elanous 0.2.25 → 0.2.28

package/src/cli/msg-cli.ts

@@ -1,13 +1,18 @@
 import type { Command } from 'commander';
-import { canonicalSeatId, openMsgStore, type Message, type MsgStore } from '../msg/msg-store.js';
+import { ensureAuthToken } from '../auth/acp-token.js';
+import { canonicalSeatId, openMsgStore, openMsgStoreReadOnly, type Message, type MsgStore } from '../msg/msg-store.js';
+import { startMsgSseServer } from '../msg/msg-sse-server.js';
 
 export interface MsgCliDeps {
   openStore?: () => MsgStore;
+  openReadStore?: () => MsgStore;
   out?: Pick<Console, 'log' | 'error'>;
   readStdin?: () => Promise<string>;
   sleep?: (ms: number) => Promise<void>;
   setExitCode?: (code: number) => void;
   signal?: AbortSignal;
+  fetch?: typeof fetch;
+  authToken?: () => string;
 }
 
 type CommonOptions = { json?: boolean };
@@ -33,6 +38,7 @@ function formatMessage(message: Message): string {
 /** Register the durable, recipient-addressed CLI. Reading never advances the acknowledgement cursor. */
 export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): void {
   const open = deps.openStore ?? (() => openMsgStore());
+  const openRead = deps.openReadStore ?? (() => openMsgStoreReadOnly());
   const out = deps.out ?? console;
   const readStdin = deps.readStdin ?? (() => Bun.stdin.text());
   const sleep = deps.sleep ?? ((ms: number) => new Promise<void>(resolve => setTimeout(resolve, ms)));
@@ -57,13 +63,20 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
   };
 
   msg.command('post [body]').description('Post a message; use - or omit body to read stdin')
-    .option('--from <seat>').option('--to <seat>').option('--kind <kind>').option('--body <text>').option('--json')
-    .action((body: string | undefined, opts: CommonOptions & { from?: string; to?: string; kind?: string; body?: string }) => run(async () => {
+    .option('--from <seat>').option('--to <seat>').option('--kind <kind>').option('--body <text>')
+    .option('--reply-to <id>', 'point this reply at a question message ID')
+    .option('--origin-key <key>', 'deduplicate a channel mirror by coord:<commentId>:<recipient>').option('--json')
+    .action((body: string | undefined, opts: CommonOptions & { from?: string; to?: string; kind?: string; body?: string; replyTo?: string; originKey?: string }) => run(async () => {
       const from = seat(opts.from, '--from');
       const to = seat(opts.to, '--to');
       if (body !== undefined && body !== '-' && opts.body !== undefined) throw new Error('provide body once (argument or --body)');
       const text = opts.body ?? (body !== undefined && body !== '-' ? body : await readStdin());
-      const posted = withStore(store => store.post({ from, to, body: text, ...(opts.kind === undefined ? {} : { kind: opts.kind }) }));
+      const envelope = { from, to, body: text,
+        ...(opts.kind === undefined ? {} : { kind: opts.kind }),
+        ...(opts.replyTo === undefined ? {} : { replyTo: integer(opts.replyTo, '--reply-to', 0, 1, Number.MAX_SAFE_INTEGER) }) };
+      const posted = withStore(store => opts.originKey === undefined
+        ? store.post(envelope)
+        : store.appendWithProvenance(envelope, opts.originKey));
       emit(posted, opts.json, () => out.log(formatMessage(posted)));
     })());
 
@@ -95,25 +108,32 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
     .option('--to <seat>').option('--json')
     .action((opts: CommonOptions & { to?: string }) => run(() => {
       const to = opts.to === undefined ? undefined : seat(opts.to, '--to');
-      const rows = withStore(store => store.unread().filter(row => to === undefined || row.recipient === to));
+      const rows = withStore(store => {
+        if (to === undefined) return store.unread();
+        const count = store.unreadCount(to);
+        return count ? [{ recipient: to, count }] : [];
+      });
       emit(rows, opts.json, () => {
         if (!rows.length) out.log('No unread messages.');
         for (const row of rows) out.log(`${row.recipient}: ${row.count} unread`);
       });
     })());
 
-  msg.command('watch').description('Poll for new messages without acknowledging them (Ctrl-C to stop)')
+  msg.command('watch').description('Watch durable messages; SSE accelerates delivery and polling covers outages')
     .option('--to <seat>').option('--after <id>', 'exclusive message ID (default: acknowledged cursor)')
+    .option('--since-ack', 'start from the recipient seat’s acknowledged cursor')
     .option('--interval <ms>', 'poll interval in milliseconds', '1000')
+    .option('--sse <url>', 'post office base URL (fall back to ledger polling on disconnect)')
     .option('--once', 'poll once and exit').option('--json')
-    .action((opts: RecipientOptions & { interval?: string; once?: boolean }) => run(async () => {
+    .action((opts: RecipientOptions & { interval?: string; once?: boolean; sinceAck?: boolean; sse?: string }) => run(async () => {
+      if (opts.sinceAck && opts.after !== undefined) throw new Error('--since-ack cannot be used with --after');
       const to = seat(opts.to, '--to');
       const interval = integer(opts.interval, '--interval', 1000, 1, 60000);
       const after = opts.after === undefined ? undefined : integer(opts.after, '--after', 0, 0, Number.MAX_SAFE_INTEGER);
       const store = open();
       try {
         let cursor = after ?? store.getCursor(to);
-        do {
+        const poll = () => {
           let messages: Message[];
           do {
             messages = store.list(to, cursor, 1000);
@@ -122,12 +142,158 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
               cursor = message.id;
             }
           } while (messages.length === 1000 && !deps.signal?.aborted);
-          if (opts.once || deps.signal?.aborted) break;
-          await sleep(interval);
-        } while (!deps.signal?.aborted);
+        };
+        if (!opts.sse || opts.once) {
+          do {
+            poll();
+            if (opts.once || deps.signal?.aborted) break;
+            await sleep(interval);
+          } while (!deps.signal?.aborted);
+        } else {
+          const url = new URL('/stream', opts.sse);
+          if (!['http:', 'https:'].includes(url.protocol)) throw new Error('--sse requires an HTTP URL');
+          if (url.protocol === 'http:' && !['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))
+            throw new Error('--sse requires HTTPS outside localhost');
+          url.searchParams.set('to', to);
+          const token = (deps.authToken ?? (() => ensureAuthToken().token))();
+          let outage = false;
+          while (!deps.signal?.aborted) {
+            poll();
+            url.searchParams.set('since', String(cursor));
+            const controller = new AbortController();
+            const onAbort = () => controller.abort();
+            deps.signal?.addEventListener('abort', onAbort, { once: true });
+            try {
+              let connectTimer: ReturnType<typeof setTimeout> | undefined;
+              const response = await Promise.race([
+                (deps.fetch ?? fetch)(url, { headers: {
+                  Authorization: `Bearer ${token}`, 'Last-Event-ID': String(cursor),
+                }, signal: controller.signal }),
+                new Promise<never>((_, reject) => { connectTimer = setTimeout(() => {
+                  controller.abort();
+                  reject(new Error('SSE connect timeout'));
+                }, Math.max(1000, Math.min(5000, interval * 2))); }),
+              ]).finally(() => clearTimeout(connectTimer));
+              if (response.status === 401) throw new Error('SSE unauthorized (401)');
+              if (!response.ok || !response.body) throw new Error(`SSE unavailable (${response.status})`);
+              outage = false;
+              const reader = response.body.getReader();
+              const decoder = new TextDecoder();
+              let pending = '';
+              while (!deps.signal?.aborted) {
+                let idleTimer: ReturnType<typeof setTimeout> | undefined;
+                const chunk = await Promise.race([
+                  reader.read(),
+                  new Promise<never>((_, reject) => { idleTimer = setTimeout(() => {
+                    controller.abort();
+                    reject(new Error('SSE idle timeout'));
+                  }, Math.max(1000, Math.min(5000, interval * 2))); }),
+                ]).finally(() => clearTimeout(idleTimer));
+                if (chunk.done) break;
+                pending += decoder.decode(chunk.value, { stream: true });
+                pending = pending.replace(/\r\n/g, '\n');
+                if (pending.length > 1_000_000) throw new Error('SSE event exceeds limit');
+                let boundary: number;
+                while ((boundary = pending.indexOf('\n\n')) >= 0) {
+                  const event = pending.slice(0, boundary);
+                  pending = pending.slice(boundary + 2);
+                  if (event.split('\n').some((line) => line.startsWith('id: '))) poll();
+                }
+              }
+            } catch (error) {
+              if (error instanceof Error && error.message === 'SSE unauthorized (401)') throw error;
+              if (!outage && !deps.signal?.aborted) out.error(`msg: SSE disconnected; polling ledger (${error instanceof Error ? error.message : String(error)})`);
+              outage = true;
+            } finally { deps.signal?.removeEventListener('abort', onAbort); controller.abort(); }
+            if (deps.signal?.aborted) break;
+            poll();
+            await sleep(interval);
+          }
+        }
       } finally { store.close(); }
     })());
 
+  msg.command('ask <recipient> <question>').description('Post a question and wait for its first reply')
+    .option('--from <seat>', 'asking seat (required)').option('--wait <seconds>', 'seconds to wait for a reply (default 60)', '60')
+    .option('--json')
+    .action((recipient: string, question: string, opts: CommonOptions & { from?: string; wait?: string }) => run(async () => {
+      const from = seat(opts.from, '--from');
+      const to = canonicalSeatId(recipient);
+      const waitSeconds = integer(opts.wait, '--wait', 60, 0, 86400);
+      const interrupt = deps.signal === undefined ? new AbortController() : undefined;
+      const signal = deps.signal ?? interrupt!.signal;
+      const onInterrupt = () => interrupt?.abort();
+      if (interrupt) {
+        process.once('SIGINT', onInterrupt);
+        process.once('SIGTERM', onInterrupt);
+      }
+      let store: MsgStore | undefined;
+      try {
+        const asked = withStore(ledger => ledger.post({ from, to, body: question }));
+        const deadline = Date.now() + waitSeconds * 1000;
+        let reply: Message | undefined;
+        store = open();
+        do {
+          reply = store.listReplies(asked.id, 1)[0];
+          if (reply !== undefined || signal.aborted || Date.now() >= deadline) break;
+          await sleep(1000);
+        } while (true);
+        if (reply === undefined && signal.aborted) throw new Error(`ask interrupted after posting #${asked.id}`);
+        if (reply === undefined) throw new Error(`no reply to #${asked.id} within ${waitSeconds}s`);
+        emit(reply, opts.json, () => out.log(formatMessage(reply)));
+      } finally {
+        store?.close();
+        if (interrupt) {
+          process.removeListener('SIGINT', onInterrupt);
+          process.removeListener('SIGTERM', onInterrupt);
+        }
+      }
+    })());
+
+  msg.command('thread <id>').description('Show one question and its replies in time order')
+    .option('--json')
+    .action((id: string, opts: CommonOptions) => run(() => {
+      const target = integer(id, 'message ID', 0, 1, Number.MAX_SAFE_INTEGER);
+      const thread = withStore(store => {
+        const question = store.getMessage(target);
+        if (question === null) throw new Error(`message not found: #${target}`);
+        // Keep paging until a short page so a thread longer than one store page is never truncated.
+        const replies: Message[] = [];
+        let after = 0;
+        let page: Message[];
+        do {
+          page = store.listReplies(target, 100, after);
+          replies.push(...page);
+          after = page.at(-1)?.id ?? after;
+        } while (page.length === 100);
+        return { question, replies };
+      });
+      emit(thread, opts.json, () => {
+        out.log(formatMessage(thread.question));
+        for (const reply of thread.replies) out.log(formatMessage(reply));
+      });
+    })());
+
+  msg.command('serve').description('Run the independent, read-only post office SSE service')
+    .option('--sse', 'serve GET /stream')
+    .option('--port <port>', 'port (or ELANOUS_MSG_SSE_PORT)')
+    .option('--host <host>', 'bind address', '127.0.0.1')
+    .action((opts: { sse?: boolean; port?: string; host?: string }) => run(() => {
+      if (!opts.sse) throw new Error('serve requires --sse');
+      const rawPort = opts.port ?? process.env.ELANOUS_MSG_SSE_PORT;
+      if (rawPort === undefined) throw new Error('--port or ELANOUS_MSG_SSE_PORT is required');
+      const port = integer(rawPort, '--port', 0, 0, 65535);
+      const store = openRead();
+      try {
+        const service = startMsgSseServer({ store, token: (deps.authToken ?? (() => ensureAuthToken().token))(),
+          port, hostname: opts.host });
+        out.log(`msg SSE listening on ${opts.host}:${service.port}`);
+        const stop = () => { service.stop(); store.close(); };
+        process.once('SIGINT', stop);
+        process.once('SIGTERM', stop);
+      } catch (error) { store.close(); throw error; }
+    })());
+
   // Commander reports option/argument errors before action handlers run. Scope their exit code
   // to msg so unrelated commands keep their own error and help behavior.
   for (const command of [msg, ...msg.commands]) {

package/src/cli/plugin-cli.ts

@@ -6,7 +6,8 @@ import { existsSync, readFileSync } from 'node:fs';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { userConfigPath } from '../user-config.js';
 import { debug, redactSecretText } from '../debug/log.js';
-import { addMarket, ensureInternalMarketIndex, listMarkets, MarketFetchError, updateMarket } from '../plugins/install/market-fetch.js';
+import { addMarket, codexPluginPackagePath, ensureInternalMarketIndex, listMarkets, MarketFetchError, updateMarket } from '../plugins/install/market-fetch.js';
+import { readCodexPluginList } from '../acp/codex-plugins.js';
 import { emitDecision } from '../live/detail-switch.js';
 import { OFFICIAL_INDEX_KEYS } from '../market/official-keys.js';
 import { installPlugin, listInstalledPlugins, PluginInstallError, removePlugin, type InstallEvent } from '../plugins/install/plugin-install.js';
@@ -118,15 +119,22 @@ export function registerPluginCommands(program: Command): void {
       }
     });
   plugin.command('add <spec>').description('Install a local path, pinned git plugin or signed market plugin')
+    .option('--from-codex', 'Import an installed Codex plugin by name@marketplace')
     .option('--yes', 'Accept requested capabilities')
     .option('--json', 'NDJSON progress events')
     .option('--allow-unsigned', 'Allow unsigned marketplace indices')
     .option('--refresh', 'Refresh the signed marketplace index before installing')
-    .action(async (spec: string, opts: { yes?: boolean; json?: boolean; allowUnsigned?: boolean; refresh?: boolean }) => {
+    .action(async (spec: string, opts: { yes?: boolean; json?: boolean; allowUnsigned?: boolean; refresh?: boolean; fromCodex?: boolean }) => {
       try {
         const root = elanousStateRoot();
         const nodeCount = { value: 0 };
-        await installPlugin(spec, {
+        let source = spec;
+        if (opts.fromCodex) {
+          const match = /^([a-z0-9][a-z0-9-]{1,39})@([a-z0-9][a-z0-9-]{1,39})$/.exec(spec);
+          if (!match) throw new PluginInstallError('io', 'Codex import requires name@marketplace');
+          source = codexPluginPackagePath(await readCodexPluginList(), match[1]!, match[2]!);
+        }
+        await installPlugin(source, {
           root, marketDir: join(root, 'plugins', 'markets'), trustedKeys: keys(),
           yes: opts.yes, allowUnsigned: opts.allowUnsigned, refresh: opts.refresh,
           onEvent: event => outputEvent(event, !!opts.json, nodeCount),

package/src/cli/pr-cli.ts

@@ -58,7 +58,9 @@ import { parseReleaseNoteSection } from '../release-loop/release-note.js';
 import { landingFreezeMessage } from '../release-loop/landing-freeze.js';
 import { admitLandingMerge } from '../self-implement/frozen-merges.js';
 import { verifyAncestorAutoPass, verifyOverlapEvidence } from './pr-land-overlap-evidence.js';
+import { observePrLandRefusal } from './pr-land-refusal.js';
 import { taskAgentStatePath } from '../task-agent/task-hand.js';
+import { PR_LABEL_NAMES } from '../github/pr-labels.js';
 import { enqueueL8ShadowQueue, runL8ShadowQueue, shadowPrNumber, statusL8ShadowQueue, type L8ShadowQueueDeps } from '../self-implement/l8-merge-queue.js';
 
 export { branchLineageSlug, findSiblingPrs };
@@ -1143,8 +1145,36 @@ export function runPrGranularity(opts: PrGranularityOpts = {}, deps: PrLandDeps
 const GITHUB_MERGEABLE = new Set(['MERGEABLE', 'CONFLICTING', 'UNKNOWN']);
 const GITHUB_MERGE_STATE = new Set(['BEHIND', 'BLOCKED', 'CLEAN', 'DIRTY', 'DRAFT', 'HAS_HOOKS', 'UNKNOWN', 'UNSTABLE']);
 
+/** Read-only identity check shared by pinned landing and its dry-run. Later landing gates still run only on a real landing. */
+function inspectPinnedPr(run: CmdRunner, cwd: string, pr: number, expectedHead: string) {
+  const viewed = run('gh', ['pr', 'view', String(pr), '--json', 'headRefOid,headRefName,state,isDraft,url'], { cwd });
+  let value: { headRefOid?: string; headRefName?: string; state?: string; isDraft?: boolean; url?: string } = {};
+  try {
+    if (viewed.ok) {
+      const parsed: unknown = JSON.parse(viewed.out);
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) value = parsed as typeof value;
+    }
+  } catch { /* unreadable is not approval */ }
+  const local = run('git', ['rev-parse', 'HEAD'], { cwd });
+  const dirty = run('git', ['status', '--porcelain'], { cwd });
+  const reasons: string[] = [];
+  if (value.state !== 'OPEN') reasons.push('PR is not OPEN or its state is unavailable');
+  if (value.isDraft !== false) reasons.push(value.isDraft === true ? 'PR is draft' : 'PR ready status is unavailable');
+  if (value.headRefOid?.toLowerCase() !== expectedHead.toLowerCase()) reasons.push('PR head differs from --expected-head or is unavailable');
+  if (!value.url?.endsWith(`/pull/${pr}`) || !value.headRefName) reasons.push('PR identity or head branch is unavailable');
+  if (!local.ok || local.out.trim().toLowerCase() !== expectedHead.toLowerCase()) reasons.push('local HEAD differs from --expected-head or is unavailable');
+  if (!dirty.ok || dirty.out.trim()) reasons.push(dirty.ok ? 'local worktree is dirty' : 'local worktree status is unavailable');
+  return { ok: reasons.length === 0, reasons, branch: value.headRefName, url: value.url };
+}
+
 export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): Promise<number> {
   const out = deps.out ?? liveOut;
+  // First slice: observe pinned identity/branch, overlap decision, and GitHub merge refusals.
+  // Option syntax and prerequisite gate errors do not describe a merge recovery edge.
+  const refuse = (message: string, context: { isDraft?: boolean } = {}): void => {
+    out.error(message);
+    observePrLandRefusal(message, context);
+  };
   if (opts.title !== undefined && opts.titleFile !== undefined) {
     out.error('✗ title: --title과 --title-file은 함께 사용할 수 없습니다.');
     return 1;
@@ -1195,6 +1225,84 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   const cwd = opts.cwd ?? process.cwd();
   const run = deps.run ?? defaultCmdRunner;
   const pinned = opts.pr !== undefined || opts.expectedHead !== undefined;
+  if (opts.dryRun && opts.pr !== undefined && opts.expectedHead === undefined) {
+    if (opts.overlapEvidence !== undefined || opts.hold) {
+      out.error('✗ dry-run: --overlap-evidence 와 --hold 는 번호 지정 읽기 전용 미리보기에서 사용할 수 없습니다.');
+      return 1;
+    }
+    const pr = Number(opts.pr);
+    if (!/^[1-9]\d*$/.test(opts.pr) || !Number.isSafeInteger(pr)) {
+      out.error('✗ dry-run: --pr 에는 양의 정수를 지정해야 합니다.');
+      return 1;
+    }
+    const viewed = run('gh', ['pr', 'view', String(pr), '--json', 'headRefOid,state,headRefName,isDraft,mergeable,mergeStateStatus,url'], { cwd });
+    if (!viewed.ok) {
+      out.error(`✗ dry-run: PR #${pr} 를 조회하지 못했습니다 — 존재하지 않거나 GitHub 조회가 실패했습니다.`);
+      return 1;
+    }
+    let value: { headRefOid?: string; state?: string; headRefName?: string; isDraft?: boolean; mergeable?: string; mergeStateStatus?: string; url?: string };
+    try {
+      const parsed: unknown = JSON.parse(viewed.out);
+      if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error('not an object');
+      value = parsed as typeof value;
+    }
+    catch {
+      out.error(`✗ dry-run: PR #${pr} 조회 결과를 읽을 수 없습니다.`);
+      return 1;
+    }
+    if (typeof value.headRefOid !== 'string' || !/^[a-f0-9]{40}$/i.test(value.headRefOid) || value.state !== 'OPEN') {
+      out.error(`✗ dry-run: PR #${pr} 가 열려 있지 않거나 head 정보가 없습니다 (state=${value.state ?? 'unmeasured'}).`);
+      return 1;
+    }
+    out.log(`PR #${pr} · head ${value.headRefOid} · state ${value.state}${value.headRefName ? ` · branch ${value.headRefName}` : ''}`);
+    out.log('Landing plan (read-only preview):');
+    out.log(`- GitHub PR state/head: PASS (${value.state}, ${value.headRefOid})`);
+    if (value.isDraft === true) out.log('- Draft status: GitHub reports DRAFT; landing eligibility UNMEASURED.');
+    else if (value.isDraft === false) out.log('- Draft status: observed — ready for review.');
+    else if (value.isDraft !== false) out.log('- Draft status: UNMEASURED');
+    if (value.mergeable === 'CONFLICTING') out.log('- Warning: GitHub reports merge conflicts; landing eligibility UNMEASURED.');
+    else if (value.mergeable === 'MERGEABLE') out.log('- Mergeability: GitHub reports MERGEABLE; repository landing gates remain UNMEASURED.');
+    else out.log(`- Mergeability: UNMEASURED${value.mergeable ? ` (${value.mergeable})` : ''}`);
+    if (value.mergeStateStatus === 'BLOCKED' || value.mergeStateStatus === 'DIRTY' || value.mergeStateStatus === 'DRAFT') {
+      out.log(`- Warning: GitHub merge state is ${value.mergeStateStatus}; landing eligibility UNMEASURED.`);
+    } else if (value.mergeStateStatus && value.mergeStateStatus !== 'CLEAN') {
+      out.log(`- GitHub merge state: ${value.mergeStateStatus} (additional requirements may apply; landing eligibility UNMEASURED).`);
+    }
+    out.log('- Local HEAD/worktree, branch/base, and same-branch guard: UNMEASURED — local git is not run');
+    out.log('- Changed-file scope, active-run files, untracked files, plan artifacts, and deletion advisory: UNMEASURED — local files are not read');
+    out.log('- Typecheck, isolation, mock-module restore, model-hardcode, daemon-port, test-interference, and global checks: UNMEASURED — gates are not run');
+    out.log('- Public export/import, public leak, and docs CLI checks: UNMEASURED — gates are not run');
+    out.log('- Android, iOS, and PWA gates: CONDITIONAL / UNMEASURED — changed-file applicability and builds are not checked');
+    out.log('- Freeze, PR base/bench guards, sibling PRs, recent landings, overlap, and approval: UNMEASURED — not queried or approved');
+    out.log('- GitHub draft/mergeability status: observed above; this preview does not approve or merge the PR.');
+    out.log('- Mutations (ready/edit/create/merge, git commit/push, worktree): NOT RUN');
+    return 0;
+  }
+  if (opts.dryRun && pinned) {
+    const pr = Number(opts.pr);
+    if (!/^[1-9]\d*$/.test(opts.pr ?? '') || !Number.isSafeInteger(pr) || !/^[a-f0-9]{40}$/i.test(opts.expectedHead ?? '')) {
+      out.error('✗ expected-head: --pr and --expected-head (full SHA) are required together without --hold');
+      return 1;
+    }
+    if (opts.hold) {
+      out.error('✗ dry-run: --hold 는 머리 고정 읽기 전용 예행과 함께 사용할 수 없습니다.');
+      return 1;
+    }
+    if (opts.overlapEvidence !== undefined) {
+      out.error('✗ dry-run: --overlap-evidence 는 머리 고정 읽기 전용 예행에서 사용할 수 없습니다.');
+      return 1;
+    }
+    const inspected = inspectPinnedPr(run, cwd, pr, opts.expectedHead!);
+    const branch = (deps.currentBranch ?? liveCurrentBranch)(cwd);
+    const reasons = [...inspected.reasons];
+    if (!branch || branch !== inspected.branch) reasons.push('current branch differs from the PR head branch or is unavailable');
+    out.log(`[dry-run] pinned PR #${pr} · expected head ${opts.expectedHead}`);
+    for (const reason of reasons) out.log(`[dry-run] ✗ preflight: ${reason}`);
+    if (reasons.includes('PR is draft')) out.log(`[dry-run] 선행: eln gh pr ready ${pr}`);
+    if (reasons.length === 0) out.log('[dry-run] ✓ preflight: PR OPEN non-draft, matching PR/local HEAD and branch, clean worktree');
+    out.log('[dry-run] Remaining landing gates, freeze, overlap and merge: UNMEASURED; no PR or git state changed.');
+    return reasons.length === 0 ? 0 : 1;
+  }
   if (opts.overlapEvidence !== undefined && (!pinned || !opts.overlapEvidence.trim())) {
     out.error('✗ overlap-evidence: --overlap-evidence <file> 는 --pr ⊕ --expected-head 머리 고정 착지에서만 쓴다.');
     return 1;
@@ -1203,30 +1311,26 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   let pinnedUrl: string | undefined;
   if (pinned) {
     const pr = Number(opts.pr);
-    if (!/^[1-9]\d*$/.test(opts.pr ?? '') || !Number.isSafeInteger(pr) || !/^[a-f0-9]{40}$/i.test(opts.expectedHead ?? '') || opts.hold || opts.dryRun) {
-      out.error('✗ expected-head: --pr and --expected-head (full SHA) are required together without --hold/--dry-run');
+    if (!/^[1-9]\d*$/.test(opts.pr ?? '') || !Number.isSafeInteger(pr) || !/^[a-f0-9]{40}$/i.test(opts.expectedHead ?? '') || opts.hold) {
+      out.error('✗ expected-head: --pr and --expected-head (full SHA) are required together without --hold');
       return 1;
     }
-    const viewed = run('gh', ['pr', 'view', String(pr), '--json', 'headRefOid,headRefName,state,isDraft,url'], { cwd });
-    let value: { headRefOid?: string; headRefName?: string; state?: string; isDraft?: boolean; url?: string } = {};
-    try { if (viewed.ok) value = JSON.parse(viewed.out) as typeof value; } catch { /* unreadable is not approval */ }
-    const local = run('git', ['rev-parse', 'HEAD'], { cwd });
-    const dirty = run('git', ['status', '--porcelain'], { cwd });
-    if (value.state !== 'OPEN' || value.isDraft !== false || value.headRefOid?.toLowerCase() !== opts.expectedHead!.toLowerCase()
-      || !value.url?.endsWith(`/pull/${pr}`) || !value.headRefName || !local.ok || local.out.trim().toLowerCase() !== opts.expectedHead!.toLowerCase()
-      || !dirty.ok || dirty.out.trim()) {
-      out.error('✗ expected-head: PR OPEN non-draft, matching local HEAD and clean worktree required');
+    const inspected = inspectPinnedPr(run, cwd, pr, opts.expectedHead!);
+    if (!inspected.ok) {
+      refuse('✗ expected-head: PR OPEN non-draft, matching local HEAD and clean worktree required', {
+        isDraft: inspected.reasons.includes('PR is draft'),
+      });
       return 1;
     }
-    pinnedBranch = value.headRefName;
-    pinnedUrl = value.url;
+    pinnedBranch = inspected.branch;
+    pinnedUrl = inspected.url;
   }
   const resolveBase = deps.resolveBase ?? resolveDeliverableBase;
   const branch = (deps.currentBranch ?? liveCurrentBranch)(cwd);
   if (!branch || (pinned && branch !== pinnedBranch)) {
     const detail = pinned ? 'PR head branch와 현재 브랜치가 다릅니다.' : '현재 브랜치를 해석하지 못했습니다.';
     record('branch', false);
-    out.error(`✗ branch: ${detail}`);
+    refuse(`✗ branch: ${detail}`);
     return 1;
   }
   record('branch', true);
@@ -1611,6 +1715,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   const hold = !!opts.hold || overlapDecision?.outcome === 'user-hold';
   // TA-LAND-OVERLAP — 비대화형 «승인 불가»만 증거로 대신한다(사람의 hold 는 증거로 뒤집지 않는다) · 증거가 없거나 어긋나면 종전 거부 그대로.
   let overlapEvidenceAccepted = false;
+  let ancestorResyncNeeded = false;
   if (pinned && overlapDecision?.outcome === 'unavailable' && opts.overlapEvidence !== undefined) {
     const ref = resolveRemoteBranchRef(run, cwd, base);
     const verdict = verifyOverlapEvidence({
@@ -1625,7 +1730,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
           ? `✓ overlap-evidence: base-advanced-disjoint — gate base ${verdict.gateBase.slice(0, 12)} ⊂ head ${opts.expectedHead!.slice(0, 12)} · ${ref.remote}/${ref.branch} ${verdict.baseTip.slice(0, 12)} 까지 ${verdict.windowCommits}개 커밋이 PR 파일을 안 건드린다 · review pass|warn must-fix 0 (${verdict.reviewResult})`
           : `✓ overlap-evidence: ${ref.remote}/${ref.branch} ${verdict.baseTip.slice(0, 12)} ⊂ head ${opts.expectedHead!.slice(0, 12)} · gate passed on that base · review pass must-fix 0 (${verdict.reviewResult})`);
     }
-    else out.error(`✗ overlap-evidence: ${verdict.reason}`);
+    else refuse(`✗ overlap-evidence: ${verdict.reason}`);
   } else if (pinned && overlapDecision?.outcome === 'unavailable') {
     // 증거 파일이 없을 때 — 겹친 착지가 전부 머리의 조상이고 표준 자리의 리뷰가 pass|warn ⊕ must-fix 0 이면 통과(아니면 종전 거부).
     const verdict = verifyAncestorAutoPass({
@@ -1637,9 +1742,19 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     if (verdict.ok) {
       out.log(`✓ overlap-evidence: already-ancestor-auto — 겹친 최근 착지 ${overlappingLandings.length}개가 전부 head ${opts.expectedHead!.slice(0, 12)} 의 조상 · review pass|warn must-fix 0 (${verdict.reviewResult})`);
     }
-    else out.error(`✗ ancestor-auto: ${verdict.reason}`);
+    else {
+      refuse(`✗ ancestor-auto: ${verdict.reason}`);
+      ancestorResyncNeeded = verdict.reason.startsWith('ancestor-auto-not-ancestor:');
+    }
   }
   if (pinned && overlapDecision && overlapDecision.outcome !== 'user-merge' && !overlapEvidenceAccepted) {
+    // A clean GitHub PR can still be behind a recently landed overlapping head. Preserve the cue
+    // across hosts; the current steward tick acts only if it can also prove local run ownership.
+    if (ancestorResyncNeeded && !opts.dryRun) {
+      const marked = run('gh', ['pr', 'edit', String(opts.pr), '--add-label', PR_LABEL_NAMES.needsRebase], { cwd });
+      record('resync-marker', marked.ok, { pr: Number(opts.pr), reason: 'ancestor-auto-not-ancestor' });
+      if (!marked.ok) out.error('⚠ resync-marker: needs-rebase 라벨을 남기지 못했습니다');
+    }
     out.error('✗ expected-head: overlap merge approval unavailable for the reviewed head');
     return 1;
   }
@@ -1700,7 +1815,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     if (opts.hold) {
       out.log(`[dry-run] ${existing.url ? '기존 PR을 갱신' : 'PR을 생성'}하고 --hold 로 병합하지 않고 멈춥니다.`);
     } else {
-      out.log(`[dry-run] ${existing.url ? '기존 PR을 갱신하고 ready 상태를 보장' : 'PR을 생성하고 ready 상태를 보장'}한 뒤 squash merge 합니다.`);
+      out.log(`[dry-run] 머리 고정 없는 일반 착지: ${existing.url ? '기존 PR을 갱신하고 ready 상태를 보장' : 'PR을 생성하고 ready 상태를 보장'}한 뒤 squash merge 합니다.`);
     }
     return 0;
   }
@@ -1874,7 +1989,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
       ...(mergeable ? { mergeable } : {}),
       ...(mergeStateStatus ? { mergeStateStatus } : {}),
     });
-    out.error(`✗ merge: ${detail}`);
+    refuse(`✗ merge: ${detail}`);
     if (mergeable === 'CONFLICTING') {
       out.error('  ↳ 충돌 — 이 브랜치가 기준 브랜치의 최근 착지와 같은 줄을 고쳤다. `bun bin/elanous.mjs git fetch origin` → `bun bin/elanous.mjs git rebase origin/<기준>` 로 풀고 다시 pr land.');
     }

package/src/cli/pr-land-overlap-evidence.ts

@@ -11,12 +11,12 @@
  *      ⓐ `gate.baseCommit` 이 고정 머리의 조상 ⊕ 지금 끝의 조상이고 ⓑ 창 `gate.baseCommit..지금 끝`의 커밋이 «하나도»
  *      PR 의 바뀐 파일(머리 vs merge-base)을 안 건드리면 통과(관측 reason `base-advanced-disjoint`).
  *      겹치면 `base-stale-overlap`(REJUDGE 가 재게이트를 청한다) · 못 재면 `base-window-unmeasured` · ⓐ 가 아니면 종전 사유.
- *   ③ 리뷰 — 증거가 가리키는 `review-results/<card>-<pr>-<head12>.json`(TA 가 받는 `self review --json` stdout)이
- *      같은 PR·같은 머리에 대해 `reviewed:true` · `verdict ∈ {pass, warn}` · must-fix 가 «잰 수» 0 인가
+ *   ③ 리뷰 — 증거가 가리키는 `review-results/<card>-<pr>-<head접두 10~40>.json`(TA 가 받는 `self review --json` stdout)이
+ *      파일명에서 같은 PR·머리 접두이고 내용에서 전체 PR·머리가 정확히 같으며 `reviewed:true` · `verdict ∈ {pass, warn}` · must-fix 가 «잰 수» 0 인가
  *      (자동 병합 canAuto · TA-LAND-WARN-MUSTFIX0 과 같은 규칙 — must-fix 를 못 셌으면 거부).
  *   ⓐ 이미 조상(TC #26019 실측) — 겹친 최근 착지 커밋이 «전부» 고정 머리의 조상이면 그 겹침은 이미 그 머리의 게이트·리뷰에
  *      반영됐다 ⇒ ①② 없이 ③ 만으로 통과(관측 reason `already-ancestor`). 하나라도 조상이 아니면 ①②③ 전부.
- *   ⓐ' 증거 파일이 없을 때(`verifyAncestorAutoPass`) — 같은 ⓐ 를 표준 자리 `review-results/*-<pr>-<head12>.json` 만으로 잰다
+ *   ⓐ' 증거 파일이 없을 때(`verifyAncestorAutoPass`) — 같은 ⓐ 를 표준 자리 `review-results/*-<pr>-<head접두 10~40>.json` 만으로 잰다
  *      (관측 reason `already-ancestor-auto`). 조상이 아닌 착지가 하나라도 있거나 리뷰 결과가 없으면 거부.
  *   하나라도 못 재거나 어긋나면 거부 — 호출부는 종전 거부를 그대로 낸다(fail-closed).
  * - 관측: `pr.land` · `overlap-evidence` (decision · reason · 잰 값).
@@ -33,7 +33,7 @@ interface OverlapEvidenceFile {
   head: string;
   /** ①② 경로에서만 필수 — 겹친 착지가 전부 조상(already-ancestor)이면 생략해도 된다. */
   gate?: { head: string; baseCommit: string; passed: boolean };
-  /** `self review --json` stdout 을 받은 파일(TA: `<state>/review-results/<card>-<pr>-<head12>.json`). */
+  /** `self review --json` stdout 을 받은 파일(TA: `<state>/review-results/<card>-<pr>-<head접두 10~40>.json`); 내용의 전체 head도 확인한다. */
   reviewResult: string;
 }
 
@@ -65,9 +65,14 @@ const COMMIT_MARK = '\u0001';
 
 function checkReview(input: Pick<VerifyOverlapEvidenceInput, 'pr' | 'readFile'>, e: Partial<OverlapEvidenceFile>, head: string, baseTip?: string): { ok: false; reason: string; baseTip?: string } | { ok: true; reviewResult: string } {
   if (typeof e.reviewResult !== 'string' || !e.reviewResult) return { ok: false, reason: 'review-missing', baseTip };
-  // TA 가 받는 자리(`<state>/review-results/<card>-<pr>-<head12>.json` · reviewResultPath)만 — 아무 디렉터리의 같은 이름은 안 받는다.
+  // TA 가 받는 자리(`<state>/review-results/<card>-<pr>-<head접두 10~40>.json` · reviewResultPath)만; 내용의 전체 head도 확인한다.
+  const resultName = basename(e.reviewResult);
+  const resultMatch = /^([A-Za-z0-9][A-Za-z0-9._-]*)-(\d+)-([a-f0-9]{10,40})\.json$/i.exec(resultName);
   if (basename(dirname(e.reviewResult)) !== 'review-results'
-    || !new RegExp(`^[A-Za-z0-9][A-Za-z0-9._-]*-${input.pr}-${head.slice(0, 12)}\\.json$`, 'i').test(basename(e.reviewResult))) {
+    || !resultMatch
+    || Number(resultMatch[2]) !== input.pr
+    || resultMatch[3]!.length < 10
+    || !head.startsWith(resultMatch[3]!.toLowerCase())) {
     return { ok: false, reason: 'review-path-not-for-this-pr-head', baseTip };
   }
   let text: string;
@@ -206,7 +211,7 @@ export interface VerifyAncestorAutoInput {
   cwd: string;
   run: CmdRunner;
   readFile: (path: string) => string;
-  /** 표준 자리 `<state>/review-results` — 이 안의 `*-<pr>-<head12>.json` 만 본다. */
+  /** 표준 자리 `<state>/review-results` — 이 안의 `*-<pr>-<head접두 10~40>.json`만 후보로 보고 내용의 전체 head를 확인한다. */
   reviewResultsDir: string;
   listDir: (dir: string) => readonly string[];
   /** 겹침 관문이 찾은 «겹친» 최근 착지 커밋들. */
@@ -222,10 +227,13 @@ function checkAncestorAuto(input: VerifyAncestorAutoInput): AncestorAutoVerdict
   if (notAncestor !== undefined) return { ok: false, reason: `ancestor-auto-not-ancestor: ${notAncestor.slice(0, 12)} is not an ancestor of ${head.slice(0, 12)}` };
   let names: readonly string[];
   try { names = input.listDir(input.reviewResultsDir); } catch { return { ok: false, reason: 'review-missing' }; }
-  const suffix = new RegExp(`-${input.pr}-${head.slice(0, 12)}\\.json$`, 'i');
-  // 같은 <pr>-<head12> 리뷰가 여럿이면 «전부» 통과해야 한다 — 하나라도 거부면 거부(fail-closed · 처음 통과한 하나로 승인하지 않는다).
+  const filename = new RegExp(`^[A-Za-z0-9][A-Za-z0-9._-]*-${input.pr}-([a-f0-9]{10,40})\\.json$`, 'i');
+  // 같은 PR·머리 접두의 리뷰가 여럿이면 «전부» 통과해야 한다 — 내용 headCommit 이 정확히 맞아야 승인한다.
   let accepted: string | undefined;
-  for (const name of [...names].filter((n) => suffix.test(n)).sort()) {
+  for (const name of [...names].filter((n) => {
+    const match = filename.exec(n);
+    return Boolean(match && match[1]!.length >= 10 && head.startsWith(match[1]!.toLowerCase()));
+  }).sort()) {
     const review = checkReview(input, { reviewResult: join(input.reviewResultsDir, name) }, head);
     if (!review.ok) return { ok: false, reason: review.reason };
     accepted = review.reviewResult;

package/src/cli/pr-land-refusal.ts

@@ -0,0 +1,20 @@
+import { readJourneyEdge, recordJourneyEdge } from '../self-dev/graph-journey-route.js';
+import { debug } from '../debug/log.js';
+
+/** The five outcomes of an observed `pr land` refusal. This function never retries a landing. */
+export type PrLandRefusal = 'draft' | 'head-branch' | 'not-ancestor' | 'review-missing' | 'other';
+
+export function classifyPrLandRefusal(message: string, context: { isDraft?: boolean } = {}): PrLandRefusal {
+  if (context.isDraft === true && message.startsWith('✗ expected-head: PR OPEN non-draft')) return 'draft';
+  if (message.startsWith('✗ branch: PR head branch와 현재 브랜치가 다릅니다.')) return 'head-branch';
+  if (message.startsWith('✗ ancestor-auto: ancestor-auto-not-ancestor:')) return 'not-ancestor';
+  if (/^✗ (?:ancestor-auto|overlap-evidence): (?:review-missing|review-not-reviewed|review-error|review-no-result|review-unreadable|review-pr-mismatch|review-head-mismatch|review-path-not-for-this-pr-head|review-verdict-null|review-must-fix-unknown)(?:\b|$)/.test(message)) return 'review-missing';
+  return 'other';
+}
+
+/** Read the declared recovery edge and observe the refusal. No recovery command runs here. */
+export function observePrLandRefusal(message: string, context: { isDraft?: boolean } = {}): void {
+  const route = readJourneyEdge('merge', classifyPrLandRefusal(message, context));
+  if (route.to !== null) recordJourneyEdge(route, route.to, 'pr-land-refused; recovery-execution=none');
+  else debug.log('self-implement', 'graph-edge-unresolved', { from: 'merge', label: route.label, reason: 'pr-land-refused; recovery-execution=none' });
+}