elanous 0.2.0 → 0.2.4

package/src/self-dev/orchestrate.ts

@@ -17,7 +17,16 @@
  * Cf. PLAN-parallel-self-dev-orchestrator-2026-07-21.
  */
 import { randomUUID } from 'node:crypto';
+import { spawn, execFileSync } from 'node:child_process';
+import { emitDecision } from '../live/detail-switch.js';
+import { parentUnlandedProgressLine } from './run-supervisor.js';
+import { mkdirSync, openSync, writeFileSync, closeSync, renameSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
 import { availableParallelism, cpus } from 'node:os';
+import { selfDevRunsDir } from './run-store.js';
+import { HARNESS_RUN_ID_ENV, normalizeRunId } from '../harness/harness-space.js';
+import { plannedSelfImplBranch } from '../harness/worktree-branch-prefix.js';
+import { parseGoalId } from '../self-implement/goal-author.js';
 import { isTransientExecutionFailure } from './execution-transient.js';
 import type { AbandonedClassification } from '../self-implement/abandoned-classification.js';
 import type { DeployVerifyFinding, DeployVerifyResult } from '../harness/browser-verify.js';
@@ -201,6 +210,10 @@ export interface SelfDevGoal {
   draft?: boolean;
   /** Optional short title (≤ 80 chars). Default = feature head. */
   title?: string;
+  /** 계획 브랜치가 알려지면 같은 워크트리의 실행을 직렬화한다. */
+  planBranch?: string;
+  /** 계획 브랜치가 없는 저작 골의 안정 식별자. */
+  goalId?: string;
   /** S2 — goal-local id for dependency wiring (default = array index). */
   id?: string;
   /** S2 — goal-local ids this goal depends on (must complete first).
@@ -226,12 +239,15 @@ interface SelfDevTerminalOutcome {
   stage: string | null;
   merged: boolean | null;
   prUrl: string | null;
+  blockReason?: 'parent-unlanded';
+  parentPrNumber?: number | null;
+  parentNoPr?: true;
 }
 
 export interface SelfDevJobResult {
   taskId: string;
   feature: string;
-  /** Terminal status — done | failed | cancelled. */
+  /** Run outcome — done | failed | cancelled | blocked (awaiting parent landing). */
   status: TaskStatus;
   error?: { code: string; message: string };
   durationMs?: number;
@@ -243,6 +259,13 @@ export interface SelfDevJobResult {
   prUrl?: string;
   prNumber?: number;
   merged?: boolean;
+  /** Child commit SHA, when observed by the Pod/host. */
+  checkedHeadCommit?: string;
+  /** A dependency is done but its result is not on main; no child was launched. */
+  blockReason?: 'parent-unlanded';
+  parentPrNumber?: number;
+  /** The upstream completed in a worktree without opening a PR. */
+  parentNoPr?: true;
   // ⭐⭐⭐ `A1`(2026-08-19 · 대표 *"R3 가 서브 프로세스여도 잘 도는 안"*) — ***판정 3종***.
   //   🚨 이 셋이 트리아지의 입력 전부인데 종전엔 자식 → 부모 경계에서 «전부» 사라졌다.
   //     값은 전선에 «실려 있었고»(자식이 `r.result` 를 통째로 낸다) 파서가 버렸다.
@@ -319,6 +342,37 @@ export interface SelfDevResultSummary {
   unlanded: number;
 }
 
+/** Read-only landing probe. An unobservable PR/commit is not evidence of landing. */
+export function dependencyOnMain(
+  result: Pick<SelfDevJobResult, 'prNumber' | 'stage' | 'merged' | 'checkedHeadCommit'>,
+  probe: { prMerged: (number: number) => boolean; commitOnMain: (commit: string) => boolean },
+): boolean {
+  if (result.prNumber !== undefined) {
+    try { if (probe.prMerged(result.prNumber)) return true; } catch { /* unknown is not landed */ }
+  }
+  if (result.checkedHeadCommit) {
+    try { if (probe.commitOnMain(result.checkedHeadCommit)) return true; } catch { /* unknown is not landed */ }
+  }
+  return false;
+}
+
+/** A merged PR lands a dependency only when its base is main. */
+export function prMergedOnMain(number: number, readPr: (number: number) => string = (pr) =>
+  execFileSync('gh', ['pr', 'view', String(pr), '--json', 'state,baseRefName'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 10_000 })): boolean {
+  const pr = JSON.parse(readPr(number)) as { state?: unknown; baseRefName?: unknown };
+  return pr.state === 'MERGED' && pr.baseRefName === 'main';
+}
+
+const defaultLandingProbe = {
+  prMerged: prMergedOnMain,
+  commitOnMain: (commit: string): boolean => {
+    if (!/^[0-9a-f]{40}$/i.test(commit)) return false;
+    // git-spawn-allow: read-only ancestry check against the cached remote main ref.
+    try { execFileSync('git', ['merge-base', '--is-ancestor', commit, 'refs/remotes/origin/main'], { stdio: 'ignore' }); return true; }
+    catch { return false; }
+  },
+};
+
 export function hasLanded(result: SelfDevJobResult): boolean {
   return result.stage === 'merged' && result.merged === true;
 }
@@ -398,6 +452,7 @@ export type FailureKind =
    * 가리킬 PR(prUrl 또는 prNumber)이 있을 때만. 없으면 기존 수렴 실패로 남긴다.
    */
   | 'awaiting-human'
+  | 'parent-unlanded'
   /**
    * 구현·리뷰가 끝난 결과가 main 정합(`stage: merge-conflict`)에서 멈췄다.
    * 구현 결함이 아니므로 재구현하지 않고 사람에게 넘긴다 — 결과는 보존 워크트리·브랜치에 있다.
@@ -456,6 +511,7 @@ export function triageActionFor(kind: FailureKind): TriageAction {
     case 'oversized-goal': return 'add-repair-task';
     case 'false-failure': return 'no-action';
     case 'awaiting-human':
+    case 'parent-unlanded':
     case 'main-sync-blocked':
     case 'provider-rejected': return 'needs-human';
     default: return 'needs-human';
@@ -531,9 +587,13 @@ export function classifyFailure(
   result: SelfDevJobResult,
   preflightWarning: PreflightWarningObservation = 'unknown',
 ): FailureKind | null {
+  if (result.blockReason === 'parent-unlanded') return 'parent-unlanded';
   const ledgerKind = result.failureClassification === undefined
     ? undefined
-    : LEDGER_FAILURE_KIND[result.failureClassification];
+    : result.failureClassification === 'run-deadline-exceeded'
+      // 기한 사망은 transient 가 아니다. 브랜치/PR 이 있으면 수확(false-failure), 없으면 재분해.
+      ? (result.branch || result.prUrl || result.prNumber !== undefined ? 'false-failure' : 'unconverged-decomposable')
+      : LEDGER_FAILURE_KIND[result.failureClassification];
 
   // ⭐ 수렴 실패인데 하니스가 «쪼개는 법»을 이미 냈으면 그것은 다른 처방이다.
   //   ⛔ 조각이 둘 미만인 제안은 채우는 자가 이미 걸러낸다(decompose-proposal.ts).
@@ -563,6 +623,8 @@ export function classifyFailure(
     return result.error?.code === 'DEP_FAILED' ? 'blocked-upstream' : 'unclassified';
   }
   if (result.status !== 'failed') return null;
+  // 기한 사망은 단계·일시 실패 어휘보다 앞선다. 브랜치/PR 이면 수확, 없으면 재분해. transient 가 아니다.
+  if (result.failureClassification === 'run-deadline-exceeded') return ledgerKind!;
   if (result.stage === 'merged' || result.stage === 'pr-opened') return 'false-failure';
   // main 정합 실패는 구현 결함이 아니다. 원장(report-deficit 등 → unconverged → rework)보다 앞선다.
   if (result.stage === 'merge-conflict') return 'main-sync-blocked';
@@ -647,7 +709,9 @@ export function classifyFailures(
     const error = result.error;
     const awaitingHuman = kind === 'awaiting-human'
       ? failureObservationFields('AWAITING_HUMAN', openPrAwaitingHumanMessage(result))
-      : undefined;
+      : kind === 'parent-unlanded'
+        ? failureObservationFields('PARENT_UNLANDED', parentUnlandedProgressLine(result.feature.split('\n')[0]!, result.parentPrNumber, result.parentNoPr === true))
+        : undefined;
     return [{
       taskId: result.taskId,
       stage: result.stage ?? null,
@@ -674,7 +738,7 @@ export function summarizeFailureKinds(results: SelfDevJobResult[]): {
       else if (failure.kind === 'transient') summary.transient++;
       else if (failure.kind === 'blocked-upstream') summary.blockedUpstream++;
       else if (failure.kind === 'main-sync-blocked') summary.mainSyncBlocked++;
-      else summary.unclassified++;
+      else if (failure.kind !== 'parent-unlanded') summary.unclassified++;
       return summary;
     },
     { falseFailure: 0, unconverged: 0, unclassified: 0, transient: 0, blockedUpstream: 0, unconvergedDecomposable: 0, mainSyncBlocked: 0 },
@@ -818,6 +882,23 @@ export interface OrchestrateSelfDevOptions {
   verifyDeliverable?: (target: string) => Promise<DeployVerifyResult>;
   /** Launch seam — default spawns real subprocesses. Tests inject a fake. */
   spawn?: SelfImplementJobSpawn;
+  /** Read-only landing seam; production queries PR state and cached origin/main. */
+  landingProbe?: { prMerged: (number: number) => boolean; commitOnMain: (commit: string) => boolean };
+  /** Dispatch decision observation seam; production uses the live-detail switch. */
+  emitDispatchDecision?: typeof emitDecision;
+  /** Run identity for the per-run PID and labelled Pod cleanup. */
+  runId?: string;
+  /** Override the run directory root for isolated tests. */
+  runsDir?: string;
+  /** Signal source and kubectl seams for isolated lifecycle tests. */
+  signalSource?: Pick<NodeJS.Process, 'on' | 'off'>;
+  /** Pod context/namespace pairs chosen by the caller that launched the Jobs. */
+  podTargets?: readonly { context: string; namespace: string }[];
+  /** Return the number of labelled jobs removed. */
+  deleteJobs?: (runId: string) => number | Promise<number>;
+  /** Injectable kubectl process seam. */
+  spawnKubectl?: typeof spawn;
+  onSecondSignal?: (signal: NodeJS.Signals) => void;
   /** F1 additions for non-dev jobs. `dev` always uses the legacy mapping. */
   jobKinds?: Omit<JobKindRegistry, 'dev'>;
   now?: () => number;
@@ -868,12 +949,53 @@ function goalTitle(g: SelfDevGoal): string {
   return raw.length <= TASK_DEFAULTS.titleMaxLen ? raw : raw.slice(0, TASK_DEFAULTS.titleMaxLen - 1) + '…';
 }
 
+export function withOrchestrateGoalKey(goal: SelfDevGoal): SelfDevGoal {
+  const goalId = goal.goalId ?? parseGoalId(goal.feature);
+  return {
+    ...goal,
+    ...(goalId ? { goalId } : {}),
+    planBranch: goal.planBranch ?? plannedSelfImplBranch(goal.feature, goalId ?? undefined),
+  };
+}
+
+function goalInFlightKey(goal: SelfDevGoal): string {
+  return goal.planBranch?.trim() || goal.goalId?.trim() || parseGoalId(goal.feature) || plannedSelfImplBranch(goal.feature);
+}
+
+/** All orchestrations in this process share reservations; the Pod Job name is the remote execution's identity. */
+const inFlightByKey = new Map<string, Promise<void>>();
+
+async function deleteLabelledJobs(runId: string, selectedTargets: readonly { context: string; namespace: string }[], spawnKubectl: typeof spawn = spawn): Promise<number> {
+  const targets = new Map(selectedTargets.map(({ context, namespace }) => [`${context}/${namespace}`, { context, namespace }]));
+  const counts = await Promise.all([...targets.values()].map(({ context, namespace }) => new Promise<number>((resolveCount) => {
+    const env = { ...process.env };
+    for (const key of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'ALL_PROXY', 'all_proxy']) delete env[key];
+    const child = spawnKubectl('kubectl', ['--context', context, '-n', namespace, 'delete', 'job', '-l', `elanous.run=${runId}`, '--wait=false'], { stdio: ['ignore', 'pipe', 'pipe'], env });
+    let stdout = '';
+    let stderr = '';
+    child.stdout?.on('data', (data: Buffer) => { stdout += data.toString(); });
+    child.stderr?.on('data', (data: Buffer) => { stderr += data.toString(); });
+    const timeout = setTimeout(() => { child.kill('SIGKILL'); }, 5_000);
+    let spawnError: Error | undefined;
+    child.once('error', (error) => { spawnError = error; });
+    child.once('close', (code) => {
+      clearTimeout(timeout);
+      if (code !== 0) debug.log('self-dev.orchestrate', 'job-delete-failed', { runId, context, namespace, error: String(spawnError ?? (stderr || `kubectl exit ${code}`)) }, { level: 'warn' });
+      resolveCount(code === 0 ? stdout.split('\n').filter((line) => line.startsWith('job.batch/')).length : 0);
+    });
+  })));
+  return counts.reduce((sum, count) => sum + count, 0);
+}
+
 /**
  * Run N self-dev jobs in parallel under the TOX dispatcher and resolve
  * once every job reaches a terminal status.
  */
 export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<SelfDevJobResult[]> {
   const now = opts.now ?? Date.now;
+  const runId = opts.runId ?? process.env[HARNESS_RUN_ID_ENV];
+  if (runId && runId !== normalizeRunId(runId)) throw new Error(`invalid self-dev run ID: ${runId}`);
+  const pidPath = runId ? join(opts.runsDir ?? selfDevRunsDir(), runId, 'pid.json') : undefined;
   const graph = new TaskGraph();
   const bus = new TaskEventBus();
   const registry = new SurfaceRegistry();
@@ -882,6 +1004,7 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
   // (keyed by its harness-space id) as the child exits. The dispatcher
   // only surfaces status via bus events, so this side-channel carries
   // the rich `{stage, prUrl, merged, worktreePath}` back to `finish()`.
+  let cancelling = false;
   const baseSpawn = opts.spawn ?? defaultSelfImplementSpawn();
   const doneBySpace = new Map<string, SelfImplementJobDone>();
   const taskByGoal = new Map<string, SelfDevGoal>();      // taskId → goal
@@ -985,14 +1108,14 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
     return handoffs.length ? `${dependencyFeature}\n\n## Dependency handoff\n${handoffs.join('\n')}` : dependencyFeature;
   };
   const capturingSpawn: SelfImplementJobSpawn = (input) => {
-    const feature = dependencyOutputFeature(input.spaceId, input.feature);
-    const r = baseSpawn({ ...input, feature });
+    const taskId = [...spaceIdByTask.entries()].find(([, id]) => id === input.spaceId)?.[0];
+    const goal = taskId ? taskByGoal.get(taskId) : undefined;
+    if (cancelling) throw new Error('orchestration cancelled by signal');
+    const started = baseSpawn({ ...input, feature: dependencyOutputFeature(input.spaceId, input.feature) });
     return {
-      address: r.address,
-      done: r.done.then((d) => {
+      address: started.address,
+      done: started.done.then((d) => {
         doneBySpace.set(input.spaceId, d);
-        const taskId = [...spaceIdByTask.entries()].find(([, id]) => id === input.spaceId)?.[0];
-        const goal = taskId ? taskByGoal.get(taskId) : undefined;
         // ⛔ 종전엔 exitCode 0 일 때만 붙잡아 «막힌 상류의 맥락»이 사라졌다 ⇒ 하류가 같은 벽에 다시 부딪혔다.
         //   이제 막혀도 붙잡되, 결말을 «다른 값»으로 실어 하류가 「이미 된 것」으로 오독하지 않게 한다.
         if (goal) {
@@ -1013,6 +1136,34 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
       }),
     };
   };
+  const devAdapter = createSelfImplementAdapter({ spawn: capturingSpawn, now });
+  const keyedDevAdapter: SurfaceAdapter = async (task, ctx) => {
+    const goal = taskByGoal.get(task.id);
+    const key = goalInFlightKey(goal ?? { feature: task.surface.kind === 'self-implement' ? task.surface.feature : task.title });
+    const previous = inFlightByKey.get(key);
+    let releaseQueue!: () => void;
+    const reserved = new Promise<void>((resolve) => { releaseQueue = resolve; });
+    inFlightByKey.set(key, reserved);
+    const releaseKey = () => {
+      if (inFlightByKey.get(key) === reserved) inFlightByKey.delete(key);
+      releaseQueue();
+    };
+    try {
+      if (previous) {
+        debug.log('self-dev.orchestrate', 'same-key-in-flight', { key, waited: true });
+        await previous;
+      }
+      if (ctx.signal?.aborted) {
+        throw new Error('aborted while waiting for same key');
+      }
+      if (cancelling) throw new Error('orchestration cancelled by signal');
+      const result = await devAdapter(task, ctx);
+      return { ...result, promise: result.promise.finally(releaseKey) };
+    } catch (error) {
+      releaseKey();
+      throw error;
+    }
+  };
   const devDefinition: JobKindDefinition = {
     surfaceKind: 'self-implement',
     surface: (goal) => ({
@@ -1024,7 +1175,8 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
       ...(goal.openPr !== undefined ? { openPr: goal.openPr } : {}),
       ...(goal.draft !== undefined ? { draft: goal.draft } : {}),
     }),
-    adapter: createSelfImplementAdapter({ spawn: capturingSpawn, now }),
+    // TaskDispatcher.tick → TaskDispatcher.spawn → keyedDevAdapter → dispatchSelfImplement (self-implement.ts) → capturingSpawn.
+    adapter: keyedDevAdapter,
     isolation: 'worktree',
   };
   if (opts.jobKinds && Object.prototype.hasOwnProperty.call(opts.jobKinds, 'dev')) {
@@ -1073,10 +1225,19 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
   const resumeDispositionByGoal = new Map<SelfDevGoal, Exclude<ResumeDisposition, 'skip'>>();
   const goalsToRun: SelfDevGoal[] = [];
   const held = new Set(opts.resumeHold ?? []);
+  const localGoals = new Map(opts.goals.map((goal, index) => [goal.id ?? String(index), goal]));
+  // Landing is required only for declared dependencies. Shared hotPaths serialize execution
+  // order (TOX edges below) but do not make an independent goal wait for another goal's PR.
+  const dependencyGoals = (goal: SelfDevGoal): SelfDevGoal[] => [...new Set(
+    (goal.dependsOn ?? []).map((id) => localGoals.get(id)).filter((parent): parent is SelfDevGoal => parent !== undefined && parent !== goal),
+  )];
+  const parents = new Set(opts.goals.flatMap(dependencyGoals));
+  const landingProbe = opts.landingProbe ?? defaultLandingProbe;
   for (const g of opts.goals) {
     const prior = priorByResumeKey.get(resumeKey(g.feature));
     if (prior) {
-      const disposition = held.has(prior.taskId) ? 'skip' : classifyResumeDisposition(prior);
+      const disposition = held.has(prior.taskId) || (parents.has(g) && prior.status === 'done' && prior.stage === 'pr-opened')
+        ? 'skip' : classifyResumeDisposition(prior);
       if (held.has(prior.taskId)) {
         debug.log('self-dev.orchestrate', 'resume.held', { taskId: prior.taskId, stage: prior.stage ?? null, wouldHaveBeen: classifyResumeDisposition(prior) });
       }
@@ -1210,7 +1371,66 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
 
   return new Promise<SelfDevJobResult[]>((resolve, reject) => {
     const results = new Map<string, SelfDevJobResult>();
+    const blockedByParent = new Set<string>();
+    const resumedByTaskId = new Map(resumedResults.map((result) => [result.taskId, result]));
     let settled = false;
+    let interrupted: NodeJS.Signals | undefined;
+    const signals = opts.signalSource ?? process;
+    const cleanup = (): void => {
+      signals.off('SIGTERM', onTerm);
+      signals.off('SIGINT', onInt);
+      if (pidPath) {
+        try { unlinkSync(pidPath); }
+        catch (error) {
+          if ((error as NodeJS.ErrnoException).code !== 'ENOENT') debug.log('self-dev.orchestrate', 'pid-cleanup-failed', { pidPath, error: String(error) }, { level: 'warn' });
+        }
+      }
+    };
+    const cancel = (signal: NodeJS.Signals): void => {
+      if (cancelling) {
+        cleanup();
+        (opts.onSecondSignal ?? ((s) => process.exit(s === 'SIGINT' ? 130 : 143)))(signal);
+        return;
+      }
+      if (settled) return;
+      cancelling = true;
+      interrupted = signal;
+      let pending = 0;
+      for (const { task } of created) {
+        const current = graph.getTask(task.id);
+        if (!current || isTerminalStatus(current.status)) continue;
+        if (current.status === 'running') dispatcher.kill(task.id);
+        else {
+          graph.updateTask(task.id, { status: 'cancelled' }, { now: now() });
+          pending++;
+        }
+        results.set(task.id, { taskId: task.id, feature: taskByGoal.get(task.id)?.feature ?? '', status: 'cancelled', stopReason: 'signal', error: { code: 'SIGNAL', message: 'signal' } });
+      }
+      void (async () => {
+        let jobsDeleted = 0;
+        try { if (runId && (opts.podTargets || opts.deleteJobs)) jobsDeleted = await (opts.deleteJobs ?? ((id) => deleteLabelledJobs(id, opts.podTargets!, opts.spawnKubectl)))(runId); }
+        catch (error) { debug.log('self-dev.orchestrate', 'job-delete-failed', { runId, error: String(error) }, { level: 'warn' }); }
+        debug.log('self-dev.orchestrate', 'signal', { signal, pending, jobsDeleted });
+        finishOrReject();
+      })();
+    };
+    const onTerm = () => cancel('SIGTERM');
+    const onInt = () => cancel('SIGINT');
+    signals.on('SIGTERM', onTerm);
+    signals.on('SIGINT', onInt);
+    try {
+      if (pidPath) {
+        mkdirSync(join(opts.runsDir ?? selfDevRunsDir(), runId!), { recursive: true });
+        const temporary = `${pidPath}.${process.pid}.${randomUUID()}.tmp`;
+        const fd = openSync(temporary, 'wx', 0o600);
+        try {
+          try {
+            writeFileSync(fd, JSON.stringify({ pid: process.pid, startedAt: Date.now() - Math.floor(process.uptime() * 1000), argv0: process.argv0 }));
+          } finally { closeSync(fd); }
+          renameSync(temporary, pidPath);
+        } catch (error) { unlinkSync(temporary); throw error; }
+      }
+    } catch (error) { cleanup(); reject(error); return; }
 
     // Current full result set: resumed-done goals + each running task's
     // state (with disposition merged when the job has settled). Reused by
@@ -1236,9 +1456,10 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
           ...(disp?.prUrl ? { prUrl: disp.prUrl } : {}),
           ...(disp?.prNumber !== undefined ? { prNumber: disp.prNumber } : {}),
           ...(disp?.merged !== undefined ? { merged: disp.merged } : {}),
+          ...(disp?.checkedHeadCommit ? { checkedHeadCommit: disp.checkedHeadCommit } : {}),
           // ⭐ `A1` — 판정 3종을 «끝까지» 옮긴다. 여기서 빠지면 트리아지가 눈을 잃는다.
           ...(disp?.mergeReason ? { mergeReason: disp.mergeReason } : {}),
-          ...(disp?.stopReason ? { stopReason: disp.stopReason } : {}),
+          ...(!cancelling && disp?.stopReason ? { stopReason: disp.stopReason } : {}),
           ...(disp?.completionDisposition ? { completionDisposition: disp.completionDisposition } : {}),
           ...(disp?.failureClassification ? { failureClassification: disp.failureClassification } : {}),
           ...(disp?.providerErrors ? { providerErrors: disp.providerErrors } : {}),
@@ -1262,7 +1483,7 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
       const out = buildResults();
       // S3 — teardown (opt-in): remove each job's worktree (fail-soft),
       // preserving any job that opened a PR (branch/worktree still needed).
-      if (opts.teardown === true) {
+      if (opts.teardown === true && !cancelling) {
         const rm = opts.removeWorktree ?? defaultRemoveWorktree;
         let removed = 0;
         for (const r of out) {
@@ -1274,7 +1495,7 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
       const summary = summarizeResults(out);
       const failureKinds = summarizeFailureKinds(out);
       // ⛔⭐ 「검증 안 함」이 «산출에 보여야» 한다 — 안 그러면 「결함 0」으로 읽힌다(리뷰 #10393).
-      const observedDeliverables = opts.deliverableTargets
+      const observedDeliverables = !cancelling && opts.deliverableTargets
         ? await observeDeliverables(opts.deliverableTargets, opts.verifyDeliverable ? { verify: opts.verifyDeliverable } : {})
         : undefined;
       const deployFindings = observedDeliverables?.deployFindings ?? opts.deployFindings;
@@ -1305,7 +1526,9 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
         unconverged: failureKinds.unconverged,
         unclassified: failureKinds.unclassified,
         mainSyncBlocked: failureKinds.mainSyncBlocked,
+        parentUnlanded: out.filter((r) => r.blockReason === 'parent-unlanded').length,
         failures,
+        blockedParents: out.filter((r) => r.blockReason === 'parent-unlanded').map((r) => ({ taskId: r.taskId, blockReason: r.blockReason, parentPrNumber: r.parentPrNumber ?? null, ...(r.parentNoPr ? { parentNoPr: true } : {}) })),
         ...(unionDiff ? { unionDiff } : {}),
       });
       const outcomes: SelfDevTerminalOutcome[] = out.map((result) => ({
@@ -1314,6 +1537,7 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
         stage: result.stage ?? null,
         merged: result.merged ?? null,
         prUrl: result.prUrl ?? null,
+        ...(result.blockReason ? { blockReason: result.blockReason, parentPrNumber: result.parentPrNumber ?? null, ...(result.parentNoPr ? { parentNoPr: true } : {}) } : {}),
       }));
       debug.log('self-dev.orchestrate', 'done', {
         total: out.length,
@@ -1327,11 +1551,13 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
         outcomes,
       });
       doCheckpoint();
+      cleanup();
+      if (interrupted && signals === process) process.exit(interrupted === 'SIGINT' ? 130 : 143);
       resolve(out);
     };
 
     const finishOrReject = (): void => {
-      void finish().catch(reject);
+      void finish().catch((error) => { cleanup(); reject(error); });
     };
 
     const openCount = (): number => {
@@ -1339,13 +1565,60 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
       return (OPEN_TASK_STATUSES as readonly TaskStatus[]).reduce((n, s) => n + c[s], 0);
     };
 
+    // Guard the TOX ready set (including dependencies carried from a prior checkpoint)
+    // before tick can turn ready into running. The parent's completion, not the child's
+    // merge/PR settings, determines whether a landing check is required.
+    const guardUnlandedParents = (): void => {
+      for (const { task, goal } of created) {
+        const current = graph.getTask(task.id);
+        if (!current || (current.status !== 'ready' && current.status !== 'blocked')) continue;
+        const parentGoals = dependencyGoals(goal);
+        if (!parentGoals.length) continue;
+        const missing = parentGoals.flatMap((parent) => {
+          const parentId = taskIdByGoal.get(parent);
+          if (!parentId) return [];
+          const prior = resumedByTaskId.get(parentId);
+          const live = results.get(parentId);
+          const disp = doneBySpace.get(spaceIdByTask.get(parentId) ?? '')?.disposition;
+          const result = prior ?? (live && { ...live, stage: disp?.stage, merged: disp?.merged, prUrl: disp?.prUrl, prNumber: disp?.prNumber, checkedHeadCommit: disp?.checkedHeadCommit });
+          if (!result || result.status !== 'done') return [];
+          // Default auto-merge scheduling and legacy no-disposition results stay unchanged.
+          // A PR completion or explicitly unlanded parent must be checked, regardless of the child's settings.
+          if (result.stage !== 'pr-opened' && result.stage !== 'worktree-completed'
+            && result.merged !== false && !(parent.openPr === true && parent.autoMerge === false)) return [];
+          return dependencyOnMain(result, landingProbe) ? [] : [result];
+        })[0];
+        if (!missing) continue;
+        // TOX permits ready → backlog → blocked, but not ready → blocked directly.
+        if (current.status === 'ready') graph.updateTask(task.id, { status: 'backlog' }, { now: now() });
+        if (graph.getTask(task.id)?.status === 'backlog') graph.updateTask(task.id, { status: 'blocked' }, { now: now() });
+        const parentNoPr = missing.stage === 'worktree-completed' && missing.prNumber === undefined && !missing.prUrl;
+        const blocked: SelfDevJobResult = {
+          taskId: task.id, feature: goal.feature, status: 'blocked', blockReason: 'parent-unlanded',
+          ...(missing.prNumber === undefined ? {} : { parentPrNumber: missing.prNumber }),
+          ...(parentNoPr ? { parentNoPr: true } : {}),
+        };
+        results.set(task.id, blocked);
+        if (blockedByParent.has(task.id)) continue;
+        blockedByParent.add(task.id);
+        const line = parentUnlandedProgressLine(goal.feature.split('\n')[0]!, missing.prNumber, parentNoPr);
+        console.error(line);
+        debug.log('self-dev.orchestrate', 'parent-unlanded', { taskId: task.id, blockReason: 'parent-unlanded', parentPrNumber: missing.prNumber ?? null, ...(parentNoPr ? { parentNoPr: true } : {}), progress: line });
+        const reason = parentNoPr ? '앞 조각 커밋이 main 에 없다'
+          : missing.prNumber === undefined ? '앞 조각 PR 번호를 알 수 없고 main 착지가 확인되지 않았다'
+            : `앞 조각 PR #${missing.prNumber} 이 main 에 없다`;
+        (opts.emitDispatchDecision ?? emitDecision)({ kind: 'ESCALATE', what: `조각 ${goal.feature.split('\n')[0]} 대기`, reason, purpose: '없는 토대 위에 짓지 않는다', target: '사람(부모 승인·병합)', phase: 'dispatch', ...(missing.prNumber === undefined ? {} : { refs: { pr: missing.prNumber } }), ...(runId ? { runId } : {}) });
+      }
+    };
+
     // Re-tick deferred past the current microtask so the dispatcher's
     // `monitor().finally` (which frees the concurrency slot) runs first —
     // else the re-tick sees a stale active count and defers on cap.
     const scheduleTick = (): void => {
       queueMicrotask(() => {
-        if (settled) return;
+        if (settled || cancelling) return;
         graph.promoteReady({ now: now() });
+        guardUnlandedParents();
         const { dispatched } = dispatcher.tick();
         doCheckpoint();   // S3 — persist progress each cycle (crash-resumable)
         if (openCount() === 0) { finishOrReject(); return; }
@@ -1378,6 +1651,7 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
 
     bus.subscribe((ev) => {
       try { opts.onEvent?.(ev); } catch { /* isolate */ }
+      if (cancelling) return;
       switch (ev.kind) {
         case 'task-started':
           debug.log('self-dev.orchestrate', 'job.start', {
@@ -1504,8 +1778,11 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
     });
 
     // Kickoff.
-    graph.promoteReady({ now: now() });
-    dispatcher.tick();
-    if (openCount() === 0) finishOrReject();
+    if (!cancelling) graph.promoteReady({ now: now() });
+    if (!cancelling) guardUnlandedParents();
+    if (!cancelling) {
+      const { dispatched } = dispatcher.tick();
+      if (openCount() === 0 || (blockedByParent.size > 0 && dispatched.length === 0 && graph.listRunning().length === 0)) finishOrReject();
+    }
   });
 }

package/src/self-dev/repair-signals.ts

@@ -32,6 +32,7 @@ type AbandonedClassification =
   | 'report-deficit'
   | 'goal-unconvergeable-candidate'
   | 'contract-conflict'
+  | 'run-deadline-exceeded'
   | 'quota-exhausted'
   | 'provider-error'
   | 'credential-failure'
@@ -45,6 +46,7 @@ const ABANDONED_CLASSIFICATIONS = new Set<AbandonedClassification>([
   'report-deficit',
   'goal-unconvergeable-candidate',
   'contract-conflict',
+  'run-deadline-exceeded',
   'quota-exhausted',
   'provider-error',
   'credential-failure',
@@ -80,6 +82,10 @@ export const CLASSIFICATION_HINTS: Record<AbandonedClassification, { system: str
     system: '계약 충돌 다발 — goal 계약·하니스 정책의 상충을 점검.',
     goal: '계약 충돌 단발 — 해당 goal의 상충하는 수용 기준을 정정.',
   },
+  'run-deadline-exceeded': {
+    system: '수명 상한 사망 다발 — 브랜치/PR 이 있으면 수확하고, 없으면 골을 재분해한다. 할당량 소진으로 읽지 않는다.',
+    goal: '수명 상한 사망 단발 — 산출이 있으면 수확하고, 없으면 그 골을 재분해한다.',
+  },
   'quota-exhausted': {
     system: '쿼터 소진 다발 — provider 회전·용량 정책을 점검.',
     goal: '쿼터 소진 단발 — 해당 goal은 환경 용량 회복 뒤 재개 판단.',

package/src/self-dev/run-store.ts

@@ -15,7 +15,9 @@
  *
  * Cf. PLAN-parallel-self-dev-orchestrator-2026-07-21 §5 (S3).
  */
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { debug } from '../debug/log.js';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { loadRunLedger, queryInterruptedRunLedgers, runLedgerDir, type RunLedgerEntry } from '../self-implement/run-ledger.js';
 import { join, resolve, sep } from 'node:path';
@@ -109,14 +111,27 @@ function runPath(runId: string, dir: string): string {
 }
 
 function loadSelfDevRunFromPath(path: string): SelfDevRunState | null {
+  const runId = path.slice(path.lastIndexOf(sep) + 1, -'.json'.length);
   try {
-    const o = JSON.parse(readFileSync(path, 'utf-8')) as SelfDevRunState;
-    return typeof o.runId === 'string' && Array.isArray(o.results) ? o : null;
-  } catch { return null; }
+    const o = JSON.parse(readFileSync(path, 'utf-8')) as SelfDevRunState | null;
+    if (o && typeof o.runId === 'string' && Array.isArray(o.results)) return o;
+    try { debug.log('self-dev.run-store', 'read-failed', { runId, reason: 'invalid checkpoint shape' }); } catch { /* preserve fail-soft reads */ }
+  } catch (error) {
+    try { debug.log('self-dev.run-store', 'read-failed', { runId, reason: String(error) }); } catch { /* preserve fail-soft reads */ }
+  }
+  return null;
 }
 
 function writeSelfDevRun(state: SelfDevRunState, dir: string): void {
-  writeFileSync(runPath(state.runId, dir), JSON.stringify(state, null, 2), 'utf-8');
+  const path = runPath(state.runId, dir);
+  const tempPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(tempPath, JSON.stringify(state, null, 2), 'utf-8');
+    renameSync(tempPath, path);
+  } catch (error) {
+    try { unlinkSync(tempPath); } catch { /* write may have failed before creating it */ }
+    throw error;
+  }
 }
 
 function mergeParticipants(