elanous 0.2.29 → 0.2.31

package/src/task-orchestrator/surfaces/pod-command-job.ts

@@ -16,7 +16,7 @@ import { collectPodArtifacts } from './pod-artifact-return.js';
 import { getDefaultLogStore, type LogStore } from '../../mss/logging/log-store.js';
 import { podBunCacheVolume } from './pod-bun-cache.js';
 import { POD_JOB_TTL_AFTER_FINISHED_SECONDS } from './pod-lease.js';
-import { podHostDirsScript, podInstallSlotsVolume } from './pod-install-slots.js';
+import { podHostDirsCheckScript, podInstallSlotsVolume, prepareHostDirsOnce, type HostDirsPrepResult, podHostDirsScript } from './pod-install-slots.js';
 import { type PodPoolMember, PodPoolScheduler, resolvePodPoolSpec, parsePodPool, checkPodPool, syncPoolImages, type PoolKubectl } from './pod-pool.js';
 import { podSkillsDigest, readSkillEnvFiles, resolvePodSkills } from './pod-skills.js';
 import { podSourceScript, type PodSource } from './pod-source-receive.js';
@@ -40,11 +40,18 @@ export const POD_LITE_IMAGE = 'elanous-harness-lite:local';
 
 export const POD_LITE_MEMORY_LIMIT = '2Gi';
 
+/** W5 (10-15 #27801): where a memory-backed TMPDIR is mounted for release gate shards — the overlayfs `/tmp` made SQLite
+ *  tests take 0.4~5s per turn (once 124s). tmpfs pages count against the container memory limit, so the caller's cap
+ *  (`tmpfsSizeLimit`) stays small next to the 16Gi shard limit (request 6Gi). */
+export const POD_TMPFS_MOUNT_PATH = '/tmp-mem';
+
 /** 요청은 한도를 넘을 수 없다(쿠버네티스가 Job 을 거부한다) — lite 2Gi 처럼 한도가 기본 요청보다 작으면 한도로 맞춘다. */
 /** The command Job container's CPU limit when the caller names none (GATE-SPEED A3①: unchanged default). */
 export const POD_COMMAND_CPU_LIMIT_DEFAULT = '4';
 /** 게이트 조각·pod-command 의 CPU 요청 기본 — 하니스 Pod(POD_CHILD_REQUESTS.cpu)와 따로 둔다(조각은 bun test 로 CPU 를 실제로 쓴다). */
 export const POD_COMMAND_CPU_REQUEST_DEFAULT = '1';
+/** Gate and command Pods retain their measured 6Gi scheduler request; si-task admission uses its own size. */
+export const POD_COMMAND_MEMORY_REQUEST_DEFAULT = '6Gi';
 
 /** Container CPU request/limit override. Omitted fields keep the defaults (request `POD_COMMAND_CPU_REQUEST_DEFAULT` · limit 4). */
 export interface PodCpu { request?: string; limit?: string }
@@ -93,9 +100,9 @@ export function parsePodCpu(value: unknown, label = 'cpu'): PodCpu | undefined {
 
 export function memoryRequestWithin(limit: string | undefined): string {
   const gi = (value: string | undefined) => { const m = /^(\d+)Gi$/.exec(value ?? ''); return m ? Number(m[1]) : null; };
-  const request = gi(POD_CHILD_REQUESTS.memory);
+  const request = gi(POD_COMMAND_MEMORY_REQUEST_DEFAULT);
   const max = gi(limit);
-  return request !== null && max !== null && request > max ? limit! : POD_CHILD_REQUESTS.memory;
+  return request !== null && max !== null && request > max ? limit! : POD_COMMAND_MEMORY_REQUEST_DEFAULT;
 }
 
 /** POD7 must-fix: the skill list alone can't tell a network-only job from one that needs ffmpeg/browser — so lite is
@@ -133,18 +140,24 @@ export function tailBytes(text: string, maxBytes: number): string {
   return `…[앞 ${bytes.length - maxBytes}바이트 생략]\n${cut.subarray(start).toString('utf8')}`;
 }
 
-/** The isolation probe: wait until the NetworkPolicy blocks the host/prod daemons, then run `onPass` (default `exit 0`). */
-function isolationGateScript(onPass = 'exit 0'): string {
-  return `ok=0
-for i in $(seq 1 60); do
-  if curl -s -m 1 -o /dev/null http://host.orb.internal:31415/health || curl -s -m 1 -o /dev/null http://core.elanous-prod:8080/; then ok=0; else ok=$((ok+1)); fi
-  [ "$ok" -ge 3 ] && { echo "[gate] isolation enforced after \${i} probes"; ${onPass}; }
-  sleep 0.5
-done
-echo "[gate] ISOLATION NOT ENFORCED within 30s"; exit 1`;
+/**
+ * The isolation probe: wait until the NetworkPolicy blocks the host/prod daemons, then go on with the child shell.
+ * GATE-WARM-BOOT-NO-INIT (10-15) — this used to be the `isolation-gate` init container; it is now the child shell's first
+ * lines, before any credential is read. Same probes, same log lines, same exit 1 when isolation is not enforced in 30 s.
+ * Measured on node-b k3d (#27805): init 2 → 354 s · init 1 → 41 s · none → 1 s from Pod creation to the child start.
+ */
+export function isolationGateLines(): string {
+  return `elanous_isolation_gate() {
+  local ok=0 i
+  for i in $(seq 1 60); do
+    if curl -s -m 1 -o /dev/null http://host.orb.internal:31415/health || curl -s -m 1 -o /dev/null http://core.elanous-prod:8080/; then ok=0; else ok=$((ok+1)); fi
+    [ "$ok" -ge 3 ] && { echo "[gate] isolation enforced after \${i} probes"; return 0; }
+    sleep 0.5
+  done
+  echo "[gate] ISOLATION NOT ENFORCED within 30s"; exit 1
+}
+elanous_isolation_gate || exit 1`;
 }
-
-const GATE = isolationGateScript();
 
 /** Export the command's log store into the existing outbox return channel without changing the command exit status. */
 const COMMAND_LOG_EXPORT = `if mkdir -p "$HOME/outbox/pod-logs" && elanous --test="$HOME/.elanous-test" logs --instance prod --since 12h --limit 20000 --json --json-data > "$HOME/outbox/pod-logs/logs.jsonl"; then
@@ -182,7 +195,7 @@ if [ -d "$HOME/outbox" ]; then
     else
       printf 'ELANOUS_POD_ARTIFACT_SKIPPED %s %s\\n' "$relative" "$size"
     fi
-  done < <(find "$HOME/outbox" -type f -print0)
+  done < <(find "$HOME/outbox" -type f -print0 | while IFS= read -r -d '' f; do printf '%s\\t%s\\0' "$(( $(wc -c < "$f") ))" "$f"; done | LC_ALL=C sort -z -t $'\\t' -k1,1n -k2 | while IFS= read -r -d '' row; do printf '%s\\0' "\${row#*$'\\t'}"; done)
 fi`;
 
 export interface PodCommandJobInput {
@@ -208,9 +221,13 @@ export interface PodCommandJobInput {
   memoryLimit?: string;
   /** GATE-SPEED A3①: CPU request/limit override (release gate shards only). Omitted = request 1 / limit 4. */
   cpu?: PodCpu;
+  /** W5 — emptyDir{medium: Memory} sizeLimit mounted at {@link POD_TMPFS_MOUNT_PATH} ⊕ `TMPDIR` (release gate shards only). Omitted = image `/tmp`. */
+  tmpfsSizeLimit?: string;
   source?: PodSource;
   deadlineSeconds: number;
   runId?: string;
+  /** GATE-WARM-BOOT-NO-INIT fallback: the node-side hand-over did not run, so a root init container hands the hostPath dirs to uid 1000. */
+  hostDirsInit?: boolean;
 }
 
 function bashSingleQuote(value: string): string {
@@ -226,8 +243,11 @@ export function podCommandJobManifest(o: PodCommandJobInput): Record<string, unk
   const grok = o.llm === 'grok';
   const bunCache = o.bunCache ? podBunCacheVolume(o.bunCache) : undefined;
   const installSlots = o.installSlots ? podInstallSlotsVolume(o.installSlots) : undefined;
-  // hostPath directories the uid-1000 child writes: a root init container hands them over (DirectoryOrCreate is root 0755).
+  // hostPath directories the uid-1000 child writes. DirectoryOrCreate makes them root 0755, so runPodCommand hands them to
+  // uid 1000 once per node (prepareHostDirsOnce); the child only reports a directory it still cannot write.
   const hostDirMounts = [...(bunCache ? [bunCache.volumeMount] : []), ...(installSlots ? [installSlots.volumeMount] : [])];
+  const tmpfs = o.tmpfsSizeLimit?.trim() || undefined;
+  const tmpfsMounts = tmpfs ? [{ name: 'tmp-mem', mountPath: POD_TMPFS_MOUNT_PATH }] : [];
   const cpu = resolvePodCpu(o.cpu);
   const quotedArgs = o.command.map(bashSingleQuote).join(' ');
   const credLines = [
@@ -237,12 +257,14 @@ export function podCommandJobManifest(o: PodCommandJobInput): Record<string, unk
       : []),
   ];
   const script = [
+    isolationGateLines(),
     'set -u',
     ...credLines,
     'curl -s -m 3 -o /dev/null http://host.orb.internal:31415/health && { echo "[pod] ISOLATION FAIL"; exit 3; }',
     ...(o.clone
       ? ['export GH_TOKEN="$(cat /creds/gh-token)" && gh auth setup-git', podSourceScript(o.source ?? { kind: 'default' }, o.repoUrl)]
       : ['mkdir -p ~/work && cd ~/work']),
+    ...(hostDirMounts.length ? [podHostDirsCheckScript(hostDirMounts)] : []),
     ...(bunCache ? [bunCache.shellPrefix] : []),
     `set -- ${quotedArgs}`,
     '"$@"',
@@ -270,14 +292,10 @@ export function podCommandJobManifest(o: PodCommandJobInput): Record<string, unk
         spec: {
           restartPolicy: 'Never',
           securityContext: { runAsUser: 1000, fsGroup: 1000 },
-          initContainers: [
-            // GATE-WARM-BOOT (10-15): ONE init container. Each extra container cost minutes on a loaded k3d node (the measured
-            // gap between a finished init script and the next container start), so the root host-dir hand-over runs inside
-            // the isolation init after the probe passes instead of as a second `host-dirs` container.
-            hostDirMounts.length
-              ? { name: 'isolation-gate', image: o.image, imagePullPolicy: o.imagePullPolicy ?? 'Never', securityContext: { runAsUser: 0 }, command: ['bash', '-c'], args: [isolationGateScript(podHostDirsScript(hostDirMounts))], volumeMounts: hostDirMounts.map((mount) => ({ ...mount })) }
-              : { name: 'isolation-gate', image: o.image, imagePullPolicy: o.imagePullPolicy ?? 'Never', command: ['bash', '-c'], args: [GATE] },
-          ],
+          // Normal path: no init container. Fallback only when the node-side hand-over did not run (no member · prep failed).
+          ...(o.hostDirsInit && hostDirMounts.length ? { initContainers: [
+            { name: 'host-dirs', image: o.image, imagePullPolicy: o.imagePullPolicy ?? 'Never', securityContext: { runAsUser: 0 }, command: ['bash', '-c'], args: [podHostDirsScript(hostDirMounts)], volumeMounts: hostDirMounts.map((mount) => ({ ...mount })) },
+          ] } : {}),
           containers: [{
             name: 'child', image: o.image, imagePullPolicy: o.imagePullPolicy ?? 'Never',
             resources: { requests: { ...POD_CHILD_REQUESTS, cpu: cpu.request, memory: memoryRequestWithin(o.memoryLimit) }, limits: { memory: o.memoryLimit ?? '16Gi', cpu: cpu.limit } },
@@ -286,18 +304,21 @@ export function podCommandJobManifest(o: PodCommandJobInput): Record<string, unk
               ...(o.runId ? [{ name: 'ELANOUS_RUN_ID', value: o.runId }] : []),
               { name: 'ELANOUS_SUBSTRATE', value: 'pod' },
               { name: 'ELANOUS_POD_NAME', valueFrom: { fieldRef: { fieldPath: 'metadata.name' } } },
+              ...(tmpfs ? [{ name: 'TMPDIR', value: POD_TMPFS_MOUNT_PATH }] : []),
             ],
-            ...(secretKeys || o.hostMirror || hostDirMounts.length ? { volumeMounts: [
+            ...(secretKeys || o.hostMirror || hostDirMounts.length || tmpfs ? { volumeMounts: [
               ...(secretKeys ? [{ name: 'creds', mountPath: '/creds', readOnly: true }] : []),
               ...(o.hostMirror ? [{ name: 'host-mirror', mountPath: '/host-mirror', readOnly: true }] : []),
               ...hostDirMounts,
+              ...tmpfsMounts,
             ] } : {}),
           }],
-          ...(secretKeys || o.hostMirror || hostDirMounts.length ? { volumes: [
+          ...(secretKeys || o.hostMirror || hostDirMounts.length || tmpfs ? { volumes: [
             ...(secretKeys ? [{ name: 'creds', secret: { secretName: `${o.name}-creds`, defaultMode: 0o400 } }] : []),
             ...(o.hostMirror ? [{ name: 'host-mirror', hostPath: { path: o.hostMirror, type: 'Directory' } }] : []),
             ...(bunCache ? [bunCache.volume] : []),
             ...(installSlots ? [installSlots.volume] : []),
+            ...(tmpfs ? [{ name: 'tmp-mem', emptyDir: { medium: 'Memory', sizeLimit: tmpfs } }] : []),
           ] } : {}),
         },
       },
@@ -374,6 +395,8 @@ export interface RunPodCommandOptions {
   memoryLimit?: string;
   /** GATE-SPEED A3①: CPU request/limit override — only the release gate passes it. Omitted = request 1 / limit 4. */
   cpu?: PodCpu;
+  /** W5 — memory-backed TMPDIR sizeLimit mounted at {@link POD_TMPFS_MOUNT_PATH}; only the release gate passes it. Omitted = image `/tmp`. */
+  tmpfsSizeLimit?: string;
   /** POD7: 호출부가 «네트워크 스킬만 쓰는 명령»이라고 말할 때만 lite 이미지 ⊕ 2Gi. */
   lite?: boolean;
   source?: PodSource;
@@ -398,6 +421,8 @@ export interface RunPodCommandOptions {
   seedMirror?: (o: { host: string; commit: string; cwd: string }) => Promise<MirrorSeedResult | undefined>;
   /** GATE-WARM-BOOT — the git tree the seed pushes from (default: the process cwd — the gate runs in the repo tree). */
   mirrorSeedCwd?: string;
+  /** GATE-WARM-BOOT-NO-INIT — hands the hostPath dirs to uid 1000 on the member's nodes (test seam · default {@link prepareHostDirsOnce}). */
+  prepareHostDirs?: (o: { member: PodPoolMember; hostPaths: readonly string[] }) => Promise<HostDirsPrepResult | undefined>;
   checkPool?: typeof checkPodPool;
   syncImages?: typeof syncPoolImages;
   imageCommit?: string | null;
@@ -417,6 +442,8 @@ export interface RunPodCommandOptions {
 /** GATE-POD-RESULT-MARKER — the child script's final line (`\n<marker> <token> rc=<n>\n`), printed after the artifact emit. */
 export const POD_RESULT_MARKER = '__ELANOUS_POD_DONE__';
 /** The marker bound to one launch (`token` = the launch's random id · the Job name when the manifest has no launch). */
+/** Full-log re-reads after an early marker return before the artifacts count as lost (GATE-POD-RESULT-MARKER follow-up). */
+export const POD_MARKER_LOG_RETRIES = 2;
 export function podResultMarker(token: string): string { return `${POD_RESULT_MARKER} ${token}`; }
 
 /** Split the child's logs into the command output (marker tail removed, bytes otherwise unchanged) and the marker rc (null = no marker for this token). */
@@ -563,6 +590,24 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
         .catch((error: unknown) => ({ host: member!.sshHost!, ok: false, ms: 0, detail: String(error).slice(0, 300) }));
       log('pod.command-job', 'mirror-seed', { host: member.sshHost, commit: options.source.sha, ok: seed?.ok ?? false, ms: seed?.ms ?? 0, ...(seed?.detail ? { detail: seed.detail } : {}) });
     }
+    // GATE-WARM-BOOT-NO-INIT (10-15): the hostPath dirs the uid-1000 child writes are handed over on the node itself, once per
+    // member·paths in this process (no init container). Best effort: a failure only logs; the child then falls back.
+    const hostDirPaths = [...(bunCache ? [bunCache] : []), ...(installSlots ? [installSlots] : [])];
+    const prepareHostDirs = options.prepareHostDirs ?? (options.kubectl ? undefined : prepareHostDirsOnce);
+    let hostDirsPrepared = false;
+    if (hostDirPaths.length) {
+      // Observed whether or not a hand-over runs: no member (nothing to reach) and an injected kubectl without a seam are skips.
+      if (!member) log('pod.command-job', 'host-dirs-prep', { ok: false, reason: 'no-pool-member', paths: hostDirPaths });
+      else if (!prepareHostDirs) log('pod.command-job', 'host-dirs-prep', { ok: false, reason: 'prep-disabled', paths: hostDirPaths });
+      else {
+        const prep = await prepareHostDirs({ member, hostPaths: hostDirPaths })
+          .catch((error: unknown) => ({ host: member!.sshHost ?? 'local', ok: false, ms: 0, detail: String(error).slice(0, 300) }));
+        hostDirsPrepared = prep?.ok === true;
+        log('pod.command-job', 'host-dirs-prep', { host: prep?.host ?? member.sshHost ?? 'local', ok: prep?.ok ?? false, ms: prep?.ms ?? 0, paths: hostDirPaths, ...(prep?.detail ? { detail: prep.detail } : {}) });
+      }
+    }
+    // Any path where the node-side hand-over did not succeed keeps the old in-Pod hand-over (review mf: uid 1000 could not write).
+    const hostDirsInit = hostDirPaths.length > 0 && !hostDirsPrepared;
     const ghToken = options.clone ? (options.ghToken ?? defaultGhToken)() : undefined;
     const secret = commandJobSecret({ name, namespace, launch, skills, skillEnvText, ...(grokAuth !== undefined ? { grokAuth } : {}), ...(ghToken !== undefined ? { ghToken } : {}) });
     if (secret) {
@@ -573,8 +618,9 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
       name, namespace, launch, image: imageRef ?? image,
       ...(imageRef ? { imagePullPolicy: 'IfNotPresent' as const } : {}),
       repoUrl, command, skills, ...(options.returnLogs ? { returnLogs: true } : {}), ...(llm ? { llm } : {}), ...(options.clone ? { clone: true } : {}),
-      ...(options.source ? { source: options.source } : {}), ...(hostMirror ? { hostMirror } : {}), ...(bunCache ? { bunCache } : {}), ...(installSlots ? { installSlots } : {}), ...(memoryLimit ? { memoryLimit } : {}), ...(options.cpu ? { cpu: options.cpu } : {}), deadlineSeconds,
+      ...(options.source ? { source: options.source } : {}), ...(hostMirror ? { hostMirror } : {}), ...(bunCache ? { bunCache } : {}), ...(installSlots ? { installSlots } : {}), ...(memoryLimit ? { memoryLimit } : {}), ...(options.cpu ? { cpu: options.cpu } : {}), ...(options.tmpfsSizeLimit ? { tmpfsSizeLimit: options.tmpfsSizeLimit } : {}), deadlineSeconds,
       ...(options.runId ? { runId: options.runId } : {}),
+      ...(hostDirsInit ? { hostDirsInit: true } : {}),
     });
     kubectl(['-n', namespace, 'delete', 'job', '-l', own, '--ignore-not-found']);
     const applied = kubectl(['apply', '-f', '-'], JSON.stringify(manifest));
@@ -611,7 +657,21 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
       } else unreadableSince = null;
       await sleep(options.pollMs ?? 15_000);
     }
-    const logsResult = kubectl(['-n', namespace, 'logs', `job/${name}`, '-c', 'child']);
+    let logsResult = kubectl(['-n', namespace, 'logs', `job/${name}`, '-c', 'child']);
+    // Marker path returns before the Job condition — a full-log read can hit the same transient window the tail read
+    // already survived (container log rotation · API hiccup). Retry it a little before calling the artifacts lost.
+    // A read that «succeeds» but stops before this launch's marker (empty · cut off) is incomplete too (review mf · #27842).
+    const fullLogIncomplete = (r: { status: number | null; stdout: string }) =>
+      r.status !== 0 || splitPodResultMarker(r.stdout.startsWith('\n') ? r.stdout : `\n${r.stdout}`, launch).rc === null;
+    for (let attempt = 1; markerRc !== null && fullLogIncomplete(logsResult) && attempt <= POD_MARKER_LOG_RETRIES; attempt++) {
+      log('pod.command-job', 'result-marker-log-retry', { job: name, attempt, ...(logsResult.status !== 0 ? { error: (logsResult.stderr ?? '').trim().slice(0, 200) } : { reason: 'marker-missing-in-full-log' }) });
+      await sleep(options.pollMs === undefined ? 1_000 : Math.min(options.pollMs, 1_000));   // ≤2 re-reads within ≈2s total
+      logsResult = kubectl(['-n', namespace, 'logs', `job/${name}`, '-c', 'child']);
+    }
+    // Still without this launch's marker after the retries: the artifacts are not trusted as complete (explicit failure).
+    if (markerRc !== null && logsResult.status === 0 && fullLogIncomplete(logsResult)) {
+      logsResult = { ...logsResult, status: 1, stderr: 'full log ended before this launch\'s result marker (incomplete after retries)' };
+    }
     const logsFailed = logsResult.status !== 0;
     const logs = logsFailed ? '' : splitPodResultMarker(logsResult.stdout, launch).logs;
     const artifactDir = artifactRoot;

package/src/task-orchestrator/surfaces/pod-failure-reason.ts

@@ -6,7 +6,15 @@ export const STOP_CLASS_NO_LAUNCH = 'no-launch' as const;
 const CHILD_RESULT_KINDS = new Set(['self', 'external']);
 
 /** The dev child's terminal line nests the stage: {ok, kind, result:{stage, ok, node, outcome, …}}. Other JSON rows are not results. */
-export function nestedPodResult(row: Record<string, unknown>): { stage: string; ok: boolean; error?: string } | null {
+export function nestedPodResult(row: Record<string, unknown>): {
+  stage: string;
+  ok: boolean;
+  error?: string;
+  reasonCode?: string;
+  checkName?: string;
+  targetPath?: string;
+  preflightChecks?: PreflightCheck[];
+} | null {
   if (typeof row.kind !== 'string' || !CHILD_RESULT_KINDS.has(row.kind) || typeof row.ok !== 'boolean') return null;
   if (!row.result || typeof row.result !== 'object' || Array.isArray(row.result)) return null;
   const result = row.result as Record<string, unknown>;
@@ -18,28 +26,72 @@ export function nestedPodResult(row: Record<string, unknown>): { stage: string;
       ? (classification as Record<string, unknown>).classification : undefined;
   const reason = [result.node, result.outcome].filter((part): part is string => typeof part === 'string' && part.length > 0).join(' ');
   const error = [reason || (typeof result.error === 'string' ? result.error : ''), typeof detail === 'string' && detail ? detail : ''].filter(Boolean).join(' · ');
-  return { stage: result.stage, ok: false, ...(error ? { error } : {}) };
+  // PREFLIGHT-RESULT-LINE: a nested preflight rejection carries its blockers under result.blockers — the same ledger fields as the flat row.
+  const blockers = result.stage === 'preflight-blocked' ? preflightBlockerText(result.blockers)
+    : { error: '', preflightChecks: [] as PreflightCheck[] };
+  return {
+    stage: result.stage,
+    ok: false,
+    ...(error || blockers.error ? { error: error || blockers.error } : {}),
+    ...(blockers.preflightChecks.length === 1 ? blockers.preflightChecks[0] : {}),
+    ...(blockers.preflightChecks.length > 1 ? { preflightChecks: blockers.preflightChecks } : {}),
+  };
 }
 
-/** One line naming each preflight blocker (`(대상 경로 0) — …`), or '' when the row carries none. */
-function preflightBlockerText(blockers: unknown): string {
-  if (!Array.isArray(blockers)) return '';
-  return blockers.flatMap((blocker) => {
-    if (!blocker || typeof blocker !== 'object' || Array.isArray(blocker)) return [];
-    const { name, detail } = blocker as Record<string, unknown>;
-    const parts = [name, detail].filter((part): part is string => typeof part === 'string' && part.trim().length > 0).map((part) => part.trim().replace(/\s+/gu, ' '));
-    return parts.length ? [parts.join(' — ')] : [];
-  }).join(' · ');
+function ledgerString(value: unknown): string {
+  return typeof value === 'string' && value.trim().length > 0 ? value : '';
+}
+
+type PreflightCheck = { reasonCode: string; checkName: string; targetPath?: string };
+
+/** Keep each structured check paired with its own path; legacy blockers retain their name/detail diagnostic. */
+function preflightBlockerText(blockers: unknown): { error: string; preflightChecks: PreflightCheck[] } {
+  if (!Array.isArray(blockers)) return { error: '', preflightChecks: [] };
+  const errors: string[] = [];
+  const preflightChecks: PreflightCheck[] = [];
+  for (const blocker of blockers) {
+    if (!blocker || typeof blocker !== 'object' || Array.isArray(blocker)) continue;
+    const record = blocker as Record<string, unknown>;
+    const reasonCode = ledgerString(record.reasonCode);
+    const checkName = ledgerString(record.checkName);
+    if (reasonCode && checkName) {
+      const targetPath = ledgerString(record.targetPath);
+      preflightChecks.push({ reasonCode, checkName, ...(targetPath ? { targetPath } : {}) });
+      errors.push(`${reasonCode} · ${checkName}`);
+      continue;
+    }
+    const parts = [record.name, record.detail]
+      .filter((part): part is string => typeof part === 'string' && part.trim().length > 0)
+      .map((part) => part.trim().replace(/\s+/gu, ' '));
+    if (parts.length) errors.push(parts.join(' — '));
+  }
+  return { error: errors.join(' · '), preflightChecks };
 }
 
 /** A child terminal row: the legacy flat form {stage, ok, error?} (no kind, or a child kind) or the nested dev result. Any other kind is not a result. */
-export function podTerminalRow(row: Record<string, unknown>): { stage: string; ok: boolean; error?: string } | null {
+export function podTerminalRow(row: Record<string, unknown>): {
+  stage: string;
+  ok: boolean;
+  error?: string;
+  reasonCode?: string;
+  checkName?: string;
+  targetPath?: string;
+  preflightChecks?: PreflightCheck[];
+} | null {
   if (typeof row.kind === 'string' && !CHILD_RESULT_KINDS.has(row.kind)) return null;
   if (typeof row.stage === 'string' && typeof row.ok === 'boolean') {
-    if (typeof row.error === 'string') return { stage: row.stage, ok: row.ok, error: row.error };
-    // PREFLIGHT-RESULT-LINE: `{kind:'self', ok:false, stage:'preflight-blocked', blockers}` carries its reason in the blockers, not in `error`.
-    const blockers = row.ok === false && row.stage === 'preflight-blocked' ? preflightBlockerText(row.blockers) : '';
-    return { stage: row.stage, ok: row.ok, ...(blockers ? { error: blockers } : {}) };
+    // PREFLIGHT-RESULT-LINE: preserve structured blockers even when an explicit error supplies the human-readable reason.
+    if (row.ok === false && row.stage === 'preflight-blocked') {
+      const blockers = preflightBlockerText(row.blockers);
+      return {
+        stage: row.stage,
+        ok: row.ok,
+        ...(typeof row.error === 'string' ? { error: row.error } : blockers.error ? { error: blockers.error } : {}),
+        ...(blockers.preflightChecks.length === 1 ? blockers.preflightChecks[0] : {}),
+        ...(blockers.preflightChecks.length > 1 ? { preflightChecks: blockers.preflightChecks } : {}),
+      };
+    }
+    return { stage: row.stage, ok: row.ok, ...(typeof row.error === 'string' ? { error: row.error } : {}) };
   }
   return nestedPodResult(row);
 }
@@ -64,9 +116,21 @@ export function classifyPodExit(input: {
   jobReason?: string | null;
   logs: string;
   result?: Record<string, unknown> | null;
-}): { class: PodExitClass; errorCode: string | null; containerReason: string | null; exitCode: number | null; jobReason: string | null; tail: string[] } {
+}): {
+  class: PodExitClass;
+  errorCode: string | null;
+  containerReason: string | null;
+  exitCode: number | null;
+  jobReason: string | null;
+  tail: string[];
+  reasonCode?: string;
+  checkName?: string;
+  targetPath?: string;
+  preflightChecks?: PreflightCheck[];
+  noResultLine?: true;
+} {
   const logLines = input.logs.split(/\r\n|\n|\r/u).map((line) => line.trim()).filter(Boolean);
-  let terminalResult: { stage: string; ok: boolean; error?: string } | null = null;
+  let terminalResult: ReturnType<typeof podTerminalRow> = null;
   for (const line of logLines) {
     if (!line.startsWith('{')) continue;
     let parsed: unknown;
@@ -74,8 +138,8 @@ export function classifyPodExit(input: {
     if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) continue;
     terminalResult = podTerminalRow(parsed as Record<string, unknown>) ?? terminalResult;
   }
-  if (!terminalResult && input.result) terminalResult = podTerminalRow(input.result);
   const hasResultLine = terminalResult !== null;
+  if (!terminalResult && input.result) terminalResult = podTerminalRow(input.result);
   const askReprompt = logLines.some((line) =>
     /^\[ask\](?!\s+\d+\)\s).*(?:implementation[_ -]?target|reprompt|re-prompt|되묻)/iu.test(line));
   // 파싱되는 JSON 줄(진행·결과 행)은 오류 «줄»로 세지 않는다 — tail 과 같은 기준.
@@ -116,6 +180,11 @@ export function classifyPodExit(input: {
     exitCode: input.containerExitCode ?? null,
     jobReason: input.jobReason ?? null,
     tail,
+    ...(terminalResult?.reasonCode ? { reasonCode: terminalResult.reasonCode } : {}),
+    ...(terminalResult?.checkName ? { checkName: terminalResult.checkName } : {}),
+    ...(terminalResult?.targetPath ? { targetPath: terminalResult.targetPath } : {}),
+    ...(terminalResult?.preflightChecks ? { preflightChecks: terminalResult.preflightChecks } : {}),
+    ...(!hasResultLine ? { noResultLine: true as const } : {}),
   };
 }
 

package/src/task-orchestrator/surfaces/pod-host-acp-review.ts

@@ -11,6 +11,7 @@
 //    ⛔ 기본 꺼짐(opt-in): 옵션 → env `ELANOUS_POD_HOST_ACP_REVIEW` → config `llm.podHostAcpReview` 순.
 //    📌 남은 조각(②-b): 이 문이 켜진 런에서 Pod 안 api 리뷰를 «끄는» 것은 Pod 이미지 쪽 변경이라 따로 간다.
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../../util/spawn-sync-output.js';
 import { debug } from '../../debug/log.js';
 import type { ReviewResult } from '../../agent-substrate/pr-reviewer.js';
 import type { SubscriptionReviewerSpec } from '../../user-config.js';
@@ -57,7 +58,7 @@ export interface PodHostAcpReviewDeps {
 }
 
 function defaultReadPr(prNumber: number, repoRoot: string): { headRefOid: string; title: string; body: string; diff: string } | undefined {
-  const view = spawnSync('gh', ['pr', 'view', String(prNumber), '--json', 'headRefOid,title,body'], { cwd: repoRoot, encoding: 'utf8', timeout: 60_000 });
+  const view = spawnSync('gh', ['pr', 'view', String(prNumber), '--json', 'headRefOid,title,body'], { cwd: repoRoot, encoding: 'utf8', timeout: 60_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   if (view.status !== 0) return undefined;
   const diff = spawnSync('gh', ['pr', 'diff', String(prNumber)], { cwd: repoRoot, encoding: 'utf8', timeout: 120_000, maxBuffer: 64 * 1024 * 1024 });
   if (diff.status !== 0) return undefined;

package/src/task-orchestrator/surfaces/pod-image-source.ts

@@ -14,6 +14,7 @@
  *   이미지는 표준판(elanous-harness)만 — 이 발사 경로는 lite 를 쓰지 않는다.
  */
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../../util/spawn-sync-output.js';
 import { debug } from '../../debug/log.js';
 import { memberHasRegistry, registryImageRef, type RemoteRun } from './pod-pool.js';
 
@@ -71,7 +72,7 @@ export function memberPinRegistry(member: PodImageMember, source: Extract<PodIma
 
 /** 실제 조회 — 원격은 pod-pool 의 SSH 판정, 로컬은 이 기계의 docker/curl 로 조회한다. */
 export function podPoolImageLookup(run?: RemoteRun, localRun: (cmd: string, args: readonly string[]) => { status: number | null; stdout: string } = (cmd, args) => {
-  const r = spawnSync(cmd, [...args], { encoding: 'utf8', timeout: 10_000 });
+  const r = spawnSync(cmd, [...args], { encoding: 'utf8', timeout: 10_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   return { status: r.status, stdout: r.stdout ?? '' };
 }): {
   hasRegistry: (member: PodImageMember & { context: string }, registry: string) => boolean;

package/src/task-orchestrator/surfaces/pod-install-slots.ts

@@ -1,3 +1,5 @@
+import { spawn } from 'node:child_process';
+
 // GATE-INSTALL-CACHE (0.2.20) — a node-wide throttle for the release-gate shards' `bun install`.
 //
 // Cause, measured on the 0.2.19 gate (`elanous logs --category release-loop.gate --event pod-shard --all --include-test`):
@@ -21,8 +23,8 @@ export const POD_INSTALL_SLOTS_HOST_PATH = '/var/lib/elanous/gate-install-slots'
 export const POD_INSTALL_SLOTS_DEFAULT = 4;
 export const POD_INSTALL_SLOTS_MOUNT = '/gate-install-slots';
 
-/** hostPath volume ⊕ mount for the tokens. `DirectoryOrCreate` makes a root-owned 0755 directory, so the Pod also needs
- *  {@link podHostDirsScript} (the child runs as uid 1000). */
+/** hostPath volume ⊕ mount for the tokens. `DirectoryOrCreate` makes a root-owned 0755 directory, so the node also needs
+ *  {@link prepareHostDirsOnce} (the child runs as uid 1000). */
 export function podInstallSlotsVolume(hostPath: string = POD_INSTALL_SLOTS_HOST_PATH) {
   return {
     volume: { name: 'install-slots', hostPath: { path: hostPath, type: 'DirectoryOrCreate' } },
@@ -30,17 +32,125 @@ export function podInstallSlotsVolume(hostPath: string = POD_INSTALL_SLOTS_HOST_
   };
 }
 
-/**
- * The root shell that hands the mounted hostPath directories to the child's uid. Without it a `DirectoryOrCreate`
- * hostPath stays root:root 0755 and the child's `[ -w … ]` guard silently skips it (the Bun cache option was a no-op).
- * Never fails the Pod: an unchanged directory only means the child falls back (no cache · no throttle).
- * GATE-WARM-BOOT — it runs inside the Pod's single init container (after the isolation probe), not as a second one.
- */
+// GATE-WARM-BOOT-NO-INIT (10-15) — the root hand-over of the hostPath directories left the Pod. It was an init container
+// (`host-dirs`, then folded into `isolation-gate` by GATE-WARM-BOOT), and every init container cost a container
+// transition on a loaded k3d node (#27805 on node-b: init 2 → 354 s · init 1 → 41 s · none → 1 s to the child start).
+// The directories live on the node and outlive every Pod, so the hand-over is a node fact: done once per node from the
+// pool host (`docker exec` into each k3d node container · idempotent `mkdir -p`/`chown`/`chmod`), and the child shell only
+// reports a directory it still cannot write. Never fails the Pod: an unwritable directory means the child falls back
+// (no cache · no throttle), exactly as before when the hand-over failed.
+
+const SAFE_HOST_PATH = /^\/[A-Za-z0-9._/-]+$/;
+const SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+export const HOST_DIRS_PREP_LIMIT_MS = 30_000;
+
+/** Child-shell line: report (never fail on) a mounted host directory the uid-1000 child cannot write. */
+/** Root hand-over inside the Pod — only for runs whose hostPath dirs could not be prepared on the node (no pool member ·
+ * prep failed · prep disabled). Same lines the old `isolation-gate` init ran; it never fails the Pod. */
 export function podHostDirsScript(mounts: ReadonlyArray<{ mountPath: string }>): string {
   const paths = mounts.map((mount) => `'${mount.mountPath.replace(/'/g, `'\\''`)}'`).join(' ');
   return `for d in ${paths}; do mkdir -p "$d" && chown 1000:1000 "$d" && chmod 0775 "$d" || echo "[host-dirs] could not prepare $d"; done; exit 0`;
 }
 
+export function podHostDirsCheckScript(mounts: ReadonlyArray<{ mountPath: string }>): string {
+  const paths = mounts.map((mount) => `'${mount.mountPath.replace(/'/g, `'\\''`)}'`).join(' ');
+  return `for d in ${paths}; do [ -d "$d" ] && [ -w "$d" ] || echo "[host-dirs] could not prepare $d (not writable by uid $(id -u) · node not prepared)"; done`;
+}
+
+/** Host-side shell (on the pool host): hand the node directories to uid 1000 in every k3d node container of `cluster`. */
+export function podHostDirsNodeScript(o: { cluster: string; hostPaths: readonly string[] }): string {
+  if (!SAFE_NAME.test(o.cluster)) throw new Error(`invalid k3d cluster: ${o.cluster}`);
+  for (const path of o.hostPaths) if (!SAFE_HOST_PATH.test(path) || path.split('/').includes('..')) throw new Error(`invalid host dir: ${path}`);
+  const inner = `for d in ${o.hostPaths.join(' ')}; do mkdir -p "$d" && chown 1000:1000 "$d" && chmod 0775 "$d" || { echo "[host-dirs] could not prepare $d"; exit 1; }; done`;
+  return [
+    `nodes=$(docker ps --filter label=k3d.cluster=${o.cluster} --format '{{.Names}} {{.Label "k3d.role"}}' | awk '$2=="server"||$2=="agent"{print $1}')`,
+    `[ -n "$nodes" ] || { echo "[host-dirs] no k3d node for ${o.cluster}"; exit 2; }`,
+    'rc=0',
+    `for n in $nodes; do docker exec "$n" sh -c '${inner}' || rc=1; done`,
+    'exit $rc',
+  ].join('\n');
+}
+
+/** The member's current k3d server/agent container IDs, sorted — the node «generation» the hand-over memo is keyed by. */
+export function podHostDirsNodeIdsScript(cluster: string): string {
+  if (!SAFE_NAME.test(cluster)) throw new Error(`invalid k3d cluster: ${cluster}`);
+  return `docker ps --no-trunc --filter label=k3d.cluster=${cluster} --format '{{.ID}} {{.Label "k3d.role"}}' | awk '$2=="server"||$2=="agent"{print $1}' | sort | tr '\\n' ' '`;
+}
+
+export interface HostDirsPrepResult { host: string; ok: boolean; ms: number; detail?: string }
+
+type HostShell = (host: string | undefined, script: string, limitMs: number) => Promise<{ rc: number; output: string }>;
+
+/**
+ * Bounded shell on the pool host (`ssh <host>`) or this machine (no host); never throws. At `limitMs` the whole process
+ * group is killed and the call returns rc 124 at once — a stuck `docker exec` grandchild holding the pipe must not keep
+ * the caller (and the Job launch behind it) waiting for `close`.
+ */
+export function hostShellWithin(host: string | undefined, script: string, limitMs: number): Promise<{ rc: number; output: string }> {
+  const env = 'export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; ';
+  const [cmd, args] = host
+    ? ['ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', host, env + script]] as const
+    : ['bash', ['-c', env + script]] as const;
+  return new Promise((resolve) => {
+    let output = '';
+    let settled = false;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const finish = (rc: number, text: string) => { if (!settled) { settled = true; clearTimeout(timer); resolve({ rc, output: text }); } };
+    let child: ReturnType<typeof spawn>;
+    try { child = spawn(cmd, [...args], { stdio: ['ignore', 'pipe', 'pipe'], detached: true }); }
+    catch (error) { resolve({ rc: 2, output: String(error) }); return; }
+    timer = setTimeout(() => {
+      try { if (child.pid) process.kill(-child.pid, 'SIGKILL'); else child.kill('SIGKILL'); } catch { child.kill('SIGKILL'); }
+      child.stdout?.destroy();
+      child.stderr?.destroy();
+      finish(124, `${output}\n[host-dirs] timed out after ${limitMs} ms`);
+    }, limitMs);
+    child.stdout?.on('data', (chunk) => { output += String(chunk); });
+    child.stderr?.on('data', (chunk) => { output += String(chunk); });
+    child.on('error', (error) => finish(2, `${output}\n${String(error)}`));
+    child.on('close', (code) => finish(code ?? 2, output));
+  });
+}
+
+const prepared = new Map<string, Promise<HostDirsPrepResult>>();
+
+/**
+ * Hand `hostPaths` to uid 1000 on the member's k3d nodes once per (host, cluster, node generation, path) in this process — every shard Job
+ * on the same member awaits the same run, and a path already handed over (or in flight) is not run again even when it
+ * comes with a different companion path. A failure is not memoized (the next Job tries again) and never throws.
+ */
+export async function prepareHostDirsOnce(o: { member: { sshHost?: string; k3dCluster: string }; hostPaths: readonly string[]; shell?: HostShell; limitMs?: number }): Promise<HostDirsPrepResult> {
+  const host = o.member.sshHost;
+  const label = host ?? 'local';
+  const start = Date.now();
+  const shell = o.shell ?? hostShellWithin;
+  // Node generation (review mf): a recreated cluster or a new agent has other container IDs, so a hand-over remembered for
+  // the old node set is not reused. Unreadable IDs → no memo at all (every path runs, success is not remembered).
+  const ids = await shell(host, podHostDirsNodeIdsScript(o.member.k3dCluster), o.limitMs ?? HOST_DIRS_PREP_LIMIT_MS)
+    .catch(() => ({ rc: 2, output: '' }));
+  const generation = ids.rc === 0 && ids.output.trim() ? ids.output.trim() : null;
+  const gen = generation ?? `unknown-${start}-${Math.random()}`;
+  const keyOf = (path: string) => `${label}\0${o.member.k3dCluster}\0${gen}\0${path}`;
+  const paths = [...new Set(o.hostPaths)].sort();
+  const fresh = paths.filter((path) => !prepared.has(keyOf(path)));
+  if (fresh.length) {
+    const run = (async (): Promise<HostDirsPrepResult> => {
+      const script = podHostDirsNodeScript({ cluster: o.member.k3dCluster, hostPaths: fresh });
+      const r = await shell(host, script, o.limitMs ?? HOST_DIRS_PREP_LIMIT_MS);
+      const ms = Date.now() - start;
+      return r.rc === 0 ? { host: label, ok: true, ms } : { host: label, ok: false, ms, detail: r.output.trim().slice(-300) || `rc=${r.rc}` };
+    })().catch((error: unknown) => ({ host: label, ok: false, ms: Date.now() - start, detail: String(error).slice(0, 300) }))
+      .then((result) => { if (!result.ok || generation === null) for (const path of fresh) prepared.delete(keyOf(path)); return result; });
+    for (const path of fresh) prepared.set(keyOf(path), run);
+  }
+  const results = await Promise.all(paths.map((path) => prepared.get(keyOf(path))!));
+  const failed = results.find((result) => !result.ok);
+  return failed ?? { host: label, ok: true, ms: Date.now() - start };
+}
+
+/** Test seam — forget the per-process hand-over memo. */
+export function resetHostDirsPrepMemo(): void { prepared.clear(); }
+
 const int = (value: number, label: string) => {
   if (!Number.isSafeInteger(value) || value < 1) throw new Error(`invalid ${label}: ${value}`);
   return value;
@@ -66,7 +176,9 @@ export function installSlotScript(o: { dir?: string; slots: number; waitSeconds?
     '  if [ ! -d "$d" ] || [ ! -w "$d" ]; then echo "[gate] install-slot none (directory not writable)"; return 0; fi',
     '  while :; do',
     `    for n in $(seq 0 ${slots - 1}); do`,
-    '      if mkdir "$d/slot-$n" 2>/dev/null; then',
+    // The token is taken by bash's own noclobber create (O_EXCL), not by `mkdir`: uutils coreutils `mkdir` (0.8 · wsl gate host)
+    // let two racing callers both succeed on one path (10-16 · 3 holders on 2 slots). A directory token left by an older shell still counts as held.
+    '      if (set -C; : > "$d/slot-$n") 2>/dev/null; then',
     '        install_slot="$d/slot-$n"',
     '        echo "[gate] install-slot $n waited $(( $(date +%s) - t0 ))s"; return 0',
     '      fi',