
+    reviewRepo = { resolved: true, source: found.source, cwd, proof: found.proof, reason: found.reason };
+  }
+  const withRepo = (result: LiveMoveResult): LiveMoveResult => reviewRepo ? { ...result, reviewRepo } : result;
+  let view: (PrHeadView & { isDraft: boolean }) | null;
+  try { view = await (deps.landPrHead ?? defaultLandPrHead)(pr, cwd); } catch { view = null; }
+  if (!view || !/^[0-9a-f]{40}$/i.test(view.head)) return reject(card.id, `PR #${pr} head unknown`, reviewRepo);
+  if (view.state !== 'OPEN') return reject(card.id, `PR #${pr} is ${view.state}`, reviewRepo);
+  if (view.isDraft !== false) return reject(card.id, `PR #${pr} is draft or draft status unknown`, reviewRepo);
+  if (ctx.produced?.prUrl && (!view.url || view.url.trim().replace(/\/+$/, '').toLowerCase() !== ctx.produced.prUrl.trim().replace(/\/+$/, '').toLowerCase())) {
+    return reject(card.id, `PR #${pr} URL mismatches run evidence`, reviewRepo);
+  }
+  // TA-LAND-WARN-MUSTFIX0 — 정본 규칙(#25941 canAuto · #25962): pass «또는» warn 이 통과 후보 · must-fix 0 은 바로 아래 검사가 본다.
+  if (ctx.review?.verdict !== 'pass' && ctx.review?.verdict !== 'warn') return reject(card.id, `PR #${pr} self review pass missing`, reviewRepo);
+  if (ctx.review.reviewed === false) return reject(card.id, `PR #${pr} self review not reviewed (reviewed:false)`, reviewRepo);
+  if (!/^[0-9a-f]{40}$/i.test(ctx.review.head) || ctx.review.head.toLowerCase() !== view.head.toLowerCase()) {
+    return reject(card.id, `PR #${pr} review head mismatch: ${ctx.review.head.slice(0, 12)} ≠ ${view.head.slice(0, 12)}`, reviewRepo);
+  }
+  // TA-LAND-MUSTFIX-ZERO — «pass ⊕ must-fix» 는 land 로 가지 않는다(#25941 `canAuto` 와 같은 축) · 수를 못 읽었으면 «0» 이 아니라 «모름»(fail-closed).
+  //   (`mustFixCount` 는 `SupervisorJobResult.selfReview` 가 나른다 — 시그니처는 그대로 두고 여기서만 읽는다.)
+  const mustFixCount = (ctx.review as { mustFixCount?: unknown }).mustFixCount;
+  if (typeof mustFixCount !== 'number' || !Number.isSafeInteger(mustFixCount) || mustFixCount < 0) return reject(card.id, `PR #${pr} review-must-fix-unknown`, reviewRepo);
+  if (mustFixCount > 0) return reject(card.id, `PR #${pr} review-warn-with-must-fix: pass carries ${mustFixCount} must-fix`, reviewRepo);
+  const cycle = ctx.cycleId ?? ctx.runId;
+  if (cycle && landedCycles.has(cycle)) return reject(card.id, `cycle ${cycle} already landed — stays shadow`, reviewRepo);
+  const path = deps.statePath ?? taskAgentStatePath();
+  const at = (deps.now ?? (() => new Date()))().toISOString();
+  let claimed = false;
+  let missing = false;
+  try {
+    updateTaskCard(path, card.id, (current) => {
+      if (!current) { missing = true; return undefined; }
+      if ((current.landAttempts ?? []).some(entry => entry.pr === pr && entry.head.toLowerCase() === view!.head.toLowerCase())) return undefined;
+      claimed = true;
+      return { ...current, landAttempts: [...(current.landAttempts ?? []), { pr, head: view!.head, at }] };
+    });
+  } catch (error) {
+    return reject(card.id, `land attempt could not be recorded: ${String(error).slice(-250)}`, reviewRepo);
+  }
+  if (missing) return reject(card.id, 'task card not in state file', reviewRepo);
+  if (!claimed) return observe(deps, withRepo({ kind, card: card.id, ok: true, executed: false, detail: `already attempted land for #${pr} head ${view.head.slice(0, 12)}` }));
+  if (cycle) landedCycles.add(cycle);
+  // TA-LAND-WORKTREE — `pr land --expected-head` 는 «로컬 HEAD = 고정 머리»를 요구한다. cwd 가 다른 머리면(Pod 런 PR · 호스트 checkout)
+  //   PR 머리의 임시 워크트리에서 부르고 끝나면 걷는다. 같은 머리(로컬 런 작업 트리)거나 HEAD 를 못 읽으면 종전 그대로 cwd 에서.
+  let landCwd = cwd;
+  let worktree: LandWorktree | undefined;
+  const local = (deps.landWorktree?.localHead ?? localHead)(cwd);
+  if (local && local.toLowerCase() !== view.head.toLowerCase()) {
+    let made: LandWorktree | LandWorktreeFailure;
+    try {
+      made = await (deps.landWorktree?.create ?? createLandWorktree)({ card: card.id, pr, head: view.head, branch: view.branch, repoCwd: cwd, statePath: path });
+    } catch (error) { made = { reason: (error instanceof Error ? error.message : String(error)).slice(-250), created: null, removed: null }; }
+    if ('reason' in made) {
+      const reason = made.reason;
+      observeLandWorktree({ card: card.id, pr, head: view.head, created: made.created, removed: made.removed, reason }, deps.log);
+      // land 를 부르지 않았다 — 이 머리의 시도 기록과 주기 표시를 되돌려 다음 틱이 다시 시도할 수 있게 한다.
+      if (cycle) landedCycles.delete(cycle);
+      try {
+        updateTaskCard(path, card.id, (current) => current?.landAttempts?.some(entry => entry.pr === pr && entry.head === view!.head && entry.at === at)
+          ? { ...current, landAttempts: current.landAttempts.filter(entry => !(entry.pr === pr && entry.head === view!.head && entry.at === at)) }
+          : undefined);
+      } catch (error) {
+        // 되돌리기 실패 — 이 머리는 «시도함»으로 남아 다음 틱이 막힌다. 조용히 넘기지 않고 사유를 남긴다.
+        observeLandWorktree({ card: card.id, pr, head: view.head, created: made.created, removed: made.removed, reason: `land attempt release failed: ${String(error).slice(-200)}` }, deps.log);
+        return reject(card.id, `PR #${pr} land worktree unavailable: ${reason} · attempt release failed (head stays attempted)`, reviewRepo);
+      }
+      return reject(card.id, `PR #${pr} land worktree unavailable: ${reason}`, reviewRepo);
+    }
+    worktree = made;
+    landCwd = made.cwd;
+    observeLandWorktree({ card: card.id, pr, head: view.head, created: true, removed: false, reason: `cwd HEAD ${local.slice(0, 12)} ≠ PR head ${view.head.slice(0, 12)}` }, deps.log);
+  }
+  // 증거 경로는 «원래» cwd 기준으로 고정한다 — 임시 트리로 cwd 를 바꿔도 상대경로가 다른 파일을 가리키지 않게(같은 cwd 면 그대로).
+  const overlapEvidence = ctx.overlapEvidence && worktree ? resolve(cwd, ctx.overlapEvidence) : ctx.overlapEvidence;
+  let ok = false;
+  let detail: string;
+  try {
+    // The CLI rechecks the pinned PR/head immediately before merge, after its own gates and freeze admission.
+    const outcome = overlapEvidence
+      ? await (deps.land ?? defaultLand)(pr, view.head, landCwd, { overlapEvidence })
+      : await (deps.land ?? defaultLand)(pr, view.head, landCwd);
+    ok = outcome.status === 0;
+    detail = (ok ? outcome.stdout || `land merged #${pr} head ${view.head.slice(0, 12)}` : outcome.stderr || outcome.stdout || `exit ${outcome.status}`).slice(-300);
+  } catch (error) { detail = (error instanceof Error ? error.message : String(error)).slice(-300); }
+  if (worktree) {
+    // 성공이든 실패든 걷는다.
+    let removal: LandWorktreeRemoval;
+    try { removal = worktree.cleanup(); } catch (error) { removal = { removed: false, reason: String(error).slice(-200) }; }
+    observeLandWorktree({ card: card.id, pr, head: view.head, created: true, removed: removal.removed, ...(removal.branchRemoved !== undefined ? { branchRemoved: removal.branchRemoved } : {}),
+      reason: removal.reason ?? `land ${ok ? 'ok' : 'failed'} — removed` }, deps.log);
+  }
+  try {
+    updateTaskCard(path, card.id, (current) => current?.landAttempts?.some(entry => entry.pr === pr && entry.head === view!.head && entry.at === at)
+      ? { ...current, landAttempts: current.landAttempts.map(entry => entry.pr === pr && entry.head === view!.head && entry.at === at ? { ...entry, ok, detail } : entry) }
+      : undefined);
+  } catch (error) {
+    return observe(deps, withRepo({ kind, card: card.id, ok: false, executed: true,
+      detail: `land ${ok ? 'succeeded' : 'failed'} but card update failed: ${String(error).slice(-230)}` }));
+  }
+  return observe(deps, withRepo({ kind, card: card.id, ok, executed: true, detail }));
 }
 
 /** `propose-green` — 비지 않은 근거가 있을 때만 카드에 제안을 적는다(한 번). 체크리스트는 쓰지 않는다. */

package/src/task-agent/parent-host.ts

@@ -12,6 +12,7 @@
  * 기본 OFF — `taskAgent.parentHost` 가 없고 `ELANOUS_TA_PARENT_HOST` 도 없으면 아무것도 바뀌지 않는다.
  */
 import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { debug } from '../debug/log.js';
@@ -29,8 +30,13 @@ export interface ParentHostConfig {
   configDir?: string;
   /** 원격 부모에 줄 `--pod-pool`(원격 kube context 이름이 HQ 와 다를 때). */
   podPool?: string;
+  /** Maximum simultaneous parent approvals on this host; absent means one conservative slot. */
+  approvalCapacity?: number;
 }
 
+/** A list opts into multi-host selection; the legacy object retains its original launch behavior. */
+export type ParentHostSetting = Partial<ParentHostConfig> | readonly Partial<ParentHostConfig>[];
+
 export const PARENT_HOST_ENV = 'ELANOUS_TA_PARENT_HOST';
 const DEFAULT_REMOTE_ELANOUS = '$HOME/.local/share/elanous/bin/elanous';
 const DEFAULT_REMOTE_CONFIG_DIR = '$HOME/.elanous';
@@ -40,14 +46,94 @@ const HOST_RE = /^[A-Za-z0-9][A-Za-z0-9._@-]{0,127}$/;
  * 켜졌나 — env 가 이긴다(`off`·`0`·빈 값이면 끔). env 가 호스트를 주면 나머지 칸(cwd 등)은 설정에서 받는다.
  * cwd 가 없으면 켜지지 않는다(어디서 띄울지 모르는 원격 발사는 하지 않는다).
  */
-export function resolveParentHost(config: Partial<ParentHostConfig> | undefined, env: NodeJS.ProcessEnv = process.env): ParentHostConfig | null {
+export function resolveParentHost(config: ParentHostSetting | undefined, env: NodeJS.ProcessEnv = process.env): ParentHostConfig | null {
+  return resolveParentHosts(config, env)[0] ?? null;
+}
+
+/** Each target is validated independently; an invalid entry cannot turn a valid list into a local-only launch. */
+export function resolveParentHosts(config: ParentHostSetting | undefined, env: NodeJS.ProcessEnv = process.env): ParentHostConfig[] {
   const fromEnv = env[PARENT_HOST_ENV];
-  if (fromEnv !== undefined && ['', '0', 'off', 'false', 'local'].includes(fromEnv.trim().toLowerCase())) return null;
-  const host = (fromEnv?.trim() || config?.host || '').trim();
-  if (!host || !HOST_RE.test(host)) return null;
-  const cwd = config?.cwd?.trim();
-  if (!cwd || !cwd.startsWith('/')) return null;
-  return { host, cwd, ...(config?.elanous ? { elanous: config.elanous } : {}), ...(config?.configDir ? { configDir: config.configDir } : {}), ...(config?.podPool ? { podPool: config.podPool } : {}) };
+  if (fromEnv !== undefined && ['', '0', 'off', 'false', 'local'].includes(fromEnv.trim().toLowerCase())) return [];
+  const configured = Array.isArray(config) ? config : [config];
+  const seen = new Set<string>();
+  const targets: ParentHostConfig[] = [];
+  if (fromEnv && Array.isArray(config) && !config.some((entry) => entry.host === fromEnv.trim())) return targets;
+  for (const entry of configured) {
+    if (fromEnv && Array.isArray(config) && entry?.host !== fromEnv.trim()) continue;
+    const host = (fromEnv?.trim() || entry?.host || '').trim();
+    const cwd = entry?.cwd?.trim();
+    if (!host || !HOST_RE.test(host) || !cwd || !cwd.startsWith('/') || seen.has(host)
+      || (Array.isArray(config) && entry?.approvalCapacity !== undefined
+        && (!Number.isSafeInteger(entry.approvalCapacity) || entry.approvalCapacity < 1))) continue;
+    seen.add(host);
+    targets.push({ host, cwd, ...(entry?.elanous ? { elanous: entry.elanous } : {}), ...(entry?.configDir ? { configDir: entry.configDir } : {}), ...(entry?.podPool ? { podPool: entry.podPool } : {}), ...(entry?.approvalCapacity !== undefined ? { approvalCapacity: entry.approvalCapacity } : {}) });
+    if (fromEnv) break; // Explicit host override selects one target only.
+  }
+  return targets;
+}
+
+/** Capacity sample is read on the host before launch. Unknown or saturated capacity is not a positive weight. */
+export interface ParentHostCapacity { approvalHeadroom: number; load: number }
+const CAPACITY_MARKER = '__ELANOUS_PARENT_CAPACITY__';
+const APPROVAL_MARKER = '__ELANOUS_PARENT_APPROVALS__';
+const LOAD_MARKER = '__ELANOUS_PARENT_LOAD__';
+/** Recent admission decisions are the host's measured approval backlog, not an inferred process count. */
+export function readParentHostCapacity(target: ParentHostConfig, ssh: SshRunner = defaultSshRunner): ParentHostCapacity | null {
+  const executable = remotePath(target.elanous ?? DEFAULT_REMOTE_ELANOUS);
+  const configDir = remotePath(target.configDir ?? DEFAULT_REMOTE_CONFIG_DIR);
+  const script = `parents=$(ps -Ao command) || exit 1; printf '%s\\n' "$parents" | awk '/[e]lanous.*harness (say|ask)/ { n++ } END { print "${CAPACITY_MARKER}" n+0 }'; `
+    + `${executable} --config-dir ${configDir} logs --event admit-by-usage --since 5m --json --limit 1000 || exit 1; `
+    + `printf '\\n${APPROVAL_MARKER}\\n'; `
+    + `cpu=$(ps -Ao %cpu=) || exit 1; printf '%s\\n' "$cpu" | awk '{ total += $1 } END { printf "${LOAD_MARKER}%.3f\\n", total+0 }'; `
+    + `cores=$(getconf _NPROCESSORS_ONLN 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null) || exit 1; printf '${LOAD_MARKER}cores=%s\\n' "$cores"`;
+  try {
+    const result = ssh(target.host, script, 15_000);
+    if (result.status !== 0) return null;
+    const activeMatch = new RegExp(`^${CAPACITY_MARKER}(\\d+)$`, 'm').exec(result.stdout);
+    const boundary = result.stdout.indexOf(`\n${APPROVAL_MARKER}\n`);
+    const logsStart = result.stdout.indexOf('\n');
+    const cpuMatch = new RegExp(`^${LOAD_MARKER}([0-9]+(?:\\.[0-9]+)?)$`, 'm').exec(result.stdout);
+    const coresMatch = new RegExp(`^${LOAD_MARKER}cores=(\\d+)$`, 'm').exec(result.stdout);
+    if (!activeMatch || activeMatch.index !== 0 || logsStart < 0 || boundary < logsStart || !cpuMatch || !coresMatch) return null;
+    const active = Number(activeMatch[1]);
+    const cores = Number(coresMatch[1]);
+    const cpu = Number(cpuMatch[1]);
+    const capacity = target.approvalCapacity ?? 1;
+    if (!Number.isSafeInteger(active) || !Number.isSafeInteger(cores) || cores <= 0 || !Number.isFinite(cpu) || cpu < 0
+      || !Number.isSafeInteger(capacity) || capacity <= 0) return null;
+    const decisions = new Map<string, number>();
+    const logs = result.stdout.slice(logsStart, boundary).trim();
+    const rows = logs ? logs.split('\n').filter(Boolean) : [];
+    if (rows.length >= 1000) return null;
+    // `logs` prints newest first; apply older decisions first so the last recommendation wins.
+    for (const line of rows.reverse()) {
+      const row = JSON.parse(line) as { _meta?: unknown; category?: unknown; event?: unknown; data?: unknown };
+      if (row._meta) {
+        if (typeof row._meta === 'object' && row._meta !== null && (row._meta as { limitReached?: boolean }).limitReached) return null;
+        continue;
+      }
+      if (row.category !== 'pod-lease' || row.event !== 'admit-by-usage') return null;
+      const data = typeof row.data === 'string' ? JSON.parse(row.data) as { runId?: unknown; recommended?: unknown }
+        : row.data as { runId?: unknown; recommended?: unknown } | null;
+      if (typeof data?.runId !== 'string' || data.recommended === null) continue;
+      if (!Number.isSafeInteger(data.recommended) || (data.recommended as number) < 0) return null;
+      decisions.set(data.runId, data.recommended as number);
+    }
+    const waiting = [...decisions.values()].filter((n) => n === 0).length;
+    return { approvalHeadroom: Math.max(0, capacity - active - waiting), load: Math.max(0, cpu / (cores * 100)) };
+  } catch { return null; }
+}
+
+/** Weighted rendezvous: stable per run, no shared counter or dependence on dispatch order. */
+export function orderParentHosts(targets: readonly ParentHostConfig[], runId: string, capacities: Readonly<Record<string, ParentHostCapacity | null>>): ParentHostConfig[] {
+  return targets.map((target, index) => {
+    const sample = capacities[target.host];
+    const weight = sample && Number.isSafeInteger(sample.approvalHeadroom) && sample.approvalHeadroom > 0 && Number.isFinite(sample.load) && sample.load >= 0
+      ? sample.approvalHeadroom / (1 + sample.load) : 0;
+    const hash = createHash('sha256').update(`${runId}\0${target.host}`).digest();
+    const fraction = (hash.readUIntBE(0, 6) + 1) / (2 ** 48 + 1);
+    return { target, index, score: weight > 0 ? -Math.log(fraction) / weight : Infinity };
+  }).sort((a, b) => a.score - b.score || a.index - b.index).map(({ target }) => target);
 }
 
 /** `$HOME/…` 은 원격 셸이 풀도록 따옴표 밖에 둔다 — 나머지는 shellQuote. */
@@ -91,6 +177,20 @@ export const defaultSshRunner: SshRunner = (host, script, timeoutMs) => {
   return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? (result.error ? String(result.error) : '') };
 };
 
+/** PID 재사용을 피하려면 살아 있는 프로세스의 command 가 이 카드의 런 id 도 실어야 한다. */
+export function remoteParentAlive(parentHost: { host: string; pid?: number; runId: string }, ssh: SshRunner = defaultSshRunner): 'alive' | 'dead' | 'unknown' {
+  if (!Number.isSafeInteger(parentHost.pid) || !parentHost.pid || parentHost.pid <= 0 || !/^run-[A-Za-z0-9_-]{4,64}$/.test(parentHost.runId)) return 'unknown';
+  try {
+    // `env ELANOUS_RUN_ID=… nohup` 은 exec 뒤 argv 에 남지 않는다. ps eww 가 부모의 환경을 command 와 함께 보여 준다.
+    // ⚠️ `eww` 는 «앞»에 둔다 — macOS(node-b) ps 는 `-o command= eww` 꼴을 `illegal argument: eww`(rc=1)로 거부해
+    // 늘 'unknown' 이 된다(10-10 node-b 실측). 없는 pid 는 rc=1 · 빈 출력 → 'dead'.
+    const result = ssh(parentHost.host, `ps eww -p ${parentHost.pid} -o command=`, 10_000);
+    if (result.status === 0) return result.stdout.trim() ? (result.stdout.split(/[^A-Za-z0-9_-]+/).includes(parentHost.runId) ? 'alive' : 'dead') : 'dead';
+    if (result.status === 1 && !result.stdout.trim() && !result.stderr.trim()) return 'dead';
+    return 'unknown';
+  } catch { return 'unknown'; }
+}
+
 /** 발사 전 점검 결과 — `gaps` 가 비어야 원격으로 띄운다. */
 export interface ParentHostPreflight { ok: boolean; gaps: string[]; facts: Record<string, string> }
 
@@ -117,13 +217,22 @@ export interface PreflightInput {
   ssh?: SshRunner;
 }
 
+/** 기준판 — `0.2.23-dev.0` → `0.2.23`(앞 x.y.z 만). 모양이 아니면 원문 그대로(= 정확히 같아야 통과). */
+export function releaseCore(version: string): string {
+  return /^(\d+\.\d+\.\d+)/.exec(version)?.[1] ?? version;
+}
+
 /** 순수 판정 — 원격 사실 → 막는 칸 목록. */
 export function judgeParentHostFacts(facts: Record<string, string>, input: Omit<PreflightInput, 'ssh' | 'target'> & { podPoolOverride?: boolean }): string[] {
   const gaps: string[] = [];
   if (facts.unreachable) gaps.push(`unreachable: ${facts.unreachable}`);
   else {
     if (!facts.version) gaps.push('remote-elanous-missing');
-    else if (facts.version !== input.localVersion) gaps.push(`version-mismatch: remote ${facts.version} ≠ HQ ${input.localVersion}`);
+    else if (facts.version !== input.localVersion) {
+      // 레일은 HQ 를 30분마다 올리고 원격은 한 주기 늦을 수 있다 — 기준판(x.y.z)이 같으면 막지 않고 경고만 남긴다(OP 10-09 13:17).
+      if (releaseCore(facts.version) !== releaseCore(input.localVersion)) gaps.push(`version-mismatch: remote ${facts.version} ≠ HQ ${input.localVersion}`);
+      else debug.log('task-agent.parent-host', 'version-drift', { remote: facts.version, hq: input.localVersion });
+    }
     if (facts.config !== '1') gaps.push('remote-config-missing');
     if (facts.podPool !== '1' && !input.podPoolOverride) gaps.push('remote-pod-pool-unset');
     if (facts.repo !== '1') gaps.push('remote-repo-missing');