elanous 0.2.34 → 0.2.36

package/src/self-dev/decompose-proposal.ts

@@ -84,6 +84,49 @@ function hotPathOverlapsOf(pieces: readonly DecomposePiece[]): HotPathOverlap[]
   return pairs;
 }
 
+/** 분해 제안 문서를 «읽은» 결과. ⛔ 혼합 문서를 조각 문서로 «다시 매기지» 않는다. */
+export type DecomposeDocument =
+  | { kind: 'pieces'; pieces: DecomposePiece[] }
+  /** 단계꼴(`step`/문자열)과 조각꼴(`feature`)이 «섞인» 문서. 조용히 다시 매기지 않고 거부한다. */
+  | { kind: 'rejected'; reason: 'mixed-document'; stepEntries: number; pieceEntries: number }
+  /** 읽을 조각이 «하나도» 없다 — 빈 문서와 거부를 같은 값으로 접지 않는다. */
+  | { kind: 'empty' };
+
+/**
+ * 분해 제안 문서(원장 `data.pieces`)를 조각 목록으로 읽는다.
+ *
+ * ⛔⭐ **혼합 문서를 «다시 매기지» 않는다** — 단계꼴 항목(`{ step }`·맨 문자열)은 `feature` 가 없어
+ *   지금까지 «조용히» 버려졌고, 남은 조각 id 가 `String(pieces.length)` 로 **재번호**됐다.
+ *   그 재번호가 `shadow → live` 선행 간선을 «매달린» 것으로 바꿔, shadow 관측 없이 live 가 나갔다.
+ *   ⇒ 단계꼴이 «하나라도» 섞여 있으면 문서 전체를 거부하고 두 수를 값으로 남긴다(처방이 다르다).
+ */
+export function readDecomposeDocument(raw: unknown): DecomposeDocument {
+  if (!Array.isArray(raw) || raw.length === 0) return { kind: 'empty' };
+  const pieces: DecomposePiece[] = [];
+  let stepEntries = 0;
+  for (const entry of raw) {
+    if (typeof entry === 'string') { stepEntries++; continue; }
+    if (!entry || typeof entry !== 'object') continue;
+    const piece = entry as {
+      id?: unknown; feature?: unknown; dependsOn?: unknown; goalType?: unknown; hotPaths?: unknown; step?: unknown;
+    };
+    if (typeof piece.step === 'string' && piece.step.trim()) stepEntries++;
+    if (typeof piece.feature !== 'string' || !piece.feature.trim()) continue;
+    pieces.push({
+      id: typeof piece.id === 'string' && piece.id ? piece.id : String(pieces.length),
+      feature: piece.feature,
+      dependsOn: Array.isArray(piece.dependsOn) ? piece.dependsOn.filter((d): d is string => typeof d === 'string') : [],
+      ...(typeof piece.goalType === 'string' ? { goalType: piece.goalType } : {}),
+      ...(Array.isArray(piece.hotPaths) ? { hotPaths: piece.hotPaths.filter((path): path is string => typeof path === 'string') } : {}),
+    });
+  }
+  if (pieces.length === 0) return { kind: 'empty' };
+  if (stepEntries > 0) {
+    return { kind: 'rejected', reason: 'mixed-document', stepEntries, pieceEntries: pieces.length };
+  }
+  return { kind: 'pieces', pieces };
+}
+
 /** 원장 엔트리들에서 조각별 «가장 늦은» 분해 제안을 뽑는다. 형제 겹침이 있으면 hot-path-overlap 관측을 낸다(fail-open). */
 export function pickDecomposeProposals(entries: readonly Ledgerish[]): Map<string, DecomposeProposal> {
   const out = new Map<string, DecomposeProposal>();
@@ -94,20 +137,20 @@ export function pickDecomposeProposals(entries: readonly Ledgerish[]): Map<strin
       : typeof entry.runId === 'string' && entry.runId.trim() ? entry.runId : null;
     if (!shardId) continue;   // ⛔ 어느 조각인지도 어느 런인지도 모르는 제안은 «쓸 수 없다» — 조용히 아무 데나 붙이지 않는다
     const data = entry.data as { pieces?: unknown; round?: unknown } | undefined;
-    const raw = Array.isArray(data?.pieces) ? data!.pieces : null;
-    if (!raw?.length) continue;
-    const pieces: DecomposePiece[] = [];
-    for (const p of raw) {
-      const piece = p as { id?: unknown; feature?: unknown; dependsOn?: unknown; goalType?: unknown; hotPaths?: unknown };
-      if (typeof piece?.feature !== 'string' || !piece.feature.trim()) continue;
-      pieces.push({
-        id: typeof piece.id === 'string' && piece.id ? piece.id : String(pieces.length),
-        feature: piece.feature,
-        dependsOn: Array.isArray(piece.dependsOn) ? piece.dependsOn.filter((d): d is string => typeof d === 'string') : [],
-        ...(typeof piece.goalType === 'string' ? { goalType: piece.goalType } : {}),
-        ...(Array.isArray(piece.hotPaths) ? { hotPaths: piece.hotPaths.filter((path): path is string => typeof path === 'string') } : {}),
-      });
+    const document = readDecomposeDocument(data?.pieces);
+    if (document.kind === 'empty') continue;
+    // ⛔ 혼합 문서는 «뽑지 않는다» — 다시 매기면 shadow→live 선행 간선이 매달린 것이 된다.
+    if (document.kind === 'rejected') {
+      try {
+        debug.log('self-dev.decompose', 'mixed-decompose-document', {
+          shardId,
+          stepEntries: document.stepEntries,
+          pieceEntries: document.pieceEntries,
+        });
+      } catch { /* fail-open */ }
+      continue;
     }
+    const pieces = document.pieces;
     // ⛔ 조각이 «하나»면 분해가 아니다 — 같은 골을 이름만 바꿔 다시 거는 셈이다.
     if (pieces.length < 2) continue;
     const round = typeof data?.round === 'number' ? data.round : undefined;
@@ -158,8 +201,9 @@ export interface DecomposePieceOrdering {
  *   겹침은 직렬화하지 않고 `DecomposeProposal.hotPathOverlaps` 로 형제 겹침으로 따로 남는다.
  *   덕분에 ⓐ 와 배열 위치가 반대 방향을 가리켜 가짜 순환을 만들던 충돌 자체가 사라졌다.
  *
- * ⛔ 매달린 `dependsOn`(조각 목록에 없는 id)은 «버리고 센다» — 그것 때문에 승격 전체를 막지 않는다
- *   (연합 경로의 `pruneDanglingDependencies` 와 같은 판단).
+ * ⛔ 매달린 `dependsOn`(조각 목록에 없는 id)은 «버리고 센다» — 이 순서 계산기는 승격을 막지 않는다
+ *   (연합 경로의 `pruneDanglingDependencies` 와 같은 판단). 승격 «입구»는 다르다 —
+ *   `planShadowFirstDispatch` 가 매달린 간선을 «거부»한다(shadow 선행 간선이 사라진 채 live 가 나가는 것을 막는다).
  *
  * 순수 함수다 — 시계·파일·프로세스를 안 만진다. 동률은 «원래 순서»로 깬다(같은 입력 → 같은 출력).
  */
@@ -217,6 +261,73 @@ export function orderPiecesTopologically(pieces: readonly DecomposePiece[]): Dec
   return { ordered, dependsOnEdges, hotPathEdges: 0, danglingDependsOn };
 }
 
+/** shadow 조각의 id — 관측만 하는 조각. ⛔ 이름은 하니스 산출이 canonical 이다. */
+export const SHADOW_PIECE_ID = 'shadow';
+
+/** shadow-first 집행 계획의 관측 값 — 무엇이 관측이고 어디에 선행 간선이 걸렸나. */
+export interface ShadowFirstPlan {
+  shadowId: string;
+  /** shadow 뒤에 서는 «live» 조각 id — 제안 순서 그대로다. */
+  liveIds: string[];
+  /** 원 제안이 잃고 있어 «되살린» shadow 선행 간선 수. 0 이면 제안이 이미 shadow-first 였다. */
+  restoredEdges: number;
+}
+
+/** shadow-first 집행 판정. ⛔ 「고칠 수 없음」과 「거부」를 같은 값으로 접지 않는다. */
+export type ShadowFirstDispatch =
+  | { kind: 'ok'; pieces: DecomposePiece[]; shadowFirst?: ShadowFirstPlan }
+  | { kind: 'rejected'; reason: 'dangling-dependsOn'; danglingIds: string[] };
+
+/**
+ * ⭐⭐⭐ shadow 관측이 live 발사보다 «앞선다» — AUTHOR-SHADOW-FIRST-SPLIT ② (#26884 수확).
+ *
+ * 🔑 ***실패 뒤 분해 제안에서 관측이 «사라지고» live 만 나갔다.*** shadow 조각은
+ *   `dependsOn` 없이 제안에 실리고, live 조각이 그 선행 간선을 «잃은» 채 오면 위상 정렬이
+ *   둘을 «동시에» 세운다 ⇒ 관측 없이 live 발사가 먼저 도착한다.
+ *
+ * ⛔ 판정은 «둘»로 가른다 — 접으면 다음 사람이 못 고친다:
+ *   ⓐ 매달린 `dependsOn`(조각 목록에 없는 id) → `kind: 'rejected'`, 사유와 없는 id 를 값으로 남긴다.
+ *     없는 조각을 선행으로 단 제안은 승격하지 않는다(`danglingDependsOn` 을 세는 것만으로는 live 발사를 못 막는다).
+ *   ⓑ shadow 조각이 «둘» 이상 → `kind: 'ok'` 지만 «가드 없음» — 어느 쪽이 관측인지 모르는 제안은 고치지 않는다.
+ *
+ * ⭐ 선행 간선은 «실제 발사 지점»(다른 조각이 의존하지 않는 끝 조각)에만 건다 — 중간 조각은
+ *   자기 선행 순서만 들고 있으면 되고, 그 것까지 shadow 에 매달면 계획이 사슬로 납작해진다.
+ *   shadow 조각은 언제나 맨 앞으로 올라오고, 이미 shadow 를 선행으로 가진 조각은 건드리지 않는다.
+ *
+ * 순수 함수다 — 시계·파일·프로세스를 안 만진다. 입력 조각은 «변형하지 않는다».
+ */
+export function planShadowFirstDispatch(pieces: readonly DecomposePiece[]): ShadowFirstDispatch {
+  const known = new Set(pieces.map((piece) => piece.id));
+  const danglingIds: string[] = [];
+  for (const piece of pieces) {
+    for (const dep of piece.dependsOn) {
+      if (dep === piece.id || known.has(dep) || danglingIds.includes(dep)) continue;
+      danglingIds.push(dep);
+    }
+  }
+  if (danglingIds.length) return { kind: 'rejected', reason: 'dangling-dependsOn', danglingIds };
+
+  const shadowPieces = pieces.filter((piece) => piece.id === SHADOW_PIECE_ID);
+  if (shadowPieces.length !== 1) return { kind: 'ok', pieces: [...pieces] };
+
+  const shadow = shadowPieces[0]!;
+  const rest = pieces.filter((piece) => piece !== shadow);
+  const dependedUpon = new Set<string>();
+  for (const piece of rest) for (const dep of piece.dependsOn) dependedUpon.add(dep);
+
+  let restoredEdges = 0;
+  const reordered = rest.map((piece) => {
+    if (dependedUpon.has(piece.id) || piece.dependsOn.includes(SHADOW_PIECE_ID)) return piece;
+    restoredEdges++;
+    return { ...piece, dependsOn: [...piece.dependsOn, SHADOW_PIECE_ID] };
+  });
+  return {
+    kind: 'ok',
+    pieces: [shadow, ...reordered],
+    shadowFirst: { shadowId: shadow.id, liveIds: rest.map((piece) => piece.id), restoredEdges },
+  };
+}
+
 export interface DecomposeProposalScan {
   proposals: Map<string, DecomposeProposal>;
   goalPlanRevisions: Map<string, GoalPlanRevisionReadObservation>;
@@ -343,11 +454,21 @@ export function readDecomposeProposals(input: {
   };
 }
 
+/** 승격하지 «않은» 제안 하나 — ⛔ 조용히 원본만 두면 다음 라운드가 같은 제안을 다시 쓴다. */
+export interface DecomposeRejection {
+  feature: string;
+  reason: 'dangling-dependsOn';
+  /** 무엇이 매달렸나 — 조각 목록에 없는 선행 id 들. */
+  detail: string[];
+}
+
 /** 조각 하나를 «쪼갠» 결과. ⛔ 「무엇을 무엇으로」가 값으로 남아야 다음 라운드가 중복하지 않는다. */
 export interface DecomposeApplication {
   goals: SelfDevGoal[];
   /** 이번에 쪼갠 원래 goal 의 feature 들. 비면 아무것도 안 바뀌었다. */
   decomposed: string[];
+  /** 거부한 제안들 — 사유와 매달린 id 를 «값»으로 남긴다. 거부가 없으면 빈 배열이다. */
+  rejected: DecomposeRejection[];
 }
 
 /**
@@ -358,10 +479,12 @@ export interface DecomposeApplication {
  *     self_orchestrate 는 shouldDefer=true 라 «찾아야» 보인다. 그래서 복합도 단일로 들어온다.
  *   ⇒ 📌 입구를 고치는 대신 ***「들어온 뒤 스스로 쪼개게」*** 한다.
  *
- * ⛔ **안전 장치 셋** — 다시 거는 것은 쉽고 «멈출 줄 아는 것»이 어렵다:
+ * ⛔ **안전 장치 넷** — 다시 거는 것은 쉽고 «멈출 줄 아는 것»이 어렵다:
  *   ⓐ 같은 goal 을 «두 번» 쪼개지 않는다(alreadyDecomposed)
  *   ⓑ 조각이 둘 미만인 제안은 애초에 안 온다(pickDecomposeProposals 가 거른다)
  *   ⓒ 상한을 넘기면 «쪼개지 않는다» — 조각이 무한히 불어나는 것을 막는다
+ *   ⓓ shadow 관측이 live 발사 «앞»에 선다(`planShadowFirstDispatch`) — 매달린 `dependsOn` 은
+ *     승격하지 않고 사유와 id 를 `rejected` 로 남긴다. 관측은 조각을 내보내기 «전»에 남는다.
  *
  * ⭐ **조각은 원 골의 «대상 경로:» 머리줄을 물려받는다** (DECOMPOSE-PIECE-TARGET-LINE · 10-11 부검 run-76941fca):
  *   조각 feature 가 골을 «통째로» 갈아 끼우면 첫 줄 선언이 사라져 Pod 예비 검사가 «대상 경로 0» →
@@ -402,22 +525,51 @@ export function applyDecomposeProposals(
     if (already.has(r.feature)) continue;
     byFeature.set(r.feature, pieces);
   }
-  if (byFeature.size === 0) return { goals: [...goals], decomposed: [] };
+  if (byFeature.size === 0) return { goals: [...goals], decomposed: [], rejected: [] };
 
   const out: SelfDevGoal[] = [];
   const decomposed: string[] = [];
+  const rejected: DecomposeRejection[] = [];
   for (const goal of goals) {
     const pieces = byFeature.get(goal.feature);
     if (!pieces) { out.push(goal); continue; }
+    // ⛔⭐ shadow-first 가드 — 매달린 선행 간선이 있는 제안은 «쪼개지 않는다»(원본을 그대로 둔다).
+    const plan = planShadowFirstDispatch(pieces);
+    if (plan.kind === 'rejected') {
+      rejected.push({ feature: goal.feature, reason: plan.reason, detail: [...plan.danglingIds] });
+      // ⛔⭐ 거부를 «로그와 값에 다» 남긴다 — 조용히 버리면 다음 라운드가 같은 제안을 다시 쓴다.
+      //   혼합 문서 거부(mixed-decompose-document)와 같은 관측 채널·같은 fail-open 규율이다.
+      try {
+        debug.log('self-dev.decompose', 'decompose-rejected', {
+          feature: goal.feature,
+          reason: plan.reason,
+          danglingIds: [...plan.danglingIds],
+        });
+      } catch { /* fail-open */ }
+      out.push(goal);
+      continue;
+    }
+    const planned = plan.pieces;
     // ⛔ 상한을 넘기면 «쪼개지 않는다» — 조용히 자르지 않고 원본을 그대로 둔다.
-    if (out.length + pieces.length + (goals.length - out.length - 1) > maxGoals) { out.push(goal); continue; }
+    if (out.length + planned.length + (goals.length - out.length - 1) > maxGoals) { out.push(goal); continue; }
     decomposed.push(goal.feature);
+    // ⭐ 관측이 live 발사보다 «앞»에 남는다 — 조각을 out 에 넣기 전에 이 자리에서 찍는다.
+    if (plan.shadowFirst) {
+      try {
+        debug.log('self-dev.decompose', 'shadow-first-dispatch', {
+          feature: goal.feature,
+          shadowId: plan.shadowFirst.shadowId,
+          liveIds: [...plan.shadowFirst.liveIds],
+          restoredEdges: plan.shadowFirst.restoredEdges,
+        });
+      } catch { /* fail-open */ }
+    }
     // 원 골의 머리줄 선언 — 첫 줄이 «대상 경로:» 가 아니면 조각은 지금 그대로(바이트 불변)다.
     const goalLines = goal.feature.split('\n');
     const targetLine = TARGET_PATHS_LINE.exec(goalLines[0] ?? '');
     // «신설:» 상속은 머리줄 선언이 «있을 때만» — 첫 줄이 라벨이 아니면 조각은 바이트 불변이어야 한다.
     const newLine = targetLine ? goalLines.map((line) => NEW_PATHS_LINE.exec(line)).find((m) => m !== null) : null;
-    for (const piece of pieces) {
+    for (const piece of planned) {
       const inherited: string[] = [];
       let paths: string[] = [];
       if (targetLine) {
@@ -444,5 +596,5 @@ export function applyDecomposeProposals(
       } as SelfDevGoal);
     }
   }
-  return { goals: out, decomposed };
+  return { goals: out, decomposed, rejected };
 }

package/src/self-dev/decompose.ts

@@ -460,6 +460,67 @@ export function inheritDecomposedTargetPaths(parentFeature: string, goals: SelfD
     .flatMap(inferHotPaths))];
   const parentTargets = declaredTargets(parentFeature);
   if (!parentTargets.length) return goals;
+  // A two-part implementation must not hand a pathless child its sibling's
+  // target as part of the parent edit fence. Keep other decompositions below.
+  if (goals.length === 2 && parentTargets.length >= 2
+    && goals.every((goal) => goal.goalType === undefined || goal.goalType === 'implement')) {
+    const own = goals.map((goal) => declaredTargets(goal.feature ?? ''));
+    const undeclared = own.map((paths, index) => paths.length ? -1 : index).filter((index) => index >= 0);
+    const declared = own.flat();
+    const canDivide = undeclared.length === 2
+      || (undeclared.length === 1 && declared.length > 0
+        && declared.some((path) => parentTargets.includes(path))
+        && parentTargets.some((path) => !declared.includes(path)));
+    if (canDivide) {
+      const claims = goals.map((goal, index) => own[index]!.length
+        ? own[index]!
+        : (goal.hotPaths ?? []).filter((path) => parentTargets.includes(path)));
+      const claimedOwners = parentTargets.map((path) => goals.flatMap((_, index) => claims[index]!.includes(path) ? [index] : []));
+      const conflictingClaims = claimedOwners.some((indices) => indices.length > 1);
+      const nameOwners = parentTargets.map((path) => {
+        const stemWords = path.split('/').at(-1)!.replace(/\.[^.]+$/, '').toLowerCase().match(/[a-z0-9]+/g) ?? [];
+        if (!stemWords.length || stemWords.join('').length < 4) return [];
+        return goals.flatMap((goal, childIndex) => {
+          const words = (goal.feature ?? '').toLowerCase().match(/[a-z0-9]+/g) ?? [];
+          return words.some((_, start) => stemWords.every((word, offset) => words[start + offset] === word)) ? [childIndex] : [];
+        });
+      });
+      const ambiguousName = nameOwners.some((indices, index) => claimedOwners[index]!.length === 0 && indices.length > 1);
+      const conflictingNameClaim = claimedOwners.some((indices, index) => indices.length === 1
+        && nameOwners[index]!.some((namedOwner) => namedOwner !== indices[0]));
+      const claimCounts = [0, 1].map((index) => claimedOwners.filter((indices) => indices.length === 1 && indices[0] === index).length);
+      const soleClaimant = claimCounts[0]! > 0 && claimCounts[1] === 0 ? 0
+        : claimCounts[1]! > 0 && claimCounts[0] === 0 ? 1 : undefined;
+      const conflictingUnclaimedHint = soleClaimant !== undefined && nameOwners.some((indices, index) =>
+        claimedOwners[index]!.length === 0 && indices.includes(soleClaimant));
+      const owners = parentTargets.map((_, index) => claimedOwners[index]!.length === 1
+        ? claimedOwners[index]![0]
+        : soleClaimant !== undefined ? 1 - soleClaimant
+          : nameOwners[index]!.length === 1 ? nameOwners[index]![0] : undefined);
+      const ownerCounts = [owners.filter((owner) => owner === 0).length, owners.filter((owner) => owner === 1).length];
+      owners.forEach((owner, index) => {
+        if (owner !== undefined) return;
+        const next = ownerCounts[0]! <= ownerCounts[1]! ? 0 : 1;
+        owners[index] = next;
+        ownerCounts[next] = (ownerCounts[next] ?? 0) + 1;
+      });
+      // A named path wins over model order; if every path points at one child,
+      // keep the old scope rather than inventing work for the other child.
+      const partitions = goals.map((_, index) => parentTargets.filter((_, pathIndex) => owners[pathIndex] === index));
+      const sharedOtherPaths = (goals[0]?.hotPaths ?? []).some((path) =>
+        !parentTargets.includes(path) && (goals[1]?.hotPaths ?? []).includes(path));
+      const conflictingParentReference = goals.some((goal, index) =>
+        own[index]!.length > 0 && (goal.hotPaths ?? []).some((path) =>
+          parentTargets.includes(path) && !own[index]!.includes(path)));
+      if (partitions.every((paths) => paths.length > 0)
+        && !conflictingClaims && !ambiguousName && !conflictingNameClaim && !conflictingUnclaimedHint
+        && !sharedOtherPaths && !conflictingParentReference) return goals.map((goal, index) => {
+        const targets = partitions[index]!;
+        return { ...goal, hotPaths: [...new Set([...(goal.hotPaths ?? []), ...targets])],
+          feature: `${goal.feature}${own[index]!.length ? '' : `\n대상 경로: ${targets.join(' · ')}`}\n완료 기준: ${targets.join(' · ')}의 변경을 확인하고 관련 시험을 통과한다.` };
+      });
+    }
+  }
   return goals.map((goal) => {
     // hotPaths also contains inferred references; only an explicit target line establishes child scope.
     const own = declaredTargets(goal.feature ?? '');

package/src/self-dev/dev-cli.ts

@@ -66,14 +66,9 @@ import { resolveModelAlias } from '../intelligence-map/model-alias.js';
 import { BUILTIN_CATALOG } from '../intelligence-map/model-catalog.js';
 import { BEDROCK_DEFAULT_MODEL, BEDROCK_MODELS, findBedrockModel, resolveBedrockModelId } from '../llm/bedrock.js';
 import { ZAI_CODING_DEFAULT_MODEL, ZAI_CODING_MODELS } from '../llm/zai-coding-plan.js';
-
-/** `dev --plan` 도움말이 가리키는 대응 문. ⛔ 도움말에 이 문자열을 리터럴로 다시 적지 마라. */
-export const DEV_PLAN_REPLACEMENT = 'elanous harness say';
-
-/** `dev --plan` 옵션 도움말. 목적지는 인자(기본=상수)에서만 온다. */
-export function formatDevPlanOptionHelp(replacement: string = DEV_PLAN_REPLACEMENT): string {
-  return `은퇴한 staged 하니스 옵션 — 지정하면 명시적으로 거부됨 · 대응 문 \`${replacement}\``;
-}
+import { isVerifiedOpenGatewayModel, OPENGATEWAY_DEFAULT_MODEL, OPENGATEWAY_VERIFIED_MODELS } from '../llm/opengateway-models.js';
+import { DEV_PLAN_REPLACEMENT } from './cli-help-text.js';
+export { DEV_PLAN_REPLACEMENT, formatDevPlanOptionHelp } from './cli-help-text.js';
 
 /** dev CLI 옵션(commander) — `--no-*` 는 false 로 도착. input/executor 는 액션이 빌드해 별도 전달. */
 /** `src/index.ts` dev command wrapper must not append a second JSON document after hold emits its result. */
@@ -1069,7 +1064,23 @@ export async function executeDevSelfRun(
 
     // ⛔ 슈퍼바이저 직전이 아니라 «호출 시작»이다 — 첫 런 도중의 정지도 이 호출의 정지다.
     const invocationStartedAt = supervise.invocationStartedAtMs ?? enteredAtMs;
-    const recordRestart = (kind: 'relaunch' | 'promoted-piece', previousResult: { worktreePath?: string }): boolean => {
+    const honorChildSoftStop = (kind: 'relaunch' | 'promoted-piece', previousResult: { worktreePath?: string; stage?: string; runId?: string }): boolean => {
+      // A Pod stop marker lives inside the child container, while its result intentionally
+      // omits the container worktree path. The child's soft-stopped stage is therefore the
+      // durable evidence available to this host before it decides to launch another Pod.
+      if (previousResult.stage !== 'soft-stopped') return false;
+      const spaceId = getHarnessSpace()?.id || normalizeSpaceId(basename(previousResult.worktreePath ?? ''));
+      supervisorStopReason = 'human-stopped';
+      try {
+        debug.log('self-dev.supervisor', 'soft-stop-honored', {
+          spaceId: spaceId || null, runId: previousResult.runId ?? null,
+          source: 'child-stage', skipped: kind === 'promoted-piece' ? 'piece' : kind, surface: 'dev',
+        });
+      } catch { /* fail-open */ }
+      return true;
+    };
+    const recordRestart = (kind: 'relaunch' | 'promoted-piece', previousResult: { worktreePath?: string; stage?: string; runId?: string }): boolean => {
+      if (honorChildSoftStop(kind, previousResult)) return true;
       const spaceId = getHarnessSpace()?.id || normalizeSpaceId(basename(previousResult.worktreePath ?? ''));
       writeHarnessStageFrame(spaceId, 'supervisor', `${kind} after ${Date.now() - invocationStartedAt}ms`);
       if (!spaceId) {
@@ -1096,6 +1107,10 @@ export async function executeDevSelfRun(
       }
     };
     retainConfirmedMerge(result);
+    if (honorChildSoftStop('relaunch', result)) {
+      triageDrafts();
+      return { result, supervisorStopReason: 'human-stopped' };
+    }
     await superviseRun({
       initial: [initialJob],
       // A review-oscillation repair goal runs through the existing piece executor (fragment re-execution with the
@@ -1174,6 +1189,10 @@ export async function executeDevSelfRun(
             const repairResult = recordResult(await supervise.executePiece(goal));
             retainConfirmedMerge(repairResult);
             if (shardResults === undefined) result = repairResult;
+            if (honorChildSoftStop('relaunch', repairResult)) {
+              result = repairResult;
+              return [];
+            }
             repaired.push({ ...asSupervisorJobResult(job.feature, repairResult), oscillationRepairOf: job.taskId });
           }
           // Jobs without a repair goal are not dropped: their last result stays in the round for the next decision.
@@ -1193,10 +1212,15 @@ export async function executeDevSelfRun(
                 pieceIndex: index, ...(base === undefined ? {} : { base }), surface: 'dev',
               });
             } catch { /* fail-open */ }
-            pieceResults.push(recordResult(await supervise.executePiece!(
+            const pieceResult = recordResult(await supervise.executePiece!(
               piece.feature,
               base === undefined ? undefined : { base },
-            )));
+            ));
+            if (honorChildSoftStop('promoted-piece', pieceResult)) {
+              result = pieceResult;
+              return [];
+            }
+            pieceResults.push(pieceResult);
           }
           shardResults = pieceResults.map((pieceResult, index) => asSupervisorJobResult(pieces[index]!.feature, pieceResult));
           const folded = foldDevShardResults(shardResults);
@@ -1218,9 +1242,14 @@ export async function executeDevSelfRun(
         const rerunResult = recordResult(await execute(relaunch));
         retainConfirmedMerge(rerunResult);
         if (shardResults === undefined) result = rerunResult;
+        if (honorChildSoftStop('relaunch', rerunResult)) {
+          result = rerunResult;
+          return [];
+        }
         return [asSupervisorJobResult(feature, rerunResult)];
       },
     });
+    if (result.stage === 'soft-stopped' && supervisorStopReason !== 'human-stopped') honorChildSoftStop('relaunch', result);
     if (supervisorStopReason === 'converged' && promotedDecomposition && (() => {
       try { return statSync(feature).isFile(); } catch { return false; }
     })()) {
@@ -1369,7 +1398,7 @@ function childModelCatalogProvider(provider: string): string {
 
 function isKnownChildLlmProvider(provider: string): boolean {
   // ZAI-POD-CHILD (0.2.24) — glm = Z.ai GLM Coding Plan 직결(`ZAI_API_KEY` · src/llm/zai-coding-plan.ts). Pod 자식이 `--child-llm-provider glm` 으로 뜬다.
-  return ['grok', 'anthropic', 'claude-acp', 'gemini', 'openai', 'openai-codex', 'local', 'openrouter', 'bedrock', 'glm'].includes(normalizeChildLlmProvider(provider));
+  return ['grok', 'anthropic', 'claude-acp', 'gemini', 'openai', 'openai-codex', 'local', 'openrouter', 'opengateway', 'bedrock', 'glm'].includes(normalizeChildLlmProvider(provider));
 }
 
 function findPickerCatalogModel(provider: string, id: string): CatalogModelView | undefined {
@@ -1380,6 +1409,7 @@ function findPickerCatalogModel(provider: string, id: string): CatalogModelView
     case 'openai':
     case 'openai-codex': return findCodexModel(id);
     case 'openrouter': return findOpenRouterChildModel(id);
+    case 'opengateway': return findOpenGatewayChildModel(id);
     case 'bedrock': return findBedrockChildModel(id);
     case 'glm': return (ZAI_CODING_MODELS as readonly string[]).includes(id)
       ? { id, tier: /flash/i.test(id) ? 'budget' : 'balanced', supportsThinking: true, recommended: id === ZAI_CODING_DEFAULT_MODEL }
@@ -1412,6 +1442,11 @@ function findOpenRouterChildModel(id: string): CatalogModelView | undefined {
   };
 }
 
+function findOpenGatewayChildModel(id: string): CatalogModelView | undefined {
+  if (!isVerifiedOpenGatewayModel(id)) return undefined;
+  return { id, tier: 'better', supportsThinking: false, recommended: id === OPENGATEWAY_DEFAULT_MODEL };
+}
+
 function thinkingFromBuiltin(tags: readonly string[] | undefined, reasoningEffortCeiling: string | undefined): boolean {
   if (tags?.includes('reasoning')) return true;
   return reasoningEffortCeiling != null && reasoningEffortCeiling !== 'off' && reasoningEffortCeiling !== 'none';
@@ -1448,6 +1483,7 @@ function listImplementationChildModelCandidates(provider: string): string[] {
       case 'openai':
       case 'openai-codex': return CODEX_MODELS.map((model) => model.id);
       case 'openrouter': return [...new Set(MODEL_TIERS.map((t) => LLM_TIER_MAP_BY_PROVIDER.openrouter[t].model))];
+      case 'opengateway': return [...OPENGATEWAY_VERIFIED_MODELS];
       case 'bedrock': return BEDROCK_MODELS.map((model) => model.id);
       case 'glm': return [...ZAI_CODING_MODELS];
       default: return [];

package/src/self-dev/dev-pipeline.ts

@@ -43,6 +43,7 @@ import type { ReviewerContextItem } from '../agent-substrate/pr-reviewer.js';
 import { resolveRunIdentity, type RunIdSource } from '../harness/harness-space.js';
 import { addSelfDevRunParticipant, processBirthId, saveSelfDevRun } from './run-store.js';
 import { getUserConfig, resolveRoleLlm, type RoleLlmSource } from '../user-config.js';
+import { applyGlmCredentialFallback, GlmChildCredentialError } from './glm-credential-guard.js';
 import { reviewReasoningEffort } from '../model-tier/review-effort.js';
 import { getProvider, inferProviderFromModel } from '../llm.js';
 import { buildReviewProviderAttempts, defaultReviewFallbackModel, runReviewWithFallback, reviewFallbackModelsFromConfig, runSubscriptionReviewer, type SubscriptionReviewerDeps } from './review-provider-fallback.js';
@@ -587,6 +588,11 @@ export async function defaultDispatchAcp(
 export function toSelfImplementOptions(text: string, plan: ResolvedDevPlan, seams: SelfImplementSeams): SelfImplementOptions {
   const s = plan.self ?? {};
   const goalId = 'file' in plan.input ? parseGoalId(text) : null;
+  // GLM-NO-CREDENTIAL-FALLBACK (OP #28375) — glm 자식인데 Z.ai 자격이 없으면 «발사 전»에 OpenRouter GLM 으로 바꾸거나
+  //   이유 한 줄로 거부한다(구현 0 라운드를 만들지 않는다). glm 이 아니거나 자격이 있으면 그대로다.
+  let childLlm = s.childLlm;
+  try { childLlm = applyGlmCredentialFallback(s.childLlm); }
+  catch (error) { if (error instanceof GlmChildCredentialError) throw new DevPipelineError(error.message); throw error; }
   return {
     feature: text,
     seams,
@@ -611,11 +617,11 @@ export function toSelfImplementOptions(text: string, plan: ResolvedDevPlan, seam
     ...(s.parentSessionId ? { parentSessionId: s.parentSessionId } : {}),
     ...(s.documentReferences ? { documentReferences: s.documentReferences } : {}),
     ...(s.naturalLanguageDispatch ? { naturalLanguageDispatch: true } : {}),
-    ...(s.childLlm ? { childLlm: s.childLlm } : {}),
+    ...(childLlm ? { childLlm } : {}),
     ...(s.correlationId !== undefined ? { correlationId: s.correlationId } : {}),
     // BENCH-ISOLATED-ARMS ② — base 가 `bench/<id>/base` 면 팔 가지 `bench/<id>/<arm>` (명시 branchName 이 이긴다).
     ...(() => {
-      const branchName = s.branchName ?? benchArmBranchForBase(plan.base, s.childLlm?.model, process.env.ELANOUS_RUN_ID?.trim() || randomUUID());
+      const branchName = s.branchName ?? benchArmBranchForBase(plan.base, childLlm?.model, process.env.ELANOUS_RUN_ID?.trim() || randomUUID());
       return branchName ? { branchName } : {};
     })(),
     ...(s.maxReworkRounds !== undefined ? { maxReworkRounds: s.maxReworkRounds } : {}),

package/src/self-dev/draft-residue.ts

@@ -4,7 +4,7 @@ import { gunzipSync } from 'node:zlib';
 import { basename, dirname, join } from 'node:path';
 import { findGitDir } from '../git-fs/locate.js';
 import { debug } from '../debug/log.js';
-import { PR_LABELS } from '../github/pr-labels.js';
+import { PR_LABELS, PR_LABEL_NAMES } from '../github/pr-labels.js';
 import { appendRunLedgerEntry, listRunLedgers, loadRunLedger, runLedgerDir, type RunLedgerEntry } from '../self-implement/run-ledger.js';
 import { queryRunningRuns } from '../self-implement/running-runs.js';
 import { clipRegateDetail, regateFailureFacts, type HostRegateFailure } from '../self-implement/regate-detail.js';
@@ -64,6 +64,7 @@ function sameCardSlot(previous: ResiduePr, current: ResiduePr, slot: string): bo
   return cardOf(previous.body) === slot && cardOf(current.body) === slot;
 }
 const harvestable = PR_LABELS.find((label) => label.name === 'elanous:harvestable')!.name;
+const running = PR_LABELS.find((label) => label.name === PR_LABEL_NAMES.running)!.name;
 const superseded = PR_LABELS.find((label) => label.name === 'elanous:superseded')!.name;
 
 export function classifyPodTerminal(input: PodTerminalInput): PrTerminalRecord {
@@ -120,6 +121,8 @@ export interface DraftResidueAdapters {
   /** Complete changed-path inventory for the newly opened PR; undefined is unmeasured. */
   listPrChangedPaths?(repository: string, number: number): Promise<readonly string[] | undefined> | readonly string[] | undefined;
   addLabel(repository: string, number: number, label: string): Promise<void> | void;
+  /** Remove one state label from a PR — RUN-STOP-RELEASES-RUNNING-LABEL drops `elanous:running` on terminal record. */
+  removeLabel?(repository: string, number: number, label: string): Promise<void> | void;
   setLabels(repository: string, number: number, change: { add: string; remove: readonly string[] }): Promise<void> | void;
   comment(repository: string, number: number, body: string): Promise<void> | void;
   closePr(repository: string, number: number): Promise<void> | void;
@@ -243,6 +246,7 @@ export function defaultAdapters(sources: ResidueRunStatusSources = defaultRunSta
       } catch { return undefined; }
     },
     addLabel: (repository, number, label) => { gh(['pr', 'edit', String(number), '-R', repository, '--add-label', label]); },
+    removeLabel: (repository, number, label) => { gh(['pr', 'edit', String(number), '-R', repository, '--remove-label', label]); },
     setLabels: (repository, number, change) => {
       const flags = [...(change.add ? ['--add-label', change.add] : []), ...change.remove.flatMap((label) => ['--remove-label', label])];
       if (flags.length) gh(['pr', 'edit', String(number), '-R', repository, ...flags]);
@@ -455,6 +459,38 @@ export async function applyPodTerminal(record: PrTerminalRecord, ctx: DraftResid
       return skipped('protected');
     }
     if (record.terminalClass !== 'landed') {
+      // RUN-STOP-RELEASES-RUNNING-LABEL: a finished run must not stay protected by its own `elanous:running`
+      // state label. Release only that state label; other state labels stay. A failed release is observed,
+      // never a reason to abort the terminal record. Only the GitHub write is guarded: a ledger write failure is a
+      // normal (retryable) terminal failure. An `attempt` effect written before the GitHub write lets a replay
+      // record the release even when the label is already gone (review r1: success must not be lost).
+      if (!completed('running-label-released', pr.number)) {
+        const attempted = completed('running-label-release-attempt', pr.number);
+        let released = false;
+        if (pr.labels.includes(running)) {
+          step = 'ledger';
+          if (!attempted) acknowledge('running-label-release-attempt', pr.number);
+          try {
+            if (!adapters.removeLabel) throw new Error('remove-label-unobserved');
+            step = 'remove-label';
+            await adapters.removeLabel(record.repository, pr.number, running);
+            released = true;
+          } catch (labelError) {
+            const reason = labelError instanceof Error ? labelError.message : String(labelError);
+            log('label-release-failed', { prNumber: pr.number, reason });
+            // The failure reason belongs in the ledger as well. Writing it is outside the GitHub guard: a ledger
+            // failure here is a normal retryable terminal failure (review r2), never a silently dropped reason.
+            step = 'ledger';
+            adapters.appendLedger({ runId: ctx.ledgerRunId, event: 'pr-terminal-effect',
+              data: { childRunId: record.childRunId, effect: 'label-release-failed', number: pr.number, reason } }, ctx.ledgerDir);
+          }
+        } else if (attempted) released = true;
+        if (released) {
+          step = 'ledger';
+          acknowledge('running-label-released', pr.number);
+          log('running-label-released', { prNumber: pr.number });
+        }
+      }
       if (!completed('harvestable', pr.number)) {
         if (!pr.labels.includes(harvestable)) {
           step = 'add-label';