@sema-agent/server 7.146.0 → 7.148.0

package/dist/plugins/run-store-sql.d.ts

@@ -2,15 +2,22 @@ import type { TaskStatus } from "@sema-agent/core";
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type UsageRow } from "../usage-analytics.js";
-import { type ClaimFenced, type CreateRunOutcome, type FencedRun, type NewRunMeta, type RunIdemBinding, type RunListQuery, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef, type SettledLegMemoryObservation } from "./store-contracts.js";
+import { type RunStallWiring, type ClaimFenced, type CreateRunOutcome, type FencedRun, type NewRunMeta, type RunIdemBinding, type RunListQuery, type RunRecord, type RunEvent, type PersistedTaskResult, type LatestRunRef, type SettledLegMemoryObservation } from "./store-contracts.js";
 import { type SqlDriver, type SqlTxConn } from "./sql-driver.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 import { type SpaceCommitClaim, type SpaceCommitReading, type SpaceCommitState } from "../workspace-space-commit.js";
-export type { RunRecord, SessionSummary, RunEvent, LatestRunRef } from "./store-contracts.js";
+export type { RunRecord, RunEvent, LatestRunRef } from "./store-contracts.js";
+/**
+ * 一次性迁移 **M44 改写半场**读 `task_run.result` 的那一口(窗口见 `plugins/one-time-migrations.ts` 登记表;随 M44 一起删):与店的读腿同一只解码
+ * ({@link decodeResultColumn},投影须经 `jsonColumnText`);读不出 ⇒ `"unreadable"`(迁移跳过那一行、码列不动 —— 店的读腿对它照旧响亮拒)。
+ */
+export declare function decodeRunResultCellM44(v: unknown, taskId: string): PersistedTaskResult | null | "unreadable";
 export declare class SqlRunStore {
     readonly db: SqlDriver;
-    /** `db` 公开只读:会话认领住在这只池背后的库里,写在认领栅栏里的店(workflow 子代决定行)读写都走它 —— 那只店的池只有这一处来源。 */
-    constructor(db: SqlDriver);
+    private readonly stall;
+    /** `db` 公开只读:会话认领住在这只池背后的库里,写在认领栅栏里的店(workflow 子代决定行)读写都走它 —— 那只店的池只有这一处来源。
+     *  `stall` = 落死亡判决的窗与计数(构造时拿到;生产装配 = `store-backend.ts` 递活配置的 getter,见 {@link RunStallWiring})。 */
+    constructor(db: SqlDriver, stall?: RunStallWiring);
     /** Pick the dialect's SQL text. Both statements stay written out at the call site ON PURPOSE. */
     private q;
     /** Dup-key classification — single owner in `sql-errors.ts` ([ref] P1-①; the old local form read
@@ -19,8 +26,10 @@ export declare class SqlRunStore {
     /** JSON column binding: TiDB stores the string verbatim; PG goes through the protocol-safe envelope
      *  (a raw NUL byte in an event payload would otherwise throw 22P05 mid-write). */
     private json;
-    /** Run statements atomically; rolls back on failure. */
+    /** Run statements atomically on a pooled connection; rolls back on failure. */
     private tx;
+    /** Run statements atomically on a connection the caller already holds (`createRun`'s claim-conflict arm: never borrow a second one); rolls back on failure. */
+    private txOn;
     /**
      * Create a run, but only if the session has no other active run (double-text guard) and no submission key
      * of this request already names a row (submission idempotency) — **atomic win or observe**.
@@ -52,6 +61,28 @@ export declare class SqlRunStore {
      * 续跑与 wake 复用 checkpoint 的会话 —— 所以零行只在「受理之后被删」这一种竞争里出现。
      */
     createRun(taskId: string, sessionId: string, owner: string | null, instanceId: string, meta?: NewRunMeta): Promise<CreateRunOutcome>;
+    /** {@link createRun} 的一次建行事务(在调用方借来的那只连接上;结局四形之一,失败回滚后原样抛)。 */
+    private createRunOn;
+    /**
+     * 认领冲突的持有者落判决(`createRun` 唯一调用;同一只连接,自动提交读 → 单行落判决事务):持有者行 `due` ⇒ 落(命中 ⇒ `true`,调用方再认领一次);
+     * `live` / 停驻 / 终局 / 表外词 / 行不在 ⇒ `false`(照答冲突)。只读判决要的两列(不过结果列的解码:一条坏结果行不许把 409 变成 500)。
+     * 落判决写失败 ⇒ F 类留痕、`false`(照答冲突,收割器下一拍补)。
+     */
+    private settleDueHolderOn;
+    /**
+     * 🔴 **死亡判决的那一句**(收割器与两处单行落判决共用一只语句构造):`running ∧ updated_at < cutoff` ⇒ `failed` / `result = NULL` / {@link RUN_STALLED_ERROR} /
+     * `error_code = run.stalled`,同一事务放认领。两种作用域:
+     *  · **全表**(`taskId` 缺席,收割器):放掉每条非活非停驻行的认领 + 孤儿认领(语义同修前);
+     *  · **单行**(`AND task_id = ?`,观察口 / 认领冲突):只有命中 1 行才 `DELETE FROM task_active WHERE task_id = ?` —— 心跳或停驻抢先赢了 CAS ⇒ 0 行 ⇒ 认领不动。
+     * 取锁序 `task_run` → `task_active`(与栅栏 / 终局写 / 收割同序)。调用方持事务(`conn` 已 `begin`)。交回命中行数。
+     */
+    private landStallVerdicts;
+    /**
+     * 🔴 **观察口**(落判决的三处之一):调用方**已经读到、已经过了属主门**的那条行(授权在判决之前:外人拿着别人的 run id 得 404 且什么都不变)。
+     * 判决不是 `due` ⇒ 原样交回、零 I/O;`due` ⇒ 单行落判决(一个事务)⇒ 事务提交之后**当前读**一次(自动提交 SELECT,不在可能拿着旧快照的事务里读)⇒ 交回。
+     * 落判决写失败 ⇒ F 类留痕({@link RUN_STALL_VERDICT_UNLANDED_TAG})+ 行原样交回(收割器下一拍补)。谁调它 = 路由闭集表 `RUN_STATE_FACES`(`http/owner-access.ts`)。
+     */
+    observeRun(row: RunRecord): Promise<RunRecord>;
     /** run 行预览的**写一次补写**(腿上装着 prompt 屏时建行不写预览,引擎交付可写的那一份之后补;律的属主 = `run-acceptance.ts`):
      *  列仍是 NULL(没建过预览)才写 —— 建行写过的、已经补过的一律不动,所以补写永远盖不掉任何一份既有预览。不碰 `updated_at`(预览不是状态变化,
      *  收割与列表的时序都不该因它移动)。行不在 ⇒ 0 行,无事。PG 臂过 `pgSanitizeText`(与建行写同一条:预览是模型可控标量)。 */
@@ -81,8 +112,10 @@ export declare class SqlRunStore {
      *  running instance calls this on a timer so a long-but-alive turn (e.g. a subagent that emits no
      *  parent events for minutes) is not mistaken for a dead instance.
      *  `owner` is the single-DB-fleet null-safe owner guard (see {@link requestCancel}); the heartbeat is
-     *  always issued by the owning instance with the run's own owner, so this only narrows, never blocks. */
-    heartbeat(taskId: string, owner: string | null): Promise<void>;
+     *  always issued by the owning instance with the run's own owner, so this only narrows, never blocks.
+     *  🔴 **交回「行还在 running 吗」**:持有者拿它决定停不停自己的腿 —— 行已被判死(观察口 / 认领冲突 / 收割器)⇒ `false` ⇒ 持有者中止(判死一条行拦不住它的执行者,
+     *  这一答补上那一半)。刷新命中 ⇒ `true`;没命中 ⇒ 再读一次状态(属主不符的心跳今天就刷不上,它的行由收割器按窗判;只在行真的不在跑时才答 `false`)。 */
+    heartbeat(taskId: string, owner: string | null): Promise<boolean>;
     /** Append one event. A single INSERT — `updated_at` (liveness) is owned by `heartbeat`, so there
      *  is no second statement to keep atomic here. */
     appendEvent(taskId: string, seq: number, type: LedgerEventType, data: unknown): Promise<void>;
@@ -224,12 +257,12 @@ export declare class SqlRunStore {
     /**
      * [ref] —— 这个会话**最近一条腿**的窄指针(`/mcp` 面板的 `lastLegMcp` 与任何「上一条 run 是谁」的读面共用)。
      *
-     * 排序口径与 {@link listSessions} 的 `rn=1` 窗函数**逐字同一句**(`created_at DESC, task_id DESC`)——
+     * 排序口径与会话店列表投影的 `rn=1` 窗函数**逐字同一句**(`created_at DESC, task_id DESC`,`session-store-sql.ts` 的 `selectListRows`)——
      * 两处答的是同一个问题「哪一条是最新的」,口径分叉会让列表面的 `lastRunId` 与本读口指向不同的 run。
      * 走的也是同一条索引路径(`idx_task_run_session_status` 的 `session_id` 前缀),所以**不新加索引**:
      * 会话内行数有界,前缀定位之后的排序只在这一小撮行上。
      *
-     * 两方言只差占位符(动态子句为零,不像 listRuns/listSessions 那样需要各自的构造器臂)。
+     * 两方言只差占位符(动态子句为零,不像 listRuns 那样需要各自的构造器臂)。
      */
     latestRunForSession(sessionId: string): Promise<LatestRunRef | undefined>;
     /**
@@ -240,24 +273,6 @@ export declare class SqlRunStore {
      * 结果列走 {@link rowToRun} 同一只解码口与同一个失败方向(读不出 ⇒ 拒,不把一条结了的腿读成「没有观测」)。
      */
     latestMemoryObservationForSession(sessionId: string): Promise<SettledLegMemoryObservation | undefined>;
-    /** GET /v1/sessions (CC /resume picker): DISTINCT sessions newest-first by last activity, keyset-paginated on
-     *  (last_activity, session_id). Aggregates task_run by session_id — one window pass picks the latest run per
-     *  session (rn=1) for the preview/status and rolls up first/last/count. Owner-scoped when set (the per-user view).
-     *  Bounded by per-tenant data today; a denormalized session table is the optimization if it ever goes hot.
-     *
-     *  🔴 Same builder divergence as {@link listRuns} — see its header note. */
-    listSessions(opts: {
-        owner?: string;
-        includeUnowned?: boolean;
-        cursor?: {
-            lastActivityAt: string;
-            sessionId: string;
-        };
-        limit: number;
-        q?: string;
-    }): Promise<SessionSummary[]>;
-    /** Shared row→summary mapper for listSessions (byte-identical between dialects). */
-    private rowToSession;
     /**
      * E21 (§0.5 session delete) — purge the service-owned RUNS LEDGER for one session: task_event (the replayable
      * event log), task_active (the single-active-run claim), and task_run (the run rows). Idempotent — returns
@@ -266,46 +281,18 @@ export declare class SqlRunStore {
      * their stores — this method owns only the runs-ledger tables. Done in one TX so a partial purge can't leak a
      * task_active claim with no run row (a permanent session lock).
      *
-     * 🔴 Scoped by `session_id` ALONE — deliberately NO per-row owner guard (F-A, 2026-08-17 合并码扫描;同一条
-     * 判断 `boot/session-faces.ts` 的 anchors 腿早就写过,run 账本这条腿当时没跟上):`task_run.owner` 是**每次
-     * 提交的 principal**,它与会话的 canonical owner 会分叉 —— 一条 `session_meta.owner = NULL` 的存量会话被
-     * 带 principal 的壳续聊后(REQUIRE_PRINCIPAL=false),新 run 行的 owner 是 `"default"`,而 DELETE 路由递进来
-     * 的是**会话行**的 owner(NULL)。行级 null-safe 属主门(`<=>` / `IS NOT DISTINCT FROM`)于是只删得掉 NULL
-     * 那批,具名那批连同它们的 task_event 全部存活 —— 而 `session_meta` 已经删了,留存腿的 sessionCandidates
-     * 再也枚举不到这棵树 ⇒ 孤儿行**没有任何清理路径**,路由却回 `{deleted:true}`。那就是一次**报成成功的
-     * 右删失效**(anchors 腿的注逐字写着这句)。删除决策的属主门在**路由层**(DELETE /v1/sessions/:id 先
-     * 经会话店唯一的按 id 读 `headOf` 取属主再比对 scope,fleet-wide 臂同门),本方法的唯一生产调用点是那条路由后面的 purge 协调器。
+     * 🔴 Scoped by `session_id` ALONE — deliberately NO per-row owner guard (F-A, 2026-08-17 合并码扫描):`task_run.owner` 是**每次提交的 principal**,与会话的
+     * canonical owner 会分叉(无主存量会话被带 principal 的壳续聊 ⇒ 新 run 行 owner `"default"`),行级属主门只删得掉一半、把具名行留成孤儿而路由答 `{deleted:true}`。
      *
-     * 🔴 **化身围栏**(`expectedSessionOwner`;codex 交叉复审 R1-[high],验真后修)—— 属主门下来了,但会话
-     * **身份**必须在同一个事务里重新确认。会话 id 由调用方自选、且删除之后**可被别人重新登记**
-     * (`register` 是 INSERT … ON DUPLICATE KEY / ON CONFLICT,老行没了就是一条新行,新 owner):于是
-     * 「路由已按 `headOf` 读到的属主验权」这句话在两只并发 purge 交错时会过期 —— A 与 A' 同时通过属主门,A' 跑完整条
-     * purge 把 meta 删掉,租户 B 用同一个 uuid 重新登记并跑完一次 run,慢半拍的 A 才走到这里 ⇒ 按 session_id
-     * 单键删就把 **B 的**行删了(修前的行级属主门恰好挡住这一形,因为 B 的行 owner≠A 的会话主)。
-     * ⇒ 事务头部 `SELECT owner FROM session_meta WHERE session_id = ? FOR UPDATE`,行不在或 owner 与路由验过的
-     * 那一位不符 ⇒ **一行不删**回 `{removed:0}`(诚实:属于调用方的那个化身已经不在了;协调器据此回
-     * `{deleted:false}`,不会拿别人的行数冒充成功)。锁序与留存腿逐字一致(先 session_meta 后 task_*),
-     * 不引入新的死锁环;锁在本事务提交时释放,其后的 checkpoint / history 两腿各自带属主门。
-     * ⚠️ 本围栏只有 SQL 双生做得到 —— File/Memory 孪生的账本里没有 session_meta(local 车道的会话表在另一只
-     * 店里),它们的同名参数因此只作**契约对齐**用,真围栏由协调器那条 pre-delete 复读 + local 数据根的
-     * 独占 BootLock(一个数据根恒一个进程)承担;逐字见 memory-run-store 的同名方法注。
-     *
-     * 🔴 Active-run re-assert INSIDE the TX (adversarial-review LOW — TOCTOU): the route's pre-purge `getActiveTaskId`
-     * 409 check is a non-transactional SELECT — a concurrent createRun can claim `task_active(session_id)` in the
-     * window between that check and this purge, then have its LIVE rows deleted here. So we re-take the no-active-run
-     * invariant transactionally: `SELECT task_id FROM task_active WHERE session_id=? FOR UPDATE` at the TOP of the TX.
-     * `FOR UPDATE` serializes against createRun's unique-key INSERT on the SAME session_id (createRun either already
-     * holds the row — we see it and abort — or blocks on our lock until commit, then fails its own unique-key claim
-     * against the now-absent row). If a claim exists we return `{ active }` (the route maps it to 409) and delete
-     * NOTHING. Returns `{ removed }` on a clean purge.
+     * **不判属主、不判认领**(会话三态,`src/session-deletion.ts`):本方法唯一的生产调用点是删除协调器,它在**围栏**之后才调 —— 围栏在根行锁里判过属主与「没有认领」、
+     * 写下了在删令牌;在删期间规则 L(认领事务锁根行读令牌)不让认领落下,于是这里没有可判的东西。协调器在调之前问过令牌仍是它的(被接管 ⇒ 不调)。
+     * 此前这里在同一事务里锁根行复核属主、锁定读 `task_active` 判认领 —— 删除路四处判活中的两处;判过之后到删行之前不挡认领,正是会话行被重建成无主行那一窗的根。
      *
      * 🔴 The multi-table DELETEs are dialect-divergent SQL FORMS (not just placeholders): TiDB's
      * `DELETE te FROM te JOIN tr ON …` vs PG's `DELETE FROM te USING tr WHERE …`.
      */
-    deleteBySession(sessionId: string, expectedSessionOwner: string | null): Promise<{
+    deleteBySession(sessionId: string): Promise<{
         removed: number;
-    } | {
-        active: string;
     }>;
     /** Per-door usage rollup (center systems-UI input): COUNT by (source,status) since a cutoff. Reads the
      *  denormalized columns only — no JSON parsing; served by full scan bounded by created_at (small windows). */
@@ -331,12 +318,10 @@ export declare class SqlRunStore {
     /** Events with seq strictly greater than `afterSeq` (use 0 for the whole stream). */
     getEvents(taskId: string, afterSeq: number): Promise<RunEvent[]>;
     /**
-     * Mark stale `running` rows as failed (best-effort recovery for runs whose instance died), then
-     * free any active-run claim whose run is no longer running (reaped here, or a terminal whose
-     * DELETE was lost). `olderThanMs` must exceed the longest expected gap between a run's events
-     * (each event refreshes `updated_at`), else a healthy slow run is wrongly reaped.
+     * 收割器(落判决的三处之一,全表形):心跳过期的 `running` 行翻 `failed`(`run.stalled`)、放掉终局行与孤儿的认领 —— 语句与观察口 / 认领冲突同一只
+     * ({@link landStallVerdicts})。窗读构造时拿到的那只 getter(`REAP_RUN_STALE_SEC`,判活窗只有这一个来源)。
      */
-    reapStale(olderThanMs: number): Promise<number>;
+    reapStale(): Promise<number>;
     /**
      * Durable F4 expiry: an approval parked beyond `olderThanMs` (the approval TTL) was never answered → fail
      * the run + RELEASE its task_active (unlock the session). Mirrors the checkpoint reaper's CAS-expire (≈ deny);
@@ -352,6 +337,9 @@ export declare class SqlRunStore {
      * opening a two-runs-one-session window. The NOT-EXISTS-pending guard (same shape as
      * failSuspendedWithExpiredCheckpoint) means this only ever reaps a row whose checkpoint is already gone/expired.
      *
+     * 卡与 run 按**归属列** `checkpoint.host_session_id` 连(兑现这张卡的那条 run 的会话;cascade 的级上卡归调用方的会话 —— 卡自己的 `session_id`
+     * 是级的对话,连不上这条 run)。两条收割腿与本地孪生的探针同一读法(`plugins/checkpoint-index-columns.ts` 的 `hostSessionOf`)。
+     *
      * 🔴 Alias-qualification divergence (kept EXPLICIT, never "fixed" to match): TiDB's SET clause QUALIFIES with
      * `tr.` (`SET tr.status = …`); PG's SET clause must NOT be alias-qualified (`SET status = …` — PG rejects
      * `SET a.col`). Both WHERE clauses use the `tr.` alias.
@@ -378,10 +366,10 @@ export declare class SqlRunStore {
 }
 /** MySQL-protocol (TiDB) binding — historical class name + ctor shape preserved. */
 export declare class TiDBRunStore extends SqlRunStore {
-    constructor(pool: MySqlPool);
+    constructor(pool: MySqlPool, stall?: RunStallWiring);
 }
 /** PostgreSQL binding — historical class name + ctor shape preserved. */
 export declare class PgRunStore extends SqlRunStore {
-    constructor(pool: PgPool);
+    constructor(pool: PgPool, stall?: RunStallWiring);
 }
 //# sourceMappingURL=run-store-sql.d.ts.map

package/dist/plugins/run-store-sql.js

@@ -1,15 +1,15 @@
-import { redactErrorMessage, redactLedgerEventData, sealRunRowResult } from "../observability/run-terminal.js";
-import { outwardPlane } from "../terminal.js";
+import { redactErrorMessage, redactLedgerEventData, runRowErrorCodeOf, sealRunRowResult } from "../observability/run-terminal.js";
+import { outwardPlane, persistedPlaneOf } from "../terminal.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
-import { escapeLike } from "./sql-escape.js";
 import { pgSanitizeText } from "./pg-safe-json.js";
 import { toIso as iso } from "./sql-row-helpers.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, foldJsonColumn, isJsonColumnBodyProblem, jsonColumnText, readJsonObjectColumn, readNonNullJsonValueColumn } from "./sql-json-column.js";
-import { RUN_HOLDER_DEATH_CODES, RUN_STALLED_ERROR, settledLegObservationOf } from "./store-contracts.js";
+import { RUN_HOLDER_DEATH_CODES, RUN_STALLED_ERROR, RUN_STALL_DEFAULT_WIRING, RUN_STALL_VERDICT_UNLANDED_TAG, isParkedRunStatus, runLivenessOf, settledLegObservationOf } from "./store-contracts.js";
 import { notifyRunTerminal, runTerminalLogLevel } from "../observability/run-terminal.js";
 import { mysqlDriver, pgDriver, dialectJsonEncoder, SQL_DB_NOW_MS, sqlDbNowMs } from "./sql-driver.js";
 import { isDupKeyError } from "./sql-errors.js";
+import { readDeletingTokenOn } from "./session-ext-table.js";
 import { readRunIdentityCells, runIdentityCells } from "../identity-source.js";
 import { decideSpaceCommitAbandon, decideSpaceCommitClaim, fenceSpaceCommitAtTerminal, spaceCommitStateOf } from "../workspace-space-commit.js";
 function runRowCols(dialect) {
@@ -20,6 +20,17 @@ const readPersistedTaskResultBody = createObjectColumnReader();
 function decodeResultColumn(v, taskId) {
     return decodeNullableJsonColumn(v, readPersistedTaskResultBody, `task_run.result for run ${taskId}`);
 }
+export function decodeRunResultCellM44(v, taskId) {
+    try {
+        return decodeResultColumn(v, taskId) ?? null;
+    }
+    catch (e) {
+        if (!isJsonColumnBodyProblem(e))
+            throw e;
+        recordFailOpen("server.run-store.m44-result-unreadable", e.message);
+        return "unreadable";
+    }
+}
 function refusing(what, read) {
     try {
         return read();
@@ -42,10 +53,19 @@ function usageResultBody(v) {
 function decodeEventDataColumn(v, taskId, seq) {
     return decodeNullableJsonColumn(v, readNonNullJsonValueColumn, `task_event.data for run ${taskId} seq ${seq}`);
 }
+function m44ErrorCodeReadSide(status, result, column) {
+    if (status === "running")
+        return null;
+    if (column !== null || !isParkedRunStatus(status))
+        return column;
+    return persistedPlaneOf(result).errorCode ?? null;
+}
 export class SqlRunStore {
     db;
-    constructor(db) {
+    stall;
+    constructor(db, stall = RUN_STALL_DEFAULT_WIRING) {
         this.db = db;
+        this.stall = stall;
     }
     q(mysql, pg) {
         return this.db.dialect === "mysql" ? mysql : pg;
@@ -58,6 +78,14 @@ export class SqlRunStore {
     }
     async tx(fn) {
         const conn = await this.db.connect();
+        try {
+            await this.txOn(conn, fn);
+        }
+        finally {
+            conn.release();
+        }
+    }
+    async txOn(conn, fn) {
         try {
             await conn.begin();
             await fn(conn);
@@ -71,18 +99,26 @@ export class SqlRunStore {
             }
             throw err;
         }
+    }
+    async createRun(taskId, sessionId, owner, instanceId, meta = {}) {
+        const conn = await this.db.connect();
+        try {
+            const first = await this.createRunOn(conn, taskId, sessionId, owner, instanceId, meta);
+            if (first.activeTaskId === undefined || !(await this.settleDueHolderOn(conn, first.activeTaskId)))
+                return first;
+            return await this.createRunOn(conn, taskId, sessionId, owner, instanceId, meta);
+        }
         finally {
             conn.release();
         }
     }
-    async createRun(taskId, sessionId, owner, instanceId, meta = {}) {
+    async createRunOn(conn, taskId, sessionId, owner, instanceId, meta) {
         const idemKey = meta.idem?.key ?? null;
-        const conn = await this.db.connect();
         let stage = "claim";
         try {
             await conn.begin();
             const { rows: root } = await conn.query(this.q("SELECT session_id FROM session_meta WHERE session_id = ? FOR UPDATE", "SELECT session_id FROM session_meta WHERE session_id = $1 FOR UPDATE"), [sessionId]);
-            if (root.length === 0) {
+            if (root.length === 0 || (await readDeletingTokenOn(async (sql, values) => (await conn.query(sql, [...values])).rows, this.db.dialect, sessionId)) !== null) {
                 await conn.rollback();
                 return { ok: false, sessionAbsent: true };
             }
@@ -137,9 +173,62 @@ export class SqlRunStore {
             }
             throw err;
         }
-        finally {
-            conn.release();
+    }
+    async settleDueHolderOn(conn, holderTaskId) {
+        const { rows } = await conn.query(this.q("SELECT status, updated_at FROM task_run WHERE task_id = ?", "SELECT status, updated_at FROM task_run WHERE task_id = $1"), [holderTaskId]);
+        const row = rows[0];
+        if (row === undefined)
+            return false;
+        const nowMs = Date.now();
+        const windowMs = this.stall.windowMs();
+        if (runLivenessOf({ status: String(row.status), updatedAt: iso(row.updated_at) }, nowMs, windowMs) !== "due")
+            return false;
+        let landed = 0;
+        try {
+            await this.txOn(conn, async (c) => {
+                landed = await this.landStallVerdicts(c, new Date(nowMs - windowMs), holderTaskId);
+            });
+        }
+        catch (err) {
+            recordFailOpen(RUN_STALL_VERDICT_UNLANDED_TAG, err instanceof Error ? err.message : String(err));
+            return false;
+        }
+        if (landed > 0)
+            this.stall.onVerdicts(landed);
+        return landed > 0;
+    }
+    async landStallVerdicts(conn, cutoff, taskId) {
+        const one = taskId !== undefined;
+        const { affected } = await conn.query(this.q(`UPDATE task_run SET status = 'failed', result = NULL, error = '${RUN_STALLED_ERROR}', error_code = '${RUN_HOLDER_DEATH_CODES.stalled}', updated_at = ? ` +
+            `WHERE status = 'running' AND updated_at < ?${one ? " AND task_id = ?" : ""}`, `UPDATE task_run SET status = 'failed', result = NULL, error = '${RUN_STALLED_ERROR}', error_code = '${RUN_HOLDER_DEATH_CODES.stalled}', updated_at = $1 ` +
+            `WHERE status = 'running' AND updated_at < $2${one ? " AND task_id = $3" : ""}`), one ? [new Date(), cutoff, taskId] : [new Date(), cutoff]);
+        if (one) {
+            if (affected === 1)
+                await conn.query(this.q("DELETE FROM task_active WHERE task_id = ?", "DELETE FROM task_active WHERE task_id = $1"), [taskId]);
+            return affected;
         }
+        await conn.query(this.q("DELETE ta FROM task_active ta JOIN task_run tr ON ta.task_id = tr.task_id WHERE tr.status NOT IN ('running','suspended','needs_review')", "DELETE FROM task_active ta USING task_run tr WHERE ta.task_id = tr.task_id AND tr.status NOT IN ('running','suspended','needs_review')"));
+        await conn.query(this.q("DELETE FROM task_active WHERE NOT EXISTS (SELECT 1 FROM task_run tr WHERE tr.task_id = task_active.task_id)", "DELETE FROM task_active WHERE NOT EXISTS (SELECT 1 FROM task_run tr WHERE tr.task_id = task_active.task_id)"));
+        return affected;
+    }
+    async observeRun(row) {
+        const nowMs = Date.now();
+        const windowMs = this.stall.windowMs();
+        if (runLivenessOf(row, nowMs, windowMs) !== "due")
+            return row;
+        let landed = 0;
+        try {
+            await this.tx(async (conn) => {
+                landed = await this.landStallVerdicts(conn, new Date(nowMs - windowMs), row.taskId);
+            });
+        }
+        catch (err) {
+            recordFailOpen(RUN_STALL_VERDICT_UNLANDED_TAG, err instanceof Error ? err.message : String(err));
+            return row;
+        }
+        if (landed > 0)
+            this.stall.onVerdicts(landed);
+        return (await this.getRun(row.taskId)) ?? row;
     }
     async fillObjectivePreview(taskId, preview) {
         await this.db.query(this.q("UPDATE task_run SET objective_preview = ? WHERE task_id = ? AND objective_preview IS NULL", "UPDATE task_run SET objective_preview = $1 WHERE task_id = $2 AND objective_preview IS NULL"), [this.db.dialect === "mysql" ? preview : pgSanitizeText(preview), taskId]);
@@ -161,7 +250,11 @@ export class SqlRunStore {
         return Boolean(rows[0]?.preempt_requested);
     }
     async heartbeat(taskId, owner) {
-        await this.db.query(this.q("UPDATE task_run SET updated_at = ? WHERE task_id = ? AND owner <=> ? AND status = 'running'", "UPDATE task_run SET updated_at = $1 WHERE task_id = $2 AND owner IS NOT DISTINCT FROM $3 AND status = 'running'"), [new Date(), taskId, owner]);
+        const { affected } = await this.db.query(this.q("UPDATE task_run SET updated_at = ? WHERE task_id = ? AND owner <=> ? AND status = 'running'", "UPDATE task_run SET updated_at = $1 WHERE task_id = $2 AND owner IS NOT DISTINCT FROM $3 AND status = 'running'"), [new Date(), taskId, owner]);
+        if (affected > 0)
+            return true;
+        const { rows } = await this.db.query(this.q("SELECT status FROM task_run WHERE task_id = ?", "SELECT status FROM task_run WHERE task_id = $1"), [taskId]);
+        return rows[0] !== undefined && String(rows[0].status) === "running";
     }
     async appendEvent(taskId, seq, type, data) {
         data = redactLedgerEventData(type, data);
@@ -175,7 +268,7 @@ export class SqlRunStore {
     async setTerminal(taskId, status, result, error) {
         result = sealRunRowResult(result);
         error = error === null ? null : (redactErrorMessage(error) ?? null);
-        const errorCode = result === null ? null : (outwardPlane(result.terminal).errorCode ?? null);
+        const errorCode = runRowErrorCodeOf(result);
         let won = false;
         let observed;
         await fenceSpaceCommitAtTerminal(taskId, async (spaceCommit) => {
@@ -272,14 +365,14 @@ export class SqlRunStore {
     }
     async setSuspended(taskId, result) {
         const sealed = sealRunRowResult(result);
-        await this.db.query(this.q("UPDATE task_run SET status = 'suspended', result = ?, updated_at = ? WHERE task_id = ? AND status IN ('running','suspended')", "UPDATE task_run SET status = 'suspended', result = $1::jsonb, updated_at = $2 WHERE task_id = $3 AND status IN ('running','suspended')"), [sealed == null ? null : this.json(sealed), new Date(), taskId]);
+        await this.db.query(this.q("UPDATE task_run SET status = 'suspended', result = ?, error_code = ?, updated_at = ? WHERE task_id = ? AND status IN ('running','suspended')", "UPDATE task_run SET status = 'suspended', result = $1::jsonb, error_code = $2, updated_at = $3 WHERE task_id = $4 AND status IN ('running','suspended')"), [sealed == null ? null : this.json(sealed), runRowErrorCodeOf(sealed), new Date(), taskId]);
     }
     async setNeedsReview(taskId, result) {
         const sealed = sealRunRowResult(result);
-        await this.db.query(this.q("UPDATE task_run SET status = 'needs_review', result = ?, updated_at = ? WHERE task_id = ? AND status IN ('running','needs_review')", "UPDATE task_run SET status = 'needs_review', result = $1::jsonb, updated_at = $2 WHERE task_id = $3 AND status IN ('running','needs_review')"), [sealed == null ? null : this.json(sealed), new Date(), taskId]);
+        await this.db.query(this.q("UPDATE task_run SET status = 'needs_review', result = ?, error_code = ?, updated_at = ? WHERE task_id = ? AND status IN ('running','needs_review')", "UPDATE task_run SET status = 'needs_review', result = $1::jsonb, error_code = $2, updated_at = $3 WHERE task_id = $4 AND status IN ('running','needs_review')"), [sealed == null ? null : this.json(sealed), runRowErrorCodeOf(sealed), new Date(), taskId]);
     }
     async markResuming(taskId, instanceId) {
-        const { affected } = await this.db.query(this.q("UPDATE task_run SET status = 'running', cancel_requested = 0, preempt_requested = 0, result = NULL, instance_id = ?, updated_at = ? WHERE task_id = ? AND status IN ('suspended','needs_review')", "UPDATE task_run SET status = 'running', cancel_requested = 0, preempt_requested = 0, result = NULL, instance_id = $1, updated_at = $2 WHERE task_id = $3 AND status IN ('suspended','needs_review')"), [instanceId, new Date(), taskId]);
+        const { affected } = await this.db.query(this.q("UPDATE task_run SET status = 'running', cancel_requested = 0, preempt_requested = 0, result = NULL, error_code = NULL, instance_id = ?, updated_at = ? WHERE task_id = ? AND status IN ('suspended','needs_review')", "UPDATE task_run SET status = 'running', cancel_requested = 0, preempt_requested = 0, result = NULL, error_code = NULL, instance_id = $1, updated_at = $2 WHERE task_id = $3 AND status IN ('suspended','needs_review')"), [instanceId, new Date(), taskId]);
         return affected === 1;
     }
     async whileHoldingClaim(sessionId, taskId, write) {
@@ -303,14 +396,15 @@ export class SqlRunStore {
         return rows[0] ? String(rows[0].task_id) : undefined;
     }
     rowToRun(r) {
+        const result = refusing("serve a finished run as if it had produced nothing", () => decodeResultColumn(r.result, String(r.task_id))) ?? null;
         return {
             taskId: String(r.task_id),
             sessionId: String(r.session_id),
             owner: r.owner ?? null,
             status: r.status,
-            result: refusing("serve a finished run as if it had produced nothing", () => decodeResultColumn(r.result, String(r.task_id))) ?? null,
+            result,
             error: r.error ?? null,
-            errorCode: r.error_code ?? null,
+            errorCode: m44ErrorCodeReadSide(String(r.status), result, r.error_code ?? null),
             jobId: r.job_id ?? null,
             source: r.source ?? null,
             identity: readRunIdentityCells(r.identity_source, r.identity_scope, r.identity_principal_inc),
@@ -424,89 +518,9 @@ export class SqlRunStore {
         const taskId = String(r.task_id);
         return settledLegObservationOf(taskId, refusing("read a settled leg as if it had observed no memory", () => decodeResultColumn(r.result, taskId)) ?? null);
     }
-    async listSessions(opts) {
-        if (this.db.dialect === "mysql") {
-            const params = [];
-            let innerWhere = "";
-            if (opts.owner !== undefined) {
-                innerWhere = opts.includeUnowned ? " WHERE (owner = ? OR owner IS NULL)" : " WHERE owner = ?";
-                params.push(opts.owner);
-            }
-            const outer = ["rn = 1"];
-            if (opts.q) {
-                outer.push("EXISTS (SELECT 1 FROM task_run tr WHERE tr.session_id = t.session_id AND LOWER(tr.objective_preview) LIKE LOWER(?) ESCAPE '\\\\')");
-                params.push(`%${escapeLike(opts.q)}%`);
-            }
-            if (opts.cursor) {
-                outer.push("(last_activity < ? OR (last_activity = ? AND session_id < ?))");
-                params.push(new Date(opts.cursor.lastActivityAt), new Date(opts.cursor.lastActivityAt), opts.cursor.sessionId);
-            }
-            const sql = "SELECT session_id, owner, task_id, last_activity, first_activity, run_count, objective_preview, status, last_task_run_id FROM (" +
-                "SELECT session_id, owner, task_id, objective_preview, status, JSON_UNQUOTE(JSON_EXTRACT(result, '$.runId')) AS last_task_run_id," +
-                " ROW_NUMBER() OVER (PARTITION BY session_id ORDER BY created_at DESC, task_id DESC) AS rn," +
-                " MAX(created_at) OVER (PARTITION BY session_id) AS last_activity," +
-                " MIN(created_at) OVER (PARTITION BY session_id) AS first_activity," +
-                " COUNT(*) OVER (PARTITION BY session_id) AS run_count" +
-                " FROM task_run" + innerWhere + ") t WHERE " + outer.join(" AND ") +
-                " ORDER BY last_activity DESC, session_id DESC LIMIT ?";
-            params.push(opts.limit);
-            const { rows } = await this.db.query(sql, params);
-            return rows.map((r) => this.rowToSession(r));
-        }
-        const params = [];
-        const p = (v) => {
-            params.push(v);
-            return `$${params.length}`;
-        };
-        const innerWhere = opts.owner !== undefined ? (opts.includeUnowned ? ` WHERE (owner = ${p(opts.owner)} OR owner IS NULL)` : ` WHERE owner = ${p(opts.owner)}`) : "";
-        const outer = ["rn = 1"];
-        if (opts.q)
-            outer.push(`EXISTS (SELECT 1 FROM task_run tr WHERE tr.session_id = t.session_id AND LOWER(tr.objective_preview) LIKE LOWER(${p(`%${escapeLike(opts.q)}%`)}) ESCAPE '\\')`);
-        if (opts.cursor) {
-            const a = p(new Date(opts.cursor.lastActivityAt));
-            const b = p(new Date(opts.cursor.lastActivityAt));
-            const sid = p(opts.cursor.sessionId);
-            outer.push(`(last_activity < ${a} OR (last_activity = ${b} AND session_id < ${sid}))`);
-        }
-        const sql = "SELECT session_id, owner, task_id, last_activity, first_activity, run_count, objective_preview, status, last_task_run_id FROM (" +
-            "SELECT session_id, owner, task_id, objective_preview, status, result ->> 'runId' AS last_task_run_id," +
-            " ROW_NUMBER() OVER (PARTITION BY session_id ORDER BY created_at DESC, task_id DESC) AS rn," +
-            " MAX(created_at) OVER (PARTITION BY session_id) AS last_activity," +
-            " MIN(created_at) OVER (PARTITION BY session_id) AS first_activity," +
-            " COUNT(*) OVER (PARTITION BY session_id) AS run_count" +
-            " FROM task_run" + innerWhere + ") t WHERE " + outer.join(" AND ") +
-            ` ORDER BY last_activity DESC, session_id DESC LIMIT ${p(opts.limit)}`;
-        const { rows } = await this.db.query(sql, params);
-        return rows.map((r) => this.rowToSession(r));
-    }
-    rowToSession(r) {
-        const lastTaskRunId = r.last_task_run_id;
-        return {
-            sessionId: String(r.session_id),
-            owner: r.owner ?? null,
-            lastActivityAt: iso(r.last_activity),
-            firstActivityAt: iso(r.first_activity),
-            runCount: Number(r.run_count),
-            objectivePreview: r.objective_preview ?? null,
-            lastStatus: String(r.status),
-            lastRunId: r.task_id ?? null,
-            ...(typeof lastTaskRunId === "string" && lastTaskRunId !== "" ? { lastTaskRunId } : {}),
-            title: null,
-            pinned: false,
-        };
-    }
-    async deleteBySession(sessionId, expectedSessionOwner) {
+    async deleteBySession(sessionId) {
         let result = { removed: 0 };
         await this.tx(async (conn) => {
-            const { rows: meta } = await conn.query(this.q("SELECT owner FROM session_meta WHERE session_id = ? FOR UPDATE", "SELECT owner FROM session_meta WHERE session_id = $1 FOR UPDATE"), [sessionId]);
-            const metaRow = meta[0];
-            if (metaRow === undefined || (metaRow.owner ?? null) !== expectedSessionOwner)
-                return;
-            const { rows: active } = await conn.query(this.q("SELECT task_id FROM task_active WHERE session_id = ? FOR UPDATE", "SELECT task_id FROM task_active WHERE session_id = $1 FOR UPDATE"), [sessionId]);
-            if (active[0]) {
-                result = { active: String(active[0].task_id) };
-                return;
-            }
             await conn.query(this.q("DELETE te FROM task_event te JOIN task_run tr ON te.task_id = tr.task_id WHERE tr.session_id = ?", "DELETE FROM task_event te USING task_run tr WHERE te.task_id = tr.task_id AND tr.session_id = $1"), [sessionId]);
             await conn.query(this.q("DELETE ta FROM task_active ta JOIN task_run tr ON ta.task_id = tr.task_id WHERE tr.session_id = ?", "DELETE FROM task_active ta USING task_run tr WHERE ta.task_id = tr.task_id AND tr.session_id = $1"), [sessionId]);
             const { affected } = await conn.query(this.q("DELETE FROM task_run WHERE session_id = ?", "DELETE FROM task_run WHERE session_id = $1"), [sessionId]);
@@ -553,17 +567,14 @@ export class SqlRunStore {
             ts: iso(r.ts),
         }));
     }
-    async reapStale(olderThanMs) {
-        const cutoff = new Date(Date.now() - olderThanMs);
+    async reapStale() {
+        const cutoff = new Date(Date.now() - this.stall.windowMs());
         let reaped = 0;
         await this.tx(async (conn) => {
-            const { affected } = await conn.query(this.q(`UPDATE task_run SET status = 'failed', result = NULL, error = '${RUN_STALLED_ERROR}', error_code = '${RUN_HOLDER_DEATH_CODES.stalled}', updated_at = ? ` +
-                "WHERE status = 'running' AND updated_at < ?", `UPDATE task_run SET status = 'failed', result = NULL, error = '${RUN_STALLED_ERROR}', error_code = '${RUN_HOLDER_DEATH_CODES.stalled}', updated_at = $1 ` +
-                "WHERE status = 'running' AND updated_at < $2"), [new Date(), cutoff]);
-            reaped = affected;
-            await conn.query(this.q("DELETE ta FROM task_active ta JOIN task_run tr ON ta.task_id = tr.task_id WHERE tr.status NOT IN ('running','suspended','needs_review')", "DELETE FROM task_active ta USING task_run tr WHERE ta.task_id = tr.task_id AND tr.status NOT IN ('running','suspended','needs_review')"));
-            await conn.query(this.q("DELETE FROM task_active WHERE NOT EXISTS (SELECT 1 FROM task_run tr WHERE tr.task_id = task_active.task_id)", "DELETE FROM task_active WHERE NOT EXISTS (SELECT 1 FROM task_run tr WHERE tr.task_id = task_active.task_id)"));
+            reaped = await this.landStallVerdicts(conn, cutoff);
         });
+        if (reaped > 0)
+            this.stall.onVerdicts(reaped);
         return reaped;
     }
     async reapSuspended(olderThanMs) {
@@ -572,9 +583,9 @@ export class SqlRunStore {
         await this.tx(async (conn) => {
             const { affected } = await conn.query(this.q("UPDATE task_run tr SET tr.status = 'failed', tr.result = NULL, tr.error = 'approval expired before decision', tr.error_code = 'approval.expired', tr.updated_at = ? " +
                 "WHERE tr.status = 'suspended' AND tr.updated_at < ? " +
-                "AND NOT EXISTS (SELECT 1 FROM checkpoint c WHERE c.session_id = tr.session_id AND c.status = 'pending')", "UPDATE task_run AS tr SET status = 'failed', result = NULL, error = 'approval expired before decision', error_code = 'approval.expired', updated_at = $1 " +
+                "AND NOT EXISTS (SELECT 1 FROM checkpoint c WHERE c.host_session_id = tr.session_id AND c.status = 'pending')", "UPDATE task_run AS tr SET status = 'failed', result = NULL, error = 'approval expired before decision', error_code = 'approval.expired', updated_at = $1 " +
                 "WHERE tr.status = 'suspended' AND tr.updated_at < $2 " +
-                "AND NOT EXISTS (SELECT 1 FROM checkpoint c WHERE c.session_id = tr.session_id AND c.status = 'pending')"), [new Date(), cutoff]);
+                "AND NOT EXISTS (SELECT 1 FROM checkpoint c WHERE c.host_session_id = tr.session_id AND c.status = 'pending')"), [new Date(), cutoff]);
             reaped = affected;
             await conn.query(this.q("DELETE ta FROM task_active ta JOIN task_run tr ON ta.task_id = tr.task_id WHERE tr.status NOT IN ('running','suspended','needs_review')", "DELETE FROM task_active ta USING task_run tr WHERE ta.task_id = tr.task_id AND tr.status NOT IN ('running','suspended','needs_review')"));
         });
@@ -585,11 +596,11 @@ export class SqlRunStore {
         await this.tx(async (conn) => {
             const { affected } = await conn.query(this.q("UPDATE task_run tr SET tr.status = 'failed', tr.result = NULL, tr.error = 'approval expired before decision', tr.error_code = 'approval.expired', tr.updated_at = ? " +
                 "WHERE tr.status IN ('suspended','needs_review') " +
-                "AND EXISTS (SELECT 1 FROM checkpoint ce WHERE ce.session_id = tr.session_id AND ce.status = 'expired') " +
-                "AND NOT EXISTS (SELECT 1 FROM checkpoint cp WHERE cp.session_id = tr.session_id AND cp.status = 'pending')", "UPDATE task_run AS tr SET status = 'failed', result = NULL, error = 'approval expired before decision', error_code = 'approval.expired', updated_at = $1 " +
+                "AND EXISTS (SELECT 1 FROM checkpoint ce WHERE ce.host_session_id = tr.session_id AND ce.status = 'expired') " +
+                "AND NOT EXISTS (SELECT 1 FROM checkpoint cp WHERE cp.host_session_id = tr.session_id AND cp.status = 'pending')", "UPDATE task_run AS tr SET status = 'failed', result = NULL, error = 'approval expired before decision', error_code = 'approval.expired', updated_at = $1 " +
                 "WHERE tr.status IN ('suspended','needs_review') " +
-                "AND EXISTS (SELECT 1 FROM checkpoint ce WHERE ce.session_id = tr.session_id AND ce.status = 'expired') " +
-                "AND NOT EXISTS (SELECT 1 FROM checkpoint cp WHERE cp.session_id = tr.session_id AND cp.status = 'pending')"), [new Date()]);
+                "AND EXISTS (SELECT 1 FROM checkpoint ce WHERE ce.host_session_id = tr.session_id AND ce.status = 'expired') " +
+                "AND NOT EXISTS (SELECT 1 FROM checkpoint cp WHERE cp.host_session_id = tr.session_id AND cp.status = 'pending')"), [new Date()]);
             reaped = affected;
             await conn.query(this.q("DELETE ta FROM task_active ta JOIN task_run tr ON ta.task_id = tr.task_id WHERE tr.status NOT IN ('running','suspended','needs_review')", "DELETE FROM task_active ta USING task_run tr WHERE ta.task_id = tr.task_id AND tr.status NOT IN ('running','suspended','needs_review')"));
         });
@@ -597,13 +608,13 @@ export class SqlRunStore {
     }
 }
 export class TiDBRunStore extends SqlRunStore {
-    constructor(pool) {
-        super(mysqlDriver(pool));
+    constructor(pool, stall) {
+        super(mysqlDriver(pool), stall);
     }
 }
 export class PgRunStore extends SqlRunStore {
-    constructor(pool) {
-        super(pgDriver(pool));
+    constructor(pool, stall) {
+        super(pgDriver(pool), stall);
     }
 }
 //# sourceMappingURL=run-store-sql.js.map

package/dist/plugins/s3-answer.d.ts

@@ -6,7 +6,8 @@
  * the second as the first turns a missing bucket into a silently empty workspace on every run. The ONLY evidence of a missing bucket is
  * a 404 whose body carries the S3 error code `NoSuchBucket`: a bare 404, a 404 from a proxy or a wrong path, a 403 (credentials that
  * cannot list ≠ no bucket) and a 5xx prove nothing about the bucket. Every consumer asks this one predicate: the boot probe of a
- * configured bucket (`MinioBlobBackend.probeBucket`) and the runtime read of the workspace `latest` pointer (`remote-env-k8s.ts`).
+ * configured bucket (`MinioBlobBackend.probeBucket`), the runtime read of the workspace `latest` pointer, and a restore's archive GET whose 404 answer the
+ * pod hands back as it is (`remote-env-k8s.ts` — the pod never judges it).
  */
 /** The code a run's refusal / operator line carries when the store answered "no such bucket" (the `workspace_snapshot_bucket_missing` line's `code`). */
 export declare const SNAPSHOT_BUCKET_MISSING = "snapshot_bucket_missing";