elanous 0.2.40 → 0.2.41

package/src/session/chat.ts

@@ -17,6 +17,7 @@ import {
   type SessionMeta, type SerializedMessage, type CreateSessionOpts,
 } from './index.js';
 import { debug } from '../debug/log.js';
+import { createRequestSizeGuard, formatRequestSizeStatus, type RequestSizeGuard } from './request-size-guard.js';
 import type { InputSourceKind } from '../input/input-source-kind.js';
 import {
   getProviderForConfig, streamLLMWithTools, type LLMMessage, type LLMOpts, type LLMProvider,
@@ -400,65 +401,41 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
     return trimToBudget(wire, opts.maxTokens ?? DEFAULT_TOKEN_BUDGET);
   };
 
-  let measuredProviderRequests = 0;
-  const requestSizeGuard: NonNullable<LLMOpts['requestSizeGuard']> | undefined =
+  const requestSizeGuard: RequestSizeGuard | undefined =
     meta.source === 'tui' && provider.name === 'openai-codex'
-      ? {
-          maxChars: 400_000,
-          compactMessages: async (currentMessages) => {
-            // The first request has only the persisted transcript plus this
-            // user turn, so use the shared session compactor and rebuild from
-            // the rewritten history. Later tool rounds compact their live
-            // message list so no just-produced tool context is lost.
-            if (measuredProviderRequests === 0) {
-              const { compactSessionHistory } = await import('./compact-session.js');
-              const result = await compactSessionHistory(opts.sessionId, {
-                config: opts.userConfig.chat.autoCompact,
-                force: true,
-                modelId: llmOpts?.model ?? provider.defaultModel,
-              });
-              if (result.fired) {
-                const refreshed = loadSession(opts.sessionId);
-                if (refreshed) {
-                  // The persisted compacted session includes this turn's
-                  // user message. Drop that final persisted row here, then
-                  // assembleTurnMessages re-adds the canonical userMsg and
-                  // any image blocks from opts.userImages exactly once.
-                  messages = refreshed.messages.slice(0, -1);
-                  const rebuilt = assembleTurnMessages(effectiveSystemPrompt).kept;
-                  return { messages: rebuilt, reason: `session-${result.reason}` };
-                }
-              }
-            }
-
-            const { runCompactPipeline } = await import('../compact/pipeline.js');
-            const { getDefaultCompactProvider } = await import('../compact/provider.js');
-            const compacted = await runCompactPipeline(currentMessages, {
-              sessionId: opts.sessionId,
-              provider: getDefaultCompactProvider(),
-              activeModelId: llmOpts?.model ?? provider.defaultModel,
-              policy: {
-                preserveLastN: opts.userConfig.chat.autoCompact.preserveLastN,
-                archiveEnabled: opts.userConfig.chat.compact.archiveEnabled,
-              },
+      ? createRequestSizeGuard({
+          compactOptions: () => ({
+            sessionId: opts.sessionId,
+            activeModelId: llmOpts?.model ?? provider.defaultModel,
+            preserveLastN: opts.userConfig.chat.autoCompact.preserveLastN,
+            archiveEnabled: opts.userConfig.chat.compact.archiveEnabled,
+          }),
+          // The first request has only the persisted transcript plus this
+          // user turn, so use the shared session compactor and rebuild from
+          // the rewritten history. Later tool rounds compact their live
+          // message list (shared guard) so no just-produced tool context is lost.
+          compactFirstRequest: async () => {
+            const { compactSessionHistory } = await import('./compact-session.js');
+            const result = await compactSessionHistory(opts.sessionId, {
+              config: opts.userConfig.chat.autoCompact,
+              force: true,
+              modelId: llmOpts?.model ?? provider.defaultModel,
             });
-            const diagnostics = compacted.diagnostics;
-            const changed = diagnostics.layer1ResponsesTrimmed > 0
-              || diagnostics.layer2MicrocompactCleared > 0
-              || diagnostics.layer3SummaryApplied === 1
-              || diagnostics.layer5FallbackTruncated === 1;
-            return changed
-              ? { messages: compacted.messages, reason: 'live-request-compact' }
-              : null;
+            if (!result.fired) return null;
+            const refreshed = loadSession(opts.sessionId);
+            if (!refreshed) return null;
+            // The persisted compacted session includes this turn's
+            // user message. Drop that final persisted row here, then
+            // assembleTurnMessages re-adds the canonical userMsg and
+            // any image blocks from opts.userImages exactly once.
+            messages = refreshed.messages.slice(0, -1);
+            const rebuilt = assembleTurnMessages(effectiveSystemPrompt).kept;
+            return { messages: rebuilt, reason: `session-${result.reason}` };
           },
           onMeasured: (measurement) => {
-            measuredProviderRequests += 1;
-            opts.onStatusLine?.(
-              `ctx ${measurement.requestChars.toLocaleString()} chars / ${measurement.maxChars.toLocaleString()}`
-              + (measurement.compacted ? ` · compact ${measurement.reason}` : ''),
-            );
+            opts.onStatusLine?.(formatRequestSizeStatus(measurement));
           },
-        }
+        })
       : undefined;
 
   let kept: LLMMessage[] = [];

package/src/session/request-size-guard.ts

@@ -0,0 +1,123 @@
+// TUI-TOKEN-GUARD-WIRE — shared request-size guard (#32254 cap).
+//
+// The 400k-char cap used to be built only inside `session/chat.ts runTurn`.
+// The production TUI does not run that function: it goes
+// DashboardSession → bridgeCoreTurnToAcp → runCoreTurn/runGoalLoop, so the
+// guard never reached `llm.ts` and no `request-size-compact` event fired
+// (root cause: seat-state/OP/tmp/TUI-TOKEN-BURN-ROOT-CAUSE-1028.md).
+//
+// This module owns the guard construction so both paths share one policy:
+//   - `createRequestSizeGuard` — the `LLMOpts.requestSizeGuard` object.
+//     The first measured request may use a caller hook (`compactFirstRequest`)
+//     that compacts the caller's *persisted* history; every other request
+//     (and a first request whose hook declines) compacts the live message list.
+//   - `compactLiveMessages` — the live compaction (Layer 1/2 + optional
+//     Layer 3 summarize) shared by the guard and by hosts that compact their
+//     own history store.
+//   - `estimateRequestChars` — cheap pre-send estimate (JSON chars of the
+//     messages plus tool specs) used by the ACP bridge preflight.
+//
+// ⚠️ `llm.ts` applies the compacted list with `messages.splice(...)`, but the
+// array it receives is a per-request copy (`mapProviderToolNamesInMessages`),
+// not `streamLLMWithTools`'s `history`. Compaction therefore does not survive
+// into the next tool round by itself — the guard re-measures each request —
+// and only a host write-back (chat.ts session rewrite / dashboard history
+// replace) makes it survive into the next prompt.
+
+import type { LLMMessage, LLMOpts, LLMToolSpec } from '../llm.js';
+import type { CompactProvider } from '../compact/provider.js';
+
+/** #32254 — the wire cap for Codex TUI requests (serialized body chars). */
+export const REQUEST_SIZE_MAX_CHARS = 400_000;
+
+export type RequestSizeGuard = NonNullable<LLMOpts['requestSizeGuard']>;
+export type RequestSizeMeasurement = Parameters<NonNullable<RequestSizeGuard['onMeasured']>>[0];
+export type RequestSizeCompactInfo = Parameters<RequestSizeGuard['compactMessages']>[1];
+export type RequestSizeCompactResult = Awaited<ReturnType<RequestSizeGuard['compactMessages']>>;
+
+type RunCompactPipeline = typeof import('../compact/pipeline.js').runCompactPipeline;
+
+export interface CompactLiveMessagesOptions {
+  sessionId?: string;
+  activeModelId?: string;
+  preserveLastN?: number;
+  archiveEnabled?: boolean;
+  /** Test seam — defaults to the real `runCompactPipeline` with the default compact provider. */
+  runCompactPipeline?: RunCompactPipeline;
+}
+
+/** Compact a live message list. Returns `null` when no layer changed anything. */
+export async function compactLiveMessages(
+  messages: LLMMessage[],
+  opts: CompactLiveMessagesOptions,
+): Promise<{ messages: LLMMessage[]; reason: string } | null> {
+  let run = opts.runCompactPipeline;
+  let provider: CompactProvider | undefined;
+  if (!run) {
+    run = (await import('../compact/pipeline.js')).runCompactPipeline;
+    provider = (await import('../compact/provider.js')).getDefaultCompactProvider();
+  }
+  const compacted = await run(messages, {
+    ...(opts.sessionId !== undefined ? { sessionId: opts.sessionId } : {}),
+    ...(provider !== undefined ? { provider } : {}),
+    ...(opts.activeModelId !== undefined ? { activeModelId: opts.activeModelId } : {}),
+    policy: {
+      ...(opts.preserveLastN !== undefined ? { preserveLastN: opts.preserveLastN } : {}),
+      ...(opts.archiveEnabled !== undefined ? { archiveEnabled: opts.archiveEnabled } : {}),
+    },
+  });
+  const diagnostics = compacted.diagnostics;
+  const changed = diagnostics.layer1ResponsesTrimmed > 0
+    || diagnostics.layer2MicrocompactCleared > 0
+    || diagnostics.layer3SummaryApplied === 1
+    || diagnostics.layer5FallbackTruncated === 1;
+  return changed ? { messages: compacted.messages, reason: 'live-request-compact' } : null;
+}
+
+export interface CreateRequestSizeGuardOptions {
+  maxChars?: number;
+  /** Live-compaction options, resolved lazily at compaction time (config is
+   *  read only when a request is actually over the cap). */
+  compactOptions: () => CompactLiveMessagesOptions;
+  /** First measured request only: compact the caller's persisted history and
+   *  return the rebuilt request. `null` falls through to live compaction. */
+  compactFirstRequest?: (
+    currentMessages: LLMMessage[],
+    info: RequestSizeCompactInfo,
+  ) => Promise<RequestSizeCompactResult>;
+  onMeasured?: (measurement: RequestSizeMeasurement) => void;
+}
+
+export function createRequestSizeGuard(opts: CreateRequestSizeGuardOptions): RequestSizeGuard {
+  let measuredProviderRequests = 0;
+  return {
+    maxChars: opts.maxChars ?? REQUEST_SIZE_MAX_CHARS,
+    compactMessages: async (currentMessages, info) => {
+      if (measuredProviderRequests === 0 && opts.compactFirstRequest) {
+        const first = await opts.compactFirstRequest(currentMessages, info);
+        if (first) return first;
+      }
+      return compactLiveMessages(currentMessages, opts.compactOptions());
+    },
+    onMeasured: (measurement) => {
+      measuredProviderRequests += 1;
+      opts.onMeasured?.(measurement);
+    },
+  };
+}
+
+/** Cheap pre-send size estimate: JSON chars of the messages plus tool specs.
+ *  It tracks the Codex wire body closely (the wire also serializes both). */
+export function estimateRequestChars(messages: readonly LLMMessage[], tools: readonly LLMToolSpec[] = []): number {
+  try {
+    return JSON.stringify(messages).length + (tools.length > 0 ? JSON.stringify(tools).length : 0);
+  } catch {
+    return 0;
+  }
+}
+
+/** One-line status text shared by chat.ts and the ACP bridge. */
+export function formatRequestSizeStatus(measurement: RequestSizeMeasurement): string {
+  return `ctx ${measurement.requestChars.toLocaleString()} chars / ${measurement.maxChars.toLocaleString()}`
+    + (measurement.compacted ? ` · compact ${measurement.reason}` : '');
+}

package/src/sidetab-core/model.ts

@@ -1,4 +1,5 @@
 import { resolveInstanceName } from '../instance-identity.js';
+import type { LLMToolSpec } from '../llm.js';
 import { listPtyManifestRows, type PtyManifestRow } from '../pty-shell/pty-manifest.js';
 import { describePtyRunState } from '../pty-shell/tui-run-state.js';
 
@@ -174,3 +175,138 @@ export function formatSidetabLines(
   if (mode === 'list' && lines.length < Math.floor(height)) lines.push(fit(' + new · /side new'));
   return lines;
 }
+
+/** NL/IPC side-tab contract and action policy, kept independent from either TUI renderer. */
+export const NEXT_SIDETAB_TOOL_NAME = 'NextSidetab';
+const NEXT_SIDETAB_CALL = 'elanous.sidetab.call';
+const NEXT_SIDETAB_RESULT = 'elanous.sidetab.result';
+
+export type NextSidetabAction = 'list' | 'switch' | 'attach' | 'detach' | 'new' | 'kill';
+export interface NextSidetabRequest {
+  action: NextSidetabAction;
+  target?: string;
+  character?: 'shell' | 'elanous';
+  confirm?: boolean;
+}
+export interface NextSidetabCall { type: typeof NEXT_SIDETAB_CALL; callId: string; request: NextSidetabRequest }
+export interface NextSidetabResult { type: typeof NEXT_SIDETAB_RESULT; callId: string; result: unknown }
+export type NextSidetabHandler = (request: NextSidetabRequest) => Promise<unknown>;
+export interface NextSidetabHostDeps {
+  rows(): readonly SidetabRow[] | Promise<readonly SidetabRow[]>;
+  selected(): number;
+  switchSession(row: SidetabRow): Promise<unknown>;
+  attach(row: SidetabRow): Promise<unknown>;
+  detach(): unknown;
+  spawn(character: 'shell' | 'elanous'): unknown;
+  kill(row: SidetabRow): unknown;
+}
+export interface NextSidetabIpcProcess {
+  send?: (message: unknown) => boolean | void;
+  on(event: 'message', listener: (message: unknown) => void): unknown;
+}
+
+export const nextSidetabToolSpec: LLMToolSpec = {
+  name: NEXT_SIDETAB_TOOL_NAME,
+  description: 'Control the Next TUI side tab: list/view sessions and PTYs, switch sessions, attach or detach, start a local shell or elanous PTY, or kill a PTY. Ask the user to confirm before calling kill with confirm=true. Starting coding agents is not supported.',
+  parameters: {
+    type: 'object',
+    properties: {
+      action: { type: 'string', enum: ['list', 'switch', 'attach', 'detach', 'new', 'kill'] },
+      target: { type: 'string', description: 'Optional exact or partial row id/label; required for targeted actions.' },
+      character: { type: 'string', enum: ['shell', 'elanous'], description: 'Only used with action=new.' },
+      confirm: { type: 'boolean', description: 'Must be true only after the user explicitly confirmed killing the selected PTY.' },
+    },
+    required: ['action'],
+    additionalProperties: false,
+  },
+};
+
+export function isNextSidetabCall(value: unknown): value is NextSidetabCall {
+  const call = value as Partial<NextSidetabCall> | null;
+  return Boolean(call && call.type === NEXT_SIDETAB_CALL && typeof call.callId === 'string'
+    && call.request && typeof call.request === 'object');
+}
+
+export async function answerNextSidetabCall(handler: NextSidetabHandler, call: NextSidetabCall): Promise<NextSidetabResult> {
+  try { return { type: NEXT_SIDETAB_RESULT, callId: call.callId, result: await handler(call.request) }; }
+  catch (error) {
+    return { type: NEXT_SIDETAB_RESULT, callId: call.callId, result: { error: error instanceof Error ? error.message : String(error) } };
+  }
+}
+
+export function createNextSidetabHostHandler(deps: NextSidetabHostDeps): NextSidetabHandler {
+  return async (request) => {
+    if (!request || !['list', 'switch', 'attach', 'detach', 'new', 'kill'].includes(request.action)) {
+      return { error: '지원하지 않는 사이드탭 동작입니다' };
+    }
+    if (request.action === 'new') {
+      if (request.character !== 'shell' && request.character !== 'elanous') return { error: 'character는 shell 또는 elanous여야 합니다' };
+      return deps.spawn(request.character);
+    }
+    if (request.action === 'detach') return deps.detach();
+    const rows = await deps.rows();
+    if (request.action === 'list') return rows.map(({ id, label, kind, badge, sessionId }) => ({ id, label, kind, badge, ...(sessionId ? { sessionId } : {}) }));
+    const target = request.target?.trim();
+    const exact = target ? rows.find((item) => item.id === target)
+      ?? rows.find((item) => item.label.toLowerCase() === target.toLowerCase()) : undefined;
+    const partial = target && !exact ? rows.filter((item) => item.label.toLowerCase().includes(target.toLowerCase())) : [];
+    if (partial.length > 1) return { error: `사이드탭 항목이 여러 개 일치합니다: ${target}` };
+    const row = exact ?? partial[0] ?? (target ? undefined : rows[deps.selected()]);
+    if (!row) return { error: target ? `사이드탭 항목을 찾지 못했습니다: ${target}` : '선택된 사이드탭 항목이 없습니다' };
+    if (request.action === 'switch') return row.kind === 'tui' ? deps.switchSession(row) : { error: 'Next TUI 세션만 전환할 수 있습니다' };
+    if (request.action === 'attach') return deps.attach(row);
+    if (row.currentProcess) return { error: '현재 TUI 세션은 사이드탭에서 종료할 수 없습니다' };
+    if (request.confirm !== true) return { needsConfirmation: true, message: `PTY 종료 확인 필요: ${row.label}` };
+    return deps.kill(row);
+  };
+}
+
+export function createReplNextSidetabTool(
+  proc: NextSidetabIpcProcess,
+  env: NodeJS.ProcessEnv = process.env,
+  timeoutMs = 15_000,
+): { spec: LLMToolSpec; dispatch: (args: Record<string, unknown>) => Promise<unknown> } | null {
+  if (env.ELANOUS_NEXT_TUI_SIDETAB_IPC !== '1' || typeof proc.send !== 'function') return null;
+  const send = proc.send.bind(proc);
+  const waiting = new Map<string, (result: unknown) => void>();
+  let sequence = 0;
+  const listener = (message: unknown): void => {
+    const result = message as Partial<NextSidetabResult> | null;
+    if (!result || result.type !== NEXT_SIDETAB_RESULT || typeof result.callId !== 'string') return;
+    const resolve = waiting.get(result.callId);
+    if (!resolve) return;
+    waiting.delete(result.callId);
+    resolve(result.result);
+  };
+  proc.on('message', listener);
+  return {
+    spec: nextSidetabToolSpec,
+    dispatch: (args) => new Promise((resolve) => {
+      const callId = `s${++sequence}`;
+      const timer = setTimeout(() => {
+        if (!waiting.delete(callId)) return;
+        resolve({ error: 'Next TUI did not answer the side-tab request' });
+      }, timeoutMs);
+      waiting.set(callId, (result) => { clearTimeout(timer); resolve(result); });
+      try {
+        send({ type: NEXT_SIDETAB_CALL, callId, request: args as unknown as NextSidetabRequest } satisfies NextSidetabCall);
+      } catch (error) {
+        waiting.delete(callId);
+        clearTimeout(timer);
+        resolve({ error: `Next TUI IPC send failed: ${error instanceof Error ? error.message : String(error)}` });
+      }
+    }),
+  };
+}
+
+export function registerNextSidetabReplTool(
+  specs: LLMToolSpec[],
+  dispatchByName: Map<string, (args: Record<string, unknown>) => Promise<unknown>>,
+  proc: NextSidetabIpcProcess,
+  env: NodeJS.ProcessEnv = process.env,
+): void {
+  const tool = createReplNextSidetabTool(proc, env);
+  if (!tool) return;
+  specs.push(tool.spec);
+  dispatchByName.set(tool.spec.name, tool.dispatch);
+}

package/src/task-agent/parent-host.ts

@@ -43,6 +43,17 @@ export type ParentHostSetting = Partial<ParentHostConfig> | readonly Partial<Par
 export const PARENT_HOST_ENV = 'ELANOUS_TA_PARENT_HOST';
 const DEFAULT_REMOTE_ELANOUS = '$HOME/.local/share/elanous/bin/elanous';
 const DEFAULT_REMOTE_CONFIG_DIR = '$HOME/.elanous';
+/**
+ * 원격 부모 상태 루트의 출처 태그 — 루트(`ELANOUS_STATE_DIR`)와 «한 벌»로 넘긴다(src/agent/identity-env.ts).
+ * HQ 가 git worktree/`--test` 라면 그 env 에 `derived` 가 실린다. 루트만 원격 값으로 바꾸고 태그를 그대로
+ * 흘리면 원격 부모는 «명시한 운영 루트 + 파생 태그»를 받아 자기 우주를 test 로 오독한다 —
+ * `SOURCE === 'derived'` 를 보는 codexCredentialRoot(src/budget/codex-reset-credit-state.ts)·
+ * harnessLaunchPolicyConfig(src/harness/harness-substrate-default.ts) 가 그 자리다.
+ * 떼어 띄운 운영 부모의 기존 꼴(src/task-orchestrator/surfaces/pod-si-warm-runner.ts)과 같은 `explicit` 를 찍는다.
+ */
+const REMOTE_STATE_DIR_SOURCE = 'explicit';
+/** 원격 발사에서 HQ 값을 버리고 원격 기준으로 다시 찍는 상태 루트 env(한 벌). */
+const STATE_ROOT_ENV_KEYS: ReadonlySet<string> = new Set(['ELANOUS_STATE_DIR', 'ELANOUS_STATE_DIR_SOURCE']);
 const HOST_RE = /^[A-Za-z0-9][A-Za-z0-9._@-]{0,127}$/;
 /** A parent can wait for a child for tens of minutes; the two-minute HTTP refresh floor is too short here. */
 export const PARENT_CHILD_CREDENTIAL_MIN_REMAINING_MS = 60 * 60_000;
@@ -227,7 +238,9 @@ export function remoteLaunchScript(target: ParentHostConfig, args: readonly stri
   const log = remoteParentLogPath(target, env.ELANOUS_RUN_ID ?? 'unknown');
   // --config-dir keeps the parent's operational config/state; authStorePath()
   // reads XDG_CONFIG_HOME/elanous/auth.json first, as the entrypoint test proves.
-  const envPart = [...Object.entries(env).filter(([key]) => key !== 'ELANOUS_STATE_DIR' && /^[A-Z_][A-Z0-9_]*$/.test(key)).map(([key, value]) => `${key}=${key === 'XDG_CONFIG_HOME' || key === 'CODEX_HOME' || key === 'GH_CONFIG_DIR' ? remotePath(value) : shellQuote(value)}`), `ELANOUS_STATE_DIR=${remotePath(configDir)}`].join(' ');
+  // 상태 루트는 태그와 한 벌로 넘긴다(REMOTE_STATE_DIR_SOURCE 주석) — HQ 의 derived 태그가
+  // 함께 흐르면 방금 명시한 운영 루트를 원격 부모가 test 우주로 오독한다.
+  const envPart = [...Object.entries(env).filter(([key]) => !STATE_ROOT_ENV_KEYS.has(key) && /^[A-Z_][A-Z0-9_]*$/.test(key)).map(([key, value]) => `${key}=${key === 'XDG_CONFIG_HOME' || key === 'CODEX_HOME' || key === 'GH_CONFIG_DIR' ? remotePath(value) : shellQuote(value)}`), `ELANOUS_STATE_DIR=${remotePath(configDir)}`, `ELANOUS_STATE_DIR_SOURCE=${shellQuote(REMOTE_STATE_DIR_SOURCE)}`].join(' ');
   const argv = [remotePath(elanous), '--config-dir', remotePath(configDir), ...remoteParentArgs(args, target.podPool).map(shellQuote)].join(' ');
   // 준비가 실패하면 «확실히 안 띄웠다»(not-launched=…)를 찍고 끝낸다 — 그때만 호출부가 로컬로 돌아간다.
   // 띄운 뒤에는 짧게 살아 있는지 보고 pid 를 찍는다(조기 종료면 early-exit — 역시 «안 돈다»가 확실).

package/src/task-agent/task-hand.ts

@@ -45,6 +45,7 @@ import { INFLIGHT_REGISTRY_FILE, registerInflight } from '../pr-tool/inflight-re
 import { taskParentRoleEnv, taskParentRolePinsForChild } from './task-parent-role-llm.js';
 import { runHarvestUnit, type ReviewInvocation } from './harvest-unit.js';
 import { TASK_CARD_PREFIX } from './task-card-prefix.js';
+import { childLlmEffortProblem } from '../intelligence-map/model-catalog.js';
 
 export interface ResolveHandTextDeps {
   cwd: string;
@@ -414,7 +415,7 @@ export interface TaskCard {
     moveId?: string }>;
 }
 
-/** 구현 자식 LLM 선택 — 하니스 `--child-llm-provider/--child-llm-model/--child-llm-effort` 로 그대로 넘긴다(검증 권위는 하니스). */
+/** 구현 자식 LLM 선택 — 하니스 `--child-llm-provider/--child-llm-model/--child-llm-effort` 로 넘긴다. */
 export interface TaskChildLlm { provider: string; model: string; effort?: string }
 
 /**
@@ -431,6 +432,8 @@ export function parseChildLlm(value: string, effort?: string): TaskChildLlm {
   const model = provider === 'openrouter' && !rest.startsWith('openrouter/') ? `openrouter/${rest}` : rest;
   if (effort === undefined) return { provider, model };
   if (!effort || /[\s\p{Cc}]/u.test(effort)) throw new Error(`--child-llm-effort 가 비었거나 공백·제어 문자를 담았다: ${JSON.stringify(effort)}`);
+  const problem = childLlmEffortProblem(model, effort);
+  if (problem) throw new Error(problem);
   return { provider, model, effort };
 }
 

package/src/task-orchestrator/surfaces/pod-failure-reason.ts

@@ -125,6 +125,49 @@ export const POD_EXIT_CLASSES = ['oom-killed', 'deadline-exceeded', 'gh-login-fa
 
 export type PodExitClass = typeof POD_EXIT_CLASSES[number];
 
+/** Build the parent-ledger row for a terminal child attempt. A Job can complete
+ * successfully while its child result is still unsuccessful (for example,
+ * report-deficit after preserving a partial PR); retain both facts together. */
+export function podChildEvidenceLedgerRow(input: {
+  job: string;
+  childRunId: string;
+  state: 'complete' | 'failed' | 'aborted';
+  result?: {
+    stage?: unknown;
+    ok?: unknown;
+    failureClassification?: unknown;
+    completionDisposition?: unknown;
+    error?: unknown;
+    childEvidence?: unknown;
+  } | null;
+  noResultDiagnostic?: string | null;
+  noResultLogEvidence?: Record<string, unknown> | null;
+  podTermination?: PodTermination | null;
+}): Record<string, unknown> | null {
+  const { result } = input;
+  const persist = input.state === 'failed' || input.state === 'aborted' || input.noResultLogEvidence != null
+    || (input.state === 'complete' && (input.noResultDiagnostic != null || result?.ok === false));
+  if (!persist) return null;
+
+  const childEvidence = input.noResultLogEvidence
+    ? { ...(result?.childEvidence && typeof result.childEvidence === 'object' && !Array.isArray(result.childEvidence)
+      ? result.childEvidence as Record<string, unknown> : {}), ...input.noResultLogEvidence }
+    : result?.childEvidence ?? null;
+  const completedButUnsuccessful = input.state === 'complete' && result?.ok === false;
+  const childResult = completedButUnsuccessful && result ? Object.fromEntries([
+    ['stage', result.stage], ['ok', result.ok], ['failureClassification', result.failureClassification],
+    ['completionDisposition', result.completionDisposition], ['error', result.error],
+  ].filter(([, value]) => value !== undefined)) : null;
+
+  return {
+    childEvidence,
+    childRunId: input.childRunId,
+    job: input.job,
+    ...(input.podTermination ? { podTermination: input.podTermination } : {}),
+    ...(childResult && Object.keys(childResult).length > 0 ? { childResult } : {}),
+  };
+}
+
 const isPodBookkeepingLine = (line: string): boolean =>
   /^(?:ELANOUS_(?:MEM|RUN_LEDGER|USAGE_ROLLUP|POD_)|\[graph\] |\[ask\]\s+\d+\)\s)/u.test(line) || /^(?:at\s+\S|\.\.\.\s+\d+\s+more\b|cleanup\s+(?:complete|done|finished)\b)/iu.test(line);
 

package/src/task-orchestrator/surfaces/pod-ledger-events.ts

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import { mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
@@ -39,6 +40,29 @@ export function captureFailedPodJobs(input: {
   }
   const location = { host: first.host, context: first.context, namespace: first.namespace, childRunId: first.childRunId, jobUid: first.jobUid };
   const evidenceDir = join(artifactDir, 'pod-failure-capture', runId, job, first.childRunId as string);
+  // A failed kubectl/SSH read is itself the missing diagnostic. Keep its stderr in
+  // the private artifact directory and put only the path and exit status in the ledger.
+  const readFailure = (reason: string, result: { status: number | null; stderr: string }, extra: Record<string, unknown> = {}): void => {
+    let stderrEvidence: string | null = null;
+    let stderrCaptureStatus: 'saved' | 'redacted' | 'empty' | 'write-failed' = result.stderr ? 'saved' : 'empty';
+    if (result.stderr) {
+      try {
+        mkdirSync(evidenceDir, { recursive: true });
+        const tail = result.stderr.slice(-8192).split(/\r?\n/).map(line => {
+          if (!SECRET_VALUE.test(line)) return line;
+          stderrCaptureStatus = 'redacted';
+          return '[redacted credential line]';
+        }).join('\n');
+        const digest = createHash('sha256').update(tail).digest('hex').slice(0, 16);
+        stderrEvidence = join(evidenceDir, `${reason}-${digest}.stderr.log`);
+        try { writeFileSync(stderrEvidence, tail, { flag: 'wx', mode: 0o600 }); }
+        catch (error) {
+          if ((error as NodeJS.ErrnoException).code !== 'EEXIST' || readFileSync(stderrEvidence, 'utf8') !== tail) throw error;
+        }
+      } catch { stderrEvidence = null; stderrCaptureStatus = 'write-failed'; }
+    }
+    finish('failed', reason, { ...location, ...extra, kubectlStatus: result.status, stderrEvidence, stderrCaptureStatus });
+  };
   const previous = rows.find(row => row.event === 'pod-failure-capture' && row.data?.job === job && row.data?.outcome === 'collected'
     && row.data.childRunId === first.childRunId && row.data.jobUid === first.jobUid
     && row.data.host === first.host && row.data.context === first.context && row.data.namespace === first.namespace);
@@ -54,8 +78,8 @@ export function captureFailedPodJobs(input: {
   try {
     const jobResult = kubectl(first.host as string, [...args, 'get', 'job', job, '-o', 'json']);
     if (jobResult.status !== 0) {
-      finish(/\bNotFound\b|not found/i.test(jobResult.stderr) ? 'vanished' : 'failed',
-        /\bNotFound\b|not found/i.test(jobResult.stderr) ? 'job-not-found' : 'job-read-failed', location);
+      if (/\bNotFound\b|not found/i.test(jobResult.stderr)) finish('vanished', 'job-not-found', { ...location, kubectlStatus: jobResult.status });
+      else readFailure('job-read-failed', jobResult);
       return;
     }
     const jobBody = JSON.parse(jobResult.stdout) as { metadata?: { name?: string; uid?: string } };
@@ -78,7 +102,7 @@ export function captureFailedPodJobs(input: {
       } catch { return false; }
     });
     const podResult = kubectl(first.host as string, [...args, 'get', 'pods', '-l', `job-name=${job}`, '-o', 'json']);
-    if (podResult.status !== 0) { finish('failed', 'pods-read-failed', { ...location, jobEvidence }); return; }
+    if (podResult.status !== 0) { readFailure('pods-read-failed', podResult, { jobEvidence }); return; }
     const pods = JSON.parse(podResult.stdout) as { items?: Array<{ metadata?: { name?: string; ownerReferences?: Array<{ uid?: string }> } }> };
     if (!pods.items?.length || pods.items.some(p => !p.metadata?.ownerReferences?.some(owner => owner.uid === jobBody.metadata?.uid))) {
       finish('failed', 'pod-owner-mismatch', { ...location, jobEvidence }); return;
@@ -89,7 +113,8 @@ export function captureFailedPodJobs(input: {
       finish('failed', 'pod-ambiguous', { ...location, jobEvidence, podEvidence }); return;
     }
     const logs = kubectl(first.host as string, [...args, 'logs', `pod/${podName}`, '-c', 'child']);
-    if (logs.status !== 0) { finish('failed', 'logs-read-failed', { ...location, jobEvidence, podEvidence }); return; }
+    if (logs.status !== 0) { readFailure('logs-read-failed', logs, { jobEvidence, podEvidence }); return; }
+    if (!logs.stdout.trim()) { finish('failed', 'logs-empty', { ...location, jobEvidence, podEvidence }); return; }
     const logEvidence = save('child.log', logs.stdout);
     finish('collected', 'job-failed', { ...location, jobEvidence, podEvidence, logEvidence });
   } catch { finish('failed', 'capture-error', location); }