elanous 0.2.41 → 0.2.43

package/src/task-orchestrator/dispatcher.ts

@@ -32,6 +32,8 @@ import {
   type AcceptanceReport,
 } from './acceptance.js';
 import { recordOpsEventSafe, type OpsEventInput } from '../domains/ops-log.js';
+import { getHarnessRunId } from '../harness/harness-space.js';
+import { collectLinearCaptureArtifacts } from './linear-capture-events.js';
 import { defaultAnomalyCluster, extractContainerExit, type AnomalyCluster } from '../loops/orchestrator/anomaly-cluster.js';
 
 // ───────────────────────── Concurrency caps ────────────────────────
@@ -309,7 +311,18 @@ export class TaskDispatcher {
     const kind = task.surface.kind;
     let savedExecution = false;
     try {
-      const exec = { ...await res.promise, id: res.executionId };
+      const completedExecution = { ...await res.promise, id: res.executionId };
+      // The run identity is taken from this dispatcher process, never from child-reported execution output.
+      const runId = getHarnessRunId();
+      let captureArtifacts: TaskExecution['captureArtifacts'] = [];
+      if (runId) {
+        try {
+          captureArtifacts = collectLinearCaptureArtifacts({ runId, startedAt: completedExecution.startedAt,
+            endedAt: completedExecution.endedAt ?? this.now() });
+        } catch { /* Capture observation is optional; an unavailable log store must not block task completion. */ }
+      }
+      const exec: TaskExecution = { ...completedExecution, runId: runId || undefined,
+        captureArtifacts: captureArtifacts.length ? captureArtifacts : undefined };
       // Keep the task row and execution in the same store read by GET /v1/tasks/:id.
       this.opts.store?.saveTask(this.opts.graph.getTask(task.id)!);
       this.opts.store?.saveExecution(exec);

package/src/task-orchestrator/linear-capture-events.ts

@@ -0,0 +1,55 @@
+import { existsSync } from 'node:fs';
+import { LogStore, logsDbPath, type LogStoreRow } from '../mss/logging/log-store.js';
+import type { TaskCaptureArtifact } from './types.js';
+
+export interface LinearCaptureEventWindow { runId: string; startedAt: number; endedAt: number }
+export type LinearCaptureEventStore = Pick<LogStore, 'queryByDataKeys' | 'close'>;
+
+function parseCaptureEvent(row: LogStoreRow, expectedRunId: string): TaskCaptureArtifact | undefined {
+  if (row.event !== 'executed' || !row.data) return undefined;
+  let data: Record<string, unknown>;
+  try {
+    const parsed: unknown = JSON.parse(row.data);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return undefined;
+    data = parsed as Record<string, unknown>;
+  } catch { return undefined; }
+  if (data.action !== 'read' || data.mode !== 'screenshot' || data.ok !== true || data.captureOutcome !== 'saved') return undefined;
+  const capture = data.capture;
+  if (!capture || typeof capture !== 'object' || Array.isArray(capture)) return undefined;
+  const descriptor = capture as Record<string, unknown>;
+  if (typeof descriptor.path !== 'string' || !descriptor.path || typeof descriptor.mimeType !== 'string' ||
+      descriptor.runId !== expectedRunId || typeof descriptor.linearIssueId !== 'string' || !descriptor.linearIssueId ||
+      descriptor.externalShare !== true || typeof descriptor.sensitivity !== 'string' ||
+      typeof descriptor.createdAt !== 'number' || !Number.isFinite(descriptor.createdAt)) return undefined;
+  return {
+    path: descriptor.path,
+    mimeType: descriptor.mimeType,
+    runId: expectedRunId,
+    linearIssueId: descriptor.linearIssueId,
+    externalShare: true,
+    sensitivity: descriptor.sensitivity,
+    createdAt: descriptor.createdAt,
+  };
+}
+
+/** Read only approved browser screenshot events emitted during this exact TOX execution. */
+export function collectLinearCaptureArtifacts(window: LinearCaptureEventWindow, deps: {
+  dbPath?: string;
+  openStore?: (path: string) => LinearCaptureEventStore;
+} = {}): TaskCaptureArtifact[] {
+  const runId = window.runId.trim();
+  if (!runId || !Number.isFinite(window.startedAt) || !Number.isFinite(window.endedAt) || window.endedAt < window.startedAt) return [];
+  const path = deps.dbPath ?? logsDbPath();
+  if (!existsSync(path)) return [];
+  const store = (deps.openStore ?? LogStore.openReadOnly)(path);
+  try {
+    const rows = store.queryByDataKeys({ exactCategories: ['harness.browser-action'], runIds: [runId] });
+    const found = new Map<string, TaskCaptureArtifact>();
+    for (const row of rows) {
+      if (row.ts_ms < window.startedAt || row.ts_ms > window.endedAt) continue;
+      const capture = parseCaptureEvent(row, runId);
+      if (capture) found.set(capture.path, capture);
+    }
+    return [...found.values()].sort((a, b) => a.createdAt - b.createdAt || a.path.localeCompare(b.path));
+  } finally { store.close(); }
+}

package/src/task-orchestrator/store.ts

@@ -56,7 +56,8 @@ import type {
 // v3 (Mission Fabric 통합 U1 · 2026-07-09) — tox_missions.autopilot_json
 //    (PFC Layer2 자율 메타 흡수 · apm Mission 병렬 table 제거 준비)
 // v4 — external task identity and approval
-export const TOX_SCHEMA_VERSION = 4;
+// v5 — run-scoped browser capture artifacts on executions
+export const TOX_SCHEMA_VERSION = 5;
 
 // ─────────────────────── Row shapes ────────────────────────────────
 
@@ -114,6 +115,8 @@ interface ExecutionRow {
   model_id: string | null;
   host_id: string | null;
   hostname: string | null;
+  run_id: string | null;
+  capture_artifacts_json: string | null;
 }
 
 interface EventRow {
@@ -262,7 +265,9 @@ export class TaskStore {
         token_input INTEGER,
         token_output INTEGER,
         cost_usd REAL,
-        model_id TEXT
+        model_id TEXT,
+        run_id TEXT,
+        capture_artifacts_json TEXT
       );
 
       CREATE TABLE IF NOT EXISTS tox_events (
@@ -314,6 +319,8 @@ export class TaskStore {
     this.db.exec('CREATE INDEX IF NOT EXISTS idx_tox_missions_project ON tox_missions(project_id)');
     this.addColumnIfMissing('tox_executions', 'host_id', 'TEXT');
     this.addColumnIfMissing('tox_executions', 'hostname', 'TEXT');
+    this.addColumnIfMissing('tox_executions', 'run_id', 'TEXT');
+    this.addColumnIfMissing('tox_executions', 'capture_artifacts_json', 'TEXT');
     this.db.exec('CREATE INDEX IF NOT EXISTS idx_tox_executions_host ON tox_executions(host_id, started_at)');
     this.addColumnIfMissing('tox_tasks', 'approval_json', 'TEXT');
     this.addColumnIfMissing('tox_tasks', 'external_provider', 'TEXT');
@@ -477,8 +484,8 @@ export class TaskStore {
         `INSERT OR REPLACE INTO tox_executions (
           id, task_id, started_at, ended_at, duration_ms, status, surface_json,
           surface_address, output, output_path, error_json, token_input,
-          token_output, cost_usd, model_id, host_id, hostname
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+          token_output, cost_usd, model_id, host_id, hostname, run_id, capture_artifacts_json
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
       )
       .run(
         exec.id,
@@ -497,7 +504,9 @@ export class TaskStore {
         exec.costUsd ?? null,
         exec.modelId ?? null,
         hostId ?? null,
-        hostname ?? null
+        hostname ?? null,
+        exec.runId ?? null,
+        exec.captureArtifacts ? JSON.stringify(exec.captureArtifacts) : null
       ));
   }
 
@@ -769,6 +778,8 @@ export class TaskStore {
       modelId: row.model_id ?? undefined,
       ...(row.host_id !== null ? { hostId: row.host_id } : {}),
       ...(row.hostname !== null ? { hostname: row.hostname } : {}),
+      ...(row.run_id !== null ? { runId: row.run_id } : {}),
+      ...(row.capture_artifacts_json ? { captureArtifacts: JSON.parse(row.capture_artifacts_json) as TaskExecution['captureArtifacts'] } : {}),
     };
   }
 }

package/src/task-orchestrator/surfaces/pod-artifact-return.ts

@@ -102,6 +102,10 @@ export function podNoResultDiagnostic(ledger: string): string | null {
     try {
       const entry = JSON.parse(line) as { event?: unknown; data?: Record<string, unknown> };
       if (!entry || typeof entry !== 'object' || !entry.data || typeof entry.data !== 'object' || typeof entry.event !== 'string' || entry.event === 'pod-ledger-incomplete') continue;
+      // Route evidence is not a child execution stage. The observer writes the category
+      // (`graph.path`) only to the log store; the run ledger keeps the event name
+      // (`path-signature`), which may be appended after the child failure.
+      if (entry.event === 'graph.path' || entry.event === 'path-signature') continue;
       if (typeof entry.data.round === 'number' && Number.isSafeInteger(entry.data.round)) round = entry.data.round;
       if (entry.event !== 'run-origin') stage = entry.event;
       // `reviewed` carries pointers only (count + finding ids); the text stays in the review artifact.

package/src/task-orchestrator/surfaces/pod-distributor.ts

@@ -0,0 +1,48 @@
+import type { PodPoolMember, PodPoolScheduler } from './pod-pool.js';
+export { POD_DISTRIBUTOR_ENTRY_ENV, TASK_HAND_POD_DISTRIBUTOR_ENTRY } from '../../task-agent/pod-distributor-entry.js';
+import { TASK_HAND_POD_DISTRIBUTOR_ENTRY } from '../../task-agent/pod-distributor-entry.js';
+
+/** Origin marker carried only by `tasks hand` Pod launches. */
+export type PodPoolAcquireMode = NonNullable<Parameters<PodPoolScheduler['tryAcquire']>[2]>;
+
+/** Admission context that the later resource-core adapter can map to its request contract. */
+export interface PodDistributorAdmission {
+  requestId: string;
+  idempotencyKey: string;
+  owner: { runId: string; cardId?: string; seat?: string };
+  lane: 'ta';
+  workload: { memoryLimit: string; kind: string };
+  skip?: ReadonlySet<string>;
+  onEmpty?: (reason: string) => void;
+  mode?: PodPoolAcquireMode;
+}
+
+/**
+ * Small seam between a Pod launch surface and its admission backend.
+ * The current adapter delegates to PodPoolScheduler, which owns the existing HostPoolLease accounting.
+ * CORE can replace this adapter with resource admission without changing the tasks-hand call site.
+ */
+export interface PodDistributorAdapter {
+  acquire(request: PodDistributorAdmission): Promise<PodPoolMember | null>;
+}
+
+export function createPodPoolDistributorAdapter(pool: PodPoolScheduler): PodDistributorAdapter {
+  // The legacy pool has no consumer for identity/workload fields; preserve them at this seam for CORE.
+  return {
+    acquire: ({ skip, onEmpty, mode }) => pool.tryAcquire(skip, onEmpty, mode),
+  };
+}
+
+/** Only the tasks-hand entry uses the adapter in this first wire slice; other launchers keep the established path. */
+export function acquirePodPoolSlot(input: {
+  entry: string | undefined;
+  pool: PodPoolScheduler;
+  adapter?: PodDistributorAdapter;
+  request: PodDistributorAdmission;
+}): Promise<PodPoolMember | null> {
+  const { entry, pool, adapter, request } = input;
+  if (entry === TASK_HAND_POD_DISTRIBUTOR_ENTRY) {
+    return (adapter ?? createPodPoolDistributorAdapter(pool)).acquire(request);
+  }
+  return pool.tryAcquire(request.skip, request.onEmpty, request.mode);
+}

package/src/task-orchestrator/surfaces/pod-failure-reason.ts

@@ -1,3 +1,5 @@
+import { podChildProviderOf, type PodChildProvider } from './pod-child-providers.js';
+
 /** STOP-RECORD stop_class values used by the card terminal classifier. */
 export const STOP_CLASS_POD_FAILURE = 'pod-failure' as const;
 export const STOP_CLASS_NO_LAUNCH = 'no-launch' as const;
@@ -20,12 +22,19 @@ export function nestedPodResult(row: Record<string, unknown>): {
   const result = row.result as Record<string, unknown>;
   if (typeof result.stage !== 'string' || typeof result.ok !== 'boolean') return null;
   if (result.ok) return { stage: result.stage, ok: true };
+  // The terminal stage/node/outcome often says only `aborted` or `abandoned`.
+  // Keep the child's explicit stop detail (for example a same-cell PR guard
+  // failure) while retaining the established node/outcome/classification text.
+  // Forward only the typed guard failure this path owns. Other aborted children
+  // can carry verbose PTY summaries in `detail`; those are not parent attribution.
+  const explicitDetail = result.detailKind === 'blocked-draft-pr-guard' ? ledgerString(result.detail) : '';
   const classification = result.abandonedClassification;
   const detail = typeof result.supervisorVerdict === 'string' ? result.supervisorVerdict
     : classification && typeof classification === 'object' && !Array.isArray(classification)
       ? (classification as Record<string, unknown>).classification : undefined;
   const reason = [result.node, result.outcome].filter((part): part is string => typeof part === 'string' && part.length > 0).join(' ');
-  const error = [reason || (typeof result.error === 'string' ? result.error : ''), typeof detail === 'string' && detail ? detail : ''].filter(Boolean).join(' · ');
+  const error = [reason || (typeof result.error === 'string' ? result.error : ''), typeof detail === 'string' && detail ? detail : '', explicitDetail]
+    .filter(Boolean).join(' · ');
   // PREFLIGHT-RESULT-LINE: a nested preflight rejection carries its blockers under result.blockers — the same ledger fields as the flat row.
   const blockers = result.stage === 'preflight-blocked' ? preflightBlockerText(result.blockers)
     : { error: '', preflightChecks: [] as PreflightCheck[] };
@@ -121,6 +130,15 @@ export function podTerminalRow(row: Record<string, unknown>): {
   return nestedPodResult(row);
 }
 
+/**
+ * OBS-GAP-BATCH-1030 — 자식 LLM 실패의 «누가·어떤 HTTP status 로» 죽었나를 부모 원장에 얹는 두 스칼라.
+ * ⛔ 응답 본문·메시지·자격증명은 담지 않는다 — provider 는 정규 id, status 는 4xx/5xx 숫자뿐이다.
+ */
+export interface PodProviderFailureFact {
+  readonly provider?: PodChildProvider;
+  readonly httpStatusCode?: number;
+}
+
 export const POD_EXIT_CLASSES = ['oom-killed', 'deadline-exceeded', 'gh-login-failed', 'pod-secret', 'ask-reprompt', 'provider-error', 'child-unconverged', 'child-error', 'no-result-line', 'unknown'] as const;
 
 export type PodExitClass = typeof POD_EXIT_CLASSES[number];
@@ -143,6 +161,8 @@ export function podChildEvidenceLedgerRow(input: {
   noResultDiagnostic?: string | null;
   noResultLogEvidence?: Record<string, unknown> | null;
   podTermination?: PodTermination | null;
+  /** OBS-GAP-BATCH-1030 — 실패 행에만 붙는 두 스칼라(provider · HTTP status). 없으면 종전 행 그대로. */
+  providerFailure?: PodProviderFailureFact | null;
 }): Record<string, unknown> | null {
   const { result } = input;
   const persist = input.state === 'failed' || input.state === 'aborted' || input.noResultLogEvidence != null
@@ -163,6 +183,8 @@ export function podChildEvidenceLedgerRow(input: {
     childEvidence,
     childRunId: input.childRunId,
     job: input.job,
+    ...(input.providerFailure?.provider ? { provider: input.providerFailure.provider } : {}),
+    ...(input.providerFailure?.httpStatusCode !== undefined ? { httpStatusCode: input.providerFailure.httpStatusCode } : {}),
     ...(input.podTermination ? { podTermination: input.podTermination } : {}),
     ...(childResult && Object.keys(childResult).length > 0 ? { childResult } : {}),
   };
@@ -195,6 +217,75 @@ function isPodProviderErrorLine(line: string): boolean {
   return POD_PROVIDER_ERROR_LINE.test(line);
 }
 
+/** 401·429·503 같은 «상태 숫자»만 — 응답 본문·메시지는 돌려주지 않는다. 4xx/5xx 밖의 수는 상태가 아니다. */
+function podProviderHttpStatus(line: string): number | undefined {
+  const explicit = /"status"\s*:\s*(\d{3})/u.exec(line) ?? /\b(?:LLM API|HTTP|status(?:[ _-]?code)?)\b\s*[:=]?\s*(\d{3})\b/iu.exec(line);
+  // 맨숫자 형태는 «상태 자리»에 선 것만 — `500ms`·`1.5e3` 같은 수를 상태로 세지 않는다.
+  const digits = (explicit ?? /(?:^|[^\d])([45]\d{2})(?![\d\p{L}.])/u.exec(line))?.[1];
+  const value = digits === undefined ? NaN : Number(digits);
+  return Number.isSafeInteger(value) && value >= 400 && value <= 599 ? value : undefined;
+}
+
+/** 줄이 이름한 provider — `llm.<id>` 접두 우선, 없으면 줄 안의 정식 이름/별칭. 목록 밖 이름은 세지 않는다. */
+function podLineProvider(line: string): PodChildProvider | undefined {
+  const scoped = /\bllm\.([a-z0-9_-]+)\b/iu.exec(line)?.[1];
+  const scopedProvider = podChildProviderOf(scoped);
+  if (scopedProvider) return scopedProvider;
+  for (const token of line.match(/[A-Za-z][A-Za-z0-9_-]{1,31}/gu) ?? []) {
+    const provider = podChildProviderOf(token);
+    if (provider) return provider;
+  }
+  return undefined;
+}
+
+/** provider 실패를 «말하는» 줄 — 분류기가 provider-error 로 읽는 줄, 또는 자식이 낸 `LLM API <status>` 문면. */
+const isPodProviderFailureSource = (line: string): boolean => isPodProviderErrorLine(line) || /\bLLM API\s+\d{3}\b/iu.test(line);
+
+/**
+ * 마지막 canonical 자식 terminal 과 «그 직전» 구간 — duplicate-cap 귀속의 한 자리(classifyPodExit 과 같은 규칙).
+ * terminal 이 없으면 구간은 전체 로그다(결과행 없는 자식도 provider 실패는 귀속된다).
+ */
+function podTerminalWindow(logs: string): { terminal: ReturnType<typeof podTerminalRow>; window: string[] } {
+  const lines = logs.split(/\r\n|\n|\r/u);
+  let terminal: ReturnType<typeof podTerminalRow> = null;
+  let lastIndex = -1;
+  let previousIndex = -1;
+  for (const [index, raw] of lines.entries()) {
+    const line = raw.trim();
+    if (!line.startsWith('{')) continue;
+    let parsed: unknown;
+    try { parsed = JSON.parse(line); } catch { continue; }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) continue;
+    const row = podTerminalRow(parsed as Record<string, unknown>);
+    if (!row) continue;
+    previousIndex = lastIndex;
+    terminal = row;
+    lastIndex = index;
+  }
+  const window = lines.slice(previousIndex + 1, lastIndex === -1 ? undefined : lastIndex)
+    .map((line) => line.trim()).filter(Boolean);
+  return { terminal, window };
+}
+
+/**
+ * OBS-GAP-BATCH-1030 — 자식 실패를 «공급자 + HTTP status» 로 귀속한다(응답 본문·자격증명 제외).
+ * 마지막 canonical terminal 이 성공이면 null — 과거(재시도 전) provider 실패를 성공한 결과에 재사용하지 않는다.
+ * 줄이 공급자를 이름하지 않으면 호출자가 준 hint(Pod 의 자식 provider)를 정규 id 로만 쓴다.
+ */
+export function podChildProviderFailureFact(logs: string, opts?: { providerHint?: string }): PodProviderFailureFact | null {
+  const { terminal, window } = podTerminalWindow(logs);
+  if (terminal?.ok === true) return null;
+  const terminalErrors = typeof terminal?.error === 'string'
+    ? terminal.error.split(/\r\n|\n|\r/u).map((line) => line.trim()).filter(Boolean) : [];
+  const sources = [...window, ...terminalErrors].filter((line) => isPodProviderFailureSource(line)).reverse();
+  if (!sources.length) return null;
+  // 마지막 줄이 `LLM API <status>` 만 말할 수 있다 — 공급자는 «이름한» 줄에서 따로 찾는다.
+  const provider = sources.map(podLineProvider).find((named) => named !== undefined) ?? podChildProviderOf(opts?.providerHint);
+  const httpStatusCode = sources.map(podProviderHttpStatus).find((status) => status !== undefined);
+  if (!provider && httpStatusCode === undefined) return null;
+  return { ...(provider ? { provider } : {}), ...(httpStatusCode !== undefined ? { httpStatusCode } : {}) };
+}
+
 /**
  * POD-FAIL-EVIDENCE-CAPTURE-FU — duplicate-cap 귀속: 마지막 «canonical» 자식 terminal 하나에만 실패를 붙인다.
  * canonical 접두(`self`/`external`)가 아닌 lookalike kind 행은 건너뛰고, 마지막 canonical terminal 이 성공이거나

package/src/task-orchestrator/surfaces/pod-ledger-collect.ts

@@ -184,6 +184,37 @@ export function createPodLedgerFollower(opts: {
   if (!Number.isFinite(stallMinutes) || stallMinutes <= 0) throw new RangeError('stallMinutes must be positive');
   const onStall = opts.onStall ?? ((message: string) => console.error(message));
   const path = runLedgerPath(opts.runId, dir);   // runId 검증(경로·셸에 안전한 문자만)도 여기서 된다
+  function activityTimestamp(epoch: number): string {
+    const iso = new Date(Math.floor(epoch / 1_000) * 1_000).toISOString();
+    return `${iso.slice(0, 4)}${iso.slice(5, 7)}${iso.slice(8, 10)}${iso.slice(11, 13)}${iso.slice(14, 16)}.${iso.slice(17, 19)}`;
+  }
+  function activityCommand(since: string, until: string, offset: number, sinceTimestamp: string, untilTimestamp: string): string {
+    return [
+      `s="\${ELANOUS_STATE_DIR:-$HOME/.elanous}"`,
+      `f="$s/run-ledger/${opts.runId}.jsonl"`,
+      'w="$s/worktrees"',
+      'if [ -f "$f" ]; then tail -c +' + (offset + 1) + ' "$f" || exit 1; fi',
+      "target=''; matches=0",
+      'for tree in "$w"/*/*.worktrees/*; do',
+      '  [ -e "$tree/.git" ] || continue',
+      '  owner=$(git -C "$tree" config --worktree --get elanous.harness.owner 2>/dev/null) || continue',
+      `  [ "$owner" = 'dev:${opts.runId}' ] || continue`,
+      '  target="$tree"; matches=$((matches + 1))',
+      'done',
+      'if [ "$matches" -eq 1 ]; then',
+      '  touch_activity_ref() { stamp_value=$1; fallback=$2; ref=$3; touch -d "@$stamp_value" "$ref" 2>/dev/null && return 0; TZ=UTC touch -t "$fallback" "$ref"; }',
+      `  activity_since="$s/.pod-activity-${opts.runId}-$$-since"`,
+      `  activity_until="$s/.pod-activity-${opts.runId}-$$-until"`,
+      "  activity=''",
+      `  if : > "$activity_since" && : > "$activity_until" && touch_activity_ref '${since}' '${sinceTimestamp}' "$activity_since" && touch_activity_ref '${until}' '${untilTimestamp}' "$activity_until"; then`,
+      '    activity=$(find "$target" -type d \\( -name .git -o -name node_modules \\) -prune -o -type f -newer "$activity_since" ! -newer "$activity_until" -exec printf . \\; 2>/dev/null)',
+      '    activity_status=$?',
+      '  else activity_status=1; fi',
+      '  rm -f "$activity_since" "$activity_until"',
+      '  if [ "$activity_status" -eq 0 ]; then printf \'\\nELANOUS_ACTIVITY %s\\n\' "\${#activity}"; else printf \'\\nELANOUS_ACTIVITY_ERROR\\n\'; fi',
+      "else printf '\\nELANOUS_ACTIVITY_ERROR\\n'; fi",
+    ].join('\n');
+  }
   let offset = 0;
   let pending = '';
   let owned = false;
@@ -218,7 +249,13 @@ export function createPodLedgerFollower(opts: {
       const since = `${Math.floor(lastActivityMeasuredAt / 1000)}.${String(lastActivityMeasuredAt % 1000).padStart(3, '0')}`;
       const measurementStartedAt = now();
       const until = `${Math.floor(measurementStartedAt / 1000)}.${String(measurementStartedAt % 1000).padStart(3, '0')}`;
-      const r = opts.exec(`s="\${ELANOUS_STATE_DIR:-$HOME/.elanous}"; f="$s/run-ledger/${opts.runId}.jsonl"; w="$s/worktrees"; if [ -f "$f" ]; then tail -c +${offset + 1} "$f" || exit 1; fi; target=''; matches=0; for tree in "$w"/*/*.worktrees/*; do [ -e "$tree/.git" ] || continue; owner=$(git -C "$tree" config --worktree --get elanous.harness.owner 2>/dev/null) || continue; [ "$owner" = 'dev:${opts.runId}' ] || continue; target="$tree"; matches=$((matches + 1)); done; if [ "$matches" -eq 1 ]; then activity=$(find "$target" -type d \\( -name .git -o -name node_modules \\) -prune -o -type f -newermt '@${since}' ! -newermt '@${until}' -printf . 2>/dev/null) && printf '\\nELANOUS_ACTIVITY %s\\n' "\${#activity}" || printf '\\nELANOUS_ACTIVITY_ERROR\\n'; else printf '\\nELANOUS_ACTIVITY_ERROR\\n'; fi`);
+      const r = opts.exec(activityCommand(
+        since,
+        until,
+        offset,
+        activityTimestamp(lastActivityMeasuredAt),
+        activityTimestamp(measurementStartedAt),
+      ));
       if (r.status !== 0) { log('self-implement.pod', 'ledger-live-unavailable', { runId: opts.runId, status: r.status, stderr: r.stderr.trim().slice(0, 200) }); checkStall(false, false); return { ledgerRead: false, activityMeasured: false }; }
       const marker = r.stdout.lastIndexOf('\nELANOUS_ACTIVITY');
       const activityLine = marker < 0 ? '' : r.stdout.slice(marker + 1);

package/src/task-orchestrator/surfaces/pod-ledger-events.ts

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { podTerminalRow } from './pod-failure-reason.js';
 
 /** Capture a failed Job against its recorded placement, never the caller's current kubectl context. */
 export function captureFailedPodJobs(input: {
@@ -39,10 +40,14 @@ export function captureFailedPodJobs(input: {
     finish('failed', 'placement-conflict'); return;
   }
   const location = { host: first.host, context: first.context, namespace: first.namespace, childRunId: first.childRunId, jobUid: first.jobUid };
+  const childRows = rows.filter(row => row.event === 'pod-child-run' && row.data?.job === job
+    && row.data.childRunId === first.childRunId && Number.isSafeInteger(row.data.attempt)
+    && (row.data.attempt as number) > 0);
+  const attempt = childRows.length ? childRows[childRows.length - 1]!.data!.attempt as number : undefined;
   const evidenceDir = join(artifactDir, 'pod-failure-capture', runId, job, first.childRunId as string);
   // A failed kubectl/SSH read is itself the missing diagnostic. Keep its stderr in
   // the private artifact directory and put only the path and exit status in the ledger.
-  const readFailure = (reason: string, result: { status: number | null; stderr: string }, extra: Record<string, unknown> = {}): void => {
+  const captureStderr = (reason: string, result: { status: number | null; stderr: string }): Record<string, unknown> => {
     let stderrEvidence: string | null = null;
     let stderrCaptureStatus: 'saved' | 'redacted' | 'empty' | 'write-failed' = result.stderr ? 'saved' : 'empty';
     if (result.stderr) {
@@ -61,19 +66,40 @@ export function captureFailedPodJobs(input: {
         }
       } catch { stderrEvidence = null; stderrCaptureStatus = 'write-failed'; }
     }
-    finish('failed', reason, { ...location, ...extra, kubectlStatus: result.status, stderrEvidence, stderrCaptureStatus });
+    return { kubectlStatus: result.status, stderrEvidence, stderrCaptureStatus };
+  };
+  const readFailure = (reason: string, result: { status: number | null; stderr: string }, extra: Record<string, unknown> = {}): void => {
+    finish('failed', reason, { ...location, ...extra, ...captureStderr(reason, result) });
   };
   const previous = rows.find(row => row.event === 'pod-failure-capture' && row.data?.job === job && row.data?.outcome === 'collected'
     && row.data.childRunId === first.childRunId && row.data.jobUid === first.jobUid
     && row.data.host === first.host && row.data.context === first.context && row.data.namespace === first.namespace);
+  const priorLogEvidence = previous?.data?.logEvidence;
+  const priorPreviousLogEvidence = previous?.data?.previousLogEvidence;
+  const priorCurrentReadStatus = previous?.data?.currentLogReadStatus;
+  const priorPreviousReadStatus = previous?.data?.previousLogReadStatus;
   // A ledger row describes a prior collection; it does not guarantee that its files survived.
-  // Check all three expected paths before treating it as complete, then recapture any missing evidence.
-  if (previous && ([['jobEvidence', 'job.json'], ['podEvidence', 'pods.json'], ['logEvidence', 'child.log']] as const)
+  // Validate the required artifacts and every log artifact claimed by the prior row before deduping.
+  // Unknown restart count is terminal for this Job snapshot: another identical Pod read cannot recover it.
+  const previousReadComplete = priorCurrentReadStatus === 'captured'
+    ? ['captured', 'empty', 'not-needed', 'unknown'].includes(String(priorPreviousReadStatus))
+    : priorCurrentReadStatus === 'empty' && priorPreviousReadStatus === 'captured';
+  const currentLogEvidencePresent = priorCurrentReadStatus === 'captured'
+    && priorLogEvidence === join(evidenceDir, 'child.log')
+    && (() => { try { return statSync(priorLogEvidence).isFile(); } catch { return false; } })();
+  const previousLogEvidencePresent = priorPreviousReadStatus === 'captured'
+    && priorPreviousLogEvidence === join(evidenceDir, 'child.previous.log')
+    && (() => { try { return statSync(priorPreviousLogEvidence).isFile(); } catch { return false; } })();
+  const logEvidenceComplete = currentLogEvidencePresent
+    ? priorPreviousReadStatus !== 'captured' || previousLogEvidencePresent
+    : priorCurrentReadStatus === 'empty' && previousLogEvidencePresent;
+  if (previous && previousReadComplete && ([['jobEvidence', 'job.json'], ['podEvidence', 'pods.json']] as const)
     .every(([field, filename]) => {
       const path = join(evidenceDir, filename);
       if (previous.data?.[field] !== path) return false;
       try { return statSync(path).isFile(); } catch { return false; }
-    })) return;
+    })
+    && logEvidenceComplete) return;
   const args = ['--context', first.context as string, '-n', first.namespace as string] as const;
   try {
     const jobResult = kubectl(first.host as string, [...args, 'get', 'job', job, '-o', 'json']);
@@ -103,23 +129,88 @@ export function captureFailedPodJobs(input: {
     });
     const podResult = kubectl(first.host as string, [...args, 'get', 'pods', '-l', `job-name=${job}`, '-o', 'json']);
     if (podResult.status !== 0) { readFailure('pods-read-failed', podResult, { jobEvidence }); return; }
-    const pods = JSON.parse(podResult.stdout) as { items?: Array<{ metadata?: { name?: string; ownerReferences?: Array<{ uid?: string }> } }> };
+    const pods = JSON.parse(podResult.stdout) as { items?: Array<{
+      metadata?: { name?: string; uid?: string; ownerReferences?: Array<{ uid?: string }> };
+      status?: { phase?: string; containerStatuses?: Array<{ name?: string; restartCount?: number;
+        state?: { terminated?: { reason?: string; exitCode?: number; finishedAt?: string } } }> };
+    }> };
     if (!pods.items?.length || pods.items.some(p => !p.metadata?.ownerReferences?.some(owner => owner.uid === jobBody.metadata?.uid))) {
       finish('failed', 'pod-owner-mismatch', { ...location, jobEvidence }); return;
     }
     const podEvidence = save('pods.json', podResult.stdout);
-    const podName = pods.items[0]?.metadata?.name;
+    const pod = pods.items[0]!;
+    const podName = pod.metadata?.name;
     if (pods.items.length !== 1 || !podName || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(podName)) {
       finish('failed', 'pod-ambiguous', { ...location, jobEvidence, podEvidence }); return;
     }
+    const childStatus = pod.status?.containerStatuses?.find(status => status.name === 'child');
+    const terminated = childStatus?.state?.terminated;
+    const shortCode = (value: unknown): string | undefined => typeof value === 'string' && /^[A-Za-z0-9_.:-]{1,64}$/.test(value) && !SECRET_VALUE.test(value) ? value : undefined;
+    const numeric = (value: unknown): number | undefined => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
+    const exitCode = (value: unknown): number | undefined => typeof value === 'number' && Number.isSafeInteger(value) ? value : undefined;
+    const restartCount = numeric(childStatus?.restartCount);
+    const podSummary: Record<string, unknown> = {
+      ...location,
+      ...(attempt !== undefined ? { attempt } : {}), podName,
+      ...(shortCode(pod.metadata?.uid) ? { podUid: shortCode(pod.metadata?.uid) } : {}),
+      ...(shortCode(pod.status?.phase) ? { podPhase: shortCode(pod.status?.phase) } : {}),
+      ...(shortCode(terminated?.reason) ? { containerReason: shortCode(terminated?.reason) } : {}),
+      ...(exitCode(terminated?.exitCode) !== undefined ? { containerExitCode: exitCode(terminated?.exitCode) } : {}),
+      ...(typeof terminated?.finishedAt === 'string' && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?Z$/.test(terminated.finishedAt) ? { containerFinishedAt: terminated.finishedAt } : {}),
+      ...(restartCount !== undefined ? { containerRestartCount: restartCount } : {}),
+    };
     const logs = kubectl(first.host as string, [...args, 'logs', `pod/${podName}`, '-c', 'child']);
-    if (logs.status !== 0) { readFailure('logs-read-failed', logs, { jobEvidence, podEvidence }); return; }
-    if (!logs.stdout.trim()) { finish('failed', 'logs-empty', { ...location, jobEvidence, podEvidence }); return; }
-    const logEvidence = save('child.log', logs.stdout);
-    finish('collected', 'job-failed', { ...location, jobEvidence, podEvidence, logEvidence });
+    const currentLogReadStatus = logs.status === 0 ? (logs.stdout.trim() ? 'captured' : 'empty') : 'failed';
+    const currentLogBytes = logs.status === 0 ? Buffer.byteLength(logs.stdout) : 0;
+    let logEvidence: string | undefined;
+    let previousLogEvidence: string | undefined;
+    let previousLogReadStatus = restartCount === undefined || restartCount > 0 ? 'unknown' : 'not-needed';
+    let previousLogBytes: number | undefined;
+    let previousLogFailure: Record<string, unknown> = {};
+    let resultMarkerPresent = false;
+    if (logs.status === 0 && logs.stdout.trim()) {
+      logEvidence = save('child.log', logs.stdout);
+      resultMarkerPresent = hasTerminalMarker(logs.stdout);
+    }
+    if (restartCount !== undefined && restartCount > 0) {
+      const previousLogs = kubectl(first.host as string, [...args, 'logs', `pod/${podName}`, '-c', 'child', '--previous']);
+      previousLogReadStatus = previousLogs.status === 0 ? (previousLogs.stdout.trim() ? 'captured' : 'empty') : 'failed';
+      previousLogBytes = previousLogs.status === 0 ? Buffer.byteLength(previousLogs.stdout) : 0;
+      if (previousLogs.status !== 0) {
+        const failure = captureStderr('previous-logs-read-failed', previousLogs);
+        previousLogFailure = {
+          previousLogKubectlStatus: failure.kubectlStatus,
+          previousLogStderrEvidence: failure.stderrEvidence,
+          previousLogStderrCaptureStatus: failure.stderrCaptureStatus,
+        };
+      }
+      if (previousLogs.status === 0 && previousLogs.stdout.trim()) {
+        previousLogEvidence = save('child.previous.log', previousLogs.stdout);
+        resultMarkerPresent ||= hasTerminalMarker(previousLogs.stdout);
+      }
+    }
+    const summary = { ...podSummary, jobEvidence, podEvidence, currentLogReadStatus, currentLogBytes,
+      previousLogReadStatus, ...(previousLogBytes !== undefined ? { previousLogBytes } : {}), ...previousLogFailure, resultMarkerPresent,
+      ...(logEvidence ? { logEvidence } : {}), ...(previousLogEvidence ? { previousLogEvidence } : {}) };
+    if (currentLogReadStatus !== 'captured' && previousLogReadStatus !== 'captured') {
+      if (logs.status !== 0) { readFailure('logs-read-failed', logs, summary); return; }
+      finish('failed', 'logs-empty', summary); return;
+    }
+    if (logs.status !== 0) finish('collected', 'job-failed', { ...summary, ...captureStderr('logs-read-failed', logs) });
+    else finish('collected', 'job-failed', summary);
   } catch { finish('failed', 'capture-error', location); }
 }
 
+function hasTerminalMarker(logs: string): boolean {
+  for (const line of logs.split(/\r?\n/)) {
+    try {
+      const row: unknown = JSON.parse(line);
+      if (row && typeof row === 'object' && !Array.isArray(row) && podTerminalRow(row as Record<string, unknown>)) return true;
+    } catch { /* ordinary child output is not a terminal result marker */ }
+  }
+  return false;
+}
+
 const SECRET_FIELD = /token|secret|password|authorization|key/i;
 const SAFE_FIELD = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
 const SECRET_VALUE = /(?:\b(?:bearer|basic)\s+\S+|\b(?:token|secret|password|authorization|api[-_]?key|access[-_]?key|private[-_]?key)\b\s*(?:is|[=:])\s*["']?\S+|\b(?:sk-[A-Za-z0-9_-]{8,}|gh[pousr]_[A-Za-z0-9_]{8,}))\b/i;
@@ -127,8 +218,12 @@ const MAX_FIELDS = 32;
 // Review R2: only lifecycle events the host needs to see, and no free text. Event names must start with a known
 // lifecycle prefix; string fields survive only when they are short code-like values in a fixed set of keys.
 const EVENT_ALLOWED = /^(?:gate|gated|review|reviewed|repair|repaired|rework|merge|merged|pr|land|landed|stage|round|supervisor|child|plan|planned|decompose|decomposed|shard|stall|harvest|decision|run|pipeline|progress|human|start|started|finish|finished|done|implement|implemented|commit|test|typecheck)(?:-(?:started|finished|round|opened|closed|failed|passed|blocked|done|entry|node|outcome|delivery|decision|stop|merged|ready|requested|resolved|result|fix|must-fix|verdict|skipped|origin|cleared))*$/;
-const CODE_FIELDS = new Set(['stage', 'outcome', 'verdict', 'status', 'kind', 'phase', 'role', 'result']);
+const CODE_FIELDS = new Set(['stage', 'outcome', 'verdict', 'status', 'kind', 'phase', 'role', 'result', 'containerReason',
+  'podPhase', 'currentLogReadStatus', 'previousLogReadStatus', 'previousLogStderrCaptureStatus', 'stderrCaptureStatus']);
 const CODE_VALUE = /^[a-z0-9_.:-]{1,40}$/i;
+const IDENTITY_FIELDS = new Set(['job', 'jobUid', 'childRunId', 'host', 'context', 'namespace', 'podName', 'podUid']);
+const SAFE_ID_VALUE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const SAFE_ISO_TIMESTAMP = /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?Z$/;
 
 function secretValues(root: Record<string, unknown>): string[] {
   const secrets: string[] = [];
@@ -163,7 +258,8 @@ export function ledgerLineToLogEvent(line: string, runId: string): {
   const sources = [entry, details].filter((source): source is Record<string, unknown> => source !== undefined);
   const knownSecrets = secretValues(entry);
   const containsCredential = (value: string) => SECRET_VALUE.test(value) || knownSecrets.some((secret) => value.includes(secret));
-  if (containsCredential(entry.event) || (!EVENT_ALLOWED.test(entry.event) && entry.event !== 'ask-auto-target-candidates' && entry.event !== 'ask-auto-reauthor')) return undefined;
+  if (containsCredential(entry.event) || (!EVENT_ALLOWED.test(entry.event) && entry.event !== 'pod-failure-capture'
+    && entry.event !== 'ask-auto-target-candidates' && entry.event !== 'ask-auto-reauthor')) return undefined;
 
   const data: Record<string, unknown> = { runId };
   let fields = 0;
@@ -176,7 +272,10 @@ export function ledgerLineToLogEvent(line: string, runId: string): {
       if (!SAFE_FIELD.test(outputName) || SECRET_FIELD.test(outputName) || Object.hasOwn(data, outputName)) continue;
       if (typeof value === 'string') {
         // Free text (reasons, messages, patches) never leaves the pod ledger; only short code values in known keys.
-        if (!CODE_FIELDS.has(name) || !CODE_VALUE.test(value) || containsCredential(value)) continue;
+        const acceptedCode = CODE_FIELDS.has(name) && CODE_VALUE.test(value);
+        const acceptedIdentity = IDENTITY_FIELDS.has(name) && SAFE_ID_VALUE.test(value);
+        const acceptedTimestamp = name === 'containerFinishedAt' && SAFE_ISO_TIMESTAMP.test(value);
+        if ((!acceptedCode && !acceptedIdentity && !acceptedTimestamp) || containsCredential(value)) continue;
         data[name] = value;
       } else if (typeof value === 'number' && Number.isFinite(value) || typeof value === 'boolean' || value === null) {
         data[name] = value;