elanous 0.2.35 → 0.2.37

package/src/task-orchestrator/surfaces/self-implement-pod.ts

@@ -21,7 +21,8 @@ import { POD_CREDENTIAL_TOKEN_ENV, POD_CREDENTIAL_URL_ENV } from '../../grok/cre
 import { isVerifiedOpenGatewayModel } from '../../llm/opengateway-models.js';
 import { configuredOpenGatewayKeys } from '../../llm/provider-credentials.js';
 import { collectPodLedgers, createPodLedgerFollower } from './pod-ledger-collect.js';
-import { collectPodArtifacts, podNoResultDiagnostic } from './pod-artifact-return.js';
+import { captureFailedPodJobs } from './pod-ledger-events.js';
+import { collectPodArtifacts, podNoResultDiagnostic, POD_SALVAGE_BUNDLE_FILE_LIMIT, POD_SALVAGE_BUNDLE_TOTAL_LIMIT } from './pod-artifact-return.js';
 import { readPodRepairArtifact } from './pod-repair-commit.js';
 import { isValidAccountName, resolveCodexAccount } from '../../oauth/codex-account.js';
 import { createCodexAccessMirror } from '../../oauth/codex-access-mirror.js';
@@ -30,13 +31,19 @@ import { controlInboxEnv } from '../../harness/control-inbox.js';
 import { finishPodFragment, writePodFragment } from '../../harness/self-send-target.js';
 import { mintRunId, normalizeRunId } from '../../harness/harness-space.js';
 import { TA_LAND_ENV } from '../../task-agent/task-hand.js';
-import { appendRunLedgerEntry, loadRunLedger, runLedgerDir, runLedgerPath } from '../../self-implement/run-ledger.js';
+import { appendRunLedgerEntry, loadRunLedger, runLedgerDir, runLedgerPath, type RunLedgerEntry } from '../../self-implement/run-ledger.js';
+import { recordRunStop } from '../../self-implement/run-stop.js';
 import { runSuffixKey } from '../../self-implement/salvage-branches.js';
 import type { GoalExecutionRecord } from '../../self-implement/orchestrator.js';
 import { hostRepositoryUnavailable, runHostRegate, type HostRegateResult } from '../../self-implement/host-regate.js';
 import { resolvePodHostAcpReview, runPodHostAcpReview, type PodHostAcpReviewOutcome } from './pod-host-acp-review.js';
 import { REVIEW_DEFERRED_TO_HOST_ENV, REVIEW_DEFERRED_TO_HOST_MERGE_REASON } from '../../self-implement/review-deferred-to-host.js';
 import { classifyPodTerminal, applyPodTerminal, podTerminalPrBody, type PrTerminalRecord, type DraftResidueContext } from '../../self-dev/draft-residue.js';
+import { assessSiWarmReply, decideSiWarmNextStep, type SiWarmCommand, type SiWarmReply,
+  type SiWarmReturnedBytes } from './pod-si-warm-protocol.js';
+import { cleanAndReturnChildPod, type ChildPodReuseOperations } from './pod-child-reuse.js';
+import { executeSiWarmTransport, type SiWarmFixedRunner,
+  type SiWarmPodIdentity } from './pod-si-warm-transport.js';
 
 export const POD_CONTROL_INBOX_DIR = '/tmp/elanous-control.inbox';
 /** Pod Job 수명 상한(`activeDeadlineSeconds`) — 대표 2026-09-26 90분 → 180분(90분에 `DeadlineExceeded` 로 죽은 런 둘). */
@@ -59,14 +66,17 @@ export const POD_JOB_DEADLINE_SECONDS = 10_800;
 // POD-DIET (10-06 03:47~05:18 · node-b goal Pods · 89 one-minute samples · 42 Pods): per-Pod observed max median 4.6Gi ·
 // p75 6.2Gi · p90 11.7Gi — 23/42 went above the old 4Gi request, so the scheduler over-packed. 6Gi ≈ p75; limits stay.
 // Node allocatable ≈ 343Gi ≫ 25 × 6Gi. One-minute samples can miss the true peak (lower bound).
-import { podWorkLabels, type PodWorkIdentity, type PodPlacement, type PodPlacementKind, type PodPoolMember, type PodPoolScheduler } from './pod-pool.js';
+import { POD_LAUNCH_FINISHED_EVENT, POD_LAUNCH_STARTED_EVENT, provenanceRowFromAnnotations, siTaskPodProvenance } from './pod-launch-history.js';
+import { podProvenanceMetadata, type PodProvenanceMetadata } from './pod-provenance.js';
+import { packageVersion } from '../../version/code-revision.js';
+import { minihLocationFrom, podWorkLabels, type PodWorkIdentity, type PodPlacement, type PodPlacementKind, type PodPoolMember, type PodPoolScheduler } from './pod-pool.js';
 export { POD_CHILD_REQUESTS } from './pod-lease.js';
 import { measurePoolLease, recommendConcurrency, POD_CHILD_REQUESTS, POD_SI_ADMISSION_CAP_BYTES, POD_HOST_LEASE_ANNOTATION, POD_JOB_TTL_AFTER_FINISHED_SECONDS, LEASE_KUBECTL_MAX_BUFFER, memoryQuantityBytes } from './pod-lease.js';
 import { ACTUAL_SUBSTRATE_ENV, RUN_CONTRACT_ENV, carryRunContract, completionFloorFor } from '../../self-implement/graph-run-contract.js';
-import { execFile, spawnSync } from 'node:child_process';
+import { execFile, execFileSync, spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, realpathSync } from 'node:fs';
-import { homedir } from 'node:os';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
 import { isAbsolute, join, normalize, relative, resolve, sep } from 'node:path';
 import { findGitDir } from '../../git-fs/locate.js';
 import { hostLeaseBaseDir } from '../../pod-lease/host-lease.js';
@@ -97,7 +107,7 @@ import { ZAI_POD_EGRESS_LABEL, checkZaiPodSecret, countActiveZaiJobs, decideZaiP
 import { ZAI_CODING_DEFAULT_MODEL, ZAI_OPENROUTER_FALLBACK_MODEL, zaiSettingsFromConfig, type ZaiCodingPlanSettings } from '../../llm/zai-coding-plan.js';
 import { normalizePlanningFallbackReason, selectEnhanceLlm } from '../../prompt-enhance/enhance.js';
 import { inferProviderFromModel } from '../../llm.js';
-import { classifyPodExit, extractPodFailureReason, podTerminalRow, type PodExitClass } from './pod-failure-reason.js';
+import { classifyPodExit, extractPodFailureReason, podChildFailureAttribution, podTerminalRow, POD_TERMINATION_JOB_JSONPATH, POD_TERMINATION_PODS_JSONPATH, readPodTermination, type PodExitClass, type PodTermination } from './pod-failure-reason.js';
 import { kubectlTransientReason, retryKubectlTransient } from './kubectl-transient-retry.js';
 import { OLD_DOOR_STAMP_ENV } from '../../self-dev/old-door.js';
 import { resolveDefaultSourceHead, seedMirrorOnce, type MirrorSeedResult } from './pod-mirror-seed.js';
@@ -105,7 +115,22 @@ import { decideWarmReuse, type WarmReuseEvidenceByConsumer, type WarmReuseSwitch
 import type { WarmWorkerCommand } from './pod-warm-worker-protocol.js';
 import type { WarmPodTransportResult } from './pod-warm-worker-pod.js';
 
-export type Kubectl = (args: readonly string[], input?: string) => { status: number | null; stdout: string; stderr: string };
+export type Kubectl = (args: readonly string[], input?: string, timeoutMs?: number) => { status: number | null; stdout: string; stderr: string };
+
+/** TC's si-v1 transport supplies this receipt. No lease is considered reusable from a Job exit alone. */
+export interface SiWarmChildAttempt {
+  leaseFenced: boolean;
+  command: SiWarmCommand | null;
+  /** The consumer executes this fenced transport. A provider cannot assert its own reply verdict. */
+  transport: { pod: SiWarmPodIdentity; runner: SiWarmFixedRunner; now?: () => number };
+  payload: Uint8Array;
+  credentialBundle: Uint8Array;
+  /** Collect verified ledger/artifact bytes into the existing host stores. */
+  adopt: (command: SiWarmCommand, reply: SiWarmReply, bytes: SiWarmReturnedBytes) => Promise<void>;
+  cleanup: ChildPodReuseOperations;
+  /** The provider fences a worker even when a transport failure hides its command receipt. */
+  quarantineUnknown: (reason: string) => Promise<void>;
+}
 type OpenPrByBranch = { status: 'found'; prNumber: number; prUrl: string }
   | { status: 'not-found' | 'failed'; reason: string };
 
@@ -123,6 +148,13 @@ const APP_GH_AUTH_COMMAND = `bun -e '${APP_GH_AUTH_SCRIPT}'`;
 const APP_GH_EXEC = `unset GH_TOKEN GITHUB_TOKEN; GH_CONFIG_DIR="${APP_GH_CONFIG_PATH}" exec "$@"`;
 
 export interface PodSpawnOptions {
+  /** si-v1 living worker consumer. Absent means the existing one-shot Job path. */
+  siWarmAttempt?: (input: Parameters<SelfImplementJobSpawn>[0]) => Promise<SiWarmChildAttempt | null>;
+  /** POD-REUSE-SI-PROVIDER-WIRE: must apply cold-path host regate, ACP, terminal and repair checks before warm adoption. */
+  siWarmHostPostprocess?: (result: SelfImplementJobDone, attempt: SiWarmChildAttempt,
+    input: Parameters<SelfImplementJobSpawn>[0]) => Promise<SelfImplementJobDone>;
+  /** Injected test ledger; production writes to the existing run ledger. */
+  siWarmLedger?: (entry: RunLedgerEntry) => void;
   /** 이미지 판(라벨 elanous.commit) — 주입(시험·감독기가 이미 잰 값). 없으면 docker 로 잰다. */
   imageCommit?: string | null;
   /** codex 계정 이름(`~/.elanous/auth.json` 의 `openai-codex:<이름>`). 기본 team. */
@@ -198,6 +230,8 @@ export interface PodSpawnOptions {
   /** LAUNCH-STALL: ms a launch may wait in one stage before `launch-stalled` (test seam; default harness.launchStallMinutes · 15 min). */
   launchStallMs?: number;
   kubectl?: Kubectl;
+  /** Capture SSH transport test seam; host selection and placement validation remain in the production path. */
+  failureCaptureRemote?: (host: string, args: readonly string[]) => ReturnType<Kubectl>;
   /** Host-side regate (injected for Pod tests). */
   hostRegate?: (input: { prNumber: number; headCommit: string; repoRoot: string; goalFile?: string; noMerge?: true }) => Promise<HostRegateResult>;
   /** REVIEW-ACP-POD — Pod merge-ready PR 을 호스트 Claude ACP 로 리뷰한 뒤 재게이트(opt-in · 옵션 → env `ELANOUS_POD_HOST_ACP_REVIEW` → config `llm.podHostAcpReview`). */
@@ -774,6 +808,48 @@ export function podGithubWatchdogScript(staleSeconds: number, intervalSeconds =
   ].join('\n');
 }
 
+export function podSalvageBundleScript(): string {
+  return `if [ "\${rc:-0}" -ne 0 ] && grep -Eq 'draft PR 생성 실패|PR (gh|guard) 실패|same-cell reuse:' "\${ELANOUS_POD_CHILD_OUTPUT:-/tmp/si.out}"; then
+  mkdir -p "$HOME/outbox/pod-salvage"
+  found_commits=0
+  preservation_failed=0
+  bundle_bytes=0
+  worktree_rows=$(git worktree list --porcelain) || preservation_failed=1
+  while IFS= read -r wt; do
+    [ -n "$wt" ] || continue
+    git -C "$wt" rev-parse --is-inside-work-tree >/dev/null 2>&1 || { preservation_failed=1; continue; }
+    wt_name=$(basename -- "$wt")
+    case "$wt_name" in ''|.*|*/*|*'..'*) preservation_failed=1; continue ;; esac
+    base=$(git -C "$wt" rev-parse --verify '@{u}' 2>/dev/null || git -C "$wt" rev-parse --verify origin/HEAD 2>/dev/null || git -C "$wt" rev-list --max-parents=0 HEAD | tail -n 1)
+    head=$(git -C "$wt" rev-parse HEAD) || { preservation_failed=1; continue; }
+    [ -n "$base" ] || { preservation_failed=1; continue; }
+    commitCount=$(git -C "$wt" rev-list --count "$base..$head") || { preservation_failed=1; continue; }
+    if [ "$commitCount" -eq 0 ]; then continue; fi
+    found_commits=1
+    diffStats=$(git -C "$wt" diff --numstat "$base..$head") || { preservation_failed=1; continue; }
+    diffLines=$(printf '%s\\n' "$diffStats" | awk '{added += $1; removed += $2} END {print added + removed}')
+    bundle="$HOME/outbox/pod-salvage/$wt_name.bundle"
+    branch=$(git -C "$wt" symbolic-ref --quiet --short HEAD) || { preservation_failed=1; continue; }
+    if git -C "$wt" bundle create "$bundle" "refs/heads/$branch" && [ -s "$bundle" ]; then
+      size=$(( $(wc -c < "$bundle") ))
+      if [ "$size" -gt ${POD_SALVAGE_BUNDLE_FILE_LIMIT} ] || [ $((bundle_bytes + size)) -gt ${POD_SALVAGE_BUNDLE_TOTAL_LIMIT} ]; then
+        preservation_failed=1
+        rm -f -- "$bundle"
+        printf 'ELANOUS_POD_SALVAGE_FAILED size-limit %s %s %s\\n' "$wt_name" "$size" "$head"
+      else
+        bundle_bytes=$((bundle_bytes + size))
+        printf 'ELANOUS_POD_SALVAGE_BUNDLE pod-salvage/%s.bundle %s %s %s\\n' "$wt_name" "$commitCount" "$diffLines" "$head"
+      fi
+    else
+      preservation_failed=1
+      printf 'ELANOUS_POD_SALVAGE_FAILED bundle-create %s\\n' "$wt_name"
+    fi
+  done < <(printf '%s\\n' "$worktree_rows" | awk '/^worktree / {sub(/^worktree /, ""); print}')
+  if [ "$preservation_failed" -ne 0 ]; then printf 'ELANOUS_POD_SALVAGE_FAILED incomplete\\n'
+  elif [ "$found_commits" -eq 0 ]; then printf 'ELANOUS_POD_SALVAGE_NONE no-commits\\n'; fi
+fi`;
+}
+
 export function podSalvageScript(): string {
   return [
     'if [ "${rc:-0}" -ne 0 ]; then',
@@ -1116,7 +1192,7 @@ export function podSigtermTrapScript(seqFile: string = POD_USAGE_PARTIAL_SEQ_FIL
   return `trap '{ [ -n "$si_pid" ] && kill "$si_pid" 2>/dev/null || true; [ -n "\${usage_partial_pid:-}" ] && kill "$usage_partial_pid" 2>/dev/null || true; si_seq=$(cat ${seqFile} 2>/dev/null || true); case "$si_seq" in ""|*[!0-9]*) si_seq=0;; esac; si_seq=$((10#$si_seq + 1)); { [ -f scripts/usage-rollup.ts ] && bun scripts/usage-rollup.ts --since 12h --partial --seq "$si_seq"; } & si_rollup_pid=$!; for si_i in 1 2 3 4 5 6 7 8; do kill -0 "$si_rollup_pid" 2>/dev/null || break; sleep 1; done; kill "$si_rollup_pid" 2>/dev/null || true; wait "$si_rollup_pid" 2>/dev/null || true; exit 143; }' TERM`;
 }
 
-export function podJobManifest(o: { name: string; namespace: string; image: string; workIdentity?: PodWorkIdentity; boundPrNumber?: number; /** 레지스트리 이미지면 IfNotPresent(노드가 pull) · 반입 이미지면 Never. */ imagePullPolicy?: 'Never' | 'IfNotPresent'; repoUrl: string; source?: PodSource; repairCommitOnly?: { pr: number; baseHead: string }; hostMirror?: string; args: readonly string[]; passEnv: readonly string[]; deadlineSeconds: number; runId?: string; parentRunId?: string; armEnv?: Readonly<Record<string, string>>; hostId?: string; imageCommit?: string | null; skillEnvs?: readonly string[]; memoryLimit?: string; memoryRequest?: string; goalDoc?: string; /** AUTHOR-POD2 — run `harness say` on /creds/feature inside the Pod (authoring happens off the host). */ authorSentence?: boolean; authorGrade?: 'full' | 'lite'; grokCredential?: 'subscription' | 'api_key'; codexAccounts?: readonly string[]; appCredential?: boolean; /** Test seam — default POD_GH_STALE_SECONDS. */ githubStaleSeconds?: number; /** Which goal execution and attempt this Job is — a resumed host verifies it before following the Job (POD9). */ execution?: { key: string; attempt: number }; hostLeaseAdmitted?: boolean; /** POD-ROLE-LLM — OpenRouter 자식 Pod 에 리뷰어용 codex 자격을 깐다. */ reviewerCodexAuth?: boolean; /** BEDROCK-PROVIDER ② — bedrock 자식만: 이름 있는 AWS Secret 의 키(secretKeyRef) ⊕ 리전 ⊕ 이그레스 라벨. */ bedrock?: BedrockPodSpec; /** ZAI-POD-CHILD — glm(ZAI) 자식만: 이름 있는 ZAI Secret 의 키(secretKeyRef) ⊕ 이그레스·동시 상한 라벨(Pod ⊕ Job). */ zai?: ZaiPodSpec; /** Codex Job may use the same named Secret only for an explicitly admitted ZAI fallback. */ zaiFallback?: ZaiPodSpec; fallbackChain?: { steps: readonly FallbackStep[]; source: 'host' | 'default' }; /** TA-POD-WARMBOOT-PARITY — the child's final line (podResultMarkerShellLine), just before `exit $rc`. */ resultMarkerLine?: string }): Record<string, unknown> {
+export function podJobManifest(o: { name: string; namespace: string; image: string; workIdentity?: PodWorkIdentity; boundPrNumber?: number; /** 레지스트리 이미지면 IfNotPresent(노드가 pull) · 반입 이미지면 Never. */ imagePullPolicy?: 'Never' | 'IfNotPresent'; repoUrl: string; source?: PodSource; repairCommitOnly?: { pr: number; baseHead: string }; hostMirror?: string; args: readonly string[]; passEnv: readonly string[]; deadlineSeconds: number; runId?: string; parentRunId?: string; armEnv?: Readonly<Record<string, string>>; hostId?: string; imageCommit?: string | null; skillEnvs?: readonly string[]; memoryLimit?: string; memoryRequest?: string; goalDoc?: string; /** AUTHOR-POD2 — run `harness say` on /creds/feature inside the Pod (authoring happens off the host). */ authorSentence?: boolean; authorGrade?: 'full' | 'lite'; grokCredential?: 'subscription' | 'api_key'; codexAccounts?: readonly string[]; appCredential?: boolean; /** Test seam — default POD_GH_STALE_SECONDS. */ githubStaleSeconds?: number; /** Which goal execution and attempt this Job is — a resumed host verifies it before following the Job (POD9). */ execution?: { key: string; attempt: number }; hostLeaseAdmitted?: boolean; /** POD-ROLE-LLM — OpenRouter 자식 Pod 에 리뷰어용 codex 자격을 깐다. */ reviewerCodexAuth?: boolean; /** BEDROCK-PROVIDER ② — bedrock 자식만: 이름 있는 AWS Secret 의 키(secretKeyRef) ⊕ 리전 ⊕ 이그레스 라벨. */ bedrock?: BedrockPodSpec; /** ZAI-POD-CHILD — glm(ZAI) 자식만: 이름 있는 ZAI Secret 의 키(secretKeyRef) ⊕ 이그레스·동시 상한 라벨(Pod ⊕ Job). */ zai?: ZaiPodSpec; /** Codex Job may use the same named Secret only for an explicitly admitted ZAI fallback. */ zaiFallback?: ZaiPodSpec; fallbackChain?: { steps: readonly FallbackStep[]; source: 'host' | 'default' }; /** TA-POD-WARMBOOT-PARITY — the child's final line (podResultMarkerShellLine), just before `exit $rc`. */ resultMarkerLine?: string; /** POD-LAUNCH-PROVENANCE — the shared provenance set (labels ⊕ annotations ⊕ child env) for this si-task Job. */ provenance?: PodProvenanceMetadata }): Record<string, unknown> {
   if (o.repairCommitOnly && (o.source?.kind !== 'pr' || o.source.number !== o.repairCommitOnly.pr || !/^[0-9a-f]{40}$/.test(o.repairCommitOnly.baseHead) || o.args.includes('--open-pr') || o.args.includes('--merge-by-host') || o.args.includes('--auto-merge'))) {
     throw new Error('repair commit-only requires matching PR source and no PR/merge flags');
   }
@@ -1183,6 +1259,9 @@ export function podJobManifest(o: { name: string; namespace: string; image: stri
     // Record that fact before the main command, without treating clone completion as install completion.
     `printf 'ELANOUS_POD_DEPS skipped %s image-prepared-no-install\\n' "$(date +%s)" || true`,
     ...(o.repairCommitOnly ? [`[ "$(git rev-parse HEAD)" = '${o.repairCommitOnly.baseHead}' ] || { echo 'ELANOUS_POD_REPAIR_FAILED source-head-mismatch'; exit 8; }`] : []),
+    // PR checkout and, when requested, the repair HEAD pin have passed before this child starts.
+    // A supervisor input may continue the repair, but cannot launch its source again.
+    ...(o.source?.kind === 'pr' ? ['export ELANOUS_POD_VERIFIED_PR_SOURCE=1'] : []),
     ...(goalPath ? [
       `mkdir -p -- "$(dirname -- ${goalPath})" && cp -- /creds/goal-doc ${goalPath} || exit 6`,
     ] : []),
@@ -1201,13 +1280,16 @@ export function podJobManifest(o: { name: string; namespace: string; image: stri
     // AUTHOR-LITE2-POD — 등급은 환경변수 `ELANOUS_AUTHOR_GRADE` 로 싣는다(옛 Pod elanous 는 모르는 환경변수를 무시하고 full 로 돈다).
     siTaskPodStageShell('run', 'start'),
     o.repairCommitOnly
-      ? `export ${OLD_DOOR_STAMP_ENV}=self-implement; elanous self implement "$(cat /creds/feature)" --json --no-open-pr ${quoted} > /tmp/si.out 2>&1 & si_pid=$!; wait "$si_pid"; rc=$?; ${RUN_END}; if [ "$rc" -eq 0 ]; then elanous self repair-commit-export '${o.repairCommitOnly.pr}' '${o.repairCommitOnly.baseHead}' /tmp/si.out "$PWD" "$HOME/outbox" || rc=8; fi`
+      ? `export ${OLD_DOOR_STAMP_ENV}=self-implement; elanous self implement "$(cat /creds/feature)" --json --no-open-pr ${quoted} > /tmp/si.out 2>&1 & si_pid=$!; wait "$si_pid"; rc=$?; ${RUN_END}; if elanous self repair-commit-export '${o.repairCommitOnly.pr}' '${o.repairCommitOnly.baseHead}' /tmp/si.out "$PWD" "$HOME/outbox"; then rc=0; elif [ "$rc" -eq 0 ]; then rc=8; fi`
       : o.authorSentence
       ? `echo "ELANOUS_AUTHOR_ON_POD started host=$(hostname) at=$(date -u +%Y-%m-%dT%H:%M:%SZ)"; author_t0=$(date +%s); ${o.authorGrade === 'lite' || o.authorGrade === 'full' ? `ELANOUS_AUTHOR_GRADE=${o.authorGrade} ` : ''}elanous harness say --substrate local --json${quotedAsk}${quotedChildLlm} -- "$(cat /creds/feature)" > /tmp/si.out 2>&1 & si_pid=$!; wait "$si_pid"; rc=$?; ${RUN_END}; echo "ELANOUS_AUTHOR_ON_POD finished host=$(hostname) rc=$rc seconds=$(( $(date +%s) - author_t0 ))"; ${POD_RESULT_FLATTEN}`
       : goalPath
       ? `elanous harness ask ${goalPath} --json${quotedAsk}${quotedChildLlm} > /tmp/si.out 2>&1 & si_pid=$!; wait "$si_pid"; rc=$?; ${RUN_END}; ${POD_RESULT_FLATTEN}`
       : `export ${OLD_DOOR_STAMP_ENV}=self-implement; elanous self implement "$(cat /creds/feature)" --json ${quoted} > /tmp/si.out 2>&1 & si_pid=$!; wait "$si_pid"; rc=$?; ${RUN_END}; ${POD_RESULT_FLATTEN}`,
     'cat /tmp/si.out',
+    ...(o.appCredential && !o.repairCommitOnly ? ['kill "$gh_watch_pid" 2>/dev/null || true'] : []),
+    ...(o.repairCommitOnly ? [] : [podSalvageScript()]),
+    podSalvageBundleScript(),
     '[ -f scripts/usage-rollup.ts ] && bun scripts/usage-rollup.ts --since 12h || echo "ELANOUS_USAGE_ROLLUP {\"measured\":false,\"reason\":\"no rollup script\"}"',
     // A long run's log export can pass the 5MB artifact limit; skipping it whole left no window into why a
     // 2h+ child failed (🅢 09-27). Keep the newest lines under the limit instead, and say so.
@@ -1224,23 +1306,27 @@ else
 fi`,
     `set -o pipefail
 artifact_bytes=0
+salvage_bundle_bytes=0
 if [ -d "$HOME/outbox" ]; then
   while IFS= read -r -d '' file; do
     [ -f "$file" ] && [ ! -L "$file" ] || continue
     relative=\${file#"$HOME/outbox/"}
     size=$(( $(wc -c < "$file") ))
-    if [ "$size" -gt 5242880 ] || [ $((artifact_bytes + size)) -gt 20971520 ]; then
+    salvage_bundle=0
+    case "$relative" in pod-salvage/*.bundle) salvage_bundle=1 ;; esac
+    if { [ "$salvage_bundle" -eq 0 ] && { [ "$size" -gt 5242880 ] || [ $((artifact_bytes + size)) -gt 20971520 ]; }; } || { [ "$salvage_bundle" -eq 1 ] && { [ "$size" -gt ${POD_SALVAGE_BUNDLE_FILE_LIMIT} ] || [ $((salvage_bundle_bytes + size)) -gt ${POD_SALVAGE_BUNDLE_TOTAL_LIMIT} ]; }; }; then
       printf 'ELANOUS_POD_ARTIFACT_SKIPPED %s %s\\n' "$relative" "$size"
       continue
     fi
     path_token=$(printf '%s' "$relative" | base64 | tr -d '\\n' | tr '+/' '-_' | tr -d '=')
     if encoded=$(gzip -c "$file" | base64 | tr -d '\\n'); then
-      artifact_bytes=$((artifact_bytes + size))
+      if [ "$salvage_bundle" -eq 1 ]; then salvage_bundle_bytes=$((salvage_bundle_bytes + size)); else artifact_bytes=$((artifact_bytes + size)); fi
       total=$(( (\${#encoded} + 7999) / 8000 ))
-      for ((n=1; n<=total; n++)); do
-        chunk=\${encoded:$(( (n-1)*8000 )):8000}
+      n=1
+      while IFS= read -r chunk || [ -n "$chunk" ]; do
         printf 'ELANOUS_POD_ARTIFACT %s %s/%s %s\\n' "$path_token" "$n" "$total" "$chunk"
-      done
+        n=$((n + 1))
+      done < <(printf '%s' "$encoded" | fold -w 8000)
     else
       printf 'ELANOUS_POD_ARTIFACT_SKIPPED %s %s\\n' "$relative" "$size"
     fi
@@ -1263,12 +1349,10 @@ for ledger in "\${ELANOUS_STATE_DIR:-$HOME/.elanous}"/run-ledger/*.jsonl; do
 done
 if [ "$found" -eq 0 ]; then echo ELANOUS_RUN_LEDGER_NONE; fi`,
     'kill "$mem_sampler_pid" 2>/dev/null || true',
-    ...(o.appCredential && !o.repairCommitOnly ? ['kill "$gh_watch_pid" 2>/dev/null || true'] : []),
     '[ -n "${usage_partial_pid:-}" ] && kill "$usage_partial_pid" 2>/dev/null || true',
     'wait "$mem_sampler_pid" 2>/dev/null || true',
     '[ -n "${usage_partial_pid:-}" ] && wait "$usage_partial_pid" 2>/dev/null || true',
     'tail -n 1 /tmp/si.out',
-    ...(o.repairCommitOnly ? [] : [podSalvageScript()]),
     // TA-POD-WARMBOOT-PARITY: the last line says «the child is done» so the host need not wait for the Job condition.
     ...(o.resultMarkerLine ? [o.resultMarkerLine] : []),
     'exit $rc',
@@ -1276,15 +1360,15 @@ if [ "$found" -eq 0 ]; then echo ELANOUS_RUN_LEDGER_NONE; fi`,
   return {
     apiVersion: 'batch/v1',
     kind: 'Job',
-    metadata: { name: o.name, namespace: o.namespace, labels: { 'elanous.substrate': 'pod', 'elanous.job': o.name, ...podRunLabels(o), ...(o.workIdentity ? podWorkLabels(o.workIdentity) : {}), ...(o.zai || o.zaiFallback ? { [ZAI_POD_EGRESS_LABEL]: 'true' } : {}) },
-      ...((o.execution || o.hostLeaseAdmitted) ? { annotations: { ...(o.execution ? { [POD_EXECUTION_KEY_ANNOTATION]: o.execution.key, [POD_ATTEMPT_ANNOTATION]: String(o.execution.attempt) } : {}), ...(o.hostLeaseAdmitted ? { [POD_HOST_LEASE_ANNOTATION]: 'true' } : {}) } } : {}) },
+    metadata: { name: o.name, namespace: o.namespace, labels: { 'elanous.substrate': 'pod', 'elanous.job': o.name, ...podRunLabels(o), ...(o.workIdentity ? podWorkLabels(o.workIdentity) : {}), ...(o.zai || o.zaiFallback ? { [ZAI_POD_EGRESS_LABEL]: 'true' } : {}), ...o.provenance?.labels },
+      ...((o.execution || o.hostLeaseAdmitted || o.provenance) ? { annotations: { ...o.provenance?.annotations, ...(o.execution ? { [POD_EXECUTION_KEY_ANNOTATION]: o.execution.key, [POD_ATTEMPT_ANNOTATION]: String(o.execution.attempt) } : {}), ...(o.hostLeaseAdmitted ? { [POD_HOST_LEASE_ANNOTATION]: 'true' } : {}) } } : {}) },
     spec: {
       backoffLimit: 0,
       ttlSecondsAfterFinished: POD_JOB_TTL_AFTER_FINISHED_SECONDS,
       activeDeadlineSeconds: o.deadlineSeconds,
       template: {
         // ⭐ Pod 라벨 — local 팔만 `elanous.egress/local-llm` 을 단다. docker/h1/policy-local-llm.yaml 이 그 라벨에만 호스트 LLM 포트 «하나»를 연다.
-        metadata: { labels: { 'elanous.job': o.name, ...podRunLabels(o), ...(o.workIdentity ? podWorkLabels(o.workIdentity) : {}), ...(o.armEnv?.ELANOUS_LLM_PROVIDER === 'local' ? { 'elanous.egress/local-llm': 'true' } : {}), ...(o.bedrock ? { [BEDROCK_POD_EGRESS_LABEL]: 'true' } : {}), ...(o.zai || o.zaiFallback ? { [ZAI_POD_EGRESS_LABEL]: 'true' } : {}) } },
+        metadata: { labels: { 'elanous.job': o.name, ...podRunLabels(o), ...(o.workIdentity ? podWorkLabels(o.workIdentity) : {}), ...(o.armEnv?.ELANOUS_LLM_PROVIDER === 'local' ? { 'elanous.egress/local-llm': 'true' } : {}), ...(o.bedrock ? { [BEDROCK_POD_EGRESS_LABEL]: 'true' } : {}), ...(o.zai || o.zaiFallback ? { [ZAI_POD_EGRESS_LABEL]: 'true' } : {}), ...o.provenance?.labels }, ...(o.provenance ? { annotations: o.provenance.annotations } : {}) },
         spec: {
           restartPolicy: 'Never',
           securityContext: { runAsUser: 1000, fsGroup: 1000 },
@@ -1311,6 +1395,8 @@ if [ "$found" -eq 0 ]; then echo ELANOUS_RUN_LEDGER_NONE; fi`,
               { name: 'ELANOUS_POD_NAMESPACE', valueFrom: { fieldRef: { fieldPath: 'metadata.namespace' } } },
               ...(o.hostId ? [{ name: 'ELANOUS_HOST_ID', value: o.hostId }] : []),
               ...(o.imageCommit ? [{ name: 'ELANOUS_IMAGE_COMMIT', value: o.imageCommit }] : []),
+              // POD-LAUNCH-PROVENANCE — the child knows who launched it, why and when (ELANOUS_POD_<key> · no secrets).
+              ...(o.provenance?.env ?? []),
               // ⭐ 런 계약(graph-run-contract.ts) — 이 칸이 «실제로» Pod 이고, 부모가 정한 계약도 Pod 다. 안의 그래프가 노드마다 대조한다.
               { name: ACTUAL_SUBSTRATE_ENV, value: 'pod' }, { name: RUN_CONTRACT_ENV, value: carryRunContract({ substrate: 'pod' }) },
               ...Object.entries(o.armEnv ?? {}).map(([name, value]) => ({ name, value })),
@@ -1421,6 +1507,14 @@ function readJobPodImage(kubectl: Kubectl, namespace: string, job: string, jobUi
   return { podName: pod.metadata.name, podUid, podCreatedAt, imageID, digest, digestUnavailable: digest ? null : 'nonstandard-image-id' };
 }
 
+/** A repair Pod succeeds only with a verified result/bundle, even if its child gate exited 1. */
+export function repairPodExitCode(input: { state: string; repairCommitOnly: boolean; repairArtifactReady: boolean;
+  disposition?: { stage?: string; ok?: boolean } }): 0 | 1 {
+  if (input.state !== 'complete') return 1;
+  if (input.repairCommitOnly) return input.repairArtifactReady ? 0 : 1;
+  return input.disposition?.stage !== 'host-regate-failed' && input.disposition?.ok !== false ? 0 : 1;
+}
+
 export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplementJobSpawn {
   if (options.repairCommitOnly && (options.source?.kind !== 'pr' || options.source.number !== options.repairCommitOnly.pr || !/^[0-9a-f]{40}$/.test(options.repairCommitOnly.baseHead))) {
     throw new Error('repair commit-only requires a matching PR source and exact head');
@@ -1436,10 +1530,290 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
   if (hostMirror && !isAbsolute(hostMirror)) throw new Error('pod.hostMirror must be an absolute directory path');
   const hostSupervised = options.hostSupervised ?? true;
   const resultMarkerOn = options.resultMarker ?? !options.kubectl;
+  const writeWarmLedger = options.siWarmLedger
+    ?? ((entry: RunLedgerEntry) => appendRunLedgerEntry(entry, runLedgerDir(env.ELANOUS_STATE_DIR)));
   return (input) => {
     if (options.repairCommitOnly && (input.autoMerge || input.openPr || input.base !== `pr-${options.repairCommitOnly.pr}`)) {
       throw new Error('repair commit-only refuses auto merge, new PR, or a different base');
     }
+    if (options.siWarmAttempt && !options.siWarmHostPostprocess) {
+      throw new Error('si-v1 warm execution requires cold-path host postprocess parity');
+    }
+    if (options.siWarmAttempt) {
+      const done = (async (): Promise<SelfImplementJobDone> => {
+        let attempt: SiWarmChildAttempt;
+        try {
+          const acquired = await options.siWarmAttempt!(input);
+          if (!acquired) {
+            // No lease was fenced: use the existing one-shot Job path.
+            const { siWarmAttempt: _unused, siWarmHostPostprocess: _postprocess, ...coldOptions } = options;
+            return podSelfImplementSpawn(coldOptions)(input).done;
+          }
+          attempt = acquired;
+        }
+        catch (error) {
+          // A lost exec reply may conceal an already opened PR. Never start another child here.
+          const message = error instanceof Error ? error.message : String(error);
+          debug.log('pod.reuse', 'attempt-unavailable', { spaceId: input.spaceId, reason: message }, { level: 'warn' });
+          return { exitCode: 1, output: '', error: { code: 'si-warm-reconcile-only', message } };
+        }
+        let transport: Awaited<ReturnType<typeof executeSiWarmTransport>>;
+        try {
+          transport = await executeSiWarmTransport({ command: attempt.command,
+            pod: attempt.transport.pod, runner: attempt.transport.runner,
+            leaseFenced: attempt.leaseFenced, payload: attempt.payload,
+            credentialBundle: attempt.credentialBundle, now: attempt.transport.now });
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          try { await attempt.quarantineUnknown('transport-exception'); }
+          catch (quarantineError) {
+            // Both failures must survive: the first transport error names the cause, the
+            // quarantine error names the unfinished disposition. Record the judgement.
+            const quarantineMessage = quarantineError instanceof Error ? quarantineError.message : String(quarantineError);
+            const combined = `transport:${message}; quarantine:${quarantineMessage}`;
+            try { writeWarmLedger({ runId: attempt.command?.runId ?? input.spaceId,
+              event: 'pod-reuse-quarantine-failed',
+              data: { spaceId: input.spaceId, workerId: attempt.command?.workerId ?? null,
+                leaseId: attempt.command?.leaseId ?? null, reason: combined } }); }
+            catch (ledgerError) { debug.log('pod.reuse', 'ledger-unavailable', { spaceId: input.spaceId,
+              event: 'pod-reuse-quarantine-failed', reason: ledgerError instanceof Error ? ledgerError.message : String(ledgerError) }, { level: 'warn' }); }
+            debug.log('pod.reuse', 'quarantine-failed', { spaceId: input.spaceId, reason: combined }, { level: 'error' });
+            return { exitCode: 1, output: '', error: { code: 'si-warm-worker-state-unknown', message: combined } };
+          }
+          // The quarantine is confirmed: record the settled disposal (fail-soft — the
+          // disposition survives a ledger write failure) before the reconcile-only return.
+          try { writeWarmLedger({ runId: attempt.command?.runId ?? input.spaceId,
+            event: 'pod-reuse-quarantined',
+            data: { spaceId: input.spaceId, workerId: attempt.command?.workerId ?? null,
+              leaseId: attempt.command?.leaseId ?? null, reason: 'transport-exception' } }); }
+          catch (ledgerError) { debug.log('pod.reuse', 'ledger-unavailable', { spaceId: input.spaceId,
+            event: 'pod-reuse-quarantined', reason: ledgerError instanceof Error ? ledgerError.message : String(ledgerError) }, { level: 'warn' }); }
+          return { exitCode: 1, output: '', error: { code: 'si-warm-reconcile-only', message } };
+        }
+        const validation = transport.boundary === 'exec-attempted'
+          ? assessSiWarmReply(attempt.command, transport.reply, transport.bytes,
+            attempt.payload, attempt.credentialBundle)
+          : undefined;
+        const next = decideSiWarmNextStep({ boundary: transport.boundary,
+          leaseFenced: attempt.leaseFenced, ...(validation ? { validation } : {}) });
+        debug.log('pod.reuse', 'admission-decision', { spaceId: input.spaceId, boundary: transport.boundary,
+          next: next.next, reason: transport.reason, validationReason: transport.validationReason ?? null });
+        if (next.next === 'cold-job' && transport.boundary === 'not-entered' && attempt.leaseFenced) {
+          const { siWarmAttempt: _unused, ...coldOptions } = options;
+          // The acquired lease must not silently ride along into a cold Job: dispose it first,
+          // record the disposition, and refuse to start the cold Job when disposal fails.
+          const coldLease = attempt.command ? { workerId: attempt.command.workerId,
+            podUid: attempt.command.podUid, leaseId: attempt.command.leaseId,
+            generation: attempt.command.generation, key: attempt.command.key,
+            sourceSha: attempt.command.sourceSha } : null;
+          if (coldLease) {
+            const recordColdDisposition = (event: string, action: string, residue: Record<string, unknown> = {}) => {
+              debug.log('pod.reuse', event, { spaceId: input.spaceId, workerId: coldLease.workerId,
+                leaseId: coldLease.leaseId, action, reason: transport.reason, ...residue });
+              try { writeWarmLedger({ runId: attempt.command?.runId ?? input.spaceId, event,
+                data: { spaceId: input.spaceId, workerId: coldLease.workerId, leaseId: coldLease.leaseId,
+                  action, reason: transport.reason, ...residue } }); }
+              catch (error) { debug.log('pod.reuse', 'ledger-unavailable', { spaceId: input.spaceId, event,
+                reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
+            };
+            try {
+              // The acquired lease is disposed by the same eligibility standard as the
+              // entered path: process count zero, pinned-source git reset/clean/status,
+              // credential count zero, and an observable return decision — before the
+              // lease can go back into the warm pool or a cold Job starts.
+              const returned = await cleanAndReturnChildPod(coldLease, { ...attempt.cleanup,
+                observe: (event, data) => {
+                  debug.log('pod.reuse', event, { spaceId: input.spaceId, ...data },
+                    { level: event === 'return-decision'
+                      && ((data as { outcome?: string }).outcome === 'eligible'
+                        || (data as { outcome?: string }).outcome === 'returned') ? 'info' : 'warn' });
+                  attempt.cleanup.observe(event, data);
+                  // A ledger write failure is an observation failure: the settled return
+                  // or quarantine disposition must survive it (fail-soft after the decision).
+                  try { writeWarmLedger({ runId: attempt.command?.runId ?? input.spaceId,
+                    event: `pod-reuse-${event}`,
+                    data: { spaceId: input.spaceId, ...data } }); }
+                  catch (ledgerError) { debug.log('pod.reuse', 'ledger-unavailable', { spaceId: input.spaceId,
+                    runId: attempt.command?.runId ?? input.spaceId, event: `pod-reuse-${event}`,
+                    reason: ledgerError instanceof Error ? ledgerError.message : String(ledgerError) },
+                    { level: 'warn' }); }
+                } });
+              recordColdDisposition('pod-reuse-cold-fallback-dispose', returned.outcome,
+                { dispositionReason: returned.reason });
+            } catch (error) {
+              const message = error instanceof Error ? error.message : String(error);
+              try { await attempt.cleanup.quarantine(coldLease, { clean: false, reason: 'cold-fallback-dispose-failed', observedResidue: null }); }
+              catch (quarantineError) {
+                const quarantineMessage = quarantineError instanceof Error ? quarantineError.message : String(quarantineError);
+                recordColdDisposition('pod-reuse-cold-fallback-dispose-failed', 'quarantine-failed',
+                  { error: `disposal:${message}; quarantine:${quarantineMessage}` });
+                return { exitCode: 1, output: '', error: { code: 'si-warm-worker-state-unknown',
+                  message: `disposal:${message}; quarantine:${quarantineMessage}` } };
+              }
+              recordColdDisposition('pod-reuse-cold-fallback-dispose-failed', 'quarantined', { error: message });
+              return { exitCode: 1, output: '', error: { code: 'si-warm-worker-state-unknown', message } };
+            }
+          }
+          return podSelfImplementSpawn(coldOptions)(input).done;
+        }
+        const command = attempt.command;
+        const lease = command && { workerId: command.workerId, podUid: command.podUid,
+          leaseId: command.leaseId, generation: command.generation, key: command.key,
+          sourceSha: command.sourceSha };
+        const recordQuarantine = (event: string, reason: string, residue: Record<string, unknown> = {}) => {
+          debug.log('pod.reuse', event, { spaceId: input.spaceId, workerId: command?.workerId ?? null,
+            leaseId: command?.leaseId ?? null, reason, ...residue }, { level: 'warn' });
+          try { writeWarmLedger({ runId: command?.runId ?? input.spaceId, event,
+            data: { spaceId: input.spaceId, workerId: command?.workerId ?? null,
+              leaseId: command?.leaseId ?? null, reason, ...residue } }); }
+          catch (error) { debug.log('pod.reuse', 'ledger-unavailable', { spaceId: input.spaceId,
+            event, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
+        };
+        const retireLease = async (reason: string) => {
+          recordQuarantine('pod-reuse-quarantine-intent', reason);
+          if (!lease) {
+            try { await attempt.quarantineUnknown(reason); }
+            catch (error) {
+              // The unsettled quarantine is an account of its own: keep both the
+              // primary path reason and the quarantine cause in the run ledger,
+              // then let the caller surface the unknown worker state.
+              const message = error instanceof Error ? error.message : String(error);
+              recordQuarantine('pod-reuse-quarantine-failed', `${reason}; quarantine:${message}`);
+              throw error;
+            }
+            recordQuarantine('pod-reuse-quarantined', reason);
+            return;
+          }
+          // An uncertain exec may still be running. Keep it fenced and revoke its run credentials.
+          let processRemaining: number | null = null;
+          let credentialRemaining: number | null = null;
+          try { processRemaining = (await attempt.cleanup.stopChildProcesses(lease)).remaining; }
+          catch (error) { debug.log('pod.reuse', 'process-stop-failed', { spaceId: input.spaceId,
+            reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
+          try { credentialRemaining = (await attempt.cleanup.removeRunCredentials(lease)).remaining; }
+          catch (error) { debug.log('pod.reuse', 'credential-revoke-failed', { spaceId: input.spaceId,
+            reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
+          const observedResidue = [processRemaining, credentialRemaining]
+            .filter((value): value is number => typeof value === 'number'
+              && Number.isSafeInteger(value) && value >= 0)
+            .reduce((sum, value) => sum + value, 0);
+          try {
+            await attempt.cleanup.quarantine(lease, { clean: false, reason,
+              observedResidue: observedResidue > 0 ? observedResidue : null });
+          } catch (error) {
+            // The lease stays unfenced and the worker state unknown: record the
+            // unsettled disposal (primary reason plus the quarantine cause)
+            // before the caller reports the unknown worker state.
+            const message = error instanceof Error ? error.message : String(error);
+            recordQuarantine('pod-reuse-quarantine-failed', `${reason}; quarantine:${message}`);
+            throw error;
+          }
+          recordQuarantine('pod-reuse-quarantined', reason, { processRemaining, credentialRemaining });
+        };
+        if (next.next !== 'adopt-warm' || !transport.measured || !command
+          || !transport.reply || !transport.bytes) {
+          const reconcileDisposition = transport.verifiedBytesForReconcile
+            ? parseSelfImplementJson(new TextDecoder().decode(transport.verifiedBytesForReconcile.terminal))
+            : null;
+          const hostDisposition = reconcileDisposition ? (({ worktreePath: _podOnly, ...host }) => host)(reconcileDisposition) : null;
+          let quarantineError: string | undefined;
+          try { await retireLease(validation?.reason ?? 'response-unknown'); }
+          catch (error) { debug.log('pod.reuse', 'quarantine-failed', { spaceId: input.spaceId,
+            reason: error instanceof Error ? error.message : String(error) }, { level: 'error' });
+            quarantineError = error instanceof Error ? error.message : String(error); }
+          return { exitCode: 1, output: '',
+            ...(hostDisposition ? { disposition: hostDisposition } : {}),
+            error: { code: quarantineError
+            || (transport.quarantineWorker && !transport.quarantineRecorded)
+            ? 'si-warm-worker-state-unknown' : 'si-warm-reconcile-only',
+            message: `si-v1 exec may have run; reconcile before retry (${transport.reason})${transport.quarantineError ? `; transport quarantine: ${transport.quarantineError}` : ''}${quarantineError ? `; worker-state-unknown: ${quarantineError}` : ''}` } };
+        }
+        const terminal = new TextDecoder().decode(transport.bytes.terminal);
+        const disposition = parseSelfImplementJson(terminal);
+        if (!disposition) {
+          let quarantineError: string | undefined;
+          try { await retireLease('terminal-disposition-unreadable'); }
+          catch (error) { debug.log('pod.reuse', 'quarantine-failed', { spaceId: input.spaceId,
+            reason: error instanceof Error ? error.message : String(error) }, { level: 'error' });
+            quarantineError = error instanceof Error ? error.message : String(error); }
+          return { exitCode: 1, output: '', error: { code: quarantineError
+            ? 'si-warm-worker-state-unknown' : 'si-warm-terminal-unreadable',
+            message: quarantineError ?? 'validated si-v1 terminal was not a self-implement disposition' } };
+        }
+        try { await attempt.adopt(command, transport.reply, transport.bytes); }
+        catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          let quarantineError: string | undefined;
+          try { await retireLease('adopt-failed'); }
+          catch (quarantineFailure) { debug.log('pod.reuse', 'quarantine-failed', { spaceId: input.spaceId,
+            reason: quarantineFailure instanceof Error ? quarantineFailure.message : String(quarantineFailure) }, { level: 'error' });
+            quarantineError = quarantineFailure instanceof Error ? quarantineFailure.message : String(quarantineFailure); }
+          debug.log('pod.reuse', 'adopt-failed', { spaceId: input.spaceId, reason: message }, { level: 'warn' });
+          return { exitCode: 1, output: '', disposition, error: { code: quarantineError
+            ? 'si-warm-worker-state-unknown' : 'si-warm-reconcile-only', message: quarantineError ?? message } };
+        }
+        let returnOutcome: 'returned' | 'quarantined' = 'quarantined';
+        let workerStateUnknown: string | undefined;
+        try {
+          const returned = await cleanAndReturnChildPod(lease!, { ...attempt.cleanup,
+            observe: (event, data) => {
+              debug.log('pod.reuse', event, { spaceId: input.spaceId, ...data },
+                { level: event === 'return-decision' && (data.outcome === 'eligible' || data.outcome === 'returned') ? 'info' : 'warn' });
+              attempt.cleanup.observe(event, data);
+              // The lease disposition is already settled by the time this callback runs; the warm
+              // ledger is an observation of it. A ledger write failure must stay an observation
+              // failure — escaping here would quarantine a lease that was already returned.
+              try { writeWarmLedger({ runId: command.runId, event: `pod-reuse-${event}`,
+                data: { spaceId: input.spaceId, ...data } }); }
+              catch (error) { debug.log('pod.reuse', 'ledger-unavailable', { spaceId: input.spaceId, runId: command.runId,
+                event: `pod-reuse-${event}`, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
+            } });
+          returnOutcome = returned.outcome;
+        } catch (error) {
+          workerStateUnknown = error instanceof Error ? error.message : String(error);
+          debug.log('pod.reuse', 'return-unavailable', { spaceId: input.spaceId,
+            reason: workerStateUnknown }, { level: 'error' });
+          // The inner return/quarantine result is unclear: quarantine the lease explicitly,
+          // and only a second quarantine failure leaves the worker state unknown.
+          try {
+            await attempt.quarantineUnknown(`return-quarantine-unavailable:${workerStateUnknown}`);
+            try { writeWarmLedger({ runId: command!.runId, event: 'pod-reuse-quarantined',
+              data: { spaceId: input.spaceId, workerId: command!.workerId, leaseId: command!.leaseId,
+                reason: `return-quarantine-unavailable:${workerStateUnknown}` } }); }
+            catch { /* ledger loss must not mask the quarantine outcome */ }
+            // The explicit quarantine settled the disposal: the caller result must
+            // account for it as quarantined instead of claiming an unknown state.
+            workerStateUnknown = undefined;
+          } catch (quarantineError) {
+            const quarantineMessage = quarantineError instanceof Error ? quarantineError.message : String(quarantineError);
+            workerStateUnknown = `return:${workerStateUnknown}; quarantine:${quarantineMessage}`;
+            try { writeWarmLedger({ runId: command!.runId, event: 'pod-reuse-quarantine-failed',
+              data: { spaceId: input.spaceId, workerId: command!.workerId, leaseId: command!.leaseId,
+                reason: workerStateUnknown } }); }
+            catch { debug.log('pod.reuse', 'ledger-unavailable', { spaceId: input.spaceId,
+              event: 'pod-reuse-quarantine-failed', reason: workerStateUnknown }, { level: 'warn' }); }
+          }
+        }
+        const log = new TextDecoder().decode(transport.bytes.log);
+        // Pod checkout paths cannot be used by the host supervisor.
+        const { worktreePath: _podOnly, ...hostDisposition } = disposition;
+        if (workerStateUnknown) return { exitCode: 1, output: log.slice(-4096), disposition: hostDisposition,
+          error: { code: 'si-warm-worker-state-unknown', message: workerStateUnknown } };
+        debug.log('pod.reuse', 'child-result', { spaceId: input.spaceId, workerId: command.workerId,
+          leaseId: command.leaseId, returnOutcome, stage: disposition.stage ?? null });
+        try {
+          return await options.siWarmHostPostprocess!({ exitCode: transport.reply.exitCode,
+            output: log.slice(-4096), disposition: hostDisposition }, attempt, input);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          debug.log('pod.reuse', 'host-postprocess-failed', { spaceId: input.spaceId,
+            reason: message }, { level: 'error' });
+          return { exitCode: 1, output: log.slice(-4096), disposition: hostDisposition,
+            error: { code: 'si-warm-host-postprocess-failed', message } };
+        }
+      })();
+      return { address: `self-impl:${input.spaceId}`, done };
+    }
     const name = podJobName(input.spaceId);
     let parentGoal: string | undefined;
     let parentGoalUnreadable = false;
@@ -1574,13 +1948,16 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
       const acquireSlot = async (): Promise<PodPoolMember | null> => {
         if (!options.pool) return null;
         const stop = watchStall('pool-slot');
+        // MINIH-MODE (0.2.37): the location is declared by the launch env — absent/unknown keeps the configured
+        // capacities, so this launch path behaves exactly as before unless the declaration is there.
+        const minihLocation = minihLocationFrom(env.ELANOUS_MINIH_LOCATION);
         try {
           for (;;) {
             if (input.signal?.aborted) return null;
             // The reason comes back inside this call, so a concurrent launch cannot overwrite it.
             const kind = podPlacementKind(oomRetried ? retryTier : memoryTier, selectedGoalType, requestKind);
             const acquired = await options.pool.tryAcquire(unfitContexts, (reason) => { stageReason['pool-slot'] = reason; },
-              { kind, onPlacement: (placement) => { lastPlacement = placement; } });
+              { kind, ...(minihLocation ? { minihLocation } : {}), onPlacement: (placement) => { lastPlacement = placement; } });
             if (acquired) {
               debug.log('self-implement.pod', 'pool-slot', { spaceId: input.spaceId, context: acquired.context, inflight: options.pool.snapshot(), ...(lastPlacement ? { placement: lastPlacement } : {}) });
               if (lastPlacement) console.warn(`[pod] 배치: ${lastPlacement.reason}`);
@@ -1631,6 +2008,21 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
       const currentContext = member ? null : baseKubectl(['config', 'current-context']);
       let context = member?.context ?? (currentContext?.status === 0 ? currentContext.stdout.trim() : '');
       const kubectl: Kubectl = (args, stdin) => baseKubectl(['--context', context, ...args], stdin);
+      const captureKubectl = (host: string, args: readonly string[]): ReturnType<Kubectl> => {
+        if (member?.sshHost ? member.sshHost !== host : host !== resolveHostId(env))
+          return { status: 1, stdout: '', stderr: 'ledger host is not the selected pool host' };
+        if (!member?.sshHost) return baseKubectl(args);
+        if (options.failureCaptureRemote) return options.failureCaptureRemote(host, args);
+        const result = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=5', '--', host, 'kubectl', ...args],
+          { encoding: 'utf8', timeout: 30_000, maxBuffer: LEASE_KUBECTL_MAX_BUFFER });
+        return { status: result.status, stdout: result.stdout ?? '', stderr: (result.stderr ?? '') + (result.error ? String(result.error) : '') };
+      };
+      const captureFailedJob = (childRunId: string): void => {
+        try {
+          captureFailedPodJobs({ runId: ledgerRunId, job: name, childRunId, ledgerPath: runLedgerPath(ledgerRunId, ledgerDir), artifactDir: join(effectiveInstanceRoot(), 'pod-artifacts'),
+            kubectl: captureKubectl, record: (event, data) => appendRunLedgerEntry({ runId: ledgerRunId, event, data }, ledgerDir), now: options.now });
+        } catch (error) { debug.log('self-implement.pod', 'failure-capture-ledger-unavailable', { job: name, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
+      };
       let recorded = false;
       let groundingMinted: string | null = null;
       try {
@@ -1672,6 +2064,44 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           collectPodArtifacts(full.stdout, { dir: join(effectiveInstanceRoot(), 'pod-artifacts'), job: name, log: record });
         }
         catch (error) { record('self-implement.pod', 'artifact-collect-incomplete', { job: name, reason: error instanceof Error ? error.message : String(error) }); }
+        for (const line of full.stdout.split(/\r?\n/)) {
+          const bundle = /^ELANOUS_POD_SALVAGE_BUNDLE (pod-salvage\/[a-zA-Z0-9._-]+\.bundle) ([0-9]+) ([0-9]+)(?: ([0-9a-f]{40,64}))?$/.exec(line);
+          if (bundle) {
+            const bundlePath = join(effectiveInstanceRoot(), 'pod-artifacts', name, bundle[1]!);
+            if (!existsSync(bundlePath)) {
+              try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-salvage-bundle', data: { job: name, disposition: '보존 실패', reason: 'bundle artifact missing' } }, ledgerDir); }
+              catch (error) { record('self-implement.pod', 'salvage-bundle-ledger-incomplete', { job: name, reason: error instanceof Error ? error.message : String(error) }); }
+              record('self-implement.pod', 'salvage-bundle-collect-incomplete', { job: name, path: bundlePath, reason: 'bundle artifact missing' });
+              continue;
+            }
+            try {
+              const refs = execFileSync('git', ['bundle', 'list-heads', bundlePath], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim().split(/\r?\n/);
+              const [bundleHead, bundleRef] = refs[0]?.trim().split(/\s+/) ?? [];
+              if (!bundleHead || !bundleRef?.startsWith('refs/heads/')) throw new Error('bundle contains no branch ref');
+              const verifyDir = mkdtempSync(join(tmpdir(), 'pod-salvage-verify-'));
+              try {
+                execFileSync('git', ['clone', '--quiet', '--branch', bundleRef.slice('refs/heads/'.length), bundlePath, verifyDir], { stdio: ['ignore', 'pipe', 'pipe'] });
+                const cloneHead = execFileSync('git', ['-C', verifyDir, 'rev-parse', 'HEAD'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+                if (cloneHead !== bundleHead || (bundle[4] && cloneHead !== bundle[4])) throw new Error('bundle clone HEAD mismatch');
+              } finally { rmSync(verifyDir, { recursive: true, force: true }); }
+              appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-salvage-bundle', data: {
+                job: name, path: bundlePath,
+                commitCount: Number(bundle[2]), diffLines: Number(bundle[3]), ...(bundle[4] ? { head: bundle[4] } : {}),
+              } }, ledgerDir);
+            } catch (error) {
+              const reason = error instanceof Error ? error.message : String(error);
+              try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-salvage-bundle', data: { job: name, disposition: '보존 실패', reason: `bundle validation failed: ${reason}` } }, ledgerDir); }
+              catch (ledgerError) { record('self-implement.pod', 'salvage-bundle-ledger-incomplete', { job: name, reason: ledgerError instanceof Error ? ledgerError.message : String(ledgerError) }); }
+              record('self-implement.pod', 'salvage-bundle-collect-incomplete', { job: name, reason });
+            }
+          } else if (line === 'ELANOUS_POD_SALVAGE_NONE no-commits') {
+            try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-salvage-bundle', data: { job: name, disposition: '보존할 것 없음', commitCount: 0, diffLines: 0 } }, ledgerDir); }
+            catch (error) { record('self-implement.pod', 'salvage-bundle-ledger-incomplete', { job: name, reason: error instanceof Error ? error.message : String(error) }); }
+          } else if (line.startsWith('ELANOUS_POD_SALVAGE_FAILED ')) {
+            try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-salvage-bundle', data: { job: name, disposition: '보존 실패', reason: line.slice('ELANOUS_POD_SALVAGE_FAILED '.length) } }, ledgerDir); }
+            catch (error) { record('self-implement.pod', 'salvage-bundle-ledger-incomplete', { job: name, reason: error instanceof Error ? error.message : String(error) }); }
+          }
+        }
         if (options.repairCommitOnly) {
           const artifactDir = join(effectiveInstanceRoot(), 'pod-artifacts', name, 'repair');
           try {
@@ -1699,9 +2129,11 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         //   상한 안 → ZAI(이름 있는 Secret · 없으면 거부) · 넘침 → 정책대로(openrouter·balance = 기존 OpenRouter GLM · stop = 거부 · apply 0).
         let zaiRoute: 'zai' | 'openrouter' | undefined;
         let zaiSpec: ZaiPodSpec | undefined;
+        let zaiLaunchOverage: 'stop' | 'balance' | 'openrouter' | undefined;
         zaiPendingApply.delete(name);
         if (options.provider === 'glm') {
           const settings = (options.zaiSettings ?? (() => zaiSettingsFromConfig(getUserConfig().llm)))();
+          zaiLaunchOverage = settings.overage;
           const poolMembers = (options.pool as { members?: readonly PodPoolMember[] } | undefined)?.members;
           const contexts = Array.isArray(poolMembers) && poolMembers.length > 0 ? poolMembers.map((m) => m.context) : [context];
           let active: number | null = 0;
@@ -1733,6 +2165,8 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         const anthropic = options.provider === 'anthropic';
         const bedrockChild = options.provider === 'bedrock';
         const zaiChild = zaiRoute === 'zai';
+        /** ZAI 로 입장한 자식도 플랜 한도 오류 뒤 OpenRouter 로 전환할 수 있다. 실행 중 폴백 자격을 발사 전에 확보한다. */
+        const openrouterCredentialRequired = openrouter || (zaiChild && zaiLaunchOverage !== 'stop');
         /** API 키 자식 — codex 계정·자격 파일을 안 쓴다(키는 작업별 creds Secret 의 `env-<KEY>` · bedrock·glm 은 이름 있는 Secret 으로만). */
         const apiKeyChild = openrouter || openGateway || anthropic || bedrockChild || zaiChild;
         const plannedAccount = retryAccount ?? (grok ? 'grok' : openrouter ? 'openrouter' : openGateway ? 'opengateway' : anthropic ? 'anthropic' : bedrockChild ? 'bedrock' : zaiChild ? 'glm' : options.accountBroker?.() ?? options.account ?? 'team');
@@ -1776,8 +2210,8 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
           return credential;
         }) : undefined;
-        const openrouterKey = openrouter ? env.OPENROUTER_API_KEY?.trim() || (options.readKeyCache ?? defaultReadKeyCache)('OPENROUTER_API_KEY')?.trim() : undefined;
-        if (openrouter && !openrouterKey) throw new Error('pod: Pod 에 openrouter 키 없음 — 호스트 키 캐시 또는 OPENROUTER_API_KEY 필요');
+        const openrouterKey = openrouterCredentialRequired ? env.OPENROUTER_API_KEY?.trim() || (options.readKeyCache ?? defaultReadKeyCache)('OPENROUTER_API_KEY')?.trim() : undefined;
+        if (openrouterCredentialRequired && !openrouterKey) throw new Error('pod: Pod 에 openrouter 키 없음 — 호스트 키 캐시 또는 OPENROUTER_API_KEY 필요');
         const openGatewayEnvKey = openGateway ? env.OPENGATEWAY_API_KEY?.trim() : undefined;
         const openGatewayCachedKey = openGateway ? (options.readKeyCache ?? defaultReadKeyCache)('OPENGATEWAY_API_KEY')?.trim() : undefined;
         if (openGatewayEnvKey && openGatewayCachedKey && openGatewayEnvKey !== openGatewayCachedKey)
@@ -1859,7 +2293,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
         }
         // Grok 자격은 전용 Secret 키 하나로만 보낸다 — passEnv 의 API 키 중복 전달은 막는다.
-        const passKeys = [...new Set([...(options.passEnv ?? []), ...(openrouter ? ['OPENROUTER_API_KEY'] : []), ...(openGateway ? ['OPENGATEWAY_API_KEY'] : []), ...(anthropic ? ['ANTHROPIC_API_KEY'] : [])])].filter((key) => key !== 'ELANOUS_LIVE_DETAIL_UNTIL'
+        const passKeys = [...new Set([...(options.passEnv ?? []), ...(openrouterCredentialRequired ? ['OPENROUTER_API_KEY'] : []), ...(openGateway ? ['OPENGATEWAY_API_KEY'] : []), ...(anthropic ? ['ANTHROPIC_API_KEY'] : [])])].filter((key) => key !== 'ELANOUS_LIVE_DETAIL_UNTIL'
           && key !== POD_GITHUB_CREDENTIAL_TOKEN_ENV && key !== POD_GITHUB_CREDENTIAL_URL_ENV
           && (!grok || !['XAI_API_KEY', 'GROK_API_KEY', 'GROK_CODE_XAI_API_KEY'].includes(key)));
         const skillEnvs: Record<string, string> = options.skillEnv
@@ -1984,6 +2418,13 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           if (key.startsWith('ELANOUS_PROMPT_ENHANCE_') && key !== 'ELANOUS_PROMPT_ENHANCE_MODEL' && key !== 'ELANOUS_PROMPT_ENHANCE_EFFORT') delete hostAuthorEnv[key];
         }
         let authorChoice = authorOnPod ? selectEnhanceLlm({ config: (options.authorConfig ?? getUserConfig)() }, hostAuthorEnv) : undefined;
+        // A named child model is this launch's model when planning has no explicit choice.
+        // Relay it to authoring too: the Pod's persistent grounding goal loop otherwise
+        // receives the host's default "better" model and silently spends sol for a luna child.
+        const namedChildModel = podDelegatedChildLlm(jobArgs)?.model;
+        if (authorChoice?.modelSource === 'default' && namedChildModel) {
+          authorChoice = { ...authorChoice, model: namedChildModel, modelSource: 'child' };
+        }
         let authorFallbackReason: string | undefined;
         let authorRequestedModel: string | undefined;
         let authorRequestedSource: string | undefined;
@@ -2005,8 +2446,10 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
             authorChoice = { ...authorChoice, model: childModel, modelSource: 'fallback-child' };
           } else debug.log('self-implement.pod', 'role-llm-armed', { job: name, role: 'planning', model: authorChoice.model, source: authorChoice.modelSource, account: roleCodexAccount });
         }
-        const hostKey = (k: string): string | undefined => k === 'OPENROUTER_API_KEY' && openrouter ? openrouterKey : k === 'OPENGATEWAY_API_KEY' && openGateway ? openGatewayKey : k === 'ANTHROPIC_API_KEY' && anthropic ? anthropicKey : env[k] ?? (options.readKeyCache ?? defaultReadKeyCache)(k);
-        const hostFallbackNames = (options.fallbackConfig ?? getUserConfig)().llm.fallbackChain;
+        const hostKey = (k: string): string | undefined => k === 'OPENROUTER_API_KEY' && openrouterCredentialRequired ? openrouterKey : k === 'OPENGATEWAY_API_KEY' && openGateway ? openGatewayKey : k === 'ANTHROPIC_API_KEY' && anthropic ? anthropicKey : env[k] ?? (options.readKeyCache ?? defaultReadKeyCache)(k);
+        const hostConfig = (options.fallbackConfig ?? getUserConfig)();
+        const hostFallbackNames = hostConfig.llm.fallbackChain;
+        const zaiOverage = zaiLaunchOverage ?? zaiSettingsFromConfig(hostConfig.llm).overage;
         const normalizedFallback = normalizeFallbackChain(hostFallbackNames);
         let fallbackSteps = normalizedFallback.chain;
         let zaiFallbackSpec: ZaiPodSpec | undefined;
@@ -2058,7 +2501,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
                 ? Object.fromEntries(codexCredentials.map((candidate, i) => [`codex-${i}.json`, JSON.stringify({ elanousAuth: candidate.elanousAuth, codexAuth: candidate.codexAuth })]))
                 : { 'elanous-auth.json': (creds as ReturnType<typeof hostCredentials>).elanousAuth, 'codex-auth.json': (creds as ReturnType<typeof hostCredentials>).codexAuth }),
             'gh-token': podGhToken, feature: input.feature,
-            'llm-fallback-config.json': JSON.stringify({ llm: { fallbackChain: fallbackChain.steps } }),
+            'llm-fallback-config.json': JSON.stringify({ llm: { fallbackChain: fallbackChain.steps, zaiCodingPlan: { overage: zaiOverage } } }),
             ...(goalDocument !== undefined ? { 'goal-doc': goalDocument } : {}),
             ...Object.fromEntries(Object.entries(skillEnvs).map(([n, text]) => [`skillenv-${n}`, text])),
             ...(grounding ? { [`env-${GROUNDING_TOKEN_ENV}`]: grounding.token } : {}),
@@ -2125,6 +2568,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
         }
         if (failedExisting) {
+          captureFailedJob(liveChildRunId);
           const pods = kubectl(['-n', namespace, 'get', 'pods', '-l', `job-name=${name}`, '-o', 'jsonpath={range .items[*]}{.metadata.creationTimestamp}{"\\t"}{range .status.containerStatuses[?(@.name=="child")]}{.state.terminated.reason}{"\\t"}{.state.terminated.exitCode}{end}{"\\n"}{end}']);
           const latestPod = pods.status === 0 ? pods.stdout.trimEnd().split('\n').map((line) => line.split('\t'))
             .filter(([created]) => created && !Number.isNaN(Date.parse(created)))
@@ -2313,7 +2757,22 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           debug.log('self-implement.pod', fit.fitted ? 'grok-deadline-fitted' : 'grok-deadline-kept', { job: name, requestedSeconds: jobDeadlineSeconds, deadlineSeconds: fit.deadlineSeconds, availableSeconds: fit.availableSeconds, relay: Boolean(credentialRelay), marginMs: POD_GROK_EXPIRY_MARGIN_MS });
           jobDeadlineSeconds = fit.deadlineSeconds;
         }
-        const job = podJobManifest({ name, namespace, fallbackChain, ...(resultMarkerLine ? { resultMarkerLine } : {}), image: jobImage, workIdentity, ...(env.ELANOUS_TASK_BOUND_PR && /^[1-9]\d*$/.test(env.ELANOUS_TASK_BOUND_PR) && Number.isSafeInteger(Number(env.ELANOUS_TASK_BOUND_PR)) ? { boundPrNumber: Number(env.ELANOUS_TASK_BOUND_PR) } : {}), ...(member?.imageRef ? { imagePullPolicy: 'IfNotPresent' as const } : {}), repoUrl, ...(options.source ? { source: options.source } : {}), ...(options.repairCommitOnly ? { repairCommitOnly: options.repairCommitOnly } : {}), ...(hostMirror ? { hostMirror } : {}), args: jobArgs, passEnv: jobPassEnv, deadlineSeconds: jobDeadlineSeconds, ...(goalDoc ? { goalDoc } : env.ELANOUS_POD_AUTHOR_ON_POD === '1' && !shard ? { authorSentence: true, ...(env.ELANOUS_POD_AUTHOR_GRADE === 'lite' || env.ELANOUS_POD_AUTHOR_GRADE === 'full' ? { authorGrade: env.ELANOUS_POD_AUTHOR_GRADE } : {}) } : {}), runId: launchRunId, ...(parentRunId ? { parentRunId } : {}), ...(jobArmEnv ? { armEnv: jobArmEnv } : {}), hostId: resolveHostId(env), skillEnvs: Object.keys(skillEnvs), memoryLimit, memoryRequest, imageCommit: jobImageCommit, ...(grok ? { grokCredential: 'grokAuth' in creds && creds.grokAuth ? 'subscription' as const : 'api_key' as const } : {}), ...(codexAccounts ? { codexAccounts } : {}), ...(hostRefresh ? { appCredential: true } : {}), execution: { key: executionKey, attempt: oomRetried ? 2 : 1 }, hostLeaseAdmitted: !!releaseAdmission, ...(roleCodexCredential ? { reviewerCodexAuth: true } : {}), ...(bedrockSpec ? { bedrock: bedrockSpec } : {}), ...(zaiSpec ? { zai: zaiSpec } : {}), ...(zaiFallbackSpec ? { zaiFallback: zaiFallbackSpec } : {}) });   // kubectl 주입(=시험)이면 docker 를 부르지 않는다
+        // POD-LAUNCH-PROVENANCE — fail-closed: a si-task Job without its ★ identity is never applied.
+        let provenance: PodProvenanceMetadata;
+        try {
+          let version: string | undefined;
+          try { version = packageVersion(); } catch { version = undefined; }
+          provenance = podProvenanceMetadata(siTaskPodProvenance({ env, runId: launchRunId, ...(parentRunId ? { parentRunId } : {}), workIdentity,
+            requestedAt: new Date((options.now ?? Date.now)()).toISOString(), feature: input.feature, launchHost: resolveHostId(env),
+            commit: seedSource.kind === 'commit' ? seedSource.sha : seedCommit ?? jobImageCommit, ...(version ? { version } : {}),
+            ...(memoryRequest ? { memReq: memoryRequest } : {}) }));
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          debug.log('pod.provenance', 'si-task-refused', { job: name, reason: message }, { level: 'warn' });
+          cleanupSecret();
+          return { exitCode: 1, output: '', error: { code: 'pod-provenance', message } };
+        }
+        const job = podJobManifest({ provenance, name, namespace, fallbackChain, ...(resultMarkerLine ? { resultMarkerLine } : {}), image: jobImage, workIdentity, ...(env.ELANOUS_TASK_BOUND_PR && /^[1-9]\d*$/.test(env.ELANOUS_TASK_BOUND_PR) && Number.isSafeInteger(Number(env.ELANOUS_TASK_BOUND_PR)) ? { boundPrNumber: Number(env.ELANOUS_TASK_BOUND_PR) } : {}), ...(member?.imageRef ? { imagePullPolicy: 'IfNotPresent' as const } : {}), repoUrl, ...(options.source ? { source: options.source } : {}), ...(options.repairCommitOnly ? { repairCommitOnly: options.repairCommitOnly } : {}), ...(hostMirror ? { hostMirror } : {}), args: jobArgs, passEnv: jobPassEnv, deadlineSeconds: jobDeadlineSeconds, ...(goalDoc ? { goalDoc } : env.ELANOUS_POD_AUTHOR_ON_POD === '1' && !shard ? { authorSentence: true, ...(env.ELANOUS_POD_AUTHOR_GRADE === 'lite' || env.ELANOUS_POD_AUTHOR_GRADE === 'full' ? { authorGrade: env.ELANOUS_POD_AUTHOR_GRADE } : {}) } : {}), runId: launchRunId, ...(parentRunId ? { parentRunId } : {}), ...(jobArmEnv ? { armEnv: jobArmEnv } : {}), hostId: resolveHostId(env), skillEnvs: Object.keys(skillEnvs), memoryLimit, memoryRequest, imageCommit: jobImageCommit, ...(grok ? { grokCredential: 'grokAuth' in creds && creds.grokAuth ? 'subscription' as const : 'api_key' as const } : {}), ...(codexAccounts ? { codexAccounts } : {}), ...(hostRefresh ? { appCredential: true } : {}), execution: { key: executionKey, attempt: oomRetried ? 2 : 1 }, hostLeaseAdmitted: !!releaseAdmission, ...(roleCodexCredential ? { reviewerCodexAuth: true } : {}), ...(bedrockSpec ? { bedrock: bedrockSpec } : {}), ...(zaiSpec ? { zai: zaiSpec } : {}), ...(zaiFallbackSpec ? { zaiFallback: zaiFallbackSpec } : {}) });   // kubectl 주입(=시험)이면 docker 를 부르지 않는다
         const carriedBranch = goalDoc ? 'goal-doc' as const : env.ELANOUS_POD_AUTHOR_ON_POD === '1' && !shard ? 'author' as const : undefined;
         const carriedChildLlm = carriedBranch ? podDelegatedChildLlm(jobArgs) : undefined;
         jobApplyStartedAt = Date.now();
@@ -2322,6 +2781,11 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         if (a.status !== 0) { cleanupSecret(); return { exitCode: 1, output: a.stderr, error: { code: 'pod-apply', message: a.stderr.trim() } }; }
         releaseAdmission?.applied?.(name, context, namespace);
         const imageFacts = { job: name, childRunId: liveChildRunId, image: jobImage, imageCommit: jobImageCommit, context };
+        // POD-LAUNCH-PROVENANCE — append-only «started» row: who · why · when, on the parent's existing run ledger.
+        const startedRow = { job: name, run: launchRunId, attempt: oomRetried ? 2 : 1, provenance: provenanceRowFromAnnotations(provenance.annotations) };
+        try { appendRunLedgerEntry({ runId: ledgerRunId, event: POD_LAUNCH_STARTED_EVENT, timestamp: new Date((options.now ?? Date.now)()).toISOString(), data: startedRow }, ledgerDir); }
+        catch (error) { debug.log('pod.provenance', 'history-unavailable', { job: name, row: 'started', reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
+        debug.log('pod.provenance', 'job-started', startedRow);
         try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-job-image', data: imageFacts }, ledgerDir); }
         catch (error) { debug.log('self-implement.pod', 'job-image-ledger-unavailable', { job: name, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
         debug.log('self-implement.pod', 'job-image', imageFacts);
@@ -2380,6 +2844,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         }
         try {
           appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-child-run', data: { childRunId: liveChildRunId, job: name, attempt: oomRetried ? 2 : 1, ...(goalFile ? { goalFile } : {}) } }, ledgerDir);
+          appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-job-applied', data: { job: name, childRunId: liveChildRunId, jobUid: lifecycleJobUid, host: member?.sshHost ?? resolveHostId(env), context, namespace } }, ledgerDir);
           if (lastPlacement) appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-placement', data: { job: name, childRunId: liveChildRunId, attempt: oomRetried ? 2 : 1, member: lastPlacement.member, kind: lastPlacement.kind, outcome: lastPlacement.outcome, preferred: lastPlacement.preferred, reason: lastPlacement.reason } }, ledgerDir);
           appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-memory-selected', data: { job: name, childRunId: liveChildRunId, attempt: oomRetried ? 2 : 1, limit: memoryLimit, ...(appliedMemoryRequest ? { request: appliedMemoryRequest } : {}), tier: oomRetried ? retryTier : memoryTier, source: oomRetried ? 'oom-retry' : memorySource, reason: oomRetried ? 'OOMKilled' : memoryReason, declaredGoalType: selectedGoalType } }, ledgerDir);
           if (oomRetried && retryFromChildRunId) appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-oom-retry', data: { attempt: 2, from: retryFromMemoryLimit ?? selectedMemoryLimit, to: memoryLimit, tier: retryTier, reason: 'OOMKilled', job: name, childRunId: liveChildRunId, fromChildRunId: retryFromChildRunId } }, ledgerDir);
@@ -2391,15 +2856,18 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         }
         writePodFragment({ spaceId: input.spaceId, context, namespace, job: name, inboxDir: POD_CONTROL_INBOX_DIR, ...(liveChildRunId === normalizeRunId(liveChildRunId) ? { runId: liveChildRunId } : {}), ...(parentRunId && normalizeRunId(parentRunId) === parentRunId ? { parentRunId } : {}) }, env);
         recorded = true;
-        debug.log('self-implement.pod', 'job-applied', { job: name, namespace, ...(member ? { context: member.context } : {}), image: jobImage, spaceId: input.spaceId, passEnv, ...(openrouter ? { openrouterKeyPresent: passEnv.includes('OPENROUTER_API_KEY') } : {}), ...(openGateway ? { openGatewayKeyPresent: passEnv.includes('OPENGATEWAY_API_KEY') } : {}), ...(anthropic ? { anthropicKeyPresent: passEnv.includes('ANTHROPIC_API_KEY') } : {}), ...(bedrockSpec ? { bedrockSecret: bedrockSpec.secretName, bedrockSecretKeys: bedrockSpec.keys, bedrockRegionFrom: bedrockSpec.region.from } : {}), ...(zaiRoute ? { zaiRoute, ...(zaiSpec ? { zaiSecret: zaiSpec.secretName } : {}) } : {}), extraArgs: options.extraArgs ?? [], ...(options.armEnv?.ELANOUS_ARM_ID ? { armId: options.armEnv.ELANOUS_ARM_ID } : {}) });
+        debug.log('self-implement.pod', 'job-applied', { job: name, namespace, ...(member ? { context: member.context } : {}), image: jobImage, spaceId: input.spaceId, passEnv, ...(openrouterCredentialRequired ? { openrouterKeyPresent: passEnv.includes('OPENROUTER_API_KEY') } : {}), ...(openGateway ? { openGatewayKeyPresent: passEnv.includes('OPENGATEWAY_API_KEY') } : {}), ...(anthropic ? { anthropicKeyPresent: passEnv.includes('ANTHROPIC_API_KEY') } : {}), ...(bedrockSpec ? { bedrockSecret: bedrockSpec.secretName, bedrockSecretKeys: bedrockSpec.keys, bedrockRegionFrom: bedrockSpec.region.from } : {}), ...(zaiRoute ? { zaiRoute, ...(zaiSpec ? { zaiSecret: zaiSpec.secretName } : {}) } : {}), extraArgs: options.extraArgs ?? [], ...(options.armEnv?.ELANOUS_ARM_ID ? { armId: options.armEnv.ELANOUS_ARM_ID } : {}) });
         let state: 'complete' | 'failed' | 'aborted' = 'failed';
         let failedReason = '';
         let containerReason: string | null = null;
         let containerExitCode: number | null = null;
+        // JOB-FAILURE-TERMINATION-CAPTURE — this Job's Kubernetes facts, read once at the failure verdict (before GC).
+        //   Observation only: failedReason · containerReason · containerExitCode keep driving the classification.
+        let podTermination: PodTermination | null = null;
         // METER-POD-ROLLUP-GAP — abort 때 Job 삭제 «전»에 거둔 로그 사본(삭제 뒤엔 PARTIAL 줄도 못 읽는다).
         let abortLogs = '';
         // ⭐ 런 «도중» 원장 증분 회수 — 호스트 슈퍼바이저가 Pod 걸음을 실시간으로 본다(🅣 요청 · 힐 루프 runtime 성형의 전제).
-        const follower = createPodLedgerFollower({ runId: liveChildRunId, dir: ledgerDir, exec: (script) => kubectl(['-n', namespace, 'exec', `job/${name}`, '-c', 'child', '--', 'sh', '-c', script]) });
+        const follower = createPodLedgerFollower({ runId: liveChildRunId, dir: ledgerDir, now, exec: (script) => kubectl(['-n', namespace, 'exec', `job/${name}`, '-c', 'child', '--', 'sh', '-c', script]) });
         // ⭐ METER-POD-ROLLUP-GAP-3 — 런 «도중» 마지막 PARTIAL 줄을 호스트가 쥔다: Pod 가 지워지면(SIGTERM 등) 종료 로그에서 PARTIAL 이 사라진다.
         let livePartialLine: string | null = null;
         let pollsSinceCapture = 0;
@@ -2428,6 +2896,10 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         const capturePolls = Math.max(1, options.usagePartialCapturePolls ?? Math.round(POD_USAGE_PARTIAL_CAPTURE_MS / Math.max(1, options.pollMs ?? 15_000)));
         const markerWait = markerToken ? await import('./pod-result-marker-wait.js') : null;
         const waitStartedAt = Date.now();
+        let consecutiveJobNotFound = 0;
+        let podVanished = false;
+        let unmeasurableSince: number | null = null;
+        let unmeasurableIncidentRecorded = false;
         for (;;) {
           if (input.signal?.aborted) {
             recordPodImage(true);
@@ -2442,15 +2914,48 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
           if (!imageSnapshotRecorded) recordPodImage(false);
           const g = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.status.conditions[*].type}']);
+          if (g.status !== 0) {
+            // A transport/5xx error says nothing about Job existence. Only Kubernetes Job NotFound counts.
+            const jobNotFound = /\(NotFound\)/i.test(g.stderr) || /\bjobs?(?:\.batch)?\b[^\n]*\bnot found\b/i.test(g.stderr);
+            consecutiveJobNotFound = jobNotFound ? consecutiveJobNotFound + 1 : 0;
+            unmeasurableSince = null;
+            if (consecutiveJobNotFound >= 3) {
+              state = 'failed';
+              failedReason = 'JobNotFound';
+              podVanished = true;
+              const facts = { job: name, childRunId: liveChildRunId, class: 'pod-vanished', consecutiveNotFound: consecutiveJobNotFound };
+              debug.log('self-implement.pod', 'pod-vanished', facts, { level: 'error' });
+              try {
+                recordRunStop({ runId: ledgerRunId, class: 'pod-vanished', site: 'pod-job-poll',
+                  cause: `Job ${name} NotFound on ${consecutiveJobNotFound} consecutive polls`,
+                  evidenceRef: `run-ledger:${ledgerRunId}:pod-job-applied`,
+                  nextMove: 'Inspect Job deletion and child artifacts before relaunch' },
+                (entry) => appendRunLedgerEntry(entry, ledgerDir));
+              } catch (error) {
+                debug.log('self-implement.pod', 'pod-vanished-ledger-unavailable', { ...facts, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' });
+              }
+              break;
+            }
+            await sleep(options.pollMs ?? 15_000);
+            continue;
+          }
+          consecutiveJobNotFound = 0;
           const types = g.stdout;
           if (/Complete|SuccessCriteriaMet/.test(types)) { releaseAdmission?.observed?.(); state = 'complete'; break; }
           if (/Failed|FailureTarget/.test(types)) {
             releaseAdmission?.observed?.();
             state = 'failed';
-            const reason = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.status.conditions[?(@.type=="Failed")].reason}']);
-            failedReason = reason.status === 0 ? reason.stdout.trim() : '';
+            // One Job read serves both: column one is the classification reason, all three the capture (no re-read a GC could empty).
+            let jobRead: { status: number | null; stdout: string } | null = null;
+            let jobReadError: unknown;
+            try { jobRead = kubectl(['-n', namespace, 'get', 'job', name, '-o', `jsonpath=${POD_TERMINATION_JOB_JSONPATH}`]); }
+            catch (error) { jobReadError = error; }
+            failedReason = jobRead?.status === 0 ? (jobRead.stdout.split('\t')[0] ?? '').trim() : '';
+            // One Pods read serves both: its first three columns are the classification layout, the rest the termination capture.
+            let podsRead: { status: number | null; stdout: string } | null = null;
             try {
-              const pods = kubectl(['-n', namespace, 'get', 'pods', '-l', `job-name=${name}`, '-o', 'jsonpath={range .items[*]}{.metadata.creationTimestamp}{"\\t"}{range .status.containerStatuses[?(@.name=="child")]}{.state.terminated.reason}{"\\t"}{.state.terminated.exitCode}{end}{"\\n"}{end}']);
+              const pods = kubectl(['-n', namespace, 'get', 'pods', '-l', `job-name=${name}`, '-o', `jsonpath=${POD_TERMINATION_PODS_JSONPATH}`]);
+              podsRead = pods;
               if (pods.status === 0 && pods.stdout) {
                 const rows = pods.stdout.trimEnd().split('\n').map((line) => line.split('\t'));
                 const latest = rows.filter(([created]) => created && !Number.isNaN(Date.parse(created)))
@@ -2463,6 +2968,16 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
               }
             } catch { /* Pod 가 사라졌거나 조회 불가 — 종료 사유는 미상. */ }
             debug.log('self-implement.pod', 'container-terminated', { job: name, container: 'child', reason: containerReason, exitCode: containerExitCode, jobReason: failedReason || null, memoryLimit });
+            podTermination = readPodTermination({ kubectl, namespace, job: name, path: 'job-failed-condition', jobRead, podsRead, jobUid: lifecycleJobUid });
+            // Keep the verdict's single Job read authoritative; collecting files may re-read a Job that GC has removed.
+            captureFailedJob(liveChildRunId);
+            if (jobReadError !== undefined) {
+              // Today's outcome stays (the throw ends the spawn as pod-error); the capture is in the ledger first.
+              try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-child-evidence', data: { childEvidence: null, childRunId: liveChildRunId, job: name, podTermination } }, ledgerDir); }
+              catch (error) { debug.log('self-implement.pod', 'child-evidence-write-failed', { job: name, childRunId: liveChildRunId, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
+              debug.log('self-implement.pod', 'pod-termination-captured', { job: name, podTermination, jobReadThrew: true }, { level: 'warn' });
+              throw jobReadError;
+            }
             break;
           }
           // TA-POD-WARMBOOT-PARITY: the condition is not there yet — the child may already be done (k3d condition lag).
@@ -2474,6 +2989,8 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
               state = seen === 0 ? 'complete' : 'failed';
               // The child's own rc (the Pod's terminated state may lag like the condition) — exit-code paths read it as before.
               if (seen !== 0) containerExitCode = seen;
+              if (seen !== 0) podTermination = readPodTermination({ kubectl, namespace, job: name, path: 'result-marker', jobUid: lifecycleJobUid });
+              if (seen !== 0) captureFailedJob(liveChildRunId);
               debug.log('self-implement.pod', 'result-marker-early', { job: name, waitedMs: Date.now() - waitStartedAt, rc: seen });
               break;
             }
@@ -2501,7 +3018,19 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
               debug.log('self-implement.pod', 'gh-token-refresh-failed', { job: name, reason: 'mint-verification-or-exec-failed' });
             }
           }
-          try { follower?.poll(); } catch (e) { debug.log('self-implement.pod', 'ledger-live-unavailable', { job: name, reason: e instanceof Error ? e.message : String(e) }); }
+          let measurement = { ledgerRead: false, activityMeasured: false };
+          try { measurement = follower.poll(); } catch (e) { debug.log('self-implement.pod', 'ledger-live-unavailable', { job: name, reason: e instanceof Error ? e.message : String(e) }); }
+          if (!measurement.ledgerRead && !measurement.activityMeasured) {
+            unmeasurableSince ??= now();
+            const unmeasurableMs = Math.max(0, now() - unmeasurableSince);
+            if (!unmeasurableIncidentRecorded && unmeasurableMs >= 120 * 60_000) {
+              unmeasurableIncidentRecorded = true;
+              const incident = { job: name, childRunId: liveChildRunId, unmeasurableMs, jobStatus: 'alive', ledgerRead: false, activityMeasured: false };
+              try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-stall-unmeasurable-incident', data: incident }, ledgerDir); }
+              catch (error) { debug.log('self-implement.pod', 'pod-stall-incident-ledger-unavailable', { job: name, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
+              debug.log('self-implement.pod', 'pod-stall-unmeasurable-incident', incident, { level: 'warn' });
+            }
+          } else unmeasurableSince = null;
           if (++pollsSinceCapture >= capturePolls) {
             pollsSinceCapture = 0;
             try {
@@ -2720,32 +3249,52 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         }
         let noResultDiagnostic: string | null = null;
         // POD-NORESULT: a terminal Job without a parsed disposition is incomplete even when the Job condition says Complete.
-        const noResultCandidate = !disposition && !oomKilled && failedReason !== 'DeadlineExceeded' &&
+        const noResultCandidate = !podVanished && !disposition && !oomKilled && failedReason !== 'DeadlineExceeded' &&
           (state === 'complete' || (state === 'failed' && containerExitCode !== 0));
         if (noResultCandidate) {
           try { noResultDiagnostic = podNoResultDiagnostic(readFileSync(runLedgerPath(liveChildRunId, ledgerDir), 'utf8')); }
           catch { /* ledger not returned: do not invent a stage */ }
           noResultDiagnostic ??= 'child terminal result missing; last ledger stage=unknown; round=unknown; mustFix=unknown';
         }
-        // POD-NORESULT-LOG-TAIL: the Job runs with backoffLimit 0, so the failed Pod — and its container log —
-        //   is collected right after this. When the child ledger cannot even name the stage, read the tail here,
-        //   before deletion, so the parent keeps a maskable reason instead of `childEvidence=null`.
+        // POD-FAIL-EVIDENCE-CAPTURE: failed Pods are collected/deleted immediately after terminal handling.
+        //   Preserve a bounded log tail for every non-OOM/non-deadline failure, including known child stages:
+        //   the terminal result line can be followed by the useful stderr that explains the actual exit.
         let noResultLogEvidence: Record<string, unknown> | null = null;
-        if (noResultDiagnostic?.includes('stage=unknown')) {
+        const shouldCaptureFailureLog = state === 'failed' && !oomKilled && failedReason !== 'DeadlineExceeded';
+        if (shouldCaptureFailureLog || noResultDiagnostic?.includes('stage=unknown')) {
+          const missingStage = noResultDiagnostic?.includes('stage=unknown') ?? false;
           const logRead = readPodNoResultLogTail({ run: kubectl, namespace, job: name, maxLines: POD_NO_RESULT_LOG_TAIL_LINES });
           if ('tail' in logRead) {
-            noResultLogEvidence = { stderr: logRead.tail.join('\n'), logTail: logRead.tail, logTailLines: logRead.tail.length };
-            debug.log('self-implement.pod', 'no-result-log-tail', { job: name, childRunId: liveChildRunId, diagnostic: noResultDiagnostic, lines: logRead.tail.length, logTail: logRead.tail }, { compact: { stringMax: 500 } });
+            noResultLogEvidence = missingStage
+              ? { stderr: logRead.tail.join('\n'), logTail: logRead.tail, logTailLines: logRead.tail.length }
+              : { podLogTail: logRead.tail, podLogTailLines: logRead.tail.length };
+            debug.log('self-implement.pod', missingStage ? 'no-result-log-tail' : 'failed-pod-log-tail', {
+              job: name, childRunId: liveChildRunId, diagnostic: noResultDiagnostic, lines: logRead.tail.length, logTail: logRead.tail,
+            }, { compact: { stringMax: 500 } });
           } else {
-            noResultLogEvidence = { stderr: `log-unavailable: ${logRead.unavailable}` };
-            debug.log('self-implement.pod', 'no-result-log-tail', { job: name, childRunId: liveChildRunId, diagnostic: noResultDiagnostic, logUnavailable: logRead.unavailable }, { level: 'warn' });
+            noResultLogEvidence = missingStage
+              ? { stderr: `log-unavailable: ${logRead.unavailable}` }
+              : { podLogUnavailable: logRead.unavailable };
+            debug.log('self-implement.pod', missingStage ? 'no-result-log-tail' : 'failed-pod-log-tail', {
+              job: name, childRunId: liveChildRunId, diagnostic: noResultDiagnostic, logUnavailable: logRead.unavailable,
+            }, { level: 'warn' });
           }
         }
         if (childFailure) debug.log('self-implement.pod', 'child-error', { job: name, stage: childFailure.stage, error: childFailure.error, ...(childPrFailure ?? {}) }, { compact: { stringMax: 500 } });
         if (noResultDiagnostic && !noResultDiagnostic.includes('stage=unknown')) {
           debug.log('self-implement.pod', 'no-result-ledger-diagnostic', { job: name, childRunId: liveChildRunId, diagnostic: noResultDiagnostic }, { compact: { stringMax: 500 } });
         }
+        // POD-LAUNCH-PROVENANCE — append-only «finished» row paired with its started row on job·run.
+        // Keyed on launchRunId like the started row; a reattached Job's inherited child run rides along as childRun.
+        // exitCode stays null when the container's code was not read (never filled in as 0).
+        const finishedRow = { job: name, run: launchRunId, ...(liveChildRunId !== launchRunId ? { childRun: liveChildRunId } : {}),
+          attempt: oomRetried ? 2 : 1, phase: state, exitCode: containerExitCode,
+          reason: failedReason || containerReason || (state === 'complete' ? 'complete' : 'unknown') };
+        try { appendRunLedgerEntry({ runId: ledgerRunId, event: POD_LAUNCH_FINISHED_EVENT, timestamp: new Date((options.now ?? Date.now)()).toISOString(), data: finishedRow }, ledgerDir); }
+        catch (error) { debug.log('pod.provenance', 'history-unavailable', { job: name, row: 'finished', reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
+        debug.log('pod.provenance', 'job-finished', finishedRow);
         debug.log('self-implement.pod', 'job-finished', { job: name, ...(member ? { context: member.context } : {}), state, containerReason, stage: disposition?.stage ?? null, prUrl: disposition?.prUrl ?? null, childRunId: liveChildRunId, ledgerCompleteness,
+          ...(podTermination ? { podTermination } : {}),
           ...(state === 'failed' && !oomKilled && failedReason !== 'DeadlineExceeded'
             ? { ...(childFailure ? { childStage: childFailure.stage } : disposition?.stage ? { childStage: disposition.stage } : {}),
               // POD-NORESULT: a parsed result row without error text is not a missing result line (UX 10-07 01:01: 28 of 28 exit-2 Jobs printed one).
@@ -2820,7 +3369,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-oom-retry-finished', data: { job: name, executionKey, fromChildRunId: retryFromChildRunId, childRunId: liveChildRunId, state } }, ledgerDir);
         }
         if (goalFile) {
-          const noResultOutcome = state === 'failed' && containerExitCode !== null && noResultDiagnostic ? 'abandoned' : 'pod-no-result';
+          const noResultOutcome = podVanished || (state === 'failed' && containerExitCode !== null && noResultDiagnostic) ? 'abandoned' : 'pod-no-result';
           const record: GoalExecutionRecord = {
             runId: liveChildRunId,
             stage: (state === 'aborted' || !disposition ? 'aborted' : disposition.stage) as GoalExecutionRecord['stage'],
@@ -2837,8 +3386,10 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         if (state === 'failed' || state === 'aborted' || noResultLogEvidence || (state === 'complete' && noResultDiagnostic !== null)) {
           // Every terminal attempt writes a marker, including one with no parseable child facts.
           // The next attempt must never inherit an earlier Pod's classification.
-          const childEvidence = noResultLogEvidence ?? disposition?.childEvidence ?? null;
-          try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-child-evidence', data: { childEvidence, childRunId: liveChildRunId, job: name } }, ledgerDir); }
+          const childEvidence = noResultLogEvidence
+            ? { ...(disposition?.childEvidence ?? {}), ...noResultLogEvidence }
+            : disposition?.childEvidence ?? null;
+          try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-child-evidence', data: { childEvidence, childRunId: liveChildRunId, job: name, ...(podTermination ? { podTermination } : {}) } }, ledgerDir); }
           catch (error) { debug.log('self-implement.pod', 'child-evidence-write-failed', { job: name, childRunId: liveChildRunId, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
         }
         let prLookup: OpenPrByBranch | undefined;
@@ -2846,7 +3397,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         if (disposition && (state === 'failed' || state === 'aborted' || disposition.ok === false)
           && (!Number.isSafeInteger(disposition.prNumber) || (disposition.prNumber ?? 0) <= 0) && terminalBranch) {
           try { prLookup = await (options.lookupOpenPrByBranch ?? defaultLookupOpenPrByBranch)(terminalBranch, repoUrl); }
-          catch { prLookup = { status: 'failed', reason: 'pr-lookup-threw' }; }
+          catch (error) { prLookup = { status: 'failed', reason: `pr-lookup-failed: ${error instanceof Error ? error.message : String(error)}`.slice(0, 200) }; }
         }
         const terminalDisposition = prLookup?.status === 'found' && disposition
           ? { ...disposition, prNumber: prLookup.prNumber, prUrl: prLookup.prUrl } : disposition;
@@ -2888,11 +3439,14 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         const finishedDisposition = deadlineExceeded && disposition
           ? { ...disposition, failureClassification: 'run-deadline-exceeded' as const }
           : disposition;
-        const podExitCode = state === 'complete' && disposition?.stage !== 'host-regate-failed' && disposition?.ok !== false ? 0 : 1;
+        // A gate environment deficit can exit the child with 1 while still yielding a
+        // verified repair bundle. The host rejudges the new PR head after CAS apply.
+        const podExitCode = podVanished ? 1 : repairPodExitCode({ state, repairCommitOnly: !!options.repairCommitOnly,
+          repairArtifactReady, disposition });
         // SCHED-CONTRACT: a failed child must say why outside the Pod, not «no error diagnostic».
         const rawPodReason = podExitCode === 1 ? extractPodFailureReason({ logs, logTailReason, containerReason, jobReason: failedReason || undefined, deadlineSeconds, result: disposition ? { stage: disposition.stage, prUrl: disposition.prUrl ?? null, prNumber: disposition.prNumber ?? null } : null }) : undefined;
         const podReason = rawPodReason
-          ? noResultLogEvidence ? boundedPodLogText(rawPodReason, POD_NO_RESULT_LOG_REASON_MAX_CHARS) : rawPodReason
+          ? redactSecretText(noResultLogEvidence ? boundedPodLogText(rawPodReason, POD_NO_RESULT_LOG_REASON_MAX_CHARS) : rawPodReason)
           : undefined;
         if (podReason) debug.log('self-implement.pod', 'failure-reason', { job: name, reason: podReason });
         if (podExitCode === 1) {
@@ -2904,7 +3458,9 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         return {
           exitCode: podExitCode,
           output: tail,
-          ...(deadlineExceeded
+          ...(podVanished
+            ? { error: { code: 'pod-vanished', message: `Job ${name} disappeared after 3 consecutive NotFound polls` } }
+            : deadlineExceeded
             ? { error: { code: 'pod-deadline-exceeded', message: `Job ${name} 이 수명 상한 ${deadlineSeconds}초에 닿았다` } }
             : state === 'failed'
               ? containerExitCode === 7
@@ -3016,6 +3572,10 @@ function podPrOpenFailure(ledger: Record<string, unknown> | undefined | null, te
 }
 
 function lastPodChildFailure(logs: string): { stage: string; error: string; rawError: string } | null {
+  // Keep canonical duplicate-cap attribution while preserving the raw terminal error
+  // used by PR-open failure diagnosis below.
+  const attribution = podChildFailureAttribution(logs);
+  if (!attribution) return null;
   for (const line of logs.split('\n').reverse()) {
     if (!line.trimStart().startsWith('{')) continue;
     let result: unknown;
@@ -3025,10 +3585,8 @@ function lastPodChildFailure(logs: string): { stage: string; error: string; rawE
     const terminal = podTerminalRow(row);
     if (!terminal) continue;
     if (terminal.ok !== false || typeof terminal.error !== 'string') return null;
-    const lines = redactSecretText(terminal.error).replace(/\/home\/[^/\s]+\//g, '~/').split(/\r\n|\n|\r/);
-    const first = lines[0]!.slice(0, 240);
-    const last = lines.at(-1)!.slice(0, 240);
-    return { stage: terminal.stage, error: first === last ? first : `${first}\n${last}`, rawError: terminal.error };
+    if (terminal.stage !== attribution.stage) return null;
+    return { ...attribution, error: redactSecretText(attribution.error), rawError: terminal.error };
   }
   return null;
 }