@sema-agent/server 7.51.0 → 7.52.1

package/dist/plugins/store-backend.d.ts

@@ -1,7 +1,6 @@
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import type { SessionStore, SessionPolicyStore, FileSnapshotStore, WorkflowJournalStore, ToolResultStore } from "@sema-agent/core";
-import { type FileSnapshotBounds } from "@sema-agent/core";
+import type { SessionStore, SessionPolicyStore, FileHistoryStore, WorkflowJournalStore, ToolResultStore } from "@sema-agent/core";
 import { type OutcomeSink } from "./file-outcome-sink.js";
 import { type InboxWarn } from "./workflow-run-store-sql.js";
 import { FileRunStore } from "./file-run-store.js";
@@ -9,6 +8,7 @@ import { LocalCheckpointStore } from "./local-checkpoint-store.js";
 import { FileResumeAnchorStore } from "./file-resume-anchor-store.js";
 import { type ApprovalExemptionStore } from "./approval-exemption-store.js";
 import { type ApprovalAskStore as ApprovalAskStoreType } from "./approval-ask-store-sql.js";
+import { type MemoryOptOutGrantStore } from "./memory-optout-grant-store-sql.js";
 import { type SendFileLedger } from "./send-file-ledger.js";
 import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
 import type { ServiceConfig } from "../config-types.js";
@@ -45,22 +45,27 @@ export type { ApprovalAskStore, AskRow, NewAskRow, AskTransitionPatch, DecideAsk
  *  it, core's InMemory omits it → optional). tidb/pg = durable twins; local = core's InMemorySessionPolicyStore (works
  *  local — rules need no cloud-only infra). The shared env-gated equivalence suite keeps the twins byte-matched to InMemory. */
 export type ServiceSessionPolicyStore = SessionPolicyStore;
-/** E19 rewind-files FileSnapshotStore — core's interface PLUS the service `deleteBySession` (E21 purge; the durable
- *  twins carry it, core's InMemory omits it → optional). tidb/pg = durable twins (manifest+blobs, reuse core
- *  captureManifest/applyManifest); local = core's FileFileSnapshotStore(file-backed content-addressed,跨重启
- *  存活——接入审计 L6 订正:旧注释写 InMemory 会误导 local 快照持久性判断). Also the 2c work-artifact transfer store. */
-export type ServiceFileSnapshotStore = FileSnapshotStore & {
-    /** [805]③a observability tail (SQL twins only — core's local stores drop the count internally, a core-side
-     *  gap): captureManifest's tolerated-vanished counter → metric sink, assigned by main.ts when present.
-     *  codex F8: async sinks admitted; the twins swallow a rejected promise (never-throw seam holds). */
-    onSkippedVanished?: (count: number) => void | Promise<void>;
+/** S-15 per-edited-file rewind FileHistoryStore — core's interface PLUS the service extras only the SQL twins
+ *  carry (optional so the local lane's core `FileFileHistoryStore` still fits). Replaces the retired E19
+ *  whole-tree `ServiceFileSnapshotStore` (design/381: the boundary covers the TRACKED set only — files this
+ *  session edited; there is no whole-tree manifest anymore). Also the 2c history-transfer store
+ *  (exportHistory/importHistory + the blob negotiation faces below). */
+export type ServiceFileHistoryStore = FileHistoryStore & {
+    /** 2c sync blob-face marker — see SqlFileHistoryStore.syncBlobFaces (codex R2-high: name-probing
+     *  `putBlob` on an arbitrary store collides with the local core store's PRIVATE void helper). */
+    syncBlobFaces?: true;
+    /** E21 purge / overwrite-dst sync wipe: drop the WHOLE scope incl. v1 baselines + DV-14 markers
+     *  (`reap(scope, [])` deliberately retains those while the scope lives — not a purge). SQL twins only. */
     deleteBySession?(scope: string): Promise<number>;
-    /** 2c session-sync DoS bound — GLOBALLY GC grace-window orphan blobs (standalone PUTs never imported, plus the
-     *  blobs reap()/deleteBySession() left orphaned — byte deletion is ASYNC, never on the sync purge path). The durable
-     *  twins carry it (scheduled by the main.ts reaper, error-tolerant → eventual consistency); core's InMemory omits it. */
+    /** Async byte-GC for the file_history_blob domain (orphans left by reap/purge/lost mint races; grace-window
+     *  protected — never a synchronous external-store delete). Reaper-driven; SQL twins only. */
     sweepOrphanBlobs?(): Promise<number>;
-    /** The subset of `hashes` already present — a cheap SQL INDEX probe (BOTH backends). Used by the §10 import
-     *  blob-presence pre-check (a HEAD/index check, NOT N full getBlob GETs). The durable twins carry it; optional. */
+    /** 2c blob negotiation: upload one content-addressed blob ahead of importHistory. SQL twins only. */
+    putBlob?(hash: string, bytes: Uint8Array): Promise<import("@sema-agent/core").FileHistoryResult>;
+    /** 2c blob read face (scope-checked by the route against the session's history graph). SQL twins only. */
+    getBlob?(hash: string): Promise<Uint8Array | undefined>;
+    /** The subset of `hashes` already present — a cheap SQL INDEX probe (the import presence pre-check,
+     *  never N full getBlob GETs). SQL twins only. */
     hasBlobs?(hashes: string[]): Promise<Set<string>>;
 };
 /** SVC-2 (core CORE-7) WorkflowJournalStore — core's interface PLUS the service `deleteByRun` (GC extra). tidb/pg =
@@ -160,9 +165,38 @@ export interface StoreBackend {
     /** E6 durable SessionPolicyStore (operator-tightened per-session tool rules). REQUIRED on all backends — works local
      *  (local = core's InMemorySessionPolicyStore), like resumeAnchor. Backs core's RunnerDeps.sessionPolicyStore. */
     sessionPolicy(): ServiceSessionPolicyStore;
-    /** E19 rewind-files FileSnapshotStore (working-tree snapshot/restore keyed by entryId; also the 2c artifact-transfer
-     *  store). REQUIRED on all backends (local = core's InMemoryFileSnapshotStore). Backs core's RunnerDeps.fileSnapshotStore. */
-    fileSnapshot(): ServiceFileSnapshotStore;
+    /** S-15 per-edited-file rewind FileHistoryStore (trackEdit/annulTrack/snapshot/restore over the tracked set;
+     *  also the 2c history-transfer store). REQUIRED on all backends (local = core's file-backed
+     *  `FileFileHistoryStore` under the data root). Backs core's RunnerDeps.fileHistoryStore. */
+    fileHistory(): ServiceFileHistoryStore;
+    /** design/383 §3.1 / S-50 §一(S-49 S-2):per-principal **memory-capture opt-out 授权表**
+     *  (`memory_optout_grant`)—— `RuntimeCaps.allowMemoryOptOut` 的本地 verdict 源(三层折叠:per-principal
+     *  行 → 部署缺省哨兵行 → 代码缺省 allow)+ `/v1/admin/memory-optout` 四端点的持久层。
+     *
+     *  🔴 **可选**(与 permissionRule 同族):SQL 后端 = 双方言 twin;`local` 车道 **undefined**,且缺席是一个
+     *  真答案 —— 没有 verdict 源时 `allowMemoryOptOut` 键不合成(core 读「无 per-principal 限制」,`open` 姿态
+     *  下 opt-out 照常生效),而 `MEMORY_CAPTURE_POLICY=governed` 在启动期对无源部署拒启
+     *  (`boot/runtime-caps.ts` `assertMemoryCapturePolicyWirable`)。刻意**不给 local 一个 in-memory twin**:
+     *  一条授权行是「operator 写下的合规事实」,进程内 Map 会在重启时静默丢掉它,下一次解析读到的是
+     *  「没有行 ⇒ 代码缺省 allow」—— 那是**放宽面**上的静默降级(permissionRule 那条禁令的同一理由)。
+     *  File 形候真实的 local+governed 部署需求出现再落(候需求档)。 */
+    memoryOptOutGrant(): MemoryOptOutGrantStore | undefined;
+    /** S-1 legacy-epoch discriminant (core `RunnerDeps.legacyRewindBoundaryProbe`): does the RETIRED whole-tree
+     *  snapshot epoch hold a boundary for (sessionId, entryId)? Reads the legacy `snapshot_manifest` table.
+     *  SQL backends only (local never had a whole-tree epoch table). Diagnostic input on the refusal path —
+     *  a probe that cannot tell answers undefined (reads exactly like an absent probe), never throws. */
+    legacyRewindBoundaryProbe?(query: {
+        sessionId: string;
+        entryId: string;
+    }): Promise<boolean | undefined>;
+    /** Retired-epoch byte hygiene: GC grace-passed orphan `snapshot_blob` rows/objects (rows the retention
+     *  lane's `snapshot_manifest` sweeps keep orphaning — without this leg their BYTES would outlive every
+     *  manifest reference forever, incl. MinIO objects). SQL backends only; reaper-driven. */
+    legacySnapshotBlobSweep?(): Promise<number>;
+    /** Retired-epoch right-to-delete: drop the session's LEGACY `snapshot_manifest` rows on the online E21
+     *  purge (the retention lane already sweeps them on expiry — the two delete legs must converge on the
+     *  same row set; a user's DELETE must reach old-epoch data too). Bytes go via the async legacy sweep. */
+    legacySnapshotPurge?(sessionId: string): Promise<number>;
     /** SVC-2 (core CORE-7) durable WorkflowJournalStore — the cross-replica resume journal for an LLM-authored workflow
      *  (RunWorkflowOptions.journalStore). REQUIRED on all backends (tidb/pg = durable twins; local = core's
      *  InMemoryWorkflowJournalStore, single-replica/in-process).
@@ -261,17 +295,13 @@ export interface StoreBackend {
      *  splits a fleet window into disjoint buckets = soft-limit leak). OPTIONAL: local backend omits (no fleet). */
     dbNowMs?(): Promise<number>;
 }
-/** (c)(clay 拍 a+c,2026-07-27)云形快照 blob 姿势门——boot 时调用(main.ts),纯函数可单测。
- *  SQL 后端(mysql|pg)把 blob 字节落 `snapshot_blob` 单行的形已被两役实证撞 mysql-协议包墙
- *  (D-1 附件 → 对象存储裁定;snapshot_blob >31MiB 同墙):大字节归对象存储。云形缺 MinIO ⇒
- *  fail-loud(启动了才是假安全);`SNAPSHOT_BLOB_ALLOW_SQL_BYTES=true` = 显式接受 SQL 店 +
- *  per-blob 帽(单机/测试台形)。local 后端不经此门(file/in-memory 快照店,无 SQL 包墙)。 */
+/** (c)(clay 拍 a+c,2026-07-27;S-15 换店后域=file_history_blob,门与旋钮名不变)云形 blob 姿势门——
+ *  boot 时调用(boot/stores.ts),纯函数可单测。SQL 后端(mysql|pg)把 blob 字节落单行的形已被两役
+ *  实证撞 mysql-协议包墙(D-1 附件 → 对象存储裁定):大字节归对象存储。per-file 历史的 blob=单文件
+ *  字节,同一堵墙(>6MiB 的被 track 文件在 TiDB 上落不进 SQL 行 ⇒ trackEdit 拒 ⇒ 默认 DV-14 下该次
+ *  编辑被拒)。云形缺 MinIO ⇒ fail-loud(启动了才是假安全);`SNAPSHOT_BLOB_ALLOW_SQL_BYTES=true` =
+ *  显式接受 SQL 店 + per-blob 帽(单机/测试台形)。local 后端不经此门(file 店,无 SQL 包墙)。 */
 export declare function assertCloudSnapshotBlobPosture(kind: "mysql" | "pg" | "local", config: Pick<ServiceConfig, "snapshotBlobStore" | "snapshotBlobAllowSql">): void;
-/** REWIND_SNAPSHOT_MAX_MB overrides ONLY the byte cap of core's DEFAULT_SNAPSHOT_BOUNDS (raise for
- *  big monorepos, lower for tight DBs). File-count / ignoreDirs stay core defaults — the knob answers the one
- *  field the 20G-workspace case needed; more knobs when a case shows up. Exported for tests
- *  (fractional-MB rounding + partial-merge semantics need a regression lock). */
-export declare function snapshotBoundsFromConfig(config: ServiceConfig): FileSnapshotBounds;
 /**
  * 启动日志里「跨副本 or 进程内」那一格的标签。
  *

package/dist/plugins/store-backend.js

@@ -1,22 +1,23 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { AdoptionError, FileStorageBackend, FileSessionRepo, DEFAULT_SNAPSHOT_BOUNDS } from "@sema-agent/core";
+import { AdoptionError, FileStorageBackend, FileSessionRepo } from "@sema-agent/core";
 import { FileWorkflowJournalStore } from "@sema-agent/core";
 import { TiDBOutcomeLedger, PgOutcomeLedger } from "./outcome-ledger-sql.js";
 import { FileOutcomeSink } from "./file-outcome-sink.js";
 import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJournalStore, PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore } from "./workflow-run-store-sql.js";
-import { FileRunStore } from "./file-run-store.js";
+import { FileRunStore, RunStoreStrictHydrateError } from "./file-run-store.js";
 import { LocalSessionStore } from "./local-session-store.js";
 import { LocalCheckpointStore } from "./local-checkpoint-store.js";
 import { FileResumeAnchorStore } from "./file-resume-anchor-store.js";
 import { TiDBApprovalExemptionStore, PgApprovalExemptionStore, FileApprovalExemptionStore } from "./approval-exemption-store.js";
 import { TiDBApprovalAskStore, PgApprovalAskStore } from "./approval-ask-store-sql.js";
 import { InMemoryApprovalAskStore } from "./approval-ask-store-memory.js";
+import { TiDBMemoryOptOutGrantStore, PgMemoryOptOutGrantStore } from "./memory-optout-grant-store-sql.js";
 import { TiDBSendFileLedger, PgSendFileLedger, FileSendFileLedger } from "./send-file-ledger.js";
 import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
 import { TiDBSessionPolicyStore, PgSessionPolicyStore } from "./session-policy-store-sql.js";
 import { TiDBWorkflowJournalStore, PgWorkflowJournalStore } from "./workflow-journal-store-sql.js";
-import { TiDBFileSnapshotStore, PgFileSnapshotStore } from "./file-snapshot-store-sql.js";
+import { TiDBFileHistoryStore, PgFileHistoryStore, FILE_HISTORY_BLOB_TABLE, FILE_HISTORY_BLOB_KEY_PREFIX } from "./file-history-store-sql.js";
 import { MinioBlobBackend, SqlBlobBackend } from "./blob-backend.js";
 import { createTidbPool, ensureSchema as ensureTidbSchema } from "./tidb-pool.js";
 import { createPgPool, ensurePgSchema, pgPoolOptions } from "./pg-pool.js";
@@ -41,7 +42,21 @@ import { TiDBRetentionLaneStore, PgRetentionLaneStore } from "./retention-lane-s
 import { createSqlPermissionRuleStores } from "./permission-rule-store-sql.js";
 import { createFilePermissionRuleStores } from "./permission-rule-store-file.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
-function snapshotBlobBackend(config, dialect, pool) {
+function historyBlobBackend(config, dialect, pool) {
+    const s = config.snapshotBlobStore;
+    if (!s)
+        return new SqlBlobBackend(dialect, pool, config.snapshotBlobSqlMaxBytes, FILE_HISTORY_BLOB_TABLE);
+    return new MinioBlobBackend({
+        endpoint: s.endpoint,
+        bucket: s.bucket,
+        accessKey: s.accessKey,
+        secretKey: s.secretKey,
+        ...(s.region ? { region: s.region } : {}),
+        keyPrefix: `${s.keyPrefix ?? ""}${FILE_HISTORY_BLOB_KEY_PREFIX}`,
+        ...(s.presignTtlSec ? { presignTtlSec: s.presignTtlSec } : {}),
+    }, { dialect, pool, table: FILE_HISTORY_BLOB_TABLE });
+}
+function legacyBlobBackend(config, dialect, pool) {
     const s = config.snapshotBlobStore;
     if (!s)
         return new SqlBlobBackend(dialect, pool, config.snapshotBlobSqlMaxBytes);
@@ -55,18 +70,51 @@ function snapshotBlobBackend(config, dialect, pool) {
         ...(s.presignTtlSec ? { presignTtlSec: s.presignTtlSec } : {}),
     }, { dialect, pool });
 }
+async function legacyProbeImpl(dialect, pool, query) {
+    try {
+        if (dialect === "tidb") {
+            const [rows] = await pool.query("SELECT 1 FROM snapshot_manifest WHERE scope = ? AND snap_key = ? LIMIT 1", [query.sessionId, query.entryId]);
+            return rows.length > 0;
+        }
+        const r = await pool.query("SELECT 1 FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2 LIMIT 1", [query.sessionId, query.entryId]);
+        return r.rows.length > 0;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function legacyPurgeImpl(dialect, pool, sessionId) {
+    if (dialect === "tidb") {
+        const [r] = await pool.query("DELETE FROM snapshot_manifest WHERE scope = ?", [sessionId]);
+        return Number(r.affectedRows ?? 0);
+    }
+    const r = await pool.query("DELETE FROM snapshot_manifest WHERE scope = $1", [sessionId]);
+    return r.rowCount ?? 0;
+}
+async function legacySweepImpl(config, dialect, pool) {
+    const sql = "SELECT blob_hash FROM snapshot_blob WHERE blob_hash NOT IN (SELECT blob_hash FROM snapshot_manifest)";
+    let orphans;
+    if (dialect === "tidb") {
+        const [rows] = await pool.query(sql);
+        orphans = rows.map((r) => String(r.blob_hash));
+    }
+    else {
+        const r = await pool.query(sql);
+        orphans = r.rows.map((row) => row.blob_hash);
+    }
+    if (orphans.length === 0)
+        return 0;
+    return legacyBlobBackend(config, dialect, pool).deleteBlobs(orphans);
+}
 export function assertCloudSnapshotBlobPosture(kind, config) {
     if (kind === "local" || config.snapshotBlobStore || config.snapshotBlobAllowSql)
         return;
-    throw new Error("cloud deployments (DB_BACKEND=mysql|pg) must configure object storage for snapshot blobs " +
+    throw new Error("cloud deployments (DB_BACKEND=mysql|pg) must configure object storage for rewind file-history blobs " +
         "(MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY): single-row SQL blob writes hit TiDB's " +
         "txn-entry-size-limit (default 6MiB) / the mysql-protocol packet limit (bytes belong in object storage — " +
         "same ruling as the D-1 attachment store). Single-box/test rigs may explicitly opt out with " +
-        "SNAPSHOT_BLOB_ALLOW_SQL_BYTES=true (a per-blob cap then applies; oversized blobs are rejected 413).");
-}
-export function snapshotBoundsFromConfig(config) {
-    const mb = config.rewindSnapshotMaxMb;
-    return mb !== undefined ? { ...DEFAULT_SNAPSHOT_BOUNDS, maxBytes: Math.round(mb * 1024 * 1024) } : DEFAULT_SNAPSHOT_BOUNDS;
+        "SNAPSHOT_BLOB_ALLOW_SQL_BYTES=true (a per-blob cap then applies; an over-cap tracked file's first-touch " +
+        "backup is refused typed, which under the default DV-14 policy refuses that edit).");
 }
 class TiDBBackend {
     pool;
@@ -85,7 +133,11 @@ class TiDBBackend {
     permissionRule() { return createSqlPermissionRuleStores(mysqlDriver(this.pool)); }
     sendFileLedger() { return new TiDBSendFileLedger(this.pool); }
     sessionPolicy() { return new TiDBSessionPolicyStore(this.pool); }
-    fileSnapshot() { return new TiDBFileSnapshotStore(this.pool, snapshotBlobBackend(this.config, "tidb", this.pool), snapshotBoundsFromConfig(this.config)); }
+    fileHistory() { return new TiDBFileHistoryStore(this.pool, historyBlobBackend(this.config, "tidb", this.pool), this.config.fileHistory); }
+    memoryOptOutGrant() { return new TiDBMemoryOptOutGrantStore(this.pool); }
+    legacyRewindBoundaryProbe(query) { return legacyProbeImpl("tidb", this.pool, query); }
+    legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "tidb", this.pool); }
+    legacySnapshotPurge(sessionId) { return legacyPurgeImpl("tidb", this.pool, sessionId); }
     workflowJournal() { return new TiDBWorkflowJournalStore(this.pool); }
     outcomeSink() { return new TiDBOutcomeLedger(this.pool); }
     workflowRun(onWarn) { return new TiDBWorkflowRunStore(this.pool, onWarn); }
@@ -126,7 +178,11 @@ class PgBackend {
     permissionRule() { return createSqlPermissionRuleStores(pgDriver(this.pool)); }
     sendFileLedger() { return new PgSendFileLedger(this.pool); }
     sessionPolicy() { return new PgSessionPolicyStore(this.pool); }
-    fileSnapshot() { return new PgFileSnapshotStore(this.pool, snapshotBlobBackend(this.config, "pg", this.pool), snapshotBoundsFromConfig(this.config)); }
+    fileHistory() { return new PgFileHistoryStore(this.pool, historyBlobBackend(this.config, "pg", this.pool), this.config.fileHistory); }
+    memoryOptOutGrant() { return new PgMemoryOptOutGrantStore(this.pool); }
+    legacyRewindBoundaryProbe(query) { return legacyProbeImpl("pg", this.pool, query); }
+    legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "pg", this.pool); }
+    legacySnapshotPurge(sessionId) { return legacyPurgeImpl("pg", this.pool, sessionId); }
     workflowJournal() { return new PgWorkflowJournalStore(this.pool); }
     outcomeSink() { return new PgOutcomeLedger(this.pool); }
     workflowRun(onWarn) { return new PgWorkflowRunStore(this.pool, onWarn); }
@@ -169,7 +225,7 @@ class LocalBackend {
         try {
             this.fileBackend = new FileStorageBackend({
                 root,
-                ...(config.rewindSnapshotMaxMb !== undefined ? { snapshotBounds: { maxBytes: Math.round(config.rewindSnapshotMaxMb * 1024 * 1024) } } : {}),
+                ...(config.fileHistory !== undefined ? { fileHistory: config.fileHistory } : {}),
                 onCorruptRead: (info) => this.onWarn?.("file_store_corrupt_read", {
                     path: info.path,
                     reason: info.reason,
@@ -178,7 +234,7 @@ class LocalBackend {
                     note: "a durable read was treated as ABSENT because the bytes were unreadable (never a plain ENOENT). " +
                         "Consequence depends on which store read it: session-policy = that run lost its SUBTRACTIVE session-rule " +
                         "layer (deployment policy / hooks / shell gate still applied); session repo = a listing silently omitted " +
-                        "rows; file-snapshot = a snapshot or scope read as missing. Inspect the named path before deciding.",
+                        "rows; file-history = a rewind boundary or scope read as missing. Inspect the named path before deciding.",
                 }),
             });
         }
@@ -191,6 +247,7 @@ class LocalBackend {
         this.sessionStore = new LocalSessionStore(new FileSessionRepo(this.fileBackend.root), this.fileBackend.root);
         this.runStore = new FileRunStore(this.fileBackend.root, {
             error: (msg, fields) => void (this.onError ?? this.onWarn)?.(msg, fields),
+            strictHydrate: config.runStoreStrictHydrate,
         });
         this.resumeAnchorStore = new FileResumeAnchorStore(this.fileBackend.root);
         this.approvalExemptionStore = new FileApprovalExemptionStore(this.fileBackend.root);
@@ -240,7 +297,8 @@ class LocalBackend {
     }
     checkpointStoreInst;
     sessionPolicy() { return this.fileBackend.sessionPolicyStore; }
-    fileSnapshot() { return this.fileBackend.fileSnapshotStore; }
+    fileHistory() { return this.fileBackend.fileHistoryStore; }
+    memoryOptOutGrant() { return undefined; }
     workflowJournal() { return this.workflowJournalStore; }
     outcomeSink() { return this.outcomeSinkInst; }
     session() { return this.sessionStore; }
@@ -275,6 +333,8 @@ export async function openStoreBackendWithFallback(config, logger) {
     catch (err) {
         if (err instanceof AdoptionError)
             throw err;
+        if (err instanceof RunStoreStrictHydrateError)
+            throw err;
         if (!mayFallback)
             throw err;
         logger.warn("store_db_unreachable_fallback_memory", {

package/dist/plugins/store-contracts.d.ts

@@ -30,9 +30,11 @@ export interface RunRecord {
     /** Which SYSTEM's credential submitted the run (oa/cc-mcp/portal…), derived at the auth gate — never
      *  self-declared. null = legacy single-token deployment (authenticated, no system identity). */
     source: string | null;
-    /** The replica that OWNS this run (the instanceId that created it). Lets a preempt/cancel handler tell
-     *  "this run is on MY replica" (consult the in-process inflight/preemptable map authoritatively) from "owned
-     *  elsewhere" (fall back to the durable cross-replica flag). null for pre-column rows. */
+    /** The replica currently HOLDING this run — written at createRun and TAKEN OVER by markResuming (S-51: a
+     *  cross-replica resume moves the seat, so a reader comparing it with its own instanceId is asking "is the
+     *  live leg here NOW", not "who minted the row"). Lets a preempt/cancel/steer handler tell "this run is on
+     *  MY replica" (consult the in-process inflight/steerable map authoritatively) from "held elsewhere" (fall
+     *  back to the durable cross-replica flag). null for pre-column rows. */
     instanceId: string | null;
     /** First ~120 chars of the objective (secret-redacted at write) — the list's "what is this task" glance.
      *  null for rows predating the column. */

package/dist/plugins/task-list-store-sql.d.ts

@@ -33,7 +33,7 @@ export declare function ensurePgTaskListSchema(q: (text: string, params?: unknow
  * 语义 = 「这个 listKey 的清单**不存在过**」:item 行 + meta 行(高水位 `next_id` / 插入序
  * `next_sort`)一并抹掉。⚠️ **meta 行必须一起删**:留着它,同一个 listKey 被重新登记后
  * (会话 id 由调用方自选、删除后可被别人 `register`)新主的第一条任务会从旧主的高水位续号 ——
- * 那是一条跨化身的信息泄漏(「上一位在这里建过 47 条」)。
+ * 那是一条跨化身的信息外泄(「上一位在这里建过 47 条」)。
  *
  * 事务内先对 meta 行 `FOR UPDATE`(与 `mutate` 同一把分区锁)⇒ 与并发的清单写串行,不会删到
  * 一半被插回新行。meta 行不在(从未写过任何任务)= 无锁可拿,DELETE 命中 0 行,幂等。

package/dist/plugins/tidb-pool.js

@@ -1,5 +1,6 @@
 import mysql from "mysql2/promise";
 import { TIDB_APPROVAL_ASK_STATEMENTS } from "./approval-ask-store-sql.js";
+import { TIDB_MEMORY_OPTOUT_GRANT_STATEMENTS } from "./memory-optout-grant-store-sql.js";
 import { TIDB_LEADER_RUN_STATEMENTS } from "./leader-run-store-sql.js";
 import { TIDB_ADOPTION_LOG_STATEMENTS } from "./adoption-log-sql.js";
 import { TIDB_PERMISSION_RULE_STATEMENTS } from "./permission-rule-store-sql.js";
@@ -335,6 +336,63 @@ export const SCHEMA_STATEMENTS = [
      created_at DATETIME(3) NOT NULL,
      PRIMARY KEY (blob_hash),
      KEY idx_snapshot_blob_created (created_at)
+   ) COLLATE utf8mb4_bin`,
+    `CREATE TABLE IF NOT EXISTS file_history_scope (
+     scope         VARCHAR(64) NOT NULL,
+     created_at_ms BIGINT      NOT NULL,
+     PRIMARY KEY (scope)
+   ) COLLATE utf8mb4_bin`,
+    `CREATE TABLE IF NOT EXISTS file_history_tracked (
+     scope          VARCHAR(64)  NOT NULL,
+     key_hash       CHAR(64)     NOT NULL,
+     track_key      TEXT         NOT NULL,
+     key_kind       VARCHAR(16)  NOT NULL,
+     key_family     VARCHAR(8)   NOT NULL,
+     base_available TINYINT(1)   NOT NULL,
+     observed_later TINYINT(1)   NOT NULL DEFAULT 0,
+     created_at_ms  BIGINT       NOT NULL,
+     PRIMARY KEY (scope, key_hash)
+   ) COLLATE utf8mb4_bin`,
+    `CREATE TABLE IF NOT EXISTS file_history_version (
+     scope        VARCHAR(64) NOT NULL,
+     key_hash     CHAR(64)    NOT NULL,
+     version      INT         NOT NULL,
+     blob_hash    CHAR(64)    NULL,
+     mode         INT         NULL,
+     parent_ident TEXT        NULL,
+     backup_time  VARCHAR(40) NOT NULL,
+     PRIMARY KEY (scope, key_hash, version),
+     KEY idx_file_history_version_blob (blob_hash)
+   ) COLLATE utf8mb4_bin`,
+    `CREATE TABLE IF NOT EXISTS file_history_boundary (
+     scope           VARCHAR(64) NOT NULL,
+     entry_id        VARCHAR(64) NOT NULL,
+     published_at_ms BIGINT      NOT NULL,
+     publish_seq     BIGINT      NOT NULL,
+     PRIMARY KEY (scope, entry_id),
+     UNIQUE KEY uq_file_history_boundary_seq (scope, publish_seq)
+   ) COLLATE utf8mb4_bin`,
+    `CREATE TABLE IF NOT EXISTS file_history_boundary_file (
+     scope    VARCHAR(64) NOT NULL,
+     entry_id VARCHAR(64) NOT NULL,
+     key_hash CHAR(64)    NOT NULL,
+     version  INT         NOT NULL,
+     PRIMARY KEY (scope, entry_id, key_hash),
+     KEY idx_file_history_bf_key (scope, key_hash)
+   ) COLLATE utf8mb4_bin`,
+    `CREATE TABLE IF NOT EXISTS file_history_reaped_entry (
+     scope        VARCHAR(64) NOT NULL,
+     entry_id     VARCHAR(64) NOT NULL,
+     reaped_at_ms BIGINT      NOT NULL,
+     PRIMARY KEY (scope, entry_id)
+   ) COLLATE utf8mb4_bin`,
+    `CREATE TABLE IF NOT EXISTS file_history_blob (
+     blob_hash  CHAR(64)    NOT NULL,
+     byte_len   BIGINT      NOT NULL,
+     bytes      LONGBLOB    NULL,
+     created_at DATETIME(3) NOT NULL,
+     PRIMARY KEY (blob_hash),
+     KEY idx_file_history_blob_created (created_at)
    ) COLLATE utf8mb4_bin`,
     `CREATE TABLE IF NOT EXISTS workflow_journal (
      run_id        VARCHAR(191) NOT NULL,
@@ -530,6 +588,7 @@ export const SCHEMA_STATEMENTS = [
      PRIMARY KEY (pool)
    ) COLLATE utf8mb4_bin`,
     ...TIDB_APPROVAL_ASK_STATEMENTS,
+    ...TIDB_MEMORY_OPTOUT_GRANT_STATEMENTS,
     ...TIDB_LEADER_RUN_STATEMENTS,
     `CREATE TABLE IF NOT EXISTS shared_memory_scope (
      -- 一个 org scope 一行。行缺席 = 该 org 从未开通 ⇒ 语义等价于 connected 且零 store(不是故障)。

package/dist/plugins/web-search.d.ts

@@ -98,7 +98,7 @@ export declare function createWebSearchBackend(cfg: WebSearchBackendConfig): Web
  *
  * 🔴 [2240] cli 逐串直证:3.18.0 我加了 `searxngParams` 字段和消费点,**却没开任何配置入口** ——
  * 两条门都没有位置填它,于是我在 [2239] 说的「这条是给你们的」是句空话。单测直接构造
- * `WebSearchBackendConfig` 传进去,**天然绕过了配置入口这一层**,于是「能力在」与「配得进」之间
+ * `WebSearchBackendConfig` 传进去,**天然跳过了配置入口这一层**,于是「能力在」与「配得进」之间
  * 断开,而两边的绿都是真的。判据:**按消费端实际能填的那个入口验,不是按自己构造的对象验。**
  *
  * 形状:`k=v` 用 `;` 分隔(`engines=bing,duckduckgo;language=zh-CN`)——值里本来就常含逗号,

package/dist/prompts-domain-validate.js

@@ -22,7 +22,7 @@ function declarationIssue(d, where) {
         return `${where}: contentHash is required (sha256:<64hex> — the epoch declaration axis needs it for byte-level change detection)`;
     const expected = `sha256:${createHash("sha256").update(o.text).digest("hex")}`;
     if (o.contentHash !== expected)
-        return `${where}: contentHash does not match sha256(text) — stale or tampered declaration`;
+        return `${where}: contentHash does not match sha256(text) — stale or altered declaration`;
     return undefined;
 }
 export function validateCenterPrompts(raw) {

package/dist/resource-suspend.d.ts

@@ -13,7 +13,7 @@
  * remote VM — ORPHANING both (the run row is terminal, so nothing resumes them). So a resource-limit hit on a
  * verify/cascade task must FAIL CLEANLY (no suspend), exactly as before the flag. This exclusion is the SAME
  * boundary the `preemptSignal` wiring enforces in runs.ts (stream-path only), so eligibility and the signal stay
- * aligned. (Adversarial review wtyc7ist3 HIGH finding: without this, enabling RESOURCE_SUSPEND leaks a suspended
+ * aligned. (Cross review wtyc7ist3 HIGH finding: without this, enabling RESOURCE_SUSPEND leaks a suspended
  * VM + checkpoint on every verify/cascade task that hits a resource limit.)
  */
 export declare function resourceSuspendOptIn(opts: {

package/dist/resource-window.d.ts

@@ -31,7 +31,7 @@
  *  · **新世代必须清**:session purge 后客户端合法复用自带 taskId 重提交 —— {@link recordResourceWindow}
  *    每次先删后写,于是「新腿没窗」不会读到旧腿的窗(`turn-activity` codex S1-F2 同款陷阱)。
  *
- * 【已声明的代价:每次 poll 一次全量账本读(codex 对抗复审 R2-[medium],如实登记、本批不修)】
+ * 【已声明的代价:每次 poll 一次全量账本读(codex 交叉复审 R2-[medium],如实登记、本批不修)】
  * {@link buildCrossSliceUsage} 要对**全部** `model_usage` 行求和 ⇒ 调用点(`routes/runs.ts` 的 poll)在
  * 窗已登记时每拍读一次 `getEvents(taskId, 0)`,工作量随「轮询次数 × 已积累事件数」增长。三条限幅是**结构性**
  * 的,不是「应该很少见」:① **只有登记过窗的 run 才读**(没开三旋钮的部署、以及 verify/cascade 腿,一次都不读);
@@ -70,7 +70,7 @@ export interface CrossSliceUsage {
  */
 export declare function recordResourceWindow(taskId: string, rs: TaskSpec["resourceSuspend"] | undefined): void;
 /**
- * **续跑腿**的登记(与 {@link recordResourceWindow} 分家,codex 对抗复审 R2-[high] 验真后修)。
+ * **续跑腿**的登记(与 {@link recordResourceWindow} 分家,codex 交叉复审 R2-[high] 验真后修)。
  *
  * 🔴 三根旋钮在续跑腿上的下场**不同**,所以登记法也必须不同(S-3 已成文的上游契约,此处是它的读面孪生):
  *  · `totalTokens` / `totalBudgetUsd` —— core **冻在账本上**(`debitLedger` 逐字 `prior ?? total`)。
@@ -85,7 +85,7 @@ export declare function recordResumeResourceWindow(taskId: string, rs: TaskSpec[
 /**
  * 本副本记得的跨片窗;无记录 ⇒ `undefined`(缺席语义见顶注:「无法证明」,不是「没有窗」)。
  *
- * 🔴 **读命中会刷新插入序**(codex 对抗复审 R1-[high] 的逐出半场,验真后修):终局的 run **不主动清**
+ * 🔴 **读命中会刷新插入序**(codex 交叉复审 R1-[high] 的逐出半场,验真后修):终局的 run **不主动清**
  * (与 `turn-activity.ts` 同理由:主动清会制造「done 已打点、行还没翻终态」窗口里的假缺席),于是纯
  * 写序 FIFO 下,一条长跑的 run 会被它之后的 8192 条**早已终局**的记录挤掉 —— 恰好挤掉唯一还需要这份
  * 数据的那一条。改成「按读刷新」= 真 LRU:被 poll 的(=活着且有人看的)那条永远是最年轻的。