@sema-agent/server 7.142.0 → 7.143.0

package/dist/plugins/approval-ask-store-memory.js

@@ -1,7 +1,7 @@
 import { ASK_TERMINAL, canAskTransition } from "../approval-ask-machine.js";
 import { isExecutionLane } from "../execution-lane-caps.js";
 import { APPROVAL_ENDING_CAUSES } from "../approval-deny-reasons.js";
-import { askRowCarriesOwner, askRowOnCall, assertDecideSettledBy, assertIdempotencyKeyShape, assertIntegralEpochMs, assertReapBounds, ApprovalAskReadAbortedError, claimTargetState, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, projectDecideReading } from "./approval-ask-store-sql.js";
+import { askRowCarriesOwner, askRowOnCall, assertDecideSource, assertIdempotencyKeyShape, assertIntegralEpochMs, assertReapBounds, ApprovalAskReadAbortedError, claimTargetState, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, projectDecideReading } from "./approval-ask-store-sql.js";
 function applyPatch(row, patch) {
     if (patch.decision !== undefined)
         row.decision = patch.decision;
@@ -58,7 +58,7 @@ export class InMemoryApprovalAskStore {
     }
     importRows(snapshot) {
         for (const r of snapshot.asks ?? [])
-            this.asks.set(r.askId, { ...r, settledBy: r.settledBy ?? null });
+            this.asks.set(r.askId, { ...r, settledBy: r.settledBy ?? null, decidedVia: r.decidedVia ?? null });
         for (const b of snapshot.batches ?? [])
             this.batches.set(b.batchId, { ...b });
     }
@@ -82,7 +82,7 @@ export class InMemoryApprovalAskStore {
         const created = {
             askId: row.askId,
             taskId: row.taskId,
-            sourceTaskId: row.sourceTaskId,
+            sourceSessionId: row.sourceSessionId,
             sessionId: row.sessionId,
             owner: row.owner ?? null,
             executionLane: row.executionLane,
@@ -98,6 +98,7 @@ export class InMemoryApprovalAskStore {
             decisionActor: null,
             decisionNote: null,
             settledBy: null,
+            decidedVia: null,
             decidedAtMs: null,
             endingCause: null,
             parkTrigger: null,
@@ -132,7 +133,7 @@ export class InMemoryApprovalAskStore {
     async decideAsk(askId, batchId, owner, decision) {
         if (decision.idempotencyKey != null)
             assertIdempotencyKeyShape(decision.idempotencyKey);
-        assertDecideSettledBy(decision);
+        assertDecideSource(decision);
         const reading = (row) => projectDecideReading(row ? { ...row } : null, owner);
         const batch = this.batches.get(batchId);
         if (!batch || batch.state !== "OPEN") {
@@ -160,6 +161,7 @@ export class InMemoryApprovalAskStore {
         ask.decisionActor = decision.decisionActor ?? null;
         ask.decisionNote = decision.decisionNote ?? null;
         ask.settledBy = decision.settledBy ?? null;
+        ask.decidedVia = decision.decidedVia ?? null;
         if (decision.updatedInput === undefined)
             delete ask.updatedInput;
         else
@@ -188,7 +190,7 @@ export class InMemoryApprovalAskStore {
                 break;
             }
             case "refuse": {
-                assertDecideSettledBy(POLICY_REFUSAL_DECISION);
+                assertDecideSource(POLICY_REFUSAL_DECISION);
                 const to = claimTargetState(intent);
                 if (!canAskTransition("STREAM_PENDING", to))
                     throw new Error(`InMemoryApprovalAskStore.claimTerminal: illegal terminal claim STREAM_PENDING -> ${to} (askId=${askId})`);
@@ -390,7 +392,7 @@ export class InMemoryApprovalAskStore {
     }
     planReapSettledAsks(cutoffMs, limit, keepAnchors) {
         assertReapBounds(cutoffMs, limit);
-        const anchored = (r) => keepAnchors.has(r.taskId) || keepAnchors.has(r.sessionId) || keepAnchors.has(r.sourceTaskId);
+        const anchored = (r) => keepAnchors.has(r.taskId) || keepAnchors.has(r.sessionId) || keepAnchors.has(r.sourceSessionId);
         return [...this.asks.values()]
             .filter((r) => ASK_TERMINAL.has(r.state) && !r.provisional && r.updatedAtMs < cutoffMs && !anchored(r))
             .sort((a, b) => a.updatedAtMs - b.updatedAtMs || (a.askId < b.askId ? -1 : a.askId > b.askId ? 1 : 0))

package/dist/plugins/approval-ask-store-sql.d.ts

@@ -42,6 +42,7 @@ import type { PgQueryFn } from "./pg-query.js";
 import { type SqlDriver, type SqlDialect } from "./sql-driver.js";
 import { type AskState, type BatchState } from "../approval-ask-machine.js";
 import type { HostSettledBy } from "../host-decision.js";
+import { type DecidedVia } from "@sema-agent/core";
 import { type AskRowEndingCause, type SettleCause, type ParkTriggerCause } from "../approval-deny-reasons.js";
 import { type IndexSpec } from "./ensure-index.js";
 import { type ExecutionLane } from "../execution-lane-caps.js";
@@ -49,7 +50,7 @@ export type AskDecision = "approve" | "deny";
 export interface AskRow {
     askId: string;
     taskId: string;
-    sourceTaskId: string;
+    sourceSessionId: string;
     sessionId: string;
     /** 租户 scope——哨兵归一在消费层(车2+),店里存原值(设计定稿 §3)。 */
     owner: string | null;
@@ -69,7 +70,7 @@ export interface AskRow {
      * 与下面 PARKED 坐标里的 `gateBoundInputHash` 是**两件不同的东西**,别混:
      *   - `boundInputHash`(本列)= ask **铸行时**的入参摘要,一次写定永不改;对账收敛器判据 1 用它跟
      *     checkpoint 行的同名列做**硬相等**——它是**身份三元组之外的第二道等式**,身份本身是
-     *     (`sourceTaskId`, `toolCallId`, 因果下界)三维([ref] 件1 换轴,判据属主 = `approval-reconciler.ts`
+     *     (`sourceSessionId`, `toolCallId`, 因果下界)三维([ref] 件1 换轴,判据属主 = `approval-reconciler.ts`
      *     的 `classifyGateMatch`;本注上一版写的「identity 四元组」是换轴前的旧口径,`sessionId` 从来不是
      *     内存判据维)。任一侧缺席 ⇒ 判据 1 **不命中**;归因看走到哪一层:身份先判(候选集非空却没有同身份
      *     的一条 ⇒ `identity_miss`),身份这层还够得着时缺席才记 `single_mint`(禁「能取到时才比」的可选谓词
@@ -90,7 +91,7 @@ export interface AskRow {
     /**
      * 🔴 [ref]([ref] 的持久半场)—— 这条决议的**结算来源**:`null` = 一个人答的(= 缺席律,core 对
      * 不带这一格的 outcome 逐字按 `"human"` 读),非 null = 宿主自报的那个词([ref] 起写进来的只有决定体出处位
-     * `decidedBy:"policy"` 经 `liveSettledBy` 映射来的 `"policy"`,allow 与 deny 两向都写;词表属主恒是 core —— 见 {@link HostSettledBy})。
+     * `decidedBy:"policy"` 经 `liveHostSource` 映射来的 `"policy"`,allow 与 deny 两向都写;词表属主恒是 core —— 见 {@link HostSettledBy})。
      *
      * **为什么必须是行上的一格**(病灶,7.93.3 合并树 codex ① 验真):`settledBy` 此前只到达**当次**回决的
      * 即时回调,行上不留痕 ⇒ 重放 / 再入 / 同 askId 的兄弟等待者 / 歧义提交恢复读回的是裸 `false`,
@@ -113,6 +114,14 @@ export interface AskRow {
      * 三态收成两态是刻意的:`"human"` 与缺席在 core 那边逐字同义,故店只存「非人」的那些词,`null` 即人。
      */
     settledBy: HostSettledBy | null;
+    /**
+     * core 7.61.0([ref])—— `settledBy = "policy"` 旁的**机器座位**:哪一个机器座位替这台部署答的(core `DECIDED_VIA`:`"policy"` 部署自己的策略 /
+     * `"permission_request_hook"` 一只 PermissionRequest 钩子)。`null` = 没陈述(旧行同读)= 部署自己的策略。它决定模型读哪一句拒句
+     * (「这一跑没有交互审批通道」vs「一只 PermissionRequest 钩子拒了」),所以与 {@link settledBy} 同一条理由住在行上、与决议同一条 UPDATE 落列:
+     * 活卡腿的结算输入只从行读,不在行上 = 重放 / 兄弟 / 再入 / 歧义恢复 / 迟到成功 / 跨副本广播六条路把钩子的拒读回成部署策略的拒。
+     * 只在 `settledBy = "policy"` 旁(core 同一条律;店门 {@link assertDecideSource} 守)。
+     */
+    decidedVia: DecidedVia | null;
     /**
      * [ref]([ref] / [ref] 收口):人批准时带的 **ctrl+g 编辑实参**(wire `updatedInput`),与决议**同一条
      * UPDATE** 原子落列 `updated_input`。语义三态,读法**严格**:
@@ -186,7 +195,7 @@ export interface AskRow {
 export interface NewAskRow {
     askId: string;
     taskId: string;
-    sourceTaskId: string;
+    sourceSessionId: string;
     sessionId: string;
     owner?: string | null;
     /** 出处的执行车道(必填;语义见 {@link AskRow.executionLane})。 */
@@ -250,10 +259,12 @@ export interface DecideAskInput {
      * 🔴 [ref]:本次回决的**结算来源**,与决议同一条 UPDATE 落列 `settled_by`(语义/两态读法/为什么是
      * 自己一列,全在 {@link AskRow.settledBy})。缺席 ⇒ 列 NULL ⇒ 读回是「一个人答的」。
      *
-     * 店**不判词**(词表属主是 core):写什么存什么。店只判**形** —— `assertDecideSettledBy` 的那一条
+     * 店**不判词**(词表属主是 core):写什么存什么。店只判**形** —— `assertDecideSource` 的那一条
      * (长度 ≤ 列宽;[ref] 起 approve 行也可以带来源位),理由见那只门的顶注;三 twin 同判。
      */
     settledBy?: HostSettledBy;
+    /** core 7.61.0([ref]):`settledBy:"policy"` 旁的机器座位,与决议同一条 UPDATE 落列 `decided_via`(语义见 {@link AskRow.decidedVia});缺席 ⇒ 列 NULL。 */
+    decidedVia?: DecidedVia;
     /** [ref]:ctrl+g 编辑实参,与决议同一条 UPDATE 落列(语义三态见 {@link AskRow.updatedInput})。
      *  缺席 / `undefined` ⇒ 列 NULL(没带编辑);**`null` 是值**(编辑成 null),照存 JSON `"null"`。
      *  调用方纪律:deny 不传(店不替调用方判决议方向,写什么存什么)。 */
@@ -293,7 +304,7 @@ export declare function assertReapBounds(cutoffMs: number, limit: number): void;
 export declare function assertIdempotencyKeyShape(key: string): void;
 /** `settled_by` 列宽 = 这一格的唯一尺(两方言 DDL 与下面的形门读同一个常量,不手抄第二份)。 */
 export declare const MAX_SETTLED_BY_CHARS = 16;
-/** `settled_by` 这一列装得下这个词吗(1..{@link MAX_SETTLED_BY_CHARS})—— 店门口形门({@link assertDecideSettledBy})的**谓词本身**。
+/** `settled_by` 这一列装得下这个词吗(1..{@link MAX_SETTLED_BY_CHARS})—— 店门口形门({@link assertDecideSource})的**谓词本身**。
  *  [ref] 起决定口不再读它:wire 上的出处位是闭集(`host-decision.ts` 的 `APPROVAL_DECIDED_BY`),映射到这一列的词恒在尺内。 */
 export declare function settledByFitsColumn(v: string): boolean;
 /**
@@ -307,9 +318,11 @@ export declare function settledByFitsColumn(v: string): boolean;
  * 🔴 [ref]:此前的第二条「只与 `deny` 同行」**删了** —— 它的前提(「只有人能批准一个要执行的动作,core 对 `{allow:true,settledBy}`
  * 一律 fail-closed 拒」)自 core 7.39.0 起不成立:策略的放行铸 `policy_allowed`,决定体的出处位 `decidedBy:"policy"` 在 allow 与 deny
  * 上都落这一列,approve 行带来源位是一条合法的行(读回铸点 `outcomeOfDecidedRow` 两向都读它)。今天写这一列的只有两条路:决定口经
- * `liveSettledBy` 映射来的 `"policy"`,与 `claimTerminal(refuse)` 的 {@link POLICY_REFUSAL_DECISION} —— 都是 core 在两向上都收的词。
+ * `liveHostSource` 映射来的 `"policy"`,与 `claimTerminal(refuse)` 的 {@link POLICY_REFUSAL_DECISION} —— 都是 core 在两向上都收的词。
  */
-export declare function assertDecideSettledBy(decision: Pick<DecideAskInput, "settledBy">): void;
+export declare function assertDecideSource(decision: Pick<DecideAskInput, "settledBy" | "decidedVia">): void;
+/** `decided_via` 列宽 = 这一格的唯一尺(两方言 DDL 读同一个常量)。core `DECIDED_VIA` 今天最长 23 字符(`permission_request_hook`)。 */
+export declare const MAX_DECIDED_VIA_CHARS = 32;
 /**
  * [ref] 车3 刀 3b(§14.2 遗留记账):两条**重放读口**被调用方的 deadline 掐断时抛的具名错误。
  *
@@ -353,7 +366,7 @@ export interface AskTerminalClaimOpts {
 /**
  * `refuse` 意图落行的决议(NP-2)—— **部署政策拒**:deny + 结算来源 `policy`。来源词的型取 core 的 `HostSettledBy`
  * (core 改词 / 退词 ⇒ 这里 tsc 红);协调器交给 core 的那一只(`tool-approval.ts` 的 `UnattendedPolicyRefusal`)读的是
- * **同一个**常量,于是「行上记的来源」与「首判交出去的来源」在构造上是一个词。三 twin 落行前都过 {@link assertDecideSettledBy}
+ * **同一个**常量,于是「行上记的来源」与「首判交出去的来源」在构造上是一个词。三 twin 落行前都过 {@link assertDecideSource}
  * (settled_by 的唯一形门:长度 ≤ 列宽)。
  */
 export declare const POLICY_REFUSAL_DECISION: {
@@ -391,6 +404,8 @@ export type AskTerminalClaimCurrent = {
     /** [ref]:赢家决议的**结算来源**(语义与两态读法见 {@link AskRow.settledBy})。**必填**(不是可选)——
      *  可选会让投影漏挑这一列时静默编译过,而漏挑的后果恰是本批要修的病:CAS 输家把赢家的策略拒读成人拒。 */
     settledBy: HostSettledBy | null;
+    /** core 7.61.0([ref]):赢家决议的机器座位(语义见 {@link AskRow.decidedVia});必填,理由与 `settledBy` 同。 */
+    decidedVia: DecidedVia | null;
     /** 行上记着的终态成因(`ending_cause` 列,经唯一读口 `askRowEndingCause` 读出)。**只在读得出时在场**(没写 / 与 state 不配 ⇒ 缺席;DECIDED 的败方读数逐字不变)。
      *  CAS 输家据它按**行上那个成因**结算(而不是把别人撤的卡读成一次拒绝);投影的唯一函数是 {@link projectAskTerminalClaimTruth},三 twin 不各自挑列,原始列值不出店层。 */
     endingCause?: AskRowEndingCause;
@@ -451,7 +466,7 @@ export interface BatchRow {
 }
 /** design 定稿 §4 的持久层接口。协调器接线(车2)、恢复扫描消费(车5)不在本车范围——本车只落这些方法。 */
 /** 一次调用在一条腿上的坐标({@link ApprovalAskStore.listByCall} 的四列;型从 {@link AskRow} 派生,不手抄)。 */
-export type AskCallCoordinate = Pick<AskRow, "taskId" | "legKey" | "toolCallId" | "sourceTaskId">;
+export type AskCallCoordinate = Pick<AskRow, "taskId" | "legKey" | "toolCallId" | "sourceSessionId">;
 /** 「这一行在这次调用上」的唯一判据(四列逐字相等):InMemory twin 的筛子与 SQL twin 的出口对齐读同一只。 */
 export declare function askRowOnCall(row: AskRow, call: AskCallCoordinate): boolean;
 /**
@@ -535,12 +550,12 @@ export interface ApprovalAskStore {
      *  后续件。 */
     listPendingBySession(sessionId: string, owner: string | null, signal?: AbortSignal): Promise<AskRow[]>;
     /**
-     * 🔴 [ref] / SN-C1:**这次调用在这条腿上的全部行** —— 任意状态、任意 ask 身份(同一调用不同类集 = 不同 askId 的几只问、升级前按旧派生
+     * 🔴 [ref] / SN-C1:**这次调用在这条腿上的全部行** —— 任意状态、任意 ask 身份(同一调用不同类集 / 不同展示动作 = 不同 askId 的几只问、升级前按旧派生
      * 写的行,都在其中)。坐标 = {@link AskCallCoordinate} 四列**精确**匹配;序 = `created_at_ms ASC, ask_id ASC`(确定性)。
      *
      * 唯一消费者 = 会话授权短路的争议判据(`tool-approval.ts` `sessionGrantUncontestedByRow`):「这次调用在腿内有行 ⇒ 一揽子放行不得代答」。
      * 为什么按调用而不是按 askId 点读:争议的真源是**调用**(人对这次调用说过什么 / 这次调用还有一张卡挂着),ask 身份只是其中一问的主键;
-     * 身份可以加轴([ref] 加了类集),争议判据不得依赖身份 —— 按身份点读在身份加轴的那一刻就把同调用的别的问、旧派生的行读成「不存在」。
+     * 身份可以加轴([ref] 加了类集,7.143.0 加了展示的动作),争议判据不得依赖身份 —— 按身份点读在身份加轴的那一刻就把同调用的别的问、旧派生的行读成「不存在」。
      *
      * 三 twin 同答:SQL twin 读后按四列逐字再滤一遍 —— MySQL 协议的 VARCHAR 等值带 PAD SPACE(`'tc'` = `'tc '`),PG(`COLLATE "C"`)与
      * InMemory 严格比较;不在入口拒(调用 id 是引擎铸的原值,首尾空白不归本店判),在出口对齐。索引:走 `idx_ask_task_state`
@@ -568,7 +583,7 @@ export interface ApprovalAskStore {
     /**
      * **审批账本留存律的问账半场之一:问行**(律、节律与「还能动的 run」一处成文在 `approval-ask-retention.ts`;维护 tick 是唯一调用方)。
      * 删至多 `limit` 只**结了**的问行 —— `state ∈ ASK_TERMINAL` ∧ `provisional = false`(provisional 行还能被 {@link resolveProvisional} 改判,没结)
-     * ∧ `updatedAtMs < cutoffMs` ∧ 行挂靠的三格(`taskId` / `sessionId` / `sourceTaskId`)都不在 `keepAnchors`(还能动的东西的挂靠集:
+     * ∧ `updatedAtMs < cutoffMs` ∧ 行挂靠的三格(`taskId` / `sessionId` / `sourceSessionId`)都不在 `keepAnchors`(还能动的东西的挂靠集:
      * 它还会回读这些行 —— 会话授权的争议判据 {@link listByCall} 把「这次调用在腿内没有行」读成可以代答)。非终态行多老都不删(它们归对账器
      * 与起服收敛)。只删不改。
      * 一条语句:要么删了并交回删掉的行数,要么一行没删就抛。三形同答(InMemory = 内核;File 形把这次调用照常落成一条账本动词,

package/dist/plugins/approval-ask-store-sql.js

@@ -1,5 +1,6 @@
 import { mysqlDriver, pgDriver, dialectJsonEncoder } from "./sql-driver.js";
 import { ASK_TERMINAL, canAskTransition } from "../approval-ask-machine.js";
+import { DECIDED_VIA } from "@sema-agent/core";
 import { APPROVAL_ENDING_CAUSES, askRowEndingCause, askRowParkTrigger } from "../approval-deny-reasons.js";
 import { isDupKeyError, isMissingColumnError } from "./sql-errors.js";
 import { describeProbedTableDrift } from "./schema-drift-sentence.js";
@@ -25,7 +26,8 @@ export const MAX_SETTLED_BY_CHARS = 16;
 export function settledByFitsColumn(v) {
     return v.length > 0 && v.length <= MAX_SETTLED_BY_CHARS;
 }
-export function assertDecideSettledBy(decision) {
+export function assertDecideSource(decision) {
+    assertDecidedViaBesidePolicy(decision);
     const v = decision.settledBy;
     if (v === undefined)
         return;
@@ -33,6 +35,15 @@ export function assertDecideSettledBy(decision) {
         throw new Error(`invalid settledBy: the settlement source is one word from the engine's closed set and lands in a VARCHAR(${MAX_SETTLED_BY_CHARS}) column — must be 1-${MAX_SETTLED_BY_CHARS} chars (got ${JSON.stringify(v.slice(0, 32))}${v.length > 32 ? "…" : ""}, length ${v.length})`);
     }
 }
+export const MAX_DECIDED_VIA_CHARS = 32;
+function assertDecidedViaBesidePolicy(decision) {
+    const via = decision.decidedVia;
+    if (via === undefined)
+        return;
+    if (!DECIDED_VIA.some((w) => w === via) || via.length > MAX_DECIDED_VIA_CHARS || decision.settledBy !== "policy") {
+        throw new Error(`invalid decidedVia: the machine seat is one of ${DECIDED_VIA.map((w) => `"${w}"`).join(" / ")} and is stated only beside settledBy "policy" (got ${JSON.stringify(String(via).slice(0, 32))} beside ${JSON.stringify(decision.settledBy ?? null)})`);
+    }
+}
 export class ApprovalAskReadAbortedError extends Error {
     constructor(where) {
         super(`approval-ask read ${where} aborted by caller`);
@@ -98,12 +109,13 @@ export function projectAskTerminalClaimTruth(row) {
         decision: row.decision,
         ...(row.updatedInput !== undefined ? { updatedInput: row.updatedInput } : {}),
         settledBy: row.settledBy,
+        decidedVia: row.decidedVia,
         ...(endingCause !== undefined ? { endingCause } : {}),
         ...(parkTrigger !== undefined ? { parkTrigger } : {}),
     };
 }
 export function askRowOnCall(row, call) {
-    return row.taskId === call.taskId && row.legKey === call.legKey && row.toolCallId === call.toolCallId && row.sourceTaskId === call.sourceTaskId;
+    return row.taskId === call.taskId && row.legKey === call.legKey && row.toolCallId === call.toolCallId && row.sourceSessionId === call.sourceSessionId;
 }
 export function askOwnerAdmits(owner, principal) {
     return owner === null || owner === principal;
@@ -179,9 +191,12 @@ export const TIDB_APPROVAL_ASK_STATEMENTS = [
     -- settled_by(S-558 / #1016 持久半场):这条决议的结算来源词(NULL = 人答的)。语义、两态读法与
     -- 「为什么是自己一列而不是塞进 decision_actor」的全文见 AskRow.settledBy 顶注。
     -- VARCHAR(16):词表属主是 core(AskOutcome.settledBy,今天最长 7 字符 "timeout"),宽度与同表
-    -- decision 同尺同理由 —— 闭集词列,不是自由文本。截断面由入店形门堵死(assertDecideSettledBy),
+    -- decision 同尺同理由 —— 闭集词列,不是自由文本。截断面由入店形门堵死(assertDecideSource),
     -- 不靠「列够宽就不会截」这种运气(MySQL 非严格模式静默截、PG 直接报错 = 两方言不同答)。
     settled_by VARCHAR(16) NULL,
+    -- decided_via(core 7.61.0 #3169):settled_by = 'policy' 旁的机器座位词(NULL = 没陈述 = 部署自己的策略;旧行同读)。
+    -- 与 settled_by 同一条 UPDATE 落列、同一条理由住在行上(语义全文见 AskRow.decidedVia)。闭集词列,宽度 = MAX_DECIDED_VIA_CHARS。
+    decided_via VARCHAR(${MAX_DECIDED_VIA_CHARS}) NULL,
     -- updated_input(S-26 / #304,A-054.15 收口):人批准时带的 ctrl+g 编辑实参,JSON 文本,与决议同一条
     -- UPDATE 原子落列;NULL = 没带编辑(与 JSON "null" = 编辑成 null 分家)。LONGTEXT 照 card_json 先例:
     -- 编辑实参是整只工具入参,VARCHAR/TEXT 会造静默截断面。语义三态与读法见 AskRow.updatedInput 顶注。
@@ -268,6 +283,8 @@ export async function ensurePgApprovalAskSchema(q) {
     decision_note TEXT COLLATE "C",
     -- settled_by(S-558)—— MySQL 孪生逐字同形(宽度/语义/形门的理由写在那侧的行内注)。
     settled_by VARCHAR(16) COLLATE "C",
+    -- decided_via(#3169)—— MySQL 孪生逐字同形。
+    decided_via VARCHAR(${MAX_DECIDED_VIA_CHARS}) COLLATE "C",
     -- updated_input(S-26 / #304)—— MySQL 孪生逐字同形(语义/类型理由见那侧行内注;PG TEXT 无长度上限)。
     updated_input TEXT COLLATE "C",
     decided_at_ms BIGINT,
@@ -317,7 +334,7 @@ function askCols(dialect) {
         "ask_id, task_id, source_task_id, session_id, owner, execution_lane, batch_id, tool_call_id, leg_key, parent_tool_call_id, bound_input_hash, state",
         "provisional, rev, decision",
         jsonColumnText(dialect, "decision_actor"),
-        "decision_note, settled_by",
+        "decision_note, settled_by, decided_via",
         jsonColumnText(dialect, "updated_input"),
         "decided_at_ms, ending_cause, park_trigger, gate_token",
         "gate_bound_call_id, gate_bound_input_hash, idempotency_key",
@@ -349,7 +366,7 @@ function mapAskRowBody(r, askId) {
     return {
         askId: String(r.ask_id),
         taskId: String(r.task_id),
-        sourceTaskId: String(r.source_task_id),
+        sourceSessionId: String(r.source_task_id),
         sessionId: String(r.session_id),
         owner: strOrNull(r.owner),
         executionLane: executionLaneColumnOf(r.execution_lane, askId),
@@ -365,6 +382,7 @@ function mapAskRowBody(r, askId) {
         decisionActor: r.decision_actor == null ? null : decodeJsonColumn(r.decision_actor, readJsonObjectColumn, `${APPROVAL_ASK_TABLE}.decision_actor for ask ${askId}`),
         decisionNote: strOrNull(r.decision_note),
         settledBy: strOrNull(r.settled_by),
+        decidedVia: strOrNull(r.decided_via),
         ...(r.updated_input == null ? {} : { updatedInput: decodeJsonColumn(r.updated_input, readTriStateJsonValueColumn, `${APPROVAL_ASK_TABLE}.updated_input for ask ${askId}`) }),
         decidedAtMs: numOrNull(r.decided_at_ms),
         endingCause: strOrNull(r.ending_cause),
@@ -462,7 +480,7 @@ export class SqlApprovalAskStore {
                 "VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, 'STREAM_PENDING', 0, 0, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, $12, $13, $14, $15, $16, $17, $18) ON CONFLICT (ask_id) DO NOTHING"), [
                 row.askId,
                 row.taskId,
-                row.sourceTaskId,
+                row.sourceSessionId,
                 row.sessionId,
                 row.owner ?? null,
                 row.executionLane,
@@ -516,10 +534,10 @@ export class SqlApprovalAskStore {
     async decideAsk(askId, batchId, owner, decision) {
         if (decision.idempotencyKey != null)
             assertIdempotencyKeyShape(decision.idempotencyKey);
-        assertDecideSettledBy(decision);
+        assertDecideSource(decision);
         const now = Date.now();
         const dialect = this.db.dialect;
-        const ownerWhere = decideOwnerWhere(dialect, owner, 11);
+        const ownerWhere = decideOwnerWhere(dialect, owner, 12);
         const conn = await this.db.connect();
         try {
             await conn.begin();
@@ -530,11 +548,12 @@ export class SqlApprovalAskStore {
             }
             let askRes;
             try {
-                askRes = await conn.query(`UPDATE ${APPROVAL_ASK_TABLE} SET state='DECIDED', decision=${ph(dialect, 1)}, decision_actor=${ph(dialect, 2)}, decision_note=${ph(dialect, 3)}, settled_by=${ph(dialect, 4)}, updated_input=${ph(dialect, 5)}, decided_at_ms=${ph(dialect, 6)}, idempotency_key=${ph(dialect, 7)}, rev=rev+1, updated_at_ms=${ph(dialect, 8)} WHERE ${pendingClaimWhere(dialect, 9)} AND ${ownerWhere.sql}`, [
+                askRes = await conn.query(`UPDATE ${APPROVAL_ASK_TABLE} SET state='DECIDED', decision=${ph(dialect, 1)}, decision_actor=${ph(dialect, 2)}, decision_note=${ph(dialect, 3)}, settled_by=${ph(dialect, 4)}, decided_via=${ph(dialect, 5)}, updated_input=${ph(dialect, 6)}, decided_at_ms=${ph(dialect, 7)}, idempotency_key=${ph(dialect, 8)}, rev=rev+1, updated_at_ms=${ph(dialect, 9)} WHERE ${pendingClaimWhere(dialect, 10)} AND ${ownerWhere.sql}`, [
                     decision.decision,
                     decision.decisionActor == null ? null : this.json(decision.decisionActor),
                     decision.decisionNote ?? null,
                     decision.settledBy ?? null,
+                    decision.decidedVia ?? null,
                     decision.updatedInput === undefined ? null : this.json(decision.updatedInput),
                     now,
                     decision.idempotencyKey ?? null,
@@ -579,7 +598,7 @@ export class SqlApprovalAskStore {
             throw new Error(`approval-ask-store.claimTerminal: illegal terminal claim STREAM_PENDING -> ${to} (askId=${askId})`);
         }
         if (intent === "refuse")
-            assertDecideSettledBy(POLICY_REFUSAL_DECISION);
+            assertDecideSource(POLICY_REFUSAL_DECISION);
         const now = Date.now();
         const dialect = this.db.dialect;
         const conn = await this.db.connect();
@@ -752,7 +771,7 @@ export class SqlApprovalAskStore {
         return rows.map(mapAskRow);
     }
     async listByCall(call) {
-        const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = ? AND leg_key = ? AND tool_call_id = ? AND source_task_id = ? ORDER BY created_at_ms ASC, ask_id ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = $1 AND leg_key = $2 AND tool_call_id = $3 AND source_task_id = $4 ORDER BY created_at_ms ASC, ask_id ASC`), [call.taskId, call.legKey, call.toolCallId, call.sourceTaskId]);
+        const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = ? AND leg_key = ? AND tool_call_id = ? AND source_task_id = ? ORDER BY created_at_ms ASC, ask_id ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = $1 AND leg_key = $2 AND tool_call_id = $3 AND source_task_id = $4 ORDER BY created_at_ms ASC, ask_id ASC`), [call.taskId, call.legKey, call.toolCallId, call.sourceSessionId]);
         return rows.map(mapAskRow).filter((r) => askRowOnCall(r, call));
     }
     async listParkingBySession(sessionId) {

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -343,7 +343,7 @@ export interface CheckpointAskCandidate {
     status: string;
     createdAtMs: number;
     /**
-     * 🔴 和解三元组的第一维([ref] 件1,黑板 [ref]③①)—— checkpoint 自己带的 `sourceTaskId`(core 在
+     * 🔴 和解三元组的第一维([ref] 件1,黑板 [ref]③①)—— checkpoint 自己带的 `sourceSessionId`(core 在
      * suspendAsk 铸行时恒填该腿的 `sessionId`)。**没有对应的列**,只能从 blob 窄读;读不出/缺席 = null。
      *
      * 为什么必须进候选集:读口按 `(scope, session_id, tool_call_id)` 查,而委派子代那条腿的 ask 落行时
@@ -351,7 +351,7 @@ export interface CheckpointAskCandidate {
      * (toolCallId, hash) 两维,一条根腿的 park 会被一只子代的 ask 认领(摘要相同的两次同 args 调用完全
      * 正常)。三元组全同才算同一件事。
      */
-    sourceTaskId: string | null;
+    sourceSessionId: string | null;
     /** 该 park 绑定的 tool call(= `pendingAction.toolCallId`)。`unparseable` 行为 null。 */
     boundCallId: string | null;
     /** 服务端铸的入参摘要——判据 1 的第二道硬等式(与 `approval_ask.bound_input_hash` 相等才算命中)。 */
@@ -444,7 +444,7 @@ export declare function pendingActionToolCallId(body: unknown): {
     toolCallId: string | null;
     boundInputHash: string | null;
     kind: string | null;
-    sourceTaskId: string | null;
+    sourceSessionId: string | null;
 } | {
     readable: false;
 };
@@ -781,7 +781,7 @@ export declare class SqlCheckpointStore implements CheckpointStore, KindlessBatc
      * 🔴 **没有「列命中即零解析」的快路径**(原注写过,已作废,别照它优化):函数体对**每一行**无条件解
      * blob,原因有二 ——(a) 前向兼容门与 blob 可读性门必须门在**所有**命中路径之前(codex F3 + 确认轮:
      * 列长得对不代表 blob 读得出,放行一条读不出的行去 `bindBatch` 会把 ask 钉成 PARKED + 一张本进程读不出
-     * 的 resume 坐标,而 PARKED 不可回滚);(b) `[ref]` 之后 blob 顶层的 `sourceTaskId` 是和解三元组的第一
+     * 的 resume 坐标,而 PARKED 不可回滚);(b) `[ref]` 之后 blob 顶层的 `sourceSessionId` 是和解三元组的第一
      * 维,列命中行结构上也必须解 blob 才拿得到它。
      */
     findCheckpointCandidatesForAsk(scope: string, sessionId: string, toolCallId: string, sinceMs: number): Promise<CheckpointAskCandidate[]>;

package/dist/plugins/checkpoint-store-sql.js

@@ -239,12 +239,14 @@ export function approvalDecisionOfWinner(winner, boundCallId) {
 export function pendingActionToolCallId(body) {
     if (typeof body !== "object" || body === null)
         return { readable: false };
-    const rawSource = "sourceTaskId" in body ? body.sourceTaskId : null;
+    if ("sourceTaskId" in body)
+        return { readable: false };
+    const rawSource = "sourceSessionId" in body ? body.sourceSessionId : null;
     if (rawSource !== null && rawSource !== undefined && typeof rawSource !== "string")
         return { readable: false };
-    const sourceTaskId = typeof rawSource === "string" ? rawSource : null;
+    const sourceSessionId = typeof rawSource === "string" ? rawSource : null;
     if (!("pendingAction" in body))
-        return { readable: true, toolCallId: null, boundInputHash: null, kind: null, sourceTaskId };
+        return { readable: true, toolCallId: null, boundInputHash: null, kind: null, sourceSessionId };
     const pa = body.pendingAction;
     if (typeof pa !== "object" || pa === null)
         return { readable: false };
@@ -252,7 +254,7 @@ export function pendingActionToolCallId(body) {
     if (kind !== null && typeof kind !== "string")
         return { readable: false };
     if (!("toolCallId" in pa))
-        return { readable: true, toolCallId: null, boundInputHash: null, kind, sourceTaskId };
+        return { readable: true, toolCallId: null, boundInputHash: null, kind, sourceSessionId };
     const id = pa.toolCallId;
     if (typeof id !== "string")
         return { readable: false };
@@ -261,7 +263,7 @@ export function pendingActionToolCallId(body) {
     const bih = "boundInputHash" in pa ? pa.boundInputHash : null;
     if (bih !== null && typeof bih !== "string")
         return { readable: false };
-    return { readable: true, toolCallId: id, boundInputHash: bih, kind, sourceTaskId };
+    return { readable: true, toolCallId: id, boundInputHash: bih, kind, sourceSessionId };
 }
 function pendingActionOfColumn(cell, where) {
     let body;
@@ -650,7 +652,7 @@ export class SqlCheckpointStore {
                 status: String(r.status),
                 createdAtMs: Number(r.created_at_ms),
                 boundInputHash: r.bound_input_hash == null ? null : String(r.bound_input_hash),
-                sourceTaskId: null,
+                sourceSessionId: null,
             };
             if (Number(r.version) > MAX_SUPPORTED_CHECKPOINT_VERSION) {
                 out.push({ ...base, boundCallId: null, unparseable: true });
@@ -673,7 +675,7 @@ export class SqlCheckpointStore {
             const effectiveHash = base.boundInputHash ?? derived.boundInputHash;
             const effective = col ?? derived.toolCallId;
             if (effective === toolCallId)
-                out.push({ ...base, boundInputHash: effectiveHash, sourceTaskId: derived.sourceTaskId, boundCallId: effective });
+                out.push({ ...base, boundInputHash: effectiveHash, sourceSessionId: derived.sourceSessionId, boundCallId: effective });
         }
         return out;
     }

package/dist/plugins/file-history-store-sql.d.ts

@@ -2,7 +2,7 @@ import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type FileHistoryRetentionPolicy, type ExecutionEnv, type FileHistoryStore, type FileHistoryResult, type FileHistoryTrackResult, type FileHistoryRestoreResult, type FileHistoryExport, type FileHistoryExportResult } from "@sema-agent/core";
 import { type BlobBackend } from "./blob-backend.js";
-import type { SyncBlobPutResult } from "./store-backend.js";
+import type { ServiceBlobExchange } from "./store-backend.js";
 import { type SqlDriver, type SqlDialect } from "./sql-driver.js";
 /** The file-history blob domain's SQL table (BlobBackend `table`/MinIO index binding + the A7 assert). */
 export declare const FILE_HISTORY_BLOB_TABLE = "file_history_blob";
@@ -24,12 +24,10 @@ export declare class SqlFileHistoryStore implements FileHistoryStore {
     /** RAW native pool — handed to blob-backend.ts (outside the SqlDriver seam, dialect-switches on
      *  its own string). Not used for this class's own statements (those go through `db`). */
     protected readonly pool: MySqlPool | PgPool;
-    /** 2c sync blob-face MARKER (codex R2-high): the route/caps predicates gate on THIS, never on a
-     *  `typeof putBlob` duck-probe — core's local FileFileHistoryStore carries a PRIVATE synchronous
-     *  `putBlob(hash, bytes): void` helper whose name collides with the service face; a name probe
-     *  passes there, mutates core-owned blob storage out of contract, then dereferences `.ok` on
-     *  undefined. Presence of this literal = the full typed putBlob/getBlob/hasBlobs face exists. */
-    readonly syncBlobFaces: true;
+    /** The blob exchange (core's `FileHistoryStore.blobExchange` group, see {@link ServiceBlobExchange}): how another machine's bytes
+     *  come in ahead of an `importHistory`, go out to a puller, and are asked about. Its presence IS the capability — read through
+     *  `blobExchangeOf` (`session-sync.ts`), which defers to core's judge; there is no second word for it on this class. */
+    readonly blobExchange: ServiceBlobExchange;
     protected readonly blobs: BlobBackend;
     /** §10 S-6 in-process lease state (design v1 D2: NOT persisted). Keys = `${scope}\x00${entryId}`. */
     private readonly spentAttempts;
@@ -58,15 +56,25 @@ export declare class SqlFileHistoryStore implements FileHistoryStore {
     /**
      * Per-scope WRITE-SERIALIZATION lock (codex R1-critical): `SELECT … FOR UPDATE` over an EMPTY result
      * locks nothing on PG, so neither the empty-target law (import/adopt) nor a multi-statement graph
-     * write can be serialized by the data rows alone. Every graph-mutating tx therefore first ensures +
+     * write can be serialized by the data rows alone. Every graph transaction therefore first ensures +
      * row-locks the scope's sentinel row — one lock, both dialects, and disjoint-key writers can no
-     * longer interleave into a merged/torn graph. The ensure+lock loops because deleteBySession removes
-     * the sentinel: a waiter woken by that delete sees zero rows and must re-ensure.
+     * longer interleave into a merged/torn graph.
      *
      * Shape A ([ref]): the MySQL ensure verb is `ON DUPLICATE KEY UPDATE scope = scope`, NOT `INSERT IGNORE`.
      * On InnoDB a duplicate-key IGNORE takes an **S** lock on the existing sentinel and the `FOR UPDATE` right
      * below has to upgrade it to X — two concurrent scope writers each holding an S deadlock ([ref]). ON
      * DUPLICATE takes X on the duplicate key, the same mode the locking read wants, so they serialize instead.
+     *
+     * **This is the transaction's first statement** (every caller: `begin()` and then this — nothing of the
+     * transaction exists before it), and a lost arbitration here restarts the transaction from the top
+     * (rollback + begin + the same ensure-and-lock), through the repo's one bound ({@link retryOnDeadlock}). Two shapes:
+     *  · the engine picked this transaction as a deadlock victim. InnoDB only (REPEATABLE READ): when the sentinel
+     *    physically disappears while ≥ 2 transactions are queued on it — its minter rolled back, or a whole-scope
+     *    removal ({@link deleteBySession}) committed and purge took the delete-marked row — the queued locks are
+     *    inherited as GAP locks on the next record, and each queued ensure's insert-intention waits on the others'
+     *    gap locks. The engine kills all but one; the survivor's mint goes through and the others restart into it;
+     *  · the sentinel was gone at the locking read ({@link ScopeSentinelVanishedError}; PG, see there).
+     * The lock order itself stays single: sentinels first (sorted), then the scope's rows.
      */
     private lockScope;
     /** Returns the UPDATE's affected count — 0 = the record is gone (annulled) or was already observed;
@@ -147,14 +155,12 @@ export declare class SqlFileHistoryStore implements FileHistoryStore {
     /** Async byte-GC: blobs referenced by NO version row (any scope), past the created_at grace window.
      *  Domain-isolated by construction (this store's blob table only — [ref] D1). Reaper-driven. */
     sweepOrphanBlobs(): Promise<number>;
-    /** Upload ONE content-addressed blob ahead of an importHistory (§5 streamed negotiation). Store-level
-     *  integrity re-check (the route pre-verifies too — the internal caller might not). Never-throw.
-     *  The SQL blob judge's refusal ({@link BlobTooLargeError}, judged on the connection that would have written the blob)
-     *  keeps its own code — the route answers it 413 (the sentence names that connection's walls), every other write failure 502 ("retry"). */
-    putBlob(hash: string, bytes: Uint8Array): Promise<SyncBlobPutResult>;
-    getBlob(hash: string): Promise<Uint8Array | undefined>;
-    /** The subset of `hashes` already present — one SQL INDEX probe (the import presence pre-check). */
-    hasBlobs(hashes: string[]): Promise<Set<string>>;
+    /** Store ONE content-addressed blob ahead of an importHistory (§5 streamed negotiation). The content address is judged HERE and
+     *  nowhere else (core's `put` law: bytes whose sha256 is not `hash` are refused `adopt_failed` / `terminal`, nothing stored).
+     *  Never-throw. The SQL blob judge's refusal ({@link BlobTooLargeError}, judged on the connection that would have written the blob)
+     *  is a terminal refusal that carries `blobCap` — the route answers it 413 with the judge's sentence; every other write failure is
+     *  `snapshot_failed` with the store's judgment of the fault (the route answers 502, "retry"). */
+    private putExchangedBlob;
     adoptScope(fromScope: string, toScope: string): Promise<FileHistoryResult>;
     private scopeEmpty;
     /** `forUpdate` — see {@link loadTracked}. Every in-transaction caller passes `true`: the four reads are

package/dist/plugins/file-history-store-sql.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { captureFileBackupViaEnv, applyFileRestoreViaEnv, fileHistoryModeProvenDifferent, worldStillMatchesMint, annulProofFailure, boundaryPublishVerdict, fileHistoryDescribeTrackKey, fileHistoryTrackKeyOf, fileHistoryResolveTrackKey, fileHistoryExportDigest, validateFileHistoryExport, resolveFileHistoryRetention, fileHistoryBoundariesToKeep, } from "@sema-agent/core";
 import { BlobTooLargeError, SqlBlobBackend } from "./blob-backend.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
-import { isMissingColumnError } from "./sql-errors.js";
+import { isMissingColumnError, retryOnDeadlock } from "./sql-errors.js";
 import { describeProbedTableDrift } from "./schema-drift-sentence.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { foldCaughtFailure } from "../file-history-disclosure.js";
@@ -12,6 +12,8 @@ const sha256hex = (s) => createHash("sha256").update(s).digest("hex");
 const truthy = (v) => v === true || v === 1 || v === "1";
 class StagedRefGoneError extends Error {
 }
+class ScopeSentinelVanishedError extends Error {
+}
 function reapedEntryRefusal(entryId) {
     return {
         ok: false,
@@ -24,7 +26,11 @@ function reapedEntryRefusal(entryId) {
 export class SqlFileHistoryStore {
     db;
     pool;
-    syncBlobFaces = true;
+    blobExchange = {
+        put: (hash, bytes) => this.putExchangedBlob(hash, bytes),
+        get: (hash) => this.blobs.getBlob(hash),
+        has: (hashes) => this.blobs.hasBlobs([...hashes]),
+    };
     blobs;
     spentAttempts = new Set();
     activeAttempts = new Set();
@@ -48,16 +54,21 @@ export class SqlFileHistoryStore {
     async beforeObserve(_scope, _keyHash) { }
     async beforePublish(_scope) { }
     async lockScope(conn, ...scopes) {
-        for (const scope of [...new Set(scopes)].sort()) {
-            let locked = false;
-            for (let i = 0; i < 3 && !locked; i++) {
+        const ordered = [...new Set(scopes)].sort();
+        let restart = false;
+        await retryOnDeadlock(this.db.dialect, async () => {
+            if (restart) {
+                await conn.rollback().catch(() => undefined);
+                await conn.begin();
+            }
+            restart = true;
+            for (const scope of ordered) {
                 await conn.query(this.q("INSERT INTO file_history_scope (scope, created_at_ms) VALUES (?,?) ON DUPLICATE KEY UPDATE scope = scope", "INSERT INTO file_history_scope (scope, created_at_ms) VALUES ($1,$2) ON CONFLICT (scope) DO NOTHING"), [scope, Date.now()]);
                 const r = await conn.query(this.q("SELECT scope FROM file_history_scope WHERE scope = ? FOR UPDATE", "SELECT scope FROM file_history_scope WHERE scope = $1 FOR UPDATE"), [scope]);
-                locked = Boolean(r.rows[0]);
+                if (!r.rows[0])
+                    throw new ScopeSentinelVanishedError(`could not acquire the scope write lock for "${scope}" (sentinel row kept vanishing)`);
             }
-            if (!locked)
-                throw new Error(`could not acquire the scope write lock for "${scope}" (sentinel row kept vanishing)`);
-        }
+        }, (err) => err instanceof ScopeSentinelVanishedError);
     }
     async markObserved(scope, keyHash) {
         const r = await this.db.query(this.q("UPDATE file_history_tracked SET observed_later = 1 WHERE scope = ? AND key_hash = ? AND observed_later = 0", "UPDATE file_history_tracked SET observed_later = TRUE WHERE scope = $1 AND key_hash = $2 AND observed_later = FALSE"), [scope, keyHash]);
@@ -585,9 +596,9 @@ export class SqlFileHistoryStore {
             return 0;
         return this.blobs.deleteBlobs(orphans);
     }
-    async putBlob(hash, bytes) {
+    async putExchangedBlob(hash, bytes) {
         if (sha256hex(bytes) !== hash) {
-            return { ok: false, error: { code: "unsupported_format", message: `putBlob ${hash} fails content-address integrity — nothing stored` } };
+            return { ok: false, error: { code: "adopt_failed", message: `blob ${hash}: the bytes do not hash to this address — nothing stored`, permanence: "terminal" } };
         }
         try {
             await this.blobs.putBlob(hash, bytes);
@@ -595,17 +606,11 @@ export class SqlFileHistoryStore {
         }
         catch (err) {
             if (err instanceof BlobTooLargeError)
-                return { ok: false, error: { code: err.code, message: err.message, wallSource: err.cap.source } };
+                return { ok: false, error: { code: "adopt_failed", message: err.message, permanence: "terminal", blobCap: { wallSource: err.cap.source } } };
             const f = foldCaughtFailure(err);
-            return { ok: false, error: { code: "snapshot_failed", message: `putBlob ${hash} write/upload failed: ${f.text}`, ...f.fault } };
+            return { ok: false, error: { code: "snapshot_failed", message: `blob ${hash} write/upload failed: ${f.text}`, ...f.fault } };
         }
     }
-    async getBlob(hash) {
-        return this.blobs.getBlob(hash);
-    }
-    async hasBlobs(hashes) {
-        return this.blobs.hasBlobs(hashes);
-    }
     async adoptScope(fromScope, toScope) {
         try {
             if (fromScope === toScope)