elanous 0.2.37 → 0.2.40

package/src/task-orchestrator/surfaces/pod-config-snapshot.ts

@@ -0,0 +1,123 @@
+import { createHash } from 'node:crypto';
+import type { UserConfig } from '../../user-config.js';
+
+type JsonValue = null | boolean | number | string | JsonValue[] | { [key: string]: JsonValue };
+type JsonObject = { [key: string]: JsonValue };
+type SnapshotSource = 'host-effective' | 'runtime';
+type Allowlist = { readonly [key: string]: true | Allowlist };
+
+const ROLE = { provider: true, tier: true, model: true, effort: true } as const;
+/** Adding a setting requires naming its path here. Arbitrary host config never reaches a Pod. */
+const POD_CONFIG_ALLOWLIST = {
+  llm: {
+    provider: true, model: true, streamIdleTimeoutMs: true,
+    codexAccountRotation: true, codexQuotaPolicy: true, codexCreditReserve: true,
+    grokWeeklyCapPct: true, fallbackChain: true,
+    zaiCodingPlan: { overage: true, maxConcurrent: true },
+    openrouter: { fallbackModel: true },
+  },
+  roleLlm: { implement: ROLE, review: ROLE, research: ROLE, planning: ROLE, audit: ROLE, classify: ROLE },
+  harness: { worktreeAddTimeoutSec: true, knowhowChildInjection: true, authorGrade: true,
+    exposeGate: true, difficultyPlacement: true, substrate: true, authorOnPod: true },
+  tools: { selfImplement: { childInstanceMode: true, observeOnly: true, fabricDecompose: true,
+    autoOpenPr: true } },
+  loops: { orchestrator: { enabled: true, mode: true, trafficMode: true, idleRequest: true,
+    finishGate: true, handToTaskAgent: true, degradationSignal: true, maxDelegatePerTick: true,
+    dispatch: { podTarget: true, localLane: true } } },
+} as const satisfies Allowlist;
+
+function scalar(value: unknown): JsonValue | undefined {
+  if (value === null || typeof value === 'string' || typeof value === 'boolean') return value;
+  if (typeof value === 'number') return Number.isFinite(value) ? value : undefined;
+  if (Array.isArray(value)) {
+    const items = value.map(scalar);
+    return items.every((item) => item !== undefined) ? items as JsonValue[] : undefined;
+  }
+  return undefined;
+}
+
+function allowed(value: unknown, schema: true | Allowlist): JsonValue | undefined {
+  if (schema === true) return scalar(value);
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;
+  const out: JsonObject = {};
+  for (const key of Object.keys(schema).sort()) {
+    const item = allowed((value as Record<string, unknown>)[key], schema[key]!);
+    if (item !== undefined) out[key] = item;
+  }
+  return out;
+}
+
+function objectAt(value: unknown): JsonObject {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value as JsonObject : {};
+}
+
+function canonical(value: JsonValue): JsonValue {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (value && typeof value === 'object') {
+    const out: JsonObject = {};
+    for (const key of Object.keys(value).sort()) {
+      const item = canonical(value[key]!);
+      if (typeof item !== 'object' || item === null || Array.isArray(item) || Object.keys(item).length > 0) out[key] = item;
+    }
+    return out;
+  }
+  return value;
+}
+
+function sourcesOf(value: JsonValue, path: string, sources: Record<string, SnapshotSource>): void {
+  if (value && typeof value === 'object' && !Array.isArray(value)) {
+    for (const key of Object.keys(value).sort()) sourcesOf(value[key]!, path ? `${path}.${key}` : key, sources);
+  } else sources[path] = 'host-effective';
+}
+
+/** A Pod receives only these effective, non-credential settings. The envelope is evidence;
+ * configJson is the plain config consumed by the child. Neither contains host credentials. */
+export function buildPodConfigSnapshot(config: UserConfig, runtime: {
+  steps: readonly string[];
+  overage: 'stop' | 'balance' | 'openrouter';
+  worktreeAddTimeoutSec: number;
+}): {
+  version: 1;
+  keys: JsonObject & { llm: JsonObject; harness: JsonObject };
+  sources: Record<string, SnapshotSource>;
+  hash: string;
+  envelopeJson: string;
+  configJson: string;
+  keyCount: number;
+} {
+  const host = config as unknown as Record<string, unknown>;
+  const selected = objectAt(allowed(host, POD_CONFIG_ALLOWLIST));
+  const tools = objectAt(selected.tools);
+  const loops = objectAt(selected.loops);
+  const keys = {
+    harness: objectAt(selected.harness),
+    llm: objectAt(selected.llm),
+    loops: { orchestrator: objectAt(loops.orchestrator) },
+    roleLlm: objectAt(selected.roleLlm),
+    tools: { selfImplement: objectAt(tools.selfImplement) },
+  };
+  const rawDefault = objectAt(host.tools).selfImplement;
+  const preference = objectAt(rawDefault).podChildDefault;
+  if (preference === 'off' || preference === false) keys.tools.selfImplement.podChildDefault = 'off';
+  else if (preference && typeof preference === 'object' && !Array.isArray(preference)) {
+    const raw = preference as Record<string, unknown>;
+    const provider = typeof raw.provider === 'string' ? raw.provider.trim() : '';
+    const model = typeof raw.model === 'string' ? raw.model.trim() : '';
+    if (provider) keys.tools.selfImplement.podChildDefault = { provider, ...(model ? { model } : {}) };
+  }
+  keys.llm.fallbackChain = [...runtime.steps];
+  const zai = objectAt(keys.llm.zaiCodingPlan);
+  zai.overage = runtime.overage;
+  keys.llm.zaiCodingPlan = zai;
+  keys.harness.worktreeAddTimeoutSec = runtime.worktreeAddTimeoutSec;
+  const canonicalKeys = canonical(keys) as JsonObject & { llm: JsonObject; harness: JsonObject };
+  const sources: Record<string, SnapshotSource> = {};
+  sourcesOf(canonicalKeys, '', sources);
+  sources['llm.fallbackChain'] = 'runtime';
+  sources['llm.zaiCodingPlan.overage'] = 'runtime';
+  sources['harness.worktreeAddTimeoutSec'] = 'runtime';
+  const version = 1 as const;
+  const body = { version, keys: canonicalKeys, sources };
+  const hash = createHash('sha256').update(JSON.stringify(body)).digest('hex');
+  return { ...body, hash, envelopeJson: JSON.stringify({ ...body, hash }), configJson: JSON.stringify(canonicalKeys), keyCount: Object.keys(sources).length };
+}

package/src/task-orchestrator/surfaces/pod-failure-reason.ts

@@ -42,7 +42,32 @@ function ledgerString(value: unknown): string {
   return typeof value === 'string' && value.trim().length > 0 ? value : '';
 }
 
-type PreflightCheck = { reasonCode: string; checkName: string; targetPath?: string };
+export type PreflightCheck = { reasonCode: string; checkName: string; targetPath?: string };
+
+/**
+ * A Pod failure's structured ledger axes: the rejection's own reason code, check name and *untruncated* target
+ * path, kept apart from the human-readable reason text — and, separately from all of them, whether the child's
+ * terminal result line was absent at all.
+ */
+export interface PodFailureLedgerAxes {
+  readonly reasonCode?: string;
+  readonly checkName?: string;
+  readonly targetPath?: string;
+  readonly preflightChecks?: readonly PreflightCheck[];
+  /** `true` = the child wrote no terminal result line. Absence is never folded into the rejection reason. */
+  readonly noResultLine?: true;
+}
+
+/** Keep the failure's structured facts as their own ledger fields; absent facts stay omitted (never `''`). */
+export function podFailureLedgerAxes(exit: PodFailureLedgerAxes): PodFailureLedgerAxes {
+  return {
+    ...(exit.reasonCode ? { reasonCode: exit.reasonCode } : {}),
+    ...(exit.checkName ? { checkName: exit.checkName } : {}),
+    ...(exit.targetPath ? { targetPath: exit.targetPath } : {}),
+    ...(exit.preflightChecks?.length ? { preflightChecks: exit.preflightChecks } : {}),
+    ...(exit.noResultLine ? { noResultLine: true as const } : {}),
+  };
+}
 
 /** Keep each structured check paired with its own path; legacy blockers retain their name/detail diagnostic. */
 function preflightBlockerText(blockers: unknown): { error: string; preflightChecks: PreflightCheck[] } {
@@ -334,10 +359,31 @@ export interface PodTermination {
   finishedAt: string | PodTerminationUnknown;
   /** From `state.terminated.reason === 'OOMKilled'` only (never from exit code 137). */
   oomKilled: boolean | PodTerminationUnknown;
+  /** A terminal verdict can race Kubernetes container status; one bounded Pod re-read records the outcome. */
+  collectionAttempts?: 2;
+  collectionFailureReason?: 'pod-still-running-after-retry' | 'pod-absent-after-retry' |
+    'pod-read-unavailable-after-retry' | 'terminated-fields-missing-after-retry' | 'pod-state-unknown-after-retry';
 }
 
-/** Job Failed condition reason first: the classification takes column one, the capture all three, from one read. */
-export const POD_TERMINATION_JOB_JSONPATH = '{.status.conditions[?(@.type=="Failed")].reason}{"\\t"}{.spec.activeDeadlineSeconds}{"\\t"}{.metadata.uid}';
+/** FailureTarget can precede Failed at the deadline. Read both in the same Job snapshot. */
+export const POD_TERMINATION_JOB_JSONPATH = '{.status.conditions[?(@.type=="Failed")].reason}{"|"}{.status.conditions[?(@.type=="FailureTarget")].reason}{"\\t"}{.spec.activeDeadlineSeconds}{"\\t"}{.metadata.uid}{"\\t"}{.metadata.creationTimestamp}{"\\t"}{.status.completionTime}';
+
+export function podJobConditionReason(value: string | undefined): string {
+  const [failed, target] = (value ?? '').split('|');
+  return terminationWord(failed || target);
+}
+
+/** Emitted by the Pod wrapper before the Job's hard deadline, scoped to this Job and child run. */
+export function podDeadlineResultMarker(logs: string, job: string, runId: string): { stage: string; pr: number | null; branch: string | null } | null {
+  if (!/^[A-Za-z0-9_.:-]+$/.test(job) || !/^[A-Za-z0-9_.:-]+$/.test(runId)) return null;
+  const prefix = `ELANOUS_POD_DEADLINE_RESULT ${job} ${runId} stop-cause=deadline `;
+  for (const line of logs.split('\n').reverse()) {
+    if (!line.startsWith(prefix)) continue;
+    const match = /^stage=(clone|setup|run|unknown) pr=(unknown|[1-9]\d*) branch=(unknown|[A-Za-z0-9_./-]+)$/.exec(line.slice(prefix.length).trim());
+    if (match) return { stage: match[1]!, pr: match[2] === 'unknown' ? null : Number(match[2]), branch: match[3] === 'unknown' ? null : match[3]! };
+  }
+  return null;
+}
 /**
  * One row per Pod of this Job name. The first three columns keep the classification read's layout
  * (`creation · terminated.reason · terminated.exitCode`, empty when the child has no status yet), so the
@@ -384,7 +430,7 @@ export function readPodTermination(input: { kubectl: PodTerminationKubectl; name
   const jobUid = input.jobUid && JOB_UID.test(input.jobUid) ? input.jobUid : undefined;
   // A read without a uid, or with another uid, is not this launch's Job.
   const jobOk = jobRead?.status === 0 && jobUid !== undefined && readUid === jobUid;
-  const jobConditionReason = jobOk ? terminationWord(reasonText) : 'unknown';
+  const jobConditionReason = jobOk ? podJobConditionReason(reasonText) : 'unknown';
   const podsRead = 'podsRead' in input ? input.podsRead ?? null
     : read(['-n', namespace, 'get', 'pods', '-l', `job-name=${job}`, '-o', `jsonpath=${POD_TERMINATION_PODS_JSONPATH}`]);
   let podLookup: PodTermination['podLookup'] = 'unavailable';
@@ -444,7 +490,11 @@ export function parsePodTermination(value: unknown, job: string): PodTermination
     || !oneOf(row.podLookup, ['terminated', 'running', 'pending', 'unknown', 'absent', 'unavailable'])
     || !wordOrUnknown(row.containerReason) || !numberOrUnknown(row.exitCode)
     || !(row.finishedAt === 'unknown' || (typeof row.finishedAt === 'string' && terminationInstant(row.finishedAt) !== 'unknown'))
-    || !boolOrUnknown(row.oomKilled)) return undefined;
+    || !boolOrUnknown(row.oomKilled)
+    || (row.collectionAttempts !== undefined && row.collectionAttempts !== 2)
+    || (row.collectionFailureReason !== undefined && !oneOf(row.collectionFailureReason, [
+      'pod-still-running-after-retry', 'pod-absent-after-retry', 'pod-read-unavailable-after-retry',
+      'terminated-fields-missing-after-retry', 'pod-state-unknown-after-retry']))) return undefined;
   // Facts are attributed through the uid only: a record claiming Job or Pod facts without one is contradictory.
   if (row.jobUid === 'unknown' && (row.jobLookup !== 'unavailable' || row.podLookup !== 'unavailable')) return undefined;
   return {
@@ -455,5 +505,7 @@ export function parsePodTermination(value: unknown, job: string): PodTermination
     podLookup: row.podLookup as PodTermination['podLookup'], containerReason: row.containerReason as string,
     exitCode: row.exitCode as PodTermination['exitCode'], finishedAt: row.finishedAt as string,
     oomKilled: row.oomKilled as PodTermination['oomKilled'],
+    ...(row.collectionAttempts === 2 ? { collectionAttempts: 2 as const } : {}),
+    ...(row.collectionFailureReason ? { collectionFailureReason: row.collectionFailureReason as PodTermination['collectionFailureReason'] } : {}),
   };
 }

package/src/task-orchestrator/surfaces/pod-mirror-seed.ts

@@ -78,24 +78,27 @@ export function seedMirrorOnce(o: { host: string; commit: string; cwd: string; p
  * one sha when it does not — objects only, no ref is moved). Never throws: a miss returns `reason` and the caller skips
  * the seed (best effort — the Job keeps its GitHub path).
  */
-export async function resolveDefaultSourceHead(o: { repoUrl: string; base?: string; cwd: string; git?: Push; limitMs?: number }): Promise<{ sha?: string; reason?: string }> {
+export async function resolveDefaultSourceHead(o: { repoUrl: string; base?: string; cwd: string; git?: Push; limitMs?: number }): Promise<{ sha?: string; reason?: string; originCalls?: number }> {
   const git = o.git ?? gitWithin;
   const limitMs = o.limitMs ?? 30_000;
   const base = o.base || 'main';
-  if (base.startsWith('-') || !/^[\w./-]+$/.test(base) || o.repoUrl.startsWith('-')) return { reason: 'invalid-ref' };
+  if (base.startsWith('-') || !/^[\w./-]+$/.test(base) || o.repoUrl.startsWith('-')) return { reason: 'invalid-ref', originCalls: 0 };
+  let originCalls = 0;
   try {
+    originCalls += 1;
     const listed = await git(['ls-remote', '--', o.repoUrl, `refs/heads/${base}`], o.cwd, limitMs);
-    if (listed.rc !== 0) return { reason: 'ls-remote-failed' };
+    if (listed.rc !== 0) return { reason: 'ls-remote-failed', originCalls };
     // Only the exact ref asked for — never the first `refs/heads/*` line (a branch named `a/refs/heads/main` must not pass).
     const want = `refs/heads/${base}`;
     const sha = listed.output.split(/\r?\n/).map((line) => line.split('\t')).find(([hash, ref]) => ref === want && /^[0-9a-f]{40}$/.test(hash ?? ''))?.[0];
-    if (!sha) return { reason: 'ls-remote-no-sha' };
-    if ((await git(['cat-file', '-e', `${sha}^{commit}`], o.cwd, limitMs)).rc === 0) return { sha };
+    if (!sha) return { reason: 'ls-remote-no-sha', originCalls };
+    if ((await git(['cat-file', '-e', `${sha}^{commit}`], o.cwd, limitMs)).rc === 0) return { sha, originCalls };
+    originCalls += 1;
     const fetched = await git(['fetch', '--quiet', '--no-write-fetch-head', '--', o.repoUrl, sha], o.cwd, GATE_MIRROR_SEED_LIMIT_MS);
-    if (fetched.rc !== 0) return { reason: 'commit-fetch-failed' };
-    return (await git(['cat-file', '-e', `${sha}^{commit}`], o.cwd, limitMs)).rc === 0 ? { sha } : { reason: 'commit-not-local' };
+    if (fetched.rc !== 0) return { reason: 'commit-fetch-failed', originCalls };
+    return (await git(['cat-file', '-e', `${sha}^{commit}`], o.cwd, limitMs)).rc === 0 ? { sha, originCalls } : { reason: 'commit-not-local', originCalls };
   } catch {
-    return { reason: 'resolve-threw' };
+    return { reason: 'resolve-threw', originCalls };
   }
 }
 

package/src/task-orchestrator/surfaces/pod-pool.ts

@@ -193,7 +193,7 @@ export function parsePodPool(spec: string): PodPoolMember[] {
     // `:N` 이 없으면 «상한 없음»이 아니라 기본 상한 2 다 — 그 사실(`capacityDefaulted`)을 멤버에 남긴다.
     const capacityDefaulted = m[3] === undefined;
     const capacity = capacityDefaulted ? POD_POOL_DEFAULT_CAPACITY : Number(m[3]);
-    // POOL-LITE (10-07): `:0` means «this member is off» — a `node-c:0` entry once threw here and broke every launch.
+    // POOL-LITE (10-07): `:0` means «this member is off» — a zero-capacity entry once threw here and broke every launch.
     //   It is dropped below (never chosen); only a pool with no live member left is an error.
     if (!Number.isInteger(capacity) || capacity < 0) throw new Error(`--pod-pool: 상한은 1 이상 — 「${part}」`);
     if (m[5] && Number(m[5]) > 65535) throw new Error(`--pod-pool: 레지스트리 포트는 65535 이하 — 「${part}」`);
@@ -294,8 +294,8 @@ export interface PodPlacement {
 }
 
 /**
- * Preferred members for a placement kind: lite → the smallest-capacity member(s) (node-c), standard → the largest (node-b).
- * Capacity is the operator's own statement of member size (`pool-node-b@node-b:40,pool-node-c@node-c:6`), so no new spec syntax.
+ * Preferred members for a placement kind: lite → the smallest-capacity member(s), standard → the largest.
+ * Capacity is the operator's own statement of member size (`pool-node-a@node-a:40,pool-node-b@node-b:6`), so no new spec syntax.
  * When every member has the same capacity there is no small/big member and no preference (empty list).
  */
 export function preferredMembers(members: readonly PodPoolMember[], kind: PodPlacementKind | null | undefined): string[] {
@@ -888,6 +888,29 @@ export function syncPoolImage(member: PodPoolMember, image: string, localCommit:
 
 export type PoolKubectl = (args: readonly string[], input?: string) => { status: number | null; stdout: string; stderr: string };
 
+/** Read identities for a shadow decision; this never reserves or changes a Pod. */
+export function snapshotWarmPoolMembers(members: readonly PodPoolMember[], kubectl: PoolKubectl):
+  Record<string, Array<{ name: string; uid: string; node: string | null }>> | null {
+  const result: Record<string, Array<{ name: string; uid: string; node: string | null }>> = {};
+  for (const member of members) {
+    const observed = kubectl(['--context', member.context, '-n', 'elanous-test', 'get', 'pods', '-l', 'elanous.kind=warm-worker', '-o', 'json']);
+    if (observed.status !== 0) return null;
+    try {
+      const parsed: unknown = JSON.parse(observed.stdout);
+      if (!parsed || typeof parsed !== 'object' || !('items' in parsed) || !Array.isArray(parsed.items)) return null;
+      const rows: Array<{ name: string; uid: string; node: string | null }> = [];
+      for (const item of parsed.items) {
+        if (!item || typeof item !== 'object' || !item.metadata || typeof item.metadata.name !== 'string'
+          || typeof item.metadata.uid !== 'string' || !item.metadata.name || !item.metadata.uid) return null;
+        const node = typeof item.spec?.nodeName === 'string' ? item.spec.nodeName : null;
+        rows.push({ name: item.metadata.name, uid: item.metadata.uid, node });
+      }
+      result[member.context] = rows.sort((a, b) => a.uid.localeCompare(b.uid));
+    } catch { return null; }
+  }
+  return result;
+}
+
 /**
  * 발사 전 점검 — 노드마다 «컨텍스트가 닿나 · elanous-test 네임스페이스가 있나».
  * ⛔ 안 되는 노드는 «조용히» 빼지 않는다 — 이유를 낸다. 하나도 안 되면 ok=false.
@@ -972,7 +995,7 @@ export async function syncPoolImages(members: readonly PodPoolMember[], image: s
   const remoteBuild = deps.remoteBuild ?? (script ? defaultRemoteBuild(script, image) : null);
   // The registry-less build fallback below calls this ship path, including its remote import result check.
   const ship = deps.ship ?? ((m: PodPoolMember, img: string, commit: string | null, remote: RemoteRun) =>
-    syncPoolImage(m, img, commit, { run: remote, inspect: deps.inspect, transfer: deps.transfer }));
+    syncPoolImage(m, img, commit, { run: remote, inspect: deps.inspect, transfer: deps.transfer, lock: deps.lock }));
   const results = new Map<string, PoolImageSync>();
   // pack 한 번 ⊕ 나눠 쓰기 — 원격 멤버가 둘 이상일 때만(하나뿐이면 종전대로 build.sh 가 스스로 pack 한다).
   //   주입된 remoteBuild(시험)에는 진짜 pack 을 붙이지 않는다 — pack 도 주입해야 쓴다.

package/src/task-orchestrator/surfaces/pod-si-warm-protocol.ts

@@ -103,7 +103,7 @@ export function parseSiWarmCommand(raw: unknown): SiWarmCommand | null {
     || !digest(row.executionKey) || !str(row.sourceSha) || !SHA.test(row.sourceSha)
     || !token(row.podUid) || !integer(row.generation) || row.generation < 1
     || !validKey(row.key) || row.envProfile !== 'si-standard-v1'
-    || !finite(row.deadlineAt) || !digest(row.payloadSha256)
+    || !finite(row.deadlineAt) || row.deadlineAt <= 0 || !digest(row.payloadSha256)
     || !digest(row.credentialBundleSha256)) return null;
   return raw as SiWarmCommand;
 }

package/src/task-orchestrator/surfaces/pod-source-receive.ts

@@ -5,7 +5,7 @@ import { execFileSync } from 'node:child_process';
 import { siTaskPodStageShell } from './pod-lifecycle-stages.js';
 
 export type PodSource =
-  | { kind: 'default'; base?: string }
+  | { kind: 'default'; base?: string; baseSha?: string }
   | { kind: 'commit'; sha: string }
   | { kind: 'pr'; number: number }
   | { kind: 'bundle'; bundlePath: string; sha256: string; sizeBytes: number; headCommit: string };
@@ -64,6 +64,24 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
   const quotedCommitFile = `'${(options.imageCommitFile ?? '/opt/elanous-source-commit').replace(/'/g, `'\\''`)}'`;
   const quotedImageGitDir = `'${(options.imageGitDir ?? '/opt/elanous-pin.git').replace(/'/g, `'\\''`)}'`;
   const clone = `git clone -q --depth 50 ${quotedUrl} repo`;
+  // First observation slice: count source checkout work without changing its routing.
+  const ioStart = [
+    // Count calls performed by this Pod source stage. Branch validation via
+    // assertRemoteBase runs on the host before Job creation and is outside it.
+    'pod_source_io_origin_calls=0',
+    'pod_source_io_started=$(date +%s)',
+    'pod_source_io_reported=0',
+    'pod_source_io_measured=0',
+    'pod_source_io_measure() { pod_source_io_files=$(git ls-files -z | tr -cd "\\000" | wc -c | tr -d " "); pod_source_io_seconds=$(( $(date +%s) - pod_source_io_started )); pod_source_io_measured=1; }',
+    'pod_source_io_emit() {',
+    '  [ "$pod_source_io_reported" -eq 0 ] || return 0; pod_source_io_reported=1',
+    '  [ -n "${pod_source_io_seconds:-}" ] || pod_source_io_seconds=$(( $(date +%s) - pod_source_io_started ))',
+    '  [ -n "${pod_source_io_files:-}" ] || pod_source_io_files=null',
+    '  pod_source_io_status=incomplete; if [ "$pod_source_io_measured" -eq 1 ]; then pod_source_io_status=complete; fi',
+    '  printf \'ELANOUS_POD_SOURCE_IO {"originCalls":%s,"checkoutFiles":%s,"sourceVia":"%s","sourceSeconds":%s,"sourceStatus":"%s","pushCalls":null,"installRan":null,"installSeconds":null}\\n\' "$pod_source_io_origin_calls" "$pod_source_io_files" "${source_via:-unknown}" "$pod_source_io_seconds" "$pod_source_io_status"',
+    '}',
+    'trap pod_source_io_emit EXIT',
+  ];
   const start = [
     'if [ -e repo ]; then exit 5; fi',
     // POD-MIRROR-IO: the image's pinned tree is a shared read-only lower layer.
@@ -113,7 +131,11 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     'else',
     "  printf 'ELANOUS_POD_SOURCE_MIRROR_SKIP %s\\n' \"$mirror_skip\"",
     '  if [ -e repo ]; then rm -r -- repo || exit 5; fi',
-    `  ${clone} || exit 5`,
+    ...(source.kind === 'default' && source.baseSha ? [] : ['  pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1))']),
+    ...(source.kind === 'default' && source.baseSha ? [
+      `  printf 'ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE %s\\n' '${source.baseSha}'`,
+      '  exit 5',
+    ] : [`  ${clone} || exit 5`]),
     '  source_via=github',
     'fi',
     'fi',
@@ -121,22 +143,50 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     'cd repo || exit 5',
   ];
   if (source.kind === 'default') {
+    if (source.baseSha) {
+      const sha = assertSha(source.baseSha, 'base sha');
+      const base = source.base ?? 'main';
+      if (base.startsWith('-') || !/^[\w./-]+$/.test(base)) throw new Error(`invalid Pod base ref: ${base}`);
+      const quote = (value: string) => `'${value.replace(/'/g, `'\\''`)}'`;
+      const quotedBase = quote(base);
+      const quotedTrackingRef = quote(`refs/remotes/origin/${base}`);
+      const quotedUpstream = quote(`origin/${base}`);
+      return [
+        ...ioStart,
+        ...start,
+        `if ! git cat-file -e '${sha}^{commit}' 2>/dev/null; then git fetch --quiet --no-write-fetch-head ${quotedMirror} '${sha}' || { printf 'ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE %s\\n' '${sha}'; exit 5; }; fi`,
+        `git checkout -q -B ${quotedBase} '${sha}' || exit 5`,
+        `git update-ref ${quotedTrackingRef} '${sha}' || exit 5`,
+        `git symbolic-ref refs/remotes/origin/HEAD ${quotedTrackingRef} || exit 5`,
+        `git branch --set-upstream-to=${quotedUpstream} ${quotedBase} >/dev/null || exit 5`,
+        'head=$(git rev-parse HEAD)',
+        'pod_source_io_measure',
+        "printf 'ELANOUS_POD_SOURCE default %s\\n' \"$head\"",
+        'pod_source_io_emit',
+      ].join('\n');
+    }
     if (source.base && source.base !== 'main') {
       assertRemoteBase(repoUrl, source.base);
       const base = source.base;
       const quote = (value: string) => `'${value.replace(/'/g, `'\\''`)}'`;
       const quotedTrackingRef = quote(`refs/remotes/origin/${base}`);
       return [
+        ...ioStart,
         ...start,
+        'pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1))',
         `git fetch --depth 50 origin ${quote(`+refs/heads/${base}:refs/remotes/origin/${base}`)} || exit 5`,
         `git checkout -q -B ${quote(base)} ${quotedTrackingRef} || exit 5`,
         'head=$(git rev-parse HEAD)',
+        'pod_source_io_measure',
         "printf 'ELANOUS_POD_SOURCE default %s\\n' \"$head\"",
+        'pod_source_io_emit',
       ].join('\n');
     }
     return [
+      ...ioStart,
       ...start,
       'if [ "$source_via" != github ]; then',
+      '  pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1))',
       '  remote_info=$(git ls-remote --symref origin HEAD) || exit 5',
       `  remote_head=$(printf '%s\\n' "$remote_info" | awk '$2=="HEAD" && $1!="ref:" {print $1}')`,
       `  remote_branch=$(printf '%s\\n' "$remote_info" | awk '$1=="ref:" && $3=="HEAD" && $2 ~ /^refs\\/heads\\// {sub(/^refs\\/heads\\//, "", $2); print $2}')`,
@@ -146,6 +196,7 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
       '      git reset --hard "$remote_head" || exit 5',
       "      printf 'ELANOUS_POD_SOURCE_DELTA mirror\\n'",
       '    else',
+      '      pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1))',
       '      git fetch --depth 50 origin HEAD && git reset --hard FETCH_HEAD || exit 5',
       "      printf 'ELANOUS_POD_SOURCE_DELTA origin\\n'",
       '    fi',
@@ -158,53 +209,68 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
       '  git branch --set-upstream-to="origin/$remote_branch" "$remote_branch" >/dev/null || exit 5',
       'fi',
       'head=$(git rev-parse HEAD)',
+      'pod_source_io_measure',
       "printf 'ELANOUS_POD_SOURCE default %s\\n' \"$head\"",
+      'pod_source_io_emit',
     ].join('\n');
   }
   if (source.kind === 'commit') {
     const sha = assertSha(source.sha, 'sha');
     return [
+      ...ioStart,
       ...start,
-      `if ! git cat-file -e '${sha}^{commit}' 2>/dev/null; then git fetch --depth 1 origin ${sha} || exit 5; fi`,
+      `if ! git cat-file -e '${sha}^{commit}' 2>/dev/null; then pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1)); git fetch --depth 1 origin ${sha} || exit 5; fi`,
       `git checkout --detach ${sha} || exit 5`,
       'head=$(git rev-parse HEAD)',
+      'pod_source_io_measure',
       "printf 'ELANOUS_POD_SOURCE commit %s\\n' \"$head\"",
+      'pod_source_io_emit',
     ].join('\n');
   }
   if (source.kind === 'pr') {
     const n = assertPositiveInt(source.number);
     return [
+      ...ioStart,
       ...start,
+      'pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1))',
       `pr_sha=$(git ls-remote origin refs/pull/${n}/head | cut -f1) || exit 5`,
       'if ! [[ "$pr_sha" =~ ^[0-9a-f]{40}$ ]]; then exit 5; fi',
-      `if ! git cat-file -e "$pr_sha^{commit}" 2>/dev/null; then git fetch --depth 50 origin pull/${n}/head || exit 5; fi`,
+      `if ! git cat-file -e "$pr_sha^{commit}" 2>/dev/null; then pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1)); git fetch --depth 50 origin pull/${n}/head || exit 5; fi`,
       `git checkout -B pr-${n} "$pr_sha" || exit 5`,
       // A pinned image starts at one shallow main commit. Fetching a PR tip at
       // depth 50 can leave that pin and the PR in disconnected shallow spans.
       // Deepen only after merge-base fails; the gate still reports unavailable
       // if ancestry cannot be obtained.
+      'pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1))',
       'remote_info=$(git ls-remote --symref origin HEAD 2>/dev/null) || { printf \'ELANOUS_POD_COMPARISON_BASE unavailable\\n\'; exit 5; }',
       `base_branch=$(printf '%s\\n' "$remote_info" | awk '$1=="ref:" && $3=="HEAD" && $2 ~ /^refs\\/heads\\// {sub(/^refs\\/heads\\//, "", $2); print $2}')`,
       'if [ -n "$base_branch" ] && git check-ref-format --branch "$base_branch" >/dev/null 2>&1; then',
       '  base_ref="refs/remotes/origin/$base_branch"',
+      '  pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1))',
       '  git fetch --depth 50 origin "+refs/heads/$base_branch:$base_ref" || { printf \'ELANOUS_POD_COMPARISON_BASE unavailable\\n\'; exit 5; }',
       '  git symbolic-ref refs/remotes/origin/HEAD "$base_ref" || exit 5',
       '  if ! git merge-base HEAD "$base_ref" >/dev/null 2>&1 && [ "$(git rev-parse --is-shallow-repository)" = true ]; then',
+      '    pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1))',
       `    git fetch --deepen=100 origin "+refs/heads/$base_branch:$base_ref" +refs/pull/${n}/head:refs/remotes/origin/pr-${n}-head || printf 'ELANOUS_POD_COMPARISON_BASE deepen-failed\\n'`,
       '  fi',
       '  if ! git merge-base HEAD "$base_ref" >/dev/null 2>&1 && [ "$(git rev-parse --is-shallow-repository)" = true ]; then',
+      '    pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1))',
       `    git fetch --unshallow origin "+refs/heads/$base_branch:$base_ref" +refs/pull/${n}/head:refs/remotes/origin/pr-${n}-head || { printf 'ELANOUS_POD_COMPARISON_BASE unavailable\\n'; exit 5; }`,
       '  fi',
       "  if ! git merge-base HEAD \"$base_ref\" >/dev/null 2>&1; then printf 'ELANOUS_POD_COMPARISON_BASE unavailable\\n'; fi",
       "else printf 'ELANOUS_POD_COMPARISON_BASE unavailable\\n'; exit 5; fi",
       'head=$(git rev-parse HEAD)',
+      'pod_source_io_measure',
       "printf 'ELANOUS_POD_SOURCE pr %s\\n' \"$head\"",
+      'pod_source_io_emit',
     ].join('\n');
   }
   const sha256 = assertSha256(source.sha256);
   const sizeBytes = assertSize(source.sizeBytes);
   const headCommit = assertSha(source.headCommit, 'headCommit');
   return [
+    ...ioStart,
+    'source_via=bundle',
     'ready=0',
     'for i in $(seq 1 300); do',
     '  if [ -f /tmp/source.ready ]; then ready=1; break; fi',
@@ -242,8 +308,10 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     '  git -C repo fetch /tmp/source.bundle "refs/elanous/pod-source/*:refs/remotes/bundle/*" || exit 5',
     'fi',
     `git -C repo checkout --detach ${headCommit} || exit 5`,
-    'head=$(git -C repo rev-parse HEAD) || exit 5',
-    "printf 'ELANOUS_POD_SOURCE bundle %s\\n' \"$head\"",
     'cd repo || exit 5',
+    'head=$(git rev-parse HEAD) || exit 5',
+    'pod_source_io_measure',
+    "printf 'ELANOUS_POD_SOURCE bundle %s\\n' \"$head\"",
+    'pod_source_io_emit',
   ].join('\n');
 }

package/src/task-orchestrator/surfaces/pod-warm-worker-pod.ts

@@ -389,6 +389,7 @@ export class WarmPodTransport {
       || command.workerId !== this.spec.workerId || command.cutSha !== this.spec.cutSha
       || !equalKey(command.key, this.spec.key)
       || ![command.runId, command.attemptId, command.leaseId, command.workerId].every(value => TOKEN.test(value))
+      || typeof command.podUid !== 'string' || !command.podUid
       || !Number.isSafeInteger(command.generation) || command.generation < 1) return fallback('key-drift');
     const prefix = ['--context', this.spec.kubectlContext, '-n', this.spec.namespace];
     const observed = this.kubectl([...prefix, 'get', 'pod', this.spec.name, '-o', 'json']);
@@ -425,7 +426,7 @@ export class WarmPodTransport {
     try { nodeArch = node.status === 0 ? JSON.parse(node.stdout)?.metadata?.labels?.['kubernetes.io/arch'] : null; }
     catch { nodeArch = null; }
     if (nodeArch !== this.spec.key.architecture) return fallback('pod-unready');
-    if ((command.podUid && uid !== command.podUid) || (this.podUid && uid !== this.podUid)) {
+    if (uid !== command.podUid || (this.podUid !== null && uid !== this.podUid)) {
       this.quarantined = true; return fallback('pod-replaced');
     }
     this.podUid = uid;