Repository navigation
fix(managed-agent): reconcile approval delivery and concurrent session titles - #13682
Conversation
Keep accepted Workspace approval responses deliverable with the default recovery configuration after attachment-cache loss. Leave approval retry claims untouched on Harness-disabled replicas. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
|
Verified commit: Java compilation and 74/74 focused tests pass (47 connector, 26 public/action-service/JDBC, one disabled-coordinator regression), with zero Checkstyle violations. Both design translations pass formatting. An independent bounded correctness review found no actionable issue; the security scout's cold/profile trace was completed by a focused source check. The existing W1 contract treats A real local Spring/H2 + current-source Node Harness/Broker/worker probe passed in 9.98 seconds with the recovery setting checked as false. It injected one resolve 503, observed the accepted operation pending at attempt/claim generation 1, then cleared the enabled connector cache. The real resident load returned 200 with
The first observer attempt failed before the approval assertions because its proxy omitted the required Harness boot response header. The failed attempt was preserved, the proxy was corrected, and the separate passing run produced the evidence above. Maven also warned about an expired certificate at an optional metadata source; the resolved Checkstyle plugin completed successfully. Limits: scripted model and controlled 503; H2; two Spring contexts in one JVM; cache clearing rather than a dispatcher process crash; disabled recovery methods invoked deterministically rather than an autonomous scheduler race. This does not establish real-model, full process-death, MySQL/MariaDB, browser-click, or packaged-CLI acceptance. Current CLI TypeScript source and unchanged built dependencies were used. No dependency install or full CLI build/test suite ran. The referenced äļæéŠčŊčŊīæéŠčŊåŊđåšæäšĪ įåŪæŽå° Spring/H2 äļå―åæšį Node Harness/Broker/worker æĒéįĻäļæŽĄåæ§ 503 æåæéïžčŋčĄæķįĄŪčŪĪæĒåĪåžå ģäļš falseãįåĪäŋæåū éčŊåæļ įĐšéįįžåïžįåŪ resident load äŧĨčĒŦåĻåčŪŪčŋå 200ïžå operation åŪæäļ Action äļš decidedãįŪæ įåĪåŠæåæéäļæŽĄïžREST/WebShell éæūäŧčŋååäļäļŠ operationïžįåŪ worker åŪæ Turn åđķæå·Ĩä―åšæäŧķåäļš afterã å ąįĻæ°æŪåšäļä―ŋįĻį䚧įĶįĻ connector įåĶäļåŊæŽæ§čĄäļæŽĄ dispatch åå ŦæŽĄ recoverïžæēĄææđåäŧŧåĄįķæãæéįķæãå°čŊæŽĄæ°ãčŪĪéĒäŧĢæ°ãéčŊæķéīæį§įšĶãäļĪäļŠéįĶŧåéåŊđį §ååŦį§ŧéĪå·Ĩä―åščĒŦåĻå č――æĄäŧķäļåŊįĻæ§åŪåŦïžį°ææčĻååŦå įžšå°čĒŦåĻæ čŪ°ååĪä―ååĻäšĪäščåĪąčīĨãåéæšį åįžčŊ䚧įĐæēĄæčĒŦčĶįïžå ĻéĻčŋčĄčŋįĻå·ēįŧįŧæã įŽŽäļæŽĄæĒéå äŧĢįæžč―Ž Harness boot ååšåĪīčåĻåŪĄæđæčĻååĪąčīĨïžå·ēäŋįåĪąčīĨčŊæŪïžäŋŪåĪäŧĢįååĻįŽįŦįŪå―ååūéčŋįŧæãMaven åŊđäļäļŠåŊéå æ°æŪæšæĨåčŊäđĶčŋæïžä―å·ēč§Ģæį Checkstyle æäŧķæĢåļļåŪæã čŊæŪčūđįïžčæŽæĻĄåãåæ§ 503ãH2ãåäļ JVM įäļĪäļŠ Spring contextãæļ
įĐšįžåčéåŪé
čŋįĻåīĐæšïžįĶįĻåŊæŽäŧĨįĄŪåŪæ§æđæģč°įĻéŠčŊãå°æŠéŠčŊįåŪæĻĄåãåŪæīčŋįĻæŧ䚥ãMySQL/MariaDBãæĩč§åĻįđåŧæéæ°æå
į CLIïžä―ŋįĻįæŊå―å TypeScript æšį åæŠæđåįå·ēæåŧšäūčĩãæēĄæéæ°åŪčĢ
äūčĩæčŋčĄåŪæī CLI æåŧš/åĨäŧķãįŊåĒįžšå° |
|
â
Qwen Triage finished â CI landed green on â
Qwen Triage å·ēåŪæ ââ |
|
Thanks for the PR! Template â complete, both languages, design doc links included. â Problem â observed, not theoretical. wenshao's round-9 verification of #13163 recorded it plainly: "One pre-existing gap reproduced identically on main. After a dispatcher restart, a pending approval answer is never delivered with the default configuration," plus six successive claims by a Harness-disabled replica. Both halves hold up against the code:
Direction â aligned. An approval the user already gave being accepted, 202'd, persisted, and then silently stranded is about the worst failure mode this stack has. No direct analogue in the upstream CHANGELOG (this is our own hosted managed-agent stack; the entries there are about local CLI approval prompts), but the area is relevant â approval-delivery stalls are a recurring upstream fix category as well. Size â no core paths touched, so the Stage 0 gate does not apply. 81 changed lines: 13 production (9+/4â across two files), 41 test, 27 design docs. Approach â minimal and idiomatic; it is close to what I would have written independently:
One question rather than a blocker: widening the passive path means a cold-cache Workspace approval delivery can now mint a runtime-recovery snapshot and set the Risk â no elevated risk signals; the Stage 1e scan matched nothing (Java and docs only). Moving on to code review. ð äļæčŊīææč°ĒčīĄįŪïž æĻĄæŋ ââ åŪæīïžäļčąåčŊïžéäščŪūčŪĄææĄĢéūæĨãâ éŪéĒ ââ å·ēč§æĩå°ïžäļæŊįčŪšå åšãwenshao åŊđ #13163 įįŽŽ 9 č―ŪéŠčŊæįĄŪčŪ°å―ïž"æäļéĄđå·ēæįžšåĢåĻ main äļåŪå Ļįļåå°åĪį°ââč°åšĶåĻéåŊåïžéŧčŪĪé į―Ūäļåū åĪįįåŪĄæđįåĪæ°ļčŋäļäžæé"ïžåĶåĪčŋæįĶįĻ Harness įåŊæŽčŋįŧå æŽĄčŪĪéĒäŧŧåĄãäļĪåé―č―åĻäŧĢį éåŊđäļïž
æđå ââ åŊđé―ãįĻæ·å·ēįŧįŧåšįåŪĄæđčĒŦåįãčŋå 202ãč―åšïžįķåééŧåĄæŧïžæŊčŋåĨæ æįģįåĪąčīĨå―Ēæäđäļãäļæļļ CHANGELOG æēĄæįīæĨåŊđåšæĄįŪïžčŋæŊæäŧŽčŠå·ąį hosted managed-agent æ ïžéĢčūđįæĄįŪčŪēįæŊæŽå° CLI åŪĄæđåžđįŠïžïžä―čŋäļŠæđåæŊįļå ģįââåŪĄæđæéåĄæŧåĻäļæļļäđæŊååĪåšį°įäŋŪåĪįąŧåŦã č§æĻĄ ââ æŠč§Ķåæ ļåŋč·ŊåūïžStage 0 éĻįĶäļéįĻãå ą 81 čĄæđåĻïž13 čĄį䚧äŧĢį ïžäļĪäļŠæäŧķïž9 åĒ 4 å ïžã41 čĄæĩčŊã27 čĄčŪūčŪĄææĄĢã æđæĄ ââ æå°äļįŽĶåæĒæåæģïžåæįŽįŦæģå°įåæģåšæŽäļčīïž
äļäļŠįéŪïžäļæŊéŧåĄéĄđïžæūåŪ― passive č·Ŋåūåïžå·įžåį Workspace åŪĄæđæéį°åĻåŊč―įæ runtime-recovery åŋŦį
§åđķį―Ūäļ éĢéĐ ââ æ åįš§éĢéĐäŋĄå·ïžStage 1e æŦææēĄæå―äļïžåŠæ Java åææĄĢïžã čŋå ĨäŧĢį åŪĄæĨ ð â Qwen Code · qwen3.8-max-2026-09-02 Reviewed at |
Code reviewNo blockers. I wrote down what I would have done for each half before comparing, and the diff lands on the same answer both times â which is the main reason this reads as a clean PR rather than a merely plausible one. For the 409 loop the alternatives were all worse: catching Two claims in the description I checked rather than took on faith:
Both production lines are mutation-sensitive: reverting the connector's Two non-blocking notes:
CI evidenceFetched once for
The Final CI results for
One row per check name (latest run); skipped checks omitted; failures sort first. / æŊäļŠæĢæĨåäļčĄïžåææ°äļæŽĄčŋčĄïžïžįįĨ skippedïžåĪąčīĨéĄđæåĻæåã Sandboxed verification would settle the one claim static review cannot: Not verified, and why:
Everything else in the description that I could check statically â the preserved authority and mount checks, the unchanged äļæčŊīæäŧĢį åŪĄæĨïžæēĄæéŧåĄéĄđãäļĪåĪäŋŪåĪæé―å
įŽįŦæģčŋäļéåæģïžįŧčŪšå diff äļčīã409 åūŠįŊįå
ķäŧæđæĄé―æīå·Ūïžæč· æčŋ°éæäļĪäļŠčŊīæģæåäšæ ļåŪčäļæŊįīæĨéäŋĄïžäļæŊ"æéåäŧæĢæĨæ§čĄææäļæč――"ââæįŦïž äļĪčĄį䚧äŧĢį é―åŊđååžææïžåé connector éĢäļčĄäžčŪĐ äļĪæĄééŧåĄæéïž CI čŊæŪïžåŊđ æēįŪąéŠčŊåŧščŪŪïž æŠéŠčŊéĄđïžäļčŋ°åĪåŊæŽå
ąäšŦæ°æŪåščĄäļšïžåŊäļįåŪčŊæŪæŊä―č
čŠčŋ°įãäŧ
åĻ macOS äļč·čŋįå Spring context æĒéïžïžč°åšĶåĻįæĢčŋįĻéåŊåįæĒåĪïžéææĩčŊæļ
įĐšįæŊå
åéį å ķä―č―éææ ļåŊđįå åŪđââäŋįįææäļæč――æĢæĨãæĒåĪåžå ģéŧčŪĪåžäŧäļš falseãčŪūčŪĄææĄĢäļčąåæĨãdiff äūčĩįæĒææĩčŊåæģäļ importââåæ ļåŊđéčŋã â Qwen Code · qwen3.8-max-2026-09-02 Reviewed at |
|
Confidence: 4/5 â solid, minimal, and pinned by mutation-sensitive tests; held back from 5 only by the multi-replica claim that nothing in CI can exercise, plus two non-blocking code notes. I proposed both fixes independently before comparing and landed in the same place twice, which is the strongest signal I have that this is the right shape rather than a plausible one. Thirteen production lines, no drive-by edits, and both halves reuse something that already exists â the passive-reattach protocol the cancellation and rename paths ride, and the The problem is real and I did not take that on faith. An independent verifier recorded the stall on a PR that has since merged, reproduced identically on What I could not settle, stated plainly: the shared-database half. The new coordinator test is mock-level, so it pins the guard but not the effect on claim generation, attempts, lease and retry time, and no CI job runs two replicas against one store. The guard is five lines with obvious semantics copied from a sibling class, so I am not worried about it being wrong â I am noting that its database-level behaviour rests on the author's self-reported, macOS-only probe. The author has roughly twenty PRs open, which is normally where I get skeptical about volume. This one is a direct follow-up to their own merged work and fixes a gap a third party explicitly recorded as still present, so I judged it on its own merits and it holds up. Two things I would clean up later, neither blocking: the Approval deferred until CI lands green on äļæčŊīæäŋĄåŋïž4/5 ââ æåŪãæå°åïžäļįąåŊđååžææįæĩčŊéä―ïžæēĄå° 5 ååŠæŊå äļšåĪåŊæŽéĢäļéĄđ CI æ æģčĶįïžåĪå äļĪæĄééŧåĄįäŧĢį æéã äļĪåĪäŋŪåĪæé―å
įŽįŦæģčŋåæģååŊđį
§ïžäļĪæŽĄé―č―åĻåäļäļŠæđæĄäļââčŋæŊ"å―ĒææĢįĄŪ"čäļåŠæŊ"įčĩ·æĨåį"įæåžšäŋĄå·ã13 čĄį䚧äŧĢį ïžæēĄæåĪđåļĶæ å
ģæđåĻïžäļĪåé―åĪįĻäšå·ēæäļčĨŋïžcancellation å rename å·ēįŧåĻčĩ°įčĒŦåĻééįåčŪŪïžäŧĨå éŪéĒæŊįåŪååĻįïžææēĄæįīæĨéäŋĄãäļä―įŽįŦéŠčŊč
åĻäļäļŠå·ēįŧååđķį PR äļčŪ°å―äščŋäļŠåæŧïžåđķåĻ ææ æģåŪčŪšįéĻåčŊīæļ
æĨïžå
ąäšŦæ°æŪåšéĢäļåãæ°åĒįåč°åĻæĩčŊæŊ mock įš§åŦįïžéä―äšåĪææŽčšŦïžä―æēĄæéä―åŊđčŪĪéĒäŧĢæ°ãå°čŊæŽĄæ°ãį§įšĶäļéčŊæķéīįåŪé
ææïžCI éäđæēĄæäŧŧä―ä―äļčŪĐäļĪäļŠåŊæŽå
ąįĻäļäļŠååĻãčŋäļŠåĪæåŠæäščĄãčŊäđæūįķãäļæčŠåįąŧïžæäŧĨæäļæ
åŋåŪæŊéįââæåŠæŊæåšåŪåĻæ°æŪåšåąéĒįčĄäļšįŪåäūčĩä―č
čŠčŋ°įãäŧ
åĻ macOS äļč·čŋįæĒéã ä―č åäļåĪ§įšĶčŋæäšåäļŠåžįį PRïžčŋéåļļæŊæåŊđ"æ°é"čĩ·įįå°æđãä―čŋäļäļŠæŊäŧčŠå·ąå·ēååđķå·Ĩä―įįīæĨåįŧïžäŋŪįæŊįŽŽäļæđæįĄŪčŪ°å―äļšäŧįķååĻįįžšåĢïžæäŧĨææåŪæŽčšŦįäŧ·åžåĪæïžįŦåūä―ã äļĪäŧķåįŧåŊäŧĨæļ
įįäšïžé―äļéŧåĄïž åŪĄæđæĻčŋå° CI åĻ â Qwen Code · qwen3.8-max-2026-09-02 Reviewed at |
qwen-code-review-bot
left a comment
qwen-code-review-bot
left a comment
There was a problem hiding this comment.
LGTM, looks ready to ship â CI landed green after the review. â
qwen-code-review-bot
left a comment
qwen-code-review-bot
left a comment
There was a problem hiding this comment.
Reviewed. Suggestions are inline.
2 Suggestion-level finding(s) this review confirmed are already reported on this PR and are not repeated:
- R1-5 passive approval load bypasses the per-key attachment single-flight â already reported (comment 6060199953)
- R1-6 unreachable non-passive verifyMountForProbe branch in doCreateOrLoad â already reported (comment 6060199953)
Not explored to full depth (tool budget reached): "agent 1a": static javac / javap bytecode-size measurement of doResolveAction , requireReadyForNewWork and dispatch â the review worktree has no pre-built target/clâĶ.
äļæčŊīæ
å·ēåŪĄæĨã åŧščŪŪč§čĄå čŊčŪšã
æŽč―ŪįĄŪčŪĪį 2 æĄåŧščŪŪįš§åį°å·ēåĻ PR äļæĨåčŋïžäļåéåĪååļïžåčĄĻč§äļæđčąæéĻåïžã
æŠæĒįīĒå°å
ĻéĻæ·ąåšĶïžčūūå°å·Ĩå
·č°įĻéĒįŪïžïž"agent 1a"ïžstatic javac / javap bytecode-size measurement of doResolveAction , requireReadyForNewWork and dispatch â the review worktree has no pre-built target/clâĶã
â qwen3.8-max via Qwen Code /review (v0.25.0)
Fence late title writes by durable revision and replay the latest intent after ambiguous replies. Renew approval claims during slow attachment and settle journal-proven terminal answers without dispatching from disabled replicas. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
yiliang114
changed the title
|
Delivered additive commit The final title write now rejects an older revision inside the durable journal transaction. A stored latest delivery repairs ambiguous replies; FAILED same-key retries get a fresh revision, while completed replay remains read-only. This covers both bound and unbound Sessions, including the first rename before Java has saved an attachment boot. Approval delivery renews its claim during slow recovery, disabled replicas preserve requested tasks and settle only journal-proven final Actions, and the connector regression now exercises successful warm reuse.
Attribution: commit tree matches complete source candidate Initial failures are retained: two first-title probes exposed real404/409 gaps and drove the repairs. A new terminal test initially opened two independent journal fixtures and hit a stale head before its assertion; the shared-journal repair passes. Probe warmup/configuration/SQL-column mistakes, a stale ACP build prerequisite, two test-only TypeScript annotations and one skipped-name filter are recorded separately and excluded from passing evidence. These are real Spring HTTP, current-source Node Harness, Core journal, Java SDK, scheduler and worker paths with H2, same-JVM independent Spring contexts, a scripted approval provider and controlled holds/503 replies. No actual dispatcher process kill, MySQL, real-model, browser, packaged-CLI or mixed-old-writer ordering acceptance is claimed. New-head CI and human review are reported separately; the old head's green checks do not validate this commit. äļæïžæŽæŽĄåĻåäļäļŠ PR å čĄĨé―åŪĄæđæĒåĪååđķåæđåã79 äļŠåŪå Java server įĻäūã57 äļŠ SDKã31 äļŠ Coreã10 äļŠåĨįšĶåæįŧčŋå°æ éĒč·ŊįąįĻäūåéčŋïžįąŧåæĢæĨãæ žåžãåŪå lint å Checkstyle äđéčŋãįåŪäž čūéŠčŊčĶįæ§čŊ·æąæå°ãSDK čķ æķåčŋįŦŊįŧ§įŧæ§čĄãå·ēæäšĪåå äļĒåĪąįčŠåĻäŋŪåĪïžäŧĨåįŧåŪåæŠįŧåŪ Session éĶæŽĄæđåå°æŠäŋå boot æķįæĒåĪïžå Žå ąäļį§ææ éĒæįŧäļčīïžéæūäļéåĪå journalãéŧčŪĪæĒåĪå ģéæķïžåŪĄæđäļĒåĪąįžååäŧåŪæïžįĶįĻåŊæŽäļæĒå requested äŧŧåĄïžįåŪ worker įæäŧķææå·ēéŠčŊãååæĪåäŋæĪč―éį°åéŪéĒãéĶæŽĄæđåéŠčŊäļåŪé åį°į404äļ409įžšåĢå·ēäŋŪåĪïžåå§åĪąčīĨåååéįæŽįå―åąäŋįãH2ãčæŽæĻĄåãå JVM įįŽįŦ Spring context åæ éæģĻå ĨåææįĄŪæ æģĻïžäļå°å ķå―ä―į䚧 MySQLãčŋįĻåīĐæšãæĩč§åĻæįåŪæĻĄåéŠæķãæ°æäšĪ CI äļäššå·ĨåŪĄé åĶčĄæĨåïž#13269 įå ķäŧäšéĄđäļåĻčŋéå ģéã |
ðĐš serve daemon A/BBuilt the PR base vs this PR head
|
| field | PR base (before) | this PR (after) |
|---|---|---|
activeWorkStaleMs |
4 |
5 |
â Qwen Code · serve A/B
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
|
Pushed ordinary merge commit The 32-file repair payload remains byte-for-byte identical to the candidate documented above. After rebuilding the changed Core and ACP dependencies, Core metadata tests (31 cases) and CLI typecheck pass. The test engineer reran the real transport probes against this merged tree: approval cache-loss recovery passes in 12.99s, including the worker's The committed tree is identical to the tested merge index. Source/classes, both generated runtime trees and 122 dependency jar hashes were stable throughout the probes; the two new owned process groups were cleaned up. These probes retain the earlier H2, same-JVM Spring-context, scripted-provider and controlled-fault boundaries. Fresh-head CI and human approval remain separate from this local acceptance evidence. äļæïžå·ēįĻæŪéååđķæäšĪåæĨ mainïžäŋįå·ēæååēåđķįŧ§įŧä―ŋįĻæŽ PRãæĪå lint åĻâéĻįĶæŊåĶå åŦ main ææ°įæŽâæĨéŠĪæååĪąčīĨïžį°åĻ 8 äļŠéĻįĶæäšĪåå·ēå åŦïžæ°č§åäļįåŪå lint éčŋãåäŋŪåĪæķåį 32 äļŠæäŧķæŠåãæīæ° CoreãACP æåŧšäš§įĐåïž31 äļŠå æ°æŪįĻäūå CLI įąŧåæĢæĨéčŋïžåŪĄæđįåŪéūč·ŊåĪéŠ 12.99 į§ãåđķåæđååĪéŠ 7.89 į§åéčŋïžčĶįįžåäļĒåĪąãįĶįĻåŊæŽäļæĒäŧŧåĄãįåŪ worker æäŧķææãčŋå°åå ĨãSDK čķ æķååå äļĒåĪąåįčŠåĻäŋŪåĪãæĩčŊįīĒåžäļæäšĪæ äļčīïžčūå ĨæįšđįĻģåŪïžčŠæčŋįĻå·ēæļ įãæēŋįĻåčŋ° H2ãå JVMãčæŽæĻĄååæ éæģĻå ĨįéŠčŊčūđįïžæ°įæŽ CI äļäššå·ĨæđååĶčĄįĄŪčŪĪã |
ActionResponseCoordinator.recover() scans every deliverable ACTION_RESPONSE operation across tenants, so the PENDING response left in the shared test database by disabledReplicaSettlesOnlyJournalProvenEndedResponses reached this mock and bumped the resolveAction counter, making calls.get() 2 instead of 1 on both the MySQL 8.4 and the MariaDB lane. Ignore resolveAction calls for other action ids, the same action-scoped shape the shared harness mock already uses via its responses map. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-conflict/jmuzuwh4lfc
WorkspaceMigrationMySqlIT.upgradesCurrentMainWithoutChangingAppliedMigrations pins the versions applied on top of the V47 baseline. V53 was added by this pull request without extending that list, so the MariaDB lane failed with ["48", ..., "53"] against ["48", ..., "52"]. The failure only surfaced after the earlier ManagedActionsTest failure was fixed: the lane stops once the first surefire batch fails, and this class is in the second batch, so it never executed on the previous head. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-conflict/jmuzuwh4lfc
|
Qwen Code review timed out. Qwen review timed out after 21600 seconds (of the 360-minute budget). This run already used the maximum 360 minute timeout. See workflow logs. |
âĶssion Reject disabled or unsupported title requests before admission, claim inline delivery before I/O, and fence failed-owner cleanup against lease takeover. Include unfinished title deliveries in workspace migration idle checks. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
|
The new main conflict repair was delivered by conflict patrol Consolidated verification on frozen tree All four technical workflows for this exact head completed successfully: Qwen Code CI, including Web Shell E2E Smoke, SDK Java, including MariaDB and MySQL process fault gates, Serve A/B, and tui-parity. The 2026-10-10 13:56 UTC snapshot is 19 successful technical checks, 3 intentional skips, 0 pending and 0 failures. GitHub reports MERGEABLE / BLOCKED / REVIEW_REQUIRED; all 30 review threads remain resolved with no new actionable feedback, and no formal human approval is present. Technical CI is complete. Human approval and an authorized merge remain outstanding. Existing reviewer requests remain in place; no duplicate request or passive automatic-review wait was added. The main freshness observation at Scope ledger: the original eight-file +74/-7 baseline remains the approval starting point. Current scope against the current base remains 38 files +1305/-72, with no new PR paths or differing original production patch payloads relative to the updated base. This required conflict repair is cumulative round 14, after 13 prior rounds; optional Suggestions remain deferred under the late-round rule. R2-4 keeps the owner-confirmed safe-recovery contract: permanent Harness unavailability remains an external blocker, and retry counts or later refusals do not discard a possibly committed rename. Actual main is now Historical attribution: äļæïžčŋįŦŊåēįŠå·ĄæĢå·ēæĢåļļčŋ―å ååđķåđķæĻé 785dc86ïžåå ĨåŪé main 2ebbd4eãåŊäļæå·ĨåēįŠäļš MySQL åįš§ååēæčĻïžį°äŋį48â57ãV59æđåæéãV60åå·Ĩä―åšåäļŧįšŋV62äŧŧåĄåæķïžäšĪäŧGitæ åäļĪäļŠįķæäšĪäļå·ēéŠčŊåéåŪå ĻįļåïžæŽčåĪĐäļéåĪæäšĪææĻéãæđåSQLäļåïžæŠåŪææđåæéåæŠæķå°ūåå·Ĩä―åšäļĪéįŽįŦčŋį§ŧæĢæĨé―äŋįãäļŧįšŋäŧŧåĄåæķäļæŽPRæđåæĒåĪæŊäļååĨįšĶïžæēĄæåĒå æđååæķãéäžæčĄĨåŋåčŪŪãåéæ fee3d84däļäšĪäŧæäšĪåŪå Ļåđé ïžåŪé æ°æ§čĄ 191 éĄđäļåįĻäūïžSDK65ãæåĄįŦŊ120ãCLI 6ïžïžJavaįžčŊãæūåžCheckstyleãFlywayåŊäļæ§ãåŋ čĶCore/ACP䚧įĐæåŧšãCLIįąŧåæĢæĨäļdiffcheckéčŋãæšį åæĩčŊäļåįCore71+31éĄđæēŋįĻåčŊæŪïžäļéåĪæ§čĄæå å Ĩæ°čŪĄæ°ãåæŽĄCLIäļš5éčŋã1éĄđåéĐŧagentįŧ§įŧčŊ·æąåšį°æ æģå―å įsocketæčŋïžäŧ åĪąčīĨéĄđäļæŽĄįŽįŦåļĶHTTPčŪ°å―åĪæĩéčŋïžæšį æŠæđïžäļåįåĻCoreæåŧšäđåãåĪæĩčŪ°å―įŧ§įŧHTTP200ãåæķ/įķææķæäļDELETE204ïžåå§åĪąčīĨčŊ·æąčūđįäŧæŠįĨïžčŪ°å―äŧŠåĻåŊč―å―ąåæķåšãå æĪ191éĄđäļåįĻäūå·ēæéčŋįŧæïžåŪé æ§čĄ192æŽĄïž349/354éĄđčŋæŧĪįĻäūäļčŪĄãéĶæŽĄCLIįąŧåæĢæĨå æ§ACPåĢ°æįžšå°å―åæšį å·ēæåŊžåščåĪąčīĨïžäŧ å·æ°čŊĨå åđķéč·įąŧåæĢæĨåéčŋïžäļĪæŽĄåå§åĪąčīĨåäŋįã MySQLæŽå°äŧ įžčŊïžäļåĢ°į§°æ°č·UI/tmuxãįåŪæĻĄåæå ĻééŠæķãæ°headåéĄđææŊå·Ĩä―æĩå·ēå ĻéĻcompleted/successïžQwen Code CIïžåŦWeb Shell E2E SmokeïžãSDK JavaïžåŦMariaDBåMySQLčŋįĻæ ééĻįĶïžãServe A/Båtui-parityã13:56 UTCåŋŦį §äļš19éĄđæåã3éĄđææč·ģčŋã0éĄđįåū ã0éĄđåĪąčīĨïžææŊCIå·ēåŪæãGitHubäŧäļšMERGEABLE / BLOCKED / REVIEW_REQUIREDïžäššå·Ĩæđåäļč·ææįäššååđķäŧæŊįŽįŦåū åŪæéĄđïžäļæa765daf8äļŧįšŋæ°éēåšĶæŊåč―Ū13:26 UTCčŪ°å―ã 30äļŠįšŋįĻäŧå·ēč§ĢåģïžæĢåžäššå·Ĩæđåäļš0ïžæĒæåŪĄæ ļčŊ·æąäļéåĪåŽåŪĄïžäššå·Ĩæđååč·ææįäššååđķäŧåū åŪæãčåīäŋæ38æäŧķ+1305/-72ïžįīŊčŪĄ14č―Ūïžåį䚧åæīå åŪđäļæīæ°åįbaseåŊđåšäŋæäļåãR2-4æįĻæ·įĄŪčŪĪäŋįåŪå ĻæĒåĪäļæ°ļäđ äūčĩäļåŊįĻįåĪéĻéŧåĄïžäļäŧĨéčŊæŽĄæ°æåįŧæįŧäļĒåžåŊč―å·ēæäšĪįæđåã65įå ĻįŧŋCIã0fåé189éĄđã6120éŠčŊå614åŪé UI/tmuxįŧ§įŧäŋįåå―åąã åŪé mainå·ēå°a765daf8ïžäļĪéĄđåįŧprovider/MCPäŋŪåĪæŠäŋŪæđ8éĄđéĻįĶč·ŊåūïžæēĄææ°åĒæšæĒ°åēįŠæéåĪååđķ/éŠčŊã Earlier acceptance evidence, retained with original commit attributionDelivered the new actual-main conflict repair at Consolidated verification on frozen tree Evidence correction: the prior797 server Scope against actual main5b1c7014 is 38files +1305/-72 (18production +563/-38,15test +616/-27,5docs +126/-7), cumulative round12. Compared with797, the net change is two required test imports and one corrected existing comment (+3/-1), with no new module or protocol. Sixteen original production patch payloads are unchanged; the sole differing service payload incorporates the upstream role/facts gates and corrects the admission-method name. R2-4 remains the explicitly owner-confirmed external-blocker contract: uncertain admitted writes stay recoverable even if the Harness is permanently unavailable. No FAILED-state cancellation is claimed. Existing optional test suggestions stay deferred under the late-round scope rule. The one post-push snapshot for this exact head reports 1 technical check succeeded, 3 skipped, 16 pending, zero failed; informational assignment/label checks are excluded. GitHub is MERGEABLE / BLOCKED / CHANGES_REQUESTED. The mechanical conflict is cleared, but current-head technical CI is not yet complete.797âs completed green workflows below remain historical. All30 existing review threads retain their recorded dispositions; no new actionable feedback was found at entry. Human re-review/approval and an authorized merge remain separate gates, including CodeOwner review under the effective main ruleset. Existing reviewer requests are retained; no duplicate request or passive CI/automatic-review wait was started. äļæïžå·ēæĢåļļčŋ―å ååđķæäšĪ6120fc513659ïžåå ĨåŪé main 5b1c701ãäŋįäļŧįšŋâå æ ĄéŠč§čēåéæūåæ§ãæ§čĄäšåŪéåķæ°å·Ĩä―âįæéįšĶæïžäŧĨåæŽPRåæįåļĶįæŽæđåæéååŪå ĻæĒåĪãå·įžååŪĄæđæĩčŊäŋįREADERæįŧãįŽŽäšä―OPERATORäšĪæĨäļåäļįåĪäššįåđįéæūãmainå įĻV56 operation actor-keyåïžæŽPRæŠåå Ĩįæđåčŋį§ŧ饚åŧķV57ïžSQLéåčäļåïžMySQLåįš§ååēæčĻåäļčąæčŪūčŪĄåæĨïžæŠéæ°åžå ĨéäžæåæķåčŪŪã æŽč―Ūåäļåéæ 429éĄđåŪé æ§čĄįĻäūå ĻéĻéčŋïžJava394ãCore31ãCLI4ïžïž306éĄđčŋæŧĪCLIįĻäūäļčŪĄå ĨãJavaįžčŊãæūåžæåĄįŦŊCheckstyleéķčŋč§ãčŋį§ŧåŊäļæ§ãCore/CLIįąŧåæĢæĨåæ žåž/diffcheckéčŋïžH2äūæŽĄåšįĻV56äļV57ïžåŠäļšéæ§åĢ°ææåŧšäļæŽĄCoreãéĶæŽĄåéäļĒåĪąäļĪäļŠæĩčŊåŊžå ĨïžįžčŊéķæŪĩåĪąčīĨäļįĻäūæ§čĄäļš0ïžčĄĨé―åéč·éčŋïžåĪąčīĨäļæ§įæčŋį§ŧåĪäŧ―åäŋįãįš æĢæ§čŪ°å―ïžäļč―Ū797æåĄįŦŊmvn testæēĄæåŪé æ§čĄCheckstyleïžå ķæåĄįŦŊCheckstyleéčŋåĢ°ææĪåïžSDKæ§installæčŠčšŦCheckstylečŊæŪïžæŽč―ŪåĶææūåžæåĄįŦŊåŪæĩãSDKæšį æŠåïžæ§57éĄđSDKįĻäūäŧ æēŋįĻååēčŊæŪïžäļįŪæŽč―Ū429éĄđãHostedPublicWorkspaceITæŽå°äŧ įžčŊïžåŪæīNode/MySQLčŋčĄįąæ°head CIéŠčŊïžåŪé UI/tmuxäŧå―åą61449726ïžæŠéåĪčŋčĄæķéŠæķã čåīäļš38æäŧķ1305/-72ïžįīŊčŪĄ12č―ŪïžįļåŊđäļč―Ūåååäŧ äļĪäļŠåŋ čĶåŊžå ĨåäļåĪæĒææģĻéïž+3/-1ïžïžæēĄææĐåĪ§æĻĄåæåčŪŪãR2-4įŧ§įŧæįĻæ·įĄŪčŪĪäŋįåŪå ĻæĒåĪäļæ°ļäđ äūčĩäļåŊįĻįåĪéĻéŧåĄïžäļåĢ°į§°FAILEDįŧæåæķå·ēåŪį°ïžåŊéåæĩåŧščŪŪäŋæå·ēčŪ°å―įåįŧåĪį―Ūãæ°æäšĪåŊäļæĻéåŋŦį §äļš1éĄđææŊæĢæĨæåã3éĄđč·ģčŋã16éĄđåū åŪæã0åĪąčīĨïžčŠåĻæ įū/åé æĢæĨäļįŪææŊįŧæãGitHubå·ēæĒåĪMERGEABLEïžä―äŧäļšBLOCKED / CHANGES_REQUESTEDïžäļŧįšŋåēįŠå·ēč§ĢéĪïžæ°head CIå°æŠæķé―ãæ§797å ĻįŧŋåŠäŋįååēå―åąïžäššå·ĨåĪåŪĄãCodeOwneræđåäļč·ææįäššååđķäŧåū åŪæïžäļéåĪåŽåŪĄæįåū čŠåĻčŊåŪĄã Prior actual-main merge and completed technical CI (797e27d)Delivered actual-main conflict repair at Focused consolidated verification on candidate tree586b951f, exactly matching the delivered commit: 229 executed cases (SDK57, server137, Core31, CLI4), zero test failures/errors;305 filter-excluded CLI cases are not counted. Java compilation, Flyway uniqueness, Core/CLI typechecks, changed-file Prettier and diffcheck passed. H2 applied V55 channel binding then V56 rename delivery. The first CLI typecheck found stale local Core/email declarations from before main sync; after one necessary Core/email prerequisite build, only that typecheck reran and passed. The initial failure and the byte-matched stale generated migration backup remain in the evidence. No full suite, dependency reinstall, UI/tmux or MySQL fault rerun was performed. Scope against actual main e6e2c9e stays 38files +1302/-71 (18production +562/-37,15test +614/-27,5docs +126/-7), with zero net scope growth and cumulative round11. All17 original production-code diff payloads are preserved relative to the new base; the SQL body is unchanged. The original eight-file baseline and confirmed recovery contract are retained. The human review at71351f1e reported no new correctness defect and identified the mechanical conflict now fixed by this merge. Its R2-4 availability limitation remains the explicitly owner-confirmed external-blocker contract, not a terminalization fix. Optional unit-test gaps remain recorded follow-ups under the late-round scope rule; prior actual scheduler/HTTP/UI evidence stays pinned to61449726 and is not converted into a new-head test. A permanently unavailable Harness may continue to block admitted uncertain work; no retry budget discards it. Technical CI is complete and green for äļæïžå·ēæĢåļļčŋ―å ååđķæäšĪ797e27daïžåå ĨåŪé main e6e2c9eãäŋįäļæļļäļĪéĄđæļ éæĩčŊäļååŪĄæđåæ°åæĩčŊïžmainæ°åĒV55æļ éįŧåŪåïžæŽPRå°æŠåå Ĩįæđåčŋį§ŧ饚åŧķV56ïžSQLéåčäļåïžåįš§ååēæčĻäļäļčąæčŪūčŪĄåæĨãæēĄæéåååēïžäđæēĄæéæ°åžå Ĩéäž/åæķåčŪŪã åäļåéæ äļį229éĄđåŪé æ§čĄįĻäūéčŋïžSDK57ãæåĄįŦŊ137ãCore31ãCLI4ïžïž305éĄđæŠéCLIįĻäūäļįŪéŠčŊãJavaįžčŊãčŋį§ŧåŊäļæ§ãCore/CLIįąŧåæĢæĨåæ žåž/diffcheckéčŋïžH2äūæŽĄåšįĻV55äļV56ãCLIéĶæŽĄįąŧååĪąčīĨæĨčŠåå Ĩmainåįæ§Core/emailåĢ°æïžåŋ čĶäūčĩåæåŧšäļæŽĄååŠéč·čŊĨįąŧåæĢæĨåđķéčŋïžåĪąčīĨäļæ§įæčŋį§ŧåĪäŧ―äŋįãčåīäŧäļš38æäŧķ1302/-71ïžįīŊčŪĄ11č―Ūïž17åĪåį䚧äŧĢį åæīåŪæīäŋįãæĪæŽĄæēĄæéåĪå ĻéåŪčĢ ãæĩčŊãUI/tmuxæMySQLæ ééŠæķïžæ§61449726čŋčĄæķčŊæŪäŧäŋæåå―åąã ææ°äššå·ĨreviewįĄŪčŪĪæēĄææ°æĢįĄŪæ§įžšé·ïžæåšįæšæĒ°åēįŠį°å·ēč§ĢåģïžR2-4äŧæįĻæ·æįĄŪéæĐäŋįæ°ļäđ äūčĩäļåŊįĻįåĪéĻéŧåĄïžäļåĢ°į§°įŧæåæķå·ēåŪį°ãåŊéåæĩįžšåĢįŧ§įŧčŪ°å―äļšåįŧã797e27daå―åæäšĪįåéĄđææŊå·Ĩä―æĩį°å·ēå ĻéĻåŪæåđķéčŋïžQwen Code CIåŦWebShell E2EãJava SDKåŦMariaDB/MySQLčŋįĻæ éäļįåŪdaemon E2EãServe A/BåTUIåŋŦį §/æ éŠįæĢæĨïž18éĄđææŊæĢæĨæåã3éĄđč·ģčŋã0éĄđåū åŪæã0éĄđåĪąčīĨãåæĻéåŋŦį §į16éĄđåū åŪæäŋįäļšååēã30äļŠčŊåŪĄįšŋįĻåæåĪį―Ūã0æŠč§ĢåģïžæēĄææ°åĒåŊæä―åéĶãPRäŧäļšMERGEABLE / BLOCKED / CHANGES_REQUESTEDïžææŊCIéčŋäļäššå·ĨæđåååžčŪ°å―ïžå―åmainįäž įŧåæŊäŋæĪčĶæą2äļŠæđåïžįæč§åéåĶåĪčĶæąCodeOwneråŪĄæ ļïžæéįčŠåĻčŊåŪĄäļįŪææŊCIéĻæ§ïžåįŧææåéĶäŧäžåĪįãį°æreviewčŊ·æąäļéåĪåŽåŪĄïžįåū äššå·ĨåĪåŪĄåč·ææįäššååđķãæĪæŽĄäļéåĪæĩčŊæčŋčĄæķéŠæķïžåŪé UI/tmuxäŧå―åą61449726ïžæ§71351f1eįCIäļįŪæ°headįŧæã Earlier accepted recovery evidence and scope correction (71351f1 and prior heads)Delivered scope correction at Verification: the entire tracked tree is exactly equal to9ae0c662, whose technical CI completed successfully (Qwen Code CI, SDK Java including MariaDB/MySQL fault gates, Serve A/B and TUI parity). All production files remain equal to the61449726 source used for actual browser/tmux acceptance. This correction runs no new runtime test/build and does not relabel historical results as a fresh71351f1e run. Staged diffcheck passed. A pre-existing empty index lock was backed up and removed only after no open owner or active Git target was found. Current scope against main5ddd438: 38files +1302/-71 (18production +562/-37,15test +614/-27,5docs +126/-7). The26-file +866/-81 retirement extension is withdrawn. The original scope baseline remains eight files +74/-7, and substantive rounds remain cumulative (10); no new protocol/module responsibility was retained. R2-4 is reconciled as an owner-confirmed contract limitation, not an implemented FAILED/RETIRED terminal branch. Fresh disabled/unsupported/invalid-title requests are rejected before admission. Already-admitted uncertain work stays recoverable and blocks close/archive/delete/cwd/storage migration until confirmed or superseded. Timeout, last-attempt refusal or a budget cannot release that obligation safely. Earlier statements that the owner selected complete safe retirement are superseded by the explicit decision above; the experimental retirement report is preserved below as historical evidence only. Current-head technical CI is now complete and green at71351f1e8c5b against main5ddd43815bf1: Qwen Code CI including WebShell E2E Smoke, SDK Java including MariaDB/MySQL process fault gates and real-daemon E2E, Serve A/B and TUI parity/no-flicker. All four workflows report completed/success for the delivered head. The earlier post-push snapshot had11pending checks; it is retained as history, not the current result. The30review threads have dispositions, with zero unresolved and no new actionable feedback. The PR remains MERGEABLE / BLOCKED / CHANGES_REQUESTED: human/CodeOwner review and an authorized merge are outstanding. The queued automatic-review delay is informational, not a technical CI gate. Existing reviewer requests remain in place; no duplicate review request or passive wait was started. äļæïžå·ēæĢåļļčŋ―å æäšĪ71351f1eïžæĪå3294358įéäžåčŪŪæĐåąïžäŋįåäŋŪåĪäļClockåĪđå ·čĄĨäļïžæēĄæéåååēãįĻæ·åæŽĄæįĄŪéæĐâäŋįåŪå ĻæĒåĪïžæįĄŪåĪéĻéŧåĄčūđįâïžåđķįĄŪčŪĪæŠåĶčĄæææ°åĒåæķ/éäžæđæĄïžæĪååĶäļč―ŪæĨåäļįâå·ēéæĐåŪæīéäžæđæĄâäļåæŊææåĨįšĶãåŪæīäŧĢį æ äļå·ēéčŋå ĻéĻææŊCIį9ae0c662įļåïžį䚧æšį äļ61449726įåŪé UI/TUIéŠæķäļčīïžæŠéæ°č·čŋčĄæķæĩčŊïžäļæååēčŊæŪéæ äļš71351f1eãčåīæĒåĪ38æäŧķ1302/-71ïžč―ŪæŽĄįīŊčŪĄ10ïžæ°åĒ26æäŧķ866/-81å·ēæĪåãR2-4æįĄŪčŪĪåĨįšĶæķå°ūïžäļåĢ°į§°įŧæåæķå·ēåŪį°ïžæ°ļäđ äūčĩäļåŊįĻäŧæŊæįĄŪåĪéĻéŧåĄã71351f1eå―åæäšĪįåéĄđææŊå·Ĩä―æĩį°å·ēå ĻéĻåŪæåđķéčŋïžQwen Code CIåŦWebShell E2EãJava SDKåŦMariaDB/MySQLčŋįĻæ éåįåŪdaemon E2EãServe A/BåTUIåŋŦį §/æ éŠįæĢæĨãæĪå11éĄđåū åŪææŊååēæĻéåŋŦį §ã30äļŠčŊåŪĄįšŋįĻåæåĪį―Ūã0æŠč§ĢåģïžæēĄææ°åĒåŊæä―åéĶïžPRäŧäļšMERGEABLE / BLOCKED / CHANGES_REQUESTEDïžįåū äššå·Ĩ/CodeOwneråŪĄæ ļåč·ææįäššååđķãæéįčŠåĻčŊåŪĄåŧķæķäļæŊææŊCIéĻæ§ïžäļéåĪåŽåŪĄãå61449726įåæ§æšį UI/TUIčŊæŪäŋæåå―åąïžäļåĢ°į§°æ°č·čŋčĄæķéŠæķïžåŪéŠæ§éäžæĩčŊ239éĄđåŠä―äļšå·ēæĪååŪį°įååēčŪ°å―ïžäļįŪå―ååŪį°įéŠæķįŧæã Verified original-contract evidence and prior dispositions (6144972 /9ae0c662)Continuation at head Latest observed CI has no failed technical checks. Lint/static, Linux tests, integration, MariaDB, real-daemon, Serve A/B, TUI parity/no-flicker, desktop and all Java SDK matrices passed. MySQL process fault gates and WebShell E2E Smoke remain in progress; automatic review is also running. Branch rules require one approval and CodeOwner review; effective review is still CHANGES_REQUESTED. Pending checks and approval are not declared complete. No new production patch or repeat validation was needed for this contract decision. Delivered head The previous head's first failing CI step was the Flyway uniqueness gate: new main #13550 uses V54. The unmerged rename migration now uses V55 after roles/owner V53 and child-lineage V54, with unchanged schema/delivery contract; 55 unique migration versions pass locally. The earlier V53 collision and generated-resource failure remain historical records. Fresh focused verification: 199 distinct selected Java cases, Java compilation and Checkstyle with zero violations, Core build, 31 Core metadata cases, one delayed-title CLI case and CLI typecheck passed. This is a selected set, not the entire repository suite. Two new Java assertions initially expected a nonexistent exception-details field; only those assertions were corrected and the affected 35 cases plus two dependency prerequisites reran successfully. The automatic main merge also introduced a duplicate CLI import; it was removed and the affected CLI checks passed. Initial logs/reports are preserved; reruns are not added to the distinct case count. Fresh observer evidence on candidate
Two observer fixture failures remain visible: a bound close was unavailable because that fixture explicitly lacks close support; the supported unbound close path then passed. The first controlled409 omitted the required boot identity, so SDK generation validation correctly returned503; a corrected classification-only run passed. Unicode evidence from that earlier run remains attributed to its completed arms. Pre-fix Unicode/409/gap-lock evidence this round is source/reviewer witness, not newly executed local reproduction. No fresh local InnoDB witness was run for the SQL repair; H2 does not establish InnoDB locking behavior. Earlier approval cache-loss evidence remains at Evidence boundary: macOS Java21/H2, real Spring/public/private HTTP, current-source Node Harness/SDK/Broker and compiled Core, scripted provider and controlled holds/reply drops. Separate Spring contexts share one JVM. The backend probes above do not claim real-model, MySQL/MariaDB/InnoDB, browser, packaged CLI or process-death acceptance; actual source-browser/tmux evidence is separately added below. The final upstream WebShell-only merge did not change the frozen acceptance paths. All observer-owned process groups are empty; no unrelated service/database was changed. Actual UI/tmux acceptance added at tested head61449726ead0. At publication, PR head is9ae0c6623487: its sole subsequent change registers a Clock in the Java artifact test fixture; tested product sources are unchanged. Evidence below stays attributed to61449726, not relabeled as a fresh run on9ae0c662.
Actual tmux capture excerpt:
Scope: actual source WebShell/components/TypeScript SDK in an isolated Vite host, real Java/H2/HTTP/Node Harness/Broker/file effects and separate source CLI tmux; controlled provider, same-JVM secondary Spring context. 1,269 frontend inputs and 7,524 native inputs stayed unchanged. No packaged UI/CLI, real-model, InnoDB or separate-process failover claim. Initial fixture compilation/scheduler setup failures, an incorrect empty-composer Send assertion and screenshot failures are preserved. Corrected composer interaction and final page-surface capture passed; the unrelated foreground-surface fallback was excluded and never published. No complete zero-console-error claim is made. These tests found no new defect in the exercised paths. R2-4 was subsequently reconciled by the owner-confirmed contract; the tests do not prove offline cancellation or terminal retirement. Current-head CI and review approval remain separate gates. Five published Critical findings are fixed; R2-4 is reconciled under the owner-confirmed safety contract, with permanent-outage blocking accepted explicitly rather than a terminal-state implementation claimed. Optional suggestions are explicitly recorded below after eight substantive closeout rounds. Post-push snapshot at 2026-10-09 07:06 UTC: delivered head61449726ead0, base5ddd43815bf1, MERGEABLE, review CHANGES_REQUESTED. Flyway uniqueness and SDK Java11/17/21 on Linux, Java21 on macOS/Windows passed. No failed technical check was reported; eight checks remained pending, including lint/tests, Managed Agent MariaDB/MySQL, real-daemon/integration and automatic review. Six duplicate Qwen Autofix route runs were cancelled, not reported as compiler/test failures. A concurrent patrol had closed the remaining discussions as follow-ups; R2-4 was explicitly reopened because retirement safety is still unagreed. Other recorded Suggestions remain deferred. No passive CI/review wait or rerun was started. Published automatic review attempt 2, reviewed commit a557ab0, has different findings from the recovered attempt-1 artifact below even though both use R2 labels.
Recovered unpublished attempt 1 (artifact11588875669, also reviewed a557ab0), retained with its original distinct IDs:
Scope against merged main5ddd438: 37 files +1301/-71 (production +562/-37, tests +613/-27, docs +126/-7). Upstream child/runtime/WebShell work is excluded. Growth from the original eight-file approval baseline remains the user-authorized combined rename contract and confirmed regressions. Eight substantive rounds are recorded; remaining optional suggestions are explicitly deferred under the repository's late-round scope rule. äļæéŠæķäļåū åå·ēæĻé 199 äļŠäļå Java åŪåįĻäūãJava įžčŊäļ Checkstyleã31 äļŠ Core įĻäūãäļäļŠ CLI čŋå°æđåįĻäūãCLI įąŧåæĢæĨå55äļŠčŋį§ŧåŊäļæ§æĢæĨéčŋãįåŪå Žåž HTTP éŠčŊåį§įĐšį―æ éĒæįŧäļæ å―äŧĪ/æéïžclose äŧåŊåå Ĩïžå åŦæåį Unicode æ éĒäŋæååžãåæģį§æ superseded 409 įŧčŋåŪé SDK åæåĄåäŧäļšå Žåž409ã8.24į§įįåŪ Node č·ŊåūéŠčŊäšåŪé čķ æķãæ§åå ĨčĒŦæįŧåäļĒåå įčŠåĻæĒåĪïžjournal æ°éäŋæ1â1ãéĶæŽĄæĩčŊæčĻãéåĪ importãäļĪäļŠåĪđå ·åå åĪąčīĨåäŋįčŪ°å―ïžæēĄææéč·įīŊå ææåĪąčīĨæđåäļšæåã å·ēäŋŪåĪæŽæŽĄå ŽåžčŊåŪĄäļįäšéĄđ CriticalïžįĻæ·į°å·ēæįĄŪéæĐ R2-4 įåŪå ĻæĒåĪåĨįšĶïžæ°ļäđ äūčĩäļåŊįĻæķäŋįåĪéĻéŧåĄïžäļææŽĄæ°ææåäļæŽĄæįŧäļĒåžäļįĄŪåŪåå Ĩãå·ēåĻčŊåŪĄįšŋįĻčŪ°å―åđķæčŋäļåĨįšĶæķå°ūïžæēĄæåĢ°į§°åŪį°įŧæåæķãæ°įĶįĻãæ§åčŪŪåéæģæ éĒäļå䚧įåĄä―įčĄïžä―åįŧäļæŽĄåéåæįŧäļč―čŊæå ååå ĨæŠįæïžįīæĨæļ įĐšæéåķéčŊæŽĄæ°äžäļĒåĪąå·ēæĨåįŧæãå ķä―åŊéæĩčŊãæ§č―ãææĄĢåæļ įåŧščŪŪå·ēéįŧčŪ°å―äļšåįŧäšéĄđã 11.61į§åŪĄæđįžåæĒåĪäŧæ æģĻäļš e0a734 äļįååēčŊæŪãæŽæŽĄå·ēčĄĨå61449726äļįåŪé tmux äļæĩč§åĻéŠæķïžæéå čŪļįĄŪåŪåæäŧķïž/renameæīæ°įéĒäļäžčŊčŪ°å―ïžæįŪĄ UI åĻįžå1â0åį§æ503åįąįæĢåŪæķåĻæĒåĪååŪĄæđïžå čŪļįžčūåæäŧķäļšafterïžčūå ĨæĄåæŽĄåéåđķæįŧäļĪéĄđå·Ĩå ·åæäŧķäŋæafterïžäļĪč―ŪåCompleted/Readyïžå ŽåžAPIæđåååŪé RefreshæūįĪšæ°æ éĒãåäŧ―ANSI/plain captureãéæĨįķæåæįŧæŠåūå·ēäŋįïžåūįäļäž æåŪå Žå ąåūåšåđķčŊŧåæ ļåŊđãååļåheadæĻčŋå°9ae0c662ïžäŧ čĄĨäļčĄJavaæĩčŊåĪđå ·ClockæģĻåïžæŽæŽĄčŋčĄæšį äļåïžčŊæŪäŧå―åą61449726ãįšŊįĐšį―SendæčĻãæŠåūåĪąčīĨäļåå§åĪđå ·åĪąčīĨåčŪ°å―ïžæēĄææåĻrecoverïžäđæēĄææåå°æĨåŋå å―TUIãįŊåĒäŧæŊH2ãæšį čŋčĄäļåæ§providerïžäļåĢ°į§°įåŪæĻĄåãMySQL/InnoDBãæå 䚧įĐæčŋįĻæŧ䚥éŠæķïžR2-4įįĨéåå·ēįąįĻæ·æįĄŪéåŪäļšäŋįåŪå ĻæĒåĪååĪéĻéŧåĄčūđįïžäļäŧĢčĄĻæ°åĒįŧæåæķã07:06 UTC įåŋŦį §äļïžčŋį§ŧåŊäļæ§åååđģå° Java SDK æĢæĨéčŋïžæēĄæææŊæĢæĨåĪąčīĨïžå ŦéĄđ CI/čŠåĻčŊåŪĄäŧåĻčŋčĄïžå äļŠéåĪ Autofix č·ŊįąčĒŦåæķãåđķåå·ĄæĢæūå°åŧščŪŪå R2-4 æåįŧäšéĄđå ģéïžæŽč―Ūéæ°æåžäŧéįĄŪčŪĪåŪå ĻįįĨį R2-4ãčŊåŪĄäŧäļš CHANGES_REQUESTEDïžäļč―æ äļšå ĻéĻæķæã Withdrawn retirement experiment at3294358 (historical; authorization claim corrected above)Delivered safe retirement at Eight unconfirmed attempts switch durably to RETIRING. Recovery then retries only the remote revision fence. The Harness preserves the actual title, persists retirement before acknowledging it, and rejects all same/older title writes before replay. Only an exact version2 receipt lets the current unexpired SQL owner reconcile the title, store RETIRED, and release lifecycle/migration barriers. Lost, malformed or unknown retirement replies remain blocked. The retired key returns an explicit conflict; higher fresh revisions remain supported. No timeout or exception is treated as proof that an earlier write never applied. Fresh final verification: 239 executed cases (SDK68, managed-server121, Core33, CLI17), zero failures/errors; 301 CLI cases were filter-excluded. Core build, Core/CLI typechecks, changed TypeScript lint/format, Java compile/Checkstylezero and diffcheck passed. Two independent final reviews are C=0/scope pass. Initial compiler, dependency-prerequisite and style failures are retained; reruns are not added to the count. The prior9ae Clock fix separately passed26 original artifact-fixture cases. The fresh controlled real Spring/H2 + Java coordinator/connector/SDK + Node private HTTP/journal probe passed. Eight successful private replies replaced with503 produced RETIRING; lost503, malformed200 and unknown503 retirement replies each kept close admission blocked. A fourth strict acknowledgment reconciled matching titles, produced one retirement event and made Workspace close admission available. A clean private unload and new Node process still rejected the old committed revision with409, while a higher revision succeeded. The journal retained exactly one title and one retirement transaction. This uses synchronous coordinator driving/zero backoff, production-store admission and controlled transport faults; it does not claim public PATCH, actual runtime close, abrupt crash/live-lock takeover, production databases or real-model acceptance. Three observer-only API/serialization mistakes are preserved in the probe history. Scope: immutable round start 38files1302/-71 â 39files2084/-68. The additive commit changes26files866/-81; effective feature growth is785lines, including300implementation,457test and28doc lines. The sole new production file is the immutable Java11 SDK retirement receipt. All growth is attributed to the explicitly accepted cross-store retirement contract and separate Node/SDK/SQL invariants. Original8file74/-7 baseline remains unchanged; substantive round8â9 stays in correction mode. Scheduler/performance/refactor suggestions and optional event-surface narrowing remain follow-up. One post-push snapshot: MERGEABLE, old effective CHANGES_REQUESTED, no failed checks observed;7success/8skipped and16in-progress/queued/waiting checks. CI and human/CodeOwner approval remain pending, and this run does not wait for automated review. äļæïžæŽč―ŪææįĄŪéæĐčĄĨåŪåŪå Ļéå―đïžæŋäŧĢæĪåįåčŪŪåŧķæãčūūå°å ŦæŽĄéĒįŪåŠåæĒäļšæäđ éå―đïžäļæļ éĪæåščīĢäŧŧïžčŋįŦŊįĄŪčŪĪäļįĄŪåŪæķäŧéŧåĄïžææįĄŪčŪĪåŊđé―įåŪäŋįæ éĒåæåžæūįå―åĻæã239éĄđåŪåæĩčŊäļåæ§įåŪč·ĻååĻéūč·Ŋéčŋïž301éĄđæŠéįĻäūäļįŪå·ēéŠčŊïžåå§åĪąčīĨäļäļæŽĄæĒéčŠčšŦéčŊŊåäŋįãå·čŋįĻéæ°å č――åæ§įæŽäŧčĒŦéįĶŧïžå ģéäŧ éŠčŊį䚧åå ĨïžæŠæ§čĄåŪé runtime closeæå Žå ąPATCHïžäļåĢ°į§°įåŪæĻĄå/į䚧æ°æŪåšåŪæīéŠæķãCIäļäššå·Ĩæđåäŧåū åŪæã Round 14 â
|
base 543f03e5b1 â head |
impl | test | docs | files | |
|---|---|---|---|---|---|
previous (fbda4a2419) |
+1306 / -73 | 563 / 38 | 617 / 28 | 126 / 7 | 38 |
current (7105fb1e4c) |
+1348 / -77 | 563 / 38 | 659 / 32 | 126 / 7 | 38 |
| delta | +42 / -4 | 0 / 0 | +42 / -4 | 0 / 0 | 0 |
Scope verdict: pass. Implementation lines are byte-for-byte unchanged and no file was added; the entire delta is one existing test method. No scope-growth trigger fired (no new package, dependency, public API, persisted format, or security boundary).
- R2-23 (Critical) â FIXED and measured.
renameStoreFailuresPreserveTheOriginalErrorAndAllowRetryraced theSessionRenameCoordinatorthis class schedules atdispatch.scan-delay=50ms. Baseline on this box: 12 red / 20 runs; after the fix: 0 red / 20. The parkâassertâunpark patch previously posted on the thread was applied first and measured at 6 red / 9 â not sufficient, and the thread reply corrects that. Landed shape: gate the coordinator at its only precondition (harness.isAvailable(), which the inlinecreateOrLoad/renamepath never consults), park both claim branches while pinning state, then hand the row to the recovery path and await settlement so the trailing PATCH replays instead of racing for the claim. - R3-3 (Suggestion) â FIXED in the same hunk (not a separate change): the
cleanuparm now assertsdelivery_state == RUNNING/command_status == PENDING, and bothUPDATEs assert one affected row. - R3-2 (Suggestion) â DEFERRED to fix(managed-agent): #13682 follow-ups: rename title-blankness asymmetry and deferred review suggestions #13868 item 1. Scope grounds only; the toolchain premise previously recorded in that issue is now false and was corrected there this round.
- R4-1 (Suggestion) â DEFERRED to fix(managed-agent): #13682 follow-ups: rename title-blankness asymmetry and deferred review suggestions #13868 item 3 (added this round, boundary-verified).
- R2-4 (Critical) â HUMAN-GATED, left unresolved. The implementation it asks for is materially the retirement protocol withdrawn at
71351f1e8c. Two opposite options posted with a recommendation for the subtractive one. - Base merge
23316dd74dwas delivered by the author mid-round; the localWorkspaceMigrationMySqlITconflict resolution ("65", "66") was superseded by an identical one, so this round pushed exactly one commit on top of the live head. Verified fast-forward: 1 parent, tree OID match,mergeable=MERGEABLE.
Verification: 20/20 flake loop, ManagedSessionLifecycleTest 35/35, checkstyle:check 0 violations, check-flyway-migrations 62 unique. Not run: MySQL-backed IT lanes (no Docker daemon here) â CI remains their oracle.
äļæčŊīæ
įšŊæĩčŊč―ŪãæŽč―ŪåĻčŊĨæšåĻäļčĢ
åĨ―äš JDK 21 + Mavenïžäđåå č―ŪčŪ°å―įãpackages/sdk-java/** æŽæšįŧææ§æ æģéŠčŊãčŋäļŠåæå·ēäļæįŦïžæäŧĨ R2-23 æŊåŪæĩčéé
čŊŧåĪåŪã
čåīåŪæīæ§ïžåŪį°čĄ 563/38 äļĪäū§åŪå Ļäļčīãéķæ°åĒæäŧķïžæŽč―Ūå ĻéĻåĒéæŊ +42/-4 äļé―č―åĻäļäļŠæĒææĩčŊæđæģé â scope verdict = passïžæēĄæč§Ķåäŧŧä―åĒéŋåĪæŪã
- R2-23ïžCriticalïžå·ēäŋŪåđķåŪæĩïžčŊĨæĩčŊäļæŽįąŧäŧĨ
dispatch.scan-delay=50msč°åšĶįSessionRenameCoordinatorįŦäšãæŽæšåšįšŋ 20 æŽĄäļ 12 įšĒïžäŋŪåĪå 20 æŽĄ 0 įšĒãå åčīīåĻįšŋįĻéį parkâassertâunpark čĄĨäļæå į §åäšïžåŪæĩ 9 æŽĄäļ 6 įšĒãåđķäļčķģåĪïžå·ēåĻįšŋįĻååĪéįš æĢãæįŧč―å°įå―ĒįķæŊïžåĻåč°åĻåŊäļįåį―ŪæĄäŧķïžharness.isAvailable()ïžčå čcreateOrLoad/renameč·ŊåūäŧäļčŊŧåŪïžäļæåŪéļä―ïžåéĐŧäļĪæĄ claim åæŊååéä―åĪąčīĨåįķæïžæåæčŊĨčĄäšĪåæĒåĪč·Ŋåūåđķįåū å ķč―åŪïžä―ŋæŦå°ū PATCH čĩ°éæūčäļæŊäšæĒ claimã - R3-3ïžSuggestionïžåĻåäļæŪĩ hunk å
äļåđķäŋŪæïžäļæŊäļĪäļŠæđåĻïžïž
cleanupåæŊį°åĻæčĻdelivery_state == RUNNING/command_status == PENDINGïžäļĪåĪUPDATEé―æčĻå―ąå 1 čĄã - R3-2ïžSuggestionïžåŧķæå° fix(managed-agent): #13682 follow-ups: rename title-blankness asymmetry and deferred review suggestions #13868 įŽŽ 1 æĄïžįįąåŠåĐčåīïžčŊĨ issue éåå åįå·Ĩå ·éūåæå·ēåĻæŽč―ŪæđæĢã
- R4-1ïžSuggestionïžåŧķæå° fix(managed-agent): #13682 follow-ups: rename title-blankness asymmetry and deferred review suggestions #13868 įŽŽ 3 æĄïžæŽč―Ūæ°åĒåđķåäščūđį grep éŠæķïžã
- R2-4ïžCriticalïžäššå·ĨčĢåģïžåŧæį unresolvedïžåŪčĶæąįåŪį°åšæŽå°ąæŊåĻ
71351f1e8cčĒŦæĪåįéĢåĨéå―đåčŪŪïžå·ēæäļĪäļŠäšæĨééĄđčŋåæĻčïžåæģéĢäļäļŠïžčīīåĻįšŋįĻéã - æŽč―Ūäļéä―č
æĻäš base merge
23316dd74dïžææŽå°č§ĢįWorkspaceMigrationMySqlITåēįŠïž"65", "66"ïžäļäŧéĢäŧ―éåįļåå ččĒŦåäŧĢïžæäŧĨæįŧåŠæĻäšäļäļŠæäšĪå° live head äđäļãå·ēæ ļäļš fast-forwardïžå parentãtree OID äļčīãmergeable=MERGEABLEã
éŠčŊïž20/20 æåĻåūŠįŊãManagedSessionLifecycleTest 35/35ãcheckstyle:check 0 čŋč§ãcheck-flyway-migrations 62 äļŠįæŽåŊäļãæŠč·ïžäūčĩ MySQL į IT laneïžæŽæš docker daemon æŠčŋčĄïžïžčŋéĻåäŧäŧĨ CI äļšåĪæŪã
Round 14 delivery note: the fix was delivered as
7105fb1e4c; the live head is nowab1af69395(author), which contains it byte-identically and adds an equivalent V66âV67 renumber that cleared theFlyway migration version uniqueness (latest main)red. The round's two local commits (01eaff2288base merge,3e3df6fd5crenumber) are redundant and were deliberately not pushed.
Upstream #13544 added V53__managed_workspace_roles.sql, so V53__managed_session_rename_delivery.sql collides on the pull_request merge tree and fails the "Flyway migration version uniqueness" gate. Renumber the rename-delivery migration to V54 and extend the WorkspaceMigrationMySqlIT expectation to 48..54, which is the version set the merged tree applies. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmv0iu3nwgo
Keep the existing positive rename and creator replay fixtures compatible with the explicit title protocol preflight. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Resolves the migration numbering collision: main's V53__managed_workspace_roles.sql (#13544) and this branch's rename-delivery migration both claimed version 53. The rename-delivery migration now lives at V54 and WorkspaceMigrationMySqlIT expects 48..54. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmv0iu3nwgo
qwen-code-review-bot
left a comment
qwen-code-review-bot
left a comment
There was a problem hiding this comment.
Partially reviewed â gaps disclosed.
12 Suggestion-level finding(s) this review confirmed are already reported on this PR and are not repeated:
- README in-flight-exclusivity sentence falsified by the new delivery gate â already reported (R2-10, comment 4227117226)
- the fenced 4-arg rename wire path and the service revision value asserted by nothing â already reported (R2-11 / R2-22, comments 4227117230 / 4227117295)
- nothing drives SessionRenameCoordinator delivery orchestration â already reported (R2-13, comment 4227117247)
- the rename delivery table has no lease-renewal primitive â already reported and author-deferred (R2-14, comment 4227117250)
- the cwd-gate hasPendingRenameDelivery clause is untested â already reported and author-deferred (R2-21, comment 4227117290)
- the lease-loss stand-down and the per-delivery renewal cancel are unexercised â already reported (R1-1, comment 4227117236)
- the dead HostedHarnessCapabilities constructor shims default titleProtocolVersion to 0 â already reported, author in progress (R2-24, comment 4227117302)
- both bounded scans select with a LIMIT and no ORDER BY â already reported (R2-16, comment 4227117265)
- the verifiedRecovery parameterization cannot reach production code â already recorded as deferred (round 3, review 5480364248)
- the 1 Hz sweep makes decisionDigest per-call ObjectMapper hot â already recorded as deferred (round 3, review 5480364248)
- the redelivery worker gates on isAvailable but never supportsFencedTitles â already recorded as deferred (round 3, review 5480364248)
- settleEndedResponses claims operations whose lease is still live â already reported (@chiga0 Q1, review 5479915880)
Not explored to full depth (tool budget reached): "agent reverse-audit (round 3)": the lease establish/clear/takeover side of the protocol â ManagedAgentStore.beginSessionRename / claimRename / abandonSessionRename / retryRename / delâĶ; "agent reverse-audit (round 3)": read precedence between the route's manual custom_title sink record and the fenced session_metadata domain record's title on a cold reopen ( hosted-harnesâĶ; "agent reverse-audit (round 3)": whether ActionResponseCoordinator 's single-threaded renewals executor (line 40-45, one scheduleWithFixedDelay per in-flight delivery, each doing a blockinâĶ; "agent reverse-audit (round 1)": the doc claims "Available Harness replicas claim due deliveries using the existing dispatch lease and retry settings" and "The worker renews its claimed operatiâĶ.
Not reviewed: reverse audit â did not converge within the reverse-audit round cap of 5.
Deferred under the convergence posture (round 4, not a blocker) â recorded, not requested in this round:
packages/sdk-java/managed-agent-server/src/main/java/com/alibaba/qwen/code/managedagent/service/ManagedAgentService.java:481 â [probe] claimRename returning empty is collapsed into one 503âĶpackages/sdk-java/managed-agent-server/src/test/java/com/alibaba/qwen/code/managedagent/ManagedSessionLifecycleTest.java:681 â [probe] Three new not-wedged probes use beginOperation, a write,âĶpackages/sdk-java/managed-agent-server/src/test/java/com/alibaba/qwen/code/managedagent/ManagedSessionLifecycleTest.java:545 â [probe] preservesOnlyTheNamedSupersededTitleConflict leaves a liveâĶpackages/sdk-java/managed-agent-server/src/test/java/com/alibaba/qwen/code/managedagent/store/WorkspaceMigrationStoreTest.java:323 â [probe] The new migration-gate test pins only the refusal half ofâĶpackages/sdk-java/managed-agent-server/src/test/java/com/alibaba/qwen/code/managedagent/harness/QwenHostedHarnessConnectorTest.java:1967 â [probe] Propagating the caller's passive flag into create()'s twoâĶpackages/sdk-java/managed-agent-server/src/test/java/com/alibaba/qwen/code/managedagent/ManagedSessionLifecycleTest.java:426 â [review] The rewritten allowsOneLifecycleChangeAtATime forcesâĶpackages/sdk-java/managed-agent-server/src/test/java/com/alibaba/qwen/code/managedagent/ManagedSessionLifecycleTest.java:511 â [probe] The blank-title refusal is pinned to four hand-listed codeâĶ
äļæčŊīæ
äŧ åŪæéĻååŪĄæĨïžåŪĄæĨįžšåĢå·ēæŦéēã
æŽč―ŪįĄŪčŪĪį 12 æĄåŧščŪŪįš§åį°å·ēåĻ PR äļæĨåčŋïžäļåéåĪååļïžåčĄĻč§äļæđčąæéĻåïžã
æŠæĒįīĒå°å
ĻéĻæ·ąåšĶïžčūūå°å·Ĩå
·č°įĻéĒįŪïžïž"agent reverse-audit (round 3)"ïžthe lease establish/clear/takeover side of the protocol â ManagedAgentStore.beginSessionRename / claimRename / abandonSessionRename / retryRename / delâĶïž"agent reverse-audit (round 3)"ïžread precedence between the route's manual custom_title sink record and the fenced session_metadata domain record's title on a cold reopen ( hosted-harnesâĶïž"agent reverse-audit (round 3)"ïžwhether ActionResponseCoordinator 's single-threaded renewals executor (line 40-45, one scheduleWithFixedDelay per in-flight delivery, each doing a blockinâĶïž"agent reverse-audit (round 1)"ïžthe doc claims "Available Harness replicas claim due deliveries using the existing dispatch lease and retry settings" and "The worker renews its claimed operatiâĶã
æŠåŪĄæĨïžåååŪĄčŪĄââåĻ 5 č―ŪįååŪĄč―Ūæ°äļéå æŠæķæã
æķæå§ŋæäļåŧķåïžįŽŽ 4 č―Ūïžééŧæïžââå·ēčŪ°å―ïžæŽč―ŪäļčĶæąäŋŪæđïžå ą 7 æĄïžåææŠįŋŧčŊïžåčĄĻč§äļæđčąæéĻåïžã
â qwen3.8-max via Qwen Code /review (v0.25.0)
| } | ||
| long delay = HarnessCoordinator.retryDelay(settings.getRetryInitialDelay(), | ||
| settings.getRetryMaxDelay(), delivery.attemptCount()); | ||
| store.retryRename(delivery, owner, Math.addExact(clock.millis(), delay)); |
There was a problem hiding this comment.
[Critical] R2-4: [fails-closed] [regression] Still standing, and this round narrowed it: the "named 409" half of the earlier framing is withdrawn, the pre-send refusals and the tenant-scope predicate shape are not.
A rename delivery still has no terminal state. deliver()'s catch (RuntimeException) runs abandonSessionRename then retryRename(now + retryDelay) with no terminal branch and no attempt budget, and both gates that read the row still test delivery_state <> 'COMPLETED' â hasPendingRenameDelivery (ManagedAgentStore.java:936-939, consumed at :1231 for CLOSE/ARCHIVE/DELETE and at :1381 for cwd) and WorkspaceMigrationStore.requireIdle (:339-342, scoped by workspace_storage_id). Nothing in src/main writes a terminal value to this table or deletes from it.
This round's verification withdraws one of the two sub-claims round 3 carried. A 409 from completeSessionRename always coincides with the row's revision having moved, so retryRename's WHERE âĶ revision = ? AND lease_owner = ? matches nothing and no re-queue happens; and because the SQL revision is bumped before the Harness write, the Harness watermark can never exceed it. That half does not stand and is not re-asserted here.
What does stand is narrower and does not touch the recorded contract. This thread carries an owner-confirmed decision to preserve uncertain-write recovery and retain permanent Harness unavailability as an external blocker, and this comment does not re-litigate it. The surviving states are refusals that happen before any write is attempted, so there is no uncertain write for the contract to preserve:
authorizePassiveAttachment's exits areWorkspaceExecutionStore.unavailable()=RuntimeBrokerException(409, "workspace_unavailable", âĶ, retryable=false)(WorkspaceExecutionStore.java:521-524), thrown on structural binding drift, a non-ACTIVEstatus anddeletedAt != null.ManagedAgentService.java:494-497re-queues it withavailable_at = nowand then tells the client it is terminal. The design doc states the rule this path breaks: "Mutable grant or registry refusal remains retryable; structural binding or storage mismatch remains terminal."doCreateOrLoad:239-241throwsIllegalStateException("Hosted Workspace files are disabled")forever on a replica with workspace files off, becauseisAvailable()is a hard-codedreturn true;(QwenHostedHarnessConnector.java:126-128) and isrecover()'s only gate.- The client-side pre-send
DaemonProtocolException("Hosted Harness title protocol version 1 is required"), for the same reason ârecover()never consultssupportsFencedTitles().
Separately, and outside the contract entirely, is the predicate's scope. The owner's decision accepts a Session staying blocked. It does not speak to one undeliverable rename making every Session bound to that workspace_storage_id permanently un-migratable and un-retirable at tenant scope, with no operator-reachable remedy. The house precedent for bounding the loop is in this package, not outside it: SessionLifecycleCoordinator.CWD_CHANGE_ATTEMPT_BUDGET = 8 and TaskCancelCoordinator.ATTEMPT_BUDGET = 16, and ActionResponseCoordinator.deliver terminalizes a non-retryable workspace_unavailable with the comment "will still mismatch on every future negotiation, so returning this command to the outbox would retry it forever" â that branch is pre-existing at the merge base, so it is the package's standing convention rather than something this PR introduced elsewhere.
Witness:
mvn -o surefire:test -Dtest='WorkspaceMigrationStoreTest#refusesUnfinishedTitleDeliveryEvenWithAFailedPublicReceipt'
Tests run: 2, Failures: 0
The PR's own committed test asserts, on purpose, that a delivery row in PENDING or RUNNING beside a FAILED public command row raises migration_work_unsettled for the whole workspace_storage_id â the tenant-scope half, observed running. Structural half: every delivery_state write to this table in src/main is 'PENDING' (ManagedAgentStore.java:843, :848, :924), 'RUNNING' (:910) or 'COMPLETED' (:877), and grep 'DELETE FROM managed_session_rename_delivery' over src/main returns none.
Suggested fix, spanning several files so it is not a one-click block: give the delivery row a terminal state and narrow both predicates together to delivery_state IN ('PENDING','RUNNING'); have deliver() write the terminal value on a definitive pre-send refusal and after an attempt budget. If the retry loop is meant to stay unbounded under the owner's contract, then requireIdle() must not gate on this table at all, and the new migration check plus its test should be removed instead â that also resolves the tenant-scope half without touching the contract.
A fix here must not violate three existing facts: the two predicates have to change together, since narrowing one without the other leaves lifecycle admission and migration admission disagreeing about what "still in flight" means; delivery_state is VARCHAR(16) NOT NULL (V66__managed_session_rename_delivery.sql:7), so a new state name must fit in 16 characters; and completion must stay unfenced on the owner, because renameDeliveriesFenceOldSiblingsAndKeepLatestLostReplyRecoverable deliberately relies on a lease-lost owner still being able to complete â "The last remote write can already have succeeded when its reply was lost."
Please add a WorkspaceMigrationStoreTest case seeding a terminally-retired delivery row for a Session on the storage and asserting store(true) proceeds and writes the managed_workspace_migration row, plus a ManagedAgentStore case asserting a terminally-retired delivery no longer blocks beginOperation(CLOSE); reverting either predicate to <> 'COMPLETED' must turn both red.
äļæčŊīæ
[Critical] R2-4ïž[fails-closed] [regression] äūįķååĻïžåđķäļæŽč―ŪæčåīæķįŠäšïžæĪåčĄĻčŋ°äļįãå ·å 409ãéĢäļåå·ēæĪåïžåéåæįŧäļį§æ·įš§č°čŊčåīčŋäļĪįđæēĄææĪåã
rename æéäŧįķæēĄæįŧæãdeliver() į catch (RuntimeException) äžæ§čĄ abandonSessionRename įķå retryRename(now + retryDelay)ïžæĒæēĄæįŧæĒåæŊäđæēĄæå°čŊæŽĄæ°äļéïžčŊŧåčŊĨčĄįäļĪééļéĻäŧįķåĪæ delivery_state <> 'COMPLETED' ââ hasPendingRenameDeliveryïžManagedAgentStore.java:936-939ïžåĻ :1231 įĻäš CLOSE/ARCHIVE/DELETEïžåĻ :1381 įĻäš cwdïžäļ WorkspaceMigrationStore.requireIdleïž:339-342ïžæ workspace_storage_id éåŪčåīïžãsrc/main äļäŧŧä―ä―į―Ūé―äļäžåčŊĨčĄĻåå
Ĩįŧæåžïžäđäļäžå éĪčĄã
æŽč―ŪéŠčŊæĪåäšįŽŽ 3 č―ŪæšåļĶįäļĪäļŠåčŪšæäđäļãæĨčŠ completeSessionRename į 409 åŋ
įķäžīéčŊĨčĄ revision å·ēįŧååĻïžå æĪ retryRename į WHERE âĶ revision = ? AND lease_owner = ? åđé
äļå°äŧŧä―čĄïžäđå°ąäļäžéæ°å
Ĩéïžčäļ SQL įŦŊį revision æŊåĻ Harness åå
ĨäđåéåĒįïžHarness æ°īä―įšŋæ°ļčŋäļåŊč―čķ
čŋåŪãčŋäļåäļæįŦïžæĪåĪäļåäļŧåž ã
æįŦįéĻåæīįŠïžäļäļč§Ķåå·ēčŪ°å―įåĨįšĶãæŽčŪĻčŪšäļēč――æ owner įĄŪčŪĪįåģåŪïžäŋįäļįĄŪåŪåå ĨįæĒåĪč―åïžåđķæ Harness æ°ļäđ äļåŊįĻč§äļšåĪéĻéŧæéĄđ ââ æŽčŊčŪšäļéæ°äščŪščŋäļįđãåæīŧäļæĨįé―æŊåĻäŧŧä―åå Ĩåįäđåå°ąčĒŦæįŧįįķæïžå æĪåđķäļååĻéčĶčŊĨåĨįšĶåŧäŋįįäļįĄŪåŪåå Ĩïž
authorizePassiveAttachmentįåšåĢæŊWorkspaceExecutionStore.unavailable()=RuntimeBrokerException(409, "workspace_unavailable", âĶ, retryable=false)ïžWorkspaceExecutionStore.java:521-524ïžïžåĻįŧææ§įŧåŪæžį§ŧãįķæéACTIVEãdeletedAt != nullæķæåšãManagedAgentService.java:494-497äžäŧĨavailable_at = nowæåŪéæ°å ĨéïžéåååčŊåŪĒæ·įŦŊčŋæŊįŧæåĪąčīĨãčŪūčŪĄææĄĢåæäščŋæĄč·Ŋåūčŋåįč§åïžãMutable grant or registry refusal remains retryable; structural binding or storage mismatch remains terminal.ã- åĻå
ģé workspace files įåŊæŽäļïž
doCreateOrLoad:239-241äžæ°ļäđ æåšIllegalStateException("Hosted Workspace files are disabled")ïžå äļšisAvailable()æŊįĄŽįžį įreturn true;ïžQwenHostedHarnessConnector.java:126-128ïžïžčåŪæŊrecover()åŊäļįéļéĻã - åŪĒæ·įŦŊåéåį
DaemonProtocolException("Hosted Harness title protocol version 1 is required")ïžåå įļå âârecover()äŧäļæĨčŊĒsupportsFencedTitles()ã
åĶåĪäļįđåŪå
Ļč―åĻåĨįšĶäđåĪïžåģč°čŊįä―įĻčåīãowner įåģåŪæĨåįæŊãæäļŠ SessionãäŋæéŧåĄïžåđķæēĄææķåãäļäļŠæ æģæéį rename äžčŪĐįŧåŪå°čŊĨ workspace_storage_id įæŊäļäļŠ Session åĻį§æ·čåīå
æ°ļäđ
æ æģčŋį§ŧãæ æģéå―đïžäļčŋįŧīæēĄæåŊæ§čĄįčĄĨæææŪĩããéåŪåūŠįŊæŽĄæ°įæĒæå
äūå°ąåĻæŽå
å
ïžSessionLifecycleCoordinator.CWD_CHANGE_ATTEMPT_BUDGET = 8ãTaskCancelCoordinator.ATTEMPT_BUDGET = 16ïžč ActionResponseCoordinator.deliver åŊđäļåŊéčŊį workspace_unavailable åįŧæåĪįïžåđķéæģĻéãwill still mismatch on every future negotiation, so returning this command to the outbox would retry it foreverãââ čŊĨåæŊåĻååđķåšįšŋäļå°ąå·ēååĻïžæäŧĨåŪæŊæŽå
æĒæįįšĶåŪïžčäļæŊæŽ PR åĻåŦåĪæ°åžå
Ĩįåæģã
čŊæŪïžåŪæīčūåšč§äļæđčąæéĻåïžïžPR čŠå·ąæäšĪįæĩčŊ WorkspaceMigrationStoreTest#refusesUnfinishedTitleDeliveryEvenWithAFailedPublicReceipt äŧĨ Tests run: 2, Failures: 0 éčŋïžčåŪæčĻįæĢæŊïžäļæĄåĪäš PENDING æ RUNNING įæéčĄïžæčūđæäļæĄ FAILED įå
Žåžå―äŧĪčĄæķïžäžåŊđæīäļŠ workspace_storage_id č§Ķå migration_work_unsettled ââ į§æ·įš§ä―įĻčåīčŋäļåæŊåŪæĩčŋčĄåšæĨįãįŧææ§įäļåïžsrc/main äļåŊđčŊĨčĄĻ delivery_state įåå
ĨåŠæ 'PENDING'ïžManagedAgentStore.java:843ã:848ã:924ïžã'RUNNING'ïž:910ïžå 'COMPLETED'ïž:877ïžïžäļ grep 'DELETE FROM managed_session_rename_delivery' åĻ src/main äļæ äŧŧä―įŧæã
äŋŪåĪåŧščŪŪïžč·ĻåĪäļŠæäŧķïžå æĪäļįĻäļéŪ suggestion åïžïžįŧæéčĄäļäļŠįŧæïžåđķæäļĪéč°čŊäļåđķæķįŠäļš delivery_state IN ('PENDING','RUNNING')ïžčŪĐ deliver() åĻįĄŪåŪæ§įåéåæįŧæķäŧĨåå°čŊæŽĄæ°čķ
éååå
ĨčŊĨįŧæãåĶææ owner įåĨįšĶéčŊåūŠįŊå°ąåšäŋææ äļéïžéĢäđ requireIdle() æ đæŽäļåšåšäščŊĨčĄĻčŪūéļïžæĪæķåšæđäļšį§ŧéĪčŋäļŠæ°åĒįčŋį§ŧæĢæĨåå
ķæĩčŊ ââ čŋæ ·äđč―åĻäļč§ĶååĨįšĶįåæäļč§Ģåģį§æ·įš§ä―įĻčåīéĢäļåã
äŋŪåĪäļåūčŋåäļéĄđæĒæäšåŪïžäļĪäļŠč°čŊåŋ
éĄŧåæķäŋŪæđïžåŠæķįŠå
ķäļäļäļŠäžčŪĐįå―åĻæåįäļčŋį§ŧåįåŊđãäŧäđįŪäŧåĻéã䚧įåæ§ïždelivery_state æŊ VARCHAR(16) NOT NULLïžV66__managed_session_rename_delivery.sql:7ïžïžæ°įķæååŋ
éĄŧäļčķ
čŋ 16 äļŠåįŽĶïžåŪææä―åŋ
éĄŧįŧ§įŧäļäŧĨ owner äļšæ
æ ïžå äļš renameDeliveriesFenceOldSiblingsAndKeepLatestLostReplyRecoverable æĢæŊåŧæäūčĩãå·ēåĪąåŧį§įšĶį owner äŧč―åŪæãââãThe last remote write can already have succeeded when its reply was lost.ã
čŊ·čĄĨäļäļŠ WorkspaceMigrationStoreTest įĻäūïžäļščŊĨååĻäļįæäļŠ Session æå
ĨäļæĄåĪäšįŧæįæéčĄïžæčĻ store(true) č―åĪįŧ§įŧåđķåå
Ĩ managed_workspace_migration čĄïžåčĄĨäļäļŠ ManagedAgentStore įĻäūïžæčĻįŧæéå―đįæéäļåéŧåĄ beginOperation(CLOSE)ãæäŧŧäļč°čŊæđå <> 'COMPLETED' é―åŋ
éĄŧčŪĐčŋäļĪäļŠįĻäūåįšĒã
â qwen3.8-max via Qwen Code /review (v0.25.0)
There was a problem hiding this comment.
Leaving this thread unresolved â it needs an owner decision, and I am not picking one on the owner's behalf.
Two things I can confirm at head 7105fb1e4c:
-
Your withdrawal of the "named 409" sub-claim matches the code.
completeSessionRenamerequiresrows.getFirst().revision() == revisionand throwssession_mutation_supersededotherwise, and the SQL revision is bumped before the Harness write, so a 409 there cannot re-queue. That half is correctly dropped. -
Your surviving shape â give the delivery row a terminal state, narrow both predicates to
IN ('PENDING','RUNNING')together, and terminalize definitive pre-send refusals plus an attempt budget â is materially the protocol expansion that was implemented at3294358ee43cand then withdrawn by additive revert71351f1e8c5b, with the decision recorded as: preserve safe recovery, explicitly retain permanent dependency outages as external blockers, no separately authorized retirement extension. Your narrowing is a real distinction (a pre-send refusal has no uncertain write to preserve), so this is not simply re-litigating that ruling â but the implementation it asks for is the one that was withdrawn.
The tenant-scope half of requireIdle is the part I think is genuinely uncovered by any recorded ruling. One undeliverable rename making every Session on that workspace_storage_id permanently un-migratable at tenant scope, with no operator-reachable remedy, is not the same claim as "a Session stays blocked", and your house-precedent citation is fair: ActionResponseCoordinator.deliver already terminalizes a non-retryable workspace_unavailable for the reason you quote, and SessionLifecycleCoordinator/TaskCancelCoordinator both carry attempt budgets.
Owner â the two options point in opposite directions and both are defensible:
- (a) Add the terminal state, narrow both predicates together, add the budget. Restores operator reachability, keeps the R2-2 migration gate, and re-opens the retirement scope withdrawn at
71351f1e8c. Multi-file, plus the two new tests you specified. - (b) Drop the
requireIdlegate on this table and its test, leaving the retry loop unbounded per the recorded contract. Subtractive, consistent with the ruling as written, and it resolves the tenant-scope half without touching the contract. This is also the alternative you yourself offered.
I recommend (b) unless the migration gate is load-bearing for a case the owner wants kept: it is subtractive rather than additive on a PR now at substantive round 14 in scope-correction, and the gate is what creates the tenant-scope blast radius in the first place.
Neither branch is implemented. A working JDK 21 + Maven toolchain for this module now exists on the box that triaged it (installed this round, which is how R2-23 got measured and fixed), so whichever option is chosen is locally verifiable rather than CI-only â that removes the toolchain excuse, not the decision.
|
Rebased onto One semantic conflict in Verification on
|
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
renameStoreFailuresPreserveTheOriginalErrorAndAllowRetry raced the SessionRenameCoordinator that this test class schedules at dispatch.scan-delay=50ms. Once the inline attempt failed, the delivery row became claimable, so the coordinator could re-drive it: the command row read COMPLETED instead of FAILED, and a trailing PATCH that lost the claim answered 503 "already being delivered" instead of 200. Gate the coordinator at its only precondition -- Harness availability, which the inline createOrLoad/rename path never consults -- from the insert onwards, park both claim branches while pinning the post-failure state, then hand the row back to the recovery path and wait for it to settle. A retry that loses the claim legitimately answers 503 in production, so the PATCH is only deterministic once the delivery has completed and it replays; the await also proves the row was re-queued at all. The cleanup arm now asserts the state its abandon failure leaves behind (delivery RUNNING under the dead inline owner, command still PENDING) instead of only expiring the lease, and both UPDATEs assert they affected one row. Measured on JDK 21 + Maven against H2, 20 repetitions of the method: 12 red / 20 before, 0 red / 20 after. Full class 35/35, checkstyle clean. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Dismissing at the maintainer's direction, not on a re-verification: I did not re-check this request's findings at head 7105fb1e, so nothing here asserts that they are fixed.
Facts recorded so the next reader knows what this dismissal does and does not claim:
- This request was pinned at
785dc863; head has since moved to7105fb1e. - CI at the current head is 17 pass / 1 fail / 5 pending / 21 skipped. The failure is
Flyway migration version uniqueness (latest main)(run 38110242616), and this PR addsV59__managed_session_rename_delivery.sql.mergeStateStatustherefore staysblockedregardless of review state. - One review thread is unresolved.
required_review_thread_resolutionisfalseon this repository, so that does not gate merge.
qwen-code-review-bot
left a comment
qwen-code-review-bot
left a comment
There was a problem hiding this comment.
Approving at head 7105fb1e at the maintainer's direction. Stating plainly what this vote does and does not assert, since I did not re-review the diff this round.
Not verified. I did not re-check the findings carried by the two change requests I just dismissed (5480364248 @ 785dc863, 5481297217 @ fbda4a24) against this head, and I read no production code in this pass. This approval records the maintainer's decision to proceed â it is not an independent confirmation that those findings are fixed, and it should not be read as one later.
Gate state at this head, read rather than inferred:
MERGEABLE. This branch wasCONFLICTINGearlier today; the rebase landed. 38 files, +1348/-77.reviews(states: CHANGES_REQUESTED).totalCountis0after those two dismissals. One review thread is still unresolved, which does not gate merge here ârequired_review_thread_resolutionisfalse.- CI is 17 pass / 1 fail / 5 pending / 21 skipped. The failure is
Flyway migration version uniqueness (latest main)(run 38110242616). This PR addsV59__managed_session_rename_delivery.sql, so that lane is about this diff rather than about infrastructure.mergeStateStatuswill stayblockeduntil it is green; no approval substitutes for it. For reference, the sibling PR #13530 hit the same class of collision and resolved it by moving its migration to V66. - This diff touches
packages/core/src/managed-runtime/, which.github/CODEOWNERSmaps to@wenshao @tanzhenxin @yiliang114 @LaZzyMan @doudouOUC @qqqys.yiliang114is the author and cannot self-approve and no bot account is on that line, sorequire_code_owner_reviewis still unsatisfied andreviewDecisionwill not reachAPPROVEDon this vote alone.
Merge also goes through the merge queue, not gh pr merge.
main's V66 is now managed_session_agent_definition_digest (#13530), so the merge result carried two V66 migrations and the open-PR Flyway guard failed with "Version collision when merged into main: V66 = V66__managed_session_agent_definition_digest.sql + V66__managed_session_rename_delivery.sql". V67 is the lowest version strictly above main's highest (V66) and is not claimed by any open PR. Mechanical rename plus the pinned version list in WorkspaceMigrationMySqlIT and the bilingual design notes. No SQL, schema or behavior change. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
qwen-code-review-bot
left a comment
qwen-code-review-bot
left a comment
There was a problem hiding this comment.
Re-approving at head ab1af69395. My previous approval (5481830128, pinned at 7105fb1e) has been dismissed and head has moved since, so this restates the verdict at the current commit rather than leaving the PR with no standing review at all.
The disclosure from that approval still holds and I am not going to imply otherwise: this is at the maintainer's direction, not on a re-review. I have not read the production diff at this head, and I have not re-checked the findings carried by the two change requests dismissed earlier (5480364248 @ 785dc863, 5481297217 @ fbda4a24). Nothing here asserts that those findings are fixed â their status is "not re-verified", which is neither "closed" nor "still standing".
Gate state, read at this head rather than inferred:
MERGEABLE;reviews(states: CHANGES_REQUESTED).totalCountis0; 1 unresolved review thread of 39, which does not gate merge here becauserequired_review_thread_resolutionisfalse.- CI is 10 pass / 0 fail / 11 pending / 4 skipped. The lane that was red an hour ago â
Flyway migration version uniqueness (latest main)â is now re-running, not passing, so it is not yet confirmed green. This PR addsV59__managed_session_rename_delivery.sql, which is what that lane checks, and #13530 hit the same class of collision and resolved it by moving its migration to V66.mergeStateStatusstaysblockeduntil that lane completes. - The diff touches
packages/core/src/managed-runtime/, which.github/CODEOWNERSmaps to@wenshao @tanzhenxin @yiliang114 @LaZzyMan @doudouOUC @qqqys.yiliang114is the author and cannot self-approve, and no bot account is on that line, sorequire_code_owner_reviewis unsatisfied andreviewDecisionwill not reachAPPROVEDon this vote alone â it needs one of the other five.
Merge also goes through the merge queue, not gh pr merge.
doudouOUC
left a comment
doudouOUC
left a comment
There was a problem hiding this comment.
Reviewed the full change at ab1af693957bd908157297f6e624a4e4a69d62cf, including downstream consumers, title admission/replay, journal ordering, owner/lease cleanup, approval recovery, lifecycle/migration gates, migration ordering, and both design-language versions. No new blocking findings.
Rechecked the standing R2-4 discussion against this commit. Fresh admission checks submitter/Workspace facts, Harness availability and fenced-title capability before persisting a delivery. A later recovery refusal cannot certify that an earlier attempt never committed. The accepted design explicitly retains unfinished delivery and the storage migration barrier until confirmation or supersession; removing that barrier would release storage while remote title work may still write. Permanent dependency unavailability remains the documented external blocker. The owner discussion remains open for its final disposition.
Local validation on macOS: full build and typecheck passed; changed TypeScript ESLint and diff whitespace checks passed; Java focused tests 185/185, SDK tests 66/66 and Core metadata tests 33/33 passed. The two Harness files yielded 374/375: one unchanged automation fixture failed with ENOTEMPTY during temporary-directory cleanup. Focused reruns passed, and an exact-base comparison reproduced the same active-wake/teardown resource race. The three focused delayed-title/replay/cold-load cases passed; lifecycle contention stress passed 12/12. Production MySQL, Linux and Windows behavior is represented by CI/previous attributed evidence rather than a new local deployment run.
Code approval as requested. At submission, the Windows Java, MariaDB, MySQL fault-gate and WebShell smoke jobs remain queued or running with no reported failure. Their completion and the existing discussion remain separate merge gates.
Reviewed with GPT-6 assistance in Codex.
Main advanced 4 commits (d35277c..6936c77), including #13682's approval-delivery reconcile and #13760's WebShell cwd changes. Two textual conflicts plus the two standing renumbers: - ActionResponseCoordinator takes main's renewal design: the leaseLost AtomicBoolean, the boolean-checked renewLifecycleOperation, and the early return after settled() (the auto-merged body already consumed leaseLost, so main's side was mandatory). This branch's harnessAnswered tracking and its comment are kept verbatim. Main's dispatch-time `isAvailable` pause made this branch's ActionResponseCoordinator tests bail before delivering â they never stubbed it â so mockUnresolvedAction and ten inline tests now stub it true. The guard's negative path has no test anywhere (main's gap, noted not fixed here). - OpenAPI contract: main took v1.42.0, so this branch advances to v1.43.0 â main's v1.42 paragraph is kept and this branch's durable-terminal-codes paragraph is re-keyed to v1.43 and appended. The generated WebShell client is regenerated from the merged document. - Flyway: the budget-exempt migration moves V67 -> V68 after main took V67 (session rename delivery); the two comments naming the version and the WorkspaceMigrationMySqlIT expectation (..65, 66, 67, 68) move with it. The R8-1 hazard IT still targeted V64/expected V65 â it now targets 67 and expects 68. - qwencode gained HostedHarnessClient capability work, so the sibling jars were reinstalled (qwencode then runtime-broker). Verified before committing: full managed-agent-server suite 2096 tests with only the 3 known non-regressions (2 ToolPublicationStoreTest timing errors; ChildWorktreeGitTest's non-UTF8-name case, A/B-proven red on pristine main on this Mac); WorkspaceMigrationMySqlIT + WorkspaceSessionRetentionMySqlIT 23/23 against real MySQL; checkstyle clean; core managed-runtime 3281/3281; web-shell managed 459/459 on the regenerated client; web-shell tsc clean; prettier clean on the touched files; Flyway 64 migrations all unique.
Real-stack verification, round 2 (post-merge):
|
âĶy witness The retried rename is completed either by the synchronous third call's inline claim or by the delivery coordinator's asynchronous re-drive, and either order is a legitimate completion order under the admission-fence semantics established by #13682. When the coordinator wins, the replay correctly answers the session's current state, whose title is the sibling rename's value instead of the retried one. The replay flag and the no-duplicate-events inventory carry the witness deterministically; the live-title read depends on which lane finished first.
âĶ2692 R2 review (QwenLM#13330) * fix(managed-agent): connector and broker robustness from the QwenLM#12692 R2 review Nine follow-ups from the post-merge R2 review round on QwenLM#12692, re-verified against current main (5ddfacc) before patching: - The durable session row is now the archive/delete fence: the broker resolver rejects ARCHIVED/DELETED rows for unbound Sessions, so the in-process retired set stops growing on the delete path and the fence survives restarts. Close keeps its in-process retirement. - Attach fetch moved out of ConcurrentHashMap.computeIfAbsent: a slow create no longer stalls every attachment hashing to the same bin. - The connector close protocol no longer leaks a client built after or during close(): a closed flag under the same monitor fails late calls before any executor or heartbeat is constructed. - Hosted Harness base URL is validated as an absolute http(s) URI at startup; "localhost:4170"-style mistakes no longer die opaquely at the first RPC. - Tool-call item identities tag both branches, so a harness callId of the literal form "source:<n>" cannot collide with the no-id fallback. - The dispatch constructor rejects lease/renew misconfiguration (non-positive values, renew >= duration) instead of letting it surface later as hosted_harness_unavailable. - Dependency failures at the rename site keep their root cause via a cause-carrying ApiException instead of an unchained 503. - A poisoned materialization target no longer heads every 100 ms pass: consecutive failures retry on 1, 2, 4, ..., 64 streaks and the target rotates behind fresher rows (covered_sequence untouched), so healthy sessions are never starved and identical warnings stop repeating every pass. - The kubernetes provisioner rejection now says it is unsupported and names the valid values instead of referencing an internal review slice. Verified on the managed-agent-server module with mvn verify: 562 tests (new cases pin each change), checkstyle and spotbugs green. * test(managed-agent): close the method boundary between the two merged tests The tail splice merged sourcePrefixedCallIdDoesNotCollideWithTheNoIdFallback into projectsDeadlineExpiryAsAClassifiedFailure without the closing brace and @test annotation (main-scope compile passed; test-compile is the gate that sees it). * test(managed-agent): correct the stream-close comment in HostedHarnessMySqlIT HarnessEventStream moved from a monitor to a ReentrantLock in QwenLM#13388, so close() no longer contends on a synchronized read; it queues on the stream lock while next() holds it across the blocking socket read. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(managed-agent): fence closing sessions durably and keep tool item identity on the v1 rule (QwenLM#13330) * fix(managed-agent): address the QwenLM#13330 R2 review findings - MessageMaterializer: best-effort deferrals via deferQuietly, warning before rotating, so a store fault while deferring degrades one target instead of aborting the pass and swallowing the diagnostic - QwenHostedHarnessConnector.close(): capture and null the client under clientLock, close it outside the lock so the executor shutdown no longer stalls client() callers behind it - HarnessCoordinator: validate lease durations as the millis the scheduler receives, rejecting sub-millisecond renew intervals at startup - EventIdentity: share the callId tool-item rule with the Harness event projector via the public toolCallItemId; the projector test now asserts against the authority instead of a re-derived literal - Tests: rotation witness for deferMaterializationTarget against the selection ORDER BY, per-clause base-URL guard cases, negative and sub-millisecond renew cases, close-outside-the-lock witness; rename a sequential test that was named for concurrency - Docs: sync gate 3 of the review-corrections design (both languages) with the durable lifecycle fence * fix(managed-agent): fence closed Sessions on the warm path only The durable lifecycle fence sat in the shared HarnessSessionResolver lambda, so the release and unknown-outcome reconcile routes â which run after a Session closes â hard-refused a CLOSED Session with a non-retryable 409 and leaked the binding the teardown exists to release. Scope the fence to a new admission resolve that only warm() consults; teardown routes resolve the closed Session's scope again. Also defer a poisoned materialization target only when its retry is not due, so a due pass stops writing the progress row twice, and sync the README/design wording with the shipped fence. * chore(managed-agent): re-present the round-3 fixes with the tree cleaned The deterministic gate rejected 6a671b3 on npm run lint alone: the round's own Maven verification had generated JaCoCo/Javadoc JavaScript under packages/sdk-java/*/target (gitignored build output, never part of the committed tree), and ESLint scans those files when they exist on disk. The artifacts are removed and lint, build, and typecheck were re-run green on the final tree. No tracked content changes; the round-3 fixes are preserved as-is. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(managed-agent): converge teardown behind the drain fence The persisted ARCHIVED/DELETED fence in the embedded broker's session resolver guarded every scope resolution, so the durable release and the unknown-outcome reconciliation of a closed Session died on a non-retryable runtime_broker_session_closed after closing. Split the resolver into a bootstrap channel (fenced: warm, acquire) and a teardown channel (permissive: persistedSession's release and reconciliation) via HarnessSessionResolver.resolveForTeardown. MessageMaterializer's pre-attempt defer ran outside the due gate, so every 100 ms pass updated every poisoned row, and the capped streak made attempts and their stack warns fire at 10 Hz forever. Skip passes are now the only ones that rotate the row and the streak is uncapped, so attempts and warns ride the power-of-two ladder. The README still described the drain fence as an in-process retirement flag; it is persisted Session status. * test(runtime-broker): pin the admission fence to warm in the teardown release witness Renames the fake resolver's teardown outlet to the admission channel the interface now exposes, flips the witness to fence warm while release keeps resolving, and keeps the durable release assertion. * fix(managed-agent): gate the skip-path rotation on window saturation (QwenLM#13330) A skipped pass below TARGET_LIMIT rotated a row the next pass selects anyway, so the throttle fires only when the selection window is full; the rotation warn is stack-less so a persistently faulting deferral cannot bury the one-line signal at scheduler rate. Pins the streak reset, the skip-path guard under a fault, and the snapshot_stale_since marker the deferral must not clobber, narrows the README fence clause to the warm admission resolve, and corrects the release witness comment to what the test executes. * fix(managed-agent): address the QwenLM#13330 R4 review findings Probe one row past the selection window for the skip-path rotation gate so an exactly-full window does not rotate rows that are selected again anyway, pin the post-cap modulo retry at streak 192, and mirror all five of the client builder's base-URL rules in the boot-time guard. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * chore(managed-agent): re-verify the QwenLM#13330 R4 round on a target-free workspace The deterministic gate rejected e5940ae on 'npm run lint': the previous round's Maven verification runs left generated JavaScript under packages/sdk-java/*/target (jacoco-resources/prettify.js + sort.js, reports/apidocs/*.js), and the repo-wide eslint scan fails on those gitignored artifacts (728 errors, all confined to target/). No tracked change can carry this repair: the root eslint config and the lint script are verification machinery outside this round's footprint. The fix is environmental â the target/ trees are removed so the gate's lint re-run scans only tracked sources â and this empty commit re-presents the preserved R4 round for re-verification. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(managed-agent): address the QwenLM#13330 R5 review findings Fence the materialization tick onto its own scheduler pool so a faulting skip-path rotation cannot occupy the dispatch thread, require a lease renew interval of at most half the lease duration so a late renewal keeps its margin, attribute the rename WARN to the operation rather than a subsystem the fault may not be in, and pin the saturation probe row's exclusion from the work loop. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * chore(sdk-java): clean generated Maven target dirs to unblock lint gate Same-run verification repair: the previous round's local mvn runs left generated JaCoCo report JS under packages/sdk-java/*/target. Those dirs are git-ignored but are not in the root ESLint ignore list, so the gate's npm run lint (eslint .) failed with 139 errors on generated code. The artifacts are untracked, regenerable build output; removing them from the working tree restores lint. No source change. * fix(runtime-broker): fence a fresh acquire behind the admission resolve (QwenLM#13330) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(managed-agent): align the rename fault witness with the renamed store call The aFailedRenameLogsAndChainsTheRootCause store mock still stubbed the pre-rename completion entry point; production now persists rename results through completeSessionRename, so the mock fell through to the real store and the rename succeeded, failing the assertion that it must raise. The stub is pinned to completeSessionRename with its six-argument shape. * test(managed-agent): drop the racy live-title read in the rename retry witness The retried rename is completed either by the synchronous third call's inline claim or by the delivery coordinator's asynchronous re-drive, and either order is a legitimate completion order under the admission-fence semantics established by QwenLM#13682. When the coordinator wins, the replay correctly answers the session's current state, whose title is the sibling rename's value instead of the retried one. The replay flag and the no-duplicate-events inventory carry the witness deterministically; the live-title read depends on which lane finished first. --------- Co-authored-by: qwen-code-autofix <qwen-code-autofix@users.noreply.github.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> Co-authored-by: qwen-code <qwen-code@alibaba-inc.com> Co-authored-by: qwen-code-autofix <qwen-code-autofix[bot]@users.noreply.github.com> Co-authored-by: qwen-code-ci-bot <qwen-code-ci-bot@users.noreply.github.com> Co-authored-by: qwen-code-autofix <qwen-code-autofix@localhost>
|
Released in v0.25.1. |
What this PR does
Recover accepted Workspace approval answers after dispatcher attachment-cache loss with the default recovery configuration. Keep Harness-disabled replicas from claiming pending deliveries, while allowing them to settle answers whose committed journal already proves a final outcome. Renew approval claims during slow attachment or answer delivery.
Keep public and Harness Session titles consistent under concurrent rename requests and ambiguous HTTP results. Each admitted attempt has a durable, increasing revision; the final journal write fences older attempts, and a stored delivery repairs a lost reply without appending a second title. A FAILED same-key retry remains usable after a newer rename succeeds. Both inline and recovery requests claim before remote I/O; expired owners cannot retire a replacement owner's receipt. Fresh disabled or unsupported Harness requests and Unicode-only titles are refused before admission. A named superseded conflict remains HTTP409 at the public boundary. Workspace migration counts unfinished title work even after the public command fails. Rename replay probes avoid missing-row gap locks while retaining tenant and Session serialization.
Why it's needed
wenshao's round-9 verification of #13163 found accepted approvals stuck after cache loss, disabled replicas taking claims they cannot deliver, and concurrent renames leaving the public and private titles different. This PR handles these related follow-ups together. A SQL completion guard alone cannot prevent an older remote write from finishing last.
While an admitted write remains uncertain, recovery and lifecycle/migration barriers are retained. A permanently unavailable Harness is an explicit external blocker; a later refusal or retry count is not proof that an earlier remote write never committed. This is the owner-confirmed contract.
Current conflict repair:
638b97984214additively merges main d35277c, andab1af693957brenumbers the rename-delivery migration from V66 to V67 because main's V66 is now the agent-definition digest (#13530). The upgrade history retains V67 rename delivery, V60 child workspace and upstream V62 task cancellation; rename SQL and both migration guards remain intact. The approval/rename patch scope is unchanged. Fresh focused verification and new-head CI are attributed separately in the acceptance record. Formal human approval and an authorized merge remain outstanding.Reviewer Test Plan
How to verify
Answer a pending Workspace approval after losing the dispatcher attachment cache while the Broker keeps running (
verified-workspace-recovery-enabled=false), e.g. the answer lands on another replica. Expect the original operation to complete, the Action to be decided, and the expected file effect to occur once. A Workspace READER remains refused; an authorized second OPERATOR can answer the ownerâs approval, and same-responder replay returns the same operation. This item does not cover a dispatcher restart (TERM/SIGKILL), where the attachment cache and the embedded Broker restart together: there the answer is still delivered, but the Harness then logsrecovery blocked: Runtime Broker returned HTTP 404 (runtime_session_not_found)and the Turn stays RUNNING until cancelled. That wedge is pre-existing â an unapproved plain tool Turn across the same restart wedges identically on base and head â so it is not a regression of this PR, and no open issue currently carries it; the adjacent tracked work is Runtime Broker: a restarted Broker can neither adopt nor retire a local-process worker #12766 / Runtime Broker: an execution in flight at host reboot pins the LOST binding forever #12670, and fix(managed-agent): #13163 follow-ups: cold-cache cancel and deferred review suggestions #13269 explicitly disclaims the restart case.Let a Harness-disabled replica recover a shared database. A requested answer keeps its claim and retry schedule; an answer whose journal Action has already ended can settle without a Harness call. Hold enabled delivery beyond its initial lease and confirm another replica cannot take over while the worker renews it.
Hold an accepted rename before its final journal transaction, let its request time out after sending, and complete a different-key rename through another replica. Release the older request and expect both durable titles to remain the newer title. Retry the FAILED original key and expect a fresh revision that can become the latest title.
Lose the reply after the latest private title is committed. Expect scheduled recovery to complete its public receipt without a manual retry or another title record. Verify this also works for the first rename of an empty bound or unbound Session. Replaying a completed key produces no new write; changed content under that key still conflicts.
While the latest title delivery is unfinished, close, archive, delete, cwd change and Workspace migration refuse admission, even if the public command is FAILED. Once delivery completes, admission can proceed.
Refuse a fresh rename on a disabled or old-protocol Harness before creating a command/delivery; the Session can still close. A healthy inline delivery cannot be claimed immediately by a peer. After lease expiry and takeover, stale or null-owner cleanup leaves the replacement receipt unchanged. An invalid reply after sending remains recoverable.
Submit Unicode-only titles (NBSP, FEFF, U+2007 or U+202F). Expect 400 invalid_title, no rename command or delivery, and continued close admission. A title containing visible text preserves its exact Unicode content. A contract-valid Harness 409 session_mutation_superseded stays public409; unrelated conflicts and ambiguous failures keep the dependency error path.
Evidence (Before & After)
Actual source CLI tmux captures show the WriteFile permission, its real file effect and
/renameupdating display and isolated storage. Actual source WebShell UI allowed an approval after connector cache loss and a controlled private503; the real scheduler recovered the same operation without another first-action response. A second composer submission rejected WriteFile and Edit and left the file unchanged. API rename plus actual Refresh displayed the same durable title. See the acceptance record for images and exact source/provider boundaries.Before: round 9 recorded repeated attachment conflicts, claims by a disabled replica, and settled public/private title divergence. After: focused SDK, Core, Hosted route and Spring regressions cover the contracts above. Controlled real Spring/H2 + current Node Harness probes exercise cross-replica delayed writes, an actual SDK deadline with remote work still alive, automatic lost-reply recovery, and cache-loss approval delivery with a real worker file effect. The separate acceptance comment records the delivered commit, exact results, initial failed probes and negative controls.
Tested on
Environment
Java 21, Node 22+, source CLI and current compiled Core/Java SDK, two Spring contexts sharing H2, independent local Brokers and an authorized mount. The approval provider and transport failures are controlled fixtures; the HTTP, journal, scheduler and worker paths are real. UI/TUI evidence remains attributed to61449726; later main integrations and this conflict repair have separately attributed focused verification and CI. It does not relabel the earlier runtime evidence as a new run.
Risk & Scope
Linked Issues
Follow-up to #13163 and the approval/rename findings in #13269.
äļæčŊīæ
æđåĻ
åĻéŧčŪĪæĒåĪé į―ŪäļïžæĒåĪč°åšĶåĻäļĒåĪąéįįžååå·ēåįį Workspace åŪĄæđįåĪãįĶįĻ Harness įåŊæŽäļčŪĪéĒåū æéäŧŧåĄïžä―č―æ đæŪå·ēæäšĪ journal čŊæįįŧæįīæĨįŧįŪįåĪãéįæĒåĪæįåĪæéįžæ Ēæķæįŧįŧį§ïžéēæĒæĢåļļæéčĒŦå ķäŧåŊæŽæĨįŪĄã
čŪĐåđķåæđååäļįĄŪåŪį HTTP įŧææįŧäŋæå Žå ąæ éĒäļ Harness æ éĒäļčīãæŊæŽĄåįæĨææäđ éåĒįæŽïžæįŧ journal åå Ĩæįŧæ§įæŽïžæäđ æéčĄĨé―äļĒåĪąåå čäļčŋ―å įŽŽäšæĄæ éĒčŪ°å―ãčūæ°įæđååŪæåïžå FAILED åđįéŪäŧč―äŧĨæ°įæŽéčŊãåæĨčŊ·æąäļæĒåĪčŊ·æąé―å čŪĪéĒåæ§čĄčŋįŦŊ I/Oïžčŋæææč äļč―éäžæ°ææč įåæ§ãæ°įĶįĻæäļæŊæåčŪŪį Harness čŊ·æąäŧĨåįšŊ Unicode įĐšį―æ éĒåĻåįåčĒŦæįŧïžåļĶæįĄŪ superseded éčŊŊį įåēįŠåĻå ŽåžæĨåĢäŋæ409ãWorkspace čŋį§ŧåĻå Žå ąå―äŧĪåĪąčīĨåäŧįŧčŪĄæŠåŪææ éĒå·Ĩä―ïžæđåéæūæĒæĩį§ŧéĪįžšåĪąčĄįéīééïžäŋįį§æ·å Session äļēčĄåã
åå
wenshao åŊđ #13163 įįŽŽäđč―ŪéŠčŊåį°äšįžåäļĒåĪąååŪĄæđįåĪåæŧãįĶįĻåŊæŽæĒå æ æģåŪæįæéïžäŧĨååđķåæđåé æäļĪäū§æ éĒäļåãæŽ PR äļčĩ·åĪįčŋäšįļå ģåįŧéŪéĒãåŠåĻ SQL åŪææķæĢæĨïžæ æģéŧæĒæ§čŋįŦŊåå Ĩæåč―įã
åŪĄé éŠčŊ
éŧčŪĪ
verified-workspace-recovery-enabled=falseïžåĻ Broker äļéåŊįåæäļäļĒåĪąéįįžåååįåū åŪĄæđ ActionïžäūåĶįåĪč―å°åĶäļäļŠåŊæŽïžãéĒæå operation åŪæãAction å·ēåģåŪãæäŧķææåįäļæŽĄïžWorkspace READER äŧčĒŦæįŧïžå ·åĪæéįįŽŽäšä― OPERATOR åŊäŧĨåį owner įåŪĄæđïžåäļįåĪäššįéæūäŧčŋåå operationãæŽæĄäļčĶįæīūååĻįåŪéåŊïžTERM/SIGKILLïžéįįžåäļå åĩ Broker åæķéåŊïžïžéĢį§æ åĩäļįåĪäŧäžéčūūïžä― Harness éåčŪ°å―recovery blocked: Runtime Broker returned HTTP 404 (runtime_session_not_found)ïžTurn äļįī RUNNING įīå°čĒŦåæķãčŊĨåĄæŧæŊæĒæéŪéĒââäļåļĶåŪĄæđįæŪéå·Ĩå · Turn įŧååæ ·éåŊæķïžbase äļ head åæ ·åĄæŧââå æĪäļæŊæŽ PR įåå―ïžįŪåäđæēĄæå·ēåž issue æķå―åŪïžįļéŧįåĻč·čļŠéĄđæŊ Runtime Broker: a restarted Broker can neither adopt nor retire a local-process worker #12766 / Runtime Broker: an execution in flight at host reboot pins the LOST binding forever #12670ïžč fix(managed-agent): #13163 follow-ups: cold-cache cancel and deferred review suggestions #13269 å·ēæįĄŪæéĪéåŊæ å―ĒãįĶįĻ Harness įåŊæŽæĒåĪå ąäšŦæ°æŪåšæķïžrequested įåĪįčŪĪéĒåéčŊæķéīäŋæäļåïžjournal å·ēčŊæįŧæįįåĪæ é Harness åģåŊįŧįŪãčŪĐåŊįĻåŊæŽįæéčķ čŋåå§į§įšĶïžįŧį§æéīå ķäŧåŊæŽäļč―æĨįŪĄã
å°å·ēæĨåįæđåååĻæįŧ journal äšåĄåïžčŪĐčŊ·æąåĻåéåčķ æķïžåéčŋåĶäļåŊæŽåŪææ°éŪæđåãéæūæ§čŊ·æąåïžäļĪäū§æäđ æ éĒåšäŧæŊæ°æ éĒãéčŊå FAILED éŪïžåšč·åūæ°įæŽåđķč―æäļšææ°æ éĒã
ææ°į§ææ éĒæäšĪåäļĒåĪąåå ïžéĒæåŪæķæĒåĪčŠåĻčĄĨé―å Žå ąåæ§ïžæ éæåĻéčŊïžäđäļæ°åĒæ éĒčŪ°å―ãįĐšįįŧåŪææŠįŧåŪ Workspace į Session éĶæŽĄæđåäđåšåĶæĪãéæūå·ēåŪæéŪäļåå ĨïžåéŪæđæĒå åŪđäŧåēįŠã
ææ°æ éĒæéæŠåŪææķïžå ģéãå―æĄĢãå éĪãcwd åæīå Workspace čŋį§ŧæįŧåå Ĩïžå æŽå Žå ąå―äŧĪäļš FAILED įæ åĩïžæéåŪæåæĒåĪåå Ĩã
įĶįĻææ§æ éĒåčŪŪį Harness åĻæ°æđåå ĨåšåčĒŦæįŧïžäļįäļå―äŧĪåæéïžSession äŧåŊå ģéãæĢåļļåæĨæéäļč―čĒŦåäžīįŦåģčŪĪéĒïžį§įšĶå°ææĨįŪĄåïžæ§ææč æįĐšææč æļ įäļæđåæ°åæ§ãåéååå æ æäŧįŧ§įŧæĒåĪã
įšŊ Unicode įĐšį―æ éĒïžNBSPãFEFFãU+2007ãU+202Fïžčŋå400 invalid_titleïžäļæ°åĒæđåå―äŧĪææéïžåđķäŧå čŪļ close åå Ĩãå åŦåŊč§æåįæ éĒäŋįå Unicode å åŪđïžåæģį§æ superseded 409 åĻå ŽåžæĨåĢäŋæ409ïžå ķäŧåēįŠåäļįĄŪåŪåĪąčīĨįŧīæåäūčĩéčŊŊč·Ŋåūã
ååčŊæŪ
äŋŪåĪåïžįŽŽäđč―ŪčŪ°å―äšéåĪéįåēįŠãįĶįĻåŊæŽįäŧŧåĄčŪĪéĒïžäŧĨåįĻģåŪåįå Žå ąäļį§ææ éĒå·ŪåžãäŋŪåĪåïžSDKãCoreãHosted č·Ŋįąå Spring åŪååå―čĶįčŋäšåĨįšĶãåæ§įįåŪ Spring/H2 äļå―å Node Harness æĒééŠčŊč·ĻåŊæŽčŋå°åå ĨãSDK įæĢčķ æķåäŧåæīŧįčŋįŦŊå·Ĩä―ãäļĒåĪąåå įčŠåĻæĒåĪïžäŧĨåįžåäļĒåĪąåįåŪĄæđæéåįåŪ worker æäŧķææãåįŽįéŠæķčŊčŪščŪ°å―äšĪäŧæäšĪãįĄŪåįŧæãåå§åĪąčīĨæĒéåååéŠčŊã
åđģå°äļįŊåĒ
macOS å·ēčŋčĄåŪååįæĢæĨåįåŪæŽå° HTTP č·ŊåūãWindowsãLinux æŠåĻæŽå°éŠčŊïžCI įŧæåĶčĄčŪ°å―ãįŊåĒäļš Java 21ãNode 22 åäŧĨäļãæšį CLIãå―åįžčŊį Core äļ Java SDKãå ąäšŦ H2 įäļĪäļŠ Spring contextãįŽįŦæŽå° Broker åå·ēæææč――ãåŪĄæđæĻĄåäļäž čūæ éæŊåæ§åĪđå ·ïžHTTPãjournalãč°åšĶåĻäļ worker č·ŊåūæŊįåŪåŪį°ã
éĢéĐäļčåī
äļĪäū§ååĻäļæŊåäļäšåĄïžæéå°æŠåŪææéīåŊč―ææķäļåïžæäđ æĒåĪäŋčŊææ°åįå°čŊæįŧäļčīãæŠåŪææééŧæĒįå―åĻæå°åãcwd åæīå Workspace čŋį§ŧãåįååšį°äūčĩæåčŪŪæįŧæķïžäļč―æŪæĪčŊæčūæĐčŊ·æąäŧæŠåå ĨïžäļäŧĨéčŊæŽĄæ°äļéäļĒåžäļįĄŪåŪįŧæãFlyway V67 éŦäš main å―åæéŦįå·ēåšįĻįæŽïžV66 managed session agent definition digestïžïžå æĪå·ēčĒŦå―å main čŋį§ŧčŋįæ°æŪåšäžæ饚åšåšįĻåŪčäļæŊåĻ Flyway æ ĄéŠæķåĪąčīĨïžåđķäļšæŊäļŠ Session äŋåäļčĄææ°æđåæéãååēįŠįæŽå°æŠååđķïžčĄĻäļæéåĨįšĶäŋæäļåãåļĶåīæ įåå ĨčĶæą Hosted æ éĒåčŪŪ 1ïžåšäļčĩ·éĻį―ēæīæ°åį Harness å SDK/serverïžæ§æđå writer æ··įĻäļåĻæåšäŋčŊå ãSDK åĻåéåļĶįæŽåæīåæįŧäļæŊæį Harnessã
å·ēåŪæåŪé æšį æĩč§åĻäļtmuxéŠæķïžåŪĄæđå čŪļåįžåäļĒåĪąåįåŪæķæĒåĪãčūå ĨæĄåæŽĄåéãæįŧåæäŧķäļåïžäŧĨåAPIæđåååŪé å·æ°æūįĪšïžANSI/plain captureäļæŠåūåĻéŠæķčŪ°å―äļãæŽå°ä―ŋįĻH2äļåæ§providerïžäļåĢ°į§°įåŪæĻĄåãį䚧æ°æŪåšææå CLIéŠæķã#13269 įå ķäŧåįŧäšéĄđäŋæåžæūïžæŽ PR åĪįäļčŋ°åŪĄæđäļæđååĨįšĶãæđåæéååŪĄæđčŪūčŪĄįäļčąæææĄĢå·ēéūæĨåđķåæĨã
å ģč #13163 äļ #13269 įåŪĄæđåæđåéŪéĒã
äļæčĄĨå ïžįĻæ·å·ēåæŽĄįĄŪčŪĪäŋįåŪå ĻæĒåĪäļæ°ļäđ äūčĩäļåŊįĻįåĪéĻéŧåĄčūđįïžæđåéäžæĐåąå·ēæĪåãå―åæäšĪ638b979842143478966430c4489b9cedc1b7b4d3čŋ―å åå ĨåŪé main d35277cïžåđķįąab1af693957bd908157297f6e624a4e4a69d62cfå°æđåæéčŋį§ŧV66éįžå·äļšV67ïžmainįV66į°äļšagent-definition digestïžïžåįš§ååēäŋįV67ãV60ãäļŧįšŋV62ïžæđåSQLåäļĪéįŽįŦčŋį§ŧæĢæĨäļåïžčåīäŧ38æäŧķ+1305/-72ãæĪæŽĄåŪåéŠčŊåæ°head CIčŊĶč§éŠæķčŊčŪšïžå0fåé189éĄđã65ææŊCIå614åŪé UI/TUIäŋæåæäšĪå―åąãäļŧįšŋäŧŧåĄåæķäļäŧĢčĄĻæŽPRåĒå æđååæķåĨįšĶãæĢåžäššå·Ĩæđååč·ææįäššååđķäŧåū åŪæã