@lmzhen/dsh-evolution-merge 0.39.2 → 0.40.0

package/lib/types/index.js

@@ -178,13 +178,14 @@ export function apply(ctx, rawConfig = {}) {
                 const loaded = await loadMergeState(io, home);
                 return { ok: true, schema: 3, migrated: false, state: { schemaVersion: 3, rows: loaded.state.rows.map(legacyToV3).filter((row) => row !== null) }, quarantine: [], report: null };
             }
-            const state = await ensureMergeStateReady(io, home);
+            const state = await ensureMergeStateReady(io, home, ctx.get('evolutionMutationAuthority')?.homeFence);
             if (!state.ok)
                 return v4.code === 'merge-state-forward-only' || v4.code === 'merge-state-needs-repair' ? { ok: false, code: v4.code, message: v4.message } : state;
             const normalized = await normalizePairLedger(io, home);
             return normalized.ok ? state : { ok: false, code: 'merge-state-needs-repair', message: normalized.message ?? 'v4 normalize failed' };
         })().catch(error => ({ ok: false, code: 'merge-state-migration-blocked', message: error instanceof Error ? error.message : String(error) }));
-        const runs = newRunRegistry({ io, home, warn: (message) => { ctx.logger.warn(message); } });
+        const homeFence = ctx.get('evolutionMutationAuthority')?.homeFence;
+        const runs = newRunRegistry({ io, home, warn: (message) => { ctx.logger.warn(message); }, ...(homeFence === undefined ? {} : { fence: homeFence }) });
         ctx.effect(() => {
             const host = ctx;
             if (typeof host.on !== 'function')
@@ -201,16 +202,18 @@ export function apply(ctx, rawConfig = {}) {
             return typeof hostApproval?.platformWrite === 'boolean' ? hostApproval.platformWrite : (resolveMergeParams(rawConfig).platformWrite ?? false);
         };
         const getParams = () => ({ ...resolveMergeParams(rawConfig), limitsSnapshot, platformWrite: getPlatformWrite() });
+        const mutationAuthority = ctx.get('evolutionMutationAuthority');
         const skills = newSkillLibrary({
             io, ctx, authority: authorityFrom({ origin: 'subagent' }),
             limits: limitsSnapshot.skillLimits,
+            ...(mutationAuthority?.mutationLock === undefined ? {} : { mutationLock: mutationAuthority.mutationLock }),
         });
         void ready.then(value => {
             if (!value.ok) {
                 ctx.logger.warn('merge state is not ready: ' + value.code + ': ' + value.message);
                 return;
             }
-            const unit = new UnitTransactions({ io, home, backend: skillLibraryUnitBackend(skills), claim: targetClaimUnitPort(io, home, () => Date.now()), now: () => Date.now() });
+            const unit = new UnitTransactions({ io, home, backend: skillLibraryUnitBackend(skills), claim: targetClaimUnitPort(io, home, () => Date.now()), now: () => Date.now(), isActive: async (runId) => await runs.hasOwner(runId), ...(mutationAuthority?.homeFence === undefined ? {} : { fence: mutationAuthority.homeFence }) });
             const cards = async () => await readSkillCards(skills);
             void (async () => {
                 // NFR-05: load the shared run index BEFORE recovery. Recovery settles through the
@@ -219,7 +222,12 @@ export function apply(ctx, rawConfig = {}) {
                 const loaded = await runs.load();
                 if (!loaded.ok)
                     ctx.logger.warn('merge run index: ' + (loaded.note ?? 'unreadable'));
-                const reports = await recoverCommitUnits({ io, home, unit, now: () => Date.now(), isActive: () => false, runs });
+                const activeRuns = new Set();
+                for (const record of runs.runs().filter(record => record.state === 'running')) {
+                    if (await runs.hasOwner(record.id))
+                        activeRuns.add(record.id);
+                }
+                const reports = await recoverCommitUnits({ io, home, unit, now: () => Date.now(), isActive: (runId) => activeRuns.has(runId), runs });
                 if (reports.length > 0)
                     ctx.logger.info('merge unit recovery: ' + reports.map(report => report.runId + '/' + report.unitId + '=' + report.action).join(', '));
                 const v4 = await readV4Readiness(io, home);
@@ -341,6 +349,7 @@ export function apply(ctx, rawConfig = {}) {
             return;
         const runtime = createMergeRuntime({
             io, home, registry: runs, skills, now: () => Date.now(), getParams, getPlatformWrite,
+            ...(mutationAuthority?.homeFence === undefined ? {} : { fence: mutationAuthority.homeFence }),
             ...(defaultModel === undefined ? {} : { model: defaultModel.currentSelection().model }),
             channel, parent: undefined, allow: ['merge_stage'], timeoutMinutes: startupParams.mergeRunTimeoutMinutes,
             hostCapabilities,

package/lib/types/pair-command.d.ts

@@ -6,6 +6,9 @@ import type { ScanPorts } from './scan-run.ts';
 import type { MergeRegistryPort, WithMergeRunResult } from './run-shell.ts';
 export interface RunPairCommandOptions {
     readonly io: EvolutionIoLike;
+    readonly fence?: {
+        run<T>(body: () => Promise<T>): Promise<T>;
+    };
     readonly home: string;
     readonly registry: MergeRegistryPort;
     readonly ports: ScanPorts;

package/lib/types/pair-command.js

@@ -4,6 +4,7 @@ export async function runPairCommand(options) {
         io: options.io,
         home: options.home,
         registry: options.registry,
+        ...(options.fence === undefined ? {} : { fence: options.fence }),
         approval: options.approval,
         platformWrite: options.platformWrite,
         now: options.now,

package/lib/types/pending-actions.d.ts

@@ -12,6 +12,10 @@ export type PendingActionResult = {
     readonly reason: 'not-found' | 'not-pending' | 'invalid' | 'expired';
     readonly message: string;
 };
-export declare function approvePending(io: EvolutionIoLike, home: string, now: () => number, id: string): Promise<PendingActionResult>;
-export declare function rejectPending(io: EvolutionIoLike, home: string, now: () => number, id: string): Promise<PendingActionResult>;
+export declare function approvePending(io: EvolutionIoLike, home: string, now: () => number, id: string, fence?: {
+    run<T>(body: () => Promise<T>): Promise<T>;
+}): Promise<PendingActionResult>;
+export declare function rejectPending(io: EvolutionIoLike, home: string, now: () => number, id: string, fence?: {
+    run<T>(body: () => Promise<T>): Promise<T>;
+}): Promise<PendingActionResult>;
 //# sourceMappingURL=pending-actions.d.ts.map

package/lib/types/pending-actions.js

@@ -1,8 +1,8 @@
 import { v4ToLegacy } from "./domain/row-v4.js";
 import { pairLedger } from "./domain/pair-ledger.js";
-async function act(io, home, now, id, type) {
+async function act(io, home, now, id, type, fence) {
     void now;
-    return await pairLedger(io, home).transact(tx => {
+    return await pairLedger(io, home, fence).transact(tx => {
         const row = tx.rows().find(item => item.id === id);
         if (row === undefined)
             return { ok: false, reason: 'not-found', message: 'pending row not found: ' + id };
@@ -23,10 +23,10 @@ async function act(io, home, now, id, type) {
         return { ok: true, row: v4ToLegacy(moved.row) };
     });
 }
-export async function approvePending(io, home, now, id) {
-    return await act(io, home, now, id, 'approve');
+export async function approvePending(io, home, now, id, fence) {
+    return await act(io, home, now, id, 'approve', fence);
 }
-export async function rejectPending(io, home, now, id) {
-    return await act(io, home, now, id, 'reject');
+export async function rejectPending(io, home, now, id, fence) {
+    return await act(io, home, now, id, 'reject', fence);
 }
 //# sourceMappingURL=pending-actions.js.map

package/lib/types/resume-command.d.ts

@@ -8,6 +8,9 @@ import type { ScanPorts, ScanRound2Outcome } from './scan-run.ts';
 import type { MergeDecision, MergeRow } from './contracts.ts';
 export interface RunResumeCommandOptions {
     readonly io: EvolutionIoLike;
+    readonly fence?: {
+        run<T>(body: () => Promise<T>): Promise<T>;
+    };
     readonly home: string;
     readonly registry: MergeRegistryPort;
     readonly ports: ScanPorts;

package/lib/types/resume-command.js

@@ -23,7 +23,7 @@ export async function runResumeCommand(options) {
             return failure('resume', 'run-owns-row', '该 verify 行仍由运行中的 run 持有：' + row.runId, '等待该 run 结束，或运行 /evolution merge cancel ' + row.runId, row.runId);
         }
         return await runScanCommand({
-            io: options.io, home: options.home, registry: options.registry,
+            io: options.io, home: options.home, registry: options.registry, ...(options.fence === undefined ? {} : { fence: options.fence }),
             approval: options.approval, platformWrite: options.platformWrite, now: options.now,
             ...(options.detached === true ? { detached: true } : {}),
             ...(options.makePorts === undefined
@@ -57,7 +57,7 @@ export async function runResumeCommand(options) {
         const staged = await options.ports.stage(selected, decision);
         if (!staged.ok)
             return failure('resume', 'stage-failed', staged.message, '检查暂存目录后重试；不影响已记录的决策', selected.runId);
-        const fused = await pairLedger(options.io, options.home).transact(tx => {
+        const fused = await pairLedger(options.io, options.home, options.fence).transact(tx => {
             const current = tx.rows().find(item => item.id === selected.id);
             if (current === undefined)
                 return null;
@@ -76,7 +76,7 @@ export async function runResumeCommand(options) {
         parentRunId, now: options.now,
         ...(options.detached === true ? { detached: true } : {}),
         async body(ctx) {
-            await attachRunToRow(options.io, options.home, row.id, ctx.runId);
+            await attachRunToRow(options.io, options.home, row.id, ctx.runId, options.isOwnerActive, options.fence);
             await ctx.stage('author', { done: 0, total: 1 });
             let outcome;
             try {
@@ -87,7 +87,7 @@ export async function runResumeCommand(options) {
             catch (error) {
                 outcome = { kind: 'failed', failure: { stage: 'author', code: 'merge-failed', message: error instanceof Error ? error.message : String(error), retryable: true, retryFrom: 'agent2' } };
             }
-            const record = await recordRound2Outcome(options.io, options.home, options.now, row, outcome, true);
+            const record = await recordRound2Outcome(options.io, options.home, options.now, row, outcome, true, options.fence);
             return {
                 stopReason: record.merged ? 'completed' : 'failed',
                 scope: { candidatePairs: 1, queueBefore: { verify: 0, pending: 0, fuse: 1, skipped: 0 } },

package/lib/types/round2-outcome.d.ts

@@ -10,5 +10,7 @@ export interface Round2Record {
     readonly merged: boolean;
     readonly finalize?: () => Promise<void>;
 }
-export declare function recordRound2Outcome(io: EvolutionIoLike, home: string, now: () => number, row: MergeRow, outcome: ScanRound2Outcome, deferProjection?: boolean): Promise<Round2Record>;
+export declare function recordRound2Outcome(io: EvolutionIoLike, home: string, now: () => number, row: MergeRow, outcome: ScanRound2Outcome, deferProjection?: boolean, fence?: {
+    run<T>(body: () => Promise<T>): Promise<T>;
+}): Promise<Round2Record>;
 //# sourceMappingURL=round2-outcome.d.ts.map

package/lib/types/round2-outcome.js

@@ -3,7 +3,7 @@ import { pairLedger } from "./domain/pair-ledger.js";
 import { dropStage } from "./domain/stage-aggregate.js";
 import { casExpiredHook } from "./domain/failure-route.js";
 import { recordPair } from "./domain/run-coordinator.js";
-export async function recordRound2Outcome(io, home, now, row, outcome, deferProjection = false) {
+export async function recordRound2Outcome(io, home, now, row, outcome, deferProjection = false, fence) {
     void now;
     const reportExtra = {
         ...(outcome.manifestFiles === undefined ? {} : { manifestFiles: outcome.manifestFiles }),
@@ -14,7 +14,7 @@ export async function recordRound2Outcome(io, home, now, row, outcome, deferProj
         const unitRef = { unitId: outcome.unitId ?? 'unknown', evidenceSha256: outcome.evidenceSha256 ?? 'unknown' };
         const target = outcome.target?.actual ?? outcome.target?.requested ?? row.decision?.target;
         const finalize = async () => {
-            const removed = await pairLedger(io, home).transact(tx => {
+            const removed = await pairLedger(io, home, fence).transact(tx => {
                 const current = tx.rows().find(item => item.id === row.id);
                 return current === undefined ? { ok: false, code: 'row-not-found', message: 'row not found' } : tx.remove(row.id, 'committed', unitRef, current.version);
             });
@@ -51,7 +51,7 @@ export async function recordRound2Outcome(io, home, now, row, outcome, deferProj
     const failure = outcome.failure ?? { stage: 'author', code: 'merge-failed', message: 'round2 failed', retryable: true, retryFrom: 'agent2' };
     if (failure.code === 'merge-over-limit' || failure.code === 'limit') {
         const reason = 'merge-over-limit';
-        const skipped = await pairLedger(io, home).transact(tx => {
+        const skipped = await pairLedger(io, home, fence).transact(tx => {
             const current = tx.rows().find(item => item.id === row.id);
             return current === undefined ? false : tx.transition(row.id, { type: 'skipped', reason, origin: 'system', skipSource: 'system' }, current.version).ok;
         });
@@ -62,7 +62,7 @@ export async function recordRound2Outcome(io, home, now, row, outcome, deferProj
     const cas = casExpiredHook(failure.code);
     if (cas !== null) {
         const terminalFailure = { ...failure, code: cas.reason, retryable: false, retryFrom: 'none' };
-        await pairLedger(io, home).transact(tx => {
+        await pairLedger(io, home, fence).transact(tx => {
             const current = tx.rows().find(item => item.id === row.id);
             if (current === undefined)
                 return false;
@@ -75,7 +75,7 @@ export async function recordRound2Outcome(io, home, now, row, outcome, deferProj
     if (failure.code === 'commit-failed' || failure.code === 'validation-failed') {
         // FR-EXEC-11/14: report-only failure. The pair leaves the active queue (so a later scan
         // can evaluate it again); it is NOT written to skipped.
-        const dropped = await pairLedger(io, home).transact(tx => {
+        const dropped = await pairLedger(io, home, fence).transact(tx => {
             const current = tx.rows().find(item => item.id === row.id);
             return current === undefined ? false : tx.remove(row.id, 'superseded', undefined, current.version).ok;
         });
@@ -85,7 +85,7 @@ export async function recordRound2Outcome(io, home, now, row, outcome, deferProj
         }
     }
     if (failure.code === 'source-gone') {
-        const dropped = await pairLedger(io, home).transact(tx => {
+        const dropped = await pairLedger(io, home, fence).transact(tx => {
             const current = tx.rows().find(item => item.id === row.id);
             return current === undefined ? false : tx.remove(row.id, 'superseded', undefined, current.version).ok;
         });
@@ -93,7 +93,7 @@ export async function recordRound2Outcome(io, home, now, row, outcome, deferProj
             await dropStage(io, home, row.id, row.stagingRef);
         return { merged: false, pair: { id: row.id, pairKey: row.pairKey, a: row.a, b: row.b, queue: row.queue, outcome: 'failed', archived: [], failure } };
     }
-    const projected = await pairLedger(io, home).transact(tx => {
+    const projected = await pairLedger(io, home, fence).transact(tx => {
         const current = tx.rows().find(item => item.id === row.id);
         if (current === undefined)
             return null;

package/lib/types/run-shell.d.ts

@@ -64,6 +64,14 @@ export interface WithMergeRunOptions {
     readonly parentRunId?: string;
     readonly detached?: boolean;
     readonly timeoutMinutes?: number;
+    /** Drain budget after abort; tests may shrink it. Defaults to 30s. */
+    readonly drainMs?: number;
+    /** Observability for a detached finish failure; defaults to console.warn. */
+    readonly warn?: (message: string) => void;
+    /** Optional authority fence for run metadata writes. */
+    readonly fence?: {
+        run<T>(body: () => Promise<T>): Promise<T>;
+    };
     readonly body: (ctx: MergeRunBodyContext) => Promise<MergeRunReportDraft>;
 }
 export type WithMergeRunResult = {

package/lib/types/run-shell.js

@@ -1,5 +1,5 @@
 import { writeMergeReport } from "./report.js";
-import { writeRunMeta } from "./domain/run-coordinator.js";
+import { readRunMeta, writeRunMeta } from "./domain/run-coordinator.js";
 /** Bounded wait for a detached body before the run is reported as timed out. */
 const DETACHED_DRAIN_MS = 30_000;
 function emptyDraft(reason) {
@@ -21,21 +21,32 @@ export async function withMergeRun(options) {
         ...(options.parentRunId === undefined ? {} : { parentRunId: options.parentRunId }),
     });
     const startedAt = handle.startedAt;
+    const writeMeta = async (meta) => { await writeRunMeta(options.io, options.home, meta, options.fence); };
     const stage = (name, progress) => options.registry.stage(handle.id, name, progress);
-    await stage('screening', options.total === undefined ? undefined : { done: 0, total: options.total });
-    await writeRunMeta(options.io, options.home, {
-        version: 1, runId: handle.id, pid: process.pid,
-        ...(options.parentRunId === undefined ? {} : { parentRunId: options.parentRunId }),
-        ...(options.pairKey === undefined ? {} : { pairKey: options.pairKey }),
-        ...(options.stagingRef === undefined ? {} : { stagingRef: options.stagingRef }),
-        ...(options.pairKey === undefined ? {} : { pairs: [{ pairKey: options.pairKey, state: 'pending' }] }),
-        pairCount: options.pairCount ?? (options.pairKey === undefined ? 0 : 1),
-        phase: 'running', approval: options.approval.mergeApproval ? 'pending' : 'approved',
-        createdAt: new Date(startedAt).toISOString(), updatedAt: new Date(options.now()).toISOString(),
-    });
+    try {
+        await stage('screening', options.total === undefined ? undefined : { done: 0, total: options.total });
+        await writeMeta({
+            version: 1, runId: handle.id, pid: process.pid,
+            ...(options.parentRunId === undefined ? {} : { parentRunId: options.parentRunId }),
+            ...(options.pairKey === undefined ? {} : { pairKey: options.pairKey }),
+            ...(options.stagingRef === undefined ? {} : { stagingRef: options.stagingRef }),
+            ...(options.pairKey === undefined ? {} : { pairs: [{ pairKey: options.pairKey, state: 'pending' }] }),
+            pairCount: options.pairCount ?? (options.pairKey === undefined ? 0 : 1),
+            phase: 'running', approval: options.approval.mergeApproval ? 'pending' : 'approved',
+            createdAt: new Date(startedAt).toISOString(), updatedAt: new Date(options.now()).toISOString(),
+        });
+    }
+    catch (error) {
+        // P1-1: begin() succeeded, so a staging/meta failure must still settle the run.
+        await options.registry.settle(handle.id, {
+            state: 'failed',
+            failure: 'merge run failed before body: ' + (error instanceof Error ? error.message : String(error)),
+        }).catch(() => { });
+        throw error;
+    }
     const writeFailureMeta = async (stopReason) => {
         try {
-            await writeRunMeta(options.io, options.home, {
+            await writeMeta({
                 version: 1, runId: handle.id, pid: process.pid,
                 ...(options.parentRunId === undefined ? {} : { parentRunId: options.parentRunId }),
                 ...(options.pairKey === undefined ? {} : { pairKey: options.pairKey }),
@@ -80,13 +91,20 @@ export async function withMergeRun(options) {
                     let drainTimer;
                     const drained = await Promise.race([
                         bodyOutcome,
-                        new Promise(resolve => { drainTimer = setTimeout(() => resolve({ kind: 'drain-timeout' }), DETACHED_DRAIN_MS); }),
+                        new Promise(resolve => { drainTimer = setTimeout(() => resolve({ kind: 'drain-timeout' }), options.drainMs ?? DETACHED_DRAIN_MS); }),
                     ]);
                     if (drainTimer !== undefined)
                         clearTimeout(drainTimer);
-                    outcome = drained.kind === 'drain-timeout'
-                        ? { kind: 'error', error: new Error('timeout: body did not stop within 30s drain window') }
-                        : drained;
+                    if (drained.kind === 'drain-timeout') {
+                        // P1-2: the body ignored abort. Close the run now so its stage/registry
+                        // writes stop; the report below records the timeout.
+                        await options.registry.settle(handle.id, { state: 'failed', failure: 'timeout: body did not stop within 30s drain window' }).catch(error => {
+                            (options.warn ?? ((message) => { console.warn(message); }))('evolution-merge: drain-timeout settle failed for ' + handle.id + ': ' + (error instanceof Error ? error.message : String(error)));
+                        });
+                        outcome = { kind: 'error', error: new Error('timeout: body did not stop within 30s drain window') };
+                    }
+                    else
+                        outcome = drained;
                 }
             }
             draft = outcome.kind === 'draft'
@@ -157,13 +175,17 @@ export async function withMergeRun(options) {
         const finalPairs = draft.pairs.length > 0
             ? draft.pairs.map(pair => ({ pairKey: pair.pairKey, state: pair.outcome === 'merged' ? 'fused' : pair.outcome === 'pending' ? 'pending' : 'skipped' }))
             : options.pairKey === undefined ? [] : [{ pairKey: options.pairKey, state: 'pending' }];
-        await writeRunMeta(options.io, options.home, { version: 1, runId: handle.id, pid: process.pid, ...(options.parentRunId === undefined ? {} : { parentRunId: options.parentRunId }), ...(options.pairKey === undefined ? {} : { pairKey: options.pairKey }), ...(options.stagingRef === undefined ? {} : { stagingRef: options.stagingRef }), ...(finalPairs.length === 0 ? {} : { pairs: finalPairs }), pairCount: options.pairCount ?? (options.pairKey === undefined ? 0 : 1), phase: awaiting ? 'awaiting-approval' : 'settled', approval: awaiting ? 'pending' : 'approved', stopReason: report.stopReason, reportRef: reportPath, createdAt: new Date(startedAt).toISOString(), updatedAt: new Date(options.now()).toISOString() });
+        const currentMeta = await readRunMeta(options.io, options.home, handle.id);
+        await writeMeta({ version: 1, runId: handle.id, pid: process.pid, ...(currentMeta?.revision === undefined ? {} : { revision: currentMeta.revision }), ...(options.parentRunId === undefined ? {} : { parentRunId: options.parentRunId }), ...(options.pairKey === undefined ? {} : { pairKey: options.pairKey }), ...(options.stagingRef === undefined ? {} : { stagingRef: options.stagingRef }), ...(finalPairs.length === 0 ? {} : { pairs: finalPairs }), pairCount: options.pairCount ?? (options.pairKey === undefined ? 0 : 1), phase: awaiting ? 'awaiting-approval' : 'settled', approval: awaiting ? 'pending' : 'approved', stopReason: report.stopReason, reportRef: reportPath, createdAt: new Date(startedAt).toISOString(), updatedAt: new Date(options.now()).toISOString() });
         if (report.stopReason === 'completed')
             return { ok: true, runId: handle.id, reportPath, report };
         return { ok: false, runId: handle.id, message: 'merge ' + report.stopReason, reportPath };
     };
     if (options.detached === true) {
-        void finish().catch(() => { });
+        void finish().catch((error) => {
+            const warn = options.warn ?? ((message) => { console.warn(message); });
+            warn('evolution-merge: detached run ' + handle.id + ' finish failed: ' + (error instanceof Error ? error.message : String(error)));
+        });
         return { ok: true, accepted: true, runId: handle.id };
     }
     return await finish();

package/lib/types/runtime.d.ts

@@ -1,5 +1,5 @@
 import { SkillLibrary, type EvolutionIoLike, type UnitTransaction } from '@lmzhen/dsh-evolution-core';
-import { type MergeCandidate, type MergeDecision } from './contracts.ts';
+import { type MergeCandidate, type MergeDecision, type MergeRow } from './contracts.ts';
 import type { MergeParams } from './params.ts';
 import type { SkillCard } from './skill-card.ts';
 import type { MergeRegistryPort } from './run-shell.ts';
@@ -7,6 +7,16 @@ import type { MergeCommandService } from './merge-command.ts';
 import type { StageToolContext } from './stage-tool.ts';
 import type { ConversationChannelLike } from './channel-port.ts';
 import type { HostCapabilities } from './host-capabilities.ts';
+interface BusyTarget {
+    readonly id: string;
+    readonly runId?: string;
+}
+/**
+ * The approved/fuse row that already holds a target. Pair/approve move a row to
+ * approved/fuse BEFORE their run starts, so this row IS the in-flight claim a second
+ * same-target run would collide with (the pair itself is guarded by run-meta).
+ */
+export declare function busyTarget(rows: readonly MergeRow[], target: string, excludeRowId: string): BusyTarget | undefined;
 export declare function forcedDecisionFor(a: string, b: string): MergeDecision;
 export interface MergeStageBindingPort {
     bind(context: StageToolContext): void;
@@ -44,7 +54,12 @@ export interface MergeRuntimeDeps {
     readonly stage?: MergeStageBindingPort;
     /** G2 transitional: when set, authoring commits through core UnitTransaction. */
     readonly unit?: UnitTransaction;
+    /** Authority home fence for metadata writes. */
+    readonly fence?: {
+        run<T>(body: () => Promise<T>): Promise<T>;
+    };
 }
 export declare function unitFor(deps: MergeRuntimeDeps): UnitTransaction | undefined;
 export declare function createMergeRuntime(deps: MergeRuntimeDeps): MergeCommandService;
+export {};
 //# sourceMappingURL=runtime.d.ts.map

package/lib/types/runtime.js

@@ -49,8 +49,12 @@ async function hostOnlyFailure(verb, capabilities) {
  * approved/fuse BEFORE their run starts, so this row IS the in-flight claim a second
  * same-target run would collide with (the pair itself is guarded by run-meta).
  */
-function busyTarget(rows, target, excludeRowId) {
-    const row = rows.find(item => item.id !== excludeRowId && (item.state === 'approved' || item.state === 'fuse') && item.decision?.target === target);
+export function busyTarget(rows, target, excludeRowId) {
+    const row = rows.find(item => item.id !== excludeRowId
+        && (item.state === 'approved' || item.state === 'fuse')
+        && item.decision?.target === target
+        // P1-4: a non-retryable failure is auditable but must not hold the target forever.
+        && !(item.failure !== undefined && item.failure.retryable !== true));
     return row === undefined ? undefined : { id: row.id, ...(row.runId === undefined ? {} : { runId: row.runId }) };
 }
 export function forcedDecisionFor(a, b) {
@@ -59,8 +63,8 @@ export function forcedDecisionFor(a, b) {
     const target = raw.length <= 64 ? raw : raw.slice(0, 55) + '-' + createHash('sha256').update(raw).digest('hex').slice(0, 8);
     return { shouldMerge: true, mode: 'create-umbrella', target, sources: [a, b], rationale: 'forced pair merge of ' + sorted.join(' and '), confidence: 0.5, aSummary: 'A: ' + sorted[0] + ' 的现有技能面。', bSummary: 'B: ' + sorted[1] + ' 的现有技能面。' };
 }
-async function removeRuntimeRow(io, home, id, event, unitId) {
-    return await pairLedger(io, home).transact(tx => {
+async function removeRuntimeRow(io, home, id, event, unitId, fence) {
+    return await pairLedger(io, home, fence).transact(tx => {
         const current = tx.rows().find(item => item.id === id);
         if (current === undefined)
             return false;
@@ -76,6 +80,7 @@ export function unitFor(deps) {
     return new UnitTransactions({ io: deps.io, home: deps.home, backend: skillLibraryUnitBackend(deps.skills), claim: targetClaimUnitPort(deps.io, deps.home, deps.now), now: deps.now });
 }
 export function createMergeRuntime(deps) {
+    const ledger = () => pairLedger(deps.io, deps.home, deps.fence);
     const readOnly = createReadOnlyMergeService(deps.io, deps.home);
     const timeout = deps.timeoutMinutes > 0 ? deps.timeoutMinutes : undefined;
     const paramsOf = () => {
@@ -91,6 +96,7 @@ export function createMergeRuntime(deps) {
         platformWrite: platformWriteOf(), now: deps.now,
         ...(deps.model === undefined ? {} : { model: deps.model }),
         ...(deps.isOwnerActive === undefined ? {} : { isOwnerActive: deps.isOwnerActive }),
+        ...(deps.fence === undefined ? {} : { fence: deps.fence }),
         ...(timeout === undefined ? {} : { timeoutMinutes: timeout }),
     });
     const stage = deps.stage;
@@ -149,7 +155,7 @@ export function createMergeRuntime(deps) {
                 const existing = (await loadMergeState(deps.io, deps.home)).state.rows.find(row => row.pairKey === pairKey(command.a, command.b));
                 let cleared = false;
                 if (existing?.state === 'skipped' || (existing?.state === 'fuse' && existing.failure?.retryable === false)) {
-                    const dropped = await removeRuntimeRow(deps.io, deps.home, existing.id, 'superseded');
+                    const dropped = await removeRuntimeRow(deps.io, deps.home, existing.id, 'superseded', undefined, deps.fence);
                     if (!dropped)
                         return fail('pair', 'row-changed', '清理可替换行时发现并发修改：' + existing.id, '运行 /evolution merge status 后重试');
                     cleared = true;
@@ -310,7 +316,7 @@ export function createMergeRuntime(deps) {
                 const row = loaded.state.rows.find(item => item.id === command.id);
                 if (row === undefined)
                     return fail('reject', 'row-not-found', '找不到合并行 ' + command.id, '运行 /evolution merge pending 查看待处理行', command.id);
-                const changed = await pairLedger(deps.io, deps.home).transact(tx => {
+                const changed = await ledger().transact(tx => {
                     const current = tx.rows().find(item => item.id === row.id);
                     if (current === undefined || current.state !== 'pending')
                         return false;
@@ -378,7 +384,7 @@ export function createMergeRuntime(deps) {
                     return fail('discard', 'row-not-found', '找不到合并行 ' + command.id, '运行 /evolution merge status 查看当前队列', command.id);
                 if (row.state !== 'pending' && row.state !== 'approved' && row.state !== 'fuse')
                     return fail('discard', 'row-not-discardable', '该行状态是 ' + row.state + '，不可丢弃：' + command.id, '只有 pending/approved/fuse 行可丢弃', row.runId);
-                const dropped = await removeRuntimeRow(deps.io, deps.home, row.id, 'superseded');
+                const dropped = await removeRuntimeRow(deps.io, deps.home, row.id, 'superseded', undefined, deps.fence);
                 if (!dropped)
                     return fail('discard', 'row-changed', '丢弃时发现并发修改：' + command.id, '运行 /evolution merge status ' + command.id + ' 后重试');
                 return { ok: true, text: '已丢弃合并行：' + command.id };
@@ -392,7 +398,7 @@ export function createMergeRuntime(deps) {
                 if (undoRegistry.runs('merge').some(run => run.id === undoRunId && run.supersededAt !== undefined))
                     return fail('undo', 'run-superseded', '该 run 已因技能树 restore 失效，不能再 undo：' + undoRunId, '运行 /evolution merge runs 查看失效标记');
                 const unit = unitFor(deps);
-                const result = await runUndoOperation({ io: deps.io, home: deps.home, runId: undoRunId, port: skillLibraryUndoPort(deps.skills), now: deps.now, target: command.target, ...(unit === undefined ? {} : { finalizeUnit: id => unit.finalize.call(unit, id) }) });
+                const result = await runUndoOperation({ io: deps.io, home: deps.home, runId: undoRunId, port: skillLibraryUndoPort(deps.skills), now: deps.now, target: command.target, ...(deps.fence === undefined ? {} : { fence: deps.fence }), ...(unit === undefined ? {} : { finalizeUnit: id => unit.finalize.call(unit, id) }) });
                 return result.ok ? { ok: true, text: result.message } : fail('undo', 'undo-failed', result.message, '检查回执与暂存后重试');
             }
             if (command.verb === 'skipped' && command.restore !== undefined) {
@@ -400,7 +406,7 @@ export function createMergeRuntime(deps) {
                 const row = loaded.state.rows.find(item => item.id === command.restore);
                 if (row === undefined || row.state !== 'skipped')
                     return fail('skipped', 'row-not-found', '找不到可恢复的 skipped 行：' + command.restore, '运行 /evolution merge skipped 查看跳过队列', command.restore);
-                const dropped = await removeRuntimeRow(deps.io, deps.home, row.id, 'restored');
+                const dropped = await removeRuntimeRow(deps.io, deps.home, row.id, 'restored', undefined, deps.fence);
                 if (!dropped)
                     return fail('skipped', 'row-changed', '恢复时发现并发修改：' + row.id, '运行 /evolution merge status 后重试');
                 return { ok: true, text: '已恢复参与筛选：' + row.id };
@@ -410,7 +416,7 @@ export function createMergeRuntime(deps) {
                     const cleared = (await loadMergeState(deps.io, deps.home)).state.rows.find(item => item.id === command.clear);
                     if (cleared === undefined)
                         return fail('resume', 'row-not-found', '找不到要清除的行：' + command.clear, '运行 /evolution merge status 查看当前队列');
-                    const dropped = await removeRuntimeRow(deps.io, deps.home, cleared.id, 'superseded');
+                    const dropped = await removeRuntimeRow(deps.io, deps.home, cleared.id, 'superseded', undefined, deps.fence);
                     if (!dropped)
                         return fail('resume', 'row-changed', '清除时发现并发修改：' + cleared.id, '运行 /evolution merge status 后重试');
                     return { ok: true, text: '已清除合并行：' + cleared.id };
@@ -508,7 +514,7 @@ export function createMergeRuntime(deps) {
                     }
                     const missingSource = [candidate.a, candidate.b].find(name => !cards.some(card => card.name === name && card.managed === true));
                     if (missingSource !== undefined) {
-                        const dropped = await removeRuntimeRow(deps.io, deps.home, candidate.id, 'superseded');
+                        const dropped = await removeRuntimeRow(deps.io, deps.home, candidate.id, 'superseded', undefined, deps.fence);
                         if (!dropped)
                             return fail('approve', 'row-changed', 'source-gone，但行已被并发修改，未清理：' + candidate.id, '运行 /evolution merge status ' + candidate.id + ' 后重试');
                         return fail('approve', 'source-gone', missingSource + ' 已不在 family-managed 技能库，已从 active 队列清除', '重新 pair 该技能对；剩余行用 /evolution merge discard ' + candidate.id, candidate.runId);
@@ -517,20 +523,20 @@ export function createMergeRuntime(deps) {
                     const targetExpected = candidate.decision?.targetRevisionRef ?? candidate.targetRevisionRef;
                     const targetMismatch = revisionMismatch(targetExpected, targetRevisionRefOf(cards, candidate.decision.target));
                     if (targetMismatch !== null) {
-                        await pairLedger(deps.io, deps.home).transact(tx => { const current = tx.rows().find(item => item.id === candidate.id); return current === undefined ? false : tx.transition(candidate.id, { type: 'expired', kind: 'target-taken' }, current.version).ok; });
+                        await ledger().transact(tx => { const current = tx.rows().find(item => item.id === candidate.id); return current === undefined ? false : tx.transition(candidate.id, { type: 'expired', kind: 'target-taken' }, current.version).ok; });
                         return fail('approve', 'target-taken', '目标 ' + candidate.decision.target + ' 在决策后已被占用', '重新 pair，或 /evolution merge discard ' + candidate.id, candidate.runId);
                     }
                     if (candidate.decision.supportDigest !== undefined && candidate.decision.supportDigest !== supportDigestOf(cards, [candidate.decision.target, candidate.a, candidate.b])) {
-                        await pairLedger(deps.io, deps.home).transact(tx => { const current = tx.rows().find(item => item.id === candidate.id); return current === undefined ? false : tx.transition(candidate.id, { type: 'expired', kind: 'source-changed' }, current.version).ok; });
+                        await ledger().transact(tx => { const current = tx.rows().find(item => item.id === candidate.id); return current === undefined ? false : tx.transition(candidate.id, { type: 'expired', kind: 'source-changed' }, current.version).ok; });
                         return fail('approve', 'source-changed', '源技能内容在决策后变化，拒绝照跑', '重新 pair，或 /evolution merge discard ' + candidate.id, candidate.runId);
                     }
                     if (revisionMismatch(sourceExpected, sourceRevisionRefOf(cards, candidate.a, candidate.b)) !== null) {
-                        await pairLedger(deps.io, deps.home).transact(tx => { const current = tx.rows().find(item => item.id === candidate.id); return current === undefined ? false : tx.transition(candidate.id, { type: 'expired', kind: 'source-changed' }, current.version).ok; });
+                        await ledger().transact(tx => { const current = tx.rows().find(item => item.id === candidate.id); return current === undefined ? false : tx.transition(candidate.id, { type: 'expired', kind: 'source-changed' }, current.version).ok; });
                         return fail('approve', 'source-changed', '源技能参考在决策后变化，拒绝照跑', '重新 pair，或 /evolution merge discard ' + candidate.id, candidate.runId);
                     }
                     const currentRevision = sourceRevisionOf(cards, candidate.a, candidate.b);
                     if (candidate.sourceRevision !== undefined && currentRevision !== undefined && currentRevision !== candidate.sourceRevision) {
-                        const recorded = await pairLedger(deps.io, deps.home).transact(tx => {
+                        const recorded = await ledger().transact(tx => {
                             const current = tx.rows().find(item => item.id === candidate.id);
                             return current === undefined ? false : tx.transition(candidate.id, { type: 'expired', kind: 'source-changed' }, current.version).ok;
                         });
@@ -541,7 +547,7 @@ export function createMergeRuntime(deps) {
                     const currentTargetRevision = targetRevisionOf(cards, candidate.decision.target);
                     if (candidate.targetRevision !== undefined && currentTargetRevision !== undefined
                         && currentTargetRevision !== candidate.targetRevision) {
-                        const recorded = await pairLedger(deps.io, deps.home).transact(tx => {
+                        const recorded = await ledger().transact(tx => {
                             const current = tx.rows().find(item => item.id === candidate.id);
                             return current === undefined ? false : tx.transition(candidate.id, { type: 'expired', kind: 'target-taken' }, current.version).ok;
                         });
@@ -562,7 +568,7 @@ export function createMergeRuntime(deps) {
                         }
                     }
                     if (candidate.decision.mode === 'merge-into-existing' && !cards.some(card => card.name === candidate.decision?.target)) {
-                        const recorded = await pairLedger(deps.io, deps.home).transact(tx => {
+                        const recorded = await ledger().transact(tx => {
                             const current = tx.rows().find(item => item.id === candidate.id);
                             return current === undefined ? false : tx.transition(candidate.id, { type: 'expired', kind: 'target-taken' }, current.version).ok;
                         });

package/lib/types/scan-command.d.ts

@@ -7,6 +7,9 @@ import { type ScanPorts } from './scan-run.ts';
 import { type MergeRegistryPort, type WithMergeRunResult } from './run-shell.ts';
 export interface RunScanCommandOptions {
     readonly io: EvolutionIoLike;
+    readonly fence?: {
+        run<T>(body: () => Promise<T>): Promise<T>;
+    };
     readonly home: string;
     readonly registry: MergeRegistryPort;
     readonly ports?: ScanPorts;

package/lib/types/scan-command.js

@@ -5,6 +5,7 @@ export async function runScanCommand(options) {
         io: options.io,
         home: options.home,
         registry: options.registry,
+        ...(options.fence === undefined ? {} : { fence: options.fence }),
         command: 'scan',
         approval: { platformWrite: options.platformWrite, mergeApproval: options.approval },
         now: options.now,

package/lib/types/target-claim.js

@@ -5,6 +5,7 @@ import { dirname, join } from 'node:path';
 import { contentHash, isProcessAlive } from '@lmzhen/dsh-evolution-core';
 import { acquireClaim, releaseClaim } from "./domain/claim.js";
 const PROCESS_STARTED_AT = Date.now() - process.uptime() * 1000;
+const TARGET_CLAIM_TTL_MS = 30 * 60_000;
 function claimPath(home, target) {
     return join(home, 'merge', 'claims', contentHash(target) + '.json');
 }
@@ -24,10 +25,12 @@ async function withGuard(path, fn) {
     const guard = path + '.guard';
     await mkdir(dirname(path), { recursive: true });
     for (let attempt = 0; attempt < 500; attempt += 1) {
+        let handle;
         try {
-            const handle = await open(guard, 'wx');
+            handle = await open(guard, 'wx');
             await handle.writeFile(String(process.pid));
             await handle.close();
+            handle = undefined;
             try {
                 return await fn();
             }
@@ -36,6 +39,9 @@ async function withGuard(path, fn) {
             }
         }
         catch (error) {
+            await handle?.close().catch(() => { });
+            if (error.code !== 'EEXIST')
+                await unlink(guard).catch(() => { });
             if (error.code !== 'EEXIST')
                 throw error;
             const pid = Number(await readFile(guard, 'utf8').catch(() => ''));
@@ -83,7 +89,7 @@ export async function acquireTargetClaim(io, home, target, now) {
         const reused = current !== undefined && current.pid === process.pid && current.startedAt !== undefined && Math.abs(current.startedAt - PROCESS_STARTED_AT) > 1_000;
         const abandoned = reused || (current !== undefined && current.expiresAt > now
             && current.pid !== undefined && current.pid !== process.pid && !isProcessAlive(current.pid));
-        const claim = acquireClaim(abandoned ? undefined : current, now, Number.MAX_SAFE_INTEGER, token, process.pid, PROCESS_STARTED_AT);
+        const claim = acquireClaim(abandoned ? undefined : current, now, TARGET_CLAIM_TTL_MS, token, process.pid, PROCESS_STARTED_AT);
         if (claim === undefined)
             return raw;
         granted = claim;

package/lib/types/undo-operation.d.ts

@@ -21,5 +21,8 @@ export declare function runUndoOperation(options: {
         readonly message?: string;
     }>;
     readonly onPhase?: (phase: string, pairKey: string) => void | Promise<void>;
+    readonly fence?: {
+        run<T>(body: () => Promise<T>): Promise<T>;
+    };
 }): Promise<UndoResult>;
 //# sourceMappingURL=undo-operation.d.ts.map