elanous 0.2.42 → 0.2.44

package/src/task-orchestrator/surfaces/pod-ledger-events.ts

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { podTerminalRow } from './pod-failure-reason.js';
 
 /** Capture a failed Job against its recorded placement, never the caller's current kubectl context. */
 export function captureFailedPodJobs(input: {
@@ -39,10 +40,14 @@ export function captureFailedPodJobs(input: {
     finish('failed', 'placement-conflict'); return;
   }
   const location = { host: first.host, context: first.context, namespace: first.namespace, childRunId: first.childRunId, jobUid: first.jobUid };
+  const childRows = rows.filter(row => row.event === 'pod-child-run' && row.data?.job === job
+    && row.data.childRunId === first.childRunId && Number.isSafeInteger(row.data.attempt)
+    && (row.data.attempt as number) > 0);
+  const attempt = childRows.length ? childRows[childRows.length - 1]!.data!.attempt as number : undefined;
   const evidenceDir = join(artifactDir, 'pod-failure-capture', runId, job, first.childRunId as string);
   // A failed kubectl/SSH read is itself the missing diagnostic. Keep its stderr in
   // the private artifact directory and put only the path and exit status in the ledger.
-  const readFailure = (reason: string, result: { status: number | null; stderr: string }, extra: Record<string, unknown> = {}): void => {
+  const captureStderr = (reason: string, result: { status: number | null; stderr: string }): Record<string, unknown> => {
     let stderrEvidence: string | null = null;
     let stderrCaptureStatus: 'saved' | 'redacted' | 'empty' | 'write-failed' = result.stderr ? 'saved' : 'empty';
     if (result.stderr) {
@@ -61,19 +66,40 @@ export function captureFailedPodJobs(input: {
         }
       } catch { stderrEvidence = null; stderrCaptureStatus = 'write-failed'; }
     }
-    finish('failed', reason, { ...location, ...extra, kubectlStatus: result.status, stderrEvidence, stderrCaptureStatus });
+    return { kubectlStatus: result.status, stderrEvidence, stderrCaptureStatus };
+  };
+  const readFailure = (reason: string, result: { status: number | null; stderr: string }, extra: Record<string, unknown> = {}): void => {
+    finish('failed', reason, { ...location, ...extra, ...captureStderr(reason, result) });
   };
   const previous = rows.find(row => row.event === 'pod-failure-capture' && row.data?.job === job && row.data?.outcome === 'collected'
     && row.data.childRunId === first.childRunId && row.data.jobUid === first.jobUid
     && row.data.host === first.host && row.data.context === first.context && row.data.namespace === first.namespace);
+  const priorLogEvidence = previous?.data?.logEvidence;
+  const priorPreviousLogEvidence = previous?.data?.previousLogEvidence;
+  const priorCurrentReadStatus = previous?.data?.currentLogReadStatus;
+  const priorPreviousReadStatus = previous?.data?.previousLogReadStatus;
   // A ledger row describes a prior collection; it does not guarantee that its files survived.
-  // Check all three expected paths before treating it as complete, then recapture any missing evidence.
-  if (previous && ([['jobEvidence', 'job.json'], ['podEvidence', 'pods.json'], ['logEvidence', 'child.log']] as const)
+  // Validate the required artifacts and every log artifact claimed by the prior row before deduping.
+  // Unknown restart count is terminal for this Job snapshot: another identical Pod read cannot recover it.
+  const previousReadComplete = priorCurrentReadStatus === 'captured'
+    ? ['captured', 'empty', 'not-needed', 'unknown'].includes(String(priorPreviousReadStatus))
+    : priorCurrentReadStatus === 'empty' && priorPreviousReadStatus === 'captured';
+  const currentLogEvidencePresent = priorCurrentReadStatus === 'captured'
+    && priorLogEvidence === join(evidenceDir, 'child.log')
+    && (() => { try { return statSync(priorLogEvidence).isFile(); } catch { return false; } })();
+  const previousLogEvidencePresent = priorPreviousReadStatus === 'captured'
+    && priorPreviousLogEvidence === join(evidenceDir, 'child.previous.log')
+    && (() => { try { return statSync(priorPreviousLogEvidence).isFile(); } catch { return false; } })();
+  const logEvidenceComplete = currentLogEvidencePresent
+    ? priorPreviousReadStatus !== 'captured' || previousLogEvidencePresent
+    : priorCurrentReadStatus === 'empty' && previousLogEvidencePresent;
+  if (previous && previousReadComplete && ([['jobEvidence', 'job.json'], ['podEvidence', 'pods.json']] as const)
     .every(([field, filename]) => {
       const path = join(evidenceDir, filename);
       if (previous.data?.[field] !== path) return false;
       try { return statSync(path).isFile(); } catch { return false; }
-    })) return;
+    })
+    && logEvidenceComplete) return;
   const args = ['--context', first.context as string, '-n', first.namespace as string] as const;
   try {
     const jobResult = kubectl(first.host as string, [...args, 'get', 'job', job, '-o', 'json']);
@@ -103,23 +129,88 @@ export function captureFailedPodJobs(input: {
     });
     const podResult = kubectl(first.host as string, [...args, 'get', 'pods', '-l', `job-name=${job}`, '-o', 'json']);
     if (podResult.status !== 0) { readFailure('pods-read-failed', podResult, { jobEvidence }); return; }
-    const pods = JSON.parse(podResult.stdout) as { items?: Array<{ metadata?: { name?: string; ownerReferences?: Array<{ uid?: string }> } }> };
+    const pods = JSON.parse(podResult.stdout) as { items?: Array<{
+      metadata?: { name?: string; uid?: string; ownerReferences?: Array<{ uid?: string }> };
+      status?: { phase?: string; containerStatuses?: Array<{ name?: string; restartCount?: number;
+        state?: { terminated?: { reason?: string; exitCode?: number; finishedAt?: string } } }> };
+    }> };
     if (!pods.items?.length || pods.items.some(p => !p.metadata?.ownerReferences?.some(owner => owner.uid === jobBody.metadata?.uid))) {
       finish('failed', 'pod-owner-mismatch', { ...location, jobEvidence }); return;
     }
     const podEvidence = save('pods.json', podResult.stdout);
-    const podName = pods.items[0]?.metadata?.name;
+    const pod = pods.items[0]!;
+    const podName = pod.metadata?.name;
     if (pods.items.length !== 1 || !podName || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(podName)) {
       finish('failed', 'pod-ambiguous', { ...location, jobEvidence, podEvidence }); return;
     }
+    const childStatus = pod.status?.containerStatuses?.find(status => status.name === 'child');
+    const terminated = childStatus?.state?.terminated;
+    const shortCode = (value: unknown): string | undefined => typeof value === 'string' && /^[A-Za-z0-9_.:-]{1,64}$/.test(value) && !SECRET_VALUE.test(value) ? value : undefined;
+    const numeric = (value: unknown): number | undefined => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
+    const exitCode = (value: unknown): number | undefined => typeof value === 'number' && Number.isSafeInteger(value) ? value : undefined;
+    const restartCount = numeric(childStatus?.restartCount);
+    const podSummary: Record<string, unknown> = {
+      ...location,
+      ...(attempt !== undefined ? { attempt } : {}), podName,
+      ...(shortCode(pod.metadata?.uid) ? { podUid: shortCode(pod.metadata?.uid) } : {}),
+      ...(shortCode(pod.status?.phase) ? { podPhase: shortCode(pod.status?.phase) } : {}),
+      ...(shortCode(terminated?.reason) ? { containerReason: shortCode(terminated?.reason) } : {}),
+      ...(exitCode(terminated?.exitCode) !== undefined ? { containerExitCode: exitCode(terminated?.exitCode) } : {}),
+      ...(typeof terminated?.finishedAt === 'string' && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?Z$/.test(terminated.finishedAt) ? { containerFinishedAt: terminated.finishedAt } : {}),
+      ...(restartCount !== undefined ? { containerRestartCount: restartCount } : {}),
+    };
     const logs = kubectl(first.host as string, [...args, 'logs', `pod/${podName}`, '-c', 'child']);
-    if (logs.status !== 0) { readFailure('logs-read-failed', logs, { jobEvidence, podEvidence }); return; }
-    if (!logs.stdout.trim()) { finish('failed', 'logs-empty', { ...location, jobEvidence, podEvidence }); return; }
-    const logEvidence = save('child.log', logs.stdout);
-    finish('collected', 'job-failed', { ...location, jobEvidence, podEvidence, logEvidence });
+    const currentLogReadStatus = logs.status === 0 ? (logs.stdout.trim() ? 'captured' : 'empty') : 'failed';
+    const currentLogBytes = logs.status === 0 ? Buffer.byteLength(logs.stdout) : 0;
+    let logEvidence: string | undefined;
+    let previousLogEvidence: string | undefined;
+    let previousLogReadStatus = restartCount === undefined || restartCount > 0 ? 'unknown' : 'not-needed';
+    let previousLogBytes: number | undefined;
+    let previousLogFailure: Record<string, unknown> = {};
+    let resultMarkerPresent = false;
+    if (logs.status === 0 && logs.stdout.trim()) {
+      logEvidence = save('child.log', logs.stdout);
+      resultMarkerPresent = hasTerminalMarker(logs.stdout);
+    }
+    if (restartCount !== undefined && restartCount > 0) {
+      const previousLogs = kubectl(first.host as string, [...args, 'logs', `pod/${podName}`, '-c', 'child', '--previous']);
+      previousLogReadStatus = previousLogs.status === 0 ? (previousLogs.stdout.trim() ? 'captured' : 'empty') : 'failed';
+      previousLogBytes = previousLogs.status === 0 ? Buffer.byteLength(previousLogs.stdout) : 0;
+      if (previousLogs.status !== 0) {
+        const failure = captureStderr('previous-logs-read-failed', previousLogs);
+        previousLogFailure = {
+          previousLogKubectlStatus: failure.kubectlStatus,
+          previousLogStderrEvidence: failure.stderrEvidence,
+          previousLogStderrCaptureStatus: failure.stderrCaptureStatus,
+        };
+      }
+      if (previousLogs.status === 0 && previousLogs.stdout.trim()) {
+        previousLogEvidence = save('child.previous.log', previousLogs.stdout);
+        resultMarkerPresent ||= hasTerminalMarker(previousLogs.stdout);
+      }
+    }
+    const summary = { ...podSummary, jobEvidence, podEvidence, currentLogReadStatus, currentLogBytes,
+      previousLogReadStatus, ...(previousLogBytes !== undefined ? { previousLogBytes } : {}), ...previousLogFailure, resultMarkerPresent,
+      ...(logEvidence ? { logEvidence } : {}), ...(previousLogEvidence ? { previousLogEvidence } : {}) };
+    if (currentLogReadStatus !== 'captured' && previousLogReadStatus !== 'captured') {
+      if (logs.status !== 0) { readFailure('logs-read-failed', logs, summary); return; }
+      finish('failed', 'logs-empty', summary); return;
+    }
+    if (logs.status !== 0) finish('collected', 'job-failed', { ...summary, ...captureStderr('logs-read-failed', logs) });
+    else finish('collected', 'job-failed', summary);
   } catch { finish('failed', 'capture-error', location); }
 }
 
+function hasTerminalMarker(logs: string): boolean {
+  for (const line of logs.split(/\r?\n/)) {
+    try {
+      const row: unknown = JSON.parse(line);
+      if (row && typeof row === 'object' && !Array.isArray(row) && podTerminalRow(row as Record<string, unknown>)) return true;
+    } catch { /* ordinary child output is not a terminal result marker */ }
+  }
+  return false;
+}
+
 const SECRET_FIELD = /token|secret|password|authorization|key/i;
 const SAFE_FIELD = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
 const SECRET_VALUE = /(?:\b(?:bearer|basic)\s+\S+|\b(?:token|secret|password|authorization|api[-_]?key|access[-_]?key|private[-_]?key)\b\s*(?:is|[=:])\s*["']?\S+|\b(?:sk-[A-Za-z0-9_-]{8,}|gh[pousr]_[A-Za-z0-9_]{8,}))\b/i;
@@ -127,8 +218,12 @@ const MAX_FIELDS = 32;
 // Review R2: only lifecycle events the host needs to see, and no free text. Event names must start with a known
 // lifecycle prefix; string fields survive only when they are short code-like values in a fixed set of keys.
 const EVENT_ALLOWED = /^(?:gate|gated|review|reviewed|repair|repaired|rework|merge|merged|pr|land|landed|stage|round|supervisor|child|plan|planned|decompose|decomposed|shard|stall|harvest|decision|run|pipeline|progress|human|start|started|finish|finished|done|implement|implemented|commit|test|typecheck)(?:-(?:started|finished|round|opened|closed|failed|passed|blocked|done|entry|node|outcome|delivery|decision|stop|merged|ready|requested|resolved|result|fix|must-fix|verdict|skipped|origin|cleared))*$/;
-const CODE_FIELDS = new Set(['stage', 'outcome', 'verdict', 'status', 'kind', 'phase', 'role', 'result']);
+const CODE_FIELDS = new Set(['stage', 'outcome', 'verdict', 'status', 'kind', 'phase', 'role', 'result', 'containerReason',
+  'podPhase', 'currentLogReadStatus', 'previousLogReadStatus', 'previousLogStderrCaptureStatus', 'stderrCaptureStatus']);
 const CODE_VALUE = /^[a-z0-9_.:-]{1,40}$/i;
+const IDENTITY_FIELDS = new Set(['job', 'jobUid', 'childRunId', 'host', 'context', 'namespace', 'podName', 'podUid']);
+const SAFE_ID_VALUE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const SAFE_ISO_TIMESTAMP = /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?Z$/;
 
 function secretValues(root: Record<string, unknown>): string[] {
   const secrets: string[] = [];
@@ -163,7 +258,8 @@ export function ledgerLineToLogEvent(line: string, runId: string): {
   const sources = [entry, details].filter((source): source is Record<string, unknown> => source !== undefined);
   const knownSecrets = secretValues(entry);
   const containsCredential = (value: string) => SECRET_VALUE.test(value) || knownSecrets.some((secret) => value.includes(secret));
-  if (containsCredential(entry.event) || (!EVENT_ALLOWED.test(entry.event) && entry.event !== 'ask-auto-target-candidates' && entry.event !== 'ask-auto-reauthor')) return undefined;
+  if (containsCredential(entry.event) || (!EVENT_ALLOWED.test(entry.event) && entry.event !== 'pod-failure-capture'
+    && entry.event !== 'ask-auto-target-candidates' && entry.event !== 'ask-auto-reauthor')) return undefined;
 
   const data: Record<string, unknown> = { runId };
   let fields = 0;
@@ -176,7 +272,10 @@ export function ledgerLineToLogEvent(line: string, runId: string): {
       if (!SAFE_FIELD.test(outputName) || SECRET_FIELD.test(outputName) || Object.hasOwn(data, outputName)) continue;
       if (typeof value === 'string') {
         // Free text (reasons, messages, patches) never leaves the pod ledger; only short code values in known keys.
-        if (!CODE_FIELDS.has(name) || !CODE_VALUE.test(value) || containsCredential(value)) continue;
+        const acceptedCode = CODE_FIELDS.has(name) && CODE_VALUE.test(value);
+        const acceptedIdentity = IDENTITY_FIELDS.has(name) && SAFE_ID_VALUE.test(value);
+        const acceptedTimestamp = name === 'containerFinishedAt' && SAFE_ISO_TIMESTAMP.test(value);
+        if ((!acceptedCode && !acceptedIdentity && !acceptedTimestamp) || containsCredential(value)) continue;
         data[name] = value;
       } else if (typeof value === 'number' && Number.isFinite(value) || typeof value === 'boolean' || value === null) {
         data[name] = value;

package/src/task-orchestrator/surfaces/pod-si-warm-host.ts

@@ -80,12 +80,22 @@ export async function adoptSiWarmBytes(command: SiWarmCommand, _reply: SiWarmRep
 
 type ChildInput = Parameters<SelfImplementJobSpawn>[0];
 
-/** Reuse only the source and auth form the fixed worker currently supports. */
-export function siWarmEligible(input: ChildInput, options: PodSpawnOptions): boolean {
+/** Reuse only the source, provider and auth form the fixed worker currently supports. */
+export function siWarmEligible(input: ChildInput, options: PodSpawnOptions, configuredProvider?: string): boolean {
+  // An explicit Codex child override is authoritative. Otherwise, an absent or
+  // auto child choice inherits the configured provider and must not mask it.
+  const requestedProvider = options.provider as string | undefined;
+  const provider = requestedProvider === 'openai-codex'
+    ? 'openai-codex'
+    : requestedProvider === undefined || requestedProvider === 'auto'
+      ? configuredProvider
+      : requestedProvider;
+  const providerSupported = provider === undefined || provider === null || provider === '' || provider === 'auto'
+    || provider === 'openai-codex';
   // Merge-ready children need the cold path's full host ACP/regate/land sequence.
   // Until that sequence is shared, admit only draft-producing children.
   return input.autoMerge === false && !input.after && !options.repairCommitOnly && !options.source
-    && (!options.provider || options.provider === 'openai-codex')
+    && providerSupported
     && (!options.accountBroker || !!options.rotationAccounts?.length)
     && !options.extraArgs?.length && !options.passEnv?.length
     && !options.skillEnv && !options.armEnv && !options.groundingUrl;
@@ -147,11 +157,12 @@ export function siWarmPayload(input: ChildInput, options: PodSpawnOptions, runId
       ...(env.ELANOUS_HARNESS_SEAT ? { ELANOUS_HARNESS_SEAT: env.ELANOUS_HARNESS_SEAT } : {}) } };
 }
 
-/** Carry the same normalized child fallback config as a fresh Pod Job. */
-export function siWarmFallbackFiles(raw: unknown, grok: { grokAuth?: string; grokApiKey?: string } | null):
+/** Carry the same normalized child fallback config as a fresh Pod Job. configuredProvider is required to preserve provider-derived defaults. */
+export function siWarmFallbackFiles(raw: unknown, grok: { grokAuth?: string; grokApiKey?: string } | null,
+  configuredProvider: string | undefined):
   Record<string, string> {
   // The fixed warm runner only carries Codex accounts and optional Grok credentials.
-  const available = normalizeFallbackChain(raw).chain.filter(step =>
+  const available = normalizeFallbackChain(raw, configuredProvider).chain.filter(step =>
     step === 'codex-rotate' || (step === 'grok' && !!(grok?.grokAuth || grok?.grokApiKey)));
   // A configured chain with no carryable provider cannot enter the warm worker.
   // Its caller catches this before acquiring a lease and uses the cold Job path.
@@ -174,6 +185,8 @@ export async function acquireSiWarmChild(input: ChildInput, options: PodSpawnOpt
   if (!siWarmEligible(input, options)) return { status: 'no-entry', reason: 'invalid-input' };
   let prepared: Parameters<typeof acquireSiWarmLease>[0];
   try {
+    const config = (options.fallbackConfig ?? getUserConfig)();
+    if (!siWarmEligible(input, options, config.llm.provider)) return { status: 'no-entry', reason: 'invalid-input' };
     const sourceSha = execFileSync('git', ['rev-parse', '--verify', '--end-of-options', `${input.base ?? 'origin/HEAD'}^{commit}`],
       { cwd: process.cwd(), encoding: 'utf8' }).trim();
     if (!/^[a-f0-9]{40}$/.test(sourceSha)) return { status: 'no-entry', reason: 'invalid-input' };
@@ -189,8 +202,7 @@ export async function acquireSiWarmChild(input: ChildInput, options: PodSpawnOpt
       ? [plannedAccount, ...rotation!.filter(name => name !== plannedAccount)] : undefined;
     const credentials = (options.credentials ?? hostCredentials)(plannedAccount);
     const deadlineMs = (options.deadlineSeconds ?? POD_JOB_DEADLINE_SECONDS) * 1000;
-    const config = (options.fallbackConfig ?? getUserConfig)();
-    const fallback = normalizeFallbackChain(config.llm.fallbackChain).chain;
+    const fallback = normalizeFallbackChain(config.llm.fallbackChain, config.llm.provider).chain;
     let grok: { grokAuth?: string; grokApiKey?: string } | null = null;
     if (fallback.includes('grok')) {
       try { grok = hostGrokCredentials({ minValidityMs: deadlineMs,
@@ -206,7 +218,7 @@ export async function acquireSiWarmChild(input: ChildInput, options: PodSpawnOpt
         : { 'elanous-auth.json': credentials.elanousAuth,
           'codex-auth.json': credentials.codexAuth }),
       'gh-token': credentials.ghToken,
-      ...siWarmFallbackFiles(config.llm.fallbackChain, grok) },
+      ...siWarmFallbackFiles(config.llm.fallbackChain, grok, config.llm.provider) },
     ...(accounts ? { accounts } : {}) };
     const payload = Buffer.from(JSON.stringify(siWarmPayload(input, options, runId)));
     const credentialBundle = Buffer.from(JSON.stringify(bundle));

package/src/task-orchestrator/surfaces/pod-source-receive.ts

@@ -107,6 +107,10 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     // Count calls performed by this Pod source stage. Branch validation via
     // assertRemoteBase runs on the host before Job creation and is outside it.
     'pod_source_io_origin_calls=0',
+    ...(source.kind === 'default' && baseSha ? [
+      'pod_source_base_sha_origin_fallback=false',
+      'pod_source_base_sha_mirror_fetch_attempted=false',
+    ] : []),
     'pod_source_io_started=$(date +%s)',
     'pod_source_io_reported=0',
     'pod_source_io_measured=0',
@@ -117,7 +121,9 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     '  [ -n "${pod_source_io_seconds:-}" ] || pod_source_io_seconds=$(( $(date +%s) - pod_source_io_started ))',
     '  [ -n "${pod_source_io_files:-}" ] || pod_source_io_files=null',
     '  pod_source_io_status=incomplete; if [ "$pod_source_io_measured" -eq 1 ]; then pod_source_io_status=complete; fi',
-    '  printf \'ELANOUS_POD_SOURCE_IO {"originCalls":%s,"checkoutFiles":%s,"sourceVia":"%s","sourceSeconds":%s,"sourceStatus":"%s","pushCalls":null,"installRan":null,"installSeconds":null}\\n\' "$pod_source_io_origin_calls" "$pod_source_io_files" "${source_via:-unknown}" "$pod_source_io_seconds" "$pod_source_io_status"',
+    ...(source.kind === 'default' && baseSha
+      ? ['  printf \'ELANOUS_POD_SOURCE_IO {"originCalls":%s,"baseShaOriginFallback":%s,"checkoutFiles":%s,"sourceVia":"%s","sourceSeconds":%s,"sourceStatus":"%s","pushCalls":null,"installRan":null,"installSeconds":null}\\n\' "$pod_source_io_origin_calls" "$pod_source_base_sha_origin_fallback" "$pod_source_io_files" "${source_via:-unknown}" "$pod_source_io_seconds" "$pod_source_io_status"']
+      : ['  printf \'ELANOUS_POD_SOURCE_IO {"originCalls":%s,"checkoutFiles":%s,"sourceVia":"%s","sourceSeconds":%s,"sourceStatus":"%s","pushCalls":null,"installRan":null,"installSeconds":null}\\n\' "$pod_source_io_origin_calls" "$pod_source_io_files" "${source_via:-unknown}" "$pod_source_io_seconds" "$pod_source_io_status"']),
     '  pod_source_result_emit "$pod_source_exit"',
     '}',
     'trap pod_source_io_emit EXIT',
@@ -174,7 +180,7 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     `if ! [ -d ${quotedMirror} ]; then mirror_skip=no-mount`,
     `elif ! git -C ${quotedMirror} rev-parse --verify HEAD >/dev/null 2>&1; then mirror_skip=rev-parse-failed`,
     ...(source.kind === 'default' && baseSha
-      ? [`elif ! git init -q -b main repo || ! git -C repo fetch --quiet --no-write-fetch-head ${quotedMirror} '${baseSha}' || ! git -C repo cat-file -e '${baseSha}^{commit}' 2>/dev/null; then mirror_skip=sha-fetch-failed`]
+      ? [`elif pod_source_base_sha_mirror_fetch_attempted=true; ! git init -q -b main repo || ! git -C repo fetch --quiet --no-write-fetch-head ${quotedMirror} '${baseSha}' || ! git -C repo cat-file -e '${baseSha}^{commit}' 2>/dev/null; then mirror_skip=sha-fetch-failed`]
       : [`elif ! git clone -q --shared -- ${quotedMirror} repo || ! git -C repo rev-parse --verify HEAD >/dev/null 2>&1; then mirror_skip=clone-failed`]),
     'fi',
     'if [ -z "$mirror_skip" ]; then',
@@ -187,10 +193,9 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     "  printf 'ELANOUS_POD_SOURCE_MIRROR_SKIP %s\\n' \"$mirror_skip\"",
     '  if [ -e repo ]; then rm -r -- repo || exit 5; fi',
     ...(source.kind === 'default' && baseSha ? [] : ['  pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1))']),
-    ...(source.kind === 'default' && baseSha ? [
-        `  pod_source_stage=base-sha; pod_source_failure_code=base-sha-unavailable; printf 'ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE %s\\n' '${baseSha}'`,
-      '  exit 5',
-    ] : [`  ${clone} || exit 5`]),
+    ...(source.kind === 'default' && baseSha
+      ? [`  git init -q -b main repo && git -C repo remote add origin ${quotedUrl} || exit 5`]
+      : [`  ${clone} || exit 5`]),
     '  source_via=github',
     'fi',
     'fi',
@@ -209,12 +214,19 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
       return [
         ...ioStart,
         ...start,
-        // «실제 객체 출처» 마커: image 라우트는 핀 객체, mirror 라우트는 --shared alternates 가
-        // 해결된 SHA 를 이미 갖고 있으면 그 쪽이 출처다. 어느 쪽에도 없으면 호스트 미러에서
-        // raw-SHA fetch 로 Pod 전용 object store 에 직접 가져온다(프로덕션 미러 = push 로 심은
-        // bare 저장소, upload-pack 기본 설정 · refs/브랜치 경유 없음).
+        // «실제 객체 출처» 마커: image pin을 우선 쓰고, SHA가 없으면 host mirror 다음 origin에서
+        // raw-SHA fetch 해 Pod 전용 object store 에 넣는다. origin 시도 수·성공 여부는 IO summary로
+        // debug.log 에 남겨 다음 실패에서 소스 부재와 네트워크 fallback을 구분한다.
         'pod_source_base_sha_from="$source_via"',
-        `if ! git cat-file -e '${sha}^{commit}' 2>/dev/null; then pod_source_stage=base-sha; pod_source_failure_code=base-sha-unavailable; printf 'ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE %s\\n' '${sha}'; exit 5; fi`,
+        `if ! git cat-file -e '${sha}^{commit}' 2>/dev/null; then`,
+        `  if [ "$pod_source_base_sha_mirror_fetch_attempted" = false ] && [ -d ${quotedMirror} ]; then pod_source_base_sha_mirror_fetch_attempted=true; if git fetch --quiet --no-write-fetch-head ${quotedMirror} '${sha}'; then pod_source_base_sha_from=mirror; else printf 'ELANOUS_POD_SOURCE_BASE_SHA_MIRROR_FETCH failed %s\\n' '${sha}'; fi; fi`,
+        `  if ! git cat-file -e '${sha}^{commit}' 2>/dev/null; then`,
+        '    pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1))',
+        '    pod_source_base_sha_origin_fallback=true',
+        `    printf 'ELANOUS_POD_SOURCE_BASE_SHA_ORIGIN_FETCH start %s\\n' '${sha}'`,
+        `    if git fetch --quiet --no-write-fetch-head origin '${sha}'; then pod_source_base_sha_from=origin; source_via=origin; printf 'ELANOUS_POD_SOURCE_BASE_SHA_ORIGIN_FETCH complete %s\\n' '${sha}'; else pod_source_stage=base-sha; pod_source_failure_code=base-sha-unavailable; printf 'ELANOUS_POD_SOURCE_BASE_SHA_ORIGIN_FETCH failed %s\\n' '${sha}'; printf 'ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE %s\\n' '${sha}'; exit 5; fi`,
+        '  fi',
+        'fi',
         `printf 'ELANOUS_POD_SOURCE_BASE_SHA_FROM %s\\n' "$pod_source_base_sha_from"`,
         `git checkout -q -B ${quotedBase} '${sha}' || exit 5`,
         `git update-ref ${quotedTrackingRef} '${sha}' || exit 5`,

package/src/task-orchestrator/surfaces/pod-warm-switch.ts

@@ -85,6 +85,8 @@ export function warmReuseFlagOn(config: unknown, consumer: WarmReuseConsumer): b
 
 function evidenceReason(evidence: WarmReuseEvidence | undefined, minSamples: number): string | null {
   if (!evidence) return 'evidence-unmeasured';
+  // A measured mismatch is the most actionable reason even when it also makes the latest canary fail.
+  if (typeof evidence.recentMismatchCount === 'number' && evidence.recentMismatchCount > 0) return 'recent-mismatch';
   if (evidence.leaseValid !== true) return evidence.leaseValid === false ? 'lease-invalid' : 'lease-unmeasured';
   if (evidence.canaryPassed !== true) return evidence.canaryPassed === false ? 'canary-failed' : 'canary-unmeasured';
   for (const field of IDENTITY_FIELDS) {

package/src/task-orchestrator/surfaces/pod-warm-worker-pod.ts

@@ -260,7 +260,7 @@ export interface WarmPodTransportResult {
   /** Every non-complete response leaves the existing one-shot Job authoritative. */
   status: 'observed' | 'fallback';
   reason: 'complete' | 'key-drift' | 'pod-unready' | 'pod-replaced' | 'exec-failed' | 'invalid-result' | 'worker-quarantined'
-    | 'no-candidate' | 'lease-unavailable' | 'context-unavailable';
+    | 'no-candidate' | 'lease-unavailable' | 'context-unavailable' | 'control-unavailable';
   reply: WarmWorkerReply | null;
   /** Original local kubectl error when a remote pool context is absent; no Pod was contacted. */
   kubectlStderr?: string;