elanous 0.2.36 → 0.2.38

package/src/task-orchestrator/dispatcher.ts

@@ -32,6 +32,7 @@ import {
   type AcceptanceReport,
 } from './acceptance.js';
 import { recordOpsEventSafe, type OpsEventInput } from '../domains/ops-log.js';
+import { defaultAnomalyCluster, extractContainerExit, type AnomalyCluster } from '../loops/orchestrator/anomaly-cluster.js';
 
 // ───────────────────────── Concurrency caps ────────────────────────
 
@@ -82,6 +83,9 @@ export interface DispatcherOptions {
    *  acceptance.checks reference fs or subprocess (file-exists /
    *  file-contains / shell-zero). */
   acceptanceIo?: AcceptanceIo;
+  /** ANOMALY-CLUSTER — grouping state written at the failure record point; while a signature has 3+ runs
+   *  and no cause verdict, relaunches of that goal·host are deferred instead of spawned. */
+  anomalyCluster?: AnomalyCluster;
 }
 
 export interface DispatchTickResult {
@@ -95,7 +99,7 @@ export interface DispatchTickResult {
   }>;
   /** Ready tasks we skipped this tick due to caps. Caller may `tick()`
    *  again after any adapter completes. */
-  deferred: Array<{ taskId: string; reason: 'cap' | 'no-adapter' | 'intake-sequential' }>;
+  deferred: Array<{ taskId: string; reason: 'cap' | 'no-adapter' | 'intake-sequential' | 'anomaly-hold' }>;
 }
 
 export class TaskDispatcher {
@@ -103,10 +107,13 @@ export class TaskDispatcher {
   private readonly activeByKind = new Map<TaskSurfaceKind, number>();
   private readonly abortByTask = new Map<string, AbortController>();
   private readonly now: () => number;
+  /** Production default is the process-wide cluster so tick-recorded failures gate relaunch here. */
+  private readonly anomaly: AnomalyCluster;
 
   constructor(private readonly opts: DispatcherOptions) {
     this.caps = { ...DEFAULT_CONCURRENCY_CAPS, ...(opts.concurrencyCaps ?? {}) };
     this.now = opts.now ?? Date.now;
+    this.anomaly = opts.anomalyCluster ?? defaultAnomalyCluster();
   }
 
   /**
@@ -147,6 +154,12 @@ export class TaskDispatcher {
         deferred.push({ taskId: task.id, reason: 'cap' });
         continue;
       }
+      // ANOMALY-CLUSTER relaunch gate: the task's goal·host relaunch is deferred while its signature has
+      // 3+ runs and no cause verdict has cleared it. Goal = task id, host = surface kind.
+      if (this.anomaly.hold(task.id, kind).hold) {
+        deferred.push({ taskId: task.id, reason: 'anomaly-hold' });
+        continue;
+      }
       const result = this.spawn(task, adapter);
       dispatched.push({
         taskId: task.id,
@@ -220,6 +233,24 @@ export class TaskDispatcher {
     }
   }
 
+  /** Records one failed attempt into the anomaly cluster (goal·host key, host excluded from signature). */
+  private recordAnomalyFailure(task: Task, observation: { runId: string; kind: string; stage: string; lastLines: string[] }): void {
+    try {
+      this.anomaly.record({
+        goal: task.id,
+        host: task.surface.kind,
+        runId: observation.runId,
+        kind: observation.kind,
+        containerExit: extractContainerExit(observation.lastLines.join('\n')),
+        stage: observation.stage,
+        lastLines: observation.lastLines,
+        at: new Date(this.now()).toISOString(),
+      });
+    } catch {
+      // Observability must not alter dispatch admission or completion.
+    }
+  }
+
   private recordOpsEvent(input: OpsEventInput): void {
     try {
       (this.opts.recordOpsEvent ?? recordOpsEventSafe)(input);
@@ -322,6 +353,8 @@ export class TaskDispatcher {
         this.recordOps(task, 'cycle_end', nextStatus, { execStatus: exec.status, durationMs: exec.durationMs });
 
         if (nextStatus === 'done') {
+          // Cause verdict — the same goal·host produced a clean run, so the relaunch hold is cleared.
+          this.anomaly.release(task.id, kind, '원인 판정: 실행이 정상 완료됨');
           this.opts.bus?.emit({
             kind: 'task-completed',
             taskId: task.id,
@@ -337,6 +370,12 @@ export class TaskDispatcher {
             reason: 'user',
           });
         } else {
+          this.recordAnomalyFailure(task, {
+            runId: exec.id,
+            kind: exec.status === 'timeout' ? 'timeout' : 'exit',
+            stage: 'monitor',
+            lastLines: [exec.error?.message ?? '', `Reason: ${exec.error?.code ?? 'UNKNOWN'}`],
+          });
           this.opts.bus?.emit({
             kind: 'task-failed',
             taskId: task.id,
@@ -368,6 +407,12 @@ export class TaskDispatcher {
         this.opts.store?.saveTask(this.opts.graph.getTask(task.id)!);
       } catch { /* ignore illegal transition */ }
       this.recordOps(task, 'cycle_end', 'failed', { errorCode: 'ADAPTER_ERROR', error: err instanceof Error ? err.message.slice(0, 120) : String(err) });
+      this.recordAnomalyFailure(task, {
+        runId: res.executionId,
+        kind: 'adapter-error',
+        stage: 'monitor',
+        lastLines: [err instanceof Error ? err.message : String(err)],
+      });
       this.opts.bus?.emit({
         kind: 'task-failed',
         taskId: task.id,

package/src/task-orchestrator/generator-prompt.ts

@@ -82,6 +82,8 @@ export function buildDecomposePrompt(
 
   const lines: string[] = [];
   const isGoalAuthorCoarse = opts.profile === 'goal-author-coarse';
+  const measuredDeviceInventory = input.context?.activeSummary?.match(/^Device inventory \(measured at goal-author repository root\): .*$/mu)?.[0];
+  const measuredDevice = measuredDeviceInventory?.match(/^Device inventory \(measured at goal-author repository root\): (missing|existing): (src\/ux-sim\/[^\s,]+)$/u);
   lines.push(
     'You are the monad-agent Task Orchestrator decomposition planner.',
     isGoalAuthorCoarse
@@ -205,6 +207,10 @@ export function buildDecomposePrompt(
       '## Device-first decomposition (DEVICE-FIRST-AUTHORING — follow strictly)',
       '### Existing device inventory (read from this checkout; use these names before proposing a new device)',
       ...deviceInventory(),
+      ...(measuredDeviceInventory
+        ? ['### Goal-author device check (measured at the target root; takes precedence over checkout inventory)',
+          measuredDeviceInventory,
+          ...(measuredDevice ? [`- Use the measured ${measuredDevice[1]} status for ${measuredDevice[2]} instead of this checkout's inventory when choosing the device branch.`] : [])] : []),
       '- The objective\'s verification plan (검증 계획/TDD) section picks a stage and ladder tier (무대·층) — e.g. a `src/ux-sim/*` stage at L2 (fake-llm·fake-bin·fake-clock). BEFORE writing slices, CHECK whether the mock device or injected event definition that this verification plan needs ALREADY EXISTS: look in `src/ux-sim/*`, the §1 device table of `docs/manual/MANUAL-ux-simulation-devices-2026-08-23.md`, and the event-monkey event kinds.',
       '- Two branches — exactly one applies per needed device:',
       '  - Device EXISTS: its name MUST go into the verification plan wording — the slice that tests the feature carries the device\'s exact name (device file / §1 table row / event kind) in its acceptance criteria and reuses the device; never re-create it.',

package/src/task-orchestrator/surfaces/pod-artifact-return.ts

@@ -7,6 +7,8 @@ import { fromJsonl, type LogRecord } from '../../mss/logging/record.js';
 
 const FILE_LIMIT = 5 * 1024 * 1024;
 const TOTAL_LIMIT = 20 * 1024 * 1024;
+export const POD_SALVAGE_BUNDLE_FILE_LIMIT = 160 * 1024 * 1024;
+export const POD_SALVAGE_BUNDLE_TOTAL_LIMIT = 180 * 1024 * 1024;
 
 type Artifact = { path: string; bytes: Buffer };
 type Incomplete = { path: string; reason: string };
@@ -50,13 +52,16 @@ export function parsePodArtifactChunks(logs: string): ParseResult {
   }
   const artifacts: Artifact[] = [];
   const error: Incomplete[] = [];
-  let bytesSoFar = 0;
+  let artifactBytes = 0;
+  let salvageBundleBytes = 0;
   for (const [token, group] of groups) {
     let path = token;
     let reason = group.reason;
     try {
       path = decodePath(token);
       if (!safeRelativePath(path)) throw new Error('unsafe relative path');
+      const salvageBundle = /^pod-salvage\/[a-zA-Z0-9._-]+\.bundle$/.test(path);
+      const fileLimit = salvageBundle ? POD_SALVAGE_BUNDLE_FILE_LIMIT : FILE_LIMIT;
       if (!reason && group.chunks.size !== group.total) reason = 'missing chunk';
       if (!reason) {
         let encoded = '';
@@ -64,15 +69,20 @@ export function parsePodArtifactChunks(logs: string): ParseResult {
           const chunk = group.chunks.get(i);
           if (!chunk) { reason = 'missing chunk'; break; }
           encoded += chunk;
-          if (encoded.length > 8 * 1024 * 1024) { reason = 'file too large'; break; }
+          if (encoded.length > Math.ceil(fileLimit * 4 / 3) + 1024 * 1024) { reason = 'file too large'; break; }
         }
         if (!reason) {
           const compressed = Buffer.from(encoded, 'base64');
           if (compressed.toString('base64') !== encoded) throw new Error('invalid base64');
-          const bytes = gunzipSync(compressed, { maxOutputLength: FILE_LIMIT + 1 });
-          if (bytes.length > FILE_LIMIT) reason = 'file too large';
-          else if (bytesSoFar + bytes.length > TOTAL_LIMIT) reason = 'total too large';
-          else { artifacts.push({ path, bytes }); bytesSoFar += bytes.length; }
+          const bytes = gunzipSync(compressed, { maxOutputLength: fileLimit + 1 });
+          if (bytes.length > fileLimit) reason = 'file too large';
+          else if ((salvageBundle ? salvageBundleBytes : artifactBytes) + bytes.length >
+            (salvageBundle ? POD_SALVAGE_BUNDLE_TOTAL_LIMIT : TOTAL_LIMIT)) reason = 'total too large';
+          else {
+            artifacts.push({ path, bytes });
+            if (salvageBundle) salvageBundleBytes += bytes.length;
+            else artifactBytes += bytes.length;
+          }
         }
       }
     } catch (e) { reason = e instanceof Error ? e.message : String(e); }

package/src/task-orchestrator/surfaces/pod-failure-reason.ts

@@ -334,10 +334,31 @@ export interface PodTermination {
   finishedAt: string | PodTerminationUnknown;
   /** From `state.terminated.reason === 'OOMKilled'` only (never from exit code 137). */
   oomKilled: boolean | PodTerminationUnknown;
+  /** A terminal verdict can race Kubernetes container status; one bounded Pod re-read records the outcome. */
+  collectionAttempts?: 2;
+  collectionFailureReason?: 'pod-still-running-after-retry' | 'pod-absent-after-retry' |
+    'pod-read-unavailable-after-retry' | 'terminated-fields-missing-after-retry' | 'pod-state-unknown-after-retry';
 }
 
-/** Job Failed condition reason first: the classification takes column one, the capture all three, from one read. */
-export const POD_TERMINATION_JOB_JSONPATH = '{.status.conditions[?(@.type=="Failed")].reason}{"\\t"}{.spec.activeDeadlineSeconds}{"\\t"}{.metadata.uid}';
+/** FailureTarget can precede Failed at the deadline. Read both in the same Job snapshot. */
+export const POD_TERMINATION_JOB_JSONPATH = '{.status.conditions[?(@.type=="Failed")].reason}{"|"}{.status.conditions[?(@.type=="FailureTarget")].reason}{"\\t"}{.spec.activeDeadlineSeconds}{"\\t"}{.metadata.uid}';
+
+export function podJobConditionReason(value: string | undefined): string {
+  const [failed, target] = (value ?? '').split('|');
+  return terminationWord(failed || target);
+}
+
+/** Emitted by the Pod wrapper before the Job's hard deadline, scoped to this Job and child run. */
+export function podDeadlineResultMarker(logs: string, job: string, runId: string): { stage: string; pr: number | null; branch: string | null } | null {
+  if (!/^[A-Za-z0-9_.:-]+$/.test(job) || !/^[A-Za-z0-9_.:-]+$/.test(runId)) return null;
+  const prefix = `ELANOUS_POD_DEADLINE_RESULT ${job} ${runId} stop-cause=deadline `;
+  for (const line of logs.split('\n').reverse()) {
+    if (!line.startsWith(prefix)) continue;
+    const match = /^stage=(clone|setup|run|unknown) pr=(unknown|[1-9]\d*) branch=(unknown|[A-Za-z0-9_./-]+)$/.exec(line.slice(prefix.length).trim());
+    if (match) return { stage: match[1]!, pr: match[2] === 'unknown' ? null : Number(match[2]), branch: match[3] === 'unknown' ? null : match[3]! };
+  }
+  return null;
+}
 /**
  * One row per Pod of this Job name. The first three columns keep the classification read's layout
  * (`creation · terminated.reason · terminated.exitCode`, empty when the child has no status yet), so the
@@ -384,7 +405,7 @@ export function readPodTermination(input: { kubectl: PodTerminationKubectl; name
   const jobUid = input.jobUid && JOB_UID.test(input.jobUid) ? input.jobUid : undefined;
   // A read without a uid, or with another uid, is not this launch's Job.
   const jobOk = jobRead?.status === 0 && jobUid !== undefined && readUid === jobUid;
-  const jobConditionReason = jobOk ? terminationWord(reasonText) : 'unknown';
+  const jobConditionReason = jobOk ? podJobConditionReason(reasonText) : 'unknown';
   const podsRead = 'podsRead' in input ? input.podsRead ?? null
     : read(['-n', namespace, 'get', 'pods', '-l', `job-name=${job}`, '-o', `jsonpath=${POD_TERMINATION_PODS_JSONPATH}`]);
   let podLookup: PodTermination['podLookup'] = 'unavailable';
@@ -444,7 +465,11 @@ export function parsePodTermination(value: unknown, job: string): PodTermination
     || !oneOf(row.podLookup, ['terminated', 'running', 'pending', 'unknown', 'absent', 'unavailable'])
     || !wordOrUnknown(row.containerReason) || !numberOrUnknown(row.exitCode)
     || !(row.finishedAt === 'unknown' || (typeof row.finishedAt === 'string' && terminationInstant(row.finishedAt) !== 'unknown'))
-    || !boolOrUnknown(row.oomKilled)) return undefined;
+    || !boolOrUnknown(row.oomKilled)
+    || (row.collectionAttempts !== undefined && row.collectionAttempts !== 2)
+    || (row.collectionFailureReason !== undefined && !oneOf(row.collectionFailureReason, [
+      'pod-still-running-after-retry', 'pod-absent-after-retry', 'pod-read-unavailable-after-retry',
+      'terminated-fields-missing-after-retry', 'pod-state-unknown-after-retry']))) return undefined;
   // Facts are attributed through the uid only: a record claiming Job or Pod facts without one is contradictory.
   if (row.jobUid === 'unknown' && (row.jobLookup !== 'unavailable' || row.podLookup !== 'unavailable')) return undefined;
   return {
@@ -455,5 +480,7 @@ export function parsePodTermination(value: unknown, job: string): PodTermination
     podLookup: row.podLookup as PodTermination['podLookup'], containerReason: row.containerReason as string,
     exitCode: row.exitCode as PodTermination['exitCode'], finishedAt: row.finishedAt as string,
     oomKilled: row.oomKilled as PodTermination['oomKilled'],
+    ...(row.collectionAttempts === 2 ? { collectionAttempts: 2 as const } : {}),
+    ...(row.collectionFailureReason ? { collectionFailureReason: row.collectionFailureReason as PodTermination['collectionFailureReason'] } : {}),
   };
 }

package/src/task-orchestrator/surfaces/pod-ledger-collect.ts

@@ -14,6 +14,7 @@ type ParseResult = Ledger[] | { error: Incomplete[]; ledgers: Ledger[] };
 const NON_PROGRESS_EVENTS = new Set(['progress-delivery-outcome']);
 const REEMIT_EXCLUDED_PREFIX = 'progress-delivery';
 type Emit = (category: string, event: string, data: Record<string, unknown>) => void;
+export interface PodLedgerMeasurement { ledgerRead: boolean; activityMeasured: boolean }
 /** Heal-loop starter seam — defaults to the real `startHealLoop` inside `recordFailureEvent`. */
 type StartHealLoop = Parameters<typeof recordFailureEvent>[2];
 
@@ -174,7 +175,7 @@ export function createPodLedgerFollower(opts: {
   stallMinutes?: number;
   now?: () => number;
   onStall?: (message: string) => void;
-}): { poll(): void; readonly owned: boolean } {
+}): { poll(): PodLedgerMeasurement; readonly owned: boolean } {
   const dir = opts.dir ?? runLedgerDir();
   const log = opts.log ?? defaultPodReemit();
   const emit: Emit = opts.emit ?? defaultPodReemit();
@@ -208,17 +209,17 @@ export function createPodLedgerFollower(opts: {
   return {
     get owned() { return owned; },
     poll() {
-      if (disabled) return;
+      if (disabled) return { ledgerRead: true, activityMeasured: false };
       if (!owned && existsSync(path)) {
         disabled = true;
         log('self-implement.pod', 'ledger-live-skipped', { runId: opts.runId, reason: 'host-ledger-exists' });
-        return;
+        return { ledgerRead: true, activityMeasured: false };
       }
       const since = `${Math.floor(lastActivityMeasuredAt / 1000)}.${String(lastActivityMeasuredAt % 1000).padStart(3, '0')}`;
       const measurementStartedAt = now();
       const until = `${Math.floor(measurementStartedAt / 1000)}.${String(measurementStartedAt % 1000).padStart(3, '0')}`;
       const r = opts.exec(`s="\${ELANOUS_STATE_DIR:-$HOME/.elanous}"; f="$s/run-ledger/${opts.runId}.jsonl"; w="$s/worktrees"; if [ -f "$f" ]; then tail -c +${offset + 1} "$f" || exit 1; fi; target=''; matches=0; for tree in "$w"/*/*.worktrees/*; do [ -e "$tree/.git" ] || continue; owner=$(git -C "$tree" config --worktree --get elanous.harness.owner 2>/dev/null) || continue; [ "$owner" = 'dev:${opts.runId}' ] || continue; target="$tree"; matches=$((matches + 1)); done; if [ "$matches" -eq 1 ]; then activity=$(find "$target" -type d \\( -name .git -o -name node_modules \\) -prune -o -type f -newermt '@${since}' ! -newermt '@${until}' -printf . 2>/dev/null) && printf '\\nELANOUS_ACTIVITY %s\\n' "\${#activity}" || printf '\\nELANOUS_ACTIVITY_ERROR\\n'; else printf '\\nELANOUS_ACTIVITY_ERROR\\n'; fi`);
-      if (r.status !== 0) { log('self-implement.pod', 'ledger-live-unavailable', { runId: opts.runId, status: r.status, stderr: r.stderr.trim().slice(0, 200) }); checkStall(false, false); return; }
+      if (r.status !== 0) { log('self-implement.pod', 'ledger-live-unavailable', { runId: opts.runId, status: r.status, stderr: r.stderr.trim().slice(0, 200) }); checkStall(false, false); return { ledgerRead: false, activityMeasured: false }; }
       const marker = r.stdout.lastIndexOf('\nELANOUS_ACTIVITY');
       const activityLine = marker < 0 ? '' : r.stdout.slice(marker + 1);
       const activityMatch = /^ELANOUS_ACTIVITY (0|[1-9]\d*)\n$/.exec(activityLine);
@@ -241,11 +242,11 @@ export function createPodLedgerFollower(opts: {
           }
         }
       }
-      if (!ledgerBytes) { checkStall(true, activityMeasured); return; }
+      if (!ledgerBytes) { checkStall(true, activityMeasured); return { ledgerRead: true, activityMeasured }; }
       offset += Buffer.byteLength(ledgerBytes);
       const text = pending + ledgerBytes;
       const cut = text.lastIndexOf('\n');
-      if (cut < 0) { pending = text; checkStall(true, activityMeasured); return; }
+      if (cut < 0) { pending = text; checkStall(true, activityMeasured); return { ledgerRead: true, activityMeasured }; }
       const complete = text.slice(0, cut + 1);
       pending = text.slice(cut + 1);
       mkdirSync(dir, { recursive: true });
@@ -278,6 +279,7 @@ export function createPodLedgerFollower(opts: {
         nextStallMinute = stallMinutes;
       }
       checkStall(true, activityMeasured);
+      return { ledgerRead: true, activityMeasured };
     },
   };
 }

package/src/task-orchestrator/surfaces/pod-ledger-events.ts

@@ -1,3 +1,100 @@
+import { mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+/** Capture a failed Job against its recorded placement, never the caller's current kubectl context. */
+export function captureFailedPodJobs(input: {
+  runId: string;
+  job: string;
+  childRunId?: string;
+  ledgerPath: string;
+  artifactDir: string;
+  kubectl: (host: string, args: readonly string[]) => { status: number | null; stdout: string; stderr: string };
+  record: (event: string, data: Record<string, unknown>) => void;
+  now?: () => number;
+}): void {
+  const { runId, job, ledgerPath, artifactDir, kubectl, record } = input;
+  const capturedAt = new Date((input.now ?? Date.now)()).toISOString();
+  const base = { runId, job, capturedAt };
+  const finish = (outcome: 'collected' | 'failed' | 'vanished', reason: string, extra: Record<string, unknown> = {}) =>
+    record('pod-failure-capture', { ...base, ...extra, outcome, reason });
+  if (!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(job)) { finish('failed', 'job-invalid'); return; }
+  if (!/^[a-zA-Z0-9_-]+$/.test(runId)) { finish('failed', 'run-id-invalid'); return; }
+  let rows: Array<{ runId?: string; event?: string; data?: Record<string, unknown> }>;
+  try {
+    rows = readFileSync(ledgerPath, 'utf8').trim().split('\n').map(line => JSON.parse(line));
+    if (rows.some(row => !row || typeof row !== 'object' || Array.isArray(row))) throw new Error('invalid ledger row');
+  } catch { finish('failed', 'ledger-unavailable'); return; }
+  if (rows.some(row => row.runId !== runId)) { finish('failed', 'ledger-run-mismatch'); return; }
+  const placements = rows.filter(row => row.event === 'pod-job-applied' && row.data?.job === job).map(row => row.data!);
+  if (!placements.length || placements.some(p => !['host', 'context', 'namespace', 'childRunId'].every(key => typeof p[key] === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9.-]*$/.test(p[key] as string))
+    || typeof p.jobUid !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9-]*$/.test(p.jobUid))) {
+    finish('failed', 'placement-incomplete'); return;
+  }
+  const selected = input.childRunId ? placements.filter(p => p.childRunId === input.childRunId) : placements;
+  if (!selected.length) { finish('failed', 'placement-incomplete'); return; }
+  const first = selected[0]!;
+  if (placements.some(p => ['host', 'context', 'namespace'].some(key => p[key] !== first[key]))
+    || selected.some(p => ['childRunId', 'jobUid'].some(key => p[key] !== first[key]))) {
+    finish('failed', 'placement-conflict'); return;
+  }
+  const location = { host: first.host, context: first.context, namespace: first.namespace, childRunId: first.childRunId, jobUid: first.jobUid };
+  const evidenceDir = join(artifactDir, 'pod-failure-capture', runId, job, first.childRunId as string);
+  const previous = rows.find(row => row.event === 'pod-failure-capture' && row.data?.job === job && row.data?.outcome === 'collected'
+    && row.data.childRunId === first.childRunId && row.data.jobUid === first.jobUid
+    && row.data.host === first.host && row.data.context === first.context && row.data.namespace === first.namespace);
+  // A ledger row describes a prior collection; it does not guarantee that its files survived.
+  // Check all three expected paths before treating it as complete, then recapture any missing evidence.
+  if (previous && ([['jobEvidence', 'job.json'], ['podEvidence', 'pods.json'], ['logEvidence', 'child.log']] as const)
+    .every(([field, filename]) => {
+      const path = join(evidenceDir, filename);
+      if (previous.data?.[field] !== path) return false;
+      try { return statSync(path).isFile(); } catch { return false; }
+    })) return;
+  const args = ['--context', first.context as string, '-n', first.namespace as string] as const;
+  try {
+    const jobResult = kubectl(first.host as string, [...args, 'get', 'job', job, '-o', 'json']);
+    if (jobResult.status !== 0) {
+      finish(/\bNotFound\b|not found/i.test(jobResult.stderr) ? 'vanished' : 'failed',
+        /\bNotFound\b|not found/i.test(jobResult.stderr) ? 'job-not-found' : 'job-read-failed', location);
+      return;
+    }
+    const jobBody = JSON.parse(jobResult.stdout) as { metadata?: { name?: string; uid?: string } };
+    if (jobBody.metadata?.name !== job || jobBody.metadata.uid !== first.jobUid) { finish('failed', 'job-identity-mismatch', location); return; }
+    mkdirSync(evidenceDir, { recursive: true });
+    const save = (filename: string, bytes: string, sameJob?: (existing: string) => boolean): string => {
+      const path = join(evidenceDir, filename);
+      try { writeFileSync(path, bytes, { flag: 'wx', mode: 0o600 }); }
+      catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+        const existing = readFileSync(path, 'utf8');
+        if (existing !== bytes && !sameJob?.(existing)) throw error;
+      }
+      return path;
+    };
+    const jobEvidence = save('job.json', jobResult.stdout, existing => {
+      try {
+        const metadata = (JSON.parse(existing) as { metadata?: { name?: string; uid?: string } }).metadata;
+        return metadata?.name === job && metadata.uid === first.jobUid;
+      } catch { return false; }
+    });
+    const podResult = kubectl(first.host as string, [...args, 'get', 'pods', '-l', `job-name=${job}`, '-o', 'json']);
+    if (podResult.status !== 0) { finish('failed', 'pods-read-failed', { ...location, jobEvidence }); return; }
+    const pods = JSON.parse(podResult.stdout) as { items?: Array<{ metadata?: { name?: string; ownerReferences?: Array<{ uid?: string }> } }> };
+    if (!pods.items?.length || pods.items.some(p => !p.metadata?.ownerReferences?.some(owner => owner.uid === jobBody.metadata?.uid))) {
+      finish('failed', 'pod-owner-mismatch', { ...location, jobEvidence }); return;
+    }
+    const podEvidence = save('pods.json', podResult.stdout);
+    const podName = pods.items[0]?.metadata?.name;
+    if (pods.items.length !== 1 || !podName || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(podName)) {
+      finish('failed', 'pod-ambiguous', { ...location, jobEvidence, podEvidence }); return;
+    }
+    const logs = kubectl(first.host as string, [...args, 'logs', `pod/${podName}`, '-c', 'child']);
+    if (logs.status !== 0) { finish('failed', 'logs-read-failed', { ...location, jobEvidence, podEvidence }); return; }
+    const logEvidence = save('child.log', logs.stdout);
+    finish('collected', 'job-failed', { ...location, jobEvidence, podEvidence, logEvidence });
+  } catch { finish('failed', 'capture-error', location); }
+}
+
 const SECRET_FIELD = /token|secret|password|authorization|key/i;
 const SAFE_FIELD = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
 const SECRET_VALUE = /(?:\b(?:bearer|basic)\s+\S+|\b(?:token|secret|password|authorization|api[-_]?key|access[-_]?key|private[-_]?key)\b\s*(?:is|[=:])\s*["']?\S+|\b(?:sk-[A-Za-z0-9_-]{8,}|gh[pousr]_[A-Za-z0-9_]{8,}))\b/i;

package/src/task-orchestrator/surfaces/pod-pool.ts

@@ -193,7 +193,7 @@ export function parsePodPool(spec: string): PodPoolMember[] {
     // `:N` 이 없으면 «상한 없음»이 아니라 기본 상한 2 다 — 그 사실(`capacityDefaulted`)을 멤버에 남긴다.
     const capacityDefaulted = m[3] === undefined;
     const capacity = capacityDefaulted ? POD_POOL_DEFAULT_CAPACITY : Number(m[3]);
-    // POOL-LITE (10-07): `:0` means «this member is off» — a `node-c:0` entry once threw here and broke every launch.
+    // POOL-LITE (10-07): `:0` means «this member is off» — a zero-capacity entry once threw here and broke every launch.
     //   It is dropped below (never chosen); only a pool with no live member left is an error.
     if (!Number.isInteger(capacity) || capacity < 0) throw new Error(`--pod-pool: 상한은 1 이상 — 「${part}」`);
     if (m[5] && Number(m[5]) > 65535) throw new Error(`--pod-pool: 레지스트리 포트는 65535 이하 — 「${part}」`);
@@ -243,14 +243,27 @@ export function podWorkLabels(identity: PodWorkIdentity): Record<string, string>
   };
 }
 
-/** Minih standard-Job policy, independent of the configured pool member capacity. Not wired into allocation. */
+/**
+ * MINIH-MODE (0.2.37) — where this pool's standard Jobs run: `home` (1 standard Job) or `external` (2).
+ * The location is declared explicitly by the launch (`minihLocationFrom` reads `ELANOUS_MINIH_LOCATION`); when it
+ * is absent the configured member capacities decide, exactly as before.
+ */
 export type MinihLocation = 'home' | 'external';
 
+/** The declared location for a launch: `home` / `external` only. Absent, empty or unknown → null (configured capacity). */
+export function minihLocationFrom(value: string | undefined | null): MinihLocation | null {
+  const normalized = value?.trim().toLowerCase();
+  return normalized === 'home' || normalized === 'external' ? normalized : null;
+}
+
 export function minihStandardCapacity(location: MinihLocation): number {
   return location === 'home' ? 1 : 2;
 }
 
-/** A drain withholds new slots until occupancy falls to the target; it never evicts Running Pods. */
+/**
+ * A drain withholds new slots until occupancy falls to the target; it never evicts Running Pods.
+ * `PodPoolScheduler.tryAcquire` applies this to new standard-Job admission when a location is declared.
+ */
 export function decideMinihDrain(location: MinihLocation, runningPods: number, pendingPods = 0): {
   capacity: number;
   runningPods: number;
@@ -281,8 +294,8 @@ export interface PodPlacement {
 }
 
 /**
- * Preferred members for a placement kind: lite → the smallest-capacity member(s) (node-c), standard → the largest (node-b).
- * Capacity is the operator's own statement of member size (`pool-node-b@node-b:40,pool-node-c@node-c:6`), so no new spec syntax.
+ * Preferred members for a placement kind: lite → the smallest-capacity member(s), standard → the largest.
+ * Capacity is the operator's own statement of member size (`pool-node-a@node-a:40,pool-node-b@node-b:6`), so no new spec syntax.
  * When every member has the same capacity there is no small/big member and no preference (empty list).
  */
 export function preferredMembers(members: readonly PodPoolMember[], kind: PodPlacementKind | null | undefined): string[] {
@@ -582,6 +595,26 @@ export class PodPoolScheduler {
       recommended: Math.min(this.members.reduce((n, item) => n + item.capacity, 0), snapshots.reduce((n, item) => n + item.recommended, 0)),
       waiting: snapshots.flatMap((item) => item.waiting) };
   }
+  /**
+   * MINIH-MODE — withhold NEW standard-Job admission while the declared location has no free standard slot.
+   * Occupancy = the measured node-c Pods (Running ⊕ Pending; a Pending Pod already holds a slot) ⊕ this process's
+   * node-c inflight slots. Nothing here deletes, evicts or re-schedules a Pod: an excess above the location's capacity
+   * leaves only as those Pods finish, and until then new admissions wait. `lite` Jobs are not the standard
+   * admission this policy gates, and no declared location keeps the configured member capacities.
+   */
+  private minihHold(kind: PodPlacementKind | null, location: MinihLocation | null, reading: Record<string, MemberOccupancy>): { capacity: number; occupied: number; draining: boolean } | null {
+    if (!location || kind === 'lite') return null;
+    // A launch pool can contain node-b and WSL beside node-c. Their Pods do not occupy node-c's physical slots.
+    const minihMembers = this.members.filter((m) => m.capacity > 0 && (m.sshHost === 'node-c' || m.context === 'pool-node-c'));
+    if (minihMembers.length === 0) return null;
+    // Lite Jobs also hold a physical node-c slot while running, even though this policy never blocks their admission.
+    const inflight = minihMembers.reduce((count, m) => count + (this.inflight.get(m.context) ?? 0), 0);
+    // The measurement reports Running and Pending as one occupied count, and decideMinihDrain judges only their sum.
+    const occupied = minihMembers
+      .reduce((count, m) => count + (reading[m.context]?.occupied ?? 0), inflight);
+    const decision = decideMinihDrain(location, occupied);
+    return decision.availableSlots > 0 ? null : { capacity: decision.capacity, occupied, draining: decision.drainNewAdmissions };
+  }
   /**
    * Pick the member with the largest free share: (capacity − measured cluster occupancy − this process's inflight) / capacity.
    * POOL-SPREAD (10-06): comparing absolute free slots always picked the big member (node-b 25 vs node-c 4), so the small
@@ -593,9 +626,10 @@ export class PodPoolScheduler {
    * member the 0.2.15 gate launched its shards one at a time.
    * Ties keep the configured member order. Returns null when every readable member is full.
    */
-  async tryAcquire(skip?: ReadonlySet<string>, onEmpty?: (reason: string) => void, mode: { selfCapped?: boolean; kind?: PodPlacementKind | null; onPlacement?: (placement: PodPlacement) => void; signal?: AbortSignal } = {}): Promise<PodPoolMember | null> {
+  async tryAcquire(skip?: ReadonlySet<string>, onEmpty?: (reason: string) => void, mode: { selfCapped?: boolean; kind?: PodPlacementKind | null; /** MINIH-MODE: a declared location gates new standard-Job admission (home 1 · external 2). */ minihLocation?: MinihLocation | null; onPlacement?: (placement: PodPlacement) => void; signal?: AbortSignal } = {}): Promise<PodPoolMember | null> {
     const selfCapped = mode.selfCapped === true;
     const kind = mode.kind ?? null;
+    const minihLocation = mode.minihLocation ?? null;
     // POOL-LITE: lite goals try the small member first, implementation goals the big one; full → overflow by free share.
     const preferred = new Set(preferredMembers(this.members, kind));
     let reading: Record<string, MemberOccupancy>;
@@ -608,6 +642,9 @@ export class PodPoolScheduler {
     }
     // A caller may abandon a slow occupancy read. Never acquire its lease after cancellation.
     if (mode.signal?.aborted) throw mode.signal.reason ?? new Error('pod pool acquisition aborted');
+    // MINIH-MODE: only node-c candidates are held. Other pool members retain their own configured capacity.
+    // Running/Pending Pods already in the pool stay exactly as they are.
+    const minihHeld = this.minihHold(kind, minihLocation, reading);
     const free: Record<string, number> = {};
     const measured: Record<string, boolean> = {};
     let best: { member: PodPoolMember; slots: number; measured: boolean; preferred: boolean } | null = null;
@@ -621,6 +658,10 @@ export class PodPoolScheduler {
     for (const m of this.members) {
       // A capacity-0 member is off — never chosen (and no division by zero in the share).
       if (m.capacity <= 0) continue;
+      if (minihHeld && (m.sshHost === 'node-c' || m.context === 'pool-node-c')) {
+        free[m.context] = 0;
+        continue;
+      }
       // LAUNCH-STALL: a member this launch cannot fit is skipped for this call only (other launches may fit it).
       if (skip?.has(m.context)) continue;
       const inflight = this.inflight.get(m.context) ?? 0;
@@ -635,7 +676,12 @@ export class PodPoolScheduler {
       if (better(cand)) best = cand;
     }
     if (!best) {
-      onEmpty?.(`no free slot · free=${JSON.stringify(free)} · measured=${JSON.stringify(measured)}${selfCapped ? ' · selfCapped' : ''}${skip?.size ? ` · skipped=${[...skip].join(',')}` : ''}${kind ? ` · kind=${kind}` : ''}`);
+      if (minihHeld) {
+        const reason = `node-c 드레인: ${minihLocation} 표준 상한 ${minihHeld.capacity} · 점유 ${minihHeld.occupied}${minihHeld.draining
+          ? ' — 초과분이 빠질 때까지 새 입장 보류(기존 Pod 유지)' : ' — 상한이 찼다'}`;
+        debug.log('pod.pool', 'node-c-drain-hold', { location: minihLocation, capacity: minihHeld.capacity, occupied: minihHeld.occupied, draining: minihHeld.draining, kind });
+        onEmpty?.(reason);
+      } else onEmpty?.(`no free slot · free=${JSON.stringify(free)} · measured=${JSON.stringify(measured)}${selfCapped ? ' · selfCapped' : ''}${skip?.size ? ` · skipped=${[...skip].join(',')}` : ''}${kind ? ` · kind=${kind}` : ''}`);
       return null;
     }
     const chosen: { member: PodPoolMember; slots: number; measured: boolean; preferred: boolean } = best;
@@ -842,6 +888,29 @@ export function syncPoolImage(member: PodPoolMember, image: string, localCommit:
 
 export type PoolKubectl = (args: readonly string[], input?: string) => { status: number | null; stdout: string; stderr: string };
 
+/** Read identities for a shadow decision; this never reserves or changes a Pod. */
+export function snapshotWarmPoolMembers(members: readonly PodPoolMember[], kubectl: PoolKubectl):
+  Record<string, Array<{ name: string; uid: string; node: string | null }>> | null {
+  const result: Record<string, Array<{ name: string; uid: string; node: string | null }>> = {};
+  for (const member of members) {
+    const observed = kubectl(['--context', member.context, '-n', 'elanous-test', 'get', 'pods', '-l', 'elanous.kind=warm-worker', '-o', 'json']);
+    if (observed.status !== 0) return null;
+    try {
+      const parsed: unknown = JSON.parse(observed.stdout);
+      if (!parsed || typeof parsed !== 'object' || !('items' in parsed) || !Array.isArray(parsed.items)) return null;
+      const rows: Array<{ name: string; uid: string; node: string | null }> = [];
+      for (const item of parsed.items) {
+        if (!item || typeof item !== 'object' || !item.metadata || typeof item.metadata.name !== 'string'
+          || typeof item.metadata.uid !== 'string' || !item.metadata.name || !item.metadata.uid) return null;
+        const node = typeof item.spec?.nodeName === 'string' ? item.spec.nodeName : null;
+        rows.push({ name: item.metadata.name, uid: item.metadata.uid, node });
+      }
+      result[member.context] = rows.sort((a, b) => a.uid.localeCompare(b.uid));
+    } catch { return null; }
+  }
+  return result;
+}
+
 /**
  * 발사 전 점검 — 노드마다 «컨텍스트가 닿나 · elanous-test 네임스페이스가 있나».
  * ⛔ 안 되는 노드는 «조용히» 빼지 않는다 — 이유를 낸다. 하나도 안 되면 ok=false.
@@ -926,7 +995,7 @@ export async function syncPoolImages(members: readonly PodPoolMember[], image: s
   const remoteBuild = deps.remoteBuild ?? (script ? defaultRemoteBuild(script, image) : null);
   // The registry-less build fallback below calls this ship path, including its remote import result check.
   const ship = deps.ship ?? ((m: PodPoolMember, img: string, commit: string | null, remote: RemoteRun) =>
-    syncPoolImage(m, img, commit, { run: remote, inspect: deps.inspect, transfer: deps.transfer }));
+    syncPoolImage(m, img, commit, { run: remote, inspect: deps.inspect, transfer: deps.transfer, lock: deps.lock }));
   const results = new Map<string, PoolImageSync>();
   // pack 한 번 ⊕ 나눠 쓰기 — 원격 멤버가 둘 이상일 때만(하나뿐이면 종전대로 build.sh 가 스스로 pack 한다).
   //   주입된 remoteBuild(시험)에는 진짜 pack 을 붙이지 않는다 — pack 도 주입해야 쓴다.

package/src/task-orchestrator/surfaces/pod-warm-worker-provider.ts

@@ -1,9 +1,9 @@
 /** Fenced warm-Pod lease bridge. The Job remains authoritative. */
 import { spawn, spawnSync } from 'node:child_process';
 import { isAbsolute, join } from 'node:path';
-import { constants, closeSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { constants, closeSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir, userInfo } from 'node:os';
-import { dlopen, read } from 'bun:ffi';
+import { dlopen, read, type Pointer } from 'bun:ffi';
 import { createHash, randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { debug } from '../../debug/log.js';
@@ -165,7 +165,8 @@ const prepareLockLib = process.platform === 'linux' || process.platform === 'dar
     [process.platform === 'linux' ? '__errno_location' : '__error']: { args: [], returns: 'ptr' },
   }) : null;
 const prepareFlock = prepareLockLib?.symbols.flock ?? null;
-const prepareErrno = prepareLockLib?.symbols[process.platform === 'linux' ? '__errno_location' : '__error'];
+const prepareErrnoLocation = prepareLockLib?.symbols[process.platform === 'linux' ? '__errno_location' : '__error'];
+const readPrepareErrno = (): number => (prepareErrnoLocation ? read.i32(prepareErrnoLocation() as Pointer) : -1);
 const LOCK_EX = 2;
 const LOCK_NB = 4;
 const LOCK_UN = 8;
@@ -190,7 +191,7 @@ async function withPrepareLease<T>(candidate: WarmWorkerCandidate, directory: st
     while (!acquired) {
       if (signal?.aborted) throw new Error('warm prepare lock wait cancelled');
       if (prepareFlock(fd, LOCK_EX | LOCK_NB) === 0) { acquired = true; break; }
-      const errno = prepareErrno ? read.i32(prepareErrno()) : -1;
+      const errno = readPrepareErrno();
       // EWOULDBLOCK/EAGAIN: Linux 11, Darwin 35. EINTR is safe to retry.
       if (errno !== 11 && errno !== 35 && errno !== 4)
         throw new Error(`warm prepare flock failed (errno ${errno})`);
@@ -818,11 +819,16 @@ if (import.meta.main) {
     // Read-only: join the cold CLI legs and the warm gate legs both processes wrote to logs.db.
     try {
       const storeMod = await import('../../mss/logging/log-store.js');
-      const store = storeMod.LogStore.openReadOnly(storeMod.logsDbPath());
-      try { process.stdout.write(JSON.stringify({ warmReuseTimePairs: readWarmReuseTimePairs(store) }) + '\n'); }
-      finally { store.close(); }
-    } catch {
-      process.stdout.write(JSON.stringify({ warmReuseTimePairs: null, reason: 'logs-unavailable' }) + '\n');
+      const dbPath = storeMod.logsDbPath();
+      // No logs.db yet means no leg was ever measured: an empty pair list, not a failed query.
+      if (!existsSync(dbPath)) process.stdout.write(JSON.stringify({ warmReuseTimePairs: [] }) + '\n');
+      else {
+        const store = storeMod.LogStore.openReadOnly(dbPath);
+        try { process.stdout.write(JSON.stringify({ warmReuseTimePairs: readWarmReuseTimePairs(store) }) + '\n'); }
+        finally { store.close(); }
+      }
+    } catch (error) {
+      process.stdout.write(JSON.stringify({ warmReuseTimePairs: null, reason: 'logs-unavailable', detail: String(error) }) + '\n');
       process.exitCode = 2;
     }
   }