elanous 0.2.42 → 0.2.44

package/src/task-orchestrator/surfaces/pod-warm-worker-runtime.ts

@@ -39,6 +39,18 @@ function readInstalledLockHash(repoDir: string): string | null {
   } catch { return null; }
 }
 
+function pathIsAbsent(path: string): boolean {
+  try { lstatSync(path); return false; }
+  catch (error) { return (error as NodeJS.ErrnoException).code === 'ENOENT'; }
+}
+
+function isRealDirectory(path: string): boolean {
+  try {
+    const stat = lstatSync(path);
+    return stat.isDirectory() && !stat.isSymbolicLink();
+  } catch { return false; }
+}
+
 /** Record the image's installed dependency lock once source verification ties it to the worker key. */
 function rememberInstalledLockHash(repoDir: string, lockHash: string): void {
   try {
@@ -261,7 +273,35 @@ export class WarmWorkerRuntime {
       }, { level: 'warn' }); } catch { /* observation cannot revive an unsafe worker */ }
       return { reply: null, quarantineWorker: true, reason: 'cleanup-failed', artifactsDir };
     }
-    mkdirSync(this.options.scratchDir, { recursive: true });
+    try {
+      (this.options.removeScratch ?? ((path: string) => rmSync(path, { recursive: true, force: true })))(this.options.scratchDir);
+      // A successful rm call is not proof of cleanup: a stub can be a no-op, and an
+      // attacker can replace the path with a symlink before the next mkdir.
+      if (!pathIsAbsent(this.options.scratchDir)) throw new Error('scratch path remains after removal');
+    } catch {
+      this.quarantined = true;
+      try { debug.log('pod.reuse', 'clean-failed', {
+        runId: command.runId, attemptId: command.attemptId, workerId: command.workerId,
+        // The worker outcome stays cleanup-failed for callers; this event reason identifies the scratch phase.
+        // Include only a path that lstat can still observe; a failed rm may also have removed it.
+        reason: 'scratch-removal-failed',
+        remainingPaths: pathIsAbsent(this.options.scratchDir) ? [] : [this.options.scratchDir],
+      }, { level: 'warn' }); } catch { /* observation cannot revive an unsafe worker */ }
+      return { reply: null, quarantineWorker: true, reason: 'cleanup-failed', artifactsDir };
+    }
+    try {
+      // Non-recursive mkdir refuses a path that was recreated (for example as a
+      // symlink) after the absence check. Validate the resulting path type as well.
+      mkdirSync(this.options.scratchDir);
+      if (!isRealDirectory(this.options.scratchDir)) throw new Error('scratch path is not a real directory');
+    } catch {
+      this.quarantined = true;
+      try { debug.log('pod.reuse', 'clean-failed', {
+        runId: command.runId, attemptId: command.attemptId, workerId: command.workerId,
+        reason: 'scratch-directory-unsafe', remainingPaths: [this.options.scratchDir],
+      }, { level: 'warn' }); } catch { /* observation cannot revive an unsafe worker */ }
+      return { reply: null, quarantineWorker: true, reason: 'cleanup-failed', artifactsDir };
+    }
     mkdirSync(artifactsRoot, { recursive: true });
     mkdirSync(artifactsDir, { recursive: true, mode: 0o700 });
     const startedAt = now();
@@ -304,8 +344,10 @@ export class WarmWorkerRuntime {
         reason = 'execution-error';
         break;
       } finally {
-        try { (this.options.removeScratch ?? ((path: string) => rmSync(path, { recursive: true } )))(sandbox); }
-        catch { this.quarantined = true; reason = 'cleanup-failed'; }
+        try {
+          (this.options.removeScratch ?? ((path: string) => rmSync(path, { recursive: true, force: true })))(sandbox);
+          if (!pathIsAbsent(sandbox)) throw new Error('request sandbox remains after removal');
+        } catch { this.quarantined = true; reason = 'cleanup-failed'; }
       }
       if (now() >= command.deadlineAt) reason = 'execution-error';
       if (reason !== 'complete') break;

package/src/task-orchestrator/surfaces/self-implement-pod.ts

@@ -22,7 +22,7 @@ import { isVerifiedOpenGatewayModel } from '../../llm/opengateway-models.js';
 import { configuredOpenGatewayKeys } from '../../llm/provider-credentials.js';
 import { collectPodLedgers, createPodLedgerFollower } from './pod-ledger-collect.js';
 import { captureFailedPodJobs } from './pod-ledger-events.js';
-import { collectPodArtifacts, podNoResultDiagnostic, POD_SALVAGE_BUNDLE_FILE_LIMIT, POD_SALVAGE_BUNDLE_TOTAL_LIMIT } from './pod-artifact-return.js';
+import { collectPodArtifacts, podNoResultChildError, podNoResultDiagnostic, POD_SALVAGE_BUNDLE_FILE_LIMIT, POD_SALVAGE_BUNDLE_TOTAL_LIMIT } from './pod-artifact-return.js';
 import { readPodRepairArtifact } from './pod-repair-commit.js';
 import { isValidAccountName, resolveCodexAccount } from '../../oauth/codex-account.js';
 import { createCodexAccessMirror } from '../../oauth/codex-access-mirror.js';
@@ -32,6 +32,7 @@ import { finishPodFragment, writePodFragment } from '../../harness/self-send-tar
 import { mintRunId, normalizeRunId } from '../../harness/harness-space.js';
 import { TA_LAND_ENV } from '../../task-agent/task-hand.js';
 import { appendRunLedgerEntry, loadRunLedger, runLedgerDir, runLedgerPath, type RunLedgerEntry } from '../../self-implement/run-ledger.js';
+import { childFirstLlmFact, childFirstLlmReportFact } from '../../llm/child-first-llm-observation.js';
 import { recordRunStop } from '../../self-implement/run-stop.js';
 import { gateFailureReceipt, gateFailureReceiptLines } from '../../self-implement/gate-failure-signature.js';
 import { runSuffixKey } from '../../self-implement/salvage-branches.js';
@@ -148,6 +149,19 @@ import { findGitDir } from '../../git-fs/locate.js';
 import { hostLeaseBaseDir } from '../../pod-lease/host-lease.js';
 import { acquireLockAsync } from '../../storage/file-lock.js';
 import { debug, redactSecretText } from '../../debug/log.js';
+
+function readPodChildFirstLlmFact(runId: string, ledgerDir: string, report = false) {
+  try {
+    const entries = loadRunLedger(runId, ledgerDir) ?? [];
+    return report ? childFirstLlmReportFact(entries) : childFirstLlmFact(entries);
+  } catch (error) {
+    debug.log('self-implement.pod', 'child-first-llm-ledger-unavailable', {
+      childRunId: runId,
+      reason: error instanceof Error ? error.message : String(error),
+    }, { level: 'warn' });
+    return undefined;
+  }
+}
 import { enterJourneyNode, exitJourneyNode, passJourneyNode } from '../../self-dev/graph-journey-nodes.js';
 import { routeJourneyEdge } from '../../self-dev/graph-journey-route.js';
 import { selectLiveDetail } from '../../live/detail-switch.js';
@@ -174,7 +188,7 @@ import { ZAI_POD_EGRESS_LABEL, checkZaiPodSecret, countActiveZaiJobs, decideZaiP
 import { ZAI_CODING_DEFAULT_MODEL, ZAI_OPENROUTER_FALLBACK_MODEL, zaiSettingsFromConfig, type ZaiCodingPlanSettings } from '../../llm/zai-coding-plan.js';
 import { normalizePlanningFallbackReason, selectEnhanceLlm } from '../../prompt-enhance/enhance.js';
 import { inferProviderFromModel } from '../../llm.js';
-import { classifyPodExit, extractPodFailureReason, podChildEvidenceLedgerRow, podChildFailureAttribution, podDeadlineResultMarker, podJobConditionReason, podTerminalRow, POD_TERMINATION_JOB_JSONPATH, POD_TERMINATION_PODS_JSONPATH, readPodTermination, type PodExitClass, type PodTermination } from './pod-failure-reason.js';
+import { classifyPodExit, extractPodFailureReason, podChildEvidenceLedgerRow, podChildFailureAttribution, podChildProviderFailureFact, podDeadlineResultMarker, podJobConditionReason, podTerminalRow, POD_TERMINATION_JOB_JSONPATH, POD_TERMINATION_PODS_JSONPATH, readPodTermination, type PodExitClass, type PodTermination } from './pod-failure-reason.js';
 import { kubectlTransientReason, retryKubectlTransient } from './kubectl-transient-retry.js';
 import { OLD_DOOR_STAMP_ENV } from '../../self-dev/old-door.js';
 import { resolveDefaultSourceHead, seedMirrorOnce, type MirrorSeedResult } from './pod-mirror-seed.js';
@@ -409,7 +423,8 @@ async function measureHostBudgetSnapshot(childLlm: PodBudgetChildLlm, env: NodeJ
   const host = resolveHostId(env);
   const measuredAt = Date.now();
   const { readBudgetInputsLive, CODEX_PROVIDER, GROK_PROVIDER } = await import('../../self-implement/budget-gate.js');
-  const inputs = await readBudgetInputsLive(inputDeps);
+  const { budgetInputsWithLiveSupply } = await import('../../live-supply/budget-consumer.js');
+  const inputs = budgetInputsWithLiveSupply(await readBudgetInputsLive(inputDeps));
   const { decision } = harnessLaunchBudgetDecision(inputs, { ...(childLlm.provider ? { childLlmProvider: childLlm.provider } : {}), ...(childLlm.model ? { childLlmModel: childLlm.model } : {}) });
   const provider = decision.provider ?? childLlm.provider ?? 'chain';
   const used = provider === GROK_PROVIDER
@@ -1002,9 +1017,11 @@ function podCodexAccountScript(accounts: readonly string[]): string {
   return [
     'mkdir -p "$HOME/.elanous" "$HOME/.codex"',
     // Names travel as JSON data, never as shell syntax. Reconstruct the account-store keys that elanous resolves at runtime.
-    `POD_CODEX_ACCOUNTS='${JSON.stringify(accounts)}' bun -e 'const fs=require("node:fs"),path=require("node:path");const names=JSON.parse(process.env.POD_CODEX_ACCOUNTS),home=process.env.HOME;const providers={};let version;for(let i=0;i<names.length;i++){const payload=JSON.parse(fs.readFileSync("/creds/codex-"+i+".json","utf8"));const row=JSON.parse(payload.elanousAuth);if(i===0)version=row.version;const entry=row.providers["openai-codex"];if(!entry)throw Error("missing codex account credential "+i);const codexHome=path.join(home,".elanous/codex-accounts",String(i));fs.mkdirSync(codexHome,{recursive:true});fs.writeFileSync(path.join(codexHome,"auth.json"),payload.codexAuth,{mode:0o600});fs.chmodSync(path.join(codexHome,"auth.json"),0o600);providers[names[i]==="default"?"openai-codex":"openai-codex:"+names[i]]={...entry,codexHome}}if(!providers["openai-codex"])providers["openai-codex"]=providers["openai-codex:"+names[0]];fs.writeFileSync(path.join(home,".elanous/auth.json"),JSON.stringify({version,providers}),{mode:0o600});fs.chmodSync(path.join(home,".elanous/auth.json"),0o600);fs.copyFileSync(path.join(home,".elanous/codex-accounts/0/auth.json"),path.join(home,".codex/auth.json"));fs.chmodSync(path.join(home,".codex/auth.json"),0o600)' || exit 5`,
+    `POD_CODEX_ACCOUNTS='${JSON.stringify(accounts)}' bun -e 'const fs=require("node:fs"),path=require("node:path");const names=JSON.parse(process.env.POD_CODEX_ACCOUNTS),home=process.env.HOME;const providers={},mirrorProviders={};let version;for(let i=0;i<names.length;i++){const payload=JSON.parse(fs.readFileSync("/creds/codex-"+i+".json","utf8"));const row=JSON.parse(payload.elanousAuth);if(i===0)version=row.version;const entry=row.providers["openai-codex"];if(!entry||!entry.tokens||typeof entry.tokens.accessToken!=="string"||!entry.tokens.accessToken||typeof entry.tokens.expiresAt!=="number"||!Number.isFinite(entry.tokens.expiresAt))throw Error("missing Codex access snapshot "+i);const accountKey=names[i]==="default"?"openai-codex":"openai-codex:"+names[i];const codexHome=path.join(home,".elanous/codex-accounts",String(i));fs.mkdirSync(codexHome,{recursive:true});fs.writeFileSync(path.join(codexHome,"auth.json"),payload.codexAuth,{mode:0o600});fs.chmodSync(path.join(codexHome,"auth.json"),0o600);providers[accountKey]={...entry,codexHome};mirrorProviders[accountKey]={authMode:"chatgpt",tokens:{accessToken:entry.tokens.accessToken,expiresAt:entry.tokens.expiresAt,refreshToken:"",refresh_token:""}}}if(!providers["openai-codex"])providers["openai-codex"]=providers["openai-codex:"+names[0]];if(!mirrorProviders["openai-codex"])mirrorProviders["openai-codex"]=mirrorProviders["openai-codex:"+names[0]];fs.writeFileSync(path.join(home,".elanous/auth.json"),JSON.stringify({version,providers}),{mode:0o600});fs.chmodSync(path.join(home,".elanous/auth.json"),0o600);const mirrorDir=path.join(home,".elanous/remote-parent-credentials/cli-mirror");fs.mkdirSync(mirrorDir,{recursive:true,mode:0o700});fs.chmodSync(mirrorDir,0o700);const mirrorPath=path.join(mirrorDir,"auth.json");fs.writeFileSync(mirrorPath,JSON.stringify({version,providers:mirrorProviders}),{mode:0o600});fs.chmodSync(mirrorPath,0o600);fs.copyFileSync(path.join(home,".elanous/codex-accounts/0/auth.json"),path.join(home,".codex/auth.json"));fs.chmodSync(path.join(home,".codex/auth.json"),0o600)' || exit 5`,
     `export ELANOUS_CODEX_ACCOUNT='${accounts[0]!.replace(/'/g, `'\\''`)}'`,
     'export ELANOUS_CODEX_ACCOUNT_HOME="$HOME/.elanous/codex-accounts/0" CODEX_HOME="$HOME/.elanous/codex-accounts/0"',
+    'export ELANOUS_REMOTE_CODEX_ACCESS_ONLY=1',
+    'export ELANOUS_REMOTE_CODEX_MIRROR_PATH="$HOME/.elanous/remote-parent-credentials/cli-mirror/auth.json"',
     podQuotaPolicyExport(),
   ].join('\n');
 }
@@ -1503,7 +1520,9 @@ if [ "$found" -eq 0 ]; then echo ELANOUS_RUN_LEDGER_NONE; fi`,
               // ⭐ 런 계약(graph-run-contract.ts) — 이 칸이 «실제로» Pod 이고, 부모가 정한 계약도 Pod 다. 안의 그래프가 노드마다 대조한다.
               { name: ACTUAL_SUBSTRATE_ENV, value: 'pod' }, { name: RUN_CONTRACT_ENV, value: carryRunContract({ substrate: 'pod' }) },
               ...Object.entries(o.armEnv ?? {}).map(([name, value]) => ({ name, value })),
-              ...o.passEnv.map((key) => ({ name: key, valueFrom: { secretKeyRef: { name: `${o.name}-creds`, key: `env-${key}` } } })),
+              // Growth admission is host-validated control state, never a caller-provided Secret env.
+              ...o.passEnv.filter((key) => key !== 'ELANOUS_GRAPH_GROWTH_SCOPE')
+                .map((key) => ({ name: key, valueFrom: { secretKeyRef: { name: `${o.name}-creds`, key: `env-${key}` } } })),
               ...(o.bedrock ? bedrockPodEnv(o.bedrock) : []),
               ...(o.zai || o.zaiFallback ? zaiPodEnv(o.zai ?? o.zaiFallback!) : []),
             ],
@@ -1618,6 +1637,22 @@ export function repairPodExitCode(input: { state: string; repairCommitOnly: bool
   return input.disposition?.stage !== 'host-regate-failed' && input.disposition?.ok !== false ? 0 : 1;
 }
 
+export function parsePodRepairExportEvidence(output: string): { exportExitCode: number | null; podExitCode: number | null; exported: boolean;
+  reasonCode: 'none' | 'no-new-commit' | 'source-head-mismatch' | 'export-failed' } | null {
+  const outcomes = [
+    ...[...output.matchAll(/^ELANOUS_POD_REPAIR_FAILED ([^\r\n]+)$/gm)].map((match) => ({ index: match.index!, failure: match[1]! })),
+    ...[...output.matchAll(/^ELANOUS_POD_REPAIR_COMMIT ([1-9]\d*) ([0-9a-f]{40}) ([0-9a-f]{40})$/gm)].map((match) => ({ index: match.index!, failure: null })),
+  ].sort((a, b) => a.index - b.index);
+  const outcome = outcomes.at(-1);
+  if (!outcome) return null;
+  const podRc = [...output.matchAll(/__ELANOUS_POD_DONE__[^\r\n]*\brc=(\d+)/g)].at(-1)?.[1];
+  const reasonCode = outcome.failure === null ? 'none' : outcome.failure === 'repair made no new commit' ? 'no-new-commit'
+    : outcome.failure === 'source-head-mismatch' ? 'source-head-mismatch' : 'export-failed';
+  const exported = outcome.failure === null;
+  return { exportExitCode: exported ? 0 : reasonCode === 'source-head-mismatch' ? null : 1,
+    podExitCode: podRc === undefined ? null : Number(podRc), exported, reasonCode };
+}
+
 export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplementJobSpawn {
   if (options.repairCommitOnly && (options.source?.kind !== 'pr' || options.source.number !== options.repairCommitOnly.pr || !/^[0-9a-f]{40}$/.test(options.repairCommitOnly.baseHead))) {
     throw new Error('repair commit-only requires a matching PR source and exact head');
@@ -1635,6 +1670,46 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
   const resultMarkerOn = options.resultMarker ?? !options.kubectl;
   const writeWarmLedger = options.siWarmLedger
     ?? ((entry: RunLedgerEntry) => appendRunLedgerEntry(entry, runLedgerDir(env.ELANOUS_STATE_DIR)));
+  const recordFinalTaskFailure = (input: Parameters<SelfImplementJobSpawn>[0], result: SelfImplementJobDone,
+    ledgerStartIndex: number): SelfImplementJobDone => {
+    // Match createSelfImplementAdapter: a nonzero process exit is failed even if it also emitted an ok disposition.
+    if (result.error?.code === 'aborted' || (result.exitCode === 0 && result.disposition?.ok !== false)) return result;
+    const ledgerRunId = env.ELANOUS_RUN_ID ?? input.spaceId;
+    const ledgerDir = runLedgerDir(env.ELANOUS_STATE_DIR);
+    const job = podJobName(input.spaceId);
+    try {
+      const entries = loadRunLedger(ledgerRunId, ledgerDir) ?? [];
+      const currentEntries = entries.slice(ledgerStartIndex);
+      const childStart = currentEntries.slice().reverse().find((entry) => entry.event === 'pod-child-run' && entry.data?.job === job);
+      const childRunId = typeof childStart?.data?.childRunId === 'string' ? childStart.data.childRunId : null;
+      const attemptValue = childStart?.data?.attempt;
+      const attempt = typeof attemptValue === 'number' && Number.isSafeInteger(attemptValue) && attemptValue > 0 ? attemptValue : 1;
+      const evidence = childRunId ? currentEntries.slice().reverse().find((entry) => entry.event === 'pod-child-evidence'
+        && entry.data?.job === job && entry.data?.childRunId === childRunId) : undefined;
+      const childResult = evidence?.data?.childResult && typeof evidence.data.childResult === 'object'
+        ? evidence.data.childResult as Record<string, unknown> : undefined;
+      const rawError = typeof result.disposition?.error === 'string' && result.disposition.error.trim() ? result.disposition.error
+        : typeof childResult?.error === 'string' && childResult.error.trim() ? childResult.error
+          : result.error?.message ?? result.output;
+      const podTermination = evidence?.data?.podTermination && typeof evidence.data.podTermination === 'object'
+        ? evidence.data.podTermination : null;
+      appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-task-failure', data: {
+        spaceId: input.spaceId,
+        taskId: input.taskId ?? null,
+        job,
+        attempt,
+        childRunId,
+        childStage: typeof result.disposition?.stage === 'string' ? result.disposition.stage
+          : typeof childResult?.stage === 'string' ? childResult.stage : 'unknown',
+        childError: redactSecretText(rawError).replace(/\s+/gu, ' ').trim().slice(0, 500) || 'unknown',
+        podTermination,
+      } }, ledgerDir);
+    } catch (error) {
+      debug.log('self-implement.pod', 'task-failure-write-failed', { job, childRunId: null,
+        reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' });
+    }
+    return result;
+  };
   return (input) => {
     if (options.repairCommitOnly && (input.autoMerge || input.openPr || input.base !== `pr-${options.repairCommitOnly.pr}`)) {
       throw new Error('repair commit-only refuses auto merge, new PR, or a different base');
@@ -1642,6 +1717,19 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
     if (options.siWarmAttempt && !options.siWarmHostPostprocess) {
       throw new Error('si-v1 warm execution requires cold-path host postprocess parity');
     }
+    const taskLedgerDir = runLedgerDir(env.ELANOUS_STATE_DIR);
+    let taskLedgerStartIndex = Number.MAX_SAFE_INTEGER;
+    try { taskLedgerStartIndex = (loadRunLedger(env.ELANOUS_RUN_ID ?? input.spaceId, taskLedgerDir) ?? []).length; }
+    catch (error) { debug.log('self-implement.pod', 'task-failure-baseline-unavailable', {
+      spaceId: input.spaceId, reason: error instanceof Error ? error.message : String(error),
+    }, { level: 'warn' }); }
+    const recordFailure = (result: SelfImplementJobDone) => recordFinalTaskFailure(input, result, taskLedgerStartIndex);
+    const recordRejectedFailure = (error: unknown): never => {
+      if (!input.signal?.aborted && !(error instanceof Error && error.name === 'AbortError')) {
+        recordFailure({ exitCode: 1, output: '', error: { code: 'pod-promise-rejected', message: error instanceof Error ? error.message : String(error) } });
+      }
+      throw error;
+    };
     let siWarmEnabled = true;
     const taskCard = env.ELANOUS_POD_TASK_CARD ?? env.ELANOUS_TASK_CARD_ID;
     if (taskCard) {
@@ -1956,7 +2044,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           return { exitCode: 1, output: log.slice(-4096), disposition: hostDisposition,
             error: { code: 'si-warm-host-postprocess-failed', message } };
         }
-      })();
+      })().then(recordFailure, recordRejectedFailure);
       return { address: `self-impl:${input.spaceId}`, done };
     }
     const name = podJobName(input.spaceId);
@@ -2122,6 +2210,23 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         const detail = unfit.map((u) => `${u.context} ${Math.round(u.allocatableMemoryBytes / 2 ** 30 * 10) / 10}GiB`).join(' · ');
         return { exitCode: 1, output: '', error: { code: 'pod-pool-unfit', message: `모든 풀 멤버의 할당 가능 메모리가 이 Job 의 한도 ${memoryLimit} 보다 작다 — 영원히 배치될 수 없다(${detail}) · --pod-memory 를 낮추거나 다른 풀로` } };
       };
+      // PRLAND-OOM-RETRY-POOL-FIT: whether the NEXT memory limit can ever be placed decides the retry before
+      // anything is written or deleted. Read-only — an all-unfit pool ends the run here, so no retry intent
+      // is journaled, the OOM Job stays, and no second Job is applied. A fit member leaves the single retry intact.
+      const retryPoolFit = async (nextLimit: string, from: string): Promise<SelfImplementJobDone | null> => {
+        const pool = options.pool as { unfitMembers?: (b: number) => Promise<Array<{ context: string; allocatableMemoryBytes: number }>>; members?: readonly PodPoolMember[] } | undefined;
+        if (!pool || typeof pool.unfitMembers !== 'function' || !Array.isArray(pool.members) || !pool.members.length) return null;
+        const limitBytes = memoryQuantityBytes(nextLimit);
+        if (limitBytes === null) return null;
+        const unfit = await pool.unfitMembers(limitBytes);
+        const unfitContextsForRetry = new Set(unfit.map((u) => u.context));
+        const fit = pool.members.filter((m) => !unfitContextsForRetry.has(m.context)).map((m) => m.context);
+        debug.log('self-implement.pod', 'oom-retry-pool-fit', { job: name, from, to: nextLimit, fit, unfit: unfit.map((u) => u.context) }, { level: fit.length ? 'info' : 'warn' });
+        if (fit.length) return null;
+        const detail = unfit.map((u) => `${u.context} ${Math.round(u.allocatableMemoryBytes / 2 ** 30 * 10) / 10}GiB`).join(' · ');
+        const poolLimit = `${Math.round(Math.max(...unfit.map((u) => u.allocatableMemoryBytes)) / 2 ** 30 * 10) / 10}GiB`;
+        return { exitCode: 1, output: '', error: { code: 'pod-pool-unfit', message: `Job ${name} 이 OOMKilled(137) 로 ${from} 에서 죽었고 다음 한도는 ${nextLimit} 이지만 어느 풀 멤버도 그 한도를 받을 수 없다 — 재시도 Job 을 만들 수 없다(필요 ${nextLimit} · 풀 한계 ${poolLimit} · ${detail}) · --pod-memory 를 낮추거나 다른 풀로` } };
+      };
       const acquireSlot = async (): Promise<PodPoolMember | null> => {
         if (!options.pool) return null;
         // Each actual acquisition is a separate observation, including the OOM retry in this
@@ -2184,8 +2289,9 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
       if (unfitDone) return unfitDone;
       // HARNESS-FULL-GRAPH — Pod 입장(입장 관문 ⊕ 멤버 슬롯)은 그래프 노드 pool-admit 이다.
       // 2판: decompose →(substrate=pod) pool-admit 간선은 «여기»(Pod 입장 직전 · 실제 단계 경계)에서 남긴다.
-      if (options.repairCommitOnly) routeJourneyEdge('dispatch', 'pr-source', { source: 'pr', substrate: 'pod' });
-      else routeJourneyEdge('decompose', 'pod', { substrate: 'pod' });
+      const journeyRunId = parentRunId ?? childRunId;
+      if (options.repairCommitOnly) routeJourneyEdge('dispatch', 'pr-source', { source: 'pr', substrate: 'pod' }, { runId: journeyRunId });
+      else routeJourneyEdge('decompose', 'pod', { substrate: 'pod' }, { runId: journeyRunId });
       enterJourneyNode('pool-admit', { provenance: 'self-implement-pod', data: { spaceId: input.spaceId } });
       // ⛔ 감싸는 함수(async 래퍼)를 쓰지 않는다 — 마이크로태스크가 늘면 Job apply 순서가 밀린다(시험이 잡았다). 같은 자리 try/catch 로.
       const podAdmitError = (error: unknown): void => {
@@ -2300,6 +2406,11 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           collectPodArtifacts(full.stdout, { dir: join(effectiveInstanceRoot(), 'pod-artifacts'), job: name, log: record });
         }
         catch (error) { record('self-implement.pod', 'artifact-collect-incomplete', { job: name, reason: error instanceof Error ? error.message : String(error) }); }
+        const repairExportEvidence = options.repairCommitOnly ? parsePodRepairExportEvidence(full.stdout) : null;
+        if (repairExportEvidence) {
+          try { appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-repair-export', data: { job: name, ...repairExportEvidence } }, ledgerDir); }
+          catch (error) { record('self-implement.pod', 'repair-export-ledger-incomplete', { job: name, reason: error instanceof Error ? error.message : String(error) }); }
+        }
         for (const line of full.stdout.split(/\r?\n/)) {
           const bundle = /^ELANOUS_POD_SALVAGE_BUNDLE (pod-salvage\/[a-zA-Z0-9._-]+\.bundle) ([0-9]+) ([0-9]+)(?: ([0-9a-f]{40,64}))?$/.exec(line);
           if (bundle) {
@@ -2538,7 +2649,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
         }
         // Grok 자격은 전용 Secret 키 하나로만 보낸다 — passEnv 의 API 키 중복 전달은 막는다.
-        const passKeys = [...new Set([...(options.passEnv ?? []), ...(openrouterCredentialNeeded && openrouterKey ? ['OPENROUTER_API_KEY'] : []), ...(openGateway ? ['OPENGATEWAY_API_KEY'] : []), ...(anthropic ? ['ANTHROPIC_API_KEY'] : [])])].filter((key) => key !== 'ELANOUS_LIVE_DETAIL_UNTIL'
+        const passKeys = [...new Set([...(options.passEnv ?? []), ...(openrouterCredentialNeeded && openrouterKey ? ['OPENROUTER_API_KEY'] : []), ...(openGateway ? ['OPENGATEWAY_API_KEY'] : []), ...(anthropic ? ['ANTHROPIC_API_KEY'] : [])])].filter((key) => key !== 'ELANOUS_GRAPH_GROWTH_SCOPE' && key !== 'ELANOUS_LIVE_DETAIL_UNTIL'
           && key !== POD_GITHUB_CREDENTIAL_TOKEN_ENV && key !== POD_GITHUB_CREDENTIAL_URL_ENV
           && (!grok || !['XAI_API_KEY', 'GROK_API_KEY', 'GROK_CODE_XAI_API_KEY'].includes(key)));
         const skillEnvs: Record<string, string> = options.skillEnv
@@ -2718,7 +2829,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         const hostKey = (k: string): string | undefined => k === 'OPENROUTER_API_KEY' && openrouterCredentialNeeded ? openrouterKey : k === 'OPENGATEWAY_API_KEY' && openGateway ? openGatewayKey : k === 'ANTHROPIC_API_KEY' && anthropic ? anthropicKey : env[k] ?? (options.readKeyCache ?? defaultReadKeyCache)(k);
         const hostFallbackNames = hostConfig.llm.fallbackChain;
         const zaiOverage = zaiLaunchOverage ?? zaiSettingsFromConfig(hostConfig.llm).overage;
-        const normalizedFallback = normalizeFallbackChain(hostFallbackNames);
+        const normalizedFallback = normalizeFallbackChain(hostFallbackNames, hostConfig.llm.provider);
         let fallbackSteps = normalizedFallback.chain;
         let zaiFallbackSpec: ZaiPodSpec | undefined;
         const codexChild = options.provider === undefined || options.provider === 'openai-codex';
@@ -2903,10 +3014,11 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           ...(credentialRelay ? [POD_CREDENTIAL_TOKEN_ENV] : []),
           ...(githubRelay ? [POD_GITHUB_CREDENTIAL_TOKEN_ENV] : []),
         ];
+        const podGrowthScope = env.ELANOUS_GRAPH_GROWTH_SCOPE === 'harness' ? 'harness' : undefined;
         const detail = selectLiveDetail(options.liveDetailFile ? { path: options.liveDetailFile } : {}).state;
         const detailUntil = detail && (detail.scope === 'all' || detail.scope === parentRunId || detail.scope === launchRunId) && detail.until > Date.now()
           ? String(detail.until) : undefined;
-        const armEnv = Object.fromEntries(Object.entries(options.armEnv ?? {}).filter(([key]) => key !== 'ELANOUS_LIVE_DETAIL_UNTIL' && !key.startsWith('ELANOUS_PROMPT_ENHANCE_') && key !== POD_GITHUB_CREDENTIAL_TOKEN_ENV && key !== POD_GITHUB_CREDENTIAL_URL_ENV && (!hostRefresh || !['GH_TOKEN', 'GITHUB_TOKEN', 'GH_CONFIG_DIR'].includes(key))));
+        const armEnv = Object.fromEntries(Object.entries(options.armEnv ?? {}).filter(([key]) => key !== 'ELANOUS_GRAPH_GROWTH_SCOPE' && key !== 'ELANOUS_LIVE_DETAIL_UNTIL' && !key.startsWith('ELANOUS_PROMPT_ENHANCE_') && key !== POD_GITHUB_CREDENTIAL_TOKEN_ENV && key !== POD_GITHUB_CREDENTIAL_URL_ENV && (!hostRefresh || !['GH_TOKEN', 'GITHUB_TOKEN', 'GH_CONFIG_DIR'].includes(key))));
         const seat = env.ELANOUS_HARNESS_SEAT;
         const authorEnv = authorChoice ? {
           ...(authorChoice.modelSource !== 'default' || inferProviderFromModel(authorChoice.model) === 'openai-codex' ? {
@@ -2925,9 +3037,10 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         const reviewDeferredToHost = input.autoMerge === true
           && resolvePodHostAcpReview(options.hostAcpReview, env, options.kubectl ? () => undefined : getUserConfig).enabled;
         if (reviewDeferredToHost) debug.log('self-implement.pod', 'review-deferred-armed', { job: name, env: REVIEW_DEFERRED_TO_HOST_ENV, ...(reviewerPin ? { reviewerPinUnused: reviewerPin } : {}) });
-        const jobArmEnv = grounding || credentialRelay || githubRelay || env.ELANOUS_DISPATCH_RECORDED === '1' || options.armEnv || detailUntil || seat || env.ELANOUS_POD_AUTHOR_ON_POD === '1' || reviewerPin || reviewDeferredToHost || budgetSnapshot
+        const jobArmEnv = grounding || credentialRelay || githubRelay || podGrowthScope || env.ELANOUS_DISPATCH_RECORDED === '1' || options.armEnv || detailUntil || seat || env.ELANOUS_POD_AUTHOR_ON_POD === '1' || reviewerPin || reviewDeferredToHost || budgetSnapshot
           ? {
               ...armEnv,
+              ...(podGrowthScope ? { ELANOUS_GRAPH_GROWTH_SCOPE: podGrowthScope } : {}),
               ...(budgetSnapshot ? { [BUDGET_SNAPSHOT_ENV]: encodeBudgetSnapshot(budgetSnapshot) } : {}),
               ...authorEnv,
               ...(reviewerPin ? { [roleLlmEnvName('review')]: reviewerPin } : {}),
@@ -3413,6 +3526,32 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         for (const row of usagePlan.rows) debug.log(row.category, row.event, row.data);
         const parsed = parseSelfImplementJson(logs);
         const terminal = parseSelfImplementJson(logs.trimEnd().split('\n').at(-1) ?? '');
+        const terminalObservation = podChildTerminalResultObservation(logs);
+        const providerSignature = {
+          grokUnavailableCount: logs.match(/Grok unavailable:\s*run `grok login`/gu)?.length ?? 0,
+          structuredProviderErrors: terminal?.providerErrors ?? parsed?.providerErrors ?? null,
+        };
+        const childResultObservation = {
+          job: name,
+          childRunId: liveChildRunId,
+          jobState: state,
+          containerExitCode: containerExitCode ?? null,
+          ledgerCompleteness,
+          terminalResultObserved: terminalObservation.observed,
+          terminalStage: terminalObservation.stage,
+          terminalOk: terminalObservation.ok,
+          terminalOutcome: terminalObservation.outcome,
+          terminalFailureClassification: terminalObservation.failureClassification,
+          providerSignature,
+        };
+        debug.log('self-implement.pod', 'child-terminal-result-observed', childResultObservation);
+        try {
+          appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-child-terminal-result-observation', data: childResultObservation }, ledgerDir);
+        } catch (error) {
+          debug.log('self-implement.pod', 'child-terminal-result-observation-write-failed', {
+            job: name, childRunId: liveChildRunId, reason: error instanceof Error ? error.message : String(error),
+          }, { level: 'warn' });
+        }
         const nextAccount = codexAccounts?.find((candidate) => candidate !== account);
         if (state === 'failed' && containerExitCode === 7 && !input.signal?.aborted) {
           debug.log('self-implement.pod', 'gh-login-failed', { job: name, attempt: ghLoginRetried ? 2 : 1, tokenExpiresInSec: ghTokenExpiresAt === null ? null : Math.floor((ghTokenExpiresAt - now()) / 1000) });
@@ -3548,7 +3687,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
           }
         }
-        const childFailure = state === 'failed' && !oomKilled && failedReason !== 'DeadlineExceeded'
+        let childFailure = state === 'failed' && !oomKilled && failedReason !== 'DeadlineExceeded'
           ? lastPodChildFailure(logs) : null;
         let childPrFailure: ReturnType<typeof podPrOpenFailure> = null;
         if (childFailure) {
@@ -3573,6 +3712,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           };
         }
         let noResultDiagnostic: string | null = null;
+        let noResultLedgerText: string | null = null;
         let noResultLedgerObservation: { available: boolean; bytes: number; rows: number; lastEvent: string | null } = {
           available: false, bytes: 0, rows: 0, lastEvent: null,
         };
@@ -3582,6 +3722,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         if (noResultCandidate) {
           try {
             const ledgerText = readFileSync(runLedgerPath(liveChildRunId, ledgerDir), 'utf8');
+            noResultLedgerText = ledgerText;
             const ledgerRows = ledgerText.split('\n').filter(Boolean);
             let lastEvent: string | null = null;
             try {
@@ -3594,6 +3735,10 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           catch { /* ledger not returned: do not invent a stage */ }
           noResultDiagnostic ??= 'child terminal result missing; last ledger stage=unknown; round=unknown; mustFix=unknown';
         }
+        if (!childFailure && state === 'failed' && noResultCandidate && noResultLedgerText) {
+          const childError = podNoResultChildError(noResultLedgerText);
+          if (childError) childFailure = { stage: 'pr-open-failed', error: childError, rawError: childError };
+        }
         // POD-FAIL-EVIDENCE-CAPTURE: failed Pods are collected/deleted immediately after terminal handling.
         //   Preserve a bounded log tail for every non-OOM/non-deadline failure, including known child stages:
         //   the terminal result line can be followed by the useful stderr that explains the actual exit.
@@ -3673,6 +3818,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         const noResultIncident = state === 'failed' && failedReason !== 'DeadlineExceeded' && !disposition;
         if (reportDeficit || noResultIncident) {
           const evidence = disposition?.childEvidence;
+          const firstLlm = readPodChildFirstLlmFact(liveChildRunId, ledgerDir, true);
           const diagnosticLines = [
             ...(Array.isArray(evidence?.podLogTail) ? evidence.podLogTail : []),
             ...(typeof evidence?.detail === 'string' ? evidence.detail.split('\n') : []),
@@ -3693,6 +3839,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
             reason: failedReason || containerReason || 'unknown',
             terminationReason: evidence?.terminationReason ?? null,
             providerErrors: disposition?.providerErrors ?? null,
+            firstLlm: firstLlm ?? null,
             oomKilled, podTermination: podTermination ?? null,
             detailTail: evidence?.detailTail ?? null,
             lastLines: diagnosticLines,
@@ -3751,6 +3898,9 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
           if (actual < (memoryGi(nextLimit) ?? actual)) {
             const from = reattachedMemoryLimit ?? memoryLimit;
+            // A retry nobody can place is not a retry: decide pool fitness for the next limit first.
+            const retryUnfit = await retryPoolFit(nextLimit, from);
+            if (retryUnfit) return retryUnfit;
             appendRunLedgerEntry({ runId: ledgerRunId, event: 'pod-oom-retry-intent', data: { attempt: 2, from, to: nextLimit, tier: nextTier, reason: 'OOMKilled', job: name, executionKey, fromChildRunId: liveChildRunId } }, ledgerDir);
             debug.log('self-implement.pod', 'oom-retry', { from, to: nextLimit, tier: nextTier, reason: 'OOMKilled', job: name });
             const deleted = kubectl(['-n', namespace, 'delete', 'job', name, '--ignore-not-found', '--wait=true']);
@@ -3798,6 +3948,13 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         }
         // The host still has the complete Pod log here. The CLI only retains a short stdout tail,
         // so preserve the parsed child facts in the parent ledger before that tail is returned.
+        // OBS-GAP-BATCH-1030 — 자식 LLM 실패의 공급자·HTTP status 를 부모 원장 행에 붙인다.
+        // 줄이 공급자를 이름하지 않으면 이 Pod 의 자식 provider(Pod 옵션 ⊕ 위임 플래그)를 정규 id 로만 쓴다.
+        // ⛔ 본문·자격증명은 담지 않는다 — 귀속은 두 스칼라뿐이다.
+        const childProviderFailure = podChildProviderFailureFact(logs, {
+          providerHint: options.provider ?? podChildProviderOf(podDelegatedChildLlm(jobArgs)?.provider),
+        });
+        const childFirstLlm = readPodChildFirstLlmFact(liveChildRunId, ledgerDir);
         const childEvidenceRow = podChildEvidenceLedgerRow({
           job: name,
           childRunId: liveChildRunId,
@@ -3806,6 +3963,8 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           noResultDiagnostic,
           noResultLogEvidence,
           podTermination,
+          providerFailure: childProviderFailure,
+          firstLlm: childFirstLlm,
         });
         if (childEvidenceRow) {
           // Every terminal attempt writes a marker, including one with no parseable child facts.
@@ -3927,7 +4086,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
       } finally {
         releaseAdmission?.();
       }
-    })();
+    })().then(recordFailure, recordRejectedFailure);
     return { address, done };
   };
 }
@@ -4095,6 +4254,43 @@ export function readPodNoResultLogTail(args: {
   }
 }
 
+/** Keep the terminal result row separate from provider-error text in the same child log. */
+function podChildTerminalResultObservation(logs: string): {
+  observed: boolean;
+  stage: string | null;
+  ok: boolean | null;
+  outcome: string | null;
+  failureClassification: string | null;
+} {
+  const lines = logs.split(/\r\n|\n|\r/u);
+  for (let index = lines.length - 1; index >= 0; index--) {
+    const line = lines[index]!.trim();
+    if (!line.startsWith('{')) continue;
+    let value: unknown;
+    try { value = JSON.parse(line); } catch { continue; }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) continue;
+    const row = value as Record<string, unknown>;
+    const terminal = podTerminalRow(row);
+    if (!terminal) continue;
+    const nested = (row.kind === 'self' || row.kind === 'external')
+      && row.result && typeof row.result === 'object' && !Array.isArray(row.result)
+      ? row.result as Record<string, unknown> : row;
+    const abandoned = nested.abandonedClassification && typeof nested.abandonedClassification === 'object'
+      && !Array.isArray(nested.abandonedClassification) ? nested.abandonedClassification as Record<string, unknown> : null;
+    return {
+      observed: true,
+      stage: terminal.stage,
+      ok: terminal.ok,
+      outcome: typeof nested.outcome === 'string' ? nested.outcome
+        : typeof nested.completionDisposition === 'string' ? nested.completionDisposition
+          : typeof nested.terminationReason === 'string' ? nested.terminationReason : null,
+      failureClassification: typeof nested.failureClassification === 'string' ? nested.failureClassification
+        : typeof abandoned?.classification === 'string' ? abandoned.classification : null,
+    };
+  }
+  return { observed: false, stage: null, ok: null, outcome: null, failureClassification: null };
+}
+
 /** 사람용 런 결과 한 줄 — 수확 브랜치가 있으면 «수확할 브랜치: …» 를 붙인다. */
 export function podRunResultLine(logs: string, branches: readonly string[]): string {
   const result = logs.split('\n').filter((line) => !line.startsWith('ELANOUS_MEM ')).join('\n').slice(-4000);

package/src/task-orchestrator/surfaces/self-implement.ts

@@ -31,6 +31,7 @@ import { isAbandonedClassification, type AbandonedClassificationResult } from '.
 import { createExecution, type Task, type TaskExecution } from '../types.js';
 import type { DispatchContext, DispatchResult } from '../surface-registry.js';
 import { nestedPodResult } from './pod-failure-reason.js';
+import { isTddRecordTag, TDD_RECORD_TAGS, type TddRecordTag } from '../../self-implement/tdd-evidence-tags.js';
 import { SCOPE_EXPANSION_CAP, SCOPE_STOP_REASONS, isProtectedScopePath, type ScopeStopReason } from '../../self-implement/scope-adjacency.js';
 
 /** Result of one self-implement subprocess. */
@@ -145,6 +146,8 @@ export interface PodChildEvidence {
   supervisorVerdict?: unknown;
   goalCauseObserved?: true;
   terminationReason?: unknown;
+  /** TDD report-deficit facts carried as named fields, independent of clipped detail text. */
+  tddEvidenceFailure?: { reason: 'tdd-evidence-missing'; round: number; missing: TddRecordTag[] };
   accountAvailability?: Record<string, unknown>;
   prFailure?: {
     stage: 'pr-open-failed';
@@ -217,6 +220,20 @@ export function podChildEvidenceFromResult(o: Record<string, unknown>): PodChild
     if (o.ok !== false || typeof value !== 'string' || !value.trim()) return undefined;
     return redactSecretText(value).slice(0, 4_000);
   };
+  const rawTddEvidenceFailure = object(o.tddEvidenceFailure);
+  const rawTddMissing = rawTddEvidenceFailure?.missing;
+  const tddEvidenceFailure = o.ok === false && o.terminationReason === 'tdd-evidence-missing'
+    && rawTddEvidenceFailure?.reason === 'tdd-evidence-missing'
+    && typeof rawTddEvidenceFailure.round === 'number' && Number.isSafeInteger(rawTddEvidenceFailure.round) && rawTddEvidenceFailure.round >= 1
+    && Array.isArray(rawTddMissing) && rawTddMissing.length > 0 && rawTddMissing.length <= TDD_RECORD_TAGS.length
+    && rawTddMissing.every(isTddRecordTag)
+    && new Set(rawTddMissing).size === rawTddMissing.length
+    ? {
+        reason: 'tdd-evidence-missing' as const,
+        round: rawTddEvidenceFailure.round,
+        missing: rawTddMissing as TddRecordTag[],
+      }
+    : undefined;
   const failureExitCode = o.ok === false && typeof o.exitCode === 'number'
     && Number.isInteger(o.exitCode) && o.exitCode >= 0 && o.exitCode <= 255 ? o.exitCode : undefined;
   const outOfScopeEdits = scrubValue(o.outOfScopeEdits);
@@ -248,7 +265,10 @@ export function podChildEvidenceFromResult(o: Record<string, unknown>): PodChild
     ...(abandoned ? { abandonedClassification: abandoned } : {}),
     ...(o.supervisorVerdict !== undefined ? { supervisorVerdict: scrubValue(o.supervisorVerdict) } : {}),
     ...(o.goalCauseObserved === true ? { goalCauseObserved: true } : {}),
-    ...(o.terminationReason !== undefined ? { terminationReason: scrubValue(o.terminationReason) } : {}),
+    ...(o.terminationReason === 'tdd-evidence-missing'
+      ? (tddEvidenceFailure ? { terminationReason: 'tdd-evidence-missing' } : {})
+      : o.terminationReason !== undefined ? { terminationReason: scrubValue(o.terminationReason) } : {}),
+    ...(tddEvidenceFailure ? { tddEvidenceFailure } : {}),
     ...(accountAvailability ? { accountAvailability } : {}),
     ...(o.harvestable === true && typeof o.branch === 'string' && o.branch.trim() ? { harvestable: true } : {}),
     ...(typeof o.prNumber === 'number' && Number.isSafeInteger(o.prNumber) && o.prNumber > 0 ? { prNumber: o.prNumber } : {}),
@@ -294,6 +314,8 @@ export interface SelfImplementJobSpawn {
     draft?: boolean;
     /** Distinct-per-job harness-space id → own screen/log buffer. */
     spaceId: string;
+    /** Orchestrator task identity, preserved with terminal Pod failure evidence. */
+    taskId?: string;
     signal?: AbortSignal;
     /** Optional TC-owned warm-worker command. The warm request is advisory; this feature Job remains authoritative. */
     warmWorkerCommand?: WarmWorkerCommand;
@@ -394,6 +416,7 @@ export function createSelfImplementAdapter(opts: SelfImplementAdapterOptions) {
         ...(surface.openPr !== undefined ? { openPr: surface.openPr } : {}),
         ...(surface.draft !== undefined ? { draft: surface.draft } : {}),
         spaceId,
+        taskId: task.id,
         ...(ctx.signal ? { signal: ctx.signal } : {}),
       });
       address = res.address;
@@ -606,8 +629,9 @@ export function reviewGateFields(o: Record<string, unknown>): Pick<SelfImplement
 export function reportUnmappedDispositionFields(
   raw: Record<string, unknown>,
   mapped: SelfImplementDisposition,
+  knownRawFields: readonly string[] = [],
 ): readonly string[] {
-  const known = new Set(Object.keys(mapped));
+  const known = new Set([...Object.keys(mapped), ...knownRawFields]);
   const unmapped = Object.keys(raw).filter((key) => !known.has(key) && raw[key] !== undefined);
   if (unmapped.length > 0) {
     try {
@@ -716,7 +740,7 @@ export function parseSelfImplementJson(stdout: string): SelfImplementDisposition
             && ((o.review as { mustFix: unknown[] }).mustFix).every((item) => typeof item === 'string')
             ? { mustFix: (o.review as { mustFix: string[] }).mustFix } : {}),
       };
-      reportUnmappedDispositionFields(o, mapped);
+      reportUnmappedDispositionFields(o, mapped, ['terminationReason', 'tddEvidenceFailure']);
       return mapped;
     } catch { /* not this line */ }
   }