@sema-agent/server 7.147.0 → 7.149.0

package/dist/plugins/store-backend.js

@@ -2,7 +2,7 @@ import { homedir } from "node:os";
 import { createCorruptReadSeat, createDurableAbsenceSeat } from "../observability/corrupt-read-seat.js";
 import { createLogger } from "../observability/logger.js";
 import { join } from "node:path";
-import { existsSync, readdirSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { AdoptionError, FileStorageBackend } from "@sema-agent/core";
 import { FileWorkflowJournalStore } from "@sema-agent/core";
 import { fileSessionCaptureRecordStore } from "@sema-agent/core";
@@ -12,14 +12,22 @@ import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJo
 import { FileRunStore } from "./file-run-store.js";
 import { LocalWorkflowParkDecisionStore } from "../orchestration/workflow-park-decision.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
+import { databaseAnswerCodesOf, isDeploymentFaultError } from "./sql-errors.js";
 import { buildStoreOpenRefusalTail } from "./store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./store-lock-wait.js";
-import { NO_SQL_MIGRATIONS, assertExecutionPlacementSwitchAdmissibleOnPool, backfillLocalAskExecutionLanes, backfillLocalExecutionPlacements, runSqlOneTimeMigrations } from "./one-time-migrations.js";
+import { NO_SQL_MIGRATIONS, migrationCarried, assertExecutionPlacementSwitchAdmissibleOnPool, backfillLocalAskExecutionLanes, backfillLocalExecutionPlacements, runSqlOneTimeMigrations } from "./one-time-migrations.js";
 import { deployedExecutionLanes } from "../execution-lane-caps.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
+import { LOCAL_MARKER_FILE, switchLocalScenarioPrefixM42 } from "./scenario-prefix-switch-m42.js";
+import { dropLocalLegacySkillExemptionsM46 } from "./approval-exemption-skill-m46.js";
+import { LOCAL_SKILL_EXEMPTION_CUTOFF_FILE, assertSkillExemptionCutoffHeldOnPool } from "./approval-exemption-skill-cutoff.js";
+import { SKILL_EXEMPTION_CUTOFF_ID } from "./one-time-migration-marker.js";
+import { LocalTaskAttachmentStore } from "./local-task-attachment-store.js";
 import { assertRetiredSchemaAbsentOnPool } from "./schema-consistency.js";
 import { LocalSessionStore, createLocalSessionRepo } from "./local-session-store.js";
-import { SESSION_DURABILITY, SESSION_PLACEMENTS } from "./session-placement.js";
-import { LocalCheckpointStore } from "./local-checkpoint-store.js";
+import { localStoreDeclarationOf } from "../local-store-declaration.js";
+import { SESSION_PLACEMENTS } from "./session-placement.js";
+import { LocalCheckpointStore, dropLocalCheckpointCtxStrict } from "./local-checkpoint-store.js";
 import { FileResumeAnchorStore } from "./file-resume-anchor-store.js";
 import { TiDBApprovalExemptionStore, PgApprovalExemptionStore, FileApprovalExemptionStore } from "./approval-exemption-store.js";
 import { TiDBApprovalNonceStore, PgApprovalNonceStore, FileApprovalNonceStore } from "./approval-nonce-store.js";
@@ -33,6 +41,7 @@ import { FileUserInputLedgerStore } from "./user-input-ledger-file.js";
 import { TiDBUserInputLedgerStore, PgUserInputLedgerStore } from "./user-input-ledger-sql.js";
 import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
 import { TiDBSessionPolicyStore, PgSessionPolicyStore } from "../stores-sql/session-policy-store-sql.js";
+import { countClientWriteOn } from "./session-withdraw-sql.js";
 import { TiDBWorkflowJournalStore, PgWorkflowJournalStore } from "../stores-sql/workflow-journal-store-sql.js";
 import { TiDBFileHistoryStore, PgFileHistoryStore, FILE_HISTORY_BLOB_KEY_PREFIX } from "../stores-sql/file-history-store-sql.js";
 import { SqlBlobIndex } from "../stores-sql/blob-index-sql.js";
@@ -59,19 +68,25 @@ import { SqlSessionStore } from "./session-store-sql.js";
 import { TiDBSharedMemoryStore, PgSharedMemoryStore } from "./shared-memory-store-sql.js";
 import { TiDBAdoptionLogStore, PgAdoptionLogStore } from "./adoption-log-sql.js";
 import { SqlRetentionStore } from "../stores-sql/retention-store-sql.js";
+import { SessionDeletionSupersededError } from "../execution-placement.js";
+import { sessionTenantScope } from "../session-children-retire.js";
 import { sqlStoreRetention } from "./retention-declaration.js";
-import { createRetentionDeploymentHooks } from "./retention-deployment.js";
+import { createRetentionDeploymentHooks, createSessionRowsHook, sweepLateCompletionRows } from "./retention-deployment.js";
+import { seatText } from "../trace/exit-seat.js";
 import { createSqlSessionWriteHooks } from "./session-store-sql.js";
 import { TiDBRetentionLaneStore, PgRetentionLaneStore } from "./retention-lane-store-sql.js";
 import { createSqlPermissionRuleStores } from "./permission-rule-store-sql.js";
 import { FILE_PERMISSION_RULE_DIR, createFilePermissionRuleStores, fileRuleBucketOwners, isFileBucketDamaged } from "./permission-rule-store-file.js";
 import { retireImportedLayerRootAllows } from "./imported-layer-root-retirement.js";
 import { buildDataDirLayout, tightenLocalDataDirModes } from "./local-data-dir-modes-m39.js";
-import { holdEngineHighWater } from "./local-engine-high-water.js";
-import { serviceVersion } from "../service-version.js";
+import { admitLocalDataRoot, holdLocalDataRootAdmission } from "./local-data-root-admission.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
-import { storeDegradedReasonFor } from "../store-posture.js";
+import { localDataRootHoldsData, storeDegradedReasonFor } from "../store-posture.js";
 import { openWithinWait } from "./store-open-wait.js";
+export function createRunStallWiring(config, observers) {
+    const count = observers?.runStallVerdicts;
+    return { windowMs: () => config.runStaleSec * 1000, onVerdicts: (landed) => count?.(landed) };
+}
 export function workflowJournalOf(config, backend) {
     return config.selfOrchestrationEnabled && backend ? backend.workflowJournal() : undefined;
 }
@@ -127,14 +142,14 @@ async function legacySweepImpl(config, dialect, pool) {
 }
 export function createSqlRetentionCallHooks(db, opts, input) {
     const deployment = createRetentionDeploymentHooks(db.dialect, opts, input);
-    return { hooks: { retention: deployment.hooks.retention, session: createSqlSessionWriteHooks(db) }, endedSpaces: deployment.endedSpaces };
+    return { hooks: { retention: deployment.hooks.retention, session: createSqlSessionWriteHooks(db) }, attachmentShas: deployment.attachmentShas };
 }
 export function createSqlRetentionExecutor(db, opts) {
-    const logged = opts.logger !== undefined ? { logger: opts.logger } : {};
-    const reads = new SqlRetentionStore(db, logged);
+    const storeOpts = { ...(opts.mailboxTables ? { sessionBoxScope: sessionTenantScope } : {}), ...(opts.logger !== undefined ? { logger: opts.logger } : {}) };
+    const reads = new SqlRetentionStore(db, storeOpts);
     const forCall = (input) => {
         const hooks = createSqlRetentionCallHooks(db, opts, input);
-        return { store: new SqlRetentionStore(db, { ...logged, transactionHooks: hooks.hooks }), hooks, call: { domain: input.domain, cutoffMs: input.cutoffMs } };
+        return { store: new SqlRetentionStore(db, { ...storeOpts, transactionHooks: hooks.hooks }), hooks, call: { domain: input.domain, cutoffMs: input.cutoffMs } };
     };
     return {
         retention: reads.retention,
@@ -146,9 +161,11 @@ export function createSqlRetentionExecutor(db, opts) {
         },
         deleteExpiredSessions: async (input) => {
             const one = forCall(input);
-            const receipt = await one.store.deleteExpiredSessions(one.call);
-            const endedSpaces = one.hooks.endedSpaces();
-            return endedSpaces.length > 0 ? { ...receipt, endedSpaces } : receipt;
+            const { erasedRows, ...receipt } = await one.store.deleteExpiredSessions(one.call);
+            if (erasedRows === undefined)
+                return receipt;
+            await afterSessionErase(db, opts, erasedRows.sessions);
+            return { ...receipt, erased: { ...erasedRows, attachmentShas: one.hooks.attachmentShas() } };
         },
         deleteOrphanToolResults: async (input) => {
             const one = forCall(input);
@@ -156,27 +173,72 @@ export function createSqlRetentionExecutor(db, opts) {
         },
     };
 }
+async function afterSessionErase(db, opts, sessions) {
+    if (!opts.completionInbox || sessions.length === 0)
+        return;
+    await sweepLateCompletionRows(db, db.dialect, sessions, Date.now()).catch((err) => opts.logger?.warn?.("workflow_completion_late_rows_sweep_failed", { sessions: sessions.length, err: seatText("operator-log-text", String(err)) }));
+}
+export function createSqlSessionEraser(db, opts) {
+    const storeOpts = { ...(opts.mailboxTables ? { sessionBoxScope: sessionTenantScope } : {}), ...(opts.logger !== undefined ? { logger: opts.logger } : {}) };
+    return {
+        async erase(input) {
+            const rows = createSessionRowsHook(db.dialect, opts, input.owner ?? "");
+            const store = new SqlRetentionStore(db, { ...storeOpts, transactionHooks: { retention: { beforeDelete: rows.beforeDelete }, session: createSqlSessionWriteHooks(db) } });
+            const out = await store.eraseSession(input);
+            switch (out.outcome) {
+                case "absent":
+                    return { outcome: "superseded" };
+                case "refused":
+                    if (out.refusal instanceof SessionDeletionSupersededError)
+                        return { outcome: "superseded" };
+                    throw out.refusal;
+                case "erased":
+                    await afterSessionErase(db, opts, out.rows.sessions);
+                    return { outcome: "erased", trees: { ...out.rows, attachmentShas: rows.attachmentShas() } };
+                default: {
+                    const unknown = out;
+                    throw new Error(`session erase: no arm for ${JSON.stringify(unknown)}`);
+                }
+            }
+        },
+    };
+}
 export function assertCloudSnapshotBlobPosture(kind, config) {
     if (kind === "local" || config.snapshotBlobStore || config.snapshotBlobAllowSql)
         return;
+    const fact = SQL_BLOB_POSTURE_FACTS[kind];
     throw new Error("cloud deployments (DB_BACKEND=mysql|pg) must configure object storage for rewind file-history blobs " +
-        "(MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY): single-row SQL blob writes hit TiDB's " +
-        "txn-entry-size-limit (default 6MiB) / the mysql-protocol packet limit (bytes belong in object storage — " +
+        `(MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY): ${fact.wall} (bytes belong in object storage — ` +
         "same ruling as the D-1 attachment store). Single-box/test rigs may explicitly opt out with " +
-        "SNAPSHOT_BLOB_ALLOW_SQL_BYTES=true (a per-blob cap then applies; an over-cap tracked file's first-touch " +
+        `SNAPSHOT_BLOB_ALLOW_SQL_BYTES=true (${fact.cap}; an over-cap tracked file's first-touch ` +
         "backup is refused typed, which under the default DV-14 policy refuses that edit).");
 }
+const SQL_BLOB_POSTURE_FACTS = {
+    mysql: {
+        wall: "single-row SQL blob writes hit TiDB's txn-entry-size-limit (default 6MiB) / the mysql-protocol packet limit",
+        cap: "a per-blob cap then applies",
+    },
+    pg: {
+        wall: "single-row SQL blob writes put each blob into one PostgreSQL bytea value (PostgreSQL holds at most 1 GB in one value; this service reads no row-size or statement-size wall from PostgreSQL, so it derives no smaller default cap)",
+        cap: "this service derives no per-blob cap on PostgreSQL, so none applies unless SNAPSHOT_BLOB_SQL_MAX_BYTES is set — then a per-blob cap applies",
+    },
+};
+export function buildSqlOneTimeMigrationInput(config) {
+    return { lanes: deployedExecutionLanes(config), liveRunWindowMs: config.runStaleSec * 1000, identityBoundary: DEPLOYMENT_SHAPE_PREDICATES.identityBoundary.holds(config) };
+}
 class TiDBBackend {
     pool;
     config;
+    observers;
     kind = "mysql";
-    constructor(pool, config) {
+    constructor(pool, config, observers) {
         this.pool = pool;
         this.config = config;
+        this.observers = observers;
     }
     ensureSchema() { return ensureTidbSchema(this.pool); }
     close() { return this.pool.end(); }
-    run() { return (this.runStoreInst ??= new TiDBRunStore(this.pool)); }
+    run() { return (this.runStoreInst ??= new TiDBRunStore(this.pool, createRunStallWiring(this.config, this.observers))); }
     runStoreInst;
     resumeAnchor() { return new TiDBResumeAnchorStore(this.pool); }
     approvalExemption() { return new TiDBApprovalExemptionStore(this.pool); }
@@ -186,13 +248,13 @@ class TiDBBackend {
     permissionRule() { return createSqlPermissionRuleStores(mysqlDriver(this.pool)); }
     sendFileLedger() { return new TiDBSendFileLedger(this.pool); }
     userInputLedger() { return new TiDBUserInputLedgerStore(this.pool); }
-    sessionPolicy(logger) { return new TiDBSessionPolicyStore(this.pool, logger); }
+    sessionPolicy(logger) { return new TiDBSessionPolicyStore(this.pool, countClientWriteOn, logger ?? createLogger()); }
     fileHistory() { return new TiDBFileHistoryStore(this.pool, fileHistoryOptions(this.config)); }
     memoryOptOutGrant() { return new TiDBMemoryOptOutGrantStore(this.pool); }
     sessionCaptureRecords() { return () => (this.captureRecordsInst ??= new TiDBSessionCaptureRecordStore(this.pool)); }
     captureRecordsInst;
     legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "mysql", this.pool); }
-    runOneTimeMigrations() { return runSqlOneTimeMigrations("mysql", this.pool, { lanes: deployedExecutionLanes(this.config), liveRunWindowMs: this.config.runStaleSec * 1000 }); }
+    runOneTimeMigrations() { return runSqlOneTimeMigrations("mysql", this.pool, buildSqlOneTimeMigrationInput(this.config)); }
     workflowJournal() { return new TiDBWorkflowJournalStore(this.pool); }
     outcomeSink() { return new TiDBOutcomeLedger(this.pool); }
     workflowRun(onWarn) { return new TiDBWorkflowRunStore(this.pool, onWarn); }
@@ -202,7 +264,7 @@ class TiDBBackend {
     workflowParkDecisions() { return (this.parkDecisionsInst ??= new SqlWorkflowParkDecisionStore(this.run())); }
     parkDecisionsInst;
     sharedMemoryStore(authorizer) { return new TiDBSharedMemoryStore(this.pool, authorizer); }
-    checkpoint(logger) { return new TiDBCheckpointStore(this.pool, logger, { retention: sqlStoreRetention(this.config.retentionSweep), claims: this.run() }); }
+    checkpoint(logger) { return new TiDBCheckpointStore(this.pool, logger, { retention: sqlStoreRetention(this.config.retentionSweep) }); }
     checkpointReadView() { return this.checkpoint(); }
     toolResult() { return new TiDBToolResultStore(this.pool, { retention: sqlStoreRetention(this.config.retentionSweep) }); }
     imageIndex() { return new TiDBImageIndex(this.pool); }
@@ -210,6 +272,7 @@ class TiDBBackend {
     leaderRun() { return new TiDBLeaderRunStore(this.pool); }
     device() { return new TiDBDeviceStore(this.pool); }
     retention(opts) { return createSqlRetentionExecutor(mysqlDriver(this.pool), opts); }
+    sessionEraser(opts) { return createSqlSessionEraser(mysqlDriver(this.pool), opts); }
     retentionLane() { return new TiDBRetentionLaneStore(this.pool); }
     breaker(onWriteFail) { return new TiDBBreakerState(this.pool, onWriteFail); }
     costQuota(limitMicroUsd, windowMs, onDegraded) { return new TiDBCostQuota(this.pool, limitMicroUsd, windowMs, undefined, onDegraded, this.config.dbQueryTimeoutMs); }
@@ -223,14 +286,16 @@ class TiDBBackend {
 class PgBackend {
     pool;
     config;
+    observers;
     kind = "pg";
-    constructor(pool, config) {
+    constructor(pool, config, observers) {
         this.pool = pool;
         this.config = config;
+        this.observers = observers;
     }
     ensureSchema() { return ensurePgSchema(this.pool); }
     close() { return this.pool.end(); }
-    run() { return (this.runStoreInst ??= new PgRunStore(this.pool)); }
+    run() { return (this.runStoreInst ??= new PgRunStore(this.pool, createRunStallWiring(this.config, this.observers))); }
     runStoreInst;
     resumeAnchor() { return new PgResumeAnchorStore(this.pool); }
     approvalExemption() { return new PgApprovalExemptionStore(this.pool); }
@@ -240,13 +305,13 @@ class PgBackend {
     permissionRule() { return createSqlPermissionRuleStores(pgDriver(this.pool)); }
     sendFileLedger() { return new PgSendFileLedger(this.pool); }
     userInputLedger() { return new PgUserInputLedgerStore(this.pool); }
-    sessionPolicy(logger) { return new PgSessionPolicyStore(this.pool, logger); }
+    sessionPolicy(logger) { return new PgSessionPolicyStore(this.pool, countClientWriteOn, logger ?? createLogger()); }
     fileHistory() { return new PgFileHistoryStore(this.pool, fileHistoryOptions(this.config)); }
     memoryOptOutGrant() { return new PgMemoryOptOutGrantStore(this.pool); }
     sessionCaptureRecords() { return () => (this.captureRecordsInst ??= new PgSessionCaptureRecordStore(this.pool)); }
     captureRecordsInst;
     legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "pg", this.pool); }
-    runOneTimeMigrations() { return runSqlOneTimeMigrations("pg", this.pool, { lanes: deployedExecutionLanes(this.config), liveRunWindowMs: this.config.runStaleSec * 1000 }); }
+    runOneTimeMigrations() { return runSqlOneTimeMigrations("pg", this.pool, buildSqlOneTimeMigrationInput(this.config)); }
     workflowJournal() { return new PgWorkflowJournalStore(this.pool); }
     outcomeSink() { return new PgOutcomeLedger(this.pool); }
     workflowRun(onWarn) { return new PgWorkflowRunStore(this.pool, onWarn); }
@@ -256,7 +321,7 @@ class PgBackend {
     workflowParkDecisions() { return (this.parkDecisionsInst ??= new SqlWorkflowParkDecisionStore(this.run())); }
     parkDecisionsInst;
     sharedMemoryStore(authorizer) { return new PgSharedMemoryStore(this.pool, authorizer); }
-    checkpoint(logger) { return new PgCheckpointStore(this.pool, logger, { retention: sqlStoreRetention(this.config.retentionSweep), claims: this.run() }); }
+    checkpoint(logger) { return new PgCheckpointStore(this.pool, logger, { retention: sqlStoreRetention(this.config.retentionSweep) }); }
     checkpointReadView() { return this.checkpoint(); }
     toolResult() { return new PgToolResultStore(this.pool, { retention: sqlStoreRetention(this.config.retentionSweep) }); }
     imageIndex() { return new PgImageIndex(this.pool); }
@@ -264,6 +329,7 @@ class PgBackend {
     leaderRun() { return new PgLeaderRunStore(this.pool); }
     device() { return new PgDeviceStore(this.pool); }
     retention(opts) { return createSqlRetentionExecutor(pgDriver(this.pool), opts); }
+    sessionEraser(opts) { return createSqlSessionEraser(pgDriver(this.pool), opts); }
     retentionLane() { return new PgRetentionLaneStore(this.pool); }
     breaker(onWriteFail) { return new PgBreakerState(this.pool, onWriteFail); }
     costQuota(limitMicroUsd, windowMs, onDegraded) { return new PgCostQuota(this.pool, limitMicroUsd, windowMs, undefined, onDegraded, this.config.dbQueryTimeoutMs); }
@@ -277,6 +343,22 @@ class PgBackend {
 export function localSessionRowsOf(backend) {
     return backend instanceof LocalBackend ? backend.session() : undefined;
 }
+export function localClientWritesOf(backend) {
+    return backend instanceof LocalBackend ? backend.session() : undefined;
+}
+function createClientCountedPolicyStore(inner, sessions) {
+    const listBySession = inner.listBySession?.bind(inner);
+    const deleteBySession = inner.deleteBySession?.bind(inner);
+    return {
+        getRules: (sessionId, principal) => inner.getRules(sessionId, principal),
+        putRules: (sessionId, principal, rules, opts) => sessions.withClientWrite(sessionId, async (count) => {
+            await count();
+            return inner.putRules(sessionId, principal, rules, opts);
+        }),
+        ...(listBySession !== undefined ? { listBySession } : {}),
+        ...(deleteBySession !== undefined ? { deleteBySession } : {}),
+    };
+}
 class LocalBackend {
     kind = "local";
     fileBackend;
@@ -296,9 +378,13 @@ class LocalBackend {
     discloseWarn;
     parkDecisionLedgerRoot;
     executionLanes;
+    identityBoundary;
+    storeDeclaration;
     dataDirLayout;
-    constructor(fileBackend, config, discloseWarn, onWarn, onError) {
+    constructor(fileBackend, config, discloseWarn, onWarn, onError, observers, facts) {
         this.executionLanes = deployedExecutionLanes(config);
+        this.identityBoundary = DEPLOYMENT_SHAPE_PREDICATES.identityBoundary.holds(config);
+        this.storeDeclaration = localStoreDeclarationOf(config, facts?.dataRootMedium ?? "unknown");
         this.onWarn = onWarn;
         this.discloseWarn = discloseWarn;
         this.onError = onError;
@@ -307,13 +393,17 @@ class LocalBackend {
         const corruptReadWarn = (msg, fields) => this.discloseWarn(msg, fields);
         this.dataDirLayout = buildDataDirLayout({ configuredRoot: root, physicalRoot: this.fileBackend.root, memoryEngineRoot: memoryEngineRootFor(config, root) });
         this.runStore = new FileRunStore(this.fileBackend.root, {
+            rootRows: () => this.sessionStore,
             error: (msg, fields) => void (this.onError ?? this.onWarn)?.(msg, fields),
             strictHydrate: config.runStoreStrictHydrate,
+            stall: createRunStallWiring(config, observers),
         });
-        this.sessionStore = new LocalSessionStore(createLocalSessionRepo(this.fileBackend.root), this.runStore, this.fileBackend.root, {
+        const physicalRoot = this.fileBackend.root;
+        this.sessionStore = new LocalSessionStore(createLocalSessionRepo(physicalRoot), this.runStore, physicalRoot, {
             log: createLogger(config.logLevel),
-            durability: SESSION_DURABILITY,
+            durability: this.storeDeclaration.durability,
             placements: SESSION_PLACEMENTS,
+            withdrawCheckpointCtx: (sessionId) => dropLocalCheckpointCtxStrict(physicalRoot, sessionId),
         });
         this.parkDecisionLedgerRoot = config.workflowRunStoreBackend === "memory" ? undefined : join(this.fileBackend.root, "workflows");
         this.resumeAnchorStore = new FileResumeAnchorStore(this.fileBackend.root);
@@ -334,15 +424,46 @@ class LocalBackend {
     }
     async ensureSchema() {
         this.executionLaneWordsRenamed += await this.sessionStore.renameRetiredExecutionLaneWordM40();
-        await this.sessionStore.assertStrictSidecarsReadable();
+        await this.sessionStore.finishPendingDrops();
         await this.sessionStore.settleArchiveSnapshots();
+        const adoption = await this.sessionStore.adoptArchiveTokensM47();
+        this.archiveTokensAdopted += adoption.adopted;
+        this.archiveTokensMinted += adoption.minted;
     }
     executionLaneWordsRenamed = 0;
+    archiveTokensAdopted = 0;
+    archiveTokensMinted = 0;
     async runOneTimeMigrations() {
+        const scenarioPrefixSourcesScanned = await switchLocalScenarioPrefixM42(join(this.fileBackend.root, LOCAL_MARKER_FILE), [
+            { source: "runs", rows: () => this.runStore.scenarioPrefixOwnerRowsM42() },
+            { source: "sessions", rows: () => this.sessionStore.scenarioPrefixOwnerRowsM42() },
+            { source: "approval asks", rows: () => this.approvalAskStore.scenarioPrefixOwnerRowsM42() },
+            { source: "attachments", rows: () => new LocalTaskAttachmentStore(this.fileBackend.root).scenarioPrefixOwnerRowsM42() },
+        ]);
         tightenLocalDataDirModes(this.dataDirLayout, {
             tightened: (msg, meta) => this.onWarn?.(msg, meta),
             refused: (msg, meta) => this.discloseWarn(msg, meta),
         });
+        const runErrorCodeColumnRewritten = this.runStore.migrateRunErrorCodeColumnM44();
+        const runObjectivePreviewRewritten = this.runStore.migrateRunObjectivePreviewM45();
+        const shellSentinelOwnerRowsRetained = [];
+        let shellSentinelOwnersCleared = 0;
+        if (this.identityBoundary) {
+            for (const [surface, rows] of [
+                ["session_meta", await this.sessionStore.countShellSentinelOwnersM48()],
+                ["task_run", this.runStore.countShellSentinelOwnersM48()],
+            ]) {
+                if (rows > 0)
+                    shellSentinelOwnerRowsRetained.push({ surface, rows });
+            }
+        }
+        else {
+            shellSentinelOwnersCleared = (await this.sessionStore.clearShellSentinelOwnersM48()) + this.runStore.clearShellSentinelOwnersM48();
+        }
+        const checkpointHostSessionsBackfilled = existsSync(join(this.fileBackend.root, "checkpoint-session-tokens.json")) || existsSync(join(this.fileBackend.root, "checkpoint-scopes.json"))
+            ? await this.checkpointStoreOf().backfillHostSessionsM49()
+            : 0;
+        const legacySkillExemptionsDropped = dropLocalLegacySkillExemptionsM46(join(this.fileBackend.root, LOCAL_SKILL_EXEMPTION_CUTOFF_FILE), this.approvalExemptionStore);
         const archives = await this.sessionStore.migrateLocalArchives();
         const placements = await backfillLocalExecutionPlacements(this.runStore.sessionIdsWithRuns(), this.sessionStore.executionPlacementBackfill, { lanes: this.executionLanes });
         const importedLayerRoot = { importedLayerRootAllowsRetired: [], importedLayerRootBucketsSkipped: [], importedLayerRootBucketsUnnamed: 0 };
@@ -350,21 +471,34 @@ class LocalBackend {
             const rules = this.permissionRule();
             await retireImportedLayerRootAllows({ candidateOwners: () => fileRuleBucketOwners(rules), durable: rules.durable, isWholeBucketRefusal: isFileBucketDamaged, isVanishedBucket: () => false }, importedLayerRoot);
         }
+        const localArchiveTokensAdopted = this.archiveTokensAdopted;
+        const localArchiveTokensMinted = this.archiveTokensMinted;
+        this.archiveTokensAdopted = 0;
+        this.archiveTokensMinted = 0;
         const executionLaneWordsRenamed = this.executionLaneWordsRenamed + this.approvalAskStore.renameRetiredExecutionLaneWordM40();
         this.executionLaneWordsRenamed = 0;
         const askExecutionLanesBackfilled = backfillLocalAskExecutionLanes(this.approvalAskStore, { lanes: this.executionLanes });
         return {
             ...NO_SQL_MIGRATIONS,
+            runErrorCodeColumnRewritten,
+            runObjectivePreviewRewritten,
+            shellSentinelOwnersCleared,
+            shellSentinelOwnerRowsRetained,
+            checkpointHostSessionsBackfilled,
+            legacySkillExemptionsDropped,
             executionPlacementsBackfilled: placements.backfilled,
             executionPlacementSessionsUnreadable: placements.unreadable,
             askExecutionLanesBackfilled,
             executionLaneWordsRenamed,
+            scenarioPrefixSourcesScanned,
             askJournalRecordsUpgraded: this.approvalAskStore.upgradeJournalEnvelope(),
             localArchiveRowFactsBackfilled: archives.rowFactsBackfilled,
             localArchivesAnonymized: archives.anonymized,
             localArchivesKeptStamped: archives.keptStamped,
             localArchivesUnreadable: archives.unreadable,
             localArchiveSnapshotsRecovered: archives.snapshotsRecovered,
+            localArchiveTokensAdopted,
+            localArchiveTokensMinted,
             ...importedLayerRoot,
         };
     }
@@ -407,9 +541,9 @@ class LocalBackend {
     userInputLedger() { return this.userInputLedgerStore; }
     checkpointStoreOf() {
         return (this.checkpointStoreInst ??= new LocalCheckpointStore(this.fileBackend.root, {
+            durability: this.storeDeclaration.durability,
             getActiveTaskId: (sessionId) => this.runStore.getActiveTaskId(sessionId),
             readSessionOwner: async (sessionId) => (await this.sessionStore.headOf(sessionId))?.owner,
-            claims: this.runStore,
         }));
     }
     checkpoint() {
@@ -417,8 +551,8 @@ class LocalBackend {
         if (!this.checkpointProbeWired) {
             this.checkpointProbeWired = true;
             this.runStore.setCheckpointProbe({
-                hasPending: async (sessionId) => (await cs.findPendingTokenBySession(sessionId)) !== null,
-                hasExpired: (sessionId) => cs.hasExpiredBySession(sessionId),
+                hasPending: async (sessionId) => (await cs.findPendingTokenBySession(sessionId, undefined, { axis: "run" })) !== null,
+                hasExpired: (sessionId) => cs.hasExpiredForRun(sessionId),
             });
         }
         return cs;
@@ -426,7 +560,9 @@ class LocalBackend {
     checkpointReadView() { return this.checkpointStoreOf(); }
     checkpointProbeWired = false;
     checkpointStoreInst;
-    sessionPolicy() { return this.fileBackend.sessionPolicyStore; }
+    sessionPolicy() { return (this.sessionPolicyInst ??= createClientCountedPolicyStore(this.fileBackend.sessionPolicyStore, this.sessionStore)); }
+    sessionPolicyInst;
+    localStoreDeclaration() { return this.storeDeclaration; }
     fileUsageWindowStore() { return this.fileBackend.usageWindowStore; }
     fileHistory() { return this.fileBackend.fileHistoryStore; }
     memoryOptOutGrant() { return undefined; }
@@ -436,15 +572,24 @@ class LocalBackend {
     outcomeSink() { return this.outcomeSinkInst; }
     session() { return this.sessionStore; }
     toolResult() { return this.fileBackend.toolResultStore; }
+    engineFileStores() {
+        const fb = this.fileBackend;
+        return { checkpointStore: fb.checkpointStore, backgroundAgentStore: fb.backgroundAgentStore, mailboxStore: fb.mailboxStore, rosterStore: fb.rosterStore };
+    }
     mysqlPool() { return undefined; }
     pgPool() { return undefined; }
 }
 export function counterStoreLabel(store, kind) {
     return store ? `shared(${kind ?? "unknown"})` : "in-process";
 }
-function openLocalBackend(config, onWarn, onError) {
+const LOCAL_OPEN_REFUSAL_HEAD = {
+    http: (root) => `DB_BACKEND=local cannot open data dir ${root}`,
+    "run-local": (root) => `cannot open local data dir ${root}`,
+};
+export function openLocalBackend(config, opts) {
+    const { lane, admission, onWarn, onError, observers, facts } = opts;
     const root = localBackendRootOf(config);
-    const discloseWarn = onWarn ?? ((msg, meta) => console.warn(msg, meta));
+    const discloseWarn = onWarn ?? createLogger().warn;
     let fileBackend;
     try {
         fileBackend = acquireLocalBackendWithWait(() => new FileStorageBackend({
@@ -456,24 +601,29 @@ function openLocalBackend(config, onWarn, onError) {
     catch (e) {
         if (e instanceof AdoptionError)
             throw e;
-        const tail = buildStoreOpenRefusalTail(e, "http");
-        throw new Error(`DB_BACKEND=local cannot open data dir ${root}: ${e instanceof Error ? e.message : String(e)}` +
+        const tail = buildStoreOpenRefusalTail(e, lane);
+        throw new Error(`${LOCAL_OPEN_REFUSAL_HEAD[lane](root)}: ${e instanceof Error ? e.message : String(e)}` +
             (tail === undefined ? "" : ` ${tail}`));
     }
     try {
-        holdEngineHighWater(fileBackend.root, serviceVersion());
+        holdLocalDataRootAdmission(fileBackend.root, admission);
     }
     catch (refusal) {
-        return new RefusedLocalBackend(fileBackend, refusal instanceof Error ? refusal : new Error(String(refusal)));
+        return new RefusedLocalBackend(() => fileBackend.dispose(), refusal instanceof Error ? refusal : new Error(String(refusal)));
+    }
+    try {
+        return new LocalBackend(fileBackend, config, discloseWarn, onWarn, onError, observers, facts);
+    }
+    catch (failure) {
+        return new RefusedLocalBackend(() => fileBackend.dispose(), failure instanceof Error ? failure : new Error(String(failure)));
     }
-    return new LocalBackend(fileBackend, config, discloseWarn, onWarn, onError);
 }
 class RefusedLocalBackend {
-    fileBackend;
+    release;
     refusal;
     kind = "local";
-    constructor(fileBackend, refusal) {
-        this.fileBackend = fileBackend;
+    constructor(release, refusal) {
+        this.release = release;
         this.refusal = refusal;
     }
     refused() {
@@ -486,7 +636,7 @@ class RefusedLocalBackend {
         return this.refused();
     }
     async close() {
-        await this.fileBackend.dispose();
+        await this.release();
     }
     run() { return this.refused(); }
     resumeAnchor() { return this.refused(); }
@@ -505,45 +655,53 @@ class RefusedLocalBackend {
     outcomeSink() { return this.refused(); }
     checkpointReadView() { return this.refused(); }
     session() { return this.refused(); }
+    engineFileStores() { return this.refused(); }
+    toolResult() { return this.refused(); }
+    fileUsageWindowStore() { return this.refused(); }
+    localStoreDeclaration() { return this.refused(); }
     mysqlPool() { return undefined; }
     pgPool() { return undefined; }
 }
-export function createStoreBackend(config, onWarn, onError) {
+export function createStoreBackend(config, onWarn, onError, observers) {
     if (config.dbBackend === "local")
-        return openLocalBackend(config, onWarn, onError);
+        return openAdmittedLocalBackend(config, undefined, { onWarn, onError, observers });
     if (config.dbBackend === "pg") {
         if (!config.pg)
             return undefined;
         const pool = createPgPool(pgPoolOptions(config.pg, config.dbQueryTimeoutMs), onWarn);
-        return withRetiredSchemaProbe(new PgBackend(pool, config), { dialect: "pg", pool }, { lanes: deployedExecutionLanes(config) });
+        return withRetiredSchemaProbe(new PgBackend(pool, config, observers), { dialect: "pg", pool }, { lanes: deployedExecutionLanes(config) });
     }
     if (!config.tidb)
         return undefined;
     const pool = createTidbPool(config);
-    return withRetiredSchemaProbe(new TiDBBackend(pool, config), { dialect: "mysql", pool }, { lanes: deployedExecutionLanes(config) });
+    return withRetiredSchemaProbe(new TiDBBackend(pool, config, observers), { dialect: "mysql", pool }, { lanes: deployedExecutionLanes(config) });
+}
+function openAdmittedLocalBackend(config, admission, sinks) {
+    let admitted = admission;
+    if (admitted === undefined) {
+        try {
+            admitted = admitLocalDataRoot(localBackendRootOf(config));
+        }
+        catch (refusal) {
+            return new RefusedLocalBackend(async () => undefined, refusal instanceof Error ? refusal : new Error(String(refusal)));
+        }
+    }
+    return openLocalBackend(config, { lane: "http", admission: admitted, ...sinks });
 }
 function withRetiredSchemaProbe(inner, target, executionPlacementSwitch) {
     const guarded = Object.create(inner);
     guarded.ensureSchema = async () => {
         await assertRetiredSchemaAbsentOnPool(target);
         await assertExecutionPlacementSwitchAdmissibleOnPool(target.dialect, target.pool, executionPlacementSwitch);
+        await assertSkillExemptionCutoffHeldOnPool(target, migrationCarried(SKILL_EXEMPTION_CUTOFF_ID));
         await inner.ensureSchema();
     };
     return guarded;
 }
-function localBackendRootOf(config) {
+export function localBackendRootOf(config) {
     return config.localDataRoot ?? join(homedir(), ".ai-agent");
 }
-function localDataRootHoldsData(root) {
-    try {
-        return readdirSync(root).length > 0;
-    }
-    catch (e) {
-        const code = e.code;
-        return code !== "ENOENT" && code !== "ENOTDIR";
-    }
-}
-export async function openStoreBackendWithFallback(config, logger) {
+export async function openStoreBackendWithFallback(config, logger, observers, localAdmission, facts) {
     const sqlEngine = config.dbBackend === "mysql" || config.dbBackend === "pg" ? config.dbBackend : undefined;
     const mayFallback = config.dbBackend === "local" && !config.dbBackendExplicit && !localDataRootHoldsData(localBackendRootOf(config));
     let backend;
@@ -552,7 +710,9 @@ export async function openStoreBackendWithFallback(config, logger) {
         const attempt = async () => {
             let built;
             try {
-                built = createStoreBackend(config, (msg, meta) => logger.warn(msg, meta), logger.error === undefined ? undefined : (msg, meta) => logger.error(msg, meta));
+                const onWarn = (msg, meta) => logger.warn(msg, meta);
+                const onError = logger.error === undefined ? undefined : (msg, meta) => logger.error(msg, meta);
+                built = config.dbBackend === "local" ? openAdmittedLocalBackend(config, localAdmission, { onWarn, onError, observers, ...(facts !== undefined ? { facts } : {}) }) : createStoreBackend(config, onWarn, onError, observers);
                 inFlight = built;
                 if (built)
                     await built.ensureSchema();
@@ -599,10 +759,15 @@ export function sqlStoreCoordinatesAsUrl(config) {
 export function buildSqlStoreOpenRefusal(engine, endpoint, waitedMs, err) {
     const coords = engine === "pg" ? "PG_*" : "MYSQL_*";
     const detail = err instanceof Error ? err.message : String(err);
+    const definite = isDeploymentFaultError(err);
+    const answer = definite ? databaseAnswerCodesOf(engine, err) : undefined;
     const waited = waitedMs > 0 ? `after retrying for ${waitedMs}ms (STORE_LOCK_WAIT_MS)` : "on the first attempt (STORE_LOCK_WAIT_MS=0: no wait)";
-    return (`DB_BACKEND=${engine}: cannot open the configured ${engine === "pg" ? "PostgreSQL" : "MySQL-protocol"} store at ${endpoint} ${waited} (${detail}) — refusing to boot, because a configured SQL store is never replaced by an in-memory one ` +
+    const next = definite
+        ? `Next: the database refused the statement for good, so waiting or changing the ${coords} coordinates will not change it — fix what the answer names: a table's storage engine (InnoDB on MySQL), its primary key, foreign-key compatibility, a missing table or the account's grants; `
+        : `Next: fix the ${coords} coordinates or the store's reachability (the boot wait is STORE_LOCK_WAIT_MS); `;
+    return (`DB_BACKEND=${engine}: cannot open the configured ${engine === "pg" ? "PostgreSQL" : "MySQL-protocol"} store at ${endpoint} ${waited} (${detail}${answer !== undefined ? `; ${answer}` : ""}) — refusing to boot, because a configured SQL store is never replaced by an in-memory one ` +
         `(SESSION_BACKEND=auto included: sessions, parked runs and every durable record would silently live in memory and vanish on restart). ` +
-        `Next: fix the ${coords} coordinates or the store's reachability (the boot wait is STORE_LOCK_WAIT_MS); ` +
+        next +
         `or run explicitly in memory with DB_BACKEND=memory (and remove the ${coords} coordinates).`);
 }
 //# sourceMappingURL=store-backend.js.map