elanous 0.2.29 → 0.2.31

package/src/task-agent/live-moves.ts

@@ -6,7 +6,7 @@
  *   TA-REVIEW-RESULT-CAPTURE — 자식 stdout(`--json`)은 결과 파일로 받고, 자식 완료 뒤 해당 카드만 회수·재판정한다.
  *   회수한 pass 는 그 틱의 판단부·land 관문 입력(`selfReview`)이 될 뿐 land 판정 로직은 그대로다.
  * - `propose-green`: 카드에 green «제안»(`greenProposal`)만 적는다 — 체크리스트는 손대지 않는다.
- * - `propose-land`: 카드·현재 머리의 self review 통과(pass «또는» warn ⊕ must-fix 0 · TA-LAND-WARN-MUSTFIX0)·non-draft 를 확인하고 기존 `pr land` 를 머리 고정으로 한 번 부른다.
+ * - `propose-land`: 카드·현재 머리의 self review 통과(pass «또는» warn ⊕ must-fix 0 · TA-LAND-WARN-MUSTFIX0)·non-draft 를 확인한다. 큐 설정이 있으면 원격 changed gate 뒤 착지 줄에 등록하고, 없으면 기존 `pr land` 를 머리 고정으로 한 번 부른다.
  * - 사다리 R4: `narrow-relaunch` · `wait-retry` · `salvage-relaunch` · `alternative` 도 허용 목록 어휘다 — 실제 발사는 실행부
  *   `executeNextAction`(`actions.ts`)이 «목록 ⊕ 같은 수 2회 상한 ⊕ 회당 1건 ⊕ 부하 관문»을 모두 넘을 때만 한다.
  * - `decision-card`: 막힌 과제를 «근거(서명 · 화면 · must-fix)» 붙은 결정 카드로 올린다 — 근거가 하나도 없으면 카드를 올리지 않는다.
@@ -28,6 +28,7 @@ import { decisionCardGrounds, decisionRaiseArgs, type DecisionCardEvidence, type
 import { pendingReviewResults, reviewResultPath, TA_REVIEW_COMPLETION_CARD_ENV, TA_REVIEW_COMPLETION_RESULT_ENV, TA_REVIEW_COMPLETION_STATE_ENV } from './review-result-capture.js';
 import { buildPriorFixContext, PRIOR_FIX_SCOPE_LINE, priorFixBlock, priorFixObservation, type PriorDiffReader, type PriorFixContext } from './review-prior-fix.js';
 import { createLandWorktree, localBranch, localHead, observeLandWorktree, type LandWorktree, type LandWorktreeFailure, type LandWorktreeInput, type LandWorktreeRemoval } from './land-worktree.js';
+import { runQueuedLanding, type QueueLandingInput } from './land-queue.js';
 
 export const TASK_AGENT_LIVE_MOVES = ['review', 'propose-green', 'propose-land', 'decision-card', ...LIVE_RETRY_MOVES] as const;
 export type TaskAgentLiveMove = typeof TASK_AGENT_LIVE_MOVES[number];
@@ -90,6 +91,9 @@ export interface LiveMoveDeps {
   log?: (category: string, event: string, data: Record<string, unknown>) => void;
   /** TA-LAND-WORKTREE — cwd HEAD 읽기 · PR 머리 임시 워크트리 만들기(시험 주입 · 기본 = git). */
   landWorktree?: { localHead?: (cwd: string) => string | null; localBranch?: (cwd: string) => string | null; create?: (input: LandWorktreeInput) => Promise<LandWorktree | LandWorktreeFailure> };
+  /** TA-LAND-AFTER-REVIEW — injected queue adapter; absent uses configured command after a remote changed gate. */
+  queueLanding?: (input: QueueLandingInput) => Promise<{ status: number; stdout: string; stderr?: string }>;
+  landQueueConfig?: { command: string; remote: string } | null;
 }
 
 /** `executed` = 부작용을 실제로 냈다(리뷰를 띄웠다 · 제안을 적었다). ok 이지만 이미 한 수(같은 머리·이미 제안)면 false. */
@@ -101,6 +105,8 @@ export interface LiveMoveResult {
   resultPath?: string;
   /** TA-LAND-RETRY-ON-INFRA — 실행한 land 의 그 머리 몇 번째 시도인가 · 실패면 갈래(infra|judgement|base-stale)·사유·재시도 가능 여부. */
   landAttempt?: { attempt: number; class?: LandFailureClass; reason?: string; retryAllowed?: boolean };
+  /** A queue accepted this head. Merge confirmation belongs to the later train receipt. */
+  queued?: boolean;
 }
 
 export interface PrHeadView { head: string; state: string; branch?: string; url?: string }
@@ -543,10 +549,11 @@ export const LAND_RETRY_ON_INFRA_EVENT = 'land-retry-on-infra';
 
 const landedCycles = new Set<string>();
 
-/** `propose-land` — only a passing self review (pass or warn, with must-fix 0) of this exact OPEN, non-draft head may invoke pr land. */
+/** `propose-land` — only a passing self review (pass or warn, with must-fix 0) of this exact OPEN, non-draft head may enqueue or invoke pr land. */
 export async function executeLiveLand(
   card: TaskCard | undefined, pr: number | undefined,
   ctx: { runId?: string | null; cycleId?: string; cwd?: string; produced?: { headCommit?: string; branch?: string; prUrl?: string }; review?: { verdict: 'pass' | 'warn' | 'fail'; head: string; /** TA-LAND-WARN-MUSTFIX0 — `false` 면 리뷰가 실제로 안 돌았다 → land 거부. 슈퍼바이저 입력은 reviewed 리뷰로만 만들어져 칸이 없다. */ reviewed?: boolean };
+    /** Exact bytes consumed by the queue's own review check; no path means queue mode cannot proceed. */ reviewResultPath?: string;
     /** TA-REJUDGE-ON-HEAD — 겹침 증거 파일(있으면 land 에 넘길 뿐 · 판정은 그대로). */ overlapEvidence?: string;
     /** REJUDGE base-stale — 증거의 재게이트를 요청한 시각 · 그 앞의 base-stale 시도는 소비됨(`openLandAttempts`). */ gateAt?: string },
   deps: LiveMoveDeps = {},
@@ -584,6 +591,10 @@ export async function executeLiveLand(
   const mustFixCount = (ctx.review as { mustFixCount?: unknown }).mustFixCount;
   if (typeof mustFixCount !== 'number' || !Number.isSafeInteger(mustFixCount) || mustFixCount < 0) return reject(card.id, `PR #${pr} review-must-fix-unknown`, reviewRepo);
   if (mustFixCount > 0) return reject(card.id, `PR #${pr} review-warn-with-must-fix: pass carries ${mustFixCount} must-fix`, reviewRepo);
+  const queueConfig = deps.landQueueConfig === undefined ? getUserConfig().taskAgent?.landQueue : deps.landQueueConfig;
+  if (queueConfig && (!isAbsolute(queueConfig.command) || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(queueConfig.remote)))
+    return reject(card.id, `PR #${pr} land queue command/remote invalid`, reviewRepo);
+  if (queueConfig && !ctx.reviewResultPath) return reject(card.id, `PR #${pr} queue review result path missing`, reviewRepo);
   const cycle = ctx.cycleId ?? ctx.runId;
   if (cycle && landedCycles.has(cycle)) return reject(card.id, `cycle ${cycle} already landed — stays shadow`, reviewRepo);
   const path = deps.statePath ?? taskAgentStatePath();
@@ -695,11 +706,16 @@ export async function executeLiveLand(
   let failure: LandFailureClassification | undefined;
   try {
     // The CLI rechecks the pinned PR/head immediately before merge, after its own gates and freeze admission.
-    const outcome = overlapEvidence
-      ? await (deps.land ?? defaultLand)(pr, view.head, landCwd, { overlapEvidence })
-      : await (deps.land ?? defaultLand)(pr, view.head, landCwd);
+    const outcome = queueConfig
+      ? await (deps.queueLanding ?? runQueuedLanding)({ card: card.id, pr, head: view.head, cwd: landCwd, statePath: path,
+        reviewResult: ctx.reviewResultPath!, command: queueConfig.command, remote: queueConfig.remote,
+        entry: (await import('../cli/tasks-cli.js')).ELANOUS_CLI_ENTRY,
+        configDir: (await import('../elanous-config-dir.js')).getElanousConfigDirOverride() ?? (await import('../instance/resolve.js')).effectiveInstanceRoot() })
+      : overlapEvidence
+        ? await (deps.land ?? defaultLand)(pr, view.head, landCwd, { overlapEvidence })
+        : await (deps.land ?? defaultLand)(pr, view.head, landCwd);
     ok = outcome.status === 0;
-    detail = (ok ? outcome.stdout || `land merged #${pr} head ${view.head.slice(0, 12)}` : outcome.stderr || outcome.stdout || `exit ${outcome.status}`).slice(-300);
+    detail = (ok ? outcome.stdout || `${queueConfig ? 'queued' : 'land merged'} #${pr} head ${view.head.slice(0, 12)}` : outcome.stderr || outcome.stdout || `exit ${outcome.status}`).slice(-300);
     if (!ok) failure = classifyLandFailure(outcome);
   } catch (error) {
     detail = (error instanceof Error ? error.message : String(error)).slice(-300);
@@ -708,8 +724,13 @@ export async function executeLiveLand(
   const retryAllowed = failure?.class === 'infra' && attempt < LAND_ATTEMPTS_PER_HEAD_ON_INFRA;
   // 인프라 실패로 재시도가 남으면 주기 표시도 푼다 — 같은 주기 id(재판정 틱의 `rejudge:<card>:<head>`)가 그 한 번을 막지 않게.
   if (retryAllowed && cycle) landedCycles.delete(cycle);
-  if (worktree) {
-    // 성공이든 실패든 걷는다.
+  if (worktree && queueConfig && ok) {
+    // The queue row pins this exact path until the train consumes it. Removing it here
+    // would turn a successful enqueue into a guaranteed missing-tree landing failure.
+    observeLandWorktree({ card: card.id, pr, head: view.head, created: worktree.created ?? null,
+      removed: false, reason: 'queued — train owns this exact-head worktree until its receipt' }, deps.log);
+  } else if (worktree) {
+    // Direct land and rejected queue attempts no longer need the temporary checkout.
     let removal: LandWorktreeRemoval;
     try { removal = worktree.cleanup(); } catch (error) { removal = { removed: false, reason: String(error).slice(-200) }; }
     observeLandWorktree({ card: card.id, pr, head: view.head, created: worktree.created ?? null, removed: removal.removed, ...(removal.branchRemoved !== undefined ? { branchRemoved: removal.branchRemoved } : {}),
@@ -746,7 +767,7 @@ export async function executeLiveLand(
     return observe(deps, withRepo({ kind, card: card.id, ok: false, executed: true, landAttempt,
       detail: `land ${ok ? 'succeeded' : 'failed'} but card update failed: ${String(error).slice(-230)}` }));
   }
-  return observe(deps, withRepo({ kind, card: card.id, ok, executed: true, detail, landAttempt }));
+  return observe(deps, withRepo({ kind, card: card.id, ok, executed: true, detail, landAttempt, ...(queueConfig && ok ? { queued: true } : {}) }));
 }
 
 /** `propose-green` — 비지 않은 근거가 있을 때만 카드에 제안을 적는다(한 번). 체크리스트는 쓰지 않는다. */

package/src/task-agent/postland-card.ts

@@ -2,6 +2,7 @@ import { debug } from '../debug/log.js';
 import { listChecklist, setItemIfSnapshot, type Checklist } from '../release-loop/checklist.js';
 import { judgeLandedCell, parseJudgeSignals, type GreenVerdict } from '../release-loop/landed-to-green.js';
 import { cardPrNumber, readTaskAgentState, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
+import { isGoalOnlyPr } from './judge.js';
 
 export interface LandedTaskPr { number: number; url: string; headRefOid: string; state: string; baseRefName: string; mergedAt: string; files?: Array<{ path: string }> }
 export interface PostlandDeps {
@@ -32,6 +33,10 @@ export function candidateMergedTaskCells(number: number, statePath = taskAgentSt
 export function closeMergedTaskCard(pr: LandedTaskPr, cwd: string, deps: PostlandDeps): string | null {
   const log = deps.log ?? debug.log.bind(debug);
   if (pr.state !== 'MERGED' || pr.baseRefName !== 'main' || !/^[a-f0-9]{40}$/i.test(pr.headRefOid) || !pr.url) return null;
+  if (isGoalOnlyPr(pr.files?.map((file) => file.path))) {
+    log('task-agent', 'postland-card-skipped', { pr: pr.number, reason: 'goal-only-pr', targetDiff: 0 });
+    return null;
+  }
   const path = deps.statePath ?? taskAgentStatePath();
   const tasks = readTaskAgentState<{ tasks?: Record<string, TaskCard> }>(path).tasks ?? {};
   const cards = Object.values(tasks).filter((card) => card.taLand && card.checklistId && cardPrNumber(card) === pr.number

package/src/task-agent/prelaunch-already-done.ts

@@ -0,0 +1,98 @@
+/** TA-PRELAUNCH-ALREADY-DONE: bounded evidence against a pinned, detached main tree. */
+import { spawnSync } from 'node:child_process';
+import { realpathSync } from 'node:fs';
+import { isAbsolute } from 'node:path';
+import { inspectGoalDoneBoundary } from '../self-implement/goal-author.js';
+
+export interface AlreadyDoneCandidate { mainSha: string; repository: string; command: string; exitCode: 0 }
+export interface AlreadyDoneDecision { candidate?: AlreadyDoneCandidate; reason: string }
+
+type SafeCommand = { argv: string[]; path: string };
+const SHA = /^[0-9a-f]{40}$/i;
+const SAFE_PATH = /^[A-Za-z0-9_./-]+$/;
+
+/** A lexical command declaration is not authority to run shell or project scripts. */
+export function parseAlreadyDoneCommand(command: string): SafeCommand | null {
+  let input = command.trim();
+  while (input.length >= 2 && ((input.startsWith('`') && input.endsWith('`'))
+    || (input.startsWith('"') && input.endsWith('"')) || (input.startsWith("'") && input.endsWith("'"))))
+    input = input.slice(1, -1).trim();
+  if (!input || /[\n\r\t`$;&|<>\\'"*?()[\]{}!]/.test(input)) return null;
+  const argv = input.split(/ +/);
+  let path: string | undefined;
+  if (argv.length === 3 && argv[0] === 'test' && ['-f', '-e'].includes(argv[1]!)) path = argv[2];
+  else if (argv.length === 5 && argv[0] === 'git' && argv[1] === 'ls-files' && argv[2] === '--error-unmatch' && argv[3] === '--') path = argv[4];
+  else if (argv.length === 7 && argv[0] === 'git' && argv[1] === 'diff' && argv[2] === '--quiet'
+    && SHA.test(argv[3]!) && argv[4] === 'HEAD' && argv[5] === '--') path = argv[6];
+  if (!path || !SAFE_PATH.test(path) || isAbsolute(path) || path.startsWith('-')
+    || path.split('/').some((part) => part === '..' || part === '.' || !part)) return null;
+  return { argv, path };
+}
+
+export type PinnedGitResult = { status: number | null; stdout: string; error: boolean };
+export type PrelaunchGitRunnerForTest = (cwd: string, argv: string[], timeout?: number) => PinnedGitResult;
+
+export function runPinnedGit(cwd: string, argv: string[], timeout = 4_000, input?: string): PinnedGitResult {
+  // Trust boundary: the operator's own repository and Git config. Drop inherited GIT_* overrides,
+  // disable replace refs, hooks, and credential helpers; remote transport uses the operator's SSH config.
+  const env = { ...process.env };
+  for (const key of Object.keys(env)) if (key.startsWith('GIT_')) delete env[key];
+  const result = spawnSync('git', ['--no-replace-objects', '-c', 'core.hooksPath=/dev/null', '-c', 'credential.helper=', ...argv],
+    { cwd, env, encoding: 'utf8', timeout, maxBuffer: 64 * 1024, ...(input !== undefined ? { input } : {}) });
+  return { status: result.status, stdout: result.stdout ?? '', error: !!result.error };
+}
+
+function evaluatePinnedTree(root: string, sha: string, safe: SafeCommand, runGit: PrelaunchGitRunnerForTest): AlreadyDoneDecision {
+  const { argv, path } = safe;
+  // Every supported command names one tracked regular file in the pinned tree.
+  // A symlink's filesystem -e/-f meaning is not inferable from its Git object.
+  const entry = runGit(root, ['ls-tree', sha, '--', path]);
+  if (entry.status !== 0 || entry.error) return { reason: 'evidence-unmeasured' };
+  const match = /^(100644|100755|040000|120000) (blob|tree) [0-9a-f]{40}\t(.+)$/m.exec(entry.stdout);
+  if (!match || match[3] !== path) return { reason: 'evidence-not-passing' };
+  if (match[1] === '120000') return { reason: 'evidence-symlink-unmeasured' };
+  if (!['100644', '100755'].includes(match[1]!) || match[2] !== 'blob') return { reason: 'evidence-path-not-tracked-file' };
+  if (argv[0] === 'git' && argv[1] === 'diff') {
+    const base = argv[3]!;
+    if (base.toLowerCase() === sha.toLowerCase()) return { reason: 'diff-compares-main-to-itself' };
+    const ancestor = runGit(root, ['merge-base', '--is-ancestor', base, sha]);
+    if (ancestor.status !== 0) return { reason: 'diff-base-unverified' };
+    const diff = runGit(root, ['diff', '--no-ext-diff', '--no-textconv', '--quiet', base, sha, '--', path]);
+    return { reason: diff.status === 0 ? 'evidence-passed-on-main' : diff.status === 1 && !diff.error ? 'evidence-not-passing' : 'evidence-unmeasured' };
+  }
+  return { reason: 'evidence-passed-on-main' };
+}
+
+/** Only an explicit project repository qualifies. Unknown target means preserve the live launch. */
+export function inspectPrelaunchAlreadyDone(text: string, projectTarget?: string,
+  deps: { runGit?: PrelaunchGitRunnerForTest; realpath?: (path: string) => string } = {}): AlreadyDoneDecision {
+  const boundary = inspectGoalDoneBoundary(text);
+  if (boundary.missing.length) return { reason: `boundary-missing:${boundary.missing.join(',')}` };
+  const command = boundary.values['완료 경계 증거 명령'] ?? '';
+  const safe = parseAlreadyDoneCommand(command);
+  if (!safe) return { reason: 'evidence-command-unsupported' };
+  const codeBoundary = boundary.values['완료 경계 코드'] ?? '';
+  const realBoundary = boundary.values['완료 경계 실물'] ?? '';
+  if (codeBoundary !== `기존 추적 파일 ${safe.path}` || realBoundary !== '원격 main의 일반 파일로 존재')
+    return { reason: 'evidence-boundary-not-file-existence' };
+  if (!projectTarget) return { reason: 'project-target-unverified' };
+  let root: string;
+  try { root = (deps.realpath ?? realpathSync)(projectTarget); } catch { return { reason: 'project-target-unreadable' }; }
+  const runGit = deps.runGit ?? runPinnedGit;
+  const top = runGit(root, ['rev-parse', '--show-toplevel']);
+  if (top.status !== 0 || top.stdout.trim() !== root) return { reason: 'project-root-unverified' };
+  const origin = runGit(root, ['remote', 'get-url', 'origin']);
+  const originUrl = origin.stdout.trim();
+  // Keep credentials and arbitrary transports out of both the verifier and its card evidence.
+  const repository = /^(?:https:\/\/github\.com\/|git@github\.com:)([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?$/.exec(originUrl)?.[1];
+  if (origin.status !== 0 || !repository) return { reason: 'origin-unverified' };
+  const local = runGit(root, ['rev-parse', 'refs/remotes/origin/main']).stdout.trim();
+  const remote = runGit(root, ['ls-remote', 'origin', 'refs/heads/main'], 7_000);
+  const sha = remote.stdout.trim().split(/\s+/)[0] ?? '';
+  if (remote.status !== 0 || !SHA.test(sha) || local !== sha) return { reason: 'main-unverified-or-stale' };
+  const evaluated = evaluatePinnedTree(root, sha, safe, runGit);
+  if (evaluated.reason !== 'evidence-passed-on-main') return evaluated;
+  const remoteAgain = runGit(root, ['ls-remote', 'origin', 'refs/heads/main'], 7_000);
+  if (remoteAgain.status !== 0 || remoteAgain.stdout.trim().split(/\s+/)[0] !== sha) return { reason: 'main-moved' };
+  return { candidate: { mainSha: sha, repository, command, exitCode: 0 }, reason: 'evidence-passed-on-main' };
+}

package/src/task-agent/real-launch-guard.ts

@@ -0,0 +1,37 @@
+/**
+ * ⛔ 시험 안의 «실물 발사» 거부 — 2026-10-16 사고(R7 · OP #8751) 의 구조 방어.
+ *
+ * 무엇이 있었나: 호스트 재게이트가 시험을 운영 HOME 그대로 돌렸고, seam 이 빠진 시험 둘이 `defaultTaskLauncher` 의
+ * 원격 부모 경로(`tryRemoteParent`)로 진짜 ssh 를 쏴 원격 prod 런 25 · draft PR 11 을 만들었다.
+ * 격리 env(재게이트 러너)와 시험 seam 은 «잊음»을 줄일 뿐 «다음 시험이 seam 을 빠뜨리는 것»은 못 막는다 — 그래서
+ * 발사 지점이 bun test 안에서는 명시 허용 없이 실물 발사를 «거부»한다(fail-closed · 큰소리).
+ *
+ * - 시험 밖(제품 경로): 아무 영향 없다 — `isUnderTestRunner()` 가 거짓이면 즉시 돌아간다.
+ * - 시험 안: 주입(가짜 ssh·spawn)을 쓰면 이 가드에 닿지 않는다. 실물이 정말 필요한 시험만
+ *   `ELANOUS_TEST_ALLOW_REAL_LAUNCH=1` 로 명시 허용한다.
+ */
+import { debug } from '../debug/log.js';
+import { isUnderTestRunner } from '../oauth/store.js';
+
+export const ALLOW_REAL_LAUNCH_UNDER_TEST_ENV = 'ELANOUS_TEST_ALLOW_REAL_LAUNCH';
+
+export type RealLaunchKind = 'remote-parent-ssh' | 'local-harness-spawn';
+
+export class RealLaunchRefusedUnderTestError extends Error {
+  constructor(readonly kind: RealLaunchKind, detail: string) {
+    super(`⛔ 시험 안에서 실물 발사를 거부했다(${kind}${detail ? ` · ${detail}` : ''}) — `
+      + (kind === 'remote-parent-ssh'
+        ? 'deps.parentHost: null(원격 끔) 또는 deps.ssh 가짜를 주입하라'
+        : 'deps.spawn 가짜(또는 handToTaskAgent:\'off\' · taskLauncher 가짜)를 주입하라')
+      + ` · 실물이 정말 필요하면 ${ALLOW_REAL_LAUNCH_UNDER_TEST_ENV}=1 (2026-10-16 시험 누수 사고 R7)`);
+    this.name = 'RealLaunchRefusedUnderTestError';
+  }
+}
+
+/** bun test 안이고 명시 허용이 없으면 던진다. 시험 밖에서는 아무것도 하지 않는다. */
+export function refuseRealLaunchUnderTest(kind: RealLaunchKind, detail = '', env: NodeJS.ProcessEnv = process.env): void {
+  if (!isUnderTestRunner(env)) return;
+  if (env[ALLOW_REAL_LAUNCH_UNDER_TEST_ENV]?.trim() === '1') return;
+  try { debug.log('task-agent', 'real-launch-refused-under-test', { kind, detail }); } catch { /* fail-soft */ }
+  throw new RealLaunchRefusedUnderTestError(kind, detail);
+}

package/src/task-agent/rejudge-on-head.ts

@@ -35,6 +35,7 @@ import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { debug } from '../debug/log.js';
 import { prodInstanceRoot } from '../instance/resolve.js';
+import { getUserConfig } from '../user-config.js';
 import { loadRunLedger, type RunLedgerEntry } from '../self-implement/run-ledger.js';
 import type { DetachedSpawn } from '../cli/tasks-cli.js';
 import { remoteLedgerMirrorDir } from './parent-host.js';
@@ -46,6 +47,9 @@ import type { RepairCasOutcome, RepairCasRequest } from './repair-branch-cas.js'
 import { defaultLandPrHead, defaultPrHead, defaultReviewRepoCandidates, executeLiveLand, executeLiveReview, landRetryPending, type LiveMoveDeps, type LiveMoveResult, type PrHeadView, type ReviewRepoCandidate, type TaskAgentLiveMove } from './live-moves.js';
 import { capturedLandReview, captureReviewResults, parseReviewResultOutput, pendingReviewResults, reviewResultPath, type ParsedReviewResult } from './review-result-capture.js';
 import { boundPrTerminal, cardPrNumber, LIVE_MOVE_RESULT_EVENT, readTaskCard, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
+import { verifiedTrainLanding, type TrainLanding } from './train-landing.js';
+import { isGoalOnlyPr } from './judge.js';
+import { defaultPrFiles } from './shadow.js';
 
 export const REJUDGE_ON_HEAD_EVENT = 'rejudge-on-head';
 /** 카드·PR 당 재게이트하는 머리 수 상한(머리가 바뀔 때마다 하나) — 넘으면 멈추고 사람에게 넘긴다. */
@@ -60,6 +64,7 @@ export type CatchUpDecision = 'pushed' | 'conflict' | 'cap-reached' | 'failed';
 export interface RejudgeOutcome {
   card: string; pr: number | null; fromHead: string | null; toHead: string | null; step: RejudgeStep; decision: string; reason: string;
   fromBase?: string; toBase?: string; newHead?: string;
+  repairRunId?: string; repairHead?: string;
 }
 
 export interface RegateRequest { card: string; pr: number; head: string; repoRoot: string; resultPath: string }
@@ -77,6 +82,8 @@ export type CatchUpGit = (cwd: string, args: string[]) => { status: number | nul
 export interface RejudgeDeps {
   live?: LiveMoveDeps;
   liveMoves: ReadonlySet<TaskAgentLiveMove>;
+  /** Complete PR target paths; undefined means the PR diff could not be measured. */
+  prFiles?: (pr: number, prUrl: string) => Promise<readonly string[] | undefined>;
   /** Only phase ① shadow callbacks may inspect a previously judged head without a regate. */
   shadowSameHead?: boolean;
   /** HQ mirror proof that the bound remote child has stopped. Test seam; absence fails closed. */
@@ -96,6 +103,8 @@ export interface RejudgeDeps {
   log?: (category: string, event: string, data: Record<string, unknown>) => void;
   /** 시험 seam — 결과 파일 읽기(없으면 ENOENT). */
   readFile?: (path: string) => string;
+  /** Verify a CLOSED component PR against the HQ train ledger and merged integration PR. */
+  trainLanding?: (pr: number, cwd: string) => TrainLanding | null;
 }
 
 /** PR binding alone does not mean a remote parent has stopped. Require its child edge and terminal ledger row. */
@@ -283,6 +292,15 @@ export function parseRegateResult(text: string, pr: number, head: string): Regat
 const sameUrl = (a: string, b: string) => a.trim().replace(/\/+$/, '').toLowerCase() === b.trim().replace(/\/+$/, '').toLowerCase();
 const sameHead = (a: string, b: string) => a.toLowerCase() === b.toLowerCase();
 
+/**
+ * TA-REGATE-UNMEASURED — «못 잰» 재게이트(draft `pr-head` 거부·띄우기 실패 등 status=unmeasured)는 코드 판정이 아니다.
+ * 재게이트 상한(REJUDGE_HEAD_CAP)에 세지 않는다. 옛 결과 파일은 noMerge 에 status 가 없어서 draft 거부 문면으로도 가린다.
+ */
+export function regateUnmeasured(entry: { passed?: boolean; status?: string; detail?: string }): boolean {
+  return entry.passed === false && (entry.status === 'unmeasured' || /^pr-head:.*\bisDraft=true\b/.test(entry.detail ?? ''));
+}
+const cappedRegates = <T extends { passed?: boolean; status?: string; detail?: string }>(entries: readonly T[]): T[] => entries.filter((entry) => !regateUnmeasured(entry));
+
 const defaultCatchUpGit: CatchUpGit = (cwd, args) => {
   const r = spawnSync('git', args, { cwd, encoding: 'utf8', timeout: 120_000 });
   return { status: r.status, stdout: String(r.stdout ?? ''), stderr: String(r.stderr ?? '') };
@@ -416,8 +434,6 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
   // 원격 부모는 node-b 의 liveMoves 가 꺼져 리뷰 이력이 0일 수 있다. HQ 거울의 종결 증거가 있을 때만 시작한다.
   const adopted = card.adoptedPr?.pr === pr && typeof card.pr === 'object'
     && !!card.pr.url && sameUrl(card.adoptedPr.url, card.pr.url) && /^[a-f0-9]{40}$/i.test(card.adoptedPr.head);
-  if (!reviews.length && !adopted && (!card.parentHost || !(deps.remoteRunTerminal ?? remoteBoundRunTerminal)(card)))
-    return target('not-started', 'no task-agent review on this PR yet (remote terminal unproven or run not stopped/judged)', pr);
   // 떼어 띄운 재게이트 결과를 «머리와 무관하게» 먼저 회수한다 — 결과가 나오기 전에 머리가 또 바뀌어도 그 머리의 결과는 카드에 남는다.
   for (const pending of (card.regates ?? []).filter((entry) => entry.pr === pr && entry.passed === undefined && entry.resultPath)) {
     let text: string | null = null;
@@ -435,7 +451,7 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
       wrote = true;
       return { ...current, regates: current.regates.map((entry) => entry.pr === pr && entry.head === pending.head && entry.at === pending.at ? { ...entry, ...patch } : entry) };
     });
-    if (wrote) emit({ card: card.id, pr, fromHead: null, toHead: pending.head, step: 'regate', decision: patch.passed ? 'regate-passed' : 'regate-failed',
+    if (wrote) emit({ card: card.id, pr, fromHead: null, toHead: pending.head, step: 'regate', decision: patch.passed ? 'regate-passed' : regateUnmeasured(patch) ? 'regate-unmeasured' : 'regate-failed',
       reason: `head ${pending.head.slice(0, 12)} · base ${(patch as { baseCommit?: string }).baseCommit?.slice(0, 12) ?? '-'} · ${patch.detail}` }, true);
   }
   card = readTaskCard(card.id, statePath) ?? card;
@@ -453,15 +469,40 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
   if ('reason' in found) return target('pr-unreadable', found.reason, pr, fromHead);
   const { cwd, view } = found;
   const toHead = view.head;
+  const eligible = !!reviews.length || adopted || (!!card.parentHost && (deps.remoteRunTerminal ?? remoteBoundRunTerminal)(card));
+  const trustedTrain = view.state === 'CLOSED' && card.status === 'launched'
+    ? (() => { try { return (deps.trainLanding ?? verifiedTrainLanding)(pr, cwd); } catch { return null; } })() : null;
+  // An unreviewed or unproven remote card retains the old guard. Only verified train
+  // evidence may cross it; an arbitrary CLOSED PR must not disappear from rejudge.
+  if (!eligible && !trustedTrain)
+    return target('not-started', 'no task-agent review on this PR yet (remote terminal unproven or run not stopped/judged)', pr);
+  try {
+    const paths = await (deps.prFiles ?? defaultPrFiles)(pr, url);
+    if (isGoalOnlyPr(paths)) return target('goal-only-pr', `PR #${pr} target diff 0 (docs/goals/** only) — review·land·같은 골 재큐 중지`, pr, fromHead, toHead, true);
+  } catch (error) {
+    try { log('task-agent', 'pr-target-diff-unavailable', { card: card.id, pr,
+      reason: error instanceof Error ? error.message : String(error) }); } catch { /* fail-soft */ }
+  }
   if (view.state === 'MERGED' || view.state === 'CLOSED') {
     const at = now().toISOString();
+    const train = trustedTrain;
     updateTaskCard(statePath, card.id, (current) => {
       if (!current || cardPrNumber(current) !== pr || typeof current.pr !== 'object' || current.pr.url !== url) return undefined;
       const previous = boundPrTerminal(current);
-      if (previous?.state === view.state && previous.head === toHead) return undefined;
-      return { ...current, prTerminal: { pr, url, head: toHead, state: view.state as 'MERGED' | 'CLOSED', at } };
+      const alreadyLanded = train && current.trainLanding?.componentPr === pr
+        && current.trainLanding.integrationPr === train.integrationPr && current.trainLanding.mergeSha === train.mergeSha;
+      if (previous?.state === view.state && previous.head === toHead && (!train || alreadyLanded) && (!train || current.status === 'done')) return undefined;
+      return {
+        ...current,
+        ...(train ? { status: 'done' as const, trainLanding: alreadyLanded ? current.trainLanding : { ...train, at }, history: alreadyLanded ? current.history : [...(current.history ?? []), {
+          at, event: 'landed-via-train', pr, head: toHead, detail: `train #${train.integrationPr} merged ${train.mergeSha}`,
+        }] } : {}),
+        prTerminal: previous?.state === view.state && previous.head === toHead ? previous
+          : { pr, url, head: toHead, state: view.state as 'MERGED' | 'CLOSED', at },
+      };
     });
-    return target('pr-not-open', `PR #${pr} is ${view.state}`, pr, fromHead, toHead);
+    return train ? target('landed-via-train', `PR #${pr} via train #${train.integrationPr} merge ${train.mergeSha}`, pr, fromHead, toHead)
+      : target('pr-not-open', `PR #${pr} is ${view.state}`, pr, fromHead, toHead);
   }
   if (view.state !== 'OPEN') return target('pr-not-open', `PR #${pr} is ${view.state}`, pr, fromHead, toHead);
   // An explicitly rejudged PR can be reopened. Clear the old marker before normal head judgement.
@@ -537,7 +578,8 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
         ...(deps.applyRepair ? { apply: deps.applyRepair } : {}),
         ...(deps.notifyRepair ? { notify: deps.notifyRepair } : {}),
         ...(deps.repairBudget ? { repairBudget: deps.repairBudget } : {}) });
-      step('repair', result.decision, result.reason, true);
+      step('repair', result.decision, result.reason, true,
+        result.repairRunId && result.repairHead ? { repairRunId: result.repairRunId, repairHead: result.repairHead } : {});
       return outcomes;
     }
   }
@@ -585,6 +627,40 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
     return outcomes;
   }
 
+  // TA-LAND-AFTER-REVIEW: configured queue mode owns its one remote changed gate inside
+  // the queue adapter. The older host regate below is the direct-merge path only.
+  const queueMode = live.landQueueConfig === undefined ? getUserConfig().taskAgent?.landQueue : live.landQueueConfig;
+  if (queueMode) {
+    const latest = readTaskCard(card.id, statePath) ?? card;
+    const priorQueue = (latest.landAttempts ?? []).filter((entry) => entry.pr === pr && sameHead(entry.head, toHead));
+    if (priorQueue.length && !landRetryPending(latest, pr, toHead)) {
+      step('land', 'queue-skipped', `PR #${pr} head ${toHead.slice(0, 12)} already claimed or queued`, false);
+      return outcomes;
+    }
+    const review = capturedLandReview(latest, pr, toHead);
+    if (!review || review.mustFixCount !== 0) {
+      if (pendingReviewResults(latest).some((entry) => entry.pr === pr && sameHead(entry.head, toHead))) {
+        step('review', 'awaiting-review-result', 'exact-head review result pending', false);
+      } else if (!latest.reviewRequests?.some((entry) => entry.pr === pr && sameHead(entry.head, toHead)) && deps.liveMoves.has('review')) {
+        const before = { reviewRequests: latest.reviewRequests, landAttempts: latest.landAttempts };
+        const result = await executeLiveReview(latest, pr, { runId: latest.runId ?? null, stopReason: 'queue-exact-head', cwd }, { ...live, ...(deps.log ? { log: deps.log } : {}) });
+        recordMove(statePath, latest.id, latest.runId, 'review', result, pr, before, now, deps.log);
+        step('review', result.executed ? 'review-requested' : 'review-request-failed', result.detail, true);
+      } else step('review', 'not-landing', 'exact-head PASS/WARN mf0 review not captured', true);
+      return outcomes;
+    }
+    if (!readyConfirmed) { step('ready', 'ready-unconfirmed', 'exact-head ready PR not confirmed', false); return outcomes; }
+    if (!deps.liveMoves.has('propose-land')) { step('land', 'would-land', 'propose-land not enabled — queue shadow', false); return outcomes; }
+    const reviewResult = latest.reviewRequests?.find((entry) => entry.pr === pr && sameHead(entry.head, toHead) && entry.resultPath)?.resultPath;
+    if (!reviewResult) { step('land', 'not-landing', 'exact-head review JSON path missing', true); return outcomes; }
+    const before = { reviewRequests: latest.reviewRequests, landAttempts: latest.landAttempts };
+    const queued = await executeLiveLand(latest, pr, { runId: latest.runId ?? null, cycleId: `queue:${latest.id}:${toHead}`, cwd,
+      review, reviewResultPath: reviewResult }, { ...live, landQueueConfig: queueMode, ...(deps.log ? { log: deps.log } : {}) });
+    recordMove(statePath, latest.id, latest.runId, 'propose-land', queued, pr, before, now, deps.log);
+    step('land', queued.queued ? 'queued' : queued.ok && !queued.executed ? 'queue-skipped' : 'queue-refused', queued.detail, true);
+    return outcomes;
+  }
+
   const tryCatchUp = async (fromBase: string | undefined, why: string): Promise<boolean> => {
     const prior = catchUpHistory(card!, pr);
     // 상한은 «실제 push» 만 센다 — 충돌·실패 뒤 사람이 새 머리를 올리면 다시 시도할 수 있어야 한다.
@@ -653,8 +729,9 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
   if (!regate || staleBase || retryDraft) {
     const why = staleBase ? `base-stale-overlap — gate base ${staleBase.slice(0, 12)} went stale (${(stale!.reason ?? '').replace(/^base-stale-overlap:\s*/, '').slice(0, 160)})`
       : retryDraft ? 'draft rejection became stale after PR ready' : '';
-    if (regates.length >= REJUDGE_HEAD_CAP) {
-      step('regate', 'cap-reached', `${why ? `${why} · ` : ''}re-gated ${regates.length} times already (cap ${REJUDGE_HEAD_CAP}) — no more rejudge; needs owner`, true);
+    const counted = cappedRegates(regates).length;
+    if (counted >= REJUDGE_HEAD_CAP) {
+      step('regate', 'cap-reached', `${why ? `${why} · ` : ''}re-gated ${counted} times already (cap ${REJUDGE_HEAD_CAP} · unmeasured ${regates.length - counted} not counted) — no more rejudge; needs owner`, true);
       return outcomes;
     }
     if (!deps.liveMoves.has('propose-land')) step('regate', 'would-regate', `${why ? `${why} · ` : ''}propose-land not enabled in taskAgent.liveMoves — shadow`, false);
@@ -670,7 +747,7 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
         if (!current || held.some((entry) => sameHead(entry.head, toHead) && (staleBase ? entry.staleBase !== undefined && sameHead(entry.staleBase, staleBase)
           : retryDraft ? entry.readyRetry === true : true))) return undefined;
         // 상한은 잠금 안의 «지금» 카드로 다시 잰다 — 다른 머리를 본 두 틱이 겹쳐도 상한을 넘지 않게.
-        if (held.length >= REJUDGE_HEAD_CAP) { capped = true; return undefined; }
+        if (cappedRegates(held).length >= REJUDGE_HEAD_CAP) { capped = true; return undefined; }
         claimed = true;
         return { ...current, regates: [...(current.regates ?? []), { pr, head: toHead, at, resultPath, ...(staleBase ? { staleBase } : {}), ...(retryDraft ? { readyRetry: true as const } : {}) }] };
       });
@@ -753,7 +830,7 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
   const before = { reviewRequests: latest.reviewRequests, landAttempts: latest.landAttempts };
   // 주기 id — base-stale 재게이트 뒤의 land 는 새 base 를 붙여 앞 land 의 주기 표시(모듈 전역)와 갈린다 · gateAt 이 앞 base-stale 시도를 소비한다.
   const cycleId = `rejudge:${card.id}:${toHead}${regate.staleBase ? `:${regate.baseCommit.slice(0, 12)}` : ''}`;
-  const landed = await executeLiveLand(latest, pr, { runId: card.runId ?? null, cycleId, cwd, review, overlapEvidence, gateAt: regate.at },
+  const landed = await executeLiveLand(latest, pr, { runId: card.runId ?? null, cycleId, cwd, review, reviewResultPath: reviewResult, overlapEvidence, gateAt: regate.at },
     { ...live, ...(deps.log ? { log: deps.log } : {}) });
   // LAND-ORDER-LEDGER — executeLiveLand 직후 원장 한 줄(같은 pr+head 는 한 줄만). 쓰기가 실패해도 land 결과는 그대로(삼킨다).
   const landOrderLog = (event: 'appended' | 'append-failed') => { try { log('task-agent.land-order', event, { pr, head: toHead }); } catch { /* fail-soft */ } };
@@ -771,7 +848,7 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
   const attempt = landed.landAttempt?.class
     ? ` · land-class ${landed.landAttempt.class} (${landed.landAttempt.reason}) · attempt ${landed.landAttempt.attempt} · ${landed.landAttempt.class === 'base-stale' ? 'base-stale → re-gate on a new base next tick (cap counts)' : landed.landAttempt.retryAllowed ? 'retry allowed on this head' : 'no retry on this head'}`
     : '';
-  step('land', landed.executed && landed.ok ? 'landed'
+  step('land', landed.queued ? 'queued' : landed.executed && landed.ok ? 'landed'
     : !landed.executed && landed.ok ? 'land-skipped' : 'land-rejected',
   `${landed.detail}${attempt} · overlap-evidence ${overlapEvidence}`, true);
   return outcomes;

package/src/task-agent/remote-rejudge-bind.ts

@@ -1,16 +1,24 @@
 /** Bind remote TA parents from the HQ ledger mirror before `rejudge --all` selects PR cards. */
-import { dirname } from 'node:path';
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { debug } from '../debug/log.js';
 import { loadRunLedger } from '../self-implement/run-ledger.js';
-import { bindCardEvidence, podChildRunIds, readCardRunSnapshot, refreshCardRunBinding } from './card-evidence.js';
+import { bindCardEvidence, podChildRunIds, podTerminalPr, readCardRunSnapshot, refreshCardRunBinding } from './card-evidence.js';
 import { mirrorRemoteRunLedgers, remoteLedgerMirrorDir } from './parent-host.js';
 import { cardPrNumber, type TaskCard } from './task-hand.js';
 
 const RECENT_LAUNCH_MS = 24 * 60 * 60 * 1000;
+/**
+ * TA-BIND-PULL-ONCE — an older launch whose parent ledger was never mirrored at HQ gets one pull («묶기만»).
+ * Bounded per tick so the first tick after deploy does not run hundreds of sequential ssh reads (backlog ≈690
+ * cards on 10-15 drains over ticks); a pulled mirror is then read locally and never pulled again by this rule.
+ */
+export const UNMIRRORED_PULL_CAP_PER_TICK = 20;
 
 type BindDeps = {
   now?: () => number;
   mirror?: typeof mirrorRemoteRunLedgers;
+  unmirroredPullCap?: number;
   onFailure?: (failure: { card: string; runId: string; host: string; reason: string }) => void;
 };
 
@@ -23,13 +31,14 @@ function recentlyLaunched(card: TaskCard, now: number): boolean {
 /**
  * A remote child PR can appear after the last HQ card refresh. A card without a PR is otherwise absent from
  * `rejudgeCandidates`, so the normal rejudge tick never reaches `mirrorRemoteCardLedger` or the binding replay.
- * Only an existing, launched TA-owned parent with a parent→child edge in its own host mirror is admitted. The
+ * Only an existing, launched parent (TA-owned or not — TA-BIND-WIDEN) with a parent→child edge in its own host
+ * mirror is bound; rejudge/land selection keeps its own taLand gate. The
  * launch registry (including foreign/test universes) and child-only ledgers are never scanned or adopted here.
  */
 export async function bindMirroredRemoteRejudgeCards(
   tasks: Readonly<Record<string, TaskCard>>, statePath: string,
   deps: BindDeps = {},
-): Promise<{ scanned: number; bound: number; skipped: number }> {
+): Promise<{ scanned: number; bound: number; skipped: number; pulledUnmirrored: number }> {
   const root = dirname(statePath);
   const now = (deps.now ?? Date.now)();
   const mirror = deps.mirror ?? mirrorRemoteRunLedgers;
@@ -41,8 +50,12 @@ export async function bindMirroredRemoteRejudgeCards(
   let scanned = 0;
   let bound = 0;
   let skipped = 0;
+  let pulledUnmirrored = 0;
+  const unmirroredCap = deps.unmirroredPullCap ?? UNMIRRORED_PULL_CAP_PER_TICK;
   for (const card of Object.values(tasks)) {
-    if (card.status !== 'launched' || card.taLand !== true || !card.parentHost || !card.runId
+    // TA-BIND-WIDEN — «묶기»는 taLand 와 무관하게 launched ⊕ runId 카드 전부. 묶여도 재판정(rejudge)·land 후보는
+    // `rejudgeCandidates`/`remoteBoundRunTerminal` 의 taLand 관문이 그대로 거른다 — 여기서 넓히는 것은 카드↔PR 연결뿐이다.
+    if (card.status !== 'launched' || !card.parentHost || !card.runId
       || cardPrNumber(card) !== undefined || card.refSource === 'manual') continue;
     scanned++;
     const dir = remoteLedgerMirrorDir(root, card.parentHost.host);
@@ -51,6 +64,10 @@ export async function bindMirroredRemoteRejudgeCards(
       // dependency: cards with a remote PR cannot be selected while their parent/child ledgers are absent locally.
       // Limit fresh remote pulls to recent launches, but keep binding older ledgers already mirrored at HQ.
       if (recentlyLaunched(card, now)) mirror(card.parentHost, card.runId, root);
+      else if (!existsSync(join(dir, `${card.runId}.jsonl`)) && pulledUnmirrored < unmirroredCap) {
+        pulledUnmirrored++;
+        mirror(card.parentHost, card.runId, root);
+      }
       const snapshot = await readCardRunSnapshot(card, {
         loadLedger: (id) => loadRunLedger(id, dir),
         podFinishes: () => [],
@@ -67,10 +84,13 @@ export async function bindMirroredRemoteRejudgeCards(
       }
       // A PR event alone is not a completed remote run. The rejudge candidate must have the same exact
       // child PR and terminal status that remoteBoundRunTerminal will later require.
+      // TA-BIND-PR-TERMINAL — a blocked-draft child has no `pr-opened`; the parent's `pr-terminal` for that exact child,
+      // number and URL is the same PR evidence.
+      const terminal = parent ? podTerminalPr(parent, [childRunId ?? '']) : undefined;
       if (!parent || !childRunId || !pr?.url || !child
         || !podChildRunIds(parent, card.runId).includes(childRunId)
-        || !child.some((entry) => entry.event === 'pr-opened' && entry.data?.number === pr.number
-          && entry.data?.url === pr.url)
+        || !(child.some((entry) => entry.event === 'pr-opened' && entry.data?.number === pr.number
+          && entry.data?.url === pr.url) || (terminal?.number === pr.number && terminal.url === pr.url))
         || !child.some((entry) => entry.event === 'run-status'
           && ['completed', 'failed', 'cancelled'].includes(String(entry.data?.runStatus)))) { skipped++; continue; }
       const result = await refreshCardRunBinding(card.id, statePath, {
@@ -87,5 +107,5 @@ export async function bindMirroredRemoteRejudgeCards(
       reportFailure(card, error instanceof Error ? error.message : String(error));
     }
   }
-  return { scanned, bound, skipped };
+  return { scanned, bound, skipped, pulledUnmirrored };
 }