elanous 0.2.35 → 0.2.37

package/src/task-agent/task-parent-role-llm.ts

@@ -0,0 +1,45 @@
+/** Parent-only role selection for Task Agent launches. The child model is a separate axis. */
+import { parseRoleLlmFlags } from '../llm/role-llm-cli.js';
+import { isModelRole, parseRoleLlmEntry, roleLlmEnvName, type ModelRole, type RoleLlmSpec } from '../user-config.js';
+
+const PARENT_ROLES = new Set<ModelRole>(['planning', 'classify', 'audit', 'review']);
+
+export function taskParentRoleEnv(values: readonly string[]): Record<string, string> {
+  const env: Record<string, string> = {};
+  for (const value of values) {
+    const at = value.indexOf('=');
+    const role = value.slice(0, at);
+    if (at < 1 || !isModelRole(role) || !PARENT_ROLES.has(role)) {
+      throw new Error(`--role-llm 부모 역할이 아니다: ${JSON.stringify(value)}`);
+    }
+    let spec: RoleLlmSpec;
+    const raw = value.slice(at + 1);
+    if (raw.startsWith('{')) {
+      let parsed: unknown;
+      try { parsed = JSON.parse(raw); }
+      catch { throw new Error(`--role-llm JSON 을 읽을 수 없다: ${role}`); }
+      const entry = parseRoleLlmEntry(parsed);
+      if (!entry.ok) throw new Error(`--role-llm ${role}: ${entry.reason}`);
+      spec = entry.spec;
+    } else {
+      const parsed = parseRoleLlmFlags([value]);
+      if (!parsed.ok) throw new Error(`--role-llm ${parsed.message}`);
+      const selected = parsed.overrides[role];
+      if (!selected) throw new Error(`--role-llm 선택한 역할이 비었다: ${role}`);
+      spec = selected;
+    }
+    const name = roleLlmEnvName(role);
+    if (env[name] !== undefined) throw new Error(`--role-llm 같은 부모 역할을 두 번 고정했다: ${role}`);
+    env[name] = JSON.stringify(spec);
+  }
+  return env;
+}
+
+/** A child model also powers planning unless the caller pinned planning explicitly. */
+export function taskParentRolePinsForChild(
+  values: readonly string[], child?: { provider: string; model: string },
+): string[] {
+  const env = taskParentRoleEnv(values);
+  if (!child || env[roleLlmEnvName('planning')] !== undefined) return [...values];
+  return [...values, `planning=${JSON.stringify({ provider: child.provider, model: child.model })}`];
+}

package/src/task-agent/tier-split.ts

@@ -6,16 +6,19 @@
  * - 분해 규칙은 TC 몫 — 여기는 그 함수를 «주입 seam» 으로 받는다. 기본 seam 은 이 파일 한 곳(`DEFAULT_TIER_SIZED_DECOMPOSE`)에서만 정한다.
  * - 분해기 «미배선»(seam 에 undefined 명시) = `decomposer-unavailable` → 종전처럼 한 덩어리 발사 ⊕ 기록. 기본 seam 은 TC 함수다.
  * - 분해 «실패»(ok:false · throw · 불가피 이유 없는 상 조각 · 빈/잘못된 조각) → 발사 0 · 카드 failed(history `tier-split-failed`).
- * - 관측: `debug.log('task-agent.hand', 'tier-split', {cid, fromTier, outcome, reason?, slices, unavoidable})`.
+ * - 관측: `debug.log('task-agent.hand', 'tier-split', {cid, fromTier, outcome, reason?, slices, unavoidable,
+ *   countScope:'accepted-slices', totalSlices, highSlices, unavoidableCount, unavoidableReasons})`.
  */
 import { randomBytes } from 'node:crypto';
+import { resolve } from 'node:path';
 import { debug } from '../debug/log.js';
-import { handTask, TASK_CARD_PREFIX, type HandTaskOptions, type HandTaskResult } from './task-hand.js';
+import { handTask, nextMoveFor, parseChildLlm, taskAgentStatePath, updateTaskCard, writeTaskCards, TASK_CARD_PREFIX, type HandTaskOptions, type HandTaskResult, type TaskCard } from './task-hand.js';
 
 // 분해 규칙·타입 정본 = TC `src/self-implement/goal-author-decompose.ts`(TIER-SIZED-DECOMPOSE · #29987).
 import { decomposeToTierSizedSlices, type SizedSlice, type TierSizedDecomposeResult } from '../self-implement/goal-author-decompose.js';
+import { DEVICE_FIRST_STEP } from '../self-implement/device-first.js';
 export type { SizedSlice, TierSizedDecomposeResult };
-export type TierSizedDecompose = (goal: string, opts?: { signal?: AbortSignal }) => Promise<TierSizedDecomposeResult>;
+export type TierSizedDecompose = (goal: string, opts?: { signal?: AbortSignal; repositoryRoot?: string }) => Promise<TierSizedDecomposeResult>;
 
 /** 기본 분해기 — TC `decomposeToTierSizedSlices`. seam 에 undefined 를 명시하면 «미배선»(decomposer-unavailable). */
 export const DEFAULT_TIER_SIZED_DECOMPOSE: TierSizedDecompose | undefined = decomposeToTierSizedSlices;
@@ -40,8 +43,11 @@ export function composeSliceHandText(sliceGoal: string, parentText: string, mark
     const label = INHERITED_PARENT_LABELS.exec(line)?.[1];
     return label !== undefined && !sliceHas.has(label);
   });
-  if (inherited.length === 0) return sliceGoal;
-  const tag = `조각 ${marker.index}/${marker.total} — 부모 ${marker.cid ?? '(칸 없음)'}(${marker.fromTier}) 를 중 이하로 나눈 몫. 아래 계약·완료 경계는 부모 칸에서 물려받았다 — 이 조각 범위만 채운다.`;
+  // 표지는 리뷰 범위를 나르므로 장치 우선 조각(총 2 이상)은 상속 줄이 없어도 남는다 —
+  // 다만 «물려받았다» 는 물려받은 줄에 대한 주장이므로 그 줄이 있을 때만 붙인다.
+  if (inherited.length === 0 && (marker.total < 2 || !sliceGoal.includes(`동작: ${DEVICE_FIRST_STEP}`))) return sliceGoal;
+  const inheritanceClaim = inherited.length > 0 ? ' 아래 계약·완료 경계는 부모 칸에서 물려받았다 — 이 조각 범위만 채운다.' : '';
+  const tag = `조각 ${marker.index}/${marker.total} — 부모 ${marker.cid ?? '(칸 없음)'}(${marker.fromTier}) 를 중 이하로 나눈 몫.${inheritanceClaim}`;
   return [...sliceLines, tag, ...inherited].join('\n');
 }
 
@@ -58,6 +64,12 @@ export function planTierSplit(result: TierSizedDecomposeResult): TierSplitPlan {
     if (!slice.goal?.trim()) return { kind: 'blocked', reason: `empty-slice-goal: #${index + 1}` };
     if (slice.tier === '상' && !slice.unavoidable?.trim()) return { kind: 'blocked', reason: `unjustified-상-slice: #${index + 1}` };
   }
+  const deviceSlices = result.slices.filter((slice) => slice.deviceFirst === 'device-test');
+  if (deviceSlices.length === 0 && result.slices.some((slice) => slice.deviceFirst === 'feature'))
+    return { kind: 'blocked', reason: 'device-first-stage-missing' };
+  if (deviceSlices.length > 0 && (deviceSlices.length !== 1 || result.slices[0]?.deviceFirst !== 'device-test'
+    || result.slices.slice(1).some((slice) => slice.deviceFirst !== 'feature')))
+    return { kind: 'blocked', reason: 'device-first-order-invalid' };
   return { kind: 'split', slices: result.slices };
 }
 
@@ -78,6 +90,14 @@ function record(data: Record<string, unknown>): void {
   try { debug.log('task-agent.hand', 'tier-split', data); } catch { /* fail-soft */ }
 }
 
+function acceptedSliceCounts(slices: readonly SizedSlice[]) {
+  const unavoidableReasons = slices.filter((slice) => slice.tier === '상').map((slice) => slice.unavoidable!.trim());
+  // planTierSplit rejects every high slice without a reason, so the accepted
+  // high count and unavoidable count coincide. Keep both for the board axes.
+  return { countScope: 'accepted-slices' as const, totalSlices: slices.length, highSlices: unavoidableReasons.length,
+    unavoidableCount: unavoidableReasons.length, unavoidableReasons };
+}
+
 /**
  * `tasks hand` 의 발사 앞단. 분해는 `--live` ⊕ tier 상|특 일 때만 — 중·하·tier 없음·shadow 는 `handTask` 그대로(분해 호출 0).
  */
@@ -88,7 +108,7 @@ export async function handTaskWithTierSplit(opts: TierSplitHandOptions): Promise
   const decompose = 'decompose' in opts ? injected : DEFAULT_TIER_SIZED_DECOMPOSE;
   const cid = hand.checklistId ?? null;
   if (!decompose) {
-    record({ cid, fromTier, outcome: 'whole', reason: TIER_SPLIT_UNAVAILABLE, slices: [], unavoidable: [] });
+    record({ cid, fromTier, outcome: 'whole', reason: TIER_SPLIT_UNAVAILABLE, slices: [], unavoidable: [], ...acceptedSliceCounts([]) });
     return { kind: 'whole', result: await handTask(hand), reason: TIER_SPLIT_UNAVAILABLE };
   }
   let plan: TierSplitPlan;
@@ -96,24 +116,74 @@ export async function handTaskWithTierSplit(opts: TierSplitHandOptions): Promise
   let timer: ReturnType<typeof setTimeout> | undefined;
   const timedOut = new Promise<'timeout'>((resolve) => { timer = setTimeout(() => { controller.abort(); resolve('timeout'); }, decomposeTimeoutMs); });
   try {
-    const raced = await Promise.race([decompose(hand.text.trim(), { signal: controller.signal }), timedOut]);
+    const raced = await Promise.race([decompose(hand.text.trim(), { signal: controller.signal,
+      ...(hand.project ? { repositoryRoot: resolve(hand.project.target) } : {}) }), timedOut]);
     plan = raced === 'timeout' ? { kind: 'blocked', reason: `decompose-timeout: ${decomposeTimeoutMs}ms` } : planTierSplit(raced);
   } catch (error) {
     plan = { kind: 'blocked', reason: `decompose-threw: ${String((error as Error)?.message ?? error).slice(0, 200)}` };
   } finally { clearTimeout(timer); }
   if (plan.kind === 'blocked') {
-    record({ cid, fromTier, outcome: 'blocked', reason: plan.reason, slices: [], unavoidable: [] });
+    record({ cid, fromTier, outcome: 'blocked', reason: plan.reason, slices: [], unavoidable: [], ...acceptedSliceCounts([]) });
     return { kind: 'blocked', result: await handTask({ ...hand, tierSplitBlocked: plan.reason }), reason: plan.reason };
   }
   const group = `${TASK_CARD_PREFIX}split-${randomBytes(4).toString('hex')}`;
   const total = plan.slices.length;
-  const unavoidable = plan.slices.filter((slice) => slice.tier === '상').map((slice) => slice.unavoidable!.trim());
+  const counts = acceptedSliceCounts(plan.slices);
+  const unavoidable = counts.unavoidableReasons;
   // 조각은 새 카드다 — 호출자 id·pr·goalId 를 조각마다 복제하면 «PR: #N» 조회·수확이 엇갈린다. 버린 것은 기록에 남긴다.
   const dropped = { ...(hand.id ? { id: hand.id } : {}), ...(hand.cardFields?.pr !== undefined ? { pr: hand.cardFields.pr } : {}), ...(hand.cardFields?.goalId !== undefined ? { goalId: hand.cardFields.goalId } : {}) };
-  record({ cid, fromTier, outcome: 'split', group, ...(Object.keys(dropped).length ? { dropped } : {}), slices: plan.slices.map((s) => ({ tier: s.tier, files: s.files, behaviours: s.behaviours })), unavoidable });
+  record({ cid, fromTier, outcome: 'split', group, ...(Object.keys(dropped).length ? { dropped } : {}), slices: plan.slices.map((s) => ({ tier: s.tier, files: s.files, behaviours: s.behaviours })), unavoidable: [...unavoidable],
+    ...counts });
   const { id: _wholeId, cardFields, ...rest } = hand;
   const base = { ...rest, ...(cardFields?.handed !== undefined ? { cardFields: { handed: cardFields.handed } } : {}) };
   const slices: TierSplitSliceOutcome[] = [];
+  // Device-first plans use the existing mission advance engine: only the test/device card starts.
+  // Feature cards carry an explicit `after` edge and `tasks advance` requires a merged PR before launch.
+  if (plan.slices[0]?.deviceFirst === 'device-test') {
+    const now = (hand.now ?? (() => new Date()))().toISOString();
+    const ids = plan.slices.map((_slice, index) => `${group}-${index + 1}`);
+    const mission: TaskCard = { id: group, text: hand.text, createdAt: now, status: 'handed', history: [],
+      pieces: ids, splitSource: 'device-first-tier-split', ...(hand.checklistId ? { checklistId: hand.checklistId } : {}),
+      ...(hand.seat ? { seat: hand.seat } : {}) };
+    const drafts: TaskCard[] = plan.slices.map((slice, index) => ({
+      id: ids[index]!, text: composeSliceHandText(slice.goal, hand.text, { index: index + 1, total, fromTier, cid }),
+      createdAt: now, status: 'handed', history: [], mission: group,
+      after: index === 0 ? [] : [ids[0]!], tier: slice.tier,
+      tierSplit: { group, fromTier, index: index + 1, total, ...(slice.tier === '상' ? { unavoidable: slice.unavoidable!.trim() } : {}) },
+      ...(hand.checklistId ? { checklistId: hand.checklistId } : {}),
+      ...(hand.seat ? { seat: hand.seat } : {}),
+      ...(hand.project ? { project: hand.project } : {}),
+      ...(hand.completion ? { completion: hand.completion } : {}),
+      ...(hand.taLand ? { taLand: true as const } : {}),
+      ...(hand.childLlm ? { childLlm: parseChildLlm(hand.childLlm, hand.childLlmEffort) } : {}),
+      ...(hand.parentRoleLlm?.length ? { parentRoleLlm: [...hand.parentRoleLlm] } : {}),
+    }));
+    writeTaskCards(hand.statePath ?? taskAgentStatePath(), [mission, ...drafts]);
+    const markFirstLaunchFailure = (reason: string) => {
+      updateTaskCard(hand.statePath ?? taskAgentStatePath(), group, (card) => card ? {
+        ...card, status: 'failed', history: [...card.history, { at: new Date().toISOString(),
+          event: 'device-first-launch-failed', detail: reason }],
+      } : undefined);
+    };
+    for (const [index, slice] of plan.slices.entries()) {
+      if (index > 0) {
+        slices.push({ slice, result: { card: drafts[index]!, move: nextMoveFor(drafts[index]!), mode: hand.live ? 'live' : 'shadow', launched: false } });
+        continue;
+      }
+      try {
+        const result = await handTask({ ...base, id: ids[0], text: drafts[0]!.text, tier: slice.tier,
+          mission: group, after: [], tierSplit: drafts[0]!.tierSplit });
+        slices.push({ slice, result });
+        if (hand.live && !result.launched) markFirstLaunchFailure(`first card not launched: ${result.card.status}`);
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        slices.push({ slice, error: reason });
+        markFirstLaunchFailure(reason);
+      }
+    }
+    record({ cid, fromTier, outcome: 'device-first-deferred', group, first: ids[0], blockedUntilLanded: ids.slice(1) });
+    return { kind: 'split', group, fromTier, slices };
+  }
   for (const [index, slice] of plan.slices.entries()) {
     try {
       const result = await handTask({ ...base, text: composeSliceHandText(slice.goal, hand.text, { index: index + 1, total, fromTier, cid }), tier: slice.tier,

package/src/task-agent/work-order.ts

@@ -11,7 +11,8 @@
  *   4. 판정 신호(`verdictSignal` — 조건·관측·기대) ⊕ 현재 계약 한 줄(`contract`)
  *   5. 경계(`boundary` — 대상 경로 · 건드리지 말 곳)
  *   6. 예산(`budget` — 시간 · 모델 티어 · Pod 자리 · 재작업 상한)
- *   7. 선행·짝 칸(`peers`)
+ *   7. 선행·짝 칸(`peers`) — 항목마다 조회된 상태(`state`)와 조회 시각(`observedAt`)을 보존한다
+ *      (칸 이름만으로는 발사 시점의 상태를 알 수 없다 · 조회하지 않은 항목은 «모름»).
  *   8. 선례 묶음(`precedents` — 같은 칸 앞 생애 결말·must-fix 서명)
  *   9. 올림 규칙(`escalation` — 무엇이면 누구에게 · 돈·보안은 대표)
  *
@@ -50,6 +51,21 @@ export interface WorkOrder {
   escalation: string;
   /** 입력에 없어 «모름»으로 채운 키. */
   unknownFields: string[];
+  /**
+   * 선행 항목별 관측 — 지시서가 선행을 배열로 적었을 때만 있다(문자열 한 줄이면 종전 그대로 없다).
+   * 항목마다 조회된 상태와 그 상태를 조회한 시각을 보존하고, 조회하지 않은 값은 «모름»이다.
+   */
+  dependencies?: WorkOrderDependency[];
+}
+
+/** 선행 칸 하나의 관측 — 칸 이름 ⊕ 조회된 상태 ⊕ 그 상태를 본 시각. */
+export interface WorkOrderDependency {
+  /** 선행 칸 id(또는 칸 이름). */
+  cell: string;
+  /** 조회된 상태(yellow·green·red …) — 조회하지 않았으면 «모름». */
+  state: string;
+  /** 상태를 조회한 시각(ISO 8601) — 조회하지 않았으면 «모름». */
+  observedAt: string;
 }
 
 export type ParseWorkOrderResult = { ok: true; order: WorkOrder } | { ok: false; reason: string };
@@ -63,6 +79,26 @@ function cellText(value: unknown): string {
   catch { return WORK_ORDER_UNKNOWN; }
 }
 
+/**
+ * 선행 칸을 항목별 관측으로 읽는다 — 배열 원소가 객체면 `state`·`observedAt` 을 보존하고,
+ * 이름만 적힌 항목(문자열 등)은 조회하지 않은 것이므로 상태·시각 모두 «모름»으로 둔다.
+ * 선행 칸이 배열이 아니면(문자열 한 줄·없음) 항목 목록은 비어 있다 — 종전 문면 그대로다.
+ */
+function parseDependencies(value: unknown): WorkOrderDependency[] {
+  if (!Array.isArray(value)) return [];
+  return value.map((item) => {
+    if (item && typeof item === 'object' && !Array.isArray(item)) {
+      const record = item as Record<string, unknown>;
+      return {
+        cell: cellText(record['cell'] ?? record['cellId']),
+        state: cellText(record['state']),
+        observedAt: cellText(record['observedAt']),
+      };
+    }
+    return { cell: cellText(item), state: WORK_ORDER_UNKNOWN, observedAt: WORK_ORDER_UNKNOWN };
+  });
+}
+
 /**
  * 지시서 JSON 원문을 검증한다. 깨진 JSON 은 `JSON 이 깨졌다: …`, 칸 id(문자열)가 없으면 `칸 id 가 없다`
  * 하나로 거부하고, 그 밖의 빠진 칸은 «모름»으로 채운다(거부 아님).
@@ -84,7 +120,21 @@ export function parseWorkOrder(source: string): ParseWorkOrderResult {
     if (value == null || (typeof value === 'string' && !value.trim())) unknownFields.push(field);
     cells[field] = text;
   }
-  return { ok: true, order: { cellId: rawCellId.trim(), ...cells, unknownFields } };
+  const dependencies = parseDependencies(record['peers']);
+  return {
+    ok: true,
+    order: {
+      cellId: rawCellId.trim(), ...cells,
+      ...(dependencies.length ? { dependencies } : {}),
+      unknownFields,
+    },
+  };
+}
+
+/** 선행 항목별 «상태 ⊕ 조회 시각» 한 줄 — 이름만 있는 항목은 «모름 (관측 모름)»으로 드러난다. */
+function renderDependencies(dependencies: WorkOrderDependency[]): string {
+  const items = dependencies.map((dep) => `${dep.cell}=${dep.state} (관측 ${dep.observedAt})`);
+  return `선행 상태: ${items.join(' · ')}`;
 }
 
 /** 검증된 지시서를 사람이 읽는 골 문면으로 펼친다 — 첫 줄 «대상 경로:»(경계), 둘째 줄 «현재 계약:». */
@@ -99,6 +149,7 @@ export function renderWorkOrderGoal(order: WorkOrder): string {
     `판정 신호: ${order.verdictSignal}`,
     `예산: ${order.budget}`,
     `선행·짝 칸: ${order.peers}`,
+    ...(order.dependencies?.length ? [renderDependencies(order.dependencies)] : []),
     `선례: ${order.precedents}`,
     `올림 규칙: ${order.escalation}`,
   ].join('\n');

package/src/task-orchestrator/dispatcher.ts

@@ -32,6 +32,7 @@ import {
   type AcceptanceReport,
 } from './acceptance.js';
 import { recordOpsEventSafe, type OpsEventInput } from '../domains/ops-log.js';
+import { defaultAnomalyCluster, extractContainerExit, type AnomalyCluster } from '../loops/orchestrator/anomaly-cluster.js';
 
 // ───────────────────────── Concurrency caps ────────────────────────
 
@@ -82,6 +83,9 @@ export interface DispatcherOptions {
    *  acceptance.checks reference fs or subprocess (file-exists /
    *  file-contains / shell-zero). */
   acceptanceIo?: AcceptanceIo;
+  /** ANOMALY-CLUSTER — grouping state written at the failure record point; while a signature has 3+ runs
+   *  and no cause verdict, relaunches of that goal·host are deferred instead of spawned. */
+  anomalyCluster?: AnomalyCluster;
 }
 
 export interface DispatchTickResult {
@@ -95,7 +99,7 @@ export interface DispatchTickResult {
   }>;
   /** Ready tasks we skipped this tick due to caps. Caller may `tick()`
    *  again after any adapter completes. */
-  deferred: Array<{ taskId: string; reason: 'cap' | 'no-adapter' | 'intake-sequential' }>;
+  deferred: Array<{ taskId: string; reason: 'cap' | 'no-adapter' | 'intake-sequential' | 'anomaly-hold' }>;
 }
 
 export class TaskDispatcher {
@@ -103,10 +107,13 @@ export class TaskDispatcher {
   private readonly activeByKind = new Map<TaskSurfaceKind, number>();
   private readonly abortByTask = new Map<string, AbortController>();
   private readonly now: () => number;
+  /** Production default is the process-wide cluster so tick-recorded failures gate relaunch here. */
+  private readonly anomaly: AnomalyCluster;
 
   constructor(private readonly opts: DispatcherOptions) {
     this.caps = { ...DEFAULT_CONCURRENCY_CAPS, ...(opts.concurrencyCaps ?? {}) };
     this.now = opts.now ?? Date.now;
+    this.anomaly = opts.anomalyCluster ?? defaultAnomalyCluster();
   }
 
   /**
@@ -147,6 +154,12 @@ export class TaskDispatcher {
         deferred.push({ taskId: task.id, reason: 'cap' });
         continue;
       }
+      // ANOMALY-CLUSTER relaunch gate: the task's goal·host relaunch is deferred while its signature has
+      // 3+ runs and no cause verdict has cleared it. Goal = task id, host = surface kind.
+      if (this.anomaly.hold(task.id, kind).hold) {
+        deferred.push({ taskId: task.id, reason: 'anomaly-hold' });
+        continue;
+      }
       const result = this.spawn(task, adapter);
       dispatched.push({
         taskId: task.id,
@@ -220,6 +233,24 @@ export class TaskDispatcher {
     }
   }
 
+  /** Records one failed attempt into the anomaly cluster (goal·host key, host excluded from signature). */
+  private recordAnomalyFailure(task: Task, observation: { runId: string; kind: string; stage: string; lastLines: string[] }): void {
+    try {
+      this.anomaly.record({
+        goal: task.id,
+        host: task.surface.kind,
+        runId: observation.runId,
+        kind: observation.kind,
+        containerExit: extractContainerExit(observation.lastLines.join('\n')),
+        stage: observation.stage,
+        lastLines: observation.lastLines,
+        at: new Date(this.now()).toISOString(),
+      });
+    } catch {
+      // Observability must not alter dispatch admission or completion.
+    }
+  }
+
   private recordOpsEvent(input: OpsEventInput): void {
     try {
       (this.opts.recordOpsEvent ?? recordOpsEventSafe)(input);
@@ -322,6 +353,8 @@ export class TaskDispatcher {
         this.recordOps(task, 'cycle_end', nextStatus, { execStatus: exec.status, durationMs: exec.durationMs });
 
         if (nextStatus === 'done') {
+          // Cause verdict — the same goal·host produced a clean run, so the relaunch hold is cleared.
+          this.anomaly.release(task.id, kind, '원인 판정: 실행이 정상 완료됨');
           this.opts.bus?.emit({
             kind: 'task-completed',
             taskId: task.id,
@@ -337,6 +370,12 @@ export class TaskDispatcher {
             reason: 'user',
           });
         } else {
+          this.recordAnomalyFailure(task, {
+            runId: exec.id,
+            kind: exec.status === 'timeout' ? 'timeout' : 'exit',
+            stage: 'monitor',
+            lastLines: [exec.error?.message ?? '', `Reason: ${exec.error?.code ?? 'UNKNOWN'}`],
+          });
           this.opts.bus?.emit({
             kind: 'task-failed',
             taskId: task.id,
@@ -368,6 +407,12 @@ export class TaskDispatcher {
         this.opts.store?.saveTask(this.opts.graph.getTask(task.id)!);
       } catch { /* ignore illegal transition */ }
       this.recordOps(task, 'cycle_end', 'failed', { errorCode: 'ADAPTER_ERROR', error: err instanceof Error ? err.message.slice(0, 120) : String(err) });
+      this.recordAnomalyFailure(task, {
+        runId: res.executionId,
+        kind: 'adapter-error',
+        stage: 'monitor',
+        lastLines: [err instanceof Error ? err.message : String(err)],
+      });
       this.opts.bus?.emit({
         kind: 'task-failed',
         taskId: task.id,

package/src/task-orchestrator/generator-prompt.ts

@@ -82,6 +82,8 @@ export function buildDecomposePrompt(
 
   const lines: string[] = [];
   const isGoalAuthorCoarse = opts.profile === 'goal-author-coarse';
+  const measuredDeviceInventory = input.context?.activeSummary?.match(/^Device inventory \(measured at goal-author repository root\): .*$/mu)?.[0];
+  const measuredDevice = measuredDeviceInventory?.match(/^Device inventory \(measured at goal-author repository root\): (missing|existing): (src\/ux-sim\/[^\s,]+)$/u);
   lines.push(
     'You are the monad-agent Task Orchestrator decomposition planner.',
     isGoalAuthorCoarse
@@ -205,6 +207,10 @@ export function buildDecomposePrompt(
       '## Device-first decomposition (DEVICE-FIRST-AUTHORING — follow strictly)',
       '### Existing device inventory (read from this checkout; use these names before proposing a new device)',
       ...deviceInventory(),
+      ...(measuredDeviceInventory
+        ? ['### Goal-author device check (measured at the target root; takes precedence over checkout inventory)',
+          measuredDeviceInventory,
+          ...(measuredDevice ? [`- Use the measured ${measuredDevice[1]} status for ${measuredDevice[2]} instead of this checkout's inventory when choosing the device branch.`] : [])] : []),
       '- The objective\'s verification plan (검증 계획/TDD) section picks a stage and ladder tier (무대·층) — e.g. a `src/ux-sim/*` stage at L2 (fake-llm·fake-bin·fake-clock). BEFORE writing slices, CHECK whether the mock device or injected event definition that this verification plan needs ALREADY EXISTS: look in `src/ux-sim/*`, the §1 device table of `docs/manual/MANUAL-ux-simulation-devices-2026-08-23.md`, and the event-monkey event kinds.',
       '- Two branches — exactly one applies per needed device:',
       '  - Device EXISTS: its name MUST go into the verification plan wording — the slice that tests the feature carries the device\'s exact name (device file / §1 table row / event kind) in its acceptance criteria and reuses the device; never re-create it.',

package/src/task-orchestrator/surfaces/pod-account-broker.ts

@@ -126,8 +126,17 @@ export function planPodAccounts(
 export function planOwnerCodexMirrorCandidates(candidates: readonly RotationCandidate[], options: {
   accountOrder: readonly string[];
   thresholdPercentByAccount?: Readonly<Record<string, unknown>>;
+  creditsAllowed?: boolean;
+  creditReserve?: number;
 }): RotationCandidate[] {
   const usable = new Set(planPodAccounts(candidates, { thresholdPercentByAccount: options.thresholdPercentByAccount }).usable);
+  // The parent has to install an access mirror before the remote Pod can use its
+  // credit fallback. Only a measured balance above the reserve admits that mirror.
+  if (usable.size === 0 && options.creditsAllowed) {
+    const reserve = typeof options.creditReserve === 'number' && Number.isFinite(options.creditReserve) && options.creditReserve >= 0
+      ? options.creditReserve : CODEX_CREDIT_RESERVE_DEFAULT;
+    return creditCandidatesByBalance(candidates, reserve);
+  }
   const rank = (name: string): number => {
     const index = options.accountOrder.indexOf(name);
     return index < 0 ? options.accountOrder.length : index;

package/src/task-orchestrator/surfaces/pod-artifact-return.ts

@@ -7,6 +7,8 @@ import { fromJsonl, type LogRecord } from '../../mss/logging/record.js';
 
 const FILE_LIMIT = 5 * 1024 * 1024;
 const TOTAL_LIMIT = 20 * 1024 * 1024;
+export const POD_SALVAGE_BUNDLE_FILE_LIMIT = 160 * 1024 * 1024;
+export const POD_SALVAGE_BUNDLE_TOTAL_LIMIT = 180 * 1024 * 1024;
 
 type Artifact = { path: string; bytes: Buffer };
 type Incomplete = { path: string; reason: string };
@@ -50,13 +52,16 @@ export function parsePodArtifactChunks(logs: string): ParseResult {
   }
   const artifacts: Artifact[] = [];
   const error: Incomplete[] = [];
-  let bytesSoFar = 0;
+  let artifactBytes = 0;
+  let salvageBundleBytes = 0;
   for (const [token, group] of groups) {
     let path = token;
     let reason = group.reason;
     try {
       path = decodePath(token);
       if (!safeRelativePath(path)) throw new Error('unsafe relative path');
+      const salvageBundle = /^pod-salvage\/[a-zA-Z0-9._-]+\.bundle$/.test(path);
+      const fileLimit = salvageBundle ? POD_SALVAGE_BUNDLE_FILE_LIMIT : FILE_LIMIT;
       if (!reason && group.chunks.size !== group.total) reason = 'missing chunk';
       if (!reason) {
         let encoded = '';
@@ -64,15 +69,20 @@ export function parsePodArtifactChunks(logs: string): ParseResult {
           const chunk = group.chunks.get(i);
           if (!chunk) { reason = 'missing chunk'; break; }
           encoded += chunk;
-          if (encoded.length > 8 * 1024 * 1024) { reason = 'file too large'; break; }
+          if (encoded.length > Math.ceil(fileLimit * 4 / 3) + 1024 * 1024) { reason = 'file too large'; break; }
         }
         if (!reason) {
           const compressed = Buffer.from(encoded, 'base64');
           if (compressed.toString('base64') !== encoded) throw new Error('invalid base64');
-          const bytes = gunzipSync(compressed, { maxOutputLength: FILE_LIMIT + 1 });
-          if (bytes.length > FILE_LIMIT) reason = 'file too large';
-          else if (bytesSoFar + bytes.length > TOTAL_LIMIT) reason = 'total too large';
-          else { artifacts.push({ path, bytes }); bytesSoFar += bytes.length; }
+          const bytes = gunzipSync(compressed, { maxOutputLength: fileLimit + 1 });
+          if (bytes.length > fileLimit) reason = 'file too large';
+          else if ((salvageBundle ? salvageBundleBytes : artifactBytes) + bytes.length >
+            (salvageBundle ? POD_SALVAGE_BUNDLE_TOTAL_LIMIT : TOTAL_LIMIT)) reason = 'total too large';
+          else {
+            artifacts.push({ path, bytes });
+            if (salvageBundle) salvageBundleBytes += bytes.length;
+            else artifactBytes += bytes.length;
+          }
         }
       }
     } catch (e) { reason = e instanceof Error ? e.message : String(e); }

package/src/task-orchestrator/surfaces/pod-child-reuse.ts

@@ -0,0 +1,146 @@
+import { decidePodReuseCleanup } from './pod-reuse-cleanup.js';
+import type { WarmWorkerKey } from './pod-warm-worker-protocol.js';
+
+/** An admitted si-v1 worker is identified by the pool, never by a Job name alone. */
+export interface ChildPodLease {
+  workerId: string;
+  podUid: string;
+  leaseId: string;
+  generation: number;
+  key: WarmWorkerKey;
+  sourceSha: string;
+}
+
+export interface ChildPodReuseCommandResult {
+  status: number | null;
+  stdout?: string;
+}
+
+export interface ChildPodCleanupReceipt {
+  clean: boolean;
+  reason: string;
+  /** Known residual lower bound; null means unmeasured surfaces and no observed residue. */
+  observedResidue: number | null;
+}
+
+/** Operations execute inside the admitted worker, after its child result and artifacts have been collected. */
+export interface ChildPodReuseOperations {
+  stopChildProcesses: (lease: ChildPodLease) => Promise<{ remaining: number }>;
+  git: (lease: ChildPodLease, args: readonly string[]) => Promise<ChildPodReuseCommandResult>;
+  removeRunCredentials: (lease: ChildPodLease) => Promise<{ remaining: number }>;
+  returnLease: (lease: ChildPodLease, receipt: ChildPodCleanupReceipt) => Promise<void>;
+  quarantine: (lease: ChildPodLease, receipt: ChildPodCleanupReceipt) => Promise<void>;
+  observe: (event: 'return-decision' | 'clean-failed' | 'quarantine-failed', data: Record<string, unknown>) => void;
+}
+
+export interface ChildPodReturnResult {
+  outcome: 'returned' | 'quarantined';
+  reason: string;
+}
+
+/**
+ * A completed child may return to the pool only after all four independent
+ * checks succeed. A missing return-decision observation also blocks return;
+ * the worker stays out of the lease pool until quarantine succeeds.
+ */
+export async function cleanAndReturnChildPod(
+  lease: ChildPodLease,
+  ops: ChildPodReuseOperations,
+): Promise<ChildPodReturnResult> {
+  const facts = { workerId: lease.workerId, podUid: lease.podUid,
+    leaseId: lease.leaseId, generation: lease.generation };
+  const log = (event: Parameters<ChildPodReuseOperations['observe']>[0], data: Record<string, unknown>) => {
+    try { ops.observe(event, { ...facts, ...data }); } catch { /* logging must not return an unsafe lease */ }
+  };
+  let reason = '';
+  let observedResidue = 0;
+  let processMeasured = false;
+  let gitMeasured = false;
+  let credentialsMeasured = false;
+  let credentialsRemoved = false;
+  try {
+    if (!lease.workerId || !lease.podUid || !lease.leaseId || !lease.key
+      || !Number.isSafeInteger(lease.generation) || lease.generation < 1
+      || !lease.key.context || !lease.key.architecture
+      || !/^sha256:[0-9a-f]{64}$/.test(lease.key.imageDigest)
+      || !/^[0-9a-f]{64}$/.test(lease.key.lockHash)
+      || !/^[0-9a-f]{40}$/.test(lease.sourceSha)) {
+      reason = 'invalid-lease';
+    } else {
+      const stopped = await ops.stopChildProcesses(lease);
+      if (Number.isSafeInteger(stopped.remaining) && stopped.remaining >= 0) {
+        observedResidue += stopped.remaining;
+        processMeasured = true;
+      }
+      if (!Number.isSafeInteger(stopped.remaining) || stopped.remaining !== 0) {
+        reason = 'child-processes-remain';
+      } else {
+        const plan = decidePodReuseCleanup({ base: lease.sourceSha, resetExitCode: 0,
+          cleanExitCode: 0, statusExitCode: 0, statusPorcelain: '' });
+        const reset = await ops.git(lease, plan.resetArgs);
+        if (reset.status !== 0) reason = 'reset-failed';
+        else {
+          const clean = await ops.git(lease, plan.cleanArgs);
+          if (clean.status !== 0) reason = 'clean-failed';
+          else {
+            const status = await ops.git(lease, plan.statusArgs);
+            if (status.status === 0 && typeof status.stdout === 'string') {
+              observedResidue += status.stdout.split('\0').filter(Boolean).length;
+              gitMeasured = true;
+            }
+            const decision = decidePodReuseCleanup({ base: lease.sourceSha,
+              resetExitCode: reset.status, cleanExitCode: clean.status,
+              statusExitCode: status.status, statusPorcelain: status.stdout ?? '' });
+            if (status.status === 0 && typeof status.stdout !== 'string') reason = 'status-unavailable';
+            else if (decision.outcome !== 'reuse') reason = decision.reason ?? 'worktree-not-clean';
+          }
+        }
+      }
+    }
+  } catch (error) {
+    reason = `cleanup-error:${error instanceof Error ? error.message : String(error)}`;
+  }
+  // A failed process or Git check never skips credential revocation.
+  try {
+    const credentials = await ops.removeRunCredentials(lease);
+    credentialsRemoved = credentials.remaining === 0;
+    if (Number.isSafeInteger(credentials.remaining) && credentials.remaining >= 0) {
+      observedResidue += credentials.remaining;
+      credentialsMeasured = true;
+    }
+    if (!credentialsRemoved && !reason) reason = 'credentials-remain';
+  } catch (error) {
+    const credentialReason = `credential-revoke-error:${error instanceof Error ? error.message : String(error)}`;
+    reason = reason ? `${reason};${credentialReason}` : credentialReason;
+  }
+  if (!reason && credentialsRemoved) {
+    try {
+      // Git clean and credential revocation can reveal child processes that appeared after the
+      // pre-cleanup survey. A lease returns clean only when the re-survey immediately before
+      // returnLease also reports zero remaining processes.
+      const resurvey = await ops.stopChildProcesses(lease);
+      if (!Number.isSafeInteger(resurvey.remaining) || resurvey.remaining !== 0) {
+        reason = 'child-processes-resurfaced';
+        if (Number.isSafeInteger(resurvey.remaining) && resurvey.remaining > 0) observedResidue += resurvey.remaining;
+      } else {
+        // Eligibility is observed only after the final process re-survey succeeds.
+        ops.observe('return-decision', { ...facts, outcome: 'eligible' });
+        await ops.returnLease(lease, { clean: true, reason: 'clean', observedResidue: 0 });
+        log('return-decision', { outcome: 'returned' });
+        return { outcome: 'returned', reason: 'clean' };
+      }
+    } catch (error) {
+      reason = `return-or-observation-error:${error instanceof Error ? error.message : String(error)}`;
+    }
+  }
+  log('clean-failed', { reason });
+  try { await ops.quarantine(lease, { clean: false, reason,
+    observedResidue: observedResidue > 0 || (processMeasured && gitMeasured && credentialsMeasured)
+      ? observedResidue : null }); }
+  catch (error) {
+    log('quarantine-failed', { reason, error: error instanceof Error ? error.message : String(error) });
+    throw error;
+  }
+  log('return-decision', { outcome: 'quarantined', reason });
+  return { outcome: 'quarantined', reason };
+}