elanous 0.2.31 → 0.2.34

package/src/cli/log-event-names.ts

@@ -316,6 +316,10 @@ export const KNOWN_LOG_EVENT_NAMES: ReadonlySet<string> = new Set([
   "daily-reflection.error",
   "dashboard-acp",
   "dashboard-boot",
+  "dashboard-executed",
+  "dashboard-executed-fallback",
+  "dashboard-executed-remote-skipped",
+  "dashboard-executed-session-unknown",
   "dashboard-optional-specs.return",
   "dashboard-optional-specs.short-circuited",
   "debug-logs.ingest",
@@ -430,6 +434,7 @@ export const KNOWN_LOG_EVENT_NAMES: ReadonlySet<string> = new Set([
   "doom-loop-ask-timeout",
   "doom-loop-auto-undo-applied",
   "doom-loop-detected",
+  "doom-loop-self-heal",
   "downgrade",
   "downstream-dep-deescalate",
   "downstream.emit",
@@ -547,6 +552,8 @@ export const KNOWN_LOG_EVENT_NAMES: ReadonlySet<string> = new Set([
   "focused-widget-key",
   "fold-applied",
   "fold-broken",
+  "fold-click-anchor",
+  "fold-click-follow-tail",
   "force-flush",
   "forced",
   "forked",
@@ -1519,7 +1526,10 @@ export const KNOWN_LOG_EVENT_NAMES: ReadonlySet<string> = new Set([
   "tool-unavailable",
   "tool.call",
   "tools-tier",
+  "trace-persist-deferred",
+  "trace-persist-dropped",
   "trace-persist-failed",
+  "trace-persist-flushed",
   "transcribe.begin",
   "transcribe.error",
   "transcribe.ok",

package/src/cli/msg-cli.ts

@@ -359,6 +359,7 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
       let store: MsgStore | undefined;
       try {
         const asked = withStore(ledger => ledger.post({ from, to, body: question }));
+        emit(asked, opts.json, () => out.log(`#${asked.id}`));
         // msg ask uses the same saved-message handler before waiting for its linked reply.
         await handleTaMessage(asked);
         const deadline = Date.now() + waitSeconds * 1000;

package/src/cli/pod-cli.ts

@@ -7,7 +7,7 @@ import { readPodMemoryAdvice } from './pod-memory-advice.js';
 import { getUserConfig } from '../user-config.js';
 import { listCodexAccountsInStore } from '../oauth/codex-account-store.js';
 import { parsePodPool, resolvePodPoolSpec, podPoolHostLease, type PoolKubectl } from '../task-orchestrator/surfaces/pod-pool.js';
-import { leaseKubectl, measurePoolLease, probePoolDns, recommendConcurrency, type PoolLeaseMeasure, type PoolDnsProbe } from '../task-orchestrator/surfaces/pod-lease.js';
+import { leaseKubectl, measurePoolLease, probePoolDns, probePoolGitHub, recommendConcurrency, type PoolLeaseMeasure, type PoolDnsProbe, type ExternalGitHubProbe } from '../task-orchestrator/surfaces/pod-lease.js';
 import { POD_COMMAND_DEADLINE_SECONDS, runPodCommand, type PodCommandResult, type RunPodCommandOptions } from '../task-orchestrator/surfaces/pod-command-job.js';
 import { hostLeaseCounts, leaseHasPendingPod } from '../pod-lease/host-lease.js';
 
@@ -22,6 +22,7 @@ export interface PodCliDeps {
   run?: (options: RunPodCommandOptions) => Promise<PodCommandResult>;
   kubectl?: PoolKubectl;
   dns?: (context: string, kubectl: PoolKubectl) => PoolDnsProbe;
+  externalGitHub?: (context: string, kubectl: PoolKubectl) => ExternalGitHubProbe;
   accounts?: () => number;
   perAccount?: () => number;
   poolSpec?: (explicit?: string) => string | null;
@@ -81,7 +82,8 @@ export function registerPodCommands(program: Command, deps: PodCliDeps = {}): vo
     .command('status').description('지금 추가로 쏠 수 있는 Pod 골과 제한 근거')
     .option('--pool <spec>', '풀 스펙 — 컨텍스트[@ssh호스트][:상한][#레지스트리:포트] 쉼표')
     .option('--json', '표 대신 동일 측정값을 JSON 으로')
-    .action((opts: { pool?: string; json?: boolean }) => {
+    .option('--github-egress', '같은 namespace 임시 Pod에서 GitHub DNS/HTTPS를 별도 관측 (admission 불변)')
+    .action((opts: { pool?: string; json?: boolean; githubEgress?: boolean }) => {
       try {
         const kubectl = deps.kubectl ?? leaseKubectl;
         const spec = (deps.poolSpec ?? ((explicit?: string) => resolvePodPoolSpec(explicit, process.env, () => {
@@ -105,7 +107,14 @@ export function registerPodCommands(program: Command, deps: PodCliDeps = {}): vo
         // Pending Pods and Job-only reservations are disjoint; a lease for an already Pending Job is the same Job.
         const waitingJobs = decision.pending === null ? null : decision.pending +
           records.filter((r) => r.stage === 'job' && !leaseHasPendingPod(r, decision.pendingJobs ?? [])).length;
-        const result = { pool: spec, ...measure, accounts, perAccount, ...decision, reserved: host.reserved, waitingJobs };
+        // This explicit observation runs after the admission calculation. A slow or failed external
+        // probe can never change recommended/limitedBy or slow the ordinary lease status path.
+        const externalGitHub = opts.githubEgress ? Object.fromEntries(members.map((member) => {
+          try { return [member.context, (deps.externalGitHub ?? probePoolGitHub)(member.context, kubectl)]; }
+          catch { return [member.context, { externalDns: null, githubHttps: null, measuredAt: null, reason: 'probe failed' }]; }
+        })) : undefined;
+        const result = { pool: spec, ...measure, accounts, perAccount, ...decision, reserved: host.reserved, waitingJobs,
+          ...(externalGitHub ? { externalGitHub } : {}) };
         debug.log('pod.lease', 'status', { pool: spec ? members.map((m) => ({ capacity: m.capacity })) : null, running: decision.running, pending: decision.pending, reserved: host.reserved, waitingJobs, unleasedRunning: decision.unleasedRunning, recommended: decision.recommended, limitedBy: decision.limitedBy });
         if (opts.json) io.log(JSON.stringify(result));
         else {
@@ -123,6 +132,8 @@ export function registerPodCommands(program: Command, deps: PodCliDeps = {}): vo
           }
           io.log(`예약(저작 중) ${host.reserved} · 대기 Job ${waitingJobs ?? '?'} · 실행 ${decision.running ?? '?'}`);
           io.log(`임대 없는 실행 ${decision.unleasedRunning ?? '?'}`);
+          if (externalGitHub) for (const [context, probe] of Object.entries(externalGitHub))
+            io.log(`GitHub 외부망 ${context}: DNS=${probe.externalDns ?? '?'} HTTPS=${probe.githubHttps ?? '?'} 측정=${probe.measuredAt ?? '?'}${probe.reason ? ` · ${probe.reason}` : ''}`);
           io.log(`capacity: ${decision.capacitySlots ?? '?'} 칸 (상한 ${members.reduce((sum, m) => sum + m.capacity, 0)} − Running ${decision.running ?? '?'} − Pending ${decision.pending ?? '?'}; 권장 수에서 건강한 멤버의 임대 없는 실행 차감)`);
           io.log(`memory: ${decision.memorySlots ?? '?'} 칸 (할당 가능 − Running 하니스 상한 합; 골당 16Gi · 모든 네임스페이스의 노드별 기존 예약을 반영해 배치 가능 ${decision.placeableSlots ?? '?'} 칸)`);
           io.log(`lite: ${decision.liteMemorySlots ?? '?'} 칸 (같은 여유를 lite 골 2Gi 로 센 값 · 관측만 — 권장 수는 위 standard 기준)`);

package/src/cli/pr-cli.ts

@@ -58,13 +58,17 @@ import { branchLineageSlug, findSiblingPrs } from './pr-lineage.js';
 import { parseReleaseNoteSection } from '../release-loop/release-note.js';
 import { landingFreezeMessage } from '../release-loop/landing-freeze.js';
 import { admitLandingMerge } from '../self-implement/frozen-merges.js';
-import { verifyAllSameHeadReviews, verifyAncestorAutoPass, verifyOverlapEvidence } from './pr-land-overlap-evidence.js';
+import { resolveOverlapEvidencePath, verifyAllSameHeadReviews, verifyAncestorAutoPass, verifyOverlapEvidence, verifyOverlapEvidenceVirtualRebase } from './pr-land-overlap-evidence.js';
+import type { VerifyOverlapEvidenceInput } from './pr-land-overlap-evidence.js';
 import { verifyVirtualRebasePatch } from './pr-land-virtual-rebase.js';
-import { observePrLandRefusal } from './pr-land-refusal.js';
+import { observeDirectPrLandRefusal, observePrLandRefusal } from './pr-land-refusal.js';
+import { planPrLandRecovery } from './pr-land-recovery.js';
 import { ensurePrLandHeavyRemote, type HeavyRemoteInput, type HeavyRemoteResult } from './pr-land-heavy-remote.js';
+import { readPrBaseNameWithRetry } from './pr-land-base-read.js';
 import { runHeavyOnPodShadow } from './pr-land-pod-shadow.js';
 import type { LandingPodShadowInput, LandingPodShadowVerdict } from './pr-land-pod-shadow-job.js';
-import { taskAgentStatePath } from '../task-agent/task-hand.js';
+import { readTaskAgentState, taskAgentStatePath, type TaskCard } from '../task-agent/task-hand.js';
+import { INFLIGHT_REGISTRY_FILE, removeInflightForPr } from '../pr-tool/inflight-registry.js';
 import { PR_LABEL_NAMES } from '../github/pr-labels.js';
 import { enqueueL8ShadowQueue, runL8ShadowQueue, shadowPrNumber, statusL8ShadowQueue, type L8ShadowQueueDeps } from '../self-implement/l8-merge-queue.js';
 import { censusOpenPrs, guardNewPr, parseDiffHunks, readOpenPrs, type Seat } from '../pr-tool/census.js';
@@ -114,6 +118,8 @@ export const PR_LAND_MERGEABLE_UNKNOWN_WAIT_MS = 5_000;
 
 export interface PrLandDeps {
   manager?: PrManager;
+  /** Confirmed merge cleanup; failures are observed and never undo the merge. */
+  onMergedSupersede?: (number: number, cwd: string) => Promise<void>;
   /** 병합 재시도 사이 대기(시험 주입용 · 기본 실제 대기). */
   sleep?: (ms: number) => Promise<void>;
   run?: CmdRunner;
@@ -122,6 +128,8 @@ export interface PrLandDeps {
   readFile?: (path: string) => string;
   /** 증거 파일 없는 already-ancestor 자동 판정이 리뷰 결과를 찾는 자리(기본 `<TA 상태 디렉터리>/review-results`). */
   reviewResultsDir?: string;
+  /** INFLIGHT-REGISTRY — 착지 뒤 등록부 줄을 찾을 과제 카드 상태(기본 `taskAgentStatePath()` · 등록부는 그 옆). */
+  taskStatePath?: string;
   listUnfinishedRuns?: () => FederatedUnfinishedRunLedgerQuery | readonly FederatedUnfinishedRunLedgerEntry[];
   queryRunningRuns?: () => RunningRunsResult;
   listOpenPrs?: () => readonly { number: number; headRefName: string }[] | null;
@@ -266,14 +274,14 @@ export async function decideOverlapLanding(input: {
 
 const liveOut = { log: (message: string) => console.log(message), error: (message: string) => console.error(message) };
 
-function runPrLandTypecheckGate(out: { log: (message: string) => void; error: (message: string) => void }, cwd: string = process.cwd()): boolean {
+function runPrLandTypecheckGate(out: { log: (message: string) => void; error: (message: string) => void }, cwd: string): boolean {
   let failed = false;
   const exit = ((code: number): never => {
     failed = code !== 0;
     throw new Error(`ci-typecheck-changed exited ${code}`);
   });
   try {
-    runChangedTypecheckGate({ log: out.log, warn: out.error, error: out.error, exit, cwd });
+    runChangedTypecheckGate({ log: out.log, warn: out.error, error: out.error, exit, cwd: resolve(cwd), allowMissingCheckoutDependencies: true });
   } catch (error) {
     if (!failed) throw error;
   }
@@ -392,6 +400,7 @@ export function exportLeakBlock(
   allow: boolean,
   out: { log: (message: string) => void; error: (message: string) => void },
   cwd: string = process.cwd(),
+  onRefusal?: (message: string) => void,
 ): boolean {
   if (!changedFiles || changedFiles.length === 0) return true;
   let result: ExportLeakCheck;
@@ -425,7 +434,9 @@ export function exportLeakBlock(
   }
   if (blockedHits.length === 0) { out.log('✓ public-export-leak: 바뀐 파일이 공개본에 사적 흔적을 싣지 않는다(prepare 와 같은 변환 뒤).'); return true; }
   const write = allow ? out.log : out.error;
-  write(`${allow ? '⚠' : '✗'} public-export-leak: 바뀐 파일 ${blockedHits.length}곳이 공개본에 사적 흔적을 싣는다 — 다음 release prepare 가 여기서 실패한다:`);
+  const refusal = `${allow ? '⚠' : '✗'} public-export-leak: 바뀐 파일 ${blockedHits.length}곳이 공개본에 사적 흔적을 싣는다 — 다음 release prepare 가 여기서 실패한다:`;
+  write(refusal);
+  if (!allow) onRefusal?.(refusal);
   for (const hit of blockedHits.slice(0, 20)) write(`   ${hit.file}:${hit.line} · ${hit.marker}${missingReason.includes(hit) ? ' · 사유 없음' : ''}`);
   if (blockedHits.length > 20) write(`   … 외 ${blockedHits.length - 20}곳`);
   write('   확인: bun scripts/public-export.ts --leak-check --all --files <파일…>');
@@ -1060,7 +1071,7 @@ function emitLandingOverlapAdvisory(
 }
 
 /** The pinned overlap evidence decision is shared by landing and its read-only preview. */
-function verifyPinnedOverlapDecision(input: {
+export function verifyPinnedOverlapDecision(input: {
   opts: PrLandOpts;
   deps: PrLandDeps;
   run: CmdRunner;
@@ -1078,13 +1089,14 @@ function verifyPinnedOverlapDecision(input: {
   let ancestorResyncNeeded = false;
   if (decision === 'unavailable' && opts.overlapEvidence !== undefined) {
     const ref = resolveRemoteBranchRef(run, cwd, base);
-    const verdict = verifyOverlapEvidence({
-      evidencePath: opts.overlapEvidence, pr: Number(opts.pr), expectedHead: opts.expectedHead!,
+    const evidenceInput: VerifyOverlapEvidenceInput = {
+      evidencePath: resolveOverlapEvidencePath(opts.overlapEvidence, cwd), pr: Number(opts.pr), expectedHead: opts.expectedHead!,
       remote: ref.remote, branch: ref.branch, cwd, run, readFile,
       reviewResultsDir: deps.reviewResultsDir ?? join(dirname(taskAgentStatePath()), 'review-results'),
       listDir: (dir) => readdirSync(dir), reviewMtime: (path) => statSync(path).mtimeMs,
       reviewRealPath: (path) => realpathSync(path), overlappingLandings,
-    });
+    };
+    const verdict = verifyOverlapEvidence(evidenceInput);
     accepted = verdict.ok;
     if (verdict.ok) {
       out.log(verdict.mode === 'already-ancestor'
@@ -1092,7 +1104,24 @@ function verifyPinnedOverlapDecision(input: {
         : verdict.mode === 'base-advanced-disjoint'
           ? `✓ overlap-evidence: base-advanced-disjoint — gate base ${verdict.gateBase.slice(0, 12)} ⊂ head ${opts.expectedHead!.slice(0, 12)} · ${ref.remote}/${ref.branch} ${verdict.baseTip.slice(0, 12)} 까지 ${verdict.windowCommits}개 커밋이 PR 파일을 안 건드린다 · review pass|warn must-fix 0 (${verdict.reviewResult})`
           : `✓ overlap-evidence: ${ref.remote}/${ref.branch} ${verdict.baseTip.slice(0, 12)} ⊂ head ${opts.expectedHead!.slice(0, 12)} · gate passed on that base · review pass must-fix 0 (${verdict.reviewResult})`);
-    } else refuse(`✗ overlap-evidence: ${verdict.reason}`);
+    } else {
+      const pureNotRebased = verdict.baseTip !== undefined && verdict.reason ===
+        `not-rebased: ${ref.remote}/${ref.branch} ${verdict.baseTip.slice(0, 12)} is not an ancestor of ${opts.expectedHead!.slice(0, 12)}`;
+      const measuredOverlap = verdict.baseTip !== undefined && verdict.reason.startsWith('base-stale-overlap:');
+      if (pureNotRebased || measuredOverlap) {
+        const patch = verifyOverlapEvidenceVirtualRebase(evidenceInput, verdict.baseTip!);
+        accepted = patch.ok;
+        record('virtual-rebase', patch.ok, {
+          pr: Number(opts.pr), head: opts.expectedHead, baseTip: verdict.baseTip,
+          reason: patch.ok ? 'same-patch-id' : patch.reason,
+          reviewResult: patch.ok ? patch.reviewResult : null,
+          evidencePath: opts.overlapEvidence,
+        });
+        if (patch.ok) {
+          out.log(`✓ overlap-evidence: virtual-rebase — ${ref.remote}/${ref.branch} ${verdict.baseTip!.slice(0, 12)} 와 head ${opts.expectedHead!.slice(0, 12)} 충돌 없음 · patch-id ${patch.patchId.slice(0, 12)} 동일 · review pass|warn must-fix 0 (${patch.reviewResult})`);
+        } else refuse(`✗ overlap-evidence: ${verdict.reason} · virtual-rebase: ${patch.reason}`);
+      } else refuse(`✗ overlap-evidence: ${verdict.reason}`);
+    }
   } else if (decision === 'unavailable') {
     const verdict = verifyAncestorAutoPass({
       pr: Number(opts.pr), expectedHead: opts.expectedHead!, cwd, run, readFile, overlappingLandings,
@@ -1121,12 +1150,12 @@ function verifyPinnedOverlapDecision(input: {
         ancestorResyncNeeded = !accepted;
         record('virtual-rebase', patch.ok, {
           pr: Number(opts.pr), head: opts.expectedHead, baseTip: baseTip || null,
-          reason: patch.ok ? 'same-patch-id' : patch.reason,
+          reason: patch.ok ? 'same-patch-id' : ('reason' in patch ? patch.reason : 'virtual-rebase-unmeasured'),
           reviewResult: reviews.ok ? reviews.reviewResult : null,
         });
-        if (patch.ok) {
+        if (patch.ok && reviews.ok) {
           out.log(`✓ overlap-evidence: virtual-rebase — ${ref.remote}/${ref.branch} ${baseTip.slice(0, 12)} 와 head ${opts.expectedHead!.slice(0, 12)} 충돌 없음 · patch-id ${patch.patchId.slice(0, 12)} 동일 · review pass|warn must-fix 0 (${reviews.reviewResult})`);
-        } else refuse(`✗ virtual-rebase: ${patch.reason} · ${verdict.reason}`);
+        } else refuse(`✗ virtual-rebase: ${'reason' in patch ? patch.reason : 'virtual-rebase-unmeasured'} · ${verdict.reason}`);
       } else refuse(`✗ ancestor-auto: ${verdict.reason}`);
     }
   }
@@ -1287,11 +1316,28 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
       totalElapsedMs: Math.max(0, Date.now() - landStartedAt), ok, ...extra,
     });
   };
-  // First slice: observe pinned identity/branch, overlap decision, and GitHub merge refusals.
-  // Option syntax and prerequisite gate errors do not describe a merge recovery edge.
+  // Observe actual merge refusals, including the measured remote gate and public export leak.
+  // Option syntax and unmeasured prerequisite errors do not describe a recovery edge.
   const refuse = (message: string, context: { isDraft?: boolean } = {}): void => {
     out.error(message);
     observePrLandRefusal(message, context);
+    const pr = Number(opts.pr);
+    if (Number.isSafeInteger(pr) && pr > 0 && opts.expectedHead) {
+      try {
+        const plan = planPrLandRecovery({ refusal: message, pr, head: opts.expectedHead, isDraft: context.isDraft });
+        debug.log('pr.land', 'recover-shadow', {
+          pr, head: opts.expectedHead, label: plan.evidence.label, route: plan.evidence.route,
+          outcome: plan.outcome, action: plan.result.action, reason: plan.result.reason,
+          delayMs: plan.result.delayMs ?? null, execution: 'none',
+        });
+      } catch {
+        // Recovery observation must never replace the original landing refusal.
+      }
+    }
+  };
+  const refuseDirect = (message: string): void => {
+    out.error(message);
+    observeDirectPrLandRefusal(message);
   };
   if (opts.title !== undefined && opts.titleFile !== undefined) {
     out.error('✗ title: --title과 --title-file은 함께 사용할 수 없습니다.');
@@ -1829,7 +1875,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   if (opts.heavyRemote) {
     const main = overlapCheckedBase!;
     const verdict = heavyGate(main, 'initial');
-    if (!verdict?.ok) { out.error(`✗ heavy-remote: 원격 게이트 ${verdict?.reason ?? 'unmeasured'} — 로컬 게이트로 폴백하지 않는다.`); return 1; }
+    if (!verdict?.ok) { refuseDirect(`✗ heavy-remote: 원격 게이트 ${verdict?.reason ?? 'unmeasured'} — 로컬 게이트로 폴백하지 않는다.`); return 1; }
     verifiedHeavyBase = main;
     out.log(`✓ heavy-remote: host=${verdict.host ?? 'unknown'} head=${opts.expectedHead!.slice(0, 12)} main=${main.slice(0, 12)} source=${verdict.source} elapsed=${verdict.elapsedMs}ms`);
     out.log(`✓ typecheck-roots: ${JSON.stringify(verdict.rootPlan ?? { mode: 'not-applicable', roots: null, promoted: false, reason: 'no-root-plan-in-gate-output' })}`);
@@ -1850,22 +1896,27 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   // A move during the wait is the same race as a move during the gate: rerun or fail closed.
   // gh merge pins the head only. A retargeted PR would land on a branch the heavy gate never measured.
   // Unreadable baseRefName is not "main". Normal pr land (no --heavy-remote) does not use this check.
-  const confirmHeavyPrBase = (): number | undefined => {
+  const confirmHeavyPrBase = async (): Promise<number | undefined> => {
     if (!opts.heavyRemote) return undefined;
-    const viewed = run('gh', ['pr', 'view', String(opts.pr), '--json', 'baseRefName,url'], { cwd });
-    // JSON only. A bare "main" from another view (tests, --jq) is not this answer; unreadable is not main.
-    let baseName = '';
-    try {
-      if (viewed.ok) {
-        const parsed: unknown = JSON.parse(viewed.out);
-        const name = parsed && typeof parsed === 'object' && !Array.isArray(parsed)
-          ? (parsed as { baseRefName?: unknown }).baseRefName : undefined;
-        if (typeof name === 'string') baseName = name.trim();
-      }
-    } catch { /* unreadable is not main */ }
+    const baseRead = await readPrBaseNameWithRetry({
+      pr: String(opts.pr), cwd, run,
+      sleep: deps.sleep ?? ((ms) => new Promise<void>((resolve) => setTimeout(resolve, ms))),
+      onUnreadable: (attempt, stderr) => {
+        if (stderr?.trim()) out.error(`⚠ heavy-remote: gh pr view base read attempt ${attempt}/3 stderr: ${stderr.trim()}`);
+      },
+    });
+    const baseName = baseRead.baseRefName;
+    record('heavy-remote-pr-base-read', baseName !== null, {
+      pr: Number(opts.pr), baseRefName: baseName, attempts: baseRead.attempts,
+    });
+    if (baseName === null) {
+      record('heavy-remote-pr-base', false, { pr: Number(opts.pr), baseRefName: null, attempts: baseRead.attempts, reason: 'unreadable' });
+      refuseDirect(`✗ heavy-remote: PR base 조회 불가 (${baseRead.attempts}회) — 통과한 head/main 쌍을 확인하지 못했다. 병합하지 않는다.`);
+      return 1;
+    }
     if (baseName !== 'main') {
-      record('heavy-remote-pr-base', false, { pr: Number(opts.pr), baseRefName: baseName || null });
-      out.error(`✗ heavy-remote: PR base=${baseName || 'unreadable'} ≠ main — 재타기팅된 PR은 통과한 head/main 쌍이 아니다. 병합하지 않는다.`);
+      record('heavy-remote-pr-base', false, { pr: Number(opts.pr), baseRefName: baseName, attempts: baseRead.attempts, reason: 'non-main' });
+      refuseDirect(`✗ heavy-remote: PR base=${baseName} ≠ main — 재타기팅된 PR은 통과한 head/main 쌍이 아니다. 병합하지 않는다.`);
       return 1;
     }
     return undefined;
@@ -1885,7 +1936,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   };
   const confirmHeavyBaseStable = async (): Promise<number | undefined> => {
     if (!opts.heavyRemote) return undefined;
-    const retargeted = confirmHeavyPrBase();
+    const retargeted = await confirmHeavyPrBase();
     if (retargeted !== undefined) return retargeted;
     let stable = false;
     for (let attempt = 0; attempt <= HEAVY_BASE_STABILITY_RETRIES; attempt += 1) {
@@ -1899,7 +1950,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
       if (staleOverlap !== undefined) return staleOverlap;
       const verdict = heavyGate(main, 'late-recheck');
       if (!verdict?.ok) {
-        out.error(`✗ heavy-remote: 병합 직전 원격 게이트 ${verdict?.reason ?? 'unmeasured'} — 로컬 게이트로 폴백하지 않는다.`);
+        refuseDirect(`✗ heavy-remote: 병합 직전 원격 게이트 ${verdict?.reason ?? 'unmeasured'} — 로컬 게이트로 폴백하지 않는다.`);
         return 1;
       }
       verifiedHeavyBase = main;
@@ -1911,7 +1962,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     }
     // A late regate can take minutes. Re-read baseRefName after that wait and before success:
     // the pre-loop check is stale if the PR was retargeted while origin/main was being remeasured.
-    const retargetedAfter = confirmHeavyPrBase();
+    const retargetedAfter = await confirmHeavyPrBase();
     if (retargetedAfter !== undefined) return retargetedAfter;
     return undefined;
   };
@@ -1924,7 +1975,8 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     }
     return recheckOverlapAtBase(currentBase);
   };
-  const typecheckOk = opts.heavyRemote || (deps.runTypecheckGate ?? ((o) => runPrLandTypecheckGate(o, cwd)))(out);
+  // The production gate must receive this land invocation's --cwd, never the launching shell's cwd.
+  const typecheckOk = opts.heavyRemote || (deps.runTypecheckGate ? deps.runTypecheckGate(out) : runPrLandTypecheckGate(out, cwd));
   record('typecheck', typecheckOk);
   if (!typecheckOk) {
     // ⛔⭐ 「왜 막혔나」를 «단정하지 않는다» — 이 게이트는 불리언만 돌려주므로 여기서는 이유를 모른다.
@@ -1990,7 +2042,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   nextMdWarning(body ?? '', changedPaths, out);
   if (!conflictMarkerBlock(changedPaths, cwd, out)) return 1;
   publicLeakWarning(changedPaths, deps.runPublicLeakGate ?? ((files, sink) => runPrLandPublicLeakGate(files, sink, cwd, base)), out);
-  if (!exportLeakBlock(changedPaths, () => (deps.runExportLeakCheck ?? runPrLandExportLeakCheck)(changedPaths ?? [], cwd), opts.allowPublicLeak === true, out, cwd)) return 1;
+  if (!exportLeakBlock(changedPaths, () => (deps.runExportLeakCheck ?? runPrLandExportLeakCheck)(changedPaths ?? [], cwd), opts.allowPublicLeak === true, out, cwd, observeDirectPrLandRefusal)) return 1;
   if (!await exportImportBlock(changedPaths, () => (deps.runExportImportCheck ?? runPrLandExportImportCheck)(changedPaths ?? [], cwd), out)) return 1;
   if (publicDocPaths(changedPaths, () => true).length > 0) {
     const top = run('git', ['rev-parse', '--show-toplevel'], { cwd });
@@ -2347,6 +2399,21 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   }
   if (opts.forceFreeze) debug.log('release-loop.freeze', 'force-merge', { pr: prNumber, reason: opts.forceFreeze.trim() });
   record('merge', true, { result: merged.kind, ...(merged.remoteBranchDeletion ? { remoteBranchDeletion: merged.remoteBranchDeletion.detail } : {}) });
+  if (Number.isSafeInteger(prNumber) && prNumber > 0 && deps.onMergedSupersede) {
+    try { await deps.onMergedSupersede(prNumber, cwd); }
+    catch (error) {
+      try { debug.log('drafts.cleanup', 'same-cell-hook-failed', { merged: prNumber, error: String(error) }, { level: 'warn' }); }
+      catch { /* a cleanup observation cannot undo a confirmed merge */ }
+    }
+  }
+  // INFLIGHT-REGISTRY — 착지하면 비행 중 등록부의 그 런 줄을 지운다(색인 실패는 착지를 막지 않는다).
+  try {
+    const statePath = deps.taskStatePath ?? taskAgentStatePath();
+    const cards = Object.values(readTaskAgentState<{ tasks?: Record<string, TaskCard> }>(statePath).tasks ?? {});
+    removeInflightForPr(prNumber, cards, { path: join(dirname(statePath), INFLIGHT_REGISTRY_FILE) });
+  } catch (error) {
+    try { debug.log('pr-tool.inflight', 'remove-failed', { pr: prNumber, error: String((error as Error)?.message ?? error).slice(0, 200) }, { level: 'warn' }); } catch { /* fail-soft */ }
+  }
   if (merged.remoteBranchDeletion) {
     out.log(`⚠ remote branch deletion: ${merged.remoteBranchDeletion.detail}`);
   }
@@ -2402,12 +2469,30 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
       out.log(`✓ heavy-remote: post-merge host=${post.host ?? 'unknown'} head=${opts.expectedHead!.slice(0, 12)} main=${firstParent.slice(0, 12)} source=${post.source}`);
     }
   }
-  const baseRef = upsert.reused
+  const finalBaseRead = upsert.reused && opts.heavyRemote
+    ? await readPrBaseNameWithRetry({
+      pr: upsert.url, cwd, run,
+      sleep: deps.sleep ?? ((ms) => new Promise<void>((resolve) => setTimeout(resolve, ms))),
+      onUnreadable: (attempt, stderr) => {
+        if (stderr?.trim()) out.error(`⚠ heavy-remote: final gh pr view base read attempt ${attempt}/3 stderr: ${stderr.trim()}`);
+      },
+    })
+    : undefined;
+  const baseRef = upsert.reused && !opts.heavyRemote
     ? run('gh', ['pr', 'view', upsert.url, '--json', 'baseRefName', '--jq', '.baseRefName'], { cwd })
     : undefined;
-  const landingBase = baseRef
-    ? (baseRef.ok && baseRef.out.trim() ? baseRef.out.trim() : '<base unavailable>')
-    : base;
+  const landingBase = finalBaseRead
+    ? finalBaseRead.baseRefName ?? '<base unavailable>'
+    : baseRef
+      ? (baseRef.ok && baseRef.out.trim() ? baseRef.out.trim() : '<base unavailable>')
+      : base;
+  if (finalBaseRead?.baseRefName && finalBaseRead.baseRefName !== 'main') {
+    out.error(`✗ heavy-remote: PR base=${finalBaseRead.baseRefName} ≠ main — 병합된 base를 확인했습니다.`);
+    return 1;
+  }
+  if (finalBaseRead?.baseRefName === null) {
+    out.log(`⚠ heavy-remote: final PR base 조회 불가 (${finalBaseRead.attempts}회) — 병합 결과를 실패 처리하지 않습니다.`);
+  }
   out.log(`✓ merge: squash ${upsert.url} → ${landingBase}`);
   if (landingBase === '<base unavailable>') {
     out.log('⚠ local HEAD does not contain the landed result; the landed base is unavailable, so no branch command can be provided.');
@@ -2423,6 +2508,20 @@ export function registerPrCommands(program: Command, deps: PrLandDeps = {}, queu
   const prToolRun = deps.run ?? defaultCmdRunner;
   const prToolOut = deps.out ?? liveOut;
   const prToolExit = deps.setExitCode ?? ((code: number) => { process.exitCode = code; });
+  const supersedeMerged = deps.onMergedSupersede ?? (async (number: number, cwd: string): Promise<void> => {
+    const { supersedeMergedGoalDrafts } = await import('../harness/harness-cli-command.js');
+    await supersedeMergedGoalDrafts(number, cwd, undefined, undefined, { onlyExplicitSameCell: true });
+  });
+  pr.command('supersede-drafts')
+    .description('확인된 병합 PR의 명시 Supersedes 같은 칸 draft만 정리')
+    .requiredOption('--pr <number>', '병합 PR 번호')
+    .option('--cwd <path>', '저장소 경로')
+    .action(async (opts: { pr: string; cwd?: string }) => {
+      const number = Number(opts.pr);
+      if (!Number.isSafeInteger(number) || number < 1) { prToolOut.error('✗ supersede-drafts: 올바른 --pr 번호 필요'); prToolExit(1); return; }
+      try { await supersedeMerged(number, opts.cwd ?? process.cwd()); }
+      catch (error) { prToolOut.error(`✗ supersede-drafts: ${String(error)}`); prToolExit(1); }
+    });
   pr.command('census')
     .description('열린 PR 전체·골 문서만·2일 무커밋 draft·미닫힌 superseded 집계')
     .option('--cwd <path>', '저장소 경로')
@@ -2497,7 +2596,7 @@ export function registerPrCommands(program: Command, deps: PrLandDeps = {}, queu
         const { registerStandaloneLogSink } = await import('../domains/standalone-log-sink.js');
         await registerStandaloneLogSink('pr-land');
       } catch { /* fail-open */ }
-      const code = await runPrLand(opts, deps);
+      const code = await runPrLand(opts, { ...deps, onMergedSupersede: supersedeMerged });
       if (code !== 0) (deps.setExitCode ?? ((exitCode: number) => { process.exitCode = exitCode; }))(code);
     });
   pr.command('granularity')

package/src/cli/pr-land-base-read.ts

@@ -0,0 +1,36 @@
+import type { CmdRunner } from '../autopilot/pr-manager.js';
+
+export const PR_LAND_BASE_READ_RETRIES = 2;
+export const PR_LAND_BASE_READ_RETRY_DELAY_MS = 100;
+
+export interface PrBaseReadResult {
+  baseRefName: string | null;
+  attempts: number;
+}
+
+/** Retry only an unreadable GitHub base response; a readable non-main base is a real retarget. */
+export async function readPrBaseNameWithRetry(input: {
+  pr: string;
+  cwd: string;
+  run: CmdRunner;
+  sleep: (ms: number) => Promise<void>;
+  onUnreadable?: (attempt: number, stderr: string | undefined) => void;
+}): Promise<PrBaseReadResult> {
+  for (let attempt = 1; attempt <= PR_LAND_BASE_READ_RETRIES + 1; attempt += 1) {
+    const viewed = input.run('gh', ['pr', 'view', input.pr, '--json', 'baseRefName,url'], { cwd: input.cwd });
+    let baseRefName: string | null = null;
+    try {
+      if (viewed.ok) {
+        const parsed: unknown = JSON.parse(viewed.out);
+        const name = parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+          ? (parsed as { baseRefName?: unknown }).baseRefName : undefined;
+        if (typeof name === 'string' && name.trim()) baseRefName = name.trim();
+      }
+    } catch { /* Retry unreadable responses; do not treat them as main. */ }
+
+    if (baseRefName !== null) return { baseRefName, attempts: attempt };
+    input.onUnreadable?.(attempt, viewed.err);
+    if (attempt <= PR_LAND_BASE_READ_RETRIES) await input.sleep(PR_LAND_BASE_READ_RETRY_DELAY_MS);
+  }
+  return { baseRefName: null, attempts: PR_LAND_BASE_READ_RETRIES + 1 };
+}