feat(session,runtime): 多角色并存—按会话选角（迁移0011 + 按回合解析 + agent池 + 提取器修正）

按 DevDocs/design/22 批次 1 后端（§2/§3/§4.1-4.5/§4.7/§5 验收 1-6）。
- 迁移 0011：chat_sessions.persona_id + chat_messages.persona_id（均 DEFAULT ''，无回填 → 升级零风险）；同步包内幂等 DDL；**真实库升级验证**（拷贝 data/cyrene.db 到临时目录跑 MigrateUp：既有 1 会话/109 消息 persona 仍为 ''，原库未被触碰）
- history：SessionMeta/Message 加 PersonaID + SetSessionPersona；ListSessions/List/scan/Append 带上
- runtime：SessionEnv.PersonaID + loop.personaFor(ctx) 替换固定 l.personaID（memory/request/turn）+ **agent 池**（Options.Agents，按角色取 instructions，未命中回落）+ **提取器不再把 persona 烤死在构造期**（多角色下记忆不再永远记在 cyrene 名下）+ **thinking 旋钮改为按会话角色解析**（否则角色 Y 会用角色 X 的预算/展示）
- gateway：会话 DTO/POST/PATCH 支持 personaId；ws/rest/voice 的 OwnerEnv 硬编改为**按会话解析角色**（actor 元数据语义不变）；admin memories 搜索去掉硬编 cyrene
- Docs/api-client v0.42；**两处有意的行为收紧**已写明：POST /sessions body 非法 JSON → 400（原先完全忽略 body；空/null/{} 仍 201）；POST /admin/memories/search 省略 personaId 且无默认角色 → 400（原先默认查 cyrene）
- 测试：design/22 §5 验收 1-6（记忆隔离/提示词首条 system/情绪按角色/提取 persona 归属/迁移兼容）+ 进程内 e2e（断言 adapter 收到的 model.Request.Messages[0] 即该角色的 systemPrompt）
- **已知未做（留批次 2 / 待确认）**：① IM 与渠道级未做 → **§7-3「owner 私聊镜像随主会话角色」尚未生效**；② 请求级覆盖未实现（本批只做会话级）；③ **§7-5 的「上下文发送角色标记」只完成存储+DTO 半边**——消息 persona 已落库且 DTO 已带，但模型上下文不从 chat_messages 重建，「第 N 条是谁说的」尚未进上下文（需确认是否属批次 2）；④「切角色重建摘要」当前是空操作（压缩未接线）；⑤ thinking 旋钮仅在流式路径生效（非流式 agent.RunStep 不带，A 批次既有性质）
- 验收：go build/vet/test 全绿 + linux/amd64 与 darwin/arm64 交叉编译（既有 flake 本轮未触发；同批 session_orchestrator.go 一度 501 行 → 抽出 session_tail.go）

internal/db/migrate_session_persona_test.go

@@ -0,0 +1,84 @@
+package db
+
+import (
+	"context"
+	"testing"
+)
+
+// TestMigrate0011SessionPersonaColumn covers design/22 acceptance 6: after upgrading a
+// database that only has the 0010 schema, both new columns exist with the ''
+// default, and every pre-existing row reads back as unbound — '' means "inherit the
+// global default role", so no backfill is needed and the old behavior is preserved.
+// It also locks the down migration (both columns dropped) and the idempotent re-up.
+func TestMigrate0011SessionPersonaColumn(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	conn := openMemory(t)
+
+	if err := MigrateUp(ctx, conn, testLogger()); err != nil {
+		t.Fatalf("MigrateUp: %v", err)
+	}
+	for _, col := range []struct{ table, column string }{
+		{"chat_sessions", "persona_id"},
+		{"chat_messages", "persona_id"},
+	} {
+		if !columnExists(t, ctx, conn, col.table, col.column) {
+			t.Fatalf("%s.%s should exist after MigrateUp", col.table, col.column)
+		}
+	}
+
+	// A row written before 0011 was added (here: written without the column, exactly
+	// what the ALTER's DEFAULT produces) must read back as the inherit-the-default
+	// value, and a legacy session must still be usable by the store.
+	legacySession := `INSERT INTO chat_sessions (id, type, title, pinned, created_at) VALUES ('web:legacy', 'sub', '', 0, 100)`
+	if _, err := conn.ExecContext(ctx, legacySession); err != nil {
+		t.Fatalf("insert legacy session: %v", err)
+	}
+	legacyMessage := `INSERT INTO chat_messages (id, session_id, role, content, created_at) VALUES ('m1', 'web:legacy', 'user', 'hi', 200)`
+	if _, err := conn.ExecContext(ctx, legacyMessage); err != nil {
+		t.Fatalf("insert legacy message: %v", err)
+	}
+	var sessionPersona, messagePersona string
+	if err := conn.QueryRowContext(ctx, `SELECT persona_id FROM chat_sessions WHERE id = 'web:legacy'`).Scan(&sessionPersona); err != nil {
+		t.Fatalf("read legacy session persona: %v", err)
+	}
+	if err := conn.QueryRowContext(ctx, `SELECT persona_id FROM chat_messages WHERE id = 'm1'`).Scan(&messagePersona); err != nil {
+		t.Fatalf("read legacy message persona: %v", err)
+	}
+	if sessionPersona != "" || messagePersona != "" {
+		t.Fatalf("legacy rows persona_id = (%q, %q), want ('', '') — inherit the global default", sessionPersona, messagePersona)
+	}
+
+	// Up twice: the recorded migration is skipped and nothing errors.
+	if err := MigrateUp(ctx, conn, testLogger()); err != nil {
+		t.Fatalf("MigrateUp second call: %v", err)
+	}
+
+	// Roll back everything newer than 0010 (0011 itself plus any future migration),
+	// so this test keeps validating the 0011 down no matter how the repo grows.
+	steps := len(upMigrationIDs(t)) - 10
+	if err := MigrateDown(ctx, conn, steps, testLogger()); err != nil {
+		t.Fatalf("MigrateDown(%d): %v", steps, err)
+	}
+	for _, col := range []struct{ table, column string }{
+		{"chat_sessions", "persona_id"},
+		{"chat_messages", "persona_id"},
+	} {
+		if columnExists(t, ctx, conn, col.table, col.column) {
+			t.Fatalf("%s.%s should be dropped by the 0011 down", col.table, col.column)
+		}
+	}
+
+	// Re-applying restores both columns.
+	if err := MigrateUp(ctx, conn, testLogger()); err != nil {
+		t.Fatalf("re-MigrateUp: %v", err)
+	}
+	for _, col := range []struct{ table, column string }{
+		{"chat_sessions", "persona_id"},
+		{"chat_messages", "persona_id"},
+	} {
+		if !columnExists(t, ctx, conn, col.table, col.column) {
+			t.Fatalf("%s.%s should exist again after re-MigrateUp", col.table, col.column)
+		}
+	}
+}

internal/db/migrate_test.go

@@ -175,9 +175,11 @@ func TestMigrateDown_StepsBeyondApplied_边界(t *testing.T) {
 		t.Fatalf("MigrateUp: %v", err)
 	}
 
-	// More steps than applied must roll everything back without error.
-	if err := MigrateDown(ctx, db, 10, testLogger()); err != nil {
-		t.Fatalf("MigrateDown(10): %v", err)
+	// More steps than applied must roll everything back without error. The count is
+	// derived from the embedded migration set rather than hardcoded, so adding a
+	// migration cannot silently leave the oldest one applied.
+	if err := MigrateDown(ctx, db, len(upMigrationIDs(t))+1, testLogger()); err != nil {
+		t.Fatalf("MigrateDown(all+1): %v", err)
 	}
 	if appMetaExists(t, ctx, db) {
 		t.Fatal("app_meta should be dropped when rolling back all")

internal/db/migrations/0011_session_persona.down.sql

@@ -0,0 +1,11 @@
+-- 0011_session_persona down: drop the role-binding columns added by the up
+-- migration. SQLite DROP COLUMN (3.35+) is already relied on by 0006/0007/0009/0010,
+-- and neither column is referenced by an index, view or constraint, so a plain drop
+-- is safe. The rolled-back state is the pre-multi-character one: a session belongs
+-- to no explicit role and every row resolves to the global default role
+-- (persona_id = '' is itself the "inherit the default" value, so the dropped data
+-- only ever held explicit non-default bindings — the code was the only consumer).
+
+ALTER TABLE chat_messages DROP COLUMN persona_id;
+
+ALTER TABLE chat_sessions DROP COLUMN persona_id;

internal/db/migrations/0011_session_persona.up.sql

@@ -0,0 +1,33 @@
+-- 0011_session_persona: per-session role binding + per-message authoring role
+-- (DevDocs/design/22 多角色并存 + 按会话选角 §4.1 / §7-5, 批次 1).
+--
+-- chat_sessions.persona_id: which role a conversation belongs to. It is the
+-- single source of truth for "this session is Cyrene / this session is Y"
+-- (design/22 §2: session-level wins, channel-level only seeds a new session,
+-- request-level is a temporary override that is never persisted).
+--
+-- chat_messages.persona_id: the role that SPOKE a message, so the context and
+-- the UI can tell "who said the Nth turn" after a session switched roles
+-- (design/22 §7-5: switching keeps the context, so each message must carry its
+-- authoring role).
+--
+-- '' means "inherit the current global default role" (owner.yaml:defaultPersona).
+-- That is why NO backfill is needed: every pre-existing session and message keeps
+-- persona_id = '' and therefore keeps resolving to the default role, i.e. the
+-- pre-multi-character behavior is byte-for-byte unchanged (design/22 §4.7), and
+-- changing owner.yaml:defaultPersona still moves those rows (design/22 §7-6).
+--
+-- The 0003 chat_sessions / chat_messages tables already exist at this point, so
+-- ALTER ADD COLUMN is the correct, non-destructive step. The canonical schema
+-- (including these columns) is also re-issued idempotently by
+-- internal/runtime/history.NewStore so a fresh in-memory store used by tests stays
+-- self-contained; the migration is the authoritative path for an existing
+-- database.
+--
+-- No index is added: persona_id is never a query predicate on the hot paths
+-- (sessions are read by primary key, messages by session_id + created_at, which
+-- idx_chat_msgs_session_created already covers). It is read as a column only.
+
+ALTER TABLE chat_sessions ADD COLUMN persona_id TEXT NOT NULL DEFAULT '';
+
+ALTER TABLE chat_messages ADD COLUMN persona_id TEXT NOT NULL DEFAULT '';