@lmzhen/dsh-evolution-merge 0.39.1 → 0.40.0

package/lib/index.js

@@ -1,8 +1,8 @@
-import { dirname, join } from "node:path";
+import { dirname, isAbsolute, join } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { pairKeyOf, screen, selectCandidates } from "@lmzhen/dsh-evolution-merge-engine";
 import { createUserMessage } from "@deepseek-ai/dsh-llm";
-import { DEFAULT_SKILL_LIMITS, SkillLibrary, UnitTransactions, authorityFrom, contentHash, createSubagentChannel, errorText, evolutionHome, evolutionIoAdapter, executeUnitUndo, isPresent, isProcessAlive, newRunRegistry, newSkillLibrary, parseFrontmatter, planUnitUndoAcross, policyStageLimits, probeAbsent, probeList, probePresent, probeText, probeUnknown, readTreeLock, readUnitEvidence, readUnitJournal, registerOwnerSettings, reportsSweepLockTarget, revisionAnchorOf, revisionFingerprint, revisionSupportDigest, runsFile, scanContentThreats, skillLibraryUnitBackend, supportRefs, sweepReports, transactIo, validateFrontmatter, validateSupportPath } from "@lmzhen/dsh-evolution-core";
+import { DEFAULT_SKILL_LIMITS, LeaseStore, SkillLibrary, UnitTransactions, authorityFrom, contentHash, createSubagentChannel, errorText, evolutionHome, evolutionIoAdapter, executeUnitUndo, isPresent, isProcessAlive, newRunRegistry, newSkillLibrary, parseFrontmatter, planUnitUndoAcross, policyStageLimits, probeAbsent, probeList, probePresent, probeText, probeUnknown, readTreeLock, readUnitEvidence, readUnitJournal, registerOwnerSettings, reportsSweepLockTarget, revisionAnchorOf, revisionFingerprint, revisionSupportDigest, runsFile, scanContentThreats, skillLibraryUnitBackend, supportRefs, sweepReports, transactIo, validateFrontmatter, validateSupportPath } from "@lmzhen/dsh-evolution-core";
 import { HOST_ROUTES, json, methodNotAllowed, registerHostRoutes } from "@lmzhen/dsh-evolution-core/http-routes";
 import { createHash, randomUUID } from "node:crypto";
 import { chmod, mkdir, open, readFile, stat, unlink } from "node:fs/promises";
@@ -1183,60 +1183,64 @@ async function readV4Readiness(io, home) {
 	return await inspect(io, home, parsed.body, parsed.rows);
 }
 /** Atomic readiness + V4 row write under one state-file lock. No production caller in 1b-2a. */
-async function transactMergeState(io, home, fn) {
+async function transactMergeState(io, home, fn, fence) {
 	let result;
-	await transactIo(io, schema4StatePath(home), async (current) => {
-		if (current === null) throw new V4BlockedError(blocked$2("merge-state-v4-required", "schema4 state is missing"));
-		let value;
-		try {
-			value = JSON.parse(current);
-		} catch {
-			throw new V4BlockedError(blocked$2("merge-state-needs-repair", "merge state is not JSON"));
-		}
-		if (!object(value)) throw new V4BlockedError(blocked$2("merge-state-needs-repair", "merge state is not an object"));
-		if (typeof value.schemaVersion === "number" && value.schemaVersion > 4) throw new V4BlockedError(blocked$2("merge-state-forward-only", "state schema " + String(value.schemaVersion) + " is newer than this build"));
-		if (value.schemaVersion === 3) throw new V4BlockedError(blocked$2("merge-state-normalize-required", "schema3 state requires v4 normalize"));
-		if (value.schemaVersion !== 4) throw new V4BlockedError(blocked$2("merge-state-needs-repair", "merge state is not schema4"));
-		const parsed = parse(current);
-		if (parsed === null) throw new V4BlockedError(blocked$2("merge-state-needs-repair", "schema4 state has an invalid row"));
-		const ready = await inspect(io, home, parsed.body, parsed.rows);
-		if (!ready.ok) throw new V4BlockedError(ready);
-		let rows = parsed.rows;
-		const apply = (write) => {
-			const next = applyV4Write(rows, write, (/* @__PURE__ */ new Date()).toISOString());
-			if (next.ok) rows = next.rows;
-			return next;
-		};
-		result = await fn({
-			rows: () => rows,
-			createVerify: (row) => apply({
-				kind: "createVerify",
-				row
-			}),
-			createSkipped: (row) => apply({
-				kind: "createSkipped",
-				row
-			}),
-			transition: (id, event, expectedVersion) => apply({
-				kind: "transition",
-				id,
-				event,
-				expectedVersion
-			}),
-			remove: (id, terminal, unit, expectedVersion) => apply({
-				kind: "remove",
-				id,
-				terminal,
-				...unit === void 0 ? {} : { unit },
-				expectedVersion
-			})
+	const run = async () => {
+		await transactIo(io, schema4StatePath(home), async (current) => {
+			if (current === null) throw new V4BlockedError(blocked$2("merge-state-v4-required", "schema4 state is missing"));
+			let value;
+			try {
+				value = JSON.parse(current);
+			} catch {
+				throw new V4BlockedError(blocked$2("merge-state-needs-repair", "merge state is not JSON"));
+			}
+			if (!object(value)) throw new V4BlockedError(blocked$2("merge-state-needs-repair", "merge state is not an object"));
+			if (typeof value.schemaVersion === "number" && value.schemaVersion > 4) throw new V4BlockedError(blocked$2("merge-state-forward-only", "state schema " + String(value.schemaVersion) + " is newer than this build"));
+			if (value.schemaVersion === 3) throw new V4BlockedError(blocked$2("merge-state-normalize-required", "schema3 state requires v4 normalize"));
+			if (value.schemaVersion !== 4) throw new V4BlockedError(blocked$2("merge-state-needs-repair", "merge state is not schema4"));
+			const parsed = parse(current);
+			if (parsed === null) throw new V4BlockedError(blocked$2("merge-state-needs-repair", "schema4 state has an invalid row"));
+			const ready = await inspect(io, home, parsed.body, parsed.rows);
+			if (!ready.ok) throw new V4BlockedError(ready);
+			let rows = parsed.rows;
+			const apply = (write) => {
+				const next = applyV4Write(rows, write, (/* @__PURE__ */ new Date()).toISOString());
+				if (next.ok) rows = next.rows;
+				return next;
+			};
+			result = await fn({
+				rows: () => rows,
+				createVerify: (row) => apply({
+					kind: "createVerify",
+					row
+				}),
+				createSkipped: (row) => apply({
+					kind: "createSkipped",
+					row
+				}),
+				transition: (id, event, expectedVersion) => apply({
+					kind: "transition",
+					id,
+					event,
+					expectedVersion
+				}),
+				remove: (id, terminal, unit, expectedVersion) => apply({
+					kind: "remove",
+					id,
+					terminal,
+					...unit === void 0 ? {} : { unit },
+					expectedVersion
+				})
+			});
+			return JSON.stringify({
+				...parsed.body,
+				schemaVersion: 4,
+				rows
+			}, null, 2) + "\n";
 		});
-		return JSON.stringify({
-			...parsed.body,
-			schemaVersion: 4,
-			rows
-		}, null, 2) + "\n";
-	});
+	};
+	if (fence !== void 0) await fence.run(run);
+	else await run();
 	if (result === void 0) throw new V4BlockedError(blocked$2("merge-state-needs-repair", "v4 transaction did not produce a result"));
 	return result;
 }
@@ -1804,160 +1808,164 @@ async function readStateReadiness(io, home) {
 	return blocked("merge-state-migration-required", "v2 state requires v3 migration");
 }
 /** One readiness/migration gate; used by startup and every write entry. */
-async function ensureMergeStateReady(io, home) {
+async function ensureMergeStateReady(io, home, fence) {
 	let outcome;
 	let migrated = false;
 	try {
-		await transactIo(io, mergeStatePath$1(home), async (current) => {
-			if (current === null) {
-				outcome = {
-					ok: true,
-					schema: 3,
-					migrated: false,
-					state: {
-						schemaVersion: 3,
-						rows: []
-					},
-					quarantine: [],
-					report: await readReport(io, home)
-				};
-				return null;
-			}
-			const body = parseBody(current);
-			if (body === null) {
-				outcome = blocked("merge-state-needs-repair", "state file is not a JSON object");
-				return current;
-			}
-			const version = body.schemaVersion;
-			if (typeof version === "number" && version > 3) {
-				outcome = blocked("merge-state-forward-only", "state schema " + String(version) + " is newer than this build");
-				return current;
-			}
-			if (version === 3) {
-				const state = v3State(body);
-				if (state === null) {
-					outcome = blocked("merge-state-needs-repair", "v3 state has an invalid row");
+		const run = async () => {
+			await transactIo(io, mergeStatePath$1(home), async (current) => {
+				if (current === null) {
+					outcome = {
+						ok: true,
+						schema: 3,
+						migrated: false,
+						state: {
+							schemaVersion: 3,
+							rows: []
+						},
+						quarantine: [],
+						report: await readReport(io, home)
+					};
+					return null;
+				}
+				const body = parseBody(current);
+				if (body === null) {
+					outcome = blocked("merge-state-needs-repair", "state file is not a JSON object");
 					return current;
 				}
-				const journal = await readJournal$1(io, home);
-				if (journal !== null) {
-					outcome = await completeJournal(io, home, journal, current);
+				const version = body.schemaVersion;
+				if (typeof version === "number" && version > 3) {
+					outcome = blocked("merge-state-forward-only", "state schema " + String(version) + " is newer than this build");
 					return current;
 				}
-				const report = await readReport(io, home);
-				const marker = readMarker(body);
-				if (body.migration !== void 0 && marker === null) {
-					outcome = blocked("merge-state-needs-repair", "migration marker is invalid");
+				if (version === 3) {
+					const state = v3State(body);
+					if (state === null) {
+						outcome = blocked("merge-state-needs-repair", "v3 state has an invalid row");
+						return current;
+					}
+					const journal = await readJournal$1(io, home);
+					if (journal !== null) {
+						outcome = await completeJournal(io, home, journal, current);
+						return current;
+					}
+					const report = await readReport(io, home);
+					const marker = readMarker(body);
+					if (body.migration !== void 0 && marker === null) {
+						outcome = blocked("merge-state-needs-repair", "migration marker is invalid");
+						return current;
+					}
+					if (report !== null && report.ready !== true) {
+						outcome = blocked("merge-state-migration-blocked", "migration report is not ready");
+						return current;
+					}
+					if (marker !== null && rowsSha(state.rows) === marker.targetSha256) {
+						if (report === null) {
+							outcome = blocked("merge-state-migration-blocked", "migration report is missing");
+							return current;
+						}
+						for (const entry of marker.staging) if (!await io.exists(stagingIndexPath(home, entry.rowId))) await writeStagingIndex(io, home, entry);
+					}
+					outcome = {
+						ok: true,
+						schema: 3,
+						migrated: false,
+						state,
+						quarantine: [],
+						report
+					};
 					return current;
 				}
-				if (report !== null && report.ready !== true) {
-					outcome = blocked("merge-state-migration-blocked", "migration report is not ready");
+				const mapped = migrateV2ToV3(body);
+				if (!mapped.ok) {
+					outcome = blocked("merge-state-migration-blocked", mapped.message);
 					return current;
 				}
-				if (marker !== null && rowsSha(state.rows) === marker.targetSha256) {
-					if (report === null) {
-						outcome = blocked("merge-state-migration-blocked", "migration report is missing");
-						return current;
-					}
-					for (const entry of marker.staging) if (!await io.exists(stagingIndexPath(home, entry.rowId))) await writeStagingIndex(io, home, entry);
+				const sourceSha256 = hash(current);
+				const backup = v2BackupPath(home);
+				const existingBackup = await readTextOrNull(io, backup);
+				if (existingBackup !== null && existingBackup !== current) {
+					outcome = blocked("merge-state-migration-blocked", "v2 backup exists with different bytes");
+					return current;
+				}
+				if (existingBackup === null) await transactIo(io, backup, () => current);
+				try {
+					await chmod(backup, 292);
+				} catch {
+					outcome = blocked("merge-state-migration-blocked", "v2 backup is not read-only");
+					return current;
+				}
+				const staging = [];
+				for (const row of body.rows) {
+					if (typeof row.id !== "string" || typeof row.pairKey !== "string" || typeof row.stagingRef !== "string") continue;
+					if (row.state !== "pending" && row.state !== "approved") continue;
+					staging.push({
+						rowId: row.id,
+						pairKey: row.pairKey,
+						ref: row.stagingRef,
+						expiresAt: typeof row.stagingExpiresAt === "number" ? row.stagingExpiresAt : Date.now() + 7 * 864e5,
+						...typeof row.runId === "string" ? { runId: row.runId } : {},
+						createdAt: typeof row.updatedAt === "string" && !Number.isNaN(Date.parse(row.updatedAt)) ? Date.parse(row.updatedAt) : Date.now()
+					});
 				}
+				const marker = {
+					migratedFromV2: true,
+					sourceSha256,
+					targetSha256: rowsSha(mapped.state.rows),
+					staging,
+					at: now()
+				};
+				const targetText = json$1({
+					...mapped.state,
+					migration: marker
+				});
+				const targetSha256 = hash(targetText);
+				const journal = {
+					version: 1,
+					sourceSha256,
+					targetSha256,
+					rows: mapped.state.rows.length,
+					quarantine: mapped.quarantine,
+					staging,
+					backupPath: backup,
+					at: now()
+				};
+				await transactIo(io, migrationJournalPath(home), () => json$1(journal));
+				for (const entry of staging) await writeStagingIndex(io, home, entry);
+				if (mapped.quarantine.length > 0) await transactIo(io, quarantinePath(home), () => json$1(mapped.quarantine));
+				const prepared = {
+					version: 1,
+					ready: false,
+					migrated: true,
+					sourceSha256,
+					targetSha256,
+					rows: mapped.state.rows.length,
+					quarantined: mapped.quarantine.length,
+					backupReadOnly: true,
+					at: now(),
+					steps: [
+						"backup",
+						"journal",
+						"staging-index",
+						"quarantine",
+						"v3-write"
+					]
+				};
+				await writeReport(io, home, prepared);
+				migrated = true;
 				outcome = {
 					ok: true,
 					schema: 3,
-					migrated: false,
-					state,
-					quarantine: [],
-					report
+					migrated: true,
+					state: mapped.state,
+					quarantine: mapped.quarantine,
+					report: prepared
 				};
-				return current;
-			}
-			const mapped = migrateV2ToV3(body);
-			if (!mapped.ok) {
-				outcome = blocked("merge-state-migration-blocked", mapped.message);
-				return current;
-			}
-			const sourceSha256 = hash(current);
-			const backup = v2BackupPath(home);
-			const existingBackup = await readTextOrNull(io, backup);
-			if (existingBackup !== null && existingBackup !== current) {
-				outcome = blocked("merge-state-migration-blocked", "v2 backup exists with different bytes");
-				return current;
-			}
-			if (existingBackup === null) await transactIo(io, backup, () => current);
-			try {
-				await chmod(backup, 292);
-			} catch {
-				outcome = blocked("merge-state-migration-blocked", "v2 backup is not read-only");
-				return current;
-			}
-			const staging = [];
-			for (const row of body.rows) {
-				if (typeof row.id !== "string" || typeof row.pairKey !== "string" || typeof row.stagingRef !== "string") continue;
-				if (row.state !== "pending" && row.state !== "approved") continue;
-				staging.push({
-					rowId: row.id,
-					pairKey: row.pairKey,
-					ref: row.stagingRef,
-					expiresAt: typeof row.stagingExpiresAt === "number" ? row.stagingExpiresAt : Date.now() + 7 * 864e5,
-					...typeof row.runId === "string" ? { runId: row.runId } : {},
-					createdAt: typeof row.updatedAt === "string" && !Number.isNaN(Date.parse(row.updatedAt)) ? Date.parse(row.updatedAt) : Date.now()
-				});
-			}
-			const marker = {
-				migratedFromV2: true,
-				sourceSha256,
-				targetSha256: rowsSha(mapped.state.rows),
-				staging,
-				at: now()
-			};
-			const targetText = json$1({
-				...mapped.state,
-				migration: marker
+				return targetText;
 			});
-			const targetSha256 = hash(targetText);
-			const journal = {
-				version: 1,
-				sourceSha256,
-				targetSha256,
-				rows: mapped.state.rows.length,
-				quarantine: mapped.quarantine,
-				staging,
-				backupPath: backup,
-				at: now()
-			};
-			await transactIo(io, migrationJournalPath(home), () => json$1(journal));
-			for (const entry of staging) await writeStagingIndex(io, home, entry);
-			if (mapped.quarantine.length > 0) await transactIo(io, quarantinePath(home), () => json$1(mapped.quarantine));
-			const prepared = {
-				version: 1,
-				ready: false,
-				migrated: true,
-				sourceSha256,
-				targetSha256,
-				rows: mapped.state.rows.length,
-				quarantined: mapped.quarantine.length,
-				backupReadOnly: true,
-				at: now(),
-				steps: [
-					"backup",
-					"journal",
-					"staging-index",
-					"quarantine",
-					"v3-write"
-				]
-			};
-			await writeReport(io, home, prepared);
-			migrated = true;
-			outcome = {
-				ok: true,
-				schema: 3,
-				migrated: true,
-				state: mapped.state,
-				quarantine: mapped.quarantine,
-				report: prepared
-			};
-			return targetText;
-		});
+		};
+		if (fence !== void 0) await fence.run(run);
+		else await run();
 	} catch (error) {
 		return blocked("merge-state-migration-blocked", "state migration failed: " + (error instanceof Error ? error.message : String(error)));
 	}
@@ -2304,11 +2312,22 @@ async function presentStage(io, home, entry) {
 		state: "present"
 	});
 }
+function safeRunTree(home, ref) {
+	const name = ref.trim();
+	if (name === "" || name.includes("\\") || isAbsolute(name)) return null;
+	const parts = name.split("/");
+	if (parts.some((part) => part === "" || part === "." || part === "..")) return null;
+	return join(home, "merge", "runs", ...parts);
+}
 async function dropStage(io, home, rowId, ref, onError) {
 	const index = join(home, "merge", "staging-index", encodeURIComponent(rowId) + ".json");
 	await io.remove(index).catch((error) => onError?.(index, error));
 	if (ref !== void 0 && ref !== "") {
-		const tree = join(home, "merge", "runs", ref);
+		const tree = safeRunTree(home, ref);
+		if (tree === null) {
+			onError?.(join(home, "merge", "runs"), /* @__PURE__ */ new Error("invalid staging ref: " + JSON.stringify(ref)));
+			return;
+		}
 		await io.remove(tree).catch((error) => onError?.(tree, error));
 	}
 }
@@ -2374,7 +2393,12 @@ async function cleanupStage(io, home, now, rows, limit = 100) {
 	for (const run of runNames.slice(0, limit)) {
 		const prefix = run + "/";
 		if ([...refs].some((ref) => ref === run || ref.startsWith(prefix))) continue;
-		await io.remove(join(runRoot, run)).catch((error) => fail(join(runRoot, run), error));
+		const tree = safeRunTree(home, run);
+		if (tree === null) {
+			fail(join(runRoot, run), /* @__PURE__ */ new Error("invalid run dir name: " + JSON.stringify(run)));
+			continue;
+		}
+		await io.remove(tree).catch((error) => fail(tree, error));
 		orphans.push(run);
 	}
 	return {
@@ -2421,7 +2445,7 @@ async function readPairLedger(io, home) {
 	};
 }
 /** 1b-2a write skeleton. Production stays on the v3 gate until 1b-2b. */
-function pairLedger(io, home) {
+function pairLedger(io, home, fence) {
 	return {
 		read: () => readPairLedger(io, home),
 		transact: async (fn) => {
@@ -2429,7 +2453,7 @@ function pairLedger(io, home) {
 				const normalized = await normalizePairLedger(io, home);
 				if (!normalized.ok) throw new Error(normalized.message ?? "normalize failed");
 			}
-			return await transactMergeState(io, home, fn);
+			return await transactMergeState(io, home, fn, fence);
 		},
 		normalize: () => normalizePairLedger(io, home)
 	};
@@ -2572,8 +2596,39 @@ async function recordPair(io, home, entry) {
 function runMetaPath(home, runId) {
 	return join(home, "merge", "run-meta", encodeURIComponent(runId) + ".json");
 }
-async function writeRunMeta(io, home, meta) {
-	await transactIo(io, runMetaPath(home, meta.runId), () => JSON.stringify(meta, null, 2) + "\n");
+async function writeRunMeta(io, home, meta, fence) {
+	if (meta.revision !== void 0) {
+		const currentRevision = (await readRunMeta(io, home, meta.runId))?.revision ?? 0;
+		if (currentRevision !== meta.revision) throw new Error("run-meta revision conflict: expected " + String(meta.revision) + ", found " + String(currentRevision));
+	}
+	const write = async () => {
+		await transactIo(io, runMetaPath(home, meta.runId), (current) => {
+			let next = meta;
+			let previousRevision = 0;
+			if (current !== null) try {
+				const prev = JSON.parse(current);
+				previousRevision = typeof prev.revision === "number" ? prev.revision : 0;
+				if (meta.revision !== void 0 && meta.revision !== previousRevision) throw new Error("run-meta revision conflict: expected " + String(meta.revision) + ", found " + String(previousRevision));
+				if (prev.degraded === true) next = {
+					...next,
+					degraded: true
+				};
+				const terminal = prev.phase === "settled" || prev.phase === "cancelled" || prev.phase === "undone";
+				const undoFromSettled = prev.phase === "settled" && next.phase === "undone";
+				if (terminal && next.phase !== prev.phase && !undoFromSettled) next = {
+					...next,
+					phase: prev.phase,
+					...prev.stopReason === void 0 ? {} : { stopReason: prev.stopReason }
+				};
+			} catch {}
+			return JSON.stringify({
+				...next,
+				revision: previousRevision + 1
+			}, null, 2) + "\n";
+		});
+	};
+	if (fence !== void 0) await fence.run(write);
+	else await write();
 }
 async function readRunMeta(io, home, runId) {
 	const raw = await readTextOrNull(io, runMetaPath(home, runId));
@@ -3087,6 +3142,7 @@ function releaseClaim(current, token) {
 //#region lib/types/target-claim.js
 /** Durable target claim: one approve writer per merge target at a time. */
 const PROCESS_STARTED_AT = Date.now() - process.uptime() * 1e3;
+const TARGET_CLAIM_TTL_MS = 30 * 6e4;
 function claimPath(home, target) {
 	return join(home, "merge", "claims", contentHash(target) + ".json");
 }
@@ -3105,20 +3161,26 @@ function parseClaim(raw) {
 async function withGuard(path, fn) {
 	const guard = path + ".guard";
 	await mkdir(dirname(path), { recursive: true });
-	for (let attempt = 0; attempt < 500; attempt += 1) try {
-		const handle = await open(guard, "wx");
-		await handle.writeFile(String(process.pid));
-		await handle.close();
+	for (let attempt = 0; attempt < 500; attempt += 1) {
+		let handle;
 		try {
-			return await fn();
-		} finally {
-			await unlink(guard).catch(() => {});
+			handle = await open(guard, "wx");
+			await handle.writeFile(String(process.pid));
+			await handle.close();
+			handle = void 0;
+			try {
+				return await fn();
+			} finally {
+				await unlink(guard).catch(() => {});
+			}
+		} catch (error) {
+			await handle?.close().catch(() => {});
+			if (error.code !== "EEXIST") await unlink(guard).catch(() => {});
+			if (error.code !== "EEXIST") throw error;
+			const pid = Number(await readFile(guard, "utf8").catch(() => ""));
+			if (Number.isFinite(pid) && pid > 0 && !isProcessAlive(pid)) await unlink(guard).catch(() => {});
+			await new Promise((resolve) => setTimeout(resolve, 10));
 		}
-	} catch (error) {
-		if (error.code !== "EEXIST") throw error;
-		const pid = Number(await readFile(guard, "utf8").catch(() => ""));
-		if (Number.isFinite(pid) && pid > 0 && !isProcessAlive(pid)) await unlink(guard).catch(() => {});
-		await new Promise((resolve) => setTimeout(resolve, 10));
 	}
 	throw new Error("target-claim-guard-timeout");
 }
@@ -3149,7 +3211,7 @@ async function acquireTargetClaim(io, home, target, now) {
 	let granted;
 	await compareAndSwap(io, path, (raw) => {
 		const current = parseClaim(raw);
-		const claim = acquireClaim(current !== void 0 && current.pid === process.pid && current.startedAt !== void 0 && Math.abs(current.startedAt - PROCESS_STARTED_AT) > 1e3 || current !== void 0 && current.expiresAt > now && current.pid !== void 0 && current.pid !== process.pid && !isProcessAlive(current.pid) ? void 0 : current, now, Number.MAX_SAFE_INTEGER, token, process.pid, PROCESS_STARTED_AT);
+		const claim = acquireClaim(current !== void 0 && current.pid === process.pid && current.startedAt !== void 0 && Math.abs(current.startedAt - PROCESS_STARTED_AT) > 1e3 || current !== void 0 && current.expiresAt > now && current.pid !== void 0 && current.pid !== process.pid && !isProcessAlive(current.pid) ? void 0 : current, now, TARGET_CLAIM_TTL_MS, token, process.pid, PROCESS_STARTED_AT);
 		if (claim === void 0) return raw;
 		granted = claim;
 		return JSON.stringify(claim) + "\n";
@@ -6230,31 +6292,42 @@ async function withMergeRun(options) {
 		...options.parentRunId === void 0 ? {} : { parentRunId: options.parentRunId }
 	});
 	const startedAt = handle.startedAt;
+	const writeMeta = async (meta) => {
+		await writeRunMeta(options.io, options.home, meta, options.fence);
+	};
 	const stage = (name, progress) => options.registry.stage(handle.id, name, progress);
-	await stage("screening", options.total === void 0 ? void 0 : {
-		done: 0,
-		total: options.total
-	});
-	await writeRunMeta(options.io, options.home, {
-		version: 1,
-		runId: handle.id,
-		pid: process.pid,
-		...options.parentRunId === void 0 ? {} : { parentRunId: options.parentRunId },
-		...options.pairKey === void 0 ? {} : { pairKey: options.pairKey },
-		...options.stagingRef === void 0 ? {} : { stagingRef: options.stagingRef },
-		...options.pairKey === void 0 ? {} : { pairs: [{
-			pairKey: options.pairKey,
-			state: "pending"
-		}] },
-		pairCount: options.pairCount ?? (options.pairKey === void 0 ? 0 : 1),
-		phase: "running",
-		approval: options.approval.mergeApproval ? "pending" : "approved",
-		createdAt: new Date(startedAt).toISOString(),
-		updatedAt: new Date(options.now()).toISOString()
-	});
+	try {
+		await stage("screening", options.total === void 0 ? void 0 : {
+			done: 0,
+			total: options.total
+		});
+		await writeMeta({
+			version: 1,
+			runId: handle.id,
+			pid: process.pid,
+			...options.parentRunId === void 0 ? {} : { parentRunId: options.parentRunId },
+			...options.pairKey === void 0 ? {} : { pairKey: options.pairKey },
+			...options.stagingRef === void 0 ? {} : { stagingRef: options.stagingRef },
+			...options.pairKey === void 0 ? {} : { pairs: [{
+				pairKey: options.pairKey,
+				state: "pending"
+			}] },
+			pairCount: options.pairCount ?? (options.pairKey === void 0 ? 0 : 1),
+			phase: "running",
+			approval: options.approval.mergeApproval ? "pending" : "approved",
+			createdAt: new Date(startedAt).toISOString(),
+			updatedAt: new Date(options.now()).toISOString()
+		});
+	} catch (error) {
+		await options.registry.settle(handle.id, {
+			state: "failed",
+			failure: "merge run failed before body: " + (error instanceof Error ? error.message : String(error))
+		}).catch(() => {});
+		throw error;
+	}
 	const writeFailureMeta = async (stopReason) => {
 		try {
-			await writeRunMeta(options.io, options.home, {
+			await writeMeta({
 				version: 1,
 				runId: handle.id,
 				pid: process.pid,
@@ -6308,13 +6381,23 @@ async function withMergeRun(options) {
 					timedOut = true;
 					let drainTimer;
 					const drained = await Promise.race([bodyOutcome, new Promise((resolve) => {
-						drainTimer = setTimeout(() => resolve({ kind: "drain-timeout" }), DETACHED_DRAIN_MS);
+						drainTimer = setTimeout(() => resolve({ kind: "drain-timeout" }), options.drainMs ?? DETACHED_DRAIN_MS);
 					})]);
 					if (drainTimer !== void 0) clearTimeout(drainTimer);
-					outcome = drained.kind === "drain-timeout" ? {
-						kind: "error",
-						error: /* @__PURE__ */ new Error("timeout: body did not stop within 30s drain window")
-					} : drained;
+					if (drained.kind === "drain-timeout") {
+						await options.registry.settle(handle.id, {
+							state: "failed",
+							failure: "timeout: body did not stop within 30s drain window"
+						}).catch((error) => {
+							(options.warn ?? ((message) => {
+								console.warn(message);
+							}))("evolution-merge: drain-timeout settle failed for " + handle.id + ": " + (error instanceof Error ? error.message : String(error)));
+						});
+						outcome = {
+							kind: "error",
+							error: /* @__PURE__ */ new Error("timeout: body did not stop within 30s drain window")
+						};
+					} else outcome = drained;
 				}
 			}
 			draft = outcome.kind === "draft" ? outcome.value : emptyDraft("run body failed: " + (outcome.error instanceof Error ? outcome.error.message : String(outcome.error)));
@@ -6398,10 +6481,12 @@ async function withMergeRun(options) {
 			pairKey: options.pairKey,
 			state: "pending"
 		}];
-		await writeRunMeta(options.io, options.home, {
+		const currentMeta = await readRunMeta(options.io, options.home, handle.id);
+		await writeMeta({
 			version: 1,
 			runId: handle.id,
 			pid: process.pid,
+			...currentMeta?.revision === void 0 ? {} : { revision: currentMeta.revision },
 			...options.parentRunId === void 0 ? {} : { parentRunId: options.parentRunId },
 			...options.pairKey === void 0 ? {} : { pairKey: options.pairKey },
 			...options.stagingRef === void 0 ? {} : { stagingRef: options.stagingRef },
@@ -6428,7 +6513,11 @@ async function withMergeRun(options) {
 		};
 	};
 	if (options.detached === true) {
-		finish().catch(() => {});
+		finish().catch((error) => {
+			(options.warn ?? ((message) => {
+				console.warn(message);
+			}))("evolution-merge: detached run " + handle.id + " finish failed: " + (error instanceof Error ? error.message : String(error)));
+		});
 		return {
 			ok: true,
 			accepted: true,
@@ -6444,6 +6533,7 @@ async function runScanCommand(options) {
 		io: options.io,
 		home: options.home,
 		registry: options.registry,
+		...options.fence === void 0 ? {} : { fence: options.fence },
 		command: "scan",
 		approval: {
 			platformWrite: options.platformWrite,
@@ -6476,8 +6566,8 @@ async function runScanCommand(options) {
 }
 //#endregion
 //#region lib/types/pending-actions.js
-async function act(io, home, now, id, type) {
-	return await pairLedger(io, home).transact((tx) => {
+async function act(io, home, now, id, type, fence) {
+	return await pairLedger(io, home, fence).transact((tx) => {
 		const row = tx.rows().find((item) => item.id === id);
 		if (row === void 0) return {
 			ok: false,
@@ -6519,24 +6609,36 @@ async function act(io, home, now, id, type) {
 		};
 	});
 }
-async function approvePending(io, home, now, id) {
-	return await act(io, home, now, id, "approve");
+async function approvePending(io, home, now, id, fence) {
+	return await act(io, home, now, id, "approve", fence);
 }
-async function rejectPending(io, home, now, id) {
-	return await act(io, home, now, id, "reject");
+async function rejectPending(io, home, now, id, fence) {
+	return await act(io, home, now, id, "reject", fence);
 }
 //#endregion
 //#region lib/types/domain/row-run.js
 /** Attach the in-flight child run to a row before its round2 starts (P1-8). */
-async function attachRunToRow(io, home, rowId, runId) {
-	if (!await pairLedger(io, home).transact((tx) => {
-		const current = tx.rows().find((row) => row.id === rowId);
-		if (current === void 0) return false;
-		return tx.transition(rowId, {
-			type: "run-attached",
-			runId
-		}, current.version).ok;
-	})) throw new Error("row is not attachable to run: " + rowId);
+async function attachRunToRow(io, home, rowId, runId, isActive, fence) {
+	const leaseStore = new LeaseStore({
+		io,
+		home,
+		ttlMs: 3e4
+	});
+	const lease = await leaseStore.acquire("foreground", "row-attach:" + rowId);
+	if (!lease.ok) throw new Error("row attach is busy: " + rowId);
+	try {
+		if (!await pairLedger(io, home, fence).transact(async (tx) => {
+			const current = tx.rows().find((row) => row.id === rowId);
+			if (current === void 0) return false;
+			if (current.runId !== void 0 && current.runId !== runId && await isActive?.(current.runId) === true) return false;
+			return tx.transition(rowId, {
+				type: "run-attached",
+				runId
+			}, current.version).ok;
+		})) throw new Error("row is not attachable to run: " + rowId);
+	} finally {
+		await leaseStore.release(lease.token);
+	}
 }
 //#endregion
 //#region lib/types/domain/failure-route.js
@@ -6555,7 +6657,7 @@ function casExpiredHook(code) {
 }
 //#endregion
 //#region lib/types/round2-outcome.js
-async function recordRound2Outcome(io, home, now, row, outcome, deferProjection = false) {
+async function recordRound2Outcome(io, home, now, row, outcome, deferProjection = false, fence) {
 	const reportExtra = {
 		...outcome.manifestFiles === void 0 ? {} : { manifestFiles: outcome.manifestFiles },
 		...outcome.criteria === void 0 ? {} : { criteria: outcome.criteria },
@@ -6568,7 +6670,7 @@ async function recordRound2Outcome(io, home, now, row, outcome, deferProjection
 		};
 		const target = outcome.target?.actual ?? outcome.target?.requested ?? row.decision?.target;
 		const finalize = async () => {
-			if (!(await pairLedger(io, home).transact((tx) => {
+			if (!(await pairLedger(io, home, fence).transact((tx) => {
 				const current = tx.rows().find((item) => item.id === row.id);
 				return current === void 0 ? {
 					ok: false,
@@ -6632,7 +6734,7 @@ async function recordRound2Outcome(io, home, now, row, outcome, deferProjection
 	};
 	if (failure.code === "merge-over-limit" || failure.code === "limit") {
 		const reason = "merge-over-limit";
-		if (await pairLedger(io, home).transact((tx) => {
+		if (await pairLedger(io, home, fence).transact((tx) => {
 			const current = tx.rows().find((item) => item.id === row.id);
 			return current === void 0 ? false : tx.transition(row.id, {
 				type: "skipped",
@@ -6665,7 +6767,7 @@ async function recordRound2Outcome(io, home, now, row, outcome, deferProjection
 			retryable: false,
 			retryFrom: "none"
 		};
-		await pairLedger(io, home).transact((tx) => {
+		await pairLedger(io, home, fence).transact((tx) => {
 			const current = tx.rows().find((item) => item.id === row.id);
 			if (current === void 0) return false;
 			return tx.transition(row.id, {
@@ -6691,7 +6793,7 @@ async function recordRound2Outcome(io, home, now, row, outcome, deferProjection
 		};
 	}
 	if (failure.code === "commit-failed" || failure.code === "validation-failed") {
-		if (await pairLedger(io, home).transact((tx) => {
+		if (await pairLedger(io, home, fence).transact((tx) => {
 			const current = tx.rows().find((item) => item.id === row.id);
 			return current === void 0 ? false : tx.remove(row.id, "superseded", void 0, current.version).ok;
 		})) {
@@ -6705,7 +6807,7 @@ async function recordRound2Outcome(io, home, now, row, outcome, deferProjection
 		}
 	}
 	if (failure.code === "source-gone") {
-		if (await pairLedger(io, home).transact((tx) => {
+		if (await pairLedger(io, home, fence).transact((tx) => {
 			const current = tx.rows().find((item) => item.id === row.id);
 			return current === void 0 ? false : tx.remove(row.id, "superseded", void 0, current.version).ok;
 		})) await dropStage(io, home, row.id, row.stagingRef);
@@ -6723,7 +6825,7 @@ async function recordRound2Outcome(io, home, now, row, outcome, deferProjection
 			}
 		};
 	}
-	if (await pairLedger(io, home).transact((tx) => {
+	if (await pairLedger(io, home, fence).transact((tx) => {
 		const current = tx.rows().find((item) => item.id === row.id);
 		if (current === void 0) return null;
 		const moved = tx.transition(row.id, {
@@ -6784,7 +6886,7 @@ async function runApproveCommand(options) {
 	if (options.agentless === true) return failure("approve", "e-305", errorText("e-305-this-invocation-carries-no", { a1: "approve" }), "在 GUI 或 CLI 的会话里运行 /evolution merge approve " + before.id);
 	const parentRunId = options.parentRunId ?? before.runId;
 	if (parentRunId === void 0) return failure("approve", "merge-parent-required", "缺 parent run id（E-305 提示：该行可能由无会话调用创建，或父 run 已丢失）", "在 agent 会话中执行 /evolution merge approve " + before.id, before.runId);
-	const taken = await approvePending(options.io, options.home, options.now, options.rowId);
+	const taken = await approvePending(options.io, options.home, options.now, options.rowId, options.fence);
 	if (!taken.ok) return failure("approve", "approve-" + taken.reason, taken.message, "重试；若行状态已变化，运行 /evolution merge status " + options.rowId, before.runId);
 	let row = taken.row;
 	const decision = row.decision;
@@ -6792,7 +6894,7 @@ async function runApproveCommand(options) {
 	if (options.ports.stage !== void 0) {
 		const staged = await options.ports.stage(row, decision);
 		if (!staged.ok) return failure("approve", "stage-failed", staged.message, "检查暂存目录后重试；不影响已记录的决策", row.runId);
-		const fused = await pairLedger(options.io, options.home).transact((tx) => {
+		const fused = await pairLedger(options.io, options.home, options.fence).transact((tx) => {
 			const current = tx.rows().find((item) => item.id === row.id);
 			if (current === void 0) return null;
 			const moved = tx.transition(row.id, {
@@ -6810,6 +6912,7 @@ async function runApproveCommand(options) {
 		io: options.io,
 		home: options.home,
 		registry: options.registry,
+		...options.fence === void 0 ? {} : { fence: options.fence },
 		command: "approve",
 		approval: {
 			platformWrite: options.platformWrite,
@@ -6821,7 +6924,7 @@ async function runApproveCommand(options) {
 		now: options.now,
 		...options.detached === true ? { detached: true } : {},
 		async body(ctx) {
-			await attachRunToRow(options.io, options.home, row.id, ctx.runId);
+			await attachRunToRow(options.io, options.home, row.id, ctx.runId, options.isOwnerActive, options.fence);
 			const stage = (name) => ctx.stage(name, {
 				done: 0,
 				total: 1
@@ -6854,7 +6957,7 @@ async function runApproveCommand(options) {
 				},
 				notes: []
 			};
-			const record = await recordRound2Outcome(options.io, options.home, options.now, row, outcome, true);
+			const record = await recordRound2Outcome(options.io, options.home, options.now, row, outcome, true, options.fence);
 			return {
 				...base,
 				stopReason: record.merged ? "completed" : "failed",
@@ -6891,6 +6994,7 @@ async function runResumeCommand(options) {
 			io: options.io,
 			home: options.home,
 			registry: options.registry,
+			...options.fence === void 0 ? {} : { fence: options.fence },
 			approval: options.approval,
 			platformWrite: options.platformWrite,
 			now: options.now,
@@ -6926,7 +7030,7 @@ async function runResumeCommand(options) {
 	if (selected.state === "approved" && options.ports.stage !== void 0) {
 		const staged = await options.ports.stage(selected, decision);
 		if (!staged.ok) return failure("resume", "stage-failed", staged.message, "检查暂存目录后重试；不影响已记录的决策", selected.runId);
-		const fused = await pairLedger(options.io, options.home).transact((tx) => {
+		const fused = await pairLedger(options.io, options.home, options.fence).transact((tx) => {
 			const current = tx.rows().find((item) => item.id === selected.id);
 			if (current === void 0) return null;
 			const moved = tx.transition(selected.id, {
@@ -6955,7 +7059,7 @@ async function runResumeCommand(options) {
 		now: options.now,
 		...options.detached === true ? { detached: true } : {},
 		async body(ctx) {
-			await attachRunToRow(options.io, options.home, row.id, ctx.runId);
+			await attachRunToRow(options.io, options.home, row.id, ctx.runId, options.isOwnerActive, options.fence);
 			await ctx.stage("author", {
 				done: 0,
 				total: 1
@@ -6975,7 +7079,7 @@ async function runResumeCommand(options) {
 					}
 				};
 			}
-			const record = await recordRound2Outcome(options.io, options.home, options.now, row, outcome, true);
+			const record = await recordRound2Outcome(options.io, options.home, options.now, row, outcome, true, options.fence);
 			return {
 				stopReason: record.merged ? "completed" : "failed",
 				scope: {
@@ -9229,7 +9333,7 @@ async function hostOnlyFailure(verb, capabilities) {
 * same-target run would collide with (the pair itself is guarded by run-meta).
 */
 function busyTarget(rows, target, excludeRowId) {
-	const row = rows.find((item) => item.id !== excludeRowId && (item.state === "approved" || item.state === "fuse") && item.decision?.target === target);
+	const row = rows.find((item) => item.id !== excludeRowId && (item.state === "approved" || item.state === "fuse") && item.decision?.target === target && !(item.failure !== void 0 && item.failure.retryable !== true));
 	return row === void 0 ? void 0 : {
 		id: row.id,
 		...row.runId === void 0 ? {} : { runId: row.runId }
@@ -9249,8 +9353,8 @@ function forcedDecisionFor(a, b) {
 		bSummary: "B: " + sorted[1] + " 的现有技能面。"
 	};
 }
-async function removeRuntimeRow(io, home, id, event, unitId) {
-	return await pairLedger(io, home).transact((tx) => {
+async function removeRuntimeRow(io, home, id, event, unitId, fence) {
+	return await pairLedger(io, home, fence).transact((tx) => {
 		const current = tx.rows().find((item) => item.id === id);
 		if (current === void 0) return false;
 		const unit = event === "committed" ? {
@@ -9272,6 +9376,7 @@ function unitFor(deps) {
 	});
 }
 function createMergeRuntime(deps) {
+	const ledger = () => pairLedger(deps.io, deps.home, deps.fence);
 	const readOnly = createReadOnlyMergeService(deps.io, deps.home);
 	const timeout = deps.timeoutMinutes > 0 ? deps.timeoutMinutes : void 0;
 	const paramsOf = () => {
@@ -9288,6 +9393,7 @@ function createMergeRuntime(deps) {
 		now: deps.now,
 		...deps.model === void 0 ? {} : { model: deps.model },
 		...deps.isOwnerActive === void 0 ? {} : { isOwnerActive: deps.isOwnerActive },
+		...deps.fence === void 0 ? {} : { fence: deps.fence },
 		...timeout === void 0 ? {} : { timeoutMinutes: timeout }
 	});
 	const stage = deps.stage;
@@ -9336,7 +9442,7 @@ function createMergeRuntime(deps) {
 			const existing = (await loadMergeState(deps.io, deps.home)).state.rows.find((row) => row.pairKey === pairKey(command.a, command.b));
 			let cleared = false;
 			if (existing?.state === "skipped" || existing?.state === "fuse" && existing.failure?.retryable === false) {
-				if (!await removeRuntimeRow(deps.io, deps.home, existing.id, "superseded")) return fail("pair", "row-changed", "清理可替换行时发现并发修改：" + existing.id, "运行 /evolution merge status 后重试");
+				if (!await removeRuntimeRow(deps.io, deps.home, existing.id, "superseded", void 0, deps.fence)) return fail("pair", "row-changed", "清理可替换行时发现并发修改：" + existing.id, "运行 /evolution merge status 后重试");
 				cleared = true;
 			}
 			if (existing?.state === "verify" && existing.runId !== void 0 && await deps.isOwnerActive?.(existing.runId) === true) return fail("pair", "merge-pair-in-flight", "同一 pair 已在运行 " + existing.runId, "等待该 run 结束，或运行 /evolution merge status " + existing.runId, existing.runId);
@@ -9511,7 +9617,7 @@ function createMergeRuntime(deps) {
 		if (command.verb === "reject") {
 			const row = (await loadMergeState(deps.io, deps.home)).state.rows.find((item) => item.id === command.id);
 			if (row === void 0) return fail("reject", "row-not-found", "找不到合并行 " + command.id, "运行 /evolution merge pending 查看待处理行", command.id);
-			if (!await pairLedger(deps.io, deps.home).transact((tx) => {
+			if (!await ledger().transact((tx) => {
 				const current = tx.rows().find((item) => item.id === row.id);
 				if (current === void 0 || current.state !== "pending") return false;
 				return tx.transition(row.id, {
@@ -9593,7 +9699,7 @@ function createMergeRuntime(deps) {
 			const row = (await loadMergeState(deps.io, deps.home)).state.rows.find((item) => item.id === command.id);
 			if (row === void 0) return fail("discard", "row-not-found", "找不到合并行 " + command.id, "运行 /evolution merge status 查看当前队列", command.id);
 			if (row.state !== "pending" && row.state !== "approved" && row.state !== "fuse") return fail("discard", "row-not-discardable", "该行状态是 " + row.state + "，不可丢弃：" + command.id, "只有 pending/approved/fuse 行可丢弃", row.runId);
-			if (!await removeRuntimeRow(deps.io, deps.home, row.id, "superseded")) return fail("discard", "row-changed", "丢弃时发现并发修改：" + command.id, "运行 /evolution merge status " + command.id + " 后重试");
+			if (!await removeRuntimeRow(deps.io, deps.home, row.id, "superseded", void 0, deps.fence)) return fail("discard", "row-changed", "丢弃时发现并发修改：" + command.id, "运行 /evolution merge status " + command.id + " 后重试");
 			return {
 				ok: true,
 				text: "已丢弃合并行：" + command.id
@@ -9612,6 +9718,7 @@ function createMergeRuntime(deps) {
 				port: skillLibraryUndoPort(deps.skills),
 				now: deps.now,
 				target: command.target,
+				...deps.fence === void 0 ? {} : { fence: deps.fence },
 				...unit === void 0 ? {} : { finalizeUnit: (id) => unit.finalize.call(unit, id) }
 			});
 			return result.ok ? {
@@ -9622,7 +9729,7 @@ function createMergeRuntime(deps) {
 		if (command.verb === "skipped" && command.restore !== void 0) {
 			const row = (await loadMergeState(deps.io, deps.home)).state.rows.find((item) => item.id === command.restore);
 			if (row === void 0 || row.state !== "skipped") return fail("skipped", "row-not-found", "找不到可恢复的 skipped 行：" + command.restore, "运行 /evolution merge skipped 查看跳过队列", command.restore);
-			if (!await removeRuntimeRow(deps.io, deps.home, row.id, "restored")) return fail("skipped", "row-changed", "恢复时发现并发修改：" + row.id, "运行 /evolution merge status 后重试");
+			if (!await removeRuntimeRow(deps.io, deps.home, row.id, "restored", void 0, deps.fence)) return fail("skipped", "row-changed", "恢复时发现并发修改：" + row.id, "运行 /evolution merge status 后重试");
 			return {
 				ok: true,
 				text: "已恢复参与筛选：" + row.id
@@ -9632,7 +9739,7 @@ function createMergeRuntime(deps) {
 			if (command.clear !== void 0) {
 				const cleared = (await loadMergeState(deps.io, deps.home)).state.rows.find((item) => item.id === command.clear);
 				if (cleared === void 0) return fail("resume", "row-not-found", "找不到要清除的行：" + command.clear, "运行 /evolution merge status 查看当前队列");
-				if (!await removeRuntimeRow(deps.io, deps.home, cleared.id, "superseded")) return fail("resume", "row-changed", "清除时发现并发修改：" + cleared.id, "运行 /evolution merge status 后重试");
+				if (!await removeRuntimeRow(deps.io, deps.home, cleared.id, "superseded", void 0, deps.fence)) return fail("resume", "row-changed", "清除时发现并发修改：" + cleared.id, "运行 /evolution merge status 后重试");
 				return {
 					ok: true,
 					text: "已清除合并行：" + cleared.id
@@ -9753,12 +9860,12 @@ function createMergeRuntime(deps) {
 				if (targetCardNow !== void 0 && (targetCardNow.protectionUnknown === true || targetCardNow.protectedBy != null)) return fail("approve", "target-protected", "目标技能「" + target + "」在决策后变为受保护，拒绝提交", "解除保护或改选其它目标", candidate.runId);
 				const missingSource = [candidate.a, candidate.b].find((name) => !cards.some((card) => card.name === name && card.managed === true));
 				if (missingSource !== void 0) {
-					if (!await removeRuntimeRow(deps.io, deps.home, candidate.id, "superseded")) return fail("approve", "row-changed", "source-gone，但行已被并发修改，未清理：" + candidate.id, "运行 /evolution merge status " + candidate.id + " 后重试");
+					if (!await removeRuntimeRow(deps.io, deps.home, candidate.id, "superseded", void 0, deps.fence)) return fail("approve", "row-changed", "source-gone，但行已被并发修改，未清理：" + candidate.id, "运行 /evolution merge status " + candidate.id + " 后重试");
 					return fail("approve", "source-gone", missingSource + " 已不在 family-managed 技能库，已从 active 队列清除", "重新 pair 该技能对；剩余行用 /evolution merge discard " + candidate.id, candidate.runId);
 				}
 				const sourceExpected = candidate.decision?.sourceRevisionRef ?? candidate.sourceRevisionRef;
 				if (revisionMismatch(candidate.decision?.targetRevisionRef ?? candidate.targetRevisionRef, targetRevisionRefOf(cards, candidate.decision.target)) !== null) {
-					await pairLedger(deps.io, deps.home).transact((tx) => {
+					await ledger().transact((tx) => {
 						const current = tx.rows().find((item) => item.id === candidate.id);
 						return current === void 0 ? false : tx.transition(candidate.id, {
 							type: "expired",
@@ -9772,7 +9879,7 @@ function createMergeRuntime(deps) {
 					candidate.a,
 					candidate.b
 				])) {
-					await pairLedger(deps.io, deps.home).transact((tx) => {
+					await ledger().transact((tx) => {
 						const current = tx.rows().find((item) => item.id === candidate.id);
 						return current === void 0 ? false : tx.transition(candidate.id, {
 							type: "expired",
@@ -9782,7 +9889,7 @@ function createMergeRuntime(deps) {
 					return fail("approve", "source-changed", "源技能内容在决策后变化，拒绝照跑", "重新 pair，或 /evolution merge discard " + candidate.id, candidate.runId);
 				}
 				if (revisionMismatch(sourceExpected, sourceRevisionRefOf(cards, candidate.a, candidate.b)) !== null) {
-					await pairLedger(deps.io, deps.home).transact((tx) => {
+					await ledger().transact((tx) => {
 						const current = tx.rows().find((item) => item.id === candidate.id);
 						return current === void 0 ? false : tx.transition(candidate.id, {
 							type: "expired",
@@ -9793,7 +9900,7 @@ function createMergeRuntime(deps) {
 				}
 				const currentRevision = sourceRevisionOf(cards, candidate.a, candidate.b);
 				if (candidate.sourceRevision !== void 0 && currentRevision !== void 0 && currentRevision !== candidate.sourceRevision) {
-					if (!await pairLedger(deps.io, deps.home).transact((tx) => {
+					if (!await ledger().transact((tx) => {
 						const current = tx.rows().find((item) => item.id === candidate.id);
 						return current === void 0 ? false : tx.transition(candidate.id, {
 							type: "expired",
@@ -9804,7 +9911,7 @@ function createMergeRuntime(deps) {
 				}
 				const currentTargetRevision = targetRevisionOf(cards, candidate.decision.target);
 				if (candidate.targetRevision !== void 0 && currentTargetRevision !== void 0 && currentTargetRevision !== candidate.targetRevision) {
-					if (!await pairLedger(deps.io, deps.home).transact((tx) => {
+					if (!await ledger().transact((tx) => {
 						const current = tx.rows().find((item) => item.id === candidate.id);
 						return current === void 0 ? false : tx.transition(candidate.id, {
 							type: "expired",
@@ -9820,7 +9927,7 @@ function createMergeRuntime(deps) {
 					if (await deps.isBlocked?.(candidate.decision.target) === true) return fail("approve", "target-blocked", "target 被范围门拦下：" + candidate.decision.target, "运行 /evolution scope 查看范围门", candidate.runId);
 				}
 				if (candidate.decision.mode === "merge-into-existing" && !cards.some((card) => card.name === candidate.decision?.target)) {
-					if (!await pairLedger(deps.io, deps.home).transact((tx) => {
+					if (!await ledger().transact((tx) => {
 						const current = tx.rows().find((item) => item.id === candidate.id);
 						return current === void 0 ? false : tx.transition(candidate.id, {
 							type: "expired",
@@ -10487,6 +10594,7 @@ async function runPairCommand(options) {
 		io: options.io,
 		home: options.home,
 		registry: options.registry,
+		...options.fence === void 0 ? {} : { fence: options.fence },
 		approval: options.approval,
 		platformWrite: options.platformWrite,
 		now: options.now,
@@ -10614,7 +10722,7 @@ function apply(ctx, rawConfig = {}) {
 				quarantine: [],
 				report: null
 			};
-			const state = await ensureMergeStateReady(io, home);
+			const state = await ensureMergeStateReady(io, home, ctx.get("evolutionMutationAuthority")?.homeFence);
 			if (!state.ok) return v4.code === "merge-state-forward-only" || v4.code === "merge-state-needs-repair" ? {
 				ok: false,
 				code: v4.code,
@@ -10631,12 +10739,14 @@ function apply(ctx, rawConfig = {}) {
 			code: "merge-state-migration-blocked",
 			message: error instanceof Error ? error.message : String(error)
 		}));
+		const homeFence = ctx.get("evolutionMutationAuthority")?.homeFence;
 		const runs = newRunRegistry({
 			io,
 			home,
 			warn: (message) => {
 				ctx.logger.warn(message);
-			}
+			},
+			...homeFence === void 0 ? {} : { fence: homeFence }
 		});
 		ctx.effect(() => {
 			const host = ctx;
@@ -10655,11 +10765,13 @@ function apply(ctx, rawConfig = {}) {
 			limitsSnapshot,
 			platformWrite: getPlatformWrite()
 		});
+		const mutationAuthority = ctx.get("evolutionMutationAuthority");
 		const skills = newSkillLibrary({
 			io,
 			ctx,
 			authority: authorityFrom({ origin: "subagent" }),
-			limits: limitsSnapshot.skillLimits
+			limits: limitsSnapshot.skillLimits,
+			...mutationAuthority?.mutationLock === void 0 ? {} : { mutationLock: mutationAuthority.mutationLock }
 		});
 		ready.then((value) => {
 			if (!value.ok) {
@@ -10671,18 +10783,22 @@ function apply(ctx, rawConfig = {}) {
 				home,
 				backend: skillLibraryUnitBackend(skills),
 				claim: targetClaimUnitPort(io, home, () => Date.now()),
-				now: () => Date.now()
+				now: () => Date.now(),
+				isActive: async (runId) => await runs.hasOwner(runId),
+				...mutationAuthority?.homeFence === void 0 ? {} : { fence: mutationAuthority.homeFence }
 			});
 			const cards = async () => await readSkillCards(skills);
 			(async () => {
 				const loaded = await runs.load();
 				if (!loaded.ok) ctx.logger.warn("merge run index: " + (loaded.note ?? "unreadable"));
+				const activeRuns = /* @__PURE__ */ new Set();
+				for (const record of runs.runs().filter((record) => record.state === "running")) if (await runs.hasOwner(record.id)) activeRuns.add(record.id);
 				const reports = await recoverCommitUnits({
 					io,
 					home,
 					unit,
 					now: () => Date.now(),
-					isActive: () => false,
+					isActive: (runId) => activeRuns.has(runId),
 					runs
 				});
 				if (reports.length > 0) ctx.logger.info("merge unit recovery: " + reports.map((report) => report.runId + "/" + report.unitId + "=" + report.action).join(", "));
@@ -10888,6 +11004,7 @@ function apply(ctx, rawConfig = {}) {
 			now: () => Date.now(),
 			getParams,
 			getPlatformWrite,
+			...mutationAuthority?.homeFence === void 0 ? {} : { fence: mutationAuthority.homeFence },
 			...defaultModel === void 0 ? {} : { model: defaultModel.currentSelection().model },
 			channel,
 			parent: void 0,
@@ -10952,4 +11069,4 @@ function apply(ctx, rawConfig = {}) {
 	});
 }
 //#endregion
-export { Config, MERGE_DOCTOR_SCHEMA_VERSION, MERGE_LIFECYCLE_VERBS, MERGE_MAX_ATTEMPTS, MERGE_PAIR_STATES, MERGE_PARAM_DEFAULTS, MERGE_PROMPT_VERSION, MERGE_QUEUES, MERGE_ROUTES, MERGE_STAGE_TOOL_NAME, MERGE_STATE_VERSION, STAGING_SCHEMA_VERSION, STANDBY_PROMPT, StageToolRegistry, apply, applyStageTool, approvePending, assembleStagedCommit, buildCommitPlan, buildRound1Prompt, buildRound2Prompt, buildStandbyPrompt, canRetry, cleanupExpiredStaging, commitReceiptPath, commitStagedRun, committedPairs, configureMergePresentation, copyStagedFile, countRows, createChannelScanPorts, createEngineRunner, createEngineScreening, createMergeCommand, createMergeRuntime, createMergeStageTool, createNewChildRound2, createReadOnlyMergeService, createStageForCards, createStaging, dropRow, dropRowV3, dropStaging, durableReceiptDir, durableReceiptPath, emptyMergeState, engineConfigFromRoot, ensureStaging, forcedDecisionFor, formatFacts, formatQueue, formatRunDetail, formatRunsView, formatSnapshotQueue, formatSnapshotStatus, formatStatus, handleReadOnlyMergeCommand, hasBlockingFinding, inject, isSkippedPair, listStagedFiles, liveRowFactsOf, loadMergeState, loadStateSchema, makeMergeRoutes, manifestFilesOf, mergeCommandHelp, mergeDoctor, mergeDoctorAvailability, mergeDoctorFact, mergeReportDigestPath, mergeReportPath, mergeRunIdsToSupersede, mergeStatePath, mergeUsage, missingManifestFile, moveRow, mutateMergeState, pairKey, parseAuthoringManifest, parseDecision, parseMergeCommand, pendingExpiry, persistedExpiry, promptHashOf, queueOf, readCommitReceipt, readCommitReceipts, readMergeReport, readStagedFile, readStagedTree, readStaging, recordRound2Outcome, rejectPending, resolveMergeParams, resolveTargetName, retryMergeReport, rewriteFrontmatterName, rowIdOf, rowsOf, runApproveCommand, runAuthoring, runMergeCommand, runNewChildAuthoring, runPairCommand, runResumeCommand, runRound1OverChannel, runScan, runScanCommand, setStagingTarget, skillLibraryPort, skillLibraryUndoPort, skippedPairKeys, snapshotCards, sourceBlock, stageKeyOf, stageOf, stagingRoot, subagentChannelAdapter, supersedeMergeRuns, transactRows, transitionLegacyForProjection, undoMergeReceipt, unitFor, upsertRow, validateStagedTree, withMergeRun, writeCommitReceipt, writeMergeReport, writeStagedFile };
+export { Config, MERGE_DOCTOR_SCHEMA_VERSION, MERGE_LIFECYCLE_VERBS, MERGE_MAX_ATTEMPTS, MERGE_PAIR_STATES, MERGE_PARAM_DEFAULTS, MERGE_PROMPT_VERSION, MERGE_QUEUES, MERGE_ROUTES, MERGE_STAGE_TOOL_NAME, MERGE_STATE_VERSION, STAGING_SCHEMA_VERSION, STANDBY_PROMPT, StageToolRegistry, apply, applyStageTool, approvePending, assembleStagedCommit, buildCommitPlan, buildRound1Prompt, buildRound2Prompt, buildStandbyPrompt, busyTarget, canRetry, cleanupExpiredStaging, commitReceiptPath, commitStagedRun, committedPairs, configureMergePresentation, copyStagedFile, countRows, createChannelScanPorts, createEngineRunner, createEngineScreening, createMergeCommand, createMergeRuntime, createMergeStageTool, createNewChildRound2, createReadOnlyMergeService, createStageForCards, createStaging, dropRow, dropRowV3, dropStaging, durableReceiptDir, durableReceiptPath, emptyMergeState, engineConfigFromRoot, ensureStaging, forcedDecisionFor, formatFacts, formatQueue, formatRunDetail, formatRunsView, formatSnapshotQueue, formatSnapshotStatus, formatStatus, handleReadOnlyMergeCommand, hasBlockingFinding, inject, isSkippedPair, listStagedFiles, liveRowFactsOf, loadMergeState, loadStateSchema, makeMergeRoutes, manifestFilesOf, mergeCommandHelp, mergeDoctor, mergeDoctorAvailability, mergeDoctorFact, mergeReportDigestPath, mergeReportPath, mergeRunIdsToSupersede, mergeStatePath, mergeUsage, missingManifestFile, moveRow, mutateMergeState, pairKey, parseAuthoringManifest, parseDecision, parseMergeCommand, pendingExpiry, persistedExpiry, promptHashOf, queueOf, readCommitReceipt, readCommitReceipts, readMergeReport, readStagedFile, readStagedTree, readStaging, recordRound2Outcome, rejectPending, resolveMergeParams, resolveTargetName, retryMergeReport, rewriteFrontmatterName, rowIdOf, rowsOf, runApproveCommand, runAuthoring, runMergeCommand, runNewChildAuthoring, runPairCommand, runResumeCommand, runRound1OverChannel, runScan, runScanCommand, setStagingTarget, skillLibraryPort, skillLibraryUndoPort, skippedPairKeys, snapshotCards, sourceBlock, stageKeyOf, stageOf, stagingRoot, subagentChannelAdapter, supersedeMergeRuns, transactRows, transitionLegacyForProjection, undoMergeReceipt, unitFor, upsertRow, validateStagedTree, withMergeRun, writeCommitReceipt, writeMergeReport, writeStagedFile };