@sema-agent/server 7.146.0 → 7.148.0

package/dist/plugins/store-backend.js

@@ -12,14 +12,19 @@ import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJo
 import { FileRunStore } from "./file-run-store.js";
 import { LocalWorkflowParkDecisionStore } from "../orchestration/workflow-park-decision.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
+import { databaseAnswerCodesOf, isDeploymentFaultError } from "./sql-errors.js";
 import { buildStoreOpenRefusalTail } from "./store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./store-lock-wait.js";
 import { NO_SQL_MIGRATIONS, assertExecutionPlacementSwitchAdmissibleOnPool, backfillLocalAskExecutionLanes, backfillLocalExecutionPlacements, runSqlOneTimeMigrations } from "./one-time-migrations.js";
 import { deployedExecutionLanes } from "../execution-lane-caps.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
+import { LOCAL_MARKER_FILE, switchLocalScenarioPrefixM42 } from "./scenario-prefix-switch-m42.js";
+import { LOCAL_LEGACY_SKILL_EXEMPTION_MARKER_FILE, dropLocalLegacySkillExemptionsM46 } from "./approval-exemption-skill-m46.js";
+import { LocalTaskAttachmentStore } from "./local-task-attachment-store.js";
 import { assertRetiredSchemaAbsentOnPool } from "./schema-consistency.js";
-import { LocalSessionStore, createLocalSessionRepo } from "./local-session-store.js";
+import { LocalSessionStore, archiveTokenAdoptionCarried, holdArchiveTokenAdoptionDuty, createLocalSessionRepo } from "./local-session-store.js";
 import { SESSION_DURABILITY, SESSION_PLACEMENTS } from "./session-placement.js";
-import { LocalCheckpointStore } from "./local-checkpoint-store.js";
+import { LocalCheckpointStore, dropLocalCheckpointCtxStrict } from "./local-checkpoint-store.js";
 import { FileResumeAnchorStore } from "./file-resume-anchor-store.js";
 import { TiDBApprovalExemptionStore, PgApprovalExemptionStore, FileApprovalExemptionStore } from "./approval-exemption-store.js";
 import { TiDBApprovalNonceStore, PgApprovalNonceStore, FileApprovalNonceStore } from "./approval-nonce-store.js";
@@ -33,11 +38,13 @@ import { FileUserInputLedgerStore } from "./user-input-ledger-file.js";
 import { TiDBUserInputLedgerStore, PgUserInputLedgerStore } from "./user-input-ledger-sql.js";
 import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
 import { TiDBSessionPolicyStore, PgSessionPolicyStore } from "../stores-sql/session-policy-store-sql.js";
+import { countClientWriteOn } from "./session-withdraw-sql.js";
 import { TiDBWorkflowJournalStore, PgWorkflowJournalStore } from "../stores-sql/workflow-journal-store-sql.js";
-import { TiDBFileHistoryStore, PgFileHistoryStore, FILE_HISTORY_BLOB_TABLE, FILE_HISTORY_BLOB_KEY_PREFIX } from "./file-history-store-sql.js";
-import { MinioBlobBackend, SqlBlobBackend } from "./blob-backend.js";
+import { TiDBFileHistoryStore, PgFileHistoryStore, FILE_HISTORY_BLOB_KEY_PREFIX } from "../stores-sql/file-history-store-sql.js";
+import { SqlBlobIndex } from "../stores-sql/blob-index-sql.js";
+import { MinioBlobBackend } from "./blob-backend.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
-import { fileMemoryControlDirFor } from "../memory-scope.js";
+import { fileMemoryControlDirFor, memoryEngineRootFor } from "../memory-scope.js";
 import { createTidbPool, ensureSchema as ensureTidbSchema } from "./tidb-pool.js";
 import { createPgPool, ensurePgSchema, pgPoolOptions } from "./pg-pool.js";
 import { TiDBRunStore, PgRunStore } from "./run-store-sql.js";
@@ -52,48 +59,69 @@ import { TiDBCostQuota } from "./tidb-cost-quota.js";
 import { PgCostQuota } from "./pg-cost-quota.js";
 import { TiDBRateLimiter } from "./tidb-rate-limiter.js";
 import { PgRateLimiter } from "./pg-rate-limiter.js";
-import { TiDBSessionStore } from "./tidb-session-store.js";
-import { PgSessionStore } from "./pg-session-storage.js";
+import { TiDBSessionStore } from "../stores-sql/tidb-session-store.js";
+import { PgSessionStore } from "../stores-sql/pg-session-storage.js";
+import { SqlSessionStore } from "./session-store-sql.js";
 import { TiDBSharedMemoryStore, PgSharedMemoryStore } from "./shared-memory-store-sql.js";
 import { TiDBAdoptionLogStore, PgAdoptionLogStore } from "./adoption-log-sql.js";
-import { TiDBRetentionStore, PgRetentionStore, sqlStoreRetention } from "./retention-store-sql.js";
+import { SqlRetentionStore } from "../stores-sql/retention-store-sql.js";
+import { SessionDeletionSupersededError } from "../execution-placement.js";
+import { sessionTenantScope } from "../session-children-retire.js";
+import { sqlStoreRetention } from "./retention-declaration.js";
+import { createRetentionDeploymentHooks, createSessionRowsHook, sweepLateCompletionRows } from "./retention-deployment.js";
+import { seatText } from "../trace/exit-seat.js";
+import { createSqlSessionWriteHooks } from "./session-store-sql.js";
 import { TiDBRetentionLaneStore, PgRetentionLaneStore } from "./retention-lane-store-sql.js";
 import { createSqlPermissionRuleStores } from "./permission-rule-store-sql.js";
 import { FILE_PERMISSION_RULE_DIR, createFilePermissionRuleStores, fileRuleBucketOwners, isFileBucketDamaged } from "./permission-rule-store-file.js";
 import { retireImportedLayerRootAllows } from "./imported-layer-root-retirement.js";
+import { buildDataDirLayout, tightenLocalDataDirModes } from "./local-data-dir-modes-m39.js";
+import { holdEngineHighWater } from "./local-engine-high-water.js";
+import { serviceVersion } from "../service-version.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
-import { storeDegradedReasonFor } from "../store-posture.js";
+import { localDataRootHoldsData, storeDegradedReasonFor } from "../store-posture.js";
 import { openWithinWait } from "./store-open-wait.js";
+export function createRunStallWiring(config, observers) {
+    const count = observers?.runStallVerdicts;
+    return { windowMs: () => config.runStaleSec * 1000, onVerdicts: (landed) => count?.(landed) };
+}
 export function workflowJournalOf(config, backend) {
     return config.selfOrchestrationEnabled && backend ? backend.workflowJournal() : undefined;
 }
-function historyBlobBackend(config, dialect, pool) {
+function fileHistoryOptions(config) {
     const s = config.snapshotBlobStore;
-    if (!s)
-        return new SqlBlobBackend(dialect, pool, config.snapshotBlobSqlMaxBytes, FILE_HISTORY_BLOB_TABLE, createLogger(config.logLevel));
-    return new MinioBlobBackend({
-        endpoint: s.endpoint,
-        bucket: s.bucket,
-        accessKey: s.accessKey,
-        secretKey: s.secretKey,
-        ...(s.region ? { region: s.region } : {}),
-        keyPrefix: `${s.keyPrefix ?? ""}${FILE_HISTORY_BLOB_KEY_PREFIX}`,
-        ...(s.presignTtlSec ? { presignTtlSec: s.presignTtlSec } : {}),
-    }, { dialect, pool, table: FILE_HISTORY_BLOB_TABLE });
+    const placement = s
+        ? {
+            blobs: new MinioBlobBackend({
+                endpoint: s.endpoint,
+                bucket: s.bucket,
+                accessKey: s.accessKey,
+                secretKey: s.secretKey,
+                ...(s.region ? { region: s.region } : {}),
+                keyPrefix: `${s.keyPrefix ?? ""}${FILE_HISTORY_BLOB_KEY_PREFIX}`,
+                ...(s.presignTtlSec ? { presignTtlSec: s.presignTtlSec } : {}),
+            }),
+        }
+        : {
+            ...(config.snapshotBlobSqlMaxBytes !== undefined ? { blobSqlMaxBytes: config.snapshotBlobSqlMaxBytes } : {}),
+            log: createLogger(config.logLevel),
+        };
+    return { ...config.fileHistory, ...placement };
 }
-function legacyBlobBackend(config, dialect, pool) {
+function legacyBlobIndex(config, dialect, pool) {
     const s = config.snapshotBlobStore;
-    if (!s)
-        return new SqlBlobBackend(dialect, pool, config.snapshotBlobSqlMaxBytes, undefined, createLogger(config.logLevel));
-    return new MinioBlobBackend({
-        endpoint: s.endpoint,
-        bucket: s.bucket,
-        accessKey: s.accessKey,
-        secretKey: s.secretKey,
-        ...(s.region ? { region: s.region } : {}),
-        ...(s.keyPrefix ? { keyPrefix: s.keyPrefix } : {}),
-        ...(s.presignTtlSec ? { presignTtlSec: s.presignTtlSec } : {}),
-    }, { dialect, pool });
+    const bytes = s
+        ? new MinioBlobBackend({
+            endpoint: s.endpoint,
+            bucket: s.bucket,
+            accessKey: s.accessKey,
+            secretKey: s.secretKey,
+            ...(s.region ? { region: s.region } : {}),
+            ...(s.keyPrefix ? { keyPrefix: s.keyPrefix } : {}),
+            ...(s.presignTtlSec ? { presignTtlSec: s.presignTtlSec } : {}),
+        })
+        : undefined;
+    return new SqlBlobIndex(dialect, pool, { table: "snapshot_blob", ...(bytes !== undefined ? { bytes } : {}), log: createLogger(config.logLevel) });
 }
 async function legacySweepImpl(config, dialect, pool) {
     const sql = "SELECT blob_hash FROM snapshot_blob";
@@ -108,29 +136,107 @@ async function legacySweepImpl(config, dialect, pool) {
     }
     if (orphans.length === 0)
         return 0;
-    return legacyBlobBackend(config, dialect, pool).deleteBlobs(orphans);
+    return legacyBlobIndex(config, dialect, pool).sweep(orphans);
+}
+export function createSqlRetentionCallHooks(db, opts, input) {
+    const deployment = createRetentionDeploymentHooks(db.dialect, opts, input);
+    return { hooks: { retention: deployment.hooks.retention, session: createSqlSessionWriteHooks(db) }, attachmentShas: deployment.attachmentShas };
+}
+export function createSqlRetentionExecutor(db, opts) {
+    const storeOpts = { ...(opts.mailboxTables ? { sessionBoxScope: sessionTenantScope } : {}), ...(opts.logger !== undefined ? { logger: opts.logger } : {}) };
+    const reads = new SqlRetentionStore(db, storeOpts);
+    const forCall = (input) => {
+        const hooks = createSqlRetentionCallHooks(db, opts, input);
+        return { store: new SqlRetentionStore(db, { ...storeOpts, transactionHooks: hooks.hooks }), hooks, call: { domain: input.domain, cutoffMs: input.cutoffMs } };
+    };
+    return {
+        retention: reads.retention,
+        listRetentionDomains: () => reads.listRetentionDomains(),
+        previewRetention: (input) => reads.previewRetention(input),
+        expireCheckpoints: async (input) => {
+            const one = forCall(input);
+            return one.store.expireCheckpoints(one.call);
+        },
+        deleteExpiredSessions: async (input) => {
+            const one = forCall(input);
+            const { erasedRows, ...receipt } = await one.store.deleteExpiredSessions(one.call);
+            if (erasedRows === undefined)
+                return receipt;
+            await afterSessionErase(db, opts, erasedRows.sessions);
+            return { ...receipt, erased: { ...erasedRows, attachmentShas: one.hooks.attachmentShas() } };
+        },
+        deleteOrphanToolResults: async (input) => {
+            const one = forCall(input);
+            return one.store.deleteOrphanToolResults(one.call);
+        },
+    };
+}
+async function afterSessionErase(db, opts, sessions) {
+    if (!opts.completionInbox || sessions.length === 0)
+        return;
+    await sweepLateCompletionRows(db, db.dialect, sessions, Date.now()).catch((err) => opts.logger?.warn?.("workflow_completion_late_rows_sweep_failed", { sessions: sessions.length, err: seatText("operator-log-text", String(err)) }));
+}
+export function createSqlSessionEraser(db, opts) {
+    const storeOpts = { ...(opts.mailboxTables ? { sessionBoxScope: sessionTenantScope } : {}), ...(opts.logger !== undefined ? { logger: opts.logger } : {}) };
+    return {
+        async erase(input) {
+            const rows = createSessionRowsHook(db.dialect, opts, input.owner ?? "");
+            const store = new SqlRetentionStore(db, { ...storeOpts, transactionHooks: { retention: { beforeDelete: rows.beforeDelete }, session: createSqlSessionWriteHooks(db) } });
+            const out = await store.eraseSession(input);
+            switch (out.outcome) {
+                case "absent":
+                    return { outcome: "superseded" };
+                case "refused":
+                    if (out.refusal instanceof SessionDeletionSupersededError)
+                        return { outcome: "superseded" };
+                    throw out.refusal;
+                case "erased":
+                    await afterSessionErase(db, opts, out.rows.sessions);
+                    return { outcome: "erased", trees: { ...out.rows, attachmentShas: rows.attachmentShas() } };
+                default: {
+                    const unknown = out;
+                    throw new Error(`session erase: no arm for ${JSON.stringify(unknown)}`);
+                }
+            }
+        },
+    };
 }
 export function assertCloudSnapshotBlobPosture(kind, config) {
     if (kind === "local" || config.snapshotBlobStore || config.snapshotBlobAllowSql)
         return;
+    const fact = SQL_BLOB_POSTURE_FACTS[kind];
     throw new Error("cloud deployments (DB_BACKEND=mysql|pg) must configure object storage for rewind file-history blobs " +
-        "(MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY): single-row SQL blob writes hit TiDB's " +
-        "txn-entry-size-limit (default 6MiB) / the mysql-protocol packet limit (bytes belong in object storage — " +
+        `(MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY): ${fact.wall} (bytes belong in object storage — ` +
         "same ruling as the D-1 attachment store). Single-box/test rigs may explicitly opt out with " +
-        "SNAPSHOT_BLOB_ALLOW_SQL_BYTES=true (a per-blob cap then applies; an over-cap tracked file's first-touch " +
+        `SNAPSHOT_BLOB_ALLOW_SQL_BYTES=true (${fact.cap}; an over-cap tracked file's first-touch ` +
         "backup is refused typed, which under the default DV-14 policy refuses that edit).");
 }
+const SQL_BLOB_POSTURE_FACTS = {
+    mysql: {
+        wall: "single-row SQL blob writes hit TiDB's txn-entry-size-limit (default 6MiB) / the mysql-protocol packet limit",
+        cap: "a per-blob cap then applies",
+    },
+    pg: {
+        wall: "single-row SQL blob writes put each blob into one PostgreSQL bytea value (PostgreSQL holds at most 1 GB in one value; this service reads no row-size or statement-size wall from PostgreSQL, so it derives no smaller default cap)",
+        cap: "this service derives no per-blob cap on PostgreSQL, so none applies unless SNAPSHOT_BLOB_SQL_MAX_BYTES is set — then a per-blob cap applies",
+    },
+};
+export function buildSqlOneTimeMigrationInput(config) {
+    return { lanes: deployedExecutionLanes(config), liveRunWindowMs: config.runStaleSec * 1000, identityBoundary: DEPLOYMENT_SHAPE_PREDICATES.identityBoundary.holds(config) };
+}
 class TiDBBackend {
     pool;
     config;
+    observers;
     kind = "mysql";
-    constructor(pool, config) {
+    constructor(pool, config, observers) {
         this.pool = pool;
         this.config = config;
+        this.observers = observers;
     }
     ensureSchema() { return ensureTidbSchema(this.pool); }
     close() { return this.pool.end(); }
-    run() { return (this.runStoreInst ??= new TiDBRunStore(this.pool)); }
+    run() { return (this.runStoreInst ??= new TiDBRunStore(this.pool, createRunStallWiring(this.config, this.observers))); }
     runStoreInst;
     resumeAnchor() { return new TiDBResumeAnchorStore(this.pool); }
     approvalExemption() { return new TiDBApprovalExemptionStore(this.pool); }
@@ -140,13 +246,13 @@ class TiDBBackend {
     permissionRule() { return createSqlPermissionRuleStores(mysqlDriver(this.pool)); }
     sendFileLedger() { return new TiDBSendFileLedger(this.pool); }
     userInputLedger() { return new TiDBUserInputLedgerStore(this.pool); }
-    sessionPolicy(logger) { return new TiDBSessionPolicyStore(this.pool, logger); }
-    fileHistory() { return new TiDBFileHistoryStore(this.pool, historyBlobBackend(this.config, "mysql", this.pool), this.config.fileHistory); }
+    sessionPolicy(logger) { return new TiDBSessionPolicyStore(this.pool, countClientWriteOn, logger ?? createLogger()); }
+    fileHistory() { return new TiDBFileHistoryStore(this.pool, fileHistoryOptions(this.config)); }
     memoryOptOutGrant() { return new TiDBMemoryOptOutGrantStore(this.pool); }
     sessionCaptureRecords() { return () => (this.captureRecordsInst ??= new TiDBSessionCaptureRecordStore(this.pool)); }
     captureRecordsInst;
     legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "mysql", this.pool); }
-    runOneTimeMigrations() { return runSqlOneTimeMigrations("mysql", this.pool, { lanes: deployedExecutionLanes(this.config) }); }
+    runOneTimeMigrations() { return runSqlOneTimeMigrations("mysql", this.pool, buildSqlOneTimeMigrationInput(this.config)); }
     workflowJournal() { return new TiDBWorkflowJournalStore(this.pool); }
     outcomeSink() { return new TiDBOutcomeLedger(this.pool); }
     workflowRun(onWarn) { return new TiDBWorkflowRunStore(this.pool, onWarn); }
@@ -156,19 +262,20 @@ class TiDBBackend {
     workflowParkDecisions() { return (this.parkDecisionsInst ??= new SqlWorkflowParkDecisionStore(this.run())); }
     parkDecisionsInst;
     sharedMemoryStore(authorizer) { return new TiDBSharedMemoryStore(this.pool, authorizer); }
-    checkpoint(logger) { return new TiDBCheckpointStore(this.pool, logger, { retention: sqlStoreRetention(this.config.retentionSweep), claims: this.run() }); }
+    checkpoint(logger) { return new TiDBCheckpointStore(this.pool, logger, { retention: sqlStoreRetention(this.config.retentionSweep) }); }
     checkpointReadView() { return this.checkpoint(); }
     toolResult() { return new TiDBToolResultStore(this.pool, { retention: sqlStoreRetention(this.config.retentionSweep) }); }
     imageIndex() { return new TiDBImageIndex(this.pool); }
     imageBake() { return new TiDBImageBake(this.pool); }
     leaderRun() { return new TiDBLeaderRunStore(this.pool); }
     device() { return new TiDBDeviceStore(this.pool); }
-    retention(opts) { return new TiDBRetentionStore(this.pool, opts); }
+    retention(opts) { return createSqlRetentionExecutor(mysqlDriver(this.pool), opts); }
+    sessionEraser(opts) { return createSqlSessionEraser(mysqlDriver(this.pool), opts); }
     retentionLane() { return new TiDBRetentionLaneStore(this.pool); }
     breaker(onWriteFail) { return new TiDBBreakerState(this.pool, onWriteFail); }
     costQuota(limitMicroUsd, windowMs, onDegraded) { return new TiDBCostQuota(this.pool, limitMicroUsd, windowMs, undefined, onDegraded, this.config.dbQueryTimeoutMs); }
     rateLimiter(limit, onDegraded) { return new TiDBRateLimiter(this.pool, limit, undefined, undefined, onDegraded, this.config.dbQueryTimeoutMs); }
-    session() { return new TiDBSessionStore(this.pool, { retention: sqlStoreRetention(this.config.retentionSweep) }); }
+    session() { return new SqlSessionStore(mysqlDriver(this.pool), (hooks) => new TiDBSessionStore(this.pool, { retention: sqlStoreRetention(this.config.retentionSweep), hooks })); }
     adoptionLog() { return new TiDBAdoptionLogStore(this.pool); }
     mysqlPool() { return this.pool; }
     pgPool() { return undefined; }
@@ -177,14 +284,16 @@ class TiDBBackend {
 class PgBackend {
     pool;
     config;
+    observers;
     kind = "pg";
-    constructor(pool, config) {
+    constructor(pool, config, observers) {
         this.pool = pool;
         this.config = config;
+        this.observers = observers;
     }
     ensureSchema() { return ensurePgSchema(this.pool); }
     close() { return this.pool.end(); }
-    run() { return (this.runStoreInst ??= new PgRunStore(this.pool)); }
+    run() { return (this.runStoreInst ??= new PgRunStore(this.pool, createRunStallWiring(this.config, this.observers))); }
     runStoreInst;
     resumeAnchor() { return new PgResumeAnchorStore(this.pool); }
     approvalExemption() { return new PgApprovalExemptionStore(this.pool); }
@@ -194,13 +303,13 @@ class PgBackend {
     permissionRule() { return createSqlPermissionRuleStores(pgDriver(this.pool)); }
     sendFileLedger() { return new PgSendFileLedger(this.pool); }
     userInputLedger() { return new PgUserInputLedgerStore(this.pool); }
-    sessionPolicy(logger) { return new PgSessionPolicyStore(this.pool, logger); }
-    fileHistory() { return new PgFileHistoryStore(this.pool, historyBlobBackend(this.config, "pg", this.pool), this.config.fileHistory); }
+    sessionPolicy(logger) { return new PgSessionPolicyStore(this.pool, countClientWriteOn, logger ?? createLogger()); }
+    fileHistory() { return new PgFileHistoryStore(this.pool, fileHistoryOptions(this.config)); }
     memoryOptOutGrant() { return new PgMemoryOptOutGrantStore(this.pool); }
     sessionCaptureRecords() { return () => (this.captureRecordsInst ??= new PgSessionCaptureRecordStore(this.pool)); }
     captureRecordsInst;
     legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "pg", this.pool); }
-    runOneTimeMigrations() { return runSqlOneTimeMigrations("pg", this.pool, { lanes: deployedExecutionLanes(this.config) }); }
+    runOneTimeMigrations() { return runSqlOneTimeMigrations("pg", this.pool, buildSqlOneTimeMigrationInput(this.config)); }
     workflowJournal() { return new PgWorkflowJournalStore(this.pool); }
     outcomeSink() { return new PgOutcomeLedger(this.pool); }
     workflowRun(onWarn) { return new PgWorkflowRunStore(this.pool, onWarn); }
@@ -210,19 +319,20 @@ class PgBackend {
     workflowParkDecisions() { return (this.parkDecisionsInst ??= new SqlWorkflowParkDecisionStore(this.run())); }
     parkDecisionsInst;
     sharedMemoryStore(authorizer) { return new PgSharedMemoryStore(this.pool, authorizer); }
-    checkpoint(logger) { return new PgCheckpointStore(this.pool, logger, { retention: sqlStoreRetention(this.config.retentionSweep), claims: this.run() }); }
+    checkpoint(logger) { return new PgCheckpointStore(this.pool, logger, { retention: sqlStoreRetention(this.config.retentionSweep) }); }
     checkpointReadView() { return this.checkpoint(); }
     toolResult() { return new PgToolResultStore(this.pool, { retention: sqlStoreRetention(this.config.retentionSweep) }); }
     imageIndex() { return new PgImageIndex(this.pool); }
     imageBake() { return new PgImageBake(this.pool); }
     leaderRun() { return new PgLeaderRunStore(this.pool); }
     device() { return new PgDeviceStore(this.pool); }
-    retention(opts) { return new PgRetentionStore(this.pool, opts); }
+    retention(opts) { return createSqlRetentionExecutor(pgDriver(this.pool), opts); }
+    sessionEraser(opts) { return createSqlSessionEraser(pgDriver(this.pool), opts); }
     retentionLane() { return new PgRetentionLaneStore(this.pool); }
     breaker(onWriteFail) { return new PgBreakerState(this.pool, onWriteFail); }
     costQuota(limitMicroUsd, windowMs, onDegraded) { return new PgCostQuota(this.pool, limitMicroUsd, windowMs, undefined, onDegraded, this.config.dbQueryTimeoutMs); }
     rateLimiter(limit, onDegraded) { return new PgRateLimiter(this.pool, limit, undefined, undefined, onDegraded, this.config.dbQueryTimeoutMs); }
-    session() { return new PgSessionStore(this.pool, { retention: sqlStoreRetention(this.config.retentionSweep) }); }
+    session() { return new SqlSessionStore(pgDriver(this.pool), (hooks) => new PgSessionStore(this.pool, { retention: sqlStoreRetention(this.config.retentionSweep), hooks })); }
     adoptionLog() { return new PgAdoptionLogStore(this.pool); }
     mysqlPool() { return undefined; }
     pgPool() { return this.pool; }
@@ -231,6 +341,22 @@ class PgBackend {
 export function localSessionRowsOf(backend) {
     return backend instanceof LocalBackend ? backend.session() : undefined;
 }
+export function localClientWritesOf(backend) {
+    return backend instanceof LocalBackend ? backend.session() : undefined;
+}
+function createClientCountedPolicyStore(inner, sessions) {
+    const listBySession = inner.listBySession?.bind(inner);
+    const deleteBySession = inner.deleteBySession?.bind(inner);
+    return {
+        getRules: (sessionId, principal) => inner.getRules(sessionId, principal),
+        putRules: (sessionId, principal, rules, opts) => sessions.withClientWrite(sessionId, async (count) => {
+            await count();
+            return inner.putRules(sessionId, principal, rules, opts);
+        }),
+        ...(listBySession !== undefined ? { listBySession } : {}),
+        ...(deleteBySession !== undefined ? { deleteBySession } : {}),
+    };
+}
 class LocalBackend {
     kind = "local";
     fileBackend;
@@ -250,34 +376,30 @@ class LocalBackend {
     discloseWarn;
     parkDecisionLedgerRoot;
     executionLanes;
-    constructor(root, config, onWarn, onError) {
+    identityBoundary;
+    dataDirLayout;
+    constructor(fileBackend, config, discloseWarn, onWarn, onError, observers) {
         this.executionLanes = deployedExecutionLanes(config);
+        this.identityBoundary = DEPLOYMENT_SHAPE_PREDICATES.identityBoundary.holds(config);
         this.onWarn = onWarn;
-        this.discloseWarn = onWarn ?? ((msg, meta) => console.warn(msg, meta));
+        this.discloseWarn = discloseWarn;
         this.onError = onError;
-        try {
-            this.fileBackend = acquireLocalBackendWithWait(() => new FileStorageBackend({
-                root,
-                ...(config.fileHistory !== undefined ? { fileHistory: config.fileHistory } : {}),
-                onCorruptRead: createDurableAbsenceSeat((msg, fields) => this.discloseWarn(msg, fields), root, "file-history = a rewind boundary or scope read as missing"),
-            }), config.storeLockWaitMs, (fields) => this.onWarn?.("store_dir_lock_wait", { ...fields }));
-        }
-        catch (e) {
-            if (e instanceof AdoptionError)
-                throw e;
-            const tail = buildStoreOpenRefusalTail(e, "http");
-            throw new Error(`DB_BACKEND=local cannot open data dir ${root}: ${e instanceof Error ? e.message : String(e)}` +
-                (tail === undefined ? "" : ` ${tail}`));
-        }
+        this.fileBackend = fileBackend;
+        const root = localBackendRootOf(config);
         const corruptReadWarn = (msg, fields) => this.discloseWarn(msg, fields);
+        this.dataDirLayout = buildDataDirLayout({ configuredRoot: root, physicalRoot: this.fileBackend.root, memoryEngineRoot: memoryEngineRootFor(config, root) });
         this.runStore = new FileRunStore(this.fileBackend.root, {
+            rootRows: () => this.sessionStore,
             error: (msg, fields) => void (this.onError ?? this.onWarn)?.(msg, fields),
             strictHydrate: config.runStoreStrictHydrate,
+            stall: createRunStallWiring(config, observers),
         });
-        this.sessionStore = new LocalSessionStore(createLocalSessionRepo(this.fileBackend.root), this.runStore, this.fileBackend.root, {
+        const physicalRoot = this.fileBackend.root;
+        this.sessionStore = new LocalSessionStore(createLocalSessionRepo(physicalRoot), this.runStore, physicalRoot, {
             log: createLogger(config.logLevel),
             durability: SESSION_DURABILITY,
             placements: SESSION_PLACEMENTS,
+            withdrawCheckpointCtx: (sessionId) => dropLocalCheckpointCtxStrict(physicalRoot, sessionId),
         });
         this.parkDecisionLedgerRoot = config.workflowRunStoreBackend === "memory" ? undefined : join(this.fileBackend.root, "workflows");
         this.resumeAnchorStore = new FileResumeAnchorStore(this.fileBackend.root);
@@ -297,28 +419,69 @@ class LocalBackend {
             : (plane) => fileSessionCaptureRecordStore(plane?.controlDir ?? ownControlDir);
     }
     async ensureSchema() {
+        this.executionLaneWordsRenamed += await this.sessionStore.renameRetiredExecutionLaneWordM40();
         await this.sessionStore.assertStrictSidecarsReadable();
+        await this.sessionStore.finishPendingDrops();
         await this.sessionStore.settleArchiveSnapshots();
+        const adoption = await this.sessionStore.adoptArchiveTokensM47();
+        this.archiveTokensAdopted += adoption.adopted;
+        this.archiveTokensMinted += adoption.minted;
     }
+    executionLaneWordsRenamed = 0;
+    archiveTokensAdopted = 0;
+    archiveTokensMinted = 0;
     async runOneTimeMigrations() {
+        const scenarioPrefixSourcesScanned = await switchLocalScenarioPrefixM42(join(this.fileBackend.root, LOCAL_MARKER_FILE), [
+            { source: "runs", rows: () => this.runStore.scenarioPrefixOwnerRowsM42() },
+            { source: "sessions", rows: () => this.sessionStore.scenarioPrefixOwnerRowsM42() },
+            { source: "approval asks", rows: () => this.approvalAskStore.scenarioPrefixOwnerRowsM42() },
+            { source: "attachments", rows: () => new LocalTaskAttachmentStore(this.fileBackend.root).scenarioPrefixOwnerRowsM42() },
+        ]);
+        tightenLocalDataDirModes(this.dataDirLayout, {
+            tightened: (msg, meta) => this.onWarn?.(msg, meta),
+            refused: (msg, meta) => this.discloseWarn(msg, meta),
+        });
+        const runErrorCodeColumnRewritten = this.runStore.migrateRunErrorCodeColumnM44();
+        const runObjectivePreviewRewritten = this.runStore.migrateRunObjectivePreviewM45();
+        const shellSentinelOwnersCleared = this.identityBoundary ? 0 : (await this.sessionStore.clearShellSentinelOwnersM48()) + this.runStore.clearShellSentinelOwnersM48();
+        const checkpointHostSessionsBackfilled = existsSync(join(this.fileBackend.root, "checkpoint-session-tokens.json")) || existsSync(join(this.fileBackend.root, "checkpoint-scopes.json"))
+            ? await this.checkpointStoreOf().backfillHostSessionsM49()
+            : 0;
+        const legacySkillExemptionsDropped = dropLocalLegacySkillExemptionsM46(join(this.fileBackend.root, LOCAL_LEGACY_SKILL_EXEMPTION_MARKER_FILE), this.approvalExemptionStore);
         const archives = await this.sessionStore.migrateLocalArchives();
         const placements = await backfillLocalExecutionPlacements(this.runStore.sessionIdsWithRuns(), this.sessionStore.executionPlacementBackfill, { lanes: this.executionLanes });
-        const importedLayerRoot = { importedLayerRootAllowsRetired: [], importedLayerRootBucketsSkipped: [] };
+        const importedLayerRoot = { importedLayerRootAllowsRetired: [], importedLayerRootBucketsSkipped: [], importedLayerRootBucketsUnnamed: 0 };
         if (existsSync(join(this.fileBackend.root, FILE_PERMISSION_RULE_DIR))) {
             const rules = this.permissionRule();
             await retireImportedLayerRootAllows({ candidateOwners: () => fileRuleBucketOwners(rules), durable: rules.durable, isWholeBucketRefusal: isFileBucketDamaged, isVanishedBucket: () => false }, importedLayerRoot);
         }
+        const localArchiveTokensAdopted = this.archiveTokensAdopted;
+        const localArchiveTokensMinted = this.archiveTokensMinted;
+        this.archiveTokensAdopted = 0;
+        this.archiveTokensMinted = 0;
+        const executionLaneWordsRenamed = this.executionLaneWordsRenamed + this.approvalAskStore.renameRetiredExecutionLaneWordM40();
+        this.executionLaneWordsRenamed = 0;
+        const askExecutionLanesBackfilled = backfillLocalAskExecutionLanes(this.approvalAskStore, { lanes: this.executionLanes });
         return {
             ...NO_SQL_MIGRATIONS,
+            runErrorCodeColumnRewritten,
+            runObjectivePreviewRewritten,
+            shellSentinelOwnersCleared,
+            checkpointHostSessionsBackfilled,
+            legacySkillExemptionsDropped,
             executionPlacementsBackfilled: placements.backfilled,
             executionPlacementSessionsUnreadable: placements.unreadable,
-            askExecutionLanesBackfilled: backfillLocalAskExecutionLanes(this.approvalAskStore, { lanes: this.executionLanes }),
+            askExecutionLanesBackfilled,
+            executionLaneWordsRenamed,
+            scenarioPrefixSourcesScanned,
             askJournalRecordsUpgraded: this.approvalAskStore.upgradeJournalEnvelope(),
             localArchiveRowFactsBackfilled: archives.rowFactsBackfilled,
             localArchivesAnonymized: archives.anonymized,
             localArchivesKeptStamped: archives.keptStamped,
             localArchivesUnreadable: archives.unreadable,
             localArchiveSnapshotsRecovered: archives.snapshotsRecovered,
+            localArchiveTokensAdopted,
+            localArchiveTokensMinted,
             ...importedLayerRoot,
         };
     }
@@ -363,7 +526,6 @@ class LocalBackend {
         return (this.checkpointStoreInst ??= new LocalCheckpointStore(this.fileBackend.root, {
             getActiveTaskId: (sessionId) => this.runStore.getActiveTaskId(sessionId),
             readSessionOwner: async (sessionId) => (await this.sessionStore.headOf(sessionId))?.owner,
-            claims: this.runStore,
         }));
     }
     checkpoint() {
@@ -371,8 +533,8 @@ class LocalBackend {
         if (!this.checkpointProbeWired) {
             this.checkpointProbeWired = true;
             this.runStore.setCheckpointProbe({
-                hasPending: async (sessionId) => (await cs.findPendingTokenBySession(sessionId)) !== null,
-                hasExpired: (sessionId) => cs.hasExpiredBySession(sessionId),
+                hasPending: async (sessionId) => (await cs.findPendingTokenBySession(sessionId, undefined, { axis: "run" })) !== null,
+                hasExpired: (sessionId) => cs.hasExpiredForRun(sessionId),
             });
         }
         return cs;
@@ -380,7 +542,8 @@ class LocalBackend {
     checkpointReadView() { return this.checkpointStoreOf(); }
     checkpointProbeWired = false;
     checkpointStoreInst;
-    sessionPolicy() { return this.fileBackend.sessionPolicyStore; }
+    sessionPolicy() { return (this.sessionPolicyInst ??= createClientCountedPolicyStore(this.fileBackend.sessionPolicyStore, this.sessionStore)); }
+    sessionPolicyInst;
     fileUsageWindowStore() { return this.fileBackend.usageWindowStore; }
     fileHistory() { return this.fileBackend.fileHistoryStore; }
     memoryOptOutGrant() { return undefined; }
@@ -390,25 +553,109 @@ class LocalBackend {
     outcomeSink() { return this.outcomeSinkInst; }
     session() { return this.sessionStore; }
     toolResult() { return this.fileBackend.toolResultStore; }
+    engineFileStores() {
+        const fb = this.fileBackend;
+        return { checkpointStore: fb.checkpointStore, backgroundAgentStore: fb.backgroundAgentStore, mailboxStore: fb.mailboxStore, rosterStore: fb.rosterStore };
+    }
     mysqlPool() { return undefined; }
     pgPool() { return undefined; }
 }
 export function counterStoreLabel(store, kind) {
     return store ? `shared(${kind ?? "unknown"})` : "in-process";
 }
-export function createStoreBackend(config, onWarn, onError) {
+const LOCAL_OPEN_REFUSAL_HEAD = {
+    http: (root) => `DB_BACKEND=local cannot open data dir ${root}`,
+    "run-local": (root) => `cannot open local data dir ${root}`,
+};
+export function openLocalBackend(config, opts) {
+    const { lane, onWarn, onError, observers } = opts;
+    const root = localBackendRootOf(config);
+    const discloseWarn = onWarn ?? createLogger().warn;
+    let fileBackend;
+    try {
+        fileBackend = acquireLocalBackendWithWait(() => new FileStorageBackend({
+            root,
+            ...(config.fileHistory !== undefined ? { fileHistory: config.fileHistory } : {}),
+            onCorruptRead: createDurableAbsenceSeat(discloseWarn, root, "file-history = a rewind boundary or scope read as missing"),
+        }), config.storeLockWaitMs, (fields) => onWarn?.("store_dir_lock_wait", { ...fields }));
+    }
+    catch (e) {
+        if (e instanceof AdoptionError)
+            throw e;
+        const tail = buildStoreOpenRefusalTail(e, lane);
+        throw new Error(`${LOCAL_OPEN_REFUSAL_HEAD[lane](root)}: ${e instanceof Error ? e.message : String(e)}` +
+            (tail === undefined ? "" : ` ${tail}`));
+    }
+    try {
+        const physicalRoot = fileBackend.root;
+        holdEngineHighWater(physicalRoot, serviceVersion(), (prior) => holdArchiveTokenAdoptionDuty(physicalRoot, prior, archiveTokenAdoptionCarried()));
+    }
+    catch (refusal) {
+        return new RefusedLocalBackend(fileBackend, refusal instanceof Error ? refusal : new Error(String(refusal)));
+    }
+    try {
+        return new LocalBackend(fileBackend, config, discloseWarn, onWarn, onError, observers);
+    }
+    catch (failure) {
+        return new RefusedLocalBackend(fileBackend, failure instanceof Error ? failure : new Error(String(failure)));
+    }
+}
+class RefusedLocalBackend {
+    fileBackend;
+    refusal;
+    kind = "local";
+    constructor(fileBackend, refusal) {
+        this.fileBackend = fileBackend;
+        this.refusal = refusal;
+    }
+    refused() {
+        throw this.refusal;
+    }
+    async ensureSchema() {
+        return this.refused();
+    }
+    async runOneTimeMigrations() {
+        return this.refused();
+    }
+    async close() {
+        await this.fileBackend.dispose();
+    }
+    run() { return this.refused(); }
+    resumeAnchor() { return this.refused(); }
+    approvalExemption() { return this.refused(); }
+    approvalNonce() { return this.refused(); }
+    orgDeliveryQuota() { return this.refused(); }
+    approvalAsk() { return this.refused(); }
+    permissionRule() { return this.refused(); }
+    sendFileLedger() { return this.refused(); }
+    userInputLedger() { return this.refused(); }
+    sessionPolicy() { return this.refused(); }
+    fileHistory() { return this.refused(); }
+    memoryOptOutGrant() { return this.refused(); }
+    sessionCaptureRecords() { return this.refused(); }
+    workflowJournal() { return this.refused(); }
+    outcomeSink() { return this.refused(); }
+    checkpointReadView() { return this.refused(); }
+    session() { return this.refused(); }
+    engineFileStores() { return this.refused(); }
+    toolResult() { return this.refused(); }
+    fileUsageWindowStore() { return this.refused(); }
+    mysqlPool() { return undefined; }
+    pgPool() { return undefined; }
+}
+export function createStoreBackend(config, onWarn, onError, observers) {
     if (config.dbBackend === "local")
-        return new LocalBackend(config.localDataRoot ?? join(homedir(), ".ai-agent"), config, onWarn, onError);
+        return openLocalBackend(config, { lane: "http", onWarn, onError, observers });
     if (config.dbBackend === "pg") {
         if (!config.pg)
             return undefined;
         const pool = createPgPool(pgPoolOptions(config.pg, config.dbQueryTimeoutMs), onWarn);
-        return withRetiredSchemaProbe(new PgBackend(pool, config), { dialect: "pg", pool }, { lanes: deployedExecutionLanes(config) });
+        return withRetiredSchemaProbe(new PgBackend(pool, config, observers), { dialect: "pg", pool }, { lanes: deployedExecutionLanes(config) });
     }
     if (!config.tidb)
         return undefined;
     const pool = createTidbPool(config);
-    return withRetiredSchemaProbe(new TiDBBackend(pool, config), { dialect: "mysql", pool }, { lanes: deployedExecutionLanes(config) });
+    return withRetiredSchemaProbe(new TiDBBackend(pool, config, observers), { dialect: "mysql", pool }, { lanes: deployedExecutionLanes(config) });
 }
 function withRetiredSchemaProbe(inner, target, executionPlacementSwitch) {
     const guarded = Object.create(inner);
@@ -419,16 +666,19 @@ function withRetiredSchemaProbe(inner, target, executionPlacementSwitch) {
     };
     return guarded;
 }
-export async function openStoreBackendWithFallback(config, logger) {
+export function localBackendRootOf(config) {
+    return config.localDataRoot ?? join(homedir(), ".ai-agent");
+}
+export async function openStoreBackendWithFallback(config, logger, observers) {
     const sqlEngine = config.dbBackend === "mysql" || config.dbBackend === "pg" ? config.dbBackend : undefined;
-    const mayFallback = config.dbBackend === "local" && !config.dbBackendExplicit;
+    const mayFallback = config.dbBackend === "local" && !config.dbBackendExplicit && !localDataRootHoldsData(localBackendRootOf(config));
     let backend;
     let inFlight;
     try {
         const attempt = async () => {
             let built;
             try {
-                built = createStoreBackend(config, (msg, meta) => logger.warn(msg, meta), logger.error === undefined ? undefined : (msg, meta) => logger.error(msg, meta));
+                built = createStoreBackend(config, (msg, meta) => logger.warn(msg, meta), logger.error === undefined ? undefined : (msg, meta) => logger.error(msg, meta), observers);
                 inFlight = built;
                 if (built)
                     await built.ensureSchema();
@@ -448,8 +698,6 @@ export async function openStoreBackendWithFallback(config, logger) {
     }
     catch (err) {
         void inFlight?.close().catch(() => undefined);
-        if (err instanceof AdoptionError)
-            throw err;
         if (err instanceof StoreBootRefusalError)
             throw err;
         if (!mayFallback) {
@@ -477,10 +725,15 @@ export function sqlStoreCoordinatesAsUrl(config) {
 export function buildSqlStoreOpenRefusal(engine, endpoint, waitedMs, err) {
     const coords = engine === "pg" ? "PG_*" : "MYSQL_*";
     const detail = err instanceof Error ? err.message : String(err);
+    const definite = isDeploymentFaultError(err);
+    const answer = definite ? databaseAnswerCodesOf(engine, err) : undefined;
     const waited = waitedMs > 0 ? `after retrying for ${waitedMs}ms (STORE_LOCK_WAIT_MS)` : "on the first attempt (STORE_LOCK_WAIT_MS=0: no wait)";
-    return (`DB_BACKEND=${engine}: cannot open the configured ${engine === "pg" ? "PostgreSQL" : "MySQL-protocol"} store at ${endpoint} ${waited} (${detail}) — refusing to boot, because a configured SQL store is never replaced by an in-memory one ` +
+    const next = definite
+        ? `Next: the database refused the statement for good, so waiting or changing the ${coords} coordinates will not change it — fix what the answer names: a table's storage engine (InnoDB on MySQL), its primary key, foreign-key compatibility, a missing table or the account's grants; `
+        : `Next: fix the ${coords} coordinates or the store's reachability (the boot wait is STORE_LOCK_WAIT_MS); `;
+    return (`DB_BACKEND=${engine}: cannot open the configured ${engine === "pg" ? "PostgreSQL" : "MySQL-protocol"} store at ${endpoint} ${waited} (${detail}${answer !== undefined ? `; ${answer}` : ""}) — refusing to boot, because a configured SQL store is never replaced by an in-memory one ` +
         `(SESSION_BACKEND=auto included: sessions, parked runs and every durable record would silently live in memory and vanish on restart). ` +
-        `Next: fix the ${coords} coordinates or the store's reachability (the boot wait is STORE_LOCK_WAIT_MS); ` +
+        next +
         `or run explicitly in memory with DB_BACKEND=memory (and remove the ${coords} coordinates).`);
 }
 //# sourceMappingURL=store-backend.js.map