elanous 0.2.31 → 0.2.34

package/src/steward/triage.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { closeSync, existsSync, openSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
+import { closeSync, existsSync, openSync, readFileSync, writeFileSync, mkdirSync, renameSync, rmSync } from 'node:fs';
 import { launchModeOf, rescueAllows } from './rescue.js';
 import { join } from 'node:path';
 import { fetchLinearIssues } from '../connectors/linear.js';
@@ -24,6 +24,7 @@ import { CardStore } from '../task-cards/card-store.js';
 import { draftWithinBudget, triageWithinBudget } from './triage-budget.js';
 import { askSteward, classifyIssue, installedCapabilities, planIssues, ruleJudgment, unsafeReason, type ClassifiedIssue, type StewardAsk } from './triage-plan.js';
 import { failureAlertText, markStageStart, markStageEnd, readFailureStreak, shouldAlert, writeFailureStreak, type FailureStreak, type StewardStage } from './failure-streak.js';
+import { briefVerdictChange } from './digest-delivery.js';
 
 export type Rung = 0 | 1 | 2 | 3 | 4 | 5 | 'hitl';
 /** `other` = the judge chose human review for a reason outside the four named ones (kept as HITL, never downgraded). */
@@ -56,6 +57,8 @@ export interface StewardDeps {
   judge?: (issue: TriageIssue, issues: TriageIssue[], tracks?: Record<string, string>) => Promise<unknown>;
   decide?: typeof emitDecision;
   sendDigest?: (text: string) => Promise<void>;
+  /** 흐름 판정 변화 브리핑 한 줄 발송(OVW-BRIEF) — 생략하면 킨드 `ops-report`(운영 봇)이 기본. */
+  sendBrief?: (text: string) => Promise<void>;
   now?: () => Date;
   root?: string;
   cardStore?: StewardCardDeps['store'];
@@ -325,13 +328,46 @@ function logStageFailure(root: string, stage: StewardStage, reason: string): voi
 }
 const SCHEDULE_CHECK_MS = 15 * 60_000;
 
+/** Atomic marker write: stage the payload at `<marker>.tmp-<pid>`, then renameSync it into place so a
+ *  crash mid-write never leaves a half-written marker for the next sync to trip over. */
+export function writeScheduleCheckMarker(
+  marker: string,
+  at: Date,
+  write: (path: string, data: string) => void = writeFileSync,
+): void {
+  const tmp = `${marker}.tmp-${process.pid}`;
+  try {
+    write(tmp, JSON.stringify({ at: at.toISOString() }));
+    renameSync(tmp, marker);
+  } catch (error) {
+    try { rmSync(tmp, { force: true }); } catch { /* Preserve the write or rename error. */ }
+    throw error;
+  }
+}
+
 /** Called by runStewardStage(sync) under its stage slot, never from the checker CLI. */
 async function checkStewardSchedules(root: string, settings: StewardSettings, deps: StewardDeps): Promise<void> {
   const now = (deps.now ?? (() => new Date()))();
   const marker = join(root, 'steward', 'schedule-check.json');
   let previous: { at?: string } = {};
-  try { previous = JSON.parse(readFileSync(marker, 'utf8')) as typeof previous; }
-  catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error; }
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(marker, 'utf8'));
+    if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
+      && (!('at' in parsed) || typeof parsed.at === 'string')) {
+      previous = parsed as typeof previous;
+    } else {
+      debug.log('steward.schedule-check', 'marker-recovered', { reason: 'invalid-marker-shape' });
+    }
+  }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') { /* first run in this window — previous stays {} */ }
+    else if (error instanceof SyntaxError) {
+      // Corrupt marker bytes self-heal: previous stays {} so this check runs now and the fresh
+      // writeScheduleCheckMarker below replaces the broken file. The recovery is observed.
+      debug.log('steward.schedule-check', 'marker-recovered', { reason: redactSecretText(String(error)) });
+    }
+    else throw error;
+  }
   const elapsed = now.getTime() - Date.parse(previous.at ?? '');
   if (Number.isFinite(elapsed) && elapsed >= 0 && elapsed < SCHEDULE_CHECK_MS) return;
   const inventory = deps.scheduleInventory ?? (() => {
@@ -375,7 +411,7 @@ async function checkStewardSchedules(root: string, settings: StewardSettings, de
     debug.log('steward.schedule-check', 'routing', { ownerRequests, opEscalations, recovered });
   }
   debug.log('steward.schedule-check', 'checked', { count: checked.length, findings: findings.length, mode: settings.mode });
-  writeFileSync(marker, JSON.stringify({ at: now.toISOString() }));
+  writeScheduleCheckMarker(marker, now);
 }
 
 function readState(path: string): { issues: Record<string, string>; digestDay?: string } {
@@ -602,6 +638,13 @@ export async function runStewardStage(stage: 'sync' | 'triage' | 'schedule' | 'r
       writeFileSync(path, JSON.stringify(state));
       digested = true;
     }
+    try {
+      await briefVerdictChange(root, { send: deps.sendBrief });
+    } catch (error) {
+      const message = `steward report: verdict brief failed: ${redactSecretText(error instanceof Error ? error.message : String(error))}`;
+      debug.log('steward.verdict-brief', 'failed', { error: message });
+      (deps.warn ?? console.warn)(message);
+    }
     const launched = readLaunchDecision(root);
     if (launched) logTickDecision(root, launched.verdict, launched.reason, launched.goalId);
     else if (outcomes.length || digested) logTickDecision(root, 'reported', outcomes.length ? `${outcomes.length} outcome(s) reported` : 'daily digest sent');

package/src/surface/shell-runner-boot.ts

@@ -7,7 +7,7 @@ interface BackgroundSurfaceLike<Handle> {
 
 export interface DashboardShellRunnerBootDeps<Handle> {
   createBackgroundSurface: (deps: {
-    onUpdate: (rollup: { running: number; backgrounded: number }) => void;
+    onUpdate: (rollup: { running: number; backgrounded: number; background: number }) => void;
   }) => BackgroundSurfaceLike<Handle>;
   initShellRegistry: (deps: {
     onRegister: (handle: Handle) => void;
@@ -19,7 +19,7 @@ export interface DashboardShellRunnerBootDeps<Handle> {
     registry: ShellRegistryLike<Handle>;
     fileEngine?: unknown;
   }): void;
-  setLatestShellRollup: (rollup: { running: number; backgrounded: number }) => void;
+  setLatestShellRollup: (rollup: { running: number; backgrounded: number; background: number }) => void;
 }
 
 export function bootDashboardShellRunner<Handle>(
@@ -30,6 +30,9 @@ export function bootDashboardShellRunner<Handle>(
       deps.setLatestShellRollup({
         running: rollup.running,
         backgrounded: rollup.backgrounded,
+        // TUI-BG-JOB-VISIBILITY — turn-outliving jobs (bg mode ⊕ backgrounded).
+        //   Required: guessing it from `backgrounded` would under-count running bg-mode jobs.
+        background: rollup.background,
       });
     },
   });

package/src/task-agent/harvest-unit.ts

@@ -0,0 +1,141 @@
+export type HarvestInput = {
+  ask?: unknown;
+  context?: unknown;
+  prior?: unknown;
+};
+
+export type ReviewInvocation = {
+  stdout: string;
+  stderr?: string;
+  exitCode: number | null;
+};
+
+export type HarvestResult = {
+  outcome: 'done' | 'rework' | 'needs-human' | 'failed';
+  result: Record<string, unknown>;
+  evidence: Record<string, unknown>;
+};
+
+type ReviewRecord = Record<string, unknown> & {
+  pr?: string | number;
+  reviewed?: boolean;
+  verdict?: string | null;
+  mustFix?: unknown;
+  model?: string;
+  headCommit?: string;
+  currentHeadCommit?: string;
+};
+
+function object(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function expectedHead(input: HarvestInput): string | undefined {
+  if (object(input.context) && typeof input.context.expectedHead === 'string' && input.context.expectedHead.trim()) return input.context.expectedHead.trim();
+  return undefined;
+}
+
+function normalizedPr(value: unknown): string | undefined {
+  const raw = typeof value === 'number' && Number.isSafeInteger(value) ? String(value) : typeof value === 'string' ? value.trim() : '';
+  const normalized = raw.replace(/^#/, '');
+  return /^\d+$/.test(normalized) ? normalized : undefined;
+}
+
+function previousAttempts(input: HarvestInput): number {
+  if (!object(input.prior)) return 0;
+  const result = object(input.prior.result) ? input.prior.result : input.prior;
+  const attempts = result.attempts;
+  return Number.isSafeInteger(attempts) && (attempts as number) >= 0 ? attempts as number : 0;
+}
+
+function parseReview(stdout: string): ReviewRecord | undefined {
+  try {
+    const parsed: unknown = JSON.parse(stdout.trim());
+    if (Array.isArray(parsed)) {
+      if (parsed.length !== 1) return undefined;
+      return object(parsed[0]) ? parsed[0] as ReviewRecord : undefined;
+    }
+    return object(parsed) ? parsed as ReviewRecord : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export async function runHarvestUnit(
+  input: HarvestInput,
+  invokeReview: (args: { pr: string; intent: string }) => Promise<ReviewInvocation>,
+): Promise<HarvestResult> {
+  const attempts = previousAttempts(input) + 1;
+  const prValue = object(input.context) ? input.context.pr : undefined;
+  const pr = normalizedPr(prValue);
+  if (!pr) {
+    return { outcome: 'failed', result: { attempts, error: 'context.pr must identify one pull request' }, evidence: { pr: pr || null, attempts } };
+  }
+
+  const context = object(input.context) ? input.context : {};
+  const hasContextIntent = Object.prototype.hasOwnProperty.call(context, 'reviewIntent');
+  const intentValue = context.reviewIntent;
+  const intent = hasContextIntent
+    ? typeof intentValue === 'string' ? intentValue.trim() : ''
+    : typeof input.ask === 'string' ? input.ask.trim() : '';
+  if (!intent) {
+    return { outcome: 'failed', result: { attempts, error: hasContextIntent ? 'context.reviewIntent must be a non-empty string' : 'context.reviewIntent or ask is required' }, evidence: { pr, attempts } };
+  }
+  const expected = expectedHead(input);
+  if (!expected || !/^[0-9a-f]{40}$/i.test(expected)) {
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'expected PR head is required' }, evidence: { pr, attempts, expectedHead: expected ?? null } };
+  }
+
+  let invocation: ReviewInvocation;
+  try {
+    invocation = await invokeReview({ pr: pr.replace(/^#/, ''), intent });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'review could not be executed' }, evidence: { pr, attempts, error: reason } };
+  }
+
+  const review = parseReview(invocation.stdout);
+  if (!review || review.reviewed !== true || typeof review.headCommit !== 'string' || typeof review.currentHeadCommit !== 'string') {
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'review result is missing or incomplete' }, evidence: {
+      pr, attempts, exitCode: invocation.exitCode, stderr: invocation.stderr ?? '', stdout: invocation.stdout.slice(0, 4000),
+    } };
+  }
+  if (normalizedPr(review.pr) !== pr) {
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'review result belongs to a different pull request' }, evidence: {
+      pr, attempts, reviewedPr: review.pr ?? null, expectedHead: expected,
+    } };
+  }
+  if (invocation.exitCode !== 0) {
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'review command exited unsuccessfully' }, evidence: {
+      pr, attempts, exitCode: invocation.exitCode, stderr: invocation.stderr ?? '',
+    } };
+  }
+  if (review.headCommit !== review.currentHeadCommit || (expected !== undefined && review.headCommit !== expected)) {
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'review head is stale or differs from expected head' }, evidence: {
+      pr, attempts, expectedHead: expected ?? null, reviewedHead: review.headCommit, currentHead: review.currentHeadCommit,
+    } };
+  }
+  if (!['pass', 'warn', 'fail'].includes(review.verdict ?? '')) {
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'review verdict is missing or invalid' }, evidence: {
+      pr, attempts, verdict: review.verdict ?? null, headCommit: review.headCommit,
+    } };
+  }
+  if (!Array.isArray(review.mustFix) || !review.mustFix.every(item => typeof item === 'string' && item.trim().length > 0)) {
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'review mustFix field is invalid' }, evidence: { pr, attempts, headCommit: review.headCommit } };
+  }
+
+  const mustFix = review.mustFix as string[];
+  if ((review.verdict === 'fail' && mustFix.length === 0)
+    || ((review.verdict === 'pass' || review.verdict === 'warn') && mustFix.length > 0)) {
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'review verdict conflicts with mustFix findings' }, evidence: {
+      pr, attempts, verdict: review.verdict, mustFix, headCommit: review.headCommit,
+    } };
+  }
+  const evidence = {
+    pr, headCommit: review.headCommit, attempts, model: review.model ?? null, verdict: review.verdict ?? null,
+    reviewResultsJson: true, exitCode: invocation.exitCode,
+  };
+  return mustFix.length > 0
+    ? { outcome: 'rework', result: { pr, headCommit: review.headCommit, attempts, mustFix }, evidence }
+    : { outcome: 'done', result: { pr, headCommit: review.headCommit, attempts, mustFix: [] }, evidence };
+}

package/src/task-agent/live-moves.ts

@@ -22,7 +22,9 @@ import { debug } from '../debug/log.js';
 import { findGitDir } from '../git-fs/locate.js';
 import { getUserConfig, userConfigPath } from '../user-config.js';
 import type { DetachedSpawn } from '../cli/tasks-cli.js';
-import { LIVE_MOVE_HISTORY_EVENT, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
+import { LIVE_MOVE_HISTORY_EVENT, shellQuote, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
+import { reconcileHandMergedCard } from './postland-card.js';
+import { resolveParentHosts, type ParentHostConfig } from './parent-host.js';
 import { LIVE_RETRY_MOVES } from './judge.js';
 import { decisionCardGrounds, decisionRaiseArgs, type DecisionCardEvidence, type NextAction } from './actions.js';
 import { pendingReviewResults, reviewResultPath, TA_REVIEW_COMPLETION_CARD_ENV, TA_REVIEW_COMPLETION_RESULT_ENV, TA_REVIEW_COMPLETION_STATE_ENV } from './review-result-capture.js';
@@ -83,6 +85,8 @@ export interface LiveMoveDeps {
   priorDiff?: PriorDiffReader;
   /** Fresh PR head and draft flag for landing; separate from the unchanged review lookup. */
   landPrHead?: (pr: number, cwd: string) => Promise<(PrHeadView & { isDraft: boolean }) | null>;
+  /** TA-CARD-MERGE-RECONCILE — MERGED PR 의 merge SHA·base·mergedAt 관측(시험 주입 · 기본 = `gh pr view`). */
+  handMergePr?: (pr: number, cwd: string) => Promise<HandMergePrView | null>;
   /** One existing pr land operation; inject in tests instead of invoking the CLI. */
   /** TA-REJUDGE-ON-HEAD — `opts.overlapEvidence` 가 있으면 `pr land --overlap-evidence <file>` 로 넘긴다(없으면 종전 인자). */
   land?: (pr: number, head: string, cwd: string, opts?: { overlapEvidence?: string }) => Promise<{ status: number; stdout: string; stderr?: string }>;
@@ -208,25 +212,44 @@ export function liveReviewArgs(entry: string, configDir: string, pr: number, int
   return [resolve(entry), '--config-dir', configDir, 'self', 'review', String(pr), '--json', '--intent', intent];
 }
 
+/** Use the configured node-b checkout for heavy TA workers; absence of parentHost preserves the legacy local path. */
+export function configuredMsb1Worker(): ParentHostConfig | null {
+  const setting = getUserConfig().taskAgent?.parentHost;
+  if (setting === undefined) return null;
+  const target = resolveParentHosts(setting, {} as NodeJS.ProcessEnv).find((entry) => entry.host === 'node-b');
+  if (!target) throw new Error('taskAgent.parentHost configured without a valid node-b worker');
+  return target;
+}
+
+export function remoteTaWorkerCommand(target: ParentHostConfig, args: readonly string[]): string {
+  const entry = target.elanous ? shellQuote(target.elanous) : '$HOME/.local/share/elanous/bin/elanous';
+  const configDir = target.configDir ? shellQuote(target.configDir) : '$HOME/.elanous';
+  return `cd ${shellQuote(target.cwd)} && ${entry} --config-dir ${configDir} ${args.map(shellQuote).join(' ')}`;
+}
+
 /**
  * 지금 도는 진입점으로 같은 우주의 리뷰를 떼어 띄운다 — 기다리지 않는다(결과는 self review 자기 관측에 남는다).
  * TA-REVIEW-RESULT-CAPTURE — `resultPath` 가 있으면 자식 stdout(`--json` 결과)만 그 파일로 받는다(stdin·stderr 는 종전대로 버린다 ·
  * 파이프가 아니라 파일 — 부모가 먼저 끝나도 자식이 EPIPE 로 죽지 않는다). 없으면 종전과 같다(stdio ignore).
  * `opts` 는 시험 몫(spawn·진입점·우주) — 기본은 실물.
  */
-export async function defaultRequestReview(pr: number, intent: string, cwd?: string, opts: { spawn?: DetachedSpawn; entry?: string; configDir?: string; resultPath?: string; cardId?: string; statePath?: string } = {}): Promise<void> {
+export async function defaultRequestReview(pr: number, intent: string, cwd?: string, opts: { spawn?: DetachedSpawn; entry?: string; configDir?: string; resultPath?: string; cardId?: string; statePath?: string; remote?: ParentHostConfig | null } = {}): Promise<void> {
   const { spawnDetachedConfirmed, ELANOUS_CLI_ENTRY } = await import('../cli/tasks-cli.js');
   const { getElanousConfigDirOverride } = await import('../elanous-config-dir.js');
   const { effectiveInstanceRoot } = await import('../instance/resolve.js');
   const configDir = opts.configDir ?? getElanousConfigDirOverride() ?? effectiveInstanceRoot();
   const base = opts.spawn ?? (spawn as unknown as DetachedSpawn);
+  const remote = opts.remote === undefined ? (opts.spawn ? null : configuredMsb1Worker()) : opts.remote;
   const args = liveReviewArgs(opts.entry ?? ELANOUS_CLI_ENTRY, configDir, pr, intent);
   const completionEnv = opts.resultPath && opts.cardId && opts.statePath ? {
     [TA_REVIEW_COMPLETION_CARD_ENV]: opts.cardId,
     [TA_REVIEW_COMPLETION_STATE_ENV]: opts.statePath,
     [TA_REVIEW_COMPLETION_RESULT_ENV]: opts.resultPath,
   } : undefined;
-  if (!opts.resultPath) { await spawnDetachedConfirmed(base, process.execPath, args, undefined, cwd); return; }
+  const workerCommand = remote ? remoteTaWorkerCommand(remote, ['self', 'review', String(pr), '--json', '--model', 'gpt-6-sol', '--intent', intent]) : null;
+  const command = remote ? 'ssh' : process.execPath;
+  const workerArgs = remote ? ['-T', '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=5', remote.host, workerCommand!] : args;
+  if (!opts.resultPath) { await spawnDetachedConfirmed(base, command, workerArgs, undefined, cwd); return; }
   let fd: number;
   try {
     mkdirSync(dirname(opts.resultPath), { recursive: true });
@@ -234,13 +257,13 @@ export async function defaultRequestReview(pr: number, intent: string, cwd?: str
   } catch (error) {
     // 결과 파일을 못 열어도 리뷰는 막지 않는다(종전처럼 stdio ignore) — 회수는 상한 뒤 «no result» 줄로 드러난다.
     try { debug.log('task-agent', 'review-result-file-open-failed', { pr, resultPath: opts.resultPath, reason: (error instanceof Error ? error.message : String(error)).slice(-300) }, { level: 'warn' }); } catch { /* fail-soft */ }
-    await spawnDetachedConfirmed(base, process.execPath, args, undefined, cwd);
+    await spawnDetachedConfirmed(base, command, workerArgs, undefined, cwd);
     return;
   }
   const toFile: DetachedSpawn = (command, spawnArgs, options) =>
     (base as unknown as (c: string, a: string[], o: unknown) => ReturnType<DetachedSpawn>)(command, spawnArgs, { ...options, stdio: ['ignore', fd, 'ignore'] });
   try {
-    await spawnDetachedConfirmed(toFile, process.execPath, args, undefined, cwd, completionEnv);
+    await spawnDetachedConfirmed(toFile, command, workerArgs, undefined, cwd, remote ? undefined : completionEnv);
   } finally {
     try { closeSync(fd); } catch { /* the child keeps its own copy */ }
   }
@@ -296,6 +319,35 @@ export async function defaultLandPrHead(pr: number, cwd: string): Promise<(PrHea
   } catch { return null; }
 }
 
+/** TA-CARD-MERGE-RECONCILE — 손수 병합된 PR 의 정산 관측값(merge SHA 가 main 조상 검증의 재료). */
+export interface HandMergePrView {
+  state: string;
+  url?: string;
+  baseRefName?: string;
+  mergedAt?: string;
+  mergeCommit?: string;
+}
+
+export async function defaultHandMergePr(pr: number, cwd: string): Promise<HandMergePrView | null> {
+  const view = (env: NodeJS.ProcessEnv) => runGh(['pr', 'view', String(pr), '--json', 'state,url,baseRefName,mergedAt,mergeCommit'], { env, cwd });
+  let out = view(process.env);
+  if (out.status !== 0) {
+    const noProxy = { ...process.env };
+    for (const key of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy']) delete noProxy[key];
+    out = view(noProxy);
+  }
+  if (out.status !== 0) return null;
+  try {
+    const value = JSON.parse(out.stdout) as { state?: unknown; url?: unknown; baseRefName?: unknown; mergedAt?: unknown; mergeCommit?: { oid?: unknown } | null };
+    if (typeof value.state !== 'string') return null;
+    return { state: value.state,
+      ...(typeof value.url === 'string' && value.url ? { url: value.url } : {}),
+      ...(typeof value.baseRefName === 'string' && value.baseRefName ? { baseRefName: value.baseRefName } : {}),
+      ...(typeof value.mergedAt === 'string' && value.mergedAt ? { mergedAt: value.mergedAt } : {}),
+      ...(typeof value.mergeCommit?.oid === 'string' && /^[a-f0-9]{40}$/i.test(value.mergeCommit.oid) ? { mergeCommit: value.mergeCommit.oid } : {}) };
+  } catch { return null; }
+}
+
 /**
  * REVIEW-CONVERGE-PRIOR-FIX — `prior` 는 같은 PR 의 두 번째 이후 리뷰에만 온다: «직전 반영분»에 직전 머리 범위·diff·must-fix 를,
  * 범위 경계에 «바뀌지 않은 줄의 새 must-fix 는 근거 줄» 한 줄을 붙인다. 없으면(첫 리뷰) 종전 문면 바이트 그대로.
@@ -402,7 +454,7 @@ export async function executeLiveReview(
  *   (`executeLiveLand` ctx `gateAt` = 그 재게이트 요청 시각)에만 이 시도는 «소비됨»으로 빠진다. judgement·infra 와 섞이지 않는다.
  */
 export const LAND_ATTEMPTS_PER_HEAD_ON_INFRA = 2;
-export type LandFailureClass = 'infra' | 'judgement' | 'base-stale';
+export type LandFailureClass = 'infra' | 'judgement' | 'base-stale' | 'recovery';
 
 /** `pr land` 출력 줄 → 인프라 사유. ⛔ 줄 «전체»가 맞아야 한다 — 비슷한 문면을 넓게 받지 않는다. */
 export const LAND_INFRA_OUTPUT_REASONS: ReadonlyArray<{ reason: string; line: RegExp }> = [
@@ -422,6 +474,8 @@ const LAND_INFRA_CONSEQUENCE_LINES: ReadonlyArray<{ of: string; line: RegExp }>
 ];
 /** REJUDGE base-stale — 겹침 증거의 게이트 base 가 낡았고 그 사이 착지가 PR 파일을 건드렸다(`pr land` · #26060 문면). */
 const LAND_BASE_STALE_LINE = /^✗ overlap-evidence: (base-stale-overlap: .*)$/;
+const LAND_RECOVER_REVIEW = /^✗ (?:ancestor-auto|overlap-evidence): (?:review-missing|review-not-reviewed|review-error|review-no-result|review-unreadable|review-pr-mismatch|review-head-mismatch|review-path-not-for-this-pr-head|review-verdict-null|review-must-fix-unknown)(?:\b|$)/;
+const LAND_RECOVER_BUSY = /^✗ heavy-remote: (?:원격|병합 직전 원격|node-b) 게이트 gate-host-busy(?:\b|\s|$)/;
 /** base-stale 에 «딸려 나오는» 줄 — 증거가 거절되면 `pr land` 가 이어서 낸다(그 줄만 있으면 판정 거절로 세지 않는다). */
 const LAND_BASE_STALE_CONSEQUENCE_LINES: readonly RegExp[] = [/^✗ expected-head: overlap merge approval unavailable for the reviewed head$/];
 /** 실패가 아닌 ✗ 줄 — `pr land` 가 «계속합니다»로 넘어간다(판정에 쓰지 않는다). */
@@ -464,6 +518,10 @@ export function classifyLandFailure(outcome: { status: number; stdout?: string;
     if (hit) infra.add(hit.reason); else unlisted.push(line);
   }
   const judged = unlisted.filter((line) => !LAND_INFRA_CONSEQUENCE_LINES.some((entry) => infra.has(entry.of) && entry.line.test(line)));
+  if (judged.length === 1 && !infra.size) {
+    if (LAND_RECOVER_REVIEW.test(judged[0]!)) return { class: 'recovery', reason: 'review-missing' };
+    if (LAND_RECOVER_BUSY.test(judged[0]!)) return { class: 'recovery', reason: 'gate-host-busy' };
+  }
   // REJUDGE base-stale — 거절 줄이 base-stale-overlap(⊕ 딸린 줄) «뿐»이고 인프라 사유가 없을 때만. 하나라도 다른 ✗ 줄이 섞이면 judgement(fail-closed).
   const stale = judged.map((line) => LAND_BASE_STALE_LINE.exec(line)?.[1]).find((reason): reason is string => !!reason);
   if (stale && !infra.size && judged.every((line) => LAND_BASE_STALE_LINE.test(line) || LAND_BASE_STALE_CONSEQUENCE_LINES.some((re) => re.test(line)))) {
@@ -520,7 +578,20 @@ function observeLandWorktreeCreateCapped(deps: LiveMoveDeps, data: { card: strin
 /** 같은 머리에 한 번 더 시도해도 되나 — 앞 시도가 «전부» 끝났고(ok:false) «전부» infra 이고 상한 밑일 때만. */
 function landRetryAllowed(prior: readonly LandAttempt[]): boolean {
   return prior.length > 0 && prior.length < LAND_ATTEMPTS_PER_HEAD_ON_INFRA
-    && prior.every((entry) => entry.ok === false && (entry.class === 'infra' || legacyMissingTscRuntime(entry)));
+    && prior.every((entry) => entry.ok === false && (entry.class === 'infra' || entry.class === 'recovery' || legacyMissingTscRuntime(entry)));
+}
+
+function recoveryAdmissionReady(card: TaskCard, prior: readonly LandAttempt[], pr: number, head: string, nowMs = Date.now()): boolean {
+  const last = prior.at(-1);
+  if (last?.class !== 'recovery') return true;
+  if (last.reason === 'gate-host-busy') return nowMs >= Date.parse(last.at) + 30_000
+    && (card.history ?? []).some((event) => event.event === 'rejudge-on-head' && event.kind === 'land'
+      && event.effect === 'recover-wait-retry' && event.pr === pr && event.head?.toLowerCase() === head.toLowerCase()
+      && Date.parse(event.at) >= Date.parse(last.at));
+  if (last.reason === 'review-missing') return (card.reviewRequests ?? []).some((request) => request.pr === pr
+    && request.head.toLowerCase() === head.toLowerCase() && Date.parse(request.at) >= Date.parse(last.at) && !request.error)
+    && !pendingReviewResults(card).some((request) => request.pr === pr && request.head.toLowerCase() === head.toLowerCase());
+  return false;
 }
 
 /** A previous release classified a missing node interpreter as judgement; only that exact recorded shape may be reopened. */
@@ -541,8 +612,9 @@ export function openLandAttempts<T extends Pick<LandAttempt, 'at' | 'class'>>(pr
 }
 
 /** 카드의 이 PR·머리에 인프라 재시도가 남았나(재판정 틱이 «머리 그대로»여도 land 단계까지 가게). */
-export function landRetryPending(card: Pick<TaskCard, 'landAttempts'>, pr: number, head: string): boolean {
-  return landRetryAllowed((card.landAttempts ?? []).filter(sameHeadOf(pr, head)));
+export function landRetryPending(card: TaskCard, pr: number, head: string): boolean {
+  const attempts = (card.landAttempts ?? []).filter(sameHeadOf(pr, head));
+  return landRetryAllowed(attempts) && recoveryAdmissionReady(card, attempts, pr, head);
 }
 
 export const LAND_RETRY_ON_INFRA_EVENT = 'land-retry-on-infra';
@@ -575,7 +647,21 @@ export async function executeLiveLand(
   let view: (PrHeadView & { isDraft: boolean }) | null;
   try { view = await (deps.landPrHead ?? defaultLandPrHead)(pr, cwd); } catch { view = null; }
   if (!view || !/^[0-9a-f]{40}$/i.test(view.head)) return reject(card.id, `PR #${pr} head unknown`, reviewRepo);
-  if (view.state !== 'OPEN') return reject(card.id, `PR #${pr} is ${view.state}`, reviewRepo);
+  if (view.state !== 'OPEN') {
+    // TA-CARD-MERGE-RECONCILE — 실패 카드에 묶인 PR을 사람이 손수 병합한 경우만 이 자리에서 정산한다; 정산이 아니면 종전 거절 그대로.
+    if (view.state === 'MERGED') {
+      let hand: HandMergePrView | null = null;
+      try { hand = await (deps.handMergePr ?? defaultHandMergePr)(pr, cwd); } catch { hand = null; }
+      if (hand?.mergeCommit) {
+        const settled = reconcileHandMergedCard({ number: pr, url: hand.url ?? view.url ?? '', headRefOid: view.head, state: 'MERGED',
+          baseRefName: hand.baseRefName ?? 'main', mergedAt: hand.mergedAt ?? '', mergeCommit: hand.mergeCommit },
+          cwd, deps.statePath ? { statePath: deps.statePath } : {});
+        if (settled.outcome === 'reconciled')
+          return withRepo(observe(deps, { kind, card: card.id, ok: true, executed: true, detail: `PR #${pr} 손 병합 정산 — card ${settled.status} (merge ${settled.mergeSha.slice(0, 12)})` }));
+      }
+    }
+    return reject(card.id, `PR #${pr} is ${view.state}`, reviewRepo);
+  }
   if (view.isDraft !== false) return reject(card.id, `PR #${pr} is draft or draft status unknown`, reviewRepo);
   if (ctx.produced?.prUrl && (!view.url || view.url.trim().replace(/\/+$/, '').toLowerCase() !== ctx.produced.prUrl.trim().replace(/\/+$/, '').toLowerCase())) {
     return reject(card.id, `PR #${pr} URL mismatches run evidence`, reviewRepo);
@@ -622,7 +708,7 @@ export async function executeLiveLand(
         }
       }
       prior = openLandAttempts((current.landAttempts ?? []).filter(sameHeadOf(pr, view!.head)), ctx.gateAt);
-      if (prior.length && !landRetryAllowed(prior)) return undefined;
+      if (prior.length && (!landRetryAllowed(prior) || !recoveryAdmissionReady(current, prior, pr, view!.head, (deps.now ?? (() => new Date()))().getTime()))) return undefined;
       claimed = true;
       return { ...current, landAttempts: [...(current.landAttempts ?? []), { pr, head: view!.head, at }] };
     });
@@ -721,7 +807,7 @@ export async function executeLiveLand(
     detail = (error instanceof Error ? error.message : String(error)).slice(-300);
     failure = classifyLandFailure({ thrown: detail });
   }
-  const retryAllowed = failure?.class === 'infra' && attempt < LAND_ATTEMPTS_PER_HEAD_ON_INFRA;
+  const retryAllowed = (failure?.class === 'infra' || failure?.class === 'recovery') && attempt < LAND_ATTEMPTS_PER_HEAD_ON_INFRA;
   // 인프라 실패로 재시도가 남으면 주기 표시도 푼다 — 같은 주기 id(재판정 틱의 `rejudge:<card>:<head>`)가 그 한 번을 막지 않게.
   if (retryAllowed && cycle) landedCycles.delete(cycle);
   if (worktree && queueConfig && ok) {

package/src/task-agent/parent-host.ts

@@ -16,6 +16,8 @@ import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { debug } from '../debug/log.js';
+import { memoryQuantityBytes } from '../task-orchestrator/surfaces/pod-lease.js';
+import { parsePodPool } from '../task-orchestrator/surfaces/pod-pool.js';
 import { shellQuote } from './task-hand.js';
 
 /** `taskAgent.parentHost` 설정 칸. */
@@ -42,6 +44,11 @@ const DEFAULT_REMOTE_ELANOUS = '$HOME/.local/share/elanous/bin/elanous';
 const DEFAULT_REMOTE_CONFIG_DIR = '$HOME/.elanous';
 const HOST_RE = /^[A-Za-z0-9][A-Za-z0-9._@-]{0,127}$/;
 
+/** Missing child-provider metadata keeps the established Pod default: the HQ Codex mirror is needed. */
+export function shouldInstallRemoteCodexAccess(effectiveChildProvider: string | undefined): boolean {
+  return effectiveChildProvider === undefined || effectiveChildProvider === 'openai-codex';
+}
+
 /**
  * 켜졌나 — env 가 이긴다(`off`·`0`·빈 값이면 끔). env 가 호스트를 주면 나머지 칸(cwd 등)은 설정에서 받는다.
  * cwd 가 없으면 켜지지 않는다(어디서 띄울지 모르는 원격 발사는 하지 않는다).
@@ -74,6 +81,50 @@ export function resolveParentHosts(config: ParentHostSetting | undefined, env: N
 
 /** Capacity sample is read on the host before launch. Unknown or saturated capacity is not a positive weight. */
 export interface ParentHostCapacity { approvalHeadroom: number; load: number }
+
+export interface ParentHostPodFit {
+  state: 'fits' | 'never-fits' | 'unmeasured';
+  memoryLimit: string;
+  requiredBytes: number | null;
+  allocatableBytes: number | null;
+  reason: string;
+}
+
+/** Read node allocatable memory only. This preflight never creates a probe Pod. */
+export function readParentHostPodFit(target: ParentHostConfig, memoryLimit: string, ssh: SshRunner = defaultSshRunner): ParentHostPodFit {
+  const requiredBytes = memoryQuantityBytes(memoryLimit);
+  const unknown = (reason: string, allocatableBytes: number | null = null): ParentHostPodFit =>
+    ({ state: 'unmeasured', memoryLimit, requiredBytes, allocatableBytes, reason });
+  if (requiredBytes === null || requiredBytes <= 0) return unknown('memory-limit-unreadable');
+  // Without an explicit pool, the remote current kubectl context may be unrelated to the launched Job.
+  if (!target.podPool) return unknown('pod-pool-unset');
+  let members: ReturnType<typeof parsePodPool>;
+  try { members = parsePodPool(target.podPool); }
+  catch { return unknown('pod-pool-unreadable'); }
+  if (!members.length) return unknown('pod-pool-empty');
+  let maximum = 0;
+  let unreadable = false;
+  for (const member of members) {
+    let result: ReturnType<SshRunner>;
+    try { result = ssh(target.host, `kubectl --context ${shellQuote(member.context)} get nodes -o json`, 15_000); }
+    catch { unreadable = true; continue; }
+    if (result.status !== 0) { unreadable = true; continue; }
+    try {
+      const parsed = JSON.parse(result.stdout) as { items?: Array<{ status?: { allocatable?: { memory?: unknown } } }> };
+      if (!Array.isArray(parsed.items) || parsed.items.length === 0) { unreadable = true; continue; }
+      for (const node of parsed.items) {
+        const raw = node?.status?.allocatable?.memory;
+        const bytes = typeof raw === 'string' ? memoryQuantityBytes(raw) : null;
+        if (bytes === null || bytes <= 0) { unreadable = true; continue; }
+        maximum = Math.max(maximum, bytes);
+      }
+    } catch { unreadable = true; }
+  }
+  if (maximum >= requiredBytes) return { state: 'fits', memoryLimit, requiredBytes, allocatableBytes: maximum, reason: 'node-allocatable-fits' };
+  if (unreadable || maximum === 0) return unknown('node-allocatable-unmeasured', maximum || null);
+  return { state: 'never-fits', memoryLimit, requiredBytes, allocatableBytes: maximum, reason: 'memory-never-fits' };
+}
+
 const CAPACITY_MARKER = '__ELANOUS_PARENT_CAPACITY__';
 const APPROVAL_MARKER = '__ELANOUS_PARENT_APPROVALS__';
 const LOAD_MARKER = '__ELANOUS_PARENT_LOAD__';
@@ -170,10 +221,12 @@ export function remoteLaunchScript(target: ParentHostConfig, args: readonly stri
 }
 
 /** ssh 실행기(시험 주입). */
-export type SshRunner = (host: string, script: string, timeoutMs: number) => { status: number | null; stdout: string; stderr: string };
+export type SshRunner = (host: string, script: string, timeoutMs: number, stdin?: string) => { status: number | null; stdout: string; stderr: string };
 
-export const defaultSshRunner: SshRunner = (host, script, timeoutMs) => {
-  const result = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=8', '-o', 'ControlPath=none', host, script], { encoding: 'utf8', timeout: timeoutMs, maxBuffer: 32 * 1024 * 1024 });
+export const defaultSshRunner: SshRunner = (host, script, timeoutMs, stdin) => {
+  const result = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=8', '-o', 'ControlPath=none', host, script], {
+    encoding: 'utf8', timeout: timeoutMs, maxBuffer: 32 * 1024 * 1024, ...(stdin !== undefined ? { input: stdin } : {}),
+  });
   return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? (result.error ? String(result.error) : '') };
 };
 
@@ -302,6 +355,43 @@ export function launchRemoteParent(target: ParentHostConfig, args: readonly stri
   throw new Error(`원격 부모 발사 결과 불확실(${target.host} · rc=${result.status}) — 중복을 피해 로컬로 다시 띄우지 않는다 · 원격에서 ELANOUS_RUN_ID=${env.ELANOUS_RUN_ID ?? '?'} 를 확인: ${(result.stderr.trim().split('\n').pop() || '').slice(0, 160)}`);
 }
 
+/** Install access-only Codex copies over SSH stdin; credentials never enter argv, shell text, or logs. */
+export function installRemoteCodexAccess(target: ParentHostConfig, mirror: { elanousAuth: string; codexAuth: string; account?: string }, ssh: SshRunner = defaultSshRunner): void {
+  let elanous: { version?: number; providers?: Record<string, Record<string, unknown>> };
+  let codex: { auth_mode?: string; tokens?: Record<string, unknown> };
+  try {
+    elanous = JSON.parse(mirror.elanousAuth) as typeof elanous;
+    codex = JSON.parse(mirror.codexAuth) as typeof codex;
+  } catch { throw new Error('invalid local Codex access mirror'); }
+  const provider = elanous.providers?.['openai-codex'];
+  const elanousTokens = provider?.tokens as Record<string, unknown> | undefined;
+  const codexTokens = codex.tokens;
+  if (!Number.isSafeInteger(elanous.version) || Number(elanous.version) < 1
+    || typeof elanousTokens?.accessToken !== 'string' || !elanousTokens.accessToken || elanousTokens.refreshToken !== '' || elanousTokens.refresh_token !== ''
+    || codex.auth_mode !== 'chatgpt'
+    || typeof codexTokens?.access_token !== 'string' || !codexTokens.access_token || codexTokens.refresh_token !== '' || codexTokens.refreshToken !== '')
+    throw new Error('Codex access mirror must contain a versioned store, auth mode, access tokens, and empty refresh tokens');
+
+  const account = mirror.account ?? 'default';
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(account)) throw new Error('invalid Codex mirror account name');
+
+  const payload = JSON.stringify({ elanousVersion: elanous.version, provider, codexAuth: codex, account, storeKey: account === 'default' ? 'openai-codex' : `openai-codex:${account}` });
+  const configDir = remotePath(target.configDir ?? DEFAULT_REMOTE_CONFIG_DIR);
+  // HQ owns token metadata; the remote keeps only the selected named Codex credential in managed account homes.
+  const code = [
+    'const fs=require("node:fs"),path=require("node:path"),os=require("node:os");',
+    'const payload=JSON.parse(fs.readFileSync(0,"utf8"));',
+    'const read=(file)=>{try{return JSON.parse(fs.readFileSync(file,"utf8"))}catch{return {}}};',
+    'const write=(file,value)=>{const temp=file+"."+process.pid+".tmp";try{fs.writeFileSync(temp,JSON.stringify(value),{mode:0o600});fs.chmodSync(temp,0o600);fs.renameSync(temp,file)}catch(error){try{fs.unlinkSync(temp)}catch{};throw error}};',
+    'const elanousFile=path.join(process.argv[1],"auth.json"),configDir=path.dirname(elanousFile);fs.mkdirSync(configDir,{recursive:true,mode:0o700});',
+    'const elanous=read(elanousFile);if(typeof elanous.version!=="number")elanous.version=payload.elanousVersion;elanous.providers={...(elanous.providers||{})};const defaultHome=path.join(os.homedir(),".codex"),managedAccounts=path.join(configDir,"codex-accounts");for(const key of Object.keys(elanous.providers)){if(key.startsWith("openai-codex:"))delete elanous.providers[key]}fs.rmSync(managedAccounts,{recursive:true,force:true});fs.rmSync(path.join(configDir,"remote-codex-mirror.json"),{force:true});',
+    'const accountHome=payload.account==="default"?defaultHome:path.join(configDir,"codex-accounts",payload.account),tokens={...(payload.provider.tokens||{}),refreshToken:"",refresh_token:""};const upsert=(key,codexHome)=>{const current=elanous.providers[key]||{};elanous.providers[key]={...current,...payload.provider,codexHome,chatGPT:{...(current.chatGPT||{}),...(payload.provider.chatGPT||{})},tokens}};upsert("openai-codex",defaultHome);if(payload.storeKey!=="openai-codex")upsert(payload.storeKey,accountHome);write(elanousFile,elanous);',
+    'const incoming=payload.codexAuth;const installCodex=(home)=>{const file=path.join(home,"auth.json");fs.mkdirSync(home,{recursive:true,mode:0o700});const current=read(file),merged={...current,...incoming};merged.auth_mode=incoming.auth_mode;if(Object.prototype.hasOwnProperty.call(incoming,"last_refresh"))merged.last_refresh=incoming.last_refresh;else delete merged.last_refresh;merged.tokens={...(incoming.tokens||{}),refresh_token:"",refreshToken:""};write(file,merged)};installCodex(defaultHome);if(accountHome!==defaultHome)installCodex(accountHome);',
+  ].join('');
+  const result = ssh(target.host, `umask 077; mkdir -p ${configDir} "$HOME/.codex" && bun -e ${shellQuote(code)} ${configDir}`, 20_000, payload);
+  if (result.status !== 0) throw new Error(`remote Codex access mirror failed (ssh rc=${result.status ?? 'unknown'})`);
+}
+
 // ── 관측: 원격 런 원장 거울 ─────────────────────────────────────────────────────────────
 
 const RUN_ID_RE = /^run-[A-Za-z0-9_-]{4,64}$/;