@sema-agent/server 7.147.0 → 7.149.0

package/dist/plugins/ensure-schema-lock-policy.js

@@ -1,3 +1,4 @@
+import { writeLogText } from "../observability/logger.js";
 export const LOCK_PROBE_INITIAL_JITTER_MS = 400;
 export const LOCK_PROBE_WARN_EVERY = 40;
 export const MAX_CONSECUTIVE_LOCK_PROBE_ERRORS = 5;
@@ -5,27 +6,93 @@ export function lockProbeBackoffMs(attempt) {
     return 100 + Math.min(attempt, 3) * 100 + Math.floor(Math.random() * 150);
 }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-export async function pollUntilLocked(tryOnce, opts) {
-    await sleep(Math.floor(Math.random() * LOCK_PROBE_INITIAL_JITTER_MS));
+const TIDB_PESSIMISTIC_RETRY_LIMIT = "pessimistic lock retry limit reached";
+function isTidbPessimisticRetryLimit(err) {
+    return err?.message === TIDB_PESSIMISTIC_RETRY_LIMIT;
+}
+function lockStatements(id) {
+    switch (id.dialect) {
+        case "mysql":
+            return {
+                probe: "SELECT GET_LOCK(?, 0) AS got",
+                release: "SELECT RELEASE_LOCK(?)",
+                params: [id.name],
+                label: `GET_LOCK('${id.name}')`,
+                held: (row) => Number(row?.got) === 1,
+                contended: isTidbPessimisticRetryLimit,
+            };
+        case "pg":
+            return id.keys.length === 1
+                ? { probe: "SELECT pg_try_advisory_lock($1) AS got", release: "SELECT pg_advisory_unlock($1)", params: [...id.keys], label: `pg advisory lock ${id.keys[0]}`, held: (row) => row?.got === true, contended: () => false }
+                : { probe: "SELECT pg_try_advisory_lock($1, $2) AS got", release: "SELECT pg_advisory_unlock($1, $2)", params: [...id.keys], label: `pg advisory lock ${id.keys[0]}/${id.keys[1]}`, held: (row) => row?.got === true, contended: () => false };
+        default: {
+            const unreachable = id;
+            throw new Error(`unreachable advisory-lock dialect: ${JSON.stringify(unreachable)}`);
+        }
+    }
+}
+const UNTIL_HELD = { initialJitterMs: LOCK_PROBE_INITIAL_JITTER_MS, maxAttempts: Number.POSITIVE_INFINITY, backoffMs: lockProbeBackoffMs };
+async function pollLock(tryOnce, budget, opts) {
+    if (budget.initialJitterMs > 0)
+        await sleep(Math.floor(Math.random() * budget.initialJitterMs));
     let consecutiveErrors = 0;
-    for (let attempt = 0;; attempt++) {
+    let lastMsg = "";
+    let lastErr;
+    for (let attempt = 0; attempt < budget.maxAttempts; attempt++) {
         try {
             if (await tryOnce())
-                return;
+                return true;
             consecutiveErrors = 0;
         }
         catch (err) {
             consecutiveErrors += 1;
-            const msg = err?.message ?? String(err);
-            console.warn(`[${opts.tag}] ${opts.label} probe attempt ${attempt + 1} threw (${consecutiveErrors}/${MAX_CONSECUTIVE_LOCK_PROBE_ERRORS}):`, msg);
+            lastErr = err;
+            lastMsg = err?.message ?? String(err);
+            writeLogText("stderr", `[${opts.tag}] ${opts.label} probe attempt ${attempt + 1} threw (${consecutiveErrors}/${MAX_CONSECUTIVE_LOCK_PROBE_ERRORS}):`, lastMsg);
             if (consecutiveErrors >= MAX_CONSECUTIVE_LOCK_PROBE_ERRORS) {
-                throw new Error(`[${opts.tag}] ${opts.label}: lock probe threw ${MAX_CONSECUTIVE_LOCK_PROBE_ERRORS} times in a row — the connection itself is unusable, refusing to poll forever (last: ${msg})`, { cause: err });
+                throw new Error(`[${opts.tag}] ${opts.label}: lock probe threw ${MAX_CONSECUTIVE_LOCK_PROBE_ERRORS} times in a row — the connection itself is unusable, refusing to poll forever (last: ${lastMsg})`, { cause: err });
             }
         }
         if (attempt > 0 && attempt % LOCK_PROBE_WARN_EVERY === 0) {
-            console.warn(`[${opts.tag}] still waiting for ${opts.label} (another replica is running the serialized DDL; attempt ${attempt})`);
+            writeLogText("stderr", `[${opts.tag}] still waiting for ${opts.label} (another session holds it; attempt ${attempt})`);
         }
-        await sleep(lockProbeBackoffMs(attempt));
+        if (attempt + 1 < budget.maxAttempts)
+            await sleep(budget.backoffMs(attempt));
+    }
+    if (consecutiveErrors > 0) {
+        throw new Error(`[${opts.tag}] ${opts.label}: the attempt budget (${budget.maxAttempts}) ran out while the lock probe was still throwing (${consecutiveErrors} in a row) — not reading that as "held by another" (last: ${lastMsg})`, { cause: lastErr });
+    }
+    return false;
+}
+export async function pollUntilLocked(tryOnce, opts) {
+    await pollLock(tryOnce, UNTIL_HELD, opts);
+}
+async function tryAdvisoryLock(conn, stmts) {
+    try {
+        const res = await conn.query(stmts.probe, stmts.params);
+        return stmts.held(res.rows[0]);
+    }
+    catch (err) {
+        if (stmts.contended(err))
+            return false;
+        throw err;
+    }
+}
+export async function acquireAdvisoryLock(conn, id, tag) {
+    const stmts = lockStatements(id);
+    await pollLock(() => tryAdvisoryLock(conn, stmts), UNTIL_HELD, { tag, label: stmts.label });
+}
+export async function acquireAdvisoryLockWithin(conn, id, tag, attempts, sleepMs) {
+    const stmts = lockStatements(id);
+    return pollLock(() => tryAdvisoryLock(conn, stmts), { initialJitterMs: 0, maxAttempts: attempts, backoffMs: () => sleepMs }, { tag, label: stmts.label });
+}
+export async function releaseAdvisoryLock(conn, id, tag) {
+    const stmts = lockStatements(id);
+    try {
+        await conn.query(stmts.release, stmts.params);
+    }
+    catch (err) {
+        writeLogText("stderr", `[${tag}] releasing ${stmts.label} failed (the lock auto-frees when the connection closes):`, err);
     }
 }
 //# sourceMappingURL=ensure-schema-lock-policy.js.map

package/dist/plugins/file-run-store.d.ts

@@ -1,6 +1,6 @@
 import { type UsageRow } from "../usage-analytics.js";
 import type { TaskStatus } from "@sema-agent/core";
-import { StoreBootRefusalError, type FenceLanded, type FencedRun, type InProcessClaimFence, type CreateRunOutcome, type NewRunMeta, type RunIdemBinding, type RunListQuery, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef, type SettledLegMemoryObservation } from "./store-contracts.js";
+import { StoreBootRefusalError, type RunStallWiring, type SessionRootRows, type FenceLanded, type FencedRun, type InProcessClaimFence, type CreateRunOutcome, type NewRunMeta, type RunIdemBinding, type RunListQuery, type RunRecord, type SessionRunRollup, type RunEvent, type PersistedTaskResult, type LatestRunRef, type SettledLegMemoryObservation } from "./store-contracts.js";
 import type { RunStoreCheckpointProbe } from "./memory-run-store.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 import { type SpaceCommitClaim, type SpaceCommitReading, type SpaceCommitState } from "../workspace-space-commit.js";
@@ -65,12 +65,22 @@ export declare class FileRunStore implements InProcessClaimFence {
     private readonly claimLocks;
     /** 件6(#43 案 [ref]):启动期告警座(可选)。既有调用方不传 ⇒ 只走 fail-open 遥测那一半,不炸。 */
     private readonly logger;
+    /**
+     * 规则 L 的根行面({@link SessionRootRows}):`createRun` 先在它的锁里判根行在不在,再取认领锁。**必填**、惰性取(会话店构造时要本店,
+     * 所以装配方交一只取法:`LocalBackend` = `() => this.sessionStore`)。没有可选形、没有 setter、没有缺省:缺它的 run 店答不出 `sessionAbsent`,
+     * 删除 / 导入 / markMirror 读到的认领就又能被超车。
+     */
+    private readonly rootRows;
     /** [ref] 件B(census 第 29 行终局):`RUN_STORE_STRICT_HYDRATE` 的**部署级**表态。
      *  `true` ⇒ hydrate 的 readdir 失败拒启;缺席/`false` ⇒ 件6 的记债腿,行为字节不变。 */
     private readonly strictHydrate;
-    constructor(root: string, opts?: {
+    /** 落死亡判决的窗与计数(构造时拿到;SQL 孪生同注,见 {@link RunStallWiring})。 */
+    private readonly stall;
+    constructor(root: string, opts: {
+        readonly rootRows: () => SessionRootRows;
         error?(msg: string, fields?: Record<string, unknown>): void;
         strictHydrate?: boolean;
+        readonly stall?: RunStallWiring;
     });
     private runDir;
     private runJsonPath;
@@ -166,7 +176,8 @@ export declare class FileRunStore implements InProcessClaimFence {
     isCancelRequested(taskId: string, owner: string | null): Promise<boolean>;
     requestPreempt(taskId: string, owner: string | null): Promise<boolean>;
     isPreemptRequested(taskId: string, owner: string | null): Promise<boolean>;
-    heartbeat(taskId: string, owner: string | null): Promise<void>;
+    /** 心跳:刷新并交回「行还在 running 吗」(持有者据它停腿;SQL 孪生同注)。 */
+    heartbeat(taskId: string, owner: string | null): Promise<boolean>;
     appendEvent(taskId: string, seq: number, type: LedgerEventType, data: unknown): Promise<void>;
     /**
      * 写口里第四个盘面的那一段(与事件行的追加在**同一同步调用**里,块在前):帧经编解码拆成引用形 + 段体,本会话块账本里还没有的段体先追加
@@ -193,15 +204,16 @@ export declare class FileRunStore implements InProcessClaimFence {
     /** The terminal write's one synchronous section (SQL twin: one transaction): the k8s space's pending commit record (when
      *  offered) → the terminal row → the active-run claim release. Returns whether the pending record is now this run's. */
     private writeTerminal;
-    /** Durable F4: park NON-terminal `suspended`, KEEP the task_active claim. CAS on running/suspended (reaper-revert guard).
-     *  [ref]:同时落 `result` —— 封口脱敏后的投影(`sealRunRowResult`,凭据不落;`null` = 没观察到 park 结果),SQL 孪生同注。 */
-    setSuspended(taskId: string, result: PersistedTaskResult | null): Promise<void>;
-    /** [ref] D-B: park NON-terminal `needs_review`, KEEP the claim. CAS on running/needs_review.
-     *  [ref]:同 {@link setSuspended} 落封口脱敏后的 `result`。 */
-    setNeedsReview(taskId: string, result: PersistedTaskResult | null): Promise<void>;
-    /** Durable F4 resume: flip suspended/needs_review → running (CAS) + reset cancel/preempt flags.
-     *  [ref](codex R1 [medium]):认领 = 接管 `instanceId`(= 当前持有副本;SQL 孪生同注)。CAS 输不改。 */
-    markResuming(taskId: string, instanceId: string): Promise<boolean>;
+    /** Durable F4: park NON-terminal `suspended`, KEEP the task_active claim. CAS = 行仍归 `legId` ∧ running / suspended ∧ 没挂取消请求(三件的理由见 SQL 孪生)。
+     *  [ref]:同时落 `result` —— 封口脱敏后的投影(`sealRunRowResult`,凭据不落;`null` = 没观察到 park 结果),SQL 孪生同注。
+     *  交回 CAS 的答(内存 / SQL 孪生同义):`true` ⇔ 这一写之后行停在这个词上;`false` ⇔ 三件有一件不成立(或行不在)。判与落盘同一个同步段。 */
+    setSuspended(taskId: string, result: PersistedTaskResult | null, legId: string): Promise<boolean>;
+    /** [ref] D-B: park NON-terminal `needs_review`, KEEP the claim. CAS = {@link setSuspended} 的三件(词换成 needs_review)。
+     *  [ref]:同 {@link setSuspended} 落封口脱敏后的 `result`;CAS 的答同 {@link setSuspended}。 */
+    setNeedsReview(taskId: string, result: PersistedTaskResult | null, legId: string): Promise<boolean>;
+    /** Durable F4 resume: flip suspended/needs_review → running (CAS);认领 = 换持有腿(铸新的 `legId` 交回)+ 两面请求旗随旧腿清零(SQL 孪生同注)。
+     *  [ref](codex R1 [medium]):认领 = 接管 `instanceId`(= 当前持有副本;SQL 孪生同注)。CAS 输不改、交回 `undefined`。 */
+    markResuming(taskId: string, instanceId: string): Promise<string | undefined>;
     getActiveTaskId(sessionId: string): Promise<string | undefined>;
     /** 认领当写栅栏用(契约 = `store-contracts.ts` 的 `InProcessClaimFence`):判、刷新活性(同步落盘)与 `write` 是同一个同步段。 */
     whileHoldingClaim(sessionId: string, taskId: string, write: (run: FencedRun) => FenceLanded): boolean;
@@ -211,6 +223,13 @@ export declare class FileRunStore implements InProcessClaimFence {
      *  the error answer invites a retry, and a retry with the same key must run, not replay the refusal. The row stays (it
      *  is the refusal's record); only the binding is freed. */
     releaseIdemKey(taskId: string): Promise<void>;
+    /** 放一条行上的提交幂等键绑定(盘先、索引后;`releaseIdemKey` 与 `withdrawMintedRun` 的非在跑臂同读)。同步段。 */
+    private dropIdemBinding;
+    /**
+     * 撤回本请求铸的这一条 run(SQL 孪生同判同序,律见那里的头注):行上的持有腿不是 `legId` ⇒ 不是本腿的行,一个字节不动;是 ⇒ 行仍在跑 ⇒ 严格删行({@link dropRun}:盘先、索引后;删不掉 ⇒ 抛,认领与行都没动)、
+     * 再放本行持有的那一枚认领;已终局 ⇒ 行零删(收割 / 终局先到,那一份就是这条行的结局),只放它上面的提交幂等键;停驻 ⇒ 一个字节不动。同步段,不让出事件循环。交回删没删。
+     */
+    withdrawMintedRun(taskId: string, legId: string): Promise<boolean>;
     /** The body fingerprint this row's binding of `idem.key` holds — binding `idem.bodyFingerprint` first when it holds none (first
      *  arrival binds and is persisted, everyone after reads; the file twin of the SQL conditional UPDATE — one writer per data root,
      *  single-threaded between the check and the write). `null` = no such row, or the row is not bound to this key (never written). */
@@ -221,7 +240,7 @@ export declare class FileRunStore implements InProcessClaimFence {
     listRuns(opts: RunListQuery): Promise<RunRecord[]>;
     /**
      * [ref] —— 这个会话**最近一条腿**的窄指针({@link SqlRunStore.latestRunForSession} 的孪生:同一个排序口径
-     *  `createdAt DESC, taskId DESC`,与本店 {@link FileRunStore.listSessions} 挑 `rn=1` 那一行的比较器逐字同一份)。
+     *  `createdAt DESC, taskId DESC`,与本店窄读面 {@link FileRunStore.sessionRunRollups} 挑最新一条的比较器同一口径 —— `session-run-rollup.ts` 的 `newer`)。
      */
     latestRunForSession(sessionId: string): Promise<LatestRunRef | undefined>;
     /**
@@ -229,25 +248,16 @@ export declare class FileRunStore implements InProcessClaimFence {
      * {@link SqlRunStore.latestMemoryObservationForSession} 的孪生:同一只已结谓词(`isTerminalRunStatus`)、同一个排序口径 —— 与本店 {@link FileRunStore.latestRunForSession} 的比较器逐字同一份)。
      */
     latestMemoryObservationForSession(sessionId: string): Promise<SettledLegMemoryObservation | undefined>;
-    /** DISTINCT sessions newest-first by last activity (the CC /resume picker): latest run's preview/status + first/last/count. */
-    listSessions(opts: {
-        owner?: string;
-        includeUnowned?: boolean;
-        cursor?: {
-            lastActivityAt: string;
-            sessionId: string;
-        };
-        limit: number;
-        q?: string;
-    }): Promise<SessionSummary[]>;
+    /** 会话枚举面读 run 账的窄读面(`SessionRunRollupSource`;规则 = 共用纯函数 {@link buildSessionRunRollups},与内存孪生、SQL 会话店的列表子查询同读)。 */
+    sessionRunRollups(opts?: {
+        readonly q?: string;
+    }): Promise<ReadonlyMap<string, SessionRunRollup>>;
     /** E21 (§0.5 delete) — purge the runs ledger for one session, scoped by `session_id` ALONE (per-row owner is the
-     *  submitting principal and diverges from the session owner — full 判据 see the SQL twin's head-note, F-A);
-     *  aborts (returns {active}) if a run is live。`expectedSessionOwner` = SQL 双生的化身围栏入参,本孪生执行不了
-     *  (账本里没有 session_meta),理由与替代围栏逐字见 {@link MemoryRunStore.deleteBySession}。 */
-    deleteBySession(sessionId: string, expectedSessionOwner: string | null): Promise<{
+     *  submitting principal and diverges from the session owner — full 判据 see the SQL twin's head-note, F-A)。
+     *  **不判认领**(会话三态,`src/session-deletion.ts`):唯一的生产调用点是删除协调器的账本腿,它在围栏(根行锁里判过「没有认领」、写下在删令牌)之后才调,
+     *  在删期间规则 L 不让认领落下 —— 这里没有可判的东西。 */
+    deleteBySession(sessionId: string): Promise<{
         removed: number;
-    } | {
-        active: string;
     }>;
     /** 用量扫窗——in-memory 腿:遍历窗内行,投影同 usage-analytics 纯函数(SQL 孪生 parity)。 */
     usageScan(fromMs: number, toMs: number, opts?: {
@@ -268,7 +278,13 @@ export declare class FileRunStore implements InProcessClaimFence {
     private sweepClaims;
     /** Flip every `running` row matching `pred` → failed (with the death sentence `reason` + its machine `code`), then sweep terminal claims. */
     private reapRunning;
-    reapStale(olderThanMs: number): Promise<number>;
+    /** 收割器(全表形;SQL 孪生同注):判决 `due` 的 `running` 行判死 + 放终局认领。窗读构造时拿到的 getter。 */
+    reapStale(): Promise<number>;
+    /**
+     * 观察口(落判决的三处之一;SQL 孪生同注):属主门之后的那条行 —— `due` ⇒ 单行判死(与收割器同一只 {@link reapRunning})+ 放认领、交回当前行;否则原样、零 I/O。
+     * 落盘失败 ⇒ F 类留痕 + 行原样交回(收割器下一拍补;副本写律保证索引里的行一字未动)。
+     */
+    observeRun(row: RunRecord): Promise<RunRecord>;
     /** TOC integration ask③ (INTEGRATION-DESIGN §11): a host-lane engine restart leaves the PREVIOUS process's
      *  `running` rows orphaned — their in-process driver (runInBackground, in the dead process's memory) is gone, but the
      *  `active/<sessionId>` claim persists on disk and EEXIST-blocks a re-submit (the shell reads the session as stuck).
@@ -384,13 +400,50 @@ export declare class FileRunStore implements InProcessClaimFence {
     private takeOverClaim;
     /** Release a session's single-active claim: unlink the claim file + drop the index entry (idempotent). */
     private releaseClaim;
-    /** Drop a run entirely (registry + event log + open fd + on-disk dir) — used by deleteBySession. */
+    /**
+     * 删一条 run 的**唯一删法**(删会话 {@link deleteBySession} 与提交出口的撤回 {@link withdrawRunsOf} 同一形)—— **严格**:盘先、索引后。
+     * 先关这条 run 的事件 fd(开着的文件在 win32 上删不掉;fd 只是缓存,下一次追加按需重开)→ 删 run 目录(删不掉 ⇒ **抛**,索引一个字节不动:这条 run 仍完整可读,
+     * 重试从同一状态开始)→ fsync `runs` 目录(删掉的目录项在盘上;win32 不 fsync 目录,与原子写同一条平台律)→ 才拆内存索引(事件、幂等键、行)。
+     * 修前是「先拆索引、删目录失败静默」:删不掉的目录在重启后 hydrate 回一条僵尸 run,而调用方已答「删了」。
+     */
     private dropRun;
+    /**
+     * 提交出口条件撤回的 run 半(`local-session-store.ts` 的 {@link SessionRunWithdrawSource};local 会话店在这只会话的写锁 = 根行锁里调 —— 本方法不取根行锁、不让出事件循环):
+     * 本会话有 `ownTaskId` 之外的 run 行 ⇒ `{ keep: "runs" }`,一个字节不删;否则与 {@link deleteBySession} 同序删:块账本先、本次 run 后(严格删法 {@link dropRun})。
+     * `ownTaskId` 那一行不属于这只会话 ⇒ 响亮抛(调用方交错了 id,不猜)。认领由调用方的判官先判过(在 ⇒ 不会走到这里)。
+     */
+    withdrawRunsOf(sessionId: string, ownTaskId: string | undefined): "proceed" | {
+        readonly keep: "runs";
+    };
+    /**
+     * 一次性迁移 **M44 的 local 腿**(窗、删法与删后谁接住:窗口见 `plugins/one-time-migrations.ts` 登记表):`errorCode` 只读列 —— 列建立之前 / 停驻写口不写列时写下的行,
+     * 列改写成「这条行在稳定、非到期时修前 `GET` 会答的码」= 结果投影的码(读盘面认两代形并折码)?? 列的原值;`running` 行的列置空(续跑认领清列)。盘上与内存同改(副本写律)。
+     * 起服时调(`LocalBackend.runOneTimeMigrations`,任何读者之前);数据根独占 ⇒ 本车道没有混跑窗,不需要读侧半场。幂等:第二跑零命中零写盘。
+     */
+    migrateRunErrorCodeColumnM44(): number;
+    /**
+     * 一次性迁移 **M45 的 local 腿**(窗、删法与删后谁接住:窗口见 `plugins/one-time-migrations.ts` 登记表):预览列以闭集注入块开标签起头的行(7.124.0 之前写下的形)
+     * 剥到不动点 —— 判据与新值同 SQL 腿(`run-preview-m45.ts` 唯一一份)。盘上与内存同改(副本写律)。
+     * 起服时调(`LocalBackend.runOneTimeMigrations`,任何读者之前);数据根独占 ⇒ 没有混跑窗。幂等:写后的值不再以开标签起头 ⇒ 第二跑零命中零写盘。
+     */
+    migrateRunObjectivePreviewM45(): number;
+    /**
+     * 一次性迁移 **M48 的 local 腿**(run 行半场;窗、删法与删后谁接住:窗口见 `plugins/one-time-migrations.ts` 登记表):属主恰为 cli 哨兵(`shell-sentinel-owner-m48.ts`)的 run 行
+     * 改写成无主。盘上与内存同改(副本写律)。起服时调(`LocalBackend.runOneTimeMigrations`,任何读者之前);数据根独占 ⇒ 没有混跑窗。幂等:第二跑零命中零写盘。
+     * 命中的行由 {@link shellSentinelRunsM48} 说(与 {@link countShellSentinelOwnersM48} 同一只)。
+     */
+    clearShellSentinelOwnersM48(): number;
+    /** 一次性迁移 **M48 的 local 腿**(有身份边界的部署:只数不写):属主恰为 cli 哨兵的 run 行数 —— 命中判据与 {@link clearShellSentinelOwnersM48} 同一只({@link shellSentinelRunsM48})。读内存索引,零写。 */
+    countShellSentinelOwnersM48(): number;
+    /** M48(local 腿)命中的 run 行:属主恰为 cli 哨兵({@link isShellSentinelOwnerM48})—— 改写与留存计数共用的**唯一**判据。先取快照再改(改写会 `persist` 替换索引里的行)。随 M48 删。 */
+    private shellSentinelRunsM48;
     /**
      * 一次性迁移 **M32 的 local 腿**(执行放置回填;窗、删法与删后谁接住:窗口见 `plugins/one-time-migrations.ts` 登记表):有 run 行的会话 id(去重)。
      * 起服时调(`LocalBackend.runOneTimeMigrations`,任何读者之前);读内存索引(构造时已从盘上 hydrate),零写。
      */
     sessionIdsWithRuns(): ReadonlySet<string>;
+    /** 一次性迁移 **M42 的 local 腿**(场景前缀的切换检查;窗口见 `plugins/one-time-migrations.ts` 登记表):属主以保留前缀开头的 run 行数。读内存索引(构造时已 hydrate),零写。 */
+    scenarioPrefixOwnerRowsM42(): number;
     /** Release every open event-log fd (called by LocalBackend.close so a graceful restart can re-open the data dir). */
     dispose(): void;
 }