@sema-agent/server 7.43.0 → 7.44.0

package/dist/plugins/tidb-session-store.js

@@ -1,34 +1,14 @@
-/**
- * TiDB-backed Session event-log center (L1) — the durable "persistence center".
- *
- * Implements core's `SessionStore`. `acquire` rebuilds a session from its append-only event log
- * (= wake/resume), so any stateless runner instance can continue it. Cross-instance write safety is
- * enforced by the storage layer's compare-and-set (core's F2 seam); crash consistency (orphan
- * tool-call after a mid-turn crash) is handled by the Runner calling `reconcileInterruptedSession`
- * on acquire (core's F1).
- *
- * Persistence only. **Tenant authorization (who may wake which session) lives in the service layer**
- * (`src/security.ts`), which uses `ownerOf` / `register` below. The store does not infer identity.
- */
-// 🔴 core 1.403 迁移(2026-07-25):runtime 构造用法,`Session` → `StoredSession`(见 audit.ts 同款注释)。
 import { StoredSession, SessionError, uuidv7, validateEntriesForImport, leafIdAfterEntry } from "@sema-agent/core";
 import { TiDBSessionStorage } from "./tidb-session-storage.js";
 import { escapeLike } from "./sql-escape.js";
 import { MANAGED_RETENTION } from "./retention-store-sql.js";
 import { contentForkRelation, fastForwardSharedContentDiverged } from "../session-sync-content.js";
 import { assertPlacementAdmission, LIST_PLACED_BATCH, PLACEMENT_SELECT_COLUMNS, placedRowFromRow, placementFromRow, placementInsertValues, SQL_SESSION_PLACEMENTS, } from "./session-placement.js";
-import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, STAGING_GC_GRACE_MS, // 两孪生店同源(理由见 kernel 处顶注:同值双抄单边改值 ⇒ 两后端 GC 判定分家)
- } from "../session-sync-kernel.js";
+import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, STAGING_GC_GRACE_MS, } from "../session-sync-kernel.js";
 export class TiDBSessionStore {
     pool;
-    /** #270 车1:托管留存声明。读法与「为什么 SQL 店答 managed 而实现体在别处」逐字见
-     *  `retention-store-sql.ts` 的 {@link MANAGED_RETENTION}。 */
     retention = MANAGED_RETENTION;
-    /** #292 C18(core 5.48.0 design/323):placement **声明**。六条义务的实装点逐条见
-     *  {@link SQL_SESSION_PLACEMENTS} 顶注与本类的 acquire / listSessions / release / listPlaced /
-     *  placementOf 各处的 `#292` 注。 */
     placements = SQL_SESSION_PLACEMENTS;
-    /** In-flight acquisitions keyed by id, so concurrent acquire(sameId) in one process share one. */
     pending = new Map();
     constructor(pool) {
         this.pool = pool;
@@ -36,18 +16,11 @@ export class TiDBSessionStore {
     async acquire(sessionId, opts) {
         if (!sessionId) {
             const id = uuidv7();
-            // #292 义务:placement 与行**同一条 INSERT** 落库(创建时一次落行,first-write 不可变)。
             await this.register(id, null, opts?.placement);
             return this.load(id, false, opts);
         }
-        // design/114 Phase3 (F1): a `requireExisting` acquire NEVER creates and can REJECT (not_found) — it MUST bypass
-        // the shared create-dedup `pending`, else a concurrent create-capable waiter awaiting that same promise would
-        // inherit the not_found rejection instead of creating-on-miss. Two concurrent requireExisting opens each just
-        // wake independently (both resolve or both fail loud) — harmless (it only opens, never double-creates).
         if (opts?.requireExisting)
             return this.load(sessionId, true, opts);
-        // #292:准入判据**按调用方逐一判**(core `TtlSessionStore` 的同款纪律)——共享的 in-flight promise
-        // 只共享「会话被唤醒」这件事,绝不让一个 claim 形等待者继承可信创建方的准入,或反过来。
         const inflight = this.pending.get(sessionId);
         if (inflight) {
             const acquired = await inflight;
@@ -61,55 +34,29 @@ export class TiDBSessionStore {
     async load(sessionId, requireExisting = false, opts) {
         let storage = await TiDBSessionStorage.wake(this.pool, sessionId);
         if (storage) {
-            // #292 义务 6(claim 关门)+ 镜像方向:判据吃的是**已持久化**的元组(wake 顺路带回,零额外往返)。
             assertPlacementAdmission(sessionId, (await storage.getMetadata()).placement, opts);
             return { session: new StoredSession(storage), sessionId };
         }
-        // design/114 Phase3: `requireExisting` ⇒ FAIL LOUD on a genuinely missing session (no session_meta row),
-        // never the silent create-on-miss that turns a reuse-style warm-resume into a fresh empty run. core's
-        // prepare-task maps this store `not_found` to the caller-facing `resume.session_not_found`.
         if (requireExisting)
             throw new SessionError("not_found", `session ${sessionId} not found`);
-        // No meta row yet (a caller-chosen brand-new id the service didn't pre-register). Create it
-        // ownerless; only the caller who chose this id can reach it, and it holds no prior data.
         await this.register(sessionId, null, opts?.placement);
         storage = await TiDBSessionStorage.wake(this.pool, sessionId);
-        // 刚 register 完却唤不醒 = 有人在这两步之间把行删了(带外 purge / 留存腿)。旧形在这里是一个
-        // `storage!` 非空断言,真撞上时炸成一条无信息的 `TypeError: reading 'getMetadata' of null`
-        // (本批实测撞到过一次:邻车在同一测试库上整表 DELETE)。改成响亮且**说得出发生了什么**的错。
         if (!storage) {
             throw new SessionError("storage", `session ${sessionId} vanished between register and wake (a concurrent purge won the race) — retry`);
         }
-        // #292 镜像方向(pre-claim squat):带 placement 的创建必须**回读**到持久化的同组元组——并发的
-        // claim 形若抢先建出普通行,我们的 INSERT 是 no-op,回读即缺席 ⇒ 响亮拒(不是静默降级成普通会话)。
         assertPlacementAdmission(sessionId, (await storage.getMetadata()).placement, opts);
         return { session: new StoredSession(storage), sessionId };
     }
-    /** Idempotently create a session_meta row with an owner. Existing owner is never overwritten.
-     *  #292:`placement` 在场时与行同一条 INSERT 落六列;ON DUPLICATE 臂是 no-op ⇒ 已存在的行的元组
-     *  **永不被重写**(first-write 不可变,义务 5 的写侧半场)。 */
     async register(sessionId, owner, placement) {
         const now = new Date();
         await this.pool.query("INSERT INTO session_meta (session_id, owner, created_at, updated_at, leaf_id, leaf_seq, " +
             "placement_kind, placement_scope, placement_parent_session_id, placement_root_session_id, placement_handle, placed_at) " +
             "VALUES (?,?,?,?,NULL,0,?,?,?,?,?,?) ON DUPLICATE KEY UPDATE session_id = session_id", [sessionId, owner, now, now, ...placementInsertValues(placement, now)]);
     }
-    /**
-     * #292 义务 6 的廉价探针 —— 一行 PK SELECT:`undefined` = 普通会话或无此行。
-     * (release 的冷缓存腿、包装店的暖命中准入判、诊断面共用这一只。)
-     */
     async placementOf(sessionId) {
         const [rows] = await this.pool.query(`SELECT ${PLACEMENT_SELECT_COLUMNS} FROM session_meta WHERE session_id = ?`, [sessionId]);
         return placementFromRow(rows[0]);
     }
-    /**
-     * #292 义务 5 —— placed 分区的**自有枚举**(联合 reap 的分区腿输入)。
-     *
-     * 年龄锚 = `COALESCE(updated_at, placed_at)`:`updated_at` 是本店的「最后活动」标记(register 时置、
-     * 每次 append/touch 推进),取不到才回落 `placed_at` —— 与 core File 店「mtime 优先、placedAt 回落」
-     * 的读法同义。行按年龄升序、上界 {@link LIST_PLACED_BATCH}(理由见那里)。
-     * join 半缺(scope/handle 任一为 NULL)⇒ `tupleIncomplete` 诚实变体,消费方对它 fail-closed。
-     */
     async listPlaced(kind, opts) {
         const params = [kind];
         let sql = `SELECT session_id, updated_at, ${PLACEMENT_SELECT_COLUMNS} FROM session_meta WHERE placement_kind = ?`;
@@ -126,7 +73,6 @@ export class TiDBSessionStore {
         const [rows] = await this.pool.query(sql, params);
         return rows.map((r) => placedRowFromRow(String(r.session_id), r, r.updated_at instanceof Date ? r.updated_at.getTime() : undefined));
     }
-    /** Owner principal of a session, `null` if registered ownerless, `undefined` if no such session. */
     async ownerOf(sessionId) {
         const [rows] = await this.pool.query("SELECT owner FROM session_meta WHERE session_id = ?", [sessionId]);
         if (rows.length === 0)
@@ -139,51 +85,26 @@ export class TiDBSessionStore {
             sessionId,
         ]);
     }
-    /** E18 — the session's current leaf `SessionTreeEntry.id` (`session_meta.leaf_id`, set transactionally on every
-     *  persist). A single SELECT, NO acquire/lock/CAS — safe to call mid-run (write-safety is the append-time CAS, not
-     *  an acquire lease) and cache-bypassing (the resume-at turn-capture reads it without touching the warm session).
-     *  Returns the leaf id, or null when the session has none / no such session. */
     async getLeafId(sessionId) {
         const [rows] = await this.pool.query("SELECT leaf_id FROM session_meta WHERE session_id = ?", [sessionId]);
         return rows[0] ? (rows[0].leaf_id ?? null) : null;
     }
-    /** [1196] 六轮复审:owner+leafId **单行原子快照**(SSE watch 探针的租户围栏读)——两独立 SELECT 在
-     *  delete/reclaim 缝里可拼出「旧 owner+新 leaf」混世代组合;单 SELECT 单行=天然一致。undefined=无此会话。 */
     async getHead(sessionId) {
         const [rows] = await this.pool.query("SELECT owner, leaf_id FROM session_meta WHERE session_id = ?", [sessionId]);
         if (rows.length === 0)
             return undefined;
         return { owner: rows[0].owner ?? null, leafId: rows[0].leaf_id ?? null };
     }
-    /**
-     * Durable history is retained; just drop any in-flight cache entry.
-     *
-     * 🔴 #292 义务 4 —— **placed 会话例外:release 是真删除**(durable 史一并)。联合 reap 先按 rev 条件删
-     * 掉 agent 行、赢了才调本方法终结转录;若这里还按「归还租约」走,一条 30 天的转录就会失去属主行地
-     * 悬着(正是这条义务要关死的 strand)。判据取**持久化元组**(冷缓存/重启后照样成立,不依赖任何进程
-     * 内状态);删除本身是 ABA 安全的**条件删**(`placement_kind IS NOT NULL`)——探针与删除之间若真有
-     * 「行被删掉又以同 id 重建成普通会话」的世代翻转,条件删当场落空,不会误杀那只无辜的新会话。
-     * 删除失败**响亮上浮**(`SessionError("storage")`):吞掉失败等于让 reap 数一条「已终结」而字节还在
-     * (core File 店同批的 rmSync 失败上浮是同一条法)。
-     */
     async release(sessionId) {
         this.pending.delete(sessionId);
         const placed = await this.placementOf(sessionId);
         if (placed === undefined)
-            return; // 普通会话:acquire/release 语义逐字节不变(义务 3)
+            return;
         await this.deletePlacedSession(sessionId);
     }
-    /**
-     * core B-17 的 `forget` 面 —— **丢引用,不动 durable 史**(与 {@link release} 的分工:release 是
-     * 生命周期终结口,forget 是「我用完了这只句柄」)。#292 之后这条分工是承重的:release 对 placed
-     * 会话已是真删除,于是每一处「只为验存在 / 写完收工」的收尾都必须落在 forget 上(preflight 纪律,
-     * [4743] 义务①)。本店的进程内状态只有 in-flight 去重表,故实现就是丢那一格。
-     */
     forget(sessionId) {
         this.pending.delete(sessionId);
     }
-    /** 真删除一只 placed 会话的两张表(条件删门在 `placement_kind IS NOT NULL`;事务内 meta 先删=提交点,
-     *  与 {@link deleteSession} 同序)。任何 I/O 失败上浮成 `SessionError("storage")`,绝不吞。 */
     async deletePlacedSession(sessionId) {
         const conn = await this.pool.getConnection();
         try {
@@ -198,7 +119,6 @@ export class TiDBSessionStore {
                 await conn.rollback();
             }
             catch {
-                /* ignore */
             }
             throw err instanceof SessionError
                 ? err
@@ -208,58 +128,26 @@ export class TiDBSessionStore {
             conn.release();
         }
     }
-    // ───────────────────────── SessionRepo seam (§0.5 session-ownership) ─────────────────────────
-    // E16/E17/E21: the service EXTENDS core's `SessionRepo` (list/fork/delete) over its OWN session_meta /
-    // session_event tables — a `TiDBSessionRepo`-style implementation (core's `PgSessionRepo` targets core's
-    // own `agent_*` tables, so it can't be consumed directly; the dossier §0.5 prescribes a backend-mirrored
-    // impl here). Enumeration + lifecycle now come from the SESSION abstraction (session identity), not the
-    // `task_run` runs ledger; `task_run` retreats to a pure runs ledger that only SUPPLIES run-level preview.
-    /**
-     * E16 — list the caller's sessions (CC /resume picker), keyset-paginated newest-first by last activity.
-     * Session IDENTITY/enumeration comes from `session_meta` (owner-filtered on the service's OWN owner column);
-     * a LEFT JOIN onto the `task_run` runs ledger supplies run-level PREVIEW (latest run's objective/status,
-     * run count) but never gates which sessions exist — a session with zero runs still lists (preview null/0).
-     * Keyset on `(updated_at, session_id)`; `updated_at` is the session's last-activity marker (touch on every
-     * run/append). The shipped {@link SessionSummary} shape is preserved (additive): `lastActivityAt` =
-     * `session_meta.updated_at`, `firstActivityAt` = `session_meta.created_at`.
-     */
     async listSessions(opts) {
         const params = [];
-        // 🔴 #292 义务 2:placed 会话**永不上宿主枚举面**——壳的 /resume 选择器不许把一条子代转录当成可
-        // 续聊的会话摆出来(而且它一旦被选中,claim 形 acquire 还会当场拒)。谓词打在**持久化列**上 ⇒
-        // 重启后照样成立(义务的「restart-stable」一半)。
         const where = ["sm.placement_kind IS NULL"];
         if (opts.owner) {
-            // [4198] 窄互认第二臂的第三条件在此:`includeUnowned` 时谓词放宽到「本人的 ∪ 无主的」。
-            // 仍然**不是** `owner IS NOT DISTINCT FROM ?`——具名的别人一行都不多给。
-            where.push(opts.includeUnowned ? "(sm.owner = ? OR sm.owner IS NULL)" : "sm.owner = ?"); // idx_owner
+            where.push(opts.includeUnowned ? "(sm.owner = ? OR sm.owner IS NULL)" : "sm.owner = ?");
             params.push(opts.owner);
         }
         if (opts.q) {
-            // `?q=` search: match sessions where ANY run's objective preview contains q (EXISTS on the
-            // runs ledger — better recall than latest-run-only, still session-granular). LOWER-LIKE = collation-proof
-            // case-insensitivity (TiDB table collation may be _bin); escapeLike + ESCAPE pins the wildcard semantics
-            // (deployment baseline: default sql_mode — under NO_BACKSLASH_ESCAPES the '\\' literal would break, a
-            // known escapeLike-family boundary shared with the tool-result store).
-            // No tr.owner predicate BY DESIGN: the outer WHERE already proves the session is the caller's;
-            // a same-session_id foreign-owner run requires DB write access to fabricate (session_meta PK + uuidv7),
-            // and an owner predicate would drop the LEGITIMATE mixed-owner form (anonymous run → principal attach,
-            // the E21 diverged-owner case) — recall loss for a 1-bit defense against an attacker who can already write.
             where.push("EXISTS (SELECT 1 FROM task_run tr WHERE tr.session_id = sm.session_id AND LOWER(tr.objective_preview) LIKE LOWER(?) ESCAPE '\\\\')");
             params.push(`%${escapeLike(opts.q)}%`);
         }
         if (opts.cursor) {
-            where.push("(sm.updated_at < ? OR (sm.updated_at = ? AND sm.session_id < ?))"); // keyset: strictly older, ties by id
+            where.push("(sm.updated_at < ? OR (sm.updated_at = ? AND sm.session_id < ?))");
             params.push(new Date(opts.cursor.lastActivityAt), new Date(opts.cursor.lastActivityAt), opts.cursor.sessionId);
         }
-        // The run-preview JOIN: the LATEST run per session (rn=1, ties broken by task_id so EXACTLY one row joins —
-        // a bare MAX(created_at) JOIN would fan out the outer row when two runs share a created_at) + a count rollup.
-        // A LEFT JOIN keeps sessions with NO runs (preview NULL, run_count 0). Bounded by per-tenant data today.
         const sql = "SELECT sm.session_id, sm.owner, sm.updated_at AS last_activity, sm.created_at AS first_activity, sm.title, " +
             "  COALESCE(r.run_count, 0) AS run_count, latest.objective_preview, latest.status, latest.task_id AS last_run_id " +
             "FROM session_meta sm " +
             "LEFT JOIN (SELECT session_id, COUNT(*) AS run_count FROM task_run GROUP BY session_id) r ON r.session_id = sm.session_id " +
-            "LEFT JOIN (SELECT session_id, objective_preview, status, task_id FROM (" + // K-5c: carry the rn=1 run's task_id
+            "LEFT JOIN (SELECT session_id, objective_preview, status, task_id FROM (" +
             "    SELECT session_id, objective_preview, status, task_id, " +
             "      ROW_NUMBER() OVER (PARTITION BY session_id ORDER BY created_at DESC, task_id DESC) AS rn FROM task_run" +
             "  ) lr WHERE rn = 1) latest ON latest.session_id = sm.session_id " +
@@ -275,55 +163,33 @@ export class TiDBSessionStore {
             runCount: Number(r.run_count),
             objectivePreview: r.objective_preview ?? null,
             lastStatus: r.status == null ? "" : String(r.status),
-            lastRunId: r.last_run_id ?? null, // K-5c: latest run id = the live-tail re-attach anchor (null if no runs)
-            title: r.title ?? null, // auto-generated title (null = not yet titled)
+            lastRunId: r.last_run_id ?? null,
+            title: r.title ?? null,
         }));
     }
-    /** Cheap pre-LLM probe: "none" = session_meta row not yet REGISTERED (createRun fires
-     *  before the Runner's session acquire — the titler retries), "untitled" / "titled" as read. */
     async probeTitle(sessionId) {
         const [rows] = await this.pool.query("SELECT title FROM session_meta WHERE session_id = ?", [sessionId]);
         if (!rows[0])
             return "none";
         return rows[0].title == null ? "untitled" : "titled";
     }
-    /** Write-once auto-title: lands ONLY when title IS NULL (a concurrent/prior title wins;
-     *  the user-facing rename layer is BFF-side). Returns whether this call set it. */
     async setTitleIfNull(sessionId, title) {
         const [r] = await this.pool.query("UPDATE session_meta SET title = ? WHERE session_id = ? AND title IS NULL", [title, sessionId]);
         return r.affectedRows > 0;
     }
-    /**
-     * E17 — fork a session: copy its WHOLE durable history to a NEW uuidv7 session owned by `owner`, mirroring
-     * core's `PgSessionRepo.fork`. Entry ids / parent links are per-session and copy VERBATIM; only `seq` is
-     * re-densified from 0 in the new session. The new leaf = the source leaf (session_meta.leaf_id).
-     * Returns the new sessionId, or null if the source does not exist (the route maps that to 404).
-     *
-     * 🔴 FULL history, NOT `wake().getEntries()` (adversarial-review MEDIUM): `wake` loads only the bounded tail
-     * `[floor..leaf]` from the latest compaction floor (F3), so forking via it would copy only the active tail of a
-     * COMPACTED session and SILENTLY LOSE all pre-compaction history (contradicting the whole-history-copy intent).
-     * We instead SELECT the entire `session_event` log ordered by seq — every durable entry, compaction floor
-     * bypassed — and re-seq it dense from 0 into the new session, ids/parents/payload byte-verbatim.
-     */
     async fork(sourceId, owner) {
-        // The source's authoritative leaf (and existence check) come from session_meta — null meta ⇒ unknown source.
         const [metaRows] = await this.pool.query("SELECT leaf_id FROM session_meta WHERE session_id = ?", [sourceId]);
         if (!metaRows[0])
             return null;
         const leafId = metaRows[0].leaf_id ?? null;
-        // FULL durable history (compaction floor bypassed) — every entry, oldest first. payload is the stored entry blob.
         const [eventRows] = await this.pool.query("SELECT entry_id, parent_id, type, payload, ts FROM session_event WHERE session_id = ? ORDER BY seq ASC", [sourceId]);
         const newId = uuidv7();
         const now = new Date();
         const conn = await this.pool.getConnection();
         try {
             await conn.beginTransaction();
-            // Entries land BEFORE the session_meta row (mirrors core BUG-1): the meta row is the commit point —
-            // a mid-fork failure leaves orphan events with NO meta row (invisible to wake), never a half-session.
             for (let seq = 0; seq < eventRows.length; seq++) {
                 const r = eventRows[seq];
-                // Copy the payload blob VERBATIM (string or already-parsed object); re-stringify only an object so the
-                // INSERT binds a JSON string. entry_id/parent_id/type/ts are carried over unchanged; only seq is re-densified.
                 const payload = typeof r.payload === "string" ? r.payload : JSON.stringify(r.payload);
                 await conn.query("INSERT INTO session_event (session_id, seq, entry_id, parent_id, type, payload, ts) VALUES (?,?,?,?,?,?,?)", [newId, seq, r.entry_id, r.parent_id ?? null, r.type, payload, r.ts]);
             }
@@ -336,7 +202,6 @@ export class TiDBSessionStore {
                 await conn.rollback();
             }
             catch {
-                /* ignore */
             }
             throw err instanceof SessionError ? err : new SessionError("storage", `fork of session ${sourceId} failed`, err instanceof Error ? err : undefined);
         }
@@ -344,100 +209,46 @@ export class TiDBSessionStore {
             conn.release();
         }
     }
-    /**
-     * 2c session-sync — EXPORT a session's full durable entry log for cross-backend migration. This is the
-     * READ half of {@link fork}, surfaced as the core `SessionRepo.exportEntries` seam: the WHOLE `session_event` log,
-     * oldest-first, ids/parents/payload/ts VERBATIM, with the compaction floor BYPASSED (NOT `wake().getEntries()`,
-     * which returns only the bounded `[floor..leaf]` tail and would silently truncate pre-floor history — see fork's
-     * note at :149-152). Returns `null` if the source does not exist (no `session_meta` row), mirroring fork's null
-     * semantics; an existing-but-empty session returns `[]`. The owner is NOT exported — import re-stamps it (§9).
-     */
     async exportEntries(sessionId) {
-        // Existence check = session_meta (a session with zero events but a meta row is a real, empty session ⇒ []).
         const [metaRows] = await this.pool.query("SELECT 1 FROM session_meta WHERE session_id = ?", [sessionId]);
         if (!metaRows[0])
             return null;
-        // FULL durable log (compaction floor bypassed) — every entry, oldest first. payload is the stored entry blob.
         const [eventRows] = await this.pool.query("SELECT entry_id, parent_id, type, payload, ts FROM session_event WHERE session_id = ? ORDER BY seq ASC", [sessionId]);
-        // The export contract is `SessionTreeEntry[]` (the full entry blob), not the column projection. The stored
-        // `payload` IS the verbatim entry (id/parentId/timestamp + variant fields) — parse a string blob, pass an
-        // already-parsed object (mysql2 returns JSON columns parsed) through.
         return eventRows.map((r) => (typeof r.payload === "string" ? JSON.parse(r.payload) : r.payload));
     }
-    /**
-     * 2c session-sync P1d-α (PULL streaming) — the IDS-ONLY projection of {@link exportEntries}: the entry ids of the
-     * WHOLE durable log, oldest-first (`SELECT entry_id … ORDER BY seq ASC`), with no payloads. Small even for a huge
-     * session, so the PULL `GET /sync/manifest` can carry it (and feed it to `classifySyncRelationshipByIds`) instead of
-     * the entries. Returns `null` if the source does not exist (no `session_meta` row), mirroring {@link exportEntries}.
-     */
     async listEntryIds(sessionId) {
         const [metaRows] = await this.pool.query("SELECT 1 FROM session_meta WHERE session_id = ?", [sessionId]);
         if (!metaRows[0])
-            return null; // no such session (mirror exportEntries' null)
+            return null;
         const [rows] = await this.pool.query("SELECT entry_id FROM session_event WHERE session_id = ? ORDER BY seq ASC", [sessionId]);
         return rows.map((r) => String(r.entry_id));
     }
-    /**
-     * 2c session-sync P1d-α (PULL streaming) — STREAM the WHOLE durable log (compaction floor bypassed), oldest-first,
-     * as an async generator that KEYSET-PAGES the `session_event` table: mysql2 buffers a plain SELECT, so a 1M-row
-     * session would OOM if read in one shot. Instead the generator loops `… WHERE seq > cursor ORDER BY seq ASC LIMIT K`
-     * (K = `opts.batchSize ?? 500`), advancing the cursor to the last `seq` of each batch, until a SHORT page (fewer than
-     * K rows) ends the stream. Each batch is its OWN `pool.query` (a pooled connection acquired + released per batch), so
-     * a slow NDJSON consumer can NEVER pin one connection across the whole stream (the clay-mandated concurrency
-     * discipline). Start cursor = `opts.afterSeq ?? -1` (seq is 0-based dense, so `> -1` = from seq 0).
-     *
-     * Resolves to `null` (NOT an empty async-iterable) when the session does not exist — checked via `session_meta`
-     * EAGERLY here (before returning the iterable), exactly like {@link exportEntries}, so a missing session is distinct
-     * from a real-but-empty one (an empty stream). payload is parsed like {@link exportEntries} (string → JSON.parse,
-     * object passthrough). The check is eager (the method is async) because a generator body is lazy — it can't decide
-     * `null` vs. iterable on its own first pull.
-     */
     async exportEntriesStream(sessionId, opts) {
         const [metaRows] = await this.pool.query("SELECT 1 FROM session_meta WHERE session_id = ?", [sessionId]);
         if (!metaRows[0])
-            return null; // no such session (mirror exportEntries' null) — NOT an empty iterable
+            return null;
         const pool = this.pool;
         const batchSize = opts?.batchSize ?? 500;
         async function* gen() {
-            let cursor = opts?.afterSeq ?? -1; // seq is 0-based dense → > -1 starts at seq 0
+            let cursor = opts?.afterSeq ?? -1;
             for (;;) {
-                // ONE pooled query per batch (NOT a held connection across the whole stream) — keyset on (session_id, seq).
                 const [rows] = await pool.query("SELECT seq, payload FROM session_event WHERE session_id = ? AND seq > ? ORDER BY seq ASC LIMIT ?", [sessionId, cursor, batchSize]);
                 for (const r of rows) {
                     const p = r.payload;
                     yield (typeof p === "string" ? JSON.parse(p) : p);
                 }
                 if (rows.length < batchSize)
-                    return; // short page = end of log (no further round-trip)
-                cursor = Number(rows[rows.length - 1].seq); // advance the keyset cursor to the last seq seen
+                    return;
+                cursor = Number(rows[rows.length - 1].seq);
             }
         }
         return gen();
     }
-    /**
-     * 2c session-sync — IMPORT a verbatim entry log (from another backend's {@link exportEntries}) into a
-     * (typically NEW) `sessionId`. This is the WRITE half of {@link fork}, surfaced as `SessionRepo.importEntries`,
-     * with two 2c-mandated differences from fork:
-     *   (a) OWNER RE-STAMP (§9): `owner` is the AUTHENTICATED importing principal passed by the caller; the bundle's
-     *       own owner is NEVER trusted (a local push is always owner=null → would become an ownerless cloud session
-     *       any anonymous caller could attach to). Mirrors the fork route's server-side `scope.gateOwner`.
-     *   (b) the single INVARIANT GATE is core's {@link validateEntriesForImport} (unique ids / parent-before-child /
-     *       exactly-one-root / leaf-resolvable / structural refs present) — we persist its VERBATIM output and do NOT
-     *       re-implement any of those checks in SQL ([[core-service-boundary]]; the same discipline fork's hand-SQL
-     *       was warned about). A violation throws `SessionError("invalid_session")` and NOTHING is written.
-     * The write itself mirrors fork: re-seq dense from 0, entry_id/parent_id/payload/ts verbatim, in ONE txn with
-     * `session_meta` LAST as the commit point (a mid-import crash leaves orphan events with no meta = invisible to
-     * wake, never a half-session). The leaf is the replayed leaf (core's `leafIdAfterEntry`), matching core's import.
-     */
     async importEntries(sessionId, owner, entries) {
-        // Fail-CLOSED invariant gate FIRST (before any write) — returns the entries verbatim or throws invalid_session.
         const validated = validateEntriesForImport(entries);
         const conn = await this.pool.getConnection();
         try {
             await conn.beginTransaction();
-            // The shared insert body (entries re-seq dense from 0, then session_meta LAST as the commit point). A plain
-            // INSERT — assumes a FRESH sessionId; a duplicate (session already present) crashes on the PK. replaceEntries
-            // is the idempotent-over-existing path (it DELETEs first inside the same txn).
             await this.insertValidatedLog(conn, sessionId, owner, validated);
             await conn.commit();
         }
@@ -446,50 +257,28 @@ export class TiDBSessionStore {
                 await conn.rollback();
             }
             catch {
-                /* ignore */
             }
             if (err instanceof SessionError)
-                throw err; // invalid_session (gate) / conflict — pass through
+                throw err;
             throw new SessionError("storage", `import of session ${sessionId} failed`, err instanceof Error ? err : undefined);
         }
         finally {
             conn.release();
         }
     }
-    /**
-     * 2c session-sync (§7/§8) — IDEMPOTENT REPLACE: purge any existing conversation log for `sessionId` then re-import
-     * `entries` verbatim under `owner`, ALL in ONE txn. Unlike {@link importEntries} (a plain INSERT that crashes on a
-     * duplicate PK when the session already exists at the destination), replace is safe to run OVER an existing session
-     * — the §7 fast-forward path and a §8 retry-to-completion both land on it. The validate gate runs FIRST (fail-closed,
-     * before any write), then DELETE events + the OWNER-GUARDED meta delete (defense-in-depth, mirrors {@link deleteSession}
-     * — a wrong-owner caller can never replace another tenant's session), then the SAME shared insert body importEntries
-     * uses (so there is ONE source of the insert logic, no copy-paste drift). session_meta is still written LAST = commit
-     * point, so a mid-replace crash (post-delete, pre-insert) leaves orphan-free state (no meta = invisible to wake).
-     */
     async replaceEntries(sessionId, owner, entries) {
-        // 🔴 #292:placed 会话不接受 session-sync 的整段换装。两条理由各自独立成立:①这条路径 DELETE 掉
-        // meta 行再重插,会**重写掉** placement 元组(first-write 不可变的写侧破口);②即便元组保住,一条
-        // 子代转录的内容被外部 push 覆盖,等于 agent 行还指着它、里面已经是别人的历史。⇒ 响亮拒。
-        await this.assertNotPlaced(sessionId, "replace"); // 快路(零工:命中即拒,不进事务)
-        const validated = validateEntriesForImport(entries); // fail-closed gate BEFORE any write (mirrors importEntries)
+        await this.assertNotPlaced(sessionId, "replace");
+        const validated = validateEntriesForImport(entries);
         const conn = await this.pool.getConnection();
         try {
             await conn.beginTransaction();
-            // 🔴 #292(codex 对抗复审 R1-[high] 的同族窗,验真后修):上面那道快路是**事务外**的 ⇒ 与本事务
-            // 之间有 TOCTOU 窗。真门在事务内:①锁读一次元组(存在的行被行锁住;MySQL 的 gap lock 还会挡住
-            // 同键的并发 INSERT);②meta 的 DELETE 加 `placement_kind IS NULL` 硬条件 —— 即便判据被绕过,
-            // 一条 placed 行也**不可能**被这条路径删掉(placed 行的 owner 恒 NULL,而 replace(owner=null)
-            // 的属主门恰好匹配它 —— 没有这个条件,一次匿名 push 就能把子代转录整只换掉)。
             const [placedRows] = await conn.query("SELECT placement_kind FROM session_meta WHERE session_id = ? FOR UPDATE", [sessionId]);
             if (placedRows[0]?.placement_kind != null) {
                 await conn.rollback();
                 throw new SessionError("placement_refused", `session ${sessionId} belongs to the ${String(placedRows[0].placement_kind)} placement partition — a session-sync replace cannot overwrite a delegation transcript`);
             }
-            // Purge the existing log first (idempotent: a missing session deletes 0 rows). Events first, then the
-            // owner-guarded meta delete (`owner <=> ?` — a legacy null-owner session matches owner=null), defense-in-depth.
             await conn.query("DELETE FROM session_event WHERE session_id = ?", [sessionId]);
             await conn.query("DELETE FROM session_meta WHERE session_id = ? AND owner <=> ? AND placement_kind IS NULL", [sessionId, owner]);
-            // …then re-insert the validated log (entries + meta-as-commit-point) via the SHARED body.
             await this.insertValidatedLog(conn, sessionId, owner, validated);
             await conn.commit();
         }
@@ -498,77 +287,41 @@ export class TiDBSessionStore {
                 await conn.rollback();
             }
             catch {
-                /* ignore */
             }
             if (err instanceof SessionError)
-                throw err; // invalid_session (gate) / conflict — pass through
+                throw err;
             throw new SessionError("storage", `replace of session ${sessionId} failed`, err instanceof Error ? err : undefined);
         }
         finally {
             conn.release();
         }
     }
-    /**
-     * Shared insert half of {@link importEntries} / {@link replaceEntries} (ONE source of the insert logic, no drift):
-     * write the validated entries re-seq dense from 0 (entry_id/parent_id/type/ts verbatim), THEN session_meta LAST as
-     * the commit point. Runs inside the caller's open transaction (`conn`) so the caller owns begin/commit/rollback.
-     * `validated` is the OUTPUT of {@link validateEntriesForImport} (the caller runs the gate before opening the txn).
-     */
     async insertValidatedLog(conn, sessionId, owner, validated) {
-        // The replayed leaf (last entry's leaf target, mirroring core resolveLeafId / validateEntriesForImport).
         let leafId = null;
         for (const e of validated)
-            leafId = leafIdAfterEntry(e); // replayed leaf — core's exported helper (no service copy)
+            leafId = leafIdAfterEntry(e);
         const now = new Date();
-        // Entries land BEFORE session_meta (mirrors fork / core BUG-1): the meta row is the commit point.
         for (let seq = 0; seq < validated.length; seq++) {
             const e = validated[seq];
-            // payload = the verbatim entry blob (stringified for the JSON column bind); entry_id/parent_id/type/ts carried
-            // over unchanged from the entry; only seq is re-densified. ts comes from the entry's own ISO timestamp.
             await conn.query("INSERT INTO session_event (session_id, seq, entry_id, parent_id, type, payload, ts) VALUES (?,?,?,?,?,?,?)", [sessionId, seq, e.id, e.parentId ?? null, e.type, JSON.stringify(e), new Date(e.timestamp)]);
         }
-        // session_meta LAST = commit point. owner = the RE-STAMPED authenticated principal (never the bundle's).
         await conn.query("INSERT INTO session_meta (session_id, owner, created_at, updated_at, leaf_id, leaf_seq) VALUES (?,?,?,?,?,?)", [sessionId, owner, now, now, leafId, validated.length]);
     }
-    /**
-     * 2c session-sync P1d-β (PUSH streaming, §15) — begin a STAGED import into `realSessionId` under the shadow id
-     * `${realSessionId}#stg-${token}`. The route mints the uuidv7 `token` (the store never calls uuidv7/Date.now itself
-     * → the staging id is deterministic + the route owns the lease key). Returns a {@link TiDBStagingHandle} the route
-     * streams entry batches into ({@link StagingHandle.appendBatch}) then commits ({@link StagingHandle.commit}, the
-     * atomic swap) or aborts. No row is touched here — the handle is a stateless cursor over this pool.
-     */
     beginImportStaging(realSessionId, token) {
         return new TiDBStagingHandle(this.pool, realSessionId, stagingIdFor(realSessionId, token));
     }
-    /** #292:「这个 id 是 placed ⇒ 该写路径不适用」的共用拒绝(session-sync 的两条换装腿共用)。 */
     async assertNotPlaced(sessionId, what) {
         const placed = await this.placementOf(sessionId);
         if (placed !== undefined) {
             throw new SessionError("placement_refused", `session ${sessionId} belongs to the ${placed.kind} placement partition — a session-sync ${what} cannot overwrite a delegation transcript`);
         }
     }
-    /**
-     * 2c session-sync P1d-β (staged-row inspection) — read the rows STAGED under `stagingId` (NO session_meta probe — a
-     * staging id has no meta row by construction, so {@link exportEntries} would return null), oldest-first. The Phase-B
-     * import gate is now the per-line {@link StreamingImportValidator} (core 1.143.0) run during the stream, so this
-     * is no longer the validation path; it remains the staged-row inspection seam (tests/diagnostics). Returns `[]` for an
-     * empty/unknown staging id.
-     */
     async readStagedEntries(stagingId) {
         const [rows] = await this.pool.query("SELECT payload FROM session_event WHERE session_id = ? ORDER BY seq ASC", [stagingId]);
         return rows.map((r) => (typeof r.payload === "string" ? JSON.parse(r.payload) : r.payload));
     }
-    /**
-     * 2c session-sync P1d-β (§4) — reaper for ABANDONED staging sessions: DELETE session_event rows under a staging id
-     * (`session_id LIKE '%#stg-%'`) that has NO session_meta (never committed → invisible orphans) AND whose OLDEST
-     * staged row is older than the grace window (an IN-FLIGHT stream keeps appending fresh `ts` rows → its MIN(ts) is
-     * recent → it is NOT reaped, exactly like sweepOrphanBlobs' created_at grace). Per-staging-id, so a slow but live
-     * stream is never reaped while another abandoned one is. Returns the affected row count. Driven by main.ts's reaper.
-     */
     async sweepStagingSessions() {
         const cutoff = new Date(Date.now() - STAGING_GC_GRACE_MS);
-        // Candidate staging ids = those with rows older than the cutoff AND no meta row. GROUP BY so an in-flight id (its
-        // MIN(ts) recent) is excluded; LEFT JOIN session_meta so a (defensively) committed staging id is never touched.
         const [cands] = await this.pool.query("SELECT se.session_id FROM session_event se LEFT JOIN session_meta sm ON sm.session_id = se.session_id " +
             "WHERE se.session_id LIKE ? AND sm.session_id IS NULL " +
             "GROUP BY se.session_id HAVING MIN(se.ts) < ?", [`%${STAGING_ID_MARKER}%`, cutoff]);
@@ -579,28 +332,11 @@ export class TiDBSessionStore {
         }
         return removed;
     }
-    /**
-     * E21 — purge a session's CONVERSATION HISTORY (session_meta + session_event). Idempotent: a missing
-     * session is a no-op (returns false). The service's OWN run-ledger / checkpoint / tool-result rows are
-     * purged separately by the route's `purgeSession` coordinator — this method owns only the session
-     * abstraction's tables (the `SessionRepo.delete` half).
-     *
-     * `owner` is the single-DB-fleet null-safe SQL owner guard on `session_meta.owner` (defense-in-depth — the
-     * route already owner-gates; `<=>` so a legacy null-owner session matches owner=null). session_event carries
-     * no owner column, so its purge is GATED on the owner-matched meta delete: if the meta DELETE matched 0 rows
-     * (wrong owner / already gone) we skip the event delete — so a wrong-owner caller can never strand-delete
-     * another tenant's events. Meta is deleted FIRST (mirrors core BUG-2: once it's gone, wake is `null`
-     * regardless of leftover events; if a crash interleaves, orphan events with NO meta are invisible, never a
-     * half-session), and the event purge only runs after that owner-matched commit point.
-     */
     async deleteSession(sessionId, owner) {
         const conn = await this.pool.getConnection();
         try {
             await conn.beginTransaction();
-            // Meta row FIRST + owner-guarded: once it's gone, wake is `null` regardless of leftover events.
             const [metaRes] = await conn.query("DELETE FROM session_meta WHERE session_id = ? AND owner <=> ?", [sessionId, owner]);
-            // Only purge events when the OWNER-matched meta row was removed — gates the un-owner-columned event table
-            // through the meta owner check (a wrong-owner / already-gone session removes 0 meta rows → skip the events).
             if (metaRes.affectedRows > 0)
                 await conn.query("DELETE FROM session_event WHERE session_id = ?", [sessionId]);
             await conn.commit();
@@ -611,7 +347,6 @@ export class TiDBSessionStore {
                 await conn.rollback();
             }
             catch {
-                /* ignore */
             }
             throw err;
         }
@@ -620,53 +355,30 @@ export class TiDBSessionStore {
         }
     }
     get size() {
-        // Best-effort: durable store reloads per acquire (no long-lived cache), so report in-flight only.
         return this.pending.size;
     }
     dispose() {
-        // The pool is owned by main.ts and closed there; nothing process-local to release.
         this.pending.clear();
     }
 }
-/**
- * 2c session-sync P1d-β (PUSH streaming, §15 + §4) — a TiDB {@link StagingHandle}: stream entry batches into a SHADOW
- * `session_event` partition (the staging id, NO meta row → invisible to wake), then atomically SWAP them into the real
- * session id. Server memory is bounded by the in-flight batch (one txn per batch), not the whole log. The swap is a
- * row-key RENAME (`UPDATE session_event SET session_id`) — metadata-only, NO payload re-copy — so the commit cost is
- * the rename + a DELETE of the (purged) dst rows, in ONE txn, with session_meta written LAST = the sole commit point.
- */
 class TiDBStagingHandle {
     pool;
     realSessionId;
     stagingId;
-    /** Running DENSE seq counter for the staging rows. Advanced ONLY for a logically-NEW entry id (tracked in `seen`), so
-     *  a re-streamed entry (Phase-B resume) is skipped and the staged seqs stay dense 0..N-1 (NO holes that would collide
-     *  with a future F2 leaf_seq append on the committed session). */
     nextSeq = 0;
-    /** Entry ids already staged by THIS handle — a resume re-streams from the start, so dedup keeps seqs dense + idempotent. */
     seen = new Set();
     constructor(pool, realSessionId, stagingId) {
         this.pool = pool;
         this.realSessionId = realSessionId;
         this.stagingId = stagingId;
     }
-    /** Append a batch to the staging id, re-seq'd DENSE from the running counter (skipping ids already staged), IDEMPOTENTLY
-     *  (ON DUPLICATE KEY UPDATE on the `(session_id, entry_id)` uk is the durable backstop too). One txn per batch
-     *  (bounded). NO meta row is written (the staging id stays invisible). ts is the entry's own ISO timestamp (verbatim). */
     async appendBatch(entries) {
-        // Build the NEW rows (skip already-staged ids — resume dedup keeps seqs dense), then ONE multi-row INSERT for the
-        // whole batch (bounded → bounded packet/txn) instead of N round-trips. ON DUPLICATE KEY UPDATE is the durable
-        // backstop for the rare case a dup slips past `seen` (e.g. a concurrent re-stream).
         const rows = [];
         const tuples = [];
         for (const e of entries) {
             if (this.seen.has(e.id))
                 continue;
             tuples.push("(?,?,?,?,?,?,?)");
-            // 对抗复查 A-1(CRITICAL):staging 行的 ts 必须是「行插入时间」——写源 entry 的历史 timestamp 会让
-            // reaper 的 MIN(ts)<cutoff 判据把「正在导入的历史会话」当成弃置 staging 删掉(导入 1 小时前的会话
-            // =导入中被 reap)。真时间源恒在 payload(e.timestamp);ts 列的唯一读消费=fork 的行拷贝(carry-over
-            // 一致)与 reaper 活性判据,写 now 零语义破坏。
             rows.push(this.stagingId, this.nextSeq, e.id, e.parentId ?? null, e.type, JSON.stringify(e), new Date());
             this.seen.add(e.id);
             this.nextSeq++;
@@ -681,46 +393,24 @@ class TiDBStagingHandle {
             throw err instanceof SessionError ? err : new SessionError("storage", `staged append for ${this.realSessionId} failed`, err instanceof Error ? err : undefined);
         }
     }
-    /**
-     * The ATOMIC swap (ONE txn), §15 commit:
-     *  1. IN-COMMIT RE-CLASSIFY (closes the Phase-A plan→commit TOCTOU): read the dst's CURRENT entry ids + the staged
-     *     ids under `FOR UPDATE` (row-locks serialize a concurrent commit/run) → classifySyncRelationshipByIds. A flip
-     *     to fork/stale WITHOUT `resolution:"overwrite-dst"` → ROLLBACK → throw SyncConflictError (route → 409).
-     *  2. DELETE the dst's existing session_event rows (the replaceEntries purge).
-     *  3. UPDATE session_event SET session_id = real WHERE session_id = staging (the row-key RENAME — metadata only).
-     *  4. INSERT/UPSERT session_meta(real, owner, leaf_id=replayedLeaf, leaf_seq=N) LAST = the sole commit point.
-     * A crash before COMMIT: the DELETE+rename roll back (dst untouched) and the staging rows keep no meta = invisible
-     * orphans (reaped by sweepStagingSessions). `owner` is the re-stamped importing principal (§9).
-     */
     async commit(owner, opts) {
         const conn = await this.pool.getConnection();
         try {
             await conn.beginTransaction();
-            // (1) in-commit re-classify — read BOTH logs' ids oldest-first under FOR UPDATE (serialize against a racing
-            // commit/append to the dst). The staged ids ARE the source (already dense 0..N-1 under the staging id).
             const [stagedRows] = await conn.query("SELECT entry_id FROM session_event WHERE session_id = ? ORDER BY seq ASC FOR UPDATE", [this.stagingId]);
             const [dstRows] = await conn.query("SELECT entry_id FROM session_event WHERE session_id = ? ORDER BY seq ASC FOR UPDATE", [this.realSessionId]);
-            // `placement_kind` 捎带在既有的存在性探针上(#292:placed 目的地拒绝整段换装,理由与
-            // `replaceEntries` 的同款注逐字同——两条腿是同一件事的两种写法)。这里**刻意不加 `FOR UPDATE`**:
-            // 它对**缺席行**在 PG 上什么都锁不到(窗关不上),在 MySQL 上又会 gap-lock 住整段键区间(把一次
-            // 本可以合法先到的 placement 创建堵成锁等待)——两边都不划算。真门在提交前的那次权威复读(见下)。
             const [dstMeta] = await conn.query("SELECT placement_kind FROM session_meta WHERE session_id = ?", [this.realSessionId]);
             if (dstMeta[0]?.placement_kind != null) {
                 await conn.rollback();
                 throw new SessionError("placement_refused", `session ${this.realSessionId} belongs to the ${String(dstMeta[0].placement_kind)} placement partition — a session-sync staged commit cannot overwrite a delegation transcript`);
             }
             const srcIds = stagedRows.map((r) => String(r.entry_id));
-            const dstIds = dstMeta[0] ? dstRows.map((r) => String(r.entry_id)) : null; // no dst meta ⇒ fresh (no dst log to relate to)
+            const dstIds = dstMeta[0] ? dstRows.map((r) => String(r.entry_id)) : null;
             const rel = classifySyncRelationshipByIds(srcIds, dstIds);
             if ((rel.relation === "fork" || rel.relation === "stale") && opts?.resolution !== "overwrite-dst") {
                 await conn.rollback();
                 throw new SyncConflictError(this.realSessionId, rel);
             }
-            // (1b) 🔴 [2557] A5/F2(2026-08-05):fast_forward 的**载荷**判据 —— dst ⊆ src 按 id,但共享 id 的
-            // 内容可能已分叉(目的端纠正过某条、源端拿旧版+追加);整段换装会静默销毁目的端版本,§7 在载荷层
-            // 同样要求 409(除非显式 overwrite-dst)。共享段载荷只在这条臂上读(commit 本就是 O(total) 行操作
-            // ——DELETE dst + rename staged——所以这次成比例的载荷读不改变量级);行已被上面的 FOR UPDATE 锁住,
-            // 同 txn 重读载荷是一致读。判据与 fork 铸形见 session-sync-content.ts。
             if (rel.relation === "fast_forward" && opts?.resolution !== "overwrite-dst" && dstIds !== null && dstIds.length > 0) {
                 const [dstFull] = await conn.query("SELECT payload FROM session_event WHERE session_id = ? ORDER BY seq ASC", [this.realSessionId]);
                 const [stagedFull] = await conn.query("SELECT entry_id, payload FROM session_event WHERE session_id = ? ORDER BY seq ASC", [this.stagingId]);
@@ -734,13 +424,8 @@ class TiDBStagingHandle {
                     throw new SyncConflictError(this.realSessionId, contentForkRelation(diverged, rel.newEntryIds));
                 }
             }
-            // (2) purge the dst's existing log (the replaceEntries purge; idempotent — fresh deletes 0).
             await conn.query("DELETE FROM session_event WHERE session_id = ?", [this.realSessionId]);
-            // (3) RENAME the staged rows onto the real session id (row-key UPDATE — metadata only, NO payload re-copy). seq is
-            // already dense 0..N-1 under the staging id (appendBatch re-seq'd it), so no re-densify is needed on rename.
             await conn.query("UPDATE session_event SET session_id = ? WHERE session_id = ?", [this.realSessionId, this.stagingId]);
-            // (4) session_meta LAST = the sole commit point. The replayed leaf = the last staged entry's leaf target — read
-            // the last staged payload (now renamed) to compute leafIdAfterEntry (core's helper; no service re-statement).
             const [lastRow] = await conn.query("SELECT payload FROM session_event WHERE session_id = ? ORDER BY seq DESC LIMIT 1", [this.realSessionId]);
             let leafId = null;
             if (lastRow[0]) {
@@ -751,12 +436,6 @@ class TiDBStagingHandle {
             const now = new Date();
             await conn.query("INSERT INTO session_meta (session_id, owner, created_at, updated_at, leaf_id, leaf_seq) VALUES (?,?,?,?,?,?) " +
                 "ON DUPLICATE KEY UPDATE owner = VALUES(owner), updated_at = VALUES(updated_at), leaf_id = VALUES(leaf_id), leaf_seq = VALUES(leaf_seq)", [this.realSessionId, owner, now, now, leafId, srcIds.length]);
-            // 🔴 #292(codex 对抗复审 R1-[high],验真后修)—— **提交前的最后一道门**:上面那次 upsert 之后,
-            // 这一行**一定**被本事务锁住(不管它是我们刚插的、还是并发方先插我们随后 UPDATE 的),于是这次
-            // 复读是**权威**的。病:目标行在(1)的探针时**还不存在** ⇒ 探针无行可锁(PG 的 FOR UPDATE 对
-            // 缺席行不锁任何东西),另一事务可以在此期间把同 id 铸成 placed 转录;没有这道复读,本事务会把
-            // 它的事件整段换掉、并把 owner/leaf 改写成 push 方的 —— agent 行还指着那条会话,里面已经是别人
-            // 的历史。命中即整事务回滚(事件的 DELETE/rename 一并撤销),响亮 `placement_refused`。
             const [afterMeta] = await conn.query("SELECT placement_kind FROM session_meta WHERE session_id = ?", [this.realSessionId]);
             if (afterMeta[0]?.placement_kind != null) {
                 await conn.rollback();
@@ -769,7 +448,7 @@ class TiDBStagingHandle {
             try {
                 await conn.rollback();
             }
-            catch { /* ignore */ }
+            catch { }
             if (err instanceof SyncConflictError || err instanceof SessionError)
                 throw err;
             throw new SessionError("storage", `staged commit for ${this.realSessionId} failed`, err instanceof Error ? err : undefined);
@@ -778,7 +457,6 @@ class TiDBStagingHandle {
             conn.release();
         }
     }
-    /** Drop the staging rows (Phase B aborted before commit). Idempotent (a missing staging id deletes 0). */
     async abort() {
         await this.pool.query("DELETE FROM session_event WHERE session_id = ?", [this.stagingId]);
     }