elanous 0.2.29 → 0.2.32

package/src/task-agent/remote-rejudge-bind.ts

@@ -1,16 +1,24 @@
 /** Bind remote TA parents from the HQ ledger mirror before `rejudge --all` selects PR cards. */
-import { dirname } from 'node:path';
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { debug } from '../debug/log.js';
 import { loadRunLedger } from '../self-implement/run-ledger.js';
-import { bindCardEvidence, podChildRunIds, readCardRunSnapshot, refreshCardRunBinding } from './card-evidence.js';
+import { bindCardEvidence, podChildRunIds, podTerminalPr, readCardRunSnapshot, refreshCardRunBinding } from './card-evidence.js';
 import { mirrorRemoteRunLedgers, remoteLedgerMirrorDir } from './parent-host.js';
 import { cardPrNumber, type TaskCard } from './task-hand.js';
 
 const RECENT_LAUNCH_MS = 24 * 60 * 60 * 1000;
+/**
+ * TA-BIND-PULL-ONCE — an older launch whose parent ledger was never mirrored at HQ gets one pull («묶기만»).
+ * Bounded per tick so the first tick after deploy does not run hundreds of sequential ssh reads (backlog ≈690
+ * cards on 10-15 drains over ticks); a pulled mirror is then read locally and never pulled again by this rule.
+ */
+export const UNMIRRORED_PULL_CAP_PER_TICK = 20;
 
 type BindDeps = {
   now?: () => number;
   mirror?: typeof mirrorRemoteRunLedgers;
+  unmirroredPullCap?: number;
   onFailure?: (failure: { card: string; runId: string; host: string; reason: string }) => void;
 };
 
@@ -23,13 +31,14 @@ function recentlyLaunched(card: TaskCard, now: number): boolean {
 /**
  * A remote child PR can appear after the last HQ card refresh. A card without a PR is otherwise absent from
  * `rejudgeCandidates`, so the normal rejudge tick never reaches `mirrorRemoteCardLedger` or the binding replay.
- * Only an existing, launched TA-owned parent with a parent→child edge in its own host mirror is admitted. The
+ * Only an existing, launched parent (TA-owned or not — TA-BIND-WIDEN) with a parent→child edge in its own host
+ * mirror is bound; rejudge/land selection keeps its own taLand gate. The
  * launch registry (including foreign/test universes) and child-only ledgers are never scanned or adopted here.
  */
 export async function bindMirroredRemoteRejudgeCards(
   tasks: Readonly<Record<string, TaskCard>>, statePath: string,
   deps: BindDeps = {},
-): Promise<{ scanned: number; bound: number; skipped: number }> {
+): Promise<{ scanned: number; bound: number; skipped: number; pulledUnmirrored: number }> {
   const root = dirname(statePath);
   const now = (deps.now ?? Date.now)();
   const mirror = deps.mirror ?? mirrorRemoteRunLedgers;
@@ -41,8 +50,12 @@ export async function bindMirroredRemoteRejudgeCards(
   let scanned = 0;
   let bound = 0;
   let skipped = 0;
+  let pulledUnmirrored = 0;
+  const unmirroredCap = deps.unmirroredPullCap ?? UNMIRRORED_PULL_CAP_PER_TICK;
   for (const card of Object.values(tasks)) {
-    if (card.status !== 'launched' || card.taLand !== true || !card.parentHost || !card.runId
+    // TA-BIND-WIDEN — «묶기»는 taLand 와 무관하게 launched ⊕ runId 카드 전부. 묶여도 재판정(rejudge)·land 후보는
+    // `rejudgeCandidates`/`remoteBoundRunTerminal` 의 taLand 관문이 그대로 거른다 — 여기서 넓히는 것은 카드↔PR 연결뿐이다.
+    if (card.status !== 'launched' || !card.parentHost || !card.runId
       || cardPrNumber(card) !== undefined || card.refSource === 'manual') continue;
     scanned++;
     const dir = remoteLedgerMirrorDir(root, card.parentHost.host);
@@ -51,6 +64,10 @@ export async function bindMirroredRemoteRejudgeCards(
       // dependency: cards with a remote PR cannot be selected while their parent/child ledgers are absent locally.
       // Limit fresh remote pulls to recent launches, but keep binding older ledgers already mirrored at HQ.
       if (recentlyLaunched(card, now)) mirror(card.parentHost, card.runId, root);
+      else if (!existsSync(join(dir, `${card.runId}.jsonl`)) && pulledUnmirrored < unmirroredCap) {
+        pulledUnmirrored++;
+        mirror(card.parentHost, card.runId, root);
+      }
       const snapshot = await readCardRunSnapshot(card, {
         loadLedger: (id) => loadRunLedger(id, dir),
         podFinishes: () => [],
@@ -67,10 +84,13 @@ export async function bindMirroredRemoteRejudgeCards(
       }
       // A PR event alone is not a completed remote run. The rejudge candidate must have the same exact
       // child PR and terminal status that remoteBoundRunTerminal will later require.
+      // TA-BIND-PR-TERMINAL — a blocked-draft child has no `pr-opened`; the parent's `pr-terminal` for that exact child,
+      // number and URL is the same PR evidence.
+      const terminal = parent ? podTerminalPr(parent, [childRunId ?? '']) : undefined;
       if (!parent || !childRunId || !pr?.url || !child
         || !podChildRunIds(parent, card.runId).includes(childRunId)
-        || !child.some((entry) => entry.event === 'pr-opened' && entry.data?.number === pr.number
-          && entry.data?.url === pr.url)
+        || !(child.some((entry) => entry.event === 'pr-opened' && entry.data?.number === pr.number
+          && entry.data?.url === pr.url) || (terminal?.number === pr.number && terminal.url === pr.url))
         || !child.some((entry) => entry.event === 'run-status'
           && ['completed', 'failed', 'cancelled'].includes(String(entry.data?.runStatus)))) { skipped++; continue; }
       const result = await refreshCardRunBinding(card.id, statePath, {
@@ -87,5 +107,5 @@ export async function bindMirroredRemoteRejudgeCards(
       reportFailure(card, error instanceof Error ? error.message : String(error));
     }
   }
-  return { scanned, bound, skipped };
+  return { scanned, bound, skipped, pulledUnmirrored };
 }

package/src/task-agent/repair-cycle.ts

@@ -3,6 +3,7 @@ import { spawn } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve, sep } from 'node:path';
 import { debug } from '../debug/log.js';
+import { readBudgetInputsLive, type BudgetInputs } from '../self-implement/budget-gate.js';
 import { mintRunId } from '../harness/harness-space.js';
 import { spawnElanousSync } from '../instance/spawn-elanous.js';
 import { passJourneyNode } from '../self-dev/graph-journey-nodes.js';
@@ -32,11 +33,17 @@ export interface RepairCycleInput {
   resolveOwner?: (card: TaskCard) => RepairOwner;
   /** Shared only by one `tasks rejudge --all` invocation; a single-card rejudge has no cap. */
   repairBudget?: RepairTickBudget;
+  /** Test seam; production reads the existing subscription quota signals. */
+  modelAvailability?: RepairModelAvailability;
+  /** Test seam for the same live quota reader used when availability is not injected. */
+  readBudgetInputs?: () => Promise<Pick<BudgetInputs, 'codexCandidates' | 'grokUsedPercent' | 'maxUsedPercent'>>;
 }
 
 export interface RepairTickBudget { max: number; requested: number; capped: number }
 
-export type RepairCycleOutcome = { decision: 'would-repair' | 'repair-requested' | 'repair-pending' | 'repair-applied' | 'repair-failed' | 'repair-stopped'; reason: string };
+export type RepairCycleOutcome = { decision: 'would-repair' | 'repair-requested' | 'repair-pending' | 'repair-applied' | 'repair-failed' | 'repair-stopped'; reason: string;
+  /** Present only when this tick actually consumed a bound worker result. */
+  repairRunId?: string; repairHead?: string };
 export type RepairOwner = { seat?: TaskSeat; source: string; reason?: string };
 
 /** A missing card seat may use only a uniquely identified checklist cell's valid seat. */
@@ -70,12 +77,39 @@ export function resolveRepairOwner(card: TaskCard, deps: {
   } catch { return { source: 'none', reason: `checklist owner invalid: ${cell.version}/${card.checklistId}` }; }
 }
 
-export function alternateRepairModel(card: TaskCard): { from: string; to: TaskChildLlm } {
+export interface RepairModelAvailability { codexSubscription: boolean; grokSubscription: boolean }
+
+export async function repairModelAvailability(readInputs: () => Promise<Pick<BudgetInputs, 'codexCandidates' | 'grokUsedPercent' | 'maxUsedPercent'>> = readBudgetInputsLive): Promise<RepairModelAvailability> {
+  try {
+    const input = await readInputs();
+    const codexCap = input.maxUsedPercent['openai-codex'] ?? 95;
+    const grokCap = input.maxUsedPercent.grok ?? 100;
+    return {
+      codexSubscription: input.codexCandidates.some((candidate) => candidate.reached !== true
+        && typeof candidate.usedPercent === 'number' && candidate.usedPercent < codexCap),
+      grokSubscription: typeof input.grokUsedPercent === 'number' && input.grokUsedPercent < grokCap,
+    };
+  } catch { return { codexSubscription: false, grokSubscription: false }; }
+}
+
+/** Repair stays inside the dispatch tier. A missing legacy tier is high, with Sol allowed only on measured subscription quota. */
+export function alternateRepairModel(card: TaskCard, availability: RepairModelAvailability = { codexSubscription: false, grokSubscription: false }): { from: string; to: TaskChildLlm } {
   const last = card.repairs?.at(-1);
   const from = last?.toModel ?? (card.childLlm ? `${card.childLlm.provider}/${card.childLlm.model}` : 'unknown');
-  const to = from.includes('openrouter/') || from.includes('glm')
-    ? { provider: 'openai-codex', model: 'gpt-6-sol' }
-    : { provider: 'openrouter', model: 'openrouter/z-ai/glm-5.3' };
+  const glm: TaskChildLlm = { provider: 'openrouter', model: 'openrouter/z-ai/glm-5.3' };
+  const sol: TaskChildLlm = { provider: 'openai-codex', model: 'gpt-6-sol' };
+  const grok: TaskChildLlm = { provider: 'grok', model: 'grok-4.6' };
+  const tier = card.tier ?? '상';
+  const pr = typeof card.pr === 'number' ? card.pr : card.pr?.number;
+  const mixEven = ((pr ?? [...card.id].reduce((sum, ch) => sum + ch.charCodeAt(0), 0)) % 2) === 0;
+  let to: TaskChildLlm;
+  if (tier === '특') to = sol;
+  else if (tier === '상' && availability.codexSubscription && mixEven && !from.includes('gpt-6-sol')) to = sol;
+  else if (tier === '상') to = availability.grokSubscription && from.includes('glm') ? grok
+    : from.includes('glm-5.3-flash') ? glm
+    : from.includes('glm-5.3') ? { provider: 'openrouter', model: 'openrouter/z-ai/glm-5.3-flash' } : glm;
+  else to = from.includes('glm-5.3-flash') ? glm : from.includes('glm-5.3')
+    ? { provider: 'openrouter', model: 'openrouter/z-ai/glm-5.3-flash' } : glm;
   return { from, to };
 }
 
@@ -131,6 +165,7 @@ export async function runRepairCycle(input: RepairCycleInput): Promise<RepairCyc
             runId: latest.runId, effect: status, detail: applied.ok ? applied.toHead : applied.reason }] } : undefined);
     } catch (error) { return { decision: 'repair-pending', reason: `repair confirmation card write failed: ${String(error).slice(-200)}` }; }
     const recorded = readTaskCard(card.id, statePath)?.repairs?.find((entry) => entry.runId === latest.runId)?.status === status;
+    // This confirms a result already claimed by another tick; it did not consume the worker result.
     return recorded ? { decision: applied.ok ? 'repair-applied' : 'repair-failed', reason: applied.ok ? `same PR #${pr} fast-forward ${latest.head.slice(0, 12)} → ${applied.toHead.slice(0, 12)}` : applied.reason }
       : { decision: 'repair-pending', reason: 'repair confirmation card changed concurrently' };
   }
@@ -187,7 +222,8 @@ export async function runRepairCycle(input: RepairCycleInput): Promise<RepairCyc
             runId: latest.runId, effect: status, detail }] } : undefined);
     } catch (error) { return { decision: 'repair-pending', reason: `repair card write failed after CAS: ${String(error).slice(-200)}` }; }
     const recorded = readTaskCard(card.id, statePath)?.repairs?.find((entry) => entry.runId === latest.runId)?.status === status;
-    return recorded ? { decision: applied?.ok ? 'repair-applied' : applied?.unconfirmed ? 'repair-pending' : 'repair-failed', reason: detail }
+    return recorded ? { decision: applied?.ok ? 'repair-applied' : applied?.unconfirmed ? 'repair-pending' : 'repair-failed', reason: detail,
+      repairRunId: latest.runId, repairHead: latest.head }
       : { decision: 'repair-pending', reason: 'repair result card changed concurrently' };
   }
   if (latest?.status === 'applied' && latest.head.toLowerCase() === head.toLowerCase())
@@ -244,7 +280,9 @@ export async function runRepairCycle(input: RepairCycleInput): Promise<RepairCyc
   }
   const next = attempts.length + 1;
   const runId = mintRunId();
-  const { from, to } = alternateRepairModel(card);
+  const availability = input.modelAvailability ?? (card.tier === '특' || card.tier === '중' || card.tier === '하'
+    ? { codexSubscription: false, grokSubscription: false } : await repairModelAvailability(input.readBudgetInputs));
+  const { from, to } = alternateRepairModel(card, availability);
   const resultPath = repairResultPath(statePath, card.id, pr, head, next, runId);
   const goalFile = resultPath.replace(/\.json$/, '.goal.txt');
   const goal = `기존 PR #${pr}의 리뷰 때 head ${head}를 같은 가지에서 수리한다. 새 PR을 열지 말고 아래 must-fix 원문만 고쳐 commit-only 결과를 반환한다.\n\n${input.mustFix.map((item, i) => `${i + 1}. ${item}`).join('\n')}`;

package/src/task-agent/repair-worker.ts

@@ -4,6 +4,7 @@ import { mkdirSync, renameSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
 import type { RepairCommitResult } from './repair-branch-cas.js';
 import type { TaskChildLlm } from './task-hand.js';
+import { publishInsideEvent } from '../nexus/api/inside-events.js';
 
 const SHA40 = /^[0-9a-f]{40}$/i;
 const SHA256 = /^[0-9a-f]{64}$/i;
@@ -70,6 +71,12 @@ export async function runRepairWorker(request: RepairWorkerRequest): Promise<Rep
   const tmp = `${request.resultPath}.${process.pid}.tmp`;
   writeFileSync(tmp, JSON.stringify(result));
   renameSync(tmp, request.resultPath);
+  // The result file, rather than this best-effort notification, is the durable source.
+  try {
+    publishInsideEvent({ kind: 'ta.repair.completed', schema: 1, card: request.card,
+      pr: request.pr, head: request.head, runId: request.runId,
+      resultPath: request.resultPath, completedAt: new Date().toISOString() });
+  } catch { /* a missing daemon cannot change the worker result */ }
   return result;
 }
 

package/src/task-agent/run-identity.ts

@@ -0,0 +1,200 @@
+/**
+ * RUN-IDENTITY-TAGS(칸 0.2.32 · P0) — 런 신분 묶음 정본(RFC adaptive-graph-ops §9.9).
+ *
+ * - 닫힌 목록 신분 묶음 `RunIdentity`: GATE-PRIORITY 의 «run priority» 를 `class` 로
+ *   흡수한다(승인·선점이 `RUN_IDENTITY_QUEUE_PRIORITY` 로 이 문을 읽는다 — 나머지
+ *   디스패처 배선은 RUN-IDENTITY-ADMIT).
+ * - parse/validate: 목록 밖 값은 거부한다(조용히 다듬지 않는다).
+ * - 출생 신분 자동(`deriveBirthIdentity`): 칸 우선순위(P0 = critical·special·protect ·
+ *   P1 = normal · 그 외 normal)·대표 표시에서 단다.
+ * - 태그 덮기(`applyRunIdentityTags`): `tasks hand --tag k=v`(반복) 이 출생 신분을 덮는다.
+ * - ⛔ 모르는 칸을 기본값으로 확정하지 않는다: 칸 조회가 실패하면 명시 태그만 담고 나머지는 «미기록».
+ * - 태그 바꾸기 감사(`runTagChange` — task-hand.ts): 카드 history 에 `run-tag-change`
+ *   {from, to, by, reason} 을 남긴다.
+ */
+
+/** 신분 계급 — GATE-PRIORITY «run priority» 흡수: 게이트|착지|비상|보통|유휴. */
+export const RUN_IDENTITY_CLASSES = ['gate', 'landing', 'critical', 'normal', 'idle'] as const;
+export type RunIdentityClass = (typeof RUN_IDENTITY_CLASSES)[number];
+/** 돌봄: 표준|특별|집중돌봄. */
+export const RUN_IDENTITY_CARES = ['standard', 'special', 'icu'] as const;
+export type RunIdentityCare = (typeof RUN_IDENTITY_CARES)[number];
+/** 권한 크기: 보통|중간|큰. */
+export const RUN_IDENTITY_RIGHTS = ['s', 'm', 'l'] as const;
+export type RunIdentityRights = (typeof RUN_IDENTITY_RIGHTS)[number];
+/** 출생 자리: 디스패처|손|대기열|의사. */
+export const RUN_IDENTITY_LAUNCHERS = ['dispatcher', 'hand', 'queue', 'doctor'] as const;
+export type RunIdentityLauncher = (typeof RUN_IDENTITY_LAUNCHERS)[number];
+
+/** 출생 기록 — 칸마다 optional: 없는 칸은 «미기록»(모른다)이다. 출생 자리를 모르면 `launcher` 를 비운다(지어내지 않는다). */
+export interface RunIdentityOrigin {
+  checklistId?: string;
+  version?: string;
+  seat?: string;
+  launcher?: RunIdentityLauncher;
+}
+
+/**
+ * 런 신분 묶음 — 카드 상태 파일(원장 정본)에 실린다(`TaskCard.identity`).
+ * ⛔ 모르는 칸을 기본값으로 확정하지 않는다 — 칸마다 optional 이고 없는 칸은 «미기록»이다.
+ * 확인된 칸만 담는다: 명시 태그(`--tag k=v`) ⊕ 조회에 성공한 칸에서 단 출생값(`deriveBirthIdentity`).
+ * 승인·선점이 `class` 를 못 찾으면 normal 로 «읽을» 뿐(`runPriorityClass`) 원장엔 적지 않는다.
+ */
+export interface RunIdentity {
+  class?: RunIdentityClass;
+  care?: RunIdentityCare;
+  rights?: RunIdentityRights;
+  protect?: boolean;
+  origin: RunIdentityOrigin;
+}
+
+/** 화면·감사 줄의 «미기록» 표기 — 원장에 없는 칸(모른다). */
+export const RUN_IDENTITY_UNRECORDED = '미기록';
+
+/** 신분 칸 하나를 글로 — 없으면 «미기록»(기본값으로 채우지 않는다). */
+export function runIdentityFieldText(identity: RunIdentity | undefined, key: RunTagKey): string {
+  const value = identity?.[key];
+  return value === undefined ? RUN_IDENTITY_UNRECORDED : String(value);
+}
+
+/** `--tag k=v` 칸(닫힌 목록) — 신분의 어느 칸을 바꾸는지. */
+export const RUN_TAG_KEYS = ['class', 'care', 'rights', 'protect'] as const;
+export type RunTagKey = (typeof RUN_TAG_KEYS)[number];
+export type RunIdentityTag =
+  | { key: 'class'; value: RunIdentityClass }
+  | { key: 'care'; value: RunIdentityCare }
+  | { key: 'rights'; value: RunIdentityRights }
+  | { key: 'protect'; value: boolean };
+
+/** 칸(체크리스트 셀) — 출생 신분이 단다: 우선순위·대표 표시(제목)·칸보드 판. */
+export interface RunIdentityCell {
+  title?: string;
+  priority?: string;
+  version?: string;
+}
+
+export function parseRunIdentityClass(value: string): RunIdentityClass {
+  if (!RUN_IDENTITY_CLASSES.includes(value as RunIdentityClass)) throw new Error(`run identity class 는 ${RUN_IDENTITY_CLASSES.join('|')} 중 하나다: ${JSON.stringify(value)}`);
+  return value as RunIdentityClass;
+}
+
+export function parseRunIdentityCare(value: string): RunIdentityCare {
+  if (!RUN_IDENTITY_CARES.includes(value as RunIdentityCare)) throw new Error(`run identity care 는 ${RUN_IDENTITY_CARES.join('|')} 중 하나다: ${JSON.stringify(value)}`);
+  return value as RunIdentityCare;
+}
+
+export function parseRunIdentityRights(value: string): RunIdentityRights {
+  if (!RUN_IDENTITY_RIGHTS.includes(value as RunIdentityRights)) throw new Error(`run identity rights 는 ${RUN_IDENTITY_RIGHTS.join('|')} 중 하나다: ${JSON.stringify(value)}`);
+  return value as RunIdentityRights;
+}
+
+export function parseRunIdentityProtect(value: string): boolean {
+  if (value !== 'true' && value !== 'false') throw new Error(`run identity protect 는 true|false 다: ${JSON.stringify(value)}`);
+  return value === 'true';
+}
+
+/** `k=v` 한 줄을 신분 태그로 — 모르는 칸·목록 밖 값은 거부한다. */
+export function parseRunIdentityTag(tag: string): RunIdentityTag {
+  const eq = tag.indexOf('=');
+  const key = eq < 0 ? '' : tag.slice(0, eq);
+  const value = eq < 0 ? '' : tag.slice(eq + 1);
+  if (!RUN_TAG_KEYS.includes(key as RunTagKey)) throw new Error(`run identity 태그 칸은 ${RUN_TAG_KEYS.join('|')} 중 하나다: ${JSON.stringify(tag)}`);
+  switch (key) {
+    case 'class': return { key: 'class', value: parseRunIdentityClass(value) };
+    case 'care': return { key: 'care', value: parseRunIdentityCare(value) };
+    case 'rights': return { key: 'rights', value: parseRunIdentityRights(value) };
+    default: return { key: 'protect', value: parseRunIdentityProtect(value) };
+  }
+}
+
+/** 이미 검증한 태그 하나를 신분에 얹는다(검증은 `parseRunIdentityTag` 몫). */
+export function applyRunIdentityTag(identity: RunIdentity, tag: RunIdentityTag): RunIdentity {
+  switch (tag.key) {
+    case 'class': return { ...identity, class: tag.value };
+    case 'care': return { ...identity, care: tag.value };
+    case 'rights': return { ...identity, rights: tag.value };
+    default: return { ...identity, protect: tag.value };
+  }
+}
+
+/** `--tag k=v`(반복) 이 출생 신분을 덮는다 — 순서대로 얹는다. */
+export function applyRunIdentityTags(identity: RunIdentity, tags: readonly string[]): RunIdentity {
+  let next = identity;
+  for (const tag of tags) next = applyRunIdentityTag(next, parseRunIdentityTag(tag));
+  return next;
+}
+
+/** 대표 표시(왕관) — 이스케이프로 적어 이 줄이 누출 검사(ceo-mark)에 걸리지 않게 한다. */
+const CROWN_MARK = '\u{1F451}';
+
+/**
+ * 출생 신분 자동 — «조회에 성공한» 칸의 우선순위(P0 = critical·special·protect · P1 = normal · 그 외 normal)·대표 표시에서 단다.
+ * 권한(rights)은 출생에서 올리지 않는다(기본 s · 올림은 `--tag rights=…` 명시만).
+ * ⛔ 칸을 못 읽었으면 부르지 않는다 — 그때는 `{ origin }` 에 명시 태그만 얹는다(나머지 «미기록»).
+ * ⛔ 읽은 칸이라도 `priority`·`title` 이 비면 그 값에서 파생되는 칸을 확정하지 않는다(«미기록»):
+ *   class 는 priority 가 있어야 · care·protect 는 P0 이거나 대표 가 보이면 올리고, «안 올림»(standard·false)은
+ *   priority 와 title 이 둘 다 있을 때만 확정한다.
+ */
+export function deriveBirthIdentity(cell: RunIdentityCell, origin: RunIdentityOrigin): RunIdentity {
+  const priority = cell.priority?.trim() ? cell.priority.trim() : undefined;
+  const title = cell.title?.trim() ? cell.title : undefined;
+  const critical = priority === 'P0';
+  const crown = title?.includes(CROWN_MARK) === true;
+  const raised = critical || crown;
+  const careKnown = raised || (priority !== undefined && title !== undefined);
+  return {
+    ...(priority !== undefined ? { class: critical ? 'critical' as const : 'normal' as const } : {}),
+    ...(careKnown ? { care: raised ? 'special' as const : 'standard' as const, protect: raised } : {}),
+    rights: 's',
+    origin,
+  };
+}
+
+/** GATE-PRIORITY «run priority» 흡수 — 신분 `class` 가 런 우선순위다(승인·선점이 읽는다 · 없거나 «미기록»이면 normal 로 «읽는다» — 원장엔 적지 않는다). */
+export function runPriorityClass(identity?: Pick<RunIdentity, 'class'> | null): RunIdentityClass {
+  return identity?.class ?? 'normal';
+}
+
+/**
+ * 승인·선점 가늠자 — 신분 `class` 를 대기열 줄 우선순위로 옮긴다(RUN-IDENTITY-ADMIT 첫 배선).
+ * 게이트 > 착지 > 비상 순, 셋 다 칸 러브릭·CEO 보너스(`harness-queue.ts` ≈ 125.5 이하)보다
+ * 위에 줄 선다 — `tasks hand` 발사 인자가 이 값을 싣고 승인·선점이 읽는다.
+ * 보통·유휴는 칸 러브릭을 그대로 쓴다(값 없음).
+ */
+export const RUN_IDENTITY_QUEUE_PRIORITY: Record<RunIdentityClass, number | undefined> = { gate: 200, landing: 175, critical: 150, normal: undefined, idle: undefined };
+
+/** 신분의 대기열 줄 우선순위 — 보통·유휴는 칸 러브릭으로 흐른다(값 없음). */
+export function runIdentityQueuePriority(identity?: Pick<RunIdentity, 'class'> | null): number | undefined {
+  return RUN_IDENTITY_QUEUE_PRIORITY[runPriorityClass(identity)];
+}
+
+/** 평범한 객체인가 — 원형이 Object.prototype 또는 null 인 객체만(배열·Date·클래스 인스턴스·null 아님). 원장에서 읽은 값의 형태 검사. */
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  if (value === null || typeof value !== 'object') return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+
+/**
+ * 원장에서 읽은 신분도 닫힌 목록으로 검증한다 — 목록 밖 값·형태가 틀린 값은 거부한다.
+ * 출생 기록(origin)은 없으면 «미기록»(빈 출생 기록 `{}` 으로 읽는다 — 지어내지 않는다) ·
+ * 있으면 평범한 객체여야 하고 checklistId·version·seat 는 문자열, launcher 는 닫힌 목록이다.
+ */
+export function validateRunIdentity(identity: RunIdentity): RunIdentity {
+  if (!isPlainRecord(identity)) throw new Error(`run identity 는 객체다: ${JSON.stringify(identity)}`);
+  // 칸마다 optional(없으면 «미기록») — 있는 칸만 닫힌 목록으로 검증한다.
+  const { class: klass, care, rights, protect, origin } = identity as Partial<RunIdentity>;
+  if (klass !== undefined && !RUN_IDENTITY_CLASSES.includes(klass)) throw new Error(`run identity class 는 ${RUN_IDENTITY_CLASSES.join('|')} 중 하나다: ${JSON.stringify(klass)}`);
+  if (care !== undefined && !RUN_IDENTITY_CARES.includes(care)) throw new Error(`run identity care 는 ${RUN_IDENTITY_CARES.join('|')} 중 하나다: ${JSON.stringify(care)}`);
+  if (rights !== undefined && !RUN_IDENTITY_RIGHTS.includes(rights)) throw new Error(`run identity rights 는 ${RUN_IDENTITY_RIGHTS.join('|')} 중 하나다: ${JSON.stringify(rights)}`);
+  if (protect !== undefined && typeof protect !== 'boolean') throw new Error(`run identity protect 는 true|false 다: ${JSON.stringify(protect)}`);
+  if (origin === undefined) return { ...identity, origin: {} };   // 출생 기록 «미기록» — 칸을 지어내지 않는다.
+  if (!isPlainRecord(origin)) throw new Error(`run identity origin 은 객체다: ${JSON.stringify(origin)}`);
+  for (const key of ['checklistId', 'version', 'seat'] as const) {
+    const value = origin[key];
+    if (value !== undefined && typeof value !== 'string') throw new Error(`run identity origin.${key} 는 문자열이다: ${JSON.stringify(value)}`);
+  }
+  const launcher = origin.launcher;
+  if (launcher !== undefined && !RUN_IDENTITY_LAUNCHERS.includes(launcher as RunIdentityLauncher)) throw new Error(`run identity 출생 자리는 ${RUN_IDENTITY_LAUNCHERS.join('|')} 중 하나다: ${JSON.stringify(launcher)}`);
+  return identity;
+}

package/src/task-agent/shadow.ts

@@ -2,8 +2,8 @@
  * TASK-AGENT-SHADOW — 슈퍼바이저가 런의 멈춤을 확정한 자리에서 판단부를 «그림자»로 부른다.
  *
  * RFC-task-agent-any-task-to-completion-2026-10-06 §A9 «판단부 호출부 0»을 메운다.
- * - 입력은 슈퍼바이저 결과에 «이미 실려 있는» 값만 쓴다(네트워크 호출 0): 종료 어휘 ·
- *   PR 번호/병합 여부(`prNumber`·`merged`). 리뷰 판정·must-fix 는 결과에 없으므로 비운다
+ * - 기본 판단은 슈퍼바이저 결과에 이미 실린 종료 어휘·PR 번호·병합 여부를 쓴다.
+ *   카드가 묶인 코드 PR의 target diff는 저장소가 고정된 gh 조회로 별도 측정한다. 리뷰 판정·must-fix 는 결과에 없으므로 비운다
  *   («통과»로 읽지 않는다 — 판단부가 review 수를 고른다).
  * - 슈퍼바이저의 기본 호출은 shadow: «했을 수»만 기록하고 명령·복사는 하나도 돌리지 않는다.
  *   전달 과제의 명시적 live 호출만 파일을 복사한다. 설정 `taskAgent.mode=live` 는 기본 호출에 먹지 않는다.
@@ -11,6 +11,8 @@
  */
 import { lstatSync, readFileSync, readdirSync, realpathSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
 import { extname, join, relative, resolve } from 'node:path';
 import { debug } from '../debug/log.js';
 import { readTaskAgentState, readTaskCard, taskAgentStatePath, TASK_CARD_PREFIX, type CompletionKind, type TaskCard } from './task-hand.js';
@@ -72,12 +74,32 @@ export interface TaskAgentShadowDeps {
   statePath?: string;
   /** TA-WIRING-CHECK — 배선 근거 수집 의존(시험 주입 · 기본 = gh pr diff 한 번 ⊕ 카드 런 원장). */
   wiring?: Omit<WiringEvidenceDeps, 'card'>;
+  /** Complete PR target paths; undefined means unmeasured, never goal-only. */
+  prFiles?: (pr: number, prUrl: string | undefined) => Promise<readonly string[] | undefined>;
   /** Process env for the launched-run id (`ELANOUS_RUN_ID`) — test seam; default process.env. */
   env?: NodeJS.ProcessEnv;
   /** Remote pending-move ledger seam; defaults to the run ledger. */
   queueMove?: typeof appendRunLedgerEntry;
 }
 
+const execFileAsync = promisify(execFile);
+export function prRepositoryFromUrl(pr: number, prUrl: string | undefined): string | undefined {
+  const match = prUrl?.match(/^https:\/\/github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/pull\/(\d+)\/?$/);
+  return match && Number(match[3]) === pr ? `${match[1]}/${match[2]}` : undefined;
+}
+
+export async function defaultPrFiles(pr: number, prUrl: string | undefined,
+  run: (args: readonly string[]) => Promise<string> = async (args) => {
+    const { stdout } = await execFileAsync('gh', [...args],
+      { encoding: 'utf8', timeout: 20_000, maxBuffer: 4 * 1024 * 1024 });
+    return stdout;
+  }): Promise<readonly string[]> {
+  const repository = prRepositoryFromUrl(pr, prUrl);
+  if (!repository) throw new Error('bound PR repository unavailable');
+  const stdout = await run(['pr', 'diff', String(pr), '--name-only', '-R', repository]);
+  return stdout.split(/\r?\n/).filter(Boolean);
+}
+
 export const REMOTE_CARD_MOVE_PENDING = 'task-agent-card-move-pending';
 
 /** 카드 조회 상태 파일 — 조회 경로 전부가 같은 파일을 본다. */
@@ -258,6 +280,17 @@ export async function recordTaskAgentShadowMove(input: TaskAgentShadowInput, dep
     }
   }
   if (selfReview) judgeInput.review = selfReview.verdict;
+  if (card && typeof judgeInput.pr === 'number' && (!kind || kind === 'code-pr')) {
+    try {
+      const prUrl = typeof card.pr === 'object' && card.pr.number === judgeInput.pr && card.pr.url
+        ? card.pr.url : successful?.prUrl;
+      const files = await (deps.prFiles ?? defaultPrFiles)(judgeInput.pr, prUrl);
+      if (files) judgeInput.prTargetPaths = files;
+    } catch (error) {
+      try { (deps.log ?? ((c, e, d) => debug.log(c, e, d)))('task-agent', 'pr-target-diff-unavailable',
+        { runId: input.runId, pr: judgeInput.pr, reason: error instanceof Error ? error.message : String(error) }); } catch { /* fail-soft */ }
+    }
+  }
   const delivery = successful?.worktreePath && card?.project?.target && isDeliveryKind(kind)
     ? { kind, worktreePath: successful.worktreePath, projectTarget: card.project.target, files: selectDeliveryCandidates(successful.worktreePath, kind) }
     : undefined;
@@ -266,6 +299,16 @@ export async function recordTaskAgentShadowMove(input: TaskAgentShadowInput, dep
       ? { move: 'wait', stage: 'observing', reason: '전달 후보 확인 — 산출물 판독 대기', executorKind: 'deliver' }
       : { move: 'wait', stage: 'waiting', reason: '전달 후보 없음' }
     : judgeNextMove(judgeInput);
+  if (judgement.reason.startsWith('goal-only-pr —') && input.runId) {
+    try {
+      (deps.queueMove ?? appendRunLedgerEntry)({ timestamp: new Date().toISOString(), runId: input.runId,
+        event: 'task-agent-goal-only-pr', data: { pr: judgeInput.pr, paths: judgeInput.prTargetPaths,
+          targetDiff: 0, reason: judgement.reason, requeue: 'stopped' } });
+    } catch (error) {
+      try { (deps.log ?? ((c, e, d) => debug.log(c, e, d)))('task-agent', 'goal-only-pr-ledger-failed',
+        { runId: input.runId, pr: judgeInput.pr, reason: error instanceof Error ? error.message : String(error) }); } catch { /* fail-soft */ }
+    }
+  }
   if (cardLookupFailed) judgement.reason = `${judgement.reason} · 종결 종류 미확인(카드 조회 실패)`;
   // 판단마다 해석한다 — 허용되지 않은 수를 판단할 때도 모르는 항목 경고가 남게.
   const liveMoves = deps.liveMoves ?? await configuredTaskAgentLiveMoves();
@@ -342,8 +385,12 @@ export async function recordTaskAgentShadowMove(input: TaskAgentShadowInput, dep
           } } : {}),
         }, liveMoveDeps(deps));
     } else if (liveKind === 'propose-land') {
+      // A supervisor live move can reach land before the periodic rejudge tick. Carry
+      // the captured review file for this PR/head so queue mode can verify its bytes.
+      const reviewResultPath = boundCard?.reviewRequests?.find((request) => request.pr === prResult?.prNumber
+        && request.head.toLowerCase() === selfReview?.head.toLowerCase() && request.resultPath && !request.error)?.resultPath;
       liveMove = await executeLiveLand(boundCard, prResult?.prNumber,
-        { runId: input.runId, cycleId: input.cycleId, review: selfReview,
+        { runId: input.runId, cycleId: input.cycleId, review: selfReview, ...(reviewResultPath ? { reviewResultPath } : {}),
           ...(prResult?.worktreePath ? { cwd: prResult.worktreePath } : {}),
           ...(prResult && !prResult.worktreePath ? { produced: {
             ...(prResult.checkedHeadCommit !== undefined ? { headCommit: prResult.checkedHeadCommit } : {}),