ltcai 3.6.0 → 4.0.1

package/latticeai/core/workspace_os.py

@@ -11,6 +11,7 @@ from __future__ import annotations
 import json
 import os
 import shutil
+import sqlite3
 import zipfile
 from collections import deque
 from datetime import datetime
@@ -18,7 +19,7 @@ from pathlib import Path
 from typing import Any, Callable, Dict, Iterable, List, Optional
 
 
-WORKSPACE_OS_VERSION = "3.6.0"
+WORKSPACE_OS_VERSION = "4.0.1"
 
 # Workspace types separate single-user Personal workspaces from shared
 # Organization workspaces. Both keep the same local-first JSON store; the type
@@ -92,8 +93,12 @@ EXECUTION_EVENT_TYPES = {
     "plugin_completed",
     "execution_failed",
     "execution_cancelled",
+    "execution_interrupted",
 }
 
+RUN_ACTIVE_STATUSES = {"queued", "running", "in_progress", "retrying", "cancelling"}
+RUN_TERMINAL_STATUSES = {"ok", "retried_ok", "failed", "rejected", "cancelled", "interrupted", "partial"}
+
 DEFAULT_AGENTS = [
     {
         "id": "agent:planner",
@@ -173,6 +178,52 @@ def _listify(value: Any) -> List[Any]:
     return value if isinstance(value, list) else []
 
 
+def _snapshot_graph_import_payload(graph_payload: Dict[str, Any], *, workspace_id: Optional[str]) -> Dict[str, Any]:
+    """Convert the UI graph snapshot shape into the logical import artifact."""
+
+    nodes = []
+    for node in _listify((graph_payload or {}).get("nodes")):
+        node_id = node.get("id")
+        if not node_id:
+            continue
+        metadata = node.get("metadata") if isinstance(node.get("metadata"), dict) else {}
+        raw = node.get("raw") if isinstance(node.get("raw"), dict) else {}
+        if workspace_id and not metadata.get("workspace_id"):
+            metadata = {**metadata, "workspace_id": workspace_id}
+        nodes.append({
+            "id": node_id,
+            "type": node.get("type") or "Concept",
+            "title": node.get("title") or node.get("label") or node_id,
+            "summary": node.get("summary") or "",
+            "metadata_json": json.dumps(metadata, ensure_ascii=False),
+            "raw_json": json.dumps(raw, ensure_ascii=False),
+        })
+
+    edges = []
+    for edge in _listify((graph_payload or {}).get("edges")):
+        source = edge.get("from_node") or edge.get("from") or edge.get("source")
+        target = edge.get("to_node") or edge.get("to") or edge.get("target")
+        if not source or not target:
+            continue
+        edges.append({
+            "from_node": source,
+            "to_node": target,
+            "type": edge.get("type") or "related_to",
+            "weight": edge.get("weight") or 1.0,
+            "metadata_json": json.dumps(edge.get("metadata") or {}, ensure_ascii=False),
+        })
+
+    return {
+        "header": {"graph_schema_version": 1, "workspace_id": workspace_id, "source": "workspace_snapshot"},
+        "nodes": nodes,
+        "edges": edges,
+        "chunks": [],
+        "knowledge_sources": [],
+        "provenance": [],
+        "counts": {"nodes": len(nodes), "edges": len(edges)},
+    }
+
+
 def _parse_iso(value: Optional[str]) -> Optional[datetime]:
     if not value:
         return None
@@ -188,6 +239,7 @@ class WorkspaceOSStore:
     def __init__(self, data_dir: Path | str, *, event_sink: Optional[Callable[[Dict[str, Any]], Any]] = None):
         self.data_dir = Path(data_dir).expanduser()
         self.state_path = self.data_dir / "workspace_os.json"
+        self.sqlite_path = self.data_dir / "knowledge_graph.sqlite"
         self.snapshots_dir = self.data_dir / "workspace_snapshots"
         self.exports_dir = self.data_dir / "workspace_exports"
         self.data_dir.mkdir(parents=True, exist_ok=True)
@@ -198,6 +250,59 @@ class WorkspaceOSStore:
         # Defaults to None → zero behavior change for existing callers/tests.
         self.event_sink = event_sink
 
+    def _connect_state_db(self) -> sqlite3.Connection:
+        conn = sqlite3.connect(self.sqlite_path)
+        conn.execute("PRAGMA journal_mode=WAL")
+        conn.execute(
+            "CREATE TABLE IF NOT EXISTS workspace_os_state ("
+            "id TEXT PRIMARY KEY, state_json TEXT NOT NULL, updated_at TEXT NOT NULL)"
+        )
+        conn.execute(
+            "CREATE TABLE IF NOT EXISTS workspace_os_meta ("
+            "key TEXT PRIMARY KEY, value TEXT NOT NULL)"
+        )
+        return conn
+
+    def _load_sqlite_state(self) -> Optional[Dict[str, Any]]:
+        try:
+            with self._connect_state_db() as conn:
+                row = conn.execute(
+                    "SELECT state_json FROM workspace_os_state WHERE id='current'"
+                ).fetchone()
+            if not row:
+                return None
+            data = json.loads(row[0])
+            return data if isinstance(data, dict) else None
+        except Exception:
+            return None
+
+    def _save_sqlite_state(self, state: Dict[str, Any]) -> None:
+        payload = json.dumps(state, ensure_ascii=False)
+        with self._connect_state_db() as conn:
+            conn.execute(
+                "INSERT OR REPLACE INTO workspace_os_state(id, state_json, updated_at) VALUES('current', ?, ?)",
+                (payload, state.get("updated_at") or _now()),
+            )
+
+    def _import_json_state_once(self, default: Dict[str, Any]) -> Dict[str, Any]:
+        if not self.state_path.exists():
+            return default
+        try:
+            loaded = json.loads(self.state_path.read_text(encoding="utf-8"))
+            if not isinstance(loaded, dict):
+                return default
+        except Exception:
+            return default
+        try:
+            backup = self.state_path.with_name(
+                f"{self.state_path.name}.pre-sqlite.{_now().replace(':', '-')}.json"
+            )
+            if not any(self.state_path.parent.glob(f"{self.state_path.name}.pre-sqlite.*.json")):
+                shutil.copy2(self.state_path, backup)
+        except Exception:
+            pass
+        return _deep_merge(default, loaded)
+
     @staticmethod
     def _new_workspace_record(
         *,
@@ -272,6 +377,47 @@ class WorkspaceOSStore:
             state["active_workspace"] = DEFAULT_WORKSPACE_ID
         return state
 
+    def migrate_workspace_identities(self, email_to_id: Dict[str, str]) -> int:
+        """Rewrite workspace membership identities from legacy emails to UUIDs.
+
+        The migration is additive and in-place: workspace records, memberships,
+        and owner fields keep their shape, only identity string values change.
+        """
+        if not email_to_id:
+            return 0
+        normalized = {str(email).strip().lower(): user_id for email, user_id in email_to_id.items() if user_id}
+        state = self.load_state()
+        changed = 0
+        for ws in (state.get("workspaces") or {}).values():
+            owner = str(ws.get("owner_user_id") or "").strip().lower()
+            if owner in normalized and ws.get("owner_user_id") != normalized[owner]:
+                ws["owner_user_id"] = normalized[owner]
+                changed += 1
+            for member in _listify(ws.get("members")):
+                member_id = str(member.get("user_id") or "").strip().lower()
+                if member_id in normalized and member.get("user_id") != normalized[member_id]:
+                    member["user_id"] = normalized[member_id]
+                    member["updated_at"] = _now()
+                    changed += 1
+            members = _listify(ws.get("members"))
+            deduped = []
+            seen_members = set()
+            for member in members:
+                member_id = member.get("user_id")
+                if member_id and member_id in seen_members:
+                    changed += 1
+                    continue
+                if member_id:
+                    seen_members.add(member_id)
+                deduped.append(member)
+            if len(deduped) != len(members):
+                ws["members"] = deduped
+        if changed:
+            state["updated_at"] = _now()
+            self.save_state(state)
+            self.record_timeline_event("workspace", "identity_uuid_migrated", {"records": changed})
+        return changed
+
     def _default_state(self) -> Dict[str, Any]:
         return {
             "version": WORKSPACE_OS_VERSION,
@@ -351,23 +497,21 @@ class WorkspaceOSStore:
 
     def load_state(self) -> Dict[str, Any]:
         default = self._default_state()
-        if not self.state_path.exists():
-            self.save_state(default)
-            return default
-        try:
-            loaded = json.loads(self.state_path.read_text(encoding="utf-8"))
-            if not isinstance(loaded, dict):
-                loaded = {}
-        except Exception:
-            loaded = {}
+        loaded = self._load_sqlite_state()
+        imported = loaded is None
+        if loaded is None:
+            loaded = self._import_json_state_once(default)
         state = _deep_merge(default, loaded)
         state["version"] = WORKSPACE_OS_VERSION
         self._migrate_workspaces(state)
+        if imported:
+            self.save_state(state)
         return state
 
     def save_state(self, state: Dict[str, Any]) -> Dict[str, Any]:
         state["version"] = WORKSPACE_OS_VERSION
         state["updated_at"] = _now()
+        self._save_sqlite_state(state)
         _atomic_write_json(self.state_path, state)
         return state
 
@@ -382,7 +526,6 @@ class WorkspaceOSStore:
             "payload": payload,
         }
         state.setdefault("timeline", []).append(event)
-        state["timeline"] = state["timeline"][-500:]
         self.save_state(state)
         if self.event_sink is not None:
             try:
@@ -430,7 +573,10 @@ class WorkspaceOSStore:
             "version": WORKSPACE_OS_VERSION,
             "identity": state.get("identity"),
             "active_workspace": state.get("active_workspace"),
-            "workspaces": state.get("workspaces"),
+            # The raw workspace registry (with member lists) must not leak to
+            # non-members; WorkspaceService.summary() adds a membership-filtered
+            # "workspace_registry" instead.
+            "workspace_count": len(state.get("workspaces") or {}),
             "navigation": list(WORKSPACE_AREAS),
             "feature_flags": state.get("feature_flags"),
             "updated_at": state.get("updated_at"),
@@ -900,7 +1046,6 @@ class WorkspaceOSStore:
             **trace,
         }
         state.setdefault("traces", []).append(record)
-        state["traces"] = state["traces"][-200:]
         self.save_state(state)
         self.record_timeline_event("graph", "answer_trace", {"trace_id": trace_id, "conversation_id": conversation_id})
         return record
@@ -1042,7 +1187,6 @@ class WorkspaceOSStore:
             "indexed_folder_count": len(local_sources.get("sources") or []),
         }
         state.setdefault("snapshots", []).append(meta)
-        state["snapshots"] = state["snapshots"][-200:]
         self.save_state(state)
         self.record_timeline_event("snapshot", "snapshot_saved", {"snapshot_id": snapshot_id, "name": name})
         return {"snapshot": meta}
@@ -1086,6 +1230,52 @@ class WorkspaceOSStore:
         self.record_timeline_event("snapshot", "snapshot_exported", {"snapshot_id": snapshot_id, "path": str(export_path)})
         return {"snapshot_id": snapshot_id, "export_path": str(export_path), "bytes": export_path.stat().st_size}
 
+    def restore_snapshot(
+        self,
+        snapshot_id: str,
+        *,
+        graph: Any,
+        workspace_id: Optional[str] = None,
+        user_email: Optional[str] = None,
+    ) -> Dict[str, Any]:
+        """Restore a snapshot additively, preserving all current user data.
+
+        v4 snapshots are immutable checkpoints. Restoring one must not delete
+        newer graph nodes, chat history, memories, workspaces, or settings, so
+        this operation imports the snapshot graph in ``merge`` mode and records a
+        durable restore event. It is a real restore path for lost/missing graph
+        data, with rollback safety because current state remains intact.
+        """
+
+        snapshot = self.get_snapshot(snapshot_id)
+        scope = self._resolve_scope(workspace_id or snapshot.get("workspace_id"))
+        if graph is None or not hasattr(graph, "import_graph_data"):
+            raise ValueError("knowledge graph import is required for snapshot restore")
+        artifact = _snapshot_graph_import_payload(snapshot.get("graph") or {}, workspace_id=scope)
+        import_result = graph.import_graph_data(artifact, mode="merge", dry_run=False)
+        restore_id = f"restore-{datetime.now().strftime('%Y%m%d%H%M%S')}-{_json_hash([snapshot_id, scope, user_email, _now()])[:10]}"
+        record = {
+            "id": restore_id,
+            "snapshot_id": snapshot_id,
+            "workspace_id": scope,
+            "restored_at": _now(),
+            "restored_by": user_email,
+            "mode": "merge",
+            "graph": import_result,
+            "settings_preserved": True,
+            "chat_preserved": True,
+        }
+        state = self.load_state()
+        state.setdefault("snapshot_restores", []).append(record)
+        self.save_state(state)
+        self.record_timeline_event(
+            "snapshot",
+            "snapshot_restored",
+            {"snapshot_id": snapshot_id, "restore_id": restore_id, "mode": "merge", "graph": import_result},
+            workspace_id=scope,
+        )
+        return {"restored": True, "restore": record}
+
     def compare_snapshots(self, before_id: str, after_id: str) -> Dict[str, Any]:
         before = self.get_snapshot(before_id)
         after = self.get_snapshot(after_id)
@@ -1204,7 +1394,7 @@ class WorkspaceOSStore:
                 record["graph_error"] = str(exc)
         if existing is None:
             memories.append(record)
-        state["memories"] = memories[-500:]
+        state["memories"] = memories
         self.save_state(state)
         self.record_timeline_event("memory", "memory_upserted", {"memory_id": memory_id, "kind": kind}, workspace_id=record.get("workspace_id"))
         return record
@@ -1229,15 +1419,26 @@ class WorkspaceOSStore:
             ]
         return {"query": query, "memories": memories[: max(1, min(limit, 100))]}
 
+    def get_memory(self, memory_id: str) -> Dict[str, Any]:
+        record = next(
+            (item for item in _listify(self.load_state().get("memories")) if item.get("id") == memory_id),
+            None,
+        )
+        if record is None:
+            raise FileNotFoundError(memory_id)
+        return record
+
     def delete_memory(self, memory_id: str) -> Dict[str, Any]:
         state = self.load_state()
         memories = _listify(state.get("memories"))
-        kept = [item for item in memories if item.get("id") != memory_id]
-        if len(kept) == len(memories):
+        target = next((item for item in memories if item.get("id") == memory_id), None)
+        if target is None:
             raise FileNotFoundError(memory_id)
-        state["memories"] = kept
+        state["memories"] = [item for item in memories if item.get("id") != memory_id]
         self.save_state(state)
-        self.record_timeline_event("memory", "memory_deleted", {"memory_id": memory_id})
+        self.record_timeline_event(
+            "memory", "memory_deleted", {"memory_id": memory_id}, workspace_id=target.get("workspace_id")
+        )
         return {"status": "ok", "memory_id": memory_id}
 
     def create_memory_snapshot(
@@ -1269,7 +1470,6 @@ class WorkspaceOSStore:
             "created_at": _now(),
         }
         state.setdefault("memory_snapshots", []).append(snapshot)
-        state["memory_snapshots"] = state["memory_snapshots"][-200:]
         self.save_state(state)
         self.record_timeline_event("memory", "memory_snapshot", {"snapshot_id": snapshot["id"], "memory_count": len(memories)}, workspace_id=scope)
         return snapshot
@@ -1306,12 +1506,15 @@ class WorkspaceOSStore:
         memory_snapshots: Optional[List[Dict[str, Any]]] = None,
         graph: Any = None,
         workspace_id: Optional[str] = None,
+        mode: str = "simulation",
     ) -> Dict[str, Any]:
         state = self.load_state()
         resolved_workspace = self._resolve_scope(workspace_id, state)
         run = {
             "id": f"agent-run-{_json_hash([agent_id, input_text, output_text, _now()])[:16]}",
+            "record_schema_version": 2,
             "agent_id": agent_id,
+            "mode": mode,
             "status": status,
             "input": input_text,
             "output_preview": output_text[:1000],
@@ -1328,14 +1531,19 @@ class WorkspaceOSStore:
             "memory_snapshots": memory_snapshots or [],
             "created_at": _now(),
         }
-        if graph is not None:
+        if mode == "simulation":
+            # Simulated runs are replay scaffolding, not experiences — they must
+            # never enter the knowledge graph as real provenance.
+            run["graph_node_id"] = None
+            run["graph_skipped"] = "simulation runs are not recorded in the knowledge graph"
+        elif graph is not None:
             try:
                 ingested = graph.ingest_event(
                     "AgentRun",
                     f"{agent_id} {status}",
                     user_email=user_email,
                     source="workspace_os",
-                    metadata={"run_id": run["id"], "agent_id": agent_id, "status": status},
+                    metadata={"run_id": run["id"], "agent_id": agent_id, "status": status, "mode": mode},
                 )
                 run["graph_node_id"] = ingested.get("node_id")
             except Exception as exc:
@@ -1349,9 +1557,8 @@ class WorkspaceOSStore:
                     "workspace_id": resolved_workspace,
                 }
                 stored_handoffs.append(stored)
-            state["handoffs"] = stored_handoffs[-500:]
+            state["handoffs"] = stored_handoffs
         state.setdefault("agent_runs", []).append(run)
-        state["agent_runs"] = state["agent_runs"][-300:]
         self.save_state(state)
         self._emit_replayable_timeline_events(area="agent", run_id=run["id"], timeline=run["timeline"], workspace_id=resolved_workspace)
         if status == "failed":
@@ -1359,6 +1566,93 @@ class WorkspaceOSStore:
         self.record_timeline_event("agent", "agent_run", {"run_id": run["id"], "agent_id": agent_id, "status": status}, workspace_id=resolved_workspace)
         return run
 
+    def update_agent_run(
+        self,
+        run_id: str,
+        *,
+        workspace_id: Optional[str] = None,
+        graph: Any = None,
+        patch: Optional[Dict[str, Any]] = None,
+        **fields: Any,
+    ) -> Dict[str, Any]:
+        """Patch a persisted agent run without changing its id.
+
+        Async execution creates a durable queued/running row before work starts,
+        then updates that same row as progress, cancellation, or a terminal
+        result arrives. This keeps old run lists/read APIs compatible while
+        avoiding duplicate "placeholder + final" records.
+        """
+        updates = {**(patch or {}), **fields}
+        state = self.load_state()
+        run = next((item for item in _listify(state.get("agent_runs")) if item.get("id") == run_id), None)
+        if run is None or (workspace_id and self._record_workspace(run) != str(workspace_id)):
+            raise FileNotFoundError(run_id)
+        resolved_workspace = self._record_workspace(run)
+        old_timeline_len = len(run.get("timeline") or [])
+
+        output_text = updates.pop("output_text", None)
+        if output_text is not None:
+            run["output_preview"] = str(output_text)[:1000]
+        for key, value in updates.items():
+            run[key] = value
+        status = str(run.get("status") or "")
+        run["updated_at"] = _now()
+        if status in RUN_TERMINAL_STATUSES:
+            run.setdefault("completed_at", _now())
+
+        handoffs = updates.get("handoffs")
+        if isinstance(handoffs, list):
+            stored_handoffs = [
+                item for item in _listify(state.get("handoffs"))
+                if item.get("run_id") != run_id
+            ]
+            for handoff in handoffs:
+                if isinstance(handoff, dict):
+                    stored_handoffs.append({**handoff, "run_id": run_id, "workspace_id": resolved_workspace})
+            state["handoffs"] = stored_handoffs
+
+        if (
+            status in RUN_TERMINAL_STATUSES
+            and run.get("mode") != "simulation"
+            and graph is not None
+            and not run.get("graph_node_id")
+        ):
+            try:
+                ingested = graph.ingest_event(
+                    "AgentRun",
+                    f"{run.get('agent_id')} {status}",
+                    user_email=run.get("user_email"),
+                    source="workspace_os",
+                    metadata={
+                        "run_id": run_id,
+                        "agent_id": run.get("agent_id"),
+                        "status": status,
+                        "mode": run.get("mode"),
+                    },
+                )
+                run["graph_node_id"] = ingested.get("node_id")
+            except Exception as exc:
+                run["graph_error"] = str(exc)
+
+        self.save_state(state)
+
+        timeline = run.get("timeline") or []
+        if len(timeline) > old_timeline_len:
+            self._emit_replayable_timeline_events(
+                area="agent",
+                run_id=run_id,
+                timeline=timeline[old_timeline_len:],
+                workspace_id=resolved_workspace,
+            )
+        if status == "failed":
+            self._emit_execution_event(area="agent", event_type="execution_failed", payload={"run_id": run_id, "agent_id": run.get("agent_id"), "status": status}, workspace_id=resolved_workspace)
+        elif status == "cancelled":
+            self._emit_execution_event(area="agent", event_type="execution_cancelled", payload={"run_id": run_id, "agent_id": run.get("agent_id"), "status": status}, workspace_id=resolved_workspace)
+        elif status == "interrupted":
+            self._emit_execution_event(area="agent", event_type="execution_interrupted", payload={"run_id": run_id, "agent_id": run.get("agent_id"), "status": status}, workspace_id=resolved_workspace)
+        self.record_timeline_event("agent", "agent_run_update", {"run_id": run_id, "agent_id": run.get("agent_id"), "status": status}, workspace_id=resolved_workspace)
+        return run
+
     def get_agent_run(self, run_id: str, workspace_id: Optional[str] = None) -> Dict[str, Any]:
         run = next((item for item in _listify(self.load_state().get("agent_runs")) if item.get("id") == run_id), None)
         if not run or (workspace_id and self._record_workspace(run) != str(workspace_id)):
@@ -1411,7 +1705,6 @@ class WorkspaceOSStore:
             except Exception as exc:
                 workflow["graph_error"] = str(exc)
         state.setdefault("workflows", []).append(workflow)
-        state["workflows"] = state["workflows"][-300:]
         self.save_state(state)
         self.record_timeline_event("workflow", "workflow_created", {"workflow_id": workflow["id"], "name": workflow["name"]})
         return workflow
@@ -1427,14 +1720,18 @@ class WorkspaceOSStore:
         user_email: Optional[str] = None,
         graph: Any = None,
         workspace_id: Optional[str] = None,
+        mode: str = "simulation",
+        pause: Optional[Dict[str, Any]] = None,
     ) -> Dict[str, Any]:
         """Persist a Workflow Designer execution into local-first run history."""
         state = self.load_state()
         resolved_workspace = self._resolve_scope(workspace_id, state)
         run = {
             "id": f"workflow-run-{_json_hash([workflow_id, name, status, _now()])[:16]}",
+            "record_schema_version": 2,
             "workflow_id": workflow_id,
             "name": name or "workflow",
+            "mode": mode,
             "status": status,
             "timeline": timeline or [],
             "outputs": outputs or {},
@@ -1442,20 +1739,26 @@ class WorkspaceOSStore:
             "workspace_id": resolved_workspace,
             "created_at": _now(),
         }
-        if graph is not None:
+        if pause:
+            run["pause"] = pause
+        if mode == "simulation":
+            # Record-only node runners do no real work; their runs must not be
+            # written into the knowledge graph as if they were real executions.
+            run["graph_node_id"] = None
+            run["graph_skipped"] = "simulation runs are not recorded in the knowledge graph"
+        elif graph is not None:
             try:
                 ingested = graph.ingest_event(
                     "WorkflowRun",
                     f"{run['name']} {status}",
                     user_email=user_email,
                     source="workspace_os",
-                    metadata={"run_id": run["id"], "workflow_id": workflow_id, "status": status},
+                    metadata={"run_id": run["id"], "workflow_id": workflow_id, "status": status, "mode": mode},
                 )
                 run["graph_node_id"] = ingested.get("node_id")
             except Exception as exc:
                 run["graph_error"] = str(exc)
         state.setdefault("workflow_runs", []).append(run)
-        state["workflow_runs"] = state["workflow_runs"][-300:]
         # Attach the run id to the workflow's event log for cross-linking.
         for wf in _listify(state.get("workflows")):
             if wf.get("id") == workflow_id:
@@ -1472,18 +1775,164 @@ class WorkspaceOSStore:
         self.record_timeline_event("workflow", "workflow_run", {"run_id": run["id"], "workflow_id": workflow_id, "status": status}, workspace_id=resolved_workspace)
         return run
 
+    def update_workflow_run(
+        self,
+        run_id: str,
+        *,
+        workspace_id: Optional[str] = None,
+        graph: Any = None,
+        patch: Optional[Dict[str, Any]] = None,
+        **fields: Any,
+    ) -> Dict[str, Any]:
+        """Patch a persisted workflow run in place for async execution."""
+        updates = {**(patch or {}), **fields}
+        state = self.load_state()
+        run = next((item for item in _listify(state.get("workflow_runs")) if item.get("id") == run_id), None)
+        if run is None or (workspace_id and self._record_workspace(run) != str(workspace_id)):
+            raise FileNotFoundError(run_id)
+        resolved_workspace = self._record_workspace(run)
+        old_timeline_len = len(run.get("timeline") or [])
+
+        for key, value in updates.items():
+            if value is None and key == "pause":
+                run.pop("pause", None)
+            else:
+                run[key] = value
+        status = str(run.get("status") or "")
+        run["updated_at"] = _now()
+        if status in RUN_TERMINAL_STATUSES:
+            run.setdefault("completed_at", _now())
+
+        workflow_id = run.get("workflow_id")
+        for wf in _listify(state.get("workflows")):
+            if wf.get("id") == workflow_id:
+                wf.setdefault("events", []).append({"type": "run_update", "timestamp": _now(), "payload": {"run_id": run_id, "status": status}})
+                wf["updated_at"] = _now()
+                break
+
+        if (
+            status in RUN_TERMINAL_STATUSES
+            and run.get("mode") != "simulation"
+            and graph is not None
+            and not run.get("graph_node_id")
+        ):
+            try:
+                ingested = graph.ingest_event(
+                    "WorkflowRun",
+                    f"{run.get('name')} {status}",
+                    user_email=run.get("user_email"),
+                    source="workspace_os",
+                    metadata={
+                        "run_id": run_id,
+                        "workflow_id": workflow_id,
+                        "status": status,
+                        "mode": run.get("mode"),
+                    },
+                )
+                run["graph_node_id"] = ingested.get("node_id")
+            except Exception as exc:
+                run["graph_error"] = str(exc)
+
+        self.save_state(state)
+
+        timeline = run.get("timeline") or []
+        if len(timeline) > old_timeline_len:
+            self._emit_replayable_timeline_events(
+                area="workflow",
+                run_id=run_id,
+                timeline=timeline[old_timeline_len:],
+                workspace_id=resolved_workspace,
+            )
+        if status == "failed":
+            self._emit_execution_event(area="workflow", event_type="execution_failed", payload={"run_id": run_id, "workflow_id": workflow_id, "status": status}, workspace_id=resolved_workspace)
+        elif status in {"ok", "partial"}:
+            self._emit_execution_event(area="workflow", event_type="workflow_completed", payload={"run_id": run_id, "workflow_id": workflow_id, "status": status}, workspace_id=resolved_workspace)
+        elif status == "cancelled":
+            self._emit_execution_event(area="workflow", event_type="execution_cancelled", payload={"run_id": run_id, "workflow_id": workflow_id, "status": status}, workspace_id=resolved_workspace)
+        elif status == "interrupted":
+            self._emit_execution_event(area="workflow", event_type="execution_interrupted", payload={"run_id": run_id, "workflow_id": workflow_id, "status": status}, workspace_id=resolved_workspace)
+        self.record_timeline_event("workflow", "workflow_run_update", {"run_id": run_id, "workflow_id": workflow_id, "status": status}, workspace_id=resolved_workspace)
+        return run
+
     def list_workflow_runs(self, workflow_id: Optional[str] = None, limit: int = 50, workspace_id: Optional[str] = None) -> Dict[str, Any]:
         runs = self._scoped(_listify(self.load_state().get("workflow_runs")), workspace_id)
         if workflow_id:
             runs = [run for run in runs if run.get("workflow_id") == workflow_id]
         return {"runs": list(reversed(runs[-max(1, min(limit, 300)):]))}
 
+    def mark_workflow_run_resolved(
+        self, run_id: str, *, resumed_run_id: str, approved: bool,
+        workspace_id: Optional[str] = None,
+    ) -> Dict[str, Any]:
+        """Close out a paused run after its approval decision (one decision only)."""
+        state = self.load_state()
+        run = next((item for item in _listify(state.get("workflow_runs")) if item.get("id") == run_id), None)
+        if run is None or (workspace_id and self._record_workspace(run) != str(workspace_id)):
+            raise FileNotFoundError(run_id)
+        run["status"] = "resumed" if approved else "denied"
+        run["resolved_at"] = _now()
+        run["resumed_run_id"] = resumed_run_id
+        self.save_state(state)
+        return run
+
     def get_workflow_run(self, run_id: str, workspace_id: Optional[str] = None) -> Dict[str, Any]:
         run = next((item for item in _listify(self.load_state().get("workflow_runs")) if item.get("id") == run_id), None)
         if not run or (workspace_id and self._record_workspace(run) != str(workspace_id)):
             raise FileNotFoundError(run_id)
         return run
 
+    def reconcile_interrupted_runs(self, *, reason: str = "server_startup") -> Dict[str, Any]:
+        """Mark durable active runs as interrupted after a process restart.
+
+        Queued/running/cancelling rows cannot have an owning asyncio task after
+        startup. Paused approval runs are intentionally left untouched so their
+        durable human decision cursor remains resumable.
+        """
+        state = self.load_state()
+        interrupted: List[Dict[str, Any]] = []
+        now = _now()
+        collections = (("agent_runs", "agent"), ("workflow_runs", "workflow"))
+        for key, area in collections:
+            for run in _listify(state.get(key)):
+                status = str(run.get("status") or "")
+                if status not in RUN_ACTIVE_STATUSES:
+                    continue
+                run["status"] = "interrupted"
+                run["interrupted_at"] = now
+                run["interrupt_reason"] = reason
+                run["updated_at"] = now
+                run.setdefault("timeline", []).append({
+                    "event": "execution_interrupted",
+                    "status": "interrupted",
+                    "reason": reason,
+                    "timestamp": now,
+                })
+                interrupted.append({
+                    "kind": area,
+                    "run_id": run.get("id"),
+                    "workspace_id": self._record_workspace(run),
+                    "previous_status": status,
+                })
+        if not interrupted:
+            return {"count": 0, "interrupted": []}
+        self.save_state(state)
+        for item in interrupted:
+            area = item["kind"]
+            run_id = item["run_id"]
+            workspace = item.get("workspace_id")
+            self._emit_execution_event(
+                area=area,
+                event_type="execution_interrupted",
+                payload={"run_id": run_id, "reason": reason, "previous_status": item.get("previous_status")},
+                workspace_id=workspace,
+            )
+        self.record_timeline_event(
+            "system",
+            "startup_reconciliation",
+            {"interrupted_runs": len(interrupted), "reason": reason},
+        )
+        return {"count": len(interrupted), "interrupted": interrupted}
+
     @staticmethod
     def _replay_frames(run: Dict[str, Any], *, kind: str) -> List[Dict[str, Any]]:
         frames = []
@@ -1699,7 +2148,6 @@ class WorkspaceOSStore:
             **activity,
         }
         config.setdefault("activities", []).append(record)
-        config["activities"] = config["activities"][-500:]
         if graph is not None:
             try:
                 graph.ingest_event(