elanous 0.2.32 → 0.2.35

package/src/cli/pod-cli.ts

@@ -2,6 +2,12 @@
 // 산출 경로를 한 줄로 알리고 명령의 종료 코드로 끝난다. `--deadline` 생략 시 기존 Pod Job 상한.
 
 import type { Command } from 'commander';
+import { randomUUID } from 'node:crypto';
+import { hostname } from 'node:os';
+import { basename, join } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { putPodShelfImage, listPodShelfImages, type PodShelfImage } from '../task-orchestrator/surfaces/pod-image-source.js';
+import { defaultRemoteRun } from '../task-orchestrator/surfaces/pod-pool.js';
 import { debug } from '../debug/log.js';
 import { readPodMemoryAdvice } from './pod-memory-advice.js';
 import { getUserConfig } from '../user-config.js';
@@ -28,6 +34,10 @@ export interface PodCliDeps {
   poolSpec?: (explicit?: string) => string | null;
   harnessPool?: () => string | undefined;
   memoryAdvice?: (logsDb?: string) => ReturnType<typeof readPodMemoryAdvice>;
+  shelfConfig?: () => { harness?: { imageCommit?: unknown } };
+  shelfPut?: (ref: string, pool: string) => Promise<PodShelfImage>;
+  shelfList?: (pool: string) => Promise<string[]> | string[];
+  shelfTail?: (artifactsDir: string) => string;
 }
 
 const HELP = `elanous pod run [--pool <스펙>] [--skill <이름,…>] [--llm grok] [--clone] [--deadline <초>] -- <명령…>
@@ -63,6 +73,57 @@ export function registerPodCommands(program: Command, deps: PodCliDeps = {}): vo
   };
   const run = deps.run ?? ((options: RunPodCommandOptions) => runPodCommand(options));
   const pod = program.command('pod').description('Pod 명령 Job — 하니스 없이 명령 하나를 돌리고 산출을 돌려받는다');
+  const shelf = pod.command('shelf').description('임의 PR·SHA·가지의 격리 하니스 이미지와 명령 Job');
+  const shelfPool = (explicit?: string) => {
+    const config = (deps.shelfConfig ?? getUserConfig)();
+    const spec = explicit || process.env.ELANOUS_POD_POOL || ('podPool' in (config.harness ?? {}) ? (config.harness as { podPool?: string }).podPool : undefined) || (config as { pod?: { pool?: string } }).pod?.pool;
+    if (!spec) throw new Error('pod shelf: remote pool is not configured');
+    return spec;
+  };
+  shelf.command('put <ref>').description('ref head 이미지를 빌드하거나 레지스트리 태그 재사용')
+    .option('--pool <spec>', '단일 원격 레지스트리 풀 멤버')
+    .action(async (ref: string, opts: { pool?: string }) => {
+      try {
+        const image = await (deps.shelfPut ?? putPodShelfImage)(ref, shelfPool(opts.pool));
+        io.log(`${image.image} (${image.action})`); io.exit(0);
+      } catch (err) { io.error(err instanceof Error ? err.message : String(err)); io.exit(1); }
+    });
+  shelf.command('ls').description('레지스트리의 커밋 이미지 태그 목록')
+    .option('--pool <spec>', '단일 원격 레지스트리 풀 멤버')
+    .action(async (opts: { pool?: string }) => {
+      try {
+        const images = await (deps.shelfList ?? ((pool) => listPodShelfImages(pool, defaultRemoteRun)))(shelfPool(opts.pool));
+        for (const image of images) io.log(image);
+        io.exit(0);
+      } catch (err) { io.error(err instanceof Error ? err.message : String(err)); io.exit(1); }
+    });
+  shelf.command('run <ref>').description('ref 이미지로 명령 Job 실행 · rc 와 출력 꼬리 반환')
+    .option('--pool <spec>', '단일 원격 레지스트리 풀 멤버')
+    .allowUnknownOption(true).allowExcessArguments(true)
+    .action(async (ref: string, opts: { pool?: string }) => {
+      const argv = process.argv.slice(2);
+      const sep = argv.indexOf('--');
+      const args = sep < 0 ? [] : argv.slice(sep + 1);
+      if (!args.length) { io.error('pod shelf run: `--` 뒤에 명령이 없다'); io.exit(2); return; }
+      try {
+        const pool = shelfPool(opts.pool);
+        const image = await (deps.shelfPut ?? putPodShelfImage)(ref, pool);
+        const seat = process.env.ELANOUS_SEAT?.trim();
+        const actor = seat || process.env.USER?.trim() || process.env.LOGNAME?.trim();
+        if (!actor) throw new Error('pod provenance actor missing: ELANOUS_SEAT or USER/LOGNAME required');
+        const runId = randomUUID();
+        const result = await run({ pool, image: image.image, shelfImage: image.image, imageCommit: image.commit,
+          clone: true, source: { kind: 'commit', sha: image.commit }, command: args, runId, returnLogs: true,
+          provenance: { actorKind: seat ? 'seat' : 'human', actor, character: 'command-runner', launchHost: hostname(),
+            entrance: 'pod-shelf-run', kind: 'command', run: runId, phase: 'exec', requestedAt: new Date().toISOString(), reason: 'unknown', argv: basename(args[0]!) },
+        });
+        io.error(`[pod shelf] image ${result.image ?? image.image} · rc ${result.exitCode} · job ${result.job}`);
+        io.log(result.artifactsDir);
+        const tail = (deps.shelfTail ?? ((dir) => readFileSync(join(dir, 'child.log'), 'utf8')))(result.artifactsDir);
+        io.log(tail.slice(-4096));
+        io.exit(result.exitCode);
+      } catch (err) { io.error(err instanceof Error ? err.message : String(err)); io.exit(1); }
+    });
   pod.command('memory').description('실측 기반 Pod 메모리 권고 (읽기 전용)')
     .command('advise').description('골 종류별 standard 16Gi / high 32Gi 권고와 근거')
     .option('--json', '권고와 측정 근거를 JSON 으로')
@@ -110,7 +171,9 @@ export function registerPodCommands(program: Command, deps: PodCliDeps = {}): vo
         // This explicit observation runs after the admission calculation. A slow or failed external
         // probe can never change recommended/limitedBy or slow the ordinary lease status path.
         const externalGitHub = opts.githubEgress ? Object.fromEntries(members.map((member) => {
-          try { return [member.context, (deps.externalGitHub ?? probePoolGitHub)(member.context, kubectl)]; }
+          try {
+            return [member.context, (deps.externalGitHub ?? probePoolGitHub)(member.context, kubectl)];
+          }
           catch { return [member.context, { externalDns: null, githubHttps: null, measuredAt: null, reason: 'probe failed' }]; }
         })) : undefined;
         const result = { pool: spec, ...measure, accounts, perAccount, ...decision, reserved: host.reserved, waitingJobs,
@@ -132,8 +195,10 @@ export function registerPodCommands(program: Command, deps: PodCliDeps = {}): vo
           }
           io.log(`예약(저작 중) ${host.reserved} · 대기 Job ${waitingJobs ?? '?'} · 실행 ${decision.running ?? '?'}`);
           io.log(`임대 없는 실행 ${decision.unleasedRunning ?? '?'}`);
-          if (externalGitHub) for (const [context, probe] of Object.entries(externalGitHub))
-            io.log(`GitHub 외부망 ${context}: DNS=${probe.externalDns ?? '?'} HTTPS=${probe.githubHttps ?? '?'} 측정=${probe.measuredAt ?? '?'}${probe.reason ? ` · ${probe.reason}` : ''}`);
+          if (externalGitHub) for (const [context, probe] of Object.entries(externalGitHub)) {
+            io.log(`GitHub 외부망 ${context}: DNS=${probe.externalDns ?? '?'} HTTPS=${probe.githubHttps ?? '?'} 측정=${probe.measuredAt ?? '?'}${probe.reason ? ` · ${probe.reason}` : ''}${probe.podName ? ` · Pod=${probe.podName}` : ''}`);
+            if (probe.podLog !== undefined) io.log(`GitHub 탐침 로그 ${probe.podName ?? context}: ${JSON.stringify(probe.podLog)}`);
+          }
           io.log(`capacity: ${decision.capacitySlots ?? '?'} 칸 (상한 ${members.reduce((sum, m) => sum + m.capacity, 0)} − Running ${decision.running ?? '?'} − Pending ${decision.pending ?? '?'}; 권장 수에서 건강한 멤버의 임대 없는 실행 차감)`);
           io.log(`memory: ${decision.memorySlots ?? '?'} 칸 (할당 가능 − Running 하니스 상한 합; 골당 16Gi · 모든 네임스페이스의 노드별 기존 예약을 반영해 배치 가능 ${decision.placeableSlots ?? '?'} 칸)`);
           io.log(`lite: ${decision.liteMemorySlots ?? '?'} 칸 (같은 여유를 lite 골 2Gi 로 센 값 · 관측만 — 권장 수는 위 standard 기준)`);
@@ -186,8 +251,17 @@ export function registerPodCommands(program: Command, deps: PodCliDeps = {}): vo
         debug.log('pod.run', 'clone-without-install', { argv0: commandArgs[0], argv1: commandArgs[1] });
       }
       try {
+        const seat = process.env.ELANOUS_SEAT?.trim();
+        const user = process.env.USER?.trim() || process.env.LOGNAME?.trim();
+        const actor = seat || user;
+        if (!actor) throw new Error('pod provenance actor missing: ELANOUS_SEAT or USER/LOGNAME required');
+        const runId = randomUUID();
         const result = await run({
           command: commandArgs,
+          runId,
+          provenance: { actorKind: seat ? 'seat' : 'human', actor,
+            character: 'command-runner', launchHost: hostname(), entrance: 'pod-run', kind: 'command', run: runId,
+            phase: 'exec', requestedAt: new Date().toISOString(), reason: 'unknown', argv: basename(commandArgs[0] || '') },
           returnLogs: true,
           ...(opts.pool ? { pool: opts.pool } : {}),
           ...(skills.length ? { skills } : {}),

package/src/cli/pr-cli.ts

@@ -30,6 +30,7 @@ import { queryRunningRuns, type RunningRunsResult } from '../self-implement/runn
 import { debug } from '../debug/log.js';
 import { runGitCommand } from '../git-fs/runner.js';
 import {
+  defaultCensusParallelRunner,
   defaultCmdRunner,
   makePrManager,
   resolveDeliverableBase,
@@ -58,10 +59,11 @@ import { branchLineageSlug, findSiblingPrs } from './pr-lineage.js';
 import { parseReleaseNoteSection } from '../release-loop/release-note.js';
 import { landingFreezeMessage } from '../release-loop/landing-freeze.js';
 import { admitLandingMerge } from '../self-implement/frozen-merges.js';
-import { verifyAllSameHeadReviews, verifyAncestorAutoPass, verifyOverlapEvidence, verifyOverlapEvidenceVirtualRebase } from './pr-land-overlap-evidence.js';
+import { resolveOverlapEvidencePath, verifyAllSameHeadReviews, verifyAncestorAutoPass, verifyOverlapEvidence, verifyOverlapEvidenceVirtualRebase } from './pr-land-overlap-evidence.js';
 import type { VerifyOverlapEvidenceInput } from './pr-land-overlap-evidence.js';
 import { verifyVirtualRebasePatch } from './pr-land-virtual-rebase.js';
 import { observeDirectPrLandRefusal, observePrLandRefusal } from './pr-land-refusal.js';
+import { planPrLandRecovery } from './pr-land-recovery.js';
 import { ensurePrLandHeavyRemote, type HeavyRemoteInput, type HeavyRemoteResult } from './pr-land-heavy-remote.js';
 import { readPrBaseNameWithRetry } from './pr-land-base-read.js';
 import { runHeavyOnPodShadow } from './pr-land-pod-shadow.js';
@@ -70,7 +72,7 @@ import { readTaskAgentState, taskAgentStatePath, type TaskCard } from '../task-a
 import { INFLIGHT_REGISTRY_FILE, removeInflightForPr } from '../pr-tool/inflight-registry.js';
 import { PR_LABEL_NAMES } from '../github/pr-labels.js';
 import { enqueueL8ShadowQueue, runL8ShadowQueue, shadowPrNumber, statusL8ShadowQueue, type L8ShadowQueueDeps } from '../self-implement/l8-merge-queue.js';
-import { censusOpenPrs, guardNewPr, parseDiffHunks, readOpenPrs, type Seat } from '../pr-tool/census.js';
+import { censusOpenPrs, guardNewPr, parseDiffHunks, readOpenPrs, sharedCensusDiffCache, type Seat } from '../pr-tool/census.js';
 
 export { branchLineageSlug, findSiblingPrs };
 
@@ -117,6 +119,8 @@ export const PR_LAND_MERGEABLE_UNKNOWN_WAIT_MS = 5_000;
 
 export interface PrLandDeps {
   manager?: PrManager;
+  /** Confirmed merge cleanup; failures are observed and never undo the merge. */
+  onMergedSupersede?: (number: number, cwd: string) => Promise<void>;
   /** 병합 재시도 사이 대기(시험 주입용 · 기본 실제 대기). */
   sleep?: (ms: number) => Promise<void>;
   run?: CmdRunner;
@@ -271,14 +275,14 @@ export async function decideOverlapLanding(input: {
 
 const liveOut = { log: (message: string) => console.log(message), error: (message: string) => console.error(message) };
 
-function runPrLandTypecheckGate(out: { log: (message: string) => void; error: (message: string) => void }, cwd: string = process.cwd()): boolean {
+function runPrLandTypecheckGate(out: { log: (message: string) => void; error: (message: string) => void }, cwd: string): boolean {
   let failed = false;
   const exit = ((code: number): never => {
     failed = code !== 0;
     throw new Error(`ci-typecheck-changed exited ${code}`);
   });
   try {
-    runChangedTypecheckGate({ log: out.log, warn: out.error, error: out.error, exit, cwd });
+    runChangedTypecheckGate({ log: out.log, warn: out.error, error: out.error, exit, cwd: resolve(cwd), allowMissingCheckoutDependencies: true });
   } catch (error) {
     if (!failed) throw error;
   }
@@ -1087,7 +1091,7 @@ export function verifyPinnedOverlapDecision(input: {
   if (decision === 'unavailable' && opts.overlapEvidence !== undefined) {
     const ref = resolveRemoteBranchRef(run, cwd, base);
     const evidenceInput: VerifyOverlapEvidenceInput = {
-      evidencePath: opts.overlapEvidence, pr: Number(opts.pr), expectedHead: opts.expectedHead!,
+      evidencePath: resolveOverlapEvidencePath(opts.overlapEvidence, cwd), pr: Number(opts.pr), expectedHead: opts.expectedHead!,
       remote: ref.remote, branch: ref.branch, cwd, run, readFile,
       reviewResultsDir: deps.reviewResultsDir ?? join(dirname(taskAgentStatePath()), 'review-results'),
       listDir: (dir) => readdirSync(dir), reviewMtime: (path) => statSync(path).mtimeMs,
@@ -1318,6 +1322,19 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   const refuse = (message: string, context: { isDraft?: boolean } = {}): void => {
     out.error(message);
     observePrLandRefusal(message, context);
+    const pr = Number(opts.pr);
+    if (Number.isSafeInteger(pr) && pr > 0 && opts.expectedHead) {
+      try {
+        const plan = planPrLandRecovery({ refusal: message, pr, head: opts.expectedHead, isDraft: context.isDraft });
+        debug.log('pr.land', 'recover-shadow', {
+          pr, head: opts.expectedHead, label: plan.evidence.label, route: plan.evidence.route,
+          outcome: plan.outcome, action: plan.result.action, reason: plan.result.reason,
+          delayMs: plan.result.delayMs ?? null, execution: 'none',
+        });
+      } catch {
+        // Recovery observation must never replace the original landing refusal.
+      }
+    }
   };
   const refuseDirect = (message: string): void => {
     out.error(message);
@@ -1885,14 +1902,22 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     const baseRead = await readPrBaseNameWithRetry({
       pr: String(opts.pr), cwd, run,
       sleep: deps.sleep ?? ((ms) => new Promise<void>((resolve) => setTimeout(resolve, ms))),
+      onUnreadable: (attempt, stderr) => {
+        if (stderr?.trim()) out.error(`⚠ heavy-remote: gh pr view base read attempt ${attempt}/3 stderr: ${stderr.trim()}`);
+      },
     });
     const baseName = baseRead.baseRefName;
     record('heavy-remote-pr-base-read', baseName !== null, {
       pr: Number(opts.pr), baseRefName: baseName, attempts: baseRead.attempts,
     });
+    if (baseName === null) {
+      record('heavy-remote-pr-base', false, { pr: Number(opts.pr), baseRefName: null, attempts: baseRead.attempts, reason: 'unreadable' });
+      refuseDirect(`✗ heavy-remote: PR base 조회 불가 (${baseRead.attempts}회) — 통과한 head/main 쌍을 확인하지 못했다. 병합하지 않는다.`);
+      return 1;
+    }
     if (baseName !== 'main') {
-      record('heavy-remote-pr-base', false, { pr: Number(opts.pr), baseRefName: baseName, attempts: baseRead.attempts });
-      refuseDirect(`✗ heavy-remote: PR base=${baseName ?? 'unreadable'} ≠ main — 재타기팅된 PR은 통과한 head/main 쌍이 아니다. 병합하지 않는다.`);
+      record('heavy-remote-pr-base', false, { pr: Number(opts.pr), baseRefName: baseName, attempts: baseRead.attempts, reason: 'non-main' });
+      refuseDirect(`✗ heavy-remote: PR base=${baseName} ≠ main — 재타기팅된 PR은 통과한 head/main 쌍이 아니다. 병합하지 않는다.`);
       return 1;
     }
     return undefined;
@@ -1951,7 +1976,8 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     }
     return recheckOverlapAtBase(currentBase);
   };
-  const typecheckOk = opts.heavyRemote || (deps.runTypecheckGate ?? ((o) => runPrLandTypecheckGate(o, cwd)))(out);
+  // The production gate must receive this land invocation's --cwd, never the launching shell's cwd.
+  const typecheckOk = opts.heavyRemote || (deps.runTypecheckGate ? deps.runTypecheckGate(out) : runPrLandTypecheckGate(out, cwd));
   record('typecheck', typecheckOk);
   if (!typecheckOk) {
     // ⛔⭐ 「왜 막혔나」를 «단정하지 않는다» — 이 게이트는 불리언만 돌려주므로 여기서는 이유를 모른다.
@@ -2374,6 +2400,13 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   }
   if (opts.forceFreeze) debug.log('release-loop.freeze', 'force-merge', { pr: prNumber, reason: opts.forceFreeze.trim() });
   record('merge', true, { result: merged.kind, ...(merged.remoteBranchDeletion ? { remoteBranchDeletion: merged.remoteBranchDeletion.detail } : {}) });
+  if (Number.isSafeInteger(prNumber) && prNumber > 0 && deps.onMergedSupersede) {
+    try { await deps.onMergedSupersede(prNumber, cwd); }
+    catch (error) {
+      try { debug.log('drafts.cleanup', 'same-cell-hook-failed', { merged: prNumber, error: String(error) }, { level: 'warn' }); }
+      catch { /* a cleanup observation cannot undo a confirmed merge */ }
+    }
+  }
   // INFLIGHT-REGISTRY — 착지하면 비행 중 등록부의 그 런 줄을 지운다(색인 실패는 착지를 막지 않는다).
   try {
     const statePath = deps.taskStatePath ?? taskAgentStatePath();
@@ -2437,12 +2470,30 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
       out.log(`✓ heavy-remote: post-merge host=${post.host ?? 'unknown'} head=${opts.expectedHead!.slice(0, 12)} main=${firstParent.slice(0, 12)} source=${post.source}`);
     }
   }
-  const baseRef = upsert.reused
+  const finalBaseRead = upsert.reused && opts.heavyRemote
+    ? await readPrBaseNameWithRetry({
+      pr: upsert.url, cwd, run,
+      sleep: deps.sleep ?? ((ms) => new Promise<void>((resolve) => setTimeout(resolve, ms))),
+      onUnreadable: (attempt, stderr) => {
+        if (stderr?.trim()) out.error(`⚠ heavy-remote: final gh pr view base read attempt ${attempt}/3 stderr: ${stderr.trim()}`);
+      },
+    })
+    : undefined;
+  const baseRef = upsert.reused && !opts.heavyRemote
     ? run('gh', ['pr', 'view', upsert.url, '--json', 'baseRefName', '--jq', '.baseRefName'], { cwd })
     : undefined;
-  const landingBase = baseRef
-    ? (baseRef.ok && baseRef.out.trim() ? baseRef.out.trim() : '<base unavailable>')
-    : base;
+  const landingBase = finalBaseRead
+    ? finalBaseRead.baseRefName ?? '<base unavailable>'
+    : baseRef
+      ? (baseRef.ok && baseRef.out.trim() ? baseRef.out.trim() : '<base unavailable>')
+      : base;
+  if (finalBaseRead?.baseRefName && finalBaseRead.baseRefName !== 'main') {
+    out.error(`✗ heavy-remote: PR base=${finalBaseRead.baseRefName} ≠ main — 병합된 base를 확인했습니다.`);
+    return 1;
+  }
+  if (finalBaseRead?.baseRefName === null) {
+    out.log(`⚠ heavy-remote: final PR base 조회 불가 (${finalBaseRead.attempts}회) — 병합 결과를 실패 처리하지 않습니다.`);
+  }
   out.log(`✓ merge: squash ${upsert.url} → ${landingBase}`);
   if (landingBase === '<base unavailable>') {
     out.log('⚠ local HEAD does not contain the landed result; the landed base is unavailable, so no branch command can be provided.');
@@ -2458,6 +2509,20 @@ export function registerPrCommands(program: Command, deps: PrLandDeps = {}, queu
   const prToolRun = deps.run ?? defaultCmdRunner;
   const prToolOut = deps.out ?? liveOut;
   const prToolExit = deps.setExitCode ?? ((code: number) => { process.exitCode = code; });
+  const supersedeMerged = deps.onMergedSupersede ?? (async (number: number, cwd: string): Promise<void> => {
+    const { supersedeMergedGoalDrafts } = await import('../harness/harness-cli-command.js');
+    await supersedeMergedGoalDrafts(number, cwd, undefined, undefined, { onlyExplicitSameCell: true });
+  });
+  pr.command('supersede-drafts')
+    .description('확인된 병합 PR의 명시 Supersedes 같은 칸 draft만 정리')
+    .requiredOption('--pr <number>', '병합 PR 번호')
+    .option('--cwd <path>', '저장소 경로')
+    .action(async (opts: { pr: string; cwd?: string }) => {
+      const number = Number(opts.pr);
+      if (!Number.isSafeInteger(number) || number < 1) { prToolOut.error('✗ supersede-drafts: 올바른 --pr 번호 필요'); prToolExit(1); return; }
+      try { await supersedeMerged(number, opts.cwd ?? process.cwd()); }
+      catch (error) { prToolOut.error(`✗ supersede-drafts: ${String(error)}`); prToolExit(1); }
+    });
   pr.command('census')
     .description('열린 PR 전체·골 문서만·2일 무커밋 draft·미닫힌 superseded 집계')
     .option('--cwd <path>', '저장소 경로')
@@ -2478,7 +2543,9 @@ export function registerPrCommands(program: Command, deps: PrLandDeps = {}, queu
       const diff = prToolRun('git', ['-C', cwd, 'diff', '--name-only', '-z', `${opts.base}...HEAD`]);
       const files = diff.ok ? diff.out.split('\0').filter(Boolean) : null;
       const patch = prToolRun('git', ['-C', cwd, 'diff', '--unified=0', `${opts.base}...HEAD`]);
-      const inventory = readOpenPrs(prToolRun, { cwd, ...(files ? { candidateFiles: files } : {}) });
+      // PR-CENSUS-PARALLEL: the real runner fans `gh pr diff` out (cap 6); an injected runner stays one by one.
+      const inventory = readOpenPrs(prToolRun, { cwd, ...(files ? { candidateFiles: files } : {}),
+        ...(deps.run ? {} : { runParallel: defaultCensusParallelRunner, diffCache: sharedCensusDiffCache }) });
       const result = guardNewPr({ files: patch.ok ? files : null, seat: opts.seat as Seat | undefined, seatCap: Number(opts.seatCap), cellId: opts.cell, hunks: patch.ok ? parseDiffHunks(patch.out) : undefined }, inventory);
       // Inspection never spends the three-creation unmeasured allowance.
       // Only pr-manager records an actual new-PR attempt in that ledger.
@@ -2532,7 +2599,7 @@ export function registerPrCommands(program: Command, deps: PrLandDeps = {}, queu
         const { registerStandaloneLogSink } = await import('../domains/standalone-log-sink.js');
         await registerStandaloneLogSink('pr-land');
       } catch { /* fail-open */ }
-      const code = await runPrLand(opts, deps);
+      const code = await runPrLand(opts, { ...deps, onMergedSupersede: supersedeMerged });
       if (code !== 0) (deps.setExitCode ?? ((exitCode: number) => { process.exitCode = exitCode; }))(code);
     });
   pr.command('granularity')

package/src/cli/pr-land-base-read.ts

@@ -14,6 +14,7 @@ export async function readPrBaseNameWithRetry(input: {
   cwd: string;
   run: CmdRunner;
   sleep: (ms: number) => Promise<void>;
+  onUnreadable?: (attempt: number, stderr: string | undefined) => void;
 }): Promise<PrBaseReadResult> {
   for (let attempt = 1; attempt <= PR_LAND_BASE_READ_RETRIES + 1; attempt += 1) {
     const viewed = input.run('gh', ['pr', 'view', input.pr, '--json', 'baseRefName,url'], { cwd: input.cwd });
@@ -28,6 +29,7 @@ export async function readPrBaseNameWithRetry(input: {
     } catch { /* Retry unreadable responses; do not treat them as main. */ }
 
     if (baseRefName !== null) return { baseRefName, attempts: attempt };
+    input.onUnreadable?.(attempt, viewed.err);
     if (attempt <= PR_LAND_BASE_READ_RETRIES) await input.sleep(PR_LAND_BASE_READ_RETRY_DELAY_MS);
   }
   return { baseRefName: null, attempts: PR_LAND_BASE_READ_RETRIES + 1 };

package/src/cli/pr-land-overlap-evidence.ts

@@ -36,7 +36,7 @@ interface OverlapEvidenceFile {
   gate?: { head: string; baseCommit: string; passed: boolean };
   /** `self review --json` stdout 을 받은 파일(TA: `<state>/review-results/<card>-<pr>-<head접두 10~40>.json`); 내용의 전체 head도 확인한다. */
   reviewResult: string;
-  /** Explicitly replaced failed reviews. Each reason is the verifier's original refusal reason. */
+  /** Evidence-file override for explicitly replaced failed reviews. Each reason is the verifier's refusal reason. */
   supersedes?: { reviewResult: string; reason: string }[];
   /** OPEN follow-up PR that owns the findings intentionally split from this landing. */
   followupPr?: number;
@@ -48,6 +48,11 @@ export type OverlapEvidenceVerdict =
   | { ok: true; mode: 'base-advanced-disjoint'; baseTip: string; gateBase: string; windowCommits: number; reviewResult: string }
   | { ok: false; reason: string; baseTip?: string };
 
+/** Resolve CLI-supplied evidence against the selected repository, not the caller's shell cwd. */
+export function resolveOverlapEvidencePath(evidencePath: string, cwd: string): string {
+  return resolve(cwd, evidencePath);
+}
+
 export interface VerifyOverlapEvidenceInput {
   evidencePath: string;
   pr: number;
@@ -99,8 +104,12 @@ function checkSelectedReviewAttempts(input: VerifyOverlapEvidenceInput, e: Parti
   const entries = e.supersedes;
   if (entries !== undefined && (!Array.isArray(entries) || entries.length === 0)) return { ok: false, reason: 'review-supersedes-invalid' };
   const superseded = new Map<string, string>();
+  const resolvedPriorAccepted: string[] = [];
   let selectedTime: number | undefined;
-  if (entries?.length) {
+  let selectedRecord: Record<string, unknown> | undefined;
+  try { selectedRecord = lastReviewRecord(input.readFile(selected)); } catch { return { ok: false, reason: 'review-unreadable' }; }
+  const hasResolvedPrior = hasResolvedPriorDeclaration(selectedRecord);
+  if (entries?.length || hasResolvedPrior) {
     try { selectedTime = input.reviewMtime(selected); } catch { return { ok: false, reason: 'review-attempt-time-unmeasured' }; }
     if (!Number.isFinite(selectedTime)) return { ok: false, reason: 'review-attempt-time-unmeasured' };
   }
@@ -123,9 +132,22 @@ function checkSelectedReviewAttempts(input: VerifyOverlapEvidenceInput, e: Parti
       if (superseded.has(path)) return { ok: false, reason: 'review-supersedes-passing' };
       continue;
     }
-    if (superseded.get(path) !== review.reason) return { ok: false, reason: `review-attempt-not-superseded: ${basename(path)} (${review.reason})` };
-    if (!/^review-(verdict-fail|must-fix-[1-9][0-9]*)$/.test(review.reason)) {
-      return { ok: false, reason: `review-supersedes-not-failed: ${basename(path)} (${review.reason})` };
+    if (superseded.has(path)) {
+      if (superseded.get(path) !== review.reason) return { ok: false, reason: `review-attempt-not-superseded: ${basename(path)} (${review.reason})` };
+      if (!/^review-(verdict-fail|must-fix-[1-9][0-9]*)$/.test(review.reason)) {
+        return { ok: false, reason: `review-supersedes-not-failed: ${basename(path)} (${review.reason})` };
+      }
+      continue;
+    }
+    if (!/^review-(verdict-fail|must-fix-[1-9][0-9]*)$/.test(review.reason)
+      || !selectedRecord || !reviewAttemptExplicitlyResolved(input, selectedRecord, path, head)) {
+      return { ok: false, reason: `review-attempt-not-superseded: ${basename(path)} (${review.reason})` };
+    }
+    resolvedPriorAccepted.push(path);
+    let failedTime: number;
+    try { failedTime = input.reviewMtime(path); } catch { return { ok: false, reason: 'review-attempt-time-unmeasured' }; }
+    if (!Number.isFinite(failedTime) || selectedTime === undefined || failedTime >= selectedTime) {
+      return { ok: false, reason: 'review-selected-not-later-than-failure' };
     }
   }
   if (entries?.length) {
@@ -145,11 +167,137 @@ function checkSelectedReviewAttempts(input: VerifyOverlapEvidenceInput, e: Parti
     head,
     selected,
     superseded: [...superseded.entries()].map(([reviewResult, reason]) => ({ reviewResult, reason })),
+    resolvedPriorAccepted,
     followupPr: e.followupPr ?? null,
   });
   return { ok: true };
 }
 
+function lastReviewRecord(text: string): Record<string, unknown> | undefined {
+  const lines = text.split('\n').reverse();
+  for (const line of lines) {
+    if (!line.trim().startsWith('{')) continue;
+    let value: unknown;
+    try { value = JSON.parse(line); } catch { continue; }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) continue;
+    const result = value as Record<string, unknown>;
+    if (result.pr !== undefined && (('verdict' in result && Array.isArray(result.mustFix)) || typeof result.error === 'string')) return result;
+  }
+  return undefined;
+}
+
+function hasResolvedPriorDeclaration(review: Record<string, unknown> | undefined): boolean {
+  if (!review) return false;
+  const value = review.resolvedPrior;
+  if (Array.isArray(value) && value.length > 0) return true;
+  if (value && typeof value === 'object' && Object.keys(value).length > 0) return true;
+  return [review.intent, review.intentBlock, review.reviewIntent, review.reviewIntentBlock]
+    .some((intent) => typeof intent === 'string' && /resolved prior|prior review findings resolved/i.test(intent));
+}
+
+function normalizedFinding(value: string): string {
+  return value.trim().replace(/\s+/g, ' ').toLowerCase();
+}
+
+function containsUnresolvedClaim(value: string): boolean {
+  return /\b(?:unresolved|not(?:\s+yet)?[\s-]+resolved|not(?:\s+yet)?[\s-]+fixed|not(?:\s+yet)?[\s-]+addressed|still[\s-]+open|remains?[\s-]+open|still[\s-]+present|status\s*[:=]\s*(?:open|unresolved|pending|in[- ]progress))\b/i.test(value);
+}
+
+function containsUnresolvedDeclaration(value: unknown): boolean {
+  if (typeof value === 'string') return containsUnresolvedClaim(value);
+  if (Array.isArray(value)) return value.some(containsUnresolvedDeclaration);
+  if (!value || typeof value !== 'object') return false;
+  const record = value as Record<string, unknown>;
+  if (record.resolved === false || (typeof record.status === 'string' && /^(?:open|unresolved|pending|in[- ]progress)$/i.test(record.status))) return true;
+  return Object.values(record).some(containsUnresolvedDeclaration);
+}
+
+function referencesReview(value: unknown, path: string): boolean {
+  return typeof value === 'string' && (value === path || value === basename(path));
+}
+
+function findingList(value: unknown): string[] {
+  const values = Array.isArray(value) ? value : typeof value === 'string' ? [value] : [];
+  return values.filter((entry): entry is string => typeof entry === 'string' && entry.trim().length > 0);
+}
+
+/** A later same-head pass/mf0 review may resolve prior attempts only when it names every finding explicitly. */
+function reviewAttemptExplicitlyResolved(input: VerifyOverlapEvidenceInput, selected: Record<string, unknown>, failedPath: string, head: string): boolean {
+  let failed: Record<string, unknown> | undefined;
+  try { failed = lastReviewRecord(input.readFile(failedPath)); } catch { return false; }
+  if (!failed || failed.pr === undefined || String(failed.pr) !== String(input.pr)
+    || (typeof failed.headCommit === 'string' && failed.headCommit.toLowerCase() !== head)
+    || (typeof failed.currentHeadCommit === 'string' && failed.currentHeadCommit.toLowerCase() !== head)) return false;
+  const rawFindings = findingList(failed.mustFix).map((finding) => finding.trim());
+  const findings = rawFindings.map(normalizedFinding);
+  if (findings.length === 0) return false;
+
+  const declared = selected.resolvedPrior;
+  if (declared !== undefined && containsUnresolvedDeclaration(declared)) return false;
+  const intentBlocks = [selected.intent, selected.intentBlock, selected.reviewIntent, selected.reviewIntentBlock]
+    .filter((value): value is string => typeof value === 'string');
+  // A resolution in one field cannot override an OPEN/PENDING declaration in another.
+  if (intentBlocks.some(containsUnresolvedClaim)) return false;
+
+  let resolved: string[] = [];
+  if (Array.isArray(declared)) {
+    for (const entry of declared) {
+      if (typeof entry === 'string') {
+        if (containsUnresolvedClaim(entry)) continue;
+        // A string can be an exact finding axis or an explicit "filename: finding" row.
+        const line = entry.trim();
+        if (rawFindings.includes(line)) resolved.push(line);
+        const prefix = `${basename(failedPath)}: `;
+        if (line.startsWith(prefix)) {
+          const declaredFinding = line.slice(prefix.length).trim();
+          const index = rawFindings.indexOf(declaredFinding);
+          if (index >= 0) resolved.push(findings[index]!);
+        }
+        continue;
+      }
+      if (!entry || typeof entry !== 'object' || Array.isArray(entry)) continue;
+      const item = entry as Record<string, unknown>;
+      const ref = item.reviewResult ?? item.review ?? item.path;
+      if (ref !== undefined && !referencesReview(ref, failedPath)) continue;
+      if (item.head !== undefined && (typeof item.head !== 'string' || item.head.toLowerCase() !== head)) continue;
+      if (item.headCommit !== undefined && (typeof item.headCommit !== 'string' || item.headCommit.toLowerCase() !== head)) continue;
+      if (item.resolved === false || item.status === 'unresolved'
+        || Object.values(item).some((value) => typeof value === 'string' && containsUnresolvedClaim(value))) continue;
+      const listed = findingList(item.mustFix ?? item.resolvedMustFix ?? item.findings ?? item.axes ?? item.finding ?? item.axis);
+      if (listed.some(containsUnresolvedClaim)) continue;
+      if (ref === undefined && listed.every((finding) => rawFindings.includes(finding.trim()))) {
+        resolved.push(...listed.filter((finding) => rawFindings.includes(finding.trim())));
+      } else if (ref !== undefined) {
+        resolved.push(...listed.filter((finding) => rawFindings.includes(finding.trim())));
+      }
+    }
+  } else if (declared && typeof declared === 'object') {
+    const record = declared as Record<string, unknown>;
+    const value = record[failedPath] ?? record[basename(failedPath)];
+    resolved.push(...findingList(value).filter((finding) => !containsUnresolvedClaim(finding) && rawFindings.includes(finding.trim())));
+  }
+
+  for (const intent of intentBlocks) {
+    const lines = intent.split(/\r?\n/);
+    const header = lines.findIndex((line) => /^resolved prior review findings:\s*$/i.test(line.trim()));
+    if (header < 0) continue;
+    // Only explicit rows under the resolution header count. A finding quoted in
+    // background prose is evidence of context, not a declaration of repair.
+    const prefix = `- ${basename(failedPath)}:`;
+    for (const raw of lines.slice(header + 1)) {
+      const line = raw.trim();
+      if (!line) continue;
+      if (!line.startsWith('- ')) break;
+      if (!line.startsWith(prefix)) continue;
+      const declaredFinding = line.slice(prefix.length).trim();
+      const index = rawFindings.indexOf(declaredFinding);
+      if (index >= 0) resolved.push(findings[index]!);
+    }
+  }
+  const resolvedSet = new Set(resolved.map(normalizedFinding));
+  return findings.every((finding) => resolvedSet.has(finding));
+}
+
 type Checked = { ok: false; reason: string; baseTip?: string; gateBase?: string; windowCommits?: number }
   | (OverlapEvidenceVerdict & { ok: true; baseTip?: string });
 
@@ -176,17 +324,7 @@ function checkReview(input: Pick<VerifyOverlapEvidenceInput, 'pr' | 'readFile'>,
   if (review.pr !== input.pr) return { ok: false, reason: 'review-pr-mismatch', baseTip };
   if (!review.head || review.head.toLowerCase() !== head) return { ok: false, reason: 'review-head-mismatch', baseTip };
   // The capture parser projects away model provenance; inspect the same last result-shaped line here.
-  let raw: Record<string, unknown> | undefined;
-  for (const line of text.split('\n').reverse()) {
-    if (!line.trim().startsWith('{')) continue;
-    let value: unknown;
-    try { value = JSON.parse(line); } catch { continue; }
-    if (!value || typeof value !== 'object' || Array.isArray(value)) continue;
-    const result = value as Record<string, unknown>;
-    if (result.pr === undefined || !(('verdict' in result && Array.isArray(result.mustFix)) || typeof result.error === 'string')) continue;
-    raw = result;
-    break;
-  }
+  const raw = lastReviewRecord(text);
   if (raw) {
     const actualBackend = typeof raw.actualBackend === 'string' ? raw.actualBackend.trim().toLowerCase() : '';
     const model = typeof raw.model === 'string' ? raw.model.trim().toLowerCase() : '';

package/src/cli/pr-land-pod-shadow-job.ts

@@ -63,6 +63,9 @@ export async function runLandingPodShadowJob(input: LandingPodShadowInput, deps:
     // Wait for the runner to observe abort and finish Job/Secret/lease cleanup before landing continues.
     job = await (deps.runPod ?? runPodCommand)({
       command: ['bash', '-lc', script], clone: true, source: { kind: 'commit', sha: input.head },
+      provenance: { actorKind: 'loop', actor: 'pr-land-shadow', kind: 'land-shadow',
+        run: input.head, phase: 'land-shadow', requestedAt: new Date().toISOString(),
+        entrance: 'pr-land', commit: input.head, reason: 'landing typecheck and changed gate shadow' },
       returnLogs: true, deadlineSeconds: 45 * 60,
       statusUnreadableMs: LANDING_POD_SHADOW_STATUS_UNREADABLE_MS,
       hostDeadlineAtMs: Date.now() + LANDING_POD_SHADOW_HOST_TIMEOUT_MS,

package/src/cli/pr-land-recovery.ts

@@ -0,0 +1,64 @@
+import { classifyPrLandRefusal } from './pr-land-refusal.js';
+import { readJourneyEdge } from '../self-dev/graph-journey-route.js';
+
+/** A recover unit selects a next action. The train or TA still owns every effect. */
+export interface PrLandRecoveryContext {
+  refusal: string;
+  pr?: number;
+  head?: string;
+  isDraft?: boolean;
+}
+
+export interface PrLandRecoveryPlan {
+  outcome: 'rework' | 'needs-human' | 'failed';
+  result: { action: 'wait-retry' | 'request-review' | 'needs-human' | 'none'; pr?: number; head?: string; delayMs?: number; reason: string };
+  evidence: { refusal: string; label: string; route: string | null; source: string };
+}
+
+export function planPrLandRecovery(context: PrLandRecoveryContext): PrLandRecoveryPlan {
+  const raw = typeof context.refusal === 'string' ? context.refusal : '';
+  const lines = raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  // Callers must extract exactly one refusal line. A second diagnostic may be
+  // unmarked (for example `error: review-missing`), so never select a line
+  // from a larger transcript and mistake it for the whole verdict.
+  const refusal = lines.length === 1 ? lines[0]! : raw.trim();
+  const label = classifyPrLandRefusal(refusal, { isDraft: context.isDraft });
+  const route = readJourneyEdge('merge', label);
+  const evidence = { refusal: refusal.slice(0, 500), label, route: route.to, source: route.source };
+  const pr = Number.isSafeInteger(context.pr) && context.pr! > 0 ? context.pr : undefined;
+  const head = typeof context.head === 'string' && /^[0-9a-f]{40}$/i.test(context.head) ? context.head.toLowerCase() : undefined;
+  if (!refusal || !pr || !head) return { outcome: 'failed', result: { action: 'none', reason: 'pinned PR, head and refusal are required' }, evidence };
+  if (lines.length !== 1 || !refusal.startsWith('✗')) return { outcome: 'needs-human', result: { action: 'needs-human', pr, head, reason: `expected one marked refusal line, observed ${lines.length} nonempty lines` }, evidence };
+  if (route.source !== 'graph') return { outcome: 'needs-human', result: { action: 'needs-human', pr, head, reason: 'refusal has no declared graph route' }, evidence };
+  if (label === 'gate-host-busy' && route.to === 'next-move') {
+    return { outcome: 'rework', result: { action: 'wait-retry', pr, head, delayMs: 30_000, reason: 'remote gate host busy; retry through existing admission after delay' }, evidence };
+  }
+  if (label === 'review-missing' && route.to === 'review') {
+    return { outcome: 'rework', result: { action: 'request-review', pr, head, reason: 'request exact-head review through existing review gate' }, evidence };
+  }
+  return { outcome: 'needs-human', result: { action: 'needs-human', pr, head, reason: `${label} requires the existing ${route.to ?? 'unknown'} admission before another landing` }, evidence };
+}
+
+/** A graph call_entry cannot turn one refusal into another action. */
+export function planPrLandRecoveryForEntry(context: PrLandRecoveryContext, entry: string): PrLandRecoveryPlan {
+  const plan = planPrLandRecovery(context);
+  // The default entry keeps the original read-only planner contract.
+  if (entry === 'plan') return plan;
+  if (entry === 'human-review') {
+    if (plan.outcome === 'needs-human' && plan.result.action === 'needs-human') return plan;
+    return { outcome: 'failed', result: { action: 'none', reason: `recover entry ${entry} does not match ${plan.result.action}` }, evidence: plan.evidence };
+  }
+  if (entry === 'request-review' || entry === 'wait-retry') {
+    if (plan.outcome === 'rework' && plan.result.action === entry) return plan;
+    return {
+      outcome: 'failed',
+      result: { action: 'none', reason: `recover entry ${entry} does not match ${plan.result.action}` },
+      evidence: plan.evidence,
+    };
+  }
+  return {
+    outcome: 'failed',
+    result: { action: 'none', reason: `unknown recover entry: ${entry}` },
+    evidence: plan.evidence,
+  };
+}