elanous 0.2.28 → 0.2.31

package/src/task-agent/prelaunch-already-done.ts

@@ -0,0 +1,98 @@
+/** TA-PRELAUNCH-ALREADY-DONE: bounded evidence against a pinned, detached main tree. */
+import { spawnSync } from 'node:child_process';
+import { realpathSync } from 'node:fs';
+import { isAbsolute } from 'node:path';
+import { inspectGoalDoneBoundary } from '../self-implement/goal-author.js';
+
+export interface AlreadyDoneCandidate { mainSha: string; repository: string; command: string; exitCode: 0 }
+export interface AlreadyDoneDecision { candidate?: AlreadyDoneCandidate; reason: string }
+
+type SafeCommand = { argv: string[]; path: string };
+const SHA = /^[0-9a-f]{40}$/i;
+const SAFE_PATH = /^[A-Za-z0-9_./-]+$/;
+
+/** A lexical command declaration is not authority to run shell or project scripts. */
+export function parseAlreadyDoneCommand(command: string): SafeCommand | null {
+  let input = command.trim();
+  while (input.length >= 2 && ((input.startsWith('`') && input.endsWith('`'))
+    || (input.startsWith('"') && input.endsWith('"')) || (input.startsWith("'") && input.endsWith("'"))))
+    input = input.slice(1, -1).trim();
+  if (!input || /[\n\r\t`$;&|<>\\'"*?()[\]{}!]/.test(input)) return null;
+  const argv = input.split(/ +/);
+  let path: string | undefined;
+  if (argv.length === 3 && argv[0] === 'test' && ['-f', '-e'].includes(argv[1]!)) path = argv[2];
+  else if (argv.length === 5 && argv[0] === 'git' && argv[1] === 'ls-files' && argv[2] === '--error-unmatch' && argv[3] === '--') path = argv[4];
+  else if (argv.length === 7 && argv[0] === 'git' && argv[1] === 'diff' && argv[2] === '--quiet'
+    && SHA.test(argv[3]!) && argv[4] === 'HEAD' && argv[5] === '--') path = argv[6];
+  if (!path || !SAFE_PATH.test(path) || isAbsolute(path) || path.startsWith('-')
+    || path.split('/').some((part) => part === '..' || part === '.' || !part)) return null;
+  return { argv, path };
+}
+
+export type PinnedGitResult = { status: number | null; stdout: string; error: boolean };
+export type PrelaunchGitRunnerForTest = (cwd: string, argv: string[], timeout?: number) => PinnedGitResult;
+
+export function runPinnedGit(cwd: string, argv: string[], timeout = 4_000, input?: string): PinnedGitResult {
+  // Trust boundary: the operator's own repository and Git config. Drop inherited GIT_* overrides,
+  // disable replace refs, hooks, and credential helpers; remote transport uses the operator's SSH config.
+  const env = { ...process.env };
+  for (const key of Object.keys(env)) if (key.startsWith('GIT_')) delete env[key];
+  const result = spawnSync('git', ['--no-replace-objects', '-c', 'core.hooksPath=/dev/null', '-c', 'credential.helper=', ...argv],
+    { cwd, env, encoding: 'utf8', timeout, maxBuffer: 64 * 1024, ...(input !== undefined ? { input } : {}) });
+  return { status: result.status, stdout: result.stdout ?? '', error: !!result.error };
+}
+
+function evaluatePinnedTree(root: string, sha: string, safe: SafeCommand, runGit: PrelaunchGitRunnerForTest): AlreadyDoneDecision {
+  const { argv, path } = safe;
+  // Every supported command names one tracked regular file in the pinned tree.
+  // A symlink's filesystem -e/-f meaning is not inferable from its Git object.
+  const entry = runGit(root, ['ls-tree', sha, '--', path]);
+  if (entry.status !== 0 || entry.error) return { reason: 'evidence-unmeasured' };
+  const match = /^(100644|100755|040000|120000) (blob|tree) [0-9a-f]{40}\t(.+)$/m.exec(entry.stdout);
+  if (!match || match[3] !== path) return { reason: 'evidence-not-passing' };
+  if (match[1] === '120000') return { reason: 'evidence-symlink-unmeasured' };
+  if (!['100644', '100755'].includes(match[1]!) || match[2] !== 'blob') return { reason: 'evidence-path-not-tracked-file' };
+  if (argv[0] === 'git' && argv[1] === 'diff') {
+    const base = argv[3]!;
+    if (base.toLowerCase() === sha.toLowerCase()) return { reason: 'diff-compares-main-to-itself' };
+    const ancestor = runGit(root, ['merge-base', '--is-ancestor', base, sha]);
+    if (ancestor.status !== 0) return { reason: 'diff-base-unverified' };
+    const diff = runGit(root, ['diff', '--no-ext-diff', '--no-textconv', '--quiet', base, sha, '--', path]);
+    return { reason: diff.status === 0 ? 'evidence-passed-on-main' : diff.status === 1 && !diff.error ? 'evidence-not-passing' : 'evidence-unmeasured' };
+  }
+  return { reason: 'evidence-passed-on-main' };
+}
+
+/** Only an explicit project repository qualifies. Unknown target means preserve the live launch. */
+export function inspectPrelaunchAlreadyDone(text: string, projectTarget?: string,
+  deps: { runGit?: PrelaunchGitRunnerForTest; realpath?: (path: string) => string } = {}): AlreadyDoneDecision {
+  const boundary = inspectGoalDoneBoundary(text);
+  if (boundary.missing.length) return { reason: `boundary-missing:${boundary.missing.join(',')}` };
+  const command = boundary.values['완료 경계 증거 명령'] ?? '';
+  const safe = parseAlreadyDoneCommand(command);
+  if (!safe) return { reason: 'evidence-command-unsupported' };
+  const codeBoundary = boundary.values['완료 경계 코드'] ?? '';
+  const realBoundary = boundary.values['완료 경계 실물'] ?? '';
+  if (codeBoundary !== `기존 추적 파일 ${safe.path}` || realBoundary !== '원격 main의 일반 파일로 존재')
+    return { reason: 'evidence-boundary-not-file-existence' };
+  if (!projectTarget) return { reason: 'project-target-unverified' };
+  let root: string;
+  try { root = (deps.realpath ?? realpathSync)(projectTarget); } catch { return { reason: 'project-target-unreadable' }; }
+  const runGit = deps.runGit ?? runPinnedGit;
+  const top = runGit(root, ['rev-parse', '--show-toplevel']);
+  if (top.status !== 0 || top.stdout.trim() !== root) return { reason: 'project-root-unverified' };
+  const origin = runGit(root, ['remote', 'get-url', 'origin']);
+  const originUrl = origin.stdout.trim();
+  // Keep credentials and arbitrary transports out of both the verifier and its card evidence.
+  const repository = /^(?:https:\/\/github\.com\/|git@github\.com:)([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?$/.exec(originUrl)?.[1];
+  if (origin.status !== 0 || !repository) return { reason: 'origin-unverified' };
+  const local = runGit(root, ['rev-parse', 'refs/remotes/origin/main']).stdout.trim();
+  const remote = runGit(root, ['ls-remote', 'origin', 'refs/heads/main'], 7_000);
+  const sha = remote.stdout.trim().split(/\s+/)[0] ?? '';
+  if (remote.status !== 0 || !SHA.test(sha) || local !== sha) return { reason: 'main-unverified-or-stale' };
+  const evaluated = evaluatePinnedTree(root, sha, safe, runGit);
+  if (evaluated.reason !== 'evidence-passed-on-main') return evaluated;
+  const remoteAgain = runGit(root, ['ls-remote', 'origin', 'refs/heads/main'], 7_000);
+  if (remoteAgain.status !== 0 || remoteAgain.stdout.trim().split(/\s+/)[0] !== sha) return { reason: 'main-moved' };
+  return { candidate: { mainSha: sha, repository, command, exitCode: 0 }, reason: 'evidence-passed-on-main' };
+}

package/src/task-agent/real-launch-guard.ts

@@ -0,0 +1,37 @@
+/**
+ * ⛔ 시험 안의 «실물 발사» 거부 — 2026-10-16 사고(R7 · OP #8751) 의 구조 방어.
+ *
+ * 무엇이 있었나: 호스트 재게이트가 시험을 운영 HOME 그대로 돌렸고, seam 이 빠진 시험 둘이 `defaultTaskLauncher` 의
+ * 원격 부모 경로(`tryRemoteParent`)로 진짜 ssh 를 쏴 원격 prod 런 25 · draft PR 11 을 만들었다.
+ * 격리 env(재게이트 러너)와 시험 seam 은 «잊음»을 줄일 뿐 «다음 시험이 seam 을 빠뜨리는 것»은 못 막는다 — 그래서
+ * 발사 지점이 bun test 안에서는 명시 허용 없이 실물 발사를 «거부»한다(fail-closed · 큰소리).
+ *
+ * - 시험 밖(제품 경로): 아무 영향 없다 — `isUnderTestRunner()` 가 거짓이면 즉시 돌아간다.
+ * - 시험 안: 주입(가짜 ssh·spawn)을 쓰면 이 가드에 닿지 않는다. 실물이 정말 필요한 시험만
+ *   `ELANOUS_TEST_ALLOW_REAL_LAUNCH=1` 로 명시 허용한다.
+ */
+import { debug } from '../debug/log.js';
+import { isUnderTestRunner } from '../oauth/store.js';
+
+export const ALLOW_REAL_LAUNCH_UNDER_TEST_ENV = 'ELANOUS_TEST_ALLOW_REAL_LAUNCH';
+
+export type RealLaunchKind = 'remote-parent-ssh' | 'local-harness-spawn';
+
+export class RealLaunchRefusedUnderTestError extends Error {
+  constructor(readonly kind: RealLaunchKind, detail: string) {
+    super(`⛔ 시험 안에서 실물 발사를 거부했다(${kind}${detail ? ` · ${detail}` : ''}) — `
+      + (kind === 'remote-parent-ssh'
+        ? 'deps.parentHost: null(원격 끔) 또는 deps.ssh 가짜를 주입하라'
+        : 'deps.spawn 가짜(또는 handToTaskAgent:\'off\' · taskLauncher 가짜)를 주입하라')
+      + ` · 실물이 정말 필요하면 ${ALLOW_REAL_LAUNCH_UNDER_TEST_ENV}=1 (2026-10-16 시험 누수 사고 R7)`);
+    this.name = 'RealLaunchRefusedUnderTestError';
+  }
+}
+
+/** bun test 안이고 명시 허용이 없으면 던진다. 시험 밖에서는 아무것도 하지 않는다. */
+export function refuseRealLaunchUnderTest(kind: RealLaunchKind, detail = '', env: NodeJS.ProcessEnv = process.env): void {
+  if (!isUnderTestRunner(env)) return;
+  if (env[ALLOW_REAL_LAUNCH_UNDER_TEST_ENV]?.trim() === '1') return;
+  try { debug.log('task-agent', 'real-launch-refused-under-test', { kind, detail }); } catch { /* fail-soft */ }
+  throw new RealLaunchRefusedUnderTestError(kind, detail);
+}

package/src/task-agent/rejudge-on-head.ts

@@ -35,6 +35,7 @@ import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { debug } from '../debug/log.js';
 import { prodInstanceRoot } from '../instance/resolve.js';
+import { getUserConfig } from '../user-config.js';
 import { loadRunLedger, type RunLedgerEntry } from '../self-implement/run-ledger.js';
 import type { DetachedSpawn } from '../cli/tasks-cli.js';
 import { remoteLedgerMirrorDir } from './parent-host.js';
@@ -46,6 +47,9 @@ import type { RepairCasOutcome, RepairCasRequest } from './repair-branch-cas.js'
 import { defaultLandPrHead, defaultPrHead, defaultReviewRepoCandidates, executeLiveLand, executeLiveReview, landRetryPending, type LiveMoveDeps, type LiveMoveResult, type PrHeadView, type ReviewRepoCandidate, type TaskAgentLiveMove } from './live-moves.js';
 import { capturedLandReview, captureReviewResults, parseReviewResultOutput, pendingReviewResults, reviewResultPath, type ParsedReviewResult } from './review-result-capture.js';
 import { boundPrTerminal, cardPrNumber, LIVE_MOVE_RESULT_EVENT, readTaskCard, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
+import { verifiedTrainLanding, type TrainLanding } from './train-landing.js';
+import { isGoalOnlyPr } from './judge.js';
+import { defaultPrFiles } from './shadow.js';
 
 export const REJUDGE_ON_HEAD_EVENT = 'rejudge-on-head';
 /** 카드·PR 당 재게이트하는 머리 수 상한(머리가 바뀔 때마다 하나) — 넘으면 멈추고 사람에게 넘긴다. */
@@ -60,6 +64,7 @@ export type CatchUpDecision = 'pushed' | 'conflict' | 'cap-reached' | 'failed';
 export interface RejudgeOutcome {
   card: string; pr: number | null; fromHead: string | null; toHead: string | null; step: RejudgeStep; decision: string; reason: string;
   fromBase?: string; toBase?: string; newHead?: string;
+  repairRunId?: string; repairHead?: string;
 }
 
 export interface RegateRequest { card: string; pr: number; head: string; repoRoot: string; resultPath: string }
@@ -77,6 +82,8 @@ export type CatchUpGit = (cwd: string, args: string[]) => { status: number | nul
 export interface RejudgeDeps {
   live?: LiveMoveDeps;
   liveMoves: ReadonlySet<TaskAgentLiveMove>;
+  /** Complete PR target paths; undefined means the PR diff could not be measured. */
+  prFiles?: (pr: number, prUrl: string) => Promise<readonly string[] | undefined>;
   /** Only phase ① shadow callbacks may inspect a previously judged head without a regate. */
   shadowSameHead?: boolean;
   /** HQ mirror proof that the bound remote child has stopped. Test seam; absence fails closed. */
@@ -89,11 +96,15 @@ export interface RejudgeDeps {
   requestRepair?: (request: RepairLaunchRequest) => Promise<void>;
   applyRepair?: (request: RepairCasRequest) => RepairCasOutcome;
   notifyRepair?: (seat: string, body: string) => void;
+  /** Shared new-launch budget for this `tasks rejudge --all` call. */
+  repairBudget?: import('./repair-cycle.js').RepairTickBudget;
   /** TA-REJUDGE-REBASE-LOOP — origin/main 을 PR 가지에 3-way merge 하고 일반 push. 시험은 주입한다. */
   catchUpMain?: (request: CatchUpRequest) => Promise<CatchUpResult>;
   log?: (category: string, event: string, data: Record<string, unknown>) => void;
   /** 시험 seam — 결과 파일 읽기(없으면 ENOENT). */
   readFile?: (path: string) => string;
+  /** Verify a CLOSED component PR against the HQ train ledger and merged integration PR. */
+  trainLanding?: (pr: number, cwd: string) => TrainLanding | null;
 }
 
 /** PR binding alone does not mean a remote parent has stopped. Require its child edge and terminal ledger row. */
@@ -281,6 +292,15 @@ export function parseRegateResult(text: string, pr: number, head: string): Regat
 const sameUrl = (a: string, b: string) => a.trim().replace(/\/+$/, '').toLowerCase() === b.trim().replace(/\/+$/, '').toLowerCase();
 const sameHead = (a: string, b: string) => a.toLowerCase() === b.toLowerCase();
 
+/**
+ * TA-REGATE-UNMEASURED — «못 잰» 재게이트(draft `pr-head` 거부·띄우기 실패 등 status=unmeasured)는 코드 판정이 아니다.
+ * 재게이트 상한(REJUDGE_HEAD_CAP)에 세지 않는다. 옛 결과 파일은 noMerge 에 status 가 없어서 draft 거부 문면으로도 가린다.
+ */
+export function regateUnmeasured(entry: { passed?: boolean; status?: string; detail?: string }): boolean {
+  return entry.passed === false && (entry.status === 'unmeasured' || /^pr-head:.*\bisDraft=true\b/.test(entry.detail ?? ''));
+}
+const cappedRegates = <T extends { passed?: boolean; status?: string; detail?: string }>(entries: readonly T[]): T[] => entries.filter((entry) => !regateUnmeasured(entry));
+
 const defaultCatchUpGit: CatchUpGit = (cwd, args) => {
   const r = spawnSync('git', args, { cwd, encoding: 'utf8', timeout: 120_000 });
   return { status: r.status, stdout: String(r.stdout ?? ''), stderr: String(r.stderr ?? '') };
@@ -414,8 +434,6 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
   // 원격 부모는 node-b 의 liveMoves 가 꺼져 리뷰 이력이 0일 수 있다. HQ 거울의 종결 증거가 있을 때만 시작한다.
   const adopted = card.adoptedPr?.pr === pr && typeof card.pr === 'object'
     && !!card.pr.url && sameUrl(card.adoptedPr.url, card.pr.url) && /^[a-f0-9]{40}$/i.test(card.adoptedPr.head);
-  if (!reviews.length && !adopted && (!card.parentHost || !(deps.remoteRunTerminal ?? remoteBoundRunTerminal)(card)))
-    return target('not-started', 'no task-agent review on this PR yet (remote terminal unproven or run not stopped/judged)', pr);
   // 떼어 띄운 재게이트 결과를 «머리와 무관하게» 먼저 회수한다 — 결과가 나오기 전에 머리가 또 바뀌어도 그 머리의 결과는 카드에 남는다.
   for (const pending of (card.regates ?? []).filter((entry) => entry.pr === pr && entry.passed === undefined && entry.resultPath)) {
     let text: string | null = null;
@@ -433,7 +451,7 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
       wrote = true;
       return { ...current, regates: current.regates.map((entry) => entry.pr === pr && entry.head === pending.head && entry.at === pending.at ? { ...entry, ...patch } : entry) };
     });
-    if (wrote) emit({ card: card.id, pr, fromHead: null, toHead: pending.head, step: 'regate', decision: patch.passed ? 'regate-passed' : 'regate-failed',
+    if (wrote) emit({ card: card.id, pr, fromHead: null, toHead: pending.head, step: 'regate', decision: patch.passed ? 'regate-passed' : regateUnmeasured(patch) ? 'regate-unmeasured' : 'regate-failed',
       reason: `head ${pending.head.slice(0, 12)} · base ${(patch as { baseCommit?: string }).baseCommit?.slice(0, 12) ?? '-'} · ${patch.detail}` }, true);
   }
   card = readTaskCard(card.id, statePath) ?? card;
@@ -451,15 +469,40 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
   if ('reason' in found) return target('pr-unreadable', found.reason, pr, fromHead);
   const { cwd, view } = found;
   const toHead = view.head;
+  const eligible = !!reviews.length || adopted || (!!card.parentHost && (deps.remoteRunTerminal ?? remoteBoundRunTerminal)(card));
+  const trustedTrain = view.state === 'CLOSED' && card.status === 'launched'
+    ? (() => { try { return (deps.trainLanding ?? verifiedTrainLanding)(pr, cwd); } catch { return null; } })() : null;
+  // An unreviewed or unproven remote card retains the old guard. Only verified train
+  // evidence may cross it; an arbitrary CLOSED PR must not disappear from rejudge.
+  if (!eligible && !trustedTrain)
+    return target('not-started', 'no task-agent review on this PR yet (remote terminal unproven or run not stopped/judged)', pr);
+  try {
+    const paths = await (deps.prFiles ?? defaultPrFiles)(pr, url);
+    if (isGoalOnlyPr(paths)) return target('goal-only-pr', `PR #${pr} target diff 0 (docs/goals/** only) — review·land·같은 골 재큐 중지`, pr, fromHead, toHead, true);
+  } catch (error) {
+    try { log('task-agent', 'pr-target-diff-unavailable', { card: card.id, pr,
+      reason: error instanceof Error ? error.message : String(error) }); } catch { /* fail-soft */ }
+  }
   if (view.state === 'MERGED' || view.state === 'CLOSED') {
     const at = now().toISOString();
+    const train = trustedTrain;
     updateTaskCard(statePath, card.id, (current) => {
       if (!current || cardPrNumber(current) !== pr || typeof current.pr !== 'object' || current.pr.url !== url) return undefined;
       const previous = boundPrTerminal(current);
-      if (previous?.state === view.state && previous.head === toHead) return undefined;
-      return { ...current, prTerminal: { pr, url, head: toHead, state: view.state as 'MERGED' | 'CLOSED', at } };
+      const alreadyLanded = train && current.trainLanding?.componentPr === pr
+        && current.trainLanding.integrationPr === train.integrationPr && current.trainLanding.mergeSha === train.mergeSha;
+      if (previous?.state === view.state && previous.head === toHead && (!train || alreadyLanded) && (!train || current.status === 'done')) return undefined;
+      return {
+        ...current,
+        ...(train ? { status: 'done' as const, trainLanding: alreadyLanded ? current.trainLanding : { ...train, at }, history: alreadyLanded ? current.history : [...(current.history ?? []), {
+          at, event: 'landed-via-train', pr, head: toHead, detail: `train #${train.integrationPr} merged ${train.mergeSha}`,
+        }] } : {}),
+        prTerminal: previous?.state === view.state && previous.head === toHead ? previous
+          : { pr, url, head: toHead, state: view.state as 'MERGED' | 'CLOSED', at },
+      };
     });
-    return target('pr-not-open', `PR #${pr} is ${view.state}`, pr, fromHead, toHead);
+    return train ? target('landed-via-train', `PR #${pr} via train #${train.integrationPr} merge ${train.mergeSha}`, pr, fromHead, toHead)
+      : target('pr-not-open', `PR #${pr} is ${view.state}`, pr, fromHead, toHead);
   }
   if (view.state !== 'OPEN') return target('pr-not-open', `PR #${pr} is ${view.state}`, pr, fromHead, toHead);
   // An explicitly rejudged PR can be reopened. Clear the old marker before normal head judgement.
@@ -533,8 +576,10 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
         mustFix: mustFix ?? [], liveMoves: deps.liveMoves, now: now(), readFile: read,
         ...(deps.requestRepair ? { request: deps.requestRepair } : {}),
         ...(deps.applyRepair ? { apply: deps.applyRepair } : {}),
-        ...(deps.notifyRepair ? { notify: deps.notifyRepair } : {}) });
-      step('repair', result.decision, result.reason, true);
+        ...(deps.notifyRepair ? { notify: deps.notifyRepair } : {}),
+        ...(deps.repairBudget ? { repairBudget: deps.repairBudget } : {}) });
+      step('repair', result.decision, result.reason, true,
+        result.repairRunId && result.repairHead ? { repairRunId: result.repairRunId, repairHead: result.repairHead } : {});
       return outcomes;
     }
   }
@@ -582,6 +627,40 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
     return outcomes;
   }
 
+  // TA-LAND-AFTER-REVIEW: configured queue mode owns its one remote changed gate inside
+  // the queue adapter. The older host regate below is the direct-merge path only.
+  const queueMode = live.landQueueConfig === undefined ? getUserConfig().taskAgent?.landQueue : live.landQueueConfig;
+  if (queueMode) {
+    const latest = readTaskCard(card.id, statePath) ?? card;
+    const priorQueue = (latest.landAttempts ?? []).filter((entry) => entry.pr === pr && sameHead(entry.head, toHead));
+    if (priorQueue.length && !landRetryPending(latest, pr, toHead)) {
+      step('land', 'queue-skipped', `PR #${pr} head ${toHead.slice(0, 12)} already claimed or queued`, false);
+      return outcomes;
+    }
+    const review = capturedLandReview(latest, pr, toHead);
+    if (!review || review.mustFixCount !== 0) {
+      if (pendingReviewResults(latest).some((entry) => entry.pr === pr && sameHead(entry.head, toHead))) {
+        step('review', 'awaiting-review-result', 'exact-head review result pending', false);
+      } else if (!latest.reviewRequests?.some((entry) => entry.pr === pr && sameHead(entry.head, toHead)) && deps.liveMoves.has('review')) {
+        const before = { reviewRequests: latest.reviewRequests, landAttempts: latest.landAttempts };
+        const result = await executeLiveReview(latest, pr, { runId: latest.runId ?? null, stopReason: 'queue-exact-head', cwd }, { ...live, ...(deps.log ? { log: deps.log } : {}) });
+        recordMove(statePath, latest.id, latest.runId, 'review', result, pr, before, now, deps.log);
+        step('review', result.executed ? 'review-requested' : 'review-request-failed', result.detail, true);
+      } else step('review', 'not-landing', 'exact-head PASS/WARN mf0 review not captured', true);
+      return outcomes;
+    }
+    if (!readyConfirmed) { step('ready', 'ready-unconfirmed', 'exact-head ready PR not confirmed', false); return outcomes; }
+    if (!deps.liveMoves.has('propose-land')) { step('land', 'would-land', 'propose-land not enabled — queue shadow', false); return outcomes; }
+    const reviewResult = latest.reviewRequests?.find((entry) => entry.pr === pr && sameHead(entry.head, toHead) && entry.resultPath)?.resultPath;
+    if (!reviewResult) { step('land', 'not-landing', 'exact-head review JSON path missing', true); return outcomes; }
+    const before = { reviewRequests: latest.reviewRequests, landAttempts: latest.landAttempts };
+    const queued = await executeLiveLand(latest, pr, { runId: latest.runId ?? null, cycleId: `queue:${latest.id}:${toHead}`, cwd,
+      review, reviewResultPath: reviewResult }, { ...live, landQueueConfig: queueMode, ...(deps.log ? { log: deps.log } : {}) });
+    recordMove(statePath, latest.id, latest.runId, 'propose-land', queued, pr, before, now, deps.log);
+    step('land', queued.queued ? 'queued' : queued.ok && !queued.executed ? 'queue-skipped' : 'queue-refused', queued.detail, true);
+    return outcomes;
+  }
+
   const tryCatchUp = async (fromBase: string | undefined, why: string): Promise<boolean> => {
     const prior = catchUpHistory(card!, pr);
     // 상한은 «실제 push» 만 센다 — 충돌·실패 뒤 사람이 새 머리를 올리면 다시 시도할 수 있어야 한다.
@@ -650,8 +729,9 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
   if (!regate || staleBase || retryDraft) {
     const why = staleBase ? `base-stale-overlap — gate base ${staleBase.slice(0, 12)} went stale (${(stale!.reason ?? '').replace(/^base-stale-overlap:\s*/, '').slice(0, 160)})`
       : retryDraft ? 'draft rejection became stale after PR ready' : '';
-    if (regates.length >= REJUDGE_HEAD_CAP) {
-      step('regate', 'cap-reached', `${why ? `${why} · ` : ''}re-gated ${regates.length} times already (cap ${REJUDGE_HEAD_CAP}) — no more rejudge; needs owner`, true);
+    const counted = cappedRegates(regates).length;
+    if (counted >= REJUDGE_HEAD_CAP) {
+      step('regate', 'cap-reached', `${why ? `${why} · ` : ''}re-gated ${counted} times already (cap ${REJUDGE_HEAD_CAP} · unmeasured ${regates.length - counted} not counted) — no more rejudge; needs owner`, true);
       return outcomes;
     }
     if (!deps.liveMoves.has('propose-land')) step('regate', 'would-regate', `${why ? `${why} · ` : ''}propose-land not enabled in taskAgent.liveMoves — shadow`, false);
@@ -667,7 +747,7 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
         if (!current || held.some((entry) => sameHead(entry.head, toHead) && (staleBase ? entry.staleBase !== undefined && sameHead(entry.staleBase, staleBase)
           : retryDraft ? entry.readyRetry === true : true))) return undefined;
         // 상한은 잠금 안의 «지금» 카드로 다시 잰다 — 다른 머리를 본 두 틱이 겹쳐도 상한을 넘지 않게.
-        if (held.length >= REJUDGE_HEAD_CAP) { capped = true; return undefined; }
+        if (cappedRegates(held).length >= REJUDGE_HEAD_CAP) { capped = true; return undefined; }
         claimed = true;
         return { ...current, regates: [...(current.regates ?? []), { pr, head: toHead, at, resultPath, ...(staleBase ? { staleBase } : {}), ...(retryDraft ? { readyRetry: true as const } : {}) }] };
       });
@@ -750,7 +830,7 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
   const before = { reviewRequests: latest.reviewRequests, landAttempts: latest.landAttempts };
   // 주기 id — base-stale 재게이트 뒤의 land 는 새 base 를 붙여 앞 land 의 주기 표시(모듈 전역)와 갈린다 · gateAt 이 앞 base-stale 시도를 소비한다.
   const cycleId = `rejudge:${card.id}:${toHead}${regate.staleBase ? `:${regate.baseCommit.slice(0, 12)}` : ''}`;
-  const landed = await executeLiveLand(latest, pr, { runId: card.runId ?? null, cycleId, cwd, review, overlapEvidence, gateAt: regate.at },
+  const landed = await executeLiveLand(latest, pr, { runId: card.runId ?? null, cycleId, cwd, review, reviewResultPath: reviewResult, overlapEvidence, gateAt: regate.at },
     { ...live, ...(deps.log ? { log: deps.log } : {}) });
   // LAND-ORDER-LEDGER — executeLiveLand 직후 원장 한 줄(같은 pr+head 는 한 줄만). 쓰기가 실패해도 land 결과는 그대로(삼킨다).
   const landOrderLog = (event: 'appended' | 'append-failed') => { try { log('task-agent.land-order', event, { pr, head: toHead }); } catch { /* fail-soft */ } };
@@ -768,7 +848,7 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
   const attempt = landed.landAttempt?.class
     ? ` · land-class ${landed.landAttempt.class} (${landed.landAttempt.reason}) · attempt ${landed.landAttempt.attempt} · ${landed.landAttempt.class === 'base-stale' ? 'base-stale → re-gate on a new base next tick (cap counts)' : landed.landAttempt.retryAllowed ? 'retry allowed on this head' : 'no retry on this head'}`
     : '';
-  step('land', landed.executed && landed.ok ? 'landed'
+  step('land', landed.queued ? 'queued' : landed.executed && landed.ok ? 'landed'
     : !landed.executed && landed.ok ? 'land-skipped' : 'land-rejected',
   `${landed.detail}${attempt} · overlap-evidence ${overlapEvidence}`, true);
   return outcomes;

package/src/task-agent/remote-rejudge-bind.ts

@@ -1,30 +1,73 @@
 /** Bind remote TA parents from the HQ ledger mirror before `rejudge --all` selects PR cards. */
-import { dirname } from 'node:path';
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { debug } from '../debug/log.js';
 import { loadRunLedger } from '../self-implement/run-ledger.js';
-import { bindCardEvidence, podChildRunIds, readCardRunSnapshot, refreshCardRunBinding } from './card-evidence.js';
-import { remoteLedgerMirrorDir } from './parent-host.js';
+import { bindCardEvidence, podChildRunIds, podTerminalPr, readCardRunSnapshot, refreshCardRunBinding } from './card-evidence.js';
+import { mirrorRemoteRunLedgers, remoteLedgerMirrorDir } from './parent-host.js';
 import { cardPrNumber, type TaskCard } from './task-hand.js';
 
+const RECENT_LAUNCH_MS = 24 * 60 * 60 * 1000;
+/**
+ * TA-BIND-PULL-ONCE — an older launch whose parent ledger was never mirrored at HQ gets one pull («묶기만»).
+ * Bounded per tick so the first tick after deploy does not run hundreds of sequential ssh reads (backlog ≈690
+ * cards on 10-15 drains over ticks); a pulled mirror is then read locally and never pulled again by this rule.
+ */
+export const UNMIRRORED_PULL_CAP_PER_TICK = 20;
+
+type BindDeps = {
+  now?: () => number;
+  mirror?: typeof mirrorRemoteRunLedgers;
+  unmirroredPullCap?: number;
+  onFailure?: (failure: { card: string; runId: string; host: string; reason: string }) => void;
+};
+
+function recentlyLaunched(card: TaskCard, now: number): boolean {
+  const launch = [...card.history].reverse().find(event => event.event === 'launch');
+  const at = Date.parse(launch?.at ?? card.createdAt);
+  return Number.isFinite(at) && at <= now && now - at < RECENT_LAUNCH_MS;
+}
+
 /**
  * A remote child PR can appear after the last HQ card refresh. A card without a PR is otherwise absent from
  * `rejudgeCandidates`, so the normal rejudge tick never reaches `mirrorRemoteCardLedger` or the binding replay.
- * Only an existing, launched TA-owned parent with a parent→child edge in its own host mirror is admitted. The
+ * Only an existing, launched parent (TA-owned or not — TA-BIND-WIDEN) with a parent→child edge in its own host
+ * mirror is bound; rejudge/land selection keeps its own taLand gate. The
  * launch registry (including foreign/test universes) and child-only ledgers are never scanned or adopted here.
  */
 export async function bindMirroredRemoteRejudgeCards(
   tasks: Readonly<Record<string, TaskCard>>, statePath: string,
-): Promise<{ scanned: number; bound: number; skipped: number }> {
+  deps: BindDeps = {},
+): Promise<{ scanned: number; bound: number; skipped: number; pulledUnmirrored: number }> {
   const root = dirname(statePath);
+  const now = (deps.now ?? Date.now)();
+  const mirror = deps.mirror ?? mirrorRemoteRunLedgers;
+  const reportFailure = (card: TaskCard, reason: string): void => {
+    const failure = { card: card.id, runId: card.runId!, host: card.parentHost!.host, reason: reason.slice(0, 300) };
+    try { (deps.onFailure ?? ((data) => debug.log('task-agent', 'remote-rejudge-bind-failed', data)))(failure); }
+    catch { /* observation must not stop the other cards */ }
+  };
   let scanned = 0;
   let bound = 0;
   let skipped = 0;
+  let pulledUnmirrored = 0;
+  const unmirroredCap = deps.unmirroredPullCap ?? UNMIRRORED_PULL_CAP_PER_TICK;
   for (const card of Object.values(tasks)) {
-    if (card.status !== 'launched' || card.taLand !== true || !card.parentHost || !card.runId
+    // TA-BIND-WIDEN — «묶기»는 taLand 와 무관하게 launched ⊕ runId 카드 전부. 묶여도 재판정(rejudge)·land 후보는
+    // `rejudgeCandidates`/`remoteBoundRunTerminal` 의 taLand 관문이 그대로 거른다 — 여기서 넓히는 것은 카드↔PR 연결뿐이다.
+    if (card.status !== 'launched' || !card.parentHost || !card.runId
       || cardPrNumber(card) !== undefined || card.refSource === 'manual') continue;
     scanned++;
     const dir = remoteLedgerMirrorDir(root, card.parentHost.host);
     try {
+      // This prepass runs before PR-based candidate selection. Pulling here breaks the otherwise circular
+      // dependency: cards with a remote PR cannot be selected while their parent/child ledgers are absent locally.
+      // Limit fresh remote pulls to recent launches, but keep binding older ledgers already mirrored at HQ.
+      if (recentlyLaunched(card, now)) mirror(card.parentHost, card.runId, root);
+      else if (!existsSync(join(dir, `${card.runId}.jsonl`)) && pulledUnmirrored < unmirroredCap) {
+        pulledUnmirrored++;
+        mirror(card.parentHost, card.runId, root);
+      }
       const snapshot = await readCardRunSnapshot(card, {
         loadLedger: (id) => loadRunLedger(id, dir),
         podFinishes: () => [],
@@ -34,12 +77,20 @@ export async function bindMirroredRemoteRejudgeCards(
       const childRunId = evidence.childRunId;
       const pr = evidence.pr;
       const child = childRunId ? snapshot.children[childRunId] : null;
+      if (snapshot.readErrors?.length) {
+        reportFailure(card, snapshot.readErrors.join('; '));
+        skipped++;
+        continue;
+      }
       // A PR event alone is not a completed remote run. The rejudge candidate must have the same exact
       // child PR and terminal status that remoteBoundRunTerminal will later require.
-      if (snapshot.readErrors?.length || !parent || !childRunId || !pr?.url || !child
+      // TA-BIND-PR-TERMINAL — a blocked-draft child has no `pr-opened`; the parent's `pr-terminal` for that exact child,
+      // number and URL is the same PR evidence.
+      const terminal = parent ? podTerminalPr(parent, [childRunId ?? '']) : undefined;
+      if (!parent || !childRunId || !pr?.url || !child
         || !podChildRunIds(parent, card.runId).includes(childRunId)
-        || !child.some((entry) => entry.event === 'pr-opened' && entry.data?.number === pr.number
-          && entry.data?.url === pr.url)
+        || !(child.some((entry) => entry.event === 'pr-opened' && entry.data?.number === pr.number
+          && entry.data?.url === pr.url) || (terminal?.number === pr.number && terminal.url === pr.url))
         || !child.some((entry) => entry.event === 'run-status'
           && ['completed', 'failed', 'cancelled'].includes(String(entry.data?.runStatus)))) { skipped++; continue; }
       const result = await refreshCardRunBinding(card.id, statePath, {
@@ -53,10 +104,8 @@ export async function bindMirroredRemoteRejudgeCards(
       else skipped++;
     } catch (error) {
       skipped++;
-      try { debug.log('task-agent', 'remote-rejudge-bind-failed', {
-        card: card.id, runId: card.runId, host: card.parentHost.host, reason: error instanceof Error ? error.message : String(error),
-      }); } catch { /* observation must not stop the other cards */ }
+      reportFailure(card, error instanceof Error ? error.message : String(error));
     }
   }
-  return { scanned, bound, skipped };
+  return { scanned, bound, skipped, pulledUnmirrored };
 }

package/src/task-agent/repair-cycle.ts

@@ -2,6 +2,8 @@
 import { spawn } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve, sep } from 'node:path';
+import { debug } from '../debug/log.js';
+import { readBudgetInputsLive, type BudgetInputs } from '../self-implement/budget-gate.js';
 import { mintRunId } from '../harness/harness-space.js';
 import { spawnElanousSync } from '../instance/spawn-elanous.js';
 import { passJourneyNode } from '../self-dev/graph-journey-nodes.js';
@@ -29,9 +31,19 @@ export interface RepairCycleInput {
   notify?: (seat: string, body: string) => void;
   observeLaunch?: (move: string, runId: string) => void;
   resolveOwner?: (card: TaskCard) => RepairOwner;
+  /** Shared only by one `tasks rejudge --all` invocation; a single-card rejudge has no cap. */
+  repairBudget?: RepairTickBudget;
+  /** Test seam; production reads the existing subscription quota signals. */
+  modelAvailability?: RepairModelAvailability;
+  /** Test seam for the same live quota reader used when availability is not injected. */
+  readBudgetInputs?: () => Promise<Pick<BudgetInputs, 'codexCandidates' | 'grokUsedPercent' | 'maxUsedPercent'>>;
 }
 
-export type RepairCycleOutcome = { decision: 'would-repair' | 'repair-requested' | 'repair-pending' | 'repair-applied' | 'repair-failed' | 'repair-stopped'; reason: string };
+export interface RepairTickBudget { max: number; requested: number; capped: number }
+
+export type RepairCycleOutcome = { decision: 'would-repair' | 'repair-requested' | 'repair-pending' | 'repair-applied' | 'repair-failed' | 'repair-stopped'; reason: string;
+  /** Present only when this tick actually consumed a bound worker result. */
+  repairRunId?: string; repairHead?: string };
 export type RepairOwner = { seat?: TaskSeat; source: string; reason?: string };
 
 /** A missing card seat may use only a uniquely identified checklist cell's valid seat. */
@@ -65,12 +77,39 @@ export function resolveRepairOwner(card: TaskCard, deps: {
   } catch { return { source: 'none', reason: `checklist owner invalid: ${cell.version}/${card.checklistId}` }; }
 }
 
-export function alternateRepairModel(card: TaskCard): { from: string; to: TaskChildLlm } {
+export interface RepairModelAvailability { codexSubscription: boolean; grokSubscription: boolean }
+
+export async function repairModelAvailability(readInputs: () => Promise<Pick<BudgetInputs, 'codexCandidates' | 'grokUsedPercent' | 'maxUsedPercent'>> = readBudgetInputsLive): Promise<RepairModelAvailability> {
+  try {
+    const input = await readInputs();
+    const codexCap = input.maxUsedPercent['openai-codex'] ?? 95;
+    const grokCap = input.maxUsedPercent.grok ?? 100;
+    return {
+      codexSubscription: input.codexCandidates.some((candidate) => candidate.reached !== true
+        && typeof candidate.usedPercent === 'number' && candidate.usedPercent < codexCap),
+      grokSubscription: typeof input.grokUsedPercent === 'number' && input.grokUsedPercent < grokCap,
+    };
+  } catch { return { codexSubscription: false, grokSubscription: false }; }
+}
+
+/** Repair stays inside the dispatch tier. A missing legacy tier is high, with Sol allowed only on measured subscription quota. */
+export function alternateRepairModel(card: TaskCard, availability: RepairModelAvailability = { codexSubscription: false, grokSubscription: false }): { from: string; to: TaskChildLlm } {
   const last = card.repairs?.at(-1);
   const from = last?.toModel ?? (card.childLlm ? `${card.childLlm.provider}/${card.childLlm.model}` : 'unknown');
-  const to = from.includes('openrouter/') || from.includes('glm')
-    ? { provider: 'openai-codex', model: 'gpt-6-sol' }
-    : { provider: 'openrouter', model: 'openrouter/z-ai/glm-5.3' };
+  const glm: TaskChildLlm = { provider: 'openrouter', model: 'openrouter/z-ai/glm-5.3' };
+  const sol: TaskChildLlm = { provider: 'openai-codex', model: 'gpt-6-sol' };
+  const grok: TaskChildLlm = { provider: 'grok', model: 'grok-4.6' };
+  const tier = card.tier ?? '상';
+  const pr = typeof card.pr === 'number' ? card.pr : card.pr?.number;
+  const mixEven = ((pr ?? [...card.id].reduce((sum, ch) => sum + ch.charCodeAt(0), 0)) % 2) === 0;
+  let to: TaskChildLlm;
+  if (tier === '특') to = sol;
+  else if (tier === '상' && availability.codexSubscription && mixEven && !from.includes('gpt-6-sol')) to = sol;
+  else if (tier === '상') to = availability.grokSubscription && from.includes('glm') ? grok
+    : from.includes('glm-5.3-flash') ? glm
+    : from.includes('glm-5.3') ? { provider: 'openrouter', model: 'openrouter/z-ai/glm-5.3-flash' } : glm;
+  else to = from.includes('glm-5.3-flash') ? glm : from.includes('glm-5.3')
+    ? { provider: 'openrouter', model: 'openrouter/z-ai/glm-5.3-flash' } : glm;
   return { from, to };
 }
 
@@ -126,6 +165,7 @@ export async function runRepairCycle(input: RepairCycleInput): Promise<RepairCyc
             runId: latest.runId, effect: status, detail: applied.ok ? applied.toHead : applied.reason }] } : undefined);
     } catch (error) { return { decision: 'repair-pending', reason: `repair confirmation card write failed: ${String(error).slice(-200)}` }; }
     const recorded = readTaskCard(card.id, statePath)?.repairs?.find((entry) => entry.runId === latest.runId)?.status === status;
+    // This confirms a result already claimed by another tick; it did not consume the worker result.
     return recorded ? { decision: applied.ok ? 'repair-applied' : 'repair-failed', reason: applied.ok ? `same PR #${pr} fast-forward ${latest.head.slice(0, 12)} → ${applied.toHead.slice(0, 12)}` : applied.reason }
       : { decision: 'repair-pending', reason: 'repair confirmation card changed concurrently' };
   }
@@ -182,7 +222,8 @@ export async function runRepairCycle(input: RepairCycleInput): Promise<RepairCyc
             runId: latest.runId, effect: status, detail }] } : undefined);
     } catch (error) { return { decision: 'repair-pending', reason: `repair card write failed after CAS: ${String(error).slice(-200)}` }; }
     const recorded = readTaskCard(card.id, statePath)?.repairs?.find((entry) => entry.runId === latest.runId)?.status === status;
-    return recorded ? { decision: applied?.ok ? 'repair-applied' : applied?.unconfirmed ? 'repair-pending' : 'repair-failed', reason: detail }
+    return recorded ? { decision: applied?.ok ? 'repair-applied' : applied?.unconfirmed ? 'repair-pending' : 'repair-failed', reason: detail,
+      repairRunId: latest.runId, repairHead: latest.head }
       : { decision: 'repair-pending', reason: 'repair result card changed concurrently' };
   }
   if (latest?.status === 'applied' && latest.head.toLowerCase() === head.toLowerCase())
@@ -230,9 +271,18 @@ export async function runRepairCycle(input: RepairCycleInput): Promise<RepairCyc
       ? { ...current, status: 'failed', history: [...(current.history ?? []), { at: now.toISOString(), event: 'repair-owner-missing', pr, head, detail: reason }] } : undefined);
     return { decision: 'repair-stopped', reason };
   }
+  if (input.repairBudget && input.repairBudget.requested >= input.repairBudget.max) {
+    input.repairBudget.capped++;
+    const reason = `repairMaxPerTick 상한 ${input.repairBudget.max} · 다음 틱에 재판정`;
+    try { debug.log('task-agent', 'repair-tick-cap', { card: card.id, pr, head, max: input.repairBudget.max,
+      requested: input.repairBudget.requested, capped: input.repairBudget.capped, move: judged.judgement.move }); } catch { /* fail-soft */ }
+    return { decision: 'would-repair', reason };
+  }
   const next = attempts.length + 1;
   const runId = mintRunId();
-  const { from, to } = alternateRepairModel(card);
+  const availability = input.modelAvailability ?? (card.tier === '특' || card.tier === '중' || card.tier === '하'
+    ? { codexSubscription: false, grokSubscription: false } : await repairModelAvailability(input.readBudgetInputs));
+  const { from, to } = alternateRepairModel(card, availability);
   const resultPath = repairResultPath(statePath, card.id, pr, head, next, runId);
   const goalFile = resultPath.replace(/\.json$/, '.goal.txt');
   const goal = `기존 PR #${pr}의 리뷰 때 head ${head}를 같은 가지에서 수리한다. 새 PR을 열지 말고 아래 must-fix 원문만 고쳐 commit-only 결과를 반환한다.\n\n${input.mustFix.map((item, i) => `${i + 1}. ${item}`).join('\n')}`;
@@ -251,6 +301,7 @@ export async function runRepairCycle(input: RepairCycleInput): Promise<RepairCyc
   try {
     await (input.request ?? defaultRequestRepair)({ card: card.id, pr, head, repo, resultPath, goalFile,
       runId, model: to, seat: owner.seat });
+    if (input.repairBudget) input.repairBudget.requested++;
   } catch (error) {
     const reason = `repair launch failed: ${error instanceof Error ? error.message : String(error)}`;
     updateTaskCard(statePath, card.id, (current) => current?.repairs?.some((entry) => entry.runId === runId && entry.status === 'requested')

package/src/task-agent/repair-worker.ts

@@ -4,6 +4,7 @@ import { mkdirSync, renameSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
 import type { RepairCommitResult } from './repair-branch-cas.js';
 import type { TaskChildLlm } from './task-hand.js';
+import { publishInsideEvent } from '../nexus/api/inside-events.js';
 
 const SHA40 = /^[0-9a-f]{40}$/i;
 const SHA256 = /^[0-9a-f]{64}$/i;
@@ -70,6 +71,12 @@ export async function runRepairWorker(request: RepairWorkerRequest): Promise<Rep
   const tmp = `${request.resultPath}.${process.pid}.tmp`;
   writeFileSync(tmp, JSON.stringify(result));
   renameSync(tmp, request.resultPath);
+  // The result file, rather than this best-effort notification, is the durable source.
+  try {
+    publishInsideEvent({ kind: 'ta.repair.completed', schema: 1, card: request.card,
+      pr: request.pr, head: request.head, runId: request.runId,
+      resultPath: request.resultPath, completedAt: new Date().toISOString() });
+  } catch { /* a missing daemon cannot change the worker result */ }
   return result;
 }