elanous 0.2.29 → 0.2.32

package/src/task-orchestrator/surfaces/pod-command-job.ts

@@ -16,7 +16,7 @@ import { collectPodArtifacts } from './pod-artifact-return.js';
 import { getDefaultLogStore, type LogStore } from '../../mss/logging/log-store.js';
 import { podBunCacheVolume } from './pod-bun-cache.js';
 import { POD_JOB_TTL_AFTER_FINISHED_SECONDS } from './pod-lease.js';
-import { podHostDirsScript, podInstallSlotsVolume } from './pod-install-slots.js';
+import { podHostDirsCheckScript, podInstallSlotsVolume, prepareHostDirsOnce, type HostDirsPrepResult, podHostDirsScript } from './pod-install-slots.js';
 import { type PodPoolMember, PodPoolScheduler, resolvePodPoolSpec, parsePodPool, checkPodPool, syncPoolImages, type PoolKubectl } from './pod-pool.js';
 import { podSkillsDigest, readSkillEnvFiles, resolvePodSkills } from './pod-skills.js';
 import { podSourceScript, type PodSource } from './pod-source-receive.js';
@@ -34,17 +34,26 @@ import {
 
 /** CLI `--deadline` 생략 시 — 기존 Pod Job 수명 상한과 같다. */
 export const POD_COMMAND_DEADLINE_SECONDS = POD_JOB_DEADLINE_SECONDS;
+/** An opt-in shadow cannot let a synchronous kubectl call hide its host deadline for two minutes. */
+export const POD_COMMAND_CANCEL_KUBECTL_TIMEOUT_MS = 15_000;
 
 export const POD_NETWORK_SKILLS = ['omni-crawl', 'omni-digest'] as const;
 export const POD_LITE_IMAGE = 'elanous-harness-lite:local';
 
 export const POD_LITE_MEMORY_LIMIT = '2Gi';
 
+/** W5 (10-15 #27801): where a memory-backed TMPDIR is mounted for release gate shards — the overlayfs `/tmp` made SQLite
+ *  tests take 0.4~5s per turn (once 124s). tmpfs pages count against the container memory limit, so the caller's cap
+ *  (`tmpfsSizeLimit`) stays small next to the 16Gi shard limit (request 6Gi). */
+export const POD_TMPFS_MOUNT_PATH = '/tmp-mem';
+
 /** 요청은 한도를 넘을 수 없다(쿠버네티스가 Job 을 거부한다) — lite 2Gi 처럼 한도가 기본 요청보다 작으면 한도로 맞춘다. */
 /** The command Job container's CPU limit when the caller names none (GATE-SPEED A3①: unchanged default). */
 export const POD_COMMAND_CPU_LIMIT_DEFAULT = '4';
 /** 게이트 조각·pod-command 의 CPU 요청 기본 — 하니스 Pod(POD_CHILD_REQUESTS.cpu)와 따로 둔다(조각은 bun test 로 CPU 를 실제로 쓴다). */
 export const POD_COMMAND_CPU_REQUEST_DEFAULT = '1';
+/** Gate and command Pods retain their measured 6Gi scheduler request; si-task admission uses its own size. */
+export const POD_COMMAND_MEMORY_REQUEST_DEFAULT = '6Gi';
 
 /** Container CPU request/limit override. Omitted fields keep the defaults (request `POD_COMMAND_CPU_REQUEST_DEFAULT` · limit 4). */
 export interface PodCpu { request?: string; limit?: string }
@@ -93,9 +102,9 @@ export function parsePodCpu(value: unknown, label = 'cpu'): PodCpu | undefined {
 
 export function memoryRequestWithin(limit: string | undefined): string {
   const gi = (value: string | undefined) => { const m = /^(\d+)Gi$/.exec(value ?? ''); return m ? Number(m[1]) : null; };
-  const request = gi(POD_CHILD_REQUESTS.memory);
+  const request = gi(POD_COMMAND_MEMORY_REQUEST_DEFAULT);
   const max = gi(limit);
-  return request !== null && max !== null && request > max ? limit! : POD_CHILD_REQUESTS.memory;
+  return request !== null && max !== null && request > max ? limit! : POD_COMMAND_MEMORY_REQUEST_DEFAULT;
 }
 
 /** POD7 must-fix: the skill list alone can't tell a network-only job from one that needs ffmpeg/browser — so lite is
@@ -133,18 +142,24 @@ export function tailBytes(text: string, maxBytes: number): string {
   return `…[앞 ${bytes.length - maxBytes}바이트 생략]\n${cut.subarray(start).toString('utf8')}`;
 }
 
-/** The isolation probe: wait until the NetworkPolicy blocks the host/prod daemons, then run `onPass` (default `exit 0`). */
-function isolationGateScript(onPass = 'exit 0'): string {
-  return `ok=0
-for i in $(seq 1 60); do
-  if curl -s -m 1 -o /dev/null http://host.orb.internal:31415/health || curl -s -m 1 -o /dev/null http://core.elanous-prod:8080/; then ok=0; else ok=$((ok+1)); fi
-  [ "$ok" -ge 3 ] && { echo "[gate] isolation enforced after \${i} probes"; ${onPass}; }
-  sleep 0.5
-done
-echo "[gate] ISOLATION NOT ENFORCED within 30s"; exit 1`;
+/**
+ * The isolation probe: wait until the NetworkPolicy blocks the host/prod daemons, then go on with the child shell.
+ * GATE-WARM-BOOT-NO-INIT (10-15) — this used to be the `isolation-gate` init container; it is now the child shell's first
+ * lines, before any credential is read. Same probes, same log lines, same exit 1 when isolation is not enforced in 30 s.
+ * Measured on node-b k3d (#27805): init 2 → 354 s · init 1 → 41 s · none → 1 s from Pod creation to the child start.
+ */
+export function isolationGateLines(): string {
+  return `elanous_isolation_gate() {
+  local ok=0 i
+  for i in $(seq 1 60); do
+    if curl -s -m 1 -o /dev/null http://host.orb.internal:31415/health || curl -s -m 1 -o /dev/null http://core.elanous-prod:8080/; then ok=0; else ok=$((ok+1)); fi
+    [ "$ok" -ge 3 ] && { echo "[gate] isolation enforced after \${i} probes"; return 0; }
+    sleep 0.5
+  done
+  echo "[gate] ISOLATION NOT ENFORCED within 30s"; exit 1
+}
+elanous_isolation_gate || exit 1`;
 }
-
-const GATE = isolationGateScript();
 
 /** Export the command's log store into the existing outbox return channel without changing the command exit status. */
 const COMMAND_LOG_EXPORT = `if mkdir -p "$HOME/outbox/pod-logs" && elanous --test="$HOME/.elanous-test" logs --instance prod --since 12h --limit 20000 --json --json-data > "$HOME/outbox/pod-logs/logs.jsonl"; then
@@ -182,7 +197,7 @@ if [ -d "$HOME/outbox" ]; then
     else
       printf 'ELANOUS_POD_ARTIFACT_SKIPPED %s %s\\n' "$relative" "$size"
     fi
-  done < <(find "$HOME/outbox" -type f -print0)
+  done < <(find "$HOME/outbox" -type f -print0 | while IFS= read -r -d '' f; do printf '%s\\t%s\\0' "$(( $(wc -c < "$f") ))" "$f"; done | LC_ALL=C sort -z -t $'\\t' -k1,1n -k2 | while IFS= read -r -d '' row; do printf '%s\\0' "\${row#*$'\\t'}"; done)
 fi`;
 
 export interface PodCommandJobInput {
@@ -208,9 +223,13 @@ export interface PodCommandJobInput {
   memoryLimit?: string;
   /** GATE-SPEED A3①: CPU request/limit override (release gate shards only). Omitted = request 1 / limit 4. */
   cpu?: PodCpu;
+  /** W5 — emptyDir{medium: Memory} sizeLimit mounted at {@link POD_TMPFS_MOUNT_PATH} ⊕ `TMPDIR` (release gate shards only). Omitted = image `/tmp`. */
+  tmpfsSizeLimit?: string;
   source?: PodSource;
   deadlineSeconds: number;
   runId?: string;
+  /** GATE-WARM-BOOT-NO-INIT fallback: the node-side hand-over did not run, so a root init container hands the hostPath dirs to uid 1000. */
+  hostDirsInit?: boolean;
 }
 
 function bashSingleQuote(value: string): string {
@@ -226,8 +245,11 @@ export function podCommandJobManifest(o: PodCommandJobInput): Record<string, unk
   const grok = o.llm === 'grok';
   const bunCache = o.bunCache ? podBunCacheVolume(o.bunCache) : undefined;
   const installSlots = o.installSlots ? podInstallSlotsVolume(o.installSlots) : undefined;
-  // hostPath directories the uid-1000 child writes: a root init container hands them over (DirectoryOrCreate is root 0755).
+  // hostPath directories the uid-1000 child writes. DirectoryOrCreate makes them root 0755, so runPodCommand hands them to
+  // uid 1000 once per node (prepareHostDirsOnce); the child only reports a directory it still cannot write.
   const hostDirMounts = [...(bunCache ? [bunCache.volumeMount] : []), ...(installSlots ? [installSlots.volumeMount] : [])];
+  const tmpfs = o.tmpfsSizeLimit?.trim() || undefined;
+  const tmpfsMounts = tmpfs ? [{ name: 'tmp-mem', mountPath: POD_TMPFS_MOUNT_PATH }] : [];
   const cpu = resolvePodCpu(o.cpu);
   const quotedArgs = o.command.map(bashSingleQuote).join(' ');
   const credLines = [
@@ -237,12 +259,14 @@ export function podCommandJobManifest(o: PodCommandJobInput): Record<string, unk
       : []),
   ];
   const script = [
+    isolationGateLines(),
     'set -u',
     ...credLines,
     'curl -s -m 3 -o /dev/null http://host.orb.internal:31415/health && { echo "[pod] ISOLATION FAIL"; exit 3; }',
     ...(o.clone
       ? ['export GH_TOKEN="$(cat /creds/gh-token)" && gh auth setup-git', podSourceScript(o.source ?? { kind: 'default' }, o.repoUrl)]
       : ['mkdir -p ~/work && cd ~/work']),
+    ...(hostDirMounts.length ? [podHostDirsCheckScript(hostDirMounts)] : []),
     ...(bunCache ? [bunCache.shellPrefix] : []),
     `set -- ${quotedArgs}`,
     '"$@"',
@@ -270,14 +294,10 @@ export function podCommandJobManifest(o: PodCommandJobInput): Record<string, unk
         spec: {
           restartPolicy: 'Never',
           securityContext: { runAsUser: 1000, fsGroup: 1000 },
-          initContainers: [
-            // GATE-WARM-BOOT (10-15): ONE init container. Each extra container cost minutes on a loaded k3d node (the measured
-            // gap between a finished init script and the next container start), so the root host-dir hand-over runs inside
-            // the isolation init after the probe passes instead of as a second `host-dirs` container.
-            hostDirMounts.length
-              ? { name: 'isolation-gate', image: o.image, imagePullPolicy: o.imagePullPolicy ?? 'Never', securityContext: { runAsUser: 0 }, command: ['bash', '-c'], args: [isolationGateScript(podHostDirsScript(hostDirMounts))], volumeMounts: hostDirMounts.map((mount) => ({ ...mount })) }
-              : { name: 'isolation-gate', image: o.image, imagePullPolicy: o.imagePullPolicy ?? 'Never', command: ['bash', '-c'], args: [GATE] },
-          ],
+          // Normal path: no init container. Fallback only when the node-side hand-over did not run (no member · prep failed).
+          ...(o.hostDirsInit && hostDirMounts.length ? { initContainers: [
+            { name: 'host-dirs', image: o.image, imagePullPolicy: o.imagePullPolicy ?? 'Never', securityContext: { runAsUser: 0 }, command: ['bash', '-c'], args: [podHostDirsScript(hostDirMounts)], volumeMounts: hostDirMounts.map((mount) => ({ ...mount })) },
+          ] } : {}),
           containers: [{
             name: 'child', image: o.image, imagePullPolicy: o.imagePullPolicy ?? 'Never',
             resources: { requests: { ...POD_CHILD_REQUESTS, cpu: cpu.request, memory: memoryRequestWithin(o.memoryLimit) }, limits: { memory: o.memoryLimit ?? '16Gi', cpu: cpu.limit } },
@@ -286,18 +306,21 @@ export function podCommandJobManifest(o: PodCommandJobInput): Record<string, unk
               ...(o.runId ? [{ name: 'ELANOUS_RUN_ID', value: o.runId }] : []),
               { name: 'ELANOUS_SUBSTRATE', value: 'pod' },
               { name: 'ELANOUS_POD_NAME', valueFrom: { fieldRef: { fieldPath: 'metadata.name' } } },
+              ...(tmpfs ? [{ name: 'TMPDIR', value: POD_TMPFS_MOUNT_PATH }] : []),
             ],
-            ...(secretKeys || o.hostMirror || hostDirMounts.length ? { volumeMounts: [
+            ...(secretKeys || o.hostMirror || hostDirMounts.length || tmpfs ? { volumeMounts: [
               ...(secretKeys ? [{ name: 'creds', mountPath: '/creds', readOnly: true }] : []),
               ...(o.hostMirror ? [{ name: 'host-mirror', mountPath: '/host-mirror', readOnly: true }] : []),
               ...hostDirMounts,
+              ...tmpfsMounts,
             ] } : {}),
           }],
-          ...(secretKeys || o.hostMirror || hostDirMounts.length ? { volumes: [
+          ...(secretKeys || o.hostMirror || hostDirMounts.length || tmpfs ? { volumes: [
             ...(secretKeys ? [{ name: 'creds', secret: { secretName: `${o.name}-creds`, defaultMode: 0o400 } }] : []),
             ...(o.hostMirror ? [{ name: 'host-mirror', hostPath: { path: o.hostMirror, type: 'Directory' } }] : []),
             ...(bunCache ? [bunCache.volume] : []),
             ...(installSlots ? [installSlots.volume] : []),
+            ...(tmpfs ? [{ name: 'tmp-mem', emptyDir: { medium: 'Memory', sizeLimit: tmpfs } }] : []),
           ] } : {}),
         },
       },
@@ -374,6 +397,8 @@ export interface RunPodCommandOptions {
   memoryLimit?: string;
   /** GATE-SPEED A3①: CPU request/limit override — only the release gate passes it. Omitted = request 1 / limit 4. */
   cpu?: PodCpu;
+  /** W5 — memory-backed TMPDIR sizeLimit mounted at {@link POD_TMPFS_MOUNT_PATH}; only the release gate passes it. Omitted = image `/tmp`. */
+  tmpfsSizeLimit?: string;
   /** POD7: 호출부가 «네트워크 스킬만 쓰는 명령»이라고 말할 때만 lite 이미지 ⊕ 2Gi. */
   lite?: boolean;
   source?: PodSource;
@@ -391,6 +416,12 @@ export interface RunPodCommandOptions {
    * elsewhere. Omitted = poll without a bound (unchanged for every caller but the release gate).
    */
   statusUnreadableMs?: number;
+  /** Optional caller cancellation. Omitted callers keep their existing polling behavior. */
+  signal?: AbortSignal;
+  /** Optional host wall-clock deadline; checked even when a synchronous kubectl delayed the abort timer. */
+  hostDeadlineAtMs?: number;
+  /** Clock seam for deadline checks. */
+  nowMs?: () => number;
   kubectl?: Kubectl;
   /** A caller-owned scheduler is self-capped: acquires count only its own Jobs, never cluster occupancy (POOLGLOBAL-REG). */
   poolScheduler?: PodPoolScheduler;
@@ -398,6 +429,8 @@ export interface RunPodCommandOptions {
   seedMirror?: (o: { host: string; commit: string; cwd: string }) => Promise<MirrorSeedResult | undefined>;
   /** GATE-WARM-BOOT — the git tree the seed pushes from (default: the process cwd — the gate runs in the repo tree). */
   mirrorSeedCwd?: string;
+  /** GATE-WARM-BOOT-NO-INIT — hands the hostPath dirs to uid 1000 on the member's nodes (test seam · default {@link prepareHostDirsOnce}). */
+  prepareHostDirs?: (o: { member: PodPoolMember; hostPaths: readonly string[] }) => Promise<HostDirsPrepResult | undefined>;
   checkPool?: typeof checkPodPool;
   syncImages?: typeof syncPoolImages;
   imageCommit?: string | null;
@@ -417,6 +450,8 @@ export interface RunPodCommandOptions {
 /** GATE-POD-RESULT-MARKER — the child script's final line (`\n<marker> <token> rc=<n>\n`), printed after the artifact emit. */
 export const POD_RESULT_MARKER = '__ELANOUS_POD_DONE__';
 /** The marker bound to one launch (`token` = the launch's random id · the Job name when the manifest has no launch). */
+/** Full-log re-reads after an early marker return before the artifacts count as lost (GATE-POD-RESULT-MARKER follow-up). */
+export const POD_MARKER_LOG_RETRIES = 2;
 export function podResultMarker(token: string): string { return `${POD_RESULT_MARKER} ${token}`; }
 
 /** Split the child's logs into the command output (marker tail removed, bytes otherwise unchanged) and the marker rc (null = no marker for this token). */
@@ -459,14 +494,35 @@ export function podCommandTargetCommit(o: { remote: boolean; gitHead: () => stri
   return o.localImageCommit();
 }
 
+/** Only opt-in callers can stop waiting on a pre-Job async operation. Late rejections stay observed. */
+function awaitPodCommandAbort<T>(pending: Promise<T>, signal?: AbortSignal): Promise<T> {
+  if (!signal) return pending;
+  return new Promise<T>((resolve, reject) => {
+    const onAbort = () => { signal.removeEventListener('abort', onAbort); reject(signal.reason ?? new Error('pod command aborted')); };
+    signal.addEventListener('abort', onAbort, { once: true });
+    pending.then(
+      (value) => { signal.removeEventListener('abort', onAbort); resolve(value); },
+      (error) => { signal.removeEventListener('abort', onAbort); reject(error); },
+    );
+    if (signal.aborted) onAbort();
+  });
+}
+
 /** 풀 자리 · 이미지 판 · Job 적용 · 완료 대기 · 산출 회수 · Secret 정리. */
 export async function runPodCommand(options: RunPodCommandOptions): Promise<PodCommandResult> {
+  const nowMs = options.nowMs ?? Date.now;
+  const ensureLive = () => {
+    if (options.signal?.aborted) throw options.signal.reason ?? new Error('pod command aborted');
+    if (options.hostDeadlineAtMs !== undefined && nowMs() >= options.hostDeadlineAtMs) throw new Error('pod shadow: host timeout');
+  };
+  ensureLive();
   const command = [...options.command];
   if (command.length === 0) throw new Error('pod command: 명령이 비었다');
   const skills = [...new Set((options.skills ?? []).map((s) => s.trim()).filter(Boolean))];
   const llm = options.llm;
   const log = options.log ?? ((c, e, d) => debug.log(c, e, d));
-  const baseKubectl = options.kubectl ?? defaultKubectl;
+  const baseKubectl = options.kubectl ?? ((args: readonly string[], input?: string) =>
+    defaultKubectl(args, input, options.signal ? POD_COMMAND_CANCEL_KUBECTL_TIMEOUT_MS : undefined));
   const sleep = options.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));
   const namespace = options.namespace ?? 'elanous-test';
   const image = options.image ?? podCommandImageFor(skills, options.clone === true, options.lite === true);
@@ -507,18 +563,32 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
     // concurrency cap — its Jobs count against the spec caps, not the cluster's goal Pods (#24253 → 0.2.15 gate ran 1 shard).
     const selfCapped = options.poolScheduler !== undefined;
     for (;;) {
-      member = await pool.tryAcquire(undefined, undefined, { selfCapped });
+      ensureLive();
+      const acquiring = pool.tryAcquire(undefined, undefined, { selfCapped, signal: options.signal });
+      try { member = await awaitPodCommandAbort(acquiring, options.signal); }
+      catch (error) {
+        // If cancellation won the await at the same instant acquisition completed, return that lease.
+        void acquiring.then((late) => { if (late) pool!.release(late); }, () => {});
+        throw error;
+      }
       if (member) break;
-      await sleep(options.pollMs ?? 15_000);
+      await awaitPodCommandAbort(sleep(options.pollMs ?? 15_000), options.signal);
     }
   }
+  if (options.signal?.aborted) {
+    if (member && pool) pool.release(member);
+    ensureLive();
+  }
   const currentContext = member || options.kubectl ? null : baseKubectl(['config', 'current-context']);
   const context = member?.context ?? (currentContext?.status === 0 ? currentContext.stdout.trim() : '');
-  const kubectl: Kubectl = (args, stdin) => baseKubectl(context ? ['--context', context, ...args] : [...args], stdin);
-  const cleanupSecret = () => { kubectl(['-n', namespace, 'delete', 'secret', '-l', own, '--ignore-not-found']); };
+  const kubectlRaw: Kubectl = (args, stdin) => baseKubectl(context ? ['--context', context, ...args] : [...args], stdin);
+  const kubectl: Kubectl = (args, stdin) => { ensureLive(); const result = kubectlRaw(args, stdin); ensureLive(); return result; };
+  const cleanupSecret = () => { kubectlRaw(['-n', namespace, 'delete', 'secret', '-l', own, '--ignore-not-found']); };
   const artifactRoot = options.artifactsRoot ?? `${effectiveInstanceRoot()}/pod-artifacts`;
   const artifactsDir = `${artifactRoot}/${name}`;
+  let jobApplied = false;
   try {
+    ensureLive();
     if (!context && !options.kubectl) throw new Error('pod command: kubectl context 를 확인할 수 없다');
     let grokAuth: string | undefined;
     if (llm === 'grok') {
@@ -546,7 +616,7 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
       const localSkillsDigest = options.kubectl ? null : image === POD_LITE_IMAGE
         ? podSkillsDigest(POD_NETWORK_SKILLS, resolve(import.meta.dir, '../../../skills')).digest
         : podSkillsDigest(resolvePodSkills(env).skills).digest;
-      const syncs = await (options.syncImages ?? syncPoolImages)([member], image, imageCommit, { localSkillsDigest });
+      const syncs = await awaitPodCommandAbort((options.syncImages ?? syncPoolImages)([member], image, imageCommit, { localSkillsDigest }), options.signal);
       const synced = syncs.get(member.context);
       if (synced && !synced.ok) throw new Error(`pod command: 이미지 판을 못 맞췄다: ${synced.detail}`);
       if (synced?.imageRef) member = { ...member, imageRef: synced.imageRef };
@@ -559,10 +629,29 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
     const seedMirror = options.seedMirror ?? (options.kubectl ? undefined : seedMirrorOnce);
     if (seedMirror && options.clone && options.source?.kind === 'commit' && hostMirror && member?.sshHost) {
       // Worst case added to a cold start: the push limit (GATE_MIRROR_SEED_LIMIT_MS), once per host·commit.
-      const seed = await seedMirror({ host: member.sshHost, commit: options.source.sha, cwd: options.mirrorSeedCwd ?? process.cwd() })
-        .catch((error: unknown) => ({ host: member!.sshHost!, ok: false, ms: 0, detail: String(error).slice(0, 300) }));
+      const seed = await awaitPodCommandAbort(seedMirror({ host: member.sshHost, commit: options.source.sha, cwd: options.mirrorSeedCwd ?? process.cwd() })
+        .catch((error: unknown) => ({ host: member!.sshHost!, ok: false, ms: 0, detail: String(error).slice(0, 300) })), options.signal);
       log('pod.command-job', 'mirror-seed', { host: member.sshHost, commit: options.source.sha, ok: seed?.ok ?? false, ms: seed?.ms ?? 0, ...(seed?.detail ? { detail: seed.detail } : {}) });
     }
+    // GATE-WARM-BOOT-NO-INIT (10-15): the hostPath dirs the uid-1000 child writes are handed over on the node itself, once per
+    // member·paths in this process (no init container). Best effort: a failure only logs; the child then falls back.
+    const hostDirPaths = [...(bunCache ? [bunCache] : []), ...(installSlots ? [installSlots] : [])];
+    const prepareHostDirs = options.prepareHostDirs ?? (options.kubectl ? undefined : prepareHostDirsOnce);
+    let hostDirsPrepared = false;
+    if (hostDirPaths.length) {
+      // Observed whether or not a hand-over runs: no member (nothing to reach) and an injected kubectl without a seam are skips.
+      if (!member) log('pod.command-job', 'host-dirs-prep', { ok: false, reason: 'no-pool-member', paths: hostDirPaths });
+      else if (!prepareHostDirs) log('pod.command-job', 'host-dirs-prep', { ok: false, reason: 'prep-disabled', paths: hostDirPaths });
+      else {
+        const prep = await awaitPodCommandAbort(prepareHostDirs({ member, hostPaths: hostDirPaths })
+          .catch((error: unknown) => ({ host: member!.sshHost ?? 'local', ok: false, ms: 0, detail: String(error).slice(0, 300) })), options.signal);
+        hostDirsPrepared = prep?.ok === true;
+        log('pod.command-job', 'host-dirs-prep', { host: prep?.host ?? member.sshHost ?? 'local', ok: prep?.ok ?? false, ms: prep?.ms ?? 0, paths: hostDirPaths, ...(prep?.detail ? { detail: prep.detail } : {}) });
+      }
+    }
+    // Any path where the node-side hand-over did not succeed keeps the old in-Pod hand-over (review mf: uid 1000 could not write).
+    const hostDirsInit = hostDirPaths.length > 0 && !hostDirsPrepared;
+    ensureLive();
     const ghToken = options.clone ? (options.ghToken ?? defaultGhToken)() : undefined;
     const secret = commandJobSecret({ name, namespace, launch, skills, skillEnvText, ...(grokAuth !== undefined ? { grokAuth } : {}), ...(ghToken !== undefined ? { ghToken } : {}) });
     if (secret) {
@@ -573,10 +662,13 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
       name, namespace, launch, image: imageRef ?? image,
       ...(imageRef ? { imagePullPolicy: 'IfNotPresent' as const } : {}),
       repoUrl, command, skills, ...(options.returnLogs ? { returnLogs: true } : {}), ...(llm ? { llm } : {}), ...(options.clone ? { clone: true } : {}),
-      ...(options.source ? { source: options.source } : {}), ...(hostMirror ? { hostMirror } : {}), ...(bunCache ? { bunCache } : {}), ...(installSlots ? { installSlots } : {}), ...(memoryLimit ? { memoryLimit } : {}), ...(options.cpu ? { cpu: options.cpu } : {}), deadlineSeconds,
+      ...(options.source ? { source: options.source } : {}), ...(hostMirror ? { hostMirror } : {}), ...(bunCache ? { bunCache } : {}), ...(installSlots ? { installSlots } : {}), ...(memoryLimit ? { memoryLimit } : {}), ...(options.cpu ? { cpu: options.cpu } : {}), ...(options.tmpfsSizeLimit ? { tmpfsSizeLimit: options.tmpfsSizeLimit } : {}), deadlineSeconds,
       ...(options.runId ? { runId: options.runId } : {}),
+      ...(hostDirsInit ? { hostDirsInit: true } : {}),
     });
     kubectl(['-n', namespace, 'delete', 'job', '-l', own, '--ignore-not-found']);
+    // A wall deadline can elapse inside the synchronous apply; cleanup by this launch's name then remains safe.
+    jobApplied = true;
     const applied = kubectl(['apply', '-f', '-'], JSON.stringify(manifest));
     if (applied.status !== 0) {
       cleanupSecret();
@@ -587,6 +679,7 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
     let markerRc: number | null = null;
     const appliedAt = Date.now();
     for (;;) {
+      ensureLive();
       const got = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.status.conditions[*].type}']);
       const finished = jobFinished(got.stdout);
       if (finished) { state = finished; break; }
@@ -609,9 +702,24 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
           throw new Error(`pod command: Job 상태를 ${Math.round(options.statusUnreadableMs / 1000)}초 동안 못 읽었다(${context}) — ${(got.stderr ?? '').trim().split('\n').pop()?.slice(0, 200) ?? ''}`);
         }
       } else unreadableSince = null;
-      await sleep(options.pollMs ?? 15_000);
+      await awaitPodCommandAbort(sleep(options.pollMs ?? 15_000), options.signal);
+    }
+    ensureLive();
+    let logsResult = kubectl(['-n', namespace, 'logs', `job/${name}`, '-c', 'child']);
+    // Marker path returns before the Job condition — a full-log read can hit the same transient window the tail read
+    // already survived (container log rotation · API hiccup). Retry it a little before calling the artifacts lost.
+    // A read that «succeeds» but stops before this launch's marker (empty · cut off) is incomplete too (review mf · #27842).
+    const fullLogIncomplete = (r: { status: number | null; stdout: string }) =>
+      r.status !== 0 || splitPodResultMarker(r.stdout.startsWith('\n') ? r.stdout : `\n${r.stdout}`, launch).rc === null;
+    for (let attempt = 1; markerRc !== null && fullLogIncomplete(logsResult) && attempt <= POD_MARKER_LOG_RETRIES; attempt++) {
+      log('pod.command-job', 'result-marker-log-retry', { job: name, attempt, ...(logsResult.status !== 0 ? { error: (logsResult.stderr ?? '').trim().slice(0, 200) } : { reason: 'marker-missing-in-full-log' }) });
+      await sleep(options.pollMs === undefined ? 1_000 : Math.min(options.pollMs, 1_000));   // ≤2 re-reads within ≈2s total
+      logsResult = kubectl(['-n', namespace, 'logs', `job/${name}`, '-c', 'child']);
+    }
+    // Still without this launch's marker after the retries: the artifacts are not trusted as complete (explicit failure).
+    if (markerRc !== null && logsResult.status === 0 && fullLogIncomplete(logsResult)) {
+      logsResult = { ...logsResult, status: 1, stderr: 'full log ended before this launch\'s result marker (incomplete after retries)' };
     }
-    const logsResult = kubectl(['-n', namespace, 'logs', `job/${name}`, '-c', 'child']);
     const logsFailed = logsResult.status !== 0;
     const logs = logsFailed ? '' : splitPodResultMarker(logsResult.stdout, launch).logs;
     const artifactDir = artifactRoot;
@@ -661,6 +769,12 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
     });
     return { exitCode, artifactsDir, job: name, image: imageRef ?? image, artifacts };
   } catch (err) {
+    if (jobApplied && options.signal) {
+      // Opt-in bounded callers remove their own failed/Pending Job, including status-unreadable exits.
+      // On an unreachable API this is best effort; the local lease is always released in finally.
+      try { kubectlRaw(['-n', namespace, 'delete', 'job', name, '--ignore-not-found', '--wait=false']); }
+      catch { /* preserve the cancellation reason */ }
+    }
     cleanupSecret();
     throw err;
   } finally {

package/src/task-orchestrator/surfaces/pod-failure-reason.ts

@@ -6,7 +6,15 @@ export const STOP_CLASS_NO_LAUNCH = 'no-launch' as const;
 const CHILD_RESULT_KINDS = new Set(['self', 'external']);
 
 /** The dev child's terminal line nests the stage: {ok, kind, result:{stage, ok, node, outcome, …}}. Other JSON rows are not results. */
-export function nestedPodResult(row: Record<string, unknown>): { stage: string; ok: boolean; error?: string } | null {
+export function nestedPodResult(row: Record<string, unknown>): {
+  stage: string;
+  ok: boolean;
+  error?: string;
+  reasonCode?: string;
+  checkName?: string;
+  targetPath?: string;
+  preflightChecks?: PreflightCheck[];
+} | null {
   if (typeof row.kind !== 'string' || !CHILD_RESULT_KINDS.has(row.kind) || typeof row.ok !== 'boolean') return null;
   if (!row.result || typeof row.result !== 'object' || Array.isArray(row.result)) return null;
   const result = row.result as Record<string, unknown>;
@@ -18,28 +26,72 @@ export function nestedPodResult(row: Record<string, unknown>): { stage: string;
       ? (classification as Record<string, unknown>).classification : undefined;
   const reason = [result.node, result.outcome].filter((part): part is string => typeof part === 'string' && part.length > 0).join(' ');
   const error = [reason || (typeof result.error === 'string' ? result.error : ''), typeof detail === 'string' && detail ? detail : ''].filter(Boolean).join(' · ');
-  return { stage: result.stage, ok: false, ...(error ? { error } : {}) };
+  // PREFLIGHT-RESULT-LINE: a nested preflight rejection carries its blockers under result.blockers — the same ledger fields as the flat row.
+  const blockers = result.stage === 'preflight-blocked' ? preflightBlockerText(result.blockers)
+    : { error: '', preflightChecks: [] as PreflightCheck[] };
+  return {
+    stage: result.stage,
+    ok: false,
+    ...(error || blockers.error ? { error: error || blockers.error } : {}),
+    ...(blockers.preflightChecks.length === 1 ? blockers.preflightChecks[0] : {}),
+    ...(blockers.preflightChecks.length > 1 ? { preflightChecks: blockers.preflightChecks } : {}),
+  };
 }
 
-/** One line naming each preflight blocker (`(대상 경로 0) — …`), or '' when the row carries none. */
-function preflightBlockerText(blockers: unknown): string {
-  if (!Array.isArray(blockers)) return '';
-  return blockers.flatMap((blocker) => {
-    if (!blocker || typeof blocker !== 'object' || Array.isArray(blocker)) return [];
-    const { name, detail } = blocker as Record<string, unknown>;
-    const parts = [name, detail].filter((part): part is string => typeof part === 'string' && part.trim().length > 0).map((part) => part.trim().replace(/\s+/gu, ' '));
-    return parts.length ? [parts.join(' — ')] : [];
-  }).join(' · ');
+function ledgerString(value: unknown): string {
+  return typeof value === 'string' && value.trim().length > 0 ? value : '';
+}
+
+type PreflightCheck = { reasonCode: string; checkName: string; targetPath?: string };
+
+/** Keep each structured check paired with its own path; legacy blockers retain their name/detail diagnostic. */
+function preflightBlockerText(blockers: unknown): { error: string; preflightChecks: PreflightCheck[] } {
+  if (!Array.isArray(blockers)) return { error: '', preflightChecks: [] };
+  const errors: string[] = [];
+  const preflightChecks: PreflightCheck[] = [];
+  for (const blocker of blockers) {
+    if (!blocker || typeof blocker !== 'object' || Array.isArray(blocker)) continue;
+    const record = blocker as Record<string, unknown>;
+    const reasonCode = ledgerString(record.reasonCode);
+    const checkName = ledgerString(record.checkName);
+    if (reasonCode && checkName) {
+      const targetPath = ledgerString(record.targetPath);
+      preflightChecks.push({ reasonCode, checkName, ...(targetPath ? { targetPath } : {}) });
+      errors.push(`${reasonCode} · ${checkName}`);
+      continue;
+    }
+    const parts = [record.name, record.detail]
+      .filter((part): part is string => typeof part === 'string' && part.trim().length > 0)
+      .map((part) => part.trim().replace(/\s+/gu, ' '));
+    if (parts.length) errors.push(parts.join(' — '));
+  }
+  return { error: errors.join(' · '), preflightChecks };
 }
 
 /** A child terminal row: the legacy flat form {stage, ok, error?} (no kind, or a child kind) or the nested dev result. Any other kind is not a result. */
-export function podTerminalRow(row: Record<string, unknown>): { stage: string; ok: boolean; error?: string } | null {
+export function podTerminalRow(row: Record<string, unknown>): {
+  stage: string;
+  ok: boolean;
+  error?: string;
+  reasonCode?: string;
+  checkName?: string;
+  targetPath?: string;
+  preflightChecks?: PreflightCheck[];
+} | null {
   if (typeof row.kind === 'string' && !CHILD_RESULT_KINDS.has(row.kind)) return null;
   if (typeof row.stage === 'string' && typeof row.ok === 'boolean') {
-    if (typeof row.error === 'string') return { stage: row.stage, ok: row.ok, error: row.error };
-    // PREFLIGHT-RESULT-LINE: `{kind:'self', ok:false, stage:'preflight-blocked', blockers}` carries its reason in the blockers, not in `error`.
-    const blockers = row.ok === false && row.stage === 'preflight-blocked' ? preflightBlockerText(row.blockers) : '';
-    return { stage: row.stage, ok: row.ok, ...(blockers ? { error: blockers } : {}) };
+    // PREFLIGHT-RESULT-LINE: preserve structured blockers even when an explicit error supplies the human-readable reason.
+    if (row.ok === false && row.stage === 'preflight-blocked') {
+      const blockers = preflightBlockerText(row.blockers);
+      return {
+        stage: row.stage,
+        ok: row.ok,
+        ...(typeof row.error === 'string' ? { error: row.error } : blockers.error ? { error: blockers.error } : {}),
+        ...(blockers.preflightChecks.length === 1 ? blockers.preflightChecks[0] : {}),
+        ...(blockers.preflightChecks.length > 1 ? { preflightChecks: blockers.preflightChecks } : {}),
+      };
+    }
+    return { stage: row.stage, ok: row.ok, ...(typeof row.error === 'string' ? { error: row.error } : {}) };
   }
   return nestedPodResult(row);
 }
@@ -64,9 +116,21 @@ export function classifyPodExit(input: {
   jobReason?: string | null;
   logs: string;
   result?: Record<string, unknown> | null;
-}): { class: PodExitClass; errorCode: string | null; containerReason: string | null; exitCode: number | null; jobReason: string | null; tail: string[] } {
+}): {
+  class: PodExitClass;
+  errorCode: string | null;
+  containerReason: string | null;
+  exitCode: number | null;
+  jobReason: string | null;
+  tail: string[];
+  reasonCode?: string;
+  checkName?: string;
+  targetPath?: string;
+  preflightChecks?: PreflightCheck[];
+  noResultLine?: true;
+} {
   const logLines = input.logs.split(/\r\n|\n|\r/u).map((line) => line.trim()).filter(Boolean);
-  let terminalResult: { stage: string; ok: boolean; error?: string } | null = null;
+  let terminalResult: ReturnType<typeof podTerminalRow> = null;
   for (const line of logLines) {
     if (!line.startsWith('{')) continue;
     let parsed: unknown;
@@ -74,8 +138,8 @@ export function classifyPodExit(input: {
     if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) continue;
     terminalResult = podTerminalRow(parsed as Record<string, unknown>) ?? terminalResult;
   }
-  if (!terminalResult && input.result) terminalResult = podTerminalRow(input.result);
   const hasResultLine = terminalResult !== null;
+  if (!terminalResult && input.result) terminalResult = podTerminalRow(input.result);
   const askReprompt = logLines.some((line) =>
     /^\[ask\](?!\s+\d+\)\s).*(?:implementation[_ -]?target|reprompt|re-prompt|되묻)/iu.test(line));
   // 파싱되는 JSON 줄(진행·결과 행)은 오류 «줄»로 세지 않는다 — tail 과 같은 기준.
@@ -116,6 +180,11 @@ export function classifyPodExit(input: {
     exitCode: input.containerExitCode ?? null,
     jobReason: input.jobReason ?? null,
     tail,
+    ...(terminalResult?.reasonCode ? { reasonCode: terminalResult.reasonCode } : {}),
+    ...(terminalResult?.checkName ? { checkName: terminalResult.checkName } : {}),
+    ...(terminalResult?.targetPath ? { targetPath: terminalResult.targetPath } : {}),
+    ...(terminalResult?.preflightChecks ? { preflightChecks: terminalResult.preflightChecks } : {}),
+    ...(!hasResultLine ? { noResultLine: true as const } : {}),
   };
 }
 

package/src/task-orchestrator/surfaces/pod-host-acp-review.ts

@@ -11,6 +11,7 @@
 //    ⛔ 기본 꺼짐(opt-in): 옵션 → env `ELANOUS_POD_HOST_ACP_REVIEW` → config `llm.podHostAcpReview` 순.
 //    📌 남은 조각(②-b): 이 문이 켜진 런에서 Pod 안 api 리뷰를 «끄는» 것은 Pod 이미지 쪽 변경이라 따로 간다.
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../../util/spawn-sync-output.js';
 import { debug } from '../../debug/log.js';
 import type { ReviewResult } from '../../agent-substrate/pr-reviewer.js';
 import type { SubscriptionReviewerSpec } from '../../user-config.js';
@@ -57,7 +58,7 @@ export interface PodHostAcpReviewDeps {
 }
 
 function defaultReadPr(prNumber: number, repoRoot: string): { headRefOid: string; title: string; body: string; diff: string } | undefined {
-  const view = spawnSync('gh', ['pr', 'view', String(prNumber), '--json', 'headRefOid,title,body'], { cwd: repoRoot, encoding: 'utf8', timeout: 60_000 });
+  const view = spawnSync('gh', ['pr', 'view', String(prNumber), '--json', 'headRefOid,title,body'], { cwd: repoRoot, encoding: 'utf8', timeout: 60_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   if (view.status !== 0) return undefined;
   const diff = spawnSync('gh', ['pr', 'diff', String(prNumber)], { cwd: repoRoot, encoding: 'utf8', timeout: 120_000, maxBuffer: 64 * 1024 * 1024 });
   if (diff.status !== 0) return undefined;

package/src/task-orchestrator/surfaces/pod-image-source.ts

@@ -14,6 +14,7 @@
  *   이미지는 표준판(elanous-harness)만 — 이 발사 경로는 lite 를 쓰지 않는다.
  */
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../../util/spawn-sync-output.js';
 import { debug } from '../../debug/log.js';
 import { memberHasRegistry, registryImageRef, type RemoteRun } from './pod-pool.js';
 
@@ -71,7 +72,7 @@ export function memberPinRegistry(member: PodImageMember, source: Extract<PodIma
 
 /** 실제 조회 — 원격은 pod-pool 의 SSH 판정, 로컬은 이 기계의 docker/curl 로 조회한다. */
 export function podPoolImageLookup(run?: RemoteRun, localRun: (cmd: string, args: readonly string[]) => { status: number | null; stdout: string } = (cmd, args) => {
-  const r = spawnSync(cmd, [...args], { encoding: 'utf8', timeout: 10_000 });
+  const r = spawnSync(cmd, [...args], { encoding: 'utf8', timeout: 10_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   return { status: r.status, stdout: r.stdout ?? '' };
 }): {
   hasRegistry: (member: PodImageMember & { context: string }, registry: string) => boolean;