@wjarka/cezarion 0.15.1 → 0.16.0

package/dist/runs/store.d.ts

@@ -1,9 +1,13 @@
 import { EventEmitter } from 'node:events';
+import { type WorkerExecution } from './worker-execution.ts';
 import { z } from 'zod';
-import type { CiWait, ConversationState, AgentInput, InboxClaim, DelegationState, WorkerCollectedResult } from '../contract/index.js';
+import type { ArchiveFinishedScope, ArchivedRunsResponse, CiWait, ConversationState, AgentInput, InboxClaim, DelegationState, RunSummary, WorkerCollectedResult, WorkerDestroyRetry } from '../contract/index.js';
+import { type TranscriptFacts } from './transcript-facts.ts';
 import { type WorkerExecutionIdentity } from '../delegation/execution-identity.ts';
-import { type WorkerProcessRecord } from '../delegation/process-liveness.ts';
+import { type CwdSource, type WorkerProcessRecord } from '../delegation/process-liveness.ts';
 import { workflowDefSchema } from '../workflows/types.ts';
+import { type RawExtras } from './raw-record.ts';
+import { RunStoreOpenError } from './store-open-error.ts';
 import type { RunnerId } from '../core/agent-runner.ts';
 export type RunStatus = 'queued' | 'running' | 'waiting' | 'review' | 'done' | 'failed' | 'cancelled';
 /**
@@ -51,9 +55,10 @@ declare const stepStateSchema: z.ZodObject<{
         "claude-cli": "claude-cli";
         codex: "codex";
         cursor: "cursor";
+        omp: "omp";
         opencode: "opencode";
         pi: "pi";
-    }>, z.ZodTransform<"claude" | "codex" | "cursor" | "opencode" | "pi", "claude" | "claude-cli" | "codex" | "cursor" | "opencode" | "pi">>>;
+    }>, z.ZodTransform<"claude" | "codex" | "cursor" | "omp" | "opencode" | "pi", "claude" | "claude-cli" | "codex" | "cursor" | "omp" | "opencode" | "pi">>>;
     profileId: z.ZodOptional<z.ZodString>;
     costUsd: z.ZodOptional<z.ZodNumber>;
     synthetic: z.ZodOptional<z.ZodLiteral<"continuation">>;
@@ -68,8 +73,8 @@ declare const queuedMessageSchema: z.ZodObject<{
     images: z.ZodOptional<z.ZodArray<z.ZodString>>;
     createdAt: z.ZodString;
 }, z.core.$strip>;
-/** Exported for `./run-index.ts`, the read-only reader of the same file. Nothing else should
- *  parse `runs.json` — see `reconcileLoadedRun` for why a second parser is a correctness risk. */
+/** Exported for `./run-index.ts`, the read-only reader of the same records. Nothing else should
+ *  parse a stored run — see `reconcileLoadedRun` for why a second parser is a correctness risk. */
 export declare const runRecordSchema: z.ZodObject<{
     id: z.ZodString;
     title: z.ZodString;
@@ -603,6 +608,15 @@ export declare const runRecordSchema: z.ZodObject<{
         deliveredAt: z.ZodOptional<z.ZodISODateTime>;
     }, z.core.$strict>>;
     lastCiWaitError: z.ZodOptional<z.ZodString>;
+    previewServers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        port: z.ZodNumber;
+        command: z.ZodString;
+        cwd: z.ZodOptional<z.ZodString>;
+        label: z.ZodString;
+        path: z.ZodOptional<z.ZodString>;
+        registeredAt: z.ZodISODateTime;
+        answeredAtRegistration: z.ZodBoolean;
+    }, z.core.$strip>>>;
     taskImages: z.ZodOptional<z.ZodArray<z.ZodString>>;
     model: z.ZodOptional<z.ZodString>;
     effort: z.ZodOptional<z.ZodString>;
@@ -612,9 +626,10 @@ export declare const runRecordSchema: z.ZodObject<{
         "claude-cli": "claude-cli";
         codex: "codex";
         cursor: "cursor";
+        omp: "omp";
         opencode: "opencode";
         pi: "pi";
-    }>, z.ZodTransform<"claude" | "codex" | "cursor" | "opencode" | "pi", "claude" | "claude-cli" | "codex" | "cursor" | "opencode" | "pi">>>;
+    }>, z.ZodTransform<"claude" | "codex" | "cursor" | "omp" | "opencode" | "pi", "claude" | "claude-cli" | "codex" | "cursor" | "omp" | "opencode" | "pi">>>;
     agentProfile: z.ZodOptional<z.ZodString>;
     systemPrompt: z.ZodOptional<z.ZodString>;
     generateFollowups: z.ZodOptional<z.ZodBoolean>;
@@ -631,6 +646,22 @@ export declare const runRecordSchema: z.ZodObject<{
         event: z.ZodString;
         githubUrl: z.ZodString;
     }, z.core.$strip>>;
+    automationTrigger: z.ZodOptional<z.ZodObject<{
+        automationId: z.ZodString;
+        automationRevision: z.ZodNumber;
+        receiptId: z.ZodString;
+        trigger: z.ZodEnum<{
+            "catch-up": "catch-up";
+            manual: "manual";
+            schedule: "schedule";
+        }>;
+        occurrenceAt: z.ZodString;
+    }, z.core.$strip>>;
+    destroyRetry: z.ZodCatch<z.ZodOptional<z.ZodObject<{
+        attempts: z.ZodNumber;
+        nextAt: z.ZodISODateTime;
+        needsAttention: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strict>>>;
     status: z.ZodEnum<{
         cancelled: "cancelled";
         done: "done";
@@ -678,6 +709,17 @@ export declare const runRecordSchema: z.ZodObject<{
     branch: z.ZodOptional<z.ZodString>;
     baseBranch: z.ZodOptional<z.ZodString>;
     worktreeReclaimedAt: z.ZodOptional<z.ZodString>;
+    worktreeSetup: z.ZodCatch<z.ZodOptional<z.ZodObject<{
+        status: z.ZodEnum<{
+            done: "done";
+            failed: "failed";
+            running: "running";
+        }>;
+        startedAt: z.ZodString;
+        finishedAt: z.ZodOptional<z.ZodString>;
+        durationMs: z.ZodOptional<z.ZodNumber>;
+        error: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
     groupId: z.ZodOptional<z.ZodString>;
     variant: z.ZodOptional<z.ZodString>;
     clientRequestId: z.ZodOptional<z.ZodString>;
@@ -727,9 +769,10 @@ export declare const runRecordSchema: z.ZodObject<{
             "claude-cli": "claude-cli";
             codex: "codex";
             cursor: "cursor";
+            omp: "omp";
             opencode: "opencode";
             pi: "pi";
-        }>, z.ZodTransform<"claude" | "codex" | "cursor" | "opencode" | "pi", "claude" | "claude-cli" | "codex" | "cursor" | "opencode" | "pi">>>;
+        }>, z.ZodTransform<"claude" | "codex" | "cursor" | "omp" | "opencode" | "pi", "claude" | "claude-cli" | "codex" | "cursor" | "omp" | "opencode" | "pi">>>;
         profileId: z.ZodOptional<z.ZodString>;
         costUsd: z.ZodOptional<z.ZodNumber>;
         synthetic: z.ZodOptional<z.ZodLiteral<"continuation">>;
@@ -749,6 +792,7 @@ export declare const runRecordSchema: z.ZodObject<{
                 claude: "claude";
                 codex: "codex";
                 cursor: "cursor";
+                omp: "omp";
                 opencode: "opencode";
                 pi: "pi";
             }>>;
@@ -1090,11 +1134,20 @@ export declare function parseRunRecords(raw: unknown): z.ZodSafeParseResult<{
         deliveredAt?: string | undefined;
     } | undefined;
     lastCiWaitError?: string | undefined;
+    previewServers?: {
+        port: number;
+        command: string;
+        cwd?: string | undefined;
+        label: string;
+        path?: string | undefined;
+        registeredAt: string;
+        answeredAtRegistration: boolean;
+    }[] | undefined;
     taskImages?: string[] | undefined;
     model?: string | undefined;
     effort?: string | undefined;
     modelIdentity?: string | undefined;
-    runner?: "claude" | "codex" | "cursor" | "opencode" | "pi" | undefined;
+    runner?: "claude" | "codex" | "cursor" | "omp" | "opencode" | "pi" | undefined;
     agentProfile?: string | undefined;
     systemPrompt?: string | undefined;
     generateFollowups?: boolean | undefined;
@@ -1111,6 +1164,18 @@ export declare function parseRunRecords(raw: unknown): z.ZodSafeParseResult<{
         event: string;
         githubUrl: string;
     } | undefined;
+    automationTrigger?: {
+        automationId: string;
+        automationRevision: number;
+        receiptId: string;
+        trigger: "catch-up" | "manual" | "schedule";
+        occurrenceAt: string;
+    } | undefined;
+    destroyRetry?: {
+        attempts: number;
+        nextAt: string;
+        needsAttention?: true | undefined;
+    } | undefined;
     status: "cancelled" | "done" | "failed" | "queued" | "review" | "running" | "waiting";
     stopping?: boolean | undefined;
     activity?: "monitoring" | undefined;
@@ -1144,6 +1209,13 @@ export declare function parseRunRecords(raw: unknown): z.ZodSafeParseResult<{
     branch?: string | undefined;
     baseBranch?: string | undefined;
     worktreeReclaimedAt?: string | undefined;
+    worktreeSetup?: {
+        status: "done" | "failed" | "running";
+        startedAt: string;
+        finishedAt?: string | undefined;
+        durationMs?: number | undefined;
+        error?: string | undefined;
+    } | undefined;
     groupId?: string | undefined;
     variant?: string | undefined;
     clientRequestId?: string | undefined;
@@ -1176,7 +1248,7 @@ export declare function parseRunRecords(raw: unknown): z.ZodSafeParseResult<{
         finishedAt?: string | undefined;
         error?: string | undefined;
         sessionId?: string | undefined;
-        backend?: "claude" | "codex" | "cursor" | "opencode" | "pi" | undefined;
+        backend?: "claude" | "codex" | "cursor" | "omp" | "opencode" | "pi" | undefined;
         profileId?: string | undefined;
         costUsd?: number | undefined;
         synthetic?: "continuation" | undefined;
@@ -1192,7 +1264,7 @@ export declare function parseRunRecords(raw: unknown): z.ZodSafeParseResult<{
             model?: string | undefined;
             effort?: string | undefined;
             timeoutMs?: number | undefined;
-            runner?: "claude" | "codex" | "cursor" | "opencode" | "pi" | undefined;
+            runner?: "claude" | "codex" | "cursor" | "omp" | "opencode" | "pi" | undefined;
             agentProfile?: string | undefined;
             allowedTools?: string[] | undefined;
             bashAllowlist?: string[] | undefined;
@@ -1206,6 +1278,18 @@ export declare function parseRunRecords(raw: unknown): z.ZodSafeParseResult<{
         path?: string | undefined;
     } | undefined;
 }[]>;
+/** One stored record and what its JSON holds beyond the runtime schema (raw-record.ts), which
+ *  the next write of its row puts back. */
+export interface DecodedRun {
+    run: RunRecord;
+    extras: RawExtras | undefined;
+}
+/** One database row's `data` back into a record and its extras. Undefined when it does not parse:
+ *  one unreadable row costs that row only. */
+export declare function decodeRunRow(data: string): DecodedRun | undefined;
+/** One database row's `data` back into a record, for a reader that never writes it back. */
+export declare function decodeRunRecord(data: string): RunRecord | undefined;
+export { LEGACY_INDEX_BACKUP_FILE, LEGACY_INDEX_FILE } from './legacy-index.ts';
 export type StepState = z.infer<typeof stepStateSchema>;
 export type QueuedMessage = z.infer<typeof queuedMessageSchema>;
 export type RunRecord = z.infer<typeof runRecordSchema>;
@@ -1217,6 +1301,10 @@ export interface RunEvent {
     type: string;
     [key: string]: unknown;
 }
+/** How many archived root runs the run lists carry per project (#864): `GET /run-summaries?archived=recent`
+ *  and `GET /workspace/runs-index`. Unarchived runs are never cut; older archived runs page in
+ *  through `GET /run-summaries/archived` and the workspace search. */
+export declare const ARCHIVED_WINDOW = 200;
 /** The repository a project IS, as `resolveRepoHandle` reports it. `null`/absent means "unknown",
  *  which is a real and common state (no `gh`, no remote, a non-git root) — never an error. */
 export type RepoHandle = {
@@ -1239,6 +1327,18 @@ export type RepoHandle = {
 export declare function reconcileLoadedRun(run: RunRecord, opts?: {
     keepLive?: boolean;
 }): RunRecord;
+/**
+ * Settle a live run whose owning process died, when a control adopts it (#779, plan step 3), so
+ * that adopting never starts agent work: only Continue may, with the user's own input. A run that
+ * never started is cancelled before it began, which Continue restarts as it would after a Stop (the
+ * same "untouched" test as `isUntouchedCancelledRun`); any other live run is interrupted, exactly as
+ * an open that does not recover settles it, and Continue resumes its last session. With `stop`
+ * (the control is Stop, and this is its run) a live run is cancelled instead, as an accepted Stop
+ * always reads. Mutates `run`.
+ */
+export declare function settleOrphanedRun(run: RunRecord, opts?: {
+    stop?: boolean;
+}): RunRecord;
 /**
  * Drop this run's referenced PR/issue if the project's handle proves it foreign and the prompt
  * does not corroborate it (#945). Returns whether anything changed.
@@ -1248,25 +1348,314 @@ export declare function reconcileLoadedRun(run: RunRecord, opts?: {
  * format is untouched and whose cleared fields were already optional.
  */
 export declare function rescopeRun(run: RunRecord, handle?: RepoHandle | null): boolean;
+export declare function __setLegacyImportHookForTests(hook?: {
+    beforeTransaction?: () => void;
+    beforeCommit?: () => void;
+}): void;
+/** What branch cleanup and git-log attribution read about a run (`RunStore.listBranchOwners`). */
+export interface BranchOwner {
+    id: string;
+    title: string;
+    status: RunStatus;
+    archived: boolean;
+    createdAt: string;
+    /** The branch the run owns (see `encodeRunRow`); absent for a run listed for its PR alone. */
+    branch?: string;
+    baseBranch?: string;
+    pullRequestUrl?: string;
+}
+/** A record as a branch owner, or undefined when it owns no branch and created no PR: the
+ *  projection `listBranchOwners` reads off a row's summary and columns, computed from memory. */
+export declare function branchOwnerOf(run: RunRecord): BranchOwner | undefined;
+/** Who may hold a run in memory besides its own record (see `RunStore.pin`). `maintenance` is the
+ *  RunManager's publish, worktree-reclaim and branch-cleanup claims, held across their async work. */
+export type RunPinHolder = 'active' | 'continue' | 'cleanup' | 'maintenance';
+/**
+ * Who may change a run, as this store sees it (#779, plan step 3; `RunStore.runOwnership`):
+ * - `held`: this store claims its delegation family;
+ * - `free`: no live process claims it and nothing in its family is live; a write takes it. A
+ *   proven-dead owner's claim on such a family counts for nothing: there is nothing to recover;
+ * - `orphaned`: nobody alive owns a family that still has a live run (its owner died, or nobody
+ *   claimed it): taking it means adopting it first (`RunStore.adoptFamily` settles it, then the
+ *   manager recovers the family);
+ * - `foreign`: another process that is alive (or cannot be proven dead) holds it: read-only here;
+ * - `quarantined`: a write found it changed under this store; refused until cezar restarts.
+ */
+export type RunOwnership = 'held' | 'free' | 'orphaned' | 'foreign' | 'quarantined';
+/** The one answer every control gives for a run another cezar process owns (`409 { error }`). */
+export declare const RUN_IN_USE_ELSEWHERE = "run is in use by another cezar process";
+/** The answer for a run this process stopped writing after a conflicting write. */
+export declare const RUN_QUARANTINED = "run changed under this cezar process \u2014 restart cezar to reload it";
+/** A write this store must not make: another process owns the run, its owner died with work
+ *  still live (adopt it first), or a conflict quarantined it. Nothing was changed. */
+export declare class RunWriteRefusedError extends Error {
+    readonly runId: string;
+    readonly ownership: Exclude<RunOwnership, 'held' | 'free'>;
+    constructor(runId: string, ownership: Exclude<RunOwnership, 'held' | 'free'>);
+}
+/** Newest first, runs created in the same millisecond in insertion order: the order `runs.db`
+ *  lists in, and the order every list had while it was a stable sort of the in-memory map. */
+/** Why a `run` event fired, when a delegation checkpoint caused it (in-process only). */
+export type CommitSource = 'delegation-checkpoint' | 'delegation-destroy-progress';
+/**
+ * A stored summary, or undefined when the row holds none (a row seeded without one, or text that
+ * is not a summary): the caller then projects the record instead. The column is written only by
+ * `encodeRunRow`, from a record the schema accepted, so this checks the shape a list row cannot
+ * do without rather than running the full contract schema — on a cockpit's thousand rows that
+ * schema costs more than reading them. The cold reader (`run-index.ts`), which reads other
+ * projects' databases, still validates in full.
+ */
+export declare function parseStoredSummary(text: string): RunSummary | undefined;
+/** The bulk-archive sweep's one predicate (#780): finished, not archived, not scheduled (a
+ *  `failed` run waiting out a usage limit), not an owned worker (those leave with their parent),
+ *  then filtered by pin state. Mirrored clause for clause by `isSweepable` in the cockpit's
+ *  `lib/tasks-table.ts`. */
+export declare function isSweepable(run: Pick<RunRecord, 'archived' | 'status' | 'autoResumeAt' | 'pinned'> & {
+    delegation?: {
+        role: string;
+    };
+}, scope?: ArchiveFinishedScope): boolean;
 /**
- * File-backed run store: `runs.json` index (atomic tmp+rename writes, the
- * pattern from @cezar/core's IssueStore) plus one append-only NDJSON event
- * file per run. Also the in-process event bus the SSE endpoints subscribe to:
- * emits `('run', RunRecord)` and `('event', { runId, event: RunEvent })`.
+ * File-backed run store: one row per run in `runs.db` (#779, `./run-database.ts`) plus one
+ * append-only NDJSON event file per run. Also the in-process event bus the SSE endpoints
+ * subscribe to: emits `('run', RunRecord)` and `('event', { runId, event: RunEvent })`.
+ *
+ * Only the held set lives in memory (#779, Amendment 2): live runs, the runs a RunManager pins,
+ * their delegation families, and runs whose latest write has not settled yet (see `isHeld`).
+ * `getRun` answers a held run with the held object, so `commitIndex` still installs into the
+ * record a caller holds; any other run is read from `runs.db` as a fresh copy every time (frozen
+ * under vitest, so an in-place write throws instead of being lost). Writes to a finished run go
+ * through the methods here, which load it, change it and persist the row like any other.
+ *
+ * Two write paths, both through `writeIndex`:
+ * - optimistic: a method changes the held record, marks it dirty and schedules the debounced
+ *   save, which writes the dirty rows and deletions only;
+ * - durable (`commitIndex`): one transaction with the changed rows AND everything a debounced
+ *   save still owes. Only once it commits do the records change in memory, and only then do
+ *   subscribers hear about it.
+ *
+ * Several processes may open one project (`serve` and a headless `cez run`), so a store writes
+ * only the delegation families it claims in `run_claims` (#779, plan step 3; `run-claims.ts`).
+ * Everything it holds is claimed: open claims the live rows nobody alive owns and leaves the rest
+ * alone, and a write to a run not in memory claims its family first, or refuses it while another
+ * live process owns it. Claims are released once a family leaves memory, and all of them on
+ * `close()`; a crashed owner's are taken over only once it is proven dead. Every write is fenced
+ * in its transaction: if a row is not as this store last saw it, or its claim is gone, nothing is
+ * written, the evidence goes to `run_conflicts` and this store stops writing that row
+ * (`handleConflicts`).
  */
 export declare class RunStore extends EventEmitter {
     private readonly dataDir;
-    private runs;
+    /** The held set: every record this store keeps in memory, by id. */
+    private readonly held;
+    /** Who holds a run beyond its record, by holder, so one holder's unpin never releases another. */
+    private readonly pins;
+    /** Staged ids while a durable commit installs and announces them: never evicted mid-commit. */
+    private readonly committing;
     private saveTimer;
+    /** `null` once the store is closed, and in a `RunStore.unavailable` store (nothing is written,
+     *  nothing is evicted). */
+    private db;
+    /** Why `open` failed, in a `RunStore.unavailable` store. */
+    private openFailure;
+    /** Runs whose held record is ahead of its row; the next save or commit writes them. */
+    private readonly dirty;
+    /** Runs gone from memory whose rows the next save or commit deletes. */
+    private readonly deleted;
+    /** Deleted runs whose history files (events, handoff, images, artifacts) go once the delete of
+     *  their row commits: until then a conflict can undo the delete and bring the row back. */
+    private readonly historyOwed;
     /** The repository this project IS (#945), armed after `open()` by `setRepoHandle`. Undefined
      *  until it arrives and `null` when it cannot be known — both mean "unscoped", which is
      *  exactly the pre-#945 behavior. */
     private repoHandle;
+    /** `open()`'s `keepLive`, which a run read later from `runs.db` is reconciled with too. */
+    private keepLive;
+    /** This store's identity in `run_claims`; undefined without a database. */
+    private owner;
+    /** The families this store claims, with the generation each acquisition got. */
+    private readonly claimed;
+    /** Families judged free whose claim a busy database kept this store from taking: the next write
+     *  of their rows takes it in its own transaction, if it is still as judged (null: absent). */
+    private readonly pendingClaims;
+    /** The revision and `data` of each held row (and pending deletion) as this store last read or
+     *  wrote it: what a write is fenced against, and a conflict's "original". No entry: this store
+     *  created the row and has not written it yet. `extras` is what that `data` holds beyond the
+     *  schema, which the next write of the row puts back (raw-record.ts). */
+    private readonly base;
+    /** Rows read cold in the current synchronous turn, so a commit staged from one is fenced against
+     *  the version it was computed from. `owned`: its family was already this store's when read.
+     *  Cleared at the next microtask: no commit spans a turn. */
+    private readonly coldBase;
+    /** The family of each pending deletion, whose claim the deleting write is fenced against. */
+    private readonly deletedFamilies;
+    /** Rows a conflicting write excluded: this store refuses to write them until it is reopened. */
+    private readonly quarantined;
+    /** Rows whose `data` this store tried to decode and could not: left in the database untouched,
+     *  and left out of the list rows from then on, as the cold reader leaves them out (run-index.ts). */
+    private readonly unreadable;
+    /** Background one-at-a-time compressor for archived transcripts (#818). */
+    private readonly compressor;
+    /** Transcript facts the delegation paths ask about, so they never re-read a transcript (#880). */
+    private readonly facts;
     private constructor();
-    /** See `reconcileLoadedRun` for what `keepLive` (#367) decides about live-looking rows. */
+    /**
+     * Open the project's run store. See `reconcileLoadedRun` for what `keepLive` (#367) decides
+     * about live-looking rows.
+     *
+     * Reads `runs.db` once its import is complete. Before that, `runs.json` is imported into it in
+     * one transaction (`importLegacyIndex`) and left exactly as it was, for older cezars to read.
+     * Either way only the held set is decoded: the live rows (by the indexed `live` column), the
+     * few finished rows a normalization still repairs, and the delegation families of the live
+     * ones.
+     *
+     * A store that cannot be opened is never an empty one (#779, plan step 4): `open` throws a
+     * `RunStoreOpenError` naming the cause, and nothing is reset, restored or deleted. `retryBusy`
+     * waits out a busy database (and a cockpit that may still be importing) with growing pauses,
+     * about 3.5 s in all, before it gives up. Open is synchronous, so the wait blocks this thread:
+     * only a boot passes it, while nothing else runs yet. Without it a busy database fails after
+     * one busy timeout.
+     */
     static open(dataDir: string, opts?: {
         keepLive?: boolean;
+        retryBusy?: boolean;
     }): RunStore;
+    private static openOnce;
+    /**
+     * The store `serve` keeps for its boot project when `open` failed: no database, nothing held,
+     * and every attempt to create or save a run refused with `failure`. The cockpit answers every
+     * route of that project with `failure`'s message, and boot skips everything that would read
+     * its empty run list as "no runs" (orphan pruning, retention, recovery, scratch sweeps). The
+     * way out is a restart once the cause is gone.
+     */
+    static unavailable(dataDir: string, failure: RunStoreOpenError): RunStore;
+    /** Why this store has no database, when it is `RunStore.unavailable`'s: its runs are unknown,
+     *  not absent. */
+    get unavailable(): RunStoreOpenError | undefined;
+    /**
+     * Open-time load: the live rows, the finished rows a load normalization repairs, then the
+     * delegation families of the live ones. A row that does not parse is skipped and left in the
+     * database untouched; one warning says how many.
+     *
+     * Only rows this store can claim are loaded (#779, plan step 3). A live row whose family another
+     * live process claims — `serve`'s parked run, seen by a headless `cez run` — is that process's:
+     * it is not loaded, normalized or recovered here, and stays readable through `getRun` and the
+     * list rows. A live row nobody alive claims is taken over, as before: this open recovers it
+     * (`keepLive`) or settles it as interrupted.
+     */
+    private loadHeldRows;
+    /** Normalize a record just read from `row` (see `reconcileLoadedRun`) and hold it. Marks the row
+     *  dirty only when normalization changed it, so the next save persists exactly the runs open()
+     *  rewrote. The caller has claimed the row's family. */
+    private adoptLoadedRun;
+    /**
+     * Hold one delegation family: its root and the root's direct workers, read through the
+     * `parent_run_id` index. No recursion: workers cannot delegate, so a worker's own id never
+     * names a family. The caller has claimed it. `settle` settles its live rows instead of keeping
+     * them for recovery (`settleOrphanedRun`); `stopId` is the run a Stop settles as cancelled.
+     */
+    private holdFamily;
+    /**
+     * Make sure this store claims each of `families`, taking every one no live process holds, and
+     * return the ones it now holds. Liveness is judged here (`claimOwnerLive`), outside the write
+     * transaction; `takeClaims` then takes a claim only if it is still exactly what was judged.
+     *
+     * `allowLive` also takes a family that still has a live row although no live process owns it.
+     * Open and `adoptFamily` pass it, because recovery follows both, and so does a write moving a
+     * run this store holds into a new family (a worker quarantined to `invalid` becomes its own):
+     * an ordinary write must not quietly inherit a dead process's live run and leave it unrecovered.
+     * `wait` retries a busy database instead of leaving the claim to the next write: recovery
+     * cannot start without it.
+     */
+    private claimFamilies;
+    /** `takeClaims`, retried while another connection holds the write lock (each try waits out the
+     *  busy timeout), then the busy error. */
+    private takeClaims;
+    /** Release the claim of every family with nothing left in memory, once nothing is pending: a
+     *  failed save keeps its families claimed until it succeeds. A failed release retries at the
+     *  next sweep; `close()` releases the rest. */
+    private releaseUnheldClaims;
+    /**
+     * Who may change this run right now (see `RunOwnership`), or undefined when there is no such
+     * run. Read-only: nothing is claimed. Controls ask this first, so a run another process owns is
+     * refused with `RUN_IN_USE_ELSEWHERE` and a dead process's run is adopted before it is changed.
+     */
+    runOwnership(id: string): RunOwnership | undefined;
+    /** Why a control on this run must be refused here, or undefined when this store may change it. */
+    writeRefusal(id: string): string | undefined;
+    /**
+     * Take over the delegation family of an `orphaned` run for a control: claim it from its dead
+     * owner (or from nobody), then load it and settle its live rows (`settleOrphanedRun`) — never
+     * keep them for recovery to resume, since only Continue may start agent work. With `stop` the
+     * control is Stop: `id` itself is settled as cancelled rather than interrupted. Returns the
+     * family's root id, or undefined when a live owner holds it after all or it is gone. The caller
+     * runs recovery for that family next (`RunManager.adoptOrphanedRun`), which then repairs it.
+     */
+    adoptFamily(id: string, opts?: {
+        stop?: boolean;
+    }): string | undefined;
+    /** Every run whose family another process owns — alive, or dead with a live run left to
+     *  recover (cleanup keeps their scratch: it is theirs, or recovery's once someone adopts them).
+     *  A dead owner's claim on a family with nothing live is no claim (see `runOwnership`). */
+    listForeignClaimedRunIds(): string[];
+    /**
+     * Whether a held run anchors itself (and its family) in memory. Anything else held is a family
+     * member or a settled write, and leaves at the next sweep (`evictSettled`).
+     *
+     * The held set is: every run that is live (`isLiveRecord`), pinned by a RunManager (`pin`),
+     * dirty, or inside a durable commit; plus the whole delegation family (root and direct
+     * workers) of any such run. Families are held because the RunManager reads a live run's family
+     * on every run event — `GET /runs/:id/relationships`, the global `reconcileWorkerWaits` pass
+     * (about twenty call sites), completion blockers and conversations — and decoding a cold
+     * record costs about 200 µs (JSON.parse plus the schema). Measured on a copy of a real
+     * cockpit's `runs.json` (958 runs, 957 of them delegated): a running root with 26 workers
+     * paid about 5 ms per family read, and the live families together about 10 ms per global
+     * pass, all on the event loop. Holding them costs memory in proportion to active work, not to
+     * history.
+     */
+    private isAnchor;
+    /** The family roots with an anchoring member in memory. */
+    private anchoredFamilies;
+    /** Drop every held run that is neither an anchor nor in an anchored family. A store without a
+     *  database keeps everything: memory is the only copy it has. */
+    private evictSettled;
+    /** A run read from `runs.db`, normalized like a loaded one (`reconcileLoadedRun`, then the
+     *  repository scope) but held by nobody. Undefined when absent, deleted or unreadable. */
+    private loadCold;
+    private decodeCold;
+    /** Hold a run just decoded from its row: the object every later read and write shares. */
+    private holdDecoded;
+    /**
+     * Bring a run into memory and return the held object: the record a write changes in place.
+     * It leaves again at the first sweep after its write settles, unless something anchors it.
+     * Its family is claimed first, then the row is read, so the version held is the claimed one;
+     * undefined while another process owns it (see `claimFamilies`).
+     */
+    private hold;
+    /** The record a store write changes in place: held, or loaded to be. Undefined for a run this
+     *  store may not write (another process's, or quarantined), so the write changes nothing. */
+    private record;
+    /** The current record for reading: the held object, the held copy of a run whose family is in
+     *  memory, or else a fresh copy nobody holds. */
+    private peek;
+    /**
+     * A run just read off its row, as reads answer it: held when its family is in memory (a live
+     * family's members are read on every run event), else a copy nobody holds — frozen under
+     * vitest when it leaves the store (`freeze`).
+     */
+    private answerCold;
+    /** `getRun` for a row a query already read: the held object, else decoded from `row`. */
+    private fromRow;
+    /** Whether the run exists, held or not, without decoding it. */
+    private hasRun;
+    /**
+     * Keep a run in memory for `holder` until `unpin(id, holder)`: a RunManager pins the runs it is
+     * executing (`active`) and the run a Continue is admitting (`continue`). A finished run is
+     * loaded. Pins are per holder, so releasing one never releases another. Returns the held record.
+     */
+    pin(id: string, holder: RunPinHolder): RunRecord | undefined;
+    /** Release `holder`'s pin. The run leaves memory at the next sweep once nothing else holds it. */
+    unpin(id: string, holder: RunPinHolder): void;
     /**
      * Tell the store which repository this project IS (#945), so the referenced tier stops adopting
      * another repo's PR/issue as the task's subject. See `isRepoScopedRef` for the rule.
@@ -1279,21 +1668,136 @@ export declare class RunStore extends EventEmitter {
      * Arming also HEALS records already poisoned by the un-scoped rule, on the `reconcileLoadedRun`
      * precedent: the evidence is all still on the record (`referenced*Candidates`), only the
      * conclusion drawn from it was wrong, so re-deciding beats asking for a migration. It rewrites
-     * values, never the format, and is one-directional by construction — see `rescopeRun`.
+     * values, never the format, and is one-directional by construction — see `rescopeRun`. Held
+     * runs are re-checked in memory; of the rest, only rows whose stored summary references another
+     * repository are decoded, and the healed ones are written, so their summaries heal too.
      */
     setRepoHandle(handle: RepoHandle | null): void;
+    /** Whether the stored summary still names a reference the scoped record no longer has. */
+    private storedScopeDiffers;
+    /**
+     * The live set, newest first: runs whose record is live (`isLiveRecord`) or that a RunManager
+     * pins. Finished runs are not here — read one by id (`getRun`), by an indexed query
+     * (`listWorkersOf`, `findRunByClientRequestId`, `listGroupRuns`, `listRunsWithWorktree`,
+     * `listBranchOwners`), or as list rows (`listRunSummaries`).
+     */
     listRuns(): RunRecord[];
+    /** Where a held run lists: its row's insertion order, or after every row while this store has
+     *  not written it yet. The held set keeps such runs in creation order, and so does every list
+     *  that sorts them in held-set order (`sortNewestFirst` is stable). */
+    private listOrder;
+    /**
+     * EVERY run as a full record, newest first — decoded row by row. Only the legacy `GET /runs`
+     * (older clients; the cockpit reads `GET /run-summaries`) may call this: it is exactly the
+     * whole-history parse #779 exists to remove from everything else.
+     */
+    listAllRunsForLegacyRoute(): RunRecord[];
+    /**
+     * Every run as its list row, newest first: the stored `summary` column, with each held run's
+     * own projection laid over it — a debounced save keeps memory up to 300 ms ahead of the row,
+     * and a run created since the last save has no row yet. `usage` is the caller's to attach.
+     *
+     * With `archivedWindow` (#864), the window the cockpit's lists read: every unarchived run, plus
+     * the newest `archivedWindow` archived ROOT runs, and whether older archived roots were left
+     * out. Archived workers are never in it (see `RunDatabase.listWindowSummaries`); with `roots`,
+     * no worker is — the runs index, whose readers list no workers. A held run
+     * lists by its record, so one archived or unarchived since the last save is ranked as it is now.
+     *
+     * A row this store found unreadable is left out, as the cold reader leaves out a row it had to
+     * decode and could not. A finished row nobody has decoded is served from its summary by both,
+     * which decodes nothing; reading it is what finds out (`isUnreadable`).
+     */
+    listRunSummaries(options?: {
+        archivedWindow?: number;
+        roots?: boolean;
+    }): {
+        runs: RunSummary[];
+        truncated: boolean;
+    };
+    /**
+     * One page of archived ROOT runs, newest first (#864): `GET /run-summaries/archived`, the
+     * archived runs past the window. Held runs list by their record, as in `listRunSummaries`.
+     * `before` is the previous page's `nextCursor`; with `q`, only runs `matchesRunQuery` keeps, and
+     * `total` counts those. A cursor this store did not write answers `{ error }`.
+     *
+     * Ranking reads every archived root's key (id, created_at, seq: no record, no summary), so the
+     * page and `total` agree with the held overlay; only the page's own rows are read in full.
+     */
+    listArchivedRuns(options: {
+        before?: string;
+        limit: number;
+        q?: string;
+    }): ArchivedRunsResponse | {
+        error: string;
+    };
+    /**
+     * The ROOT runs, archived or not, that match `query` (`matchesRunQuery`), newest first: at most
+     * `limit`, and whether more matched. The owned half of the workspace search (#864); held runs
+     * match by their record.
+     */
+    searchRunSummaries(query: string, limit: number): {
+        runs: RunSummary[];
+        truncated: boolean;
+    };
+    /** A row whose stored summary does not fit the contract any more, projected from its record. */
+    private coldSummary;
+    /**
+     * The run, or undefined. A held run is the held object (writes install into it). Any other run
+     * is a fresh copy of its row each call, normalized like a loaded record — frozen under vitest —
+     * so changing it means a store method, never an assignment.
+     */
     getRun(id: string): RunRecord | undefined;
+    /** Whether the run's row is in `runs.db` but its record could not be read here: what tells a
+     *  run that cannot open from one that does not exist. Known once something tried to read it. */
+    isUnreadable(id: string): boolean;
+    /** The ids in memory right now: the held set, for diagnostics and the benchmark's heap pass. */
+    heldIds(): string[];
     /**
      * The workers a root run owns, newest first, read off its own `receipts` (#659). Every
      * `createOwnedRun` writes the receipt and the worker record in one transaction, and the
-     * receipt list is capped at 32, so this is a bounded lookup rather than a walk of the whole
+     * receipt list is capped at 1,024 creations (#816), so this is a bounded lookup rather than a walk of the whole
      * project index. An ordinary or worker run owns nothing and costs one map read; a receipt
      * whose record has been deleted is skipped, never invented. A parent quarantined to
      * `invalid` has no readable receipts and reports none, which is also what the cockpit
      * assumes for that role.
      */
     listOwnedWorkers(parentId: string): RunRecord[];
+    /** Every worker filed under `parentId` (the `parent_run_id` index plus memory), newest first:
+     *  receipts or not, which is what the reconcile and deletion checks ask. */
+    listWorkersOf(parentId: string): RunRecord[];
+    /** The id of every worker, held or stored, without decoding any (recovery's worker passes). */
+    listWorkerIds(): string[];
+    /** The id of every run whose delegation is quarantined (`invalid`), held or stored: its stored
+     *  summary says so, so nothing is decoded (scratch cleanup). */
+    listQuarantinedRunIds(): string[];
+    /**
+     * The runs automation receipts launched, by receipt id (`automation.receiptId` or
+     * `automationTrigger.receiptId`). Memory answers first; a receipt it does not know costs one
+     * pass over `runs.db` that reads the records' JSON in SQLite — only a crash leftover (a
+     * receipt still `reserved` at startup) ever asks.
+     */
+    findRunIdsByAutomationReceipt(receiptIds: readonly string[]): Map<string, string>;
+    /** The id of every root whose delegation carries a conversation, held or stored: recovery's
+     *  full reconcile pass (#661). The stored summary names the role, so only roots' records are
+     *  read, in SQLite. */
+    listConversationRootIds(): string[];
+    /** The id of every run, held or stored, without decoding any (orphan-worktree sweeps). */
+    listRunIds(): string[];
+    /** The members of one parallel-variant group (spec 010), in no particular order. */
+    listGroupRuns(groupId: string): RunRecord[];
+    /** Runs with a materialized worktree directory (`worktreePath`, not reclaimed), most recently
+     *  finished first, then newest first: worktree retention and the worktrees panel. */
+    listRunsWithWorktree(): RunRecord[];
+    /**
+     * Every run that owns a branch or names the PR it created, as the few fields branch cleanup and
+     * git-log attribution read (issue 08 §B3, §B5; a squash commit is attributed by its PR number):
+     * the stored summary plus the `branch` and `base_branch` columns, so a Git-tab request decodes
+     * no record. Held runs answer from memory.
+     */
+    listBranchOwners(): BranchOwner[];
+    /** The rows a column query returned, as records, with memory laid over them: a held run
+     *  answers from memory (matching `matches` there, not on its maybe-older row). */
+    private queryRuns;
     /** The run an idempotent start already created (#504), archived or not. A deleted run is gone
      *  with its record, so a retry after deletion honestly creates a fresh one. */
     findRunByClientRequestId(clientRequestId: string): RunRecord | undefined;
@@ -1369,6 +1873,10 @@ export declare class RunStore extends EventEmitter {
         id: string;
         delegation: DelegationState;
     }>): void;
+    /** A pending destroy's automatic retry state, or its removal (hearsay-tools/cezarion#879). Kept on
+     * the record beside the strict delegation, so an older cezar strips it rather than quarantining the
+     * worker. Destroy progress: nothing the family reconcile reads changes. */
+    commitDestroyRetry(id: string, retry: WorkerDestroyRetry | undefined): void;
     /** Accepted execution revision is public lifecycle identity, separate from process generations. */
     commitWorkerContinuation(id: string, patch: Partial<Omit<RunRecord, 'id' | 'steps' | 'delegation'>>, step?: Pick<StepState, 'id' | 'name' | 'kind' | 'synthetic'>, conversation?: {
         rootId: string;
@@ -1380,16 +1888,39 @@ export declare class RunStore extends EventEmitter {
     private readWorkerResultFile;
     readWorkerResult(parentId: string, workerId: string): WorkerCollectedResult | undefined;
     readWorkerResultDiff(parentId: string, workerId: string): string | undefined;
-    /** Publish a pointer only after its redacted immutable snapshot reaches disk. Failed index writes retain the old evidence. */
-    commitWorkerResult(parentId: string, value: WorkerCollectedResult, diffSnapshot?: string): WorkerCollectedResult;
+    /** Publish a pointer only after its redacted immutable snapshot reaches disk. Failed index writes retain the old evidence.
+     * A result whose evidence is already stored returns the stored one and writes nothing; `ignoreCleanup` is for a
+     * caller that only needs the payload durable, whatever cleanup phase the stored copy names. */
+    commitWorkerResult(parentId: string, value: WorkerCollectedResult, diffSnapshot?: string, opts?: {
+        ignoreCleanup?: boolean;
+    }): WorkerCollectedResult;
     /**
      * requestHash is supplied only by the trusted service: hash the ORIGINAL normalized request,
      * before resolving refs. A retry keeps the original worker and pinned SHA even if HEAD moved.
      * workspace.ownerRunId is the trusted service's preallocated worker UUID.
      */
     createOwnedRun(input: Parameters<RunStore['createRun']>[0], parentId: string, requestId: string, worker: DelegationState, requestHash: string, executionIdentity?: WorkerExecutionIdentity): RunRecord;
-    /** Atomic file replacement is the durability boundary; flush() is deliberately best-effort. */
+    /**
+     * The durable write: `staged` holds the records this operation replaces (`null` deletes one),
+     * in the order subscribers hear about them. The transaction is the durability boundary;
+     * flush() is deliberately best-effort.
+     *
+     * One transaction carries the staged rows and every row a debounced save still owes, so the
+     * database never holds a commit without the optimistic writes made before it. If it fails,
+     * nothing changed anywhere: the held records, the database, the pending dirty rows and the
+     * subscribers all see the store as it was.
+     */
     private commitIndex;
+    /**
+     * Refuse (throwing, with nothing changed) a commit that stages a quarantined run, or a run whose
+     * family this store does not claim and cannot take: another process owns it, or a dead process
+     * left it live and it has not been adopted.
+     */
+    private assertWritable;
+    /** The family of a run this store knows: held, else its row; a run nowhere is its own. */
+    private familyOf;
+    /** Schedule the sweep that lets any of `ids` leave memory, when one of them now can. */
+    private sweepIfSettled;
     updateRun(id: string, patch: Partial<Omit<RunRecord, 'id' | 'steps'>>): RunRecord | undefined;
     /** Prompt edits can both revoke and restore a reference. Resolve the retained working sets
      *  before notifying readers, using the same ambiguity, marker and repository rules as events. */
@@ -1424,6 +1955,20 @@ export declare class RunStore extends EventEmitter {
     /** Parent + owned workers; returns how many records flipped `archived`. */
     private applyArchivedCascade;
     private applyArchived;
+    /** Transcript form follows `archived`: enqueue compression, or restore the plain file now. */
+    private syncTranscriptForm;
+    /**
+     * Whether this store may compress `id`'s transcript: the run exists, is archived, is not in a
+     * live status (queued/running/waiting), and this process holds the family's claim in `claimed`
+     * (not merely `pendingClaims`). Two processes never both write a run (#779, #818 B1).
+     */
+    private isHistoryCompressEligible;
+    /** Take the family claim if free and require it to be in `this.claimed`, not only pending. */
+    private holdsCompressClaim;
+    /** Startup sweep: enqueue every archived non-live run that still has a plain transcript. */
+    compressArchivedHistory(): void;
+    /** Resolves when the transcript compressor is idle (tests, shutdown). */
+    historyIdle(): Promise<void>;
     /** Pin one run to the top of this project's task list, or unpin it (#935). Mirrors
      *  `setArchived`: sets the fields, then persists + broadcasts via `touch`, so the updated
      *  record rides the existing `run` SSE with no new event. Idempotent — re-pinning a pinned
@@ -1432,8 +1977,14 @@ export declare class RunStore extends EventEmitter {
      *  Every active status is pinnable. Archived requests clear stale metadata instead, so a
      *  late click racing archive cannot leave a hidden pin that reappears on unarchive. */
     setPinned(id: string, pinned: boolean): RunRecord | undefined;
-    /** Bulk-archive every finished run; returns how many records flipped to archived. */
-    archiveFinished(): number;
+    /** Bulk-archive finished runs (#780). `isSweepable` decides which; `archived` counts every
+     *  record that flipped (cascaded workers included), `ids` lists the top-level runs picked and
+     *  `pinnedIds` the subset that carried a pin before `clearPin` dropped it. */
+    archiveFinished(scope?: ArchiveFinishedScope): {
+        archived: number;
+        ids: string[];
+        pinnedIds: string[];
+    };
     /** Mark one run as read (#unread-done-items): stamp the read receipt now. Mirrors
      *  `setArchived` — sets the field then persists + broadcasts via `touch`, so the
      *  updated record rides the existing `run` SSE with no new event. Idempotent by
@@ -1542,18 +2093,43 @@ export declare class RunStore extends EventEmitter {
      *  the `CEZ_REDACT_SECRETS=0` opt-out itself so every caller inherits it. */
     redactText(text: string): string;
     private hostSecrets;
+    /** The run's indexed transcript facts (#880): a read-only view, never a transcript read once
+     *  the run's index is loaded. An unreadable transcript answers as empty, as readEvents does. */
+    transcriptFacts(runId: string): Readonly<TranscriptFacts>;
+    hasProjection(runId: string, projectionId: string): boolean;
+    private factsWarming;
+    /** After open, build the indexes the delegation reconcile will ask for first, off the request
+     *  path: every member of every family with a conversation (#880). */
+    private warmTranscriptFacts;
+    /** Resolves when the open-time warm-up is done (tests). */
+    factsWarmIdle(): Promise<void>;
+    /** `readEvents` off the event loop (async read and async brotli), for collection paths. */
+    readEventsAsync(runId: string): Promise<RunEvent[]>;
+    /** The owned store's `refreshHumanAskSummary`, from the index, on the same rules: no history
+     *  (legacy runs) keeps the summary, an unreadable one requests attention. True when it changed. */
+    private syncHumanAskSummary;
     readEvents(runId: string): RunEvent[];
     /** Private process-generation evidence; never part of run JSON or SSE. */
     private identityPath;
     readWorkerIdentity(id: string): WorkerExecutionIdentity | undefined;
     private writeWorkerIdentity;
     private executionPath;
-    readWorkerExecution(id: string): {
-        generation: string;
-        phase: 'queued' | 'starting' | 'complete';
-        neverMaterialized?: true;
-    } | undefined;
+    readWorkerExecution(id: string): WorkerExecution | undefined;
     private writeWorkerExecution;
+    /** Complete execution is not permission to reuse/delete persistent resources (#738).
+     * Synchronous, fresh and generation/resource fenced; callers hold admission off across awaits. */
+    workerResourcesSafe(id: string, generation: string, resourceId: string, admittingQueued?: boolean): boolean;
+    /** `workerResourcesSafe` with the refusal's live PIDs (empty when no PID explains it). */
+    workerResourceHolders(id: string, generation: string, resourceId: string, opts?: {
+        admittingQueued?: boolean;
+        cwds?: CwdSource;
+    }): 'safe' | number[];
+    /** Upgrade a legacy completed checkpoint while terminal task ownership is still known.
+     * No holder scan here: settlement and scheduling must never wait on cleanup proof. */
+    retainWorkerScratchCleanup(id: string): void;
+    /** Cleanup can outlive its index row, but never its generation or terminal task intent.
+     * `cwds` is the scratch reprobe tick's shared `/proc` snapshot (hearsay-tools/cezarion#879). */
+    workerScratchResourcesSafe(id: string, generation: string, resourceId: string, cwds?: CwdSource): boolean;
     commitWorkerExecutionStart(id: string): string;
     /** Private process record (#469): which processes a generation spawned, never part of run JSON or SSE. */
     private processesPath;
@@ -1563,7 +2139,7 @@ export declare class RunStore extends EventEmitter {
     private writeWorkerProcesses;
     /** Bound to the current generation. Past the cap the record never drops an entry: the
      * working-directory scan is the remaining evidence. */
-    appendWorkerProcess(id: string, generation: string, pid: number): boolean;
+    appendWorkerProcess(id: string, generation: string, pid: number, pgid?: number): boolean;
     commitWorkerExecutionComplete(id: string, generation: string): boolean;
     /** Cancellation must hit disk before queued no-start evidence authorizes cleanup. */
     commitWorkerCancellation(id: string): void;
@@ -1576,7 +2152,7 @@ export declare class RunStore extends EventEmitter {
     private deleteDelegatedRun;
     private removeRunHistoryBytes;
     deleteRun(id: string): boolean;
-    /** Write the index out now (used on shutdown). */
+    /** Write the pending rows out now (used on shutdown). */
     flush(): void;
     private seqs;
     private nextSeq;
@@ -1593,10 +2169,69 @@ export declare class RunStore extends EventEmitter {
     /** Agent screenshots persisted by the run manager (see persistImage). */
     private imagesDir;
     private touch;
+    /** Form follows archived: a terminal archived run with a plain transcript is queued again. */
+    private maybeEnqueueHistoryCompress;
+    /** The held record is gone; the next save or commit deletes its row, fenced by `family`'s claim
+     *  and by the revision this store last saw (kept in `base` until the delete is written). */
+    private markDeleted;
+    /** A deleted run's history files, once the delete of its row has committed. Best effort, as
+     *  deletion always was. */
+    private removeOwedHistory;
+    /**
+     * Count-based history retention: of the runs past the newest `MAX_RUNS_KEPT` unarchived ones,
+     * archive each finished run without delegation that is not pinned and whose family this store
+     * can claim. Ranked over the row keys (the `created_at` index, no record decoded) with memory
+     * laid over them, since a run created or archived since the last save has no row yet; the rows
+     * past the cut are then filtered in `runs.db`, so only real candidates decode. Archived runs
+     * are never deleted by retention — only an explicit delete, worker destruction, or history
+     * deletion removes a run.
+     */
     private pruneOldRuns;
-    /** Debounced so token-usage updates don't rewrite the index per event. */
+    /** Debounced so token-usage updates don't rewrite a row per event. Nothing to schedule without
+     *  a database: a `RunStore.unavailable` store, or a closed one, writes nothing. */
     private scheduleSave;
+    /** The single database write, so a test can fail it the way a full disk would. */
     private writeIndex;
+    /**
+     * Write `staged` plus everything still pending — dirty rows from memory, deletions — in one
+     * transaction, then clear the pending marks. Throws with nothing cleared when it fails.
+     * Never copies or sorts the whole store: the cost is the rows that changed.
+     *
+     * Fenced (#779, plan step 3): the transaction commits only if every family it writes still
+     * carries this store's claim and every row is at the revision this store last saw. Otherwise
+     * nothing is written and `handleConflicts` deals with the rows that changed under it.
+     */
+    private persist;
+    /** What a write of these rows (id → family) must still find: this store's claims, at the
+     *  generations it took them, and each row at the revision it last saw (none for a new row). */
+    private fence;
+    /**
+     * A fenced write found rows that changed under this store (#779, plan step 3); the write itself
+     * has already failed with nothing changed, and its caller sees that error.
+     *
+     * A conflict is UNEXPECTED when this store owned the row's family when it last read or wrote it:
+     * a held or pending row, or one read inside a family it claimed. Another writer then broke the
+     * claim. For each such row the original (what this store last saw), local (what it meant to
+     * write, or that it meant to delete it) and current versions go to `run_conflicts` first. Only
+     * once that evidence is stored does the row leave the pending set, so no retry rewrites it; this
+     * store then refuses to write it again, and its held copy is replaced by the current row (or
+     * dropped when deleted) and announced. That refusal lasts as long as this store: the explicit
+     * recovery is a restart, which reads the row as it now stands, and the evidence row stays for a
+     * person to compare. Other pending rows stay pending and the next save writes them.
+     *
+     * If the evidence cannot be stored, nothing changes: the rows stay pending, and the next write
+     * meets the same conflict and tries again. A row read before its family was claimed may simply
+     * have been finished by its previous owner in between: a stale read, not a conflict, so only the
+     * write fails.
+     */
+    private handleConflicts;
+    /** Write what is pending, then (unless closing) let every run whose write settled leave memory. */
     private saveNow;
+    /**
+     * Write what is pending and release the database (store disposal, process shutdown).
+     * Idempotent. A closed store keeps answering reads for what it holds — the final save evicts
+     * nothing — but cannot read `runs.db` any more, so a run that had already left memory reads as
+     * absent. It saves nothing more, and a durable commit on it throws.
+     */
+    close(): void;
 }
-export {};