refactor(cluster,evals): one Kubernetes call family, one diagnostic bound, one image-producer fact

[chughtapan]

A reviewed cleanup inventory over packages/simulator/src/cluster and packages/evals/src. No behaviour is added; the changes collapse facts that were stated more than once and remove one dead bound.

The Kubernetes call families merge (worst offender)

kubernetes/calls.ts carried two parallel wrapper/error families: the society API (request / ignoreAbsent / ClusterError), which was unbounded, and run-control (kubernetesCall / attemptUnlessAbsent / KubernetesCallFailed), bounded via Effect.timeoutFail. They now share one family, so PR #978's stated invariant — bound every Kubernetes call — is true for the workload, secret, and sandbox calls too, and there is one 404-is-absent rule rather than two spellings of it.

ClusterError stays the society seam's declared error because it is public API (SimulatorRunFailure, Society, the run-spec shape canary). The two families reduce to one wrapper plus one Effect.mapError adapter at that seam, rather than to one error type. Society-call failure text now reads create agent sandbox failed (Kubernetes 409) instead of create agent sandbox: <cause message>, and an unanswered call reads did not answer in time.

The controller diagnostic was bounded four times in three units

• evals/src/submission.ts bounded it to 8192 code units after decode. That bound was structurally dead: the submitter publishes at most 8192 UTF-8 bytes, and a string of ≤8192 bytes is ≤8192 code units, so the slice was the identity — while still being able to split a surrogate pair. Deleted, along with the comment that justified it.
• submit.ts's boundedDiagnostic — the byte-aware one — is left as the single authority.
• watch.ts's two layers now name their units (RETAINED_DIAGNOSTIC_CHARACTERS, FETCHED_LOG_BYTES) instead of one constant doing double duty as characters and as limitBytes * 2.

The submission test that asserted trimming now asserts what actually matters there: an over-long diagnostic does not cost the run its receipt.

cli.ts: two constructors that were one

ledgerAllocationFailed and runInfrastructureFailed were the same function twice — two constructors, two optional diagnostic parameters, two ?? constants. They merge into infrastructureFailed, keyed on the summary _tag, and completeSubmission's sequential string-compare dispatch becomes a single check on the discriminant. Both old names were exported only for tests; the tests now go through the merged surface.

cli.ts: one producer descriptor per image

The image-producer fact was spread across four names with the controller script path written twice. There is now one descriptor with the two controller keys aliased to one constant, and EvaluationImageKey is derived from it rather than re-enumerated. The error text still names the producing script, and the existing canary that asserts the named script exists on disk is untouched.

Smaller items

• openclaw/runtime.ts — invisibleWorkspaceFiles() ran once at definition time inside the reachability guard and again per render. It is computed once and carried on the settings snapshot.
• agents/workspace.ts — the McpServer structural union was re-narrowed by "url" in server at three sites. One exported isHttpMcpServer matcher now owns the narrow. No _tag was added: bare { name, url } servers are constructed by downstream callers and must keep working.
• cluster/temporal.ts — the worker-roll visibility query interpolated the operator-supplied taskQueue unescaped. Quotes in the value are doubled, with a test for it, and the never-varying execution status is one constant clause instead of an interpolation pretending to be dynamic.
• cluster/install.ts — INSTALL_ORDER re-enumerated keyof RunWorkerManifests. It now derives from a record checked exhaustive against that type, so a new control-plane object fails to compile until it is given a position. The ordering comment is load-bearing and stays.
• gke/profile.test.mjs — the prelude assertion counted source-text occurrences (begin_cluster_session × 3). It now checks that the function is defined and invoked, which is the property that was meant.
• Comment deletions — six comments that narrated a past change or explained design cleverness rather than saying what the code is. Terraform comments, cluster.sh bash-quirk notes, and the load-bearing invariants in install.ts, calls.ts, openclaw/runtime.ts, workspace.ts, nanoclaw/runtime.ts, and temporal.ts are untouched.

Verification

corepack pnpm check, corepack pnpm test, and corepack pnpm nx run-many -t docs:generate all pass with the tree clean afterwards. Full suite green on the rerun (no flakes). The regression guards held untouched: same-image resubmission stays a no-op, the worker-roll refuse test, the MCP url render tests, and the workspace reachability guard tests.

Note: GitHub Actions is in a major outage as of this writing, so CI has not run on this branch. Please wait for a green CI before merging.

🤖 Generated with Claude Code