elanous 0.2.34 → 0.2.36

package/src/cli/pr-cli.ts

@@ -30,6 +30,7 @@ import { queryRunningRuns, type RunningRunsResult } from '../self-implement/runn
 import { debug } from '../debug/log.js';
 import { runGitCommand } from '../git-fs/runner.js';
 import {
+  defaultCensusParallelRunner,
   defaultCmdRunner,
   makePrManager,
   resolveDeliverableBase,
@@ -61,8 +62,8 @@ import { admitLandingMerge } from '../self-implement/frozen-merges.js';
 import { resolveOverlapEvidencePath, verifyAllSameHeadReviews, verifyAncestorAutoPass, verifyOverlapEvidence, verifyOverlapEvidenceVirtualRebase } from './pr-land-overlap-evidence.js';
 import type { VerifyOverlapEvidenceInput } from './pr-land-overlap-evidence.js';
 import { verifyVirtualRebasePatch } from './pr-land-virtual-rebase.js';
-import { observeDirectPrLandRefusal, observePrLandRefusal } from './pr-land-refusal.js';
-import { planPrLandRecovery } from './pr-land-recovery.js';
+import { classifyPrLandRefusal, observeDirectPrLandRefusal, observePrLandRefusal } from './pr-land-refusal.js';
+import { bindPrLandRefusalToRecover, PR_LAND_CARD_ID_ENV } from './pr-land-recovery.js';
 import { ensurePrLandHeavyRemote, type HeavyRemoteInput, type HeavyRemoteResult } from './pr-land-heavy-remote.js';
 import { readPrBaseNameWithRetry } from './pr-land-base-read.js';
 import { runHeavyOnPodShadow } from './pr-land-pod-shadow.js';
@@ -71,7 +72,7 @@ import { readTaskAgentState, taskAgentStatePath, type TaskCard } from '../task-a
 import { INFLIGHT_REGISTRY_FILE, removeInflightForPr } from '../pr-tool/inflight-registry.js';
 import { PR_LABEL_NAMES } from '../github/pr-labels.js';
 import { enqueueL8ShadowQueue, runL8ShadowQueue, shadowPrNumber, statusL8ShadowQueue, type L8ShadowQueueDeps } from '../self-implement/l8-merge-queue.js';
-import { censusOpenPrs, guardNewPr, parseDiffHunks, readOpenPrs, type Seat } from '../pr-tool/census.js';
+import { censusOpenPrs, guardNewPr, parseDiffHunks, readOpenPrs, sharedCensusDiffCache, type Seat } from '../pr-tool/census.js';
 
 export { branchLineageSlug, findSiblingPrs };
 
@@ -1318,26 +1319,39 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   };
   // Observe actual merge refusals, including the measured remote gate and public export leak.
   // Option syntax and unmeasured prerequisite errors do not describe a recovery edge.
+  // LAND-REFUSAL-EDGES — a pinned refusal is also bound to the recover@1 edge with its raw line and card.
+  // The card arrives only through the child env set by TA defaultLand — never a shell export.
+  const cardId = process.env[PR_LAND_CARD_ID_ENV]?.trim() || undefined;
+  const bindRecover = (message: string, context: { isDraft?: boolean } = {}) => {
+    const pr = Number(opts.pr);
+    if (!Number.isSafeInteger(pr) || pr <= 0 || !opts.expectedHead) return undefined;
+    try { return bindPrLandRefusalToRecover({ refusal: message, pr, head: opts.expectedHead, isDraft: context.isDraft, cardId }); }
+    catch { return undefined; }
+  };
   const refuse = (message: string, context: { isDraft?: boolean } = {}): void => {
     out.error(message);
     observePrLandRefusal(message, context);
-    const pr = Number(opts.pr);
-    if (Number.isSafeInteger(pr) && pr > 0 && opts.expectedHead) {
-      try {
-        const plan = planPrLandRecovery({ refusal: message, pr, head: opts.expectedHead, isDraft: context.isDraft });
-        debug.log('pr.land', 'recover-shadow', {
-          pr, head: opts.expectedHead, label: plan.evidence.label, route: plan.evidence.route,
-          outcome: plan.outcome, action: plan.result.action, reason: plan.result.reason,
-          delayMs: plan.result.delayMs ?? null, execution: 'none',
-        });
-      } catch {
-        // Recovery observation must never replace the original landing refusal.
-      }
+    const plan = bindRecover(message, context);
+    if (!plan) return;
+    try {
+      debug.log('pr.land', 'recover-shadow', {
+        pr: Number(opts.pr), head: opts.expectedHead, label: plan.evidence.label, route: plan.evidence.route,
+        outcome: plan.outcome, action: plan.result.action, reason: plan.result.reason,
+        delayMs: plan.result.delayMs ?? null, execution: 'none',
+      });
+    } catch {
+      // Recovery observation must never replace the original landing refusal.
     }
   };
+  // A direct failure binds only when today's refusal shape is recognized — the same measured sample
+  // as observeDirectPrLandRefusal (#28939). An unclassified direct error is not a landing refusal.
+  const observeDirect = (message: string): void => {
+    observeDirectPrLandRefusal(message);
+    if (classifyPrLandRefusal(message) !== 'other') bindRecover(message);
+  };
   const refuseDirect = (message: string): void => {
     out.error(message);
-    observeDirectPrLandRefusal(message);
+    observeDirect(message);
   };
   if (opts.title !== undefined && opts.titleFile !== undefined) {
     out.error('✗ title: --title과 --title-file은 함께 사용할 수 없습니다.');
@@ -2042,7 +2056,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   nextMdWarning(body ?? '', changedPaths, out);
   if (!conflictMarkerBlock(changedPaths, cwd, out)) return 1;
   publicLeakWarning(changedPaths, deps.runPublicLeakGate ?? ((files, sink) => runPrLandPublicLeakGate(files, sink, cwd, base)), out);
-  if (!exportLeakBlock(changedPaths, () => (deps.runExportLeakCheck ?? runPrLandExportLeakCheck)(changedPaths ?? [], cwd), opts.allowPublicLeak === true, out, cwd, observeDirectPrLandRefusal)) return 1;
+  if (!exportLeakBlock(changedPaths, () => (deps.runExportLeakCheck ?? runPrLandExportLeakCheck)(changedPaths ?? [], cwd), opts.allowPublicLeak === true, out, cwd, observeDirect)) return 1;
   if (!await exportImportBlock(changedPaths, () => (deps.runExportImportCheck ?? runPrLandExportImportCheck)(changedPaths ?? [], cwd), out)) return 1;
   if (publicDocPaths(changedPaths, () => true).length > 0) {
     const top = run('git', ['rev-parse', '--show-toplevel'], { cwd });
@@ -2542,7 +2556,9 @@ export function registerPrCommands(program: Command, deps: PrLandDeps = {}, queu
       const diff = prToolRun('git', ['-C', cwd, 'diff', '--name-only', '-z', `${opts.base}...HEAD`]);
       const files = diff.ok ? diff.out.split('\0').filter(Boolean) : null;
       const patch = prToolRun('git', ['-C', cwd, 'diff', '--unified=0', `${opts.base}...HEAD`]);
-      const inventory = readOpenPrs(prToolRun, { cwd, ...(files ? { candidateFiles: files } : {}) });
+      // PR-CENSUS-PARALLEL: the real runner fans `gh pr diff` out (cap 6); an injected runner stays one by one.
+      const inventory = readOpenPrs(prToolRun, { cwd, ...(files ? { candidateFiles: files } : {}),
+        ...(deps.run ? {} : { runParallel: defaultCensusParallelRunner, diffCache: sharedCensusDiffCache }) });
       const result = guardNewPr({ files: patch.ok ? files : null, seat: opts.seat as Seat | undefined, seatCap: Number(opts.seatCap), cellId: opts.cell, hunks: patch.ok ? parseDiffHunks(patch.out) : undefined }, inventory);
       // Inspection never spends the three-creation unmeasured allowance.
       // Only pr-manager records an actual new-PR attempt in that ledger.

package/src/cli/pr-land-base-read.ts

@@ -1,7 +1,16 @@
 import type { CmdRunner } from '../autopilot/pr-manager.js';
 
 export const PR_LAND_BASE_READ_RETRIES = 2;
-export const PR_LAND_BASE_READ_RETRY_DELAY_MS = 100;
+/** Increasing backoff: 1s after the first unreadable read, 3s after the second (OPT #24215). */
+export const PR_LAND_BASE_READ_RETRY_DELAYS_MS = [1_000, 3_000] as const;
+/** Fixed ceiling: no retry sleep ever exceeds the last scheduled delay. */
+export const PR_LAND_BASE_READ_RETRY_DELAY_CAP_MS = 3_000;
+
+/** Backoff for the sleep that follows `attempt`; the schedule stops growing at the cap. */
+export function prLandBaseReadRetryDelayMs(attempt: number): number {
+  const index = Math.min(Math.max(attempt, 1), PR_LAND_BASE_READ_RETRY_DELAYS_MS.length) - 1;
+  return Math.min(PR_LAND_BASE_READ_RETRY_DELAYS_MS[index], PR_LAND_BASE_READ_RETRY_DELAY_CAP_MS);
+}
 
 export interface PrBaseReadResult {
   baseRefName: string | null;
@@ -30,7 +39,7 @@ export async function readPrBaseNameWithRetry(input: {
 
     if (baseRefName !== null) return { baseRefName, attempts: attempt };
     input.onUnreadable?.(attempt, viewed.err);
-    if (attempt <= PR_LAND_BASE_READ_RETRIES) await input.sleep(PR_LAND_BASE_READ_RETRY_DELAY_MS);
+    if (attempt <= PR_LAND_BASE_READ_RETRIES) await input.sleep(prLandBaseReadRetryDelayMs(attempt));
   }
   return { baseRefName: null, attempts: PR_LAND_BASE_READ_RETRIES + 1 };
 }

package/src/cli/pr-land-heavy-remote.ts

@@ -8,8 +8,11 @@ import { debug, redactSecretText } from '../debug/log.js';
 import { gateRemoteHostCap, realGateRemoteRunner, resolveGateRemoteSettings, runOnRemote, type GateRemoteRunner, type RemoteRunOutcome } from '../self-implement/gate-remote.js';
 
 const SHA = /^[0-9a-f]{40}$/i;
-// WSL is excluded until its push permissions and gate environment are proven stable.
-export const PR_LAND_HEAVY_HOSTS = ['node-b', 'node-c'] as const;
+// WSL still lands last: its gate environment was repaired (WSL-GATE-ENV, 2026-10-17 — baselineWorkspaceRoot in
+// scripts/ci-typecheck-changed.ts now picks the host disk /var/tmp instead of WSL's 20GiB tmpfs), so the host is
+// allowlisted as the third slot while node-b/node-c keep discovery order — the recorded host order stays part of the
+// evidence contract.
+export const PR_LAND_HEAVY_HOSTS = ['node-b', 'node-c', 'host-e-wsl'] as const;
 export const PR_LAND_HEAVY_HOST = PR_LAND_HEAVY_HOSTS[0];
 export type PrLandHeavyHost = typeof PR_LAND_HEAVY_HOSTS[number];
 const allowedHost = (host: string): host is PrLandHeavyHost => PR_LAND_HEAVY_HOSTS.some((candidate) => candidate === host);
@@ -234,7 +237,7 @@ export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemo
       // A completed run or infrastructure failure is a verdict. Only a full host slot asks for another host.
       if (outcome.kind !== 'busy') break wait;
     }
-    // Both allowlisted hosts were busy. Wait the same slotWaitSeconds window as self gate, then retry.
+    // Every allowlisted host was busy. Wait the same slotWaitSeconds window as self gate, then retry.
     debug.log('pr.land', 'host-busy', { host: selectedHost, occupied: outcome.occupied ?? null, slotWaitSeconds: settings.slotWaitSeconds });
     const left = deadline - now();
     if (left <= 0) break;

package/src/cli/pr-land-overlap-evidence.ts

@@ -189,6 +189,7 @@ function lastReviewRecord(text: string): Record<string, unknown> | undefined {
 function hasResolvedPriorDeclaration(review: Record<string, unknown> | undefined): boolean {
   if (!review) return false;
   const value = review.resolvedPrior;
+  if (value === true) return true;
   if (Array.isArray(value) && value.length > 0) return true;
   if (value && typeof value === 'object' && Object.keys(value).length > 0) return true;
   return [review.intent, review.intentBlock, review.reviewIntent, review.reviewIntentBlock]
@@ -199,8 +200,21 @@ function normalizedFinding(value: string): string {
   return value.trim().replace(/\s+/g, ' ').toLowerCase();
 }
 
+// `status open` / `status pending` in prose counts the same as `status: pending` in a field.
+const UNRESOLVED_STATUS = /^(?:open|unresolved|pending|in[- ]progress)$/i;
+
 function containsUnresolvedClaim(value: string): boolean {
-  return /\b(?:unresolved|not(?:\s+yet)?[\s-]+resolved|not(?:\s+yet)?[\s-]+fixed|not(?:\s+yet)?[\s-]+addressed|still[\s-]+open|remains?[\s-]+open|still[\s-]+present|status\s*[:=]\s*(?:open|unresolved|pending|in[- ]progress))\b/i.test(value);
+  return /\b(?:unresolved|not(?:\s+yet)?[\s-]+resolved|not(?:\s+yet)?[\s-]+fixed|not(?:\s+yet)?[\s-]+addressed|still[\s-]+open|remains?[\s-]+open|still[\s-]+present|status\s*(?:[:=]\s*|\s+)(?:open|unresolved|pending|in[- ]progress))\b/i.test(value);
+}
+
+/** A record cannot claim resolution while carrying its own OPEN/PENDING status — refuse both fields. */
+function unresolvedStatusDeclared(record: Record<string, unknown>): boolean {
+  if (record.resolved === false) return true;
+  return ['status', 'resolutionStatus', 'resolution']
+    .some((key) => {
+      const value = record[key];
+      return typeof value === 'string' && UNRESOLVED_STATUS.test(value.trim());
+    });
 }
 
 function containsUnresolvedDeclaration(value: unknown): boolean {
@@ -208,7 +222,7 @@ function containsUnresolvedDeclaration(value: unknown): boolean {
   if (Array.isArray(value)) return value.some(containsUnresolvedDeclaration);
   if (!value || typeof value !== 'object') return false;
   const record = value as Record<string, unknown>;
-  if (record.resolved === false || (typeof record.status === 'string' && /^(?:open|unresolved|pending|in[- ]progress)$/i.test(record.status))) return true;
+  if (unresolvedStatusDeclared(record)) return true;
   return Object.values(record).some(containsUnresolvedDeclaration);
 }
 
@@ -233,11 +247,16 @@ function reviewAttemptExplicitlyResolved(input: VerifyOverlapEvidenceInput, sele
   if (findings.length === 0) return false;
 
   const declared = selected.resolvedPrior;
-  if (declared !== undefined && containsUnresolvedDeclaration(declared)) return false;
+  if (declared !== undefined && declared !== false && containsUnresolvedDeclaration(declared)) return false;
   const intentBlocks = [selected.intent, selected.intentBlock, selected.reviewIntent, selected.reviewIntentBlock]
     .filter((value): value is string => typeof value === 'string');
   // A resolution in one field cannot override an OPEN/PENDING declaration in another.
   if (intentBlocks.some(containsUnresolvedClaim)) return false;
+  // Contradiction axis 1 (structured): the record declares the prior attempt resolved while a
+  // separate lifecycle field still says open/pending — neither claim can be trusted, so refuse.
+  const declaresResolution = (declared !== undefined && declared !== false)
+    || intentBlocks.some((intent) => /^resolved prior review findings:\s*$/im.test(intent));
+  if (declaresResolution && unresolvedStatusDeclared(selected)) return false;
 
   let resolved: string[] = [];
   if (Array.isArray(declared)) {
@@ -261,7 +280,7 @@ function reviewAttemptExplicitlyResolved(input: VerifyOverlapEvidenceInput, sele
       if (ref !== undefined && !referencesReview(ref, failedPath)) continue;
       if (item.head !== undefined && (typeof item.head !== 'string' || item.head.toLowerCase() !== head)) continue;
       if (item.headCommit !== undefined && (typeof item.headCommit !== 'string' || item.headCommit.toLowerCase() !== head)) continue;
-      if (item.resolved === false || item.status === 'unresolved'
+      if (unresolvedStatusDeclared(item)
         || Object.values(item).some((value) => typeof value === 'string' && containsUnresolvedClaim(value))) continue;
       const listed = findingList(item.mustFix ?? item.resolvedMustFix ?? item.findings ?? item.axes ?? item.finding ?? item.axis);
       if (listed.some(containsUnresolvedClaim)) continue;

package/src/cli/pr-land-pod-shadow-job.ts

@@ -63,6 +63,9 @@ export async function runLandingPodShadowJob(input: LandingPodShadowInput, deps:
     // Wait for the runner to observe abort and finish Job/Secret/lease cleanup before landing continues.
     job = await (deps.runPod ?? runPodCommand)({
       command: ['bash', '-lc', script], clone: true, source: { kind: 'commit', sha: input.head },
+      provenance: { actorKind: 'loop', actor: 'pr-land-shadow', kind: 'land-shadow',
+        run: input.head, phase: 'land-shadow', requestedAt: new Date().toISOString(),
+        entrance: 'pr-land', commit: input.head, reason: 'landing typecheck and changed gate shadow' },
       returnLogs: true, deadlineSeconds: 45 * 60,
       statusUnreadableMs: LANDING_POD_SHADOW_STATUS_UNREADABLE_MS,
       hostDeadlineAtMs: Date.now() + LANDING_POD_SHADOW_HOST_TIMEOUT_MS,

package/src/cli/pr-land-recovery.ts

@@ -1,5 +1,10 @@
 import { classifyPrLandRefusal } from './pr-land-refusal.js';
-import { readJourneyEdge } from '../self-dev/graph-journey-route.js';
+import { readJourneyEdge, recordJourneyEdge } from '../self-dev/graph-journey-route.js';
+import { GRAPH_SPECS } from '../self-implement/graph-templates.js';
+import { debug } from '../debug/log.js';
+
+/** The task card that launched this `pr land` (TA `defaultLand` sets it). Observation only. */
+export const PR_LAND_CARD_ID_ENV = 'ELANOUS_PR_LAND_CARD_ID';
 
 /** A recover unit selects a next action. The train or TA still owns every effect. */
 export interface PrLandRecoveryContext {
@@ -62,3 +67,114 @@ export function planPrLandRecoveryForEntry(context: PrLandRecoveryContext, entry
     evidence: plan.evidence,
   };
 }
+
+/** LAND-REFUSAL-EDGES — bind one observed landing refusal to the declared recover@1 edge.
+ *  The row carries the raw refusal, card, PR, head and the read-only plan. It never retries,
+ *  merges or requests anything: `execution: 'none'` and `mergeSha: null` are part of the row. */
+export function bindPrLandRefusalToRecover(context: PrLandRecoveryContext & { cardId?: string }): PrLandRecoveryPlan {
+  const plan = planPrLandRecovery(context);
+  try {
+    if (!plan.result.pr || !plan.result.head) return plan;
+    const route = readJourneyEdge('merge', 'land-refused');
+    const node = route.to ? GRAPH_SPECS['self-implement']?.nodes.find((n) => n.nodeId === route.to) : undefined;
+    const call = node?.kind === 'subgraph' ? node.call ?? null : null;
+    const cardId = typeof context.cardId === 'string' && context.cardId.trim() ? context.cardId.trim() : null;
+    const reason = 'pr-land-refused; recover@1 bound; recovery-execution=none';
+    // Only a declared recover@1 subgraph is a binding. A fallback edge (e.g. merge → cleanup) is not.
+    if (route.source !== 'graph' || route.on !== 'recovery' || call !== 'recover@1') {
+      debug.log('self-implement', 'graph-edge-unresolved', { from: 'merge', label: 'land-refused', to: route.to, call, reason });
+      return plan;
+    }
+    recordJourneyEdge(route, route.to!, reason, {
+      call, execution: 'none', mergeSha: null,
+      evidence: { cardId, pr: plan.result.pr, head: plan.result.head, refusal: plan.evidence.refusal,
+        refusalLabel: plan.evidence.label, refusalRoute: plan.evidence.route },
+      recover: { outcome: plan.outcome, action: plan.result.action, reason: plan.result.reason, delayMs: plan.result.delayMs ?? null },
+    });
+  } catch { /* Observation must never replace the landing refusal. */ }
+  return plan;
+}
+
+type RecoverRun = { runId?: string; status?: string; path?: readonly string[]; nodes?: ReadonlyArray<{ nodeId?: string; output?: unknown }> };
+export interface PrLandRecoveryExecution {
+  /** The plan the caller may act on. An untrusted or failed run is replaced by a needs-human plan. */
+  plan: PrLandRecoveryPlan;
+  /** True only when the declared recover@1 binding existed and the unit was run. */
+  executed: boolean;
+}
+
+/** LAND-REFUSAL-EXEC — bind one refusal (row `execution: 'none'`), then run the existing recover@1 unit
+ *  (graphs/units/recover.yaml · read-only `cmd:recover-plan`) for one step to the terminal the unit selects,
+ *  and record that run on the same edge keys with `execution: 'graph-run'`. A run that does not reproduce the
+ *  pinned plan fails closed to `needs-human`. It still never retries, requests, merges or enqueues. */
+/** recover@1 한 단계 실행의 시간 한도 — 운영 TA 착지 틱이 매달린 유닛에 붙잡히지 않게(넘으면 fail-closed needs-human). */
+export const PR_LAND_RECOVER_TIMEOUT_MS = 60_000;
+
+export async function executeBoundPrLandRecover(
+  context: PrLandRecoveryContext & { cardId?: string },
+  deps: { root?: string; timeoutMs?: number; runGraph?: (path: string, options: { input: unknown; quiet?: boolean; pinChildUniverse?: boolean; deps?: { root?: string } }) => Promise<RecoverRun> } = {},
+): Promise<PrLandRecoveryExecution> {
+  const plan = bindPrLandRefusalToRecover(context);
+  let route: ReturnType<typeof readJourneyEdge>;
+  let call: string | null;
+  try {
+    route = readJourneyEdge('merge', 'land-refused');
+    const node = route.to ? GRAPH_SPECS['self-implement']?.nodes.find((n) => n.nodeId === route.to) : undefined;
+    call = node?.kind === 'subgraph' ? node.call ?? null : null;
+  } catch { return { plan, executed: false }; }
+  // Same admission as the binding: pinned identity and a declared recover@1 subgraph edge.
+  if (!plan.result.pr || !plan.result.head || route.source !== 'graph' || route.on !== 'recovery' || call !== 'recover@1') return { plan, executed: false };
+  const cardId = typeof context.cardId === 'string' && context.cardId.trim() ? context.cardId.trim() : null;
+  const unitContext = { refusal: context.refusal, pr: plan.result.pr, head: plan.result.head, ...(context.isDraft === undefined ? {} : { isDraft: context.isDraft }) };
+  let run: RecoverRun | undefined;
+  let error: string | undefined;
+  try {
+    const runGraph = deps.runGraph ?? (await import('../graph-runner/runner.js')).runGraph;
+    const { fileURLToPath } = await import('node:url');
+    const limitMs = deps.timeoutMs ?? PR_LAND_RECOVER_TIMEOUT_MS;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const timeout = new Promise<never>((_, reject) => {
+      timer = setTimeout(() => reject(new Error(`recover@1 timeout after ${limitMs}ms`)), limitMs);
+      (timer as { unref?: () => void }).unref?.();
+    });
+    try {
+      run = await Promise.race([runGraph(fileURLToPath(new URL('../../graphs/units/recover.yaml', import.meta.url)), {
+        input: { ask: `pr land refusal for PR #${plan.result.pr}`, context: unitContext, prior: null },
+        quiet: true, pinChildUniverse: true, ...(deps.root ? { deps: { root: deps.root } } : {}),
+      }), timeout]);
+    } finally { if (timer) clearTimeout(timer); }
+  } catch (cause) { error = String(cause).slice(0, 300); run = undefined; }
+  const exit = run?.path?.at(-1) ?? null;
+  let output: Partial<PrLandRecoveryPlan> | undefined;
+  try {
+    const raw = run?.nodes?.find((n) => n.nodeId === 'plan')?.output;
+    const lines = typeof raw === 'string' ? raw.split('\n').map((l) => l.trim()).filter(Boolean) : [];
+    output = lines.length ? JSON.parse(lines.at(-1)!) as Partial<PrLandRecoveryPlan> : undefined;
+  } catch { output = undefined; }
+  // Trust only a run that reproduces the pinned plan and ends in the terminal the plan names.
+  const trusted = !error && !!output && output.outcome === plan.outcome && exit === plan.outcome
+    && output.result?.action === plan.result.action && output.result?.pr === plan.result.pr
+    && output.result?.head === plan.result.head && (output.result?.delayMs ?? null) === (plan.result.delayMs ?? null)
+    && output.evidence?.refusal === plan.evidence.refusal;
+  const executed: PrLandRecoveryPlan = trusted ? plan : {
+    outcome: 'needs-human',
+    result: { action: 'needs-human', pr: plan.result.pr, head: plan.result.head,
+      reason: `recover@1 execution untrusted (${error ?? `status ${run?.status ?? 'none'} exit ${exit ?? 'none'}`}); hand to a human` },
+    evidence: plan.evidence,
+  };
+  try {
+    recordJourneyEdge(route, route.to!, 'pr-land-refused; recover@1 executed; recovery-execution=graph-run', {
+      call, execution: 'graph-run', mergeSha: null,
+      evidence: { cardId, pr: plan.result.pr, head: plan.result.head, refusal: plan.evidence.refusal,
+        refusalLabel: plan.evidence.label, refusalRoute: plan.evidence.route },
+      recover: { outcome: executed.outcome, action: executed.result.action, reason: executed.result.reason, delayMs: executed.result.delayMs ?? null },
+      run: { runId: run?.runId ?? null, status: run?.status ?? null, path: run?.path ?? [], exit, trusted, ...(error ? { error } : {}) },
+    });
+    // A human owns every needs-human/failed exit — say so at warn level, with the same join keys.
+    if (executed.outcome !== 'rework') debug.log('pr.land', 'recover-needs-human', {
+      cardId, pr: plan.result.pr, head: plan.result.head, outcome: executed.outcome, reason: executed.result.reason, runId: run?.runId ?? null,
+    }, { level: 'warn' });
+  } catch { /* Observation must never replace the landing refusal. */ }
+  // «실행했다» 는 유닛이 실제로 돌아 런을 냈을 때만 — 예외·시간 초과는 결속만 남고 실행 0.
+  return { plan: executed, executed: run !== undefined };
+}

package/src/cli/pty-takeover-cli.ts

@@ -16,7 +16,7 @@ import { formatPtyWebAddress, ptyWebAddress, type PtyWebAddress } from './pty-we
 import { getHarnessRunId, normalizeRunIdSource, type RunIdSource } from '../harness/harness-space.js';
 import { inspectControlInbox, type ControlInboxSnapshot } from '../harness/control-inbox.js';
 import { requestRemotePtyControl, type PtyControlAction, type PtyControlPayload, type PtyControlRequestOptions, type PtyControlResult } from '../pty-shell/pty-control-ipc.js';
-import { resolvePtySpecialKey } from '../pty-shell/pty-special-keys.js';
+import { resolvePtySpecialKey, type PtyKeyEncoding } from '../pty-shell/pty-special-keys.js';
 import { encodeSgrMouse, mouseModeOffReason, type PtyMouseInput } from '../pty-shell/pty-mouse.js';
 import { resizePtyWithOutcome, writePtyWithOutcome, writePtyWithOutcomeDetail } from '../pty-shell/pty-write-outcome.js';
 import type { PtyControlTarget, PtyHandle } from '../pty-shell/registry.js';
@@ -2217,9 +2217,9 @@ export async function runPtyTextWhenIdle(ref: string, text: string, appendEnter:
   const typed = await runPtyText(ref, text, appendEnter, deps, actor);
   return { ...typed, message: `${waited.message}\n${typed.message}` };
 }
-export function runPtyKey(ref: string, key: string, repeat = 1, deps: PtyTakeoverCommandDeps = liveDeps, actor: PtyWriteActor = 'human'): Promise<PtyTakeoverCommandResult> {
+export function runPtyKey(ref: string, key: string, repeat = 1, deps: PtyTakeoverCommandDeps = liveDeps, actor: PtyWriteActor = 'human', encoding: PtyKeyEncoding = 'xterm'): Promise<PtyTakeoverCommandResult> {
   if (!Number.isInteger(repeat) || repeat < 1) return Promise.resolve({ exitCode: 1, message: 'pty key: repeat must be a positive integer' });
-  try { const normalized = key.trim().toLowerCase(); return inject(ref, 'input-key', resolvePtySpecialKey(normalized).repeat(repeat), { key: normalized, repeat }, deps, actor); } catch (error) { return Promise.resolve({ exitCode: 1, message: `pty key: ${(error as Error).message}` }); }
+  try { const normalized = key.trim().toLowerCase(); return inject(ref, 'input-key', resolvePtySpecialKey(normalized, { encoding }).repeat(repeat), { key: normalized, repeat, encoding }, deps, actor); } catch (error) { return Promise.resolve({ exitCode: 1, message: `pty key: ${(error as Error).message}` }); }
 }
 export async function runPtyMouse(ref: string, input: PtyMouseInput, deps: PtyTakeoverCommandDeps = liveDeps, actor: PtyWriteActor = 'human'): Promise<PtyTakeoverCommandResult> {
   let chars: string;
@@ -2369,14 +2369,15 @@ export function registerPtyTakeoverCommands(program: Command, deps: PtyTakeoverC
           : runPtyText(id, text, Boolean(opts.enter), deps, actor))
         : runPtyRemoteControl('text', id, remote, { action: 'input-text', chars: text + (opts.enter === true ? '\r' : '') }, deps));
     }));
-  pty.command('key <ref> <key>').option('-n, --repeat <count>', 'repetitions', '1').option('-r', 'inject a key on the default remote bookmark (does not take a value)').option('--remote <name>', 'inject a key on a named remote bookmark').option(...ACTOR_FLAG)
-    .description("Inject a named special key (enter/esc/tab/up/… · see 'pty list' for <ref>)").action((id: string, key: string, opts: { repeat: string; actor?: string; r?: boolean; remote?: string }) => run(() => {
+  pty.command('key <ref> <key>').option('-n, --repeat <count>', 'repetitions', '1').option('--kitty', 'send modifier combos (shift+enter …) as kitty CSI-u instead of xterm modifyOtherKeys').option('-r', 'inject a key on the default remote bookmark (does not take a value)').option('--remote <name>', 'inject a key on a named remote bookmark').option(...ACTOR_FLAG)
+    .description("Inject a named special key (enter/esc/tab/up/… · shift+enter / alt+enter / ctrl+enter combos · see 'pty list' for <ref>)").action((id: string, key: string, opts: { repeat: string; actor?: string; r?: boolean; remote?: string; kitty?: boolean }) => run(() => {
       const remote = opts.remote ?? (opts.r === true ? true : undefined);
+      const encoding: PtyKeyEncoding = opts.kitty === true ? 'kitty' : 'xterm';
       return withActor(opts, (actor) => {
-        if (remote === undefined) return runPtyKey(id, key, Number(opts.repeat), deps, actor);
+        if (remote === undefined) return runPtyKey(id, key, Number(opts.repeat), deps, actor, encoding);
         const repeat = Number(opts.repeat);
         if (!Number.isInteger(repeat) || repeat < 1) return Promise.resolve({ exitCode: 1, message: 'pty key: repeat must be a positive integer' });
-        try { return runPtyRemoteControl('key', id, remote, { action: 'input-key', chars: resolvePtySpecialKey(key.trim().toLowerCase()).repeat(repeat) }, deps); }
+        try { return runPtyRemoteControl('key', id, remote, { action: 'input-key', chars: resolvePtySpecialKey(key.trim().toLowerCase(), { encoding }).repeat(repeat) }, deps); }
         catch (error) { return Promise.resolve({ exitCode: 1, message: `pty key: ${(error as Error).message}` }); }
       });
     }));

package/src/cli/release-checklist-read-cli.ts

@@ -0,0 +1,79 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import type { Command } from 'commander';
+import { debug } from '../debug/log.js';
+import { getElanousConfigDirOverride } from '../elanous-config-dir.js';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { devVersion, listChecklist, ownerMatches, parseOwner, parityGap, summarizeChecklist } from '../release-loop/checklist.js';
+import { userConfigPath } from '../user-config.js';
+import { CliUserError } from './cli-user-error.js';
+import { writeStdoutJson } from './stdout-json.js';
+
+const SEMVER = /^\d+\.\d+\.\d+(?:-(?:rc|alpha|beta)\.\d+)?$/;
+export function isReleaseVersion(version: string): boolean { return SEMVER.test(version); }
+
+export function checklistCodenames(): Record<string, string> {
+  const path = getElanousConfigDirOverride() ? join(effectiveInstanceRoot(), 'config.json') : userConfigPath();
+  if (!existsSync(path)) return {};
+  const raw = JSON.parse(readFileSync(path, 'utf8')) as { release?: { codenames?: Record<string, string> } };
+  return raw.release?.codenames ?? {};
+}
+
+export function checklistVersion(input: string | undefined, codenames: Record<string, string>): string {
+  const v = input ?? devVersion().replace(/-dev\.\d+$/, '');
+  const resolved = isReleaseVersion(v) ? v : Object.entries(codenames).find(([, name]) => name === v)?.[0] ?? v;
+  if (!isReleaseVersion(resolved)) throw new CliUserError(`체크리스트 판 또는 별칭이 아니다: ${v}`);
+  return resolved;
+}
+
+export function readChecklistContext(cmd: Command): { version: string; codenames: Record<string, string>; json?: boolean } {
+  const opts = { ...(cmd.parent?.parent?.opts() as { version?: string; json?: boolean }), ...(cmd.parent?.opts() as { version?: string; json?: boolean }), ...(cmd.opts() as { version?: string; json?: boolean }) };
+  const codenames = checklistCodenames();
+  return { version: checklistVersion(opts.version, codenames), codenames, json: opts.json };
+}
+
+export async function checklistOutput(v: string, codenames: Record<string, string>, mode: 'list' | 'status', json?: boolean, owner?: string): Promise<void> {
+  if (owner !== undefined) parseOwner(owner);
+  const snapshot = listChecklist(v);
+  const data = owner === undefined ? snapshot : { ...snapshot, items: snapshot.items.filter((item) => ownerMatches(item.owner, owner)) };
+  const summary = summarizeChecklist(data);
+  const parity = data.items.flatMap((item) => {
+    const why = item.kind === 'screen' ? parityGap(item.evidence) : null;
+    return why ? [{ id: item.id, why }] : [];
+  });
+  const result = { ...data, codename: codenames[v] ?? '', ...summary, parity };
+  for (const { id, why } of parity) debug.log('release.checklist', 'parity-warning', { version: v, id, why });
+  if (json) { await writeStdoutJson(`${JSON.stringify(result)}\n`); return; }
+  console.log(`⚠ 짝 경고 ${parity.length}: ${parity.map(({ id }) => id).join(', ') || '없음'}`);
+  console.log(`${v}${result.codename ? ` (${result.codename})` : ''} · 공개 ${data.released || '없음'} · 개발 ${data.dev}`);
+  if (mode === 'list') {
+    for (const item of data.items) console.log(`${({ green: '🟢', yellow: '🟡', red: '🔴', done: '✅' } as const)[item.status]} ${item.id} ${item.title}${item.owner ? ` · ${item.owner}` : ''}${item.ceoMinutes !== undefined ? ` · 대표 손 ${item.ceoMinutes}분${item.ceoDate ? ` (${item.ceoDate})` : ''}` : ''}`);
+  } else {
+    console.log(`🟢 ${summary.green} · 🟡 ${summary.yellow} · 🔴 ${summary.red} · ✅ ${summary.done}`);
+    console.log(`🔴 칸: ${summary.blocked.join(', ') || '없음'}`);
+    console.log(`담당별: ${Object.entries(summary.byOwner).map(([owner, count]) => `${owner} ${count}`).join(' · ') || '없음'}`);
+  }
+}
+
+/** Register the same read commands on the full and lightweight release roots. */
+export function registerChecklistReadCommands(checklist: Command): void {
+  const withContext = (cmd: Command) => cmd.option('--version <v>', '판 또는 별칭').option('--json', '결과 JSON').option('--hq-override', '본부 임대 거부를 관측하며 수동 우회');
+  withContext(checklist.command('list').description('모든 칸')).option('--owner <owner>', '자리 또는 하위 자리로 거르기').action(async (opts: { owner?: string }, cmd: Command) => {
+    const { version, codenames, json } = readChecklistContext(cmd);
+    await checklistOutput(version, codenames, 'list', json, opts.owner);
+  });
+  withContext(checklist.command('status').description('상태 요약')).option('--owner <owner>', '자리 또는 하위 자리로 거르기').action(async (opts: { owner?: string }, cmd: Command) => {
+    const { version, codenames, json } = readChecklistContext(cmd);
+    await checklistOutput(version, codenames, 'status', json, opts.owner);
+  });
+}
+
+/** The light router enters only list/status, so no publishing modules are loaded. */
+export function registerReleaseChecklistReadCommands(program: Command): void {
+  const release = program.command('release').description('공개 배포 한 판 — prepare(로컬) → publish(--yes) → verify (docs/manual/MANUAL-versioning-and-release-2026-09-25.md)');
+  const checklist = release.command('checklist').description('판별 확인표 조회·갱신')
+    .option('--version <v>', '판 또는 별칭(기본: package.json 의 개발판에서 -dev.N 제거)')
+    .option('--json', '결과 JSON')
+    .option('--hq-override', '본부 임대 거부를 관측하며 수동 우회');
+  registerChecklistReadCommands(checklist);
+}