@sema-agent/server 7.82.0 → 7.83.0

package/dist/leader/merge.d.ts

@@ -4,7 +4,8 @@
  * The deterministic Coordinator integrates N completed workers' branches under FULL isolation:
  *   1. pull each worker's patch OUT of its container (M2 `pullDiff` — no creds go in).
  *   2. provision an EPHEMERAL no-net/no-creds integration sandbox (base pre-provisioned by the dep).
- *   3. `git apply --3way` each patch in sequence (partial-apply → capture `.rej`, quarantine — council#3).
+ *   3. `git apply --3way` each patch in sequence (conflict ⇒ TERMINAL: capture `.rej` + the conflict PATH list and
+ *      hand them to the USER as {@link MergeConflict} — S-113 / clay [ref] ④; council#3's quarantine unchanged).
  *   4. run the full test suite IN the sandbox (the gate; untrusted diff never touches the control plane — [26]§16).
  *   5. green → the **Coordinator** (trusted control plane, holds creds — NOT the sandbox, council#1) takes the
  *      integrated patch and pushes with CAS `--force-with-lease=<ref>:<baseSha>` (push race → retry — council#2).
@@ -57,31 +58,25 @@ export interface IntegrationRepair {
     }>;
 }
 /**
- * Bounded merge-conflict resolution (search 2026-06-16). Symmetric with {@link IntegrationRepair}: when a worker's
- * patch CONFLICTS on `git apply --3way` (overlapping edits a sibling already touched), run a bounded agent IN the
- * integration sandbox to integrate THIS worker's patch — instead of the leader discarding ALL fan-out work and
- * redoing the whole task as one fresh worker (collapseToSingle, leader.ts: "correctness over thrift; half-done
- * adoption is future"). The agent merges the in-tree conflict markers + applies the `.rej` hunks; mergeBranches
- * then VERIFIES no marker/.rej remains before continuing, and the downstream test gate still guards correctness.
- * Wired by the caller (provisionIntegrationSandbox); when unset, an apply conflict stays terminal exactly as before
- * (zero behaviour change). Reuses the IntegrationRepair sandbox + hands pattern → no new core/env seam (the seam
- * [ref] §8 feared for "adopting N half-done workspaces" is unnecessary for the conflict case).
+ * S-113 / clay [ref] ④ — **合不上 = 交给用户**(对齐 CC 形)。`git apply --3way` 冲突时的产出:冲突**路径**
+ * (不含内容)+ 哪几只 worker 的补丁已经进树,由 leader 铸成 `LeaderResult.conflict` 段交到用户手上。
+ * 本段刻意**只有路径与身份**:CC 259 语料对 collapse / conflict resolution 零命中,CC 的并行是同机 teammates
+ * 各 worktree、结束由 git 重放到用户 HEAD、冲突列给用户(cli259.js @2303113)——没有任何模型去读别的 worker
+ * 的 diff。7.83.0 删掉的那条「冲突解决模型」通道(它的类型面与 `LEADER_CONFLICT_ROUNDS` 旋钮)正是此意。
  */
-export interface ConflictResolver {
-    /** Max resolution attempts before giving up (each = one agent run + one marker/.rej re-check). */
-    maxRounds: number;
-    /** Run the resolver agent against the live conflicted tree. Edits the working tree to integrate the worker's
-     *  patch + removes the `.rej`/`.orig` files; MUST NOT commit / push / add (the merge squashes at the end). */
-    run(ctx: {
-        round: number;
-        workerId: string;
-        conflictText: string;
-        patch: string;
-        repoDir: string;
-    }): Promise<{
-        costUsd?: number;
-        note?: string;
-    }>;
+export interface MergeConflict {
+    /** 有冲突标记或 `.rej` 的路径(**不含内容**;`.rej` 后缀已剥,指向源文件)。 */
+    files: string[];
+    /** 对抗复审 F5 [medium]:清单**被截断**(命中 {@link CONFLICT_FILES_MAX})时在场 —— 缺席 = 这就是全部。
+     *  「完整清单」是本终局对用户的补偿,一次静默的 200 封顶会让用户以为冲突只有 200 处。 */
+    filesTruncated?: true;
+    /** 冲突发生**之前**已经干净 apply 进树的 workerId(顺序 apply,失败即停)。 */
+    applied: string[];
+    /** 补丁没能 apply 的那只 worker。 */
+    conflicted: string;
+    /** `.rej` 头(经既有**工件**脱敏面 `redactArtifactText` —— 与 `rej` 同一批 diff 字节同一口 —— 再切 ≤ 2 KiB)
+     *  ——给用户看「冲突长什么样」,不是给模型的输入。 */
+    rejHead?: string;
 }
 export interface MergeDeps {
     /** Pull one worker's patch from ITS container (M2 pullDiff bound to the worker's env). */
@@ -93,7 +88,6 @@ export interface MergeDeps {
         env: IntegrationEnv;
         destroy: () => Promise<void>;
         repair?: IntegrationRepair;
-        conflictResolver?: ConflictResolver;
     }>;
     /**
      * The CREDENTIALED push, done by the Coordinator (control plane), NOT the sandbox (council#1). Takes the
@@ -177,8 +171,6 @@ export type MergeResult = {
         reason?: string;
     };
     repair?: RepairMeta;
-    conflictsResolved?: string[];
-    conflictResolverCostUsd?: number;
     terminal?: RepairTerminal;
     candidatePatch?: string;
 } | {
@@ -187,10 +179,10 @@ export type MergeResult = {
     phase: "no-workers" | "diff-out" | "provision" | "apply" | "test" | "push";
     quarantine?: string[];
     rej?: string;
+    conflict?: MergeConflict;
     retry?: boolean;
     details?: string;
     repair?: RepairMeta;
-    conflictResolverCostUsd?: number;
     terminal?: RepairTerminal;
     candidatePatch?: string;
     measure?: {
@@ -200,4 +192,21 @@ export type MergeResult = {
 };
 /** Integrate completed workers' branches. Never throws — failures are typed MergeResult. */
 export declare function mergeBranches(reports: WorkerReport[], baseSha: string, deps: MergeDeps): Promise<MergeResult>;
+/** 探测脚本里某一半失败时打到 stdout 的标记前缀(`grep` / `find` 各一);只由 {@link conflictFilesOf} 认。
+ *  ⚠️ 判序承重:`conflictFilesOf` **先**测本前缀、**后**剥 `./` —— `grep -rl` / `find .` 输出的真路径恒带 `./`,
+ *  所以一个真叫 `__PROBE_FAIL_grep` 的文件到达时是 `./__PROBE_FAIL_grep`,不与标记二义;把剥 `./` 挪到前面就静默破功。 */
+export declare const PROBE_FAIL_PREFIX = "__PROBE_FAIL_";
+/**
+ * S-113 / [ref] ④ — 把 `grep -rIl` + `find` 的输出变成**冲突路径清单**(给用户,不含内容)。
+ * 逐行:去掉 `./` 前缀、剥掉 `.rej` 后缀(`pkg/a.ts.rej` 与 `pkg/a.ts` 是同一处冲突的两种痕迹)、去重、
+ * 按 {@link CONFLICT_FILES_MAX} 封顶并**交回是否截断**(F5:静默封顶会让用户把 200 当成全部)。两条命令合成
+ * 一次 exec,所以 stdout 里两族路径混在一起 —— 本函数是它唯一的解释者。任一半探测失败 ⇒ 那一半打出
+ * {@link PROBE_FAIL_PREFIX} 标记、另一半的清单照常回来 ⇒ `probeFailed` 点名失败的那半、`files` 只是**不完整**而不是
+ * 「没有冲突」:`conflict` 段仍在场(用户仍拿得到分支与冲突者身份),调用点另记一行响亮日志(合并复审 车HB H-7)。
+ */
+export declare function conflictFilesOf(stdout: string): {
+    files: string[];
+    truncated: boolean;
+    probeFailed: string[];
+};
 //# sourceMappingURL=merge.d.ts.map

package/dist/leader/merge.js

@@ -1,7 +1,9 @@
 import { delimitUntrusted } from "@sema-agent/core";
-import { OVERSIZED_DIAG_PLACEHOLDER, redactErrorMessage, redactHead, redactTail } from "../observability/run-terminal-log.js";
+import { OVERSIZED_DIAG_PLACEHOLDER, redactArtifactText, redactErrorMessage, redactHead, redactTail } from "../observability/run-terminal-log.js";
 import { applyAndGrade, changedFilesOutOfAllowlist } from "./grader-env-factory.js";
 import { shellQuote as Q } from "../plugins/remote-shell.js";
+const CONFLICT_FILES_MAX = 200;
+const CONFLICT_REJ_HEAD_MAX = 2048;
 export async function mergeBranches(reports, baseSha, deps) {
     const repo = deps.repoDir ?? "/repo";
     const mergeable = reports.filter((r) => r.status === "completed");
@@ -10,7 +12,6 @@ export async function mergeBranches(reports, baseSha, deps) {
     }
     let destroy;
     let phase = "diff-out";
-    let conflictResolverCostUsd = 0;
     let repairMeta;
     let measure;
     try {
@@ -28,23 +29,29 @@ export async function mergeBranches(reports, baseSha, deps) {
         const { env } = integ;
         const integBase = (await env.exec("git rev-parse HEAD", { cwd: repo })).stdout.trim();
         phase = "apply";
-        const conflictsResolved = [];
+        const applied = [];
         for (const p of patches) {
             const patchPath = `/tmp/${p.workerId}.patch`;
             await env.writeFile(patchPath, p.patch);
             const ap = await env.exec(`git apply --3way --whitespace=nowarn ${Q(patchPath)}`, { cwd: repo });
             if (ap.exitCode !== 0) {
                 const rej = await env.exec(`find . -name '*.rej' -print -exec cat {} +`, { cwd: repo }).catch(() => ({ stdout: "", stderr: "", exitCode: -1 }));
-                const cr = integ.conflictResolver && integ.conflictResolver.maxRounds > 0
-                    ? await resolveApplyConflict(env, repo, p, rej.stdout, ap.stderr, integ.conflictResolver, deps)
-                    : { resolved: false, costUsd: 0 };
-                conflictResolverCostUsd += cr.costUsd;
-                if (!cr.resolved) {
-                    deps.logger?.warn?.("merge_apply_failed", { workerId: p.workerId, exitCode: ap.exitCode });
-                    return { ok: false, phase: "apply", reason: `git apply --3way failed for ${p.workerId} (conflict)`, quarantine: [p.workerId], rej: rej.stdout, details: redactHead(ap.stderr, 800), ...(conflictResolverCostUsd > 0 ? { conflictResolverCostUsd } : {}) };
-                }
-                conflictsResolved.push(p.workerId);
+                const listing = await env
+                    .exec(`grep -rIlE --exclude-dir=.git '^(<<<<<<<|>>>>>>>)' . 2>/dev/null; [ $? -le 1 ] || echo ${PROBE_FAIL_PREFIX}grep; ` +
+                    `find . -path ./.git -prune -o -name '*.rej' -print 2>/dev/null || echo ${PROBE_FAIL_PREFIX}find`, { cwd: repo })
+                    .catch(() => ({ exitCode: -1, stdout: "", stderr: "" }));
+                const { files, truncated, probeFailed } = conflictFilesOf(listing.stdout);
+                if (listing.exitCode !== 0 || probeFailed.length > 0)
+                    deps.logger?.warn?.("merge_conflict_files_probe_failed", { workerId: p.workerId, exitCode: listing.exitCode, probeFailed });
+                deps.logger?.warn?.("merge_apply_failed", { workerId: p.workerId, exitCode: ap.exitCode, files: files.slice(0, 20) });
+                const rejHead = redactArtifactText(rej.stdout).slice(0, CONFLICT_REJ_HEAD_MAX);
+                return {
+                    ok: false, phase: "apply", reason: `git apply --3way failed for ${p.workerId} (conflict)`,
+                    quarantine: [p.workerId], rej: rej.stdout, details: redactHead(ap.stderr, 800),
+                    conflict: { files, ...(truncated ? { filesTruncated: true } : {}), applied: [...applied], conflicted: p.workerId, ...(rejHead ? { rejHead } : {}) },
+                };
             }
+            applied.push(p.workerId);
         }
         phase = "test";
         let test = await env.exec(deps.testCmd, { cwd: repo });
@@ -74,7 +81,7 @@ export async function mergeBranches(reports, baseSha, deps) {
             deps.logger?.info?.("integration_repair_done", { ...repairMeta });
         }
         if (test.exitCode !== 0) {
-            return { ok: false, phase: "test", reason: `integration test failed (exit ${test.exitCode})`, details: redactTail(test.stdout + "\n" + test.stderr, 2000), ...(repairMeta ? { repair: repairMeta } : {}), ...(conflictResolverCostUsd > 0 ? { conflictResolverCostUsd } : {}) };
+            return { ok: false, phase: "test", reason: `integration test failed (exit ${test.exitCode})`, details: redactTail(test.stdout + "\n" + test.stderr, 2000), ...(repairMeta ? { repair: repairMeta } : {}) };
         }
         if (deps.measureCmd) {
             const mr = await env.exec(deps.measureCmd, { cwd: repo });
@@ -83,7 +90,7 @@ export async function mergeBranches(reports, baseSha, deps) {
         phase = "push";
         if (repairMeta)
             await env.exec(`git reset --soft ${Q(integBase)}`, { cwd: repo });
-        const costTail = { ...(repairMeta ? { repair: repairMeta } : {}), ...(conflictResolverCostUsd > 0 ? { conflictResolverCostUsd } : {}) };
+        const costTail = { ...(repairMeta ? { repair: repairMeta } : {}) };
         const commit = await env.exec(`git add -A && git -c user.email=leader@local -c user.name=leader commit -m ${Q(`merge: integrate ${mergeable.map((r) => r.workerId).join("+")}`)} --allow-empty`, { cwd: repo });
         if (commit.exitCode !== 0) {
             return { ok: false, phase: "push", reason: `failed to create integration commit (exit ${commit.exitCode})`, details: redactHead(commit.stdout + "\n" + commit.stderr, 800), ...costTail };
@@ -107,7 +114,6 @@ export async function mergeBranches(reports, baseSha, deps) {
                 candidatePatch: h.candidatePatch,
                 ...(measure ? { measure } : {}),
                 ...(repairMeta ? { repair: repairMeta } : {}),
-                ...(conflictResolverCostUsd > 0 ? { conflictResolverCostUsd } : {}),
             };
         }
         const push = await deps.push(integrated.stdout, baseSha);
@@ -117,7 +123,7 @@ export async function mergeBranches(reports, baseSha, deps) {
             return { ok: false, phase: "push", reason: `push failed: ${push.error}`, ...costTail };
         }
         deps.logger?.info?.("merge_ok", { ref: push.ref, merged: mergeable.map((r) => r.workerId), ...(repairMeta ? { repairRounds: repairMeta.rounds } : {}) });
-        return { ok: true, ref: push.ref, merged: mergeable.map((r) => r.workerId), ...(measure ? { measure } : {}), ...(repairMeta ? { repair: repairMeta } : {}), ...(conflictsResolved.length > 0 ? { conflictsResolved } : {}), ...(conflictResolverCostUsd > 0 ? { conflictResolverCostUsd } : {}) };
+        return { ok: true, ref: push.ref, merged: mergeable.map((r) => r.workerId), ...(measure ? { measure } : {}), ...(repairMeta ? { repair: repairMeta } : {}) };
     }
     catch (e) {
         return {
@@ -125,7 +131,6 @@ export async function mergeBranches(reports, baseSha, deps) {
             quarantine: mergeable.map((r) => r.workerId),
             ...(measure ? { measure } : {}),
             ...(repairMeta ? { repair: repairMeta } : {}),
-            ...(conflictResolverCostUsd > 0 ? { conflictResolverCostUsd } : {}),
         };
     }
     finally {
@@ -170,28 +175,30 @@ async function evaluatePushHold(mergeable, observeMeasure, integratedPatch, deps
     }
     return { measure };
 }
-async function resolveApplyConflict(env, repo, p, rejText, applyStderr, resolver, deps) {
-    let costUsd = 0;
-    const conflictText = `git apply --3way could not cleanly apply worker '${p.workerId}'.\n--- apply stderr ---\n${redactHead(applyStderr, 1500)}\n--- reject hunks (*.rej) ---\n${redactHead(rejText, 3000)}`;
-    for (let round = 0; round < resolver.maxRounds; round++) {
-        deps.logger?.warn?.("merge_conflict_repair_round", { workerId: p.workerId, round: round + 1, maxRounds: resolver.maxRounds });
-        try {
-            const r = await resolver.run({ round: round + 1, workerId: p.workerId, conflictText, patch: p.patch, repoDir: repo });
-            costUsd += r.costUsd ?? 0;
-        }
-        catch (e) {
-            deps.logger?.warn?.("merge_conflict_repair_error", { workerId: p.workerId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
-            return { resolved: false, costUsd };
-        }
-        const check = await env
-            .exec(`grep -rIlE '^(<<<<<<<|>>>>>>>)' . 2>/dev/null; find . -name '*.rej' 2>/dev/null | head -20`, { cwd: repo })
-            .catch(() => ({ exitCode: -1, stdout: "DIRTY", stderr: "" }));
-        if (!check.stdout.trim()) {
-            await env.exec(`find . -name '*.orig' -delete 2>/dev/null || true`, { cwd: repo }).catch(() => { });
-            deps.logger?.info?.("merge_conflict_resolved", { workerId: p.workerId, rounds: round + 1 });
-            return { resolved: true, costUsd };
+export const PROBE_FAIL_PREFIX = "__PROBE_FAIL_";
+export function conflictFilesOf(stdout) {
+    const out = [];
+    const probeFailed = [];
+    const seen = new Set();
+    for (const raw of stdout.split("\n")) {
+        let f = raw.trim();
+        if (f === "")
+            continue;
+        if (f.startsWith(PROBE_FAIL_PREFIX)) {
+            probeFailed.push(f.slice(PROBE_FAIL_PREFIX.length));
+            continue;
         }
+        if (f.startsWith("./"))
+            f = f.slice(2);
+        if (f.endsWith(".rej"))
+            f = f.slice(0, -4);
+        if (f === "" || seen.has(f))
+            continue;
+        seen.add(f);
+        if (out.length >= CONFLICT_FILES_MAX)
+            return { files: out, truncated: true, probeFailed };
+        out.push(f);
     }
-    return { resolved: false, costUsd };
+    return { files: out, truncated: false, probeFailed };
 }
 //# sourceMappingURL=merge.js.map

package/dist/leader/wire.d.ts

@@ -129,11 +129,6 @@ export interface LeaderWireConfig {
      *  0 / unset = OFF (a failing integration test is terminal, the pre-2026-06-14 behavior). Env override:
      *  LEADER_REPAIR_ROUNDS. Repair runs the strong (default) model with hands in the live merged sandbox. */
     repairRounds?: number;
-    /** Max bounded merge-conflict-resolution rounds on a `git apply --3way` conflict (see merge.ts ConflictResolver).
-     *  0 / unset = OFF (an apply conflict collapses the whole run to a single worker, the pre-2026-06-16 behavior).
-     *  Env override: LEADER_CONFLICT_ROUNDS. Resolves the conflict in-place + keeps the other workers' work, instead
-     *  of discarding all fan-out output and redoing single. Runs the strong (default) model with hands in the sandbox. */
-    conflictRounds?: number;
     /** [ref] §8 F2(a): when set, workers run on FACTORY envs (runner-owned lifecycle — the durable-suspend-
      *  complete path; a suspended worker's paused env is exempt from the leader reap by construction) and diff-out
      *  is the worker's mandatory self-upload to this MinIO/S3 store (presigned per worker; creds adapter-held).
@@ -173,14 +168,6 @@ type WireEnv = Pick<RemoteExecutionEnv, "exec" | "writeFile">;
  *    k8s、host `RemoteHostExecutionEnv`——`hostExecutionEnvFactory` 恒 `new RemoteHostExecutionEnv`),
  *    所以这条臂是**防御性**的:它真响的那天,意思是有人接了一条新工厂车道而 leader 收不动它的沙盒。
  */
-/** 冲突解决模型的目标文本——纯函数(第十三轮重扫 [medium]:wire 内联时无法钉「补丁先脱」;抽出来直接钉)。
- *  补丁走补丁头窗(头 256KB 扫再切 6000;解决者仍有工作树里的冲突标记),conflictText 由 merge.ts 先脱后切。 */
-export declare function buildConflictResolverObjective(args: {
-    workerId: string;
-    repoDir: string;
-    patch: string;
-    conflictText: string;
-}): string;
 export declare function createEnvReaper(env: ExecutionEnv, what: string): () => Promise<void>;
 /**
  * Resume-safe worker staging (the [ref] F2(a) factory-env path). Runs adapter-side before the agent's
@@ -247,13 +234,12 @@ export declare function leaderResourceConfig(env?: NodeJS.ProcessEnv): {
         maxSuspends: number;
     };
 };
-/** Repair/conflict/replan-loop knobs derived from env + optional `LeaderWireConfig` fallbacks (`repairRounds`/
- *  `conflictRounds` land in cfg when the caller wires them programmatically instead of via env). Split out of
+/** Repair/replan-loop knobs derived from env + optional `LeaderWireConfig` fallbacks (`repairRounds` lands in
+ *  cfg when the caller wires it programmatically instead of via env). Split out of
  *  `createLeaderRunner`'s closure so it's a plain, unit-testable data constructor. */
 export interface LeaderLoopConfig {
     repairRounds: number;
     repairBudgetUsd: number;
-    conflictRounds: number;
     repairLoopOn: boolean;
     measureGatesOn: boolean;
     repairLoopAttempts: number;
@@ -264,7 +250,6 @@ export interface LeaderLoopConfig {
 }
 export declare function leaderLoopConfig(cfg: {
     repairRounds?: number;
-    conflictRounds?: number;
 }, env?: NodeJS.ProcessEnv): LeaderLoopConfig;
 export declare const LEADER_PUSH_NETWORK_TIMEOUT_MS = 120000;
 export declare const LEADER_PUSH_LOCAL_TIMEOUT_MS = 30000;

package/dist/leader/wire.js

@@ -16,7 +16,7 @@ import { attachRepairLoopDeps } from "./repair-wire.js";
 import { routePlanWithFallback, validateSubtasks } from "./planner.js";
 import { createEngineNoticeSeat } from "../boot/runner-deps.js";
 import { currentPrincipal } from "../observability/principal-context.js";
-import { redactHead, redactPatchHead } from "../observability/run-terminal-log.js";
+import { redactHead } from "../observability/run-terminal-log.js";
 const REPAIR_LOOP_WIRED = true;
 const sh = (env) => async (cmd) => {
     const r = await env.exec(`bash -lc ${JSON.stringify(cmd)}`);
@@ -34,18 +34,6 @@ const asIntegrationEnv = (env) => ({
     writeFile: async (p, c) => { const r = await env.writeFile(p, c); if (!r.ok)
         throw r.error; },
 });
-export function buildConflictResolverObjective(args) {
-    const { workerId, repoDir, patch, conflictText } = args;
-    return [
-        `A parallel worker '${workerId}' ported a module on its own branch, but applying its patch onto the already-integrated tree at ${repoDir} produced a MERGE CONFLICT (git apply --3way). The OTHER workers' patches already applied cleanly — integrate THIS worker's changes too, resolving the overlap.`,
-        `Resolve EVERY conflict in the working tree: open each file containing conflict markers (<<<<<<< / ======= / >>>>>>>) and merge BOTH sides' real intent (keep both workers' behaviour — never drop one side just to make it apply). Then apply any rejected hunks recorded in *.rej files by hand, and DELETE every *.rej and *.orig file.`,
-        `When done, NO conflict markers and NO *.rej files may remain under ${repoDir}. Verify yourself before finishing: grep -rIlE '^(<<<<<<<|>>>>>>>)' . ; find . -name '*.rej'  — BOTH must print nothing.`,
-        `HARD RULES: do NOT git commit / git add / git push (the coordinator squashes at the end); do NOT modify build configuration; do NOT call AskUserQuestion — decide autonomously. Preserve both sides' ported semantics.`,
-        ``,
-        delimitUntrusted("CONFLICTING WORKER PATCH (untrusted)", redactPatchHead(patch, 6000)),
-        delimitUntrusted("CONFLICT DETAILS (untrusted)", conflictText),
-    ].join("\n");
-}
 export function createEnvReaper(env, what) {
     if (!hasDestroy(env)) {
         throw new Error(`${what}: the execution-env factory returned an env with no destroy() — the leader OWNS this dedicated sandbox and this closure is its only teardown, so it would leak (and keep billing) until the backend's own timeout reaps it. Deploy a factory whose env implements RemoteExecutionEnv.destroy for the leader lane.`);
@@ -98,15 +86,12 @@ export function leaderLoopConfig(cfg, env = process.env) {
         ? parseNumOrFailNonNegative("LEADER_REPAIR_ROUNDS", env.LEADER_REPAIR_ROUNDS)
         : (cfg.repairRounds ?? 0)) || 0);
     const repairBudgetUsd = parseNumOrFailNonNegative("LEADER_REPAIR_BUDGET_USD", env.LEADER_REPAIR_BUDGET_USD ?? "4") || 4;
-    const conflictRounds = Math.max(0, Math.floor(env.LEADER_CONFLICT_ROUNDS !== undefined
-        ? parseNumOrFailNonNegative("LEADER_CONFLICT_ROUNDS", env.LEADER_CONFLICT_ROUNDS)
-        : (cfg.conflictRounds ?? 0)) || 0);
     const repairLoopOn = String(env.LEADER_REPAIR_LOOP ?? "").toLowerCase() === "true";
     const measureGatesOn = String(env.LEADER_MEASURE_GATES ?? "").toLowerCase() === "true";
     const repairLoopAttempts = Math.min(3, Math.max(2, Math.floor(parseNumOrFailNonNegative("LEADER_REPAIR_LOOP_ATTEMPTS", env.LEADER_REPAIR_LOOP_ATTEMPTS ?? "2")) || 2));
     const oracleFlakyK = Math.max(1, Math.floor(parseNumOrFailNonNegative("LEADER_ORACLE_FLAKY_K", env.LEADER_ORACLE_FLAKY_K ?? "2")) || 2);
     return {
-        repairRounds, repairBudgetUsd, conflictRounds, repairLoopOn, measureGatesOn, repairLoopAttempts, oracleFlakyK,
+        repairRounds, repairBudgetUsd, repairLoopOn, measureGatesOn, repairLoopAttempts, oracleFlakyK,
         ...(env.LEADER_BUDGET_USD ? { replanBudgetUsd: parseNumOrFailNonNegative("LEADER_BUDGET_USD", env.LEADER_BUDGET_USD) } : {}),
     };
 }
@@ -148,7 +133,7 @@ export function createLeaderRunner(cfg) {
     const repo = `${W}/repo`;
     const ident = cfg.git ?? { name: "leader", email: "leader@local" };
     const { leaderTimeoutMs, workerLimits, presignTtlSec, resourceSuspend: resourceCfg } = leaderResourceConfig();
-    const { repairRounds, repairBudgetUsd, conflictRounds, repairLoopOn, measureGatesOn, repairLoopAttempts, oracleFlakyK, replanBudgetUsd, } = leaderLoopConfig({ repairRounds: cfg.repairRounds, conflictRounds: cfg.conflictRounds });
+    const { repairRounds, repairBudgetUsd, repairLoopOn, measureGatesOn, repairLoopAttempts, oracleFlakyK, replanBudgetUsd, } = leaderLoopConfig({ repairRounds: cfg.repairRounds });
     const onNoticeSeat = createEngineNoticeSeat(cfg.logger);
     const governanceSeat = cfg.governance ?? {};
     const deploymentPostureSeat = () => cfg.deploymentPosture?.() ?? {};
@@ -204,43 +189,6 @@ export function createLeaderRunner(cfg) {
             },
         };
     };
-    const mkConflictResolver = (rawEnv, repoDir, oracleFiles) => {
-        if (conflictRounds <= 0)
-            return undefined;
-        return {
-            maxRounds: conflictRounds,
-            run: async ({ round, workerId, conflictText, patch }) => {
-                for (const f of oracleFiles) {
-                    await rawEnv.remove(f.path).catch(() => { });
-                    const ex = await rawEnv.exists(f.path);
-                    if (ex.ok && ex.value)
-                        throw new Error(`oracle still present after remove (${f.path}) — refusing conflict-resolve (measurement integrity)`);
-                }
-                try {
-                    const runner = new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, executionEnv: rawEnv, rootPath: repoDir });
-                    const objective = buildConflictResolverObjective({ workerId, repoDir, patch, conflictText });
-                    const res = await runner
-                        .runTaskStream({
-                        objective,
-                        ...principalSpec(),
-                        sessionId: `leader-conflict-${Date.now()}-${round}`,
-                        limits: { maxCostUsd: repairBudgetUsd, maxWalltimeMs: Math.max(300_000, Math.floor(leaderTimeoutMs / 2)) },
-                    })
-                        .result();
-                    if (res.terminal.kind !== "completed")
-                        throw new Error(`conflict-resolve round ${round} did not complete (status=${terminalProjection(res.terminal).status})`);
-                    return { costUsd: res.stats?.costMicroUsd !== undefined ? res.stats.costMicroUsd / 1e6 : undefined, note: res.result?.slice(0, 200) };
-                }
-                finally {
-                    for (const f of oracleFiles) {
-                        const wr = await rawEnv.writeFile(f.path, f.content);
-                        if (!wr.ok)
-                            throw wr.error;
-                    }
-                }
-            },
-        };
-    };
     return async (raw) => {
         const body = raw;
         if (!body.objective || !body.durableRemote || !body.testCmd || !body.seedCmd || !body.baseSha) {
@@ -406,8 +354,7 @@ export function createLeaderRunner(cfg) {
                 const rawEnv = env;
                 const oracleFiles = body.oracleFiles ?? [];
                 const repair = mkRepair(rawEnv, repo, oracleFiles);
-                const conflictResolver = mkConflictResolver(rawEnv, repo, oracleFiles);
-                return { env: asIntegrationEnv(env), destroy: reap, ...(repair ? { repair } : {}), ...(conflictResolver ? { conflictResolver } : {}) };
+                return { env: asIntegrationEnv(env), destroy: reap, ...(repair ? { repair } : {}) };
             }
             if (!cfg.e2bApiKey)
                 throw new Error("leader wire: no envFactory and no e2bApiKey");
@@ -424,7 +371,7 @@ export function createLeaderRunner(cfg) {
                 await env.destroy().catch(() => { });
                 throw e;
             }
-            return { env: asIntegrationEnv(env), destroy: () => env.destroy().then(() => { }), ...(mkRepair(env, repo, body.oracleFiles ?? []) ? { repair: mkRepair(env, repo, body.oracleFiles ?? []) } : {}), ...(mkConflictResolver(env, repo, body.oracleFiles ?? []) ? { conflictResolver: mkConflictResolver(env, repo, body.oracleFiles ?? []) } : {}) };
+            return { env: asIntegrationEnv(env), destroy: () => env.destroy().then(() => { }), ...(mkRepair(env, repo, body.oracleFiles ?? []) ? { repair: mkRepair(env, repo, body.oracleFiles ?? []) } : {}) };
         };
         const push = createCoordinatorPush(body.durableRemote, body.targetRef, ident);
         const deps = {

package/dist/observability/fail-open.d.ts

@@ -215,7 +215,7 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.run-terminal.redact-threw": {
         readonly cls: "F";
-        readonly note: "四个发射座(errorMessage 终态文案 / 诊断文本 diag / 补丁头 patch-head / 工件 artifact,probe 前缀判别;普查 56 行):S-105 最终轮 [medium]:终态 errorMessage/blockedReason/remoteEnvFailures[].message 脱敏抛出(RangeError:关键字/前缀臂那一形已由 S-219 的 atLeast 铸点闭掉,仍能抛的是 JSON 秘密字段臂的转义对循环,既有未闭,S-106)⇒ 落固定占位 «redacted:oversized»——绝不落原文(安全轴 fail-closed),也绝不阻断终态翻转与 claim 释放(可用性)。方向刻意:一条超大错误体不得把 run 卡在 running。";
+        readonly note: "三个发射座(errorMessage 终态文案 / 诊断文本 diag / 工件 artifact,probe 前缀判别;普查 56 行;补丁头 patch-head 那座随 7.83.0 / S-113 的 redactPatchHead 一并退役):S-105 最终轮 [medium]:终态 errorMessage/blockedReason/remoteEnvFailures[].message 脱敏抛出(RangeError:关键字/前缀臂那一形已由 S-219 的 atLeast 铸点闭掉,仍能抛的是 JSON 秘密字段臂的转义对循环,既有未闭,S-106)⇒ 落固定占位 «redacted:oversized»——绝不落原文(安全轴 fail-closed),也绝不阻断终态翻转与 claim 释放(可用性)。方向刻意:一条超大错误体不得把 run 卡在 running。";
     };
     readonly "server.run-terminal.redact-capped": {
         readonly cls: "F";
@@ -229,10 +229,6 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-107:诊断文本座(merge details/measure/grader trace、leader 日志座、planner 样本、journal 预览、workflow_run error cut)长度 > DIAG_INPUT_CAP(256KB)⇒ 整段换 «redacted:oversized-diagnostic» [len=N](fail-closed 取证丢弃;固定窗不 fail-closed 故不开窗);计数=多少段诊断文本被整段丢弃";
     };
-    readonly "server.run-terminal.patch-head-cut": {
-        readonly cls: "F";
-        readonly note: "S-107:进模型的 worker 补丁(collapse 目标 / 冲突解决目标)> DIAG_INPUT_CAP(256KB)⇒ **不内联**,整份换 «redacted:oversized-patch-not-inlined» [len=N](第十三轮开的 256KB 头窗及其裁切守卫在五轮复审后撤回);计数=多少份补丁因超限未内联";
-    };
     readonly "server.run-terminal.output-truncated": {
         readonly cls: "F";
         readonly note: "S-107:持久 error 脱后 UTF-8 字节 > 65,000(TiDB TEXT 65,535 字节)⇒ 脱后切并带标记(切在占位里不是泄漏);计数=多少条终态文案被字节封顶截断";
@@ -253,6 +249,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-55(test [5864] 独立复现):pg 连接池里一条连接被外部终止(pg_terminate_backend / 云端故障切换 / LB 空闲回收)或自身网络错误。**两态一 tag,detail 判别**(`state=idle` / `state=checked-out`;先例=park 墓碑行的两臂 detail 判别):①idle 态 —— node-postgres 语义(pg-pool@3.14.0 makeIdleListener):池在 emit 'error' **之前**已 `_remove` 掉该 client,坏连接自然淘汰,下次 acquire 发新连接,在飞查询零影响;修前 Pool 上无 'error' 监听 ⇒ EventEmitter 把事件转 throw ⇒ uncaughtException ⇒ 整进程 exit 1。②checked-out 态(codex R1-[high] 补,同批修)—— pg-pool 借出时摘 idle 监听(index.js:344),`pool.connect()` 显式持有的连接(事务)在 checkout 期死时 client 直接 emit 'error' 同样打死进程;守卫只观察:中毒 client 的后续查询由 pg 以 `_queryable=false` 响亮拒,归还时池淘汰;同一次 checkout 的死可能双发事件(FATAL 消息 + socket end),warn 逐枚、计数按 checkout 去重。放行的最坏后果 = 下一次 acquire 多付一次建连,故 F 类。必须留痕:「连接不断被外部杀」(故障切换风暴 / 回收策略过激 / 有人在库上清连接)与「一切正常」在服务面同形;每次事件另有逐次结构化 warn(`pg_pool_idle_client_error` / `pg_pool_checked_out_client_error`,含 code/severity),本计数让频率曲线可读。`pool.query()` 快路不在洞内(pg-pool 自带 checkout 期 once('error') 守卫)。mysql2 孪生(tidb-pool)**不同病**:PoolConnection 构造器恒挂 once('error') 库内吞并淘汰、借出期同在(坐标成文在 createTidbPool 头注),故无同族 tag。";
     };
+    readonly "server.ensure-index.concurrently-unsupported": {
+        readonly cls: "F";
+        readonly note: "S-287(`plugins/ensure-index.ts` 的 PG 臂):这口 PG **协议**面不认 `CREATE INDEX CONCURRENTLY`。今天唯一的真消费者是**仓内离线镜像的手搓 `PgQueryFn` 假件**(`pg-mem` 不是本仓依赖,`test/memory-embedder-fingerprint.test.ts` 头注已为此记过一次档,这里不重复那个错)。判据是**能力面**不是名字,且**只认阳性信号**:SQLSTATE ∈ {`0A000` feature_not_supported、`42601` syntax_error},或错误**完全不带 `code`**(= 不是驱动也不是服务端给的错误)⇒ 判「不认」,回退成普通 `CREATE INDEX IF NOT EXISTS`;**带任何其它 `code` 的一律原样抛** —— SQLSTATE 的 `55P03`/`57014`/`23505`/`42501`/`25001` 与 libuv 的 `ECONNRESET`/`EPIPE`/`ETIMEDOUT` 都在这一侧(⚠️ 不要按「5 位大写」的形状去分这两族:`EPIPE` 恰好也是 5 位大写)。放行的最坏后果 = 这一次建索引持表级 `SHARE` 锁阻塞该表的写(纯**性能/可用性**面,索引本身照样建成、语义零差别),而能走到这条臂的面**按定义**不是生产 PG。计数非零 = 有一口本以为是真 PG 的部署其实不认 CONCURRENTLY,运维要去看它到底是什么。detail = `<表>.<索引名>`。";
+    };
 };
 /** 词表键推导的闭集类型——未登记的 tag 传不进 {@link recordFailOpen}(编译期拒)。 */
 export type FailOpenTag = keyof typeof FAIL_OPEN_TAGS;

package/dist/observability/fail-open.js

@@ -206,12 +206,11 @@ export const FAIL_OPEN_TAGS = {
     },
     "server.run-terminal.redact-threw": {
         cls: "F",
-        note: "四个发射座(errorMessage 终态文案 / 诊断文本 diag / 补丁头 patch-head / 工件 artifact,probe 前缀判别;普查 56 行):S-105 最终轮 [medium]:终态 errorMessage/blockedReason/remoteEnvFailures[].message 脱敏抛出(RangeError:关键字/前缀臂那一形已由 S-219 的 atLeast 铸点闭掉,仍能抛的是 JSON 秘密字段臂的转义对循环,既有未闭,S-106)⇒ 落固定占位 «redacted:oversized»——绝不落原文(安全轴 fail-closed),也绝不阻断终态翻转与 claim 释放(可用性)。方向刻意:一条超大错误体不得把 run 卡在 running。",
+        note: "三个发射座(errorMessage 终态文案 / 诊断文本 diag / 工件 artifact,probe 前缀判别;普查 56 行;补丁头 patch-head 那座随 7.83.0 / S-113 的 redactPatchHead 一并退役):S-105 最终轮 [medium]:终态 errorMessage/blockedReason/remoteEnvFailures[].message 脱敏抛出(RangeError:关键字/前缀臂那一形已由 S-219 的 atLeast 铸点闭掉,仍能抛的是 JSON 秘密字段臂的转义对循环,既有未闭,S-106)⇒ 落固定占位 «redacted:oversized»——绝不落原文(安全轴 fail-closed),也绝不阻断终态翻转与 claim 释放(可用性)。方向刻意:一条超大错误体不得把 run 卡在 running。",
     },
     "server.run-terminal.redact-capped": { cls: "F", note: "S-107:终态自由文本(errorMessage/blockedReason/remoteEnvFailures[].message/error 列/done·failed 行)长度 > REDACT_INPUT_CAP(64KB)⇒ 整段换 «redacted:oversized»(fail-closed 取证丢弃,不截断不扫);计数=多少条终态文案被整段丢弃" },
     "server.run-terminal.artifact-capped": { cls: "F", note: "S-107:leader_run 行上的工件字节(salvaged[].patch / candidatePatch.patch / merge.candidatePatch / merge.rej)长度 > ARTIFACT_INPUT_CAP(256KB)⇒ 整份换 «redacted:oversized-artifact»(fail-closed 取证丢弃;原字节仍在 worker 分支/merge 咽喉);计数=多少份工件被整份丢弃" },
     "server.run-terminal.diag-capped": { cls: "F", note: "S-107:诊断文本座(merge details/measure/grader trace、leader 日志座、planner 样本、journal 预览、workflow_run error cut)长度 > DIAG_INPUT_CAP(256KB)⇒ 整段换 «redacted:oversized-diagnostic» [len=N](fail-closed 取证丢弃;固定窗不 fail-closed 故不开窗);计数=多少段诊断文本被整段丢弃" },
-    "server.run-terminal.patch-head-cut": { cls: "F", note: "S-107:进模型的 worker 补丁(collapse 目标 / 冲突解决目标)> DIAG_INPUT_CAP(256KB)⇒ **不内联**,整份换 «redacted:oversized-patch-not-inlined» [len=N](第十三轮开的 256KB 头窗及其裁切守卫在五轮复审后撤回);计数=多少份补丁因超限未内联" },
     "server.run-terminal.output-truncated": { cls: "F", note: "S-107:持久 error 脱后 UTF-8 字节 > 65,000(TiDB TEXT 65,535 字节)⇒ 脱后切并带标记(切在占位里不是泄漏);计数=多少条终态文案被字节封顶截断" },
     "server.runs.terminal-ledger-write-failed": { cls: "F", note: "S-107(全量门 silent-degradation 棘轮抓出的五处静默 `catch {}`):run 终局链里**账本腿**(flush 缓冲 text/reasoning、append `failed` 行)与终态翻转(setTerminal)已不共命运——账本 INSERT 抛不再让 run 卡 running 到 reaper;但那条抛掉的账本行之前是**静默**吞的。detail `arm=` 四臂(flush-clean-cancel / append-clean-cancel / flush-catch / append-thrown-cancel / append-failed):缺的是 run_events 尾巴(缓冲文本或 failed 事件),run 行本身仍是 durable truth,读面/reaper 容忍缺失,故 F 类;计数=多少次终局账本写失败。" },
     "server.redact.ppk-eat-to-end": { cls: "F", note: "S-107 第三十二轮重扫:PuTTY .ppk 容器扫描器(redact.ts redactPpkContainers)在「无合格终止 / 收口后同容器范围再见私钥字段 / 收口后到下一版本头之间夹非空白」三形下从头**吃到输入末尾**(fail-closed 取证丢弃)——终态 errorMessage 座上=整条错误文案变成 «redacted:private-key»,与 redactions_applied_total{private-key} 的诚实替换同形不可分,故要有自己的计数/探针;影子扫不计;计数=多少次整段吃尾。" },
@@ -223,6 +222,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-55(test [5864] 独立复现):pg 连接池里一条连接被外部终止(pg_terminate_backend / 云端故障切换 / LB 空闲回收)或自身网络错误。**两态一 tag,detail 判别**(`state=idle` / `state=checked-out`;先例=park 墓碑行的两臂 detail 判别):①idle 态 —— node-postgres 语义(pg-pool@3.14.0 makeIdleListener):池在 emit 'error' **之前**已 `_remove` 掉该 client,坏连接自然淘汰,下次 acquire 发新连接,在飞查询零影响;修前 Pool 上无 'error' 监听 ⇒ EventEmitter 把事件转 throw ⇒ uncaughtException ⇒ 整进程 exit 1。②checked-out 态(codex R1-[high] 补,同批修)—— pg-pool 借出时摘 idle 监听(index.js:344),`pool.connect()` 显式持有的连接(事务)在 checkout 期死时 client 直接 emit 'error' 同样打死进程;守卫只观察:中毒 client 的后续查询由 pg 以 `_queryable=false` 响亮拒,归还时池淘汰;同一次 checkout 的死可能双发事件(FATAL 消息 + socket end),warn 逐枚、计数按 checkout 去重。放行的最坏后果 = 下一次 acquire 多付一次建连,故 F 类。必须留痕:「连接不断被外部杀」(故障切换风暴 / 回收策略过激 / 有人在库上清连接)与「一切正常」在服务面同形;每次事件另有逐次结构化 warn(`pg_pool_idle_client_error` / `pg_pool_checked_out_client_error`,含 code/severity),本计数让频率曲线可读。`pool.query()` 快路不在洞内(pg-pool 自带 checkout 期 once('error') 守卫)。mysql2 孪生(tidb-pool)**不同病**:PoolConnection 构造器恒挂 once('error') 库内吞并淘汰、借出期同在(坐标成文在 createTidbPool 头注),故无同族 tag。",
     },
+    "server.ensure-index.concurrently-unsupported": {
+        cls: "F",
+        note: "S-287(`plugins/ensure-index.ts` 的 PG 臂):这口 PG **协议**面不认 `CREATE INDEX CONCURRENTLY`。今天唯一的真消费者是**仓内离线镜像的手搓 `PgQueryFn` 假件**(`pg-mem` 不是本仓依赖,`test/memory-embedder-fingerprint.test.ts` 头注已为此记过一次档,这里不重复那个错)。判据是**能力面**不是名字,且**只认阳性信号**:SQLSTATE ∈ {`0A000` feature_not_supported、`42601` syntax_error},或错误**完全不带 `code`**(= 不是驱动也不是服务端给的错误)⇒ 判「不认」,回退成普通 `CREATE INDEX IF NOT EXISTS`;**带任何其它 `code` 的一律原样抛** —— SQLSTATE 的 `55P03`/`57014`/`23505`/`42501`/`25001` 与 libuv 的 `ECONNRESET`/`EPIPE`/`ETIMEDOUT` 都在这一侧(⚠️ 不要按「5 位大写」的形状去分这两族:`EPIPE` 恰好也是 5 位大写)。放行的最坏后果 = 这一次建索引持表级 `SHARE` 锁阻塞该表的写(纯**性能/可用性**面,索引本身照样建成、语义零差别),而能走到这条臂的面**按定义**不是生产 PG。计数非零 = 有一口本以为是真 PG 的部署其实不认 CONCURRENTLY,运维要去看它到底是什么。detail = `<表>.<索引名>`。"
+    },
 };
 export function failOpenTagForDroppedFrame(frameType) {
     switch (frameType) {

package/dist/observability/run-terminal-log.d.ts

@@ -135,13 +135,6 @@ export declare const DIAG_INPUT_CAP = 262144;
 export declare const OVERSIZED_DIAG_PLACEHOLDER = "\u00ABredacted:oversized-diagnostic\u00BB";
 export declare function redactDiagnosticText(text: string): string;
 export declare function redactHead(text: string, keep: number): string;
-/** 进模型的 worker 补丁头(collapse 目标 / 冲突解决目标):**不开窗**。第十三轮为保留大 diff 的可复用头部开了 256KB 头窗,
- *  此后 codex r12–r15 与第十五至十七轮重扫五轮各证一次「窗上的裁切守卫可被打穿」(无上界的 JSON 值/URL 密码臂;脱前/脱后坐标
- *  错位;PEM 逐块;前面一处脱敏会**吃掉**守卫所依赖的锚点)——同 S-103 的教训:猜边界的规则总有反例。终形=补丁 ≤256KB 整段扫
- *  再切 keep(完全正确);>256KB **不内联**(占位带原长,tag `patch-head-cut`):冲突解决者仍有工作树里的冲突标记,collapse solo
- *  对 lockfile 级大 diff 失去内联上下文(worker 分支仍在)——这是有意成文的安全轴取舍。 */
-export declare const OVERSIZED_PATCH_PLACEHOLDER = "\u00ABredacted:oversized-patch-not-inlined\u00BB";
-export declare function redactPatchHead(patch: string, keep: number): string;
 export declare function redactTail(text: string, keep: number): string;
 export declare const ARTIFACT_INPUT_CAP = 262144;
 export declare const OVERSIZED_ARTIFACT_PLACEHOLDER = "\u00ABredacted:oversized-artifact\u00BB";

package/dist/observability/run-terminal-log.js

@@ -383,7 +383,6 @@ export function redactDiagnosticText(text) {
 export function redactHead(text, keep) {
     return redactDiagnosticText(text).slice(0, keep);
 }
-export const OVERSIZED_PATCH_PLACEHOLDER = "«redacted:oversized-patch-not-inlined»";
 function diffScanRefusal(patch, direct) {
     if (/^diff --(?:cc|combined) |^@{3,} /m.test(patch))
         return "combined-diff";
@@ -415,25 +414,6 @@ function diffScanRefusal(patch, direct) {
     }
     return undefined;
 }
-export function redactPatchHead(patch, keep) {
-    if (patch.length > DIAG_INPUT_CAP) {
-        recordFailOpen("server.run-terminal.patch-head-cut", `not-inlined len=${patch.length} keep=${keep}`);
-        return `${OVERSIZED_PATCH_PLACEHOLDER} [len=${patch.length}]`;
-    }
-    try {
-        const direct = redactSecrets(patch);
-        const refusal = diffScanRefusal(patch, direct);
-        if (refusal !== undefined) {
-            recordFailOpen("server.run-terminal.patch-head-cut", `${refusal} len=${patch.length} keep=${keep}`);
-            return `${OVERSIZED_PATCH_PLACEHOLDER} [len=${patch.length}]`;
-        }
-        return direct.slice(0, keep);
-    }
-    catch (err) {
-        recordFailOpen("server.run-terminal.redact-threw", `patch-head len=${patch.length} err=${err instanceof Error ? err.name : String(err)}`);
-        return OVERSIZED_REDACTION_PLACEHOLDER;
-    }
-}
 export function redactTail(text, keep) {
     return redactDiagnosticText(text).slice(-keep);
 }
@@ -506,6 +486,15 @@ export function redactLeaderResultWithFlag(result) {
             m.measure = { ...measure, reason: str(measure.reason) };
         out.merge = m;
     }
+    const conflict = obj(r.conflict);
+    if (conflict) {
+        const c = { ...conflict };
+        if (typeof conflict.rejHead === "string")
+            c.rejHead = art(conflict.rejHead);
+        if (Array.isArray(conflict.files))
+            c.files = conflict.files.map((f) => (typeof f === "string" ? str(f) : f));
+        out.conflict = c;
+    }
     const cp = obj(r.candidatePatch);
     if (cp)
         out.candidatePatch = { ...cp, ...(typeof cp.reason === "string" ? { reason: str(cp.reason) } : {}), ...(typeof cp.patch === "string" ? { patch: art(cp.patch) } : {}) };

package/dist/plugins/adoption-log-sql.d.ts

@@ -24,6 +24,7 @@ import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type SqlDriver, type SqlExec, type SqlTxConn } from "./sql-driver.js";
 import type { AdoptionRejectCode } from "../adoption/wire.js";
+import { type IndexSpec } from "./ensure-index.js";
 export declare const ADOPTION_LOG_TABLE = "adoption_log";
 /** 弧的阶段(183 §3.2 根级状态机的 form b 投影)。**单调**,只增不减。 */
 export declare const ADOPTION_PHASE: {
@@ -106,6 +107,8 @@ export interface AdoptionLogStore {
 /** MySQL 协议方言的建表语句(展开进 tidb-pool 的中央 `SCHEMA_STATEMENTS`,与 approval-ask 同姿势:
  *  跟着中央 ensureSchema 在 named-lock 的那条 conn 上建,不绕开 DDL 串行化)。 */
 export declare const TIDB_ADOPTION_LOG_STATEMENTS: readonly string[];
+/** S-287:本 store 的索引**声明**(两方言共用一份)。PG 侧由下面的 `ensurePgAdoptionLogSchema` 应用,MySQL 侧由 `tidb-pool.ts` 的中央 `ensureSchema` 应用(那里内联 `KEY` 已在 `CREATE TABLE` 里 ⇒ 新建库探到即零 DDL,存量库缺谁补谁)。加索引以外的 schema 变更仍归运维,见 `plugins/ensure-index.ts` 头注。 */
+export declare const ADOPTION_LOG_INDEXES: readonly IndexSpec[];
 /** PostgreSQL 孪生(由 `ensurePgSchema` 在 advisory lock 的那条 client 上调用)。 */
 export declare function ensurePgAdoptionLogSchema(q: (text: string, params?: unknown[]) => Promise<unknown>): Promise<void>;
 /**

package/dist/plugins/adoption-log-sql.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
+import { ensureIndexes } from "./ensure-index.js";
 export const ADOPTION_LOG_TABLE = "adoption_log";
 export const ADOPTION_PHASE = {
     INTENT: 2,
@@ -30,6 +31,9 @@ export const TIDB_ADOPTION_LOG_STATEMENTS = [
      KEY idx_adoption_log_state (state)
    ) COLLATE utf8mb4_bin`,
 ];
+export const ADOPTION_LOG_INDEXES = [
+    { table: `${ADOPTION_LOG_TABLE}`, name: "idx_adoption_log_state", columns: ["state"] },
+];
 export async function ensurePgAdoptionLogSchema(q) {
     await q(`CREATE TABLE IF NOT EXISTS ${ADOPTION_LOG_TABLE} (
      adoption_id    VARCHAR(64) COLLATE "C"  NOT NULL,
@@ -48,7 +52,7 @@ export async function ensurePgAdoptionLogSchema(q) {
      PRIMARY KEY (adoption_id),
      CONSTRAINT uq_adoption_log_from UNIQUE (from_principal)
    )`);
-    await q(`CREATE INDEX IF NOT EXISTS idx_adoption_log_state ON ${ADOPTION_LOG_TABLE} (state)`);
+    await ensureIndexes(q, "pg", ADOPTION_LOG_INDEXES);
 }
 const COLS = "adoption_id, from_principal, to_principal, phase, state, legs, configs, report, reject_code, reject_detail, created_at_ms, updated_at_ms";
 function toRow(r) {