create-principles-disciple 1.85.0 → 1.87.0

package/core/dist/runtime-v2/internalization-integrity-remediation.js

@@ -1,8 +1,12 @@
 import * as fs from 'fs';
 import * as path from 'path';
+import * as crypto from 'crypto';
 import Database from 'better-sqlite3';
+import { Value } from '@sinclair/typebox/value';
 import { extractPIMetadata } from './internalization-chain-integrity-read-model.js';
 import { createRemediationResult, remediationAction } from './remediation-contract.js';
+import { SqliteRunStore } from './store/run/sqlite-run-store.js';
+import { RunRecordSchema, RuntimeKindSchema } from './runtime-protocol.js';
 export class InternalizationIntegrityRemediation {
     dbPath;
     constructor(opts) {
@@ -14,9 +18,14 @@ export class InternalizationIntegrityRemediation {
             throw new Error(`state.db not found at ${this.dbPath} — cannot remediate`);
         }
         const brokenDreamers = this.detectBrokenDreamers();
+        const stuckLeases = this.detectStuckLeases();
+        const orphanedRuns = this.detectOrphanedRuns();
+        const malformedRuns = this.detectMalformedRuns();
         const actions = [];
+        const warnings = [];
         let repairedCount = 0;
         let skippedCount = 0;
+        // ── 1. Fix broken dreamers (existing logic) ──────────────────────────
         for (const bd of brokenDreamers) {
             if (bd.missingArtifact) {
                 if (params.dryRun) {
@@ -142,15 +151,327 @@ export class InternalizationIntegrityRemediation {
                 }
             }
         }
+        // ── 2. Fix stuck leases ────────────────────────────────────────────
+        for (const sl of stuckLeases) {
+            if (!sl.isSafe) {
+                actions.push(remediationAction({
+                    action: 'refuse_repair',
+                    targetId: sl.taskId,
+                    taskId: sl.taskId,
+                    type: 'lease_stuck',
+                    severity: 'error',
+                    previousState: 'leased',
+                    nextState: 'leased',
+                    previousStatus: 'leased',
+                    newStatus: 'leased',
+                    recommendedAction: 'manual_intervention',
+                    reason: `Cannot safely repair: ${sl.reason ?? 'unknown reason'}. nextAction: Manually update/fix the task status or lease_expires_at in state.db`,
+                }));
+                warnings.push(`Task ${sl.taskId} has unsafe/unparseable lease state and cannot be safely repaired automatically.`);
+                skippedCount++;
+                continue;
+            }
+            if (params.dryRun) {
+                actions.push(remediationAction({
+                    action: 'force_expire_lease',
+                    targetId: sl.taskId,
+                    taskId: sl.taskId,
+                    type: 'lease_stuck',
+                    severity: 'warning',
+                    previousState: 'leased',
+                    nextState: 'pending',
+                    previousStatus: 'leased',
+                    newStatus: 'pending',
+                    recommendedAction: 'force_expire_lease',
+                    reason: `Task ${sl.taskId} has expired lease (owner: ${sl.leaseOwner ?? 'unknown'}) — would force-expire to pending and mark latest run as failed`,
+                }));
+            }
+            else {
+                const currentStatus = this.getTaskStatus(sl.taskId);
+                if (currentStatus !== 'leased') {
+                    actions.push(remediationAction({
+                        action: 'already_repaired',
+                        targetId: sl.taskId,
+                        taskId: sl.taskId,
+                        type: 'lease_stuck',
+                        severity: 'warning',
+                        previousState: currentStatus,
+                        nextState: currentStatus,
+                        previousStatus: currentStatus,
+                        newStatus: currentStatus,
+                        recommendedAction: 'already_repaired',
+                        reason: `Task already in ${currentStatus} — no repair needed`,
+                    }));
+                    skippedCount++;
+                    continue;
+                }
+                try {
+                    this.forceExpireAndMarkRunFailed(sl.taskId);
+                    repairedCount++;
+                    actions.push(remediationAction({
+                        action: 'force_expire_lease',
+                        targetId: sl.taskId,
+                        taskId: sl.taskId,
+                        type: 'lease_stuck',
+                        severity: 'warning',
+                        previousState: 'leased',
+                        nextState: 'pending',
+                        previousStatus: 'leased',
+                        newStatus: 'pending',
+                        recommendedAction: 'force_expire_lease',
+                        reason: `Task ${sl.taskId} had expired lease (owner: ${sl.leaseOwner ?? 'unknown'}) — force-expired to pending and latest run marked as failed`,
+                    }));
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    actions.push(remediationAction({
+                        action: 'refuse_repair',
+                        targetId: sl.taskId,
+                        taskId: sl.taskId,
+                        type: 'lease_stuck',
+                        severity: 'error',
+                        previousState: 'leased',
+                        nextState: 'leased',
+                        previousStatus: 'leased',
+                        newStatus: 'leased',
+                        recommendedAction: 'manual_intervention',
+                        reason: `Cannot safely force-expire lease for task ${sl.taskId}: ${msg}. nextAction: Manually update/delete the task/run in state.db`,
+                    }));
+                    warnings.push(`Cannot safely force-expire lease for task ${sl.taskId}: ${msg}`);
+                    skippedCount++;
+                }
+            }
+        }
+        // ── 3. Fix orphaned running runs ───────────────────────────────────
+        for (const or of orphanedRuns) {
+            if (params.dryRun) {
+                actions.push(remediationAction({
+                    action: 'mark_run_failed',
+                    targetId: or.runId,
+                    taskId: or.taskId,
+                    type: 'running_run_stuck',
+                    severity: 'error',
+                    previousState: 'running',
+                    nextState: 'failed',
+                    previousStatus: 'running',
+                    newStatus: 'failed',
+                    recommendedAction: 'mark_run_failed',
+                    reason: `Run ${or.runId} for task ${or.taskId} is 'running' but task status is ${or.taskStatus ?? 'none'} — would mark run as failed`,
+                }));
+            }
+            else {
+                const currentRunStatus = this.getRunStatus(or.runId);
+                if (currentRunStatus !== 'running') {
+                    actions.push(remediationAction({
+                        action: 'already_repaired',
+                        targetId: or.runId,
+                        taskId: or.taskId,
+                        type: 'running_run_stuck',
+                        severity: 'warning',
+                        previousState: currentRunStatus,
+                        nextState: currentRunStatus,
+                        previousStatus: currentRunStatus,
+                        newStatus: currentRunStatus,
+                        recommendedAction: 'already_repaired',
+                        reason: `Run already in ${currentRunStatus} — no repair needed`,
+                    }));
+                    skippedCount++;
+                    continue;
+                }
+                try {
+                    this.markOrphanedRunFailed(or.runId, or.taskId);
+                    repairedCount++;
+                    actions.push(remediationAction({
+                        action: 'mark_run_failed',
+                        targetId: or.runId,
+                        taskId: or.taskId,
+                        type: 'running_run_stuck',
+                        severity: 'error',
+                        previousState: 'running',
+                        nextState: 'failed',
+                        previousStatus: 'running',
+                        newStatus: 'failed',
+                        recommendedAction: 'mark_run_failed',
+                        reason: `Run ${or.runId} for task ${or.taskId} was 'running' with task status ${or.taskStatus ?? 'none'} — marked as failed (recovery repair)`,
+                    }));
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    actions.push(remediationAction({
+                        action: 'refuse_repair',
+                        targetId: or.runId,
+                        taskId: or.taskId,
+                        type: 'running_run_stuck',
+                        severity: 'error',
+                        previousState: 'running',
+                        nextState: 'running',
+                        previousStatus: 'running',
+                        newStatus: 'running',
+                        recommendedAction: 'manual_intervention',
+                        reason: `Cannot safely mark stuck run as failed: ${msg}. nextAction: Manually update/delete the run row in state.db`,
+                    }));
+                    warnings.push(`Cannot safely mark stuck run ${or.runId} as failed: ${msg}`);
+                    skippedCount++;
+                }
+            }
+        }
+        // ── 4. Quarantine malformed run rows ────────────────────────────────
+        // Schema-invalid historical run rows block runner recovery (resolveStoreRunId
+        // and the mark* completion methods tolerate them at runtime, but they stay
+        // in the DB forever without this pass). Quarantine is conservative:
+        //   - mark execution_status='failed' + error_category='storage_unavailable'
+        //   - NEVER delete the row (preserves audit history)
+        //   - NEVER mark as succeeded (would forge a successful run)
+        //   - idempotent: rows already 'failed' are skipped
+        for (const mr of malformedRuns) {
+            if (mr.currentStatus === 'failed') {
+                actions.push(remediationAction({
+                    action: 'already_repaired',
+                    targetId: mr.runId,
+                    taskId: mr.taskId,
+                    type: 'malformed_run_row',
+                    severity: 'warning',
+                    previousState: 'failed',
+                    nextState: 'failed',
+                    previousStatus: 'failed',
+                    newStatus: 'failed',
+                    recommendedAction: 'already_repaired',
+                    reason: `Malformed run ${mr.runId} already quarantined (failed). Validation error: ${mr.error}`,
+                }));
+                skippedCount++;
+                continue;
+            }
+            if (params.dryRun) {
+                actions.push(remediationAction({
+                    action: 'quarantine_malformed_run',
+                    targetId: mr.runId,
+                    taskId: mr.taskId,
+                    type: 'malformed_run_row',
+                    severity: 'warning',
+                    previousState: mr.currentStatus ?? 'unknown',
+                    nextState: 'failed',
+                    previousStatus: mr.currentStatus ?? 'unknown',
+                    newStatus: 'failed',
+                    recommendedAction: 'quarantine_malformed_run',
+                    reason: `Run ${mr.runId} (task ${mr.taskId}) failed schema validation — would quarantine as failed + storage_unavailable. Error: ${mr.error}`,
+                }));
+            }
+            else {
+                try {
+                    this.quarantineMalformedRun(mr.runId, mr.error);
+                    repairedCount++;
+                    actions.push(remediationAction({
+                        action: 'quarantine_malformed_run',
+                        targetId: mr.runId,
+                        taskId: mr.taskId,
+                        type: 'malformed_run_row',
+                        severity: 'warning',
+                        previousState: mr.currentStatus ?? 'unknown',
+                        nextState: 'failed',
+                        previousStatus: mr.currentStatus ?? 'unknown',
+                        newStatus: 'failed',
+                        recommendedAction: 'quarantine_malformed_run',
+                        reason: `Run ${mr.runId} (task ${mr.taskId}) failed schema validation — quarantined as failed + storage_unavailable. Error: ${mr.error}`,
+                    }));
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    actions.push(remediationAction({
+                        action: 'refuse_repair',
+                        targetId: mr.runId,
+                        taskId: mr.taskId,
+                        type: 'malformed_run_row',
+                        severity: 'error',
+                        previousState: mr.currentStatus ?? 'unknown',
+                        nextState: mr.currentStatus ?? 'unknown',
+                        previousStatus: mr.currentStatus ?? 'unknown',
+                        newStatus: mr.currentStatus ?? 'unknown',
+                        recommendedAction: 'manual_intervention',
+                        reason: `Cannot safely quarantine malformed run ${mr.runId}: ${msg}. nextAction: Manually delete or update the run row in state.db`,
+                    }));
+                    warnings.push(`Cannot safely quarantine malformed run ${mr.runId}: ${msg}`);
+                    skippedCount++;
+                }
+            }
+        }
+        // ── 5. Supplement succeeded runs for task_succeeded_no_succeeded_run ──
+        const succeededTasksNoRun = this.detectSucceededTasksWithoutSucceededRun();
+        for (const st of succeededTasksNoRun) {
+            if (params.dryRun) {
+                actions.push(remediationAction({
+                    action: 'supplement_succeeded_run',
+                    targetId: st.taskId,
+                    taskId: st.taskId,
+                    type: 'task_succeeded_no_succeeded_run',
+                    severity: 'error',
+                    previousState: 'missing',
+                    nextState: 'succeeded',
+                    previousStatus: 'missing',
+                    newStatus: 'succeeded',
+                    recommendedAction: 'supplement_succeeded_run',
+                    reason: `Task ${st.taskId} is succeeded but has no succeeded run — would supplement a canonical succeeded run`,
+                }));
+            }
+            else {
+                try {
+                    this.supplementSucceededRun(st.taskId, st.resultRef);
+                    repairedCount++;
+                    actions.push(remediationAction({
+                        action: 'supplement_succeeded_run',
+                        targetId: st.taskId,
+                        taskId: st.taskId,
+                        type: 'task_succeeded_no_succeeded_run',
+                        severity: 'error',
+                        previousState: 'missing',
+                        nextState: 'succeeded',
+                        previousStatus: 'missing',
+                        newStatus: 'succeeded',
+                        recommendedAction: 'supplement_succeeded_run',
+                        reason: `Task ${st.taskId} is succeeded but had no succeeded run — supplemented a canonical succeeded run`,
+                    }));
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    actions.push(remediationAction({
+                        action: 'refuse_repair',
+                        targetId: st.taskId,
+                        taskId: st.taskId,
+                        type: 'task_succeeded_no_succeeded_run',
+                        severity: 'error',
+                        previousState: 'missing',
+                        nextState: 'missing',
+                        previousStatus: 'missing',
+                        newStatus: 'missing',
+                        recommendedAction: 'manual_intervention',
+                        reason: `Cannot safely supplement run for ${st.taskId}: ${msg}. nextAction: Manually create a run row in state.db`,
+                    }));
+                    skippedCount++;
+                }
+            }
+        }
+        if (!params.dryRun) {
+            // Perform a post-repair verification check
+            const postBrokenDreamers = this.detectBrokenDreamers();
+            const postStuckLeases = this.detectStuckLeases();
+            const postOrphanedRuns = this.detectOrphanedRuns();
+            const postMalformedRuns = this.detectMalformedRuns();
+            const postSucceededTasksNoRun = this.detectSucceededTasksWithoutSucceededRun();
+            const totalUnresolved = postBrokenDreamers.length + postStuckLeases.length + postOrphanedRuns.length + postMalformedRuns.length + postSucceededTasksNoRun.length;
+            if (totalUnresolved > 0) {
+                console.warn(`[Integrity Check Post-Repair] ${totalUnresolved} unresolved issue(s) remaining.`);
+            }
+        }
         return createRemediationResult({
             mode: params.dryRun ? 'dry_run' : 'confirm',
             repairedCount,
             skippedCount,
             actions,
+            warnings,
             generatedAt,
             includeLegacyDryRun: true,
         });
     }
+    // ── Detection helpers ─────────────────────────────────────────────────
     detectBrokenDreamers() {
         const db = new Database(this.dbPath, { readonly: true });
         try {
@@ -197,6 +518,143 @@ export class InternalizationIntegrityRemediation {
             db.close();
         }
     }
+    /**
+     * Detect tasks that are still 'leased' with an expired lease.
+     * These are tasks where the lease owner crashed or the runner failed
+     * before releasing/renewing the lease.
+     */
+    detectStuckLeases() {
+        const db = new Database(this.dbPath, { readonly: true });
+        try {
+            const leasedTasks = db.prepare("SELECT task_id, lease_owner, lease_expires_at FROM tasks WHERE status = 'leased'").all();
+            const now = Date.now();
+            const results = [];
+            for (const t of leasedTasks) {
+                if (!t.lease_expires_at) {
+                    results.push({
+                        taskId: t.task_id,
+                        leaseOwner: t.lease_owner,
+                        leaseExpiresAt: null,
+                        isSafe: false,
+                        reason: `Task ${t.task_id} is leased but lease_expires_at is missing/null`,
+                    });
+                    continue;
+                }
+                const expiresAt = new Date(t.lease_expires_at).getTime();
+                if (Number.isNaN(expiresAt)) {
+                    results.push({
+                        taskId: t.task_id,
+                        leaseOwner: t.lease_owner,
+                        leaseExpiresAt: t.lease_expires_at,
+                        isSafe: false,
+                        reason: `Task ${t.task_id} is leased but lease_expires_at '${t.lease_expires_at}' is unparseable`,
+                    });
+                    continue;
+                }
+                if (expiresAt < now) {
+                    results.push({
+                        taskId: t.task_id,
+                        leaseOwner: t.lease_owner,
+                        leaseExpiresAt: t.lease_expires_at,
+                        isSafe: true,
+                    });
+                }
+            }
+            return results;
+        }
+        finally {
+            db.close();
+        }
+    }
+    /**
+     * Detect runs that are 'running' but their owning task is no longer
+     * in 'leased' state. These are orphan runs from crashed/completed
+     * runners that didn't properly close the run record.
+     */
+    detectOrphanedRuns() {
+        const db = new Database(this.dbPath, { readonly: true });
+        try {
+            const runningRuns = db.prepare("SELECT run_id, task_id FROM runs WHERE execution_status = 'running'").all();
+            const results = [];
+            for (const run of runningRuns) {
+                const taskRow = db.prepare('SELECT status FROM tasks WHERE task_id = ?').get(run.task_id);
+                if (!taskRow) {
+                    // Task no longer exists — definitely a stuck run
+                    results.push({
+                        runId: run.run_id,
+                        taskId: run.task_id,
+                        taskExists: false,
+                        taskStatus: null,
+                    });
+                }
+                else if (taskRow.status !== 'leased') {
+                    // Task is no longer leased but run is still 'running'
+                    results.push({
+                        runId: run.run_id,
+                        taskId: run.task_id,
+                        taskExists: true,
+                        taskStatus: taskRow.status,
+                    });
+                }
+                // If task is still 'leased', the run might be legitimate — skip
+            }
+            return results;
+        }
+        finally {
+            db.close();
+        }
+    }
+    /**
+     * Detect run rows that fail TypeBox schema validation against
+     * RunRecordSchema — the exact failure mode that throws MalformedRunError
+     * from SqliteRunStore and historically blocked runner recovery.
+     *
+     * Detection reuses SqliteRunStore.rowToRecord() (the SAME validation used
+     * by production reads — EP-01: no duplicated schema logic that can drift).
+     * rowToRecord throws PDRuntimeError{storage_unavailable} for invalid rows;
+     * we capture the validation message.
+     */
+    detectMalformedRuns() {
+        const db = new Database(this.dbPath, { readonly: true });
+        try {
+            const rows = db.prepare('SELECT * FROM runs').all();
+            const results = [];
+            for (const row of rows) {
+                let isMalformed = false;
+                let errMsg = '';
+                try {
+                    SqliteRunStore.rowToRecord(row);
+                    // If it is schema-valid but has been quarantined by integrity-repair
+                    const reason = typeof row.reason === 'string' ? row.reason : '';
+                    if (row.execution_status === 'failed' && row.error_category === 'storage_unavailable' && reason.includes('quarantined')) {
+                        isMalformed = true;
+                        errMsg = reason;
+                    }
+                }
+                catch (err) {
+                    isMalformed = true;
+                    errMsg = err instanceof Error ? err.message : String(err);
+                }
+                if (isMalformed) {
+                    const runId = typeof row.run_id === 'string' ? row.run_id : String(row.run_id ?? 'unknown');
+                    const taskId = typeof row.task_id === 'string' ? row.task_id : String(row.task_id ?? 'unknown');
+                    const executionStatus = typeof row.execution_status === 'string' ? row.execution_status : null;
+                    results.push({
+                        runId,
+                        taskId,
+                        error: errMsg,
+                        currentStatus: executionStatus,
+                    });
+                }
+            }
+            return results;
+        }
+        finally {
+            db.close();
+        }
+    }
+    // ── State readers ─────────────────────────────────────────────────────
+    // Get current task status from DB
     getTaskStatus(taskId) {
         const db = new Database(this.dbPath, { readonly: true });
         try {
@@ -207,6 +665,18 @@ export class InternalizationIntegrityRemediation {
             db.close();
         }
     }
+    // Get current run execution status from DB
+    getRunStatus(runId) {
+        const db = new Database(this.dbPath, { readonly: true });
+        try {
+            const row = db.prepare('SELECT execution_status FROM runs WHERE run_id = ?').get(runId);
+            return row?.execution_status ?? 'unknown';
+        }
+        finally {
+            db.close();
+        }
+    }
+    // ── Mutators ──────────────────────────────────────────────────────────
     requeueTask(taskId) {
         const db = new Database(this.dbPath);
         try {
@@ -216,6 +686,64 @@ export class InternalizationIntegrityRemediation {
             db.close();
         }
     }
+    /**
+     * Force-expire a stuck lease: set task to 'pending' and mark the latest
+     * running run as 'failed' with a reason.
+     */
+    forceExpireAndMarkRunFailed(taskId) {
+        const db = new Database(this.dbPath);
+        try {
+            const tx = db.transaction(() => {
+                // Reset task to pending (force-expire lease)
+                db.prepare(`
+          UPDATE tasks
+          SET status = 'pending', lease_owner = NULL, lease_expires_at = NULL, updated_at = datetime('now')
+          WHERE task_id = ?
+        `).run(taskId);
+                // Mark the latest run as failed
+                const latestRun = db.prepare(`SELECT run_id FROM runs WHERE task_id = ? AND execution_status = 'running' ORDER BY started_at DESC LIMIT 1`).get(taskId);
+                if (latestRun) {
+                    this.safeUpdateRunRow(latestRun.run_id, {
+                        executionStatus: 'failed',
+                        reason: 'Lease expired — force-expired by integrity-repair',
+                        errorCategory: 'lease_expired',
+                    }, db);
+                }
+            });
+            tx();
+        }
+        finally {
+            db.close();
+        }
+    }
+    /**
+     * Mark an orphaned running run as 'failed'. When the owning task still
+     * exists and is in a terminal/failed/retry_wait state, the run should
+     * reflect the terminal outcome.
+     */
+    markOrphanedRunFailed(runId, _taskId) {
+        this.safeUpdateRunRow(runId, {
+            executionStatus: 'failed',
+            reason: 'Orphaned run — recovered by integrity-repair (task not leased)',
+            errorCategory: 'execution_failed',
+        });
+    }
+    /**
+     * Quarantine a schema-malformed run row: mark it failed + storage_unavailable.
+     *
+     * Conservative by design:
+     *   - NEVER deletes the row (audit history preserved)
+     *   - NEVER marks as succeeded (would forge a successful run)
+     *   - The reason records the validation error so operators can trace root cause
+     */
+    quarantineMalformedRun(runId, validationError) {
+        this.safeUpdateRunRow(runId, {
+            executionStatus: 'failed',
+            reason: `Malformed run row quarantined by integrity-repair. Validation error: ${validationError}`,
+            errorCategory: 'storage_unavailable',
+        });
+    }
+    // ── Successor helpers (unchanged) ──────────────────────────────────────
     findExistingSuccessor(dreamerTaskId) {
         const db = new Database(this.dbPath, { readonly: true });
         try {
@@ -265,5 +793,279 @@ export class InternalizationIntegrityRemediation {
             db.close();
         }
     }
+    /**
+     * Helper to check if input_payload and output_payload exist in the database.
+     */
+    static checkRunsSchema(db) {
+        try {
+            const columns = db.pragma("table_info(runs)");
+            return {
+                hasInputPayload: columns.some(c => c.name === 'input_payload'),
+                hasOutputPayload: columns.some(c => c.name === 'output_payload'),
+            };
+        }
+        catch {
+            return { hasInputPayload: false, hasOutputPayload: false };
+        }
+    }
+    /**
+     * Helper to update a run row under a database transaction with pre-write
+     * and post-write schema validation checks. Rollback is triggered on error.
+     */
+    safeUpdateRunRow(runId, patch, existingDb) {
+        const db = existingDb ?? new Database(this.dbPath);
+        try {
+            const tx = db.transaction(() => {
+                // 1. Read existing row
+                const rawRow = db.prepare('SELECT * FROM runs WHERE run_id = ?').get(runId);
+                if (!rawRow) {
+                    throw new Error(`Run not found: ${runId}`);
+                }
+                // Validate required fields from the raw DB row before patching
+                if (typeof rawRow.task_id !== 'string' || rawRow.task_id.length === 0) {
+                    throw new Error(`Run row is missing required task_id`);
+                }
+                if (typeof rawRow.runtime_kind !== 'string' || !Value.Check(RuntimeKindSchema, rawRow.runtime_kind)) {
+                    throw new Error(`Run row has invalid runtime_kind: '${rawRow.runtime_kind}'`);
+                }
+                if (typeof rawRow.started_at !== 'string' || rawRow.started_at.length === 0) {
+                    throw new Error(`Run row is missing required started_at`);
+                }
+                if (typeof rawRow.created_at !== 'string' || rawRow.created_at.length === 0) {
+                    throw new Error(`Run row is missing required created_at`);
+                }
+                if (typeof rawRow.attempt_number !== 'number' || !Number.isInteger(rawRow.attempt_number) || rawRow.attempt_number < 0) {
+                    throw new Error(`Run row has invalid attempt_number: '${rawRow.attempt_number}'`);
+                }
+                const now = new Date().toISOString();
+                const schema = InternalizationIntegrityRemediation.checkRunsSchema(db);
+                // 2. Build candidate patched record
+                const candidateRecord = {
+                    runId: typeof rawRow.run_id === 'string' && rawRow.run_id.length > 0 ? rawRow.run_id : runId,
+                    taskId: rawRow.task_id,
+                    runtimeKind: rawRow.runtime_kind,
+                    executionStatus: patch.executionStatus,
+                    startedAt: rawRow.started_at,
+                    attemptNumber: rawRow.attempt_number,
+                    createdAt: rawRow.created_at,
+                    updatedAt: now,
+                    endedAt: now,
+                    reason: patch.reason,
+                    errorCategory: patch.errorCategory,
+                    outputRef: typeof rawRow.output_ref === 'string' ? rawRow.output_ref : undefined,
+                    inputPayload: schema.hasInputPayload && typeof rawRow.input_payload === 'string' ? rawRow.input_payload : undefined,
+                    outputPayload: schema.hasOutputPayload && typeof rawRow.output_payload === 'string' ? rawRow.output_payload : undefined,
+                };
+                // 写前校验
+                if (!Value.Check(RunRecordSchema, candidateRecord)) {
+                    const errors = [...Value.Errors(RunRecordSchema, candidateRecord)];
+                    const details = errors.map(e => `${e.path}: ${e.message}`).join(', ');
+                    throw new Error(`Run ${runId} failed pre-write schema check: ${details}`);
+                }
+                // 3. Update DB dynamically based on available columns
+                const sets = [
+                    'task_id = ?',
+                    'runtime_kind = ?',
+                    'execution_status = ?',
+                    'started_at = ?',
+                    'attempt_number = ?',
+                    'created_at = ?',
+                    'updated_at = ?',
+                    'ended_at = ?',
+                    'reason = ?',
+                    'error_category = ?',
+                    'output_ref = ?',
+                ];
+                const params = [
+                    candidateRecord.taskId,
+                    candidateRecord.runtimeKind,
+                    candidateRecord.executionStatus,
+                    candidateRecord.startedAt,
+                    candidateRecord.attemptNumber,
+                    candidateRecord.createdAt,
+                    candidateRecord.updatedAt,
+                    candidateRecord.endedAt,
+                    candidateRecord.reason,
+                    candidateRecord.errorCategory ?? null,
+                    candidateRecord.outputRef ?? null,
+                ];
+                if (schema.hasInputPayload) {
+                    sets.push('input_payload = ?');
+                    params.push(candidateRecord.inputPayload ?? null);
+                }
+                if (schema.hasOutputPayload) {
+                    sets.push('output_payload = ?');
+                    params.push(candidateRecord.outputPayload ?? null);
+                }
+                params.push(candidateRecord.runId);
+                db.prepare(`
+          UPDATE runs
+          SET ${sets.join(', ')}
+          WHERE run_id = ?
+        `).run(...params);
+                // 写后复校
+                const updatedRow = db.prepare('SELECT * FROM runs WHERE run_id = ?').get(runId);
+                SqliteRunStore.rowToRecord(updatedRow);
+            });
+            tx();
+        }
+        finally {
+            if (!existingDb) {
+                db.close();
+            }
+        }
+    }
+    /**
+     * Helper to insert a run row under a database transaction with pre-write
+     * and post-write schema validation checks. Rollback is triggered on error.
+     */
+    safeInsertRunRow(record) {
+        const db = new Database(this.dbPath);
+        try {
+            const tx = db.transaction(() => {
+                // 写前校验
+                if (!Value.Check(RunRecordSchema, record)) {
+                    const errors = [...Value.Errors(RunRecordSchema, record)];
+                    const details = errors.map(e => `${e.path}: ${e.message}`).join(', ');
+                    throw new Error(`Run ${record.runId} failed pre-write schema check: ${details}`);
+                }
+                const schema = InternalizationIntegrityRemediation.checkRunsSchema(db);
+                const columns = [
+                    'run_id',
+                    'task_id',
+                    'runtime_kind',
+                    'execution_status',
+                    'started_at',
+                    'ended_at',
+                    'reason',
+                    'output_ref',
+                    'attempt_number',
+                    'created_at',
+                    'updated_at',
+                    'error_category'
+                ];
+                const placeholders = ['?', '?', '?', '?', '?', '?', '?', '?', '?', '?', '?', '?'];
+                const params = [
+                    record.runId,
+                    record.taskId,
+                    record.runtimeKind,
+                    record.executionStatus,
+                    record.startedAt,
+                    record.endedAt ?? null,
+                    record.reason ?? null,
+                    record.outputRef ?? null,
+                    record.attemptNumber,
+                    record.createdAt,
+                    record.updatedAt,
+                    record.errorCategory ?? null,
+                ];
+                if (schema.hasInputPayload) {
+                    columns.push('input_payload');
+                    placeholders.push('?');
+                    params.push(record.inputPayload ?? null);
+                }
+                if (schema.hasOutputPayload) {
+                    columns.push('output_payload');
+                    placeholders.push('?');
+                    params.push(record.outputPayload ?? null);
+                }
+                db.prepare(`
+          INSERT INTO runs (${columns.join(', ')})
+          VALUES (${placeholders.join(', ')})
+        `).run(...params);
+                // 写后复校
+                const insertedRow = db.prepare('SELECT * FROM runs WHERE run_id = ?').get(record.runId);
+                SqliteRunStore.rowToRecord(insertedRow);
+            });
+            tx();
+        }
+        finally {
+            db.close();
+        }
+    }
+    /**
+     * Detect tasks that succeeded but have no succeeded run record.
+     */
+    detectSucceededTasksWithoutSucceededRun() {
+        const db = new Database(this.dbPath, { readonly: true });
+        try {
+            const succeededTasks = db.prepare("SELECT task_id, result_ref FROM tasks WHERE status = 'succeeded'").all();
+            const results = [];
+            for (const t of succeededTasks) {
+                const runs = db.prepare("SELECT * FROM runs WHERE task_id = ? AND execution_status = 'succeeded'").all(t.task_id);
+                let hasValidSucceededRun = false;
+                for (const run of runs) {
+                    try {
+                        SqliteRunStore.rowToRecord(run);
+                        hasValidSucceededRun = true;
+                        break;
+                    }
+                    catch {
+                        // Malformed run row — ignore it as a valid succeeded run
+                    }
+                }
+                if (!hasValidSucceededRun) {
+                    results.push({
+                        taskId: t.task_id,
+                        resultRef: t.result_ref,
+                    });
+                }
+            }
+            return results;
+        }
+        finally {
+            db.close();
+        }
+    }
+    /**
+     * Supplements a canonical succeeded run for a succeeded task.
+     * Resolves runtime kind from task's existing runs or defaults to 'openclaw'.
+     */
+    supplementSucceededRun(taskId, resultRef) {
+        const db = new Database(this.dbPath, { readonly: true });
+        let runtimeKind = 'openclaw';
+        let attemptNumber = 1;
+        let startedAt = new Date().toISOString();
+        let createdAt = startedAt;
+        try {
+            // Resolve runtimeKind from any existing run of this task
+            const existingRun = db.prepare('SELECT runtime_kind, attempt_number, started_at, created_at FROM runs WHERE task_id = ? ORDER BY started_at DESC LIMIT 1').get(taskId);
+            if (existingRun) {
+                if (Value.Check(RuntimeKindSchema, existingRun.runtime_kind)) {
+                    runtimeKind = existingRun.runtime_kind;
+                }
+                attemptNumber = existingRun.attempt_number;
+                startedAt = existingRun.started_at;
+                createdAt = existingRun.created_at;
+            }
+            else {
+                // Query task attributes
+                const taskRow = db.prepare('SELECT attempt_count, created_at, updated_at FROM tasks WHERE task_id = ?').get(taskId);
+                if (taskRow) {
+                    attemptNumber = Math.max(1, taskRow.attempt_count);
+                    startedAt = taskRow.created_at;
+                    createdAt = taskRow.created_at;
+                }
+            }
+        }
+        finally {
+            db.close();
+        }
+        const now = new Date().toISOString();
+        const runRecord = {
+            runId: crypto.randomUUID(),
+            taskId,
+            runtimeKind,
+            executionStatus: 'succeeded',
+            startedAt,
+            endedAt: now,
+            attemptNumber,
+            createdAt,
+            updatedAt: now,
+            reason: 'Supplemented succeeded run for succeeded task by integrity-repair',
+            outputRef: resultRef ?? undefined,
+        };
+        this.safeInsertRunRow(runRecord);
+    }
 }
 //# sourceMappingURL=internalization-integrity-remediation.js.map