[freeqaz]

Problem

An Agent whose Harness or gateway image cannot be pulled shows only REVISION_INCOMPLETE "Waiting for the runtime to become ready." while the kubelet retries, flipping between queued and running until the convergence deadline. Pending codes named an unschedulable Pod, a full Pod quota and workspace waits, but not ErrImagePull / ImagePullBackOff (dogfood D474).

Change

• Kubernetes Compute: the unschedulable observation becomes safePodPendingObservation. It still returns WORKLOAD_UNSCHEDULABLE first. Otherwise it returns the new WORKLOAD_IMAGE_PULL_FAILED when a live Pod's container or init container waits with reason ErrImagePull or ImagePullBackOff. As before, an unavailable observation reports nothing, and a full Pod quota still leads.
• ComputePendingReason gains WORKLOAD_IMAGE_PULL_FAILED. The worker maps it to REVISION_IMAGE_PULL_FAILED.
• Deployment progress copy for REVISION_IMAGE_PULL_FAILED is fixed text: "Kubernetes cannot pull a container image for this Agent and keeps retrying. Ask an administrator to check the runtime image reference and that the cluster's nodes can pull from its registry." Like the other pending codes, it never includes the image reference or the registry's response.
• docs/reference/agents/deployment.md lists the new code. The paragraph was tightened so the page stays at its current word count (2480).
• The public lastAttempt.code is an open string (OpenAPI: 1-64 characters), and no RFC fixes the pending-code set. This follows fix(compute): name a full Namespace Pod quota instead of a bare provisioning wait #2674, which added NAMESPACE_POD_QUOTA_EXCEEDED the same way.

Verification

• tsc --build tsconfig.json: clean.
• node --test tests/conformance/kubernetes-compute.test.mjs: 375/375. The new "a pending dedicated deploy names a container image pull failure" covers agent and gateway Pods, init containers, both reasons, non-pull waits (ContainerCreating, CrashLoopBackOff) and unschedulable precedence. It passes 20/20 on 2 CPUs together with the existing pending-deploy tests.
• tests/integration/postgres-worker-agent-revision.test.mjs: extended with the new code and copy. It needs PostgreSQL and was skipped locally; CI runs it.
• No cluster run.

Risks

• Low. This is a new pending code on an existing path. A client that switches on known codes sees one more value. The Console's Create Agent page does not name this wait yet: it shows the generic provisioning line, as it does for REVISION_UNSCHEDULABLE.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix(compute): name an image pull failure instead of a bare runtime wait This is item 1/1 in the current shard. Shard 0/1.

This temporary status tracks the active review worker. The completed review will appear in the durable ClawSweeper review comment.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.