elanous 0.2.35 → 0.2.37

package/src/cli/pr-granularity.ts

@@ -76,7 +76,7 @@ export interface OverlapEntry {
 }
 
 /** Restrict `git log` to commits already on the resolved base, excluding HEAD-only feature commits. */
-export function landingHistoryLogArgs(since: string, baseRef: string): string[] {
+export function landingHistoryLogArgs(since: string | null, baseRef: string): string[] {
   return landingHistoryGitLogArgs(since, baseRef).map((arg) =>
     arg === '--pretty=format:commit %H' ? landingHistoryPrettyFormat() : arg,
   );
@@ -381,9 +381,11 @@ export function countRecentLandingsByAuthor(
 export function collectBaseLandingCommits(
   run: CmdRunner,
   cwd: string,
-  opts: { since?: string; baseRef: string },
+  opts: { since?: string | null; baseRef: string },
 ): LandingCommit[] | null {
-  const since = opts.since?.trim() || DEFAULT_GRANULARITY_SINCE;
+  const since = opts.since === null
+    ? null
+    : opts.since?.trim() || DEFAULT_GRANULARITY_SINCE;
   const history = run('git', landingHistoryLogArgs(since, opts.baseRef), { cwd });
   if (!history.ok) return null;
   return parseCommitNameLog(history.out);

package/src/cli/pr-land-base-read.ts

@@ -1,7 +1,16 @@
 import type { CmdRunner } from '../autopilot/pr-manager.js';
 
 export const PR_LAND_BASE_READ_RETRIES = 2;
-export const PR_LAND_BASE_READ_RETRY_DELAY_MS = 100;
+/** Increasing backoff: 1s after the first unreadable read, 3s after the second (OPT #24215). */
+export const PR_LAND_BASE_READ_RETRY_DELAYS_MS = [1_000, 3_000] as const;
+/** Fixed ceiling: no retry sleep ever exceeds the last scheduled delay. */
+export const PR_LAND_BASE_READ_RETRY_DELAY_CAP_MS = 3_000;
+
+/** Backoff for the sleep that follows `attempt`; the schedule stops growing at the cap. */
+export function prLandBaseReadRetryDelayMs(attempt: number): number {
+  const index = Math.min(Math.max(attempt, 1), PR_LAND_BASE_READ_RETRY_DELAYS_MS.length) - 1;
+  return Math.min(PR_LAND_BASE_READ_RETRY_DELAYS_MS[index], PR_LAND_BASE_READ_RETRY_DELAY_CAP_MS);
+}
 
 export interface PrBaseReadResult {
   baseRefName: string | null;
@@ -30,7 +39,7 @@ export async function readPrBaseNameWithRetry(input: {
 
     if (baseRefName !== null) return { baseRefName, attempts: attempt };
     input.onUnreadable?.(attempt, viewed.err);
-    if (attempt <= PR_LAND_BASE_READ_RETRIES) await input.sleep(PR_LAND_BASE_READ_RETRY_DELAY_MS);
+    if (attempt <= PR_LAND_BASE_READ_RETRIES) await input.sleep(prLandBaseReadRetryDelayMs(attempt));
   }
   return { baseRefName: null, attempts: PR_LAND_BASE_READ_RETRIES + 1 };
 }

package/src/cli/pr-land-heavy-remote.ts

@@ -8,8 +8,11 @@ import { debug, redactSecretText } from '../debug/log.js';
 import { gateRemoteHostCap, realGateRemoteRunner, resolveGateRemoteSettings, runOnRemote, type GateRemoteRunner, type RemoteRunOutcome } from '../self-implement/gate-remote.js';
 
 const SHA = /^[0-9a-f]{40}$/i;
-// WSL is excluded until its push permissions and gate environment are proven stable.
-export const PR_LAND_HEAVY_HOSTS = ['node-b', 'node-c'] as const;
+// WSL still lands last: its gate environment was repaired (WSL-GATE-ENV, 2026-10-17 — baselineWorkspaceRoot in
+// scripts/ci-typecheck-changed.ts now picks the host disk /var/tmp instead of WSL's 20GiB tmpfs), so the host is
+// allowlisted as the third slot while node-b/node-c keep discovery order — the recorded host order stays part of the
+// evidence contract.
+export const PR_LAND_HEAVY_HOSTS = ['node-b', 'node-c', 'host-e-wsl'] as const;
 export const PR_LAND_HEAVY_HOST = PR_LAND_HEAVY_HOSTS[0];
 export type PrLandHeavyHost = typeof PR_LAND_HEAVY_HOSTS[number];
 const allowedHost = (host: string): host is PrLandHeavyHost => PR_LAND_HEAVY_HOSTS.some((candidate) => candidate === host);
@@ -234,7 +237,7 @@ export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemo
       // A completed run or infrastructure failure is a verdict. Only a full host slot asks for another host.
       if (outcome.kind !== 'busy') break wait;
     }
-    // Both allowlisted hosts were busy. Wait the same slotWaitSeconds window as self gate, then retry.
+    // Every allowlisted host was busy. Wait the same slotWaitSeconds window as self gate, then retry.
     debug.log('pr.land', 'host-busy', { host: selectedHost, occupied: outcome.occupied ?? null, slotWaitSeconds: settings.slotWaitSeconds });
     const left = deadline - now();
     if (left <= 0) break;

package/src/cli/pr-land-overlap-evidence.ts

@@ -189,6 +189,7 @@ function lastReviewRecord(text: string): Record<string, unknown> | undefined {
 function hasResolvedPriorDeclaration(review: Record<string, unknown> | undefined): boolean {
   if (!review) return false;
   const value = review.resolvedPrior;
+  if (value === true) return true;
   if (Array.isArray(value) && value.length > 0) return true;
   if (value && typeof value === 'object' && Object.keys(value).length > 0) return true;
   return [review.intent, review.intentBlock, review.reviewIntent, review.reviewIntentBlock]
@@ -199,8 +200,21 @@ function normalizedFinding(value: string): string {
   return value.trim().replace(/\s+/g, ' ').toLowerCase();
 }
 
+// `status open` / `status pending` in prose counts the same as `status: pending` in a field.
+const UNRESOLVED_STATUS = /^(?:open|unresolved|pending|in[- ]progress)$/i;
+
 function containsUnresolvedClaim(value: string): boolean {
-  return /\b(?:unresolved|not(?:\s+yet)?[\s-]+resolved|not(?:\s+yet)?[\s-]+fixed|not(?:\s+yet)?[\s-]+addressed|still[\s-]+open|remains?[\s-]+open|still[\s-]+present|status\s*[:=]\s*(?:open|unresolved|pending|in[- ]progress))\b/i.test(value);
+  return /\b(?:unresolved|not(?:\s+yet)?[\s-]+resolved|not(?:\s+yet)?[\s-]+fixed|not(?:\s+yet)?[\s-]+addressed|still[\s-]+open|remains?[\s-]+open|still[\s-]+present|status\s*(?:[:=]\s*|\s+)(?:open|unresolved|pending|in[- ]progress))\b/i.test(value);
+}
+
+/** A record cannot claim resolution while carrying its own OPEN/PENDING status — refuse both fields. */
+function unresolvedStatusDeclared(record: Record<string, unknown>): boolean {
+  if (record.resolved === false) return true;
+  return ['status', 'resolutionStatus', 'resolution']
+    .some((key) => {
+      const value = record[key];
+      return typeof value === 'string' && UNRESOLVED_STATUS.test(value.trim());
+    });
 }
 
 function containsUnresolvedDeclaration(value: unknown): boolean {
@@ -208,7 +222,7 @@ function containsUnresolvedDeclaration(value: unknown): boolean {
   if (Array.isArray(value)) return value.some(containsUnresolvedDeclaration);
   if (!value || typeof value !== 'object') return false;
   const record = value as Record<string, unknown>;
-  if (record.resolved === false || (typeof record.status === 'string' && /^(?:open|unresolved|pending|in[- ]progress)$/i.test(record.status))) return true;
+  if (unresolvedStatusDeclared(record)) return true;
   return Object.values(record).some(containsUnresolvedDeclaration);
 }
 
@@ -233,11 +247,16 @@ function reviewAttemptExplicitlyResolved(input: VerifyOverlapEvidenceInput, sele
   if (findings.length === 0) return false;
 
   const declared = selected.resolvedPrior;
-  if (declared !== undefined && containsUnresolvedDeclaration(declared)) return false;
+  if (declared !== undefined && declared !== false && containsUnresolvedDeclaration(declared)) return false;
   const intentBlocks = [selected.intent, selected.intentBlock, selected.reviewIntent, selected.reviewIntentBlock]
     .filter((value): value is string => typeof value === 'string');
   // A resolution in one field cannot override an OPEN/PENDING declaration in another.
   if (intentBlocks.some(containsUnresolvedClaim)) return false;
+  // Contradiction axis 1 (structured): the record declares the prior attempt resolved while a
+  // separate lifecycle field still says open/pending — neither claim can be trusted, so refuse.
+  const declaresResolution = (declared !== undefined && declared !== false)
+    || intentBlocks.some((intent) => /^resolved prior review findings:\s*$/im.test(intent));
+  if (declaresResolution && unresolvedStatusDeclared(selected)) return false;
 
   let resolved: string[] = [];
   if (Array.isArray(declared)) {
@@ -261,7 +280,7 @@ function reviewAttemptExplicitlyResolved(input: VerifyOverlapEvidenceInput, sele
       if (ref !== undefined && !referencesReview(ref, failedPath)) continue;
       if (item.head !== undefined && (typeof item.head !== 'string' || item.head.toLowerCase() !== head)) continue;
       if (item.headCommit !== undefined && (typeof item.headCommit !== 'string' || item.headCommit.toLowerCase() !== head)) continue;
-      if (item.resolved === false || item.status === 'unresolved'
+      if (unresolvedStatusDeclared(item)
         || Object.values(item).some((value) => typeof value === 'string' && containsUnresolvedClaim(value))) continue;
       const listed = findingList(item.mustFix ?? item.resolvedMustFix ?? item.findings ?? item.axes ?? item.finding ?? item.axis);
       if (listed.some(containsUnresolvedClaim)) continue;

package/src/cli/pr-land-recovery.ts

@@ -1,5 +1,10 @@
 import { classifyPrLandRefusal } from './pr-land-refusal.js';
-import { readJourneyEdge } from '../self-dev/graph-journey-route.js';
+import { readJourneyEdge, recordJourneyEdge } from '../self-dev/graph-journey-route.js';
+import { GRAPH_SPECS } from '../self-implement/graph-templates.js';
+import { debug } from '../debug/log.js';
+
+/** The task card that launched this `pr land` (TA `defaultLand` sets it). Observation only. */
+export const PR_LAND_CARD_ID_ENV = 'ELANOUS_PR_LAND_CARD_ID';
 
 /** A recover unit selects a next action. The train or TA still owns every effect. */
 export interface PrLandRecoveryContext {
@@ -62,3 +67,114 @@ export function planPrLandRecoveryForEntry(context: PrLandRecoveryContext, entry
     evidence: plan.evidence,
   };
 }
+
+/** LAND-REFUSAL-EDGES — bind one observed landing refusal to the declared recover@1 edge.
+ *  The row carries the raw refusal, card, PR, head and the read-only plan. It never retries,
+ *  merges or requests anything: `execution: 'none'` and `mergeSha: null` are part of the row. */
+export function bindPrLandRefusalToRecover(context: PrLandRecoveryContext & { cardId?: string }): PrLandRecoveryPlan {
+  const plan = planPrLandRecovery(context);
+  try {
+    if (!plan.result.pr || !plan.result.head) return plan;
+    const route = readJourneyEdge('merge', 'land-refused');
+    const node = route.to ? GRAPH_SPECS['self-implement']?.nodes.find((n) => n.nodeId === route.to) : undefined;
+    const call = node?.kind === 'subgraph' ? node.call ?? null : null;
+    const cardId = typeof context.cardId === 'string' && context.cardId.trim() ? context.cardId.trim() : null;
+    const reason = 'pr-land-refused; recover@1 bound; recovery-execution=none';
+    // Only a declared recover@1 subgraph is a binding. A fallback edge (e.g. merge → cleanup) is not.
+    if (route.source !== 'graph' || route.on !== 'recovery' || call !== 'recover@1') {
+      debug.log('self-implement', 'graph-edge-unresolved', { from: 'merge', label: 'land-refused', to: route.to, call, reason });
+      return plan;
+    }
+    recordJourneyEdge(route, route.to!, reason, {
+      call, execution: 'none', mergeSha: null,
+      evidence: { cardId, pr: plan.result.pr, head: plan.result.head, refusal: plan.evidence.refusal,
+        refusalLabel: plan.evidence.label, refusalRoute: plan.evidence.route },
+      recover: { outcome: plan.outcome, action: plan.result.action, reason: plan.result.reason, delayMs: plan.result.delayMs ?? null },
+    });
+  } catch { /* Observation must never replace the landing refusal. */ }
+  return plan;
+}
+
+type RecoverRun = { runId?: string; status?: string; path?: readonly string[]; nodes?: ReadonlyArray<{ nodeId?: string; output?: unknown }> };
+export interface PrLandRecoveryExecution {
+  /** The plan the caller may act on. An untrusted or failed run is replaced by a needs-human plan. */
+  plan: PrLandRecoveryPlan;
+  /** True only when the declared recover@1 binding existed and the unit was run. */
+  executed: boolean;
+}
+
+/** LAND-REFUSAL-EXEC — bind one refusal (row `execution: 'none'`), then run the existing recover@1 unit
+ *  (graphs/units/recover.yaml · read-only `cmd:recover-plan`) for one step to the terminal the unit selects,
+ *  and record that run on the same edge keys with `execution: 'graph-run'`. A run that does not reproduce the
+ *  pinned plan fails closed to `needs-human`. It still never retries, requests, merges or enqueues. */
+/** recover@1 한 단계 실행의 시간 한도 — 운영 TA 착지 틱이 매달린 유닛에 붙잡히지 않게(넘으면 fail-closed needs-human). */
+export const PR_LAND_RECOVER_TIMEOUT_MS = 60_000;
+
+export async function executeBoundPrLandRecover(
+  context: PrLandRecoveryContext & { cardId?: string },
+  deps: { root?: string; timeoutMs?: number; runGraph?: (path: string, options: { input: unknown; quiet?: boolean; pinChildUniverse?: boolean; deps?: { root?: string } }) => Promise<RecoverRun> } = {},
+): Promise<PrLandRecoveryExecution> {
+  const plan = bindPrLandRefusalToRecover(context);
+  let route: ReturnType<typeof readJourneyEdge>;
+  let call: string | null;
+  try {
+    route = readJourneyEdge('merge', 'land-refused');
+    const node = route.to ? GRAPH_SPECS['self-implement']?.nodes.find((n) => n.nodeId === route.to) : undefined;
+    call = node?.kind === 'subgraph' ? node.call ?? null : null;
+  } catch { return { plan, executed: false }; }
+  // Same admission as the binding: pinned identity and a declared recover@1 subgraph edge.
+  if (!plan.result.pr || !plan.result.head || route.source !== 'graph' || route.on !== 'recovery' || call !== 'recover@1') return { plan, executed: false };
+  const cardId = typeof context.cardId === 'string' && context.cardId.trim() ? context.cardId.trim() : null;
+  const unitContext = { refusal: context.refusal, pr: plan.result.pr, head: plan.result.head, ...(context.isDraft === undefined ? {} : { isDraft: context.isDraft }) };
+  let run: RecoverRun | undefined;
+  let error: string | undefined;
+  try {
+    const runGraph = deps.runGraph ?? (await import('../graph-runner/runner.js')).runGraph;
+    const { fileURLToPath } = await import('node:url');
+    const limitMs = deps.timeoutMs ?? PR_LAND_RECOVER_TIMEOUT_MS;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const timeout = new Promise<never>((_, reject) => {
+      timer = setTimeout(() => reject(new Error(`recover@1 timeout after ${limitMs}ms`)), limitMs);
+      (timer as { unref?: () => void }).unref?.();
+    });
+    try {
+      run = await Promise.race([runGraph(fileURLToPath(new URL('../../graphs/units/recover.yaml', import.meta.url)), {
+        input: { ask: `pr land refusal for PR #${plan.result.pr}`, context: unitContext, prior: null },
+        quiet: true, pinChildUniverse: true, ...(deps.root ? { deps: { root: deps.root } } : {}),
+      }), timeout]);
+    } finally { if (timer) clearTimeout(timer); }
+  } catch (cause) { error = String(cause).slice(0, 300); run = undefined; }
+  const exit = run?.path?.at(-1) ?? null;
+  let output: Partial<PrLandRecoveryPlan> | undefined;
+  try {
+    const raw = run?.nodes?.find((n) => n.nodeId === 'plan')?.output;
+    const lines = typeof raw === 'string' ? raw.split('\n').map((l) => l.trim()).filter(Boolean) : [];
+    output = lines.length ? JSON.parse(lines.at(-1)!) as Partial<PrLandRecoveryPlan> : undefined;
+  } catch { output = undefined; }
+  // Trust only a run that reproduces the pinned plan and ends in the terminal the plan names.
+  const trusted = !error && !!output && output.outcome === plan.outcome && exit === plan.outcome
+    && output.result?.action === plan.result.action && output.result?.pr === plan.result.pr
+    && output.result?.head === plan.result.head && (output.result?.delayMs ?? null) === (plan.result.delayMs ?? null)
+    && output.evidence?.refusal === plan.evidence.refusal;
+  const executed: PrLandRecoveryPlan = trusted ? plan : {
+    outcome: 'needs-human',
+    result: { action: 'needs-human', pr: plan.result.pr, head: plan.result.head,
+      reason: `recover@1 execution untrusted (${error ?? `status ${run?.status ?? 'none'} exit ${exit ?? 'none'}`}); hand to a human` },
+    evidence: plan.evidence,
+  };
+  try {
+    recordJourneyEdge(route, route.to!, 'pr-land-refused; recover@1 executed; recovery-execution=graph-run', {
+      call, execution: 'graph-run', mergeSha: null,
+      evidence: { cardId, pr: plan.result.pr, head: plan.result.head, refusal: plan.evidence.refusal,
+        refusalLabel: plan.evidence.label, refusalRoute: plan.evidence.route },
+      recover: { outcome: executed.outcome, action: executed.result.action, reason: executed.result.reason, delayMs: executed.result.delayMs ?? null },
+      run: { runId: run?.runId ?? null, status: run?.status ?? null, path: run?.path ?? [], exit, trusted, ...(error ? { error } : {}) },
+    });
+    // A human owns every needs-human/failed exit — say so at warn level, with the same join keys.
+    if (executed.outcome !== 'rework') debug.log('pr.land', 'recover-needs-human', {
+      cardId, pr: plan.result.pr, head: plan.result.head, outcome: executed.outcome, reason: executed.result.reason, runId: run?.runId ?? null,
+    }, { level: 'warn' });
+  } catch { /* Observation must never replace the landing refusal. */ }
+  // «실행했다» 는 유닛이 실제로 돌아 런을 냈을 때만 — 예외·시간 초과는 결속만 남고 실행 0.
+  return { plan: executed, executed: run !== undefined };
+}

package/src/cli/pty-takeover-cli.ts

@@ -16,7 +16,7 @@ import { formatPtyWebAddress, ptyWebAddress, type PtyWebAddress } from './pty-we
 import { getHarnessRunId, normalizeRunIdSource, type RunIdSource } from '../harness/harness-space.js';
 import { inspectControlInbox, type ControlInboxSnapshot } from '../harness/control-inbox.js';
 import { requestRemotePtyControl, type PtyControlAction, type PtyControlPayload, type PtyControlRequestOptions, type PtyControlResult } from '../pty-shell/pty-control-ipc.js';
-import { resolvePtySpecialKey } from '../pty-shell/pty-special-keys.js';
+import { resolvePtySpecialKey, type PtyKeyEncoding } from '../pty-shell/pty-special-keys.js';
 import { encodeSgrMouse, mouseModeOffReason, type PtyMouseInput } from '../pty-shell/pty-mouse.js';
 import { resizePtyWithOutcome, writePtyWithOutcome, writePtyWithOutcomeDetail } from '../pty-shell/pty-write-outcome.js';
 import type { PtyControlTarget, PtyHandle } from '../pty-shell/registry.js';
@@ -2217,9 +2217,9 @@ export async function runPtyTextWhenIdle(ref: string, text: string, appendEnter:
   const typed = await runPtyText(ref, text, appendEnter, deps, actor);
   return { ...typed, message: `${waited.message}\n${typed.message}` };
 }
-export function runPtyKey(ref: string, key: string, repeat = 1, deps: PtyTakeoverCommandDeps = liveDeps, actor: PtyWriteActor = 'human'): Promise<PtyTakeoverCommandResult> {
+export function runPtyKey(ref: string, key: string, repeat = 1, deps: PtyTakeoverCommandDeps = liveDeps, actor: PtyWriteActor = 'human', encoding: PtyKeyEncoding = 'xterm'): Promise<PtyTakeoverCommandResult> {
   if (!Number.isInteger(repeat) || repeat < 1) return Promise.resolve({ exitCode: 1, message: 'pty key: repeat must be a positive integer' });
-  try { const normalized = key.trim().toLowerCase(); return inject(ref, 'input-key', resolvePtySpecialKey(normalized).repeat(repeat), { key: normalized, repeat }, deps, actor); } catch (error) { return Promise.resolve({ exitCode: 1, message: `pty key: ${(error as Error).message}` }); }
+  try { const normalized = key.trim().toLowerCase(); return inject(ref, 'input-key', resolvePtySpecialKey(normalized, { encoding }).repeat(repeat), { key: normalized, repeat, encoding }, deps, actor); } catch (error) { return Promise.resolve({ exitCode: 1, message: `pty key: ${(error as Error).message}` }); }
 }
 export async function runPtyMouse(ref: string, input: PtyMouseInput, deps: PtyTakeoverCommandDeps = liveDeps, actor: PtyWriteActor = 'human'): Promise<PtyTakeoverCommandResult> {
   let chars: string;
@@ -2369,14 +2369,15 @@ export function registerPtyTakeoverCommands(program: Command, deps: PtyTakeoverC
           : runPtyText(id, text, Boolean(opts.enter), deps, actor))
         : runPtyRemoteControl('text', id, remote, { action: 'input-text', chars: text + (opts.enter === true ? '\r' : '') }, deps));
     }));
-  pty.command('key <ref> <key>').option('-n, --repeat <count>', 'repetitions', '1').option('-r', 'inject a key on the default remote bookmark (does not take a value)').option('--remote <name>', 'inject a key on a named remote bookmark').option(...ACTOR_FLAG)
-    .description("Inject a named special key (enter/esc/tab/up/… · see 'pty list' for <ref>)").action((id: string, key: string, opts: { repeat: string; actor?: string; r?: boolean; remote?: string }) => run(() => {
+  pty.command('key <ref> <key>').option('-n, --repeat <count>', 'repetitions', '1').option('--kitty', 'send modifier combos (shift+enter …) as kitty CSI-u instead of xterm modifyOtherKeys').option('-r', 'inject a key on the default remote bookmark (does not take a value)').option('--remote <name>', 'inject a key on a named remote bookmark').option(...ACTOR_FLAG)
+    .description("Inject a named special key (enter/esc/tab/up/… · shift+enter / alt+enter / ctrl+enter combos · see 'pty list' for <ref>)").action((id: string, key: string, opts: { repeat: string; actor?: string; r?: boolean; remote?: string; kitty?: boolean }) => run(() => {
       const remote = opts.remote ?? (opts.r === true ? true : undefined);
+      const encoding: PtyKeyEncoding = opts.kitty === true ? 'kitty' : 'xterm';
       return withActor(opts, (actor) => {
-        if (remote === undefined) return runPtyKey(id, key, Number(opts.repeat), deps, actor);
+        if (remote === undefined) return runPtyKey(id, key, Number(opts.repeat), deps, actor, encoding);
         const repeat = Number(opts.repeat);
         if (!Number.isInteger(repeat) || repeat < 1) return Promise.resolve({ exitCode: 1, message: 'pty key: repeat must be a positive integer' });
-        try { return runPtyRemoteControl('key', id, remote, { action: 'input-key', chars: resolvePtySpecialKey(key.trim().toLowerCase()).repeat(repeat) }, deps); }
+        try { return runPtyRemoteControl('key', id, remote, { action: 'input-key', chars: resolvePtySpecialKey(key.trim().toLowerCase(), { encoding }).repeat(repeat) }, deps); }
         catch (error) { return Promise.resolve({ exitCode: 1, message: `pty key: ${(error as Error).message}` }); }
       });
     }));

package/src/cli/release-checklist-read-cli.ts

@@ -1,10 +1,11 @@
 import { existsSync, readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
 import { join } from 'node:path';
 import type { Command } from 'commander';
 import { debug } from '../debug/log.js';
 import { getElanousConfigDirOverride } from '../elanous-config-dir.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
-import { devVersion, listChecklist, ownerMatches, parseOwner, parityGap, summarizeChecklist } from '../release-loop/checklist.js';
+import { checklistEvidenceChain, devVersion, listChecklist, ownerMatches, parseOwner, parityGap, summarizeChecklist, type ChecklistEvidenceStage } from '../release-loop/checklist.js';
 import { userConfigPath } from '../user-config.js';
 import { CliUserError } from './cli-user-error.js';
 import { writeStdoutJson } from './stdout-json.js';
@@ -55,8 +56,102 @@ export async function checklistOutput(v: string, codenames: Record<string, strin
   }
 }
 
+export type ChecklistEvidenceReader = (item: ReturnType<typeof listChecklist>['items'][number], version: string) => readonly ChecklistEvidenceStage[];
+
+export type ChecklistEvidenceCommandRunner = (command: string, args: string[], timeout?: number) => { status: number | null; stdout: string; stderr: string; error?: string };
+const evidenceCommand: ChecklistEvidenceCommandRunner = (command, args, timeout = 20_000) => {
+  const result = spawnSync(command, args, { cwd: process.cwd(), encoding: 'utf8', timeout, maxBuffer: 4 * 1024 * 1024 });
+  return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '', ...(result.error ? { error: result.error.message } : {}) };
+}
+
+function evidenceJson(stdout: string): Record<string, unknown> | null {
+  for (const line of stdout.split(/\r?\n/u).reverse()) {
+    const start = line.indexOf('{');
+    if (start < 0) continue;
+    try { return JSON.parse(line.slice(start)) as Record<string, unknown>; } catch { /* try another complete JSON line */ }
+  }
+  return null;
+}
+
+export function collectChecklistEvidenceStages(item: ReturnType<typeof listChecklist>['items'][number], run: ChecklistEvidenceCommandRunner = evidenceCommand): ChecklistEvidenceStage[] {
+  const measuredAt = new Date().toISOString();
+  const evidence = item.evidence ?? '';
+  const prRefs = [...new Set([...evidence.matchAll(/(?:^|\s)#(\d{1,8})\b/gu)].map((match) => match[1]!))];
+  const pr = prRefs.length === 1 ? prRefs[0] : undefined;
+  const prLine = pr ? evidence.split(/\r?\n/u).find((line) => new RegExp(`(?:^|\\s)#${pr}\\b`).test(line)) : undefined;
+  const e1: ChecklistEvidenceStage = { id: 'E1', state: 'missing', source: 'checklist evidence + eln gh pr view', measuredAt,
+    reason: prRefs.length > 1 ? '근거에서 교차할 PR이 하나로 좁혀지지 않는다' : '근거에 병합 PR 번호가 없다' };
+  let mergeSha: string | null = null;
+  if (pr) {
+    const view = run('eln', ['gh', 'pr', 'view', pr, '--json', 'state,mergeCommit']);
+    const record = view.status === 0 ? evidenceJson(view.stdout) : null;
+    if (!record) { e1.state = 'unmeasurable'; e1.reason = `PR #${pr} 조회 실패${view.error ? `: ${view.error}` : ''}`; }
+    else if (record.state !== 'MERGED') { e1.reason = `PR #${pr} 상태가 MERGED가 아니다`; }
+    else {
+      const commit = record.mergeCommit && typeof record.mergeCommit === 'object' ? (record.mergeCommit as { oid?: unknown }).oid : null;
+      mergeSha = typeof commit === 'string' && /^[a-f0-9]{40}$/i.test(commit) ? commit : null;
+      if (!mergeSha) { e1.state = 'unmeasurable'; e1.reason = `PR #${pr} 조회에 유효한 merge SHA가 없다`; }
+      else if (!prLine || !new RegExp(`\\b${mergeSha}\\b`, 'i').test(prLine)) { e1.reason = `병합 PR #${pr}와 merge SHA가 같은 근거 줄에서 결속되지 않았다`; e1.source = `eln gh pr view #${pr} → ${mergeSha}`; }
+      else { e1.state = 'observed'; e1.reason = `PR #${pr} MERGED 및 merge SHA가 근거와 일치한다`; e1.source = `eln gh pr view #${pr} → ${mergeSha}`; }
+    }
+  }
+
+  const e3: ChecklistEvidenceStage = { id: 'E3', state: 'unmeasurable', source: null, measuredAt, reason: mergeSha ? '설치본 pin을 조회하지 못했다' : 'E1 merge SHA가 없어 조상 관계를 검사할 수 없다' };
+  if (mergeSha) {
+    const pin = run('eln', ['--version']);
+    const pinSha = pin.stdout.match(/\b[a-f0-9]{40}\b/i)?.[0];
+    if (!pinSha) e3.reason = `eln --version에서 설치본 SHA를 읽지 못했다${pin.error ? `: ${pin.error}` : ''}`;
+    else {
+      const repoRoot = run('git', ['rev-parse', '--show-toplevel']);
+      const origin = run('git', ['remote', 'get-url', 'origin']);
+      const pinObject = run('git', ['cat-file', '-e', `${pinSha}^{commit}`]);
+      const repoUrl = origin.stdout.trim().replace(/^git@github\.com:/i, 'https://github.com/').replace(/\.git$/i, '').replace(/\/$/u, '').toLowerCase();
+      const expectedRepo = 'https://github.com/elanvitalai/elanous';
+      if (repoRoot.status !== 0 || !repoRoot.stdout.trim() || origin.status !== 0 || repoUrl !== expectedRepo || pinObject.status !== 0) {
+        e3.reason = '현재 git 저장소가 elanous 원본이 아니거나 설치본 pin 객체가 없어 조상 관계를 판정할 수 없다';
+      } else {
+      const ancestry = run('git', ['merge-base', '--is-ancestor', mergeSha, pinSha]);
+      e3.source = `eln --version ${pinSha}; git -C ${repoRoot.stdout.trim()} merge-base --is-ancestor ${mergeSha} ${pinSha}`;
+      if (ancestry.status === 0) { e3.state = 'observed'; e3.reason = '설치본 pin이 merge SHA의 후손이다'; }
+      else if (ancestry.status === 1) { e3.state = 'missing'; e3.reason = '설치본 pin이 merge SHA의 후손이 아니다'; }
+      else { e3.reason = `설치본 저장소에서 조상 관계를 검사할 수 없다${ancestry.error ? `: ${ancestry.error}` : ''}`; }
+      }
+    }
+  }
+
+  const runId = /\b(run-[a-f0-9]{8}-[a-f0-9-]{27,})\b/i.exec(evidence)?.[1]
+    ?? /\b([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})\b/i.exec(evidence)?.[1];
+  const event = /(?:event|이벤트)\s*[:=]\s*([A-Za-z0-9_.:-]+)/iu.exec(evidence)?.[1];
+  const verificationCommand = /(?:완료 경계 증거 명령|증거 명령|verification command)\s*[:=]\s*([^\r\n]+)/iu.exec(`${item.title}\n${evidence}`)?.[1]?.trim() ?? null;
+  const e4: ChecklistEvidenceStage = { id: 'E4', state: 'missing', source: null, measuredAt, verificationCommand, reason: '근거에 runId·event·원문 검증 명령이 모두 필요하다' };
+  if (runId && event && verificationCommand) {
+    const logs = run('eln', ['logs', '--grep', runId, '--since', '365d', '--all', '--include-test', '--limit', '1000', '--json'], 30_000);
+    if (logs.status !== 0) { e4.state = 'unmeasurable'; e4.reason = `runId 로그 조회 실패${logs.error ? `: ${logs.error}` : ''}`; }
+    else {
+      const rows = logs.stdout.split(/\r?\n/u).flatMap((line) => { try { return [JSON.parse(line) as Record<string, unknown>]; } catch { return []; } });
+      const truncated = rows.length >= 1000 || rows.some((row) => row._meta && typeof row._meta === 'object' && (row._meta as { limitReached?: unknown }).limitReached === true);
+      const observed = rows.some((row) => {
+        if (row.event !== event || typeof row.data !== 'string') return false;
+        try { return (JSON.parse(row.data) as { runId?: unknown }).runId === runId; } catch { return false; }
+      });
+      e4.source = `eln logs --grep ${runId} --since 365d --all --include-test --limit 1000 --json (event=${event})`;
+      if (observed) { e4.state = 'observed'; e4.reason = `같은 runId의 ${event} 실물 이벤트를 찾았다`; }
+      else if (truncated) { e4.state = 'unmeasurable'; e4.reason = '로그 결과가 잘려 사건 부재를 판정할 수 없다'; }
+      else { e4.reason = `같은 runId의 ${event} 이벤트가 없다`; }
+    }
+  }
+
+  const acceptance = /- 완료 경계 실물:([^\r\n]+)/u.exec(item.title)?.[1]?.trim();
+  const e5Observed = Boolean(acceptance && evidence.includes(acceptance));
+  const e5: ChecklistEvidenceStage = { id: 'E5', state: e5Observed ? 'observed' : 'missing', source: 'checklist title/evidence exact acceptance-text comparison', measuredAt,
+    reason: e5Observed ? '완료 경계 실물 문구가 기록된 근거와 일치한다' : '완료 경계 실물 문구와 일치하는 근거가 없다' };
+  return [
+    e1, e3, e4, e5,
+  ];
+}
+
 /** Register the same read commands on the full and lightweight release roots. */
-export function registerChecklistReadCommands(checklist: Command): void {
+export function registerChecklistReadCommands(checklist: Command, evidenceReader: ChecklistEvidenceReader = collectChecklistEvidenceStages): void {
   const withContext = (cmd: Command) => cmd.option('--version <v>', '판 또는 별칭').option('--json', '결과 JSON').option('--hq-override', '본부 임대 거부를 관측하며 수동 우회');
   withContext(checklist.command('list').description('모든 칸')).option('--owner <owner>', '자리 또는 하위 자리로 거르기').action(async (opts: { owner?: string }, cmd: Command) => {
     const { version, codenames, json } = readChecklistContext(cmd);
@@ -66,14 +161,24 @@ export function registerChecklistReadCommands(checklist: Command): void {
     const { version, codenames, json } = readChecklistContext(cmd);
     await checklistOutput(version, codenames, 'status', json, opts.owner);
   });
+  withContext(checklist.command('evidence [id]').description('칸의 단계별 실물 근거 사슬 조회·PR 참조 추가'))
+    .action(async (id: string | undefined, _opts: unknown, cmd: Command) => {
+      const { version, json } = readChecklistContext(cmd);
+      if (!id) throw new CliUserError('조회할 칸 id를 지정하라');
+      if (!json) throw new CliUserError('evidence 조회는 --json 이 필요하다');
+      const item = listChecklist(version).items.find((row) => row.id === id);
+      if (!item) throw new CliUserError(`없는 칸: ${id}`);
+      const result = checklistEvidenceChain({ item, version, stages: evidenceReader(item, version) });
+      await writeStdoutJson(`${JSON.stringify(result)}\n`);
+    });
 }
 
 /** The light router enters only list/status, so no publishing modules are loaded. */
-export function registerReleaseChecklistReadCommands(program: Command): void {
+export function registerReleaseChecklistReadCommands(program: Command, evidenceReader: ChecklistEvidenceReader = collectChecklistEvidenceStages): void {
   const release = program.command('release').description('공개 배포 한 판 — prepare(로컬) → publish(--yes) → verify (docs/manual/MANUAL-versioning-and-release-2026-09-25.md)');
   const checklist = release.command('checklist').description('판별 확인표 조회·갱신')
     .option('--version <v>', '판 또는 별칭(기본: package.json 의 개발판에서 -dev.N 제거)')
     .option('--json', '결과 JSON')
     .option('--hq-override', '본부 임대 거부를 관측하며 수동 우회');
-  registerChecklistReadCommands(checklist);
+  registerChecklistReadCommands(checklist, evidenceReader);
 }