fix(managed-agent): stop database amplification on session hot paths - #13217

E2E / verification report

Method: the change lives in the standalone Spring control plane packages/sdk-java/managed-agent-server, which the qwen CLI never exercises, so the verification vehicle is the pinned query-count suite the issue itself recommends. The new Issue13181QueryBudgetTest drives the production stores/services over a statement-recording H2 (MySQL mode) DataSource migrated by the real Flyway scripts.

Measured before → after (same instrumented harness on both runs):

Regression: full mvn -o test suite (426 tests after the rebase onto current main) — 0 failures; the only error is the known timing flake streamsLargeOutputAndReadsItsTailAfterStoreReplacement (and its sibling), both reproduced on the unmodified baseline. All 32 Flyway migrations apply cleanly; RuntimeBrokerFlywaySchemaTest passes; the new check-flyway-migrations CI gate passes locally (it caught a real V28/V29 collision with upstream during review — renumbered to V31/V32).

Revocation semantics pinned both ways: a zero window restores per-event/per-chunk checks (existing tests), and new tests prove a revocation within the window takes effect at the window's end.

MySQL *IT integration suites need Docker; not run locally, left to CI.

Please do not rebase or force-push to an active PR as it invalidates existing review comments. Note for future reference, the bots always squash all changes into a single commit automatically as part of the integration.

Review round R1 addressed (2 Criticals + 23 Suggestions, all accepted)

All 25 findings are fixed in the follow-up commit. Summary by area:

Criticals

• R1-1 (snapshot gate, trickle case): the gate now skips the rewrite only when a snapshot exists, lag < 1000, no terminal event in the batch, and NOT (caught-up AND ≥5s since the last write). Convergence is preserved: findMaterializationTargets re-selects a session whose snapshot lags its drained progress once the snapshot ages past 5s, and the re-selected empty tick rewrites it (pinned by deferredSnapshotConvergesOnTheAgedOutReselection + the existing integration test, which caught the stale-forever shape before this fix).
• R1-2 (rolling-deploy fail-open): head columns are trusted only under qwen.managed-agent.tool-publication.journal-head-authorization (default false, wired through properties → configuration → store, mirrored in application.yml). With the gate off, authorization always scans the journal; preV33CommitSkewStillFencesWhileTheHeadGateIsOff reproduces the exact skew (journal row + revision bump, columns untouched) and asserts fencing, and disabledJournalHeadAuthorizationKeepsScanningTheJournal proves the scan still runs and repairs the head.

Store/service changes

• R1-9: the activation extraction now rides the extension-record parse pass (ApplyResult); the third parse is gone. The four acceptance tests stay green.
• R1-6: all three expiresAt readers share ManagedExtensionRecords.millisLenient (integral number or integral numeric string, else absent); stringExpiresAtReadsConsistentlyAcrossTheScanAndTheHead pins commit-write, scan, backfill, and head-read agreement.
• R1-7: with the head authoritative, requireEvidence resolves the intent's revision via one first_sequence/last_sequence range read plus one verified page (chain check preserved); renewReadsTheIntentAtItsOwnRevision pins a constant 3 journal statements at filler depth 30 (was 5/revision).
• R1-16: approval_mode rides the page's SELECT * onto SessionRecord; ManagedActionStore.approvalModes is deleted; page budgets tightened to 3/3/3/2 with a zero-count pin on the removed query. The value still comes from the column (lowercase-normalized at insert), never from the property.
• R1-17: both batch turn reads project TURN_SUMMARY_COLUMNS (qualified variant for the join) into TurnSummary; projection pinned by SQL-text assertions.
• R1-5: findActiveTurn/findLatestTurn/findLatestEnvironmentEvent delegate to the batch twins (the session_not_found guard kept); the dead findSnapshotCoveredSequence is gone; LATEST_TURN_ID removed.
• R1-8: column widths live once on ManagedSessionStoreModels.MAX_ACTIVATION_ID_CHARS/MAX_ACTIVATION_PHASE_CHARS, read by both the commit fits-guard and the backfill.

Test pins (mutant-verified locally)

• R1-4: batchTurnReadsFollowAdmissionOrderNotCreatedAt drives two out-of-order Turns + inverted environment sequences through the page; both measured mutants (MAX→MIN, pair-filter narrowing) go red.
• R1-10/R1-11: revocation window widened to 500ms/1000ms keeping grantChecks == 3; both window tests now assert failed == false.
• R1-20: a default-window case with its own workspace-bound session asserts the window covers the second event (grantChecks == 2); ManagedAgentPropertiesTest pins the 5s defaults and the false flag.
• R1-23: readGrantRecheckReanchorsAfterEachSuccess (500ms/1000ms, sent == 4, grantChecks == 3); the anchor-once mutant goes red.
• R1-21: retimed to 400ms reads / 1000ms window asserting exactly "ab"; the per-chunk re-verify mutant goes red. (Constants widened beyond the proposed 200/500 after observing >100ms scheduler overshoot on a loaded machine; margins are now 200ms each way.)
• R1-22: oneCommitKeepsTheLastActivationChange now blanks the four columns and re-asserts the fence through both scans (renew → "Activation is not active", verifyDispatch → "Original activation is fenced"); both forward-walk mutants go red.
• R1-3/R1-19: already covered in the reworked gate tests (replay floor clamped to a lagging snapshot; exact per-batch statement/row counts).

Docs

• R1-12: follow-up issue Move the managed-agent seal/finish stream rehash off the request thread #13242 filed and cited in §2/§9 and this PR body.
• R1-13/R1-14: supersede notes with cross-links added to the 2026-09-26 and 2026-09-29 contracts (both languages; the per-chunk lease checks noted as unchanged).
• R1-15: README gained the read-revalidation-interval row, qualified the two immediacy sentences, and links the new design doc pair.
• R1-18: §2/§9 reworded — the relaxations default to 5s, are operator-configurable, and have no enforced upper bound.
• R1-24: §7 now documents that the stage-1 DELETING observation is also window-deferred mid-download (stage-2 retirement still aborts per chunk via the read lease), pinned by midstreamDeletionIsDeferredToTheRevalidationWindow.

Full module suite: 471 tests, 0 failures, 2 errors — the two pre-existing ToolPublicationStoreTest timing flakes that fail identically on unmodified origin/main under load (A/B verified on a clean worktree). Flyway uniqueness gate: 34 migrations, all unique.

Post-commit audit rounds (undirected + adversarial pairs over the committed diff, with mutation probes):

• Round 1: no Criticals; findings fixed in the third commit — renew-path gate pin in the skew test, inline catch-up + debounce pins, missing/overflowing expiresAt clean-refusal pin, artifact test margins widened (500ms/1500ms after a 4/9 load-flake reproduction), dead import and stale comments cleaned.
• Round 2: no Criticals; fixed in the fourth commit — expired-activation fence pinned on both grant paths (both freshness-removal mutants go red), the two wall-clock-sensitive budget tests moved to a frozen clock, and the commit-side text extraction aligned with the scans' leniency. Three surviving conjunct mutants were declined as non-exploitable (a non-conforming writer's self-harm; the legacy scan keeps identical checks).
• Round 3 (confirmation, both audit types on the final state): CLEAN — the undirected pass found nothing actionable, and the adversarial pass closed all 16 attacks with the round-2 pin claims independently reproduced (mutants red).

Rebase note: the branch was rebased onto current main (which landed #13194's workspace-session archive/delete) and squashed to a single commit 1b2496d10a; the earlier commits fd18586686/0676c68fdb/fdf2f3be07/0ff29396ac are its pre-squash history.

Two integration points came out of the rebase:

• Retention capability flags are now batched too. feat(managed-agent): archive and delete closed workspace sessions #13194 added a per-row hasCompletedWorkspaceClose read feeding the new session_archive/session_unarchive/session_delete capability flags; on this PR's batched page assembly that would have been a per-row query again. The page assemblers now fetch the close state in one IN query (completedWorkspaceCloses) only when the page holds workspace-bound sessions, so the pins moved from 3/2 to 4/3 for bound pages (unbound pages stay 3/3), with the close-state query count pinned at 1.
• Migrations renumbered again: upstream added V33__managed_agent_definitions.sql, so this PR's two migrations are now V34 (journal-head activation columns) and V35 (event-type index). The Flyway-uniqueness gate passes (35 migrations, all unique).

Suite on the squashed tree: 498 tests (including upstream's new WorkspaceSessionRetentionTest), 0 failures, 2 pre-existing timing flakes (renewsTheOriginalClaimWhileScanningSlowObjectBytes, streamsLargeOutputAndReadsItsTailAfterStoreReplacement, both reproduced on unmodified origin/main under load).

Final audit trail and CI note:

• Rounds 3–5 of the pre-push audits (undirected + adversarial, mutation-probed): round 3 found two test-rigor gaps and one dead branch, fixed in f75955cb55 (the expired-activation test now proves the fence came from the head columns — renew reads exactly the intent's revision, verifyDispatch performs zero locked journal reads — and the renew budget additionally pins zero locked reads so a lock-mode upgrade cannot slip past); round 4 covered the rebase surface (retention batching, squash fidelity, renumber) and found one pin gap, fixed in 7de58603bc (per-row sessionDelete assertions on both bound pages with one completed CLOSE row among 20); round 5 re-audited both follow-up commits: CLEAN.
• CI: the MariaDB job caught one real integration between the snapshot gate and the 10ms test materializer — a scheduler tick could create the snapshot mid-sequence so a non-terminal explicit drain legally left it lagging. Fixed in b0d357ae9c by making the text-order test's trailing event terminal (the drain then always rewrites; the content assertion is unchanged). No production code involved.

Review round R2 addressed (2 Criticals + 38 Suggestions — 39 fixed, 1 declined)

All findings are in the follow-up commit. Summary by area:

Criticals

• R2-1 (exponent-form expiresAt DoS): millisLenient now pre-checks precision() - scale() > 19 before any BigInteger materialization, so an exponent-form string is rejected from its 11 bytes (the reviewer's exact shape), on the commit path and both scan paths alike. The 1e100000000 arm in unrepresentableExpiresAtFencesTheHeadCleanly pins the clean refusal with a zero-journal-statement budget.
• R2-2 (stale head certified as live): the head carries a fifth column, activation_head_revision, written on every commit with the journal revision the columns reflect. Both gates require stamp equality with the head's journal_revision; a pre-V34 binary's commit bumps journal_revision without the columns, so the head fails the stamp check, authorization rescans, and the backfill re-stamps — the rolling window self-heals per session. staleHeadStampRescansInsteadOfTrustingTheColumns (gate ON) and preV34CommitSkewStillFencesWhileTheHeadGateIsOff (gate OFF) reproduce the skew by restoring the pre-commit columns and stamp after a real release commit; staleHeadStampRebackfillsAndRejoinsTheHeadPath pins the heal.

Publication authorization

• R2-40/R2-39: requireEvidence answers the activation term from the locked head before reading the intent — a fenced renew pays zero journal statements (pinned in expiredActivationFencesThroughTheHead and the unrepresentable-expiry test, which now also carries ledger assertions).
• R2-23: migration V37 adds qwen_managed_session_journal_tx (tenant_id, session_id, last_sequence), so the intent revision lookup is an index range read.
• R2-24: the fast path restores the chain-contiguity proof with one indexed COUNT over the revision range from the intent up to the locked head.
• R2-25: the verified page is parsed by byte slice (ToolPublicationContract.readJson(bytes, offset, length)) — no record-wide String decode/split/re-encode.
• R2-20: the commit-side activation capture now requires the record's index to sit inside the declared event range ("Activation change has an invalid journal position").
• R2-21: the activation columns fold into the single head UPDATE every commit already runs — one write to the locked row per commit.
• R2-22: backfillActivation skips its write when the columns already hold exactly those values (all four columns + stamp compared, keeping disabledJournalHeadAuthorizationKeepsScanningTheJournal's restore assertion green).
• R2-32: the two-arg newStore test helper now defaults journalHeadAuthorization to false, the shipped default; the head-path tests opt in explicitly, and sameEpochReleasePreventsReserveAndRenew is parameterized over the flag so the release fence is pinned on both the legacy scan and the head fast path.
• R2-34: the budget suite now pins the flag-off costs too — the skew test asserts the legacy branch's locked-read count and a zero head-write count, so a regression on the shipped-default path goes red.
• R2-38: the publish-side zero pin gained its positive control: the two authorizations' four head FOR UPDATE reads (liveness probe + locked read each) are counted, so the zero cannot pass vacuously.
• R2-29/R2-31: oneCommitKeepsTheLastActivationChange builds the two activations with distinct fields on every column and asserts all four columns plus the stamp on blank/restore.
• R2-30 (declined): the twin width guard in backfillActivation is unreachable — the publication contract rejects an id wider than 512 bytes at reserve time (measured: the reserve fails with "Invalid ID encoding" before any journal row exists), so no binding can reference an oversized activation id for the backfill to re-check. Both guards share the MAX_ACTIVATION_* constants from R1-8.
• R2-37: the publication journal fixture is extracted into PublicationJournalFixture (create(DataSource, journalHeadAuthorization) + the event/append/request/reserve helpers); ToolPublicationStoreTest and Issue13181QueryBudgetTest delegate, ending the drift between the two copies.

Snapshot gating

• R2-18: the correlated per-tick snapshot lookup is gone — a deferred rewrite instead stamps snapshot_stale_since on the consumer-progress row (migration V36), and findMaterializationTargets re-selects on the marker alone; rewriteStaleSnapshot converges and clears it.
• R2-19: the design doc now states the invariant precisely — readers key off the snapshot's own covered_sequence, so projection progress may lead the snapshot between rewrites — and §3 documents the marker.
• R2-36: deferredSnapshotConvergesOnTheAgedOutReselection runs on the frozen-clock Fixture(Clock) like its siblings.

List pages

• R2-16/R2-17: findLatestEnvironmentEvents selects each session's latest environment event on its latest turn in SQL (a MAX(sequence_id) derived table filtered by the (session, turn) pairs) — one row per session, no OR chain, no dropped limit.
• R2-13: the close-state predicate has one spelling — hasCompletedWorkspaceClose delegates to completedWorkspaceCloses.
• R2-14: the test-only singulars (findActiveTurn/findLatestTurn/findLatestEnvironmentEvent/findSnapshotCoveredSequence) are deleted from the store SPI.
• R2-10: hasActions reads approval_mode off the page row; the actions != null clause and the ManagedActionStore collaborator are gone.
• R2-11: the retention rule has one spelling again — a static retention(session, closed) helper feeding both capability assemblers.
• R2-15: the batch reads pre-size their maps and bind lists from the known element count.
• R2-35: the item-part read is pinned alongside the item read (partReads [1,0,…,2] on the burst).

Transcript

• R2-7 (doc) + tail bounding: the transcript's event tail past the snapshot is bounded by the caller's limit (findNewestTailEvents, newest kept, olderCursor/hasMore reported), and §3 says precisely which view lags (the items array) and which does not (the event tail).

Docs and wording

• R2-3: the supersession note no longer leaves the zero-event revocation guarantee standing — it states closure within one window plus one poll interval.
• R2-4/R2-5/R2-6: the three zh-CN notes link the zh-CN design doc.
• R2-8: §8 discloses the two re-fixtured ManagedAgentServerIntegrationTest snapshot tests instead of claiming the suite is unchanged.
• R2-9: the README row says enforcement lands at the next chunk boundary after the window's end.
• R2-12: the ReadGrant javadoc states the idle-stream closure bound (recheck window + poll interval).

Test internals

• R2-26: the artifact window tests share readingPolicy/oneBytePerReadReader/flippingResponse helpers; the dead permission flag is gone (the flip lives in flippingResponse, still firing on the first write; the per-read sleep is untouched).
• R2-27: the deletion test now observes the stage-1 transition — it asserts the session reached DELETING.
• R2-28: the revocation window test retimed to 1000ms/3000ms margins.
• R2-33: relaxationDefaultsMatchTheShippedConfiguration binds application.yml through YamlPropertySourceLoader + ApplicationContextRunner, so both halves of the invariant are guarded.

Full module suite: 503 tests, 0 failures, 2 errors — the two pre-existing ToolPublicationStoreTest timing flakes that fail identically on the pre-change commit under load (A/B-verified on a clean worktree this round). Flyway uniqueness gate: clean.

Post-commit audit rounds (undirected + adversarial over the committed diff):

• Round 1: one Critical — a no-activation-change commit re-stamped carried-forward head columns to the new journal revision, laundering a pre-V34 writer's skew into a fresh-looking head (both auditors found it independently); fixed by advancing the stamp only when the preserved columns were current at the previous revision, pinned by noChangeCommitDoesNotRestampASkewedHead with the always-advance mutant going red. Three Minors fixed alongside: the width pre-check widened to long arithmetic (extreme exponents overflowed the int subtraction), the yml-mirror test now asserts the flattened keys exist (key drift cannot false-pass on Java defaults), and the transcript page-seam overlap (page 1's inlined control events reappear on the cursor path) is documented in §3 of the design doc — the WebShell client deduplicates on the event sequence, so the seam repeat is not user-visible. The head-path coverage split behind R2-32 was hardened by parameterizing the release-fence test over the flag.
• Round 2: one Major found independently by both auditors — the millisLenient pre-check guarded only the giant-integer direction (1e+N), while 1e-N still forced toBigIntegerExact to expand 10^N before dividing (measured ~56s for a 12-byte input); the scale is now bounded too (at most 19 decimal places, which a representable long never needs), with a 1e-100000000 test arm. Two test-coverage Minors fixed alongside: transcriptTailIsBoundedByTheCallerLimit now pins the newest-kept property with exact sequences (the oldest-kept mutant goes red), and deferredSnapshotConvergesOnTheAgedOutReselection ages only the marker for the selection arm and pins that the tick's scan never touches managed_agent_snapshot. Everything else the adversarial pass attacked held (stamp conditional, readIntent, V36 marker lifecycle, env derived table, fixture extraction, Flyway).
• Round 3: adversarial CLEAN (every fix re-attacked with fresh angles — backfill/commit interleavings, parser-exotic expiresAt forms probed empirically, the pins' discriminating power — all held; readIntent, the V36 marker lifecycle, the env derived table, and the fixture extraction all held). The undirected pass verified all six round-1/2 fixes as correct, complete, and non-vacuously pinned; its single Minor was a wrong lock attribution in the publish positive-control comment, corrected (claim authorize + retention put + verify-open lease + install authorize = the 4 head reads).
• Round 4 (confirmation, both audit types over the final state): CLEAN — the undirected pass re-derived every fixed spot and found nothing reportable; the adversarial pass enumerated all stamp/column writers and readers (two writers, two gated readers, both under the head row lock), re-probed the millisLenient bounds empirically, and closed fresh attacks on readIntent's strict decode, the env derived table, and the marker lifecycle. Two residual notes are recorded as non-defects: readIntent's range read visits O(revisions-after-intent) rows (pre-existing; the pinned budget is the statement count, which holds), and the zh-CN doc renders "stamp" as 时间戳.

Review round R3 addressed (4 Criticals + 20 Suggestions — all accepted)

Criticals

• R3-1/R3-2 (transcript tail cap): reverted to the merge-base behaviour — the cursor-less page again serves every event after the snapshot (the published contract's exact words), so the prefix invariant the stream resume relies on holds and the backward-walk seam disappears with the cursor it came from. transcriptServesEveryEventPastTheSnapshot pins the full tail (every event past the snapshot, hasMore=false, no cursor, the reported watermark equals the session's last sequence); the capped variant would fail it. ManagedAgentApiContractTest now pins the webShellTranscript description's load-bearing sentences, so a future paging change that leaves the published text stale goes red (the R3-1 acceptance).
• R3-3 (chain proof dropped the walk's tripwires): the contiguity COUNT now carries the same byte_length >= 1 AND byte_length <= MAX_TRANSACTION_BYTES bounds the legacy walk's transactions() applies per revision, and §6/§9 (both languages) state honestly what the count proves (gap-freeness with the tripwire; the per-line parse is kept for the located revision) — including the one residual: a pre-existing journal carrying a foreign-scoped line above the intent is caught by the legacy scan but not re-read after backfill, which is why the commit side now refuses such lines. aCorruptedJournalRowAboveTheIntentFencesBothPaths pins both arms (head path: "journal evidence is missing"; legacy: "failed verification"), going red without the bounds.
• R3-4 (write-side scope check): ManagedExtensionRecordStore.apply applies the same sessionKey/v equality to the activation.changed capture that both read paths enforce — a foreign-scoped line is rejected at commit ("Journal event scope conflicts", same message) instead of being promoted into durable trusted columns. foreignScopedActivationChangeIsRejectedAtCommit (foreign key + unknown version arms) goes red with the check removed.
• R3-6 (duplicate intents): both readIntent and the legacy walk now require(intent == null, "Intent sequence conflicts") before assigning, so the two paths fence ambiguous evidence identically; duplicateIntentLinesAtOneSequenceAreFenced (both flags) goes red with either guard removed.

Suggestions — test pins (each verified against its mutant)

• R3-9: aJournalHoleAboveTheIntentFencesTheHeadPath (deleted revision above the intent) goes red without the contiguity require; anOverlappingJournalRangeFencesTheHeadPath (widened range) goes red with size() == 1 weakened.
• R3-13: idleStreamClosesAfterRevocationAtTheNextWake (both loops, nothing published after revocation) completes within window + poll interval; deleting the loop-head recheck from streamWebShell turns its arm red while the public arm stays green.
• R3-14: the item-read filter now also counts the per-event existingAttributes read (trailing where keeps the parts table out), and a whole-batch ledger.total() vector is pinned (measured [35×8, 17]).
• R3-17: oversizedActivationPhaseBlanksTheHeadColumnsCleanly — a 46-char phase blanks the columns, advances the stamp, and the scan fences; without the phase arm the commit dies with DataIntegrityViolation (verified).
• R2-20 residual: activationChangeBeyondTheDeclaredEventsIsRejectedAtCommit pins the position guard.
• R2-29 residual: oneCommitKeepsTheLastActivationChange now varies activationId and epoch between the two payloads and asserts all four columns record the last.
• R3-18: the fixture's event() gained a scope/version overload (the three-arg form is byte-identical); foreignScopedIntentLinesAreFenced and unknownVersionIntentLinesAreFenced pin the read-side scope guard under both flag settings.
• R3-19: ToolPublicationConfigurationTest.theJournalHeadAuthorizationFlagReachesTheStore pins the flag's path from properties into the store via a public journalHeadAuthorization() accessor; negating the wiring goes red.
• R3-10: revocationInsideTheShippedWindowStillShipsARange pins the shipped 5s default's actual Range-path guarantee (admission + first guard = 2 policy calls, the window covers the single write) next to the existing PT0S case.
• R3-11: emptyBatchDoesNotRewriteAFreshLaggingSnapshot now also pins the deferral marker surviving the not-aged exit (value unchanged, and the session stays unselected).

Suggestions — housekeeping and docs

• R3-16: the dead args field and its assignment are gone from ToolPublicationStoreTest.
• R2-30 residual: the backfillActivation width guard is dropped as provably unreachable — both callers require an active phase and the binding's contract-capped id immediately before the call — and the javadoc now says so instead of describing a live path.
• R2-33 residual: relaxationDefaultsMatchTheShippedConfiguration now replaces systemEnvironment with a scrubbed map (all QWEN_MANAGED_AGENT_* removed) before adding the yaml sources; the hostile-env rerun (QWEN_MANAGED_AGENT_TOOL_PUBLICATION_JOURNAL_HEAD_AUTHORIZATION=true plus the harness pair) stays green.
• R3-15: the class javadoc restates all four snapshot-gate arms; the test is renamed materializationRewritesTheSnapshotAtCreationAndTerminalEvents.
• R3-7: the admission design's recheck sentence now states the windowed behaviour and the real closure bound (next recheck, plus at most one poll interval for an idle stream), and the superseded note is scoped to the original per-event decision — both languages.
• R3-8: §8 composes the bound-page budgets (6 with Turns: page, latest turns, environment events, close-state, creator-marker, grant; 5 when the turn-less page skips the environment batch) in both languages.
• R2-9 residual: the README row now states the real in-window exposure (up to 1 MiB for a Range request, up to a full read-timeout of a streaming download; nothing written after a denial).
• R2-23 residual: §6 and V38's comment no longer claim a constant-cost seek — the statement count is constant while the locate's row cost grows with the intent's distance behind the head (still strictly lighter than the legacy walk's locked row reads). On the suggested rows() pin: the ledger counts rows a statement RETURNS, so a COUNT(*) yields one row regardless of scan depth — a row-examined pin needs engine-level instrumentation H2 can't provide through the proxy, so the honesty fix is in the claims instead.
• R2-38: the README names all three knobs (read-grant-recheck-interval, read-revalidation-interval, journal-head-authorization) with defaults and restore/rollout semantics.
• R3-5: §2 qualifies path 4's relief as opt-in until the fleet runs the V35 code; the operator flip is tracked as follow-up issue Enable journal-head authorization after the fleet runs the V35 schema #13295 (filed, bilingual, with the acceptance checks).

The round's fixed-ruling confirmations (R1-1, R1-2, R2-1, R2-2, R2-3, R2-8, R2-20, R2-35, R2-36, R2-37) are acknowledged with thanks — no action needed.

Full module suite on this commit: 611 tests, 0 failures — the only errors are the three pre-existing, environment-bound failures reproduced on unmodified origin/main under the same load (the two ToolPublicationStoreTest timing flakes plus HarnessCoordinatorTest.runningOwnerObservesCancellationAfterStreamingStarts[accepted], all A/B-verified). Flyway uniqueness gate: 38 migrations, all unique. SpotBugs high-confidence gate: clean.

Review round R4 addressed (1 Critical + 5 Suggestions, all accepted; 9 deferred observations recorded)

Critical

• R4-1 (corruption misclassified as a client fault): readIntent's three journal-damage checks (the locate, the contiguity count, the verified page) now throw the session store's corruption fault — 500 managed_session_journal_corrupt, shared via ManagedSessionStore.journalCorrupt() widened to package-private — instead of an IllegalArgumentException that the handler maps to 400 invalid_request. Both authorization paths now answer a damaged journal identically, and the reserve/renew caller's retry/alert semantics are right. aJournalHoleAboveTheIntentFencesTheHeadPath, anOverlappingJournalRangeFencesTheHeadPath, and aCorruptedJournalRowAboveTheIntentFencesBothPaths all assert the code and the 5xx status under both flag settings (the head arm goes red with the old require — verified).

Suggestions

• R4-2 (scope-less legacy scan could launder a foreign line into the head): requireLegacyActivation now applies the closed-key scope check (sessionKey deep-equality + v == 1, the exact spelling the sibling readers use) before backfillActivation may promote the line. aForeignScopedActivationInAPreExistingJournalIsNotPromoted (SQL-planted poison, cold head) refuses under both flag settings and the head stays NULL; it goes red without the check (verified).
• R4-3 (the fence tests planted the foreign line at the intent, the one position both paths parse): the commit-side scope check in ManagedExtensionRecordStore.apply now covers every managed_session_event_v1 line, so a misscoped line can never enter the journal — the head path's narrower parse scope is safe by construction. The two fence tests are retargeted to assert the commit rejection (foreignScopedIntentLinesAreRejectedAtCommit, unknownVersionIntentLinesAreRejectedAtCommit; both go red with the check narrowed back to activation lines — verified), and aForeignScopedLineAboveTheIntentIsRefusedByTheLegacyScan plants a misscoped line above the intent via SQL: the legacy scan refuses it (both gate settings, via a cold head), while the warm head path authorizes from the head columns without re-parsing the intermediate revision — the §9 residual, recorded.
• R4-4 (the restored uncapped tail pays ten round trips at the lag ceiling): tailEvents now pages at SNAPSHOT_REFRESH_EVENTS (the deferral gate's own lag bound), so a transcript open on a maximally lagging session costs one event read instead of ten, and a transient longer burst still pages further. aMaximallyLaggingSnapshotTailIsOneRead pins the 999-event tail at exactly one managed_agent_event read (red at page size 100 — verified); the full-tail contract pins hold with the wider page.
• R4-5 (the empty tick had no statement pin): emptyBatchDoesNotRewriteAFreshLaggingSnapshot now pins the whole empty batch at ledger.total() == 4 (the event read, the session lock, the progress lock, the snapshot read).
• R3-10 follow-up: the Range-window test now uses the shared readingPolicy(...) helper like its siblings (the calls == 2 pin is unchanged and green).

Deferred (recorded in the review body, not requested this round): the nine round-4 deferred observations (wall-clock sleeps in the revocation test, the QueryLedger.matches negation grammar, the stream tests' repeated fixture, §8's acceptance list, the empty-batch rewriteStaleSnapshot call shape, fractional expiresAt shapes, the width-constant two-writer invariant, a lapping-window artifact case, the stream helper's third knob) stay deferred per the convergence posture — happy to take any of them in a follow-up if you'd like.

Full module suite on the final head: 633 tests, 0 real failures — the only failures are the pre-existing, environment-bound set that reproduces on unmodified origin/main under load (the two ToolPublicationStoreTest timing flakes, A/B-verified). Flyway uniqueness gate: clean (39 migrations). Checkstyle and SpotBugs high-confidence gates: clean. Post-commit audits: an undirected pass found only wording-level observations (folded into the commit message and §9); an adversarial pass found two Suggestions (the fault-class split for a never-committed intentSequence, and the unknown-domain carve-out gap) — both fixed with red-verified pins in the audit-response commit; the confirmation pass over the final state came back CLEAN.

Heads-up on the latest push: main's #13301 (persisted Workspace session tool profiles) landed its own V35 while this round was in flight, so this branch's four migrations are renumbered to V36–V39 and SessionRecord now carries both new fields (approvalMode, toolProfile); every textual V35–V38 reference in code, tests, README, and the design docs moved with them.

@qwen-code /triage

Real-stack verification — #13217 at 4d3b1351c7 (trial-merged onto main 6136786c0c)

Verdict for merge: supports merging. On a real MySQL 8.4.7 + Druid deployment driven through the public and WebShell APIs, the three hot paths the API can reach shrink as claimed:

• List pages: 41–141 statements down to 3–6.
• Snapshot rewrites: 18–22× fewer rewrites and ~18.5× fewer binlog bytes.
• SSE read-grant queries: 139× fewer.

Both bounded-staleness relaxations stay inside their documented bounds, and read-grant-recheck-interval=PT0S restores main's revocation behaviour and query volume. On the upgrade path:

• V36–V39 apply cleanly to a populated database.
• The six list/detail responses are byte-identical before and after the upgrade.
• The old binary keeps serving the migrated schema.
• The activation_head_revision stamp falls behind after an old-binary commit, which is the rolling-window premise the design depends on.

Nothing blocking. The R5-3 redundancy is confirmed but small. Publication authorization (path 4) and the artifact-download throttle can't be reached through the public API with shipped defaults. I ran the PR's own budget test for them on real MySQL instead (§4).

How it was run

1. The three API-reachable hot paths (figure 1)

Notes on these numbers:

• On the real stack a Workspace-bound WebShell page costs 7 statements per row on main, more than the 4 per row behind the 41–81 range in the PR description: per-row approval_mode, close-state, create-command and registry reads, plus the turn and environment-event lookups. PR's 6 equals the bound in design §8 for a bound page with creator-owned sessions.
• All four SSE subscribers on PR received 1505/1505 events in order.
• History-Turn wall time was 23–33 s on main and 19–32 s on PR. Both arms spend that time mostly in the per-delta Session Store commit path (the 1,505-event stream made 1,608 vs 1,614 journal commits), so I see no end-to-end latency change on this host.

2. Bounded staleness, measured (figure 2)

• Snapshot / GET …/items. During the 60 s stream the snapshot was refreshed every 268 ms (median) on main and every 5058 ms on PR (max 5168 ms). On PR the oldest event missing from the snapshot was at most 4.9 s old, and the lag peaked at 120 events (main: 11). Both arms converge on the terminal batch. In the trickle-then-pause case PR lagged by at most 22 events and converged about 5 s after ingestion paused, through the snapshot_stale_since reselection; the marker was observed set and then cleared. The WebShell transcript showed every token throughout, because it tails the events past the snapshot.

• Read-grant revocation (can_read flipped 4 s into a 15 s stream):

  Arm	Stream closed after	Events delivered after revoke
  main	123 ms	0
  PR (default 5 s)	4666 ms	45
  PR + read-grant-recheck-interval=PT0S	144 ms	0

  The public and WebShell streams behave identically. A new subscription after revocation returns 404 in every arm. PT0S also restores the per-event query volume (6,905 reads, against 6,943 on main).

3. Upgrade, rollback and the rolling-window stamp (figure 3)

One MySQL database through four phases. Each phase is a fresh Spring + Harness process pair on the same deployment directories, as on a real host.

1. main (V35) creates 41 Sessions, 29 of them with Turns.
2. PR boots on that database. Flyway applies V36–V39 in 0.049 s. On the same rows, all six list and detail responses are byte-identical to main's (15–18 KB bodies), while statements per call fall from 41 / 81 / 61 / 141 / 3 / 4 to 3 / 4 / 3 / 6 / 3 / 3. New Turns completed on 6/6 pre-existing Sessions and 1/1 new Session.
3. main again on the V39 schema (rollback, or the old half of a rolling fleet). Flyway logs Successfully validated 39 migrations and the server runs normally. 6/6 old Sessions plus 1 new completed. A 205-event stream reached both SSE subscribers in full. No Spring ERROR lines in any phase.
4. PR again. 6/6 plus 1/1 completed.

Journal-head activation stamp on the 28 list Sessions that have journals:

• Before the upgrade: 28 null.
• After PR commits: 6 current.
• After old-binary commits: those 6 are lagging. The old binary advances journal_revision without touching the columns, which is exactly the rolling-window skew the stamp is designed to expose, here produced by real traffic.
• After the next PR commit carrying an activation change: 6 current again.
• In the ab-pr run, real Hosted Turns filled the V36 columns on all 31 heads, each with a current stamp.

The reader side (refusing a lagging or null head, then rescanning and backfilling) needs tool publication, so it is covered in §4 instead.

Scaled database. I copied the main-arm data ×100 into a V35 schema: 4,300 Sessions, 1,736,300 events, 2.1 GiB.

• V36–V39 applied in 4.87 s, of which the V37 event index took 4.74 s.
• I then rebuilt V37 on 2.14M rows while a writer inserted an event every ~5 ms. The 474 inserts during the 3.3 s build had a max latency of 6.4 ms and a mean of 0.54 ms, so InnoDB's online DDL did not block ingestion.

After each restart, the first Turn on a pre-existing Session waited 32–35 s for the previous Harness's writer lease. This happened in every phase with both binaries, so it is unrelated to the PR.

4. Paths the public API can't reach

Publication authorization (path 4) and the artifact re-validation window both need qwen.managed-agent.tool-publication.enabled (default false) plus an object store. They also need hosted-workspace-shell/1 Sessions, and the Managed Agent API only creates hosted-workspace-files/1, so neither path can be reached through the public API with shipped defaults. What I ran instead:

• The PR's own Issue13181QueryBudgetTest on real MySQL. I patched only its fixture so that each test gets a fresh MySQL 8.4.7 schema migrated V1–V39 by Flyway (36-line patch, on the assets branch). Result: 30/30 pass on InnoDB, the same as on H2. That includes the publication budgets (verifyDispatch reads the locked journal 0 times, renew costs 4 journal statements, a fenced renew costs 0) and the stamp cases staleHeadStampRescansInsteadOfTrustingTheColumns, staleHeadStampRebackfillsAndRejoinsTheHeadPath, noChangeCommitDoesNotRestampASkewedHead and publicationAuthorizationRescansAndBackfillsPreMigrationHeads.
• Full managed-agent-server unit suite on the trial merge (main with Druid, plus the PR): 633 run, 0 failures, 0 errors, 1 skipped. The two timing-sensitive ToolPublicationStoreTest cases named in the PR description passed here.
• Plans on the scaled database (figure 4): a 20-row page drops from 41 / 81 / 61 / 121 statements to 3 / 4 / 3 / 5. Both new batch reads use the V37 index: findLatestTurns reads 39 index entries and findLatestEnvironmentEvents reads 78 rows. When Sessions have 500 Turns each, the optimizer switches the environment read to managed_agent_event_turn_idx by itself (40 rows).

Observations (non-blocking)

1. findLatestTurns cost grows with Turns per listed Session (figure 4). It reads every turn.accepted index entry of each listed Session and then takes MAX; MySQL uses no loose index scan here. Server time for a 20-row page: 0.61 ms at 1 Turn per Session, 1.16 ms at 50, 4.49 ms at 500, 35.95 ms at 5,000. main's per-row read costs 0.10–0.30 ms × 20 plus 20 round trips, so the crossover lies somewhere between 500 and 5,000 Turns per Session; at 500 PR is still ahead. I don't think this blocks the PR, but it is worth remembering for very long-lived Sessions. I tried a per-Session ORDER BY … DESC LIMIT 1 rewrite and it was slower (117 ms, or 158 ms with FORCE INDEX), so I'm not proposing a fix.
2. R5-3 is real but small. On PR, QwenHostedHarnessConnector still issues about 1.7 single-row SELECT approval_mode per Workspace Turn (41 across 24 Turns). main's 904 such reads came mostly from per-row list lookups, which this PR removes. Next to roughly 1,600 Session Store commits per 1,500-event Turn, the remainder is noise, so a follow-up is fine.
3. API clients can see both documented trade-offs. In the trickle run, 9.8 s in, the WebShell transcript had 38 tokens while GET …/items showed 19. A revoked reader received 45 more events over 4.7 s. Both match the design. PT0S restores the strict behaviour at main's query cost. Operators who rely on prompt revocation may want a line about this in the release notes.

Not covered

• No end-to-end tool publication or artifact download (see §4). MariaDB and Linux/Windows were not run locally; CI's MariaDB, MySQL 8.4 and Windows Java legs are green on the head.
• Concurrency stayed below the core count to avoid the JDK 21 virtual-thread pinning wedge described in fix(managed-agent): ≥8 concurrent Turns stall after the model answers on modest hardware (lock convoy in the store path) #13333, which is not related to this PR.

Evidence: figures, raw results.json and samples for every run, the rig (rig.mjs, scale.mjs, configs) and the MySQL fixture patch are on assets-pr13217.