@sema-agent/server 7.57.0 → 7.59.0

package/dist/cross-session-settings.js

@@ -0,0 +1,37 @@
+export const CROSS_SESSION_INBOUND_LAYER_NAMES = ["managed", "user", "repo"];
+export const CROSS_SESSION_INBOUND_LAYER_SOURCES = {
+    managed: {
+        source: "CROSS_SESSION_INBOUND —— 部署/组织层旋钮(词表 accept|hold|refuse,未设=本层不设)",
+        wired: true,
+    },
+    user: {
+        source: "body.settings.crossSessionInbound —— 提交面明拒(unsupportedKeys 400,宽容层不读),因引擎座是部署级、无会话上下文," +
+            "把某一次提交的值塞进部署座会让一个会话的设置治理另一个会话;候上游每任务座或本仓 per-run 上下文全腿覆盖",
+        wired: false,
+    },
+    repo: {
+        source: "本服务没有项目层 settings 源(无 .claude/settings.json 之类的仓库层读点);不造一个来凑数",
+        wired: false,
+    },
+};
+export function buildCrossSessionInboundLayers(cfg) {
+    const layers = {};
+    for (const name of CROSS_SESSION_INBOUND_LAYER_NAMES) {
+        if (!CROSS_SESSION_INBOUND_LAYER_SOURCES[name].wired)
+            continue;
+        switch (name) {
+            case "managed":
+                if (cfg.crossSessionInbound !== undefined)
+                    layers.managed = cfg.crossSessionInbound;
+                break;
+            case "user":
+            case "repo":
+                throw new Error(`cross-session inbound layer "${name}" is marked wired in CROSS_SESSION_INBOUND_LAYER_SOURCES but has no value arm here — wire the source or set wired:false (an unwired layer must be ABSENT, never a silently empty one)`);
+        }
+    }
+    return layers;
+}
+export function crossSessionDialogExpiryOf(cfg) {
+    return cfg.crossSessionDialogExpiry;
+}
+//# sourceMappingURL=cross-session-settings.js.map

package/dist/deployment-governance.d.ts

@@ -11,6 +11,35 @@ export interface DeploymentGovernanceConfigView {
     readonly commandPolicy?: ServiceConfig["commandPolicy"];
     readonly manualModeShellGate?: ServiceConfig["manualModeShellGate"];
     readonly sensitiveWritePatterns: ServiceConfig["sensitiveWritePatterns"];
+    /**
+     * 本部署的**本地店根**(`LOCAL_DATA_ROOT → CONFIG_LOCAL_DIR → AGENT_DATA_DIR → ~/.ai-agent`)—— 在本口只喂
+     * **誊本门**(`<localDataRoot>/sessions`)。S-133 起它**不再**当守卫集的 `dataRoot`(那是引擎记忆根,见
+     * {@link DeploymentGovernanceRoots});下面这段历史注保留,记的是 S-125 件⑦ 把两根混作一根的由来。
+     *
+     * S-125 件⑦(core 7.4.0 [ref] HRD-PRM-10)—— 当时把本键原样交给 `createSensitivePathPolicy` 的 `dataRoot`。
+     *
+     * 为什么必须**显式**传而不是吃 core 的缺省:core 的缺省是 `$AGENT_DATA_DIR ?? ~/.ai-agent`,而本仓的
+     * 数据根解析链多一节最高优先级的覆盖(`config.ts`:`LOCAL_DATA_ROOT → CONFIG_LOCAL_DIR → AGENT_DATA_DIR
+     * → ~/.ai-agent`)。只设 `LOCAL_DATA_ROOT=/data/sema` 的部署,数据真的躺在 `/data/sema`,而 core 的缺省
+     * 会去猜 `~/.ai-agent` ⇒ 守卫把真数据根**当普通路径**判(它的祖先段一旦命中守卫集里的某一条,整棵子树
+     * 连同模型被**指示**要写的记忆库一起被硬拒),同时又把一个不存在的目录当成豁免区。两个方向都错,且都静默。
+     * ⇒ 本键 = 「这道门与 transcript 门说的是同一个目录」的单一属主,值与 `ServiceConfig.localDataRoot`
+     * **同一个**解析结果(不在本口重算,重算就是第二个写者)。
+     *
+     * 缺席(窄接口的老调用方 / 测试夹具)⇒ **不铸 `dataRoot` 键**,core 走它自己的缺省 —— 与本口既有的
+     * `rootPath` 条件展开同姿势:缺席是「本调用方没有这项知识」,不是「数据根是 undefined」。
+     */
+    readonly localDataRoot?: ServiceConfig["localDataRoot"];
+}
+/**
+ * S-133 —— 守卫集 `dataRoot` 的**显式供给**(与 `DeploymentGovernanceConfigView.localDataRoot` 是两件事):
+ * `engineDataRoot` = 引擎写记忆的根 = boot 已铸的 `memoryEngine.root`(boot/stores.ts 是唯一写者;推导函数
+ * `memoryEngineRootFor` 只在那里与 `memoryEngineBackendFor` 里调)。**调用腿读那只活对象,不重推导**——重推导
+ * 就是第二个写者(7.59.0 重扫 codex 轮抓到 HTTP 腿的 fallback 与 stores 不同源,正是这一形)。参数非可选:
+ * 一条腿忘了 = 编译红。`undefined` = 引擎未接(或窄接口的测试夹具),那时不铸 `dataRoot` 键,core 走自己的缺省。
+ */
+export interface DeploymentGovernanceRoots {
+    readonly engineDataRoot: string | undefined;
 }
 /** 审批基线读的配置切面(同上,窄接口)。 */
 export interface ApprovalBaselineConfigView {
@@ -147,7 +176,7 @@ export declare function buildOnlySensitiveBaselineWarning(config: Pick<Deploymen
  * `manualModeShellGate`/`sensitivePathPolicy` 按在场性条件展开 —— `applyRuntimeGovernance` 的
  * `!== undefined` 判据对两者等价,但 profile 是折叠面的可观测字节,搬家不许顺手改。
  */
-export declare function createDeploymentGovernanceInputs(config: DeploymentGovernanceConfigView, pathAdjudication: PathAdjudication): DeploymentGovernanceInputs;
+export declare function createDeploymentGovernanceInputs(config: DeploymentGovernanceConfigView, pathAdjudication: PathAdjudication, roots: DeploymentGovernanceRoots): DeploymentGovernanceInputs;
 /**
  * 审批基线 —— `applyRuntimeGovernance` 那个 base 的 `toolPolicy` 座([ref] 件一)。**恒非
  * `undefined`**:治理层是 tighten-only 的叠加层,没有基线可叠时它自己也产不出「门在场」这件事。

package/dist/deployment-governance.js

@@ -1,5 +1,5 @@
-import { posix } from "node:path";
-import { FileError, StubExecutionEnv, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, createSensitivePathPolicy, err, ok, } from "@sema-agent/core";
+import { join, posix } from "node:path";
+import { FileError, StubExecutionEnv, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, createSensitivePathPolicy, createTranscriptIntegrityPolicy, err, ok, } from "@sema-agent/core";
 import { createDurableAskPolicy } from "./approval.js";
 export function createDurableQuestionGate(live) {
     if (live === undefined)
@@ -47,17 +47,23 @@ export function buildOnlySensitiveBaselineWarning(config, seat) {
         },
     };
 }
-export function createDeploymentGovernanceInputs(config, pathAdjudication) {
+export function createDeploymentGovernanceInputs(config, pathAdjudication, roots) {
     const sensitivePathPolicy = config.sensitiveWritePatterns.length > 0
         ? (() => {
+            const dataRootOpt = roots.engineDataRoot !== undefined ? { dataRoot: roots.engineDataRoot } : {};
             const realTarget = createSensitivePathPolicy({
                 env: pathAdjudication.env,
                 patterns: config.sensitiveWritePatterns,
                 ...(pathAdjudication.cwd !== undefined ? { rootPath: pathAdjudication.cwd } : {}),
+                ...dataRootOpt,
             });
+            const transcriptGuard = config.localDataRoot !== undefined
+                ? createTranscriptIntegrityPolicy({ sessionsDirs: [join(config.localDataRoot, "sessions")] })
+                : undefined;
+            const withTranscripts = (p) => (transcriptGuard ? combinePolicies(p, transcriptGuard) : p);
             if (pathAdjudication.cwd !== undefined)
-                return realTarget;
-            return combinePolicies(realTarget, createSensitivePathPolicy({ env: new RelativeTargetLexicalEnv(), patterns: config.sensitiveWritePatterns }));
+                return withTranscripts(realTarget);
+            return withTranscripts(combinePolicies(realTarget, createSensitivePathPolicy({ env: new RelativeTargetLexicalEnv(), patterns: config.sensitiveWritePatterns, ...dataRootOpt })));
         })()
         : undefined;
     return {

package/dist/hooks/hook-runner.js

@@ -673,7 +673,7 @@ async function runObserveOnlyEvent(event, groups, matchValue, payload, ctx, once
         if (!out)
             continue;
         if (typeof out.systemMessage === "string")
-            ctx.logger.warn("hook_system_message", { event, message: clip(out.systemMessage, 500) });
+            ctx.logger.info("hook_system_message", { event, message: clip(out.systemMessage, 500) });
         if (out.decision !== undefined || out.continue === false || out.hookSpecificOutput !== undefined) {
             ctx.logger.warn("hook_result_unsupported", { event });
         }
@@ -747,7 +747,7 @@ export function createTaskHooks(config, ctx) {
                     if (!out)
                         continue;
                     if (typeof out.systemMessage === "string")
-                        ctx.logger.warn("hook_system_message", { event: "PreToolUse", message: clip(out.systemMessage, 500) });
+                        ctx.logger.info("hook_system_message", { event: "PreToolUse", message: clip(out.systemMessage, 500) });
                     if (out.continue === false) {
                         const reason = clip(typeof out.stopReason === "string" ? out.stopReason : "hook requested stop", MAX_HOOK_FEEDBACK_CHARS);
                         return { action: "deny", message: reason, ...buildHookContextField(contexts) };
@@ -845,7 +845,7 @@ export function createTaskHooks(config, ctx) {
                 if (!out)
                     continue;
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "PostToolUse", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "PostToolUse", message: clip(out.systemMessage, 500) });
                 if (out.continue === false) {
                     ctx.logger.warn("hook_continue_false_unsupported", { event: "PostToolUse" });
                 }
@@ -895,7 +895,7 @@ export function createTaskHooks(config, ctx) {
                 if (!out)
                     continue;
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "PostToolUseFailure", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "PostToolUseFailure", message: clip(out.systemMessage, 500) });
                 if (out.continue === false)
                     ctx.logger.warn("hook_continue_false_unsupported", { event: "PostToolUseFailure" });
                 if (out.decision === "block" && typeof out.reason === "string")
@@ -942,7 +942,7 @@ export function createTaskHooks(config, ctx) {
                 if (!out)
                     continue;
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "PostToolBatch", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "PostToolBatch", message: clip(out.systemMessage, 500) });
                 if (out.continue === false)
                     ctx.logger.warn("hook_continue_false_unsupported", { event: "PostToolBatch" });
                 if (out.decision === "block" && typeof out.reason === "string")
@@ -974,7 +974,7 @@ export function createTaskHooks(config, ctx) {
                 if (!out)
                     continue;
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "UserPromptSubmit", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "UserPromptSubmit", message: clip(out.systemMessage, 500) });
                 if (out.continue === false) {
                     const reason = clip(typeof out.stopReason === "string" ? out.stopReason : "hook requested stop", MAX_HOOK_FEEDBACK_CHARS);
                     return { block: reason, ...buildHookContextField(contexts) };
@@ -1063,7 +1063,7 @@ export function createTaskHooks(config, ctx) {
                     continue;
                 }
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "Stop", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "Stop", message: clip(out.systemMessage, 500) });
                 if (out.continue === false)
                     sawContinueFalse = true;
                 if (out.decision === "block" && block === undefined) {
@@ -1122,7 +1122,7 @@ export function createTaskHooks(config, ctx) {
                 if (!out)
                     continue;
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "PreCompact", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "PreCompact", message: clip(out.systemMessage, 500) });
                 if (out.continue === false) {
                     ctx.logger.warn("hook_continue_false_unsupported", { event: "PreCompact" });
                 }

package/dist/main.js

@@ -475,6 +475,7 @@ async function main() {
     const parkedReviveInheritedGate = parkedReviveTool && config.durableApproval
         ? createParkedReviveInheritedGate({
             config, question, approvalExemptionStore, logger, localRoot,
+            memoryEngineRoot: memoryEngine?.root,
             approverSeat: createRunnerDepsOnAsk(toolApproval),
             ...(runnerDeps.runtimeCapsResolver ? { resolveRuntimeCaps: runnerDeps.runtimeCapsResolver } : {}),
             autoModeSeatMounted: runnerDeps.autoMode !== undefined,

package/dist/memory-scope.d.ts

@@ -84,6 +84,26 @@ engineWired: boolean): {
  * Returns the backend + the resolved config root (the root also rides on `RunnerDeps.memoryEngineDir` so
  * core derives the B3 control plane beside it).
  */
+/**
+ * S-133(7.59.0 合并重扫 wf_5ac18676 #1)—— **引擎数据根的唯一推导点**。模型是用 fs 工具往这里写记忆的
+ * ([ref] 记忆边界不变式,boot/memory-boundary.ts),所以三件事必须读**同一只**值:①boot 起哪只记忆后端的根
+ * (boot/stores.ts 三腿)、②`RunnerDeps.memoryEngineDir`、③守卫集 `createSensitivePathPolicy` 的 `dataRoot`
+ * (deployment-governance.ts:落在这个根**里面**的目标按相对根判,根自己的祖先段不算目标的账)。
+ * 此前 ③ 读的是 `config.localDataRoot`(本地**店**根:`LOCAL_DATA_ROOT → CONFIG_LOCAL_DIR → AGENT_DATA_DIR`),
+ * 而 ① 的 file 腿读的是 `MEMORY_ENGINE_DIR ?? AGENT_DATA_DIR`——两条链在「店根另指他处 + 记忆根坐在守卫段下
+ * (壳布局 `~/.sema/engine-data`)」时分家 ⇒ 记忆库每一次 Write 被硬拒(7.58.0 放行 ⇒ 回归);反向
+ * (`CONFIG_LOCAL_DIR=~/.sema` 当 dataRoot)则让配置根自身免检。两根本就是两件事:店根归誊本门,引擎根归本函数。
+ *
+ * 形与 boot/stores.ts 逐字同律:DB 记忆腿(pg/tidb)的根 = `<localDataRoot ?? fallbackRoot>/memory-work`
+ * (per-worker 物化区);file 腿 = `resolveMemoryEngineRoot(memoryEngineDir ?? fallbackRoot)`。**不判引擎是否
+ * 启用**——纯路径推导,禁用态下守卫仍以「若开引擎会写到哪」为根,与 core 缺省(`$AGENT_DATA_DIR`)同向。
+ */
+export declare function memoryEngineRootFor(config: Pick<ServiceConfig, "memoryEngineBackend" | "memoryEngineDir" | "localDataRoot">, fallbackRoot?: string): string;
+/** file 后端的根链(`MEMORY_ENGINE_DIR ?? fallback ?? $AGENT_DATA_DIR ?? ~/.ai-agent`)—— 与后端选择器**无关**:
+ *  `memoryEngineBackendFor` 恒造 file 后端(run-local 从 env 继承 `MEMORY_ENGINE_BACKEND=pg|tidb` 时仍是 file),
+ *  所以它的根必须走这条链而不是 `memoryEngineRootFor` 的分派(codex 修复验证轮 [medium]:分派会把 run-local 的
+ *  记忆搬到 `<localDataRoot>/memory-work`,存量记忆与控制面升级后隐形)。 */
+export declare function fileMemoryEngineRoot(config: Pick<ServiceConfig, "memoryEngineDir">, fallbackRoot?: string): string;
 export declare function memoryEngineBackendFor(config: ServiceConfig, fallbackRoot?: string): {
     backend: FileMemoryEngineBackend;
     root: string;

package/dist/memory-scope.js

@@ -60,12 +60,20 @@ export function buildMemoryRemoteLaneWarn(config, engineWired) {
                 "WORKER fs; verify the lane really shares it.",
         };
 }
+export function memoryEngineRootFor(config, fallbackRoot) {
+    if (config.memoryEngineBackend !== "file")
+        return join(config.localDataRoot ?? fallbackRoot ?? resolveMemoryEngineRoot(undefined), "memory-work");
+    return fileMemoryEngineRoot(config, fallbackRoot);
+}
+export function fileMemoryEngineRoot(config, fallbackRoot) {
+    return resolveMemoryEngineRoot(config.memoryEngineDir ?? fallbackRoot);
+}
 export function memoryEngineBackendFor(config, fallbackRoot) {
     if (config.requirePrincipal === true || !config.memoryEngineEnabled)
         return undefined;
     if (memoryEngineRemoteLanePosture(config)?.posture === "dark")
         return undefined;
-    const root = resolveMemoryEngineRoot(config.memoryEngineDir ?? fallbackRoot);
+    const root = fileMemoryEngineRoot(config, fallbackRoot);
     const dir = join(root, "memory");
     return { backend: new FileMemoryEngineBackend(dir, { controlDir: deriveControlPlaneDir(root, dir) }), root };
 }

package/dist/observability/metrics.js

@@ -235,7 +235,7 @@ export function createMetrics() {
     m.counter("remote_env_resume_total", "E2B remote-env resumeVM outcomes (v1.5, provider/result)");
     m.counter("remote_env_exec_stream_read_timeout_total", "E2B execStream idle read-timeouts (#1128, provider)");
     m.counter("resume_anchor_capture_failed", "E18 resume-at per-turn anchor captures that failed (best-effort, run unaffected)");
-    m.counter("brain_retry_total", "Brain-layer status events (S4), by phase (rate_limited/retrying/reconnecting/circuit_open)");
+    m.counter("brain_retry_total", "Brain-layer status events (S4), by phase (rate_limited/retrying/reconnecting/circuit_open/waiting_first_token/recovered/gave_up)");
     m.gauge("store_backend_degraded", "1 when the auto DB probe failed at boot and this replica degraded to in-memory (S5)");
     m.counter("images_omitted_total", "Tasks whose images will be degraded to text placeholders (no-vision model), by model (S6)");
     m.counter("runs_reaped_total", "Run rows flipped by the background reapers (S7), by kind (stale/suspended/expired_checkpoint)");

package/dist/observability/run-terminal-log.d.ts

@@ -60,6 +60,10 @@ export declare function redactTerminalResult<T extends {
     remoteEnvFailures?: readonly {
         message?: string | undefined;
     }[] | undefined;
+    /** 🔴 形上**故意**是 `unknown`:本函数也是**读面**(旧持久 blob / 非 core Runner 的形不可信),
+     *  声明成 `{path,edits}[]` 会逼每一个喂坏形的调用点铸一次宽松断言 —— 而「坏形从哪来」正是本座要
+     *  处理的事(同一份不信任在 `remoteEnvFailures` 的实现里也已成文)。运行期逐项判形,不抛。 */
+    editedFiles?: unknown;
 } | null | undefined>(result: T): T;
 /** S-107(第五轮合并重扫 wf_f00c00bc 两根 [high]):同一个 `TaskResult` 除 run 行外还被逐字追加进 run_events 的 `done` 行
  *  (bg/verify/cascade/stream/resume 五腿),`failed` 行带原文 `errorMessage`,`GET /v1/runs/:id/events` 原样回放。

package/dist/observability/run-terminal-log.js

@@ -74,6 +74,7 @@ export function redactErrorMessage(raw) {
         return OVERSIZED_REDACTION_PLACEHOLDER;
     }
 }
+const MAX_EDITED_FILES = 1000;
 export function redactTerminalResult(result) {
     if (result === undefined || result === null)
         return result;
@@ -94,6 +95,19 @@ export function redactTerminalResult(result) {
             : r.remoteEnvFailures;
         changed = true;
     }
+    if (r.editedFiles !== undefined) {
+        out.editedFiles = Array.isArray(r.editedFiles)
+            ? r.editedFiles
+                .slice(0, MAX_EDITED_FILES)
+                .map((f) => {
+                if (f === null || typeof f !== "object")
+                    return f;
+                const path = f.path;
+                return typeof path === "string" ? { ...f, path: redactSecrets(path) } : f;
+            })
+            : r.editedFiles;
+        changed = true;
+    }
     return changed ? out : result;
 }
 export function redactLedgerEventData(type, data) {
@@ -177,7 +191,7 @@ export const OVERSIZED_PATCH_PLACEHOLDER = "«redacted:oversized-patch-not-inlin
 function diffScanRefusal(patch, direct) {
     if (/^diff --(?:cc|combined) |^@{3,} /m.test(patch))
         return "combined-diff";
-    const fence = /-{4,5} ?BEGIN[^\n-]*PRIVATE KEY(?: BLOCK)?[^\n-]*-{4,5}/;
+    const fence = /-{4,5} ?BEGIN(?:[^\n-]|-(?!-))*PRIVATE KEY(?: BLOCK)?(?:[^\n-]|-(?!-))*-{4,5}/;
     if (fence.test(direct))
         return "pem-fence-survived";
     const ppkField = /Private-(?:MAC|Hash): [0-9a-fA-F]{32}/;

package/dist/plugins/device-store-sql.d.ts

@@ -129,15 +129,39 @@ export declare class SqlDeviceStore implements DeviceStore {
     heartbeatConnection(input: HeartbeatConnectionInput): Promise<boolean>;
     releaseConnection(deviceId: string, generation: number): Promise<boolean>;
     /**
-     * §4.3.2 首绑写协议 —— **单事务**:设备校验(active ∧ owner)与 `INSERT IGNORE` 在一个事务里。
+     * §4.3.2 首绑写协议 —— **单事务**:设备校验(active ∧ owner)与首绑 CAS 插入在一个事务里。
      *
-     * 🔴 `beginPessimistic` + `FOR UPDATE`:设备行必须是**当前读**。快照读下,一次与吊销并发的绑定会
-     * 读到「还 active」的旧版本,于是把 session 绑到一台**刚被吊销**的设备上(sql-driver.ts 头注点名的
-     * double-admit 形)。
-     * 并发首绑:`INSERT IGNORE` / `ON CONFLICT DO NOTHING` 的 affected 是引擎对「谁赢」的权威回答;
-     * 输家回读既有行 —— 同 deviceId = 幂等成功,异 deviceId = `conflict`(无未定义态)。
+     * 🔴 `beginPessimistic` + `FOR UPDATE`(设备行):设备行必须是**当前读**。快照读下,一次与吊销并发的
+     * 绑定会读到「还 active」的旧版本,于是把 session 绑到一台**刚被吊销**的设备上(sql-driver.ts 头注点名
+     * 的 double-admit 形)。这把锁在 `devices` 表上,与下面被插入的 `device_session` 行不是同一行。
+     *
+     * 🔴 形 B · cas-insert(S-127 / B-013)—— 本站点是全仓 `INSERT IGNORE` 的**正当用法**:
+     * `INSERT IGNORE` / `ON CONFLICT DO NOTHING` 的 affected(1/0)是引擎对「谁赢」的**权威**回答,而
+     * `ON DUPLICATE KEY UPDATE pk = pk` 的 affected 新行/既有行都是 1、分不出赢家 ⇒ 这里换不得动词。
+     * 代价必须付清:**同一事务此后不得对被插入的那一行做加锁读**。InnoDB 下撞重复键的 IGNORE 在既有行
+     * 取 **S 锁**,随后的 `SELECT … FOR UPDATE` 要升 X;两个并发首绑各持一把 S 互等 ⇒ ER_LOCK_DEADLOCK
+     * (TiDB 悲观事务无共享锁,这一形在它上面恒绿 —— 双库门看不见)。于是两条路径分家:
+     *  · **赢家**(affected === 1):行是自己刚插的,回执用**入参 + 插入时刻**直接构造,零回读。插入时刻
+     *    仍由 **DB 时钟**给出(插入前一句 `SELECT NOW(3)` / `SELECT now()`,再把它当参数写进 INSERT)——
+     *    时间权威留在 DB,回执里的 `boundAtMs` 与落库值**逐字节同一个**,不是应用侧的近似。
+     *  · **输家**(affected === 0):**结束当前事务**,在**新事务**里 `SELECT … FOR UPDATE` 观察。那一刻
+     *    赢家已提交,读到的是一把干净的 X 锁(无升级);判 同 deviceId = 幂等成功,异 deviceId =
+     *    `conflict`(无未定义态)。设备状态门在输家路径上已经过完,不需要重来。
      */
     bindSession(input: BindSessionInput): Promise<BindSessionResult>;
+    /**
+     * 首绑 CAS 的**输家观察**(形 B 的后半,S-127)—— 独立事务,与那次 `INSERT IGNORE` 无锁关系。
+     *
+     * 🔴 `FOR UPDATE`(**真库红修**,2026-08-28 双库跑当场抓到,mock 抓不到):TiDB 的悲观事务里**普通
+     * SELECT 仍是快照读**(读的是本事务 start_ts 的视图),只有加锁读才是当前读。放在新事务里读同样要
+     * 这把锁 —— 新事务的 start_ts 虽在赢家提交之后,但「读的是不是当前」这条判据不该靠时序巧合来满足。
+     * 与旧形的**唯一**差别:此刻我们手上没有那一行的 S 锁,于是这把 X 是**直接取**的,不是升级 ⇒ 两个
+     * 并发输家不会互等(B-013 的死锁形正是那次升级)。
+     *
+     * 行不在 = 赢家的绑定在这一瞬被 `unbindSession` 删了(真实可能,不是不变量破)。这仍然是**响亮**的:
+     * 首绑既没成、也说不出冲突对象,折成任何一种业务回执都是撒谎([ref]:未知失败不伪装成正常拒绝)。
+     */
+    private observeLostBind;
     /**
      * O4 显式换绑(2026-08-30 v2 稿 §2)—— **单事务**:目标设备门(当前读)+ 幂等短路 + 前态 CAS +
      * `session_rebound` 审计行一起提交。三形语义 oracle = `InMemoryDeviceStore.rebindSession`。

package/dist/plugins/device-store-sql.js

@@ -533,14 +533,33 @@ export class SqlDeviceStore {
                 await conn.rollback();
                 return { outcome: "device_revoked" };
             }
-            const ins = await conn.query(this.q(`INSERT IGNORE INTO ${DEVICE_SESSIONS_TABLE} (root_session_id, device_id, owner_tenant, owner_subject, bound_at, rev) VALUES (?, ?, ?, ?, NOW(3), 0)`, `INSERT INTO ${DEVICE_SESSIONS_TABLE} (root_session_id, device_id, owner_tenant, owner_subject, bound_at, rev) VALUES ($1, $2, $3, $4, now(), 0) ON CONFLICT (root_session_id) DO NOTHING`), [input.rootSessionId, input.deviceId, input.owner.tenant, input.owner.subject]);
+            const clock = await conn.query(this.q(`SELECT ${ms("tidb", NOW("tidb"), "bound_at_ms")}`, `SELECT ${ms("pg", NOW("pg"), "bound_at_ms")}`));
+            const boundAtMs = Number(clock.rows[0].bound_at_ms);
+            const ins = await conn.query(this.q(`INSERT IGNORE INTO ${DEVICE_SESSIONS_TABLE} (root_session_id, device_id, owner_tenant, owner_subject, bound_at, rev) VALUES (?, ?, ?, ?, FROM_UNIXTIME(? / 1000), 0)`, `INSERT INTO ${DEVICE_SESSIONS_TABLE} (root_session_id, device_id, owner_tenant, owner_subject, bound_at, rev) VALUES ($1, $2, $3, $4, to_timestamp($5::double precision / 1000.0), 0) ON CONFLICT (root_session_id) DO NOTHING`), [input.rootSessionId, input.deviceId, input.owner.tenant, input.owner.subject, boundAtMs]);
+            if (ins.affected === 1) {
+                await conn.commit();
+                return { outcome: "bound", row: { rootSessionId: input.rootSessionId, deviceId: input.deviceId, owner: input.owner, boundAtMs, rev: 0 } };
+            }
+            await conn.rollback();
+        }
+        catch (err) {
+            await conn.rollback().catch(() => undefined);
+            throw err;
+        }
+        finally {
+            conn.release();
+        }
+        return await this.observeLostBind(input);
+    }
+    async observeLostBind(input) {
+        const conn = await this.db.connect();
+        try {
+            await conn.beginPessimistic();
             const { rows } = await conn.query(this.q(`SELECT ${sessionCols("tidb")} FROM ${DEVICE_SESSIONS_TABLE} WHERE root_session_id = ? FOR UPDATE`, `SELECT ${sessionCols("pg")} FROM ${DEVICE_SESSIONS_TABLE} WHERE root_session_id = $1 FOR UPDATE`), [input.rootSessionId]);
             await conn.commit();
             const row = rows[0] ? mapSessionRow(rows[0]) : null;
             if (!row)
-                throw new Error("device-store: session binding vanished immediately after insert");
-            if (ins.affected === 1)
-                return { outcome: "bound", row };
+                throw new Error("device-store: the winning session binding vanished before the losing binder could observe it");
             const same = row.deviceId === input.deviceId && row.owner.tenant === input.owner.tenant && row.owner.subject === input.owner.subject;
             return { outcome: same ? "idempotent" : "conflict", row };
         }

package/dist/plugins/file-history-store-sql.d.ts

@@ -61,6 +61,11 @@ export declare class SqlFileHistoryStore implements FileHistoryStore {
      * row-locks the scope's sentinel row — one lock, both dialects, and disjoint-key writers can no
      * longer interleave into a merged/torn graph. The ensure+lock loops because deleteBySession removes
      * the sentinel: a waiter woken by that delete sees zero rows and must re-ensure.
+     *
+     * Shape A (S-127): the MySQL ensure verb is `ON DUPLICATE KEY UPDATE scope = scope`, NOT `INSERT IGNORE`.
+     * On InnoDB a duplicate-key IGNORE takes an **S** lock on the existing sentinel and the `FOR UPDATE` right
+     * below has to upgrade it to X — two concurrent scope writers each holding an S deadlock (B-013). ON
+     * DUPLICATE takes X on the duplicate key, the same mode the locking read wants, so they serialize instead.
      */
     private lockScope;
     /** Returns the UPDATE's affected count — 0 = the record is gone (annulled) or was already observed;

package/dist/plugins/file-history-store-sql.js

@@ -49,7 +49,7 @@ export class SqlFileHistoryStore {
         for (const scope of [...new Set(scopes)].sort()) {
             let locked = false;
             for (let i = 0; i < 3 && !locked; i++) {
-                await conn.query(this.q("INSERT IGNORE INTO file_history_scope (scope, created_at_ms) VALUES (?,?)", "INSERT INTO file_history_scope (scope, created_at_ms) VALUES ($1,$2) ON CONFLICT (scope) DO NOTHING"), [scope, Date.now()]);
+                await conn.query(this.q("INSERT INTO file_history_scope (scope, created_at_ms) VALUES (?,?) ON DUPLICATE KEY UPDATE scope = scope", "INSERT INTO file_history_scope (scope, created_at_ms) VALUES ($1,$2) ON CONFLICT (scope) DO NOTHING"), [scope, Date.now()]);
                 const r = await conn.query(this.q("SELECT scope FROM file_history_scope WHERE scope = ? FOR UPDATE", "SELECT scope FROM file_history_scope WHERE scope = $1 FOR UPDATE"), [scope]);
                 locked = Boolean(r.rows[0]);
             }
@@ -358,15 +358,15 @@ export class SqlFileHistoryStore {
                 }
                 const seqRow = await conn.query(this.q("SELECT publish_seq FROM file_history_boundary WHERE scope = ? ORDER BY publish_seq DESC LIMIT 1 FOR UPDATE", "SELECT publish_seq FROM file_history_boundary WHERE scope = $1 ORDER BY publish_seq DESC LIMIT 1"), [scope]);
                 const publishSeq = (seqRow.rows[0] !== undefined ? Number(seqRow.rows[0].publish_seq) : 0) + 1;
-                const ins = await conn.query(this.q("INSERT IGNORE INTO file_history_boundary (scope, entry_id, published_at_ms, publish_seq) VALUES (?,?,CAST(UNIX_TIMESTAMP(NOW(3))*1000 AS SIGNED),?)", "INSERT INTO file_history_boundary (scope, entry_id, published_at_ms, publish_seq) VALUES ($1,$2,(EXTRACT(EPOCH FROM clock_timestamp())*1000)::bigint,$3) ON CONFLICT (scope, entry_id) DO NOTHING"), [scope, entryId, publishSeq]);
-                if (ins.affected !== 1) {
-                    const won = await conn.query(this.q("SELECT 1 FROM file_history_boundary WHERE scope = ? AND entry_id = ? FOR UPDATE", "SELECT 1 FROM file_history_boundary WHERE scope = $1 AND entry_id = $2 FOR UPDATE"), [scope, entryId]);
-                    if (!won.rows[0]) {
-                        throw new Error(`boundary publish for entry "${entryId}" was suppressed without a same-entry winner (publish_seq allocation invariant breach) — refusing to report a boundary that was not stored`);
-                    }
+                const priorWinner = await conn.query(this.q("SELECT 1 FROM file_history_boundary WHERE scope = ? AND entry_id = ? FOR UPDATE", "SELECT 1 FROM file_history_boundary WHERE scope = $1 AND entry_id = $2 FOR UPDATE"), [scope, entryId]);
+                if (priorWinner.rows[0]) {
                     await conn.rollback();
                     return { ok: true };
                 }
+                const ins = await conn.query(this.q("INSERT IGNORE INTO file_history_boundary (scope, entry_id, published_at_ms, publish_seq) VALUES (?,?,CAST(UNIX_TIMESTAMP(NOW(3))*1000 AS SIGNED),?)", "INSERT INTO file_history_boundary (scope, entry_id, published_at_ms, publish_seq) VALUES ($1,$2,(EXTRACT(EPOCH FROM clock_timestamp())*1000)::bigint,$3) ON CONFLICT (scope, entry_id) DO NOTHING"), [scope, entryId, publishSeq]);
+                if (ins.affected !== 1) {
+                    throw new Error(`boundary publish for entry "${entryId}" was suppressed without a same-entry winner (publish_seq allocation invariant breach) — refusing to report a boundary that was not stored`);
+                }
                 for (const [keyHash, cap] of staged) {
                     let version;
                     if (cap.kind === "unchanged") {

package/dist/plugins/image-bake-store-sql.js

@@ -140,7 +140,7 @@ export class SqlImageBake {
         try {
             if (this.db.dialect === "tidb") {
                 await conn.beginPessimistic();
-                await conn.query("INSERT IGNORE INTO image_bake_admit (pool) VALUES (?)", [this.poolName]);
+                await conn.query("INSERT INTO image_bake_admit (pool) VALUES (?) ON DUPLICATE KEY UPDATE pool = pool", [this.poolName]);
                 await conn.query("SELECT pool FROM image_bake_admit WHERE pool = ? FOR UPDATE", [this.poolName]);
                 const busy = await conn.query("SELECT 1 FROM image_bake WHERE status IN ('queued','running') AND dry_run = 0 LIMIT 1 FOR UPDATE");
                 if (busy.rows.length === 0) {

package/dist/plugins/mailbox-store-sql.d.ts

@@ -7,15 +7,19 @@
  * 终版文本,conformance 无两可):
  *  1. **同主重 claim = 续期 + 纳新**(crash-retry 正形):活 lease 只挡**别的** owner;同 owner 任意
  *     时刻重 claim 重设 TTL 并拿到当前全部未 ack 消息(maxSeq 随最新行走)。
- *  2. **seq = 盒生命周期内不复用**:box 行携 `next_seq`,分配与 append 同事务;`drop`/`reap` 删整盒
- *     (含 box 行)= 生命周期终结,重建从 1(core 定谳:行随盒亡,dedup 键携 handle)。
+ *  2. **seq = 盒生命周期内不复用**:box 行携 `next_seq`,分配与 append 同事务;`drop` 删整盒(含 box 行)
+ *     = 生命周期终结,重建从 1(core 定谳:行随盒亡,dedup 键携 handle)。⚠️ **`reap` 自 [ref](core
+ *     2026-07-25)起不再与 drop 同句**:reap 是收件人活着时的龄扫,**清箱保高水位**(删消息、清租约、盒行与
+ *     next_seq 留着)——本文件 2026-09-03(车BF,codex r1 [high])才跟上;此前 reap 删盒行 ⇒ 下一条 append 从 1
+ *     重铸,陈旧 ack 可删掉一条没人见过的新消息。跨进程试剂盒明钉此条。
  *  3. **ack 无 owner 守卫**(信任 claim 赢者链):`seq <= upToSeq` 删行;lease 的 `maxSeq <= upToSeq`
  *     时顺带清 lease(全量 ack = 释放)。
  *  4. **lease 过期判 = 严格 `expiresAt > now` 才挡**;`releaseLease` 只在 owner 匹配时清。
  *  5. `peekCount` 含已 lease 消息(可见性 ≠ lease 态);空盒 claim = null(box 行在而消息 0 也 null)。
  *  6. **reap = SQL 全量真扫**(core File 实现只扫已加载盒 = 进程内 backstop,[ref] 确认 SQL 是全量
- *     真扫的正确层):`maxAgeMs` 缺省 → 0;按盒 newest `sentAt < now - maxAgeMs` 删整盒;空盒(有
- *     box 行无消息)不删(InMemory 同形——`newest === undefined` 不删)。
+ *     真扫的正确层):`maxAgeMs` 缺省 → 0;按盒 newest `sentAt < now - maxAgeMs` **清箱**(删消息 + 清租约,
+ *     盒行/高水位保留,见定谳 2 的 [ref] 半句);空盒(有 box 行无消息)不清(InMemory 同形——`newest ===
+ *     undefined` 不动)。
  *
  * 键列 = 字节等价(TiDB VARBINARY / PG COLLATE "C",roster F2 案):scope/handle/lease_owner 的
  * `=` 必须纯字节——PAD SPACE 近撞不得穿隔离/抢别人 lease。PG unstorable bytes([ref] 三层定谳):
@@ -32,20 +36,36 @@
  *  - reap 候删 = 事务外粗筛 + 事务内**逐盒锁定重验**(当前读 newest):窗内新到的消息救活盒,
  *    绝不连带删信;盒行已被并发 drop = 跳过不计。
  *  - append 的 ensure 与 FOR UPDATE 之间被并发 drop 提交 = 同事务内重建一次(语义 = drop 后重建,
- *    seq 从 1)。键长 > 190 字节写入即拒(fail-loud)——TiDB `INSERT IGNORE` 会把超长键**静默截断**,
- *    截断键与全长查询参数字节比对恒 miss(分配读空行崩/隔离键错位)。
+ *    seq 从 1)。建盒动词 = 形 A(S-127)`ON DUPLICATE KEY UPDATE <pk> = <pk>`:重复键取 X 锁,与随后的
+ *    `FOR UPDATE` **同锁模式**(`INSERT IGNORE` 取 S 再升 X = InnoDB 上的并发死锁形,B-013)。
+ *  - 键长 > 190 字节写入即拒(fail-loud):截断键与全长查询参数字节比对恒 miss(分配读空行崩/隔离键
+ *    错位)。守卫在**语句之前**,与建行动词无关 —— 换成 ON DUPLICATE 之后超长键由引擎直接报错(严格
+ *    模式下 IGNORE 会把它降级成静默截断),方向=更响亮,守卫依旧是第一道。
  */
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import type { MailboxLease, MailboxStore } from "@sema-agent/core";
-type MailboxAppendMessage = Parameters<MailboxStore["append"]>[2];
+import type { MailboxAppendMessage, MailboxLease, MailboxStore } from "@sema-agent/core";
 export declare const MAILBOX_TABLE = "mailbox";
 export declare const MAILBOX_MSG_TABLE = "mailbox_message";
+/** 店侧日志座(可选;boot 注入 `Logger`)。7.58.0 合并重扫 [medium]:坏 `peer_meta` 行的 fail-closed 抛必须**响亮**——core 唯一的
+ *  claimLease 调用方(peer-session-drain)吞掉该错,店不记这一笔就成了「静默永久卡箱」。抛之前记 `mailbox_peer_meta_corrupt`
+ *  (scope/handle/seq/code),运维按 seq 修行。 */
+export interface MailboxStoreLogger {
+    warn(event: string, fields: Record<string, unknown>): void;
+}
 export declare function ensureTiDBMailboxSchema(pool: MySqlPool): Promise<void>;
 export declare function ensurePgMailboxSchema(q: (text: string, params?: unknown[]) => Promise<unknown>): Promise<void>;
 export declare class TiDBMailboxStore implements MailboxStore {
     private readonly pool;
-    constructor(pool: MySqlPool);
+    private readonly logger?;
+    /** [ref]([ref] §1.2⑥):跨进程安全**显式**声明 —— core 的 `mailboxCrossProcessMountVerdict` 只对字面 `true` 放行
+     *  peer lane(缺席/false/畸形一律响亮拒挂 `config.peer_lane_unmounted`)。真值前提 = 本文件头注「并发正确性」段:seq
+     *  在事务内经盒行 FOR UPDATE 单铸、lease/ack/drop/reap 统一盒行锁序、reap 事务内逐盒当前读重验 —— 多副本(=多 OS
+     *  进程)共享一个盒本就是 SQL 双生的设计象限。**终验** = core 跨进程试剂盒 `mailboxCrossProcessContract` 跑在真第二个
+     *  OS 进程上:`test/mailbox-cross-process-kit.test.ts`(file 腿恒跑验 harness;tidb/pg 腿 ENV-GATED,发车前双库门必跑,
+     *  红即摘本声明——core 契约逐字「declares true AFTER passing」,声明不许先于试剂盒长期悬空)。 */
+    readonly crossProcessSafe = true;
+    constructor(pool: MySqlPool, logger?: MailboxStoreLogger | undefined);
     private tx;
     append(scope: string, handle: string, msg: MailboxAppendMessage): Promise<number>;
     claimLease(scope: string, handle: string, owner: string, ttlMs: number, now?: number): Promise<MailboxLease | null>;
@@ -59,7 +79,10 @@ export declare class TiDBMailboxStore implements MailboxStore {
 }
 export declare class PgMailboxStore implements MailboxStore {
     private readonly pool;
-    constructor(pool: PgPool);
+    private readonly logger?;
+    /** [ref] 跨进程安全显式声明(TiDB 孪生同注:事务 + 盒行 FOR UPDATE 锁序是真值前提;终验 = test/mailbox-cross-process-kit.test.ts pg 腿)。 */
+    readonly crossProcessSafe = true;
+    constructor(pool: PgPool, logger?: MailboxStoreLogger | undefined);
     private tx;
     /** 身份键拒绝式([ref] 协议纪律):scope/handle/owner/from 清洗形变 = 路由/attribution 错位。 */
     private assertIdentity;
@@ -73,5 +96,4 @@ export declare class PgMailboxStore implements MailboxStore {
         maxAgeMs?: number;
     }): Promise<number>;
 }
-export {};
 //# sourceMappingURL=mailbox-store-sql.d.ts.map