elanous 0.2.0 → 0.2.4

package/src/task-orchestrator/surfaces/self-implement-pod.ts

@@ -2,7 +2,7 @@
 //
 // 계약은 로컬 spawn(`defaultSelfImplementSpawn`)과 «같다»: 입력 → { address, done }. 그래서 분해·동시 실행 상한·
 // 감독 루프·원장이 수정 없이 따라온다(RFC-elanous-on-docker-and-kubernetes-isolation-ladder · ROADMAP C2).
-// Pod 안에서는 같은 명령 `elanous self implement "<feature>" --json …` 을 치고, 마지막 줄 JSON 을 Job 로그로 읽는다.
+// Pod 안에서는 일반 골은 `self implement`, 전달된 ask 골 문서는 `harness ask` 로 실행하고 마지막 줄 JSON 을 Job 로그로 읽는다.
 //
 // 📏 2026-09-25 실측 근거(docker/harness · docker/runner):
 //   · 자격 = 호스트 계정의 «refresh 없는» 사본(1회용 refresh 보호) — Secret(읽기 전용) → 쓰기 가능한 홈으로 복사.
@@ -12,21 +12,49 @@
 // 부작용(kubectl·파일)은 주입받는다 — 시험은 가짜 kubectl 로 누른다.
 
 import { podSkillsDigest, readSkillEnvFiles, resolvePodSkills } from './pod-skills.js';
+import { podSourceScript, type PodSource } from './pod-source-receive.js';
+import { GROUNDING_TOKEN_ENV, GROUNDING_URL_ENV, mintGroundingToken, revokeGroundingRun, type GroundingTokenScope } from '../../grounding/token.js';
+import { POD_CREDENTIAL_GROK_PATH } from '../../nexus/api/pod-credential-api.js';
+import { POD_CREDENTIAL_TOKEN_ENV, POD_CREDENTIAL_URL_ENV } from '../../grok/credential.js';
+import { collectPodLedgers, createPodLedgerFollower } from './pod-ledger-collect.js';
+import { collectPodArtifacts } from './pod-artifact-return.js';
+import { isValidAccountName, resolveCodexAccount } from '../../oauth/codex-account.js';
+import { effectiveInstanceRoot } from '../../instance/resolve.js';
 import { controlInboxEnv } from '../../harness/control-inbox.js';
 import { finishPodFragment, writePodFragment } from '../../harness/self-send-target.js';
+import { mintRunId, normalizeRunId } from '../../harness/harness-space.js';
+import { appendRunLedgerEntry, runLedgerDir, runLedgerPath } from '../../self-implement/run-ledger.js';
+import type { GoalExecutionRecord } from '../../self-implement/orchestrator.js';
+import { runHostRegate, type HostRegateResult } from '../../self-implement/host-regate.js';
 
 export const POD_CONTROL_INBOX_DIR = '/tmp/elanous-control.inbox';
+/** Pod Job 수명 상한(`activeDeadlineSeconds`) — 대표 2026-09-26 90분 → 180분(90분에 `DeadlineExceeded` 로 죽은 런 둘). */
+/** Newest pod log bytes returned when the export passes the 5MB artifact limit (headroom under it). */
+export const POD_LOGS_KEEP_BYTES = 4_500_000;
+
+export const POD_JOB_DEADLINE_SECONDS = 10_800;
+
+/** 자식 컨테이너 «요청» — 🩸 2026-09-27: limits 만 두면 k8s 가 requests=limits(cpu 4)로 잡아, 32코어 노드에
+ *  «자리 요청»이 88% 차서 잡이 Pending 인데 실사용은 14%였다(풀 25 자리 중 ~8 만 떴다). 상한(limits)은 그대로 두고
+ *  예약만 실사용에 맞춘다. */
+export const POD_CHILD_REQUESTS = { cpu: '1', memory: '4Gi' } as const;
 import type { PodPoolMember, PodPoolScheduler } from './pod-pool.js';
+import { ACTUAL_SUBSTRATE_ENV, RUN_CONTRACT_ENV, carryRunContract, completionFloorFor } from '../../self-implement/graph-run-contract.js';
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { readFileSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { isAbsolute, join, normalize, relative, resolve, sep } from 'node:path';
+import { findGitDir } from '../../git-fs/locate.js';
 import { debug } from '../../debug/log.js';
 import { authStorePath } from '../../oauth/store.js';
+import { grokAuthFilePath, resolveGrokCredential } from '../../grok/credential.js';
+import { defaultGrokModel } from '../../grok/models.js';
 import { resolveHostId } from '../../platform/host-id.js';
+import { envLiteral } from '../../platform/env-literal.js';
 import { LLM_TIER_MAP_BY_PROVIDER, lookupLlmTierSpec, type LlmTierProvider } from '../../model-tier/llm-tier-map.js';
 import { parseSelfImplementJson, type SelfImplementJobDone, type SelfImplementJobSpawn } from './self-implement.js';
+import { codexQuotaPolicyFromConfig } from '../../oauth/codex-account-store.js';
 
 export type Kubectl = (args: readonly string[], input?: string) => { status: number | null; stdout: string; stderr: string };
 
@@ -37,12 +65,22 @@ export interface PodSpawnOptions {
   account?: string;
   /** Job 마다 계정을 고른다(pod-account-broker) — 있으면 `account` 보다 먼저. */
   accountBroker?: () => string;
+  /** Usable codex accounts from the broker; the allocated account is moved to the front per Job. */
+  rotationAccounts?: readonly string[];
+  /** 미지정이면 종전 Codex Job. */
+  provider?: 'openai-codex' | 'grok';
+  /** 🔐 API 키 과금 허용은 명시 true 뿐. */
+  grokApiKeyOptIn?: boolean;
   namespace?: string;
   /** 클러스터 안 이미지(`docker/harness/run.sh` 가 만드는 `elanous-harness:local`). */
   image?: string;
   repoUrl?: string;
+  /** 원천 — 없으면 종전 `git clone --depth 50`. bundle 이면 apply 뒤 kubectl cp 로 싣는다. */
+  source?: PodSource;
   /** 호스트 환경에서 읽어 Pod env 로 넣을 키 이름(예: OPENROUTER_API_KEY · ANTHROPIC_API_KEY) — 벤치마크 과금 경로. */
   passEnv?: readonly string[];
+  /** 호스트가 재발사를 소유하면 Pod 자식의 자체 감독을 끈다. 독립 호출 기본 true; 실제 CLI 호스트는 자기 감독 상태를 명시한다. */
+  hostSupervised?: boolean;
   /** 자식 `self implement` 에 덧붙일 인자. */
   extraArgs?: readonly string[];
   /** Pod 에 그대로 넣을 «비밀 아닌» env — 벤치 팔의 `ELANOUS_LLM_PROVIDER`·`ELANOUS_LLM_MODEL`·`ELANOUS_ARM_ID`. */
@@ -51,14 +89,24 @@ export interface PodSpawnOptions {
   deadlineSeconds?: number;
   pollMs?: number;
   kubectl?: Kubectl;
+  /** Host-side regate (injected for Pod tests). */
+  hostRegate?: (input: { prNumber: number; headCommit: string; repoRoot: string }) => Promise<HostRegateResult>;
+  /** PR comment for host-regate failures that never reached runHostRegate (injectable for tests). */
+  ghComment?: (prNumber: number, body: string) => void;
   /** 🔑 Pod 필수 스킬의 키(.env)를 이 런의 Secret 으로 넘긴다 — 명시 opt-in(유료 크레딧을 쓴다). */
   skillEnv?: boolean;
   /** 스킬 키 읽기(시험 주입) — `{ <스킬>: <.env 내용> }`. */
   readSkillEnv?: () => Record<string, string>;
   /** ☸️ 여러 클러스터 풀(pod-pool.ts) — Job 마다 우선순위 순 첫 빈 자리로. 없으면 현재 컨텍스트 하나. */
   pool?: PodPoolScheduler;
+  /** ☸️ 원격 그라운딩 주소(P13) — 없으면 호스트 env ELANOUS_GROUNDING_URL → 설정 pod.groundingUrl. 셋 다 없으면 토큰을 안 만든다. */
+  groundingUrl?: string;
+  /** 시험 심 — 토큰 발급·회수. scope 는 그라운딩 발급에는 안 넘기고, grok 구독 중계 발급에만 'llm-credential' 로 넘긴다. */
+  mintGrounding?: (claims: { runId: string; job: string; ttlMs: number; scope?: GroundingTokenScope }) => Promise<{ token: string; exp: number }>;
+  revokeGrounding?: (runId: string) => void;
   sleep?: (ms: number) => Promise<void>;
-  credentials?: () => { elanousAuth: string; codexAuth: string; ghToken: string };
+  credentials?: (account: string) => { elanousAuth: string; codexAuth: string; ghToken: string };
+  grokCredentials?: () => { grokAuth?: string; grokApiKey?: string; ghToken: string };
   /** 호스트 키 캐시(`~/.cache/<소문자 이름>`)에서 키를 읽는다(시험 주입) — env 에 없을 때. */
   readKeyCache?: (name: string) => string | undefined;
   env?: NodeJS.ProcessEnv;
@@ -83,31 +131,129 @@ export function podJobName(spaceId: string): string {
 export function hostCredentials(account: string, storePath: string = authStorePath(), ghToken: () => string = defaultGhToken): { elanousAuth: string; codexAuth: string; ghToken: string } {
   // 경로는 해석기로(격리 게이트 · 2026-09-25) — 손으로 `~/.elanous/auth.json` 을 조립하면 test↔prod 격리가 새는 자리가 된다.
   const store = JSON.parse(readFileSync(storePath, 'utf8')) as { version?: number; providers: Record<string, Record<string, unknown>> };
-  const entry = store.providers[`openai-codex:${account}`] as { tokens: Record<string, unknown>; lastRefresh?: string; authMode?: string; codexHome?: string } | undefined;
-  if (!entry?.codexHome) throw new Error(`openai-codex:${account} 계정이 없거나 codexHome 을 모른다`);
-  const codex = JSON.parse(readFileSync(join(entry.codexHome, 'auth.json'), 'utf8')) as { tokens: Record<string, unknown> };
+  // ⭐ 기본 계정은 정본 키가 `openai-codex`(이름 없음)이고 홈을 안 적는다 — 기본 위치로 푼다(회전 후보와 같은 해석).
+  const storeKey = account === 'default' ? 'openai-codex' : `openai-codex:${account}`;
+  const entry = store.providers[storeKey] as { tokens: Record<string, unknown>; lastRefresh?: string; authMode?: string; codexHome?: string } | undefined;
+  const codexHome = entry?.codexHome ?? (entry && account === 'default' ? resolveCodexAccount(envLiteral({ CODEX_HOME: process.env.CODEX_HOME })).home : undefined);
+  if (!entry || !codexHome) throw new Error(`${storeKey} 계정이 없거나 codexHome 을 모른다`);
+  const codex = JSON.parse(readFileSync(join(codexHome, 'auth.json'), 'utf8')) as { tokens: Record<string, unknown> };
   const access = String(codex.tokens.access_token ?? '');
   const exp = Number(JSON.parse(Buffer.from(access.split('.')[1] ?? '', 'base64url').toString('utf8') || '{}').exp ?? 0);
   if (exp * 1000 - Date.now() < 3 * 3600_000) throw new Error(`openai-codex:${account} access token 이 3시간 안에 만료 — 호스트에서 먼저 갱신(컨테이너는 갱신 못 한다)`);
   const elanousAuth = JSON.stringify({
     version: store.version ?? 1,
-    providers: { 'openai-codex': { tokens: { ...entry.tokens, refreshToken: '' }, lastRefresh: entry.lastRefresh, authMode: entry.authMode, chatGPT: { accountId: codex.tokens.account_id } } },
+    // ⭐ P4(2026-09-26): elanous 사본도 «방금 검사한» codex 홈의 토큰으로 싣는다 — 두 저장소는 따로 갱신된다.
+    //   🩸 실측: third 는 elanous 쪽 토큰이 4시간 전에 만료됐고 codex 홈 쪽은 235시간 남아 있었다 → Pod 가 갱신 400 으로 첫 호출 전에 죽었다(할당량 소진으로 오분류).
+    providers: { 'openai-codex': { tokens: { ...entry.tokens, accessToken: access, expiresAt: exp * 1000, refreshToken: '' }, lastRefresh: entry.lastRefresh, authMode: entry.authMode, chatGPT: { accountId: codex.tokens.account_id } } },
   });
   const codexAuth = JSON.stringify({ ...codex, tokens: { ...codex.tokens, refresh_token: '' } });
   return { elanousAuth, codexAuth, ghToken: ghToken() };
 }
 
+/** resolveGrokCredential 과 동일한 출처를 읽되 Pod 로는 refresh 없는 access 사본만 보낸다. */
+export function hostGrokCredentials(opts: {
+  home?: string; env?: NodeJS.ProcessEnv; apiKeyOptIn?: boolean; ghToken?: () => string;
+} = {}): { grokAuth?: string; grokApiKey?: string; ghToken: string } {
+  const credential = resolveGrokCredential({ home: opts.home, env: opts.env });
+  if (credential?.kind === 'subscription') {
+    const scopes = JSON.parse(readFileSync(grokAuthFilePath(opts.home), 'utf8')) as Record<string, unknown>;
+    const redacted: Record<string, { key: string; expires_at?: string; user_id?: string }> = {};
+    for (const [name, value] of Object.entries(scopes)) {
+      if (!value || typeof value !== 'object' || Array.isArray(value)) continue;
+      const scope = value as Record<string, unknown>;
+      if (scope.key !== credential.token) continue;
+      redacted[name] = {
+        key: scope.key,
+        ...(typeof scope.expires_at === 'string' ? { expires_at: scope.expires_at } : {}),
+        ...(typeof scope.user_id === 'string' ? { user_id: scope.user_id } : {}),
+      };
+    }
+    if (!Object.keys(redacted).length) throw new Error('grok: 구독 access 토큰 없음');
+    return { grokAuth: JSON.stringify(redacted), ghToken: (opts.ghToken ?? defaultGhToken)() };
+  }
+  if (credential?.kind === 'api_key' && opts.apiKeyOptIn === true) {
+    return { grokApiKey: credential.token, ghToken: (opts.ghToken ?? defaultGhToken)() };
+  }
+  throw new Error('grok: 구독 자격 없음 · API 키 opt-in 꺼짐 또는 키 없음');
+}
+
 /** 키 캐시 관례: `~/.cache/<env 이름 소문자>`(예: OPENROUTER_API_KEY → ~/.cache/openrouter_api_key · src/config.ts 와 같다). */
 function defaultReadKeyCache(name: string): string | undefined {
   try { const v = readFileSync(join(homedir(), '.cache', name.toLowerCase()), 'utf8').trim(); return v || undefined; } catch { return undefined; }
 }
 
-function defaultGhToken(): string {
+export function defaultGhToken(): string {
   const r = spawnSync('gh', ['auth', 'token'], { encoding: 'utf8' });
   if (r.status !== 0 || !r.stdout.trim()) throw new Error('gh auth token 실패 — 호스트에서 gh auth login');
   return r.stdout.trim();
 }
 
+/** Job 스크립트의 salvage 단계 — 자식 rc 가 0 이 아닐 때만, 변경·미푸시 커밋이 있는 격리 워크트리를 `salvage/<job>/<worktree>` 로 push.
+ *  main·self-impl/ 로는 절대 안 민다. 실패해도 제어 흐름을 바꾸지 않는다(호출자는 이 뒤에 `exit $rc`). */
+export function podSalvageScript(): string {
+  return [
+    'if [ "${rc:-0}" -ne 0 ]; then',
+    '  job_name="${ELANOUS_POD_NAME:-unknown-job}"',
+    '  salvage_any=0',
+    '  while IFS= read -r wt; do',
+    '    [ -n "$wt" ] || continue',
+    '    case "$wt" in',
+    '      /*) ;;',
+    "      *) printf 'ELANOUS_POD_SALVAGE_NONE bad-worktree-path\\n'; continue ;;",
+    '    esac',
+    '    wt_name=$(basename -- "$wt")',
+    '    case "$wt_name" in',
+    "      ''|.*|*/*|*'..'*) printf 'ELANOUS_POD_SALVAGE_NONE bad-worktree-name\\n'; continue ;;",
+    '    esac',
+    '    branch="salvage/${job_name}/${wt_name}"',
+    '    case "$branch" in',
+    '      salvage/*) ;;',
+    "      *) printf 'ELANOUS_POD_SALVAGE_NONE refused-prefix\\n'; continue ;;",
+    '    esac',
+    '    case "$branch" in',
+    "      main|self-impl|self-impl/*) printf 'ELANOUS_POD_SALVAGE_NONE refused-prefix\\n'; continue ;;",
+    '    esac',
+    '    (',
+    '      set +e',
+    '      cd -- "$wt" || { printf \'ELANOUS_POD_SALVAGE_NONE cd-failed\\n\'; exit 0; }',
+    '      git rev-parse --is-inside-work-tree >/dev/null 2>&1 || { printf \'ELANOUS_POD_SALVAGE_NONE not-a-worktree\\n\'; exit 0; }',
+    '      dirty=0',
+    '      git diff --quiet || dirty=1',
+    '      git diff --cached --quiet || dirty=1',
+    '      if [ -n "$(git ls-files --others --exclude-standard)" ]; then dirty=1; fi',
+    '      ahead=0',
+    '      if git rev-parse --verify HEAD >/dev/null 2>&1; then',
+    "        if git rev-parse --abbrev-ref --symbolic-full-name '@{u}' >/dev/null 2>&1; then",
+    "          if [ \"$(git rev-list --count '@{u}..HEAD' 2>/dev/null || true)\" != 0 ]; then ahead=1; fi",
+    '        else',
+    '          if git rev-parse --verify origin/HEAD >/dev/null 2>&1; then',
+    '            base=$(git rev-parse origin/HEAD)',
+    '          elif git rev-parse --verify origin/main >/dev/null 2>&1; then',
+    '            base=$(git rev-parse origin/main)',
+    '          else',
+    '            base=$(git rev-list --max-parents=0 HEAD 2>/dev/null | head -n 1)',
+    '          fi',
+    '          if [ -n "$base" ] && [ "$(git rev-list --count "${base}..HEAD" 2>/dev/null || true)" != 0 ]; then ahead=1; fi',
+    '        fi',
+    '      fi',
+    '      if [ "$dirty" -eq 0 ] && [ "$ahead" -eq 0 ]; then',
+    "        printf 'ELANOUS_POD_SALVAGE_NONE clean\\n'",
+    '        exit 0',
+    '      fi',
+    '      if [ "$dirty" -eq 1 ]; then',
+    "        git add -A -- . || { printf 'ELANOUS_POD_SALVAGE_NONE add-failed\\n'; exit 0; }",
+    '        git commit -m "salvage: ${job_name} rc=${rc}" || { printf \'ELANOUS_POD_SALVAGE_NONE commit-failed\\n\'; exit 0; }',
+    '      fi',
+    '      git push origin "HEAD:refs/heads/${branch}" || { printf \'ELANOUS_POD_SALVAGE_NONE push-failed\\n\'; exit 0; }',
+    '      commit=$(git rev-parse HEAD) || { printf \'ELANOUS_POD_SALVAGE_NONE rev-parse-failed\\n\'; exit 0; }',
+    "      printf 'ELANOUS_POD_SALVAGE %s %s\\n' \"$branch\" \"$commit\"",
+    '    )',
+    '    salvage_any=1',
+    "  done < <(git worktree list --porcelain | awk '/^worktree / { sub(/^worktree /, \"\"); print }')",
+    "  if [ \"$salvage_any\" -eq 0 ]; then printf 'ELANOUS_POD_SALVAGE_NONE no-worktree\\n'; fi",
+    'fi',
+  ].join('\n');
+}
 const GATE = `ok=0
 for i in $(seq 1 60); do
   if curl -s -m 1 -o /dev/null http://host.orb.internal:31415/health || curl -s -m 1 -o /dev/null http://core.elanous-prod:8080/; then ok=0; else ok=$((ok+1)); fi
@@ -116,48 +262,196 @@ for i in $(seq 1 60); do
 done
 echo "[gate] ISOLATION NOT ENFORCED within 30s"; exit 1`;
 
+/** Only the allocated account is active; each candidate has its own read-only Secret files and writable Codex home. */
+/** The host's codex quota policy, exported into the Pod so the child rotates onto credits like the host does. */
+function podQuotaPolicyExport(policy: string = codexQuotaPolicyFromConfig()): string {
+  return `export ELANOUS_CODEX_QUOTA_POLICY='${policy.replace(/[^a-z-]/g, '')}'`;
+}
+
+function podCodexAccountScript(accounts: readonly string[]): string {
+  if (!accounts.length || new Set(accounts).size !== accounts.length || accounts.some((name) => !isValidAccountName(name))) throw new Error('pod: 유효하고 서로 다른 codex 계정이 필요하다');
+  return [
+    'mkdir -p "$HOME/.elanous" "$HOME/.codex"',
+    // Names travel as JSON data, never as shell syntax. Reconstruct the account-store keys that elanous resolves at runtime.
+    `POD_CODEX_ACCOUNTS='${JSON.stringify(accounts)}' bun -e 'const fs=require("node:fs"),path=require("node:path");const names=JSON.parse(process.env.POD_CODEX_ACCOUNTS),home=process.env.HOME;const providers={};let version;for(let i=0;i<names.length;i++){const payload=JSON.parse(fs.readFileSync("/creds/codex-"+i+".json","utf8"));const row=JSON.parse(payload.elanousAuth);if(i===0)version=row.version;const entry=row.providers["openai-codex"];if(!entry)throw Error("missing codex account credential "+i);const codexHome=path.join(home,".elanous/codex-accounts",String(i));fs.mkdirSync(codexHome,{recursive:true});fs.writeFileSync(path.join(codexHome,"auth.json"),payload.codexAuth,{mode:0o600});fs.chmodSync(path.join(codexHome,"auth.json"),0o600);providers[names[i]==="default"?"openai-codex":"openai-codex:"+names[i]]={...entry,codexHome}}if(!providers["openai-codex"])providers["openai-codex"]=providers["openai-codex:"+names[0]];fs.writeFileSync(path.join(home,".elanous/auth.json"),JSON.stringify({version,providers}),{mode:0o600});fs.chmodSync(path.join(home,".elanous/auth.json"),0o600);fs.copyFileSync(path.join(home,".elanous/codex-accounts/0/auth.json"),path.join(home,".codex/auth.json"));fs.chmodSync(path.join(home,".codex/auth.json"),0o600)' || exit 5`,
+    `export ELANOUS_CODEX_ACCOUNT='${accounts[0]!.replace(/'/g, `'\\''`)}'`,
+    'export ELANOUS_CODEX_ACCOUNT_HOME="$HOME/.elanous/codex-accounts/0" CODEX_HOME="$HOME/.elanous/codex-accounts/0"',
+    podQuotaPolicyExport(),
+  ].join('\n');
+}
+
 /** Job 매니페스트(JSON) — docker/harness/job.yaml 과 같은 격리(관문 ⊕ 읽기 전용 Secret ⊕ 한도). */
-export function podJobManifest(o: { name: string; namespace: string; image: string; repoUrl: string; args: readonly string[]; passEnv: readonly string[]; deadlineSeconds: number; runId?: string; armEnv?: Readonly<Record<string, string>>; hostId?: string; imageCommit?: string | null; skillEnvs?: readonly string[]; memoryLimit?: string }): Record<string, unknown> {
+/** k8s 라벨 값 규칙(63자 이하 · 영숫자로 시작·끝 · 가운데 `-_.`) 밖은 정리한다. 비면 undefined. */
+export function k8sLabelValue(value: string | undefined): string | undefined {
+  const cleaned = (value ?? '').replace(/[^A-Za-z0-9._-]+/g, '-').slice(0, 63).replace(/^[^A-Za-z0-9]+|[^A-Za-z0-9]+$/g, '');
+  return cleaned || undefined;
+}
+
+/** `elanous.run` = 사람이 보는 하니스 런(오케스트레이터 · `ELANOUS_RUN_ID`) — `harness stop <runId>` 와 오케스트레이터의 신호 정리(#21171)가
+ *  이 라벨로 Job 을 고른다. 자식 런 id 는 `elanous.child-run`. */
+export function podRunLabels(o: { runId?: string; parentRunId?: string }): Record<string, string> {
+  const run = k8sLabelValue(o.parentRunId ?? o.runId);
+  const child = k8sLabelValue(o.runId);
+  return { ...(run ? { 'elanous.run': run } : {}), ...(child && child !== run ? { 'elanous.child-run': child } : {}) };
+}
+
+/** Pod 메모리 «등급» — 대표 09-27: PWA Pod 골이 16Gi 에서 OOM 으로 죽는다 ⇒ «high» 등급을 옵션으로 고른다.
+ *  등급 = `standard`(`ELANOUS_POD_MEMORY` 또는 16Gi) · `high`(`ELANOUS_POD_MEMORY_HIGH` 또는 32Gi · standard 보다 작아지지 않는다).
+ *  고르는 순서(앞이 이긴다): ① 발사 옵션 `--pod-memory <등급>`(→ `ELANOUS_POD_MEMORY_TIER`) ② 골 문면 한 줄 `Pod 메모리: high` ③ 자동 — 골 문면에 `apps/pwa/` 면 high ④ standard.
+ *  node-b 노드 할당 가능 약 251Gi. */
+export const POD_MEMORY_DEFAULT = '16Gi';
+export const POD_MEMORY_HIGH_DEFAULT = '32Gi';
+export const POD_MEMORY_TIERS = ['standard', 'high'] as const;
+export type PodMemoryTier = (typeof POD_MEMORY_TIERS)[number];
+export type PodMemorySource = 'option' | 'goal-line' | 'pwa-auto' | 'default';
+const PWA_PATH = /(?:^|[\s`'"(,·])apps\/pwa\//m;
+const GOAL_LINE = /^\s*(?:Pod 메모리|pod-memory)\s*:\s*(standard|high)\s*$/im;
+
+export function goalTouchesPwa(feature: string): boolean {
+  return PWA_PATH.test(feature);
+}
+
+export function parsePodMemoryTier(v: string | undefined): PodMemoryTier | null {
+  const t = v?.trim().toLowerCase();
+  return t && (POD_MEMORY_TIERS as readonly string[]).includes(t) ? (t as PodMemoryTier) : null;
+}
+
+function memoryGi(v: string): number | null {
+  const m = /^(\d+(?:\.\d+)?)(Gi|Mi)$/.exec(v);
+  if (!m) return null;
+  return m[2] === 'Gi' ? Number(m[1]) : Number(m[1]) / 1024;
+}
+
+export function podMemoryLimitFor(feature: string, env: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>>): { limit: string; tier: PodMemoryTier; source: PodMemorySource } {
+  const option = parsePodMemoryTier(env.ELANOUS_POD_MEMORY_TIER);
+  const line = parsePodMemoryTier(GOAL_LINE.exec(feature)?.[1]);
+  const [tier, source]: [PodMemoryTier, PodMemorySource] = option ? [option, 'option']
+    : line ? [line, 'goal-line']
+    : goalTouchesPwa(feature) ? ['high', 'pwa-auto']
+    : ['standard', 'default'];
+  const base = env.ELANOUS_POD_MEMORY?.trim() || POD_MEMORY_DEFAULT;
+  if (tier === 'standard') return { limit: base, tier, source };
+  const high = env.ELANOUS_POD_MEMORY_HIGH?.trim() || POD_MEMORY_HIGH_DEFAULT;
+  const a = memoryGi(base), b = memoryGi(high);
+  return { limit: a !== null && b !== null && a > b ? base : high, tier, source };
+}
+
+export function podJobManifest(o: { name: string; namespace: string; image: string; /** 레지스트리 이미지면 IfNotPresent(노드가 pull) · 반입 이미지면 Never. */ imagePullPolicy?: 'Never' | 'IfNotPresent'; repoUrl: string; source?: PodSource; args: readonly string[]; passEnv: readonly string[]; deadlineSeconds: number; runId?: string; parentRunId?: string; armEnv?: Readonly<Record<string, string>>; hostId?: string; imageCommit?: string | null; skillEnvs?: readonly string[]; memoryLimit?: string; goalDoc?: string; grokCredential?: 'subscription' | 'api_key'; codexAccounts?: readonly string[] }): Record<string, unknown> {
   const quoted = o.args.map((a) => `'${a.replace(/'/g, `'\\''`)}'`).join(' ');
+  const goalPath = o.goalDoc ? `'${(o.goalDoc.startsWith('-') ? `./${o.goalDoc}` : o.goalDoc).replace(/'/g, `'\\''`)}'` : undefined;
+  const askBaseIndex = o.goalDoc ? o.args.indexOf('--base') : -1;
+  const quotedAsk = (askBaseIndex >= 0 && o.args[askBaseIndex + 1]
+    ? ` '--base' '${o.args[askBaseIndex + 1]!.replace(/'/g, `'\\''`)}'`
+    : '') + (o.goalDoc && o.args.includes('--merge-by-host') ? ' --merge-by-host' : o.goalDoc && o.args.includes('--open-pr') && !o.args.includes('--auto-merge') ? ' --no-auto-merge' : '')
+    + (o.goalDoc && o.args.includes('--no-supervise') ? ' --no-supervise' : '');
   const script = [
     'set -u',
-    'mkdir -p ~/.elanous ~/.codex && cp /creds/elanous-auth.json ~/.elanous/auth.json && cp /creds/codex-auth.json ~/.codex/auth.json && chmod 600 ~/.elanous/auth.json ~/.codex/auth.json',
+    o.grokCredential === 'subscription'
+      ? 'mkdir -p ~/.grok && install -m 600 /creds/grok-auth.json ~/.grok/auth.json && export ELANOUS_LLM_PROVIDER=grok'
+      : o.grokCredential === 'api_key'
+        ? 'mkdir -p ~/.grok && install -m 600 /creds/grok-api-key ~/.grok/api-key && export XAI_API_KEY="$(cat ~/.grok/api-key)" && export ELANOUS_LLM_PROVIDER=grok'
+        : o.codexAccounts ? podCodexAccountScript(o.codexAccounts) : `mkdir -p ~/.elanous ~/.codex && cp /creds/elanous-auth.json ~/.elanous/auth.json && cp /creds/codex-auth.json ~/.codex/auth.json && chmod 600 ~/.elanous/auth.json ~/.codex/auth.json\n${podQuotaPolicyExport()}`,
     'export GH_TOKEN="$(cat /creds/gh-token)"',
     // 🔑 스킬 키(.env) — 이미지엔 없다. 이 런의 Secret 에서 각 스킬 폴더로 0600 복사(값은 로그에 안 나온다).
     ...(o.skillEnvs?.length ? [`for n in ${o.skillEnvs.join(' ')}; do [ -d ~/.claude/skills/$n ] && install -m 600 /creds/skillenv-$n ~/.claude/skills/$n/.env; done; echo "[pod] skill env: ${o.skillEnvs.join(',')}"`] : []),
     'git config --global user.name "elanous pod child" && git config --global user.email "noreply@anthropic.com" && gh auth setup-git',
     'curl -s -m 3 -o /dev/null http://host.orb.internal:31415/health && { echo "[pod] ISOLATION FAIL"; exit 3; }',
-    `git clone -q --depth 50 '${o.repoUrl}' repo && cd repo || exit 5`,
-    // self implement 의 마지막 줄 JSON 이 «맨 끝»이어야 한다(parseSelfImplementJson) — rollup 은 그 앞에.
-    `elanous self implement "$(cat /creds/feature)" --json ${quoted} > /tmp/si.out 2>&1; rc=$?`,
+    podSourceScript(o.source ?? { kind: 'default' }, o.repoUrl),
+    ...(goalPath ? [
+      `mkdir -p -- "$(dirname -- ${goalPath})" && cp -- /creds/goal-doc ${goalPath} || exit 6`,
+    ] : []),
+    // Only fixed command shapes leave the Pod; arbitrary argv (including shell -c text) is never emitted.
+    `(while :; do { mem=$(if [ -r /sys/fs/cgroup/memory.current ]; then cat /sys/fs/cgroup/memory.current; elif [ -r /sys/fs/cgroup/memory/memory.usage_in_bytes ]; then cat /sys/fs/cgroup/memory/memory.usage_in_bytes; else printf -- -; fi); top=$(ps -eo rss=,comm=,args= --sort=-rss | head -5 | awk 'function encode(s) { gsub(/%/, "%25", s); gsub(/:/, "%3A", s); gsub(/ /, "%20", s); gsub(/\\t/, "%09", s); return s } { rss=$1; name=$2; sub(/^[[:space:]]*[0-9]+[[:space:]]+[^[:space:]]+[[:space:]]*/, ""); n=split($0, a, /[[:space:]]+/); cmd="<redacted>"; if (name=="sleep" && a[2]=="30") cmd="sleep 30" (n>2 ? " <redacted>" : ""); else if (name=="bun") { cmd="bun <redacted>"; if (a[2]=="test") cmd="bun test <redacted>"; else if (a[2]=="run") cmd="bun run <redacted>"; else if ((a[2]=="x" || a[2]=="exec") && a[3]=="tsc") cmd="bun x tsc <redacted>" } else if (name=="tsc") cmd="tsc <redacted>"; else if (name=="elanous") { cmd="elanous <redacted>"; if (a[2]=="self") cmd="elanous self <redacted>"; else if (a[2]=="harness") cmd="elanous harness <redacted>" } else if (name=="node") cmd="node <redacted>"; if (name=="sleep" && cmd=="<redacted>") cmd="sleep <redacted>"; else if (cmd=="<redacted>" && name!="bash" && name!="sh") name="other"; printf " %s:%s:%s", rss, encode(name), encode(substr(cmd,1,120)) }'); printf "ELANOUS_MEM %s %s%s\\n" "$(date +%s)" "$mem" "$top"; } || true; sleep 15 || break; done) & mem_sampler_pid=$!`,
+    // 마지막 줄 JSON 이 «맨 끝»이어야 한다(parseSelfImplementJson) — rollup 은 그 앞에.
+    goalPath
+      ? `elanous harness ask ${goalPath} --json${quotedAsk} > /tmp/si.out 2>&1; rc=$?; bun -e 'const fs=require("fs");const p="/tmp/si.out";const s=fs.readFileSync(p,"utf8");const line=s.trimEnd().split("\\n").at(-1);try{const o=JSON.parse(line);if(o.kind==="self"&&o.result&&typeof o.result==="object")fs.appendFileSync(p,"\\n"+JSON.stringify({...o.result,...(typeof o.ok==="boolean"?{ok:o.ok}:{})})+"\\n")}catch{}'`
+      : `elanous self implement "$(cat /creds/feature)" --json ${quoted} > /tmp/si.out 2>&1; rc=$?`,
     'cat /tmp/si.out',
     '[ -f scripts/usage-rollup.ts ] && bun scripts/usage-rollup.ts --since 12h || echo "ELANOUS_USAGE_ROLLUP {\"measured\":false,\"reason\":\"no rollup script\"}"',
+    // A long run's log export can pass the 5MB artifact limit; skipping it whole left no window into why a
+    // 2h+ child failed (🅢 09-27). Keep the newest lines under the limit instead, and say so.
+    `if mkdir -p "$HOME/outbox/pod-logs" && elanous logs --all --include-test --since 12h --limit 20000 --json > "$HOME/outbox/pod-logs/logs.jsonl"; then
+  logs_size=$(( $(wc -c < "$HOME/outbox/pod-logs/logs.jsonl") ))
+  if [ "$logs_size" -gt ${POD_LOGS_KEEP_BYTES} ]; then
+    tail -c ${POD_LOGS_KEEP_BYTES} "$HOME/outbox/pod-logs/logs.jsonl" | tail -n +2 > "$HOME/outbox/pod-logs/logs.jsonl.tail" && mv -f "$HOME/outbox/pod-logs/logs.jsonl.tail" "$HOME/outbox/pod-logs/logs.jsonl"
+    printf 'ELANOUS_POD_LOGS_TRUNCATED %s %s\\n' "$logs_size" "$(( $(wc -c < "$HOME/outbox/pod-logs/logs.jsonl") ))"
+  fi
+else
+  logs_rc=$?
+  rm -f "$HOME/outbox/pod-logs/logs.jsonl"
+  printf 'ELANOUS_POD_LOGS_UNAVAILABLE export-exit-%s\\n' "$logs_rc"
+fi`,
+    `set -o pipefail
+artifact_bytes=0
+if [ -d "$HOME/outbox" ]; then
+  while IFS= read -r -d '' file; do
+    [ -f "$file" ] && [ ! -L "$file" ] || continue
+    relative=\${file#"$HOME/outbox/"}
+    size=$(( $(wc -c < "$file") ))
+    if [ "$size" -gt 5242880 ] || [ $((artifact_bytes + size)) -gt 20971520 ]; then
+      printf 'ELANOUS_POD_ARTIFACT_SKIPPED %s %s\\n' "$relative" "$size"
+      continue
+    fi
+    path_token=$(printf '%s' "$relative" | base64 | tr -d '\\n' | tr '+/' '-_' | tr -d '=')
+    if encoded=$(gzip -c "$file" | base64 | tr -d '\\n'); then
+      artifact_bytes=$((artifact_bytes + size))
+      total=$(( (\${#encoded} + 7999) / 8000 ))
+      for ((n=1; n<=total; n++)); do
+        chunk=\${encoded:$(( (n-1)*8000 )):8000}
+        printf 'ELANOUS_POD_ARTIFACT %s %s/%s %s\\n' "$path_token" "$n" "$total" "$chunk"
+      done
+    else
+      printf 'ELANOUS_POD_ARTIFACT_SKIPPED %s %s\\n' "$relative" "$size"
+    fi
+  done < <(find "$HOME/outbox" -type f -print0)
+fi
+found=0
+for ledger in "\${ELANOUS_STATE_DIR:-$HOME/.elanous}"/run-ledger/*.jsonl; do
+  [ -f "$ledger" ] || continue
+  found=1
+  run_id=\${ledger##*/}; run_id=\${run_id%.jsonl}
+  if encoded=$(gzip -c "$ledger" | base64 | tr -d '\\n'); then
+    total=$(( (\${#encoded} + 7999) / 8000 ))
+    for ((n=1; n<=total; n++)); do
+      chunk=\${encoded:$(( (n-1)*8000 )):8000}
+      printf 'ELANOUS_RUN_LEDGER %s %s/%s %s\\n' "$run_id" "$n" "$total" "$chunk"
+    done
+  else
+    echo "[pod] ledger transfer failed: $run_id" >&2
+  fi
+done
+if [ "$found" -eq 0 ]; then echo ELANOUS_RUN_LEDGER_NONE; fi`,
+    'kill "$mem_sampler_pid" 2>/dev/null || true',
+    'wait "$mem_sampler_pid" 2>/dev/null || true',
     'tail -n 1 /tmp/si.out',
+    podSalvageScript(),
     'exit $rc',
   ].join('\n');
   return {
     apiVersion: 'batch/v1',
     kind: 'Job',
-    metadata: { name: o.name, namespace: o.namespace, labels: { 'elanous.substrate': 'pod', 'elanous.job': o.name } },
+    metadata: { name: o.name, namespace: o.namespace, labels: { 'elanous.substrate': 'pod', 'elanous.job': o.name, ...podRunLabels(o) } },
     spec: {
       backoffLimit: 0,
       ttlSecondsAfterFinished: 7200,
       activeDeadlineSeconds: o.deadlineSeconds,
       template: {
         // ⭐ Pod 라벨 — local 팔만 `elanous.egress/local-llm` 을 단다. docker/h1/policy-local-llm.yaml 이 그 라벨에만 호스트 LLM 포트 «하나»를 연다.
-        metadata: { labels: { 'elanous.job': o.name, ...(o.armEnv?.ELANOUS_LLM_PROVIDER === 'local' ? { 'elanous.egress/local-llm': 'true' } : {}) } },
+        metadata: { labels: { 'elanous.job': o.name, ...podRunLabels(o), ...(o.armEnv?.ELANOUS_LLM_PROVIDER === 'local' ? { 'elanous.egress/local-llm': 'true' } : {}) } },
         spec: {
           restartPolicy: 'Never',
           securityContext: { runAsUser: 1000, fsGroup: 1000 },
-          initContainers: [{ name: 'isolation-gate', image: o.image, imagePullPolicy: 'Never', command: ['bash', '-c'], args: [GATE] }],
+          initContainers: [{ name: 'isolation-gate', image: o.image, imagePullPolicy: o.imagePullPolicy ?? 'Never', command: ['bash', '-c'], args: [GATE] }],
           containers: [{
-            name: 'child', image: o.image, imagePullPolicy: 'Never',
-            // 📏 09-25: 6Gi 는 빠듯했다 — 자식이 6,127Mi 에 붙어 OOMKilled(137). 기본 12Gi · ELANOUS_POD_MEMORY 로 조정.
-            resources: { limits: { memory: o.memoryLimit ?? '12Gi', cpu: '4' } },
+            name: 'child', image: o.image, imagePullPolicy: o.imagePullPolicy ?? 'Never',
+            // 📏 09-25: 6Gi 는 빠듯했다 — 자식이 6,127Mi 에 붙어 OOMKilled(137) → 12Gi.
+            // 📏 09-27: 12Gi 에서도 OOMKilled 셋(구현 노드 도중) — 같은 골을 16Gi 로 다시 쏘니 끝까지 갔다(#20930) → 기본 16Gi.
+            //   요청(4Gi · POD_CHILD_REQUESTS)과 따로라 자리 계산은 안 바뀐다. ELANOUS_POD_MEMORY 로 조정.
+            resources: { requests: { ...POD_CHILD_REQUESTS }, limits: { memory: o.memoryLimit ?? POD_MEMORY_DEFAULT, cpu: '4' } },
             command: ['bash', '-c'], args: [script],
             env: [
-              // 토큰 관측(`llm.usage`)이 부모 런에 묶이게 — debug.log 는 ELANOUS_RUN_ID 를 data.runId 로 붙인다.
               ...(o.runId ? [{ name: 'ELANOUS_RUN_ID', value: o.runId }] : []),
+              ...(o.parentRunId ? [{ name: 'ELANOUS_PARENT_RUN_ID', value: o.parentRunId }] : []),
               { name: 'ELANOUS_SUBSTRATE', value: 'pod' },
               ...Object.entries(controlInboxEnv(POD_CONTROL_INBOX_DIR)).map(([name, value]) => ({ name, value })),
               // ⭐ 런 출처(🅣 RFC run-origin §A3 · #20457/#20468 칸 이름) — Pod 는 자기 elanous_id 를 쓰지 않고 «띄운 감독기»의 hostId 를 물려받는다.
@@ -166,6 +460,8 @@ export function podJobManifest(o: { name: string; namespace: string; image: stri
               { name: 'ELANOUS_POD_NAMESPACE', valueFrom: { fieldRef: { fieldPath: 'metadata.namespace' } } },
               ...(o.hostId ? [{ name: 'ELANOUS_HOST_ID', value: o.hostId }] : []),
               ...(o.imageCommit ? [{ name: 'ELANOUS_IMAGE_COMMIT', value: o.imageCommit }] : []),
+              // ⭐ 런 계약(graph-run-contract.ts) — 이 칸이 «실제로» Pod 이고, 부모가 정한 계약도 Pod 다. 안의 그래프가 노드마다 대조한다.
+              { name: ACTUAL_SUBSTRATE_ENV, value: 'pod' }, { name: RUN_CONTRACT_ENV, value: carryRunContract({ substrate: 'pod' }) },
               ...Object.entries(o.armEnv ?? {}).map(([name, value]) => ({ name, value })),
               ...o.passEnv.map((key) => ({ name: key, valueFrom: { secretKeyRef: { name: `${o.name}-creds`, key: `env-${key}` } } })),
             ],
@@ -178,24 +474,50 @@ export function podJobManifest(o: { name: string; namespace: string; image: stri
   };
 }
 
+async function waitForRunningPod(kubectl: Kubectl, namespace: string, job: string, sleep: (ms: number) => Promise<void>): Promise<string | null> {
+  for (let i = 0; i < 60; i++) {
+    const listed = kubectl(['-n', namespace, 'get', 'pods', '-l', `job-name=${job}`, '-o', 'jsonpath={range .items[*]}{.metadata.name} {.status.phase}{"\\n"}{end}']);
+    const running = listed.stdout.split('\n').map((line) => line.trim().split(/\s+/)).find((parts) => parts[1] === 'Running');
+    if (running?.[0]) return running[0];
+    await sleep(250);
+  }
+  return null;
+}
+
+function defaultGhComment(prNumber: number, body: string): void {
+  const r = spawnSync('gh', ['pr', 'comment', String(prNumber), '--body', body], { cwd: findGitDir(process.cwd())?.root ?? process.cwd(), encoding: 'utf8', timeout: 60_000 });
+  if (r.status !== 0) throw new Error((r.stderr || r.error?.message || `gh exited ${r.status}`).trim().slice(0, 200));
+}
+
 export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplementJobSpawn {
   const baseKubectl = options.kubectl ?? defaultKubectl;
   const sleep = options.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));
   const namespace = options.namespace ?? 'elanous-test';
   const image = options.image ?? 'elanous-harness:local';
-  const repoUrl = options.repoUrl ?? 'https://github.com/ElanvitalAI/monad';
+  const repoUrl = options.repoUrl ?? 'https://github.com/ElanvitalAI/elanous';
   const env = options.env ?? process.env;
+  const hostSupervised = options.hostSupervised ?? true;
   return (input) => {
     const name = podJobName(input.spaceId);
+    const { limit: memoryLimit, tier: memoryTier, source: memorySource } = podMemoryLimitFor(input.feature, env);
+    debug.log('self-implement.pod', 'memory-limit', { spaceId: input.spaceId, memoryLimit, tier: memoryTier, source: memorySource });
+    const childRunId = mintRunId();
+    const parentRunId = env.ELANOUS_RUN_ID?.trim();
     const address = `self-impl:${input.spaceId}`;
+    const ledgerDir = runLedgerDir(env.ELANOUS_STATE_DIR);
     const args = [
       ...(input.base ? ['--base', input.base] : []),
-      ...(input.autoMerge ? ['--auto-merge'] : []),
+      ...(input.autoMerge ? ['--merge-by-host'] : []),
       ...(input.autoReview ? ['--auto-review'] : []),
-      ...(input.openPr ? ['--open-pr'] : []),
+      // ⭐ 계약이 미래 노드를 바꾼다(첫 규칙): Pod 는 끝나면 사라지므로 완료 하한 = PR. 작업 트리로만 끝나면 결과가 Pod 와 함께 없어진다.
+      //   ⚠️ 임시 안전망(🅢 2026-09-26) — 🅣 의 «종결 하한 오버레이»(그래프 쪽)가 서면 이 줄을 지우고 그것으로 바꾼다(채널 합의).
+      ...(input.openPr || (!input.autoMerge && completionFloorFor({ substrate: 'pod' }) === 'pr') ? ['--open-pr'] : []),
       ...(input.draft === false ? ['--no-draft'] : []),
+      ...(hostSupervised ? ['--no-supervise'] : []),
       ...(options.extraArgs ?? []),
+      ...(options.provider === 'grok' ? ['--child-llm-provider', 'grok', '--child-llm-model', defaultGrokModel().id] : []),
     ];
+    debug.log('pod.self-implement', 'child-supervise', { hostSupervised, childSupervise: !hostSupervised });
     const done = (async (): Promise<SelfImplementJobDone> => {
       // ☸️ 풀이면 자리를 잡는다(우선순위 순 · 다 차면 기다린다) — 그 노드의 컨텍스트로 모든 호출을 묶는다.
       let member: PodPoolMember | null = null;
@@ -212,40 +534,272 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
       const context = member?.context ?? (currentContext?.status === 0 ? currentContext.stdout.trim() : '');
       const kubectl: Kubectl = (args, stdin) => baseKubectl(['--context', context, ...args], stdin);
       let recorded = false;
+      let groundingMinted: string | null = null;
       try {
       if (!context) return { exitCode: 1, output: '', error: { code: 'pod-context', message: 'Pod Job context를 확인할 수 없다' } };
       const cleanupSecret = () => { kubectl(['-n', namespace, 'delete', 'secret', `${name}-creds`, '--ignore-not-found']); };
+      const collectFullLogs = (unavailableEvent: string, replace?: ReadonlySet<string>, onEvent?: (event: string, data: Record<string, unknown>) => void, childId?: string): { status: 'ok' | 'unavailable' | 'incomplete'; childLedgerIncomplete: boolean; samples: ReturnType<typeof parseMemSamples> } => {
+        let full: ReturnType<Kubectl>;
+        try {
+          full = kubectl(['-n', namespace, 'logs', `job/${name}`, '-c', 'child']);
+          if (full.status !== 0) throw new Error(full.stderr || `kubectl logs exited ${full.status}`);
+          if (!full.stdout && unavailableEvent === 'failed-job-logs-unavailable') throw new Error('empty child logs');
+        } catch (error) {
+          debug.log('self-implement.pod', unavailableEvent, { job: name, reason: error instanceof Error ? error.message : String(error) });
+          return { status: 'unavailable', childLedgerIncomplete: false, samples: [] };
+        }
+        let ledgerIncomplete = false;
+        let childLedgerIncomplete = false;
+        let artifactIncomplete = false;
+        const record = (category: string, event: string, data: Record<string, unknown>) => {
+          if (event === 'ledger-collect-incomplete' || event === 'ledger-collect-skipped') {
+            ledgerIncomplete = true;
+            if (childId && (data.runId === childId || !data.runId)) childLedgerIncomplete = true;
+          }
+          if (event === 'artifact-collect-incomplete' || event === 'artifact-collect-skipped') artifactIncomplete = true;
+          debug.log(category, event, data);
+          onEvent?.(event, data);
+        };
+        try { collectPodLedgers(full.stdout, { dir: ledgerDir, ...(replace ? { replace } : {}), log: record }); }
+        catch (error) { record('self-implement.pod', 'ledger-collect-incomplete', { job: name, reason: error instanceof Error ? error.message : String(error) }); }
+        try {
+          collectPodArtifacts(full.stdout, { dir: join(effectiveInstanceRoot(), 'pod-artifacts'), job: name, log: record });
+        }
+        catch (error) { record('self-implement.pod', 'artifact-collect-incomplete', { job: name, reason: error instanceof Error ? error.message : String(error) }); }
+        return { status: ledgerIncomplete || artifactIncomplete ? 'incomplete' : 'ok', childLedgerIncomplete, samples: parseMemSamples(full.stdout) };
+      };
+      let retryAccount: string | undefined;
+      let failedAccount: string | undefined;
+      let usageLimitRetried = false;
+      for (;;) {
       try {
-        const account = options.accountBroker?.() ?? options.account ?? 'team';
+        const grok = options.provider === 'grok';
+        const account = retryAccount ?? (grok ? 'grok' : options.accountBroker?.() ?? options.account ?? 'team');
         debug.log('self-implement.pod', 'account', { spaceId: input.spaceId, account, brokered: Boolean(options.accountBroker) });
-        const creds = (options.credentials ?? (() => hostCredentials(account)))();
+        const codexAccounts = grok || !options.accountBroker || !options.rotationAccounts ? undefined : [account, ...options.rotationAccounts.filter((candidate) => candidate !== account && candidate !== failedAccount)];
+        if (codexAccounts && !options.rotationAccounts!.includes(account)) throw new Error(`pod: 배분 계정 ${account} 이 회전 계획에 없다`);
+        if (codexAccounts && new Set(options.rotationAccounts).size !== options.rotationAccounts!.length) throw new Error('pod: 유효하고 서로 다른 codex 계정이 필요하다');
+        const accountCredentials = options.credentials ?? hostCredentials;
+        if (codexAccounts) podCodexAccountScript(codexAccounts);
+        const codexCredentials = codexAccounts?.map((candidate) => {
+          const credential = accountCredentials(candidate);
+          const elanous = JSON.parse(credential.elanousAuth) as { providers?: Record<string, { tokens?: { refreshToken?: unknown } }> };
+          const codex = JSON.parse(credential.codexAuth) as { tokens?: { refresh_token?: unknown } };
+          if (!elanous.providers?.['openai-codex']?.tokens || elanous.providers['openai-codex'].tokens.refreshToken || !codex.tokens || codex.tokens.refresh_token) {
+            throw new Error(`pod: ${candidate} 자격에 refresh 토큰이 있거나 인증 파일이 없다`);
+          }
+          return credential;
+        });
+        const creds = grok
+          ? (options.grokCredentials ?? (() => hostGrokCredentials({ env, apiKeyOptIn: options.grokApiKeyOptIn })))()
+          : codexCredentials?.[0] ?? accountCredentials(account);
+        if (grok && !('grokAuth' in creds && creds.grokAuth) && !('grokApiKey' in creds && creds.grokApiKey && options.grokApiKeyOptIn === true)) {
+          throw new Error('grok: 구독 자격 없음 · API 키 opt-in 꺼짐 또는 키 없음');
+        }
+        if (grok && 'grokAuth' in creds && creds.grokAuth) {
+          let parsed: unknown;
+          try { parsed = JSON.parse(creds.grokAuth); } catch { throw new Error('grok: Pod 구독 자격 JSON 이 아니다'); }
+          if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed) || !Object.values(parsed).some((scope) => scope && typeof scope === 'object' && typeof (scope as { key?: unknown }).key === 'string') || /"[^\"]*refresh[^\"]*"\s*:/i.test(creds.grokAuth)) {
+            throw new Error('grok: Pod 구독 자격에 access 토큰이 없거나 refresh 필드가 있다');
+          }
+        }
+        // Grok 자격은 전용 Secret 키 하나로만 보낸다 — passEnv 의 API 키 중복 전달은 막는다.
+        const passKeys = grok
+          ? (options.passEnv ?? []).filter((key) => !['XAI_API_KEY', 'GROK_API_KEY', 'GROK_CODE_XAI_API_KEY'].includes(key))
+          : options.passEnv ?? [];
         const skillEnvs: Record<string, string> = options.skillEnv
           ? (options.readSkillEnv ?? (() => readSkillEnvFiles(resolvePodSkills(env).skills)))()
           : {};
         if (options.skillEnv) debug.log('self-implement.pod', 'skill-env', { job: name, skills: Object.keys(skillEnvs) });   // ⛔ 이름만 — 값은 안 싣는다
+        // ⭐ 원격 그라운딩(P13): 주소가 설정돼 있으면 이 런 전용·짧은 수명 토큰을 발급해 Secret 으로만 싣는다(값은 로그에 안 싣는다).
+        const groundingUrl = (options.groundingUrl ?? env[GROUNDING_URL_ENV] ?? (options.kubectl ? undefined : configGroundingUrl()))?.trim() || undefined;   // kubectl 주입(=시험)이면 사용자 설정을 읽지 않는다
+        const groundingRunId = env.ELANOUS_RUN_ID?.trim() || input.spaceId;
+        const groundingTtlMs = (options.deadlineSeconds ?? POD_JOB_DEADLINE_SECONDS) * 1000;
+        const mint = options.mintGrounding ?? mintGroundingToken;
+        const grounding = groundingUrl
+          ? await mint({ runId: groundingRunId, job: name, ttlMs: groundingTtlMs })
+          : null;
+        groundingMinted = grounding ? groundingRunId : null;
+        debug.log('self-implement.pod', grounding ? 'grounding-token-issued' : 'grounding-token-skipped', { job: name, ...(grounding ? { runId: groundingRunId, exp: grounding.exp } : { reason: 'no-grounding-url' }) });
+        // grok 구독 access(~2시간) < Job 수명. 중계 토큰은 그라운딩과 같은 runId 로만 발급하고, 회수는 아래 finally 의 revokeGroundingRun 한 경로가 닫는다.
+        const grokSubscription = grok && 'grokAuth' in creds && Boolean(creds.grokAuth);
+        const credentialRelay = grokSubscription && groundingUrl
+          ? await mint({ runId: groundingRunId, job: name, ttlMs: groundingTtlMs, scope: 'llm-credential' })
+          : null;
+        if (credentialRelay) {
+          groundingMinted = groundingRunId;
+          debug.log('self-implement.pod', 'credential-relay', { job: name, runId: groundingRunId, exp: credentialRelay.exp });
+        } else if (grokSubscription && !groundingUrl) {
+          debug.log('self-implement.pod', 'credential-relay-skipped', { reason: 'no-host-url' });
+        }
+        const requestedGoalDoc = env.ELANOUS_POD_GOAL_DOC;
+        const requestedPath = requestedGoalDoc ? normalize(requestedGoalDoc) : undefined;
+        if (requestedPath && (isAbsolute(requestedPath) || requestedPath === '..' || requestedPath.startsWith(`..${sep}`) || requestedPath === '.')) {
+          throw new Error(`ELANOUS_POD_GOAL_DOC must be a repository-relative file: ${requestedGoalDoc}`);
+        }
+        const repoRoot = requestedPath ? findGitDir(process.cwd())?.root : undefined;
+        if (requestedPath && !repoRoot) throw new Error('ELANOUS_POD_GOAL_DOC requires a Git repository');
+        const goalFile = requestedPath ? realpathSync(resolve(repoRoot!, requestedPath)) : undefined;
+        const relativeGoalFile = goalFile ? relative(realpathSync(repoRoot!), goalFile) : undefined;
+        if (relativeGoalFile && (relativeGoalFile === '..' || relativeGoalFile.startsWith(`..${sep}`) || isAbsolute(relativeGoalFile))) throw new Error('ELANOUS_POD_GOAL_DOC outside repository');
+        const originalGoal = goalFile ? readFileSync(goalFile, 'utf8') : undefined;
+        // The orchestrator appends its identity after the executable feature, before
+        // dependency handoffs. A quoted heading or pieceIndex example is not a stamp.
+        // The stamp is the LAST identity heading followed only by the end or by the
+        // handoffs the orchestrator appends after it. The shard body itself may quote
+        // those handoff headings, so splitting at the first one would hide the stamp.
+        const normalizedFeature = input.feature.replace(/\r\n/g, '\n');
+        const stampPattern = /\n\n## Shard identity\n(\{[^\n]*\})(?=$|\n\n## (?:Dependency outputs|Dependency handoff|Working-memory handoff)\n)/g;
+        let stamp: RegExpExecArray | null = null;
+        for (const match of normalizedFeature.matchAll(stampPattern)) stamp = match as RegExpExecArray;
+        const executableFeature = stamp
+          ? normalizedFeature.slice(0, stamp.index + stamp[0].length)
+          : normalizedFeature.split(/\n\n## (?:Dependency outputs|Dependency handoff|Working-memory handoff)\n/, 1)[0]!;
+        const goalBody = originalGoal?.replace(/\r\n/g, '\n').split(/^## 실행 기록(?:\n|$)/m, 1)[0]?.trim();
+        // A stamp already present in the goal document is an example, not a new
+        // orchestration identity. Compare the entire input, not the unstamped body:
+        // a real shard can have precisely the same body as the parent goal.
+        const isOriginalDocument = [originalGoal?.replace(/\r\n/g, '\n').trim(), goalBody]
+          .some((text) => text !== undefined && (executableFeature.trim() === text || executableFeature.trim() === text.replace(/;;/gu, '; ;')));
+        let shard = false;
+        if (originalGoal !== undefined && stamp && !isOriginalDocument) {
+          try {
+            const parsed: unknown = JSON.parse(stamp[1]!);
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+              const id = parsed as Record<string, unknown>;
+              const count = id.totalShards;
+              const prefix = executableFeature.slice(0, stamp.index);
+              const summary = prefix.trim().replace(/\s+/g, ' ');
+              const expectedSummary = !summary ? '(empty shard)' : summary.length <= 240 ? summary : `${summary.slice(0, 239)}…`;
+              shard = Number.isInteger(count) && (count as number) >= 1
+                && typeof id.orchestrationId === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id.orchestrationId)
+                && typeof id.shardId === 'string' && /^task:[0-9a-f-]+$/i.test(id.shardId)
+                && Number.isInteger(id.position) && (id.position as number) >= 1 && (id.position as number) <= (count as number)
+                && id.summary === expectedSummary && Array.isArray(id.siblings)
+                && id.siblings.length === (count as number) - 1
+                && id.siblings.every((sibling: unknown) => sibling && typeof sibling === 'object' && !Array.isArray(sibling)
+                  && typeof (sibling as { shardId?: unknown }).shardId === 'string'
+                  && /^task:[0-9a-f-]+$/i.test((sibling as { shardId: string }).shardId)
+                  && (sibling as { shardId: string }).shardId !== id.shardId
+                  && typeof (sibling as { summary?: unknown }).summary === 'string');
+            }
+          } catch { /* Invalid stamp: preserve the goal-document route. */ }
+        }
+        const mode = shard ? 'shard-feature' : requestedPath ? 'goal-doc' : 'feature';
+        debug.log('self-implement.pod', 'goal-doc-mode', { spaceId: input.spaceId, mode, reason: shard ? 'shard-identity' : requestedPath ? 'goal-doc-env' : 'no-goal-doc' });
+        const goalDoc = shard ? undefined : requestedPath;
+        const goalDocument = goalDoc ? originalGoal : undefined;
         const secret = {
           apiVersion: 'v1', kind: 'Secret', type: 'Opaque',
           metadata: { name: `${name}-creds`, namespace, labels: { 'elanous.job': name } },
           stringData: {
-            'elanous-auth.json': creds.elanousAuth, 'codex-auth.json': creds.codexAuth, 'gh-token': creds.ghToken, feature: input.feature,
+            ...(grok
+              ? ('grokAuth' in creds && creds.grokAuth
+                ? { 'grok-auth.json': creds.grokAuth }
+                : { 'grok-api-key': (creds as { grokApiKey: string }).grokApiKey })
+              : codexCredentials
+                ? Object.fromEntries(codexCredentials.map((candidate, i) => [`codex-${i}.json`, JSON.stringify({ elanousAuth: candidate.elanousAuth, codexAuth: candidate.codexAuth })]))
+                : { 'elanous-auth.json': (creds as ReturnType<typeof hostCredentials>).elanousAuth, 'codex-auth.json': (creds as ReturnType<typeof hostCredentials>).codexAuth }),
+            'gh-token': creds.ghToken, feature: input.feature,
+            ...(goalDocument !== undefined ? { 'goal-doc': goalDocument } : {}),
             ...Object.fromEntries(Object.entries(skillEnvs).map(([n, text]) => [`skillenv-${n}`, text])),
-            ...Object.fromEntries((options.passEnv ?? []).map((k) => [k, env[k] ?? (options.readKeyCache ?? defaultReadKeyCache)(k)] as const).filter(([, v]) => v).map(([k, v]) => [`env-${k}`, v!])),
+            ...(grounding ? { [`env-${GROUNDING_TOKEN_ENV}`]: grounding.token } : {}),
+            ...(credentialRelay ? { [`env-${POD_CREDENTIAL_TOKEN_ENV}`]: credentialRelay.token } : {}),
+            ...Object.fromEntries(passKeys.map((k) => [k, env[k] ?? (options.readKeyCache ?? defaultReadKeyCache)(k)] as const).filter(([, v]) => v).map(([k, v]) => [`env-${k}`, v!])),
           },
         };
         const hostKey = (k: string): string | undefined => env[k] ?? (options.readKeyCache ?? defaultReadKeyCache)(k);
-        const passEnv = (options.passEnv ?? []).filter((k) => hostKey(k));
-        const missing = (options.passEnv ?? []).filter((k) => !hostKey(k));
+        const passEnv = passKeys.filter((k) => hostKey(k));
+        const missing = passKeys.filter((k) => !hostKey(k));
         if (missing.length) debug.log('self-implement.pod', 'pass-env-missing', { job: name, missing }, { level: 'warn' });
+        // ☸️ 재개(P3 · 2026-09-26): 같은 이름의 Job 이 이미 있으면 «지우지 않고» 붙는다 — 호스트가 끊긴 동안에도 원격은 계속 돌았다.
+        //   🩸 종전엔 여기서 delete 부터 해서, 재개가 원격에서 멀쩡히 돌던 Job 을 죽였다. 실패로 끝난 Job 만 지우고 다시 만든다.
+        // ☸️ 노드 레지스트리에 이 판이 있으면 그것을 pull 한다(델타 · 대표 2026-09-26) — 라벨 판정은 로컬 이미지 이름으로 한다.
+        const jobImage = member?.imageRef ?? image;
+        const launchRunId = retryAccount ? mintRunId() : childRunId;
+        let liveChildRunId = launchRunId;
+        const existing = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.metadata.uid} {.status.conditions[*].type}']);
+        const [existingUid = '', ...existingConditions] = existing.status === 0 ? existing.stdout.trim().split(/\s+/u) : [];
+        const reattach = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(existingUid) &&   // k8s uid 는 UUID — 다른 산출을 «있음»으로 읽지 않는다
+          !/Failed|FailureTarget/.test(existingConditions.join(' '));
+        if (reattach) {
+          const existingJob = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'json']);
+          if (existingJob.status === 0) {
+            try {
+              const job = JSON.parse(existingJob.stdout) as { spec?: { template?: { spec?: { containers?: Array<{ name?: string; env?: Array<{ name: string; value?: string }> }> } } } };
+              const inherited = job.spec?.template?.spec?.containers?.find((c) => c.name === 'child')?.env?.find((e) => e.name === 'ELANOUS_RUN_ID')?.value;
+              if (inherited && inherited !== parentRunId && inherited === normalizeRunId(inherited)) liveChildRunId = inherited;
+            } catch { /* The existing Job's identity must be verified before following it. */ }
+          }
+          if (liveChildRunId === launchRunId) {
+            debug.log('self-implement.pod', 'job-reattach-id-unavailable', { job: name });
+            return { exitCode: 1, output: '', error: { code: 'pod-child-run-id', message: `Job ${name} child runId를 확인할 수 없다` } };
+          }
+        }
+        if (reattach) debug.log('self-implement.pod', 'job-reattach', { job: name, conditions: existingConditions.join(' ') || 'running', spaceId: input.spaceId });
+        if (!reattach) {
+        if (/Failed|FailureTarget/.test(existingConditions.join(' ')) && collectFullLogs('failed-job-logs-unavailable').status === 'incomplete') {
+          return { exitCode: 1, output: '', error: { code: 'pod-collection-incomplete', message: `Job ${name} recovery incomplete — old Job retained` } };
+        }
         const s = kubectl(['apply', '-f', '-'], JSON.stringify(secret));
         if (s.status !== 0) return { exitCode: 1, output: s.stderr, error: { code: 'pod-secret', message: s.stderr.trim() } };
         kubectl(['-n', namespace, 'delete', 'job', name, '--ignore-not-found']);
-        const job = podJobManifest({ name, namespace, image, repoUrl, args, passEnv, deadlineSeconds: options.deadlineSeconds ?? 5400, ...(env.ELANOUS_RUN_ID ? { runId: env.ELANOUS_RUN_ID } : {}), ...(options.armEnv ? { armEnv: options.armEnv } : {}), hostId: resolveHostId(env), skillEnvs: Object.keys(skillEnvs), ...(env.ELANOUS_POD_MEMORY?.trim() ? { memoryLimit: env.ELANOUS_POD_MEMORY.trim() } : {}), imageCommit: options.imageCommit !== undefined ? options.imageCommit : options.kubectl ? null : podImageFreshness({ image }).imageCommit });   // kubectl 주입(=시험)이면 docker 를 부르지 않는다
+        const jobPassEnv = [
+          ...passEnv,
+          ...(grounding ? [GROUNDING_TOKEN_ENV] : []),
+          ...(credentialRelay ? [POD_CREDENTIAL_TOKEN_ENV] : []),
+        ];
+        const jobArmEnv = grounding || credentialRelay
+          ? {
+              ...(options.armEnv ?? {}),
+              ...(grounding ? { [GROUNDING_URL_ENV]: groundingUrl! } : {}),
+              ...(credentialRelay ? { [POD_CREDENTIAL_URL_ENV]: `${new URL(groundingUrl!).origin}${POD_CREDENTIAL_GROK_PATH}` } : {}),
+            }
+          : options.armEnv;
+        const job = podJobManifest({ name, namespace, image: jobImage, ...(member?.imageRef ? { imagePullPolicy: 'IfNotPresent' as const } : {}), repoUrl, ...(options.source ? { source: options.source } : {}), args, passEnv: jobPassEnv, deadlineSeconds: options.deadlineSeconds ?? POD_JOB_DEADLINE_SECONDS, ...(goalDoc ? { goalDoc } : {}), runId: launchRunId, ...(parentRunId ? { parentRunId } : {}), ...(jobArmEnv ? { armEnv: jobArmEnv } : {}), hostId: resolveHostId(env), skillEnvs: Object.keys(skillEnvs), memoryLimit, imageCommit: options.imageCommit !== undefined ? options.imageCommit : options.kubectl ? null : podImageFreshness({ image }).imageCommit, ...(grok ? { grokCredential: 'grokAuth' in creds && creds.grokAuth ? 'subscription' as const : 'api_key' as const } : {}), ...(codexAccounts ? { codexAccounts } : {}) });   // kubectl 주입(=시험)이면 docker 를 부르지 않는다
         const a = kubectl(['apply', '-f', '-'], JSON.stringify(job));
         if (a.status !== 0) { cleanupSecret(); return { exitCode: 1, output: a.stderr, error: { code: 'pod-apply', message: a.stderr.trim() } }; }
+        if (options.source?.kind === 'bundle') {
+          const podName = await waitForRunningPod(kubectl, namespace, name, sleep);
+          if (!podName) {
+            debug.log('self-implement.pod', 'source-mismatch', { job: name, kind: 'bundle', headCommit: options.source.headCommit });
+            cleanupSecret();
+            return { exitCode: 1, output: '', error: { code: 'pod-source', message: `Pod for ${name} did not become Running` } };
+          }
+          const copied = kubectl(['cp', options.source.bundlePath, `${podName}:/tmp/source.bundle`, '-c', 'child', '-n', namespace]);
+          if (copied.status !== 0) {
+            debug.log('self-implement.pod', 'source-mismatch', { job: name, kind: 'bundle', headCommit: options.source.headCommit });
+            cleanupSecret();
+            return { exitCode: 1, output: copied.stderr, error: { code: 'pod-source', message: copied.stderr.trim() || 'kubectl cp failed' } };
+          }
+          const ready = kubectl(['-n', namespace, 'exec', podName, '-c', 'child', '--', 'touch', '/tmp/source.ready']);
+          if (ready.status !== 0) {
+            debug.log('self-implement.pod', 'source-mismatch', { job: name, kind: 'bundle', headCommit: options.source.headCommit });
+            cleanupSecret();
+            return { exitCode: 1, output: ready.stderr, error: { code: 'pod-source', message: ready.stderr.trim() || 'kubectl exec touch failed' } };
+          }
+          debug.log('self-implement.pod', 'source-delivered', { job: name, kind: 'bundle', headCommit: options.source.headCommit });
+        }
+        // ☸️ P2: 비밀의 소유자 = Job — 호스트가 죽어도 Job 의 TTL 삭제와 함께 k8s 가 비밀을 거둔다(자격 사본이 클러스터에 남지 않는다).
+        const uid = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.metadata.uid}']).stdout.trim();
+        if (uid) {
+          const owned = kubectl(['-n', namespace, 'patch', 'secret', `${name}-creds`, '--type=merge', '-p', JSON.stringify({ metadata: { ownerReferences: [{ apiVersion: 'batch/v1', kind: 'Job', name, uid }] } })]);
+          if (owned.status !== 0) debug.log('self-implement.pod', 'secret-owner-failed', { job: name, stderr: owned.stderr.trim() }, { level: 'warn' });
+        }
+        }
+        if (parentRunId) {
+          try { appendRunLedgerEntry({ runId: parentRunId, event: 'pod-child-run', data: { childRunId: liveChildRunId, job: name, ...(goalFile ? { goalFile } : {}) } }, ledgerDir); }
+          catch (error) { debug.log('self-implement.pod', 'parent-ledger-unavailable', { job: name, reason: error instanceof Error ? error.message : String(error) }); }
+        }
         writePodFragment({ spaceId: input.spaceId, context, namespace, job: name, inboxDir: POD_CONTROL_INBOX_DIR }, env);
         recorded = true;
-        debug.log('self-implement.pod', 'job-applied', { job: name, namespace, ...(member ? { context: member.context } : {}), image, spaceId: input.spaceId, passEnv, extraArgs: options.extraArgs ?? [], ...(options.armEnv?.ELANOUS_ARM_ID ? { armId: options.armEnv.ELANOUS_ARM_ID } : {}) });
+        debug.log('self-implement.pod', 'job-applied', { job: name, namespace, ...(member ? { context: member.context } : {}), image: jobImage, spaceId: input.spaceId, passEnv, extraArgs: options.extraArgs ?? [], ...(options.armEnv?.ELANOUS_ARM_ID ? { armId: options.armEnv.ELANOUS_ARM_ID } : {}) });
         let state: 'complete' | 'failed' | 'aborted' = 'failed';
+        let failedReason = '';
+        let containerReason: string | null = null;
+        let containerExitCode: number | null = null;
+        // ⭐ 런 «도중» 원장 증분 회수 — 호스트 슈퍼바이저가 Pod 걸음을 실시간으로 본다(🅣 요청 · 힐 루프 runtime 성형의 전제).
+        const follower = createPodLedgerFollower({ runId: liveChildRunId, dir: ledgerDir, exec: (script) => kubectl(['-n', namespace, 'exec', `job/${name}`, '-c', 'child', '--', 'sh', '-c', script]) });
         for (;;) {
           if (input.signal?.aborted) {
             kubectl(['-n', namespace, 'delete', 'job', name, '--ignore-not-found', '--wait=false']);
@@ -255,25 +809,144 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           const g = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.status.conditions[*].type}']);
           const types = g.stdout;
           if (/Complete|SuccessCriteriaMet/.test(types)) { state = 'complete'; break; }
-          if (/Failed|FailureTarget/.test(types)) { state = 'failed'; break; }
+          if (/Failed|FailureTarget/.test(types)) {
+            state = 'failed';
+            const reason = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.status.conditions[?(@.type=="Failed")].reason}']);
+            failedReason = reason.status === 0 ? reason.stdout.trim() : '';
+            try {
+              const pods = kubectl(['-n', namespace, 'get', 'pods', '-l', `job-name=${name}`, '-o', 'jsonpath={range .items[*]}{.metadata.creationTimestamp}{"\\t"}{range .status.containerStatuses[?(@.name=="child")]}{.state.terminated.reason}{"\\t"}{.state.terminated.exitCode}{end}{"\\n"}{end}']);
+              if (pods.status === 0 && pods.stdout) {
+                const rows = pods.stdout.trimEnd().split('\n').map((line) => line.split('\t'));
+                const latest = rows.filter(([created]) => created && !Number.isNaN(Date.parse(created)))
+                  .sort((a, b) => Date.parse(b[0]!) - Date.parse(a[0]!))[0];
+                if (latest) {
+                  const [, reasonText, exitText] = latest;
+                  containerReason = reasonText?.trim() || null;
+                  containerExitCode = exitText?.trim() && /^\d+$/.test(exitText.trim()) ? Number(exitText.trim()) : null;
+                }
+              }
+            } catch { /* Pod 가 사라졌거나 조회 불가 — 종료 사유는 미상. */ }
+            debug.log('self-implement.pod', 'container-terminated', { job: name, container: 'child', reason: containerReason, exitCode: containerExitCode, jobReason: failedReason || null, memoryLimit });
+            break;
+          }
+          try { follower?.poll(); } catch (e) { debug.log('self-implement.pod', 'ledger-live-unavailable', { job: name, reason: e instanceof Error ? e.message : String(e) }); }
           await sleep(options.pollMs ?? 15_000);
         }
-        const logs = kubectl(['-n', namespace, 'logs', `job/${name}`, '-c', 'child', '--tail=400']).stdout;
+        let logs = '';
+        let logTailReason: string | undefined;
+        try {
+          const fetched = kubectl(['-n', namespace, 'logs', `job/${name}`, '-c', 'child', '--tail=400']);
+          if (fetched.status !== 0) logTailReason = fetched.stderr.trim() || `kubectl logs exited ${fetched.status}`;
+          else if (!fetched.stdout) logTailReason = 'empty child logs';
+          else logs = fetched.stdout;
+        } catch (error) { logTailReason = error instanceof Error ? error.message : String(error); }
+        let ledgerReason = '';
+        let ledgerCollected = false;
+        const collection = collectFullLogs('ledger-collect-incomplete', follower.owned ? new Set([liveChildRunId]) : undefined, (event, data) => {
+          if ((event === 'ledger-collect-incomplete' || event === 'ledger-collect-skipped') && (data.runId === liveChildRunId || !data.runId)) ledgerReason = String(data.reason);
+          if ((event === 'ledger-collected' || event === 'ledger-collect-already-complete') && data.runId === liveChildRunId) ledgerCollected = true;
+        }, liveChildRunId);
+        const samples = collection.status === 'unavailable' ? parseMemSamples(logs) : collection.samples;
+        if (state === 'failed' && containerReason === 'OOMKilled') {
+          // 자식 stdout 원문은 싣지 않는다 — 임의 출력에 든 비밀이 진단 경로로 새지 않도록 «모양»(줄·바이트)만 남긴다.
+          const childLines = logs ? logs.replace(/\n$/, '').split('\n').filter((line) => !line.startsWith('ELANOUS_MEM ')) : [];
+          const logShape = logs ? { lines: childLines.length, bytes: Buffer.byteLength(childLines.join('\n')) } : null;
+          debug.log('self-implement.pod', 'oom-evidence', { job: name, memoryLimit, samples: samples.slice(-3), logShape, ...(logShape === null ? { logTailReason: logTailReason ?? 'empty child logs' } : {}) }, { compact: { maxDepth: 6 } });
+        } else if (state === 'complete') {
+          debug.log('self-implement.pod', 'memory-last', { job: name, sample: samples.at(-1) ?? null }, { compact: { maxDepth: 6 } });
+        }
+        const ledgerExists = existsSync(runLedgerPath(liveChildRunId, ledgerDir));
+        const ledgerCompleteness = collection.childLedgerIncomplete || (follower.owned && !ledgerCollected) ? 'incomplete' : ledgerCollected ? 'complete' : 'missing';
+        if (ledgerCompleteness === 'incomplete' || (state !== 'complete' && !ledgerExists)) {
+          try { appendRunLedgerEntry({ runId: liveChildRunId, event: 'pod-ledger-incomplete', data: { job: name, reason: ledgerReason || (collection.status === 'unavailable' ? 'logs-unavailable' : ledgerExists ? 'collection-incomplete' : 'child-ledger-missing') } }, ledgerDir); }
+          catch (error) { debug.log('self-implement.pod', 'ledger-marker-unavailable', { job: name, childRunId: liveChildRunId, reason: error instanceof Error ? error.message : String(error) }); }
+        }
+        const salvage = recordPodSalvage(logs, name);
         cleanupSecret();
         // ⭐ 호스트 단가로 다시 매긴다(BACKLOG C1b) — Pod 엔 레지스트리 스냅숏이 없다.
         const { estimateLlmCost } = await import('../../budget/llm-cost.js');
         reemitPodUsage(logs, name, undefined, (u) => estimateLlmCost(u) as { kind: string; usd?: number });
         const parsed = parseSelfImplementJson(logs);
+        const terminal = parseSelfImplementJson(logs.trimEnd().split('\n').at(-1) ?? '');
+        const nextAccount = codexAccounts?.find((candidate) => candidate !== account);
+        if (!usageLimitRetried && !input.signal?.aborted && state !== 'aborted' && terminal?.ok === false
+          && /\b429\b/.test(terminal.error ?? '') && /\busage_limit_reached\b/.test(terminal.error ?? '') && nextAccount) {
+          debug.log('self-implement.pod', 'usage-limit-retry', { job: name, spaceId: input.spaceId, from: account, to: nextAccount });
+          const deleted = kubectl(['-n', namespace, 'delete', 'job', name, '--ignore-not-found', '--wait=true']);
+          if (deleted.status !== 0) throw new Error(`pod: 사용량 초과 Job 삭제 실패: ${deleted.stderr.trim()}`);
+          failedAccount = account;
+          retryAccount = nextAccount;
+          usageLimitRetried = true;
+          continue;
+        }
         // Pod 안 경로는 호스트에서 쓸 수 없다.
-        const disposition = parsed ? { ...parsed, worktreePath: undefined } : undefined;
-        debug.log('self-implement.pod', 'job-finished', { job: name, ...(member ? { context: member.context } : {}), state, stage: disposition?.stage ?? null, prUrl: disposition?.prUrl ?? null });
-        const tail = logs.slice(-4000);
+        let disposition = parsed ? { ...parsed, worktreePath: undefined } : undefined;
+        if (input.autoMerge && state === 'complete' && disposition?.stage === 'merge-ready') {
+          const prNumber = disposition.prNumber;
+          const headCommit = disposition.checkedHeadCommit;
+          let regate: HostRegateResult;
+          if (!Number.isSafeInteger(prNumber) || !prNumber || !headCommit || !/^[0-9a-f]{40}$/i.test(headCommit)) {
+            debug.log('harness.host-regate', 'unmeasured', { pr: prNumber ?? null, files: [], os: process.platform, failedStep: 'pod-result' });
+            regate = { passed: false, failures: [{ step: 'pod-result', detail: 'missing PR number or checked head commit' }], os: process.platform };
+          } else {
+            try {
+              const hostRoot = findGitDir(process.cwd())?.root;
+              if (!hostRoot) throw new Error('host repository unavailable');
+              regate = await (options.hostRegate ?? runHostRegate)({ prNumber, headCommit, repoRoot: hostRoot });
+            } catch (error) {
+              debug.log('harness.host-regate', 'unmeasured', { pr: prNumber, files: [], os: process.platform, failedStep: 'host-regate' });
+              regate = { passed: false, failures: [{ step: 'host-regate', detail: error instanceof Error ? error.message : String(error) }], os: process.platform };
+            }
+          }
+          // runHostRegate comments on its own failures; these two paths never reached it.
+          const failedStep = regate.failures[0]?.step;
+          if (!regate.passed && (failedStep === 'pod-result' || failedStep === 'host-regate') && Number.isSafeInteger(prNumber) && prNumber) {
+            const detail = (regate.failures[0]?.detail ?? 'unknown').replace(/\s+/g, ' ').slice(0, 180);
+            try { (options.ghComment ?? defaultGhComment)(prNumber, `호스트 재게이트 실패(${process.platform}): ${failedStep} — ${detail}`); }
+            catch (error) { debug.log('harness.host-regate', 'unmeasured', { pr: prNumber, files: [], os: process.platform, failedStep: 'comment', detail: error instanceof Error ? error.message : String(error) }); }
+          }
+          disposition = { ...disposition, stage: regate.passed ? 'merged' : 'host-regate-failed', merged: regate.passed, hostRegate: regate, ok: regate.passed };
+        }
+        if (goalFile) {
+          const record: GoalExecutionRecord = {
+            runId: liveChildRunId,
+            stage: (state === 'aborted' || !disposition ? 'aborted' : disposition.stage) as GoalExecutionRecord['stage'],
+            outcome: (!disposition ? 'pod-no-result' : state === 'complete' && disposition.merged ? 'merged' : state === 'complete' && disposition.ok ? 'completed' : 'abandoned') as GoalExecutionRecord['outcome'],
+            ok: state === 'complete' && (disposition?.ok ?? false),
+            ...(disposition?.prNumber !== undefined ? { prNumber: disposition.prNumber } : {}),
+            completedAt: new Date().toISOString(),
+          };
+          try { const { appendGoalExecutionRecord } = await import('../../self-implement/orchestrator.js'); appendGoalExecutionRecord(goalFile, record); }
+          catch (error) { debug.log('self-implement.pod', 'goal-record-unavailable', { job: name, childRunId: liveChildRunId, reason: error instanceof Error ? error.message : String(error) }); }
+        }
+        debug.log('self-implement.pod', 'job-finished', { job: name, ...(member ? { context: member.context } : {}), state, containerReason, stage: disposition?.stage ?? null, prUrl: disposition?.prUrl ?? null, childRunId: liveChildRunId, ledgerCompleteness });
+        const tail = podRunResultLine(logs, salvage);
         if (state === 'aborted') return { exitCode: null, output: tail, error: { code: 'aborted', message: 'aborted — Job deleted' }, ...(disposition ? { disposition } : {}) };
+        const deadlineExceeded = state === 'failed' && failedReason === 'DeadlineExceeded';
+        const deadlineSeconds = options.deadlineSeconds ?? POD_JOB_DEADLINE_SECONDS;
+        if (deadlineExceeded) {
+          debug.log('self-implement.pod', 'deadline-exceeded', {
+            job: name,
+            deadlineSeconds,
+            childClassification: disposition?.failureClassification ?? null,
+            prUrl: disposition?.prUrl ?? null,
+            branch: disposition?.branch ?? null,
+          });
+        }
+        const finishedDisposition = deadlineExceeded && disposition
+          ? { ...disposition, failureClassification: 'run-deadline-exceeded' as const }
+          : disposition;
         return {
-          exitCode: state === 'complete' ? 0 : 1,
+          exitCode: state === 'complete' && disposition?.stage !== 'host-regate-failed' && disposition?.ok !== false ? 0 : 1,
           output: tail,
-          ...(state === 'failed' ? { error: { code: 'pod-job-failed', message: `Job ${name} failed` } } : {}),
-          ...(disposition ? { disposition } : {}),
+          ...(deadlineExceeded
+            ? { error: { code: 'pod-deadline-exceeded', message: `Job ${name} 이 수명 상한 ${deadlineSeconds}초에 닿았다` } }
+            : state === 'failed'
+              ? containerReason === 'OOMKilled'
+                ? { error: { code: 'pod-oom-killed', message: `Job ${name} failed (OOMKilled/${containerExitCode ?? 'unknown'}, memoryLimit=${memoryLimit})\n${formatLastMemSample(samples.at(-1))}` } }
+                : { error: { code: 'pod-job-failed', message: `Job ${name} failed${failedReason || containerReason ? ` (${[failedReason, containerReason ? `container=${containerReason}/${containerExitCode ?? 'unknown'}` : ''].filter(Boolean).join(', ')})` : ''}` } }
+              : {}),
+          ...(finishedDisposition ? { disposition: finishedDisposition } : {}),
         };
       } catch (err) {
         cleanupSecret();
@@ -281,8 +954,10 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         debug.log('self-implement.pod', 'job-error', { job: name, message }, { level: 'error' });
         return { exitCode: 1, output: message, error: { code: 'pod-error', message } };
       }
+      }
       } finally {
         if (recorded) finishPodFragment(input.spaceId, env);
+        if (groundingMinted) { try { (options.revokeGrounding ?? revokeGroundingRun)(groundingMinted); } catch (e) { debug.log('self-implement.pod', 'grounding-revoke-failed', { job: name, reason: e instanceof Error ? e.message : String(e) }, { level: 'warn' }); } }
         if (member) options.pool!.release(member);
       }
     })();
@@ -311,6 +986,64 @@ export function podRowCost(r: Record<string, unknown>, reprice?: PodRowReprice):
   return { kind: 'partial', usd: usdKnown, unknownCostCalls: unknown };
 }
 
+const SALVAGE_LINE = /^ELANOUS_POD_SALVAGE (\S+) (\S+)$/;
+
+/** Job 로그의 `ELANOUS_POD_SALVAGE <branch> <commit>` — 호스트가 거둘 브랜치. 접두가 salvage/ 가 아니면 버린다. */
+export function parsePodSalvageLines(logs: string): Array<{ branch: string; commit: string }> {
+  const out: Array<{ branch: string; commit: string }> = [];
+  for (const line of logs.split('\n')) {
+    const m = SALVAGE_LINE.exec(line.trim());
+    if (!m || !m[1]!.startsWith('salvage/')) continue;
+    out.push({ branch: m[1]!, commit: m[2]! });
+  }
+  return out;
+}
+
+/** 기존 Job 로그 소비 경로가 부르는 salvage 기록. 사람용 런 결과 줄에 붙일 브랜치 목록을 돌려준다. */
+export function recordPodSalvage(logs: string, job: string, log: (category: string, event: string, data: Record<string, unknown>) => void = (c, e, d) => debug.log(c, e, d)): string[] {
+  const rows = parsePodSalvageLines(logs);
+  for (const row of rows) log('self-implement.pod', 'salvage-pushed', { job, branch: row.branch, commit: row.commit });
+  return rows.map((row) => row.branch);
+}
+
+/** 사람용 런 결과 한 줄 — 수확 브랜치가 있으면 «수확할 브랜치: …» 를 붙인다. */
+export function podRunResultLine(logs: string, branches: readonly string[]): string {
+  const result = logs.split('\n').filter((line) => !line.startsWith('ELANOUS_MEM ')).join('\n').slice(-4000);
+  if (!branches.length) return result;
+  const note = branches.map((branch) => `수확할 브랜치: ${branch}`).join('\n');
+  return result ? `${result}\n${note}` : note;
+}
+
+export function parseMemSamples(logs: string): Array<{ at: number; cgroupBytes: number | null; top: Array<{ rssKb: number; name: string; cmd?: string }> }> {
+  const samples: Array<{ at: number; cgroupBytes: number | null; top: Array<{ rssKb: number; name: string; cmd?: string }> }> = [];
+  for (const line of logs.split('\n')) {
+    const match = /^ELANOUS_MEM (\d+) (\d+|-)(?: (.*))?\r?$/.exec(line);
+    if (!match) continue;
+    const at = Number(match[1]);
+    const cgroupBytes = match[2] === '-' ? null : Number(match[2]);
+    if (!Number.isSafeInteger(at) || (cgroupBytes !== null && !Number.isSafeInteger(cgroupBytes))) continue;
+    const top: Array<{ rssKb: number; name: string; cmd?: string }> = [];
+    let valid = true;
+    for (const token of (match[3] ?? '').split(' ').filter(Boolean)) {
+      const entry = /^(\d+):([^\s:]+)(?::([^\s:]+))?$/.exec(token);
+      if (!entry || !Number.isSafeInteger(Number(entry[1])) || top.length >= 5) { valid = false; break; }
+      let name: string;
+      let cmd: string | undefined;
+      try { name = decodeURIComponent(entry[2]!); if (entry[3] !== undefined) cmd = decodeURIComponent(entry[3]); }
+      catch { valid = false; break; }
+      top.push({ rssKb: Number(entry[1]), name, ...(cmd !== undefined ? { cmd } : {}) });
+    }
+    if (valid) samples.push({ at, cgroupBytes, top });
+  }
+  return samples;
+}
+
+function formatLastMemSample(sample: ReturnType<typeof parseMemSamples>[number] | undefined): string {
+  if (!sample) return '마지막 샘플: 샘플 없음';
+  const gib = (bytes: number) => `${(bytes / 1024 ** 3).toFixed(2)}GiB`;
+  return `마지막 샘플: cgroup ${sample.cgroupBytes === null ? '-' : gib(sample.cgroupBytes)} · 상위 ${sample.top.length ? sample.top.map((p) => `${p.name} ${gib(p.rssKb * 1024)}`).join(' · ') : '없음'}`;
+}
+
 export function reemitPodUsage(logs: string, job: string, log: (category: string, event: string, data: Record<string, unknown>) => void = (c, e, d) => debug.log(c, e, d), reprice?: PodRowReprice): number {
   const line = logs.split('\n').reverse().find((l) => l.startsWith('ELANOUS_USAGE_ROLLUP '));
   if (!line) { log('self-implement.pod', 'usage-rollup-missing', { job }); return 0; }
@@ -334,7 +1067,7 @@ export function reemitPodUsage(logs: string, job: string, log: (category: string
 /** 이 기계가 Pod 칸을 쓸 수 있나(클러스터 · 이미지) — 발사 전 한 번. */
 export function podSubstrateReady(kubectl: Kubectl = defaultKubectl, image = 'elanous-harness:local'): { ok: boolean; reason: string } {
   const ctx = kubectl(['config', 'current-context']);
-  if (ctx.status !== 0) return { ok: false, reason: 'kubectl context 없음 — k3d cluster create elanous-h1 --no-lb' };
+  if (ctx.status !== 0) return { ok: false, reason: 'kubectl context 없음 — k3d cluster create elanous-h1 --no-lb (이미 있는 k3d 클러스터면 kubectl config use-context k3d-<이름>)' };
   const ns = kubectl(['get', 'ns', 'elanous-test']);
   if (ns.status !== 0) return { ok: false, reason: 'elanous-test 네임스페이스 없음 — kubectl apply -f docker/h1/base.yaml -f docker/h1/policy-internet.yaml' };
   void image;
@@ -449,3 +1182,11 @@ export function podImageFreshness(deps: {
     ? { imageCommit, headCommit, fresh: true, reason: 'HEAD 와 같다' }
     : { imageCommit, headCommit, fresh: false, reason: `이미지 ${imageCommit.slice(0, 12)} ≠ HEAD ${headCommit.slice(0, 12)}` };
 }
+
+function configGroundingUrl(): string | undefined {
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { getUserConfig } = require('../../user-config.js') as typeof import('../../user-config.js');
+    return getUserConfig().pod?.groundingUrl;
+  } catch { return undefined; }
+}