elanous 0.2.40 → 0.2.42

package/src/task-orchestrator/surfaces/self-implement-pod.ts

@@ -70,12 +70,48 @@ export function recordPodSourceIoSummary(logs: string, job: string, runId: strin
   if (!ioSummary) return;
   try {
     const measured = JSON.parse(ioSummary) as Record<string, unknown>;
-    log('pod.source', 'io-summary', { job, runId, runIdSource, ...measured, hostOriginCalls });
+    const pushCounterReady = /^ELANOUS_POD_GIT_PUSH_COUNTER ready\r?$/m.test(logs);
+    const pushCalls = (logs.match(/^ELANOUS_POD_GIT_PUSH_ATTEMPT\r?$/gm) ?? []).length;
+    log('pod.source', 'io-summary', { job, runId, runIdSource, ...measured, hostOriginCalls,
+      ...(pushCounterReady ? { pushCalls } : {}) });
   } catch (error) {
     log('pod.source', 'io-summary-invalid', { job, runId, runIdSource, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' });
   }
 }
 
+export type PodSourceAttemptOutcome = {
+  classification: 'explicit-source-failure' | 'source-complete' | 'status-not-recorded';
+  sourceStage: string | null;
+  sourceKind: string | null;
+  sourceVia: string | null;
+  sourceStatus: string | null;
+  baseSha: string | null;
+  exitCode: number | null;
+  failureCode: string | null;
+};
+
+/** Keep missing telemetry distinct from an observed source-stage failure. */
+export function parsePodSourceAttemptOutcome(logs: string | null, fallback: { sourceKind?: string | null; baseSha?: string | null } = {}): PodSourceAttemptOutcome {
+  const resultLine = logs ? /^ELANOUS_POD_SOURCE_RESULT (\{[^\r\n]+\})\r?$/m.exec(logs)?.[1] : undefined;
+  const result = resultLine ? (() => { try { return JSON.parse(resultLine) as Record<string, unknown>; } catch { return null; } })() : null;
+  const explicitBaseFailure = !!logs && /^ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE [^\r\n]+\r?$/m.test(logs);
+  const ioLine = logs ? /^ELANOUS_POD_SOURCE_IO (\{[^\r\n]+\})\r?$/m.exec(logs)?.[1] : undefined;
+  const io = ioLine ? (() => { try { return JSON.parse(ioLine) as Record<string, unknown>; } catch { return null; } })() : null;
+  const validString = (value: unknown): string | null => typeof value === 'string' && value.length > 0 ? value : null;
+  const resultFailure = validString(result?.failureCode) ?? (explicitBaseFailure ? 'base-sha-unavailable' : null);
+  const status = validString(result?.sourceStatus) ?? (io?.sourceStatus === 'complete' || io?.sourceStatus === 'incomplete' ? io.sourceStatus : null);
+  return {
+    classification: resultFailure || explicitBaseFailure ? 'explicit-source-failure' : status === 'complete' ? 'source-complete' : 'status-not-recorded',
+    sourceStage: validString(result?.sourceStage) ?? (explicitBaseFailure ? 'base-sha' : null),
+    sourceKind: validString(result?.sourceKind) ?? fallback.sourceKind ?? null,
+    sourceVia: validString(result?.sourceVia) ?? validString(io?.sourceVia) ?? (/^ELANOUS_POD_SOURCE_VIA (image|mirror|github|bundle|min-sync)\r?$/m.exec(logs ?? '')?.[1] ?? null),
+    sourceStatus: status,
+    baseSha: validString(result?.baseSha) ?? fallback.baseSha ?? null,
+    exitCode: typeof result?.exitCode === 'number' && Number.isInteger(result.exitCode) ? result.exitCode : null,
+    failureCode: resultFailure,
+  };
+}
+
 /** Select a timestamp for a DeadlineExceeded observation without making detector time look like Job completion.
  *  `podFinishedAt` must come from readPodTermination for the same verified Job uid. */
 export function podJobFinishedTiming(input: { jobCreatedAt: string | null; jobCompletedAt: string | null;
@@ -99,6 +135,7 @@ import { POD_LAUNCH_FINISHED_EVENT, POD_LAUNCH_STARTED_EVENT, provenanceRowFromA
 import { podProvenanceMetadata, type PodProvenanceMetadata } from './pod-provenance.js';
 import { packageVersion } from '../../version/code-revision.js';
 import { minihLocationFrom, podWorkLabels, type PodWorkIdentity, type PodPlacement, type PodPlacementKind, type PodPoolMember, type PodPoolScheduler } from './pod-pool.js';
+import { acquirePodPoolSlot, POD_DISTRIBUTOR_ENTRY_ENV, type PodDistributorAdapter } from './pod-distributor.js';
 export { POD_CHILD_REQUESTS } from './pod-lease.js';
 import { measurePoolLease, recommendConcurrency, POD_CHILD_REQUESTS, POD_SI_ADMISSION_CAP_BYTES, POD_HOST_LEASE_ANNOTATION, POD_JOB_TTL_AFTER_FINISHED_SECONDS, LEASE_KUBECTL_MAX_BUFFER, memoryQuantityBytes } from './pod-lease.js';
 import { ACTUAL_SUBSTRATE_ENV, RUN_CONTRACT_ENV, carryRunContract, completionFloorFor } from '../../self-implement/graph-run-contract.js';
@@ -128,7 +165,7 @@ import { normalizeFallbackChain, type FallbackStep } from '../../oauth/fallback-
 import { goalTypeOf, type GoalType } from '../../../scripts/measure-pod-memory-by-goal.js';
 import { declaredGoalType, type GoalType as DeclaredGoalType } from '../../self-implement/goal-author.js';
 import { readPodMemoryAdvice, type PodMemoryAdvice } from '../../cli/pod-memory-advice.js';
-import { DEFAULT_BUDGET_GATE_MAX_USED_PERCENT, getUserConfig, roleLlmEnvName, type UserConfig } from '../../user-config.js';
+import { DEFAULT_BUDGET_GATE_MAX_USED_PERCENT, getUserConfig, resolveRoleLlm, roleLlmEnvName, type UserConfig } from '../../user-config.js';
 import { worktreeAddTimeoutSec } from '../../git-fs/worktree.js';
 import { podChildProviderOf, podChildProviderRefusal, type PodChildProvider } from './pod-child-providers.js';
 import { BEDROCK_POD_EGRESS_LABEL, bedrockPodEnv, checkBedrockPodSecret, type BedrockPodSpec } from './pod-bedrock-child.js';
@@ -137,7 +174,7 @@ import { ZAI_POD_EGRESS_LABEL, checkZaiPodSecret, countActiveZaiJobs, decideZaiP
 import { ZAI_CODING_DEFAULT_MODEL, ZAI_OPENROUTER_FALLBACK_MODEL, zaiSettingsFromConfig, type ZaiCodingPlanSettings } from '../../llm/zai-coding-plan.js';
 import { normalizePlanningFallbackReason, selectEnhanceLlm } from '../../prompt-enhance/enhance.js';
 import { inferProviderFromModel } from '../../llm.js';
-import { classifyPodExit, extractPodFailureReason, podChildFailureAttribution, podDeadlineResultMarker, podJobConditionReason, podTerminalRow, POD_TERMINATION_JOB_JSONPATH, POD_TERMINATION_PODS_JSONPATH, readPodTermination, type PodExitClass, type PodTermination } from './pod-failure-reason.js';
+import { classifyPodExit, extractPodFailureReason, podChildEvidenceLedgerRow, podChildFailureAttribution, podDeadlineResultMarker, podJobConditionReason, podTerminalRow, POD_TERMINATION_JOB_JSONPATH, POD_TERMINATION_PODS_JSONPATH, readPodTermination, type PodExitClass, type PodTermination } from './pod-failure-reason.js';
 import { kubectlTransientReason, retryKubectlTransient } from './kubectl-transient-retry.js';
 import { OLD_DOOR_STAMP_ENV } from '../../self-dev/old-door.js';
 import { resolveDefaultSourceHead, seedMirrorOnce, type MirrorSeedResult } from './pod-mirror-seed.js';
@@ -285,6 +322,8 @@ export interface PodSpawnOptions {
   readSkillEnv?: () => Record<string, string>;
   /** ☸️ 여러 클러스터 풀(pod-pool.ts) — Job 마다 우선순위 순 첫 빈 자리로. 없으면 현재 컨텍스트 하나. */
   pool?: PodPoolScheduler;
+  /** POD-DISTRIBUTOR-WIRE — replaceable admission seam; tasks-hand only in the first wire slice. */
+  podDistributorAdapter?: PodDistributorAdapter;
   /** ☸️ 원격 그라운딩 주소(P13) — 없으면 호스트 env ELANOUS_GROUNDING_URL → 설정 pod.groundingUrl. 셋 다 없으면 토큰을 안 만든다. */
   groundingUrl?: string;
   /** 시험 심 — 토큰 발급·회수. GitHub credential 토큰에는 호스트가 검증한 저장소를 서명한다. */
@@ -771,9 +810,10 @@ export function podGitPushGuardScript(runId?: string): string {
     '    *) echo "[pod] git-guard: refused push to $rref (only this run\'s branches)" >&2; exit 1 ;;',
     '  esac',
     'done',
+    'case "$2" in https://github.com/*|http://github.com/*|git@github.com:*|ssh://git@github.com/*) printf \'ELANOUS_POD_GIT_PUSH_ATTEMPT\\n\' >&2 ;; esac',
     'exit 0',
     'ELANOUS_PRE_PUSH',
-    `chmod 755 "${POD_GIT_HOOKS_DIR}/pre-push" && git config --global core.hooksPath "${POD_GIT_HOOKS_DIR}"`,
+    `chmod 755 "${POD_GIT_HOOKS_DIR}/pre-push" && git config --global core.hooksPath "${POD_GIT_HOOKS_DIR}" && printf 'ELANOUS_POD_GIT_PUSH_COUNTER ready\\n'`,
   ].join('\n');
 }
 
@@ -1602,21 +1642,63 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
     if (options.siWarmAttempt && !options.siWarmHostPostprocess) {
       throw new Error('si-v1 warm execution requires cold-path host postprocess parity');
     }
-    if (options.siWarmAttempt) {
+    let siWarmEnabled = true;
+    const taskCard = env.ELANOUS_POD_TASK_CARD ?? env.ELANOUS_TASK_CARD_ID;
+    if (taskCard) {
+      let stage: 'config' | 'evidence' | 'decision' = 'config';
+      try {
+        const config = options.warmReuseConfig?.();
+        stage = 'evidence';
+        const evidence = options.warmReuseEvidence?.();
+        stage = 'decision';
+        const decision = decideWarmReuse('ta', config, evidence);
+        siWarmEnabled = decision.live;
+        debug.log('pod.warm', 'ta-admission-decision', { ...decision,
+          execution: decision.live ? 'warm-attempt' : 'fresh-job' });
+      } catch {
+        siWarmEnabled = false;
+        debug.log('pod.warm', 'ta-admission-unavailable', { spaceId: input.spaceId,
+          reason: stage === 'decision' ? 'warm-decision-failed' : `injected-${stage}-failed`, execution: 'fresh-job' }, { level: 'warn' });
+      }
+    }
+    if (options.siWarmAttempt && siWarmEnabled) {
       const done = (async (): Promise<SelfImplementJobDone> => {
+        // POD-REUSE-REQUEST-CLEAN-FU — one fail-soft row per request decision. `runId` is the
+        // ledger partition (warm child, then parent run, then the legacy spaceId fallback);
+        // `correlationId` always names the request's spaceId. `warm-path-selected` is recorded
+        // before transport, so only the later return/quarantine row settles whether reuse completed.
+        // A ledger write failure is an observation failure only.
+        const recordWarmRequestDecision = (data: Record<string, unknown>, runId?: string) => {
+          const parentRunId = env.ELANOUS_RUN_ID;
+          const ledgerRunId = runId ?? parentRunId ?? input.spaceId;
+          const runIdSource = runId ? 'warm-child-run' : parentRunId ? 'parent-run' : 'space-id-fallback';
+          try { writeWarmLedger({ runId: ledgerRunId, event: 'pod-reuse-request-decision',
+            data: { ...data, correlationId: input.spaceId, runIdSource } }); }
+          catch (error) { debug.log('pod.reuse', 'ledger-unavailable', { spaceId: input.spaceId,
+            event: 'pod-reuse-request-decision',
+            reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
+        };
         let attempt: SiWarmChildAttempt;
         try {
           const acquired = await options.siWarmAttempt!(input);
           if (!acquired) {
             // No lease was fenced: use the existing one-shot Job path.
+            recordWarmRequestDecision({ spaceId: input.spaceId, outcome: 'cold-job',
+              workerId: null, leaseId: null, generation: null, podUid: null });
             const { siWarmAttempt: _unused, siWarmHostPostprocess: _postprocess, ...coldOptions } = options;
             return podSelfImplementSpawn(coldOptions)(input).done;
           }
           attempt = acquired;
+          recordWarmRequestDecision({ spaceId: input.spaceId, outcome: 'warm-path-selected',
+            workerId: acquired.command?.workerId ?? null, leaseId: acquired.command?.leaseId ?? null,
+            generation: acquired.command?.generation ?? null, podUid: acquired.command?.podUid ?? null },
+            acquired.command?.runId);
         }
         catch (error) {
           // A lost exec reply may conceal an already opened PR. Never start another child here.
           const message = error instanceof Error ? error.message : String(error);
+          recordWarmRequestDecision({ spaceId: input.spaceId, outcome: 'acquire-failed', reason: message,
+            workerId: null, leaseId: null, generation: null, podUid: null });
           debug.log('pod.reuse', 'attempt-unavailable', { spaceId: input.spaceId, reason: message }, { level: 'warn' });
           return { exitCode: 1, output: '', error: { code: 'si-warm-reconcile-only', message } };
         }
@@ -1985,7 +2067,8 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         return 'pool-slot-unavailable';
       };
       const recordSlotObservation = (attempt: { observationKey: string; requestedAtMs: number; requestedAt: string },
-        outcome: 'requested' | 'queued' | 'admitted' | 'rejected', reasonCode: string): void => {
+        outcome: 'requested' | 'queued' | 'admitted' | 'rejected', reasonCode: string,
+        cancellation?: { abortReason?: string; waitReason: string | null }): void => {
         const pool = options.pool;
         let occupants: Record<string, number> | null = null;
         try { occupants = pool ? pool.snapshot() : null; } catch { /* observation must not change scheduling */ }
@@ -1994,6 +2077,8 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           observationKey: attempt.observationKey, runId: childRunId, host: resolveHostId(env),
           requestedAt: attempt.requestedAt, waitedMs: Math.max(0, slotNow() - attempt.requestedAtMs),
           queued: outcome === 'queued', poolCapacity, occupants, reasonCode, parentId: ledgerRunId, outcome,
+          ...(cancellation ? { waitReason: cancellation.waitReason,
+            ...(cancellation.abortReason === undefined ? {} : { abortReason: cancellation.abortReason }) } : {}),
         };
         debug.log('pod.slot', outcome, data, { level: outcome === 'admitted' || outcome === 'requested' ? 'info' : 'warn' });
         try {
@@ -2045,6 +2130,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         const attempt = { observationKey: `${childRunId}:pod-slot:${requestedAtMs}:${++slotAttemptNumber}`,
           requestedAtMs, requestedAt: new Date(requestedAtMs).toISOString() };
         let firstSlotReasonCode: string | undefined;
+        stageReason['pool-slot'] = null;
         let slotQueuedRecorded = false;
         const stop = watchStall('pool-slot');
         // MINIH-MODE (0.2.37): the location is declared by the launch env — absent/unknown keeps the configured
@@ -2056,11 +2142,15 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
             if (input.signal?.aborted) return null;
             // The reason comes back inside this call, so a concurrent launch cannot overwrite it.
             const kind = podPlacementKind(oomRetried ? retryTier : memoryTier, selectedGoalType, requestKind);
-            const acquired = await options.pool.tryAcquire(unfitContexts, (reason) => {
-              stageReason['pool-slot'] = reason;
-              firstSlotReasonCode ??= slotReasonCode(reason);
-            },
-              { kind, ...(minihLocation ? { minihLocation } : {}), onPlacement: (placement) => { lastPlacement = placement; } });
+            const acquired = await acquirePodPoolSlot({ entry: env[POD_DISTRIBUTOR_ENTRY_ENV], pool: options.pool,
+              ...(options.podDistributorAdapter ? { adapter: options.podDistributorAdapter } : {}),
+              request: { requestId: attempt.observationKey, idempotencyKey: attempt.observationKey,
+                owner: { runId: childRunId, ...(env.ELANOUS_TASK_CARD_ID ? { cardId: env.ELANOUS_TASK_CARD_ID } : {}),
+                  ...(env.ELANOUS_POD_OWNER_KIND === 'seat' && env.ELANOUS_POD_OWNER_ID ? { seat: env.ELANOUS_POD_OWNER_ID } : {}) },
+                lane: 'ta', workload: { memoryLimit, kind }, skip: unfitContexts, onEmpty: (reason) => {
+                stageReason['pool-slot'] = reason;
+                firstSlotReasonCode ??= slotReasonCode(reason);
+              }, mode: { kind, ...(minihLocation ? { minihLocation } : {}), onPlacement: (placement) => { lastPlacement = placement; } } } });
             if (acquired) {
               recordSlotObservation(attempt, 'admitted', firstSlotReasonCode ?? 'admitted');
               debug.log('self-implement.pod', 'pool-slot', { spaceId: input.spaceId, context: acquired.context, inflight: options.pool.snapshot(), ...(lastPlacement ? { placement: lastPlacement } : {}) });
@@ -2110,7 +2200,10 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
       let member: PodPoolMember | null;
       try { member = await acquireSlot(); } catch (error) { podAdmitError(error); throw error; }
       if (options.pool && !member) {
-        if (lastSlotAttempt) recordSlotObservation(lastSlotAttempt, 'rejected', lastSlotReasonCode ?? 'aborted');
+        if (lastSlotAttempt) recordSlotObservation(lastSlotAttempt, 'rejected', lastSlotReasonCode ?? 'aborted', {
+          waitReason: stageReason['pool-slot'] ?? null,
+          ...(typeof input.signal?.reason === 'string' ? { abortReason: input.signal.reason } : {}),
+        });
         exitJourneyNode('pool-admit', { provenance: 'self-implement-pod', outcome: 'refused', data: { spaceId: input.spaceId, reason: 'no-slot' } });
         return { exitCode: null, output: '', error: { code: 'aborted', message: 'aborted before a pool slot opened', ...(lastSlotReasonCode ? { reasonCode: lastSlotReasonCode } : {}) } };
       }
@@ -2134,14 +2227,41 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         } catch (error) { debug.log('self-implement.pod', 'failure-capture-ledger-unavailable', { job: name, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
       };
       let recorded = false;
+      let jobApplied = false;
       let groundingMinted: string | null = null;
       try {
       if (!context) return { exitCode: 1, output: '', error: { code: 'pod-context', message: 'Pod Job context를 확인할 수 없다' } };
-      const cleanupSecret = () => { kubectl(['-n', namespace, 'delete', 'secret', `${name}-creds`, '--ignore-not-found']); };
+      const cleanupSecret = () => {
+        // Once the Job exists, its credential Secret must live at least as long as the Job.
+        // Early error/abort paths may run while the Pod is still reading /creds; leave cleanup
+        // to the Job ownerReference/TTL until Kubernetes reports this Job terminal or absent.
+        if (jobApplied) {
+          const lifecycle = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.metadata.uid} {.status.active} {.status.succeeded} {.status.failed}']);
+          const [uid, , succeeded, failed] = lifecycle.stdout.trim().split(/\s+/u);
+          const terminal = Number(succeeded) > 0 || Number(failed) > 0;
+          if (lifecycle.status === 0 && uid && !terminal) {
+            debug.log('self-implement.pod', 'secret-cleanup-deferred-job-live', { job: name });
+            return;
+          }
+          if (lifecycle.status !== 0 && !/notfound/iu.test(lifecycle.stderr)) {
+            debug.log('self-implement.pod', 'secret-cleanup-deferred-job-unmeasured', { job: name }, { level: 'warn' });
+            return;
+          }
+        }
+        kubectl(['-n', namespace, 'delete', 'secret', `${name}-creds`, '--ignore-not-found']);
+      };
       let repairResultAnnounced = false;
       let repairArtifactReady = false;
       let hostOriginCalls: number | null = 0;
       let sourceBaseSha: string | undefined;
+      const recordSourceAttemptOutcome = (logs: string | null, captureStatus: 'captured' | 'logs-unavailable', observedChildRunId?: string) => {
+        const optionBaseSha = options.source && 'baseSha' in options.source ? options.source.baseSha : undefined;
+        const outcome = parsePodSourceAttemptOutcome(logs, { sourceKind: options.source?.kind ?? 'default', baseSha: sourceBaseSha ?? optionBaseSha });
+        const data = { job: name, childRunId: observedChildRunId ?? childRunId ?? null, attempt: oomRetried ? 2 : 1, captureStatus, ...outcome };
+        debug.log('pod.source', 'attempt-outcome', data, outcome.classification === 'status-not-recorded' ? { level: 'warn' } : undefined);
+        try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-source-attempt-outcome', data }, ledgerDir); }
+        catch (error) { debug.log('pod.source', 'attempt-outcome-ledger-unavailable', { job: name, childRunId: childRunId ?? null, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
+      };
       const collectFullLogs = (unavailableEvent: string, replace?: ReadonlySet<string>, onEvent?: (event: string, data: Record<string, unknown>) => void, childId?: string): { status: 'ok' | 'unavailable' | 'incomplete'; childLedgerIncomplete: boolean; samples: ReturnType<typeof parseMemSamples> } => {
         let full: ReturnType<Kubectl>;
         try {
@@ -2150,8 +2270,10 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           if (!full.stdout && unavailableEvent === 'failed-job-logs-unavailable') throw new Error('empty child logs');
         } catch (error) {
           debug.log('self-implement.pod', unavailableEvent, { job: name, reason: error instanceof Error ? error.message : String(error) });
+          recordSourceAttemptOutcome(null, 'logs-unavailable', childId);
           return { status: 'unavailable', childLedgerIncomplete: false, samples: [] };
         }
+        recordSourceAttemptOutcome(full.stdout, 'captured', childId);
         const via = /^ELANOUS_POD_SOURCE_VIA (image|mirror|github)\r?$/m.exec(full.stdout)?.[1];
         // #28246 names why the mirror was skipped on the line before `VIA github`; carry it on the same event.
         const mirrorSkip = /^ELANOUS_POD_SOURCE_MIRROR_SKIP (no-mount|rev-parse-failed|clone-failed)\r?$/m.exec(full.stdout)?.[1];
@@ -2274,13 +2396,22 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         /** 넘친 glm Pod 는 자식 인자도 OpenRouter GLM 으로 — Job 스크립트·리뷰어 고정·키 전달이 openrouter 갈래를 그대로 탄다. */
         const jobArgs = zaiRoute === 'openrouter' ? zaiOverflowChildArgs(args, ZAI_OPENROUTER_FALLBACK_MODEL) : args;
         const grok = options.provider === 'grok';
-        const openrouter = options.provider === 'openrouter' || zaiRoute === 'openrouter';
+        // The delegated child provider is also a launch source. Callers that carry
+        // --child-llm-provider in args must not leave the host's Secret wiring on
+        // the default provider path.
+        const delegatedChildProvider = podDelegatedChildLlm(jobArgs)?.provider;
+        const openrouter = options.provider === 'openrouter' || zaiRoute === 'openrouter' || delegatedChildProvider === 'openrouter';
         const openGateway = options.provider === 'opengateway';
         const anthropic = options.provider === 'anthropic';
         const bedrockChild = options.provider === 'bedrock';
         const zaiChild = zaiRoute === 'zai';
         /** ZAI 로 입장한 자식도 플랜 한도 오류 뒤 OpenRouter 로 전환할 수 있다. 실행 중 폴백 자격을 발사 전에 확보한다. */
         const openrouterCredentialRequired = openrouter || (zaiChild && zaiLaunchOverage !== 'stop');
+        const hostConfig = (options.fallbackConfig ?? getUserConfig)();
+        const reviewProvider = resolveRoleLlm('review', { config: hostConfig, env: { ...env, ...options.armEnv } }).provider;
+        // A non-OpenRouter child can still run a review role pinned to OpenRouter. Pass that
+        // credential through the same Secret path, but don't make it a launch requirement.
+        const openrouterCredentialNeeded = openrouterCredentialRequired || reviewProvider === 'openrouter';
         /** API 키 자식 — codex 계정·자격 파일을 안 쓴다(키는 작업별 creds Secret 의 `env-<KEY>` · bedrock·glm 은 이름 있는 Secret 으로만). */
         const apiKeyChild = openrouter || openGateway || anthropic || bedrockChild || zaiChild;
         const plannedAccount = retryAccount ?? (grok ? 'grok' : openrouter ? 'openrouter' : openGateway ? 'opengateway' : anthropic ? 'anthropic' : bedrockChild ? 'bedrock' : zaiChild ? 'glm' : options.accountBroker?.() ?? options.account ?? 'team');
@@ -2324,7 +2455,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
           return credential;
         }) : undefined;
-        const openrouterKey = openrouterCredentialRequired ? env.OPENROUTER_API_KEY?.trim() || (options.readKeyCache ?? defaultReadKeyCache)('OPENROUTER_API_KEY')?.trim() : undefined;
+        const openrouterKey = openrouterCredentialNeeded ? env.OPENROUTER_API_KEY?.trim() || (options.readKeyCache ?? defaultReadKeyCache)('OPENROUTER_API_KEY')?.trim() : undefined;
         if (openrouterCredentialRequired && !openrouterKey) throw new Error('pod: Pod 에 openrouter 키 없음 — 호스트 키 캐시 또는 OPENROUTER_API_KEY 필요');
         const openGatewayEnvKey = openGateway ? env.OPENGATEWAY_API_KEY?.trim() : undefined;
         const openGatewayCachedKey = openGateway ? (options.readKeyCache ?? defaultReadKeyCache)('OPENGATEWAY_API_KEY')?.trim() : undefined;
@@ -2407,7 +2538,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
         }
         // Grok 자격은 전용 Secret 키 하나로만 보낸다 — passEnv 의 API 키 중복 전달은 막는다.
-        const passKeys = [...new Set([...(options.passEnv ?? []), ...(openrouterCredentialRequired ? ['OPENROUTER_API_KEY'] : []), ...(openGateway ? ['OPENGATEWAY_API_KEY'] : []), ...(anthropic ? ['ANTHROPIC_API_KEY'] : [])])].filter((key) => key !== 'ELANOUS_LIVE_DETAIL_UNTIL'
+        const passKeys = [...new Set([...(options.passEnv ?? []), ...(openrouterCredentialNeeded && openrouterKey ? ['OPENROUTER_API_KEY'] : []), ...(openGateway ? ['OPENGATEWAY_API_KEY'] : []), ...(anthropic ? ['ANTHROPIC_API_KEY'] : [])])].filter((key) => key !== 'ELANOUS_LIVE_DETAIL_UNTIL'
           && key !== POD_GITHUB_CREDENTIAL_TOKEN_ENV && key !== POD_GITHUB_CREDENTIAL_URL_ENV
           && (!grok || !['XAI_API_KEY', 'GROK_API_KEY', 'GROK_CODE_XAI_API_KEY'].includes(key)));
         const skillEnvs: Record<string, string> = options.skillEnv
@@ -2584,8 +2715,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
             authorChoice = { ...authorChoice, model: childModel, modelSource: 'fallback-child' };
           } else debug.log('self-implement.pod', 'role-llm-armed', { job: name, role: 'planning', model: authorChoice.model, source: authorChoice.modelSource, account: roleCodexAccount });
         }
-        const hostKey = (k: string): string | undefined => k === 'OPENROUTER_API_KEY' && openrouterCredentialRequired ? openrouterKey : k === 'OPENGATEWAY_API_KEY' && openGateway ? openGatewayKey : k === 'ANTHROPIC_API_KEY' && anthropic ? anthropicKey : env[k] ?? (options.readKeyCache ?? defaultReadKeyCache)(k);
-        const hostConfig = (options.fallbackConfig ?? getUserConfig)();
+        const hostKey = (k: string): string | undefined => k === 'OPENROUTER_API_KEY' && openrouterCredentialNeeded ? openrouterKey : k === 'OPENGATEWAY_API_KEY' && openGateway ? openGatewayKey : k === 'ANTHROPIC_API_KEY' && anthropic ? anthropicKey : env[k] ?? (options.readKeyCache ?? defaultReadKeyCache)(k);
         const hostFallbackNames = hostConfig.llm.fallbackChain;
         const zaiOverage = zaiLaunchOverage ?? zaiSettingsFromConfig(hostConfig.llm).overage;
         const normalizedFallback = normalizeFallbackChain(hostFallbackNames);
@@ -2842,22 +2972,6 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           slotId: env.ELANOUS_POD_SLOT_ID,
           work: !goalDoc && env.ELANOUS_POD_AUTHOR_ON_POD === '1' && !shard ? 'authoring' : (oomRetried ? retryTier : memoryTier) === 'lite' ? 'lite' : 'harness',
         };
-        // TA-POD-WARMBOOT-PARITY shadow only: read injected evidence, then keep the fresh-Job path.
-        // This boundary must not open host configuration or credential files for a warm decision.
-        if (workIdentity.taskCard) {
-          let stage: 'config' | 'evidence' | 'decision' = 'config';
-          try {
-            const config = options.warmReuseConfig?.();
-            stage = 'evidence';
-            const evidence = options.warmReuseEvidence?.();
-            stage = 'decision';
-            const decision = decideWarmReuse('ta', config, evidence);
-            debug.log('pod.warm', 'ta-shadow-observation', { ...decision, execution: 'fresh-job' });
-          } catch {
-            debug.log('pod.warm', 'ta-shadow-unavailable', { spaceId: input.spaceId,
-              reason: stage === 'decision' ? 'warm-decision-failed' : `injected-${stage}-failed`, execution: 'fresh-job' }, { level: 'warn' });
-          }
-        }
         // TA-POD-WARMBOOT-PARITY (GATE-WARM-BOOT parity · #27805): a commit-pinned source on a pool host — put that commit into
         // the host mirror first (once per host·commit in this process) so podSourceScript finds it instead of fetching
         // from GitHub. Best effort: a failed seed only logs; the Job is applied either way.
@@ -2934,6 +3048,19 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         const a = kubectl(['apply', '-f', '-'], JSON.stringify(job));
         zaiPendingApply.delete(name);   // apply 뒤엔 Job 라벨이 센다(성공) · 실패면 셀 것이 없다
         if (a.status !== 0) { cleanupSecret(); return { exitCode: 1, output: a.stderr, error: { code: 'pod-apply', message: a.stderr.trim() } }; }
+        jobApplied = true;
+        // Bind the credential Secret immediately after Job creation, before waiting for a Pod
+        // or doing any other fallible work. Kubernetes then removes both on Job TTL cleanup.
+        const jobUid = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.metadata.uid}']);
+        const uid = jobUid.status === 0 ? jobUid.stdout.trim() : '';
+        lifecycleJobUid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(uid) ? uid : undefined;
+        if (lifecycleJobUid) {
+          const owned = kubectl(['-n', namespace, 'patch', 'secret', `${name}-creds`, '--type=merge', '-p', JSON.stringify({ metadata: { ownerReferences: [{ apiVersion: 'batch/v1', kind: 'Job', name, uid: lifecycleJobUid }] } })]);
+          if (owned.status !== 0) debug.log('self-implement.pod', 'secret-owner-failed', { job: name, stderr: owned.stderr.trim() }, { level: 'warn' });
+          else debug.log('self-implement.pod', 'secret-owner-attached', { job: name, owner: 'job' });
+        } else {
+          debug.log('self-implement.pod', 'secret-owner-job-uid-unavailable', { job: name }, { level: 'warn' });
+        }
         releaseAdmission?.applied?.(name, context, namespace);
         try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-config-snapshot', data: {
           job: name, hash: configSnapshot.hash, keyCount: configSnapshot.keyCount,
@@ -2996,16 +3123,10 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
           debug.log('self-implement.pod', 'source-delivered', { job: name, kind: 'bundle', headCommit: options.source.headCommit });
         }
-        // ☸️ P2: 비밀의 소유자 = Job — 호스트가 죽어도 Job 의 TTL 삭제와 함께 k8s 가 비밀을 거둔다(자격 사본이 클러스터에 남지 않는다).
-        const uid = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.metadata.uid}']).stdout.trim();
-        lifecycleJobUid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(uid) ? uid : undefined;
-        if (uid) {
-          const owned = kubectl(['-n', namespace, 'patch', 'secret', `${name}-creds`, '--type=merge', '-p', JSON.stringify({ metadata: { ownerReferences: [{ apiVersion: 'batch/v1', kind: 'Job', name, uid }] } })]);
-          if (owned.status !== 0) debug.log('self-implement.pod', 'secret-owner-failed', { job: name, stderr: owned.stderr.trim() }, { level: 'warn' });
-        }
         }
         try {
-          appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-child-run', data: { childRunId: liveChildRunId, job: name, attempt: oomRetried ? 2 : 1, ...(goalFile ? { goalFile } : {}) } }, ledgerDir);
+          appendRunLedgerEntry({ runId: ledgerRunId, timestamp: new Date((options.now ?? Date.now)()).toISOString(),
+            event: 'pod-child-run', data: { childRunId: liveChildRunId, job: name, attempt: oomRetried ? 2 : 1, ...(goalFile ? { goalFile } : {}) } }, ledgerDir);
           appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-job-applied', data: { job: name, childRunId: liveChildRunId, jobUid: lifecycleJobUid, host: member?.sshHost ?? resolveHostId(env), context, namespace } }, ledgerDir);
           if (lastPlacement) appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-placement', data: { job: name, childRunId: liveChildRunId, attempt: oomRetried ? 2 : 1, member: lastPlacement.member, kind: lastPlacement.kind, outcome: lastPlacement.outcome, preferred: lastPlacement.preferred, reason: lastPlacement.reason } }, ledgerDir);
           appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-memory-selected', data: { job: name, childRunId: liveChildRunId, attempt: oomRetried ? 2 : 1, limit: memoryLimit, ...(appliedMemoryRequest ? { request: appliedMemoryRequest } : {}), tier: oomRetried ? retryTier : memoryTier, source: oomRetried ? 'oom-retry' : memorySource, reason: oomRetried ? 'OOMKilled' : memoryReason, declaredGoalType: selectedGoalType } }, ledgerDir);
@@ -3181,11 +3302,11 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
             if (seen !== null) {
               releaseAdmission?.observed?.();
               state = seen === 0 ? 'complete' : 'failed';
-              // The child's own rc (the Pod's terminated state may lag like the condition) — exit-code paths read it as before.
-              if (seen !== 0) containerExitCode = seen;
+              // The shared marker is authoritative while Pod status lags; preserve the child's rc, including 0, on the parent.
+              containerExitCode = seen;
               if (seen !== 0) podTermination = readPodTermination({ kubectl, namespace, job: name, path: 'result-marker', jobUid: lifecycleJobUid });
               if (seen !== 0) captureFailedJob(liveChildRunId);
-              debug.log('self-implement.pod', 'result-marker-early', { job: name, waitedMs: Date.now() - waitStartedAt, rc: seen });
+              debug.log('self-implement.pod', 'result-marker-early', { job: name, runId: liveChildRunId, waitedMs: Date.now() - waitStartedAt, rc: seen });
               break;
             }
           }
@@ -3452,11 +3573,24 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           };
         }
         let noResultDiagnostic: string | null = null;
+        let noResultLedgerObservation: { available: boolean; bytes: number; rows: number; lastEvent: string | null } = {
+          available: false, bytes: 0, rows: 0, lastEvent: null,
+        };
         // POD-NORESULT: a terminal Job without a parsed disposition is incomplete even when the Job condition says Complete.
         const noResultCandidate = !podVanished && !disposition && !oomKilled && failedReason !== 'DeadlineExceeded' &&
           (state === 'complete' || (state === 'failed' && containerExitCode !== 0));
         if (noResultCandidate) {
-          try { noResultDiagnostic = podNoResultDiagnostic(readFileSync(runLedgerPath(liveChildRunId, ledgerDir), 'utf8')); }
+          try {
+            const ledgerText = readFileSync(runLedgerPath(liveChildRunId, ledgerDir), 'utf8');
+            const ledgerRows = ledgerText.split('\n').filter(Boolean);
+            let lastEvent: string | null = null;
+            try {
+              const parsed = JSON.parse(ledgerRows.at(-1) ?? 'null') as { event?: unknown } | null;
+              lastEvent = typeof parsed?.event === 'string' ? parsed.event : null;
+            } catch { /* Keep counts when the last ledger row is malformed. */ }
+            noResultLedgerObservation = { available: true, bytes: Buffer.byteLength(ledgerText), rows: ledgerRows.length, lastEvent };
+            noResultDiagnostic = podNoResultDiagnostic(ledgerText);
+          }
           catch { /* ledger not returned: do not invent a stage */ }
           noResultDiagnostic ??= 'child terminal result missing; last ledger stage=unknown; round=unknown; mustFix=unknown';
         }
@@ -3468,20 +3602,41 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         const missingStage = noResultDiagnostic?.includes('stage=unknown') ?? false;
         if (shouldCaptureFailureLog || missingStage) {
           const logRead = readPodNoResultLogTail({ run: kubectl, namespace, job: name, maxLines: POD_NO_RESULT_LOG_TAIL_LINES });
+          const logObservation = 'tail' in logRead
+            ? { available: true, readState: 'tail-read', lines: logRead.tail.length, normalizedTailBytes: Buffer.byteLength(logRead.tail.join('\n')) }
+            : { available: false, readState: logRead.unavailable === 'empty log output' ? 'empty' : 'read-failed', reason: logRead.unavailable, lines: 0, normalizedTailBytes: 0 };
+          const childLedgerResultMissing = noResultCandidate && Boolean(noResultDiagnostic?.includes('child terminal result missing'));
+          const observation = {
+            classification: disposition ? 'result-parsed' : 'insufficient-evidence',
+            noResultCandidate,
+            launchRunIdPresent: Boolean(liveChildRunId),
+            childLedger: noResultCandidate ? noResultLedgerObservation : null,
+            childLedgerResultPresent: noResultCandidate ? !childLedgerResultMissing : null,
+            resultParsed: Boolean(disposition),
+            resultLineObserved: Boolean(terminal),
+            pod: { jobReason: failedReason ?? null, containerReason: containerReason ?? null, exitCode: containerExitCode ?? null },
+            childLog: logObservation,
+            missing: [
+              ...(noResultCandidate && !noResultLedgerObservation.available ? ['child-ledger'] : []),
+              ...(childLedgerResultMissing ? ['child-ledger-result'] : []),
+              ...(!disposition ? ['child-result-line', 'child-result-classification'] : []),
+              ...(!logObservation.available ? ['child-log-cause-lines'] : []),
+            ],
+          };
           if ('tail' in logRead) {
             noResultLogEvidence = missingStage
-              ? { stderr: logRead.tail.join('\n'), logTail: logRead.tail, logTailLines: logRead.tail.length }
-              : { podLogTail: logRead.tail, podLogTailLines: logRead.tail.length };
+              ? { stderr: logRead.tail.join('\n'), logTail: logRead.tail, logTailLines: logRead.tail.length, observation }
+              : { podLogTail: logRead.tail, podLogTailLines: logRead.tail.length, observation };
             debug.log('self-implement.pod', missingStage ? 'no-result-log-tail' : 'failed-pod-log-tail', {
-              job: name, childRunId: liveChildRunId, diagnostic: noResultDiagnostic, lines: logRead.tail.length, logTail: logRead.tail,
+              job: name, childRunId: liveChildRunId, diagnostic: noResultDiagnostic, ...observation, lines: logRead.tail.length, logTail: logRead.tail,
             }, { compact: { stringMax: 500 } });
           } else {
             const unavailable = `log-unavailable: ${logRead.unavailable}`;
             noResultLogEvidence = missingStage
-              ? { stderr: unavailable }
-              : { podLogUnavailable: logRead.unavailable };
+              ? { stderr: unavailable, observation }
+              : { podLogUnavailable: logRead.unavailable, observation };
             debug.log('self-implement.pod', missingStage ? 'no-result-log-tail' : 'failed-pod-log-tail', {
-              job: name, childRunId: liveChildRunId, diagnostic: noResultDiagnostic,
+              job: name, childRunId: liveChildRunId, diagnostic: noResultDiagnostic, ...observation,
               logUnavailable: missingStage ? unavailable : logRead.unavailable,
             }, { level: 'warn' });
           }
@@ -3498,12 +3653,57 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         // exitCode stays null when the container's code was not read (never filled in as 0).
         const finishedRow = { job: name, run: launchRunId, ...(liveChildRunId !== launchRunId ? { childRun: liveChildRunId } : {}),
           attempt: oomRetried ? 2 : 1, phase: state, exitCode: containerExitCode,
-          reason: failedReason || containerReason || (state === 'complete' ? 'complete' : 'unknown') };
+          reason: failedReason || containerReason || (state === 'complete' ? 'complete' : 'unknown'),
+          // POD-TERMINAL-EVIDENCE-JOIN: keep classifier and termination cause on this Job/childRun/attempt row.
+          failureClassification: disposition?.failureClassification ?? null,
+          classificationBasis: disposition?.childEvidence?.classificationBasis ?? null,
+          // The child-run status is a different axis from the implementation's abandoned classification.
+          // Preserve it even when the child did not emit a parseable self-implement disposition.
+          podExitClass: state === 'failed' ? classifyPodExit({ containerReason: containerReason ?? null,
+            containerExitCode: containerExitCode ?? null, jobReason: failedReason || null, logs }).class : null,
+          childFailureStage: childFailure?.stage ?? null,
+          terminationReason: typeof disposition?.childEvidence?.terminationReason === 'string'
+            ? redactSecretText(disposition.childEvidence.terminationReason).slice(0, 200) : null };
         try { appendRunLedgerEntry({ runId: ledgerRunId, event: POD_LAUNCH_FINISHED_EVENT, timestamp: new Date((options.now ?? Date.now)()).toISOString(), data: finishedRow }, ledgerDir); }
         catch (error) { debug.log('pod.provenance', 'history-unavailable', { job: name, row: 'finished', reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
         debug.log('pod.provenance', 'job-finished', finishedRow);
-        debug.log('self-implement.pod', 'job-finished', { job: name, ...(member ? { context: member.context } : {}), state, containerReason, stage: disposition?.stage ?? null, prUrl: disposition?.prUrl ?? null, childRunId: liveChildRunId, ledgerCompleteness,
+        // Keep report-deficit incidents queryable as one bounded event. The child detail field is
+        // intentionally capped elsewhere, so cause evidence must not depend on that full payload.
+        const reportDeficit = disposition?.failureClassification === 'report-deficit';
+        const noResultIncident = state === 'failed' && failedReason !== 'DeadlineExceeded' && !disposition;
+        if (reportDeficit || noResultIncident) {
+          const evidence = disposition?.childEvidence;
+          const diagnosticLines = [
+            ...(Array.isArray(evidence?.podLogTail) ? evidence.podLogTail : []),
+            ...(typeof evidence?.detail === 'string' ? evidence.detail.split('\n') : []),
+            ...(typeof evidence?.detailTail === 'string' ? evidence.detailTail.split('\n') : []),
+            ...(typeof evidence?.stderr === 'string' ? evidence.stderr.split('\n') : []),
+            ...(Array.isArray(noResultLogEvidence?.logTail) ? noResultLogEvidence.logTail as string[] : []),
+            ...(Array.isArray(noResultLogEvidence?.podLogTail) ? noResultLogEvidence.podLogTail as string[] : []),
+            ...(typeof noResultLogEvidence?.stderr === 'string' ? noResultLogEvidence.stderr.split('\n') : []),
+          ].slice(-12).map((line) => redactSecretText(line).slice(0, 500));
+          debug.log('pod.child', reportDeficit ? 'report-deficit-cause' : 'terminal-cause', {
+            job: name, run: launchRunId, childRun: liveChildRunId, attempt: oomRetried ? 2 : 1,
+            // A missing parsed result is an incident trigger, not proof of the child's classifier.
+            classification: disposition?.failureClassification ?? null,
+            ...(noResultIncident ? { trigger: 'no-result' } : {}),
+            podExitClass: finishedRow.podExitClass,
+            classificationBasis: evidence?.classificationBasis ?? null,
+            phase: state, exitCode: containerExitCode,
+            reason: failedReason || containerReason || 'unknown',
+            terminationReason: evidence?.terminationReason ?? null,
+            providerErrors: disposition?.providerErrors ?? null,
+            oomKilled, podTermination: podTermination ?? null,
+            detailTail: evidence?.detailTail ?? null,
+            lastLines: diagnosticLines,
+          }, { level: 'warn', compact: { stringMax: 4_500 } });
+        }
+        debug.log('self-implement.pod', 'job-finished', { job: name, ...(member ? { context: member.context } : {}), state, containerReason, stage: disposition?.stage ?? null, prUrl: disposition?.prUrl ?? null, childRunId: liveChildRunId, attempt: oomRetried ? 2 : 1, ledgerCompleteness,
+          ...(noResultLogEvidence ? { stopEvidenceTail: podStopEvidenceTail(noResultLogEvidence) } : {}),
           ...(podTermination ? { podTermination } : {}),
+          failureClassification: finishedRow.failureClassification,
+          classificationBasis: finishedRow.classificationBasis,
+          terminationReason: finishedRow.terminationReason,
           ...(state === 'failed' && !oomKilled && failedReason !== 'DeadlineExceeded'
             ? { ...(childFailure ? { childStage: childFailure.stage } : disposition?.stage ? { childStage: disposition.stage } : {}),
               // POD-NORESULT: a parsed result row without error text is not a missing result line (UX 10-07 01:01: 28 of 28 exit-2 Jobs printed one).
@@ -3569,7 +3769,10 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
             if (!await acquireAdmission()) return admissionFailure();
             member = await acquireSlot();
             if (options.pool && !member) {
-              if (lastSlotAttempt) recordSlotObservation(lastSlotAttempt, 'rejected', lastSlotReasonCode ?? 'aborted');
+              if (lastSlotAttempt) recordSlotObservation(lastSlotAttempt, 'rejected', lastSlotReasonCode ?? 'aborted', {
+                waitReason: stageReason['pool-slot'] ?? null,
+                ...(typeof input.signal?.reason === 'string' ? { abortReason: input.signal.reason } : {}),
+              });
               return { exitCode: null, output: '', error: { code: 'aborted', message: 'aborted before a pool slot opened', ...(lastSlotReasonCode ? { reasonCode: lastSlotReasonCode } : {}) } };
             }
             if (member) context = member.context;
@@ -3595,13 +3798,21 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         }
         // The host still has the complete Pod log here. The CLI only retains a short stdout tail,
         // so preserve the parsed child facts in the parent ledger before that tail is returned.
-        if (state === 'failed' || state === 'aborted' || noResultLogEvidence || (state === 'complete' && noResultDiagnostic !== null)) {
+        const childEvidenceRow = podChildEvidenceLedgerRow({
+          job: name,
+          childRunId: liveChildRunId,
+          state,
+          result: disposition ?? null,
+          noResultDiagnostic,
+          noResultLogEvidence,
+          podTermination,
+        });
+        if (childEvidenceRow) {
           // Every terminal attempt writes a marker, including one with no parseable child facts.
           // The next attempt must never inherit an earlier Pod's classification.
-          const childEvidence = noResultLogEvidence
-            ? { ...(disposition?.childEvidence ?? {}), ...noResultLogEvidence }
-            : disposition?.childEvidence ?? null;
-          try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-child-evidence', data: { childEvidence, childRunId: liveChildRunId, job: name, ...(podTermination ? { podTermination } : {}) } }, ledgerDir); }
+          // Also persist completed Jobs whose child result is unsuccessful; Kubernetes
+          // Completed is container success, not proof the requested work converged.
+          try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-child-evidence', data: childEvidenceRow }, ledgerDir); }
           catch (error) { debug.log('self-implement.pod', 'child-evidence-write-failed', { job: name, childRunId: liveChildRunId, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
         }
         let prLookup: OpenPrByBranch | undefined;
@@ -3831,6 +4042,15 @@ function boundedPodLogText(source: string, maxChars: number): string {
   return redacted.length > maxChars ? `${redacted.slice(0, maxChars)}…[truncated]` : redacted;
 }
 
+/** A compact, redacted stop clue carried on the attempt-scoped finished row. */
+function podStopEvidenceTail(evidence: Record<string, unknown>): string[] {
+  const raw = Array.isArray(evidence.logTail) ? evidence.logTail
+    : Array.isArray(evidence.podLogTail) ? evidence.podLogTail
+    : typeof evidence.stderr === 'string' ? evidence.stderr.split(/\r\n|\n|\r/u) : [];
+  return raw.slice(-12).filter((line): line is string => typeof line === 'string' && line.length > 0)
+    .map((line) => redactSecretText(line).slice(0, 240));
+}
+
 /** 로그 꼬리 — 마지막 N줄만, 한 줄씩 비밀값 마스킹. */
 export function podNoResultLogTailLines(source: string, maxLines: number = POD_NO_RESULT_LOG_TAIL_LINES): string[] {
   const lines = source.replace(/\r\n/g, '\n').split('\n');