elanous 0.2.23 → 0.2.24

package/src/task-agent/task-hand.ts

@@ -16,6 +16,8 @@ import { HARNESS_RUN_ID_ENV, mintRunId, normalizeRunId } from '../harness/harnes
 import { debug } from '../debug/log.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { withFileLockSync } from '../storage/file-lock.js';
+import { checkCompletionEvidence, deliverableReceiptEvidence } from './completion-evidence.js';
+import { judgeNextMove } from './judge.js';
 
 export interface ResolveHandTextDeps {
   cwd: string;
@@ -83,7 +85,7 @@ export function taskCardLabelContext(card: Pick<TaskCard, 'id'>): TaskCardLabelC
  * 과제 종결 종류(RFC-loop-agent-map §A4b③) — 비면 code-pr(PR 병합)로 읽는다.
  * code-pr 밖의 종류는 «확인 증거»(`judge.ts` TaskJudgeInput.evidence)로 종결한다 — 증거를 만드는 일은 DEFAULT-HANDS 몫.
  */
-export const COMPLETION_KINDS = ['code-pr', 'artifact', 'research-report', 'ops-action', 'content', 'watch-brief', 'decision-support'] as const;
+export const COMPLETION_KINDS = ['code-pr', 'artifact', 'research-report', 'ops-action', 'content', 'watch-brief', 'decision-support', 'deliverable'] as const;
 export type CompletionKind = typeof COMPLETION_KINDS[number];
 
 /**
@@ -92,6 +94,8 @@ export type CompletionKind = typeof COMPLETION_KINDS[number];
  */
 export interface TaskCardEvent {
   at: string; event: string; detail?: string; runId?: string; pr?: number;
+  /** `closed-by-hand` 줄만 — 닫은 사유 · 닫은 자리(`closeTaskCard`). */
+  reason?: string; by?: string;
   kind?: string; executed?: boolean; ok?: boolean; executorResult?: 'shadow' | 'live'; head?: string; effect?: string;
   /** TA-REVIEW-RESULT-CAPTURE — review live-move 줄 · 결과 줄(`live-move-result`)의 결과 파일 경로. */
   resultPath?: string;
@@ -102,6 +106,8 @@ export interface TaskCardEvent {
 export const LIVE_MOVE_HISTORY_EVENT = 'live-move';
 /** TA-REVIEW-RESULT-CAPTURE — 떼어 띄운 리뷰의 결과(또는 «결과 없음») 줄 — live-move 줄처럼 상태 사유 판정에서 뺀다. */
 export const LIVE_MOVE_RESULT_EVENT = 'live-move-result';
+/** HAND-MOVE-LEDGER — 자리가 손으로 마무리한 수 줄(`recordHandMove`) — 관측 기록이라 live-move 줄처럼 상태 사유 판정에서 뺀다. */
+export const HAND_MOVE_HISTORY_EVENT = 'hand-move';
 export interface TaskCardMove { kind: 'launch' | 'wait'; command?: string[]; reason: string }
 export interface TaskCard {
   id: string;
@@ -159,9 +165,17 @@ export interface TaskCard {
    * TA-REJUDGE-ON-HEAD — 런 멈춤 «뒤» 머리마다 한 번 돌린 호스트 재게이트(병합 없음 · 떼어 띄움). 결과는 `resultPath` 파일에서
    * 다음 틱이 회수해 passed·status·baseCommit·detail 을 채운다(비어 있으면 아직 도는 중 · 없는 칸을 «통과»로 읽지 않는다).
    */
-  regates?: Array<{ pr: number; head: string; at: string; resultPath?: string; passed?: boolean; status?: string; baseCommit?: string; detail?: string }>;
-  /** Live land attempts, claimed before invocation, once per PR head even if the command fails. */
-  landAttempts?: Array<{ pr: number; head: string; at: string; ok?: boolean; detail?: string }>;
+  regates?: Array<{ pr: number; head: string; at: string; resultPath?: string; passed?: boolean; status?: string; baseCommit?: string; detail?: string;
+    /** REJUDGE base-stale — 같은 머리를 새 base 위에서 다시 잰 재게이트면, land 가 낡았다고 거절한 앞 재게이트의 base(멱등 키 = 머리 ⊕ 이 base). */
+    staleBase?: string }>;
+  /**
+   * Live land attempts, claimed before invocation, once per PR head even if the command fails.
+   * TA-LAND-RETRY-ON-INFRA — a failed attempt carries `class`/`reason`: `infra` (TA-side, allow-listed) leaves one more attempt on
+   * the same head (`LAND_ATTEMPTS_PER_HEAD_ON_INFRA`); `judgement` · unknown reason · no class (older record) closes the head.
+   * REJUDGE base-stale — `base-stale` (overlap evidence gate base went stale with PR-file overlap) waits for a re-gate on a new base;
+   * only after that re-gate passes is the attempt consumed (`openLandAttempts`) and the same head may land once more.
+   */
+  landAttempts?: Array<{ pr: number; head: string; at: string; ok?: boolean; detail?: string; class?: 'infra' | 'judgement' | 'base-stale'; reason?: string }>;
   /** TA-LIVE-LAND-2 — `tasks hand --ta-land`: this card's run leaves the merge to the task agent (propose-land). */
   taLand?: true;
   /** TASKS-HAND-CHILD-LLM — `tasks hand --child-llm <provider>/<model> [--child-llm-effort <level>]` → 발사 인자 `--child-llm-provider/-model/-effort`. */
@@ -279,6 +293,16 @@ export function readTaskCard(id: string, path = taskAgentStatePath()): TaskCard
   return readState(path).tasks?.[id];
 }
 
+export const CLOSED_BY_HAND_EVENT = 'closed-by-hand';
+
+/** 카드를 손으로 닫는다 — 상태를 `failed` 로 두고 history 에 한 줄(`closed-by-hand`)을 남긴다. 이미 손으로 닫은 카드는 그대로 돌려준다(멱등). */
+export function closeTaskCard(card: TaskCard, input: { reason: string; by: string; at: string }): TaskCard {
+  const reason = input.reason.trim();
+  if (!reason) throw new Error('닫는 사유(reason)가 비어 있다');
+  if (card.status === 'failed' && card.history.some((item) => item.event === CLOSED_BY_HAND_EVENT)) return card;
+  return { ...card, status: 'failed', history: [...card.history, { at: input.at, event: CLOSED_BY_HAND_EVENT, kind: CLOSED_BY_HAND_EVENT, detail: reason, reason, by: input.by }] };
+}
+
 /** 첫 수의 elanous 인자(진입점·--config-dir 앞붙임은 launcher 몫). */
 export function launchArgs(card: Pick<TaskCard, 'text' | 'seat' | 'childLlm'>): string[] {
   const child = card.childLlm
@@ -298,8 +322,8 @@ export function nextMoveFor(card: TaskCard, landed?: ReadonlySet<string>): TaskC
   if (card.status !== 'launched' && unmet.length > 0) return { kind: 'wait', reason: `after ${unmet.join(', ')}${landed ? '' : ' · 착지 미확인'}` };
   if (card.status === 'handed') return { kind: 'launch', command: launchArgs(card), reason: '넘겨받은 과제 — 첫 발사' };
   if (card.status === 'launch-failed') return { kind: 'launch', command: launchArgs(card), reason: '직전 발사 실패 — 다시 발사' };
-  // live-move 줄(관측 기록)은 실패 사유가 아니다 — 그 줄을 뺀 마지막 칸이 사유다(live-move 줄 없는 카드는 종전과 같다).
-  if (card.status === 'failed') return { kind: 'wait', reason: card.history.filter((item) => item.event !== LIVE_MOVE_HISTORY_EVENT && item.event !== LIVE_MOVE_RESULT_EVENT).at(-1)?.detail ?? '런 실패 — PR·수확 가지 없음' };
+  // live-move·hand-move 줄(관측 기록)은 실패 사유가 아니다 — 그 줄을 뺀 마지막 칸이 사유다(live-move 줄 없는 카드는 종전과 같다).
+  if (card.status === 'failed') return { kind: 'wait', reason: card.history.filter((item) => item.event !== LIVE_MOVE_HISTORY_EVENT && item.event !== LIVE_MOVE_RESULT_EVENT && item.event !== HAND_MOVE_HISTORY_EVENT).at(-1)?.detail ?? '런 실패 — PR·수확 가지 없음' };
   return { kind: 'wait', reason: '발사됨 — 런 멈춤을 슈퍼바이저 그림자 판단(task-agent.shadow-move)이 받는다' };
 }
 
@@ -370,6 +394,29 @@ export class TaskLaunchError extends Error {
 
 export interface HandTaskResult { card: TaskCard; move: TaskCardMove; mode: 'shadow' | 'live'; launched: boolean; cwd?: string }
 
+/** Dispatch evidence for a handed deliverable card; unlike handTask, this never launches work. */
+export function dispatchDeliverableCompletion(id: string, input: { ref: string; receipt?: boolean }, path: string, now: () => Date = () => new Date()): boolean {
+  const card = readTaskCard(id, path);
+  if (card?.completion !== 'deliverable' || !card.project?.target || card.pr !== undefined || card.status === 'failed' || card.status === 'launch-failed') return false;
+  const evidence = checkCompletionEvidence('deliverable', { dir: card.project.target, ...input });
+  if (judgeNextMove({ completion: card.completion, evidence }).move !== 'propose-green') {
+    try { debug.log('task-agent', 'deliverable-rejected', { taskId: id, ref: input.ref, missing: evidence.missing }); } catch { /* fail-soft */ }
+    return false;
+  }
+  const receiptEvidence = deliverableReceiptEvidence(evidence.ref);
+  const at = now().toISOString();
+  let closed = false;
+  updateTaskCard(path, id, (current) => {
+    if (current?.completion !== 'deliverable' || current.pr !== undefined || current.greenProposal || !current.project || current.project.target !== card.project?.target || current.status === 'failed' || current.status === 'launch-failed') return undefined;
+    const fresh = checkCompletionEvidence('deliverable', { dir: current.project.target, ...input });
+    if (judgeNextMove({ completion: current.completion, evidence: fresh }).move !== 'propose-green') return undefined;
+    closed = true;
+    return { ...current, greenProposal: { at, checklistId: current.checklistId ?? null, evidence: { [id]: receiptEvidence } } };
+  });
+  try { debug.log('task-agent', closed ? 'deliverable-closed' : 'deliverable-rejected', { taskId: id, ref: evidence.ref, ...(closed ? {} : { missing: ['already-proposed-or-changed'] }) }); } catch { /* fail-soft */ }
+  return closed;
+}
+
 export async function handTask(opts: HandTaskOptions): Promise<HandTaskResult> {
   const text = opts.text.trim();
   if (!text) throw new Error('과제 한 줄이 비어 있다');
@@ -440,7 +487,7 @@ export async function handTask(opts: HandTaskOptions): Promise<HandTaskResult> {
   if (!opts.launcher) throw new Error('--live 인데 launcher 가 없다');
   const runId = mintRunId();
   const launchId = `tl-${randomBytes(6).toString('hex')}`;
-  const context: TaskLaunchContext = { runId, launchId, env: { [HARNESS_RUN_ID_ENV]: runId, ...(card.taLand ? { [TA_LAND_ENV]: '1' } : {}) }, cardLabelContext: taskCardLabelContext(card) };
+  const context: TaskLaunchContext = { runId, launchId, env: { [HARNESS_RUN_ID_ENV]: runId, ELANOUS_TASK_CARD_ID: card.id, ...(card.taLand ? { [TA_LAND_ENV]: '1' } : {}) }, cardLabelContext: taskCardLabelContext(card) };
   let receipt: void | TaskLaunchReceipt;
   try {
     receipt = await opts.launcher(move.command!, project?.target, context);

package/src/task-orchestrator/surfaces/pod-account-broker.ts

@@ -5,14 +5,15 @@
 //    «모른다»라서 뒤로 보내되 빼지 않는다(못 읽었다고 갈 곳을 없애지 않는다 — 회전 규칙과 같다).
 // ⛔ `--pod-account` 를 명시하면 브로커를 쓰지 않는다 — 사람의 의도가 이긴다.
 
-import { codexAccountThresholdPercent, type RotationCandidate } from '../../oauth/codex-account-rotation.js';
+import { CODEX_CREDIT_RESERVE_DEFAULT, codexAccountThresholdPercent, creditCandidatesByBalance, type RotationCandidate } from '../../oauth/codex-account-rotation.js';
+import { debug } from '../../debug/log.js';
 
 export const POD_ACCOUNT_EXCLUDE_AT_PERCENT = 95;
 
 export interface PodAccountPlan { usable: string[]; excluded: Array<{ name: string; why: string }>; /** 크레딧으로 쓰는 계정(구독 잔량 0 · 대표 허가) — 로그에 «크레딧» 으로 보이게. */ creditAccounts?: string[] }
 
 export type PodProviderPlan =
-  | { provider: 'openai-codex'; accounts: string[]; excluded: PodAccountPlan['excluded']; grokSubscriptionEligible: boolean; creditAccounts?: string[] }
+  | { provider: 'openai-codex'; accounts: string[]; excluded: PodAccountPlan['excluded']; grokSubscriptionEligible: boolean; creditAccounts?: string[]; /** CODEX-CREDITS-STEP — 체인 마지막 칸으로 크레딧에 왔다. */ codexCreditsStep?: true; /** 그 칸에 온 이유(관측). */ skipped?: string[] }
   | { provider: 'grok'; excluded: PodAccountPlan['excluded']; grokSubscriptionEligible: boolean }
   | { provider: null; reasons: string[]; grokSubscriptionEligible: boolean };
 
@@ -26,14 +27,39 @@ export function planPodProvider(input: {
   thresholdPercentByAccount?: Readonly<Record<string, unknown>>;
   /** 대표 크레딧 허가(`llm.codexCreditsAllowed`) — 구독 잔량 계정이 없으면 찬 계정을 크레딧으로 쓴다. */
   creditsAllowed?: boolean;
+  /** SUBSCRIPTION-EXHAUST-REROUTE — `llm.codexCreditReserve`. 잔액이 «알려져» 이 값 이하인 계정은 크레딧으로 쓰지 않는다. */
+  creditReserve?: number;
+  /** CODEX-CREDITS-STEP — `llm.fallbackChain` 에 `codex-credits` 칸이 있고 정책이 폴백을 허용한다(호출자가 확정). */
+  codexCreditsStep?: boolean;
+  /** grok «잔량» — `exhausted` 일 때만 grok 을 건너뛴다(「모른다」는 종전대로 grok · 돈을 쓰는 쪽으로 기울지 않는다). */
+  grokQuota?: 'usable' | 'exhausted' | 'unknown';
 }): PodProviderPlan {
   const accounts = planPodAccounts(input.codexCandidates, {
     excludeAt: input.excludeAt,
     thresholdPercentByAccount: input.thresholdPercentByAccount,
     creditsAllowed: input.creditsAllowed,
+    ...(input.creditReserve !== undefined ? { creditReserve: input.creditReserve } : {}),
   });
   if (accounts.usable.length) return { provider: 'openai-codex', accounts: accounts.usable, excluded: accounts.excluded, grokSubscriptionEligible: input.grokSubscription, ...(accounts.creditAccounts ? { creditAccounts: accounts.creditAccounts } : {}) };
-  if (input.grokSubscription || (input.grokApiKey && input.grokApiKeyOptIn)) return { provider: 'grok', excluded: accounts.excluded, grokSubscriptionEligible: input.grokSubscription };
+  const grokEligible = input.grokSubscription || (input.grokApiKey && input.grokApiKeyOptIn);
+  const grokSkippedAsExhausted = input.codexCreditsStep === true && input.grokQuota === 'exhausted';
+  if (grokEligible && !grokSkippedAsExhausted) return { provider: 'grok', excluded: accounts.excluded, grokSubscriptionEligible: input.grokSubscription };
+  if (input.codexCreditsStep === true) {
+    // 체인 마지막 칸 — 크레딧 잔액이 «확인된» 계정만, 많은 순(모르면 안 쓴다 · 돈이라 fail-closed).
+    const credit = creditCandidatesByBalance(input.codexCandidates, input.creditReserve ?? CODEX_CREDIT_RESERVE_DEFAULT).map((c) => c.name);   // 회전 수집기와 같은 자
+    if (credit.length > 0) {
+      return {
+        // 구독 기준 제외 사유는 진단용으로 남긴다(계정 선택은 credit 순서가 정한다).
+        provider: 'openai-codex', accounts: credit, excluded: accounts.excluded, creditAccounts: credit, codexCreditsStep: true,
+        grokSubscriptionEligible: input.grokSubscription,
+        skipped: ['codex-rotate:no-candidate', grokEligible ? 'grok:grok-exhausted' : 'grok:grok-unavailable'],
+      };
+    }
+    // 칸에 «닿았지만» 잔액 확인된 계정이 없다 — 실패한 도달도 남긴다.
+    try { debug.log('self-implement.pod', 'codex-credits-step', { outcome: 'skipped', why: 'codex-credits-unavailable', grokEligible }); } catch { /* observation is fail-soft */ }
+    // 크레딧도 못 쓰면 종전 그대로 — 소진 신호가 있어도 grok 으로(새로 막지 않는다).
+    if (grokEligible) return { provider: 'grok', excluded: accounts.excluded, grokSubscriptionEligible: input.grokSubscription };
+  }
   return {
     provider: null,
     grokSubscriptionEligible: false,
@@ -50,10 +76,11 @@ export function planPodAccounts(
     thresholdPercentByAccount?: Readonly<Record<string, unknown>>;
     excludeAt?: number;
     creditsAllowed?: boolean;
+    creditReserve?: number;
   } = {},
 ): PodAccountPlan {
-  const { thresholdPercentByAccount, excludeAt = POD_ACCOUNT_EXCLUDE_AT_PERCENT, creditsAllowed = false } =
-    typeof options === 'number' ? { excludeAt: options } : options;
+  const { thresholdPercentByAccount, excludeAt = POD_ACCOUNT_EXCLUDE_AT_PERCENT, creditsAllowed = false, creditReserve } =
+    typeof options === 'number' ? { excludeAt: options } as { thresholdPercentByAccount?: undefined; excludeAt: number; creditsAllowed?: boolean; creditReserve?: number } : options;
   const excluded: PodAccountPlan['excluded'] = [];
   const known: RotationCandidate[] = [];
   const unknown: RotationCandidate[] = [];
@@ -70,11 +97,17 @@ export function planPodAccounts(
   const usable = [...known, ...unknown].map((c) => c.name);
   // 대표 크레딧 허가: 구독 잔량이 남은 계정이 «하나도» 없을 때만 찬 계정을 크레딧으로 쓴다(사용률 낮은 순) — 잔량 계정이 있으면 그쪽이 먼저다.
   if (usable.length === 0 && creditsAllowed) {
+    // SUBSCRIPTION-EXHAUST-REROUTE — 잔액이 «알려져» 예비분 이하인 계정은 크레딧 후보가 아니다(모르면 종전대로 남긴다).
+    const reserve = typeof creditReserve === 'number' && Number.isFinite(creditReserve) && creditReserve >= 0 ? creditReserve : undefined;
     const credit = candidates
       .filter((c) => excluded.some((e) => e.name === c.name))
+      .filter((c) => reserve === undefined || typeof c.creditBalance !== 'number' || c.creditBalance > reserve)
       // 크레딧 잔액이 많은 계정부터(09-28 · 한 계정 크레딧만 타던 것) — 잔액을 모르면 사용률 낮은 순.
       .sort((a, b) => ((b.creditBalance ?? -1) - (a.creditBalance ?? -1)) || ((a.usedPercent ?? 100) - (b.usedPercent ?? 100)) || a.name.localeCompare(b.name))
       .map((c) => c.name);
+    if (credit.length === 0 && reserve !== undefined && excluded.length > 0) {
+      return { usable, excluded: excluded.map((e) => ({ ...e, why: `${e.why} · credits ≤ reserve ${reserve}` })) };
+    }
     return { usable: credit, excluded: [], creditAccounts: credit };
   }
   return { usable, excluded };

package/src/task-orchestrator/surfaces/pod-bedrock-child.ts

@@ -0,0 +1,74 @@
+/**
+ * BEDROCK-PROVIDER ② (0.2.24 · MK) — bedrock 자식 Pod 의 자격·리전·이그레스.
+ *
+ * 대표 10-10 승인: AWS 자격은 «bedrock Pod 에만» `secretKeyRef` 로 싣는다 · 값은 어디에도 내보내지 않는다 ·
+ *   다른 Pod 의 매니페스트는 바이트 하나 안 바뀐다.
+ *
+ * ⭐ 자격은 «작업별 creds Secret» 이 아니라 클러스터에 미리 둔 «이름 있는 Secret»(`elanous-bedrock-aws`)에서 온다.
+ *   호스트는 그 Secret 의 «키 이름»만 읽는다(값은 kubectl 밖으로 안 나온다) — 만들기는 `scripts/fleet/bedrock-pod-secret.ts`(사람 승인 뒤).
+ *   ⛔ SSO 캐시는 Pod 안에서 못 쓴다 — Pod 용 정적 키(또는 베어러 토큰)가 그 Secret 에 있어야 한다.
+ * ⛔ Secret 이 없거나 자격 키가 모자라면 «발사 전에» 거부한다(아무것도 apply 하지 않는다 · fail-closed).
+ * ⛔ 이 모듈은 가볍게 둔다(무거운 import 0).
+ */
+
+/** 클러스터(풀 노드마다)·네임스페이스(Pod 와 같은 곳)에 미리 둔 Secret 이름. */
+export const BEDROCK_POD_SECRET_NAME = 'elanous-bedrock-aws';
+
+/** bedrock Pod 만 다는 이그레스 라벨 — `docker/h1/policy-bedrock.yaml` 이 이 라벨에만 443 을 연다. */
+export const BEDROCK_POD_EGRESS_LABEL = 'elanous.egress/bedrock';
+
+/** Secret 에서 Pod env 로 «이름 그대로» 싣는 키(있는 것만). 값은 secretKeyRef 로만 간다. */
+export const BEDROCK_POD_SECRET_KEYS = ['AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY', 'AWS_SESSION_TOKEN', 'AWS_BEARER_TOKEN_BEDROCK', 'AWS_REGION'] as const;
+export type BedrockPodSecretKey = typeof BEDROCK_POD_SECRET_KEYS[number];
+
+/** Secret 의 «키 이름»만 뽑는 kubectl 인자 — go-template 이 값을 찍지 않는다. */
+export function bedrockPodSecretKeyNamesArgs(namespace: string, secretName = BEDROCK_POD_SECRET_NAME): string[] {
+  return ['-n', namespace, 'get', 'secret', secretName, '-o', 'go-template={{range $k, $v := .data}}{{$k}}{{"\\n"}}{{end}}'];
+}
+
+export interface BedrockPodSpec {
+  secretName: string;
+  /** Secret 에 «있는» 자격 키 이름(값 아님). */
+  keys: BedrockPodSecretKey[];
+  /** 리전 — Secret 의 `AWS_REGION` 키가 있으면 그것(secretKeyRef), 없으면 호스트가 푼 리전(평문 · 비밀 아님). */
+  region: { from: 'secret' } | { from: 'host'; value: string };
+}
+
+export type BedrockPodCheck = { ok: true; spec: BedrockPodSpec } | { ok: false; reason: string };
+
+type KubectlLike = (args: string[], stdin?: string) => { status: number | null; stdout: string; stderr: string };
+
+const AWS_REGION_SHAPE = /^[a-z]{2,4}(?:-[a-z]+)+-\d{1,2}$/;
+
+/**
+ * 발사 «전» 판정 — Secret 이 있나 · 자격 키가 갖춰졌나 · 리전이 풀리나. 어느 하나라도 아니면 거부 사유.
+ * ⛔ 사유 문면에 값·kubectl stderr 원문을 싣지 않는다(이름·고정 문면만).
+ */
+export function checkBedrockPodSecret(kubectl: KubectlLike, namespace: string, hostRegion: string | undefined, secretName = BEDROCK_POD_SECRET_NAME): BedrockPodCheck {
+  const fix = `scripts/fleet/bedrock-pod-secret.ts 로 ${namespace}/${secretName} 을 만든다(승인 뒤)`;
+  const got = kubectl(bedrockPodSecretKeyNamesArgs(namespace, secretName));
+  if (got.status !== 0) {
+    return { ok: false, reason: /not ?found/i.test(got.stderr) ? `pod: bedrock 자격 Secret 없음 — ${namespace}/${secretName} · ${fix}` : `pod: bedrock 자격 Secret 을 못 읽었다 — ${namespace}/${secretName} (kubectl rc=${got.status}) · 발사하지 않는다` };
+  }
+  const present = new Set(got.stdout.split('\n').map((line) => line.trim()).filter(Boolean));
+  const keys = BEDROCK_POD_SECRET_KEYS.filter((key) => present.has(key));
+  const staticPair = keys.includes('AWS_ACCESS_KEY_ID') && keys.includes('AWS_SECRET_ACCESS_KEY');
+  const bearer = keys.includes('AWS_BEARER_TOKEN_BEDROCK');
+  if (!staticPair && !bearer) {
+    return { ok: false, reason: `pod: bedrock 자격 Secret ${namespace}/${secretName} 에 자격 키가 없다 — AWS_ACCESS_KEY_ID ⊕ AWS_SECRET_ACCESS_KEY 또는 AWS_BEARER_TOKEN_BEDROCK 필요 · ${fix}` };
+  }
+  const host = hostRegion?.trim();
+  const region: BedrockPodSpec['region'] | undefined = keys.includes('AWS_REGION') ? { from: 'secret' }
+    : host && AWS_REGION_SHAPE.test(host) ? { from: 'host', value: host } : undefined;
+  if (!region) return { ok: false, reason: `pod: bedrock 리전 없음 — Secret ${namespace}/${secretName} 의 AWS_REGION 또는 호스트 AWS_REGION(·~/.aws/config) 필요` };
+  return { ok: true, spec: { secretName, keys: keys.filter((key) => key !== 'AWS_REGION' || region.from === 'secret'), region } };
+}
+
+/** bedrock 자식 컨테이너 env — 자격은 secretKeyRef, 리전은 secretKeyRef 또는 평문. IMDS 탐색은 끈다(Pod 에 인스턴스 역할 없음). */
+export function bedrockPodEnv(spec: BedrockPodSpec): Array<Record<string, unknown>> {
+  return [
+    ...spec.keys.map((key) => ({ name: key, valueFrom: { secretKeyRef: { name: spec.secretName, key } } })),
+    ...(spec.region.from === 'host' ? [{ name: 'AWS_REGION', value: spec.region.value }] : []),
+    { name: 'AWS_EC2_METADATA_DISABLED', value: 'true' },
+  ];
+}

package/src/task-orchestrator/surfaces/pod-child-default.ts

@@ -0,0 +1,50 @@
+/** SUBSCRIPTION-EXHAUST-REROUTE (0.2.24 · P0) — Pod 구현 자식의 «기본» 모델을 codex 밖으로 뺀다.
+ *
+ *  🩸 10-11 실측(apiEq 24h): codex 소모의 ~95% 가 node-b Pod 구현 자식이었다($2,633 · 107런). 원인은
+ *    자식 모델을 안 준 Pod 발사가 `planPodProvider` 로 codex(gpt-6-sol)에 떨어진 것이다.
+ *  ⭐ 결정 지점은 «호스트가 발사 인자를 만드는 곳»(`self orchestrate --substrate pod`) — 여기서 «자식 모델 없음 → 기본값»을
+ *    `--child-llm-provider/--child-llm-model` 과 «같은 모양»으로 채운다. 그 뒤 경로(키 확인·passEnv·Job 인자)는 명시 발사와 같다.
+ *  ⛔ 명시(`--child-llm-*`)가 있으면 손대지 않는다 · `--bench-arms`(팔마다 모델) · `--pod-account`(codex 계정 고정 = 사람의 선택)도 손대지 않는다.
+ *  ⛔ 기본값이 «못 서면»(OpenRouter 키 없음) 종전 codex 경로로 간다 — 기본값 때문에 발사가 죽지 않는다(관측은 남긴다).
+ *  config = `tools.selfImplement.podChildDefault`: `{ provider, model? }` · `'off'`(종전 codex 기본). 없으면 아래 상수. */
+
+/** 대표 라우팅 «중» 시작 모델 — OpenRouter 키는 Pod 에 이미 있다(새 자격 0). */
+export const POD_CHILD_DEFAULT = { provider: 'openrouter', model: 'openrouter/z-ai/glm-5.3' } as const;
+
+export type PodChildDefaultDecision =
+  | { apply: true; provider: string; model?: string; source: 'config' | 'default' }
+  | { apply: false; reason: 'flag' | 'bench-arms' | 'pod-account' | 'config-off' | 'no-openrouter-key'; provider?: string; model?: string; source?: 'config' | 'default' };
+
+function parseConfigValue(raw: unknown): { value: { provider: string; model?: string } | 'off'; source: 'config' } | { value: typeof POD_CHILD_DEFAULT; source: 'default'; invalid?: unknown } {
+  if (raw === undefined) return { value: POD_CHILD_DEFAULT, source: 'default' };
+  if (raw === 'off' || raw === false) return { value: 'off', source: 'config' };
+  if (raw && typeof raw === 'object' && !Array.isArray(raw)) {
+    const v = raw as Record<string, unknown>;
+    const provider = typeof v.provider === 'string' ? v.provider.trim() : '';
+    const model = typeof v.model === 'string' ? v.model.trim() : '';
+    if (provider) return { value: { provider, ...(model ? { model } : {}) }, source: 'config' };
+  }
+  return { value: POD_CHILD_DEFAULT, source: 'default', invalid: raw };
+}
+
+/** 순수 판정 — 「무엇을 보고 정했나」가 인자에 다 있다. */
+export function resolvePodChildDefault(input: {
+  flags: { provider?: string; model?: string; effort?: string };
+  benchArms: boolean;
+  explicitPodAccount?: string;
+  config: unknown;
+  /** OpenRouter 키가 호스트에 «있나»(값은 안 본다) — openrouter 기본일 때만 묻는다. */
+  openrouterKeyPresent: () => boolean;
+}): PodChildDefaultDecision & { invalidConfig?: unknown } {
+  if (input.flags.provider?.trim() || input.flags.model?.trim() || input.flags.effort?.trim()) return { apply: false, reason: 'flag' };
+  if (input.benchArms) return { apply: false, reason: 'bench-arms' };
+  if (input.explicitPodAccount?.trim()) return { apply: false, reason: 'pod-account' };
+  const parsed = parseConfigValue(input.config);
+  const invalid = 'invalid' in parsed ? { invalidConfig: parsed.invalid } : {};
+  if (parsed.value === 'off') return { apply: false, reason: 'config-off', source: 'config' };
+  const { provider, model } = parsed.value as { provider: string; model?: string };
+  if (provider === 'openrouter' && !input.openrouterKeyPresent()) {
+    return { apply: false, reason: 'no-openrouter-key', provider, ...(model ? { model } : {}), source: parsed.source, ...invalid };
+  }
+  return { apply: true, provider, ...(model ? { model } : {}), source: parsed.source, ...invalid };
+}

package/src/task-orchestrator/surfaces/pod-child-providers.ts

@@ -7,7 +7,9 @@
  *   목록 밖 provider 는 발사 «전»에 같은 문면으로 거부된다.
  * ⛔ 이 모듈은 가볍게 둔다(무거운 import 0) — 하니스 CLI 가 Pod 표면 전체를 끌어오지 않게.
  */
-export const POD_CHILD_PROVIDERS = ['openai-codex', 'grok', 'openrouter', 'anthropic'] as const;
+// BEDROCK-PROVIDER ② (0.2.24) — bedrock 은 «이름 있는 AWS Secret» 이 클러스터에 있을 때만 뜬다(pod-bedrock-child.ts · 발사 전 거부).
+// ZAI-POD-CHILD (0.2.24) — glm 은 Z.ai GLM Coding Plan(정액 구독) · «이름 있는 ZAI Secret» 이 클러스터에 있을 때만 뜬다(pod-zai-child.ts · 발사 전 거부 · 동시 상한 넘치면 정책대로).
+export const POD_CHILD_PROVIDERS = ['openai-codex', 'grok', 'openrouter', 'anthropic', 'bedrock', 'glm'] as const;
 export type PodChildProvider = typeof POD_CHILD_PROVIDERS[number];
 
 /** 사람이 쓰는 별칭 → 정식 이름. */
@@ -27,3 +29,14 @@ export function podChildProviderRefusal(named: string | undefined): string | und
   if (!id || podChildProviderOf(id)) return undefined;
   return `pod: Pod 자식 provider 는 ${POD_CHILD_PROVIDERS.join('|')} 만 — 받음 ${id}`;
 }
+
+/**
+ * BEDROCK-POD-PROVIDER-DROP (0.2.24) — 발사(`index.ts`)가 고른 Pod provider 를 Pod 옵션(`provider` · `account`)으로 옮기는 «한 곳».
+ * 🩸 10-11: podBase 가 grok·openrouter·anthropic 만 손으로 나열해 `bedrock` 이 떨어졌다 — Pod 자식은 codex(team) 로 돌았다.
+ * ⭐ codex 가 아닌 provider 는 «그 이름»이 곧 account 다(Pod 표면 `plannedAccount` 와 같은 규칙) · codex 만 명시 계정 ?? team.
+ */
+export function podLaunchProviderOptions(podProvider: PodChildProvider, o: { explicitPodAccount?: string; grokApiKeyOptIn: boolean }): { account: string; provider: PodChildProvider; grokApiKeyOptIn?: boolean } {
+  // provider 는 여섯 전부 싣는다 — Pod 의 podChildLlmArgs 는 명시 발사에 provider 가 비면 거부한다(조용한 codex 금지).
+  if (podProvider === 'openai-codex') return { account: o.explicitPodAccount ?? 'team', provider: 'openai-codex' };
+  return { account: podProvider, provider: podProvider, ...(podProvider === 'grok' ? { grokApiKeyOptIn: o.grokApiKeyOptIn } : {}) };
+}

package/src/task-orchestrator/surfaces/pod-failure-reason.ts

@@ -44,6 +44,81 @@ export function podTerminalRow(row: Record<string, unknown>): { stage: string; o
   return nestedPodResult(row);
 }
 
+export const POD_EXIT_CLASSES = ['oom-killed', 'deadline-exceeded', 'gh-login-failed', 'pod-secret', 'ask-reprompt', 'child-unconverged', 'child-error', 'no-result-line', 'unknown'] as const;
+
+export type PodExitClass = typeof POD_EXIT_CLASSES[number];
+
+const isPodBookkeepingLine = (line: string): boolean =>
+  /^(?:ELANOUS_(?:MEM|RUN_LEDGER|USAGE_ROLLUP|POD_)|\[graph\] |\[ask\]\s+\d+\)\s)/u.test(line) || /^(?:at\s+\S|\.\.\.\s+\d+\s+more\b|cleanup\s+(?:complete|done|finished)\b)/iu.test(line);
+
+const isPodErrorLine = (line: string): boolean =>
+  /\berror\b|\bfail(?:ed|ure)?\b|exception|fatal|denied|timed?\s*out|exceeded|overloaded|unavailable|exhausted|오류|실패/iu.test(line);
+
+const normalizePodLogLine = (line: string): string => line.replace(/\/home\/[^/\s]+\//gu, '~/').slice(0, 240);
+
+/** Classify a failed Pod using its terminal metadata and child output, without side effects. */
+export function classifyPodExit(input: {
+  errorCode?: string | null;
+  containerReason?: string | null;
+  containerExitCode?: number | null;
+  jobReason?: string | null;
+  logs: string;
+  result?: Record<string, unknown> | null;
+}): { class: PodExitClass; errorCode: string | null; containerReason: string | null; exitCode: number | null; jobReason: string | null; tail: string[] } {
+  const logLines = input.logs.split(/\r\n|\n|\r/u).map((line) => line.trim()).filter(Boolean);
+  let terminalResult: { stage: string; ok: boolean; error?: string } | null = null;
+  for (const line of logLines) {
+    if (!line.startsWith('{')) continue;
+    let parsed: unknown;
+    try { parsed = JSON.parse(line); } catch { continue; }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) continue;
+    terminalResult = podTerminalRow(parsed as Record<string, unknown>) ?? terminalResult;
+  }
+  if (!terminalResult && input.result) terminalResult = podTerminalRow(input.result);
+  const hasResultLine = terminalResult !== null;
+  const askReprompt = logLines.some((line) =>
+    /^\[ask\](?!\s+\d+\)\s).*(?:implementation[_ -]?target|reprompt|re-prompt|되묻)/iu.test(line));
+  // 파싱되는 JSON 줄(진행·결과 행)은 오류 «줄»로 세지 않는다 — tail 과 같은 기준.
+  const isParsedJsonLine = (line: string): boolean => {
+    if (!line.startsWith('{')) return false;
+    try { const parsed = JSON.parse(line); return !!parsed && typeof parsed === 'object' && !Array.isArray(parsed); } catch { return false; }
+  };
+  const hasErrorLine = logLines.some((line) => !isPodBookkeepingLine(line) && !isParsedJsonLine(line) && isPodErrorLine(line));
+  let exitClass: PodExitClass;
+  if (input.errorCode === 'pod-secret') exitClass = 'pod-secret';
+  else if (input.jobReason === 'DeadlineExceeded') exitClass = 'deadline-exceeded';
+  else if (input.containerReason === 'OOMKilled') exitClass = 'oom-killed';
+  else if (input.containerExitCode === 7) exitClass = 'gh-login-failed';
+  else if (askReprompt) exitClass = 'ask-reprompt';
+  else if (terminalResult?.stage && terminalResult.ok === false) exitClass = 'child-unconverged';
+  else if (!hasResultLine && hasErrorLine) exitClass = 'child-error';
+  else if (!hasResultLine) exitClass = 'no-result-line';
+  else exitClass = 'unknown';
+
+  const tail = logLines.flatMap((line) => {
+    if (line.startsWith('{')) {
+      let parsed: unknown;
+      try { parsed = JSON.parse(line); } catch { parsed = undefined; }
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+        const terminal = podTerminalRow(parsed as Record<string, unknown>);
+        if (terminal?.error) return terminal.error.split(/\r\n|\n|\r/u).map((part) => part.trim())
+          .filter((part) => part && !isPodBookkeepingLine(part)).map(normalizePodLogLine);
+        return [];
+      }
+    }
+    return isPodBookkeepingLine(line) ? [] : [normalizePodLogLine(line)];
+  }).slice(-5);
+
+  return {
+    class: exitClass,
+    errorCode: input.errorCode ?? null,
+    containerReason: input.containerReason ?? null,
+    exitCode: input.containerExitCode ?? null,
+    jobReason: input.jobReason ?? null,
+    tail,
+  };
+}
+
 /** Extract a human-readable reason from a failed child Pod without treating transfer markers as child errors. */
 export function extractPodFailureReason(input: {
   logs: string;
@@ -59,10 +134,8 @@ export function extractPodFailureReason(input: {
   }
   if (input.containerReason === 'OOMKilled') return 'OOMKilled: 컨테이너 메모리 한도 초과';
 
-  const isBookkeeping = (line: string): boolean =>
-    /^(?:ELANOUS_(?:MEM|RUN_LEDGER|USAGE_ROLLUP|POD_)|\[graph\] |\[ask\]\s+\d+\)\s)/u.test(line) || /^(?:at\s+\S|\.\.\.\s+\d+\s+more\b|cleanup\s+(?:complete|done|finished)\b)/iu.test(line);
-  const isError = (line: string): boolean =>
-    /\berror\b|\bfail(?:ed|ure)?\b|exception|fatal|denied|timed?\s*out|exceeded|overloaded|unavailable|exhausted|오류|실패/iu.test(line);
+  const isBookkeeping = isPodBookkeepingLine;
+  const isError = isPodErrorLine;
   const meaningful: Array<{ text: string; terminal: boolean }> = [];
   for (const line of input.logs.split(/\r\n|\n|\r/u)) {
     const trimmed = line.trim();
@@ -90,7 +163,7 @@ export function extractPodFailureReason(input: {
     meaningful.push({ text: trimmed, terminal: false });
   }
   const errorLine = [...meaningful].reverse().find((line) => line.terminal || isError(line.text));
-  const reason = errorLine?.text.replace(/\/home\/[^/\s]+\//gu, '~/').slice(0, 240);
+  const reason = errorLine ? normalizePodLogLine(errorLine.text) : undefined;
   if (reason) return reason;
   // POD-NORESULT: an unconverged child (exit 2 → BackoffLimitExceeded under backoffLimit 0) often leaves a result row
   // with a stage and PR but no error text — report that instead of «unreadable».
@@ -101,5 +174,5 @@ export function extractPodFailureReason(input: {
     return pr ? `수확 가능(${stage}) · ${pr}` : `수렴 못 함(단계 ${stage})`;
   }
   const why = input.logTailReason?.trim() || (input.logs.trim() ? '로그에 읽을 수 있는 오류 줄 없음' : '자식 로그 비어 있음');
-  return `사유 못 읽음: ${why.replace(/\/home\/[^/\s]+\//gu, '~/').slice(0, 240)}`;
+  return `사유 못 읽음: ${normalizePodLogLine(why)}`;
 }

package/src/task-orchestrator/surfaces/pod-lease.ts

@@ -40,6 +40,8 @@ export function leaseKubectl(args: readonly string[], input?: string): { status:
 export interface PodLeaseMember {
   context: string;
   capacity: number;
+  /** POD-POOL-UNCAPPED-SPEC — `capacity` came from the spec default (`:N` absent), not from the operator. */
+  capacityDefaulted?: boolean;
   running: number | null;
   pending: number | null;
   /** Job names of Pending harness Pods already included in pending (used to avoid counting the same Job's host lease twice). */
@@ -94,7 +96,12 @@ export interface PoolLeaseMeasure {
 
 export interface PoolLeaseRecommendation {
   recommended: number | null;
-  limitedBy: 'capacity' | 'memory' | null;
+  /**
+   * What stopped admission: `memory` = node memory headroom · `capacity` = the pool slot budget ·
+   * `pool-cap` = POD-POOL-UNCAPPED-SPEC — a member whose cap came from the spec default (`:N` absent → 2) is
+   * already at/over that cap, so the pool spec itself (not memory, not a configured budget) is the bound.
+   */
+  limitedBy: 'capacity' | 'memory' | 'pool-cap' | null;
   reason: string | null;
   capacitySlots: number | null;
   memorySlots: number | null;
@@ -392,7 +399,7 @@ export function measurePoolLease(members: readonly PodPoolMember[], deps: { kube
   const kubectl = deps.kubectl ?? leaseKubectl;
   return { members: members.map((member) => {
     const base = ['--context', member.context, '--request-timeout=10s'];
-    const result: PodLeaseMember = { context: member.context, capacity: member.capacity, running: null, pending: null, unleasedRunning: null, memoryLimitBytes: null, allocatableMemoryBytes: null, allocatableCpuMillicores: null, availableMemoryByNodeBytes: null, reason: null };
+    const result: PodLeaseMember = { context: member.context, capacity: member.capacity, ...(member.capacityDefaulted ? { capacityDefaulted: true } : {}), running: null, pending: null, unleasedRunning: null, memoryLimitBytes: null, allocatableMemoryBytes: null, allocatableCpuMillicores: null, availableMemoryByNodeBytes: null, reason: null };
     try {
       const nodes = kubectl([...base, 'get', 'nodes', '-o', 'json']);
       const jobs = kubectl([...base, '-n', 'elanous-test', 'get', 'jobs', '-l', 'elanous.substrate=pod', '-o', 'json']);
@@ -635,7 +642,7 @@ export function recommendConcurrency(measure: PoolLeaseMeasure, options: { capac
   if (goalBytes === null || goalBytes <= 0) return { ...empty, reason: '측정 불가: perGoalMemory' };
   const admission = admissionByUsage(measure, goalBytes, options.perGoalMemory !== undefined);
   if (!measure.members.length || measure.members.some((m) => m.running === null || m.pending === null || m.unleasedRunning === null || m.allocatableMemoryBytes === null || m.memoryLimitBytes === null || m.allocatableCpuMillicores === null || m.availableMemoryByNodeBytes === null)) {
-    debug.log('pod-lease', 'admit-by-usage', { samples: admission.samples, p95Bytes: admission.p95Bytes, admitBytes: admission.admitBytes, fallback: admission.fallback, recommended: null, limitedBy: null });
+    debug.log('pod-lease', 'admit-by-usage', { samples: admission.samples, p95Bytes: admission.p95Bytes, admitBytes: admission.admitBytes, fallback: admission.fallback, recommended: null, limitedBy: null, capacity: options.capacity, capacitySlots: null, memorySlots: null, running: null, pending: null });
     return { ...empty, reason: `측정 불가: cluster${measure.members.map((m) => m.reason ? ` ${m.context}: ${m.reason}` : '').join('')}` };
   }
   if (!Number.isSafeInteger(options.capacity) || options.capacity < 0) return { ...empty, reason: '측정 불가: capacity' };
@@ -680,9 +687,14 @@ export function recommendConcurrency(measure: PoolLeaseMeasure, options: { capac
     Math.floor((m.allocatableMemoryBytes! - m.memoryLimitBytes!) / liteBytes))), 0);
   const memoryBound = Math.min(memorySlots, placeableSlots);
   const recommended = Math.max(0, Math.min(capacitySlots, memoryBound) - eligibleUnleasedRunning);
-  const limitedBy = memoryBound < capacitySlots ? 'memory' : 'capacity';
+  // POD-POOL-UNCAPPED-SPEC — `capacity ≤ occupied` on a member whose cap is the spec default (`:N` absent → 2) means
+  // the «uncapped» pool spec is what admits nothing. Name it `pool-cap`, not the generic `capacity`, so a launch that
+  // sits on `recommended=0` says in its first admit line that the pool spec never declared a cap of its own.
+  const defaultCapFull = capacitySlots <= 0 && measure.members.some((m) => m.capacityDefaulted === true
+    && m.reason !== 'dns' && m.running !== null && m.pending !== null && m.running + m.pending >= m.capacity);
+  const limitedBy: PoolLeaseRecommendation['limitedBy'] = memoryBound < capacitySlots ? 'memory' : defaultCapFull ? 'pool-cap' : 'capacity';
   if (unleasedRunning > 0) debug.log('pod-lease', 'unleased', { unleasedRunning, running, recommended });
-  debug.log('pod-lease', 'admit-by-usage', { samples: admission.samples, p95Bytes: admission.p95Bytes, admitBytes: admission.admitBytes, fallback: admission.fallback, recommended, limitedBy });
+  debug.log('pod-lease', 'admit-by-usage', { samples: admission.samples, p95Bytes: admission.p95Bytes, admitBytes: admission.admitBytes, fallback: admission.fallback, recommended, limitedBy, capacity: options.capacity, capacitySlots, memorySlots, running, pending });
   return { recommended, limitedBy, reason: measure.members.some((m) => m.reason === 'dns') ? 'dns' : null, capacitySlots, memorySlots, liteMemorySlots, placeableSlots, accountSlots, running, pending, pendingJobs, unleasedRunning, admission };
 }
 

package/src/task-orchestrator/surfaces/pod-ledger-collect.ts

@@ -14,6 +14,8 @@ type ParseResult = Ledger[] | { error: Incomplete[]; ledgers: Ledger[] };
 const NON_PROGRESS_EVENTS = new Set(['progress-delivery-outcome']);
 const REEMIT_EXCLUDED_PREFIX = 'progress-delivery';
 type Emit = (category: string, event: string, data: Record<string, unknown>) => void;
+/** Heal-loop starter seam — defaults to the real `startHealLoop` inside `recordFailureEvent`. */
+type StartHealLoop = Parameters<typeof recordFailureEvent>[2];
 
 /** Reemit only complete ledger records; offsets name the first byte of each line in the Pod ledger. */
 function reemitLedgerLines(jsonl: string, runId: string, startOffset: number, emit: Emit): number {
@@ -93,7 +95,7 @@ export function parsePodLedgerChunks(logs: string): ParseResult {
   return error.length ? { error, ledgers } : ledgers;
 }
 
-function intakeCollectedFailure(runId: string, dir: string, log: Emit): void {
+function intakeCollectedFailure(runId: string, dir: string, log: Emit, startHealLoop?: StartHealLoop): void {
   let ledger: ReturnType<typeof loadRunLedger>;
   try { ledger = loadRunLedger(runId, dir); }
   catch { return; }
@@ -104,8 +106,10 @@ function intakeCollectedFailure(runId: string, dir: string, log: Emit): void {
   if (terminal?.data.runStatus !== 'failed' || !terminal.timestamp || !Number.isFinite(Date.parse(terminal.timestamp))
     || ledger.slice(terminalIndex + 1).some(entry => !TRAILING_BOOKKEEPING_EVENTS.includes(entry.event as typeof TRAILING_BOOKKEEPING_EVENTS[number]))) return;
   try {
+    // POD-HEAL-HOST — the recovered Pod failure is recorded into the HOST universe (`dirname(dir)`),
+    // so the host heal loop triages it (harvest + narrowed relaunch) instead of dying inside the Pod.
     recordFailureEvent({ source: 'harness-run', kind: 'pod-run', ref: runId,
-      summary: `Pod run ${runId} failed`, at: terminal.timestamp }, dirname(dir));
+      summary: `Pod run ${runId} failed`, at: terminal.timestamp }, dirname(dir), startHealLoop);
   } catch (error) {
     log('self-implement.pod', 'heal-intake-failed', { runId, reason: error instanceof Error ? error.message : String(error) });
   }
@@ -115,11 +119,13 @@ function intakeCollectedFailure(runId: string, dir: string, log: Emit): void {
  *  except a ledger that THIS run's live follower created (`replace`): that one is a partial copy and the final is complete. */
 export function collectPodLedgers(
   logs: string,
-  { dir = runLedgerDir(), log = defaultPodReemit(), emit = defaultPodReemit(), replace = new Set<string>() }: {
+  { dir = runLedgerDir(), log = defaultPodReemit(), emit = defaultPodReemit(), replace = new Set<string>(), startHealLoop }: {
     dir?: string;
     log?: (category: string, event: string, data: Record<string, unknown>) => void;
     emit?: Emit;
     replace?: ReadonlySet<string>;
+    /** Which starter receives a recovered Pod failure (POD-HEAL-HOST 판정선 measurement); default = real `startHealLoop`. */
+    startHealLoop?: StartHealLoop;
   } = {},
 ): void {
   const parsed = parsePodLedgerChunks(logs);
@@ -136,7 +142,7 @@ export function collectPodLedgers(
       const newLines = Buffer.from(jsonl).subarray(previousBytes).toString('utf8');
       reemitLedgerLines(newLines, runId, previousBytes, emit);
       log('self-implement.pod', 'ledger-collected', { runId, lines: jsonl.split('\n').filter(Boolean).length, bytes: Buffer.byteLength(jsonl) });
-      intakeCollectedFailure(runId, dir, log);
+      intakeCollectedFailure(runId, dir, log, startHealLoop);
     } catch (e) {
       if ((e as NodeJS.ErrnoException).code === 'EEXIST') {
         // A reattached Job may have already delivered this exact complete snapshot.
@@ -145,7 +151,7 @@ export function collectPodLedgers(
           const existing = readFileSync(runLedgerPath(runId, dir));
           const identical = existing.equals(Buffer.from(jsonl));
           log('self-implement.pod', identical ? 'ledger-collect-already-complete' : 'ledger-collect-skipped', { runId, reason: 'exists' });
-          if (identical) intakeCollectedFailure(runId, dir, log);
+          if (identical) intakeCollectedFailure(runId, dir, log, startHealLoop);
         } catch (readError) {
           log('self-implement.pod', 'ledger-collect-incomplete', { runId, reason: readError instanceof Error ? readError.message : String(readError) });
         }