elanous 0.2.23 → 0.2.25

package/src/harness/harness-gc.ts

@@ -0,0 +1,331 @@
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+import { debug } from '../debug/log.js';
+import { configuredWorktreeRoot } from '../user-config.js';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { acquireLockSync } from '../storage/file-lock.js';
+import { createGhRunner, execHarnessClean, gitStdout, type GitRunner, type GhRunner, type ActiveDirectoryProvider } from './harness-clean.js';
+import type { WorktreeAssessmentInput, WorktreeAssessment } from './harness-worktrees.js';
+
+export interface HarnessGcOptions {
+  repos?: string[];
+  dryRun?: boolean;
+  window?: number;
+  maxRemove?: number;
+  budgetMs?: number;
+}
+
+export interface HarnessGcDeps {
+  stateRoot?: string;
+  worktreeRoot?: string;
+  now?: () => number;
+  run?: GitRunner;
+  runGh?: GhRunner;
+  activeDirectoryProvider?: ActiveDirectoryProvider;
+  assessWorktree?: (input: WorktreeAssessmentInput) => WorktreeAssessment;
+  readWorktreeProvenance?: (path: string, run: GitRunner) => { owner: string; command: string; createdAt: string };
+}
+
+export interface HarnessGcRepo {
+  gitDir: string;
+  offset: number;
+  window: number;
+  total: number;
+  removed: number;
+  preserved: number;
+  deferred: number;
+  failed: number;
+  preservedByReason: Record<string, number>;
+  orphanScan: 'scanned' | 'unavailable' | 'not-requested';
+  unseenOutsideWindow?: number;
+  unseenOutsidePrefix?: number;
+}
+
+export interface HarnessGcResult {
+  outcome: 'ok' | 'skipped' | 'fail';
+  reason?: 'overlap' | 'no-target-repo' | 'repo-failed' | 'budget-exhausted';
+  repos: number;
+  removed: number;
+  preserved: number;
+  deferred: number;
+  failed: number;
+  unseenOutsideWindow?: number;
+  unseenOutsidePrefix?: number;
+  undiscoverable: number;
+  orphanScanUnavailable: number;
+  budgetMs: number;
+  elapsedMs: number;
+  repositories: HarnessGcRepo[];
+  repoFailures?: Array<{ gitDir: string; error: string }>;
+  /** The tick budget ran out inside a repository's queries; that repository was left unverified (cursor kept). */
+  budgetExhausted?: boolean;
+}
+
+/** Discover current linked worktrees; the tick also retains previously verified automatic targets. */
+export function discoverHarnessGcRepos(root: string, expired: () => boolean = () => false):
+  { repos: string[]; undiscoverable: number; stopped?: boolean } {
+  const repos = new Set<string>();
+  let undiscoverable = 0;
+  // The deadline is checked *between* reads (each readdir / .git read); a stopped walk leaves the rest unverified.
+  let stopped = false;
+  const halt = (): boolean => { if (!stopped && expired()) stopped = true; return stopped; };
+  const done = () => ({ repos: [...repos].sort(), undiscoverable, ...(stopped ? { stopped } : {}) });
+  const children = (path: string): string[] => readdirSync(path, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory()).map((entry) => join(path, entry.name));
+  let scopes: string[];
+  if (halt()) return done();
+  try { scopes = children(root); }
+  catch { return { repos: [], undiscoverable: 0 }; }
+  for (const scope of scopes) {
+    if (halt()) return done();
+    let parents: string[];
+    try { parents = children(scope); }
+    catch { undiscoverable++; continue; }
+    for (const parent of parents) {
+      if (!parent.endsWith('.worktrees')) continue;
+      if (halt()) return done();
+      let paths: string[];
+      try { paths = children(parent); }
+      catch { undiscoverable++; continue; }
+      for (const path of paths) {
+        if (halt()) return done();
+        try {
+          const line = readFileSync(join(path, '.git'), 'utf8').trim();
+          const match = /^gitdir:\s*(.+?)[/\\]worktrees[/\\][^/\\]+\s*$/.exec(line);
+          if (!match) { undiscoverable++; continue; }
+          const gitDir = isAbsolute(match[1]!) ? match[1]! : resolve(path, match[1]!);
+          repos.add(resolve(gitDir));
+        } catch { undiscoverable++; }
+      }
+    }
+  }
+  return done();
+}
+
+function defaultRun(args: string[]) {
+  const result = spawnSync('git', args, { encoding: 'utf8', timeout: 20_000 });
+  return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
+}
+
+function positive(value: number | undefined, fallback: number): number {
+  if (value === undefined) return fallback;
+  if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`invalid GC limit: ${value}`);
+  return value;
+}
+
+/** One lock guards discovery, every repository window, deletion, and cursor writes. */
+export function runHarnessGcTick(opts: HarnessGcOptions = {}, deps: HarnessGcDeps = {}): HarnessGcResult {
+  const windowSize = positive(opts.window, 150);
+  const maxRemove = positive(opts.maxRemove, 30);
+  const budgetMs = positive(opts.budgetMs, 240_000);
+  const now = deps.now ?? Date.now;
+  const started = now();
+  const state = join(deps.stateRoot ?? effectiveInstanceRoot(), 'harness-gc');
+  mkdirSync(state, { recursive: true });
+  const lockPath = join(state, 'tick.lock');
+  let holder = '';
+  let release: () => void;
+  try {
+    release = acquireLockSync(lockPath, { maxTries: 2, retryBusyMs: 1, breakDeadHolder: true,
+      staleMs: Math.max(2 * budgetMs, 600_000), onWait: (value) => { holder = value; } });
+  } catch (error) {
+    if (!String(error).includes('timed out')) throw error;
+    debug.log('harness.gc', 'tick-skipped', { reason: 'overlap', holder });
+    return { outcome: 'skipped', reason: 'overlap', repos: 0, removed: 0, preserved: 0, deferred: 0, failed: 0,
+      undiscoverable: 0, orphanScanUnavailable: 0, budgetMs, elapsedMs: now() - started, repositories: [] };
+  }
+  try {
+    const runner = deps.run ?? defaultRun;
+    const cursorPath = join(state, 'cursor.json');
+    const targetsPath = join(state, 'targets.json');
+    let cursor: Record<string, number> = {};
+    let persistedTargets: string[] = [];
+    try {
+      const parsed: unknown = JSON.parse(readFileSync(cursorPath, 'utf8'));
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) cursor = parsed as Record<string, number>;
+    } catch { /* No cursor yet, or corrupt state: start at the beginning. */ }
+    try {
+      const parsed: unknown = JSON.parse(readFileSync(targetsPath, 'utf8'));
+      if (Array.isArray(parsed)) persistedTargets = parsed.filter((path): path is string =>
+        typeof path === 'string' && isAbsolute(path));
+    } catch { /* No persisted automatic targets yet. */ }
+    const discovery = opts.repos === undefined
+      ? discoverHarnessGcRepos(deps.worktreeRoot ?? configuredWorktreeRoot(), () => now() - started >= budgetMs)
+      : { repos: opts.repos, undiscoverable: 0 };
+    // A verified automatic target survives removal of its last linked worktree; --repo never enrolls it.
+    const candidates = opts.repos === undefined
+      ? [...new Set([...discovery.repos, ...persistedTargets])]
+      : discovery.repos;
+    const targets = new Set<string>();
+    const repoFailures: Array<{ gitDir: string; error: string }> = [];
+    let failed = 0;
+    // A discovery walk cut by the deadline: repositories it did not reach are unverified, not absent.
+    let discoveryBudgetExhausted = 'stopped' in discovery && discovery.stopped === true;
+    for (const repo of [...candidates].sort()) {
+      if (now() - started >= budgetMs) { discoveryBudgetExhausted = true; break; }
+      const common = gitStdout(['-C', repo, 'rev-parse', '--path-format=absolute', '--git-common-dir'], runner);
+      if (common.ok && common.value && isAbsolute(common.value)) {
+        const gitDir = resolve(common.value);
+        targets.add(gitDir);
+        if (!opts.dryRun && opts.repos === undefined) persistedTargets.push(gitDir);
+      } else { failed++; repoFailures.push({ gitDir: repo, error: 'git common directory unavailable' }); }
+    }
+    const repositories: HarnessGcRepo[] = [];
+    let removed = 0;
+    let preserved = 0;
+    let deferred = 0;
+    let unseenOutsideWindow: number | undefined = repoFailures.length || discoveryBudgetExhausted ? undefined : 0;
+    let unseenOutsidePrefix: number | undefined = repoFailures.length || discoveryBudgetExhausted ? undefined : 0;
+    let orphanScanUnavailable = 0;
+    let processedTargets = 0;
+    let budgetExhausted = false;
+    // maxRemove bounds deletion *attempts* (incl. partial/failed ones), not only successes.
+    let attempts = 0;
+    const overBudget = (): boolean => now() - started >= budgetMs;
+    const baseGh: GhRunner = deps.runGh ?? createGhRunner();
+    for (const gitDir of [...targets].sort()) {
+      if (overBudget()) { budgetExhausted = true; break; } // remaining repositories unprocessed — record it
+      processedTargets++;
+      const offset = Number.isSafeInteger(cursor[gitDir]) && cursor[gitDir]! >= 0 ? cursor[gitDir]! : 0;
+      // The deadline is enforced inside the clean too: once it passes, every further *read* (git query, PR lookup,
+      // safety measurement) fails fast instead of running on past the tick. Deletions are never cut mid-item —
+      // `shouldRemove` already refuses to start one after the deadline.
+      let budgetHit = false;
+      const isDeletion = (args: readonly string[]): boolean =>
+        (args.includes('worktree') && args.includes('remove')) || (args.includes('branch') && args.includes('-D'));
+      const run: GitRunner = (args) => {
+        if (!isDeletion(args) && overBudget()) { budgetHit = true; return { status: 1, stdout: '', stderr: 'harness gc tick budget exhausted' }; }
+        return runner(args[0] === '-C' ? args : ['-C', gitDir, ...args]);
+      };
+      const runGh: GhRunner = (args, options) => {
+        if (overBudget()) { budgetHit = true; return { status: 1, stdout: '', stderr: 'harness gc tick budget exhausted', error: 'budget' }; }
+        return baseGh(args, options);
+      };
+      try {
+        // gh's {owner}/{repo} placeholders refer to cwd, not this target repository.
+        const remote = gitStdout(['config', '--get', 'remote.origin.url'], run);
+        const identity = remote.ok ? /(?:github\.com[:/])([^/:]+)\/([^/]+?)(?:\.git)?\/?$/.exec(remote.value) : null;
+        if (!identity) throw new Error('target repository has no GitHub origin identity');
+        const result = execHarnessClean({ mode: 'merged', dryRun: opts.dryRun, repo: `${identity[1]}/${identity[2]}`,
+          window: { offset, size: windowSize }, forceWorktreeRemove: false, run, runGh, expired: overBudget,
+          activeDirectoryProvider: deps.activeDirectoryProvider,
+          assessWorktree: deps.assessWorktree,
+          readWorktreeProvenance: deps.readWorktreeProvenance,
+          shouldRemove: () => {
+            if (attempts >= maxRemove) return false; // count cap, not the time budget
+            if (overBudget()) { budgetExhausted = true; return false; } // deletion deferred by the time budget
+            attempts++;
+            return true;
+          } });
+        const plan = result.plan;
+        if (result.expired) budgetHit = true;
+        if (budgetHit) {
+          // Unverified, not failed: nothing is counted as preserved/failed and the cursor is kept for the next tick.
+          removed += result.removed.length;
+          failed += result.failed.length;
+          budgetExhausted = true;
+          debug.log('harness.gc', 'repo-budget-exhausted', { gitDir, removed: result.removed.length });
+          break;
+        }
+        if (plan.unavailable) {
+          repoFailures.push({ gitDir, error: 'required clean query unavailable' });
+          failed++;
+        }
+        const pending = result.deferred?.length ?? 0;
+        const byReason: Record<string, number> = {};
+        for (const item of plan.preserve) byReason[item.reason] = (byReason[item.reason] ?? 0) + 1;
+        const repo: HarnessGcRepo = {
+          gitDir, offset: result.window!.offset, window: result.window!.size, total: result.window!.total,
+          removed: result.removed.length, preserved: plan.preserve.length, deferred: pending,
+          failed: result.failed.length, preservedByReason: byReason, orphanScan: plan.orphanScan,
+          ...(plan.queryStatus?.branches && plan.queryStatus.worktrees
+            ? { unseenOutsideWindow: result.window!.unseenOutsideWindow } : {}),
+          ...(plan.queryStatus?.branches && plan.queryStatus.worktrees && plan.scope?.registeredWorktrees !== undefined
+            ? { unseenOutsidePrefix: Math.max(0, plan.scope.registeredWorktrees - plan.scope.matchedWorktrees) } : {}),
+        };
+        repositories.push(repo);
+        debug.log('harness.gc', 'repo', repo);
+        removed += repo.removed;
+        preserved += repo.preserved;
+        deferred += repo.deferred;
+        failed += repo.failed;
+        if (repo.unseenOutsideWindow === undefined) unseenOutsideWindow = undefined;
+        else if (unseenOutsideWindow !== undefined) unseenOutsideWindow += repo.unseenOutsideWindow;
+        if (repo.unseenOutsidePrefix === undefined) unseenOutsidePrefix = undefined;
+        else if (unseenOutsidePrefix !== undefined) unseenOutsidePrefix += repo.unseenOutsidePrefix;
+        if (plan.orphanScan === 'unavailable') orphanScanUnavailable++;
+        if (!opts.dryRun && repo.deferred === 0 && repo.failed === 0 && !plan.unavailable) {
+          const next = repo.offset + repo.window - repo.removed;
+          cursor[gitDir] = next >= repo.total - repo.removed ? 0 : Math.max(0, next);
+        }
+      } catch (error) {
+        if (budgetHit) {
+          budgetExhausted = true;
+          debug.log('harness.gc', 'repo-budget-exhausted', { gitDir, error: String(error) });
+          break;
+        }
+        failed++;
+        unseenOutsideWindow = undefined;
+        unseenOutsidePrefix = undefined;
+        repoFailures.push({ gitDir, error: String(error) });
+        debug.log('harness.gc', 'repo-failed', { gitDir, error: String(error) }, { level: 'error' });
+      }
+    }
+    if (processedTargets < targets.size || budgetExhausted) {
+      unseenOutsideWindow = undefined;
+      unseenOutsidePrefix = undefined;
+    }
+    if (!opts.dryRun && targets.size) {
+      const temp = join(state, `cursor.${process.pid}.tmp`);
+      writeFileSync(temp, JSON.stringify(cursor));
+      renameSync(temp, cursorPath);
+    }
+    if (!opts.dryRun && opts.repos === undefined && persistedTargets.length) {
+      const temp = join(state, `targets.${process.pid}.tmp`);
+      writeFileSync(temp, JSON.stringify([...new Set(persistedTargets)].sort()));
+      renameSync(temp, targetsPath);
+    }
+    // A tick whose budget ran out before any repository was verified did not succeed — it is «skipped», never «ok».
+    const outcome = (targets.size === 0 && !discoveryBudgetExhausted) || failed > 0 ? 'fail'
+      : repositories.length === 0 ? 'skipped' : 'ok';
+    const summary: HarnessGcResult = { outcome,
+      ...(outcome === 'fail' ? { reason: targets.size === 0 ? 'no-target-repo' as const : 'repo-failed' as const }
+        : outcome === 'skipped' ? { reason: 'budget-exhausted' as const } : {}),
+      repos: repositories.length, removed, preserved, deferred, failed,
+      ...(unseenOutsideWindow === undefined ? {} : { unseenOutsideWindow }),
+      ...(unseenOutsidePrefix === undefined ? {} : { unseenOutsidePrefix }),
+      undiscoverable: discovery.undiscoverable, orphanScanUnavailable, budgetMs,
+      elapsedMs: now() - started, repositories,
+      ...(repoFailures.length ? { repoFailures } : {}),
+      ...(budgetExhausted || discoveryBudgetExhausted ? { budgetExhausted: true } : {}) };
+    debug.log('harness.gc', 'tick', summary);
+    return summary;
+  } finally { release(); }
+}
+
+function cliArgs(args: string[]): HarnessGcOptions {
+  const opts: HarnessGcOptions = {};
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === '--json') continue;
+    if (arg === '--dry-run') { opts.dryRun = true; continue; }
+    if (arg === '--repo') { (opts.repos ??= []).push(args[++i] ?? ''); continue; }
+    const key = arg === '--window' ? 'window' : arg === '--max-remove' ? 'maxRemove' : arg === '--budget-ms' ? 'budgetMs' : null;
+    if (!key) throw new Error(`unknown GC option: ${arg}`);
+    opts[key] = Number(args[++i]);
+  }
+  if (opts.repos?.some((repo) => !repo)) throw new Error('--repo needs a path');
+  return opts;
+}
+
+if (import.meta.main) {
+  try {
+    const result = runHarnessGcTick(cliArgs(process.argv.slice(2)));
+    console.log(JSON.stringify(result));
+    if (result.outcome === 'fail') process.exitCode = 1;
+  } catch (error) {
+    console.log(JSON.stringify({ outcome: 'fail', reason: String(error) }));
+    process.exitCode = 1;
+  }
+}

package/src/harness/harness-stop.ts

@@ -3,10 +3,12 @@
 // 🩸 2026-09-27: 멈추려면 사람이 PID 둘(harness ask 부모 · self orchestrate 자식)과 Job 이름을 손으로 찾아야 했고,
 //   그 사이 떠 있던 조각이 main 에 병합됐다(#21048). 부모를 죽이면 자식이 PPID 1 고아로 2h36m 더 돌았다(🅞 보고).
 // B 조각(#21171)이 오케스트레이터에 `self-dev-runs/<runId>/pid.json` ⊕ SIGTERM 정리(새 잡 멈춤 · 자기 Job 삭제 · cancelled)를 넣었다.
-// 이 파일은 그 기록과 런 원장·프로세스 표를 읽고, 시작 시각이 확인된 후보에만 신호를 보내며, `elanous.run=<runId>` 라벨 Job 을 지운다.
+// 이 파일은 그 기록과 런 원장·프로세스 표를 읽고, 시작 시각이 확인된 후보에만 신호를 보내며, 라벨 일치 Pod Job 을 지운다.
 //
 // ⛔ 불변식: 기록된 시작 시각과 실제 프로세스 시작 시각이 다르면 신호를 보내지 않는다(PID 재사용 방지).
-// ⛔ 불변식: `elanous.run=<runId>` 라벨이 붙은 Job 만 지운다.
+// ⛔ 불변식: 라벨이 붙은 Job 만 지운다 — `elanous.run=<runId>` · 그 라벨이 0 이면 `elanous.child-run=<runId>` 폴백(자식 런 id 로 쳤을 때).
+//   지우는 것은 라벨 일치 Job 뿐이다: 이름 추측 없음 · Pod 직접 삭제 없음 · namespace 기본값(elanous-test) 불변.
+//   (HARNESS-STOP-POD-LABEL 2026-10-11) 문맥마다 삭제 결과를 넷으로 가르고 관측 `harness.stop` `job-delete`(context·outcome·matchedBy) 로 남긴다.
 // ⛔ 불변식: 짧은 runId 의 후보가 둘 이상이면 프로세스 신호·Job 삭제 전에 중단한다.
 
 import { existsSync, readdirSync, readFileSync, readlinkSync } from 'node:fs';
@@ -151,6 +153,19 @@ export interface HarnessStopDeps {
   graceMs: number;
 }
 
+export type HarnessStopJobMatchedBy = 'elanous.run' | 'elanous.child-run';
+
+/**
+ * 문맥 하나의 Pod Job 삭제 결과(HARNESS-STOP-POD-LABEL) — «0개 지움» 의 종류를 가른다.
+ *   deleted N — 라벨 일치 Job N 개 삭제 · none — 두 라벨 다 Job 0(진짜 없음 · Pod 생성 전 등)
+ *   unreachable — kubectl 실패(그 0 을 진짜 0 으로 믿을 수 없다) · pods-only — Job 0 인데 같은 라벨 Pod 잔존
+ */
+export type HarnessStopJobDelete =
+  | { context: string; outcome: 'deleted'; matchedBy: HarnessStopJobMatchedBy; deleted: number }
+  | { context: string; outcome: 'none'; matchedBy: null; deleted: 0 }
+  | { context: string; outcome: 'unreachable'; matchedBy: null; deleted: 0; error: string }
+  | { context: string; outcome: 'pods-only'; matchedBy: null; deleted: 0; podsRemaining: number };
+
 export interface HarnessStopResult {
   runId: string;
   givenRunId?: string;
@@ -161,6 +176,8 @@ export interface HarnessStopResult {
   pidRecordFound: boolean;
   dryRun: boolean;
   jobsDeleted: number;
+  /** 문맥별 Job 삭제 분류 — 출력 한 줄과 `--json` 의 근원. */
+  jobDeletes: HarnessStopJobDelete[];
   contexts: string[];
 }
 
@@ -231,6 +248,56 @@ export function defaultHarnessStopDeps(overrides: Partial<HarnessStopDeps> = {},
   };
 }
 
+/** Pod Job 라벨 — `elanous.run` = 부모(오케스트레이터) 런 id · `elanous.child-run` = 자식 런 id(self-implement-pod podRunLabels). */
+const POD_JOB_LABELS = ['elanous.run', 'elanous.child-run'] as const;
+
+/** `kubectl get -o name` 출력에서 `<prefix>` 로 시작하는 줄 수를 센다. */
+function countOutputLines(stdout: string, prefix: string): number {
+  return stdout.split('\n').filter((line) => line.startsWith(prefix)).length;
+}
+
+/**
+ * `kubectl delete job -o name` 출력에서 삭제된 Job 줄 수를 센다.
+ * `-o name` 출력은 `job.batch/<name>` 한 줄씩이지만, 일부 kubectl 버전·설정에서는
+ * `job.batch "<name>" deleted` 꼴도 나타난다(#26194). 두 꼴을 모두 센다.
+ */
+function countDeletedJobLines(stdout: string): number {
+  return stdout.split('\n').filter((line) => /^job\.batch(?:\/|\s+")/.test(line.trim())).length;
+}
+
+/** 문맥 하나의 Pod Job 삭제 — 결과를 넷(deleted·none·unreachable·pods-only)으로 가르고 문맥마다 관측 `harness.stop` `job-delete` 를 남긴다. */
+function deleteRunPodJobs(deps: HarnessStopDeps, runId: string, context: string): HarnessStopJobDelete {
+  const unreachable = (stderr: string): HarnessStopJobDelete => {
+    const error = stderr.slice(0, 200);
+    debug.log('harness.stop', 'job-delete', { runId, context, outcome: 'unreachable', matchedBy: null, error }, { level: 'warn' });
+    return { context, outcome: 'unreachable', matchedBy: null, deleted: 0, error };
+  };
+  // ① `elanous.run=<runId>` — 0 이면 `elanous.child-run=<runId>` 로 한 번 더 고른다(자식 런 id 로 쳤을 때). 지우는 것은 라벨 일치 Job 뿐이다.
+  for (const label of POD_JOB_LABELS) {
+    // `-o name` → «job.batch/<name>» 한 줄씩. 맨 출력은 «job.batch "<name>" deleted» 라 «job.batch/» 로만 세면
+    //   지워도 늘 0 이었다(10-11 · 여섯 번 «0개 지움» 뒤 Pod Terminating). 두 꼴을 다 센다(#26194).
+    const r = deps.kubectl(['--context', context, '-n', deps.namespace, 'delete', 'job', '-l', `${label}=${runId}`, '--wait=false', '-o', 'name']);
+    if (r.status !== 0) return unreachable(r.stderr);
+    const deleted = countDeletedJobLines(r.stdout);
+    if (deleted > 0) {
+      debug.log('harness.stop', 'job-delete', { runId, context, outcome: 'deleted', matchedBy: label, deleted });
+      return { context, outcome: 'deleted', matchedBy: label, deleted };
+    }
+  }
+  // ② 두 라벨 다 Job 0 — 같은 라벨 Pod(`get pods -l <라벨>=<runId>`)로 none 과 pods-only 를 가른다. Pod 는 직접 지우지 않는다.
+  for (const label of POD_JOB_LABELS) {
+    const p = deps.kubectl(['--context', context, '-n', deps.namespace, 'get', 'pods', '-l', `${label}=${runId}`, '-o', 'name']);
+    if (p.status !== 0) return unreachable(p.stderr);
+    const podsRemaining = countOutputLines(p.stdout, 'pod/');
+    if (podsRemaining > 0) {
+      debug.log('harness.stop', 'job-delete', { runId, context, outcome: 'pods-only', matchedBy: null, podsRemaining });
+      return { context, outcome: 'pods-only', matchedBy: null, deleted: 0, podsRemaining };
+    }
+  }
+  debug.log('harness.stop', 'job-delete', { runId, context, outcome: 'none', matchedBy: null });
+  return { context, outcome: 'none', matchedBy: null, deleted: 0 };
+}
+
 export async function stopHarnessRun(runId: string, deps: HarnessStopDeps, contexts?: readonly string[], dryRun = false): Promise<HarnessStopResult> {
   if (!RUN_ID.test(runId)) throw new Error(`invalid run id: ${runId}`);
   const given = runId;
@@ -297,13 +364,9 @@ export async function stopHarnessRun(runId: string, deps: HarnessStopDeps, conte
   }
   // ── ⓑ Pod Job (라벨로만) ───────────────────────────────────
   const targets = dryRun ? [] : contexts && contexts.length > 0 ? [...contexts] : deps.kubeContexts();
-  let jobsDeleted = 0;
-  for (const context of targets) {
-    const r = deps.kubectl(['--context', context, '-n', deps.namespace, 'delete', 'job', '-l', `elanous.run=${runId}`, '--wait=false']);
-    if (r.status === 0) jobsDeleted += r.stdout.split('\n').filter((line) => line.startsWith('job.batch/')).length;
-    else debug.log('harness.stop', 'job-delete-failed', { runId, context, error: r.stderr.slice(0, 200) }, { level: 'warn' });
-  }
-  const result: HarnessStopResult = { runId, ...(given !== runId ? { givenRunId: given } : {}), process: processState, ...(record ? { pid: record.pid } : {}), candidates, scanned: scan.status === 'ok', pidRecordFound: record !== null, dryRun, jobsDeleted, contexts: targets };
+  const jobDeletes = targets.map((context) => deleteRunPodJobs(deps, runId, context));
+  const jobsDeleted = jobDeletes.reduce((sum, job) => sum + job.deleted, 0);
+  const result: HarnessStopResult = { runId, ...(given !== runId ? { givenRunId: given } : {}), process: processState, ...(record ? { pid: record.pid } : {}), candidates, scanned: scan.status === 'ok', pidRecordFound: record !== null, dryRun, jobsDeleted, jobDeletes, contexts: targets };
   debug.log('harness.stop', 'stopped', { runId, process: processState, jobsDeleted, contexts: targets.length });
   return result;
 }
@@ -324,6 +387,15 @@ export function formatHarnessStop(r: HarnessStopResult): string {
     ...r.candidates.map(({ pid, startedAt, via }) => `  후보: pid ${pid} · 시작 ${new Date(startedAt).toISOString()} · ${via}`),
     r.dryRun
       ? `  Pod Job: dry-run(조회·삭제하지 않음 · 라벨 elanous.run=${r.runId})`
-      : `  Pod Job: ${r.jobsDeleted}개 지움 (문맥 ${r.contexts.length}개 · 라벨 elanous.run=${r.runId})`,
+      : `  Pod Job: ${r.jobsDeleted}개 지움 (문맥 ${r.contexts.length}개 · 라벨 elanous.run=${r.runId} · child-run 폴백)`,
+    ...r.jobDeletes.map(formatHarnessStopJobDelete),
   ].join('\n');
 }
+
+/** 문맥 하나의 Pod Job 결과 줄 — none·unreachable·pods-only 는 서로 다른 문면으로 갈라 읽힌다. */
+function formatHarnessStopJobDelete(job: HarnessStopJobDelete): string {
+  if (job.outcome === 'deleted') return `    ${job.context}: ${job.deleted}개 지움 (라벨 ${job.matchedBy})`;
+  if (job.outcome === 'pods-only') return `    ${job.context}: Job 0 · 같은 라벨 Pod ${job.podsRemaining} 남음 (Pod 는 직접 지우지 않는다)`;
+  if (job.outcome === 'unreachable') return `    ${job.context}: 못 닿음 (kubectl 실패: ${job.error})`;
+  return `    ${job.context}: 없음 (라벨 맞는 Job 0)`;
+}

package/src/harness/harness-substrate-default.ts

@@ -5,6 +5,9 @@ import { effectiveInstanceRoot, prodInstanceRoot, treeDerivedRootFor } from '../
 import { getElanousConfigDirOverride } from '../elanous-config-dir.js';
 import { buildUserConfig, getUserConfig, type UserConfig } from '../user-config.js';
 import { resolveCodexQuotaPolicy } from '../oauth/codex-quota-policy.js';
+import { debug } from '../debug/log.js';
+import type { PoolLeaseRecommendation } from '../task-orchestrator/surfaces/pod-lease.js';
+import type { PodPoolMember, PoolKubectl } from '../task-orchestrator/surfaces/pod-pool.js';
 
 /** Key-order-insensitive JSON so equal per-account caps written in another order do not warn. */
 function stableJson(value: unknown): string {
@@ -79,22 +82,154 @@ export interface ResolvedHarnessSubstrate {
   source: 'flag' | 'config' | 'default';
 }
 
-/** Only inspect the current context when no explicit pool is available. Never turn a failed Pod selection into local. */
+/** Conservative local headroom for one standard harness goal (the Pod lease's default per-goal size). */
+export const AUTO_LOCAL_MIN_AVAILABLE_MEMORY_BYTES = 16 * 1024 ** 3;
+
+export interface AutoSubstrateSignals {
+  /** A blocked memory admission has recommended=0 and limitedBy=memory; unknown is not blocked. */
+  podAdmission: Pick<PoolLeaseRecommendation, 'recommended' | 'limitedBy'> | null;
+  load1: number | null;
+  cores: number | null;
+  availableMemoryBytes: number | null;
+  localLaneOpen: boolean;
+}
+
+export interface AutoSubstrateDecision {
+  substrate: HarnessSubstrate;
+  reason: string;
+}
+
+export interface NextLocalLaneCapInput {
+  current: number;
+  wanted: number;
+  lastRaisedAtMs: number | null;
+  nowMs: number;
+  load1: number | null;
+  cores: number | null;
+}
+
+export interface NextLocalLaneCapDecision {
+  cap: number;
+  action: 'raise' | 'hold' | 'lower';
+  reason: string;
+}
+
+/** Decide one conservative local-lane cap adjustment from the current observations. */
+export function nextLocalLaneCap({ current, wanted, lastRaisedAtMs, nowMs, load1, cores }: NextLocalLaneCapInput): NextLocalLaneCapDecision {
+  let decision: NextLocalLaneCapDecision;
+  if (load1 === null || cores === null || !Number.isFinite(load1) || !Number.isFinite(cores) || load1 < 0 || cores <= 0) {
+    decision = { cap: current, action: 'hold', reason: 'load-unreadable' };
+  } else if (load1 >= cores) {
+    decision = { cap: Math.max(0, current - 5), action: 'lower', reason: 'local-load-overloaded' };
+  } else if (!Number.isFinite(current) || !Number.isFinite(wanted) || !Number.isFinite(nowMs)) {
+    decision = { cap: current, action: 'hold', reason: 'cap-or-time-unreadable' };
+  } else if (wanted <= current) {
+    decision = { cap: current, action: 'hold', reason: 'no-increase-requested' };
+  } else if (load1 >= cores / 2) {
+    decision = { cap: current, action: 'hold', reason: 'local-load-not-spare' };
+  } else if (lastRaisedAtMs !== null && (!Number.isFinite(lastRaisedAtMs) || nowMs - lastRaisedAtMs < 15 * 60 * 1000)) {
+    decision = { cap: current, action: 'hold', reason: 'raise-cooldown' };
+  } else {
+    decision = { cap: Math.min(wanted, current + 5), action: 'raise', reason: 'local-load-spare' };
+  }
+  debug.log('harness.guardian', 'lane-step', { current, wanted, lastRaisedAtMs, nowMs, load1, cores, ...decision });
+  return decision;
+}
+
+/** Pure routing judgment. Missing/invalid observations are not evidence that the host has room. */
+export function routeAutoSubstrate(signals: AutoSubstrateSignals): AutoSubstrateDecision {
+  const { podAdmission, load1, cores, availableMemoryBytes, localLaneOpen } = signals;
+  if (podAdmission === null || podAdmission.recommended === null || podAdmission.limitedBy === null)
+    return { substrate: 'pod', reason: 'pod-admission-unobserved' };
+  if (podAdmission.recommended !== 0 || podAdmission.limitedBy !== 'memory')
+    return { substrate: 'pod', reason: 'pod-admission-not-memory-blocked' };
+  if (!localLaneOpen) return { substrate: 'pod', reason: 'local-lane-closed' };
+  if (cores === null || !Number.isFinite(cores) || cores <= 0 || load1 === null || !Number.isFinite(load1) || load1 < 0 || load1 >= cores / 2)
+    return { substrate: 'pod', reason: 'local-load-not-spare' };
+  if (availableMemoryBytes === null || !Number.isFinite(availableMemoryBytes) || availableMemoryBytes < AUTO_LOCAL_MIN_AVAILABLE_MEMORY_BYTES)
+    return { substrate: 'pod', reason: 'local-memory-not-spare' };
+  return { substrate: 'local', reason: 'pod-memory-blocked-local-spare' };
+}
+
+/**
+ * POD-POOL-UNCAPPED-SPEC — the pre-launch pool check of an «implicit» Pod pool (the current kube context),
+ * reported in context names. `unmeasured` = kubectl itself could not run, so nothing was measured:
+ * «unknown» is not «unfit» (same rule as LAUNCH-STALL's unreadable member memory).
+ */
+export interface HarnessPoolCheck {
+  ok: boolean;
+  ready: string[];
+  dropped: { context: string; reason: string }[];
+  unmeasured?: string | null;
+}
+
+/** `checkPodPool` over one pool spec — a kube context that cannot answer before launch is refused, not silently kept. */
+export function checkHarnessPodPool(pool: string, run?: PoolKubectl): HarnessPoolCheck {
+  // Lazy require: the Pod surface pulls `bun:ffi`, and only a Pod launch without an explicit pool needs it.
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const surface = require('../task-orchestrator/surfaces/pod-pool.js') as typeof import('../task-orchestrator/surfaces/pod-pool.js');
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const leaseKubectl = run ?? (require('../task-orchestrator/surfaces/pod-lease.js') as typeof import('../task-orchestrator/surfaces/pod-lease.js')).leaseKubectl;
+  let members: PodPoolMember[];
+  try { members = surface.parsePodPool(pool); }
+  catch (error) {
+    return { ok: false, ready: [], dropped: [{ context: pool, reason: error instanceof Error ? error.message : String(error) }] };
+  }
+  let calls = 0;
+  let unrunnable = 0;
+  const kubectl: PoolKubectl = (args, input) => {
+    const r = leaseKubectl(args, input);
+    calls++;
+    // Only «kubectl is not installed» (spawn ENOENT) is no verdict about the cluster. A kubectl that started but
+    // timed out (status null · ETIMEDOUT) is a cluster that did not answer — that stays a measured refusal.
+    if (r.status === null && /\bENOENT\b/.test(r.stderr)) unrunnable++;
+    return r;
+  };
+  const checked = surface.checkPodPool(members, kubectl);
+  if (!checked.ok && calls > 0 && unrunnable === calls) return { ok: true, ready: [], dropped: checked.dropped, unmeasured: 'kubectl 을 실행할 수 없다' };
+  return { ok: checked.ok, ready: checked.ready.map((m) => m.context), dropped: checked.dropped };
+}
+
+/** Only inspect the current context when no explicit pool is available. Never turn an explicit Pod selection into local. */
 export function resolveHarnessSubstrate({ flag, config, env, currentContext = () => {
   const result = spawnSync('kubectl', ['config', 'current-context'], { encoding: 'utf8', timeout: 5000 });
   return result.status === 0 ? result.stdout?.trim() : undefined;
-} }: {
-  flag?: { substrate?: HarnessSubstrate; podPool?: string };
+}, autoSignals, poolCheck = checkHarnessPodPool }: {
+  flag?: { substrate?: HarnessSubstrate | 'auto'; podPool?: string };
   config?: Pick<UserConfig, 'harness' | 'pod'>;
   env?: NodeJS.ProcessEnv;
   currentContext?: () => string | undefined;
+  /** Signals must come from the launch host and Pod admission, not a worktree's cached config. */
+  autoSignals?: AutoSubstrateSignals;
+  /** POD-POOL-UNCAPPED-SPEC — pre-launch check of the implicit kube context; tests inject it instead of shelling out. */
+  poolCheck?: (pool: string) => HarnessPoolCheck;
 }): ResolvedHarnessSubstrate {
-  const substrate = flag?.substrate ?? config?.harness?.substrate ?? 'local';
-  if (substrate !== 'local' && substrate !== 'pod') throw new Error('harness.substrate: local 또는 pod 만 허용한다');
+  const requested = flag?.substrate ?? config?.harness?.substrate ?? 'local';
+  if (requested !== 'local' && requested !== 'pod' && requested !== 'auto') throw new Error('harness.substrate: local, pod 또는 auto 만 허용한다');
   const source = flag?.substrate ? 'flag' : config?.harness?.substrate ? 'config' : 'default';
+  // Missing signals mean admission was not observed, not that the Pod has room.
+  const decision = requested === 'auto' ? routeAutoSubstrate(autoSignals ?? {
+    podAdmission: null, load1: null, cores: null, availableMemoryBytes: null, localLaneOpen: false,
+  }) : null;
+  const substrate: HarnessSubstrate = requested === 'auto' ? decision!.substrate : requested;
+  if (decision) debug.log('harness.substrate', 'route', { substrate, reason: decision.reason, source });
   if (substrate === 'local') return { substrate, pool: null, source };
-  const pool = flag?.podPool?.trim() || env?.ELANOUS_POD_POOL?.trim() || config?.harness?.podPool?.trim() || config?.pod?.pool?.trim() || currentContext()?.trim();
-  if (!pool) throw new Error('harness.substrate=pod: Pod 풀 또는 현재 컨텍스트에 닿지 못했다 — 풀을 설정하거나 `--substrate local` 로 명시하라');
+  const explicit = flag?.podPool?.trim() || env?.ELANOUS_POD_POOL?.trim() || config?.harness?.podPool?.trim() || config?.pod?.pool?.trim();
+  const pool = explicit || currentContext()?.trim();
+  if (!pool) throw new Error(`harness.substrate=${decision ? `auto→pod(${decision.reason})` : 'pod'}: Pod 풀 또는 현재 컨텍스트에 닿지 못했다 — 풀을 설정하거나 \`--substrate local\` 로 명시하라`);
+  // POD-POOL-UNCAPPED-SPEC — an explicit pool is the operator's own statement and gets `checkPodPool` at the launch
+  //   site (`src/index.ts` self orchestrate · `src/loops/orchestrator/tick.ts` · `pod-command-job.ts`). The implicit
+  //   kube context had no such gate: a context whose cluster is gone, or whose `elanous-test` namespace is missing,
+  //   sailed through here and then sat on `recommended=0` for 35 minutes (10-10 probe, 6 runs). Check before launch.
+  if (!explicit) {
+    const checked = poolCheck(pool);
+    debug.log('harness.substrate', 'pool-check', { pool, origin: 'current-context', ok: checked.ok, ready: checked.ready, dropped: checked.dropped, unmeasured: checked.unmeasured ?? null });
+    if (!checked.ok) {
+      const why = checked.dropped.map((d) => `${d.context}: ${d.reason}`).join(' · ') || '노드가 하나도 준비되지 않았다';
+      throw new Error(`harness.substrate=pod: 현재 컨텍스트 「${pool}」 이 발사 전 풀 점검을 넘지 못했다 — ${why} · 풀을 설정하거나 \`--substrate local\` 로 명시하라`);
+    }
+    if (checked.unmeasured) debug.log('harness.substrate', 'pool-check-unmeasured', { pool, reason: checked.unmeasured }, { level: 'warn' });
+  }
   return { substrate, pool, source };
 }