elanous 0.2.28 → 0.2.31

package/src/context-bus/context-now.ts

@@ -1,13 +1,15 @@
 import { existsSync, lstatSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { isMainThread, parentPort, workerData, Worker } from 'node:worker_threads';
 import { queryRunningRuns, type QueriedRunningRunsResult } from '../self-implement/running-runs.js';
-import { loadRunLedger } from '../self-implement/run-ledger.js';
+import { loadRunLedger, resolveFederatedRunLedgerDirectories, runLedgerDir } from '../self-implement/run-ledger.js';
 import { localLoopRows } from '../dashboard/slash-runtime/loops-table.js';
 import { checkBrand } from '../../scripts/brand/check.js';
 import { debug, redactSecretText } from '../debug/log.js';
 import { DecisionLedger, type DecisionEntry } from '../decisions/decision-ledger.js';
 import { listChecklist, devVersion, type Checklist } from '../release-loop/checklist.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { setElanousConfigDir } from '../elanous-config-dir.js';
 import { seatDay, seatLedgerPath, type SeatEntry } from '../seat-loop/seat-loop.js';
 import { listCoordEvents, type CoordEvent } from './coord-events.js';
 import { filterPublicDemoContext } from './context-now-public.js';
@@ -50,12 +52,32 @@ function todaySeatEntries(now: Date): Array<{ entry: SeatEntry; source: string }
   });
 }
 
+function seatFact({ entry, source }: { entry: SeatEntry; source: string }): Extract<ContextFact, { kind: 'seat' }> {
+  return { kind: 'seat', seat: entry.seat, at: entry.at, status: entry.status,
+    id: entry.item?.id ?? null, title: entry.item?.source === 'checklist'
+      ? redactSecretText(entry.item.title.split(/\r?\n/, 1)[0] ?? '').slice(0, 120) : null, source };
+}
+
+/** The TUI status line needs seat facts only; it must not scan release or run ledgers. */
+export function seatStatusNow(now = new Date()): ContextNowAnswer {
+  return { at: `${now.toISOString().slice(0, 16)}:00.000Z`, topic: null,
+    facts: todaySeatEntries(now).map(seatFact), events: [], guide: [] };
+}
+
 const runSource = 'elanous://self-implement/running-runs';
 const releaseSource = 'elanous://graph-runs/release-loop';
 const scheduleSource = 'elanous://schedules';
 const oneLine = (text: string) => redactSecretText(text.split(/\r?\n/, 1)[0] ?? '').slice(0, 120);
 
-function runningRunFacts(now: Date, queryRuns: () => QueriedRunningRunsResult = () => queryRunningRuns({ includeTest: false, caller: 'context-now' })): Extract<ContextFact, { kind: 'run' }>[] {
+// src/dashboard/slash-runtime/dashboard-handlers.ts:buildDashboardSlashRegistry /now calls contextNowInWorker;
+// contextNow → queryRunningRuns → queryFederatedUnfinishedRunLedgers → queryUnfinishedRunLedgers (persisted scan index).
+function runningRunFacts(now: Date, queryRuns: () => QueriedRunningRunsResult = () => queryRunningRuns({
+  includeTest: false,
+  caller: 'context-now',
+  noCache: false,
+}, {
+  ledgerDirectories: () => [...new Set([runLedgerDir(), ...resolveFederatedRunLedgerDirectories({ includeTest: false })])],
+})): Extract<ContextFact, { kind: 'run' }>[] {
   const observed = queryRuns();
   const unreadable = observed.completeness === 'partial' || observed.pty.unreadable.length || !!observed.phases?.unreadableTargetCount;
   const facts = observed.entries.filter(entry => observed.countedStatuses.includes(entry.status)).slice(0, 8).flatMap(entry => {
@@ -143,11 +165,7 @@ export function contextNow(options: { topic?: string; limit?: number; audience?:
     facts.push({ kind: 'decision', id: item.id, title: redactSecretText(item.title.split(/\r?\n/, 1)[0] ?? '').slice(0, 120),
       status: item.status, dueAt: item.dueAt ?? null, source: `elanous://decisions/${encodeURIComponent(item.id)}` });
   }
-  for (const { entry, source } of (deps.seatEntries ?? todaySeatEntries)(now)) {
-    facts.push({ kind: 'seat', seat: entry.seat, at: entry.at, status: entry.status,
-      id: entry.item?.id ?? null, title: entry.item?.source === 'checklist'
-        ? redactSecretText(entry.item.title.split(/\r?\n/, 1)[0] ?? '').slice(0, 120) : null, source });
-  }
+  facts.push(...(deps.seatEntries ?? todaySeatEntries)(now).map(seatFact));
   const rawEvents = (deps.events ?? (since => listCoordEvents({ since })))(new Date(now.getTime() - 7 * 86_400_000).toISOString());
   const chronologicalEvents = rawEvents.slice().sort((a, b) => a.at.localeCompare(b.at));
   const matches = (text: string) => !topic || text.toLocaleLowerCase().includes(topic.toLocaleLowerCase());
@@ -199,3 +217,73 @@ export function contextNow(options: { topic?: string; limit?: number; audience?:
   debug.log('context.now', 'answer', { topic, facts: answer.facts, events: answer.events });
   return options.audience === 'public-demo' ? filterPublicDemoContext(answer, deps.brandCheck) : answer;
 }
+
+const workerAnswers = new Map<string, { promise: Promise<ContextNowAnswer>; expiresAt: number }>();
+const WORKER_ANSWER_TTL_MS = 5_000;
+const WORKER_SCAN_TIMEOUT_MS = 60_000;
+let workerScanTail: Promise<void> = Promise.resolve();
+
+/** Keep the ledger scan off the TUI event loop. Repeated identical reads share one scan. */
+export function contextNowInWorker(options: Parameters<typeof contextNow>[0] = {}): Promise<ContextNowAnswer> {
+  const stateRoot = process.env.ELANOUS_STATE_DIR;
+  const selectedRoot = effectiveInstanceRoot();
+  const key = JSON.stringify([selectedRoot, stateRoot ?? null, options.topic ?? null, options.limit ?? null, options.audience ?? null]);
+  const now = Date.now();
+  for (const [cachedKey, cached] of workerAnswers) {
+    if (cached.expiresAt < now) workerAnswers.delete(cachedKey);
+  }
+  const cached = workerAnswers.get(key);
+  if (cached) return cached.promise;
+  // Distinct topics queue behind the active scan instead of multiplying the same costly ledger walk.
+  const promise = workerScanTail.then(() => scanContextNowInWorker(options, stateRoot, selectedRoot));
+  workerScanTail = promise.then(() => undefined, () => undefined);
+  const entry = { promise, expiresAt: Infinity };
+  workerAnswers.set(key, entry);
+  void promise.then(() => { entry.expiresAt = Date.now() + WORKER_ANSWER_TTL_MS; }, () => { workerAnswers.delete(key); });
+  return promise;
+}
+
+export function scanContextNowInWorker(options: Parameters<typeof contextNow>[0], stateRoot: string | undefined, selectedRoot: string,
+  createWorker: () => Worker = () => new Worker(new URL(import.meta.url), { workerData: { kind: 'context-now' } }),
+  timeoutMs = WORKER_SCAN_TIMEOUT_MS): Promise<ContextNowAnswer> {
+  const worker = createWorker();
+  const startedAt = Date.now();
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const timeout = setTimeout(() => {
+      debug.log('context.now', 'worker-timeout', { timeoutMs, topic: options?.topic ?? null, selectedRoot });
+      finish(new Error(`context_now worker timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    const finish = (error?: Error, answer?: ContextNowAnswer): void => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      // 첫 호출 지연은 색인과 무관하게 «따로» 재야 판정선과 비교할 수 있다 — 스캔 자체의 ms 를 남긴다.
+      debug.log('context.now', 'worker-answer', { topic: options?.topic ?? null, ok: !error, ms: Date.now() - startedAt });
+      void worker.terminate();
+      if (error) reject(error);
+      else resolve(answer!);
+    };
+    worker.on('message', (message: { answer?: ContextNowAnswer; error?: string }) => {
+      if (message.error) finish(new Error(message.error));
+      else if (message.answer) finish(undefined, message.answer);
+    });
+    worker.on('error', error => finish(error instanceof Error ? error : new Error(String(error))));
+    worker.on('exit', code => { if (!settled) finish(new Error(`context_now worker exited before answering: ${code}`)); });
+    // Preserve both caller roots: a programmatic config override is not inherited by workers.
+    worker.postMessage({ options, stateRoot, selectedRoot });
+  });
+}
+
+const contextWorkerPort = parentPort;
+if (!isMainThread && contextWorkerPort && workerData?.kind === 'context-now') {
+  contextWorkerPort.on('message', ({ options, stateRoot, selectedRoot }: { options: Parameters<typeof contextNow>[0]; stateRoot?: string; selectedRoot: string }) => {
+    try {
+      if (stateRoot === undefined) delete process.env.ELANOUS_STATE_DIR;
+      else process.env.ELANOUS_STATE_DIR = stateRoot;
+      setElanousConfigDir(selectedRoot);
+      contextWorkerPort.postMessage({ answer: contextNow(options) });
+    }
+    catch (error) { contextWorkerPort.postMessage({ error: error instanceof Error ? error.message : String(error) }); }
+  });
+}

package/src/context-bus/ops-events.ts

@@ -0,0 +1,75 @@
+import type { Database } from 'bun:sqlite';
+import { debug, redactSecretText } from '../debug/log.js';
+import { openSurfaceEventsDb, recordEvent, surfaceEventsDbPath } from '../domains/surface-events.js';
+
+export const OPS_EVENT_KINDS = [
+  'land.start', 'land.refused', 'land.merged',
+  'review.verdict',
+  'gate.rc',
+  'cell.opened', 'cell.hold',
+  'config.set',
+] as const;
+export type OpsEventKind = typeof OPS_EVENT_KINDS[number];
+
+export interface OpsEventInput {
+  kind: OpsEventKind;
+  /** One nonempty line describing the ops fact; multi-line input keeps only the first line. */
+  text: string;
+  /** Optional locator — PR number, checklist cell id, config key, release version. */
+  ref?: string;
+  /** Optional ISO timestamp; unparseable values are dropped. */
+  at?: string;
+}
+
+export interface OpsEventDeps {
+  db?: Database;
+  /** Injection seam for tests; defaults to the surface-events recordEvent. */
+  record?: typeof recordEvent;
+}
+
+/** Persist a one-line harness ops fact (land flow · review verdict · release gate ·
+ *  checklist cell · config set) into the existing surface_events.db journal via
+ *  recordEvent (src/domains/surface-events.ts) so pr-cli / release-loop operations
+ *  become recallable observations instead of vanishing side effects.
+ *  Fail-soft contract: any write-path failure — db open error, recordEvent throw,
+ *  schema mismatch — is caught, logged to debug, and swallowed. This writer never
+ *  throws and never rejects; callers fire it as a side call without touching their
+ *  own control flow. Malformed input (non-object, unknown kind, empty text) is a
+ *  silent no-op. Returns the recorded event id, or null when nothing was recorded. */
+export function emitOpsEvent(input: OpsEventInput, deps: OpsEventDeps = {}): string | null {
+  if (!input || typeof input !== 'object') return null;
+  let db: Database | undefined = deps.db;
+  let ownDb = false;
+  try {
+    if (!(OPS_EVENT_KINDS as readonly string[]).includes(input.kind)) return null;
+    const oneLine = (value: unknown): string =>
+      redactSecretText(String(value ?? '').split(/\r?\n/, 1)[0] ?? '').trim();
+    const text = oneLine(input.text);
+    if (!text) return null;
+    const ref = oneLine(input.ref) || null;
+    const at = typeof input.at === 'string' && !Number.isNaN(Date.parse(input.at)) ? input.at : undefined;
+    if (!db) {
+      // Test runners must never fall through to the user's production memory DB
+      // (same guard as recordInboundTurn in domains/surface-events.ts).
+      const testRunner = process.env.NODE_ENV === 'test' || process.env.BUN_TEST !== undefined;
+      db = openSurfaceEventsDb(testRunner
+        ? (process.env.ELANOUS_STATE_DIR?.trim() ? surfaceEventsDbPath() : ':memory:')
+        : surfaceEventsDbPath());
+      ownDb = true;
+    }
+    const record = deps.record ?? recordEvent;
+    return record(db, {
+      surface: 'ops', direction: 'outbound', domain: 'elanous', category: 'ops',
+      kind: input.kind, text, summary: text.slice(0, 120),
+      refs: JSON.stringify({ kind: input.kind, ref, url: null }),
+      ...(at ? { ts: at } : {}),
+    });
+  } catch (error) {
+    try { debug.log('ops.event', 'record-failed', {
+      kind: input.kind, reason: error instanceof Error ? error.message : String(error),
+    }, { level: 'warn' }); } catch { /* A broken logger cannot change the caller's result. */ }
+    return null;
+  } finally {
+    if (ownDb && db) { try { db.close(); } catch { /* close failure is not the caller's problem */ } }
+  }
+}

package/src/control-plane/lease-holder.ts

@@ -8,7 +8,7 @@ export interface LeaseHolderSnapshot {
 }
 
 export interface LeaseHolderView {
-  get(): Promise<LeaseHolderSnapshot>;
+  get(options?: { fresh?: boolean }): Promise<LeaseHolderSnapshot>;
 }
 
 export function createLeaseHolderView({ machine, read, ttlMs = 10_000, now = Date.now }: {
@@ -20,17 +20,21 @@ export function createLeaseHolderView({ machine, read, ttlMs = 10_000, now = Dat
   let cached: LeaseHolderSnapshot | undefined;
   let measuredAt = 0;
   let pending: Promise<LeaseHolderSnapshot> | undefined;
+  const readSnapshot = async (): Promise<LeaseHolderSnapshot> => {
+    let result: RoleLeaseRead;
+    try { result = await read(); }
+    catch { result = { kind: 'unmeasured', why: 'read failed' }; }
+    return result.kind === 'present'
+      ? { holder: result.doc.holder, generation: result.doc.generation, iAmHolder: result.doc.holder === machine, known: true }
+      : { holder: null, generation: null, iAmHolder: false, known: false };
+  };
   return {
-    get() {
+    get(options) {
+      if (options?.fresh) return readSnapshot();
       if (cached && now() - measuredAt < ttlMs) return Promise.resolve(cached);
       if (pending) return pending;
       pending = (async () => {
-        let result: RoleLeaseRead;
-        try { result = await read(); }
-        catch { result = { kind: 'unmeasured', why: 'read failed' }; }
-        const snapshot: LeaseHolderSnapshot = result.kind === 'present'
-          ? { holder: result.doc.holder, generation: result.doc.generation, iAmHolder: result.doc.holder === machine, known: true }
-          : { holder: null, generation: null, iAmHolder: false, known: false };
+        const snapshot = await readSnapshot();
         cached = snapshot;
         measuredAt = now();
         return snapshot;

package/src/control-plane/ledger.ts

@@ -2,8 +2,9 @@ import { randomUUID } from 'node:crypto';
 import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { acquireLockAsync, withFileLockSync } from '../storage/file-lock.js';
 
-export const RESOURCE_KINDS = ['machine', 'instance', 'port-lease', 'exposure', 'universe', 'setup-status', 'image', 'slot-lease'] as const;
+export const RESOURCE_KINDS = ['machine', 'instance', 'port-lease', 'exposure', 'universe', 'setup-status', 'image', 'slot-lease', 'pod-worker-lease'] as const;
 export type ResourceKind = (typeof RESOURCE_KINDS)[number];
 export interface ResourceRecord {
   id: string;
@@ -18,12 +19,37 @@ export interface ResourceRecord {
 }
 export type ResourceView = ResourceRecord & { ageMs: number; expired: boolean };
 
+export interface PodWorkerKey { context: string; imageDigest: string; lockHash: string; architecture: string }
+type PodWorkerState = 'idle' | 'leased' | 'sanitizing' | 'quarantined';
+interface PodWorkerLeaseAttrs {
+  key: PodWorkerKey;
+  state: PodWorkerState;
+  generation: number;
+  idleTtlMs: number;
+  leaseId?: string;
+  leaseOwner?: string;
+  runId?: string;
+  attemptId?: string;
+  reason?: string;
+}
+
+function workerAttrs(row: ResourceRecord): PodWorkerLeaseAttrs {
+  if (row.kind !== 'pod-worker-lease') throw new ResourceLedgerError(400, 'not-pod-worker');
+  return row.attrs as unknown as PodWorkerLeaseAttrs;
+}
+
+function sameWorkerKey(a: PodWorkerKey, b: PodWorkerKey): boolean {
+  return a.context === b.context && a.imageDigest === b.imageDigest && a.lockHash === b.lockHash && a.architecture === b.architecture;
+}
+
 export class ResourceLedgerError extends Error {
   constructor(public readonly status: number, message: string) { super(message); }
 }
 
 export class ResourceLedger {
   readonly path: string;
+  private guardedLockHeld = false;
+  private guardedAction = false;
 
   constructor(root: string = effectiveInstanceRoot()) {
     this.path = join(root, 'control', 'ledger.json');
@@ -52,6 +78,48 @@ export class ResourceLedger {
     }
   }
 
+  /** All read-modify-write operations share one cross-process lock, including older resource kinds. */
+  private mutate<T>(fn: () => T): T {
+    if (this.guardedLockHeld) {
+      if (!this.guardedAction) throw new ResourceLedgerError(503, 'ledger-busy');
+      return fn();
+    }
+    mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+    return withFileLockSync(`${this.path}.lock`, fn, { staleMs: 300_000, breakDeadHolder: true });
+  }
+
+  /** Recheck the current primary only after acquiring the same lock that protects the worker write. */
+  async withGuardedWorkerMutation<T>(primaryCurrent: () => Promise<boolean>, action: () => T): Promise<T> {
+    mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+    const lock = await acquireLockAsync(`${this.path}.lock`, { staleMs: 300_000, maxTries: 240 });
+    this.guardedLockHeld = true;
+    try {
+      if (!(await primaryCurrent()) || !lock.stillHeld()) throw new ResourceLedgerError(409, 'not-primary');
+      this.guardedAction = true;
+      try { return action(); }
+      finally { this.guardedAction = false; }
+    } finally {
+      this.guardedLockHeld = false;
+      lock.release();
+    }
+  }
+
+  /** Server writes join the async queue so a slow primary read cannot turn unrelated writes into 503s. */
+  async withSerializedMutation<T>(action: () => T): Promise<T> {
+    mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+    const lock = await acquireLockAsync(`${this.path}.lock`, { staleMs: 300_000, maxTries: 240 });
+    this.guardedLockHeld = true;
+    this.guardedAction = true;
+    try {
+      if (!lock.stillHeld()) throw new ResourceLedgerError(503, 'ledger-lock-lost');
+      return action();
+    } finally {
+      this.guardedAction = false;
+      this.guardedLockHeld = false;
+      lock.release();
+    }
+  }
+
   list(filter: { kind?: string; machine?: string; name?: string } = {}, now = Date.now()): ResourceView[] {
     return this.read().filter(row =>
       (!filter.kind || row.kind === filter.kind) &&
@@ -64,6 +132,8 @@ export class ResourceLedger {
   }
 
   register(record: ResourceRecord, owner: string): ResourceRecord {
+    return this.mutate(() => {
+    if (record.kind === 'pod-worker-lease' || record.id.startsWith('pod-worker-lease:')) throw new ResourceLedgerError(403, 'pod-worker-requires-allocator');
     const rows = this.read();
     const index = rows.findIndex(row => row.id === record.id);
     if (index >= 0 && rows[index]!.owner !== owner) throw new ResourceLedgerError(403, 'not-owner');
@@ -72,15 +142,18 @@ export class ResourceLedger {
     else rows[index] = next;
     this.write(rows);
     return next;
+    });
   }
 
   /** Select and persist the lowest available lease in a single ledger operation. */
   leaseTestPort(
     request: { machine: string; purpose: string; ttlMs: number; owner: string },
     band: { start: number; end: number },
-    now = Date.now(),
+    now?: number,
     excluded: readonly number[] = [],
   ): ResourceRecord {
+    return this.mutate(() => {
+    now ??= Date.now();
     const rows = this.read();
     for (let port = band.start; port <= band.end; port++) {
       if (excluded.includes(port)) continue;
@@ -98,9 +171,12 @@ export class ResourceLedger {
       return next;
     }
     throw new ResourceLedgerError(409, 'no-port');
+    });
   }
 
-  renewTestPort(port: number, owner: string, leaseId: string, now = Date.now()): ResourceRecord {
+  renewTestPort(port: number, owner: string, leaseId: string, now?: number): ResourceRecord {
+    return this.mutate(() => {
+    now ??= Date.now();
     const id = `port-lease:${port}`;
     const rows = this.read();
     const index = rows.findIndex(row => row.id === id && row.kind === 'port-lease');
@@ -112,35 +188,118 @@ export class ResourceLedger {
     rows[index] = next;
     this.write(rows);
     return next;
+    });
   }
 
   deleteTestPort(port: number, owner: string, leaseId: string): void {
+    return this.mutate(() => {
     const rows = this.read();
     const index = rows.findIndex(row => row.id === `port-lease:${port}` && row.kind === 'port-lease');
     if (index < 0) throw new ResourceLedgerError(404, 'not-found');
     if (rows[index]!.owner !== owner || !leaseId || rows[index]!.attrs.leaseId !== leaseId) throw new ResourceLedgerError(403, 'not-owner');
     rows.splice(index, 1);
     this.write(rows);
+    });
+  }
+
+  /** A trusted host registers a clean instance; canary verification is a separate, still unwired step. */
+  registerPodWorker(request: { workerId: string; machine: string; key: PodWorkerKey; owner: string; ttlMs: number }, now?: number): ResourceRecord {
+    return this.mutate(() => {
+    now ??= Date.now();
+    const rows = this.read();
+    const id = `pod-worker-lease:${request.workerId}`;
+    const index = rows.findIndex(row => row.id === id);
+    const previous = index < 0 ? undefined : rows[index]!;
+    if (previous && previous.kind !== 'pod-worker-lease') throw new ResourceLedgerError(409, 'worker-id-conflict');
+    if (previous && previous.owner !== request.owner) throw new ResourceLedgerError(403, 'not-owner');
+    // A workerId identifies one Pod instance. Expiry never proves that a leased or quarantined Pod was cleaned.
+    if (previous) throw new ResourceLedgerError(409, 'worker-id-used');
+    const generation = 0;
+    const row: ResourceRecord = { id, kind: 'pod-worker-lease', machine: request.machine, name: request.workerId,
+      owner: request.owner, attrs: { key: request.key, state: 'idle', generation, idleTtlMs: request.ttlMs }, observedAt: now, ttlMs: request.ttlMs };
+    if (index < 0) rows.push(row); else rows[index] = row;
+    this.write(rows);
+    return row;
+    });
+  }
+
+  acquirePodWorker(request: { machine?: string; key: PodWorkerKey; owner: string; runId: string; attemptId: string; ttlMs: number }, now?: number): ResourceRecord {
+    return this.mutate(() => {
+    const at = now ?? Date.now();
+    const rows = this.read();
+    const index = rows.findIndex(row => row.kind === 'pod-worker-lease' && (!request.machine || row.machine === request.machine)
+      && Math.max(0, at - row.observedAt) < row.ttlMs && workerAttrs(row).state === 'idle'
+      && sameWorkerKey(workerAttrs(row).key, request.key));
+    if (index < 0) throw new ResourceLedgerError(409, 'no-warm-worker');
+    const row = rows[index]!;
+    const attrs = workerAttrs(row);
+    const next: ResourceRecord = { ...row, attrs: { ...attrs, state: 'leased', generation: attrs.generation + 1,
+      leaseId: randomUUID(), leaseOwner: request.owner, runId: request.runId, attemptId: request.attemptId },
+      observedAt: at, ttlMs: request.ttlMs };
+    rows[index] = next;
+    this.write(rows);
+    return next;
+    });
   }
 
-  heartbeat(id: string, owner: string, attrs?: Record<string, unknown>, now = Date.now()): ResourceRecord {
+  transitionPodWorker(id: string, request: { owner: string; leaseId: string; generation: number; action: 'renew' | 'release' | 'sanitize' | 'quarantine'; ttlMs?: number; reason?: string }, now?: number): ResourceRecord {
+    return this.mutate(() => {
+    now ??= Date.now();
+    const rows = this.read();
+    const index = rows.findIndex(row => row.id === id && row.kind === 'pod-worker-lease');
+    if (index < 0) throw new ResourceLedgerError(404, 'not-found');
+    const row = rows[index]!;
+    const attrs = workerAttrs(row);
+    if (!request.leaseId || attrs.leaseId !== request.leaseId || attrs.generation !== request.generation) throw new ResourceLedgerError(409, 'stale-worker-lease');
+    const permitted = request.action === 'sanitize' ? row.owner === request.owner
+      : request.action === 'quarantine' ? row.owner === request.owner || attrs.leaseOwner === request.owner
+      : attrs.leaseOwner === request.owner;
+    if (!permitted) {
+      throw new ResourceLedgerError(403, 'not-owner');
+    }
+    if (request.action === 'renew' && (attrs.state !== 'leased' || Math.max(0, now - row.observedAt) >= row.ttlMs)) throw new ResourceLedgerError(409, 'lease-expired');
+    if (request.action === 'release' && attrs.state !== 'leased') throw new ResourceLedgerError(409, 'not-leased');
+    if (request.action === 'sanitize' && attrs.state !== 'sanitizing') throw new ResourceLedgerError(409, 'not-sanitizing');
+    if (request.action === 'quarantine' && attrs.state === 'quarantined') throw new ResourceLedgerError(409, 'already-quarantined');
+    const state: PodWorkerState = request.action === 'renew' ? 'leased' : request.action === 'release' ? 'sanitizing'
+      : request.action === 'sanitize' ? 'idle' : 'quarantined';
+    const nextAttrs: PodWorkerLeaseAttrs = { ...attrs, state, ...(request.reason ? { reason: request.reason } : {}) };
+    if (state === 'idle') { delete nextAttrs.leaseId; delete nextAttrs.leaseOwner; delete nextAttrs.runId; delete nextAttrs.attemptId; delete nextAttrs.reason; }
+    const ttlMs = state === 'idle' ? attrs.idleTtlMs : request.ttlMs ?? row.ttlMs;
+    const next: ResourceRecord = { ...row, attrs: nextAttrs as unknown as Record<string, unknown>, observedAt: now, ttlMs };
+    rows[index] = next;
+    this.write(rows);
+    return next;
+    });
+  }
+
+  heartbeat(id: string, owner: string, attrs?: Record<string, unknown>, now?: number): ResourceRecord {
+    return this.mutate(() => {
+    if (id.startsWith('pod-worker-lease:')) throw new ResourceLedgerError(403, 'pod-worker-requires-allocator');
+    now ??= Date.now();
     const rows = this.read();
     const index = rows.findIndex(row => row.id === id);
     if (index < 0) throw new ResourceLedgerError(404, 'not-found');
     const row = rows[index]!;
+    if (row.kind === 'pod-worker-lease') throw new ResourceLedgerError(403, 'pod-worker-requires-allocator');
     if (row.owner !== owner) throw new ResourceLedgerError(403, 'not-owner');
     const next = { ...row, observedAt: now, ...(attrs ? { attrs: { ...row.attrs, ...attrs } } : {}) };
     rows[index] = next;
     this.write(rows);
     return next;
+    });
   }
 
   delete(id: string, owner: string): void {
+    return this.mutate(() => {
+    if (id.startsWith('pod-worker-lease:')) throw new ResourceLedgerError(403, 'pod-worker-requires-allocator');
     const rows = this.read();
     const index = rows.findIndex(row => row.id === id);
     if (index < 0) throw new ResourceLedgerError(404, 'not-found');
+    if (rows[index]!.kind === 'pod-worker-lease') throw new ResourceLedgerError(403, 'pod-worker-requires-allocator');
     if (rows[index]!.owner !== owner) throw new ResourceLedgerError(403, 'not-owner');
     rows.splice(index, 1);
     this.write(rows);
+    });
   }
 }