elanous 0.2.28 → 0.2.31

package/src/task-orchestrator/surfaces/pod-failure-reason.ts

@@ -6,7 +6,15 @@ export const STOP_CLASS_NO_LAUNCH = 'no-launch' as const;
 const CHILD_RESULT_KINDS = new Set(['self', 'external']);
 
 /** The dev child's terminal line nests the stage: {ok, kind, result:{stage, ok, node, outcome, …}}. Other JSON rows are not results. */
-export function nestedPodResult(row: Record<string, unknown>): { stage: string; ok: boolean; error?: string } | null {
+export function nestedPodResult(row: Record<string, unknown>): {
+  stage: string;
+  ok: boolean;
+  error?: string;
+  reasonCode?: string;
+  checkName?: string;
+  targetPath?: string;
+  preflightChecks?: PreflightCheck[];
+} | null {
   if (typeof row.kind !== 'string' || !CHILD_RESULT_KINDS.has(row.kind) || typeof row.ok !== 'boolean') return null;
   if (!row.result || typeof row.result !== 'object' || Array.isArray(row.result)) return null;
   const result = row.result as Record<string, unknown>;
@@ -18,28 +26,72 @@ export function nestedPodResult(row: Record<string, unknown>): { stage: string;
       ? (classification as Record<string, unknown>).classification : undefined;
   const reason = [result.node, result.outcome].filter((part): part is string => typeof part === 'string' && part.length > 0).join(' ');
   const error = [reason || (typeof result.error === 'string' ? result.error : ''), typeof detail === 'string' && detail ? detail : ''].filter(Boolean).join(' · ');
-  return { stage: result.stage, ok: false, ...(error ? { error } : {}) };
+  // PREFLIGHT-RESULT-LINE: a nested preflight rejection carries its blockers under result.blockers — the same ledger fields as the flat row.
+  const blockers = result.stage === 'preflight-blocked' ? preflightBlockerText(result.blockers)
+    : { error: '', preflightChecks: [] as PreflightCheck[] };
+  return {
+    stage: result.stage,
+    ok: false,
+    ...(error || blockers.error ? { error: error || blockers.error } : {}),
+    ...(blockers.preflightChecks.length === 1 ? blockers.preflightChecks[0] : {}),
+    ...(blockers.preflightChecks.length > 1 ? { preflightChecks: blockers.preflightChecks } : {}),
+  };
 }
 
-/** One line naming each preflight blocker (`(대상 경로 0) — …`), or '' when the row carries none. */
-function preflightBlockerText(blockers: unknown): string {
-  if (!Array.isArray(blockers)) return '';
-  return blockers.flatMap((blocker) => {
-    if (!blocker || typeof blocker !== 'object' || Array.isArray(blocker)) return [];
-    const { name, detail } = blocker as Record<string, unknown>;
-    const parts = [name, detail].filter((part): part is string => typeof part === 'string' && part.trim().length > 0).map((part) => part.trim().replace(/\s+/gu, ' '));
-    return parts.length ? [parts.join(' — ')] : [];
-  }).join(' · ');
+function ledgerString(value: unknown): string {
+  return typeof value === 'string' && value.trim().length > 0 ? value : '';
+}
+
+type PreflightCheck = { reasonCode: string; checkName: string; targetPath?: string };
+
+/** Keep each structured check paired with its own path; legacy blockers retain their name/detail diagnostic. */
+function preflightBlockerText(blockers: unknown): { error: string; preflightChecks: PreflightCheck[] } {
+  if (!Array.isArray(blockers)) return { error: '', preflightChecks: [] };
+  const errors: string[] = [];
+  const preflightChecks: PreflightCheck[] = [];
+  for (const blocker of blockers) {
+    if (!blocker || typeof blocker !== 'object' || Array.isArray(blocker)) continue;
+    const record = blocker as Record<string, unknown>;
+    const reasonCode = ledgerString(record.reasonCode);
+    const checkName = ledgerString(record.checkName);
+    if (reasonCode && checkName) {
+      const targetPath = ledgerString(record.targetPath);
+      preflightChecks.push({ reasonCode, checkName, ...(targetPath ? { targetPath } : {}) });
+      errors.push(`${reasonCode} · ${checkName}`);
+      continue;
+    }
+    const parts = [record.name, record.detail]
+      .filter((part): part is string => typeof part === 'string' && part.trim().length > 0)
+      .map((part) => part.trim().replace(/\s+/gu, ' '));
+    if (parts.length) errors.push(parts.join(' — '));
+  }
+  return { error: errors.join(' · '), preflightChecks };
 }
 
 /** A child terminal row: the legacy flat form {stage, ok, error?} (no kind, or a child kind) or the nested dev result. Any other kind is not a result. */
-export function podTerminalRow(row: Record<string, unknown>): { stage: string; ok: boolean; error?: string } | null {
+export function podTerminalRow(row: Record<string, unknown>): {
+  stage: string;
+  ok: boolean;
+  error?: string;
+  reasonCode?: string;
+  checkName?: string;
+  targetPath?: string;
+  preflightChecks?: PreflightCheck[];
+} | null {
   if (typeof row.kind === 'string' && !CHILD_RESULT_KINDS.has(row.kind)) return null;
   if (typeof row.stage === 'string' && typeof row.ok === 'boolean') {
-    if (typeof row.error === 'string') return { stage: row.stage, ok: row.ok, error: row.error };
-    // PREFLIGHT-RESULT-LINE: `{kind:'self', ok:false, stage:'preflight-blocked', blockers}` carries its reason in the blockers, not in `error`.
-    const blockers = row.ok === false && row.stage === 'preflight-blocked' ? preflightBlockerText(row.blockers) : '';
-    return { stage: row.stage, ok: row.ok, ...(blockers ? { error: blockers } : {}) };
+    // PREFLIGHT-RESULT-LINE: preserve structured blockers even when an explicit error supplies the human-readable reason.
+    if (row.ok === false && row.stage === 'preflight-blocked') {
+      const blockers = preflightBlockerText(row.blockers);
+      return {
+        stage: row.stage,
+        ok: row.ok,
+        ...(typeof row.error === 'string' ? { error: row.error } : blockers.error ? { error: blockers.error } : {}),
+        ...(blockers.preflightChecks.length === 1 ? blockers.preflightChecks[0] : {}),
+        ...(blockers.preflightChecks.length > 1 ? { preflightChecks: blockers.preflightChecks } : {}),
+      };
+    }
+    return { stage: row.stage, ok: row.ok, ...(typeof row.error === 'string' ? { error: row.error } : {}) };
   }
   return nestedPodResult(row);
 }
@@ -64,9 +116,21 @@ export function classifyPodExit(input: {
   jobReason?: string | null;
   logs: string;
   result?: Record<string, unknown> | null;
-}): { class: PodExitClass; errorCode: string | null; containerReason: string | null; exitCode: number | null; jobReason: string | null; tail: string[] } {
+}): {
+  class: PodExitClass;
+  errorCode: string | null;
+  containerReason: string | null;
+  exitCode: number | null;
+  jobReason: string | null;
+  tail: string[];
+  reasonCode?: string;
+  checkName?: string;
+  targetPath?: string;
+  preflightChecks?: PreflightCheck[];
+  noResultLine?: true;
+} {
   const logLines = input.logs.split(/\r\n|\n|\r/u).map((line) => line.trim()).filter(Boolean);
-  let terminalResult: { stage: string; ok: boolean; error?: string } | null = null;
+  let terminalResult: ReturnType<typeof podTerminalRow> = null;
   for (const line of logLines) {
     if (!line.startsWith('{')) continue;
     let parsed: unknown;
@@ -74,8 +138,8 @@ export function classifyPodExit(input: {
     if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) continue;
     terminalResult = podTerminalRow(parsed as Record<string, unknown>) ?? terminalResult;
   }
-  if (!terminalResult && input.result) terminalResult = podTerminalRow(input.result);
   const hasResultLine = terminalResult !== null;
+  if (!terminalResult && input.result) terminalResult = podTerminalRow(input.result);
   const askReprompt = logLines.some((line) =>
     /^\[ask\](?!\s+\d+\)\s).*(?:implementation[_ -]?target|reprompt|re-prompt|되묻)/iu.test(line));
   // 파싱되는 JSON 줄(진행·결과 행)은 오류 «줄»로 세지 않는다 — tail 과 같은 기준.
@@ -116,6 +180,11 @@ export function classifyPodExit(input: {
     exitCode: input.containerExitCode ?? null,
     jobReason: input.jobReason ?? null,
     tail,
+    ...(terminalResult?.reasonCode ? { reasonCode: terminalResult.reasonCode } : {}),
+    ...(terminalResult?.checkName ? { checkName: terminalResult.checkName } : {}),
+    ...(terminalResult?.targetPath ? { targetPath: terminalResult.targetPath } : {}),
+    ...(terminalResult?.preflightChecks ? { preflightChecks: terminalResult.preflightChecks } : {}),
+    ...(!hasResultLine ? { noResultLine: true as const } : {}),
   };
 }
 

package/src/task-orchestrator/surfaces/pod-host-acp-review.ts

@@ -11,6 +11,7 @@
 //    ⛔ 기본 꺼짐(opt-in): 옵션 → env `ELANOUS_POD_HOST_ACP_REVIEW` → config `llm.podHostAcpReview` 순.
 //    📌 남은 조각(②-b): 이 문이 켜진 런에서 Pod 안 api 리뷰를 «끄는» 것은 Pod 이미지 쪽 변경이라 따로 간다.
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../../util/spawn-sync-output.js';
 import { debug } from '../../debug/log.js';
 import type { ReviewResult } from '../../agent-substrate/pr-reviewer.js';
 import type { SubscriptionReviewerSpec } from '../../user-config.js';
@@ -57,7 +58,7 @@ export interface PodHostAcpReviewDeps {
 }
 
 function defaultReadPr(prNumber: number, repoRoot: string): { headRefOid: string; title: string; body: string; diff: string } | undefined {
-  const view = spawnSync('gh', ['pr', 'view', String(prNumber), '--json', 'headRefOid,title,body'], { cwd: repoRoot, encoding: 'utf8', timeout: 60_000 });
+  const view = spawnSync('gh', ['pr', 'view', String(prNumber), '--json', 'headRefOid,title,body'], { cwd: repoRoot, encoding: 'utf8', timeout: 60_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   if (view.status !== 0) return undefined;
   const diff = spawnSync('gh', ['pr', 'diff', String(prNumber)], { cwd: repoRoot, encoding: 'utf8', timeout: 120_000, maxBuffer: 64 * 1024 * 1024 });
   if (diff.status !== 0) return undefined;

package/src/task-orchestrator/surfaces/pod-image-source.ts

@@ -14,6 +14,7 @@
  *   이미지는 표준판(elanous-harness)만 — 이 발사 경로는 lite 를 쓰지 않는다.
  */
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../../util/spawn-sync-output.js';
 import { debug } from '../../debug/log.js';
 import { memberHasRegistry, registryImageRef, type RemoteRun } from './pod-pool.js';
 
@@ -71,7 +72,7 @@ export function memberPinRegistry(member: PodImageMember, source: Extract<PodIma
 
 /** 실제 조회 — 원격은 pod-pool 의 SSH 판정, 로컬은 이 기계의 docker/curl 로 조회한다. */
 export function podPoolImageLookup(run?: RemoteRun, localRun: (cmd: string, args: readonly string[]) => { status: number | null; stdout: string } = (cmd, args) => {
-  const r = spawnSync(cmd, [...args], { encoding: 'utf8', timeout: 10_000 });
+  const r = spawnSync(cmd, [...args], { encoding: 'utf8', timeout: 10_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   return { status: r.status, stdout: r.stdout ?? '' };
 }): {
   hasRegistry: (member: PodImageMember & { context: string }, registry: string) => boolean;

package/src/task-orchestrator/surfaces/pod-install-slots.ts

@@ -1,3 +1,5 @@
+import { spawn } from 'node:child_process';
+
 // GATE-INSTALL-CACHE (0.2.20) — a node-wide throttle for the release-gate shards' `bun install`.
 //
 // Cause, measured on the 0.2.19 gate (`elanous logs --category release-loop.gate --event pod-shard --all --include-test`):
@@ -21,8 +23,8 @@ export const POD_INSTALL_SLOTS_HOST_PATH = '/var/lib/elanous/gate-install-slots'
 export const POD_INSTALL_SLOTS_DEFAULT = 4;
 export const POD_INSTALL_SLOTS_MOUNT = '/gate-install-slots';
 
-/** hostPath volume ⊕ mount for the tokens. `DirectoryOrCreate` makes a root-owned 0755 directory, so the Pod also needs
- *  {@link podHostDirsInit} (the child runs as uid 1000). */
+/** hostPath volume ⊕ mount for the tokens. `DirectoryOrCreate` makes a root-owned 0755 directory, so the node also needs
+ *  {@link prepareHostDirsOnce} (the child runs as uid 1000). */
 export function podInstallSlotsVolume(hostPath: string = POD_INSTALL_SLOTS_HOST_PATH) {
   return {
     volume: { name: 'install-slots', hostPath: { path: hostPath, type: 'DirectoryOrCreate' } },
@@ -30,22 +32,125 @@ export function podInstallSlotsVolume(hostPath: string = POD_INSTALL_SLOTS_HOST_
   };
 }
 
+// GATE-WARM-BOOT-NO-INIT (10-15) — the root hand-over of the hostPath directories left the Pod. It was an init container
+// (`host-dirs`, then folded into `isolation-gate` by GATE-WARM-BOOT), and every init container cost a container
+// transition on a loaded k3d node (#27805 on node-b: init 2 → 354 s · init 1 → 41 s · none → 1 s to the child start).
+// The directories live on the node and outlive every Pod, so the hand-over is a node fact: done once per node from the
+// pool host (`docker exec` into each k3d node container · idempotent `mkdir -p`/`chown`/`chmod`), and the child shell only
+// reports a directory it still cannot write. Never fails the Pod: an unwritable directory means the child falls back
+// (no cache · no throttle), exactly as before when the hand-over failed.
+
+const SAFE_HOST_PATH = /^\/[A-Za-z0-9._/-]+$/;
+const SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+export const HOST_DIRS_PREP_LIMIT_MS = 30_000;
+
+/** Child-shell line: report (never fail on) a mounted host directory the uid-1000 child cannot write. */
+/** Root hand-over inside the Pod — only for runs whose hostPath dirs could not be prepared on the node (no pool member ·
+ * prep failed · prep disabled). Same lines the old `isolation-gate` init ran; it never fails the Pod. */
+export function podHostDirsScript(mounts: ReadonlyArray<{ mountPath: string }>): string {
+  const paths = mounts.map((mount) => `'${mount.mountPath.replace(/'/g, `'\\''`)}'`).join(' ');
+  return `for d in ${paths}; do mkdir -p "$d" && chown 1000:1000 "$d" && chmod 0775 "$d" || echo "[host-dirs] could not prepare $d"; done; exit 0`;
+}
+
+export function podHostDirsCheckScript(mounts: ReadonlyArray<{ mountPath: string }>): string {
+  const paths = mounts.map((mount) => `'${mount.mountPath.replace(/'/g, `'\\''`)}'`).join(' ');
+  return `for d in ${paths}; do [ -d "$d" ] && [ -w "$d" ] || echo "[host-dirs] could not prepare $d (not writable by uid $(id -u) · node not prepared)"; done`;
+}
+
+/** Host-side shell (on the pool host): hand the node directories to uid 1000 in every k3d node container of `cluster`. */
+export function podHostDirsNodeScript(o: { cluster: string; hostPaths: readonly string[] }): string {
+  if (!SAFE_NAME.test(o.cluster)) throw new Error(`invalid k3d cluster: ${o.cluster}`);
+  for (const path of o.hostPaths) if (!SAFE_HOST_PATH.test(path) || path.split('/').includes('..')) throw new Error(`invalid host dir: ${path}`);
+  const inner = `for d in ${o.hostPaths.join(' ')}; do mkdir -p "$d" && chown 1000:1000 "$d" && chmod 0775 "$d" || { echo "[host-dirs] could not prepare $d"; exit 1; }; done`;
+  return [
+    `nodes=$(docker ps --filter label=k3d.cluster=${o.cluster} --format '{{.Names}} {{.Label "k3d.role"}}' | awk '$2=="server"||$2=="agent"{print $1}')`,
+    `[ -n "$nodes" ] || { echo "[host-dirs] no k3d node for ${o.cluster}"; exit 2; }`,
+    'rc=0',
+    `for n in $nodes; do docker exec "$n" sh -c '${inner}' || rc=1; done`,
+    'exit $rc',
+  ].join('\n');
+}
+
+/** The member's current k3d server/agent container IDs, sorted — the node «generation» the hand-over memo is keyed by. */
+export function podHostDirsNodeIdsScript(cluster: string): string {
+  if (!SAFE_NAME.test(cluster)) throw new Error(`invalid k3d cluster: ${cluster}`);
+  return `docker ps --no-trunc --filter label=k3d.cluster=${cluster} --format '{{.ID}} {{.Label "k3d.role"}}' | awk '$2=="server"||$2=="agent"{print $1}' | sort | tr '\\n' ' '`;
+}
+
+export interface HostDirsPrepResult { host: string; ok: boolean; ms: number; detail?: string }
+
+type HostShell = (host: string | undefined, script: string, limitMs: number) => Promise<{ rc: number; output: string }>;
+
 /**
- * A root init container that hands the mounted hostPath directories to the child's uid. Without it a `DirectoryOrCreate`
- * hostPath stays root:root 0755 and the child's `[ -w … ]` guard silently skips it (the Bun cache option was a no-op).
+ * Bounded shell on the pool host (`ssh <host>`) or this machine (no host); never throws. At `limitMs` the whole process
+ * group is killed and the call returns rc 124 at once — a stuck `docker exec` grandchild holding the pipe must not keep
+ * the caller (and the Job launch behind it) waiting for `close`.
  */
-export function podHostDirsInit(image: string, imagePullPolicy: string, mounts: ReadonlyArray<{ name: string; mountPath: string; readOnly: boolean }>) {
-  const paths = mounts.map((mount) => `'${mount.mountPath.replace(/'/g, `'\\''`)}'`).join(' ');
-  return {
-    name: 'host-dirs', image, imagePullPolicy,
-    securityContext: { runAsUser: 0 },
-    command: ['sh', '-c'],
-    // Never fails the Pod: an unchanged directory only means the child falls back (no cache · no throttle).
-    args: [`for d in ${paths}; do mkdir -p "$d" && chown 1000:1000 "$d" && chmod 0775 "$d" || echo "[host-dirs] could not prepare $d"; done; exit 0`],
-    volumeMounts: mounts.map((mount) => ({ ...mount })),
-  };
+export function hostShellWithin(host: string | undefined, script: string, limitMs: number): Promise<{ rc: number; output: string }> {
+  const env = 'export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; ';
+  const [cmd, args] = host
+    ? ['ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', host, env + script]] as const
+    : ['bash', ['-c', env + script]] as const;
+  return new Promise((resolve) => {
+    let output = '';
+    let settled = false;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const finish = (rc: number, text: string) => { if (!settled) { settled = true; clearTimeout(timer); resolve({ rc, output: text }); } };
+    let child: ReturnType<typeof spawn>;
+    try { child = spawn(cmd, [...args], { stdio: ['ignore', 'pipe', 'pipe'], detached: true }); }
+    catch (error) { resolve({ rc: 2, output: String(error) }); return; }
+    timer = setTimeout(() => {
+      try { if (child.pid) process.kill(-child.pid, 'SIGKILL'); else child.kill('SIGKILL'); } catch { child.kill('SIGKILL'); }
+      child.stdout?.destroy();
+      child.stderr?.destroy();
+      finish(124, `${output}\n[host-dirs] timed out after ${limitMs} ms`);
+    }, limitMs);
+    child.stdout?.on('data', (chunk) => { output += String(chunk); });
+    child.stderr?.on('data', (chunk) => { output += String(chunk); });
+    child.on('error', (error) => finish(2, `${output}\n${String(error)}`));
+    child.on('close', (code) => finish(code ?? 2, output));
+  });
 }
 
+const prepared = new Map<string, Promise<HostDirsPrepResult>>();
+
+/**
+ * Hand `hostPaths` to uid 1000 on the member's k3d nodes once per (host, cluster, node generation, path) in this process — every shard Job
+ * on the same member awaits the same run, and a path already handed over (or in flight) is not run again even when it
+ * comes with a different companion path. A failure is not memoized (the next Job tries again) and never throws.
+ */
+export async function prepareHostDirsOnce(o: { member: { sshHost?: string; k3dCluster: string }; hostPaths: readonly string[]; shell?: HostShell; limitMs?: number }): Promise<HostDirsPrepResult> {
+  const host = o.member.sshHost;
+  const label = host ?? 'local';
+  const start = Date.now();
+  const shell = o.shell ?? hostShellWithin;
+  // Node generation (review mf): a recreated cluster or a new agent has other container IDs, so a hand-over remembered for
+  // the old node set is not reused. Unreadable IDs → no memo at all (every path runs, success is not remembered).
+  const ids = await shell(host, podHostDirsNodeIdsScript(o.member.k3dCluster), o.limitMs ?? HOST_DIRS_PREP_LIMIT_MS)
+    .catch(() => ({ rc: 2, output: '' }));
+  const generation = ids.rc === 0 && ids.output.trim() ? ids.output.trim() : null;
+  const gen = generation ?? `unknown-${start}-${Math.random()}`;
+  const keyOf = (path: string) => `${label}\0${o.member.k3dCluster}\0${gen}\0${path}`;
+  const paths = [...new Set(o.hostPaths)].sort();
+  const fresh = paths.filter((path) => !prepared.has(keyOf(path)));
+  if (fresh.length) {
+    const run = (async (): Promise<HostDirsPrepResult> => {
+      const script = podHostDirsNodeScript({ cluster: o.member.k3dCluster, hostPaths: fresh });
+      const r = await shell(host, script, o.limitMs ?? HOST_DIRS_PREP_LIMIT_MS);
+      const ms = Date.now() - start;
+      return r.rc === 0 ? { host: label, ok: true, ms } : { host: label, ok: false, ms, detail: r.output.trim().slice(-300) || `rc=${r.rc}` };
+    })().catch((error: unknown) => ({ host: label, ok: false, ms: Date.now() - start, detail: String(error).slice(0, 300) }))
+      .then((result) => { if (!result.ok || generation === null) for (const path of fresh) prepared.delete(keyOf(path)); return result; });
+    for (const path of fresh) prepared.set(keyOf(path), run);
+  }
+  const results = await Promise.all(paths.map((path) => prepared.get(keyOf(path))!));
+  const failed = results.find((result) => !result.ok);
+  return failed ?? { host: label, ok: true, ms: Date.now() - start };
+}
+
+/** Test seam — forget the per-process hand-over memo. */
+export function resetHostDirsPrepMemo(): void { prepared.clear(); }
+
 const int = (value: number, label: string) => {
   if (!Number.isSafeInteger(value) || value < 1) throw new Error(`invalid ${label}: ${value}`);
   return value;
@@ -71,7 +176,9 @@ export function installSlotScript(o: { dir?: string; slots: number; waitSeconds?
     '  if [ ! -d "$d" ] || [ ! -w "$d" ]; then echo "[gate] install-slot none (directory not writable)"; return 0; fi',
     '  while :; do',
     `    for n in $(seq 0 ${slots - 1}); do`,
-    '      if mkdir "$d/slot-$n" 2>/dev/null; then',
+    // The token is taken by bash's own noclobber create (O_EXCL), not by `mkdir`: uutils coreutils `mkdir` (0.8 · wsl gate host)
+    // let two racing callers both succeed on one path (10-16 · 3 holders on 2 slots). A directory token left by an older shell still counts as held.
+    '      if (set -C; : > "$d/slot-$n") 2>/dev/null; then',
     '        install_slot="$d/slot-$n"',
     '        echo "[gate] install-slot $n waited $(( $(date +%s) - t0 ))s"; return 0',
     '      fi',

package/src/task-orchestrator/surfaces/pod-lease.ts

@@ -11,13 +11,23 @@ import { hostLeaseBaseDir, type PendingJobIdentity } from '../../pod-lease/host-
 // POD-CPU-REQUEST-RIGHTSIZE(10-09 · OP 실측): 하니스 Pod 실사용은 대부분 100m 미만(LLM 응답 대기)인데 요청 1 CPU 를
 //   잡아 node-b 32코어가 «요청 31/32»로 막혔다(실사용 4.6코어 · 14%). 요청은 실사용 근처로, 한도(4)는 그대로 — 몰릴 때는 한도까지 쓴다.
 //   게이트·pod-command 기본은 pod-command-job.ts 의 POD_COMMAND_CPU_REQUEST_DEFAULT(1)로 따로 둔다(테스트 조각은 CPU 를 실제로 쓴다).
-export const POD_CHILD_REQUESTS = { cpu: '250m', memory: '6Gi' } as const;
+// SI-TASK-ADMIT-RIGHTSIZE: one host env restores the previous 6Gi request and uncapped p95 admission.
+// An invalid override fails conservative at 6Gi rather than silently under-reserving a Pod.
+export function resolveSiTaskMemoryPolicy(override: string | undefined): { requestMemory: string; admissionCapBytes: number | null; source: string } {
+  if (override === undefined) return { requestMemory: '3Gi', admissionCapBytes: 3 * 1024 ** 3, source: 'default' };
+  if (override === '6Gi') return { requestMemory: '6Gi', admissionCapBytes: null, source: 'override' };
+  return { requestMemory: '6Gi', admissionCapBytes: null, source: 'invalid-override-fallback' };
+}
+const siMemoryPolicy = resolveSiTaskMemoryPolicy(process.env.ELANOUS_POD_SI_REQUEST_MEMORY);
+export const POD_CHILD_REQUESTS = { cpu: '250m', memory: siMemoryPolicy.requestMemory } as const;
 /** Finished harness and command Jobs release their Pod slots after 30 minutes. */
 export const POD_JOB_TTL_AFTER_FINISHED_SECONDS = 1800;
 /** 게이트가 돌 때 하니스 «한 자리»로 셈하는 CPU — 요청(250m)보다 보수적으로 1 코어를 잡아 게이트 조각의 CPU 를 지킨다(GATE-RESERVE-AUTO 셈은 그대로). */
 export const HARNESS_SLOT_CPU_BESIDE_GATE = '1';
 /** POD-ADMIT-BY-USAGE — observed usage is scaled by this before it reserves memory. */
 const POD_USAGE_HEADROOM = 1.5;
+/** New standard si-task admission only. Existing Running Pods keep their observed/requested reservation. */
+export const POD_SI_ADMISSION_CAP_BYTES = siMemoryPolicy.admissionCapBytes;
 /** POD-ADMIT-BY-USAGE — a node keeps at least this share of allocatable memory free (real usage and bookkeeping). */
 const POD_NODE_FREE_FLOOR_RATIO = 0.1;
 
@@ -477,6 +487,7 @@ export function measurePoolLease(members: readonly PodPoolMember[], deps: { kube
         const leasedJobs = new Set<string>();
         const gateJobs = new Map<string, number>();
         const boundGateJobs = new Set<string>();
+        const commandJobs = new Set<string>();
         let jobsValid = true;
         for (const job of jobItems) {
           const meta = object(job.metadata);
@@ -484,6 +495,7 @@ export function measurePoolLease(members: readonly PodPoolMember[], deps: { kube
           if (object(meta.labels)?.['elanous.substrate'] !== 'pod') continue;
           if (typeof meta.name !== 'string' || !meta.name) { jobsValid = false; continue; }
           jobNames.add(meta.name);
+          if (object(meta.labels)?.['elanous.kind'] === 'command') commandJobs.add(meta.name);
           // GATE-RESERVE-AUTO: a release-gate shard Job (`gate-<uuid>`, kind=command) reserves its Pod template's CPU
           // from creation until it is terminal — also while its Pod is still Pending or not created yet.
           if (meta.name.startsWith('gate-') && object(meta.labels)?.['elanous.kind'] === 'command') {
@@ -521,7 +533,8 @@ export function measurePoolLease(members: readonly PodPoolMember[], deps: { kube
           } else reservationsValid = false;
           const ownerJob = String(labels?.['elanous.job'] ?? labels?.['job-name'] ?? '');
           const gatePod = metadata?.namespace === 'elanous-test' && gateJobs.has(ownerJob);
-          const harness = metadata?.namespace === 'elanous-test' && labels?.['elanous.probe'] !== 'dns' && !gatePod &&
+          const commandPod = labels?.['elanous.kind'] === 'command' || commandJobs.has(ownerJob);
+          const harness = metadata?.namespace === 'elanous-test' && labels?.['elanous.probe'] !== 'dns' && !gatePod && !commandPod &&
             (labels?.['elanous.substrate'] === 'pod' || jobNames.has(String(labels?.['elanous.job'] ?? '')));
           const spec = object(pod.spec);
           let limit: number | null = null;
@@ -642,7 +655,7 @@ export function recommendConcurrency(measure: PoolLeaseMeasure, options: { capac
   if (goalBytes === null || goalBytes <= 0) return { ...empty, reason: '측정 불가: perGoalMemory' };
   const admission = admissionByUsage(measure, goalBytes, options.perGoalMemory !== undefined);
   if (!measure.members.length || measure.members.some((m) => m.running === null || m.pending === null || m.unleasedRunning === null || m.allocatableMemoryBytes === null || m.memoryLimitBytes === null || m.allocatableCpuMillicores === null || m.availableMemoryByNodeBytes === null)) {
-    debug.log('pod-lease', 'admit-by-usage', { samples: admission.samples, p95Bytes: admission.p95Bytes, admitBytes: admission.admitBytes, fallback: admission.fallback, recommended: null, limitedBy: null, capacity: options.capacity, capacitySlots: null, memorySlots: null, running: null, pending: null });
+    debug.log('pod-lease', 'admit-by-usage', { samples: admission.samples, p95Bytes: admission.p95Bytes, admitBytes: admission.admitBytes, fallback: admission.fallback, requestMemory: siMemoryPolicy.requestMemory, admissionCapBytes: POD_SI_ADMISSION_CAP_BYTES, policySource: siMemoryPolicy.source, recommended: null, limitedBy: null, capacity: options.capacity, capacitySlots: null, memorySlots: null, running: null, pending: null });
     return { ...empty, reason: `측정 불가: cluster${measure.members.map((m) => m.reason ? ` ${m.context}: ${m.reason}` : '').join('')}` };
   }
   if (!Number.isSafeInteger(options.capacity) || options.capacity < 0) return { ...empty, reason: '측정 불가: capacity' };
@@ -694,7 +707,7 @@ export function recommendConcurrency(measure: PoolLeaseMeasure, options: { capac
     && m.reason !== 'dns' && m.running !== null && m.pending !== null && m.running + m.pending >= m.capacity);
   const limitedBy: PoolLeaseRecommendation['limitedBy'] = memoryBound < capacitySlots ? 'memory' : defaultCapFull ? 'pool-cap' : 'capacity';
   if (unleasedRunning > 0) debug.log('pod-lease', 'unleased', { unleasedRunning, running, recommended });
-  debug.log('pod-lease', 'admit-by-usage', { samples: admission.samples, p95Bytes: admission.p95Bytes, admitBytes: admission.admitBytes, fallback: admission.fallback, recommended, limitedBy, capacity: options.capacity, capacitySlots, memorySlots, running, pending });
+  debug.log('pod-lease', 'admit-by-usage', { samples: admission.samples, p95Bytes: admission.p95Bytes, admitBytes: admission.admitBytes, fallback: admission.fallback, requestMemory: siMemoryPolicy.requestMemory, admissionCapBytes: POD_SI_ADMISSION_CAP_BYTES, policySource: siMemoryPolicy.source, recommended, limitedBy, capacity: options.capacity, capacitySlots, memorySlots, running, pending });
   return { recommended, limitedBy, reason: measure.members.some((m) => m.reason === 'dns') ? 'dns' : null, capacitySlots, memorySlots, liteMemorySlots, placeableSlots, accountSlots, running, pending, pendingJobs, unleasedRunning, admission };
 }
 
@@ -714,7 +727,8 @@ function admissionByUsage(measure: PoolLeaseMeasure, goalBytes: number, explicit
       : live.some((m) => m.harnessUsageBytes == null) ? (live.map((m) => m.harnessUsageBytes == null ? `${m.context}: ${m.usageReason ?? 'usage not measured'}` : '').filter(Boolean).join('; '))
         : p95Bytes === null ? 'no Running harness Pod usage samples'
           : null;
-  const admitBytes = fallback !== null || p95Bytes === null ? goalBytes
-    : Math.min(goalBytes, Math.max(requestBytes, Math.ceil(p95Bytes * POD_USAGE_HEADROOM)));
+  const observedBytes = p95Bytes === null ? null : Math.ceil(p95Bytes * POD_USAGE_HEADROOM);
+  const admitBytes = fallback !== null || observedBytes === null ? goalBytes
+    : Math.min(goalBytes, Math.max(requestBytes, POD_SI_ADMISSION_CAP_BYTES === null ? observedBytes : Math.min(observedBytes, POD_SI_ADMISSION_CAP_BYTES)));
   return { samples: samples.length, p95Bytes, admitBytes, fallback };
 }

package/src/task-orchestrator/surfaces/pod-lifecycle-stages.ts

@@ -0,0 +1,169 @@
+/**
+ * POD-LIFECYCLE-STAGES (P0 · Pod 재사용 기준선) — Pod 하나가 끝날 때 «어느 단계에 시간이 갔나»를 한 줄로 낸다.
+ *
+ * 계약: category `pod.lifecycle` · event `stages` ·
+ *   data `{ runId, podJob, host, kind, stages: [{ stage, start, end, clock }], outcome, missing }`.
+ *   - 시각은 epoch ms 하나로 통일한다(Pod 시계의 초 값은 ×1000).
+ *   - `clock` 은 그 값이 어느 시계에서 왔나 — `host`(이 프로세스) · `k8s`(API 서버 시각) · `pod`(Pod 안 `date +%s`) · `mixed`.
+ *   - ⛔ «0초»와 «못 잼»을 섞지 않는다: 시작·끝 둘 다 잰 단계만 `stages` 에 들어가고, 나머지는 이름만 `missing` 에 간다.
+ *     끝이 시작보다 앞서면(시계가 어긋났다) 그 단계도 지어내지 않고 `missing` 이다.
+ *
+ * 관측만 한다 — 판정·rc·파일을 바꾸지 않고, 내보내기가 실패해도 삼킨다.
+ */
+import { debug } from '../../debug/log.js';
+
+export const POD_LIFECYCLE_STAGES = ['create', 'schedule', 'clone', 'mirror', 'deps', 'test', 'delete'] as const;
+/** si-task Pod 은 시험이 아니라 `self implement`(또는 harness ask/say) 본체를 돈다 — 그 칸은 `test` 가 아니라 `run` 이다. */
+export const SI_TASK_POD_LIFECYCLE_STAGES = ['create', 'schedule', 'clone', 'mirror', 'deps', 'run', 'delete'] as const;
+export type PodLifecycleStageName = typeof POD_LIFECYCLE_STAGES[number] | typeof SI_TASK_POD_LIFECYCLE_STAGES[number];
+export type PodLifecycleClock = 'host' | 'k8s' | 'pod' | 'mixed';
+export type PodLifecycleKind = 'gate' | 'si-task';
+
+export interface PodLifecycleStage { stage: PodLifecycleStageName; start: number; end: number; clock: PodLifecycleClock }
+
+export interface PodLifecycleEvent {
+  runId: string | null;
+  podJob: string | null;
+  host: string | null;
+  kind: PodLifecycleKind;
+  stages: PodLifecycleStage[];
+  outcome: string;
+  missing: PodLifecycleStageName[];
+  [extra: string]: unknown;
+}
+
+type Measured = Partial<Record<PodLifecycleStageName, { start?: number; end?: number; clock: PodLifecycleClock }>>;
+
+/** ISO 문자열 → epoch ms (못 읽으면 undefined — 지어내지 않는다). */
+export function isoMs(value: string | undefined): number | undefined {
+  if (typeof value !== 'string') return undefined;
+  const ms = Date.parse(value);
+  return Number.isFinite(ms) ? ms : undefined;
+}
+
+/** Pod 시계의 epoch 초 → ms. */
+function podSecondsMs(value: number | undefined): number | undefined {
+  return typeof value === 'number' && Number.isFinite(value) ? value * 1000 : undefined;
+}
+
+/** 잰 것만 stages 로, 나머지는 missing 으로 — 계약의 단계 순서대로. */
+export function splitPodLifecycleStages(measured: Measured, order: readonly PodLifecycleStageName[] = POD_LIFECYCLE_STAGES): { stages: PodLifecycleStage[]; missing: PodLifecycleStageName[] } {
+  const stages: PodLifecycleStage[] = [];
+  const missing: PodLifecycleStageName[] = [];
+  for (const name of order) {
+    const item = measured[name];
+    if (item && item.start !== undefined && item.end !== undefined && item.end >= item.start) stages.push({ stage: name, start: item.start, end: item.end, clock: item.clock });
+    else missing.push(name);
+  }
+  return { stages, missing };
+}
+
+/**
+ * gate shard Pod — `pod-N.json` 에 쓰는 바로 그 값(phaseTimes · podStages · podLifecycle)에서 단계를 고른다.
+ * - create   = 풀 자리 배정(없으면 입장 끝 · host) → Pod 생성(k8s)
+ * - schedule = Pod 생성 → PodScheduled (k8s)
+ * - clone    = 자식 컨테이너 PID 1(prep-start) → 셸 첫 줄(clone-end) (pod)
+ * - deps     = deps-start → deps-end (pod) · test = test-start → test-end (pod)
+ * - mirror · delete = gate 는 Pod 별로 재지 않는다 → 늘 missing.
+ */
+export function gatePodLifecycleStages(input: {
+  phaseTimes?: Readonly<Record<string, string>>;
+  podStages?: Readonly<Record<string, number>>;
+  podLifecycle?: Readonly<Record<string, string>>;
+}): { stages: PodLifecycleStage[]; missing: PodLifecycleStageName[] } {
+  const phase = input.phaseTimes ?? {};
+  const pod = input.podStages ?? {};
+  const k8s = input.podLifecycle ?? {};
+  return splitPodLifecycleStages({
+    create: { start: isoMs(phase.poolPlaced) ?? isoMs(phase.admissionEnd), end: isoMs(k8s.podCreated), clock: 'mixed' },
+    schedule: { start: isoMs(k8s.podCreated), end: isoMs(k8s.podScheduled), clock: 'k8s' },
+    clone: { start: podSecondsMs(pod['prep-start']), end: podSecondsMs(pod['clone-end']), clock: 'pod' },
+    deps: { start: podSecondsMs(pod['deps-start']), end: podSecondsMs(pod['deps-end']), clock: 'pod' },
+    test: { start: podSecondsMs(pod['test-start']), end: podSecondsMs(pod['test-end']), clock: 'pod' },
+  });
+}
+
+/** gate shard 의 끝 — 판정 코드와 같은 순서(잡 실패 → 정지 → 시간 초과 → 판정 없음 → rc). */
+export function gatePodOutcome(o: { jobFailed: boolean; stalled: boolean; timedOut: boolean; rc: number | undefined }): string {
+  if (o.jobFailed) return 'job-failed';
+  if (o.stalled) return 'stall';
+  if (o.timedOut) return 'timeout';
+  if (o.rc === undefined) return 'no-verdict';
+  return o.rc === 0 ? 'pass' : 'fail';
+}
+
+export function gatePodLifecycleEvent(input: {
+  runId?: string | null;
+  podJob?: string | null;
+  host?: string | null;
+  shard: string;
+  attemptId?: string;
+  phaseTimes?: Readonly<Record<string, string>>;
+  podStages?: Readonly<Record<string, number>>;
+  podLifecycle?: Readonly<Record<string, string>>;
+  outcome: string;
+}): PodLifecycleEvent {
+  const { stages, missing } = gatePodLifecycleStages(input);
+  return { runId: input.runId ?? null, podJob: input.podJob ?? null, host: input.host ?? null, kind: 'gate', stages, outcome: input.outcome, missing,
+    shard: input.shard, ...(input.attemptId ? { attemptId: input.attemptId } : {}) };
+}
+
+/** si-task Pod 셸이 찍는 단계 표지 — `ELANOUS_POD_STAGE <stage> <start|end> <epoch초>` (Pod 시계 · `date +%s`). */
+/** Pod 셸이 실제로 표지를 찍는 단계만 — deps 는 si-task Job 에 설치 단계가 없어 읽지도 않는다(늘 missing). */
+const SI_TASK_MARKED_STAGES = ['clone', 'mirror', 'run'] as const;
+export type SiTaskMarkedStage = typeof SI_TASK_MARKED_STAGES[number];
+
+/** Pod 셸 한 줄 — 단계 경계에서 Pod 시계(초)를 찍는다. 실패해도 셸을 끊지 않는다(`|| true`). */
+export function siTaskPodStageShell(stage: SiTaskMarkedStage, edge: 'start' | 'end'): string {
+  return `printf 'ELANOUS_POD_STAGE ${stage} ${edge} %s\\n' "$(date +%s)" || true`;
+}
+const SI_TASK_STAGE_LINE = /^ELANOUS_POD_STAGE (clone|mirror|run) (start|end) (\d{1,12})\r?$/gm;
+
+/**
+ * Job 로그에서 단계 표지를 읽는다 → `{ 'clone-start': 초, 'clone-end': 초, … }` (gate 의 podStages 와 같은 꼴).
+ * 같은 표지가 두 번 나오면 «첫» 값 — 셸 표지는 모두 자식 출력(`cat /tmp/si.out`)보다 앞에 찍히므로, 자식이 같은 모양의 줄을
+ * 내도 셸 값을 덮지 못한다(리뷰 should-fix). 모르는 단계·꼴은 버린다(지어내지 않는다).
+ */
+export function parseSiTaskPodStages(logs: string | undefined): Record<string, number> {
+  const out: Record<string, number> = {};
+  if (!logs) return out;
+  for (const match of logs.matchAll(SI_TASK_STAGE_LINE)) {
+    const key = `${match[1]}-${match[2]}`;
+    if (!(key in out)) out[key] = Number(match[3]);
+  }
+  return out;
+}
+
+/**
+ * si-task Pod — Pod 셸이 찍은 단계 표지(`parseSiTaskPodStages`)로 clone · mirror · deps · run 을 채운다(pod 시계).
+ * - clone  = 소스 받기(`podSourceScript`) 시작 → 그 스크립트 전체가 끝난 뒤(`cd repo` 포함 · 어느 줄에서든 exit 하면 끝이 없다 → missing)
+ * - mirror = 호스트 미러 `clone --shared` 시도 → 성공(미러를 건너뛰면 끝이 없다 → missing)
+ * - deps   = si-task Job 셸엔 의존성 설치 단계가 없다 → 표지를 읽지 않는다(`deps` 표지 줄이 있어도 늘 missing)
+ * - run    = 본체(`self implement` · `harness ask`/`say`) 띄움 → `wait` 가 돌아옴(SIGTERM 이면 끝이 없다 → missing)
+ * - create · schedule · delete = 호스트가 잴 값이 없다 → missing.
+ * 호스트가 지켜본 구간은 단계가 아닌 `watch`(host 시계)로 따로 싣는다 — 단계로 지어내지 않는다.
+ */
+export function siTaskPodLifecycleEvent(input: {
+  runId?: string | null;
+  podJob: string;
+  host?: string | null;
+  watchStart?: number;
+  watchEnd?: number;
+  podStages?: Readonly<Record<string, number>>;
+  outcome: string;
+}): PodLifecycleEvent {
+  const pod = input.podStages ?? {};
+  const measured: Measured = {};
+  for (const name of SI_TASK_MARKED_STAGES) measured[name] = { start: podSecondsMs(pod[`${name}-start`]), end: podSecondsMs(pod[`${name}-end`]), clock: 'pod' };
+  const { stages, missing } = splitPodLifecycleStages(measured, SI_TASK_POD_LIFECYCLE_STAGES);
+  const watched = input.watchStart !== undefined && input.watchEnd !== undefined && Number.isFinite(input.watchStart) && Number.isFinite(input.watchEnd) && input.watchEnd >= input.watchStart;
+  return { runId: input.runId ?? null, podJob: input.podJob, host: input.host ?? null, kind: 'si-task', stages, outcome: input.outcome, missing,
+    ...(watched ? { watch: { start: input.watchStart, end: input.watchEnd, clock: 'host' as const } } : {}) };
+}
+
+export type PodLifecycleLog = (category: string, event: string, data: Record<string, unknown>) => void;
+
+/** 한 줄 낸다 — 관측은 fail-soft(판정 경로를 절대 깨지 않는다). */
+export function emitPodLifecycle(event: PodLifecycleEvent, log: PodLifecycleLog = (category, name, data) => debug.log(category, name, data)): void {
+  try { log('pod.lifecycle', 'stages', event); } catch { /* observation is fail-soft */ }
+}