elanous 0.2.31 → 0.2.32

package/src/cli/pr-cli.ts

@@ -58,13 +58,16 @@ import { branchLineageSlug, findSiblingPrs } from './pr-lineage.js';
 import { parseReleaseNoteSection } from '../release-loop/release-note.js';
 import { landingFreezeMessage } from '../release-loop/landing-freeze.js';
 import { admitLandingMerge } from '../self-implement/frozen-merges.js';
-import { verifyAllSameHeadReviews, verifyAncestorAutoPass, verifyOverlapEvidence } from './pr-land-overlap-evidence.js';
+import { verifyAllSameHeadReviews, verifyAncestorAutoPass, verifyOverlapEvidence, verifyOverlapEvidenceVirtualRebase } from './pr-land-overlap-evidence.js';
+import type { VerifyOverlapEvidenceInput } from './pr-land-overlap-evidence.js';
 import { verifyVirtualRebasePatch } from './pr-land-virtual-rebase.js';
-import { observePrLandRefusal } from './pr-land-refusal.js';
+import { observeDirectPrLandRefusal, observePrLandRefusal } from './pr-land-refusal.js';
 import { ensurePrLandHeavyRemote, type HeavyRemoteInput, type HeavyRemoteResult } from './pr-land-heavy-remote.js';
+import { readPrBaseNameWithRetry } from './pr-land-base-read.js';
 import { runHeavyOnPodShadow } from './pr-land-pod-shadow.js';
 import type { LandingPodShadowInput, LandingPodShadowVerdict } from './pr-land-pod-shadow-job.js';
-import { taskAgentStatePath } from '../task-agent/task-hand.js';
+import { readTaskAgentState, taskAgentStatePath, type TaskCard } from '../task-agent/task-hand.js';
+import { INFLIGHT_REGISTRY_FILE, removeInflightForPr } from '../pr-tool/inflight-registry.js';
 import { PR_LABEL_NAMES } from '../github/pr-labels.js';
 import { enqueueL8ShadowQueue, runL8ShadowQueue, shadowPrNumber, statusL8ShadowQueue, type L8ShadowQueueDeps } from '../self-implement/l8-merge-queue.js';
 import { censusOpenPrs, guardNewPr, parseDiffHunks, readOpenPrs, type Seat } from '../pr-tool/census.js';
@@ -122,6 +125,8 @@ export interface PrLandDeps {
   readFile?: (path: string) => string;
   /** 증거 파일 없는 already-ancestor 자동 판정이 리뷰 결과를 찾는 자리(기본 `<TA 상태 디렉터리>/review-results`). */
   reviewResultsDir?: string;
+  /** INFLIGHT-REGISTRY — 착지 뒤 등록부 줄을 찾을 과제 카드 상태(기본 `taskAgentStatePath()` · 등록부는 그 옆). */
+  taskStatePath?: string;
   listUnfinishedRuns?: () => FederatedUnfinishedRunLedgerQuery | readonly FederatedUnfinishedRunLedgerEntry[];
   queryRunningRuns?: () => RunningRunsResult;
   listOpenPrs?: () => readonly { number: number; headRefName: string }[] | null;
@@ -392,6 +397,7 @@ export function exportLeakBlock(
   allow: boolean,
   out: { log: (message: string) => void; error: (message: string) => void },
   cwd: string = process.cwd(),
+  onRefusal?: (message: string) => void,
 ): boolean {
   if (!changedFiles || changedFiles.length === 0) return true;
   let result: ExportLeakCheck;
@@ -425,7 +431,9 @@ export function exportLeakBlock(
   }
   if (blockedHits.length === 0) { out.log('✓ public-export-leak: 바뀐 파일이 공개본에 사적 흔적을 싣지 않는다(prepare 와 같은 변환 뒤).'); return true; }
   const write = allow ? out.log : out.error;
-  write(`${allow ? '⚠' : '✗'} public-export-leak: 바뀐 파일 ${blockedHits.length}곳이 공개본에 사적 흔적을 싣는다 — 다음 release prepare 가 여기서 실패한다:`);
+  const refusal = `${allow ? '⚠' : '✗'} public-export-leak: 바뀐 파일 ${blockedHits.length}곳이 공개본에 사적 흔적을 싣는다 — 다음 release prepare 가 여기서 실패한다:`;
+  write(refusal);
+  if (!allow) onRefusal?.(refusal);
   for (const hit of blockedHits.slice(0, 20)) write(`   ${hit.file}:${hit.line} · ${hit.marker}${missingReason.includes(hit) ? ' · 사유 없음' : ''}`);
   if (blockedHits.length > 20) write(`   … 외 ${blockedHits.length - 20}곳`);
   write('   확인: bun scripts/public-export.ts --leak-check --all --files <파일…>');
@@ -1060,7 +1068,7 @@ function emitLandingOverlapAdvisory(
 }
 
 /** The pinned overlap evidence decision is shared by landing and its read-only preview. */
-function verifyPinnedOverlapDecision(input: {
+export function verifyPinnedOverlapDecision(input: {
   opts: PrLandOpts;
   deps: PrLandDeps;
   run: CmdRunner;
@@ -1078,13 +1086,14 @@ function verifyPinnedOverlapDecision(input: {
   let ancestorResyncNeeded = false;
   if (decision === 'unavailable' && opts.overlapEvidence !== undefined) {
     const ref = resolveRemoteBranchRef(run, cwd, base);
-    const verdict = verifyOverlapEvidence({
+    const evidenceInput: VerifyOverlapEvidenceInput = {
       evidencePath: opts.overlapEvidence, pr: Number(opts.pr), expectedHead: opts.expectedHead!,
       remote: ref.remote, branch: ref.branch, cwd, run, readFile,
       reviewResultsDir: deps.reviewResultsDir ?? join(dirname(taskAgentStatePath()), 'review-results'),
       listDir: (dir) => readdirSync(dir), reviewMtime: (path) => statSync(path).mtimeMs,
       reviewRealPath: (path) => realpathSync(path), overlappingLandings,
-    });
+    };
+    const verdict = verifyOverlapEvidence(evidenceInput);
     accepted = verdict.ok;
     if (verdict.ok) {
       out.log(verdict.mode === 'already-ancestor'
@@ -1092,7 +1101,24 @@ function verifyPinnedOverlapDecision(input: {
         : verdict.mode === 'base-advanced-disjoint'
           ? `✓ overlap-evidence: base-advanced-disjoint — gate base ${verdict.gateBase.slice(0, 12)} ⊂ head ${opts.expectedHead!.slice(0, 12)} · ${ref.remote}/${ref.branch} ${verdict.baseTip.slice(0, 12)} 까지 ${verdict.windowCommits}개 커밋이 PR 파일을 안 건드린다 · review pass|warn must-fix 0 (${verdict.reviewResult})`
           : `✓ overlap-evidence: ${ref.remote}/${ref.branch} ${verdict.baseTip.slice(0, 12)} ⊂ head ${opts.expectedHead!.slice(0, 12)} · gate passed on that base · review pass must-fix 0 (${verdict.reviewResult})`);
-    } else refuse(`✗ overlap-evidence: ${verdict.reason}`);
+    } else {
+      const pureNotRebased = verdict.baseTip !== undefined && verdict.reason ===
+        `not-rebased: ${ref.remote}/${ref.branch} ${verdict.baseTip.slice(0, 12)} is not an ancestor of ${opts.expectedHead!.slice(0, 12)}`;
+      const measuredOverlap = verdict.baseTip !== undefined && verdict.reason.startsWith('base-stale-overlap:');
+      if (pureNotRebased || measuredOverlap) {
+        const patch = verifyOverlapEvidenceVirtualRebase(evidenceInput, verdict.baseTip!);
+        accepted = patch.ok;
+        record('virtual-rebase', patch.ok, {
+          pr: Number(opts.pr), head: opts.expectedHead, baseTip: verdict.baseTip,
+          reason: patch.ok ? 'same-patch-id' : patch.reason,
+          reviewResult: patch.ok ? patch.reviewResult : null,
+          evidencePath: opts.overlapEvidence,
+        });
+        if (patch.ok) {
+          out.log(`✓ overlap-evidence: virtual-rebase — ${ref.remote}/${ref.branch} ${verdict.baseTip!.slice(0, 12)} 와 head ${opts.expectedHead!.slice(0, 12)} 충돌 없음 · patch-id ${patch.patchId.slice(0, 12)} 동일 · review pass|warn must-fix 0 (${patch.reviewResult})`);
+        } else refuse(`✗ overlap-evidence: ${verdict.reason} · virtual-rebase: ${patch.reason}`);
+      } else refuse(`✗ overlap-evidence: ${verdict.reason}`);
+    }
   } else if (decision === 'unavailable') {
     const verdict = verifyAncestorAutoPass({
       pr: Number(opts.pr), expectedHead: opts.expectedHead!, cwd, run, readFile, overlappingLandings,
@@ -1121,12 +1147,12 @@ function verifyPinnedOverlapDecision(input: {
         ancestorResyncNeeded = !accepted;
         record('virtual-rebase', patch.ok, {
           pr: Number(opts.pr), head: opts.expectedHead, baseTip: baseTip || null,
-          reason: patch.ok ? 'same-patch-id' : patch.reason,
+          reason: patch.ok ? 'same-patch-id' : ('reason' in patch ? patch.reason : 'virtual-rebase-unmeasured'),
           reviewResult: reviews.ok ? reviews.reviewResult : null,
         });
-        if (patch.ok) {
+        if (patch.ok && reviews.ok) {
           out.log(`✓ overlap-evidence: virtual-rebase — ${ref.remote}/${ref.branch} ${baseTip.slice(0, 12)} 와 head ${opts.expectedHead!.slice(0, 12)} 충돌 없음 · patch-id ${patch.patchId.slice(0, 12)} 동일 · review pass|warn must-fix 0 (${reviews.reviewResult})`);
-        } else refuse(`✗ virtual-rebase: ${patch.reason} · ${verdict.reason}`);
+        } else refuse(`✗ virtual-rebase: ${'reason' in patch ? patch.reason : 'virtual-rebase-unmeasured'} · ${verdict.reason}`);
       } else refuse(`✗ ancestor-auto: ${verdict.reason}`);
     }
   }
@@ -1287,12 +1313,16 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
       totalElapsedMs: Math.max(0, Date.now() - landStartedAt), ok, ...extra,
     });
   };
-  // First slice: observe pinned identity/branch, overlap decision, and GitHub merge refusals.
-  // Option syntax and prerequisite gate errors do not describe a merge recovery edge.
+  // Observe actual merge refusals, including the measured remote gate and public export leak.
+  // Option syntax and unmeasured prerequisite errors do not describe a recovery edge.
   const refuse = (message: string, context: { isDraft?: boolean } = {}): void => {
     out.error(message);
     observePrLandRefusal(message, context);
   };
+  const refuseDirect = (message: string): void => {
+    out.error(message);
+    observeDirectPrLandRefusal(message);
+  };
   if (opts.title !== undefined && opts.titleFile !== undefined) {
     out.error('✗ title: --title과 --title-file은 함께 사용할 수 없습니다.');
     return 1;
@@ -1829,7 +1859,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   if (opts.heavyRemote) {
     const main = overlapCheckedBase!;
     const verdict = heavyGate(main, 'initial');
-    if (!verdict?.ok) { out.error(`✗ heavy-remote: 원격 게이트 ${verdict?.reason ?? 'unmeasured'} — 로컬 게이트로 폴백하지 않는다.`); return 1; }
+    if (!verdict?.ok) { refuseDirect(`✗ heavy-remote: 원격 게이트 ${verdict?.reason ?? 'unmeasured'} — 로컬 게이트로 폴백하지 않는다.`); return 1; }
     verifiedHeavyBase = main;
     out.log(`✓ heavy-remote: host=${verdict.host ?? 'unknown'} head=${opts.expectedHead!.slice(0, 12)} main=${main.slice(0, 12)} source=${verdict.source} elapsed=${verdict.elapsedMs}ms`);
     out.log(`✓ typecheck-roots: ${JSON.stringify(verdict.rootPlan ?? { mode: 'not-applicable', roots: null, promoted: false, reason: 'no-root-plan-in-gate-output' })}`);
@@ -1850,22 +1880,19 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   // A move during the wait is the same race as a move during the gate: rerun or fail closed.
   // gh merge pins the head only. A retargeted PR would land on a branch the heavy gate never measured.
   // Unreadable baseRefName is not "main". Normal pr land (no --heavy-remote) does not use this check.
-  const confirmHeavyPrBase = (): number | undefined => {
+  const confirmHeavyPrBase = async (): Promise<number | undefined> => {
     if (!opts.heavyRemote) return undefined;
-    const viewed = run('gh', ['pr', 'view', String(opts.pr), '--json', 'baseRefName,url'], { cwd });
-    // JSON only. A bare "main" from another view (tests, --jq) is not this answer; unreadable is not main.
-    let baseName = '';
-    try {
-      if (viewed.ok) {
-        const parsed: unknown = JSON.parse(viewed.out);
-        const name = parsed && typeof parsed === 'object' && !Array.isArray(parsed)
-          ? (parsed as { baseRefName?: unknown }).baseRefName : undefined;
-        if (typeof name === 'string') baseName = name.trim();
-      }
-    } catch { /* unreadable is not main */ }
+    const baseRead = await readPrBaseNameWithRetry({
+      pr: String(opts.pr), cwd, run,
+      sleep: deps.sleep ?? ((ms) => new Promise<void>((resolve) => setTimeout(resolve, ms))),
+    });
+    const baseName = baseRead.baseRefName;
+    record('heavy-remote-pr-base-read', baseName !== null, {
+      pr: Number(opts.pr), baseRefName: baseName, attempts: baseRead.attempts,
+    });
     if (baseName !== 'main') {
-      record('heavy-remote-pr-base', false, { pr: Number(opts.pr), baseRefName: baseName || null });
-      out.error(`✗ heavy-remote: PR base=${baseName || 'unreadable'} ≠ main — 재타기팅된 PR은 통과한 head/main 쌍이 아니다. 병합하지 않는다.`);
+      record('heavy-remote-pr-base', false, { pr: Number(opts.pr), baseRefName: baseName, attempts: baseRead.attempts });
+      refuseDirect(`✗ heavy-remote: PR base=${baseName ?? 'unreadable'} ≠ main — 재타기팅된 PR은 통과한 head/main 쌍이 아니다. 병합하지 않는다.`);
       return 1;
     }
     return undefined;
@@ -1885,7 +1912,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   };
   const confirmHeavyBaseStable = async (): Promise<number | undefined> => {
     if (!opts.heavyRemote) return undefined;
-    const retargeted = confirmHeavyPrBase();
+    const retargeted = await confirmHeavyPrBase();
     if (retargeted !== undefined) return retargeted;
     let stable = false;
     for (let attempt = 0; attempt <= HEAVY_BASE_STABILITY_RETRIES; attempt += 1) {
@@ -1899,7 +1926,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
       if (staleOverlap !== undefined) return staleOverlap;
       const verdict = heavyGate(main, 'late-recheck');
       if (!verdict?.ok) {
-        out.error(`✗ heavy-remote: 병합 직전 원격 게이트 ${verdict?.reason ?? 'unmeasured'} — 로컬 게이트로 폴백하지 않는다.`);
+        refuseDirect(`✗ heavy-remote: 병합 직전 원격 게이트 ${verdict?.reason ?? 'unmeasured'} — 로컬 게이트로 폴백하지 않는다.`);
         return 1;
       }
       verifiedHeavyBase = main;
@@ -1911,7 +1938,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     }
     // A late regate can take minutes. Re-read baseRefName after that wait and before success:
     // the pre-loop check is stale if the PR was retargeted while origin/main was being remeasured.
-    const retargetedAfter = confirmHeavyPrBase();
+    const retargetedAfter = await confirmHeavyPrBase();
     if (retargetedAfter !== undefined) return retargetedAfter;
     return undefined;
   };
@@ -1990,7 +2017,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   nextMdWarning(body ?? '', changedPaths, out);
   if (!conflictMarkerBlock(changedPaths, cwd, out)) return 1;
   publicLeakWarning(changedPaths, deps.runPublicLeakGate ?? ((files, sink) => runPrLandPublicLeakGate(files, sink, cwd, base)), out);
-  if (!exportLeakBlock(changedPaths, () => (deps.runExportLeakCheck ?? runPrLandExportLeakCheck)(changedPaths ?? [], cwd), opts.allowPublicLeak === true, out, cwd)) return 1;
+  if (!exportLeakBlock(changedPaths, () => (deps.runExportLeakCheck ?? runPrLandExportLeakCheck)(changedPaths ?? [], cwd), opts.allowPublicLeak === true, out, cwd, observeDirectPrLandRefusal)) return 1;
   if (!await exportImportBlock(changedPaths, () => (deps.runExportImportCheck ?? runPrLandExportImportCheck)(changedPaths ?? [], cwd), out)) return 1;
   if (publicDocPaths(changedPaths, () => true).length > 0) {
     const top = run('git', ['rev-parse', '--show-toplevel'], { cwd });
@@ -2347,6 +2374,14 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   }
   if (opts.forceFreeze) debug.log('release-loop.freeze', 'force-merge', { pr: prNumber, reason: opts.forceFreeze.trim() });
   record('merge', true, { result: merged.kind, ...(merged.remoteBranchDeletion ? { remoteBranchDeletion: merged.remoteBranchDeletion.detail } : {}) });
+  // INFLIGHT-REGISTRY — 착지하면 비행 중 등록부의 그 런 줄을 지운다(색인 실패는 착지를 막지 않는다).
+  try {
+    const statePath = deps.taskStatePath ?? taskAgentStatePath();
+    const cards = Object.values(readTaskAgentState<{ tasks?: Record<string, TaskCard> }>(statePath).tasks ?? {});
+    removeInflightForPr(prNumber, cards, { path: join(dirname(statePath), INFLIGHT_REGISTRY_FILE) });
+  } catch (error) {
+    try { debug.log('pr-tool.inflight', 'remove-failed', { pr: prNumber, error: String((error as Error)?.message ?? error).slice(0, 200) }, { level: 'warn' }); } catch { /* fail-soft */ }
+  }
   if (merged.remoteBranchDeletion) {
     out.log(`⚠ remote branch deletion: ${merged.remoteBranchDeletion.detail}`);
   }

package/src/cli/pr-land-base-read.ts

@@ -0,0 +1,34 @@
+import type { CmdRunner } from '../autopilot/pr-manager.js';
+
+export const PR_LAND_BASE_READ_RETRIES = 2;
+export const PR_LAND_BASE_READ_RETRY_DELAY_MS = 100;
+
+export interface PrBaseReadResult {
+  baseRefName: string | null;
+  attempts: number;
+}
+
+/** Retry only an unreadable GitHub base response; a readable non-main base is a real retarget. */
+export async function readPrBaseNameWithRetry(input: {
+  pr: string;
+  cwd: string;
+  run: CmdRunner;
+  sleep: (ms: number) => Promise<void>;
+}): Promise<PrBaseReadResult> {
+  for (let attempt = 1; attempt <= PR_LAND_BASE_READ_RETRIES + 1; attempt += 1) {
+    const viewed = input.run('gh', ['pr', 'view', input.pr, '--json', 'baseRefName,url'], { cwd: input.cwd });
+    let baseRefName: string | null = null;
+    try {
+      if (viewed.ok) {
+        const parsed: unknown = JSON.parse(viewed.out);
+        const name = parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+          ? (parsed as { baseRefName?: unknown }).baseRefName : undefined;
+        if (typeof name === 'string' && name.trim()) baseRefName = name.trim();
+      }
+    } catch { /* Retry unreadable responses; do not treat them as main. */ }
+
+    if (baseRefName !== null) return { baseRefName, attempts: attempt };
+    if (attempt <= PR_LAND_BASE_READ_RETRIES) await input.sleep(PR_LAND_BASE_READ_RETRY_DELAY_MS);
+  }
+  return { baseRefName: null, attempts: PR_LAND_BASE_READ_RETRIES + 1 };
+}

package/src/cli/pr-land-heavy-remote.ts

@@ -51,6 +51,8 @@ export interface HeavyRemoteResult {
   reason?: string;
   elapsedMs: number;
   evidencePath: string;
+  /** Redacted stdout/stderr from a failed remote gate; never a reusable pass. */
+  failureLogPath?: string;
   rootPlan?: RootPlanSummary | null;
   interferenceMeasured?: boolean;
 }
@@ -60,6 +62,8 @@ export interface HeavyRemoteDeps {
   runRemote?: (input: Parameters<typeof runOnRemote>[0], runner: GateRemoteRunner) => RemoteRunOutcome;
   settings?: ReturnType<typeof resolveGateRemoteSettings>;
   now?: () => number;
+  /** Test seam — same cadence as self gate (`dispatchHeavyCheck`): sleep at most 15s while a host stays busy. */
+  sleep?: (ms: number) => void;
   observe?: (event: string, data: Record<string, unknown>) => void;
 }
 
@@ -157,6 +161,38 @@ function failedGateSummary(stdout: Buffer, stderr: Buffer): string | undefined {
   return bounded.length ? bounded.join(' | ') : undefined;
 }
 
+/** The self-gate baseline prints one failure per line after its count header. Keep only distinct test paths here. */
+function failedGateFiles(stdout: Buffer, stderr: Buffer): string | undefined {
+  const files = { introduced: new Set<string>(), preexisting: new Set<string>() };
+  for (const line of `${stdout.toString('utf8')}\n${stderr.toString('utf8')}`.split(/\r?\n/)) {
+    const match = /^- (introduced|preexisting):\s+(\S+\.(?:test|spec)\.[cm]?[jt]sx?)(?:\s+>|\s|$)/.exec(line.trim());
+    if (match) files[match[1] as keyof typeof files].add(match[2]!);
+  }
+  const parts = (['introduced', 'preexisting'] as const).filter((kind) => files[kind].size > 0)
+    .map((kind) => { const names = [...files[kind]].sort(); return `${kind}-files=${names.slice(0, 5).map((name) => redactSecretText(name).slice(0, 160)).join(',')}${names.length > 5 ? `,+${names.length - 5}` : ''}`; });
+  return parts.length ? parts.join(' · ') : undefined;
+}
+
+/** Remote scratch is deleted on exit. Preserve a bounded, redacted copy before returning a refusal. */
+function writeFailedGateLog(path: string, stdout: Buffer, stderr: Buffer): string | undefined {
+  // One latest refusal log per PR; repeated attempts replace it atomically instead of accumulating files.
+  const logPath = `${path}.failure.log`;
+  const tempPath = `${logPath}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+  const maxBytes = 2 * 1024 * 1024;
+  const render = (label: string, bytes: Buffer): string => {
+    const safe = Buffer.from(redactSecretText(bytes.toString('utf8')), 'utf8');
+    const clipped = safe.length > maxBytes
+      ? `${safe.subarray(0, maxBytes / 2).toString('utf8')}\n[remote log middle truncated]\n${safe.subarray(-maxBytes / 2).toString('utf8')}` : safe.toString('utf8');
+    return `=== ${label} (${bytes.length} bytes${safe.length > maxBytes ? ', middle truncated' : ''}) ===\n${clipped}\n`;
+  };
+  try {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    writeFileSync(tempPath, render('stdout', stdout) + render('stderr', stderr), { mode: 0o600, flag: 'wx' });
+    renameSync(tempPath, logPath);
+    return logPath;
+  } catch { rmSync(tempPath, { force: true }); return undefined; }
+}
+
 /** No local gate fallback: host refusal, an unmeasured run, and a failed gate all block landing. */
 export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemoteDeps = {}): HeavyRemoteResult {
   const path = evidencePath(input);
@@ -170,48 +206,66 @@ export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemo
   }
   const cached = matchingEvidence(path, input);
   if (cached) return { ok: true, host: cached.host, source: 'cached', elapsedMs: 0, evidencePath: path, rootPlan: cached.rootPlan, interferenceMeasured: cached.interferenceMeasured };
-  const started = (deps.now ?? Date.now)();
+  const now = deps.now ?? Date.now;
+  const sleep = deps.sleep ?? ((ms: number) => { if (ms > 0) Bun.sleepSync(ms); });
+  const started = now();
+  const deadline = started + settings.slotWaitSeconds * 1000;
   let outcome: RemoteRunOutcome = { kind: 'busy' };
   const primaryHost: PrLandHeavyHost = settings.host;
   let selectedHost: PrLandHeavyHost = primaryHost;
-  for (const host of [primaryHost, ...PR_LAND_HEAVY_HOSTS.filter((candidate) => candidate !== primaryHost)]) {
-    selectedHost = host;
-    try {
-      outcome = (deps.runRemote ?? runOnRemote)({
-        repo: input.repo, host, mirror: settings.mirror, commit: input.head,
-        refs: [input.main], hostCap: gateRemoteHostCap(settings, host), installPwa: true, stableCheckout: true,
-        // Test the tree GitHub will merge: scratch-checkout the reviewed head, merge the pinned main tip there,
-        // then run typecheck and self gate (changed tests and PWA reach/build) at that exact pair.
-        // The detached integration commit stays on the selected host and never changes the PR branch.
-        argv: (sha) => ['sh', '-c',
+  const hosts = [primaryHost, ...PR_LAND_HEAVY_HOSTS.filter((candidate) => candidate !== primaryHost)];
+  wait: for (;;) {
+    for (const host of hosts) {
+      selectedHost = host;
+      try {
+        outcome = (deps.runRemote ?? runOnRemote)({
+          repo: input.repo, host, mirror: settings.mirror, commit: input.head,
+          refs: [input.main], hostCap: gateRemoteHostCap(settings, host), installPwa: true, stableCheckout: true,
+          // Test the tree GitHub will merge: scratch-checkout the reviewed head, merge the pinned main tip there,
+          // then run typecheck and self gate (changed tests and PWA reach/build) at that exact pair.
+          // The detached integration commit stays on the selected host and never changes the PR branch.
+          argv: (sha) => ['sh', '-c',
           'git -c user.name=elanous-gate -c user.email=gate@localhost -c commit.gpgsign=false merge --no-ff --no-edit "$1" && TSC_BASE_REF="$1" bun run scripts/ci-typecheck-changed.ts --local && bun bin/elanous.mjs self gate --changed --base "$1" --local --shards 4 && bun scripts/pr-land-extra-remote-gates.ts "$1"',
           'sh', sha(input.main)],
-      }, deps.runner ?? realGateRemoteRunner);
-    } catch (error) {
-      outcome = { kind: 'infra', reason: `exception: ${error instanceof Error ? error.message : String(error)}` };
+        }, deps.runner ?? realGateRemoteRunner);
+      } catch (error) {
+        outcome = { kind: 'infra', reason: `exception: ${error instanceof Error ? error.message : String(error)}` };
+      }
+      // A completed run or infrastructure failure is a verdict. Only a full host slot asks for another host.
+      if (outcome.kind !== 'busy') break wait;
     }
-    // A completed run or infrastructure failure is a verdict. Only a full host slot asks for another host.
-    if (outcome.kind !== 'busy') break;
+    // Both allowlisted hosts were busy. Wait the same slotWaitSeconds window as self gate, then retry.
+    debug.log('pr.land', 'host-busy', { host: selectedHost, occupied: outcome.occupied ?? null, slotWaitSeconds: settings.slotWaitSeconds });
+    const left = deadline - now();
+    if (left <= 0) break;
+    sleep(Math.min(15_000, left));
+    if (now() >= deadline) break;
   }
-  const elapsedMs = Math.max(0, (deps.now ?? Date.now)() - started);
+  const elapsedMs = Math.max(0, now() - started);
   const observe = deps.observe ?? ((event: string, data: Record<string, unknown>) => debug.log('pr.land', event, data));
   const actualHost = outcome.kind === 'ran' ? outcome.host : undefined;
   const base = { pr: input.pr, head: input.head, main: input.main, host: actualHost ?? null, attemptedHost: selectedHost, elapsedMs };
   // The outcome must identify the selected allowlisted host; the configured host alone is not evidence.
   if (outcome.kind !== 'ran' || outcome.commit !== input.head || outcome.rc !== 0 || outcome.host !== selectedHost) {
     const summary = outcome.kind === 'ran' && outcome.rc !== 0 ? failedGateSummary(outcome.stdout, outcome.stderr) : undefined;
+    // A different host cannot attest to this gate, so do not promote its file list into the refusal.
+    const files = outcome.kind === 'ran' && outcome.rc !== 0 && outcome.host === selectedHost && outcome.commit === input.head
+      ? failedGateFiles(outcome.stdout, outcome.stderr) : undefined;
+    const failureLogPath = outcome.kind === 'ran' ? writeFailedGateLog(path, outcome.stdout, outcome.stderr) : undefined;
     const reason = outcome.kind === 'ran'
       ? outcome.host !== selectedHost
-        ? `gate-host-mismatch (${outcome.host})`
-        : `gate-rc-${outcome.rc}${outcome.commit !== input.head ? '-head-mismatch' : ''}${summary ? ` · remote: ${summary}` : ''}`
+        ? `gate-host-mismatch (${outcome.host})${failureLogPath ? ` · remote-log: ${failureLogPath}` : ''}`
+        : `gate-rc-${outcome.rc}${outcome.commit !== input.head ? '-head-mismatch' : ''}${files ? ` · ${files}` : ''}${summary ? ` · remote: ${summary}` : ''}${failureLogPath ? ` · remote-log: ${failureLogPath}` : ' · remote-log: unavailable'}`
       : outcome.kind === 'busy' ? 'gate-host-busy' : outcome.reason;
-    observe('heavy-remote', { ...base, outcome: outcome.kind === 'ran' ? 'fail' : 'unmeasured', reason });
-    return { ok: false, ...(actualHost ? { host: actualHost } : {}), attemptedHost: selectedHost, source: 'unmeasured', reason, elapsedMs, evidencePath: path };
+    observe('heavy-remote', { ...base, outcome: outcome.kind === 'ran' ? 'fail' : 'unmeasured', reason, failureLogPath: failureLogPath ?? null });
+    return { ok: false, ...(actualHost ? { host: actualHost } : {}), attemptedHost: selectedHost, source: 'unmeasured', reason, elapsedMs, evidencePath: path, ...(failureLogPath ? { failureLogPath } : {}) };
   }
   const extraGates = extraGatesFromOutput(outcome.stdout);
   if (!extraGates) {
-    observe('heavy-remote', { ...base, outcome: 'unmeasured', reason: 'extra-global-unmeasured' });
-    return { ok: false, host: selectedHost, attemptedHost: selectedHost, source: 'unmeasured', reason: 'extra-global-unmeasured', elapsedMs, evidencePath: path };
+    const failureLogPath = writeFailedGateLog(path, outcome.stdout, outcome.stderr);
+    const reason = `extra-global-unmeasured${failureLogPath ? ` · remote-log: ${failureLogPath}` : ' · remote-log: unavailable'}`;
+    observe('heavy-remote', { ...base, outcome: 'unmeasured', reason, failureLogPath: failureLogPath ?? null });
+    return { ok: false, host: selectedHost, attemptedHost: selectedHost, source: 'unmeasured', reason, elapsedMs, evidencePath: path, ...(failureLogPath ? { failureLogPath } : {}) };
   }
   const evidence: HeavyRemoteEvidence = {
     schema: 2, pr: input.pr, head: input.head, main: input.main, host: selectedHost,
@@ -225,8 +279,10 @@ export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemo
     renameSync(temp, path);
   } catch (error) {
     rmSync(temp, { force: true });
-    observe('heavy-remote', { ...base, outcome: 'unmeasured', reason: 'evidence-write-failed' });
-    return { ok: false, host: selectedHost, attemptedHost: selectedHost, source: 'unmeasured', reason: `evidence-write-failed: ${error instanceof Error ? error.message : String(error)}`, elapsedMs, evidencePath: path };
+    const failureLogPath = writeFailedGateLog(path, outcome.stdout, outcome.stderr);
+    const reason = `evidence-write-failed: ${error instanceof Error ? error.message : String(error)}${failureLogPath ? ` · remote-log: ${failureLogPath}` : ' · remote-log: unavailable'}`;
+    observe('heavy-remote', { ...base, outcome: 'unmeasured', reason, failureLogPath: failureLogPath ?? null });
+    return { ok: false, host: selectedHost, attemptedHost: selectedHost, source: 'unmeasured', reason, elapsedMs, evidencePath: path, ...(failureLogPath ? { failureLogPath } : {}) };
   }
   observe('heavy-remote', { ...base, outcome: 'pass', evidencePath: path, rootPlan: evidence.rootPlan, interferenceMeasured: evidence.interferenceMeasured });
   return { ok: true, host: selectedHost, source: 'remote', elapsedMs, evidencePath: path, rootPlan: evidence.rootPlan, interferenceMeasured: evidence.interferenceMeasured };

package/src/cli/pr-land-overlap-evidence.ts

@@ -25,6 +25,7 @@ import { basename, dirname, join, resolve } from 'node:path';
 import { debug } from '../debug/log.js';
 import type { CmdRunner } from '../autopilot/pr-manager.js';
 import { parseReviewResultOutput } from '../task-agent/review-result-capture.js';
+import { verifyVirtualRebasePatch } from './pr-land-virtual-rebase.js';
 
 const SHA40 = /^[0-9a-f]{40}$/i;
 
@@ -45,7 +46,7 @@ export type OverlapEvidenceVerdict =
   | { ok: true; mode: 'already-ancestor'; reviewResult: string }
   | { ok: true; mode: 'rebased'; baseTip: string; reviewResult: string }
   | { ok: true; mode: 'base-advanced-disjoint'; baseTip: string; gateBase: string; windowCommits: number; reviewResult: string }
-  | { ok: false; reason: string };
+  | { ok: false; reason: string; baseTip?: string };
 
 export interface VerifyOverlapEvidenceInput {
   evidencePath: string;
@@ -222,6 +223,47 @@ function checkReview(input: Pick<VerifyOverlapEvidenceInput, 'pr' | 'readFile'>,
   return { ok: true, reviewResult: e.reviewResult };
 }
 
+/** Reuse the evidence-selected review when a pinned head needs a read-only virtual rebase. */
+export function verifyOverlapEvidenceVirtualRebase(input: VerifyOverlapEvidenceInput, baseTip: string):
+  { ok: true; reviewResult: string; patchId: string } | { ok: false; reason: string; baseTip?: string } {
+  const head = input.expectedHead.toLowerCase();
+  if (!SHA40.test(head) || !SHA40.test(baseTip)) return { ok: false, reason: 'virtual-rebase-invalid-sha' };
+  let raw: unknown;
+  try { raw = JSON.parse(input.readFile(input.evidencePath)); }
+  catch { return { ok: false, reason: 'evidence-unreadable' }; }
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return { ok: false, reason: 'evidence-not-object' };
+  const evidence = raw as Partial<OverlapEvidenceFile>;
+  const evidencePr = typeof evidence.pr === 'number' ? evidence.pr
+    : typeof evidence.pr === 'string' && /^[0-9]+$/.test(evidence.pr) ? Number(evidence.pr) : NaN;
+  if (!Number.isSafeInteger(evidencePr) || evidencePr !== input.pr) return { ok: false, reason: 'evidence-pr-mismatch' };
+  if (typeof evidence.head !== 'string' || evidence.head.toLowerCase() !== head) return { ok: false, reason: 'evidence-head-mismatch' };
+  const gate = evidence.gate;
+  if (!gate || typeof gate !== 'object') return { ok: false, reason: 'gate-missing' };
+  if (gate.passed !== true) return { ok: false, reason: 'gate-not-passed' };
+  if (typeof gate.head !== 'string' || gate.head.toLowerCase() !== head) return { ok: false, reason: 'gate-head-mismatch' };
+  if (typeof gate.baseCommit !== 'string' || !SHA40.test(gate.baseCommit)) return { ok: false, reason: 'gate-base-unmeasured' };
+  const review = checkReview(input, evidence, head, baseTip);
+  if (!review.ok) return review;
+  const attempts = checkSelectedReviewAttempts(input, evidence, head);
+  if (!attempts.ok) return attempts;
+  const remote = input.run('git', ['ls-remote', input.remote, `refs/heads/${input.branch}`], { cwd: input.cwd });
+  if (!remote.ok || remote.out.trim().split(/\s+/)[0]?.toLowerCase() !== baseTip.toLowerCase()) {
+    return { ok: false, reason: 'virtual-rebase-base-advanced' };
+  }
+  const local = input.run('git', ['rev-parse', '--verify', `refs/remotes/${input.remote}/${input.branch}`], { cwd: input.cwd });
+  if (!local.ok || local.out.trim().toLowerCase() !== baseTip.toLowerCase()) {
+    return { ok: false, reason: 'virtual-rebase-base-stale-or-unmeasured' };
+  }
+  const patch = verifyVirtualRebasePatch({ cwd: input.cwd, baseTip, head });
+  if (!patch.ok) return patch;
+  const oldBase = patch.oldBase.toLowerCase();
+  const gateBase = gate.baseCommit.toLowerCase();
+  if (!input.run('git', ['merge-base', '--is-ancestor', gateBase, oldBase], { cwd: input.cwd }).ok) {
+    return { ok: false, reason: 'gate-base-not-ancestor-of-old-base' };
+  }
+  return { ok: true, reviewResult: review.reviewResult, patchId: patch.patchId };
+}
+
 type WindowResult = { ok: true; windowCommits: number } | { ok: false; reason: string; windowCommits?: number };
 
 /**
@@ -431,7 +473,9 @@ export function verifyOverlapEvidence(input: VerifyOverlapEvidenceInput): Overla
     gateBase: (verdict.ok ? (verdict.mode === 'base-advanced-disjoint' ? verdict.gateBase : undefined) : verdict.gateBase) ?? null,
     windowCommits: (verdict.ok ? (verdict.mode === 'base-advanced-disjoint' ? verdict.windowCommits : undefined) : verdict.windowCommits) ?? null,
   });
-  if (!verdict.ok) return { ok: false, reason: verdict.reason };
+  if (!verdict.ok) return (verdict.reason.startsWith('not-rebased:') || verdict.reason.startsWith('base-stale-overlap:')) && verdict.baseTip
+    ? { ok: false, reason: verdict.reason, baseTip: verdict.baseTip }
+    : { ok: false, reason: verdict.reason };
   if (verdict.mode === 'already-ancestor') return { ok: true, mode: 'already-ancestor', reviewResult: verdict.reviewResult };
   if (verdict.mode === 'base-advanced-disjoint') {
     return { ok: true, mode: 'base-advanced-disjoint', baseTip: verdict.baseTip!, gateBase: verdict.gateBase, windowCommits: verdict.windowCommits, reviewResult: verdict.reviewResult };

package/src/cli/pr-land-pod-shadow-job.ts

@@ -7,6 +7,9 @@ import type { RootPlanSummary } from './pr-land-heavy-remote.js';
 
 const SHA = /^[0-9a-f]{40}$/i;
 const MARKER = 'ELANOUS_PRLAND_SHADOW';
+/** Shadow evidence is optional; it must not hold a ready landing for the Pod's 45-minute deadline. */
+export const LANDING_POD_SHADOW_HOST_TIMEOUT_MS = 10 * 60_000;
+export const LANDING_POD_SHADOW_STATUS_UNREADABLE_MS = 60_000;
 
 export interface LandingPodShadowInput { head: string; main: string }
 export interface LandingPodShadowVerdict {
@@ -42,12 +45,32 @@ export function landingPodShadowScript(head: string, main: string): string {
 export async function runLandingPodShadowJob(input: LandingPodShadowInput, deps: {
   runPod?: (options: RunPodCommandOptions) => Promise<PodCommandResult>;
   readLog?: (path: string) => string;
+  /** Deterministic timer seam for the host deadline. */
+  armTimeout?: (onTimeout: () => void, ms: number) => () => void;
 } = {}): Promise<LandingPodShadowVerdict> {
   const script = landingPodShadowScript(input.head, input.main);
-  const job = await (deps.runPod ?? runPodCommand)({
-    command: ['bash', '-lc', script], clone: true, source: { kind: 'commit', sha: input.head },
-    returnLogs: true, deadlineSeconds: 45 * 60,
+  const controller = new AbortController();
+  const armTimeout = deps.armTimeout ?? ((onTimeout: () => void, ms: number) => {
+    const timer = setTimeout(onTimeout, ms);
+    return () => clearTimeout(timer);
   });
+  const disarm = armTimeout(() => {
+    const reason = new Error(`pod shadow: host timeout after ${LANDING_POD_SHADOW_HOST_TIMEOUT_MS}ms`);
+    controller.abort(reason);
+  }, LANDING_POD_SHADOW_HOST_TIMEOUT_MS);
+  let job: PodCommandResult;
+  try {
+    // Wait for the runner to observe abort and finish Job/Secret/lease cleanup before landing continues.
+    job = await (deps.runPod ?? runPodCommand)({
+      command: ['bash', '-lc', script], clone: true, source: { kind: 'commit', sha: input.head },
+      returnLogs: true, deadlineSeconds: 45 * 60,
+      statusUnreadableMs: LANDING_POD_SHADOW_STATUS_UNREADABLE_MS,
+      hostDeadlineAtMs: Date.now() + LANDING_POD_SHADOW_HOST_TIMEOUT_MS,
+      signal: controller.signal,
+    });
+  } finally {
+    disarm();
+  }
   let log: string;
   try { log = (deps.readLog ?? ((path: string) => readFileSync(path, 'utf8')))(join(job.artifactsDir, 'child.log')); }
   catch (error) {

package/src/cli/pr-land-refusal.ts

@@ -1,20 +1,35 @@
 import { readJourneyEdge, recordJourneyEdge } from '../self-dev/graph-journey-route.js';
 import { debug } from '../debug/log.js';
 
-/** The five outcomes of an observed `pr land` refusal. This function never retries a landing. */
-export type PrLandRefusal = 'draft' | 'head-branch' | 'not-ancestor' | 'review-missing' | 'other';
+/** Observed `pr land` refusal reasons. Classification never retries a landing. */
+export type PrLandRefusal = 'draft' | 'head-branch' | 'not-ancestor' | 'review-missing'
+  | 'gate-host-busy' | 'gate-merge-conflict' | 'gate-touch-clean'
+  | 'pr-base-unreadable' | 'public-export-leak' | 'other';
 
 export function classifyPrLandRefusal(message: string, context: { isDraft?: boolean } = {}): PrLandRefusal {
   if (context.isDraft === true && message.startsWith('✗ expected-head: PR OPEN non-draft')) return 'draft';
   if (message.startsWith('✗ branch: PR head branch와 현재 브랜치가 다릅니다.')) return 'head-branch';
   if (message.startsWith('✗ ancestor-auto: ancestor-auto-not-ancestor:')) return 'not-ancestor';
   if (/^✗ (?:ancestor-auto|overlap-evidence): (?:review-missing|review-not-reviewed|review-error|review-no-result|review-unreadable|review-pr-mismatch|review-head-mismatch|review-path-not-for-this-pr-head|review-verdict-null|review-must-fix-unknown)(?:\b|$)/.test(message)) return 'review-missing';
+  if (message.startsWith('✗ heavy-remote: PR base=unreadable ≠ main')) return 'pr-base-unreadable';
+  if (/^✗ heavy-remote: (?:원격|병합 직전 원격|node-b) 게이트 gate-host-busy(?:\b|\s|$)/.test(message)) return 'gate-host-busy';
+  if (message.startsWith('✗ heavy-remote: 원격 게이트 gate-rc-1 · remote: stdout: CONFLICT (content): Merge conflict')) return 'gate-merge-conflict';
+  if (message.startsWith('✗ heavy-remote: 원격 게이트 gate-rc-1 · remote: stderr: 건드린 src/scripts 파일과 baseline 밖 test 파일은 tsc 클린이어야 합니다(touch-clean).')) return 'gate-touch-clean';
+  if (message.startsWith('✗ public-export-leak: 바뀐 파일')) return 'public-export-leak';
   return 'other';
 }
 
+/** Direct landing failures are observed only when today's refusal shape is recognized. */
+export function observeDirectPrLandRefusal(message: string): void {
+  if (classifyPrLandRefusal(message) === 'other') return;
+  observePrLandRefusal(message);
+}
+
 /** Read the declared recovery edge and observe the refusal. No recovery command runs here. */
 export function observePrLandRefusal(message: string, context: { isDraft?: boolean } = {}): void {
-  const route = readJourneyEdge('merge', classifyPrLandRefusal(message, context));
-  if (route.to !== null) recordJourneyEdge(route, route.to, 'pr-land-refused; recovery-execution=none');
-  else debug.log('self-implement', 'graph-edge-unresolved', { from: 'merge', label: route.label, reason: 'pr-land-refused; recovery-execution=none' });
+  try {
+    const route = readJourneyEdge('merge', classifyPrLandRefusal(message, context));
+    if (route.to !== null) recordJourneyEdge(route, route.to, 'pr-land-refused; recovery-execution=none');
+    else debug.log('self-implement', 'graph-edge-unresolved', { from: 'merge', label: route.label, reason: 'pr-land-refused; recovery-execution=none' });
+  } catch { /* An observation failure must never change the landing refusal. */ }
 }