elanous 0.2.40 → 0.2.41

package/src/msg/msg-mirror-runner.ts

@@ -0,0 +1,219 @@
+import type { Message } from './msg-store.js';
+import { buildMirrorSummary, isMirrorEvent, MIRROR_SUMMARY_INTERVAL_MS, selectMirrorEvents, shouldRotateMirrorChannel } from './msg-mirror-policy.js';
+
+export interface MirrorTarget {
+  repo: string;
+  issueNumber: number;
+}
+
+export interface MsgMirrorState {
+  version: 1;
+  target: MirrorTarget;
+  messageCursor: number;
+  summaryWindowEnd: string;
+  rotationPending?: { from: MirrorTarget; to: MirrorTarget };
+}
+
+export interface MsgMirrorSource {
+  listAfter(afterId: number, limit: number): Message[];
+  listWindow(start: string, end: string): Message[];
+  latestId(): number;
+}
+
+export interface MsgMirrorStateStore {
+  read(): MsgMirrorState | null;
+  write(state: MsgMirrorState): void;
+}
+
+export interface MsgMirrorTransport {
+  beginTick?(): Promise<void> | void;
+  countComments(target: MirrorTarget): Promise<number> | number;
+  hasMarker(target: MirrorTarget, marker: string): Promise<boolean> | boolean;
+  postComment(target: MirrorTarget, body: string): Promise<void> | void;
+  createNextChannel(target: MirrorTarget, idempotencyKey: string): Promise<MirrorTarget> | MirrorTarget;
+  linkAndCloseChannel(from: MirrorTarget, to: MirrorTarget): Promise<void> | void;
+}
+
+export interface MsgMirrorTickOptions {
+  configuredTarget?: MirrorTarget;
+  nowMs?: number;
+  dryRun?: boolean;
+  source: MsgMirrorSource;
+  state: MsgMirrorStateStore;
+  transport: MsgMirrorTransport;
+}
+
+export interface MsgMirrorTickResult {
+  status: 'disabled' | 'dry-run' | 'synced';
+  target: MirrorTarget | null;
+  scanned: number;
+  posted: number;
+  rotated: number;
+  summaries: number;
+  sourceCursor: number;
+}
+
+const VALID_REPO = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+
+export function validateMirrorTarget(value: unknown): MirrorTarget {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('mirror target must be an object');
+  const target = value as Record<string, unknown>;
+  if (typeof target.repo !== 'string' || !VALID_REPO.test(target.repo)
+    || typeof target.issueNumber !== 'number' || !Number.isSafeInteger(target.issueNumber) || target.issueNumber < 1) {
+    throw new Error('mirror target requires repo=owner/name and a positive issueNumber');
+  }
+  return { repo: target.repo, issueNumber: target.issueNumber as number };
+}
+
+/** Sparse settings are disabled by default; malformed nonempty settings are rejected. */
+export function configuredMirrorTarget(raw: unknown): MirrorTarget | undefined {
+  if (raw === undefined) return undefined;
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error('msgMirror config must be an object');
+  const target = (raw as Record<string, unknown>).target;
+  return target === undefined ? undefined : validateMirrorTarget(target);
+}
+
+export function validateMsgMirrorState(value: unknown): MsgMirrorState {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('invalid message mirror state');
+  const state = value as Record<string, unknown>;
+  if (state.version !== 1 || typeof state.messageCursor !== 'number' || !Number.isSafeInteger(state.messageCursor) || state.messageCursor < 0
+    || typeof state.summaryWindowEnd !== 'string' || !Number.isFinite(Date.parse(state.summaryWindowEnd))) throw new Error('invalid message mirror state');
+  const target = validateMirrorTarget(state.target);
+  const pending = state.rotationPending;
+  const rotationPending = pending && typeof pending === 'object' && !Array.isArray(pending)
+    ? { from: validateMirrorTarget((pending as Record<string, unknown>).from), to: validateMirrorTarget((pending as Record<string, unknown>).to) }
+    : undefined;
+  if (pending !== undefined && !rotationPending) throw new Error('invalid pending mirror rotation');
+  return { version: 1, target, messageCursor: state.messageCursor as number, summaryWindowEnd: new Date(state.summaryWindowEnd as string).toISOString(),
+    ...(rotationPending ? { rotationPending } : {}) };
+}
+
+function initialState(target: MirrorTarget, nowMs: number, latestMessageId: number): MsgMirrorState {
+  if (!Number.isSafeInteger(latestMessageId) || latestMessageId < 0) throw new Error('source latest message ID is invalid');
+  const end = Math.floor(nowMs / MIRROR_SUMMARY_INTERVAL_MS) * MIRROR_SUMMARY_INTERVAL_MS;
+  return { version: 1, target, messageCursor: latestMessageId, summaryWindowEnd: new Date(end).toISOString() };
+}
+
+function eventMarker(id: number): string { return `<!-- elanous-msg-mirror:event:${id} -->`; }
+function summaryMarker(start: string): string { return `<!-- elanous-msg-mirror:summary:${start} -->`; }
+
+function renderEvent(message: Message): string {
+  return `## ${message.kind} · #${message.id}\n\n**${message.from} → ${message.to}** · ${message.createdAt}\n\n${message.body.trim()}`;
+}
+
+async function prepareTarget(state: MsgMirrorState, transport: MsgMirrorTransport, dryRun: boolean): Promise<{
+  state: MsgMirrorState; rotated: number;
+}> {
+  let current = state;
+  let rotated = 0;
+  if (current.rotationPending) {
+    if (dryRun) return { state: current, rotated };
+    await transport.linkAndCloseChannel(current.rotationPending.from, current.rotationPending.to);
+    current = { ...current, rotationPending: undefined };
+  }
+  const count = await transport.countComments(current.target);
+  if (!shouldRotateMirrorChannel(count)) return { state: current, rotated };
+  if (dryRun) return { state: current, rotated };
+  const oldTarget = current.target;
+  const nextTarget = validateMirrorTarget(await transport.createNextChannel(oldTarget,
+    `msg-mirror-rotate:${oldTarget.repo}#${oldTarget.issueNumber}`));
+  current = { ...current, target: nextTarget, rotationPending: { from: oldTarget, to: nextTarget } };
+  // Persist the pointer before closing the old issue. On restart the pending link/close is retried.
+  // If this write fails, the adapter's idempotency key prevents creating another channel.
+  return { state: current, rotated: 1 };
+}
+
+/** One idempotent mirror pass. All GitHub effects are behind the injected transport. */
+export async function runMsgMirrorTick(options: MsgMirrorTickOptions): Promise<MsgMirrorTickResult> {
+  const nowMs = options.nowMs ?? Date.now();
+  if (!Number.isFinite(nowMs)) throw new Error('nowMs must be finite');
+  const stored = options.state.read();
+  const configured = options.configuredTarget ? validateMirrorTarget(options.configuredTarget) : undefined;
+  if (!stored && !configured) return { status: 'disabled', target: null, scanned: 0, posted: 0, rotated: 0, summaries: 0, sourceCursor: 0 };
+  await options.transport.beginTick?.();
+  let state = stored ? validateMsgMirrorState(stored) : initialState(configured!, nowMs, options.source.latestId());
+  let scanned = 0, posted = 0, rotated = 0, summaries = 0;
+  if (!options.dryRun) options.state.write(state);
+
+  const startTarget = state.target;
+  const prepared = await prepareTarget(state, options.transport, options.dryRun === true);
+  state = prepared.state;
+  rotated += prepared.rotated;
+  if (!options.dryRun && state !== stored) options.state.write(state);
+
+  // A rotation is recorded before side effects that close the previous issue.
+  if (state.rotationPending && !options.dryRun) {
+    await options.transport.linkAndCloseChannel(state.rotationPending.from, state.rotationPending.to);
+    state = { ...state, rotationPending: undefined };
+    options.state.write(state);
+  }
+
+  let page = options.source.listAfter(state.messageCursor, 1000);
+  while (page.length > 0) {
+    const eligible = new Map(selectMirrorEvents(page, state.messageCursor).map(message => [message.id, message]));
+    for (const message of page) {
+      scanned++;
+      const event = eligible.get(message.id);
+      if (event) {
+        const preparedNext = await prepareTarget(state, options.transport, options.dryRun === true);
+        if (preparedNext.rotated) {
+          state = preparedNext.state;
+          rotated += preparedNext.rotated;
+          if (!options.dryRun) {
+            options.state.write(state);
+            if (state.rotationPending) {
+              await options.transport.linkAndCloseChannel(state.rotationPending.from, state.rotationPending.to);
+              state = { ...state, rotationPending: undefined };
+              options.state.write(state);
+            }
+          }
+        }
+        const marker = eventMarker(event.id);
+        if (!options.dryRun && !(await options.transport.hasMarker(state.target, marker))) {
+          await options.transport.postComment(state.target, `${marker}\n${renderEvent(event)}`);
+          posted++;
+        }
+      }
+      state = { ...state, messageCursor: message.id };
+      if (!options.dryRun) options.state.write(state);
+    }
+    if (page.length < 1000) break;
+    page = options.source.listAfter(state.messageCursor, 1000);
+  }
+
+  let windowStart = Date.parse(state.summaryWindowEnd);
+  const nowWindowEnd = Math.floor(nowMs / MIRROR_SUMMARY_INTERVAL_MS) * MIRROR_SUMMARY_INTERVAL_MS;
+  while (windowStart + MIRROR_SUMMARY_INTERVAL_MS <= nowWindowEnd) {
+    const windowEnd = windowStart + MIRROR_SUMMARY_INTERVAL_MS;
+    const from = new Date(windowStart).toISOString();
+    const to = new Date(windowEnd).toISOString();
+    const summary = buildMirrorSummary(options.source.listWindow(from, to), from, to);
+    if (summary) {
+      const preparedNext = await prepareTarget(state, options.transport, options.dryRun === true);
+      if (preparedNext.rotated) {
+        state = preparedNext.state;
+        rotated += preparedNext.rotated;
+        if (!options.dryRun) {
+          options.state.write(state);
+          if (state.rotationPending) {
+            await options.transport.linkAndCloseChannel(state.rotationPending.from, state.rotationPending.to);
+            state = { ...state, rotationPending: undefined };
+            options.state.write(state);
+          }
+        }
+      }
+      const marker = summaryMarker(from);
+      if (!options.dryRun && !(await options.transport.hasMarker(state.target, marker))) {
+        await options.transport.postComment(state.target, `${marker}\n${summary}`);
+        posted++;
+      }
+      summaries++;
+    }
+    state = { ...state, summaryWindowEnd: to };
+    if (!options.dryRun) options.state.write(state);
+    windowStart = windowEnd;
+  }
+
+  return { status: options.dryRun ? 'dry-run' : 'synced', target: options.dryRun ? startTarget : state.target,
+    scanned, posted, rotated, summaries, sourceCursor: state.messageCursor };
+}

package/src/msg/msg-mirror-state.ts

@@ -0,0 +1,33 @@
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { elanousStateRoot } from '../autopilot/state-paths.js';
+import { validateMsgMirrorState, type MsgMirrorState, type MsgMirrorStateStore } from './msg-mirror-runner.js';
+
+export function defaultMsgMirrorStatePath(): string {
+  return join(elanousStateRoot(), 'msg', 'github-mirror-state.json');
+}
+
+/** One durable rotation pointer and progress cursor, stored atomically in the active state universe. */
+export class JsonMsgMirrorStateStore implements MsgMirrorStateStore {
+  constructor(readonly path: string = defaultMsgMirrorStatePath()) {}
+
+  read(): MsgMirrorState | null {
+    if (!existsSync(this.path)) return null;
+    const parsed: unknown = JSON.parse(readFileSync(this.path, 'utf8'));
+    return validateMsgMirrorState(parsed);
+  }
+
+  write(state: MsgMirrorState): void {
+    const normalized = validateMsgMirrorState(state);
+    mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+    const temp = `${this.path}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+      writeFileSync(temp, `${JSON.stringify(normalized, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+      renameSync(temp, this.path);
+    } catch (error) {
+      try { rmSync(temp, { force: true }); } catch { /* preserve the original write error */ }
+      throw error;
+    }
+  }
+}

package/src/msg/msg-store.ts

@@ -129,6 +129,7 @@ export class MsgStore {
       created_at TEXT NOT NULL
     );
     CREATE INDEX IF NOT EXISTS idx_msg_messages_recipient_id ON msg_messages(recipient, id);
+    CREATE INDEX IF NOT EXISTS idx_msg_messages_created_at_id ON msg_messages(created_at, id);
     CREATE TABLE IF NOT EXISTS msg_cursors (
       recipient TEXT PRIMARY KEY,
       last_id INTEGER NOT NULL DEFAULT 0 CHECK(last_id >= 0)
@@ -307,6 +308,16 @@ export class MsgStore {
       WHERE id > ? ORDER BY id ASC LIMIT ?`).all(after, limit) as MessageRow[]).map(fromRow));
   }
 
+  /** Read a half-open UTC timestamp window for periodic message-mirror summaries. */
+  listCreatedBetween(start: string, end: string): Message[] {
+    const startMs = Date.parse(start);
+    const endMs = Date.parse(end);
+    if (!Number.isFinite(startMs) || !Number.isFinite(endMs) || endMs <= startMs) throw new Error('invalid message time window');
+    return this.readWithSchema(hasReplyTo => (this.db.query(`SELECT id, sender, recipient, body, kind,
+      ${hasReplyTo ? 'reply_to' : 'NULL AS reply_to'}, created_at FROM msg_messages
+      WHERE created_at >= ? AND created_at < ? ORDER BY id ASC`).all(new Date(startMs).toISOString(), new Date(endMs).toISOString()) as MessageRow[]).map(fromRow));
+  }
+
   latestId(): number {
     return (this.db.query('SELECT COALESCE(MAX(id), 0) AS id FROM msg_messages').get() as { id: number }).id;
   }

package/src/output-truncation.ts

@@ -35,7 +35,7 @@ export interface TruncateOptions {
   toolName: string;
   /** File extension for the spilled file (no leading dot). Default 'txt'. */
   ext?: string;
-  /** Bytes above which we spill. Default 8192. */
+  /** Bytes above which we spill. Default 8192. The inline spill marker must fit this limit. */
   inlineLimit?: number;
   /** Head bytes preserved when spilled. Default 4096. */
   headBytes?: number;
@@ -59,8 +59,8 @@ export interface TruncateResult {
 /** Apply head/tail truncation + optional disk spill. */
 export function truncateOutput(body: string, opts: TruncateOptions): TruncateResult {
   const inlineLimit = opts.inlineLimit ?? DEFAULT_INLINE_LIMIT;
-  const head = opts.headBytes ?? DEFAULT_HEAD_BYTES;
-  const tail = opts.tailBytes ?? DEFAULT_TAIL_BYTES;
+  const requestedHead = opts.headBytes ?? DEFAULT_HEAD_BYTES;
+  const requestedTail = opts.tailBytes ?? DEFAULT_TAIL_BYTES;
   const ext = (opts.ext ?? 'txt').replace(/^\./, '');
   const outputDir = opts.outputDir ?? DEFAULT_OUTPUT_DIR;
 
@@ -74,22 +74,51 @@ export function truncateOutput(body: string, opts: TruncateOptions): TruncateRes
   const filename = `${opts.toolName}-${hash}.${ext}`;
   const savedPath = joinPath(outputDir, filename);
 
+  // Reserve enough space for the full path/footer first, then scale the
+  // requested head/tail budgets to fit the inline byte limit. A tiny limit
+  // that cannot hold the recovery marker is invalid instead of silently
+  // exceeding the configured maximum.
+  const marker = (elided: number) =>
+    `\n\n[... ${elided} bytes elided — saved to ${savedPath} (${bytes} bytes total). ` +
+    `Use Read tool with file_path="${savedPath}" to inspect more. ...]\n\n`;
+  const markerBudget = Buffer.byteLength(marker(bytes), 'utf8');
+  if (markerBudget >= inlineLimit) {
+    throw new RangeError(`inlineLimit must leave room for the saved-output marker (minimum ${markerBudget + 1} bytes)`);
+  }
   if (!existsSync(savedPath)) {
     mkdirSync(outputDir, { recursive: true });
     writeFileSync(savedPath, body, 'utf-8');
   }
+  const availableContentBytes = inlineLimit - markerBudget;
+  const requestedContentBytes = requestedHead + requestedTail;
+  const scale = requestedContentBytes > availableContentBytes
+    ? availableContentBytes / requestedContentBytes
+    : 1;
+  const head = Math.floor(requestedHead * scale);
+  const tail = Math.floor(requestedTail * scale);
 
-  // Build head+tail+footer. Slice on the string (not bytes) for
-  // simplicity; cap is a hint, not an invariant. UTF-8 multi-byte
-  // boundaries don't matter because we feed it to the LLM, not a
-  // byte-stream consumer.
-  const headStr = body.slice(0, head);
-  const tailStr = body.slice(-tail);
-  const elided = bytes - headStr.length - tailStr.length;
+  // Preserve byte budgets and never split a UTF-8 code point. The LLM
+  // inline limit is a byte limit too, so character slicing would allow
+  // multibyte output to exceed it by up to 4x.
+  const bodyBuffer = Buffer.from(body, 'utf8');
+  const alignStart = (offset: number): number => {
+    let index = Math.max(0, Math.min(bodyBuffer.length, offset));
+    while (index < bodyBuffer.length && (bodyBuffer[index]! & 0b1100_0000) === 0b1000_0000) index++;
+    return index;
+  };
+  const alignEnd = (offset: number): number => {
+    let index = Math.max(0, Math.min(bodyBuffer.length, offset));
+    while (index > 0 && index < bodyBuffer.length && (bodyBuffer[index]! & 0b1100_0000) === 0b1000_0000) index--;
+    return index;
+  };
+  const headEnd = alignEnd(head);
+  const tailStart = alignStart(bodyBuffer.length - tail);
+  const headStr = bodyBuffer.toString('utf8', 0, headEnd);
+  const tailStr = bodyBuffer.toString('utf8', tailStart);
+  const elided = bytes - Buffer.byteLength(headStr, 'utf8') - Buffer.byteLength(tailStr, 'utf8');
   const out = [
     headStr,
-    `\n\n[... ${elided} bytes elided — saved to ${savedPath} (${bytes} bytes total). ` +
-      `Use Read tool with file_path="${savedPath}" to inspect more. ...]\n\n`,
+    marker(elided),
     tailStr,
   ].join('');
 

package/src/project/project-store.ts

@@ -1,4 +1,4 @@
-import { randomUUID } from 'node:crypto';
+import { createHash, createHmac, randomBytes, randomUUID } from 'node:crypto';
 import { linkSync, mkdirSync, readFileSync, readdirSync, realpathSync, unlinkSync, writeFileSync } from 'node:fs';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { parse, stringify } from 'yaml';
@@ -133,3 +133,50 @@ export function getProject(id: string): Project | null {
 export function suggestProjectForFolder(folder: string): Project | null {
   return new ProjectStore().suggestForFolder(folder);
 }
+
+// TENANT-BOUNDARY (0.2.41 · nfr:security): 고객 프로젝트 원장이 설치 밖으로 나가는
+// 출구는 이 익명 내보내기 하나다 — 식별 필드(이름·경로)는 익명 토큰으로 치환되고
+// id(이미 불투명한 uuid)·createdAt·relations 만 남는다.
+export interface AnonymousProject {
+  id: string;
+  name: string;
+  createdAt: string;
+  primaryFolder?: string;
+  relations?: Project['relations'];
+}
+
+const ANONYMOUS_EXPORT_DOMAIN = 'elanous-tenant-boundary';
+
+function anonymousExportSecret(): Buffer {
+  const configDir = getElanousConfigDir();
+  const path = join(configDir, 'tenant-boundary-secret');
+  try {
+    const existing = readFileSync(path);
+    if (existing.length === 32) return existing;
+  } catch { /* first use */ }
+  mkdirSync(configDir, { recursive: true, mode: 0o700 });
+  const secret = randomBytes(32);
+  try { writeFileSync(path, secret, { flag: 'wx', mode: 0o600 }); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+    const existing = readFileSync(path);
+    if (existing.length === 32) return existing;
+    throw new Error('invalid tenant boundary secret');
+  }
+  return secret;
+}
+
+export function anonymousToken(prefix: 'project' | 'folder', value: string): string {
+  return `${prefix}-${createHmac('sha256', anonymousExportSecret()).update(`${ANONYMOUS_EXPORT_DOMAIN}\u0000${prefix}\u0000${value}`).digest('hex').slice(0, 16)}`;
+}
+
+export function anonymousExport(project: Project): AnonymousProject {
+  const exported: AnonymousProject = {
+    id: project.id,
+    name: anonymousToken('project', project.name),
+    createdAt: project.createdAt,
+  };
+  if (project.primaryFolder !== undefined) exported.primaryFolder = anonymousToken('folder', project.primaryFolder);
+  if (project.relations !== undefined) exported.relations = project.relations;
+  return exported;
+}

package/src/release-loop/gate-host-reservation.ts

@@ -1,9 +1,12 @@
 import { randomUUID } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { psProcessStartMs } from '../harness/harness-stop.js';
 import { debug } from '../debug/log.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { psProcessStart, type HostLeaseRecord, type PendingJobIdentity } from '../pod-lease/host-lease.js';
+import { parsePodPool, podPoolHostLease, resolvePodPoolSpec, type PodPoolMember } from '../task-orchestrator/surfaces/pod-pool.js';
 
 interface GateHostClaim {
   token: string;
@@ -19,6 +22,147 @@ export type GateHostReservation =
   | { status: 'free' }
   | { status: 'reserved' | 'unknown'; reason: string; runId?: string; reservedAt?: number };
 
+/** Read-only snapshots used to decide whether the resource pool behind a gate host is occupied. */
+export interface GateHostResourceSnapshot {
+  /** null means the lease ledger was unreadable; [] is a measured empty ledger. */
+  leases: readonly HostLeaseRecord[] | null;
+  /** Active Pending/Running Jobs from the configured Pod pool; null means not measurable. */
+  activeJobs: readonly PendingJobIdentity[] | null;
+}
+
+export type GateHostResourceReading =
+  | { status: 'measured'; empty: boolean; reservations: number; authoringLeases: number; waitingJobs: number; activeJobs: number }
+  | { status: 'unmeasurable'; empty: null; reason: 'lease-ledger-unavailable' | 'lease-ledger-invalid' | 'pod-list-unavailable' | 'pod-list-invalid' | 'pod-pool-invalid' };
+
+const unavailable = (reason: Extract<GateHostResourceReading, { status: 'unmeasurable' }>['reason']): GateHostResourceReading => ({ status: 'unmeasurable', empty: null, reason });
+
+/** Read leases and active harness Pods from the configured pool without creating, pruning, or updating any ledger. */
+export function readGateHostResourcesForHost(host: string, env: NodeJS.ProcessEnv = process.env,
+  deps: { members?: readonly PodPoolMember[]; kubectl?: (args: readonly string[]) => { status: number | null; stdout: string };
+    processStart?: (pid: number) => string | null } = {}): GateHostResourceReading {
+  let members: readonly PodPoolMember[];
+  try {
+    const spec = resolvePodPoolSpec(undefined, env, () => {
+      try {
+        // The gate path resolves its pool from harness.podPool, unlike generic Pod launches.
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        return (require('../user-config.js') as typeof import('../user-config.js')).getUserConfig().harness?.podPool;
+      } catch { return undefined; }
+    });
+    members = deps.members ?? (spec ? parsePodPool(spec) : []);
+  } catch { return unavailable('pod-pool-invalid'); }
+  if (!members.length) return unavailable('pod-list-unavailable');
+  const selectedHost = host.split('@').at(-1)!;
+  const selectedMembers = members.filter(member => member.sshHost === selectedHost);
+  if (!selectedMembers.length) return unavailable('pod-list-unavailable');
+  const selectedContexts = new Set(selectedMembers.map(member => member.context));
+
+  const leasePool = podPoolHostLease(members);
+  let leases: HostLeaseRecord[];
+  try {
+    let names: string[];
+    try { names = readdirSync(leasePool.dir).filter(name => name.endsWith('.json')); }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') names = [];
+      else return unavailable('lease-ledger-unavailable');
+    }
+    leases = [];
+    const processStart = deps.processStart ?? psProcessStart;
+    for (const name of names) {
+      if (!/^[A-Za-z0-9._-]+\.json$/.test(name)) return unavailable('lease-ledger-invalid');
+      let lease: HostLeaseRecord;
+      try { lease = JSON.parse(readFileSync(join(leasePool.dir, name), 'utf8')) as HostLeaseRecord; }
+      catch { return unavailable('lease-ledger-invalid'); }
+      if (!lease || !Number.isSafeInteger(lease.pid) || lease.pid <= 0 || typeof lease.startedAt !== 'string' || !lease.startedAt ||
+        typeof lease.at !== 'string' || (lease.stage !== undefined && lease.stage !== 'authoring' && lease.stage !== 'job') ||
+        (lease.stage === 'job' && (!lease.job || !lease.context || !lease.namespace))) return unavailable('lease-ledger-invalid');
+      try { process.kill(lease.pid, 0); }
+      catch (error) {
+        if ((error as NodeJS.ErrnoException).code === 'ESRCH') continue;
+        // EPERM means the PID may still be alive; the start-time comparison below is still read-only.
+      }
+      const startedAt = processStart(lease.pid);
+      if (startedAt === null) return unavailable('lease-ledger-unavailable');
+      if (startedAt !== lease.startedAt) continue;
+      if (lease.stage !== 'job' || selectedContexts.has(lease.context!)) leases.push(lease);
+    }
+  } catch { return unavailable('lease-ledger-unavailable'); }
+
+  const kubectl = deps.kubectl ?? ((args: readonly string[]) => {
+    const result = spawnSync('kubectl', [...args], { encoding: 'utf8', timeout: 15_000, maxBuffer: 64 * 1024 * 1024 });
+    return { status: result.status, stdout: result.stdout ?? '' };
+  });
+  const activeJobs = new Map<string, PendingJobIdentity>();
+  for (const member of selectedMembers) {
+    let result: { status: number | null; stdout: string };
+    try { result = kubectl(['--context', member.context, '--request-timeout=10s', 'get', 'pods', '--all-namespaces', '-l', 'elanous.substrate=pod', '-o', 'json']); }
+    catch { return unavailable('pod-list-unavailable'); }
+    if (result.status !== 0) return unavailable('pod-list-unavailable');
+    let items: unknown;
+    try { items = (JSON.parse(result.stdout) as { items?: unknown }).items; }
+    catch { return unavailable('pod-list-invalid'); }
+    if (!Array.isArray(items)) return unavailable('pod-list-invalid');
+    for (const item of items) {
+      if (!item || typeof item !== 'object') return unavailable('pod-list-invalid');
+      const pod = item as { metadata?: { name?: unknown; namespace?: unknown; deletionTimestamp?: unknown; labels?: Record<string, unknown>; ownerReferences?: Array<{ kind?: unknown; name?: unknown }> }; status?: { phase?: unknown } };
+      const phase = pod.status?.phase;
+      if (phase === 'Succeeded' || phase === 'Failed') continue;
+      if (phase !== 'Pending' && phase !== 'Running') return unavailable('pod-list-invalid');
+      // Deleting Pods are already leaving the pool and must not keep the selected host occupied.
+      if (pod.metadata?.deletionTimestamp != null) continue;
+      const context = member.context;
+      const namespace = pod.metadata?.namespace;
+      const owner = pod.metadata?.ownerReferences?.find(ref => ref.kind === 'Job')?.name;
+      const job = owner ?? pod.metadata?.labels?.['job-name'];
+      if (typeof namespace !== 'string' || !namespace || typeof job !== 'string' || !job) return unavailable('pod-list-invalid');
+      const identity = { context, namespace, job };
+      activeJobs.set(`${context}\0${namespace}\0${job}`, identity);
+    }
+  }
+  const reading = readGateHostResources({ leases, activeJobs: [...activeJobs.values()] });
+  debug.log('release-loop.gate', 'host-resource-probe', { host: selectedHost, poolContexts: selectedMembers.map(member => member.context), ...reading });
+  return reading;
+}
+
+function activeJobKey(job: PendingJobIdentity): string | null {
+  return typeof job?.context === 'string' && job.context.length > 0 &&
+    typeof job.namespace === 'string' && job.namespace.length > 0 &&
+    typeof job.job === 'string' && job.job.length > 0
+    ? `${job.context}\0${job.namespace}\0${job.job}` : null;
+}
+
+/**
+ * Read the resource ledgers as the authority for host occupancy. Process argv is deliberately not an input:
+ * unrelated commands that happen to contain `bun test` do not reserve a gate host.
+ * A Job-backed lease and its active Job are one reservation; a lease without an observed Job remains reserved.
+ */
+export function readGateHostResources(snapshot: GateHostResourceSnapshot): GateHostResourceReading {
+  if (snapshot.leases === null) return { status: 'unmeasurable', empty: null, reason: 'lease-ledger-unavailable' };
+  if (snapshot.activeJobs === null) return { status: 'unmeasurable', empty: null, reason: 'pod-list-unavailable' };
+  if (!Array.isArray(snapshot.leases) || snapshot.leases.some((lease) => !lease ||
+    !Number.isSafeInteger(lease.pid) || lease.pid <= 0 || typeof lease.startedAt !== 'string' || !lease.startedAt || typeof lease.at !== 'string' ||
+    (lease.stage !== undefined && lease.stage !== 'authoring' && lease.stage !== 'job') ||
+    (lease.stage === 'job' && (!lease.job || !lease.context || !lease.namespace)))) {
+    return { status: 'unmeasurable', empty: null, reason: 'lease-ledger-invalid' };
+  }
+  if (!Array.isArray(snapshot.activeJobs) || snapshot.activeJobs.some((job) => !job || activeJobKey(job) === null)) {
+    return { status: 'unmeasurable', empty: null, reason: 'pod-list-invalid' };
+  }
+
+  const jobs = new Set(snapshot.activeJobs.map(activeJobKey) as string[]);
+  // Authoring leases have no host/context yet, so they conservatively occupy each selected host in the shared pool.
+  let authoringLeases = 0;
+  let waitingJobs = 0;
+  for (const lease of snapshot.leases) {
+    if (lease.stage !== 'job') { authoringLeases++; continue; }
+    const key = lease.job && lease.context && lease.namespace
+      ? activeJobKey({ job: lease.job, context: lease.context, namespace: lease.namespace }) : null;
+    if (!key || !jobs.has(key)) waitingJobs++;
+  }
+  const reservations = authoringLeases + waitingJobs + jobs.size;
+  return { status: 'measured', empty: reservations === 0, reservations, authoringLeases, waitingJobs, activeJobs: jobs.size };
+}
+
 const hostName = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 const claimsDir = (root: string) => join(root, 'release', 'gate-host-reservations');