elanous 0.2.34 → 0.2.36

package/src/self-dev/draft-sweep.ts

@@ -1,6 +1,6 @@
 import { CLAIM_IDLE_HOURS, PR_LABELS, STALLED_DRAFT_HOURS } from '../github/pr-labels.js';
 import { debug } from '../debug/log.js';
-import { decideDraft, draftClaimComment, draftClaimState, draftReleaseComment, laterMergedTwins, sameGoalPr, PROTECTED_LABELS, type DraftTriagePr } from './draft-triage-rules.js';
+import { assessDraftTriage, decideDraft, draftClaimComment, draftClaimState, draftReleaseComment, laterMergedTwins, sameGoalPr, PROTECTED_LABELS, type DraftTriageAssessment, type DraftTriagePr, type DraftTriageReviewState } from './draft-triage-rules.js';
 import { cellIdFromBody } from '../pr-tool/census.js';
 import { cardPrNumber, draftTaskOwner, type TaskCard } from '../task-agent/task-hand.js';
 import type { PrTerminalRecord } from './draft-residue.js';
@@ -26,6 +26,8 @@ export interface SweepMergedPr extends DraftTriagePr {
 export interface DraftSweepAdapters {
   /** Each call returns one complete page; a rejection must not be mistaken for an empty page. */
   listDrafts(page: number, perPage: number, repository: string): Promise<readonly SweepDraft[]>;
+  /** Head commit time is fetched only for explicit triage, where it gates idle/close recommendations. */
+  getHeadCommitTime?(repository: string, number: number): Promise<string | undefined>;
   listMerged(page: number, perPage: number, repository: string): Promise<readonly SweepMergedPr[]>;
   /** Complete closed PR inventory for the creation cohort (including closed without merge). */
   listRecentClosed?(repository: string, createdSince: Date): Promise<readonly SweepMergedPr[]>;
@@ -77,6 +79,8 @@ export interface SweepReviewGate {
   readonly review?: 'pass' | 'fail';
   readonly mustFix?: boolean;
   readonly gate?: 'pass' | 'fail';
+  /** Exact-head review posture for triage; unknown stays distinct from legacy census posture. */
+  readonly triageReview?: DraftTriageReviewState;
 }
 
 export interface DraftSweepOptions {
@@ -89,6 +93,8 @@ export interface DraftSweepOptions {
   closeCapSource?: DraftSweepCloseCapSource;
   /** Closes already made this tick by the pod-terminal replay — they count against the same cap. */
   alreadyClosed?: number;
+  /** Include evidence-backed next-action recommendations in JSON output; never authorizes writes. */
+  includeTriage?: boolean;
 }
 
 export interface DraftSweepEntry {
@@ -107,6 +113,7 @@ export interface DraftSweepResult {
   apply: boolean;
   complete: boolean;
   entries: DraftSweepEntry[];
+  triage?: { entries: Array<{ number: number; assessment: DraftTriageAssessment }>; counts: Record<string, number> };
   counts: Record<string, number>;
   /** Drafts whose run could not be observed from here (kept, or closed by the idle rule). */
   unobserved?: number;
@@ -136,6 +143,11 @@ export interface DraftSweepLineageCounts {
   closed: number;
   harvestableClosed: number;
   fallThrough: Record<string, number>;
+  /**
+   * Of `closed`, the ones the 칸 (cell) key decided instead of the branch lineage key. Absent while the 칸 rule
+   * closes nothing, so every existing lineage count and log line keeps its exact shape.
+   */
+  cellClosed?: number;
 }
 
 /** A review counts as passed only on an observed PASS with no must-fix left. */
@@ -773,6 +785,30 @@ export function newerLineageDraft(draft: SweepDraft, openDrafts: readonly SweepD
     .sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt) || b.number - a.number)[0];
 }
 
+/**
+ * The newest open draft of the same 칸 (cell) that was created strictly after `draft` and belongs to a different
+ * goal lineage — two runs of different goals working the same cell are duplicates of one deliverable.
+ * Reads the canonical cell identity (`cellIdFromBody`, the same `칸: <CELL>` marker the PR creation guard uses),
+ * never a re-derived marker, and keeps `branchLineageKey` byte-compatible: only a *different* key is a cell match.
+ * ⛔ A draft whose body names no 칸 never matches (keep), and a same-칸 draft of the same goal is `newerLineageDraft`.
+ */
+export function newerSameCellDraft(draft: SweepDraft, openDrafts: readonly SweepDraft[]): SweepDraft | undefined {
+  const cellId = cellIdFromBody(draft.body ?? '');
+  const created = Date.parse(draft.createdAt);
+  if (cellId === null || !Number.isFinite(created)) return undefined;
+  const key = branchLineageKey(draft.branch);
+  // A missing goal id is not evidence of a different goal. Keep unknown lineage on either side.
+  if (key === null) return undefined;
+  return openDrafts
+    .filter((pr) => {
+      const openKey = branchLineageKey(pr.branch);
+      return pr.number !== draft.number && cellIdFromBody(pr.body ?? '') === cellId
+        && openKey !== null && openKey !== key
+        && Number.isFinite(Date.parse(pr.createdAt)) && Date.parse(pr.createdAt) > created;
+    })
+    .sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt) || b.number - a.number)[0];
+}
+
 /**
  * Census of harness drafts older than 24h. Same-goal landing uses `sameGoalPr` unchanged.
  * A draft counts as closable when a same-goal merged PR exists, harvestable when review PASS and the gate passed,
@@ -800,7 +836,7 @@ export function draftSweepDaily(
 }
 
 /** A failed inventory or liveness lookup is never treated as proof that a draft can be closed. */
-export async function runDraftSweep({ repository, adapters, apply = false, now = new Date(), closeCap: requestedCap, closeCapSource: requestedSource, alreadyClosed = 0 }: DraftSweepOptions): Promise<DraftSweepResult> {
+export async function runDraftSweep({ repository, adapters, apply = false, now = new Date(), closeCap: requestedCap, closeCapSource: requestedSource, alreadyClosed = 0, includeTriage = false }: DraftSweepOptions): Promise<DraftSweepResult> {
   const validCap = validCloseCap(requestedCap);
   const closeCap = validCap ?? DRAFT_SWEEP_CLOSE_CAP;
   const closeCapSource: DraftSweepCloseCapSource = validCap === undefined ? 'default' : requestedSource ?? 'flag';
@@ -878,7 +914,7 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
   const reviewGate = new Map<number, SweepReviewGate | undefined>();
   if (adapters.getReviewGate) {
     // Review/gate posture only feeds the daily census, which only counts harness drafts older than 24h.
-    const censused = drafts.filter((draft) => dailyCensusDraft(draft, now));
+    const censused = includeTriage ? drafts : drafts.filter((draft) => dailyCensusDraft(draft, now));
     try {
       await mapBounded(censused, DRAFT_SWEEP_CONCURRENCY, async (draft) => {
         reviewGate.set(draft.number, await adapters.getReviewGate!(draft, repository));
@@ -894,12 +930,89 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
   // Card and terminal inventories are observations, not closing authority. An unreadable source cannot mint a claim.
   let cards: readonly TaskCard[] | undefined;
   let terminals: readonly PrTerminalRecord[] | undefined;
-  if (apply) {
+  if (apply || includeTriage) {
     try { cards = await adapters.listTaskCards?.(); if (cards && !Array.isArray(cards)) cards = undefined; }
     catch (error) { debug.log('draft.residue', 'claim-skipped', { prNumber: null, owner: null, runId: null, reason: `cards-unreadable: ${sweepFailureReason(error)}` }); }
     try { terminals = await adapters.listPrTerminals?.(); if (terminals && !Array.isArray(terminals)) terminals = undefined; }
     catch (error) { debug.log('draft.residue', 'claim-skipped', { prNumber: null, owner: null, runId: null, reason: `terminals-unreadable: ${sweepFailureReason(error)}` }); }
   }
+  if (includeTriage) {
+    const latestCommitTimes = new Map<number, string | undefined>();
+    if (adapters.getHeadCommitTime) {
+      await mapBounded(drafts, DRAFT_SWEEP_CONCURRENCY, async (draft) => {
+        latestCommitTimes.set(draft.number, draft.latestCommitAt ?? await adapters.getHeadCommitTime!(repository, draft.number).catch(() => undefined));
+      });
+    }
+    const triageDrafts = drafts.map((draft) => ({ ...draft,
+      ...(latestCommitTimes.has(draft.number) ? { latestCommitAt: latestCommitTimes.get(draft.number) } : {}),
+    }));
+    const triageRows: Array<{ number: number; assessment: DraftTriageAssessment }> = [];
+    const initial = triageDrafts.map((draft) => {
+      const posture = reviewGate.get(draft.number);
+      return assessDraftTriage({ draft, now, runStatus: statuses.get(draft.number),
+        ...(posture?.gate ? { gate: posture.gate } : {}),
+        ...(posture?.triageReview ? { review: posture.triageReview } : {}),
+      });
+    });
+    const activeOwnerObservations = new Map<number, { owner?: string; observed: boolean }>();
+    if (adapters.getActiveClaimOwner) {
+      const ownerLookupDrafts = triageDrafts.filter((draft) => !(cards && draftTaskOwner(cards, draft)));
+      await mapBounded(ownerLookupDrafts, DRAFT_SWEEP_CONCURRENCY, async (draft) => {
+        try {
+          activeOwnerObservations.set(draft.number, { owner: await adapters.getActiveClaimOwner!(repository, draft.number), observed: true });
+        } catch {
+          activeOwnerObservations.set(draft.number, { observed: false });
+        }
+      });
+    }
+    for (let index = 0; index < drafts.length; index++) {
+      const draft = triageDrafts[index]!;
+      const identity = initial[index]!;
+      // A generic sweep can target any repository, while the checklist is machine-wide.
+      // Until checklist observations are repository-bound, leave cell status unknown so close-a stays human.
+      const draftCreatedAt = Date.parse(draft.createdAt);
+      let newerSameCellSameCard: boolean | undefined;
+      if (identity.origin && identity.cellId && identity.cardId && Number.isFinite(draftCreatedAt)) {
+        let uncertainMatch = false;
+        newerSameCellSameCard = false;
+        for (let otherIndex = 0; otherIndex < triageDrafts.length; otherIndex++) {
+          if (otherIndex === index) continue;
+          const other = triageDrafts[otherIndex]!;
+          const otherIdentity = initial[otherIndex];
+          const otherCreatedAt = Date.parse(other.createdAt);
+          if (Number.isFinite(otherCreatedAt) && otherCreatedAt <= draftCreatedAt) continue;
+          if (otherIdentity?.origin && otherIdentity.origin !== identity.origin) continue;
+          if (otherIdentity?.cellId && otherIdentity.cellId !== identity.cellId) continue;
+          if (otherIdentity?.cardId && otherIdentity.cardId !== identity.cardId) continue;
+          if (!Number.isFinite(otherCreatedAt) || !otherIdentity?.origin || !otherIdentity.cellId || !otherIdentity.cardId) {
+            uncertainMatch = true;
+            continue;
+          }
+          newerSameCellSameCard = true;
+          break;
+        }
+        if (newerSameCellSameCard !== true && uncertainMatch) newerSameCellSameCard = undefined;
+      }
+      const ownerCard = cards ? draftTaskOwner(cards, draft) : undefined;
+      // A cell can have several cards and PRs. Terminal evidence belongs to this draft only by exact PR number;
+      // the terminal `card` field can identify the cell, not this card.
+      const cellTerminals = terminals?.filter((terminal) => terminal.repository === repository && terminal.prNumber === draft.number);
+      const activeOwnerObservation = ownerCard ? undefined : activeOwnerObservations.get(draft.number);
+      const posture = reviewGate.get(draft.number);
+      const assessment = assessDraftTriage({ draft, now, runStatus: statuses.get(draft.number),
+        ...(posture?.gate ? { gate: posture.gate } : {}),
+        ...(posture?.triageReview ? { review: posture.triageReview } : {}),
+        newerSameCellSameCard,
+        ownerConfirmed: ownerCard?.seat ? true : !activeOwnerObservation?.observed ? undefined : Boolean(activeOwnerObservation.owner?.trim()),
+      });
+      const terminalEvidence = terminals === undefined ? 'PrTerminalRecord 미관측'
+        : `PrTerminalRecord: cell=${identity.cellId ?? 'unknown'} matched=${cellTerminals?.length ?? 0}`;
+      triageRows.push({ number: draft.number, assessment: { ...assessment, evidence: [...assessment.evidence, terminalEvidence] } });
+    }
+    const triageCounts: Record<string, number> = {};
+    for (const row of triageRows) triageCounts[row.assessment.nextAction] = (triageCounts[row.assessment.nextAction] ?? 0) + 1;
+    result.triage = { entries: triageRows, counts: triageCounts };
+  }
   result.complete = true;
   let closes = Number.isSafeInteger(alreadyClosed) && alreadyClosed > 0 ? alreadyClosed : 0;
   let unobserved = 0;
@@ -907,6 +1020,8 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
   let claimExpired = 0;
   const lineageCounts: DraftSweepLineageCounts = { closed: 0, harvestableClosed: 0, fallThrough: {} };
   result.lineage = lineageCounts;
+  // 칸-keyed closes this tick; published on `lineageCounts` only when the 칸 rule fires (existing shapes stay byte-identical).
+  let cellClosed = 0;
   // Review posture for the harvestable lineage check, reusing the census lookups (one lookup per PR per tick).
   const postureFor = async (pr: SweepDraft): Promise<SweepReviewGate | undefined> => {
     if (!reviewGate.has(pr.number)) reviewGate.set(pr.number, await adapters.getReviewGate!(pr, repository));
@@ -1029,7 +1144,11 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
     // reruns open until the 24h idle expiry. It is still protected when its own review passed and the newer one's did not.
     const harvestable = draft.labels.includes(harvestableLabel);
     const lineageNewer = contradiction ? undefined : newerLineageDraft(draft, drafts);
-    if (lineageNewer) {
+    // A different goal working the same 칸 is invisible to the branch lineage key, so the canonical 칸 identity decides it.
+    // The lineage key keeps priority: a same-goal rerun stays a lineage outcome even when both drafts share the 칸.
+    const cellNewer = contradiction || lineageNewer ? undefined : newerSameCellDraft(draft, drafts);
+    const duplicateNewer = lineageNewer ?? cellNewer;
+    if (duplicateNewer) {
       const base = decideDraft({ draft, runStatus, mergedTwins: merged, openDrafts: drafts, liveBranches,
         finalRunResult, ageHours: runStatus ? ageHours : idleHours });
       if (!base.reason.startsWith('label:') && !base.reason.startsWith('superseded-by #') && !base.reason.startsWith('duplicate-of-open #')) {
@@ -1037,12 +1156,14 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
           || (status !== 'self-implement.result final' && liveBranches.has(branch));
         const runLive = live(runStatus, draft.branch);
         const lineageKey = branchLineageKey(draft.branch);
-        const reason = `duplicate-of-open #${lineageNewer.number} (lineage ${lineageKey})${runLive ? ` · stop run ${draft.runId ?? 'unknown'}` : ''}`;
+        const cellId = cellNewer ? cellIdFromBody(draft.body ?? '') : null;
+        const duplicateOf = cellNewer ? `cell ${cellId}` : `lineage ${lineageKey}`;
+        const reason = `duplicate-of-open #${duplicateNewer.number} (${duplicateOf})${runLive ? ` · stop run ${draft.runId ?? 'unknown'}` : ''}`;
         // Every lineage outcome that does not close falls through to the existing rules (preservation contract):
         // a duplicate this rule cannot settle is decided exactly as it was before this rule existed.
         const fallThrough = (why: string) => {
           lineageCounts.fallThrough[why] = (lineageCounts.fallThrough[why] ?? 0) + 1;
-          try { debug.log('self-dev.draft-sweep', 'lineage-fall-through', { number: draft.number, newer: lineageNewer.number, lineageKey, why, harvestable }); } catch { /* fail-soft */ }
+          try { debug.log('self-dev.draft-sweep', 'lineage-fall-through', { number: draft.number, newer: duplicateNewer.number, lineageKey, ...(cellId === null ? {} : { cellId }), why, harvestable }); } catch { /* fail-soft */ }
         };
         // A harvestable draft yields only to a newer draft at least as complete: an observed review PASS on the old one
         // is kept unless the newer one passed review too. Unobservable review posture keeps the old draft (fail-closed).
@@ -1051,17 +1172,19 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
           if (!adapters.getReviewGate) harvestProtection = 'lineage-harvestable-review-unobserved';
           else {
             try {
-              const [oldPosture, newPosture] = [await postureFor(draft), await postureFor(lineageNewer)];
+              const [oldPosture, newPosture] = [await postureFor(draft), await postureFor(duplicateNewer)];
               if (oldPosture === undefined) harvestProtection = 'lineage-harvestable-review-unobserved';
               else if (reviewPassed(oldPosture) && !reviewPassed(newPosture)) harvestProtection = 'lineage-harvestable-review-pass-protected';
             } catch { harvestProtection = 'lineage-harvestable-review-unobserved'; }
           }
         }
         if (harvestProtection) fallThrough(harvestProtection);
+        // `supersedeRun` is same-lineage authority only: a live 칸 duplicate is kept for the existing rules instead.
+        else if (cellNewer && runLive) fallThrough('cell-duplicate-run-live');
         else if (runLive && !adapters.supersedeRun) fallThrough('lineage-duplicate-run-live');
         // Safety (OP 10-11): a live run is stopped only when the newer run of the same lineage is itself live —
         // never trade a running attempt for one that already ended or was never observed running.
-        else if (runLive && !live(statuses.get(lineageNewer.number), lineageNewer.branch)) fallThrough('lineage-newer-run-not-live');
+        else if (runLive && !live(statuses.get(duplicateNewer.number), duplicateNewer.branch)) fallThrough('lineage-newer-run-not-live');
         else if (closes >= closeCap) {
           record({ number: draft.number, action: 'keep', reason: 'close-cap', applied: false });
           continue;
@@ -1069,9 +1192,9 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
           let stopFailed = false;
           // --apply only: the run is stopped before anything is written; a stop that cannot be confirmed writes nothing.
           if (apply && runLive) {
-            const observed = { number: draft.number, newer: lineageNewer.number, runId: draft.runId ?? null, newerRunId: lineageNewer.runId ?? null, lineageKey };
+            const observed = { number: draft.number, newer: duplicateNewer.number, runId: draft.runId ?? null, newerRunId: duplicateNewer.runId ?? null, lineageKey };
             try {
-              await adapters.supersedeRun!(draft, repository, lineageNewer);
+              await adapters.supersedeRun!(draft, repository, duplicateNewer);
               try { debug.log('self-dev.draft-sweep', 'supersede-run', observed); } catch { /* fail-soft */ }
             } catch (error) {
               stopFailed = true;
@@ -1084,6 +1207,7 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
             closes += 1;
             lineageCounts.closed += 1;
             if (harvestable) lineageCounts.harvestableClosed += 1;
+            if (cellNewer) cellClosed += 1;
             const entry: DraftSweepEntry = { number: draft.number, action: 'close', reason, statusLabel: supersededLabel, applied: false };
             record(entry);
             if (!apply) continue;
@@ -1103,6 +1227,7 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
                 closes -= 1;
                 lineageCounts.closed -= 1;
                 if (harvestable) lineageCounts.harvestableClosed -= 1;
+                if (cellNewer) cellClosed -= 1;
               }
               entry.error = String(error);
             }
@@ -1212,6 +1337,7 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
     }
   }
   timing('decide', drafts.length);
+  if (cellClosed > 0) lineageCounts.cellClosed = cellClosed;
   try { debug.log('self-dev.draft-sweep', 'lineage-summary', { ...lineageCounts, apply }); } catch { /* fail-soft */ }
   try { debug.log('self-dev.draft-sweep', 'timing', { phase: 'total', ms: Date.now() - started, count: drafts.length, closed: closes, closeCap, closeCapSource }); } catch { /* fail-soft */ }
   result.unobserved = unobserved;

package/src/self-dev/draft-triage-rules.ts

@@ -17,6 +17,12 @@ export function draftClaimState(draft: { labels: readonly string[]; updatedAt?:
   return (now.getTime() - updated) / 3_600_000 < CLAIM_IDLE_HOURS ? 'claimed' : 'expired';
 }
 
+/** DRAFT-CLAIM-AUTO-2-FU — 카드에 남은 claim 기록(`draftClaim.at`)이 아직 살아 있나 — `draftClaimState` 와 «같은 창»(CLAIM_IDLE_HOURS)을 쓴다. */
+export function draftClaimRecordLive(at: string, now: Date): boolean {
+  const updated = Date.parse(at);
+  return Number.isFinite(updated) && (now.getTime() - updated) / 3_600_000 < CLAIM_IDLE_HOURS;
+}
+
 export interface DraftTriagePr {
   number: number;
   title?: string;
@@ -30,6 +36,113 @@ export interface DraftTriagePr {
   changedFiles?: readonly string[];
   /** Latest change to each draft file, from the draft branch's commit history. Missing is not creation time. */
   latestFileChanges?: Readonly<Record<string, string>>;
+  /** Latest head commit, separate from PR updatedAt (labels/comments also update that). */
+  latestCommitAt?: string;
+}
+
+export type DraftTriageNextAction = 'close-a' | 'close-c' | 'human';
+export type DraftTriageReviewState = 'approved' | 'changes-requested' | 'commented' | 'dismissed' | 'pending' | 'unknown';
+export type DraftTriageCheck = { state: 'yes' | 'no' | 'unknown'; evidence: string };
+export interface DraftTriageAssessment {
+  origin: string | null;
+  cellId: string | null;
+  cardId: string | null;
+  gate: 'pass' | 'fail' | 'unknown';
+  review: DraftTriageReviewState;
+  cellStatus: 'green' | 'yellow' | 'red' | 'done' | 'unknown';
+  nextAction: DraftTriageNextAction;
+  checks: Readonly<Record<'provenance' | 'gate' | 'review' | 'cell-complete' | 'cell-status-repository-bound' | 'replacement-landed' | 'newer-same-card' | 'idle-48h' | 'protected' | 'recent-commit' | 'running' | 'owner-confirmed', DraftTriageCheck>>;
+  evidence: readonly string[];
+}
+
+export interface DraftTriageAssessmentInput {
+  draft: DraftTriagePr;
+  now: Date;
+  runStatus?: string;
+  gate?: 'pass' | 'fail';
+  review?: DraftTriageReviewState;
+  cellStatus?: 'green' | 'yellow' | 'red' | 'done';
+  /** Repository identity attached to the cell-status observation, when available. */
+  cellStatusRepository?: string;
+  /** Repository targeted by this triage request. */
+  targetRepository?: string;
+  newerSameCellSameCard?: boolean;
+  ownerConfirmed?: boolean;
+}
+
+const CLOSE_PROTECTED_LABELS = new Set([
+  'elanous:running', 'elanous:keep', 'elanous:release-hold', 'elanous:idea-approval',
+  'elanous:harvest-claimed', 'triage:land', 'triage:active',
+]);
+const TRIAGE_TERMINAL_RUN_STATUSES = new Set(['completed', 'failed', 'cancelled', 'abandoned', 'self-implement.result final']);
+
+/** Evidence-first recommendation. Unknown evidence always routes to a person. */
+export function assessDraftTriage(input: DraftTriageAssessmentInput): DraftTriageAssessment {
+  const { draft, now } = input;
+  const originLabels = (draft.labels ?? []).filter((name) => /^elanous:from-[a-z0-9-]+$/.test(name));
+  const origin = originLabels.length === 1 ? originLabels[0]! : null;
+  const bodyLines = (draft.body ?? '').split(/\r?\n/);
+  const cellMarkerLines = bodyLines.filter((line) => /^\s*칸\s*:/.test(line));
+  const cellRows = bodyLines.flatMap((line) => {
+    const match = /^칸:\s*([^\r\n]*)$/.exec(line);
+    return match ? [match[1]!.trim()] : [];
+  });
+  const cellValues = new Set(cellRows);
+  const cellId = cellMarkerLines.length === cellRows.length && cellRows.length > 0 && cellValues.size === 1
+    && /^[A-Z][A-Z0-9-]{2,}$/.test(cellRows[0]!) ? cellRows[0]! : null;
+  const cardMarkerLines = bodyLines.filter((line) => /^\s*카드\s*:/.test(line));
+  const cardRows = bodyLines.flatMap((line) => {
+    const match = /^카드:[ \t]*([^\r\n]+)[ \t]*$/.exec(line);
+    return match ? [match[1]!.trim()] : [];
+  });
+  const cardId = cardMarkerLines.length === cardRows.length && cardRows.length > 0
+    && cardRows.every((value) => value === cardRows[0])
+    && /^[A-Za-z0-9][A-Za-z0-9._:-]{2,}$/.test(cardRows[0]!) ? cardRows[0]! : null;
+  const provenance = Boolean(origin && cellId && cardId);
+  const latestCommit = Date.parse(draft.latestCommitAt ?? '');
+  const clock = now.getTime();
+  const ageHours = Number.isFinite(latestCommit) && Number.isFinite(clock) ? (clock - latestCommit) / 3_600_000 : NaN;
+  const protectedLabel = (draft.labels ?? []).find((name) => CLOSE_PROTECTED_LABELS.has(name));
+  const protectedState = Boolean(protectedLabel);
+  const running = input.runStatus === 'running' || input.runStatus === 'probable-running'
+    || (draft.labels ?? []).includes('elanous:running');
+  const cellComplete = input.cellStatus === 'green' || input.cellStatus === 'done';
+  const hasCellStatusRepositoryIdentity = Boolean(input.cellStatusRepository?.trim() && input.targetRepository?.trim());
+  const cellStatusRepositoryBound = hasCellStatusRepositoryIdentity
+    && input.cellStatusRepository!.trim().toLowerCase() === input.targetRepository!.trim().toLowerCase();
+  const releaseCutoff = Number.isFinite(clock) ? (() => {
+    const date = new Date(clock);
+    const cutoff = new Date(date);
+    cutoff.setUTCHours(0, 30, 0, 0); // 09:30 KST
+    return clock < cutoff.getTime() ? cutoff.getTime() - 86_400_000 : cutoff.getTime();
+  })() : NaN;
+  const recentCommit = Number.isFinite(latestCommit) && Number.isFinite(releaseCutoff) && latestCommit > releaseCutoff;
+  const runNotRunning = input.runStatus !== undefined && TRIAGE_TERMINAL_RUN_STATUSES.has(input.runStatus) && !running;
+  // Closing requires positive evidence that the head predates today's release cutoff.
+  // Missing timestamps are unknown, so they cannot authorize a close recommendation.
+  const closeEligible = provenance && !protectedState && Number.isFinite(latestCommit) && !recentCommit && runNotRunning;
+  const idle48h = Number.isFinite(ageHours) && ageHours >= 48;
+  let nextAction: DraftTriageNextAction = 'human';
+  if (closeEligible && cellComplete && cellStatusRepositoryBound) nextAction = 'close-a';
+  else if (closeEligible && idle48h && input.ownerConfirmed === true) nextAction = 'close-c';
+
+  const checks = {
+    provenance: { state: provenance ? 'yes' : 'unknown', evidence: provenance ? `origin=${origin}; cell=${cellId}; card=${cardId}` : '출처·유효 칸·카드 표지가 모두 확인되지 않음' },
+    gate: { state: input.gate === undefined ? 'unknown' : input.gate === 'pass' ? 'yes' : 'no', evidence: `gate=${input.gate ?? 'unknown'}` },
+    review: { state: input.review === undefined || input.review === 'unknown' ? 'unknown' : input.review === 'approved' ? 'yes' : 'no', evidence: `latest exact-head review=${input.review ?? 'unknown'}` },
+    'cell-complete': { state: input.cellStatus && cellStatusRepositoryBound ? (cellComplete ? 'yes' : 'no') : 'unknown', evidence: input.cellStatus ? `cell=${cellId ?? 'unknown'} status=${input.cellStatus}${cellStatusRepositoryBound ? '' : ' (저장소 귀속 미확인)'}` : `칸 상태 미관측${cellId ? ` (${cellId})` : ''}` },
+    'cell-status-repository-bound': { state: cellStatusRepositoryBound ? 'yes' : hasCellStatusRepositoryIdentity ? 'no' : 'unknown', evidence: cellStatusRepositoryBound ? `칸 상태 저장소=${input.cellStatusRepository}; 대상 저장소=${input.targetRepository}` : hasCellStatusRepositoryIdentity ? `칸 상태 저장소=${input.cellStatusRepository}; 대상 저장소=${input.targetRepository} (불일치)` : '칸 상태의 대상 저장소 귀속 미확인' },
+    'replacement-landed': { state: 'unknown', evidence: '현재 adapter는 같은 칸 병합 PR과 이 초안의 대체 관계를 증명하지 않음; follow-up 필요' },
+    'newer-same-card': { state: input.newerSameCellSameCard === undefined ? 'unknown' : input.newerSameCellSameCard ? 'yes' : 'no', evidence: `${input.newerSameCellSameCard === undefined ? '같은 칸·카드 새 draft 관계 미관측' : `same-cell-same-card-newer=${input.newerSameCellSameCard}`}; 관측 표지이며 대체 증거가 아님` },
+    'idle-48h': { state: Number.isFinite(ageHours) ? (idle48h ? 'yes' : 'no') : 'unknown', evidence: Number.isFinite(ageHours) ? `head age=${ageHours.toFixed(1)}h` : 'head commit 시각 미관측' },
+    protected: { state: protectedState ? 'yes' : 'no', evidence: protectedLabel ? `보호 표지=${protectedLabel}` : '보호 표지 없음' },
+    'recent-commit': { state: Number.isFinite(latestCommit) ? (recentCommit ? 'yes' : 'no') : 'unknown', evidence: Number.isFinite(latestCommit) ? `last commit=${draft.latestCommitAt}; cutoff=09:30 KST` : 'head commit 시각 미관측' },
+    running: { state: running ? 'yes' : runNotRunning ? 'no' : 'unknown', evidence: running ? `run=${input.runStatus ?? 'elanous:running'}` : runNotRunning ? `종결 run=${input.runStatus}` : `run 상태 미관측${input.runStatus ? ` (${input.runStatus})` : ''}` },
+    'owner-confirmed': { state: input.ownerConfirmed === undefined ? 'unknown' : input.ownerConfirmed ? 'yes' : 'no', evidence: input.ownerConfirmed === undefined ? '소유자 출처 미관측' : input.ownerConfirmed ? '고유 카드 또는 활성 claim owner 확인' : '고유 소유자 없음' },
+  } satisfies DraftTriageAssessment['checks'];
+  const evidence = Object.values(checks).map((check) => check.evidence);
+  return { origin, cellId, cardId, gate: input.gate ?? 'unknown', review: input.review ?? 'unknown',
+    cellStatus: input.cellStatus ?? 'unknown', nextAction, checks, evidence };
 }
 
 export interface DraftTriageInput {
@@ -102,7 +215,32 @@ export function laterMergedTwins(draft: DraftTriagePr, mergedTwins: readonly Dra
       || (draftSlot && slot(pr.body) === draftSlot) || (stem && branchStem(pr.branch) === stem)));
 }
 
+/**
+ * DRAFT-ZERO — explicit harvest-deferred marker: the exact PR-metadata key·value a failed run's termination
+ * path records when the draft's changes must survive the sweep for harvest. The marker line is
+ * `수확보류: harvest-deferred` (body key·value, never a label-registry entry); the value byte-matches the keep reason.
+ */
+export const HARVEST_DEFERRED_MARKER_KEY = '수확보류';
+export const HARVEST_DEFERRED_MARKER_VALUE = 'harvest-deferred';
+
+const HARVEST_DEFERRED_ROW_RE = new RegExp(`^${HARVEST_DEFERRED_MARKER_KEY}:\\s*([^\\r\\n]*)$`);
+const HARVEST_DEFERRED_CONFLICT_RE = new RegExp(`^\\s*${HARVEST_DEFERRED_MARKER_KEY}\\s*:`);
+
+/** Verified only when at least one unindented `수확보류:` body line exists and every such line carries exactly the marker value — missing, indented or conflicting lines never verify. */
+export function harvestDeferredMarker(body: string | undefined): boolean {
+  const lines = (body ?? '').split(/\r?\n/);
+  const rows = lines.flatMap((line) => {
+    const match = HARVEST_DEFERRED_ROW_RE.exec(line);
+    return match ? [match[1]!.trim()] : [];
+  });
+  return lines.filter((line) => HARVEST_DEFERRED_CONFLICT_RE.test(line)).length === rows.length
+    && rows.length > 0 && rows.every((value) => value === HARVEST_DEFERRED_MARKER_VALUE);
+}
+
 export function decideDraft({ draft, runStatus, mergedTwins, openDrafts, ageHours, liveBranches, finalRunResult }: DraftTriageInput): DraftDecision {
+  // DRAFT-ZERO — a verified harvest-deferred marker is the strongest hold: it outranks protected labels
+  // and every close rule, so a failed run's harvestable draft survives the sweep for harvest.
+  if (runStatus === 'failed' && harvestDeferredMarker(draft.body)) return { action: 'keep', reason: 'harvest-deferred' };
   const held = draft.labels?.find((label) => PROTECTED_LABELS.has(label));
   if (held) return { action: 'keep', reason: `label:${held}` };
   if (runStatus !== 'self-implement.result final' && draft.branch && liveBranches.has(draft.branch)

package/src/self-dev/fleet-reduce.ts

@@ -3,7 +3,7 @@
 //
 // 순서: 기준(origin/<base>)에서 임시 워크트리 → 조각 브랜치를 차례로 `merge --no-ff`
 //   → 충돌이면 «그 조각 ⊕ 충돌 파일»을 이름으로 대고 병합을 되돌린 뒤 멈춘다(추측으로 풀지 않는다)
-//   → 다 합쳐지면 `self gate --base <base>`(새 회귀만 빨강) → 통합 브랜치 푸시 → PR 하나(조각 PR 나열)
+//   → 다 합쳐지면 `self gate --local --base <base>`(새 회귀만 빨강) → 통합 브랜치 푸시 → PR 하나(조각 PR 나열)
 //   → 조각 PR 에 «통합 PR 로 대체됨» 코멘트(닫지는 않는다 — 사람 몫).
 // ⛔ 조각 PR 을 main 에 따로 병합하지 않는다 — 그건 `--auto-merge` 의 일이고 reduce 는 «하나로»다.
 
@@ -116,7 +116,8 @@ export async function reduceShards(opts: ReduceOptions): Promise<ReduceOutcome>
       // 게이트는 저장소 코드로 돈다 — 통합 워크트리에 의존성을 잇는다(설치 없이).
       const nm = join(opts.repoRoot, 'node_modules');
       if (existsSync(nm) && !existsSync(join(wt, 'node_modules'))) symlinkSync(nm, join(wt, 'node_modules'));
-      const g = run('bun', ['bin/elanous.mjs', 'self', 'gate', '--changed', '--base', `origin/${base}`], wt);   // 📏 `--changed` 가 없으면 rc 2 로 거절한다(첫 실물)
+      // This gate measures the local integration worktree; remote SSH availability is unrelated to the merge result.
+      const g = run('bun', ['bin/elanous.mjs', 'self', 'gate', '--local', '--changed', '--base', `origin/${base}`], wt);   // 📏 `--changed` 가 없으면 rc 2 로 거절한다(첫 실물)
       const tail = `${g.stdout}\n${g.stderr}`.trim().split('\n').slice(-6).join('\n');
       if (g.status !== 0) {
         debug.log('self-dev.reduce', 'gate-failed', { branch, merged: merged.length, rc: g.status });

package/src/self-dev/glm-credential-guard.ts

@@ -0,0 +1,77 @@
+/**
+ * GLM-NO-CREDENTIAL-FALLBACK (OP #28375 · 10-22) — 하니스 자식 공급자가 `glm`(Z.ai GLM Coding Plan 직결)인데
+ * 이 프로세스에 Z.ai 자격이 없으면, 구현 라운드를 «열기 전»에 정한다:
+ *   · OpenRouter 키가 있으면 → `openrouter` / `openrouter/z-ai/glm-5.3` 로 바꿔 발사한다(같은 GLM 계열 · 관측 한 줄).
+ *   · 둘 다 없으면 → 이유 한 줄로 발사 전에 거부한다(조용한 no-progress 라운드를 만들지 않는다).
+ *
+ * ⭐ 자격 판정은 생산 해석기 그대로다 — `zaiCodingPlanAvailable()`(키 캐시 `~/.cache/zai_api_key` → env `ZAI_API_KEY`)이
+ *   `getProviderForConfig` 가 glm 직결을 세우는 조건과 «같은» 함수이고, OpenRouter 는 `getOpenRouterApiKey()` 다.
+ * ⛔ Pod 경로는 이 판정 «전»에 이미 fail-closed 다(`pod-zai-child.ts` · 클러스터 Secret 판정). Pod 안에선 Secret 이
+ *   `ZAI_API_KEY` 를 env 로 주므로 여기는 그대로 통과한다(keep). 이 모듈은 호스트 로컬 자식·Secret 밖 경로의 받침이다.
+ * ⛔ 이 모듈은 가볍게 둔다(무거운 import 0) — dev-pipeline 이 발사 직전에 부른다.
+ */
+
+import type { ChildLlmSelection } from '../agent/run-context.js';
+import { getOpenRouterApiKey } from '../config.js';
+import { debug } from '../debug/log.js';
+import { ZAI_OPENROUTER_FALLBACK_MODEL, zaiCodingPlanAvailable } from '../llm/zai-coding-plan.js';
+
+export interface GlmCredentialProbe {
+  /** Z.ai 직결이 서나 — 기본 = 생산 `zaiCodingPlanAvailable()`. */
+  readonly zai: () => boolean;
+  /** OpenRouter 키가 있나 — 기본 = 생산 `getOpenRouterApiKey()`. */
+  readonly openrouter: () => boolean;
+}
+
+export const defaultGlmCredentialProbe: GlmCredentialProbe = {
+  zai: () => zaiCodingPlanAvailable(),
+  openrouter: () => Boolean(getOpenRouterApiKey()?.trim()),
+};
+
+export type GlmCredentialDecision =
+  | { kind: 'keep' }
+  | { kind: 'fallback'; from: string; to: string; reason: string }
+  | { kind: 'refuse'; reason: string };
+
+/** 발사 전 거부 — 호출부가 자기 오류 종류로 감싼다(dev-pipeline 은 DevPipelineError). */
+export class GlmChildCredentialError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'GlmChildCredentialError';
+  }
+}
+
+const ZAI_MISSING = 'Z.ai 자격 없음(~/.cache/zai_api_key · env ZAI_API_KEY)';
+
+/** 순수 판정 — glm 이 아니면 언제나 keep. */
+export function decideGlmChildCredential(
+  selection: Pick<ChildLlmSelection, 'provider' | 'model'> | undefined,
+  probe: GlmCredentialProbe = defaultGlmCredentialProbe,
+): GlmCredentialDecision {
+  if (!selection || selection.provider.trim().toLowerCase() !== 'glm') return { kind: 'keep' };
+  if (probe.zai()) return { kind: 'keep' };
+  const from = `glm/${selection.model}`;
+  if (probe.openrouter()) {
+    return { kind: 'fallback', from, to: `openrouter/${ZAI_OPENROUTER_FALLBACK_MODEL}`, reason: `${ZAI_MISSING} · OpenRouter 키 있음 → OpenRouter GLM 으로 발사` };
+  }
+  return {
+    kind: 'refuse',
+    reason: `child provider glm(${selection.model}) 발사 전 거부 — ${ZAI_MISSING} ⊕ OpenRouter 키 없음(~/.cache/openrouter_api_key · env OPENROUTER_API_KEY) · 자격 하나를 세우거나 --child-llm-provider 를 바꿔라`,
+  };
+}
+
+/** 발사 직전 적용 — keep 이면 같은 객체, fallback 이면 바꾼 선택, refuse 면 던진다. 결정마다 관측 한 줄. */
+export function applyGlmCredentialFallback(
+  selection: ChildLlmSelection | undefined,
+  probe: GlmCredentialProbe = defaultGlmCredentialProbe,
+): ChildLlmSelection | undefined {
+  const decision = decideGlmChildCredential(selection, probe);
+  if (decision.kind === 'keep') return selection;
+  if (decision.kind === 'fallback') {
+    debug.log('self-dev.child-llm', 'glm-no-credential-fallback', { from: decision.from, to: decision.to, reason: decision.reason }, { level: 'warn' });
+    // effort·source·codexQuotaPolicy 는 그대로 — 바뀌는 것은 «길»(provider·model)뿐이다.
+    return { ...selection!, provider: 'openrouter', model: ZAI_OPENROUTER_FALLBACK_MODEL };
+  }
+  debug.log('self-dev.child-llm', 'glm-no-credential-refused', { from: `glm/${selection!.model}`, reason: decision.reason }, { level: 'warn' });
+  throw new GlmChildCredentialError(decision.reason);
+}