@rei-standard/amsg-server 2.6.0-next.4 → 2.6.0-next.6

package/README.md

@@ -123,6 +123,22 @@ AI 配置消息的提示词可以用两种形态之一，**互斥二选一**：
 - `send-notifications`
   - `Authorization: Bearer <cronToken>` 或 `?token=<cronToken>`
 
+## 触发任务时的占位
+
+`send-notifications`（以及单用户 Worker 的 `scheduled()`）每条任务开跑前会先占位：在这一行的 `lease_until` 上写下「归我管到现在 + 租期为止」，本次投递期间别的 tick 领不走它；占位改到 0 行说明别人先领走了，本次直接跳过。cron 一分钟一跳而带工具的 AI 任务常常跑过一分钟，没有这层占位同一条任务会被相邻几跳重复触发。
+
+租约写在自己的列上，`next_send_at` 全程不动——任务列表读到的一直是用户设的那个时刻，循环任务也按它推进到下一次。投递收尾时租约就放掉，失败重试的退避（2 分钟起）不会被租期压住。
+
+领了任务的那一跳中途没了（Worker 被回收之类）就没人来放租约，这条任务要等租约到期才会被后面的 tick 接手。把租期设得比最慢的一次投递长一点即可。
+
+租期默认 10 分钟；配了 `totalTimeoutMs` 的话按它 + 2 分钟往上抬。想自己定就在 `runScheduledTick` 的 ctx（或单用户 Worker 的 config）里传 `claimLeaseMs`——注意 `createReiServer` 内置的 `/send-notifications` 处理器不透传这两个值，要调租期就自己调 `runScheduledTick`。`onBeforeFire` 里按次放宽的预算占位时看不到，那种情况也要显式设 `claimLeaseMs`。
+
+占位管的是定时触发这条路径。`messageType: 'instant'` 走的是「建行 → 当场投递」，不经过占位。
+
+内置适配器都实现了占位。自定义适配器可以不实现 `claimTask`，跑得动，只是回到不占位的行为。
+
+`lease_until` 是这次新加的列。走 `POST /init-tenant`（或任何一次 `initSchema`）会自动给已有的表补上；手工建表的看 `examples/cloudflare-single-user/schema.sql`。
+
 ## 导出 API（Exports）
 
 - `createReiServer`

package/dist/{chunk-RGECD4OH.cjs → chunk-DCKCAGFV.cjs}

@@ -7,12 +7,20 @@ var TABLE_SQL = `
     encrypted_payload TEXT NOT NULL,
     message_type VARCHAR(50) NOT NULL CHECK (message_type IN ('fixed', 'prompted', 'auto', 'instant')),
     next_send_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    lease_until TIMESTAMP WITH TIME ZONE,
     status VARCHAR(50) NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'sent', 'failed')),
     retry_count INTEGER DEFAULT 0,
     created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
     updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
   )
 `;
+var MIGRATIONS = [
+  {
+    name: "add_lease_until",
+    sql: "ALTER TABLE scheduled_messages ADD COLUMN IF NOT EXISTS lease_until TIMESTAMP WITH TIME ZONE",
+    description: "Task claim lease (2.6.0)"
+  }
+];
 var INDEXES = [
   {
     name: "idx_pending_tasks_optimized",
@@ -69,4 +77,5 @@ var COLUMNS_SQL = `
 
 
 
-exports.TABLE_SQL = TABLE_SQL; exports.INDEXES = INDEXES; exports.VERIFY_TABLE_SQL = VERIFY_TABLE_SQL; exports.COLUMNS_SQL = COLUMNS_SQL;
+
+exports.TABLE_SQL = TABLE_SQL; exports.MIGRATIONS = MIGRATIONS; exports.INDEXES = INDEXES; exports.VERIFY_TABLE_SQL = VERIFY_TABLE_SQL; exports.COLUMNS_SQL = COLUMNS_SQL;

package/dist/{chunk-5ENJGVZX.mjs → chunk-GOBCWCJP.mjs}

@@ -7,12 +7,20 @@ var TABLE_SQL = `
     encrypted_payload TEXT NOT NULL,
     message_type VARCHAR(50) NOT NULL CHECK (message_type IN ('fixed', 'prompted', 'auto', 'instant')),
     next_send_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    lease_until TIMESTAMP WITH TIME ZONE,
     status VARCHAR(50) NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'sent', 'failed')),
     retry_count INTEGER DEFAULT 0,
     created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
     updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
   )
 `;
+var MIGRATIONS = [
+  {
+    name: "add_lease_until",
+    sql: "ALTER TABLE scheduled_messages ADD COLUMN IF NOT EXISTS lease_until TIMESTAMP WITH TIME ZONE",
+    description: "Task claim lease (2.6.0)"
+  }
+];
 var INDEXES = [
   {
     name: "idx_pending_tasks_optimized",
@@ -66,6 +74,7 @@ var COLUMNS_SQL = `
 
 export {
   TABLE_SQL,
+  MIGRATIONS,
   INDEXES,
   VERIFY_TABLE_SQL,
   COLUMNS_SQL

package/dist/{chunk-OVGQHTSE.mjs → chunk-JODQV7MD.mjs}

@@ -598,7 +598,7 @@ function normalizeBeforeFireResult(result) {
     };
   }
   throw new TypeError(
-    "AGENTIC_BAD_BEFORE_FIRE: onBeforeFire must return ChatMessage[] | { messages, maxToolIterations?, totalTimeoutMs? } | null"
+    "AGENTIC_BAD_BEFORE_FIRE: onBeforeFire must return ChatMessage[] | { messages, maxToolIterations?, totalTimeoutMs? } | { skip: true } | null"
   );
 }
 function firstPositiveInt(values, fallback) {
@@ -642,6 +642,9 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
   });
   const before = await hooks.onBeforeFire(fireCtx);
   if (before == null) return { handled: false };
+  if (typeof before === "object" && before.skip === true) {
+    return { handled: true, result: { success: true, messagesSent: 0, status: "skipped", iterations: 0 } };
+  }
   const normalized = normalizeBeforeFireResult(before);
   const maxToolIterations = firstPositiveInt(
     [normalized.maxToolIterations, ctx.maxToolIterations],
@@ -1088,9 +1091,18 @@ function createScheduleMessageHandler(ctx) {
 }
 
 // src/server/lib/run-tick.js
+var DEFAULT_CLAIM_LEASE_MS = 10 * 60 * 1e3;
+var CLAIM_LEASE_MARGIN_MS = 2 * 60 * 1e3;
+function positiveNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
+}
+function resolveClaimLeaseMs(ctx) {
+  return positiveNumber(ctx.claimLeaseMs) || Math.max(DEFAULT_CLAIM_LEASE_MS, positiveNumber(ctx.totalTimeoutMs) + CLAIM_LEASE_MARGIN_MS);
+}
 async function runScheduledTick(ctx) {
   const db = ctx.db;
   const masterKey = ctx.masterKey;
+  const claimLeaseMs = resolveClaimLeaseMs(ctx);
   const startTime = Date.now();
   const tasks = await db.getPendingTasks(50);
   const MAX_CONCURRENT = 8;
@@ -1098,19 +1110,29 @@ async function runScheduledTick(ctx) {
     totalTasks: tasks.length,
     successCount: 0,
     failedCount: 0,
+    claimSkippedTasks: 0,
     deletedOnceOffTasks: 0,
     updatedRecurringTasks: 0,
     failedTasks: []
   };
+  const supportsClaim = typeof db.claimTask === "function";
+  async function claimForThisTick(task) {
+    if (!supportsClaim) return true;
+    const leaseUntil = new Date(Date.now() + claimLeaseMs).toISOString();
+    return !!await db.claimTask(task.id, task.next_send_at, leaseUntil);
+  }
+  async function updateAndRelease(taskId, fields) {
+    return db.updateTaskById(taskId, supportsClaim ? { ...fields, lease_until: null } : fields);
+  }
   async function handleDeliveryFailure(task, reason) {
     results.failedCount++;
     try {
       if (task.retry_count >= 3) {
-        await db.updateTaskById(task.id, { status: "failed" });
+        await updateAndRelease(task.id, { status: "failed" });
         results.failedTasks.push({ taskId: task.id, reason, retryCount: task.retry_count, status: "permanently_failed" });
       } else {
         const nextRetryTime = new Date(Date.now() + (task.retry_count + 1) * 2 * 60 * 1e3);
-        await db.updateTaskById(task.id, { next_send_at: nextRetryTime.toISOString(), retry_count: task.retry_count + 1 });
+        await updateAndRelease(task.id, { next_send_at: nextRetryTime.toISOString(), retry_count: task.retry_count + 1 });
         results.failedTasks.push({ taskId: task.id, reason, retryCount: task.retry_count + 1, nextRetryAt: nextRetryTime.toISOString() });
       }
     } catch (updateError) {
@@ -1121,7 +1143,7 @@ async function runScheduledTick(ctx) {
     results.failedCount++;
     let markedSent = false;
     try {
-      await db.updateTaskById(task.id, { status: "sent", retry_count: 0 });
+      await updateAndRelease(task.id, { status: "sent", retry_count: 0 });
       markedSent = true;
     } catch (_markSentError) {
       markedSent = false;
@@ -1134,6 +1156,18 @@ async function runScheduledTick(ctx) {
     });
   }
   async function processTask(task) {
+    let claimed;
+    try {
+      claimed = await claimForThisTick(task);
+    } catch (error) {
+      results.failedCount++;
+      results.failedTasks.push({ taskId: task.id, reason: error.message || "\u4EFB\u52A1\u5360\u4F4D\u5931\u8D25", status: "claim_failed" });
+      return;
+    }
+    if (!claimed) {
+      results.claimSkippedTasks++;
+      return;
+    }
     let sendResult;
     try {
       sendResult = await processSingleMessage(task, { ...ctx, db, masterKey }, masterKey);
@@ -1159,7 +1193,7 @@ async function runScheduledTick(ctx) {
         } else if (decryptedPayload.recurrenceType === "weekly") {
           nextSendAt = new Date(currentSendAt.getTime() + 7 * 24 * 60 * 60 * 1e3);
         }
-        await db.updateTaskById(task.id, { next_send_at: nextSendAt.toISOString(), retry_count: 0 });
+        await updateAndRelease(task.id, { next_send_at: nextSendAt.toISOString(), retry_count: 0 });
         results.updatedRecurringTasks++;
       }
       results.successCount++;
@@ -1192,6 +1226,7 @@ async function runScheduledTick(ctx) {
     processedAt: (/* @__PURE__ */ new Date()).toISOString(),
     executionTime,
     details: {
+      claimSkippedTasks: results.claimSkippedTasks,
       deletedOnceOffTasks: results.deletedOnceOffTasks,
       updatedRecurringTasks: results.updatedRecurringTasks,
       failedTasks: results.failedTasks
@@ -1416,7 +1451,14 @@ function createMessagesHandler(ctx) {
         status: task.status,
         retryCount: task.retry_count,
         createdAt: task.created_at,
-        updatedAt: task.updated_at
+        updatedAt: task.updated_at,
+        // Character ownership / client-side task identity, pulled from the
+        // scheduling host's metadata so it can filter tasks by character
+        // (contactName can collide across characters). Only these two
+        // metadata fields are surfaced — the rest of metadata may hold
+        // host-private data and stays server-side. Absent → null.
+        charId: decrypted.metadata?.charId ?? null,
+        clientTaskId: decrypted.metadata?.amsgClientTaskId ?? null
       };
     }));
     const responsePayload = {
@@ -1446,12 +1488,20 @@ var SQLITE_TABLE_SQL = `
     encrypted_payload TEXT NOT NULL,
     message_type TEXT NOT NULL CHECK (message_type IN ('fixed', 'prompted', 'auto', 'instant')),
     next_send_at TEXT NOT NULL,
+    lease_until TEXT,
     status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'sent', 'failed')),
     retry_count INTEGER NOT NULL DEFAULT 0,
     created_at TEXT NOT NULL,
     updated_at TEXT NOT NULL
   )
 `;
+var SQLITE_MIGRATIONS = [
+  {
+    name: "add_lease_until",
+    sql: "ALTER TABLE scheduled_messages ADD COLUMN lease_until TEXT",
+    description: "Task claim lease (2.6.0)"
+  }
+];
 var SQLITE_INDEXES = [
   {
     name: "idx_pending_tasks_optimized",
@@ -1511,6 +1561,7 @@ var UPDATABLE_COLUMNS = /* @__PURE__ */ new Set([
   "encrypted_payload",
   "message_type",
   "next_send_at",
+  "lease_until",
   "status",
   "retry_count",
   "created_at",
@@ -1539,6 +1590,13 @@ var D1Adapter = class {
   async initSchema() {
     await this._db.prepare(SQLITE_TABLE_SQL).run();
     await this._db.prepare(CLIENT_STATE_TABLE_SQL).run();
+    for (const migration of SQLITE_MIGRATIONS) {
+      try {
+        await this._db.prepare(migration.sql).run();
+      } catch (error) {
+        if (!/duplicate column name/i.test(error.message || "")) throw error;
+      }
+    }
     const indexResults = [];
     for (const index of SQLITE_INDEXES) {
       try {
@@ -1556,7 +1614,7 @@ var D1Adapter = class {
       );
     }
     return {
-      columnsCreated: 10,
+      columnsCreated: 11,
       indexesCreated: indexResults.filter((r) => r.status === "success").length,
       indexesFailed: indexResults.filter((r) => r.status === "failed").length,
       columns: [],
@@ -1648,15 +1706,53 @@ var D1Adapter = class {
     return res.meta.changes > 0;
   }
   async getPendingTasks(limit = 50) {
+    const now = this._now();
     const res = await this._db.prepare(
       `SELECT id, user_id, uuid, encrypted_payload, message_type, next_send_at, status, retry_count
        FROM scheduled_messages
        WHERE status = 'pending' AND next_send_at <= ?
+         AND (lease_until IS NULL OR lease_until <= ?)
        ORDER BY next_send_at ASC
        LIMIT ?`
-    ).bind(this._now(), limit).all();
+    ).bind(now, now, limit).all();
     return res.results || [];
   }
+  /**
+   * 领取一条到点的任务：在 lease_until 上写下「这条归我管到什么时候」，
+   * 本次投递期间别的 tick 领不走它。
+   *
+   * 租约写在自己的列上，next_send_at 全程不动——那一列是用户设的触发时刻，
+   * 任务列表要读它、循环任务推进下一次也要拿它当基准。
+   *
+   * 两个 tick 抢同一行时只有一个能改到行，另一个拿到 changes = 0，据此跳过。
+   * WHERE 里的两个条件各管一件事：
+   *   - lease_until 为空或已过期：没人正在跑这条。领了任务的 tick 中途没了
+   *     也不会把行焊死，租约到期后自然可以被接手。
+   *   - next_send_at 等于读这行时看到的值：读出来之后用户又改了排期的话，
+   *     这一跳就不该再按旧时刻发。
+   *
+   * 不加一个 'sending' 状态来表达「正在跑」：建表语句里 status 有
+   * CHECK (status IN ('pending','sent','failed'))，加值要重建表。
+   *
+   * expectedNextSendAt 按读到的原样比对，不做时区归一化——老部署里可能还留
+   * 着非归一化写法的行（如 +08:00 结尾），归一化后反而对不上，那条任务会永
+   * 远领不到。
+   *
+   * @param {number} taskId
+   * @param {string} expectedNextSendAt - 读这行时拿到的 next_send_at 原值
+   * @param {string|Date} leaseUntil - 租期末尾
+   * @returns {Promise<boolean>} true = 领到了；false = 别人正拿着租约、排期被改过、或行已不是 pending
+   */
+  async claimTask(taskId, expectedNextSendAt, leaseUntil) {
+    const expected = typeof expectedNextSendAt === "string" ? expectedNextSendAt : this._iso(expectedNextSendAt);
+    const res = await this._db.prepare(
+      `UPDATE scheduled_messages
+          SET lease_until = ?, updated_at = ?
+        WHERE id = ? AND status = 'pending' AND next_send_at = ?
+          AND (lease_until IS NULL OR lease_until <= ?)`
+    ).bind(this._iso(leaseUntil), this._now(), taskId, expected, this._now()).run();
+    return (res.meta.changes || 0) > 0;
+  }
   async listTasks(userId, opts = {}) {
     const { status = "all", limit = 20, offset = 0 } = opts;
     const conditions = ["user_id = ?"];
@@ -2082,7 +2178,7 @@ function createClientStateHandler(ctx) {
 }
 
 // src/server/lib/version.js
-var SERVER_VERSION = true ? "2.6.0-next.4" : "0.0.0-dev";
+var SERVER_VERSION = true ? "2.6.0-next.6" : "0.0.0-dev";
 
 // src/server/handlers/capabilities.js
 var SERVER_FEATURES = Object.freeze([
@@ -2445,7 +2541,9 @@ function createSingleUserCloudflareWorker(buildConfig) {
         // spreads its ctx into processSingleMessage, so these ride along.
         hooks: cfg.hooks || null,
         maxToolIterations: cfg.maxToolIterations,
-        totalTimeoutMs: cfg.totalTimeoutMs
+        totalTimeoutMs: cfg.totalTimeoutMs,
+        // 任务占位租期（默认 10 分钟，随 totalTimeoutMs 抬高）。
+        claimLeaseMs: cfg.claimLeaseMs
       });
     } catch (error) {
       console.error("[amsg single-user] scheduled(): tick failed:", error && error.message);

package/dist/{chunk-REX5MCEZ.cjs → chunk-WFFIWXM5.cjs}

@@ -598,7 +598,7 @@ function normalizeBeforeFireResult(result) {
     };
   }
   throw new TypeError(
-    "AGENTIC_BAD_BEFORE_FIRE: onBeforeFire must return ChatMessage[] | { messages, maxToolIterations?, totalTimeoutMs? } | null"
+    "AGENTIC_BAD_BEFORE_FIRE: onBeforeFire must return ChatMessage[] | { messages, maxToolIterations?, totalTimeoutMs? } | { skip: true } | null"
   );
 }
 function firstPositiveInt(values, fallback) {
@@ -642,6 +642,9 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
   });
   const before = await hooks.onBeforeFire(fireCtx);
   if (before == null) return { handled: false };
+  if (typeof before === "object" && before.skip === true) {
+    return { handled: true, result: { success: true, messagesSent: 0, status: "skipped", iterations: 0 } };
+  }
   const normalized = normalizeBeforeFireResult(before);
   const maxToolIterations = firstPositiveInt(
     [normalized.maxToolIterations, ctx.maxToolIterations],
@@ -1088,9 +1091,18 @@ function createScheduleMessageHandler(ctx) {
 }
 
 // src/server/lib/run-tick.js
+var DEFAULT_CLAIM_LEASE_MS = 10 * 60 * 1e3;
+var CLAIM_LEASE_MARGIN_MS = 2 * 60 * 1e3;
+function positiveNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
+}
+function resolveClaimLeaseMs(ctx) {
+  return positiveNumber(ctx.claimLeaseMs) || Math.max(DEFAULT_CLAIM_LEASE_MS, positiveNumber(ctx.totalTimeoutMs) + CLAIM_LEASE_MARGIN_MS);
+}
 async function runScheduledTick(ctx) {
   const db = ctx.db;
   const masterKey = ctx.masterKey;
+  const claimLeaseMs = resolveClaimLeaseMs(ctx);
   const startTime = Date.now();
   const tasks = await db.getPendingTasks(50);
   const MAX_CONCURRENT = 8;
@@ -1098,19 +1110,29 @@ async function runScheduledTick(ctx) {
     totalTasks: tasks.length,
     successCount: 0,
     failedCount: 0,
+    claimSkippedTasks: 0,
     deletedOnceOffTasks: 0,
     updatedRecurringTasks: 0,
     failedTasks: []
   };
+  const supportsClaim = typeof db.claimTask === "function";
+  async function claimForThisTick(task) {
+    if (!supportsClaim) return true;
+    const leaseUntil = new Date(Date.now() + claimLeaseMs).toISOString();
+    return !!await db.claimTask(task.id, task.next_send_at, leaseUntil);
+  }
+  async function updateAndRelease(taskId, fields) {
+    return db.updateTaskById(taskId, supportsClaim ? { ...fields, lease_until: null } : fields);
+  }
   async function handleDeliveryFailure(task, reason) {
     results.failedCount++;
     try {
       if (task.retry_count >= 3) {
-        await db.updateTaskById(task.id, { status: "failed" });
+        await updateAndRelease(task.id, { status: "failed" });
         results.failedTasks.push({ taskId: task.id, reason, retryCount: task.retry_count, status: "permanently_failed" });
       } else {
         const nextRetryTime = new Date(Date.now() + (task.retry_count + 1) * 2 * 60 * 1e3);
-        await db.updateTaskById(task.id, { next_send_at: nextRetryTime.toISOString(), retry_count: task.retry_count + 1 });
+        await updateAndRelease(task.id, { next_send_at: nextRetryTime.toISOString(), retry_count: task.retry_count + 1 });
         results.failedTasks.push({ taskId: task.id, reason, retryCount: task.retry_count + 1, nextRetryAt: nextRetryTime.toISOString() });
       }
     } catch (updateError) {
@@ -1121,7 +1143,7 @@ async function runScheduledTick(ctx) {
     results.failedCount++;
     let markedSent = false;
     try {
-      await db.updateTaskById(task.id, { status: "sent", retry_count: 0 });
+      await updateAndRelease(task.id, { status: "sent", retry_count: 0 });
       markedSent = true;
     } catch (_markSentError) {
       markedSent = false;
@@ -1134,6 +1156,18 @@ async function runScheduledTick(ctx) {
     });
   }
   async function processTask(task) {
+    let claimed;
+    try {
+      claimed = await claimForThisTick(task);
+    } catch (error) {
+      results.failedCount++;
+      results.failedTasks.push({ taskId: task.id, reason: error.message || "\u4EFB\u52A1\u5360\u4F4D\u5931\u8D25", status: "claim_failed" });
+      return;
+    }
+    if (!claimed) {
+      results.claimSkippedTasks++;
+      return;
+    }
     let sendResult;
     try {
       sendResult = await processSingleMessage(task, { ...ctx, db, masterKey }, masterKey);
@@ -1159,7 +1193,7 @@ async function runScheduledTick(ctx) {
         } else if (decryptedPayload.recurrenceType === "weekly") {
           nextSendAt = new Date(currentSendAt.getTime() + 7 * 24 * 60 * 60 * 1e3);
         }
-        await db.updateTaskById(task.id, { next_send_at: nextSendAt.toISOString(), retry_count: 0 });
+        await updateAndRelease(task.id, { next_send_at: nextSendAt.toISOString(), retry_count: 0 });
         results.updatedRecurringTasks++;
       }
       results.successCount++;
@@ -1192,6 +1226,7 @@ async function runScheduledTick(ctx) {
     processedAt: (/* @__PURE__ */ new Date()).toISOString(),
     executionTime,
     details: {
+      claimSkippedTasks: results.claimSkippedTasks,
       deletedOnceOffTasks: results.deletedOnceOffTasks,
       updatedRecurringTasks: results.updatedRecurringTasks,
       failedTasks: results.failedTasks
@@ -1416,7 +1451,14 @@ function createMessagesHandler(ctx) {
         status: task.status,
         retryCount: task.retry_count,
         createdAt: task.created_at,
-        updatedAt: task.updated_at
+        updatedAt: task.updated_at,
+        // Character ownership / client-side task identity, pulled from the
+        // scheduling host's metadata so it can filter tasks by character
+        // (contactName can collide across characters). Only these two
+        // metadata fields are surfaced — the rest of metadata may hold
+        // host-private data and stays server-side. Absent → null.
+        charId: _nullishCoalesce(_optionalChain([decrypted, 'access', _7 => _7.metadata, 'optionalAccess', _8 => _8.charId]), () => ( null)),
+        clientTaskId: _nullishCoalesce(_optionalChain([decrypted, 'access', _9 => _9.metadata, 'optionalAccess', _10 => _10.amsgClientTaskId]), () => ( null))
       };
     }));
     const responsePayload = {
@@ -1446,12 +1488,20 @@ var SQLITE_TABLE_SQL = `
     encrypted_payload TEXT NOT NULL,
     message_type TEXT NOT NULL CHECK (message_type IN ('fixed', 'prompted', 'auto', 'instant')),
     next_send_at TEXT NOT NULL,
+    lease_until TEXT,
     status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'sent', 'failed')),
     retry_count INTEGER NOT NULL DEFAULT 0,
     created_at TEXT NOT NULL,
     updated_at TEXT NOT NULL
   )
 `;
+var SQLITE_MIGRATIONS = [
+  {
+    name: "add_lease_until",
+    sql: "ALTER TABLE scheduled_messages ADD COLUMN lease_until TEXT",
+    description: "Task claim lease (2.6.0)"
+  }
+];
 var SQLITE_INDEXES = [
   {
     name: "idx_pending_tasks_optimized",
@@ -1511,6 +1561,7 @@ var UPDATABLE_COLUMNS = /* @__PURE__ */ new Set([
   "encrypted_payload",
   "message_type",
   "next_send_at",
+  "lease_until",
   "status",
   "retry_count",
   "created_at",
@@ -1539,6 +1590,13 @@ var D1Adapter = class {
   async initSchema() {
     await this._db.prepare(SQLITE_TABLE_SQL).run();
     await this._db.prepare(CLIENT_STATE_TABLE_SQL).run();
+    for (const migration of SQLITE_MIGRATIONS) {
+      try {
+        await this._db.prepare(migration.sql).run();
+      } catch (error) {
+        if (!/duplicate column name/i.test(error.message || "")) throw error;
+      }
+    }
     const indexResults = [];
     for (const index of SQLITE_INDEXES) {
       try {
@@ -1556,7 +1614,7 @@ var D1Adapter = class {
       );
     }
     return {
-      columnsCreated: 10,
+      columnsCreated: 11,
       indexesCreated: indexResults.filter((r) => r.status === "success").length,
       indexesFailed: indexResults.filter((r) => r.status === "failed").length,
       columns: [],
@@ -1648,15 +1706,53 @@ var D1Adapter = class {
     return res.meta.changes > 0;
   }
   async getPendingTasks(limit = 50) {
+    const now = this._now();
     const res = await this._db.prepare(
       `SELECT id, user_id, uuid, encrypted_payload, message_type, next_send_at, status, retry_count
        FROM scheduled_messages
        WHERE status = 'pending' AND next_send_at <= ?
+         AND (lease_until IS NULL OR lease_until <= ?)
        ORDER BY next_send_at ASC
        LIMIT ?`
-    ).bind(this._now(), limit).all();
+    ).bind(now, now, limit).all();
     return res.results || [];
   }
+  /**
+   * 领取一条到点的任务：在 lease_until 上写下「这条归我管到什么时候」，
+   * 本次投递期间别的 tick 领不走它。
+   *
+   * 租约写在自己的列上，next_send_at 全程不动——那一列是用户设的触发时刻，
+   * 任务列表要读它、循环任务推进下一次也要拿它当基准。
+   *
+   * 两个 tick 抢同一行时只有一个能改到行，另一个拿到 changes = 0，据此跳过。
+   * WHERE 里的两个条件各管一件事：
+   *   - lease_until 为空或已过期：没人正在跑这条。领了任务的 tick 中途没了
+   *     也不会把行焊死，租约到期后自然可以被接手。
+   *   - next_send_at 等于读这行时看到的值：读出来之后用户又改了排期的话，
+   *     这一跳就不该再按旧时刻发。
+   *
+   * 不加一个 'sending' 状态来表达「正在跑」：建表语句里 status 有
+   * CHECK (status IN ('pending','sent','failed'))，加值要重建表。
+   *
+   * expectedNextSendAt 按读到的原样比对，不做时区归一化——老部署里可能还留
+   * 着非归一化写法的行（如 +08:00 结尾），归一化后反而对不上，那条任务会永
+   * 远领不到。
+   *
+   * @param {number} taskId
+   * @param {string} expectedNextSendAt - 读这行时拿到的 next_send_at 原值
+   * @param {string|Date} leaseUntil - 租期末尾
+   * @returns {Promise<boolean>} true = 领到了；false = 别人正拿着租约、排期被改过、或行已不是 pending
+   */
+  async claimTask(taskId, expectedNextSendAt, leaseUntil) {
+    const expected = typeof expectedNextSendAt === "string" ? expectedNextSendAt : this._iso(expectedNextSendAt);
+    const res = await this._db.prepare(
+      `UPDATE scheduled_messages
+          SET lease_until = ?, updated_at = ?
+        WHERE id = ? AND status = 'pending' AND next_send_at = ?
+          AND (lease_until IS NULL OR lease_until <= ?)`
+    ).bind(this._iso(leaseUntil), this._now(), taskId, expected, this._now()).run();
+    return (res.meta.changes || 0) > 0;
+  }
   async listTasks(userId, opts = {}) {
     const { status = "all", limit = 20, offset = 0 } = opts;
     const conditions = ["user_id = ?"];
@@ -2082,7 +2178,7 @@ function createClientStateHandler(ctx) {
 }
 
 // src/server/lib/version.js
-var SERVER_VERSION = true ? "2.6.0-next.4" : "0.0.0-dev";
+var SERVER_VERSION = true ? "2.6.0-next.6" : "0.0.0-dev";
 
 // src/server/handlers/capabilities.js
 var SERVER_FEATURES = Object.freeze([
@@ -2445,7 +2541,9 @@ function createSingleUserCloudflareWorker(buildConfig) {
         // spreads its ctx into processSingleMessage, so these ride along.
         hooks: cfg.hooks || null,
         maxToolIterations: cfg.maxToolIterations,
-        totalTimeoutMs: cfg.totalTimeoutMs
+        totalTimeoutMs: cfg.totalTimeoutMs,
+        // 任务占位租期（默认 10 分钟，随 totalTimeoutMs 抬高）。
+        claimLeaseMs: cfg.claimLeaseMs
       });
     } catch (error) {
       console.error("[amsg single-user] scheduled(): tick failed:", error && error.message);