power-loop 2.0.0__tar.gz → 2.1.0__tar.gz

{power_loop-2.0.0 → power_loop-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: power-loop
-Version: 2.0.0
+Version: 2.1.0
 Summary: Embeddable agent execution kernel — LLM loop, hooks, events, tools, dynamic sub-agents.
 Author-email: zhangran <zhangran24@126.com>
 License: MIT

{power_loop-2.0.0 → power_loop-2.1.0}/power_loop/__init__.py

@@ -15,7 +15,7 @@ Stability tiers
 无版本承诺，可随时变更或删除。
 """
 
-__version__ = "2.0.0"
+__version__ = "2.1.0"
 
 # Public LLM contract (SDK-free) re-exported so callers (e.g. writing llm.* hooks or
 # a custom LLMService) don't reach into the internal vendored transport package (H3.4).

{power_loop-2.0.0 → power_loop-2.1.0}/power_loop/agent/stateful_loop.py

@@ -21,8 +21,9 @@ from __future__ import annotations
 import asyncio
 import json
 import logging
+import threading
 from collections import OrderedDict
-from collections.abc import Sequence
+from collections.abc import Coroutine, Sequence
 from dataclasses import dataclass, field, replace
 from typing import Any
 
@@ -73,11 +74,16 @@ class _SessionCache:
     ``rows`` is EXACTLY what ``store.load_active_messages(session_id)`` returns at the moment
     ``next_seq`` was observed — the DURABLE projection, never the pipeline's mutated working
     copy (recall placeholders / microcompacted content are re-applied fresh each send, never
-    cached). ``next_seq`` is the validity token: a send reuses ``rows`` iff the live
-    ``session_state.next_seq`` still matches; any mismatch (another writer, or a fold) forces a
-    reload. So a cold loop with an empty cache reproduces identical behavior."""
+    cached). The validity token is the PAIR ``(next_seq, last_compact_seq)``: a send reuses
+    ``rows`` iff BOTH still match the live ``session_state``. ``next_seq`` alone is insufficient
+    — a fold (compaction) reshuffles the OLDER active set into ``compacted_out`` while only
+    bumping ``next_seq`` by the note, so an out-of-band fold during a send could leave a stale
+    delta-extended window whose ``next_seq`` happens to match. ``last_compact_seq`` advances on
+    every fold, so pairing it in makes any fold — this loop's or another writer/process's —
+    invalidate the window. A cold loop with an empty cache reproduces identical behavior."""
 
     next_seq: int
+    last_compact_seq: int
     rows: list[MessageRow]
 
 
@@ -99,6 +105,38 @@ class StatefulResult:
     tool_calls: int = 0
 
 
+class _SyncLoopRunner:
+    """A persistent event loop on a daemon thread that drives the blocking sync API.
+
+    ``send_sync`` / ``follow_up_sync`` / ``close`` must NOT spin a fresh ``asyncio.run`` per
+    call: an asyncpg/aiomysql connection pool binds to the event loop it was created on, so
+    a second ``asyncio.run`` (a new loop) finds the loop's cached store pool bound to the
+    now-closed first loop and raises ``InterfaceError`` / ``Event loop is closed``. One
+    long-lived loop keeps the pool valid for the whole lifetime of the StatefulAgentLoop —
+    matching the legacy synchronous store's "call it as often as you like" contract. (SQLite
+    is loop-agnostic but shares this path for uniformity.)
+    """
+
+    def __init__(self) -> None:
+        self._loop = asyncio.new_event_loop()
+        self._thread = threading.Thread(target=self._serve, name="power-loop-sync", daemon=True)
+        self._thread.start()
+
+    def _serve(self) -> None:
+        asyncio.set_event_loop(self._loop)
+        self._loop.run_forever()
+
+    def run(self, coro: Coroutine[Any, Any, Any]) -> Any:
+        """Submit a coroutine to the dedicated loop and block until it completes."""
+        return asyncio.run_coroutine_threadsafe(coro, self._loop).result()
+
+    def close(self) -> None:
+        self._loop.call_soon_threadsafe(self._loop.stop)
+        self._thread.join(timeout=5.0)
+        if not self._thread.is_alive():
+            self._loop.close()
+
+
 class StatefulAgentLoop:
     """The only public entry point for running an agent loop.
 
@@ -156,6 +194,13 @@ class StatefulAgentLoop:
             store.max_spawn_depth = max_spawn_depth
         self._owns_store = store is None
         self._store_open_lock = asyncio.Lock()
+        # Dedicated event loop (daemon thread) for the blocking sync API; opened lazily so
+        # the store pool stays bound to ONE loop across send_sync/follow_up_sync/close calls.
+        self._sync_runner: _SyncLoopRunner | None = None
+        self._sync_runner_lock = threading.Lock()
+        # Strong ref to a best-effort store.close() scheduled when sync close() is called
+        # from inside a running loop (keeps the task from being GC'd before it runs).
+        self._orphaned_close_task: asyncio.Future[None] | None = None
         self.config = config if config is not None else AgentLoopConfig()
         self.tool_registry = tool_registry
         self._runner = AgentRunner(event_bus=event_bus, hooks=hooks)
@@ -170,6 +215,17 @@ class StatefulAgentLoop:
         self._cache_misses = 0
         self._cache_evictions = 0
 
+    async def ensure_store(self) -> SessionStore:
+        """Public accessor: return this loop's store, opening an owned one on first use.
+
+        Construction is sync but the store opens lazily on first async use, so ``loop.store``
+        is ``None`` until then. Host integrations that need the store up front — e.g. building
+        a :class:`~power_loop.runtime.blackboard.SqliteBlackboard` to share with the loop —
+        must ``await loop.ensure_store()`` rather than reading ``loop.store`` directly (which
+        would capture ``None``).
+        """
+        return await self._ensure_store()
+
     async def _ensure_store(self) -> SessionStore:
         """Return the loop's store, opening an owned one on first use.
 
@@ -197,22 +253,29 @@ class StatefulAgentLoop:
 
     # ── per-session active-window cache helpers ─────────────────────────────
 
-    def _cache_get(self, sid: str, next_seq: int) -> list[MessageRow] | None:
-        """Return the cached active rows iff the validity token still matches; else None."""
+    def _cache_get(self, sid: str, next_seq: int, last_compact_seq: int) -> list[MessageRow] | None:
+        """Return the cached active rows iff the ``(next_seq, last_compact_seq)`` token still
+        matches; else None. The fold counter must match too — a fold reshuffles the older
+        active set, so a matching ``next_seq`` alone can still front a stale window."""
         if self._session_cache_size <= 0:
             return None
         entry = self._session_cache.get(sid)
-        if entry is not None and entry.next_seq == next_seq:
+        if entry is not None and entry.next_seq == next_seq \
+                and entry.last_compact_seq == last_compact_seq:
             self._session_cache.move_to_end(sid)  # LRU touch
             self._cache_hits += 1
             return entry.rows
         self._cache_misses += 1
         return None
 
-    def _cache_put(self, sid: str, next_seq: int, rows: list[MessageRow]) -> None:
+    def _cache_put(
+        self, sid: str, next_seq: int, rows: list[MessageRow], last_compact_seq: int
+    ) -> None:
         if self._session_cache_size <= 0:
             return
-        self._session_cache[sid] = _SessionCache(next_seq=next_seq, rows=list(rows))
+        self._session_cache[sid] = _SessionCache(
+            next_seq=next_seq, last_compact_seq=last_compact_seq, rows=list(rows)
+        )
         self._session_cache.move_to_end(sid)
         while len(self._session_cache) > self._session_cache_size:
             self._session_cache.popitem(last=False)  # evict LRU
@@ -242,6 +305,31 @@ class StatefulAgentLoop:
     def _cache_invalidate(self, sid: str) -> None:
         self._session_cache.pop(sid, None)
 
+    async def _refresh_window_cache_after_send(self, sid: str, store: SessionStore) -> None:
+        """Fold this send's appended tail into the live window entry — UNLESS a fold
+        reshuffled the older active set, in which case drop the entry so the next send
+        full-reloads.
+
+        The fold check compares the durable ``last_compact_seq`` against the entry's, so it
+        fires for ANY fold since the entry was built — this send's own compaction OR an
+        out-of-band one by another writer/process. A bare ``next_seq`` delta-extend would
+        otherwise keep the now-``compacted_out`` rows in the window and, because a fold also
+        advances ``next_seq`` (the note), leave the entry's token matching the live state —
+        so the next send would HIT a corrupt window mixing folded-out rows with the note."""
+        entry = self._session_cache.get(sid)
+        if entry is None:
+            return
+        post_state = await store.get_state(sid)
+        if post_state is None:
+            return
+        if post_state.last_compact_seq != entry.last_compact_seq:
+            self._cache_invalidate(sid)
+        elif post_state.next_seq != entry.next_seq:
+            # Pure append tail (incl. follow-ups drained mid-run): cheap O(delta) extend.
+            delta = await store.load_active_messages(sid, after_seq=entry.next_seq)
+            entry.rows.extend(delta)
+            entry.next_seq = post_state.next_seq
+
     @property
     def cache_stats(self) -> dict[str, int]:
         """Observability for the per-session window cache: hits / misses / evictions /
@@ -257,27 +345,52 @@ class StatefulAgentLoop:
     # ── lifecycle ─────────────────────────────────────────────────────────
 
     def close(self) -> None:
-        """Close the underlying store (if owned). Does NOT delete sessions.
+        """Close the underlying store (if owned) and the dedicated sync event loop.
 
         Synchronous and abrupt: it does NOT wait for in-flight sends or pending async
-        event-bus tasks. The store is async, so this can only close cleanly when no
-        event loop is running (it drives ``store.close()`` via ``asyncio.run``); when
-        called from inside a running loop it schedules the close and warns. Prefer
-        :meth:`aclose` (or ``async with loop:``) for graceful shutdown.
+        event-bus tasks. Prefer :meth:`aclose` (or ``async with loop:``) for graceful
+        shutdown. When the sync API was used, the store/pool live on the dedicated sync
+        loop and are torn down on it (a fresh ``asyncio.run`` could not close a pool bound
+        to another loop — the bug this avoids); otherwise the close is driven via
+        ``asyncio.run``. Called from inside a running loop it only schedules + warns.
         """
-        if not self._owns_store or self.store is None:
-            return
-        store = self.store
-        try:
-            asyncio.get_running_loop()
-        except RuntimeError:
-            asyncio.run(store.close())
-        else:
-            logger.warning(
-                "StatefulAgentLoop.close() called inside a running event loop; "
-                "use 'await loop.aclose()' for graceful async shutdown"
-            )
-            asyncio.ensure_future(store.close())
+        runner = self._sync_runner
+        # Let in-flight background tasks finish + persist their terminal status before the
+        # store/loop is torn down (a finishing task's write-back targets the runner loop,
+        # which is still alive here); then recover any already-deferred ones.
+        if self.store is not None and runner is not None:
+            from power_loop.tools.default_tools import BG
+
+            try:
+                BG.join_pending(timeout=5.0)
+                runner.run(BG.flush_orphaned(self.store))
+            except Exception:  # pragma: no cover - drain must never block teardown
+                logger.warning("close: background-task drain failed; continuing", exc_info=True)
+        store = self.store if self._owns_store else None
+        if store is not None:
+            if runner is not None:
+                # Store/pool were opened on the dedicated loop; close them there.
+                runner.run(store.close())
+                self.store = None
+            else:
+                try:
+                    asyncio.get_running_loop()
+                except RuntimeError:
+                    asyncio.run(store.close())
+                    self.store = None
+                else:
+                    logger.warning(
+                        "StatefulAgentLoop.close() called inside a running event loop; "
+                        "use 'await loop.aclose()' for graceful async shutdown"
+                    )
+                    # Keep a strong reference: a bare ensure_future() returns a task nothing
+                    # holds, which the GC can collect mid-flight ('Task was destroyed but it
+                    # is pending') so store.close() never runs and the connection/pool leaks.
+                    self._orphaned_close_task = asyncio.ensure_future(store.close())
+                    self.store = None
+        if runner is not None:
+            runner.close()
+            self._sync_runner = None
 
     async def aclose(self, *, drain_timeout_s: float = 30.0) -> None:
         """Graceful, async shutdown: quiesce, then stop.
@@ -318,7 +431,18 @@ class StatefulAgentLoop:
             await self.event_bus.drain(timeout=drain_timeout_s)
         except Exception:  # pragma: no cover - drain must never block teardown
             logger.warning("aclose: event-bus drain raised; continuing", exc_info=True)
-        # (4) checkpoint + close the owned store (only if it was ever opened).
+        # (4) let in-flight background tasks finish so their terminal status write-back
+        # lands on the still-open store/loop, then recover any that were already deferred —
+        # otherwise closing the store here would strand them at 'running' forever.
+        if self.store is not None:
+            from power_loop.tools.default_tools import BG
+
+            try:
+                await asyncio.to_thread(BG.join_pending, drain_timeout_s)
+                await BG.flush_orphaned(self.store)
+            except Exception:  # pragma: no cover - drain must never block teardown
+                logger.warning("aclose: background-task drain failed; continuing", exc_info=True)
+        # (5) checkpoint + close the owned store (only if it was ever opened).
         if self._owns_store and self.store is not None:
             try:
                 await self.store.checkpoint(mode="TRUNCATE")
@@ -339,14 +463,16 @@ class StatefulAgentLoop:
     async def close_session(self, session_id: str, *, cascade: bool = True) -> int:
         """Physically delete the session and (by default) its LINKED subtree."""
         store = await self._ensure_store()
-        n = await store.close_session(session_id, cascade=cascade)
-        # Drop the per-session in-memory bookkeeping so a long-lived loop that
-        # cycles through many sessions doesn't leak a Lock per session id (C12).
-        self._locks.pop(session_id, None)
-        self._follow_up_queue_locks.pop(session_id, None)
-        self._follow_up_queues.pop(session_id, None)
-        self._cache_invalidate(session_id)
-        return n
+        deleted_ids = await store.close_session_tree(session_id, cascade=cascade)
+        # Drop the per-session in-memory bookkeeping for EVERY removed session so a long-lived
+        # loop that cycles through many sessions doesn't leak a Lock/queue/cache entry per id —
+        # for the directly-closed session (C12) AND each cascade-deleted descendant (C4).
+        for sid in {session_id, *deleted_ids}:
+            self._locks.pop(sid, None)
+            self._follow_up_queue_locks.pop(sid, None)
+            self._follow_up_queues.pop(sid, None)
+            self._cache_invalidate(sid)
+        return len(deleted_ids)
 
     # ── primary API ───────────────────────────────────────────────────────
 
@@ -379,7 +505,7 @@ class StatefulAgentLoop:
             state = await store.get_state(session_id)
             rows = await store.load_active_messages(session_id)
             if state is not None:
-                self._cache_put(session_id, state.next_seq, rows)
+                self._cache_put(session_id, state.next_seq, rows, state.last_compact_seq)
         return True
 
     async def send(
@@ -462,6 +588,29 @@ class StatefulAgentLoop:
             user_input, sid, stop_event=stop_event, tools=tools, system_prompt=system_prompt
         )
 
+    def _run_sync(self, coro: Coroutine[Any, Any, Any]) -> Any:
+        """Drive ``coro`` to completion on the loop's dedicated sync event loop.
+
+        All blocking sync entry points funnel through here so an owned PG/MySQL pool stays
+        bound to a single, long-lived loop (see :class:`_SyncLoopRunner`). Raises if called
+        from within a running event loop — use the async methods (``await loop.send(...)``)
+        in that case.
+        """
+        try:
+            asyncio.get_running_loop()
+        except RuntimeError:
+            pass
+        else:
+            coro.close()  # avoid "coroutine was never awaited"
+            raise RuntimeError(
+                "sync API (send_sync/follow_up_sync) called from within a running event "
+                "loop; await the async method (loop.send / loop.follow_up) instead"
+            )
+        with self._sync_runner_lock:
+            if self._sync_runner is None:
+                self._sync_runner = _SyncLoopRunner()
+        return self._sync_runner.run(coro)
+
     def follow_up_sync(
         self,
         user_input: str | LoopMessage,
@@ -471,7 +620,7 @@ class StatefulAgentLoop:
         tools: Sequence[str] | ToolRegistry | None = None,
         system_prompt: str | None = None,
     ) -> StatefulResult | FollowUpQueued:
-        return asyncio.run(
+        return self._run_sync(
             self.follow_up(
                 user_input,
                 session_id,
@@ -481,6 +630,20 @@ class StatefulAgentLoop:
             )
         )
 
+    def new_session_sync(
+        self,
+        *,
+        metadata: dict[str, Any] | None = None,
+        system_prompt: str | None = None,
+    ) -> str:
+        """Synchronous :meth:`new_session`. Use this (not ``asyncio.run(loop.new_session())``)
+        to bootstrap a session for the sync API: it runs on the loop's dedicated sync event
+        loop, so an owned PG/MySQL pool opens on the SAME loop that ``send_sync`` later uses
+        (a throwaway ``asyncio.run`` would bind the pool to a loop that is then closed)."""
+        return self._run_sync(
+            self.new_session(metadata=metadata, system_prompt=system_prompt)
+        )
+
     def send_sync(
         self,
         user_input: str | LoopMessage,
@@ -491,7 +654,7 @@ class StatefulAgentLoop:
         system_prompt: str | None = None,
         heal_pending: bool = False,
     ) -> StatefulResult:
-        return asyncio.run(
+        return self._run_sync(
             self.send(
                 user_input,
                 session_id,
@@ -944,16 +1107,16 @@ class StatefulAgentLoop:
         # already advanced by the just-persisted user input), reuse it and skip the O(active-
         # history) load entirely; otherwise load in full and (re)populate the cache.
         active_rows: list[MessageRow] | None = None
-        cache_token: int | None = None
+        cache_token: tuple[int, int] | None = None
         if cache_eligible:
             state = await store.get_state(sid)
             if state is not None:
-                cache_token = state.next_seq
-                active_rows = self._cache_get(sid, state.next_seq)
+                cache_token = (state.next_seq, state.last_compact_seq)
+                active_rows = self._cache_get(sid, state.next_seq, state.last_compact_seq)
         if active_rows is None:
             active_rows = await store.load_active_messages(sid)
             if cache_eligible and cache_token is not None:
-                self._cache_put(sid, cache_token, active_rows)
+                self._cache_put(sid, cache_token[0], active_rows, cache_token[1])
         history = [_row_to_loop_message(r) for r in active_rows]
         # Mirror loaded seqs into the sink so the compactor can translate
         # in-memory indices back to store rows when it folds messages. Pass the
@@ -1014,16 +1177,7 @@ class StatefulAgentLoop:
         # extend with the active tail this send appended (a cheap O(delta) read, incl. any
         # follow-up rows drained mid-run) so back-to-back sends stay on the fast path. ──
         if cache_eligible:
-            if sink.compactions_applied > 0:
-                self._cache_invalidate(sid)
-            else:
-                entry = self._session_cache.get(sid)
-                post_state = await store.get_state(sid)
-                if entry is not None and post_state is not None:
-                    if post_state.next_seq != entry.next_seq:
-                        delta = await store.load_active_messages(sid, after_seq=entry.next_seq)
-                        entry.rows.extend(delta)
-                        entry.next_seq = post_state.next_seq
+            await self._refresh_window_cache_after_send(sid, store)
         else:
             # A pre-primed sink (resume()/submit_input()) durably appended rows out-of-band of
             # the cache; drop any live entry now so it can't be served stale. (The contiguity

{power_loop-2.0.0 → power_loop-2.1.0}/power_loop/runtime/store/backends/mysql.py

@@ -30,11 +30,14 @@ from power_loop.runtime.store.db import Params, Row
 from power_loop.runtime.store.dialect import Dialect, MySQLDialect
 
 
-def _args(params: Params) -> tuple[Any, ...] | None:
-    # Pass None for a parameterless statement so the driver skips its ``query % args``
-    # %-formatting pass entirely (our DDL has no ``%`` literals, and dialect.translate
-    # already doubled any that a parameterized statement might carry).
-    return tuple(params) if params else None
+def _args(params: Params) -> tuple[Any, ...]:
+    # Always hand the driver a tuple (empty when there are no binds) so PyMySQL/aiomysql
+    # ALWAYS run their ``query % escaped_args`` pass — that pass is what collapses the
+    # ``%%`` that ``dialect.translate`` doubles back down to a single literal ``%``. If we
+    # returned None for a parameterless statement, the driver would SKIP that pass and a
+    # ``%`` literal would reach MySQL as a stray ``%%`` (e.g. ``LIKE 'pl\_%'`` → ``'pl\_%%'``).
+    # ``query % ()`` is a no-op for SQL with no ``%`` and collapses ``%%`` otherwise.
+    return tuple(params)
 
 
 class _MyTransaction:

{power_loop-2.0.0 → power_loop-2.1.0}/power_loop/runtime/store/backends/sqlite.py

@@ -3,15 +3,18 @@
 Wraps a single stdlib ``sqlite3`` connection (``check_same_thread=False``, autocommit
 so transaction boundaries are explicit) and runs every statement in a worker thread via
 ``asyncio.to_thread`` so the async store never blocks the event loop. An ``asyncio.Lock``
-serializes writers — preserving SQLite's one-writer model — so a transaction's
-``SELECT next_seq → … → UPDATE`` is atomic without DB row locks. WAL keeps readers
-non-blocking. (A dedicated read pool can be layered later; for now reads share the write
-connection under the lock.)
+serializes writers IN-PROCESS — preserving SQLite's one-writer model — so a transaction's
+``SELECT next_seq → … → UPDATE`` is atomic without DB row locks. ACROSS processes (two
+handles to one file) ``transaction()`` uses ``BEGIN IMMEDIATE`` so the RESERVED write lock
+is taken up front and ``busy_timeout`` serializes contenders instead of deadlocking on a
+lock upgrade. WAL keeps readers non-blocking. (A dedicated read pool can be layered later;
+for now reads share the write connection under the lock.)
 """
 
 from __future__ import annotations
 
 import asyncio
+import logging
 import sqlite3
 from collections.abc import AsyncIterator
 from contextlib import asynccontextmanager
@@ -19,6 +22,8 @@ from contextlib import asynccontextmanager
 from power_loop.runtime.store.db import Params, Row
 from power_loop.runtime.store.dialect import Dialect, SqliteDialect
 
+logger = logging.getLogger(__name__)
+
 
 class _SqliteTransaction:
     """Lock-free statement runner; the owning Database holds its write lock for the
@@ -58,9 +63,14 @@ class SqliteDatabase:
         conn = sqlite3.connect(path, check_same_thread=False, isolation_level=None)
         conn.row_factory = sqlite3.Row
         if path != ":memory:":
+            # auto_vacuum MUST be chosen before the db header is initialized — i.e. before
+            # WAL touches it / before the first table is created — otherwise the PRAGMA is a
+            # silent no-op (mode stays NONE) and incremental_vacuum reclaims nothing. So it
+            # has to run BEFORE journal_mode=WAL. (DBs created by an older build where the
+            # order was reversed need a one-time full VACUUM to switch the mode.)
+            conn.execute("PRAGMA auto_vacuum=INCREMENTAL")
             conn.execute("PRAGMA journal_mode=WAL")
             conn.execute("PRAGMA synchronous=NORMAL")
-            conn.execute("PRAGMA auto_vacuum=INCREMENTAL")
         conn.execute("PRAGMA foreign_keys=ON")
         conn.execute("PRAGMA busy_timeout=5000")
         return cls(conn, path=path)
@@ -86,17 +96,44 @@ class SqliteDatabase:
         return await asyncio.to_thread(self._b_fetchall, sql, params)
 
     # ── transaction ────────────────────────────────────────────────────────────
+    async def _safe_rollback(self) -> None:
+        """Return the shared connection to a no-open-transaction state without letting a
+        failing ROLLBACK mask the original error. Leaving an open transaction here would
+        wedge the one shared writer permanently ('cannot start a transaction within a
+        transaction') for the rest of the process."""
+        try:
+            await self._exec("ROLLBACK")
+        except Exception:
+            logger.warning("sqlite: ROLLBACK during transaction recovery failed", exc_info=True)
+
     @asynccontextmanager
     async def transaction(self) -> AsyncIterator[_SqliteTransaction]:
         async with self._lock:
-            await self._exec("BEGIN")
+            # BEGIN IMMEDIATE (not plain/DEFERRED BEGIN): every store transaction is a
+            # read-modify-write (e.g. append_message's SELECT next_seq → INSERT), so take the
+            # RESERVED write lock up front. A DEFERRED BEGIN takes only a SHARED lock at the
+            # leading SELECT and upgrades at the first write — and SQLite returns SQLITE_BUSY
+            # *immediately* on a lock-UPGRADE conflict (busy_timeout does NOT retry upgrades),
+            # so two processes sharing the file deadlock ('database is locked'). IMMEDIATE makes
+            # busy_timeout WAIT and serialize them instead. In-process the asyncio.Lock already
+            # serializes, so this only adds the cross-process guarantee the store advertises.
+            await self._exec("BEGIN IMMEDIATE")
             try:
                 yield _SqliteTransaction(self)
             except BaseException:
-                await self._exec("ROLLBACK")
+                # Roll back, but never let a failed ROLLBACK replace the caller's
+                # exception (callers pattern-match on IntegrityError / domain ValueError).
+                await self._safe_rollback()
                 raise
             else:
-                await self._exec("COMMIT")
+                try:
+                    await self._exec("COMMIT")
+                except BaseException:
+                    # A failed COMMIT (disk full / I/O error / SQLITE_BUSY on a write
+                    # upgrade) leaves the transaction open; roll it back so the connection
+                    # isn't wedged for every subsequent transaction, then surface the error.
+                    await self._safe_rollback()
+                    raise
 
     # ── autocommit reads / single writes (lock-guarded) ────────────────────────
     async def fetchone(self, sql: str, params: Params = ()) -> Row | None:
@@ -118,15 +155,23 @@ class SqliteDatabase:
             self._closed = True
             await asyncio.to_thread(self._conn.close)
 
+    def _check_open(self) -> None:
+        # Guard maintenance ops the way close()/the read path are guarded: a statement on a
+        # closed sqlite3 connection raises an opaque ProgrammingError; surface a clear one.
+        if self._closed:
+            raise RuntimeError("operation on a closed SQLite store")
+
     # ── Maintenance capability (SQLite-only; see store/capabilities.py) ─────────
     async def checkpoint(self, *, mode: str = "TRUNCATE") -> None:
         if mode not in ("PASSIVE", "FULL", "RESTART", "TRUNCATE"):
             raise ValueError(f"invalid checkpoint mode: {mode!r}")
         async with self._lock:
+            self._check_open()
             await asyncio.to_thread(self._conn.execute, f"PRAGMA wal_checkpoint({mode})")
 
     async def vacuum(self, *, incremental: bool = True) -> None:
         async with self._lock:
+            self._check_open()
             # VACUUM cannot run inside a transaction; this conn is in autocommit mode.
             sql = "PRAGMA incremental_vacuum" if incremental else "VACUUM"
             await asyncio.to_thread(self._conn.execute, sql)
@@ -140,6 +185,7 @@ class SqliteDatabase:
                 dest.close()
 
         async with self._lock:
+            self._check_open()
             await asyncio.to_thread(_backup)
 
 

{power_loop-2.0.0 → power_loop-2.1.0}/power_loop/runtime/store/dialect.py

@@ -267,8 +267,10 @@ class MySQLDialect:
 
     def translate(self, sql: str) -> str:
         # The driver (aiomysql/PyMySQL) uses ``%s`` and runs ``query % args``, so a literal
-        # ``%`` must be doubled. Our SQL contains no ``%`` literals today, but escape first
-        # to stay correct if one is ever added, then map qmark → ``%s``.
+        # ``%`` must be doubled here and is collapsed back by that pass. This is only correct
+        # because backends/mysql.py:_args ALWAYS passes a tuple (never None), so the
+        # ``query % args`` collapse runs even for parameterless statements — otherwise a
+        # doubled ``%%`` would leak to MySQL verbatim. Escape ``%`` first, then qmark → ``%s``.
         return sql.replace("%", "%%").replace("?", "%s")
 
     def ddl(self, prefix: str) -> list[str]: