elanous 0.2.35 → 0.2.37

package/src/self-dev/draft-sweep.ts

@@ -2,6 +2,7 @@ import { CLAIM_IDLE_HOURS, PR_LABELS, STALLED_DRAFT_HOURS } from '../github/pr-l
 import { debug } from '../debug/log.js';
 import { assessDraftTriage, decideDraft, draftClaimComment, draftClaimState, draftReleaseComment, laterMergedTwins, sameGoalPr, PROTECTED_LABELS, type DraftTriageAssessment, type DraftTriagePr, type DraftTriageReviewState } from './draft-triage-rules.js';
 import { cellIdFromBody } from '../pr-tool/census.js';
+import { RELEASE_PATH_LABEL } from './release-path-guard.js';
 import { cardPrNumber, draftTaskOwner, type TaskCard } from '../task-agent/task-hand.js';
 import type { PrTerminalRecord } from './draft-residue.js';
 import { branchLineageSlug } from '../cli/pr-lineage.js';
@@ -13,6 +14,7 @@ export interface SweepDraft extends DraftTriagePr {
   readonly createdAt: string;
   /** Last PR update (push, label, comment). Missing ⇒ no idle-based close; merged twins can still close. */
   readonly updatedAt?: string;
+  readonly headSha?: string;
   readonly runId?: string | null;
 }
 
@@ -26,17 +28,22 @@ export interface SweepMergedPr extends DraftTriagePr {
 export interface DraftSweepAdapters {
   /** Each call returns one complete page; a rejection must not be mistaken for an empty page. */
   listDrafts(page: number, perPage: number, repository: string): Promise<readonly SweepDraft[]>;
+  /** Optional completeness of a bounded inventory; a partial inventory can inform dry-run only. */
+  inventoryStatus?(): Promise<{ complete: boolean; reason?: string }>;
   /** Head commit time is fetched only for explicit triage, where it gates idle/close recommendations. */
   getHeadCommitTime?(repository: string, number: number): Promise<string | undefined>;
   listMerged(page: number, perPage: number, repository: string): Promise<readonly SweepMergedPr[]>;
   /** Complete closed PR inventory for the creation cohort (including closed without merge). */
   listRecentClosed?(repository: string, createdSince: Date): Promise<readonly SweepMergedPr[]>;
   /** Undefined means no run assessment; a merged twin or 24h idle draft can still authorize a close. */
-  getRunStatus(draft: SweepDraft, repository: string): Promise<string | undefined>;
+  /** Intentionally needs identity only: adapters must not couple sweep status lookup to presentation fields. */
+  getRunStatus(draft: Pick<SweepDraft, 'number' | 'branch' | 'runId'>, repository: string): Promise<string | undefined>;
   /** Undefined means liveness could not be established. */
   listLiveBranches(repository: string): Promise<ReadonlySet<string> | undefined>;
   setLabels(repository: string, number: number, change: { add: string; remove: readonly string[] }): Promise<void>;
   closeDraft(repository: string, number: number): Promise<void>;
+  /** Minimal live identity check used by snapshot apply; no repository-wide inventory is read. */
+  getDraftSnapshot?(repository: string, number: number): Promise<DraftSweepSnapshot | undefined>;
   /** Resolve the latest claim comment owner; a failed lookup must not authorize a close. */
   getClaimOwner?(repository: string, number: number): Promise<string | undefined>;
   /** Current owner, accounting for a later claim release; only draft metrics need this distinction. */
@@ -71,7 +78,28 @@ export interface DraftSweepAdapters {
    * Must reject when the run could not be stopped — the draft is then neither labelled nor closed.
    * Absent ⇒ a live duplicate is kept, never closed.
    */
-  supersedeRun?(draft: SweepDraft, repository: string, newer: SweepDraft): Promise<void>;
+  /** Same minimal identity contract as getRunStatus; stopping authority is scoped to the selected run pair. */
+  supersedeRun?(draft: Pick<SweepDraft, 'number' | 'branch' | 'runId'>, repository: string,
+    newer: Pick<SweepDraft, 'number' | 'branch' | 'runId'>): Promise<void>;
+}
+
+export interface DraftSweepSnapshot {
+  readonly number: number;
+  readonly state: 'open' | 'closed';
+  readonly draft: boolean;
+  readonly headSha: string;
+  readonly branch: string;
+  readonly updatedAt: string;
+  readonly labels: readonly string[];
+}
+
+export interface DraftSweepApplyPlan {
+  readonly version: 1;
+  readonly closeCap: number;
+  readonly closeCapSource: DraftSweepCloseCapSource;
+  readonly entries: readonly (DraftSweepEntry & { readonly headSha: string; readonly branch: string; readonly runId?: string;
+    readonly stopRunRequired?: boolean; readonly supersedeNewer?: { readonly number: number; readonly branch: string; readonly runId?: string };
+    readonly updatedAt: string; readonly labels: readonly string[] })[];
 }
 
 /** Review PASS and gate posture used only by the daily old-draft count. */
@@ -95,6 +123,10 @@ export interface DraftSweepOptions {
   alreadyClosed?: number;
   /** Include evidence-backed next-action recommendations in JSON output; never authorizes writes. */
   includeTriage?: boolean;
+  /** Build a frozen apply plan from a complete dry-run classification. */
+  includeApplyPlan?: boolean;
+  /** Apply exactly this plan after live identity preflight. */
+  applyPlan?: DraftSweepApplyPlan;
 }
 
 export interface DraftSweepEntry {
@@ -113,6 +145,7 @@ export interface DraftSweepResult {
   apply: boolean;
   complete: boolean;
   entries: DraftSweepEntry[];
+  applyPlan?: DraftSweepApplyPlan;
   triage?: { entries: Array<{ number: number; assessment: DraftTriageAssessment }>; counts: Record<string, number> };
   counts: Record<string, number>;
   /** Drafts whose run could not be observed from here (kept, or closed by the idle rule). */
@@ -260,9 +293,26 @@ export async function collectDraftMetrics(repository: string, adapters: Pick<Dra
       || (pr.mergedAt !== undefined && !Number.isFinite(Date.parse(pr.mergedAt)))
       || !Array.isArray(pr.labels) || pr.labels.some((name) => typeof name !== 'string')))
     throw new Error('Incomplete draft metric inventory');
-  if (new Set(drafts.map((pr) => pr.number)).size !== drafts.length
-    || new Set(closed.map((pr) => pr.number)).size !== closed.length) throw new Error('Duplicate draft metric PR');
-  const open = drafts.filter(harnessDraft);
+  // Fold each source independently; a merged closed row outranks an unmerged snapshot.
+  // The serialized row is a stable tie-breaker when timestamps match, regardless of page order.
+  const fold = <T extends { number: number }>(rows: readonly T[], rank: (pr: T) => readonly number[]): T[] => {
+    const byNumber = new Map<number, T>();
+    for (const row of rows) {
+      const prior = byNumber.get(row.number);
+      if (prior) {
+        const a = rank(row), b = rank(prior);
+        const order = a.reduce((result, value, index) => result || value - b[index]!, 0);
+        if (order < 0 || (order === 0 && JSON.stringify(row) <= JSON.stringify(prior))) continue;
+      }
+      byNumber.set(row.number, row);
+    }
+    return [...byNumber.values()];
+  };
+  const uniqueDrafts = fold(drafts, (pr) => [Number.isFinite(Date.parse(pr.updatedAt ?? ''))
+    ? Date.parse(pr.updatedAt!) : Date.parse(pr.createdAt), Date.parse(pr.createdAt)]);
+  const uniqueClosed = fold(closed, (pr) => [pr.mergedAt ? 1 : 0,
+    pr.mergedAt ? Date.parse(pr.mergedAt) : Date.parse(pr.createdAt!), Date.parse(pr.createdAt!)]);
+  const open = uniqueDrafts.filter(harnessDraft);
   const owners = await Promise.all(open.map(async (draft) => {
     if (!adapters.getActiveClaimOwner) throw new Error('Draft owner lookup unavailable');
     const owner = await adapters.getActiveClaimOwner(repository, draft.number);
@@ -270,9 +320,12 @@ export async function collectDraftMetrics(repository: string, adapters: Pick<Dra
     return owner;
   }));
   const cohort = [...open.filter((pr) => Date.parse(pr.createdAt) >= cutoff && Date.parse(pr.createdAt) <= matured),
-    ...closed.filter((pr) => (pr.branch.startsWith('self-impl/') || pr.labels!.some((name) => name.startsWith('elanous:')))
+    ...uniqueClosed.filter((pr) => (pr.branch.startsWith('self-impl/') || pr.labels!.some((name) => name.startsWith('elanous:')))
       && pr.createdAt && Date.parse(pr.createdAt) >= cutoff && Date.parse(pr.createdAt) <= matured)];
   if (new Set(cohort.map((pr) => pr.number)).size !== cohort.length) throw new Error('Overlapping draft metric inventory');
+  const folded = drafts.length - uniqueDrafts.length + closed.length - uniqueClosed.length;
+  if (folded) try { debug.log('drafts.metrics', 'duplicate-pr-folded', { repository, drafts: drafts.length - uniqueDrafts.length,
+    closed: closed.length - uniqueClosed.length, folded }); } catch { /* fail-soft */ }
   const converted48h = cohort.filter((pr) => 'mergedAt' in pr && typeof pr.mergedAt === 'string'
     && Date.parse(pr.mergedAt) >= Date.parse(pr.createdAt!) && Date.parse(pr.mergedAt) <= clock
     && Date.parse(pr.mergedAt) - Date.parse(pr.createdAt!) <= 48 * 3_600_000).length;
@@ -770,6 +823,17 @@ function harnessDraft(draft: SweepDraft): boolean {
   return draft.branch.startsWith('self-impl/') || draft.labels.some((name) => name.startsWith('elanous:'));
 }
 
+/** A prior final event is authoritative only when the branch is not observably live. */
+function isLiveDraftRun(status: string | undefined, branch: string, liveBranches: ReadonlySet<string>): boolean {
+  return status === 'running' || status === 'probable-running'
+    || (status !== 'self-implement.result final' && liveBranches.has(branch));
+}
+
+function isKnownSweepCloseReason(reason: string): boolean {
+  return ['superseded-by #', 'duplicate-of-open #', 'claim-expired', 'stale-unobserved', 'harvest-expired', 'stale-ended-run']
+    .some((prefix) => reason === prefix || reason.startsWith(prefix));
+}
+
 /**
  * The newest open draft of the same goal lineage that was created strictly after `draft` — a rerun
  * (e.g. a forced requeue) of the same goal. Reads only the branch, so a draft with no task card still has a lineage.
@@ -835,8 +899,130 @@ export function draftSweepDaily(
   return { date: now.toISOString().slice(0, 10), over24h, closable, harvestable, blocked };
 }
 
+/** Validate serialized plans at the CLI boundary; malformed or ambiguous plans must never reach a writer. */
+export function validateDraftSweepApplyPlan(value: unknown): DraftSweepApplyPlan {
+  if (!value || typeof value !== 'object') throw new Error('invalid draft sweep apply plan');
+  const plan = value as Partial<DraftSweepApplyPlan>;
+  if (plan.version !== 1 || !validCloseCap(plan.closeCap)
+    || !['flag', 'config', 'default'].includes(String(plan.closeCapSource)) || !Array.isArray(plan.entries)) {
+    throw new Error('invalid draft sweep apply plan header');
+  }
+  const seen = new Set<number>();
+  for (const entry of plan.entries) {
+    if (!entry || !Number.isSafeInteger(entry.number) || entry.number! < 1 || seen.has(entry.number!)
+      || !['keep', 'close', 'report'].includes(entry.action) || typeof entry.reason !== 'string'
+      || (entry.action === 'close' && !isKnownSweepCloseReason(entry.reason))
+      || typeof entry.headSha !== 'string' || !/^[a-f0-9]{40}$/i.test(entry.headSha)
+      || typeof entry.branch !== 'string' || !entry.branch
+      || (entry.statusLabel !== undefined && !stateLabels.some((state) => state.name === entry.statusLabel))
+      || (entry.supersedeNewer !== undefined && (!Number.isSafeInteger(entry.supersedeNewer.number)
+        || entry.supersedeNewer.number < 1 || entry.supersedeNewer.number === entry.number
+        || typeof entry.supersedeNewer.branch !== 'string' || !entry.supersedeNewer.branch
+        || (entry.supersedeNewer.runId !== undefined && typeof entry.supersedeNewer.runId !== 'string')))
+      || typeof entry.updatedAt !== 'string' || !Number.isFinite(Date.parse(entry.updatedAt))
+      || !Array.isArray(entry.labels) || entry.labels.some((name: unknown) => typeof name !== 'string')
+      || (entry.stopRunRequired === true && (!entry.runId || !entry.supersedeNewer?.runId))
+      || (entry.supersedeNewer !== undefined && entry.stopRunRequired !== true)) {
+      throw new Error('invalid draft sweep apply plan entry');
+    }
+    seen.add(entry.number!);
+  }
+  const closes = plan.entries.filter((entry) => entry.action === 'close').length;
+  if (closes > plan.closeCap!) throw new Error('draft sweep apply plan exceeds close cap');
+  return value as DraftSweepApplyPlan;
+}
+
+async function applyDraftSweepPlan(repository: string, adapters: DraftSweepAdapters, planInput: DraftSweepApplyPlan): Promise<DraftSweepResult> {
+  const plan = validateDraftSweepApplyPlan(planInput);
+  const result: DraftSweepResult = { repository, apply: true, complete: false, entries: plan.entries.map(({ number, action, reason, statusLabel }) => ({
+    number, action, reason, ...(statusLabel ? { statusLabel } : {}), applied: false,
+  })), counts: {}, closeCap: plan.closeCap, closeCapSource: plan.closeCapSource };
+  const writable = plan.entries.filter((entry) => entry.action !== 'report' && (entry.action === 'close' || Boolean(entry.statusLabel)));
+  const preflightEntries = new Map(writable.map((entry) => [entry.number, entry]));
+  for (const entry of writable) if (entry.supersedeNewer) {
+    const newer = plan.entries.find((candidate) => candidate.number === entry.supersedeNewer!.number);
+    if (!newer) { result.error = `snapshot apply plan missing newer PR #${entry.supersedeNewer.number}`; return result; }
+    preflightEntries.set(newer.number, newer);
+  }
+  if (!adapters.getDraftSnapshot) { result.error = 'draft snapshot preflight unavailable'; return result; }
+  // Read and validate every target before the first mutation: one stale item blocks the whole write batch.
+  const snapshots = await mapBounded([...preflightEntries.values()], DRAFT_SWEEP_CONCURRENCY, async (entry) => ({ entry,
+    current: await adapters.getDraftSnapshot!(repository, entry.number) }));
+  const drift = snapshots.find(({ entry, current }) => !current || current.number !== entry.number || current.state !== 'open'
+    || current.draft !== true || current.headSha !== entry.headSha || current.branch !== entry.branch || current.updatedAt !== entry.updatedAt
+    || current.labels.length !== entry.labels.length || [...current.labels].sort().join('\0') !== [...entry.labels].sort().join('\0'));
+  if (drift) {
+    const number = drift.entry.number;
+    result.error = `draft snapshot drift at #${number}; no writes performed`;
+    for (const entry of result.entries) if (writable.some((item) => item.number === entry.number)) entry.error = result.error;
+    return result;
+  }
+  const stopPlans = writable.filter((entry) => entry.stopRunRequired === true);
+  const stoppedRuns = new Set<number>();
+  if (stopPlans.length) {
+    if (!adapters.supersedeRun || !adapters.getRunStatus || !adapters.listLiveBranches
+      || stopPlans.some((entry) => !entry.runId || !entry.supersedeNewer?.runId)) {
+      result.error = 'snapshot apply cannot verify live duplicate run ownership';
+      return result;
+    }
+    const branches = await adapters.listLiveBranches(repository);
+    if (!branches) { result.error = 'snapshot apply cannot verify branch liveness'; return result; }
+    const liveChecks = await Promise.all(stopPlans.map(async (entry) => {
+      const newer = entry.supersedeNewer!;
+      const [oldStatus, newerStatus] = await Promise.all([
+        adapters.getRunStatus!({ number: entry.number, branch: entry.branch, runId: entry.runId }, repository),
+        adapters.getRunStatus!({ number: newer.number, branch: newer.branch, runId: newer.runId }, repository),
+      ]);
+      return { entry, newer, oldStatus, newerStatus, ok: isLiveDraftRun(oldStatus, entry.branch, branches)
+        && isLiveDraftRun(newerStatus, newer.branch, branches) };
+    }));
+    const invalid = liveChecks.find((check) => !check.ok);
+    if (invalid) { result.error = `live duplicate run state drift at #${invalid.entry.number}; no PR writes performed`; return result; }
+    for (const check of liveChecks) {
+      try {
+        await adapters.supersedeRun!({ number: check.entry.number, branch: check.entry.branch, runId: check.entry.runId }, repository,
+          { number: check.newer.number, branch: check.newer.branch, runId: check.newer.runId });
+        stoppedRuns.add(check.entry.number);
+      } catch (error) { result.error = `could not stop planned run at #${check.entry.number}: ${sweepFailureReason(error)}`; return result; }
+    }
+  }
+  for (const { entry } of snapshots) {
+    const output = result.entries.find((item) => item.number === entry.number)!;
+    let mutated = false;
+    try {
+      if (entry.action === 'close' && entry.reason.startsWith('claim-expired')) {
+        // A complete comment inventory with no owner marker is valid; incomplete/unreadable inventories throw.
+        // The owner value itself is not a close criterion; classification and updatedAt preflight own that decision.
+        if (!adapters.getClaimOwner) throw new Error('claim owner lookup unavailable');
+        await adapters.getClaimOwner(repository, entry.number);
+      }
+      if (entry.statusLabel) {
+        const remove = stateLabels.filter((item) => entry.labels.includes(item.name) && item.name !== entry.statusLabel).map((item) => item.name);
+        if (!entry.labels.includes(entry.statusLabel) || remove.length) {
+          await adapters.setLabels(repository, entry.number, { add: entry.statusLabel, remove });
+          mutated = true;
+        }
+      }
+      if (entry.action === 'close') {
+        await closeSweptDraft(adapters, repository, entry.number, entry.reason, () => { mutated = true; });
+      }
+      output.applied = mutated;
+    } catch (error) {
+      if ((mutated && entry.action === 'close') || stoppedRuns.has(entry.number)) output.partialApplied = true;
+      output.error = sweepFailureReason(error);
+      result.error = `snapshot apply failed at #${entry.number}: ${output.error}`;
+      return result;
+    }
+  }
+  result.complete = true;
+  result.closed = plan.entries.filter((entry) => entry.action === 'close').length;
+  for (const entry of result.entries) result.counts[entry.reason] = (result.counts[entry.reason] ?? 0) + 1;
+  return result;
+}
+
 /** A failed inventory or liveness lookup is never treated as proof that a draft can be closed. */
-export async function runDraftSweep({ repository, adapters, apply = false, now = new Date(), closeCap: requestedCap, closeCapSource: requestedSource, alreadyClosed = 0, includeTriage = false }: DraftSweepOptions): Promise<DraftSweepResult> {
+export async function runDraftSweep({ repository, adapters, apply = false, now = new Date(), closeCap: requestedCap, closeCapSource: requestedSource, alreadyClosed = 0, includeTriage = false, includeApplyPlan = false, applyPlan }: DraftSweepOptions): Promise<DraftSweepResult> {
+  if (applyPlan) return applyDraftSweepPlan(repository, adapters, applyPlan);
   const validCap = validCloseCap(requestedCap);
   const closeCap = validCap ?? DRAFT_SWEEP_CLOSE_CAP;
   const closeCapSource: DraftSweepCloseCapSource = validCap === undefined ? 'default' : requestedSource ?? 'flag';
@@ -871,6 +1057,7 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
   let drafts: SweepDraft[] = [];
   let merged: SweepMergedPr[] = [];
   let liveBranches: ReadonlySet<string> | undefined;
+  let inventoryStatus: { complete: boolean; reason?: string } = { complete: true };
   try {
     [drafts, merged, liveBranches] = await Promise.all([
       collectPages((page, size) => adapters.listDrafts(page, size, repository)),
@@ -880,6 +1067,7 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
     if (!liveBranches) throw new Error('Branch liveness unavailable');
     if (drafts.some((pr) => !Number.isInteger(pr.number) || !pr.branch || !Array.isArray(pr.labels) || !Number.isFinite(Date.parse(pr.createdAt)))
       || merged.some((pr) => !Number.isInteger(pr.number) || !pr.branch)) throw new Error('Invalid PR inventory');
+    inventoryStatus = await adapters.inventoryStatus?.() ?? inventoryStatus;
   } catch (error) {
     timing('inventory', drafts.length + merged.length, 'failed');
     result.error = sweepFailureReason(error);
@@ -887,6 +1075,10 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
     return finish();
   }
   timing('inventory', drafts.length + merged.length);
+  if (!inventoryStatus.complete && apply) {
+    result.error = inventoryStatus.reason ?? 'PR inventory incomplete';
+    return finish();
+  }
   for (const pr of drafts) if (pr.runId) runIdByNumber.set(pr.number, pr.runId);
   const statuses = new Map<number, string | undefined>();
   const finality = new Map<number, boolean | undefined>();
@@ -926,7 +1118,7 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
     }
     timing('review-gate', censused.length);
   }
-  result.daily = draftSweepDaily(drafts, merged, now, reviewGate);
+  if (inventoryStatus.complete) result.daily = draftSweepDaily(drafts, merged, now, reviewGate);
   // Card and terminal inventories are observations, not closing authority. An unreadable source cannot mint a claim.
   let cards: readonly TaskCard[] | undefined;
   let terminals: readonly PrTerminalRecord[] | undefined;
@@ -999,7 +1191,17 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
       const cellTerminals = terminals?.filter((terminal) => terminal.repository === repository && terminal.prNumber === draft.number);
       const activeOwnerObservation = ownerCard ? undefined : activeOwnerObservations.get(draft.number);
       const posture = reviewGate.get(draft.number);
+      const replacement = identity.cellId && identity.checks.provenance.state === 'yes'
+        ? merged.find((pr) => pr.number !== draft.number && cellIdFromBody(pr.body ?? '') === identity.cellId
+          && Number.isFinite(Date.parse(pr.mergedAt ?? '')) && Date.parse(pr.mergedAt!) > Date.parse(draft.createdAt)
+          && (pr.body ?? '').split(/\r?\n/).some((line) => line.trim() === `Supersedes: #${draft.number}`)) : undefined;
+      const lastFailure = cellTerminals?.filter((terminal) => terminal.terminalClass.startsWith('failed-')
+        && Number.isFinite(Date.parse(terminal.at)))
+        .sort((a, b) => Date.parse(b.at) - Date.parse(a.at))[0];
+      const lastFailureTail = lastFailure?.hostRegateFailure?.detail ?? lastFailure?.stage ?? null;
       const assessment = assessDraftTriage({ draft, now, runStatus: statuses.get(draft.number),
+        ...(replacement ? { replacement: { number: replacement.number, evidence: `Supersedes: #${draft.number}` } } : {}),
+        lastFailureTail,
         ...(posture?.gate ? { gate: posture.gate } : {}),
         ...(posture?.triageReview ? { review: posture.triageReview } : {}),
         newerSameCellSameCard,
@@ -1013,12 +1215,14 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
     for (const row of triageRows) triageCounts[row.assessment.nextAction] = (triageCounts[row.assessment.nextAction] ?? 0) + 1;
     result.triage = { entries: triageRows, counts: triageCounts };
   }
-  result.complete = true;
+  result.complete = inventoryStatus.complete;
+  if (!inventoryStatus.complete) result.error = inventoryStatus.reason ?? 'PR inventory incomplete';
   let closes = Number.isSafeInteger(alreadyClosed) && alreadyClosed > 0 ? alreadyClosed : 0;
   let unobserved = 0;
   let claimed = 0;
   let claimExpired = 0;
   const lineageCounts: DraftSweepLineageCounts = { closed: 0, harvestableClosed: 0, fallThrough: {} };
+  const stopRunPlans = new Map<number, { runId?: string; newer: { number: number; branch: string; runId?: string } }>();
   result.lineage = lineageCounts;
   // 칸-keyed closes this tick; published on `lineageCounts` only when the 칸 rule fires (existing shapes stay byte-identical).
   let cellClosed = 0;
@@ -1035,7 +1239,7 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
     let claimPartialApplied = false;
     let partialClaimUnowned = false;
     let releasePending = false;
-    if (apply && harnessDraft(draft) && !draft.labels.some((name) => name === approvalLabel || name === keepLabel || name === releaseHoldLabel)
+    if (apply && harnessDraft(draft) && !draft.labels.some((name) => name === approvalLabel || name === keepLabel || name === releaseHoldLabel || name === RELEASE_PATH_LABEL)
       && stateLabels.filter((state) => draft.labels.includes(state.name)).length <= 1
       && !draft.labels.includes(supersededLabel)) {
       const logClaim = (event: 'claim-marked' | 'claim-released' | 'claim-skipped', owner: string | null, runId: string | null, reason: string) =>
@@ -1128,8 +1332,10 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
       ...(claimWriteFailed ? { error: claimWriteError, ...(claimPartialApplied ? { partialApplied: true } : {}) } : {}) });
       continue;
     }
-    if (draft.labels.includes(releaseHoldLabel ?? '') || (!contradiction && draft.labels.includes(keepLabel ?? ''))) {
-      const held = draft.labels.includes(keepLabel ?? '') ? keepLabel : releaseHoldLabel;
+    if (draft.labels.includes(releaseHoldLabel ?? '') || draft.labels.includes(RELEASE_PATH_LABEL)
+      || (!contradiction && draft.labels.includes(keepLabel ?? ''))) {
+      const held = draft.labels.includes(keepLabel ?? '') ? keepLabel
+        : draft.labels.includes(RELEASE_PATH_LABEL) ? RELEASE_PATH_LABEL : releaseHoldLabel;
       record({ number: draft.number, action: 'keep', reason: `label:${held}`, applied: false });
       continue;
     }
@@ -1152,9 +1358,7 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
       const base = decideDraft({ draft, runStatus, mergedTwins: merged, openDrafts: drafts, liveBranches,
         finalRunResult, ageHours: runStatus ? ageHours : idleHours });
       if (!base.reason.startsWith('label:') && !base.reason.startsWith('superseded-by #') && !base.reason.startsWith('duplicate-of-open #')) {
-        const live = (status: string | undefined, branch: string) => status === 'running' || status === 'probable-running'
-          || (status !== 'self-implement.result final' && liveBranches.has(branch));
-        const runLive = live(runStatus, draft.branch);
+        const runLive = isLiveDraftRun(runStatus, draft.branch, liveBranches);
         const lineageKey = branchLineageKey(draft.branch);
         const cellId = cellNewer ? cellIdFromBody(draft.body ?? '') : null;
         const duplicateOf = cellNewer ? `cell ${cellId}` : `lineage ${lineageKey}`;
@@ -1184,7 +1388,7 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
         else if (runLive && !adapters.supersedeRun) fallThrough('lineage-duplicate-run-live');
         // Safety (OP 10-11): a live run is stopped only when the newer run of the same lineage is itself live —
         // never trade a running attempt for one that already ended or was never observed running.
-        else if (runLive && !live(statuses.get(duplicateNewer.number), duplicateNewer.branch)) fallThrough('lineage-newer-run-not-live');
+        else if (runLive && !isLiveDraftRun(statuses.get(duplicateNewer.number), duplicateNewer.branch, liveBranches)) fallThrough('lineage-newer-run-not-live');
         else if (closes >= closeCap) {
           record({ number: draft.number, action: 'keep', reason: 'close-cap', applied: false });
           continue;
@@ -1208,6 +1412,8 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
             lineageCounts.closed += 1;
             if (harvestable) lineageCounts.harvestableClosed += 1;
             if (cellNewer) cellClosed += 1;
+            if (runLive) stopRunPlans.set(draft.number, { runId: draft.runId ?? undefined, newer: { number: duplicateNewer.number,
+              branch: duplicateNewer.branch, runId: duplicateNewer.runId ?? undefined } });
             const entry: DraftSweepEntry = { number: draft.number, action: 'close', reason, statusLabel: supersededLabel, applied: false };
             record(entry);
             if (!apply) continue;
@@ -1345,5 +1551,24 @@ export async function runDraftSweep({ repository, adapters, apply = false, now =
   result.closed = closes - (Number.isSafeInteger(alreadyClosed) && alreadyClosed > 0 ? alreadyClosed : 0);
   result.claimed = claimed;
   result.claimExpired = claimExpired;
+  if (includeApplyPlan && !apply && result.complete) {
+    const byNumber = new Map(drafts.map((draft) => [draft.number, draft]));
+    const planEntries = result.entries.map((entry) => {
+      const draft = byNumber.get(entry.number);
+      if (!draft?.headSha || !draft.updatedAt || !Number.isFinite(Date.parse(draft.updatedAt))) {
+        throw new Error(`cannot freeze apply plan: missing head SHA or updatedAt for #${entry.number}`);
+      }
+      const stopRun = stopRunPlans.get(entry.number);
+      const newer = stopRun ? byNumber.get(stopRun.newer.number) : undefined;
+      if (stopRun && (!draft.runId || !newer?.runId || stopRun.runId !== draft.runId
+        || stopRun.newer.branch !== newer.branch || stopRun.newer.runId !== newer.runId)) {
+        throw new Error(`cannot freeze apply plan: live duplicate run identity incomplete for #${entry.number}`);
+      }
+      return { ...entry, headSha: draft.headSha, branch: draft.branch, ...(draft.runId ? { runId: draft.runId } : {}),
+        ...(stopRun ? { stopRunRequired: true, supersedeNewer: stopRun.newer } : {}),
+        updatedAt: draft.updatedAt, labels: [...draft.labels].sort() };
+    });
+    result.applyPlan = validateDraftSweepApplyPlan({ version: 1, closeCap, closeCapSource, entries: planEntries });
+  }
   return finish();
 }

package/src/self-dev/draft-triage-rules.ts

@@ -17,6 +17,12 @@ export function draftClaimState(draft: { labels: readonly string[]; updatedAt?:
   return (now.getTime() - updated) / 3_600_000 < CLAIM_IDLE_HOURS ? 'claimed' : 'expired';
 }
 
+/** DRAFT-CLAIM-AUTO-2-FU — 카드에 남은 claim 기록(`draftClaim.at`)이 아직 살아 있나 — `draftClaimState` 와 «같은 창»(CLAIM_IDLE_HOURS)을 쓴다. */
+export function draftClaimRecordLive(at: string, now: Date): boolean {
+  const updated = Date.parse(at);
+  return Number.isFinite(updated) && (now.getTime() - updated) / 3_600_000 < CLAIM_IDLE_HOURS;
+}
+
 export interface DraftTriagePr {
   number: number;
   title?: string;
@@ -34,7 +40,7 @@ export interface DraftTriagePr {
   latestCommitAt?: string;
 }
 
-export type DraftTriageNextAction = 'close-a' | 'close-c' | 'human';
+export type DraftTriageNextAction = 'close-a' | 'close-b' | 'close-c' | 'harvest' | 'human';
 export type DraftTriageReviewState = 'approved' | 'changes-requested' | 'commented' | 'dismissed' | 'pending' | 'unknown';
 export type DraftTriageCheck = { state: 'yes' | 'no' | 'unknown'; evidence: string };
 export interface DraftTriageAssessment {
@@ -45,6 +51,8 @@ export interface DraftTriageAssessment {
   review: DraftTriageReviewState;
   cellStatus: 'green' | 'yellow' | 'red' | 'done' | 'unknown';
   nextAction: DraftTriageNextAction;
+  lastFailureTail: string | null;
+  missingEvidence: readonly string[];
   checks: Readonly<Record<'provenance' | 'gate' | 'review' | 'cell-complete' | 'cell-status-repository-bound' | 'replacement-landed' | 'newer-same-card' | 'idle-48h' | 'protected' | 'recent-commit' | 'running' | 'owner-confirmed', DraftTriageCheck>>;
   evidence: readonly string[];
 }
@@ -62,11 +70,15 @@ export interface DraftTriageAssessmentInput {
   targetRepository?: string;
   newerSameCellSameCard?: boolean;
   ownerConfirmed?: boolean;
+  /** Explicit merged PR naming this draft as its same-cell predecessor. */
+  replacement?: { number: number; evidence: string };
+  /** Exact-PR terminal failure, not a failure inferred from another draft in the cell. */
+  lastFailureTail?: string | null;
 }
 
 const CLOSE_PROTECTED_LABELS = new Set([
   'elanous:running', 'elanous:keep', 'elanous:release-hold', 'elanous:idea-approval',
-  'elanous:harvest-claimed', 'triage:land', 'triage:active',
+  'elanous:harvest-claimed', RELEASE_PATH_LABEL, 'triage:land', 'triage:active',
 ]);
 const TRIAGE_TERMINAL_RUN_STATUSES = new Set(['completed', 'failed', 'cancelled', 'abandoned', 'self-implement.result final']);
 
@@ -118,7 +130,10 @@ export function assessDraftTriage(input: DraftTriageAssessmentInput): DraftTriag
   const idle48h = Number.isFinite(ageHours) && ageHours >= 48;
   let nextAction: DraftTriageNextAction = 'human';
   if (closeEligible && cellComplete && cellStatusRepositoryBound) nextAction = 'close-a';
+  else if (closeEligible && input.replacement) nextAction = 'close-b';
   else if (closeEligible && idle48h && input.ownerConfirmed === true) nextAction = 'close-c';
+  else if (provenance && (draft.labels ?? []).includes('elanous:harvestable') && !protectedState && runNotRunning
+    && input.gate === 'pass' && input.review === 'approved') nextAction = 'harvest';
 
   const checks = {
     provenance: { state: provenance ? 'yes' : 'unknown', evidence: provenance ? `origin=${origin}; cell=${cellId}; card=${cardId}` : '출처·유효 칸·카드 표지가 모두 확인되지 않음' },
@@ -126,7 +141,9 @@ export function assessDraftTriage(input: DraftTriageAssessmentInput): DraftTriag
     review: { state: input.review === undefined || input.review === 'unknown' ? 'unknown' : input.review === 'approved' ? 'yes' : 'no', evidence: `latest exact-head review=${input.review ?? 'unknown'}` },
     'cell-complete': { state: input.cellStatus && cellStatusRepositoryBound ? (cellComplete ? 'yes' : 'no') : 'unknown', evidence: input.cellStatus ? `cell=${cellId ?? 'unknown'} status=${input.cellStatus}${cellStatusRepositoryBound ? '' : ' (저장소 귀속 미확인)'}` : `칸 상태 미관측${cellId ? ` (${cellId})` : ''}` },
     'cell-status-repository-bound': { state: cellStatusRepositoryBound ? 'yes' : hasCellStatusRepositoryIdentity ? 'no' : 'unknown', evidence: cellStatusRepositoryBound ? `칸 상태 저장소=${input.cellStatusRepository}; 대상 저장소=${input.targetRepository}` : hasCellStatusRepositoryIdentity ? `칸 상태 저장소=${input.cellStatusRepository}; 대상 저장소=${input.targetRepository} (불일치)` : '칸 상태의 대상 저장소 귀속 미확인' },
-    'replacement-landed': { state: 'unknown', evidence: '현재 adapter는 같은 칸 병합 PR과 이 초안의 대체 관계를 증명하지 않음; follow-up 필요' },
+    'replacement-landed': input.replacement
+      ? { state: 'yes', evidence: `merged #${input.replacement.number}: ${input.replacement.evidence}` }
+      : { state: 'unknown', evidence: '현재 adapter는 같은 칸 병합 PR과 이 초안의 대체 관계를 증명하지 않음; follow-up 필요' },
     'newer-same-card': { state: input.newerSameCellSameCard === undefined ? 'unknown' : input.newerSameCellSameCard ? 'yes' : 'no', evidence: `${input.newerSameCellSameCard === undefined ? '같은 칸·카드 새 draft 관계 미관측' : `same-cell-same-card-newer=${input.newerSameCellSameCard}`}; 관측 표지이며 대체 증거가 아님` },
     'idle-48h': { state: Number.isFinite(ageHours) ? (idle48h ? 'yes' : 'no') : 'unknown', evidence: Number.isFinite(ageHours) ? `head age=${ageHours.toFixed(1)}h` : 'head commit 시각 미관측' },
     protected: { state: protectedState ? 'yes' : 'no', evidence: protectedLabel ? `보호 표지=${protectedLabel}` : '보호 표지 없음' },
@@ -134,9 +151,12 @@ export function assessDraftTriage(input: DraftTriageAssessmentInput): DraftTriag
     running: { state: running ? 'yes' : runNotRunning ? 'no' : 'unknown', evidence: running ? `run=${input.runStatus ?? 'elanous:running'}` : runNotRunning ? `종결 run=${input.runStatus}` : `run 상태 미관측${input.runStatus ? ` (${input.runStatus})` : ''}` },
     'owner-confirmed': { state: input.ownerConfirmed === undefined ? 'unknown' : input.ownerConfirmed ? 'yes' : 'no', evidence: input.ownerConfirmed === undefined ? '소유자 출처 미관측' : input.ownerConfirmed ? '고유 카드 또는 활성 claim owner 확인' : '고유 소유자 없음' },
   } satisfies DraftTriageAssessment['checks'];
-  const evidence = Object.values(checks).map((check) => check.evidence);
+  const missingEvidence = Object.entries(checks).filter(([, check]) => check.state === 'unknown').map(([name]) => name);
+  const evidence = [...Object.values(checks).map((check) => check.evidence),
+    ...(input.lastFailureTail ? [`last failure: ${input.lastFailureTail}`] : [])];
   return { origin, cellId, cardId, gate: input.gate ?? 'unknown', review: input.review ?? 'unknown',
-    cellStatus: input.cellStatus ?? 'unknown', nextAction, checks, evidence };
+    cellStatus: input.cellStatus ?? 'unknown', nextAction, lastFailureTail: input.lastFailureTail ?? null,
+    missingEvidence, checks, evidence };
 }
 
 export interface DraftTriageInput {
@@ -209,7 +229,32 @@ export function laterMergedTwins(draft: DraftTriagePr, mergedTwins: readonly Dra
       || (draftSlot && slot(pr.body) === draftSlot) || (stem && branchStem(pr.branch) === stem)));
 }
 
+/**
+ * DRAFT-ZERO — explicit harvest-deferred marker: the exact PR-metadata key·value a failed run's termination
+ * path records when the draft's changes must survive the sweep for harvest. The marker line is
+ * `수확보류: harvest-deferred` (body key·value, never a label-registry entry); the value byte-matches the keep reason.
+ */
+export const HARVEST_DEFERRED_MARKER_KEY = '수확보류';
+export const HARVEST_DEFERRED_MARKER_VALUE = 'harvest-deferred';
+
+const HARVEST_DEFERRED_ROW_RE = new RegExp(`^${HARVEST_DEFERRED_MARKER_KEY}:\\s*([^\\r\\n]*)$`);
+const HARVEST_DEFERRED_CONFLICT_RE = new RegExp(`^\\s*${HARVEST_DEFERRED_MARKER_KEY}\\s*:`);
+
+/** Verified only when at least one unindented `수확보류:` body line exists and every such line carries exactly the marker value — missing, indented or conflicting lines never verify. */
+export function harvestDeferredMarker(body: string | undefined): boolean {
+  const lines = (body ?? '').split(/\r?\n/);
+  const rows = lines.flatMap((line) => {
+    const match = HARVEST_DEFERRED_ROW_RE.exec(line);
+    return match ? [match[1]!.trim()] : [];
+  });
+  return lines.filter((line) => HARVEST_DEFERRED_CONFLICT_RE.test(line)).length === rows.length
+    && rows.length > 0 && rows.every((value) => value === HARVEST_DEFERRED_MARKER_VALUE);
+}
+
 export function decideDraft({ draft, runStatus, mergedTwins, openDrafts, ageHours, liveBranches, finalRunResult }: DraftTriageInput): DraftDecision {
+  // DRAFT-ZERO — a verified harvest-deferred marker is the strongest hold: it outranks protected labels
+  // and every close rule, so a failed run's harvestable draft survives the sweep for harvest.
+  if (runStatus === 'failed' && harvestDeferredMarker(draft.body)) return { action: 'keep', reason: 'harvest-deferred' };
   const held = draft.labels?.find((label) => PROTECTED_LABELS.has(label));
   if (held) return { action: 'keep', reason: `label:${held}` };
   if (runStatus !== 'self-implement.result final' && draft.branch && liveBranches.has(draft.branch)

package/src/self-dev/glm-credential-guard.ts

@@ -0,0 +1,77 @@
+/**
+ * GLM-NO-CREDENTIAL-FALLBACK (OP #28375 · 10-22) — 하니스 자식 공급자가 `glm`(Z.ai GLM Coding Plan 직결)인데
+ * 이 프로세스에 Z.ai 자격이 없으면, 구현 라운드를 «열기 전»에 정한다:
+ *   · OpenRouter 키가 있으면 → `openrouter` / `openrouter/z-ai/glm-5.3` 로 바꿔 발사한다(같은 GLM 계열 · 관측 한 줄).
+ *   · 둘 다 없으면 → 이유 한 줄로 발사 전에 거부한다(조용한 no-progress 라운드를 만들지 않는다).
+ *
+ * ⭐ 자격 판정은 생산 해석기 그대로다 — `zaiCodingPlanAvailable()`(키 캐시 `~/.cache/zai_api_key` → env `ZAI_API_KEY`)이
+ *   `getProviderForConfig` 가 glm 직결을 세우는 조건과 «같은» 함수이고, OpenRouter 는 `getOpenRouterApiKey()` 다.
+ * ⛔ Pod 경로는 이 판정 «전»에 이미 fail-closed 다(`pod-zai-child.ts` · 클러스터 Secret 판정). Pod 안에선 Secret 이
+ *   `ZAI_API_KEY` 를 env 로 주므로 여기는 그대로 통과한다(keep). 이 모듈은 호스트 로컬 자식·Secret 밖 경로의 받침이다.
+ * ⛔ 이 모듈은 가볍게 둔다(무거운 import 0) — dev-pipeline 이 발사 직전에 부른다.
+ */
+
+import type { ChildLlmSelection } from '../agent/run-context.js';
+import { getOpenRouterApiKey } from '../config.js';
+import { debug } from '../debug/log.js';
+import { ZAI_OPENROUTER_FALLBACK_MODEL, zaiCodingPlanAvailable } from '../llm/zai-coding-plan.js';
+
+export interface GlmCredentialProbe {
+  /** Z.ai 직결이 서나 — 기본 = 생산 `zaiCodingPlanAvailable()`. */
+  readonly zai: () => boolean;
+  /** OpenRouter 키가 있나 — 기본 = 생산 `getOpenRouterApiKey()`. */
+  readonly openrouter: () => boolean;
+}
+
+export const defaultGlmCredentialProbe: GlmCredentialProbe = {
+  zai: () => zaiCodingPlanAvailable(),
+  openrouter: () => Boolean(getOpenRouterApiKey()?.trim()),
+};
+
+export type GlmCredentialDecision =
+  | { kind: 'keep' }
+  | { kind: 'fallback'; from: string; to: string; reason: string }
+  | { kind: 'refuse'; reason: string };
+
+/** 발사 전 거부 — 호출부가 자기 오류 종류로 감싼다(dev-pipeline 은 DevPipelineError). */
+export class GlmChildCredentialError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'GlmChildCredentialError';
+  }
+}
+
+const ZAI_MISSING = 'Z.ai 자격 없음(~/.cache/zai_api_key · env ZAI_API_KEY)';
+
+/** 순수 판정 — glm 이 아니면 언제나 keep. */
+export function decideGlmChildCredential(
+  selection: Pick<ChildLlmSelection, 'provider' | 'model'> | undefined,
+  probe: GlmCredentialProbe = defaultGlmCredentialProbe,
+): GlmCredentialDecision {
+  if (!selection || selection.provider.trim().toLowerCase() !== 'glm') return { kind: 'keep' };
+  if (probe.zai()) return { kind: 'keep' };
+  const from = `glm/${selection.model}`;
+  if (probe.openrouter()) {
+    return { kind: 'fallback', from, to: `openrouter/${ZAI_OPENROUTER_FALLBACK_MODEL}`, reason: `${ZAI_MISSING} · OpenRouter 키 있음 → OpenRouter GLM 으로 발사` };
+  }
+  return {
+    kind: 'refuse',
+    reason: `child provider glm(${selection.model}) 발사 전 거부 — ${ZAI_MISSING} ⊕ OpenRouter 키 없음(~/.cache/openrouter_api_key · env OPENROUTER_API_KEY) · 자격 하나를 세우거나 --child-llm-provider 를 바꿔라`,
+  };
+}
+
+/** 발사 직전 적용 — keep 이면 같은 객체, fallback 이면 바꾼 선택, refuse 면 던진다. 결정마다 관측 한 줄. */
+export function applyGlmCredentialFallback(
+  selection: ChildLlmSelection | undefined,
+  probe: GlmCredentialProbe = defaultGlmCredentialProbe,
+): ChildLlmSelection | undefined {
+  const decision = decideGlmChildCredential(selection, probe);
+  if (decision.kind === 'keep') return selection;
+  if (decision.kind === 'fallback') {
+    debug.log('self-dev.child-llm', 'glm-no-credential-fallback', { from: decision.from, to: decision.to, reason: decision.reason }, { level: 'warn' });
+    // effort·source·codexQuotaPolicy 는 그대로 — 바뀌는 것은 «길»(provider·model)뿐이다.
+    return { ...selection!, provider: 'openrouter', model: ZAI_OPENROUTER_FALLBACK_MODEL };
+  }
+  debug.log('self-dev.child-llm', 'glm-no-credential-refused', { from: `glm/${selection!.model}`, reason: decision.reason }, { level: 'warn' });
+  throw new GlmChildCredentialError(decision.reason);
+}

package/src/self-dev/graph-journey-nodes.ts

@@ -42,6 +42,7 @@ export const JOURNEY_NODE_IDS = [
   'decision-card',
   'ready',
   'pr-head-checkout',
+  'recover',          // LAND-REFUSAL-EDGES — 착지 거부 결속 간선의 목적지(recover@1 subgraph)
   'stopped',
 ] as const;
 export type JourneyNodeId = typeof JOURNEY_NODE_IDS[number];