@sema-agent/server 7.51.0 → 7.52.0

package/dist/plugins/permission-rule-store-sql.js

@@ -1,6 +1,6 @@
-import { createHash, randomBytes } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { z } from "zod";
-import { applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, foldDelta, parseAllowRuleText, screenRuleSyncState, PERMISSION_RULE_WRITER, RULE_SYNC_DROP_CODES, } from "@sema-agent/core";
+import { applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, foldDelta, parseAllowRuleText, screenRuleSyncState, PERMISSION_RULE_WRITER, RULE_SYNC_DROP_CODES, } from "@sema-agent/core";
 import { dialectProtocolJsonEncoder } from "./sql-driver.js";
 import { isMissingColumnError } from "./sql-errors.js";
 export function writerOfSqlRuleStore(store) {
@@ -14,7 +14,7 @@ export function writerOfSqlRuleStore(store) {
         return undefined;
     return { nextDot: nextDot, apply: apply, readRaw: readRaw };
 }
-const RuleScopeSchema = z.union([
+export const DurableRuleScopeSchema = z.union([
     z.object({ kind: z.literal("global") }).strict(),
     z.object({ kind: z.literal("project"), root: z.string().min(1) }).strict(),
 ]);
@@ -28,12 +28,12 @@ const PersistedAllowRuleSchema = z
     tool: z.literal("Bash"),
     match: z.enum(["exact", "prefix"]),
     command: z.string(),
-    scope: RuleScopeSchema,
+    scope: DurableRuleScopeSchema,
     adds: z.array(RuleAddSchema),
 })
     .strict();
 const RuleTombstoneSchema = z
-    .object({ rule: z.string(), scope: RuleScopeSchema, removedDots: z.array(RuleDotSchema).min(1), deletedBy: RuleDotSchema })
+    .object({ rule: z.string(), scope: DurableRuleScopeSchema, removedDots: z.array(RuleDotSchema).min(1), deletedBy: RuleDotSchema })
     .strict();
 const QUARANTINE_REASONS = new Set(Object.entries(RULE_SYNC_DROP_CODES)
     .filter(([, side]) => side.includes("local-quarantined"))
@@ -42,14 +42,14 @@ const isQuarantineReason = (v) => typeof v === "string" && QUARANTINE_REASONS.ha
 const QuarantinedRuleAddSchema = z
     .object({
     rule: z.string(),
-    scope: RuleScopeSchema,
+    scope: DurableRuleScopeSchema,
     add: RuleAddSchema,
     reason: z.custom(isQuarantineReason, { message: "not a registered permission-rule quarantine reason" }),
     atMs: z.number().int().nonnegative().safe(),
 })
     .strict();
 const FrontierSchema = z.record(z.string(), z.number().int().nonnegative().safe());
-const RuleCandidateSchema = z.object({ rule: z.string(), scope: RuleScopeSchema }).strict();
+const RuleCandidateSchema = z.object({ rule: z.string(), scope: DurableRuleScopeSchema }).strict();
 const RedeemedDotsSchema = z.record(z.string(), RuleDotSchema);
 const RuleEditedSchema = z.object({ index: z.number().int().nonnegative().safe(), text: z.string(), at: z.string() }).strict();
 const RuleOffer2Schema = z.union([
@@ -143,16 +143,41 @@ export const TIDB_PERMISSION_RULE_STATEMENTS = [
     principal VARCHAR(512) NOT NULL,
     approval_id VARCHAR(190) NOT NULL,
     -- payload_hash:载荷绑定(F1 ④)。= prepare 时刻候选集的规范摘要;redeem 时与记录上的候选集
-    -- 重算比对,不符 ⇒ 拒(篡改/重放不可扩权)。
+    -- 重算比对,不符 ⇒ 拒(改动/重放不可扩权)。
     payload_hash VARCHAR(190) NOT NULL,
     payload_json LONGTEXT NOT NULL,
     expires_at_ms BIGINT NOT NULL,
     -- consumed_at_ms:一次性消费位(F1 ③)。消费 = 单条条件 UPDATE(WHERE consumed_at_ms IS NULL),
     -- **禁 read-then-write** —— 并发双 redeem 必须恰一成功,那只能由引擎的行锁回答。
     consumed_at_ms BIGINT NULL,
+    -- claim_id:#265 A7 的**认领代次**(codex 对抗轮 R1-F1,验真后修)。每一次 consume / reclaim
+    -- 铸一枚新的;release / settle 的 WHERE 里**必须**带着它。没有这一列时两条语句问的是"有没有
+    -- 认领",不是"这是**谁的**认领"—— 于是一个跑过头被顶替的旧持有者能清掉现持有者的认领(第三条腿
+    -- 随即又认领一次),或把自己的陈旧终局写成这张票的答案。围栏把"恰一赢者"从一句话变成一条谓词。
+    claim_id VARCHAR(190) NULL,
+    -- purpose:#265 A7 的**车道绑定**(codex 对抗轮 R1-F2,验真后修)。两条导入车道共用这张表,而它们
+    -- 的票语义**刻意不同**(cc-import 一次性 / local-import 可恢复三态)。不刻这一位,一张 cc 票拿到
+    -- local 口就白得三态语义(cc-import 的一次性拒重放在**不改它一行代码**的情况下被绕过),反向则更坏:
+    -- 一张 local 票被 cc 口执行完却不落定,local 口随后按崩溃窗把它再执行一遍。不可变:铸票时定,此后
+    -- 每一次读写都拿它当匹配项(不符 ⇒ 与"票不存在"同形,零存在性 oracle)。
+    purpose VARCHAR(32) NOT NULL,
+    -- redeemed_outcome:#265 A7 的**第三态**(SETTLED)。NULL = 还没落定;非 NULL = 这张票的兑付**已经
+    -- 结束**,里面是那一次的逐字终局(JSON)。它把票的两态(未认领/已认领)扩成三态
+    -- MINTED → CLAIMED → SETTLED,而三态正是"认领之后死进程"这件事唯一能被区分出来的形:
+    -- CLAIMED-未结 = 上一次执行中途没了(可重驱),SETTLED = 已经答过了(逐字回放,零二次执行)。
+    -- 🔴 只服务 local-import 车道;cc-import 的票**语义不变**(一次性,同票二次 redeem 恒拒)——
+    -- 那条车道一个字节都不写这一列,两条车道的语义因此不共享一个开关(purpose 列是那条边界的执法者)。
+    redeemed_outcome LONGTEXT NULL,
+    -- settled_at_ms:落定**发生的时刻**(codex 对抗轮 R3-F2,验真后修)。清扫的「已落定」那一支必须按
+    -- 它判,不能按 expires_at_ms —— 一次**临期恢复**写下终局的那一刻,票早就过期很久了,按过期判会让
+    -- 这份刚生出来的权威回执**下一拍**就被删:规则已经写进店里,而属主的丢响应重放拿到 404。
+    -- 有了这一列,「落定之后必有一个完整的回放窗」对每一条路都成立,而不只是对准时兑付的那条。
+    settled_at_ms BIGINT NULL,
     created_at_ms BIGINT NOT NULL,
     PRIMARY KEY (ticket_id),
     KEY idx_permission_rule_ticket_owner (owner_key),
+    -- 保留期腿 R6-F1 的支撑索引:孤儿 pending 的清扫谓词里有一条按 approval_id 的 NOT EXISTS 内查。
+    KEY idx_permission_rule_ticket_approval (approval_id),
     -- 保留期腿的支撑索引(同上):WHERE expires_at_ms <= ? 是每 tick 一次的区间扫。
     KEY idx_permission_rule_ticket_expires (expires_at_ms)
   ) COLLATE utf8mb4_bin`,
@@ -181,6 +206,25 @@ export async function assertPermissionRuleApprovalSchema(query, dialect) {
             `Underlying probe error: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
+export async function assertPermissionRuleTicketSchema(query, dialect) {
+    try {
+        await query(`SELECT redeemed_outcome, claim_id, purpose, settled_at_ms FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE 1=0`);
+    }
+    catch (err) {
+        if (!isMissingColumnError(err, dialect))
+            throw err;
+        throw new Error(`${PERMISSION_RULE_TICKET_TABLE} is missing required columns (redeemed_outcome / claim_id / purpose / settled_at_ms) — refusing to start. This build needs ` +
+            `the #265 A7 three-state redemption columns (MINTED → CLAIMED → SETTLED, the claim generation that fences a superseded ` +
+            `claimant, and the lane binding that keeps cc-import and local-import tickets from being interchangeable): without them a ` +
+            `local-import ticket can be claimed but never settled, so a redemption that already wrote rules to the store answers its ` +
+            `owner with a retry-later it can never satisfy. This repository ships no ALTER TABLE migrations, so the table must be recreated: run ` +
+            `\`DROP TABLE ${PERMISSION_RULE_TICKET_TABLE};\` on the ${dialect === "pg" ? "PostgreSQL" : "MySQL-protocol"} backend and ` +
+            `restart — the schema is recreated at boot. The cost is bounded and small: this table holds minute-TTL single-use import ` +
+            `tickets (a governance transient that dies on expiry), so dropping it only makes anyone mid-preview re-run prepare; ` +
+            `persisted rules live in ${PERMISSION_RULE_TABLE} and are untouched. ` +
+            `Underlying probe error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
 export async function ensurePgPermissionRuleSchema(q) {
     await q(`CREATE TABLE IF NOT EXISTS ${PERMISSION_RULE_TABLE} (
     owner_key VARCHAR(190) COLLATE "C" NOT NULL,
@@ -237,10 +281,19 @@ export async function ensurePgPermissionRuleSchema(q) {
     payload_json TEXT COLLATE "C" NOT NULL,
     expires_at_ms BIGINT NOT NULL,
     consumed_at_ms BIGINT,
+    -- claim_id / purpose / redeemed_outcome:#265 A7 三列(MySQL 孪生的行内注写了各自的理由 ——
+    -- 认领代次是 release/settle 的围栏、purpose 是两条导入车道的绑定位、redeemed_outcome 是第三态)。
+    claim_id VARCHAR(190) COLLATE "C",
+    purpose VARCHAR(32) COLLATE "C" NOT NULL,
+    redeemed_outcome TEXT COLLATE "C",
+    -- settled_at_ms:落定时刻(MySQL 孪生的行内注写了理由:清扫的已落定支按它判,否则临期恢复出来的
+    -- 权威回执下一拍就没)。
+    settled_at_ms BIGINT,
     created_at_ms BIGINT NOT NULL,
     PRIMARY KEY (ticket_id)
   )`);
     await q(`CREATE INDEX IF NOT EXISTS idx_permission_rule_ticket_owner ON ${PERMISSION_RULE_TICKET_TABLE} (owner_key)`);
+    await q(`CREATE INDEX IF NOT EXISTS idx_permission_rule_ticket_approval ON ${PERMISSION_RULE_TICKET_TABLE} (approval_id)`);
     await q(`CREATE INDEX IF NOT EXISTS idx_permission_rule_ticket_expires ON ${PERMISSION_RULE_TICKET_TABLE} (expires_at_ms)`);
 }
 export function buildRuleOwnerKey(owner) {
@@ -398,6 +451,7 @@ class SqlPermissionRuleStore {
                 throw new Error("the SQL permission-rule backend does not implement the sync-join landing pipeline (core's applySyncJoin is not on the package's public export face); " +
                     "no sync client is wired in this deployment, so this arm has no caller — see permission-rule-store-sql.ts header");
             }
+            assertWriteDeltaScopeDurable(delta);
             await this.ensureBucket();
             const cur = await this.read();
             if (cur.rev !== opts.expectedRev)
@@ -558,6 +612,10 @@ export class SqlRuleApprovalRecordStore {
     }
 }
 export const RULE_IMPORT_TICKET_GC_GRACE_MS = 10 * 60_000;
+export const SQL_DB_NOW_MS = {
+    tidb: "CAST(UNIX_TIMESTAMP(NOW(3)) * 1000 AS SIGNED)",
+    pg: "(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint",
+};
 export function buildRulePayloadHash(candidates) {
     return createHash("sha256").update(canonicalJson(candidates), "utf8").digest("hex");
 }
@@ -575,9 +633,9 @@ export class SqlRuleImportTicketStore {
         const nowMs = this.now();
         const expiresAtMs = nowMs + input.ttlMs;
         const payloadHash = buildRulePayloadHash(input.candidates);
-        await this.db.query(this.q(`INSERT INTO ${PERMISSION_RULE_TICKET_TABLE} (ticket_id, owner_key, principal, approval_id, payload_hash, payload_json, expires_at_ms, consumed_at_ms, created_at_ms)
-         VALUES (?, ?, ?, ?, ?, ?, ?, NULL, ?)`, `INSERT INTO ${PERMISSION_RULE_TICKET_TABLE} (ticket_id, owner_key, principal, approval_id, payload_hash, payload_json, expires_at_ms, consumed_at_ms, created_at_ms)
-         VALUES ($1, $2, $3, $4, $5, $6, $7, NULL, $8)`), [
+        await this.db.query(this.q(`INSERT INTO ${PERMISSION_RULE_TICKET_TABLE} (ticket_id, owner_key, principal, approval_id, payload_hash, payload_json, expires_at_ms, consumed_at_ms, claim_id, purpose, created_at_ms)
+         VALUES (?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?, ?)`, `INSERT INTO ${PERMISSION_RULE_TICKET_TABLE} (ticket_id, owner_key, principal, approval_id, payload_hash, payload_json, expires_at_ms, consumed_at_ms, claim_id, purpose, created_at_ms)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, NULL, NULL, $8, $9)`), [
             input.ticketId,
             buildRuleOwnerKey({ kind: "principal", principal: input.principal }),
             input.principal,
@@ -585,44 +643,88 @@ export class SqlRuleImportTicketStore {
             payloadHash,
             dialectProtocolJsonEncoder(this.db.dialect)(input.candidates, "permission_rule_ticket.payload_json"),
             expiresAtMs,
+            input.purpose,
             nowMs,
         ]);
         return { ticketId: input.ticketId, approvalId: input.approvalId, payloadHash, expiresAtMs };
     }
-    async consume(ticketId, principal, opts) {
-        const stampMs = this.now();
-        const decisionNowMs = opts?.decisionNowMs ?? stampMs;
+    async consume(ticketId, principal, purpose, opts) {
+        const decisionNowMs = opts?.decisionNowMs ?? this.now();
         const ownerKey = buildRuleOwnerKey({ kind: "principal", principal });
         const row = await this.readRow(ticketId);
         if (row === undefined)
             return { ok: false, reason: "unknown" };
         if (row.ownerKey !== ownerKey)
             return { ok: false, reason: "wrong-principal" };
+        if (row.purpose !== purpose)
+            return { ok: false, reason: "wrong-purpose" };
         if (row.consumedAtMs !== undefined)
             return { ok: false, reason: "consumed" };
         if (row.expiresAtMs <= decisionNowMs)
             return { ok: false, reason: "expired" };
-        const { affected } = await this.db.query(this.q(`UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = ? WHERE ticket_id = ? AND owner_key = ? AND consumed_at_ms IS NULL AND expires_at_ms > ?`, `UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = $1 WHERE ticket_id = $2 AND owner_key = $3 AND consumed_at_ms IS NULL AND expires_at_ms > $4`), [stampMs, ticketId, ownerKey, decisionNowMs]);
+        const claimId = randomUUID();
+        const { affected } = await this.db.query(this.q(`UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = ${SQL_DB_NOW_MS.tidb}, claim_id = ? WHERE ticket_id = ? AND owner_key = ? AND purpose = ? AND consumed_at_ms IS NULL AND expires_at_ms > ?`, `UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = ${SQL_DB_NOW_MS.pg}, claim_id = $1 WHERE ticket_id = $2 AND owner_key = $3 AND purpose = $4 AND consumed_at_ms IS NULL AND expires_at_ms > $5`), [claimId, ticketId, ownerKey, purpose, decisionNowMs]);
         if (affected === 1)
-            return { ok: true, approvalId: row.approvalId, payloadHash: row.payloadHash };
+            return { ok: true, approvalId: row.approvalId, payloadHash: row.payloadHash, claimId };
         return { ok: false, reason: "consumed" };
     }
-    async release(ticketId, principal, mustRemainValidMs = 0, opts) {
+    async release(ticketId, principal, claimId, mustRemainValidMs = 0, opts) {
         const nowMs = opts?.decisionNowMs ?? this.now();
-        const { affected } = await this.db.query(this.q(`UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = NULL WHERE ticket_id = ? AND owner_key = ? AND consumed_at_ms IS NOT NULL AND expires_at_ms > ?`, `UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = NULL WHERE ticket_id = $1 AND owner_key = $2 AND consumed_at_ms IS NOT NULL AND expires_at_ms > $3`), [ticketId, buildRuleOwnerKey({ kind: "principal", principal }), nowMs + mustRemainValidMs]);
+        const { affected } = await this.db.query(this.q(`UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = NULL, claim_id = NULL WHERE ticket_id = ? AND owner_key = ? AND claim_id = ? AND consumed_at_ms IS NOT NULL AND redeemed_outcome IS NULL AND expires_at_ms > ?`, `UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = NULL, claim_id = NULL WHERE ticket_id = $1 AND owner_key = $2 AND claim_id = $3 AND consumed_at_ms IS NOT NULL AND redeemed_outcome IS NULL AND expires_at_ms > $4`), [ticketId, buildRuleOwnerKey({ kind: "principal", principal }), claimId, nowMs + mustRemainValidMs]);
+        return affected === 1;
+    }
+    async settle(ticketId, principal, claimId, outcome) {
+        const { affected } = await this.db.query(this.q(`UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET redeemed_outcome = ?, settled_at_ms = ${SQL_DB_NOW_MS.tidb} WHERE ticket_id = ? AND owner_key = ? AND claim_id = ? AND consumed_at_ms IS NOT NULL AND redeemed_outcome IS NULL`, `UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET redeemed_outcome = $1, settled_at_ms = ${SQL_DB_NOW_MS.pg} WHERE ticket_id = $2 AND owner_key = $3 AND claim_id = $4 AND consumed_at_ms IS NOT NULL AND redeemed_outcome IS NULL`), [
+            dialectProtocolJsonEncoder(this.db.dialect)(outcome, "permission_rule_ticket.redeemed_outcome"),
+            ticketId,
+            buildRuleOwnerKey({ kind: "principal", principal }),
+            claimId,
+        ]);
         return affected === 1;
     }
+    async peek(ticketId, principal, purpose) {
+        const row = await this.readRow(ticketId);
+        if (row === undefined || row.ownerKey !== buildRuleOwnerKey({ kind: "principal", principal }) || row.purpose !== purpose)
+            return undefined;
+        if (row.redeemedOutcome !== undefined) {
+            let outcome;
+            try {
+                outcome = JSON.parse(row.redeemedOutcome);
+            }
+            catch (err) {
+                throw new Error(`${PERMISSION_RULE_TICKET_TABLE}.redeemed_outcome for ticket ${ticketId} is not valid JSON (${err instanceof Error ? err.message : String(err)})`);
+            }
+            return { state: "settled", outcome };
+        }
+        if (row.consumedAtMs === undefined)
+            return { state: "minted" };
+        return { state: "claimed", claimAgeMs: Math.max(0, row.dbNowMs - row.consumedAtMs) };
+    }
+    async reclaim(ticketId, principal, purpose, minClaimAgeMs) {
+        const row = await this.readRow(ticketId);
+        if (row === undefined || row.ownerKey !== buildRuleOwnerKey({ kind: "principal", principal }) || row.purpose !== purpose)
+            return { ok: false };
+        if (row.claimId === undefined)
+            return { ok: false };
+        const claimId = randomUUID();
+        const { affected } = await this.db.query(this.q(`UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = ${SQL_DB_NOW_MS.tidb}, claim_id = ? WHERE ticket_id = ? AND owner_key = ? AND purpose = ? AND claim_id = ? AND consumed_at_ms IS NOT NULL AND consumed_at_ms <= ${SQL_DB_NOW_MS.tidb} - ? AND redeemed_outcome IS NULL`, `UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = ${SQL_DB_NOW_MS.pg}, claim_id = $1 WHERE ticket_id = $2 AND owner_key = $3 AND purpose = $4 AND claim_id = $5 AND consumed_at_ms IS NOT NULL AND consumed_at_ms <= ${SQL_DB_NOW_MS.pg} - $6 AND redeemed_outcome IS NULL`), [claimId, ticketId, buildRuleOwnerKey({ kind: "principal", principal }), purpose, row.claimId, minClaimAgeMs]);
+        return affected === 1 ? { ok: true, approvalId: row.approvalId, payloadHash: row.payloadHash, claimId } : { ok: false };
+    }
     async readRow(ticketId) {
-        const { rows } = await this.db.query(this.q(`SELECT owner_key, approval_id, payload_hash, expires_at_ms, consumed_at_ms FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE ticket_id = ?`, `SELECT owner_key, approval_id, payload_hash, expires_at_ms, consumed_at_ms FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE ticket_id = $1`), [ticketId]);
+        const { rows } = await this.db.query(this.q(`SELECT owner_key, approval_id, payload_hash, purpose, expires_at_ms, consumed_at_ms, claim_id, redeemed_outcome, ${SQL_DB_NOW_MS.tidb} AS db_now_ms FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE ticket_id = ?`, `SELECT owner_key, approval_id, payload_hash, purpose, expires_at_ms, consumed_at_ms, claim_id, redeemed_outcome, ${SQL_DB_NOW_MS.pg} AS db_now_ms FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE ticket_id = $1`), [ticketId]);
         const row = rows[0];
         if (row === undefined)
             return undefined;
         return {
+            dbNowMs: Number(row.db_now_ms),
             ownerKey: String(row.owner_key),
             approvalId: String(row.approval_id),
             payloadHash: String(row.payload_hash),
+            purpose: String(row.purpose),
             expiresAtMs: Number(row.expires_at_ms),
             ...(row.consumed_at_ms === null || row.consumed_at_ms === undefined ? {} : { consumedAtMs: Number(row.consumed_at_ms) }),
+            ...(row.claim_id === null || row.claim_id === undefined ? {} : { claimId: String(row.claim_id) }),
+            ...(row.redeemed_outcome === null || row.redeemed_outcome === undefined ? {} : { redeemedOutcome: String(row.redeemed_outcome) }),
         };
     }
 }
@@ -635,8 +737,8 @@ export function createSqlPermissionRuleStores(db, now) {
         approvals: new SqlRuleApprovalRecordStore(db, now),
         tickets: new SqlRuleImportTicketStore(db, now),
         reapExpired: async (nowMs) => {
-            const deadTickets = await db.query(q(`DELETE FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE expires_at_ms <= ? LIMIT ${RULE_REAP_BATCH}`, `DELETE FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE ctid IN (SELECT ctid FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE expires_at_ms <= $1 LIMIT ${RULE_REAP_BATCH})`), [nowMs - RULE_IMPORT_TICKET_GC_GRACE_MS]);
-            const orphanPending = await db.query(q(`DELETE FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE state = 'pending' AND created_at_ms < ? LIMIT ${RULE_REAP_BATCH}`, `DELETE FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE ctid IN (SELECT ctid FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE state = 'pending' AND created_at_ms < $1 LIMIT ${RULE_REAP_BATCH})`), [nowMs - RULE_PENDING_APPROVAL_RETENTION_MS]);
+            const deadTickets = await db.query(q(`DELETE FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE (consumed_at_ms IS NULL AND expires_at_ms <= ?) OR (redeemed_outcome IS NOT NULL AND settled_at_ms IS NOT NULL AND settled_at_ms <= ${SQL_DB_NOW_MS.tidb} - ${RULE_IMPORT_TICKET_GC_GRACE_MS}) OR (consumed_at_ms IS NOT NULL AND redeemed_outcome IS NULL AND consumed_at_ms < ${SQL_DB_NOW_MS.tidb} - ${RULE_PENDING_APPROVAL_RETENTION_MS}) LIMIT ${RULE_REAP_BATCH}`, `DELETE FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE ctid IN (SELECT ctid FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE (consumed_at_ms IS NULL AND expires_at_ms <= $1) OR (redeemed_outcome IS NOT NULL AND settled_at_ms IS NOT NULL AND settled_at_ms <= ${SQL_DB_NOW_MS.pg} - ${RULE_IMPORT_TICKET_GC_GRACE_MS}) OR (consumed_at_ms IS NOT NULL AND redeemed_outcome IS NULL AND consumed_at_ms < ${SQL_DB_NOW_MS.pg} - ${RULE_PENDING_APPROVAL_RETENTION_MS}) LIMIT ${RULE_REAP_BATCH})`), [nowMs - RULE_IMPORT_TICKET_GC_GRACE_MS]);
+            const orphanPending = await db.query(q(`DELETE FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE state = 'pending' AND created_at_ms < ? AND NOT EXISTS (SELECT 1 FROM ${PERMISSION_RULE_TICKET_TABLE} t WHERE t.approval_id = ${PERMISSION_RULE_APPROVAL_TABLE}.record_id) LIMIT ${RULE_REAP_BATCH}`, `DELETE FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE ctid IN (SELECT a.ctid FROM ${PERMISSION_RULE_APPROVAL_TABLE} a WHERE a.state = 'pending' AND a.created_at_ms < $1 AND NOT EXISTS (SELECT 1 FROM ${PERMISSION_RULE_TICKET_TABLE} t WHERE t.approval_id = a.record_id) LIMIT ${RULE_REAP_BATCH})`), [nowMs - RULE_PENDING_APPROVAL_RETENTION_MS]);
             return deadTickets.affected + orphanPending.affected;
         },
         countBuckets: async () => {

package/dist/plugins/pg-pool.js

@@ -8,6 +8,7 @@ import { ensurePgOutcomeLedgerSchema as ensureOutcomeLedgerSchema } from "./outc
 import { ensureSchema as ensureImageIndexSchema } from "./image-index-sql.js";
 import { ensurePgImageBakeSchema as ensureImageBakeSchema } from "./image-bake-store-sql.js";
 import { ensurePgApprovalAskSchema } from "./approval-ask-store-sql.js";
+import { ensurePgMemoryOptOutGrantSchema } from "./memory-optout-grant-store-sql.js";
 import { ensurePgAdoptionLogSchema } from "./adoption-log-sql.js";
 import { ensurePgPermissionRuleSchema } from "./permission-rule-store-sql.js";
 import { ensurePgLeaderRunSchema } from "./leader-run-store-sql.js";
@@ -165,6 +166,63 @@ export const PG_SCHEMA_STATEMENTS = [
      created_at TIMESTAMPTZ(3) NOT NULL
    )`,
     `CREATE INDEX IF NOT EXISTS idx_snapshot_blob_created ON snapshot_blob (created_at)`,
+    `CREATE TABLE IF NOT EXISTS file_history_scope (
+     scope         VARCHAR(64) COLLATE "C" NOT NULL,
+     created_at_ms BIGINT                  NOT NULL,
+     PRIMARY KEY (scope)
+   )`,
+    `CREATE TABLE IF NOT EXISTS file_history_tracked (
+     scope          VARCHAR(64) COLLATE "C" NOT NULL,
+     key_hash       CHAR(64) COLLATE "C"    NOT NULL,
+     track_key      TEXT COLLATE "C"        NOT NULL,
+     key_kind       VARCHAR(16) COLLATE "C" NOT NULL,
+     key_family     VARCHAR(8) COLLATE "C"  NOT NULL,
+     base_available BOOLEAN                 NOT NULL,
+     observed_later BOOLEAN                 NOT NULL DEFAULT FALSE,
+     created_at_ms  BIGINT                  NOT NULL,
+     PRIMARY KEY (scope, key_hash)
+   )`,
+    `CREATE TABLE IF NOT EXISTS file_history_version (
+     scope        VARCHAR(64) COLLATE "C" NOT NULL,
+     key_hash     CHAR(64) COLLATE "C"    NOT NULL,
+     version      INT                     NOT NULL,
+     blob_hash    CHAR(64) COLLATE "C"    NULL,
+     mode         INT                     NULL,
+     parent_ident TEXT COLLATE "C"        NULL,
+     backup_time  VARCHAR(40) COLLATE "C" NOT NULL,
+     PRIMARY KEY (scope, key_hash, version)
+   )`,
+    `CREATE INDEX IF NOT EXISTS idx_file_history_version_blob ON file_history_version (blob_hash)`,
+    `CREATE TABLE IF NOT EXISTS file_history_boundary (
+     scope           VARCHAR(64) COLLATE "C" NOT NULL,
+     entry_id        VARCHAR(64) COLLATE "C" NOT NULL,
+     published_at_ms BIGINT                  NOT NULL,
+     publish_seq     BIGINT                  NOT NULL,
+     PRIMARY KEY (scope, entry_id),
+     CONSTRAINT uq_file_history_boundary_seq UNIQUE (scope, publish_seq)
+   )`,
+    `CREATE TABLE IF NOT EXISTS file_history_boundary_file (
+     scope    VARCHAR(64) COLLATE "C" NOT NULL,
+     entry_id VARCHAR(64) COLLATE "C" NOT NULL,
+     key_hash CHAR(64) COLLATE "C"    NOT NULL,
+     version  INT                     NOT NULL,
+     PRIMARY KEY (scope, entry_id, key_hash)
+   )`,
+    `CREATE INDEX IF NOT EXISTS idx_file_history_bf_key ON file_history_boundary_file (scope, key_hash)`,
+    `CREATE TABLE IF NOT EXISTS file_history_reaped_entry (
+     scope        VARCHAR(64) COLLATE "C" NOT NULL,
+     entry_id     VARCHAR(64) COLLATE "C" NOT NULL,
+     reaped_at_ms BIGINT                  NOT NULL,
+     PRIMARY KEY (scope, entry_id)
+   )`,
+    `CREATE TABLE IF NOT EXISTS file_history_blob (
+     blob_hash  CHAR(64) COLLATE "C" PRIMARY KEY,
+     byte_len   BIGINT         NOT NULL,
+     -- bytes NULLABLE = the same two-backend (SQL inline / MinIO index-only) contract as snapshot_blob above.
+     bytes      BYTEA          NULL,
+     created_at TIMESTAMPTZ(3) NOT NULL
+   )`,
+    `CREATE INDEX IF NOT EXISTS idx_file_history_blob_created ON file_history_blob (created_at)`,
     `CREATE TABLE IF NOT EXISTS workflow_journal (
      run_id        VARCHAR(191) COLLATE "C" NOT NULL,
      ordinal       INT          NOT NULL,
@@ -305,6 +363,7 @@ export async function ensurePgSchema(pool) {
         await ensureImageIndexSchema(client);
         await ensureImageBakeSchema(client);
         await ensurePgApprovalAskSchema((text, params) => client.query(text, params));
+        await ensurePgMemoryOptOutGrantSchema((text, params) => client.query(text, params));
         await ensurePgAdoptionLogSchema((text, params) => client.query(text, params));
         await ensurePgPermissionRuleSchema((text, params) => client.query(text, params));
         await ensurePgLeaderRunSchema((text, params) => client.query(text, params));

package/dist/plugins/pg-safe-json.d.ts

@@ -10,7 +10,7 @@ export declare function pgLosslessJsonStringify(value: unknown): string;
  *  剥离等),CAS/rev 语义的臂必须先 detect 再变换。 */
 export declare function pgHasUnstorable(v: unknown): boolean;
 /** codex R4→R7 终形:协议数据(approval args/checkpoint/ctx/outcome/rules/memory)一律**拒绝式**。
- *  信封方案历经 R4-R7 四轮对抗全灭:行内判别子恒可被 ≤1.240 老行/用户数据撞形(静默解错=approval
+ *  信封方案历经 R4-R7 四轮交叉复审全灭:行内判别子恒可被 ≤1.240 老行/用户数据撞形(静默解错=approval
  *  信任边界破),进程旗恒有混旗副本窗(写读不同解)。唯一无歧义解=**脏值不进库**:PG 存不了
  *  NUL 是后端能力边界,fail-loud 暴露(清晰文案)严格优于修前的 22P05 神秘崩——两者都存不进,
  *  但拒绝式下 review==execute 恒成立(库里只有干净值,展示面=执行面永逐位一致)。 */

package/dist/plugins/remote-env-device.d.ts

@@ -113,7 +113,7 @@ export declare class RemoteDeviceExecutionEnv implements RemoteExecutionEnv {
      * 🔴 **为什么这条判据不能只守 `connect()`**(codex R2-F3,判真):`connect()` 一辈子只跑一两次,而
      * 设备的 WS 可以**透明重连** —— 断开、以同一 deviceId 连回来,`this.connected` 全程不变,后续
      * `dispatch` 直接用汇聚端的**当前**连接。于是「弱能力连接上铸的 env + 设备连回时带上了 guarded 面」
-     * 这一形绕过了 connect 期的闸:core 仍看不到 guarded 方法、仍走非原子写降级,而没有任何一层再问一次。
+     * 这一形跳过了 connect 期的闸:core 仍看不到 guarded 方法、仍走非原子写降级,而没有任何一层再问一次。
      * 所以判据要落在**每一次非原子写之前**(那正是被降级的那条路),connect 期的检查是它的早期快门。
      */
     private guardFaceDrift;

package/dist/plugins/remote-env-k8s.d.ts

@@ -268,7 +268,7 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
         maxLines?: number;
         abortSignal?: AbortSignal;
     }): Promise<Result<string[], FileError>>;
-    /** 父目录自建(与 host/local-docker/adb/ssh 同口径)。抽成共用是因为 `appendFile` 曾**绕过**它:
+    /** 父目录自建(与 host/local-docker/adb/ssh 同口径)。抽成共用是因为 `appendFile` 曾**跳过**它:
      *  🔴 2026-07-25 实测的跨腿分叉 —— `appendFile` 直接调 `writeChunked`,整条路上没有 `mkdir -p`,于是
      *  「直接 append 建一个新日志路径」在 k8s 腿上返 `not_found`,而其余 5 腿都成功(host/local-docker/adb 实测,
      *  ssh/e2b 由方法体判据)。core 的后台输出镜像正是"每拍 append 一次"的形,这条分叉会让它在 k8s 腿上从第一拍

package/dist/plugins/retention-lane-store-sql.d.ts

@@ -147,7 +147,7 @@ export declare class SqlRetentionLaneStore implements RetentionLaneStore {
      * 判据三合取写进**一条 CAS 的 WHERE**:holder 是我 ∧ fencing token 还是本轮那个 ∧ **尚未过期**。
      *  · 第三项是承重的:租约过期而 holder 还写着我,必须读成**不再属于我**(fail-closed)——另一个副本
      *    随时可能抢走,两个副本同时跑三方法是这条腿最不能出的事。
-     *  · 「复核」与「续租」合成一条语句而不是先读后写(codex 对抗复审 R1-[high],验真后改):
+     *  · 「复核」与「续租」合成一条语句而不是先读后写(codex 交叉复审 R1-[high],验真后改):
      *    ① 读+写两条语句之间有窗口,而 CAS 的谓词与更新在引擎里是原子的;
      *    ② 更要紧的是**续租本身**:`startRetentionLane` 的重入守卫会跳过下一 tick,于是一轮的续租机会
      *       只有轮首那一次 —— 一轮跑满 2×interval 之后租约自己到期,而本副本毫不知情、继续删下去。
@@ -196,7 +196,7 @@ export declare class SqlRetentionLaneStore implements RetentionLaneStore {
         nowMs: number;
     }): Promise<void>;
     /**
-     * 放置/解除 **+ 治理审计行,同一个事务**(codex 对抗复审 R1-[high],验真后加)。
+     * 放置/解除 **+ 治理审计行,同一个事务**(codex 交叉复审 R1-[high],验真后加)。
      *
      * 🔴 为什么必须原子(与 §6 F5 的「删除与审计同事务」是同一条判据,只是换了一张表):两次独立提交下,
      * 第二步失败会留下一次**无审计的状态变更**。PUT 那一支是「冻结了但账上没有」;**DELETE 那一支更重**
@@ -231,7 +231,7 @@ export declare class SqlRetentionLaneStore implements RetentionLaneStore {
      *
      * `before` = 上一页最后一行的 `id`(严格小于)。
      *
-     * 🔴 读上限是 `MAX_LIMIT + 1` 而不是 `MAX_LIMIT`(codex 对抗复审 R1-[medium],验真属实):调用方要判
+     * 🔴 读上限是 `MAX_LIMIT + 1` 而不是 `MAX_LIMIT`(codex 交叉复审 R1-[medium],验真属实):调用方要判
      * 「还有没有下一页」就得多取一行,而**页**的上限是 `MAX_LIMIT`。旧形把 limit 无条件夹到 `MAX_LIMIT`
      * ⇒ 请求 `limit=200` 时 scanned 恒 ≤ 200 ⇒ `hasMore` 恒 false ⇒ **第 201 行之后的审计对这条分页链
      * 永久不可达**。这一格是「窗的上限」与「探路的那一行」两个不同的数被写成同一个数造成的,

package/dist/plugins/retention-store-sql.d.ts

@@ -217,7 +217,7 @@ export declare class SqlRetentionStore implements ManagedRetentionCapability {
      *     一条既存的 hold(两方言的这两个动词都只在缺行时写),只保证**接下来那把行锁有东西可锁**;
      *  ② `SELECT held … FOR UPDATE` —— 现在这行必定存在,于是锁真的拿到了。
      *
-     * 🔴 为什么必须先造行(codex 对抗复审 R1-[high],验真后改):`FOR UPDATE` 锁不住缺席行(TiDB 无 gap
+     * 🔴 为什么必须先造行(codex 交叉复审 R1-[high],验真后改):`FOR UPDATE` 锁不住缺席行(TiDB 无 gap
      * lock;PG READ COMMITTED 同样)。presence 形(「行在 = 冻结」)下,operator 的 PUT 与本事务可以**同时**
      * 都读到「没有 hold」,PUT 提交返回成功之后本事务照删不误 —— 设计稿 §5 声称由行锁给出的串行化在那一形
      * 上根本不存在。哨兵行把 hold 的写点与删除的读点压到**同一把行锁**上,那句承诺才成立。
@@ -309,7 +309,7 @@ export declare class SqlRetentionStore implements ManagedRetentionCapability {
     /**
      * **可过期**的候选 token(保护谓词写在 SQL 里、扣在 `LIMIT` **之前**)。
      *
-     * 🔴 为什么保护必须下推(codex 对抗复审 R1-[medium],验真后改):旧形先按时间取 N 行、再在 JS 里剔除
+     * 🔴 为什么保护必须下推(codex 交叉复审 R1-[medium],验真后改):旧形先按时间取 N 行、再在 JS 里剔除
      * pinned —— 只要最老的一批持续被占着,每轮取回的都是同一批、每轮删 0,**它们后面**那些同样过期、又
      * 没有任何引用的行**永远轮不到**。那不是「下一拍自然收敛」,那是一个域的留存静默停摆(而且读数一直
      * 是 deleted=0,看上去像"没有候选")。判据下推之后 LIMIT 扣的是**真能动的行**,头部被保护多少行都不
@@ -319,7 +319,7 @@ export declare class SqlRetentionStore implements ManagedRetentionCapability {
     /**
      * 过期视界之内、**当下被 live-pin 护住**的 pending 行数 = receipt 的 `skipped`。
      *
-     * 🔴 账法定谳(两轮对抗复审各推了一次,最终落在这一形):
+     * 🔴 账法定谳(两轮交叉复审各推了一次,最终落在这一形):
      *  · 曾经用「候选 + pinned 两读相加当分母、差值当 skipped」——被 codex R2 抓到会把中途翻转 pin 的行数两遍;
      *  · 改成「视界总数当分母、差值当 skipped」——被 codex R3 抓到在 PG 的 READ COMMITTED 下可以**为负**
      *    (分母读完之后又有行被 put/reopen 成 pending,候选与 UPDATE 都看得见它 ⇒ expired > 分母),而一条
@@ -356,7 +356,7 @@ export declare class SqlRetentionStore implements ManagedRetentionCapability {
      * **可删**的会话 id:本域、过视界、且四条活引用腿**一条都不命中**(保护谓词下推,扣在 LIMIT 之前 ——
      * 理由与 {@link expiryCandidates} 逐字相同:头部被保护的树不许饿死它后面的树)。
      *
-     * `lock = true`(删除事务里的读)追加 `FOR UPDATE`,这一格是**承重**的(codex 对抗复审 R1-[high]):
+     * `lock = true`(删除事务里的读)追加 `FOR UPDATE`,这一格是**承重**的(codex 交叉复审 R1-[high]):
      *  · 会话行是**存在**的行 ⇒ 这把锁与 hold 哨兵不同,它真的锁得住;
      *  · 锁住之后,并发的 `touch()`(把会话重新拉进视界)与 session-sync 的 **owner 改写**(importEntries /
      *    replaceEntries / staged commit 都会重写 `session_meta.owner`)必须排队等我们提交 —— 否则「按旧候选集
@@ -371,11 +371,11 @@ export declare class SqlRetentionStore implements ManagedRetentionCapability {
     /**
      * 本域**可归属**的孤儿卸载结果(属主 session 已亡 + 墓碑归属本域 + 归属**无歧义**)。
      *
-     * 🔴 第三个条件是 fail-closed 的归属门(codex 对抗复审 R3-[high],验真后加):`tool_result` 没有域列,
+     * 🔴 第三个条件是 fail-closed 的归属门(codex 交叉复审 R3-[high],验真后加):`tool_result` 没有域列,
      * 它的域完全靠「属主 sessionId 的墓碑」推。而会话 id 是**调用方可自选**的 ⇒ 两个租户先后用过同一个 id
      * 完全合法;两边都删过之后,同一个 row_key 上会有**两个域**的墓碑,这时任何一边的 sweep 拿自己的墓碑
      * 去认领这些字节都只是猜。判据因此是:**存在第二个域的同名墓碑 ⇒ 这批行不可归属 ⇒ 一根不删**,
-     * 实体清理退回既有的 TTL 腿(`reapOlderThan`)。少删一次是可接受的;删掉另一个租户的字节、还绕过它的
+     * 实体清理退回既有的 TTL 腿(`reapOlderThan`)。少删一次是可接受的;删掉另一个租户的字节、还跳过它的
      * legal hold 与审计域,不可接受。
      */
     protected orphanToolResultCandidates(exec: {
@@ -394,7 +394,7 @@ export declare class SqlRetentionStore implements ManagedRetentionCapability {
      *      {@link SqlRetentionStore.sessionCandidates});
      *   ③ 按 E21 顺序逐表删 → 墓碑 → 审计行(同事务)→ COMMIT。
      *
-     * 🔴 活引用重查为什么是**候选查询本身**而不是第二条查询(codex 对抗复审 R1 的两条 high 合并采纳):
+     * 🔴 活引用重查为什么是**候选查询本身**而不是第二条查询(codex 交叉复审 R1 的两条 high 合并采纳):
      *  · 两条查询之间有窗口,而下推之后「被查到的」按构造就是「四条腿一条都不命中的」;
      *  · `FOR UPDATE` 让这些会话行在本事务期间不可被 `touch()` 拉回视界、也不可被 session-sync 改写属主 ——
      *    旧形(不加锁 + 尾部无条件删 `session_event`)可以在属主被并发改写后,把**别的租户**的历史删掉;

package/dist/plugins/retention-store-sql.js

@@ -373,6 +373,12 @@ export class SqlRetentionStore {
             ["session_policy", "session_id"],
             ...(this.opts.taskAttachmentTable ? [["task_attachment", "session_id"]] : []),
             ["snapshot_manifest", "scope"],
+            ["file_history_tracked", "scope"],
+            ["file_history_version", "scope"],
+            ["file_history_boundary", "scope"],
+            ["file_history_boundary_file", "scope"],
+            ["file_history_scope", "scope"],
+            ["file_history_reaped_entry", "scope"],
         ]) {
             const s = set(col, 1);
             await conn.query(`DELETE FROM ${table} WHERE ${s.sql}`, s.params);

package/dist/plugins/run-store-sql.d.ts

@@ -152,8 +152,14 @@ export declare class SqlRunStore {
      * this the row sits at `suspended`/updated_at=suspend-time for the WHOLE resume execution, so a resume that
      * crosses the TTL is marked `failed` mid-run and its session lock (`task_active`) is released. Returns true
      * if it claimed the flip (false ⇒ the reaper already expired it, or it isn't suspended).
+     *
+     * S-51(codex R1 [medium],红先双库证):认领 = **接管 `instance_id`**。此前该列只在 createRun 铸、此处不动,
+     * 于是 A 创建、C 认领 resume 的行永远记 A —— 而 steer/interrupt 的「他副本」臂与 sendHandleMiss 都拿这列当
+     * 「当前持有者」证据:verify 形 resume 腿(不登记 steerable)在 C 上跑时,C 读到 A≠C 就谎报「run 在别的副本」。
+     * 语义自此成文:`instance_id` = **当前持有副本**(createRun 铸、markResuming 认领接管);CAS 输不改列
+     * (一个输掉的认领不许覆盖赢家的持有记录——同一条条件 UPDATE 天然保证)。
      */
-    markResuming(taskId: string): Promise<boolean>;
+    markResuming(taskId: string, instanceId: string): Promise<boolean>;
     /** The active run's taskId for a session (the `task_active` claim) — lets resume find the suspended run row. */
     getActiveTaskId(sessionId: string): Promise<string | undefined>;
     /** Shared row→record mapper — byte-identical between dialects (both drivers hand back the same column
@@ -215,7 +221,7 @@ export declare class SqlRunStore {
      * 右删失效**(anchors 腿的注逐字写着这句)。删除决策的属主门在**路由层**(DELETE /v1/sessions/:id 先
      * `ownerOf` 再比对 scope,fleet-wide 臂同门),本方法的唯一生产调用点是那条路由后面的 purge 协调器。
      *
-     * 🔴 **化身围栏**(`expectedSessionOwner`;codex 对抗复审 R1-[high],验真后修)—— 属主门下来了,但会话
+     * 🔴 **化身围栏**(`expectedSessionOwner`;codex 交叉复审 R1-[high],验真后修)—— 属主门下来了,但会话
      * **身份**必须在同一个事务里重新确认。会话 id 由调用方自选、且删除之后**可被别人重新登记**
      * (`register` 是 INSERT … ON DUPLICATE KEY / ON CONFLICT,老行没了就是一条新行,新 owner):于是
      * 「路由 `ownerOf` 已验权」这句话在两只并发 purge 交错时会过期 —— A 与 A' 同时通过属主门,A' 跑完整条
@@ -280,7 +286,7 @@ export declare class SqlRunStore {
      * the run + RELEASE its task_active (unlock the session). Mirrors the checkpoint reaper's CAS-expire (≈ deny);
      * idempotent across replicas. Returns count.
      *
-     * 🔴 design/80 D-D (adversarial blocker fix): SKIPS any row whose checkpoint is STILL pending — that row is
+     * 🔴 design/80 D-D (blocker fix): SKIPS any row whose checkpoint is STILL pending — that row is
      * owned by a checkpoint-state-driven sweep (the SLA deny-sweep for human/irreversible_ask, or
      * failSuspendedWithExpiredCheckpoint once the checkpoint is expired). Without this guard, this time-based
      * UPDATE fired at the SAME instant as the deny-sweep (deadline == createdAt + ttl, both keyed on the TTL),

package/dist/plugins/run-store-sql.js

@@ -132,8 +132,8 @@ export class SqlRunStore {
     async setNeedsReview(taskId) {
         await this.db.query(this.q("UPDATE task_run SET status = 'needs_review', updated_at = ? WHERE task_id = ? AND status IN ('running','needs_review')", "UPDATE task_run SET status = 'needs_review', updated_at = $1 WHERE task_id = $2 AND status IN ('running','needs_review')"), [new Date(), taskId]);
     }
-    async markResuming(taskId) {
-        const { affected } = await this.db.query(this.q("UPDATE task_run SET status = 'running', cancel_requested = 0, preempt_requested = 0, updated_at = ? WHERE task_id = ? AND status IN ('suspended','needs_review')", "UPDATE task_run SET status = 'running', cancel_requested = 0, preempt_requested = 0, updated_at = $1 WHERE task_id = $2 AND status IN ('suspended','needs_review')"), [new Date(), taskId]);
+    async markResuming(taskId, instanceId) {
+        const { affected } = await this.db.query(this.q("UPDATE task_run SET status = 'running', cancel_requested = 0, preempt_requested = 0, instance_id = ?, updated_at = ? WHERE task_id = ? AND status IN ('suspended','needs_review')", "UPDATE task_run SET status = 'running', cancel_requested = 0, preempt_requested = 0, instance_id = $1, updated_at = $2 WHERE task_id = $3 AND status IN ('suspended','needs_review')"), [instanceId, new Date(), taskId]);
         return affected === 1;
     }
     async getActiveTaskId(sessionId) {

package/dist/plugins/send-user-file.d.ts

@@ -8,7 +8,7 @@ export declare const PRESIGN_MAX_TTL_SEC = 604800;
  *  - keyed on the S3 SECRET KEY — server-held and stable, so the mapping is deterministic per deployment but
  *    unforgeable/unenumerable from outside (a URL holder cannot test principal guesses without the key);
  *  - the "sendfile-scope:" DOMAIN SEPARATOR pins this HMAC use — the same secret signs SigV4 requests, and a
- *    cross-protocol collision between "scope segment" and any other HMAC-of-attacker-controlled-string use is
+ *    cross-protocol collision between "scope segment" and any other HMAC-of-caller-controlled-string use is
  *    exactly what domain separation exists to prevent;
  *  - 32 hex chars (128 bits) is a NAMESPACE label, not a secret: the cross-tenant BIRTHDAY bound at even a
  *    billion tenants is ~n²/2^129 ≈ 2^-69 — negligible. (The earlier 16-hex/64-bit cut had a ~2.7% birthday

package/dist/plugins/session-placement.d.ts

@@ -96,7 +96,7 @@ export interface PlacementAcquireOpts {
  * · 方向①(claim 关门):`persisted` 在场 + 非 `requireExisting` + 调用方没带创建 placement ⇒ 拒。
  *   `requireExisting`(读/复活形,义务 5)与「创建调用及其幂等重取」(带 placement 的可信内部链)
  *   是仅有的两个合法形。placement 不可变意味着带 placement 的参数**永远重写不了**任何东西——持久化
- *   的那一份恒赢,所以放行它不开任何后门。
+ *   的那一份恒赢,所以放行它不开任何口子。
  * · 方向②(镜像/squat):带 placement 的创建形回读到**缺席**或**异组**元组 ⇒ 拒。缺席 = 并发的
  *   claim 形抢先建出了普通会话(或带外写把元组抹了);异组 = 同 id 上坐着另一条委派链的转录。
  *   两者都不许让「声明了 durable 分区」这句话在静默中变成谎。

package/dist/plugins/sql-errors.d.ts

@@ -50,7 +50,7 @@ export declare const MYSQL_ER_BAD_FIELD_CODE = "ER_BAD_FIELD_ERROR";
  * 🔴 单一属主的理由与 {@link isDupKeyError} 逐字同源(本文件顶注的 single-semantic-multi-site-drift):
  * 判据一旦复制,两处的识别集就会各自漂,而这条谓词的错判方向**特别贵** —— 它守的是一句**破坏性**的
  * 错误指路(「去 DROP TABLE」)。超时、连接重置、取消、资源不足、列级权限被拒、表整个不存在,每一种
- * 都会让探针抛错;把它们诊断成「删表重建」比它要挡的缺陷更贵(#340 codex 对抗复审 round2/round3
+ * 都会让探针抛错;把它们诊断成「删表重建」比它要挡的缺陷更贵(#340 codex 交叉复审 round2/round3
  * [high] 两轮收窄后的终形)。认不出的一律**不是**缺列(fail-safe:宁可把一次真缺列报成原始错误)。
  *
  * MySQL 侧两个归因键都认(mysql2 的 `code`/`errno` 是同一件事的两种写法),与 dup-key 那条同姿势。