@dotdrelle/wiki-manager 0.15.101 → 0.16.0

package/src/runtime/server.js

@@ -30,6 +30,7 @@ import { reconcileControlQueue } from './controlDrain.js';
 import { cancelControlChain, cancelQueuedControlItem } from './controlCancellation.js';
 import { generateSkillAcknowledgment, runSkillChain } from './skillRun.js';
 import { emitRuntimeLog } from './supervisor.js';
+import { summarizeCompactedConversation } from './conversationCompact.js';
 import { findSkill, listSkills } from '../core/skills.js';
 import {
   enrollment,
@@ -587,6 +588,10 @@ export function startRuntimeServer({
             // line pushed into the thread.
             input = runtimeStatusSynthesisPrompt(input, controlStatus(context, store));
             readOnlyChat = true;
+          } else if (actsDuringRun(classification)) {
+            // A new action: Donna takes the turn with her direct tools and
+            // performs it now when one fits (write a template, a page, run a
+            // read), or queues it after the run herself.
           } else if (classification.kind !== 'converse') {
             const result = await handleControlMessage(context, store, input, {
               intent: body.intent,
@@ -619,6 +624,8 @@ export function startRuntimeServer({
             if (classification.kind === 'observe') {
               input = runtimeStatusSynthesisPrompt(input, controlStatus(context, store));
               readOnlyChat = true;
+            } else if (actsDuringRun(classification)) {
+              // Same as above: Donna acts now or queues it herself.
             } else if (classification.kind !== 'converse') {
               const result = await handleControlMessage(context, store, input, {
                 intent: body.intent,
@@ -1023,6 +1030,16 @@ export function startRuntimeServer({
       context?.currentAbortController?.abort();
       await cancel?.(context);
     }
+    // A purge must wait for the aborted run to finish dispatching its terminal
+    // events, or those events re-create the run/plan after the wipe (see
+    // currentRunPromise above). Bounded: a run that ignores its abort signal
+    // must not freeze the reset.
+    if (purge && !targetRunId && typeof context?.currentRunPromise?.then === 'function') {
+      await Promise.race([
+        Promise.resolve(context.currentRunPromise).catch(() => {}),
+        new Promise((resolve) => setTimeout(resolve, 5000)),
+      ]);
+    }
     const runs = typeof store.interruptRuns === 'function'
       ? store.interruptRuns({ workspace: targetWorkspace, runId: targetRunId, reason: 'Runtime run killed by user.' })
       : 0;
@@ -1085,6 +1102,12 @@ export function startRuntimeServer({
       proactiveRuns.set(runId, body.proactiveReview);
     }
     const runPromise = run(context, runBody, { signal: context.currentAbortController.signal, runId });
+    // Keep a handle so a purge can wait for the aborted run to finish
+    // dispatching its terminal events BEFORE it wipes the event log. Without
+    // this, `run_cancelled`/`plan_step_updated` emitted during the unwind
+    // landed after `clearWorkspaceState` and re-created the very run/plan the
+    // user just reset — the "reset restarts at 47%" symptom.
+    context.currentRunPromise = runPromise;
     runPromise
       .catch((err) => {
         rejectReady?.(err);
@@ -1100,6 +1123,7 @@ export function startRuntimeServer({
           proactiveScheduler.release(proactive.workspace);
         }
         if (context.session?._proactiveReview?.runId === runId) context.session._proactiveReview = null;
+        if (context.currentRunPromise === runPromise) context.currentRunPromise = null;
         context.running = false;
         context.currentAbortController = null;
         context.currentRunId = null;
@@ -1729,44 +1753,6 @@ async function handleControlMessage(context, store, input, { intent = null, star
  falls back to the deterministic English catalog when no LLM is configured or
  the call fails. The fallback is what keeps the lane deterministic-under-failure.
  */
-const CONVERSATION_SUMMARY_TIMEOUT_MS = 20_000;
-const CONVERSATION_SUMMARY_MAX_INPUT_CHARS = 8_000;
-
-/*
- A compact does not just cut older turns from conversationSeed — it replaces
- them with a short rolling summary, so a decision made 20 messages ago is not
- gone from Donna's grounding entirely, only condensed. Best-effort: no LLM
- configured, an empty reply, or a call failure all fall back to keeping
- whatever summary already existed (never worse than before this compact),
- the same deterministic-under-failure shape as generateControlAcknowledgment.
- */
-async function summarizeCompactedConversation(session, { previousSummary, segment }) {
-  const llm = session?.llm;
-  const transcript = (Array.isArray(segment) ? segment : [])
-    .filter((message) => ['user', 'assistant'].includes(message?.role) && String(message?.content ?? '').trim())
-    .map((message) => `${message.role === 'user' ? 'User' : 'Assistant'}: ${String(message.content).trim()}`)
-    .join('\n')
-    .slice(0, CONVERSATION_SUMMARY_MAX_INPUT_CHARS);
-  if (!transcript) return previousSummary || null;
-  if (!(llm && typeof llm.complete === 'function')) return previousSummary || null;
-  try {
-    const reply = await llm.complete({
-      system: 'You maintain a compact working memory for Donna, a workspace assistant. You are shown an optional PREVIOUS SUMMARY and a NEW SEGMENT of conversation about to leave the assistant\'s context window. Write ONE updated summary that preserves the facts, decisions, open questions and user preferences that still matter for future turns. Be concise: well under 200 words. Return only the summary text — no preamble, no meta-commentary, no headings.',
-      input: [
-        previousSummary ? `PREVIOUS SUMMARY:\n${previousSummary}` : null,
-        `NEW SEGMENT:\n${transcript}`,
-      ].filter(Boolean).join('\n\n'),
-      signal: AbortSignal.timeout(CONVERSATION_SUMMARY_TIMEOUT_MS),
-    });
-    const text = String(reply ?? '').trim();
-    if (text) return text;
-    emitRuntimeLog(session, 'conversation-compact: LLM returned an empty summary, keeping the previous one');
-  } catch (err) {
-    emitRuntimeLog(session, `conversation-compact: summary LLM call failed, keeping the previous summary — ${err instanceof Error ? err.message : String(err)}`);
-  }
-  return previousSummary || null;
-}
-
 async function generateControlAcknowledgment(session, { kind, input }) {
   const language = String(session?.language ?? '').trim().toLowerCase() || 'en';
   const llm = session?.llm;
@@ -2031,16 +2017,46 @@ function asksForRunStatus(input) {
   return statusWord.test(text) && runNoun.test(text);
 }
 
-// Classifier for the control lane's free-text messages. The classification is
-// LLM-backed: the only deterministic matches left are the runtime's own
-// control verbs (cancel, an explicit "later/queue", status and plan-change
-// wording). Deciding "is this a NEW task to queue vs plain conversation" is a
-// semantic judgement about the workspace's domain, so it is never a keyword
-// list here — it goes to the model, bounded, and falls back to the choice menu
-// (`ambiguous`) rather than guessing when no model is available.
+// Classifier for the control lane's free-text messages, used by `/turn` (serve,
+// ShellUI) and `/control message` (legacy shell) while a run is active.
+//
+// The model decides. The only deterministic rules left match a WHOLE message
+// that can mean one thing: a bare cancel command, a bare status question, a
+// bare confirmation, an explicit "queue it". Keywords inside a sentence used
+// to decide instead, and ordinary questions typed during an ingest were
+// misrouted (measured 2026-09-25, plan-demandes-pendant-run.md): "explique /
+// montre" answered with the run status, "après / plan" proposed a patch of the
+// running plan, "modifie la page" too — and "quand est-ce qu'on stop le
+// support de X ?" cancelled the run. Every fallback is read-only
+// conversation: a wrong triage can only answer, never cancel or mutate.
+const CANCEL_COMMAND = /^\s*(?:stop|cancel|abort|annule[rz]?|arr[eê]te[rz]?|interromps)(?:\s+(?:tout|all|everything|it|[çc]a|(?:le|ce|the|this)\s+(?:run|job|build|export|traitement|pipeline)|l['’]\s?(?:ingestion|export)|la\s+t[aâ]che))?\s*[.!…]*\s*$/i;
+const STATUS_ONLY = /^\s*(?:\/status|status|statut|progress(?:ion)?|avancement|logs?|quoi de neuf|o[uù] en (?:est|es-tu|sommes-nous)(?:[- ]?(?:on|il|elle|ce|[çc]a))?)\s*[?!.…]*\s*$/i;
+const CONFIRMATION_ONLY = /^\s*(?:oui|yes|yep|ok|okay|vas[- ]?y|d['’]accord|daccord|entendu)\s*[.!…]*\s*$/i;
+const EXPLICIT_ENQUEUE = /\b(?:enqueue|mets(?:-le)? en file|met en file|apr[eè]s ce run|[aà] la fin (?:du|de ce) run|next run|after this run)\b/i;
+
+// A NEW action typed during a run (the model said "action", not an explicit
+// "mets en file"). It used to be queued straight away, so a template to write
+// waited for a whole ingest. It now goes to an agent turn instead: Donna holds
+// her direct tools there — never a job starter (isOrchestrationBypassTool) —
+// and either performs it now or queues it with runtime__enqueue. The engine
+// refuses a write that would race with the running job, and says so
+// (plan-demandes-pendant-run.md, lot 3).
+export function actsDuringRun(classification) {
+  return classification?.kind === 'enqueue_run' && classification?.reason === 'llm_classified_action';
+}
+
+const CONTROL_CATEGORIES = {
+  question: { kind: 'converse', reason: 'llm_classified_question' },
+  conversation: { kind: 'converse', reason: 'llm_classified_question' },
+  status: { kind: 'observe', reason: 'llm_classified_status' },
+  action: { kind: 'enqueue_run', reason: 'llm_classified_action' },
+  plan_change: { kind: 'modify_run', reason: 'llm_classified_plan_change' },
+  cancel: { kind: 'cancel', reason: 'llm_classified_cancel' },
+};
+
 export async function classifyControlMessage(input, status, { forcedIntent = null, llm = null, session = null } = {}) {
   // Caller (the /control message route) already trims and rejects empty input.
-  const lower = String(input ?? '').toLowerCase();
+  const text = String(input ?? '');
   const intent = forcedIntent ? String(forcedIntent).toLowerCase() : null;
   const explicit = {
     observe: 'observe',
@@ -2056,55 +2072,47 @@ export async function classifyControlMessage(input, status, { forcedIntent = nul
   if (explicit) {
     return { kind: explicit, confidence: 1, reason: 'explicit_intent' };
   }
-  // Cancel stays a keyword: it is a runtime control verb, and an abort must not
-  // wait on a model round-trip.
-  if (/\b(cancel|annule|stop|arr[eê]te|interromps|abort)\b/i.test(lower)) {
-    return { kind: 'cancel', confidence: 0.86, reason: 'cancel_request' };
-  }
-  if (/\b(plus tard|later|ensuite|apr[eè]s ce run|enqueue|mets en file|met en file|futur|next run|future run)\b/i.test(lower)) {
-    return { kind: 'enqueue_run', confidence: 0.8, reason: 'future_run_request' };
+  // A bare cancel command stays deterministic: an abort must not wait on a
+  // model round-trip. The whole message has to BE the command.
+  if (CANCEL_COMMAND.test(text)) {
+    return { kind: 'cancel', confidence: 0.9, reason: 'cancel_command' };
   }
-  if (/\b(o[uù] en es[t-]|status|statut|progress|progression|logs?|explique|explain|inspect|show|montre|quoi de neuf)\b/i.test(lower)) {
-    return { kind: 'observe', confidence: 0.86, reason: 'status_or_explanation_request' };
+  if (STATUS_ONLY.test(text) || asksForRunStatus(text)) {
+    return { kind: 'observe', confidence: 0.86, reason: 'status_request' };
   }
   // A bare "yes" answers the runtime's own last prompt (the launch
   // acknowledgement used to end on "check progress or cancel?"). While a run is
-  // active, the only thing the runtime can act on is a status check: treating
-  // the word as ordinary conversation made the read-only chat fallback lecture
-  // the user about switching modes instead of answering.
-  // Anchored at BOTH ends: "oui" is a confirmation, "oui, ajoute une étape de
-  // polish" is a plan change. Without the end anchor this branch shadowed
-  // modify_run and enqueue_run for every message merely STARTING on a yes.
-  if (status.running && /^\s*(oui|yes|yep|ok|okay|vas[- ]?y|d'accord|daccord|entendu)\s*[.!…]*\s*$/i.test(lower)) {
+  // active, the only thing the runtime can act on is a status check. Anchored
+  // at BOTH ends: "oui, ajoute une étape de polish" is not a confirmation.
+  if (status.running && CONFIRMATION_ONLY.test(text)) {
     return { kind: 'observe', confidence: 0.7, reason: 'confirmation_of_runtime_prompt' };
   }
-  if (status.running && /\b(ajoute|add|change|modifie|modify|remplace|replace|retire|remove|skip|ignore|apr[eè]s|before|after|chaque|each|plan|step|t[aâ]che)\b/i.test(lower)) {
-    return { kind: 'modify_run', confidence: 0.78, reason: 'active_run_change_request' };
+  if (EXPLICIT_ENQUEUE.test(text)) {
+    return { kind: 'enqueue_run', confidence: 0.8, reason: 'explicit_enqueue_request' };
   }
   if (!status.running) return { kind: 'converse', confidence: 0.62, reason: 'plain_conversation' };
-  // A run is active and none of the runtime control verbs matched. The message
-  // is either a request to perform a NEW mutating task (→ queue it to run
-  // after the current one) or ordinary conversation — that is a judgement about
-  // the workspace's domain, so the model decides it, never a keyword list.
   if (llm && typeof llm.complete === 'function') {
     try {
       const reply = await llm.complete({
-        system: 'You classify one user message typed while a run is already active. Return exactly one word, nothing else.',
+        system: 'You classify one user message typed while a run is already active in their workspace. Return exactly one word, nothing else.',
         input: [
           `The user typed this while a run is active: "${input}"`,
           '',
           'Choose ONE of:',
-          '- "action" — a request to perform a NEW task (generate, create, ingest, build, export, convert, send, publish, produce…), which must run after the current run.',
-          '- "conversation" — ordinary conversation, a question, or an unrelated remark.',
+          '- "question" — a question or search about the workspace content or the product, an explanation request, or ordinary conversation. Words such as "plan", "after", "show", "explain" or "stop" inside a question do not make it anything else.',
+          '- "status" — a question about the progress or state of the run currently executing.',
+          '- "action" — a request to perform a NEW task: create, edit or write a file or page, ingest, build, export, convert, curate, run a doctor, rebuild an index, send, publish…',
+          '- "plan_change" — a request to change the run currently executing: add or skip one of its steps, change its target.',
+          '- "cancel" — a request to stop or cancel the run currently executing.',
           '',
           'Return only that one word.',
         ].join('\n'),
         signal: AbortSignal.timeout(8_000),
       });
-      const kind = String(reply ?? '').trim().toLowerCase();
-      if (kind.startsWith('action')) return { kind: 'enqueue_run', confidence: 0.85, reason: 'llm_classified_action' };
-      if (kind.startsWith('conversation')) return { kind: 'converse', confidence: 0.85, reason: 'llm_classified_conversation' };
-      emitRuntimeLog(session, `control-classify: LLM returned an unrecognized reply, answering as read-only conversation — ${JSON.stringify(kind).slice(0, 200)}`);
+      const word = String(reply ?? '').trim().toLowerCase().replace(/[^a-z_]/g, '');
+      const category = Object.keys(CONTROL_CATEGORIES).find((name) => word.startsWith(name));
+      if (category) return { ...CONTROL_CATEGORIES[category], confidence: 0.85 };
+      emitRuntimeLog(session, `control-classify: LLM returned an unrecognized reply, answering as read-only conversation — ${JSON.stringify(word).slice(0, 200)}`);
     } catch (err) {
       // A degradation must announce itself: silently falling through here
       // hides the difference between "no LLM configured" (expected) and "the

package/src/runtime/server.test.js

@@ -840,6 +840,77 @@ test('runtime server state exposes active run identity while running', async (t)
   }
 });
 
+// A purge used to wipe the event log while the aborted run was still emitting
+// its terminal events; those landed after the wipe and re-created the run/plan
+// ("reset restarts at 47%"). The purge must wait for the run to settle first.
+test('a purge waits for the aborted run to settle before wiping state', async (t) => {
+  const order = [];
+  const context = {
+    workspace: 'acme',
+    session: { workspace: 'acme' },
+    running: false,
+    currentAbortController: null,
+    currentRunId: null,
+  };
+  let handle;
+  try {
+    handle = await startRuntimeServer({
+      host: '127.0.0.1',
+      port: 0,
+      store: {
+        dbPath: ':memory:',
+        getState: () => ({ status: 'idle', plan: [] }),
+        listEvents: () => [],
+        interruptRuns: () => 0,
+        cancelActiveTasksForInterruptedRuns: () => 0,
+        clearWorkspaceState: () => {
+          order.push('clear');
+          return { runs: 0, events: 0, queue: 0 };
+        },
+      },
+      getContext: async () => context,
+      run: async (_context, _body, { signal }) => {
+        await new Promise((resolve) => {
+          if (signal.aborted) {
+            order.push('abort');
+            resolve();
+            return;
+          }
+          signal.addEventListener('abort', () => {
+            order.push('abort');
+            resolve();
+          });
+        });
+        order.push('settled');
+      },
+    });
+  } catch (err) {
+    if (err?.code === 'EPERM') {
+      t.skip('network listen is not permitted in this sandbox');
+      return;
+    }
+    throw err;
+  }
+
+  try {
+    const runResponse = await fetch(`http://127.0.0.1:${handle.port}/run?workspace=acme`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ input: 'build' }),
+    });
+    assert.equal(runResponse.status, 202);
+    const kill = await fetch(`http://127.0.0.1:${handle.port}/kill?workspace=acme`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ purge: true }),
+    });
+    assert.equal(kill.status, 202);
+    assert.deepEqual(order, ['abort', 'settled', 'clear']);
+  } finally {
+    await handle.close();
+  }
+});
+
 test('runtime server isolates active runs by workspace', async (t) => {
   const releases = new Map();
   const runWorkspaces = [];
@@ -1351,6 +1422,8 @@ test('runtime server control message records active plan mutation as a proposal'
   const session = {
     workspace: 'acme',
     controlQueue: [],
+    // The model decides a plan change; no keyword does (plan-demandes-pendant-run.md).
+    llm: { complete: async () => 'plan_change' },
   };
   dispatchAgentEvent(session, createAgentEvent('run_started', {
     origin: 'runtime',
@@ -1899,6 +1972,54 @@ test('POST /turn treats a bare confirmation during a run as a status check', asy
   }
 });
 
+// plan-demandes-pendant-run.md, lot 3: a new action typed during a run used to
+// be queued straight away, so a template waited for a whole ingest. It is an
+// agent turn now (Donna's direct tools, or runtime__enqueue from her), while a
+// question stays a read-only chat turn and nothing lands in the control queue.
+test('POST /turn hands a new action typed during a run to an agent turn, not the queue', async (t) => {
+  const session = { workspace: 'acme', controlQueue: [], llm: null };
+  const context = { workspace: 'acme', session, running: true, currentAbortController: null };
+  const status = {
+    status: 'pending_approval', running: true,
+    plan: [{ step: 1, description: 'Ingest pending sources', status: 'waiting_approval' }],
+    queue: [], controlQueue: [], approvals: [], conversation: [],
+  };
+  const turns = [];
+  let handle;
+  try {
+    handle = await startRuntimeServer({
+      host: '127.0.0.1', port: 0,
+      store: { dbPath: ':memory:', getState: () => status, listEvents: () => [] },
+      getContext: async () => context,
+      run: async () => new Promise(() => {}),
+      turn: async (_context, options) => { turns.push(options); return { ok: true }; },
+    });
+  } catch (err) {
+    if (err?.code === 'EPERM') { t.skip('network listen is not permitted in this sandbox'); return; }
+    throw err;
+  }
+  try {
+    for (const [input, word] of [['crée un template pour la note de synthèse', 'action'], ['que dit le wiki sur SISBA ?', 'question']]) {
+      session.llm = { complete: async () => word };
+      const response = await fetch(`http://127.0.0.1:${handle.port}/turn?workspace=acme`, {
+        method: 'POST', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ input, mode: 'agent' }),
+      });
+      assert.equal(response.status, 202);
+      assert.equal((await response.json()).kind, 'turn');
+    }
+    await new Promise((resolve) => setTimeout(resolve, 25));
+    assert.deepEqual(turns.map((options) => [options.input, options.mode]), [
+      ['crée un template pour la note de synthèse', 'agent'],
+      ['que dit le wiki sur SISBA ?', 'chat'],
+    ]);
+    assert.equal(session.controlQueue.length, 0, 'nothing was queued behind the run');
+  } finally {
+    context.currentAbortController?.abort();
+    await handle.close();
+  }
+});
+
 test('POST /turn answers the reserved /status command itself, never the homonymous skill', async (t) => {
   // A workspace skill named `status` exists precisely to prove the built-in
   // wins: `/status` was handed to the model, which ran that skill (English

package/src/runtime/store.js

@@ -249,7 +249,23 @@ export function openRuntimeStore({ stateDir = defaultRuntimeStateDir(), fileName
     INSERT OR IGNORE INTO events (sequence, id, ts, type, run_id, turn_id, task_id, workspace, origin, payload)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `);
-  const nextEventSequenceStatement = db.prepare('SELECT COALESCE(MAX(sequence), 0) + 1 AS next_sequence FROM events');
+  // A sequence is a CURSOR clients hold ("events after N"): it must never be
+  // handed out twice. MAX(sequence)+1 alone reused the numbers a purge or a
+  // truncation had just deleted — observed: after a purge the next run's
+  // events took 3503…3540 again, a served chat whose cursor stood at 3536
+  // never received them, and it stayed on the failed run (strip at 0 %,
+  // inspector on the old task) while the ShellUI showed the new one done.
+  // sqlite_sequence keeps the high-water mark of an AUTOINCREMENT table
+  // across deletions; a legacy table without it falls back to MAX.
+  const hasSqliteSequence = Boolean(db.prepare(
+    "SELECT 1 AS present FROM sqlite_master WHERE type = 'table' AND name = 'sqlite_sequence'",
+  ).get());
+  const nextEventSequenceStatement = db.prepare(hasSqliteSequence
+    ? `SELECT MAX(
+        COALESCE((SELECT MAX(sequence) FROM events), 0),
+        COALESCE((SELECT seq FROM sqlite_sequence WHERE name = 'events'), 0)
+      ) + 1 AS next_sequence`
+    : 'SELECT COALESCE(MAX(sequence), 0) + 1 AS next_sequence FROM events');
   const listEventsStatement = db.prepare(`
     SELECT sequence, id, ts, type, run_id, turn_id, task_id, workspace, origin, payload
     FROM events

package/src/runtime/store.test.js

@@ -1174,3 +1174,25 @@ test('un agent restauré par hydrateSession n’est plus routable tant qu’aucu
     [],
   );
 });
+
+test('a purge never lets the next event reuse a sequence a client may hold as its cursor', () => {
+  // Observed on acpi: after a purge the next run's events took the numbers
+  // just deleted, and a served chat whose cursor stood past them never
+  // received them — it stayed on the failed run while the ShellUI showed done.
+  const stateDir = mkdtempSync(join(tmpdir(), 'wiki-manager-runtime-'));
+  const store = openRuntimeStore({ stateDir });
+  const session = { activities: {}, headlessPlan: null };
+  const persist = () => store.persistEvent(dispatchAgentEvent(session, createAgentEvent('run_started', {
+    origin: 'test', workspace: 'acpi', payload: { input: 'x', workspace: 'acpi' },
+  })));
+  for (let i = 0; i < 5; i += 1) persist();
+  const cursor = Math.max(...store.listEvents().map((e) => e.sequence));
+  store.clearWorkspaceState({ workspace: 'acpi' });
+  const next = persist();
+  assert.ok(next.sequence > cursor, `sequence ${next.sequence} must be past the cursor ${cursor}`);
+  store.close();
+  const reopened = openRuntimeStore({ stateDir });
+  const after = reopened.persistEvent(createAgentEvent('run_started', { origin: 'test', workspace: 'acpi', payload: {} }));
+  assert.ok(after.sequence > next.sequence, 'the high-water mark survives a restart');
+  reopened.close();
+});

package/src/runtime/workspaceIsolation.test.js

@@ -161,18 +161,27 @@ test('every client subscribes with the workspace it is scoped to', () => {
   assert.match(shell, /runtimeStreamAbort\?\.abort\(\);\s*\n\s*syncRuntimeState\(\);\s*\n\s*void subscribeRuntimeEvents\(\);/);
 });
 
-test('locks are per run, so one workspace never blocks another', async () => {
-  // `ingest_apply` est sérialisé par construction. Si le gestionnaire de
-  // verrous était global au processus, deux workspaces ingérant en parallèle
-  // se bloqueraient mutuellement — pas une fuite, mais une contention
-  // invisible et très difficile à diagnostiquer.
-  const { createLockManager } = await import('../orchestrator/lockManager.js');
-  const runA = createLockManager();
-  const runB = createLockManager();
-
-  assert.ok(runA.acquire({ locks: ['ingest_apply'] }));
-  assert.ok(runB.acquire({ locks: ['ingest_apply'] }), 'deux runs distincts ne partagent pas leurs verrous');
+test('locks are per workspace: shared by its runs, never across workspaces', async () => {
+  // `ingest_apply` est sérialisé par construction. Si le registre de verrous
+  // était global au processus, deux workspaces ingérant en parallèle se
+  // bloqueraient mutuellement — une contention invisible. Il est attaché à la
+  // session du workspace : partagé par ses runs et ses actions directes
+  // (plan-demandes-pendant-run.md, lot 2), jamais d'un workspace à l'autre.
+  const { workspaceLockRegistry } = await import('../orchestrator/lockManager.js');
+  const { createAttemptManager } = await import('../orchestrator/attemptManager.js');
+  const acme = { workspace: 'acme' };
+  const juno = { workspace: 'juno' };
+  const manager = (session, owner) => {
+    const registry = workspaceLockRegistry(session);
+    return createAttemptManager({ locks: registry.locks, owners: registry.owners, owner });
+  };
+
+  assert.ok(manager(acme, 'run-a1').reserve({ id: 't1', locks: ['workspace-write'] }));
+  assert.ok(manager(juno, 'run-j1').reserve({ id: 't1', locks: ['workspace-write'] }), 'two workspaces never share their locks');
+  const second = manager(acme, 'run-a2');
+  assert.equal(second.reserve({ id: 't2', locks: ['workspace-write'] }), null, 'two runs of one workspace do');
+  assert.deepEqual(second.foreignHolders({ locks: ['workspace-write'] }), [{ lock: 'workspace-write', owner: 'run-a1' }]);
 
   const runner = readFileSync(new URL('./runner.js', import.meta.url), 'utf8');
-  assert.match(runner, /const attempts = attemptManager \?\? createAttemptManager\(\);/);
+  assert.match(runner, /const lockRegistry = workspaceLockRegistry\(session\);/);
 });