@sema-agent/server 7.150.0 → 7.152.0

package/dist/plugins/store-boundary.js

@@ -0,0 +1,139 @@
+import { storeBoundaryFault } from "../terminal.js";
+export const BOOT_METHOD_NAMES = new Set(["ensureSchema", "runOneTimeMigrations", "close", "mysqlPool", "pgPool"]);
+export const SEALED_STORE_MEMBER = Symbol("sema.sealedStoreMember");
+const SEALS = new Map();
+export function storeSealRecords() {
+    return [...SEALS.values()];
+}
+const STORE_WORD = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+export function sealStoreClass(ctor, store, plan) {
+    assertStoreWord(store);
+    const proto = ctor.prototype;
+    if (SEALS.has(`class:${store}`))
+        throw new Error(`store-boundary: store word ${store} is already sealed — every sealed producer has its own word`);
+    for (const key of Reflect.ownKeys(plan)) {
+        const word = plan[key];
+        assertWord(store, key, word);
+        if (word !== "exit")
+            continue;
+        const own = Object.getOwnPropertyDescriptor(proto, key);
+        if (own !== undefined) {
+            if (typeof own.value !== "function")
+                throw new Error(`store-boundary: ${store}.${String(key)} is not a method on ${ctor.name}.prototype (an accessor or a field cannot be sealed in place)`);
+            assertNotGenerator(store, key, own.value);
+            Object.defineProperty(proto, key, { ...own, value: sealedMember(own.value, `${store}.${String(key)}`) });
+            continue;
+        }
+        const inherited = proto[key];
+        if (typeof inherited !== "function")
+            throw new Error(`store-boundary: ${store}.${String(key)} is not a method reachable from ${ctor.name}.prototype`);
+        if (inherited[SEALED_STORE_MEMBER] === undefined) {
+            throw new Error(`store-boundary: ${store}.${String(key)} is inherited by ${ctor.name} from an unsealed base — seal the base class first`);
+        }
+    }
+    SEALS.set(`class:${store}`, { store, kind: "class", name: ctor.name, plan: Object.freeze({ ...plan }) });
+}
+export function sealStoreObject(obj, store, plan) {
+    assertStoreWord(store);
+    const planKeys = new Set(Reflect.ownKeys(plan));
+    if (typeof obj !== "function") {
+        for (const key of Reflect.ownKeys(obj)) {
+            const d = Object.getOwnPropertyDescriptor(obj, key);
+            if (d !== undefined && typeof d.value === "function" && !planKeys.has(key)) {
+                throw new Error(`store-boundary: ${store} has a callable member ${String(key)} that its exit plan does not list`);
+            }
+        }
+    }
+    for (const key of planKeys) {
+        const word = plan[key];
+        assertWord(store, key, word);
+        if (word !== "exit")
+            continue;
+        const d = Object.getOwnPropertyDescriptor(obj, key);
+        if (d === undefined)
+            continue;
+        if (typeof d.value !== "function")
+            throw new Error(`store-boundary: ${store}.${String(key)} is not a callable own property`);
+        if (d.value[SEALED_STORE_MEMBER] !== undefined)
+            continue;
+        assertNotGenerator(store, key, d.value);
+        if (d.writable !== true && d.configurable !== true)
+            throw new Error(`store-boundary: ${store}.${String(key)} is frozen and cannot be sealed`);
+        Object.defineProperty(obj, key, { ...d, value: sealedMember(d.value, `${store}.${String(key)}`) });
+    }
+    if (!SEALS.has(`object:${store}`))
+        SEALS.set(`object:${store}`, { store, kind: "object", name: store, plan: Object.freeze({ ...plan }) });
+    return obj;
+}
+export function sealStoreFunction(fn, site) {
+    if (!/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*\.[A-Za-z][A-Za-z0-9]*$/.test(site))
+        throw new Error(`store-boundary: site ${JSON.stringify(site)} is not <store word>.<verb>`);
+    return sealedMember(fn, site);
+}
+export async function* sealStoreIterable(it, site) {
+    try {
+        return yield* it;
+    }
+    catch (err) {
+        throw storeBoundaryFault(err, site);
+    }
+}
+function sealedMember(fn, site) {
+    const sealed = function (...args) {
+        try {
+            const out = fn.apply(this, args);
+            const then = thenOf(out);
+            if (then === undefined)
+                return sealedYield(out, site);
+            return Reflect.apply(then, out, [
+                (value) => sealedYield(value, site),
+                (err) => {
+                    throw storeBoundaryFault(err, site);
+                },
+            ]);
+        }
+        catch (err) {
+            throw storeBoundaryFault(err, site);
+        }
+    };
+    Object.defineProperty(sealed, "name", { value: fn.name, configurable: true });
+    Object.defineProperty(sealed, "length", { value: fn.length, configurable: true });
+    Object.defineProperty(sealed, SEALED_STORE_MEMBER, { value: site });
+    return sealed;
+}
+function thenOf(v) {
+    if (v === null || (typeof v !== "object" && typeof v !== "function"))
+        return undefined;
+    const then = Reflect.get(v, "then");
+    return typeof then === "function" ? then : undefined;
+}
+function sealedYield(value, site) {
+    let tag;
+    try {
+        tag = Object.prototype.toString.call(value);
+    }
+    catch (err) {
+        throw storeBoundaryFault(err, site);
+    }
+    return tag === "[object AsyncGenerator]" ? sealStoreIterable(value, site) : value;
+}
+function assertStoreWord(store) {
+    if (!STORE_WORD.test(store))
+        throw new Error(`store-boundary: store word ${JSON.stringify(store)} is not a lowercase dashed word`);
+}
+function assertWord(store, key, word) {
+    if (word === "exit" || word === "in-store")
+        return;
+    if (word === "boot") {
+        if (typeof key === "string" && BOOT_METHOD_NAMES.has(key))
+            return;
+        throw new Error(`store-boundary: ${store}.${String(key)} is marked boot but is not a boot lifecycle name (${[...BOOT_METHOD_NAMES].join(" / ")})`);
+    }
+    throw new Error(`store-boundary: ${store}.${String(key)} has exit word ${JSON.stringify(word)} (expected exit | boot | in-store)`);
+}
+function assertNotGenerator(store, key, fn) {
+    if (fn.constructor?.name === "GeneratorFunction") {
+        throw new Error(`store-boundary: ${store}.${String(key)} is a synchronous generator method — its failures happen after the call returns, where the seal cannot see them`);
+    }
+}
+//# sourceMappingURL=store-boundary.js.map

package/dist/plugins/store-contracts.d.ts

@@ -21,6 +21,7 @@
 import type { PeerSessionTempo, TaskResult, TaskStatus } from "@sema-agent/core";
 import type { RunIdentity } from "../identity-source.js";
 import type { SessionUnreadable } from "../session-error-wire.js";
+import type { SessionKind } from "../session-kind.js";
 import type { ReadDenyFloorSummary } from "../read-deny-floor-notice.js";
 /**
  * **File 店族的 boot 期拒启基类**([ref];把 `RunStoreStrictHydrateError` 的那条论证升成一条族规)。
@@ -616,6 +617,22 @@ export interface SessionSummary {
     /** fork 谱系:建这一行的那次 fork 的源会话 id(core `SessionMetadata.forkedFrom` 原词)—— present-iff 这一行是 fork 建的、且建于谱系落地之后(更早的 fork 不回填:源已不可知)。
      *  三店从行上读(谱系的唯一读法 `session-incarnation.ts` 的 `forkLineageOfRow`);来源住客(`forkedFromIncarnation`)不上列表行。wire 半场见 `security.ts SessionListItem.forkedFrom`(同名同义)。 */
     forkedFrom?: string;
+    /** 会话种类(律 `session-kind.ts`):present-iff 这只会话由一次带 `sessionKind` 的提交建下;顶层行缺席(恒不铸 null)。三店从行上读(唯一解码 `sessionKindFromCell`)。
+     *  wire 半场见 `security.ts SessionListItem.sessionKind`(同名同义)。 */
+    sessionKind?: SessionKind;
+}
+/** 列表面的查询形(`listSessions` / `listSessionRows` 同一形;三只会话店与路由同读)。`sessionKind` = 视图(律 `session-kind.ts`:缺席 = 缺省视图,只列无种类的会话)。 */
+export interface SessionListQuery {
+    owner?: string;
+    /** [ref] 窄互认第二臂的第三条件(SQL 孪生里是 `owner IS NULL` 谓词;local 店是同义的 `owner === null` 放行)。 */
+    includeUnowned?: boolean;
+    cursor?: {
+        lastActivityAt: string;
+        sessionId: string;
+    };
+    limit: number;
+    q?: string;
+    sessionKind?: SessionKind;
 }
 /**
  * run 账里「每会话的 run 投影」的五位([ref] 四位 + [ref] 预览位)—— 会话列表行上出自 run 行的那一半:

package/dist/plugins/store-fault-sentence-m53.d.ts

@@ -0,0 +1,7 @@
+type Json = Record<string, unknown>;
+/** 后台子代记录的改写(见头注);不改 ⇒ `undefined`。 */
+export declare function rewrittenBackgroundRecordM53(record: unknown): Json | undefined;
+/** `tool_end` 事件数据的改写(见头注);不改 ⇒ `undefined`。 */
+export declare function rewrittenToolEndDataM53(data: unknown): Json | undefined;
+export {};
+//# sourceMappingURL=store-fault-sentence-m53.d.ts.map

package/dist/plugins/store-fault-sentence-m53.js

@@ -0,0 +1,25 @@
+import { outwardFailureCode, outwardStoreMessageOf } from "../terminal.js";
+const isRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+function outwardOrUnchanged(code, message) {
+    if (typeof code !== "string" || typeof message !== "string" || outwardFailureCode(code) === code)
+        return undefined;
+    const outward = outwardStoreMessageOf(code, message);
+    return outward === message ? undefined : outward;
+}
+export function rewrittenBackgroundRecordM53(record) {
+    if (!isRecord(record))
+        return undefined;
+    const outward = outwardOrUnchanged(record.errorCode, record.error);
+    if (outward === undefined)
+        return undefined;
+    const old = record.error;
+    const summary = typeof record.summary === "string" && old !== "" && record.summary.includes(old) ? { summary: record.summary.split(old).join(outward) } : {};
+    return { ...record, error: outward, ...summary };
+}
+export function rewrittenToolEndDataM53(data) {
+    if (!isRecord(data) || !isRecord(data.structured))
+        return undefined;
+    const outward = outwardOrUnchanged(data.structured.errorCode, data.structured.errorMessage);
+    return outward === undefined ? undefined : { ...data, structured: { ...data.structured, errorMessage: outward } };
+}
+//# sourceMappingURL=store-fault-sentence-m53.js.map

package/dist/plugins/store-fault.d.ts

@@ -6,12 +6,13 @@ export type StoreFaultClass = "corrupt" | "connection" | "deployment" | "defect"
  */
 export declare function isCodeDefect(err: unknown): boolean;
 /** 判官本体。纯函数、不抛;只看被抛出的这一只对象(不沿 `cause` 链找)。连接类与部署错配两张识别表互斥,两者之间判序不影响结果(`test/store-fault-judge.test.ts` 钉互斥);
- *  程序错排在它们之后(带那两类归因键的对象按那两类认)。 */
+ *  程序错排在它们之后(带那两类归因键的对象按那两类认)。
+ *  首臂 = 店边界形({@link StoreBoundaryFault}):边界在**原错**上判过一次(连接类整句、errno 臂、1005 内层号都只在原错上读得到),词随形带走 —— 读它就是读那一判,不是第二种读法。 */
 export declare function storeFaultClassOf(err: unknown): StoreFaultClass;
 /**
  * 判官每个词的**对外句**(闭集 `Record`:判官加一个词而不在这里写出它对外怎么说 = 编译错)。这是本判官唯一的一张「对外怎么说」的表 ——
- * 失败要出 wire 时,调用方只拿**类别**说话,不把驱动的原句(带库用户名 / 主机 / 表名 / 约束名)交出去;驱动原句只进运维日志
- * (`terminal.ts` 的折码处),出口脱敏器是模式脱敏、认不出「这是库账号 / 表名」。每句只说两件事:**坏在哪一类** + **重试有没有用**,不带任何实例化的名字。
+ * 失败要出店 / 出 wire 时,调用方只拿**类别**说话,不把驱动的原句(带库用户名 / 主机 / 表名 / 约束名)交出去;驱动原句只进运维日志
+ * (店边界 `terminal.ts` 的 `storeBoundaryFault` 那一行 `at=store`),出口脱敏器是模式脱敏、认不出「这是库账号 / 表名」。每句只说两件事:**坏在哪一类** + **重试有没有用**,不带任何实例化的名字。
  *
  * 🔴 **句子只断言码本身证明得了的事**:判官读到的只有一个码,而同一个码形可以出自库驱动,也可以出自别的系统调用(`ECONNREFUSED` 出自任何一个套接字、`ENOENT` 出自文件系统),
  * 所以 `connection` 说「一条连接」而不说「数据库的连接」;`unclassified` 只说「带了一个本服务不公布的码」。只有 `deployment` 的两类码(缺表、权限拒:`42P01` / `42501` /
@@ -22,9 +23,27 @@ export declare function storeFaultClassOf(err: unknown): StoreFaultClass;
  */
 export declare const STORE_FAULT_OUTWARD_SENTENCE: Readonly<Record<StoreFaultClass, string>>;
 /**
- * 一个**失败码**的对外句 —— 终局因由只带码(引擎把错压成 `code` + `message` 两格,类型与 `cause` 链已不在)的那些站点用:判官读 `{ code }`(识别表按 `code` 字符串登记,
- * 数字 `errno` 只是同一件事的另一种写法,这里读不到也不影响:每个登记行都有 `code`),交回的词按 {@link STORE_FAULT_OUTWARD_SENTENCE} 说一句。
- * 判官是整仓一只,这里不第二次认「什么算连接类 / 部署错配类」。
+ * 对外句的**唯一拼法**(纯函数):判官的词 → 本表那一句 + 原码尾注 `[original code: <码>]`(码缺席 ⇒ 只有类别句)。两种输入、一只拼法:
+ *  · 店边界({@link StoreBoundaryFault}):词是边界在**原错**上判的那一个(带 `cause` 的包装、只带 errno 的错、无码整句 —— 只看码判不出的那几形都在原错上判得出);
+ *  · 只剩码的站点(终局因由 / 投影 / 抛出臂:引擎已把错压成 `code` + `message` 两格,类型与 `cause` 链已不在,`terminal.ts` 的 `outwardStoreMessage`):词 = 判官读 `{ code }`。
+ * 两者对同一次店失败说同一句(边界句原样过出口,出口的幂等判 `isOutwardStoreSentence` 由本表派生)。句子里没有「持久层失败」之类的前缀:码 `internal.store_error` 已经在同一条因由上说了辖域,
+ * 而抛出臂(没有因由、没有码)上同一句不该替抛出物断言它的出身。
  */
-export declare function storeFaultSentenceOfCode(code: string): string;
+export declare function outwardStoreSentence(cls: StoreFaultClass, code: string | undefined): string;
+/** 判官的词(闭集,与 {@link STORE_FAULT_OUTWARD_SENTENCE} 的键同一份):出口幂等判逐词比对用。 */
+export declare const STORE_FAULT_CLASSES: readonly StoreFaultClass[];
+/**
+ * **店边界形** —— 一只 SQL 店的任何出口(抛出值 / 包装错的 `cause` / 失败文本 / 交出的读器与事务对象)上驱动错的**唯一**形:原码 + 稳定句,别无他物。
+ * 自有成员恰为 `name` · `message` · `stack`(新铸,第一行就是稳定句)· `faultClass` · `code`(有码时)· `errno`(原错链上带数字 errno 时)——
+ * **不带** `cause`、`sqlMessage`、`sql`(带插值后的语句全文)、`sqlState`、`fatal`、node-pg `DatabaseError` 的 `detail` / `hint` / `where` / `table` / `column` / `constraint` …、
+ * 套接字错的 `syscall` / `address` / `port`、原 stack:引擎在拒绝路径上对抛出值做全量自有键快照,同主体档不跑主机 / 路径脱敏,所以只能是新对象,不能「删几键」。
+ * 唯一铸点 = 边界函数 `terminal.ts` 的 `storeBoundaryFault`(它在铸之前把原句经出口座记一行运维日志);本类住在判官旁边,因为判官的首臂读它带的词(`terminal.ts` → 本文件已是一条边,反向成环)。
+ */
+export declare class StoreBoundaryFault extends Error {
+    /** 判官在**原错**上读出的词(只算一次、随形带走)。 */
+    readonly faultClass: StoreFaultClass;
+    readonly code?: string;
+    readonly errno?: number;
+    constructor(faultClass: StoreFaultClass, code: string | undefined, errno: number | undefined);
+}
 //# sourceMappingURL=store-fault.d.ts.map

package/dist/plugins/store-fault.js

@@ -7,6 +7,8 @@ export function isCodeDefect(err) {
     return RUNTIME_DEFECT_CLASSES.some((cls) => err instanceof cls) && !Object.hasOwn(err, "cause");
 }
 export function storeFaultClassOf(err) {
+    if (err instanceof StoreBoundaryFault)
+        return err.faultClass;
     if (err instanceof StoreCorruptError)
         return "corrupt";
     if (isConnectionFaultError(err))
@@ -22,7 +24,21 @@ export const STORE_FAULT_OUTWARD_SENTENCE = {
     defect: "the service failed on an internal error; retrying fails the same way until the service is fixed",
     unclassified: "the failure carried a code this service does not publish; the operator log carries the original sentence",
 };
-export function storeFaultSentenceOfCode(code) {
-    return STORE_FAULT_OUTWARD_SENTENCE[storeFaultClassOf({ code })];
+export function outwardStoreSentence(cls, code) {
+    const sentence = STORE_FAULT_OUTWARD_SENTENCE[cls];
+    return code === undefined ? sentence : `${sentence} [original code: ${code}]`;
+}
+export const STORE_FAULT_CLASSES = Object.keys(STORE_FAULT_OUTWARD_SENTENCE);
+export class StoreBoundaryFault extends Error {
+    faultClass;
+    constructor(faultClass, code, errno) {
+        super(outwardStoreSentence(faultClass, code));
+        this.name = "StoreBoundaryFault";
+        this.faultClass = faultClass;
+        if (code !== undefined)
+            this.code = code;
+        if (errno !== undefined)
+            this.errno = errno;
+    }
 }
 //# sourceMappingURL=store-fault.js.map

package/dist/plugins/task-attachment-store.d.ts

@@ -83,7 +83,8 @@ export interface TaskAttachmentStore {
     deleteBySession(sessionId: string): Promise<number>;
     /** TTL 收割:未绑定且 created_at_ms < olderThanMs 的行。返回删除数。 */
     reapUnbound(olderThanMs: number): Promise<number>;
-    /** D-1 孤儿**对象**彻底 GC(clay 拍 2026-07-28):列举对象存储 × meta 行对账,零行且过 grace 的对象删。
+    /** D-1 孤儿**对象**彻底 GC(clay 拍 2026-07-28):列举对象存储 × meta 行对账,零行且过 grace 的对象删。只看本域写得出的名(内容地址);
+     *  「零行」只对本库成立 ⇒ 命名空间必须只属本库(字节口的删除等命名空间归属证明,`session-blob-namespace.ts`)。
      *  可选——local 店(meta+bytes 同盘同步删)无此孤儿类。 */
     sweepOrphanObjects?(graceMs: number, nowMs?: number): Promise<number>;
 }

package/dist/plugins/task-attachment-store.js

@@ -5,7 +5,8 @@ import { attachmentKindOf, PROJECT_BUNDLE_MIME } from "../project-bundle.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { isDupKeyError, retryOnDeadlock } from "./sql-errors.js";
 import { countClientWriteOn } from "./session-withdraw-sql.js";
-import { readAtAddress } from "./blob-backend.js";
+import { isContentAddress, readAtAddress } from "./blob-backend.js";
+import { sealStoreClass } from "./store-boundary.js";
 export const TaskAttachmentRecordSchema = z.object({
     id: z.string(),
     owner: z.string(),
@@ -385,6 +386,8 @@ export class TiDBTaskAttachmentStore {
             batch = [];
         };
         for await (const o of lister.listObjects()) {
+            if (!isContentAddress(o.hash))
+                continue;
             if (nowMs - o.lastModifiedMs < graceMs)
                 continue;
             batch.push(o.hash);
@@ -420,6 +423,10 @@ export class TiDBTaskAttachmentStore {
         return out;
     }
 }
+sealStoreClass(TiDBTaskAttachmentStore, "tidb-task-attachment-store", {
+    put: "exit", get: "exit", getContent: "exit", releaseBytes: "exit", bind: "exit", listBySession: "exit", delete: "exit", deleteBySession: "exit",
+    reapUnbound: "exit", sweepOrphanObjects: "exit",
+});
 export class PgTaskAttachmentStore {
     bytes;
     db;
@@ -501,6 +508,8 @@ export class PgTaskAttachmentStore {
             batch = [];
         };
         for await (const o of lister.listObjects()) {
+            if (!isContentAddress(o.hash))
+                continue;
             if (nowMs - o.lastModifiedMs < graceMs)
                 continue;
             batch.push(o.hash);
@@ -536,4 +545,8 @@ export class PgTaskAttachmentStore {
         return out;
     }
 }
+sealStoreClass(PgTaskAttachmentStore, "pg-task-attachment-store", {
+    put: "exit", get: "exit", getContent: "exit", releaseBytes: "exit", bind: "exit", listBySession: "exit", delete: "exit", deleteBySession: "exit",
+    reapUnbound: "exit", sweepOrphanObjects: "exit",
+});
 //# sourceMappingURL=task-attachment-store.js.map

package/dist/plugins/task-list-store-sql.d.ts

@@ -50,9 +50,9 @@ export declare function ensurePgTaskListSchema(q: (text: string, params?: unknow
  * 事务内先对 meta 行 `FOR UPDATE`(与 `mutate` 同一把分区锁)⇒ 与并发的清单写串行,不会删到
  * 一半被插回新行。meta 行不在(从未写过任何任务)= 无锁可拿,DELETE 命中 0 行,幂等。
  */
-export declare function deleteTiDBTaskList(pool: MySqlPool, listKey: string): Promise<void>;
+export declare const deleteTiDBTaskList: (pool: MySqlPool, listKey: string) => Promise<void>;
 /** {@link deleteTiDBTaskList} 的 PG 孪生(同语义、同事务姿势)。 */
-export declare function deletePgTaskList(pool: PgPool, listKey: string): Promise<void>;
+export declare const deletePgTaskList: (pool: PgPool, listKey: string) => Promise<void>;
 export declare function createTiDBTaskListStore(pool: MySqlPool, listKey: string): TaskListStore;
 export declare function createPgTaskListStore(pool: PgPool, listKey: string): TaskListStore;
 //# sourceMappingURL=task-list-store-sql.d.ts.map

package/dist/plugins/task-list-store-sql.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { assertJsonMetadata } from "@sema-agent/core";
 import { pgHasUnstorable, pgSafeJsonStringify, PgUnstorableError } from "./pg-safe-json.js";
 import { decodeJsonColumn, foldJsonColumn, jsonColumnText } from "./sql-json-column.js";
+import { sealStoreFunction, sealStoreObject } from "./store-boundary.js";
 export const TASK_LIST_META_TABLE = "task_list_meta";
 export const TASK_LIST_ITEM_TABLE = "task_list_item";
 export function taskListKeyFor(sessionId) {
@@ -98,7 +99,7 @@ async function setOn(exec, dialect, listKey, id, itemJson) {
         ? `UPDATE ${TASK_LIST_META_TABLE} SET next_sort = ? WHERE list_key = ?`
         : `UPDATE ${TASK_LIST_META_TABLE} SET next_sort = $1 WHERE list_key = $2`, [sort + 1, listKey]);
 }
-export async function deleteTiDBTaskList(pool, listKey) {
+export const deleteTiDBTaskList = sealStoreFunction(async function deleteTiDBTaskList(pool, listKey) {
     assertListKeyBytes(listKey);
     const c = await pool.getConnection();
     try {
@@ -115,8 +116,8 @@ export async function deleteTiDBTaskList(pool, listKey) {
     finally {
         c.release();
     }
-}
-export async function deletePgTaskList(pool, listKey) {
+}, "sql-task-list-tidb.delete");
+export const deletePgTaskList = sealStoreFunction(async function deletePgTaskList(pool, listKey) {
     if (pgHasUnstorable(listKey))
         throw new PgUnstorableError("task-list listKey");
     assertListKeyBytes(listKey);
@@ -135,7 +136,8 @@ export async function deletePgTaskList(pool, listKey) {
     finally {
         c.release();
     }
-}
+}, "sql-task-list-pg.delete");
+const TASK_LIST_EXIT_PLAN = { get: "exit", set: "exit", delete: "exit", list: "exit", allocateId: "exit", mutate: "exit" };
 export function createTiDBTaskListStore(pool, listKey) {
     assertListKeyBytes(listKey);
     const tx = async (fn) => {
@@ -158,7 +160,7 @@ export function createTiDBTaskListStore(pool, listKey) {
         const [rows] = (await q.query(sql, params));
         return rows;
     };
-    const build = (q, inTx) => ({
+    const build = (q, inTx) => sealStoreObject({
         get: async (id) => {
             const [rows] = (await q.query(`SELECT ${jsonColumnText("mysql", "item_json")} FROM ${TASK_LIST_ITEM_TABLE} WHERE list_key = ? AND id = ?${inTx ? " FOR UPDATE" : ""}`, [listKey, id]));
             return rows.length > 0 ? parseItem(rows[0].item_json, `for list ${listKey} item ${JSON.stringify(id)}`) : undefined;
@@ -187,7 +189,7 @@ export function createTiDBTaskListStore(pool, listKey) {
                     return fn(build(c, true));
                 }),
             }),
-    });
+    }, inTx ? "sql-task-list-tidb-tx" : "sql-task-list-tidb", TASK_LIST_EXIT_PLAN);
     return build(pool, false);
 }
 export function createPgTaskListStore(pool, listKey) {
@@ -214,7 +216,7 @@ export function createPgTaskListStore(pool, listKey) {
         const res = await q.query(sql, params);
         return res.rows;
     };
-    const build = (q, inTx) => ({
+    const build = (q, inTx) => sealStoreObject({
         get: async (id) => {
             const { rows } = await q.query(`SELECT ${jsonColumnText("pg", "item_json")} FROM ${TASK_LIST_ITEM_TABLE} WHERE list_key = $1 AND id = $2${inTx ? " FOR UPDATE" : ""}`, [listKey, id]);
             return rows.length > 0 ? parseItem(rows[0].item_json, `for list ${listKey} item ${JSON.stringify(id)}`) : undefined;
@@ -250,7 +252,7 @@ export function createPgTaskListStore(pool, listKey) {
                     return fn(build(c, true));
                 }),
             }),
-    });
+    }, inTx ? "sql-task-list-pg-tx" : "sql-task-list-pg", TASK_LIST_EXIT_PLAN);
     return build(pool, false);
 }
 //# sourceMappingURL=task-list-store-sql.js.map

package/dist/plugins/tidb-cost-quota.js

@@ -1,5 +1,6 @@
 import { decideQuota } from "../observability/cost-quota.js";
 import { WriteBehindCounter } from "./write-behind-counter.js";
+import { sealStoreClass } from "./store-boundary.js";
 export class TiDBCostQuota {
     counter;
     limitMicroUsd;
@@ -50,4 +51,7 @@ export class TiDBCostQuota {
         this.counter.stop();
     }
 }
+sealStoreClass(TiDBCostQuota, "tidb-cost-quota", {
+    setLimits: "exit", check: "exit", add: "exit", flush: "exit", refresh: "exit", reap: "exit", startRefresh: "exit", stop: "exit",
+});
 //# sourceMappingURL=tidb-cost-quota.js.map

package/dist/plugins/tidb-pool.js

@@ -8,7 +8,7 @@ import { TIDB_PERMISSION_RULE_STATEMENTS } from "./permission-rule-store-sql.js"
 import { TIDB_RETENTION_TOMBSTONE_STATEMENTS } from "../stores-sql/retention-store-sql.js";
 import { TIDB_RETENTION_LANE_STATEMENTS } from "./retention-lane-store-sql.js";
 import { SESSION_META_INCARNATION_COLUMN, SESSION_META_LINEAGE_COLUMNS } from "../session-incarnation.js";
-import { ensureSessionExtTableMysql } from "./session-ext-table.js";
+import { SESSION_EXT_INDEXES, ensureSessionExtTableMysql } from "./session-ext-table.js";
 import { CHECKPOINT_HOST_SESSION_COLUMN } from "./checkpoint-index-columns.js";
 import { RUN_IDENTITY_COLUMNS } from "../identity-source.js";
 import { SESSION_RULES_COLUMN } from "./session-rules-column.js";
@@ -33,6 +33,7 @@ import { acquireAdvisoryLock, releaseAdvisoryLock } from "./ensure-schema-lock-p
 import { SKILL_EXEMPTION_CUTOFF_ID, markIfAbsentSql, migrationMarkerDdl } from "./one-time-migration-marker.js";
 import { replicaRegistrationDdl } from "./replica-registration.js";
 import { servingRequirementDdl } from "./serving-requirement.js";
+import { sessionBlobNamespaceClaimDdl } from "./session-blob-claim-token.js";
 import { createCloseAwarePool } from "./sql-driver.js";
 export function tidbPoolOptions(tidb) {
     const { host, port, user, password, database, connectionLimit } = tidb;
@@ -268,12 +269,11 @@ export const SCHEMA_STATEMENTS = [
      session_id   VARCHAR(190) NOT NULL,
      version      INT          NOT NULL DEFAULT 1,
      status       VARCHAR(16)  NOT NULL DEFAULT 'pending',
-     tool_name    VARCHAR(190) NULL,
      tool_call_id VARCHAR(190) NULL,
-     -- tool_input: the pending-approval tool args = the approval card's payload, surfaced in listPending so the
-     -- BFF need not N+1-fetch trace.turns per pending item. Redacted + bounded at put().
-     -- NULL on PRE-MIGRATION rows (suspended before the column existed) ⇒ the consumer falls back.
-     tool_input   JSON         NULL,
+     -- (no display-copy columns: the approval queue row's action facts — tool name, input, risk descriptor, rule offers,
+     --  bidi bit — are projected at read time from ONE whole-row decode of checkpoint, the copy a resume executes;
+     --  the stored copies tool_name / tool_input / risk_descriptor / rule_suggestions / has_bidi_controls were retired by
+     --  one-time migration M54. tool_call_id / bound_input_hash / approval_card / gate_kind stay: readers find rows by them.)
      checkpoint   JSON         NOT NULL,
      outcome      JSON         NULL,
      deadline     BIGINT       NULL,
@@ -331,25 +331,6 @@ export const SCHEMA_STATEMENTS = [
      --  那条:文本相等性有太多与业务无关的自由度,整数没有。)
      -- **绝不**用它做 resolve 的 OCC:bump 它不影响 core 的 rev 语义。
      pending_steer_rev BIGINT  NOT NULL DEFAULT 0,
-     -- risk_descriptor (design/80 riskDescriptor inbox): core's INERT CheckpointGate.riskDescriptor ({severity
-     -- 1-5, axes, toolName, redacted summary, touchedPaths}), stamped at put() so listPending can surface it +
-     -- triage-sort the supervisor inbox by severity DESC — WITHOUT parsing the checkpoint blob per row.
-     -- NULL on gates with no descriptor.
-     risk_descriptor TEXT        NULL,
-     -- rule_suggestions ([3683]-2/[3684]② mint 面归因):core 挂在 pendingAction.ruleOffers 上的规则
-     -- 候选(design/179 §4;与同步腿 AskRequest.ruleOffers 同一条契约;design/375 换形后载荷=判别联合,列名保留),在 put() 落列 —— 于是
-     -- listPending 不必为一格展示材料去拖整只 checkpoint blob(那是整份 suspend 快照)。落列前过
-     -- boundedRuleOffers:窄读(坏条丢弃)+ redactSecrets(候选文本由命令原文铸出,而运维队列跨租户
-     -- 可见)+ 基数截断。NULL = 无供给(规则车道没武装 / 命令说不出规则 / 这只 ask 规则清不掉),读口
-     -- 据此省键而不是铸空数组。
-     rule_suggestions TEXT       NULL,
-     -- has_bidi_controls(S-30① / #356②;core 5.60.0 #438):bidi **在场位** —— core 在 park mint 写在
-     -- pendingAction(tool_approval 臂)上的那一位,put() 反范式成列,listPending 据它给 /v1/approvals 与
-     -- /v1/approvals/stream 的行铸 hasBidiControls:true(此前耐久运维队列一个位都没有:同一张卡
-     -- 「活着看得到告警、park 之后看不到」)。取值 **1 或 NULL、恒不写 0**:core 的契约是 true 或缺席
-     -- (缺席 = 没检出 ≠ 干净),一个 0 会把「没检出」谎成「已确认干净」。老行(本列诞生前 park 的)
-     -- NULL ⇒ 读口省键。clay 批 2026-07-26 TINYINT(1) 归一先例:布尔列 TiDB 侧 TINYINT(1)。
-     has_bidi_controls TINYINT(1) NULL,
      -- execution_outcome / execution_at_ms(S-160;core 7.7.0 #602 的耐久半场):**决定被怎么处置了**的
      -- 结算记录 —— resume 腿上那次调用的 tool_end 帧携带的 GateOutcome,与 outcome 列(决定本身,不可变)
      -- 是两个轴:一个人批了(outcome 里 disposition=allowed),部署自己的复核在 post-CAS 否了他改过的参数
@@ -365,6 +346,10 @@ export const SCHEMA_STATEMENTS = [
      -- plugins/checkpoint-index-columns.ts 的 hostSessionOf 求值一次;存量行由一次性迁移 M49 自 session_id 回填。按会话找卡的读口(决断 / 取消 / 收割 /
      -- 续跑输入回收 / 运维队列行)只读它;session_id 只答「这是哪段对话」。列定义的唯一属主 = 同模块的 CHECKPOINT_HOST_SESSION_COLUMN。
      ${CHECKPOINT_HOST_SESSION_COLUMN.mysql},
+     -- card_scope_root:这张卡上「不再询问」规则的 project root **铸卡快照**(停驻那一刻由跑这条 run 的副本写一次,读法与问行 rule_scope_root 同义;
+     -- 不在兑付时重推)。NULL = 授权发生地在 server 坐标系里不可知(远程沙箱 / 未登记的 host / 多租 host 车道),或行由加这一列之前的构建落下 ⇒
+     -- 规则兑付不铸 scope(core 答 scope-unresolved,只会拒不会放宽)。写口 put,读口 cardScopeRootOf;上界同 rule_scope_root(ABSOLUTE_HOST_PATH_MAX)。
+     card_scope_root   VARCHAR(4096) NULL,
      PRIMARY KEY (token),
      KEY idx_checkpoint_status_deadline (status, deadline),
      KEY idx_checkpoint_session_status (session_id, status),
@@ -564,6 +549,15 @@ export const SCHEMA_STATEMENTS = [
      created_at DATETIME(3) NOT NULL,
      PRIMARY KEY (blob_hash),
      KEY idx_file_history_blob_created (created_at)
+   ) COLLATE utf8mb4_bin`,
+    `CREATE TABLE IF NOT EXISTS file_history_blob_grant (
+     scope         VARCHAR(64)  NOT NULL,
+     landing_owner VARBINARY(${PRINCIPAL_MAX_BYTES}) NOT NULL,
+     blob_hash     CHAR(64)     NOT NULL,
+     granted_at    DATETIME(3)  NOT NULL,
+     PRIMARY KEY (scope, landing_owner, blob_hash),
+     KEY idx_file_history_blob_grant_granted (granted_at),
+     KEY idx_file_history_blob_grant_blob (blob_hash)
    ) COLLATE utf8mb4_bin`,
     `CREATE TABLE IF NOT EXISTS workflow_journal (
      run_id        VARCHAR(191) NOT NULL,
@@ -784,6 +778,7 @@ export const SCHEMA_STATEMENTS = [
     migrationMarkerDdl("mysql"),
     replicaRegistrationDdl("mysql"),
     servingRequirementDdl("mysql"),
+    sessionBlobNamespaceClaimDdl("mysql"),
     ...TIDB_APPROVAL_ASK_STATEMENTS,
     ...TIDB_MEMORY_OPTOUT_GRANT_STATEMENTS,
     ...TIDB_SESSION_CAPTURE_OPTOUT_STATEMENTS,
@@ -843,6 +838,7 @@ export async function releaseEnsureSchemaLock(conn, tag = "ensureSchema") {
 export const SCHEMA_INDEXES = [
     ...CENTRAL_SCHEMA_INDEXES,
     ...SESSION_INDEXES,
+    ...SESSION_EXT_INDEXES,
     ...TOOL_RESULT_INDEXES,
     ...COST_QUOTA_INDEXES,
     ...RATE_LIMIT_INDEXES,

package/dist/plugins/tidb-rate-limiter.js

@@ -1,4 +1,5 @@
 import { WriteBehindCounter } from "./write-behind-counter.js";
+import { sealStoreClass } from "./store-boundary.js";
 export class TiDBRateLimiter {
     counter;
     limit;
@@ -48,4 +49,7 @@ export class TiDBRateLimiter {
         this.counter.stop();
     }
 }
+sealStoreClass(TiDBRateLimiter, "tidb-rate-limiter", {
+    setLimits: "exit", check: "exit", sweep: "exit", flush: "exit", refresh: "exit", startRefresh: "exit", stop: "exit",
+});
 //# sourceMappingURL=tidb-rate-limiter.js.map

package/dist/plugins/user-input-ledger-sql.js

@@ -2,6 +2,7 @@ import { recordFailOpen } from "../observability/fail-open.js";
 import { isDupKeyError } from "./sql-errors.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { assertPageLimit, CRASHED_CAUSE, SETTLE_HOW_WORDS, USER_INPUT_KIND_WORDS, USER_INPUT_OPEN_SCAN_MAX, USER_INPUT_SESSION_READ_MAX, } from "../user-input-ledger.js";
+import { sealStoreClass } from "./store-boundary.js";
 export const USER_INPUT_ACCEPTANCE_TABLE = "user_input_acceptance";
 const COLUMNS = "accept_id, input_kind, message_id, session_id, task_id, writer, accepted_at_ms, state, state_at_ms, settle_how, announced_at_ms, announced_task_id";
 function rowState(r) {
@@ -116,6 +117,9 @@ export class SqlUserInputLedgerStore {
         return res.affected;
     }
 }
+sealStoreClass(SqlUserInputLedgerStore, "sql-user-input-ledger-store", {
+    accept: "exit", settle: "exit", converge: "exit", announce: "exit", listOpen: "exit", listCrashed: "exit", listUnannounced: "exit", deleteBySession: "exit",
+});
 export class TiDBUserInputLedgerStore extends SqlUserInputLedgerStore {
     constructor(pool) {
         super(mysqlDriver(pool));