elanous 0.2.41 → 0.2.43

package/src/task-orchestrator/surfaces/pod-si-warm-entry.ts

@@ -1,16 +1,43 @@
 /** Opt-in SI warm entry; the ordinary Pod spawn remains the default. */
 import { podSelfImplementSpawn, type PodSpawnOptions } from './self-implement-pod.js';
+import type { SiWarmChildAttempt } from './self-implement-pod.js';
+import type { SelfImplementJobDone, SelfImplementJobSpawn } from './self-implement.js';
+import type { SiWarmAcquireResult } from './pod-si-warm-provider.js';
+
+export interface SiWarmEntryAdapter {
+  acquire(input: Parameters<SelfImplementJobSpawn>[0], base: PodSpawnOptions): Promise<SiWarmAcquireResult>;
+  postprocess(input: Parameters<SelfImplementJobSpawn>[0], result: SelfImplementJobDone,
+    attempt: SiWarmChildAttempt, base: PodSpawnOptions): Promise<SelfImplementJobDone>;
+}
 
 export async function podSpawnWithSiWarm(base: PodSpawnOptions,
-  env: NodeJS.ProcessEnv = process.env) {
-  if (env.ELANOUS_SI_WARM_REUSE !== '1') return podSelfImplementSpawn(base);
-  const { acquireSiWarmChild, postprocessSiWarmChild } = await import('./pod-si-warm-host.js');
+  env: NodeJS.ProcessEnv = process.env, adapter?: SiWarmEntryAdapter) {
+  let configEnabled = false;
+  try { configEnabled = base.warmReuseConfig?.()?.ta === true; }
+  catch { /* An unreadable config must not open the warm transport. */ }
+  if (env.ELANOUS_SI_WARM_REUSE !== '1' && !configEnabled) return podSelfImplementSpawn(base);
+  const hooks = adapter ?? await import('./pod-si-warm-host.js').then(({ acquireSiWarmChild, postprocessSiWarmChild }) => ({
+    acquire: acquireSiWarmChild,
+    postprocess: postprocessSiWarmChild,
+  }));
   return podSelfImplementSpawn({ ...base,
     siWarmAttempt: async input => {
-      const result = await acquireSiWarmChild(input, base);
-      return result.status === 'acquired' ? result.attempt : null;
+      const result = await hooks.acquire(input, base);
+      switch (result.status) {
+        case 'acquired': return result.attempt;
+        case 'no-entry': return null;
+        case 'uncertain':
+          // An uncertain lease may already be running this request. Never launch a fresh Job
+          // until its fenced worker is reconciled, or the same goal can execute twice.
+          throw new Error(`si-v1 lease state uncertain: ${result.reason}`);
+        default: {
+          const exhaustive: never = result;
+          void exhaustive;
+          throw new Error('si-v1 lease acquisition returned an unsupported state');
+        }
+      }
     },
     siWarmHostPostprocess: (result, attempt, input) =>
-      postprocessSiWarmChild(input, result, attempt, base),
+      hooks.postprocess(input, result, attempt, base),
   });
 }

package/src/task-orchestrator/surfaces/pod-source-bundle.ts

@@ -13,8 +13,9 @@ type PackOptions = {
   paths?: string[];
   outDir: string;
   maxSizeBytes?: number;
-  mirrorHead?: string;
+  mirrorHead?: string | null;
   log?: (category: string, event: string, data: Record<string, unknown>) => void;
+  probeGit?: typeof gitProbe;
 };
 
 type PackedBundle = {
@@ -35,10 +36,21 @@ function git(repoDir: string, env: NodeJS.ProcessEnv, ...args: string[]): string
   }
 }
 
+function gitProbe(repoDir: string, env: NodeJS.ProcessEnv, ...args: string[]): { status: number; stderr: string } {
+  try {
+    execFileSync('git', args, { cwd: repoDir, env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+    return { status: 0, stderr: '' };
+  } catch (error) {
+    const e = error as Error & { status?: number; stderr?: Buffer | string };
+    return { status: e.status ?? -1, stderr: String(e.stderr ?? e.message).trim() };
+  }
+}
+
 /** Package the host's on-disk files above a fetchable remote base without touching the user's index. */
 export function packSourceBundle(options: PackOptions): PackedBundle {
   const { repoDir, kind, base, paths, outDir } = options;
   const log = options.log ?? ((category: string, event: string, data: Record<string, unknown>) => debug.log(category, event, data));
+  const probeGit = options.probeGit ?? gitProbe;
   const started = Date.now();
   let root = resolve(repoDir);
   const output = resolve(outDir);
@@ -50,6 +62,9 @@ export function packSourceBundle(options: PackOptions): PackedBundle {
   let headCommit: string | undefined;
   let ownsIndex = false;
   let createdBundle = false;
+  let bundleMode: 'thin' | 'full' | 'unknown' = 'unknown';
+  let bundleReason = 'decision-not-reached';
+  let bundleSizeBytes: number | null = null;
   try {
     root = git(root, env, 'rev-parse', '--show-toplevel');
     const outputRelative = relative(root, output);
@@ -110,16 +125,36 @@ export function packSourceBundle(options: PackOptions): PackedBundle {
     git(root, env, 'update-ref', ref, headCommit);
     createdBundle = true;
     let bundleRevision = ref;
-    if (options.mirrorHead !== undefined) {
+    if (options.mirrorHead === undefined) {
+      bundleMode = 'full';
+      bundleReason = 'mirror-head-unspecified';
+    } else if (options.mirrorHead === null) {
+      bundleMode = 'full';
+      bundleReason = 'mirror-head-missing';
+    } else {
+      bundleMode = 'full';
+      bundleReason = 'mirror-head-invalid';
       // A thin bundle is usable only when its excluded history belongs to the packed base's lineage.
       const mirrorHead = options.mirrorHead;
       let sharedHistory = false;
       if (/^[0-9a-f]{40,64}$/.test(mirrorHead)) {
-        try {
-          git(root, env, 'cat-file', '-e', `${mirrorHead}^{commit}`);
-          git(root, env, 'merge-base', '--is-ancestor', mirrorHead, baseCommit);
-          sharedHistory = true;
-        } catch { /* The mirror is unavailable or unrelated; include all history instead. */ }
+        const commitProbe = probeGit(root, { ...env, GIT_NO_LAZY_FETCH: '1' }, 'cat-file', '-e', `${mirrorHead}^{commit}`);
+        if (commitProbe.status === 0) {
+          const ancestorProbe = probeGit(root, env, 'merge-base', '--is-ancestor', mirrorHead, baseCommit);
+          if (ancestorProbe.status === 0) sharedHistory = true;
+          else if (ancestorProbe.status === 1 && !ancestorProbe.stderr) bundleReason = 'mirror-head-not-ancestor';
+          else bundleReason = 'mirror-head-check-failed';
+        } else if ((commitProbe.status === 1 && !commitProbe.stderr) || (commitProbe.status === 128 && /not a valid object name|could not get object info/i.test(commitProbe.stderr))) {
+          bundleReason = 'mirror-head-unavailable';
+        } else {
+          bundleReason = 'mirror-head-check-failed';
+        }
+      } else {
+        bundleReason = 'mirror-head-invalid';
+      }
+      if (sharedHistory) {
+        bundleMode = 'thin';
+        bundleReason = 'shared-history';
       }
       bundleRevision = sharedHistory ? `${mirrorHead}..${ref}` : ref;
     }
@@ -127,15 +162,16 @@ export function packSourceBundle(options: PackOptions): PackedBundle {
     git(root, env, 'update-ref', '-d', ref, headCommit);
     ref = undefined;
     const sizeBytes = statSync(bundlePath).size;
+    bundleSizeBytes = sizeBytes;
     if (sizeBytes > limit) throw new Error(`bundle size ${sizeBytes} exceeds limit ${limit} bytes`);
     const sha256 = createHash('sha256').update(readFileSync(bundlePath)).digest('hex');
     const result = { bundlePath, sha256, sizeBytes, baseCommit, headCommit, fileCount };
-    log('pod.source', 'bundle-packed', { kind, baseCommit, headCommit, fileCount, sizeBytes, ms: Date.now() - started });
+    log('pod.source', 'bundle-packed', { kind, baseCommit, headCommit, fileCount, bundleMode, bundleReason, sizeBytes, ms: Date.now() - started });
     return result;
   } catch (error) {
     if (createdBundle) rmSync(bundlePath, { force: true });
     const reason = error instanceof Error ? error.message : String(error);
-    log('pod.source', 'bundle-refused', { kind, reason });
+    log('pod.source', 'bundle-refused', { kind, reason, bundleMode, bundleReason, sizeBytes: bundleSizeBytes });
     throw error;
   } finally {
     if (ref && headCommit) git(root, env, 'update-ref', '-d', ref, headCommit);

package/src/task-orchestrator/surfaces/pod-source-receive.ts

@@ -3,17 +3,31 @@
 
 import { execFileSync } from 'node:child_process';
 import { siTaskPodStageShell } from './pod-lifecycle-stages.js';
+import { decidePodReuseCleanup } from './pod-reuse-cleanup.js';
 
 export type PodSource =
   | { kind: 'default'; base?: string; baseSha?: string }
   | { kind: 'commit'; sha: string }
   | { kind: 'pr'; number: number }
-  | { kind: 'bundle'; bundlePath: string; sha256: string; sizeBytes: number; headCommit: string };
+  | { kind: 'bundle'; bundlePath: string; sha256: string; sizeBytes: number; headCommit: string }
+  /** POD-REUSE-MIN-SYNC — 웜 Pod 재사용: 이미 있는 체크아웃을 지우지 않고 «이전 head → 새 base» 차이만 맞춘다.
+   *  base 는 호스트 미러 또는 부모가 넘긴 git bundle 에서만 받는다(GitHub 원격 호출 0 — PR push 1회는 이 단계 밖).
+   *  `lockHash` — 새 base 가 요구하는 bun.lock 해시. 실제 상주 설치 해시는
+   *  node_modules/.elanous-installed-lock-hash 에 따로 기록해 비교한다. */
+  | { kind: 'min-sync'; baseSha: string; previousHead: string; bundle?: { bundlePath: string; sha256: string; sizeBytes: number }; lockHash?: string };
 
 const SHA40 = /^[0-9a-f]{40}$/;
 
+/** Fail-closed typed error — resolved SHA 형식이 틀리면 스크립트 생성 이전에 거부한다. */
+export class PodSourceShaFormatError extends Error {
+  constructor(public readonly label: string, public readonly value: string) {
+    super(`${label} must be 40 hex characters`);
+    this.name = 'PodSourceShaFormatError';
+  }
+}
+
 function assertSha(value: string, label: string): string {
-  if (!SHA40.test(value)) throw new Error(`${label} must be 40 hex characters`);
+  if (!SHA40.test(value)) throw new PodSourceShaFormatError(label, value);
   return value;
 }
 
@@ -56,7 +70,10 @@ function assertRemoteBase(repoUrl: string, base: string): void {
 /** Job 스크립트의 원천 단계. 성공 갈래는 `ELANOUS_POD_SOURCE <kind> <HEAD>` 로 끝난다.
  *  `stageMarkers` — si-task Job 만: 호스트 미러 `clone --shared` 시도의 시작·성공을 `ELANOUS_POD_STAGE mirror start|end` 로 찍는다
  *  (건너뛰거나 실패하면 끝 표지가 없다 → 호스트가 missing 으로 읽는다). 기본은 꺼짐 — gate·pod-command Job 의 바이트는 그대로다. */
-export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath = '/host-mirror', options: { stageMarkers?: boolean; imageSourceDir?: string; imageCommitFile?: string; imageGitDir?: string } = {}): string {
+export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath = '/host-mirror', options: { stageMarkers?: boolean; imageSourceDir?: string; imageCommitFile?: string; imageGitDir?: string; /** min-sync 만: 스크립트가 다루는 체크아웃 경로(기본 `repo` — Job 스크립트 관례). 상주 런타임은 절대 경로를 준다. */ checkoutDir?: string } = {}): string {
+  // 검증 우선 — 부모 resolver 가 준 baseSha 는 셸 스크립트 문자열에 삽입되기 전에 형식 검사를 통과해야 한다.
+  const sourceBaseSha = source.kind === 'default' ? source.baseSha : undefined;
+  const baseSha = sourceBaseSha ? assertSha(sourceBaseSha, 'base sha') : undefined;
   const mark = (edge: 'start' | 'end'): string[] => options.stageMarkers ? [siTaskPodStageShell('mirror', edge)] : [];
   const quotedUrl = `'${repoUrl.replace(/'/g, `'\\''`)}'`;
   const quotedMirror = `'${mirrorPath.replace(/'/g, `'\\''`)}'`;
@@ -64,21 +81,50 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
   const quotedCommitFile = `'${(options.imageCommitFile ?? '/opt/elanous-source-commit').replace(/'/g, `'\\''`)}'`;
   const quotedImageGitDir = `'${(options.imageGitDir ?? '/opt/elanous-pin.git').replace(/'/g, `'\\''`)}'`;
   const clone = `git clone -q --depth 50 ${quotedUrl} repo`;
+  const sourceRecordSha = source.kind === 'default' ? (baseSha ?? '')
+    : source.kind === 'commit' ? assertSha(source.sha, 'commit sha')
+    : source.kind === 'bundle' ? assertSha(source.headCommit, 'headCommit')
+    : source.kind === 'min-sync' ? assertSha(source.baseSha, 'base sha') : '';
+  const sourceOutcomeStart = [
+    `pod_source_kind='${source.kind}'`,
+    `pod_source_base_sha='${sourceRecordSha}'`,
+    'pod_source_stage=source-preflight',
+    'pod_source_failure_code=',
+    'pod_source_result_reported=0',
+    'pod_source_result_emit() {',
+    '  pod_source_exit="${1:-0}"',
+    '  [ "$pod_source_result_reported" -eq 0 ] || return 0; pod_source_result_reported=1',
+    '  pod_source_result_status=failed; if [ "${pod_source_io_measured:-0}" -eq 1 ]; then pod_source_result_status=complete; elif [ "$pod_source_exit" -eq 0 ]; then pod_source_result_status=incomplete; fi',
+    '  if [ "$pod_source_exit" -ne 0 ] && [ -z "$pod_source_failure_code" ]; then pod_source_failure_code=source-step-failed; fi',
+    '  pod_source_failure_json=null; if [ -n "$pod_source_failure_code" ]; then pod_source_failure_json="\\\"$pod_source_failure_code\\\""; fi',
+    '  pod_source_base_sha_json=null; if [ -n "$pod_source_base_sha" ]; then pod_source_base_sha_json="\\\"$pod_source_base_sha\\\""; fi',
+    '  printf \'ELANOUS_POD_SOURCE_RESULT {"sourceStage":"%s","sourceKind":"%s","sourceVia":"%s","sourceStatus":"%s","baseSha":%s,"exitCode":%s,"failureCode":%s}\\n\' "$pod_source_stage" "$pod_source_kind" "${source_via:-unknown}" "$pod_source_result_status" "$pod_source_base_sha_json" "$pod_source_exit" "$pod_source_failure_json"',
+    '}',
+  ];
   // First observation slice: count source checkout work without changing its routing.
   const ioStart = [
+    ...sourceOutcomeStart,
     // Count calls performed by this Pod source stage. Branch validation via
     // assertRemoteBase runs on the host before Job creation and is outside it.
     'pod_source_io_origin_calls=0',
+    ...(source.kind === 'default' && baseSha ? [
+      'pod_source_base_sha_origin_fallback=false',
+      'pod_source_base_sha_mirror_fetch_attempted=false',
+    ] : []),
     'pod_source_io_started=$(date +%s)',
     'pod_source_io_reported=0',
     'pod_source_io_measured=0',
-    'pod_source_io_measure() { pod_source_io_files=$(git ls-files -z | tr -cd "\\000" | wc -c | tr -d " "); pod_source_io_seconds=$(( $(date +%s) - pod_source_io_started )); pod_source_io_measured=1; }',
+    'pod_source_io_measure() { pod_source_io_files=$(git ls-files -z | tr -cd "\\000" | wc -c | tr -d " "); pod_source_io_seconds=$(( $(date +%s) - pod_source_io_started )); pod_source_io_measured=1; pod_source_stage=source-complete; }',
     'pod_source_io_emit() {',
+    '  pod_source_exit=$?',
     '  [ "$pod_source_io_reported" -eq 0 ] || return 0; pod_source_io_reported=1',
     '  [ -n "${pod_source_io_seconds:-}" ] || pod_source_io_seconds=$(( $(date +%s) - pod_source_io_started ))',
     '  [ -n "${pod_source_io_files:-}" ] || pod_source_io_files=null',
     '  pod_source_io_status=incomplete; if [ "$pod_source_io_measured" -eq 1 ]; then pod_source_io_status=complete; fi',
-    '  printf \'ELANOUS_POD_SOURCE_IO {"originCalls":%s,"checkoutFiles":%s,"sourceVia":"%s","sourceSeconds":%s,"sourceStatus":"%s","pushCalls":null,"installRan":null,"installSeconds":null}\\n\' "$pod_source_io_origin_calls" "$pod_source_io_files" "${source_via:-unknown}" "$pod_source_io_seconds" "$pod_source_io_status"',
+    ...(source.kind === 'default' && baseSha
+      ? ['  printf \'ELANOUS_POD_SOURCE_IO {"originCalls":%s,"baseShaOriginFallback":%s,"checkoutFiles":%s,"sourceVia":"%s","sourceSeconds":%s,"sourceStatus":"%s","pushCalls":null,"installRan":null,"installSeconds":null}\\n\' "$pod_source_io_origin_calls" "$pod_source_base_sha_origin_fallback" "$pod_source_io_files" "${source_via:-unknown}" "$pod_source_io_seconds" "$pod_source_io_status"']
+      : ['  printf \'ELANOUS_POD_SOURCE_IO {"originCalls":%s,"checkoutFiles":%s,"sourceVia":"%s","sourceSeconds":%s,"sourceStatus":"%s","pushCalls":null,"installRan":null,"installSeconds":null}\\n\' "$pod_source_io_origin_calls" "$pod_source_io_files" "${source_via:-unknown}" "$pod_source_io_seconds" "$pod_source_io_status"']),
+    '  pod_source_result_emit "$pod_source_exit"',
     '}',
     'trap pod_source_io_emit EXIT',
   ];
@@ -88,6 +134,7 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     // Git metadata is tiny and private to this Pod; alternates point first at
     // the image's shallow pin objects, then optionally at the host mirror.
     'source_via=',
+    'pod_source_stage=image-source',
     `if [ -f ${quotedCommitFile} ] && [ -d ${quotedImageDir} ] && [ -d ${quotedImageGitDir} ]; then`,
     // Older pinned images can contain macOS AppleDouble pack sidecars. Git may
     // interpret `._pack-*.idx` as an index and fail even when the real pack is valid.
@@ -97,7 +144,16 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     `    ln -s ${quotedImageDir} repo || exit 5`,
     `    image_objects=$(git -C ${quotedImageGitDir} rev-parse --path-format=absolute --git-path objects)`,
     `    if git -C repo init -q -b main && mkdir -p repo/.git/objects/info && printf '%s\\n' "$image_objects" > repo/.git/objects/info/alternates; then`,
-    `      if [ -d ${quotedMirror} ]; then mirror_objects=$(git -C ${quotedMirror} rev-parse --path-format=absolute --git-path objects 2>/dev/null || :); [ -z "$mirror_objects" ] || printf '%s\\n' "$mirror_objects" >> repo/.git/objects/info/alternates; fi`,
+    // 부모 resolver 가 exact SHA 를 준 image 라우트에선 호스트 미러를 alternates 로 빌리지 않는다.
+    // 그 SHA 는 아래 baseSha 분기의 raw-SHA fetch 로 Pod 전용 object store 에 직접 들어오므로
+    // ① ELANOUS_POD_SOURCE_BASE_SHA_FROM 마커가 «실제» 객체 출처를 말하고
+    // ② 호스트 마운트가 런타임에 사라져도 'unable to normalize alternate object path' 로
+    //    checkout 이 깨지지 않는다(라운드1 미러 alternates 플레이크의 뿌리 제거).
+    ...(source.kind === 'default' && baseSha
+      ? []
+      : [
+          `      if [ -d ${quotedMirror} ]; then mirror_objects=$(git -C ${quotedMirror} rev-parse --path-format=absolute --git-path objects 2>/dev/null || :); [ -z "$mirror_objects" ] || printf '%s\\n' "$mirror_objects" >> repo/.git/objects/info/alternates; fi`,
+        ]),
     `      if [ -f ${quotedImageGitDir}/shallow ]; then cp ${quotedImageGitDir}/shallow repo/.git/shallow || exit 5; fi`,
     `      if git -C repo update-ref refs/heads/main "$image_commit" && git -C repo read-tree "$image_commit" && git -C repo update-index --refresh && git -C repo diff-files --quiet && extra=$(git -C repo ls-files --others) && [ -z "$extra" ]; then`,
     `        git -C repo remote add origin ${quotedUrl} || exit 5`,
@@ -116,26 +172,30 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     '  fi',
     'fi',
     'if [ "$source_via" != image ]; then',
+    'pod_source_stage=mirror-source',
     // TA-POD-WARMBOOT-PARITY (10-16): the mirror fallback used to be silent — 157 HARD gate Pods all said
     // `VIA github` and nothing said why (the Job had no /host-mirror mount). Each failed step now names itself.
     'mirror_skip=',
     ...mark('start'),
     `if ! [ -d ${quotedMirror} ]; then mirror_skip=no-mount`,
     `elif ! git -C ${quotedMirror} rev-parse --verify HEAD >/dev/null 2>&1; then mirror_skip=rev-parse-failed`,
-    `elif ! git clone -q --shared -- ${quotedMirror} repo || ! git -C repo rev-parse --verify HEAD >/dev/null 2>&1; then mirror_skip=clone-failed`,
+    ...(source.kind === 'default' && baseSha
+      ? [`elif pod_source_base_sha_mirror_fetch_attempted=true; ! git init -q -b main repo || ! git -C repo fetch --quiet --no-write-fetch-head ${quotedMirror} '${baseSha}' || ! git -C repo cat-file -e '${baseSha}^{commit}' 2>/dev/null; then mirror_skip=sha-fetch-failed`]
+      : [`elif ! git clone -q --shared -- ${quotedMirror} repo || ! git -C repo rev-parse --verify HEAD >/dev/null 2>&1; then mirror_skip=clone-failed`]),
     'fi',
     'if [ -z "$mirror_skip" ]; then',
     ...mark('end').map((line) => `  ${line}`),
-    `  git -C repo remote set-url origin ${quotedUrl} || exit 5`,
+    ...(source.kind === 'default' && baseSha
+      ? [`  git -C repo remote add origin ${quotedUrl} || exit 5`]
+      : [`  git -C repo remote set-url origin ${quotedUrl} || exit 5`]),
     '  source_via=mirror',
     'else',
     "  printf 'ELANOUS_POD_SOURCE_MIRROR_SKIP %s\\n' \"$mirror_skip\"",
     '  if [ -e repo ]; then rm -r -- repo || exit 5; fi',
-    ...(source.kind === 'default' && source.baseSha ? [] : ['  pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1))']),
-    ...(source.kind === 'default' && source.baseSha ? [
-      `  printf 'ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE %s\\n' '${source.baseSha}'`,
-      '  exit 5',
-    ] : [`  ${clone} || exit 5`]),
+    ...(source.kind === 'default' && baseSha ? [] : ['  pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1))']),
+    ...(source.kind === 'default' && baseSha
+      ? [`  git init -q -b main repo && git -C repo remote add origin ${quotedUrl} || exit 5`]
+      : [`  ${clone} || exit 5`]),
     '  source_via=github',
     'fi',
     'fi',
@@ -143,8 +203,8 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     'cd repo || exit 5',
   ];
   if (source.kind === 'default') {
-    if (source.baseSha) {
-      const sha = assertSha(source.baseSha, 'base sha');
+    if (baseSha) {
+      const sha = baseSha;
       const base = source.base ?? 'main';
       if (base.startsWith('-') || !/^[\w./-]+$/.test(base)) throw new Error(`invalid Pod base ref: ${base}`);
       const quote = (value: string) => `'${value.replace(/'/g, `'\\''`)}'`;
@@ -154,7 +214,20 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
       return [
         ...ioStart,
         ...start,
-        `if ! git cat-file -e '${sha}^{commit}' 2>/dev/null; then git fetch --quiet --no-write-fetch-head ${quotedMirror} '${sha}' || { printf 'ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE %s\\n' '${sha}'; exit 5; }; fi`,
+        // «실제 객체 출처» 마커: image pin을 우선 쓰고, SHA가 없으면 host mirror 다음 origin에서
+        // raw-SHA fetch 해 Pod 전용 object store 에 넣는다. origin 시도 수·성공 여부는 IO summary로
+        // debug.log 에 남겨 다음 실패에서 소스 부재와 네트워크 fallback을 구분한다.
+        'pod_source_base_sha_from="$source_via"',
+        `if ! git cat-file -e '${sha}^{commit}' 2>/dev/null; then`,
+        `  if [ "$pod_source_base_sha_mirror_fetch_attempted" = false ] && [ -d ${quotedMirror} ]; then pod_source_base_sha_mirror_fetch_attempted=true; if git fetch --quiet --no-write-fetch-head ${quotedMirror} '${sha}'; then pod_source_base_sha_from=mirror; else printf 'ELANOUS_POD_SOURCE_BASE_SHA_MIRROR_FETCH failed %s\\n' '${sha}'; fi; fi`,
+        `  if ! git cat-file -e '${sha}^{commit}' 2>/dev/null; then`,
+        '    pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1))',
+        '    pod_source_base_sha_origin_fallback=true',
+        `    printf 'ELANOUS_POD_SOURCE_BASE_SHA_ORIGIN_FETCH start %s\\n' '${sha}'`,
+        `    if git fetch --quiet --no-write-fetch-head origin '${sha}'; then pod_source_base_sha_from=origin; source_via=origin; printf 'ELANOUS_POD_SOURCE_BASE_SHA_ORIGIN_FETCH complete %s\\n' '${sha}'; else pod_source_stage=base-sha; pod_source_failure_code=base-sha-unavailable; printf 'ELANOUS_POD_SOURCE_BASE_SHA_ORIGIN_FETCH failed %s\\n' '${sha}'; printf 'ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE %s\\n' '${sha}'; exit 5; fi`,
+        '  fi',
+        'fi',
+        `printf 'ELANOUS_POD_SOURCE_BASE_SHA_FROM %s\\n' "$pod_source_base_sha_from"`,
         `git checkout -q -B ${quotedBase} '${sha}' || exit 5`,
         `git update-ref ${quotedTrackingRef} '${sha}' || exit 5`,
         `git symbolic-ref refs/remotes/origin/HEAD ${quotedTrackingRef} || exit 5`,
@@ -265,6 +338,95 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
       'pod_source_io_emit',
     ].join('\n');
   }
+  if (source.kind === 'min-sync') {
+    // POD-REUSE-MIN-SYNC — 같은 웜 Pod 재사용 수신. 새 Pod 갈래(clone/image)와 반대로:
+    //  ① 대상 base 를 호스트 미러 또는 부모가 넘긴 git bundle 에서만 받는다(GitHub 원격 호출 0).
+    //  ② 기존 작업 트리를 지우지 않고 «이전 head → 새 base» 차이 파일만 checkout/reset 하고
+    //     남은 untracked·빌드 산출만 clean 한다(제외 목록·status 게이트 = decidePodReuseCleanup).
+    //  ③ node_modules 는 bun.lock 해시가 같으면 그대로 재사용(설치 건너뜀), 다르면 재설치한다.
+    //  ④ 요청마다 «GitHub 호출 수 · 바뀐 파일 수 · 소요 초»를 ELANOUS_POD_STAGE 표지로 남긴다.
+    const baseSha = assertSha(source.baseSha, 'base sha');
+    const previousHead = assertSha(source.previousHead, 'previous head');
+    const lockHash = source.lockHash ? assertSha256(source.lockHash) : undefined;
+    const bundle = source.bundle ? {
+      bundlePath: source.bundle.bundlePath, sha256: assertSha256(source.bundle.sha256), sizeBytes: assertSize(source.bundle.sizeBytes),
+    } : undefined;
+    const cleanupPlan = decidePodReuseCleanup({ base: baseSha, resetExitCode: 0, cleanExitCode: 0, statusExitCode: 0, statusPorcelain: '' });
+    const checkout = options.checkoutDir ?? 'repo';
+    const quote = (value: string) => `'${value.replace(/'/g, `'\\''`)}'`;
+    const quotedCheckout = quote(checkout);
+    const gitArgv = (args: readonly string[]) => args.map(quote).join(' ');
+    return [
+      ...sourceOutcomeStart,
+      'source_via=min-sync',
+      'pod_source_stage=min-sync',
+      'pod_source_io_origin_calls=0',
+      'pod_source_io_started=$(date +%s)',
+      'pod_source_io_reported=0',
+      'pod_source_io_measured=0',
+      'pod_source_io_install_ran=false',
+      'pod_source_io_install_seconds=null',
+      'pod_source_io_emit() {',
+      '  pod_source_exit=$?',
+      '  [ "$pod_source_io_reported" -eq 0 ] || return 0; pod_source_io_reported=1',
+      '  [ -n "${pod_source_io_seconds:-}" ] || pod_source_io_seconds=$(( $(date +%s) - pod_source_io_started ))',
+      '  pod_source_io_status=incomplete; if [ "$pod_source_io_measured" -eq 1 ]; then pod_source_io_status=complete; fi',
+      '  printf \'ELANOUS_POD_SOURCE_IO {"originCalls":%s,"checkoutFiles":%s,"sourceVia":"%s","sourceSeconds":%s,"sourceStatus":"%s","pushCalls":null,"installRan":%s,"installSeconds":%s}\\n\' "$pod_source_io_origin_calls" "${pod_source_io_files:-null}" "$source_via" "$pod_source_io_seconds" "$pod_source_io_status" "$pod_source_io_install_ran" "$pod_source_io_install_seconds"',
+      '  pod_source_result_emit "$pod_source_exit"',
+      '}',
+      'trap pod_source_io_emit EXIT',
+      `if [ ! -d ${quotedCheckout}/.git ]; then printf 'ELANOUS_POD_SOURCE_MISMATCH no-warm-checkout\\n'; exit 5; fi`,
+      `cd ${quotedCheckout} || exit 5`,
+      'resident_head=$(git rev-parse HEAD) || exit 5',
+      `if [ "$resident_head" != ${quote(previousHead)} ]; then printf 'ELANOUS_POD_SOURCE_MISMATCH previous-head-mismatch %s\\n' "$resident_head"; exit 5; fi`,
+      `if ! git cat-file -e ${quote(`${baseSha}^{commit}`)} 2>/dev/null; then`,
+      ...(bundle ? [
+        `  size=$(wc -c < ${quote(bundle.bundlePath)} | tr -d " ")`,
+        `  if [ "$size" != "${bundle.sizeBytes}" ]; then printf 'ELANOUS_POD_SOURCE_MISMATCH size\\n'; exit 3; fi`,
+        `  got=$(sha256sum ${quote(bundle.bundlePath)} | awk '{print $1}')`,
+        `  if [ "$got" != "${bundle.sha256}" ]; then printf 'ELANOUS_POD_SOURCE_MISMATCH sha256\\n'; exit 3; fi`,
+        `  git fetch --quiet --no-write-fetch-head ${quote(bundle.bundlePath)} ${quote(baseSha)} || { pod_source_stage=base-sha; pod_source_failure_code=base-sha-unavailable; printf 'ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE %s\\n' ${quote(baseSha)}; exit 5; }`,
+      ] : [
+        `  if [ -d ${quotedMirror} ]; then git fetch --quiet --no-write-fetch-head ${quotedMirror} ${quote(baseSha)} || { pod_source_stage=base-sha; pod_source_failure_code=base-sha-unavailable; printf 'ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE %s\\n' ${quote(baseSha)}; exit 5; }; else pod_source_stage=base-sha; pod_source_failure_code=base-sha-unavailable; printf 'ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE %s\\n' ${quote(baseSha)}; exit 5; fi`,
+      ]),
+      'fi',
+      `if ! git cat-file -e ${quote(`${baseSha}^{commit}`)} 2>/dev/null; then pod_source_stage=base-sha; pod_source_failure_code=base-sha-unavailable; printf 'ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE %s\\n' ${quote(baseSha)}; exit 5; fi`,
+      'minsync_paths=$(mktemp) || exit 5',
+      `git diff --name-only -z ${quote(previousHead)} ${quote(baseSha)} > "$minsync_paths" || exit 5`,
+      `pod_source_io_files=$(tr -cd "\\000" < "$minsync_paths" | wc -c | tr -d " ")`,
+      `git reset -q ${quote(baseSha)} || exit 5`,
+      "while IFS= read -r -d '' path; do",
+      `  if git cat-file -e ${quote(`${baseSha}:`)}"$path" 2>/dev/null; then git checkout -q -- "$path" || exit 5; fi`,
+      'done < "$minsync_paths"',
+      'rm -f -- "$minsync_paths"',
+      `git ${gitArgv(cleanupPlan.cleanArgs)} || exit 5`,
+      ...(lockHash ? [
+        'if [ ! -f bun.lock ]; then printf \'ELANOUS_POD_SOURCE_MISMATCH lockfile-missing\\n\'; exit 5; fi',
+        "lock_now=$(sha256sum bun.lock | awk '{print $1}')",
+        `if [ "$lock_now" != ${quote(lockHash)} ]; then printf 'ELANOUS_POD_SOURCE_MISMATCH lock-hash-does-not-match-request\\n'; exit 5; fi`,
+        "installed_lock_hash=",
+        'install_marker=node_modules/.elanous-installed-lock-hash',
+        'if [ -f "$install_marker" ] && [ ! -L "$install_marker" ]; then installed_lock_hash=$(cat "$install_marker") || exit 5; fi',
+        'if [ "$installed_lock_hash" != "$lock_now" ]; then',
+        '  install_t0=$SECONDS',
+        "  if ! bun install >/dev/null 2>&1; then printf 'ELANOUS_POD_SOURCE_MISMATCH install-failed\\n'; exit 5; fi",
+        '  pod_source_io_install_ran=true',
+        '  pod_source_io_install_seconds=$(( SECONDS - install_t0 ))',
+        '  install_marker_tmp=$(mktemp "$install_marker.tmp.XXXXXX") || exit 5',
+        '  printf \'%s\\n\' "$lock_now" > "$install_marker_tmp" && mv -- "$install_marker_tmp" "$install_marker" || { rm -f -- "$install_marker_tmp"; exit 5; }',
+        'fi',
+      ] : []),
+      `minsync_status=$(git ${gitArgv(cleanupPlan.statusArgs)}) || exit 5`,
+      `if [ -n "$minsync_status" ]; then printf 'ELANOUS_POD_SOURCE_MISMATCH worktree-not-clean\\n'; exit 5; fi`,
+      'head=$(git rev-parse HEAD) || exit 5',
+      `if [ "$head" != ${quote(baseSha)} ]; then printf 'ELANOUS_POD_SOURCE_MISMATCH base-head-mismatch\\n'; exit 5; fi`,
+      'pod_source_io_seconds=$(( $(date +%s) - pod_source_io_started ))',
+      'pod_source_io_measured=1',
+      `printf 'ELANOUS_POD_STAGE min-sync %s %s %s\\n' "$pod_source_io_origin_calls" "$pod_source_io_files" "$pod_source_io_seconds"`,
+      `printf 'ELANOUS_POD_SOURCE min-sync %s\\n' "$head"`,
+      'pod_source_io_emit',
+    ].join('\n');
+  }
   const sha256 = assertSha256(source.sha256);
   const sizeBytes = assertSize(source.sizeBytes);
   const headCommit = assertSha(source.headCommit, 'headCommit');

package/src/task-orchestrator/surfaces/pod-source-spec.ts

@@ -57,11 +57,11 @@ function gitRoot(start: string): string {
 }
 
 /** commit·pr 는 그대로. worktree·files 는 `packSourceBundle` 로 `{ kind: 'bundle' }`. */
-export function resolvePodSource(parsed: ParsedPodSource, opts: { base: string; outDir: string }): PodSource {
+export function resolvePodSource(parsed: ParsedPodSource, opts: { base: string; outDir: string; mirrorHead?: string | null; log?: (category: string, event: string, data: Record<string, unknown>) => void }): PodSource {
   if (parsed.kind === 'commit') return { kind: 'commit', sha: parsed.sha };
   if (parsed.kind === 'pr') return { kind: 'pr', number: parsed.number };
   if (parsed.kind === 'worktree') {
-    const packed = packSourceBundle({ repoDir: resolve(parsed.path), kind: 'worktree', base: opts.base, outDir: opts.outDir });
+    const packed = packSourceBundle({ repoDir: resolve(parsed.path), kind: 'worktree', base: opts.base, outDir: opts.outDir, mirrorHead: opts.mirrorHead, log: opts.log });
     return { kind: 'bundle', bundlePath: packed.bundlePath, sha256: packed.sha256, sizeBytes: packed.sizeBytes, headCommit: packed.headCommit };
   }
   const first = resolve(parsed.paths[0]!);
@@ -72,6 +72,6 @@ export function resolvePodSource(parsed: ParsedPodSource, opts: { base: string;
     if (!rel || rel.startsWith('..') || isAbsolute(rel)) throw new Error(`files path '${path}' is outside git root ${root}`);
     return rel.split('\\').join('/');
   });
-  const packed = packSourceBundle({ repoDir: root, kind: 'files', base: opts.base, paths, outDir: opts.outDir });
+  const packed = packSourceBundle({ repoDir: root, kind: 'files', base: opts.base, paths, outDir: opts.outDir, mirrorHead: opts.mirrorHead, log: opts.log });
   return { kind: 'bundle', bundlePath: packed.bundlePath, sha256: packed.sha256, sizeBytes: packed.sizeBytes, headCommit: packed.headCommit };
 }

package/src/task-orchestrator/surfaces/pod-warm-switch.ts

@@ -85,6 +85,8 @@ export function warmReuseFlagOn(config: unknown, consumer: WarmReuseConsumer): b
 
 function evidenceReason(evidence: WarmReuseEvidence | undefined, minSamples: number): string | null {
   if (!evidence) return 'evidence-unmeasured';
+  // A measured mismatch is the most actionable reason even when it also makes the latest canary fail.
+  if (typeof evidence.recentMismatchCount === 'number' && evidence.recentMismatchCount > 0) return 'recent-mismatch';
   if (evidence.leaseValid !== true) return evidence.leaseValid === false ? 'lease-invalid' : 'lease-unmeasured';
   if (evidence.canaryPassed !== true) return evidence.canaryPassed === false ? 'canary-failed' : 'canary-unmeasured';
   for (const field of IDENTITY_FIELDS) {