@wjarka/cezarion 0.15.1 → 0.16.0

package/dist/runs/store.js

@@ -1,23 +1,34 @@
 import { EventEmitter } from 'node:events';
-import { removeAgentTmpDir } from './agent-tmpdir.js';
+import { workerEvidenceRunIds, workerExecutionSchema } from './worker-execution.js';
+import { agentTmpDirLocations, agentTmpDirMayExist, agentTmpDirOwnershipProven, removeAgentTmpDir } from './agent-tmpdir.js';
 import { removeArtifacts } from '../artifacts/lifecycle.js';
 import { randomUUID } from 'node:crypto';
 import { isDeepStrictEqual } from 'node:util';
-import { appendFileSync, closeSync, constants, fstatSync, fsyncSync, lstatSync, openSync, readSync, realpathSync, readdirSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { appendFileSync, closeSync, constants, fstatSync, fsyncSync, lstatSync, openSync, readSync, realpathSync, readdirSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { z } from 'zod';
-import { ciWaitSchema, agentInputSchema, inboxClaimSchema, delegationStateSchema, workerCreationReceiptSchema, workerCollectedResultSchema, workerResultFileSchema, continuationMessageSchema, runRecordSchema as contractRunRecordSchema, } from '../contract/index.js';
+import { ciWaitSchema, agentInputSchema, inboxClaimSchema, delegationStateSchema, workerCreationReceiptSchema, workerCollectedResultSchema, workerResultFileSchema, continuationMessageSchema, previewServerSchema, toRunSummary, workerDestroyRetrySchema, runRecordSchema as contractRunRecordSchema, } from '../contract/index.js';
+import { matchesRunQuery, sqlPrefilterTokens } from './run-search.js';
 import { storedDelegationStateSchema } from './delegation-state.js';
-import { refreshHumanAskSummary } from './human-ask-summary.js';
+import { HistoryCompressor } from './history-compressor.js';
+import { emptyFacts, stampOf, TranscriptFactsIndex } from './transcript-facts.js';
+import { hasPlainHistory, historyPaths, readHistoryText, readHistoryTextAsync, removeHistory, restoreHistory } from './history-file.js';
 import { workerExecutionIdentitySchema } from '../delegation/execution-identity.js';
 import { reconcileWorkerWait } from '../delegation/wait.js';
-import { processStartToken } from '../delegation/process-liveness.js';
+import { capacityError, workerCapacity } from '../delegation/capacity.js';
+import { inspectGeneration, isCurrentProcess, recordedProcessLive, processStartToken } from '../delegation/process-liveness.js';
 import { collectSecretValues, redactDeep, redactSecrets } from '../core/secret-redaction.js';
 // Pure, dependency-free reference helpers — the same sanity bound the marker parser applies.
 import { MAX_REF } from './task-refs.js';
 // Type-only module (zod + nothing else), so this cannot cycle back into the store.
 import { workflowDefSchema } from '../workflows/types.js';
 import { RUNNER_IDS } from '../core/agent-runner.js';
+import { ARCHIVED_ROOT, RUNS_DB_FILE, RUNS_IMPORT_COMPLETE_KEY, RunConflictError, RunDatabase, RunDatabaseBusyError, } from './run-database.js';
+import { encodeRunRow, isLiveRecord, isLiveStatus } from './run-row.js';
+import { collectRawExtras, encodeRawRecord } from './raw-record.js';
+import { assertNoLegacyCockpit, assertNoLegacyWriter, backUpLegacyIndex, LEGACY_INDEX_FILE, LegacyWriterError, readLegacyIndex } from './legacy-index.js';
+import { toRunStoreOpenError } from './store-open-error.js';
+import { claimOwnerLive, closeClaimSession, openClaimSession } from './run-claims.js';
 const usageCounterSchema = z.number().finite().nonnegative();
 /**
  * A runner id as it may appear in a PERSISTED record, normalized to the three
@@ -88,8 +99,8 @@ const queuedMessageSchema = z.object({
     images: z.array(z.string()).optional(),
     createdAt: z.string(),
 });
-/** Exported for `./run-index.ts`, the read-only reader of the same file. Nothing else should
- *  parse `runs.json` — see `reconcileLoadedRun` for why a second parser is a correctness risk. */
+/** Exported for `./run-index.ts`, the read-only reader of the same records. Nothing else should
+ *  parse a stored run — see `reconcileLoadedRun` for why a second parser is a correctness risk. */
 export const runRecordSchema = z.object({
     id: z.string(),
     title: z.string(),
@@ -131,6 +142,8 @@ export const runRecordSchema = z.object({
     lastCiWait: ciWaitSchema.optional(),
     /** Retained recovery observation when previous CI metadata cannot be trusted. */
     lastCiWaitError: z.string().max(256).optional(),
+    /** Dev servers the agent registered with `cezar_preview_serve` (#781). Optional so old files parse. */
+    previewServers: z.array(previewServerSchema).optional(),
     /** URLs of images attached to the initial task prompt, for the thread's first bubble
      *  (#image-display) — persisted like agent screenshots, served from `/images/`. */
     taskImages: z.array(z.string()).optional(),
@@ -185,6 +198,19 @@ export const runRecordSchema = z.object({
         githubUrl: z.string().url(),
     })
         .optional(),
+    /** Provenance for a task a scheduled automation launched. Its own key so a pre-schedule cezar
+     *  strips it instead of failing the whole index on a missing `githubUrl`. */
+    automationTrigger: z
+        .object({
+        automationId: z.string(),
+        automationRevision: z.number().int().positive(),
+        receiptId: z.string(),
+        trigger: z.enum(['schedule', 'catch-up', 'manual']),
+        occurrenceAt: z.string(),
+    })
+        .optional(),
+    /** A pending worker destroy's automatic retry state (hearsay-tools/cezarion#879); a malformed one is dropped, never the run. */
+    destroyRetry: contractRunRecordSchema.shape.destroyRetry.catch(undefined),
     status: z.enum(['queued', 'running', 'waiting', 'review', 'done', 'failed', 'cancelled']),
     stopping: contractRunRecordSchema.shape.stopping.catch(undefined),
     /** Sub-state of `running` (spec 2026-07-18-subagent-monitoring-status, #490):
@@ -266,6 +292,8 @@ export const runRecordSchema = z.object({
      *  dir gone, recoverable via `git worktree add`"; it excludes the run from the
      *  retention budget until the dir is re-materialized (resume clears it). */
     worktreeReclaimedAt: z.string().optional(),
+    /** Worktree setup (#917). An unreadable value drops the field, never the run. */
+    worktreeSetup: contractRunRecordSchema.shape.worktreeSetup.catch(undefined),
     /** Parallel variants (spec 010): tasks sharing a groupId are one group. */
     groupId: z.string().optional(),
     /** Variant letter within the group — 'A' | 'B' | 'C' (kept as a string). */
@@ -337,11 +365,65 @@ export function parseRunRecords(raw) {
                 delete row.lastCiWait;
                 row.lastCiWaitError = 'CI wait unavailable — saved observation is unreadable; register a new wait.';
             }
+            // One unreadable registration must not evict the run, nor its readable siblings (#781).
+            if (row.previewServers !== undefined) {
+                if (Array.isArray(row.previewServers))
+                    row.previewServers = row.previewServers.filter((entry) => previewServerSchema.safeParse(entry).success);
+                else
+                    delete row.previewServers;
+            }
         }
     return z.array(runRecordSchema).safeParse(raw);
 }
+/** Just the `StoredRow` part of a `coldBase` entry. */
+function storedRow({ revision, seq, data, extras }) {
+    return { revision, seq, data, extras };
+}
+/** One stored record (a row's `data`) through `parseRunRecords`' salvage and schema, with what the
+ *  schema dropped. Read after the salvage ran: what it removes (an unreadable CI wait, a preview
+ *  server entry) the runtime has decided to drop, and keeps dropping on the next write, as it always
+ *  has; only what the schema does not know is put back. */
+function decodeStoredRecord(raw) {
+    const parsed = parseRunRecords([raw]);
+    if (!parsed.success)
+        return undefined;
+    const run = parsed.data[0];
+    return { run, extras: collectRawExtras(raw, run) };
+}
+/** One database row's `data` back into a record and its extras. Undefined when it does not parse:
+ *  one unreadable row costs that row only. */
+export function decodeRunRow(data) {
+    try {
+        return decodeStoredRecord(JSON.parse(data));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** One database row's `data` back into a record, for a reader that never writes it back. */
+export function decodeRunRecord(data) {
+    try {
+        const parsed = parseRunRecords([JSON.parse(data)]);
+        return parsed.success ? parsed.data[0] : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export { LEGACY_INDEX_BACKUP_FILE, LEGACY_INDEX_FILE } from './legacy-index.js';
+/** The pauses between open attempts while the database is busy, when `open` may wait (a boot):
+ *  about 3.5 s in all, with each attempt's own busy timeout. Long enough for another process to
+ *  finish importing a large `runs.json`. */
+const OPEN_RETRY_DELAYS_MS = [50, 100, 200, 400, 800, 1600];
+/** Block this thread for `ms`. Only `open` does, at boot, when there is nothing else to run. */
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
 const MAX_RUNS_KEPT = 300;
-const MAX_ARCHIVED_KEPT = 500;
+/** How many archived root runs the run lists carry per project (#864): `GET /run-summaries?archived=recent`
+ *  and `GET /workspace/runs-index`. Unarchived runs are never cut; older archived runs page in
+ *  through `GET /run-summaries/archived` and the workspace search. */
+export const ARCHIVED_WINDOW = 200;
 const PR_URL_RE = /https:\/\/github\.com\/[^/\s]+\/[^/\s]+\/pull\/\d+/;
 const ISSUE_URL_RE = /https:\/\/github\.com\/[^/\s]+\/[^/\s]+\/issues\/\d+/;
 // The transcript auto-link is convenience only (the cockpit's own `gh pr create` path sets the
@@ -677,6 +759,25 @@ export function reconcileLoadedRun(run, opts) {
     // also scopes any referenced PR restored above without filtering candidate evidence first.
     return run;
 }
+/**
+ * Settle a live run whose owning process died, when a control adopts it (#779, plan step 3), so
+ * that adopting never starts agent work: only Continue may, with the user's own input. A run that
+ * never started is cancelled before it began, which Continue restarts as it would after a Stop (the
+ * same "untouched" test as `isUntouchedCancelledRun`); any other live run is interrupted, exactly as
+ * an open that does not recover settles it, and Continue resumes its last session. With `stop`
+ * (the control is Stop, and this is its run) a live run is cancelled instead, as an accepted Stop
+ * always reads. Mutates `run`.
+ */
+export function settleOrphanedRun(run, opts = {}) {
+    if (opts.stop && (run.status === 'queued' || run.status === 'running' || run.status === 'waiting'))
+        run.stopping = true;
+    if (run.status === 'queued' && !run.startedAt && run.workflowDef !== undefined &&
+        run.steps.every((step) => step.status === 'pending' && !step.startedAt && !step.sessionId)) {
+        run.status = 'cancelled';
+        run.finishedAt ??= new Date().toISOString();
+    }
+    return reconcileLoadedRun(run, { keepLive: false });
+}
 /**
  * Drop this run's referenced PR/issue if the project's handle proves it foreign and the prompt
  * does not corroborate it (#945). Returns whether anything changed.
@@ -707,54 +808,877 @@ export function rescopeRun(run, handle) {
     }
     return changed;
 }
+/**
+ * Every field `RunStore.open` may rewrite while loading a record: what `reconcileLoadedRun` and
+ * `refreshHumanAskSummary` assign. Compared before and after, it tells open() which rows
+ * normalization changed, so it marks those dirty and no others. Edit it together with either
+ * function, or a normalized row stays unsaved (the store tests pin each field).
+ */
+function loadNormalizedFields(run) {
+    return JSON.stringify([
+        run.stopping, run.status, run.finishedAt, run.error, run.activity, run.monitoringWakeAt, run.autoResumeAt,
+        run.monitoringWakeCapReached, run.referencedPullRequestUrl, run.hasPendingHumanAsk, run.steps.map((step) => step.status),
+    ]);
+}
+/** Test seam (#779): `beforeTransaction` runs once `runs.json` is read and parsed, before the
+ *  import asks for the write lock; `beforeCommit` runs inside the import transaction, after every
+ *  row is written and before the last check that no older cezar wrote `runs.json` meanwhile. */
+let legacyImportHook;
+export function __setLegacyImportHookForTests(hook) {
+    legacyImportHook = hook;
+}
+/** `runs.json`'s records as rows, and how many of its entries were left out. Each row's `data` is
+ *  the record's own JSON as `runs.json` held it, so nothing this cezar's schema does not know is lost
+ *  (raw-record.ts); its summary and columns come from the parsed record, which is what decoding that
+ *  JSON gives back. An entry that does not parse is skipped and costs that entry only, as an
+ *  unreadable row does once it is in the database. Undefined when the file is not a JSON array. */
+function legacyIndexRows(bytes) {
+    let raw;
+    try {
+        raw = JSON.parse(bytes.toString('utf8'));
+    }
+    catch {
+        return undefined;
+    }
+    if (!Array.isArray(raw))
+        return undefined;
+    // A hand-edited index may repeat an id; the last one won when it loaded into a map, so it still does.
+    const rows = new Map();
+    let skipped = 0;
+    for (const entry of raw) {
+        // `parseRunRecords`' salvage rewrites top-level keys: the stored JSON is taken from a copy.
+        const stored = entry !== null && typeof entry === 'object' && !Array.isArray(entry) ? { ...entry } : entry;
+        const parsed = parseRunRecords([entry]);
+        if (!parsed.success) {
+            skipped += 1;
+            continue;
+        }
+        const run = parsed.data[0];
+        rows.set(run.id, encodeRunRow(run, JSON.stringify(stored)));
+    }
+    return { rows: [...rows.values()], skipped, total: raw.length };
+}
+/**
+ * Import `runs.json` into a database that has never completed an import (#779, plan step 4).
+ *
+ * Nothing is read while a live cockpit other than this process owns the project
+ * (`assertNoLegacyCockpit`): an older cezar still writes `runs.json` then, and the import could
+ * not commit. Otherwise the file is read once, through one descriptor, and parsed; it is checked
+ * again before anything is written, so a file that moved while it was parsed costs no write. Then
+ * ONE transaction writes every record and the completion marker, or nothing:
+ * - the marker is checked again once the transaction holds the write lock, so of two processes
+ *   importing at once exactly one writes; the other finds the marker and writes nothing;
+ * - right before COMMIT it refuses (`LegacyWriterError`) when an older cezar may still be writing
+ *   `runs.json` (`assertNoLegacyWriter`) — the check that decides;
+ * - only then are the exact bytes kept beside it (`backUpLegacyIndex`: synced, never half-written,
+ *   an existing backup trusted only when it holds the same bytes), and the marker records what
+ *   the import read: size, sha256 and the backup's name. A refused attempt leaves no backup;
+ * - a crash or refusal leaves no marker, so the next open imports again from the start.
+ * `runs.json` itself is left as it was, and nothing writes it again: an older cezar keeps reading
+ * the history as it stood at the upgrade, and what it writes afterwards is never imported.
+ *
+ * A record that does not parse is skipped and the rest are imported; an index that does not parse
+ * at all imports as an empty history. Either way the import that commits says so once, naming the
+ * backup: the bytes survive there and in `runs.json`, which used to be overwritten by the next save
+ * instead.
+ */
+function importLegacyIndex(db, dataDir) {
+    assertNoLegacyCockpit(dataDir);
+    const snapshot = readLegacyIndex(join(dataDir, LEGACY_INDEX_FILE));
+    const parsed = snapshot ? legacyIndexRows(snapshot.bytes) : undefined;
+    const rows = parsed?.rows ?? [];
+    const skipped = parsed?.skipped ?? 0;
+    const source = !snapshot ? 'none' : parsed ? LEGACY_INDEX_FILE : `${LEGACY_INDEX_FILE} (unparseable)`;
+    assertNoLegacyWriter(dataDir, snapshot);
+    legacyImportHook?.beforeTransaction?.();
+    let backup;
+    const commit = db.transaction({
+        upserts: rows,
+        deletes: [],
+        onlyIfMetaAbsent: RUNS_IMPORT_COMPLETE_KEY,
+        beforeCommit: () => {
+            legacyImportHook?.beforeCommit?.();
+            assertNoLegacyWriter(dataDir, snapshot);
+            backup = snapshot ? backUpLegacyIndex(dataDir, snapshot) : undefined;
+            const read = snapshot ? { bytes: snapshot.bytes.length, sha256: snapshot.sha256, backup } : {};
+            return { [RUNS_IMPORT_COMPLETE_KEY]: JSON.stringify({ at: new Date().toISOString(), source, records: rows.length, ...(skipped > 0 ? { skipped } : {}), ...read }) };
+        },
+    });
+    // Told once, by the import that committed: the marker means no later open reads runs.json again.
+    if (commit.skipped || backup === undefined)
+        return;
+    const kept = `Its exact bytes are kept in ${join(dataDir, backup)}; BACKWARD_COMPATIBILITY.md §3 says how to import it after a repair.`;
+    if (!parsed)
+        console.warn(`[cez] ${LEGACY_INDEX_FILE} could not be read; no run was imported, and this project starts with an empty history. ${kept}`);
+    else if (skipped > 0)
+        console.warn(`[cez] ${skipped} of ${parsed.total} runs in ${LEGACY_INDEX_FILE} could not be read and were not imported. ${kept}`);
+}
+/**
+ * Finished rows whose stored summary an open-time normalization would still change: a referenced
+ * PR an older cezar's created-PR declaration erased (see `reconcileLoadedRun`). Not live, so not
+ * in the `live` column; open decodes these few and keeps the ones it actually repaired.
+ */
+const LEGACY_REFERENCE_HEAL_SQL = "json_extract(summary, '$.markerRefs.pr') IS NOT NULL AND json_extract(summary, '$.referencedPullRequestUrl') IS NULL";
+/** Mark-all-read's rule (see `RunStore.markAllRead`) over the columns and the stored summary. */
+const MARK_ALL_READ_SQL = "archived = 0 AND status IN ('done', 'failed') AND finished_at IS NOT NULL" +
+    " AND NOT (status = 'failed' AND json_extract(summary, '$.autoResumeAt') IS NOT NULL)" +
+    " AND (json_extract(summary, '$.seenAt') IS NULL OR json_extract(summary, '$.seenAt') < finished_at)";
+/** History retention's candidates among the given ids (a JSON array): finished, without
+ *  delegation, and not pinned. */
+const RETENTION_CANDIDATES_SQL = "id IN (SELECT value FROM json_each(?)) AND status NOT IN ('queued', 'running', 'waiting')" +
+    " AND parent_run_id IS NULL AND json_extract(summary, '$.delegation') IS NULL" +
+    " AND json_extract(summary, '$.pinned') IS NOT 1";
+/** Rows whose stored summary names a referenced PR or issue: what a repository handle can veto. */
+const REFERENCED_SQL = "json_extract(summary, '$.referencedPullRequestUrl') IS NOT NULL OR json_extract(summary, '$.referencedIssueUrl') IS NOT NULL";
+/** A record as a branch owner, or undefined when it owns no branch and created no PR: the
+ *  projection `listBranchOwners` reads off a row's summary and columns, computed from memory. */
+export function branchOwnerOf(run) {
+    const branch = encodeRunRow(run).branch;
+    if (!branch && run.pullRequestUrl === undefined)
+        return undefined;
+    return {
+        id: run.id, title: run.title, status: run.status, archived: run.archived, createdAt: run.createdAt,
+        ...(branch ? { branch } : {}),
+        ...(run.baseBranch === undefined ? {} : { baseBranch: run.baseBranch }),
+        ...(run.pullRequestUrl === undefined ? {} : { pullRequestUrl: run.pullRequestUrl }),
+    };
+}
+/** The one answer every control gives for a run another cezar process owns (`409 { error }`). */
+export const RUN_IN_USE_ELSEWHERE = 'run is in use by another cezar process';
+/** The answer for a run this process stopped writing after a conflicting write. */
+export const RUN_QUARANTINED = 'run changed under this cezar process — restart cezar to reload it';
+/** A write this store must not make: another process owns the run, its owner died with work
+ *  still live (adopt it first), or a conflict quarantined it. Nothing was changed. */
+export class RunWriteRefusedError extends Error {
+    runId;
+    ownership;
+    constructor(runId, ownership) {
+        super(ownership === 'quarantined' ? `${RUN_QUARANTINED}: ${runId}`
+            : ownership === 'orphaned' ? `run ${runId} belongs to a cezar process that exited; take it over before writing it`
+                : `${RUN_IN_USE_ELSEWHERE}: ${runId}`);
+        this.runId = runId;
+        this.ownership = ownership;
+        this.name = 'RunWriteRefusedError';
+    }
+}
+/** How many times open (or an adoption) tries to take its claims while another connection holds
+ *  the write lock, each waiting out the 50 ms busy timeout: recovery cannot start without them. */
+const ADOPT_CLAIM_ATTEMPTS = 10;
+/** The `run_claims` family of a run: a worker's parent, else the run itself (`parent_run_id ?? id`). */
+function familyKey(run) {
+    return run.delegation?.role === 'worker' ? run.delegation.parentRunId : run.id;
+}
+/** The same family, off a stored row's columns. */
+function rowFamily(row) {
+    return row.parentRunId ?? row.id;
+}
+/** Make `target` hold exactly `source`'s fields, keeping the object every holder references. */
+function replaceRecord(target, source) {
+    for (const key of Object.keys(target))
+        if (!(key in source))
+            delete target[key];
+    Object.assign(target, source);
+}
+/**
+ * A worker's destroy moving between two unfinished phases, and nothing else changing: nothing the
+ * family reconcile reads changed, so it may skip that pass (#880). The first request and the
+ * `complete` phase still reconcile: one changes delivery eligibility, the other settles requests.
+ */
+function isDestroyProgress(before, after) {
+    if (before?.role !== 'worker' || after.role !== 'worker' || !before.destroy || !after.destroy)
+        return false;
+    if (before.destroy.phase === 'complete' || after.destroy.phase === 'complete')
+        return false;
+    return isDeepStrictEqual({ ...before, destroy: undefined }, { ...after, destroy: undefined });
+}
+/**
+ * Two collected worker results carry the same evidence: equal but for when they were observed and
+ * which snapshot file holds them, and, with `ignoreCleanup`, the cleanup phase. A retried destroy
+ * that observed nothing new then rewrites and fsyncs nothing (hearsay-tools/cezarion#879).
+ */
+function sameWorkerResult(a, b, opts) {
+    const comparable = (value) => ({ ...value, observedAt: undefined, ...(opts.ignoreCleanup ? { cleanup: undefined } : {}),
+        diff: value.diff.state === 'available' ? { ...value.diff, snapshotId: undefined, path: undefined } : value.diff });
+    return isDeepStrictEqual(comparable(a), comparable(b));
+}
+/** NDJSON transcript text to events; a damaged line is skipped, never fatal. */
+function parseEvents(raw) {
+    return raw
+        .split('\n')
+        .filter(Boolean)
+        .map((line) => {
+        try {
+            return JSON.parse(line);
+        }
+        catch {
+            return null;
+        }
+    })
+        .filter((e) => e !== null);
+}
+function newestFirst(a, b) {
+    if (a.createdAt !== b.createdAt)
+        return a.createdAt < b.createdAt ? 1 : -1;
+    return a.seq < b.seq ? -1 : a.seq > b.seq ? 1 : 0;
+}
+/** An archived page's cursor: the last row's order, opaque to clients. A held run with no row yet
+ *  lists after every row (`seq` is infinite), which JSON cannot carry, so it travels as null. */
+function encodeArchivedCursor(key) {
+    return Buffer.from(JSON.stringify({ c: key.createdAt, s: Number.isFinite(key.seq) ? key.seq : null })).toString('base64url');
+}
+function decodeArchivedCursor(cursor) {
+    try {
+        const parsed = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'));
+        if (typeof parsed !== 'object' || parsed === null)
+            return undefined;
+        const { c, s } = parsed;
+        if (typeof c !== 'string' || !(s === null || (typeof s === 'number' && Number.isInteger(s))))
+            return undefined;
+        return { createdAt: c, seq: s ?? Number.POSITIVE_INFINITY };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The items newest first, each by the order beside it. Stable: ties keep their input order. */
+function sortNewestFirst(entries) {
+    return [...entries].sort(([, a], [, b]) => newestFirst(a, b)).map(([item]) => item);
+}
+/** The delegation family a run belongs to, by its root's id: a root is its own, a worker its
+ *  parent's. Workers cannot delegate, so a family is one root and its direct workers, never more. */
+function familyRootOf(run) {
+    if (run.delegation?.role === 'root')
+        return run.id;
+    if (run.delegation?.role === 'worker')
+        return run.delegation.parentRunId;
+    return undefined;
+}
+/** Tests freeze the copies of cold runs, so an in-place write to one throws instead of vanishing. */
+function deepFreeze(value) {
+    if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+        Object.freeze(value);
+        for (const child of Object.values(value))
+            deepFreeze(child);
+    }
+    return value;
+}
+/**
+ * A stored summary, or undefined when the row holds none (a row seeded without one, or text that
+ * is not a summary): the caller then projects the record instead. The column is written only by
+ * `encodeRunRow`, from a record the schema accepted, so this checks the shape a list row cannot
+ * do without rather than running the full contract schema — on a cockpit's thousand rows that
+ * schema costs more than reading them. The cold reader (`run-index.ts`), which reads other
+ * projects' databases, still validates in full.
+ */
+export function parseStoredSummary(text) {
+    try {
+        const raw = JSON.parse(text);
+        if (!raw || typeof raw !== 'object')
+            return undefined;
+        const row = raw;
+        return typeof row.id === 'string' && typeof row.title === 'string' && typeof row.status === 'string' &&
+            typeof row.createdAt === 'string' && typeof row.archived === 'boolean' ? raw : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 const WORKER_PROCESS_CAP = 32;
-const recordedProcessSchema = z.object({ pid: z.number().int().positive(), startToken: z.string().min(1).max(128).optional() }).strict();
+const recordedProcessSchema = z.object({ pid: z.number().int().positive(), startToken: z.string().min(1).max(128).optional(),
+    pgid: z.number().int().positive().optional() }).strict();
 const workerProcessRecordSchema = z.object({ generation: z.string().uuid(), controller: recordedProcessSchema,
     processes: z.array(recordedProcessSchema).max(WORKER_PROCESS_CAP) }).strict();
 const startToken = (pid) => { const token = processStartToken(pid); return token === undefined ? {} : { startToken: token }; };
+/** The bulk-archive sweep's one predicate (#780): finished, not archived, not scheduled (a
+ *  `failed` run waiting out a usage limit), not an owned worker (those leave with their parent),
+ *  then filtered by pin state. Mirrored clause for clause by `isSweepable` in the cockpit's
+ *  `lib/tasks-table.ts`. */
+export function isSweepable(run, scope) {
+    if (run.archived || !['done', 'failed', 'cancelled'].includes(run.status))
+        return false;
+    if (run.status === 'failed' && run.autoResumeAt !== undefined)
+        return false;
+    if (run.delegation?.role === 'worker')
+        return false;
+    if (scope === 'unpinned')
+        return !run.pinned;
+    if (scope === 'pinned')
+        return run.pinned === true;
+    return true;
+}
 /**
- * File-backed run store: `runs.json` index (atomic tmp+rename writes, the
- * pattern from @cezar/core's IssueStore) plus one append-only NDJSON event
- * file per run. Also the in-process event bus the SSE endpoints subscribe to:
- * emits `('run', RunRecord)` and `('event', { runId, event: RunEvent })`.
+ * File-backed run store: one row per run in `runs.db` (#779, `./run-database.ts`) plus one
+ * append-only NDJSON event file per run. Also the in-process event bus the SSE endpoints
+ * subscribe to: emits `('run', RunRecord)` and `('event', { runId, event: RunEvent })`.
+ *
+ * Only the held set lives in memory (#779, Amendment 2): live runs, the runs a RunManager pins,
+ * their delegation families, and runs whose latest write has not settled yet (see `isHeld`).
+ * `getRun` answers a held run with the held object, so `commitIndex` still installs into the
+ * record a caller holds; any other run is read from `runs.db` as a fresh copy every time (frozen
+ * under vitest, so an in-place write throws instead of being lost). Writes to a finished run go
+ * through the methods here, which load it, change it and persist the row like any other.
+ *
+ * Two write paths, both through `writeIndex`:
+ * - optimistic: a method changes the held record, marks it dirty and schedules the debounced
+ *   save, which writes the dirty rows and deletions only;
+ * - durable (`commitIndex`): one transaction with the changed rows AND everything a debounced
+ *   save still owes. Only once it commits do the records change in memory, and only then do
+ *   subscribers hear about it.
+ *
+ * Several processes may open one project (`serve` and a headless `cez run`), so a store writes
+ * only the delegation families it claims in `run_claims` (#779, plan step 3; `run-claims.ts`).
+ * Everything it holds is claimed: open claims the live rows nobody alive owns and leaves the rest
+ * alone, and a write to a run not in memory claims its family first, or refuses it while another
+ * live process owns it. Claims are released once a family leaves memory, and all of them on
+ * `close()`; a crashed owner's are taken over only once it is proven dead. Every write is fenced
+ * in its transaction: if a row is not as this store last saw it, or its claim is gone, nothing is
+ * written, the evidence goes to `run_conflicts` and this store stops writing that row
+ * (`handleConflicts`).
  */
 export class RunStore extends EventEmitter {
     dataDir;
-    runs = new Map();
+    /** The held set: every record this store keeps in memory, by id. */
+    held = new Map();
+    /** Who holds a run beyond its record, by holder, so one holder's unpin never releases another. */
+    pins = new Map();
+    /** Staged ids while a durable commit installs and announces them: never evicted mid-commit. */
+    committing = new Set();
     saveTimer = null;
+    /** `null` once the store is closed, and in a `RunStore.unavailable` store (nothing is written,
+     *  nothing is evicted). */
+    db = null;
+    /** Why `open` failed, in a `RunStore.unavailable` store. */
+    openFailure;
+    /** Runs whose held record is ahead of its row; the next save or commit writes them. */
+    dirty = new Set();
+    /** Runs gone from memory whose rows the next save or commit deletes. */
+    deleted = new Set();
+    /** Deleted runs whose history files (events, handoff, images, artifacts) go once the delete of
+     *  their row commits: until then a conflict can undo the delete and bring the row back. */
+    historyOwed = new Set();
     /** The repository this project IS (#945), armed after `open()` by `setRepoHandle`. Undefined
      *  until it arrives and `null` when it cannot be known — both mean "unscoped", which is
      *  exactly the pre-#945 behavior. */
     repoHandle;
+    /** `open()`'s `keepLive`, which a run read later from `runs.db` is reconciled with too. */
+    keepLive = false;
+    /** This store's identity in `run_claims`; undefined without a database. */
+    owner;
+    /** The families this store claims, with the generation each acquisition got. */
+    claimed = new Map();
+    /** Families judged free whose claim a busy database kept this store from taking: the next write
+     *  of their rows takes it in its own transaction, if it is still as judged (null: absent). */
+    pendingClaims = new Map();
+    /** The revision and `data` of each held row (and pending deletion) as this store last read or
+     *  wrote it: what a write is fenced against, and a conflict's "original". No entry: this store
+     *  created the row and has not written it yet. `extras` is what that `data` holds beyond the
+     *  schema, which the next write of the row puts back (raw-record.ts). */
+    base = new Map();
+    /** Rows read cold in the current synchronous turn, so a commit staged from one is fenced against
+     *  the version it was computed from. `owned`: its family was already this store's when read.
+     *  Cleared at the next microtask: no commit spans a turn. */
+    coldBase = new Map();
+    /** The family of each pending deletion, whose claim the deleting write is fenced against. */
+    deletedFamilies = new Map();
+    /** Rows a conflicting write excluded: this store refuses to write them until it is reopened. */
+    quarantined = new Set();
+    /** Rows whose `data` this store tried to decode and could not: left in the database untouched,
+     *  and left out of the list rows from then on, as the cold reader leaves them out (run-index.ts). */
+    unreadable = new Set();
+    /** Background one-at-a-time compressor for archived transcripts (#818). */
+    compressor;
+    /** Transcript facts the delegation paths ask about, so they never re-read a transcript (#880). */
+    facts;
     constructor(dataDir) {
         super();
         this.dataDir = dataDir;
         this.setMaxListeners(100);
+        this.facts = new TranscriptFactsIndex(dataDir);
+        this.compressor = new HistoryCompressor(dataDir, (id) => this.isHistoryCompressEligible(id), (id, plain, archive) => this.facts.adoptArchive(id, plain, stampOf(archive)));
     }
-    /** See `reconcileLoadedRun` for what `keepLive` (#367) decides about live-looking rows. */
+    /**
+     * Open the project's run store. See `reconcileLoadedRun` for what `keepLive` (#367) decides
+     * about live-looking rows.
+     *
+     * Reads `runs.db` once its import is complete. Before that, `runs.json` is imported into it in
+     * one transaction (`importLegacyIndex`) and left exactly as it was, for older cezars to read.
+     * Either way only the held set is decoded: the live rows (by the indexed `live` column), the
+     * few finished rows a normalization still repairs, and the delegation families of the live
+     * ones.
+     *
+     * A store that cannot be opened is never an empty one (#779, plan step 4): `open` throws a
+     * `RunStoreOpenError` naming the cause, and nothing is reset, restored or deleted. `retryBusy`
+     * waits out a busy database (and a cockpit that may still be importing) with growing pauses,
+     * about 3.5 s in all, before it gives up. Open is synchronous, so the wait blocks this thread:
+     * only a boot passes it, while nothing else runs yet. Without it a busy database fails after
+     * one busy timeout.
+     */
     static open(dataDir, opts) {
-        mkdirSync(join(dataDir, 'runs'), { recursive: true });
-        const store = new RunStore(dataDir);
-        const indexPath = join(dataDir, 'runs.json');
-        if (existsSync(indexPath)) {
+        const path = join(dataDir, RUNS_DB_FILE);
+        const delays = opts?.retryBusy ? OPEN_RETRY_DELAYS_MS : [];
+        const started = Date.now();
+        for (let attempt = 0;; attempt++) {
             try {
-                const raw = JSON.parse(readFileSync(indexPath, 'utf8'));
-                const parsed = parseRunRecords(raw);
-                if (parsed.success) {
-                    for (const run of parsed.data) {
-                        if (run.delegation?.role === 'root' && (run.status === 'waiting' || run.delegation.wait !== undefined)) {
-                            refreshHumanAskSummary(run, dataDir);
-                        }
-                        store.runs.set(run.id, reconcileLoadedRun(run, opts));
-                    }
+                return RunStore.openOnce(dataDir, path, opts?.keepLive === true);
+            }
+            catch (error) {
+                const transient = error instanceof RunDatabaseBusyError || (error instanceof LegacyWriterError && error.reason === 'cockpit');
+                if (!transient || attempt >= delays.length) {
+                    throw toRunStoreOpenError(error, path, attempt > 0 ? { waitedMs: Date.now() - started } : {});
                 }
+                sleepSync(delays[attempt]);
             }
-            catch {
-                // corrupt index — start fresh; event files stay on disk untouched
+        }
+    }
+    static openOnce(dataDir, path, keepLive) {
+        mkdirSync(join(dataDir, 'runs'), { recursive: true });
+        const store = new RunStore(dataDir);
+        store.keepLive = keepLive;
+        const db = RunDatabase.open(path);
+        try {
+            if (db.getMeta(RUNS_IMPORT_COMPLETE_KEY) === undefined)
+                importLegacyIndex(db, dataDir);
+            store.db = db;
+            store.owner = openClaimSession();
+            store.loadHeldRows();
+            store.warmTranscriptFacts();
+        }
+        catch (error) {
+            if (store.owner) {
+                try {
+                    db.releaseClaims(store.owner.session);
+                }
+                catch { /* the session closes below: its claims are provably dead */ }
+                closeClaimSession(store.owner.session);
             }
+            store.owner = undefined;
+            store.db = null;
+            store.held.clear();
+            store.dirty.clear();
+            store.claimed.clear();
+            store.base.clear();
+            db.close();
+            throw error;
         }
         return store;
     }
+    /**
+     * The store `serve` keeps for its boot project when `open` failed: no database, nothing held,
+     * and every attempt to create or save a run refused with `failure`. The cockpit answers every
+     * route of that project with `failure`'s message, and boot skips everything that would read
+     * its empty run list as "no runs" (orphan pruning, retention, recovery, scratch sweeps). The
+     * way out is a restart once the cause is gone.
+     */
+    static unavailable(dataDir, failure) {
+        const store = new RunStore(dataDir);
+        store.openFailure = failure;
+        return store;
+    }
+    /** Why this store has no database, when it is `RunStore.unavailable`'s: its runs are unknown,
+     *  not absent. */
+    get unavailable() {
+        return this.openFailure;
+    }
+    /**
+     * Open-time load: the live rows, the finished rows a load normalization repairs, then the
+     * delegation families of the live ones. A row that does not parse is skipped and left in the
+     * database untouched; one warning says how many.
+     *
+     * Only rows this store can claim are loaded (#779, plan step 3). A live row whose family another
+     * live process claims — `serve`'s parked run, seen by a headless `cez run` — is that process's:
+     * it is not loaded, normalized or recovered here, and stays readable through `getRun` and the
+     * list rows. A live row nobody alive claims is taken over, as before: this open recovers it
+     * (`keepLive`) or settles it as interrupted.
+     */
+    loadHeldRows() {
+        let unreadable = 0;
+        const decode = (row) => {
+            const decoded = decodeRunRow(row.data);
+            if (!decoded) {
+                unreadable++;
+                this.unreadable.add(row.id);
+            }
+            return decoded;
+        };
+        const live = this.db.listLive();
+        const owned = this.claimFamilies(live.map(rowFamily), { allowLive: true, wait: true });
+        for (const row of live) {
+            if (!owned.has(rowFamily(row)))
+                continue;
+            const decoded = decode(row);
+            if (decoded)
+                this.adoptLoadedRun(decoded, { keepLive: this.keepLive }, row);
+        }
+        const heal = this.db.listWhere(LEGACY_REFERENCE_HEAL_SQL).filter((row) => !this.held.has(row.id));
+        const healable = this.claimFamilies(heal.map(rowFamily));
+        for (const row of heal) {
+            if (!healable.has(rowFamily(row)))
+                continue;
+            const decoded = decode(row);
+            // Held only when the repair changed it: the next save writes it, then it leaves.
+            if (decoded)
+                this.adoptLoadedRun(decoded, { keepLive: this.keepLive, onlyIfChanged: true }, row);
+        }
+        for (const rootId of this.anchoredFamilies())
+            this.holdFamily(rootId, decode);
+        this.releaseUnheldClaims();
+        if (unreadable > 0)
+            console.warn(`[cez] ${unreadable} run(s) in ${RUNS_DB_FILE} could not be read; they are left in the database untouched.`);
+    }
+    /** Normalize a record just read from `row` (see `reconcileLoadedRun`) and hold it. Marks the row
+     *  dirty only when normalization changed it, so the next save persists exactly the runs open()
+     *  rewrote. The caller has claimed the row's family. */
+    adoptLoadedRun({ run, extras }, opts, row) {
+        const before = loadNormalizedFields(run);
+        if (run.delegation?.role === 'root' && (run.status === 'waiting' || run.delegation.wait !== undefined)) {
+            this.syncHumanAskSummary(run);
+        }
+        if (opts.settle)
+            settleOrphanedRun(run, { stop: opts.stop });
+        else
+            reconcileLoadedRun(run, opts);
+        const changed = loadNormalizedFields(run) !== before;
+        if (opts.onlyIfChanged && !changed)
+            return;
+        this.held.set(run.id, run);
+        this.base.set(run.id, { revision: row.revision, seq: row.seq, data: row.data, extras });
+        if (changed)
+            this.dirty.add(run.id);
+    }
+    /**
+     * Hold one delegation family: its root and the root's direct workers, read through the
+     * `parent_run_id` index. No recursion: workers cannot delegate, so a worker's own id never
+     * names a family. The caller has claimed it. `settle` settles its live rows instead of keeping
+     * them for recovery (`settleOrphanedRun`); `stopId` is the run a Stop settles as cancelled.
+     */
+    holdFamily(rootId, decode = (row) => decodeRunRow(row.data), settle = false, stopId) {
+        const rows = [this.db.get(rootId), ...this.db.listByParent(rootId)];
+        for (const row of rows) {
+            if (!row || this.held.has(row.id) || this.deleted.has(row.id))
+                continue;
+            const decoded = decode(row);
+            if (decoded)
+                this.adoptLoadedRun(decoded, { keepLive: this.keepLive, settle, stop: row.id === stopId }, row);
+        }
+    }
+    /**
+     * Make sure this store claims each of `families`, taking every one no live process holds, and
+     * return the ones it now holds. Liveness is judged here (`claimOwnerLive`), outside the write
+     * transaction; `takeClaims` then takes a claim only if it is still exactly what was judged.
+     *
+     * `allowLive` also takes a family that still has a live row although no live process owns it.
+     * Open and `adoptFamily` pass it, because recovery follows both, and so does a write moving a
+     * run this store holds into a new family (a worker quarantined to `invalid` becomes its own):
+     * an ordinary write must not quietly inherit a dead process's live run and leave it unrecovered.
+     * `wait` retries a busy database instead of leaving the claim to the next write: recovery
+     * cannot start without it.
+     */
+    claimFamilies(families, opts = {}) {
+        const owned = new Set();
+        const wanted = [];
+        for (const family of new Set(families)) {
+            if (this.claimed.has(family) || this.pendingClaims.has(family))
+                owned.add(family);
+            else
+                wanted.push(family);
+        }
+        if (!this.db || !this.owner || wanted.length === 0)
+            return owned;
+        const claims = this.db.getClaims(wanted);
+        const take = [];
+        for (const family of wanted) {
+            const claim = claims.get(family);
+            if (claim && claimOwnerLive(claim))
+                continue;
+            if (!opts.allowLive && this.db.familyHasLive(family))
+                continue;
+            take.push({ family, expect: claim ? { session: claim.session, generation: claim.generation } : null });
+        }
+        if (take.length === 0)
+            return owned;
+        let taken;
+        try {
+            taken = this.takeClaims(take, opts.wait ? ADOPT_CLAIM_ATTEMPTS : 1);
+        }
+        catch (error) {
+            if (!(error instanceof RunDatabaseBusyError))
+                throw error;
+            // Recovery follows an adoption, so it must hold the claim first: those families stay
+            // unclaimed and orphaned (a control or the next restart adopts them). A write does not wait:
+            // its next transaction takes the claim (`fence`), or meets whoever took it meanwhile.
+            if (opts.wait)
+                return owned;
+            for (const { family, expect } of take) {
+                this.pendingClaims.set(family, expect);
+                owned.add(family);
+            }
+            this.scheduleSave();
+            return owned;
+        }
+        for (const [family, generation] of taken) {
+            this.claimed.set(family, generation);
+            owned.add(family);
+        }
+        // A claim taken for a write that then changes nothing still leaves at the next sweep.
+        if (taken.size > 0)
+            this.scheduleSave();
+        return owned;
+    }
+    /** `takeClaims`, retried while another connection holds the write lock (each try waits out the
+     *  busy timeout), then the busy error. */
+    takeClaims(take, attempts) {
+        for (let attempt = 1;; attempt++) {
+            try {
+                return this.db.takeClaims(this.owner, take);
+            }
+            catch (error) {
+                if (!(error instanceof RunDatabaseBusyError) || attempt >= attempts)
+                    throw error;
+            }
+        }
+    }
+    /** Release the claim of every family with nothing left in memory, once nothing is pending: a
+     *  failed save keeps its families claimed until it succeeds. A failed release retries at the
+     *  next sweep; `close()` releases the rest. */
+    releaseUnheldClaims() {
+        if (!this.db || !this.owner || this.dirty.size > 0 || this.deleted.size > 0)
+            return;
+        const kept = new Set();
+        for (const run of this.held.values())
+            kept.add(familyKey(run));
+        // A claim never taken has nothing to release in the database.
+        for (const family of this.pendingClaims.keys())
+            if (!kept.has(family))
+                this.pendingClaims.delete(family);
+        const released = [...this.claimed.keys()].filter((family) => !kept.has(family));
+        if (released.length === 0)
+            return;
+        try {
+            this.db.releaseClaims(this.owner.session, released);
+            for (const family of released)
+                this.claimed.delete(family);
+        }
+        catch {
+            // Busy or failing: the next sweep tries again.
+        }
+    }
+    /**
+     * Who may change this run right now (see `RunOwnership`), or undefined when there is no such
+     * run. Read-only: nothing is claimed. Controls ask this first, so a run another process owns is
+     * refused with `RUN_IN_USE_ELSEWHERE` and a dead process's run is adopted before it is changed.
+     */
+    runOwnership(id) {
+        if (this.quarantined.has(id))
+            return 'quarantined';
+        const held = this.held.get(id);
+        if (!this.db)
+            return held ? 'held' : undefined;
+        const family = held ? familyKey(held) : this.deleted.has(id) ? undefined : this.db.familyOf(id);
+        if (family === undefined)
+            return undefined;
+        if (this.claimed.has(family) || this.pendingClaims.has(family))
+            return 'held';
+        const claim = this.db.getClaim(family);
+        if (claim && claimOwnerLive(claim))
+            return 'foreign';
+        // The same rule `claimFamilies` writes by: a dead owner left only settled runs → free.
+        return this.db.familyHasLive(family) ? 'orphaned' : 'free';
+    }
+    /** Why a control on this run must be refused here, or undefined when this store may change it. */
+    writeRefusal(id) {
+        const ownership = this.runOwnership(id);
+        if (ownership === 'quarantined')
+            return RUN_QUARANTINED;
+        return ownership === 'foreign' || ownership === 'orphaned' ? RUN_IN_USE_ELSEWHERE : undefined;
+    }
+    /**
+     * Take over the delegation family of an `orphaned` run for a control: claim it from its dead
+     * owner (or from nobody), then load it and settle its live rows (`settleOrphanedRun`) — never
+     * keep them for recovery to resume, since only Continue may start agent work. With `stop` the
+     * control is Stop: `id` itself is settled as cancelled rather than interrupted. Returns the
+     * family's root id, or undefined when a live owner holds it after all or it is gone. The caller
+     * runs recovery for that family next (`RunManager.adoptOrphanedRun`), which then repairs it.
+     */
+    adoptFamily(id, opts = {}) {
+        const family = this.db?.familyOf(id);
+        if (family === undefined || !this.claimFamilies([family], { allowLive: true, wait: true }).has(family))
+            return undefined;
+        this.holdFamily(family, undefined, true, opts.stop ? id : undefined);
+        return family;
+    }
+    /** Every run whose family another process owns — alive, or dead with a live run left to
+     *  recover (cleanup keeps their scratch: it is theirs, or recovery's once someone adopts them).
+     *  A dead owner's claim on a family with nothing live is no claim (see `runOwnership`). */
+    listForeignClaimedRunIds() {
+        const db = this.db, owner = this.owner;
+        if (!db || !owner)
+            return [];
+        const kept = new Set(db.listClaims().filter((claim) => claim.session !== owner.session &&
+            (claimOwnerLive(claim) || db.familyHasLive(claim.family))).map((claim) => claim.family));
+        return kept.size === 0 ? [] : db.listForeignClaimedIds(owner.session).filter((row) => kept.has(row.family)).map((row) => row.id);
+    }
+    /**
+     * Whether a held run anchors itself (and its family) in memory. Anything else held is a family
+     * member or a settled write, and leaves at the next sweep (`evictSettled`).
+     *
+     * The held set is: every run that is live (`isLiveRecord`), pinned by a RunManager (`pin`),
+     * dirty, or inside a durable commit; plus the whole delegation family (root and direct
+     * workers) of any such run. Families are held because the RunManager reads a live run's family
+     * on every run event — `GET /runs/:id/relationships`, the global `reconcileWorkerWaits` pass
+     * (about twenty call sites), completion blockers and conversations — and decoding a cold
+     * record costs about 200 µs (JSON.parse plus the schema). Measured on a copy of a real
+     * cockpit's `runs.json` (958 runs, 957 of them delegated): a running root with 26 workers
+     * paid about 5 ms per family read, and the live families together about 10 ms per global
+     * pass, all on the event loop. Holding them costs memory in proportion to active work, not to
+     * history.
+     */
+    isAnchor(id, run) {
+        return isLiveRecord(run) || this.pins.has(id) || this.dirty.has(id) || this.committing.has(id);
+    }
+    /** The family roots with an anchoring member in memory. */
+    anchoredFamilies() {
+        const roots = new Set();
+        for (const [id, run] of this.held) {
+            const root = familyRootOf(run);
+            if (root !== undefined && this.isAnchor(id, run))
+                roots.add(root);
+        }
+        return roots;
+    }
+    /** Drop every held run that is neither an anchor nor in an anchored family. A store without a
+     *  database keeps everything: memory is the only copy it has. */
+    evictSettled() {
+        if (!this.db)
+            return;
+        const families = this.anchoredFamilies();
+        for (const [id, run] of this.held) {
+            if (this.isAnchor(id, run))
+                continue;
+            const root = familyRootOf(run);
+            if (root !== undefined && families.has(root))
+                continue;
+            this.held.delete(id);
+            this.base.delete(id);
+        }
+        this.releaseUnheldClaims();
+    }
+    /** A run read from `runs.db`, normalized like a loaded one (`reconcileLoadedRun`, then the
+     *  repository scope) but held by nobody. Undefined when absent, deleted or unreadable. */
+    loadCold(id) {
+        if (!this.db || this.deleted.has(id))
+            return undefined;
+        const row = this.db.get(id);
+        return row ? this.decodeCold(row) : undefined;
+    }
+    decodeCold(row) {
+        const decoded = decodeRunRow(row.data);
+        if (!decoded) {
+            this.unreadable.add(row.id);
+            return undefined;
+        }
+        this.unreadable.delete(row.id);
+        const { run, extras } = decoded;
+        if (this.coldBase.size === 0)
+            queueMicrotask(() => this.coldBase.clear());
+        const family = rowFamily(row);
+        this.coldBase.set(row.id, { revision: row.revision, seq: row.seq, data: row.data, extras, owned: this.claimed.has(family) || this.pendingClaims.has(family) });
+        reconcileLoadedRun(run, { keepLive: this.keepLive });
+        rescopeRun(run, this.repoHandle);
+        return run;
+    }
+    /** Hold a run just decoded from its row: the object every later read and write shares. */
+    holdDecoded(run) {
+        const read = this.coldBase.get(run.id);
+        this.held.set(run.id, run);
+        if (read)
+            this.base.set(run.id, storedRow(read));
+        return run;
+    }
+    /**
+     * Bring a run into memory and return the held object: the record a write changes in place.
+     * It leaves again at the first sweep after its write settles, unless something anchors it.
+     * Its family is claimed first, then the row is read, so the version held is the claimed one;
+     * undefined while another process owns it (see `claimFamilies`).
+     */
+    hold(id) {
+        const held = this.held.get(id);
+        if (held)
+            return held;
+        const family = this.db && !this.deleted.has(id) ? this.db.familyOf(id) : undefined;
+        if (family === undefined || !this.claimFamilies([family]).has(family))
+            return undefined;
+        const run = this.loadCold(id);
+        if (!run)
+            return undefined;
+        this.holdDecoded(run);
+        this.scheduleSave();
+        return run;
+    }
+    /** The record a store write changes in place: held, or loaded to be. Undefined for a run this
+     *  store may not write (another process's, or quarantined), so the write changes nothing. */
+    record(id) {
+        if (this.quarantined.has(id))
+            return undefined;
+        return this.held.get(id) ?? this.hold(id);
+    }
+    /** The current record for reading: the held object, the held copy of a run whose family is in
+     *  memory, or else a fresh copy nobody holds. */
+    peek(id) {
+        const held = this.held.get(id);
+        if (held)
+            return held;
+        const run = this.loadCold(id);
+        return run && this.answerCold(run, false);
+    }
+    /**
+     * A run just read off its row, as reads answer it: held when its family is in memory (a live
+     * family's members are read on every run event), else a copy nobody holds — frozen under
+     * vitest when it leaves the store (`freeze`).
+     */
+    answerCold(run, freeze) {
+        const root = familyRootOf(run);
+        if (root !== undefined && this.anchoredFamilies().has(root))
+            return this.holdDecoded(run);
+        return freeze && process.env.VITEST ? deepFreeze(run) : run;
+    }
+    /** `getRun` for a row a query already read: the held object, else decoded from `row`. */
+    fromRow(row) {
+        const held = this.held.get(row.id);
+        if (held)
+            return held;
+        if (this.deleted.has(row.id))
+            return undefined;
+        const run = this.decodeCold(row);
+        return run && this.answerCold(run, true);
+    }
+    /** Whether the run exists, held or not, without decoding it. */
+    hasRun(id) {
+        return this.held.has(id) || (!!this.db && !this.deleted.has(id) && this.db.has(id));
+    }
+    /**
+     * Keep a run in memory for `holder` until `unpin(id, holder)`: a RunManager pins the runs it is
+     * executing (`active`) and the run a Continue is admitting (`continue`). A finished run is
+     * loaded. Pins are per holder, so releasing one never releases another. Returns the held record.
+     */
+    pin(id, holder) {
+        const run = this.record(id);
+        if (!run)
+            return undefined;
+        let holders = this.pins.get(id);
+        if (!holders)
+            this.pins.set(id, holders = new Set());
+        holders.add(holder);
+        return run;
+    }
+    /** Release `holder`'s pin. The run leaves memory at the next sweep once nothing else holds it. */
+    unpin(id, holder) {
+        const holders = this.pins.get(id);
+        if (!holders?.delete(holder))
+            return;
+        if (holders.size === 0)
+            this.pins.delete(id);
+        this.sweepIfSettled([id]);
+    }
     /**
      * Tell the store which repository this project IS (#945), so the referenced tier stops adopting
      * another repo's PR/issue as the task's subject. See `isRepoScopedRef` for the rule.
@@ -767,7 +1691,9 @@ export class RunStore extends EventEmitter {
      * Arming also HEALS records already poisoned by the un-scoped rule, on the `reconcileLoadedRun`
      * precedent: the evidence is all still on the record (`referenced*Candidates`), only the
      * conclusion drawn from it was wrong, so re-deciding beats asking for a migration. It rewrites
-     * values, never the format, and is one-directional by construction — see `rescopeRun`.
+     * values, never the format, and is one-directional by construction — see `rescopeRun`. Held
+     * runs are re-checked in memory; of the rest, only rows whose stored summary references another
+     * repository are decoded, and the healed ones are written, so their summaries heal too.
      */
     setRepoHandle(handle) {
         this.repoHandle = handle;
@@ -776,55 +1702,419 @@ export class RunStore extends EventEmitter {
         // `touch` per healed run: the cockpit is already live when the handle lands, so a corrected
         // chip has to reach the open page over SSE, not just the next `runs.json` write.
         let healed = false;
-        for (const run of this.runs.values()) {
+        const own = `${handle.owner}/${handle.name}`.toLowerCase();
+        const foreign = (url) => url !== undefined && refUrlRepo(url) !== own;
+        const stored = this.db?.listWhere(REFERENCED_SQL).filter((row) => {
+            if (this.held.has(row.id) || this.deleted.has(row.id))
+                return false;
+            const summary = parseStoredSummary(row.summary);
+            return !summary || foreign(summary.referencedPullRequestUrl) || foreign(summary.referencedIssueUrl);
+        }) ?? [];
+        for (const run of [...this.held.values()]) {
             if (rescopeRun(run, this.repoHandle)) {
                 this.touch(run);
                 healed = true;
             }
         }
+        // Only rows this store may write: another process's runs heal when their owner arms its handle.
+        const writable = this.claimFamilies(stored.map(rowFamily));
+        for (const row of stored) {
+            if (!writable.has(rowFamily(row)))
+                continue;
+            const run = this.decodeCold(row);
+            // `decodeCold` already scoped it with the handle just armed; write it when that changed it.
+            if (!run || !this.storedScopeDiffers(row, run))
+                continue;
+            this.holdDecoded(run);
+            this.touch(run);
+            healed = true;
+        }
         // Discovery may finish after headless shutdown's final flush. Persist repairs now: the
         // debounced save is unref'd, so it cannot keep the CLI alive once the lookup completes.
         if (healed)
             this.flush();
     }
+    /** Whether the stored summary still names a reference the scoped record no longer has. */
+    storedScopeDiffers(row, run) {
+        const summary = parseStoredSummary(row.summary);
+        return summary?.referencedPullRequestUrl !== run.referencedPullRequestUrl ||
+            summary?.referencedIssueUrl !== run.referencedIssueUrl || summary?.issueNumber !== run.issueNumber;
+    }
+    /**
+     * The live set, newest first: runs whose record is live (`isLiveRecord`) or that a RunManager
+     * pins. Finished runs are not here — read one by id (`getRun`), by an indexed query
+     * (`listWorkersOf`, `findRunByClientRequestId`, `listGroupRuns`, `listRunsWithWorktree`,
+     * `listBranchOwners`), or as list rows (`listRunSummaries`).
+     */
     listRuns() {
-        return [...this.runs.values()].sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+        return sortNewestFirst([...this.held].filter(([id, run]) => isLiveRecord(run) || this.pins.has(id)).map(([, run]) => [run, this.listOrder(run)]));
+    }
+    /** Where a held run lists: its row's insertion order, or after every row while this store has
+     *  not written it yet. The held set keeps such runs in creation order, and so does every list
+     *  that sorts them in held-set order (`sortNewestFirst` is stable). */
+    listOrder(run) {
+        return { createdAt: run.createdAt, seq: this.base.get(run.id)?.seq ?? Number.POSITIVE_INFINITY };
+    }
+    /**
+     * EVERY run as a full record, newest first — decoded row by row. Only the legacy `GET /runs`
+     * (older clients; the cockpit reads `GET /run-summaries`) may call this: it is exactly the
+     * whole-history parse #779 exists to remove from everything else.
+     */
+    listAllRunsForLegacyRoute() {
+        const runs = new Map();
+        for (const row of this.db?.listAll() ?? []) {
+            if (this.deleted.has(row.id) || this.held.has(row.id))
+                continue;
+            const run = this.decodeCold(row);
+            if (run)
+                runs.set(row.id, [run, row]);
+        }
+        for (const [id, run] of this.held)
+            runs.set(id, [run, this.listOrder(run)]);
+        return sortNewestFirst(runs.values());
     }
+    /**
+     * Every run as its list row, newest first: the stored `summary` column, with each held run's
+     * own projection laid over it — a debounced save keeps memory up to 300 ms ahead of the row,
+     * and a run created since the last save has no row yet. `usage` is the caller's to attach.
+     *
+     * With `archivedWindow` (#864), the window the cockpit's lists read: every unarchived run, plus
+     * the newest `archivedWindow` archived ROOT runs, and whether older archived roots were left
+     * out. Archived workers are never in it (see `RunDatabase.listWindowSummaries`); with `roots`,
+     * no worker is — the runs index, whose readers list no workers. A held run
+     * lists by its record, so one archived or unarchived since the last save is ranked as it is now.
+     *
+     * A row this store found unreadable is left out, as the cold reader leaves out a row it had to
+     * decode and could not. A finished row nobody has decoded is served from its summary by both,
+     * which decodes nothing; reading it is what finds out (`isUnreadable`).
+     */
+    listRunSummaries(options = {}) {
+        const { archivedWindow, roots = false } = options;
+        // Every skipped row may be an archived root, so ask for that many more: one past the window
+        // after skipping is how "older ones were left out" is known without counting them.
+        const rows = (archivedWindow === undefined
+            ? this.db?.listSummaries()
+            : this.db?.listWindowSummaries(archivedWindow + 1 + this.deleted.size + this.unreadable.size + this.held.size, { roots })) ?? [];
+        const summaries = new Map();
+        for (const row of rows) {
+            if (this.deleted.has(row.id) || this.held.has(row.id) || this.unreadable.has(row.id))
+                continue;
+            const summary = parseStoredSummary(row.summary) ?? this.coldSummary(row.id);
+            if (summary)
+                summaries.set(row.id, [summary, row]);
+        }
+        for (const [id, run] of this.held) {
+            if (archivedWindow !== undefined && (run.archived || roots) && run.delegation?.role === 'worker')
+                continue;
+            summaries.set(id, [toRunSummary(run), this.listOrder(run)]);
+        }
+        const runs = sortNewestFirst(summaries.values());
+        if (archivedWindow === undefined)
+            return { runs, truncated: false };
+        let archived = 0;
+        const kept = runs.filter((run) => !run.archived || ++archived <= archivedWindow);
+        return { runs: kept, truncated: archived > archivedWindow };
+    }
+    /**
+     * One page of archived ROOT runs, newest first (#864): `GET /run-summaries/archived`, the
+     * archived runs past the window. Held runs list by their record, as in `listRunSummaries`.
+     * `before` is the previous page's `nextCursor`; with `q`, only runs `matchesRunQuery` keeps, and
+     * `total` counts those. A cursor this store did not write answers `{ error }`.
+     *
+     * Ranking reads every archived root's key (id, created_at, seq: no record, no summary), so the
+     * page and `total` agree with the held overlay; only the page's own rows are read in full.
+     */
+    listArchivedRuns(options) {
+        let after;
+        if (options.before !== undefined) {
+            after = decodeArchivedCursor(options.before);
+            if (!after)
+                return { error: 'before is not a cursor this server wrote' };
+        }
+        const q = options.q?.trim() ?? '';
+        const skipped = (id) => this.deleted.has(id) || this.held.has(id) || this.unreadable.has(id);
+        const ranked = new Map();
+        if (q === '') {
+            for (const key of this.db?.listKeysWhere(ARCHIVED_ROOT) ?? [])
+                if (!skipped(key.id))
+                    ranked.set(key.id, key);
+        }
+        else {
+            for (const row of this.db?.searchRootSummaries(sqlPrefilterTokens(q)) ?? []) {
+                if (skipped(row.id))
+                    continue;
+                const summary = parseStoredSummary(row.summary) ?? this.coldSummary(row.id);
+                if (summary?.archived && matchesRunQuery(summary, q))
+                    ranked.set(row.id, { ...row, summary });
+            }
+        }
+        for (const [id, run] of this.held) {
+            if (!run.archived || run.delegation?.role === 'worker')
+                continue;
+            const summary = toRunSummary(run);
+            if (q === '' || matchesRunQuery(summary, q))
+                ranked.set(id, { ...this.listOrder(run), summary });
+        }
+        const ordered = [...ranked.entries()].sort(([, a], [, b]) => newestFirst(a, b));
+        const rest = after ? ordered.filter(([, key]) => newestFirst(key, after) > 0) : ordered;
+        const page = rest.slice(0, options.limit);
+        const cold = new Map((this.db?.getSummaries(page.filter(([, key]) => !key.summary).map(([id]) => id)) ?? [])
+            .map((row) => [row.id, parseStoredSummary(row.summary) ?? this.coldSummary(row.id)]));
+        const runs = page.flatMap(([id, key]) => {
+            const summary = key.summary ?? cold.get(id);
+            return summary ? [summary] : [];
+        });
+        const last = page.at(-1)?.[1];
+        return {
+            runs,
+            nextCursor: last && rest.length > page.length ? encodeArchivedCursor(last) : null,
+            total: ordered.length,
+        };
+    }
+    /**
+     * The ROOT runs, archived or not, that match `query` (`matchesRunQuery`), newest first: at most
+     * `limit`, and whether more matched. The owned half of the workspace search (#864); held runs
+     * match by their record.
+     */
+    searchRunSummaries(query, limit) {
+        const matched = new Map();
+        // Rows come newest first, so the newest `limit + 1` row matches are all a page can use; held
+        // runs, which may be newer than any row, are ranked in below.
+        this.db?.visitRootSummaries(sqlPrefilterTokens(query), (row) => {
+            if (this.deleted.has(row.id) || this.held.has(row.id) || this.unreadable.has(row.id))
+                return true;
+            const summary = parseStoredSummary(row.summary) ?? this.coldSummary(row.id);
+            if (summary && matchesRunQuery(summary, query))
+                matched.set(row.id, [summary, row]);
+            return matched.size <= limit;
+        });
+        for (const [id, run] of this.held) {
+            if (run.delegation?.role === 'worker')
+                continue;
+            const summary = toRunSummary(run);
+            if (matchesRunQuery(summary, query))
+                matched.set(id, [summary, this.listOrder(run)]);
+        }
+        const runs = sortNewestFirst(matched.values());
+        return { runs: runs.slice(0, limit), truncated: runs.length > limit };
+    }
+    /** A row whose stored summary does not fit the contract any more, projected from its record. */
+    coldSummary(id) {
+        const run = this.loadCold(id);
+        return run ? toRunSummary(run) : undefined;
+    }
+    /**
+     * The run, or undefined. A held run is the held object (writes install into it). Any other run
+     * is a fresh copy of its row each call, normalized like a loaded record — frozen under vitest —
+     * so changing it means a store method, never an assignment.
+     */
     getRun(id) {
-        return this.runs.get(id);
+        const held = this.held.get(id);
+        if (held)
+            return held;
+        const run = this.loadCold(id);
+        return run && this.answerCold(run, true);
+    }
+    /** Whether the run's row is in `runs.db` but its record could not be read here: what tells a
+     *  run that cannot open from one that does not exist. Known once something tried to read it. */
+    isUnreadable(id) {
+        return this.unreadable.has(id) && !this.held.has(id) && !this.deleted.has(id);
+    }
+    /** The ids in memory right now: the held set, for diagnostics and the benchmark's heap pass. */
+    heldIds() {
+        return [...this.held.keys()];
     }
     /**
      * The workers a root run owns, newest first, read off its own `receipts` (#659). Every
      * `createOwnedRun` writes the receipt and the worker record in one transaction, and the
-     * receipt list is capped at 32, so this is a bounded lookup rather than a walk of the whole
+     * receipt list is capped at 1,024 creations (#816), so this is a bounded lookup rather than a walk of the whole
      * project index. An ordinary or worker run owns nothing and costs one map read; a receipt
      * whose record has been deleted is skipped, never invented. A parent quarantined to
      * `invalid` has no readable receipts and reports none, which is also what the cockpit
      * assumes for that role.
      */
     listOwnedWorkers(parentId) {
-        const parent = this.runs.get(parentId);
+        const parent = this.getRun(parentId);
         if (parent?.delegation?.role !== 'root')
             return [];
         const workers = [];
         for (const receipt of parent.delegation.receipts) {
-            const worker = this.runs.get(receipt.workerId);
+            const worker = this.getRun(receipt.workerId);
             if (worker?.delegation?.role === 'worker' && worker.delegation.parentRunId === parentId)
                 workers.push(worker);
         }
         return workers.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
     }
+    /** Every worker filed under `parentId` (the `parent_run_id` index plus memory), newest first:
+     *  receipts or not, which is what the reconcile and deletion checks ask. */
+    listWorkersOf(parentId) {
+        const workers = new Map();
+        for (const run of this.held.values()) {
+            if (run.delegation?.role === 'worker' && run.delegation.parentRunId === parentId)
+                workers.set(run.id, [run, this.listOrder(run)]);
+        }
+        // Ids first: a live family's workers are usually all held, and then no record is read at all.
+        const cold = (this.db?.listIdsByParent(parentId) ?? []).filter((id) => !this.held.has(id) && !this.deleted.has(id));
+        for (const row of cold.length > 0 ? this.db.getMany(cold) : []) {
+            const run = this.fromRow(row);
+            if (run?.delegation?.role === 'worker' && run.delegation.parentRunId === parentId)
+                workers.set(row.id, [run, row]);
+        }
+        return sortNewestFirst(workers.values());
+    }
+    /** The id of every worker, held or stored, without decoding any (recovery's worker passes). */
+    listWorkerIds() {
+        const ids = new Set(this.db?.listWorkerIds() ?? []);
+        for (const id of this.deleted)
+            ids.delete(id);
+        for (const run of this.held.values())
+            if (run.delegation?.role === 'worker')
+                ids.add(run.id);
+        return [...ids];
+    }
+    /** The id of every run whose delegation is quarantined (`invalid`), held or stored: its stored
+     *  summary says so, so nothing is decoded (scratch cleanup). */
+    listQuarantinedRunIds() {
+        const ids = new Set((this.db?.listKeysWhere("json_extract(summary, '$.delegation.role') = 'invalid'") ?? []).map((key) => key.id));
+        for (const id of this.deleted)
+            ids.delete(id);
+        for (const [id, run] of this.held) {
+            if (run.delegation?.role === 'invalid')
+                ids.add(id);
+            else
+                ids.delete(id);
+        }
+        return [...ids];
+    }
+    /**
+     * The runs automation receipts launched, by receipt id (`automation.receiptId` or
+     * `automationTrigger.receiptId`). Memory answers first; a receipt it does not know costs one
+     * pass over `runs.db` that reads the records' JSON in SQLite — only a crash leftover (a
+     * receipt still `reserved` at startup) ever asks.
+     */
+    findRunIdsByAutomationReceipt(receiptIds) {
+        const wanted = new Set(receiptIds);
+        const found = new Map();
+        const receiptOf = (run) => run.automation?.receiptId ?? run.automationTrigger?.receiptId;
+        for (const run of this.held.values()) {
+            const receipt = receiptOf(run);
+            if (receipt !== undefined && wanted.has(receipt))
+                found.set(receipt, run.id);
+        }
+        const missing = [...wanted].filter((receipt) => !found.has(receipt));
+        if (missing.length === 0 || !this.db)
+            return found;
+        const where = "json_extract(data, '$.automation.receiptId') IN (SELECT value FROM json_each(?))" +
+            " OR json_extract(data, '$.automationTrigger.receiptId') IN (SELECT value FROM json_each(?))";
+        for (const key of this.db.listKeysWhere(where, [JSON.stringify(missing), JSON.stringify(missing)])) {
+            if (this.held.has(key.id) || this.deleted.has(key.id))
+                continue;
+            const run = this.getRun(key.id);
+            const receipt = run && receiptOf(run);
+            if (receipt !== undefined && wanted.has(receipt) && !found.has(receipt))
+                found.set(receipt, key.id);
+        }
+        return found;
+    }
+    /** The id of every root whose delegation carries a conversation, held or stored: recovery's
+     *  full reconcile pass (#661). The stored summary names the role, so only roots' records are
+     *  read, in SQLite. */
+    listConversationRootIds() {
+        const where = "json_extract(summary, '$.delegation.role') = 'root' AND json_extract(data, '$.delegation.conversation') IS NOT NULL";
+        const ids = new Set((this.db?.listKeysWhere(where) ?? []).map((key) => key.id));
+        for (const id of this.deleted)
+            ids.delete(id);
+        for (const [id, run] of this.held) {
+            if (run.delegation?.role === 'root' && run.delegation.conversation)
+                ids.add(id);
+            else
+                ids.delete(id);
+        }
+        return [...ids];
+    }
+    /** The id of every run, held or stored, without decoding any (orphan-worktree sweeps). */
+    listRunIds() {
+        const ids = new Set(this.db?.listIds() ?? []);
+        for (const id of this.deleted)
+            ids.delete(id);
+        for (const id of this.held.keys())
+            ids.add(id);
+        return [...ids];
+    }
+    /** The members of one parallel-variant group (spec 010), in no particular order. */
+    listGroupRuns(groupId) {
+        return this.queryRuns(this.db?.listByGroup(groupId) ?? [], (run) => run.groupId === groupId).map(([run]) => run);
+    }
+    /** Runs with a materialized worktree directory (`worktreePath`, not reclaimed), most recently
+     *  finished first, then newest first: worktree retention and the worktrees panel. */
+    listRunsWithWorktree() {
+        const runs = this.queryRuns(this.db?.listWithWorktree() ?? [], (run) => run.worktreePath !== undefined && run.worktreeReclaimedAt === undefined);
+        const recency = ([run]) => run.finishedAt ?? run.createdAt;
+        return runs.sort((a, b) => (recency(a) < recency(b) ? 1 : recency(a) > recency(b) ? -1 : newestFirst(a[1], b[1]))).map(([run]) => run);
+    }
+    /**
+     * Every run that owns a branch or names the PR it created, as the few fields branch cleanup and
+     * git-log attribution read (issue 08 §B3, §B5; a squash commit is attributed by its PR number):
+     * the stored summary plus the `branch` and `base_branch` columns, so a Git-tab request decodes
+     * no record. Held runs answer from memory.
+     */
+    listBranchOwners() {
+        const owners = new Map();
+        for (const row of this.db?.listBranchOwners("branch IS NOT NULL OR json_extract(summary, '$.pullRequestUrl') IS NOT NULL") ?? []) {
+            if (this.deleted.has(row.id) || this.held.has(row.id))
+                continue;
+            const summary = parseStoredSummary(row.summary);
+            owners.set(row.id, {
+                id: row.id, createdAt: row.createdAt, status: row.status, archived: row.archived,
+                ...(row.branch === null ? {} : { branch: row.branch }),
+                ...(row.baseBranch === null ? {} : { baseBranch: row.baseBranch }),
+                title: summary?.title ?? row.id,
+                ...(summary?.pullRequestUrl === undefined ? {} : { pullRequestUrl: summary.pullRequestUrl }),
+            });
+        }
+        for (const run of this.held.values()) {
+            const owner = branchOwnerOf(run);
+            if (owner)
+                owners.set(run.id, owner);
+        }
+        return [...owners.values()];
+    }
+    /** The rows a column query returned, as records, with memory laid over them: a held run
+     *  answers from memory (matching `matches` there, not on its maybe-older row). */
+    queryRuns(rows, matches) {
+        const runs = new Map();
+        for (const run of this.held.values())
+            if (matches(run))
+                runs.set(run.id, [run, this.listOrder(run)]);
+        for (const row of rows) {
+            if (runs.has(row.id) || this.held.has(row.id) || this.deleted.has(row.id))
+                continue;
+            const run = this.fromRow(row);
+            if (run && matches(run))
+                runs.set(row.id, [run, row]);
+        }
+        return [...runs.values()];
+    }
     /** The run an idempotent start already created (#504), archived or not. A deleted run is gone
      *  with its record, so a retry after deletion honestly creates a fresh one. */
     findRunByClientRequestId(clientRequestId) {
-        for (const run of this.runs.values())
+        for (const run of this.held.values())
             if (run.clientRequestId === clientRequestId)
                 return run;
-        return undefined;
+        const row = this.db?.findByClientRequestId(clientRequestId);
+        if (!row || this.held.has(row.id))
+            return undefined;
+        const run = this.getRun(row.id);
+        return run?.clientRequestId === clientRequestId ? run : undefined;
     }
     createRun(input) {
+        if (this.openFailure)
+            throw this.openFailure;
         const run = this.buildRun(input, randomUUID());
-        this.runs.set(run.id, run);
+        // A new family, so nobody else can hold it; claimed before anything (an NDJSON event) is written.
+        if (this.db && !this.claimFamilies([run.id]).has(run.id))
+            throw new RunWriteRefusedError(run.id, 'foreign');
+        this.held.set(run.id, run);
         this.pruneOldRuns();
         this.touch(run);
         return run;
@@ -875,29 +2165,27 @@ export class RunStore extends EventEmitter {
     }
     /** Accept the family ledger and its recipient queue in a single durable index replacement. */
     commitConversation(rootId, conversation, delivery) {
-        const root = this.runs.get(rootId);
+        const root = this.peek(rootId);
         if (root?.delegation?.role !== 'root')
             throw new Error('missing conversation root');
-        const proposed = new Map(this.runs);
-        proposed.set(rootId, { ...root, delegation: delegationStateSchema.parse({ ...root.delegation, conversation: { ...conversation,
+        const staged = new Map();
+        staged.set(rootId, { ...root, delegation: delegationStateSchema.parse({ ...root.delegation, conversation: { ...conversation,
                     messages: conversation.messages.map(message => ({ ...message, text: this.redactText(message.text) })),
                 } }) });
-        const changed = new Set([rootId]);
         if (delivery) {
-            const recipient = proposed.get(delivery.recipientRunId);
+            const recipient = staged.get(delivery.recipientRunId) ?? this.peek(delivery.recipientRunId);
             if (!recipient)
                 throw new Error('missing conversation recipient');
             const input = agentInputSchema.parse({ ...delivery.input, text: this.redactText(delivery.input.text) });
-            proposed.set(recipient.id, { ...recipient, agentInputs: [...(recipient.agentInputs ?? []), input] });
-            changed.add(recipient.id);
+            staged.set(recipient.id, { ...recipient, agentInputs: [...(recipient.agentInputs ?? []), input] });
         }
-        this.commitIndex(proposed, changed);
+        this.commitIndex(staged);
     }
     /** Observable atomic input checkpoint: a failed write publishes nothing. */
     /** Accepted input the harness will never read returns to the queue (#505): only its
      * delivery and consumption receipts are cleared; order and identity are kept. */
     requeueUnconsumedAgentInputs(id, ids) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         if (!run?.agentInputs || !ids.length)
             return;
         this.commitAgentInputs(id, run.agentInputs.map(input => {
@@ -909,7 +2197,7 @@ export class RunStore extends EventEmitter {
     }
     /** Model consumption observed by the current session (#505). Never un-sets deliveredAt. */
     commitAgentInputsConsumed(id, ids, at) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         if (!run?.agentInputs || !ids.length)
             return;
         this.commitAgentInputs(id, run.agentInputs.map(input => {
@@ -921,7 +2209,7 @@ export class RunStore extends EventEmitter {
     }
     /** Delivered, but the harness never confirmed reading it (#505): stop awaiting a read. */
     commitAgentInputsUnconfirmed(id, ids) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         if (!run?.agentInputs || !ids.length)
             return;
         this.commitAgentInputs(id, run.agentInputs.map(input => {
@@ -934,12 +2222,12 @@ export class RunStore extends EventEmitter {
     /** Crash recovery (#505): input a harness accepted but was never seen reading goes
      * back to the queue. Returns the requeued IDs. */
     requeueAwaitingReadInputs(id) {
-        const ids = (this.runs.get(id)?.agentInputs ?? []).filter(input => input.awaitingRead && input.deliveredAt && !input.consumedAt).map(input => input.id);
+        const ids = (this.peek(id)?.agentInputs ?? []).filter(input => input.awaitingRead && input.deliveredAt && !input.consumedAt).map(input => input.id);
         this.requeueUnconsumedAgentInputs(id, ids);
         return ids;
     }
     commitAgentInputs(id, inputs, openingContinuationInputId) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         if (!run)
             throw new Error('missing agent input target');
         const agentInputs = inputs.map(input => agentInputSchema.parse(input));
@@ -956,13 +2244,11 @@ export class RunStore extends EventEmitter {
         if (openingContinuationInputId && (run.continuationMessage?.agentInputId !== openingContinuationInputId ||
             !agentInputs.some(input => input.id === openingContinuationInputId && input.deliveredAt)))
             throw new Error('opening agent input checkpoint changed');
-        const proposed = new Map(this.runs);
-        proposed.set(id, { ...run, agentInputs, ...(openingContinuationInputId ? { continuationMessage: undefined } : {}) });
-        this.commitIndex(proposed, new Set([id]));
+        this.commitIndex(new Map([[id, { ...run, agentInputs, ...(openingContinuationInputId ? { continuationMessage: undefined } : {}) }]]));
     }
     /** Reserve only unread conversation inputs in one durable index replacement. */
     claimInboxInputs(runId, ids, claim) {
-        const run = this.runs.get(runId);
+        const run = this.peek(runId);
         if (!run)
             throw new Error('missing inbox recipient');
         const selected = z.array(z.uuid()).min(1).max(32).refine(values => new Set(values).size === values.length).parse(ids);
@@ -980,14 +2266,12 @@ export class RunStore extends EventEmitter {
             }
         }
         const selectedIds = new Set(selected);
-        const proposed = new Map(this.runs);
-        proposed.set(runId, { ...run, agentInputs: inputs.map(input => selectedIds.has(input.id)
-                ? agentInputSchema.parse({ ...input, inboxClaim: receipt }) : input) });
-        this.commitIndex(proposed, new Set([runId]));
+        this.commitIndex(new Map([[runId, { ...run, agentInputs: inputs.map(input => selectedIds.has(input.id)
+                        ? agentInputSchema.parse({ ...input, inboxClaim: receipt }) : input) }]]));
     }
     /** A receipt owns every matching input or none; exact ACK retries preserve the first timestamp. */
     ackInboxInputs(runId, receiptId, generation, at) {
-        const run = this.runs.get(runId);
+        const run = this.peek(runId);
         if (!run)
             throw new Error('missing inbox recipient');
         inboxClaimSchema.shape.receiptId.parse(receiptId);
@@ -1008,14 +2292,12 @@ export class RunStore extends EventEmitter {
         if (matching.some(input => input.deliveredAt || input.inboxClaim?.acknowledgedAt || input.inboxClaim.expiresAt <= at)) {
             throw new Error('inbox receipt expired or displaced');
         }
-        const proposed = new Map(this.runs);
-        proposed.set(runId, { ...run, agentInputs: run.agentInputs.map(input => input.inboxClaim?.receiptId === receiptId
-                ? agentInputSchema.parse({ ...input, deliveredAt: at, inboxClaim: { ...input.inboxClaim, acknowledgedAt: at } }) : input) });
-        this.commitIndex(proposed, new Set([runId]));
+        this.commitIndex(new Map([[runId, { ...run, agentInputs: run.agentInputs.map(input => input.inboxClaim?.receiptId === receiptId
+                        ? agentInputSchema.parse({ ...input, deliveredAt: at, inboxClaim: { ...input.inboxClaim, acknowledgedAt: at } }) : input) }]]));
         return 'acknowledged';
     }
     releaseInboxInputs(runId, receiptId, generation) {
-        const run = this.runs.get(runId);
+        const run = this.peek(runId);
         if (!run)
             throw new Error('missing inbox recipient');
         inboxClaimSchema.shape.receiptId.parse(receiptId);
@@ -1024,108 +2306,93 @@ export class RunStore extends EventEmitter {
         if (!matching.length || matching.some(input => input.inboxClaim?.generation !== generation ||
             input.inboxClaim?.acknowledgedAt || input.deliveredAt))
             throw new Error('inbox receipt changed');
-        const proposed = new Map(this.runs);
-        proposed.set(runId, { ...run, agentInputs: run.agentInputs.map(input => {
-                if (input.inboxClaim?.receiptId !== receiptId)
-                    return input;
-                const { inboxClaim: _claim, ...unclaimed } = input;
-                return agentInputSchema.parse(unclaimed);
-            }) });
-        this.commitIndex(proposed, new Set([runId]));
+        this.commitIndex(new Map([[runId, { ...run, agentInputs: run.agentInputs.map(input => {
+                        if (input.inboxClaim?.receiptId !== receiptId)
+                            return input;
+                        const { inboxClaim: _claim, ...unclaimed } = input;
+                        return agentInputSchema.parse(unclaimed);
+                    }) }]]));
         return 'released';
     }
     clearExpiredInboxClaims(runId, now) {
-        const run = this.runs.get(runId);
+        const run = this.peek(runId);
         if (!run)
             throw new Error('missing inbox recipient');
         inboxClaimSchema.shape.expiresAt.parse(now);
         if (!run.agentInputs?.some(input => input.inboxClaim && !input.inboxClaim.acknowledgedAt && input.inboxClaim.expiresAt <= now))
             return;
-        const proposed = new Map(this.runs);
-        proposed.set(runId, { ...run, agentInputs: run.agentInputs.map(input => {
-                if (!input.inboxClaim || input.inboxClaim.acknowledgedAt || input.inboxClaim.expiresAt > now)
-                    return input;
-                const { inboxClaim: _claim, ...unclaimed } = input;
-                return agentInputSchema.parse(unclaimed);
-            }) });
-        this.commitIndex(proposed, new Set([runId]));
+        this.commitIndex(new Map([[runId, { ...run, agentInputs: run.agentInputs.map(input => {
+                        if (!input.inboxClaim || input.inboxClaim.acknowledgedAt || input.inboxClaim.expiresAt > now)
+                            return input;
+                        const { inboxClaim: _claim, ...unclaimed } = input;
+                        return agentInputSchema.parse(unclaimed);
+                    }) }]]));
     }
     /** CI intent and its wake entry share one atomic index replacement. */
     commitCiWait(id, wait, input) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         if (!run)
             throw new Error('missing CI wait target');
         const ciWait = ciWaitSchema.parse(wait);
         const entry = input ? agentInputSchema.parse(input) : undefined;
-        const proposed = new Map(this.runs);
-        proposed.set(id, { ...run, ciWait, lastCiWaitError: undefined, ...(entry ? { agentInputs: run.agentInputs?.some(row => row.id === entry.id)
-                    ? run.agentInputs : [...(run.agentInputs ?? []), entry] } : {}) });
-        this.commitIndex(proposed, new Set([id]));
+        this.commitIndex(new Map([[id, { ...run, ciWait, lastCiWaitError: undefined, ...(entry ? { agentInputs: run.agentInputs?.some(row => row.id === entry.id)
+                            ? run.agentInputs : [...(run.agentInputs ?? []), entry] } : {}) }]]));
     }
     /** Retire the wait and precisely its pending wake, optionally accepting human input. */
     commitCiWaitWithdrawal(id, acceptedHumanMessage) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         if (!run?.ciWait)
             return;
         const { ciWait, ...rest } = run;
         const lastCiWait = { ...ciWait, phase: 'withdrawn' };
-        const proposed = new Map(this.runs);
-        proposed.set(id, { ...rest, ciWait: undefined, lastCiWait,
-            ...(run.agentInputs ? { agentInputs: run.agentInputs.filter(input => input.id !== ciWait.wakeId || input.deliveredAt) } : {}),
-            ...(acceptedHumanMessage ? { queuedMessages: [...(run.queuedMessages ?? []), queuedMessageSchema.parse(acceptedHumanMessage)] } : {}),
-        });
-        this.commitIndex(proposed, new Set([id]));
+        this.commitIndex(new Map([[id, { ...rest, ciWait: undefined, lastCiWait,
+                    ...(run.agentInputs ? { agentInputs: run.agentInputs.filter(input => input.id !== ciWait.wakeId || input.deliveredAt) } : {}),
+                    ...(acceptedHumanMessage ? { queuedMessages: [...(run.queuedMessages ?? []), queuedMessageSchema.parse(acceptedHumanMessage)] } : {}),
+                }]]));
     }
     /** Provider acceptance and receipt retirement have one delivery checkpoint. */
     commitCiWaitDelivery(id, inputId) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         if (!run?.ciWait || run.ciWait.wakeId !== inputId)
             return;
         const { ciWait, ...rest } = run;
         const deliveredAt = new Date().toISOString();
-        const proposed = new Map(this.runs);
-        proposed.set(id, { ...rest, ciWait: undefined, lastCiWait: { ...ciWait, phase: 'delivered', deliveredAt },
-            agentInputs: (run.agentInputs ?? []).map(input => input.id === inputId ? { ...input, deliveredAt } : input),
-        });
-        this.commitIndex(proposed, new Set([id]));
+        this.commitIndex(new Map([[id, { ...rest, ciWait: undefined, lastCiWait: { ...ciWait, phase: 'delivered', deliveredAt },
+                    agentInputs: (run.agentInputs ?? []).map(input => input.id === inputId ? { ...input, deliveredAt } : input), }]]));
     }
     /** Retain the settled receipt and retire exactly one wait together with any human message that superseded it. */
     commitWorkerWaitWithdrawal(id, waitId, acceptedHumanMessage) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         if (!run?.delegation || run.delegation.role === 'invalid' || run.delegation.wait?.id !== waitId) {
             throw new Error('worker wait changed before withdrawal');
         }
         const { wait, ...delegation } = run.delegation;
         const message = acceptedHumanMessage ? queuedMessageSchema.parse(acceptedHumanMessage) : undefined;
-        const proposed = new Map(this.runs);
-        proposed.set(id, { ...run, delegation: { ...delegation, lastWait: wait.phase === 'wake-pending'
-                    ? reconcileWorkerWait(wait, [], new Date().toISOString())
-                    : { ...wait, phase: 'wake-pending', reason: wait.reason ?? 'cancelled', wakeId: wait.wakeId ?? wait.id } },
-            // An adopted agent input belongs to its sender, even when it carries the wait receipt.
-            ...(run.agentInputs ? { agentInputs: run.agentInputs.filter(input => input.id !== wait.wakeId || input.deliveredAt || input.source === 'agent') } : {}),
-            ...(message ? {
-                queuedMessages: [...(run.queuedMessages ?? []), message],
-                ...(run.continuationMessage ? { continuationMessage: {
-                        ...run.continuationMessage, origin: 'human',
-                        text: run.continuationMessage.origin === 'lifecycle' ? '' : run.continuationMessage.text,
-                    } } : {}),
-            } : {}),
-        });
-        this.commitIndex(proposed, new Set([id]));
+        this.commitIndex(new Map([[id, { ...run, delegation: { ...delegation, lastWait: wait.phase === 'wake-pending'
+                            ? reconcileWorkerWait(wait, [], new Date().toISOString())
+                            : { ...wait, phase: 'wake-pending', reason: wait.reason ?? 'cancelled', wakeId: wait.wakeId ?? wait.id } },
+                    // An adopted agent input belongs to its sender, even when it carries the wait receipt.
+                    ...(run.agentInputs ? { agentInputs: run.agentInputs.filter(input => input.id !== wait.wakeId || input.deliveredAt || input.source === 'agent') } : {}),
+                    ...(message ? {
+                        queuedMessages: [...(run.queuedMessages ?? []), message],
+                        ...(run.continuationMessage ? { continuationMessage: {
+                                ...run.continuationMessage, origin: 'human',
+                                text: run.continuationMessage.origin === 'lifecycle' ? '' : run.continuationMessage.text,
+                            } } : {}),
+                    } : {}),
+                }]]));
     }
     /** Successful deferred human delivery consumes only its persisted queue ID.
      * A crash before this checkpoint may replay that same message on recovery. */
     commitQueuedMessageDelivery(id, messageId) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         if (!run)
             throw new Error('missing queued message target');
-        const proposed = new Map(this.runs);
-        proposed.set(id, { ...run, queuedMessages: (run.queuedMessages ?? []).filter(message => message.id !== messageId) });
-        this.commitIndex(proposed, new Set([id]));
+        this.commitIndex(new Map([[id, { ...run, queuedMessages: (run.queuedMessages ?? []).filter(message => message.id !== messageId) }]]));
     }
     /** An acknowledged inactive-root Finish must survive the async diff and restart. */
     commitRootFinishIntent(id) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         if (run?.status !== 'waiting' || run.delegation?.role !== 'root')
             throw new Error('root is not waiting');
         if (run.delegation.finishRequestedAt)
@@ -1135,77 +2402,87 @@ export class RunStore extends EventEmitter {
     /** Cancellation supersedes pending Finish in one durable checkpoint. Also
      * repairs cancelled-plus-intent snapshots left by older controllers. */
     commitRootFinishCancellation(id) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         if (run?.delegation?.role !== 'root' || !run.delegation.finishRequestedAt ||
             !['waiting', 'cancelled'].includes(run.status))
             return false;
         const { finishRequestedAt: _intent, ...delegation } = run.delegation;
-        const proposed = new Map(this.runs);
-        proposed.set(id, { ...run, delegation, status: 'cancelled', finishedAt: run.finishedAt ?? new Date().toISOString() });
-        this.commitIndex(proposed, new Set([id]));
+        this.commitIndex(new Map([[id, { ...run, delegation, status: 'cancelled', finishedAt: run.finishedAt ?? new Date().toISOString() }]]));
         return true;
     }
     /** Publish terminal success and completed steps only after their atomic checkpoint.
      * A concurrent explicit cancellation is never overwritten by the async diff. */
     commitRootFinishSuccess(id, status) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         if (run?.status !== 'waiting' || run.delegation?.role !== 'root' || !run.delegation.finishRequestedAt)
             return false;
         const { finishRequestedAt: _intent, ...delegation } = run.delegation;
         const finishedAt = new Date().toISOString();
-        const proposed = new Map(this.runs);
-        proposed.set(id, { ...run, delegation, status, finishedAt, currentStepId: undefined, autoResumeAttempts: undefined,
-            activity: undefined, monitoringWakeAt: undefined, monitoringWakeCapReached: undefined,
-            steps: run.steps.map(step => step.status === 'waiting' || step.status === 'running'
-                ? { ...step, status: 'done', finishedAt } : step),
-        });
-        this.commitIndex(proposed, new Set([id]));
+        this.commitIndex(new Map([[id, { ...run, delegation, status, finishedAt, currentStepId: undefined, autoResumeAttempts: undefined,
+                    activity: undefined, monitoringWakeAt: undefined, monitoringWakeCapReached: undefined,
+                    steps: run.steps.map(step => step.status === 'waiting' || step.status === 'running'
+                        ? { ...step, status: 'done', finishedAt: step.finishedAt ?? finishedAt } : step),
+                }]]));
         return true;
     }
     /** Persist all authority patches before exposing any of them to the engine or subscribers. */
     commitDelegation(patches) {
         if (patches.length === 0)
             return;
-        const proposed = new Map(this.runs);
-        const changed = new Set();
+        const staged = new Map();
+        let destroyProgress = true;
         for (const patch of patches) {
-            const run = proposed.get(patch.id);
-            if (!run || changed.has(patch.id))
+            const run = this.peek(patch.id);
+            if (!run || staged.has(patch.id))
                 throw new Error('missing or duplicate delegation patch target');
             const delegation = delegationStateSchema.parse(patch.delegation);
-            proposed.set(patch.id, { ...run, delegation });
-            changed.add(patch.id);
+            if (!isDestroyProgress(run.delegation, delegation))
+                destroyProgress = false;
+            staged.set(patch.id, { ...run, delegation });
         }
         // In-process cause only: consumers can skip metadata replay when delegation
         // is disabled without dropping real status or termination-proof notifications.
-        this.commitIndex(proposed, changed, 'delegation-checkpoint');
+        this.commitIndex(staged, destroyProgress ? 'delegation-destroy-progress' : 'delegation-checkpoint');
+    }
+    /** A pending destroy's automatic retry state, or its removal (hearsay-tools/cezarion#879). Kept on
+     * the record beside the strict delegation, so an older cezar strips it rather than quarantining the
+     * worker. Destroy progress: nothing the family reconcile reads changes. */
+    commitDestroyRetry(id, retry) {
+        const run = this.peek(id);
+        if (run?.delegation?.role !== 'worker' || !run.delegation.destroy)
+            throw new Error('missing pending destroy');
+        if (!retry && !run.destroyRetry)
+            return;
+        // An explicit `undefined`, not an omitted key: commitIndex assigns onto the live record.
+        this.commitIndex(new Map([[id, { ...run, destroyRetry: retry ? workerDestroyRetrySchema.parse(retry) : undefined }]]), 'delegation-destroy-progress');
     }
     /** Accepted execution revision is public lifecycle identity, separate from process generations. */
     commitWorkerContinuation(id, patch, step, conversation) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         if (run?.delegation?.role !== 'worker')
             throw new Error('missing worker continuation target');
         const delegation = delegationStateSchema.parse({ ...run.delegation,
             executionRevision: (run.delegation.executionRevision ?? 0) + 1,
-            executionStartSeq: this.readEvents(id).reduce((seq, event) => Math.max(seq, event.seq), 0),
+            executionStartSeq: this.transcriptFacts(id).lastSeq,
         });
-        const proposed = new Map(this.runs);
-        proposed.set(id, { ...run, ...this.redactPatch(patch), delegation,
+        const staged = new Map();
+        const next = { ...run, ...this.redactPatch(patch), delegation,
             ...(step ? { steps: [...run.steps, { ...step, status: 'pending', iterations: 0, tokensUsed: 0 }] } : {}),
-        });
-        const changed = new Set([id]);
+        };
+        staged.set(id, next);
+        if (Object.prototype.hasOwnProperty.call(patch, 'archived'))
+            this.syncTranscriptForm(id, next.archived);
         if (conversation) {
-            const root = this.runs.get(conversation.rootId);
+            const root = this.peek(conversation.rootId);
             if (root?.delegation?.role !== 'root' || run.delegation.parentRunId !== root.id)
                 throw new Error('missing conversation ownership');
-            proposed.set(root.id, { ...root, delegation: delegationStateSchema.parse({ ...root.delegation, conversation: { ...conversation.state,
+            staged.set(root.id, { ...root, delegation: delegationStateSchema.parse({ ...root.delegation, conversation: { ...conversation.state,
                         messages: conversation.state.messages.map(message => ({ ...message, text: this.redactText(message.text) })),
                     } }) });
             const input = agentInputSchema.parse({ ...conversation.input, text: this.redactText(conversation.input.text) });
-            proposed.set(id, { ...proposed.get(id), agentInputs: [...(run.agentInputs ?? []), input] });
-            changed.add(root.id);
+            staged.set(id, { ...staged.get(id), agentInputs: [...(run.agentInputs ?? []), input] });
         }
-        this.commitIndex(proposed, changed);
+        this.commitIndex(staged);
     }
     workerResultsDir(parentId) {
         z.uuid().parse(parentId);
@@ -1219,7 +2496,7 @@ export class RunStore extends EventEmitter {
         return join(this.dataDir, 'runs', `${z.uuid().parse(parentId)}-worker-results`, `${z.uuid().parse(workerId)}.${z.uuid().parse(snapshotId)}.json`);
     }
     readWorkerResultFile(parentId, workerId) {
-        const parent = this.runs.get(parentId);
+        const parent = this.peek(parentId);
         if (parent?.delegation?.role !== 'root' || !parent.delegation.receipts.some(receipt => receipt.workerId === workerId))
             return undefined;
         const reference = parent.delegation.results?.find(result => result.workerId === workerId);
@@ -1256,11 +2533,13 @@ export class RunStore extends EventEmitter {
     readWorkerResultDiff(parentId, workerId) {
         return this.readWorkerResultFile(parentId, workerId)?.diffSnapshot;
     }
-    /** Publish a pointer only after its redacted immutable snapshot reaches disk. Failed index writes retain the old evidence. */
-    commitWorkerResult(parentId, value, diffSnapshot) {
+    /** Publish a pointer only after its redacted immutable snapshot reaches disk. Failed index writes retain the old evidence.
+     * A result whose evidence is already stored returns the stored one and writes nothing; `ignoreCleanup` is for a
+     * caller that only needs the payload durable, whatever cleanup phase the stored copy names. */
+    commitWorkerResult(parentId, value, diffSnapshot, opts = {}) {
         const result = workerCollectedResultSchema.parse(this.redact({ type: 'worker-result', seq: 0, ts: value.observedAt, result: value }).result);
-        const parent = this.runs.get(parentId);
-        const worker = this.runs.get(result.workerId);
+        const parent = this.peek(parentId);
+        const worker = this.peek(result.workerId);
         if (parent?.delegation?.role !== 'root' || result.parentRunId !== parentId ||
             !parent.delegation.receipts.some(receipt => receipt.workerId === result.workerId))
             throw new Error('missing result ownership');
@@ -1268,6 +2547,10 @@ export class RunStore extends EventEmitter {
             worker.delegation.workspace.ownerRunId !== worker.id || (worker.delegation.executionRevision ?? 0) !== result.revision || worker.status !== result.status))
             throw new Error('worker result revision changed');
         const old = parent.delegation.results?.find(entry => entry.workerId === result.workerId);
+        const stored = old && this.readWorkerResultFile(parentId, result.workerId);
+        if (stored && sameWorkerResult(stored.result, result, opts) &&
+            stored.diffSnapshot === (diffSnapshot === undefined ? undefined : this.redactText(diffSnapshot)))
+            return stored.result;
         if ((!worker && !this.readWorkerResult(parentId, result.workerId)) || (old && (old.revision > result.revision || (old.revision === result.revision && old.observedAt > result.observedAt))))
             throw new Error('worker result is obsolete');
         const snapshotId = result.diff.state === 'available' ? result.diff.snapshotId : randomUUID();
@@ -1321,7 +2604,7 @@ export class RunStore extends EventEmitter {
      * workspace.ownerRunId is the trusted service's preallocated worker UUID.
      */
     createOwnedRun(input, parentId, requestId, worker, requestHash, executionIdentity = { kind: 'internal' }) {
-        const parent = this.runs.get(parentId);
+        const parent = this.peek(parentId);
         const authority = delegationStateSchema.safeParse(parent?.delegation);
         if (!parent || !authority.success || authority.data.role !== 'root' || authority.data.historyDeletion) {
             throw new Error('invalid delegation parent');
@@ -1333,7 +2616,7 @@ export class RunStore extends EventEmitter {
         if (receipt) {
             if (receipt.requestHash !== identity.requestHash)
                 throw new Error('request ID payload conflict');
-            const existing = this.runs.get(receipt.workerId);
+            const existing = this.peek(receipt.workerId);
             const metadata = delegationStateSchema.safeParse(existing?.delegation);
             if (!existing || !metadata.success || metadata.data.role !== 'worker' ||
                 metadata.data.parentRunId !== parentId || metadata.data.workspace.ownerRunId !== existing.id ||
@@ -1341,67 +2624,130 @@ export class RunStore extends EventEmitter {
                 throw new Error('invalid request receipt ownership');
             return existing;
         }
+        // #816: the same check the spawn policy makes, inside the receipt transaction, so no path
+        // writes a receipt past either limit.
+        const refusal = capacityError(workerCapacity(parent, id => this.peek(id)));
+        if (refusal)
+            throw new Error(refusal);
         const metadata = delegationStateSchema.parse(worker);
         if (metadata.role !== 'worker' || metadata.parentRunId !== parentId ||
             metadata.workspace.ownerRunId === parentId || input.worktree === false) {
             throw new Error('invalid worker ownership');
         }
         const workspace = metadata.workspace;
-        if (this.runs.has(workspace.ownerRunId))
+        if (this.hasRun(workspace.ownerRunId))
             throw new Error('worker run ID collision');
-        for (const run of this.runs.values()) {
+        for (const run of this.held.values()) {
             const owned = run.delegation?.role === 'worker' ? run.delegation.workspace : undefined;
             if ((owned && (owned.resourceId === workspace.resourceId || owned.path === workspace.path ||
                 owned.branch === workspace.branch)) || run.worktreePath === workspace.path || run.branch === workspace.branch) {
                 throw new Error('worker resource ownership collision');
             }
         }
+        // Runs not in memory answer through the branch and worktree columns. A worker's planned
+        // branch is its `branch` column; its path and resource id derive from its own run id, which
+        // the id check above already proved unused.
+        if ((this.db?.findResourceHolders({ branch: workspace.branch, worktreePath: workspace.path }) ?? [])
+            .some((id) => !this.held.has(id) && !this.deleted.has(id)))
+            throw new Error('worker resource ownership collision');
         const delegation = delegationStateSchema.parse({
             ...authority.data,
             receipts: [...authority.data.receipts, { ...identity, workerId: workspace.ownerRunId }],
         });
         const run = { ...this.buildRun(input, workspace.ownerRunId), delegation: metadata };
-        const proposed = new Map(this.runs);
-        proposed.set(parentId, { ...parent, delegation });
-        proposed.set(run.id, run);
         // This transaction precedes materialization. Every launch must rotate this
         // generation to starting before touching the workspace or a session.
         this.writeWorkerIdentity(run.id, workerExecutionIdentitySchema.parse(executionIdentity));
         this.writeWorkerExecution(run.id, { generation: randomUUID(), phase: 'queued' }, true);
         // No pruning here: deleting run history cannot be part of a proposed index transaction.
-        this.commitIndex(proposed, new Set([parentId, run.id]));
+        this.commitIndex(new Map([[parentId, { ...parent, delegation }], [run.id, run]]));
         return run;
     }
-    /** Atomic file replacement is the durability boundary; flush() is deliberately best-effort. */
-    commitIndex(proposed, changed, source) {
-        this.writeIndex([...proposed.values()].sort((a, b) => b.createdAt.localeCompare(a.createdAt)));
-        if (this.saveTimer) {
-            clearTimeout(this.saveTimer);
-            this.saveTimer = null;
-        }
+    /**
+     * The durable write: `staged` holds the records this operation replaces (`null` deletes one),
+     * in the order subscribers hear about them. The transaction is the durability boundary;
+     * flush() is deliberately best-effort.
+     *
+     * One transaction carries the staged rows and every row a debounced save still owes, so the
+     * database never holds a commit without the optimistic writes made before it. If it fails,
+     * nothing changed anywhere: the held records, the database, the pending dirty rows and the
+     * subscribers all see the store as it was.
+     */
+    commitIndex(staged, source) {
+        if (!this.db)
+            throw this.openFailure ?? new Error('runs database unavailable: nothing can be saved');
+        this.assertWritable(staged);
+        this.persist(staged);
         // Preserve existing record references, but expose the entire transaction before its first event.
-        for (const id of changed) {
-            const next = proposed.get(id);
+        // A finished run joins the held set for the commit and leaves at the next sweep.
+        for (const [id, next] of staged) {
             if (!next) {
-                this.runs.delete(id);
+                this.held.delete(id);
                 continue;
             }
-            const current = this.runs.get(id);
+            this.committing.add(id);
+            const current = this.held.get(id);
             if (current)
                 Object.assign(current, next);
             else
-                this.runs.set(id, next);
+                this.held.set(id, next);
         }
-        for (const id of changed) {
-            const run = this.runs.get(id);
-            if (run)
-                this.emit('run', run, source);
-            else
-                this.emit('deleted', id);
+        try {
+            for (const id of staged.keys()) {
+                const run = this.held.get(id);
+                if (run)
+                    this.emit('run', run, source);
+                else
+                    this.emit('deleted', id);
+            }
+        }
+        finally {
+            for (const id of staged.keys())
+                this.committing.delete(id);
+            this.sweepIfSettled(staged.keys());
+        }
+    }
+    /**
+     * Refuse (throwing, with nothing changed) a commit that stages a quarantined run, or a run whose
+     * family this store does not claim and cannot take: another process owns it, or a dead process
+     * left it live and it has not been adopted.
+     */
+    assertWritable(staged) {
+        const families = new Map();
+        const held = new Set();
+        for (const [id, next] of staged) {
+            if (this.quarantined.has(id))
+                throw new RunWriteRefusedError(id, 'quarantined');
+            const family = next ? familyKey(next) : this.familyOf(id);
+            families.set(id, family);
+            if (this.held.has(id))
+                held.add(family);
+        }
+        // A run this store holds may move to a new family; any other row is claimed as a plain write.
+        const owned = new Set([...this.claimFamilies(held, { allowLive: true }),
+            ...this.claimFamilies([...families.values()].filter((family) => !held.has(family)))]);
+        for (const [id, family] of families) {
+            if (!owned.has(family))
+                throw new RunWriteRefusedError(id, this.runOwnership(id) === 'orphaned' ? 'orphaned' : 'foreign');
+        }
+    }
+    /** The family of a run this store knows: held, else its row; a run nowhere is its own. */
+    familyOf(id) {
+        const held = this.held.get(id);
+        return held ? familyKey(held) : this.deletedFamilies.get(id) ?? this.db?.familyOf(id) ?? id;
+    }
+    /** Schedule the sweep that lets any of `ids` leave memory, when one of them now can. */
+    sweepIfSettled(ids) {
+        for (const id of ids) {
+            const run = this.held.get(id);
+            if (run && !this.isAnchor(id, run)) {
+                this.scheduleSave();
+                return;
+            }
         }
     }
     updateRun(id, patch) {
-        const run = this.runs.get(id);
+        const run = this.record(id);
         if (!run)
             return undefined;
         if (Object.prototype.hasOwnProperty.call(patch, 'issueNumber')) {
@@ -1420,10 +2766,23 @@ export class RunStore extends EventEmitter {
         if (normalized.status && ['running', 'waiting', 'queued'].includes(normalized.status)) {
             normalized.autoResumeAt = undefined;
         }
+        const archived = Object.prototype.hasOwnProperty.call(normalized, 'archived')
+            ? Boolean(normalized.archived)
+            : undefined;
+        if (archived !== undefined) {
+            delete normalized.archived;
+            delete normalized.archivedAt;
+        }
+        // Restore before mutating so a throw leaves status and archived unchanged (#818 S3).
+        if (archived === false)
+            restoreHistory(this.dataDir, id);
         Object.assign(run, this.redactPatch(normalized));
         if (normalized.task !== undefined)
             this.resolveEditedTaskRefs(run);
-        this.touch(run);
+        if (archived !== undefined)
+            this.applyArchived(run, archived);
+        else
+            this.touch(run);
         return run;
     }
     /** Prompt edits can both revoke and restore a reference. Resolve the retained working sets
@@ -1499,14 +2858,14 @@ export class RunStore extends EventEmitter {
     }
     /** Append a step to an existing run (used by "Continue" — spec 003). */
     addStep(runId, step) {
-        const run = this.runs.get(runId);
+        const run = this.record(runId);
         if (!run || run.steps.some((s) => s.id === step.id))
             return;
         run.steps.push({ ...step, status: 'pending', iterations: 0, tokensUsed: 0 });
         this.touch(run);
     }
     updateStep(runId, stepId, patch) {
-        const run = this.runs.get(runId);
+        const run = this.record(runId);
         const step = run?.steps.find((s) => s.id === stepId);
         if (!run || !step)
             return;
@@ -1535,7 +2894,7 @@ export class RunStore extends EventEmitter {
         this.touch(run);
     }
     setArchived(id, archived) {
-        const run = this.runs.get(id);
+        const run = this.record(id);
         if (!run)
             return undefined;
         this.applyArchivedCascade(run, archived);
@@ -1549,17 +2908,18 @@ export class RunStore extends EventEmitter {
         // Owned workers nest under their parent only while both share Active/Archived (#250).
         // Cascade from the parent only — archiving one worker stays independent.
         if (run.delegation?.role !== 'worker') {
-            for (const child of this.runs.values()) {
-                if (child.delegation?.role === 'worker' && child.delegation.parentRunId === run.id) {
-                    if (this.applyArchived(child, archived))
-                        changed++;
-                }
+            for (const { id } of this.listWorkersOf(run.id)) {
+                const child = this.record(id);
+                if (child && this.applyArchived(child, archived))
+                    changed++;
             }
         }
         return changed;
     }
     applyArchived(run, archived) {
         const changed = run.archived !== archived;
+        // Transcript first: a restore throw aborts with the record unchanged (#818 S3).
+        this.syncTranscriptForm(run.id, archived);
         run.archived = archived;
         run.archivedAt = archived ? new Date().toISOString() : undefined;
         if (archived) {
@@ -1569,6 +2929,74 @@ export class RunStore extends EventEmitter {
         this.touch(run);
         return changed;
     }
+    /** Transcript form follows `archived`: enqueue compression, or restore the plain file now. */
+    syncTranscriptForm(id, archived) {
+        if (archived)
+            this.compressor.enqueue(id);
+        else {
+            this.compressor.cancel(id);
+            restoreHistory(this.dataDir, id);
+        }
+    }
+    /**
+     * Whether this store may compress `id`'s transcript: the run exists, is archived, is not in a
+     * live status (queued/running/waiting), and this process holds the family's claim in `claimed`
+     * (not merely `pendingClaims`). Two processes never both write a run (#779, #818 B1).
+     */
+    isHistoryCompressEligible(id) {
+        if (this.deleted.has(id))
+            return false;
+        try {
+            const run = this.held.get(id) ?? this.peek(id);
+            if (!run || run.archived !== true || isLiveStatus(run.status))
+                return false;
+            return this.holdsCompressClaim(id);
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Take the family claim if free and require it to be in `this.claimed`, not only pending. */
+    holdsCompressClaim(id) {
+        const family = this.familyOf(id);
+        return this.claimFamilies([family]).has(family) && this.claimed.has(family);
+    }
+    /** Startup sweep: enqueue every archived non-live run that still has a plain transcript. */
+    compressArchivedHistory() {
+        try {
+            const ids = new Set();
+            for (const key of this.db?.listKeysWhere('archived = 1 AND live = 0') ?? []) {
+                if (!this.deleted.has(key.id))
+                    ids.add(key.id);
+            }
+            for (const run of this.held.values()) {
+                if (run.archived && !isLiveStatus(run.status) && !this.deleted.has(run.id))
+                    ids.add(run.id);
+            }
+            for (const id of ids) {
+                try {
+                    const { plain } = historyPaths(this.dataDir, id);
+                    // Claim only ids with work: a plain file to compress, including both-present leftovers.
+                    if (!existsSync(plain))
+                        continue;
+                    if (!this.holdsCompressClaim(id))
+                        continue;
+                    if (hasPlainHistory(this.dataDir, id))
+                        this.compressor.enqueue(id);
+                }
+                catch {
+                    // Best effort: one id must not stop the sweep or boot (#818 S2).
+                }
+            }
+        }
+        catch {
+            // listKeysWhere / open-time fs: never throw out of boot.
+        }
+    }
+    /** Resolves when the transcript compressor is idle (tests, shutdown). */
+    historyIdle() {
+        return this.compressor.idle();
+    }
     /** Pin one run to the top of this project's task list, or unpin it (#935). Mirrors
      *  `setArchived`: sets the fields, then persists + broadcasts via `touch`, so the updated
      *  record rides the existing `run` SSE with no new event. Idempotent — re-pinning a pinned
@@ -1577,7 +3005,7 @@ export class RunStore extends EventEmitter {
      *  Every active status is pinnable. Archived requests clear stale metadata instead, so a
      *  late click racing archive cannot leave a hidden pin that reappears on unarchive. */
     setPinned(id, pinned) {
-        const run = this.runs.get(id);
+        const run = this.record(id);
         if (!run)
             return undefined;
         if (pinned && !run.archived) {
@@ -1590,28 +3018,43 @@ export class RunStore extends EventEmitter {
         this.touch(run);
         return run;
     }
-    /** Bulk-archive every finished run; returns how many records flipped to archived. */
-    archiveFinished() {
-        let count = 0;
-        // Snapshot ids first: cascade may archive still-live workers, mutating the map view.
-        const finished = [...this.runs.values()]
-            .filter((run) => !run.archived && ['done', 'failed', 'cancelled'].includes(run.status))
-            .map((run) => run.id);
-        for (const id of finished) {
-            // Re-check: a prior cascade may already have archived this id as an owned worker.
-            const run = this.runs.get(id);
+    /** Bulk-archive finished runs (#780). `isSweepable` decides which; `archived` counts every
+     *  record that flipped (cascaded workers included), `ids` lists the top-level runs picked and
+     *  `pinnedIds` the subset that carried a pin before `clearPin` dropped it. */
+    archiveFinished(scope) {
+        let archived = 0;
+        // Snapshot first: cascade may archive still-live workers, mutating the held set, and the pin
+        // has to be read before `applyArchived` clears it. Runs not in memory are picked off their
+        // stored summary, which carries every field `isSweepable` reads.
+        const picked = [...this.held.values()].filter((run) => isSweepable(run, scope)).map((run) => [run, this.listOrder(run)]);
+        for (const row of this.db?.listWhere("archived = 0 AND status IN ('done', 'failed', 'cancelled') AND parent_run_id IS NULL") ?? []) {
+            if (this.held.has(row.id) || this.deleted.has(row.id))
+                continue;
+            const summary = parseStoredSummary(row.summary);
+            if (summary && isSweepable(summary, scope))
+                picked.push([summary, row]);
+        }
+        // Another process's runs are not this store's to archive (#779, plan step 3): they stay out.
+        // A sweepable run is never a worker (`isSweepable`), so each is its own family.
+        const writable = this.claimFamilies(picked.map(([run]) => run.id));
+        const mine = sortNewestFirst(picked.filter(([run]) => writable.has(run.id)));
+        const ids = mine.map((run) => run.id);
+        const pinnedIds = mine.filter((run) => run.pinned).map((run) => run.id);
+        for (const id of ids) {
+            // Re-check: a prior cascade may already have archived this id.
+            const run = this.record(id);
             if (!run || run.archived)
                 continue;
-            count += this.applyArchivedCascade(run, true);
+            archived += this.applyArchivedCascade(run, true);
         }
-        return count;
+        return { archived, ids, pinnedIds };
     }
     /** Mark one run as read (#unread-done-items): stamp the read receipt now. Mirrors
      *  `setArchived` — sets the field then persists + broadcasts via `touch`, so the
      *  updated record rides the existing `run` SSE with no new event. Idempotent by
      *  design: opening an already-read thread just re-stamps a later `seenAt`. */
     setRead(id) {
-        const run = this.runs.get(id);
+        const run = this.record(id);
         if (!run)
             return undefined;
         run.seenAt = new Date().toISOString();
@@ -1632,7 +3075,7 @@ export class RunStore extends EventEmitter {
      *  the marker. WHETHER the action means anything for a given run is UI policy, and lives
      *  in the cockpit's `runActionFlags` — the same split the rest of the store keeps. */
     setUnread(id) {
-        const run = this.runs.get(id);
+        const run = this.record(id);
         if (!run)
             return undefined;
         delete run.seenAt;
@@ -1666,7 +3109,18 @@ export class RunStore extends EventEmitter {
     markAllRead() {
         const now = new Date().toISOString();
         let count = 0;
-        for (const run of this.runs.values()) {
+        // Runs not in memory are picked by the same rule over their stored summary, then re-checked
+        // on the record before they are stamped.
+        const candidates = [...this.held.values()];
+        const stored = (this.db?.listWhere(MARK_ALL_READ_SQL) ?? []).filter((row) => !this.held.has(row.id) && !this.deleted.has(row.id));
+        // One claim transaction for them all; another process's runs are skipped (`record` refuses).
+        this.claimFamilies(stored.map(rowFamily));
+        for (const row of stored) {
+            const run = this.record(row.id);
+            if (run)
+                candidates.push(run);
+        }
+        for (const run of candidates) {
             const unread = !run.archived &&
                 (run.status === 'done' || run.status === 'failed') &&
                 !(run.status === 'failed' && run.autoResumeAt !== undefined) &&
@@ -1681,9 +3135,13 @@ export class RunStore extends EventEmitter {
         return count;
     }
     appendEvent(runId, event) {
-        const run = this.runs.get(runId);
-        if (!run)
+        const run = this.record(runId);
+        if (!run) {
+            const ownership = this.runOwnership(runId);
+            if (ownership === 'foreign' || ownership === 'orphaned' || ownership === 'quarantined')
+                throw new RunWriteRefusedError(runId, ownership);
             throw new Error(`unknown run: ${runId}`);
+        }
         const seq = this.nextSeq(runId);
         // Scrub credentials before the event touches disk or the live wire (#427):
         // tool-result output is persisted verbatim and served back over the API, so
@@ -1691,9 +3149,14 @@ export class RunStore extends EventEmitter {
         const full = this.redact({ ...event, seq, ts: new Date().toISOString() });
         // Sync append keeps event order without a write queue; local NDJSON
         // appends at agent-event rates are effectively free.
-        appendFileSync(this.eventsPath(runId), `${JSON.stringify(full)}\n`, 'utf8');
+        if (!hasPlainHistory(this.dataDir, runId))
+            restoreHistory(this.dataDir, runId);
+        const line = `${JSON.stringify(full)}\n`;
+        appendFileSync(this.eventsPath(runId), line, 'utf8');
+        this.facts.append(runId, full, Buffer.byteLength(line));
+        this.maybeEnqueueHistoryCompress(run);
         if ((full.type === 'ask.requested' || full.type === 'human-input-delivered') &&
-            refreshHumanAskSummary(run, this.dataDir))
+            this.syncHumanAskSummary(run))
             this.touch(run);
         this.emit('event', { runId, event: full });
         // The janitor trick: agents print the PR URL after `gh pr create` — the
@@ -1813,7 +3276,7 @@ export class RunStore extends EventEmitter {
      * re-declare after it opens a PR, and taking that literally cost the task the PR it was about.
      */
     applyMarkerRefs(runId, refs) {
-        const run = this.runs.get(runId);
+        const run = this.record(runId);
         if (!run || (refs.pr === undefined && refs.issue === undefined))
             return run;
         run.markerRefs = {
@@ -1882,21 +3345,58 @@ export class RunStore extends EventEmitter {
             this.secretValues = collectSecretValues();
         return this.secretValues;
     }
+    /** The run's indexed transcript facts (#880): a read-only view, never a transcript read once
+     *  the run's index is loaded. An unreadable transcript answers as empty, as readEvents does. */
+    transcriptFacts(runId) {
+        return this.facts.get(runId) ?? emptyFacts();
+    }
+    hasProjection(runId, projectionId) {
+        return this.transcriptFacts(runId).projectionIds.includes(projectionId);
+    }
+    factsWarming = Promise.resolve();
+    /** After open, build the indexes the delegation reconcile will ask for first, off the request
+     *  path: every member of every family with a conversation (#880). */
+    warmTranscriptFacts() {
+        // A microtask, not a timer: open returns first, and no timer outlives a store that never warms.
+        this.factsWarming = Promise.resolve().then(() => {
+            const ids = [];
+            for (const rootId of this.listConversationRootIds())
+                ids.push(rootId, ...(this.db?.listIdsByParent(rootId) ?? []));
+            return this.facts.warm(ids);
+        }).catch(() => undefined);
+    }
+    /** Resolves when the open-time warm-up is done (tests). */
+    factsWarmIdle() {
+        return this.factsWarming;
+    }
+    /** `readEvents` off the event loop (async read and async brotli), for collection paths. */
+    async readEventsAsync(runId) {
+        try {
+            const raw = await readHistoryTextAsync(this.dataDir, runId);
+            return raw === undefined ? [] : parseEvents(raw);
+        }
+        catch {
+            return [];
+        }
+    }
+    /** The owned store's `refreshHumanAskSummary`, from the index, on the same rules: no history
+     *  (legacy runs) keeps the summary, an unreadable one requests attention. True when it changed. */
+    syncHumanAskSummary(run) {
+        const facts = this.facts.get(run.id);
+        const next = !facts ? true
+            : facts.bytes > 0 || facts.archive !== undefined ? facts.pendingAsk !== undefined
+                : run.hasPendingHumanAsk === true;
+        if (next === run.hasPendingHumanAsk)
+            return false;
+        run.hasPendingHumanAsk = next;
+        return true;
+    }
     readEvents(runId) {
         try {
-            const raw = readFileSync(this.eventsPath(runId), 'utf8');
-            return raw
-                .split('\n')
-                .filter(Boolean)
-                .map((line) => {
-                try {
-                    return JSON.parse(line);
-                }
-                catch {
-                    return null;
-                }
-            })
-                .filter((e) => e !== null);
+            const raw = readHistoryText(this.dataDir, runId);
+            if (raw === undefined)
+                return [];
+            return parseEvents(raw);
         }
         catch {
             return [];
@@ -1950,13 +3450,11 @@ export class RunStore extends EventEmitter {
             const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
             try {
                 const info = fstatSync(fd);
-                if (!info.isFile() || info.size > 1024 || (info.mode & 0o077))
+                if (!info.isFile() || info.size > 16384 || (info.mode & 0o077))
                     return undefined;
-                const buffer = Buffer.alloc(1025);
+                const buffer = Buffer.alloc(16385);
                 const count = readSync(fd, buffer, 0, buffer.length, 0);
-                return z.object({ generation: z.string().uuid(), phase: z.enum(['queued', 'starting', 'complete']), neverMaterialized: z.literal(true).optional() }).strict()
-                    .refine(proof => !proof.neverMaterialized || proof.phase === 'complete')
-                    .parse(JSON.parse(buffer.subarray(0, count).toString('utf8')));
+                return workerExecutionSchema.parse(JSON.parse(buffer.subarray(0, count).toString('utf8')));
             }
             finally {
                 closeSync(fd);
@@ -1993,14 +3491,85 @@ export class RunStore extends EventEmitter {
             rmSync(temporary, { force: true });
         }
     }
+    /** Complete execution is not permission to reuse/delete persistent resources (#738).
+     * Synchronous, fresh and generation/resource fenced; callers hold admission off across awaits. */
+    workerResourcesSafe(id, generation, resourceId, admittingQueued = false) {
+        return this.workerResourceHolders(id, generation, resourceId, { admittingQueued }) === 'safe';
+    }
+    /** `workerResourcesSafe` with the refusal's live PIDs (empty when no PID explains it). */
+    workerResourceHolders(id, generation, resourceId, opts = {}) {
+        const run = this.peek(id);
+        const proof = this.readWorkerExecution(id);
+        if (run?.delegation?.role !== 'worker' || run.delegation.workspace.ownerRunId !== id ||
+            run.delegation.workspace.resourceId !== resourceId || proof?.generation !== generation ||
+            (proof.phase !== 'complete' && !(opts.admittingQueued && proof.phase === 'queued')))
+            return [];
+        const record = this.readWorkerProcesses(id, generation);
+        if (record === 'unknown' || !agentTmpDirOwnershipProven(this.dataDir, id))
+            return [];
+        const paths = [run.delegation.workspace.path, ...agentTmpDirLocations(this.dataDir, id)];
+        // Nothing can be deleted/reused at an absent path. This lets explicit history deletion
+        // retire completed cleanup despite ambient denial, while recorded survivors/unknown evidence
+        // still block. Only ENOENT proves absence; existsSync would also hide access errors.
+        const absent = paths.every(path => {
+            try {
+                lstatSync(path);
+                return false;
+            }
+            catch (error) {
+                return error.code === 'ENOENT';
+            }
+        });
+        if (absent)
+            return record === 'absent' ||
+                ((!recordedProcessLive(record.controller) || isCurrentProcess(record.controller)) && !record.processes.some(recordedProcessLive)) ? 'safe' : [];
+        const probe = inspectGeneration({ ...(record === 'absent' ? {} : { record }), paths, cwds: opts.cwds });
+        return probe.liveness === 'gone' ? 'safe' : probe.controller !== undefined ? [probe.controller] : probe.pids;
+    }
+    /** Upgrade a legacy completed checkpoint while terminal task ownership is still known.
+     * No holder scan here: settlement and scheduling must never wait on cleanup proof. */
+    retainWorkerScratchCleanup(id) {
+        const run = this.peek(id), proof = this.readWorkerExecution(id);
+        if (run?.delegation?.role !== 'worker' || ['queued', 'running', 'waiting'].includes(run.status) || proof?.phase !== 'complete')
+            return;
+        const { resourceId, path } = run.delegation.workspace;
+        if (proof.scratchCleanup?.resourceId === resourceId && proof.scratchCleanup.path === path)
+            return;
+        this.writeWorkerExecution(id, { ...proof, scratchCleanup: { resourceId, path } });
+    }
+    /** Cleanup can outlive its index row, but never its generation or terminal task intent.
+     * `cwds` is the scratch reprobe tick's shared `/proc` snapshot (hearsay-tools/cezarion#879). */
+    workerScratchResourcesSafe(id, generation, resourceId, cwds) {
+        const run = this.peek(id), proof = this.readWorkerExecution(id);
+        if (proof?.phase !== 'complete' || proof.generation !== generation || proof.scratchCleanup?.resourceId !== resourceId ||
+            (run && ['queued', 'running', 'waiting'].includes(run.status)))
+            return false;
+        if (run?.delegation?.role === 'worker')
+            return run.delegation.workspace.path === proof.scratchCleanup.path &&
+                this.workerResourceHolders(id, generation, resourceId, { cwds }) === 'safe';
+        // A valid different role contradicts the retained intent. Quarantined/missing metadata
+        // supplies no new authority; only the private terminal checkpoint authorizes scratch.
+        if (run && run.delegation?.role !== 'invalid')
+            return false;
+        const record = this.readWorkerProcesses(id, generation);
+        if (record === 'unknown' || !agentTmpDirOwnershipProven(this.dataDir, id))
+            return false;
+        return inspectGeneration({ ...(record === 'absent' ? {} : { record }),
+            paths: [proof.scratchCleanup.path, ...agentTmpDirLocations(this.dataDir, id)], cwds }).liveness === 'gone';
+    }
     commitWorkerExecutionStart(id) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         if (run?.delegation?.role !== 'worker' || run.delegation.destroy)
             throw new Error('Worker cannot start');
         const prior = this.readWorkerExecution(id);
+        if (prior?.abandoned)
+            throw new Error('Worker execution was abandoned; spawn a new worker instead of resuming it');
         if (!prior || (prior.phase !== 'queued' && prior.phase !== 'complete')) {
             throw new Error('Worker execution checkpoint does not prove safe admission');
         }
+        if (!this.workerResourcesSafe(id, prior.generation, run.delegation.workspace.resourceId, true)) {
+            throw new Error('Worker resources may still be held by a process; reuse is not proven safe');
+        }
         const generation = randomUUID();
         // #469: the controller is durable before `starting`, so a crash leaves a provable generation.
         this.writeWorkerProcesses(id, { generation, controller: { pid: process.pid, ...startToken(process.pid) }, processes: [] });
@@ -2062,11 +3631,11 @@ export class RunStore extends EventEmitter {
     }
     /** Bound to the current generation. Past the cap the record never drops an entry: the
      * working-directory scan is the remaining evidence. */
-    appendWorkerProcess(id, generation, pid) {
+    appendWorkerProcess(id, generation, pid, pgid) {
         const record = this.readWorkerProcesses(id, generation);
         if (typeof record === 'string' || this.readWorkerExecution(id)?.generation !== generation)
             return false;
-        const entry = { pid, ...startToken(pid) };
+        const entry = { pid, ...startToken(pid), ...(pgid === undefined ? {} : { pgid }) };
         if (record.processes.some(known => known.pid === entry.pid && known.startToken === entry.startToken))
             return true;
         if (record.processes.length >= WORKER_PROCESS_CAP)
@@ -2078,20 +3647,25 @@ export class RunStore extends EventEmitter {
         const proof = this.readWorkerExecution(id);
         if (!proof || proof.generation !== generation)
             return false;
-        if (proof.phase === 'queued' && this.runs.get(id)?.status !== 'cancelled')
+        if (proof.phase === 'queued' && this.peek(id)?.status !== 'cancelled')
             return false;
         try {
-            const run = this.runs.get(id);
+            const run = this.peek(id);
             if (run?.delegation?.role !== 'worker')
                 return false;
-            this.commitIndex(new Map(this.runs), new Set([id]));
+            this.commitIndex(new Map([[id, run]]));
             if (this.readWorkerExecution(id)?.generation !== generation)
                 return false;
             this.writeWorkerExecution(id, { generation, phase: 'complete',
-                ...(proof.phase === 'queued' || proof.neverMaterialized ? { neverMaterialized: true } : {}) });
+                // Nothing abandons an execution any more (hearsay-tools/cezarion#889); keep a checkpoint that already was.
+                ...(proof.abandoned ? { abandoned: true } : {}),
+                ...(proof.phase === 'queued' || proof.neverMaterialized ? { neverMaterialized: true } : {}),
+                ...(!['queued', 'running', 'waiting'].includes(run.status) ? { scratchCleanup: {
+                        resourceId: run.delegation.workspace.resourceId, path: run.delegation.workspace.path
+                    } } : {}) });
             // The earlier index event cannot attest exit: subscribers must observe the
             // durable private proof before a terminal worker can satisfy a lifecycle wait.
-            this.emit('run', this.runs.get(id));
+            this.emit('run', this.peek(id));
             return true;
         }
         catch {
@@ -2100,18 +3674,16 @@ export class RunStore extends EventEmitter {
     }
     /** Cancellation must hit disk before queued no-start evidence authorizes cleanup. */
     commitWorkerCancellation(id) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         if (run?.delegation?.role !== 'worker')
             throw new Error('Worker not found');
-        const proposed = new Map(this.runs);
-        proposed.set(id, { ...run, status: 'cancelled', finishedAt: new Date().toISOString() });
-        this.commitIndex(proposed, new Set([id]));
+        this.commitIndex(new Map([[id, { ...run, status: 'cancelled', finishedAt: new Date().toISOString() }]]));
     }
     /** Complete replacement evidence can stand in for absent child history, never for a present execution. */
     readDeletedWorkerResult(parentId, workerId) {
-        if (this.runs.has(workerId))
+        if (this.hasRun(workerId))
             return undefined;
-        const parent = this.runs.get(parentId);
+        const parent = this.peek(parentId);
         if (parent?.delegation?.role !== 'root' || parent.delegation.historyDeletion)
             return undefined;
         const deletion = parent.delegation.receipts.find(receipt => receipt.workerId === workerId)?.deletion;
@@ -2124,12 +3696,12 @@ export class RunStore extends EventEmitter {
     }
     /** A deleted child's receipt replaces the private proof only after the deletion checkpoint. */
     workerDeletionEvidence(id) {
-        const child = this.runs.get(id);
+        const child = this.peek(id);
         if (child?.delegation?.role !== 'worker' || child.delegation.workspace.ownerRunId !== id ||
             child.delegation.destroy?.phase !== 'complete' || child.delegation.destroy.remaining.length ||
             !['review', 'done', 'failed', 'cancelled'].includes(child.status))
             return false;
-        const parent = this.runs.get(child.delegation.parentRunId);
+        const parent = this.peek(child.delegation.parentRunId);
         if (parent?.delegation?.role !== 'root' || parent.delegation.historyDeletion)
             return false;
         const receipt = parent.delegation.receipts.find(entry => entry.workerId === id);
@@ -2141,6 +3713,12 @@ export class RunStore extends EventEmitter {
         if (JSON.stringify(workspace) !== JSON.stringify(child.delegation.workspace))
             return false;
         const proof = this.readWorkerExecution(id);
+        // Retain process evidence until scratch is safely removed. A prior pending deletion may
+        // already have removed those files; it never authorizes deleting newly appeared scratch.
+        if (proof && !this.workerResourcesSafe(id, proof.generation, workspace.resourceId))
+            return false;
+        if (!proof && agentTmpDirMayExist(this.dataDir, id))
+            return false;
         if (receipt.deletion)
             return receipt.deletion.revision === result.revision &&
                 receipt.deletion.resourceId === workspace.resourceId && receipt.deletion.phase === 'pending' &&
@@ -2148,19 +3726,22 @@ export class RunStore extends EventEmitter {
         return proof?.phase === 'complete';
     }
     canDeleteRun(id) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         if (run?.delegation?.role === 'invalid')
             return false;
         if (run?.delegation?.role === 'worker')
             return this.workerDeletionEvidence(id);
+        const privateWorkers = workerEvidenceRunIds(this.dataDir);
+        if (!privateWorkers || privateWorkers.includes(id))
+            return false;
         if (run?.delegation?.role === 'root') {
             if (run.delegation.finishRequestedAt && ['queued', 'running', 'waiting'].includes(run.status))
                 return false;
             // Keep the parent's receipt and result ownership until each child history is explicitly removed.
-            if ([...this.runs.values()].some(child => child.delegation?.role === 'worker' && child.delegation.parentRunId === id))
+            if (this.listWorkersOf(id).length > 0)
                 return false;
             return run.delegation.receipts.every(receipt => {
-                if (this.runs.has(receipt.workerId) || receipt.deletion?.phase !== 'complete')
+                if (this.hasRun(receipt.workerId) || receipt.deletion?.phase !== 'complete')
                     return false;
                 // A pending parent deletion already validated the results before removing their bytes.
                 if (run.delegation?.role === 'root' && run.delegation.historyDeletion === 'pending')
@@ -2168,14 +3749,14 @@ export class RunStore extends EventEmitter {
                 return this.readDeletedWorkerResult(id, receipt.workerId) !== undefined;
             });
         }
-        return ![...this.runs.values()].some(child => child.delegation?.role === 'worker' && child.delegation.parentRunId === id);
+        return this.listWorkersOf(id).length === 0;
     }
     /** Delegated history deletion is synchronous and checkpointed; any failed byte/index removal remains retryable. */
     deleteDelegatedRun(id) {
-        const run = this.runs.get(id);
+        const run = this.peek(id);
         try {
             if (run.delegation?.role === 'worker') {
-                const parent = this.runs.get(run.delegation.parentRunId);
+                const parent = this.peek(run.delegation.parentRunId);
                 if (parent.delegation?.role !== 'root')
                     return false;
                 const receipt = parent.delegation.receipts.find(entry => entry.workerId === id);
@@ -2194,6 +3775,10 @@ export class RunStore extends EventEmitter {
                     } : result.artifacts,
                 }, this.readWorkerResultDiff(parent.id, id));
                 this.removeRunHistoryBytes(id);
+                // Delete scratch while its generation evidence still exists; failed removal keeps it.
+                removeAgentTmpDir(this.dataDir, id);
+                if (agentTmpDirMayExist(this.dataDir, id))
+                    return false;
                 // Private process/account evidence is now replaced by the exact parent receipt.
                 rmSync(this.identityPath(id), { force: true });
                 rmSync(this.processesPath(id), { force: true });
@@ -2205,20 +3790,15 @@ export class RunStore extends EventEmitter {
                         items: retained.artifacts.items.map(item => ({ state: 'deleted', reason: 'missing', id: item.id, path: item.path })),
                     } : retained.artifacts,
                 }, this.readWorkerResultDiff(parent.id, id));
-                const proposed = new Map(this.runs);
-                proposed.delete(id);
-                proposed.set(parent.id, { ...parent, delegation: { ...parent.delegation,
-                        receipts: parent.delegation.receipts.map(entry => entry.workerId === id ? { ...entry, deletion: { ...deletion, phase: 'complete' } } : entry),
-                    } });
-                this.commitIndex(proposed, new Set([parent.id, id]));
+                this.commitIndex(new Map([[parent.id, { ...parent, delegation: { ...parent.delegation,
+                                receipts: parent.delegation.receipts.map(entry => entry.workerId === id ? { ...entry, deletion: { ...deletion, phase: 'complete' } } : entry),
+                            } }], [id, null]]));
             }
             else if (run.delegation?.role === 'root') {
                 this.commitDelegation([{ id, delegation: { ...run.delegation, historyDeletion: 'pending' } }]);
                 this.removeRunHistoryBytes(id);
                 rmSync(join(this.dataDir, 'runs', `${id}-worker-results`), { recursive: true, force: true });
-                const proposed = new Map(this.runs);
-                proposed.delete(id);
-                this.commitIndex(proposed, new Set([id]));
+                this.commitIndex(new Map([[id, null]]));
             }
             else
                 return false;
@@ -2236,7 +3816,8 @@ export class RunStore extends EventEmitter {
         const dir = join(this.dataDir, 'runs');
         if (realpathSync(dir) !== resolve(dir))
             throw new Error('History storage redirected');
-        rmSync(this.eventsPath(id), { force: true });
+        this.facts.forget(id);
+        removeHistory(this.dataDir, id);
         rmSync(this.handoffPath(id), { force: true });
         rmSync(this.imagesDir(id), { recursive: true, force: true });
         removeArtifacts(this.dataDir, id);
@@ -2244,18 +3825,15 @@ export class RunStore extends EventEmitter {
     deleteRun(id) {
         if (!this.canDeleteRun(id))
             return false;
-        const run = this.runs.get(id);
+        const run = this.peek(id);
+        if (run && this.db && (this.quarantined.has(id) || !this.claimFamilies([familyKey(run)]).size))
+            return false;
         if (run?.delegation?.role === 'worker' || run?.delegation?.role === 'root')
             return this.deleteDelegatedRun(id);
-        const existed = this.runs.delete(id);
+        const existed = run !== undefined;
+        this.held.delete(id);
         if (existed) {
-            try {
-                rmSync(this.eventsPath(id), { force: true });
-                rmSync(this.handoffPath(id), { force: true });
-                rmSync(this.imagesDir(id), { recursive: true, force: true });
-                removeArtifacts(this.dataDir, id);
-            }
-            catch { /* Ordinary run deletion preserves its existing best-effort behavior. */ }
+            this.markDeleted(id, familyKey(run));
             removeAgentTmpDir(this.dataDir, id);
             this.seqs.delete(id);
             this.scheduleSave();
@@ -2263,7 +3841,7 @@ export class RunStore extends EventEmitter {
         }
         return existed;
     }
-    /** Write the index out now (used on shutdown). */
+    /** Write the pending rows out now (used on shutdown). */
     flush() {
         if (this.saveTimer) {
             clearTimeout(this.saveTimer);
@@ -2284,15 +3862,10 @@ export class RunStore extends EventEmitter {
      *  resumed event, even across a reload (the frozen-transcript symptom class
      *  of #424). One file read on the first post-restart append per run. */
     rehydrateSeq(runId) {
-        let max = 0;
-        for (const event of this.readEvents(runId)) {
-            if (typeof event.seq === 'number' && event.seq > max)
-                max = event.seq;
-        }
-        return max;
+        return this.transcriptFacts(runId).lastSeq;
     }
     eventsPath(runId) {
-        return join(this.dataDir, 'runs', `${runId}.ndjson`);
+        return historyPaths(this.dataDir, runId).plain;
     }
     /** Same location `handoffPath()` in handoff.ts produces — inlined to keep
      *  the store free of upward imports. */
@@ -2304,38 +3877,90 @@ export class RunStore extends EventEmitter {
         return join(this.dataDir, 'runs', `${runId}-images`);
     }
     touch(run) {
+        this.dirty.add(run.id);
         this.scheduleSave();
         this.emit('run', run);
+        this.maybeEnqueueHistoryCompress(run);
+    }
+    /** Form follows archived: a terminal archived run with a plain transcript is queued again. */
+    maybeEnqueueHistoryCompress(run) {
+        if (run.archived && !isLiveStatus(run.status) && hasPlainHistory(this.dataDir, run.id)) {
+            this.compressor.enqueue(run.id);
+        }
+    }
+    /** The held record is gone; the next save or commit deletes its row, fenced by `family`'s claim
+     *  and by the revision this store last saw (kept in `base` until the delete is written). */
+    markDeleted(id, family) {
+        const read = this.coldBase.get(id);
+        if (!this.base.has(id) && read)
+            this.base.set(id, storedRow(read));
+        this.dirty.delete(id);
+        this.deleted.add(id);
+        this.deletedFamilies.set(id, family);
+        this.historyOwed.add(id);
+    }
+    /** A deleted run's history files, once the delete of its row has committed. Best effort, as
+     *  deletion always was. */
+    removeOwedHistory(id) {
+        if (!this.historyOwed.delete(id))
+            return;
+        try {
+            this.facts.forget(id);
+            removeHistory(this.dataDir, id);
+            rmSync(this.handoffPath(id), { force: true });
+            rmSync(this.imagesDir(id), { recursive: true, force: true });
+            removeArtifacts(this.dataDir, id);
+        }
+        catch { /* best effort */ }
     }
+    /**
+     * Count-based history retention: of the runs past the newest `MAX_RUNS_KEPT` unarchived ones,
+     * archive each finished run without delegation that is not pinned and whose family this store
+     * can claim. Ranked over the row keys (the `created_at` index, no record decoded) with memory
+     * laid over them, since a run created or archived since the last save has no row yet; the rows
+     * past the cut are then filtered in `runs.db`, so only real candidates decode. Archived runs
+     * are never deleted by retention — only an explicit delete, worker destruction, or history
+     * deletion removes a run.
+     */
     pruneOldRuns() {
-        const all = this.listRuns();
-        const stalePool = [
-            ...all.filter((r) => !r.archived).slice(MAX_RUNS_KEPT),
-            ...all.filter((r) => r.archived).slice(MAX_ARCHIVED_KEPT),
-        ];
-        for (const stale of stalePool) {
-            // Retention must not evict a live task's history or scratch between turns.
-            if (['queued', 'running', 'waiting'].includes(stale.status))
-                continue;
-            // Delegation promises history and parent snapshots until explicit deletion.
-            if (stale.delegation || !this.canDeleteRun(stale.id))
+        const ranked = new Map();
+        for (const key of this.db?.listKeysWhere('archived = ?', [0]) ?? []) {
+            if (!this.held.has(key.id) && !this.deleted.has(key.id))
+                ranked.set(key.id, key);
+        }
+        for (const run of this.held.values())
+            if (!run.archived)
+                ranked.set(run.id, { id: run.id, ...this.listOrder(run) });
+        const overflow = [...ranked.values()].sort(newestFirst).slice(MAX_RUNS_KEPT).map((key) => key.id);
+        if (overflow.length === 0)
+            return;
+        const stale = overflow.flatMap((id) => {
+            const run = this.held.get(id);
+            // Retention must not archive a live task between turns, a pinned run, or a delegation
+            // family whose history is promised until explicit deletion.
+            return run && !isLiveStatus(run.status) && !run.delegation && !run.pinned ? [id] : [];
+        });
+        const cold = overflow.filter((id) => !this.held.has(id));
+        if (cold.length > 0) {
+            // Another process's runs are its own to keep or archive (#779, plan step 3).
+            const rows = this.db.listWhere(RETENTION_CANDIDATES_SQL, [JSON.stringify(cold)]);
+            const writable = this.claimFamilies(rows.map(rowFamily));
+            for (const row of rows)
+                if (writable.has(rowFamily(row)))
+                    stale.push(row.id);
+        }
+        for (const id of stale) {
+            const run = this.record(id);
+            if (!run || run.archived)
                 continue;
-            this.runs.delete(stale.id);
-            try {
-                rmSync(this.eventsPath(stale.id), { force: true });
-                rmSync(this.handoffPath(stale.id), { force: true });
-                rmSync(this.imagesDir(stale.id), { recursive: true, force: true });
-                removeArtifacts(this.dataDir, stale.id);
-            }
-            catch {
-                // best effort
-            }
-            removeAgentTmpDir(this.dataDir, stale.id);
+            this.applyArchived(run, true);
+            removeAgentTmpDir(this.dataDir, id);
         }
     }
-    /** Debounced so token-usage updates don't rewrite the index per event. */
+    /** Debounced so token-usage updates don't rewrite a row per event. Nothing to schedule without
+     *  a database: a `RunStore.unavailable` store, or a closed one, writes nothing. */
     scheduleSave() {
-        if (this.saveTimer)
+        if (this.saveTimer || !this.db)
             return;
         this.saveTimer = setTimeout(() => {
             this.saveTimer = null;
@@ -2343,30 +3968,234 @@ export class RunStore extends EventEmitter {
         }, 300);
         this.saveTimer.unref?.();
     }
-    writeIndex(runs) {
-        const indexPath = join(this.dataDir, 'runs.json');
-        const tmpPath = `${indexPath}.tmp`;
-        writeFileSync(tmpPath, JSON.stringify(runs, null, 2), 'utf8');
-        renameSync(tmpPath, indexPath);
+    /** The single database write, so a test can fail it the way a full disk would. */
+    writeIndex(changes) {
+        return this.db.transaction(changes);
     }
-    saveNow() {
+    /**
+     * Write `staged` plus everything still pending — dirty rows from memory, deletions — in one
+     * transaction, then clear the pending marks. Throws with nothing cleared when it fails.
+     * Never copies or sorts the whole store: the cost is the rows that changed.
+     *
+     * Fenced (#779, plan step 3): the transaction commits only if every family it writes still
+     * carries this store's claim and every row is at the revision this store last saw. Otherwise
+     * nothing is written and `handleConflicts` deals with the rows that changed under it.
+     */
+    persist(staged) {
+        const upserts = [];
+        const deletes = [];
+        const families = new Map();
+        const extras = new Map();
+        const encode = (run) => {
+            const encoded = encodeRawRecord(run, (this.base.get(run.id) ?? this.coldBase.get(run.id))?.extras);
+            extras.set(run.id, encoded.extras);
+            upserts.push(encodeRunRow(run, encoded.data));
+        };
+        for (const [id, next] of staged) {
+            if (next)
+                encode(next);
+            else
+                deletes.push(id);
+            families.set(id, next ? familyKey(next) : this.familyOf(id));
+        }
+        for (const id of this.dirty) {
+            const run = this.held.get(id);
+            if (!run || staged.has(id))
+                continue;
+            encode(run);
+            families.set(id, familyKey(run));
+        }
+        for (const id of this.deleted) {
+            if (staged.has(id))
+                continue;
+            deletes.push(id);
+            families.set(id, this.familyOf(id));
+        }
+        // A row's insertion order (`seq`) is the order this write inserts it in, and it is where the
+        // run lists among runs created in the same millisecond. Insert new runs in creation order (the
+        // held set's, then staged runs not held yet), whether staged or dirty brought them here.
+        if (upserts.filter((row) => !this.base.has(row.id)).length > 1) {
+            const created = new Map();
+            for (const id of [...this.held.keys(), ...staged.keys()])
+                if (!created.has(id))
+                    created.set(id, created.size);
+            upserts.sort((a, b) => created.get(a.id) - created.get(b.id));
+        }
+        // A held run whose write moved it into a new family (a worker quarantined to `invalid`) takes
+        // that family's claim first; one it cannot take fails the fence below as claim-lost.
+        const moved = [...new Set(families.values())].filter((family) => !this.claimed.has(family) && !this.pendingClaims.has(family));
+        if (moved.length > 0)
+            this.claimFamilies(moved, { allowLive: true });
+        let commit;
         try {
-            this.writeIndex(this.listRuns());
+            commit = this.writeIndex({ upserts, deletes, ...(this.owner ? { fence: this.fence(families) } : {}) });
         }
-        catch (err) {
-            if (err?.code === 'ENOENT') {
-                try {
-                    statSync(this.dataDir);
-                }
-                catch (dirErr) {
-                    // A pending save may outlive its directory; never recreate it or hide live-directory failures.
-                    if (dirErr?.code === 'ENOENT')
-                        return;
+        catch (error) {
+            if (error instanceof RunConflictError)
+                this.handleConflicts(error, staged);
+            throw error;
+        }
+        for (const [family, generation] of commit.claims) {
+            this.claimed.set(family, generation);
+            this.pendingClaims.delete(family);
+        }
+        for (const row of upserts) {
+            this.base.set(row.id, { revision: commit.revisions.get(row.id), seq: commit.seqs.get(row.id), data: row.data, extras: extras.get(row.id) });
+        }
+        for (const id of deletes) {
+            this.base.delete(id);
+            this.deletedFamilies.delete(id);
+            this.removeOwedHistory(id);
+        }
+        this.dirty.clear();
+        this.deleted.clear();
+        if (this.saveTimer) {
+            clearTimeout(this.saveTimer);
+            this.saveTimer = null;
+        }
+    }
+    /** What a write of these rows (id → family) must still find: this store's claims, at the
+     *  generations it took them, and each row at the revision it last saw (none for a new row). */
+    fence(families) {
+        const claims = new Map();
+        const rows = new Map();
+        for (const [id, family] of families) {
+            const pending = this.pendingClaims.get(family);
+            // Generations start at 1, so an unclaimed family's 0 fails the fence as claim-lost.
+            claims.set(family, pending !== undefined ? { take: pending } : { generation: this.claimed.get(family) ?? 0 });
+            rows.set(id, { revision: (this.base.get(id) ?? this.coldBase.get(id))?.revision ?? null, family });
+        }
+        return { owner: this.owner, claims, rows };
+    }
+    /**
+     * A fenced write found rows that changed under this store (#779, plan step 3); the write itself
+     * has already failed with nothing changed, and its caller sees that error.
+     *
+     * A conflict is UNEXPECTED when this store owned the row's family when it last read or wrote it:
+     * a held or pending row, or one read inside a family it claimed. Another writer then broke the
+     * claim. For each such row the original (what this store last saw), local (what it meant to
+     * write, or that it meant to delete it) and current versions go to `run_conflicts` first. Only
+     * once that evidence is stored does the row leave the pending set, so no retry rewrites it; this
+     * store then refuses to write it again, and its held copy is replaced by the current row (or
+     * dropped when deleted) and announced. That refusal lasts as long as this store: the explicit
+     * recovery is a restart, which reads the row as it now stands, and the evidence row stays for a
+     * person to compare. Other pending rows stay pending and the next save writes them.
+     *
+     * If the evidence cannot be stored, nothing changes: the rows stay pending, and the next write
+     * meets the same conflict and tries again. A row read before its family was claimed may simply
+     * have been finished by its previous owner in between: a stale read, not a conflict, so only the
+     * write fails.
+     */
+    handleConflicts(error, staged) {
+        const unexpected = error.conflicts.filter((conflict) => this.held.has(conflict.id) || this.deleted.has(conflict.id) || this.coldBase.get(conflict.id)?.owned === true);
+        if (unexpected.length === 0 || !this.db || !this.owner)
+            return;
+        const evidence = unexpected.map((conflict) => {
+            const seen = this.base.get(conflict.id) ?? this.coldBase.get(conflict.id);
+            const local = staged.has(conflict.id) ? staged.get(conflict.id) : this.deleted.has(conflict.id) ? null : this.held.get(conflict.id) ?? null;
+            return {
+                runId: conflict.id, reason: conflict.reason,
+                baseRevision: seen?.revision ?? null, baseData: seen?.data ?? null,
+                localData: local === null ? null : JSON.stringify(local), localDeleted: local === null,
+                currentRevision: conflict.current?.revision ?? null, currentData: conflict.current?.data ?? null,
+            };
+        });
+        let seqs;
+        try {
+            seqs = this.db.recordConflicts(this.owner.session, evidence);
+        }
+        catch (evidenceError) {
+            const message = evidenceError instanceof Error ? evidenceError.message : String(evidenceError);
+            console.error(`[cez] ${RUNS_DB_FILE}: could not record the conflicting write on ${unexpected.map((c) => c.id).join(', ')}; it stays pending: ${message}`);
+            return;
+        }
+        unexpected.forEach((conflict, index) => {
+            const family = this.familyOf(conflict.id);
+            this.quarantined.add(conflict.id);
+            this.dirty.delete(conflict.id);
+            this.deleted.delete(conflict.id);
+            this.deletedFamilies.delete(conflict.id);
+            // The delete did not happen, so the history stays with the row.
+            this.historyOwed.delete(conflict.id);
+            if (conflict.reason === 'claim-lost') {
+                this.claimed.delete(family);
+                this.pendingClaims.delete(family);
+            }
+            const decoded = conflict.current ? decodeRunRow(conflict.current.data) : undefined;
+            const current = decoded?.run;
+            const held = this.held.get(conflict.id);
+            if (current && conflict.current) {
+                // The other writer's record as it stands, normalized only as a live owner's run would be.
+                reconcileLoadedRun(current, { keepLive: true });
+                rescopeRun(current, this.repoHandle);
+                if (held)
+                    replaceRecord(held, current);
+                this.base.set(conflict.id, { revision: conflict.current.revision, seq: conflict.current.seq, data: conflict.current.data, extras: decoded.extras });
+                this.emit('run', held ?? current);
+            }
+            else {
+                this.held.delete(conflict.id);
+                this.base.delete(conflict.id);
+                this.emit('deleted', conflict.id);
+            }
+            console.error(`[cez] run ${conflict.id} was changed by another writer (${conflict.reason}); this process will not write it again until cezar restarts. Evidence: ${join(this.dataDir, RUNS_DB_FILE)}, table run_conflicts, seq ${seqs[index]}.`);
+        });
+        this.scheduleSave();
+    }
+    /** Write what is pending, then (unless closing) let every run whose write settled leave memory. */
+    saveNow(evict = true) {
+        if (!this.db)
+            return;
+        // A second attempt only after a conflict excluded its rows: the unrelated rest goes out at once.
+        for (let attempt = 0; attempt < 2 && (this.dirty.size > 0 || this.deleted.size > 0); attempt++) {
+            const quarantined = this.quarantined.size;
+            try {
+                this.persist(new Map());
+            }
+            catch (err) {
+                if (err instanceof RunConflictError && this.quarantined.size > quarantined)
+                    continue;
+                // A pending save may outlive its directory; never recreate it or hide live-directory
+                // failures. The rows stay pending (and held), so the next save or commit retries them.
+                if (existsSync(this.dataDir)) {
+                    const message = err instanceof Error ? err.message : String(err);
+                    console.error(`[cez] failed to save ${RUNS_DB_FILE}: ${message}`);
                 }
+                break;
+            }
+        }
+        if (evict)
+            this.evictSettled();
+    }
+    /**
+     * Write what is pending and release the database (store disposal, process shutdown).
+     * Idempotent. A closed store keeps answering reads for what it holds — the final save evicts
+     * nothing — but cannot read `runs.db` any more, so a run that had already left memory reads as
+     * absent. It saves nothing more, and a durable commit on it throws.
+     */
+    close() {
+        this.compressor.stop();
+        this.facts.stop();
+        this.facts.flush();
+        if (this.saveTimer) {
+            clearTimeout(this.saveTimer);
+            this.saveTimer = null;
+        }
+        this.saveNow(false);
+        if (this.db && this.owner) {
+            // Every claim goes with the store. Should the release fail, the claims stay until this
+            // process exits; from then on they are provably dead and the next opener takes them.
+            try {
+                this.db.releaseClaims(this.owner.session);
             }
-            const message = err instanceof Error ? err.message : String(err);
-            console.error(`[cez] failed to save runs.json: ${message}`);
+            catch { /* see above */ }
         }
+        this.claimed.clear();
+        this.pendingClaims.clear();
+        if (this.owner)
+            closeClaimSession(this.owner.session);
+        this.db?.close();
+        this.db = null;
     }
 }
 //# sourceMappingURL=store.js.map