elanous 0.2.29 → 0.2.32

package/src/self-dev/draft-residue.ts

@@ -9,7 +9,7 @@ import { appendRunLedgerEntry, listRunLedgers, loadRunLedger, runLedgerDir, type
 import { queryRunningRuns } from '../self-implement/running-runs.js';
 import { clipRegateDetail, regateFailureFacts, type HostRegateFailure } from '../self-implement/regate-detail.js';
 import { DRAFT_SWEEP_CLOSE_CAP } from './draft-sweep.js';
-import { PROTECTED_LABELS, sameVerifiedGoal, type DraftTriagePr } from './draft-triage-rules.js';
+import { PROTECTED_LABELS, type DraftTriagePr } from './draft-triage-rules.js';
 
 export type PodTerminalClass = 'landed' | 'merge-ready-not-merged' | 'failed-with-pr' | 'failed-no-pr' | 'failed-pr-unobserved' | 'timed-out-harvestable';
 export interface PrTerminalRecord {
@@ -43,7 +43,26 @@ export interface PodTerminalInput {
   at?: string;
 }
 
-const cardOf = (text?: string): string | null => /^칸:\s*(\S.*?)\s*$/m.exec(text ?? '')?.[1]?.trim() || null;
+function cardOf(text?: string): string | null {
+  const lines = (text ?? '').split(/\r?\n/).filter((line) => line.startsWith('칸:'));
+  if (lines.length !== 1) return null;
+  const slot = lines[0]!.slice('칸:'.length).trim();
+  // A blank marker cannot borrow an ID from the following line. Duplicate markers are
+  // ambiguous even when they happen to name the same card.
+  return slot && !/\s/.test(slot) ? slot : null;
+}
+const validCardSlot = (text: string | null): text is string => !!text && /^[A-Z][A-Z0-9]*(?:-[A-Z0-9]+)+$/.test(text);
+const goalLineage = (pr: ResiduePr): string | undefined =>
+  /(?:^|[-/])goalid-([a-f0-9]+)(?=-|\/|$)/i.exec(pr.branch)?.[1]?.toLowerCase()
+  ?? /^골(?: ID)?:\s*(\S.*?)\s*$/m.exec(pr.body ?? '')?.[1];
+const hasCodeDiff = (paths: readonly string[]): boolean => paths.some((path) =>
+  !path.startsWith('docs/') && (
+    /\.(?:[cm]?[jt]sx?|py|sh|bash|zsh|rs|go|c|cc|cpp|h|hpp|java|kt|swift|rb|php|lua|sql)$/.test(path)
+    || /(?:^|\/)(?:Dockerfile|Containerfile|Makefile)(?:\.[^/]*)?$/.test(path)
+    || (path.startsWith('graphs/') && /\.ya?ml$/.test(path))));
+function sameCardSlot(previous: ResiduePr, current: ResiduePr, slot: string): boolean {
+  return cardOf(previous.body) === slot && cardOf(current.body) === slot;
+}
 const harvestable = PR_LABELS.find((label) => label.name === 'elanous:harvestable')!.name;
 const superseded = PR_LABELS.find((label) => label.name === 'elanous:superseded')!.name;
 
@@ -83,6 +102,8 @@ export function classifyPodTerminal(input: PodTerminalInput): PrTerminalRecord {
 export interface ResiduePr extends DraftTriagePr {
   createdAt: string;
   labels: readonly string[];
+  headSha?: string;
+  isDraft?: boolean;
   body?: string;
   comments?: readonly string[];
   /** GitHub PR state at lookup time (review r8) — absent only from injected inventories. */
@@ -92,7 +113,12 @@ export interface DraftResidueAdapters {
   loadLedger(runId: string, ledgerDir: string): readonly RunLedgerEntry[] | null;
   appendLedger(entry: RunLedgerEntry, ledgerDir: string): void;
   getPr(number: number): Promise<ResiduePr | undefined> | ResiduePr | undefined;
+  /** Return all issue comments only after pagination completes; undefined means completeness is unknown. */
+  getAllComments?(repository: string, number: number): Promise<readonly string[] | undefined> | readonly string[] | undefined;
+  /** Undefined means the open-draft inventory could not be observed («못 셌음») — never a disguised zero count. */
   listOpenDrafts(repository: string): Promise<readonly ResiduePr[] | undefined> | readonly ResiduePr[] | undefined;
+  /** Complete changed-path inventory for the newly opened PR; undefined is unmeasured. */
+  listPrChangedPaths?(repository: string, number: number): Promise<readonly string[] | undefined> | readonly string[] | undefined;
   addLabel(repository: string, number: number, label: string): Promise<void> | void;
   setLabels(repository: string, number: number, change: { add: string; remove: readonly string[] }): Promise<void> | void;
   comment(repository: string, number: number, body: string): Promise<void> | void;
@@ -112,14 +138,21 @@ export interface DraftResidueContext {
 }
 export type DraftResidueResult = { status: 'recorded' | 'skipped' | 'failed'; reason?: string; step?: string };
 
+/** A REST pulls page carries up to 100 full PR bodies; the spawn default buffer (1 MiB) overflowed daily as
+ *  `spawnSync gh ENOBUFS`, so every gh call gets an explicit ceiling that fits a full page of large-bodied drafts. */
+const GH_MAX_BUFFER = 64 * 1024 * 1024;
+/** Only the fields the residue consumes. The raw REST page (base/head repo objects, _links, review metadata, …) is
+ *  several times larger than this projection, so the listing asks gh to project each page down to these fields. */
+const OPEN_DRAFT_FIELDS = '[.[] | {number, title, headRefName: .head.ref, createdAt: .created_at, body, labels: [.labels[] | {name}], draft}]';
+
 function gh(args: string[]): string {
-  const result = spawnSync('gh', args, { cwd: findGitDir(process.cwd())?.root ?? process.cwd(), encoding: 'utf8', timeout: 60_000 });
+  const result = spawnSync('gh', args, { cwd: findGitDir(process.cwd())?.root ?? process.cwd(), encoding: 'utf8', timeout: 60_000, maxBuffer: GH_MAX_BUFFER });
   if (result.status !== 0) throw new Error((result.stderr || result.error?.message || `gh exited ${result.status}`).trim().slice(0, 200));
   return result.stdout.trim();
 }
-function ghPr(row: { number: number; title: string; headRefName: string; createdAt: string; body: string; labels: Array<{ name: string }>; comments?: Array<{ body: string }>; state?: string }): ResiduePr {
+function ghPr(row: { number: number; title: string; headRefName: string; headRefOid?: string; isDraft?: boolean; createdAt: string; body: string; labels: Array<{ name: string }>; comments?: Array<{ body: string }>; state?: string }): ResiduePr {
   const state = row.state === 'OPEN' || row.state === 'CLOSED' || row.state === 'MERGED' ? row.state : undefined;
-  return { number: row.number, title: row.title, branch: row.headRefName, createdAt: row.createdAt, body: row.body,
+  return { number: row.number, title: row.title, branch: row.headRefName, headSha: row.headRefOid, isDraft: row.isDraft, createdAt: row.createdAt, body: row.body,
     labels: row.labels.map((label) => label.name), comments: row.comments?.map((comment) => comment.body), ...(state ? { state } : {}) };
 }
 /** Where the default `getRunStatus` reads run facts. Production reads the federated host ledgers and the running-runs
@@ -166,25 +199,54 @@ export function residueRunStatus(draft: Pick<ResiduePr, 'number'>, repository: s
 }
 
 export function defaultAdapters(sources: ResidueRunStatusSources = defaultRunStatusSources): DraftResidueAdapters {
-  const fields = 'number,title,headRefName,createdAt,body,labels,comments,state';
+  const fields = 'number,title,headRefName,headRefOid,isDraft,createdAt,body,labels,comments,state';
   return {
     loadLedger: loadRunLedger,
     appendLedger: appendRunLedgerEntry,
     getPr: (number) => ghPr(JSON.parse(gh(['pr', 'view', String(number), '-R', hostRepository() ?? '', '--json', fields]))),
+    getAllComments: (repository, number) => {
+      try {
+        const pages: unknown = JSON.parse(gh(['api', `repos/${repository}/issues/${number}/comments?per_page=100`, '--paginate', '--slurp']));
+        if (!Array.isArray(pages) || !pages.every((page) => Array.isArray(page)
+          && page.every((row: unknown) => !!row && typeof row === 'object' && typeof (row as { body?: unknown }).body === 'string'))) return undefined;
+        return (pages as Array<Array<{ body: string }>>).flat().map((row) => row.body);
+      } catch (error) {
+        debug.log('draft.residue', 'comments-unobserved', { repository, number, reason: error instanceof Error ? error.message : String(error) });
+        return undefined;
+      }
+    },
     listOpenDrafts: (repository) => {
       const rows: ResiduePr[] = [];
-      for (let page = 1; page <= 100; page++) {
-        const result = JSON.parse(gh(['api', `repos/${repository}/pulls?state=open&per_page=100&page=${page}`])) as Array<{
-          number: number; title: string; head: { ref: string }; created_at: string; body: string; draft: boolean; labels: Array<{ name: string }>;
-        }>;
-        if (!Array.isArray(result)) throw new Error('Invalid open PR inventory');
-        rows.push(...result.filter((pr) => pr.draft).map((pr) => ghPr({ number: pr.number, title: pr.title, headRefName: pr.head.ref, createdAt: pr.created_at, body: pr.body, labels: pr.labels })));
-        if (result.length < 100) return rows;
+      try {
+        for (let page = 1; page <= 100; page++) {
+          const result = JSON.parse(gh(['api', `repos/${repository}/pulls?state=open&per_page=100&page=${page}`, '--jq', OPEN_DRAFT_FIELDS])) as Array<{
+            number: number; title: string; headRefName: string; createdAt: string; body: string;
+            labels: Array<{ name: string }>; draft: boolean;
+          }>;
+          if (!Array.isArray(result)) throw new Error('Invalid open PR inventory');
+          rows.push(...result.filter((pr) => pr.draft).map((pr) => ghPr({ number: pr.number, title: pr.title, headRefName: pr.headRefName, createdAt: pr.createdAt, body: pr.body, labels: pr.labels })));
+          if (result.length < 100) return rows;
+        }
+        throw new Error('Open PR inventory exceeded pagination limit');
+      } catch (error) {
+        // «못 셌음»: a failed (or truncated) listing is unmeasurable — it must never surface as a counted zero.
+        debug.log('draft.residue', 'list-open-drafts-unobserved', { repository, reason: error instanceof Error ? error.message : String(error) });
+        return undefined;
       }
-      throw new Error('Open PR inventory exceeded pagination limit');
+    },
+    listPrChangedPaths: (repository, number) => {
+      try {
+        const pages: unknown = JSON.parse(gh(['api', `repos/${repository}/pulls/${number}/files?per_page=100`, '--paginate', '--slurp']));
+        if (!Array.isArray(pages) || !pages.every((page) => Array.isArray(page)
+          && page.every((row: unknown) => !!row && typeof row === 'object' && typeof (row as { filename?: unknown }).filename === 'string'))) return undefined;
+        return (pages as Array<Array<{ filename: string }>>).flat().map((row) => row.filename);
+      } catch { return undefined; }
     },
     addLabel: (repository, number, label) => { gh(['pr', 'edit', String(number), '-R', repository, '--add-label', label]); },
-    setLabels: (repository, number, change) => { gh(['pr', 'edit', String(number), '-R', repository, '--add-label', change.add, ...change.remove.flatMap((label) => ['--remove-label', label])]); },
+    setLabels: (repository, number, change) => {
+      const flags = [...(change.add ? ['--add-label', change.add] : []), ...change.remove.flatMap((label) => ['--remove-label', label])];
+      if (flags.length) gh(['pr', 'edit', String(number), '-R', repository, ...flags]);
+    },
     comment: (repository, number, body) => { gh(['pr', 'comment', String(number), '-R', repository, '--body', body]); },
     closePr: (repository, number) => { gh(['pr', 'close', String(number), '-R', repository]); },
     listLiveBranches: (repository) => {
@@ -319,7 +381,7 @@ export async function replayPodTerminals(options: DraftResidueReplayOptions = {}
       const outcome = await applyPodTerminal(record, { ledgerDir, ledgerRunId, adapters: replayAdapters, closeBudget });
       if (outcome.status === 'recorded' || outcome.reason === 'already-recorded') recovered++;
       else if (outcome.status === 'skipped' && outcome.reason === 'repository-unobserved') unresolved++;
-      else if (outcome.status === 'skipped' && !['previous-run-unverified', 'previous-run-live', 'close-cap', 'host-repository-unobserved'].includes(outcome.reason ?? '')) recovered++;
+      else if (outcome.status === 'skipped' && !['previous-run-unverified', 'previous-run-live', 'close-cap', 'host-repository-unobserved', 'restore-unverified'].includes(outcome.reason ?? '')) recovered++;
       else pending++;
     }
   }
@@ -333,6 +395,7 @@ export async function applyPodTerminal(record: PrTerminalRecord, ctx: DraftResid
   const skipped = (reason: string): DraftResidueResult => { log('skipped', { reason }); return { status: 'skipped', reason }; };
   const budget: DraftCloseBudget = ctx.closeBudget ?? { remaining: DRAFT_SWEEP_CLOSE_CAP };
   let step = 'ledger';
+  let pendingSupersession: { repository: string; number: number; prNumber: number; commentMayExist: boolean } | null = null;
   try {
     const ledger = adapters.loadLedger(ctx.ledgerRunId, ctx.ledgerDir);
     if (ledger === undefined) throw new Error('Terminal ledger unavailable');
@@ -407,6 +470,28 @@ export async function applyPodTerminal(record: PrTerminalRecord, ctx: DraftResid
         step = 'ledger';
         acknowledge('owner-comment', pr.number);
       }
+      // PR1a records a recovery pointer but never closes this failed draft. PR1b owns the close decision.
+      if (record.terminalClass === 'failed-with-pr' && !completed('restore-comment', pr.number)) {
+        step = 'get-pr';
+        let latest: ResiduePr | undefined;
+        try { latest = await adapters.getPr(pr.number); }
+        catch { return skipped('restore-unverified'); }
+        if (!latest || latest.state !== 'OPEN' || latest.isDraft !== true || !record.headSha
+          || latest.headSha?.toLowerCase() !== record.headSha.toLowerCase()
+          || !latest.branch?.trim() || latest.branch !== pr.branch || (record.branch && latest.branch !== record.branch)
+          || !Array.isArray(latest.labels) || latest.labels.some((label) => PROTECTED_LABELS.has(label))) {
+          return skipped('restore-unverified');
+        }
+        step = 'list-comments';
+        let comments: readonly string[] | undefined;
+        try { comments = await adapters.getAllComments?.(record.repository, pr.number); }
+        catch { return skipped('restore-unverified'); }
+        if (!Array.isArray(comments) || comments.some((comment) => typeof comment !== 'string'
+          || /landing-verified\s*:|land-enqueue\s*:/i.test(comment))) return skipped('restore-unverified');
+        const restore = `Draft residue: failed-run recovery · run=${record.childRunId} · head=${record.headSha} · branch=${latest.branch} preserved. Restore from this branch.`;
+        if (!comments.includes(restore)) { step = 'comment'; await adapters.comment(record.repository, pr.number, restore); }
+        step = 'ledger'; acknowledge('restore-comment', pr.number);
+      }
     } else skipped('landed');
     step = 'list-open-drafts';
     const drafts = await adapters.listOpenDrafts(record.repository);
@@ -415,12 +500,33 @@ export async function applyPodTerminal(record: PrTerminalRecord, ctx: DraftResid
       throw new Error('Open draft lookup unavailable or incomplete');
     }
     const newerAt = Date.parse(pr.createdAt);
-    const candidates = drafts.filter((draft: ResiduePr) => draft.number !== pr.number && draft.branch.startsWith('self-impl/')
+    const slot = cardOf(pr.body);
+    const taSlot = validCardSlot(slot) ? slot : undefined;
+    const earlier: ResiduePr[] = drafts.filter((draft: ResiduePr) => draft.number !== pr.number && draft.branch.startsWith('self-impl/')
       && Date.parse(draft.createdAt) < newerAt && !draft.labels.some((label: string) => PROTECTED_LABELS.has(label))
-      && !completed('superseded-close', draft.number)
-      && (!draft.labels.includes(superseded) || completed('supersede-intent', draft.number))
-      // Only a verified goal identifier may close a PR — a shared «칸:» value or seat is not the same goal.
-      && sameVerifiedGoal(draft, pr));
+      && !completed('superseded-close', draft.number));
+    const sameSlot = taSlot ? earlier.filter((draft) => /^[a-f0-9]{40}$/i.test(draft.headSha ?? '') && sameCardSlot(draft, pr, taSlot)
+      && !draft.labels.some((label) => label === 'elanous:running' || label.includes('harvest-claimed'))) : [];
+    let codeDiff = false;
+    if (taSlot && sameSlot.length) {
+      // A changed PR head can turn a measured code PR into a goal-only PR while files are being fetched.
+      step = 'get-pr';
+      const beforeFiles = await adapters.getPr(pr.number);
+      if (!beforeFiles || beforeFiles.number !== pr.number || beforeFiles.state !== pr.state
+        || !pr.headSha || beforeFiles.headSha !== pr.headSha || beforeFiles.branch !== pr.branch
+        || !sameCardSlot(beforeFiles, pr, taSlot)) return skipped('new-pr-changed-before-files');
+      step = 'list-pr-changed-paths';
+      const paths = await adapters.listPrChangedPaths?.(record.repository, pr.number);
+      if (!paths || !Array.isArray(paths) || paths.some((path) => typeof path !== 'string')) return skipped('new-pr-code-diff-unobserved');
+      step = 'get-pr';
+      const afterFiles = await adapters.getPr(pr.number);
+      if (!afterFiles || afterFiles.number !== pr.number || afterFiles.state !== pr.state
+        || afterFiles.headSha !== pr.headSha || afterFiles.branch !== pr.branch
+        || !sameCardSlot(afterFiles, pr, taSlot)) return skipped('new-pr-changed-after-files');
+      codeDiff = hasCodeDiff(paths);
+      if (!codeDiff) log('skipped', { reason: 'new-pr-goal-only', prNumber: pr.number });
+    }
+    const candidates = codeDiff ? sameSlot : [];
     let liveBranches: ReadonlySet<string> | undefined;
     if (candidates.length) {
       step = 'list-live-branches';
@@ -431,6 +537,16 @@ export async function applyPodTerminal(record: PrTerminalRecord, ctx: DraftResid
     let capped = false;
     for (const draft of candidates) {
       if (budget.remaining <= 0) { capped = true; break; }
+      if (taSlot) {
+        step = 'get-pr';
+        const latest = await adapters.getPr(draft.number);
+        if (!latest || latest.number !== draft.number || latest.state !== 'OPEN' || latest.isDraft !== true
+          || !draft.headSha
+          || latest.branch !== draft.branch || latest.headSha !== draft.headSha
+          || !Array.isArray(latest.labels) || latest.labels.some((label) => PROTECTED_LABELS.has(label)
+            || label === 'elanous:running' || label.includes('harvest-claimed'))
+          || !sameCardSlot(latest, pr, taSlot)) { deferred = true; skipped('previous-pr-changed'); continue; }
+      }
       step = 'get-run-status';
       const status = await adapters.getRunStatus(draft, record.repository);
       if (liveBranches!.has(draft.branch) || !['completed', 'failed', 'cancelled', 'abandoned', 'self-implement.result final'].includes(status ?? '')) {
@@ -438,38 +554,145 @@ export async function applyPodTerminal(record: PrTerminalRecord, ctx: DraftResid
         skipped(`previous-run-${status === 'running' || status === 'probable-running' || liveBranches!.has(draft.branch) ? 'live' : 'unobserved'}`);
         continue;
       }
+      if (taSlot) {
+        step = 'list-live-branches';
+        const liveNow = await adapters.listLiveBranches(record.repository);
+        step = 'get-run-status';
+        const statusNow = await adapters.getRunStatus(draft, record.repository);
+        if (!liveNow || liveNow.has(draft.branch)
+          || !['completed', 'failed', 'cancelled', 'abandoned', 'self-implement.result final'].includes(statusNow ?? '')) {
+          deferred = true; skipped('previous-run-changed-before-label'); continue;
+        }
+      }
+      // Revalidate the effective diff and both PRs before applying any public supersession marker.
+      if (taSlot) {
+        const newBeforeClose = await adapters.getPr(pr.number);
+        if (!newBeforeClose || newBeforeClose.number !== pr.number || newBeforeClose.state !== pr.state
+          || newBeforeClose.headSha !== pr.headSha || newBeforeClose.branch !== pr.branch
+          || !sameCardSlot(newBeforeClose, pr, taSlot)) { deferred = true; skipped('new-pr-changed-before-close'); continue; }
+        // The base can move without changing this PR's head. Re-read the effective diff before closing the old draft.
+        step = 'list-pr-changed-paths';
+        const currentPaths = await adapters.listPrChangedPaths?.(record.repository, pr.number);
+        if (!currentPaths || !Array.isArray(currentPaths) || currentPaths.some((path) => typeof path !== 'string')
+          || !hasCodeDiff(currentPaths)) { deferred = true; skipped('new-pr-code-diff-changed-before-close'); continue; }
+        step = 'get-pr';
+        const afterCloseDiff = await adapters.getPr(pr.number);
+        if (!afterCloseDiff || afterCloseDiff.number !== pr.number || afterCloseDiff.state !== pr.state
+          || afterCloseDiff.headSha !== pr.headSha || afterCloseDiff.branch !== pr.branch
+          || !sameCardSlot(afterCloseDiff, pr, taSlot)) { deferred = true; skipped('new-pr-changed-after-close-diff'); continue; }
+        const beforeClose = await adapters.getPr(draft.number);
+        if (!beforeClose || beforeClose.number !== draft.number || beforeClose.state !== 'OPEN' || beforeClose.isDraft !== true
+          || !draft.headSha
+          || beforeClose.branch !== draft.branch || beforeClose.headSha !== draft.headSha
+          || !Array.isArray(beforeClose.labels) || beforeClose.labels.some((label) => PROTECTED_LABELS.has(label)
+            || label === 'elanous:running' || label.includes('harvest-claimed'))
+          || !sameCardSlot(beforeClose, pr, taSlot)) { deferred = true; skipped('previous-pr-changed-before-close'); continue; }
+        step = 'list-live-branches';
+        const liveBeforeClose = await adapters.listLiveBranches(record.repository);
+        step = 'get-run-status';
+        const statusBeforeClose = await adapters.getRunStatus(draft, record.repository);
+        if (!liveBeforeClose || liveBeforeClose.has(draft.branch)
+          || !['completed', 'failed', 'cancelled', 'abandoned', 'self-implement.result final'].includes(statusBeforeClose ?? '')) {
+          deferred = true; skipped('previous-run-changed-before-close'); continue;
+        }
+      }
       if (!completed('supersede-intent', draft.number)) {
         step = 'ledger';
         acknowledge('supersede-intent', draft.number);
       }
-      if (!completed('superseded-label', draft.number)) {
-        if (!draft.labels.includes(superseded)) {
-          step = 'set-labels';
-          await adapters.setLabels(record.repository, draft.number, { add: superseded,
-            remove: PR_LABELS.filter((label) => label.axis === 'state' && draft.labels.includes(label.name) && label.name !== superseded).map((label) => label.name) });
-        }
-        step = 'ledger';
-        acknowledge('superseded-label', draft.number);
+      // The inventory was read before the liveness and diff checks. Labels can change while
+      // those checks run, so ownership and the state to restore come from a fresh PR read.
+      step = 'get-pr';
+      const beforeLabel = await adapters.getPr(draft.number);
+      if (!beforeLabel || beforeLabel.number !== draft.number || beforeLabel.state !== 'OPEN'
+        || beforeLabel.isDraft !== true || beforeLabel.branch !== draft.branch
+        || beforeLabel.headSha !== draft.headSha || !Array.isArray(beforeLabel.labels)
+        || beforeLabel.labels.some((label) => PROTECTED_LABELS.has(label)
+          || label === 'elanous:running' || label.includes('harvest-claimed'))
+        || (taSlot && !sameCardSlot(beforeLabel, pr, taSlot))) {
+        deferred = true; skipped('previous-pr-changed-before-label-write'); continue;
       }
-      const body = `Draft residue: superseded-by #${pr.number} (newer run ${record.childRunId} of the same goal). Branch preserved.`;
+      // There is no conditional GitHub add-label operation. A label written before close
+      // cannot be safely removed on a race: another run may have added that same label
+      // between our read and write. Apply the public state marker only after close succeeds.
+      pendingSupersession = { repository: record.repository, number: draft.number, prNumber: pr.number,
+        commentMayExist: false };
+      const body = taSlot
+        ? `Draft residue: superseded-by #${pr.number} (same card ${taSlot}; old goalid=${goalLineage(draft) ?? 'unobserved'}; new goalid=${goalLineage(pr) ?? 'unobserved'}; newer run ${record.childRunId}). Branch preserved.`
+        : `Draft residue: superseded-by #${pr.number} (newer run ${record.childRunId} of the same goal). Branch preserved.`;
+      pendingSupersession.commentMayExist = completed('supersede-comment', draft.number);
       if (!completed('supersede-comment', draft.number)) {
-        // REST draft listings do not contain comments; fetch them on a retry after the label was applied.
+        // REST draft listings do not contain comments; fetch them before deciding whether to comment.
         let comments = draft.comments;
-        if (comments === undefined && completed('superseded-label', draft.number)) {
+        if (comments === undefined) {
           step = 'get-pr';
           const prior = await adapters.getPr(draft.number);
           if (!prior || prior.number !== draft.number) throw new Error('Previous PR lookup unavailable');
           comments = prior.comments;
         }
-        if (!comments?.includes(body)) { step = 'comment'; await adapters.comment(record.repository, draft.number, body); }
+        if (!comments?.includes(body)) {
+          pendingSupersession.commentMayExist = true;
+          step = 'comment'; await adapters.comment(record.repository, draft.number, body);
+        }
         step = 'ledger';
         acknowledge('supersede-comment', draft.number);
       }
+      if (taSlot) {
+        // A claimant or new commit can arrive while GitHub accepts the label/comment writes.
+        step = 'list-pr-changed-paths';
+        const pathsAfterEffects = await adapters.listPrChangedPaths?.(record.repository, pr.number);
+        // The diff lookup can race a new head; bind its result to the head read after it.
+        step = 'get-pr';
+        const newAfterEffects = await adapters.getPr(pr.number);
+        step = 'list-live-branches';
+        const liveAfterEffects = await adapters.listLiveBranches(record.repository);
+        step = 'get-run-status';
+        const statusAfterEffects = await adapters.getRunStatus(draft, record.repository);
+        step = 'get-pr';
+        const oldAfterEffects = await adapters.getPr(draft.number);
+        if (!newAfterEffects || newAfterEffects.number !== pr.number || newAfterEffects.state !== pr.state
+          || newAfterEffects.headSha !== pr.headSha || newAfterEffects.branch !== pr.branch
+          || !sameCardSlot(newAfterEffects, pr, taSlot)
+          || !pathsAfterEffects || !Array.isArray(pathsAfterEffects)
+          || pathsAfterEffects.some((path) => typeof path !== 'string') || !hasCodeDiff(pathsAfterEffects)
+          || !oldAfterEffects || oldAfterEffects.number !== draft.number || oldAfterEffects.state !== 'OPEN'
+          || oldAfterEffects.isDraft !== true || oldAfterEffects.headSha !== draft.headSha
+          || oldAfterEffects.branch !== draft.branch || !Array.isArray(oldAfterEffects.labels)
+          || oldAfterEffects.labels.some((label) => PROTECTED_LABELS.has(label)
+            || label === 'elanous:running' || label.includes('harvest-claimed'))
+          || !sameCardSlot(oldAfterEffects, pr, taSlot)
+          || !liveAfterEffects || liveAfterEffects.has(draft.branch)
+          || !['completed', 'failed', 'cancelled', 'abandoned', 'self-implement.result final'].includes(statusAfterEffects ?? '')) {
+          const correction = `Draft residue: supersession by #${pr.number} deferred after PR or run changed; branch preserved. Prior superseded-by comment is no longer a close decision.`;
+          if (!oldAfterEffects?.comments?.includes(correction)) {
+            step = 'comment';
+            await adapters.comment(record.repository, draft.number, correction);
+          }
+          pendingSupersession = null;
+          deferred = true; skipped('supersession-changed-after-effects'); continue;
+        }
+      }
       step = 'close-pr';
       await adapters.closePr(record.repository, draft.number);
+      pendingSupersession = null;
       budget.remaining--;
       step = 'ledger';
       acknowledge('superseded-close', draft.number);
+      // The close is irreversible. Label failure is diagnostic, never a reason to retry
+      // supersession or to roll back a label whose writer cannot be identified.
+      if (!beforeLabel.labels.includes(superseded)) {
+        try {
+          step = 'set-labels';
+          // A state label read before close may have been written by another run
+          // before this call. Its writer is unknown, so only add our marker.
+          await adapters.setLabels(record.repository, draft.number, { add: superseded, remove: [] });
+          step = 'ledger';
+          if (!completed('superseded-label', draft.number)) acknowledge('superseded-label', draft.number);
+        } catch (labelError) {
+          log('superseded-label-unobserved', { previousPrNumber: draft.number,
+            reason: labelError instanceof Error ? labelError.message : String(labelError) });
+        }
+      }
       log('superseded-previous', { previousPrNumber: draft.number });
     }
     if (deferred) return skipped('previous-run-unverified');
@@ -479,6 +702,17 @@ export async function applyPodTerminal(record: PrTerminalRecord, ctx: DraftResid
     return { status: 'recorded' };
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
+    if (pendingSupersession) {
+      const pending = pendingSupersession;
+      try {
+        if (pending.commentMayExist) await adapters.comment(pending.repository, pending.number,
+          `Draft residue: supersession by #${pending.prNumber} deferred after an interrupted check; branch preserved. Prior superseded-by comment is no longer a close decision.`);
+        log('supersession-compensated', { previousPrNumber: pending.number, failedStep: step });
+      } catch (compensationError) {
+        log('supersession-compensation-failed', { previousPrNumber: pending.number,
+          reason: compensationError instanceof Error ? compensationError.message : String(compensationError) });
+      }
+    }
     log('failed', { step, reason });
     return { status: 'failed', step, reason };
   }

package/src/self-dev/draft-sweep.ts

@@ -154,6 +154,12 @@ export interface DraftMetrics {
   readonly inventory: number;
   readonly oldestAgeHours: number | null;
   readonly needsOwner: number;
+  /**
+   * Per-seat needsOwner counts (own keys, finite numbers only). Unattributed drafts
+   * stay in the global `needsOwner` total and are absent here. Optional so existing
+   * screen/ledger constructors stay valid; collectDraftMetrics always fills it.
+   */
+  readonly needsOwnerBySeat?: Readonly<Record<string, number>>;
   /** Open running claims whose last update cannot be read; neither owned nor needs-owner. */
   readonly claimUnobserved?: number;
   readonly converted48h: number;
@@ -164,6 +170,8 @@ export interface DraftMetrics {
 /** Default maximum unclaimed open harness drafts for one seat. */
 export const DRAFT_NEEDS_OWNER_SEAT_CAP = 15;
 
+const NEEDS_OWNER_SEATS = ['OP', 'TC', 'MK', 'UX'] as const;
+
 /** Compare one seat's observed needsOwner count; the caller supplies counts of open drafts by seat. */
 export function isSeatDraftNeedsOwnerOverCap(
   seat: string,
@@ -174,6 +182,50 @@ export function isSeatDraftNeedsOwnerOverCap(
   return typeof count === 'number' && Number.isFinite(count) && count > cap;
 }
 
+/** Hold that seat's new launches when its needsOwner drafts exceed the default cap of 15. */
+export function shouldHoldSeatNewLaunch(
+  seat: string,
+  needsOwnerBySeat: Readonly<Record<string, number>>,
+): boolean {
+  return isSeatDraftNeedsOwnerOverCap(seat, needsOwnerBySeat, DRAFT_NEEDS_OWNER_SEAT_CAP);
+}
+
+function draftNeedsOwner(draft: SweepDraft, owner: string | undefined, now: Date): boolean {
+  const state = draftClaimState(draft, now);
+  return state !== 'unobserved' && (state !== 'claimed' || !owner?.trim());
+}
+
+/** Seat for a needsOwner draft: active claim owner, else a unique `elanous:seat-<자리>` label. */
+function needsOwnerSeatOf(draft: SweepDraft, owner: string | undefined): string | undefined {
+  const claimed = owner?.trim();
+  if (claimed && (NEEDS_OWNER_SEATS as readonly string[]).includes(claimed)) return claimed;
+  const found = new Set<string>();
+  for (const name of draft.labels) {
+    const seat = /^elanous:seat-(OP|TC|MK|UX)$/.exec(name)?.[1];
+    if (seat) found.add(seat);
+  }
+  return found.size === 1 ? [...found][0] : undefined;
+}
+
+/** Own-key, finite-number per-seat counts of drafts that still need an owner. */
+export function aggregateNeedsOwnerBySeat(
+  drafts: readonly SweepDraft[],
+  owners: readonly (string | undefined)[],
+  now: Date,
+): Record<string, number> {
+  const needsOwnerBySeat: Record<string, number> = {};
+  for (let index = 0; index < drafts.length; index++) {
+    const draft = drafts[index]!;
+    if (!draftNeedsOwner(draft, owners[index], now)) continue;
+    const seat = needsOwnerSeatOf(draft, owners[index]);
+    if (typeof seat !== 'string' || !seat) continue;
+    const current = Object.hasOwn(needsOwnerBySeat, seat) ? needsOwnerBySeat[seat] : 0;
+    if (typeof current !== 'number' || !Number.isFinite(current)) continue;
+    needsOwnerBySeat[seat] = current + 1;
+  }
+  return needsOwnerBySeat;
+}
+
 export async function collectDraftMetrics(repository: string, adapters: Pick<DraftSweepAdapters, 'listDrafts' | 'listRecentClosed' | 'getActiveClaimOwner'>, now: Date): Promise<DraftMetrics> {
   const clock = now.getTime();
   if (!Number.isFinite(clock)) throw new Error('Invalid draft metric clock');
@@ -209,13 +261,16 @@ export async function collectDraftMetrics(repository: string, adapters: Pick<Dra
   const converted48h = cohort.filter((pr) => 'mergedAt' in pr && typeof pr.mergedAt === 'string'
     && Date.parse(pr.mergedAt) >= Date.parse(pr.createdAt!) && Date.parse(pr.mergedAt) <= clock
     && Date.parse(pr.mergedAt) - Date.parse(pr.createdAt!) <= 48 * 3_600_000).length;
+  const needsOwnerBySeat = aggregateNeedsOwnerBySeat(open, owners, now);
+  // This observation reports over-cap seats; the dispatchers enforce the hold before launch.
+  const heldSeats = Object.keys(needsOwnerBySeat).filter((seat) =>
+    isSeatDraftNeedsOwnerOverCap(seat, needsOwnerBySeat, DRAFT_NEEDS_OWNER_SEAT_CAP));
+  try { debug.log('self-dev.draft-metrics', 'seat-launch-hold', { heldSeats, needsOwnerBySeat }); } catch { /* fail-soft */ }
   return {
     inventory: open.length,
     oldestAgeHours: open.length ? Math.max(...open.map((pr) => Math.max(0, (clock - Date.parse(pr.createdAt)) / 3_600_000))) : null,
-    needsOwner: open.filter((draft, index) => {
-      const state = draftClaimState(draft, now);
-      return state !== 'unobserved' && (state !== 'claimed' || !owners[index]?.trim());
-    }).length,
+    needsOwner: open.filter((draft, index) => draftNeedsOwner(draft, owners[index], now)).length,
+    needsOwnerBySeat,
     claimUnobserved: open.filter((draft) => draftClaimState(draft, now) === 'unobserved').length,
     converted48h,
     cohort48h: cohort.length,

package/src/self-dev/external-call-zero.ts

@@ -0,0 +1,77 @@
+// ── 외부 호출 0 모드 가드 — LLM·검색·크롤 외부 호출을 «거부하고 남긴다» ─────────────
+//
+// «외부 호출 0 모드»(external-call-zero mode)가 켜져 있으면 LLM·검색·크롤 외부 호출
+// 시도는 전부 거부되고, 거부된 시도마다 감사 원장에 한 줄이 덧붙는다(타임스탬프 ·
+// 호출 범주 · 호출자 맥락). 원장은 append-only — 이력은 «덧붙일 수만» 있고,
+// 읽는 쪽이 고치거나 지울 수는 없다.
+//
+// 이 모듈은 순수 가드다. run-supervisor.ts 로의 배선(LLM/검색/크롤 시도를 이 가드로
+// 돌리는 시임)은 이 정의를 소비하는 별도 의존 조각의 몫이다 — 여기서 운영 경로를
+// 건드리지 않는 것은 의도된 경계다.
+
+export const EXTERNAL_CALL_CATEGORIES = ['llm', 'search', 'crawl'] as const;
+
+export type ExternalCallCategory = (typeof EXTERNAL_CALL_CATEGORIES)[number];
+
+/** 거부된 외부 호출 시도 한 건 — 감사 원장의 한 줄. */
+export interface ExternalCallAuditEntry {
+  /** 0부터 매 거부 시도마다 하나씩 — 같은 원장에서 재사용되지 않는다. */
+  readonly seq: number;
+  /** 시각(ISO 8601). */
+  readonly at: string;
+  /** 시도한 외부 표면(llm | search | crawl). */
+  readonly category: ExternalCallCategory;
+  /** 호출자 맥락 — 누가(어느 파일·함수·지점) 외부 호출을 청했나. */
+  readonly caller: string;
+}
+
+export interface ExternalCallZeroVerdict {
+  readonly denied: boolean;
+  /** 거부되어 원장에 덧붙은 줄 — 거부된 시도에만 있다. */
+  readonly entry?: ExternalCallAuditEntry;
+}
+
+export interface ExternalCallZeroOptions {
+  /** true = 외부 호출 0 모드. 기본 false — 평소 동작(호출 통과 · 기록 없음). */
+  readonly enabled?: boolean;
+  /** 시험용 시계 주입 — 운영은 벽시계를 쓴다. */
+  readonly now?: () => Date;
+}
+
+export class ExternalCallZeroGuard {
+  private readonly zeroMode: boolean;
+  private readonly clock: () => Date;
+  private readonly entries: ExternalCallAuditEntry[] = [];
+
+  constructor(options: ExternalCallZeroOptions = {}) {
+    this.zeroMode = options.enabled ?? false;
+    this.clock = options.now ?? (() => new Date());
+  }
+
+  /** 외부 호출 0 모드가 켜져 있는가. */
+  get enabled(): boolean {
+    return this.zeroMode;
+  }
+
+  /**
+   * 외부 호출 시도를 가드로 돌린다. 켜진 모드에서는 모든 llm/search/crawl 시도를
+   * 거부하고 시도마다 감사 원장에 한 줄을 덧붙인다. 꺼진 모드는 시도를 그대로
+   * 통과시키고 아무것도 기록하지 않는다.
+   */
+  attempt(category: ExternalCallCategory, caller: string): ExternalCallZeroVerdict {
+    if (!this.zeroMode) return { denied: false };
+    const entry: ExternalCallAuditEntry = Object.freeze({
+      seq: this.entries.length,
+      at: this.clock().toISOString(),
+      category,
+      caller,
+    });
+    this.entries.push(entry);
+    return { denied: true, entry };
+  }
+
+  /** Append-only 읽기 뷰 — 얼린 스냅숏. 읽는 쪽은 이력을 못 고친다. */
+  ledger(): readonly ExternalCallAuditEntry[] {
+    return Object.freeze([...this.entries]);
+  }
+}

package/src/self-dev/launch-preflight-text.ts

@@ -22,6 +22,12 @@ export interface LaunchPreflightBlocker {
   readonly name: string;
   /** 왜 막혔는지 한 줄 — 경로와 수를 포함한다. */
   readonly detail: string;
+  /** 골 판독 실패(`goal-unreadable`)와 traced-path 오류(`missing-traced-path`)를 가르는 사유 코드. */
+  readonly reasonCode?: 'goal-unreadable' | 'missing-traced-path';
+  /** 어느 검사인지 — 경로를 접지 않은 검사 이름. */
+  readonly checkName?: string;
+  /** 잘리지 않은 대상 경로. 경로 없는 검사(빈 traced paths)는 생략한다. */
+  readonly targetPath?: string;
   /** draft PR 경고가 연 검사 대상 경로. 동일 경로의 경고를 렌더에서 묶는다. */
   readonly draftPaths?: readonly string[];
   /** 라이브 런 충돌의 경로별 역할. ask 대상 표지가 없으면 미상이라 생략한다. */