elanous 0.2.28 → 0.2.31

package/src/cli/pr-land-heavy-remote.ts

@@ -0,0 +1,233 @@
+/** Pinned pr land's heavy gate. A pass belongs to exactly one PR head and main tip. */
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { getUserConfig } from '../user-config.js';
+import { debug, redactSecretText } from '../debug/log.js';
+import { gateRemoteHostCap, realGateRemoteRunner, resolveGateRemoteSettings, runOnRemote, type GateRemoteRunner, type RemoteRunOutcome } from '../self-implement/gate-remote.js';
+
+const SHA = /^[0-9a-f]{40}$/i;
+// WSL is excluded until its push permissions and gate environment are proven stable.
+export const PR_LAND_HEAVY_HOSTS = ['node-b', 'node-c'] as const;
+export const PR_LAND_HEAVY_HOST = PR_LAND_HEAVY_HOSTS[0];
+export type PrLandHeavyHost = typeof PR_LAND_HEAVY_HOSTS[number];
+const allowedHost = (host: string): host is PrLandHeavyHost => PR_LAND_HEAVY_HOSTS.some((candidate) => candidate === host);
+
+export interface HeavyRemoteEvidence {
+  schema: 2;
+  pr: number;
+  head: string;
+  main: string;
+  host: PrLandHeavyHost;
+  passedAt: string;
+  elapsedMs: number;
+  rootPlan: RootPlanSummary | null;
+  interferenceMeasured: boolean;
+}
+
+export interface RootPlanSummary {
+  mode: 'affected' | 'full';
+  roots: number | null;
+  promoted: boolean;
+  reason: string | null;
+}
+
+export interface HeavyRemoteInput {
+  pr: number;
+  head: string;
+  main: string;
+  repo: string;
+  evidenceDir?: string;
+}
+
+export interface HeavyRemoteResult {
+  ok: boolean;
+  /** Host reported by a completed remote run; absent when no host executed the gate. */
+  host?: string;
+  /** Last host requested, including an unsuccessful or busy attempt. */
+  attemptedHost?: PrLandHeavyHost;
+  source: 'cached' | 'remote' | 'unmeasured';
+  reason?: string;
+  elapsedMs: number;
+  evidencePath: string;
+  rootPlan?: RootPlanSummary | null;
+  interferenceMeasured?: boolean;
+}
+
+export interface HeavyRemoteDeps {
+  runner?: GateRemoteRunner;
+  runRemote?: (input: Parameters<typeof runOnRemote>[0], runner: GateRemoteRunner) => RemoteRunOutcome;
+  settings?: ReturnType<typeof resolveGateRemoteSettings>;
+  now?: () => number;
+  observe?: (event: string, data: Record<string, unknown>) => void;
+}
+
+function evidencePath(input: HeavyRemoteInput): string {
+  return join(input.evidenceDir ?? join(effectiveInstanceRoot(), 'pr-land-heavy-results'), `${input.pr}.json`);
+}
+
+function matchingEvidence(path: string, input: HeavyRemoteInput): HeavyRemoteEvidence | null {
+  if (!existsSync(path)) return null;
+  try {
+    const data: HeavyRemoteEvidence = JSON.parse(readFileSync(path, 'utf8'));
+    return data.schema === 2 && data.pr === input.pr && data.head === input.head
+      && data.main === input.main && allowedHost(data.host) && Number.isFinite(data.elapsedMs)
+      && typeof data.interferenceMeasured === 'boolean'
+      && (data.rootPlan === null || (data.rootPlan?.mode === 'affected' || data.rootPlan?.mode === 'full')) ? data : null;
+  } catch { return null; }
+}
+
+function rootPlanFromOutput(output: Buffer): RootPlanSummary | null {
+  const line = output.toString('utf8').split(/\r?\n/).reverse().find((item: string) => item.startsWith('[tsc-gate] root-plan '));
+  if (!line) return null;
+  try {
+    const parsed = JSON.parse(line.slice('[tsc-gate] root-plan '.length)) as RootPlanSummary;
+    if ((parsed.mode !== 'affected' && parsed.mode !== 'full') || (parsed.roots !== null && (!Number.isSafeInteger(parsed.roots) || parsed.roots < 0))
+      || typeof parsed.promoted !== 'boolean' || (parsed.reason !== null && typeof parsed.reason !== 'string')) return null;
+    return parsed;
+  } catch { return null; }
+}
+
+function extraGatesFromOutput(output: Buffer): { interferenceMeasured: boolean } | null {
+  const line = output.toString('utf8').split(/\r?\n/).reverse().find((item) => item.startsWith('[pr-land-extra-gates] pass '));
+  const match = /^\[pr-land-extra-gates\] pass global=measured interference=(measured|unmeasured) files=\d+$/.exec(line ?? '');
+  return match ? { interferenceMeasured: match[1] === 'measured' } : null;
+}
+
+/** Only gate verdict lines reach the landing error. Keep it one line and bounded even for a large remote log. */
+function failedGateSummary(stdout: Buffer, stderr: Buffer): string | undefined {
+  const boundLine = (line: string): string => {
+    const safe = redactSecretText(line).replace(/[\x00-\x1f\x7f]+/g, ' ');
+    if (safe.length <= 220) return safe;
+    // Give both streams space: either one can carry the actionable cause.
+    const outAt = safe.indexOf(' · stdout: ');
+    const errAt = safe.indexOf(' · stderr: ');
+    if (safe.startsWith('shard diagnostic:') && errAt !== -1) {
+      const stdoutLabel = ' · stdout: ';
+      const stderrLabel = ' · stderr: ';
+      const prefixEnd = outAt !== -1 && outAt < errAt ? outAt : errAt;
+      const rawPrefix = safe.slice(0, prefixEnd);
+      const prefix = rawPrefix.length > 100 ? `${rawPrefix.slice(0, 99)}…` : rawPrefix;
+      const rawStderr = safe.slice(errAt + stderrLabel.length);
+      const rawStdout = outAt !== -1 && outAt < errAt ? safe.slice(outAt + stdoutLabel.length, errAt) : '';
+      const hasStdout = rawStdout.length > 0;
+      const available = 220 - prefix.length - stderrLabel.length - (hasStdout ? stdoutLabel.length : 0);
+      const stdoutBudget = hasStdout ? Math.floor(available / 2) : 0;
+      const stderrBudget = available - stdoutBudget;
+      const clip = (value: string, budget: number): string => {
+        if (value.length <= budget) return value;
+        const head = Math.floor((budget - 1) / 2);
+        return `${value.slice(0, head)}…${value.slice(-(budget - 1 - head))}`;
+      };
+      return `${prefix}${hasStdout ? `${stdoutLabel}${clip(rawStdout, stdoutBudget)}` : ''}${stderrLabel}${clip(rawStderr, stderrBudget)}`;
+    }
+    return `${safe.slice(0, 110)}…${safe.slice(-109)}`;
+  };
+  const output = `${stdout.toString('utf8')}\n${stderr.toString('utf8')}`;
+  const lines = output.split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => /^(?:shards: unmeasured|shard attempt:|shard diagnostic:|\[gate-baseline\]|✗ |error:|fatal:)/.test(line));
+  const verdict = [...lines].reverse().find((line) => line.startsWith('shards: unmeasured'))
+    ?? [...lines].reverse().find((line) => line.startsWith('[gate-baseline]'));
+  const unmeasuredIds = new Set(verdict?.startsWith('shards: unmeasured')
+    ? [...verdict.matchAll(/\bshard-\d+\b/g)].map((match) => match[0]) : []);
+  // The last attempt overall may have recovered while an earlier, different shard remains unmeasured.
+  const failedAttempt = [...lines].reverse().find((line) => {
+    const id = /^shard attempt: (shard-\d+) #/.exec(line)?.[1];
+    return id && unmeasuredIds.has(id);
+  });
+  const attemptKey = /^shard attempt: (\S+ #\d+)\b/.exec(failedAttempt ?? '')?.[1];
+  const diagnostic = attemptKey
+    ? lines.filter((line) => line.startsWith(`shard diagnostic: ${attemptKey} `))
+    : [];
+  // Generic stderr can be arbitrarily long; it must never displace the selected shard's two sides.
+  const limit = 5;
+  const selected = failedAttempt
+    ? [failedAttempt, ...diagnostic.slice(-2), verdict, [...lines].reverse().find((line) => /^(?:✗ |error:|fatal:)/.test(line))].filter((line): line is string => !!line)
+    : lines.filter((line) => !line.startsWith('shard attempt:') && !line.startsWith('shard diagnostic:')).slice(-limit);
+  const actionable = !!failedAttempt || selected.some((line) => /^(?:shards: unmeasured|\[gate-baseline\]|✗ |error:|fatal:)/.test(line));
+  const tail = [
+      ...stderr.toString('utf8').split(/\r?\n/).map((line) => line.trim()).filter(Boolean).slice(-2).map((line) => `stderr: ${line}`),
+      ...stdout.toString('utf8').split(/\r?\n/).map((line) => line.trim()).filter(Boolean).slice(-2).map((line) => `stdout: ${line}`),
+    ];
+  const context = limit > tail.length ? selected.slice(-(limit - tail.length)) : [];
+  const cause = actionable ? selected : [...context, ...tail];
+  const bounded = cause.slice(0, 5).map(boundLine);
+  return bounded.length ? bounded.join(' | ') : undefined;
+}
+
+/** No local gate fallback: host refusal, an unmeasured run, and a failed gate all block landing. */
+export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemoteDeps = {}): HeavyRemoteResult {
+  const path = evidencePath(input);
+  if (!Number.isSafeInteger(input.pr) || input.pr <= 0 || !SHA.test(input.head) || !SHA.test(input.main)) {
+    return { ok: false, source: 'unmeasured', reason: 'invalid-pr-head-or-main', elapsedMs: 0, evidencePath: path };
+  }
+  // A cached success is still a landing claim; accept only a measured host in the landing allowlist.
+  const settings = deps.settings ?? resolveGateRemoteSettings(getUserConfig().gateRemote);
+  if (!allowedHost(settings.host)) {
+    return { ok: false, source: 'unmeasured', reason: `gate-host-mismatch (${settings.host})`, elapsedMs: 0, evidencePath: path };
+  }
+  const cached = matchingEvidence(path, input);
+  if (cached) return { ok: true, host: cached.host, source: 'cached', elapsedMs: 0, evidencePath: path, rootPlan: cached.rootPlan, interferenceMeasured: cached.interferenceMeasured };
+  const started = (deps.now ?? Date.now)();
+  let outcome: RemoteRunOutcome = { kind: 'busy' };
+  const primaryHost: PrLandHeavyHost = settings.host;
+  let selectedHost: PrLandHeavyHost = primaryHost;
+  for (const host of [primaryHost, ...PR_LAND_HEAVY_HOSTS.filter((candidate) => candidate !== primaryHost)]) {
+    selectedHost = host;
+    try {
+      outcome = (deps.runRemote ?? runOnRemote)({
+        repo: input.repo, host, mirror: settings.mirror, commit: input.head,
+        refs: [input.main], hostCap: gateRemoteHostCap(settings, host), installPwa: true, stableCheckout: true,
+        // Test the tree GitHub will merge: scratch-checkout the reviewed head, merge the pinned main tip there,
+        // then run typecheck and self gate (changed tests and PWA reach/build) at that exact pair.
+        // The detached integration commit stays on the selected host and never changes the PR branch.
+        argv: (sha) => ['sh', '-c',
+          'git -c user.name=elanous-gate -c user.email=gate@localhost -c commit.gpgsign=false merge --no-ff --no-edit "$1" && TSC_BASE_REF="$1" bun run scripts/ci-typecheck-changed.ts --local && bun bin/elanous.mjs self gate --changed --base "$1" --local --shards 4 && bun scripts/pr-land-extra-remote-gates.ts "$1"',
+          'sh', sha(input.main)],
+      }, deps.runner ?? realGateRemoteRunner);
+    } catch (error) {
+      outcome = { kind: 'infra', reason: `exception: ${error instanceof Error ? error.message : String(error)}` };
+    }
+    // A completed run or infrastructure failure is a verdict. Only a full host slot asks for another host.
+    if (outcome.kind !== 'busy') break;
+  }
+  const elapsedMs = Math.max(0, (deps.now ?? Date.now)() - started);
+  const observe = deps.observe ?? ((event: string, data: Record<string, unknown>) => debug.log('pr.land', event, data));
+  const actualHost = outcome.kind === 'ran' ? outcome.host : undefined;
+  const base = { pr: input.pr, head: input.head, main: input.main, host: actualHost ?? null, attemptedHost: selectedHost, elapsedMs };
+  // The outcome must identify the selected allowlisted host; the configured host alone is not evidence.
+  if (outcome.kind !== 'ran' || outcome.commit !== input.head || outcome.rc !== 0 || outcome.host !== selectedHost) {
+    const summary = outcome.kind === 'ran' && outcome.rc !== 0 ? failedGateSummary(outcome.stdout, outcome.stderr) : undefined;
+    const reason = outcome.kind === 'ran'
+      ? outcome.host !== selectedHost
+        ? `gate-host-mismatch (${outcome.host})`
+        : `gate-rc-${outcome.rc}${outcome.commit !== input.head ? '-head-mismatch' : ''}${summary ? ` · remote: ${summary}` : ''}`
+      : outcome.kind === 'busy' ? 'gate-host-busy' : outcome.reason;
+    observe('heavy-remote', { ...base, outcome: outcome.kind === 'ran' ? 'fail' : 'unmeasured', reason });
+    return { ok: false, ...(actualHost ? { host: actualHost } : {}), attemptedHost: selectedHost, source: 'unmeasured', reason, elapsedMs, evidencePath: path };
+  }
+  const extraGates = extraGatesFromOutput(outcome.stdout);
+  if (!extraGates) {
+    observe('heavy-remote', { ...base, outcome: 'unmeasured', reason: 'extra-global-unmeasured' });
+    return { ok: false, host: selectedHost, attemptedHost: selectedHost, source: 'unmeasured', reason: 'extra-global-unmeasured', elapsedMs, evidencePath: path };
+  }
+  const evidence: HeavyRemoteEvidence = {
+    schema: 2, pr: input.pr, head: input.head, main: input.main, host: selectedHost,
+    passedAt: new Date().toISOString(), elapsedMs: outcome.ms, rootPlan: rootPlanFromOutput(outcome.stdout),
+    interferenceMeasured: extraGates.interferenceMeasured,
+  };
+  const temp = `${path}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(temp, `${JSON.stringify(evidence)}\n`, { mode: 0o600, flag: 'wx' });
+    renameSync(temp, path);
+  } catch (error) {
+    rmSync(temp, { force: true });
+    observe('heavy-remote', { ...base, outcome: 'unmeasured', reason: 'evidence-write-failed' });
+    return { ok: false, host: selectedHost, attemptedHost: selectedHost, source: 'unmeasured', reason: `evidence-write-failed: ${error instanceof Error ? error.message : String(error)}`, elapsedMs, evidencePath: path };
+  }
+  observe('heavy-remote', { ...base, outcome: 'pass', evidencePath: path, rootPlan: evidence.rootPlan, interferenceMeasured: evidence.interferenceMeasured });
+  return { ok: true, host: selectedHost, source: 'remote', elapsedMs, evidencePath: path, rootPlan: evidence.rootPlan, interferenceMeasured: evidence.interferenceMeasured };
+}

package/src/cli/pr-land-overlap-evidence.ts

@@ -21,7 +21,7 @@
  *   하나라도 못 재거나 어긋나면 거부 — 호출부는 종전 거부를 그대로 낸다(fail-closed).
  * - 관측: `pr.land` · `overlap-evidence` (decision · reason · 잰 값).
  */
-import { basename, dirname, join } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
 import { debug } from '../debug/log.js';
 import type { CmdRunner } from '../autopilot/pr-manager.js';
 import { parseReviewResultOutput } from '../task-agent/review-result-capture.js';
@@ -29,12 +29,16 @@ import { parseReviewResultOutput } from '../task-agent/review-result-capture.js'
 const SHA40 = /^[0-9a-f]{40}$/i;
 
 interface OverlapEvidenceFile {
-  pr: number;
+  pr: number | string;
   head: string;
   /** ①② 경로에서만 필수 — 겹친 착지가 전부 조상(already-ancestor)이면 생략해도 된다. */
   gate?: { head: string; baseCommit: string; passed: boolean };
   /** `self review --json` stdout 을 받은 파일(TA: `<state>/review-results/<card>-<pr>-<head접두 10~40>.json`); 내용의 전체 head도 확인한다. */
   reviewResult: string;
+  /** Explicitly replaced failed reviews. Each reason is the verifier's original refusal reason. */
+  supersedes?: { reviewResult: string; reason: string }[];
+  /** OPEN follow-up PR that owns the findings intentionally split from this landing. */
+  followupPr?: number;
 }
 
 export type OverlapEvidenceVerdict =
@@ -52,10 +56,99 @@ export interface VerifyOverlapEvidenceInput {
   cwd: string;
   run: CmdRunner;
   readFile: (path: string) => string;
+  /** Canonical state directory; evidence cannot choose the review search root. */
+  reviewResultsDir?: string;
+  /** Standard review-results directory listing. Failure to measure always rejects. */
+  listDir?: (dir: string) => readonly string[];
+  /** Review file modification time in milliseconds, used to prove the selected result followed failed attempts. */
+  reviewMtime?: (path: string) => number;
+  /** Resolve the physical review path so a symlink cannot select a file outside the state directory. */
+  reviewRealPath?: (path: string) => string;
   /** 겹침 관문이 찾은 «겹친» 최근 착지 커밋들 — 전부 머리의 조상이면 already-ancestor. */
   overlappingLandings?: readonly string[];
 }
 
+function checkSelectedReviewAttempts(input: VerifyOverlapEvidenceInput, e: Partial<OverlapEvidenceFile>, head: string): { ok: true } | { ok: false; reason: string } {
+  const selected = e.reviewResult!;
+  if (!input.reviewResultsDir || !input.listDir || !input.reviewMtime || !input.reviewRealPath) return { ok: false, reason: 'review-attempts-unmeasured' };
+  const dir = input.reviewResultsDir;
+  if (resolve(dirname(selected)) !== resolve(dir)) return { ok: false, reason: 'review-selected-outside-standard-dir' };
+  let names: readonly string[];
+  try { names = input.listDir(dir); } catch { return { ok: false, reason: 'review-attempts-unmeasured' }; }
+  const filename = new RegExp(`^[A-Za-z0-9][A-Za-z0-9._-]*-${input.pr}-([a-f0-9]{10,40})\\.json$`, 'i');
+  const candidates = [...names].filter((name) => {
+    const match = filename.exec(name);
+    return Boolean(match && head.startsWith(match[1]!.toLowerCase()));
+  }).map((name) => join(dir, name));
+  if (!candidates.includes(selected)) return { ok: false, reason: 'review-selected-missing' };
+  let physicalDir: string;
+  let physicalParent: string;
+  try {
+    physicalDir = input.reviewRealPath(dir);
+    physicalParent = input.reviewRealPath(dirname(dir));
+  } catch { return { ok: false, reason: 'review-attempts-unmeasured' }; }
+  if (resolve(physicalDir) !== resolve(join(physicalParent, basename(dir)))) {
+    return { ok: false, reason: 'review-standard-dir-symlink' };
+  }
+  for (const path of candidates) {
+    let physicalPath: string;
+    try { physicalPath = input.reviewRealPath(path); } catch { return { ok: false, reason: 'review-attempts-unmeasured' }; }
+    if (resolve(dirname(physicalPath)) !== resolve(physicalDir)) return { ok: false, reason: 'review-file-outside-standard-dir' };
+  }
+  const entries = e.supersedes;
+  if (entries !== undefined && (!Array.isArray(entries) || entries.length === 0)) return { ok: false, reason: 'review-supersedes-invalid' };
+  const superseded = new Map<string, string>();
+  let selectedTime: number | undefined;
+  if (entries?.length) {
+    try { selectedTime = input.reviewMtime(selected); } catch { return { ok: false, reason: 'review-attempt-time-unmeasured' }; }
+    if (!Number.isFinite(selectedTime)) return { ok: false, reason: 'review-attempt-time-unmeasured' };
+  }
+  for (const entry of entries ?? []) {
+    if (!entry || typeof entry.reviewResult !== 'string' || typeof entry.reason !== 'string' || !entry.reason.trim()
+      || !candidates.includes(entry.reviewResult) || entry.reviewResult === selected || superseded.has(entry.reviewResult)) {
+      return { ok: false, reason: 'review-supersedes-invalid' };
+    }
+    superseded.set(entry.reviewResult, entry.reason);
+    let failedTime: number;
+    try { failedTime = input.reviewMtime(entry.reviewResult); } catch { return { ok: false, reason: 'review-attempt-time-unmeasured' }; }
+    if (!Number.isFinite(failedTime) || selectedTime === undefined || failedTime >= selectedTime) {
+      return { ok: false, reason: 'review-selected-not-later-than-failure' };
+    }
+  }
+  for (const path of candidates) {
+    if (path === selected) continue;
+    const review = checkReview(input, { reviewResult: path }, head);
+    if (review.ok) {
+      if (superseded.has(path)) return { ok: false, reason: 'review-supersedes-passing' };
+      continue;
+    }
+    if (superseded.get(path) !== review.reason) return { ok: false, reason: `review-attempt-not-superseded: ${basename(path)} (${review.reason})` };
+    if (!/^review-(verdict-fail|must-fix-[1-9][0-9]*)$/.test(review.reason)) {
+      return { ok: false, reason: `review-supersedes-not-failed: ${basename(path)} (${review.reason})` };
+    }
+  }
+  if (entries?.length) {
+    if (!Number.isSafeInteger(e.followupPr) || (e.followupPr as number) <= 0 || e.followupPr === input.pr) {
+      return { ok: false, reason: 'review-followup-pr-invalid' };
+    }
+    const response = input.run('gh', ['pr', 'view', String(e.followupPr), '--json', 'state'], { cwd: input.cwd });
+    if (!response.ok) return { ok: false, reason: 'review-followup-pr-unmeasured' };
+    let state: unknown;
+    try { state = JSON.parse(response.out); } catch { return { ok: false, reason: 'review-followup-pr-unmeasured' }; }
+    if ((state as { state?: unknown })?.state !== 'OPEN') return { ok: false, reason: 'review-followup-pr-not-open' };
+  } else if (e.followupPr !== undefined) {
+    return { ok: false, reason: 'review-followup-pr-without-supersedes' };
+  }
+  debug.log('pr.land', 'review-attempt-selection', {
+    pr: input.pr,
+    head,
+    selected,
+    superseded: [...superseded.entries()].map(([reviewResult, reason]) => ({ reviewResult, reason })),
+    followupPr: e.followupPr ?? null,
+  });
+  return { ok: true };
+}
+
 type Checked = { ok: false; reason: string; baseTip?: string; gateBase?: string; windowCommits?: number }
   | (OverlapEvidenceVerdict & { ok: true; baseTip?: string });
 
@@ -81,6 +174,47 @@ function checkReview(input: Pick<VerifyOverlapEvidenceInput, 'pr' | 'readFile'>,
   if (!review) return { ok: false, reason: 'review-no-result', baseTip };
   if (review.pr !== input.pr) return { ok: false, reason: 'review-pr-mismatch', baseTip };
   if (!review.head || review.head.toLowerCase() !== head) return { ok: false, reason: 'review-head-mismatch', baseTip };
+  // The capture parser projects away model provenance; inspect the same last result-shaped line here.
+  let raw: Record<string, unknown> | undefined;
+  for (const line of text.split('\n').reverse()) {
+    if (!line.trim().startsWith('{')) continue;
+    let value: unknown;
+    try { value = JSON.parse(line); } catch { continue; }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) continue;
+    const result = value as Record<string, unknown>;
+    if (result.pr === undefined || !(('verdict' in result && Array.isArray(result.mustFix)) || typeof result.error === 'string')) continue;
+    raw = result;
+    break;
+  }
+  if (raw) {
+    const actualBackend = typeof raw.actualBackend === 'string' ? raw.actualBackend.trim().toLowerCase() : '';
+    const model = typeof raw.model === 'string' ? raw.model.trim().toLowerCase() : '';
+    const route = typeof raw.reviewRoute === 'string' ? raw.reviewRoute.trim().toLowerCase() : '';
+    const respondedProvider = typeof raw.respondedProvider === 'string' ? raw.respondedProvider.trim().toLowerCase() : '';
+    const respondedModel = typeof raw.respondedModel === 'string' ? raw.respondedModel.trim().toLowerCase() : '';
+    if (actualBackend === 'acp:claude' || actualBackend.startsWith('acp:claude/')
+      || model === 'acp:claude' || model.startsWith('acp:claude/')
+      || ((route === 'acp' || route === 'acp-fallback') && typeof raw.fallbackBackend === 'string' && raw.fallbackBackend.trim().toLowerCase() === 'claude')) {
+      return { ok: false, reason: 'review-forbidden-acp-claude', baseTip };
+    }
+    const requested = typeof raw.requestedModel === 'string' ? raw.requestedModel.trim().toLowerCase() : '';
+    if (requested) {
+      const requestedAcpBackend = requested.startsWith('acp:') ? requested.split('/')[0] : '';
+      // Only explicit provider-qualified forms identify a provider here. Bare model IDs
+      // (for example claude-sonnet-4 or gpt-6-sol) cannot be compared to a provider name.
+      const apiProvider = requested.startsWith('openrouter/') ? 'openrouter'
+        : requested.startsWith('local:') ? 'local' : '';
+      const expectedResponseModel = requested.startsWith('openrouter/') ? requested.slice('openrouter/'.length) : requested;
+      const mismatch = (model !== '' && model !== requested)
+        || (actualBackend !== '' && (requestedAcpBackend ? actualBackend !== requestedAcpBackend : actualBackend !== 'api'
+          && (apiProvider === '' || actualBackend !== apiProvider)))
+        || (route !== '' && route !== (requestedAcpBackend ? 'acp' : 'api'))
+        || (!requestedAcpBackend && apiProvider !== '' && respondedProvider !== '' && respondedProvider !== apiProvider)
+        || (!requestedAcpBackend && respondedModel !== '' && respondedModel !== expectedResponseModel
+          && respondedModel !== requested);
+      if (mismatch) console.warn(`⚠ overlap-evidence: review provider mismatch — requestedModel=${requested} actualBackend=${actualBackend || 'unmeasured'} model=${model || 'unmeasured'} reviewRoute=${route || 'unmeasured'} respondedProvider=${respondedProvider || 'unmeasured'} respondedModel=${respondedModel || 'unmeasured'} (${e.reviewResult})`);
+    }
+  }
   if (review.error) return { ok: false, reason: 'review-error', baseTip };
   if (review.reviewed !== true) return { ok: false, reason: 'review-not-reviewed', baseTip };
   if (review.verdict === null || !ACCEPTED_REVIEW_VERDICTS.has(review.verdict)) return { ok: false, reason: `review-verdict-${review.verdict ?? 'null'}`, baseTip };
@@ -152,7 +286,11 @@ function check(input: VerifyOverlapEvidenceInput): Checked {
   }
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return { ok: false, reason: 'evidence-not-object' };
   const e = raw as Partial<OverlapEvidenceFile>;
-  if (e.pr !== input.pr) return { ok: false, reason: `evidence-pr-mismatch: ${String(e.pr)} ≠ ${input.pr}` };
+  const evidencePr = typeof e.pr === 'number' ? e.pr
+    : typeof e.pr === 'string' && /^[0-9]+$/.test(e.pr) ? Number(e.pr) : NaN;
+  const prMatches = Number.isSafeInteger(input.pr) && input.pr > 0
+    && Number.isSafeInteger(evidencePr) && evidencePr === input.pr;
+  if (!prMatches) return { ok: false, reason: `evidence-pr-mismatch: ${String(e.pr)} ≠ ${input.pr}` };
   if (typeof e.head !== 'string' || e.head.toLowerCase() !== head) return { ok: false, reason: 'evidence-head-mismatch' };
 
   // ⓐ 이미 조상 — 겹친 착지가 전부 머리 안에 있으면 그 머리의 게이트·리뷰가 이미 그것을 보고 쟀다.
@@ -160,7 +298,9 @@ function check(input: VerifyOverlapEvidenceInput): Checked {
   if (landings.length > 0 && landings.every((sha) => /^[0-9a-f]{7,40}$/i.test(sha)
     && input.run('git', ['merge-base', '--is-ancestor', sha, head], { cwd: input.cwd }).ok)) {
     const review = checkReview(input, e, head);
-    return review.ok ? { ok: true, mode: 'already-ancestor', reviewResult: review.reviewResult } : review;
+    if (!review.ok) return review;
+    const attempts = checkSelectedReviewAttempts(input, e, head);
+    return attempts.ok ? { ok: true, mode: 'already-ancestor', reviewResult: review.reviewResult } : attempts;
   }
 
   // ① 재기반 — 원격의 «지금» 끝을 읽기 전용으로 받는다(로컬 ref 를 안 바꾼다).
@@ -178,9 +318,11 @@ function check(input: VerifyOverlapEvidenceInput): Checked {
     const window = checkBaseWindow(input, head, baseTip, gateBase!, staleReason);
     if (!window.ok) return { ok: false, reason: window.reason, baseTip, gateBase, windowCommits: window.windowCommits };
     const review = checkReview(input, e, head, baseTip);
-    return review.ok
+    if (!review.ok) return { ...review, gateBase, windowCommits: window.windowCommits };
+    const attempts = checkSelectedReviewAttempts(input, e, head);
+    return attempts.ok
       ? { ok: true, mode: 'base-advanced-disjoint', baseTip, gateBase: gateBase!, windowCommits: window.windowCommits, reviewResult: review.reviewResult }
-      : { ...review, gateBase, windowCommits: window.windowCommits };
+      : { ...attempts, gateBase, windowCommits: window.windowCommits };
   };
   if (!ancestor.ok) {
     const notRebased = `not-rebased: ${input.remote}/${input.branch} ${baseTip.slice(0, 12)} is not an ancestor of ${head.slice(0, 12)}`;
@@ -198,7 +340,9 @@ function check(input: VerifyOverlapEvidenceInput): Checked {
 
   // ③ 리뷰 — 그 PR · 그 머리의 pass ⊕ must-fix 0.
   const review = checkReview(input, e, head, baseTip);
-  return review.ok ? { ok: true, mode: 'rebased', baseTip, reviewResult: review.reviewResult } : review;
+  if (!review.ok) return review;
+  const attempts = checkSelectedReviewAttempts(input, e, head);
+  return attempts.ok ? { ok: true, mode: 'rebased', baseTip, reviewResult: review.reviewResult } : attempts;
 }
 
 export type AncestorAutoVerdict =
@@ -218,13 +362,10 @@ export interface VerifyAncestorAutoInput {
   overlappingLandings: readonly string[];
 }
 
-function checkAncestorAuto(input: VerifyAncestorAutoInput): AncestorAutoVerdict {
+/** Standard same-head reviews must all pass; a later passing review cannot hide a failed attempt. */
+export function verifyAllSameHeadReviews(input: Pick<VerifyAncestorAutoInput, 'pr' | 'expectedHead' | 'readFile' | 'reviewResultsDir' | 'listDir'>):
+  { ok: true; reviewResult: string } | { ok: false; reason: string } {
   const head = input.expectedHead.toLowerCase();
-  const landings = input.overlappingLandings;
-  if (landings.length === 0) return { ok: false, reason: 'ancestor-auto-no-overlapping-landings' };
-  const notAncestor = landings.find((sha) => !(/^[0-9a-f]{7,40}$/i.test(sha)
-    && input.run('git', ['merge-base', '--is-ancestor', sha, head], { cwd: input.cwd }).ok));
-  if (notAncestor !== undefined) return { ok: false, reason: `ancestor-auto-not-ancestor: ${notAncestor.slice(0, 12)} is not an ancestor of ${head.slice(0, 12)}` };
   let names: readonly string[];
   try { names = input.listDir(input.reviewResultsDir); } catch { return { ok: false, reason: 'review-missing' }; }
   const filename = new RegExp(`^[A-Za-z0-9][A-Za-z0-9._-]*-${input.pr}-([a-f0-9]{10,40})\\.json$`, 'i');
@@ -234,11 +375,23 @@ function checkAncestorAuto(input: VerifyAncestorAutoInput): AncestorAutoVerdict
     const match = filename.exec(n);
     return Boolean(match && match[1]!.length >= 10 && head.startsWith(match[1]!.toLowerCase()));
   }).sort()) {
+    // The auto-ancestor landing path uses the same provider/forbidden-backend check as explicit evidence.
     const review = checkReview(input, { reviewResult: join(input.reviewResultsDir, name) }, head);
     if (!review.ok) return { ok: false, reason: review.reason };
     accepted = review.reviewResult;
   }
-  return accepted === undefined ? { ok: false, reason: 'review-missing' } : { ok: true, mode: 'already-ancestor-auto', reviewResult: accepted };
+  return accepted === undefined ? { ok: false, reason: 'review-missing' } : { ok: true, reviewResult: accepted };
+}
+
+function checkAncestorAuto(input: VerifyAncestorAutoInput): AncestorAutoVerdict {
+  const head = input.expectedHead.toLowerCase();
+  const landings = input.overlappingLandings;
+  if (landings.length === 0) return { ok: false, reason: 'ancestor-auto-no-overlapping-landings' };
+  const notAncestor = landings.find((sha) => !(/^[0-9a-f]{7,40}$/i.test(sha)
+    && input.run('git', ['merge-base', '--is-ancestor', sha, head], { cwd: input.cwd }).ok));
+  if (notAncestor !== undefined) return { ok: false, reason: `ancestor-auto-not-ancestor: ${notAncestor.slice(0, 12)} is not an ancestor of ${head.slice(0, 12)}` };
+  const reviews = verifyAllSameHeadReviews(input);
+  return reviews.ok ? { ok: true, mode: 'already-ancestor-auto', reviewResult: reviews.reviewResult } : reviews;
 }
 
 /**

package/src/cli/pr-land-pod-shadow-job.ts

@@ -0,0 +1,83 @@
+/** Opt-in shadow of the pinned landing typecheck and changed-file gate on a Pod Job. */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { runPodCommand, type RunPodCommandOptions, type PodCommandResult } from '../task-orchestrator/surfaces/pod-command-job.js';
+import { redactSecretText } from '../debug/log.js';
+import type { RootPlanSummary } from './pr-land-heavy-remote.js';
+
+const SHA = /^[0-9a-f]{40}$/i;
+const MARKER = 'ELANOUS_PRLAND_SHADOW';
+
+export interface LandingPodShadowInput { head: string; main: string }
+export interface LandingPodShadowVerdict {
+  measured: boolean;
+  ok: boolean;
+  rootPlan: RootPlanSummary | null;
+  tscRc?: number;
+  gateRc?: number;
+  reason?: string;
+  job?: string;
+}
+
+export function landingPodShadowScript(head: string, main: string): string {
+  if (!SHA.test(head) || !SHA.test(main)) throw new Error('pod shadow: invalid head/main');
+  return [
+    'set -u',
+    `test "$(git rev-parse HEAD)" = '${head}' || { echo '${MARKER} unmeasured source-head'; exit 2; }`,
+    `git fetch origin '${main}' >/dev/null 2>&1 || { echo '${MARKER} unmeasured main-fetch'; exit 2; }`,
+    `git cat-file -e '${main}^{commit}' || { echo '${MARKER} unmeasured main-missing'; exit 2; }`,
+    `if [ "$(git rev-parse --is-shallow-repository)" = true ]; then git fetch --unshallow origin '${head}' >/tmp/prland-shadow-unshallow.log 2>&1 || { tail -n 12 /tmp/prland-shadow-unshallow.log; echo '${MARKER} unmeasured unshallow'; exit 2; }; fi`,
+    'git -c user.name=elanous-gate -c user.email=gate@localhost -c commit.gpgsign=false merge --no-ff --no-edit ' + `'${main}'` + ` >/tmp/prland-shadow-merge.log 2>&1 || { tail -n 12 /tmp/prland-shadow-merge.log; echo '${MARKER} unmeasured merge'; exit 2; }`,
+    `bun install --frozen-lockfile >/tmp/prland-shadow-install.log 2>&1 || { echo '${MARKER} unmeasured root-install'; exit 2; }`,
+    `if [ -f apps/pwa/package.json ]; then (cd apps/pwa && bun install --frozen-lockfile) >/tmp/prland-shadow-pwa-install.log 2>&1 || { echo '${MARKER} unmeasured pwa-install'; exit 2; }; fi`,
+    `TSC_BASE_REF='${main}' bun scripts/ci-typecheck-changed.ts --local >/tmp/prland-shadow-tsc.log 2>&1; tsc_rc=$?`,
+    `bun bin/elanous.mjs self gate --changed --base '${main}' --local --shards 4 >/tmp/prland-shadow-gate.log 2>&1; gate_rc=$?`,
+    `printf '${MARKER}_TSC_PLAN %s\\n' "$(grep '^\\[tsc-gate\\] root-plan ' /tmp/prland-shadow-tsc.log | tail -n 1 | sed 's/^\\[tsc-gate\\] root-plan //')"`,
+    "tail -n 8 /tmp/prland-shadow-tsc.log; tail -n 8 /tmp/prland-shadow-gate.log",
+    `printf '${MARKER} head=%s main=%s tsc=%s gate=%s\\n' '${head}' '${main}' "$tsc_rc" "$gate_rc"`,
+    'exit 0',
+  ].join('\n');
+}
+
+export async function runLandingPodShadowJob(input: LandingPodShadowInput, deps: {
+  runPod?: (options: RunPodCommandOptions) => Promise<PodCommandResult>;
+  readLog?: (path: string) => string;
+} = {}): Promise<LandingPodShadowVerdict> {
+  const script = landingPodShadowScript(input.head, input.main);
+  const job = await (deps.runPod ?? runPodCommand)({
+    command: ['bash', '-lc', script], clone: true, source: { kind: 'commit', sha: input.head },
+    returnLogs: true, deadlineSeconds: 45 * 60,
+  });
+  let log: string;
+  try { log = (deps.readLog ?? ((path: string) => readFileSync(path, 'utf8')))(join(job.artifactsDir, 'child.log')); }
+  catch (error) {
+    const detail = redactSecretText(error instanceof Error ? error.message : String(error)).slice(0, 180);
+    return { measured: false, ok: false, rootPlan: null, reason: `child-log-unreadable:${detail}`, job: job.job };
+  }
+  const expected = `${MARKER} head=${input.head} main=${input.main} `;
+  const lines = log.split(/\r?\n/);
+  let markerIndex = -1;
+  for (let index = lines.length - 1; index >= 0; index--) {
+    if (lines[index]!.startsWith(MARKER)) { markerIndex = index; break; }
+  }
+  const line = markerIndex >= 0 ? lines[markerIndex] : undefined;
+  if (job.exitCode !== 0 || !line?.startsWith(expected)) {
+    const detail = markerIndex > 0 ? redactSecretText(lines[markerIndex - 1] ?? '').trim().slice(0, 180) : '';
+    return { measured: false, ok: false, rootPlan: null, reason: `${line ?? `pod-exit-${job.exitCode}`}${detail ? ` · ${detail}` : ''}`, job: job.job };
+  }
+  const match = /^tsc=(\d+) gate=(\d+)$/.exec(line.slice(expected.length));
+  if (!match) return { measured: false, ok: false, rootPlan: null, reason: 'marker-unreadable', job: job.job };
+  const planLine = log.split(/\r?\n/).reverse().find((part) => part.startsWith(`${MARKER}_TSC_PLAN `));
+  let rootPlan: RootPlanSummary | null = null;
+  if (planLine) {
+    try {
+      const candidate = JSON.parse(planLine.slice(`${MARKER}_TSC_PLAN `.length)) as RootPlanSummary;
+      if ((candidate.mode === 'affected' || candidate.mode === 'full') && (candidate.roots === null || Number.isSafeInteger(candidate.roots))
+        && typeof candidate.promoted === 'boolean' && (candidate.reason === null || typeof candidate.reason === 'string')) rootPlan = candidate;
+    } catch { /* an unreadable plan stays unmeasured */ }
+  }
+  if (!rootPlan) return { measured: false, ok: false, rootPlan: null, reason: 'root-plan-missing', job: job.job };
+  const tscRc = Number(match[1]);
+  const gateRc = Number(match[2]);
+  return { measured: true, ok: tscRc === 0 && gateRc === 0, rootPlan, tscRc, gateRc, job: job.job };
+}

package/src/cli/pr-land-pod-shadow.ts

@@ -1,10 +1,10 @@
 /**
  * PRLAND-HEAVY-ON-POD-1 — `pr land` 무거운 판정을 Pod 에서 그림자 리허설한다.
  *
- * 착지 경로에 아직 잇지 않는다. `--heavy-on-pod-shadow` 플래그·실제 Pod 러너 바인딩은
- * 다음 조각(pr-cli.ts · pod-command-job.ts 무접촉). 이번 단위는 주입형 순수 함수만:
+ * `pr-cli.ts`의 `--heavy-remote --heavy-on-pod-shadow` 선택 경로가 호출한다.
+ * 비교기는 주입형 함수이며 Pod Job 바인딩은 `pr-land-pod-shadow-job.ts`에 둔다.
  * 켜지면 가짜/실 Pod 러너를 한 번 부르고 `pr.land`/`heavy-on-pod-shadow` 관측 한 줄을 남긴 뒤
- * 로컬 판정을 그대로 반환한다. 끄면 러너 0회. 러너가 던져도 경고 한 줄만 내고 로컬을 지킨다.
+ * 로컬 판정을 그대로 반환한다. 끄면 러너 0회. 러너가 던지면 미측정 관측과 경고를 남기고 로컬을 지킨다.
  */
 
 export interface HeavyOnPodShadowInput<T> {
@@ -18,6 +18,13 @@ export interface HeavyOnPodShadowInput<T> {
 }
 
 function agree(local: unknown, pod: unknown): boolean {
+  if (local && pod && typeof local === 'object' && typeof pod === 'object'
+    && 'measured' in local && 'measured' in pod) {
+    const a = local as { measured: unknown; ok?: unknown; rootPlan?: unknown };
+    const b = pod as { measured: unknown; ok?: unknown; rootPlan?: unknown };
+    return a.measured === true && b.measured === true && a.ok === b.ok
+      && JSON.stringify(a.rootPlan ?? null) === JSON.stringify(b.rootPlan ?? null);
+  }
   if (Object.is(local, pod)) return true;
   try {
     return JSON.stringify(local) === JSON.stringify(pod);
@@ -49,6 +56,12 @@ export async function runHeavyOnPodShadow<T>(input: HeavyOnPodShadowInput<T>): P
     });
   } catch (error) {
     warn(error instanceof Error ? error.message : String(error));
+    log('pr.land', 'heavy-on-pod-shadow', {
+      pr, head, local,
+      pod: { measured: false, ok: false, reason: `pod-exception:${error instanceof Error ? error.name : 'unknown'}` },
+      agree: false,
+      podMs: elapsedMs(started), localMs,
+    });
   }
   return local;
 }