elanous 0.2.36 → 0.2.37

package/src/task-agent/map-reduce.ts

@@ -0,0 +1,158 @@
+/**
+ * MAPREDUCE-FANOUT backend. Inventory and card execution are ports so the CLI can
+ * bind the existing checklist/draft readers and tasks hand Pod launcher separately.
+ * A run snapshots its inventory before any card starts; one terminal row belongs
+ * to each item. This module never changes a checklist or closes a PR.
+ */
+import { randomUUID } from 'node:crypto';
+import { debug } from '../debug/log.js';
+import {
+  appendMapRunRow, createMapRun, readMapRun, reduceMapRun,
+  type MapRecipe, type MapRowKind, type MapRunRow, type MapRunStart,
+} from './map-run-ledger.js';
+
+export type MapSource = 'landed-but-yellow' | 'drafts';
+export interface MapItem { id: string }
+export interface MapInventory<T extends MapItem> {
+  items: readonly T[];
+  complete: boolean;
+  snapshotTime: string;
+  snapshotRef: string;
+  recipeSha: string;
+  mainSha: string;
+  checklistSnapshotPath: string | null;
+  requestedPool: string;
+  selectedPool: string | null;
+  imageCommit: string | null;
+  /** A failed inventory is recorded as a suppressed HOLD row. */
+  reason?: string;
+}
+export interface MapCard {
+  id: string;
+  itemId: string;
+  mapRunId: string;
+  recipe: MapRecipe;
+  text: string;
+}
+export interface MapContext {
+  mapRunId: string;
+  recipe: MapRecipe;
+  source: MapSource;
+  dryRun: boolean;
+}
+export interface MapPorts<T extends MapItem> {
+  inventory: (recipe: MapRecipe, source: MapSource, limit: number | undefined) => Promise<MapInventory<T>>;
+  /** Pure card authoring. Do not persist or launch here. */
+  buildCard: (item: T, context: MapContext) => MapCard;
+  /** Production adapter must launch through tasks hand and wait for its terminal recipe result. */
+  launchCard: (card: MapCard, item: T, context: MapContext) => Promise<MapRunRow>;
+  /** Optional pure preview; default dry-run yields a HOLD without invoking launchCard. */
+  previewCard?: (card: MapCard, item: T, context: MapContext) => MapRunRow | Promise<MapRunRow>;
+  log?: (event: string, data: Record<string, unknown>) => void;
+}
+export interface MapRequest {
+  recipe: MapRecipe;
+  source: MapSource;
+  limit?: number;
+  concurrency?: number;
+  dryRun?: boolean;
+  root?: string;
+  mapRunId?: string;
+}
+export interface MapResult { mapRunId: string; expected: number; observed: number; dryRun: boolean }
+
+const validPairs: Readonly<Record<MapRecipe, MapSource>> = {
+  'green-close': 'landed-but-yellow', 'draft-close': 'drafts',
+};
+const idPattern = /^[A-Za-z0-9][A-Za-z0-9_-]{0,95}$/;
+
+function checkPositive(value: number | undefined, label: string): void {
+  if (value !== undefined && (!Number.isSafeInteger(value) || value < 1)) throw new Error(`map ${label} must be a positive integer`);
+}
+function hold(context: MapContext, itemId: string | null, reason: string, suppressed = false): MapRunRow {
+  return { event: 'row', mapRunId: context.mapRunId, itemId, recipe: context.recipe,
+    kind: 'hold', verdict: 'hold', reason, evidence: [], ...(suppressed ? { rowsSuppressed: true, pr: null } : {}) };
+}
+function record(log: MapPorts<MapItem>['log'], event: string, data: Record<string, unknown>): void {
+  try { (log ?? ((name, fields) => debug.log('task-agent.map-reduce', name, fields)))(event, data); }
+  catch { /* diagnostics must not turn a completed item into a failed one */ }
+}
+
+/** Bounded workers, with no unbounded Promise.all fanout. Default is a read-only preview. */
+export async function mapInventory<T extends MapItem>(request: MapRequest, ports: MapPorts<T>): Promise<MapResult> {
+  if (validPairs[request.recipe] !== request.source) throw new Error('map recipe/source mismatch');
+  checkPositive(request.limit, 'limit');
+  checkPositive(request.concurrency, 'concurrency');
+  const concurrency = request.concurrency ?? 2;
+  const dryRun = request.dryRun !== false;
+  const mapRunId = request.mapRunId ?? `map-${randomUUID()}`;
+  if (!idPattern.test(mapRunId)) throw new Error('map invalid run id');
+  const context: MapContext = { mapRunId, recipe: request.recipe, source: request.source, dryRun };
+  const inventory = await ports.inventory(request.recipe, request.source, request.limit);
+  // A limit is a selection boundary, not permission to silently truncate a partial inventory.
+  const items = inventory.complete ? inventory.items.slice(0, request.limit) : [];
+  const start: MapRunStart = { event: 'start', mapRunId, recipe: request.recipe,
+    recipeSha: inventory.recipeSha, snapshotTime: inventory.snapshotTime, snapshotRef: inventory.snapshotRef,
+    mainSha: inventory.mainSha, checklistSnapshotPath: inventory.checklistSnapshotPath,
+    inventoryComplete: inventory.complete, itemIds: items.map((item) => item.id),
+    requestedPool: inventory.requestedPool, selectedPool: inventory.selectedPool,
+    imageCommit: inventory.imageCommit, dryRun };
+  createMapRun(start, request.root);
+  record(ports.log, 'start', { mapRunId, recipe: request.recipe, source: request.source, count: items.length, concurrency, dryRun });
+  if (!inventory.complete) {
+    appendMapRunRow(hold(context, null, inventory.reason || 'inventory-incomplete', true), request.root);
+    record(ports.log, 'inventory-hold', { mapRunId, reason: inventory.reason ?? 'inventory-incomplete' });
+    return { mapRunId, expected: 0, observed: 1, dryRun };
+  }
+  let next = 0;
+  let observed = 0;
+  async function worker(): Promise<void> {
+    while (next < items.length) {
+      const item = items[next++]!;
+      let row: MapRunRow;
+      try {
+        const card = ports.buildCard(item, context);
+        if (!card || !idPattern.test(card.id) || card.itemId !== item.id || card.mapRunId !== mapRunId
+          || card.recipe !== request.recipe || !card.text.trim()) throw new Error('card identity mismatch');
+        row = dryRun
+          ? ports.previewCard ? await ports.previewCard(card, item, context) : hold(context, item.id, 'dry-run-preview')
+          : await ports.launchCard(card, item, context);
+        if (row.mapRunId !== mapRunId || row.itemId !== item.id || row.recipe !== request.recipe)
+          throw new Error('result identity mismatch');
+        row = { ...row, result: { ...row.result, cardId: card.id } };
+      } catch (error) {
+        row = hold(context, item.id, `map-item-failed: ${error instanceof Error ? error.message : String(error)}`);
+      }
+      // The ledger validates recipe-specific evidence and rejects duplicate/unknown rows.
+      // An invalid result is a hard error; never launder it into a successful map run.
+      appendMapRunRow(row, request.root);
+      observed++;
+      record(ports.log, 'item', { mapRunId, itemId: item.id, kind: row.kind, reason: row.reason });
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, () => worker()));
+  record(ports.log, 'finished', { mapRunId, expected: items.length, observed });
+  return { mapRunId, expected: items.length, observed, dryRun };
+}
+
+export interface MapReduceTable { mapRunId: string; markdown: string; writes: 0 }
+const countKinds: readonly MapRowKind[] = ['green-candidate', 'mock-pr', 'implementation-remains', 'harvest', 'close-candidate', 'hold'];
+function cell(value: unknown): string { return String(value ?? '').replaceAll('|', '\\|').replaceAll(/\r?\n/g, ' '); }
+
+/** Read-only aggregation. Applying green/close candidates belongs to a separate guarded reducer. */
+export function renderMapReduceTable(mapRunId: string, root?: string): MapReduceTable {
+  const { start, rows } = readMapRun(mapRunId, root);
+  const summary = reduceMapRun(mapRunId, root);
+  const lines = [
+    `# Map run ${cell(mapRunId)}`,
+    '',
+    `Recipe: ${start.recipe} · snapshot: ${cell(start.snapshotRef)} · dry-run: ${start.dryRun} · verdict: ${summary.verdict} (${summary.reason})`,
+    `Expected: ${summary.expected} · observed: ${summary.observed} · writes: 0`,
+    `Counts: ${countKinds.map((kind) => `${kind} ${summary.counts[kind]}`).join(' · ')}`,
+    '',
+    '| Item | Card | Result | PR | Reason |',
+    '| --- | --- | --- | --- | --- |',
+    ...rows.map((row) => `| ${cell(row.itemId ?? 'inventory')} | ${cell(row.result?.cardId)} | ${row.kind} | ${cell(row.pr)} | ${cell(row.reason)} |`),
+  ];
+  return { mapRunId, markdown: `${lines.join('\n')}\n`, writes: 0 };
+}

package/src/task-agent/map-run-ledger.ts

@@ -0,0 +1,226 @@
+/**
+ * MAPREDUCE-FANOUT: one immutable inventory snapshot, followed by one result per item.
+ * The reducer is read-only. A partial inventory or missing/duplicate result is a hold,
+ * never evidence for a checklist change or a draft close.
+ */
+import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, writeSync } from 'node:fs';
+import { dirname, isAbsolute, join } from 'node:path';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { withFileLockSync } from '../storage/file-lock.js';
+
+export type MapRecipe = 'green-close' | 'draft-close';
+export type MapRowKind = 'green-candidate' | 'mock-pr' | 'implementation-remains'
+  | 'harvest' | 'close-candidate' | 'hold';
+export type MapEvidenceVerdict = 'pass' | 'fail' | 'hold' | 'unmeasured';
+
+export interface MapRunStart {
+  event: 'start';
+  mapRunId: string;
+  recipe: MapRecipe;
+  recipeSha: string;
+  snapshotTime: string;
+  snapshotRef: string;
+  /** Exact origin/main captured with the inventory, independent of the image or recipe commit. */
+  mainSha: string;
+  /** The checklist snapshot artifact used by green-close; draft-close records null. */
+  checklistSnapshotPath: string | null;
+  inventoryComplete: boolean;
+  /** Stable identities from the complete inventory; item display titles are never keys. */
+  itemIds: string[];
+  requestedPool: string;
+  selectedPool: string | null;
+  imageCommit: string | null;
+  dryRun: boolean;
+}
+
+export interface MapRunRow {
+  event: 'row';
+  mapRunId: string;
+  itemId: string | null;
+  recipe: MapRecipe;
+  kind: MapRowKind;
+  verdict: MapRowKind;
+  reason: string;
+  evidence: string[];
+  e1?: { verdict: MapEvidenceVerdict; mergeSha?: string; mainAncestor?: boolean };
+  e2?: { verdict: MapEvidenceVerdict; command?: string; exitCode?: number };
+  e2Source?: 'completion-boundary' | 'prior-evidence' | 'missing';
+  e3?: { verdict: MapEvidenceVerdict; reason: string };
+  /** Only an inventory-wide failure uses this form; it suppresses all item rows and requires pr:null. */
+  rowsSuppressed?: boolean;
+  pr?: number | null;
+  prUrl?: string | null;
+  headOid?: string | null;
+  podJob?: string | null;
+  podUid?: string | null;
+  startedAt?: string | null;
+  endedAt?: string | null;
+  rc?: number | null;
+  result?: Record<string, unknown>;
+}
+
+export interface MapRunRead {
+  start: MapRunStart;
+  rows: MapRunRow[];
+}
+
+export interface MapRunReduce {
+  mapRunId: string;
+  verdict: 'complete' | 'hold';
+  reason: string;
+  expected: number;
+  observed: number;
+  counts: Record<MapRowKind, number>;
+  /** A dry-run has no write authority, even when every item is a candidate. */
+  writes: 0;
+}
+
+const ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,95}$/;
+const SHA = /^[0-9a-f]{40}$/;
+const KINDS = new Set<MapRowKind>(['green-candidate', 'mock-pr', 'implementation-remains', 'harvest', 'close-candidate', 'hold']);
+const RECIPE_KINDS: Record<MapRecipe, ReadonlySet<MapRowKind>> = {
+  'green-close': new Set(['green-candidate', 'mock-pr', 'implementation-remains', 'hold']),
+  'draft-close': new Set(['harvest', 'close-candidate', 'hold']),
+};
+
+function checkId(value: string, label: string): void {
+  if (!ID.test(value)) throw new Error(`map-run invalid ${label}: ${value}`);
+}
+
+export function mapRunLedgerPath(mapRunId: string, root = effectiveInstanceRoot()): string {
+  checkId(mapRunId, 'id');
+  return join(root, 'map-runs', `${mapRunId}.jsonl`);
+}
+
+function validateStart(start: MapRunStart): void {
+  checkId(start.mapRunId, 'id');
+  if (start.recipe !== 'green-close' && start.recipe !== 'draft-close') throw new Error('map-run unknown recipe');
+  if (!SHA.test(start.recipeSha)) throw new Error('map-run recipe SHA missing');
+  if (!start.snapshotTime || !start.snapshotRef) throw new Error('map-run snapshot identity missing');
+  if (!SHA.test(start.mainSha) || !('checklistSnapshotPath' in start)
+    || (start.recipe === 'green-close' && (!start.checklistSnapshotPath || !isAbsolute(start.checklistSnapshotPath)))
+    || (start.recipe === 'draft-close' && start.checklistSnapshotPath !== null)) {
+    throw new Error('map-run main or checklist snapshot provenance missing');
+  }
+  if (!Array.isArray(start.itemIds) || start.itemIds.some((id) => typeof id !== 'string' || !ID.test(id))
+    || new Set(start.itemIds).size !== start.itemIds.length) throw new Error('map-run item identities missing or duplicate');
+  if (typeof start.inventoryComplete !== 'boolean' || typeof start.dryRun !== 'boolean') throw new Error('map-run completeness or dry-run missing');
+  if (!start.inventoryComplete && start.itemIds.length) throw new Error('map-run partial inventory cannot name items');
+  if (!start.requestedPool || !('selectedPool' in start) || !('imageCommit' in start)) throw new Error('map-run pool or image provenance missing');
+}
+
+function validateRow(row: MapRunRow, start: MapRunStart): void {
+  if (row.mapRunId !== start.mapRunId || row.recipe !== start.recipe || !KINDS.has(row.kind) || row.verdict !== row.kind
+    || !Array.isArray(row.evidence)
+    || row.evidence.some((value) => typeof value !== 'string') || typeof row.reason !== 'string') {
+    throw new Error('map-run row contract mismatch');
+  }
+  if (!RECIPE_KINDS[start.recipe].has(row.kind)) throw new Error('map-run kind outside recipe');
+  if (row.rowsSuppressed) {
+    if (start.inventoryComplete || row.itemId !== null || row.pr !== null || row.kind !== 'hold') {
+      throw new Error('map-run suppressed row must hold an incomplete inventory without a PR');
+    }
+  } else if (!start.inventoryComplete) {
+    throw new Error('map-run incomplete inventory suppresses item rows');
+  } else if (!row.itemId || !start.itemIds.includes(row.itemId)) {
+    throw new Error(`map-run unknown item: ${row.itemId}`);
+  }
+  if (row.kind === 'hold' && !row.reason.trim()) throw new Error('map-run hold needs a reason');
+  if (row.kind !== 'hold' && row.evidence.length === 0) throw new Error('map-run candidate needs evidence');
+  if (row.kind === 'green-candidate'
+    && (row.e1?.verdict !== 'pass' || row.e2?.verdict !== 'pass' || row.e3?.verdict !== 'pass'
+      || !SHA.test(row.e1.mergeSha ?? '') || row.e1.mainAncestor !== true
+      || !row.e3.reason.trim()
+      || typeof row.pr !== 'number' || !Number.isSafeInteger(row.pr) || row.pr <= 0
+      || !row.prUrl || !row.e2Source || row.e2Source === 'missing'
+      || !row.e2.command?.trim() || row.e2.exitCode !== 0)) {
+    throw new Error('map-run green candidate needs E1/E2/E3 and PR proof');
+  }
+  if ((row.kind === 'harvest' || row.kind === 'close-candidate')
+    && (typeof row.pr !== 'number' || !Number.isSafeInteger(row.pr) || row.pr <= 0 || !SHA.test(row.headOid ?? ''))) {
+    throw new Error('map-run draft decision needs exact PR head');
+  }
+  if (row.rc != null && row.rc !== 0 && row.kind !== 'hold') throw new Error('map-run failed Pod cannot yield a candidate');
+  for (const field of ['podJob', 'podUid', 'startedAt', 'endedAt'] as const) {
+    const value = row[field];
+    if (value != null && (typeof value !== 'string' || !value.trim())) throw new Error(`map-run invalid ${field}`);
+  }
+  if (row.result != null && (typeof row.result !== 'object' || Array.isArray(row.result))) {
+    throw new Error('map-run invalid result');
+  }
+}
+
+/** Exclusive create prevents a retry from silently replacing the original inventory. */
+export function createMapRun(start: MapRunStart, root?: string): string {
+  validateStart(start);
+  const path = mapRunLedgerPath(start.mapRunId, root);
+  mkdirSync(dirname(path), { recursive: true });
+  const fd = openSync(path, 'wx', 0o600);
+  try { writeSync(fd, `${JSON.stringify(start)}\n`); }
+  finally { closeSync(fd); }
+  return path;
+}
+
+export function readMapRun(mapRunId: string, root?: string): MapRunRead {
+  const path = mapRunLedgerPath(mapRunId, root);
+  if (!existsSync(path)) throw new Error(`map-run missing: ${mapRunId}`);
+  const raw = readFileSync(path, 'utf8');
+  if (!raw.endsWith('\n')) throw new Error('map-run truncated JSONL tail');
+  const lines = raw.trimEnd().split('\n');
+  let start: MapRunStart;
+  try { start = JSON.parse(lines[0]!) as MapRunStart; }
+  catch { throw new Error('map-run invalid start JSON'); }
+  if (start.event !== 'start' || start.mapRunId !== mapRunId) throw new Error('map-run invalid start');
+  validateStart(start);
+  const rows: MapRunRow[] = [];
+  const seen = new Set<string>();
+  for (const line of lines.slice(1)) {
+    let row: MapRunRow;
+    try { row = JSON.parse(line) as MapRunRow; }
+    catch { throw new Error('map-run invalid row JSON'); }
+    if (row.event !== 'row') throw new Error('map-run unexpected event');
+    validateRow(row, start);
+    const key = row.rowsSuppressed ? '__inventory_hold__' : row.itemId!;
+    if (seen.has(key)) throw new Error(`map-run duplicate row: ${key}`);
+    seen.add(key);
+    rows.push(row);
+  }
+  if (rows.some((row) => row.rowsSuppressed) && rows.length !== 1) throw new Error('map-run suppressed inventory has item rows');
+  return { start, rows };
+}
+
+/** The lock protects the read-before-append duplicate check across concurrent Pod completions. */
+export function appendMapRunRow(row: MapRunRow, root?: string): void {
+  const path = mapRunLedgerPath(row.mapRunId, root);
+  withFileLockSync(`${path}.lock`, () => {
+    const current = readMapRun(row.mapRunId, root);
+    validateRow(row, current.start);
+    const key = row.rowsSuppressed ? '__inventory_hold__' : row.itemId!;
+    if (current.rows.some((existing) => (existing.rowsSuppressed ? '__inventory_hold__' : existing.itemId) === key)) {
+      throw new Error(`map-run duplicate row: ${key}`);
+    }
+    if (row.rowsSuppressed && current.rows.length) throw new Error('map-run inventory hold cannot follow item rows');
+    if (current.rows.some((existing) => existing.rowsSuppressed)) throw new Error('map-run inventory hold suppresses item rows');
+    appendFileSync(path, `${JSON.stringify(row)}\n`);
+  });
+}
+
+/** No consumer of this result can write: incomplete evidence remains an explicit hold. */
+export function reduceMapRun(mapRunId: string, root?: string): MapRunReduce {
+  const { start, rows } = readMapRun(mapRunId, root);
+  const counts: Record<MapRowKind, number> = {
+    'green-candidate': 0, 'mock-pr': 0, 'implementation-remains': 0,
+    harvest: 0, 'close-candidate': 0, hold: 0,
+  };
+  for (const row of rows) counts[row.kind]++;
+  const accounted = start.inventoryComplete && rows.length === start.itemIds.length
+    && rows.every((row) => !row.rowsSuppressed);
+  const complete = accounted && start.itemIds.length > 0 && counts.hold === 0;
+  return {
+    mapRunId, verdict: complete ? 'complete' : 'hold',
+    reason: !start.inventoryComplete ? 'inventory-incomplete' : start.itemIds.length === 0 ? 'empty-inventory'
+      : !accounted ? 'results-missing'
+      : counts.hold ? 'item-hold' : 'all-items-accounted',
+    expected: start.itemIds.length, observed: rows.length, counts, writes: 0,
+  };
+}

package/src/task-agent/parent-host.ts

@@ -81,7 +81,7 @@ export function resolveParentHosts(config: ParentHostSetting | undefined, env: N
 }
 
 /** Capacity sample is read on the host before launch. Unknown or saturated capacity is not a positive weight. */
-export interface ParentHostCapacity { approvalHeadroom: number; load: number }
+export interface ParentHostCapacity { active: number; waiting: number; approvalHeadroom: number; load: number }
 
 export interface ParentHostPodFit {
   state: 'fits' | 'never-fits' | 'unmeasured';
@@ -127,26 +127,35 @@ export function readParentHostPodFit(target: ParentHostConfig, memoryLimit: stri
 }
 
 const CAPACITY_MARKER = '__ELANOUS_PARENT_CAPACITY__';
+const CAPACITY_ERROR_MARKER = '__ELANOUS_PARENT_CAPACITY_ERROR__';
 const APPROVAL_MARKER = '__ELANOUS_PARENT_APPROVALS__';
 const LOAD_MARKER = '__ELANOUS_PARENT_LOAD__';
+/** Best-effort macOS `ps` fallback; Linux/WSL uses argv boundaries below. */
+export const PARENT_HOST_ACTIVE_FILTER = String.raw`/^(([^ ]+\/)?(bun|node|nodejs) )?([^ ]+\/)?elanous(\.mjs)?( --config-dir [^ ]+)? harness (say|ask)( |$)/ && / --no-auto-merge( |$)/ && !/ --substrate local( |$)/ && !/^([^ ]+\/)?[^ ]*sh -c/`;
+/** Count exact Linux argv entries so Pod-local commands and goal text cannot masquerade as host parents. */
+export const PARENT_HOST_PROC_COUNT_SCRIPT = "count=0; proc_root=${1:-/proc}; for file in \"$proc_root\"/[0-9]*/cmdline; do [ -r \"$file\" ] || continue; argv=(); while IFS= read -r -d '' arg; do argv+=(\"$arg\"); done < \"$file\" 2>/dev/null || true; [ ${#argv[@]} -ge 3 ] || continue; program=\"${argv[0]##*/}\"; case \"$program\" in elanous|elanous.mjs) ;; bun|node|nodejs) script_match=0; for ((i=1; i<${#argv[@]}; i++)); do if [[ \"${argv[i]}\" == */elanous.mjs ]]; then script_match=1; break; fi; [[ \"${argv[i]}\" == harness ]] && break; done; [ \"$script_match\" -eq 1 ] || continue ;; *) continue ;; esac; harness=0; for ((i=0; i+1<${#argv[@]}; i++)); do if [[ \"${argv[i]}\" == harness && ( \"${argv[i+1]}\" == say || \"${argv[i+1]}\" == ask ) ]]; then harness=1; break; fi; done; [ \"$harness\" -eq 1 ] || continue; has_no_auto_merge=0; for arg in \"${argv[@]}\"; do [[ \"$arg\" == --no-auto-merge ]] && has_no_auto_merge=1; done; [ \"$has_no_auto_merge\" -eq 1 ] || continue; local_substrate=0; for ((i=0; i+1<${#argv[@]}; i++)); do if [[ \"${argv[i]}\" == --substrate && \"${argv[i+1]}\" == local ]]; then local_substrate=1; break; fi; done; [ \"$local_substrate\" -eq 1 ] || count=$((count+1)); done; printf '__ELANOUS_PARENT_CAPACITY__%s\\n' \"$count\""
 /** Recent admission decisions are the host's measured approval backlog, not an inferred process count. */
 export function readParentHostCapacity(target: ParentHostConfig, ssh: SshRunner = defaultSshRunner): ParentHostCapacity | null {
   const executable = remotePath(target.elanous ?? DEFAULT_REMOTE_ELANOUS);
   const configDir = remotePath(target.configDir ?? DEFAULT_REMOTE_CONFIG_DIR);
-  const script = `parents=$(ps -Ao command) || exit 1; printf '%s\\n' "$parents" | awk '/[e]lanous.*harness (say|ask)/ { n++ } END { print "${CAPACITY_MARKER}" n+0 }'; `
+  const unavailable = (reason: string): null => { try { debug.log('task-agent.parent-host', 'capacity-unavailable', { host: target.host, reason }); } catch { /* fail-soft */ } return null; };
+  const processCount = `if [ -r /proc/self/cmdline ]; then if command -v bash >/dev/null 2>&1; then bash -c ${shellQuote(PARENT_HOST_PROC_COUNT_SCRIPT)} -- /proc; else printf "${CAPACITY_ERROR_MARKER}bash-unavailable\\n"; exit 1; fi; else parents=$(ps -Ao command) || exit 1; printf '%s\\n' "$parents" | awk '${PARENT_HOST_ACTIVE_FILTER} { n++ } END { print "${CAPACITY_MARKER}" n+0 }'; fi`;
+  const script = `${processCount}; `
     + `${executable} --config-dir ${configDir} logs --event admit-by-usage --since 5m --json --limit 1000 || exit 1; `
     + `printf '\\n${APPROVAL_MARKER}\\n'; `
     + `cpu=$(ps -Ao %cpu=) || exit 1; printf '%s\\n' "$cpu" | awk '{ total += $1 } END { printf "${LOAD_MARKER}%.3f\\n", total+0 }'; `
     + `cores=$(getconf _NPROCESSORS_ONLN 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null) || exit 1; printf '${LOAD_MARKER}cores=%s\\n' "$cores"`;
   try {
     const result = ssh(target.host, script, 15_000);
-    if (result.status !== 0) return null;
+    if (result.status !== 0) return unavailable(result.stdout.includes(`${CAPACITY_ERROR_MARKER}bash-unavailable`) ? 'bash-unavailable' : 'remote-command-failed');
     const activeMatch = new RegExp(`^${CAPACITY_MARKER}(\\d+)$`, 'm').exec(result.stdout);
     const boundary = result.stdout.indexOf(`\n${APPROVAL_MARKER}\n`);
     const logsStart = result.stdout.indexOf('\n');
     const cpuMatch = new RegExp(`^${LOAD_MARKER}([0-9]+(?:\\.[0-9]+)?)$`, 'm').exec(result.stdout);
     const coresMatch = new RegExp(`^${LOAD_MARKER}cores=(\\d+)$`, 'm').exec(result.stdout);
-    if (!activeMatch || activeMatch.index !== 0 || logsStart < 0 || boundary < logsStart || !cpuMatch || !coresMatch) return null;
+    if (!activeMatch || activeMatch.index !== 0) return unavailable('active-count-marker-missing');
+    if (logsStart < 0 || boundary < logsStart) return unavailable('approval-boundary-missing');
+    if (!cpuMatch || !coresMatch) return unavailable('load-marker-missing');
     const active = Number(activeMatch[1]);
     const cores = Number(coresMatch[1]);
     const cpu = Number(cpuMatch[1]);
@@ -172,23 +181,24 @@ export function readParentHostCapacity(target: ParentHostConfig, ssh: SshRunner
       decisions.set(data.runId, data.recommended as number);
     }
     const waiting = [...decisions.values()].filter((n) => n === 0).length;
-    return { approvalHeadroom: Math.max(0, capacity - active - waiting), load: Math.max(0, cpu / (cores * 100)) };
-  } catch { return null; }
+    return { active, waiting, approvalHeadroom: Math.max(0, capacity - active - waiting), load: Math.max(0, cpu / (cores * 100)) };
+  } catch { return unavailable('capacity-parse-failed'); }
 }
 
-/** Weighted rendezvous: stable per run, no shared counter or dependence on dispatch order. */
-export function orderParentHosts(targets: readonly ParentHostConfig[], runId: string, capacities: Readonly<Record<string, ParentHostCapacity | null>>): ParentHostConfig[] {
+/** Weighted rendezvous rank with evidence fields for launch-time observation. */
+export function rankParentHosts(targets: readonly ParentHostConfig[], runId: string, capacities: Readonly<Record<string, ParentHostCapacity | null>>): Array<{ target: ParentHostConfig; weight: number; score: number }> {
   return targets.map((target, index) => {
     const sample = capacities[target.host];
     const weight = sample && Number.isSafeInteger(sample.approvalHeadroom) && sample.approvalHeadroom > 0 && Number.isFinite(sample.load) && sample.load >= 0
       ? sample.approvalHeadroom / (1 + sample.load) : 0;
     const hash = createHash('sha256').update(`${runId}\0${target.host}`).digest();
     const fraction = (hash.readUIntBE(0, 6) + 1) / (2 ** 48 + 1);
-    return { target, index, score: weight > 0 ? -Math.log(fraction) / weight : Infinity };
-  }).sort((a, b) => a.score - b.score || a.index - b.index).map(({ target }) => target);
+    return { target, index, weight, score: weight > 0 ? -Math.log(fraction) / weight : Infinity };
+  }).sort((a, b) => a.score - b.score || a.index - b.index).map(({ target, weight, score }) => ({ target, weight, score }));
 }
 
-/** `$HOME/…` 은 원격 셸이 풀도록 따옴표 밖에 둔다 — 나머지는 shellQuote. */
+
+/** Keep `$HOME/...` outside quotes so the remote shell expands it; quote every other path. */
 function remotePath(path: string): string {
   return path.startsWith('$HOME/') ? `"$HOME"/${shellQuote(path.slice('$HOME/'.length))}` : shellQuote(path);
 }

package/src/task-agent/rejudge-on-head.ts

@@ -102,6 +102,8 @@ export interface RejudgeDeps {
   notifyRepair?: (seat: string, body: string) => void;
   /** Shared new-launch budget for this `tasks rejudge --all` call. */
   repairBudget?: import('./repair-cycle.js').RepairTickBudget;
+  /** Verify a later PR head contains the harvested owner commit (read-only). */
+  ownerHarvestAncestor?: (cwd: string, owner: string, head: string) => boolean;
   /** One review request across all candidates in one --all tick; standalone card rejudge is uncapped. */
   reviewBudget?: { max: number; requested: number };
   /** One land or queue attempt across all candidates in one --all tick. */
@@ -346,10 +348,11 @@ const catchUpFail = (reason: string, extra: Partial<CatchUpResult> = {}): CatchU
 /**
  * origin/main 을 PR 머리에 3-way merge(rerere 켬) 하고 일반 push 한다.
  * ⛔ rebase · force-push · reset · 남의 가지 파일째 checkout — 충돌이면 merge --abort.
+ * 이전 시도의 worktree 경로가 남았으면 새 경로로 한 번 더 시도한다. 남은 트리를 강제 제거하지 않는다.
  */
 export async function defaultCatchUpMain(request: CatchUpRequest, git: CatchUpGit = defaultCatchUpGit): Promise<CatchUpResult> {
   const repo = request.cwd;
-  const work = request.worktreePath ?? join(tmpdir(), `ta-catch-up-${request.pr}-${safe(request.head.slice(0, 12))}-${process.pid}`);
+  let work = request.worktreePath ?? join(tmpdir(), `ta-catch-up-${request.pr}-${safe(request.head.slice(0, 12))}-${process.pid}`);
   const gitRepo = (args: string[]) => git(repo, args);
   const gitWork = (args: string[]) => git(work, args);
   const fromBase = request.fromBase;
@@ -367,7 +370,12 @@ export async function defaultCatchUpMain(request: CatchUpRequest, git: CatchUpGi
     return catchUpFail(`fetched PR head ${(fetchedHead ?? '?').slice(0, 12)} ≠ ${request.head.slice(0, 12)}`, { fromBase, toBase });
   }
 
-  const added = gitRepo(['worktree', 'add', '--detach', work, request.head]);
+  let added = gitRepo(['worktree', 'add', '--detach', work, request.head]);
+  if (added.status !== 0 && /already exists|already registered|already used by worktree/i.test(added.stderr || added.stdout)) {
+    // 남은 경로가 살아 있는 다른 시도의 것일 수 있으므로 건드리지 않는다.
+    work = `${work}-retry-${randomUUID()}`;
+    added = gitRepo(['worktree', 'add', '--detach', work, request.head]);
+  }
   if (added.status !== 0) return catchUpFail(`worktree add failed: ${(added.stderr || added.stdout).trim().slice(-200)}`, { fromBase, toBase });
   const cleanup = () => { gitRepo(['worktree', 'remove', '--force', work]); };
 
@@ -495,7 +503,8 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
   if ('reason' in found) return target('pr-unreadable', found.reason, pr, fromHead);
   const { cwd, view } = found;
   const toHead = view.head;
-  const eligible = !!reviews.length || adopted || (!!card.parentHost && (deps.remoteRunTerminal ?? remoteBoundRunTerminal)(card));
+  const harvest = pendingOwnerHarvest(card, pr);
+  const eligible = !!reviews.length || adopted || !!harvestReviewPending(card, pr) || (!!card.parentHost && (deps.remoteRunTerminal ?? remoteBoundRunTerminal)(card));
   const trustedTrain = view.state === 'CLOSED' && card.status === 'launched'
     ? (() => { try { return (deps.trainLanding ?? verifiedTrainLanding)(pr, cwd); } catch { return null; } })() : null;
   // An unreviewed or unproven remote card retains the old guard. Only verified train
@@ -543,6 +552,25 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
       : target('pr-not-open', `PR #${pr} is ${view.state}`, pr, fromHead, toHead);
   }
   if (view.state !== 'OPEN') return target('pr-not-open', `PR #${pr} is ${view.state}`, pr, fromHead, toHead);
+  if (harvest) {
+    const ancestor = deps.ownerHarvestAncestor ?? ((repo: string, owner: string, head: string) => {
+      const result = spawnSync('git', ['merge-base', '--is-ancestor', owner, head], { cwd: repo, encoding: 'utf8', timeout: 10_000 });
+      return result.status === 0;
+    });
+    let reached = sameHead(toHead, harvest.head);
+    if (!reached) { try { reached = ancestor(cwd, harvest.head, toHead); } catch { reached = false; } }
+    if (!reached) {
+      emit({ card: card.id, pr, fromHead, toHead, step: 'review', decision: 'awaiting-harvest',
+        reason: `PR #${pr} head ${toHead.slice(0, 12)} awaits owner-worktree-commit ${harvest.head.slice(0, 12)} · next: wait for harvest` }, false);
+      return outcomes;
+    }
+    updateTaskCard(statePath, card.id, current => current && cardPrNumber(current) === pr
+      && typeof current.pr === 'object' && current.pr.url === url && pendingOwnerHarvest(current, pr)?.head === harvest.head
+      && !current.history.some(entry => entry.event === 'review-harvest-reached' && entry.pr === pr
+        && entry.runId === current.runId && entry.head && sameHead(entry.head, toHead))
+      ? { ...current, history: [...current.history, { at: now().toISOString(), event: 'review-harvest-reached',
+        pr, head: toHead, ...(current.runId ? { runId: current.runId } : {}), detail: `PR #${pr} head reached owner-worktree-commit · next: review` }] } : undefined);
+  }
   // An explicitly rejudged PR can be reopened. Clear the old marker before normal head judgement.
   if (boundPrTerminal(card)) {
     updateTaskCard(statePath, card.id, (current) => current && cardPrNumber(current) === pr && typeof current.pr === 'object' && current.pr.url === url
@@ -552,6 +580,26 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
   const step = (s: RejudgeStep, decision: string, reason: string, record: boolean, extra: Partial<RejudgeOutcome> = {}) =>
     emit({ card: card!.id, pr, fromHead, toHead, step: s, decision, reason, ...extra }, record);
   const requestReview = async (candidate: TaskCard, reason: string, forceNewReview = false): Promise<void> => {
+    // The head used for this decision may have moved while the card was being updated.
+    // Never request a review of a new head until it is verified against the owner commit.
+    if (harvest) {
+      let fresh: PrHeadView | null;
+      try { fresh = await (live.prHead ?? defaultPrHead)(pr, cwd); } catch { fresh = null; }
+      if (!fresh || fresh.state !== 'OPEN' || !fresh.url || !sameUrl(fresh.url, url)) {
+        step('review', 'awaiting-harvest', `PR #${pr} fresh head unavailable · next: wait for harvest`, false);
+        return;
+      }
+      let reached = sameHead(fresh.head, harvest.head);
+      if (!reached) {
+        try { reached = (deps.ownerHarvestAncestor ?? ((repo: string, owner: string, head: string) =>
+          spawnSync('git', ['merge-base', '--is-ancestor', owner, head], { cwd: repo, encoding: 'utf8', timeout: 10_000 }).status === 0))(cwd, harvest.head, fresh.head); }
+        catch { reached = false; }
+      }
+      if (!reached) {
+        step('review', 'awaiting-harvest', `PR #${pr} head ${fresh.head.slice(0, 12)} awaits owner-worktree-commit ${harvest.head.slice(0, 12)} · next: wait for harvest`, false);
+        return;
+      }
+    }
     const budget = deps.reviewBudget;
     if (budget && budget.requested >= budget.max) {
       step('review', 'tick-cap', `review request cap ${budget.max} reached — next tick`, false);
@@ -560,9 +608,12 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
     // Reserve before awaiting the worker so another candidate cannot launch a second request.
     if (budget) budget.requested++;
     const before = { reviewRequests: candidate.reviewRequests, landAttempts: candidate.landAttempts };
-    const result = await executeLiveReview(candidate, pr, { runId: candidate.runId ?? null, stopReason: reason, cwd, forceNewReview }, { ...live, ...(deps.log ? { log: deps.log } : {}) });
+    const result = await executeLiveReview(candidate, pr, { runId: candidate.runId ?? null, stopReason: reason, cwd, forceNewReview,
+      ...(harvest ? { ownerHarvestHead: harvest.head, ...(deps.ownerHarvestAncestor ? { ownerHarvestAncestor: deps.ownerHarvestAncestor } : {}) } : {}) },
+      { ...live, ...(deps.log ? { log: deps.log } : {}) });
     recordMove(statePath, candidate.id, candidate.runId, 'review', result, pr, before, now, deps.log);
-    step('review', result.executed ? 'review-requested' : 'review-request-failed', result.detail, true);
+    step('review', harvest && !result.executed && result.detail.includes('awaits owner-worktree-commit') ? 'awaiting-harvest'
+      : result.executed ? 'review-requested' : 'review-request-failed', result.detail, true);
   };
 
   // Adoption is a first judgement for the current head, even when the implementation run
@@ -938,6 +989,21 @@ function recordMove(statePath: string, cardId: string, runId: string | undefined
   } catch { /* recordLiveMoveHistory 는 스스로 관측한다 */ }
 }
 
+function harvestReviewPending(card: TaskCard, pr: number): boolean {
+  if (card.status !== 'launched' || typeof card.pr !== 'object' || card.pr.number !== pr || !card.pr.url || !card.runId) return false;
+  const latest = card.history.filter(entry => (entry.event === 'review-skipped-harvest' || entry.event === 'review-harvest-reached')
+    && entry.pr === pr && typeof entry.head === 'string' && /^[a-f0-9]{40}$/i.test(entry.head)
+    && entry.runId === card.runId).at(-1);
+  return !!latest && !(card.reviewRequests ?? []).some(entry => entry.pr === pr && sameHead(entry.head, latest.head!));
+}
+
+function pendingOwnerHarvest(card: TaskCard, pr: number): { head: string } | undefined {
+  if (!harvestReviewPending(card, pr)) return undefined;
+  const latest = card.history.filter(entry => entry.event === 'review-skipped-harvest' && entry.pr === pr
+    && entry.runId === card.runId && typeof entry.head === 'string' && /^[a-f0-9]{40}$/i.test(entry.head)).at(-1);
+  return latest?.effect === 'wait' ? { head: latest.head! } : undefined;
+}
+
 /** 재판정 대상 카드 — 기존 리뷰 또는 HQ 가 종결 원장을 검증할 원격 부모 카드. */
 export function rejudgeCandidates(tasks: Readonly<Record<string, TaskCard>>, opts: {
   now?: Date; maxAgeHours?: number; onAgeSkip?: (card: TaskCard, ageHours: number | null) => void;
@@ -949,6 +1015,7 @@ export function rejudgeCandidates(tasks: Readonly<Record<string, TaskCard>>, opt
   return Object.values(tasks).filter((card) => {
     const pr = cardPrNumber(card);
     const eligible = pr !== undefined && !boundPrTerminal(card) && ((card.reviewRequests ?? []).some((entry) => entry.pr === pr)
+      || (pr !== undefined && harvestReviewPending(card, pr))
       || (card.status === 'launched' && card.taLand === true && ((!!card.parentHost && !!card.runId && !!card.runChildId)
         || (card.adoptedPr?.pr === pr && typeof card.pr === 'object' && !!card.pr.url && sameUrl(card.adoptedPr.url, card.pr.url)))));
     if (!eligible) return false;