AbstractRuntime 0.15.1__tar.gz → 0.15.3__tar.gz

{abstractruntime-0.15.1 → abstractruntime-0.15.3}/CHANGELOG.md

@@ -7,11 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.15.3] - 2026-10-29
+
+### Fixed
+
+- **An index build no longer announces its journal replay as changes** (`JsonFileRunStore`; a 0.15.2 regression).
+  0.15.2's first sync after a build re-applies the journal tail before the build's mark (backlog 0863) and noted every
+  replayed record on the change ring: a plain read (`list_run_index`, `warm_session_index`) moved `change_token` and
+  `changed_run_ids` then named every run in the tail as changed, so a change-driven consumer re-read every run after
+  each build (the gateway's mail notification check loaded all 400 finished runs of its index test on every full
+  pass: AbstractGateway backlog 0965, red CI since 0.15.2). Replayed records are still filed into the session,
+  children and active indexes (the 0863 guarantee stands). A replay is quiet only when it says nothing new: its file
+  was known to the store at the build's mark (the scan memo, the sidecar included) and is unchanged since; a file
+  that landed or changed during the build (the record precedes the file, J53-1), a known run now gone, and every
+  record after the mark are announced as before, so a consumer whose token already covers the record still learns
+  of it; a store with no sidecar announces its first replay (a bounded one-off). Tests:
+  `tests/test_json_file_run_store_change_token_after_build.py` (red on 0.15.2).
+
+## [0.15.2] - 2026-10-28
+
+### Fixed
+
+- **An index build no longer loses a run another store object creates during it** (`JsonFileRunStore`, backlog 0863).
+  A new run's `+` journal line is written before its file is published; a session/children/active index build that
+  marked the journal between the two and scanned the folder before the file landed missed the run: the listing until
+  the next reconciliation, the session and children indexes for the life of the store object (the reconciliation
+  repaired only the listing). Seen as a gateway that answered 404 `session_not_found` when archiving a session written
+  while it booted (AbstractGateway backlog 0963); a split-mode runner creating a run during the API process's boot
+  hit the same window. The first sync after a build now re-applies the journal's last 16 KiB before the build's mark
+  (`JOURNAL_REPLAY_TAIL_BYTES`; idempotent, once per build), and the reconciliation re-files a run it repairs into
+  the session and children indexes too (and drops a vanished one from them).
+
 ## [0.15.1] - 2026-10-28
 
 ### Changed
 
-- **Is Empty (`is_empty_string`) accepts lists.** Nothing (unset / `None`), an empty text, and a list, tuple, set or object with no elements are empty; whitespace, `0`, `False` and a list with any element are not. Before, a list was turned into text (`"[]"`) and was never empty, so a flow checking a list variable needed Array Length + Compare (operator QA 2026-10-28, the email-triage flow). Backlog 0857. AbstractFlow lets the node take a list once this is released.
+- **Is Empty (`is_empty_string`) accepts lists.** Nothing (unset / `None`), an empty text, and a list, tuple, set or object with no elements are empty; whitespace, `0`, `False` and a list with any element are not. Before, a list was turned into text (`"[]"`) and was never empty, so a flow checking a list variable needed Array Length + Compare (operator QA 2026-10-28, the email-triage flow). Backlog 0862 (numbered 0857 in the 0.15.1 package). AbstractFlow lets the node take a list once this is released.
 
 ## [0.15.0] - 2026-10-28
 

{abstractruntime-0.15.1 → abstractruntime-0.15.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: AbstractRuntime
-Version: 0.15.1
+Version: 0.15.3
 Summary: AbstractRuntime: a durable graph runner designed to pair with AbstractCore.
 Project-URL: AbstractCore (website), https://www.abstractcore.ai/
 Project-URL: AbstractRuntime (GitHub), https://github.com/lpalbou/abstractruntime
@@ -55,14 +55,27 @@ Description-Content-Type: text/markdown
 
 It is designed for long-running workflows that must survive restarts and explicitly model blocking (human input, timers, external events, subworkflows) without keeping Python stacks alive.
 
-**Version:** 0.15.1 • **Python:** 3.10+
+**Version:** 0.15.3 • **Python:** 3.10+
 
 **Status:** pre-1.0 (API may evolve). For production use, pin versions and follow `CHANGELOG.md`.
 
+## What's new in 0.15.3
+
+- **A run-store index build no longer announces its journal replay as changes**: a plain read (`list_run_index`,
+  `warm_session_index`) leaves `change_token` and `changed_run_ids` untouched, so a change-driven consumer (the
+  gateway's mail notification check) no longer re-reads every finished run after each build (a 0.15.2 regression;
+  AbstractGateway backlog 0965). A file that landed during the build and a known run that vanished are still announced.
+
+## What's new in 0.15.2
+
+- **Run index builds never lose a run created during them**: a run another process (or store object) wrote while
+  this store built its indexes is in the session and children indexes and the listing at once (before, the session
+  index could miss it for the life of the store object; backlog 0863).
+
 ## What's new in 0.15.1
 
 - **Is Empty accepts lists**: nothing, an empty text, or a list or object with no elements is empty (visual-flow
-  node `is_empty_string`; backlog 0857).
+  node `is_empty_string`; backlog 0862).
 
 ## What's new in 0.15.0
 

{abstractruntime-0.15.1 → abstractruntime-0.15.3}/README.md

@@ -4,14 +4,27 @@
 
 It is designed for long-running workflows that must survive restarts and explicitly model blocking (human input, timers, external events, subworkflows) without keeping Python stacks alive.
 
-**Version:** 0.15.1 • **Python:** 3.10+
+**Version:** 0.15.3 • **Python:** 3.10+
 
 **Status:** pre-1.0 (API may evolve). For production use, pin versions and follow `CHANGELOG.md`.
 
+## What's new in 0.15.3
+
+- **A run-store index build no longer announces its journal replay as changes**: a plain read (`list_run_index`,
+  `warm_session_index`) leaves `change_token` and `changed_run_ids` untouched, so a change-driven consumer (the
+  gateway's mail notification check) no longer re-reads every finished run after each build (a 0.15.2 regression;
+  AbstractGateway backlog 0965). A file that landed during the build and a known run that vanished are still announced.
+
+## What's new in 0.15.2
+
+- **Run index builds never lose a run created during them**: a run another process (or store object) wrote while
+  this store built its indexes is in the session and children indexes and the listing at once (before, the session
+  index could miss it for the life of the store object; backlog 0863).
+
 ## What's new in 0.15.1
 
 - **Is Empty accepts lists**: nothing, an empty text, or a list or object with no elements is empty (visual-flow
-  node `is_empty_string`; backlog 0857).
+  node `is_empty_string`; backlog 0862).
 
 ## What's new in 0.15.0
 

{abstractruntime-0.15.1 → abstractruntime-0.15.3}/docs/backlog/README.md

@@ -12,12 +12,14 @@ If you are new to the project, start with `../README.md` and `../architecture.md
 
 ## Counts
 
+2026-10-28: +1 proposed, 0862 (a message's artifacts list the run's offloaded bookkeeping; one listed ref is missing from `view.artifacts`), found by the desktop Assistant QA (AbstractAssistant 1067).
+
 2026-10-28: +2 proposed, 0860 (the view does not say how a run was stopped; the gateway does not advertise the view) and 0861 (tool sandbox and per-call model timings missing from view activities), found by AbstractUIC 0040 (panel-chat renders the replay view).
 
 2026-10-28: recounted from disk (deprecated was 13 in this block, 14 on disk); +1 planned for 0858 (root 1063, typed runs); +1 planned for 0859 (ephemeral live-text deltas on the view stream, gateway 0954).
 
 - Planned: 34
-- Proposed: 16
+- Proposed: 17
 - Completed: 39
 - Deprecated: 14
 - Recurrent: 0
@@ -97,7 +99,8 @@ mtime). The anticipated ADR ("an automation is its controller root run") is not
 
 | ID | Item |
 |----|------|
-| 0857 | [Is Empty accepts lists](completed/0857_is_empty_accepts_lists.md): completed 2026-10-28, released in abstractruntime 0.15.1 (PR #15); `is_empty_string` treats nothing, "" and a list/tuple/set/object with no elements as empty (operator QA 2026-10-28, AbstractFlow backlog 0160). |
+| 0863 | [An index build never loses a run created during it](completed/0863_index_build_never_loses_a_run_created_during_it.md): completed 2026-10-28, released in abstractruntime 0.15.2; the first sync after an index build re-applies the journal's last 16 KiB (gateway backlog 0963, the flaky archive test). |
+| 0862 | [Is Empty accepts lists](completed/0862_is_empty_accepts_lists.md): completed 2026-10-28, released in abstractruntime 0.15.1 (PR #15); `is_empty_string` treats nothing, "" and a list/tuple/set/object with no elements as empty (operator QA 2026-10-28, AbstractFlow backlog 0160). |
 | 0856 | [Memory facade and ledger provenance](completed/0856_memory_facade_and_ledger_provenance.md): completed 2026-10-27, released in abstractruntime 0.15.0 (2026-10-28, PR #6 merge `88a584b`; floor AbstractMemory>=0.4.0); ADR 0011: `MemoryFacade` (open a mind, stamp, reconstruct a source), `LedgerStore.get_record(run_id, seq)` (JSON-file line-offset index), the step context, a `step` ref on every memory write the runtime performs, `MEMORY_REVISE` / node `memory_revise`. Follow-up 0857. |
 | 0851 | [Per-account voice stores](completed/0851_per_account_voice_stores.md): completed 2026-10-27 (0.13.0); the runtime's voice catalog and voice library use its `voice_store_dir` / `voice_library_dirs`; real-weights E2E 9/9. |
 | 0852 | [Capability refusals are not retried](completed/0852_capability_refusals_are_not_retried.md): completed 2026-10-27 (0.13.0); one engine call for a refused request. |

abstractruntime-0.15.1/docs/backlog/completed/0857_is_empty_accepts_lists.md → abstractruntime-0.15.3/docs/backlog/completed/0862_is_empty_accepts_lists.md

@@ -1,7 +1,7 @@
-# 0857 — Is Empty accepts lists (nothing or no elements = empty)
+# 0862 — Is Empty accepts lists (nothing or no elements = empty)
 
 **Status**: completed 2026-10-28, released in abstractruntime 0.15.1 (PR #15; released on the release lead's decision;
-the gateway floor stays >=0.15.0, the root pins 0.15.1) · **Priority**: P2 · **Created**: 2026-10-28
+the gateway floor stays >=0.15.0, the root pins 0.15.1) · **Priority**: P2 · **Created**: 2026-10-28 · Numbered 0857 at release (a clash with planned 0857, renumbered 2026-10-28)
 **Cross-package**: AbstractFlow backlog 0160 (operator QA 2026-10-28 item (e)); the Flow editor lets Is Empty take a
 list only after this is released (branch `fix/is-empty-lists` there).
 

abstractruntime-0.15.3/docs/backlog/completed/0863_index_build_never_loses_a_run_created_during_it.md

@@ -0,0 +1,48 @@
+# 0863 — An index build never loses a run another store object creates during it
+
+**Status**: completed 2026-10-28, released in abstractruntime 0.15.2 · **Priority**: P1 · **Created**: 2026-10-28
+**Cross-package**: AbstractGateway backlog 0963 (the flaky `test_runs_reads_archive_and_kinds_once_and_sees_its_own_writes`,
+404 `session_not_found` on one CI job per run; it blocked the gateway 0.17.2 PR and release runs).
+
+## Why
+`JsonFileRunStore._save` appends a new run's `+id` journal line BEFORE it publishes the run file (J53-1: a crash after
+publication can never hide a run). An index build (`_ensure_session_index`, `_ensure_children_index`, the active
+index; `warm_session_index` at a host's boot) marks the journal offset (`_mark_journal_start`) and then scans the
+folder. A run created by ANOTHER store object (another process: a split-mode runner during the API process's boot;
+or another object in the same process) whose `+` line landed before the mark and whose file landed after the scan
+was in neither: the trusted listing memo missed it until the next reconciliation, and the session and children
+indexes for the life of the store object (the reconciliation repaired only the memo and the active set). In the gateway, `POST /sessions/{id}/archive` answered 404
+`session_not_found` for a session just written (`session_exists` -> `list_run_index(session_id=...)`).
+
+## Change
+`_mark_journal_start` sets the first sync's offset to `_journal_replay_start(size)`: the first record boundary within
+`JOURNAL_REPLAY_TAIL_BYTES` (16 KiB, ~400 records) before the journal's size at the mark, instead of the size itself.
+The build syncs right after its scan, so those records are re-applied at once; applying is idempotent (a `+` whose
+file exists is filed again; one whose file is still absent stays pending, as for any `+`, until the file appears).
+The reconciliation (`_scan_active_ids`) now re-files every run it repairs into the session and children indexes
+and drops a vanished run from them (review finding: it repaired only the memo and the active set).
+
+Chosen over "a `+` whose file was absent at scan time stays pending": that needs the build to know which `+` lines
+precede the mark, i.e. to read the journal before the mark anyway; the tail replay reuses the existing, tested
+pending path unchanged. Cost: one read of at most 16 KiB and one stat per record in it, once per index build (a
+build happens at boot or after a journal rewrite). Failure mode: a run whose `+` is more than ~400 records before
+the mark and still unpublished after the scan (a publication takes milliseconds) is caught by the periodic
+reconciliation, which logs what it repairs and now re-files it in every index; an unreadable tail logs a warning and replays nothing (the previous
+behaviour).
+
+## Evidence
+- `tests/test_json_file_run_store_index_build_race.py`: another store object's new run, with this store's index
+  build run between its `+` line and its publication, is listed by `list_run_index(session_id=...)` and by the
+  root listing; with a 50 KB journal the replay is bounded to the tail and starts on a record boundary. These 2:
+  2 failed with the previous `json_files.py`. The file (3 tests): 20/20 plain runs and 20/20 beside 12 CPU-busy processes passed.
+- `test_the_reconciliation_refiles_a_run_the_session_and_children_indexes_missed`: a miss beyond the tail is
+  repaired by `rescan_active_index()` into the session index; red with the re-file removed.
+- Adversarial review (Opus, read-only): all index kinds covered (session, children, active, the memo; event-wait
+  and mailbox indexes refresh from the active set); record boundaries never parse a bogus record; the rewind
+  happens once per store object; re-application of `-`, `~`, `=` and this store's own records is safe. Fixed: the
+  claim that the reconciliation caught a miss (it did not repair the session/children indexes; now it does).
+  Recorded: a build's replay bumps the change counter once for the replayed runs (one incremental pass of the
+  gateway's notifications collector over ~400 runs per build).
+- The gateway's previous test order (runs written while the boot warm-up builds the index), with the window between
+  `+` and publication widened to 0.3 s: 3/3 failed with AbstractRuntime 0.15.1 (the CI's exact 404), 5/5 passed with
+  this change.

abstractruntime-0.15.3/docs/backlog/proposed/0862_replay_view_message_artifacts_exclude_bookkeeping.md

@@ -0,0 +1,48 @@
+# 0862 — Replay view: a message's artifacts are what the run produced, not its offloaded bookkeeping
+
+**Status**: proposed · **Priority**: P2 · **Created**: 2026-10-28
+**Package**: abstractruntime (`replay/view.py` `_final_message` / `_note_artifacts` / `_artifact_refs`; the run-output and node-trace offload)
+**Parent**: 0854 (replay view) · **Found by**: operator QA 2026-10-28 (b) on the desktop Assistant (AbstractAssistant backlog 1067)
+
+## Problem
+
+An automation answer in the desktop Assistant showed two chips named by raw ids (`7c8efef…`, `f738932…`); opening
+one failed with "artifact not found". Evidence (operator data dir, run `68c30dd3…`, session
+`automation:7f7613b4…`, AbstractRuntime 0.15.0, AbstractGateway 0.17.0):
+
+1. **The final message lists bookkeeping as its artifacts.** `_final_message(..., refs=_artifact_refs(output))`
+   takes EVERY `$artifact` under the completion output. An agent's output carries `scratchpad`; the runtime
+   offloads its large values into the artifact store, so the message's `artifact_ids` were the agent's system
+   prompt (`text/plain`, 4,340 B, tag `source=node_trace_offload`, path
+   `output.scratchpad.node_traces.reason.steps[0].result.metadata._provider_request.payload.messages[0].content`)
+   and its step list (`application/json`, 145,460 B, `source=run_output_offload`, path `output.scratchpad.steps`).
+   Neither is something the person asked for.
+2. **`view.artifacts` misses a ref the message lists.** `_note_artifacts` walks the completion RESULT, one level
+   above the output `_final_message` walks; the system-prompt ref sits at depth 12 from the result, and
+   `_artifact_refs` stops at `_MAX_WALK_DEPTH = 12`. The message names an artifact the view does not describe
+   (no path, no owning run): a client cannot label it or know which run serves it.
+3. **The offload belongs to a child run.** The system-prompt artifact's `run_id` is the agent's child run
+   (`d072afe8…`, parent chain under the root), with no `session_id` tag; the gateway's content route serves an
+   artifact only through its own run or the session's memory run (`_assert_artifact_visible_to_run`), so a client
+   asking through the root run gets 404 "artifact not found" although the blob exists.
+
+4. **The snapshot-built final has the same problem, unlisted.** When no completion record was folded,
+   `_finalize` builds `:final` from `snapshot.output_artifacts` (every ref under the output, bookkeeping included)
+   and lists none of them in `view.artifacts`, so a client cannot tell an image from a scratchpad offload.
+
+## Proposal
+
+- A message's `artifact_ids` exclude refs under the run's bookkeeping (`scratchpad`, node traces, `_`-prefixed
+  metadata such as `_provider_request`, `_runtime_observability`), or carry a `role` per artifact
+  (`output` / `bookkeeping`) so every client applies one rule. Conformance case: an agent completion whose output
+  holds offloaded scratchpad values and one real `image_artifact`.
+- `_note_artifacts` and the message walk use the same root and depth bound, so every id a message lists is in
+  `view.artifacts` (invariant: `message.artifact_ids ⊆ {a.id for a in view.artifacts}`).
+- Offloads made for a run in a session carry the session (tag or descriptor), so the gateway can serve a child
+  run's artifact through the root run of the same session; or the view's artifact entry names its owning run (it
+  does: `run_id`) and clients are told to use it (AbstractAssistant 0.16.3 does).
+
+## Client status
+
+AbstractAssistant 0.16.3 drops listed bookkeeping refs, and unlisted refs of a ledger-folded final, on its side (a snapshot-built final keeps its unlisted refs) and opens each artifact through its
+owning run; AbstractUIC panel-chat and the iPhone/watch clients should apply the same rule until this lands.

{abstractruntime-0.15.1 → abstractruntime-0.15.3}/llms-full.txt

@@ -55,14 +55,27 @@ See llms.txt for the linked index.
 
 It is designed for long-running workflows that must survive restarts and explicitly model blocking (human input, timers, external events, subworkflows) without keeping Python stacks alive.
 
-**Version:** 0.15.1 • **Python:** 3.10+
+**Version:** 0.15.3 • **Python:** 3.10+
 
 **Status:** pre-1.0 (API may evolve). For production use, pin versions and follow `CHANGELOG.md`.
 
+## What's new in 0.15.3
+
+- **A run-store index build no longer announces its journal replay as changes**: a plain read (`list_run_index`,
+  `warm_session_index`) leaves `change_token` and `changed_run_ids` untouched, so a change-driven consumer (the
+  gateway's mail notification check) no longer re-reads every finished run after each build (a 0.15.2 regression;
+  AbstractGateway backlog 0965). A file that landed during the build and a known run that vanished are still announced.
+
+## What's new in 0.15.2
+
+- **Run index builds never lose a run created during them**: a run another process (or store object) wrote while
+  this store built its indexes is in the session and children indexes and the listing at once (before, the session
+  index could miss it for the life of the store object; backlog 0863).
+
 ## What's new in 0.15.1
 
 - **Is Empty accepts lists**: nothing, an empty text, or a list or object with no elements is empty (visual-flow
-  node `is_empty_string`; backlog 0857).
+  node `is_empty_string`; backlog 0862).
 
 ## What's new in 0.15.0
 

{abstractruntime-0.15.1 → abstractruntime-0.15.3}/llms.txt

@@ -3,7 +3,7 @@
 > Durable workflow runtime (interrupt → checkpoint → resume) with an append-only execution ledger.
 
 - Python: 3.10+ (see `pyproject.toml`)
-- Version: 0.15.1
+- Version: 0.15.3
 - Ecosystem: [AbstractFramework](https://github.com/lpalbou/AbstractFramework) umbrella, integrates with [AbstractCore](https://github.com/lpalbou/abstractcore)
 - Hard invariant: `RunState.vars` must be JSON-serializable (`src/abstractruntime/core/models.py`)
 - Current AbstractCore baseline: base `abstractruntime` requires AbstractCore 2.30.0 or newer with its light install (remote providers, tools and the MCP worker, media routing); `abstractruntime[apple]` and `abstractruntime[gpu]` require AbstractCore's `apple` and `gpu` settings (`pyproject.toml`)

{abstractruntime-0.15.1 → abstractruntime-0.15.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "AbstractRuntime"
-version = "0.15.1"
+version = "0.15.3"
 description = "AbstractRuntime: a durable graph runner designed to pair with AbstractCore."
 readme = "README.md"
 requires-python = ">=3.10"

abstractruntime-0.15.3/release-notes.md

@@ -0,0 +1,14 @@
+### Fixed
+
+- **An index build no longer announces its journal replay as changes** (`JsonFileRunStore`; a 0.15.2 regression).
+  0.15.2's first sync after a build re-applies the journal tail before the build's mark (backlog 0863) and noted every
+  replayed record on the change ring: a plain read (`list_run_index`, `warm_session_index`) moved `change_token` and
+  `changed_run_ids` then named every run in the tail as changed, so a change-driven consumer re-read every run after
+  each build (the gateway's mail notification check loaded all 400 finished runs of its index test on every full
+  pass: AbstractGateway backlog 0965, red CI since 0.15.2). Replayed records are still filed into the session,
+  children and active indexes (the 0863 guarantee stands). A replay is quiet only when it says nothing new: its file
+  was known to the store at the build's mark (the scan memo, the sidecar included) and is unchanged since; a file
+  that landed or changed during the build (the record precedes the file, J53-1), a known run now gone, and every
+  record after the mark are announced as before, so a consumer whose token already covers the record still learns
+  of it; a store with no sidecar announces its first replay (a bounded one-off). Tests:
+  `tests/test_json_file_run_store_change_token_after_build.py` (red on 0.15.2).

{abstractruntime-0.15.1 → abstractruntime-0.15.3}/src/abstractruntime/storage/json_files.py

@@ -130,6 +130,10 @@ class JsonFileRunStore(RunStore):
     # A run temp file older than this is an orphan of a crashed writer (a
     # save()/create_if_absent() publishes its temp within milliseconds).
     STALE_TEMP_AGE_S = 600.0
+    # An index build re-applies the journal records written in this many bytes BEFORE its mark
+    # (`_mark_journal_start`; ~400 records): a run whose `+` line landed before the mark while its
+    # file was published after the folder scan is otherwise in neither (gateway backlog 0963).
+    JOURNAL_REPLAY_TAIL_BYTES = 16 * 1024
     # Background reconciliation of the active index (foreign writers that bypass the journal).
     ACTIVE_INDEX_RESCAN_S = 60.0
     # Trusted run index: with the folder and the creation log unchanged since the last
@@ -184,6 +188,16 @@ class JsonFileRunStore(RunStore):
         self._journal_path = self._base / ".runs_created.log"
         self._journal_lock = threading.Lock()
         self._journal_offset: Optional[int] = None
+        # The journal's size when an index build marked it (`_mark_journal_start`): records
+        # before it are REPLAYED by the first sync (filed into the indexes, nothing announced:
+        # they predate the build's scan, which already read their files, or are this store's own
+        # saves, announced when they happened). Only records after it are changes.
+        self._journal_replay_mark: int = 0
+        # What this store knew when it marked: {run id: file identity token} from the scan memo
+        # (the sidecar included). A replayed record is quiet only for a file known then and
+        # unchanged since; anything else (a file that landed or changed during the build, a known
+        # run now gone) is announced like any change.
+        self._journal_replay_known: Dict[str, tuple] = {}
         from collections import deque as _deque
 
         self._journal_own_appends: Any = _deque(maxlen=8192)
@@ -701,6 +715,7 @@ class JsonFileRunStore(RunStore):
             self._children_index = children
             self._run_parent_index = run_parent
         self._maybe_persist_scan_memo()
+        self._sync_indexes()  # the journal tail before the mark (`_journal_replay_start`), at once
 
     # --- creation journal ------------------------------------------------
 
@@ -742,10 +757,42 @@ class JsonFileRunStore(RunStore):
         """Called BEFORE an index's full scan: entries appended from here on
         are re-applied by `_sync_indexes` (idempotent), so nothing created
         during the scan is lost."""
+        if self._journal_offset is not None:
+            return
+        self._load_scan_sidecar_once()  # the memo as a restarted store knows it, before the snapshot
+        with self._scan_memo_lock:
+            known = {rid: tuple(v[0]) for rid, v in self._scan_memo.items()}
         with self._journal_lock:
             if self._journal_offset is None:
                 size = self._journal_size()
-                self._journal_offset = size if size is not None else 0
+                self._journal_offset = self._journal_replay_start(size) if size is not None else 0
+                self._journal_replay_mark = int(size) if size is not None else 0
+                self._journal_replay_known = known
+
+    def _journal_replay_start(self, size: int) -> int:
+        """Where the first sync after an index build starts reading: the first record boundary
+        within JOURNAL_REPLAY_TAIL_BYTES before `size` (the journal's size at the mark).
+
+        `_save` appends a new run's `+id` BEFORE publishing its file (J53-1). A build that marks
+        the journal at `size` and then scans the folder misses a run whose line is before the
+        mark and whose file lands after the scan; re-applying the tail (idempotent: a `+` whose
+        file exists is filed, one whose file is still absent stays pending until it appears)
+        closes that window. Cost: one read of at most JOURNAL_REPLAY_TAIL_BYTES and one stat per
+        record in it, once per build. A record older than the tail is still caught by the
+        periodic reconciliation, which re-files what it repairs in every index and logs it."""
+        start = max(0, int(size) - int(self.JOURNAL_REPLAY_TAIL_BYTES))
+        if start == 0:
+            return 0
+        try:
+            with open(self._journal_path, "rb") as f:
+                f.seek(start)
+                chunk = f.read(int(size) - start)
+        except OSError:
+            logger.warning("JsonFileRunStore: creation journal tail unreadable; index build replays nothing before its mark",
+                           exc_info=True)
+            return int(size)
+        boundary = chunk.find(b"\n")  # records are framed `\n<op><run_id>\n`: start after a newline
+        return start + boundary + 1 if boundary >= 0 else int(size)
 
     def _sync_indexes(self) -> None:
         """Apply journal lines appended since the last sync (one stat when
@@ -794,24 +841,57 @@ class JsonFileRunStore(RunStore):
                 return
             complete = chunk.rfind(b"\n") + 1  # a line still being written waits for the next sync
             self._journal_offset = offset + complete
+            mark = self._journal_replay_mark
             pending = dict(self._journal_pending)
         entries = list(pending.items())
         now = time.time()
-        for raw in chunk[:complete].decode("utf-8", "replace").splitlines():
+        # A record wholly before the build's mark is a replay (0.15.2): it is filed, never
+        # announced as a change (`change_token` / `changed_run_ids` stay put: a read that moved
+        # them made every change-driven consumer re-read every run after each build, 0.15.3).
+        replayed: set = set()
+        announced: set = set()
+        pos = offset
+        for raw_line in chunk[:complete].split(b"\n"):
+            line_end = pos + len(raw_line) + 1
+            raw = raw_line.decode("utf-8", "replace")
             op, rid = raw[:1], raw[1:].strip()
             if op in ("+", "-", "~", "=") and rid:
                 entries.append((rid, (op, now)))
-        self._apply_journal_entries(entries)
-
-    def _apply_journal_entries(self, entries: Any) -> None:
+                (replayed if line_end <= mark else announced).add(rid)
+            pos = line_end
+        self._apply_journal_entries(entries, quiet=replayed - announced)
+        if offset + complete >= mark:
+            self._journal_replay_known = {}  # the replay is over: later records are all new
+
+    def _apply_journal_entries(self, entries: Any, *, quiet: Any = frozenset()) -> None:
+        """`quiet`: run ids whose records are replays (an index build's tail). A replay is filed
+        without a change-ring note only when it says nothing new: its file was known at the mark
+        (`_journal_replay_known`) and is unchanged since; a known run now gone IS announced. A file
+        that landed or changed during the build (J53-1: the record precedes the file) is announced
+        like any change, so a consumer whose token already covers the record still learns of it."""
         cutoff = time.time() - float(self.STALE_TEMP_AGE_S)
         for rid, (op, since) in entries:
+            note = rid not in quiet
             p = self._path(rid)
             exists = p.exists()
+            if not note:
+                known = self._journal_replay_known.get(rid)
+                if exists:
+                    try:
+                        unchanged = known is not None and tuple(known) == tuple(self._stat_token(p.stat()))
+                    except OSError:
+                        unchanged = False
+                    note = not unchanged
+                else:
+                    with self._scan_memo_lock:
+                        in_memo = rid in self._scan_memo
+                    with self._active_lock:
+                        in_active = rid in self._active
+                    note = known is not None or in_memo or in_active
             if op in ("+", "~", "=") and exists:
                 fields = self._scan_fields(p)
                 if fields is not None:
-                    self._index_fields_into_indexes(rid, fields)
+                    self._index_fields_into_indexes(rid, fields, note=note)
                 # `~` announces a flip TO active: until the file says so it is
                 # not resolved (the writer's replace may land after its line).
                 # `=` is written AFTER its file was published: one read resolves it.
@@ -819,7 +899,7 @@ class JsonFileRunStore(RunStore):
             elif op == "-" and not exists:
                 self._drop_from_children_index(rid)
                 self._drop_from_session_index(rid)
-                self._forget_active(rid)
+                self._forget_active(rid, note=note)
                 self._memo_pop(rid)
                 resolved = True
             elif op == "=":
@@ -832,7 +912,7 @@ class JsonFileRunStore(RunStore):
                 else:
                     self._journal_pending[rid] = (op, since)
 
-    def _index_fields_into_indexes(self, rid: str, fields: Dict[str, Any]) -> None:
+    def _index_fields_into_indexes(self, rid: str, fields: Dict[str, Any], *, note: bool = True) -> None:
         parent = fields.get("parent_run_id")
         parent = str(parent) if parent else None
         with self._index_lock:
@@ -845,7 +925,7 @@ class JsonFileRunStore(RunStore):
             if self._session_index is not None and sid:
                 self._session_index.setdefault(sid, {})[rid] = fields.get("session_kind")
                 self._run_session[rid] = sid
-        self._note_active_status(rid, fields.get("status"))
+        self._note_active_status(rid, fields.get("status"), note=note)
 
     def warm_session_index(self) -> None:
         """Build the session and children indexes now (host boot), so the
@@ -880,6 +960,7 @@ class JsonFileRunStore(RunStore):
             self._session_index = index
             self._run_session = by_run
         self._maybe_persist_scan_memo()
+        self._sync_indexes()  # the journal tail before the mark (`_journal_replay_start`), at once
 
     def _update_session_index_on_save(self, run: RunState) -> None:
         rid = str(run.run_id)
@@ -1236,24 +1317,37 @@ class JsonFileRunStore(RunStore):
             e = self._active[rid] = _ActiveEntry()
         return e
 
-    def _note_active_status(self, rid: str, status: Any) -> None:
+    def _note_active_status(self, rid: str, status: Any, *, note: bool = True) -> None:
         """Record what a save, a journal line or a verified read says about a
         run. Always recorded (before the first build too): a scan in progress
         merges by generation, a build not yet started reads disk truth and
-        reconciles these notes with it."""
+        reconciles these notes with it.
+
+        `note=False` (a replayed journal record, `_apply_journal_entries`): the
+        membership is kept right, but nothing is announced: no sequence bump,
+        no change-ring entry, so `change_token` does not move for a read."""
         if not rid:
             return
         with self._active_lock:
+            existed = rid in self._active
             e = self._active_entry(rid)
+            active = self._is_active_status(status)
+            if not note and (not existed or e.active == active):
+                # A replay of a file known at the mark and unchanged since: filed, not announced
+                # (an existing entry whose active flag FLIPS is a change, announced below).
+                e.active = active
+                return
+            e.active = active
             self._active_seq += 1
             e.gen = self._active_seq
-            e.active = self._is_active_status(status)
             self._change_ring.note(self._active_seq, rid)
 
-    def _forget_active(self, rid: str) -> None:
+    def _forget_active(self, rid: str, *, note: bool = True) -> None:
         """The run is gone (deleted here, or a `-id` line): drop its record."""
         with self._active_lock:
             self._active.pop(rid, None)
+            if not note:
+                return
             self._active_seq += 1
             self._change_ring.note(self._active_seq, rid)
 
@@ -1324,6 +1418,7 @@ class JsonFileRunStore(RunStore):
         t0 = time.monotonic()
         settled_ns = time.time_ns() - int(float(self.RUN_INDEX_IN_FLIGHT_S) * 1e9)
         repaired: List[str] = []
+        refile: Dict[str, Dict[str, Any]] = {}
         found: set[str] = set()
         seen: set[str] = set()
         for p in self._base.glob("run_*.json"):
@@ -1341,6 +1436,8 @@ class JsonFileRunStore(RunStore):
                 cur_tok = tuple(cur[0]) if cur is not None else None
                 if cur_tok is not None and cur_tok != prev_tok and cur_tok[0] < settled_ns:
                     repaired.append(rid)
+                    if fields is not None and rid:
+                        refile[rid] = fields
             if fields is None:
                 continue
             if self._is_active_status(fields.get("status")):
@@ -1349,6 +1446,13 @@ class JsonFileRunStore(RunStore):
         self._sync_indexes()
         dropped = self._scan_memo_prune(seen)
         if complete:
+            # A run the session/children indexes missed (gateway backlog 0963) is re-filed there
+            # too, not only in the memo and the active set; a vanished one leaves them.
+            for rid, fields in refile.items():
+                self._index_fields_into_indexes(rid, fields)
+            for rid in dropped:
+                self._drop_from_children_index(rid)
+                self._drop_from_session_index(rid)
             repaired.extend(dropped)
             self._note_reconcile(repaired, files=len(seen), seconds=time.monotonic() - t0)
         return found