@sema-agent/server 7.145.0 → 7.147.0

package/dist/plugins/approval-ask-store-file.d.ts

@@ -1,4 +1,5 @@
 import { type ExecutionLane } from "../execution-lane-caps.js";
+import { type LocalAskLaneBackfillRefusal } from "./one-time-migrations.js";
 import type { AskState } from "../approval-ask-machine.js";
 import type { SettleCause } from "../approval-deny-reasons.js";
 import type { AskCallCoordinate, AskRow, AskTerminalClaimIntent, AskTerminalClaimOpts, AskTerminalClaimOutcome, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, DecideResult, EnsureAskResult, ExpireResult, NewAskRow } from "./approval-ask-store-sql.js";
@@ -235,9 +236,16 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
     /**
      * 执行放置切换 ④b 的 local 腿(一次性迁移登记表 M32;`LocalBackend.runOneTimeMigrations` 在任何读者之前调):升级前写下的问(日志 `ensureAsk` 记录行 /
      * 压实快照行没有 `executionLane`)记成本部署车道表的唯一项,然后**一次压实**把整本账重写成带车道的快照(压实 = 既有整本原子重写)。
-     * 没有缺车道的行 ⇒ 零写。车道表不是一元而还有缺车道的行 ⇒ 抛与 SQL 同一只拒(`backfill_ambiguous`,由调用方铸),一个字节没写。
+     * 只填**缺席**:记下了而不是车道词的问 ⇒ 抛 `unknown_lane`(由调用方铸,点名问与词)—— 拿此刻的车道盖掉它就是替问改了出处。没有缺车道的行 ⇒ 零写。
+     * 车道表不是一元而还有缺车道的行 ⇒ 抛与 SQL 同一只拒(`backfill_ambiguous`,由调用方铸)。两种拒都一个字节没写。
      */
-    backfillExecutionLanes(lanes: readonly ExecutionLane[], refuse: (pending: number) => never): number;
+    backfillExecutionLanes(lanes: readonly ExecutionLane[], refuse: (refusal: LocalAskLaneBackfillRefusal) => never): number;
+    /**
+     * 一次性迁移 M40 的 local 问账腿(`LocalBackend.runOneTimeMigrations` 调,排在 M32 的问回填 {@link backfillExecutionLanes} 之前 —— 否则旧词先撞那里的词表外拒):
+     * 出处车道记成退役词的问改记新名,然后**一次压实**重写整本账。没有 ⇒ 零写。返回改了的问数。词的属主 = `execution-lane-rename-m40.ts`。
+     * 压实写不进 ⇒ {@link ExecutionLaneRenameWriteRefusedError}(拒启;内存里已改的行随进程退出作废,盘上账本原样,下次起服重跑)。
+     */
+    renameRetiredExecutionLaneWordM40(): number;
     /** 释放追加 fd(`LocalBackend.close` → 优雅重启重开)。不包 try/catch 的理由同
      *  {@link FileApprovalNonceStore.dispose}:core 的 `AppendLog.close()` 自己就是全函数。 */
     dispose(): void;

package/dist/plugins/approval-ask-store-file.js

@@ -1,5 +1,7 @@
 import { closeSync, copyFileSync, openSync, readSync, statSync, existsSync } from "node:fs";
 import { isExecutionLane } from "../execution-lane-caps.js";
+import { RENAMED_EXECUTION_LANE_M40, RETIRED_EXECUTION_LANE_WORD_M40 } from "./execution-lane-rename-m40.js";
+import { ExecutionLaneRenameWriteRefusedError } from "./one-time-migrations.js";
 import { join } from "node:path";
 import { AppendLog, atomicWriteFile, ensureDir } from "@sema-agent/core";
 import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
@@ -112,12 +114,20 @@ export class FileApprovalAskStore {
         this.records = records.length;
         if (tornTail || this.corruptLineCount > 0) {
             const quarantine = `${this.path}.corrupt-${Date.now()}`;
-            copyFileSync(this.path, quarantine);
+            try {
+                copyFileSync(this.path, quarantine);
+                this.compact();
+            }
+            catch (e) {
+                throw new StoreBootRefusalError(`FileApprovalAskStore: approval ask journal ${this.path} has ${tornTail ? "a torn tail" : "no torn tail"} and ${this.corruptLineCount} unparseable line(s) ` +
+                    `and its recovery rewrite could not land on disk (${e?.code ?? (e instanceof Error ? e.message : String(e))}) — the journal is unchanged. ` +
+                    "Refusing to start rather than run without the approvals it holds: restore write access to the journal, its directory and that directory's .tmp " +
+                    "(clear an immutable flag, remount read-write, free disk space), then restart.", { cause: e });
+            }
             this.corruptQuarantinePath = quarantine;
             console.warn(`FileApprovalAskStore: approval ask journal ${this.path} had ${tornTail ? "a torn tail" : "no torn tail"} and ` +
                 `${this.corruptLineCount} unparseable line(s) — replayed every COMPLETE record, quarantined the original at ${quarantine}, ` +
                 `and rewrote the live journal from the replayed state. A dropped record is a LOST approval-ask transition: inspect the quarantined file.`);
-            this.compact();
         }
         else if (this.removalRecordsOnDisk) {
             this.compactOrRecord();
@@ -370,15 +380,38 @@ export class FileApprovalAskStore {
         return upgraded;
     }
     backfillExecutionLanes(lanes, refuse) {
-        const pending = this.core.exportRows().asks.filter((r) => !isExecutionLane(String(r.executionLane ?? ""))).length;
+        const asks = this.core.exportRows().asks;
+        const unknown = [];
+        let pending = 0;
+        for (const r of asks) {
+            const recorded = r.executionLane;
+            if (recorded === undefined)
+                pending += 1;
+            else if (typeof recorded !== "string" || !isExecutionLane(recorded))
+                unknown.push({ askId: r.askId, word: String(recorded) });
+        }
+        if (unknown.length > 0)
+            refuse({ kind: "unknown_lane", asks: unknown });
         if (pending === 0)
             return 0;
         if (lanes.length !== 1)
-            refuse(pending);
+            refuse({ kind: "backfill_ambiguous", pending });
         const filled = this.core.fillMissingExecutionLanes(lanes[0]);
         this.compact();
         return filled;
     }
+    renameRetiredExecutionLaneWordM40() {
+        const renamed = this.core.renameExecutionLaneWord(RETIRED_EXECUTION_LANE_WORD_M40, RENAMED_EXECUTION_LANE_M40);
+        if (renamed === 0)
+            return 0;
+        try {
+            this.compact();
+        }
+        catch (e) {
+            throw new ExecutionLaneRenameWriteRefusedError(this.path, e);
+        }
+        return renamed;
+    }
     dispose() {
         this.log?.close();
         this.log = undefined;

package/dist/plugins/approval-ask-store-memory.d.ts

@@ -30,7 +30,7 @@
  *  - resolveProvisional 故意不经 canAskTransition(同 SQL twin 头注：这是版本化补偿的例外通道）。
  */
 import { type AskState, type BatchState } from "../approval-ask-machine.js";
-import { type ExecutionLane } from "../execution-lane-caps.js";
+import type { ExecutionLane } from "../execution-lane-caps.js";
 import type { AskCallCoordinate, AskDecision, AskRow, AskTerminalClaimIntent, AskTerminalClaimOpts, AskTerminalClaimOutcome, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, EnsureAskResult, DecideResult, ExpireResult, NewAskRow } from "./approval-ask-store-sql.js";
 /**
  * [ref] 的 `updatedInput` **入店编码**——两 twin 共用的那一只(本函数是唯一真源)。
@@ -75,10 +75,12 @@ export declare class InMemoryApprovalAskStore implements ApprovalAskStore {
      */
     exportRows(): ApprovalAskRowsSnapshot;
     /**
-     * 执行放置切换 ④b 的 local 腿(File 形的内核口;`FileApprovalAskStore.backfillExecutionLanes` 调):出处车道还没记下的行(升级前写下的日志 / 快照行
-     * 装回后这一格缺席)记成 `lane`(一元车道表的唯一项 —— 调用方判过)。返回改了的行数;只碰缺这一格的行。
+     * 执行放置切换 ④b 的 local 腿(File 形的内核口;`FileApprovalAskStore.backfillExecutionLanes` 调):出处车道**缺席**的行(升级前写下的日志 / 快照行
+     * 装回后这一格不在)记成 `lane`(一元车道表的唯一项 —— 调用方判过)。返回改了的行数;只碰这一格缺席的行 —— 记下了而不是车道词的行不在这里改(调用方先拒)。
      */
     fillMissingExecutionLanes(lane: ExecutionLane): number;
+    /** 一次性迁移 M40 的 local 问账腿(File 形的内核口;`FileApprovalAskStore.renameRetiredExecutionLaneWordM40` 调):出处车道记成 `from` 的行改记 `to`。返回改了的行数。 */
+    renameExecutionLaneWord(from: string, to: ExecutionLane): number;
     /** [ref]:一行的**同步**点读(拷贝;纯读,零判定)—— File 形在写口的同步前缀里用它(见类顶注)。 */
     peekAsk(askId: string): AskRow | null;
     /** [ref]:把快照里的行**原样**装回两张 Map(同键覆盖)。零谓词、零状态机 —— 它不是一条转移,是重放

package/dist/plugins/approval-ask-store-memory.js

@@ -1,5 +1,4 @@
 import { ASK_TERMINAL, canAskTransition } from "../approval-ask-machine.js";
-import { isExecutionLane } from "../execution-lane-caps.js";
 import { APPROVAL_ENDING_CAUSES } from "../approval-deny-reasons.js";
 import { askRowCarriesOwner, askRowOnCall, assertDecideSource, assertIdempotencyKeyShape, assertIntegralEpochMs, assertReapBounds, ApprovalAskReadAbortedError, claimTargetState, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, projectDecideReading } from "./approval-ask-store-sql.js";
 function applyPatch(row, patch) {
@@ -45,13 +44,23 @@ export class InMemoryApprovalAskStore {
     fillMissingExecutionLanes(lane) {
         let filled = 0;
         for (const [askId, row] of this.asks) {
-            if (isExecutionLane(String(row.executionLane ?? "")))
+            if (row.executionLane !== undefined)
                 continue;
             this.asks.set(askId, { ...row, executionLane: lane });
             filled += 1;
         }
         return filled;
     }
+    renameExecutionLaneWord(from, to) {
+        let renamed = 0;
+        for (const [askId, row] of this.asks) {
+            if (row.executionLane !== from)
+                continue;
+            this.asks.set(askId, { ...row, executionLane: to });
+            renamed += 1;
+        }
+        return renamed;
+    }
     peekAsk(askId) {
         const row = this.asks.get(askId);
         return row ? { ...row } : null;

package/dist/plugins/approval-ask-store-sql.d.ts

@@ -406,6 +406,9 @@ export type AskTerminalClaimCurrent = {
     settledBy: HostSettledBy | null;
     /** core 7.61.0([ref]):赢家决议的机器座位(语义见 {@link AskRow.decidedVia});必填,理由与 `settledBy` 同。 */
     decidedVia: DecidedVia | null;
+    /** 赢家决议的人写说明(`decision_note` 列,与决议同一条 UPDATE 落;`null` = 没说明);**必填**(可空),理由与 `settledBy` 同:可选会让投影漏挑这一列时静默编译过,
+     *  而漏挑的后果恰是 CAS 输家把赢家带说明的拒读成「一个人拒了、没说怎么办」(读回铸点 `outcomeOfDecidedRow` 把拒行上的非空说明铸成交给模型的 `reason`)。 */
+    decisionNote: string | null;
     /** 行上记着的终态成因(`ending_cause` 列,经唯一读口 `askRowEndingCause` 读出)。**只在读得出时在场**(没写 / 与 state 不配 ⇒ 缺席;DECIDED 的败方读数逐字不变)。
      *  CAS 输家据它按**行上那个成因**结算(而不是把别人撤的卡读成一次拒绝);投影的唯一函数是 {@link projectAskTerminalClaimTruth},三 twin 不各自挑列,原始列值不出店层。 */
     endingCause?: AskRowEndingCause;

package/dist/plugins/approval-ask-store-sql.js

@@ -7,6 +7,7 @@ import { describeProbedTableDrift } from "./schema-drift-sentence.js";
 import { decodeJsonColumn, foldJsonColumn, jsonColumnText, readJsonObjectColumn, readTriStateJsonValueColumn } from "./sql-json-column.js";
 import { ensureIndexes } from "./ensure-index.js";
 import { isExecutionLane } from "../execution-lane-caps.js";
+import { retiredExecutionLaneHintM40 } from "./execution-lane-rename-m40.js";
 export function assertIntegralEpochMs(field, value) {
     if (!Number.isSafeInteger(value)) {
         throw new TypeError(`approval-ask store: ${field} must be an integer epoch-ms (BIGINT column), got ${String(value)}`);
@@ -110,6 +111,7 @@ export function projectAskTerminalClaimTruth(row) {
         ...(row.updatedInput !== undefined ? { updatedInput: row.updatedInput } : {}),
         settledBy: row.settledBy,
         decidedVia: row.decidedVia,
+        decisionNote: row.decisionNote,
         ...(endingCause !== undefined ? { endingCause } : {}),
         ...(parkTrigger !== undefined ? { parkTrigger } : {}),
     };
@@ -144,7 +146,7 @@ export const APPROVAL_ASK_PARK_TRIGGER_COLUMN = {
 function executionLaneColumnOf(raw, askId) {
     const lane = typeof raw === "string" ? raw : "";
     if (!isExecutionLane(lane)) {
-        throw new Error(`approval-ask-store: ask ${askId} carries execution_lane ${JSON.stringify(lane)}, which is not an execution lane — the execution placement switch migration backfills every row; refusing rather than guess the lane this ask was raised on`);
+        throw new Error(`approval-ask-store: ask ${askId} carries execution_lane ${JSON.stringify(lane)}, which is not an execution lane — the execution placement switch migration backfills every row; refusing rather than guess the lane this ask was raised on${retiredExecutionLaneHintM40(lane)}`);
     }
     return lane;
 }

package/dist/plugins/blob-backend.d.ts

@@ -1,153 +1,31 @@
-import type { Pool as MysqlPool } from "mysql2/promise";
-import type { Pool as PgPool } from "pg";
-import { type SqlEngineFacts, type SqlEngineReading, type SqlWallSource, type SqlWallsReading, type SqlDialect } from "./sql-driver.js";
-import { type Logger } from "../observability/logger.js";
 /**
- * 文本协议的 blob 膨胀律 —— mysql2 `query()` 把 Buffer 参数写成 `X'<hex>'`,一字节两个字符,所以承载一个 blob 的语句至少是它的 2 倍。
- * 包墙折成「能装下多大的 blob」只用这一只常量,推导里不手写 `/ 2`。
- */
-export declare const SQL_TEXT_PROTOCOL_BLOB_INFLATION = 2;
-/**
- * 包墙下能装多大的 blob:语句里的载荷量({@link packetWallStatementBytes})再按 {@link SQL_TEXT_PROTOCOL_BLOB_INFLATION} 折半。
- * blob 以十六进制字面进语句、有 2× —— 膨胀律是 blob 腿自己的,余量不是。
- */
-export declare function packetWallBlobCap(maxPacketBytes: number): number;
-/**
- * SQL 快照 blob 的**缺省**帽(运维没设 `SNAPSHOT_BLOB_SQL_MAX_BYTES` 时)的唯一推导 —— 入参是判官 `sqlWallsOf` 给的墙(不读事实、不判缺席、不看方言),**两堵墙取最小**:
- * 行墙腿(`SqlEngineFacts.maxRowBytes`,TiDB:{@link rowWallPayloadBytes} 的 `blob` = 行墙 − blob 行的余量 1 KiB —— 按这一行的真实形算,不借 JSON 提交体行的 64 KiB)
- * 与包墙腿(`SqlEngineFacts.maxPacketBytes`,InnoDB 与 TiDB 都有:{@link packetWallBlobCap} = ⌊(包墙 − 1 KiB 语句余量) ÷ 2⌋)。余量只在 `sql-driver.ts` 定义一次
- * (墙 × 行的形各一只),提交体受理口(`http/request-guards.ts` `refuseSubmitBody`)读同一张表的 `json` 那一只,不各抄。
- * 墙的 `null` 只表示「这堵墙不存在」;两堵都不存在(PG —— 扩展协议无这两堵墙 —— 或没有 SQL 后端)⇒ `undefined` 不设帽。
- * 「事实本身缺席」不是这里的入参:店的写前判读的是借出连接自己的事实(恒已建立,见 {@link SqlConnectionReading}),缺席的读法只在提交受理口读池级读口时出现(判官 `sqlWallsOf` 给墙)。
- * 显式旋钮是运维的策略帽,在本推导之上(见 {@link sqlBlobCapBytes})。
- *
- * 两堵墙的真库读数(clay 拍 a+c,2026-07-27;k3s8 tidb-test v7.5.1 默认配置探针):7 MiB / 31 MiB = `entry too large`(行墙,默认 6291456)、
- * 32 MiB = `max_allowed_packet`(包墙,64 MiB ÷ ~2× 文本协议膨胀)。帽=诚实拒绝:超限 blob 在 query 之前 typed 拒(消费面 HTTP 413 / capture warn
- * 拿到可行动信息);帽与墙之间只差这一行自己的几百字节(blob 行余量),帽之下的 blob 在缺省配置下落得进。D-1 附件战役同墙教训:`task-attachment-store.ts` 头注。
- */
-export declare function sqlBlobDefaultCapBytes(walls: SqlWallsReading): number | undefined;
-/**
- * 一个 SQL 快照 blob 的帽 + 它**从哪来**。`operator` = 运维显式设的 `SNAPSHOT_BLOB_SQL_MAX_BYTES`(策略帽);`reported` / `assumed` = 缺省推导里**定下这个帽的那条腿**的墙数字出处
- * ({@link SqlWallSource}:库自己报的 / 读失败或事实缺席而退的文档缺省)。机读位同 413 拒体的 `wallSource` 词,旋钮形多一个 `operator`。
- */
-export interface SqlBlobCapReading {
-    readonly capBytes: number;
-    readonly source: "operator" | SqlWallSource;
-}
-/**
- * 缺省帽的推导(唯一一处,{@link sqlBlobDefaultCapBytes} 是它的字节投影):两条腿各带自己那堵墙的出处,取最小的那条;两条一样小取行墙腿。两堵墙都不存在 ⇒ `undefined`。
- */
-export declare function sqlBlobDefaultCapOf(walls: SqlWallsReading): SqlBlobCapReading | undefined;
-/**
- * 一条**借出连接**的引擎读口:方言(装配事实)+ 它自己那次初始化回读的事实。与 {@link SqlEngineReading} 的差别只有一处 —— `facts` 恒在:连接是借出时才有的,
- * 借出即已初始化({@link connectJudged} 交给判决的就是借出连接的 `sqlConnectionFacts`),所以「事实缺席」在这条读法上**不可表示**(编译期拒,不是运行期一个没人走的分支)。
- * 事实缺席(池上还没建立过、或最近一次初始化被拒)只出现在读**池级**读口的地方 —— 提交受理口 —— 那一格的墙由判官 `sqlWallsOf` 给,不经过帽的推导。
- */
-export interface SqlConnectionReading {
-    readonly dialect: SqlEngineReading["dialect"];
-    readonly facts: SqlEngineFacts;
-}
-/**
- * 一个 SQL 快照 blob 此刻的帽 —— **显式旋钮 ?? 判官给的墙走缺省推导**的唯一一只函数。唯一读者 = 店的写前判({@link SqlBlobBackend.putBlob}),传的读口({@link SqlConnectionReading})是
- * **将要执行写入的那条连接**的(方言 + 它自己那次初始化回读的事实,墙经与提交受理口同一只判官 `sqlWallsOf`):包墙是连接的会话值,所以判决只在写入的那条连接上做,
- * HTTP 面不替店另算一份帽。
- */
-export declare function sqlBlobCapOf(explicitCapBytes: number | undefined, connection: SqlConnectionReading): SqlBlobCapReading | undefined;
-/** {@link sqlBlobCapOf} 的字节投影(同一个推导,不另读)。 */
-export declare function sqlBlobCapBytes(explicitCapBytes: number | undefined, connection: SqlConnectionReading): number | undefined;
-/**
- * 这一拒是不是**那条连接的包墙**定的:帽是缺省推导出的(不是运维旋钮)、那条连接有包墙、且包墙腿的折算恰是这个帽(包墙腿是最矮的一腿,或与行墙腿并列)。
- * 只有这种拒才值得问「这条连接过时了吗」({@link connectJudged}) —— 旋钮的拒、行墙的拒与连接新旧无关。`walls` = 判出这个帽的那一份墙({@link sqlWallsOf})。
- */
-export declare function capBoundByPacketWall(cap: SqlBlobCapReading, walls: SqlWallsReading): boolean;
-/**
- * 一次 blob 超帽的拒句 —— **唯一的组句器**(店的 typed {@link BlobTooLargeError} 调它;`PUT /sync/blobs` 的 413 原样转出它的句子):句子按帽的出处({@link SqlBlobCapReading.source})
- * 分三形,不把假定说成库的上限、也不把运维的旋钮说成库的上限。
- *  · `operator` —— 帽是运维设的 `SNAPSHOT_BLOB_SQL_MAX_BYTES`;
- *  · `reported` —— 帽由库报的两堵墙推出(单行上限与包墙÷文本协议膨胀的较小者);
- *  · `assumed` —— 库的上限没读到(事实还没建立,或这一堵读失败),帽按受支持引擎里最保守的缺省墙推出,稍后重试或由运维设旋钮。
- */
-export declare function sqlBlobCapRefusalText(byteLen: number, cap: SqlBlobCapReading): string;
-/** typed 判别错:blob 超过 SQL 店的承载帽。判别码供店侧结果映射/HTTP 面/日志使用——绝不能与
- *  transient 写失败混在一类(那类是可重试的 502;这类重试永远不会成功)。句子是 {@link sqlBlobCapRefusalText}(带帽的出处)。 */
-export declare class BlobTooLargeError extends Error {
-    readonly cap: SqlBlobCapReading;
-    readonly code: "blob_too_large_for_sql";
-    constructor(byteLen: number, cap: SqlBlobCapReading);
-}
-/**
- * The content-addressed byte store. All four methods are keyed on the sha256 `hash` of the bytes:
- *  - putBlob: store bytes (idempotent — a repeat for the same hash is a no-op-equivalent; the SQL twin refreshes
- *    created_at so a just-written/re-used blob is GC-grace-protected). MinIO PUTs the object AND upserts the SQL INDEX.
- *  - getBlob: the bytes for `hash`, or undefined if absent. A TRANSIENT backend fault THROWS (so a restore/import fails
- *    LOUD, not a silent "missing blob"); only a genuine absence / corruption is undefined.
- *  - hasBlobs: the subset of `hashes` that already exist — a single SQL `IN(...)` over the index for BOTH backends
- *    (migration idempotency + reap probing + the §10 import presence pre-check; cheaper than a HEAD-per-hash on MinIO).
- *  - deleteBlobs: byte-delete the given hashes (called ONLY by the async sweep reaper). Honors the SAME created_at
- *    grace window as the SQL backend (MinIO reads the index's created_at) — delete-in-use is impossible. Returns the
- *    count ACTUALLY deleted (the grace-passed subset), so the sweep reports real work, not the pre-grace orphan count.
+ * The byte port. Keys are opaque to it (today every index owner keys a blob by its sha256 hash).
+ *  - `put`: store `bytes` under `key`. Idempotent (a repeat for the same key overwrites with the identical bytes); a rejection is a
+ *    failed write.
+ *  - `get`: the bytes under `key`, or `undefined` when nothing is there. A TRANSIENT fault THROWS (so a restore / import fails LOUD,
+ *    not as a silent "missing blob"). The index owner checks the bytes against the hash ({@link readAtAddress}).
+ *  - `delete`: remove the bytes under each key. Idempotent — a key with nothing under it is a success; a key that could not be removed
+ *    makes the call reject (after every key was tried).
  */
 export interface BlobBackend {
-    putBlob(hash: string, bytes: Uint8Array): Promise<void>;
-    getBlob(hash: string): Promise<Uint8Array | undefined>;
-    hasBlobs(hashes: string[]): Promise<Set<string>>;
-    deleteBlobs(hashes: string[]): Promise<number>;
+    put(key: string, bytes: Uint8Array): Promise<void>;
+    get(key: string): Promise<Uint8Array | undefined>;
+    delete(keys: readonly string[]): Promise<void>;
 }
 /**
- * SQL BlobBackend — the `snapshot_blob` table ops EXTRACTED VERBATIM from the tidb/pg file-snapshot stores (the
- * created_at-refreshing upsert, the bytes SELECT, the grace-window orphan DELETE→deleteBlobs, a has via SELECT). Two
- * dialect twins selected by `dialect`. Keeping the SQL byte-identical means the existing behaviour + the env-gated
- * real-DB integration suite are unchanged when MinIO is unset (the DEFAULT backend the file-snapshot stores construct).
- *
- * NOTE deleteBlobs here is the BYTE delete ONLY — it does NOT do the reference (`not in the manifest`) filter: that
- * check stays in the owning store, which computes the orphan hash SET from its own domain's manifest and hands it here. The grace-window `created_at < cutoff` guard is RETAINED on the delete so a just-written blob
- * that a concurrent in-flight snapshot still needs is never byte-deleted (delete-in-use is data loss; under-delete is
- * harmless — the next sweep collects it).
+ * A content-addressed read through a port — the index owner's ONE reading of `get`: the bytes under `hash`, or `undefined` when the
+ * port has none OR when the bytes it serves do not hash to `hash` (corruption on the wire, or a POISONED object written under a hash
+ * it does not match): fail-closed, never wrong bytes. A content-addressed store's whole safety rests on bytes-match-hash; this is
+ * where both index owners judge it (the file-history blob index, the attachment store).
  */
-export declare class SqlBlobBackend implements BlobBackend {
-    private readonly dialect;
-    private readonly pool;
-    /** Explicit per-blob cap (the operator's `SNAPSHOT_BLOB_SQL_MAX_BYTES`); absent ⇒ the derivation in {@link sqlBlobCapOf} over the walls of the connection each write borrows. */
-    private readonly explicitCapBytes;
-    /** Blob-domain table ([ref] blob 域隔离:file-history 域用自己的表,reap/GC 不跨域)。代码内字面量,非用户输入。 */
-    private readonly table;
-    /** The write path's connection source: every `putBlob` borrows ONE connection from it (through {@link connectJudged}), judges on that connection's walls, writes on it. */
-    private readonly db;
-    /** Where a stale connection's replacement is logged ({@link connectJudged}); the boot assembly passes the service logger. */
-    private readonly log;
-    constructor(dialect: SqlDialect, pool: MysqlPool | PgPool, maxBytes?: number, table?: string, log?: Pick<Logger, "warn">);
-    /** The created_at-refreshing content-addressed upsert — VERBATIM the tidb/pg stores' `putBlobRow`. Refreshes
-     *  created_at even on a dedup hit so a re-used/just-written blob is "touched=now" and GC-grace-protected.
-     *  (a): an over-cap blob is REJECTED (typed {@link BlobTooLargeError}) BEFORE the driver ever sees the bytes —
-     *  the alternative is an inscrutable packet-limit error deep in the driver, and on the HTTP face a 502 that
-     *  invites the peer to retry a blob that can never land.
-     *  🔴 The cap is judged ON THE CONNECTION THAT WRITES ([ref]): `max_allowed_packet` is a session value, fixed per
-     *  connection, so the write borrows one connection through {@link connectJudged}, which reads ITS walls, judges, and — when
-     *  the refusal is that connection's packet wall and the server's global wall is higher — replaces the stale connection and
-     *  judges once more; the INSERT runs on the connection that passed. Never a pool-level reading, never a bare `pool.query`. */
-    putBlob(hash: string, bytes: Uint8Array): Promise<void>;
-    /** The bytes for `hash` (undefined if absent) — VERBATIM the tidb/pg stores' getBlob SELECT. A pool/query error
-     *  PROPAGATES (a transient DB fault is loud, not a silent "missing blob" — parity with the MinIO backend's throw). */
-    getBlob(hash: string): Promise<Uint8Array | undefined>;
-    /** The subset of `hashes` that exist — a single `blob_hash IN (...)` SELECT (idempotency / reap probe). */
-    hasBlobs(hashes: string[]): Promise<Set<string>>;
-    /** Byte-delete the given hashes (the orphan SET is computed by the CALLER from its own domain's manifest). Retains
-     *  the grace-window guard so a just-written blob a concurrent in-flight write needs is never delete-in-use — VERBATIM
-     *  the tidb/pg stores' gcOrphanBlobs delete, minus the reference clause (the caller already excluded referenced
-     *  hashes). Best-effort: a delete error is swallowed (under-delete is harmless). */
-    deleteBlobs(hashes: string[]): Promise<number>;
-}
-/** SHARED index op(workspace 浏览面 #3,[ref]②)—— per-blob 字节数,读 SQL INDEX 的 `byte_len`
- *  列(sqlHasBlobs 同款单 IN 查询;MinIO 后端的 bytes-NULL 索引行同样带 byte_len,两后端同源)。
- *  tree/file 面的 size 投影与「超限先拒后拉」都靠它——绝不为拿大小去 getBlob 整块字节。 */
-export declare function sqlBlobSizes(dialect: SqlDialect, pool: MysqlPool | PgPool, hashes: string[]): Promise<Map<string, number>>;
+export declare function readAtAddress(port: Pick<BlobBackend, "get">, hash: string): Promise<Uint8Array | undefined>;
 export interface MinioBlobBackendConfig {
     endpoint: string;
     bucket: string;
     accessKey: string;
     secretKey: string;
     region?: string;
-    /** Key prefix for blob objects, e.g. "blobs/". Object key = keyPrefix + hash. Default "blobs/". */
+    /** Key prefix for blob objects, e.g. "blobs/". Object key = keyPrefix + key. Default "blobs/". */
     keyPrefix?: string;
     /** Presigned-URL TTL (seconds). Default 3600 (1h) — must comfortably exceed a ~64 MiB single-PUT/GET on a slow link
      *  (a SigV4 X-Amz-Expires bounds the WHOLE transfer from X-Amz-Date; a too-short TTL fails mid-stream). */
@@ -155,22 +33,6 @@ export interface MinioBlobBackendConfig {
     /** 测试注入口(listObjects 分页钉用);生产缺省 global fetch。 */
     fetchImpl?: typeof fetch;
 }
-/**
- * MinIO BlobBackend — content-addressed bytes in an S3-compatible object store, via the zero-dependency
- * {@link presignS3Url} SigV4 generator + `fetch` (NO S3 SDK; the repo's no-SDK posture). The object key is
- * `keyPrefix + hash` (content-addressed → idempotent PUT, dedup across snapshots is automatic).
- *
- * THE SQL INDEX: the bytes go to MinIO, but a `snapshot_blob` INDEX row `(blob_hash, byte_len, created_at)` with bytes
- * NULL is kept in SQL (same pool/dialect). This is what makes the orphan-reference computation + the created_at grace
- * window + the §10 presence pre-check work identically to the SQL backend (see the file header). hasBlobs reads the
- * index; putBlob PUTs then upserts the index (created_at-refresh on conflict); deleteBlobs deletes the grace-passed
- * index rows AND the matching MinIO objects (called ONLY from the async sweep reaper).
- *
- * INTEGRITY (security-critical): getBlob VERIFIES sha256(bytes) === hash before returning. A content-addressed store's
- * whole safety rests on bytes-match-hash; a mismatch means corruption (network) or POISONING (a hostile object written
- * under a hash it doesn't match) — treated as ABSENT (undefined), NEVER returning wrong bytes. This mirrors the
- * importManifest content-address check the SQL stores already do.
- */
 /** 鲁棒性批2 C2/C3/C6(2026-08-03):S3 兼容端点 IO 的统一 abort 上界(fleet-client C1 定常量形
  *  先例)。半开端点此前各挂 undici 默认 ~300s headersTimeout——blob GET 卡住 restore/session-import
  *  同步路径,SendUserFile 工具调用永不返回。120s 对慢链路 ~64MiB 单 PUT/GET 仍宽裕(presignTtlSec
@@ -185,45 +47,34 @@ export type BucketProbe = {
     readonly state: "unknown";
     readonly detail: string;
 };
+/**
+ * The object-storage port: bytes in an S3-compatible store under `keyPrefix + key` (content-addressed keys ⇒ an idempotent PUT and
+ * dedup across writers). Object I/O only — no SQL, no index, no grace window, no content-address check (those are the index
+ * owner's). Beyond the port's three members it carries the object store's own reads a deployment needs: `listObjects` / `headObject`
+ * (the attachment store's orphan-object sweep) and `probeBucket` (the boot-time bucket check).
+ */
 export declare class MinioBlobBackend implements BlobBackend {
     private readonly cfg;
     private readonly keyPrefix;
     private readonly ttl;
-    /** The SQL index pool+dialect, or undefined for an index-LESS backend (the migration script + the unit suite, which
-     *  exercise ONLY the object I/O — put/get/has-by-HEAD/delete — with no DB). When undefined, hasBlobs falls back to a
-     *  HEAD-per-hash probe and deleteBlobs ignores the grace window (the script is a stop-the-world copy, not the live GC
-     *  path). The file-snapshot stores ALWAYS pass the pool, so the live reference-tracking always has the index. */
-    private readonly indexPool?;
-    private readonly indexDialect?;
-    /** Blob-domain index table ([ref] 域隔离,SqlBlobBackend.table 同款;默认 = E19 纪元的 snapshot_blob)。 */
-    private readonly indexTable;
-    constructor(cfg: MinioBlobBackendConfig, index?: {
-        dialect: SqlDialect;
-        pool: MysqlPool | PgPool;
-        table?: string;
-    });
+    constructor(cfg: MinioBlobBackendConfig);
     private objectKey;
     private presign;
-    /** PUT the bytes under the content-addressed key, THEN upsert the SQL INDEX row (bytes NULL, created_at refresh on
-     *  conflict — the SAME grace discipline as SqlBlobBackend, so a just-PUT blob an in-flight snapshot needs is touched=
-     *  now and protected). Idempotent (same hash ⇒ overwrite-with-identical-bytes + created_at bump). A non-2xx PUT throws
-     *  (an upload failure must surface — a silent drop would later read_failed on restore). The PUT happens BEFORE the
-     *  index upsert so an index row never claims a blob the object store doesn't hold (an index row with no object would
-     *  let hasBlobs report a phantom present; the reverse — an object with no index — is harmless and pruned by a bucket
-     *  lifecycle if it ever happens). NOTE no post-PUT read-back verify on the LIVE path (perf): content-addressing
-     *  catches a corrupted PUT at the next getBlob sha-check (fail-closed); the one-time migration script DOES read-back. */
-    putBlob(hash: string, bytes: Uint8Array): Promise<void>;
-    /** GET the bytes for `hash`, then VERIFY content-address (sha256(bytes)===hash). THREE branches (finding 11):
-     *   - 404 → undefined (genuinely ABSENT — the file-snapshot store treats undefined as a missing blob).
-     *   - sha256 MISMATCH → undefined (corruption/poisoning; treat corrupt-as-absent, fail-CLOSED, NEVER wrong bytes).
-     *   - a NON-2xx-NON-404 (5xx/throttle) OR a network/fetch REJECT → THROW (a TRANSIENT fault must fail LOUD so the
-     *     restore/import surfaces an error, NOT silently drop a file as "missing"; the SQL backend likewise propagates a
-     *     pool error). The snapshot store's restore() wraps applyManifest so this throw becomes a {ok:false} restore_failed. */
-    getBlob(hash: string): Promise<Uint8Array | undefined>;
-    /** The subset of `hashes` present — reads the SQL INDEX (cheaper than a HEAD-per-hash AND consistent with the SQL
-     *  backend). Falls back to a presigned HEAD per hash ONLY in object-only mode (no index pool: the migration / unit
-     *  path). The caller passes DISTINCT hashes (migration idempotency batch / reap orphan set / §10 presence pre-check). */
-    hasBlobs(hashes: string[]): Promise<Set<string>>;
+    /** PUT the bytes under the key. A non-2xx PUT throws (an upload failure must surface — a silent drop would later read_failed on
+     *  restore). NOTE no post-PUT read-back verify on the live path (perf): a corrupted PUT is caught at the next read's content-address
+     *  check (fail-closed). */
+    put(key: string, bytes: Uint8Array): Promise<void>;
+    /** GET the bytes under the key. THREE branches (finding 11):
+     *   - 404 → undefined (genuinely ABSENT).
+     *   - 2xx → the bytes, unjudged (the index owner checks them against the hash: {@link readAtAddress}).
+     *   - a NON-2xx-NON-404 (5xx/throttle) OR a network/fetch REJECT → THROW (a TRANSIENT fault must fail LOUD so the restore/import
+     *     surfaces an error, NOT silently drop a file as "missing"). */
+    get(key: string): Promise<Uint8Array | undefined>;
+    /** DELETE every key's object, at most {@link MINIO_OP_CONCURRENCY} in flight (no FD / throttle storm). Each key is independent: a
+     *  2xx or a 404 (already gone) is a success; any other answer or a network failure is a failure. Every key is tried; then, if any
+     *  failed, the call REJECTS naming how many (🔴 复审 F4 的同一判据:对象存储完全不可写时绝不报「清理成功」—— 失败只在这里说出来,
+     *  调用方据此记账,不吞)。 */
+    delete(keys: readonly string[]): Promise<void>;
     /** D-1 孤儿对象 GC(clay 拍 2026-07-28):列举本后端 keyPrefix 下的全部对象(ListObjectsV2 分页,
      *  零依赖 XML 取 <Key>/<LastModified>/<NextContinuationToken>)。**server 端 sweep 专用**——presign 的
      *  bucket-GET 列举能力绝不外发。响应非 2xx 即 throw(sweep 调用方自 catch:列举失败=本轮跳过,
@@ -241,13 +92,5 @@ export declare class MinioBlobBackend implements BlobBackend {
      *  🔴 只有「404 且体里是 `NoSuchBucket`」才算缺桶;网络不通 / 403(凭据不能列举 ≠ 桶不在)/ 5xx / 没有 NoSuchBucket 的 404(代理 / 路径错)
      *  都**证明不了**缺桶 ⇒ `unknown`,调用方不拒启、只报一次。总函数:不抛。`timeoutMs`:boot 期调用方给的单次上界(黑洞端点不许把起服拖到 120s)。 */
     probeBucket(timeoutMs?: number): Promise<BucketProbe>;
-    /** Byte-delete the given hashes — called ONLY from the async sweepOrphanBlobs reaper (NEVER the synchronous purge
-     *  path). Honors the SAME created_at grace window as the SQL backend: with an index, DELETE the grace-passed index
-     *  rows first (the index's created_at is the authoritative age — an S3 object carries no service-controlled timestamp
-     *  the backend reads), then delete the MinIO objects ONLY for those grace-passed hashes (so a just-PUT blob an
-     *  in-flight snapshot needs is NOT delete-in-use). ERROR-TOLERANT + BOUNDED: each object delete is independent (a
-     *  failure is skipped → retried next sweep), at most MINIO_OP_CONCURRENCY in flight (no FD/throttle storm). In
-     *  object-only mode (no index pool: the migration/unit cleanup path) it deletes every given hash with no grace. */
-    deleteBlobs(hashes: string[]): Promise<number>;
 }
 //# sourceMappingURL=blob-backend.d.ts.map