@sema-agent/server 7.146.0 → 7.148.0

package/dist/plugins/file-run-store.js

@@ -1,14 +1,19 @@
-import { redactErrorMessage, redactLedgerEventData, sealRunRowResult } from "../observability/run-terminal.js";
-import { outwardPlane } from "../terminal.js";
+import { SCENARIO_SUBJECT_PREFIX } from "../owner-brands.js";
+import { redactErrorMessage, redactLedgerEventData, runRowErrorCodeOf, sealRunRowResult } from "../observability/run-terminal.js";
+import { outwardPlane, persistedPlaneOf } from "../terminal.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
 import { join } from "node:path";
-import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync } from "node:fs";
+import { closeSync, existsSync, fsyncSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync } from "node:fs";
+import { IS_WIN32 } from "./host-platform.js";
 import { randomBytes } from "node:crypto";
 import { AppendLog, atomicWriteFile, ensureDir, isProcessLive, processFingerprint, sanitizePathComponent, sanitizeScope, writeThenLink } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
 import { joinFromStore, splitForStore } from "./wiring-section-codec.js";
-import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR, StoreBootRefusalError, buildRunOrphanedError, isTerminalRunStatus, settledLegObservationOf } from "./store-contracts.js";
+import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR, RUN_STALL_DEFAULT_WIRING, RUN_STALL_VERDICT_UNLANDED_TAG, StoreBootRefusalError, runLivenessOf, buildRunOrphanedError, isTerminalRunStatus, settledLegObservationOf } from "./store-contracts.js";
+import { buildSessionRunRollups } from "./session-run-rollup.js";
+import { normalizedRunPreviewM45 } from "./run-preview-m45.js";
+import { SHELL_SENTINEL_OWNER_M48 } from "./shell-sentinel-owner-m48.js";
 import { notifyRunTerminal } from "../observability/run-terminal.js";
 import { readRunIdentityCells, runIdentityCells } from "../identity-source.js";
 import { createInProcessSpaceCommitTable, fenceSpaceCommitAtTerminal, SPACE_COMMIT_RECORD_SCHEMA } from "../workspace-space-commit.js";
@@ -58,6 +63,9 @@ const PARK_ORPHAN_SETTLE_MS = 30_000;
 export class RunStoreStrictHydrateError extends StoreBootRefusalError {
     name = "RunStoreStrictHydrateError";
 }
+export function fileRunStoreDirsFor(root) {
+    return { runs: join(root, "runs"), active: join(root, "runs", "active"), tmp: join(root, "tmp"), spaceCommits: join(root, "space-commits") };
+}
 export class FileRunStore {
     runsDir;
     activeDir;
@@ -77,19 +85,24 @@ export class FileRunStore {
     claimOwner = { nonce: randomBytes(12).toString("hex"), ...processFingerprint() };
     claimLocks = new Map();
     logger;
+    rootRows;
     strictHydrate;
+    stall;
     constructor(root, opts) {
         this.logger = opts;
-        this.strictHydrate = opts?.strictHydrate === true;
-        this.runsDir = join(root, "runs");
-        this.activeDir = join(root, "runs", "active");
-        this.tmpDir = join(root, "tmp");
+        this.stall = opts.stall ?? RUN_STALL_DEFAULT_WIRING;
+        this.rootRows = opts.rootRows;
+        this.strictHydrate = opts.strictHydrate === true;
+        const dirs = fileRunStoreDirsFor(root);
+        this.runsDir = dirs.runs;
+        this.activeDir = dirs.active;
+        this.tmpDir = dirs.tmp;
         this.blobsDir = join(root, "run-blobs");
-        this.spaceCommitsDir = join(root, "space-commits");
+        this.spaceCommitsDir = dirs.spaceCommits;
         this.spaceCommits = createInProcessSpaceCommitTable({
             load: (spaceKey) => this.loadSpaceCommit(spaceKey),
             save: (record) => {
-                mkdirSync(this.spaceCommitsDir, { recursive: true });
+                ensureDir(this.spaceCommitsDir);
                 atomicWriteFile(this.tmpDir, this.spaceCommitPath(record.spaceKey), `${JSON.stringify(record)}\n`);
             },
             remove: (spaceKey) => rmSync(this.spaceCommitPath(spaceKey), { force: true }),
@@ -353,17 +366,21 @@ export class FileRunStore {
         }
     }
     writeRunFile(r) {
-        mkdirSync(this.runDir(r.taskId), { recursive: true });
+        ensureDir(this.runDir(r.taskId));
         atomicWriteFile(this.tmpDir, this.runJsonPath(r.taskId), `${JSON.stringify(this.toDisk(r))}\n`);
     }
-    persist(r) {
-        this.writeRunFile(r);
-        this.runs.set(r.taskId, r);
+    persist(draft) {
+        this.writeRunFile(draft);
+        const live = this.runs.get(draft.taskId);
+        if (live === undefined)
+            this.runs.set(draft.taskId, draft);
+        else
+            Object.assign(live, draft);
     }
     eventLogFor(taskId) {
         let log = this.eventLogs.get(taskId);
         if (!log) {
-            mkdirSync(this.runDir(taskId), { recursive: true });
+            ensureDir(this.runDir(taskId));
             log = new AppendLog(this.eventsPath(taskId));
             this.eventLogs.set(taskId, log);
         }
@@ -371,13 +388,17 @@ export class FileRunStore {
     }
     async createRun(taskId, sessionId, owner, instanceId, meta = {}) {
         const idemKey = meta.idem?.key ?? null;
-        return this.withClaimLock(sessionId, async () => {
-            const acquired = await this.acquireClaim(sessionId, taskId);
-            if (!acquired.ok) {
-                const existing = this.submittedRow(taskId, idemKey);
-                return existing ? { ok: false, existing: this.toRecord(existing) } : acquired;
-            }
-            return this.commitNewRun(taskId, sessionId, owner, instanceId, meta, idemKey);
+        return this.rootRows().withRootRow(sessionId, async (present) => {
+            if (!present)
+                return { ok: false, sessionAbsent: true };
+            return this.withClaimLock(sessionId, async () => {
+                const acquired = await this.acquireClaim(sessionId, taskId);
+                if (!acquired.ok) {
+                    const existing = this.submittedRow(taskId, idemKey);
+                    return existing ? { ok: false, existing: this.toRecord(existing) } : acquired;
+                }
+                return this.commitNewRun(taskId, sessionId, owner, instanceId, meta, idemKey);
+            });
         });
     }
     submittedRow(taskId, idemKey) {
@@ -434,15 +455,13 @@ export class FileRunStore {
         const r = this.runs.get(taskId);
         if (!r || r.objectivePreview !== null)
             return;
-        this.writeRunFile({ ...r, objectivePreview: preview });
-        r.objectivePreview = preview;
+        this.persist({ ...r, objectivePreview: preview });
     }
     async requestCancel(taskId, owner) {
         const r = this.runs.get(taskId);
         if (!r || !ownerEq(r.owner, owner) || r.status !== "running")
             return false;
-        r.cancelRequested = true;
-        this.persist(r);
+        this.persist({ ...r, cancelRequested: true });
         return true;
     }
     async isCancelRequested(taskId, owner) {
@@ -453,8 +472,7 @@ export class FileRunStore {
         const r = this.runs.get(taskId);
         if (!r || !ownerEq(r.owner, owner) || r.status !== "running")
             return false;
-        r.preemptRequested = true;
-        this.persist(r);
+        this.persist({ ...r, preemptRequested: true });
         return true;
     }
     async isPreemptRequested(taskId, owner) {
@@ -463,10 +481,9 @@ export class FileRunStore {
     }
     async heartbeat(taskId, owner) {
         const r = this.runs.get(taskId);
-        if (r && ownerEq(r.owner, owner) && r.status === "running") {
-            r.updatedAt = new Date();
-            this.persist(r);
-        }
+        if (r && ownerEq(r.owner, owner) && r.status === "running")
+            this.persist({ ...r, updatedAt: new Date() });
+        return r !== undefined && r.status === "running";
     }
     async appendEvent(taskId, seq, type, data) {
         data = redactLedgerEventData(type, data);
@@ -569,12 +586,8 @@ export class FileRunStore {
         }
         let pending;
         if (r.status === "running" || r.status === "suspended" || r.status === "needs_review") {
-            r.status = status;
-            r.result = result;
-            r.error = error;
-            r.errorCode = result === null ? null : (outwardPlane(result.terminal).errorCode ?? null);
-            r.updatedAt = new Date();
-            this.persist(r);
+            const errorCode = runRowErrorCodeOf(result);
+            this.persist({ ...r, status, result, error, errorCode, updatedAt: new Date() });
             pending = {
                 runId: taskId,
                 sessionId: r.sessionId,
@@ -582,7 +595,7 @@ export class FileRunStore {
                 status,
                 resultTaskId: result?.taskId,
                 model: result?.model,
-                errorCode: r.errorCode ?? undefined,
+                errorCode: errorCode ?? undefined,
                 errorMessage: (result === null ? undefined : outwardPlane(result.terminal).errorMessage) ?? error ?? undefined,
                 elapsedMs: Math.max(0, Date.now() - r.createdAt.getTime()),
             };
@@ -597,33 +610,30 @@ export class FileRunStore {
         const sealed = sealRunRowResult(result);
         const r = this.runs.get(taskId);
         if (r && (r.status === "running" || r.status === "suspended")) {
-            r.status = "suspended";
-            r.result = sealed;
-            r.updatedAt = new Date();
-            this.persist(r);
+            this.persist({ ...r, status: "suspended", result: sealed, errorCode: runRowErrorCodeOf(sealed), updatedAt: new Date() });
         }
     }
     async setNeedsReview(taskId, result) {
         const sealed = sealRunRowResult(result);
         const r = this.runs.get(taskId);
         if (r && (r.status === "running" || r.status === "needs_review")) {
-            r.status = "needs_review";
-            r.result = sealed;
-            r.updatedAt = new Date();
-            this.persist(r);
+            this.persist({ ...r, status: "needs_review", result: sealed, errorCode: runRowErrorCodeOf(sealed), updatedAt: new Date() });
         }
     }
     async markResuming(taskId, instanceId) {
         const r = this.runs.get(taskId);
         if (!r || (r.status !== "suspended" && r.status !== "needs_review"))
             return false;
-        r.status = "running";
-        r.result = null;
-        r.instanceId = instanceId;
-        r.cancelRequested = false;
-        r.preemptRequested = false;
-        r.updatedAt = new Date();
-        this.persist(r);
+        this.persist({
+            ...r,
+            status: "running",
+            result: null,
+            errorCode: null,
+            instanceId,
+            cancelRequested: false,
+            preemptRequested: false,
+            updatedAt: new Date(),
+        });
         return true;
     }
     async getActiveTaskId(sessionId) {
@@ -633,8 +643,7 @@ export class FileRunStore {
         const r = this.runs.get(taskId);
         if (this.active.get(sessionId) !== taskId || r === undefined || r.status !== "running")
             return false;
-        r.updatedAt = new Date();
-        this.persist(r);
+        this.persist({ ...r, updatedAt: new Date() });
         write({ instanceId: r.instanceId });
         return true;
     }
@@ -702,62 +711,10 @@ export class FileRunStore {
         }
         return latest === undefined ? undefined : settledLegObservationOf(latest.taskId, latest.result);
     }
-    async listSessions(opts) {
-        const bySession = new Map();
-        for (const r of this.runs.values()) {
-            if (opts.owner !== undefined && r.owner !== opts.owner && !(opts.includeUnowned === true && r.owner === null))
-                continue;
-            const arr = bySession.get(r.sessionId) ?? [];
-            arr.push(r);
-            bySession.set(r.sessionId, arr);
-        }
-        const cursorAt = opts.cursor ? Date.parse(opts.cursor.lastActivityAt) : undefined;
-        const qlc = opts.q?.toLowerCase();
-        const summaries = [];
-        for (const [sessionId, arr] of bySession) {
-            if (qlc && !arr.some((r) => r.objectivePreview?.toLowerCase().includes(qlc)))
-                continue;
-            const sorted = [...arr].sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime() || (a.taskId < b.taskId ? 1 : a.taskId > b.taskId ? -1 : 0));
-            const latest = sorted[0];
-            const latestRunId = latest.result?.runId;
-            let last = -Infinity;
-            let first = Infinity;
-            for (const r of arr) {
-                const t = r.createdAt.getTime();
-                if (t > last)
-                    last = t;
-                if (t < first)
-                    first = t;
-            }
-            summaries.push({
-                sessionId,
-                owner: latest.owner,
-                lastActivityAt: new Date(last).toISOString(),
-                firstActivityAt: new Date(first).toISOString(),
-                runCount: arr.length,
-                objectivePreview: latest.objectivePreview,
-                lastStatus: latest.status,
-                lastRunId: latest.taskId,
-                ...(typeof latestRunId === "string" && latestRunId !== "" ? { lastTaskRunId: latestRunId } : {}),
-                title: null,
-                pinned: false,
-            });
-        }
-        return summaries
-            .filter((s) => {
-            if (cursorAt === undefined)
-                return true;
-            const t = Date.parse(s.lastActivityAt);
-            return t < cursorAt || (t === cursorAt && s.sessionId < opts.cursor.sessionId);
-        })
-            .sort((a, b) => Date.parse(b.lastActivityAt) - Date.parse(a.lastActivityAt) || (a.sessionId < b.sessionId ? 1 : a.sessionId > b.sessionId ? -1 : 0))
-            .slice(0, opts.limit);
-    }
-    async deleteBySession(sessionId, expectedSessionOwner) {
-        void expectedSessionOwner;
-        const claimed = this.active.get(sessionId);
-        if (claimed !== undefined)
-            return { active: claimed };
+    async sessionRunRollups(opts = {}) {
+        return buildSessionRunRollups(this.runs.values(), opts);
+    }
+    async deleteBySession(sessionId) {
         this.dropSectionBlobs(sessionId);
         let removed = 0;
         for (const [taskId, r] of [...this.runs]) {
@@ -806,21 +763,45 @@ export class FileRunStore {
         let reaped = 0;
         for (const r of this.runs.values()) {
             if (r.status === "running" && pred(r)) {
-                r.status = "failed";
-                r.result = null;
-                r.error = reason;
-                r.errorCode = code;
-                r.updatedAt = new Date();
-                this.persist(r);
+                this.persist({
+                    ...r,
+                    status: "failed",
+                    result: null,
+                    error: reason,
+                    errorCode: code,
+                    updatedAt: new Date(),
+                });
                 reaped += 1;
             }
         }
         this.sweepClaims();
         return reaped;
     }
-    async reapStale(olderThanMs) {
-        const cutoff = Date.now() - olderThanMs;
-        return this.reapRunning((r) => r.updatedAt.getTime() < cutoff, RUN_STALLED_ERROR, RUN_HOLDER_DEATH_CODES.stalled);
+    async reapStale() {
+        const nowMs = Date.now();
+        const windowMs = this.stall.windowMs();
+        const reaped = this.reapRunning((r) => runLivenessOf(this.toRecord(r), nowMs, windowMs) === "due", RUN_STALLED_ERROR, RUN_HOLDER_DEATH_CODES.stalled);
+        if (reaped > 0)
+            this.stall.onVerdicts(reaped);
+        return reaped;
+    }
+    async observeRun(row) {
+        const nowMs = Date.now();
+        const windowMs = this.stall.windowMs();
+        if (runLivenessOf(row, nowMs, windowMs) !== "due")
+            return row;
+        let landed = 0;
+        try {
+            landed = this.reapRunning((r) => r.taskId === row.taskId && runLivenessOf(this.toRecord(r), nowMs, windowMs) === "due", RUN_STALLED_ERROR, RUN_HOLDER_DEATH_CODES.stalled);
+        }
+        catch (err) {
+            recordFailOpen(RUN_STALL_VERDICT_UNLANDED_TAG, err instanceof Error ? err.message : String(err));
+            return row;
+        }
+        if (landed > 0)
+            this.stall.onVerdicts(landed);
+        const r = this.runs.get(row.taskId);
+        return r ? this.toRecord(r) : row;
     }
     async reclaimOrphanedAtBoot(isResumable) {
         const orphans = [];
@@ -829,12 +810,14 @@ export class FileRunStore {
                 orphans.push(r);
         }
         for (const r of orphans) {
-            r.status = "failed";
-            r.result = null;
-            r.error = RUN_ORPHANED_ERROR;
-            r.errorCode = RUN_HOLDER_DEATH_CODES.orphaned;
-            r.updatedAt = new Date();
-            this.persist(r);
+            this.persist({
+                ...r,
+                status: "failed",
+                result: null,
+                error: RUN_ORPHANED_ERROR,
+                errorCode: RUN_HOLDER_DEATH_CODES.orphaned,
+                updatedAt: new Date(),
+            });
         }
         this.sweepClaims();
         return orphans.length;
@@ -843,12 +826,14 @@ export class FileRunStore {
         this.checkpointProbe = probe;
     }
     failExpiredPark(r) {
-        r.status = "failed";
-        r.result = null;
-        r.error = "approval expired before decision";
-        r.errorCode = "approval.expired";
-        r.updatedAt = new Date();
-        this.persist(r);
+        this.persist({
+            ...r,
+            status: "failed",
+            result: null,
+            error: "approval expired before decision",
+            errorCode: "approval.expired",
+            updatedAt: new Date(),
+        });
     }
     async reapSuspended(olderThanMs) {
         const probe = this.checkpointProbe;
@@ -961,7 +946,19 @@ export class FileRunStore {
                 const verdict = await this.judgeClaim(sessionId, claim, holder);
                 if (verdict.kind === "live")
                     return { ok: false, activeTaskId: verdict.holderTaskId ?? holder };
-                this.takeOverClaim(sessionId, verdict.reason, verdict.snapshot, verdict.code);
+                const stalled = verdict.code === RUN_HOLDER_DEATH_CODES.stalled;
+                let taken;
+                try {
+                    taken = this.takeOverClaim(sessionId, verdict.reason, verdict.snapshot, verdict.code);
+                }
+                catch (e) {
+                    if (!stalled)
+                        throw e;
+                    recordFailOpen(RUN_STALL_VERDICT_UNLANDED_TAG, e instanceof Error ? e.message : String(e));
+                    return { ok: false, activeTaskId: verdict.snapshot.taskId || holder };
+                }
+                if (taken && stalled)
+                    this.stall.onVerdicts(1);
             }
         }
         try {
@@ -1019,6 +1016,8 @@ export class FileRunStore {
                 return live();
             return { kind: "stale", reason: `parked run (${row.status}) has no resumable checkpoint — claim reclaimed`, snapshot };
         }
+        if (row && runLivenessOf(this.toRecord(row), Date.now(), this.stall.windowMs()) === "due")
+            return { kind: "stale", reason: RUN_STALLED_ERROR, snapshot, code: RUN_HOLDER_DEATH_CODES.stalled };
         const mine = owner?.nonce === this.claimOwner.nonce;
         const ownerGone = owner !== undefined && !isProcessLive(owner);
         if (!mine && !ownerGone)
@@ -1051,7 +1050,7 @@ export class FileRunStore {
         if (row?.status !== snapshot.status || row?.updatedAt.getTime() !== snapshot.updatedAtMs)
             return false;
         if (row && (row.status === "running" || row.status === "suspended" || row.status === "needs_review")) {
-            this.persist({ ...row, status: "failed", error: reason, ...(code !== undefined ? { errorCode: code } : {}), updatedAt: new Date() });
+            this.persist({ ...row, status: "failed", result: null, error: reason, errorCode: code ?? null, updatedAt: new Date() });
         }
         const quarantine = join(this.tmpDir, `stale-claim.${sanitizePathComponent(sessionId)}.${process.pid}.${randomBytes(6).toString("hex")}`);
         try {
@@ -1093,23 +1092,79 @@ export class FileRunStore {
             }
             this.eventLogs.delete(taskId);
         }
+        const dir = this.runDir(taskId);
+        rmSync(dir, { recursive: true, force: true });
+        if (!IS_WIN32 && existsSync(this.runsDir)) {
+            const fd = openSync(this.runsDir, "r");
+            try {
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+        }
         this.events.delete(taskId);
         const dropped = this.runs.get(taskId);
         if (dropped?.idemKey != null && this.byIdem.get(dropped.idemKey) === taskId)
             this.byIdem.delete(dropped.idemKey);
         this.runs.delete(taskId);
-        const dir = this.runDir(taskId);
-        if (existsSync(dir)) {
-            try {
-                rmSync(dir, { recursive: true, force: true });
-            }
-            catch {
-            }
+    }
+    withdrawRunsOf(sessionId, ownTaskId) {
+        for (const r of this.runs.values())
+            if (r.sessionId === sessionId && r.taskId !== ownTaskId)
+                return { keep: "runs" };
+        const own = ownTaskId === undefined ? undefined : this.runs.get(ownTaskId);
+        if (own !== undefined && own.sessionId !== sessionId)
+            throw new Error(`FileRunStore.withdrawRunsOf: run ${ownTaskId} belongs to session ${own.sessionId}, not ${sessionId} — refusing to delete it`);
+        this.dropSectionBlobs(sessionId);
+        if (own !== undefined)
+            this.dropRun(own.taskId);
+        return "proceed";
+    }
+    migrateRunErrorCodeColumnM44() {
+        let migrated = 0;
+        for (const r of this.runs.values()) {
+            const target = r.status === "running" ? null : r.result === null ? r.errorCode : (persistedPlaneOf(r.result).errorCode ?? r.errorCode);
+            if (target === r.errorCode)
+                continue;
+            this.persist({ ...r, errorCode: target });
+            migrated += 1;
+        }
+        return migrated;
+    }
+    migrateRunObjectivePreviewM45() {
+        let migrated = 0;
+        for (const r of this.runs.values()) {
+            if (typeof r.objectivePreview !== "string")
+                continue;
+            const target = normalizedRunPreviewM45(r.objectivePreview);
+            if (target === undefined || target === r.objectivePreview)
+                continue;
+            this.persist({ ...r, objectivePreview: target });
+            migrated += 1;
         }
+        return migrated;
+    }
+    clearShellSentinelOwnersM48() {
+        let cleared = 0;
+        for (const r of this.runs.values()) {
+            if (r.owner !== SHELL_SENTINEL_OWNER_M48)
+                continue;
+            this.persist({ ...r, owner: null });
+            cleared += 1;
+        }
+        return cleared;
     }
     sessionIdsWithRuns() {
         return new Set([...this.runs.values()].map((r) => r.sessionId));
     }
+    scenarioPrefixOwnerRowsM42() {
+        let n = 0;
+        for (const r of this.runs.values())
+            if (r.owner !== null && r.owner.startsWith(SCENARIO_SUBJECT_PREFIX))
+                n += 1;
+        return n;
+    }
     dispose() {
         for (const log of [...this.eventLogs.values(), ...this.blobLogs.values()]) {
             try {

package/dist/plugins/host-platform.d.ts

@@ -32,7 +32,7 @@
  * structural tests only on mac/Linux; behavior-level bite happens on the first Windows-runner green.
  */
 import type { ChildProcess } from "node:child_process";
-import { killProcessTree, type BackgroundHardKillOutcome } from "@sema-agent/core";
+import { killProcessTree, signalProcessTree, type BackgroundHardKillOutcome } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
 /** 平台读点全仓一处(`test/host-shell-settle-order.test.ts` 源码钉);别处要平台串从这里取,不直读 Node 的平台字段。 */
 export declare const HOST_PLATFORM: NodeJS.Platform;
@@ -133,8 +133,29 @@ export declare function hardKillGroupNow(pid: number): BackgroundHardKillOutcome
  */
 export declare function killTreeSoft(pid: number): void;
 /** Graceful tree kill where the CALLER has no escalation timer of its own (currently unused by the host lane —
- *  exported for parity with core's surface; the bg driver keeps its own HOST_BG_KILL_GRACE_MS ladder). */
-export { killProcessTree };
+ *  exported for parity with core's surface; the bg driver keeps its own HOST_BG_KILL_GRACE_MS ladder).
+ *  `signalProcessTree` = ONE signal to the whole tree (POSIX: a `ps` snapshot of the descendants of `pid` + the group
+ *  signal + each descendant; win32: taskkill /T). Never throws. Its root must be a pid that is still OURS (an unreaped
+ *  child): a reaped pid may already be a stranger's, and a descendant walk from a stranger's pid kills the stranger's
+ *  children — the one caller (the command-hook ladder) guards that on the child handle. */
+export { killProcessTree, signalProcessTree };
+/**
+ * Group probe for a REAPED leader: does the group of `pid` still hold an ORIGINAL member? Ask it only after node reaped the
+ * leader (an unreaped leader keeps the pid ours — no question to ask). POSIX reads two numbers:
+ *  · `kill(-pid, 0)` — is anyone in the group;
+ *  · `kill(pid, 0)`  — is any process holding the number itself.
+ * Group empty (ESRCH) ⇒ false. Group non-empty and nobody holds the number (ESRCH) ⇒ true: the kernel never hands out a number that a
+ * process still uses as its process-group id, so the number was not recycled and the members are the original ones (Linux's pid
+ * allocator; BSD / darwin allocate the same way — inferred, not read from kernel source). Group non-empty and the number IS held
+ * (success / EPERM) ⇒ false: while an original member lived the number could not have been handed out, so every original is dead and what
+ * answers now is a stranger's new process / group — never ours, so the caller sends it nothing. EPERM on the group probe reads
+ * "non-empty" (darwin answers EPERM for a group holding only unreaped zombies, indistinguishable from a live member we may not signal:
+ * one extra shot, never a missed member); EPERM on the number probe reads "held" (the process exists, we just cannot touch it).
+ * win32 has no process group ⇒ always false (the tree is discovered only at signal time, by taskkill /T, and only from an unreaped
+ * root). Never throws. The only residual is the instant between the two probes (an original member dying and its number being
+ * recycled inside it) — microseconds, not the grace window.
+ */
+export declare function reapedLeaderGroupAlive(pid: number): boolean;
 /**
  * 登记回执 = 注销的**唯一**凭据(身份即凭据,见簿注)+ 一只幂等的注销把手。
  *

package/dist/plugins/host-platform.js

@@ -127,7 +127,21 @@ export function killTreeSoft(pid) {
     }
     process.kill(-pid, "SIGTERM");
 }
-export { killProcessTree };
+export { killProcessTree, signalProcessTree };
+export function reapedLeaderGroupAlive(pid) {
+    if (IS_WIN32)
+        return false;
+    const answers = (target) => {
+        try {
+            process.kill(target, 0);
+            return true;
+        }
+        catch (err) {
+            return err.code !== "ESRCH";
+        }
+    };
+    return answers(-pid) && !answers(pid);
+}
 const liveHostForegroundGroups = new Set();
 export function trackHostForegroundChild(pid) {
     const ticket = {

package/dist/plugins/image-bake-store-sql.js

@@ -136,6 +136,8 @@ function refusingBakeRow(read) {
 export const IMAGE_BAKE_INDEXES = [
     { table: "image_bake", name: "idx_image_bake_status", columns: ["status"] },
     { table: "image_bake", name: "idx_image_bake_created", columns: ["created_at"] },
+    { table: "image_bake", name: "uq_image_bake_idem", columns: ["idem_key"], unique: true },
+    { table: "image_bake_event", name: "uq_image_bake_event_line", columns: ["bake_id", "line_ord"], unique: true },
 ];
 export async function ensurePgImageBakeSchema(pool, poolName = "standard") {
     for (const stmt of PG_IMAGE_BAKE_SCHEMA)