elanous 0.2.12 → 0.2.14

package/src/nexus/api/merge-approvals-gate.ts

@@ -53,7 +53,7 @@ export function startApprovalGate(input: ApprovalGateInput, deps: ApprovalGateDe
     void Promise.resolve().then(() => (deps.runHostRegate ?? runHostRegate)({
       prNumber: input.prNumber, headCommit: input.headSha, repoRoot: input.repoRoot, verifyOnly: true,
     })).then(async (result) => {
-      let status = result.status ?? (result.passed ? 'passed' : 'failed');
+      let status: ApprovalGateStatus = result.status === 'frozen' ? 'unmeasured' : result.status ?? (result.passed ? 'passed' : 'failed');
       let failures = result.failures.map(({ step, detail }) => `${step} — ${detail.replace(/\s+/g, ' ')}`.slice(0, 800));
       if (status === 'passed') {
         const current = await (deps.readPr ?? readPr)(input);

package/src/nexus/api/personas.ts

@@ -8,6 +8,7 @@ import {
   resolveStatePersonaDir,
 } from '../../persona/global-registry.js';
 import { clonePreset, editPersona, loadPresets } from '../../persona/presets.js';
+import { resolvePersonaAddress } from '../../intake-plane/persona-answer.js';
 import type { PersonaRegistryEvent } from '../../persona/registry.js';
 import type { PersonaProfile } from '../../persona/types.js';
 import {
@@ -99,7 +100,7 @@ export async function handlePersonaGet(
   }
   await awaitGlobalPersonaLoad();
   const registry = getGlobalPersonaRegistry();
-  const persona = registry.get(personaId);
+  const persona = resolvePersonaAddress(personaId, registry);
   if (!persona) return notFound(`persona ${personaId} not found`);
   return jsonResponse({ persona: toWire(persona) }, 200);
 }

package/src/nexus/api/schedules-read.ts

@@ -193,9 +193,13 @@ function inventory(deps: SchedulesReadDeps): { cards: ScheduleCard[]; names: Map
   return { cards, names };
 }
 
+export function readSchedulesInventory(deps: SchedulesReadDeps = {}): ScheduleCard[] {
+  return inventory(deps).cards;
+}
+
 export function handleSchedulesList(req: Request, opts: MetaApiOpts, deps: SchedulesReadDeps = {}): Response {
   if (!checkAuth(req, opts)) return jsonResponse({ error: 'unauthorized' }, 401);
-  const { cards } = inventory(deps);
+  const cards = readSchedulesInventory(deps);
   const schedules = new URL(req.url).searchParams.get('includeOff') === '1' ? cards : cards.filter(c => c.state !== 'off');
   return jsonResponse({ schedules, count: schedules.length }, 200);
 }

package/src/nexus/api/skill-exec-route.ts

@@ -0,0 +1,97 @@
+import { randomUUID } from 'node:crypto';
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { debug } from '../../debug/log.js';
+import { effectiveInstanceRoot } from '../../instance/resolve.js';
+import { dispatchSkillExec } from '../../tool-runtime/skill-exec-runtime.js';
+import { jsonResponse } from './json-response.js';
+
+export const SKILL_EXEC_PATH = '/v1/skills/exec';
+
+type SkillJob = {
+  id: string;
+  skill: string;
+  status: 'running' | 'done' | 'rejected' | 'failed';
+  updatedAt: number;
+  ok?: boolean;
+  output?: string;
+  reason?: 'not-allowlisted';
+  error?: string;
+};
+
+type SkillExecDeps = {
+  rootDir?: string;
+  exec?: typeof dispatchSkillExec;
+  now?: () => number;
+};
+
+export function createSkillExecJobs({ rootDir = effectiveInstanceRoot(), exec = dispatchSkillExec, now = Date.now }: SkillExecDeps = {}) {
+  const base = join(rootDir, 'skill-exec');
+  const active = new Set<string>();
+  const unavailable = new Set<string>();
+  const file = (id: string) => join(base, `${id}.json`);
+  const save = (job: SkillJob) => {
+    mkdirSync(base, { recursive: true, mode: 0o700 });
+    chmodSync(base, 0o700);
+    writeFileSync(file(job.id), JSON.stringify(job), { mode: 0o600 });
+    chmodSync(file(job.id), 0o600);
+  };
+
+  return {
+    async post(req: Request): Promise<Response> {
+      let body: unknown;
+      try { body = await req.json(); } catch { body = null; }
+      if (!body || typeof body !== 'object' || Array.isArray(body)) return jsonResponse({ error: 'bad_request' }, 400);
+      const { skill, task } = body as Record<string, unknown>;
+      if (typeof skill !== 'string' || !skill.trim() || typeof task !== 'string' || !task.trim() || task.length > 4000) {
+        return jsonResponse({ error: 'bad_request' }, 400);
+      }
+      const id = randomUUID();
+      const update = (status: SkillJob['status'], fields: Partial<Pick<SkillJob, 'ok' | 'output' | 'reason' | 'error'>> = {}) =>
+        save({ id, skill, status, updatedAt: now(), ...fields });
+      update('running');
+      active.add(id);
+      debug.log('skill-exec.pwa', 'started', { id, skill });
+      setTimeout(() => {
+        void (async () => {
+          try {
+            const result = await exec({ skill, task });
+            if (!result.ok && result.output.startsWith(`자동 실행 대상 아님: ${skill}.`)) {
+              update('rejected', { reason: 'not-allowlisted' });
+              debug.log('skill-exec.pwa', 'rejected', { id, skill });
+            } else {
+              update('done', { ok: result.ok, output: result.output.slice(0, 20_000) });
+              debug.log('skill-exec.pwa', 'done', { id, skill });
+            }
+          } catch {
+            try {
+              update('failed', { error: 'skill-exec-failed' });
+            } catch {
+              unavailable.add(id);
+            }
+            debug.log('skill-exec.pwa', 'failed', { id, skill });
+          } finally {
+            active.delete(id);
+          }
+        })().catch(() => {
+          unavailable.add(id);
+          active.delete(id);
+        });
+      });
+      return jsonResponse({ id }, 202);
+    },
+    get(id: string): Response {
+      if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) return jsonResponse({ error: 'not-found' }, 404);
+      if (unavailable.has(id)) return jsonResponse({ id, status: 'failed', error: 'skill-exec-failed' });
+      let job: SkillJob;
+      try { job = JSON.parse(readFileSync(file(id), 'utf8')) as SkillJob; }
+      catch { return jsonResponse({ error: 'not-found' }, 404); }
+      if (job.id !== id) return jsonResponse({ error: 'not-found' }, 404);
+      if (job.status === 'running' && !active.has(id)) return jsonResponse({ id, status: 'failed', error: 'daemon-restarted' });
+      const { status, ok, output, reason, error } = job;
+      return jsonResponse({ id, status, ...(ok !== undefined ? { ok } : {}), ...(output !== undefined ? { output } : {}), ...(reason ? { reason } : {}), ...(error ? { error } : {}) });
+    },
+  };
+}
+
+export type SkillExecJobs = ReturnType<typeof createSkillExecJobs>;

package/src/nexus/api/task-cards-api.ts

@@ -1,4 +1,8 @@
-import { CardStore } from '../../task-cards/card-store.js';
+import { Database } from 'bun:sqlite';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { CardStore, type TaskCard } from '../../task-cards/card-store.js';
+import { releaseLedgerRoot } from '../../instance/resolve.js';
 import { createWishCard } from '../../intake-plane/wish-card.js';
 import { jsonResponse } from './json-response.js';
 
@@ -7,19 +11,53 @@ export async function handleTaskCardsWishPost(req: Request, root?: string): Prom
   try { body = await req.json(); }
   catch { return jsonResponse({ error: 'bad_request' }, 400); }
   if (!body || typeof body !== 'object' || Array.isArray(body)) return jsonResponse({ error: 'bad_request' }, 400);
-  const { text, ref } = body as Record<string, unknown>;
-  if (typeof text !== 'string' || !text.trim() || typeof ref !== 'string' || !ref.trim()) {
+  const { text, ref, sessionId } = body as Record<string, unknown>;
+  if (typeof text !== 'string' || !text.trim() || typeof ref !== 'string' || !ref.trim()
+    || typeof sessionId !== 'string' || !sessionId.trim()) {
     return jsonResponse({ error: 'bad_request' }, 400);
   }
   const store = new CardStore(root);
   try {
-    const card = createWishCard({ text, source: 'pwa', ref }, store);
+    const card = createWishCard({ text, source: 'pwa', ref, replyTo: { surface: 'pwa', sessionId } }, store);
     return jsonResponse(card, card.created ? 201 : 200);
   } finally {
     store.close();
   }
 }
 
+export interface WishPlacement { cellId: string; cellTitle: string; version: string; status: 'green' | 'yellow' | 'red' | 'done' }
+
+export function isSplitCell(cell: unknown): cell is { id: string } {
+  return cell !== null && typeof cell === 'object' && 'id' in cell
+    && typeof cell.id === 'string' && cell.id.trim().length > 0;
+}
+
+/** Join the live checklist to the wish card by the split cell ID, never by title or card status. */
+export function wishPlacements(card: TaskCard, root?: string): WishPlacement[] {
+  if (!card.goalId.startsWith('wish:')) return [];
+  const split = [...card.sections].reverse().find(section => section.key === 'orch:split');
+  if (!split) return [];
+  let cells: unknown;
+  try { cells = JSON.parse(split.content); } catch { return []; }
+  if (!Array.isArray(cells)) return [];
+  const ids = [...new Set(cells.filter(isSplitCell).map(cell => cell.id.trim()))];
+  if (!ids.length) return [];
+  const ledgerRoot = root ?? releaseLedgerRoot();
+  const path = join(ledgerRoot, 'release', 'features.sqlite');
+  if (!existsSync(path)) return [];
+  const db = new Database(path, { readonly: true, strict: true });
+  try {
+    const placements: WishPlacement[] = [];
+    for (const cellId of ids) {
+      const rows = db.query('SELECT a.version, a.status, COALESCE(a.title_override, f.title) AS title FROM assignments a JOIN features f ON f.id = a.feature_id WHERE a.feature_id = ? ORDER BY a.version').all(cellId) as Array<{ version: string; status: string; title: string }>;
+      for (const row of rows) if (['green', 'yellow', 'red', 'done'].includes(row.status)) {
+        placements.push({ cellId, cellTitle: row.title, version: row.version, status: row.status as WishPlacement['status'] });
+      }
+    }
+    return placements;
+  } finally { db.close(); }
+}
+
 /** Read-only card API; route registration and authorization belong to the HTTP server. */
 export function handleTaskCardsGet(pathname: string, root?: string): Response {
   if (pathname !== '/v1/task-cards' && !/^\/v1\/task-cards\/[^/]+$/.test(pathname)) {
@@ -46,7 +84,8 @@ export function handleTaskCardsGet(pathname: string, root?: string): Response {
   const store = new CardStore(root);
   try {
     const card = store.getCard(id);
-    return card ? jsonResponse({ card }) : jsonResponse({ error: 'not_found' }, 404);
+    return card ? jsonResponse({ card, ...(card.goalId.startsWith('wish:') ? { placements: wishPlacements(card, root) } : {}) })
+      : jsonResponse({ error: 'not_found' }, 404);
   } finally {
     store.close();
   }

package/src/nexus/api/workflows.ts

@@ -302,6 +302,7 @@ export async function handleWorkflowPut(
   }
   const r = saveWorkflow(name, yamlText, { scope });
   if (!r.ok) {
+    if (r.readonly) return jsonResponse({ error: 'readonly_workflow', reason: r.error }, 409);
     return jsonResponse(
       {
         error: 'invalid_workflow',
@@ -323,7 +324,7 @@ export function handleWorkflowDelete(
   const url = new URL(req.url);
   const scope = url.searchParams.get('scope') === 'global' ? 'global' : 'project';
   const r = deleteWorkflow(name, { scope });
-  if (!r.ok) return jsonResponse({ error: 'delete_failed', reason: r.error }, 404);
+  if (!r.ok) return jsonResponse({ error: r.readonly ? 'readonly_workflow' : 'delete_failed', reason: r.error }, r.readonly ? 409 : 404);
   return jsonResponse({ ok: true, path: r.path, scope }, 200);
 }
 

package/src/persona/loader.ts

@@ -138,6 +138,22 @@ export function validatePersonaShape(
     models = mr.models;
   }
 
+  let seat: string | undefined;
+  if (Object.hasOwn(obj, 'seat')) {
+    if (typeof obj['seat'] !== 'string' || !obj['seat'].trim()) {
+      return err(path, 'seat must be a non-empty string');
+    }
+    seat = obj['seat'];
+  }
+
+  let todo: string | undefined;
+  if (Object.hasOwn(obj, 'todo')) {
+    if (typeof obj['todo'] !== 'string' || !/^[a-z0-9_][a-z0-9_-]*\.todo\.jsonl$/i.test(obj['todo'])) {
+      return err(path, 'todo must be a per-persona .todo.jsonl filename');
+    }
+    todo = obj['todo'];
+  }
+
   let mentionPatterns: readonly string[] | undefined;
   if (obj['mentionPatterns'] !== undefined) {
     if (!Array.isArray(obj['mentionPatterns'])
@@ -149,6 +165,8 @@ export function validatePersonaShape(
 
   const profile: PersonaProfile = {
     personaId, displayName,
+    ...(seat !== undefined ? { seat } : {}),
+    ...(todo !== undefined ? { todo } : {}),
     ...(description.value !== undefined ? { description: description.value } : {}),
     ...(systemPrompt.value !== undefined ? { systemPrompt: systemPrompt.value } : {}),
     ...(brand !== undefined ? { brand } : {}),

package/src/persona/persona-todo.ts

@@ -6,6 +6,8 @@ export interface PersonaTodo {
   title: string;
   status: 'open' | 'done';
   createdAt: string;
+  priority?: number;
+  dueAt?: string;
 }
 
 export interface PersonaTodoReadResult {
@@ -28,7 +30,9 @@ function isPersonaTodo(value: unknown): value is PersonaTodo {
     && typeof item.title === 'string' && item.title.length > 0
     && (item.status === 'open' || item.status === 'done')
     && typeof item.createdAt === 'string'
-    && Number.isFinite(Date.parse(item.createdAt));
+    && Number.isFinite(Date.parse(item.createdAt))
+    && (item.priority === undefined || (typeof item.priority === 'number' && Number.isInteger(item.priority) && item.priority >= 0))
+    && (item.dueAt === undefined || (typeof item.dueAt === 'string' && Number.isFinite(Date.parse(item.dueAt))));
 }
 
 /** Missing files are empty; malformed lines are skipped and returned for observation. */
@@ -67,13 +71,14 @@ export function writePersonaTodos(dir: string, personaId: string, todos: readonl
   writeFileSync(path, todos.map(todo => JSON.stringify(todo)).join('\n') + (todos.length ? '\n' : ''), 'utf8');
 }
 
-/** Earliest created open item; original order breaks equal-timestamp ties. */
+/** Higher priority first, then earlier deadline, then earlier creation; file order breaks ties. */
+export function orderedPersonaTodos(todos: readonly PersonaTodo[]): PersonaTodo[] {
+  return [...todos].filter((todo) => todo.status === 'open').sort((a, b) =>
+    (b.priority ?? 0) - (a.priority ?? 0)
+    || (a.dueAt && b.dueAt ? Date.parse(a.dueAt) - Date.parse(b.dueAt) : a.dueAt ? -1 : b.dueAt ? 1 : 0)
+    || Date.parse(a.createdAt) - Date.parse(b.createdAt));
+}
+
 export function nextPersonaTodo(todos: readonly PersonaTodo[]): PersonaTodo | null {
-  let oldest: PersonaTodo | null = null;
-  for (const todo of todos) {
-    if (todo.status === 'open' && (!oldest || Date.parse(todo.createdAt) < Date.parse(oldest.createdAt))) {
-      oldest = todo;
-    }
-  }
-  return oldest;
+  return orderedPersonaTodos(todos)[0] ?? null;
 }

package/src/persona/presets.ts

@@ -88,6 +88,7 @@ export function presetToProfileYaml(p: PersonaPreset, common: PresetCommon, opts
     displayName: opts.name?.trim() ? `${opts.name.trim()} · ${p.role}` : p.displayName,
     description: p.oneLine,
     systemPrompt: presetSystemPrompt(p, common, name),
+    todo: `${opts.personaId}.todo.jsonl`,
     preset: { id: p.personaId, role: p.role, ...(title ? { title } : {}), tools: p.tools.map((t) => t.name), firstQuestions: p.firstQuestions },
   };
   return `# 프리셋 «${p.personaId}» 에서 만든 페르소나 — elanous persona add (원본: persona-presets/${p.personaId}.yaml)\n${stringify(profile, { lineWidth: 0 })}`;
@@ -99,7 +100,7 @@ export interface PersonaWriteResult { personaId: string; displayName: string; pa
 // Only fields in the runtime persona schema may be edited; provenance (`preset`) is retained, not editable.
 const PROFILE_KEYS = new Set([
   'personaId', 'displayName', 'description', 'systemPrompt', 'actionHosts', 'offsiteNavigation',
-  'brand', 'models', 'mentionPatterns', 'avatarUrl', 'brandColor', 'browserPort', 'residence', 'capabilities',
+  'brand', 'models', 'mentionPatterns', 'avatarUrl', 'brandColor', 'browserPort', 'residence', 'capabilities', 'todo',
 ]);
 const NESTED_KEYS: Record<string, readonly string[]> = {
   models: ['primary', 'fallback', 'providers'], 'models.providers': ['ollama', 'openai'],

package/src/persona/team.ts

@@ -0,0 +1,105 @@
+import { readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { parseDocument } from 'yaml';
+import { parsePersonaYaml } from './loader.js';
+
+export interface TeamMember {
+  persona: string;
+  title: string;
+  checklistTemplate: string[];
+}
+
+export interface TeamHandoff {
+  from: string;
+  to: string;
+}
+
+export interface TeamDefinition {
+  name: string;
+  members: TeamMember[];
+  handoffs: TeamHandoff[];
+}
+
+function mapping(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function fields(value: Record<string, unknown>, required: readonly string[], label: string): void {
+  for (const key of required) {
+    if (!Object.hasOwn(value, key)) throw new Error(`${label}.${key} is required`);
+  }
+  for (const key of Object.keys(value)) {
+    if (!required.includes(key)) throw new Error(`${label}.${key} is not a team schema field`);
+  }
+}
+
+function text(value: unknown, label: string): string {
+  if (typeof value !== 'string' || !value.trim()) throw new Error(`${label} must be a non-empty string`);
+  return value;
+}
+
+/** Read-only validation: resolve persona paths relative to the team file, not the caller's cwd. */
+export function validateTeamFile(file: string): TeamDefinition {
+  const document = parseDocument(readFileSync(file, 'utf8'), { uniqueKeys: true });
+  if (document.errors.length) throw new Error(`invalid team YAML: ${document.errors[0]!.message}`);
+  const raw: unknown = document.toJS();
+  if (!mapping(raw)) throw new Error('team must be a YAML mapping');
+  fields(raw, ['name', 'members', 'handoffs'], 'team');
+  const name = text(raw.name, 'team.name');
+  if (!Array.isArray(raw.members) || raw.members.length === 0) {
+    throw new Error('team.members must be a non-empty list');
+  }
+  const titles = new Set<string>();
+  const personaIds = new Set<string>();
+  const members: TeamMember[] = raw.members.map((item: unknown, index: number) => {
+    const label = `team.members[${index}]`;
+    if (!mapping(item)) throw new Error(`${label} must be a mapping`);
+    fields(item, ['persona', 'title', 'checklistTemplate'], label);
+    const persona = text(item.persona, `${label}.persona`);
+    const title = text(item.title, `${label}.title`);
+    if (titles.has(title)) throw new Error(`duplicate team title: ${title}`);
+    titles.add(title);
+    if (!Array.isArray(item.checklistTemplate) || item.checklistTemplate.length === 0) {
+      throw new Error(`${label}.checklistTemplate must be a non-empty list of strings`);
+    }
+    const checklistTemplate = item.checklistTemplate.map((entry: unknown) => text(entry, `${label}.checklistTemplate item`));
+    const personaPath = resolve(dirname(file), persona);
+    let yaml: string;
+    try {
+      yaml = readFileSync(personaPath, 'utf8');
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') throw new Error(`persona not found: ${persona} (${title})`);
+      throw error;
+    }
+    const parsed = parsePersonaYaml(yaml, personaPath);
+    if (!parsed.ok) throw new Error(`invalid persona ${persona}: ${parsed.error.message}`);
+    if (parsed.profile.seat !== title) throw new Error(`persona seat mismatch: ${persona} requires seat ${title}`);
+    if (personaIds.has(parsed.profile.personaId)) throw new Error(`duplicate personaId: ${parsed.profile.personaId}`);
+    personaIds.add(parsed.profile.personaId);
+    return { persona, title, checklistTemplate };
+  });
+  if (!Array.isArray(raw.handoffs)) throw new Error('team.handoffs must be a list');
+  const handoffs: TeamHandoff[] = raw.handoffs.map((item: unknown, index: number) => {
+    const label = `team.handoffs[${index}]`;
+    if (!mapping(item)) throw new Error(`${label} must be a mapping`);
+    fields(item, ['from', 'to'], label);
+    const from = text(item.from, `${label}.from`);
+    const to = text(item.to, `${label}.to`);
+    if (!titles.has(from) || !titles.has(to)) throw new Error(`handoff references missing title: ${from} -> ${to}`);
+    return { from, to };
+  });
+  const edges = new Map([...titles].map((title) => [title, [] as string[]]));
+  for (const { from, to } of handoffs) edges.get(from)!.push(to);
+  const visiting = new Set<string>();
+  const visited = new Set<string>();
+  const visit = (title: string): void => {
+    if (visiting.has(title)) throw new Error(`handoff cycle at ${title}`);
+    if (visited.has(title)) return;
+    visiting.add(title);
+    for (const next of edges.get(title)!) visit(next);
+    visiting.delete(title);
+    visited.add(title);
+  };
+  for (const title of titles) visit(title);
+  return { name, members, handoffs };
+}

package/src/persona/types.ts

@@ -19,6 +19,10 @@ export type PersonaBrand =
 export interface PersonaProfile {
   readonly personaId: string;
   readonly displayName: string;
+  /** Seat address (title, id or alias) represented by this persona. */
+  readonly seat?: string;
+  /** Per-persona JSONL todo filename in the state persona directory. */
+  readonly todo?: string;
   readonly description?: string;
 
   /** System prompt to prepend in LLM calls. Markdown text. May

package/src/pod-lease/host-lease.ts

@@ -2,12 +2,32 @@
 // in a per-user directory; a launch is admitted only while live leases stay under the pool's measured total.
 // Without this, independent CLI processes each measured an empty pool and all launched (review round 2 of #23212).
 import { spawnSync } from 'node:child_process';
-import { mkdirSync, readdirSync, readFileSync, rmSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir, userInfo } from 'node:os';
 import { join } from 'node:path';
 import { debug } from '../debug/log.js';
 
-export interface HostLeaseRecord { pid: number; startedAt: string; at: string }
+export interface HostLeaseRecord { pid: number; startedAt: string; at: string; stage?: 'authoring' | 'job'; claimed?: boolean; job?: string; context?: string; namespace?: string }
+
+export interface PendingJobIdentity { context: string; namespace: string; job: string }
+
+/** Only the same cluster, namespace and Job can account for an existing host lease. */
+export function leaseHasPendingPod(lease: HostLeaseRecord, pending: readonly PendingJobIdentity[]): boolean {
+  return lease.stage === 'job' && !!lease.context && !!lease.namespace && !!lease.job &&
+    pending.some((pod) => pod.context === lease.context && pod.namespace === lease.namespace && pod.job === lease.job);
+}
+
+export interface HostLeaseHandle {
+  (): void;
+  readonly id: string;
+  /** Job creation is not release: retain the lease until its Pod is observed Running or terminal. */
+  applied: (job: string, context: string, namespace: string) => void;
+}
+
+/** A Job without a Running/terminal Pod still occupies a host reservation. */
+export function hostLeaseCounts(records: readonly HostLeaseRecord[]): { reserved: number; waitingJobs: number } {
+  return { reserved: records.filter((r) => r.stage !== 'job').length, waitingJobs: records.filter((r) => r.stage === 'job').length };
+}
 
 export interface HostPoolLeaseOptions {
   /** Base directory — default `$TMPDIR/elanous-pod-leases-<uid>` (0700). */
@@ -53,8 +73,42 @@ export class HostPoolLease {
     this.staleLockMs = options.staleLockMs ?? 10_000;
   }
 
+  reservationIsOther(id: string): boolean {
+    if (!/^[A-Za-z0-9._-]+\.json$/.test(id)) return false;
+    try {
+      const record = JSON.parse(readFileSync(join(this.dir, id), 'utf8')) as HostLeaseRecord;
+      return record.stage === 'authoring' && Number.isSafeInteger(record.pid) && record.pid > 0 &&
+        typeof record.startedAt === 'string' && this.processStart(record.pid) === record.startedAt &&
+        (record.pid !== this.pid || record.startedAt !== this.selfStart());
+    } catch { return false; }
+  }
+
+  /** Transfer a reservation across the authoring → orchestrator process boundary. */
+  claim(id: string): HostLeaseHandle | null {
+    if (!/^[A-Za-z0-9._-]+\.json$/.test(id)) return null;
+    const file = join(this.dir, id);
+    const deadline = Date.now() + this.staleLockMs;
+    while (!this.lock()) {
+      if (Date.now() >= deadline) return null;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+    }
+    try {
+      if (this.ownStart === undefined) this.ownStart = this.processStart(this.pid);
+      if (!this.ownStart) return null;
+      const original = JSON.parse(readFileSync(file, 'utf8')) as HostLeaseRecord;
+      if (original.stage !== 'authoring' || original.claimed || !Number.isSafeInteger(original.pid) || original.pid <= 0 ||
+        typeof original.startedAt !== 'string' || this.processStart(original.pid) !== original.startedAt) return null;
+      const record: HostLeaseRecord = { ...original, pid: this.pid, startedAt: this.ownStart, claimed: true };
+      this.replaceRecord(file, record);
+      return this.handle(file, record, id);
+    } catch { return null; }
+    finally { this.unlock(); }
+  }
+
   /** Live leases after removing stale ones (dead pid or a recycled pid whose start time differs). */
-  live(): HostLeaseRecord[] {
+  live(): HostLeaseRecord[] { return this.readLive(false); }
+
+  private readLive(lockHeld: boolean): HostLeaseRecord[] {
     const out: HostLeaseRecord[] = [];
     let names: string[] = [];
     try { names = readdirSync(this.dir).filter((name) => name.endsWith('.json')); } catch { return out; }
@@ -62,50 +116,106 @@ export class HostPoolLease {
       const file = join(this.dir, name);
       let record: HostLeaseRecord | null = null;
       try { record = JSON.parse(readFileSync(file, 'utf8')) as HostLeaseRecord; } catch { record = null; }
-      const alive = record && this.processStart(record.pid) === record.startedAt;
+      const alive = record && Number.isSafeInteger(record.pid) && record.pid > 0 && typeof record.startedAt === 'string'
+        && this.processStart(record.pid) === record.startedAt;
       if (record && alive) { out.push(record); continue; }
-      try { unlinkSync(file); } catch { /* another process cleaned it */ }
-      debug.log('pod.lease', 'host-lease-stale-cleared', { file: name, pid: record?.pid ?? null });
+      // A concurrent claim can replace the record while we check the original PID.
+      if (!lockHeld && !this.lock()) { if (record) out.push(record); continue; }
+      try {
+        let current: HostLeaseRecord | null;
+        try { current = JSON.parse(readFileSync(file, 'utf8')) as HostLeaseRecord; } catch { current = null; }
+        if (current && Number.isSafeInteger(current.pid) && current.pid > 0 && typeof current.startedAt === 'string' &&
+          this.processStart(current.pid) === current.startedAt) { out.push(current); continue; }
+        try { unlinkSync(file); } catch { /* already cleaned */ }
+        debug.log('pod.lease', 'host-lease-stale-cleared', { file: name, pid: current?.pid ?? null });
+      } finally { if (!lockHeld) this.unlock(); }
     }
     return out;
   }
 
-  /** Unapplied leases held by other processes — launches admitted elsewhere whose Job the cluster can't see yet. */
-  othersPending(): number {
+  selfStart(): string | null {
     if (this.ownStart === undefined) this.ownStart = this.processStart(this.pid);
-    return this.live().filter((r) => !(r.pid === this.pid && r.startedAt === this.ownStart)).length;
+    return this.ownStart;
+  }
+
+  /** Reservations held by other processes while the cluster cannot yet observe them. */
+  othersPending(): number {
+    return this.live().filter((r) => !(r.pid === this.pid && r.startedAt === this.selfStart())).length;
   }
 
   /**
-   * Under the host lock, take a lease only if `allowed(othersPending)` holds — the check and the write are one step,
-   * so independent processes measuring the same empty pool cannot all pass. Null = refused or lock busy (retry later).
+   * Under the host lock, take a lease only if `allowed(pending)` holds — the check and the write are one step.
+   * By default pending excludes this process's permits (the local admission gate owns them); includeOwn
+   * counts every reservation for independent authoring launches from the same process.
+   * Null = refused or lock busy (retry later).
    */
-  tryReserve(allowed: (othersPending: number) => boolean): (() => void) | null {
+  tryReserve(allowed: (othersPending: number) => boolean, includeOwn = false): HostLeaseHandle | null {
     try { mkdirSync(this.dir, { recursive: true, mode: 0o700 }); } catch { return null; }
     if (!this.lock()) return null;
     try {
       if (this.ownStart === undefined) this.ownStart = this.processStart(this.pid);
       if (!this.ownStart) return null;
-      const others = this.live().filter((r) => !(r.pid === this.pid && r.startedAt === this.ownStart)).length;
+      const others = this.readLive(true).filter((r) => includeOwn || !(r.pid === this.pid && r.startedAt === this.ownStart)).length;
       if (!allowed(others)) {
         debug.log('pod.lease', 'host-lease-refused', { othersPending: others });
         return null;
       }
       const file = join(this.dir, `${this.pid}-${this.now()}-${Math.random().toString(36).slice(2, 8)}.json`);
-      const record: HostLeaseRecord = { pid: this.pid, startedAt: this.ownStart, at: new Date(this.now()).toISOString() };
+      const record: HostLeaseRecord = { pid: this.pid, startedAt: this.ownStart, at: new Date(this.now()).toISOString(), stage: 'authoring' };
       writeFileSync(file, JSON.stringify(record), { flag: 'wx', mode: 0o600 });
       debug.log('pod.lease', 'host-lease-acquired', { othersPending: others });
-      let released = false;
-      return () => {
-        if (released) return;
-        released = true;
-        try { unlinkSync(file); } catch { /* already cleaned */ }
-      };
+      return this.handle(file, record, file.slice(this.dir.length + 1));
     } finally {
       this.unlock();
     }
   }
 
+  private replaceRecord(file: string, record: HostLeaseRecord): void {
+    const temp = `${file}.${this.pid}-${Math.random().toString(36).slice(2)}.tmp`;
+    try {
+      writeFileSync(temp, JSON.stringify(record), { flag: 'wx', mode: 0o600 });
+      renameSync(temp, file);
+    } catch (error) {
+      try { unlinkSync(temp); } catch { /* already gone */ }
+      throw error;
+    }
+  }
+
+  private handle(file: string, record: HostLeaseRecord, id: string): HostLeaseHandle {
+    let released = false;
+    const release = (() => {
+      if (released) return;
+      // Claim replaces the same file under this lock. An old owner must not unlink a
+      // newly transferred reservation between reading and removing its record.
+      const deadline = Date.now() + this.staleLockMs;
+      while (!this.lock()) {
+        if (Date.now() >= deadline) return;
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+      }
+      try {
+        const current = JSON.parse(readFileSync(file, 'utf8')) as HostLeaseRecord;
+        if (current.pid === record.pid && current.startedAt === record.startedAt && current.claimed === record.claimed) unlinkSync(file);
+      } catch { /* transferred or already cleaned */ }
+      finally { released = true; this.unlock(); }
+    }) as HostLeaseHandle;
+    Object.defineProperty(release, 'id', { value: id });
+    release.applied = (job, context, namespace) => {
+      if (released) return;
+      const deadline = Date.now() + this.staleLockMs;
+      while (!this.lock()) {
+        if (Date.now() >= deadline) throw new Error('pod lease: cannot update Job reservation');
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+      }
+      try {
+        const current = JSON.parse(readFileSync(file, 'utf8')) as HostLeaseRecord;
+        if (current.pid !== record.pid || current.startedAt !== record.startedAt || current.claimed !== record.claimed) throw new Error('pod lease: reservation owner changed');
+        if (!job || !context || !namespace) throw new Error('pod lease: Job identity requires context, namespace and name');
+        this.replaceRecord(file, { ...record, stage: 'job', job, context, namespace });
+      } finally { this.unlock(); }
+    };
+    return release;
+  }
+
   private lockDir(): string { return join(this.dir, '.lock'); }
 
   private lock(): boolean {