elanous 0.2.41 → 0.2.43

package/src/cli/pr-land-heavy-remote.ts

@@ -6,6 +6,9 @@ import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { getUserConfig } from '../user-config.js';
 import { debug, redactSecretText } from '../debug/log.js';
 import { gateRemoteHostCap, realGateRemoteRunner, resolveGateRemoteSettings, runOnRemote, type GateRemoteRunner, type RemoteRunOutcome } from '../self-implement/gate-remote.js';
+import { decideWarmReuse, type WarmReuseEvidenceByConsumer, type WarmReuseSwitchConfig } from '../task-orchestrator/surfaces/pod-warm-switch.js';
+import { buildLandWarmEvidence, type LandShadowSampleWindow } from './pr-land-pod-shadow-job.js';
+import { readWarmReuseEvidence, warmReuseEvidencePath, type WarmReuseEvidenceRow } from '../task-orchestrator/surfaces/warm-reuse-evidence.js';
 
 const SHA = /^[0-9a-f]{40}$/i;
 // This is the stable fallback order when settings.host is unavailable; an explicitly configured allowlisted host
@@ -16,7 +19,7 @@ export type PrLandHeavyHost = typeof PR_LAND_HEAVY_HOSTS[number];
 const allowedHost = (host: string): host is PrLandHeavyHost => PR_LAND_HEAVY_HOSTS.some((candidate) => candidate === host);
 
 export interface HeavyRemoteEvidence {
-  schema: 2;
+  schema: 3;
   pr: number;
   head: string;
   main: string;
@@ -66,6 +69,46 @@ export interface HeavyRemoteDeps {
   /** Test seam — same cadence as self gate (`dispatchHeavyCheck`): sleep at most 15s while a host stays busy. */
   sleep?: (ms: number) => void;
   observe?: (event: string, data: Record<string, unknown>) => void;
+  /** WARM-REUSE-LAND-CONSUMER-WIRE — land warm 재사용 config seam(기본은 `getUserConfig().pod?.warmReuse`). */
+  warmReuseConfig?: () => WarmReuseSwitchConfig | undefined;
+  /** WARM-REUSE-LAND-CONSUMER-WIRE — land shadow Job 결과 창 seam(기본 없음 = 증거 없음 = off). */
+  landShadowSamples?: () => LandShadowSampleWindow | undefined;
+  /** Durable shadow journal reader seam. */
+  readWarmEvidence?: (identity: { consumer: 'land' | 'gate-recheck'; pr: number; head: string; main: string }) => WarmReuseEvidenceRow[] | undefined;
+  warmEvidencePath?: () => string;
+}
+
+function journalLandShadowSamples(input: HeavyRemoteInput, deps: HeavyRemoteDeps): LandShadowSampleWindow | undefined {
+  const read = deps.readWarmEvidence ?? ((identity) => readWarmReuseEvidence(
+    (deps.warmEvidencePath ?? warmReuseEvidencePath)(), identity));
+  const rows = read({ consumer: 'land', pr: input.pr, head: input.head, main: input.main });
+  if (!rows?.length) return undefined;
+  const samples = rows.map((row) => ({ head: row.head, main: row.main,
+    lock: row.expectedLockHash ?? '', leaseValid: row.leaseValid === true && !!row.leaseId && !!row.workerId
+      && row.generation !== undefined && row.expectedLockHash === row.workerLockHash,
+    canaryPassed: row.canaryPassed === true, agree: row.agree === true }));
+  const latest = rows[rows.length - 1]!;
+  const gateRows = read({ consumer: 'gate-recheck', pr: input.pr, head: input.head, main: input.main });
+  let gateRecheck: LandShadowSampleWindow['gateRecheck'];
+  if (gateRows?.length) {
+    let consecutiveMatchSamples = 0;
+    for (let i = gateRows.length - 1; i >= 0; i--) {
+      const row = gateRows[i]!;
+      if (row.workerId !== latest.workerId || row.expectedLockHash !== latest.expectedLockHash
+        || row.workerLockHash !== row.expectedLockHash || row.leaseValid !== true
+        || !row.leaseId || row.generation === undefined
+        || row.canaryPassed !== true || row.agree !== true) break;
+      consecutiveMatchSamples++;
+    }
+    const latestGate = gateRows[gateRows.length - 1]!;
+    gateRecheck = { consecutiveMatchSamples, recentMismatchCount: gateRows.filter((row) => row.agree === false).length,
+      leaseValid: latestGate.leaseValid === true && !!latestGate.leaseId && !!latestGate.workerId && latestGate.generation !== undefined,
+      canaryPassed: latestGate.canaryPassed === true,
+      expected: { head: input.head, main: input.main, lock: latestGate.expectedLockHash },
+      worker: { head: input.head, main: input.main, lock: latestGate.workerLockHash } };
+  }
+  const lock = latest.expectedLockHash ?? '';
+  return { samples, lock, ...(gateRecheck ? { gateRecheck } : {}) };
 }
 
 function evidencePath(input: HeavyRemoteInput): string {
@@ -77,7 +120,7 @@ function validRootPlan(value: unknown): value is RootPlanSummary | null {
   if (!value || typeof value !== 'object') return false;
   const plan = value as Partial<RootPlanSummary>;
   return (plan.mode === 'affected' || plan.mode === 'full')
-    && (plan.roots === null || (Number.isSafeInteger(plan.roots) && plan.roots >= 0))
+    && (plan.roots === null || (typeof plan.roots === 'number' && Number.isSafeInteger(plan.roots) && plan.roots >= 0))
     && typeof plan.promoted === 'boolean'
     && (plan.reason === null || typeof plan.reason === 'string');
 }
@@ -86,7 +129,7 @@ function matchingEvidence(path: string, input: HeavyRemoteInput): HeavyRemoteEvi
   if (!existsSync(path)) return null;
   try {
     const data: HeavyRemoteEvidence = JSON.parse(readFileSync(path, 'utf8'));
-    return data.schema === 2 && data.pr === input.pr && data.head === input.head
+    return data.schema === 3 && data.pr === input.pr && data.head === input.head
       && data.main === input.main && allowedHost(data.host) && Number.isFinite(data.elapsedMs)
       && typeof data.interferenceMeasured === 'boolean' && validRootPlan(data.rootPlan) ? data : null;
   } catch { return null; }
@@ -209,6 +252,33 @@ export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemo
   if (!Number.isSafeInteger(input.pr) || input.pr <= 0 || !SHA.test(input.head) || !SHA.test(input.main)) {
     return { ok: false, source: 'unmeasured', reason: 'invalid-pr-head-or-main', elapsedMs: 0, evidencePath: path };
   }
+  // WARM-REUSE-LAND-CONSUMER-WIRE — 무거운 착지 판정마다 land 소비자 판정을 1줄 남긴다(pod.warm/switch-decision).
+  // 판정은 그림자 전용이다: live 여부와 무관하게 원격 게이트는 기존(fresh) 경로를 그대로 간다.
+  // 증거는 land shadow Job 결과 창(주입 seam · 기본 없음=증거 없음=off)에서 만들고, 판정 실패는 착지를 깨지 않는다.
+  let warmConfig: WarmReuseSwitchConfig | undefined;
+  let warmEvidence: WarmReuseEvidenceByConsumer | undefined;
+  let warmStage: 'config' | 'evidence' = 'config';
+  try {
+    warmConfig = deps.warmReuseConfig?.() ?? getUserConfig().pod?.warmReuse;
+  } catch (error) {
+    debug.log('pod.warm', 'land-shadow-unavailable', {
+      pr: input.pr, stage: warmStage,
+      reason: `warm-${warmStage}-read-failed`,
+      detail: error instanceof Error ? error.message : String(error), execution: 'fresh-gate',
+    }, { level: 'warn' });
+  }
+  try {
+    warmStage = 'evidence';
+    const samples = deps.landShadowSamples ? deps.landShadowSamples() : journalLandShadowSamples(input, deps);
+    warmEvidence = buildLandWarmEvidence(samples, { head: input.head, main: input.main });
+  } catch (error) {
+    debug.log('pod.warm', 'land-shadow-unavailable', {
+      pr: input.pr, stage: warmStage, reason: 'warm-evidence-read-failed',
+      detail: error instanceof Error ? error.message : String(error), execution: 'fresh-gate',
+    }, { level: 'warn' });
+  }
+  // Read failures leave config/evidence absent, but every valid landing still emits one fail-closed decision.
+  decideWarmReuse('land', warmConfig, warmEvidence);
   // A cached success is still a landing claim; accept only a measured host in the landing allowlist.
   const settings = deps.settings ?? resolveGateRemoteSettings(getUserConfig().gateRemote);
   if (!allowedHost(settings.host)) {
@@ -234,7 +304,7 @@ export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemo
           // then run typecheck and self gate (changed tests and PWA reach/build) at that exact pair.
           // The detached integration commit stays on the selected host and never changes the PR branch.
           argv: (sha) => ['sh', '-c',
-          'git -c user.name=elanous-gate -c user.email=gate@localhost -c commit.gpgsign=false merge --no-ff --no-edit "$1" && TSC_BASE_REF="$1" bun run scripts/ci-typecheck-changed.ts --local && bun bin/elanous.mjs self gate --changed --base "$1" --local --shards 4 && bun scripts/pr-land-extra-remote-gates.ts "$1"',
+          'git -c user.name=elanous-gate -c user.email=gate@localhost -c commit.gpgsign=false merge --no-ff --no-edit "$1" && bash scripts/ci-typecheck-main-delta.sh "$1" && bun bin/elanous.mjs self gate --changed --base "$1" --local --shards 4 && bun scripts/pr-land-extra-remote-gates.ts "$1"',
           'sh', sha(input.main)],
         }, deps.runner ?? realGateRemoteRunner);
       } catch (error) {
@@ -277,7 +347,7 @@ export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemo
     return { ok: false, host: selectedHost, attemptedHost: selectedHost, source: 'unmeasured', reason, elapsedMs, evidencePath: path, ...(failureLogPath ? { failureLogPath } : {}) };
   }
   const evidence: HeavyRemoteEvidence = {
-    schema: 2, pr: input.pr, head: input.head, main: input.main, host: selectedHost,
+    schema: 3, pr: input.pr, head: input.head, main: input.main, host: selectedHost,
     passedAt: new Date().toISOString(), elapsedMs: outcome.ms, rootPlan: rootPlanFromOutput(outcome.stdout),
     interferenceMeasured: extraGates.interferenceMeasured,
   };

package/src/cli/pr-land-overlap-evidence.ts

@@ -14,6 +14,9 @@
  *   ③ 리뷰 — 증거가 가리키는 `review-results/<card>-<pr>-<head접두 10~40>.json`(TA 가 받는 `self review --json` stdout)이
  *      파일명에서 같은 PR·머리 접두이고 내용에서 전체 PR·머리가 정확히 같으며 `reviewed:true` · `verdict ∈ {pass, warn}` · must-fix 가 «잰 수» 0 인가
  *      (자동 병합 canAuto · TA-LAND-WARN-MUSTFIX0 과 같은 규칙 — must-fix 를 못 셌으면 거부).
+ *   ③' 공급자(PRLAND-ACP-CLAUDE-ALLOW) — 백엔드가 `acp:claude`(또는 `acp:claude/…`, acp-fallback+`claude`)인 리뷰도
+ *      ③ 을 만족하고 «같은 머리의 선택된 리뷰» 이면 착지 증거다. 같은 머리의 실패한 금지 리뷰는 후보에서
+ *      superseded 로 제외되고(supersedes 장부), 유효한 같은-머리 리뷰가 없으면 종전처럼 거부한다(fail-closed).
  *   ⓐ 이미 조상(TC #26019 실측) — 겹친 최근 착지 커밋이 «전부» 고정 머리의 조상이면 그 겹침은 이미 그 머리의 게이트·리뷰에
  *      반영됐다 ⇒ ①② 없이 ③ 만으로 통과(관측 reason `already-ancestor`). 하나라도 조상이 아니면 ①②③ 전부.
  *   ⓐ' 증거 파일이 없을 때(`verifyAncestorAutoPass`) — 같은 ⓐ 를 표준 자리 `review-results/*-<pr>-<head접두 10~40>.json` 만으로 잰다
@@ -119,6 +122,17 @@ function checkSelectedReviewAttempts(input: VerifyOverlapEvidenceInput, e: Parti
   let selectedRecord: Record<string, unknown> | undefined;
   try { selectedRecord = lastReviewRecord(input.readFile(selected)); } catch { return { ok: false, reason: 'review-unreadable' }; }
   const hasResolvedPrior = hasResolvedPriorDeclaration(selectedRecord);
+  if (selectedRecord?.reviewer === 'OP-waiver') {
+    const waiver = validOpWaiver(selectedRecord, input.pr, selectedHead);
+    if (!waiver.ok) return { ok: false, reason: waiver.reason };
+    const linkedSameHeadFailure = candidates.some((path) => {
+      if (path === selected || !adjudicatesReviewFile(waiver.adjudicates, path)) return false;
+      const failed = checkReview(input, { reviewResult: path }, selectedHead);
+      return !failed.ok && /^review-(?:verdict-fail|must-fix-[1-9][0-9]*)$/.test(failed.reason)
+        && reviewAttemptHasExactSameHeadFail(input, path, selectedHead);
+    });
+    if (!linkedSameHeadFailure) return { ok: false, reason: 'review-op-waiver-same-head-failure-missing' };
+  }
   if (entries?.length || hasResolvedPrior) {
     try { selectedTime = input.reviewMtime(selected); } catch { return { ok: false, reason: 'review-attempt-time-unmeasured' }; }
     if (!Number.isFinite(selectedTime)) return { ok: false, reason: 'review-attempt-time-unmeasured' };
@@ -196,8 +210,77 @@ function lastReviewRecord(text: string): Record<string, unknown> | undefined {
   return undefined;
 }
 
+const OP_WAIVER_DISPOSITIONS = new Set(['already-fixed', 'out-of-scope-followup', 'reviewer-error']);
+
+function canonicalWaiverDisposition(value: unknown): string | undefined {
+  if (typeof value !== 'string') return undefined;
+  if (OP_WAIVER_DISPOSITIONS.has(value)) return value;
+  // These labels occur in OP's saved, approved adjudications; accept only their
+  // narrow semantic aliases while new decisions use the canonical vocabulary.
+  if (value === 'fixed-in-this-head') return 'already-fixed';
+  if (value === 'evidence-provided' || value === 'reviewer-misread-contract') return 'reviewer-error';
+  return undefined;
+}
+
+function opWaiverTestResult(value: unknown, head: string): boolean {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const run = value as Record<string, unknown>;
+  if (typeof run.sha !== 'string' || run.sha.toLowerCase() !== head || (run.exit !== undefined && run.exit !== 0)) return false;
+  const hasRunDescription = ['command', 'scope', 'rawOutput'].some((key) => typeof run[key] === 'string' && (run[key] as string).trim());
+  if (!hasRunDescription) return false;
+  let pass = typeof run.pass === 'number' && Number.isSafeInteger(run.pass) ? run.pass : undefined;
+  let fail = typeof run.fail === 'number' && Number.isSafeInteger(run.fail) ? run.fail : undefined;
+  if ((pass === undefined || fail === undefined) && run.tests && typeof run.tests === 'object' && !Array.isArray(run.tests)) {
+    const rows = Object.values(run.tests as Record<string, unknown>);
+    const parsed = rows.map((row) => typeof row === 'string' ? /^(\d+)\/(\d+)$/.exec(row) : null);
+    if (rows.length > 0 && parsed.every(Boolean)) {
+      pass = parsed.reduce((sum, row) => sum + Number(row![1]), 0);
+      fail = parsed.reduce((sum, row) => sum + Number(row![2]), 0);
+    }
+  }
+  return pass !== undefined && pass > 0 && fail === 0;
+}
+
+function validOpWaiver(record: Record<string, unknown> | undefined, pr: number, head: string):
+  | { ok: true; adjudicates: string; findingCount: number }
+  | { ok: false; reason: string } {
+  if (!record || record.reviewer !== 'OP-waiver') return { ok: false, reason: 'review-op-waiver-reviewer' };
+  const waiver = record.waiver;
+  if (!waiver || typeof waiver !== 'object' || Array.isArray(waiver)) return { ok: false, reason: 'review-op-waiver-missing' };
+  const value = waiver as Record<string, unknown>;
+  if (value.by !== 'OP' || typeof value.approvedBy !== 'string' || !value.approvedBy.trim()) {
+    return { ok: false, reason: 'review-op-waiver-approval-missing' };
+  }
+  if (typeof value.adjudicates !== 'string' || !value.adjudicates.trim()) return { ok: false, reason: 'review-op-waiver-adjudication-missing' };
+  if (!opWaiverTestResult(value.headTestRun, head)) return { ok: false, reason: 'review-op-waiver-head-test-missing' };
+  if (!Array.isArray(value.dispositions) || value.dispositions.length === 0) return { ok: false, reason: 'review-op-waiver-dispositions-missing' };
+  const findings = new Set<number>();
+  for (const raw of value.dispositions) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return { ok: false, reason: 'review-op-waiver-disposition-invalid' };
+    const item = raw as Record<string, unknown>;
+    if (!Number.isSafeInteger(item.finding) || (item.finding as number) < 1 || findings.has(item.finding as number)
+      || !canonicalWaiverDisposition(item.disposition)
+      || typeof item.evidence !== 'string' || !item.evidence.trim()) return { ok: false, reason: 'review-op-waiver-disposition-invalid' };
+    if (canonicalWaiverDisposition(item.disposition) === 'out-of-scope-followup'
+      && !/(?:#[1-9]\d*|\b[A-Z][A-Z0-9]+(?:-[A-Z0-9]+)+\b)/.test(item.evidence)) {
+      return { ok: false, reason: 'review-op-waiver-followup-missing' };
+    }
+    findings.add(item.finding as number);
+  }
+  const ordered = [...findings].sort((a, b) => a - b);
+  if (ordered.some((finding, index) => finding !== index + 1)) return { ok: false, reason: 'review-op-waiver-findings-incomplete' };
+  const recordPr = typeof record.pr === 'number' ? record.pr : Number(record.pr);
+  if (!Number.isSafeInteger(recordPr) || recordPr !== pr) return { ok: false, reason: 'review-op-waiver-pr-mismatch' };
+  return { ok: true, adjudicates: value.adjudicates, findingCount: findings.size };
+}
+
+function adjudicatesReviewFile(adjudicates: string, path: string): boolean {
+  return adjudicates.split(/[\s,;()]+/).includes(basename(path));
+}
+
 function hasResolvedPriorDeclaration(review: Record<string, unknown> | undefined): boolean {
   if (!review) return false;
+  if (review.reviewer === 'OP-waiver' && review.waiver && typeof review.waiver === 'object' && !Array.isArray(review.waiver)) return true;
   const value = review.resolvedPrior;
   if (value === true) return true;
   if (Array.isArray(value) && value.length > 0) return true;
@@ -250,12 +333,18 @@ function reviewAttemptExplicitlyResolved(input: VerifyOverlapEvidenceInput, sele
   let failed: Record<string, unknown> | undefined;
   try { failed = lastReviewRecord(input.readFile(failedPath)); } catch { return false; }
   if (!failed || failed.pr === undefined || String(failed.pr) !== String(input.pr)
-    || (typeof failed.headCommit === 'string' && failed.headCommit.toLowerCase() !== head)
+    || typeof failed.headCommit !== 'string' || failed.headCommit.toLowerCase() !== head
     || (typeof failed.currentHeadCommit === 'string' && failed.currentHeadCommit.toLowerCase() !== head)) return false;
   const rawFindings = findingList(failed.mustFix).map((finding) => finding.trim());
   const findings = rawFindings.map(normalizedFinding);
   if (findings.length === 0) return false;
 
+  const waiver = validOpWaiver(selected, input.pr, head);
+  if (waiver.ok) {
+    if (failed.reviewed !== true || failed.verdict !== 'fail' || rawFindings.length === 0) return false;
+    return adjudicatesReviewFile(waiver.adjudicates, failedPath) && waiver.findingCount === rawFindings.length;
+  }
+
   const declared = selected.resolvedPrior;
   if (declared !== undefined && declared !== false && containsUnresolvedDeclaration(declared)) return false;
   const intentBlocks = [selected.intent, selected.intentBlock, selected.reviewIntent, selected.reviewIntentBlock]
@@ -327,6 +416,15 @@ function reviewAttemptExplicitlyResolved(input: VerifyOverlapEvidenceInput, sele
   return findings.every((finding) => resolvedSet.has(finding));
 }
 
+function reviewAttemptHasExactSameHeadFail(input: VerifyOverlapEvidenceInput, failedPath: string, head: string): boolean {
+  let failed: Record<string, unknown> | undefined;
+  try { failed = lastReviewRecord(input.readFile(failedPath)); } catch { return false; }
+  return Boolean(failed && failed.pr !== undefined && String(failed.pr) === String(input.pr)
+    && failed.reviewed === true && failed.verdict === 'fail'
+    && typeof failed.headCommit === 'string' && failed.headCommit.toLowerCase() === head
+    && findingList(failed.mustFix).length > 0);
+}
+
 type Checked = { ok: false; reason: string; baseTip?: string; gateBase?: string; windowCommits?: number }
   | (OverlapEvidenceVerdict & { ok: true; baseTip?: string });
 
@@ -358,16 +456,26 @@ function checkReview(input: Pick<VerifyOverlapEvidenceInput, 'pr' | 'readFile'>
   if (!review.head || review.head.toLowerCase() !== reviewHead) return { ok: false, reason: 'review-head-mismatch', baseTip };
   // The capture parser projects away model provenance; inspect the same last result-shaped line here.
   const raw = lastReviewRecord(text);
+  let acpClaudeEvidence: { actualBackend: string; model: string; reviewRoute: string } | undefined;
   if (raw) {
+    if (raw.reviewer === 'OP-waiver') {
+      const waiver = validOpWaiver(raw, input.pr, head);
+      if (!waiver.ok) return { ok: false, reason: waiver.reason, baseTip };
+    }
     const actualBackend = typeof raw.actualBackend === 'string' ? raw.actualBackend.trim().toLowerCase() : '';
     const model = typeof raw.model === 'string' ? raw.model.trim().toLowerCase() : '';
     const route = typeof raw.reviewRoute === 'string' ? raw.reviewRoute.trim().toLowerCase() : '';
     const respondedProvider = typeof raw.respondedProvider === 'string' ? raw.respondedProvider.trim().toLowerCase() : '';
     const respondedModel = typeof raw.respondedModel === 'string' ? raw.respondedModel.trim().toLowerCase() : '';
+    // PRLAND-ACP-CLAUDE-ALLOW — `acp:claude` is no longer refused outright. A review that satisfies
+    // the landing contract below (same PR/head, reviewed, pass|warn, counted must-fix 0) is evidence
+    // whatever backend produced it; a failed acp:claude attempt is excluded by the same-head
+    // supersedes ledger instead of blocking every landing. This note records the provenance only —
+    // the contract below still decides, so an invalid or other-head acp:claude review stays rejected.
     if (actualBackend === 'acp:claude' || actualBackend.startsWith('acp:claude/')
       || model === 'acp:claude' || model.startsWith('acp:claude/')
       || ((route === 'acp' || route === 'acp-fallback') && typeof raw.fallbackBackend === 'string' && raw.fallbackBackend.trim().toLowerCase() === 'claude')) {
-      return { ok: false, reason: 'review-forbidden-acp-claude', baseTip };
+      acpClaudeEvidence = { actualBackend, model, reviewRoute: route };
     }
     const requested = typeof raw.requestedModel === 'string' ? raw.requestedModel.trim().toLowerCase() : '';
     if (requested) {
@@ -391,6 +499,9 @@ function checkReview(input: Pick<VerifyOverlapEvidenceInput, 'pr' | 'readFile'>
   if (review.reviewed !== true) return { ok: false, reason: 'review-not-reviewed', baseTip };
   if (review.verdict === null || !ACCEPTED_REVIEW_VERDICTS.has(review.verdict)) return { ok: false, reason: `review-verdict-${review.verdict ?? 'null'}`, baseTip };
   if (review.mustFix !== 0) return { ok: false, reason: review.mustFix === null ? 'review-must-fix-unknown' : `review-must-fix-${review.mustFix}`, baseTip };
+  if (acpClaudeEvidence) {
+    debug.log('pr.land', 'review-acp-claude-accepted', { pr: input.pr, head, reviewResult: e.reviewResult, ...acpClaudeEvidence });
+  }
   if (carry) {
     if (!input.cwd || !input.remote || !input.branch) return { ok: false, reason: 'carry-repo-unmeasured', baseTip };
     const digest = createHash('sha256').update(text).digest('hex');

package/src/cli/pr-land-pod-shadow-job.ts

@@ -3,7 +3,15 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { runPodCommand, type RunPodCommandOptions, type PodCommandResult } from '../task-orchestrator/surfaces/pod-command-job.js';
 import { redactSecretText } from '../debug/log.js';
+import { getUserConfig } from '../user-config.js';
 import type { RootPlanSummary } from './pr-land-heavy-remote.js';
+import type { WarmReuseEvidence, WarmReuseEvidenceByConsumer, WarmReuseSwitchConfig } from '../task-orchestrator/surfaces/pod-warm-switch.js';
+import { requestWarmPodReplay, finalizeWarmPodReplay, quarantineWarmPodReplay } from '../task-orchestrator/surfaces/pod-warm-worker-provider.js';
+import { assessWarmWorkerShadow, type WarmWorkerFileResult } from '../task-orchestrator/surfaces/pod-warm-worker-protocol.js';
+import { writeWarmJobManifest, warmReferenceFromJobArtifacts } from '../../scripts/release-loop/gate-warm-artifacts.js';
+import type { ActualWarmLeaseEvidence } from '../task-orchestrator/surfaces/warm-reuse-evidence.js';
+import { randomUUID } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
 
 const SHA = /^[0-9a-f]{40}$/i;
 const MARKER = 'ELANOUS_PRLAND_SHADOW';
@@ -11,7 +19,7 @@ const MARKER = 'ELANOUS_PRLAND_SHADOW';
 export const LANDING_POD_SHADOW_HOST_TIMEOUT_MS = 10 * 60_000;
 export const LANDING_POD_SHADOW_STATUS_UNREADABLE_MS = 60_000;
 
-export interface LandingPodShadowInput { head: string; main: string }
+export interface LandingPodShadowInput { pr?: number; repo?: string; host?: string; head: string; main: string }
 export interface LandingPodShadowVerdict {
   measured: boolean;
   ok: boolean;
@@ -20,9 +28,26 @@ export interface LandingPodShadowVerdict {
   gateRc?: number;
   reason?: string;
   job?: string;
+  /** Warm evidence only exists after a real worker lease and exact per-file comparison. */
+  warmEvidence?: ActualWarmLeaseEvidence;
+  warmReason?: string;
+  warmTestFiles?: string[];
 }
 
-export function landingPodShadowScript(head: string, main: string): string {
+const LAND_TEST_PATH = /^(?:[A-Za-z0-9_-][A-Za-z0-9_.-]*\/)*[A-Za-z0-9_-][A-Za-z0-9_.-]*\.test\.tsx?$/;
+export const LAND_WARM_CANARY_TIMEOUT_MS = 5 * 60_000;
+
+/** Changed test files are the bounded canary scope; no test file means no warm evidence. */
+export function changedLandWarmTestFiles(repo: string, head: string, main: string): string[] {
+  if (!SHA.test(head) || !SHA.test(main)) return [];
+  const result = spawnSync('git', ['-C', repo, 'diff', '--name-only', '--diff-filter=ACMR', `${main}...${head}`], {
+    encoding: 'utf8', timeout: 15_000, maxBuffer: 2 * 1024 * 1024,
+  });
+  if (result.status !== 0) return [];
+  return [...new Set(result.stdout.split(/\r?\n/).filter((path) => LAND_TEST_PATH.test(path)))].sort();
+}
+
+export function landingPodShadowScript(head: string, main: string, afterGate = ''): string {
   if (!SHA.test(head) || !SHA.test(main)) throw new Error('pod shadow: invalid head/main');
   return [
     'set -u',
@@ -38,17 +63,117 @@ export function landingPodShadowScript(head: string, main: string): string {
     `printf '${MARKER}_TSC_PLAN %s\\n' "$(grep '^\\[tsc-gate\\] root-plan ' /tmp/prland-shadow-tsc.log | tail -n 1 | sed 's/^\\[tsc-gate\\] root-plan //')"`,
     "tail -n 8 /tmp/prland-shadow-tsc.log; tail -n 8 /tmp/prland-shadow-gate.log",
     `printf '${MARKER} head=%s main=%s tsc=%s gate=%s\\n' '${head}' '${main}' "$tsc_rc" "$gate_rc"`,
+    ...(afterGate ? [afterGate] : []),
     'exit 0',
   ].join('\n');
 }
 
+function landWarmColdTestScript(files: readonly string[], head: string, attemptId: string): string {
+  if (files.some((file) => !LAND_TEST_PATH.test(file)) || !SHA.test(head) || !/^[0-9a-f-]{36}$/i.test(attemptId))
+    throw new Error('pod shadow: invalid warm test scope');
+  return files.map((file, index) => {
+    const prefix = `"$HOME/outbox/pr-land-warm/${index}"`;
+    const quotedFile = `'${file}'`;
+    return [
+      `mkdir -p "$HOME/outbox/pr-land-warm"`,
+      `bun test --reporter=junit --reporter-outfile=${prefix}.junit.xml ${quotedFile} >${prefix}.log 2>&1`,
+      'test_rc=$?',
+      `printf '%s' "$test_rc" >${prefix}.rc`,
+      `printf '{"commit":"${head}","attemptId":"${attemptId}","files":["${file}"],"rc":%s,"jobFailed":false,"jobExitCode":0}\n' "$test_rc" >${prefix}.json`,
+      `printf '[warm-worker] file=%s\\n[warm-worker] cut=%s attempt=%s\\n' '${file}' '${head}' '${attemptId}' >${prefix}.log.stamped`,
+      `cat ${prefix}.log >>${prefix}.log.stamped`,
+      `printf '\\n[warm-worker] junit-sha256=%s\\n' "$(sha256sum ${prefix}.junit.xml 2>/dev/null | cut -d' ' -f1)" >>${prefix}.log.stamped`,
+      `mv ${prefix}.log.stamped ${prefix}.log`,
+    ].join('\n');
+  }).join('\n');
+}
+
+async function runWarmLandCanary(input: {
+  pr: number; head: string; main: string; host: string; repo: string;
+  job: PodCommandResult; files: readonly string[]; attemptId: string; coldGatePassed: boolean;
+  timeoutMs?: number;
+  readReference?: typeof warmReferenceFromJobArtifacts;
+  requestWarm?: typeof requestWarmPodReplay;
+  finalizeWarm?: typeof finalizeWarmPodReplay;
+  quarantineWarm?: typeof quarantineWarmPodReplay;
+  warmConfig?: () => WarmReuseSwitchConfig | undefined;
+}): Promise<{ warmEvidence?: ActualWarmLeaseEvidence; reason: string }> {
+  let config: WarmReuseSwitchConfig | undefined;
+  try { config = input.warmConfig ? input.warmConfig() : getUserConfig().pod?.warmReuse; }
+  catch { return { reason: 'warm-config-unavailable' }; }
+  if (input.host !== 'node-b') return { reason: 'canary-host-mismatch' };
+  if (config?.land !== true) return { reason: 'land-canary-flag-off' };
+  if (!input.files.length) return { reason: 'changed-test-files-unmeasured' };
+  const coldFiles = input.files.map((file, index) => {
+    const prefix = join(input.job.artifactsDir, 'outbox', 'pr-land-warm', String(index));
+    const writeManifest = writeWarmJobManifest(prefix, file, input.head, input.attemptId);
+    return writeManifest ? (input.readReference ?? warmReferenceFromJobArtifacts)(prefix, file,
+      { cutSha: input.head, attemptId: input.attemptId }) : null;
+  });
+  if (coldFiles.some((row) => row === null)) return { reason: 'cold-reference-unmeasured' };
+  const requestWarm = input.requestWarm ?? requestWarmPodReplay;
+  let replay;
+  const timeoutMs = input.timeoutMs ?? LAND_WARM_CANARY_TIMEOUT_MS;
+  const request = requestWarm({ protocol: 1, runId: `land-${input.pr}-${input.head.slice(0, 8)}`,
+      attemptId: input.attemptId, cutSha: input.head, baselineSha: input.main,
+      deadlineAt: Date.now() + timeoutMs, files: [...input.files], envProfile: 'gate-v1' });
+  const timedOut = Symbol('warm-canary-timeout');
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    const raced = await Promise.race([request, new Promise<typeof timedOut>((resolve) => {
+      timer = setTimeout(() => resolve(timedOut), timeoutMs);
+    })]);
+    if (raced === timedOut) {
+      // The provider API has no AbortSignal yet. Fence any late lease as soon as it arrives.
+      void request.then(async (late) => {
+        if (late.command) await (input.quarantineWarm ?? quarantineWarmPodReplay)(late.command, 'land-shadow-late-after-timeout');
+      }).catch(() => {});
+      return { reason: 'warm-request-timeout' };
+    }
+    replay = raced;
+  } catch (error) { return { reason: `warm-request-failed:${error instanceof Error ? error.name : 'unknown'}` }; }
+  finally { if (timer) clearTimeout(timer); }
+  const command = replay.command;
+  if (!command) return { reason: replay.transport.reason ?? 'warm-lease-unmeasured' };
+  const decision = assessWarmWorkerShadow(command, coldFiles as WarmWorkerFileResult[], replay.transport.reply);
+  const matched = decision.reason === 'match';
+  let leaseValid = replay.transport.status === 'observed' && replay.transport.reason === 'complete';
+  try {
+    if (matched) await (input.finalizeWarm ?? finalizeWarmPodReplay)(command);
+    else { leaseValid = false; await (input.quarantineWarm ?? quarantineWarmPodReplay)(command, `land-shadow-${decision.reason}`); }
+  } catch { leaseValid = false; }
+  // The reply is the worker-side observation. Falling back to the host's requested key
+  // would turn a missing worker identity into a false positive comparison.
+  const workerLockHash = replay.transport.reply?.key?.lockHash;
+  if (!command.leaseId || !Number.isSafeInteger(command.generation) || command.generation < 1
+    || !command.key.lockHash || !workerLockHash) return { reason: 'warm-lease-identity-unmeasured' };
+  return { reason: decision.reason, warmEvidence: {
+    workerId: command.workerId,
+    leaseId: command.leaseId, generation: command.generation,
+    expectedLockHash: command.key.lockHash, workerLockHash,
+    leaseValid, canaryPassed: matched && leaseValid && input.coldGatePassed, agree: matched,
+  } };
+}
+
 export async function runLandingPodShadowJob(input: LandingPodShadowInput, deps: {
   runPod?: (options: RunPodCommandOptions) => Promise<PodCommandResult>;
   readLog?: (path: string) => string;
   /** Deterministic timer seam for the host deadline. */
   armTimeout?: (onTimeout: () => void, ms: number) => () => void;
+  testFiles?: readonly string[];
+  warmReplay?: typeof requestWarmPodReplay;
+  finalizeWarm?: typeof finalizeWarmPodReplay;
+  quarantineWarm?: typeof quarantineWarmPodReplay;
+  readReference?: typeof warmReferenceFromJobArtifacts;
+  warmConfig?: () => WarmReuseSwitchConfig | undefined;
+  warmTimeoutMs?: number;
 } = {}): Promise<LandingPodShadowVerdict> {
-  const script = landingPodShadowScript(input.head, input.main);
+  let warmConfig: WarmReuseSwitchConfig | undefined;
+  try { warmConfig = deps.warmConfig ? deps.warmConfig() : getUserConfig().pod?.warmReuse; } catch { /* no warm launch without readable config */ }
+  const canaryEnabled = input.host === 'node-b' && warmConfig?.land === true;
+  const files = canaryEnabled ? deps.testFiles ?? (input.repo ? changedLandWarmTestFiles(input.repo, input.head, input.main) : []) : [];
+  const attemptId = randomUUID();
+  const script = landingPodShadowScript(input.head, input.main, landWarmColdTestScript(files, input.head, attemptId));
   const controller = new AbortController();
   const armTimeout = deps.armTimeout ?? ((onTimeout: () => void, ms: number) => {
     const timer = setTimeout(onTimeout, ms);
@@ -105,5 +230,78 @@ export async function runLandingPodShadowJob(input: LandingPodShadowInput, deps:
   if (!rootPlan) return { measured: false, ok: false, rootPlan: null, reason: 'root-plan-missing', job: job.job };
   const tscRc = Number(match[1]);
   const gateRc = Number(match[2]);
-  return { measured: true, ok: tscRc === 0 && gateRc === 0, rootPlan, tscRc, gateRc, job: job.job };
+  const verdict: LandingPodShadowVerdict = { measured: true, ok: tscRc === 0 && gateRc === 0, rootPlan, tscRc, gateRc, job: job.job,
+    ...(files.length ? { warmTestFiles: [...files] } : {}) };
+  if (input.pr && input.repo && input.host) {
+    const warm = await runWarmLandCanary({ pr: input.pr, head: input.head, main: input.main, host: input.host,
+      repo: input.repo, job, files, attemptId, coldGatePassed: verdict.ok,
+      ...(deps.warmTimeoutMs !== undefined ? { timeoutMs: deps.warmTimeoutMs } : {}),
+      ...(deps.readReference ? { readReference: deps.readReference } : {}),
+      ...(deps.warmReplay ? { requestWarm: deps.warmReplay } : {}),
+      ...(deps.finalizeWarm ? { finalizeWarm: deps.finalizeWarm } : {}),
+      ...(deps.quarantineWarm ? { quarantineWarm: deps.quarantineWarm } : {}),
+      warmConfig: () => warmConfig });
+    verdict.warmReason = warm.reason;
+    if (warm.warmEvidence) verdict.warmEvidence = warm.warmEvidence;
+  }
+  return verdict;
+}
+
+/** WARM-REUSE-LAND-CONSUMER-WIRE — land shadow Job 결과 표본(착지쌍·lock·lease·카나리아·그림자 일치). */
+export interface LandingShadowSample {
+  /** shadow Job 이 잰 착지쌍 — 원격 게이트가 잰 head/main 와 정확히 같아야 표본으로 센다. */
+  head: string;
+  main: string;
+  /** shadow Job 이 돈 Pod generation lock — 원값 그대로 대조한다. */
+  lock: string;
+  /** shadow Job 이 lease 를 잡고 끝까지 쟀나. */
+  leaseValid: boolean;
+  /** shadow Job 카나리아(착지 tsc+gate) 통과. */
+  canaryPassed: boolean;
+  /** 같은 착지의 fresh(원격 게이트) 판정과 그림자 비교 일치 — 불일치 표본은 최근 mismatch 로 센다. */
+  agree: boolean;
+}
+
+/** land 소비자 판정 증거 입력 — 최근 창 표본 ⊕ 이번 착지가 기대하는 warm 워커 lock ⊕ 선행 소비자 증거. */
+export interface LandShadowSampleWindow {
+  /** 최근 창 — 마지막 원소가 가장 최근 shadow 결과다. */
+  samples: LandingShadowSample[];
+  /** 이번 착지가 기대하는 warm 워커 lock(현재 Pod generation). */
+  lock: string;
+  /** 선행 소비자(gate-recheck)의 자기 증거 — land 는 이 칸이 live 여야 live 가 될 수 있다(비면 off). */
+  gateRecheck?: WarmReuseEvidence;
+}
+
+/**
+ * WARM-REUSE-LAND-CONSUMER-WIRE — land shadow Job 결과에서 소비자('land') 판정 증거를 만든다.
+ * 판정 본체는 pod-warm-switch.ts `decideWarmReuse` — 이 모듈은 증거의 산지만 담당한다.
+ * 창이 없거나 비면 land 증거 칸이 비어 off 다 — 못 잰 증거는 통과가 아니다.
+ * 원값은 고쳐 읽지 않고 정확히 비교한다(신원 형식 어긋남은 pod-warm-switch 판정이 끊는다).
+ */
+export function buildLandWarmEvidence(
+  window: LandShadowSampleWindow | undefined,
+  expected: { head: string; main: string },
+): WarmReuseEvidenceByConsumer {
+  const evidence: WarmReuseEvidenceByConsumer = window?.gateRecheck ? { 'gate-recheck': window.gateRecheck } : {};
+  if (!window || window.samples.length === 0) return evidence;
+  const latest = window.samples[window.samples.length - 1]!;
+  let consecutiveMatchSamples = 0;
+  for (let index = window.samples.length - 1; index >= 0; index--) {
+    const sample = window.samples[index]!;
+    if (sample.head !== expected.head || sample.main !== expected.main || sample.lock !== window.lock
+      || sample.leaseValid !== true || sample.canaryPassed !== true || sample.agree !== true) break;
+    consecutiveMatchSamples++;
+  }
+  const recentMismatchCount = window.samples.filter((sample) => sample.agree === false).length;
+  return {
+    ...evidence,
+    land: {
+      consecutiveMatchSamples,
+      recentMismatchCount,
+      leaseValid: latest.leaseValid,
+      canaryPassed: latest.canaryPassed,
+      expected: { head: expected.head, main: expected.main, lock: window.lock },
+      worker: { head: latest.head, main: latest.main, lock: latest.lock },
+    },
+  };
 }

package/src/cli/pr-land-pod-shadow.ts

@@ -15,6 +15,8 @@ export interface HeavyOnPodShadowInput<T> {
   runPod: () => T | Promise<T>;
   log: (category: string, event: string, data: Record<string, unknown>) => void;
   warn: (message: string) => void;
+  /** Evidence persistence is best effort; it must never change the cold landing verdict. */
+  onShadow?: (observation: { pod: unknown; agree: boolean }) => void;
 }
 
 function agree(local: unknown, pod: unknown): boolean {
@@ -38,22 +40,25 @@ function elapsedMs(started: number): number {
 }
 
 export async function runHeavyOnPodShadow<T>(input: HeavyOnPodShadowInput<T>): Promise<T> {
-  const { enabled, pr, head, local, runPod, log, warn } = input;
+  const { enabled, pr, head, local, runPod, log, warn, onShadow } = input;
   if (!enabled) return local;
 
   const localMs = 0;
   const started = performance.now();
   try {
     const pod = await runPod();
+    const agrees = agree(local, pod);
     log('pr.land', 'heavy-on-pod-shadow', {
       pr,
       head,
       local,
       pod,
-      agree: agree(local, pod),
+      agree: agrees,
       podMs: elapsedMs(started),
       localMs,
     });
+    try { onShadow?.({ pod, agree: agrees }); }
+    catch (error) { warn(`shadow evidence write failed: ${error instanceof Error ? error.message : String(error)}`); }
   } catch (error) {
     warn(error instanceof Error ? error.message : String(error));
     log('pr.land', 'heavy-on-pod-shadow', {
@@ -62,6 +67,8 @@ export async function runHeavyOnPodShadow<T>(input: HeavyOnPodShadowInput<T>): P
       agree: false,
       podMs: elapsedMs(started), localMs,
     });
+    try { onShadow?.({ pod: { measured: false, ok: false, reason: `pod-exception:${error instanceof Error ? error.name : 'unknown'}` }, agree: false }); }
+    catch (writeError) { warn(`shadow evidence write failed: ${writeError instanceof Error ? writeError.message : String(writeError)}`); }
   }
   return local;
 }