elanous 0.2.32 → 0.2.35

package/src/task-orchestrator/surfaces/self-implement-pod.ts

@@ -12,22 +12,26 @@
 // 부작용(kubectl·파일)은 주입받는다 — 시험은 가짜 kubectl 로 누른다.
 
 import { podSkillsDigest, readSkillEnvFiles, resolvePodSkills } from './pod-skills.js';
-import { emitPodLifecycle, parseSiTaskPodStages, siTaskPodLifecycleEvent, siTaskPodStageShell } from './pod-lifecycle-stages.js';
+import { emitPodLifecycle, parseSiTaskDepsSkipped, parseSiTaskPodStages, siTaskPodK8sTiming, siTaskPodLifecycleEvent, siTaskPodStageShell } from './pod-lifecycle-stages.js';
 import { podSourceScript, type PodSource } from './pod-source-receive.js';
 import { GROUNDING_TOKEN_ENV, GROUNDING_URL_ENV, mintGroundingToken, revokeGroundingRun, type GroundingTokenScope } from '../../grounding/token.js';
 import { POD_CREDENTIAL_GROK_PATH, POD_CREDENTIAL_GITHUB_PATH, POD_GITHUB_CREDENTIAL_TOKEN_ENV, POD_GITHUB_CREDENTIAL_URL_ENV, installationRepositories } from '../../nexus/api/pod-credential-api.js';
 import { coalescedInstallationCredential } from '../../auth/github-app-token.js';
 import { POD_CREDENTIAL_TOKEN_ENV, POD_CREDENTIAL_URL_ENV } from '../../grok/credential.js';
+import { isVerifiedOpenGatewayModel } from '../../llm/opengateway-models.js';
+import { configuredOpenGatewayKeys } from '../../llm/provider-credentials.js';
 import { collectPodLedgers, createPodLedgerFollower } from './pod-ledger-collect.js';
 import { collectPodArtifacts, podNoResultDiagnostic } from './pod-artifact-return.js';
 import { readPodRepairArtifact } from './pod-repair-commit.js';
 import { isValidAccountName, resolveCodexAccount } from '../../oauth/codex-account.js';
+import { createCodexAccessMirror } from '../../oauth/codex-access-mirror.js';
 import { effectiveInstanceRoot } from '../../instance/resolve.js';
 import { controlInboxEnv } from '../../harness/control-inbox.js';
 import { finishPodFragment, writePodFragment } from '../../harness/self-send-target.js';
 import { mintRunId, normalizeRunId } from '../../harness/harness-space.js';
 import { TA_LAND_ENV } from '../../task-agent/task-hand.js';
 import { appendRunLedgerEntry, loadRunLedger, runLedgerDir, runLedgerPath } from '../../self-implement/run-ledger.js';
+import { runSuffixKey } from '../../self-implement/salvage-branches.js';
 import type { GoalExecutionRecord } from '../../self-implement/orchestrator.js';
 import { hostRepositoryUnavailable, runHostRegate, type HostRegateResult } from '../../self-implement/host-regate.js';
 import { resolvePodHostAcpReview, runPodHostAcpReview, type PodHostAcpReviewOutcome } from './pod-host-acp-review.js';
@@ -67,7 +71,7 @@ import { isAbsolute, join, normalize, relative, resolve, sep } from 'node:path';
 import { findGitDir } from '../../git-fs/locate.js';
 import { hostLeaseBaseDir } from '../../pod-lease/host-lease.js';
 import { acquireLockAsync } from '../../storage/file-lock.js';
-import { debug } from '../../debug/log.js';
+import { debug, redactSecretText } from '../../debug/log.js';
 import { enterJourneyNode, exitJourneyNode, passJourneyNode } from '../../self-dev/graph-journey-nodes.js';
 import { routeJourneyEdge } from '../../self-dev/graph-journey-route.js';
 import { selectLiveDetail } from '../../live/detail-switch.js';
@@ -97,8 +101,16 @@ import { classifyPodExit, extractPodFailureReason, podTerminalRow, type PodExitC
 import { kubectlTransientReason, retryKubectlTransient } from './kubectl-transient-retry.js';
 import { OLD_DOOR_STAMP_ENV } from '../../self-dev/old-door.js';
 import { resolveDefaultSourceHead, seedMirrorOnce, type MirrorSeedResult } from './pod-mirror-seed.js';
+import { decideWarmReuse, type WarmReuseEvidenceByConsumer, type WarmReuseSwitchConfig } from './pod-warm-switch.js';
+import type { WarmWorkerCommand } from './pod-warm-worker-protocol.js';
+import type { WarmPodTransportResult } from './pod-warm-worker-pod.js';
 
 export type Kubectl = (args: readonly string[], input?: string) => { status: number | null; stdout: string; stderr: string };
+type OpenPrByBranch = { status: 'found'; prNumber: number; prUrl: string }
+  | { status: 'not-found' | 'failed'; reason: string };
+
+/** TC supplies the validated candidate/lease transport. UX only forwards its request command. */
+export type WarmPodRequestHook = (request: { command: WarmWorkerCommand }) => Promise<WarmPodTransportResult> | WarmPodTransportResult;
 
 // gh auth login may reject installation tokens when validating /user. Its config is
 // still the credential source for gh and setup-git's helper. Install it privately
@@ -148,6 +160,11 @@ export interface PodSpawnOptions {
   seedMirror?: (o: { host: string; commit: string; cwd: string }) => Promise<MirrorSeedResult | undefined>;
   /** Git tree that has the pinned commit for the mirror seed (default: process.cwd()). */
   mirrorSeedCwd?: string;
+  /** TA warm-reuse shadow evidence/config seams. Missing evidence must stay off; no warm candidate is consumed here. */
+  warmReuseConfig?: () => WarmReuseSwitchConfig | undefined;
+  warmReuseEvidence?: () => WarmReuseEvidenceByConsumer | undefined;
+  /** Optional warm-pool observation/preparation hook. It never replaces the feature implementation Job. */
+  warmPodRequest?: WarmPodRequestHook;
   /** SI-SEED-DEFAULT — resolves a default source's branch tip for the mirror seed (test seam · default
    *  {@link resolveDefaultSourceHead}; none with an injected kubectl unless given). */
   resolveSourceHead?: (o: { repoUrl: string; base?: string; cwd: string }) => Promise<{ sha?: string; reason?: string }>;
@@ -157,6 +174,8 @@ export interface PodSpawnOptions {
   authorConfig?: () => UserConfig;
   /** Host fallback chain seam; a Pod has no access to the host config. */
   fallbackConfig?: () => UserConfig;
+  /** Host OpenGateway key config seam; unit tests inject isolated config without bypassing production reads. */
+  openGatewayConfig?: () => UserConfig;
   /** 원천 — 없으면 종전 `git clone --depth 50`. bundle 이면 apply 뒤 kubectl cp 로 싣는다. */
   source?: PodSource;
   /** Existing PR repair: pin the source head and export a commit bundle instead of opening a PR. */
@@ -193,6 +212,8 @@ export interface PodSpawnOptions {
   taskAgentLiveMoves?: () => Promise<ReadonlySet<string>> | ReadonlySet<string>;
   /** PR comment for host-regate failures that never reached runHostRegate (injectable for tests). */
   ghComment?: (prNumber: number, body: string) => void;
+  /** Read-only host gh lookup; injected fixtures can stand in for gh without creating or closing a PR. */
+  lookupOpenPrByBranch?: (branch: string, repoUrl: string) => Promise<OpenPrByBranch> | OpenPrByBranch;
   draftResidue?: (record: PrTerminalRecord, ctx: DraftResidueContext) => Promise<void> | void;
   /** 🔑 Pod 필수 스킬의 키(.env)를 이 런의 Secret 으로 넘긴다 — 명시 opt-in(유료 크레딧을 쓴다). */
   skillEnv?: boolean;
@@ -385,6 +406,11 @@ export async function podCodexCredentialWithPrerefresh(account: string, deps: {
       // ⑴ 잠금을 기다리는 사이 동료 런이 갱신했으면 그대로 쓴다 — 두 번째 갱신이 회전된 토큰으로 실패하는 자리.
       const first = reread();
       if (!('expiringH' in first)) { observe('refresh-skipped-already-fresh', null); return first; }
+      // The lease can transfer while an account lock is queued. Recheck inside the
+      // critical section, immediately before the only refresh-token operation.
+      let stillHolder = false;
+      try { stillHolder = await deps.isLeaseHolder(); } catch { stillHolder = false; }
+      if (!stillHolder) { observe('no-lease', null, 'lease-lost-before-refresh'); return null; }
       let refreshed: Awaited<ReturnType<typeof deps.refresh>> | null = null;
       let failReason = 'threw';
       try { refreshed = await deps.refresh(account); }
@@ -418,12 +444,13 @@ export async function podCodexCredentialWithPrerefresh(account: string, deps: {
 
 /** 기본 임대 판정 — 기존 HQ 펜스(`ledger-cli` 역할 · fail-open 없음)를 그대로 쓴다. */
 async function defaultHqLeaseHolder(): Promise<boolean> {
+  if (process.env.ELANOUS_REMOTE_CODEX_ACCESS_ONLY === '1') return false;
   const { hqFenceDecision } = await import('../../hq/hq.js');
   return hqFenceDecision('ledger-cli').run;
 }
 
 /** 호스트 계정 → refresh 없는 사본(elanous 저장소 ⊕ codex auth.json) ⊕ gh 토큰. */
-export function hostCredentials(account: string, storePath: string = authStorePath(), ghToken: () => string = defaultGhToken): { elanousAuth: string; codexAuth: string; ghToken: string } {
+export function hostCredentials(account: string, storePath: string = authStorePath(), ghToken: () => string = defaultGhToken, options: { requireExplicitChatgptAuthMode?: boolean } = {}): { elanousAuth: string; codexAuth: string; ghToken: string } {
   // 경로는 해석기로(격리 게이트 · 2026-09-25) — 손으로 `~/.elanous/auth.json` 을 조립하면 test↔prod 격리가 새는 자리가 된다.
   const store = JSON.parse(readFileSync(storePath, 'utf8')) as { version?: number; providers: Record<string, Record<string, unknown>> };
   // ⭐ 기본 계정은 정본 키가 `openai-codex`(이름 없음)이고 홈을 안 적는다 — 기본 위치로 푼다(회전 후보와 같은 해석).
@@ -431,22 +458,70 @@ export function hostCredentials(account: string, storePath: string = authStorePa
   const entry = store.providers[storeKey] as { tokens: Record<string, unknown>; lastRefresh?: string; authMode?: string; codexHome?: string } | undefined;
   const codexHome = entry?.codexHome ?? (entry && account === 'default' ? resolveCodexAccount(envLiteral({ CODEX_HOME: process.env.CODEX_HOME })).home : undefined);
   if (!entry || !codexHome) throw new Error(`${storeKey} 계정이 없거나 codexHome 을 모른다`);
-  const codex = JSON.parse(readFileSync(join(codexHome, 'auth.json'), 'utf8')) as { tokens: Record<string, unknown> };
-  const access = String(codex.tokens.access_token ?? '');
-  const exp = Number(JSON.parse(Buffer.from(access.split('.')[1] ?? '', 'base64url').toString('utf8') || '{}').exp ?? 0);
-  if (exp * 1000 - Date.now() < 3 * 3600_000) throw new PodCodexExpiringError(account, Math.round(((exp * 1000 - Date.now()) / 3_600_000) * 10) / 10);
-  const elanousAuth = JSON.stringify({
-    version: store.version ?? 1,
-    // ⭐ P4(2026-09-26): elanous 사본도 «방금 검사한» codex 홈의 토큰으로 싣는다 — 두 저장소는 따로 갱신된다.
-    //   🩸 실측: third 는 elanous 쪽 토큰이 4시간 전에 만료됐고 codex 홈 쪽은 235시간 남아 있었다 → Pod 가 갱신 400 으로 첫 호출 전에 죽었다(할당량 소진으로 오분류).
-    providers: { 'openai-codex': { tokens: { ...entry.tokens, accessToken: access, expiresAt: exp * 1000, refreshToken: '' }, lastRefresh: entry.lastRefresh, authMode: entry.authMode, chatGPT: { accountId: codex.tokens.account_id } } },
-  });
-  const codexAuth = JSON.stringify({ ...codex, tokens: { ...codex.tokens, refresh_token: '' } });
-  return { elanousAuth, codexAuth, ghToken: ghToken() };
+  const codex = JSON.parse(readFileSync(join(codexHome, 'auth.json'), 'utf8')) as { auth_mode?: string; tokens: Record<string, unknown> };
+  // Remote parents must not infer this from store metadata; ordinary Pod callers retain the legacy fallback.
+  if (options.requireExplicitChatgptAuthMode && codex.auth_mode !== 'chatgpt') throw new Error(`${storeKey} Codex CLI auth_mode must be explicitly chatgpt for remote parent`);
+  const mirror = createCodexAccessMirror({ account, store, codexAuth: codex });
+  const hoursLeft = (mirror.expiresAt - Date.now()) / 3_600_000;
+  if (hoursLeft < 3) throw new PodCodexExpiringError(account, Math.round(hoursLeft * 10) / 10);
+  // ⭐ P4(2026-09-26): both stores use the just-checked Codex access token; the stores refresh independently.
+  return { elanousAuth: mirror.elanousAuth, codexAuth: mirror.codexAuth, ghToken: ghToken() };
+}
+
+/** POD-GROK-VALIDITY-FIT (10-17) — the Pod gets a refresh-less grok access copy, so the copy must outlive the Job.
+ *  It used to require 3 h (= the full POD_JOB_DEADLINE_SECONDS), but the token lives only 6 h and the grok CLI renews it
+ *  only right before expiry (`grok models`/`grok -p` leave `expires_at` unchanged — node-b refreshOutcome:"unchanged"), and
+ *  the CLI has no forced-refresh command (`grok --help`/`grok login --help` 10-17: login·logout only). So half of every
+ *  day refused grok Pod launches (10-17 node-b·node-c·mbp 9 no-launch · 3 hand re-logins).
+ *  ⇒ The Job is fitted to the token instead: a launch is allowed when the token has at least a minimum Job
+ *  (POD_GROK_MIN_JOB_SECONDS) plus a margin left, and that launch's `activeDeadlineSeconds` is cut to the token's
+ *  remaining life minus the margin (`fitPodDeadlineToGrok`) — so a long run ends as a classified DeadlineExceeded
+ *  instead of a silent mid-run 401. With the host credential relay (pod.groundingUrl) the Pod renews mid-run and
+ *  nothing is cut. 90 min = the Job cap before 대표 09-26 raised it (only two runs had reached it). */
+export const POD_GROK_MIN_JOB_SECONDS = 90 * 60;
+/** Slack between the fitted Job end and the token expiry (clock skew · Pod scheduling). */
+export const POD_GROK_EXPIRY_MARGIN_MS = 15 * 60_000;
+/** Minimum remaining token life for a grok Pod launch = minimum Job + margin (1 h 45 m). */
+export const POD_GROK_MIN_VALIDITY_MS = POD_GROK_MIN_JOB_SECONDS * 1000 + POD_GROK_EXPIRY_MARGIN_MS;
+
+/** «1h45m» · «20m» · «만료» — remaining-time text for refusal lines (no token value). */
+export function formatGrokRemaining(ms: number | null): string {
+  if (ms === null || !Number.isFinite(ms)) return '알 수 없음';
+  if (ms <= 0) return '만료됨';
+  const m = Math.floor(ms / 60_000);
+  return m >= 60 ? `${Math.floor(m / 60)}h${String(m % 60).padStart(2, '0')}m` : `${m}m`;
+}
+
+/** Latest `expires_at` among scopes that carry an access key (the token the Pod would get). */
+function grokSubscriptionExpiresAtMs(home?: string): number | null {
+  try {
+    const scopes = JSON.parse(readFileSync(grokAuthFilePath(home), 'utf8')) as Record<string, { key?: unknown; expires_at?: unknown }>;
+    const all = Object.values(scopes).flatMap((s) => (s && typeof s.key === 'string' && s.key && typeof s.expires_at === 'string' && Number.isFinite(Date.parse(s.expires_at)) ? [Date.parse(s.expires_at)] : []));
+    return all.length ? Math.max(...all) : null;
+  } catch { return null; }
+}
+
+/** POD-GROK-VALIDITY-FIT — this launch's Job deadline for a refresh-less grok subscription copy.
+ *  · relay (the Pod can renew from the host) or unknown expiry → the requested deadline as is.
+ *  · otherwise → min(requested, remaining − margin); below the minimum Job (time passed since the credential check)
+ *    the launch is refused — the deadline never outlives the token. */
+export function fitPodDeadlineToGrok(o: { requestedSeconds: number; expiresAtMs: number | null; nowMs: number; relay: boolean }):
+  { refused: false; deadlineSeconds: number; fitted: boolean; availableSeconds: number | null } | { refused: true; availableSeconds: number } {
+  if (o.relay || o.expiresAtMs === null || !Number.isFinite(o.expiresAtMs)) return { refused: false, deadlineSeconds: o.requestedSeconds, fitted: false, availableSeconds: null };
+  const availableSeconds = Math.floor((o.expiresAtMs - o.nowMs - POD_GROK_EXPIRY_MARGIN_MS) / 1000);
+  if (availableSeconds < POD_GROK_MIN_JOB_SECONDS) return { refused: true, availableSeconds };
+  if (availableSeconds >= o.requestedSeconds) return { refused: false, deadlineSeconds: o.requestedSeconds, fitted: false, availableSeconds };
+  return { refused: false, deadlineSeconds: availableSeconds, fitted: true, availableSeconds };
+}
+
+/** Expiry of the access the Pod will actually use — only scopes with a key, latest wins (same rule as the Pod reader). */
+export function shippedGrokExpiresAtMs(grokAuth: string): number | null {
+  try {
+    const scopes = JSON.parse(grokAuth) as Record<string, { key?: unknown; expires_at?: unknown }>;
+    const all = Object.values(scopes).flatMap((sc) => (sc && typeof sc.key === 'string' && sc.key && typeof sc.expires_at === 'string' && Number.isFinite(Date.parse(sc.expires_at)) ? [Date.parse(sc.expires_at)] : []));
+    return all.length ? Math.max(...all) : null;
+  } catch { return null; }
 }
-
-/** A Pod gets a refresh-less access copy, so the copy must outlive the Job: same rule as the Codex path (3 h). */
-export const POD_GROK_MIN_VALIDITY_MS = 3 * 3600_000;
 /** PODCRED1 (10-05): an App installation token lives ~60 min and the host renews it in the Pod at the ten-minute
  *  boundary; below this remaining life at launch the token is observed (`github-app-short-lived`). */
 export const POD_APP_TOKEN_MIN_START_MS = 20 * 60_000;
@@ -466,13 +541,21 @@ export function hostGrokCredentials(opts: {
   home?: string; env?: NodeJS.ProcessEnv; apiKeyOptIn?: boolean; ghToken?: () => string;
   /** Test seams — the host refresh (read-only `grok models`) and the expiry probe. */
   refresh?: () => void; isExpiring?: () => boolean;
+  /** Required remaining token life (default POD_GROK_MIN_VALIDITY_MS) — a caller whose Job is not fitted passes its own deadline. */
+  minValidityMs?: number; now?: () => number;
 } = {}): { grokAuth?: string; grokApiKey?: string; ghToken: string } {
   let credential = resolveGrokCredential({ home: opts.home, env: opts.env });
   if (credential?.kind === 'subscription') {
-    const expiring = opts.isExpiring ?? (() => isGrokSubscriptionExpiring({ home: opts.home, bufferMs: POD_GROK_MIN_VALIDITY_MS }));
+    const minValidityMs = opts.minValidityMs ?? POD_GROK_MIN_VALIDITY_MS;
+    const expiring = opts.isExpiring ?? (() => isGrokSubscriptionExpiring({ home: opts.home, bufferMs: minValidityMs, ...(opts.now ? { now: opts.now } : {}) }));
     if (expiring()) {
       try { (opts.refresh ?? (() => { refreshGrokSubscriptionToken({ home: opts.home }); }))(); } catch { /* judged below */ }
-      if (expiring()) throw new Error('grok: 구독 access 토큰이 3시간 안에 만료 — 호스트 갱신(grok models)도 못 늘렸다 · 호스트에서 grok login 후 다시');
+      if (expiring()) {
+        const at = grokSubscriptionExpiresAtMs(opts.home);
+        const remainingMs = at === null ? null : at - (opts.now ?? Date.now)();
+        try { debug.log('pod.grok-credentials', 'refused', { remainingMs, minValidityMs, expiresAt: at === null ? null : new Date(at).toISOString() }); } catch { /* fail-soft */ }
+        throw new Error(`grok: 구독 access 토큰 남은 시간 ${formatGrokRemaining(remainingMs)} < Pod 발사 기준 ${formatGrokRemaining(minValidityMs)} — 호스트 갱신(grok models)도 못 늘렸다 · 다음: 호스트에서 grok login --device-auth 후 다시`);
+      }
       credential = resolveGrokCredential({ home: opts.home, env: opts.env });
       if (credential?.kind !== 'subscription') throw new Error('grok: 갱신 뒤 구독 자격을 다시 읽지 못했다');
     }
@@ -554,9 +637,12 @@ export function grokLaunchReadiness(opts: { home?: string; env?: NodeJS.ProcessE
 }
 
 /** The one launch line for a skipped grok copy — the reader sees why grok left this run's chain. */
-export function podGrokSkippedLine(skip: { reason: PodGrokSkipReason; expiresAt: string | null }): string {
+export function podGrokSkippedLine(skip: { reason: PodGrokSkipReason; expiresAt: string | null }, now?: () => number): string {
   const why = skip.reason === 'missing' ? '구독 자격 없음' : skip.reason === 'expiring' ? '만료 임박' : '만료 임박 · 호스트 갱신 실패';
-  return `⚠️ grok 자격 없음(${why}${skip.expiresAt ? ` · 만료 ${skip.expiresAt}` : ''}) — 이 런의 폴백 체인에서 grok 을 뺐다`;
+  const at = skip.expiresAt ? Date.parse(skip.expiresAt) : NaN;
+  const left = skip.reason !== 'missing' && Number.isFinite(at) ? ` · 남은 ${formatGrokRemaining(at - (now ?? Date.now)())} < 기준 ${formatGrokRemaining(POD_GROK_MIN_VALIDITY_MS)}` : '';
+  const next = skip.reason === 'missing' ? '' : ' · 다음: 호스트에서 grok login --device-auth';
+  return `⚠️ grok 자격 없음(${why}${skip.expiresAt ? ` · 만료 ${skip.expiresAt}` : ''}${left}) — 이 런의 폴백 체인에서 grok 을 뺐다${next}`;
 }
 
 /** 키 캐시 관례: `~/.cache/<env 이름 소문자>`(예: OPENROUTER_API_KEY → ~/.cache/openrouter_api_key · src/config.ts 와 같다). */
@@ -578,20 +664,45 @@ function githubRepositoryFromUrl(repoUrl: string): string | null {
   return owner && name && ![owner, name].some((part) => part === '.' || part === '..') ? `${owner}/${name}` : null;
 }
 
-/** GROK-CHILD-GIT-GUARD — the Pod holds a GitHub write token and our repo cannot protect main (private free plan · API 403),
- *  so a child tool could `git push origin main`, force-push another run's branch or delete remote branches. A global
- *  pre-push hook lets a Pod push only its own run branches (self-impl/* · salvage/* · bench/<id>/<arm>) and refuses
- *  everything else, including deletes and the shared bench base. It stops accidental and reset-then-push overwrites;
- *  it is not a sandbox — credential isolation from child tools is the next slice. */
+/** GROK-CHILD-GIT-GUARD — the Pod holds a GitHub write token and our repo cannot protect main (private free plan · API 403).
+ *  The global hook refuses main/tags/unknown refs and most deletes. With a runId, self-impl refs use the same six-hex
+ *  run suffix as planned branch names; only that suffix and this run's disposable PR scratch create/delete pass.
+ *  A same-card PR reuse push is the one exception: per-command Git config binds its ref, old head and card;
+ *  the hook compares the Pod card and proves fast-forward ancestry before accepting it.
+ *  salvage/* and bench arm refs keep their existing broader rules. A six-hex collision remains possible, so this is
+ *  an accidental overwrite guard, not a security isolation boundary; child credential isolation is a separate slice. */
 export const POD_GIT_HOOKS_DIR = '$HOME/.elanous-git-hooks';
-export function podGitPushGuardScript(): string {
+export function podGitPushGuardScript(runId?: string): string {
+  const runKey = runId ? runSuffixKey(runId) : null;
+  const zeroSha = '0'.repeat(40);
   return [
     `mkdir -p "${POD_GIT_HOOKS_DIR}" && cat > "${POD_GIT_HOOKS_DIR}/pre-push" <<'ELANOUS_PRE_PUSH'`,
     '#!/bin/sh',
     'while read -r lref lsha rref rsha; do',
-    '  case "$lsha" in *[!0]*) ;; *) echo "[pod] git-guard: refused remote delete $rref" >&2; exit 1 ;; esac',
+    '  case "$lsha" in *[!0]*) ;; *)',
+    ...(runKey ? [
+      `    case "$rref" in refs/heads/self-impl/pr-create-r${runKey}-*) ;; *) echo "[pod] git-guard: refused remote delete $rref" >&2; exit 1 ;; esac ;;`,
+    ] : ['    echo "[pod] git-guard: refused remote delete $rref" >&2; exit 1 ;;']),
+    '  esac',
     '  case "$rref" in',
-    '    refs/heads/self-impl/*|refs/heads/salvage/*) ;;',
+    ...(runKey ? [
+      `    refs/heads/self-impl/pr-create-r${runKey}-*)`,
+      `      case "$lsha:$rsha" in ${zeroSha}:*|*:${zeroSha}) ;; *) echo "[pod] git-guard: refused scratch ref update $rref" >&2; exit 1 ;; esac ;;`,
+      `    refs/heads/self-impl/*-r${runKey}|refs/heads/self-impl/*-r${runKey}-early) ;;`,
+      '    refs/heads/self-impl/*)',
+      '      reuse_ref=$(git config --get elanous.sameCellReuseRef 2>/dev/null || true)',
+      '      reuse_head=$(git config --get elanous.sameCellReuseHead 2>/dev/null || true)',
+      '      reuse_card=$(git config --get elanous.sameCellReuseCard 2>/dev/null || true)',
+      '      if [ -z "$reuse_ref" ]; then echo "[pod] git-guard: refused push to $rref (another run)" >&2; exit 1; fi',
+      '      if [ "$rref" != "$reuse_ref" ]; then echo "[pod] git-guard: refused same-cell ref-mismatch $rref" >&2; exit 1; fi',
+      '      if [ -z "${ELANOUS_TASK_CARD_ID:-}" ] || [ "$reuse_card" != "$ELANOUS_TASK_CARD_ID" ]; then echo "[pod] git-guard: refused same-cell card-mismatch $rref" >&2; exit 1; fi',
+      '      if [ -z "$reuse_head" ] || [ "$rsha" != "$reuse_head" ]; then echo "[pod] git-guard: refused same-cell remote-head-mismatch $rref" >&2; exit 1; fi',
+      '      if ! git merge-base --is-ancestor "$rsha" "$lsha" 2>/dev/null; then echo "[pod] git-guard: refused same-cell non-fast-forward $rref" >&2; exit 1; fi',
+      '      echo "[pod] git-guard: allowed same-cell fast-forward $rref" >&2 ;;',
+    ] : [
+      ...(runId ? ['    refs/heads/self-impl/*) echo "[pod] git-guard: refused push to $rref (invalid run id)" >&2; exit 1 ;;'] : ['    refs/heads/self-impl/*) ;;']),
+    ]),
+    '    refs/heads/salvage/*) ;;',
     '    refs/heads/bench/*/base) echo "[pod] git-guard: refused push to shared bench base $rref" >&2; exit 1 ;;',
     '    refs/heads/bench/*/*) ;;',
     '    *) echo "[pod] git-guard: refused push to $rref (only this run\'s branches)" >&2; exit 1 ;;',
@@ -769,7 +880,7 @@ export const POD_ATTEMPT_ANNOTATION = 'elanous.dev/attempt';
 export function podRunLabels(o: { runId?: string; parentRunId?: string }): Record<string, string> {
   const run = k8sLabelValue(o.parentRunId ?? o.runId);
   const child = k8sLabelValue(o.runId);
-  return { ...(run ? { 'elanous.run': run } : {}), ...(child && child !== run ? { 'elanous.child-run': child } : {}) };
+  return { ...(run ? { 'elanous.run': run } : {}), ...(child ? { 'elanous.child-run': child } : {}) };
 }
 
 /** Pod 메모리 «등급» — 대표 09-27: PWA Pod 골이 16Gi 에서 OOM 으로 죽는다 ⇒ «high» 등급을 옵션으로 고른다.
@@ -892,7 +1003,7 @@ export function podMemoryLimitFor(feature: string, env: NodeJS.ProcessEnv | Read
 }
 
 /** A named child provider decides the Pod provider; paid OpenRouter requires an explicit key and model. */
-export function podNamedChildProvider(named: string | undefined, credential: { grokSubscription: boolean; grokApiKey: boolean; openrouterKey?: boolean; anthropicKey?: boolean }, childModel?: string): { provider?: PodChildProvider; refuse?: string } {
+export function podNamedChildProvider(named: string | undefined, credential: { grokSubscription: boolean; grokApiKey: boolean; openrouterKey?: boolean; openGatewayKey?: boolean; anthropicKey?: boolean }, childModel?: string): { provider?: PodChildProvider; refuse?: string } {
   // 공백·빈 이름 = «미지정»(종전 기본 경로) — 유료 provider 로 흘러가지 않는다(codex 재리뷰 must-fix).
   if (!named?.trim()) return {};
   // ⭐ 목록은 한 곳(pod-child-providers.ts) — 발사 관문도 같은 상수·같은 문면으로 거부한다.
@@ -907,6 +1018,12 @@ export function podNamedChildProvider(named: string | undefined, credential: { g
     if (!childModel?.trim()) return { refuse: 'pod: openrouter 자식 모델 없음 — --child-llm-model 필요' };
     return { provider: 'openrouter' };
   }
+  if (named === 'opengateway') {
+    if (!credential.openGatewayKey) return { refuse: 'pod: Pod 에 opengateway 키 없음 — 호스트 키 캐시 또는 OPENGATEWAY_API_KEY 필요' };
+    if (!childModel?.trim()) return { refuse: 'pod: opengateway 자식 모델 없음 — --child-llm-model 필요' };
+    if (!isVerifiedOpenGatewayModel(childModel.trim())) return { refuse: `pod: opengateway model not verified: ${childModel.trim()}` };
+    return { provider: 'opengateway' };
+  }
   // BEDROCK-PROVIDER ② — 자격은 클러스터의 이름 있는 Secret 에서 온다. 있나·키가 갖춰졌나는 Pod 발사 «전»(apply 0)에 판정한다(checkBedrockPodSecret).
   if (named === 'bedrock') return { provider: 'bedrock' };
   // ZAI-POD-CHILD — glm 도 같은 결: 자격은 클러스터의 이름 있는 ZAI Secret · 있나·동시 상한은 Pod 발사 «전»(apply 0)에 판정한다(pod-zai-child.ts).
@@ -941,7 +1058,8 @@ export function podChildLlmArgs(options: Pick<PodSpawnOptions, 'provider' | 'chi
   const provider = options.provider === 'openai-codex' && !options.childProviderExplicit ? undefined : options.provider;
   if (!provider) return [];
   const model = options.childModel?.trim() || (provider === 'grok' ? defaultGrokModel().id : provider === 'glm' ? ZAI_CODING_DEFAULT_MODEL : undefined);
-  if (provider === 'openrouter' && !model) throw new Error('pod: openrouter 자식 모델 없음 — --child-llm-model 필요');
+  if ((provider === 'openrouter' || provider === 'opengateway') && !model) throw new Error(`pod: ${provider} 자식 모델 없음 — --child-llm-model 필요`);
+  if (provider === 'opengateway' && !isVerifiedOpenGatewayModel(model!)) throw new Error(`pod: opengateway model not verified: ${model}`);
   // `self implement` registers no --child-llm-effort — passing it kills the Pod at argument parsing, so effort stays host-only.
   return ['--child-llm-provider', provider, ...(model ? ['--child-llm-model', model] : [])];
 }
@@ -998,7 +1116,7 @@ export function podSigtermTrapScript(seqFile: string = POD_USAGE_PARTIAL_SEQ_FIL
   return `trap '{ [ -n "$si_pid" ] && kill "$si_pid" 2>/dev/null || true; [ -n "\${usage_partial_pid:-}" ] && kill "$usage_partial_pid" 2>/dev/null || true; si_seq=$(cat ${seqFile} 2>/dev/null || true); case "$si_seq" in ""|*[!0-9]*) si_seq=0;; esac; si_seq=$((10#$si_seq + 1)); { [ -f scripts/usage-rollup.ts ] && bun scripts/usage-rollup.ts --since 12h --partial --seq "$si_seq"; } & si_rollup_pid=$!; for si_i in 1 2 3 4 5 6 7 8; do kill -0 "$si_rollup_pid" 2>/dev/null || break; sleep 1; done; kill "$si_rollup_pid" 2>/dev/null || true; wait "$si_rollup_pid" 2>/dev/null || true; exit 143; }' TERM`;
 }
 
-export function podJobManifest(o: { name: string; namespace: string; image: string; workIdentity?: PodWorkIdentity; /** 레지스트리 이미지면 IfNotPresent(노드가 pull) · 반입 이미지면 Never. */ imagePullPolicy?: 'Never' | 'IfNotPresent'; repoUrl: string; source?: PodSource; repairCommitOnly?: { pr: number; baseHead: string }; hostMirror?: string; args: readonly string[]; passEnv: readonly string[]; deadlineSeconds: number; runId?: string; parentRunId?: string; armEnv?: Readonly<Record<string, string>>; hostId?: string; imageCommit?: string | null; skillEnvs?: readonly string[]; memoryLimit?: string; memoryRequest?: string; goalDoc?: string; /** AUTHOR-POD2 — run `harness say` on /creds/feature inside the Pod (authoring happens off the host). */ authorSentence?: boolean; authorGrade?: 'full' | 'lite'; grokCredential?: 'subscription' | 'api_key'; codexAccounts?: readonly string[]; appCredential?: boolean; /** Test seam — default POD_GH_STALE_SECONDS. */ githubStaleSeconds?: number; /** Which goal execution and attempt this Job is — a resumed host verifies it before following the Job (POD9). */ execution?: { key: string; attempt: number }; hostLeaseAdmitted?: boolean; /** POD-ROLE-LLM — OpenRouter 자식 Pod 에 리뷰어용 codex 자격을 깐다. */ reviewerCodexAuth?: boolean; /** BEDROCK-PROVIDER ② — bedrock 자식만: 이름 있는 AWS Secret 의 키(secretKeyRef) ⊕ 리전 ⊕ 이그레스 라벨. */ bedrock?: BedrockPodSpec; /** ZAI-POD-CHILD — glm(ZAI) 자식만: 이름 있는 ZAI Secret 의 키(secretKeyRef) ⊕ 이그레스·동시 상한 라벨(Pod ⊕ Job). */ zai?: ZaiPodSpec; fallbackChain?: { steps: readonly FallbackStep[]; source: 'host' | 'default' }; /** TA-POD-WARMBOOT-PARITY — the child's final line (podResultMarkerShellLine), just before `exit $rc`. */ resultMarkerLine?: string }): Record<string, unknown> {
+export function podJobManifest(o: { name: string; namespace: string; image: string; workIdentity?: PodWorkIdentity; boundPrNumber?: number; /** 레지스트리 이미지면 IfNotPresent(노드가 pull) · 반입 이미지면 Never. */ imagePullPolicy?: 'Never' | 'IfNotPresent'; repoUrl: string; source?: PodSource; repairCommitOnly?: { pr: number; baseHead: string }; hostMirror?: string; args: readonly string[]; passEnv: readonly string[]; deadlineSeconds: number; runId?: string; parentRunId?: string; armEnv?: Readonly<Record<string, string>>; hostId?: string; imageCommit?: string | null; skillEnvs?: readonly string[]; memoryLimit?: string; memoryRequest?: string; goalDoc?: string; /** AUTHOR-POD2 — run `harness say` on /creds/feature inside the Pod (authoring happens off the host). */ authorSentence?: boolean; authorGrade?: 'full' | 'lite'; grokCredential?: 'subscription' | 'api_key'; codexAccounts?: readonly string[]; appCredential?: boolean; /** Test seam — default POD_GH_STALE_SECONDS. */ githubStaleSeconds?: number; /** Which goal execution and attempt this Job is — a resumed host verifies it before following the Job (POD9). */ execution?: { key: string; attempt: number }; hostLeaseAdmitted?: boolean; /** POD-ROLE-LLM — OpenRouter 자식 Pod 에 리뷰어용 codex 자격을 깐다. */ reviewerCodexAuth?: boolean; /** BEDROCK-PROVIDER ② — bedrock 자식만: 이름 있는 AWS Secret 의 키(secretKeyRef) ⊕ 리전 ⊕ 이그레스 라벨. */ bedrock?: BedrockPodSpec; /** ZAI-POD-CHILD — glm(ZAI) 자식만: 이름 있는 ZAI Secret 의 키(secretKeyRef) ⊕ 이그레스·동시 상한 라벨(Pod ⊕ Job). */ zai?: ZaiPodSpec; /** Codex Job may use the same named Secret only for an explicitly admitted ZAI fallback. */ zaiFallback?: ZaiPodSpec; fallbackChain?: { steps: readonly FallbackStep[]; source: 'host' | 'default' }; /** TA-POD-WARMBOOT-PARITY — the child's final line (podResultMarkerShellLine), just before `exit $rc`. */ resultMarkerLine?: string }): Record<string, unknown> {
   if (o.repairCommitOnly && (o.source?.kind !== 'pr' || o.source.number !== o.repairCommitOnly.pr || !/^[0-9a-f]{40}$/.test(o.repairCommitOnly.baseHead) || o.args.includes('--open-pr') || o.args.includes('--merge-by-host') || o.args.includes('--auto-merge'))) {
     throw new Error('repair commit-only requires matching PR source and no PR/merge flags');
   }
@@ -1007,6 +1125,8 @@ export function podJobManifest(o: { name: string; namespace: string; image: stri
   const childModelIndex = o.args.indexOf('--child-llm-model');
   const openrouterModel = childProviderIndex >= 0 && o.args[childProviderIndex + 1] === 'openrouter' && childModelIndex >= 0
     ? o.args[childModelIndex + 1] : undefined;
+  const openGatewayModel = childProviderIndex >= 0 && o.args[childProviderIndex + 1] === 'opengateway' && childModelIndex >= 0
+    ? o.args[childModelIndex + 1] : undefined;
   // POD-ANTHROPIC-PROVIDER — anthropic 자식은 키(env · secretKeyRef)만 쓴다. codex·grok 자격 파일을 깔지 않는다.
   const anthropicChild = childProviderIndex >= 0 && o.args[childProviderIndex + 1] === 'anthropic';
   const goalPath = o.goalDoc ? `'${(o.goalDoc.startsWith('-') ? `./${o.goalDoc}` : o.goalDoc).replace(/'/g, `'\\''`)}'` : undefined;
@@ -1030,7 +1150,9 @@ export function podJobManifest(o: { name: string; namespace: string; image: stri
       'mkdir -p "$HOME/.elanous" && install -m 600 /creds/llm-fallback-config.json "$HOME/.elanous/config.json" || exit 6',
       `echo "ELANOUS_POD_FALLBACK_CHAIN source=${o.fallbackChain.source} steps=${o.fallbackChain.steps.join(',')}"`,
     ] : []),
-    openrouterModel
+    openGatewayModel
+      ? 'mkdir -p ~/.elanous && export ELANOUS_LLM_PROVIDER=opengateway'
+      : openrouterModel
       ? o.reviewerCodexAuth
         ? 'mkdir -p ~/.elanous ~/.codex && cp /creds/elanous-auth.json ~/.elanous/auth.json && cp /creds/codex-auth.json ~/.codex/auth.json && chmod 600 ~/.elanous/auth.json ~/.codex/auth.json && export ELANOUS_LLM_PROVIDER=openrouter'
         : 'mkdir -p ~/.elanous && export ELANOUS_LLM_PROVIDER=openrouter'
@@ -1049,7 +1171,7 @@ export function podJobManifest(o: { name: string; namespace: string; image: stri
     // 🔑 스킬 키(.env) — 이미지엔 없다. 이 런의 Secret 에서 각 스킬 폴더로 0600 복사(값은 로그에 안 나온다).
     ...(o.skillEnvs?.length ? [`for n in ${o.skillEnvs.join(' ')}; do [ -d ~/.claude/skills/$n ] && install -m 600 /creds/skillenv-$n ~/.claude/skills/$n/.env; done; echo "[pod] skill env: ${o.skillEnvs.join(',')}"`] : []),
     'git config --global user.name "elanous pod child" && git config --global user.email "noreply@anthropic.com" && gh auth setup-git',
-    podGitPushGuardScript(),
+    podGitPushGuardScript(o.runId),
     'curl -s -m 3 -o /dev/null http://host.orb.internal:31415/health && { echo "[pod] ISOLATION FAIL"; exit 3; }',
     // SI-POD-STAGE-MARKERS — Pod 시계 단계 표지(`ELANOUS_POD_STAGE <stage> <start|end> <epoch초>`): 호스트가 Job 로그에서 읽어
     //   pod.lifecycle stages 의 clone · mirror · run 을 채운다. 실패한 단계는 끝 표지가 없다(→ missing · 지어내지 않는다).
@@ -1057,6 +1179,9 @@ export function podJobManifest(o: { name: string; namespace: string; image: stri
     siTaskPodStageShell('clone', 'start'),
     podSourceScript(o.source ?? { kind: 'default' }, o.repoUrl, undefined, { stageMarkers: true }),
     siTaskPodStageShell('clone', 'end'),
+    // This image already contains runtime dependencies; there is no child install command.
+    // Record that fact before the main command, without treating clone completion as install completion.
+    `printf 'ELANOUS_POD_DEPS skipped %s image-prepared-no-install\\n' "$(date +%s)" || true`,
     ...(o.repairCommitOnly ? [`[ "$(git rev-parse HEAD)" = '${o.repairCommitOnly.baseHead}' ] || { echo 'ELANOUS_POD_REPAIR_FAILED source-head-mismatch'; exit 8; }`] : []),
     ...(goalPath ? [
       `mkdir -p -- "$(dirname -- ${goalPath})" && cp -- /creds/goal-doc ${goalPath} || exit 6`,
@@ -1151,7 +1276,7 @@ if [ "$found" -eq 0 ]; then echo ELANOUS_RUN_LEDGER_NONE; fi`,
   return {
     apiVersion: 'batch/v1',
     kind: 'Job',
-    metadata: { name: o.name, namespace: o.namespace, labels: { 'elanous.substrate': 'pod', 'elanous.job': o.name, ...podRunLabels(o), ...(o.workIdentity ? podWorkLabels(o.workIdentity) : {}), ...(o.zai ? { [ZAI_POD_EGRESS_LABEL]: 'true' } : {}) },
+    metadata: { name: o.name, namespace: o.namespace, labels: { 'elanous.substrate': 'pod', 'elanous.job': o.name, ...podRunLabels(o), ...(o.workIdentity ? podWorkLabels(o.workIdentity) : {}), ...(o.zai || o.zaiFallback ? { [ZAI_POD_EGRESS_LABEL]: 'true' } : {}) },
       ...((o.execution || o.hostLeaseAdmitted) ? { annotations: { ...(o.execution ? { [POD_EXECUTION_KEY_ANNOTATION]: o.execution.key, [POD_ATTEMPT_ANNOTATION]: String(o.execution.attempt) } : {}), ...(o.hostLeaseAdmitted ? { [POD_HOST_LEASE_ANNOTATION]: 'true' } : {}) } } : {}) },
     spec: {
       backoffLimit: 0,
@@ -1159,7 +1284,7 @@ if [ "$found" -eq 0 ]; then echo ELANOUS_RUN_LEDGER_NONE; fi`,
       activeDeadlineSeconds: o.deadlineSeconds,
       template: {
         // ⭐ Pod 라벨 — local 팔만 `elanous.egress/local-llm` 을 단다. docker/h1/policy-local-llm.yaml 이 그 라벨에만 호스트 LLM 포트 «하나»를 연다.
-        metadata: { labels: { 'elanous.job': o.name, ...podRunLabels(o), ...(o.workIdentity ? podWorkLabels(o.workIdentity) : {}), ...(o.armEnv?.ELANOUS_LLM_PROVIDER === 'local' ? { 'elanous.egress/local-llm': 'true' } : {}), ...(o.bedrock ? { [BEDROCK_POD_EGRESS_LABEL]: 'true' } : {}), ...(o.zai ? { [ZAI_POD_EGRESS_LABEL]: 'true' } : {}) } },
+        metadata: { labels: { 'elanous.job': o.name, ...podRunLabels(o), ...(o.workIdentity ? podWorkLabels(o.workIdentity) : {}), ...(o.armEnv?.ELANOUS_LLM_PROVIDER === 'local' ? { 'elanous.egress/local-llm': 'true' } : {}), ...(o.bedrock ? { [BEDROCK_POD_EGRESS_LABEL]: 'true' } : {}), ...(o.zai || o.zaiFallback ? { [ZAI_POD_EGRESS_LABEL]: 'true' } : {}) } },
         spec: {
           restartPolicy: 'Never',
           securityContext: { runAsUser: 1000, fsGroup: 1000 },
@@ -1175,6 +1300,8 @@ if [ "$found" -eq 0 ]; then echo ELANOUS_RUN_LEDGER_NONE; fi`,
               ...(o.runId ? [{ name: 'ELANOUS_RUN_ID', value: o.runId }] : []),
               ...(o.parentRunId ? [{ name: 'ELANOUS_PARENT_RUN_ID', value: o.parentRunId }] : []),
               ...(o.workIdentity?.taskCard ? [{ name: 'ELANOUS_TASK_CARD_ID', value: o.workIdentity.taskCard }] : []),
+              ...(o.boundPrNumber && Number.isSafeInteger(o.boundPrNumber) && o.boundPrNumber > 0
+                ? [{ name: 'ELANOUS_TASK_BOUND_PR', value: String(o.boundPrNumber) }] : []),
               ...(o.workIdentity?.slotId ? [{ name: 'ELANOUS_POD_SLOT_ID', value: o.workIdentity.slotId }] : []),
               { name: 'ELANOUS_SUBSTRATE', value: 'pod' },
               ...Object.entries(controlInboxEnv(POD_CONTROL_INBOX_DIR)).map(([name, value]) => ({ name, value })),
@@ -1189,7 +1316,7 @@ if [ "$found" -eq 0 ]; then echo ELANOUS_RUN_LEDGER_NONE; fi`,
               ...Object.entries(o.armEnv ?? {}).map(([name, value]) => ({ name, value })),
               ...o.passEnv.map((key) => ({ name: key, valueFrom: { secretKeyRef: { name: `${o.name}-creds`, key: `env-${key}` } } })),
               ...(o.bedrock ? bedrockPodEnv(o.bedrock) : []),
-              ...(o.zai ? zaiPodEnv(o.zai) : []),
+              ...(o.zai || o.zaiFallback ? zaiPodEnv(o.zai ?? o.zaiFallback!) : []),
             ],
             volumeMounts: [{ name: 'creds', mountPath: '/creds', readOnly: true }, ...(o.hostMirror ? [{ name: 'host-mirror', mountPath: '/host-mirror', readOnly: true }] : [])],
           }],
@@ -1215,6 +1342,85 @@ function defaultGhComment(prNumber: number, body: string): void {
   if (r.status !== 0) throw new Error((r.stderr || r.error?.message || `gh exited ${r.status}`).trim().slice(0, 200));
 }
 
+function defaultLookupOpenPrByBranch(branch: string, repoUrl: string): OpenPrByBranch {
+  const repo = /^https:\/\/github\.com\/([\w.-]+\/[\w.-]+?)(?:\.git)?\/?$/u.exec(repoUrl)?.[1];
+  if (!repo) return { status: 'failed', reason: 'repository-unrecognized' };
+  if (!branch || !/^[A-Za-z0-9._/-]+$/u.test(branch) || branch.includes('..')) return { status: 'failed', reason: 'branch-invalid' };
+  const result = spawnSync('gh', ['pr', 'list', '--repo', repo, '--state', 'open', '--head', branch,
+    '--json', 'number,url,headRefName,isCrossRepository', '--limit', '100'], { encoding: 'utf8', timeout: 10_000, maxBuffer: 1_048_576 });
+  if (result.status !== 0) return { status: 'failed', reason: result.error ? 'gh-list-unavailable' : `gh-list-rc-${result.status ?? 'null'}` };
+  let rows: unknown;
+  try { rows = JSON.parse(result.stdout); } catch { return { status: 'failed', reason: 'gh-json-invalid' }; }
+  if (!Array.isArray(rows)) return { status: 'failed', reason: 'gh-json-invalid' };
+  if (rows.some((row) => row === null || typeof row !== 'object'
+    || typeof (row as { number?: unknown }).number !== 'number'
+    || !Number.isSafeInteger((row as { number: number }).number)
+    || typeof (row as { url?: unknown }).url !== 'string'
+    || typeof (row as { headRefName?: unknown }).headRefName !== 'string'
+    || typeof (row as { isCrossRepository?: unknown }).isCrossRepository !== 'boolean'))
+    return { status: 'failed', reason: 'gh-json-invalid' };
+  if (rows.length >= 100) return { status: 'failed', reason: 'gh-result-limit-reached' };
+  const matching = rows.filter((row): row is { number: number; url: string; headRefName: string; isCrossRepository: false } => {
+    if (row === null || typeof row !== 'object') return false;
+    const candidate = row as { number?: unknown; url?: unknown; headRefName?: unknown; isCrossRepository?: unknown };
+    return candidate.headRefName === branch && candidate.isCrossRepository === false && typeof candidate.number === 'number'
+      && Number.isSafeInteger(candidate.number) && candidate.number > 0 && typeof candidate.url === 'string';
+  });
+  if (matching.length === 0) return { status: 'not-found', reason: rows.some((row) =>
+    (row as { headRefName: string }).headRefName === branch && (row as { isCrossRepository: boolean }).isCrossRepository)
+    ? 'cross-repository-only' : 'no-open-pr-for-branch' };
+  if (matching.length !== 1) return { status: 'failed', reason: 'ambiguous-open-pr-for-branch' };
+  const row = matching[0]!;
+  if (row.url.replace(/\/$/u, '').toLowerCase() !== `https://github.com/${repo}/pull/${row.number}`.toLowerCase())
+    return { status: 'failed', reason: 'pr-url-mismatch' };
+  return { status: 'found', prNumber: row.number, prUrl: row.url };
+}
+
+type PodImageObservation = { podName: string | null; podUid: string | null; podCreatedAt: string | null;
+  imageID: string | null; digest: string | null; digestUnavailable: string | null };
+
+/** Read the newest Pod owned by this Job. A stale replacement must never be named as the final Pod. */
+function readJobPodImage(kubectl: Kubectl, namespace: string, job: string, jobUid?: string): PodImageObservation {
+  const unavailable = (reason: string, podName: string | null = null, imageID: string | null = null,
+    podUid: string | null = null, podCreatedAt: string | null = null): PodImageObservation =>
+    ({ podName, podUid, podCreatedAt, imageID, digest: null, digestUnavailable: reason });
+  let result: ReturnType<Kubectl>;
+  try { result = kubectl(['-n', namespace, 'get', 'pods', '-l', `job-name=${job}`, '-o', 'json', '--request-timeout=5s']); }
+  catch { return unavailable('pod-status-threw'); }
+  if (result.status !== 0) return unavailable(`pod-status-rc-${result.status ?? 'null'}`);
+  let rows: unknown;
+  try { rows = (JSON.parse(result.stdout) as { items?: unknown }).items; }
+  catch { return unavailable('pod-status-invalid-json'); }
+  if (!Array.isArray(rows)) return unavailable('pod-status-invalid-items');
+  const owned = rows.filter((row): row is {
+    metadata: { name: string; uid?: string; creationTimestamp?: string; ownerReferences: Array<{ kind: string; name: string; uid?: string }> };
+    status?: { containerStatuses?: Array<{ name?: string; imageID?: string }> };
+  } => {
+    if (!row || typeof row !== 'object') return false;
+    const meta = (row as { metadata?: unknown }).metadata;
+    if (!meta || typeof meta !== 'object') return false;
+    const m = meta as { name?: unknown; ownerReferences?: unknown };
+    if (typeof m.name !== 'string' || !Array.isArray(m.ownerReferences)) return false;
+    return m.ownerReferences.some((owner: unknown) => !!owner && typeof owner === 'object'
+      && (owner as { kind?: unknown }).kind === 'Job' && (owner as { name?: unknown }).name === job
+      && (!jobUid || (owner as { uid?: unknown }).uid === jobUid));
+  }).sort((a, b) => {
+    const at = Date.parse(a.metadata.creationTimestamp ?? '') || 0;
+    const bt = Date.parse(b.metadata.creationTimestamp ?? '') || 0;
+    return bt - at || b.metadata.name.localeCompare(a.metadata.name);
+  });
+  const pod = owned[0];
+  if (!pod) return unavailable(rows.length ? 'no-job-owned-pod' : 'pod-not-created');
+  const podUid = typeof pod.metadata.uid === 'string' ? pod.metadata.uid : null;
+  const podCreatedAt = typeof pod.metadata.creationTimestamp === 'string' ? pod.metadata.creationTimestamp : null;
+  const child = pod.status?.containerStatuses?.find((entry) => entry.name === 'child');
+  if (!child) return unavailable('child-container-not-started', pod.metadata.name, null, podUid, podCreatedAt);
+  const imageID = typeof child.imageID === 'string' ? child.imageID : null;
+  if (!imageID?.trim()) return unavailable('image-id-missing', pod.metadata.name, imageID, podUid, podCreatedAt);
+  const digest = /(?:^|[@/])(sha256:[0-9a-f]{64})$/iu.exec(imageID.trim())?.[1]?.toLowerCase() ?? null;
+  return { podName: pod.metadata.name, podUid, podCreatedAt, imageID, digest, digestUnavailable: digest ? null : 'nonstandard-image-id' };
+}
+
 export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplementJobSpawn {
   if (options.repairCommitOnly && (options.source?.kind !== 'pr' || options.source.number !== options.repairCommitOnly.pr || !/^[0-9a-f]{40}$/.test(options.repairCommitOnly.baseHead))) {
     throw new Error('repair commit-only requires a matching PR source and exact head');
@@ -1342,9 +1548,9 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         const timer = setTimeout(() => {
           if (stalledStages.has(stage)) return;
           stalledStages.add(stage);
-          const pool = options.pool as { waitReason?: () => string | null } | undefined;
+          const pool = options.pool as { waitReason?: (memoryLimit?: string) => string | null } | undefined;
           debug.log('harness.launch', 'launch-stalled', { spaceId: input.spaceId, runId: childRunId, stage, waitedSec: Math.round((Date.now() - started) / 1000),
-            reason: (stage === 'pool-slot' ? stageReason['pool-slot'] : (typeof pool?.waitReason === 'function' ? pool.waitReason() : null)) ?? 'not-measured-yet' }, { level: 'warn' });
+            reason: (stage === 'pool-slot' ? stageReason['pool-slot'] : (typeof pool?.waitReason === 'function' ? pool.waitReason(memoryLimit) : null)) ?? 'not-measured-yet' }, { level: 'warn' });
         }, stallMs);
         (timer as { unref?: () => void }).unref?.();
         return () => clearTimeout(timer);
@@ -1387,7 +1593,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
       const acquireAdmission = async (): Promise<boolean> => {
         if (!options.pool || typeof options.pool.acquireAdmission !== 'function') return true;
         const stop = watchStall('admission');
-        try { releaseAdmission = await options.pool.acquireAdmission(input.signal, after); return true; }
+        try { releaseAdmission = await options.pool.acquireAdmission(input.signal, after, { memoryLimit }); return true; }
         catch (error) {
           // A predecessor closed without merging is not a cancellation: surface it so the queue owner is notified.
           if (error instanceof Error && error.message.startsWith('pod lease predecessor blocked')) admissionBlocked = error.message;
@@ -1432,7 +1638,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
       const cleanupSecret = () => { kubectl(['-n', namespace, 'delete', 'secret', `${name}-creds`, '--ignore-not-found']); };
       let repairResultAnnounced = false;
       let repairArtifactReady = false;
-      const collectFullLogs = (unavailableEvent: string, replace?: ReadonlySet<string>, onEvent?: (event: string, data: Record<string, unknown>) => void, childId?: string): { status: 'ok' | 'unavailable' | 'incomplete'; childLedgerIncomplete: boolean; samples: ReturnType<typeof parseMemSamples>; podStages?: Record<string, number> } => {
+      const collectFullLogs = (unavailableEvent: string, replace?: ReadonlySet<string>, onEvent?: (event: string, data: Record<string, unknown>) => void, childId?: string): { status: 'ok' | 'unavailable' | 'incomplete'; childLedgerIncomplete: boolean; samples: ReturnType<typeof parseMemSamples> } => {
         let full: ReturnType<Kubectl>;
         try {
           full = kubectl(['-n', namespace, 'logs', `job/${name}`, '-c', 'child']);
@@ -1442,10 +1648,12 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           debug.log('self-implement.pod', unavailableEvent, { job: name, reason: error instanceof Error ? error.message : String(error) });
           return { status: 'unavailable', childLedgerIncomplete: false, samples: [] };
         }
-        const via = /^ELANOUS_POD_SOURCE_VIA (mirror|github)\r?$/m.exec(full.stdout)?.[1];
+        const via = /^ELANOUS_POD_SOURCE_VIA (image|mirror|github)\r?$/m.exec(full.stdout)?.[1];
         // #28246 names why the mirror was skipped on the line before `VIA github`; carry it on the same event.
         const mirrorSkip = /^ELANOUS_POD_SOURCE_MIRROR_SKIP (no-mount|rev-parse-failed|clone-failed)\r?$/m.exec(full.stdout)?.[1];
-        if (via) debug.log('self-implement.pod', 'source-via', { job: name, via, ...(mirrorSkip ? { mirrorSkip } : {}) });
+        const imageSkip = /^ELANOUS_POD_SOURCE_IMAGE_SKIP ([^\r\n]+)\r?$/m.exec(full.stdout)?.[1];
+        const delta = /^ELANOUS_POD_SOURCE_DELTA (mirror|origin)\r?$/m.exec(full.stdout)?.[1];
+        if (via) debug.log('self-implement.pod', 'source-via', { job: name, via, ...(mirrorSkip ? { mirrorSkip } : {}), ...(imageSkip ? { imageSkip } : {}), ...(delta ? { delta } : {}) });
         let ledgerIncomplete = false;
         let childLedgerIncomplete = false;
         let artifactIncomplete = false;
@@ -1478,7 +1686,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
             record('self-implement.pod', 'repair-artifact-incomplete', { job: name, reason: error instanceof Error ? error.message : String(error) });
           }
         }
-        return { status: ledgerIncomplete || artifactIncomplete ? 'incomplete' : 'ok', childLedgerIncomplete, samples: parseMemSamples(full.stdout), podStages: parseSiTaskPodStages(full.stdout) };
+        return { status: ledgerIncomplete || artifactIncomplete ? 'incomplete' : 'ok', childLedgerIncomplete, samples: parseMemSamples(full.stdout) };
       };
       let retryAccount: string | undefined;
       let retrySamples: ReturnType<typeof parseMemSamples> = [];
@@ -1521,12 +1729,13 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         const jobArgs = zaiRoute === 'openrouter' ? zaiOverflowChildArgs(args, ZAI_OPENROUTER_FALLBACK_MODEL) : args;
         const grok = options.provider === 'grok';
         const openrouter = options.provider === 'openrouter' || zaiRoute === 'openrouter';
+        const openGateway = options.provider === 'opengateway';
         const anthropic = options.provider === 'anthropic';
         const bedrockChild = options.provider === 'bedrock';
         const zaiChild = zaiRoute === 'zai';
         /** API 키 자식 — codex 계정·자격 파일을 안 쓴다(키는 작업별 creds Secret 의 `env-<KEY>` · bedrock·glm 은 이름 있는 Secret 으로만). */
-        const apiKeyChild = openrouter || anthropic || bedrockChild || zaiChild;
-        const plannedAccount = retryAccount ?? (grok ? 'grok' : openrouter ? 'openrouter' : anthropic ? 'anthropic' : bedrockChild ? 'bedrock' : zaiChild ? 'glm' : options.accountBroker?.() ?? options.account ?? 'team');
+        const apiKeyChild = openrouter || openGateway || anthropic || bedrockChild || zaiChild;
+        const plannedAccount = retryAccount ?? (grok ? 'grok' : openrouter ? 'openrouter' : openGateway ? 'opengateway' : anthropic ? 'anthropic' : bedrockChild ? 'bedrock' : zaiChild ? 'glm' : options.accountBroker?.() ?? options.account ?? 'team');
         debug.log('self-implement.pod', 'account', { spaceId: input.spaceId, account: plannedAccount, brokered: Boolean(options.accountBroker) });
         const plannedCodexAccounts = grok || apiKeyChild || !options.accountBroker || !options.rotationAccounts ? undefined : [plannedAccount, ...options.rotationAccounts.filter((candidate) => candidate !== plannedAccount && candidate !== failedAccount)];
         if (plannedCodexAccounts && !options.rotationAccounts!.includes(plannedAccount)) throw new Error(`pod: 배분 계정 ${plannedAccount} 이 회전 계획에 없다`);
@@ -1569,6 +1778,17 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         }) : undefined;
         const openrouterKey = openrouter ? env.OPENROUTER_API_KEY?.trim() || (options.readKeyCache ?? defaultReadKeyCache)('OPENROUTER_API_KEY')?.trim() : undefined;
         if (openrouter && !openrouterKey) throw new Error('pod: Pod 에 openrouter 키 없음 — 호스트 키 캐시 또는 OPENROUTER_API_KEY 필요');
+        const openGatewayEnvKey = openGateway ? env.OPENGATEWAY_API_KEY?.trim() : undefined;
+        const openGatewayCachedKey = openGateway ? (options.readKeyCache ?? defaultReadKeyCache)('OPENGATEWAY_API_KEY')?.trim() : undefined;
+        if (openGatewayEnvKey && openGatewayCachedKey && openGatewayEnvKey !== openGatewayCachedKey)
+          throw new Error('pod: opengateway env와 키 캐시가 충돌 — Pod 발사 거부');
+        const openGatewayHostConfig = openGateway ? (options.openGatewayConfig ?? getUserConfig)() : undefined;
+        const openGatewayConfiguredKeys = openGatewayHostConfig ? configuredOpenGatewayKeys(openGatewayHostConfig.llm) : [];
+        if (openGatewayConfiguredKeys.length > 1 || openGatewayConfiguredKeys.some((key) =>
+          (openGatewayEnvKey && openGatewayEnvKey !== key) || (openGatewayCachedKey && openGatewayCachedKey !== key)))
+          throw new Error('pod: opengateway 호스트 설정과 env/키 캐시가 충돌 — Pod 발사 거부');
+        const openGatewayKey = openGatewayEnvKey || openGatewayCachedKey || openGatewayConfiguredKeys[0];
+        if (openGateway && !openGatewayKey) throw new Error('pod: Pod 에 opengateway 키 없음 — 호스트 키 캐시 또는 OPENGATEWAY_API_KEY 필요');
         // POD-ANTHROPIC-PROVIDER — 제품 자격 해석(`getAnthropicApiKey` · 키 캐시 → env)으로 읽는다. 못 읽으면 Pod 를 안 띄운다(fail-closed).
         //   ⛔ 값은 로그·오류 문면에 안 싣는다 — «있었다» 만.
         const anthropicKey = anthropic
@@ -1590,6 +1810,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
           bedrockSpec = checked.spec;
         }
+        let jobDeadlineSeconds = options.deadlineSeconds ?? POD_JOB_DEADLINE_SECONDS;
         const creds = grok
           ? (options.grokCredentials ?? (() => hostGrokCredentials({ env, apiKeyOptIn: options.grokApiKeyOptIn })))()
           : apiKeyChild ? { ghToken: (options.openrouterGhToken ?? defaultGhToken)() }
@@ -1638,7 +1859,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
         }
         // Grok 자격은 전용 Secret 키 하나로만 보낸다 — passEnv 의 API 키 중복 전달은 막는다.
-        const passKeys = [...new Set([...(options.passEnv ?? []), ...(openrouter ? ['OPENROUTER_API_KEY'] : []), ...(anthropic ? ['ANTHROPIC_API_KEY'] : [])])].filter((key) => key !== 'ELANOUS_LIVE_DETAIL_UNTIL'
+        const passKeys = [...new Set([...(options.passEnv ?? []), ...(openrouter ? ['OPENROUTER_API_KEY'] : []), ...(openGateway ? ['OPENGATEWAY_API_KEY'] : []), ...(anthropic ? ['ANTHROPIC_API_KEY'] : [])])].filter((key) => key !== 'ELANOUS_LIVE_DETAIL_UNTIL'
           && key !== POD_GITHUB_CREDENTIAL_TOKEN_ENV && key !== POD_GITHUB_CREDENTIAL_URL_ENV
           && (!grok || !['XAI_API_KEY', 'GROK_API_KEY', 'GROK_CODE_XAI_API_KEY'].includes(key)));
         const skillEnvs: Record<string, string> = options.skillEnv
@@ -1784,10 +2005,41 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
             authorChoice = { ...authorChoice, model: childModel, modelSource: 'fallback-child' };
           } else debug.log('self-implement.pod', 'role-llm-armed', { job: name, role: 'planning', model: authorChoice.model, source: authorChoice.modelSource, account: roleCodexAccount });
         }
-        const hostKey = (k: string): string | undefined => k === 'OPENROUTER_API_KEY' && openrouter ? openrouterKey : k === 'ANTHROPIC_API_KEY' && anthropic ? anthropicKey : env[k] ?? (options.readKeyCache ?? defaultReadKeyCache)(k);
+        const hostKey = (k: string): string | undefined => k === 'OPENROUTER_API_KEY' && openrouter ? openrouterKey : k === 'OPENGATEWAY_API_KEY' && openGateway ? openGatewayKey : k === 'ANTHROPIC_API_KEY' && anthropic ? anthropicKey : env[k] ?? (options.readKeyCache ?? defaultReadKeyCache)(k);
         const hostFallbackNames = (options.fallbackConfig ?? getUserConfig)().llm.fallbackChain;
         const normalizedFallback = normalizeFallbackChain(hostFallbackNames);
-        const fallbackChain = { steps: normalizedFallback.chain, source: normalizedFallback.usedDefault ? 'default' as const : 'host' as const };
+        let fallbackSteps = normalizedFallback.chain;
+        let zaiFallbackSpec: ZaiPodSpec | undefined;
+        const codexChild = options.provider === undefined || options.provider === 'openai-codex';
+        if (!codexChild && fallbackSteps.includes('zai')) {
+          fallbackSteps = fallbackSteps.filter(step => step !== 'zai');
+          debug.log('self-implement.pod', 'zai-fallback-unavailable', {
+            job: name, reason: 'non-codex-child',
+          }, { level: 'warn' });
+        }
+        if (codexChild && fallbackSteps.includes('zai')) {
+          const settings = (options.zaiSettings ?? (() => zaiSettingsFromConfig(getUserConfig().llm)))();
+          const poolMembers = (options.pool as { members?: readonly PodPoolMember[] } | undefined)?.members;
+          const contexts = Array.isArray(poolMembers) && poolMembers.length > 0 ? poolMembers.map((m) => m.context) : [context];
+          let active: number | null = 0;
+          for (const c of contexts) {
+            const n = c === context ? countActiveZaiJobs(kubectl, namespace)
+              : countActiveZaiJobs((a, i) => baseKubectl(['--context', c, ...a], i), namespace);
+            if (n === null) { active = null; break; }
+            active += n;
+          }
+          const slot = decideZaiPodSlot({ active, pending: zaiPendingApply.size,
+            maxConcurrent: settings.maxConcurrent, overage: 'stop' });
+          if (slot.route === 'zai') {
+            const checked = checkZaiPodSecret(kubectl, namespace);
+            if (checked.ok) { zaiFallbackSpec = checked.spec; zaiPendingApply.add(name); }
+            else debug.log('self-implement.pod', 'zai-fallback-unavailable', { job: name, reason: 'secret-unavailable' }, { level: 'warn' });
+          } else debug.log('self-implement.pod', 'zai-fallback-unavailable', {
+            job: name, reason: slot.route === 'refuse' ? 'slot-refused' : 'slot-unavailable', active,
+          }, { level: 'warn' });
+          if (!zaiFallbackSpec) fallbackSteps = fallbackSteps.filter(step => step !== 'zai');
+        }
+        const fallbackChain = { steps: fallbackSteps, source: normalizedFallback.usedDefault ? 'default' as const : 'host' as const };
         debug.log('self-implement.pod', 'fallback-chain-carried', {
           job: name, source: fallbackChain.source, steps: fallbackChain.steps,
           ...(normalizedFallback.dropped.length ? { droppedCount: normalizedFallback.dropped.length } : {}),
@@ -1822,6 +2074,10 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         //   🩸 종전엔 여기서 delete 부터 해서, 재개가 원격에서 멀쩡히 돌던 Job 을 죽였다. 실패로 끝난 Job 만 지우고 다시 만든다.
         // ☸️ 노드 레지스트리에 이 판이 있으면 그것을 pull 한다(델타 · 대표 2026-09-26) — 라벨 판정은 로컬 이미지 이름으로 한다.
         const jobImage = member?.imageRef ?? image;
+        // A pool member may pull a different image than the host's local one.
+        // The local Docker label cannot prove that member image's commit.
+        const localImageCommit = options.imageCommit !== undefined ? options.imageCommit : options.kubectl ? null : podImageFreshness({ image }).imageCommit;
+        const jobImageCommit = jobImage === image ? localImageCommit : null;
         const launchRunId = retryAccount || oomRetried || ghLoginRetried ? mintRunId() : childRunId;
         let liveChildRunId = launchRunId;
         // TA-POD-WARMBOOT-PARITY — the id the followed Job prints in its result marker (null = wait on the condition only).
@@ -1830,9 +2086,12 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         let existingExecutionKey: string | undefined;
         let existingAttempt = NaN;
         let existingChildScript = '';
+        let jobApplyStartedAt: number | undefined;
+        let lifecycleJobUid: string | undefined;
         const existing = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.metadata.uid} {.status.conditions[*].type}']);
         const [existingUid = '', ...existingConditions] = existing.status === 0 ? existing.stdout.trim().split(/\s+/u) : [];
         const hasExistingJob = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(existingUid);
+        if (hasExistingJob) lifecycleJobUid = existingUid;
         let reattach = hasExistingJob && !/Failed|FailureTarget/.test(existingConditions.join(' '));
         const failedExisting = hasExistingJob && /Failed|FailureTarget/.test(existingConditions.join(' '));
         if (hasExistingJob) {
@@ -1994,6 +2253,13 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           slotId: env.ELANOUS_POD_SLOT_ID,
           work: !goalDoc && env.ELANOUS_POD_AUTHOR_ON_POD === '1' && !shard ? 'authoring' : (oomRetried ? retryTier : memoryTier) === 'lite' ? 'lite' : 'harness',
         };
+        // TA-POD-WARMBOOT-PARITY shadow only: record the decision on the existing fresh-Job path.
+        // Until a shared warm-candidate contract exists, evidence stays unmeasured and this never changes execution.
+        if (workIdentity.taskCard) {
+          const warmReuseConfig = options.warmReuseConfig?.() ?? (options.kubectl ? undefined : getUserConfig().pod?.warmReuse);
+          const decision = decideWarmReuse('ta', warmReuseConfig, options.warmReuseEvidence?.());
+          debug.log('pod.warm', 'ta-shadow-observation', { ...decision, execution: 'fresh-job' });
+        }
         // TA-POD-WARMBOOT-PARITY (GATE-WARM-BOOT parity · #27805): a commit-pinned source on a pool host — put that commit into
         // the host mirror first (once per host·commit in this process) so podSourceScript finds it instead of fetching
         // from GitHub. Best effort: a failed seed only logs; the Job is applied either way.
@@ -2034,13 +2300,51 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         // TA-POD-WARMBOOT-PARITY (GATE-POD-RESULT-MARKER parity · #27815): this launch's marker is the child's last line.
         const resultMarkerLine = resultMarkerOn ? (await import('./pod-result-marker-wait.js')).podResultMarkerShellLine(launchRunId) ?? undefined : undefined;
         if (resultMarkerLine) markerToken = launchRunId;
-        const job = podJobManifest({ name, namespace, fallbackChain, ...(resultMarkerLine ? { resultMarkerLine } : {}), image: jobImage, workIdentity, ...(member?.imageRef ? { imagePullPolicy: 'IfNotPresent' as const } : {}), repoUrl, ...(options.source ? { source: options.source } : {}), ...(options.repairCommitOnly ? { repairCommitOnly: options.repairCommitOnly } : {}), ...(hostMirror ? { hostMirror } : {}), args: jobArgs, passEnv: jobPassEnv, deadlineSeconds: options.deadlineSeconds ?? POD_JOB_DEADLINE_SECONDS, ...(goalDoc ? { goalDoc } : env.ELANOUS_POD_AUTHOR_ON_POD === '1' && !shard ? { authorSentence: true, ...(env.ELANOUS_POD_AUTHOR_GRADE === 'lite' || env.ELANOUS_POD_AUTHOR_GRADE === 'full' ? { authorGrade: env.ELANOUS_POD_AUTHOR_GRADE } : {}) } : {}), runId: launchRunId, ...(parentRunId ? { parentRunId } : {}), ...(jobArmEnv ? { armEnv: jobArmEnv } : {}), hostId: resolveHostId(env), skillEnvs: Object.keys(skillEnvs), memoryLimit, memoryRequest, imageCommit: options.imageCommit !== undefined ? options.imageCommit : options.kubectl ? null : podImageFreshness({ image }).imageCommit, ...(grok ? { grokCredential: 'grokAuth' in creds && creds.grokAuth ? 'subscription' as const : 'api_key' as const } : {}), ...(codexAccounts ? { codexAccounts } : {}), ...(hostRefresh ? { appCredential: true } : {}), execution: { key: executionKey, attempt: oomRetried ? 2 : 1 }, hostLeaseAdmitted: !!releaseAdmission, ...(roleCodexCredential ? { reviewerCodexAuth: true } : {}), ...(bedrockSpec ? { bedrock: bedrockSpec } : {}), ...(zaiSpec ? { zai: zaiSpec } : {}) });   // kubectl 주입(=시험)이면 docker 를 부르지 않는다
+        // POD-GROK-VALIDITY-FIT — without a relay the Pod cannot renew the copy, so the Job ends before the token does.
+        // Measured right before the Job is applied (review r2): setup between the credential check and here takes time.
+        if (grokSubscription) {
+          const shippedExpiresAtMs = shippedGrokExpiresAtMs((creds as { grokAuth: string }).grokAuth);
+          const fit = fitPodDeadlineToGrok({ requestedSeconds: jobDeadlineSeconds, expiresAtMs: shippedExpiresAtMs, nowMs: (options.now ?? Date.now)(), relay: Boolean(credentialRelay) });
+          if (fit.refused) {
+            debug.log('self-implement.pod', 'grok-deadline-refused', { job: name, requestedSeconds: jobDeadlineSeconds, availableSeconds: fit.availableSeconds, minJobSeconds: POD_GROK_MIN_JOB_SECONDS, marginMs: POD_GROK_EXPIRY_MARGIN_MS });
+            cleanupSecret();
+            return { exitCode: 1, output: '', error: { code: 'pod-grok-expiring', message: `grok: 구독 access 토큰 남은 시간 ${formatGrokRemaining(fit.availableSeconds * 1000 + POD_GROK_EXPIRY_MARGIN_MS)} < Pod 발사 기준 ${formatGrokRemaining(POD_GROK_MIN_VALIDITY_MS)} — 발사 직전 재검증 · 다음: 호스트에서 grok login --device-auth 후 다시` } };
+          }
+          debug.log('self-implement.pod', fit.fitted ? 'grok-deadline-fitted' : 'grok-deadline-kept', { job: name, requestedSeconds: jobDeadlineSeconds, deadlineSeconds: fit.deadlineSeconds, availableSeconds: fit.availableSeconds, relay: Boolean(credentialRelay), marginMs: POD_GROK_EXPIRY_MARGIN_MS });
+          jobDeadlineSeconds = fit.deadlineSeconds;
+        }
+        const job = podJobManifest({ name, namespace, fallbackChain, ...(resultMarkerLine ? { resultMarkerLine } : {}), image: jobImage, workIdentity, ...(env.ELANOUS_TASK_BOUND_PR && /^[1-9]\d*$/.test(env.ELANOUS_TASK_BOUND_PR) && Number.isSafeInteger(Number(env.ELANOUS_TASK_BOUND_PR)) ? { boundPrNumber: Number(env.ELANOUS_TASK_BOUND_PR) } : {}), ...(member?.imageRef ? { imagePullPolicy: 'IfNotPresent' as const } : {}), repoUrl, ...(options.source ? { source: options.source } : {}), ...(options.repairCommitOnly ? { repairCommitOnly: options.repairCommitOnly } : {}), ...(hostMirror ? { hostMirror } : {}), args: jobArgs, passEnv: jobPassEnv, deadlineSeconds: jobDeadlineSeconds, ...(goalDoc ? { goalDoc } : env.ELANOUS_POD_AUTHOR_ON_POD === '1' && !shard ? { authorSentence: true, ...(env.ELANOUS_POD_AUTHOR_GRADE === 'lite' || env.ELANOUS_POD_AUTHOR_GRADE === 'full' ? { authorGrade: env.ELANOUS_POD_AUTHOR_GRADE } : {}) } : {}), runId: launchRunId, ...(parentRunId ? { parentRunId } : {}), ...(jobArmEnv ? { armEnv: jobArmEnv } : {}), hostId: resolveHostId(env), skillEnvs: Object.keys(skillEnvs), memoryLimit, memoryRequest, imageCommit: jobImageCommit, ...(grok ? { grokCredential: 'grokAuth' in creds && creds.grokAuth ? 'subscription' as const : 'api_key' as const } : {}), ...(codexAccounts ? { codexAccounts } : {}), ...(hostRefresh ? { appCredential: true } : {}), execution: { key: executionKey, attempt: oomRetried ? 2 : 1 }, hostLeaseAdmitted: !!releaseAdmission, ...(roleCodexCredential ? { reviewerCodexAuth: true } : {}), ...(bedrockSpec ? { bedrock: bedrockSpec } : {}), ...(zaiSpec ? { zai: zaiSpec } : {}), ...(zaiFallbackSpec ? { zaiFallback: zaiFallbackSpec } : {}) });   // kubectl 주입(=시험)이면 docker 를 부르지 않는다
         const carriedBranch = goalDoc ? 'goal-doc' as const : env.ELANOUS_POD_AUTHOR_ON_POD === '1' && !shard ? 'author' as const : undefined;
         const carriedChildLlm = carriedBranch ? podDelegatedChildLlm(jobArgs) : undefined;
+        jobApplyStartedAt = Date.now();
         const a = kubectl(['apply', '-f', '-'], JSON.stringify(job));
         zaiPendingApply.delete(name);   // apply 뒤엔 Job 라벨이 센다(성공) · 실패면 셀 것이 없다
         if (a.status !== 0) { cleanupSecret(); return { exitCode: 1, output: a.stderr, error: { code: 'pod-apply', message: a.stderr.trim() } }; }
         releaseAdmission?.applied?.(name, context, namespace);
+        const imageFacts = { job: name, childRunId: liveChildRunId, image: jobImage, imageCommit: jobImageCommit, context };
+        try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-job-image', data: imageFacts }, ledgerDir); }
+        catch (error) { debug.log('self-implement.pod', 'job-image-ledger-unavailable', { job: name, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
+        debug.log('self-implement.pod', 'job-image', imageFacts);
+        // The injected observer does not acquire a production lease. The gate consumer
+        // must compare the Job result and explicitly finalize before enabling replay.
+        if (!oomRetried && input.warmWorkerCommand && options.warmPodRequest) {
+          setImmediate(() => {
+            try {
+              const request = options.warmPodRequest!({ command: input.warmWorkerCommand! });
+              void Promise.resolve(request)
+                .then((result) => debug.log('pod.warm', 'request-observation', {
+                  spaceId: input.spaceId, status: result.status, reason: result.reason, execution: 'fresh-job',
+                }))
+                .catch((error) => debug.log('pod.warm', 'request-unavailable', {
+                  spaceId: input.spaceId, reason: error instanceof Error ? error.message : String(error), execution: 'fresh-job',
+                }, { level: 'warn' }));
+            } catch (error) {
+              debug.log('pod.warm', 'request-unavailable', {
+                spaceId: input.spaceId, reason: error instanceof Error ? error.message : String(error), execution: 'fresh-job',
+              }, { level: 'warn' });
+            }
+          });
+        }
         // Logged only once the Job is applied — a failed apply carried nothing.
         if (carriedBranch && carriedChildLlm) debug.log('self-implement.pod', 'child-llm-carried', { spaceId: input.spaceId, job: name, branch: carriedBranch, provider: carriedChildLlm.provider, model: carriedChildLlm.model ?? null });
         if (options.source?.kind === 'bundle') {
@@ -2068,6 +2372,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         }
         // ☸️ P2: 비밀의 소유자 = Job — 호스트가 죽어도 Job 의 TTL 삭제와 함께 k8s 가 비밀을 거둔다(자격 사본이 클러스터에 남지 않는다).
         const uid = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.metadata.uid}']).stdout.trim();
+        lifecycleJobUid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(uid) ? uid : undefined;
         if (uid) {
           const owned = kubectl(['-n', namespace, 'patch', 'secret', `${name}-creds`, '--type=merge', '-p', JSON.stringify({ metadata: { ownerReferences: [{ apiVersion: 'batch/v1', kind: 'Job', name, uid }] } })]);
           if (owned.status !== 0) debug.log('self-implement.pod', 'secret-owner-failed', { job: name, stderr: owned.stderr.trim() }, { level: 'warn' });
@@ -2086,7 +2391,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         }
         writePodFragment({ spaceId: input.spaceId, context, namespace, job: name, inboxDir: POD_CONTROL_INBOX_DIR, ...(liveChildRunId === normalizeRunId(liveChildRunId) ? { runId: liveChildRunId } : {}), ...(parentRunId && normalizeRunId(parentRunId) === parentRunId ? { parentRunId } : {}) }, env);
         recorded = true;
-        debug.log('self-implement.pod', 'job-applied', { job: name, namespace, ...(member ? { context: member.context } : {}), image: jobImage, spaceId: input.spaceId, passEnv, ...(openrouter ? { openrouterKeyPresent: passEnv.includes('OPENROUTER_API_KEY') } : {}), ...(anthropic ? { anthropicKeyPresent: passEnv.includes('ANTHROPIC_API_KEY') } : {}), ...(bedrockSpec ? { bedrockSecret: bedrockSpec.secretName, bedrockSecretKeys: bedrockSpec.keys, bedrockRegionFrom: bedrockSpec.region.from } : {}), ...(zaiRoute ? { zaiRoute, ...(zaiSpec ? { zaiSecret: zaiSpec.secretName } : {}) } : {}), extraArgs: options.extraArgs ?? [], ...(options.armEnv?.ELANOUS_ARM_ID ? { armId: options.armEnv.ELANOUS_ARM_ID } : {}) });
+        debug.log('self-implement.pod', 'job-applied', { job: name, namespace, ...(member ? { context: member.context } : {}), image: jobImage, spaceId: input.spaceId, passEnv, ...(openrouter ? { openrouterKeyPresent: passEnv.includes('OPENROUTER_API_KEY') } : {}), ...(openGateway ? { openGatewayKeyPresent: passEnv.includes('OPENGATEWAY_API_KEY') } : {}), ...(anthropic ? { anthropicKeyPresent: passEnv.includes('ANTHROPIC_API_KEY') } : {}), ...(bedrockSpec ? { bedrockSecret: bedrockSpec.secretName, bedrockSecretKeys: bedrockSpec.keys, bedrockRegionFrom: bedrockSpec.region.from } : {}), ...(zaiRoute ? { zaiRoute, ...(zaiSpec ? { zaiSecret: zaiSpec.secretName } : {}) } : {}), extraArgs: options.extraArgs ?? [], ...(options.armEnv?.ELANOUS_ARM_ID ? { armId: options.armEnv.ELANOUS_ARM_ID } : {}) });
         let state: 'complete' | 'failed' | 'aborted' = 'failed';
         let failedReason = '';
         let containerReason: string | null = null;
@@ -2098,11 +2403,34 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         // ⭐ METER-POD-ROLLUP-GAP-3 — 런 «도중» 마지막 PARTIAL 줄을 호스트가 쥔다: Pod 가 지워지면(SIGTERM 등) 종료 로그에서 PARTIAL 이 사라진다.
         let livePartialLine: string | null = null;
         let pollsSinceCapture = 0;
+        let imageSnapshotRecorded = false;
+        let terminalImageRecorded = false;
+        const recordPodImage = (final: boolean): void => {
+          if (final ? terminalImageRecorded : imageSnapshotRecorded) return;
+          const observed = readJobPodImage(kubectl, namespace, name, lifecycleJobUid);
+          if (!final && !observed.podName) return;
+          const append = (isFinal: boolean): void => {
+            const data = { job: name, childRunId: liveChildRunId, attempt: oomRetried ? 2 : 1,
+              image: jobImage, imageCommit: jobImageCommit, context, ...observed, final: isFinal };
+            try {
+              appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-image-digest', data }, ledgerDir);
+              if (isFinal) terminalImageRecorded = true;
+              else imageSnapshotRecorded = true;
+            } catch (error) {
+              debug.log('self-implement.pod', 'pod-image-digest-ledger-unavailable', {
+                job: name, final: isFinal, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' });
+            }
+            debug.log('self-implement.pod', 'pod-image-digest', data);
+          };
+          if (final && !imageSnapshotRecorded && observed.podName) append(false);
+          append(final);
+        };
         const capturePolls = Math.max(1, options.usagePartialCapturePolls ?? Math.round(POD_USAGE_PARTIAL_CAPTURE_MS / Math.max(1, options.pollMs ?? 15_000)));
         const markerWait = markerToken ? await import('./pod-result-marker-wait.js') : null;
         const waitStartedAt = Date.now();
         for (;;) {
           if (input.signal?.aborted) {
+            recordPodImage(true);
             // METER-POD-ROLLUP-GAP — Job 삭제 «전»에 로그를 한 번 거둔다: PARTIAL 줄이 삭제와 함께 사라지면 사용량이 0 처럼 보인다.
             try {
               const captured = kubectl(['-n', namespace, 'logs', `job/${name}`, '-c', 'child', '--tail=400']);
@@ -2112,6 +2440,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
             state = 'aborted';
             break;
           }
+          if (!imageSnapshotRecorded) recordPodImage(false);
           const g = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.status.conditions[*].type}']);
           const types = g.stdout;
           if (/Complete|SuccessCriteriaMet/.test(types)) { releaseAdmission?.observed?.(); state = 'complete'; break; }
@@ -2187,6 +2516,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
           await sleep(options.pollMs ?? 15_000);
         }
+        if (!terminalImageRecorded) recordPodImage(true);
         let logs = '';
         let logTailReason: string | undefined;
         try {
@@ -2366,14 +2696,52 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         }
         const childFailure = state === 'failed' && !oomKilled && failedReason !== 'DeadlineExceeded'
           ? lastPodChildFailure(logs) : null;
+        let childPrFailure: ReturnType<typeof podPrOpenFailure> = null;
+        if (childFailure) {
+          try {
+            const entries = loadRunLedger(liveChildRunId, ledgerDir);
+            const entry = entries?.slice().reverse().find((row) => row.event === 'pr-open-failed');
+            childPrFailure = podPrOpenFailure(entry?.data, childFailure.rawError);
+          } catch { /* child ledger is optional; terminal result remains available */ }
+          childPrFailure ??= podPrOpenFailure(null, childFailure.rawError);
+        }
+        if (childPrFailure && disposition) {
+          disposition.childEvidence = {
+            ...(disposition.childEvidence ?? {}),
+            prFailure: {
+              stage: childPrFailure.prFailureStage,
+              source: childPrFailure.prFailureSource,
+              errorTail: childPrFailure.childErrorTail,
+              ...(childPrFailure.blockingPrNumber ? { blockingPrNumber: childPrFailure.blockingPrNumber } : {}),
+              ...(childPrFailure.candidateCardId ? { candidateCardId: childPrFailure.candidateCardId } : {}),
+              ...(childPrFailure.blockingCardId ? { blockingCardId: childPrFailure.blockingCardId } : {}),
+            },
+          };
+        }
         let noResultDiagnostic: string | null = null;
-        // POD-NORESULT: the Job runs with backoffLimit 0, so any non-zero child exit is «BackoffLimitExceeded» — not a reason to skip the ledger.
-        if (state === 'failed' && containerExitCode !== null && containerExitCode !== 0 && !disposition && !oomKilled && failedReason !== 'DeadlineExceeded') {
+        // POD-NORESULT: a terminal Job without a parsed disposition is incomplete even when the Job condition says Complete.
+        const noResultCandidate = !disposition && !oomKilled && failedReason !== 'DeadlineExceeded' &&
+          (state === 'complete' || (state === 'failed' && containerExitCode !== 0));
+        if (noResultCandidate) {
           try { noResultDiagnostic = podNoResultDiagnostic(readFileSync(runLedgerPath(liveChildRunId, ledgerDir), 'utf8')); }
           catch { /* ledger not returned: do not invent a stage */ }
           noResultDiagnostic ??= 'child terminal result missing; last ledger stage=unknown; round=unknown; mustFix=unknown';
         }
-        if (childFailure) debug.log('self-implement.pod', 'child-error', { job: name, stage: childFailure.stage, error: childFailure.error }, { compact: { stringMax: 500 } });
+        // POD-NORESULT-LOG-TAIL: the Job runs with backoffLimit 0, so the failed Pod — and its container log —
+        //   is collected right after this. When the child ledger cannot even name the stage, read the tail here,
+        //   before deletion, so the parent keeps a maskable reason instead of `childEvidence=null`.
+        let noResultLogEvidence: Record<string, unknown> | null = null;
+        if (noResultDiagnostic?.includes('stage=unknown')) {
+          const logRead = readPodNoResultLogTail({ run: kubectl, namespace, job: name, maxLines: POD_NO_RESULT_LOG_TAIL_LINES });
+          if ('tail' in logRead) {
+            noResultLogEvidence = { stderr: logRead.tail.join('\n'), logTail: logRead.tail, logTailLines: logRead.tail.length };
+            debug.log('self-implement.pod', 'no-result-log-tail', { job: name, childRunId: liveChildRunId, diagnostic: noResultDiagnostic, lines: logRead.tail.length, logTail: logRead.tail }, { compact: { stringMax: 500 } });
+          } else {
+            noResultLogEvidence = { stderr: `log-unavailable: ${logRead.unavailable}` };
+            debug.log('self-implement.pod', 'no-result-log-tail', { job: name, childRunId: liveChildRunId, diagnostic: noResultDiagnostic, logUnavailable: logRead.unavailable }, { level: 'warn' });
+          }
+        }
+        if (childFailure) debug.log('self-implement.pod', 'child-error', { job: name, stage: childFailure.stage, error: childFailure.error, ...(childPrFailure ?? {}) }, { compact: { stringMax: 500 } });
         if (noResultDiagnostic && !noResultDiagnostic.includes('stage=unknown')) {
           debug.log('self-implement.pod', 'no-result-ledger-diagnostic', { job: name, childRunId: liveChildRunId, diagnostic: noResultDiagnostic }, { compact: { stringMax: 500 } });
         }
@@ -2381,14 +2749,37 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           ...(state === 'failed' && !oomKilled && failedReason !== 'DeadlineExceeded'
             ? { ...(childFailure ? { childStage: childFailure.stage } : disposition?.stage ? { childStage: disposition.stage } : {}),
               // POD-NORESULT: a parsed result row without error text is not a missing result line (UX 10-07 01:01: 28 of 28 exit-2 Jobs printed one).
-              childError: childFailure?.error ?? (disposition?.stage ? 'result-without-error' : 'no-result-line') } : {}) },
-          state === 'failed' && !oomKilled && failedReason !== 'DeadlineExceeded' ? { compact: { stringMax: 500 } } : undefined);
+              childError: childFailure?.error ?? (disposition?.stage ? 'result-without-error' : 'no-result-line'),
+              ...(childPrFailure ?? {}) } : {}) },
+          (state === 'failed' && !oomKilled && failedReason !== 'DeadlineExceeded') ? { compact: { stringMax: 500 } } : undefined);
         // POD-LIFECYCLE-STAGES: one `pod.lifecycle stages` line — clone · mirror · run come from the Pod's own
-        //   `ELANOUS_POD_STAGE` markers (SI-POD-STAGE-MARKERS), read from the «full» Job log only. ⛔ No `--tail=400` fallback:
+        //   `ELANOUS_POD_STAGE` markers (SI-POD-STAGE-MARKERS), read from that Pod's full named log. ⛔ No `--tail=400` fallback:
         //   a tail can lose the real `run start` and pair a child-printed look-alike with the real `run end` (review mf) —
         //   when the full log cannot be read, every stage stays «missing».
+        let k8sTiming: ReturnType<typeof siTaskPodK8sTiming> = {};
+        try {
+          const childRunLabel = k8sLabelValue(liveChildRunId);
+          if (childRunLabel) {
+            const pods = kubectl(['-n', namespace, 'get', 'pods', '-l', `elanous.child-run=${childRunLabel}`, '-o', 'json']);
+            if (pods.status === 0) k8sTiming = siTaskPodK8sTiming(pods.stdout, childRunLabel, name, lifecycleJobUid);
+          }
+        } catch { /* observation only: keep each unavailable timestamp missing */ }
+        let lifecyclePodStages: Record<string, number> = {};
+        let lifecycleDepsSkipped: { at: number; reason: string } | undefined;
+        if (k8sTiming.podName && k8sTiming.podUid) {
+          try {
+            // The stage markers and UID must come from exactly the same Pod. `logs job/<name>`
+            // can choose another Pod when a Job has more than one attempt.
+            const podLogs = kubectl(['-n', namespace, 'logs', k8sTiming.podName, '-c', 'child']);
+            if (podLogs.status === 0) {
+              lifecyclePodStages = parseSiTaskPodStages(podLogs.stdout);
+              lifecycleDepsSkipped = parseSiTaskDepsSkipped(podLogs.stdout);
+            }
+          } catch { /* only this Pod's markers may fill lifecycle stages */ }
+        }
         emitPodLifecycle(siTaskPodLifecycleEvent({ runId: liveChildRunId, podJob: name, host: member?.context ?? null, watchStart: waitStartedAt, watchEnd: Date.now(),
-          podStages: collection.podStages ?? {}, outcome: oomKilled ? 'oom' : state }));
+          createStart: jobApplyStartedAt,
+          ...k8sTiming, podStages: lifecyclePodStages, depsSkipped: lifecycleDepsSkipped, outcome: oomKilled ? 'oom' : state }));
         if (oomKilled && reattach && !oomRetried && (!reattachedMemoryLimit || memoryGi(reattachedMemoryLimit) === null)) {
           return { exitCode: 1, output: '', error: { code: 'pod-memory-unavailable', message: `Job ${name} 실제 메모리 한도를 확인할 수 없다` } };
         }
@@ -2429,10 +2820,11 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-oom-retry-finished', data: { job: name, executionKey, fromChildRunId: retryFromChildRunId, childRunId: liveChildRunId, state } }, ledgerDir);
         }
         if (goalFile) {
+          const noResultOutcome = state === 'failed' && containerExitCode !== null && noResultDiagnostic ? 'abandoned' : 'pod-no-result';
           const record: GoalExecutionRecord = {
             runId: liveChildRunId,
             stage: (state === 'aborted' || !disposition ? 'aborted' : disposition.stage) as GoalExecutionRecord['stage'],
-            outcome: (!disposition ? noResultDiagnostic ? 'abandoned' : 'pod-no-result' : state === 'complete' && disposition.merged ? 'merged' : state === 'complete' && disposition.ok ? 'completed' : 'abandoned') as GoalExecutionRecord['outcome'],
+            outcome: (!disposition ? noResultOutcome : state === 'complete' && disposition.merged ? 'merged' : state === 'complete' && disposition.ok ? 'completed' : 'abandoned') as GoalExecutionRecord['outcome'],
             ok: state === 'complete' && (disposition?.ok ?? false),
             ...(disposition?.prNumber !== undefined ? { prNumber: disposition.prNumber } : {}),
             completedAt: new Date().toISOString(),
@@ -2440,17 +2832,50 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           try { const { appendGoalExecutionRecord } = await import('../../self-implement/orchestrator.js'); appendGoalExecutionRecord(goalFile, record); }
           catch (error) { debug.log('self-implement.pod', 'goal-record-unavailable', { job: name, childRunId: liveChildRunId, reason: error instanceof Error ? error.message : String(error) }); }
         }
-        const terminalRecord = classifyPodTerminal({ childRunId: liveChildRunId, state, disposition, env,
-          prBody: options.draftResidue ? undefined : podTerminalPrBody(disposition),
-          goalText: parentGoal ?? input.feature, at: new Date().toISOString() });
-        try { await (options.draftResidue ?? applyPodTerminal)(terminalRecord, { ledgerRunId, ledgerDir }); }
+        // The host still has the complete Pod log here. The CLI only retains a short stdout tail,
+        // so preserve the parsed child facts in the parent ledger before that tail is returned.
+        if (state === 'failed' || state === 'aborted' || noResultLogEvidence || (state === 'complete' && noResultDiagnostic !== null)) {
+          // Every terminal attempt writes a marker, including one with no parseable child facts.
+          // The next attempt must never inherit an earlier Pod's classification.
+          const childEvidence = noResultLogEvidence ?? disposition?.childEvidence ?? null;
+          try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-child-evidence', data: { childEvidence, childRunId: liveChildRunId, job: name } }, ledgerDir); }
+          catch (error) { debug.log('self-implement.pod', 'child-evidence-write-failed', { job: name, childRunId: liveChildRunId, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
+        }
+        let prLookup: OpenPrByBranch | undefined;
+        const terminalBranch = typeof disposition?.branch === 'string' ? disposition.branch.trim() : '';
+        if (disposition && (state === 'failed' || state === 'aborted' || disposition.ok === false)
+          && (!Number.isSafeInteger(disposition.prNumber) || (disposition.prNumber ?? 0) <= 0) && terminalBranch) {
+          try { prLookup = await (options.lookupOpenPrByBranch ?? defaultLookupOpenPrByBranch)(terminalBranch, repoUrl); }
+          catch { prLookup = { status: 'failed', reason: 'pr-lookup-threw' }; }
+        }
+        const terminalDisposition = prLookup?.status === 'found' && disposition
+          ? { ...disposition, prNumber: prLookup.prNumber, prUrl: prLookup.prUrl } : disposition;
+        if (prLookup?.status === 'found') debug.log('self-implement.pod', 'pr-terminal-bound-by-branch', {
+          branch: terminalBranch, prNumber: prLookup.prNumber, prUrl: prLookup.prUrl, status: 'found', job: name });
+        else if (prLookup) debug.log('self-implement.pod', 'pr-terminal-branch-lookup', {
+          branch: terminalBranch, status: prLookup.status, reason: prLookup.reason, job: name });
+        const terminalRecord = { ...classifyPodTerminal({ childRunId: liveChildRunId, state, disposition: terminalDisposition, env,
+          prBody: options.draftResidue || prLookup?.status === 'found' ? undefined : podTerminalPrBody(terminalDisposition),
+          goalText: parentGoal ?? input.feature, at: new Date().toISOString() }),
+          ...(prLookup ? { prLookup: prLookup.status === 'found' ? { status: 'found', source: 'branch-lookup' }
+            : { status: prLookup.status, reason: prLookup.reason } } : {}),
+          ...(prLookup?.status === 'found' ? { prNumberSource: 'branch-lookup' } : {}) };
+        try {
+          if (options.draftResidue) await options.draftResidue(terminalRecord, { ledgerRunId, ledgerDir });
+          else if (prLookup?.status === 'found') {
+            // This lookup only repairs the host ledger's PR identity. The draft sweeper owns PR writes.
+            const alreadyRecorded = loadRunLedger(ledgerRunId, ledgerDir)?.some((entry) =>
+              entry.event === 'pr-terminal' && entry.data.childRunId === liveChildRunId);
+            if (!alreadyRecorded) appendRunLedgerEntry({ runId: ledgerRunId, event: 'pr-terminal', data: terminalRecord }, ledgerDir);
+          } else await applyPodTerminal(terminalRecord, { ledgerRunId, ledgerDir });
+        }
         catch (error) { debug.log('draft.residue', 'failed', { childRunId: liveChildRunId, prNumber: terminalRecord.prNumber,
           terminalClass: terminalRecord.terminalClass, owner: terminalRecord.owner, ownerSource: terminalRecord.ownerSource,
           step: 'apply', reason: error instanceof Error ? error.message : String(error) }); }
         const tail = podRunResultLine(logs, salvage);
         if (state === 'aborted') return { exitCode: null, output: tail, error: { code: 'aborted', message: 'aborted — Job deleted' }, ...(disposition ? { disposition } : {}) };
         const deadlineExceeded = state === 'failed' && failedReason === 'DeadlineExceeded';
-        const deadlineSeconds = options.deadlineSeconds ?? POD_JOB_DEADLINE_SECONDS;
+        const deadlineSeconds = jobDeadlineSeconds;
         if (deadlineExceeded) {
           debug.log('self-implement.pod', 'deadline-exceeded', {
             job: name,
@@ -2465,7 +2890,10 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           : disposition;
         const podExitCode = state === 'complete' && disposition?.stage !== 'host-regate-failed' && disposition?.ok !== false ? 0 : 1;
         // SCHED-CONTRACT: a failed child must say why outside the Pod, not «no error diagnostic».
-        const podReason = podExitCode === 1 ? extractPodFailureReason({ logs, logTailReason, containerReason, jobReason: failedReason || undefined, deadlineSeconds, result: disposition ? { stage: disposition.stage, prUrl: disposition.prUrl ?? null, prNumber: disposition.prNumber ?? null } : null }) : undefined;
+        const rawPodReason = podExitCode === 1 ? extractPodFailureReason({ logs, logTailReason, containerReason, jobReason: failedReason || undefined, deadlineSeconds, result: disposition ? { stage: disposition.stage, prUrl: disposition.prUrl ?? null, prNumber: disposition.prNumber ?? null } : null }) : undefined;
+        const podReason = rawPodReason
+          ? noResultLogEvidence ? boundedPodLogText(rawPodReason, POD_NO_RESULT_LOG_REASON_MAX_CHARS) : rawPodReason
+          : undefined;
         if (podReason) debug.log('self-implement.pod', 'failure-reason', { job: name, reason: podReason });
         if (podExitCode === 1) {
           // HARNESS-FULL-GRAPH — 실패 쪽 두 노드: 결과 해석(result-parse) → 수확(salvage, Pod Job 이 push 한 줄로 판정).
@@ -2483,7 +2911,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
                 ? { error: { code: 'pod-gh-login-failed', message: `Job ${name} GitHub 앱 로그인 실패 (container=${containerReason ?? 'unknown'}/7, attempt=${ghLoginRetried ? 2 : 1}) — 새 토큰으로 ${ghLoginRetried ? '1회 재시도했으나 다시 실패' : '재시도 불가'}` } }
               : oomKilled
                 ? { error: { code: 'pod-oom-killed', message: `Job ${name} failed (OOMKilled/${containerExitCode ?? 'unknown'}, memoryLimit=${memoryLimit})${oomRetried || (memoryGi(reattachedMemoryLimit ?? memoryLimit) ?? 0) >= (memoryGi(podMemoryLimitFor(input.feature, { ...env, ELANOUS_POD_MEMORY_TIER: 'high' }).limit) ?? Infinity) ? ` — OOM · ${oomRetried ? retryTier : 'high'} 에서도` : ''}\n${formatLastMemSample(samples.at(-1))}` } }
-                : { error: { code: 'pod-job-failed', message: `Job ${name} failed${failedReason || containerReason ? ` (${[failedReason, containerReason ? `container=${containerReason}/${containerExitCode ?? 'unknown'}` : ''].filter(Boolean).join(', ')})` : ''}${childFailure ? ` — childStage=${childFailure.stage} · childError=${childFailure.error}` : disposition?.stage ? ` — childStage=${disposition.stage} · reason=${podReason}` : ` — childError=no-result-line · reason=${podReason}`}${noResultDiagnostic ? ` · ${noResultDiagnostic}` : ''}` } }
+              : { error: { code: 'pod-job-failed', message: `Job ${name} failed${failedReason || containerReason ? ` (${[failedReason, containerReason ? `container=${containerReason}/${containerExitCode ?? 'unknown'}` : ''].filter(Boolean).join(', ')})` : ''}${childFailure ? ` — childStage=${childFailure.stage} · childError=${childFailure.error}` : disposition?.stage ? ` — childStage=${disposition.stage} · reason=${podReason}` : ` — childError=no-result-line · reason=${podReason}`}${noResultDiagnostic && containerExitCode !== null ? ` · ${noResultDiagnostic}` : ''}` } }
               : podReason && !childFailure?.error ? { error: { code: 'pod-child-failed', message: podReason } } : {}),
           ...(finishedDisposition ? { disposition: finishedDisposition } : {}),
         };
@@ -2551,7 +2979,43 @@ export function recordPodSalvage(logs: string, job: string, log: (category: stri
   return rows.map((row) => row.branch);
 }
 
-function lastPodChildFailure(logs: string): { stage: string; error: string } | null {
+type PodPrOpenFailure = {
+  childErrorTail: string;
+  prFailureStage: 'pr-open-failed';
+  prFailureSource: 'child-ledger' | 'terminal-result';
+  blockingPrNumber?: number;
+  candidateCardId?: string;
+  blockingCardId?: string;
+};
+
+/** Preserve the actionable tail independently of the bounded human error. Never infer a card from a PR number. */
+function podPrOpenFailure(ledger: Record<string, unknown> | undefined | null, terminalError: string): PodPrOpenFailure | null {
+  const ledgerError = typeof ledger?.error === 'string' ? ledger.error : '';
+  // A previous rework round can leave a pr-open-failed row behind. Only a terminal PR failure may consume it.
+  if (!/draft PR 생성 실패|PR (?:gh|guard) 실패|same-cell reuse:/u.test(terminalError)) return null;
+  // The terminal must contain the complete ledger error. A shared prefix such as "same-cell"
+  // cannot distinguish an earlier rework round from the current failed attempt.
+  const matchingLedger = ledgerError.length >= 20 && terminalError.includes(ledgerError);
+  const source = terminalError || ledgerError;
+  const sanitized = redactSecretText(source).replace(/\/home\/[^/\s]+\//gu, '~/');
+  const tail = sanitized.split(/\r\n|\n|\r/u).filter(Boolean).at(-1) ?? sanitized;
+  const terminalHasIds = /(?:blockers=|blockingPr=|candidateCardId=)/u.test(terminalError);
+  const detail = `${terminalError}\n${matchingLedger ? ledgerError : ''}`;
+  const blocker = /(?:blockers=|blockingPr=)\s*#?(\d+)(?::([A-Za-z0-9_-]{1,128}))?/u.exec(detail);
+  const prNumber = blocker ? Number(blocker[1]) : null;
+  const candidate = /candidateCardId=([A-Za-z0-9_-]{1,128})/u.exec(detail)?.[1];
+  const card = blocker?.[2];
+  return {
+    childErrorTail: tail.slice(-240),
+    prFailureStage: 'pr-open-failed',
+    prFailureSource: terminalHasIds || !matchingLedger ? 'terminal-result' : 'child-ledger',
+    ...(prNumber && Number.isSafeInteger(prNumber) ? { blockingPrNumber: prNumber } : {}),
+    ...(candidate && candidate !== 'unknown' ? { candidateCardId: candidate } : {}),
+    ...(card && card !== 'unknown' ? { blockingCardId: card } : {}),
+  };
+}
+
+function lastPodChildFailure(logs: string): { stage: string; error: string; rawError: string } | null {
   for (const line of logs.split('\n').reverse()) {
     if (!line.trimStart().startsWith('{')) continue;
     let result: unknown;
@@ -2561,14 +3025,67 @@ function lastPodChildFailure(logs: string): { stage: string; error: string } | n
     const terminal = podTerminalRow(row);
     if (!terminal) continue;
     if (terminal.ok !== false || typeof terminal.error !== 'string') return null;
-    const lines = terminal.error.replace(/\/home\/[^/\s]+\//g, '~/').split(/\r\n|\n|\r/);
+    const lines = redactSecretText(terminal.error).replace(/\/home\/[^/\s]+\//g, '~/').split(/\r\n|\n|\r/);
     const first = lines[0]!.slice(0, 240);
     const last = lines.at(-1)!.slice(0, 240);
-    return { stage: terminal.stage, error: first === last ? first : `${first}\n${last}` };
+    return { stage: terminal.stage, error: first === last ? first : `${first}\n${last}`, rawError: terminal.error };
   }
   return null;
 }
 
+/** POD-NORESULT-LOG-TAIL: how many container-log lines a failed Pod leaves behind for the parent. */
+export const POD_NO_RESULT_LOG_TAIL_LINES = 80;
+const POD_NO_RESULT_LOG_TAIL_LINE_CHARS = 512;
+const POD_NO_RESULT_LOG_TAIL_MAX_CHARS = 8_192;
+const POD_NO_RESULT_LOG_REASON_MAX_CHARS = 512;
+
+function boundedPodLogText(source: string, maxChars: number): string {
+  const redacted = redactSecretText(source).replace(/[\r\n\t]+/g, ' ').replace(/\s+/g, ' ').trim();
+  return redacted.length > maxChars ? `${redacted.slice(0, maxChars)}…[truncated]` : redacted;
+}
+
+/** 로그 꼬리 — 마지막 N줄만, 한 줄씩 비밀값 마스킹. */
+export function podNoResultLogTailLines(source: string, maxLines: number = POD_NO_RESULT_LOG_TAIL_LINES): string[] {
+  const lines = source.replace(/\r\n/g, '\n').split('\n');
+  while (lines.length && lines[lines.length - 1] === '') lines.pop();
+  const result: string[] = [];
+  let chars = 0;
+  for (const line of lines.slice(-Math.max(0, maxLines)).reverse()) {
+    if (chars >= POD_NO_RESULT_LOG_TAIL_MAX_CHARS) break;
+    const bounded = boundedPodLogText(line, Math.min(POD_NO_RESULT_LOG_TAIL_LINE_CHARS, POD_NO_RESULT_LOG_TAIL_MAX_CHARS - chars));
+    if (!bounded) continue;
+    result.push(bounded);
+    chars += bounded.length;
+  }
+  return result.reverse();
+}
+
+export type PodNoResultLogRead = { tail: string[] } | { unavailable: string };
+
+/**
+ * POD-NORESULT-LOG-TAIL: the terminal Job (`backoffLimit 0`) is collected right after it fails, so the
+ * container log has to be read while the Pod still exists. Never throws — an unreadable log becomes a reason.
+ */
+export function readPodNoResultLogTail(args: {
+  run: (args: readonly string[]) => { status: number | null; stdout: string; stderr: string };
+  namespace: string;
+  job: string;
+  maxLines?: number;
+}): PodNoResultLogRead {
+  const maxLines = args.maxLines ?? POD_NO_RESULT_LOG_TAIL_LINES;
+  try {
+    const result = args.run(['-n', args.namespace, 'logs', `job/${args.job}`, `--tail=${maxLines}`]);
+    if (result.status !== 0) {
+      const reason = boundedPodLogText(result.stderr || result.stdout || '', POD_NO_RESULT_LOG_REASON_MAX_CHARS);
+      return { unavailable: reason || `kubectl logs exit ${result.status}` };
+    }
+    const tail = podNoResultLogTailLines(result.stdout, maxLines);
+    return tail.length ? { tail } : { unavailable: 'empty log output' };
+  } catch (error) {
+    return { unavailable: boundedPodLogText(error instanceof Error ? error.message : String(error), POD_NO_RESULT_LOG_REASON_MAX_CHARS) || 'unknown error' };
+  }
+}
+
 /** 사람용 런 결과 한 줄 — 수확 브랜치가 있으면 «수확할 브랜치: …» 를 붙인다. */
 export function podRunResultLine(logs: string, branches: readonly string[]): string {
   const result = logs.split('\n').filter((line) => !line.startsWith('ELANOUS_MEM ')).join('\n').slice(-4000);