elanous 0.2.35 → 0.2.37

package/src/task-agent/green-close-recipe.ts

@@ -0,0 +1,239 @@
+import { chmodSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve, dirname } from 'node:path';
+import * as ts from 'typescript';
+import { boundaryMappingHash } from './boundary-proof-mapping.js';
+
+export type GreenCloseCommand = { ok: true; args: string[] } | { ok: false };
+
+/** A passing test proves code behavior; these two title clauses describe the whole cell's completion. */
+export function verifyGreenCloseBoundary(input: {
+  title: string; evidence: string; paths: string[]; changedPaths: string[];
+  cellId: string; mainSha: string; stateRoot: string; repoRoot: string; command: string;
+  mapRunId?: string; cardId?: string; graphRunId?: string; proofRef?: string;
+}): { outcome: 'pass' | 'hold'; reason: string; evidence: string[] } {
+  const code = /^\s*-?\s*완료 경계 코드:\s*(.+)$/m.exec(input.title)?.[1]?.trim();
+  const live = /^\s*-?\s*완료 경계 실물:\s*(.+)$/m.exec(input.title)?.[1]?.trim();
+  if (!code || !live) return { outcome: 'hold', reason: 'boundary-unproven', evidence: ['Completion code and live boundary lines are required'] };
+  const required = input.paths.filter((path) => !/\.test\.[cm]?[jt]sx?$/.test(path));
+  if (!required.length || required.some((path) => !input.changedPaths.includes(path)))
+    return { outcome: 'hold', reason: 'boundary-unproven', evidence: ['Candidate merge does not cover every declared production boundary path'] };
+  const parsed = parseGreenCloseEvidenceCommand(input.command);
+  const tests = parsed.ok ? parsed.args.filter((arg) => /\.test\.[cm]?[jt]sx?$/.test(arg)) : [];
+  if (!tests.length || required.some((path) => path.startsWith('/') || path.split('/').includes('..')))
+    return { outcome: 'hold', reason: 'boundary-unproven', evidence: ['Code boundary test paths are missing or invalid'] };
+  try {
+    for (const path of required.filter((value) => /\.[cm]?[jt]sx?$/.test(value))) {
+      const covered = tests.some((testPath) => {
+        const fullTestPath = resolve(input.repoRoot, testPath);
+        return analyzeProductionAssertion(readFileSync(fullTestPath, 'utf8'), fullTestPath,
+          [resolve(input.repoRoot, path)]).asserted;
+      });
+      if (!covered) throw new Error('boundary path has no commanded assertion');
+    }
+  } catch {
+    return { outcome: 'hold', reason: 'boundary-unproven', evidence: ['Commanded tests do not assert every declared production boundary path'] };
+  }
+  const ref = input.proofRef;
+  if (!ref || !input.graphRunId || !input.mapRunId || !input.cardId
+    || ref !== `boundary-proofs/${input.cellId}/${input.graphRunId}.json`)
+    return { outcome: 'hold', reason: 'boundary-unproven', evidence: ['Live boundary needs a proof produced by this graph and card'] };
+  try {
+    const root = realpathSync(input.stateRoot);
+    const proofPath = realpathSync(resolve(root, ref));
+    if (!proofPath.startsWith(root + '/')) throw new Error('proof outside state root');
+    const proof = JSON.parse(readFileSync(proofPath, 'utf8')) as Record<string, unknown>;
+    if (proof.schema !== 'green-close-boundary-proof/v1' || proof.cellId !== input.cellId
+      || proof.mainSha !== input.mainSha || proof.liveBoundary !== live
+      || proof.producer !== 'green-close-boundary-producer/v1' || proof.outcome !== 'pass'
+      || proof.exitCode !== 0 || proof.runId !== input.graphRunId || proof.graphRunId !== input.graphRunId
+      || proof.mapRunId !== input.mapRunId || proof.cardId !== input.cardId
+      || !boundaryMappingHash(input.title) || proof.mappingHash !== boundaryMappingHash(input.title))
+      throw new Error('proof identity or outcome mismatch');
+    return { outcome: 'pass', reason: 'boundary-proven', evidence: [`Completion code paths and live proof ${ref} match ${input.mainSha}`] };
+  } catch {
+    return { outcome: 'hold', reason: 'boundary-unproven', evidence: ['Live proof missing, outside state root, or does not match this cell and main SHA'] };
+  }
+}
+
+/** Parse the deliberately small evidence-command language. No shell syntax reaches a process. */
+export function parseGreenCloseEvidenceCommand(command: string): GreenCloseCommand {
+  if (!command || /[\r\n\u0000`$|<>;&(){}\\'"\\]/.test(command)) return { ok: false };
+  const tokens = command.trim().split(/\s+/);
+  if (tokens[0] !== 'bun' || tokens[1] !== 'test') return { ok: false };
+  const args: string[] = [];
+  let paths = 0;
+  for (let i = 2; i < tokens.length; i += 1) {
+    const token = tokens[i]!;
+    if (token === '-t') {
+      const value = tokens[++i];
+      if (!value || !/^[A-Za-z0-9_.:/-]+$/.test(value)) return { ok: false };
+      args.push(token, value);
+      continue;
+    }
+    if (token === '--timeout') {
+      const value = tokens[++i];
+      if (!value || !/^\d+$/.test(value) || Number(value) < 1) return { ok: false };
+      args.push(token, value);
+      continue;
+    }
+    if (token.startsWith('--timeout=')) {
+      const value = token.slice('--timeout='.length);
+      if (!/^\d+$/.test(value) || Number(value) < 1) return { ok: false };
+      args.push(token);
+      continue;
+    }
+    if (token.startsWith('-') || token.startsWith('/') || token.split('/').some((part) => part === '..')
+      || !/^[A-Za-z0-9_./-]+$/.test(token)) return { ok: false };
+    paths += 1;
+    args.push(token);
+  }
+  return paths > 0 ? { ok: true, args } : { ok: false };
+}
+
+function rootIdentifier(node: ts.Expression): string | undefined {
+  let current = node;
+  while (ts.isPropertyAccessExpression(current) || ts.isElementAccessExpression(current)) current = current.expression;
+  return ts.isIdentifier(current) ? current.text : undefined;
+}
+
+function containsAny(node: ts.Node, names: Set<string>, calls: Set<ts.Node>): boolean {
+  if (calls.has(node)) return true;
+  if (ts.isIdentifier(node) && names.has(node.text)) return true;
+  let found = false;
+  ts.forEachChild(node, (child) => { if (!found && containsAny(child, names, calls)) found = true; });
+  return found;
+}
+
+/** Reports whether a test calls a declared production entry and asserts on its result or a simple alias. */
+export function analyzeProductionAssertion(
+  source: string,
+  testPath: string,
+  productionPaths: readonly string[],
+): { called: boolean; asserted: boolean } {
+  const file = ts.createSourceFile(testPath, source, ts.ScriptTarget.Latest, true);
+  const normalize = (value: string) => value.replace(/\.(?:[cm]?[jt]sx?)$/i, '');
+  const declaredTargets = new Set(productionPaths.map((value) => normalize(resolve(value))));
+  const imported = new Set<string>();
+  const collectImports = (node: ts.Node) => {
+    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier) && node.moduleSpecifier.text.startsWith('.')) {
+      const resolved = normalize(resolve(dirname(resolve(testPath)), node.moduleSpecifier.text));
+      if (declaredTargets.has(resolved)) {
+        const clause = node.importClause;
+        if (clause?.name) imported.add(clause.name.text);
+        if (clause?.namedBindings && ts.isNamespaceImport(clause.namedBindings)) imported.add(clause.namedBindings.name.text);
+        if (clause?.namedBindings && ts.isNamedImports(clause.namedBindings)) {
+          for (const item of clause.namedBindings.elements) imported.add(item.name.text);
+        }
+      }
+    }
+    ts.forEachChild(node, collectImports);
+  };
+  collectImports(file);
+  if (!imported.size) return { called: false, asserted: false };
+
+  let called = false;
+  let asserted = false;
+  const inspectTest = (body: ts.Node) => {
+    const walkBlock = (root: ts.Node, visitor: (node: ts.Node) => void) => {
+      const walk = (node: ts.Node) => {
+        if (node !== root && ts.isCallExpression(node) && ts.isIdentifier(node.expression)
+          && ['test', 'it'].includes(node.expression.text)) return;
+        visitor(node);
+        ts.forEachChild(node, walk);
+      };
+      walk(root);
+    };
+    const productionCalls = new Set<ts.Node>();
+    const aliases = new Set<string>();
+    walkBlock(body, (node) => {
+      if ((ts.isCallExpression(node) || ts.isNewExpression(node)) && imported.has(rootIdentifier(node.expression) ?? '')) {
+        productionCalls.add(node);
+        called = true;
+      }
+    });
+    let addedAlias = true;
+    while (addedAlias) {
+      addedAlias = false;
+      walkBlock(body, (node) => {
+        if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer
+          && !aliases.has(node.name.text) && containsAny(node.initializer, aliases, productionCalls)) {
+          aliases.add(node.name.text);
+          addedAlias = true;
+        }
+      });
+    }
+
+    const isAssertion = (node: ts.CallExpression): ts.CallExpression | undefined => {
+      if (ts.isPropertyAccessExpression(node.expression) && ts.isCallExpression(node.expression.expression)
+        && rootIdentifier(node.expression.expression.expression) === 'expect') return node.expression.expression;
+      if (rootIdentifier(node.expression) === 'expect' || rootIdentifier(node.expression) === 'assert') return node;
+      return undefined;
+    };
+    walkBlock(body, (node) => {
+      if (ts.isCallExpression(node)) {
+        const assertion = isAssertion(node);
+        if (assertion && assertion.arguments.some((arg) => containsAny(arg, aliases, productionCalls))) asserted = true;
+      }
+    });
+  };
+
+  const visit = (node: ts.Node) => {
+    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && ['test', 'it'].includes(node.expression.text)) {
+      const callback = node.arguments.find((arg) => ts.isArrowFunction(arg) || ts.isFunctionExpression(arg));
+      if (callback) inspectTest(callback);
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(file);
+  return { called, asserted };
+}
+
+export function testAssertsProductionResult(source: string, testPath: string, productionPaths: readonly string[]): boolean {
+  return analyzeProductionAssertion(source, testPath, productionPaths).asserted;
+}
+
+function makeReadOnlyTree(root: string, originalModes: Map<string, number>): void {
+  originalModes.set(root, statSync(root).mode & 0o7777);
+  for (const entry of readdirSync(root, { withFileTypes: true })) {
+    if (entry.isSymbolicLink()) continue;
+    const path = join(root, entry.name);
+    const mode = statSync(path).mode & 0o7777;
+    originalModes.set(path, mode);
+    if (entry.isDirectory()) {
+      makeReadOnlyTree(path, originalModes);
+      chmodSync(path, mode & ~0o222);
+    } else chmodSync(path, mode & ~0o222);
+  }
+  chmodSync(root, (originalModes.get(root) ?? 0o755) & ~0o222);
+}
+
+function restoreTreeModes(originalModes: Map<string, number>): void {
+  for (const [path, mode] of [...originalModes].sort(([left], [right]) => left.length - right.length)) chmodSync(path, mode);
+}
+
+/** Run the allowlisted Bun test argv from a detached, read-only worktree and clean it up. */
+export function runGreenCloseEvidenceTest(repo: string, sha: string, args: string[], timeout = 900_000) {
+  const parent = mkdtempSync(join(tmpdir(), 'green-close-readonly-'));
+  const tree = join(parent, 'repo');
+  const originalModes = new Map<string, number>();
+  let added = false;
+  try {
+    const add = Bun.spawnSync(['git', '-C', repo, 'worktree', 'add', '--detach', tree, sha], { stdout: 'pipe', stderr: 'pipe' });
+    if (add.exitCode !== 0) return { exitCode: add.exitCode ?? 1, stdout: '', stderr: new TextDecoder().decode(add.stderr).slice(-1200), reason: 'readonly-worktree-create-failed' };
+    added = true;
+    const install = Bun.spawnSync(['bun', 'install', '--frozen-lockfile', '--ignore-scripts'], {
+      cwd: tree, stdout: 'pipe', stderr: 'pipe', timeout: 300_000, maxBuffer: 1_000_000,
+    });
+    if (install.exitCode !== 0) return { exitCode: install.exitCode ?? 1, stdout: new TextDecoder().decode(install.stdout).slice(-1200), stderr: new TextDecoder().decode(install.stderr).slice(-1200), reason: 'readonly-worktree-dependencies-unavailable' };
+    makeReadOnlyTree(tree, originalModes);
+    const run = Bun.spawnSync(['bun', 'test', ...args], { cwd: tree, stdout: 'pipe', stderr: 'pipe', timeout, maxBuffer: 4_000_000 });
+    return { exitCode: run.exitCode ?? 1, stdout: new TextDecoder().decode(run.stdout).slice(-1200), stderr: new TextDecoder().decode(run.stderr).slice(-1200), reason: 'completion-command-' + (run.exitCode === 0 ? 'passed' : 'failed') };
+  } finally {
+    if (added) {
+      try { restoreTreeModes(originalModes); } catch { /* worktree cleanup below reports failure if necessary */ }
+      Bun.spawnSync(['git', '-C', repo, 'worktree', 'remove', '--force', tree], { stdout: 'pipe', stderr: 'pipe' });
+    }
+    rmSync(parent, { recursive: true, force: true });
+  }
+}

package/src/task-agent/green-sweep.ts

@@ -39,22 +39,39 @@ export interface GreenSweepDecision {
 /** PR-body mentions are intentionally absent from this parser. */
 export function explicitEvidencePrs(evidence: string | undefined): number[] {
   const numbers = new Set<number>();
+  const refusedAcrossEvidence = new Set<number>();
+  const negated = /미착지|미병합|예정|계획|아님|않음|안\s*함|보류|대기|실패|불가|아직|미완료|누락|못\s*함|(?:착지|병합)\s*전|\b(?:not\s+(?:yet\s+)?(?:merged|landed)|unmerged|pending|planned)\b/i;
   for (const line of (evidence ?? '').split(/\r?\n/)) {
     // A previous refusal is diagnostic text, never new landing evidence.
     if (/^GREEN-FROM-LEDGER:/i.test(line) && !/· green ·/.test(line)) continue;
-    // A negated landing claim cannot establish this cell's PR ownership.
-    if (/미착지|미병합|예정|계획|아님|않음|안\s*함|보류|대기|실패|불가|아직|미완료|누락|못\s*함|(?:착지|병합)\s*전|\b(?:not\s+(?:yet\s+)?(?:merged|landed)|unmerged|pending|planned)\b/i.test(line)) continue;
-    // A PR number only counts when this cell's own evidence calls it landed.
-    for (const match of line.matchAll(/(?:착지|병합|merged|landed)\s*(?:PR\s*)?#(\d+)\b|(?:PR\s*)?#(\d+)\s*(?:착지|병합|merged|landed)(?=$|[^A-Za-z가-힣])/gi)) {
-      const number = Number(match[1] ?? match[2]);
-      if (Number.isSafeInteger(number) && number > 0) numbers.add(number);
+    // Scope a refusal to its own PR or named phase. An unbound refusal keeps
+    // the whole line ambiguous (for example "PR #123 착지 · 다른 PR 대기").
+    const clauses = line.split(/\s*·\s*|\s*;\s*|,\s*(?=(?:PR\s*)?#\d+\b)/);
+    const refused = new Set<number>();
+    let unboundRefusal = false;
+    for (const clause of clauses) {
+      if (!negated.test(clause)) continue;
+      const ids = [...clause.matchAll(/(?:PR\s*)?#(\d+)\b/gi)].map((match) => Number(match[1]));
+      if (ids.length === 0 && !/\b[CE]\d+\b/.test(clause)) unboundRefusal = true;
+      for (const id of ids) { refused.add(id); refusedAcrossEvidence.add(id); }
     }
-    for (const match of line.matchAll(/https?:\/\/github\.com\/[^/\s]+\/[^/\s]+\/pull\/(\d+)\b\s*(?:착지|병합|merged|landed)|(?:착지|병합|merged|landed)\s*https?:\/\/github\.com\/[^/\s]+\/[^/\s]+\/pull\/(\d+)\b/gi)) {
-      const number = Number(match[1] ?? match[2]);
-      if (Number.isSafeInteger(number) && number > 0) numbers.add(number);
+    if (unboundRefusal) continue;
+    // A PR number only counts when this cell's own evidence calls it landed.
+    for (const clause of clauses) {
+      if (negated.test(clause)) continue;
+      for (const match of clause.matchAll(/(?:착지|병합|merged|landed)\s*(?:PR\s*)?#(\d+)\b|(?:PR\s*)?#(\d+)\s*(?:착지|병합|merged|landed)(?=$|[^A-Za-z가-힣])/gi)) {
+        const number = Number(match[1] ?? match[2]);
+        if (Number.isSafeInteger(number) && number > 0 && !refused.has(number)) numbers.add(number);
+      }
+      for (const match of clause.matchAll(/https?:\/\/github\.com\/[^/\s]+\/[^/\s]+\/pull\/(\d+)\b\s*(?:착지|병합|merged|landed)|(?:착지|병합|merged|landed)\s*https?:\/\/github\.com\/[^/\s]+\/[^/\s]+\/pull\/(\d+)\b/gi)) {
+        const number = Number(match[1] ?? match[2]);
+        if (Number.isSafeInteger(number) && number > 0 && !refused.has(number)) numbers.add(number);
+      }
     }
   }
-  return [...numbers];
+  // Contradictory lines are not enough to establish ownership without an
+  // ordering proof. Keep them out of the candidate inventory altogether.
+  return [...numbers].filter((number) => !refusedAcrossEvidence.has(number));
 }
 
 export function greenSweepCandidates(item: ChecklistItem, version: string, cards: readonly TaskCard[]): GreenSweepCandidate[] {
@@ -101,6 +118,43 @@ export function appendGreenSweepEvidence(existing: string | undefined, line: str
   return `${before}${before && !before.endsWith('\n') ? '\n' : ''}${line}`;
 }
 
+/** Accept only the checklist's explicit Bun test command; never pass checklist text through a shell. */
+export function greenSweepEvidenceTestArgs(title: string): string[] | null {
+  const command = /^\s*-?\s*완료 경계 증거 명령:\s*bun test\s+([^\r\n]+)\s*$/m.exec(title)?.[1]?.trim();
+  if (!command) return null;
+  const args = command.split(/\s+/);
+  if (!args.length || args.some((arg) => !/^[A-Za-z0-9_./@-]+$/.test(arg) || arg.startsWith('-') || arg.split('/').includes('..'))) return null;
+  return args;
+}
+
+export type GreenSweepSnapshotWriter = (
+  version: string,
+  id: string,
+  patch: { status: 'green'; evidence: string },
+  by: string,
+  expected: Pick<ChecklistItem, 'title' | 'status' | 'evidence'>,
+) => unknown;
+
+/** Production write entrypoint. Only green decisions with main-tree E2 proof may mutate the ledger. */
+export function applyGreenSweepDecisions(
+  version: string,
+  decisions: readonly GreenSweepDecision[],
+  items: readonly ChecklistItem[],
+  mainEvidencePassed: ReadonlySet<string>,
+  write: GreenSweepSnapshotWriter,
+): Array<{ cell: string; written: boolean; reason?: string }> {
+  return decisions.map((decision) => {
+    if (decision.verdict !== 'green') return { cell: decision.cell, written: false, reason: `verdict-${decision.verdict}` };
+    if (!mainEvidencePassed.has(decision.cell)) return { cell: decision.cell, written: false, reason: 'main-evidence-not-passed' };
+    const item = items.find((entry) => entry.id === decision.cell);
+    if (!item || item.status !== 'yellow')
+      return { cell: decision.cell, written: false, reason: 'cell-snapshot-not-writable' };
+    write(version, item.id, { status: 'green', evidence: decision.plannedEvidence }, 'tasks-green-sweep',
+      { title: item.title, status: item.status, evidence: item.evidence });
+    return { cell: decision.cell, written: true };
+  });
+}
+
 /** A merge establishes ownership of a PR, not completion of a whole cell. */
 export function decideGreenSweep(input: {
   item: ChecklistItem;

package/src/task-agent/land-queue.ts

@@ -4,6 +4,7 @@ import { mkdirSync, readFileSync } from 'node:fs';
 import { dirname, isAbsolute, join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { parseReviewResultOutput } from './review-result-capture.js';
+import { executeBoundPrLandRecover, PR_LAND_CARD_ID_ENV } from '../cli/pr-land-recovery.js';
 
 type CommandResult = { status: number; stdout: string; stderr: string };
 export interface QueueLandingInput {
@@ -13,6 +14,8 @@ export interface QueueLandingInput {
 export interface QueueLandingDeps {
   run?: (command: string, args: string[], cwd: string, env?: NodeJS.ProcessEnv) => Promise<CommandResult>;
   read?: (path: string) => string;
+  /** LAND-REFUSAL-EXEC — observe a refusal on the recover@1 edge and run that unit once (never an effect). */
+  recover?: typeof executeBoundPrLandRecover;
 }
 
 async function run(command: string, args: string[], cwd: string, env?: NodeJS.ProcessEnv): Promise<CommandResult> {
@@ -31,14 +34,24 @@ export async function runQueuedLanding(input: QueueLandingInput, deps: QueueLand
   const invoke = deps.run ?? run;
   const read = deps.read ?? ((path: string) => readFileSync(path, 'utf8'));
   const fail = (stage: string, reason: string): CommandResult => ({ status: 1, stdout: '', stderr: `${stage}: ${reason.slice(-500)}` });
+  // LAND-REFUSAL-EXEC — a judged refusal (not an unmeasured prerequisite) is bound to recover@1 with this card
+  // and that unit runs once. The returned refusal is unchanged; recovery observation never replaces it.
+  const refuse = async (stage: string, reason: string): Promise<CommandResult> => {
+    const refused = fail(stage, reason);
+    try { await (deps.recover ?? executeBoundPrLandRecover)({ refusal: refused.stderr, pr: input.pr, head: input.head, cardId: input.card }, { root: dirname(input.statePath) }); }
+    catch { /* fail-soft */ }
+    return refused;
+  };
+  // The card rides along to every child that may land or record this PR (same env as TA defaultLand).
+  const cardEnv = (extra: Record<string, string> = {}): NodeJS.ProcessEnv => ({ ...process.env, ...extra, [PR_LAND_CARD_ID_ENV]: input.card });
   if (!/^[a-f0-9]{40}$/i.test(input.head) || !Number.isSafeInteger(input.pr) || input.pr < 1) return fail('input', 'invalid PR/head');
   if (!isAbsolute(input.command) || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(input.remote)) return fail('config', 'land queue command/remote invalid');
   let review: ReturnType<typeof parseReviewResultOutput>;
   try { review = parseReviewResultOutput(read(input.reviewResult)); }
-  catch (error) { return fail('review', String(error)); }
+  catch (error) { return refuse('review', String(error)); }
   if (!review || review.pr !== input.pr || review.head?.toLowerCase() !== input.head.toLowerCase()
     || review.reviewed !== true || !['pass', 'warn'].includes(review.verdict ?? '') || review.mustFix !== 0 || review.error) {
-    return fail('review', `exact head #${input.pr} ${input.head.slice(0, 12)} PASS/WARN mf0 not proven`);
+    return refuse('review', `exact head #${input.pr} ${input.head.slice(0, 12)} PASS/WARN mf0 not proven`);
   }
   const git = async (args: string[]) => invoke(process.execPath, [input.entry, '--config-dir', input.configDir, 'git', ...args], input.cwd);
   const fetched = await git(['fetch', '--quiet', 'origin', 'main']);
@@ -52,15 +65,15 @@ export async function runQueuedLanding(input: QueueLandingInput, deps: QueueLand
   const artifact = join(dirname(input.statePath), 'land-queue-gates', `${safeCard}-${input.pr}-${input.head.slice(0, 12)}-${randomUUID()}`);
   mkdirSync(artifact, { recursive: true });
   const gate = await invoke(process.execPath, [input.entry, '--config-dir', input.configDir,
-    'self', 'gate', '--changed', '--base', baseHead!, '--remote', input.remote, '--shards', '4', '--artifact-dir', artifact], input.cwd);
-  if (gate.status !== 0) return fail('remote-changed-gate', gate.stderr || gate.stdout || `exit ${gate.status}`);
+    'self', 'gate', '--changed', '--base', baseHead!, '--remote', input.remote, '--shards', '4', '--artifact-dir', artifact], input.cwd, cardEnv());
+  if (gate.status !== 0) return refuse('remote-changed-gate', gate.stderr || gate.stdout || `exit ${gate.status}`);
   let summary: Record<string, unknown>;
   try { summary = JSON.parse(read(join(artifact, 'summary.json'))) as Record<string, unknown>; }
   catch (error) { return fail('remote-changed-gate', `summary unreadable: ${String(error)}`); }
   if (summary.head40 !== input.head || summary.base40 !== baseHead || summary.remoteHost !== input.remote
     || summary.verdict !== 'passed' || summary.exitCode !== 0 || summary.introduced !== 0
     || summary.unknown !== 0 || summary.preconditionUnmet !== 0) {
-    return fail('remote-changed-gate', 'summary does not prove this head/base/remote passed with zero unknown');
+    return refuse('remote-changed-gate', 'summary does not prove this head/base/remote passed with zero unknown');
   }
   const fresh = await invoke('gh', ['pr', 'view', String(input.pr), '--json', 'headRefOid,state,isDraft'], input.cwd);
   let latest: { headRefOid?: unknown; state?: unknown; isDraft?: unknown };
@@ -68,12 +81,12 @@ export async function runQueuedLanding(input: QueueLandingInput, deps: QueueLand
   catch { return fail('pr-head', `current PR state unreadable: ${fresh.stderr || fresh.stdout || fresh.status}`); }
   if (fresh.status !== 0 || latest.state !== 'OPEN' || latest.isDraft !== false
     || typeof latest.headRefOid !== 'string' || latest.headRefOid.toLowerCase() !== input.head.toLowerCase()) {
-    return fail('pr-head', `PR #${input.pr} changed after gate or is not ready`);
+    return refuse('pr-head', `PR #${input.pr} changed after gate or is not ready`);
   }
   const enrolled = await invoke(input.command, [String(input.pr), input.cwd, '--review', input.reviewResult, '--expected-head', input.head], input.cwd,
-    { ...process.env, LAND_RR_DIR: dirname(input.reviewResult) });
+    cardEnv({ LAND_RR_DIR: dirname(input.reviewResult) }));
   if (enrolled.status !== 0 || !new RegExp(`^OK #${input.pr} head=${input.head.slice(0, 12)}(?:\\s|$)`, 'm').test(enrolled.stdout)) {
-    return fail('land-enqueue-refused', enrolled.stdout || enrolled.stderr || `exit ${enrolled.status}`);
+    return refuse('land-enqueue-refused', enrolled.stdout || enrolled.stderr || `exit ${enrolled.status}`);
   }
   return { status: 0, stdout: `queued #${input.pr} head ${input.head.slice(0, 12)} gate ${artifact} · ${enrolled.stdout.slice(-250)}`, stderr: '' };
 }

package/src/task-agent/live-moves.ts

@@ -26,11 +26,12 @@ import { debug } from '../debug/log.js';
 import { findGitDir } from '../git-fs/locate.js';
 import { getUserConfig, userConfigPath } from '../user-config.js';
 import type { DetachedSpawn } from '../cli/tasks-cli.js';
-import { LIVE_MOVE_HISTORY_EVENT, shellQuote, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
+import { LIVE_MOVE_HISTORY_EVENT, cardPrNumber, shellQuote, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
 import { reconcileHandMergedCard } from './postland-card.js';
+import { advanceLandedPieceMission } from './mission.js';
 import { resolveParentHosts, type ParentHostConfig } from './parent-host.js';
 import { LIVE_RETRY_MOVES } from './judge.js';
-import { decisionCardGrounds, decisionRaiseArgs, type DecisionCardEvidence, type NextAction } from './actions.js';
+import { decisionCardGrounds, decisionRaiseArgs, ownerWorktreeHarvestState, type DecisionCardEvidence, type NextAction } from './actions.js';
 import { pendingReviewResults, reviewResultPath, TA_REVIEW_COMPLETION_CARD_ENV, TA_REVIEW_COMPLETION_RESULT_ENV, TA_REVIEW_COMPLETION_STATE_ENV } from './review-result-capture.js';
 import { buildPriorFixContext, PRIOR_FIX_SCOPE_LINE, priorFixBlock, priorFixObservation, type PriorDiffReader, type PriorFixContext } from './review-prior-fix.js';
 import { createLandWorktree, localBranch, localHead, observeLandWorktree, type LandWorktree, type LandWorktreeFailure, type LandWorktreeInput, type LandWorktreeRemoval } from './land-worktree.js';
@@ -87,13 +88,15 @@ export interface LiveMoveDeps {
   requestReview?: (pr: number, intent: string, cwd?: string, capture?: { resultPath: string }) => Promise<void>;
   /** REVIEW-CONVERGE-PRIOR-FIX — 같은 PR 재리뷰의 직전 머리 → 지금 머리 diff(시험 주입 · 기본 = `git diff --numstat`). */
   priorDiff?: PriorDiffReader;
+  /** Read-only owner worktree harvest probe; injected only in tests. */
+  harvestGit?: (cwd: string, args: string[]) => { status: number | null; stdout: string };
   /** Fresh PR head and draft flag for landing; separate from the unchanged review lookup. */
   landPrHead?: (pr: number, cwd: string) => Promise<(PrHeadView & { isDraft: boolean }) | null>;
   /** TA-CARD-MERGE-RECONCILE — MERGED PR 의 merge SHA·base·mergedAt 관측(시험 주입 · 기본 = `gh pr view`). */
   handMergePr?: (pr: number, cwd: string) => Promise<HandMergePrView | null>;
   /** One existing pr land operation; inject in tests instead of invoking the CLI. */
   /** TA-REJUDGE-ON-HEAD — `opts.overlapEvidence` 가 있으면 `pr land --overlap-evidence <file>` 로 넘긴다(없으면 종전 인자). */
-  land?: (pr: number, head: string, cwd: string, opts?: { overlapEvidence?: string }) => Promise<{ status: number; stdout: string; stderr?: string }>;
+  land?: (pr: number, head: string, cwd: string, opts?: { overlapEvidence?: string; cardId?: string }) => Promise<{ status: number; stdout: string; stderr?: string }>;
   /** `decision-card` — `decisions raise` 한 번(시험 주입 · 기본 = 같은 우주의 CLI 자식). */
   raiseDecision?: (args: string[]) => Promise<{ status: number; stdout: string; stderr?: string }>;
   log?: (category: string, event: string, data: Record<string, unknown>) => void;
@@ -102,6 +105,8 @@ export interface LiveMoveDeps {
   /** TA-LAND-AFTER-REVIEW — injected queue adapter; absent uses configured command after a remote changed gate. */
   queueLanding?: (input: QueueLandingInput) => Promise<{ status: number; stdout: string; stderr?: string }>;
   landQueueConfig?: { command: string; remote: string } | null;
+  /** Confirmed direct landing wakes successor pieces; tests inject an observation-only seam. */
+  advanceLandedPiece?: (pieceId: string, statePath: string) => Promise<unknown>;
 }
 
 /** `executed` = 부작용을 실제로 냈다(리뷰를 띄웠다 · 제안을 적었다). ok 이지만 이미 한 수(같은 머리·이미 제안)면 false. */
@@ -280,13 +285,16 @@ export function liveLandArgs(entry: string, configDir: string, pr: number, head:
 }
 
 /** The CLI owns the freeze, gate and merge checks; no direct gh merge or bypass flags. */
-export async function defaultLand(pr: number, head: string, cwd: string, opts: { overlapEvidence?: string } = {}): Promise<{ status: number; stdout: string; stderr?: string }> {
+export async function defaultLand(pr: number, head: string, cwd: string, opts: { overlapEvidence?: string; cardId?: string } = {}): Promise<{ status: number; stdout: string; stderr?: string }> {
   const { ELANOUS_CLI_ENTRY } = await import('../cli/tasks-cli.js');
   const { getElanousConfigDirOverride } = await import('../elanous-config-dir.js');
   const { effectiveInstanceRoot } = await import('../instance/resolve.js');
   const args = liveLandArgs(ELANOUS_CLI_ENTRY, getElanousConfigDirOverride() ?? effectiveInstanceRoot(), pr, head, cwd, opts.overlapEvidence);
+  const cardEnv = opts.cardId ? { [(await import('../cli/pr-land-recovery.js')).PR_LAND_CARD_ID_ENV]: opts.cardId } : undefined;
   return new Promise((resolveResult, reject) => {
-    const child = spawn(process.execPath, args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+    // LAND-REFUSAL-EDGES — the card rides along so a refusal row can be bound to this card (observation only).
+    const env = cardEnv ? { ...process.env, ...cardEnv } : undefined;
+    const child = spawn(process.execPath, args, { cwd, stdio: ['ignore', 'pipe', 'pipe'], ...(env ? { env } : {}) });
     let stdout = '';
     let stderr = '';
     child.stdout.on('data', (chunk: Buffer) => { stdout = (stdout + chunk.toString()).slice(-300); });
@@ -379,7 +387,8 @@ function observe(deps: LiveMoveDeps, result: LiveMoveResult): LiveMoveResult {
 /** `review` — PR 머리마다 한 번. 카드에 먼저 적고(잠금 안) 그다음 띄운다 · 띄우기 실패는 카드에 오류로 남기고 같은 머리는 다시 안 띄운다. */
 export async function executeLiveReview(
   card: TaskCard | undefined, pr: number | undefined,
-  ctx: { runId: string | null; stopReason: string; cwd?: string; forceNewReview?: boolean; produced?: { headCommit?: string; branch?: string; prUrl?: string } },
+  ctx: { runId: string | null; stopReason: string; cwd?: string; forceNewReview?: boolean; ownerHarvestHead?: string;
+    ownerHarvestAncestor?: (cwd: string, owner: string, head: string) => boolean; produced?: { headCommit?: string; branch?: string; prUrl?: string } },
   deps: LiveMoveDeps = {},
 ): Promise<LiveMoveResult> {
   const kind = 'review' as const;
@@ -404,7 +413,49 @@ export async function executeLiveReview(
   const withRepo = (result: LiveMoveResult): LiveMoveResult => reviewRepo ? { ...result, reviewRepo } : result;
   if (!head) return observe(deps, withRepo({ kind, executed: false, card: card.id, ok: false, detail: `PR #${pr} head unknown` }));
   if (head.state !== 'OPEN') return observe(deps, withRepo({ kind, executed: false, card: card.id, ok: false, detail: `PR #${pr} is ${head.state}` }));
+  if (ctx.ownerHarvestHead) {
+    const owner = ctx.ownerHarvestHead;
+    const same = head.head.toLowerCase() === owner.toLowerCase();
+    let descendant = false;
+    if (!same && cwd && /^[a-f0-9]{40}$/i.test(owner)) {
+      try {
+        descendant = (ctx.ownerHarvestAncestor ?? ((dir: string, ancestor: string, newer: string) => {
+          const git = deps.harvestGit ?? ((repo: string, args: string[]) => {
+            const result = spawnSync('git', args, { cwd: repo, encoding: 'utf8', timeout: 10_000 });
+            return { status: result.status, stdout: String(result.stdout ?? '') };
+          });
+          return git(dir, ['merge-base', '--is-ancestor', ancestor, newer]).status === 0;
+        }))(cwd, owner, head.head);
+      } catch { /* Unverified ancestry must not start a review. */ }
+    }
+    if (!/^[a-f0-9]{40}$/i.test(owner) || !head.url || typeof card.pr !== 'object'
+      || card.pr.number !== pr || !card.pr.url || head.url.replace(/\/+$/, '').toLowerCase() !== card.pr.url.replace(/\/+$/, '').toLowerCase()
+      || (!same && !descendant)) {
+      return observe(deps, withRepo({ kind, executed: false, card: card.id, ok: true,
+        detail: `PR #${pr} head ${head.head.slice(0, 12)} awaits owner-worktree-commit ${owner.slice(0, 12)} · next: wait for harvest` }));
+    }
+  }
+  // The PR head still trails this PR branch's registered owner checkout: review that head only after harvest.
+  const harvestState = cwd && head.branch ? ownerWorktreeHarvestState({ pr, cwd, head: head.head, branch: head.branch, state: head.state }, deps.harvestGit) : undefined;
   const path = deps.statePath ?? taskAgentStatePath();
+  const boundUrl = typeof card.pr === 'object' ? card.pr.url : undefined;
+  const samePrUrl = !!boundUrl && !!head.url && boundUrl.replace(/\/+$/, '').toLowerCase() === head.url.replace(/\/+$/, '').toLowerCase();
+  if (harvestState && samePrUrl && !!ctx.runId) {
+    const detail = `review skipped: owner-worktree-commit PR #${pr} ${harvestState.head} · next: wait for harvest and exact-head review`;
+    let bound = false;
+    try {
+      updateTaskCard(path, card.id, current => {
+        if (!current || current.status !== 'launched' || cardPrNumber(current) !== pr || current.runId !== ctx.runId
+          || typeof current.pr !== 'object' || current.pr.url !== boundUrl) return undefined;
+        bound = true;
+        if (current.history.some(item => item.event === 'review-skipped-harvest' && item.pr === pr
+          && item.head === harvestState.head && item.runId === ctx.runId)) return undefined;
+        return { ...current, history: [...current.history, { at: (deps.now ?? (() => new Date()))().toISOString(), event: 'review-skipped-harvest',
+          pr, head: harvestState.head, ...(ctx.runId ? { runId: ctx.runId } : {}), effect: 'wait', detail }] };
+      });
+    } catch { bound = false; }
+    if (bound) return observe(deps, withRepo({ kind, executed: false, card: card.id, ok: true, detail }));
+  }
   const at = (deps.now ?? (() => new Date()))().toISOString();
   // TA-REVIEW-RESULT-CAPTURE — 머리마다 한 번이라 경로도 머리마다 하나다. 요청 칸에 먼저 적는다(회수가 이 칸을 본다).
   const resultPath = ctx.forceNewReview
@@ -660,8 +711,13 @@ export async function executeLiveLand(
         const settled = reconcileHandMergedCard({ number: pr, url: hand.url ?? view.url ?? '', headRefOid: view.head, state: 'MERGED',
           baseRefName: hand.baseRefName ?? 'main', mergedAt: hand.mergedAt ?? '', mergeCommit: hand.mergeCommit },
           cwd, deps.statePath ? { statePath: deps.statePath } : {});
-        if (settled.outcome === 'reconciled')
+        if (settled.outcome === 'reconciled') {
+          const path = deps.statePath ?? taskAgentStatePath();
+          try { await (deps.advanceLandedPiece ?? ((pieceId, statePath) => advanceLandedPieceMission(pieceId, { statePath })))(card.id, path); }
+          catch (error) { try { (deps.log ?? ((c, e, d) => debug.log(c, e, d)))('task-agent', 'mission-auto-advance-error',
+            { card: card.id, pr, error: String(error).slice(0, 250) }); } catch { /* fail-soft */ } }
           return withRepo(observe(deps, { kind, card: card.id, ok: true, executed: true, detail: `PR #${pr} 손 병합 정산 — card ${settled.status} (merge ${settled.mergeSha.slice(0, 12)})` }));
+        }
       }
     }
     return reject(card.id, `PR #${pr} is ${view.state}`, reviewRepo);
@@ -802,8 +858,8 @@ export async function executeLiveLand(
         entry: (await import('../cli/tasks-cli.js')).ELANOUS_CLI_ENTRY,
         configDir: (await import('../elanous-config-dir.js')).getElanousConfigDirOverride() ?? (await import('../instance/resolve.js')).effectiveInstanceRoot() })
       : overlapEvidence
-        ? await (deps.land ?? defaultLand)(pr, view.head, landCwd, { overlapEvidence })
-        : await (deps.land ?? defaultLand)(pr, view.head, landCwd);
+        ? await (deps.land ?? defaultLand)(pr, view.head, landCwd, { overlapEvidence, cardId: card.id })
+        : await (deps.land ?? defaultLand)(pr, view.head, landCwd, { cardId: card.id });
     ok = outcome.status === 0;
     detail = (ok ? outcome.stdout || `${queueConfig ? 'queued' : 'land merged'} #${pr} head ${view.head.slice(0, 12)}` : outcome.stderr || outcome.stdout || `exit ${outcome.status}`).slice(-300);
     if (!ok) failure = classifyLandFailure(outcome);
@@ -857,6 +913,11 @@ export async function executeLiveLand(
     return observe(deps, withRepo({ kind, card: card.id, ok: false, executed: true, landAttempt,
       detail: `land ${ok ? 'succeeded' : 'failed'} but card update failed: ${String(error).slice(-230)}` }));
   }
+  if (ok && !queueConfig) {
+    try { await (deps.advanceLandedPiece ?? ((pieceId, statePath) => advanceLandedPieceMission(pieceId, { statePath })))(card.id, path); }
+    catch (error) { try { (deps.log ?? ((c, e, d) => debug.log(c, e, d)))('task-agent', 'mission-auto-advance-error',
+      { card: card.id, pr, error: String(error).slice(0, 250) }); } catch { /* fail-soft */ } }
+  }
   return observe(deps, withRepo({ kind, card: card.id, ok, executed: true, detail, landAttempt, ...(queueConfig && ok ? { queued: true } : {}) }));
 }