@sema-agent/server 7.8.1 → 7.10.0

package/dist/plugins/checkpoint-store-sql.js

@@ -27,6 +27,7 @@
  *   - schema ownership: TiDB DDL in tidb-pool.ts, PG DDL centrally in pg-pool.ts (neither store creates tables).
  */
 import { createHash } from "node:crypto";
+import { APPROVAL_GATE_KINDS_SQL_IN } from "../tool-approval.js"; // A-002.1 单一属主(SQL IN 片段从闭集数组派生)
 import { CheckpointError, validatePendingSteer, appendPendingSteer, checkpointVersionOf, winnerFromOutcome, summarizeCheckpoint, MAX_SUPPORTED_CHECKPOINT_VERSION, } from "@sema-agent/core";
 import { redactDeep } from "../trace/redact.js";
 import { parseJsonStrict as parseJson } from "./sql-row-helpers.js";
@@ -36,7 +37,7 @@ import { mysqlDriver, pgDriver, dialectProtocolJsonEncoder } from "./sql-driver.
 const MAX_TOOL_INPUT_CHARS = 8192;
 /**
  * design/80 D-1 (§3 invariant #3 — crash-safe reaper backstop): an ABSOLUTE upper bound on a pending
- * checkpoint's lifetime, stamped at put() into `terminal_at` INDEPENDENT of the per-approval `deadline`. The
+ * checkpoint's lifetime, stamped at put() into `terminal_at_ms` INDEPENDENT of the per-approval `deadline`. The
  * SLA-timer (D-D) does the fine, per-gate-kind resolve-deny; THIS coarse backstop ensures even a pending row
  * with a NULL `deadline` (no approval TTL configured) is eventually GC'd if the SLA service dies — closing a
  * forever-leak of a never-resolved suspension (the current `reap`/`reapExpired` only catch non-NULL deadlines).
@@ -45,15 +46,15 @@ const MAX_TOOL_INPUT_CHARS = 8192;
  */
 export const TERMINAL_BACKSTOP_MS = Math.max(60_000, Number(process.env.APPROVAL_TERMINAL_BACKSTOP_MS) || 30 * 86_400_000);
 /**
- * design/80 D-D (adversarial fix): the crash-safe `terminal_at` backstop must fall STRICTLY AFTER any SLA
- * `deadline`, never AT it. `terminal_at = max(createdAt+backstop, deadline)` made the two coincide whenever an
- * operator tuned APPROVAL_TERMINAL_BACKSTOP_MS at/below the SLA — and reapExpired's terminal_at-branch (which
+ * design/80 D-D (adversarial fix): the crash-safe `terminal_at_ms` backstop must fall STRICTLY AFTER any SLA
+ * `deadline`, never AT it. `terminal_at_ms = max(createdAt+backstop, deadline)` made the two coincide whenever an
+ * operator tuned APPROVAL_TERMINAL_BACKSTOP_MS at/below the SLA — and reapExpired's terminal_at_ms-branch (which
  * has NO gate_kind filter) then abort-EXPIRED a human/irreversible_ask gate in the SAME tick the deny-sweep
  * wanted to gracefully DENY it, racing it away. Adding this grace to the deadline term guarantees the deny-sweep
  * at least this window of clean ticks before the absolute backstop can fire. Far smaller than the backstop, so
  * it never meaningfully delays the eventual crash-safe GC.
  */
-export const TERMINAL_GRACE_MS = 3_600_000; // exported for the LOCAL twin's read-time terminal_at derivation (anti-drift) // 1h — many reaper intervals of deny-sweep runway past the SLA deadline
+export const TERMINAL_GRACE_MS = 3_600_000; // exported for the LOCAL twin's read-time terminal_at_ms derivation (anti-drift) // 1h — many reaper intervals of deny-sweep runway past the SLA deadline
 /**
  * The capability token IS the resume credential (token-as-auth) — anyone who reads it can impersonate a
  * resume, so it must never reach the logs (which fan out to a log-aggregation pipeline). For the diagnostic
@@ -302,8 +303,8 @@ export class SqlCheckpointStore {
         // payload without an N+1 trace.turns fetch. Stored as a stringified JSON column value.
         const toolInput = boundedToolInput(pa?.args);
         try {
-            await this.db.query(this.q("INSERT INTO checkpoint (token, scope, session_id, version, status, tool_name, tool_call_id, tool_input, checkpoint, deadline, created_at, terminal_at, gate_kind, bound_input_hash, risk_descriptor) " +
-                "VALUES (?,?,?,?,'pending',?,?,?,?,?,?,?,?,?,?)", "INSERT INTO checkpoint (token, scope, session_id, version, status, tool_name, tool_call_id, tool_input, checkpoint, deadline, created_at, terminal_at, gate_kind, bound_input_hash, risk_descriptor) " +
+            await this.db.query(this.q("INSERT INTO checkpoint (token, scope, session_id, version, status, tool_name, tool_call_id, tool_input, checkpoint, deadline, created_at_ms, terminal_at_ms, gate_kind, bound_input_hash, risk_descriptor) " +
+                "VALUES (?,?,?,?,'pending',?,?,?,?,?,?,?,?,?,?)", "INSERT INTO checkpoint (token, scope, session_id, version, status, tool_name, tool_call_id, tool_input, checkpoint, deadline, created_at_ms, terminal_at_ms, gate_kind, bound_input_hash, risk_descriptor) " +
                 "VALUES ($1,$2,$3,$4,'pending',$5,$6,$7::jsonb,$8::jsonb,$9,$10,$11,$12,$13,$14)"), [
                 token,
                 cp.scope,
@@ -315,7 +316,7 @@ export class SqlCheckpointStore {
                 this.json(cp, "checkpoint"),
                 cp.deadline ?? null,
                 cp.createdAt,
-                Math.max(cp.createdAt + TERMINAL_BACKSTOP_MS, (cp.deadline ?? 0) + TERMINAL_GRACE_MS), // D-1 §3 inv#3 backstop — STRICTLY after any SLA deadline (grace) so the terminal_at-branch never races the D-D deny-sweep, and never pre-empts an operator's longer TTL
+                Math.max(cp.createdAt + TERMINAL_BACKSTOP_MS, (cp.deadline ?? 0) + TERMINAL_GRACE_MS), // D-1 §3 inv#3 backstop — STRICTLY after any SLA deadline (grace) so the terminal_at_ms-branch never races the D-D deny-sweep, and never pre-empts an operator's longer TTL
                 cp.gate?.kind ?? null, // D-D SLA split: human/irreversible_ask deadline → resolve-deny; others → expire
                 pa?.boundInputHash ?? null, // D-1: the opaque hash the portal must echo on /decide (surfaced via listPending so the TOCTOU binding is reachable)
                 ((g) => (g?.riskDescriptor ? this.json(g.riskDescriptor, "risk descriptor") : null))(cp.gate), // riskDescriptor inbox: stamp core's INERT descriptor for triage-sort
@@ -412,8 +413,8 @@ export class SqlCheckpointStore {
         const params = [this.json(outcome, "checkpoint outcome"), Date.now(), token, scope];
         if (expect)
             params.push(expect.rev);
-        const res = await this.db.query(this.q("UPDATE checkpoint SET status = 'resolved', outcome = ?, decided_at = ?, rev = rev + 1, reopen_reason = NULL WHERE token = ? AND scope = ? AND status = 'pending'" +
-            (expect ? " AND rev = ?" : ""), "UPDATE checkpoint SET status = 'resolved', outcome = $1::jsonb, decided_at = $2, rev = rev + 1, reopen_reason = NULL WHERE token = $3 AND scope = $4 AND status = 'pending'" +
+        const res = await this.db.query(this.q("UPDATE checkpoint SET status = 'resolved', outcome = ?, decided_at_ms = ?, rev = rev + 1, reopen_reason = NULL WHERE token = ? AND scope = ? AND status = 'pending'" +
+            (expect ? " AND rev = ?" : ""), "UPDATE checkpoint SET status = 'resolved', outcome = $1::jsonb, decided_at_ms = $2, rev = rev + 1, reopen_reason = NULL WHERE token = $3 AND scope = $4 AND status = 'pending'" +
             (expect ? " AND rev = $5" : "")), params);
         return res.affected === 1;
     }
@@ -507,19 +508,19 @@ export class SqlCheckpointStore {
      * Uses `expired` (not a `resolve`-deny) so a CANCELLED checkpoint never pollutes resolved-count / outcome.
      */
     async expire(token, scope) {
-        const res = await this.db.query(this.q("UPDATE checkpoint SET status = 'expired', decided_at = ? WHERE token = ? AND scope = ? AND status = 'pending'", "UPDATE checkpoint SET status = 'expired', decided_at = $1 WHERE token = $2 AND scope = $3 AND status = 'pending'"), [Date.now(), token, scope]);
+        const res = await this.db.query(this.q("UPDATE checkpoint SET status = 'expired', decided_at_ms = ? WHERE token = ? AND scope = ? AND status = 'pending'", "UPDATE checkpoint SET status = 'expired', decided_at_ms = $1 WHERE token = $2 AND scope = $3 AND status = 'pending'"), [Date.now(), token, scope]);
         return res.affected === 1;
     }
     /** Interface reap: CAS-expire pending checkpoints in `scope` past `cutoff`. Returns count. */
     async reap(scope, cutoff) {
-        const res = await this.db.query(this.q("UPDATE checkpoint SET status = 'expired', decided_at = ? WHERE scope = ? AND status = 'pending' AND deadline IS NOT NULL AND deadline <= ?", "UPDATE checkpoint SET status = 'expired', decided_at = $1 WHERE scope = $2 AND status = 'pending' AND deadline IS NOT NULL AND deadline <= $3"), [Date.now(), scope, cutoff]);
+        const res = await this.db.query(this.q("UPDATE checkpoint SET status = 'expired', decided_at_ms = ? WHERE scope = ? AND status = 'pending' AND deadline IS NOT NULL AND deadline <= ?", "UPDATE checkpoint SET status = 'expired', decided_at_ms = $1 WHERE scope = $2 AND status = 'pending' AND deadline IS NOT NULL AND deadline <= $3"), [Date.now(), scope, cutoff]);
         return res.affected;
     }
     /**
      * GLOBAL sweep for the service's per-replica TTL reaper (expiry isn't tenant-
      * sensitive — only `resolve` is scoped). Idempotent across replicas (DB serializes; no election). Returns count.
-     * Called with `cutoff = Date.now()` (deadline/terminal_at are ABSOLUTE epoch-ms), so it expires any pending row
-     * whose per-approval `deadline` OR its design/80 D-1 §3-inv#3 `terminal_at` crash-safe backstop has passed —
+     * Called with `cutoff = Date.now()` (deadline/terminal_at_ms are ABSOLUTE epoch-ms), so it expires any pending row
+     * whose per-approval `deadline` OR its design/80 D-1 §3-inv#3 `terminal_at_ms` crash-safe backstop has passed —
      * the latter closes the forever-leak of a pending row with a NULL `deadline` (no approval TTL was configured).
      *
      * design/80 D-D: the deadline-branch EXPIRES (≈ abort) every kind EXCEPT a tool-approval human/irreversible_ask
@@ -528,14 +529,14 @@ export class SqlCheckpointStore {
      * AskUserQuestion ALSO mints gate.kind='human' (no question-specific kind in core) — but DENYING a question is
      * incoherent (the model gets a "denied" tool-result, not an answer), so it is carved BACK INTO the expire path
      * (COALESCE(tool_name,'')='AskUserQuestion') to abort-expire on timeout instead. Legacy rows (gate_kind NULL)
-     * stay on the expire path. The terminal_at-branch is the crash-safe backstop for ANY kind (incl. a human gate
+     * stay on the expire path. The terminal_at_ms-branch is the crash-safe backstop for ANY kind (incl. a human gate
      * whose deny-resume keeps failing) — it always abort-expires past the absolute cap (which is now STRICTLY after
      * the deadline, so it never races the deny-sweep at the deadline instant).
      */
     async reapExpired(cutoff) {
-        const res = await this.db.query(this.q("UPDATE checkpoint SET status = 'expired', decided_at = ? " +
-            "WHERE status = 'pending' AND ((deadline IS NOT NULL AND deadline <= ? AND (gate_kind IS NULL OR gate_kind NOT IN ('human','irreversible_ask') OR COALESCE(tool_name,'') = 'AskUserQuestion')) OR (terminal_at IS NOT NULL AND terminal_at <= ?))", "UPDATE checkpoint SET status = 'expired', decided_at = $1 " +
-            "WHERE status = 'pending' AND ((deadline IS NOT NULL AND deadline <= $2 AND (gate_kind IS NULL OR gate_kind NOT IN ('human','irreversible_ask') OR COALESCE(tool_name,'') = 'AskUserQuestion')) OR (terminal_at IS NOT NULL AND terminal_at <= $3))"), [Date.now(), cutoff, cutoff]);
+        const res = await this.db.query(this.q("UPDATE checkpoint SET status = 'expired', decided_at_ms = ? " +
+            `WHERE status = 'pending' AND ((deadline IS NOT NULL AND deadline <= ? AND (gate_kind IS NULL OR gate_kind NOT IN ${APPROVAL_GATE_KINDS_SQL_IN} OR COALESCE(tool_name,'') = 'AskUserQuestion')) OR (terminal_at_ms IS NOT NULL AND terminal_at_ms <= ?))`, "UPDATE checkpoint SET status = 'expired', decided_at_ms = $1 " +
+            `WHERE status = 'pending' AND ((deadline IS NOT NULL AND deadline <= $2 AND (gate_kind IS NULL OR gate_kind NOT IN ${APPROVAL_GATE_KINDS_SQL_IN} OR COALESCE(tool_name,'') = 'AskUserQuestion')) OR (terminal_at_ms IS NOT NULL AND terminal_at_ms <= $3))`), [Date.now(), cutoff, cutoff]);
         return res.affected;
     }
     /**
@@ -549,8 +550,8 @@ export class SqlCheckpointStore {
      * reapExpired's abort-expire path instead of this graceful-deny path.
      */
     async listExpiredApprovalGates(cutoff, limit = 100) {
-        const { rows } = await this.db.query(this.q("SELECT session_id, scope FROM checkpoint WHERE status = 'pending' AND gate_kind IN ('human','irreversible_ask') " +
-            "AND COALESCE(tool_name,'') <> 'AskUserQuestion' AND deadline IS NOT NULL AND deadline <= ? ORDER BY deadline ASC LIMIT ?", "SELECT session_id, scope FROM checkpoint WHERE status = 'pending' AND gate_kind IN ('human','irreversible_ask') " +
+        const { rows } = await this.db.query(this.q(`SELECT session_id, scope FROM checkpoint WHERE status = 'pending' AND gate_kind IN ${APPROVAL_GATE_KINDS_SQL_IN} ` +
+            "AND COALESCE(tool_name,'') <> 'AskUserQuestion' AND deadline IS NOT NULL AND deadline <= ? ORDER BY deadline ASC LIMIT ?", `SELECT session_id, scope FROM checkpoint WHERE status = 'pending' AND gate_kind IN ${APPROVAL_GATE_KINDS_SQL_IN} ` +
             "AND COALESCE(tool_name,'') <> 'AskUserQuestion' AND deadline IS NOT NULL AND deadline <= $1 ORDER BY deadline ASC LIMIT $2"), [cutoff, limit]);
         return rows.map((r) => ({ sessionId: String(r.session_id), scope: String(r.scope) }));
     }
@@ -559,11 +560,11 @@ export class SqlCheckpointStore {
      *  joined from task_active (the JOIN KEY to the run/trace — a suspended run KEEPS its
      *  session claim, so the join is live for every pending row; null only in pathological windows). */
     async listPending(scope) {
-        const base = "SELECT c.session_id, c.scope, c.tool_name, c.tool_call_id, c.tool_input, c.bound_input_hash, c.risk_descriptor, c.created_at, c.deadline, c.gate_kind, ta.task_id " +
+        const base = "SELECT c.session_id, c.scope, c.tool_name, c.tool_call_id, c.tool_input, c.bound_input_hash, c.risk_descriptor, c.created_at_ms, c.deadline, c.gate_kind, ta.task_id " +
             "FROM checkpoint c LEFT JOIN task_active ta ON ta.session_id = c.session_id WHERE c.status='pending'";
         const { rows } = scope
-            ? await this.db.query(`${base}${this.q(" AND c.scope=?", " AND c.scope=$1")} ORDER BY c.created_at ASC`, [scope])
-            : await this.db.query(`${base} ORDER BY c.created_at ASC`);
+            ? await this.db.query(`${base}${this.q(" AND c.scope=?", " AND c.scope=$1")} ORDER BY c.created_at_ms ASC`, [scope])
+            : await this.db.query(`${base} ORDER BY c.created_at_ms ASC`);
         const out = rows.map((r) => {
             const toolCallId = r.tool_call_id ?? null;
             const boundInputHash = r.bound_input_hash ?? null;
@@ -586,7 +587,7 @@ export class SqlCheckpointStore {
                 // Both drivers return the JSON column already parsed; null for pre-migration rows. PG 库内恒干净
                 // (拒绝式)——直读即审阅面=执行面。
                 input: r.tool_input ?? null,
-                createdAt: Number(r.created_at),
+                createdAt: Number(r.created_at_ms),
                 deadline: r.deadline == null ? null : Number(r.deadline),
                 riskDescriptor: parseJson(r.risk_descriptor),
             };
@@ -601,14 +602,14 @@ export class SqlCheckpointStore {
      * (gate kind + risk severity + budget spent + deadline per suspended task), no N+1 `get`s. The projection is
      * core's shared {@link summarizeCheckpoint} run over the persisted blob (the `checkpoint` column = the same full
      * {@link Checkpoint} `get()` parses), so this stays byte-identical to core's InMemory/Pg/File impls. Order =
-     * created_at ASC; callers (the inbox/scheduler) sort by severity. The COLUMN `status` is authoritative (the blob
+     * created_at_ms ASC; callers (the inbox/scheduler) sort by severity. The COLUMN `status` is authoritative (the blob
      * is the suspend-time snapshot), so it overrides the blob's status before the summary is derived.
      *
      * LIMIT bounds the fan-out (review w16yqkkxv): a triage view never needs more than a few — 500 is a generous
      * ceiling that still protects memory/latency if a scope ever accumulates pathologically many pending gates.
      */
     async listByScope(scope) {
-        const { rows } = await this.db.query(this.q("SELECT checkpoint, status FROM checkpoint WHERE status = 'pending' AND scope = ? ORDER BY created_at ASC LIMIT 500", "SELECT checkpoint, status FROM checkpoint WHERE status = 'pending' AND scope = $1 ORDER BY created_at ASC LIMIT 500"), [scope]);
+        const { rows } = await this.db.query(this.q("SELECT checkpoint, status FROM checkpoint WHERE status = 'pending' AND scope = ? ORDER BY created_at_ms ASC LIMIT 500", "SELECT checkpoint, status FROM checkpoint WHERE status = 'pending' AND scope = $1 ORDER BY created_at_ms ASC LIMIT 500"), [scope]);
         const out = [];
         for (const r of rows) {
             // A corrupt/missing blob skips THAT row rather than crashing the whole scheduler view (review w16yqkkxv):
@@ -637,7 +638,7 @@ export class SqlCheckpointStore {
      *
      * 「这条 PARKING 的 ask 究竟 park 成了哪张 checkpoint?」的唯一读法。为什么不是「按 session 翻历史页」:
      * 分页宽读会漏匹配,而漏匹配在收敛器那侧的后果是**假阴性 ⇒ 落一条不可逆的 DENIED**。所以这里改成
-     * 谓词精确查——`(scope, session_id, tool_call_id, created_at ≥ sinceMs)` 这组条件下的行数天然极小,
+     * 谓词精确查——`(scope, session_id, tool_call_id, created_at_ms ≥ sinceMs)` 这组条件下的行数天然极小,
      * 一次全量返回,结构上没有分页假阴性。
      *
      * 三条口径,逐条都是判据:
@@ -660,9 +661,9 @@ export class SqlCheckpointStore {
      * 维,列命中行结构上也必须解 blob 才拿得到它。
      */
     async findCheckpointCandidatesForAsk(scope, sessionId, toolCallId, sinceMs) {
-        const { rows } = await this.db.query(this.q("SELECT token, status, created_at, tool_call_id, bound_input_hash, version, checkpoint FROM checkpoint " +
-            "WHERE scope=? AND session_id=? AND created_at>=? AND (tool_call_id=? OR tool_call_id IS NULL) ORDER BY created_at ASC", "SELECT token, status, created_at, tool_call_id, bound_input_hash, version, checkpoint FROM checkpoint " +
-            "WHERE scope=$1 AND session_id=$2 AND created_at>=$3 AND (tool_call_id=$4 OR tool_call_id IS NULL) ORDER BY created_at ASC"), [scope, sessionId, sinceMs, toolCallId]);
+        const { rows } = await this.db.query(this.q("SELECT token, status, created_at_ms, tool_call_id, bound_input_hash, version, checkpoint FROM checkpoint " +
+            "WHERE scope=? AND session_id=? AND created_at_ms>=? AND (tool_call_id=? OR tool_call_id IS NULL) ORDER BY created_at_ms ASC", "SELECT token, status, created_at_ms, tool_call_id, bound_input_hash, version, checkpoint FROM checkpoint " +
+            "WHERE scope=$1 AND session_id=$2 AND created_at_ms>=$3 AND (tool_call_id=$4 OR tool_call_id IS NULL) ORDER BY created_at_ms ASC"), [scope, sessionId, sinceMs, toolCallId]);
         const out = [];
         for (const r of rows) {
             // `sourceTaskId: null` 是**所有 unparseable 臂的共同底**(读不出的行不许带出一个可用于身份比对的
@@ -670,7 +671,7 @@ export class SqlCheckpointStore {
             const base = {
                 token: String(r.token),
                 status: String(r.status),
-                createdAtMs: Number(r.created_at),
+                createdAtMs: Number(r.created_at_ms),
                 boundInputHash: r.bound_input_hash == null ? null : String(r.bound_input_hash),
                 sourceTaskId: null,
             };

package/dist/plugins/local-checkpoint-store.d.ts

@@ -84,7 +84,7 @@ export declare class LocalCheckpointStore {
      * design/80 D-D global expiry sweep — same kind-split as the TiDB twin: the deadline branch abort-expires
      * every kind EXCEPT a human/irreversible_ask approval gate (those get the graceful resolve-DENY via
      * listExpiredApprovalGates), with the AskUserQuestion carve-back (denying a question is incoherent → expire);
-     * the terminal_at branch (derived read-time via the SAME formula the TiDB put stamps) abort-expires ANY kind.
+     * the terminal_at_ms branch (derived read-time via the SAME formula the TiDB put stamps) abort-expires ANY kind.
      */
     reapExpired(cutoff: number): Promise<number>;
     /** design/80 D-D SLA deny-sweep input — pending human/irreversible_ask gates past deadline (excl. AskUserQuestion). */

package/dist/plugins/local-checkpoint-store.js

@@ -23,9 +23,10 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync, renameSync, unlinkSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
+import { isApprovalGateKind } from "../tool-approval.js"; // A-002.1 单一属主
 import { FileCheckpointStore, atomicWriteFile, sanitizePathComponent, } from "@sema-agent/core";
 import { boundedToolInput, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS } from "./checkpoint-store-sql.js";
-/** design/80 D-D read-time twin of the TiDB put-time `terminal_at` column (same formula — anti-drift). */
+/** design/80 D-D read-time twin of the TiDB put-time `terminal_at_ms` column (same formula — anti-drift). */
 function terminalAtOf(cp) {
     return Math.max(cp.createdAt + TERMINAL_BACKSTOP_MS, (cp.deadline ?? 0) + TERMINAL_GRACE_MS);
 }
@@ -285,7 +286,7 @@ export class LocalCheckpointStore {
      * design/80 D-D global expiry sweep — same kind-split as the TiDB twin: the deadline branch abort-expires
      * every kind EXCEPT a human/irreversible_ask approval gate (those get the graceful resolve-DENY via
      * listExpiredApprovalGates), with the AskUserQuestion carve-back (denying a question is incoherent → expire);
-     * the terminal_at branch (derived read-time via the SAME formula the TiDB put stamps) abort-expires ANY kind.
+     * the terminal_at_ms branch (derived read-time via the SAME formula the TiDB put stamps) abort-expires ANY kind.
      */
     async reapExpired(cutoff) {
         let n = 0;
@@ -294,7 +295,7 @@ export class LocalCheckpointStore {
             const toolName = cp.pendingAction?.toolName ?? "";
             const deadlineBranch = cp.deadline !== undefined &&
                 cp.deadline <= cutoff &&
-                (gateKind === undefined || !["human", "irreversible_ask"].includes(gateKind) || toolName === "AskUserQuestion");
+                (gateKind === undefined || !isApprovalGateKind(gateKind) || toolName === "AskUserQuestion");
             const terminalBranch = terminalAtOf(cp) <= cutoff;
             if ((deadlineBranch || terminalBranch) && (await this.inner.expire(token, cp.scope)))
                 n++;
@@ -308,7 +309,7 @@ export class LocalCheckpointStore {
             const gateKind = cp.gate?.kind;
             const toolName = cp.pendingAction?.toolName ?? "";
             if (gateKind !== undefined &&
-                ["human", "irreversible_ask"].includes(gateKind) &&
+                isApprovalGateKind(gateKind) &&
                 toolName !== "AskUserQuestion" &&
                 cp.deadline !== undefined &&
                 cp.deadline <= cutoff)

package/dist/plugins/memory-engine-pg.js

@@ -23,6 +23,7 @@ import { cosineDistance, jaccardDistance, termSet } from "@sema-agent/core";
 import { isUniqueViolation } from "./memory-engine-vector-util.js";
 import { computeEntryRev, serializeEntryFile } from "@sema-agent/core";
 import { pgSafeJsonStringify, pgHasUnstorable } from "./pg-safe-json.js";
+import { assertSlugWidth } from "./memory-key-guards.js"; // R5 批γ:slug 写前宽守卫
 /** Table names (single source). Deliberately DISJOINT from the legacy `agent_memory*` tables —
  *  the retired MemoryStore plane and this entry plane must never cross-write. */
 export const PG_MEMORY_ENGINE_TABLES = {
@@ -43,8 +44,8 @@ export async function ensurePgMemoryEngineSchema(query, opts = {}) {
     const embeddingCol = vec?.pgvector ? `vector(${vec.dimensions})` : "jsonb";
     await query(`CREATE TABLE IF NOT EXISTS ${PG_MEMORY_ENGINE_TABLES.entry} (
     id text COLLATE "C" PRIMARY KEY,
-    scope text COLLATE "C" NOT NULL,
-    slug text COLLATE "C" NOT NULL,
+    scope varchar(190) COLLATE "C" NOT NULL,
+    slug varchar(512) COLLATE "C" NOT NULL,
     frontmatter jsonb NOT NULL,
     body text COLLATE "C" NOT NULL,
     rev text COLLATE "C" NOT NULL,
@@ -65,7 +66,7 @@ export async function ensurePgMemoryEngineSchema(query, opts = {}) {
     // suffix. NOT wrapped in try/catch — if this constraint cannot be created, the backend is unsafe.
     await query(`CREATE UNIQUE INDEX IF NOT EXISTS uq_${PG_MEMORY_ENGINE_TABLES.entry}_scope_slug ON ${PG_MEMORY_ENGINE_TABLES.entry} (scope, slug)`);
     await query(`CREATE TABLE IF NOT EXISTS ${PG_MEMORY_ENGINE_TABLES.cursor} (
-    scope text COLLATE "C" PRIMARY KEY,
+    scope varchar(190) COLLATE "C" PRIMARY KEY,
     cursor text COLLATE "C" NOT NULL
   )`);
 }
@@ -278,6 +279,15 @@ export class PgMemoryEngineBackend {
                 report.conflicts.push({ op: "add", id: rawEntry.id, reason: "unstorable_bytes (PG cannot store NUL/lone surrogates; strip them at the source — the store never rewrites content)" });
                 return;
             }
+            // R5(批γ):slug 超列宽写前拒(reject-not-rewrite 同形;tidb 版同注)。守卫常量与 DDL 同源门
+            // 在 test/key-width-guards.test.ts。
+            try {
+                assertSlugWidth(rawEntry.slug);
+            }
+            catch (e) {
+                report.conflicts.push({ op: "add", id: rawEntry.id, reason: e instanceof Error ? e.message : String(e) });
+                return;
+            }
             const entry = rawEntry;
             // opus 审 C3: an add whose id already lives in a DIFFERENT scope is refused explicitly — the bare
             // `ON CONFLICT (id) DO UPDATE SET scope=…` would silently MOVE the row across scopes (and diverge

package/dist/plugins/memory-engine-tidb.js

@@ -24,6 +24,7 @@
 import { jaccardDistance, termSet } from "@sema-agent/core";
 import { computeEntryRev, serializeEntryFile } from "@sema-agent/core";
 import { pgHasUnstorable } from "./pg-safe-json.js";
+import { assertSlugWidth } from "./memory-key-guards.js"; // R5 批γ:slug 写前宽守卫
 /** Table names (single source) — SAME names as PG_MEMORY_ENGINE_TABLES (the two dialects never share
  *  one database), deliberately DISJOINT from the legacy `agent_memory*` MemoryStore plane. */
 export const TIDB_MEMORY_ENGINE_TABLES = {
@@ -234,6 +235,16 @@ export class TiDBMemoryEngineBackend {
                 report.conflicts.push({ op: "add", id: entry.id, reason: "unstorable_bytes (utf8mb4 cannot store NUL/lone surrogates without mangling; strip them at the source — the store never rewrites content)" });
                 return;
             }
+            // R5(批γ):slug 超列宽写前拒(reject-not-rewrite 同形)——非严格 MySQL 会静默截断,
+            // 截断=两个不同 slug 折叠成一行互串;PG/严格 MySQL 落裸错不可分类。守卫常量与 DDL 同源门在
+            // test/key-width-guards.test.ts。
+            try {
+                assertSlugWidth(entry.slug);
+            }
+            catch (e) {
+                report.conflicts.push({ op: "add", id: entry.id, reason: e instanceof Error ? e.message : String(e) });
+                return;
+            }
             // Cross-scope add refusal (opus 审 C3,Pg 版同注): an add whose id already lives in a DIFFERENT
             // scope must not silently MOVE the row; same-scope re-add stays the idempotent overwrite.
             // One probe serves BOTH the E-02 guard and the cross-scope refusal (File/Pg parity).

package/dist/plugins/memory-key-guards.d.ts

@@ -0,0 +1,8 @@
+/** R5(车A [3191] 欠账,批γ 落地):memory-engine 键宽写前守卫。
+ *  列宽收窄后,模型可控的条目名(slug)超宽此前落裸 SQL 错(PG `value too long`)或非严格 MySQL
+ *  静默截断(截断=两个不同 slug 折叠成一行=条目互串,最危险形)。写前响亮拒,错误可分类。
+ *  列宽同源门=test/key-width-guards.test.ts(守卫常量 vs 两方言 DDL 逐字对表)。 */
+/** memory-engine entry 表 `slug` 列宽(两方言 VARCHAR(512) 同宽;(scope,slug) UNIQUE 键预算注在 DDL)。 */
+export declare const MEMORY_SLUG_COLUMN_CHARS = 512;
+export declare function assertSlugWidth(slug: string): void;
+//# sourceMappingURL=memory-key-guards.d.ts.map

package/dist/plugins/memory-key-guards.js

@@ -0,0 +1,13 @@
+/** R5(车A [3191] 欠账,批γ 落地):memory-engine 键宽写前守卫。
+ *  列宽收窄后,模型可控的条目名(slug)超宽此前落裸 SQL 错(PG `value too long`)或非严格 MySQL
+ *  静默截断(截断=两个不同 slug 折叠成一行=条目互串,最危险形)。写前响亮拒,错误可分类。
+ *  列宽同源门=test/key-width-guards.test.ts(守卫常量 vs 两方言 DDL 逐字对表)。 */
+/** memory-engine entry 表 `slug` 列宽(两方言 VARCHAR(512) 同宽;(scope,slug) UNIQUE 键预算注在 DDL)。 */
+export const MEMORY_SLUG_COLUMN_CHARS = 512;
+export function assertSlugWidth(slug) {
+    if (slug.length > MEMORY_SLUG_COLUMN_CHARS) {
+        throw new Error(`memory entry slug exceeds ${MEMORY_SLUG_COLUMN_CHARS} characters (the slug column width both SQL dialects pin); ` +
+            `got ${slug.length} — shorten the entry name`);
+    }
+}
+//# sourceMappingURL=memory-key-guards.js.map

package/dist/plugins/pg-pool.js

@@ -96,11 +96,11 @@ export const PG_SCHEMA_STATEMENTS = [
      checkpoint   JSONB        NOT NULL,
      outcome      JSONB,
      deadline     BIGINT,
-     created_at   BIGINT       NOT NULL,
-     decided_at   BIGINT,
+     created_at_ms BIGINT      NOT NULL,
+     decided_at_ms BIGINT,
      rev          BIGINT       NOT NULL DEFAULT 0,
      reopen_reason VARCHAR(32) COLLATE "C",
-     terminal_at  BIGINT,
+     terminal_at_ms BIGINT,
      gate_kind    VARCHAR(32) COLLATE "C",
      bound_input_hash VARCHAR(190) COLLATE "C",
      -- pending_steer / pending_steer_queue / pending_steer_rev:队列化后的 durable steering(core 5.14.0
@@ -222,7 +222,7 @@ export const PG_SCHEMA_STATEMENTS = [
      source_run_id VARCHAR(191) COLLATE "C" NOT NULL,
      scope         VARCHAR(190) COLLATE "C" NOT NULL,
      new_run_id    VARCHAR(191) COLLATE "C" NOT NULL,
-     claimed_at    BIGINT       NOT NULL,
+     claimed_at_ms BIGINT       NOT NULL,
      PRIMARY KEY (source_run_id, scope)
    )`,
     // P1 (fleet failover): WorkflowRunStore + completion-inbox PG twins (design doc in workflow-run-store-sql.ts).
@@ -234,7 +234,7 @@ export const PG_SCHEMA_STATEMENTS = [
      run           TEXT COLLATE "C"         NOT NULL,
      rev           INTEGER      NOT NULL DEFAULT 0,
      created_at_ms BIGINT       NOT NULL,
-     ended_at      BIGINT,
+     ended_at_ms   BIGINT,
      PRIMARY KEY (id)
    )`,
     `CREATE INDEX IF NOT EXISTS idx_wfrun_scope_created ON workflow_run (scope, created_at_ms)`,
@@ -279,8 +279,8 @@ export const PG_SCHEMA_STATEMENTS = [
      acked          SMALLINT     NOT NULL DEFAULT 0,
      source_task_id VARCHAR(191) COLLATE "C",
      principal      VARCHAR(190) COLLATE "C",
-     created_at     BIGINT       NOT NULL,
-     acked_at       BIGINT,
+     created_at_ms  BIGINT       NOT NULL,
+     acked_at_ms    BIGINT,
      PRIMARY KEY (run_id)
    )`,
     `CREATE INDEX IF NOT EXISTS idx_wfnotify_acked ON workflow_notify_journal (acked)`,

package/dist/plugins/remote-env-k8s.js

@@ -949,10 +949,21 @@ export class RemoteK8sExecutionEnv {
                 if (finished)
                     break;
                 const waitMs = Math.max(1, idleMs - (Date.now() - lastChunk));
-                await new Promise((r) => {
-                    wake = r;
-                    setTimeout(r, Math.min(waitMs, 30_000));
-                });
+                // A-002.11: the wait races the drain timer against `wake` (a chunk / completion). When `wake` wins —
+                // the common case on a chatty command — the timer stays armed for up to 30s unless it is cleared, so a
+                // long-running command leaks one per drain cycle. Same `finally` cleanup form the E2B twin already uses
+                // for its idle timer (remote-env-e2b.ts execStream). Clearing an already-fired timer is a no-op.
+                let waitTimer;
+                try {
+                    await new Promise((r) => {
+                        wake = r;
+                        waitTimer = setTimeout(r, Math.min(waitMs, 30_000));
+                    });
+                }
+                finally {
+                    if (waitTimer !== undefined)
+                        clearTimeout(waitTimer);
+                }
                 if (!finished && Date.now() - lastChunk >= idleMs) {
                     throw new RemoteExecutionError("timeout", `execStream idle > ${idleMs}ms (suspected hang)`);
                 }

package/dist/plugins/run-store-sql.d.ts

@@ -263,11 +263,11 @@ export declare class SqlRunStore {
      */
     reapSuspended(olderThanMs: number): Promise<number>;
     /**
-     * design/80 §3 inv#3 (crash-safe backstop — the run-row half of the checkpoint `terminal_at` sweep): fail a
+     * design/80 §3 inv#3 (crash-safe backstop — the run-row half of the checkpoint `terminal_at_ms` sweep): fail a
      * suspended run whose durable checkpoint was ALREADY EXPIRED by `reapExpired` (past its `deadline` or its
-     * absolute `terminal_at`), and release its task_active (unlock the session). Runs UNCONDITIONALLY (no
+     * absolute `terminal_at_ms`), and release its task_active (unlock the session). Runs UNCONDITIONALLY (no
      * approval-TTL gate), CHECKPOINT-STATE-driven not time-driven, so it aligns EXACTLY with the per-row
-     * `terminal_at` (which never falls before an operator's >30d deadline) — unlike a uniform timer, which would
+     * `terminal_at_ms` (which never falls before an operator's >30d deadline) — unlike a uniform timer, which would
      * either be inert (gated off at APPROVAL_TIMEOUT_SEC=0) or prematurely kill a long gate. Safe against the two
      * windows a naive predicate mis-fires on: (a) the transient suspend-write window — a run suspended before its
      * checkpoint row exists has NO expired checkpoint, so it is not matched; (b) a re-suspended session that minted

package/dist/plugins/run-store-sql.js

@@ -563,11 +563,11 @@ export class SqlRunStore {
         return reaped;
     }
     /**
-     * design/80 §3 inv#3 (crash-safe backstop — the run-row half of the checkpoint `terminal_at` sweep): fail a
+     * design/80 §3 inv#3 (crash-safe backstop — the run-row half of the checkpoint `terminal_at_ms` sweep): fail a
      * suspended run whose durable checkpoint was ALREADY EXPIRED by `reapExpired` (past its `deadline` or its
-     * absolute `terminal_at`), and release its task_active (unlock the session). Runs UNCONDITIONALLY (no
+     * absolute `terminal_at_ms`), and release its task_active (unlock the session). Runs UNCONDITIONALLY (no
      * approval-TTL gate), CHECKPOINT-STATE-driven not time-driven, so it aligns EXACTLY with the per-row
-     * `terminal_at` (which never falls before an operator's >30d deadline) — unlike a uniform timer, which would
+     * `terminal_at_ms` (which never falls before an operator's >30d deadline) — unlike a uniform timer, which would
      * either be inert (gated off at APPROVAL_TIMEOUT_SEC=0) or prematurely kill a long gate. Safe against the two
      * windows a naive predicate mis-fires on: (a) the transient suspend-write window — a run suspended before its
      * checkpoint row exists has NO expired checkpoint, so it is not matched; (b) a re-suspended session that minted

package/dist/plugins/tidb-pool.js

@@ -233,8 +233,8 @@ export const SCHEMA_STATEMENTS = [
      checkpoint   JSON         NOT NULL,
      outcome      JSON         NULL,
      deadline     BIGINT       NULL,
-     created_at   BIGINT       NOT NULL,
-     decided_at   BIGINT       NULL,
+     created_at_ms BIGINT      NOT NULL,
+     decided_at_ms BIGINT      NULL,
      -- rev (design/80 D-1): monotonic optimistic-concurrency counter bumped on every resolve/reopen, so a
      -- resolve(expect) requires the rev the resume observed to still be live → fail-closed on a concurrent
      -- resolve-reopen cycle (core → checkpoint.reopened_concurrently).
@@ -244,10 +244,10 @@ export const SCHEMA_STATEMENTS = [
      -- tool_unavailable (a fresh decision is allowed). Drives core's reopen-revote validation.
      -- NULL = NEVER REOPENED (the first resume is unconstrained).
      reopen_reason VARCHAR(32)  NULL,
-     -- terminal_at: crash-safe ABSOLUTE lifetime backstop (design/80 §3 inv#3), distinct from the per-approval
+     -- terminal_at_ms: crash-safe ABSOLUTE lifetime backstop (design/80 §3 inv#3), distinct from the per-approval
      -- deadline, stamped at put(). NULL on PRE-MIGRATION rows — those keep their DEADLINE-BASED expiry (the old
      -- path); the backstop only covers rows suspended after the column existed.
-     terminal_at  BIGINT       NULL,
+     terminal_at_ms BIGINT     NULL,
      -- gate_kind (design/80 D-D, SLA-timer): the CheckpointGate.kind, stamped at put(), so the SLA sweep splits by
      -- kind WITHOUT parsing the JSON blob per row — human/irreversible_ask past deadline are resolve-DENIED (the
      -- model continues with a denial), resource_limit/needs_review are abandonment-TTL → expire().
@@ -430,7 +430,7 @@ export const SCHEMA_STATEMENTS = [
      source_run_id VARCHAR(191) NOT NULL,
      scope         VARCHAR(190) NOT NULL,
      new_run_id    VARCHAR(191) NOT NULL,
-     claimed_at    BIGINT       NOT NULL,
+     claimed_at_ms BIGINT       NOT NULL,
      PRIMARY KEY (source_run_id, scope)
    ) COLLATE utf8mb4_bin`,
     // P1 (fleet failover, 2026-07-05): durable cross-replica WorkflowRunStore twin — one row per run, the full
@@ -443,7 +443,7 @@ export const SCHEMA_STATEMENTS = [
      run           MEDIUMTEXT   NOT NULL,
      rev           INT          NOT NULL DEFAULT 0,
      created_at_ms BIGINT       NOT NULL,
-     ended_at      BIGINT       NULL,
+     ended_at_ms   BIGINT       NULL,
      PRIMARY KEY (id),
      KEY idx_wfrun_scope_created (scope, created_at_ms),
      KEY idx_wfrun_scope_status (scope, status)
@@ -494,8 +494,8 @@ export const SCHEMA_STATEMENTS = [
      acked          TINYINT(1)   NOT NULL DEFAULT 0,
      source_task_id VARCHAR(191) NULL,
      principal      VARCHAR(190) NULL,
-     created_at     BIGINT       NOT NULL,
-     acked_at       BIGINT       NULL,
+     created_at_ms  BIGINT       NOT NULL,
+     acked_at_ms    BIGINT       NULL,
      PRIMARY KEY (run_id),
      KEY idx_wfnotify_acked (acked)
    ) COLLATE utf8mb4_bin`,

package/dist/plugins/workflow-journal-store-sql.d.ts

@@ -41,7 +41,7 @@ import { type SqlDriver } from "./sql-driver.js";
 /** Dual-dialect durable WorkflowJournalStore. See the file header for the dialect-delta ledger. */
 /** RB-242 租约旋钮。TTL 只是**崩溃兜底**(engine 终态 finally 显式释放;[1981]/[1984] 两层分工:
  *  engine 崩了没释放 ⇒ 陈旧 claim 可被接管)。
- *  🔴 缺省 1h,与 core file 参考实现同值([1984] :284)——**租约无心跳**(claimed_at 在授予时刻定格,
+ *  🔴 缺省 1h,与 core file 参考实现同值([1984] :284)——**租约无心跳**(claimed_at_ms 在授予时刻定格,
  *  运行期间不刷新),所以 TTL 必须盖过最长合法 run 时长:取小了(我初版 15min)会在一次 >TTL 的活跑
  *  中把 claim 判陈旧、放另一副本进来接管——恰是本缝要防的双跑。要更短的接管等待,先给 engine 半场
  *  加心跳刷新,再谈调小。 */
@@ -89,8 +89,8 @@ export declare class SqlWorkflowJournalStore implements WorkflowJournalStore {
      *  语义(bake-store `idem_key UNIQUE` 先例):PK (source_run_id, scope) 上的原子赢或观察。四步,每步
      *  单语句原子,并发交叉在任一步都收敛到「恰一个持有者」:
      *   ① 抢空位:INSERT..DO NOTHING / ON DUP KEY 无操作 —— affected=1 即赢;
-     *   ② 同持有者幂等重入(engine 重试同一 resume):按 (键, new_run_id) 守卫的 claimed_at 刷新;
-     *   ③ TTL 崩溃兜底接管:claimed_at < now-ttl 守卫下的原子改持有者(engine 终态会显式释放,
+     *   ② 同持有者幂等重入(engine 重试同一 resume):按 (键, new_run_id) 守卫的 claimed_at_ms 刷新;
+     *   ③ TTL 崩溃兜底接管:claimed_at_ms < now-ttl 守卫下的原子改持有者(engine 终态会显式释放,
      *     走到这步=上一持有 engine 崩了没释放;两层分工见 SqlWorkflowJournalStoreOptions 注);
      *   ④ 都没赢 ⇒ 读在位者返 {granted:false, holder}(holder 进 engine 的拒绝文案供归因)。 */
     resumeClaim(input: {

package/dist/plugins/workflow-journal-store-sql.js

@@ -76,8 +76,8 @@ export class SqlWorkflowJournalStore {
      *  语义(bake-store `idem_key UNIQUE` 先例):PK (source_run_id, scope) 上的原子赢或观察。四步,每步
      *  单语句原子,并发交叉在任一步都收敛到「恰一个持有者」:
      *   ① 抢空位:INSERT..DO NOTHING / ON DUP KEY 无操作 —— affected=1 即赢;
-     *   ② 同持有者幂等重入(engine 重试同一 resume):按 (键, new_run_id) 守卫的 claimed_at 刷新;
-     *   ③ TTL 崩溃兜底接管:claimed_at < now-ttl 守卫下的原子改持有者(engine 终态会显式释放,
+     *   ② 同持有者幂等重入(engine 重试同一 resume):按 (键, new_run_id) 守卫的 claimed_at_ms 刷新;
+     *   ③ TTL 崩溃兜底接管:claimed_at_ms < now-ttl 守卫下的原子改持有者(engine 终态会显式释放,
      *     走到这步=上一持有 engine 崩了没释放;两层分工见 SqlWorkflowJournalStoreOptions 注);
      *   ④ 都没赢 ⇒ 读在位者返 {granted:false, holder}(holder 进 engine 的拒绝文案供归因)。 */
     async resumeClaim(input) {
@@ -85,20 +85,20 @@ export class SqlWorkflowJournalStore {
         const ins = await this.db.query(this.q(
         // INSERT IGNORE(非 ON DUP KEY 无操作形):TiDB 对「无变化的 DUP KEY UPDATE」affected 报 1
         // (MySQL 报 0)——真双库跑出来的方言差;IGNORE 形两家都在冲突时报 0。
-        "INSERT IGNORE INTO workflow_resume_claim (source_run_id, scope, new_run_id, claimed_at) VALUES (?, ?, ?, ?)", "INSERT INTO workflow_resume_claim (source_run_id, scope, new_run_id, claimed_at) VALUES ($1, $2, $3, $4) ON CONFLICT (source_run_id, scope) DO NOTHING"), [input.sourceRunId, input.scope, input.newRunId, now]);
+        "INSERT IGNORE INTO workflow_resume_claim (source_run_id, scope, new_run_id, claimed_at_ms) VALUES (?, ?, ?, ?)", "INSERT INTO workflow_resume_claim (source_run_id, scope, new_run_id, claimed_at_ms) VALUES ($1, $2, $3, $4) ON CONFLICT (source_run_id, scope) DO NOTHING"), [input.sourceRunId, input.scope, input.newRunId, now]);
         if (ins.affected === 1)
             return { granted: true };
-        const refresh = await this.db.query(this.q("UPDATE workflow_resume_claim SET claimed_at = ? WHERE source_run_id = ? AND scope = ? AND new_run_id = ?", "UPDATE workflow_resume_claim SET claimed_at = $1 WHERE source_run_id = $2 AND scope = $3 AND new_run_id = $4"), [now, input.sourceRunId, input.scope, input.newRunId]);
+        const refresh = await this.db.query(this.q("UPDATE workflow_resume_claim SET claimed_at_ms = ? WHERE source_run_id = ? AND scope = ? AND new_run_id = ?", "UPDATE workflow_resume_claim SET claimed_at_ms = $1 WHERE source_run_id = $2 AND scope = $3 AND new_run_id = $4"), [now, input.sourceRunId, input.scope, input.newRunId]);
         if (refresh.affected >= 1)
             return { granted: true };
-        const takeover = await this.db.query(this.q("UPDATE workflow_resume_claim SET new_run_id = ?, claimed_at = ? WHERE source_run_id = ? AND scope = ? AND claimed_at < ?", "UPDATE workflow_resume_claim SET new_run_id = $1, claimed_at = $2 WHERE source_run_id = $3 AND scope = $4 AND claimed_at < $5"), [input.newRunId, now, input.sourceRunId, input.scope, now - this.resumeClaimTtlMs]);
+        const takeover = await this.db.query(this.q("UPDATE workflow_resume_claim SET new_run_id = ?, claimed_at_ms = ? WHERE source_run_id = ? AND scope = ? AND claimed_at_ms < ?", "UPDATE workflow_resume_claim SET new_run_id = $1, claimed_at_ms = $2 WHERE source_run_id = $3 AND scope = $4 AND claimed_at_ms < $5"), [input.newRunId, now, input.sourceRunId, input.scope, now - this.resumeClaimTtlMs]);
         if (takeover.affected >= 1)
             return { granted: true };
         const holder = await this.db.query(this.q("SELECT new_run_id FROM workflow_resume_claim WHERE source_run_id = ? AND scope = ?", "SELECT new_run_id FROM workflow_resume_claim WHERE source_run_id = $1 AND scope = $2"), [input.sourceRunId, input.scope]);
         // 行在①-③间被释放的窄窗:holder 读空 ⇒ 如实返 denied 无 holder(engine 下一次重试会在①赢)。
         const row = holder.rows[0];
         const holderId = row?.new_run_id === undefined ? undefined : String(row.new_run_id);
-        // ②的 UPDATE 在 MySQL 缺省协议下只数**被改变**的行——同毫秒重入(claimed_at 未变)会 affected=0
+        // ②的 UPDATE 在 MySQL 缺省协议下只数**被改变**的行——同毫秒重入(claimed_at_ms 未变)会 affected=0
         // 掉到这里;持有者==自己仍是 granted(幂等重入语义不依赖 affected 的方言细节)。
         if (holderId === input.newRunId)
             return { granted: true };

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -12,7 +12,7 @@
  *
  * ## WorkflowRunStore twin
  * One row per run: the full `WorkflowRun` as a JSON blob + EXTRACTED columns for everything SQL needs to
- * index/filter (scope, status, created_at_ms, ended_at) + an authoritative `rev` column (the OCC key — the
+ * index/filter (scope, status, created_at_ms, ended_at_ms) + an authoritative `rev` column (the OCC key — the
  * blob's own `rev` is OVERLAID from the column on every read, so writes never have to know the bumped value
  * up front). `update` is a single-statement CAS (`WHERE id AND scope [AND rev]`, `SET rev = rev + 1`);
  * `listByScope` projects через core's SHARED `summarizeWorkflowRun` (anti-drift — identical to InMemory/File).