Files
DeepSeek-Reasonix/internal/secrets
SivanCola 866ad4cb8e Fix canonical inbox identity and settled tool state / 修复会话队列身份与工具完成状态 (#10646)
* fix: preserve canonical inbox identity and settled tool status

Problem: canonical sessions could reject queued messages or count another
session's background jobs, while settled tool rows could remain running.
Diagnostic exports could also stop when text redaction damaged JSON.

Root cause: logical session locators were conflated with backing paths, and
sampled job states were treated as the output reader's invocation state.
Diagnostic redaction operated on serialized JSON instead of string values.

Fix: separate inbox identity from storage, use canonical identities for
receipt ownership and runtime metadata, settle background launch receipts,
retain output-reader completion during history restore, and redact JSON
structurally without changing counters or the persisted inbox format.

Verification: root Go suite; focused control and desktop race tests;
sessioninbox and secrets tests; frontend typecheck and transcript suite;
Chromium transcript regression; repolint and git diff --check passed.

* fix: close query workers and reconcile CI validation

Problem: Linux CI raced temporary-directory cleanup with query-cache writes,
and desktop preparation exceeded its initial raw bundle gate by 35 bytes.

Root cause: the mirror-listing fixture retired runtimes without shutting down
its service-owned query workers. Settled tool-state handling adds 104 bytes
to the same-toolchain base and consumes the previous rounded payload margin.

Fix: register terminal service shutdown before directory cleanup and isolate
the listing regression in its own test file. Round only the measured initial
raw bundle budget from 2053.8 to 2053.9 KiB; keep all other gates unchanged.
Also document the unchanged user workflow through PR impact metadata.

Verification: the listing regression passed 20 race-enabled repetitions;
identity lifecycle race tests, transcript and submission regressions, manual
compaction regressions, repolint, and documentation impact validation passed.
Both base and candidate Electron bundles were measured with one toolchain.

* fix: order snapshot eviction independently of clock precision

Problem: Windows CI retained an old read handle after the snapshot bound
was reached, failing the read-snapshot eviction regression.

Root cause: multiple accesses can share one clock sample. Comparing only
timestamps made LRU selection depend on nondeterministic map traversal.

Fix: assign a monotonic access sequence under the store lock at publication,
handle acquisition, and page access. Use that order for eviction and retain
elapsed time for idle and absolute expiry.

Verification: a forced-equal-timestamp regression covering insertion and
page promotion fails against the old implementation. The read-snapshot
suite passed five race-enabled repetitions; desktop go vet and repolint
passed. Native Windows validation remains in the replacement CI run.

* test: range directly over snapshot eviction expectations

Problem: CI's Windows desktop lint rejected the eviction regression loop.
Root cause: the test ranged over len(ordered) instead of the slice itself,
which violates the intrange rule enforced by the pinned linter.
Fix: range directly over ordered, preserving the same eviction assertions.
Verification: run golangci-lint 2.12.2 for Windows amd64, matching CI.
2026-09-22 13:24:35 +08:00
..