elanous 0.2.32 → 0.2.35

package/src/task-agent/parent-host.ts

@@ -16,6 +16,9 @@ import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { debug } from '../debug/log.js';
+import { resolveFreshGrokCredential } from '../grok/credential.js';
+import { memoryQuantityBytes } from '../task-orchestrator/surfaces/pod-lease.js';
+import { parsePodPool } from '../task-orchestrator/surfaces/pod-pool.js';
 import { shellQuote } from './task-hand.js';
 
 /** `taskAgent.parentHost` 설정 칸. */
@@ -42,6 +45,11 @@ const DEFAULT_REMOTE_ELANOUS = '$HOME/.local/share/elanous/bin/elanous';
 const DEFAULT_REMOTE_CONFIG_DIR = '$HOME/.elanous';
 const HOST_RE = /^[A-Za-z0-9][A-Za-z0-9._@-]{0,127}$/;
 
+/** Missing child-provider metadata keeps the established Pod default: the HQ Codex mirror is needed. */
+export function shouldInstallRemoteCodexAccess(effectiveChildProvider: string | undefined): boolean {
+  return effectiveChildProvider === undefined || effectiveChildProvider === 'openai-codex';
+}
+
 /**
  * 켜졌나 — env 가 이긴다(`off`·`0`·빈 값이면 끔). env 가 호스트를 주면 나머지 칸(cwd 등)은 설정에서 받는다.
  * cwd 가 없으면 켜지지 않는다(어디서 띄울지 모르는 원격 발사는 하지 않는다).
@@ -74,6 +82,50 @@ export function resolveParentHosts(config: ParentHostSetting | undefined, env: N
 
 /** Capacity sample is read on the host before launch. Unknown or saturated capacity is not a positive weight. */
 export interface ParentHostCapacity { approvalHeadroom: number; load: number }
+
+export interface ParentHostPodFit {
+  state: 'fits' | 'never-fits' | 'unmeasured';
+  memoryLimit: string;
+  requiredBytes: number | null;
+  allocatableBytes: number | null;
+  reason: string;
+}
+
+/** Read node allocatable memory only. This preflight never creates a probe Pod. */
+export function readParentHostPodFit(target: ParentHostConfig, memoryLimit: string, ssh: SshRunner = defaultSshRunner): ParentHostPodFit {
+  const requiredBytes = memoryQuantityBytes(memoryLimit);
+  const unknown = (reason: string, allocatableBytes: number | null = null): ParentHostPodFit =>
+    ({ state: 'unmeasured', memoryLimit, requiredBytes, allocatableBytes, reason });
+  if (requiredBytes === null || requiredBytes <= 0) return unknown('memory-limit-unreadable');
+  // Without an explicit pool, the remote current kubectl context may be unrelated to the launched Job.
+  if (!target.podPool) return unknown('pod-pool-unset');
+  let members: ReturnType<typeof parsePodPool>;
+  try { members = parsePodPool(target.podPool); }
+  catch { return unknown('pod-pool-unreadable'); }
+  if (!members.length) return unknown('pod-pool-empty');
+  let maximum = 0;
+  let unreadable = false;
+  for (const member of members) {
+    let result: ReturnType<SshRunner>;
+    try { result = ssh(target.host, `kubectl --context ${shellQuote(member.context)} get nodes -o json`, 15_000); }
+    catch { unreadable = true; continue; }
+    if (result.status !== 0) { unreadable = true; continue; }
+    try {
+      const parsed = JSON.parse(result.stdout) as { items?: Array<{ status?: { allocatable?: { memory?: unknown } } }> };
+      if (!Array.isArray(parsed.items) || parsed.items.length === 0) { unreadable = true; continue; }
+      for (const node of parsed.items) {
+        const raw = node?.status?.allocatable?.memory;
+        const bytes = typeof raw === 'string' ? memoryQuantityBytes(raw) : null;
+        if (bytes === null || bytes <= 0) { unreadable = true; continue; }
+        maximum = Math.max(maximum, bytes);
+      }
+    } catch { unreadable = true; }
+  }
+  if (maximum >= requiredBytes) return { state: 'fits', memoryLimit, requiredBytes, allocatableBytes: maximum, reason: 'node-allocatable-fits' };
+  if (unreadable || maximum === 0) return unknown('node-allocatable-unmeasured', maximum || null);
+  return { state: 'never-fits', memoryLimit, requiredBytes, allocatableBytes: maximum, reason: 'memory-never-fits' };
+}
+
 const CAPACITY_MARKER = '__ELANOUS_PARENT_CAPACITY__';
 const APPROVAL_MARKER = '__ELANOUS_PARENT_APPROVALS__';
 const LOAD_MARKER = '__ELANOUS_PARENT_LOAD__';
@@ -159,7 +211,9 @@ export function remoteLaunchScript(target: ParentHostConfig, args: readonly stri
   const elanous = target.elanous ?? DEFAULT_REMOTE_ELANOUS;
   const configDir = target.configDir ?? DEFAULT_REMOTE_CONFIG_DIR;
   const log = remoteParentLogPath(target, env.ELANOUS_RUN_ID ?? 'unknown');
-  const envPart = [...Object.entries(env).filter(([key]) => key !== 'ELANOUS_STATE_DIR' && /^[A-Z_][A-Z0-9_]*$/.test(key)).map(([key, value]) => `${key}=${shellQuote(value)}`), `ELANOUS_STATE_DIR=${remotePath(configDir)}`].join(' ');
+  // --config-dir keeps the parent's operational config/state; authStorePath()
+  // reads XDG_CONFIG_HOME/elanous/auth.json first, as the entrypoint test proves.
+  const envPart = [...Object.entries(env).filter(([key]) => key !== 'ELANOUS_STATE_DIR' && /^[A-Z_][A-Z0-9_]*$/.test(key)).map(([key, value]) => `${key}=${key === 'XDG_CONFIG_HOME' || key === 'CODEX_HOME' || key === 'GH_CONFIG_DIR' ? remotePath(value) : shellQuote(value)}`), `ELANOUS_STATE_DIR=${remotePath(configDir)}`].join(' ');
   const argv = [remotePath(elanous), '--config-dir', remotePath(configDir), ...remoteParentArgs(args, target.podPool).map(shellQuote)].join(' ');
   // 준비가 실패하면 «확실히 안 띄웠다»(not-launched=…)를 찍고 끝낸다 — 그때만 호출부가 로컬로 돌아간다.
   // 띄운 뒤에는 짧게 살아 있는지 보고 pid 를 찍는다(조기 종료면 early-exit — 역시 «안 돈다»가 확실).
@@ -170,10 +224,12 @@ export function remoteLaunchScript(target: ParentHostConfig, args: readonly stri
 }
 
 /** ssh 실행기(시험 주입). */
-export type SshRunner = (host: string, script: string, timeoutMs: number) => { status: number | null; stdout: string; stderr: string };
+export type SshRunner = (host: string, script: string, timeoutMs: number, stdin?: string) => { status: number | null; stdout: string; stderr: string };
 
-export const defaultSshRunner: SshRunner = (host, script, timeoutMs) => {
-  const result = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=8', '-o', 'ControlPath=none', host, script], { encoding: 'utf8', timeout: timeoutMs, maxBuffer: 32 * 1024 * 1024 });
+export const defaultSshRunner: SshRunner = (host, script, timeoutMs, stdin) => {
+  const result = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=8', '-o', 'ControlPath=none', host, script], {
+    encoding: 'utf8', timeout: timeoutMs, maxBuffer: 32 * 1024 * 1024, ...(stdin !== undefined ? { input: stdin } : {}),
+  });
   return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? (result.error ? String(result.error) : '') };
 };
 
@@ -289,8 +345,27 @@ export class RemoteParentNotLaunchedError extends Error {
  * 그 밖(ssh 끊김·시간 초과·알 수 없는 답)은 «떴는지 모른다» — 일반 Error 로 던져 카드가 launch-failed 로 남게 한다
  * (⛔ 로컬로 또 띄우면 원격에 이미 뜬 부모와 중복이 될 수 있다).
  */
-export function launchRemoteParent(target: ParentHostConfig, args: readonly string[], env: Record<string, string>, ssh: SshRunner = defaultSshRunner): { pid: number; log: string } {
-  const result = ssh(target.host, remoteLaunchScript(target, args, env), 30_000);
+export function launchRemoteParent(
+  target: ParentHostConfig,
+  args: readonly string[],
+  env: Record<string, string>,
+  ssh: SshRunner = defaultSshRunner,
+  grokMirrorResolver: () => OwnerGrokAccessMirror = resolveOwnerGrokAccessMirror,
+  effectiveChildProvider?: string,
+  now: () => number = Date.now,
+): { pid: number; log: string } {
+  const argvProvider = childProviderFromArgs(args);
+  if (effectiveChildProvider && argvProvider && argvProvider !== effectiveChildProvider) {
+    throw new Error(`effective child provider mismatch (context=${effectiveChildProvider}, argv=${argvProvider})`);
+  }
+  const launchArgs = effectiveChildProvider && !argvProvider
+    ? [...args.slice(0, 2), '--child-llm-provider', effectiveChildProvider, ...args.slice(2)]
+    : args;
+  if ((effectiveChildProvider ?? argvProvider) === 'grok') {
+    const mirror = grokMirrorResolver();
+    installRemoteGrokAccess(target, mirror, ssh, now);
+  }
+  const result = ssh(target.host, remoteLaunchScript(target, launchArgs, env), 30_000);
   const log = remoteParentLogPath(target, env.ELANOUS_RUN_ID ?? 'unknown');
   const pid = Number(/^pid=(\d+)$/m.exec(result.stdout)?.[1]);
   if (result.status === 0 && Number.isSafeInteger(pid) && pid > 0) return { pid, log };
@@ -302,6 +377,141 @@ export function launchRemoteParent(target: ParentHostConfig, args: readonly stri
   throw new Error(`원격 부모 발사 결과 불확실(${target.host} · rc=${result.status}) — 중복을 피해 로컬로 다시 띄우지 않는다 · 원격에서 ELANOUS_RUN_ID=${env.ELANOUS_RUN_ID ?? '?'} 를 확인: ${(result.stderr.trim().split('\n').pop() || '').slice(0, 160)}`);
 }
 
+/** The provider selection travels as an argv pair or assignment; absent remains the existing Codex default. */
+function childProviderFromArgs(args: readonly string[]): string | undefined {
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]!;
+    if (arg === '--child-llm-provider') return args[i + 1];
+    if (arg.startsWith('--child-llm-provider=')) return arg.slice('--child-llm-provider='.length);
+  }
+  return undefined;
+}
+
+export interface OwnerGrokAccessMirror { key: string; expiresAt: string }
+
+/** Resolve/refresh on HQ and return only a still-usable subscription access token. */
+export function resolveOwnerGrokAccessMirror(opts: {
+  home?: string;
+  env?: NodeJS.ProcessEnv;
+  now?: () => number;
+  execImpl?: (cmd: string, args: string[], timeoutMs: number) => void;
+} = {}): OwnerGrokAccessMirror {
+  const credential = resolveFreshGrokCredential({
+    ...(opts.home ? { home: opts.home } : {}),
+    ...(opts.env ? { env: opts.env } : {}),
+    ...(opts.now ? { now: opts.now } : {}),
+    ...(opts.execImpl ? { execImpl: opts.execImpl } : {}),
+  });
+  if (!credential || credential.kind !== 'subscription') throw new Error('Grok subscription mirror unavailable: no-usable-subscription');
+  // Expiry travels with the selected credential so a second auth-file read cannot pair another scope's
+  // expiry with this access token if the file changes between reads.
+  if (!credential.expiresAt) throw new Error('Grok subscription mirror unavailable: access-state-incomplete');
+  const expiresAt = Date.parse(credential.expiresAt);
+  // Keep the same two-minute safety margin that triggers HQ refresh before remote installation.
+  if (!Number.isFinite(expiresAt) || expiresAt <= (opts.now ?? Date.now)() + 120_000) {
+    throw new Error('Grok subscription mirror unavailable: expired-or-refresh-did-not-produce-fresh-access');
+  }
+  return { key: credential.token, expiresAt: credential.expiresAt };
+}
+
+/** Install one HQ-selected Grok access token over SSH stdin; never copy refresh or other scopes. */
+export function installRemoteGrokAccess(
+  target: ParentHostConfig,
+  mirror: OwnerGrokAccessMirror,
+  ssh: SshRunner = defaultSshRunner,
+  now: () => number = Date.now,
+): void {
+  if (!mirror || typeof mirror.key !== 'string' || !mirror.key || typeof mirror.expiresAt !== 'string'
+    || !Number.isFinite(Date.parse(mirror.expiresAt)) || Date.parse(mirror.expiresAt) <= now() + 120_000) {
+    throw new Error('invalid Grok access mirror');
+  }
+  const payload = JSON.stringify({ key: mirror.key, expires_at: mirror.expiresAt });
+  const code = [
+    'const fs=require("node:fs"),path=require("node:path"),os=require("node:os");',
+    'const p=JSON.parse(fs.readFileSync(0,"utf8"));if(!p||typeof p.key!=="string"||!p.key||typeof p.expires_at!=="string"||!Number.isFinite(Date.parse(p.expires_at))||Date.parse(p.expires_at)<=Date.now()+120000||Object.keys(p).some(k=>!new Set(["key","expires_at"]).has(k)))process.exit(2);',
+    'const dir=path.join(os.homedir(),".grok"),file=path.join(dir,"auth.json"),temp=file+"."+process.pid+".tmp";fs.mkdirSync(dir,{recursive:true,mode:0o700});fs.chmodSync(dir,0o700);',
+    'try{let auth={};try{const prior=JSON.parse(fs.readFileSync(file,"utf8"));if(!prior||typeof prior!=="object"||Array.isArray(prior))process.exit(3);auth=prior}catch(e){if(e.code!=="ENOENT")throw e}auth["https://auth.x.ai::hq-mirror"]={key:p.key,expires_at:p.expires_at};fs.writeFileSync(temp,JSON.stringify(auth),{mode:0o600});fs.chmodSync(temp,0o600);fs.renameSync(temp,file)}catch(e){try{fs.unlinkSync(temp)}catch{};throw e}',
+  ].join('');
+  const result = ssh(target.host, `umask 077; bun -e ${shellQuote(code)}`, 20_000, payload);
+  if (result.status !== 0) throw new Error(`remote Grok access mirror failed (ssh rc=${result.status ?? 'unknown'})`);
+}
+
+/** Install access-only Codex copies over SSH stdin; credentials never enter argv, shell text, or logs. */
+export function installRemoteCodexAccess(target: ParentHostConfig, mirror: { elanousAuth: string; codexAuth: string; account?: string }, ssh: SshRunner = defaultSshRunner): void {
+  let elanous: { version?: number; providers?: Record<string, Record<string, unknown>> };
+  let codex: { auth_mode?: string; tokens?: Record<string, unknown> };
+  try {
+    elanous = JSON.parse(mirror.elanousAuth) as typeof elanous;
+    codex = JSON.parse(mirror.codexAuth) as typeof codex;
+  } catch { throw new Error('invalid local Codex access mirror'); }
+  const provider = elanous.providers?.['openai-codex'];
+  const elanousTokens = provider?.tokens as Record<string, unknown> | undefined;
+  const codexTokens = codex.tokens;
+  if (!Number.isSafeInteger(elanous.version) || Number(elanous.version) < 1
+    || typeof elanousTokens?.accessToken !== 'string' || !elanousTokens.accessToken || elanousTokens.refreshToken !== '' || elanousTokens.refresh_token !== ''
+    || codex.auth_mode !== 'chatgpt'
+    || typeof codexTokens?.access_token !== 'string' || !codexTokens.access_token || codexTokens.refresh_token !== '' || codexTokens.refreshToken !== '')
+    throw new Error('Codex access mirror must contain a versioned store, auth mode, access tokens, and empty refresh tokens');
+
+  const account = mirror.account ?? 'default';
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(account)) throw new Error('invalid Codex mirror account name');
+
+  const payload = JSON.stringify({ elanousVersion: elanous.version, provider, codexAuth: codex, account, storeKey: account === 'default' ? 'openai-codex' : `openai-codex:${account}` });
+  const configDir = remotePath(target.configDir ?? DEFAULT_REMOTE_CONFIG_DIR);
+  // HQ owns token metadata; the remote keeps only the selected named Codex credential in managed account homes.
+  const code = [
+    'const fs=require("node:fs"),path=require("node:path"),os=require("node:os");',
+    'const payload=JSON.parse(fs.readFileSync(0,"utf8"));',
+    'const read=(file)=>{try{return JSON.parse(fs.readFileSync(file,"utf8"))}catch{return {}}};',
+    'const write=(file,value)=>{const temp=file+"."+process.pid+".tmp";try{fs.writeFileSync(temp,JSON.stringify(value),{mode:0o600});fs.chmodSync(temp,0o600);fs.renameSync(temp,file)}catch(error){try{fs.unlinkSync(temp)}catch{};throw error}};',
+    'const elanousFile=path.join(process.argv[1],"auth.json"),configDir=path.dirname(elanousFile);fs.mkdirSync(configDir,{recursive:true,mode:0o700});',
+    'const elanous=read(elanousFile);if(typeof elanous.version!=="number")elanous.version=payload.elanousVersion;elanous.providers={...(elanous.providers||{})};const defaultHome=path.join(os.homedir(),".codex"),managedAccounts=path.join(configDir,"codex-accounts");for(const key of Object.keys(elanous.providers)){if(key.startsWith("openai-codex:"))delete elanous.providers[key]}fs.rmSync(managedAccounts,{recursive:true,force:true});fs.rmSync(path.join(configDir,"remote-codex-mirror.json"),{force:true});',
+    'const accountHome=payload.account==="default"?defaultHome:path.join(configDir,"codex-accounts",payload.account),tokens={...(payload.provider.tokens||{}),refreshToken:"",refresh_token:""};const upsert=(key,codexHome)=>{const current=elanous.providers[key]||{};elanous.providers[key]={...current,...payload.provider,codexHome,chatGPT:{...(current.chatGPT||{}),...(payload.provider.chatGPT||{})},tokens}};upsert("openai-codex",defaultHome);if(payload.storeKey!=="openai-codex")upsert(payload.storeKey,accountHome);write(elanousFile,elanous);',
+    'const incoming=payload.codexAuth;const installCodex=(home)=>{const file=path.join(home,"auth.json");fs.mkdirSync(home,{recursive:true,mode:0o700});const current=read(file),merged={...current,...incoming};merged.auth_mode=incoming.auth_mode;if(Object.prototype.hasOwnProperty.call(incoming,"last_refresh"))merged.last_refresh=incoming.last_refresh;else delete merged.last_refresh;merged.tokens={...(incoming.tokens||{}),refresh_token:"",refreshToken:""};write(file,merged)};installCodex(defaultHome);if(accountHome!==defaultHome)installCodex(accountHome);',
+  ].join('');
+  const result = ssh(target.host, `umask 077; mkdir -p ${configDir} "$HOME/.codex" && bun -e ${shellQuote(code)} ${configDir}`, 20_000, payload);
+  if (result.status !== 0) throw new Error(`remote Codex access mirror failed (ssh rc=${result.status ?? 'unknown'})`);
+}
+
+/** Replace the remote Codex account set with one HQ-owned, refresh-free snapshot. */
+export function installRemoteCodexAccessBatch(target: ParentHostConfig, mirrors: readonly { elanousAuth: string; codexAuth: string; account: string }[], ssh: SshRunner = defaultSshRunner): void {
+  if (!mirrors.length) throw new Error('Codex access mirror batch is empty');
+  const seen = new Set<string>();
+  const accounts = mirrors.map((mirror) => {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(mirror.account) || seen.has(mirror.account)) throw new Error('invalid or duplicate Codex mirror account name');
+    seen.add(mirror.account);
+    let elanous: { version?: number; providers?: Record<string, Record<string, unknown>> };
+    let codex: { auth_mode?: string; tokens?: Record<string, unknown> };
+    try { elanous = JSON.parse(mirror.elanousAuth); codex = JSON.parse(mirror.codexAuth); }
+    catch { throw new Error('invalid local Codex access mirror'); }
+    const provider = elanous.providers?.['openai-codex'];
+    const token = provider?.tokens as Record<string, unknown> | undefined;
+    if (!Number.isSafeInteger(elanous.version) || Number(elanous.version) < 1
+      || typeof token?.accessToken !== 'string' || !token.accessToken || token.refreshToken !== '' || token.refresh_token !== ''
+      || codex.auth_mode !== 'chatgpt' || typeof codex.tokens?.access_token !== 'string' || !codex.tokens.access_token
+      || codex.tokens.refresh_token !== '' || codex.tokens.refreshToken !== '')
+      throw new Error('Codex access mirror batch requires access tokens and empty refresh tokens');
+    return { account: mirror.account, provider, codexAuth: codex, version: elanous.version };
+  });
+  const configDir = remotePath(target.configDir ?? DEFAULT_REMOTE_CONFIG_DIR);
+  const code = [
+    'const fs=require("node:fs"),path=require("node:path"),os=require("node:os");',
+    'const items=JSON.parse(fs.readFileSync(0,"utf8"));const dir=process.argv[1],file=path.join(dir,"auth.json"),defaultHome=path.join(dir,"codex-default"),managed=path.join(dir,"codex-accounts");',
+    'const read=(p)=>{try{return JSON.parse(fs.readFileSync(p,"utf8"))}catch{return {}}};',
+    'const write=(p,v)=>{fs.mkdirSync(path.dirname(p),{recursive:true,mode:0o700});const tmp=p+"."+process.pid+".tmp";try{fs.writeFileSync(tmp,JSON.stringify(v),{mode:0o600});fs.chmodSync(tmp,0o600);fs.renameSync(tmp,p)}catch(e){try{fs.unlinkSync(tmp)}catch{};throw e}};',
+    // A remote parent can launch concurrently with another parent. Serialize the
+    // entire auth-store + named-home transition, including stale-home pruning.
+    'const lock=path.join(dir,"remote-codex-mirror.lock"),deadline=Date.now()+15000,sleep=new Int32Array(new SharedArrayBuffer(4));fs.mkdirSync(dir,{recursive:true,mode:0o700});while(true){try{fs.writeFileSync(lock,String(process.pid),{flag:"wx",mode:0o600});break}catch(e){if(e.code!=="EEXIST")throw e;try{if(Date.now()-fs.statSync(lock).mtimeMs>60000)fs.rmSync(lock,{force:true})}catch{}if(Date.now()>=deadline)throw new Error("remote Codex mirror lock timeout");Atomics.wait(sleep,0,0,25)}}try{',
+    'const store=read(file);store.version=typeof store.version==="number"?store.version:items[0].version;store.providers={...(store.providers||{})};for(const key of Object.keys(store.providers)){if(key==="openai-codex"||key.startsWith("openai-codex:"))delete store.providers[key]}',
+    'for(const item of items){const home=item.account==="default"?defaultHome:path.join(managed,item.account),key=item.account==="default"?"openai-codex":"openai-codex:"+item.account;const current=read(path.join(home,"auth.json")),auth={...current,...item.codexAuth,auth_mode:"chatgpt",tokens:{...(item.codexAuth.tokens||{}),refresh_token:"",refreshToken:""}};write(path.join(home,"auth.json"),auth);store.providers[key]={...item.provider,codexHome:home,tokens:{...(item.provider.tokens||{}),refreshToken:"",refresh_token:""}}}',
+    'if(!store.providers["openai-codex"]){const first=items[0],home=path.join(managed,first.account);write(path.join(defaultHome,"auth.json"),{...first.codexAuth,auth_mode:"chatgpt",tokens:{...(first.codexAuth.tokens||{}),refresh_token:"",refreshToken:""}});store.providers["openai-codex"]={...store.providers["openai-codex:"+first.account],codexHome:defaultHome}}',
+    'write(file,store);const keep=new Set(items.filter(x=>x.account!=="default").map(x=>x.account));try{for(const name of fs.readdirSync(managed)){if(!keep.has(name))fs.rmSync(path.join(managed,name),{recursive:true,force:true})}}catch(e){if(e.code!=="ENOENT")throw e}fs.rmSync(path.join(dir,"remote-codex-mirror.json"),{force:true});',
+    '}finally{fs.rmSync(lock,{force:true})}',
+  ].join('');
+  const result = ssh(target.host, `umask 077; mkdir -p ${configDir} "$HOME/.codex" && bun -e ${shellQuote(code)} ${configDir}`, 20_000, JSON.stringify(accounts));
+  if (result.status !== 0) throw new Error(`remote Codex access mirror batch failed (ssh rc=${result.status ?? 'unknown'})`);
+}
+
 // ── 관측: 원격 런 원장 거울 ─────────────────────────────────────────────────────────────
 
 const RUN_ID_RE = /^run-[A-Za-z0-9_-]{4,64}$/;

package/src/task-agent/postland-card.ts

@@ -1,7 +1,8 @@
+import { spawnSync } from 'node:child_process';
 import { debug } from '../debug/log.js';
 import { listChecklist, setItemIfSnapshot, type Checklist } from '../release-loop/checklist.js';
 import { judgeLandedCell, parseJudgeSignals, type GreenVerdict } from '../release-loop/landed-to-green.js';
-import { cardPrNumber, readTaskAgentState, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
+import { HAND_MOVE_HISTORY_EVENT, LIVE_MOVE_HISTORY_EVENT, LIVE_MOVE_RESULT_EVENT, cardPrNumber, readTaskAgentState, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
 import { isGoalOnlyPr } from './judge.js';
 
 export interface LandedTaskPr { number: number; url: string; headRefOid: string; state: string; baseRefName: string; mergedAt: string; files?: Array<{ path: string }> }
@@ -142,3 +143,81 @@ export function closeMergedTaskCard(pr: LandedTaskPr, cwd: string, deps: Postlan
   log('task-agent', 'postland-card-closed', { pr: pr.number, card: card.id, version, id: item.id, outcome: complete ? 'complete' : 'partial', verdict });
   return item.id;
 }
+
+const defaultGit = (cwd: string, args: string[]): { status: number; stdout: string; stderr: string } => {
+  const run = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  return { status: run.status ?? 1, stdout: run.stdout ?? '', stderr: run.stderr ?? '' };
+};
+
+export type HandMergeReconcileOutcome =
+  | { outcome: 'reconciled'; card: string; status: 'landed-by-hand' | 'landed'; pr: number; head: string; mergeSha: string; mergedAt: string }
+  | { outcome: 'not-reconciled'; reason: 'pr-not-merged' | 'no-merge-sha' | 'no-bound-card' | 'ambiguous-card' | 'card-not-failed' | 'not-ancestor-of-main' | 'card-binding-changed-before-write' };
+
+export interface HandMergeReconcileDeps {
+  statePath?: string;
+  mainRef?: string;
+  updateCard?: typeof updateTaskCard;
+  git?: (cwd: string, args: string[]) => { status: number; stdout: string; stderr: string };
+  log?: typeof debug.log;
+}
+
+/**
+ * TA-CARD-MERGE-RECONCILE — 실패 카드에 묶인 PR을 사람이 손수 병합했을 때만 카드를 정산한다.
+ * MERGED + merge SHA가 `${mainRef}`(기본 `origin/main`) 조상일 때 status=landed-by-hand(또는 merge 커밋이
+ * land attempt head와 일치하면 landed)로 `updateTaskCard` 파일-락 트랜잭션 하나로 갱신하고,
+ * 이전 status·사유는 history `hand-move` 줄에 보존한다. OPEN·비조상·묶임 없음은 카드를 그대로 둔다.
+ */
+export function reconcileHandMergedCard(pr: LandedTaskPr & { mergeCommit?: string }, cwd: string, deps: HandMergeReconcileDeps = {}): HandMergeReconcileOutcome {
+  const log = deps.log ?? debug.log.bind(debug);
+  if (pr.state !== 'MERGED' || !pr.url) return { outcome: 'not-reconciled', reason: 'pr-not-merged' };
+  const mergeSha = pr.mergeCommit ?? '';
+  if (!/^[a-f0-9]{40}$/i.test(mergeSha)) return { outcome: 'not-reconciled', reason: 'no-merge-sha' };
+  const path = deps.statePath ?? taskAgentStatePath();
+  const tasks = readTaskAgentState<{ tasks?: Record<string, TaskCard> }>(path).tasks ?? {};
+  const cards = Object.values(tasks).filter((card) => card.taLand && cardPrNumber(card) === pr.number
+    && typeof card.pr === 'object' && card.pr.url?.replace(/\/+$/, '') === pr.url.replace(/\/+$/, ''));
+  if (cards.length !== 1) {
+    log('task-agent', 'postland-card-hand-skipped', { pr: pr.number, reason: cards.length ? 'ambiguous-card' : 'no-bound-card' });
+    return { outcome: 'not-reconciled', reason: cards.length ? 'ambiguous-card' : 'no-bound-card' };
+  }
+  const card = cards[0]!;
+  if (card.status !== 'failed') {
+    log('task-agent', 'postland-card-hand-skipped', { pr: pr.number, card: card.id, reason: 'card-not-failed', status: card.status });
+    return { outcome: 'not-reconciled', reason: 'card-not-failed' };
+  }
+  const mainRef = deps.mainRef ?? 'origin/main';
+  if ((deps.git ?? defaultGit)(cwd, ['merge-base', '--is-ancestor', mergeSha, mainRef]).status !== 0) {
+    log('task-agent', 'postland-card-hand-skipped', { pr: pr.number, card: card.id, reason: 'not-ancestor-of-main', mainRef });
+    return { outcome: 'not-reconciled', reason: 'not-ancestor-of-main' };
+  }
+  const at = new Date().toISOString();
+  let reconciled: { status: 'landed-by-hand' | 'landed' } | undefined;
+  // The card lock keeps the settlement atomic with its binding checks: a card that flipped off
+  // `failed` mid-flight is left untouched for its owning path to finish.
+  (deps.updateCard ?? updateTaskCard)(path, card.id, (current, currentTasks) => {
+    const matching = Object.values(currentTasks).filter((candidate) => candidate.taLand && cardPrNumber(candidate) === pr.number
+      && typeof candidate.pr === 'object' && candidate.pr.url?.replace(/\/+$/, '') === pr.url.replace(/\/+$/, ''));
+    if (matching.length !== 1 || matching[0]?.id !== card.id) return undefined;
+    if (!current || current.status !== 'failed' || cardPrNumber(current) !== pr.number || typeof current.pr !== 'object'
+      || current.pr.url?.replace(/\/+$/, '') !== pr.url.replace(/\/+$/, '')) return undefined;
+    const status = (current.landAttempts ?? []).some((attempt) => attempt.pr === pr.number
+      && attempt.head.toLowerCase() === mergeSha.toLowerCase()) ? 'landed' : 'landed-by-hand';
+    const priorReason = [...current.history].reverse().find((event) => event.event !== LIVE_MOVE_HISTORY_EVENT
+      && event.event !== LIVE_MOVE_RESULT_EVENT && event.event !== HAND_MOVE_HISTORY_EVENT)?.detail ?? '사유 기록 없음';
+    const detail = status === 'landed'
+      ? `PR #${pr.number} 병합 정산: merge ${mergeSha}가 land attempt head와 일치 — status landed; 이전 status: failed; 이전 사유: ${priorReason}`
+      : `PR #${pr.number} 손 병합 정산: merge ${mergeSha}가 ${mainRef} 조상 — status landed-by-hand; 이전 status: failed; 이전 사유: ${priorReason}`;
+    reconciled = { status };
+    return { ...current,
+      status,
+      prTerminal: { pr: pr.number, url: pr.url, head: mergeSha, state: 'MERGED' as const, at },
+      history: [...current.history, { at, event: HAND_MOVE_HISTORY_EVENT, pr: pr.number, head: mergeSha, detail }],
+    };
+  });
+  if (!reconciled) {
+    log('task-agent', 'postland-card-hand-pending', { pr: pr.number, card: card.id, reason: 'card-binding-changed-before-write' });
+    return { outcome: 'not-reconciled', reason: 'card-binding-changed-before-write' };
+  }
+  log('task-agent', 'postland-card-hand-reconciled', { pr: pr.number, card: card.id, status: reconciled.status, mergeSha, mainRef });
+  return { outcome: 'reconciled', card: card.id, status: reconciled.status, pr: pr.number, head: pr.headRefOid, mergeSha, mergedAt: pr.mergedAt };
+}

package/src/task-agent/rejudge-on-head.ts

@@ -29,10 +29,13 @@
  * - 관측: `task-agent` · `rejudge-on-head {card, pr, fromHead, toHead, step, decision, reason}` — 수가 난 판단은 카드 history 에도
  *   한 줄(`event:'rejudge-on-head'` · 같은 머리·같은 단계·같은 판단은 한 번).
  */
-import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { closeSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
 import { spawn, spawnSync } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
+import { planPrLandRecovery, type PrLandRecoveryPlan } from '../cli/pr-land-recovery.js';
+import { lastJsonObject, runGraph } from '../graph-runner/runner.js';
 import { debug } from '../debug/log.js';
 import { prodInstanceRoot } from '../instance/resolve.js';
 import { getUserConfig } from '../user-config.js';
@@ -44,7 +47,7 @@ import { recordLiveMoveHistory } from './live-move-history.js';
 import { runRepairCycle, type RepairLaunchRequest } from './repair-cycle.js';
 import { repairMustFixFromReview, repairReviewDigest } from './repair-review.js';
 import type { RepairCasOutcome, RepairCasRequest } from './repair-branch-cas.js';
-import { defaultLandPrHead, defaultPrHead, defaultReviewRepoCandidates, executeLiveLand, executeLiveReview, landRetryPending, type LiveMoveDeps, type LiveMoveResult, type PrHeadView, type ReviewRepoCandidate, type TaskAgentLiveMove } from './live-moves.js';
+import { configuredMsb1Worker, defaultLandPrHead, defaultPrHead, defaultReviewRepoCandidates, executeLiveLand, executeLiveReview, landRetryPending, remoteTaWorkerCommand, type LiveMoveDeps, type LiveMoveResult, type PrHeadView, type ReviewRepoCandidate, type TaskAgentLiveMove } from './live-moves.js';
 import { capturedLandReview, captureReviewResults, parseReviewResultOutput, pendingReviewResults, reviewResultPath, type ParsedReviewResult } from './review-result-capture.js';
 import { boundPrTerminal, cardPrNumber, LIVE_MOVE_RESULT_EVENT, readTaskCard, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
 import { verifiedTrainLanding, type TrainLanding } from './train-landing.js';
@@ -98,6 +101,10 @@ export interface RejudgeDeps {
   notifyRepair?: (seat: string, body: string) => void;
   /** Shared new-launch budget for this `tasks rejudge --all` call. */
   repairBudget?: import('./repair-cycle.js').RepairTickBudget;
+  /** One review request across all candidates in one --all tick; standalone card rejudge is uncapped. */
+  reviewBudget?: { max: number; requested: number };
+  /** One land or queue attempt across all candidates in one --all tick. */
+  landBudget?: { max: number; requested: number };
   /** TA-REJUDGE-REBASE-LOOP — origin/main 을 PR 가지에 3-way merge 하고 일반 push. 시험은 주입한다. */
   catchUpMain?: (request: CatchUpRequest) => Promise<CatchUpResult>;
   log?: (category: string, event: string, data: Record<string, unknown>) => void;
@@ -265,12 +272,28 @@ export function regateRunArgs(entry: string, configDir: string, request: RegateR
   return [entry, '--config-dir', configDir, 'tasks', 'regate-run', '--card', request.card, '--pr', String(request.pr), '--head', request.head, '--repo', request.repoRoot, '--out', request.resultPath];
 }
 
-export async function defaultRequestRegate(request: RegateRequest, opts: { spawn?: DetachedSpawn; entry?: string; configDir?: string } = {}): Promise<void> {
+export async function defaultRequestRegate(request: RegateRequest, opts: { spawn?: DetachedSpawn; entry?: string; configDir?: string; remote?: import('./parent-host.js').ParentHostConfig | null } = {}): Promise<void> {
   const { spawnDetachedConfirmed, ELANOUS_CLI_ENTRY } = await import('../cli/tasks-cli.js');
   const { getElanousConfigDirOverride } = await import('../elanous-config-dir.js');
   const { effectiveInstanceRoot } = await import('../instance/resolve.js');
   const configDir = opts.configDir ?? getElanousConfigDirOverride() ?? effectiveInstanceRoot();
-  await spawnDetachedConfirmed(opts.spawn ?? (spawn as unknown as DetachedSpawn), process.execPath, regateRunArgs(opts.entry ?? ELANOUS_CLI_ENTRY, configDir, request), undefined, request.repoRoot);
+  const base = opts.spawn ?? (spawn as unknown as DetachedSpawn);
+  const remote = opts.remote === undefined ? (opts.spawn ? null : configuredMsb1Worker()) : opts.remote;
+  if (!remote) {
+    await spawnDetachedConfirmed(base, process.execPath, regateRunArgs(opts.entry ?? ELANOUS_CLI_ENTRY, configDir, request), undefined, request.repoRoot);
+    return;
+  }
+  // The remote worker writes its own result, then SSH carries only that JSON into the HQ result path.
+  const remoteResult = `/tmp/elanous-ta-regate-${randomUUID()}.json`;
+  const script = `${remoteTaWorkerCommand(remote, ['tasks', 'regate-run', '--card', request.card, '--pr', String(request.pr),
+    '--head', request.head, '--repo', remote.cwd, '--out', remoteResult])} >/dev/null; rc=$?; cat '${remoteResult}'; rm -f '${remoteResult}'; exit $rc`;
+  mkdirSync(dirname(request.resultPath), { recursive: true });
+  const fd = openSync(request.resultPath, 'w');
+  const toFile: DetachedSpawn = (command, args, options) =>
+    (base as unknown as (c: string, a: string[], o: unknown) => ReturnType<DetachedSpawn>)(command, args, { ...options, stdio: ['ignore', fd, 'ignore'] });
+  try {
+    await spawnDetachedConfirmed(toFile, 'ssh', ['-T', '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=5', remote.host, script]);
+  } finally { closeSync(fd); }
 }
 
 /** 재게이트 결과 파일 — `tasks regate-run` 이 쓴다. */
@@ -513,6 +536,19 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
   }
   const step = (s: RejudgeStep, decision: string, reason: string, record: boolean, extra: Partial<RejudgeOutcome> = {}) =>
     emit({ card: card!.id, pr, fromHead, toHead, step: s, decision, reason, ...extra }, record);
+  const requestReview = async (candidate: TaskCard, reason: string, forceNewReview = false): Promise<void> => {
+    const budget = deps.reviewBudget;
+    if (budget && budget.requested >= budget.max) {
+      step('review', 'tick-cap', `review request cap ${budget.max} reached — next tick`, false);
+      return;
+    }
+    // Reserve before awaiting the worker so another candidate cannot launch a second request.
+    if (budget) budget.requested++;
+    const before = { reviewRequests: candidate.reviewRequests, landAttempts: candidate.landAttempts };
+    const result = await executeLiveReview(candidate, pr, { runId: candidate.runId ?? null, stopReason: reason, cwd, forceNewReview }, { ...live, ...(deps.log ? { log: deps.log } : {}) });
+    recordMove(statePath, candidate.id, candidate.runId, 'review', result, pr, before, now, deps.log);
+    step('review', result.executed ? 'review-requested' : 'review-request-failed', result.detail, true);
+  };
 
   // Adoption is a first judgement for the current head, even when the implementation run
   // already asked for a review. A captured failure needs repair; an accepted result must
@@ -526,10 +562,7 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
     } else if (!deps.liveMoves.has('review')) {
       step('review', 'would-review', 'adopted PR first judgement · review not enabled in HQ taskAgent.liveMoves — shadow', false);
     } else {
-      const before = { reviewRequests: card.reviewRequests, landAttempts: card.landAttempts };
-      const result = await executeLiveReview(card, pr, { runId: card.runId ?? null, stopReason: 'adopted-pr-first-judgement', cwd }, { ...live, ...(deps.log ? { log: deps.log } : {}) });
-      recordMove(statePath, card.id, card.runId, 'review', result, pr, before, now, deps.log);
-      step('review', result.executed ? 'review-requested' : 'review-request-failed', result.detail, true);
+      await requestReview(card, 'adopted-pr-first-judgement');
     }
     return outcomes;
   }
@@ -618,12 +651,7 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
 
   if (!reviews.length) {
     if (!deps.liveMoves.has('review')) step('review', 'would-review', 'remote run terminal proven · review not enabled in HQ taskAgent.liveMoves — shadow', false);
-    else {
-      const before = { reviewRequests: card.reviewRequests, landAttempts: card.landAttempts };
-      const result = await executeLiveReview(card, pr, { runId: card.runId ?? null, stopReason: 'remote-run-terminal', cwd }, { ...live, ...(deps.log ? { log: deps.log } : {}) });
-      recordMove(statePath, card.id, card.runId, 'review', result, pr, before, now, deps.log);
-      step('review', result.executed ? 'review-requested' : 'review-request-failed', result.detail, true);
-    }
+    else await requestReview(card, 'remote-run-terminal');
     return outcomes;
   }
 
@@ -642,10 +670,7 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
       if (pendingReviewResults(latest).some((entry) => entry.pr === pr && sameHead(entry.head, toHead))) {
         step('review', 'awaiting-review-result', 'exact-head review result pending', false);
       } else if (!latest.reviewRequests?.some((entry) => entry.pr === pr && sameHead(entry.head, toHead)) && deps.liveMoves.has('review')) {
-        const before = { reviewRequests: latest.reviewRequests, landAttempts: latest.landAttempts };
-        const result = await executeLiveReview(latest, pr, { runId: latest.runId ?? null, stopReason: 'queue-exact-head', cwd }, { ...live, ...(deps.log ? { log: deps.log } : {}) });
-        recordMove(statePath, latest.id, latest.runId, 'review', result, pr, before, now, deps.log);
-        step('review', result.executed ? 'review-requested' : 'review-request-failed', result.detail, true);
+        await requestReview(latest, 'queue-exact-head');
       } else step('review', 'not-landing', 'exact-head PASS/WARN mf0 review not captured', true);
       return outcomes;
     }
@@ -654,8 +679,13 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
     const reviewResult = latest.reviewRequests?.find((entry) => entry.pr === pr && sameHead(entry.head, toHead) && entry.resultPath)?.resultPath;
     if (!reviewResult) { step('land', 'not-landing', 'exact-head review JSON path missing', true); return outcomes; }
     const before = { reviewRequests: latest.reviewRequests, landAttempts: latest.landAttempts };
+    if (deps.landBudget && deps.landBudget.requested >= deps.landBudget.max) {
+      step('land', 'tick-cap', `land attempt cap ${deps.landBudget.max} reached — next tick`, false);
+      return outcomes;
+    }
     const queued = await executeLiveLand(latest, pr, { runId: latest.runId ?? null, cycleId: `queue:${latest.id}:${toHead}`, cwd,
       review, reviewResultPath: reviewResult }, { ...live, landQueueConfig: queueMode, ...(deps.log ? { log: deps.log } : {}) });
+    if (deps.landBudget && queued.executed) deps.landBudget.requested++;
     recordMove(statePath, latest.id, latest.runId, 'propose-land', queued, pr, before, now, deps.log);
     step('land', queued.queued ? 'queued' : queued.ok && !queued.executed ? 'queue-skipped' : 'queue-refused', queued.detail, true);
     return outcomes;
@@ -778,12 +808,7 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
   // ② 리뷰 — 지금 머리로 요청한 적이 없으면 다시(같은 머리는 한 번 · 상한은 ① 의 머리 수가 이미 막았다).
   if (!reviews.some((entry) => sameHead(entry.head, toHead))) {
     if (!deps.liveMoves.has('review')) step('review', 'would-review', 'review not enabled in taskAgent.liveMoves — shadow', false);
-    else {
-      const before = { reviewRequests: card.reviewRequests, landAttempts: card.landAttempts };
-      const result = await executeLiveReview(card, pr, { runId: card.runId ?? null, stopReason: 'rejudge-on-head', cwd }, { ...live, ...(deps.log ? { log: deps.log } : {}) });
-      recordMove(statePath, card.id, card.runId, 'review', result, pr, before, now, deps.log);
-      step('review', result.executed ? 'review-requested' : 'review-request-failed', result.detail, true);
-    }
+    else await requestReview(card, 'rejudge-on-head');
     return outcomes;
   }
   const latest = readTaskCard(card.id, statePath) ?? card;
@@ -828,10 +853,15 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
     return outcomes;
   }
   const before = { reviewRequests: latest.reviewRequests, landAttempts: latest.landAttempts };
+  if (deps.landBudget && deps.landBudget.requested >= deps.landBudget.max) {
+    step('land', 'tick-cap', `land attempt cap ${deps.landBudget.max} reached — next tick`, false);
+    return outcomes;
+  }
   // 주기 id — base-stale 재게이트 뒤의 land 는 새 base 를 붙여 앞 land 의 주기 표시(모듈 전역)와 갈린다 · gateAt 이 앞 base-stale 시도를 소비한다.
   const cycleId = `rejudge:${card.id}:${toHead}${regate.staleBase ? `:${regate.baseCommit.slice(0, 12)}` : ''}`;
   const landed = await executeLiveLand(latest, pr, { runId: card.runId ?? null, cycleId, cwd, review, reviewResultPath: reviewResult, overlapEvidence, gateAt: regate.at },
     { ...live, ...(deps.log ? { log: deps.log } : {}) });
+  if (deps.landBudget && landed.executed) deps.landBudget.requested++;
   // LAND-ORDER-LEDGER — executeLiveLand 직후 원장 한 줄(같은 pr+head 는 한 줄만). 쓰기가 실패해도 land 결과는 그대로(삼킨다).
   const landOrderLog = (event: 'appended' | 'append-failed') => { try { log('task-agent.land-order', event, { pr, head: toHead }); } catch { /* fail-soft */ } };
   try {
@@ -844,6 +874,38 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
     landOrderLog('append-failed');
   }
   recordMove(statePath, card.id, card.runId, 'propose-land', landed, pr, before, now, deps.log);
+  if (landed.executed && !landed.ok && /^✗/.test(landed.detail)) {
+    const context = { refusal: landed.detail, pr, head: toHead };
+    const preliminary = planPrLandRecovery(context);
+    if (preliminary.result.action === 'request-review' || preliminary.result.action === 'wait-retry') {
+      const entry = preliminary.result.action;
+      try {
+        const graphPath = entry === 'request-review' ? '../../graphs/units/task-agent-recover-review.yaml' : '../../graphs/units/task-agent-recover-wait.yaml';
+        const graph = await runGraph(join(import.meta.dir, graphPath), {
+          input: { ask: `TA land refusal for PR #${pr}`, context, prior: {} },
+          pinChildUniverse: true,
+          deps: { root: dirname(statePath) },
+        });
+        const output = lastJsonObject(graph.nodes.find((node) => node.nodeId === 'recover')?.output);
+        const plan = graph.status === 'done' && graph.unitCalls?.[0]?.entry === entry
+          && graph.unitCalls[0].exit === 'rework' ? output as unknown as PrLandRecoveryPlan | undefined : undefined;
+        const action = plan?.result?.action;
+        const matched = plan?.outcome === 'rework' && plan.result.pr === pr && plan.result.head === toHead
+          && action === preliminary.result.action && plan.evidence?.refusal === context.refusal.slice(0, 500)
+          && (action !== 'wait-retry' || plan.result.delayMs === 30_000);
+        if (!matched) step('land', 'recover-untrusted', `recover@1 ${entry} produced no pinned matching action`, true);
+        else if (action === 'request-review' && deps.liveMoves.has('review')) {
+          await requestReview(readTaskCard(card.id, statePath) ?? card, 'land-refusal-review-missing', true);
+        } else if (action === 'request-review') {
+          step('review', 'recover-review-disabled', 'recover@1 selected review but taskAgent.liveMoves excludes review', true);
+        } else if (action === 'wait-retry') {
+          step('land', 'recover-wait-retry', `recover@1 ${entry} selected existing retry admission after ${plan.result.delayMs}ms`, true);
+        } else step('land', 'recover-needs-human', `recover@1 ${entry}: ${plan.result.reason}`, true);
+      } catch (error) {
+        step('land', 'recover-failed', `recover@1 ${entry}: ${String(error).slice(0, 200)}`, true);
+      }
+    }
+  }
   // TA-LAND-RETRY-ON-INFRA — 실패한 시도는 갈래·사유·재시도 여부를 사유 줄에 싣는다(다음 틱이 왜 다시 하는지/안 하는지).
   const attempt = landed.landAttempt?.class
     ? ` · land-class ${landed.landAttempt.class} (${landed.landAttempt.reason}) · attempt ${landed.landAttempt.attempt} · ${landed.landAttempt.class === 'base-stale' ? 'base-stale → re-gate on a new base next tick (cap counts)' : landed.landAttempt.retryAllowed ? 'retry allowed on this head' : 'no retry on this head'}`
@@ -862,11 +924,35 @@ function recordMove(statePath: string, cardId: string, runId: string | undefined
 }
 
 /** 재판정 대상 카드 — 기존 리뷰 또는 HQ 가 종결 원장을 검증할 원격 부모 카드. */
-export function rejudgeCandidates(tasks: Readonly<Record<string, TaskCard>>): string[] {
+export function rejudgeCandidates(tasks: Readonly<Record<string, TaskCard>>, opts: {
+  now?: Date; maxAgeHours?: number; onAgeSkip?: (card: TaskCard, ageHours: number | null) => void;
+  /** Fresh remote PR heads; mf0 only gets priority when it matches this head. */
+  currentHeads?: ReadonlyMap<string, string>;
+} = {}): string[] {
+  const now = opts.now?.getTime() ?? Date.now();
+  const maxAgeHours = opts.maxAgeHours;
   return Object.values(tasks).filter((card) => {
     const pr = cardPrNumber(card);
-    return pr !== undefined && !boundPrTerminal(card) && ((card.reviewRequests ?? []).some((entry) => entry.pr === pr)
+    const eligible = pr !== undefined && !boundPrTerminal(card) && ((card.reviewRequests ?? []).some((entry) => entry.pr === pr)
       || (card.status === 'launched' && card.taLand === true && ((!!card.parentHost && !!card.runId && !!card.runChildId)
         || (card.adoptedPr?.pr === pr && typeof card.pr === 'object' && !!card.pr.url && sameUrl(card.adoptedPr.url, card.pr.url)))));
+    if (!eligible) return false;
+    if (maxAgeHours !== undefined) {
+      const created = Date.parse(card.createdAt);
+      const ageHours = Number.isFinite(created) ? Math.max(0, (now - created) / 3_600_000) : null;
+      if (ageHours === null || ageHours > maxAgeHours) { opts.onAgeSkip?.(card, ageHours); return false; }
+    }
+    return true;
+  }).sort((a, b) => {
+    const hasMf0 = (card: TaskCard): number => {
+      const pr = cardPrNumber(card);
+      const head = card.reviewRequests?.filter((entry) => entry.pr === pr).at(-1)?.head;
+      const currentHead = opts.currentHeads?.get(card.id);
+      return pr !== undefined && head && currentHead?.toLowerCase() === head.toLowerCase()
+        && capturedLandReview(card, pr, head)?.mustFixCount === 0 ? 1 : 0;
+    };
+    const ageOrder = (Number.isFinite(Date.parse(b.createdAt)) ? Date.parse(b.createdAt) : 0)
+      - (Number.isFinite(Date.parse(a.createdAt)) ? Date.parse(a.createdAt) : 0);
+    return hasMf0(b) - hasMf0(a) || ageOrder || a.id.localeCompare(b.id);
   }).map((card) => card.id);
 }