@sema-agent/server 7.147.0 → 7.148.0

package/dist/plugins/file-run-store.js

@@ -1,14 +1,19 @@
-import { redactErrorMessage, redactLedgerEventData, sealRunRowResult } from "../observability/run-terminal.js";
-import { outwardPlane } from "../terminal.js";
+import { SCENARIO_SUBJECT_PREFIX } from "../owner-brands.js";
+import { redactErrorMessage, redactLedgerEventData, runRowErrorCodeOf, sealRunRowResult } from "../observability/run-terminal.js";
+import { outwardPlane, persistedPlaneOf } from "../terminal.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
 import { join } from "node:path";
-import { existsSync, readFileSync, readdirSync, renameSync, rmSync, statSync } from "node:fs";
+import { closeSync, existsSync, fsyncSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync } from "node:fs";
+import { IS_WIN32 } from "./host-platform.js";
 import { randomBytes } from "node:crypto";
 import { AppendLog, atomicWriteFile, ensureDir, isProcessLive, processFingerprint, sanitizePathComponent, sanitizeScope, writeThenLink } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
 import { joinFromStore, splitForStore } from "./wiring-section-codec.js";
-import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR, StoreBootRefusalError, buildRunOrphanedError, isTerminalRunStatus, settledLegObservationOf } from "./store-contracts.js";
+import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR, RUN_STALL_DEFAULT_WIRING, RUN_STALL_VERDICT_UNLANDED_TAG, StoreBootRefusalError, runLivenessOf, buildRunOrphanedError, isTerminalRunStatus, settledLegObservationOf } from "./store-contracts.js";
+import { buildSessionRunRollups } from "./session-run-rollup.js";
+import { normalizedRunPreviewM45 } from "./run-preview-m45.js";
+import { SHELL_SENTINEL_OWNER_M48 } from "./shell-sentinel-owner-m48.js";
 import { notifyRunTerminal } from "../observability/run-terminal.js";
 import { readRunIdentityCells, runIdentityCells } from "../identity-source.js";
 import { createInProcessSpaceCommitTable, fenceSpaceCommitAtTerminal, SPACE_COMMIT_RECORD_SCHEMA } from "../workspace-space-commit.js";
@@ -80,10 +85,14 @@ export class FileRunStore {
     claimOwner = { nonce: randomBytes(12).toString("hex"), ...processFingerprint() };
     claimLocks = new Map();
     logger;
+    rootRows;
     strictHydrate;
+    stall;
     constructor(root, opts) {
         this.logger = opts;
-        this.strictHydrate = opts?.strictHydrate === true;
+        this.stall = opts.stall ?? RUN_STALL_DEFAULT_WIRING;
+        this.rootRows = opts.rootRows;
+        this.strictHydrate = opts.strictHydrate === true;
         const dirs = fileRunStoreDirsFor(root);
         this.runsDir = dirs.runs;
         this.activeDir = dirs.active;
@@ -379,13 +388,17 @@ export class FileRunStore {
     }
     async createRun(taskId, sessionId, owner, instanceId, meta = {}) {
         const idemKey = meta.idem?.key ?? null;
-        return this.withClaimLock(sessionId, async () => {
-            const acquired = await this.acquireClaim(sessionId, taskId);
-            if (!acquired.ok) {
-                const existing = this.submittedRow(taskId, idemKey);
-                return existing ? { ok: false, existing: this.toRecord(existing) } : acquired;
-            }
-            return this.commitNewRun(taskId, sessionId, owner, instanceId, meta, idemKey);
+        return this.rootRows().withRootRow(sessionId, async (present) => {
+            if (!present)
+                return { ok: false, sessionAbsent: true };
+            return this.withClaimLock(sessionId, async () => {
+                const acquired = await this.acquireClaim(sessionId, taskId);
+                if (!acquired.ok) {
+                    const existing = this.submittedRow(taskId, idemKey);
+                    return existing ? { ok: false, existing: this.toRecord(existing) } : acquired;
+                }
+                return this.commitNewRun(taskId, sessionId, owner, instanceId, meta, idemKey);
+            });
         });
     }
     submittedRow(taskId, idemKey) {
@@ -470,6 +483,7 @@ export class FileRunStore {
         const r = this.runs.get(taskId);
         if (r && ownerEq(r.owner, owner) && r.status === "running")
             this.persist({ ...r, updatedAt: new Date() });
+        return r !== undefined && r.status === "running";
     }
     async appendEvent(taskId, seq, type, data) {
         data = redactLedgerEventData(type, data);
@@ -572,7 +586,7 @@ export class FileRunStore {
         }
         let pending;
         if (r.status === "running" || r.status === "suspended" || r.status === "needs_review") {
-            const errorCode = result === null ? null : (outwardPlane(result.terminal).errorCode ?? null);
+            const errorCode = runRowErrorCodeOf(result);
             this.persist({ ...r, status, result, error, errorCode, updatedAt: new Date() });
             pending = {
                 runId: taskId,
@@ -596,14 +610,14 @@ export class FileRunStore {
         const sealed = sealRunRowResult(result);
         const r = this.runs.get(taskId);
         if (r && (r.status === "running" || r.status === "suspended")) {
-            this.persist({ ...r, status: "suspended", result: sealed, updatedAt: new Date() });
+            this.persist({ ...r, status: "suspended", result: sealed, errorCode: runRowErrorCodeOf(sealed), updatedAt: new Date() });
         }
     }
     async setNeedsReview(taskId, result) {
         const sealed = sealRunRowResult(result);
         const r = this.runs.get(taskId);
         if (r && (r.status === "running" || r.status === "needs_review")) {
-            this.persist({ ...r, status: "needs_review", result: sealed, updatedAt: new Date() });
+            this.persist({ ...r, status: "needs_review", result: sealed, errorCode: runRowErrorCodeOf(sealed), updatedAt: new Date() });
         }
     }
     async markResuming(taskId, instanceId) {
@@ -614,6 +628,7 @@ export class FileRunStore {
             ...r,
             status: "running",
             result: null,
+            errorCode: null,
             instanceId,
             cancelRequested: false,
             preemptRequested: false,
@@ -696,62 +711,10 @@ export class FileRunStore {
         }
         return latest === undefined ? undefined : settledLegObservationOf(latest.taskId, latest.result);
     }
-    async listSessions(opts) {
-        const bySession = new Map();
-        for (const r of this.runs.values()) {
-            if (opts.owner !== undefined && r.owner !== opts.owner && !(opts.includeUnowned === true && r.owner === null))
-                continue;
-            const arr = bySession.get(r.sessionId) ?? [];
-            arr.push(r);
-            bySession.set(r.sessionId, arr);
-        }
-        const cursorAt = opts.cursor ? Date.parse(opts.cursor.lastActivityAt) : undefined;
-        const qlc = opts.q?.toLowerCase();
-        const summaries = [];
-        for (const [sessionId, arr] of bySession) {
-            if (qlc && !arr.some((r) => r.objectivePreview?.toLowerCase().includes(qlc)))
-                continue;
-            const sorted = [...arr].sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime() || (a.taskId < b.taskId ? 1 : a.taskId > b.taskId ? -1 : 0));
-            const latest = sorted[0];
-            const latestRunId = latest.result?.runId;
-            let last = -Infinity;
-            let first = Infinity;
-            for (const r of arr) {
-                const t = r.createdAt.getTime();
-                if (t > last)
-                    last = t;
-                if (t < first)
-                    first = t;
-            }
-            summaries.push({
-                sessionId,
-                owner: latest.owner,
-                lastActivityAt: new Date(last).toISOString(),
-                firstActivityAt: new Date(first).toISOString(),
-                runCount: arr.length,
-                objectivePreview: latest.objectivePreview,
-                lastStatus: latest.status,
-                lastRunId: latest.taskId,
-                ...(typeof latestRunId === "string" && latestRunId !== "" ? { lastTaskRunId: latestRunId } : {}),
-                title: null,
-                pinned: false,
-            });
-        }
-        return summaries
-            .filter((s) => {
-            if (cursorAt === undefined)
-                return true;
-            const t = Date.parse(s.lastActivityAt);
-            return t < cursorAt || (t === cursorAt && s.sessionId < opts.cursor.sessionId);
-        })
-            .sort((a, b) => Date.parse(b.lastActivityAt) - Date.parse(a.lastActivityAt) || (a.sessionId < b.sessionId ? 1 : a.sessionId > b.sessionId ? -1 : 0))
-            .slice(0, opts.limit);
-    }
-    async deleteBySession(sessionId, expectedSessionOwner) {
-        void expectedSessionOwner;
-        const claimed = this.active.get(sessionId);
-        if (claimed !== undefined)
-            return { active: claimed };
+    async sessionRunRollups(opts = {}) {
+        return buildSessionRunRollups(this.runs.values(), opts);
+    }
+    async deleteBySession(sessionId) {
         this.dropSectionBlobs(sessionId);
         let removed = 0;
         for (const [taskId, r] of [...this.runs]) {
@@ -814,9 +777,31 @@ export class FileRunStore {
         this.sweepClaims();
         return reaped;
     }
-    async reapStale(olderThanMs) {
-        const cutoff = Date.now() - olderThanMs;
-        return this.reapRunning((r) => r.updatedAt.getTime() < cutoff, RUN_STALLED_ERROR, RUN_HOLDER_DEATH_CODES.stalled);
+    async reapStale() {
+        const nowMs = Date.now();
+        const windowMs = this.stall.windowMs();
+        const reaped = this.reapRunning((r) => runLivenessOf(this.toRecord(r), nowMs, windowMs) === "due", RUN_STALLED_ERROR, RUN_HOLDER_DEATH_CODES.stalled);
+        if (reaped > 0)
+            this.stall.onVerdicts(reaped);
+        return reaped;
+    }
+    async observeRun(row) {
+        const nowMs = Date.now();
+        const windowMs = this.stall.windowMs();
+        if (runLivenessOf(row, nowMs, windowMs) !== "due")
+            return row;
+        let landed = 0;
+        try {
+            landed = this.reapRunning((r) => r.taskId === row.taskId && runLivenessOf(this.toRecord(r), nowMs, windowMs) === "due", RUN_STALLED_ERROR, RUN_HOLDER_DEATH_CODES.stalled);
+        }
+        catch (err) {
+            recordFailOpen(RUN_STALL_VERDICT_UNLANDED_TAG, err instanceof Error ? err.message : String(err));
+            return row;
+        }
+        if (landed > 0)
+            this.stall.onVerdicts(landed);
+        const r = this.runs.get(row.taskId);
+        return r ? this.toRecord(r) : row;
     }
     async reclaimOrphanedAtBoot(isResumable) {
         const orphans = [];
@@ -961,7 +946,19 @@ export class FileRunStore {
                 const verdict = await this.judgeClaim(sessionId, claim, holder);
                 if (verdict.kind === "live")
                     return { ok: false, activeTaskId: verdict.holderTaskId ?? holder };
-                this.takeOverClaim(sessionId, verdict.reason, verdict.snapshot, verdict.code);
+                const stalled = verdict.code === RUN_HOLDER_DEATH_CODES.stalled;
+                let taken;
+                try {
+                    taken = this.takeOverClaim(sessionId, verdict.reason, verdict.snapshot, verdict.code);
+                }
+                catch (e) {
+                    if (!stalled)
+                        throw e;
+                    recordFailOpen(RUN_STALL_VERDICT_UNLANDED_TAG, e instanceof Error ? e.message : String(e));
+                    return { ok: false, activeTaskId: verdict.snapshot.taskId || holder };
+                }
+                if (taken && stalled)
+                    this.stall.onVerdicts(1);
             }
         }
         try {
@@ -1019,6 +1016,8 @@ export class FileRunStore {
                 return live();
             return { kind: "stale", reason: `parked run (${row.status}) has no resumable checkpoint — claim reclaimed`, snapshot };
         }
+        if (row && runLivenessOf(this.toRecord(row), Date.now(), this.stall.windowMs()) === "due")
+            return { kind: "stale", reason: RUN_STALLED_ERROR, snapshot, code: RUN_HOLDER_DEATH_CODES.stalled };
         const mine = owner?.nonce === this.claimOwner.nonce;
         const ownerGone = owner !== undefined && !isProcessLive(owner);
         if (!mine && !ownerGone)
@@ -1051,7 +1050,7 @@ export class FileRunStore {
         if (row?.status !== snapshot.status || row?.updatedAt.getTime() !== snapshot.updatedAtMs)
             return false;
         if (row && (row.status === "running" || row.status === "suspended" || row.status === "needs_review")) {
-            this.persist({ ...row, status: "failed", error: reason, ...(code !== undefined ? { errorCode: code } : {}), updatedAt: new Date() });
+            this.persist({ ...row, status: "failed", result: null, error: reason, errorCode: code ?? null, updatedAt: new Date() });
         }
         const quarantine = join(this.tmpDir, `stale-claim.${sanitizePathComponent(sessionId)}.${process.pid}.${randomBytes(6).toString("hex")}`);
         try {
@@ -1093,23 +1092,79 @@ export class FileRunStore {
             }
             this.eventLogs.delete(taskId);
         }
+        const dir = this.runDir(taskId);
+        rmSync(dir, { recursive: true, force: true });
+        if (!IS_WIN32 && existsSync(this.runsDir)) {
+            const fd = openSync(this.runsDir, "r");
+            try {
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+        }
         this.events.delete(taskId);
         const dropped = this.runs.get(taskId);
         if (dropped?.idemKey != null && this.byIdem.get(dropped.idemKey) === taskId)
             this.byIdem.delete(dropped.idemKey);
         this.runs.delete(taskId);
-        const dir = this.runDir(taskId);
-        if (existsSync(dir)) {
-            try {
-                rmSync(dir, { recursive: true, force: true });
-            }
-            catch {
-            }
+    }
+    withdrawRunsOf(sessionId, ownTaskId) {
+        for (const r of this.runs.values())
+            if (r.sessionId === sessionId && r.taskId !== ownTaskId)
+                return { keep: "runs" };
+        const own = ownTaskId === undefined ? undefined : this.runs.get(ownTaskId);
+        if (own !== undefined && own.sessionId !== sessionId)
+            throw new Error(`FileRunStore.withdrawRunsOf: run ${ownTaskId} belongs to session ${own.sessionId}, not ${sessionId} — refusing to delete it`);
+        this.dropSectionBlobs(sessionId);
+        if (own !== undefined)
+            this.dropRun(own.taskId);
+        return "proceed";
+    }
+    migrateRunErrorCodeColumnM44() {
+        let migrated = 0;
+        for (const r of this.runs.values()) {
+            const target = r.status === "running" ? null : r.result === null ? r.errorCode : (persistedPlaneOf(r.result).errorCode ?? r.errorCode);
+            if (target === r.errorCode)
+                continue;
+            this.persist({ ...r, errorCode: target });
+            migrated += 1;
+        }
+        return migrated;
+    }
+    migrateRunObjectivePreviewM45() {
+        let migrated = 0;
+        for (const r of this.runs.values()) {
+            if (typeof r.objectivePreview !== "string")
+                continue;
+            const target = normalizedRunPreviewM45(r.objectivePreview);
+            if (target === undefined || target === r.objectivePreview)
+                continue;
+            this.persist({ ...r, objectivePreview: target });
+            migrated += 1;
+        }
+        return migrated;
+    }
+    clearShellSentinelOwnersM48() {
+        let cleared = 0;
+        for (const r of this.runs.values()) {
+            if (r.owner !== SHELL_SENTINEL_OWNER_M48)
+                continue;
+            this.persist({ ...r, owner: null });
+            cleared += 1;
         }
+        return cleared;
     }
     sessionIdsWithRuns() {
         return new Set([...this.runs.values()].map((r) => r.sessionId));
     }
+    scenarioPrefixOwnerRowsM42() {
+        let n = 0;
+        for (const r of this.runs.values())
+            if (r.owner !== null && r.owner.startsWith(SCENARIO_SUBJECT_PREFIX))
+                n += 1;
+        return n;
+    }
     dispose() {
         for (const log of [...this.eventLogs.values(), ...this.blobLogs.values()]) {
             try {

package/dist/plugins/host-platform.d.ts

@@ -32,7 +32,7 @@
  * structural tests only on mac/Linux; behavior-level bite happens on the first Windows-runner green.
  */
 import type { ChildProcess } from "node:child_process";
-import { killProcessTree, type BackgroundHardKillOutcome } from "@sema-agent/core";
+import { killProcessTree, signalProcessTree, type BackgroundHardKillOutcome } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
 /** 平台读点全仓一处(`test/host-shell-settle-order.test.ts` 源码钉);别处要平台串从这里取,不直读 Node 的平台字段。 */
 export declare const HOST_PLATFORM: NodeJS.Platform;
@@ -133,8 +133,29 @@ export declare function hardKillGroupNow(pid: number): BackgroundHardKillOutcome
  */
 export declare function killTreeSoft(pid: number): void;
 /** Graceful tree kill where the CALLER has no escalation timer of its own (currently unused by the host lane —
- *  exported for parity with core's surface; the bg driver keeps its own HOST_BG_KILL_GRACE_MS ladder). */
-export { killProcessTree };
+ *  exported for parity with core's surface; the bg driver keeps its own HOST_BG_KILL_GRACE_MS ladder).
+ *  `signalProcessTree` = ONE signal to the whole tree (POSIX: a `ps` snapshot of the descendants of `pid` + the group
+ *  signal + each descendant; win32: taskkill /T). Never throws. Its root must be a pid that is still OURS (an unreaped
+ *  child): a reaped pid may already be a stranger's, and a descendant walk from a stranger's pid kills the stranger's
+ *  children — the one caller (the command-hook ladder) guards that on the child handle. */
+export { killProcessTree, signalProcessTree };
+/**
+ * Group probe for a REAPED leader: does the group of `pid` still hold an ORIGINAL member? Ask it only after node reaped the
+ * leader (an unreaped leader keeps the pid ours — no question to ask). POSIX reads two numbers:
+ *  · `kill(-pid, 0)` — is anyone in the group;
+ *  · `kill(pid, 0)`  — is any process holding the number itself.
+ * Group empty (ESRCH) ⇒ false. Group non-empty and nobody holds the number (ESRCH) ⇒ true: the kernel never hands out a number that a
+ * process still uses as its process-group id, so the number was not recycled and the members are the original ones (Linux's pid
+ * allocator; BSD / darwin allocate the same way — inferred, not read from kernel source). Group non-empty and the number IS held
+ * (success / EPERM) ⇒ false: while an original member lived the number could not have been handed out, so every original is dead and what
+ * answers now is a stranger's new process / group — never ours, so the caller sends it nothing. EPERM on the group probe reads
+ * "non-empty" (darwin answers EPERM for a group holding only unreaped zombies, indistinguishable from a live member we may not signal:
+ * one extra shot, never a missed member); EPERM on the number probe reads "held" (the process exists, we just cannot touch it).
+ * win32 has no process group ⇒ always false (the tree is discovered only at signal time, by taskkill /T, and only from an unreaped
+ * root). Never throws. The only residual is the instant between the two probes (an original member dying and its number being
+ * recycled inside it) — microseconds, not the grace window.
+ */
+export declare function reapedLeaderGroupAlive(pid: number): boolean;
 /**
  * 登记回执 = 注销的**唯一**凭据(身份即凭据,见簿注)+ 一只幂等的注销把手。
  *

package/dist/plugins/host-platform.js

@@ -127,7 +127,21 @@ export function killTreeSoft(pid) {
     }
     process.kill(-pid, "SIGTERM");
 }
-export { killProcessTree };
+export { killProcessTree, signalProcessTree };
+export function reapedLeaderGroupAlive(pid) {
+    if (IS_WIN32)
+        return false;
+    const answers = (target) => {
+        try {
+            process.kill(target, 0);
+            return true;
+        }
+        catch (err) {
+            return err.code !== "ESRCH";
+        }
+    };
+    return answers(-pid) && !answers(pid);
+}
 const liveHostForegroundGroups = new Set();
 export function trackHostForegroundChild(pid) {
     const ticket = {

package/dist/plugins/image-bake-store-sql.js

@@ -136,6 +136,8 @@ function refusingBakeRow(read) {
 export const IMAGE_BAKE_INDEXES = [
     { table: "image_bake", name: "idx_image_bake_status", columns: ["status"] },
     { table: "image_bake", name: "idx_image_bake_created", columns: ["created_at"] },
+    { table: "image_bake", name: "uq_image_bake_idem", columns: ["idem_key"], unique: true },
+    { table: "image_bake_event", name: "uq_image_bake_event_line", columns: ["bake_id", "line_ord"], unique: true },
 ];
 export async function ensurePgImageBakeSchema(pool, poolName = "standard") {
     for (const stmt of PG_IMAGE_BAKE_SCHEMA)

package/dist/plugins/imported-layer-root-retirement.d.ts

@@ -40,7 +40,7 @@
  * 另两种店**答了**却做不了的(没有写面或写面拒 / 并发争不过)⇒ 点名跳过,下一次起服再试,其间那几行照旧放行,每次起服都点名。
  */
 import { type DurableRulePartitionProvider, type PersistedRule, type RuleAdd, type RuleOwner } from "@sema-agent/core";
-/** 一只被退役的导入 add 所在的行(一行一条读数)。**不带规则正文**(与 M11 同一条纪律:规则正文不出店)—— 桶键 + 工具名足够让运维去列举面对上它。 */
+/** 一只被退役的导入 add 所在的行(一行一条读数)。**不带规则正文**(规则正文不出店)—— 桶键 + 工具名足够让运维去列举面对上它。 */
 export interface ImportedLayerRootAllowRetired {
     /** 桶键(`buildRuleOwnerKey`:属主的单向摘要;两种店同一把,日志里不出属主名)。 */
     readonly ownerKey: string;
@@ -61,7 +61,7 @@ export type ImportedLayerRootSkipReason = "bucket_unreadable" | "vanished" | "no
 export interface ImportedLayerRootBucketSkipped {
     readonly ownerKey: string;
     readonly reason: ImportedLayerRootSkipReason;
-    /** 一句不带行内容的话:读 / 解析桶抛出来的东西只报它的种类(原句可能引到桶里的行 —— 与 M11 `contentFreeRefusal` 同一条纪律;
+    /** 一句不带行内容的话:读 / 解析桶抛出来的东西只报它的种类(原句可能引到桶里的行 —— 规则正文不出店;
      *  原句由店自己的披露口说,File 店的 `permission_rule_store_disclosure`、SQL 店的整桶拒句);写面拒的是闭集词,原样带。 */
     readonly why: string;
 }

package/dist/plugins/k8s-pod-reaper.d.ts

@@ -25,7 +25,7 @@
  * 每轮一行结构化日志 `sandbox_pod_reap_round`(扫了几只、按闭集原因分的删 / 跳过计数),每删一只一行 `sandbox_pod_reaped`;**列举失败**这一轮一只都删不了 ——
  * F 类兜底口 `server.sandbox-pod-reaper.list-failed` 计一次 + 一行 warn `sandbox_pod_reap_list_failed`(下一轮一个周期后照常再列);**某一只删失败**不挡其余 ——
  * 与连接清理同一只上报口 `reportPodDeleteFailed`(F 类计数 `server.sandbox-pod.delete-failed` + 一行 error `sandbox_pod_delete_failed`,`why=reaper_<删它的理由>`,下一轮再判再删)。
- * 每副本起服后第一个维护 tick 跑一次、此后每 {@link SANDBOX_POD_REAP_PERIOD_MS} 一次(`boot/reapers.ts`);多副本同时删同一只 ⇒ 404 计 `gone`。
+ * 每副本起服后第一个维护 tick 跑一次、此后每 `SANDBOX_REAP_PERIOD_MS` 一次(`boot/reapers.ts` 的沙箱回收腿,与 local-docker 车道的容器回收器共一只座一个节拍:`sandbox-reaper.ts`);多副本同时删同一只 ⇒ 404 计 `gone`。
  */
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
@@ -33,8 +33,6 @@ import type { Metrics } from "../observability/metrics.js";
 export declare const SANDBOX_POD_REAP_GRACE_MS = 60000;
 /** ① 的上界:`max(租约上限 + 宽限, 快照时限 + 引擎拆环境放行)`。唯一的调用方 = 适配器建 Pod 的那一拍(快照时限 = 建它的副本的 `dataTimeoutMs`),结果写进 Pod 的注解。 */
 export declare function sandboxRunEndHoldMs(snapshotTimeoutMs: number): number;
-/** 一个副本两轮回收之间的间隔。常量。 */
-export declare const SANDBOX_POD_REAP_PERIOD_MS: number;
 /** 列举出来的一只沙箱 Pod(只带判官要读的几样;时刻是毫秒)。 */
 export interface SandboxPodListing {
     readonly name: string;

package/dist/plugins/k8s-pod-reaper.js

@@ -15,7 +15,6 @@ function runEndHoldOf(raw) {
     const ms = Number(raw);
     return Number.isSafeInteger(ms) && ms >= RUN_END_HOLD_READABLE.min && ms <= RUN_END_HOLD_READABLE.max ? ms : undefined;
 }
-export const SANDBOX_POD_REAP_PERIOD_MS = 5 * 60_000;
 const CLASS_VERDICT = {
     live: "live",
     parked: "live",

package/dist/plugins/leader-run-store-sql.d.ts

@@ -2,10 +2,16 @@ import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type SqlDriver } from "./sql-driver.js";
 import { type IndexSpec } from "./ensure-index.js";
+import { type RunIdentity } from "../identity-source.js";
 /** 表名([ref] 单数纪律;`schema-naming-invariants` 的闭集词表执法)。 */
 export declare const LEADER_RUN_TABLE = "leader_run";
 /** leader run 的四态 —— 与 `leader/endpoint.ts` 的 `LeaderRun["status"]` 同词表(闭集)。 */
 export type LeaderRunStatus = "running" | "completed" | "failed" | "needs_human";
+/**
+ * 终局行的机读码闭集(`error_code` 列;与 run / bake 的取消终局同词:`failed` + `cancelled`)。今天唯一的成员 = 取消口停下的 run;
+ * 其余终局(自然失败、陈旧清算)不带码 ⇒ 列 NULL。读出表外词 ⇒ 响亮拒(与 {@link statusOf} 同)。
+ */
+export type LeaderRunErrorCode = "cancelled";
 /** 库里一行 leader run 的读出形。`result` 是 `LeaderResult` 的 JSON 原样(店不解释它的内部结构)。 */
 export interface LeaderRunRecord {
     id: string;
@@ -17,6 +23,12 @@ export interface LeaderRunRecord {
     objectivePreview: string | null;
     result?: unknown;
     error?: string;
+    /** 只在取消口停下的终局上在场(列 NULL ⇒ 缺席)。 */
+    errorCode?: LeaderRunErrorCode;
+    /** 耐久取消旗(`cancel_requested` 列):取消口翻过、行当时还在跑 ⇒ `true`。只翻 `running` 行;终局之后不再变。 */
+    cancelRequested: boolean;
+    /** 受理时验过的身份元组(三列;律在 `identity-source.ts` 头注)。`null` = 不合格(列之前的行 / 无鉴权写面 / 别人替属主按下)。不上 wire。 */
+    identity: RunIdentity | null;
     startedAtMs: number;
     finishedAtMs?: number;
 }
@@ -26,12 +38,16 @@ export interface NewLeaderRun {
     owner: string | null;
     /** 已 scope 过的幂等键(唯一铸法 `idemKeyOf(raw, caller, "leader")`,`http/idempotency.ts`;sha256 hex 定宽 64);null = 不去重。 */
     idemKey: string | null;
+    /** 受理时的身份元组 —— 凭据门铸、提交路由经 `runIdentityOf` 交来,原样写入,之后只读(店不重算)。 */
+    identity: RunIdentity | null;
 }
 /** 终局补丁 —— `finishRun` 一次写完(状态 + 结果/错误 + 完成时刻)。 */
 export interface LeaderRunTerminal {
     status: Exclude<LeaderRunStatus, "running">;
     result?: unknown;
     error?: string;
+    /** 取消口停下的终局带 `cancelled`;其余缺席(列写 NULL)。 */
+    errorCode?: LeaderRunErrorCode;
 }
 /** `objective_preview` 的字符上限,与 DDL 的 VARCHAR(160) 同源(`task_run.objective_preview` 先例同宽)。 */
 export declare const LEADER_OBJECTIVE_PREVIEW_CHARS = 160;
@@ -67,6 +83,12 @@ export declare class SqlLeaderRunStore {
     getRun(id: string): Promise<LeaderRunRecord | undefined>;
     /** 按幂等键读回既有行(dup-key 观察臂;也给集成套件直查)。 */
     getByIdem(idemKey: string): Promise<LeaderRunRecord | undefined>;
+    /**
+     * 翻耐久取消旗 —— **只翻 `running` 行**(CAS:`WHERE status = 'running'`,与 task_run / image_bake 的 `requestCancel` 同形)。
+     * 回执 = 是否真的翻了:`false` ⇒ 行不在或已终局(取消口据此重读、按终局臂答)。驱动这条 run 的副本在下一个存活心跳拍读到它并中止;
+     * 与 {@link finishRun} 同一只谓词 ⇒ 两写在库里有先后:旗先到 ⇒ 终局写落定后的复读看得见它;终局先到 ⇒ 本 CAS 打空。
+     */
+    requestCancel(id: string): Promise<boolean>;
     /**
      * 陈旧 `running` 清算(codex 交叉复审 R1-high②,验真后修)。
      *

package/dist/plugins/leader-run-store-sql.js

@@ -4,8 +4,10 @@ import { mysqlDriver, pgDriver, dialectJsonEncoder } from "./sql-driver.js";
 import { decodeNullableJsonColumn, foldJsonColumn, jsonColumnText, readNonNullJsonValueColumn } from "./sql-json-column.js";
 import { ensureIndexes } from "./ensure-index.js";
 import { buildObjectivePreview } from "../user-authored-text.js";
+import { RUN_IDENTITY_COLUMNS, readRunIdentityCells, runIdentityCells } from "../identity-source.js";
 export const LEADER_RUN_TABLE = "leader_run";
 const LEADER_RUN_STATUSES = new Set(["running", "completed", "failed", "needs_human"]);
+const LEADER_RUN_ERROR_CODES = new Set(["cancelled"]);
 export const LEADER_OBJECTIVE_PREVIEW_CHARS = 160;
 export const TIDB_LEADER_RUN_STATEMENTS = [
     `CREATE TABLE IF NOT EXISTS ${LEADER_RUN_TABLE} (
@@ -22,6 +24,12 @@ export const TIDB_LEADER_RUN_STATEMENTS = [
      -- result:LeaderResult 的 JSON 原样(店不解释内部结构)。仅终局时写。
      result         JSON         NULL,
      error          TEXT         NULL,
+     -- error_code:终局的机读码(闭集 LeaderRunErrorCode;今天只有取消口停下的 run 写 cancelled,其余 NULL)。
+     error_code     VARCHAR(64)  NULL,
+     -- cancel_requested:耐久取消旗(与 task_run / image_bake 同形)。取消口只翻 running 行;驱动这条 run 的副本按存活心跳拍读它并中止。
+     cancel_requested SMALLINT   NOT NULL DEFAULT 0,
+     -- 受理时验过的身份元组三列(列定义的唯一属主 = identity-source.ts 的 RUN_IDENTITY_COLUMNS,与 task_run 内插同一段)。
+     ${RUN_IDENTITY_COLUMNS.mysql},
      started_at_ms  BIGINT       NOT NULL,
      finished_at_ms BIGINT       NULL,
      PRIMARY KEY (leader_run_id),
@@ -39,6 +47,9 @@ export const PG_LEADER_RUN_SCHEMA = [
      status         VARCHAR(16) COLLATE "C"  NOT NULL,
      result         JSONB        NULL,
      error          TEXT COLLATE "C"         NULL,
+     error_code     VARCHAR(64) COLLATE "C"  NULL,
+     cancel_requested SMALLINT   NOT NULL DEFAULT 0,
+     ${RUN_IDENTITY_COLUMNS.pg},
      started_at_ms  BIGINT       NOT NULL,
      finished_at_ms BIGINT       NULL,
      PRIMARY KEY (leader_run_id),
@@ -47,6 +58,7 @@ export const PG_LEADER_RUN_SCHEMA = [
 ];
 export const LEADER_RUN_INDEXES = [
     { table: `${LEADER_RUN_TABLE}`, name: "idx_leader_run_owner", columns: ["owner"] },
+    { table: `${LEADER_RUN_TABLE}`, name: "uq_leader_run_idem", columns: ["idem_key"], unique: true },
     { table: `${LEADER_RUN_TABLE}`, name: "idx_leader_run_started", columns: ["started_at_ms"] },
 ];
 export async function ensurePgLeaderRunSchema(q) {
@@ -57,7 +69,7 @@ export async function ensurePgLeaderRunSchema(q) {
 export const STALE_SWEEP_REASON = "leader run went stale: no replica settled it within LEADER_RUN_STALE_MS (the replica driving it most likely died). " +
     "The run was NOT taken over — re-submit with a NEW Idempotency-Key to run it again.";
 function selectCols(dialect) {
-    return `leader_run_id, owner, objective_preview, status, ${jsonColumnText(dialect, "result")}, error, started_at_ms, finished_at_ms`;
+    return `leader_run_id, owner, objective_preview, status, ${jsonColumnText(dialect, "result")}, error, error_code, cancel_requested, identity_source, identity_scope, identity_principal_inc, started_at_ms, finished_at_ms`;
 }
 function readResultColumn(text, id) {
     try {
@@ -67,6 +79,15 @@ function readResultColumn(text, id) {
         throw foldJsonColumn(e, (m) => `leader_run: ${m} — refusing rather than serve this run as if it had finished empty-handed`);
     }
 }
+function errorCodeOf(raw, id) {
+    if (raw == null)
+        return undefined;
+    const s = String(raw);
+    if (!LEADER_RUN_ERROR_CODES.has(s)) {
+        throw new Error(`leader_run ${id}: unknown error_code ${JSON.stringify(s)} (closed word table: ${[...LEADER_RUN_ERROR_CODES].join("|")}) — a newer replica wrote a word this build cannot interpret`);
+    }
+    return s;
+}
 function statusOf(raw, id) {
     const s = String(raw);
     if (!LEADER_RUN_STATUSES.has(s)) {
@@ -78,6 +99,7 @@ function mapRow(r) {
     const id = String(r.leader_run_id);
     const result = readResultColumn(r.result, id);
     const error = r.error == null ? undefined : String(r.error);
+    const errorCode = errorCodeOf(r.error_code, id);
     const finished = r.finished_at_ms == null ? undefined : Number(r.finished_at_ms);
     return {
         id,
@@ -86,6 +108,9 @@ function mapRow(r) {
         objectivePreview: r.objective_preview == null ? null : String(r.objective_preview),
         ...(result === undefined ? {} : { result }),
         ...(error === undefined ? {} : { error }),
+        ...(errorCode === undefined ? {} : { errorCode }),
+        cancelRequested: Number(r.cancel_requested) === 1,
+        identity: readRunIdentityCells(r.identity_source, r.identity_scope, r.identity_principal_inc),
         startedAtMs: Number(r.started_at_ms),
         ...(finished === undefined ? {} : { finishedAtMs: finished }),
     };
@@ -102,9 +127,10 @@ export class SqlLeaderRunStore {
         const id = uuidv7();
         const now = Date.now();
         const preview = buildObjectivePreview(input.objective, LEADER_OBJECTIVE_PREVIEW_CHARS);
-        const params = [id, input.idemKey, input.owner, preview, "running", now];
+        const cells = runIdentityCells(input.identity);
+        const params = [id, input.idemKey, input.owner, preview, "running", now, cells.identitySource, cells.identityScope, cells.identityPrincipalInc];
         try {
-            await this.db.query(this.q(`INSERT INTO ${LEADER_RUN_TABLE} (leader_run_id, idem_key, owner, objective_preview, status, started_at_ms) VALUES (?,?,?,?,?,?)`, `INSERT INTO ${LEADER_RUN_TABLE} (leader_run_id, idem_key, owner, objective_preview, status, started_at_ms) VALUES ($1,$2,$3,$4,$5,$6)`), params);
+            await this.db.query(this.q(`INSERT INTO ${LEADER_RUN_TABLE} (leader_run_id, idem_key, owner, objective_preview, status, started_at_ms, identity_source, identity_scope, identity_principal_inc) VALUES (?,?,?,?,?,?,?,?,?)`, `INSERT INTO ${LEADER_RUN_TABLE} (leader_run_id, idem_key, owner, objective_preview, status, started_at_ms, identity_source, identity_scope, identity_principal_inc) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)`), params);
         }
         catch (err) {
             if (isDupKeyError(this.db.dialect, err) && input.idemKey) {
@@ -129,6 +155,10 @@ export class SqlLeaderRunStore {
         const row = res.rows[0];
         return row ? mapRow(row) : undefined;
     }
+    async requestCancel(id) {
+        const res = await this.db.query(this.q(`UPDATE ${LEADER_RUN_TABLE} SET cancel_requested = 1 WHERE leader_run_id = ? AND status = 'running'`, `UPDATE ${LEADER_RUN_TABLE} SET cancel_requested = 1 WHERE leader_run_id = $1 AND status = 'running'`), [id]);
+        return res.affected > 0;
+    }
     async reapStaleRunning(staleMs, now) {
         const cutoff = now - staleMs;
         const res = await this.db.query(this.q(`UPDATE ${LEADER_RUN_TABLE} SET status = 'failed', error = ?, finished_at_ms = ? WHERE status = 'running' AND started_at_ms < ?`, `UPDATE ${LEADER_RUN_TABLE} SET status = 'failed', error = $1, finished_at_ms = $2 WHERE status = 'running' AND started_at_ms < $3`), [STALE_SWEEP_REASON, now, cutoff]);
@@ -139,7 +169,7 @@ export class SqlLeaderRunStore {
     }
     async finishRun(id, patch) {
         const json = dialectJsonEncoder(this.db.dialect);
-        const res = await this.db.query(this.q(`UPDATE ${LEADER_RUN_TABLE} SET status = ?, result = CAST(? AS JSON), error = ?, finished_at_ms = ? WHERE leader_run_id = ? AND status = 'running'`, `UPDATE ${LEADER_RUN_TABLE} SET status = $1, result = $2::jsonb, error = $3, finished_at_ms = $4 WHERE leader_run_id = $5 AND status = 'running'`), [patch.status, patch.result == null ? null : json(patch.result), patch.error ?? null, Date.now(), id]);
+        const res = await this.db.query(this.q(`UPDATE ${LEADER_RUN_TABLE} SET status = ?, result = CAST(? AS JSON), error = ?, error_code = ?, finished_at_ms = ? WHERE leader_run_id = ? AND status = 'running'`, `UPDATE ${LEADER_RUN_TABLE} SET status = $1, result = $2::jsonb, error = $3, error_code = $4, finished_at_ms = $5 WHERE leader_run_id = $6 AND status = 'running'`), [patch.status, patch.result == null ? null : json(patch.result), patch.error ?? null, patch.errorCode ?? null, Date.now(), id]);
         return res.affected > 0;
     }
 }