elanous 0.2.36 → 0.2.38

package/src/agent-substrate/self-review-cli.ts

@@ -14,24 +14,46 @@
 //
 // index.ts 의 액션은 옵션 파싱과 실제 의존 배선만 남는다(얇은 껍데기).
 
-import { mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { tierModel } from '../llm/model-defaults.js';
-import { buildReviewObservation, safeLogText } from './review-observation.js';
+import { buildReviewObservation, reviewIntentFingerprint, safeLogText } from './review-observation.js';
+import { checkCitedReviewPathsAtHead } from './review-finding-key.js';
 import { DEFAULT_REVIEW_BACKEND, defaultAcpReviewTimeoutSec } from './acp-reviewer.js';
 import { ZAI_OPENROUTER_FALLBACK_MODEL } from '../llm/zai-coding-plan.js';
 import { debug } from '../debug/log.js';
 import { ACP_BACKENDS, canonicalizeBackendId } from '../acp/backend-registry.js';
 import { buildManualReviewIntent, intentFromPr, prIntentSectionCoverage, reviewIntentTruncationFromPr, reviewIntentTruncationObservation } from './review-intent.js';
-import { budgetReviewerContext, reviewDiffBudgetObservation, splitDiffByFile, type ReviewImage, type ReviewInput, type ReviewerContextItem, type ReviewResult } from './pr-reviewer.js';
+import { budgetReviewerContext, isNoneSentinelFinding, reviewDiffBudgetObservation, splitDiffByFile, type ReviewImage, type ReviewInput, type ReviewerContextItem, type ReviewResult } from './pr-reviewer.js';
 import type { ReferencedFileReader } from '../self-implement/goal-file-reader.js';
-import { getUserConfig, type LLMProviderName, type RoleLlmSpec, type SubscriptionReviewerSpec } from '../user-config.js';
+import { getUserConfig, type LLMProviderName, type ReviewerMixSpec, type RoleLlmSpec, type SubscriptionReviewerSpec } from '../user-config.js';
+import { loadLlmPolicy } from '../policy/llm-policy.js';
 import { listRunLedgers, lookupPrGoalAcceptance, lookupRunLedger, type PrGoalAcceptanceLookup, type RunLedgerEntry, type RunLedgerLookup } from '../self-implement/run-ledger.js';
 
 /** SUBSCRIPTION-EXHAUST-REROUTE — API reviewer when the configured `roleLlm.reviewer` lane is unavailable (off codex). */
 export const ROLE_REVIEWER_FALLBACK_MODEL = 'openrouter/z-ai/glm-5.3';
+export const DEFAULT_REVIEWER_MIX: ReviewerMixSpec = { sol: 1, claude: 1, glm: 1 };
+type ReviewLane = keyof ReviewerMixSpec;
+const REVIEW_LANES: readonly ReviewLane[] = ['sol', 'claude', 'glm'];
+
+/** A PR keeps the same primary lane through every review round, regardless of head SHA. */
+export function reviewLaneOrder(pr: string, mix: ReviewerMixSpec): ReviewLane[] {
+  if (!/^\d+$/.test(pr)) return [];
+  const total = REVIEW_LANES.reduce((sum, lane) => sum + mix[lane], 0);
+  if (!Number.isSafeInteger(total) || total <= 0) return [];
+  const slot = Number(BigInt(pr) % BigInt(total));
+  let offset = 0;
+  let primary: ReviewLane | undefined;
+  for (const lane of REVIEW_LANES) {
+    offset += mix[lane];
+    if (slot < offset) { primary = lane; break; }
+  }
+  if (!primary) return [];
+  const start = REVIEW_LANES.indexOf(primary);
+  return [...REVIEW_LANES.slice(start), ...REVIEW_LANES.slice(0, start)].filter(lane => mix[lane] > 0);
+}
 
 /** Only an explicit provider+model role setting selects the API review model. */
 export function apiReviewModelFromRoleSpec(spec: RoleLlmSpec | undefined): string | undefined {
@@ -54,6 +76,15 @@ export interface SelfReviewCliOpts {
   reviewDenyBackends?: string[] | undefined;
   /** `roleLlm.reviewer` (same resolution as the harness). Used only when no explicit reviewer flag is given. */
   roleReviewer?: SubscriptionReviewerSpec | undefined;
+  /** Default resolves from policy/config; null keeps the legacy single reviewer for isolated callers. */
+  reviewerMix?: ReviewerMixSpec | null | undefined;
+  /** Internal route metadata; the user-facing mix is selected once per PR. */
+  reviewerMixPrimaryLane?: ReviewLane | undefined;
+  reviewerMixAttemptLane?: ReviewLane | undefined;
+  reviewerMixExpectedHead?: string | undefined;
+  /** Internal: the same command already claimed its single over-cap exception for this pinned head. */
+  reviewerMixCapClaimed?: boolean | undefined;
+  disableClaudeGlmFallback?: boolean | undefined;
   acpTimeout?: string | undefined;
   context?: string[] | undefined;
   contextText?: string[] | undefined;
@@ -67,6 +98,8 @@ export interface SelfReviewCliOpts {
 
 /** 셸/네트워크/로그 경계 — 테스트는 전부 대역으로 채운다. */
 export interface SelfReviewCliDeps {
+  /** Explicit repository root for exact-head cited-path checks; absent means unmeasured. */
+  reviewRepositoryPath?: string;
   /** `gh` 호출. 실패도 예외 없이 `{status, stdout, stderr}` 로 돌려준다(spawnSync 동형). */
   gh(args: string[], timeoutMs: number): { status: number | null; stdout: string; stderr: string };
   /** ⭐ `git` 호출(선택). 주입되면 리뷰 증거를 **이 PR 이 저작한 변경**으로 좁힌다(아래 참조).
@@ -138,37 +171,77 @@ export interface SelfReviewCliOutcome {
   failed: number;
 }
 
-/** Saved results are round evidence only when their PR, exact head and reviewed status agree. */
-function savedReviewRecords(pr: string, root = effectiveInstanceRoot()): Array<{ head: string; reviewedAt: number }> {
+interface SavedReviewEvidence {
+  heads: string[];
+  records: Array<{ head: string; reviewedAt: number }>;
+  unreadableFiles: string[];
+}
+
+function savedReviewEvidence(
+  pr: string,
+  root = effectiveInstanceRoot(),
+  onUnreadable?: (file: string) => void,
+): SavedReviewEvidence {
   const dir = join(root, 'review-results');
   let names: string[];
-  try { names = readdirSync(dir); } catch { return []; }
-  // Manual review saves in the operating house also use head10; the JSON's full head is authoritative.
-  const matching = new RegExp(`^.+-${pr}-([a-f0-9]{7,40})\\.json$`, 'i');
+  try { names = readdirSync(dir); } catch { return { heads: [], records: [], unreadableFiles: [] }; }
+  const escapedPr = pr.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const matchingPrInName = new RegExp(`(?:^|-)${escapedPr}(?:-|\\.json$)`, 'i');
   const records = new Map<string, { head: string; reviewedAt: number }>();
+  const unreadableFiles: string[] = [];
   for (const name of names) {
-    const match = matching.exec(name);
-    if (!match) continue;
+    if (!name.toLowerCase().endsWith('.json')) continue;
+    const nameSuggestsPr = matchingPrInName.test(name);
     try {
-      const recordPath = join(dir, name);
-      const raw: unknown = JSON.parse(readFileSync(recordPath, 'utf8'));
-      if (!raw || typeof raw !== 'object' || Array.isArray(raw)) continue;
+      const raw: unknown = JSON.parse(readFileSync(join(dir, name), 'utf8'));
+      if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
+        if (nameSuggestsPr) { unreadableFiles.push(name); onUnreadable?.(name); }
+        continue;
+      }
       const result = raw as Record<string, unknown>;
+      const recordPr = typeof result.pr === 'string' ? result.pr
+        : Number.isSafeInteger(result.pr) ? String(result.pr) : undefined;
+      if (recordPr !== pr) {
+        // A parseable, explicit foreign PR identity outranks a misleading filename.
+        if (recordPr === undefined && nameSuggestsPr) { unreadableFiles.push(name); onUnreadable?.(name); }
+        continue;
+      }
+      if (result.reviewed !== true) continue;
       const head = result.headCommit;
-      if (String(result.pr) !== pr || result.reviewed !== true || typeof head !== 'string'
-        || !COMMIT_OID.test(head) || !head.toLowerCase().startsWith(match[1]!.toLowerCase())) continue;
-      const normalized = head.toLowerCase();
-      const existing = records.get(normalized);
+      if (typeof head !== 'string' || !COMMIT_OID.test(head)) {
+        unreadableFiles.push(name);
+        onUnreadable?.(name);
+        continue;
+      }
+      // The result payload is authoritative: round-tagged filenames and stale suffixes
+      // still count by their full PR/head identity, then deduplicate on that identity.
+      const recordPath = join(dir, name);
       const reviewedAt = typeof result.reviewedAt === 'number' && Number.isFinite(result.reviewedAt)
         ? result.reviewedAt : statSync(recordPath).mtimeMs;
+      const normalized = head.toLowerCase();
+      const existing = records.get(normalized);
       if (!existing || reviewedAt > existing.reviewedAt) records.set(normalized, { head: normalized, reviewedAt });
-    } catch { /* corrupt or partial result is not a completed round */ }
+    } catch {
+      // A filename can associate an unreadable record with this PR; fail closed at the cap.
+      if (nameSuggestsPr) { unreadableFiles.push(name); onUnreadable?.(name); }
+    }
   }
-  return [...records.values()];
+  const saved = [...records.values()];
+  return { heads: saved.map(({ head }) => head), records: saved, unreadableFiles };
 }
 
 export function savedReviewHeads(pr: string, root = effectiveInstanceRoot()): string[] {
-  return savedReviewRecords(pr, root).map(({ head }) => head);
+  return savedReviewEvidence(pr, root).heads;
+}
+
+function isReplaceableErrorArtifact(path: string, pr: string, head: string): boolean {
+  try {
+    const result = JSON.parse(readFileSync(path, 'utf8')) as Record<string, unknown>;
+    const recordPr = typeof result.pr === 'string' ? result.pr
+      : Number.isSafeInteger(result.pr) ? String(result.pr) : undefined;
+    return recordPr === pr && result.headCommit === head && result.reviewed === false
+      && typeof result.error === 'string' && result.error.length > 0;
+  } catch { return false; }
 }
 
 function normalizeReviewPrArg(input: string, deps: SelfReviewCliDeps): string | null {
@@ -1371,6 +1444,105 @@ function createDetachedReviewWorktree(commit: string, deps: SelfReviewCliDeps):
   return { cwd, commit, remove };
 }
 
+// ── 착지 관문(landing gate) — requested/actual ────────────────────────────────────────────
+//
+// ⚠️ 왜 생산자(여기)에 있나: 착지 관문(`src/cli/pr-land-overlap-evidence.ts`)도 결과 JSON 을 읽어
+//    같은 대조를 하지만, 그 파일을 **만드는 자리**가 틀린 requested/actual 을 적으면 관문은 그
+//    거짓을 근거로 판정한다. 그리고 `acp.reviewDenyBackends` 가 금지한 백엔드가 낸 판정은 파일이
+//    되기 **전에** 거부돼야 `--save` 로도 착지 근거가 될 수 없다(fail-closed).
+//
+// ⛔ 못 잰 값(`unmeasured`)을 «일치»로 적지 않는다 — 부재와 미지를 같은 값으로 두지 않는다.
+
+/** 사람이 요청한 리뷰어. `value` 는 화면·로그에 그대로 나가는 **요청 원문**이다. */
+interface LandingGateRequest {
+  kind: 'api-model' | 'acp-backend' | 'role-lane';
+  value: string;
+  /** api-model 요청의 정규화된 기대 모델(짧은 별칭 → 정본 ID). */
+  model?: string;
+  /** acp-backend 요청의 기대 백엔드. */
+  backend?: string;
+}
+
+/** 실제로 판정을 낸 리뷰어. `value` 는 실측 원문(`api:<model>` · `acp:<backend>` · `unmeasured`). */
+interface LandingGateActual {
+  kind: 'api' | 'acp' | 'unknown';
+  value: string;
+  model?: string;
+  backend?: string;
+  respondedProvider?: string;
+  respondedModel?: string;
+}
+
+type LandingGateOutcome =
+  | { state: 'consistent'; requested: string; actual: string }
+  | { state: 'mismatch'; requested: string; actual: string; warning: string }
+  | { state: 'denied'; requested: string; actual: string; warning: string; refusal: 'review-forbidden-acp-backend'; deniedBackend: string };
+
+function normalizedReviewBackend(value: string | undefined): string {
+  return canonicalizeBackendId((value ?? '').trim()).trim().toLowerCase();
+}
+
+/** 금지 목록 대조. 문자열 엔트리와 구조형(`{backend, expiresAt}`) 엔트리가 같은 값으로 접힌다. */
+function deniedReviewBackend(backend: string | undefined, denyBackends: readonly string[]): boolean {
+  const target = normalizedReviewBackend(backend);
+  if (!target) return false;
+  return denyBackends.some((denied) => normalizedReviewBackend(denied) === target);
+}
+
+function landingGateAgrees(request: LandingGateRequest, actual: LandingGateActual): boolean {
+  // ⛔ 실측을 못 잰 것을 «일치»로 적지 않는다(요청이 있으면 불일치로 남긴다).
+  if (actual.kind === 'unknown') return false;
+  if (request.kind === 'api-model') {
+    if (actual.kind !== 'api') return false;
+    const requested = (request.model ?? request.value).trim().toLowerCase();
+    const selected = (actual.model ?? '').trim().toLowerCase();
+    if (selected && selected === requested) return true;
+    const respondedProvider = (actual.respondedProvider ?? '').trim().toLowerCase();
+    const respondedModel = (actual.respondedModel ?? '').trim().toLowerCase();
+    // 요청이 공급자 한정 형태(`openrouter/<model>`)일 때만 공급자·응답 모델을 대조한다 —
+    // 맨 모델 ID(`gpt-6-sol`·`claude-sonnet-4`)는 공급자와 비교할 수 없다.
+    const slash = requested.indexOf('/');
+    if (slash <= 0) return false;
+    const requestedProvider = requested.slice(0, slash);
+    const requestedTail = requested.slice(slash + 1);
+    return Boolean(respondedProvider) && respondedProvider === requestedProvider
+      && Boolean(respondedModel) && (respondedModel === requestedTail || respondedModel === requested);
+  }
+  if (request.kind === 'acp-backend') {
+    return actual.kind === 'acp' && normalizedReviewBackend(actual.backend) === normalizedReviewBackend(request.backend);
+  }
+  // role-lane: 설정이 고른 레인은 provider 표기(`claude-acp`)와 백엔드 표기(`claude`)가 달라
+  // 백엔드 이름으로 비교하지 않는다 — 「ACP 레인으로 판정했나」만 본다.
+  return actual.kind === 'acp';
+}
+
+function landingGateOutcome(input: {
+  pr: string;
+  reviewRoute: 'api' | 'acp' | 'acp-fallback';
+  request?: LandingGateRequest | undefined;
+  actual: LandingGateActual;
+  deniedBackends: readonly string[];
+}): LandingGateOutcome {
+  const requested = input.request?.value ?? '(none)';
+  const actual = input.actual.value;
+  if (input.actual.kind === 'acp' && deniedReviewBackend(input.actual.backend, input.deniedBackends)) {
+    const deniedBackend = normalizedReviewBackend(input.actual.backend);
+    return {
+      state: 'denied', requested, actual, refusal: 'review-forbidden-acp-backend', deniedBackend,
+      warning: `⛔ LANDING GATE DENY (fail-closed): requested=${requested} actual=${actual} denied=${deniedBackend} reviewRoute=${input.reviewRoute} — acp.reviewDenyBackends 가 금지한 백엔드가 판정을 냈습니다. PR ${input.pr} 의 이 리뷰는 착지 근거가 아니며 self review 는 실패(rc≠0)로 끝납니다.`,
+    };
+  }
+  if (!input.request || landingGateAgrees(input.request, input.actual)) return { state: 'consistent', requested, actual };
+  const responded = [
+    input.actual.respondedProvider ? `respondedProvider=${input.actual.respondedProvider}` : '',
+    input.actual.respondedModel ? `respondedModel=${input.actual.respondedModel}` : '',
+  ].filter(Boolean).join(' ');
+  return {
+    state: 'mismatch', requested, actual,
+    warning: `⚠️ LANDING GATE REQUESTED/ACTUAL MISMATCH: requested=${requested} actual=${actual} reviewRoute=${input.reviewRoute}${responded ? ` ${responded}` : ''} — 요청한 리뷰어와 실제로 판정을 낸 리뷰어가 다릅니다(PR ${input.pr}). 이 리뷰를 착지 근거로 쓰기 전에 확인하세요.`,
+  };
+}
+
 /** `elanous self review <pr...>` 본문. read-only — 머지하지 않는다. */
 /**
  * `self review --json` stdout 한 줄 — 결과가 하나면 객체, 여럿이면 배열. index.ts 액션이 이것을 그대로 쓴다.
@@ -1380,27 +1552,13 @@ export function selfReviewJsonLine(results: readonly unknown[]): string {
   return JSON.stringify(results.length === 1 ? results[0] : results) + '\n';
 }
 
-// Normalize only whole-item forms whose complete text is an explicit no-finding
-// sentinel. Any extra clause stays in mustFix (fail-closed).
-const NO_FINDING_REVIEW_NOTE_ALLOWLIST: readonly RegExp[] = [
-  /^(?:없음|해당\s*없음|none|nothing|n\/a)[.!。]?$/i,
-  /^\((?:없음|해당\s*없음|none|nothing|n\/a)\)[.!。]?$/i,
-  /^\(이 조각에서 확인된 코어 결함 없음\s*[—–-]\s*명시 intent 기준 mustFix 는 비움\)$/i,
-  /^\(이 조각에서 검증된 (?:차단 )?결함은 발견되지 않음(?:\s*\(mustFix \[\]\))?\)$/i,
-];
-
-function isNoFindingReviewNote(finding: string): boolean {
-  const wholeItem = finding.trim();
-  return NO_FINDING_REVIEW_NOTE_ALLOWLIST.some((form) => form.test(wholeItem));
-}
-
 function normalizeSavedReviewMustFix(result: Record<string, unknown>): { result: Record<string, unknown>; count: number } {
   if (!Array.isArray(result.mustFix)) return { result, count: 0 };
   const noFindingNotes = result.mustFix.filter((finding): finding is string =>
-    typeof finding === 'string' && isNoFindingReviewNote(finding));
+    typeof finding === 'string' && isNoneSentinelFinding(finding));
   if (noFindingNotes.length === 0) return { result, count: 0 };
   const retained = result.mustFix.filter((finding) =>
-    typeof finding !== 'string' || !isNoFindingReviewNote(finding));
+    typeof finding !== 'string' || !isNoneSentinelFinding(finding));
   const existingNotes = Array.isArray(result.noFindingNotes) ? result.noFindingNotes : [];
   return {
     result: { ...result, mustFix: retained, noFindingNotes: [...existingNotes, ...noFindingNotes] },
@@ -1415,6 +1573,141 @@ export async function runSelfReviewCliCommand(
 ): Promise<SelfReviewCliOutcome> {
   const pins: ReviewWorktree[] = [];
   try {
+    // Resolve inside the leaf CLI seam so src/index.ts needs no mix-specific registration.
+    const reviewerMix = opts.reviewerMix === undefined
+      ? loadLlmPolicy().policy.roles.reviewerMix ?? getUserConfig().roleLlm?.reviewerMix ?? DEFAULT_REVIEWER_MIX
+      : opts.reviewerMix;
+    // The route is chosen outside the existing single-review pipeline so explicit CLI flags retain
+    // their exact behavior. A failed reviewer is retried on the same pinned PR diff by the next lane.
+    if (reviewerMix && (opts.save === undefined || /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(opts.save)) &&
+        !opts.model?.trim() && !opts.acp && !opts.acpBackend && !opts.acpModel && !deps.envModel()) {
+      const results: Array<Record<string, unknown>> = [];
+      let failed = 0;
+      for (const arg of prArgs) {
+        const pr = normalizeReviewPrArg(arg, deps);
+        const lanes = pr ? reviewLaneOrder(pr, reviewerMix) : [];
+        if (!pr || lanes.length === 0) {
+          const outcome = await runSelfReviewCliCommandPinned([arg], { ...opts, reviewerMix: undefined }, deps, pins);
+          results.push(...outcome.results);
+          failed += outcome.failed;
+          continue;
+        }
+        const initialHead = prHeadCommit(pr, deps);
+        if (initialHead.state !== 'known') {
+          deps.log('review.lane-head-unknown', { pr, headState: initialHead.state }, { level: 'warn' });
+          results.push({ pr, reviewed: false, refusal: 'reviewer-mix-head-unknown',
+            failureReason: 'PR head could not be pinned before review', reviewerMixPrimaryLane: lanes[0] });
+          failed += 1;
+          continue;
+        }
+        let completed: Record<string, unknown> | undefined;
+        let last: Record<string, unknown> | undefined;
+        let completedLane: ReviewLane | undefined;
+        let attemptedLane: ReviewLane | undefined;
+        let completedWithError = false;
+        const pinnedHead = initialHead.value;
+        const priorEvidence = savedReviewEvidence(pr);
+        const capWasActive = priorEvidence.heads.length + priorEvidence.unreadableFiles.length >= 5;
+        const canonicalResultPath = join(effectiveInstanceRoot(), 'review-results', `pr-${pr}-${pinnedHead.slice(0, 12)}.json`);
+        if (capWasActive && existsSync(canonicalResultPath)
+          && !isReplaceableErrorArtifact(canonicalResultPath, pr, pinnedHead)) {
+          const message = `PR ${pr}: 동일 head 리뷰 결과가 이미 저장되어 있습니다: ${canonicalResultPath}`;
+          results.push({ pr, reviewed: false, refusal: 'cap-refused', existingResult: canonicalResultPath, headCommit: pinnedHead });
+          deps.error(message);
+          failed += 1;
+          continue;
+        }
+        let capClaimed = false;
+        let pendingFallback: { from: ReviewLane; reason: string } | undefined;
+        for (const [index, lane] of lanes.entries()) {
+          const observedHead = prHeadCommit(pr, deps);
+          if (observedHead.state !== 'known' || observedHead.value !== pinnedHead) {
+            last = { pr, reviewed: false, refusal: 'reviewer-mix-head-changed', stale: true,
+              expectedHeadCommit: pinnedHead, headCommit: observedHead.value };
+            deps.log('review.lane-head-changed', { pr, expectedHead: pinnedHead,
+              observedHead: observedHead.value }, { level: 'warn' });
+            break;
+          }
+          const laneOpts: SelfReviewCliOpts = {
+            ...opts, reviewerMix: undefined, reviewerMixPrimaryLane: lanes[0], reviewerMixAttemptLane: lane,
+            reviewerMixExpectedHead: pinnedHead, reviewerMixCapClaimed: capClaimed,
+            disableClaudeGlmFallback: true, json: true,
+            ...(lane === 'claude' ? { acp: true, acpBackend: 'claude', model: undefined } :
+              { acp: false, acpBackend: undefined, model: lane === 'sol' ? 'gpt-6-sol' : ROLE_REVIEWER_FALLBACK_MODEL }),
+          };
+          let reviewerStarted = false;
+          const laneDeps: SelfReviewCliDeps = { ...deps,
+            reviewPullRequest: (input, llm) => { reviewerStarted = true; return deps.reviewPullRequest(input, llm); },
+            observeDoctorReview: (event, data, options) => {
+              if (event === 'cap-override') capClaimed = true;
+              deps.observeDoctorReview?.(event, data, options);
+            },
+          };
+          try {
+            const outcome = await runSelfReviewCliCommandPinned([arg], laneOpts, laneDeps, pins);
+            last = outcome.results[0];
+            completedWithError = last?.reviewed === true && outcome.failed > 0;
+          } catch (error) {
+            last = { pr, reviewed: false, failureReason: safeLogText(error instanceof Error ? error.message : String(error), 400) };
+          }
+          if (last?.refusal === 'reviewer-mix-head-changed' || last?.refusal === 'cap-refused' || last?.stale === true) break;
+          if (reviewerStarted) {
+            attemptedLane = lane;
+            deps.log('review.lane-chosen', { pr, lane, primaryLane: lanes[0], attempt: index + 1, weights: reviewerMix });
+          }
+          if (pendingFallback && reviewerStarted) {
+            deps.log('review.lane-fallback', { pr, from: pendingFallback.from, to: lane,
+              reason: pendingFallback.reason }, { level: 'warn' });
+            pendingFallback = undefined;
+          }
+          if (last?.reviewed === true) {
+            completed = last;
+            completedLane = lane;
+            break;
+          }
+          if (last?.refusal || last?.stale === true || index === lanes.length - 1) break;
+          pendingFallback = { from: lane,
+            reason: safeLogText(String(last?.failureReason ?? last?.error ?? 'reviewed=false'), 400) };
+        }
+        const result = completed ?? last;
+        if (result) {
+          const selectedLane = completedLane ?? attemptedLane;
+          const enriched: Record<string, unknown> = { ...result, reviewerMixPrimaryLane: lanes[0],
+            ...(selectedLane ? { reviewerMixSelectedLane: selectedLane } : {}) };
+          results.push(enriched);
+          if (completed && completed.reviewed === true) {
+            try {
+              mkdirSync(dirname(canonicalResultPath), { recursive: true });
+              const normalized = normalizeSavedReviewMustFix(enriched);
+              if (enriched.headCommit !== pinnedHead || enriched.stale === true
+                || enriched.currentHeadCommit !== pinnedHead) {
+                throw new Error('review result is not pinned to the confirmed current PR head');
+              }
+              writeFileSync(canonicalResultPath, selfReviewJsonLine([normalized.result]));
+            } catch (error) {
+              failed += 1;
+              deps.error(`PR ${pr}: 리뷰 결과 저장 실패 (${canonicalResultPath}): ${error instanceof Error ? error.message : String(error)}`);
+              if (capWasActive) {
+                const authorization = readCapOverride(pr);
+                const claimPath = authorization?.head === pinnedHead.toLowerCase()
+                  ? join(effectiveInstanceRoot(), 'review-results', `cap-override-${pr}.json`)
+                  : join(effectiveInstanceRoot(), 'review-results', `cap-override-${pr}-head-${pinnedHead.toLowerCase()}.json`);
+                try { unlinkSync(claimPath); } catch { /* already absent or owned by another lane */ }
+              }
+            }
+          } else if (capWasActive && !completed && capClaimed) {
+            const authorization = readCapOverride(pr);
+            const claimPath = authorization?.head === pinnedHead.toLowerCase()
+              ? join(effectiveInstanceRoot(), 'review-results', `cap-override-${pr}.json`)
+              : join(effectiveInstanceRoot(), 'review-results', `cap-override-${pr}-head-${pinnedHead.toLowerCase()}.json`);
+            try { unlinkSync(claimPath); } catch { /* already absent or owned by another lane */ }
+          }
+          if (!opts.json) deps.print(`\n━━ PR ${pr} (${String(enriched.model ?? 'review failed')}) ━━\n${deps.renderReview(enriched as unknown as ReviewResult)}`);
+        }
+        if (!completed || completedWithError) failed += 1;
+      }
+      return { results, failed };
+    }
     return await runSelfReviewCliCommandPinned(prArgs, opts, deps, pins);
   } finally {
     for (const pin of pins) pin.remove();
@@ -1468,8 +1761,10 @@ async function runSelfReviewCliCommandPinned(
     deps.error(message);
     return { results: opts.json ? [{ error: message }] : [], failed: 1 };
   }
-  const automaticFallbacks = orderedAcpReviewFallbackBackends(opts.configuredAcpBackend,
-    opts.reviewDenyBackends === undefined ? configuredReviewDenyBackends : reviewDenyBackends);
+  // 이 명령이 실제로 적용하는 금지 목록 — 자동 폴백 후보에서 빼는 데 쓰이고(종전과 같은 값),
+  // 이제 착지 관문이 «실제로 판정을 낸 백엔드»를 대조하는 데에도 같은 값으로 쓰인다.
+  const effectiveReviewDenyBackends: string[] = opts.reviewDenyBackends === undefined ? configuredReviewDenyBackends : reviewDenyBackends;
+  const automaticFallbacks = orderedAcpReviewFallbackBackends(opts.configuredAcpBackend, effectiveReviewDenyBackends);
   const fallbackAcpBackends = opts.acpBackend
     ? [canonicalizeBackendId(opts.acpBackend)]
     : automaticFallbacks.backends;
@@ -1520,7 +1815,13 @@ async function runSelfReviewCliCommandPinned(
       const made = deps.makeRoleReviewerLlm
         ? deps.makeRoleReviewerLlm(opts.roleReviewer, { timeoutMs: acpTimeoutSec * 1000 })
         : { reason: 'role-reviewer-seam-missing' };
-      if ('llm' in made) roleReviewer = { llm: made.llm, model: `acp:${made.backend}` };
+      // ⛔ 금지 목록(acp.reviewDenyBackends)은 «자동 폴백 후보»만이 아니라 **자동 선택 전부**를 막는다.
+      //    역할 레인은 사람이 친 플래그가 아니라 설정이 고른 자동 선택이므로, 금지된 백엔드가 레인을
+      //    잡으면 그 리뷰가 그대로 착지 근거가 됐다(fail-open). ⇒ 레인을 쓰지 않고 같은 사유 코드로
+      //    API 로 내려간다(`role-reviewer-fallback · stage=availability` 가 관측에 남는다).
+      if ('llm' in made && deniedReviewBackend(made.backend, effectiveReviewDenyBackends)) {
+        roleReviewerUnavailableReason = 'denied-by-acp.reviewDenyBackends';
+      } else if ('llm' in made) roleReviewer = { llm: made.llm, model: `acp:${made.backend}` };
       else roleReviewerUnavailableReason = safeLogText(made.reason, 400);
     } catch (error) {
       roleReviewerUnavailableReason = roleAcpErrorReason(error);
@@ -1546,8 +1847,12 @@ async function runSelfReviewCliCommandPinned(
   const providedReviewerContext = loadReviewerContext(opts, deps.readReferencedFile);
   const hasProvidedReviewerContext = (opts.contextOrder?.length ?? 0) > 0 || (opts.context?.length ?? 0) > 0 || (opts.contextText?.length ?? 0) > 0;
   for (const pr of normalizedPrArgs as string[]) {
-    const previousHeads = savedReviewHeads(pr);
-    const previousRoundCount = previousHeads.length;
+    const savedEvidence = savedReviewEvidence(pr, undefined, (file) => {
+      deps.observeDoctorReview?.('saved-result-unreadable', { pr, file }, { level: 'warn' });
+    });
+    const previousHeads = savedEvidence.heads;
+    const previousRoundCount = previousHeads.length + savedEvidence.unreadableFiles.length;
+    const shouldPersistCapResult = previousRoundCount >= 5 && !opts.reviewerMixPrimaryLane;
     const reason = opts.overCapReason?.trim();
     const authorization = previousRoundCount >= 5 ? readCapOverride(pr) : undefined;
     deps.observeDoctorReview?.('round-counted', { pr, previousRoundCount, round: previousRoundCount + 1 });
@@ -1555,7 +1860,7 @@ async function runSelfReviewCliCommandPinned(
     if (previousRoundCount >= 5) {
       deps.observeDoctorReview?.('cap-attempt', { pr, previousRoundCount, round: previousRoundCount + 1, reasonProvided: Boolean(reason), opAllowed }, { level: 'warn' });
     }
-    if (previousRoundCount >= 5 && (!opAllowed || (!authorization && !reason))) {
+    if (previousRoundCount >= 5 && (!opAllowed || (!authorization && !reason && !opts.reviewerMixCapClaimed))) {
       const refusalHead = prHeadCommit(pr, deps).value;
       const message = !opAllowed
         ? `PR ${pr}: r5 상한 초과 리뷰는 OP traffic.json reviewOverCapAllow 허용 목록에 있어야 합니다.`
@@ -1567,11 +1872,45 @@ async function runSelfReviewCliCommandPinned(
       continue;
     }
     const diffRead = readDiffAtHead(pr, deps);
-    if (previousRoundCount >= 5 && authorization && diffRead.headCommit.toLowerCase() === authorization.head) {
-      const message = `PR ${pr}: 동일 head는 이미 승인 소모 기록이 있습니다.`;
+    const canonicalResultPath = COMMIT_OID.test(diffRead.headCommit)
+      ? join(effectiveInstanceRoot(), 'review-results', `pr-${pr}-${diffRead.headCommit.slice(0, 12)}.json`)
+      : undefined;
+    let claimedCapPath: string | undefined;
+    const releaseCapClaim = (): void => {
+      if (!claimedCapPath || opts.reviewerMixPrimaryLane) return;
+      try {
+        unlinkSync(claimedCapPath);
+        claimedCapPath = undefined;
+      } catch (error) {
+        deps.error(`PR ${pr}: 상한 예외 사용 기록 롤백 실패 (${claimedCapPath}): ${error instanceof Error ? error.message : String(error)}`);
+      }
+    };
+    if (shouldPersistCapResult && canonicalResultPath && existsSync(canonicalResultPath)
+      && !isReplaceableErrorArtifact(canonicalResultPath, pr, diffRead.headCommit)) {
+      const message = `PR ${pr}: 동일 head 리뷰 결과가 이미 저장되어 있습니다: ${canonicalResultPath}`;
+      deps.error(message);
+      results.push({ pr, error: message, reviewed: false, refusal: 'cap-refused', previousRoundCount, headCommit: diffRead.headCommit, existingResult: canonicalResultPath });
+      failed += 1;
+      continue;
+    }
+    if (opts.reviewerMixExpectedHead && diffRead.headCommit !== opts.reviewerMixExpectedHead) {
+      const refusal = { pr, reviewed: false, verdict: null, mustFix: [], shouldFix: [],
+        refusal: 'reviewer-mix-head-changed', stale: true, headCommit: diffRead.headCommit,
+        expectedHeadCommit: opts.reviewerMixExpectedHead };
+      deps.log('review.lane-head-changed', { pr, expectedHead: opts.reviewerMixExpectedHead,
+        observedHead: diffRead.headCommit }, { level: 'warn' });
+      if (opts.json || opts.save !== undefined) results.push(refusal);
+      failed += 1;
+      continue;
+    }
+    if (previousRoundCount >= 5 && authorization && diffRead.headCommit.toLowerCase() === authorization.head && !opts.reviewerMixCapClaimed) {
+      const resultExists = canonicalResultPath && existsSync(canonicalResultPath);
+      const message = resultExists
+        ? `PR ${pr}: 동일 head 리뷰 결과가 이미 저장되어 있습니다: ${canonicalResultPath}`
+        : `PR ${pr}: 동일 head는 이미 승인 소모 기록이 있습니다. 결과 파일을 찾을 수 없어 재리뷰하지 않습니다.`;
       deps.observeDoctorReview?.('cap-refused', { pr, head: diffRead.headCommit, previousRoundCount, round: previousRoundCount + 1, reason: 'same-head-already-used' }, { level: 'warn' });
       deps.error(message);
-      if (opts.json || opts.save !== undefined) results.push({ pr, error: message, reviewed: false, refusal: 'cap-refused', previousRoundCount, headCommit: diffRead.headCommit });
+      if (opts.json || opts.save !== undefined || resultExists) results.push({ pr, error: message, reviewed: false, refusal: 'cap-refused', previousRoundCount, headCommit: diffRead.headCommit, ...(resultExists ? { existingResult: canonicalResultPath } : {}) });
       failed += 1;
       continue;
     }
@@ -1584,7 +1923,7 @@ async function runSelfReviewCliCommandPinned(
       continue;
     }
     let mergeOnlyDeltaRange: { base: string; head: string } | undefined;
-    if (previousRoundCount >= 5 && authorization) {
+    if (previousRoundCount >= 5 && authorization && !opts.reviewerMixCapClaimed) {
       const git = deps.git;
       if (!git || diffRead.source !== 'sha-pinned' || diffRead.headCommitState !== 'known'
         || diffRead.currentHeadCommitState !== 'known' || diffRead.stale || diffRead.diff.status !== 0) {
@@ -1594,7 +1933,7 @@ async function runSelfReviewCliCommandPinned(
         failed += 1;
         continue;
       }
-      const savedRecords = savedReviewRecords(pr);
+      const savedRecords = savedEvidence.records;
       const latestReviewed = savedRecords.reduce<(typeof savedRecords)[number] | undefined>(
         (latest, record) => !latest || record.reviewedAt > latest.reviewedAt ? record : latest, undefined,
       );
@@ -1629,7 +1968,9 @@ async function runSelfReviewCliCommandPinned(
         }
         if (commits.stdout.trim() === '') mergeOnlyDeltaRange = { base: classificationBase, head: diffRead.headCommit.toLowerCase() };
       }
-    } else if (previousRoundCount >= 5 && reason) {
+    } else if (previousRoundCount >= 5 && reason && !opts.reviewerMixCapClaimed) {
+      // Claim only the exact SHA-pinned diff that the reviewer will see; never spend an OP
+      // authorization on a separately read head that may move before readDiffAtHead.
       const claimable = diffRead.source === 'sha-pinned' && diffRead.headCommitState === 'known'
         && diffRead.currentHeadCommitState === 'known' && !diffRead.stale && diffRead.diff.status === 0;
       if (!claimable || !claimCapOverride(pr, diffRead.headCommit, reason, deps.now())) {
@@ -1640,6 +1981,9 @@ async function runSelfReviewCliCommandPinned(
         failed += 1;
         continue;
       }
+      claimedCapPath = join(effectiveInstanceRoot(), 'review-results', authorization
+        ? `cap-override-${pr}-head-${diffRead.headCommit.toLowerCase()}.json`
+        : `cap-override-${pr}.json`);
       deps.observeDoctorReview?.('cap-override', { pr, head: diffRead.headCommit, previousRoundCount, round: previousRoundCount + 1, reason }, { level: 'warn' });
     }
     if (mergeOnlyDeltaRange) {
@@ -1648,19 +1992,24 @@ async function runSelfReviewCliCommandPinned(
         const message = `PR ${pr}: merge-only 후속 head의 delta diff를 고정할 수 없습니다.`;
         deps.error(message);
         if (opts.json || opts.save !== undefined) results.push({ pr, error: message, reviewed: false, refusal: 'cap-refused', previousRoundCount, headCommit: diffRead.headCommit });
+        releaseCapClaim();
         failed += 1;
         continue;
       }
       diffRead.diff = delta;
       diffRead.baseCommit = mergeOnlyDeltaRange.base;
     }
-    if (previousRoundCount >= 5 && authorization && !claimCapOverride(pr, diffRead.headCommit, authorization.reason, deps.now())) {
+    if (previousRoundCount >= 5 && authorization && !opts.reviewerMixCapClaimed && !claimCapOverride(pr, diffRead.headCommit, authorization.reason, deps.now())) {
       const message = `PR ${pr}: 후속 head 승인 사용 기록을 남기지 못했습니다.`;
       deps.error(message);
       if (opts.json || opts.save !== undefined) results.push({ pr, error: message, reviewed: false, refusal: 'cap-refused', previousRoundCount, headCommit: diffRead.headCommit });
       failed += 1;
       continue;
     }
+    if (previousRoundCount >= 5 && authorization && !opts.reviewerMixCapClaimed) {
+      claimedCapPath = join(effectiveInstanceRoot(), 'review-results', `cap-override-${pr}-head-${diffRead.headCommit.toLowerCase()}.json`);
+      deps.observeDoctorReview?.('cap-override', { pr, head: diffRead.headCommit, previousRoundCount, round: previousRoundCount + 1, reason: authorization.reason }, { level: 'warn' });
+    }
     const localHeadComparison = compareLocalHead(pr, { value: diffRead.headCommit, state: diffRead.headCommitState }, deps);
     const { diff } = diffRead;
     const baseReviewerContext = hasProvidedReviewerContext
@@ -1751,8 +2100,24 @@ async function runSelfReviewCliCommandPinned(
         { pr: safeLogText(pr), exit: diff.status, error: safeLogText(diff.stderr || err, 160) },
         { level: 'warn' });
       const contextOutput = reviewerContextOutput(reviewerContext, decompositionContext);
-      if (opts.json || opts.save !== undefined) results.push({ pr, error: err, ...contextOutput, ...comparisonData, ...(mismatchWarning ?? {}) });
+      const errorResult = { pr, error: err, reviewed: false, headCommit: diffRead.headCommit,
+        currentHeadCommit: diffRead.currentHeadCommit, stale: diffRead.stale,
+        ...contextOutput, ...comparisonData, ...(mismatchWarning ?? {}) };
+      if (opts.json || opts.save !== undefined) results.push(errorResult);
+      if (canonicalResultPath && COMMIT_OID.test(diffRead.headCommit)
+        && diffRead.headCommitState === 'known' && diffRead.currentHeadCommitState === 'known'
+        && diffRead.currentHeadCommit === diffRead.headCommit && !diffRead.stale) {
+        try {
+          if (!existsSync(canonicalResultPath) || isReplaceableErrorArtifact(canonicalResultPath, pr, diffRead.headCommit)) {
+            mkdirSync(dirname(canonicalResultPath), { recursive: true });
+            writeFileSync(canonicalResultPath, selfReviewJsonLine([errorResult]));
+          }
+        } catch (error) {
+          deps.error(`PR ${pr}: 오류 리뷰 결과 저장 실패 (${canonicalResultPath}): ${error instanceof Error ? error.message : String(error)}`);
+        }
+      }
       if (!opts.json) deps.error(`PR ${pr}: ${err}\n${reviewerContextStatus}`);
+      releaseCapClaim();
       failed += 1;
       continue;
     }
@@ -1814,6 +2179,7 @@ async function runSelfReviewCliCommandPinned(
       };
       if (opts.json || opts.save !== undefined) results.push(refused);
       if (!opts.json) deps.print(`\n━━ PR ${pr} (${primaryModel}) ━━\n${renderStaleRefusal(diffRead)}\n${reviewerContextStatus}`);
+      releaseCapClaim();
       continue;
     }
     // ⭐ 머지된 PR 만 머지 커밋 detached worktree 에서 리뷰한다 — main 최신이 아니라 그 PR 이 머지된 시점의 코드를 본다.
@@ -1867,6 +2233,7 @@ async function runSelfReviewCliCommandPinned(
       ...(deps.readReferencedFile ? { readReferencedFile: deps.readReferencedFile } : {}),
       ...(goalAcceptance.acceptance ? { acceptance: goalAcceptance.acceptance } : {}),
     };
+    const intentFingerprint = reviewIntentFingerprint(reviewInput.phaseIntent);
     // ⭐ Role-config ACP lane: a completed ACP review is used as-is; anything else (throw, reviewed≠true)
     //    falls to the same API review this command ran before the lane existed — and is observed.
     // ⚠️ Stricter than the harness lane on purpose: `runSubscriptionReviewer` accepts any non-empty text;
@@ -1936,7 +2303,7 @@ async function runSelfReviewCliCommandPinned(
     //   An explicit `--acp-model` is the operator's model choice: it is not silently swapped for GLM.
     //   GLM that throws or also ends without a verdict keeps the claude result, and says so (`glmReviewed`).
     let claudeFallbackGlm: { reason: string; model: string; glmReviewed: boolean; glmFailureReason?: string } | undefined;
-    if (useAcp && !roleReview && !acpModel && canonicalizeBackendId(acpBackend) === 'claude' && review.reviewed !== true) {
+    if (useAcp && !roleReview && !acpModel && !opts.disableClaudeGlmFallback && canonicalizeBackendId(acpBackend) === 'claude' && review.reviewed !== true) {
       const reason = safeLogText(review.failureReason || 'reviewed=false', 400);
       debug.log('review.acp', 'claude-fallback-glm', { reason }, { level: 'warn' });
       fallbackAttempted = true;
@@ -1967,6 +2334,50 @@ async function runSelfReviewCliCommandPinned(
       ...(reviewPin && reviewedOnPin ? { reviewCwdCommit: reviewPin.commit } : {}),
       ...(reviewCwdPinFallbackReason ? { reviewCwdPinFallbackReason } : {}),
     };
+    // ⭐ 착지 관문 — 요청한 리뷰어와 실제로 판정을 낸 리뷰어를 대조한다. 판정이 나온 리뷰에만
+    //    의미가 있다(리뷰가 없으면 근거도 없고, 실패는 기존 회계가 이미 센다).
+    const acpActual = (backendText: string | undefined): LandingGateActual => {
+      const backend = normalizedReviewBackend(backendText);
+      return backend ? { kind: 'acp', value: `acp:${backend}`, backend } : { kind: 'unknown', value: 'unmeasured' };
+    };
+    const landingGateRequest: LandingGateRequest | undefined = requestedModel
+      ? { kind: 'api-model', value: opts.model?.trim() || requestedModel, model: explicitApiModel ?? requestedModel }
+      : useAcp
+        ? { kind: 'acp-backend', value: `acp:${canonicalizeBackendId(acpBackend)}`, backend: acpBackend }
+        : reviewerSource === 'role-config' && opts.roleReviewer
+          ? { kind: 'role-lane', value: `acp:${opts.roleReviewer.provider}` }
+          : undefined;
+    const landingGateActual: LandingGateActual = reviewRoute === 'acp-fallback'
+      ? acpActual(fallbackBackend)
+      : reviewRoute === 'acp'
+        ? acpActual(roleReview && prRoleReviewer ? prRoleReviewer.model.replace(/^acp:/, '') : acpBackend)
+        : ((): LandingGateActual => {
+            const apiModel = (selectedModel ?? '').trim();
+            if (!apiModel) return { kind: 'unknown', value: 'unmeasured' };
+            return {
+              kind: 'api', value: `api:${apiModel}`, model: apiModel,
+              ...(responded.provider ? { respondedProvider: responded.provider } : {}),
+              ...(responded.model ? { respondedModel: responded.model } : {}),
+            };
+          })();
+    const landingGate = review.reviewed === true
+      ? landingGateOutcome({ pr, reviewRoute, request: landingGateRequest, actual: landingGateActual, deniedBackends: effectiveReviewDenyBackends })
+      : undefined;
+    if (landingGate && landingGate.state !== 'consistent') {
+      deps.error(landingGate.warning);
+      deps.log('landing-gate', {
+        pr: safeLogText(pr), decision: landingGate.state, reviewRoute,
+        requested: safeLogText(landingGate.requested), actual: safeLogText(landingGate.actual),
+        ...(landingGate.state === 'denied' ? { deniedBackend: landingGate.deniedBackend } : {}),
+      }, { level: 'warn' });
+    }
+    const landingGateAdmitted = landingGate?.state !== 'denied';
+    const landingGateDeniedBackend = landingGate?.state === 'denied' ? landingGate.deniedBackend : undefined;
+    const landingGateFields: Record<string, unknown> = landingGate?.state === 'mismatch'
+      ? { landingGateDecision: 'mismatch', landingGateRequested: landingGate.requested, landingGateActual: landingGate.actual }
+      : landingGate?.state === 'denied'
+        ? { landingGateDecision: 'denied', landingGateRequested: landingGate.requested, landingGateActual: landingGate.actual, landingGateDeniedBackend: landingGate.deniedBackend }
+        : {};
     if (!fallbackAttempted) {
       fallbackNotAttemptedReason = useAcp ? 'explicit-acp' : requestedModel && review.reviewed !== true ? 'explicit-model' : 'primary-review-succeeded';
     }
@@ -1991,13 +2402,33 @@ async function runSelfReviewCliCommandPinned(
     const reviewerSelection = {
       ...reviewerSourceObservation(),
       ...(roleReviewerFallbackReason !== undefined ? { roleReviewerFallbackReason } : {}),
+      ...(opts.reviewerMixPrimaryLane ? { reviewerMixPrimaryLane: opts.reviewerMixPrimaryLane,
+        reviewerMixSelectedLane: opts.reviewerMixAttemptLane } : {}),
     };
+    // The reviewer owns its finding severity. A missing citation is separate evidence,
+    // never a new must-fix or a verified defect. Keep unreadable heads distinct too.
+    const reviewRepositoryPath = deps.reviewRepositoryPath;
+    const findingPathHeadChecks = review.reviewed === true && landingGateAdmitted
+      && diffRead.headCommitState === 'known' && reviewRepositoryPath
+      ? ([...review.mustFix.map(finding => ({ severity: 'mustFix' as const, finding })),
+          ...review.shouldFix.map(finding => ({ severity: 'shouldFix' as const, finding }))]
+          .map(({ severity, finding }) => ({ severity, finding,
+            ...checkCitedReviewPathsAtHead(finding, reviewRepositoryPath, diffRead.headCommit) }))
+          .filter(check => check.paths.length > 0))
+      : [];
+    const pathWarnings = findingPathHeadChecks.flatMap(check => check.paths
+      .filter(path => path.status !== 'present')
+      .map(path => `${path.status === 'missing' ? '경로 미확인' : '경로 검증 불가'}: ${path.path} (PR head ${check.head})`));
+    if (pathWarnings.length) deps.log('finding-path-head-check', {
+      pr, headCommit: diffRead.headCommit, missing: findingPathHeadChecks.flatMap(check => check.paths).filter(path => path.status === 'missing').length,
+      unreadable: findingPathHeadChecks.flatMap(check => check.paths).filter(path => path.status === 'unreadable').length,
+    }, { level: 'warn' });
     // ⚠️ verdict=fail 은 **정상 동작**(리뷰가 일한 것)이라 warn 으로 올리지 않는다. 대신 `reviewed:false`
     //    (fail-soft pass·리뷰 미실행)는 조용히 통과로 읽히면 위험하므로 warn 이다.
     deps.log('done',
       {
         ...buildReviewObservation({
-          pr, model: selectedModel, intent, review, durationMs: deps.now() - startedAt,
+          pr, model: selectedModel, intent, intentFingerprint, review, durationMs: deps.now() - startedAt,
           ...reviewProvenance,
           ...intentTruncation,
           ...reviewDiffBudgetObservation(review),
@@ -2011,6 +2442,7 @@ async function runSelfReviewCliCommandPinned(
         acceptanceChars: goalAcceptance.acceptanceChars,
         ...reviewerSelection,
         ...reviewCwdOutput,
+        ...landingGateFields,
       },
       { level: review.reviewed === false ? 'warn' : 'info' });
     // --acp 는 대표가 명시 요청한 리뷰 — fail-soft(reviewed=false)면 조용히 pass 하지 말고 표면화(관측=acp-review).
@@ -2019,17 +2451,43 @@ async function runSelfReviewCliCommandPinned(
       const contextOutput = reviewerContextOutput(reviewerContext, decompositionContext);
       if (opts.json || opts.save !== undefined) results.push({ pr, error: err, ...review, verdict: null, ...reviewProvenance, ...respondedOutput, ...reviewerSelection, ...reviewCwdOutput, ...provenance, ...contextOutput });
       if (!opts.json) deps.error(`PR ${pr}: ${err}\n${renderProvenance(diffRead)}\n${reviewerContextStatus}`);
+      releaseCapClaim();
       failed += 1;
       continue;
     }
     const contextOutput = reviewerContextOutput(reviewerContext, decompositionContext);
     const jsonReview = review.reviewed === true ? review : { ...review, verdict: null };
-    if (opts.json || opts.save !== undefined) results.push({ pr, model: selectedModel, ...jsonReview, ...reviewProvenance, ...respondedOutput, ...reviewerSelection, ...reviewCwdOutput, ...provenance, ...contextOutput, evidence: evidence.evidence, prDiffFiles: evidence.prDiffFiles, ...(evidence.authoredFiles !== undefined ? { authoredFiles: evidence.authoredFiles } : {}) });
-    if (!opts.json) deps.print(`\n━━ PR ${pr} (${selectedModel}) ━━\n${renderProvenance(diffRead)}\n${evidenceLine}\n${reviewerContextStatus}\n${deps.renderReview(review)}`);
+    // ⛔ 금지 백엔드가 낸 판정은 «근거 거부»다 — verdict·mustFix 를 그대로 실어 보내면 읽는 쪽이
+    //    그것을 착지 판정으로 쓴다(관문도 reviewed===true 를 근거 조건으로 본다).
+    const refusalOverride = landingGateAdmitted ? {} : { reviewed: false, verdict: null, refusal: 'review-forbidden-acp-backend' as const };
+    const resultOutput = { pr, model: selectedModel, ...jsonReview, ...reviewProvenance, ...respondedOutput, ...reviewerSelection, ...reviewCwdOutput, ...provenance, ...contextOutput, ...refusalOverride, ...landingGateFields, findingPathHeadChecks, pathWarnings, evidence: evidence.evidence, prDiffFiles: evidence.prDiffFiles, ...(evidence.authoredFiles !== undefined ? { authoredFiles: evidence.authoredFiles } : {}) };
+    if (opts.json || opts.save !== undefined || shouldPersistCapResult) results.push(resultOutput);
+    if (!shouldPersistCapResult
+      && landingGateAdmitted && review.reviewed === true && diffRead.headCommitState === 'known'
+      && diffRead.currentHeadCommitState === 'known' && diffRead.currentHeadCommit === diffRead.headCommit
+      && !diffRead.stale && COMMIT_OID.test(diffRead.headCommit)) {
+      const path = canonicalResultPath ?? join(effectiveInstanceRoot(), 'review-results', `pr-${pr}-${diffRead.headCommit.slice(0, 12)}.json`);
+      const normalized = normalizeSavedReviewMustFix(resultOutput);
+      try {
+        mkdirSync(dirname(path), { recursive: true });
+        // A successful review replaces an earlier error artifact for the same PR head.
+        writeFileSync(path, selfReviewJsonLine([normalized.result]));
+        if (normalized.count > 0 && opts.save === undefined) deps.log('mustfix-normalized', { pr, head: diffRead.headCommit, count: normalized.count });
+      } catch (error) {
+        deps.error(`PR ${pr}: 리뷰 결과 저장 실패 (${path}): ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+    if (!opts.json) {
+      if (!landingGateAdmitted) deps.print(`\n━━ PR ${pr} (${selectedModel}) ━━\n${renderProvenance(diffRead)}\n⛔ LANDING GATE: review-forbidden-acp-backend (${landingGateDeniedBackend ?? 'unknown'}) — 이 리뷰는 착지 근거가 아닙니다.\n${reviewerContextStatus}`);
+      else deps.print(`\n━━ PR ${pr} (${selectedModel}) ━━\n${renderProvenance(diffRead)}\n${evidenceLine}\n${reviewerContextStatus}\n${deps.renderReview(review)}${pathWarnings.length ? `\n${pathWarnings.join('\n')}` : ''}`);
+    }
     // REVIEW-ERROR-RC — 기본(API)·role 경로가 1차·폴백 모두 실패해 reviewed≠true 로 끝나도 «못 리뷰한 PR» 이다(verdict:null).
-    if (review.reviewed !== true) failed += 1;
+    // ⛔ 착지 관문 거부도 같은 회계다 — 금지 백엔드가 판정을 냈으면 리뷰가 «성공»해도 근거가 아니다(rc≠0).
+    if (review.reviewed !== true || !landingGateAdmitted) failed += 1;
     if (opts.save !== undefined) {
-      if (review.reviewed !== true || diffRead.headCommitState !== 'known' || diffRead.currentHeadCommitState !== 'known' || diffRead.currentHeadCommit !== diffRead.headCommit || diffRead.headCommit.length !== 40) {
+      if (!landingGateAdmitted) {
+        deps.error(`PR ${pr}: --save 거부 — acp.reviewDenyBackends 가 금지한 백엔드(${landingGateDeniedBackend ?? 'unknown'})의 결과는 착지 근거로 저장하지 않습니다.`);
+      } else if (review.reviewed !== true || diffRead.headCommitState !== 'known' || diffRead.currentHeadCommitState !== 'known' || diffRead.currentHeadCommit !== diffRead.headCommit || diffRead.headCommit.length !== 40) {
         deps.error(`PR ${pr}: --save 불가 — 완료된 리뷰와 확인된 40자 PR head가 필요합니다.`);
         if (review.reviewed === true) failed += 1;
       } else {
@@ -2049,6 +2507,28 @@ async function runSelfReviewCliCommandPinned(
         }
       }
     }
+    if (shouldPersistCapResult) {
+      if (!landingGateAdmitted || review.reviewed !== true || !canonicalResultPath
+        || diffRead.headCommitState !== 'known' || diffRead.currentHeadCommitState !== 'known'
+        || diffRead.currentHeadCommit !== diffRead.headCommit || !COMMIT_OID.test(diffRead.headCommit)) {
+        releaseCapClaim();
+        deps.error(`PR ${pr}: 상한 예외 리뷰 결과가 저장 가능한 상태가 아니어서 승인 사용 기록을 되돌렸습니다.`);
+      } else {
+        const rawResult = results.at(-1);
+        const normalized = rawResult && typeof rawResult === 'object'
+          ? normalizeSavedReviewMustFix(rawResult)
+          : { result: rawResult, count: 0 };
+        try {
+          mkdirSync(dirname(canonicalResultPath), { recursive: true });
+          writeFileSync(canonicalResultPath, selfReviewJsonLine([normalized.result]));
+          if (normalized.count > 0) deps.log('mustfix-normalized', { pr, head: diffRead.headCommit, count: normalized.count });
+        } catch (error) {
+          releaseCapClaim();
+          failed += 1;
+          deps.error(`PR ${pr}: 상한 예외 리뷰 결과 저장 실패${canonicalResultPath ? ` (${canonicalResultPath})` : ''}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+      }
+    }
   }
   return { results, failed };
 }