elanous 0.2.28 → 0.2.31

package/src/steward/ta-repair-event-collect.ts

@@ -0,0 +1,158 @@
+/** Immediate TA repair collection. The card and atomic worker result remain authoritative. */
+import { mkdirSync, readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { debug } from '../debug/log.js';
+import { spawnElanous } from '../instance/spawn-elanous.js';
+import { acquireLockSync } from '../storage/file-lock.js';
+import { subscribeInsideEvent, type InsideLiveEvent } from '../nexus/api/inside-events.js';
+import type { NexusEventBus } from '../nexus/api/event-bus.js';
+import { parseRepairWorkerResult } from '../task-agent/repair-worker.js';
+import { readTaskCard, taskAgentStatePath } from '../task-agent/task-hand.js';
+
+const SHA40 = /^[0-9a-f]{40}$/i;
+const CARD = /^ta-[a-z0-9-]{1,80}$/;
+const TIMEOUT_MS = 10 * 60_000;
+const OUTPUT_LIMIT = 1024 * 1024;
+
+export interface TaRepairCompleted {
+  kind: 'ta.repair.completed'; schema: 1; card: string; pr: number; head: string;
+  runId: string; resultPath: string; completedAt: string;
+}
+
+export function parseTaRepairCompleted(value: unknown): TaRepairCompleted | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const v = value as Record<string, unknown>;
+  if (v.kind !== 'ta.repair.completed' || v.schema !== 1 || typeof v.card !== 'string' || !CARD.test(v.card)
+    || !Number.isSafeInteger(v.pr) || Number(v.pr) < 1 || typeof v.head !== 'string' || !SHA40.test(v.head)
+    || typeof v.runId !== 'string' || !/^run-[a-z0-9-]{1,100}$/i.test(v.runId)
+    || typeof v.resultPath !== 'string' || !v.resultPath.startsWith('/')
+    || typeof v.completedAt !== 'string' || !Number.isFinite(Date.parse(v.completedAt))) return null;
+  return v as unknown as TaRepairCompleted;
+}
+
+export interface TaRepairCollectDeps {
+  statePath?: string;
+  /** Test entry for a child that runs the real tasks CLI with isolated dependencies. */
+  cliBin?: string;
+  read?: (path: string) => string;
+  run?: (card: string) => Promise<{ code: number | null; output: string; truncated?: boolean }>;
+  now?: () => Date;
+  log?: (data: Record<string, unknown>) => void;
+}
+
+function defaultRun(card: string, statePath: string, cliBin?: string): Promise<{ code: number | null; output: string; truncated?: boolean }> {
+  return new Promise(done => {
+    const child = spawnElanous(['tasks', 'rejudge', card, '--json'], { stateDir: dirname(statePath),
+      ...(cliBin ? { bin: cliBin } : {}), stdio: ['ignore', 'pipe', 'pipe'] });
+    let output = '';
+    let truncated = false;
+    let settled = false;
+    let force: ReturnType<typeof setTimeout> | undefined;
+    const finish = (code: number | null) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (force) clearTimeout(force);
+      done({ code, output, truncated });
+    };
+    const timer = setTimeout(() => {
+      child.kill('SIGTERM');
+      // Keep the card lock until close confirms the child has stopped writing the card.
+      force = setTimeout(() => { child.kill('SIGKILL'); }, 5000);
+    }, TIMEOUT_MS);
+    const append = (chunk: unknown) => {
+      const next = output + String(chunk);
+      if (next.length > OUTPUT_LIMIT) { truncated = true; output = next.slice(-OUTPUT_LIMIT); }
+      else output = next;
+    };
+    child.stdout?.on('data', append);
+    child.stderr?.on('data', append);
+    // Node emits close after error, including spawn failure. An error can also
+    // describe a failed kill while the child is still alive: keep the lock.
+    child.once('error', (error) => { append(`\nchild error: ${String(error)}`); });
+    child.once('close', finish);
+  });
+}
+
+function childConsumedRepair(output: string, event: TaRepairCompleted): boolean {
+  for (const line of output.split(/\r?\n/).reverse()) {
+    if (!line.trimStart().startsWith('[')) continue;
+    try {
+      const rows: unknown = JSON.parse(line);
+      if (Array.isArray(rows) && rows.some(row => row && typeof row === 'object' && row.card === event.card
+        && row.pr === event.pr && row.repairRunId === event.runId && row.repairHead === event.head
+        && row.step === 'repair' && (row.decision === 'repair-applied' || row.decision === 'repair-failed'))) return true;
+    } catch { /* not a JSON result line */ }
+  }
+  return false;
+}
+
+/** One event may start one card rejudge. A periodic rejudge can race; its existing card CAS still owns side effects. */
+export async function collectTaRepairCompleted(input: unknown, deps: TaRepairCollectDeps = {}): Promise<'invalid' | 'duplicate' | 'deferred' | 'collected'> {
+  const event = parseTaRepairCompleted(input);
+  if (!event) return 'invalid';
+  const statePath = deps.statePath ?? taskAgentStatePath();
+  const emit = (outcome: string, extra: Record<string, unknown> = {}) => {
+    const collectedAt = (deps.now?.() ?? new Date()).toISOString();
+    const data = { card: event.card, pr: event.pr, runId: event.runId, completedAt: event.completedAt,
+      collectedAt, ...(outcome === 'collected' ? { latencyMs: Date.parse(collectedAt) - Date.parse(event.completedAt) } : {}),
+      delivery: 'event', outcome, ...extra };
+    try { (deps.log ?? ((d) => debug.log('task-agent', 'ta.repair.collected', d)))(data); } catch { /* observability cannot change the result */ }
+  };
+  let card;
+  try { card = readTaskCard(event.card, statePath); } catch { emit('deferred', { reason: 'card unreadable' }); return 'deferred'; }
+  const repair = Array.isArray(card?.repairs) ? card.repairs.find(entry => entry && typeof entry === 'object' && entry.runId === event.runId) : undefined;
+  if (!repair || repair.pr !== event.pr || typeof repair.head !== 'string' || repair.head.toLowerCase() !== event.head.toLowerCase()
+    || typeof repair.resultPath !== 'string' || !repair.resultPath.startsWith('/')
+    || resolve(repair.resultPath) !== resolve(event.resultPath)) { emit('invalid', { reason: 'event differs from card binding' }); return 'invalid'; }
+  if (repair.status !== 'requested') { emit('duplicate', { reason: `repair ${repair.status}` }); return 'duplicate'; }
+  let result;
+  try { result = parseRepairWorkerResult((deps.read ?? ((path) => readFileSync(path, 'utf8')))(repair.resultPath), event.pr, event.head, event.runId); }
+  catch { /* periodic tick can recover a missing result */ }
+  if (!result) { emit('deferred', { reason: 'worker result missing or invalid' }); return 'deferred'; }
+
+  // Existing PID-aware lock recovers a dead daemon without making later events wait forever.
+  // A live holder keeps the lock through the child process; the card CAS covers periodic-tick races.
+  const lock = join(dirname(statePath), 'steward', 'ta-repair-collect', `${event.card}.lock`);
+  let release: () => void;
+  try {
+    mkdirSync(dirname(lock), { recursive: true });
+    release = acquireLockSync(lock, { breakDeadHolder: true, staleMs: TIMEOUT_MS + 60_000, maxTries: 2 });
+  }
+  catch { emit('deferred', { reason: 'collector busy; periodic fallback remains' }); return 'deferred'; }
+  try {
+    // Recheck after claiming: another collector or the periodic tick may have consumed the file.
+    const current = readTaskCard(event.card, statePath);
+    const latest = Array.isArray(current?.repairs) ? current.repairs.find(entry => entry && typeof entry === 'object' && entry.runId === event.runId) : undefined;
+    if (!latest || latest.status !== 'requested' || latest.pr !== event.pr || typeof latest.head !== 'string'
+      || latest.head.toLowerCase() !== event.head.toLowerCase() || typeof latest.resultPath !== 'string'
+      || !latest.resultPath.startsWith('/') || resolve(latest.resultPath) !== resolve(event.resultPath)) { emit('duplicate'); return 'duplicate'; }
+    const child = await (deps.run ?? ((card) => defaultRun(card, statePath, deps.cliBin)))(event.card);
+    const after = readTaskCard(event.card, statePath)?.repairs?.find(entry => entry.runId === event.runId);
+    const consumed = child.code === 0 && !child.truncated && after?.status !== 'requested' && after !== undefined
+      && childConsumedRepair(child.output, event);
+    const outcome = consumed ? 'collected' : child.truncated ? 'deferred' : after && after.status !== 'requested' ? 'duplicate' : 'deferred';
+    emit(outcome, { rc: child.code, repairStatus: after?.status,
+      ...(child.truncated ? { reason: 'rejudge output exceeded 1 MiB; event attribution unmeasured' } : {}),
+      detail: child.output.slice(-300) });
+    return consumed ? 'collected' : outcome === 'duplicate' ? 'duplicate' : 'deferred';
+  } catch (error) {
+    emit('deferred', { reason: String(error).slice(-300) });
+    return 'deferred';
+  } finally { release(); }
+}
+
+/** Bridge child-process inside events to Nexus pub/sub; keep the handler nonblocking. */
+export function startTaRepairEventCollector(bus: NexusEventBus, deps: TaRepairCollectDeps = {}): () => void {
+  const unsubscribeBus = bus.subscribe(event => {
+    void collectTaRepairCompleted(event.detail, deps).catch(error => {
+      try { debug.log('task-agent', 'ta.repair.collect-error', { reason: String(error).slice(-300) }, { level: 'warn' }); }
+      catch { /* observer failure cannot reject the Nexus callback */ }
+    });
+  }, ['ta.repair.completed']);
+  const unsubscribeInside = subscribeInsideEvent((event: InsideLiveEvent) => {
+    if (event.kind !== 'ta.repair.completed') return;
+    bus.publish({ kind: 'ta.repair.completed', ts: Date.now(), detail: event as unknown as Record<string, unknown> });
+  });
+  return () => { unsubscribeInside(); unsubscribeBus(); };
+}

package/src/task-agent/card-evidence.ts

@@ -76,7 +76,27 @@ export function podChildRunIds(host: readonly RunLedgerEntry[] | null, runId?: s
     && RUN_ID.test(entry.data.childRunId) && entry.data.childRunId !== runId).map((entry) => entry.data.childRunId as string))];
 }
 
-/** 순수 — 카드 런의 골 id · PR. PR 은 호스트 → 자식(나중 자식 먼저) → job-finished 순으로 처음 찾은 것. */
+/**
+ * TA-BIND-PR-TERMINAL — 부모(호스트) 원장의 `pr-terminal{childRunId, prNumber, prUrl}`(draft-residue `applyPodTerminal`).
+ * gate-failed draft 자식은 `pr-opened` 없이 `rework-blocked-draft-pr`·`pr.comment.mode` 만 남겨서, PR 근거는 부모의 이 줄뿐이다.
+ * 자식은 부모의 `pod-child-run` 자식이어야 하고, url 은 같은 번호의 PR 주소여야 한다. 나중 줄이 먼저다.
+ */
+export function podTerminalPr(host: readonly RunLedgerEntry[] | null, childRunIds: readonly string[]): { number: number; url: string; childRunId: string } | undefined {
+  const children = new Set(childRunIds);
+  for (let at = (host?.length ?? 0) - 1; at >= 0; at--) {
+    const entry = host![at]!;
+    if (entry.event !== 'pr-terminal') continue;
+    const childRunId = entry.data?.childRunId;
+    const number = entry.data?.prNumber;
+    const url = entry.data?.prUrl;
+    if (typeof childRunId !== 'string' || !children.has(childRunId) || !Number.isSafeInteger(number) || (number as number) <= 0
+      || typeof url !== 'string' || PR_URL.exec(url)?.[1] !== String(number)) continue;
+    return { number: number as number, url, childRunId };
+  }
+  return undefined;
+}
+
+/** 순수 — 카드 런의 골 id · PR. PR 은 호스트 → 자식(나중 자식 먼저) → 호스트 `pr-terminal` → job-finished 순으로 처음 찾은 것. */
 export function bindCardEvidence(card: Pick<TaskCard, 'runId'>, snapshot: CardRunSnapshot): CardRunEvidence {
   if (!card.runId || !snapshot.host) return { ledgerFound: false };
   const children = podChildRunIds(snapshot.host, card.runId).reverse();
@@ -88,6 +108,10 @@ export function bindCardEvidence(card: Pick<TaskCard, 'runId'>, snapshot: CardRu
     const found = entries ? lastPr(entries) : undefined;
     if (found) { pr = found; childRunId = id; }
   }
+  if (!pr) {
+    const terminal = podTerminalPr(snapshot.host, children);
+    if (terminal) { pr = { number: terminal.number, url: terminal.url }; childRunId = terminal.childRunId; }
+  }
   for (const id of children) {
     if (pr) break;
     const finish = [...(snapshot.podFinishes ?? [])].reverse().find((row) => row.childRunId === id && PR_URL.test(row.prUrl));

package/src/task-agent/green-sweep.ts

@@ -19,6 +19,7 @@ export interface GreenSweepPr {
   state: string;
   mergeSha?: string;
   url?: string;
+  viaTrain?: { integrationPr: number };
 }
 export interface GreenSweepDecision {
   cell: string;
@@ -112,7 +113,8 @@ export function decideGreenSweep(input: {
   const { item, candidate, pr } = input;
   const mergeSha = pr?.mergeSha && /^[a-f0-9]{40}$/i.test(pr.mergeSha) ? pr.mergeSha : null;
   const result = (verdict: GreenSweepVerdict, reason: string): GreenSweepDecision => {
-    const evidence = `GREEN-FROM-LEDGER: PR #${candidate.pr}${mergeSha ? ` merged ${mergeSha}` : ''} · ${verdict} · ${reason}`;
+    const landing = pr?.viaTrain ? ` via train #${pr.viaTrain.integrationPr}` : '';
+    const evidence = `GREEN-FROM-LEDGER: PR #${candidate.pr}${landing}${mergeSha ? ` merged ${mergeSha}` : ''} · ${verdict} · ${reason}`;
     return { cell: item.id, pr: candidate.pr, mergeSha, source: candidate.source, verdict, reason,
       evidence, existingEvidence: item.evidence ?? '', plannedEvidence: appendGreenSweepEvidence(item.evidence, evidence) };
   };
@@ -122,6 +124,9 @@ export function decideGreenSweep(input: {
   if (input.repositoryMatches === false) return result('skip', 'repository-mismatch');
   if (input.repositoryMatches !== true) return result('record-only', 'repository-unreadable');
   if (pr.state !== 'MERGED') return result('skip', `pr-${pr.state.toLowerCase()}`);
+  if (pr.viaTrain && (candidate.card?.trainLanding?.componentPr !== candidate.pr
+    || candidate.card.trainLanding.integrationPr !== pr.viaTrain.integrationPr
+    || candidate.card.trainLanding.mergeSha !== pr.mergeSha)) return result('skip', 'train-binding-mismatch');
   if (!mergeSha) return result('skip', 'merge-sha-unreadable');
   if (input.ancestor === null) return result('record-only', 'origin-main-ref-unverified');
   if (!input.ancestor) return result('skip', 'merge-sha-not-on-origin-main');
@@ -159,8 +164,8 @@ export function decideGreenSweep(input: {
   if (typeof card.pr === 'object' && pr.url && card.pr.url
     && card.pr.url.replace(/\/+$/, '') !== pr.url.replace(/\/+$/, ''))
     return result('record-only', 'card-pr-url-mismatch');
-  if (card.prTerminal?.state === 'CLOSED') return result('record-only', 'card-terminal-conflict');
-  return result('green', card.postLand?.outcome === 'complete' ? 'bound-card-complete' : 'bound-card-merged');
+  if (card.prTerminal?.state === 'CLOSED' && !pr.viaTrain) return result('record-only', 'card-terminal-conflict');
+  return result('green', card.postLand?.outcome === 'complete' ? 'bound-card-complete' : pr.viaTrain ? 'bound-card-train-merged' : 'bound-card-merged');
 }
 
 /** Every candidate emits one structured decision, including refusals. */

package/src/task-agent/judge.ts

@@ -24,6 +24,8 @@ export interface TaskJudgeInput {
   stopReason?: SupervisorStopReason;
   prState?: 'OPEN' | 'MERGED' | 'CLOSED';
   pr?: string | number;
+  /** Complete PR target paths when measured. Unknown is omitted, never treated as zero code diff. */
+  prTargetPaths?: readonly string[];
   /** `self review --json` 판정. 관측 못 했으면 비운다(«통과»로 읽지 않는다). */
   review?: 'pass' | 'fail';
   mustFix?: readonly string[];
@@ -36,6 +38,42 @@ export interface TaskJudgeInput {
   evidence?: { ok: boolean; ref: string };
   /** Only classified terminal evidence; an absent input preserves the existing stop-reason table. */
   terminalRun?: { kind: typeof STOP_CLASS_POD_FAILURE | typeof STOP_CLASS_NO_LAUNCH; reason: string; hasPr: boolean; hasHarvestBranch: boolean };
+  /**
+   * 같은 칸(checklistId)의 앞 런들 — 재발사 계열 수를 고르기 «전»에 받는 «선례»(RFC adaptive-graph-ops §9.10).
+   * 없으면 지금 표 그대로(입력이 비어도 동작한다 — RUN-TAG-REWORK 가 원장에 서명을 달면 여기 입력이 된다).
+   */
+  precedents?: readonly TaskPrecedent[];
+  /** 판정 관측 훅 — `task-agent.judge` 이벤트에 precedent {matched, priorRunId, signature} 를 싣는다. 없으면 관측 없이 종전 동작. */
+  observe?: (event: 'task-agent.judge', data: { precedent: { matched: boolean; priorRunId?: string; signature?: string } }) => void;
+}
+
+/** 같은 칸의 앞 런 한 건 — 결말(outcome)과 must-fix 서명. `outcome: 'alternative-failed'` 는 «대안도 같은 서명으로 실패했다»는 예약 결말이다. */
+export interface TaskPrecedent {
+  runId: string;
+  outcome: string;
+  signature: string;
+}
+
+/** must-fix 서명의 분류 축(남은 must-fix 의 성격) — 해시에 함께 박는다. */
+export const MUST_FIX_CLASSIFICATION = 'implementation-deficit';
+
+/**
+ * 남은 must-fix 원문을 정규화(공백 접기·trim·정렬)한 해시 ⊕ 분류 — 같은 칸의 앞 런과 비교하는 «서명».
+ * must-fix 가 비면 서명도 없다(선례 비교 없음).
+ */
+export function mustFixSignature(mustFix?: readonly string[]): string | undefined {
+  const normalized = [...(mustFix ?? [])]
+    .map(fix => (typeof fix === 'string' ? fix.trim().replace(/\s+/gu, ' ') : ''))
+    .filter(Boolean)
+    .sort();
+  if (!normalized.length) return undefined;
+  let hash = 0x811c9dc5;
+  const text = `${MUST_FIX_CLASSIFICATION}:${JSON.stringify(normalized)}`;
+  for (let i = 0; i < text.length; i++) {
+    hash ^= text.charCodeAt(i);
+    hash = Math.imul(hash, 0x01000193) >>> 0;
+  }
+  return `fnv1a-${hash.toString(16).padStart(8, '0')}`;
 }
 
 export interface TaskJudgement {
@@ -83,12 +121,22 @@ const RETRY_MOVE_OF_VARIANT: Record<RetryVariant, LiveRetryMove> = {
   alternative: 'alternative',
 };
 
+/** Only a measured complete file list can establish zero implementation target diff. */
+export function isGoalOnlyPr(paths: readonly string[] | undefined): boolean {
+  return paths !== undefined && paths.every((path) => /^docs\/goals\/[^/]+(?:\/.*)?$/.test(path));
+}
+
 /** 실행부 `retry` 가 어느 수인가 — 갈래 없는 재발사(리뷰 fail 의 must-fix 재발사)는 «좁혀 재발사»다. */
 export function retryMoveOf(variant?: RetryVariant): LiveRetryMove {
   return RETRY_MOVE_OF_VARIANT[variant ?? 'narrow'];
 }
 
 function base(input: TaskJudgeInput): Omit<TaskJudgement, 'executorKind'> {
+  // A goal document is a launch artifact. Its PR cannot prove implementation progress,
+  // even when the PR has merged. Waiting also prevents the same goal's live retry.
+  if (input.pr && isGoalOnlyPr(input.prTargetPaths)) {
+    return { move: 'wait', stage: 'escalated', reason: `goal-only-pr — PR ${input.pr} target diff 0; 같은 골 재큐 중지·구현 근거 필요` };
+  }
   if (input.deliveryEvidence) return input.deliveryEvidence.ok
     ? { move: 'propose-green', stage: 'closing', reason: `전달 근거 확인: ${input.deliveryEvidence.files.join(', ')}` }
     : { move: 'wait', stage: 'waiting', reason: input.deliveryEvidence.reason };
@@ -139,16 +187,34 @@ function base(input: TaskJudgeInput): Omit<TaskJudgement, 'executorKind'> {
 /** 재발사 계열 — 대안(alternative)이 실패한 «같은 실패 흐름»에 속하는 수. */
 const RETRY_FAMILY: ReadonlySet<TaskMove> = new Set<TaskMove>(['narrow-relaunch', 'wait-retry', 'salvage-relaunch']);
 
+/**
+ * 선례가 «같은 수로 재발사»를 막는 수 — narrow·salvage·그 자신(alternative).
+ * 대기 후 재시도(wait-retry)는 «같은 수로 재발사»가 아니므로 선례 승격에서는 제외.
+ */
+const PRECEDENT_RELAUNCH_FAMILY: ReadonlySet<TaskMove> = new Set<TaskMove>(['narrow-relaunch', 'salvage-relaunch']);
+
 /**
  * 종료 어휘·관측에서 다음 한 수를 고른다. 같은 수 2회 실패 → 다른 수 → 그것도 실패 → 결정 카드.
  *
  * ⭐ 새 관측이 이긴다(사후 리뷰 must-fix · #24453): 병합된 PR(propose-green)·종료 미관측(wait)·표 밖 어휘(decision-card)는
  * 실패 셈과 무관하게 그대로 간다. 「대안도 실패 → 결정 카드」 승격은 지금 수가 같은 실패 흐름일 때만 —
  * 재발사 계열이거나, 그 수 자신이 이미 같은 수 한도만큼 실패했을 때다.
+ *
+ * ⭐ 선례(RFC adaptive-graph-ops §9.10): 이번 런의 must-fix 서명이 앞 런 서명과 같으면 같은 수로 재발사하지 않는다 —
+ * narrow/salvage → alternative, alternative 자신(또는 선례 결말이 `alternative-failed`)이면 결정 카드.
+ * 선례가 없으면 지금 표 그대로.
  */
 export function judgeNextMove(input: TaskJudgeInput): TaskJudgement {
   const failures = input.failures ?? {};
   let judged = base(input);
+  const signature = mustFixSignature(input.mustFix);
+  // 같은 서명 일치 «전체»를 스캔한다 — `alternative-failed` 유무는 목록 어느 위치에 있든 먼저 판정한다(anyMatch 우선, 순서 무관).
+  const sameSignature = signature !== undefined
+    ? (input.precedents ?? []).filter(prec => typeof prec?.signature === 'string' && prec.signature === signature
+      && typeof prec?.runId === 'string' && prec.runId !== '')
+    : [];
+  const matched = sameSignature[0];
+  input.observe?.('task-agent.judge', { precedent: { matched: matched !== undefined, priorRunId: matched?.runId, signature } });
   const escalatable = judged.move !== 'wait' && judged.move !== 'decision-card' && judged.move !== 'propose-green';
   const exhausted = escalatable && (failures[judged.move] ?? 0) >= SAME_MOVE_FAILURE_LIMIT;
   const inFailingFlow = RETRY_FAMILY.has(judged.move) || exhausted;
@@ -157,6 +223,16 @@ export function judgeNextMove(input: TaskJudgeInput): TaskJudgement {
   } else if (exhausted) {
     judged = { move: 'alternative', stage: 'repairing', reason: `같은 수 ${SAME_MOVE_FAILURE_LIMIT}회 실패 — 다른 수 선택 (${judged.move})` };
   }
+  // 선례 승격 — 실패 승격 다음: 이번 수가 같은 서명 앞 런의 수와 겹치지 않게 한다(같은 수로 재발사 차단).
+  if (matched !== undefined && (PRECEDENT_RELAUNCH_FAMILY.has(judged.move) || judged.move === 'alternative')) {
+    if (judged.move === 'alternative' || sameSignature.some(prec => prec.outcome === 'alternative-failed')) {
+      judged = { move: 'decision-card', stage: 'escalated',
+        reason: `같은 must-fix 서명 선례 ${matched.runId} — 대안도 같은 서명으로 실패 — 사람 결정 (서명 ${signature})` };
+    } else {
+      judged = { move: 'alternative', stage: 'repairing',
+        reason: `같은 must-fix 서명 선례 ${matched.runId} — 같은 수로 재발사하지 않고 다른 수 선택 (서명 ${signature})` };
+    }
+  }
   const executorKind = EXECUTOR_KIND[judged.move];
   const executorVariant = EXECUTOR_VARIANT[judged.move];
   if (!executorKind) return judged;

package/src/task-agent/land-queue.ts

@@ -0,0 +1,79 @@
+/** TA-LAND-AFTER-REVIEW: a configured queue adapter after exact-head review and remote changed gate. */
+import { spawn } from 'node:child_process';
+import { mkdirSync, readFileSync } from 'node:fs';
+import { dirname, isAbsolute, join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { parseReviewResultOutput } from './review-result-capture.js';
+
+type CommandResult = { status: number; stdout: string; stderr: string };
+export interface QueueLandingInput {
+  card: string; pr: number; head: string; cwd: string; statePath: string; reviewResult: string;
+  command: string; remote: string; entry: string; configDir: string;
+}
+export interface QueueLandingDeps {
+  run?: (command: string, args: string[], cwd: string, env?: NodeJS.ProcessEnv) => Promise<CommandResult>;
+  read?: (path: string) => string;
+}
+
+async function run(command: string, args: string[], cwd: string, env?: NodeJS.ProcessEnv): Promise<CommandResult> {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { cwd, env: env ?? process.env, stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = ''; let stderr = '';
+    child.stdout.on('data', (chunk: Buffer) => { stdout = (stdout + chunk.toString()).slice(-4000); });
+    child.stderr.on('data', (chunk: Buffer) => { stderr = (stderr + chunk.toString()).slice(-4000); });
+    child.once('error', reject);
+    child.once('close', (code) => resolve({ status: code ?? 1, stdout, stderr }));
+  });
+}
+
+/** The adapter owns no merge authority. Its only successful result is a confirmed queue row. */
+export async function runQueuedLanding(input: QueueLandingInput, deps: QueueLandingDeps = {}): Promise<CommandResult> {
+  const invoke = deps.run ?? run;
+  const read = deps.read ?? ((path: string) => readFileSync(path, 'utf8'));
+  const fail = (stage: string, reason: string): CommandResult => ({ status: 1, stdout: '', stderr: `${stage}: ${reason.slice(-500)}` });
+  if (!/^[a-f0-9]{40}$/i.test(input.head) || !Number.isSafeInteger(input.pr) || input.pr < 1) return fail('input', 'invalid PR/head');
+  if (!isAbsolute(input.command) || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(input.remote)) return fail('config', 'land queue command/remote invalid');
+  let review: ReturnType<typeof parseReviewResultOutput>;
+  try { review = parseReviewResultOutput(read(input.reviewResult)); }
+  catch (error) { return fail('review', String(error)); }
+  if (!review || review.pr !== input.pr || review.head?.toLowerCase() !== input.head.toLowerCase()
+    || review.reviewed !== true || !['pass', 'warn'].includes(review.verdict ?? '') || review.mustFix !== 0 || review.error) {
+    return fail('review', `exact head #${input.pr} ${input.head.slice(0, 12)} PASS/WARN mf0 not proven`);
+  }
+  const git = async (args: string[]) => invoke(process.execPath, [input.entry, '--config-dir', input.configDir, 'git', ...args], input.cwd);
+  const fetched = await git(['fetch', '--quiet', 'origin', 'main']);
+  if (fetched.status !== 0) return fail('base-fetch', fetched.stderr || fetched.stdout || `exit ${fetched.status}`);
+  const base = await git(['rev-parse', '--verify', 'origin/main']);
+  const baseHead = base.stdout.trim().split(/\s+/)[0];
+  if (base.status !== 0 || !/^[a-f0-9]{40}$/i.test(baseHead ?? '')) return fail('base', 'origin/main commit unmeasured');
+  const local = await git(['rev-parse', '--verify', 'HEAD']);
+  if (local.status !== 0 || local.stdout.trim().split(/\s+/)[0]?.toLowerCase() !== input.head.toLowerCase()) return fail('head', 'queue worktree HEAD differs from PR head');
+  const safeCard = input.card.replace(/[^A-Za-z0-9._-]/g, '_');
+  const artifact = join(dirname(input.statePath), 'land-queue-gates', `${safeCard}-${input.pr}-${input.head.slice(0, 12)}-${randomUUID()}`);
+  mkdirSync(artifact, { recursive: true });
+  const gate = await invoke(process.execPath, [input.entry, '--config-dir', input.configDir,
+    'self', 'gate', '--changed', '--base', baseHead!, '--remote', input.remote, '--shards', '4', '--artifact-dir', artifact], input.cwd);
+  if (gate.status !== 0) return fail('remote-changed-gate', gate.stderr || gate.stdout || `exit ${gate.status}`);
+  let summary: Record<string, unknown>;
+  try { summary = JSON.parse(read(join(artifact, 'summary.json'))) as Record<string, unknown>; }
+  catch (error) { return fail('remote-changed-gate', `summary unreadable: ${String(error)}`); }
+  if (summary.head40 !== input.head || summary.base40 !== baseHead || summary.remoteHost !== input.remote
+    || summary.verdict !== 'passed' || summary.exitCode !== 0 || summary.introduced !== 0
+    || summary.unknown !== 0 || summary.preconditionUnmet !== 0) {
+    return fail('remote-changed-gate', 'summary does not prove this head/base/remote passed with zero unknown');
+  }
+  const fresh = await invoke('gh', ['pr', 'view', String(input.pr), '--json', 'headRefOid,state,isDraft'], input.cwd);
+  let latest: { headRefOid?: unknown; state?: unknown; isDraft?: unknown };
+  try { latest = JSON.parse(fresh.stdout) as typeof latest; }
+  catch { return fail('pr-head', `current PR state unreadable: ${fresh.stderr || fresh.stdout || fresh.status}`); }
+  if (fresh.status !== 0 || latest.state !== 'OPEN' || latest.isDraft !== false
+    || typeof latest.headRefOid !== 'string' || latest.headRefOid.toLowerCase() !== input.head.toLowerCase()) {
+    return fail('pr-head', `PR #${input.pr} changed after gate or is not ready`);
+  }
+  const enrolled = await invoke(input.command, [String(input.pr), input.cwd, '--review', input.reviewResult, '--expected-head', input.head], input.cwd,
+    { ...process.env, LAND_RR_DIR: dirname(input.reviewResult) });
+  if (enrolled.status !== 0 || !new RegExp(`^OK #${input.pr} head=${input.head.slice(0, 12)}(?:\\s|$)`, 'm').test(enrolled.stdout)) {
+    return fail('land-enqueue-refused', enrolled.stdout || enrolled.stderr || `exit ${enrolled.status}`);
+  }
+  return { status: 0, stdout: `queued #${input.pr} head ${input.head.slice(0, 12)} gate ${artifact} · ${enrolled.stdout.slice(-250)}`, stderr: '' };
+}

package/src/task-agent/live-moves.ts

@@ -6,7 +6,7 @@
  *   TA-REVIEW-RESULT-CAPTURE — 자식 stdout(`--json`)은 결과 파일로 받고, 자식 완료 뒤 해당 카드만 회수·재판정한다.
  *   회수한 pass 는 그 틱의 판단부·land 관문 입력(`selfReview`)이 될 뿐 land 판정 로직은 그대로다.
  * - `propose-green`: 카드에 green «제안»(`greenProposal`)만 적는다 — 체크리스트는 손대지 않는다.
- * - `propose-land`: 카드·현재 머리의 self review 통과(pass «또는» warn ⊕ must-fix 0 · TA-LAND-WARN-MUSTFIX0)·non-draft 를 확인하고 기존 `pr land` 를 머리 고정으로 한 번 부른다.
+ * - `propose-land`: 카드·현재 머리의 self review 통과(pass «또는» warn ⊕ must-fix 0 · TA-LAND-WARN-MUSTFIX0)·non-draft 를 확인한다. 큐 설정이 있으면 원격 changed gate 뒤 착지 줄에 등록하고, 없으면 기존 `pr land` 를 머리 고정으로 한 번 부른다.
  * - 사다리 R4: `narrow-relaunch` · `wait-retry` · `salvage-relaunch` · `alternative` 도 허용 목록 어휘다 — 실제 발사는 실행부
  *   `executeNextAction`(`actions.ts`)이 «목록 ⊕ 같은 수 2회 상한 ⊕ 회당 1건 ⊕ 부하 관문»을 모두 넘을 때만 한다.
  * - `decision-card`: 막힌 과제를 «근거(서명 · 화면 · must-fix)» 붙은 결정 카드로 올린다 — 근거가 하나도 없으면 카드를 올리지 않는다.
@@ -28,6 +28,7 @@ import { decisionCardGrounds, decisionRaiseArgs, type DecisionCardEvidence, type
 import { pendingReviewResults, reviewResultPath, TA_REVIEW_COMPLETION_CARD_ENV, TA_REVIEW_COMPLETION_RESULT_ENV, TA_REVIEW_COMPLETION_STATE_ENV } from './review-result-capture.js';
 import { buildPriorFixContext, PRIOR_FIX_SCOPE_LINE, priorFixBlock, priorFixObservation, type PriorDiffReader, type PriorFixContext } from './review-prior-fix.js';
 import { createLandWorktree, localBranch, localHead, observeLandWorktree, type LandWorktree, type LandWorktreeFailure, type LandWorktreeInput, type LandWorktreeRemoval } from './land-worktree.js';
+import { runQueuedLanding, type QueueLandingInput } from './land-queue.js';
 
 export const TASK_AGENT_LIVE_MOVES = ['review', 'propose-green', 'propose-land', 'decision-card', ...LIVE_RETRY_MOVES] as const;
 export type TaskAgentLiveMove = typeof TASK_AGENT_LIVE_MOVES[number];
@@ -90,6 +91,9 @@ export interface LiveMoveDeps {
   log?: (category: string, event: string, data: Record<string, unknown>) => void;
   /** TA-LAND-WORKTREE — cwd HEAD 읽기 · PR 머리 임시 워크트리 만들기(시험 주입 · 기본 = git). */
   landWorktree?: { localHead?: (cwd: string) => string | null; localBranch?: (cwd: string) => string | null; create?: (input: LandWorktreeInput) => Promise<LandWorktree | LandWorktreeFailure> };
+  /** TA-LAND-AFTER-REVIEW — injected queue adapter; absent uses configured command after a remote changed gate. */
+  queueLanding?: (input: QueueLandingInput) => Promise<{ status: number; stdout: string; stderr?: string }>;
+  landQueueConfig?: { command: string; remote: string } | null;
 }
 
 /** `executed` = 부작용을 실제로 냈다(리뷰를 띄웠다 · 제안을 적었다). ok 이지만 이미 한 수(같은 머리·이미 제안)면 false. */
@@ -101,6 +105,8 @@ export interface LiveMoveResult {
   resultPath?: string;
   /** TA-LAND-RETRY-ON-INFRA — 실행한 land 의 그 머리 몇 번째 시도인가 · 실패면 갈래(infra|judgement|base-stale)·사유·재시도 가능 여부. */
   landAttempt?: { attempt: number; class?: LandFailureClass; reason?: string; retryAllowed?: boolean };
+  /** A queue accepted this head. Merge confirmation belongs to the later train receipt. */
+  queued?: boolean;
 }
 
 export interface PrHeadView { head: string; state: string; branch?: string; url?: string }
@@ -543,10 +549,11 @@ export const LAND_RETRY_ON_INFRA_EVENT = 'land-retry-on-infra';
 
 const landedCycles = new Set<string>();
 
-/** `propose-land` — only a passing self review (pass or warn, with must-fix 0) of this exact OPEN, non-draft head may invoke pr land. */
+/** `propose-land` — only a passing self review (pass or warn, with must-fix 0) of this exact OPEN, non-draft head may enqueue or invoke pr land. */
 export async function executeLiveLand(
   card: TaskCard | undefined, pr: number | undefined,
   ctx: { runId?: string | null; cycleId?: string; cwd?: string; produced?: { headCommit?: string; branch?: string; prUrl?: string }; review?: { verdict: 'pass' | 'warn' | 'fail'; head: string; /** TA-LAND-WARN-MUSTFIX0 — `false` 면 리뷰가 실제로 안 돌았다 → land 거부. 슈퍼바이저 입력은 reviewed 리뷰로만 만들어져 칸이 없다. */ reviewed?: boolean };
+    /** Exact bytes consumed by the queue's own review check; no path means queue mode cannot proceed. */ reviewResultPath?: string;
     /** TA-REJUDGE-ON-HEAD — 겹침 증거 파일(있으면 land 에 넘길 뿐 · 판정은 그대로). */ overlapEvidence?: string;
     /** REJUDGE base-stale — 증거의 재게이트를 요청한 시각 · 그 앞의 base-stale 시도는 소비됨(`openLandAttempts`). */ gateAt?: string },
   deps: LiveMoveDeps = {},
@@ -584,6 +591,10 @@ export async function executeLiveLand(
   const mustFixCount = (ctx.review as { mustFixCount?: unknown }).mustFixCount;
   if (typeof mustFixCount !== 'number' || !Number.isSafeInteger(mustFixCount) || mustFixCount < 0) return reject(card.id, `PR #${pr} review-must-fix-unknown`, reviewRepo);
   if (mustFixCount > 0) return reject(card.id, `PR #${pr} review-warn-with-must-fix: pass carries ${mustFixCount} must-fix`, reviewRepo);
+  const queueConfig = deps.landQueueConfig === undefined ? getUserConfig().taskAgent?.landQueue : deps.landQueueConfig;
+  if (queueConfig && (!isAbsolute(queueConfig.command) || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(queueConfig.remote)))
+    return reject(card.id, `PR #${pr} land queue command/remote invalid`, reviewRepo);
+  if (queueConfig && !ctx.reviewResultPath) return reject(card.id, `PR #${pr} queue review result path missing`, reviewRepo);
   const cycle = ctx.cycleId ?? ctx.runId;
   if (cycle && landedCycles.has(cycle)) return reject(card.id, `cycle ${cycle} already landed — stays shadow`, reviewRepo);
   const path = deps.statePath ?? taskAgentStatePath();
@@ -695,11 +706,16 @@ export async function executeLiveLand(
   let failure: LandFailureClassification | undefined;
   try {
     // The CLI rechecks the pinned PR/head immediately before merge, after its own gates and freeze admission.
-    const outcome = overlapEvidence
-      ? await (deps.land ?? defaultLand)(pr, view.head, landCwd, { overlapEvidence })
-      : await (deps.land ?? defaultLand)(pr, view.head, landCwd);
+    const outcome = queueConfig
+      ? await (deps.queueLanding ?? runQueuedLanding)({ card: card.id, pr, head: view.head, cwd: landCwd, statePath: path,
+        reviewResult: ctx.reviewResultPath!, command: queueConfig.command, remote: queueConfig.remote,
+        entry: (await import('../cli/tasks-cli.js')).ELANOUS_CLI_ENTRY,
+        configDir: (await import('../elanous-config-dir.js')).getElanousConfigDirOverride() ?? (await import('../instance/resolve.js')).effectiveInstanceRoot() })
+      : overlapEvidence
+        ? await (deps.land ?? defaultLand)(pr, view.head, landCwd, { overlapEvidence })
+        : await (deps.land ?? defaultLand)(pr, view.head, landCwd);
     ok = outcome.status === 0;
-    detail = (ok ? outcome.stdout || `land merged #${pr} head ${view.head.slice(0, 12)}` : outcome.stderr || outcome.stdout || `exit ${outcome.status}`).slice(-300);
+    detail = (ok ? outcome.stdout || `${queueConfig ? 'queued' : 'land merged'} #${pr} head ${view.head.slice(0, 12)}` : outcome.stderr || outcome.stdout || `exit ${outcome.status}`).slice(-300);
     if (!ok) failure = classifyLandFailure(outcome);
   } catch (error) {
     detail = (error instanceof Error ? error.message : String(error)).slice(-300);
@@ -708,8 +724,13 @@ export async function executeLiveLand(
   const retryAllowed = failure?.class === 'infra' && attempt < LAND_ATTEMPTS_PER_HEAD_ON_INFRA;
   // 인프라 실패로 재시도가 남으면 주기 표시도 푼다 — 같은 주기 id(재판정 틱의 `rejudge:<card>:<head>`)가 그 한 번을 막지 않게.
   if (retryAllowed && cycle) landedCycles.delete(cycle);
-  if (worktree) {
-    // 성공이든 실패든 걷는다.
+  if (worktree && queueConfig && ok) {
+    // The queue row pins this exact path until the train consumes it. Removing it here
+    // would turn a successful enqueue into a guaranteed missing-tree landing failure.
+    observeLandWorktree({ card: card.id, pr, head: view.head, created: worktree.created ?? null,
+      removed: false, reason: 'queued — train owns this exact-head worktree until its receipt' }, deps.log);
+  } else if (worktree) {
+    // Direct land and rejected queue attempts no longer need the temporary checkout.
     let removal: LandWorktreeRemoval;
     try { removal = worktree.cleanup(); } catch (error) { removal = { removed: false, reason: String(error).slice(-200) }; }
     observeLandWorktree({ card: card.id, pr, head: view.head, created: worktree.created ?? null, removed: removal.removed, ...(removal.branchRemoved !== undefined ? { branchRemoved: removal.branchRemoved } : {}),
@@ -746,7 +767,7 @@ export async function executeLiveLand(
     return observe(deps, withRepo({ kind, card: card.id, ok: false, executed: true, landAttempt,
       detail: `land ${ok ? 'succeeded' : 'failed'} but card update failed: ${String(error).slice(-230)}` }));
   }
-  return observe(deps, withRepo({ kind, card: card.id, ok, executed: true, detail, landAttempt }));
+  return observe(deps, withRepo({ kind, card: card.id, ok, executed: true, detail, landAttempt, ...(queueConfig && ok ? { queued: true } : {}) }));
 }
 
 /** `propose-green` — 비지 않은 근거가 있을 때만 카드에 제안을 적는다(한 번). 체크리스트는 쓰지 않는다. */

package/src/task-agent/postland-card.ts

@@ -2,6 +2,7 @@ import { debug } from '../debug/log.js';
 import { listChecklist, setItemIfSnapshot, type Checklist } from '../release-loop/checklist.js';
 import { judgeLandedCell, parseJudgeSignals, type GreenVerdict } from '../release-loop/landed-to-green.js';
 import { cardPrNumber, readTaskAgentState, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
+import { isGoalOnlyPr } from './judge.js';
 
 export interface LandedTaskPr { number: number; url: string; headRefOid: string; state: string; baseRefName: string; mergedAt: string; files?: Array<{ path: string }> }
 export interface PostlandDeps {
@@ -32,6 +33,10 @@ export function candidateMergedTaskCells(number: number, statePath = taskAgentSt
 export function closeMergedTaskCard(pr: LandedTaskPr, cwd: string, deps: PostlandDeps): string | null {
   const log = deps.log ?? debug.log.bind(debug);
   if (pr.state !== 'MERGED' || pr.baseRefName !== 'main' || !/^[a-f0-9]{40}$/i.test(pr.headRefOid) || !pr.url) return null;
+  if (isGoalOnlyPr(pr.files?.map((file) => file.path))) {
+    log('task-agent', 'postland-card-skipped', { pr: pr.number, reason: 'goal-only-pr', targetDiff: 0 });
+    return null;
+  }
   const path = deps.statePath ?? taskAgentStatePath();
   const tasks = readTaskAgentState<{ tasks?: Record<string, TaskCard> }>(path).tasks ?? {};
   const cards = Object.values(tasks).filter((card) => card.taLand && card.checklistId && cardPrNumber(card) === pr.number