@sema-agent/server 7.55.0 → 7.56.0

package/dist/plugins/permission-rule-store-file.d.ts

@@ -1,5 +1,5 @@
 import { FilePermissionRuleStoreProvider, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleScope, type StaleRuleApprovalRecord } from "@sema-agent/core";
-import { type RuleImportTicket, type RuleTicketDecisionClock, type RuleTicketPurpose, type RuleTicketReclaimResult, type RuleTicketRedeemResult, type RuleTicketSnapshot } from "./permission-rule-store-sql.js";
+import { type RuleImportTicket, type RuleTicketPurpose, type RuleTicketReclaimResult, type RuleTicketRedeemResult, type RuleTicketSnapshot } from "./permission-rule-store-sql.js";
 import type { PermissionRuleStoreBundle } from "../rules-consent.js";
 /**
  * `RuleApprovalRecordStore` 的 File 形。
@@ -29,17 +29,34 @@ export declare class FileRuleApprovalRecordStore implements RuleApprovalRecordSt
 /**
  * CC 导入票的 File 形。四条信任边界(principal 绑定 / TTL / 一次性原子消费 / 载荷绑定)与 SQL 形
  * **同语义**;唯一不同的是「原子」由谁保证 —— 那边是引擎行锁,这边是单进程 + 单写者(顶注)。
+ *
+ * 🔴 **每只店对自己那口钟负责**([ref]):SQL 形的 TTL 轴锚在数据库的钟上(多副本共享的唯一一口);
+ * local 形没有那样一口外部钟,它的钟就是本进程的 —— 而进程墙钟**不单调**,一次 NTP 回拨就能让一张
+ * 真实已经走满 TTL 的票复活(codex 对抗复审 r1 [high],验真后修)。所以本形自己带一枚**单调锚**:
+ * 本进程铸的票,判定钟 = `铸票墙钟 + 自铸票起单调钟走过的量`;重启后重放回来的行没有锚,如实退回墙钟。
  */
 export declare class FileRuleImportTicketStore {
     private readonly rows;
     private readonly log;
     private readonly gate;
-    constructor(dir: string, now?: () => number, onError?: (message: string) => void);
+    /** 单调钟(判定用)。与 {@link now}(墙钟,记账用)是两只不同的钟,别混。 */
+    private readonly monotonic;
+    constructor(dir: string, now?: () => number, onError?: (message: string) => void, monotonic?: () => number);
     private readonly now;
     /** 取证/自证用:本面是否因内部损坏而 fail-closed。 */
     get corrupt(): boolean;
     /** 归还本面 eager 持有的日志描述符(理由与姊妹面 {@link FileRuleApprovalRecordStore.close} 逐字同源)。 */
     close(): void;
+    /**
+     * 这一刻的**判定钟**([ref] r1-F1)。
+     *
+     * 本进程铸的票 ⇒ `铸票墙钟 + 自铸票起单调钟走过的量`:墙钟被前拨不会误杀(真实只过了几秒的票还活着),
+     * 被回拨也不会续命(单调钟照走)。重启后重放回来的行没有锚 ⇒ 退回墙钟(单调钟的零点跨进程无意义)。
+     *
+     * **给不了票额外寿命**:投影严格按单调钟前进,真实走满 TTL 必然越过 `expiresAtMs`(负控钉在
+     * `permission-rule-store-file.test.ts` 的 [ref] r1-F1 族)。
+     */
+    private decisionNowMs;
     mint(input: {
         ticketId: string;
         principal: string;
@@ -53,11 +70,11 @@ export declare class FileRuleImportTicketStore {
     }): Promise<RuleImportTicket>;
     /** 一次性**认领**。五条否定项的判序与 SQL 形逐字相同(unknown → wrong-principal → wrong-purpose →
      *  consumed → expired),于是两形的服务端日志归因可比;wire 面把五类折成同一个 404(零存在性 oracle)。 */
-    consume(ticketId: string, principal: string, purpose: RuleTicketPurpose, opts?: RuleTicketDecisionClock): Promise<RuleTicketRedeemResult>;
+    consume(ticketId: string, principal: string, purpose: RuleTicketPurpose): Promise<RuleTicketRedeemResult>;
     /** 把认领**放回去**。`mustRemainValidMs` = 放回之后至少还要能用多久 —— 撑不过就不算放回成功
      *  (理由逐字见 SQL 侧 `release` 的头注:承诺一次必然兑现不了的重试比不承诺更坏)。
      *  `claimId` = A7 的认领围栏(R1-F1):被顶替的旧持有者动不了现持有者的认领。 */
-    release(ticketId: string, principal: string, claimId: string, mustRemainValidMs?: number, opts?: RuleTicketDecisionClock): Promise<boolean>;
+    release(ticketId: string, principal: string, claimId: string, mustRemainValidMs?: number): Promise<boolean>;
     /** [ref] A7 CLAIMED → **SETTLED**。判据与 SQL 孪生逐字同源(持有**这一代**认领 ∧ 未落定;过期
      *  **刻意不设门** —— 理由逐字见 SQL 侧 `settle` 的头注:拒绝记录一件已经发生的事只会把真相丢掉)。 */
     settle(ticketId: string, principal: string, claimId: string, outcome: unknown): Promise<boolean>;
@@ -89,5 +106,6 @@ export interface FilePermissionRuleStores extends PermissionRuleStoreBundle {
 export declare function createFilePermissionRuleStores(root: string, opts?: {
     onError?: (message: string) => void;
     now?: () => number;
+    monotonic?: () => number;
 }): FilePermissionRuleStores;
 //# sourceMappingURL=permission-rule-store-file.d.ts.map

package/dist/plugins/permission-rule-store-file.js

@@ -1,6 +1,7 @@
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
 import { readdirSync } from "node:fs";
+import { performance } from "node:perf_hooks";
 import { FilePermissionRuleStoreProvider, AppendLog, ensureDir, readJsonlRecords, } from "@sema-agent/core";
 import { z } from "zod";
 import { buildRulePayloadHash } from "./permission-rule-store-sql.js";
@@ -195,8 +196,10 @@ export class FileRuleImportTicketStore {
     rows = new Map();
     log;
     gate;
-    constructor(dir, now, onError) {
+    monotonic;
+    constructor(dir, now, onError, monotonic) {
         this.now = now ?? Date.now;
+        this.monotonic = monotonic ?? (() => performance.now());
         ensureDir(dir);
         const path = join(dir, "import-tickets.jsonl");
         this.gate = new CorruptionGate("permission-rule import-ticket log", path, onError);
@@ -247,15 +250,21 @@ export class FileRuleImportTicketStore {
     close() {
         this.log.close();
     }
+    decisionNowMs(row) {
+        const a = row.mintAnchor;
+        return a === undefined ? this.now() : a.wallMs + (this.monotonic() - a.monoMs);
+    }
     async mint(input) {
         this.gate.assertUsable();
-        const expiresAtMs = this.now() + input.ttlMs;
+        const mintedAtWall = this.now();
+        const mintedAtMono = this.monotonic();
+        const expiresAtMs = mintedAtWall + input.ttlMs;
         const payloadHash = buildRulePayloadHash(input.candidates);
         this.log.append({ op: "mint", ticketId: input.ticketId, ownerKey: input.principal, approvalId: input.approvalId, payloadHash, purpose: input.purpose, expiresAtMs }, true);
-        this.rows.set(input.ticketId, { ownerKey: input.principal, approvalId: input.approvalId, payloadHash, purpose: input.purpose, expiresAtMs });
+        this.rows.set(input.ticketId, { ownerKey: input.principal, approvalId: input.approvalId, payloadHash, purpose: input.purpose, expiresAtMs, mintAnchor: { wallMs: mintedAtWall, monoMs: mintedAtMono } });
         return { ticketId: input.ticketId, approvalId: input.approvalId, payloadHash, expiresAtMs };
     }
-    async consume(ticketId, principal, purpose, opts) {
+    async consume(ticketId, principal, purpose) {
         this.gate.assertUsable();
         const row = this.rows.get(ticketId);
         if (row === undefined)
@@ -267,7 +276,7 @@ export class FileRuleImportTicketStore {
         if (row.consumedAtMs !== undefined)
             return { ok: false, reason: "consumed" };
         const stampMs = this.now();
-        if (row.expiresAtMs <= (opts?.decisionNowMs ?? stampMs))
+        if (row.expiresAtMs <= this.decisionNowMs(row))
             return { ok: false, reason: "expired" };
         const claimId = randomUUID();
         this.log.append({ op: "consume", ticketId, atMs: stampMs, claimId }, true);
@@ -275,12 +284,12 @@ export class FileRuleImportTicketStore {
         row.claimId = claimId;
         return { ok: true, approvalId: row.approvalId, payloadHash: row.payloadHash, claimId };
     }
-    async release(ticketId, principal, claimId, mustRemainValidMs = 0, opts) {
+    async release(ticketId, principal, claimId, mustRemainValidMs = 0) {
         this.gate.assertUsable();
         const row = this.rows.get(ticketId);
         if (row === undefined || row.ownerKey !== principal || row.consumedAtMs === undefined || row.claimId !== claimId || row.outcome !== undefined)
             return false;
-        if (row.expiresAtMs <= (opts?.decisionNowMs ?? this.now()) + mustRemainValidMs)
+        if (row.expiresAtMs <= this.decisionNowMs(row) + mustRemainValidMs)
             return false;
         this.log.append({ op: "release", ticketId }, true);
         delete row.consumedAtMs;
@@ -329,7 +338,7 @@ export function createFilePermissionRuleStores(root, opts) {
     ensureDir(dir);
     const provider = opts?.onError ? new FilePermissionRuleStoreProvider(dir, opts.onError) : new FilePermissionRuleStoreProvider(dir);
     const approvals = new FileRuleApprovalRecordStore(dir, opts?.onError);
-    const tickets = new FileRuleImportTicketStore(dir, opts?.now, opts?.onError);
+    const tickets = new FileRuleImportTicketStore(dir, opts?.now, opts?.onError, opts?.monotonic);
     return {
         provider,
         approvals,

package/dist/plugins/permission-rule-store-sql.d.ts

@@ -195,16 +195,6 @@ export type RuleTicketRedeemResult = {
     ok: false;
     reason: "unknown" | "wrong-principal" | "wrong-purpose" | "expired" | "consumed";
 };
-/**
- * [ref]③/[ref]③ —— 票的**判定钟**覆写(记账钟永远不覆写,见 `consume` 内注)。
- *
- * 缺席 = 墙钟,既有行为逐字不变。在场 = 调用方(同意车道)按**单调锚**投影出来的那个时刻:
- * 铸票时刻的墙钟 + 自铸票起单调钟走过的量。它只能让判定更贴近**真实经过的时间**,给不了票额外寿命
- * (投影按单调钟前进,走满 TTL 就必然越过 `expires_at_ms`)。
- */
-export interface RuleTicketDecisionClock {
-    decisionNowMs?: number;
-}
 /**
  * [ref] A7 —— 一张票的**三态快照**(MINTED → CLAIMED → SETTLED)。
  *
@@ -243,15 +233,18 @@ export type RuleTicketReclaimResult = {
     ok: false;
 };
 /**
- * [ref]③ 同族的 **GC 宽限**:`reapExpired` 只收「按墙钟至少已死一个完整 TTL」的票行。
+ * [ref]③ 同族的 **GC 宽限**:`reapExpired` 只收「按**数据库的钟**至少已死一个完整 TTL」的票行。
  *
- * 为什么需要它:判定侧改单调锚之后,一张「按墙钟已过期、按单调钟还在窗内」的票是**可兑付**的;
- * 若 GC 仍按 `expires_at_ms <= now` 收行,判定修好了而行先没了 —— 用户拿到的从 `expired` 变成 `unknown`,
- * 缺陷只是换了个归因。宽限一个 TTL 覆盖住「铸票时钟慢了不到一个 TTL」这一族(含 [ref]③ 的真实构造)。
+ * 🔴 立论已换([ref] / [ref]):它原本是给单调锚兜底的 —— 一张「按墙钟已过期、按单调钟还在窗内」的
+ * 票当年是可兑付的,GC 不能抢在判定前面把行收走。TTL 轴整条搬到数据库的钟之后,那一族**从根上没有了**
+ * (判定与清扫从此同一口钟、同一个不等号,不可能一个说活一个说死)。留着它的现由是另外两条,都成立:
+ *  · **归因质量**:行还在 ⇒ 拒绝是 `expired`(服务端日志说得清「票过期了」);行被收走 ⇒ 塌成 `unknown`。
+ *    死票在库里多躺一个宽限,换来运维排查时一个准确的归因,而票表按设计是短命小表,代价可忽略。
+ *  · **数据库自己的钟也会被拨**(DB 主机的 NTP 纠正、或一次主从切换换了台机器)。宽限一个 TTL 覆盖住
+ *    「DB 钟被往前拨了不到一个 TTL」这一族:那种时刻 `consume` 会暂时拒,但行还在,钟走回来票就活。
  *
- * 残余(如实登记,不假称已解):墙钟被拨慢**超过**一个 TTL 时,行仍可能在单调窗内被收。彻底解需要行上
- * 存单调基准,而单调基准跨进程无意义(core [ref] 的判词)。补偿是现成的:prepare 廉价,重铸一张即可
- * ——这正是 core 建议的姿态(「接受 + 票廉价重铸」)。
+ * 残余(如实登记,不假称已解):DB 钟被往前拨**超过**一个 TTL 时,行仍会被收。补偿是现成的:prepare
+ * 廉价,重铸一张即可(core [ref] 建议的姿态)。
  */
 export declare const RULE_IMPORT_TICKET_GC_GRACE_MS: number;
 /**
@@ -262,11 +255,17 @@ export declare const RULE_IMPORT_TICKET_GC_GRACE_MS: number;
  * 生出来的权威回执下一拍就被删,而"落定之后必有一个完整的回放窗"是本批新许下的承诺 —— 它不能建立在
  * 「两台机器的钟差不多」这条没人声明过的假设上。数据库的钟是这两台副本**唯一**共享的那口钟。
  *
- * 🔴 射程更新(车K 2026-08-30 对账):`consumed_at_ms` 自 R8-F2 起**也走本钟**(`consume` 的 UPDATE
- * 直写本常量,见其行注);仍留在副本墙钟域的是 `expires_at_ms` / `created_at_ms` 两列 —— 那是
- * cc-import 车道的**既存已登记残余**([ref]③,收口方向逐字见
- * `rules-consent.ts` 的 anchors 头注),把它一并搬走会改动两条车道共用的认领谓词,不在本批射程。
- * 这一句同时也是那次收口的**样板**:形已经在这里了,下一批照抄即可。
+ * 🔴 射程收官([ref] / [ref],2026-09-02):**这张票上的每一个时刻量都走本钟**,一个不剩 ——
+ * `consumed_at_ms` / `settled_at_ms`(R8-F2 起)、`expires_at_ms` / `created_at_ms`(本批)。
+ *
+ * 本批补上的是 **TTL 轴**,也是最后一条:铸票 `expires_at_ms = <本钟> + ttl`、判定
+ * `expires_at_ms > <本钟>`、清扫 `expires_at_ms <= <本钟> − 宽限`。修前那一形是**两台副本各出一半**的
+ * 比较(铸票副本的墙钟定到期时刻,兑付副本的墙钟做判定),于是 TTL 在集群上**不单调**:同一张票在钟慢
+ * 的那台上还活着、在钟快的那台上已经死了;极端形是「出生即过期」(铸票副本慢过一个 TTL ⇒ 票铸出来就
+ * 没人兑得动)。这不需要故障就能发作 —— 负载均衡把 prepare 与 redeem 分到两台副本是**常态**。
+ * 上一批的进程内单调锚只覆盖「同一副本铸、同一副本兑」那一格,连同它的台账在本批一并删除。
+ *
+ * 判定读不到本钟 ⇒ 语句抛错 ⇒ 调用方按不确定失败处置(fail-closed:绝不退回本地墙钟放行)。
  */
 export declare const SQL_DB_NOW_MS: {
     readonly tidb: "CAST(UNIX_TIMESTAMP(NOW(3)) * 1000 AS SIGNED)";
@@ -277,11 +276,37 @@ export declare function buildRulePayloadHash(candidates: ReadonlyArray<{
     rule: string;
     scope: RuleScope;
 }>): string;
+/**
+ * 票面三态协议的 SQL 实现。
+ *
+ * 🔴 **这只店没有本地钟 seam**([ref]):它此前收一个 `now: () => number`,而票上的每一个时刻量现在都由
+ * 数据库自己出({@link SQL_DB_NOW_MS})。留着那只形参会让人以为「注一只假钟就能改票的判决」——
+ * 那正是本批要消灭的那条依赖。测试要制造过期,改行(把 `expires_at_ms` 相对 `<db now>` 挪)即可,
+ * 而那恰恰也是生产上唯一能让票过期的方式。
+ */
 export declare class SqlRuleImportTicketStore {
     private readonly db;
-    private readonly now;
-    constructor(db: SqlDriver, now?: () => number);
+    constructor(db: SqlDriver);
     private q;
+    /**
+     * 问一次**数据库自己的钟**(毫秒)。铸票用它当基准,于是到期时刻与后续每一次判定同域。
+     *
+     * 读不出数 ⇒ **响亮抛**([ref] fail-closed):静默兜个本地 `Date.now()` 正是本批要删掉的那条腿,
+     * 而一次「钟读不出来」在授权面上是运维事件,不是一个可以猜的默认值。
+     */
+    private dbNowMs;
+    /**
+     * 铸一张票。
+     *
+     * 🔴 到期时刻 = **数据库的钟** + TTL([ref] / [ref]),不是这台副本的墙钟 + TTL。理由逐字见
+     * {@link SQL_DB_NOW_MS} 的头注:铸造点与判定点必须同一口钟,否则 TTL 在集群上不单调。
+     *
+     * 为什么是「先问一次钟、再把绝对值写进去」而不是「INSERT 里直接写 `<db now> + ?`」:`expiresAtMs`
+     * 要**原样上 wire**(prepare 的响应体里有它,客户端拿它显示倒计时),而 MySQL 的 INSERT 交不回
+     * 计算列 —— 那一形要么再补一条 SELECT 读回来(失败时留一行孤儿),要么两方言各写一套(PG 有
+     * `RETURNING`、MySQL 没有,两份会各自漂)。先问钟的形只有一个失败方向:钟没问到 ⇒ 一行都没落,
+     * 调用方原样收错。两跳之间流逝的那点时间只会让票**略短命**,方向保守。
+     */
     mint(input: {
         ticketId: string;
         principal: string;
@@ -308,7 +333,7 @@ export declare class SqlRuleImportTicketStore {
      * wrong-purpose/expired/consumed 五类给服务端日志;wire 面把五类折成同一个 404)。预读说「可以」而 UPDATE 命中零行,
      * 只可能是我们在这两跳之间输给了一个并发认领者 —— 如实报 `consumed`,而不是把这次失败当成成功。
      */
-    consume(ticketId: string, principal: string, purpose: RuleTicketPurpose, opts?: RuleTicketDecisionClock): Promise<RuleTicketRedeemResult>;
+    consume(ticketId: string, principal: string, purpose: RuleTicketPurpose): Promise<RuleTicketRedeemResult>;
     /**
      * **认领的释放**(codex 交叉复审 round1 [high] 一,验真后修)。
      *
@@ -325,7 +350,7 @@ export declare class SqlRuleImportTicketStore {
      * 期间属主可以重新走 prepare 拿一张新票(导入是幂等的:同一条规则再兑付只是同一个 dot 的重放)。
      * 要彻底消灭它需要一条带租约到期的认领状态机,属协议改动,列为后续件。
      */
-    release(ticketId: string, principal: string, claimId: string, mustRemainValidMs?: number, opts?: RuleTicketDecisionClock): Promise<boolean>;
+    release(ticketId: string, principal: string, claimId: string, mustRemainValidMs?: number): Promise<boolean>;
     /**
      * [ref] A7 —— CLAIMED → **SETTLED**:把这一次兑付的终局写进行里。
      *
@@ -427,11 +452,16 @@ export interface PermissionRuleStores {
      *    「超帽当场拒」那一条路,不收「人改主意了」)。
      *
      * 两张表的谓词都只删**可证已死**的行,所以本腿不需要旋钮(没有可调的语义):
-     *  · 票(三支 OR,A7 交叉复审定形,逐支论证见 reapExpired 实现内注):甲=从未认领且已过期;
-     *    乙=已落定且落定后过 GC 宽限(按 `settled_at_ms` 判,走 DB 钟);丙=CLAIMED-未结且认领戳老过
-     *    废弃期(按 `consumed_at_ms` 判,走 DB 钟);
-     *  · 记录:`state = 'pending' AND created_at_ms < now − {@link RULE_PENDING_APPROVAL_RETENTION_MS}`,
+     *  · 票(三支 OR,A7 交叉复审定形,逐支论证见 reapExpired 实现内注)**三支全走 DB 钟**([ref]):
+     *    甲=从未认领且过期已满 GC 宽限;乙=已落定且落定后过 GC 宽限(按 `settled_at_ms` 判);
+     *    丙=CLAIMED-未结且认领戳老过废弃期(按 `consumed_at_ms` 判);
+     *  · 记录:`state = 'pending' AND created_at_ms < nowMs − {@link RULE_PENDING_APPROVAL_RETENTION_MS}`,
      *    再加 `NOT EXISTS`(载荷必须陪着把手活,R6-F1:仍有票引用的 pending 记录不删)。
+     *
+     * 🔴 `nowMs` 形参**只剩记录那一支在用**,如实登记:`permission_rule_approval.created_at_ms` 是这台
+     * 副本自己写下的(见 {@link SqlRuleApprovalRecordStore}),按同一台副本的墙钟判"落盘满 24 小时了吗"
+     * 是**同域比较** —— 把它单独搬到 DB 钟反而会造出一次新的跨钟比较。那张表的钟域是另一条轴上的事,
+     * 不在本批射程(登记为后续件)。票那一支已经不看它了。
      */
     reapExpired(nowMs: number): Promise<number>;
 }

package/dist/plugins/permission-rule-store-sql.js

@@ -616,16 +616,21 @@ export function buildRulePayloadHash(candidates) {
 }
 export class SqlRuleImportTicketStore {
     db;
-    now;
-    constructor(db, now = Date.now) {
+    constructor(db) {
         this.db = db;
-        this.now = now;
     }
     q(tidbSql, pgSql) {
         return this.db.dialect === "tidb" ? tidbSql : pgSql;
     }
+    async dbNowMs() {
+        const { rows } = await this.db.query(this.q(`SELECT ${SQL_DB_NOW_MS.tidb} AS db_now_ms`, `SELECT ${SQL_DB_NOW_MS.pg} AS db_now_ms`), []);
+        const n = Number(rows[0]?.["db_now_ms"] ?? Number.NaN);
+        if (!Number.isFinite(n))
+            throw new Error(`${PERMISSION_RULE_TICKET_TABLE}: the database clock came back unreadable (${String(rows[0]?.["db_now_ms"])})`);
+        return n;
+    }
     async mint(input) {
-        const nowMs = this.now();
+        const nowMs = await this.dbNowMs();
         const expiresAtMs = nowMs + input.ttlMs;
         const payloadHash = buildRulePayloadHash(input.candidates);
         await this.db.query(this.q(`INSERT INTO ${PERMISSION_RULE_TICKET_TABLE} (ticket_id, owner_key, principal, approval_id, payload_hash, payload_json, expires_at_ms, consumed_at_ms, claim_id, purpose, created_at_ms)
@@ -643,8 +648,7 @@ export class SqlRuleImportTicketStore {
         ]);
         return { ticketId: input.ticketId, approvalId: input.approvalId, payloadHash, expiresAtMs };
     }
-    async consume(ticketId, principal, purpose, opts) {
-        const decisionNowMs = opts?.decisionNowMs ?? this.now();
+    async consume(ticketId, principal, purpose) {
         const ownerKey = buildRuleOwnerKey({ kind: "principal", principal });
         const row = await this.readRow(ticketId);
         if (row === undefined)
@@ -655,17 +659,23 @@ export class SqlRuleImportTicketStore {
             return { ok: false, reason: "wrong-purpose" };
         if (row.consumedAtMs !== undefined)
             return { ok: false, reason: "consumed" };
-        if (row.expiresAtMs <= decisionNowMs)
+        if (row.expiresAtMs <= row.dbNowMs)
             return { ok: false, reason: "expired" };
         const claimId = randomUUID();
-        const { affected } = await this.db.query(this.q(`UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = ${SQL_DB_NOW_MS.tidb}, claim_id = ? WHERE ticket_id = ? AND owner_key = ? AND purpose = ? AND consumed_at_ms IS NULL AND expires_at_ms > ?`, `UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = ${SQL_DB_NOW_MS.pg}, claim_id = $1 WHERE ticket_id = $2 AND owner_key = $3 AND purpose = $4 AND consumed_at_ms IS NULL AND expires_at_ms > $5`), [claimId, ticketId, ownerKey, purpose, decisionNowMs]);
+        const { affected } = await this.db.query(this.q(`UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = ${SQL_DB_NOW_MS.tidb}, claim_id = ? WHERE ticket_id = ? AND owner_key = ? AND purpose = ? AND consumed_at_ms IS NULL AND expires_at_ms > ${SQL_DB_NOW_MS.tidb}`, `UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = ${SQL_DB_NOW_MS.pg}, claim_id = $1 WHERE ticket_id = $2 AND owner_key = $3 AND purpose = $4 AND consumed_at_ms IS NULL AND expires_at_ms > ${SQL_DB_NOW_MS.pg}`), [claimId, ticketId, ownerKey, purpose]);
         if (affected === 1)
             return { ok: true, approvalId: row.approvalId, payloadHash: row.payloadHash, claimId };
+        const after = await this.readRow(ticketId);
+        if (after === undefined)
+            return { ok: false, reason: "unknown" };
+        if (after.consumedAtMs !== undefined)
+            return { ok: false, reason: "consumed" };
+        if (after.expiresAtMs <= after.dbNowMs)
+            return { ok: false, reason: "expired" };
         return { ok: false, reason: "consumed" };
     }
-    async release(ticketId, principal, claimId, mustRemainValidMs = 0, opts) {
-        const nowMs = opts?.decisionNowMs ?? this.now();
-        const { affected } = await this.db.query(this.q(`UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = NULL, claim_id = NULL WHERE ticket_id = ? AND owner_key = ? AND claim_id = ? AND consumed_at_ms IS NOT NULL AND redeemed_outcome IS NULL AND expires_at_ms > ?`, `UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = NULL, claim_id = NULL WHERE ticket_id = $1 AND owner_key = $2 AND claim_id = $3 AND consumed_at_ms IS NOT NULL AND redeemed_outcome IS NULL AND expires_at_ms > $4`), [ticketId, buildRuleOwnerKey({ kind: "principal", principal }), claimId, nowMs + mustRemainValidMs]);
+    async release(ticketId, principal, claimId, mustRemainValidMs = 0) {
+        const { affected } = await this.db.query(this.q(`UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = NULL, claim_id = NULL WHERE ticket_id = ? AND owner_key = ? AND claim_id = ? AND consumed_at_ms IS NOT NULL AND redeemed_outcome IS NULL AND expires_at_ms > ${SQL_DB_NOW_MS.tidb} + ?`, `UPDATE ${PERMISSION_RULE_TICKET_TABLE} SET consumed_at_ms = NULL, claim_id = NULL WHERE ticket_id = $1 AND owner_key = $2 AND claim_id = $3 AND consumed_at_ms IS NOT NULL AND redeemed_outcome IS NULL AND expires_at_ms > ${SQL_DB_NOW_MS.pg} + $4`), [ticketId, buildRuleOwnerKey({ kind: "principal", principal }), claimId, mustRemainValidMs]);
         return affected === 1;
     }
     async settle(ticketId, principal, claimId, outcome) {
@@ -730,9 +740,9 @@ export function createSqlPermissionRuleStores(db, now) {
     return {
         provider: new SqlPermissionRuleStoreProvider(db, now),
         approvals: new SqlRuleApprovalRecordStore(db, now),
-        tickets: new SqlRuleImportTicketStore(db, now),
+        tickets: new SqlRuleImportTicketStore(db),
         reapExpired: async (nowMs) => {
-            const deadTickets = await db.query(q(`DELETE FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE (consumed_at_ms IS NULL AND expires_at_ms <= ?) OR (redeemed_outcome IS NOT NULL AND settled_at_ms IS NOT NULL AND settled_at_ms <= ${SQL_DB_NOW_MS.tidb} - ${RULE_IMPORT_TICKET_GC_GRACE_MS}) OR (consumed_at_ms IS NOT NULL AND redeemed_outcome IS NULL AND consumed_at_ms < ${SQL_DB_NOW_MS.tidb} - ${RULE_PENDING_APPROVAL_RETENTION_MS}) LIMIT ${RULE_REAP_BATCH}`, `DELETE FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE ctid IN (SELECT ctid FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE (consumed_at_ms IS NULL AND expires_at_ms <= $1) OR (redeemed_outcome IS NOT NULL AND settled_at_ms IS NOT NULL AND settled_at_ms <= ${SQL_DB_NOW_MS.pg} - ${RULE_IMPORT_TICKET_GC_GRACE_MS}) OR (consumed_at_ms IS NOT NULL AND redeemed_outcome IS NULL AND consumed_at_ms < ${SQL_DB_NOW_MS.pg} - ${RULE_PENDING_APPROVAL_RETENTION_MS}) LIMIT ${RULE_REAP_BATCH})`), [nowMs - RULE_IMPORT_TICKET_GC_GRACE_MS]);
+            const deadTickets = await db.query(q(`DELETE FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE (consumed_at_ms IS NULL AND expires_at_ms <= ${SQL_DB_NOW_MS.tidb} - ${RULE_IMPORT_TICKET_GC_GRACE_MS}) OR (redeemed_outcome IS NOT NULL AND settled_at_ms IS NOT NULL AND settled_at_ms <= ${SQL_DB_NOW_MS.tidb} - ${RULE_IMPORT_TICKET_GC_GRACE_MS}) OR (consumed_at_ms IS NOT NULL AND redeemed_outcome IS NULL AND consumed_at_ms < ${SQL_DB_NOW_MS.tidb} - ${RULE_PENDING_APPROVAL_RETENTION_MS}) LIMIT ${RULE_REAP_BATCH}`, `DELETE FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE ctid IN (SELECT ctid FROM ${PERMISSION_RULE_TICKET_TABLE} WHERE (consumed_at_ms IS NULL AND expires_at_ms <= ${SQL_DB_NOW_MS.pg} - ${RULE_IMPORT_TICKET_GC_GRACE_MS}) OR (redeemed_outcome IS NOT NULL AND settled_at_ms IS NOT NULL AND settled_at_ms <= ${SQL_DB_NOW_MS.pg} - ${RULE_IMPORT_TICKET_GC_GRACE_MS}) OR (consumed_at_ms IS NOT NULL AND redeemed_outcome IS NULL AND consumed_at_ms < ${SQL_DB_NOW_MS.pg} - ${RULE_PENDING_APPROVAL_RETENTION_MS}) LIMIT ${RULE_REAP_BATCH})`), []);
             const orphanPending = await db.query(q(`DELETE FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE state = 'pending' AND created_at_ms < ? AND NOT EXISTS (SELECT 1 FROM ${PERMISSION_RULE_TICKET_TABLE} t WHERE t.approval_id = ${PERMISSION_RULE_APPROVAL_TABLE}.record_id) LIMIT ${RULE_REAP_BATCH}`, `DELETE FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE ctid IN (SELECT a.ctid FROM ${PERMISSION_RULE_APPROVAL_TABLE} a WHERE a.state = 'pending' AND a.created_at_ms < $1 AND NOT EXISTS (SELECT 1 FROM ${PERMISSION_RULE_TICKET_TABLE} t WHERE t.approval_id = a.record_id) LIMIT ${RULE_REAP_BATCH})`), [nowMs - RULE_PENDING_APPROVAL_RETENTION_MS]);
             return deadTickets.affected + orphanPending.affected;
         },

package/dist/plugins/pg-session-storage.js

@@ -310,25 +310,29 @@ export class PgSessionStore {
             where.push(`(sm.updated_at < ${a} OR (sm.updated_at = ${b} AND sm.session_id < ${sid}))`);
         }
         const sql = "SELECT sm.session_id, sm.owner, sm.updated_at AS last_activity, sm.created_at AS first_activity, sm.title, " +
-            "  COALESCE(r.run_count, 0) AS run_count, latest.objective_preview, latest.status, latest.task_id AS last_run_id " +
+            "  COALESCE(r.run_count, 0) AS run_count, latest.objective_preview, latest.status, latest.task_id AS last_run_id, latest.last_task_run_id " +
             "FROM session_meta sm " +
             "LEFT JOIN (SELECT session_id, COUNT(*) AS run_count FROM task_run GROUP BY session_id) r ON r.session_id = sm.session_id " +
-            "LEFT JOIN (SELECT DISTINCT ON (session_id) session_id, objective_preview, status, task_id FROM task_run " +
+            "LEFT JOIN (SELECT DISTINCT ON (session_id) session_id, objective_preview, status, task_id, result ->> 'runId' AS last_task_run_id FROM task_run " +
             "  ORDER BY session_id, created_at DESC, task_id DESC) latest ON latest.session_id = sm.session_id " +
             (where.length ? "WHERE " + where.join(" AND ") + " " : "") +
             `ORDER BY sm.updated_at DESC, sm.session_id DESC LIMIT ${ph(opts.limit)}`;
         const res = await this.pool.query(sql, params);
-        return res.rows.map((r) => ({
-            sessionId: String(r.session_id),
-            owner: r.owner ?? null,
-            lastActivityAt: r.last_activity instanceof Date ? r.last_activity.toISOString() : String(r.last_activity),
-            firstActivityAt: r.first_activity instanceof Date ? r.first_activity.toISOString() : String(r.first_activity),
-            runCount: Number(r.run_count),
-            objectivePreview: r.objective_preview ?? null,
-            lastStatus: r.status == null ? "" : String(r.status),
-            lastRunId: r.last_run_id ?? null,
-            title: r.title ?? null,
-        }));
+        return res.rows.map((r) => {
+            const runId = r.last_task_run_id;
+            return {
+                sessionId: String(r.session_id),
+                owner: r.owner ?? null,
+                lastActivityAt: r.last_activity instanceof Date ? r.last_activity.toISOString() : String(r.last_activity),
+                firstActivityAt: r.first_activity instanceof Date ? r.first_activity.toISOString() : String(r.first_activity),
+                runCount: Number(r.run_count),
+                objectivePreview: r.objective_preview ?? null,
+                lastStatus: r.status == null ? "" : String(r.status),
+                lastRunId: r.last_run_id ?? null,
+                ...(typeof runId === "string" && runId !== "" ? { lastTaskRunId: runId } : {}),
+                title: r.title ?? null,
+            };
+        });
     }
     async probeTitle(sessionId) {
         const res = await this.pool.query("SELECT title FROM session_meta WHERE session_id = $1", [sessionId]);

package/dist/plugins/run-store-sql.js

@@ -237,8 +237,8 @@ export class SqlRunStore {
                 outer.push("(last_activity < ? OR (last_activity = ? AND session_id < ?))");
                 params.push(new Date(opts.cursor.lastActivityAt), new Date(opts.cursor.lastActivityAt), opts.cursor.sessionId);
             }
-            const sql = "SELECT session_id, owner, task_id, last_activity, first_activity, run_count, objective_preview, status FROM (" +
-                "SELECT session_id, owner, task_id, objective_preview, status," +
+            const sql = "SELECT session_id, owner, task_id, last_activity, first_activity, run_count, objective_preview, status, last_task_run_id FROM (" +
+                "SELECT session_id, owner, task_id, objective_preview, status, JSON_UNQUOTE(JSON_EXTRACT(result, '$.runId')) AS last_task_run_id," +
                 " ROW_NUMBER() OVER (PARTITION BY session_id ORDER BY created_at DESC, task_id DESC) AS rn," +
                 " MAX(created_at) OVER (PARTITION BY session_id) AS last_activity," +
                 " MIN(created_at) OVER (PARTITION BY session_id) AS first_activity," +
@@ -264,8 +264,8 @@ export class SqlRunStore {
             const sid = p(opts.cursor.sessionId);
             outer.push(`(last_activity < ${a} OR (last_activity = ${b} AND session_id < ${sid}))`);
         }
-        const sql = "SELECT session_id, owner, task_id, last_activity, first_activity, run_count, objective_preview, status FROM (" +
-            "SELECT session_id, owner, task_id, objective_preview, status," +
+        const sql = "SELECT session_id, owner, task_id, last_activity, first_activity, run_count, objective_preview, status, last_task_run_id FROM (" +
+            "SELECT session_id, owner, task_id, objective_preview, status, result ->> 'runId' AS last_task_run_id," +
             " ROW_NUMBER() OVER (PARTITION BY session_id ORDER BY created_at DESC, task_id DESC) AS rn," +
             " MAX(created_at) OVER (PARTITION BY session_id) AS last_activity," +
             " MIN(created_at) OVER (PARTITION BY session_id) AS first_activity," +
@@ -276,6 +276,7 @@ export class SqlRunStore {
         return rows.map((r) => this.rowToSession(r));
     }
     rowToSession(r) {
+        const lastTaskRunId = r.last_task_run_id;
         return {
             sessionId: String(r.session_id),
             owner: r.owner ?? null,
@@ -285,6 +286,7 @@ export class SqlRunStore {
             objectivePreview: r.objective_preview ?? null,
             lastStatus: String(r.status),
             lastRunId: r.task_id ?? null,
+            ...(typeof lastTaskRunId === "string" && lastTaskRunId !== "" ? { lastTaskRunId } : {}),
             title: null,
         };
     }

package/dist/plugins/store-contracts.d.ts

@@ -94,6 +94,10 @@ export interface SessionSummary {
     /** K-5c (shell §K): the LATEST run's task_id — the anchor the shell uses to re-attach the live event tail in ONE
      *  hop (`GET /v1/runs/:lastRunId/events`) when resuming a picked session, instead of a second lookup. */
     lastRunId: string | null;
+    /** [ref]([ref]/[ref]):latest 终局 run 的 engine runId(`TaskResult.runId`,latest.result JSON 提取的
+     *  零迁移路线 —— result 终局才写 ⇒ 在跑 run 键诚实缺席);OMIT-when-absent,恒不铸 null。轴辨析与
+     *  wire 半场见 `security.ts SessionListItem.lastTaskRunId`(同名同义)。 */
+    lastTaskRunId?: string;
     /** The auto-generated session title (cheap-model one-liner, write-once). null = not (yet)
      *  titled OR the lister face has no session_meta (the legacy task_run aggregate / memory twins — honest degrade). */
     title: string | null;

package/dist/plugins/tidb-session-store.js

@@ -144,28 +144,32 @@ export class TiDBSessionStore {
             params.push(new Date(opts.cursor.lastActivityAt), new Date(opts.cursor.lastActivityAt), opts.cursor.sessionId);
         }
         const sql = "SELECT sm.session_id, sm.owner, sm.updated_at AS last_activity, sm.created_at AS first_activity, sm.title, " +
-            "  COALESCE(r.run_count, 0) AS run_count, latest.objective_preview, latest.status, latest.task_id AS last_run_id " +
+            "  COALESCE(r.run_count, 0) AS run_count, latest.objective_preview, latest.status, latest.task_id AS last_run_id, latest.last_task_run_id " +
             "FROM session_meta sm " +
             "LEFT JOIN (SELECT session_id, COUNT(*) AS run_count FROM task_run GROUP BY session_id) r ON r.session_id = sm.session_id " +
-            "LEFT JOIN (SELECT session_id, objective_preview, status, task_id FROM (" +
-            "    SELECT session_id, objective_preview, status, task_id, " +
+            "LEFT JOIN (SELECT session_id, objective_preview, status, task_id, last_task_run_id FROM (" +
+            "    SELECT session_id, objective_preview, status, task_id, JSON_UNQUOTE(JSON_EXTRACT(result, '$.runId')) AS last_task_run_id, " +
             "      ROW_NUMBER() OVER (PARTITION BY session_id ORDER BY created_at DESC, task_id DESC) AS rn FROM task_run" +
             "  ) lr WHERE rn = 1) latest ON latest.session_id = sm.session_id " +
             (where.length ? "WHERE " + where.join(" AND ") + " " : "") +
             "ORDER BY sm.updated_at DESC, sm.session_id DESC LIMIT ?";
         params.push(opts.limit);
         const [rows] = await this.pool.query(sql, params);
-        return rows.map((r) => ({
-            sessionId: String(r.session_id),
-            owner: r.owner ?? null,
-            lastActivityAt: r.last_activity instanceof Date ? r.last_activity.toISOString() : String(r.last_activity),
-            firstActivityAt: r.first_activity instanceof Date ? r.first_activity.toISOString() : String(r.first_activity),
-            runCount: Number(r.run_count),
-            objectivePreview: r.objective_preview ?? null,
-            lastStatus: r.status == null ? "" : String(r.status),
-            lastRunId: r.last_run_id ?? null,
-            title: r.title ?? null,
-        }));
+        return rows.map((r) => {
+            const runId = r.last_task_run_id;
+            return {
+                sessionId: String(r.session_id),
+                owner: r.owner ?? null,
+                lastActivityAt: r.last_activity instanceof Date ? r.last_activity.toISOString() : String(r.last_activity),
+                firstActivityAt: r.first_activity instanceof Date ? r.first_activity.toISOString() : String(r.first_activity),
+                runCount: Number(r.run_count),
+                objectivePreview: r.objective_preview ?? null,
+                lastStatus: r.status == null ? "" : String(r.status),
+                lastRunId: r.last_run_id ?? null,
+                ...(typeof runId === "string" && runId !== "" ? { lastTaskRunId: runId } : {}),
+                title: r.title ?? null,
+            };
+        });
     }
     async probeTitle(sessionId) {
         const [rows] = await this.pool.query("SELECT title FROM session_meta WHERE session_id = ?", [sessionId]);

package/dist/rules-consent.d.ts

@@ -1,6 +1,6 @@
 import { type RuleOwner, type ImportPreview, type RedeemedBatchMember, type ImportedSettingsLayer, type PersistedAllowRule, type RemoveResult, type EditedRuleTextPrecheck, type RuleScope, type RuleOffer } from "@sema-agent/core";
 import type { PermissionRuleStoreProvider, RuleApprovalRecordStore } from "@sema-agent/core";
-import { type RuleImportTicket, type RuleTicketDecisionClock, type RuleTicketPurpose, type RuleTicketReclaimResult, type RuleTicketRedeemResult, type RuleTicketSnapshot } from "./plugins/permission-rule-store-sql.js";
+import { type RuleImportTicket, type RuleTicketPurpose, type RuleTicketReclaimResult, type RuleTicketRedeemResult, type RuleTicketSnapshot } from "./plugins/permission-rule-store-sql.js";
 /**
  * 本车道**真正**依赖的三面(**结构**接口,不是 SQL 类)。
  *
@@ -31,12 +31,13 @@ export interface RuleConsentStores {
         }): Promise<RuleImportTicket>;
         /** 一次**认领**(不是「已完成」)。语义与「认领之后怎么办」见 {@link RuleConsentStores.tickets.release}。
          *  `purpose` = 车道绑定(A7 R1-F2):一条车道的口只认它自己铸的票,不符与「票不存在」同形。
-         *  `opts.decisionNowMs` = [ref]③ 的判定钟覆写(记账列不受影响),见 {@link RuleTicketDecisionClock}。 */
-        consume(ticketId: string, principal: string, purpose: RuleTicketPurpose, opts?: RuleTicketDecisionClock): Promise<RuleTicketRedeemResult>;
+         *  🔴 **不收任何时刻量**([ref]):过期判定是店自己的事,由店那口钟(SQL=数据库的钟 / local=本进程的
+         *  墙钟)在**语句执行的那一刻**答。车道递一个时刻进来,就等于让副本的钟参与授权判决。 */
+        consume(ticketId: string, principal: string, purpose: RuleTicketPurpose): Promise<RuleTicketRedeemResult>;
         /** 把认领**放回去**(认领之后遇到不确定/瞬时失败时)。`claimId` = 本次认领的代次(A7 R1-F1 围栏:
          *  被顶替的旧持有者动不了现持有者的认领);`mustRemainValidMs` = 放回之后这张票至少还要能用多久
          *  —— 撑不过就**不算放回成功**(理由逐字见 store 侧 `release` 的头注)。 */
-        release(ticketId: string, principal: string, claimId: string, mustRemainValidMs?: number, opts?: RuleTicketDecisionClock): Promise<boolean>;
+        release(ticketId: string, principal: string, claimId: string, mustRemainValidMs?: number): Promise<boolean>;
         /**
          * [ref] A7 三态协议的三条口(CLAIMED → SETTLED / 三态快照 / 崩溃窗抢认领)。
          *