elanous 0.2.14 → 0.2.16

package/src/session-runtime/retry-api.ts

@@ -25,6 +25,8 @@ import {
   decideRetry,
   DoomLoopTracker,
   fingerprintError,
+  llmCallOutcomeKind,
+  type LlmCallOutcomeKind,
   type RetryAction,
 } from './retry-policy.js';
 
@@ -75,6 +77,35 @@ export interface FetchApiWithRetryOpts {
    *  row" pattern within a single request. Pass a session-scoped
    *  tracker if you want cross-request doom detection. */
   doomTracker?: DoomLoopTracker;
+  /** Fallbacks still unused. When > 0, k consecutive overload-class
+   *  failures throw OverloadFailoverError before another retry sleep. */
+  remainingFallbacks?: number;
+}
+
+/** Raised when overload repeats k times and a fallback is still unused.
+ *  The caller switches provider; this is not a retry exhaustion. */
+export class OverloadFailoverError extends Error {
+  readonly provider: string;
+  readonly status: number;
+  readonly kind: LlmCallOutcomeKind;
+  readonly streak: number;
+  readonly cause: unknown;
+
+  constructor(opts: {
+    provider: string;
+    status: number;
+    kind: LlmCallOutcomeKind;
+    streak: number;
+    cause: unknown;
+  }) {
+    super(`overload failover after ${opts.streak} ${opts.kind} from ${opts.provider} (status ${opts.status})`);
+    this.name = 'OverloadFailoverError';
+    this.provider = opts.provider;
+    this.status = opts.status;
+    this.kind = opts.kind;
+    this.streak = opts.streak;
+    this.cause = opts.cause;
+  }
 }
 
 /** POST a fetch with the standard retry policy. On 2xx returns the
@@ -91,13 +122,17 @@ export async function fetchApiWithRetry(
 ): Promise<Response> {
   const maxAttempts = opts.maxAttempts ?? 4;
   const tracker = opts.doomTracker ?? new DoomLoopTracker();
+  const remainingFallbacks = opts.remainingFallbacks ?? 0;
   let attempt = 0;
+  let overloadStreak = 0;
   let lastErr: unknown;
   while (attempt < maxAttempts) {
     let response: Response | null = null;
     try {
       response = await fetch(url, init);
       if (response.ok) {
+        recordLlmCallOutcome(opts.provider, response.status, 'ok');
+        overloadStreak = 0;
         return response;
       }
       // Drain body so the error can carry the API's explanation. We
@@ -136,6 +171,11 @@ export async function fetchApiWithRetry(
       // would couple the helper to the caller's signal.
       if (isAbortLike(err)) throw err;
 
+      const status = err instanceof ApiHttpError ? err.status : 0;
+      const kind = llmCallOutcomeKind(status, err instanceof Error ? err.message : String(err));
+      recordLlmCallOutcome(opts.provider, status, kind);
+      if (kind === 'overloaded' || kind === '5xx' || kind === 'rate-limit') overloadStreak += 1;
+      else overloadStreak = 0;
       const fp = fingerprintError(err, `api:${opts.provider}`);
       const doomStatus = tracker.record(fp);
       const retryAfter = err instanceof ApiHttpError ? err.retryAfter : undefined;
@@ -143,6 +183,8 @@ export async function fetchApiWithRetry(
         attempt,
         doomStatus,
         retryAfter,
+        remainingFallbacks,
+        overloadStreak,
       });
       debug.log('llm.retry', decisionEvent(decision.action), {
         provider: opts.provider,
@@ -151,7 +193,19 @@ export async function fetchApiWithRetry(
         reason: decision.reason,
         delayMs: decision.delayMs,
         status: err instanceof ApiHttpError ? err.status : undefined,
+        kind,
+        overloadStreak,
+        remainingFallbacks,
       });
+      if (decision.action === 'switch-provider') {
+        throw new OverloadFailoverError({
+          provider: opts.provider,
+          status,
+          kind,
+          streak: overloadStreak,
+          cause: err,
+        });
+      }
       if (decision.action !== 'retry') {
         throw err;
       }
@@ -172,6 +226,39 @@ export async function fetchApiWithRetry(
   throw lastErr ?? new Error(`${opts.errorPrefix}: retry loop terminated unexpectedly`);
 }
 
+type OutcomeWriter = (row: { provider: string; status: number; kind: LlmCallOutcomeKind }) => void;
+
+let outcomeWriterForTesting: OutcomeWriter | undefined;
+
+/** Test seam. Production uses the log store. `undefined` restores it. */
+export function setLlmCallOutcomeWriterForTesting(writer: OutcomeWriter | undefined): void {
+  outcomeWriterForTesting = writer;
+}
+
+/** The one event launch failover is allowed to read.
+ *  Category `llm.call`, event `outcome`, payload {provider,status,kind}.
+ *  Written straight to the log store — `debug.log` drops the row when no
+ *  sink is armed, which is the normal launch path. */
+export function recordLlmCallOutcome(provider: string, status: number, kind: LlmCallOutcomeKind): void {
+  const data = { provider, status, kind };
+  // Trace only — a store sink would otherwise write a second `llm.call`/`outcome` row and halve the streak threshold.
+  debug.log('llm.call', 'outcome-trace', data);
+  if (outcomeWriterForTesting) {
+    outcomeWriterForTesting(data);
+    return;
+  }
+  if (process.env.NODE_ENV === 'test') return;
+  try {
+    const { getDefaultLogStore } = require('../mss/logging/log-store.js') as typeof import('../mss/logging/log-store.js');
+    getDefaultLogStore()?.insertBatch([{
+      rec: { ts: new Date().toISOString(), category: 'llm.call', event: 'outcome', data },
+      surface: 'llm',
+    }]);
+  } catch {
+    // A failed observation must not fail the call. Launch then sees no sample.
+  }
+}
+
 function decisionEvent(action: RetryAction): string {
   // Stable category names for log filtering. The action is the most
   // useful axis ("how many turns hit retry vs abort"); the category

package/src/session-runtime/retry-policy.ts

@@ -364,7 +364,61 @@ export function decideProviderFallback(input: {
   return { action: 'advance', nextProvider, category, attempts };
 }
 
-export type RetryAction = 'retry' | 'abort' | 'ask-user' | 'auto-undo';
+/** Consecutive overload/5xx/rate-limit outcomes that switch the child off codex
+ *  before the same provider spends its remaining retries. Other errors (400)
+ *  never count. Recovery is this many later non-overload outcomes. */
+export const OVERLOAD_FAILOVER_STREAK = 3;
+
+export type LlmCallOutcomeKind = 'ok' | 'overloaded' | '5xx' | 'rate-limit' | 'other';
+
+/** One finished LLM call. Launch failover reads only this shape. */
+export interface LlmCallOutcome {
+  readonly provider: string;
+  readonly status: number;
+  readonly kind: LlmCallOutcomeKind;
+}
+
+const CODEX_CALL_PROVIDERS = new Set(['codex', 'openai-codex']);
+
+export function llmCallOutcomeKind(status: number, message = ''): LlmCallOutcomeKind {
+  if (status >= 200 && status < 300) return 'ok';
+  const msg = message.toLowerCase();
+  if (status === 429 || msg.includes('rate limit') || msg.includes('too many requests')) return 'rate-limit';
+  if (
+    status === 500 || status === 502 || status === 503 || status === 504 ||
+    msg.includes('overloaded') || msg.includes('server_busy') || msg.includes('server_error')
+  ) {
+    return status >= 500 ? '5xx' : 'overloaded';
+  }
+  if (msg.includes('overloaded')) return 'overloaded';
+  return 'other';
+}
+
+export function isOverloadOutcomeKind(kind: LlmCallOutcomeKind): boolean {
+  return kind === 'overloaded' || kind === '5xx' || kind === 'rate-limit';
+}
+
+/** True when the newest `limit` codex outcomes are all overload-class.
+ *  A non-codex row or a non-overload row breaks the streak. Empty input is false. */
+export function codexOverloadStreakReached(
+  outcomes: readonly LlmCallOutcome[],
+  limit = OVERLOAD_FAILOVER_STREAK,
+): boolean {
+  if (limit < 1 || outcomes.length < limit) return false;
+  const tail = outcomes.slice(-limit);
+  return tail.every((row) => CODEX_CALL_PROVIDERS.has(row.provider) && isOverloadOutcomeKind(row.kind));
+}
+
+/** True when the newest `limit` outcomes are successful (any provider). */
+export function overloadRecovered(
+  outcomes: readonly LlmCallOutcome[],
+  limit = OVERLOAD_FAILOVER_STREAK,
+): boolean {
+  if (limit < 1 || outcomes.length < limit) return false;
+  return outcomes.slice(-limit).every((row) => row.kind === 'ok');
+}
+
+export type RetryAction = 'retry' | 'abort' | 'ask-user' | 'auto-undo' | 'switch-provider';
 
 export interface RetryDecision {
   action: RetryAction;
@@ -417,6 +471,16 @@ export interface RetryContext {
   /** Optional: retry-after header string from a 429 response (ms or
    *  seconds or HTTP date). decideRetry parses it. */
   retryAfter?: string;
+  /** Configured fallbacks still unused. When > 0, an overload-class
+   *  failure that has already repeated `overloadStreak` times switches
+   *  provider instead of spending another retry on the same one.
+   *  Omitted or 0 keeps the historical retry-until-exhausted behaviour. */
+  remainingFallbacks?: number;
+  /** Consecutive overload-class failures already seen for this call,
+   *  including the one under decision. Default threshold is
+   *  OVERLOAD_FAILOVER_STREAK. */
+  overloadStreak?: number;
+  overloadStreakLimit?: number;
 }
 
 /** Classify an error into a RetryCategory without making an action
@@ -519,10 +583,42 @@ export function classifyError(err: unknown): RetryCategory {
   return 'unknown';
 }
 
+function isOverloadSwitchCandidate(msg: string, code: string | null): boolean {
+  return (
+    code === '429' || code === '500' || code === '502' || code === '503' || code === '504' ||
+    msg.includes('rate limit') || msg.includes('too many requests') ||
+    msg.includes('overloaded') || msg.includes('server_busy') || msg.includes('server_error')
+  );
+}
+
+function overloadSwitchDecision(ctx: RetryContext): RetryDecision | undefined {
+  const remaining = ctx.remainingFallbacks ?? 0;
+  if (remaining <= 0) return undefined;
+  const limit = ctx.overloadStreakLimit ?? OVERLOAD_FAILOVER_STREAK;
+  const streak = ctx.overloadStreak ?? 1;
+  if (streak < limit) return undefined;
+  return {
+    action: 'switch-provider',
+    category: 'overloaded',
+    reason: `overload streak ${streak} with ${remaining} fallback(s) left; switch before spending retries`,
+  };
+}
+
 /** Pure verdict. Caller sleeps + retries or aborts per the returned
  *  action. Exponential backoff baseline: 500ms * 2^attempt, clamped
  *  to [500, 30_000]. */
 export function decideRetry(err: unknown, ctx: RetryContext): RetryDecision {
+  const msg = extractMessage(err).toLowerCase();
+  const code = extractErrorCode(err);
+
+  // Overload with a fallback still unused switches before the doom
+  // window (k === 3) turns the same 503 into auto-undo. A 400 is not
+  // a candidate. Doom still wins for every other repeated failure.
+  if (isOverloadSwitchCandidate(msg, code)) {
+    const switched = overloadSwitchDecision(ctx);
+    if (switched) return switched;
+  }
+
   // Doom-loop always wins — even a technically-retryable error
   // becomes auto-undo after N identical failures. The caller may
   // still degrade to ask-user when plan mode is active or when the
@@ -535,9 +631,6 @@ export function decideRetry(err: unknown, ctx: RetryContext): RetryDecision {
     };
   }
 
-  const msg = extractMessage(err).toLowerCase();
-  const code = extractErrorCode(err);
-
   // Context window exhausted — never retry (the next call will also
   // be over-sized). Abort and surface the error to the caller; upstream
   // can trigger compaction.
@@ -589,8 +682,16 @@ export function decideRetry(err: unknown, ctx: RetryContext): RetryDecision {
     };
   }
 
-  // Overloaded / server busy.
-  if (msg.includes('overloaded') || msg.includes('server_busy') || code === '503') {
+  // Overloaded / server busy / 5xx.
+  if (
+    msg.includes('overloaded') ||
+    msg.includes('server_busy') ||
+    msg.includes('server_error') ||
+    code === '500' ||
+    code === '502' ||
+    code === '503' ||
+    code === '504'
+  ) {
     return {
       action: 'retry',
       delayMs: backoffMs(ctx.attempt),

package/src/steward/triage.ts

@@ -260,9 +260,56 @@ function skipOverlappingRun(root: string, open: FailureStreak['open'] & { pid?:
   }
   debug.log('steward.stage', 'skipped-overlap', { openStage: open.stage, pid: open.pid });
   writeFileSync(skippedPath(root), JSON.stringify({ openStage: open.stage, pid: open.pid }));
+  logTickDecision(root, 'skipped', `overlapping ${open.stage} (pid ${open.pid ?? 'unknown'})`);
 }
 
 function reportPath(root: string): string { return join(root, 'steward', 'observe.json'); }
+
+type TickDecision = { verdict: 'launched' | 'failed'; reason: string; goalId?: string };
+
+function logTickDecision(root: string | undefined, verdict: 'launched' | 'skipped' | 'reported' | 'failed', reason: string, goalId?: string): void {
+  const runId = graphRunId();
+  const marker = root && runId && existsSync(join(root, 'steward')) ? join(root, 'steward', `decision-logged-${runId}.json`) : undefined;
+  const decision = { verdict, reason: redactSecretText(reason), ...(goalId ? { goalId } : {}), ...(runId ? { runId } : {}) };
+  if (marker) try {
+    const previous = JSON.parse(readFileSync(marker, 'utf8')) as { verdict?: string; reason?: string };
+    // A replay keeps the first success; a failure replaces a success; a success after a failure replaces the failure.
+    if (previous.verdict === decision.verdict && previous.reason === decision.reason) return;
+    if (previous.verdict !== 'failed' && verdict !== 'failed') return;
+  } catch { /* Missing or stale marker: retry the observation. */ }
+  try {
+    debug.log('loop.steward', 'decision', decision);
+    if (marker) writeFileSync(marker, JSON.stringify(decision));
+  } catch { /* Observation must not change the tick outcome. */ }
+}
+
+function tickDecisionPath(root: string, runId: string): string {
+  return join(root, 'steward', `decision-${runId}.json`);
+}
+function rememberLaunchDecision(root: string, entry: TickDecision): void {
+  const runId = graphRunId();
+  if (!runId) return;
+  const path = tickDecisionPath(root, runId);
+  try {
+    let current: TickDecision | undefined;
+    try { current = JSON.parse(readFileSync(path, 'utf8')) as TickDecision; }
+    catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') return; }
+    // Keep the first failure (and its goal/cause), even if a retried schedule later succeeds.
+    if (current?.verdict === 'failed' || current?.verdict === entry.verdict) return;
+    writeFileSync(path, JSON.stringify(entry));
+  } catch { /* An unavailable observation store must not block execution. */ }
+}
+function readLaunchDecision(root: string): TickDecision | undefined {
+  const runId = graphRunId();
+  if (!runId) return undefined;
+  try { return JSON.parse(readFileSync(tickDecisionPath(root, runId), 'utf8')) as TickDecision; }
+  catch { return undefined; }
+}
+function logStageFailure(root: string, stage: StewardStage, reason: string): void {
+  const runId = graphRunId();
+  if (runId) try { rmSync(tickDecisionPath(root, runId), { force: true }); } catch { /* Observation must not change the failure. */ }
+  logTickDecision(root, 'failed', `${stage}: ${reason}`);
+}
 function readState(path: string): { issues: Record<string, string>; digestDay?: string } {
   try { return JSON.parse(readFileSync(path, 'utf8')) as ReturnType<typeof readState>; }
   catch (error) { if ((error as NodeJS.ErrnoException).code === 'ENOENT') return { issues: {} }; throw error; }
@@ -396,10 +443,18 @@ export async function runStewardStage(stage: 'sync' | 'triage' | 'schedule' | 'r
       const entry = raiseHitl(issue, row, launchDeps);
       recordHitlOnCard(issue, entry, cardDeps);
     }
+    let launchDecision: TickDecision | undefined;
     for (const item of plan.launches) {
       const entry = launch(item, launchDeps);
+      const decision: TickDecision | undefined = entry.status === 'launched'
+        ? { verdict: 'launched', reason: 'harness run spawned', goalId: `linear:${item.issue.identifier}` }
+        : entry.status === 'failed'
+          ? { verdict: 'failed', reason: entry.reason ?? 'launch failed', goalId: `linear:${item.issue.identifier}` }
+          : undefined;
+      if (decision && (!launchDecision || (decision.verdict === 'failed' && launchDecision.verdict !== 'failed'))) launchDecision = decision;
       recordLaunchOnCard(item.issue, entry, cardDeps);
     }
+    if (launchDecision) rememberLaunchDecision(root, launchDecision);
     if (settings.mode === 'shadow') {
       const { recordShadowTick } = await import('./readiness.js');
       const tick = recordShadowTick(root, rows, plan, (deps.now ?? (() => new Date()))());
@@ -459,12 +514,18 @@ export async function runStewardStage(stage: 'sync' | 'triage' | 'schedule' | 'r
       }
     }
     const day = at.slice(0, 10);
+    let digested = false;
     if (state.digestDay !== day) {
       const send = deps.sendDigest ?? sendStewardDigest;
       await send(`스튜어드 ${day}: ${rows.map(row => `${row.issue} ${row.disposition}`).join(' · ')}`);
       state.digestDay = day;
       writeFileSync(path, JSON.stringify(state));
+      digested = true;
     }
+    const launched = readLaunchDecision(root);
+    if (launched) logTickDecision(root, launched.verdict, launched.reason, launched.goalId);
+    else if (outcomes.length || digested) logTickDecision(root, 'reported', outcomes.length ? `${outcomes.length} outcome(s) reported` : 'daily digest sent');
+    else logTickDecision(root, 'skipped', 'no new outcome or digest');
   }
   outcome = 'ok';
   } finally {
@@ -513,10 +574,14 @@ async function withStageSlot<T>(root: string, run: () => Promise<T>, onBusy?: ()
 
 /** The command-node boundary records both normal exits and an unclosed stage from a killed process. */
 export async function runStewardStageCommand(stage: StewardStage, deps: StewardCommandDeps = {}): Promise<0 | 1> {
-  if (resolvedStewardSettings(deps.launchSettings).mode === 'off') return 0;
+  if (resolvedStewardSettings(deps.launchSettings).mode === 'off') {
+    if (stage === 'sync') logTickDecision(deps.root ?? effectiveInstanceRoot(), 'skipped', 'steward mode off');
+    return 0;
+  }
   const root = deps.root ?? effectiveInstanceRoot();
   if (stage !== 'sync' && existsSync(skippedPath(root))) return 0;
-  return withStageSlot(root, async () => {
+  try {
+    return await withStageSlot(root, async () => {
     const now = deps.now ?? (() => new Date());
     const threshold = stewardSettings().alertAfterFailures ?? 3;
     const alertIfNeeded = async (state: FailureStreak): Promise<void> => {
@@ -564,10 +629,16 @@ export async function runStewardStageCommand(stage: StewardStage, deps: StewardC
     if (!ok) {
       console.error(`steward ${stage}: stage failed — ${reason}`);
       debug.log('steward.stage', 'failed', { stage, reason });
+      if (stage === 'sync' || !existsSync(skippedPath(root))) logStageFailure(root, stage, reason);
       return 1;
     }
     return 0;
-  }, stage === 'sync' ? () => { skipOverlappingRun(root, currentOpen(root, stage)); return 0 as const; } : undefined);
+    }, stage === 'sync' ? () => { skipOverlappingRun(root, currentOpen(root, stage)); return 0 as const; } : undefined);
+  } catch (error) {
+    try { if (stage === 'sync' || !existsSync(skippedPath(root))) logStageFailure(root, stage, error instanceof Error ? error.message : String(error)); }
+    catch { /* Observation must not change the stage error. */ }
+    throw error;
+  }
 }
 
 export async function runStewardNodeCommand(

package/src/steward/working-backwards.ts

@@ -53,8 +53,26 @@ export async function recordWorkingBackwardsOnCards(
     }
     const card = store.createCard({ goalId: `linear:${issue.identifier}`, title: redactSecrets(issue.title) });
     if (card.sections.some(section => section.key.startsWith('prfaq:')) && card.sections.some(section => section.key.startsWith('manual:'))) continue;
-    if (card.sections.some(section => section.key.startsWith('launch:'))) throw new Error(`Working-backwards draft follows launch: ${issue.identifier}`);
-    const draft = await draftWorkingBackwards(issue, ask);
+    if (card.sections.some(section => section.key.startsWith('launch:'))) {
+      debug.log('steward.working-backwards', 'skipped-launched-before-draft', { issueId: issue.identifier });
+      continue;
+    }
+    // An invalid draft for the same issue text is not re-asked every tick — each ask is a 70-100 s LLM call (10-05 ELA-29 timed the schedule stage out 3×).
+    const invalidKey = `hitl:draft-invalid-${createHash('sha256').update(JSON.stringify({ title: issue.title, body: issue.body ?? '' })).digest('hex').slice(0, 16)}`;
+    if (card.sections.some(section => section.key === invalidKey)) {
+      debug.log('steward.working-backwards', 'skipped-known-invalid', { issueId: issue.identifier });
+      throw new InvalidWorkingBackwardsDraft();
+    }
+    let draft: WorkingBackwardsDraft;
+    try { draft = await draftWorkingBackwards(issue, ask); }
+    catch (error) {
+      if (error instanceof InvalidWorkingBackwardsDraft) {
+        // The memo is best-effort — failing to write it must not replace the invalid-draft error the caller routes to hitl.
+        try { store.appendSection(card.id, { key: invalidKey, owner: 'steward', content: 'working-backwards draft invalid for this issue text — not re-asked until the issue changes' }); }
+        catch (memoError) { debug.log('steward.working-backwards', 'invalid-memo-failed', { issueId: issue.identifier, error: memoError instanceof Error ? memoError.message : String(memoError) }); }
+      }
+      throw error;
+    }
     for (const [section, content] of [['prfaq', draft.prfaq], ['manual', draft.manual]] as const) {
       const key = `${section}:${createHash('sha256').update(content).digest('hex')}`;
       if (!card.sections.some(item => item.key === key)) store.appendSection(card.id, { key, owner: 'steward', content });

package/src/task-cards/card-cli.ts

@@ -46,6 +46,31 @@ export function registerCardCommand(program: Command, deps: CardCliDeps = {}): C
       }
     });
 
+  card.command('close <id>')
+    .description('Close a task card with a reason (owner operation)')
+    .requiredOption('--reason <text>', 'One-line close reason')
+    .action((id: string, options: { reason: string }) => {
+      const store = createStore();
+      try {
+        const reason = options.reason.trim();
+        if (!reason || /[\r\n]/.test(options.reason)) throw new Error('Close reason must be one line');
+        const existing = store.getCard(id);
+        if (!existing) {
+          process.stderr.write(`Card not found: ${id}\n`);
+          process.exitCode = 1;
+          return;
+        }
+        if (existing.status === 'closed') {
+          write(`이미 닫힘: ${id}\n`);
+          return;
+        }
+        store.closeCard(id, reason);
+        write(`닫힘: ${id}\n`);
+      } finally {
+        store.close();
+      }
+    });
+
   card.command('list')
     .description('List task cards')
     .option('--open', 'Only show open cards')

package/src/task-cards/card-store.ts

@@ -32,7 +32,7 @@ export interface AppendSectionInput {
 type CardEvent =
   | { type: 'created'; id: string; goalId: string; title: string; createdAt: string }
   | { type: 'section'; key: string; owner: string; content: string; createdAt: string }
-  | { type: 'closed'; createdAt: string };
+  | { type: 'closed'; createdAt: string; reason?: string };
 
 /** RFC §3 (내부 문서 `RFC-execution-and-landing-loop-agents-parallel-first-2026-09-29`) — each card section has one owner.
  *  A key is `<section>` or `<section>:<idempotency key>`: the same section can be appended many times over a
@@ -197,13 +197,15 @@ export class CardStore {
     }).immediate();
   }
 
-  closeCard(id: string): TaskCard {
+  closeCard(id: string, reason?: string): TaskCard {
+    if (reason !== undefined && !reason.trim()) throw new Error('Close reason is required');
     return this.db.transaction(() => {
       this.reconcile();
       const card = this.readCard(id);
       if (!card) throw new Error(`Card not found: ${id}`);
       if (card.status === 'closed') return card;
-      this.append(id, { type: 'closed', createdAt: new Date().toISOString() });
+      this.append(id, { type: 'closed', createdAt: new Date().toISOString(),
+        ...(reason === undefined ? {} : { reason: redactSecrets(reason.trim()) }) });
       return { ...card, status: 'closed' as const };
     }).immediate();
   }

package/src/task-orchestrator/surfaces/pod-artifact-return.ts

@@ -1,9 +1,9 @@
-import { lstatSync, mkdirSync, writeFileSync } from 'node:fs';
+import { lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { gunzipSync } from 'node:zlib';
 import { debug } from '../../debug/log.js';
 import { getDefaultLogStore, type LogStore } from '../../mss/logging/log-store.js';
-import type { LogRecord } from '../../mss/logging/record.js';
+import { fromJsonl, type LogRecord } from '../../mss/logging/record.js';
 
 const FILE_LIMIT = 5 * 1024 * 1024;
 const TOTAL_LIMIT = 20 * 1024 * 1024;
@@ -83,50 +83,58 @@ export function parsePodArtifactChunks(logs: string): ParseResult {
 
 const POD_LOGS_PATH = 'pod-logs/logs.jsonl';
 
-function childRunId(data: unknown): string | undefined {
-  if (!data || typeof data !== 'object' || Array.isArray(data)) return undefined;
-  const value = (data as Record<string, unknown>).runId;
-  return typeof value === 'string' && value.length > 0 ? value : undefined;
-}
-
-function decisionRecord(line: string): { rec: LogRecord; surface: string } | undefined {
-  let parsed: unknown;
-  try { parsed = JSON.parse(line); } catch { return undefined; }
-  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return undefined;
-  const row = parsed as Record<string, unknown>;
-  if (row.category !== 'harness.decision') return undefined;
-  if (typeof row.ts !== 'string' || typeof row.event !== 'string') return undefined;
-  const runId = childRunId(row.data);
-  if (!runId) return undefined;
-  const data = { ...(row.data as Record<string, unknown>), podJob: '', importedFrom: 'pod' as const };
-  return {
-    rec: {
-      ts: row.ts,
-      category: 'harness.decision',
-      event: row.event,
-      data,
-      ...(typeof row.level === 'string' ? { level: row.level as LogRecord['level'] } : {}),
-      ...(typeof row.trace_id === 'string' ? { trace_id: row.trace_id } : {}),
-    },
-    surface: typeof row.surface === 'string' && row.surface ? row.surface : 'pod',
-  };
+/** Last measured child ledger context when a failed Pod emitted no terminal JSON. */
+export function podNoResultDiagnostic(ledger: string): string | null {
+  let stage: string | undefined;
+  let round: number | undefined;
+  let mustFix: string | undefined;
+  for (const line of ledger.split(/\r?\n/)) {
+    try {
+      const entry = JSON.parse(line) as { event?: unknown; data?: Record<string, unknown> };
+      if (!entry || typeof entry !== 'object' || !entry.data || typeof entry.data !== 'object' || typeof entry.event !== 'string' || entry.event === 'pod-ledger-incomplete') continue;
+      if (typeof entry.data.round === 'number' && Number.isSafeInteger(entry.data.round)) round = entry.data.round;
+      if (entry.event !== 'run-origin') stage = entry.event;
+      // `reviewed` carries pointers only (count + finding ids); the text stays in the review artifact.
+      if (entry.event === 'reviewed' && typeof entry.data.mustFix === 'number') {
+        const ids = Array.isArray(entry.data.findingIds) ? entry.data.findingIds.filter((id): id is string => typeof id === 'string') : [];
+        mustFix = `${entry.data.mustFix}${ids.length ? ` ${JSON.stringify(ids)}` : ''}`;
+      }
+    } catch { /* incomplete ledger line */ }
+  }
+  return stage ? `child terminal result missing; last ledger stage=${stage}; round=${round ?? 'unknown'}; mustFix=${mustFix ?? 'unknown'}` : null;
 }
 
-/** Import only harness.decision rows from a returned pod log into the launching host store. */
-export function importPodDecisionLogs(bytes: Buffer, job: string, store: LogStore | null = getDefaultLogStore()): { imported: number; skipped: number } {
+/** Import valid JSONL log records into the launching host store, with durable per-job line receipts. */
+export function importPodLogs(bytes: Buffer, job: string, store: LogStore | null = getDefaultLogStore()): { imported: number; skipped: number } {
   if (!store) return { imported: 0, skipped: 0 };
-  const text = bytes.toString('utf8');
-  const rows: Array<{ rec: LogRecord; surface: string }> = [];
+  const rows: Array<{ rec: LogRecord; surface: string; line: number }> = [];
   let skipped = 0;
-  for (const line of text.split(/\r?\n/)) {
+  for (const [lineNumber, line] of bytes.toString('utf8').split(/\r?\n/).entries()) {
     if (!line) continue;
-    const row = decisionRecord(line);
-    if (!row) { skipped += 1; continue; }
-    row.rec.data = { ...(row.rec.data as Record<string, unknown>), podJob: job };
-    rows.push(row);
+    const rec = fromJsonl(line);
+    if (!rec || !Number.isFinite(Date.parse(rec.ts))) { skipped++; continue; }
+    const data = rec.data && typeof rec.data === 'object' && !Array.isArray(rec.data)
+      ? rec.data as Record<string, unknown>
+      : rec.data === undefined ? {} : { originalData: rec.data };
+    const surface = (rec as LogRecord & { surface?: unknown }).surface;
+    rows.push({
+      rec: { ...rec, data: { ...data, origin: 'pod', podJob: job } },
+      surface: typeof surface === 'string' && surface ? surface : 'pod',
+      line: lineNumber,
+    });
+  }
+  return { imported: store.insertPodBatch(job, rows), skipped };
+}
+
+function importReturnedLogs(bytes: Buffer, job: string, store: LogStore | null,
+  log: (category: string, event: string, data: Record<string, unknown>) => void): void {
+  try {
+    if (!store) throw new Error('host log store unavailable');
+    const imported = importPodLogs(bytes, job, store);
+    log('self-implement.pod', 'pod-logs-imported', { job, imported: imported.imported, skipped: imported.skipped });
+  } catch (error) {
+    debug.log('self-implement.pod', 'pod-logs-import-failed', { job, reason: error instanceof Error ? error.message : String(error) });
   }
-  if (rows.length > 0) store.insertBatch(rows);
-  return { imported: rows.length, skipped };
 }
 
 /** Reject symlink parents as well as lexical traversal; never replace a host file. */
@@ -176,17 +184,24 @@ export function collectPodArtifacts(logs: string, { dir, job, log = (c, e, d) =>
         podLogsReturned = true;
         const lines = bytes.length ? bytes.toString('utf8').split('\n').length - (bytes.at(-1) === 10 ? 1 : 0) : 0;
         log('self-implement.pod', 'pod-logs-returned', { job, path: destination, lines });
-        try {
-          const imported = importPodDecisionLogs(bytes, job, logStore);
-          log('self-implement.pod', 'pod-decisions-imported', { job, imported: imported.imported, skipped: imported.skipped });
-        } catch (error) {
-          log('self-implement.pod', 'pod-logs-import-failed', { job, reason: error instanceof Error ? error.message : String(error) });
-        }
+        importReturnedLogs(bytes, job, logStore, log);
       }
     } catch (e) {
       const reason = (e as NodeJS.ErrnoException).code === 'EEXIST' ? 'exists' : e instanceof Error ? e.message : String(e);
-      if ((e as NodeJS.ErrnoException).code === 'EEXIST') log('self-implement.pod', 'artifact-collect-skipped', { job, path, reason });
-      else log('self-implement.pod', 'artifact-collect-incomplete', { job, path, reason });
+      if ((e as NodeJS.ErrnoException).code === 'EEXIST') {
+        log('self-implement.pod', 'artifact-collect-skipped', { job, path, reason });
+        if (path === podLogsPath) {
+          try {
+            const existing = resolve(dir, job, path);
+            if (!lstatSync(existing).isSymbolicLink() && readFileSync(existing).equals(bytes)) {
+              podLogsReturned = true;
+              importReturnedLogs(bytes, job, logStore, log);
+            }
+          } catch (error) {
+            debug.log('self-implement.pod', 'pod-logs-import-failed', { job, reason: error instanceof Error ? error.message : String(error) });
+          }
+        }
+      } else log('self-implement.pod', 'artifact-collect-incomplete', { job, path, reason });
       if (path === podLogsPath) podLogsMissingReason = reason;
     }
   }