# Phase 2 深审 — Wave P2-6（sync_engine_v2.py 全文）

**日期**: 2026-06-04  
**范围**: 推送引擎服务层 — rsync/并发/预览/暂存清理  
**标准**: `standards/line-walk-audit-standard-v2.md` 8 步

## 登记

| # | 文件 | 语言 | 行数 N | Read 范围 |
|---|------|------|--------|-----------|
| 1 | `server/application/services/sync_engine_v2.py` | Python | 552 | 1–552 全文 |
| 2 | `server/utils/posix_paths.py` | Python | — | resolve_nexus_push_source_path（P2-2 已审，交叉引用） |
| 3 | `server/utils/sync_error_message.py` | Python | — | translate_sync_error_message（错误脱敏） |
| 4 | `server/infrastructure/database/crypto.py` | Python | 54 | decrypt_value（P2-4 已审） |
| 5 | `server/api/sync_v2.py` | Python | 1656 | 调用方（P2-2 已审） |

## 入口表（服务层，经 sync_v2 API 调用）

| 方法 | 调用方 | 说明 |
|------|--------|------|
| `sync_files` | POST push/sync | 多机 rsync + WS 进度 |
| `preview_sync` | POST preview | dry-run 单机 |
| `_rsync_push` | 内部 | subprocess rsync |

## Closure 表

| H | 文件:行号 | 判定 | 理由 |
|---|-----------|------|------|
| H-Source | sync_engine_v2.py:72-76,327-330 | SAFE | `_nexus_source_path` 拒绝系统路径 |
| H-Conc | sync_engine_v2.py:38,79-80 | SAFE | MAX_CONCURRENT=10 + min 入参 |
| H-DBLock | sync_engine_v2.py:89,149,190 | SAFE | `_db_lock` 串行写 sync_log/retry |
| H-Cancel | sync_engine_v2.py:96-136 | SAFE | Redis cancel flag；失败则继续 push |
| H-Retry | sync_engine_v2.py:193-224 | SAFE | 失败自动 pending retry；去重 |
| H-Subproc | sync_engine_v2.py:468-473 | SAFE | create_subprocess_exec 参数化 |
| H-Shlex | sync_engine_v2.py:456-458 | SAFE | key path shlex.quote |
| H-KeyTmp | sync_engine_v2.py:449-455,491-495 | SAFE | 0600 临时 key + finally unlink |
| H-Pass | sync_engine_v2.py:440-446 | RISK | sshpass -e；/proc 可见（内网运维可接受） |
| H-Remote | sync_engine_v2.py:414 | SAFE | normalize_remote_abs_path |
| H-Timeout | sync_engine_v2.py:476-482 | SAFE | RSYNC_TIMEOUT+30 kill |
| H-Output | sync_engine_v2.py:486-487 | SAFE | stdout/stderr 截断 10KB |
| H-Staging | sync_engine_v2.py:498-516 | SAFE | 仅 manual 全成功才 rmtree staging |
| H-Preview | sync_engine_v2.py:364-365 | SAFE | verbose 文件列表上限 200 |
| H-Audit | sync_engine_v2.py:267-271,380-391 | SAFE | sync_files 审计；失败 log error |
| H-TG | sync_engine_v2.py:274-291 | SAFE | Telegram 失败不阻断 |
| H-Gather | sync_engine_v2.py:254-265 | SAFE | gather 异常计入 failed |

**len(H)=17, Closure=17**

## FINDING

无 P0/P1 新 FINDING。

## DoD

- [x] sync_engine_v2.py 552 行全文 Read
- [x] len(H) == Closure
- [x] local_verify 通过

## 验证

`bash scripts/local_verify.sh` — 全绿
