@sema-agent/server 7.125.0 → 7.126.0

package/dist/plugins/local-session-store.js

@@ -1,6 +1,6 @@
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
-import { FileSessionRepo, SessionError, validateEntriesForImport } from "@sema-agent/core";
+import { FileSessionRepo, SessionError, StoredSession, validateEntriesForImport } from "@sema-agent/core";
 import { z } from "zod";
 import { contentForkRelation, fastForwardSharedContentDiverged, identicalIdsAlsoIdenticalContent } from "../session-sync-content.js";
 import { quarantineUnreadableSidecar } from "./local-sidecar-quarantine.js";
@@ -49,6 +49,7 @@ function ownerClaimWindowOpen() {
     return migrationWindowOpen(window, new Date().toISOString().slice(0, 10));
 }
 const SIDECAR_MAP_STATE_BY_PATH = new Map();
+const SESSION_WRITE_LOCKS_BY_ROOT = new Map();
 class SidecarMap {
     path;
     label;
@@ -104,6 +105,9 @@ class SidecarMap {
     persist() {
         return this.commit(() => true);
     }
+    deleteKey(key) {
+        return this.commit((draft) => draft.delete(key));
+    }
     commit(change) {
         const path = this.path;
         const st = this.state;
@@ -142,6 +146,22 @@ export function createLocalSessionRepo(root) {
         onCorruptRead: createCorruptReadFailOpenSeat("server.session-repo.corrupt-record-skipped", noteReplayInSessionOpenScope),
     });
 }
+function occupiedBy(session, incarnation) {
+    const storage = session.getStorage();
+    const view = new Proxy(storage, {
+        get(target, prop) {
+            if (prop === "getMetadata")
+                return async () => occupantMetadata(await target.getMetadata(), incarnation);
+            const value = Reflect.get(target, prop, target);
+            return typeof value === "function" ? value.bind(target) : value;
+        },
+    });
+    return new StoredSession(view);
+}
+function occupantMetadata(meta, incarnation) {
+    const { forkedFromIncarnation: _notThisStoresToken, ...rest } = meta;
+    return { ...rest, incarnation };
+}
 export class LocalSessionStore {
     repo;
     runs;
@@ -161,6 +181,7 @@ export class LocalSessionStore {
     instructionSources;
     meta;
     log;
+    sessionWriteLocks;
     constructor(repo, runs, dataDir, opts) {
         this.repo = repo;
         this.runs = runs;
@@ -171,6 +192,10 @@ export class LocalSessionStore {
         this.pinned = sidecar("session-pinned.json", "pinned", readPinnedSidecar);
         this.instructionSources = sidecar("session-instruction-sources.json", "instruction-source", readStringRecordColumn);
         this.meta = sidecar("session-incarnations.json", "session-meta", readSessionMetaSidecar, true);
+        const root = dataDir ? resolve(dataDir) : undefined;
+        if (root !== undefined && !SESSION_WRITE_LOCKS_BY_ROOT.has(root))
+            SESSION_WRITE_LOCKS_BY_ROOT.set(root, new Map());
+        this.sessionWriteLocks = root !== undefined ? SESSION_WRITE_LOCKS_BY_ROOT.get(root) : new Map();
     }
     async writeMeta(sessionId, next) {
         await this.meta.ensureLoaded();
@@ -189,10 +214,22 @@ export class LocalSessionStore {
     }
     async dropMeta(sessionId) {
         await this.meta.ensureLoaded();
-        const committed = await this.meta.commit((draft) => draft.delete(sessionId));
-        if (!committed)
+        if (!(await this.meta.deleteKey(sessionId)))
             throw new SessionError("storage", `LocalSessionStore: session-meta sidecar write failed while deleting session ${sessionId} — its owner/incarnation cell is still on disk`);
     }
+    async withSessionWriteLock(sessionId, body) {
+        const locks = this.sessionWriteLocks;
+        const link = (locks.get(sessionId) ?? Promise.resolve()).then(body);
+        const tail = link.then(() => undefined, () => undefined);
+        locks.set(sessionId, tail);
+        try {
+            return await link;
+        }
+        finally {
+            if (locks.get(sessionId) === tail)
+                locks.delete(sessionId);
+        }
+    }
     async existsInRepo(sessionId) {
         try {
             await this.repo.open({ id: sessionId, createdAt: "" });
@@ -211,14 +248,27 @@ export class LocalSessionStore {
             return readSessionMetaCell(cell);
         if (!(await this.existsInRepo(sessionId)))
             return undefined;
-        await this.writeMeta(sessionId, (before) => (before === undefined ? mintSessionIncarnation() : undefined));
-        const minted = this.meta.state.entries.get(sessionId);
-        return minted === undefined ? undefined : readSessionMetaCell(minted);
+        return this.cellOfPresent(sessionId);
+    }
+    async cellOfPresent(sessionId) {
+        if (!this.meta.state.entries.has(sessionId))
+            await this.writeMeta(sessionId, (before) => (before === undefined ? mintSessionIncarnation() : undefined));
+        const cell = this.meta.state.entries.get(sessionId);
+        return cell === undefined ? undefined : readSessionMetaCell(cell);
     }
     async sessionFaceOf(sessionId) {
         const meta = await this.metaOf(sessionId);
         return meta === undefined ? undefined : sessionFaceFromRow(sessionId, meta.owner ?? null, meta.incarnation);
     }
+    async incarnationOf(sessionId) {
+        return (await this.sessionFaceOf(sessionId))?.incarnation;
+    }
+    async handOut(sessionId, session) {
+        const meta = await this.cellOfPresent(sessionId);
+        if (meta === undefined)
+            throw new SessionError("storage", `LocalSessionStore: session ${sessionId} lost its session-meta cell while it was being handed out`);
+        return { session: occupiedBy(session, sessionFaceFromRow(sessionId, meta.owner ?? null, meta.incarnation).incarnation), sessionId };
+    }
     async probeTitle(sessionId) {
         await this.titles.ensureLoaded();
         return this.titles.state.entries.has(sessionId) ? "titled" : "untitled";
@@ -233,48 +283,42 @@ export class LocalSessionStore {
         return true;
     }
     async patchSessionMeta(sessionId, patch, face) {
-        await this.meta.ensureLoaded();
-        const occupied = () => this.occupiedBy(sessionId, face);
-        if (!occupied() || (await this.listedMeta(sessionId)) === undefined)
-            return undefined;
-        const { title, pinned } = patch;
-        if (title !== undefined) {
-            await this.titles.ensureLoaded();
-            const ok = await this.titles.commit((draft) => {
-                if (!occupied())
-                    return false;
-                if (title === null)
-                    return draft.delete(sessionId);
-                if (draft.get(sessionId) === title)
-                    return false;
-                draft.set(sessionId, title);
-                return true;
-            });
-            if (!ok)
-                throw new SessionError("storage", `LocalSessionStore: title sidecar write failed for session ${sessionId} — the title was not recorded`);
-        }
-        if (pinned !== undefined) {
-            await this.pinned.ensureLoaded();
-            const ok = await this.pinned.commit((draft) => {
-                if (!occupied())
-                    return false;
-                if (!pinned)
-                    return draft.delete(sessionId);
-                if (draft.get(sessionId) === true)
-                    return false;
-                draft.set(sessionId, true);
-                return true;
-            });
-            if (!ok)
-                throw new SessionError("storage", `LocalSessionStore: pin sidecar write failed for session ${sessionId} — the pin was not recorded`);
-        }
-        const rollups = await this.runRollups();
-        await this.loadRowSidecars();
-        const meta = await this.listedMeta(sessionId);
-        if (meta === undefined || !occupied())
-            return undefined;
-        const row = await this.summaryOf(meta, rollups);
-        return occupied() ? row : undefined;
+        return this.withSessionWriteLock(sessionId, async () => {
+            await this.meta.ensureLoaded();
+            if (!this.occupiedBy(sessionId, face) || (await this.listedMeta(sessionId)) === undefined)
+                return undefined;
+            const { title, pinned } = patch;
+            if (title !== undefined) {
+                await this.titles.ensureLoaded();
+                const ok = await this.titles.commit((draft) => {
+                    if (title === null)
+                        return draft.delete(sessionId);
+                    if (draft.get(sessionId) === title)
+                        return false;
+                    draft.set(sessionId, title);
+                    return true;
+                });
+                if (!ok)
+                    throw new SessionError("storage", `LocalSessionStore: title sidecar write failed for session ${sessionId} — the title was not recorded`);
+            }
+            if (pinned !== undefined) {
+                await this.pinned.ensureLoaded();
+                const ok = await this.pinned.commit((draft) => {
+                    if (!pinned)
+                        return draft.delete(sessionId);
+                    if (draft.get(sessionId) === true)
+                        return false;
+                    draft.set(sessionId, true);
+                    return true;
+                });
+                if (!ok)
+                    throw new SessionError("storage", `LocalSessionStore: pin sidecar write failed for session ${sessionId} — the pin was not recorded`);
+            }
+            const rollups = await this.runRollups();
+            await this.loadRowSidecars();
+            const meta = await this.listedMeta(sessionId);
+            return meta === undefined ? undefined : this.summaryOf(meta, rollups);
+        });
     }
     occupiedBy(sessionId, face) {
         const cell = this.meta.state.entries.get(sessionId);
@@ -377,7 +421,7 @@ export class LocalSessionStore {
             const session = await this.repo.create({});
             const id = (await session.getMetadata()).id;
             await this.writeMeta(id, () => ({ incarnation: mintSessionIncarnation(), owner: null }));
-            return { session: session, sessionId: id };
+            return this.handOut(id, session);
         }
         if (opts?.requireExisting)
             return this.load(sessionId, true);
@@ -389,38 +433,46 @@ export class LocalSessionStore {
         return p;
     }
     async load(sessionId, requireExisting = false) {
-        try {
-            const session = await openSessionForItself(sessionId, () => this.repo.open({ id: sessionId, createdAt: "" }));
-            return { session: session, sessionId };
-        }
-        catch (e) {
-            if (!isNotFound(e))
-                throw e;
-            if (requireExisting)
-                throw e;
+        return this.withSessionWriteLock(sessionId, async () => {
+            try {
+                return await this.openForItselfHeld(sessionId);
+            }
+            catch (e) {
+                if (!isNotFound(e))
+                    throw e;
+                if (requireExisting)
+                    throw e;
+            }
             await this.meta.ensureLoaded();
             const session = await this.repo.create({ id: sessionId });
             await this.writeMeta(sessionId, (before) => ({ incarnation: mintSessionIncarnation(), owner: before !== undefined && ownerRecorded(before) ? (readSessionMetaCell(before).owner ?? null) : null }));
-            return { session: session, sessionId };
-        }
+            return this.handOut(sessionId, session);
+        });
     }
-    async register(sessionId, owner) {
+    async openForItselfHeld(sessionId) {
         await this.meta.ensureLoaded();
-        if (ownerRecorded(this.meta.state.entries.get(sessionId)))
-            return;
-        const existed = await this.existsInRepo(sessionId);
-        const claim = existed && owner !== null && ownerClaimWindowOpen();
-        const wrote = await this.writeMeta(sessionId, (before) => {
-            if (ownerRecorded(before))
-                return undefined;
-            if (!existed || claim)
-                return { incarnation: existed && before !== undefined ? readSessionMetaCell(before).incarnation : mintSessionIncarnation(), owner };
-            return before === undefined ? mintSessionIncarnation() : undefined;
+        const session = await openSessionForItself(sessionId, () => this.repo.open({ id: sessionId, createdAt: "" }));
+        return this.handOut(sessionId, session);
+    }
+    async register(sessionId, owner) {
+        await this.withSessionWriteLock(sessionId, async () => {
+            await this.meta.ensureLoaded();
+            if (ownerRecorded(this.meta.state.entries.get(sessionId)))
+                return;
+            const existed = await this.existsInRepo(sessionId);
+            const claim = existed && owner !== null && ownerClaimWindowOpen();
+            const wrote = await this.writeMeta(sessionId, (before) => {
+                if (ownerRecorded(before))
+                    return undefined;
+                if (!existed || claim)
+                    return { incarnation: existed && before !== undefined ? readSessionMetaCell(before).incarnation : mintSessionIncarnation(), owner };
+                return before === undefined ? mintSessionIncarnation() : undefined;
+            });
+            if (!existed && wrote)
+                await this.repo.create({ id: sessionId });
+            if (claim && wrote)
+                this.log.info("session_owner_claimed", { sessionId });
         });
-        if (!existed && wrote)
-            await this.repo.create({ id: sessionId });
-        if (claim && wrote)
-            this.log.info("session_owner_claimed", { sessionId });
     }
     async ownerOf(sessionId) {
         const meta = await this.metaOf(sessionId);
@@ -569,7 +621,7 @@ export class LocalSessionStore {
         return gen();
     }
     async importEntries(sessionId, owner, entries) {
-        await this.importEntriesAs(sessionId, owner, entries, mintSessionIncarnation());
+        await this.withSessionWriteLock(sessionId, () => this.importEntriesAs(sessionId, owner, entries, mintSessionIncarnation()));
     }
     async importEntriesAs(sessionId, owner, entries, incarnation) {
         if (!this.repo.importEntries)
@@ -579,6 +631,9 @@ export class LocalSessionStore {
         await this.writeMeta(sessionId, () => ({ incarnation, owner }));
     }
     async replaceEntries(sessionId, owner, entries) {
+        await this.withSessionWriteLock(sessionId, () => this.replaceEntriesHeld(sessionId, owner, entries));
+    }
+    async replaceEntriesHeld(sessionId, owner, entries) {
         if (!this.repo.importEntries)
             throw new SessionError("storage", "session import is not supported by this local backend");
         if (!this.repo.delete)
@@ -586,7 +641,7 @@ export class LocalSessionStore {
         validateEntriesForImport(entries);
         const current = await this.metaOf(sessionId);
         const prior = current === undefined ? undefined : { owner: current.owner ?? null, incarnation: current.incarnation };
-        await this.deleteSession(sessionId, owner);
+        await this.deleteSessionHeld(sessionId, owner);
         await this.importEntriesAs(sessionId, owner, entries, carriedIncarnation(prior, owner));
     }
     beginImportStaging(realSessionId, token) {
@@ -600,7 +655,36 @@ export class LocalSessionStore {
     forgetStaging(stagingId) {
         this.stagings.delete(stagingId);
     }
+    async commitStagedImport(sessionId, owner, staged, opts) {
+        return this.withSessionWriteLock(sessionId, async () => {
+            const dstEntries = await this.exportEntries(sessionId);
+            const rel = classifySyncRelationshipByIds(staged.map((e) => e.id), dstEntries === null ? null : dstEntries.map((e) => e.id));
+            if ((rel.relation === "fork" || rel.relation === "stale") && opts?.resolution !== "overwrite-dst") {
+                throw new SyncConflictError(sessionId, rel);
+            }
+            if (rel.relation === "fast_forward" && opts?.resolution !== "overwrite-dst" && dstEntries !== null && dstEntries.length > 0) {
+                const dstSet = new Set(dstEntries.map((e) => e.id));
+                const diverged = fastForwardSharedContentDiverged(staged.filter((e) => dstSet.has(e.id)), dstEntries);
+                if (diverged)
+                    throw new SyncConflictError(sessionId, contentForkRelation(diverged, rel.newEntryIds));
+            }
+            const contentEqual = rel.relation === "identical" && identicalIdsAlsoIdenticalContent(staged, dstEntries);
+            if (rel.relation !== "identical" || !contentEqual) {
+                await this.replaceEntriesHeld(sessionId, owner, staged);
+            }
+            else {
+                await this.restampOwner(sessionId, owner);
+            }
+            const face = await this.sessionFaceOf(sessionId);
+            if (face === undefined)
+                throw new SessionError("storage", `LocalSessionStore: staged commit for session ${sessionId} left no session face — nothing was settled`);
+            return { relation: rel.relation, face };
+        });
+    }
     async deleteSession(sessionId, owner) {
+        return this.withSessionWriteLock(sessionId, () => this.deleteSessionHeld(sessionId, owner));
+    }
+    async deleteSessionHeld(sessionId, owner) {
         const current = await this.ownerOf(sessionId);
         if (current === undefined || !ownerEq(current, owner))
             return false;
@@ -611,13 +695,13 @@ export class LocalSessionStore {
             if (!isNotFound(e))
                 throw e;
         }
-        await this.dropMeta(sessionId);
-        this.lastActivity.delete(sessionId);
-        for (const map of [this.titles, this.pinned, this.instructionSources]) {
+        for (const [map, which] of [[this.titles, "title"], [this.pinned, "pinned"], [this.instructionSources, "instruction-source"]]) {
             await map.ensureLoaded();
-            if (map.state.entries.delete(sessionId))
-                await map.persist();
+            if (!(await map.deleteKey(sessionId)))
+                throw new SessionError("storage", `LocalSessionStore: ${which} sidecar write failed while deleting session ${sessionId} — its ${which} is still on disk; retry the delete`);
         }
+        await this.dropMeta(sessionId);
+        this.lastActivity.delete(sessionId);
         this.scheduleFlush();
         return true;
     }
@@ -657,26 +741,9 @@ class LocalStagingHandle {
         return [...this.staged];
     }
     async commit(owner, opts) {
-        const dstEntries = await this.store.exportEntries(this.realSessionId);
-        const rel = classifySyncRelationshipByIds(this.staged.map((e) => e.id), dstEntries === null ? null : dstEntries.map((e) => e.id));
-        if ((rel.relation === "fork" || rel.relation === "stale") && opts?.resolution !== "overwrite-dst") {
-            throw new SyncConflictError(this.realSessionId, rel);
-        }
-        if (rel.relation === "fast_forward" && opts?.resolution !== "overwrite-dst" && dstEntries !== null && dstEntries.length > 0) {
-            const dstSet = new Set(dstEntries.map((e) => e.id));
-            const diverged = fastForwardSharedContentDiverged(this.staged.filter((e) => dstSet.has(e.id)), dstEntries);
-            if (diverged)
-                throw new SyncConflictError(this.realSessionId, contentForkRelation(diverged, rel.newEntryIds));
-        }
-        const contentEqual = rel.relation === "identical" && identicalIdsAlsoIdenticalContent(this.staged, dstEntries);
-        if (rel.relation !== "identical" || !contentEqual) {
-            await this.store.replaceEntries(this.realSessionId, owner, this.staged);
-        }
-        else {
-            await this.store.restampOwner(this.realSessionId, owner);
-        }
+        const committed = await this.store.commitStagedImport(this.realSessionId, owner, this.staged, opts);
         this.store.forgetStaging(this.stagingId);
-        return { relation: rel.relation };
+        return committed;
     }
     async abort() {
         this.staged.length = 0;

package/dist/plugins/mailbox-recipient-lifecycle.d.ts

@@ -26,7 +26,7 @@
  * 没有要求它活过丢箱。
  *
  * 🔴 **为什么这条设计比「墓碑永久 + 一个撤回动词」严格更好**(codex 对抗复审 r1 三条 [high] 之一,验真后重设计):
- * 会话 id 由调用方自选(`http/admission.ts:153` 只有长度门,`security.ts:187-199` 明写刻意不加形状门),
+ * 会话 id 由调用方提供(7.126.0 起提交面只收 canonical uuid;此前只有长度门、不加形状门),
  * 删掉之后**同一个 id 可以被重新登记**(`run-local --session myproject`、留存腿删后用户再跑同名会话)。
  * 永久墓碑于是需要一个「这个收件人回来了」的撤回口,而那个判据**在读面上判不出来** —— 会话删除级联是
  * 「子腿先、`session_meta` 最后」(E21 次序契约),所以级联在飞的那一段里,活会话行与新墓碑是**同时**

package/dist/plugins/memory-run-store.d.ts

@@ -1,7 +1,8 @@
 import { type UsageRow } from "../usage-analytics.js";
 import type { TaskStatus } from "@sema-agent/core";
-import { type CreateRunOutcome, type NewRunMeta, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
+import { type CreateRunOutcome, type NewRunMeta, type RunIdemBinding, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
+import { type SpaceCommitClaim, type SpaceCommitReading, type SpaceCommitState } from "../workspace-space-commit.js";
 /**
  * [ref] P0 — the local lane's stand-in for the SQL twins' checkpoint-table JOIN. The file/memory run stores
  * cannot JOIN `checkpoint` (separate store, separate files), so the suspended-run reapers were NO-OPs — which
@@ -31,17 +32,29 @@ export declare class MemoryRunStore {
     private readonly events;
     /** [ref] the checkpoint-table stand-in (see {@link RunStoreCheckpointProbe}); absent ⇒ reapers NO-OP. */
     private checkpointProbe?;
+    /** spaceKey → row — the twin of `workspace_space_commit` (the k8s workspace space's commit fence, `workspace-space-commit.ts`). */
+    private readonly spaceCommitRecords;
+    private readonly spaceCommits;
+    /** The k8s workspace space's commit fence rows (SQL twin: `workspace_space_commit`; the rule: `workspace-space-commit.ts`). */
+    readSpaceCommit(spaceKey: string): Promise<SpaceCommitReading | undefined>;
+    claimSpaceCommit(spaceKey: string, taskId: string, state: SpaceCommitState, claim: SpaceCommitClaim): Promise<boolean>;
+    endSpaceCommit(spaceKey: string, taskId: string): Promise<void>;
+    abandonSpaceCommit(spaceKey: string, taskId: string): Promise<boolean>;
     /** [ref] wire the checkpoint probe (backend assembly, where checkpoint + run store are built together). */
     setCheckpointProbe(probe: RunStoreCheckpointProbe): void;
     private toRecord;
     /** Create a run iff no submission key of this request names a row (idemKey first, then a caller-minted taskId —
      *  OBSERVED, see {@link CreateRunOutcome}) and the session has no active run (the task_active unique-key claim). */
     createRun(taskId: string, sessionId: string, owner: string | null, instanceId: string, meta?: NewRunMeta): Promise<CreateRunOutcome>;
-    /** Undo THIS submission's key binding (`idem_key` → NULL) — called only where the submit surface refuses the submission
+    /** Undo THIS submission's binding (key + body fingerprint → null) — called only where the submit surface refuses the submission
      *  before any work and terminalizes the row it just claimed (the sync leg's zero-work refusal, a device-placement reject):
      *  the error answer invites a retry, and a retry with the same key must run, not replay the refusal. The row stays (it
-     *  is the refusal's record); only the key is freed. */
+     *  is the refusal's record); only the binding is freed. */
     releaseIdemKey(taskId: string): Promise<void>;
+    /** The body fingerprint this row's binding of `idem.key` holds — binding `idem.bodyFingerprint` first when it holds none (first
+     *  arrival binds, everyone after reads; the twin of the SQL conditional UPDATE). `null` = no such row, or the row is not bound to
+     *  this key (never written). */
+    bindIdemBodyFingerprint(taskId: string, idem: RunIdemBinding): Promise<string | null>;
     /** The run a submission's scoped `Idempotency-Key` names, if any. */
     getRunByIdem(idemKey: string): Promise<RunRecord | undefined>;
     requestCancel(taskId: string, owner: string | null): Promise<boolean>;
@@ -56,6 +69,9 @@ export declare class MemoryRunStore {
     /** [ref] FIRST terminal writer wins(SQL 孪生同款正向 CAS on running/suspended/needs_review,
      *  [1.207 codex M1] 负向形漏 blocked/timeout);claim 释放保持无条件(幂等)。 */
     setTerminal(taskId: string, status: TaskStatus, result: PersistedTaskResult | null, error: string | null): Promise<void>;
+    /** The terminal write's one synchronous section (SQL twin: one transaction): the k8s space's pending commit row (when
+     *  offered) → the terminal row → the active-run slot release. Returns whether the pending row is now this run's. */
+    private writeTerminal;
     /** Durable F4: park NON-terminal `suspended`, KEEP the task_active claim. CAS on running/suspended (reaper-revert guard).
      *  S-173:同时落 `result` —— 封口脱敏后的投影(`sealRunRowResult`,凭据不落;`null` = 没观察到 park 结果),SQL 孪生同注。 */
     setSuspended(taskId: string, result: PersistedTaskResult | null): Promise<void>;

package/dist/plugins/memory-run-store.js

@@ -3,6 +3,7 @@ import { outwardPlane } from "../terminal.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
 import { RUN_HOLDER_DEATH_CODES, RUN_STALLED_ERROR } from "./store-contracts.js";
 import { notifyRunTerminal } from "../observability/run-terminal.js";
+import { createInProcessSpaceCommitTable, fenceSpaceCommitAtTerminal } from "../workspace-space-commit.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 export class MemoryRunStore {
     runs = new Map();
@@ -10,6 +11,24 @@ export class MemoryRunStore {
     byIdem = new Map();
     events = new Map();
     checkpointProbe;
+    spaceCommitRecords = new Map();
+    spaceCommits = createInProcessSpaceCommitTable({
+        load: (spaceKey) => this.spaceCommitRecords.get(spaceKey),
+        save: (record) => void this.spaceCommitRecords.set(record.spaceKey, record),
+        remove: (spaceKey) => void this.spaceCommitRecords.delete(spaceKey),
+    });
+    readSpaceCommit(spaceKey) {
+        return this.spaceCommits.readSpaceCommit(spaceKey);
+    }
+    claimSpaceCommit(spaceKey, taskId, state, claim) {
+        return this.spaceCommits.claimSpaceCommit(spaceKey, taskId, state, claim);
+    }
+    endSpaceCommit(spaceKey, taskId) {
+        return this.spaceCommits.endSpaceCommit(spaceKey, taskId);
+    }
+    abandonSpaceCommit(spaceKey, taskId) {
+        return this.spaceCommits.abandonSpaceCommit(spaceKey, taskId);
+    }
     setCheckpointProbe(probe) {
         this.checkpointProbe = probe;
     }
@@ -32,7 +51,7 @@ export class MemoryRunStore {
         };
     }
     async createRun(taskId, sessionId, owner, instanceId, meta = {}) {
-        const idemKey = meta.idemKey ?? null;
+        const idemKey = meta.idem?.key ?? null;
         const byKey = idemKey !== null ? this.byIdem.get(idemKey) : undefined;
         const existing = (byKey !== undefined ? this.runs.get(byKey) : undefined) ?? this.runs.get(taskId);
         if (existing)
@@ -55,6 +74,7 @@ export class MemoryRunStore {
             instanceId,
             objectivePreview: meta.objectivePreview ?? null,
             idemKey,
+            idemBodyFingerprint: meta.idem?.bodyFingerprint ?? null,
             createdAt: now,
             updatedAt: now,
             cancelRequested: false,
@@ -66,12 +86,22 @@ export class MemoryRunStore {
     }
     async releaseIdemKey(taskId) {
         const r = this.runs.get(taskId);
-        if (!r || r.idemKey === null)
+        if (!r)
+            return;
+        r.idemBodyFingerprint = null;
+        if (r.idemKey === null)
             return;
         if (this.byIdem.get(r.idemKey) === taskId)
             this.byIdem.delete(r.idemKey);
         r.idemKey = null;
     }
+    async bindIdemBodyFingerprint(taskId, idem) {
+        const r = this.runs.get(taskId);
+        if (!r || r.idemKey !== idem.key)
+            return null;
+        r.idemBodyFingerprint ??= idem.bodyFingerprint;
+        return r.idemBodyFingerprint;
+    }
     async getRunByIdem(idemKey) {
         const taskId = this.byIdem.get(idemKey);
         const r = taskId !== undefined ? this.runs.get(taskId) : undefined;
@@ -128,8 +158,12 @@ export class MemoryRunStore {
             .map((e) => ({ ...e, data: e.data == null ? null : structuredClone(e.data) }));
     }
     async setTerminal(taskId, status, result, error) {
+        await fenceSpaceCommitAtTerminal(taskId, async (spaceCommit) => this.writeTerminal(taskId, status, result, error, spaceCommit));
+    }
+    writeTerminal(taskId, status, result, error, spaceCommit) {
         result = sealRunRowResult(result);
         error = error === null ? null : (redactErrorMessage(error) ?? null);
+        const fenced = spaceCommit !== undefined && this.spaceCommits.claimSync(spaceCommit.spaceKey, taskId, "pending", spaceCommit.claim);
         const r = this.runs.get(taskId);
         if (!r) {
             for (const [sessionId, tid] of this.active)
@@ -137,7 +171,7 @@ export class MemoryRunStore {
                     this.active.delete(sessionId);
                     break;
                 }
-            return;
+            return fenced;
         }
         let pending;
         if (r.status === "running" || r.status === "suspended" || r.status === "needs_review") {
@@ -162,6 +196,7 @@ export class MemoryRunStore {
             this.active.delete(r.sessionId);
         if (pending)
             notifyRunTerminal(pending);
+        return fenced;
     }
     async setSuspended(taskId, result) {
         const sealed = sealRunRowResult(result);