@sema-agent/server 7.146.0 → 7.148.0

package/dist/plugins/memory-engine-sql-apply.js

@@ -94,7 +94,7 @@ async function planSqlPatch(patch, reads, baseline, claims, unstorableReason, su
             kind: "add",
             stored,
             rev: computeEntryRev(stored),
-            prior: prior !== undefined ? { scope: prior.scope, slug: prior.slug } : undefined,
+            prior: prior !== undefined ? { scope: prior.scope, slug: prior.slug, rev: patch.guard === "absent" ? prior.rev : undefined } : undefined,
             frontmatter: entry.frontmatter,
             suffixAt: n,
             landings,
@@ -138,6 +138,9 @@ async function planSqlPatch(patch, reads, baseline, claims, unstorableReason, su
         return conflict({ op: "update", id: patch.id, reason: unstorableReason });
     }
     const moves = current.scope !== entry.scope || current.slug !== entry.slug;
+    if (moves && (suffixFrom > FIRST_SUFFIX_STEP || (await reads.idsAt(entry.scope, entry.slug)).some((holder) => holder !== patch.id))) {
+        return conflict({ op: "update", id: patch.id, reason: `update target ${JSON.stringify(`${entry.scope}/${entry.slug}`)} is held by another entry (unique (scope, slug)); not written` });
+    }
     return {
         kind: "update",
         entry,
@@ -145,6 +148,7 @@ async function planSqlPatch(patch, reads, baseline, claims, unstorableReason, su
         currentRev: current.rev,
         current: at,
         baseRev: patch.baseRev,
+        suffixAt: FIRST_SUFFIX_STEP,
         landings: [...(moves ? [{ id: patch.id, ...at }] : []), { id: entry.id, scope: entry.scope, slug: entry.slug }],
     };
 }
@@ -187,13 +191,8 @@ async function predictLandings(patches, from, duplicateAt, reads, unstorableReas
         if (duplicateAt.has(i))
             continue;
         let plan;
-        let targetHeld = false;
         try {
             plan = await planSqlPatch(patches[i], view, scratchBaseline, scratchClaims, unstorableReason, suffixFloor.get(i) ?? FIRST_SUFFIX_STEP);
-            if (plan.kind === "update") {
-                const { id, scope, slug } = plan.entry;
-                targetHeld = (await view.idsAt(scope, slug)).some((holder) => holder !== id);
-            }
         }
         catch {
             continue;
@@ -206,8 +205,7 @@ async function predictLandings(patches, from, duplicateAt, reads, unstorableReas
             scratchClaims.add(slugKey(plan.stored.scope, plan.stored.slug));
         }
         else if (plan.kind === "update") {
-            if (!targetHeld)
-                overlay.set(plan.entry.id, { scope: plan.entry.scope, slug: plan.entry.slug, rev: plan.rev, frontmatter: plan.entry.frontmatter });
+            overlay.set(plan.entry.id, { scope: plan.entry.scope, slug: plan.entry.slug, rev: plan.rev, frontmatter: plan.entry.frontmatter });
         }
         else {
             overlay.set(plan.id, null);
@@ -302,7 +300,7 @@ export async function applySqlPatches(patches, opts, leg) {
                         report.conflicts.push(outcome.conflict);
                         return [];
                     case "slug-taken":
-                        if (plan.kind === "add")
+                        if (plan.kind !== "delete")
                             suffixFloor.set(k, plan.suffixAt + 1);
                         continue;
                     case "moved":

package/dist/plugins/memory-engine-tidb.d.ts

@@ -27,7 +27,7 @@ export interface TiDBMemoryEngineBackendOptions {
      *  entry plane itself is deliberately NON-transactional (single-statement CAS is the correctness
      *  mechanism), and the Pg twin's bare-PgQueryFn seam cannot cheaply transact — wrapping only the
      *  TiDB side would fork the twins' semantics. Chosen trade-off on BOTH dialects: entry write commits
-     *  first, history append is BEST-EFFORT (failure = swallow + console.warn) — history is the AUDIT
+     *  first, history append is BEST-EFFORT (failure = swallow + a log-seam warn line) — history is the AUDIT
      *  face, not the correctness face: a lost history row loses an audit line, never data. */
     history?: {
         appendHistory(rows: readonly MemoryHistoryAppendRow[]): Promise<void>;
@@ -67,11 +67,14 @@ export declare class TiDBMemoryEngineBackend implements MemoryBackend {
     private freshRow;
     /**
      * add:拆成「计划时有行 ⇒ UPDATE by id / 没有 ⇒ INSERT」(见文件头:MySQL 的 ON DUPLICATE KEY UPDATE 会被 `(scope, slug)` 键抢占、改写他人行,
-     * 禁用)。UPDATE 腿只覆盖仍在计划投影上的行;零 AFFECTED 行 ⇒ 现读:行没了 = 被并发删掉 ⇒ 转 INSERT 腿、同一拼写(改前同);
-     * 行在别处 ⇒ `moved`;行还在计划的投影上且已是这一份内容 = 匹配但值逐字相同(连接未开 FOUND_ROWS 时只数改动行)⇒ 已落;
-     * 行还在计划的投影上却不是这一份内容 = 判与现读之间行被挪走又挪回 ⇒ 响亮抛(记成这一条的 io error 冲突,与 PG 孪生同答)。INSERT 腿的 ER_DUP_ENTRY 按键名分诊:
-     * PRIMARY = 同 id 的行在判与写之间被别的副本插入 ⇒ `moved`(驱动器按现状重判,guard / 跨 scope 拒照判);`uq_…scope_slug` = 名在计划之后
-     * 被占 ⇒ `slug-taken`。每次重发写语句前都调 confirm(它是检查,幂等)。
+     * 禁用)。UPDATE 腿只覆盖仍在计划投影上的行,add-if-absent 再绑计划读到的 rev(与 PG 孪生同一条件);零 AFFECTED 行 ⇒ 现读:行没了 = 被并发
+     * 删掉 ⇒ 转 INSERT 腿、同一拼写(改前同);行在别处、或(绑了 rev 时)已被改写 ⇒ `moved`(驱动器按现状重判:add-if-absent 照判);行仍满足写条件且
+     * 已是这一份内容 = 匹配但值逐字相同(连接未开 FOUND_ROWS 时只数改动行)⇒ 已落;仍满足写条件却不是这一份内容 = 判与现读之间行被改走又改回
+     * ⇒ 响亮抛(记成这一条的 io error 冲突,与 PG 孪生同答)。ER_DUP_ENTRY 按**现读**分诊,不按报文里的键名:INSERT 腿撞键之后这个 id 的行在 ⇒
+     * 同 id 的行在判与写之间被别的副本插入 ⇒ `moved`(驱动器按现状重判,guard / 跨 scope 拒照判;与 PG 孪生 `ON CONFLICT (id)` 的仲裁同答);不在 ⇒
+     * 名在计划之后被占 ⇒ `slug-taken`;UPDATE 腿按 id 改、只撞得上 `(scope, slug)` ⇒ `slug-taken`。键名不可作判据:对手以同 id **同拼写**插入时
+     * 两只唯一键同时撞上,引擎报哪一只由它自己定(TiDB 报 `uq_…scope_slug`)—— 按键名会把「同 id 已在」读成「名被占」、退到 `-2` 拼写去覆盖。
+     * 每次重发写语句前都调 confirm(它是检查,幂等)。
      */
     private writeAdd;
     /** update:条件 = 判过的 rev **且**判过的投影(rev 是内容哈希、不含 scope / slug)。零 AFFECTED 行 ⇒ 这一条的 CAS 按 **rev** 判(core 契约:stale
@@ -81,7 +84,9 @@ export declare class TiDBMemoryEngineBackend implements MemoryBackend {
      *    这是零行唯一能是 applied 的形 —— 目标 rev 与判过的 rev 不同的 update 一定改动行(rev 列本身变了),零行即未匹配;
      *    行被对手改走又改回判过的 rev 时,按 rev 它没变过(与 File 腿的比对、与共享判里「A→B→A 让 stale baseRev 重新当前」同一读法),这一条本来就是什么都没改 ⇒ 照样已落;
      *  · 内容未变而投影变了 = `moved`;其余 = CAS 冲突,`currentRev` 报现值。
-     *  🔴 行存在性是承重的:判与写之间行被并发删掉时 affectedRows 也是 0,现读对没了的行答 undefined ⇒ 落冲突(逐字相同的 update 也一样),两方言同答。 */
+     *  🔴 行存在性是承重的:判与写之间行被并发删掉时 affectedRows 也是 0,现读对没了的行答 undefined ⇒ 落冲突(逐字相同的 update 也一样),两方言同答。
+     *  撞唯一键(ER_DUP_ENTRY):主键 `id` 不变,能撞的只有 `(scope, slug)` —— 目标名在判之后被别的 id 占了 ⇒ `slug-taken`(与 add 口、PG 孪生同一结局词;
+     *  驱动器重判,判当场判成冲突)。 */
     private writeUpdate;
     /** delete:条件同 update;DELETE 的 affectedRows 数的是删掉的行(FOUND_ROWS 只影响 UPDATE):0 = 行变了 / 挪了 / 没了。 */
     private writeDelete;

package/dist/plugins/memory-engine-tidb.js

@@ -1,3 +1,4 @@
+import { writeLogText } from "../observability/logger.js";
 import { jaccardDistance, termSet } from "@sema-agent/core";
 import { readFrontmatterColumn } from "./memory-engine-vector-util.js";
 import { decodeJsonColumn, foldJsonColumn, jsonColumnText } from "./sql-json-column.js";
@@ -37,9 +38,6 @@ export async function ensureTiDBMemoryEngineSchema(pool) {
     await ensureIndexes((text, params) => pool.query(text, params), "mysql", MEMORY_ENGINE_INDEXES);
 }
 const isDupEntry = isMysqlDupKeyError;
-function isPrimaryKeyDup(err) {
-    return isDupEntry(err) && /for key '[^']*PRIMARY'/i.test(String(err.message ?? ""));
-}
 const AT_PLANNED_PROJECTION = "CAST(scope AS BINARY) = CAST(? AS BINARY) AND CAST(slug AS BINARY) = CAST(? AS BINARY)";
 function inPlaceholders(count) {
     return Array.from({ length: count }, () => "?").join(", ");
@@ -182,19 +180,19 @@ export class TiDBMemoryEngineBackend {
         for (;;) {
             try {
                 if (overwrite !== undefined) {
-                    const params = [stored.scope, stored.slug, JSON.stringify(stored.frontmatter), stored.body, rev, this.clock(), sizeBytes, stored.id, overwrite.scope, overwrite.slug];
+                    const params = [stored.scope, stored.slug, JSON.stringify(stored.frontmatter), stored.body, rev, this.clock(), sizeBytes, stored.id, ...(overwrite.rev !== undefined ? [overwrite.rev] : []), overwrite.scope, overwrite.slug];
                     confirm();
-                    const res = await this.write(`UPDATE ${T} SET scope = ?, slug = ?, frontmatter = ?, body = ?, rev = ?, mtime_ms = ?, size_bytes = ?, embedding = NULL WHERE id = ? AND ${AT_PLANNED_PROJECTION}`, params);
+                    const res = await this.write(`UPDATE ${T} SET scope = ?, slug = ?, frontmatter = ?, body = ?, rev = ?, mtime_ms = ?, size_bytes = ?, embedding = NULL WHERE id = ? AND ${overwrite.rev !== undefined ? "rev = ? AND " : ""}${AT_PLANNED_PROJECTION}`, params);
                     if (res.affectedRows === 0) {
                         const fresh = await this.freshRow(stored.id);
                         if (fresh === undefined) {
                             overwrite = undefined;
                             continue;
                         }
-                        if (fresh.scope !== overwrite.scope || fresh.slug !== overwrite.slug)
+                        if (fresh.scope !== overwrite.scope || fresh.slug !== overwrite.slug || (overwrite.rev !== undefined && fresh.rev !== overwrite.rev))
                             return { kind: "moved" };
                         if (fresh.rev !== rev) {
-                            throw new Error(`memory-engine: the add of ${JSON.stringify(stored.id)} wrote no row, yet the row is still at the planned projection with other content — refusing to report it either way`);
+                            throw new Error(`memory-engine: the add of ${JSON.stringify(stored.id)} wrote no row, yet the row still meets the write condition with other content — refusing to report it either way`);
                         }
                     }
                 }
@@ -207,7 +205,9 @@ export class TiDBMemoryEngineBackend {
             catch (err) {
                 if (!isDupEntry(err))
                     throw err;
-                return isPrimaryKeyDup(err) ? { kind: "moved" } : { kind: "slug-taken" };
+                if (overwrite !== undefined)
+                    return { kind: "slug-taken" };
+                return (await this.freshRow(stored.id)) !== undefined ? { kind: "moved" } : { kind: "slug-taken" };
             }
             return { kind: "committed" };
         }
@@ -215,7 +215,15 @@ export class TiDBMemoryEngineBackend {
     async writeUpdate({ entry, rev, currentRev, current, baseRev }, _prepared, confirm) {
         const params = [entry.scope, entry.slug, JSON.stringify(entry.frontmatter), entry.body, rev, this.clock(), Buffer.byteLength(serializeEntryFile(entry), "utf8"), entry.id, currentRev, current.scope, current.slug];
         confirm();
-        const res = await this.write(`UPDATE ${TIDB_MEMORY_ENGINE_TABLES.entry} SET scope = ?, slug = ?, frontmatter = ?, body = ?, rev = ?, mtime_ms = ?, size_bytes = ?, embedding = NULL WHERE id = ? AND rev = ? AND ${AT_PLANNED_PROJECTION}`, params);
+        let res;
+        try {
+            res = await this.write(`UPDATE ${TIDB_MEMORY_ENGINE_TABLES.entry} SET scope = ?, slug = ?, frontmatter = ?, body = ?, rev = ?, mtime_ms = ?, size_bytes = ?, embedding = NULL WHERE id = ? AND rev = ? AND ${AT_PLANNED_PROJECTION}`, params);
+        }
+        catch (err) {
+            if (isDupEntry(err))
+                return { kind: "slug-taken" };
+            throw err;
+        }
         if (res.affectedRows > 0)
             return { kind: "committed" };
         const fresh = await this.freshRow(entry.id);
@@ -245,7 +253,7 @@ export class TiDBMemoryEngineBackend {
         }
         catch (err) {
             this.historyRowsLost += rows.length;
-            console.warn(`TiDBMemoryEngineBackend: best-effort history append failed (${rows.length} row(s) lost, ${this.historyRowsLost} cumulative — audit face only, entries committed): ${err instanceof Error ? err.message : String(err)}`);
+            writeLogText("stderr", `TiDBMemoryEngineBackend: best-effort history append failed (${rows.length} row(s) lost, ${this.historyRowsLost} cumulative — audit face only, entries committed): ${err instanceof Error ? err.message : String(err)}`);
         }
     }
     async getConsolidationCursor(scope) {

package/dist/plugins/memory-optout-grant-store-sql.d.ts

@@ -6,7 +6,7 @@
  *
  * ── 数据形([ref] §1.1 的施工形;**稿偏离如实记**)────────────────────────────────────────────────
  * [ref] 稿写的是 `PRIMARY KEY (org_id, principal)` + `principal=''` 为 org 级缺省哨兵行。亲读本仓
- * (侦察 2026-08-30):server **没有 org 身份维** —— 租户维 = 单 `principal`(`gatedPrincipal` 供给),
+ * (侦察 2026-08-30):server **没有 org 身份维** —— 租户维 = 单 `principal`(`gatedSubject` 供给),
  * `org` 只是记忆 scope 目录里的一个词(`org-memory-admission.ts`:授权目录三态,不是 principal 的属性),
  * 任何 SQL 表都没有 `org_id` 列。给表铸一根没人能填的 `org_id` 就是编数据(「不编」律)。所以:
  *   · **一台 worker = 一个租户面**,稿中「org 级缺省行」落成**部署级缺省行**(同一哨兵 `principal=''`);

package/dist/plugins/memory-optout-grant-store-sql.js

@@ -1,5 +1,5 @@
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
-import { RESERVED_PRINCIPALS, RESERVED_PRINCIPAL_PREFIXES } from "../security.js";
+import { PRINCIPAL_MAX_BYTES, RESERVED_PRINCIPALS, RESERVED_PRINCIPAL_PREFIXES } from "../principal-shape.js";
 export const MEMORY_OPTOUT_GRANT_TABLE = "memory_optout_grant";
 export const MEMORY_OPTOUT_DEFAULT_PRINCIPAL = "";
 export function buildMemoryOptOutVerdict(rows, principal) {
@@ -16,8 +16,8 @@ export function buildMemoryOptOutVerdict(rows, principal) {
 export function memoryOptOutPrincipalShapeProblem(principal) {
     if (principal.length === 0)
         return "principal is empty (the empty string is the deployment-default sentinel row, not an addressable principal)";
-    if (principal.length > 190)
-        return "principal exceeds the 190-char column width";
+    if (Buffer.byteLength(principal, "utf8") > PRINCIPAL_MAX_BYTES)
+        return `principal exceeds ${PRINCIPAL_MAX_BYTES} UTF-8 bytes (the principal length every identity column holds)`;
     if (/^\s|\s$/u.test(principal))
         return "principal has leading/trailing whitespace (rejected at the boundary: MySQL-protocol PAD SPACE collation would fold it onto another principal's row)";
     if (/[\u0000-\u001f\u007f]/u.test(principal))

package/dist/plugins/memory-run-store.d.ts

@@ -1,6 +1,6 @@
 import { type UsageRow } from "../usage-analytics.js";
 import type { TaskStatus } from "@sema-agent/core";
-import { type FenceLanded, type FencedRun, type InProcessClaimFence, type CreateRunOutcome, type NewRunMeta, type RunIdemBinding, type RunListQuery, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef, type SettledLegMemoryObservation } from "./store-contracts.js";
+import { type RunStallWiring, type SessionRootRows, type FenceLanded, type FencedRun, type InProcessClaimFence, type CreateRunOutcome, type NewRunMeta, type RunIdemBinding, type RunListQuery, type RunRecord, type SessionRunRollup, type RunEvent, type PersistedTaskResult, type LatestRunRef, type SettledLegMemoryObservation } from "./store-contracts.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 import { type SpaceCommitClaim, type SpaceCommitReading, type SpaceCommitState } from "../workspace-space-commit.js";
 /**
@@ -35,6 +35,17 @@ export declare class MemoryRunStore implements InProcessClaimFence {
     /** spaceKey → row — the twin of `workspace_space_commit` (the k8s workspace space's commit fence, `workspace-space-commit.ts`). */
     private readonly spaceCommitRecords;
     private readonly spaceCommits;
+    /**
+     * 规则 L 的根行面(可选;文件孪生同形同读法,见 `FileRunStore` 的同名字段):在场 ⇒ `createRun` 先在它的锁里判根行在不在(不在 ⇒ `sessionAbsent`),再认领 ——
+     * 测试装配「内存 run 店 + 同一只 local 会话店」的撤回与认领因此排在同一把根锁上。缺席(只测 run 店、或配引擎内存会话店的装配:那种店没有根行)⇒ 不判根行,行为与修前同。
+     */
+    private readonly rootRows;
+    /** 落死亡判决的窗与计数(构造时拿到;SQL 孪生同注,见 {@link RunStallWiring})。 */
+    private readonly stall;
+    constructor(opts?: {
+        readonly rootRows?: () => SessionRootRows;
+        readonly stall?: RunStallWiring;
+    });
     /** The k8s workspace space's commit fence rows (SQL twin: `workspace_space_commit`; the rule: `workspace-space-commit.ts`). */
     readSpaceCommit(spaceKey: string): Promise<SpaceCommitReading | undefined>;
     claimSpaceCommit(spaceKey: string, taskId: string, state: SpaceCommitState, claim: SpaceCommitClaim): Promise<boolean>;
@@ -46,6 +57,15 @@ export declare class MemoryRunStore implements InProcessClaimFence {
     /** Create a run iff no submission key of this request names a row (idemKey first, then a caller-minted taskId —
      *  OBSERVED, see {@link CreateRunOutcome}) and the session has no active run (the task_active unique-key claim). */
     createRun(taskId: string, sessionId: string, owner: string | null, instanceId: string, meta?: NewRunMeta): Promise<CreateRunOutcome>;
+    /** {@link createRun} 的认领一半(根行已判过在 —— 或本店不接根行面)。同步判、同步写(没有让出点:两只并发认领不交错)。 */
+    private createRunClaimed;
+    /**
+     * 提交出口条件撤回的 run 半(`local-session-store.ts` 的 `SessionRunWithdrawSource`;文件孪生同名方法同判序):本会话有 `ownTaskId` 之外的 run 行 ⇒ `{ keep: "runs" }`;
+     * 否则删本次 run(事件 / 幂等键 / 行)。调用方持根行锁 —— 不取锁、不让出事件循环。`ownTaskId` 那一行不属于这只会话 ⇒ 响亮抛。
+     */
+    withdrawRunsOf(sessionId: string, ownTaskId: string | undefined): "proceed" | {
+        readonly keep: "runs";
+    };
     /** Undo THIS submission's binding (key + body fingerprint → null) — called only where the submit surface refuses the submission
      *  before any work and terminalizes the row it just claimed (the sync leg's zero-work refusal, an execution-placement reject):
      *  the error answer invites a retry, and a retry with the same key must run, not replay the refusal. The row stays (it
@@ -63,7 +83,8 @@ export declare class MemoryRunStore implements InProcessClaimFence {
     isCancelRequested(taskId: string, owner: string | null): Promise<boolean>;
     requestPreempt(taskId: string, owner: string | null): Promise<boolean>;
     isPreemptRequested(taskId: string, owner: string | null): Promise<boolean>;
-    heartbeat(taskId: string, owner: string | null): Promise<void>;
+    /** 心跳:刷新并交回「行还在 running 吗」(持有者据它停腿;SQL 孪生同注)。 */
+    heartbeat(taskId: string, owner: string | null): Promise<boolean>;
     appendEvent(taskId: string, seq: number, type: LedgerEventType, data: unknown): Promise<void>;
     maxSeq(taskId: string): Promise<number>;
     retainedFrom(taskId: string): Promise<number>;
@@ -91,7 +112,7 @@ export declare class MemoryRunStore implements InProcessClaimFence {
     listRuns(opts: RunListQuery): Promise<RunRecord[]>;
     /**
      * [ref] —— 这个会话**最近一条腿**的窄指针({@link SqlRunStore.latestRunForSession} 的孪生:同一个排序口径
-     *  `createdAt DESC, taskId DESC`,与本店 {@link MemoryRunStore.listSessions} 挑 `rn=1` 那一行的比较器逐字同一份)。
+     *  `createdAt DESC, taskId DESC`,与本店窄读面 {@link MemoryRunStore.sessionRunRollups} 挑最新一条的比较器同一口径 —— `session-run-rollup.ts` 的 `newer`)。
      */
     latestRunForSession(sessionId: string): Promise<LatestRunRef | undefined>;
     /**
@@ -99,32 +120,17 @@ export declare class MemoryRunStore implements InProcessClaimFence {
      * {@link SqlRunStore.latestMemoryObservationForSession} 的孪生:同一只已结谓词(`isTerminalRunStatus`)、同一个排序口径 —— 与本店 {@link MemoryRunStore.latestRunForSession} 的比较器逐字同一份)。
      */
     latestMemoryObservationForSession(sessionId: string): Promise<SettledLegMemoryObservation | undefined>;
-    /** DISTINCT sessions newest-first by last activity (the CC /resume picker): latest run's preview/status + first/last/count. */
-    listSessions(opts: {
-        owner?: string;
-        includeUnowned?: boolean;
-        cursor?: {
-            lastActivityAt: string;
-            sessionId: string;
-        };
-        limit: number;
-        q?: string;
-    }): Promise<SessionSummary[]>;
+    /** 会话枚举面读 run 账的窄读面(`SessionRunRollupSource`;规则 = 共用纯函数 {@link buildSessionRunRollups},与文件孪生、SQL 会话店的列表子查询同读)。 */
+    sessionRunRollups(opts?: {
+        readonly q?: string;
+    }): Promise<ReadonlyMap<string, SessionRunRollup>>;
     /**
      * E21 (§0.5 delete) — purge the runs ledger for one session, scoped by `session_id` ALONE (per-row owner is the
-     * submitting principal and diverges from the session owner — full 判据 see the SQL twin's head-note, F-A);
-     * aborts (returns {active}) if a run is live.
-     *
-     * `expectedSessionOwner` 是 SQL 双生的**化身围栏**入参(事务内复核 `session_meta.owner`,防「A 验权后 A' 删完、
-     * 别人用同一 uuid 重新登记」那一形)。本孪生**执行不了**它:local 车道的会话表在另一只店里,这只账本没有
-     * session_meta 可读 —— 参数只作契约对齐(签名不齐会让 RunStore 联合类型的调用点直接不可调)。local 的替代
-     * 围栏是两条:①协调器在本调用**紧前**复读一次 canonical owner(不齐即整条中止);②数据根的独占 BootLock
-     * 保证一个数据根恒一个进程,交错只可能发生在同进程的 await 缝里。这条不对称是**明写**的,不是遗漏。
+     * submitting principal and diverges from the session owner — full 判据 see the SQL twin's head-note, F-A)。
+     * **不判认领**:与 File / SQL 孪生同一条(唯一调用点 = 删除协调器的账本腿,围栏之后才调;律在 `src/session-deletion.ts`)。
      */
-    deleteBySession(sessionId: string, expectedSessionOwner: string | null): Promise<{
+    deleteBySession(sessionId: string): Promise<{
         removed: number;
-    } | {
-        active: string;
     }>;
     /** 用量扫窗——in-memory 腿:遍历窗内行,投影同 usage-analytics 纯函数(SQL 孪生 parity)。 */
     usageScan(fromMs: number, toMs: number, opts?: {
@@ -139,8 +145,14 @@ export declare class MemoryRunStore implements InProcessClaimFence {
         status: string;
         count: number;
     }>>;
-    /** Fail stale `running` rows (crashed-run backstop) + release task_active for any now-terminal row. */
-    reapStale(olderThanMs: number): Promise<number>;
+    /** 收割器(全表形;SQL 孪生同注):心跳过期的 `running` 行判死 + 放掉终局行的认领。窗读构造时拿到的 getter。 */
+    reapStale(): Promise<number>;
+    /** 死亡判决的那一笔(收割器 / 观察口 / 认领冲突同一只;SQL 孪生的 `landStallVerdicts`):行 `due` ⇒ 翻 `failed`(`run.stalled`)、交回 `true`;否则不动。认领由调用方放。 */
+    private landStallVerdict;
+    /** 认领冲突的持有者落判决(SQL 孪生同判):`due` ⇒ 判死、放它的认领、交回 `true`(调用方照常认领)。 */
+    private settleDueHolder;
+    /** 观察口(落判决的三处之一;SQL 孪生同注):属主门之后的那条行 —— `due` ⇒ 判死、放认领、交回当前行;否则原样。 */
+    observeRun(row: RunRecord): Promise<RunRecord>;
     /** [ref] shared tail of both suspended-run reapers: flip one parked row → failed('approval.expired'), the
      *  in-memory twin of the SQL UPDATE (`error`/`error_code` set directly — no result blob to derive from; [ref]: the park-time `result` is cleared, same as the SQL `result = NULL`). */
     private failExpiredPark;

package/dist/plugins/memory-run-store.js

@@ -1,7 +1,8 @@
-import { redactErrorMessage, redactLedgerEventData, sealRunRowResult } from "../observability/run-terminal.js";
+import { redactErrorMessage, redactLedgerEventData, runRowErrorCodeOf, sealRunRowResult } from "../observability/run-terminal.js";
 import { outwardPlane } from "../terminal.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
-import { RUN_HOLDER_DEATH_CODES, RUN_STALLED_ERROR, isTerminalRunStatus, settledLegObservationOf } from "./store-contracts.js";
+import { RUN_HOLDER_DEATH_CODES, RUN_STALLED_ERROR, RUN_STALL_DEFAULT_WIRING, isTerminalRunStatus, runLivenessOf, settledLegObservationOf } from "./store-contracts.js";
+import { buildSessionRunRollups } from "./session-run-rollup.js";
 import { notifyRunTerminal } from "../observability/run-terminal.js";
 import { createInProcessSpaceCommitTable, fenceSpaceCommitAtTerminal } from "../workspace-space-commit.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
@@ -17,6 +18,12 @@ export class MemoryRunStore {
         save: (record) => void this.spaceCommitRecords.set(record.spaceKey, record),
         remove: (spaceKey) => void this.spaceCommitRecords.delete(spaceKey),
     });
+    rootRows;
+    stall;
+    constructor(opts) {
+        this.rootRows = opts?.rootRows;
+        this.stall = opts?.stall ?? RUN_STALL_DEFAULT_WIRING;
+    }
     readSpaceCommit(spaceKey) {
         return this.spaceCommits.readSpaceCommit(spaceKey);
     }
@@ -52,13 +59,19 @@ export class MemoryRunStore {
         };
     }
     async createRun(taskId, sessionId, owner, instanceId, meta = {}) {
+        const rootRows = this.rootRows;
+        if (rootRows === undefined)
+            return this.createRunClaimed(taskId, sessionId, owner, instanceId, meta);
+        return rootRows().withRootRow(sessionId, async (present) => (present ? this.createRunClaimed(taskId, sessionId, owner, instanceId, meta) : { ok: false, sessionAbsent: true }));
+    }
+    createRunClaimed(taskId, sessionId, owner, instanceId, meta) {
         const idemKey = meta.idem?.key ?? null;
         const byKey = idemKey !== null ? this.byIdem.get(idemKey) : undefined;
         const existing = (byKey !== undefined ? this.runs.get(byKey) : undefined) ?? this.runs.get(taskId);
         if (existing)
             return { ok: false, existing: this.toRecord(existing) };
         const claimed = this.active.get(sessionId);
-        if (claimed !== undefined)
+        if (claimed !== undefined && !this.settleDueHolder(claimed))
             return { ok: false, activeTaskId: claimed };
         const now = new Date();
         this.active.set(sessionId, taskId);
@@ -86,6 +99,21 @@ export class MemoryRunStore {
             this.byIdem.set(idemKey, taskId);
         return { ok: true };
     }
+    withdrawRunsOf(sessionId, ownTaskId) {
+        for (const r of this.runs.values())
+            if (r.sessionId === sessionId && r.taskId !== ownTaskId)
+                return { keep: "runs" };
+        const own = ownTaskId === undefined ? undefined : this.runs.get(ownTaskId);
+        if (own === undefined)
+            return "proceed";
+        if (own.sessionId !== sessionId)
+            throw new Error(`MemoryRunStore.withdrawRunsOf: run ${ownTaskId} belongs to session ${own.sessionId}, not ${sessionId} — refusing to delete it`);
+        this.events.delete(own.taskId);
+        if (own.idemKey !== null && this.byIdem.get(own.idemKey) === own.taskId)
+            this.byIdem.delete(own.idemKey);
+        this.runs.delete(own.taskId);
+        return "proceed";
+    }
     async releaseIdemKey(taskId) {
         const r = this.runs.get(taskId);
         if (!r)
@@ -141,6 +169,7 @@ export class MemoryRunStore {
         const r = this.runs.get(taskId);
         if (r && ownerEq(r.owner, owner) && r.status === "running")
             r.updatedAt = new Date();
+        return r !== undefined && r.status === "running";
     }
     async appendEvent(taskId, seq, type, data) {
         data = redactLedgerEventData(type, data);
@@ -186,7 +215,7 @@ export class MemoryRunStore {
             r.status = status;
             r.result = result;
             r.error = error;
-            r.errorCode = result === null ? null : (outwardPlane(result.terminal).errorCode ?? null);
+            r.errorCode = runRowErrorCodeOf(result);
             r.updatedAt = new Date();
             pending = {
                 runId: taskId,
@@ -212,6 +241,7 @@ export class MemoryRunStore {
         if (r && (r.status === "running" || r.status === "suspended")) {
             r.status = "suspended";
             r.result = sealed;
+            r.errorCode = runRowErrorCodeOf(sealed);
             r.updatedAt = new Date();
         }
     }
@@ -221,6 +251,7 @@ export class MemoryRunStore {
         if (r && (r.status === "running" || r.status === "needs_review")) {
             r.status = "needs_review";
             r.result = sealed;
+            r.errorCode = runRowErrorCodeOf(sealed);
             r.updatedAt = new Date();
         }
     }
@@ -230,6 +261,7 @@ export class MemoryRunStore {
             return false;
         r.status = "running";
         r.result = null;
+        r.errorCode = null;
         r.instanceId = instanceId;
         r.cancelRequested = false;
         r.preemptRequested = false;
@@ -289,62 +321,10 @@ export class MemoryRunStore {
         }
         return latest === undefined ? undefined : settledLegObservationOf(latest.taskId, latest.result);
     }
-    async listSessions(opts) {
-        const bySession = new Map();
-        for (const r of this.runs.values()) {
-            if (opts.owner !== undefined && r.owner !== opts.owner && !(opts.includeUnowned === true && r.owner === null))
-                continue;
-            const arr = bySession.get(r.sessionId) ?? [];
-            arr.push(r);
-            bySession.set(r.sessionId, arr);
-        }
-        const cursorAt = opts.cursor ? Date.parse(opts.cursor.lastActivityAt) : undefined;
-        const qlc = opts.q?.toLowerCase();
-        const summaries = [];
-        for (const [sessionId, arr] of bySession) {
-            if (qlc && !arr.some((r) => r.objectivePreview?.toLowerCase().includes(qlc)))
-                continue;
-            const sorted = [...arr].sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime() || (a.taskId < b.taskId ? 1 : a.taskId > b.taskId ? -1 : 0));
-            const latest = sorted[0];
-            const latestRunId = latest.result?.runId;
-            let last = -Infinity;
-            let first = Infinity;
-            for (const r of arr) {
-                const t = r.createdAt.getTime();
-                if (t > last)
-                    last = t;
-                if (t < first)
-                    first = t;
-            }
-            summaries.push({
-                sessionId,
-                owner: latest.owner,
-                lastActivityAt: new Date(last).toISOString(),
-                firstActivityAt: new Date(first).toISOString(),
-                runCount: arr.length,
-                objectivePreview: latest.objectivePreview,
-                lastStatus: latest.status,
-                lastRunId: latest.taskId,
-                ...(typeof latestRunId === "string" && latestRunId !== "" ? { lastTaskRunId: latestRunId } : {}),
-                title: null,
-                pinned: false,
-            });
-        }
-        return summaries
-            .filter((s) => {
-            if (cursorAt === undefined)
-                return true;
-            const t = Date.parse(s.lastActivityAt);
-            return t < cursorAt || (t === cursorAt && s.sessionId < opts.cursor.sessionId);
-        })
-            .sort((a, b) => Date.parse(b.lastActivityAt) - Date.parse(a.lastActivityAt) || (a.sessionId < b.sessionId ? 1 : a.sessionId > b.sessionId ? -1 : 0))
-            .slice(0, opts.limit);
+    async sessionRunRollups(opts = {}) {
+        return buildSessionRunRollups(this.runs.values(), opts);
     }
-    async deleteBySession(sessionId, expectedSessionOwner) {
-        void expectedSessionOwner;
-        const claimed = this.active.get(sessionId);
-        if (claimed !== undefined)
-            return { active: claimed };
+    async deleteBySession(sessionId) {
         let removed = 0;
         for (const [taskId, r] of [...this.runs]) {
             if (r.sessionId !== sessionId)
@@ -384,22 +364,44 @@ export class MemoryRunStore {
         }
         return [...counts.values()];
     }
-    async reapStale(olderThanMs) {
-        const cutoff = Date.now() - olderThanMs;
+    async reapStale() {
+        const nowMs = Date.now();
+        const windowMs = this.stall.windowMs();
         let reaped = 0;
-        for (const r of this.runs.values()) {
-            if (r.status === "running" && r.updatedAt.getTime() < cutoff) {
-                r.status = "failed";
-                r.result = null;
-                r.error = RUN_STALLED_ERROR;
-                r.errorCode = RUN_HOLDER_DEATH_CODES.stalled;
-                r.updatedAt = new Date();
+        for (const r of this.runs.values())
+            if (this.landStallVerdict(r, nowMs, windowMs))
                 reaped += 1;
-            }
-        }
         this.releaseTerminalClaims();
+        if (reaped > 0)
+            this.stall.onVerdicts(reaped);
         return reaped;
     }
+    landStallVerdict(r, nowMs, windowMs) {
+        if (runLivenessOf(this.toRecord(r), nowMs, windowMs) !== "due")
+            return false;
+        r.status = "failed";
+        r.result = null;
+        r.error = RUN_STALLED_ERROR;
+        r.errorCode = RUN_HOLDER_DEATH_CODES.stalled;
+        r.updatedAt = new Date();
+        return true;
+    }
+    settleDueHolder(holderTaskId) {
+        const r = this.runs.get(holderTaskId);
+        if (r === undefined || !this.landStallVerdict(r, Date.now(), this.stall.windowMs()))
+            return false;
+        if (this.active.get(r.sessionId) === holderTaskId)
+            this.active.delete(r.sessionId);
+        this.stall.onVerdicts(1);
+        return true;
+    }
+    async observeRun(row) {
+        const r = this.runs.get(row.taskId);
+        if (r === undefined || runLivenessOf(row, Date.now(), this.stall.windowMs()) !== "due")
+            return row;
+        this.settleDueHolder(row.taskId);
+        return this.toRecord(r);
+    }
     failExpiredPark(r) {
         r.status = "failed";
         r.result = null;

package/dist/plugins/one-time-migration-marker.d.ts

@@ -0,0 +1,10 @@
+/**
+ * **一次性迁移的标记表**(SQL 两方言)—— 需要「这一库上这一条已经判过 / 落过」这一事实的迁移各在这里记一行(键 = 登记表里的那一条名,`plugins/one-time-migrations.ts`)。
+ * 表由用到它的那一步自己建(不进中央建表语句:它随最后一条读它的迁移删码,库里留下的空表无人读,起服列册对账只核本树声明的表)。最后一条读它的迁移删码时,本文件一起删。
+ */
+import type { SqlDialect } from "./sql-driver.js";
+/** 标记表名。 */
+export declare const MIGRATION_MARKER_TABLE = "one_time_migration_marker";
+/** 标记表的建表句(两方言;幂等)。 */
+export declare function migrationMarkerDdl(dialect: SqlDialect): string;
+//# sourceMappingURL=one-time-migration-marker.d.ts.map

package/dist/plugins/one-time-migration-marker.js

@@ -0,0 +1,7 @@
+export const MIGRATION_MARKER_TABLE = "one_time_migration_marker";
+export function migrationMarkerDdl(dialect) {
+    return dialect === "mysql"
+        ? `CREATE TABLE IF NOT EXISTS ${MIGRATION_MARKER_TABLE} (migration_id VARCHAR(16) NOT NULL PRIMARY KEY, marked_at_ms BIGINT NOT NULL)`
+        : `CREATE TABLE IF NOT EXISTS ${MIGRATION_MARKER_TABLE} (migration_id VARCHAR(16) COLLATE "C" NOT NULL PRIMARY KEY, marked_at_ms BIGINT NOT NULL)`;
+}
+//# sourceMappingURL=one-time-migration-marker.js.map