feat(session,runtime): 多角色并存—按会话选角（迁移0011 + 按回合解析 + agent池 + 提取器修正）

按 DevDocs/design/22 批次 1 后端（§2/§3/§4.1-4.5/§4.7/§5 验收 1-6）。
- 迁移 0011：chat_sessions.persona_id + chat_messages.persona_id（均 DEFAULT ''，无回填 → 升级零风险）；同步包内幂等 DDL；**真实库升级验证**（拷贝 data/cyrene.db 到临时目录跑 MigrateUp：既有 1 会话/109 消息 persona 仍为 ''，原库未被触碰）
- history：SessionMeta/Message 加 PersonaID + SetSessionPersona；ListSessions/List/scan/Append 带上
- runtime：SessionEnv.PersonaID + loop.personaFor(ctx) 替换固定 l.personaID（memory/request/turn）+ **agent 池**（Options.Agents，按角色取 instructions，未命中回落）+ **提取器不再把 persona 烤死在构造期**（多角色下记忆不再永远记在 cyrene 名下）+ **thinking 旋钮改为按会话角色解析**（否则角色 Y 会用角色 X 的预算/展示）
- gateway：会话 DTO/POST/PATCH 支持 personaId；ws/rest/voice 的 OwnerEnv 硬编改为**按会话解析角色**（actor 元数据语义不变）；admin memories 搜索去掉硬编 cyrene
- Docs/api-client v0.42；**两处有意的行为收紧**已写明：POST /sessions body 非法 JSON → 400（原先完全忽略 body；空/null/{} 仍 201）；POST /admin/memories/search 省略 personaId 且无默认角色 → 400（原先默认查 cyrene）
- 测试：design/22 §5 验收 1-6（记忆隔离/提示词首条 system/情绪按角色/提取 persona 归属/迁移兼容）+ 进程内 e2e（断言 adapter 收到的 model.Request.Messages[0] 即该角色的 systemPrompt）
- **已知未做（留批次 2 / 待确认）**：① IM 与渠道级未做 → **§7-3「owner 私聊镜像随主会话角色」尚未生效**；② 请求级覆盖未实现（本批只做会话级）；③ **§7-5 的「上下文发送角色标记」只完成存储+DTO 半边**——消息 persona 已落库且 DTO 已带，但模型上下文不从 chat_messages 重建，「第 N 条是谁说的」尚未进上下文（需确认是否属批次 2）；④「切角色重建摘要」当前是空操作（压缩未接线）；⑤ thinking 旋钮仅在流式路径生效（非流式 agent.RunStep 不带，A 批次既有性质）
- 验收：go build/vet/test 全绿 + linux/amd64 与 darwin/arm64 交叉编译（既有 flake 本轮未触发；同批 session_orchestrator.go 一度 501 行 → 抽出 session_tail.go）

cmd/cyrene/extractor.go

@@ -23,15 +23,20 @@ const memoryOwnerRoleID = "owner"
 //     records the owner's explicit "记住 X" directives instead of failing a model
 //     call on every turn.
 //
+// The extractor deliberately holds NO persona: one process now answers as several
+// roles (design/22 §4.2), so a persona baked in here would file every extracted
+// memory under that one role. The loop stamps each item with the role that
+// produced the turn when it persists it (loop.persistMemories).
+//
 // The loop detaches the LLM extractor to a background goroutine (ExtractAsync);
 // see internal/runtime/loop/memory.go.
-func (a *app) buildMemoryExtractor(personaID string) memory.Extractor {
+func (a *app) buildMemoryExtractor() memory.Extractor {
 	if llmGroupUsable(a.llm) {
 		a.log.Info("memory extractor: llm", "model", a.llm.Model(), "provider", a.llm.Provider())
-		return memory.NewLLMExtractor(a.llm, personaID, memoryOwnerRoleID)
+		return memory.NewLLMExtractor(a.llm, "", memoryOwnerRoleID)
 	}
 	a.log.Warn("memory extractor: manual (no usable llm model group)")
-	return memory.NewManualExtractor(personaID, memoryOwnerRoleID)
+	return memory.NewManualExtractor("", memoryOwnerRoleID)
 }
 
 // llmGroupUsable reports whether the active model group of the runtime stack can

cmd/cyrene/extractor_test.go

@@ -18,7 +18,10 @@ func testRuntimeLLM(t *testing.T, env config.LLMConfig) *modelpkg.RuntimeLLM {
 }
 
 // TestBuildMemoryExtractor_LLMWhenCredentials proves a configured provider group
-// selects the LLM extractor (design/03 §1).
+// selects the LLM extractor (design/03 §1). The extractor is role-agnostic
+// (design/22 §4.2): it is built without a persona and the loop stamps the turn's
+// role onto each extracted item, so multi-role extraction cannot be filed under
+// the default role.
 func TestBuildMemoryExtractor_LLMWhenCredentials(t *testing.T) {
 	t.Parallel()
 	a := &app{
@@ -29,8 +32,8 @@ func TestBuildMemoryExtractor_LLMWhenCredentials(t *testing.T) {
 			Model:   "gpt-4o-mini",
 		}),
 	}
-	if _, ok := a.buildMemoryExtractor("persona-a").(*memory.LLMExtractor); !ok {
-		t.Fatalf("extractor = %T, want *memory.LLMExtractor (credentials configured)", a.buildMemoryExtractor("persona-a"))
+	if _, ok := a.buildMemoryExtractor().(*memory.LLMExtractor); !ok {
+		t.Fatalf("extractor = %T, want *memory.LLMExtractor (credentials configured)", a.buildMemoryExtractor())
 	}
 }
 
@@ -40,13 +43,13 @@ func TestBuildMemoryExtractor_LLMWhenCredentials(t *testing.T) {
 func TestBuildMemoryExtractor_ManualWhenNoCredentials(t *testing.T) {
 	t.Parallel()
 	a := &app{log: testLog(), llm: testRuntimeLLM(t, config.LLMConfig{})}
-	if _, ok := a.buildMemoryExtractor("persona-a").(*memory.ManualExtractor); !ok {
-		t.Fatalf("extractor = %T, want *memory.ManualExtractor (no usable llm group)", a.buildMemoryExtractor("persona-a"))
+	if _, ok := a.buildMemoryExtractor().(*memory.ManualExtractor); !ok {
+		t.Fatalf("extractor = %T, want *memory.ManualExtractor (no usable llm group)", a.buildMemoryExtractor())
 	}
 
 	bare := &app{log: testLog()}
-	if _, ok := bare.buildMemoryExtractor("persona-a").(*memory.ManualExtractor); !ok {
-		t.Fatalf("extractor = %T, want *memory.ManualExtractor (nil provider stack)", bare.buildMemoryExtractor("persona-a"))
+	if _, ok := bare.buildMemoryExtractor().(*memory.ManualExtractor); !ok {
+		t.Fatalf("extractor = %T, want *memory.ManualExtractor (nil provider stack)", bare.buildMemoryExtractor())
 	}
 }
 

cmd/cyrene/persona_agents.go

@@ -0,0 +1,68 @@
+package main
+
+import (
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/logger"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/agent"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/guardrail"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/model"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/tool"
+)
+
+// This file builds the per-role agent pool (design/22 §4.2 方案 A). An
+// agent.Agent's instructions are immutable after construction, so "the session's
+// role decides the system prompt" is implemented as one agent per role, all
+// sharing the same dispatcher, guardrail pipeline, model adapter and options —
+// only the instruction string differs. The loop picks the pool entry for the
+// turn's role on every step (internal/runtime/loop/persona.go), so a role switch
+// takes effect on the next turn without rebuilding the loop.
+//
+// Requirements from design/22 §5: prompt, memory, emotion and thinking must all
+// be resolved from the same role. The pool owns the prompt; the loop owns the
+// other three (personaFor / knobsFor), so a turn can never mix two roles.
+
+// personaAgentPool returns the per-role agent pool plus the agent to run turns
+// with: the pooled agent for the default role when the pool has one, otherwise the
+// caller's fallback agent, so a deployment with no registered character keeps
+// exactly the pre-multi-character single agent.
+func (a *app) personaAgentPool(llm *model.RuntimeLLM, dispatcher *tool.Dispatcher, guards *guardrail.Pipeline, fallback *agent.Agent) (map[string]*agent.Agent, *agent.Agent) {
+	pool := a.buildPersonaAgents(llm, dispatcher, guards)
+	if pooled, ok := pool[a.defaultPersonaID()]; ok {
+		return pool, pooled
+	}
+	return pool, fallback
+}
+
+// buildPersonaAgents returns the role → agent pool: every registered character's
+// persona gets an agent carrying that persona's system instruction
+// (identityInstructionFor + the personality/values/speechStyle/catchphrase/
+// background sections, design/01 §2.2). It returns an empty map when no persona is
+// registered, so the loop keeps its single default agent.
+//
+// Only personas reachable through a registered character are pooled: a character
+// is the selectable unit (1 character ↔ 1 persona), so a persona with no character
+// can never be bound to a session. A session bound to an unknown id therefore
+// falls back to the default agent, and its memory scope still follows the bound
+// id — a stale binding degrades to the default prompt rather than failing the
+// turn.
+func (a *app) buildPersonaAgents(llm *model.RuntimeLLM, dispatcher *tool.Dispatcher, guards *guardrail.Pipeline) map[string]*agent.Agent {
+	log := logger.WithSource(a.log, "cmd/cyrene")
+	pool := make(map[string]*agent.Agent, a.personas.CountPersonas())
+	for _, c := range a.personas.List() {
+		if _, ok := pool[c.PersonaID]; ok {
+			continue
+		}
+		p, ok := a.personas.Persona(c.PersonaID)
+		if !ok || p == nil {
+			continue
+		}
+		ag, err := agent.New(instructionsFromPersona(p), dispatcher, guards,
+			agent.WithModel(llm, llm),
+			agent.WithOptions(agent.Options{MaxRounds: defaultMaxRounds, Purpose: "chat"}))
+		if err != nil {
+			log.Warn("persona agent skipped", "persona", c.PersonaID, "error", err)
+			continue
+		}
+		pool[c.PersonaID] = ag
+	}
+	return pool
+}

cmd/cyrene/persona_emotion_test.go

@@ -0,0 +1,111 @@
+package main
+
+import (
+	"context"
+	"testing"
+
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/persona/emotion"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/persona/loader"
+	personareg "git.yeij.top/AskaEth/Cyrene_v2/internal/persona/registry"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/agent"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/loop"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/model"
+)
+
+// This file locks design/22 acceptance 4 at the composition-root level: with two
+// roles registered, a turn of role Y must advance ONLY Y's emotion machine and
+// affection (design/01 §2: 情绪/好感度 follow the persona), and the `mood` frame it
+// broadcasts must name Y — never the default role. The turn's role reaches the hook
+// through the loop's per-turn SessionEnv resolution (loop.TurnEnd.PersonaID), so a
+// regression to a construction-time persona shows up as the wrong machine moving.
+
+// testTwoPersonaApp registers two personas (each with its own emotion machine and
+// affection curve) and wires the composition root's emotion observer exactly as
+// wire.go does.
+func testTwoPersonaApp(t *testing.T) (*app, *fakeMoodEmitter) {
+	t.Helper()
+	reg := personareg.New()
+	for _, p := range []*loader.Persona{
+		{
+			ID:        "xilian",
+			Name:      "昔涟",
+			Emotion:   loader.EmotionParams{InitialState: emotion.Calm, DecayRate: 0.5},
+			Affection: loader.AffectionParams{Initial: 50, Min: 0, Max: 700, Delta: 10},
+		},
+		{
+			ID:        "yuki",
+			Name:      "由纪",
+			Emotion:   loader.EmotionParams{InitialState: emotion.Calm, DecayRate: 0.5},
+			Affection: loader.AffectionParams{Initial: 20, Min: 0, Max: 700, Delta: 5},
+		},
+	} {
+		if err := reg.RegisterPersona(p); err != nil {
+			t.Fatalf("RegisterPersona(%s): %v", p.ID, err)
+		}
+	}
+	if err := reg.RegisterCharacter(&personareg.Character{ID: "xilian", Name: "昔涟", Default: true, PersonaID: "xilian"}); err != nil {
+		t.Fatalf("RegisterCharacter: %v", err)
+	}
+	if err := reg.RegisterCharacter(&personareg.Character{ID: "yuki", Name: "由纪", PersonaID: "yuki"}); err != nil {
+		t.Fatalf("RegisterCharacter: %v", err)
+	}
+
+	sink := &fakeMoodEmitter{}
+	a := &app{log: testLog(), personas: reg, moodSink: sink}
+	a.emotion = a.buildEmotionObserver()
+	return a, sink
+}
+
+// TestTurnEndMovesOnlyTheTurnPersona is acceptance 4: a Y turn moves Y's emotion and
+// affection and leaves the default role's untouched, and the mood broadcast carries
+// Y's id (so the frontend's 心情 badge is the active role's, not a global one).
+func TestTurnEndMovesOnlyTheTurnPersona(t *testing.T) {
+	t.Parallel()
+	a, sink := testTwoPersonaApp(t)
+	ag, err := agent.New("你是由纪。", nil, nil, agent.WithModel(moodAdapter{reply: "由纪在呢～"}, nil))
+	if err != nil {
+		t.Fatalf("agent.New: %v", err)
+	}
+	l := loop.New(loop.Options{
+		Agent:     ag,
+		Agents:    map[string]*agent.Agent{"yuki": ag},
+		PersonaID: "xilian", // the configured default role is NOT the turn's role
+		OnTurnEnd: a.onTurnEnd,
+	})
+
+	env := loop.OwnerEnv()
+	env.PersonaID = "yuki"
+	res, err := l.Run(loop.WithSessionEnv(context.Background(), env), "web", []model.Message{model.TextMessage(model.RoleUser, "好开心呀，最喜欢你了")})
+	if err != nil {
+		t.Fatalf("Run: %v", err)
+	}
+	if res.Mood == "" {
+		t.Fatal("Result.Mood is empty, want Y's mood for the turn")
+	}
+
+	yukiMachine, yukiAffection, ok := a.personas.Emotions().Get("yuki")
+	if !ok {
+		t.Fatal("persona yuki has no emotion machine")
+	}
+	if yukiMachine.Current() == emotion.Calm {
+		t.Fatalf("yuki machine state = %s, want it moved by her own turn", yukiMachine.Current())
+	}
+	if yukiAffection.Value() != 25 {
+		t.Fatalf("yuki affection = %d, want 25 (20 + her own step 5)", yukiAffection.Value())
+	}
+
+	xilianMachine, xilianAffection, ok := a.personas.Emotions().Get("xilian")
+	if !ok {
+		t.Fatal("persona xilian has no emotion machine")
+	}
+	if xilianMachine.Current() != emotion.Calm {
+		t.Fatalf("default role machine = %s, want it untouched (calm)", xilianMachine.Current())
+	}
+	if xilianAffection.Value() != 50 {
+		t.Fatalf("default role affection = %d, want it untouched (50)", xilianAffection.Value())
+	}
+
+	if sink.calls != 1 || sink.personaID != "yuki" {
+		t.Fatalf("mood broadcast = %+v, want exactly one frame naming yuki", sink)
+	}
+}

cmd/cyrene/persona_prompt.go

@@ -4,6 +4,7 @@ import (
 	"strings"
 
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/persona/loader"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/loop"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/model"
 )
 
@@ -106,7 +107,9 @@ func bulletList(items []string) string {
 
 // defaultThinkingOptions returns the reasoning knobs the loop should inject for
 // the default persona: the thinking directive, the reasoning_effort value and the
-// thinking-broadcast switch.
+// thinking-broadcast switch. It is the default half of the per-role resolution
+// the loop performs every turn (Options.PersonaKnobs, see personaKnobs below), so
+// the configured default and the per-turn lookup can never drift apart.
 //
 // The thinking directive is non-nil only when the persona configures something
 // that affects the request (a budget, an effort, or an explicit on/off mode).
@@ -115,12 +118,35 @@ func bulletList(items []string) string {
 // effect. All three are zero when no persona is registered, which leaves the
 // loop's pre-existing behavior untouched.
 func (a *app) defaultThinkingOptions() (*model.Thinking, string, *bool) {
-	p, ok := a.defaultPersona()
+	knobs, ok := a.personaKnobs(a.defaultPersonaID())
 	if !ok {
 		return nil, "", nil
 	}
+	return knobs.Thinking, knobs.ReasoningEffort, knobs.ThinkingShowToUser
+}
+
+// personaKnobs resolves a role's reasoning knobs for the loop
+// (loop.Options.PersonaKnobs, design/22 §4.2): the loop asks for the role of the
+// turn it is about to build a request for, so a session bound to role Y runs with
+// Y's thinking budget / effort / broadcast switch instead of the default role's.
+// Resolving from the role id rather than pushing a value into every caller's
+// SessionEnv means every path — Web REST/WS/voice, IM, backthink, sub-agents —
+// gets the right knobs from one input. ok=false means "unknown role", and the loop
+// keeps its configured defaults.
+func (a *app) personaKnobs(personaID string) (loop.LoopKnobs, bool) {
+	if personaID == "" {
+		return loop.LoopKnobs{}, false
+	}
+	p, ok := a.personas.Persona(personaID)
+	if !ok || p == nil {
+		return loop.LoopKnobs{}, false
+	}
 	thinking, effort := personaThinking(p)
-	return thinking, effort, p.Thinking.ShowToUser
+	return loop.LoopKnobs{
+		Thinking:           thinking,
+		ReasoningEffort:    effort,
+		ThinkingShowToUser: p.Thinking.ShowToUser,
+	}, true
 }
 
 // personaThinking maps the persona's `thinking` section onto the model-layer

cmd/cyrene/wire.go

@@ -363,6 +363,9 @@ func (a *app) wireRuntime() error {
 
 	personaID := a.defaultPersonaID()
 	store := a.memStore
+	// One agent per role, all sharing the dispatcher/guards/adapter above, so a session
+	// can answer as any role (design/22 §4.2 方案 A); the loop picks per turn.
+	agents, defaultAgent := a.personaAgentPool(runtimeStack, a.dispatcher, guards, ag)
 
 	// Spans fan out to the JSONL stderr recorder and — once wireFrontend has built
 	// the gateway — to its observability buffer (cmd/cyrene/observability.go).
@@ -410,11 +413,15 @@ func (a *app) wireRuntime() error {
 	// emotion machine and affection move, and the returned mood label is written
 	// onto Result.Mood and the assistant message (design/16 §3.3).
 	a.emotion = a.buildEmotionObserver()
-	// Reasoning knobs from the default persona (budget / effort / thinking broadcast).
+	// Reasoning knobs from the default persona (budget / effort / thinking broadcast),
+	// which are also the per-turn defaults: the loop re-resolves them for each turn's
+	// role through PersonaKnobs, so a session bound to another role uses that role's
+	// budget instead.
 	thinking, reasoningEffort, thinkingShow := a.defaultThinkingOptions()
 
 	a.loop = loop.New(loop.Options{
-		Agent:              ag,
+		Agent:              defaultAgent,
+		Agents:             agents,
 		Tools:              a.dispatcher,
 		Capacity:           capDecider,
 		OnCapacity:         a.onCapacity,
@@ -422,12 +429,13 @@ func (a *app) wireRuntime() error {
 		OnTurnEnd:          a.onTurnEnd,
 		Memory:             store,
 		Retriever:          a.retriever,
-		Extractor:          a.buildMemoryExtractor(personaID),
+		Extractor:          a.buildMemoryExtractor(),
 		Checkpoint:         checkpoint,
 		Tracer:             tracer,
 		Flow:               flowPub,
 		Guards:             guards,
 		PersonaID:          personaID,
+		PersonaKnobs:       a.personaKnobs,
 		Timezone:           a.cfg.Timezone,
 		MaxRounds:          defaultMaxRounds,
 		WorkingMemory:      memory.NewWorkingMemory(0),