elanous 0.2.41 → 0.2.43

package/src/task-orchestrator/surfaces/self-implement-pod.ts

@@ -79,6 +79,39 @@ export function recordPodSourceIoSummary(logs: string, job: string, runId: strin
   }
 }
 
+export type PodSourceAttemptOutcome = {
+  classification: 'explicit-source-failure' | 'source-complete' | 'status-not-recorded';
+  sourceStage: string | null;
+  sourceKind: string | null;
+  sourceVia: string | null;
+  sourceStatus: string | null;
+  baseSha: string | null;
+  exitCode: number | null;
+  failureCode: string | null;
+};
+
+/** Keep missing telemetry distinct from an observed source-stage failure. */
+export function parsePodSourceAttemptOutcome(logs: string | null, fallback: { sourceKind?: string | null; baseSha?: string | null } = {}): PodSourceAttemptOutcome {
+  const resultLine = logs ? /^ELANOUS_POD_SOURCE_RESULT (\{[^\r\n]+\})\r?$/m.exec(logs)?.[1] : undefined;
+  const result = resultLine ? (() => { try { return JSON.parse(resultLine) as Record<string, unknown>; } catch { return null; } })() : null;
+  const explicitBaseFailure = !!logs && /^ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE [^\r\n]+\r?$/m.test(logs);
+  const ioLine = logs ? /^ELANOUS_POD_SOURCE_IO (\{[^\r\n]+\})\r?$/m.exec(logs)?.[1] : undefined;
+  const io = ioLine ? (() => { try { return JSON.parse(ioLine) as Record<string, unknown>; } catch { return null; } })() : null;
+  const validString = (value: unknown): string | null => typeof value === 'string' && value.length > 0 ? value : null;
+  const resultFailure = validString(result?.failureCode) ?? (explicitBaseFailure ? 'base-sha-unavailable' : null);
+  const status = validString(result?.sourceStatus) ?? (io?.sourceStatus === 'complete' || io?.sourceStatus === 'incomplete' ? io.sourceStatus : null);
+  return {
+    classification: resultFailure || explicitBaseFailure ? 'explicit-source-failure' : status === 'complete' ? 'source-complete' : 'status-not-recorded',
+    sourceStage: validString(result?.sourceStage) ?? (explicitBaseFailure ? 'base-sha' : null),
+    sourceKind: validString(result?.sourceKind) ?? fallback.sourceKind ?? null,
+    sourceVia: validString(result?.sourceVia) ?? validString(io?.sourceVia) ?? (/^ELANOUS_POD_SOURCE_VIA (image|mirror|github|bundle|min-sync)\r?$/m.exec(logs ?? '')?.[1] ?? null),
+    sourceStatus: status,
+    baseSha: validString(result?.baseSha) ?? fallback.baseSha ?? null,
+    exitCode: typeof result?.exitCode === 'number' && Number.isInteger(result.exitCode) ? result.exitCode : null,
+    failureCode: resultFailure,
+  };
+}
+
 /** Select a timestamp for a DeadlineExceeded observation without making detector time look like Job completion.
  *  `podFinishedAt` must come from readPodTermination for the same verified Job uid. */
 export function podJobFinishedTiming(input: { jobCreatedAt: string | null; jobCompletedAt: string | null;
@@ -102,6 +135,7 @@ import { POD_LAUNCH_FINISHED_EVENT, POD_LAUNCH_STARTED_EVENT, provenanceRowFromA
 import { podProvenanceMetadata, type PodProvenanceMetadata } from './pod-provenance.js';
 import { packageVersion } from '../../version/code-revision.js';
 import { minihLocationFrom, podWorkLabels, type PodWorkIdentity, type PodPlacement, type PodPlacementKind, type PodPoolMember, type PodPoolScheduler } from './pod-pool.js';
+import { acquirePodPoolSlot, POD_DISTRIBUTOR_ENTRY_ENV, type PodDistributorAdapter } from './pod-distributor.js';
 export { POD_CHILD_REQUESTS } from './pod-lease.js';
 import { measurePoolLease, recommendConcurrency, POD_CHILD_REQUESTS, POD_SI_ADMISSION_CAP_BYTES, POD_HOST_LEASE_ANNOTATION, POD_JOB_TTL_AFTER_FINISHED_SECONDS, LEASE_KUBECTL_MAX_BUFFER, memoryQuantityBytes } from './pod-lease.js';
 import { ACTUAL_SUBSTRATE_ENV, RUN_CONTRACT_ENV, carryRunContract, completionFloorFor } from '../../self-implement/graph-run-contract.js';
@@ -131,7 +165,7 @@ import { normalizeFallbackChain, type FallbackStep } from '../../oauth/fallback-
 import { goalTypeOf, type GoalType } from '../../../scripts/measure-pod-memory-by-goal.js';
 import { declaredGoalType, type GoalType as DeclaredGoalType } from '../../self-implement/goal-author.js';
 import { readPodMemoryAdvice, type PodMemoryAdvice } from '../../cli/pod-memory-advice.js';
-import { DEFAULT_BUDGET_GATE_MAX_USED_PERCENT, getUserConfig, roleLlmEnvName, type UserConfig } from '../../user-config.js';
+import { DEFAULT_BUDGET_GATE_MAX_USED_PERCENT, getUserConfig, resolveRoleLlm, roleLlmEnvName, type UserConfig } from '../../user-config.js';
 import { worktreeAddTimeoutSec } from '../../git-fs/worktree.js';
 import { podChildProviderOf, podChildProviderRefusal, type PodChildProvider } from './pod-child-providers.js';
 import { BEDROCK_POD_EGRESS_LABEL, bedrockPodEnv, checkBedrockPodSecret, type BedrockPodSpec } from './pod-bedrock-child.js';
@@ -140,7 +174,7 @@ import { ZAI_POD_EGRESS_LABEL, checkZaiPodSecret, countActiveZaiJobs, decideZaiP
 import { ZAI_CODING_DEFAULT_MODEL, ZAI_OPENROUTER_FALLBACK_MODEL, zaiSettingsFromConfig, type ZaiCodingPlanSettings } from '../../llm/zai-coding-plan.js';
 import { normalizePlanningFallbackReason, selectEnhanceLlm } from '../../prompt-enhance/enhance.js';
 import { inferProviderFromModel } from '../../llm.js';
-import { classifyPodExit, extractPodFailureReason, podChildEvidenceLedgerRow, podChildFailureAttribution, podDeadlineResultMarker, podJobConditionReason, podTerminalRow, POD_TERMINATION_JOB_JSONPATH, POD_TERMINATION_PODS_JSONPATH, readPodTermination, type PodExitClass, type PodTermination } from './pod-failure-reason.js';
+import { classifyPodExit, extractPodFailureReason, podChildEvidenceLedgerRow, podChildFailureAttribution, podChildProviderFailureFact, podDeadlineResultMarker, podJobConditionReason, podTerminalRow, POD_TERMINATION_JOB_JSONPATH, POD_TERMINATION_PODS_JSONPATH, readPodTermination, type PodExitClass, type PodTermination } from './pod-failure-reason.js';
 import { kubectlTransientReason, retryKubectlTransient } from './kubectl-transient-retry.js';
 import { OLD_DOOR_STAMP_ENV } from '../../self-dev/old-door.js';
 import { resolveDefaultSourceHead, seedMirrorOnce, type MirrorSeedResult } from './pod-mirror-seed.js';
@@ -288,6 +322,8 @@ export interface PodSpawnOptions {
   readSkillEnv?: () => Record<string, string>;
   /** ☸️ 여러 클러스터 풀(pod-pool.ts) — Job 마다 우선순위 순 첫 빈 자리로. 없으면 현재 컨텍스트 하나. */
   pool?: PodPoolScheduler;
+  /** POD-DISTRIBUTOR-WIRE — replaceable admission seam; tasks-hand only in the first wire slice. */
+  podDistributorAdapter?: PodDistributorAdapter;
   /** ☸️ 원격 그라운딩 주소(P13) — 없으면 호스트 env ELANOUS_GROUNDING_URL → 설정 pod.groundingUrl. 셋 다 없으면 토큰을 안 만든다. */
   groundingUrl?: string;
   /** 시험 심 — 토큰 발급·회수. GitHub credential 토큰에는 호스트가 검증한 저장소를 서명한다. */
@@ -373,7 +409,8 @@ async function measureHostBudgetSnapshot(childLlm: PodBudgetChildLlm, env: NodeJ
   const host = resolveHostId(env);
   const measuredAt = Date.now();
   const { readBudgetInputsLive, CODEX_PROVIDER, GROK_PROVIDER } = await import('../../self-implement/budget-gate.js');
-  const inputs = await readBudgetInputsLive(inputDeps);
+  const { budgetInputsWithLiveSupply } = await import('../../live-supply/budget-consumer.js');
+  const inputs = budgetInputsWithLiveSupply(await readBudgetInputsLive(inputDeps));
   const { decision } = harnessLaunchBudgetDecision(inputs, { ...(childLlm.provider ? { childLlmProvider: childLlm.provider } : {}), ...(childLlm.model ? { childLlmModel: childLlm.model } : {}) });
   const provider = decision.provider ?? childLlm.provider ?? 'chain';
   const used = provider === GROK_PROVIDER
@@ -1582,6 +1619,22 @@ export function repairPodExitCode(input: { state: string; repairCommitOnly: bool
   return input.disposition?.stage !== 'host-regate-failed' && input.disposition?.ok !== false ? 0 : 1;
 }
 
+export function parsePodRepairExportEvidence(output: string): { exportExitCode: number | null; podExitCode: number | null; exported: boolean;
+  reasonCode: 'none' | 'no-new-commit' | 'source-head-mismatch' | 'export-failed' } | null {
+  const outcomes = [
+    ...[...output.matchAll(/^ELANOUS_POD_REPAIR_FAILED ([^\r\n]+)$/gm)].map((match) => ({ index: match.index!, failure: match[1]! })),
+    ...[...output.matchAll(/^ELANOUS_POD_REPAIR_COMMIT ([1-9]\d*) ([0-9a-f]{40}) ([0-9a-f]{40})$/gm)].map((match) => ({ index: match.index!, failure: null })),
+  ].sort((a, b) => a.index - b.index);
+  const outcome = outcomes.at(-1);
+  if (!outcome) return null;
+  const podRc = [...output.matchAll(/__ELANOUS_POD_DONE__[^\r\n]*\brc=(\d+)/g)].at(-1)?.[1];
+  const reasonCode = outcome.failure === null ? 'none' : outcome.failure === 'repair made no new commit' ? 'no-new-commit'
+    : outcome.failure === 'source-head-mismatch' ? 'source-head-mismatch' : 'export-failed';
+  const exported = outcome.failure === null;
+  return { exportExitCode: exported ? 0 : reasonCode === 'source-head-mismatch' ? null : 1,
+    podExitCode: podRc === undefined ? null : Number(podRc), exported, reasonCode };
+}
+
 export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplementJobSpawn {
   if (options.repairCommitOnly && (options.source?.kind !== 'pr' || options.source.number !== options.repairCommitOnly.pr || !/^[0-9a-f]{40}$/.test(options.repairCommitOnly.baseHead))) {
     throw new Error('repair commit-only requires a matching PR source and exact head');
@@ -1599,6 +1652,46 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
   const resultMarkerOn = options.resultMarker ?? !options.kubectl;
   const writeWarmLedger = options.siWarmLedger
     ?? ((entry: RunLedgerEntry) => appendRunLedgerEntry(entry, runLedgerDir(env.ELANOUS_STATE_DIR)));
+  const recordFinalTaskFailure = (input: Parameters<SelfImplementJobSpawn>[0], result: SelfImplementJobDone,
+    ledgerStartIndex: number): SelfImplementJobDone => {
+    // Match createSelfImplementAdapter: a nonzero process exit is failed even if it also emitted an ok disposition.
+    if (result.error?.code === 'aborted' || (result.exitCode === 0 && result.disposition?.ok !== false)) return result;
+    const ledgerRunId = env.ELANOUS_RUN_ID ?? input.spaceId;
+    const ledgerDir = runLedgerDir(env.ELANOUS_STATE_DIR);
+    const job = podJobName(input.spaceId);
+    try {
+      const entries = loadRunLedger(ledgerRunId, ledgerDir) ?? [];
+      const currentEntries = entries.slice(ledgerStartIndex);
+      const childStart = currentEntries.slice().reverse().find((entry) => entry.event === 'pod-child-run' && entry.data?.job === job);
+      const childRunId = typeof childStart?.data?.childRunId === 'string' ? childStart.data.childRunId : null;
+      const attemptValue = childStart?.data?.attempt;
+      const attempt = typeof attemptValue === 'number' && Number.isSafeInteger(attemptValue) && attemptValue > 0 ? attemptValue : 1;
+      const evidence = childRunId ? currentEntries.slice().reverse().find((entry) => entry.event === 'pod-child-evidence'
+        && entry.data?.job === job && entry.data?.childRunId === childRunId) : undefined;
+      const childResult = evidence?.data?.childResult && typeof evidence.data.childResult === 'object'
+        ? evidence.data.childResult as Record<string, unknown> : undefined;
+      const rawError = typeof result.disposition?.error === 'string' && result.disposition.error.trim() ? result.disposition.error
+        : typeof childResult?.error === 'string' && childResult.error.trim() ? childResult.error
+          : result.error?.message ?? result.output;
+      const podTermination = evidence?.data?.podTermination && typeof evidence.data.podTermination === 'object'
+        ? evidence.data.podTermination : null;
+      appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-task-failure', data: {
+        spaceId: input.spaceId,
+        taskId: input.taskId ?? null,
+        job,
+        attempt,
+        childRunId,
+        childStage: typeof result.disposition?.stage === 'string' ? result.disposition.stage
+          : typeof childResult?.stage === 'string' ? childResult.stage : 'unknown',
+        childError: redactSecretText(rawError).replace(/\s+/gu, ' ').trim().slice(0, 500) || 'unknown',
+        podTermination,
+      } }, ledgerDir);
+    } catch (error) {
+      debug.log('self-implement.pod', 'task-failure-write-failed', { job, childRunId: null,
+        reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' });
+    }
+    return result;
+  };
   return (input) => {
     if (options.repairCommitOnly && (input.autoMerge || input.openPr || input.base !== `pr-${options.repairCommitOnly.pr}`)) {
       throw new Error('repair commit-only refuses auto merge, new PR, or a different base');
@@ -1606,7 +1699,39 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
     if (options.siWarmAttempt && !options.siWarmHostPostprocess) {
       throw new Error('si-v1 warm execution requires cold-path host postprocess parity');
     }
-    if (options.siWarmAttempt) {
+    const taskLedgerDir = runLedgerDir(env.ELANOUS_STATE_DIR);
+    let taskLedgerStartIndex = Number.MAX_SAFE_INTEGER;
+    try { taskLedgerStartIndex = (loadRunLedger(env.ELANOUS_RUN_ID ?? input.spaceId, taskLedgerDir) ?? []).length; }
+    catch (error) { debug.log('self-implement.pod', 'task-failure-baseline-unavailable', {
+      spaceId: input.spaceId, reason: error instanceof Error ? error.message : String(error),
+    }, { level: 'warn' }); }
+    const recordFailure = (result: SelfImplementJobDone) => recordFinalTaskFailure(input, result, taskLedgerStartIndex);
+    const recordRejectedFailure = (error: unknown): never => {
+      if (!input.signal?.aborted && !(error instanceof Error && error.name === 'AbortError')) {
+        recordFailure({ exitCode: 1, output: '', error: { code: 'pod-promise-rejected', message: error instanceof Error ? error.message : String(error) } });
+      }
+      throw error;
+    };
+    let siWarmEnabled = true;
+    const taskCard = env.ELANOUS_POD_TASK_CARD ?? env.ELANOUS_TASK_CARD_ID;
+    if (taskCard) {
+      let stage: 'config' | 'evidence' | 'decision' = 'config';
+      try {
+        const config = options.warmReuseConfig?.();
+        stage = 'evidence';
+        const evidence = options.warmReuseEvidence?.();
+        stage = 'decision';
+        const decision = decideWarmReuse('ta', config, evidence);
+        siWarmEnabled = decision.live;
+        debug.log('pod.warm', 'ta-admission-decision', { ...decision,
+          execution: decision.live ? 'warm-attempt' : 'fresh-job' });
+      } catch {
+        siWarmEnabled = false;
+        debug.log('pod.warm', 'ta-admission-unavailable', { spaceId: input.spaceId,
+          reason: stage === 'decision' ? 'warm-decision-failed' : `injected-${stage}-failed`, execution: 'fresh-job' }, { level: 'warn' });
+      }
+    }
+    if (options.siWarmAttempt && siWarmEnabled) {
       const done = (async (): Promise<SelfImplementJobDone> => {
         // POD-REUSE-REQUEST-CLEAN-FU — one fail-soft row per request decision. `runId` is the
         // ledger partition (warm child, then parent run, then the legacy spaceId fallback);
@@ -1901,7 +2026,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           return { exitCode: 1, output: log.slice(-4096), disposition: hostDisposition,
             error: { code: 'si-warm-host-postprocess-failed', message } };
         }
-      })();
+      })().then(recordFailure, recordRejectedFailure);
       return { address: `self-impl:${input.spaceId}`, done };
     }
     const name = podJobName(input.spaceId);
@@ -2067,6 +2192,23 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         const detail = unfit.map((u) => `${u.context} ${Math.round(u.allocatableMemoryBytes / 2 ** 30 * 10) / 10}GiB`).join(' · ');
         return { exitCode: 1, output: '', error: { code: 'pod-pool-unfit', message: `모든 풀 멤버의 할당 가능 메모리가 이 Job 의 한도 ${memoryLimit} 보다 작다 — 영원히 배치될 수 없다(${detail}) · --pod-memory 를 낮추거나 다른 풀로` } };
       };
+      // PRLAND-OOM-RETRY-POOL-FIT: whether the NEXT memory limit can ever be placed decides the retry before
+      // anything is written or deleted. Read-only — an all-unfit pool ends the run here, so no retry intent
+      // is journaled, the OOM Job stays, and no second Job is applied. A fit member leaves the single retry intact.
+      const retryPoolFit = async (nextLimit: string, from: string): Promise<SelfImplementJobDone | null> => {
+        const pool = options.pool as { unfitMembers?: (b: number) => Promise<Array<{ context: string; allocatableMemoryBytes: number }>>; members?: readonly PodPoolMember[] } | undefined;
+        if (!pool || typeof pool.unfitMembers !== 'function' || !Array.isArray(pool.members) || !pool.members.length) return null;
+        const limitBytes = memoryQuantityBytes(nextLimit);
+        if (limitBytes === null) return null;
+        const unfit = await pool.unfitMembers(limitBytes);
+        const unfitContextsForRetry = new Set(unfit.map((u) => u.context));
+        const fit = pool.members.filter((m) => !unfitContextsForRetry.has(m.context)).map((m) => m.context);
+        debug.log('self-implement.pod', 'oom-retry-pool-fit', { job: name, from, to: nextLimit, fit, unfit: unfit.map((u) => u.context) }, { level: fit.length ? 'info' : 'warn' });
+        if (fit.length) return null;
+        const detail = unfit.map((u) => `${u.context} ${Math.round(u.allocatableMemoryBytes / 2 ** 30 * 10) / 10}GiB`).join(' · ');
+        const poolLimit = `${Math.round(Math.max(...unfit.map((u) => u.allocatableMemoryBytes)) / 2 ** 30 * 10) / 10}GiB`;
+        return { exitCode: 1, output: '', error: { code: 'pod-pool-unfit', message: `Job ${name} 이 OOMKilled(137) 로 ${from} 에서 죽었고 다음 한도는 ${nextLimit} 이지만 어느 풀 멤버도 그 한도를 받을 수 없다 — 재시도 Job 을 만들 수 없다(필요 ${nextLimit} · 풀 한계 ${poolLimit} · ${detail}) · --pod-memory 를 낮추거나 다른 풀로` } };
+      };
       const acquireSlot = async (): Promise<PodPoolMember | null> => {
         if (!options.pool) return null;
         // Each actual acquisition is a separate observation, including the OOM retry in this
@@ -2087,11 +2229,15 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
             if (input.signal?.aborted) return null;
             // The reason comes back inside this call, so a concurrent launch cannot overwrite it.
             const kind = podPlacementKind(oomRetried ? retryTier : memoryTier, selectedGoalType, requestKind);
-            const acquired = await options.pool.tryAcquire(unfitContexts, (reason) => {
-              stageReason['pool-slot'] = reason;
-              firstSlotReasonCode ??= slotReasonCode(reason);
-            },
-              { kind, ...(minihLocation ? { minihLocation } : {}), onPlacement: (placement) => { lastPlacement = placement; } });
+            const acquired = await acquirePodPoolSlot({ entry: env[POD_DISTRIBUTOR_ENTRY_ENV], pool: options.pool,
+              ...(options.podDistributorAdapter ? { adapter: options.podDistributorAdapter } : {}),
+              request: { requestId: attempt.observationKey, idempotencyKey: attempt.observationKey,
+                owner: { runId: childRunId, ...(env.ELANOUS_TASK_CARD_ID ? { cardId: env.ELANOUS_TASK_CARD_ID } : {}),
+                  ...(env.ELANOUS_POD_OWNER_KIND === 'seat' && env.ELANOUS_POD_OWNER_ID ? { seat: env.ELANOUS_POD_OWNER_ID } : {}) },
+                lane: 'ta', workload: { memoryLimit, kind }, skip: unfitContexts, onEmpty: (reason) => {
+                stageReason['pool-slot'] = reason;
+                firstSlotReasonCode ??= slotReasonCode(reason);
+              }, mode: { kind, ...(minihLocation ? { minihLocation } : {}), onPlacement: (placement) => { lastPlacement = placement; } } } });
             if (acquired) {
               recordSlotObservation(attempt, 'admitted', firstSlotReasonCode ?? 'admitted');
               debug.log('self-implement.pod', 'pool-slot', { spaceId: input.spaceId, context: acquired.context, inflight: options.pool.snapshot(), ...(lastPlacement ? { placement: lastPlacement } : {}) });
@@ -2125,8 +2271,9 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
       if (unfitDone) return unfitDone;
       // HARNESS-FULL-GRAPH — Pod 입장(입장 관문 ⊕ 멤버 슬롯)은 그래프 노드 pool-admit 이다.
       // 2판: decompose →(substrate=pod) pool-admit 간선은 «여기»(Pod 입장 직전 · 실제 단계 경계)에서 남긴다.
-      if (options.repairCommitOnly) routeJourneyEdge('dispatch', 'pr-source', { source: 'pr', substrate: 'pod' });
-      else routeJourneyEdge('decompose', 'pod', { substrate: 'pod' });
+      const journeyRunId = parentRunId ?? childRunId;
+      if (options.repairCommitOnly) routeJourneyEdge('dispatch', 'pr-source', { source: 'pr', substrate: 'pod' }, { runId: journeyRunId });
+      else routeJourneyEdge('decompose', 'pod', { substrate: 'pod' }, { runId: journeyRunId });
       enterJourneyNode('pool-admit', { provenance: 'self-implement-pod', data: { spaceId: input.spaceId } });
       // ⛔ 감싸는 함수(async 래퍼)를 쓰지 않는다 — 마이크로태스크가 늘면 Job apply 순서가 밀린다(시험이 잡았다). 같은 자리 try/catch 로.
       const podAdmitError = (error: unknown): void => {
@@ -2168,14 +2315,41 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         } catch (error) { debug.log('self-implement.pod', 'failure-capture-ledger-unavailable', { job: name, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
       };
       let recorded = false;
+      let jobApplied = false;
       let groundingMinted: string | null = null;
       try {
       if (!context) return { exitCode: 1, output: '', error: { code: 'pod-context', message: 'Pod Job context를 확인할 수 없다' } };
-      const cleanupSecret = () => { kubectl(['-n', namespace, 'delete', 'secret', `${name}-creds`, '--ignore-not-found']); };
+      const cleanupSecret = () => {
+        // Once the Job exists, its credential Secret must live at least as long as the Job.
+        // Early error/abort paths may run while the Pod is still reading /creds; leave cleanup
+        // to the Job ownerReference/TTL until Kubernetes reports this Job terminal or absent.
+        if (jobApplied) {
+          const lifecycle = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.metadata.uid} {.status.active} {.status.succeeded} {.status.failed}']);
+          const [uid, , succeeded, failed] = lifecycle.stdout.trim().split(/\s+/u);
+          const terminal = Number(succeeded) > 0 || Number(failed) > 0;
+          if (lifecycle.status === 0 && uid && !terminal) {
+            debug.log('self-implement.pod', 'secret-cleanup-deferred-job-live', { job: name });
+            return;
+          }
+          if (lifecycle.status !== 0 && !/notfound/iu.test(lifecycle.stderr)) {
+            debug.log('self-implement.pod', 'secret-cleanup-deferred-job-unmeasured', { job: name }, { level: 'warn' });
+            return;
+          }
+        }
+        kubectl(['-n', namespace, 'delete', 'secret', `${name}-creds`, '--ignore-not-found']);
+      };
       let repairResultAnnounced = false;
       let repairArtifactReady = false;
       let hostOriginCalls: number | null = 0;
       let sourceBaseSha: string | undefined;
+      const recordSourceAttemptOutcome = (logs: string | null, captureStatus: 'captured' | 'logs-unavailable', observedChildRunId?: string) => {
+        const optionBaseSha = options.source && 'baseSha' in options.source ? options.source.baseSha : undefined;
+        const outcome = parsePodSourceAttemptOutcome(logs, { sourceKind: options.source?.kind ?? 'default', baseSha: sourceBaseSha ?? optionBaseSha });
+        const data = { job: name, childRunId: observedChildRunId ?? childRunId ?? null, attempt: oomRetried ? 2 : 1, captureStatus, ...outcome };
+        debug.log('pod.source', 'attempt-outcome', data, outcome.classification === 'status-not-recorded' ? { level: 'warn' } : undefined);
+        try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-source-attempt-outcome', data }, ledgerDir); }
+        catch (error) { debug.log('pod.source', 'attempt-outcome-ledger-unavailable', { job: name, childRunId: childRunId ?? null, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
+      };
       const collectFullLogs = (unavailableEvent: string, replace?: ReadonlySet<string>, onEvent?: (event: string, data: Record<string, unknown>) => void, childId?: string): { status: 'ok' | 'unavailable' | 'incomplete'; childLedgerIncomplete: boolean; samples: ReturnType<typeof parseMemSamples> } => {
         let full: ReturnType<Kubectl>;
         try {
@@ -2184,8 +2358,10 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           if (!full.stdout && unavailableEvent === 'failed-job-logs-unavailable') throw new Error('empty child logs');
         } catch (error) {
           debug.log('self-implement.pod', unavailableEvent, { job: name, reason: error instanceof Error ? error.message : String(error) });
+          recordSourceAttemptOutcome(null, 'logs-unavailable', childId);
           return { status: 'unavailable', childLedgerIncomplete: false, samples: [] };
         }
+        recordSourceAttemptOutcome(full.stdout, 'captured', childId);
         const via = /^ELANOUS_POD_SOURCE_VIA (image|mirror|github)\r?$/m.exec(full.stdout)?.[1];
         // #28246 names why the mirror was skipped on the line before `VIA github`; carry it on the same event.
         const mirrorSkip = /^ELANOUS_POD_SOURCE_MIRROR_SKIP (no-mount|rev-parse-failed|clone-failed)\r?$/m.exec(full.stdout)?.[1];
@@ -2212,6 +2388,11 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           collectPodArtifacts(full.stdout, { dir: join(effectiveInstanceRoot(), 'pod-artifacts'), job: name, log: record });
         }
         catch (error) { record('self-implement.pod', 'artifact-collect-incomplete', { job: name, reason: error instanceof Error ? error.message : String(error) }); }
+        const repairExportEvidence = options.repairCommitOnly ? parsePodRepairExportEvidence(full.stdout) : null;
+        if (repairExportEvidence) {
+          try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-repair-export', data: { job: name, ...repairExportEvidence } }, ledgerDir); }
+          catch (error) { record('self-implement.pod', 'repair-export-ledger-incomplete', { job: name, reason: error instanceof Error ? error.message : String(error) }); }
+        }
         for (const line of full.stdout.split(/\r?\n/)) {
           const bundle = /^ELANOUS_POD_SALVAGE_BUNDLE (pod-salvage\/[a-zA-Z0-9._-]+\.bundle) ([0-9]+) ([0-9]+)(?: ([0-9a-f]{40,64}))?$/.exec(line);
           if (bundle) {
@@ -2308,13 +2489,22 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         /** 넘친 glm Pod 는 자식 인자도 OpenRouter GLM 으로 — Job 스크립트·리뷰어 고정·키 전달이 openrouter 갈래를 그대로 탄다. */
         const jobArgs = zaiRoute === 'openrouter' ? zaiOverflowChildArgs(args, ZAI_OPENROUTER_FALLBACK_MODEL) : args;
         const grok = options.provider === 'grok';
-        const openrouter = options.provider === 'openrouter' || zaiRoute === 'openrouter';
+        // The delegated child provider is also a launch source. Callers that carry
+        // --child-llm-provider in args must not leave the host's Secret wiring on
+        // the default provider path.
+        const delegatedChildProvider = podDelegatedChildLlm(jobArgs)?.provider;
+        const openrouter = options.provider === 'openrouter' || zaiRoute === 'openrouter' || delegatedChildProvider === 'openrouter';
         const openGateway = options.provider === 'opengateway';
         const anthropic = options.provider === 'anthropic';
         const bedrockChild = options.provider === 'bedrock';
         const zaiChild = zaiRoute === 'zai';
         /** ZAI 로 입장한 자식도 플랜 한도 오류 뒤 OpenRouter 로 전환할 수 있다. 실행 중 폴백 자격을 발사 전에 확보한다. */
         const openrouterCredentialRequired = openrouter || (zaiChild && zaiLaunchOverage !== 'stop');
+        const hostConfig = (options.fallbackConfig ?? getUserConfig)();
+        const reviewProvider = resolveRoleLlm('review', { config: hostConfig, env: { ...env, ...options.armEnv } }).provider;
+        // A non-OpenRouter child can still run a review role pinned to OpenRouter. Pass that
+        // credential through the same Secret path, but don't make it a launch requirement.
+        const openrouterCredentialNeeded = openrouterCredentialRequired || reviewProvider === 'openrouter';
         /** API 키 자식 — codex 계정·자격 파일을 안 쓴다(키는 작업별 creds Secret 의 `env-<KEY>` · bedrock·glm 은 이름 있는 Secret 으로만). */
         const apiKeyChild = openrouter || openGateway || anthropic || bedrockChild || zaiChild;
         const plannedAccount = retryAccount ?? (grok ? 'grok' : openrouter ? 'openrouter' : openGateway ? 'opengateway' : anthropic ? 'anthropic' : bedrockChild ? 'bedrock' : zaiChild ? 'glm' : options.accountBroker?.() ?? options.account ?? 'team');
@@ -2358,7 +2548,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
           return credential;
         }) : undefined;
-        const openrouterKey = openrouterCredentialRequired ? env.OPENROUTER_API_KEY?.trim() || (options.readKeyCache ?? defaultReadKeyCache)('OPENROUTER_API_KEY')?.trim() : undefined;
+        const openrouterKey = openrouterCredentialNeeded ? env.OPENROUTER_API_KEY?.trim() || (options.readKeyCache ?? defaultReadKeyCache)('OPENROUTER_API_KEY')?.trim() : undefined;
         if (openrouterCredentialRequired && !openrouterKey) throw new Error('pod: Pod 에 openrouter 키 없음 — 호스트 키 캐시 또는 OPENROUTER_API_KEY 필요');
         const openGatewayEnvKey = openGateway ? env.OPENGATEWAY_API_KEY?.trim() : undefined;
         const openGatewayCachedKey = openGateway ? (options.readKeyCache ?? defaultReadKeyCache)('OPENGATEWAY_API_KEY')?.trim() : undefined;
@@ -2441,7 +2631,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
         }
         // Grok 자격은 전용 Secret 키 하나로만 보낸다 — passEnv 의 API 키 중복 전달은 막는다.
-        const passKeys = [...new Set([...(options.passEnv ?? []), ...(openrouterCredentialRequired ? ['OPENROUTER_API_KEY'] : []), ...(openGateway ? ['OPENGATEWAY_API_KEY'] : []), ...(anthropic ? ['ANTHROPIC_API_KEY'] : [])])].filter((key) => key !== 'ELANOUS_LIVE_DETAIL_UNTIL'
+        const passKeys = [...new Set([...(options.passEnv ?? []), ...(openrouterCredentialNeeded && openrouterKey ? ['OPENROUTER_API_KEY'] : []), ...(openGateway ? ['OPENGATEWAY_API_KEY'] : []), ...(anthropic ? ['ANTHROPIC_API_KEY'] : [])])].filter((key) => key !== 'ELANOUS_LIVE_DETAIL_UNTIL'
           && key !== POD_GITHUB_CREDENTIAL_TOKEN_ENV && key !== POD_GITHUB_CREDENTIAL_URL_ENV
           && (!grok || !['XAI_API_KEY', 'GROK_API_KEY', 'GROK_CODE_XAI_API_KEY'].includes(key)));
         const skillEnvs: Record<string, string> = options.skillEnv
@@ -2618,8 +2808,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
             authorChoice = { ...authorChoice, model: childModel, modelSource: 'fallback-child' };
           } else debug.log('self-implement.pod', 'role-llm-armed', { job: name, role: 'planning', model: authorChoice.model, source: authorChoice.modelSource, account: roleCodexAccount });
         }
-        const hostKey = (k: string): string | undefined => k === 'OPENROUTER_API_KEY' && openrouterCredentialRequired ? openrouterKey : k === 'OPENGATEWAY_API_KEY' && openGateway ? openGatewayKey : k === 'ANTHROPIC_API_KEY' && anthropic ? anthropicKey : env[k] ?? (options.readKeyCache ?? defaultReadKeyCache)(k);
-        const hostConfig = (options.fallbackConfig ?? getUserConfig)();
+        const hostKey = (k: string): string | undefined => k === 'OPENROUTER_API_KEY' && openrouterCredentialNeeded ? openrouterKey : k === 'OPENGATEWAY_API_KEY' && openGateway ? openGatewayKey : k === 'ANTHROPIC_API_KEY' && anthropic ? anthropicKey : env[k] ?? (options.readKeyCache ?? defaultReadKeyCache)(k);
         const hostFallbackNames = hostConfig.llm.fallbackChain;
         const zaiOverage = zaiLaunchOverage ?? zaiSettingsFromConfig(hostConfig.llm).overage;
         const normalizedFallback = normalizeFallbackChain(hostFallbackNames);
@@ -2876,22 +3065,6 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           slotId: env.ELANOUS_POD_SLOT_ID,
           work: !goalDoc && env.ELANOUS_POD_AUTHOR_ON_POD === '1' && !shard ? 'authoring' : (oomRetried ? retryTier : memoryTier) === 'lite' ? 'lite' : 'harness',
         };
-        // TA-POD-WARMBOOT-PARITY shadow only: read injected evidence, then keep the fresh-Job path.
-        // This boundary must not open host configuration or credential files for a warm decision.
-        if (workIdentity.taskCard) {
-          let stage: 'config' | 'evidence' | 'decision' = 'config';
-          try {
-            const config = options.warmReuseConfig?.();
-            stage = 'evidence';
-            const evidence = options.warmReuseEvidence?.();
-            stage = 'decision';
-            const decision = decideWarmReuse('ta', config, evidence);
-            debug.log('pod.warm', 'ta-shadow-observation', { ...decision, execution: 'fresh-job' });
-          } catch {
-            debug.log('pod.warm', 'ta-shadow-unavailable', { spaceId: input.spaceId,
-              reason: stage === 'decision' ? 'warm-decision-failed' : `injected-${stage}-failed`, execution: 'fresh-job' }, { level: 'warn' });
-          }
-        }
         // TA-POD-WARMBOOT-PARITY (GATE-WARM-BOOT parity · #27805): a commit-pinned source on a pool host — put that commit into
         // the host mirror first (once per host·commit in this process) so podSourceScript finds it instead of fetching
         // from GitHub. Best effort: a failed seed only logs; the Job is applied either way.
@@ -2968,6 +3141,19 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         const a = kubectl(['apply', '-f', '-'], JSON.stringify(job));
         zaiPendingApply.delete(name);   // apply 뒤엔 Job 라벨이 센다(성공) · 실패면 셀 것이 없다
         if (a.status !== 0) { cleanupSecret(); return { exitCode: 1, output: a.stderr, error: { code: 'pod-apply', message: a.stderr.trim() } }; }
+        jobApplied = true;
+        // Bind the credential Secret immediately after Job creation, before waiting for a Pod
+        // or doing any other fallible work. Kubernetes then removes both on Job TTL cleanup.
+        const jobUid = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.metadata.uid}']);
+        const uid = jobUid.status === 0 ? jobUid.stdout.trim() : '';
+        lifecycleJobUid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(uid) ? uid : undefined;
+        if (lifecycleJobUid) {
+          const owned = kubectl(['-n', namespace, 'patch', 'secret', `${name}-creds`, '--type=merge', '-p', JSON.stringify({ metadata: { ownerReferences: [{ apiVersion: 'batch/v1', kind: 'Job', name, uid: lifecycleJobUid }] } })]);
+          if (owned.status !== 0) debug.log('self-implement.pod', 'secret-owner-failed', { job: name, stderr: owned.stderr.trim() }, { level: 'warn' });
+          else debug.log('self-implement.pod', 'secret-owner-attached', { job: name, owner: 'job' });
+        } else {
+          debug.log('self-implement.pod', 'secret-owner-job-uid-unavailable', { job: name }, { level: 'warn' });
+        }
         releaseAdmission?.applied?.(name, context, namespace);
         try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-config-snapshot', data: {
           job: name, hash: configSnapshot.hash, keyCount: configSnapshot.keyCount,
@@ -3030,13 +3216,6 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
           debug.log('self-implement.pod', 'source-delivered', { job: name, kind: 'bundle', headCommit: options.source.headCommit });
         }
-        // ☸️ P2: 비밀의 소유자 = Job — 호스트가 죽어도 Job 의 TTL 삭제와 함께 k8s 가 비밀을 거둔다(자격 사본이 클러스터에 남지 않는다).
-        const uid = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.metadata.uid}']).stdout.trim();
-        lifecycleJobUid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(uid) ? uid : undefined;
-        if (uid) {
-          const owned = kubectl(['-n', namespace, 'patch', 'secret', `${name}-creds`, '--type=merge', '-p', JSON.stringify({ metadata: { ownerReferences: [{ apiVersion: 'batch/v1', kind: 'Job', name, uid }] } })]);
-          if (owned.status !== 0) debug.log('self-implement.pod', 'secret-owner-failed', { job: name, stderr: owned.stderr.trim() }, { level: 'warn' });
-        }
         }
         try {
           appendRunLedgerEntry({ runId: ledgerRunId, timestamp: new Date((options.now ?? Date.now)()).toISOString(),
@@ -3216,11 +3395,11 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
             if (seen !== null) {
               releaseAdmission?.observed?.();
               state = seen === 0 ? 'complete' : 'failed';
-              // The child's own rc is the parent's exit code even when 0 — the condition path below yields none here.
+              // The shared marker is authoritative while Pod status lags; preserve the child's rc, including 0, on the parent.
               containerExitCode = seen;
               if (seen !== 0) podTermination = readPodTermination({ kubectl, namespace, job: name, path: 'result-marker', jobUid: lifecycleJobUid });
               if (seen !== 0) captureFailedJob(liveChildRunId);
-              debug.log('self-implement.pod', 'result-marker-early', { job: name, waitedMs: Date.now() - waitStartedAt, rc: seen });
+              debug.log('self-implement.pod', 'result-marker-early', { job: name, runId: liveChildRunId, waitedMs: Date.now() - waitStartedAt, rc: seen });
               break;
             }
           }
@@ -3327,6 +3506,32 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         for (const row of usagePlan.rows) debug.log(row.category, row.event, row.data);
         const parsed = parseSelfImplementJson(logs);
         const terminal = parseSelfImplementJson(logs.trimEnd().split('\n').at(-1) ?? '');
+        const terminalObservation = podChildTerminalResultObservation(logs);
+        const providerSignature = {
+          grokUnavailableCount: logs.match(/Grok unavailable:\s*run `grok login`/gu)?.length ?? 0,
+          structuredProviderErrors: terminal?.providerErrors ?? parsed?.providerErrors ?? null,
+        };
+        const childResultObservation = {
+          job: name,
+          childRunId: liveChildRunId,
+          jobState: state,
+          containerExitCode: containerExitCode ?? null,
+          ledgerCompleteness,
+          terminalResultObserved: terminalObservation.observed,
+          terminalStage: terminalObservation.stage,
+          terminalOk: terminalObservation.ok,
+          terminalOutcome: terminalObservation.outcome,
+          terminalFailureClassification: terminalObservation.failureClassification,
+          providerSignature,
+        };
+        debug.log('self-implement.pod', 'child-terminal-result-observed', childResultObservation);
+        try {
+          appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-child-terminal-result-observation', data: childResultObservation }, ledgerDir);
+        } catch (error) {
+          debug.log('self-implement.pod', 'child-terminal-result-observation-write-failed', {
+            job: name, childRunId: liveChildRunId, reason: error instanceof Error ? error.message : String(error),
+          }, { level: 'warn' });
+        }
         const nextAccount = codexAccounts?.find((candidate) => candidate !== account);
         if (state === 'failed' && containerExitCode === 7 && !input.signal?.aborted) {
           debug.log('self-implement.pod', 'gh-login-failed', { job: name, attempt: ghLoginRetried ? 2 : 1, tokenExpiresInSec: ghTokenExpiresAt === null ? null : Math.floor((ghTokenExpiresAt - now()) / 1000) });
@@ -3487,11 +3692,24 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           };
         }
         let noResultDiagnostic: string | null = null;
+        let noResultLedgerObservation: { available: boolean; bytes: number; rows: number; lastEvent: string | null } = {
+          available: false, bytes: 0, rows: 0, lastEvent: null,
+        };
         // POD-NORESULT: a terminal Job without a parsed disposition is incomplete even when the Job condition says Complete.
         const noResultCandidate = !podVanished && !disposition && !oomKilled && failedReason !== 'DeadlineExceeded' &&
           (state === 'complete' || (state === 'failed' && containerExitCode !== 0));
         if (noResultCandidate) {
-          try { noResultDiagnostic = podNoResultDiagnostic(readFileSync(runLedgerPath(liveChildRunId, ledgerDir), 'utf8')); }
+          try {
+            const ledgerText = readFileSync(runLedgerPath(liveChildRunId, ledgerDir), 'utf8');
+            const ledgerRows = ledgerText.split('\n').filter(Boolean);
+            let lastEvent: string | null = null;
+            try {
+              const parsed = JSON.parse(ledgerRows.at(-1) ?? 'null') as { event?: unknown } | null;
+              lastEvent = typeof parsed?.event === 'string' ? parsed.event : null;
+            } catch { /* Keep counts when the last ledger row is malformed. */ }
+            noResultLedgerObservation = { available: true, bytes: Buffer.byteLength(ledgerText), rows: ledgerRows.length, lastEvent };
+            noResultDiagnostic = podNoResultDiagnostic(ledgerText);
+          }
           catch { /* ledger not returned: do not invent a stage */ }
           noResultDiagnostic ??= 'child terminal result missing; last ledger stage=unknown; round=unknown; mustFix=unknown';
         }
@@ -3503,20 +3721,41 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         const missingStage = noResultDiagnostic?.includes('stage=unknown') ?? false;
         if (shouldCaptureFailureLog || missingStage) {
           const logRead = readPodNoResultLogTail({ run: kubectl, namespace, job: name, maxLines: POD_NO_RESULT_LOG_TAIL_LINES });
+          const logObservation = 'tail' in logRead
+            ? { available: true, readState: 'tail-read', lines: logRead.tail.length, normalizedTailBytes: Buffer.byteLength(logRead.tail.join('\n')) }
+            : { available: false, readState: logRead.unavailable === 'empty log output' ? 'empty' : 'read-failed', reason: logRead.unavailable, lines: 0, normalizedTailBytes: 0 };
+          const childLedgerResultMissing = noResultCandidate && Boolean(noResultDiagnostic?.includes('child terminal result missing'));
+          const observation = {
+            classification: disposition ? 'result-parsed' : 'insufficient-evidence',
+            noResultCandidate,
+            launchRunIdPresent: Boolean(liveChildRunId),
+            childLedger: noResultCandidate ? noResultLedgerObservation : null,
+            childLedgerResultPresent: noResultCandidate ? !childLedgerResultMissing : null,
+            resultParsed: Boolean(disposition),
+            resultLineObserved: Boolean(terminal),
+            pod: { jobReason: failedReason ?? null, containerReason: containerReason ?? null, exitCode: containerExitCode ?? null },
+            childLog: logObservation,
+            missing: [
+              ...(noResultCandidate && !noResultLedgerObservation.available ? ['child-ledger'] : []),
+              ...(childLedgerResultMissing ? ['child-ledger-result'] : []),
+              ...(!disposition ? ['child-result-line', 'child-result-classification'] : []),
+              ...(!logObservation.available ? ['child-log-cause-lines'] : []),
+            ],
+          };
           if ('tail' in logRead) {
             noResultLogEvidence = missingStage
-              ? { stderr: logRead.tail.join('\n'), logTail: logRead.tail, logTailLines: logRead.tail.length }
-              : { podLogTail: logRead.tail, podLogTailLines: logRead.tail.length };
+              ? { stderr: logRead.tail.join('\n'), logTail: logRead.tail, logTailLines: logRead.tail.length, observation }
+              : { podLogTail: logRead.tail, podLogTailLines: logRead.tail.length, observation };
             debug.log('self-implement.pod', missingStage ? 'no-result-log-tail' : 'failed-pod-log-tail', {
-              job: name, childRunId: liveChildRunId, diagnostic: noResultDiagnostic, lines: logRead.tail.length, logTail: logRead.tail,
+              job: name, childRunId: liveChildRunId, diagnostic: noResultDiagnostic, ...observation, lines: logRead.tail.length, logTail: logRead.tail,
             }, { compact: { stringMax: 500 } });
           } else {
             const unavailable = `log-unavailable: ${logRead.unavailable}`;
             noResultLogEvidence = missingStage
-              ? { stderr: unavailable }
-              : { podLogUnavailable: logRead.unavailable };
+              ? { stderr: unavailable, observation }
+              : { podLogUnavailable: logRead.unavailable, observation };
             debug.log('self-implement.pod', missingStage ? 'no-result-log-tail' : 'failed-pod-log-tail', {
-              job: name, childRunId: liveChildRunId, diagnostic: noResultDiagnostic,
+              job: name, childRunId: liveChildRunId, diagnostic: noResultDiagnostic, ...observation,
               logUnavailable: missingStage ? unavailable : logRead.unavailable,
             }, { level: 'warn' });
           }
@@ -3631,6 +3870,9 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
           if (actual < (memoryGi(nextLimit) ?? actual)) {
             const from = reattachedMemoryLimit ?? memoryLimit;
+            // A retry nobody can place is not a retry: decide pool fitness for the next limit first.
+            const retryUnfit = await retryPoolFit(nextLimit, from);
+            if (retryUnfit) return retryUnfit;
             appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-oom-retry-intent', data: { attempt: 2, from, to: nextLimit, tier: nextTier, reason: 'OOMKilled', job: name, executionKey, fromChildRunId: liveChildRunId } }, ledgerDir);
             debug.log('self-implement.pod', 'oom-retry', { from, to: nextLimit, tier: nextTier, reason: 'OOMKilled', job: name });
             const deleted = kubectl(['-n', namespace, 'delete', 'job', name, '--ignore-not-found', '--wait=true']);
@@ -3678,6 +3920,12 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         }
         // The host still has the complete Pod log here. The CLI only retains a short stdout tail,
         // so preserve the parsed child facts in the parent ledger before that tail is returned.
+        // OBS-GAP-BATCH-1030 — 자식 LLM 실패의 공급자·HTTP status 를 부모 원장 행에 붙인다.
+        // 줄이 공급자를 이름하지 않으면 이 Pod 의 자식 provider(Pod 옵션 ⊕ 위임 플래그)를 정규 id 로만 쓴다.
+        // ⛔ 본문·자격증명은 담지 않는다 — 귀속은 두 스칼라뿐이다.
+        const childProviderFailure = podChildProviderFailureFact(logs, {
+          providerHint: options.provider ?? podChildProviderOf(podDelegatedChildLlm(jobArgs)?.provider),
+        });
         const childEvidenceRow = podChildEvidenceLedgerRow({
           job: name,
           childRunId: liveChildRunId,
@@ -3686,6 +3934,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           noResultDiagnostic,
           noResultLogEvidence,
           podTermination,
+          providerFailure: childProviderFailure,
         });
         if (childEvidenceRow) {
           // Every terminal attempt writes a marker, including one with no parseable child facts.
@@ -3807,7 +4056,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
       } finally {
         releaseAdmission?.();
       }
-    })();
+    })().then(recordFailure, recordRejectedFailure);
     return { address, done };
   };
 }
@@ -3975,6 +4224,43 @@ export function readPodNoResultLogTail(args: {
   }
 }
 
+/** Keep the terminal result row separate from provider-error text in the same child log. */
+function podChildTerminalResultObservation(logs: string): {
+  observed: boolean;
+  stage: string | null;
+  ok: boolean | null;
+  outcome: string | null;
+  failureClassification: string | null;
+} {
+  const lines = logs.split(/\r\n|\n|\r/u);
+  for (let index = lines.length - 1; index >= 0; index--) {
+    const line = lines[index]!.trim();
+    if (!line.startsWith('{')) continue;
+    let value: unknown;
+    try { value = JSON.parse(line); } catch { continue; }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) continue;
+    const row = value as Record<string, unknown>;
+    const terminal = podTerminalRow(row);
+    if (!terminal) continue;
+    const nested = (row.kind === 'self' || row.kind === 'external')
+      && row.result && typeof row.result === 'object' && !Array.isArray(row.result)
+      ? row.result as Record<string, unknown> : row;
+    const abandoned = nested.abandonedClassification && typeof nested.abandonedClassification === 'object'
+      && !Array.isArray(nested.abandonedClassification) ? nested.abandonedClassification as Record<string, unknown> : null;
+    return {
+      observed: true,
+      stage: terminal.stage,
+      ok: terminal.ok,
+      outcome: typeof nested.outcome === 'string' ? nested.outcome
+        : typeof nested.completionDisposition === 'string' ? nested.completionDisposition
+          : typeof nested.terminationReason === 'string' ? nested.terminationReason : null,
+      failureClassification: typeof nested.failureClassification === 'string' ? nested.failureClassification
+        : typeof abandoned?.classification === 'string' ? abandoned.classification : null,
+    };
+  }
+  return { observed: false, stage: null, ok: null, outcome: null, failureClassification: null };
+}
+
 /** 사람용 런 결과 한 줄 — 수확 브랜치가 있으면 «수확할 브랜치: …» 를 붙인다. */
 export function podRunResultLine(logs: string, branches: readonly string[]): string {
   const result = logs.split('\n').filter((line) => !line.startsWith('ELANOUS_MEM ')).join('\n').slice(-4000);