elanous 0.2.35 → 0.2.37

package/src/task-orchestrator/surfaces/pod-ledger-collect.ts

@@ -14,6 +14,7 @@ type ParseResult = Ledger[] | { error: Incomplete[]; ledgers: Ledger[] };
 const NON_PROGRESS_EVENTS = new Set(['progress-delivery-outcome']);
 const REEMIT_EXCLUDED_PREFIX = 'progress-delivery';
 type Emit = (category: string, event: string, data: Record<string, unknown>) => void;
+export interface PodLedgerMeasurement { ledgerRead: boolean; activityMeasured: boolean }
 /** Heal-loop starter seam — defaults to the real `startHealLoop` inside `recordFailureEvent`. */
 type StartHealLoop = Parameters<typeof recordFailureEvent>[2];
 
@@ -174,7 +175,7 @@ export function createPodLedgerFollower(opts: {
   stallMinutes?: number;
   now?: () => number;
   onStall?: (message: string) => void;
-}): { poll(): void; readonly owned: boolean } {
+}): { poll(): PodLedgerMeasurement; readonly owned: boolean } {
   const dir = opts.dir ?? runLedgerDir();
   const log = opts.log ?? defaultPodReemit();
   const emit: Emit = opts.emit ?? defaultPodReemit();
@@ -208,17 +209,17 @@ export function createPodLedgerFollower(opts: {
   return {
     get owned() { return owned; },
     poll() {
-      if (disabled) return;
+      if (disabled) return { ledgerRead: true, activityMeasured: false };
       if (!owned && existsSync(path)) {
         disabled = true;
         log('self-implement.pod', 'ledger-live-skipped', { runId: opts.runId, reason: 'host-ledger-exists' });
-        return;
+        return { ledgerRead: true, activityMeasured: false };
       }
       const since = `${Math.floor(lastActivityMeasuredAt / 1000)}.${String(lastActivityMeasuredAt % 1000).padStart(3, '0')}`;
       const measurementStartedAt = now();
       const until = `${Math.floor(measurementStartedAt / 1000)}.${String(measurementStartedAt % 1000).padStart(3, '0')}`;
       const r = opts.exec(`s="\${ELANOUS_STATE_DIR:-$HOME/.elanous}"; f="$s/run-ledger/${opts.runId}.jsonl"; w="$s/worktrees"; if [ -f "$f" ]; then tail -c +${offset + 1} "$f" || exit 1; fi; target=''; matches=0; for tree in "$w"/*/*.worktrees/*; do [ -e "$tree/.git" ] || continue; owner=$(git -C "$tree" config --worktree --get elanous.harness.owner 2>/dev/null) || continue; [ "$owner" = 'dev:${opts.runId}' ] || continue; target="$tree"; matches=$((matches + 1)); done; if [ "$matches" -eq 1 ]; then activity=$(find "$target" -type d \\( -name .git -o -name node_modules \\) -prune -o -type f -newermt '@${since}' ! -newermt '@${until}' -printf . 2>/dev/null) && printf '\\nELANOUS_ACTIVITY %s\\n' "\${#activity}" || printf '\\nELANOUS_ACTIVITY_ERROR\\n'; else printf '\\nELANOUS_ACTIVITY_ERROR\\n'; fi`);
-      if (r.status !== 0) { log('self-implement.pod', 'ledger-live-unavailable', { runId: opts.runId, status: r.status, stderr: r.stderr.trim().slice(0, 200) }); checkStall(false, false); return; }
+      if (r.status !== 0) { log('self-implement.pod', 'ledger-live-unavailable', { runId: opts.runId, status: r.status, stderr: r.stderr.trim().slice(0, 200) }); checkStall(false, false); return { ledgerRead: false, activityMeasured: false }; }
       const marker = r.stdout.lastIndexOf('\nELANOUS_ACTIVITY');
       const activityLine = marker < 0 ? '' : r.stdout.slice(marker + 1);
       const activityMatch = /^ELANOUS_ACTIVITY (0|[1-9]\d*)\n$/.exec(activityLine);
@@ -241,11 +242,11 @@ export function createPodLedgerFollower(opts: {
           }
         }
       }
-      if (!ledgerBytes) { checkStall(true, activityMeasured); return; }
+      if (!ledgerBytes) { checkStall(true, activityMeasured); return { ledgerRead: true, activityMeasured }; }
       offset += Buffer.byteLength(ledgerBytes);
       const text = pending + ledgerBytes;
       const cut = text.lastIndexOf('\n');
-      if (cut < 0) { pending = text; checkStall(true, activityMeasured); return; }
+      if (cut < 0) { pending = text; checkStall(true, activityMeasured); return { ledgerRead: true, activityMeasured }; }
       const complete = text.slice(0, cut + 1);
       pending = text.slice(cut + 1);
       mkdirSync(dir, { recursive: true });
@@ -278,6 +279,7 @@ export function createPodLedgerFollower(opts: {
         nextStallMinute = stallMinutes;
       }
       checkStall(true, activityMeasured);
+      return { ledgerRead: true, activityMeasured };
     },
   };
 }

package/src/task-orchestrator/surfaces/pod-ledger-events.ts

@@ -1,3 +1,100 @@
+import { mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+/** Capture a failed Job against its recorded placement, never the caller's current kubectl context. */
+export function captureFailedPodJobs(input: {
+  runId: string;
+  job: string;
+  childRunId?: string;
+  ledgerPath: string;
+  artifactDir: string;
+  kubectl: (host: string, args: readonly string[]) => { status: number | null; stdout: string; stderr: string };
+  record: (event: string, data: Record<string, unknown>) => void;
+  now?: () => number;
+}): void {
+  const { runId, job, ledgerPath, artifactDir, kubectl, record } = input;
+  const capturedAt = new Date((input.now ?? Date.now)()).toISOString();
+  const base = { runId, job, capturedAt };
+  const finish = (outcome: 'collected' | 'failed' | 'vanished', reason: string, extra: Record<string, unknown> = {}) =>
+    record('pod-failure-capture', { ...base, ...extra, outcome, reason });
+  if (!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(job)) { finish('failed', 'job-invalid'); return; }
+  if (!/^[a-zA-Z0-9_-]+$/.test(runId)) { finish('failed', 'run-id-invalid'); return; }
+  let rows: Array<{ runId?: string; event?: string; data?: Record<string, unknown> }>;
+  try {
+    rows = readFileSync(ledgerPath, 'utf8').trim().split('\n').map(line => JSON.parse(line));
+    if (rows.some(row => !row || typeof row !== 'object' || Array.isArray(row))) throw new Error('invalid ledger row');
+  } catch { finish('failed', 'ledger-unavailable'); return; }
+  if (rows.some(row => row.runId !== runId)) { finish('failed', 'ledger-run-mismatch'); return; }
+  const placements = rows.filter(row => row.event === 'pod-job-applied' && row.data?.job === job).map(row => row.data!);
+  if (!placements.length || placements.some(p => !['host', 'context', 'namespace', 'childRunId'].every(key => typeof p[key] === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9.-]*$/.test(p[key] as string))
+    || typeof p.jobUid !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9-]*$/.test(p.jobUid))) {
+    finish('failed', 'placement-incomplete'); return;
+  }
+  const selected = input.childRunId ? placements.filter(p => p.childRunId === input.childRunId) : placements;
+  if (!selected.length) { finish('failed', 'placement-incomplete'); return; }
+  const first = selected[0]!;
+  if (placements.some(p => ['host', 'context', 'namespace'].some(key => p[key] !== first[key]))
+    || selected.some(p => ['childRunId', 'jobUid'].some(key => p[key] !== first[key]))) {
+    finish('failed', 'placement-conflict'); return;
+  }
+  const location = { host: first.host, context: first.context, namespace: first.namespace, childRunId: first.childRunId, jobUid: first.jobUid };
+  const evidenceDir = join(artifactDir, 'pod-failure-capture', runId, job, first.childRunId as string);
+  const previous = rows.find(row => row.event === 'pod-failure-capture' && row.data?.job === job && row.data?.outcome === 'collected'
+    && row.data.childRunId === first.childRunId && row.data.jobUid === first.jobUid
+    && row.data.host === first.host && row.data.context === first.context && row.data.namespace === first.namespace);
+  // A ledger row describes a prior collection; it does not guarantee that its files survived.
+  // Check all three expected paths before treating it as complete, then recapture any missing evidence.
+  if (previous && ([['jobEvidence', 'job.json'], ['podEvidence', 'pods.json'], ['logEvidence', 'child.log']] as const)
+    .every(([field, filename]) => {
+      const path = join(evidenceDir, filename);
+      if (previous.data?.[field] !== path) return false;
+      try { return statSync(path).isFile(); } catch { return false; }
+    })) return;
+  const args = ['--context', first.context as string, '-n', first.namespace as string] as const;
+  try {
+    const jobResult = kubectl(first.host as string, [...args, 'get', 'job', job, '-o', 'json']);
+    if (jobResult.status !== 0) {
+      finish(/\bNotFound\b|not found/i.test(jobResult.stderr) ? 'vanished' : 'failed',
+        /\bNotFound\b|not found/i.test(jobResult.stderr) ? 'job-not-found' : 'job-read-failed', location);
+      return;
+    }
+    const jobBody = JSON.parse(jobResult.stdout) as { metadata?: { name?: string; uid?: string } };
+    if (jobBody.metadata?.name !== job || jobBody.metadata.uid !== first.jobUid) { finish('failed', 'job-identity-mismatch', location); return; }
+    mkdirSync(evidenceDir, { recursive: true });
+    const save = (filename: string, bytes: string, sameJob?: (existing: string) => boolean): string => {
+      const path = join(evidenceDir, filename);
+      try { writeFileSync(path, bytes, { flag: 'wx', mode: 0o600 }); }
+      catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+        const existing = readFileSync(path, 'utf8');
+        if (existing !== bytes && !sameJob?.(existing)) throw error;
+      }
+      return path;
+    };
+    const jobEvidence = save('job.json', jobResult.stdout, existing => {
+      try {
+        const metadata = (JSON.parse(existing) as { metadata?: { name?: string; uid?: string } }).metadata;
+        return metadata?.name === job && metadata.uid === first.jobUid;
+      } catch { return false; }
+    });
+    const podResult = kubectl(first.host as string, [...args, 'get', 'pods', '-l', `job-name=${job}`, '-o', 'json']);
+    if (podResult.status !== 0) { finish('failed', 'pods-read-failed', { ...location, jobEvidence }); return; }
+    const pods = JSON.parse(podResult.stdout) as { items?: Array<{ metadata?: { name?: string; ownerReferences?: Array<{ uid?: string }> } }> };
+    if (!pods.items?.length || pods.items.some(p => !p.metadata?.ownerReferences?.some(owner => owner.uid === jobBody.metadata?.uid))) {
+      finish('failed', 'pod-owner-mismatch', { ...location, jobEvidence }); return;
+    }
+    const podEvidence = save('pods.json', podResult.stdout);
+    const podName = pods.items[0]?.metadata?.name;
+    if (pods.items.length !== 1 || !podName || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(podName)) {
+      finish('failed', 'pod-ambiguous', { ...location, jobEvidence, podEvidence }); return;
+    }
+    const logs = kubectl(first.host as string, [...args, 'logs', `pod/${podName}`, '-c', 'child']);
+    if (logs.status !== 0) { finish('failed', 'logs-read-failed', { ...location, jobEvidence, podEvidence }); return; }
+    const logEvidence = save('child.log', logs.stdout);
+    finish('collected', 'job-failed', { ...location, jobEvidence, podEvidence, logEvidence });
+  } catch { finish('failed', 'capture-error', location); }
+}
+
 const SECRET_FIELD = /token|secret|password|authorization|key/i;
 const SAFE_FIELD = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
 const SECRET_VALUE = /(?:\b(?:bearer|basic)\s+\S+|\b(?:token|secret|password|authorization|api[-_]?key|access[-_]?key|private[-_]?key)\b\s*(?:is|[=:])\s*["']?\S+|\b(?:sk-[A-Za-z0-9_-]{8,}|gh[pousr]_[A-Za-z0-9_]{8,}))\b/i;

package/src/task-orchestrator/surfaces/pod-manifest-test-normalize.ts

@@ -12,6 +12,17 @@ export function stablePodManifestText(applied: Array<Record<string, any>>): stri
   let snapshots = 0;
   for (const manifest of manifests) {
     if (manifest.kind !== 'Job') continue;
+    // POD-LAUNCH-PROVENANCE — the request time and the 8-char run/parent labels are per launch like the run id.
+    for (const meta of [manifest.metadata, manifest.spec?.template?.metadata]) {
+      for (const bag of [meta?.labels, meta?.annotations]) {
+        if (!bag) continue;
+        if (bag['elanous.ai/requested-at'] !== undefined) bag['elanous.ai/requested-at'] = '<requested-at>';
+        if (meta?.labels === bag) for (const key of ['elanous.ai/run', 'elanous.ai/parent']) if (bag[key] !== undefined) bag[key] = '<run-label>';
+      }
+    }
+    for (const container of manifest.spec?.template?.spec?.containers ?? []) {
+      for (const entry of container.env ?? []) if (entry.name === 'ELANOUS_POD_REQUESTED_AT') entry.value = '<requested-at>';
+    }
     for (const container of manifest.spec?.template?.spec?.containers ?? []) {
       for (const entry of container.env ?? []) {
         if (entry.name !== BUDGET_SNAPSHOT_ENV) continue;

package/src/task-orchestrator/surfaces/pod-pool.ts

@@ -89,14 +89,29 @@ function defaultLocalImageInspect(image: string): { status: number | null; stdou
   return { status: r.status, stdout: r.stdout ?? '' };
 }
 
+/** 레지스트리 안 이미지 이름 — `docker/harness/build.sh` 의 full/lite 규칙 그대로. */
+function podRegistryImageName(image: string): string {
+  return image === 'elanous-harness-lite:local' ? 'elanous-harness-lite' : 'elanous-harness';
+}
+
+/** 레지스트리 태그 = 커밋 앞 12자리 (build.sh:295 와 같은 규칙). */
+function podRegistryTag(commit: string): string {
+  return commit.slice(0, 12);
+}
+
+/** 노드 로컬 레지스트리의 HTTP 포트 — 호스트에서는 같은 포트의 localhost 로 조회한다. */
+function memberRegistryPort(member: PodPoolMember): string {
+  const registry = memberRegistry(member);
+  return registry.slice(registry.lastIndexOf(':') + 1);
+}
+
 /** 이 커밋의 이미지가 노드 레지스트리에 있나 — 있으면 클러스터 안 이미지 주소. */
 export function registryImageRef(member: PodPoolMember, commit: string | null, run: RemoteRun = defaultRemoteRun, image = 'elanous-harness:local'): string | null {
   if (!member.sshHost || !commit) return null;
-  const imageName = image === 'elanous-harness-lite:local' ? 'elanous-harness-lite' : 'elanous-harness';
-  const tag = commit.slice(0, 12);
+  const imageName = podRegistryImageName(image);
+  const tag = podRegistryTag(commit);
   const registry = memberRegistry(member);
-  const port = registry.slice(registry.lastIndexOf(':') + 1);
-  const r = run(member.sshHost, `curl -fsS --max-time 5 http://localhost:${port}/v2/${imageName}/tags/list 2>/dev/null`);
+  const r = run(member.sshHost, `curl -fsS --max-time 5 http://localhost:${memberRegistryPort(member)}/v2/${imageName}/tags/list 2>/dev/null`);
   if (r.status !== 0) return null;
   try {
     const tags = (JSON.parse(r.stdout) as { tags?: string[] }).tags ?? [];
@@ -104,6 +119,54 @@ export function registryImageRef(member: PodPoolMember, commit: string | null, r
   } catch { return null; }
 }
 
+/** 레지스트리 HTTP 한 번 — 노드에서 `curl -fsS --max-time 5`(registryImageRef 와 같은 규칙). 실패면 null. */
+function registryHttpGet(member: PodPoolMember, path: string, run: RemoteRun, accept?: string): string | null {
+  if (!member.sshHost) return null;
+  const header = accept ? `-H 'Accept: ${accept}' ` : '';
+  const r = run(member.sshHost, `curl -fsS --max-time 5 ${header}http://localhost:${memberRegistryPort(member)}/v2/${path} 2>/dev/null`);
+  return r.status === 0 && r.stdout.trim() ? r.stdout : null;
+}
+
+function registryLabelValue(raw: unknown): string | null {
+  return typeof raw === 'string' && raw.trim() && raw !== '<no value>' ? raw.trim() : null;
+}
+
+/**
+ * GATE-REGISTRY-IMAGE-FASTPATH (0.2.36): 레지스트리 HTTP 만으로 이 커밋 태그 이미지의 config label 을 읽는다 —
+ * 노드 Docker 데몬(`docker image inspect`)을 부르지 않는다. 태그 결손 · HTTP 오류 · manifest list(단일 config 없음) ·
+ * 비JSON 은 null 이다(판정하지 않고 종전 경로로 떨어진다).
+ *   GET /v2/<이미지>/manifests/<커밋12> → config.digest → GET /v2/<이미지>/blobs/<digest> → config.Labels
+ */
+export function registryImageLabels(member: PodPoolMember, image: string, commit: string | null, run: RemoteRun = defaultRemoteRun): { commit: string | null; skills: string | null } | null {
+  if (!member.sshHost || !commit) return null;
+  const imageName = podRegistryImageName(image);
+  const manifest = registryHttpGet(member, `${imageName}/manifests/${podRegistryTag(commit)}`, run, 'application/vnd.docker.distribution.manifest.v2+json');
+  if (!manifest) return null;
+  let digest: string | undefined;
+  try { digest = (JSON.parse(manifest) as { config?: { digest?: string } }).config?.digest; } catch { return null; }
+  if (!digest) return null;
+  // config digest 는 `sha256:<64 hex>` — 이 형태가 아니면 경로에 넣지 않는다.
+  if (!/^sha256:[0-9a-f]{64}$/u.test(digest)) return null;
+  const blob = registryHttpGet(member, `${imageName}/blobs/${digest}`, run);
+  if (!blob) return null;
+  let labels: Record<string, unknown> | undefined;
+  try { labels = (JSON.parse(blob) as { config?: { Labels?: Record<string, unknown> } }).config?.Labels; } catch { return null; }
+  if (!labels || typeof labels !== 'object') return null;
+  return { commit: registryLabelValue(labels['elanous.commit']), skills: registryLabelValue(labels['elanous.pod-skills']) };
+}
+
+/**
+ * 이 커밋 태그의 이미지 label 이 이번 발사 값과 모두 맞나 — 맞으면 Docker 조회 없이 그 판을 쓸 수 있다.
+ * 커밋 label 은 발사 커밋과 «정확히» 같아야 한다(태그가 다른 판을 가리키는 경우를 거른다).
+ * `localSkillsDigest` 가 없으면(모르는 값) 커밋 label 만 본다 — syncPoolImages 의 종전 skillsSame 과 같은 뜻.
+ */
+export function registryImageLabelsMatch(member: PodPoolMember, image: string, commit: string | null, opts: { localSkillsDigest?: string | null; run?: RemoteRun } = {}): boolean {
+  if (!commit) return false;
+  const labels = registryImageLabels(member, image, commit, opts.run ?? defaultRemoteRun);
+  if (!labels || labels.commit !== commit) return false;
+  return opts.localSkillsDigest == null || labels.skills === opts.localSkillsDigest;
+}
+
 /** IMAGE-ONE-SOURCE: 이 멤버의 노드에 레지스트리 컨테이너가 있나(syncPoolImages 의 판정과 같은 명령). 로컬 멤버는 false. */
 export function memberHasRegistry(member: PodPoolMember, run: RemoteRun = defaultRemoteRun): boolean {
   if (!member.sshHost) return false;
@@ -180,14 +243,27 @@ export function podWorkLabels(identity: PodWorkIdentity): Record<string, string>
   };
 }
 
-/** Minih standard-Job policy, independent of the configured pool member capacity. Not wired into allocation. */
+/**
+ * MINIH-MODE (0.2.37) — where this pool's standard Jobs run: `home` (1 standard Job) or `external` (2).
+ * The location is declared explicitly by the launch (`minihLocationFrom` reads `ELANOUS_MINIH_LOCATION`); when it
+ * is absent the configured member capacities decide, exactly as before.
+ */
 export type MinihLocation = 'home' | 'external';
 
+/** The declared location for a launch: `home` / `external` only. Absent, empty or unknown → null (configured capacity). */
+export function minihLocationFrom(value: string | undefined | null): MinihLocation | null {
+  const normalized = value?.trim().toLowerCase();
+  return normalized === 'home' || normalized === 'external' ? normalized : null;
+}
+
 export function minihStandardCapacity(location: MinihLocation): number {
   return location === 'home' ? 1 : 2;
 }
 
-/** A drain withholds new slots until occupancy falls to the target; it never evicts Running Pods. */
+/**
+ * A drain withholds new slots until occupancy falls to the target; it never evicts Running Pods.
+ * `PodPoolScheduler.tryAcquire` applies this to new standard-Job admission when a location is declared.
+ */
 export function decideMinihDrain(location: MinihLocation, runningPods: number, pendingPods = 0): {
   capacity: number;
   runningPods: number;
@@ -519,6 +595,26 @@ export class PodPoolScheduler {
       recommended: Math.min(this.members.reduce((n, item) => n + item.capacity, 0), snapshots.reduce((n, item) => n + item.recommended, 0)),
       waiting: snapshots.flatMap((item) => item.waiting) };
   }
+  /**
+   * MINIH-MODE — withhold NEW standard-Job admission while the declared location has no free standard slot.
+   * Occupancy = the measured node-c Pods (Running ⊕ Pending; a Pending Pod already holds a slot) ⊕ this process's
+   * node-c inflight slots. Nothing here deletes, evicts or re-schedules a Pod: an excess above the location's capacity
+   * leaves only as those Pods finish, and until then new admissions wait. `lite` Jobs are not the standard
+   * admission this policy gates, and no declared location keeps the configured member capacities.
+   */
+  private minihHold(kind: PodPlacementKind | null, location: MinihLocation | null, reading: Record<string, MemberOccupancy>): { capacity: number; occupied: number; draining: boolean } | null {
+    if (!location || kind === 'lite') return null;
+    // A launch pool can contain node-b and WSL beside node-c. Their Pods do not occupy node-c's physical slots.
+    const minihMembers = this.members.filter((m) => m.capacity > 0 && (m.sshHost === 'node-c' || m.context === 'pool-node-c'));
+    if (minihMembers.length === 0) return null;
+    // Lite Jobs also hold a physical node-c slot while running, even though this policy never blocks their admission.
+    const inflight = minihMembers.reduce((count, m) => count + (this.inflight.get(m.context) ?? 0), 0);
+    // The measurement reports Running and Pending as one occupied count, and decideMinihDrain judges only their sum.
+    const occupied = minihMembers
+      .reduce((count, m) => count + (reading[m.context]?.occupied ?? 0), inflight);
+    const decision = decideMinihDrain(location, occupied);
+    return decision.availableSlots > 0 ? null : { capacity: decision.capacity, occupied, draining: decision.drainNewAdmissions };
+  }
   /**
    * Pick the member with the largest free share: (capacity − measured cluster occupancy − this process's inflight) / capacity.
    * POOL-SPREAD (10-06): comparing absolute free slots always picked the big member (node-b 25 vs node-c 4), so the small
@@ -530,9 +626,10 @@ export class PodPoolScheduler {
    * member the 0.2.15 gate launched its shards one at a time.
    * Ties keep the configured member order. Returns null when every readable member is full.
    */
-  async tryAcquire(skip?: ReadonlySet<string>, onEmpty?: (reason: string) => void, mode: { selfCapped?: boolean; kind?: PodPlacementKind | null; onPlacement?: (placement: PodPlacement) => void; signal?: AbortSignal } = {}): Promise<PodPoolMember | null> {
+  async tryAcquire(skip?: ReadonlySet<string>, onEmpty?: (reason: string) => void, mode: { selfCapped?: boolean; kind?: PodPlacementKind | null; /** MINIH-MODE: a declared location gates new standard-Job admission (home 1 · external 2). */ minihLocation?: MinihLocation | null; onPlacement?: (placement: PodPlacement) => void; signal?: AbortSignal } = {}): Promise<PodPoolMember | null> {
     const selfCapped = mode.selfCapped === true;
     const kind = mode.kind ?? null;
+    const minihLocation = mode.minihLocation ?? null;
     // POOL-LITE: lite goals try the small member first, implementation goals the big one; full → overflow by free share.
     const preferred = new Set(preferredMembers(this.members, kind));
     let reading: Record<string, MemberOccupancy>;
@@ -545,6 +642,9 @@ export class PodPoolScheduler {
     }
     // A caller may abandon a slow occupancy read. Never acquire its lease after cancellation.
     if (mode.signal?.aborted) throw mode.signal.reason ?? new Error('pod pool acquisition aborted');
+    // MINIH-MODE: only node-c candidates are held. Other pool members retain their own configured capacity.
+    // Running/Pending Pods already in the pool stay exactly as they are.
+    const minihHeld = this.minihHold(kind, minihLocation, reading);
     const free: Record<string, number> = {};
     const measured: Record<string, boolean> = {};
     let best: { member: PodPoolMember; slots: number; measured: boolean; preferred: boolean } | null = null;
@@ -558,6 +658,10 @@ export class PodPoolScheduler {
     for (const m of this.members) {
       // A capacity-0 member is off — never chosen (and no division by zero in the share).
       if (m.capacity <= 0) continue;
+      if (minihHeld && (m.sshHost === 'node-c' || m.context === 'pool-node-c')) {
+        free[m.context] = 0;
+        continue;
+      }
       // LAUNCH-STALL: a member this launch cannot fit is skipped for this call only (other launches may fit it).
       if (skip?.has(m.context)) continue;
       const inflight = this.inflight.get(m.context) ?? 0;
@@ -572,7 +676,12 @@ export class PodPoolScheduler {
       if (better(cand)) best = cand;
     }
     if (!best) {
-      onEmpty?.(`no free slot · free=${JSON.stringify(free)} · measured=${JSON.stringify(measured)}${selfCapped ? ' · selfCapped' : ''}${skip?.size ? ` · skipped=${[...skip].join(',')}` : ''}${kind ? ` · kind=${kind}` : ''}`);
+      if (minihHeld) {
+        const reason = `node-c 드레인: ${minihLocation} 표준 상한 ${minihHeld.capacity} · 점유 ${minihHeld.occupied}${minihHeld.draining
+          ? ' — 초과분이 빠질 때까지 새 입장 보류(기존 Pod 유지)' : ' — 상한이 찼다'}`;
+        debug.log('pod.pool', 'node-c-drain-hold', { location: minihLocation, capacity: minihHeld.capacity, occupied: minihHeld.occupied, draining: minihHeld.draining, kind });
+        onEmpty?.(reason);
+      } else onEmpty?.(`no free slot · free=${JSON.stringify(free)} · measured=${JSON.stringify(measured)}${selfCapped ? ' · selfCapped' : ''}${skip?.size ? ` · skipped=${[...skip].join(',')}` : ''}${kind ? ` · kind=${kind}` : ''}`);
       return null;
     }
     const chosen: { member: PodPoolMember; slots: number; measured: boolean; preferred: boolean } = best;
@@ -873,6 +982,15 @@ export async function syncPoolImages(members: readonly PodPoolMember[], image: s
   await Promise.all(members.map(async (m) => {
     const t0 = Date.now();
     if (!m.sshHost) { results.set(m.context, { ok: true, action: 'local', detail: 'this machine', ms: 0 }); return; }
+    // ⭐ GATE-REGISTRY-IMAGE-FASTPATH (0.2.36 · OP): 레지스트리 커밋 태그의 config label(commit ⊕ pod-skills)이 이번 발사
+    //   값과 같으면 노드 Docker 데몬을 «한 번도» 부르지 않고 그 커밋 ref 로 끝난다 — 데몬 조회가 느려도 gate 첫 Pod 이 뜬다.
+    //   태그 결손 · label 불일치 · HTTP 오류면 아래 종전 경로(원격 inspect → 노드 빌드 → 통째 전송)가 그대로 판정한다.
+    if (localCommit && registryImageLabelsMatch(m, image, localCommit, { ...(deps.localSkillsDigest !== undefined ? { localSkillsDigest: deps.localSkillsDigest } : {}), run })) {
+      const imageRef = `${memberRegistry(m)}/${podRegistryImageName(image)}:${podRegistryTag(localCommit)}`;
+      debug.log('pod.pool', 'image-fresh-registry-label', { context: m.context, host: m.sshHost, commit: localCommit, imageRef, skills: deps.localSkillsDigest ?? null, waitedMs: 0 });
+      results.set(m.context, { ok: true, action: 'fresh', detail: localCommit.slice(0, 12), ms: Date.now() - t0, imageRef });
+      return;
+    }
     const before = remoteImageCommit(m, image, run);
     const skillsNow = deps.localSkillsDigest;
     const refBefore = registryImageRef(m, localCommit, run, image);

package/src/task-orchestrator/surfaces/pod-provenance.ts

@@ -17,6 +17,8 @@ export interface PodProvenance {
   commit?: string;
   shard?: string;
   reason?: string;
+  /** Parent runId / lease id — whose child this Pod is. Label keeps the first 8 characters like run/commit. */
+  parent?: string;
   pool?: string;
   cpuReq?: string;
   memReq?: string;
@@ -28,11 +30,15 @@ const required = ['actorKind', 'actor', 'kind', 'run', 'phase', 'requestedAt'] a
 const names: Record<keyof PodProvenance, string> = {
   actorKind: 'actor-kind', actor: 'actor', kind: 'kind', run: 'run', phase: 'phase', requestedAt: 'requested-at',
   character: 'character', launchHost: 'launch-host', entrance: 'entrance', graphNode: 'graph-node', cell: 'cell',
-  version: 'version', commit: 'commit', shard: 'shard', reason: 'reason',
+  version: 'version', commit: 'commit', shard: 'shard', reason: 'reason', parent: 'parent',
   pool: 'pool', cpuReq: 'cpu-req', memReq: 'mem-req',
   warmReused: 'warm-reused', argv: 'argv',
 };
 
+/** Every child env name the set can carry (`ELANOUS_POD_<KEY>`). */
+export const POD_PROVENANCE_ENV_NAMES: readonly string[] = Object.values(names)
+  .map((name) => `ELANOUS_POD_${name.toUpperCase().replaceAll('-', '_')}`);
+
 const labelValue = (value: string): string => {
   const cleaned = value.toLowerCase().replace(/[^a-z0-9._-]/g, '-').replace(/^[^a-z0-9]+|[^a-z0-9]+$/g, '');
   return cleaned.slice(0, 63).replace(/[^a-z0-9]+$/g, '') || 'unknown';
@@ -67,7 +73,7 @@ export function podProvenanceMetadata(input: Partial<PodProvenance> | undefined,
   const annotations: Record<string, string> = {};
   const env: Array<{ name: string; value: string }> = [];
   for (const [name, value] of Object.entries(values)) {
-    const label = name === 'run' || name === 'commit' ? value.slice(0, 8) : value;
+    const label = name === 'run' || name === 'commit' || name === 'parent' ? value.slice(0, 8) : value;
     if (name !== 'reason' && name !== 'argv') labels[`elanous.ai/${name}`] = labelValue(label);
     annotations[`elanous.ai/${name}`] = value;
     env.push({ name: `ELANOUS_POD_${name.toUpperCase().replaceAll('-', '_')}`, value });

package/src/task-orchestrator/surfaces/pod-repair-commit.ts

@@ -3,6 +3,7 @@ import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
+import { classifyGateEnvDeficit, GATE_ENV_DEFICIT_HARVESTABLE_MARK } from '../../self-implement/gate-env-retry.js';
 
 export const REPAIR_REF = 'refs/elanous/repair/result';
 export const REPAIR_BUNDLE_MAX_BYTES = 5 * 1024 * 1024;
@@ -39,15 +40,29 @@ function completedWorktree(output: string): { path: string; runId: string } {
     let value: Record<string, unknown>;
     try { value = JSON.parse(line) as Record<string, unknown>; } catch { continue; }
     if (value.kind === 'self' && value.result && typeof value.result === 'object') value = value.result as Record<string, unknown>;
-    if (value.stage !== 'worktree-completed' || value.ok !== true || typeof value.worktreePath !== 'string'
+    const completed = value.stage === 'worktree-completed' && value.ok === true;
+    // The gate could not measure an environmental failure. Keep the implementation as a
+    // bundle for the pinned PR; the parent still has to review and rejudge that head.
+    const gate = value.gate && typeof value.gate === 'object' && !Array.isArray(value.gate)
+      ? value.gate as { passed?: unknown; log?: unknown; reflectGateFacts?: { introduced?: number; unknownReason?: string; childResponsibility?: string } }
+      : null;
+    const environmentHarvest = value.stage === 'gate-failed' && value.ok === false
+      && value.harvestable === true && typeof value.detail === 'string'
+      && value.detail.includes(GATE_ENV_DEFICIT_HARVESTABLE_MARK)
+      && gate?.passed === false
+      && gate.reflectGateFacts?.introduced === 0
+      && gate.reflectGateFacts?.childResponsibility === 'none'
+      && classifyGateEnvDeficit({ passed: false, ...(typeof gate.log === 'string' ? { log: gate.log } : {}),
+        ...(gate.reflectGateFacts ? { reflectGateFacts: gate.reflectGateFacts } : {}) }).envDeficit;
+    if ((!completed && !environmentHarvest) || typeof value.worktreePath !== 'string'
       || typeof value.runId !== 'string' || !value.runId)
-      throw new Error('repair child final result is not a successful worktree-only result');
+      throw new Error('repair child final result is neither successful worktree-only nor environment-deficit harvestable');
     return { path: value.worktreePath, runId: value.runId };
   }
   throw new Error('repair child did not return a successful worktree-only result');
 }
 
-/** Called in the Pod after the child exits successfully and before artifact export. */
+/** Called in the Pod after a successful child or a verified environment-deficit harvest. */
 export function writePodRepairCommit(input: { pr: number; baseHead: string; runId: string; output: string; repo: string; outbox: string }): PodRepairResult {
   if (!Number.isSafeInteger(input.pr) || input.pr < 1 || !SHA40.test(input.baseHead)) throw new Error('invalid repair PR or base head');
   if (!input.runId.trim()) throw new Error('repair parent run id missing');

package/src/task-orchestrator/surfaces/pod-si-warm-entry.ts

@@ -0,0 +1,16 @@
+/** Opt-in SI warm entry; the ordinary Pod spawn remains the default. */
+import { podSelfImplementSpawn, type PodSpawnOptions } from './self-implement-pod.js';
+
+export async function podSpawnWithSiWarm(base: PodSpawnOptions,
+  env: NodeJS.ProcessEnv = process.env) {
+  if (env.ELANOUS_SI_WARM_REUSE !== '1') return podSelfImplementSpawn(base);
+  const { acquireSiWarmChild, postprocessSiWarmChild } = await import('./pod-si-warm-host.js');
+  return podSelfImplementSpawn({ ...base,
+    siWarmAttempt: async input => {
+      const result = await acquireSiWarmChild(input, base);
+      return result.status === 'acquired' ? result.attempt : null;
+    },
+    siWarmHostPostprocess: (result, attempt, input) =>
+      postprocessSiWarmChild(input, result, attempt, base),
+  });
+}