elanous 0.2.37 → 0.2.40

package/src/task-agent/evidence-command-normalize.ts

@@ -0,0 +1,42 @@
+import { linesOutsideFencedCode, validateGoalDoneEvidenceCommand } from '../self-implement/goal-author.js';
+
+const EVIDENCE_LINE = /^(\s*(?:[-*]\s*)?완료 경계 증거 명령\s*:\s*)(.*?)(\s*)$/;
+
+/** Remove known result annotations from an evidence command, preserving every other line. */
+export function normalizeEvidenceCommandLines(document: string): { text: string; warnings: string[]; unrecognized: string[] } {
+  const warnings: string[] = [];
+  const unrecognized: string[] = [];
+  const replacements: Array<{ start: number; old: string; next: string }> = [];
+  for (const line of linesOutsideFencedCode(document)) {
+    const match = EVIDENCE_LINE.exec(line.text);
+    if (!match) continue;
+    const original = match[2].trim();
+    if (!original) continue;
+    let candidate = original.replace(/\s*(?:→|->)\s*0\s+fail\s*$/i, '')
+      .replace(/\s*·\s*typecheck\s+PASS\s*$/i, '').trim();
+    // Some cards have both annotations; peel them in either order.
+    candidate = candidate.replace(/\s*(?:→|->)\s*0\s+fail\s*$/i, '')
+      .replace(/\s*·\s*typecheck\s+PASS\s*$/i, '').trim();
+    if (candidate.startsWith('`') && candidate.endsWith('`') && candidate.length > 2)
+      candidate = candidate.slice(1, -1).trim();
+    if (candidate === original) {
+      if (/[`→]|->|·\s*typecheck\b/i.test(original)) {
+        warnings.push(`완료 경계 증거 명령 정규화 불가: ${original}`);
+        unrecognized.push(original);
+      }
+      continue;
+    }
+    // An unrecognized decoration is never silently converted into a shell command.
+    if (!validateGoalDoneEvidenceCommand(candidate).command) {
+      warnings.push(`완료 경계 증거 명령 정규화 불가: ${original}`);
+      unrecognized.push(original);
+      continue;
+    }
+    replacements.push({ start: line.start, old: line.text, next: `${match[1]}${candidate}${match[3]}` });
+    warnings.push(`완료 경계 증거 명령 정규화: ${original} → ${candidate}`);
+  }
+  let text = document;
+  for (const replacement of replacements.reverse())
+    text = text.slice(0, replacement.start) + replacement.next + text.slice(replacement.start + replacement.old.length);
+  return { text, warnings, unrecognized };
+}

package/src/task-agent/export-redactions-provision.ts

@@ -0,0 +1,43 @@
+import { lstatSync, readFileSync } from 'node:fs';
+import { loadPrivateRedactions, privateRedactionsPath } from '../../scripts/public-export.js';
+import { defaultSshRunner, type SshRunner } from './parent-host.js';
+import { shellQuote } from './task-hand.js';
+
+const ALLOWED_HOSTS = new Set(['node-b', 'elangram-wsl', 'host-e-wsl']);
+
+/** Give a train host the same private list that release export-check reads on HQ.
+ * The list travels only over SSH stdin and is installed atomically at mode 0600.
+ * A missing or unreadable list is a failed preflight, never a weaker leak check. */
+export function provisionExportRedactions(
+  host: string,
+  sourcePath = privateRedactionsPath(),
+  ssh: SshRunner = defaultSshRunner,
+): void {
+  if (!ALLOWED_HOSTS.has(host)) throw new Error('export redactions host not allowed');
+  let payload: string;
+  try {
+    const stat = lstatSync(sourcePath);
+    if (!stat.isFile() || (stat.mode & 0o077) !== 0 || stat.size === 0 || stat.size > 1_048_576) {
+      throw new Error('source is not a private regular file');
+    }
+    if (!loadPrivateRedactions(sourcePath)?.length) throw new Error('source has no redaction entries');
+    payload = readFileSync(sourcePath, 'utf8');
+    if (payload.includes('\0')) throw new Error('source contains NUL');
+  } catch {
+    throw new Error('export redactions source unavailable or invalid');
+  }
+
+  const code = [
+    'const fs=require("node:fs"),path=require("node:path"),crypto=require("node:crypto");',
+    // Remote SSH execution has no repository resolver module. Match privateRedactionsPath():
+    // ELANOUS_EXPORT_REDACTIONS first, then the remote shell HOME default (OP #40040).
+    'const home=process.env.HOME?.trim(),override=process.env.ELANOUS_EXPORT_REDACTIONS?.trim();',
+    'const file=override||(home?path.join(home,".elanous","export-redactions.tsv"):"");if(!file||!path.isAbsolute(file))process.exit(2);const dir=path.dirname(file);',
+    'const bytes=fs.readFileSync(0);if(!bytes.length||bytes.length>1048576||bytes.includes(0))process.exit(2);',
+    'fs.mkdirSync(dir,{recursive:true,mode:0o700});fs.chmodSync(dir,0o700);',
+    'const temp=file+"."+process.pid+"."+crypto.randomBytes(6).toString("hex")+".tmp";',
+    'try{fs.writeFileSync(temp,bytes,{mode:0o600,flag:"wx"});fs.chmodSync(temp,0o600);fs.renameSync(temp,file)}catch{try{fs.rmSync(temp,{force:true})}catch{};process.exit(3)}',
+  ].join('');
+  const result = ssh(host, `umask 077; bun -e ${shellQuote(code)}`, 20_000, payload);
+  if (result.status !== 0) throw new Error(`export redactions provision failed (ssh rc=${result.status ?? 'unknown'})`);
+}

package/src/task-agent/judge.ts

@@ -76,6 +76,62 @@ export function mustFixSignature(mustFix?: readonly string[]): string | undefine
   return `fnv1a-${hash.toString(16).padStart(8, '0')}`;
 }
 
+/**
+ * 빈 구현 must-fix 신호(대상 3종) — 리뷰가 이 신호를 담은 must-fix 를 내면 같은 PR 수리(narrow-relaunch)로는 수렴하지 않는다.
+ * 결정론 분류만 한다(LLM 경로 없음). 판별은 문구 일치로 하되 오탐을 피해 좁게 잡는다.
+ */
+const EMPTY_IMPLEMENTATION_SIGNALS: readonly { name: string; patterns: readonly RegExp[] }[] = [
+  {
+    name: '구현 파일 변경 0',
+    patterns: [
+      /빈 구현/u,
+      /empty[- ]implementation/iu,
+      /구현 파일[^\n.]{0,8}(없음|없다|미변경)|구현 파일[^\n.]{0,24}변경[^\n.]{0,8}0(?!\d)/u,
+      /구현 (diff|변경|차분)[^\n.]{0,8}0(?!\d)/u,
+      /implementation files?[^\n.]{0,32}(unchanged|zero|no change)/iu,
+      /(no|zero) (implementation|code) (changes|diff)/iu,
+      /target diff (is )?0(?!\d)/iu,
+    ],
+  },
+  {
+    name: 'GOODHART/자기 문구 시험',
+    patterns: [/GOODHART/iu, /자기 ?문구/u, /골 문면/u, /goal[ -]?(text|wording)/iu],
+  },
+  {
+    name: '대상 경로 미배선',
+    patterns: [/미배선/u, /배선되지 않/u, /호출부[^\n.]{0,8}(없음|없다)/u, /not[ -]?wired/iu, /unwired/iu, /no caller/iu, /dead code/iu],
+  },
+];
+
+/** 빈 구현 must-fix 판정의 수 — 첫 회는 같은 칸 새 발사(재구현), 이미 두 번째면 칸 주인 이관(needs-owner). */
+export type EmptyImplementationMove = 'reimplement' | 'needs-owner';
+
+/** 판정 관측 한 줄 — `reason` 이 그대로 관측 로그 문면이다(줄바꿈 없음). */
+export interface EmptyImplementationJudgement {
+  move: EmptyImplementationMove;
+  signals: readonly string[];
+  reason: string;
+}
+
+/**
+ * 리뷰 must-fix 가 «빈 구현» 신호(구현 파일 변경 0 · GOODHART/자기 문구 시험 · 대상 경로 미배선)를 담는지 결정론 분류한다.
+ * 신호를 담으면 narrow-relaunch 대신 재구현 판정 — 같은 칸의 앞 런에서 이미 빈 구현 must-fix 였으면
+ * (priorEmptyImplementation ≥ 1) 두 번째이므로 needs-owner. 신호가 없으면 null — 일반 must-fix 는 종전대로 narrow-relaunch.
+ */
+export function judgeEmptyImplementation(
+  mustFix: readonly string[] | undefined,
+  priorEmptyImplementation = 0,
+): EmptyImplementationJudgement | null {
+  const signals: string[] = [];
+  for (const { name, patterns } of EMPTY_IMPLEMENTATION_SIGNALS) {
+    if ((mustFix ?? []).some(fix => typeof fix === 'string' && patterns.some(pattern => pattern.test(fix)))) signals.push(name);
+  }
+  if (!signals.length) return null;
+  const move: EmptyImplementationMove = priorEmptyImplementation >= 1 ? 'needs-owner' : 'reimplement';
+  const disposition = move === 'needs-owner' ? '두 번째 빈 구현 — 칸 주인에게 이관' : '같은 PR 수리로는 수렴 불가 — 같은 칸 새 발사(시험 먼저)';
+  return { move, signals, reason: `빈 구현 must-fix(${signals.join(' · ')}) — ${disposition}` };
+}
+
 export interface TaskJudgement {
   move: TaskMove;
   stage: 'observing' | 'closing' | 'reviewing' | 'repairing' | 'waiting' | 'escalated';

package/src/task-agent/parent-host.ts

@@ -44,6 +44,8 @@ export const PARENT_HOST_ENV = 'ELANOUS_TA_PARENT_HOST';
 const DEFAULT_REMOTE_ELANOUS = '$HOME/.local/share/elanous/bin/elanous';
 const DEFAULT_REMOTE_CONFIG_DIR = '$HOME/.elanous';
 const HOST_RE = /^[A-Za-z0-9][A-Za-z0-9._@-]{0,127}$/;
+/** A parent can wait for a child for tens of minutes; the two-minute HTTP refresh floor is too short here. */
+export const PARENT_CHILD_CREDENTIAL_MIN_REMAINING_MS = 60 * 60_000;
 
 /** Missing child-provider metadata keeps the established Pod default: the HQ Codex mirror is needed. */
 export function shouldInstallRemoteCodexAccess(effectiveChildProvider: string | undefined): boolean {
@@ -81,7 +83,7 @@ export function resolveParentHosts(config: ParentHostSetting | undefined, env: N
 }
 
 /** Capacity sample is read on the host before launch. Unknown or saturated capacity is not a positive weight. */
-export interface ParentHostCapacity { active: number; waiting: number; approvalHeadroom: number; load: number }
+export interface ParentHostCapacity { active: number; waiting: number; limit: number; headroom: number; approvalHeadroom: number; load: number }
 
 export interface ParentHostPodFit {
   state: 'fits' | 'never-fits' | 'unmeasured';
@@ -133,13 +135,13 @@ const LOAD_MARKER = '__ELANOUS_PARENT_LOAD__';
 /** Best-effort macOS `ps` fallback; Linux/WSL uses argv boundaries below. */
 export const PARENT_HOST_ACTIVE_FILTER = String.raw`/^(([^ ]+\/)?(bun|node|nodejs) )?([^ ]+\/)?elanous(\.mjs)?( --config-dir [^ ]+)? harness (say|ask)( |$)/ && / --no-auto-merge( |$)/ && !/ --substrate local( |$)/ && !/^([^ ]+\/)?[^ ]*sh -c/`;
 /** Count exact Linux argv entries so Pod-local commands and goal text cannot masquerade as host parents. */
-export const PARENT_HOST_PROC_COUNT_SCRIPT = "count=0; proc_root=${1:-/proc}; for file in \"$proc_root\"/[0-9]*/cmdline; do [ -r \"$file\" ] || continue; argv=(); while IFS= read -r -d '' arg; do argv+=(\"$arg\"); done < \"$file\" 2>/dev/null || true; [ ${#argv[@]} -ge 3 ] || continue; program=\"${argv[0]##*/}\"; case \"$program\" in elanous|elanous.mjs) ;; bun|node|nodejs) script_match=0; for ((i=1; i<${#argv[@]}; i++)); do if [[ \"${argv[i]}\" == */elanous.mjs ]]; then script_match=1; break; fi; [[ \"${argv[i]}\" == harness ]] && break; done; [ \"$script_match\" -eq 1 ] || continue ;; *) continue ;; esac; harness=0; for ((i=0; i+1<${#argv[@]}; i++)); do if [[ \"${argv[i]}\" == harness && ( \"${argv[i+1]}\" == say || \"${argv[i+1]}\" == ask ) ]]; then harness=1; break; fi; done; [ \"$harness\" -eq 1 ] || continue; has_no_auto_merge=0; for arg in \"${argv[@]}\"; do [[ \"$arg\" == --no-auto-merge ]] && has_no_auto_merge=1; done; [ \"$has_no_auto_merge\" -eq 1 ] || continue; local_substrate=0; for ((i=0; i+1<${#argv[@]}; i++)); do if [[ \"${argv[i]}\" == --substrate && \"${argv[i+1]}\" == local ]]; then local_substrate=1; break; fi; done; [ \"$local_substrate\" -eq 1 ] || count=$((count+1)); done; printf '__ELANOUS_PARENT_CAPACITY__%s\\n' \"$count\""
+export const PARENT_HOST_PROC_COUNT_SCRIPT = "count=0; proc_root=${1:-/proc}; for file in \"$proc_root\"/[0-9]*/cmdline; do [ -r \"$file\" ] || continue; argv=(); while IFS= read -r -d '' arg; do argv+=(\"$arg\"); done < \"$file\" 2>/dev/null || true; [ ${#argv[@]} -ge 3 ] || continue; program=\"${argv[0]##*/}\"; case \"$program\" in elanous|elanous.mjs) ;; bun|node|nodejs) script_match=0; for ((i=1; i<${#argv[@]}; i++)); do if [[ \"${argv[i]}\" == */elanous.mjs ]]; then script_match=1; break; fi; [[ \"${argv[i]}\" == harness ]] && break; done; [ \"$script_match\" -eq 1 ] || continue ;; *) continue ;; esac; harness=0; for ((i=0; i+1<${#argv[@]}; i++)); do if [[ \"${argv[i]}\" == harness && ( \"${argv[i+1]}\" == say || \"${argv[i+1]}\" == ask ) ]]; then harness=1; break; fi; done; [ \"$harness\" -eq 1 ] || continue; has_no_auto_merge=0; for arg in \"${argv[@]}\"; do [[ \"$arg\" == --no-auto-merge ]] && has_no_auto_merge=1; done; [ \"$has_no_auto_merge\" -eq 1 ] || continue; local_substrate=0; for ((i=0; i+1<${#argv[@]}; i++)); do if [[ \"${argv[i]}\" == --substrate && \"${argv[i+1]}\" == local ]]; then local_substrate=1; break; fi; done; [ \"$local_substrate\" -eq 1 ] && continue; cgroup_file=${file%cmdline}cgroup; if [ ! -r $cgroup_file ]; then [ ! -d ${file%/cmdline} ] && continue; printf '__ELANOUS_PARENT_CAPACITY_ERROR__cgroup-unreadable\\n'; exit 1; fi; cgroup=$(cat $cgroup_file 2>/dev/null) || { [ ! -d ${file%/cmdline} ] && continue; printf '__ELANOUS_PARENT_CAPACITY_ERROR__cgroup-unreadable\\n'; exit 1; }; case $cgroup in *docker*|*kubepods*|*containerd*|*libpod*|*lxc*) continue;; esac; count=$((count+1)); done; printf '__ELANOUS_PARENT_CAPACITY__%s\\n' \"$count\""
 /** Recent admission decisions are the host's measured approval backlog, not an inferred process count. */
 export function readParentHostCapacity(target: ParentHostConfig, ssh: SshRunner = defaultSshRunner): ParentHostCapacity | null {
   const executable = remotePath(target.elanous ?? DEFAULT_REMOTE_ELANOUS);
   const configDir = remotePath(target.configDir ?? DEFAULT_REMOTE_CONFIG_DIR);
   const unavailable = (reason: string): null => { try { debug.log('task-agent.parent-host', 'capacity-unavailable', { host: target.host, reason }); } catch { /* fail-soft */ } return null; };
-  const processCount = `if [ -r /proc/self/cmdline ]; then if command -v bash >/dev/null 2>&1; then bash -c ${shellQuote(PARENT_HOST_PROC_COUNT_SCRIPT)} -- /proc; else printf "${CAPACITY_ERROR_MARKER}bash-unavailable\\n"; exit 1; fi; else parents=$(ps -Ao command) || exit 1; printf '%s\\n' "$parents" | awk '${PARENT_HOST_ACTIVE_FILTER} { n++ } END { print "${CAPACITY_MARKER}" n+0 }'; fi`;
+  const processCount = `if [ -r /proc/self/cmdline ]; then if command -v bash >/dev/null 2>&1; then bash -c ${shellQuote(PARENT_HOST_PROC_COUNT_SCRIPT)} -- /proc || exit 1; else printf "${CAPACITY_ERROR_MARKER}bash-unavailable\\n"; exit 1; fi; else parents=$(ps -Ao command) || exit 1; printf '%s\\n' "$parents" | awk '${PARENT_HOST_ACTIVE_FILTER} { n++ } END { print "${CAPACITY_MARKER}" n+0 }'; fi`;
   const script = `${processCount}; `
     + `${executable} --config-dir ${configDir} logs --event admit-by-usage --since 5m --json --limit 1000 || exit 1; `
     + `printf '\\n${APPROVAL_MARKER}\\n'; `
@@ -147,7 +149,8 @@ export function readParentHostCapacity(target: ParentHostConfig, ssh: SshRunner
     + `cores=$(getconf _NPROCESSORS_ONLN 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null) || exit 1; printf '${LOAD_MARKER}cores=%s\\n' "$cores"`;
   try {
     const result = ssh(target.host, script, 15_000);
-    if (result.status !== 0) return unavailable(result.stdout.includes(`${CAPACITY_ERROR_MARKER}bash-unavailable`) ? 'bash-unavailable' : 'remote-command-failed');
+    if (result.status !== 0) return unavailable(result.stdout.includes(`${CAPACITY_ERROR_MARKER}bash-unavailable`) ? 'bash-unavailable'
+      : result.stdout.includes(`${CAPACITY_ERROR_MARKER}cgroup-unreadable`) ? 'cgroup-unreadable' : 'remote-command-failed');
     const activeMatch = new RegExp(`^${CAPACITY_MARKER}(\\d+)$`, 'm').exec(result.stdout);
     const boundary = result.stdout.indexOf(`\n${APPROVAL_MARKER}\n`);
     const logsStart = result.stdout.indexOf('\n');
@@ -181,12 +184,13 @@ export function readParentHostCapacity(target: ParentHostConfig, ssh: SshRunner
       decisions.set(data.runId, data.recommended as number);
     }
     const waiting = [...decisions.values()].filter((n) => n === 0).length;
-    return { active, waiting, approvalHeadroom: Math.max(0, capacity - active - waiting), load: Math.max(0, cpu / (cores * 100)) };
+    const headroom = Math.max(0, capacity - active - waiting);
+    return { active, waiting, limit: capacity, headroom, approvalHeadroom: headroom, load: Math.max(0, cpu / (cores * 100)) };
   } catch { return unavailable('capacity-parse-failed'); }
 }
 
 /** Weighted rendezvous rank with evidence fields for launch-time observation. */
-export function rankParentHosts(targets: readonly ParentHostConfig[], runId: string, capacities: Readonly<Record<string, ParentHostCapacity | null>>): Array<{ target: ParentHostConfig; weight: number; score: number }> {
+export function rankParentHosts(targets: readonly ParentHostConfig[], runId: string, capacities: Readonly<Record<string, Pick<ParentHostCapacity, 'approvalHeadroom' | 'load'> | null>>): Array<{ target: ParentHostConfig; weight: number; score: number }> {
   return targets.map((target, index) => {
     const sample = capacities[target.host];
     const weight = sample && Number.isSafeInteger(sample.approvalHeadroom) && sample.approvalHeadroom > 0 && Number.isFinite(sample.load) && sample.load >= 0
@@ -264,14 +268,22 @@ export interface ParentHostPreflight { ok: boolean; gaps: string[]; warnings: st
 export function preflightScript(target: ParentHostConfig): string {
   const elanous = remotePath(target.elanous ?? DEFAULT_REMOTE_ELANOUS);
   const configDir = remotePath(target.configDir ?? DEFAULT_REMOTE_CONFIG_DIR);
+  const grokCredentialFloorSeconds = Math.ceil(PARENT_CHILD_CREDENTIAL_MIN_REMAINING_MS / 1_000);
   return [
     `echo "version=$(${elanous} --version 2>/dev/null | tail -1 | cut -d' ' -f1)"`,
     `test -f ${configDir}/config.json && echo config=1`,
     `grep -Eq '"podPool"[[:space:]]*:[[:space:]]*"[^"[:space:]]+' ${configDir}/config.json 2>/dev/null && echo podPool=1`,
     `(cd ${shellQuote(target.cwd)} 2>/dev/null && git rev-parse --is-inside-work-tree >/dev/null 2>&1) && echo repo=1`,
     `command -v kubectl >/dev/null 2>&1 && echo kubectl=1`,
+    `{ command -v grok >/dev/null 2>&1 || [ -x "$HOME/.grok/bin/grok" ]; } && echo grokCli=1`,
+    `{ command -v codex >/dev/null 2>&1 || [ -x "$HOME/.local/bin/codex" ]; } && echo codexCli=1`,
     `n=$(grep -Ec '^[[:space:]]*"openai-codex(:[^"]*)?"[[:space:]]*:[[:space:]]*\\{' ${configDir}/auth.json 2>/dev/null); echo "codexAccounts=\${n:-0}"`,
     `{ grep -Eq '"key"[[:space:]]*:[[:space:]]*"[^"]+"' "$HOME/.grok/auth.json" 2>/dev/null || [ -n "\${XAI_API_KEY:-}\${GROK_API_KEY:-}\${GROK_CODE_XAI_API_KEY:-}" ]; } && echo grok=1`,
+    // The remote host owns its device-auth session. Ignore the legacy HQ mirror entry; it can outlive and mask the host credential.
+    // Read only expiry metadata, never credential values, and compare against the shared minimum lifetime.
+    `grokProbe=$(if [ ! -f "$HOME/.grok/auth.json" ]; then printf '0|'; else bun -e 'const fs=require("node:fs");try{const auth=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));const entries=Object.entries(auth).filter(([id])=>id!=="https://auth.x.ai::hq-mirror");const hasKey=entries.some(([,entry])=>typeof entry?.key==="string"&&entry.key.length>0);const expiries=entries.filter(([,entry])=>typeof entry?.expires_at==="string").map(([,entry])=>entry.expires_at).sort();process.stdout.write((hasKey?"1":"0")+"|"+(expiries.length?expiries[expiries.length-1]:""))}catch{}' "$HOME/.grok/auth.json" 2>/dev/null; fi); grokOtherKey=\${grokProbe%%|*}; grokExp=\${grokProbe#*|}`,
+    `grokFloor=$(date -u -d "@$(( $(date +%s) + ${grokCredentialFloorSeconds} ))" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -r "$(( $(date +%s) + ${grokCredentialFloorSeconds} ))" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || true); grokNow=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || true)`,
+    `grokHost=$(if [ -n "$XAI_API_KEY$GROK_API_KEY$GROK_CODE_XAI_API_KEY" ]; then echo valid; elif [ -z "$grokProbe" ]; then echo unknown; elif [ -z "$grokExp" ]; then [ "$grokOtherKey" = 1 ] && echo unknown || echo missing; elif [ -z "$grokFloor" ] || [ -z "$grokNow" ]; then echo unknown; else printf '%s\n%s\n%s\n' "$grokExp" "$grokFloor" "$grokNow" | awk 'NR==1{e=$0} NR==2{f=$0} NR==3{n=$0} END{if (e >= f) print "valid"; else if (e >= n) print "expiring"; else print "expired"}'; fi); echo "grokHost=$grokHost"`,
     `{ [ -s "\${ELANOUS_KEY_CACHE_DIR:-$HOME/.cache}/openrouter_api_key" ] || [ -n "\${OPENROUTER_API_KEY:-}" ]; } && echo openrouter=1`,
     `true`,
   ].join('; ');
@@ -283,6 +295,8 @@ export interface PreflightInput {
   localVersion: string;
   /** HQ 착지 동결이 «발사도 막는» 상태인가 — 원격 부모는 그 동결을 못 본다. */
   launchHoldActive: boolean;
+  /** Provider that the detached parent will use for its child. */
+  childProvider?: string;
   ssh?: SshRunner;
 }
 
@@ -306,11 +320,34 @@ export function judgeParentHostFacts(facts: Record<string, string>, input: Omit<
     if (facts.podPool !== '1' && !input.podPoolOverride) gaps.push('remote-pod-pool-unset');
     if (facts.repo !== '1') gaps.push('remote-repo-missing');
     if (facts.kubectl !== '1') gaps.push('remote-kubectl-missing');
+    if (input.childProvider === 'grok' && facts.grokCli !== '1') gaps.push('grok-cli-missing');
+    if ((input.childProvider === 'openai-codex' || input.childProvider === 'codex') && facts.codexCli !== '1') gaps.push('codex-cli-missing');
   }
   if (input.launchHoldActive) gaps.push('hq-launch-freeze-active');
   return gaps;
 }
 
+/** Host-side Grok credential states the preflight probe reports; HQ never sees the token itself. */
+export type ParentHostGrokCredentialState = 'valid' | 'expiring' | 'expired' | 'missing' | 'unknown';
+
+/**
+ * 순수 판정 — 원격 호스트가 스스로 보고한 grok 자격 상태 → **막는** gap 목록(GROK-MIRROR-REAL-SCOPE · 10-20 방향 전환).
+ *
+ * 왜 경고가 아니라 gap 인가: access-only 미러(4필드)는 원격 grok CLI 1.0.41 에서 `session/new` -32000 으로
+ * 거부됐고, HQ refresh_token 복사는 단일 주인 원칙 위반이다. ⇒ 호스트가 각자 device-auth 세션을 스스로
+ * 갱신하고, HQ 는 「쓸 수 있나」만 재서 **무효면 Grok 자식 발사 전에** 막는다(발사 뒤 -32000 반복 금지).
+ *
+ * ⛔ 상태를 «안 보고한» 호스트(구 판)는 막지 않는다 — 모름을 「죽었다」로 읽으면 멀쩡한 호스트가 조용히 빠진다.
+ */
+export function judgeParentHostGrokCredential(facts: Record<string, string>, opts: { childProvider?: string } = {}): string[] {
+  if (opts.childProvider !== 'grok' || facts.unreachable) return [];
+  const state = facts.grokHost as ParentHostGrokCredentialState | undefined;
+  if (state === 'missing') return ['grok-credential-missing'];
+  if (state === 'expiring') return ['grok-credential-expiring'];
+  if (state === 'expired') return ['grok-credential-expired'];
+  return [];
+}
+
 /** 순수 판정 — 원격 LLM 자격 사실 → 경고 목록(막지 않는다 · gaps 와 별개). 못 닿은 호스트는 사실이 없으므로 경고도 없다. */
 export function judgeParentHostCredentials(facts: Record<string, string>): string[] {
   if (facts.unreachable) return [];
@@ -330,7 +367,16 @@ export function preflightParentHost(input: PreflightInput): ParentHostPreflight
     const at = line.indexOf('=');
     if (at > 0) facts[line.slice(0, at).trim()] = line.slice(at + 1).trim();
   }
-  const gaps = judgeParentHostFacts(facts, { localVersion: input.localVersion, launchHoldActive: input.launchHoldActive, podPoolOverride: Boolean(input.target.podPool) });
+  const gaps = judgeParentHostFacts(facts, { localVersion: input.localVersion, launchHoldActive: input.launchHoldActive, podPoolOverride: Boolean(input.target.podPool), ...(input.childProvider ? { childProvider: input.childProvider } : {}) });
+  // 호스트 자체 grok 자격은 «경고»가 아니라 발사 전 «차단» 축이다 — 무효면 OP 재로그인 요청 신호를 남긴다.
+  const credentialGaps = judgeParentHostGrokCredential(facts, { ...(input.childProvider ? { childProvider: input.childProvider } : {}) });
+  if (credentialGaps.length) {
+    try {
+      debug.log('task-agent.parent-host', 'grok-relogin-required', {
+        host: input.target.host, state: facts.grokHost ?? 'unknown', gaps: credentialGaps,
+      });
+    } catch { /* fail-soft */ }
+  }
   const warnings = judgeParentHostCredentials(facts);
   if (warnings.length) {
     try {
@@ -342,7 +388,8 @@ export function preflightParentHost(input: PreflightInput): ParentHostPreflight
       });
     } catch { /* fail-soft */ }
   }
-  return { ok: gaps.length === 0, gaps, warnings, facts };
+  const blocking = [...gaps, ...credentialGaps];
+  return { ok: blocking.length === 0, gaps: blocking, warnings, facts };
 }
 
 /** 원격이 «확실히 안 띄웠다»고 답했다 — 호출부가 로컬로 돌아가도 중복 발사가 아니다. */
@@ -360,9 +407,7 @@ export function launchRemoteParent(
   args: readonly string[],
   env: Record<string, string>,
   ssh: SshRunner = defaultSshRunner,
-  grokMirrorResolver: () => OwnerGrokAccessMirror = resolveOwnerGrokAccessMirror,
   effectiveChildProvider?: string,
-  now: () => number = Date.now,
 ): { pid: number; log: string } {
   const argvProvider = childProviderFromArgs(args);
   if (effectiveChildProvider && argvProvider && argvProvider !== effectiveChildProvider) {
@@ -371,9 +416,11 @@ export function launchRemoteParent(
   const launchArgs = effectiveChildProvider && !argvProvider
     ? [...args.slice(0, 2), '--child-llm-provider', effectiveChildProvider, ...args.slice(2)]
     : args;
+  // GROK-MIRROR-REAL-SCOPE: 원격 부모는 HQ access 미러를 «설치하지 않는다»(4필드 미러는 grok 1.0.41 에서
+  // `session/new` -32000 · HQ refresh_token 복사는 단일 주인 원칙 위반). 호스트가 각자 device-auth 로
+  // 자체 갱신 세션을 쓰고, HQ 는 preflight 에서 «유효성»만 재서 무효면 발사 전에 막는다.
   if ((effectiveChildProvider ?? argvProvider) === 'grok') {
-    const mirror = grokMirrorResolver();
-    installRemoteGrokAccess(target, mirror, ssh, now);
+    try { debug.log('task-agent.parent-host', 'grok-host-credential', { host: target.host, runId: env.ELANOUS_RUN_ID ?? 'unknown', source: 'host-device-auth' }); } catch { /* fail-soft */ }
   }
   const result = ssh(target.host, remoteLaunchScript(target, launchArgs, env), 30_000);
   const log = remoteParentLogPath(target, env.ELANOUS_RUN_ID ?? 'unknown');

package/src/task-agent/postland-card.ts

@@ -2,10 +2,10 @@ import { spawnSync } from 'node:child_process';
 import { debug } from '../debug/log.js';
 import { listChecklist, setItemIfSnapshot, type Checklist } from '../release-loop/checklist.js';
 import { judgeLandedCell, parseJudgeSignals, type GreenVerdict } from '../release-loop/landed-to-green.js';
-import { HAND_MOVE_HISTORY_EVENT, LIVE_MOVE_HISTORY_EVENT, LIVE_MOVE_RESULT_EVENT, cardPrNumber, readTaskAgentState, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
+import { HAND_MOVE_HISTORY_EVENT, LIVE_MOVE_HISTORY_EVENT, LIVE_MOVE_RESULT_EVENT, cardPrNumber, readTaskAgentState, taskAgentStatePath, updateTaskCard, recordPostLandImplFindings, type TaskCard } from './task-hand.js';
 import { isGoalOnlyPr } from './judge.js';
 
-export interface LandedTaskPr { number: number; url: string; headRefOid: string; state: string; baseRefName: string; mergedAt: string; files?: Array<{ path: string }> }
+export interface LandedTaskPr { number: number; url: string; headRefOid: string; state: string; baseRefName: string; mergedAt: string; body?: string | null; files?: Array<{ path: string }> }
 export interface PostlandDeps {
   statePath?: string;
   versions: readonly string[];
@@ -144,6 +144,39 @@ export function closeMergedTaskCard(pr: LandedTaskPr, cwd: string, deps: Postlan
   return item.id;
 }
 
+/** Awaited postland feedback for the confirmed merge caller; card+PR URL/head must still bind exactly. */
+export async function recordMergedTaskImplFindings(
+  pr: LandedTaskPr,
+  cwd: string,
+  options: { statePath?: string; ledgerDir?: string; followUp?: NonNullable<Parameters<typeof recordPostLandImplFindings>[2]>['followUp'] } = {},
+): Promise<Awaited<ReturnType<typeof recordPostLandImplFindings>> | null> {
+  if (pr.state !== 'MERGED' || pr.baseRefName !== 'main' || !pr.url || !pr.headRefOid || pr.body == null) return null;
+  const path = options.statePath ?? taskAgentStatePath();
+  const tasks = readTaskAgentState<{ tasks?: Record<string, TaskCard> }>(path).tasks ?? {};
+  const cards = Object.values(tasks).filter((card) => card.taLand && cardPrNumber(card) === pr.number
+    && typeof card.pr === 'object' && card.pr.url?.replace(/\/+$/, '') === pr.url!.replace(/\/+$/, '')
+    && card.status === 'done' && card.prTerminal?.pr === pr.number
+    && card.prTerminal.head.toLowerCase() === pr.headRefOid!.toLowerCase()
+    && card.prTerminal.url.replace(/\/+$/, '') === pr.url!.replace(/\/+$/, '')
+    && (card.landAttempts ?? []).some((attempt) => attempt.pr === pr.number && attempt.head.toLowerCase() === pr.headRefOid!.toLowerCase()));
+  if (cards.length !== 1) {
+    debug.log('task-agent', 'impl-findings-skipped', { pr: pr.number, reason: cards.length ? 'ambiguous-postland-card' : 'postland-card-not-bound' });
+    return null;
+  }
+  const card = cards[0]!;
+  const result = await recordPostLandImplFindings(card, { prBody: pr.body, ask: card.text }, {
+    ...(options.ledgerDir ? { ledgerDir: options.ledgerDir } : {}),
+    ...(options.followUp ? { followUp: options.followUp } : {}),
+  });
+  debug.log('task-agent', 'impl-findings-postland-result', {
+    pr: pr.number, card: card.id, appended: result?.appended ?? false,
+    lessonIds: result?.lessonIds ?? [], injectedSections: result?.injectedSections ?? [], skippedSections: result?.skippedSections ?? [],
+    authoringInjectionBytes: result ? Buffer.byteLength(result.authoringInjection, 'utf8') : 0,
+    followUp: result?.followUp?.queued ?? null,
+  });
+  return result;
+}
+
 const defaultGit = (cwd: string, args: string[]): { status: number; stdout: string; stderr: string } => {
   const run = spawnSync('git', args, { cwd, encoding: 'utf8' });
   return { status: run.status ?? 1, stdout: run.stdout ?? '', stderr: run.stderr ?? '' };

package/src/task-agent/rejudge-on-head.ts

@@ -45,14 +45,14 @@ import { remoteLedgerMirrorDir } from './parent-host.js';
 import { appendLandOrderRow, joinLandOrderRow } from './land-order-ledger.js';
 import { recordLiveMoveHistory } from './live-move-history.js';
 import { advanceLandedPieceMission } from './mission.js';
-import { runRepairCycle, type RepairLaunchRequest } from './repair-cycle.js';
+import { runRepairCycle, resolveRepairOwner, type RepairLaunchRequest } from './repair-cycle.js';
 import { repairMustFixFromReview, repairReviewDigest } from './repair-review.js';
 import type { RepairCasOutcome, RepairCasRequest } from './repair-branch-cas.js';
 import { configuredMsb1Worker, defaultLandPrHead, defaultPrHead, defaultReviewRepoCandidates, executeLiveLand, executeLiveReview, landRetryPending, remoteTaWorkerCommand, type LiveMoveDeps, type LiveMoveResult, type PrHeadView, type ReviewRepoCandidate, type TaskAgentLiveMove } from './live-moves.js';
 import { capturedLandReview, captureReviewResults, parseReviewResultOutput, pendingReviewResults, reviewResultPath, type ParsedReviewResult } from './review-result-capture.js';
 import { boundPrTerminal, cardPrNumber, LIVE_MOVE_RESULT_EVENT, readTaskCard, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
 import { verifiedTrainLanding, type TrainLanding } from './train-landing.js';
-import { isGoalOnlyPr } from './judge.js';
+import { isGoalOnlyPr, judgeEmptyImplementation } from './judge.js';
 import { defaultPrFiles } from './shadow.js';
 
 export const REJUDGE_ON_HEAD_EVENT = 'rejudge-on-head';
@@ -671,6 +671,50 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
         step('repair', 'repair-stopped', 'PR branch name unavailable', true);
         return outcomes;
       }
+      // 빈 구현 must-fix — 같은 PR 수리(narrow-relaunch)로는 수렴하지 않는다: 첫 회는 같은 칸 새 발사(시험 먼저), 두 번째는 칸 주인 이관.
+      const priorEmpty = (card.history ?? []).filter((entry) => entry.event === REJUDGE_ON_HEAD_EVENT && entry.kind === 'repair'
+        && (entry.effect === 'empty-implementation-reimplement' || entry.effect === 'empty-implementation-needs-owner')).length;
+      const emptyJudgement = mustFix?.length ? judgeEmptyImplementation(mustFix, priorEmpty) : null;
+      if (emptyJudgement) {
+        if (emptyJudgement.move === 'needs-owner') {
+          let ownerSeat: string | null = card.seat ?? null;
+          try {
+            const owner = resolveRepairOwner(card);
+            if (owner?.seat) ownerSeat = owner.seat;
+          } catch { /* 결정 실패 시 칸 좌석을 유지한다 */ }
+          if (ownerSeat) {
+            try {
+              (deps.notifyRepair ?? (() => {}))(ownerSeat,
+                `빈 구현 needs-owner: 칸 ${card.id} PR #${pr} head ${toHead.slice(0, 12)} — ${emptyJudgement.reason} · 칸 주인이 재구현 지시를 결정한다`);
+            } catch { /* 통보 실패가 이관을 막지 않는다 */ }
+          }
+          const handedOver = updateTaskCard(statePath, card.id, (current) => {
+            if (!current) return undefined;
+            if ((current.history ?? []).some((entry) => entry.event === REJUDGE_ON_HEAD_EVENT && entry.kind === 'repair'
+              && entry.pr === pr && entry.head && sameHead(entry.head, toHead) && entry.effect === 'empty-implementation-needs-owner')) return current;
+            return { ...current, status: 'failed',
+              history: [...(current.history ?? []), { at: now().toISOString(), event: 'pr-superseded-candidate', kind: 'repair', pr,
+                ...(toHead ? { head: toHead } : {}), effect: 'superseded-candidate',
+                detail: `빈 구현 needs-owner — 옛 PR #${pr} 은 superseded 후보` }] };
+          });
+          if (handedOver) step('repair', 'empty-implementation-needs-owner',
+            `${emptyJudgement.reason} · 칸 주인 ${ownerSeat ?? 'unknown'} 이관 · 옛 PR #${pr} superseded 후보`, true);
+          return outcomes;
+        }
+        const relaunched = updateTaskCard(statePath, card.id, (current) => {
+          if (!current) return undefined;
+          if ((current.history ?? []).some((entry) => entry.event === REJUDGE_ON_HEAD_EVENT && entry.kind === 'repair'
+            && entry.pr === pr && entry.head && sameHead(entry.head, toHead) && entry.effect === 'empty-implementation-reimplement')) return current;
+          return { ...current, status: 'launch-failed',
+            text: `${current.text}\n- 재구현 지시(빈 구현 판정): 시험 먼저 — 구현 전에 실패하는 시험(RED)을 먼저 쓰고 구현 파일 변경 0이 되지 않게 한다.`,
+            history: [...(current.history ?? []), { at: now().toISOString(), event: 'pr-superseded-candidate', kind: 'repair', pr,
+              ...(toHead ? { head: toHead } : {}), effect: 'superseded-candidate',
+              detail: `빈 구현 재구현 — 옛 PR #${pr} 은 superseded 후보` }] };
+        });
+        if (relaunched) step('repair', 'empty-implementation-reimplement',
+          `${emptyJudgement.reason} · 같은 칸 새 발사(시험 먼저) · 옛 PR #${pr} superseded 후보`, true);
+        return outcomes;
+      }
       const result = await runRepairCycle({ card, statePath, repo: cwd, pr, head: toHead, branch: view.branch,
         mustFix: mustFix ?? [], liveMoves: deps.liveMoves, now: now(), readFile: read,
         ...(deps.requestRepair ? { request: deps.requestRepair } : {}),

package/src/task-agent/repair-cycle.ts

@@ -1,5 +1,6 @@
 /** HQ same-PR repair launch and result collection; the reviewed head is the sole source of truth. */
 import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve, sep } from 'node:path';
 import { debug } from '../debug/log.js';
@@ -13,13 +14,14 @@ import { applyRepairBundle, type RepairCasOutcome, type RepairCasRequest } from
 import { pairMoveId, repairNextMove } from './repair-next-move.js';
 import type { SupervisorGoalDeficit } from '../self-implement/goal-supervisor-fill.js';
 import { loadRunLedger, type RunLedgerEntry } from '../self-implement/run-ledger.js';
-import { parseRepairWorkerResult } from './repair-worker.js';
+import { parseRepairWorkerResult, repairFailureSignature } from './repair-worker.js';
 import { TASK_SEATS, readTaskCard, updateTaskCard, type TaskCard, type TaskChildLlm, type TaskSeat } from './task-hand.js';
 
 const WAIT_MS = 90 * 60_000;
 const ESCALATE_MS = 6 * 60 * 60_000;
 const ALERT_CLAIM_STALE_MS = 10 * 60_000;
 const safe = (value: string) => value.replace(/[^A-Za-z0-9._-]/g, '_');
+const reviewSignature = (mustFix: readonly string[]) => createHash('sha256').update(JSON.stringify(mustFix)).digest('hex');
 
 export interface RepairLaunchRequest {
   card: string; pr: number; head: string; repo: string; resultPath: string;
@@ -108,9 +110,9 @@ export async function repairModelAvailability(readInputs: () => Promise<Pick<Bud
 export function alternateRepairModel(card: TaskCard, availability: RepairModelAvailability = { codexSubscription: false, grokSubscription: false }): { from: string; to: TaskChildLlm } {
   const last = card.repairs?.at(-1);
   const from = last?.toModel ?? (card.childLlm ? `${card.childLlm.provider}/${card.childLlm.model}` : 'unknown');
-  // The Pod's named ZAI subscription is the primary GLM route. A failed
-  // glm-5.3 repair must never be retried with the smaller flash model.
-  const glm: TaskChildLlm = { provider: 'glm', model: 'glm-5.3' };
+  // Pin the full model route; a bare glm-5.3 can be ambiguous in the Pod review path.
+  // A failed full GLM repair must never be retried with the smaller flash model.
+  const glm: TaskChildLlm = { provider: 'openrouter', model: 'openrouter/z-ai/glm-5.3' };
   const sol: TaskChildLlm = { provider: 'openai-codex', model: 'gpt-6-sol' };
   const grok: TaskChildLlm = { provider: 'grok', model: 'grok-4.6' };
   const tier = card.tier ?? '중';
@@ -275,6 +277,8 @@ export async function runRepairCycle(input: RepairCycleInput): Promise<RepairCyc
       }
     }
     const status = applied?.ok ? 'applied' : applied?.unconfirmed ? 'unconfirmed' : 'failed';
+    const failureSignature = status === 'failed' && !result.ok
+      ? result.failureSignature ?? repairFailureSignature(result.reason ?? '') : null;
     // NEXTMOVE-GENERAL-RELAUNCH-MOVEID — 결과 파일의 수 id 를 카드(발사 순간 적은 값)와 짝짓는다. 못 짝지으면 관측만(소비는 그대로).
     const pairing = pairMoveId(latest.moveId, result.moveId);
     if (pairing.kind === 'unpaired') try { debug.log('task-agent', 'move-id-unpaired', { card: card.id, pr, head: latest.head,
@@ -282,13 +286,16 @@ export async function runRepairCycle(input: RepairCycleInput): Promise<RepairCyc
     const pairedMoveId = pairing.kind === 'paired' ? { moveId: pairing.moveId } : {};
     try { debug.log('task-agent', 'repair-attempt-result', { card: card.id, pr, head: latest.head,
       runId: latest.runId, failureType: status === 'applied' || status === 'unconfirmed' ? null : result.ok ? 'artifact-or-cas' : 'worker',
-      model: latest.toModel, resultPath: latest.resultPath, artifactDir: result.artifactDir ?? null, status, detail });
+      model: latest.toModel, resultPath: latest.resultPath, artifactDir: result.artifactDir ?? null, status, detail,
+      ...(result.gateFailureTests ? { gateFailureTests: result.gateFailureTests } : {}) });
     } catch { /* diagnostics cannot change the result */ }
     try {
       updateTaskCard(statePath, card.id, (current) => current?.repairs?.some((entry) => entry.runId === latest.runId
         && (entry.status === 'requested' || (claimedThisCycle && entry.status === 'unconfirmed' && entry.commit === result?.result?.commit)))
         ? { ...current, repairs: current.repairs.map((entry) => entry.runId === latest.runId
-          ? { ...entry, status, detail, ...(result?.result && status === 'unconfirmed' ? { commit: result.result.commit,
+          ? { ...entry, status, detail, ...(failureSignature ? { failureSignature } : {}),
+            ...(failureSignature?.startsWith('gate:') && result.gateFailureTests ? { gateFailureTests: result.gateFailureTests } : {}),
+            ...(result?.result && status === 'unconfirmed' ? { commit: result.result.commit,
             bundleSha256: result.result.bundleSha256, bundlePath: join(resolve(result.artifactDir!), 'commit.bundle') } : {}),
             ...(applied?.ok ? { commit: applied.toHead } : {}) } : entry),
           history: [...(current.history ?? []), { at: now.toISOString(), event: 'repair-result', pr, head: latest.head,
@@ -428,10 +435,61 @@ export async function runRepairCycle(input: RepairCycleInput): Promise<RepairCyc
     return { decision: 'would-repair', reason };
   }
   const next = attempts.length + 1;
-  const runId = mintRunId();
   // 결정 순간 만든 수 id — 아래 발사·카드·관측이 «이 값»만 쓴다(다시 만들지 않는다).
   const moveId = judged.moveId;
   const { from, to } = alternateRepairModel(card, availability);
+  const nextModel = `${to.provider}/${to.model}`;
+  const repeatSignature = latest?.status === 'failed' && latest.head.toLowerCase() === head.toLowerCase()
+    && latest.reviewSignature === reviewSignature(input.mustFix) && latest.failureSignature
+    && (latest.failureSignature.startsWith('gate:sha256:')
+      || latest.failureSignature.startsWith('provider:ambiguous-primary:') && latest.toModel === nextModel)
+    ? latest.failureSignature : null;
+  if (repeatSignature) {
+    const prior = latest!;
+    const tests = prior.gateFailureTests?.slice(0, 4).join(' | ');
+    const reason = `same PR/head/review deterministic repair failure ${repeatSignature}; owner repair required${tests ? ` · ${tests}` : ''}`;
+    let recorded = false;
+    updateTaskCard(statePath, card.id, (current) => {
+      if (!current || current.status !== 'launched' || !current.repairs?.some((entry) =>
+        entry.runId === prior.runId && entry.status === 'failed' && entry.failureSignature === repeatSignature
+        && entry.reviewSignature === prior.reviewSignature)
+        || current.history?.some((entry) => entry.event === 'repair-signature-repeat-stopped' && entry.pr === pr
+          && entry.head?.toLowerCase() === head.toLowerCase() && entry.runId === prior.runId)) return undefined;
+      recorded = true;
+      return { ...current, status: 'failed', history: [...(current.history ?? []),
+        { at: now.toISOString(), event: 'repair-signature-repeat-stopped', pr, head, runId: prior.runId, detail: reason }] };
+    });
+    if (recorded) try { debug.log('task-agent', 'repair-signature-repeat-stopped', { card: card.id, pr, head,
+      signature: repeatSignature, priorRunId: prior.runId, skippedRelaunch: true }); } catch { /* fail-soft */ }
+    let notifyClaimed = false;
+    updateTaskCard(statePath, card.id, (current) => {
+      const history = current?.history ?? [];
+      const lastAlert = history.filter((entry) => entry.runId === prior.runId && entry.event.startsWith('repair-repeat-owner-')).at(-1);
+      const staleClaim = lastAlert?.event === 'repair-repeat-owner-claimed'
+        && now.getTime() - Date.parse(lastAlert.at) >= ALERT_CLAIM_STALE_MS;
+      if (!current || !history.some((entry) => entry.event === 'repair-signature-repeat-stopped'
+        && entry.pr === pr && entry.head?.toLowerCase() === head.toLowerCase() && entry.runId === prior.runId)
+        || lastAlert && lastAlert.event !== 'repair-repeat-owner-failed' && !staleClaim) return undefined;
+      notifyClaimed = true;
+      return { ...current, history: [...history,
+        { at: now.toISOString(), event: 'repair-repeat-owner-claimed', pr, head, runId: prior.runId, detail: reason }] };
+    });
+    if (notifyClaimed) {
+      let event = 'repair-repeat-owner-sent';
+      let detail = reason;
+      try {
+        (input.notify ?? defaultNotify)(owner.seat, `${reason} · card ${card.id} · owner ${owner.seat} via ${owner.source}`);
+      } catch (error) {
+        event = 'repair-repeat-owner-failed';
+        detail = `${reason} · ${String(error).slice(0, 200)}`;
+      }
+      updateTaskCard(statePath, card.id, (current) => current?.history?.some((entry) =>
+        entry.event === 'repair-repeat-owner-claimed' && entry.runId === prior.runId)
+        ? { ...current, history: [...current.history, { at: now.toISOString(), event, pr, head, runId: prior.runId, detail }] } : undefined);
+    }
+    return { decision: 'repair-stopped', reason };
+  }
+  const runId = mintRunId();
   const resultPath = repairResultPath(statePath, card.id, pr, head, next, runId);
   const goalFile = resultPath.replace(/\.json$/, '.goal.txt');
   const goal = `기존 PR #${pr}의 리뷰 때 head ${head}를 같은 가지에서 수리한다. 새 PR을 열지 말고 아래 must-fix 원문만 고쳐 commit-only 결과를 반환한다.\n\n${input.mustFix.map((item, i) => `${i + 1}. ${item}`).join('\n')}`;
@@ -442,7 +500,8 @@ export async function runRepairCycle(input: RepairCycleInput): Promise<RepairCyc
     if (!current || current.status !== 'launched' || (current.repairs ?? []).length !== (card.repairs ?? []).length) return undefined;
     claimed = true;
     return { ...current, repairs: [...(current.repairs ?? []), { pr, head, branch, at: now.toISOString(),
-      move: judged.judgement.move, moveId, runId, resultPath, fromModel: from, toModel: `${to.provider}/${to.model}`, status: 'requested' }],
+      move: judged.judgement.move, moveId, runId, resultPath, fromModel: from, toModel: `${to.provider}/${to.model}`,
+      reviewSignature: reviewSignature(input.mustFix), status: 'requested' }],
       history: [...(current.history ?? []), { at: now.toISOString(), event: 'repair-launched', pr, head, runId,
         effect: judged.judgement.move, moveId, detail: `source pr:${pr} · owner ${owner.seat} via ${owner.source} · must-fix ${input.mustFix.length} · childLlm ${from} → ${to.provider}/${to.model}` }] };
   });
@@ -473,7 +532,7 @@ export async function runRepairCycle(input: RepairCycleInput): Promise<RepairCyc
     else {
       passJourneyNode('next-move', { provenance: 'task-agent-repair', outcome: judged.judgement.move, runId,
         data: { card: card.id, source: `pr:${pr}`, pr, head, branch, mustFix: input.mustFix, moveId } });
-      recordJourneyEdge(judged.route, 'dispatch', undefined, { moveId });
+      recordJourneyEdge(judged.route, 'dispatch', undefined, { moveId, runId, card: card.id, pr, head });
     }
   } catch (error) {
     const detail = `repair observation failed after worker launch: ${error instanceof Error ? error.message : String(error)}`;