elanous 0.2.29 → 0.2.31

package/src/control-plane/ledger.ts

@@ -2,8 +2,9 @@ import { randomUUID } from 'node:crypto';
 import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { acquireLockAsync, withFileLockSync } from '../storage/file-lock.js';
 
-export const RESOURCE_KINDS = ['machine', 'instance', 'port-lease', 'exposure', 'universe', 'setup-status', 'image', 'slot-lease'] as const;
+export const RESOURCE_KINDS = ['machine', 'instance', 'port-lease', 'exposure', 'universe', 'setup-status', 'image', 'slot-lease', 'pod-worker-lease'] as const;
 export type ResourceKind = (typeof RESOURCE_KINDS)[number];
 export interface ResourceRecord {
   id: string;
@@ -18,12 +19,37 @@ export interface ResourceRecord {
 }
 export type ResourceView = ResourceRecord & { ageMs: number; expired: boolean };
 
+export interface PodWorkerKey { context: string; imageDigest: string; lockHash: string; architecture: string }
+type PodWorkerState = 'idle' | 'leased' | 'sanitizing' | 'quarantined';
+interface PodWorkerLeaseAttrs {
+  key: PodWorkerKey;
+  state: PodWorkerState;
+  generation: number;
+  idleTtlMs: number;
+  leaseId?: string;
+  leaseOwner?: string;
+  runId?: string;
+  attemptId?: string;
+  reason?: string;
+}
+
+function workerAttrs(row: ResourceRecord): PodWorkerLeaseAttrs {
+  if (row.kind !== 'pod-worker-lease') throw new ResourceLedgerError(400, 'not-pod-worker');
+  return row.attrs as unknown as PodWorkerLeaseAttrs;
+}
+
+function sameWorkerKey(a: PodWorkerKey, b: PodWorkerKey): boolean {
+  return a.context === b.context && a.imageDigest === b.imageDigest && a.lockHash === b.lockHash && a.architecture === b.architecture;
+}
+
 export class ResourceLedgerError extends Error {
   constructor(public readonly status: number, message: string) { super(message); }
 }
 
 export class ResourceLedger {
   readonly path: string;
+  private guardedLockHeld = false;
+  private guardedAction = false;
 
   constructor(root: string = effectiveInstanceRoot()) {
     this.path = join(root, 'control', 'ledger.json');
@@ -52,6 +78,48 @@ export class ResourceLedger {
     }
   }
 
+  /** All read-modify-write operations share one cross-process lock, including older resource kinds. */
+  private mutate<T>(fn: () => T): T {
+    if (this.guardedLockHeld) {
+      if (!this.guardedAction) throw new ResourceLedgerError(503, 'ledger-busy');
+      return fn();
+    }
+    mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+    return withFileLockSync(`${this.path}.lock`, fn, { staleMs: 300_000, breakDeadHolder: true });
+  }
+
+  /** Recheck the current primary only after acquiring the same lock that protects the worker write. */
+  async withGuardedWorkerMutation<T>(primaryCurrent: () => Promise<boolean>, action: () => T): Promise<T> {
+    mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+    const lock = await acquireLockAsync(`${this.path}.lock`, { staleMs: 300_000, maxTries: 240 });
+    this.guardedLockHeld = true;
+    try {
+      if (!(await primaryCurrent()) || !lock.stillHeld()) throw new ResourceLedgerError(409, 'not-primary');
+      this.guardedAction = true;
+      try { return action(); }
+      finally { this.guardedAction = false; }
+    } finally {
+      this.guardedLockHeld = false;
+      lock.release();
+    }
+  }
+
+  /** Server writes join the async queue so a slow primary read cannot turn unrelated writes into 503s. */
+  async withSerializedMutation<T>(action: () => T): Promise<T> {
+    mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+    const lock = await acquireLockAsync(`${this.path}.lock`, { staleMs: 300_000, maxTries: 240 });
+    this.guardedLockHeld = true;
+    this.guardedAction = true;
+    try {
+      if (!lock.stillHeld()) throw new ResourceLedgerError(503, 'ledger-lock-lost');
+      return action();
+    } finally {
+      this.guardedAction = false;
+      this.guardedLockHeld = false;
+      lock.release();
+    }
+  }
+
   list(filter: { kind?: string; machine?: string; name?: string } = {}, now = Date.now()): ResourceView[] {
     return this.read().filter(row =>
       (!filter.kind || row.kind === filter.kind) &&
@@ -64,6 +132,8 @@ export class ResourceLedger {
   }
 
   register(record: ResourceRecord, owner: string): ResourceRecord {
+    return this.mutate(() => {
+    if (record.kind === 'pod-worker-lease' || record.id.startsWith('pod-worker-lease:')) throw new ResourceLedgerError(403, 'pod-worker-requires-allocator');
     const rows = this.read();
     const index = rows.findIndex(row => row.id === record.id);
     if (index >= 0 && rows[index]!.owner !== owner) throw new ResourceLedgerError(403, 'not-owner');
@@ -72,15 +142,18 @@ export class ResourceLedger {
     else rows[index] = next;
     this.write(rows);
     return next;
+    });
   }
 
   /** Select and persist the lowest available lease in a single ledger operation. */
   leaseTestPort(
     request: { machine: string; purpose: string; ttlMs: number; owner: string },
     band: { start: number; end: number },
-    now = Date.now(),
+    now?: number,
     excluded: readonly number[] = [],
   ): ResourceRecord {
+    return this.mutate(() => {
+    now ??= Date.now();
     const rows = this.read();
     for (let port = band.start; port <= band.end; port++) {
       if (excluded.includes(port)) continue;
@@ -98,9 +171,12 @@ export class ResourceLedger {
       return next;
     }
     throw new ResourceLedgerError(409, 'no-port');
+    });
   }
 
-  renewTestPort(port: number, owner: string, leaseId: string, now = Date.now()): ResourceRecord {
+  renewTestPort(port: number, owner: string, leaseId: string, now?: number): ResourceRecord {
+    return this.mutate(() => {
+    now ??= Date.now();
     const id = `port-lease:${port}`;
     const rows = this.read();
     const index = rows.findIndex(row => row.id === id && row.kind === 'port-lease');
@@ -112,35 +188,118 @@ export class ResourceLedger {
     rows[index] = next;
     this.write(rows);
     return next;
+    });
   }
 
   deleteTestPort(port: number, owner: string, leaseId: string): void {
+    return this.mutate(() => {
     const rows = this.read();
     const index = rows.findIndex(row => row.id === `port-lease:${port}` && row.kind === 'port-lease');
     if (index < 0) throw new ResourceLedgerError(404, 'not-found');
     if (rows[index]!.owner !== owner || !leaseId || rows[index]!.attrs.leaseId !== leaseId) throw new ResourceLedgerError(403, 'not-owner');
     rows.splice(index, 1);
     this.write(rows);
+    });
+  }
+
+  /** A trusted host registers a clean instance; canary verification is a separate, still unwired step. */
+  registerPodWorker(request: { workerId: string; machine: string; key: PodWorkerKey; owner: string; ttlMs: number }, now?: number): ResourceRecord {
+    return this.mutate(() => {
+    now ??= Date.now();
+    const rows = this.read();
+    const id = `pod-worker-lease:${request.workerId}`;
+    const index = rows.findIndex(row => row.id === id);
+    const previous = index < 0 ? undefined : rows[index]!;
+    if (previous && previous.kind !== 'pod-worker-lease') throw new ResourceLedgerError(409, 'worker-id-conflict');
+    if (previous && previous.owner !== request.owner) throw new ResourceLedgerError(403, 'not-owner');
+    // A workerId identifies one Pod instance. Expiry never proves that a leased or quarantined Pod was cleaned.
+    if (previous) throw new ResourceLedgerError(409, 'worker-id-used');
+    const generation = 0;
+    const row: ResourceRecord = { id, kind: 'pod-worker-lease', machine: request.machine, name: request.workerId,
+      owner: request.owner, attrs: { key: request.key, state: 'idle', generation, idleTtlMs: request.ttlMs }, observedAt: now, ttlMs: request.ttlMs };
+    if (index < 0) rows.push(row); else rows[index] = row;
+    this.write(rows);
+    return row;
+    });
+  }
+
+  acquirePodWorker(request: { machine?: string; key: PodWorkerKey; owner: string; runId: string; attemptId: string; ttlMs: number }, now?: number): ResourceRecord {
+    return this.mutate(() => {
+    const at = now ?? Date.now();
+    const rows = this.read();
+    const index = rows.findIndex(row => row.kind === 'pod-worker-lease' && (!request.machine || row.machine === request.machine)
+      && Math.max(0, at - row.observedAt) < row.ttlMs && workerAttrs(row).state === 'idle'
+      && sameWorkerKey(workerAttrs(row).key, request.key));
+    if (index < 0) throw new ResourceLedgerError(409, 'no-warm-worker');
+    const row = rows[index]!;
+    const attrs = workerAttrs(row);
+    const next: ResourceRecord = { ...row, attrs: { ...attrs, state: 'leased', generation: attrs.generation + 1,
+      leaseId: randomUUID(), leaseOwner: request.owner, runId: request.runId, attemptId: request.attemptId },
+      observedAt: at, ttlMs: request.ttlMs };
+    rows[index] = next;
+    this.write(rows);
+    return next;
+    });
   }
 
-  heartbeat(id: string, owner: string, attrs?: Record<string, unknown>, now = Date.now()): ResourceRecord {
+  transitionPodWorker(id: string, request: { owner: string; leaseId: string; generation: number; action: 'renew' | 'release' | 'sanitize' | 'quarantine'; ttlMs?: number; reason?: string }, now?: number): ResourceRecord {
+    return this.mutate(() => {
+    now ??= Date.now();
+    const rows = this.read();
+    const index = rows.findIndex(row => row.id === id && row.kind === 'pod-worker-lease');
+    if (index < 0) throw new ResourceLedgerError(404, 'not-found');
+    const row = rows[index]!;
+    const attrs = workerAttrs(row);
+    if (!request.leaseId || attrs.leaseId !== request.leaseId || attrs.generation !== request.generation) throw new ResourceLedgerError(409, 'stale-worker-lease');
+    const permitted = request.action === 'sanitize' ? row.owner === request.owner
+      : request.action === 'quarantine' ? row.owner === request.owner || attrs.leaseOwner === request.owner
+      : attrs.leaseOwner === request.owner;
+    if (!permitted) {
+      throw new ResourceLedgerError(403, 'not-owner');
+    }
+    if (request.action === 'renew' && (attrs.state !== 'leased' || Math.max(0, now - row.observedAt) >= row.ttlMs)) throw new ResourceLedgerError(409, 'lease-expired');
+    if (request.action === 'release' && attrs.state !== 'leased') throw new ResourceLedgerError(409, 'not-leased');
+    if (request.action === 'sanitize' && attrs.state !== 'sanitizing') throw new ResourceLedgerError(409, 'not-sanitizing');
+    if (request.action === 'quarantine' && attrs.state === 'quarantined') throw new ResourceLedgerError(409, 'already-quarantined');
+    const state: PodWorkerState = request.action === 'renew' ? 'leased' : request.action === 'release' ? 'sanitizing'
+      : request.action === 'sanitize' ? 'idle' : 'quarantined';
+    const nextAttrs: PodWorkerLeaseAttrs = { ...attrs, state, ...(request.reason ? { reason: request.reason } : {}) };
+    if (state === 'idle') { delete nextAttrs.leaseId; delete nextAttrs.leaseOwner; delete nextAttrs.runId; delete nextAttrs.attemptId; delete nextAttrs.reason; }
+    const ttlMs = state === 'idle' ? attrs.idleTtlMs : request.ttlMs ?? row.ttlMs;
+    const next: ResourceRecord = { ...row, attrs: nextAttrs as unknown as Record<string, unknown>, observedAt: now, ttlMs };
+    rows[index] = next;
+    this.write(rows);
+    return next;
+    });
+  }
+
+  heartbeat(id: string, owner: string, attrs?: Record<string, unknown>, now?: number): ResourceRecord {
+    return this.mutate(() => {
+    if (id.startsWith('pod-worker-lease:')) throw new ResourceLedgerError(403, 'pod-worker-requires-allocator');
+    now ??= Date.now();
     const rows = this.read();
     const index = rows.findIndex(row => row.id === id);
     if (index < 0) throw new ResourceLedgerError(404, 'not-found');
     const row = rows[index]!;
+    if (row.kind === 'pod-worker-lease') throw new ResourceLedgerError(403, 'pod-worker-requires-allocator');
     if (row.owner !== owner) throw new ResourceLedgerError(403, 'not-owner');
     const next = { ...row, observedAt: now, ...(attrs ? { attrs: { ...row.attrs, ...attrs } } : {}) };
     rows[index] = next;
     this.write(rows);
     return next;
+    });
   }
 
   delete(id: string, owner: string): void {
+    return this.mutate(() => {
+    if (id.startsWith('pod-worker-lease:')) throw new ResourceLedgerError(403, 'pod-worker-requires-allocator');
     const rows = this.read();
     const index = rows.findIndex(row => row.id === id);
     if (index < 0) throw new ResourceLedgerError(404, 'not-found');
+    if (rows[index]!.kind === 'pod-worker-lease') throw new ResourceLedgerError(403, 'pod-worker-requires-allocator');
     if (rows[index]!.owner !== owner) throw new ResourceLedgerError(403, 'not-owner');
     rows.splice(index, 1);
     this.write(rows);
+    });
   }
 }

package/src/control-plane/server.ts

@@ -2,13 +2,14 @@ import { createHash, randomBytes } from 'node:crypto';
 import { chmodSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
-import { RESOURCE_KINDS, ResourceLedger, ResourceLedgerError, type ResourceRecord } from './ledger.js';
+import { RESOURCE_KINDS, ResourceLedger, ResourceLedgerError, type PodWorkerKey, type ResourceRecord } from './ledger.js';
 import { leasePort, PORT_BANDS } from './ports.js';
 import { machineForToken } from './member-tokens.js';
 import type { LeaseHolderView } from './lease-holder.js';
 
 export const DEFAULT_CONTROL_PORT = PORT_BANDS.reserved[0];
 export const CONTROL_HOSTNAME = '127.0.0.1';
+const MAX_POD_WORKER_TTL_MS = 24 * 60 * 60 * 1000;
 
 export function allowedControlHostname(hostname: string): boolean {
   if (hostname === '127.0.0.1' || hostname === '::1') return true;
@@ -69,6 +70,20 @@ function recordFromBody(value: unknown, owner: string): ResourceRecord {
   };
 }
 
+function podWorkerKey(value: unknown): PodWorkerKey {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new ResourceLedgerError(400, 'invalid-worker-key');
+  const key = value as Record<string, unknown>;
+  if (!['context', 'imageDigest', 'lockHash', 'architecture'].every(name => typeof key[name] === 'string' && (key[name] as string).trim())) {
+    throw new ResourceLedgerError(400, 'invalid-worker-key');
+  }
+  return key as unknown as PodWorkerKey;
+}
+
+function podWorkerBody(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new ResourceLedgerError(400, 'invalid-pod-worker-lease');
+  return value as Record<string, unknown>;
+}
+
 export interface ControlServerOptions {
   root?: string;
   port?: number;
@@ -94,6 +109,7 @@ export function startControlServer(opts: ControlServerOptions = {}): {
     port,
     async fetch(req) {
       const lease = await opts.leaseView?.get();
+      let responseLease = lease;
       const respond = async (): Promise<Response> => {
         const url = new URL(req.url);
         const path = url.pathname;
@@ -108,7 +124,10 @@ export function startControlServer(opts: ControlServerOptions = {}): {
         const leaseRequest = path === '/v1/leases/port' && method === 'POST';
         const leaseDeletion = /^\/v1\/leases\/port\/([^/]+)$/.exec(path);
         const leaseRenewal = /^\/v1\/leases\/port\/([^/]+)\/heartbeat$/.exec(path);
-        if (!resourcePath && !registerPath && !leaseRequest && !(leaseDeletion && method === 'DELETE') && !(leaseRenewal && method === 'POST') && !(heartbeat && method === 'POST') && !(deletion && method === 'DELETE')) {
+        const workerRegister = path === '/v1/workers/pod' && method === 'POST';
+        const workerAcquire = path === '/v1/leases/pod-worker' && method === 'POST';
+        const workerTransition = /^\/v1\/leases\/pod-worker\/([^/]+)\/(renew|release|sanitize|quarantine)$/.exec(path);
+        if (!resourcePath && !registerPath && !leaseRequest && !workerRegister && !workerAcquire && !(workerTransition && method === 'POST') && !(leaseDeletion && method === 'DELETE') && !(leaseRenewal && method === 'POST') && !(heartbeat && method === 'POST') && !(deletion && method === 'DELETE')) {
           return json({ error: 'not-found' }, 404);
         }
         const authorization = req.headers.get('authorization');
@@ -118,7 +137,7 @@ export function startControlServer(opts: ControlServerOptions = {}): {
           : undefined;
         const machine = !scope && presented ? machineForToken(presented, root) : undefined;
         if (!scope && !machine) return json({ error: 'unauthorized' }, 401);
-        if (!resourcePath && (scope === 'query' || ((leaseRequest || leaseDeletion || leaseRenewal) && scope !== 'member' && !machine))) return json({ error: 'forbidden' }, 403);
+        if (!resourcePath && (scope === 'query' || ((leaseRequest || leaseDeletion || leaseRenewal || workerRegister || workerAcquire || workerTransition) && scope !== 'member' && !machine))) return json({ error: 'forbidden' }, 403);
         if (!resourcePath && (lease?.known ? !lease.iAmHolder : opts.requireKnownLeaseForWrites)) {
           return json({ error: 'not-primary', holder: lease?.holder ?? null, generation: lease?.generation ?? null }, 409);
         }
@@ -132,7 +151,62 @@ export function startControlServer(opts: ControlServerOptions = {}): {
             if (target) requireMachine(target.machine);
           }
         };
+        const currentWorkerPrimary = async (): Promise<Response | undefined> => {
+          if (!opts.leaseView) return json({ error: 'primary-unmeasured' }, 409);
+          const current = await opts.leaseView.get({ fresh: true });
+          responseLease = current;
+          if (!current.known || !current.iAmHolder || current.generation !== lease?.generation) {
+            return json({ error: 'not-primary', holder: current.holder, generation: current.generation }, 409);
+          }
+          return undefined;
+        };
         try {
+          if (workerRegister) {
+            if (!machine) throw new ResourceLedgerError(403, 'worker-host-required');
+            const body = podWorkerBody(await req.json());
+            const { workerId, machine: workerMachine, key, ttlMs } = body;
+            if (typeof workerId !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,95}$/.test(workerId)
+              || typeof workerMachine !== 'string' || !workerMachine.trim()
+              || typeof ttlMs !== 'number' || !Number.isSafeInteger(ttlMs) || ttlMs <= 0 || ttlMs > MAX_POD_WORKER_TTL_MS) throw new ResourceLedgerError(400, 'invalid-pod-worker-lease');
+            requireMachine(workerMachine);
+            const stale = await currentWorkerPrimary();
+            if (stale) return stale;
+            return json(await ledger.withGuardedWorkerMutation(async () => !(await currentWorkerPrimary()),
+              () => ledger.registerPodWorker({ workerId, machine: workerMachine, key: podWorkerKey(key), ttlMs, owner })));
+          }
+          if (workerAcquire) {
+            if (scope !== 'member') throw new ResourceLedgerError(403, 'worker-consumer-required');
+            const body = podWorkerBody(await req.json());
+            const { machine: workerMachine, key, runId, attemptId, ttlMs } = body;
+            if (workerMachine !== undefined && (typeof workerMachine !== 'string' || !workerMachine.trim())) throw new ResourceLedgerError(400, 'invalid-pod-worker-lease');
+            if (typeof runId !== 'string' || !runId.trim() || typeof attemptId !== 'string' || !attemptId.trim()
+              || typeof ttlMs !== 'number' || !Number.isSafeInteger(ttlMs) || ttlMs <= 0 || ttlMs > MAX_POD_WORKER_TTL_MS) throw new ResourceLedgerError(400, 'invalid-pod-worker-lease');
+            const stale = await currentWorkerPrimary();
+            if (stale) return stale;
+            return json(await ledger.withGuardedWorkerMutation(async () => !(await currentWorkerPrimary()),
+              () => ledger.acquirePodWorker({ ...(workerMachine ? { machine: workerMachine } : {}), key: podWorkerKey(key),
+                runId, attemptId, ttlMs, owner })));
+          }
+          if (workerTransition) {
+            const workerId = decodeURIComponent(workerTransition[1]!);
+            if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,95}$/.test(workerId)) throw new ResourceLedgerError(400, 'invalid-worker-id');
+            const action = workerTransition[2] as 'renew' | 'release' | 'sanitize' | 'quarantine';
+            if (action === 'sanitize' ? !machine : (action === 'renew' || action === 'release') && scope !== 'member') {
+              throw new ResourceLedgerError(403, 'worker-scope');
+            }
+            const body = podWorkerBody(await req.json());
+            const { leaseId, generation, ttlMs, reason } = body;
+            if (typeof leaseId !== 'string' || !leaseId || !Number.isSafeInteger(generation) || (generation as number) < 1
+              || (ttlMs !== undefined && (typeof ttlMs !== 'number' || !Number.isSafeInteger(ttlMs) || ttlMs <= 0 || ttlMs > MAX_POD_WORKER_TTL_MS))
+              || (reason !== undefined && (typeof reason !== 'string' || !reason.trim()))) throw new ResourceLedgerError(400, 'invalid-pod-worker-lease');
+            const id = `pod-worker-lease:${workerId}`;
+            requireTarget(id);
+            const stale = await currentWorkerPrimary();
+            if (stale) return stale;
+            return json(await ledger.withGuardedWorkerMutation(async () => !(await currentWorkerPrimary()),
+              () => ledger.transitionPodWorker(id, { owner, leaseId, generation: generation as number, action,
+                ...(ttlMs ? { ttlMs: ttlMs as number } : {}), ...(reason ? { reason: reason as string } : {}) })));
+          }
           if (leaseRequest) {
             const body: unknown = await req.json();
             if (!body || typeof body !== 'object' || Array.isArray(body)) throw new ResourceLedgerError(400, 'invalid-port-lease');
@@ -144,7 +218,8 @@ export function startControlServer(opts: ControlServerOptions = {}): {
               throw new ResourceLedgerError(400, 'invalid-port-lease');
             }
             requireMachine(machine);
-            const lease = leasePort({ machine, purpose, ttlMs, owner, excluded: excluded as number[] | undefined }, ledger);
+            const lease = await ledger.withSerializedMutation(() =>
+              leasePort({ machine, purpose, ttlMs, owner, excluded: excluded as number[] | undefined }, ledger));
             return json({ port: lease.attrs.port, lease });
           }
           if (leaseRenewal || leaseDeletion) {
@@ -156,10 +231,10 @@ export function startControlServer(opts: ControlServerOptions = {}): {
             const leaseId = req.headers.get('x-port-lease-id');
             if (!leaseId) throw new ResourceLedgerError(400, 'missing-lease-id');
             if (leaseRenewal) {
-              const renewed = ledger.renewTestPort(port, owner, leaseId);
+              const renewed = await ledger.withSerializedMutation(() => ledger.renewTestPort(port, owner, leaseId));
               return json({ ...renewed, attrs: { ...renewed.attrs, leaseId: undefined } });
             }
-            ledger.deleteTestPort(port, owner, leaseId);
+            await ledger.withSerializedMutation(() => ledger.deleteTestPort(port, owner, leaseId));
             return new Response(null, { status: 204 });
           }
           if (resourcePath) {
@@ -168,19 +243,23 @@ export function startControlServer(opts: ControlServerOptions = {}): {
               machine: url.searchParams.get('machine') || undefined,
               name: url.searchParams.get('name') || undefined,
             });
-            return json({ resources: rows.map(row => row.kind === 'port-lease'
+            return json({ resources: rows.map(row => row.kind === 'pod-worker-lease'
+              ? { ...row, attrs: { key: row.attrs.key, state: row.attrs.state, generation: row.attrs.generation } }
+              : row.kind === 'port-lease'
               ? { ...row, attrs: { ...row.attrs, leaseId: undefined } }
               : row) });
           }
           if (registerPath) {
             const row = recordFromBody(await req.json(), owner);
             if (row.kind === 'port-lease' || row.id.startsWith('port-lease:')) throw new ResourceLedgerError(403, 'port-lease-requires-allocator');
+            if (row.kind === 'pod-worker-lease' || row.id.startsWith('pod-worker-lease:')) throw new ResourceLedgerError(403, 'pod-worker-requires-allocator');
             requireMachine(row.machine);
             requireTarget(row.id);
-            return json(ledger.register(row, owner));
+            return json(await ledger.withSerializedMutation(() => ledger.register(row, owner)));
           }
           if (heartbeat && method === 'POST') {
             if (decodeURIComponent(heartbeat[1]!).startsWith('port-lease:')) throw new ResourceLedgerError(403, 'port-lease-requires-allocator');
+            if (decodeURIComponent(heartbeat[1]!).startsWith('pod-worker-lease:')) throw new ResourceLedgerError(403, 'pod-worker-requires-allocator');
             const body: unknown = await req.json();
             if (!body || typeof body !== 'object' || Array.isArray(body)) throw new ResourceLedgerError(400, 'invalid-heartbeat');
             if (machine && 'machine' in body) requireMachine((body as Record<string, unknown>).machine as string);
@@ -190,12 +269,13 @@ export function startControlServer(opts: ControlServerOptions = {}): {
             }
             const id = decodeURIComponent(heartbeat[1]!);
             requireTarget(id);
-            return json(ledger.heartbeat(id, owner, attrs as Record<string, unknown> | undefined));
+            return json(await ledger.withSerializedMutation(() => ledger.heartbeat(id, owner, attrs as Record<string, unknown> | undefined)));
           }
           if (decodeURIComponent(deletion![1]!).startsWith('port-lease:')) throw new ResourceLedgerError(403, 'port-lease-requires-allocator');
+          if (decodeURIComponent(deletion![1]!).startsWith('pod-worker-lease:')) throw new ResourceLedgerError(403, 'pod-worker-requires-allocator');
           const id = decodeURIComponent(deletion![1]!);
           requireTarget(id);
-          ledger.delete(id, owner);
+          await ledger.withSerializedMutation(() => ledger.delete(id, owner));
           return new Response(null, { status: 204 });
         } catch (err) {
           if (err instanceof ResourceLedgerError) return json({ error: err.message }, err.status);
@@ -204,7 +284,7 @@ export function startControlServer(opts: ControlServerOptions = {}): {
         }
       };
       const response = await respond();
-      if (lease?.known && lease.generation !== null) response.headers.set('x-primary-generation', String(lease.generation));
+      if (responseLease?.known && responseLease.generation !== null) response.headers.set('x-primary-generation', String(responseLease.generation));
       return response;
     },
   });

package/src/core-turn/run-core-turn.ts

@@ -288,6 +288,7 @@ export async function runCoreTurn(
         ...(ctx.modelOverride !== undefined ? { model: ctx.modelOverride } : {}),
         ...(ctx.callbacks?.onResolvedProvider !== undefined ? { onResolvedProvider: ctx.callbacks.onResolvedProvider } : {}),
         ...(ctx.budgetGrant !== undefined ? { budgetGrant: ctx.budgetGrant } : {}),
+        ...(ctx.terminalToolNames !== undefined ? { terminalToolNames: ctx.terminalToolNames } : {}),
         // ⭐⭐⭐ `B3`(2026-08-19 · 대표 지시 ②) — 도는 턴 «안»으로 들어오는 사용자 발화의 배수구.
         //   ⛔ 종전엔 스트리밍 중 친 발화가 ***턴이 끝난 뒤***에야 나갔다.
         //   ⭐ 이제 «다음 모델 요청을 만들기 직전»(루프 경계)에 이력으로 들어가고,