@sema-agent/server 7.52.1 → 7.53.0

package/dist/plugins/session-policy-store-sql.d.ts

@@ -4,7 +4,7 @@ import type { Pool as PgPool } from "pg";
 import { type SqlDriver } from "./sql-driver.js";
 /** `session_policy.policy_key` 的**唯一铸造点**(core 复合键的 sha256)。
  *
- *  🔴 导出而不是让收编腿再抄一份(clay 宪法「schema 单一属主禁复制」):design/183 form b 的身份重绑要
+ *  🔴 导出而不是让收编腿再抄一份(clay 宪法「schema 单一属主禁复制」):[ref] form b 的身份重绑要
  *  逐行重算这把键(身份在 hash 的**原像**里,等值 UPDATE 够不着)。两处各写一遍 sha256 表达式的下场是
  *  某天有人在这里改了 key 公式而收编腿还在按旧式算 —— 迁完的行从此谁也读不到,且**静默**。 */
 export declare const policyKeyFor: (sessionId: string, principal: string | undefined) => string;
@@ -14,7 +14,7 @@ export declare class SqlSessionPolicyStore implements SessionPolicyStore {
     constructor(db: SqlDriver);
     /** Pick the dialect's SQL text. Both statements stay written out at the call site ON PURPOSE. */
     private q;
-    /** 判据属主 = `sql-errors.ts`(A-032 P1-①;本站点旧形已是并集形,收编后语义不变)。 */
+    /** 判据属主 = `sql-errors.ts`([ref] P1-①;本站点旧形已是并集形,收编后语义不变)。 */
     private isDupKey;
     /** Read the stored rules for (session, principal-owner); null when none (parity with InMemory). */
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;

package/dist/plugins/session-store.d.ts

@@ -14,7 +14,7 @@ export declare function createSessionStore(config: ServiceConfig, backend?: Stor
     inc(name: string, labels?: Record<string, string>, n?: number): void;
 }): SessionStore;
 /**
- * core 1.382(design/153,[1561] 提货单①②)`SubagentToolOptions.background.ensureChildSessionDurable`
+ * core 1.382([ref],[ref] 提货单①②)`SubagentToolOptions.background.ensureChildSessionDurable`
  * 的实现体——从 main.ts 装配点抽出为可独立测试的纯函数(main.ts 里的其余装配闭包历来无单测覆盖,
  * 这条因为承载真实的 park/veto 裁决,拆出来直接钉)。
  *
@@ -27,7 +27,7 @@ export declare function createSessionStore(config: ServiceConfig, backend?: Stor
  * (F-7 案:让"真会话在 transient"赢过"host 店里的同 id 空壳"),会把"只在 transient 店有真内容"误判成
  * "host 店已经有了"。这里要问的是纯粹"host 店本身是否已经有这份真内容",必须绕开那层路由。
  *
- * 🔴 [1575] F3(cli 复查抓获,真红确认)调用方前提——**本函数假设 `hostStore.release()` 是"归还租约"
+ * 🔴 [ref] F3(cli 复查抓获,真红确认)调用方前提——**本函数假设 `hostStore.release()` 是"归还租约"
  * 语义(不销毁内容)**,这对 core `TiDBSessionStore` 成立(`release()` 逐字注释「Durable history is
  * retained; just drop any in-flight cache entry」),但对无 repo 构造的 `TtlSessionStore`(`createSessionStore`
  * 在 `SESSION_BACKEND !== "tidb"` 时返回的那种)**不成立**——那个店形的 `release()` 是整删会话
@@ -39,7 +39,7 @@ export declare function createSessionStore(config: ServiceConfig, backend?: Stor
  */
 export declare function ensureSessionDurable(hostStore: SessionStore, sessionId: string): Promise<void>;
 /**
- * [1593] 主动晋升版 ensureChildSessionDurable(cli TiDB 真机撞获:1.263 的只查不迁形在拆店生产形下
+ * [ref] 主动晋升版 ensureChildSessionDurable(cli TiDB 真机撞获:1.263 的只查不迁形在拆店生产形下
  * 恒否决 park——bg 子会话住 subRunner 私有 TTL 店、从不在 host 店,core 收 veto 即 expire checkpoint
  * (14ms~2s)+ settle failed,赎回窗口不存在):
  *   1. 快路:已在 host 店且有真内容 → 直接通过(幂等/重入)。

package/dist/plugins/shared-memory-store-sql.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/177 — the SQL `SharedMemoryStoreProvider`: the deployment's ORG-scoped shared memory libraries
+ * [ref] — the SQL `SharedMemoryStoreProvider`: the deployment's ORG-scoped shared memory libraries
  * (`memory_list` / `memory_read`), served out of the durable store instead of a BYOM host callback.
  *
  * ─────────────────────────────────────────────────────────────────────────────────────────────────
@@ -12,7 +12,7 @@
  * is the DEPLOYMENT's admin plane (migrations, an import job, an operator face) and is deliberately
  * NOT reachable from any model-facing surface in this repo.
  *
- * 🔴 ORG PLANE ≠ THE LOCAL MEMORY CHAIN (设计 182 §13). `agent_memory_engine_*` (the design/138
+ * 🔴 ORG PLANE ≠ THE LOCAL MEMORY CHAIN (设计 182 §13). `agent_memory_engine_*` (the [ref]
  * MemoryEngine) and these three tables share NOTHING: no join, no view, no shared row, no shared
  * scope registry. The local chain is an entry-transactional index injection with a write path; this
  * one is a read-only document library. Bridging them in EITHER direction would let harvested private
@@ -135,7 +135,7 @@ export declare function assertScopeKey(scopeKey: string): void;
 export declare function assertDocumentPath(path: string): void;
 /**
  * The dual-dialect implementation. Every statement is written out in BOTH texts at its call site
- * (design/158 A12 判据:方言差异必须显式) — the `q(tidbSql, pgSql)` helper never builds one text.
+ * ([ref] A12 判据:方言差异必须显式) — the `q(tidbSql, pgSql)` helper never builds one text.
  */
 export declare class SqlSharedMemoryStore implements SharedMemoryStoreProvider {
     private readonly db;
@@ -156,7 +156,7 @@ export declare class SqlSharedMemoryStore implements SharedMemoryStoreProvider {
     /**
      * 盘状态 + 库登记,**一个事务一个快照**(轮2 F3 修)。
      *
-     * 🔴 A-010.11(两臂不对称,验真后修):此前 PG 臂显式抬隔离级别、**MySQL 臂只靠服务端默认值**,
+     * 🔴 [ref](两臂不对称,验真后修):此前 PG 臂显式抬隔离级别、**MySQL 臂只靠服务端默认值**,
      * 注里写的是「MySQL/TiDB 的默认隔离级别就是 REPEATABLE READ ⇒ 天然同快照」。那句话对**默认配置**
      * 为真,但 `transaction_isolation` 是可设的服务端/会话变量:一台跑 READ COMMITTED 的实例(托管
      * MySQL 的厂商默认、中间层代理、运维手改)会把「一个事务一个快照」悄悄降成「每条语句各自取快照」,
@@ -203,7 +203,7 @@ export declare class SqlSharedMemoryStore implements SharedMemoryStoreProvider {
      * Remove one document. Scope-fenced like {@link putDocument} (a stale delete must not reach a
      * successor tenant's library). Returns whether a row was actually there.
      *
-     * 🔴 A-010.14(验真后修):此前围栏是**两条独立语句** —— `assertOwnedBy()` 先查一次登记表,然后另
+     * 🔴 [ref](验真后修):此前围栏是**两条独立语句** —— `assertOwnedBy()` 先查一次登记表,然后另
      * 起一条 DELETE。它自称与 `putDocument` 对齐,但 `putDocument` 的检查与写是**同事务同行锁**
      * (`FOR UPDATE`),而这里的两条语句之间有一道真窗:登记检查通过之后、DELETE 发出之前,另一个 org
      * 完成 `deleteStore` + `putStore` 的 id 复用,这条 DELETE 就落进**继任租户**的库里删掉他们的文档。

package/dist/plugins/sql-driver.d.ts

@@ -1,6 +1,6 @@
 /**
  * Backend-NEUTRAL SQL exec/transaction seam for the "single-file dual-dialect" store collapses
- * (design/158 A12 定型半场). Sibling of `sql-escape.ts` / `sql-row-helpers.ts` / `store-contracts.ts`:
+ * ([ref] A12 定型半场). Sibling of `sql-escape.ts` / `sql-row-helpers.ts` / `store-contracts.ts`:
  * a leaf module with ZERO store logic, so a collapsed pair never has to load the other dialect's
  * adapter to reach a driver call.
  *
@@ -19,7 +19,7 @@
  *   - WHICH unique key collided (mysql2 `sqlMessage` text vs pg `err.constraint`) — that lives with
  *     the store that needs it, because the attribution rule is store-specific, not driver-generic.
  *     ⚠️ The dup-key predicate ITSELF is NOT store-specific and no longer lives at the call sites:
- *     `sql-errors.ts` owns it (A-032 P1-①; 7+ hand-rolled copies had drifted into three different
+ *     `sql-errors.ts` owns it ([ref] P1-①; 7+ hand-rolled copies had drifted into three different
  *     recognition sets, so the same driver error got opposite verdicts in different stores).
  *   - per-query timeouts: mysql2 takes `{sql, timeout}` while node-pg takes a `QueryConfig` with
  *     `query_timeout`. The counter family (write-behind-counter.ts) needs those and keeps its own
@@ -31,7 +31,7 @@
  * divergence is visible rather than hidden inside `begin()`.
  *
  * ─────────────────────────────────────────────────────────────────────────────────────────────────
- * REPLICATION PLAYBOOK — collapsing the remaining tidb-/pg- twin pairs (design/158 A12)
+ * REPLICATION PLAYBOOK — collapsing the remaining tidb-/pg- twin pairs ([ref] A12)
  * ─────────────────────────────────────────────────────────────────────────────────────────────────
  * Reference collapses: image-bake-store-sql.ts (class + transactions) and checkpoint-store-sql.ts
  * (class, no transactions). Function-style stores follow task-list-store-sql.ts instead (inline
@@ -64,7 +64,7 @@
  *   (sqlMessage vs err.constraint; the dup-key predicate itself = `sql-errors.ts`) · PG-only protocol-byte handling
  *   (pgSafeJsonStringify / pgProtocolJsonStringify / pgSanitizeText / pgHasUnstorable) · DDL. Each arm's
  *   BEHAVIOR (what pgSafeJsonStringify/pgProtocolJsonStringify actually do to the bytes) stays written out
- *   in `pg-safe-json.ts`, untouched — `dialectJsonEncoder`/`dialectProtocolJsonEncoder` below (design/158
+ *   in `pg-safe-json.ts`, untouched — `dialectJsonEncoder`/`dialectProtocolJsonEncoder` below ([ref]
  *   redesign①) only collect the identical `dialect === "tidb" ? JSON.stringify(v) : pgSafe…(v)` DISPATCH
  *   ternary that five call sites duplicated verbatim; they are not a new abstraction over the encodings
  *   themselves, so this does not violate the rule above.
@@ -94,7 +94,7 @@ export interface SqlTxConn extends SqlExec {
     /** TiDB: `BEGIN PESSIMISTIC` (current-read txn). PG: plain `BEGIN`. */
     beginPessimistic(): Promise<void>;
     /**
-     * Open a transaction whose reads are pinned to ONE snapshot (A-010.11).
+     * Open a transaction whose reads are pinned to ONE snapshot ([ref]).
      *
      * 🔴 Why this is a named verb and not "just `begin()` — MySQL defaults to REPEATABLE READ anyway":
      * a *server default* is not a structural guarantee. `transaction_isolation` is a settable
@@ -125,13 +125,13 @@ export interface SqlDriver extends SqlExec {
 export declare function mysqlDriver(pool: MySqlPool): SqlDriver;
 /** PostgreSQL driver. Transaction control is issued as STATEMENTS (node-pg has no native verbs). */
 export declare function pgDriver(pool: PgPool): SqlDriver;
-/** design/158 redesign① — the "safe" JSON-column encoder DISPATCH (run-store/outcome-ledger's identical
+/** [ref] redesign① — the "safe" JSON-column encoder DISPATCH (run-store/outcome-ledger's identical
  *  ternary, collected): TiDB stores `JSON.stringify` verbatim; PG goes through `pgSafeJsonStringify`'s
  *  protocol-byte defenses (a raw NUL/lone-surrogate would otherwise throw mid-write). Returns a 1-arg
  *  encoder; call sites invoke `dialectJsonEncoder(this.db.dialect)(value)` inline — the dispatch is the
  *  collected thing, not a cached field. */
 export declare const dialectJsonEncoder: (dialect: SqlDialect) => ((v: unknown) => string);
-/** design/158 redesign① — the "protocol" JSON-column encoder DISPATCH (approval-store/checkpoint-store's
+/** [ref] redesign① — the "protocol" JSON-column encoder DISPATCH (approval-store/checkpoint-store's
  *  identical ternary, collected): TiDB stores `JSON.stringify` verbatim (the `label` arg is ignored on that
  *  arm — TiDB has no protocol-byte envelope to name); PG goes through `pgProtocolJsonStringify(v, label)`,
  *  whose `label` names the field in its error text on an unstorable-byte reject. */

package/dist/plugins/sql-errors.d.ts

@@ -1,5 +1,5 @@
 /**
- * SQL 驱动错误的**方言判别**——「这是不是唯一键冲突」的单一属主(A-032 P1-①,病族
+ * SQL 驱动错误的**方言判别**——「这是不是唯一键冲突」的单一属主([ref] P1-①,病族
  * single-semantic-multi-site-drift)。`sql-escape.ts` / `sql-row-helpers.ts` / `store-contracts.ts`
  * 的同级叶子:零 store 逻辑、零驱动依赖(不 import mysql2/pg),纯谓词。
  *
@@ -50,7 +50,7 @@ export declare const MYSQL_ER_BAD_FIELD_CODE = "ER_BAD_FIELD_ERROR";
  * 🔴 单一属主的理由与 {@link isDupKeyError} 逐字同源(本文件顶注的 single-semantic-multi-site-drift):
  * 判据一旦复制,两处的识别集就会各自漂,而这条谓词的错判方向**特别贵** —— 它守的是一句**破坏性**的
  * 错误指路(「去 DROP TABLE」)。超时、连接重置、取消、资源不足、列级权限被拒、表整个不存在,每一种
- * 都会让探针抛错;把它们诊断成「删表重建」比它要挡的缺陷更贵(#340 codex 交叉复审 round2/round3
+ * 都会让探针抛错;把它们诊断成「删表重建」比它要挡的缺陷更贵([ref] codex 交叉复审 round2/round3
  * [high] 两轮收窄后的终形)。认不出的一律**不是**缺列(fail-safe:宁可把一次真缺列报成原始错误)。
  *
  * MySQL 侧两个归因键都认(mysql2 的 `code`/`errno` 是同一件事的两种写法),与 dup-key 那条同姿势。

package/dist/plugins/sql-escape.d.ts

@@ -1,5 +1,5 @@
 /**
- * Backend-NEUTRAL SQL string escaping (design/158 A3 沉底).
+ * Backend-NEUTRAL SQL string escaping ([ref] A3 沉底).
  *
  * Lives in its own leaf so no adapter has to load another dialect's adapter module to get a pure
  * string transform (the PG stores used to runtime-import the TiDB tool-result store for exactly

package/dist/plugins/sql-row-helpers.d.ts

@@ -1,5 +1,5 @@
 /**
- * Shared pure row-mapping helpers for the SQL store twins (design/158 S8 纯 helper 归位).
+ * Shared pure row-mapping helpers for the SQL store twins ([ref] S8 纯 helper 归位).
  *
  * These were duplicated verbatim across the pg-/tidb- store twin pairs; each store imports the flavor
  * it was written against (usually under its historical local alias, e.g. `parseJsonStrict as

package/dist/plugins/store-backend.d.ts

@@ -1,6 +1,6 @@
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import type { SessionStore, SessionPolicyStore, FileHistoryStore, WorkflowJournalStore, ToolResultStore } from "@sema-agent/core";
+import type { SessionStore, SessionPolicyStore, FileHistoryStore, WorkflowJournalStore, ToolResultStore, SessionCaptureRecordStore } from "@sema-agent/core";
 import { type OutcomeSink } from "./file-outcome-sink.js";
 import { type InboxWarn } from "./workflow-run-store-sql.js";
 import { FileRunStore } from "./file-run-store.js";
@@ -38,16 +38,16 @@ export type RunStore = TiDBRunStore | PgRunStore | FileRunStore;
  *  FileResumeAnchorStore is the FILE-backed local twin (P0.5 variant-1; survives restart). */
 export type ResumeAnchorStore = TiDBResumeAnchorStore | PgResumeAnchorStore | FileResumeAnchorStore;
 export type { ApprovalExemptionStore } from "./approval-exemption-store.js";
-/** #151(design/172 v3.1 §3.0-§3.2 流内审批协议持久层):`ApprovalAskStore` 接口 + 行/补丁类型。
+/** [ref]([ref] v3.1 §3.0-§3.2 流内审批协议持久层):`ApprovalAskStore` 接口 + 行/补丁类型。
  *  车3 刀 3a 起 `StoreBackend.approvalAsk()` 已在(见接口体的那条注)。 */
 export type { ApprovalAskStore, AskRow, NewAskRow, AskTransitionPatch, DecideAskInput, DecideResult, ExpireResult, BindGateInput, BatchRow, AskDecision } from "./approval-ask-store-sql.js";
 /** E6 SessionPolicyStore — core's interface PLUS the service `deleteBySession` (E21 purge; only the durable twins carry
  *  it, core's InMemory omits it → optional). tidb/pg = durable twins; local = core's InMemorySessionPolicyStore (works
  *  local — rules need no cloud-only infra). The shared env-gated equivalence suite keeps the twins byte-matched to InMemory. */
 export type ServiceSessionPolicyStore = SessionPolicyStore;
-/** S-15 per-edited-file rewind FileHistoryStore — core's interface PLUS the service extras only the SQL twins
+/** [ref] per-edited-file rewind FileHistoryStore — core's interface PLUS the service extras only the SQL twins
  *  carry (optional so the local lane's core `FileFileHistoryStore` still fits). Replaces the retired E19
- *  whole-tree `ServiceFileSnapshotStore` (design/381: the boundary covers the TRACKED set only — files this
+ *  whole-tree `ServiceFileSnapshotStore` ([ref]: the boundary covers the TRACKED set only — files this
  *  session edited; there is no whole-tree manifest anymore). Also the 2c history-transfer store
  *  (exportHistory/importHistory + the blob negotiation faces below). */
 export type ServiceFileHistoryStore = FileHistoryStore & {
@@ -92,7 +92,7 @@ export type ServiceWorkflowJournalStore = WorkflowJournalStore & {
 };
 export type ImageIndex = TiDBImageIndex | PgImageIndex;
 export type ImageBake = TiDBImageBake | PgImageBake;
-/** #193 车4 件1:durable leader-run 登记表的双方言孪生(union 同族——TS 私有字段让具体类名义上不同)。 */
+/** [ref] 车4 件1:durable leader-run 登记表的双方言孪生(union 同族——TS 私有字段让具体类名义上不同)。 */
 export type LeaderRunStore = TiDBLeaderRunStore | PgLeaderRunStore;
 /** The FULL checkpoint store (core CheckpointStore + the service operator-queue/ctx methods listPending/
  *  listByScope/findPendingTokenBySession/peekPendingScope/putCtx/getCtx/reapCtx) — the SQL twins carry them,
@@ -129,7 +129,7 @@ export interface StoreBackend {
     /** Per-session per-toolName approval exemption ("本会话不再询问") — an approval MEMORY the F4
      *  ask-gate consults after deny/neverAuto. REQUIRED on all backends (works local, like resumeAnchor). */
     approvalExemption(): ApprovalExemptionStore;
-    /** #151(design/172 §3.0-§3.2)流内审批协议持久层:每个流内工具调用一行的 ask 状态机 + 批行。
+    /** [ref]([ref] §3.0-§3.2)流内审批协议持久层:每个流内工具调用一行的 ask 状态机 + 批行。
      *  REQUIRED on all backends — tidb/pg = SQL 双方言 twin;local = {@link InMemoryApprovalAskStore}。
      *
      *  🔴 local 形的代价必须在这里说清楚(而不是留给读者自己发现):InMemory 的 STREAM_PENDING/DECIDED/
@@ -144,7 +144,7 @@ export interface StoreBackend {
      *  D1 逐字现行为(store 缺席 = 现行 `tool_approval` 活卡腿一字不变)。 */
     approvalAsk(): ApprovalAskStoreType;
     /**
-     * #154 车二(core 5.18.0 design/179 + 5.22.0 design/182):**持久化权限规则店**(「不再询问」车道)
+     * [ref] 车二(core 5.18.0 [ref] + 5.22.0 [ref]):**持久化权限规则店**(「不再询问」车道)
      * 三面 —— 规则桶 provider / durable 审批记录 / server 自铸的 CC 导入票。
      *
      * 🔴 **可选**(与上面那些 REQUIRED 家族不同),缺席是一个真答案:core 的 `RunnerDeps.permissionRuleStore`
@@ -153,7 +153,7 @@ export interface StoreBackend {
      *
      * `local` 车道**刻意不给 in-memory twin**:一条规则是「人授权过的持久事实」,进程内 Map 形会在重启时
      * 静默丢掉那份授权,而消费端(下一次同命令的 ask)读到的是「没有规则」——那是**放宽面**上的静默降级。
-     * ✅ **#203 §1 已落 File 形**(那条注写下的解除条件逐字是「先落 File 形,core 现成
+     * ✅ **[ref] §1 已落 File 形**(那条注写下的解除条件逐字是「先落 File 形,core 现成
      * `FilePermissionRuleStoreProvider` 即可当模子」——本车照办):`local` 现在返回一个**跨重启存活**的
      * 三面束,storeWired 在单机车道上真为 true。in-memory twin 的禁令不变,它禁的是「会遗忘的店」,
      * 不是「单机的店」。
@@ -165,11 +165,11 @@ export interface StoreBackend {
     /** E6 durable SessionPolicyStore (operator-tightened per-session tool rules). REQUIRED on all backends — works local
      *  (local = core's InMemorySessionPolicyStore), like resumeAnchor. Backs core's RunnerDeps.sessionPolicyStore. */
     sessionPolicy(): ServiceSessionPolicyStore;
-    /** S-15 per-edited-file rewind FileHistoryStore (trackEdit/annulTrack/snapshot/restore over the tracked set;
+    /** [ref] per-edited-file rewind FileHistoryStore (trackEdit/annulTrack/snapshot/restore over the tracked set;
      *  also the 2c history-transfer store). REQUIRED on all backends (local = core's file-backed
      *  `FileFileHistoryStore` under the data root). Backs core's RunnerDeps.fileHistoryStore. */
     fileHistory(): ServiceFileHistoryStore;
-    /** design/383 §3.1 / S-50 §一(S-49 S-2):per-principal **memory-capture opt-out 授权表**
+    /** [ref] §3.1 / [ref] §一([ref] S-2):per-principal **memory-capture opt-out 授权表**
      *  (`memory_optout_grant`)—— `RuntimeCaps.allowMemoryOptOut` 的本地 verdict 源(三层折叠:per-principal
      *  行 → 部署缺省哨兵行 → 代码缺省 allow)+ `/v1/admin/memory-optout` 四端点的持久层。
      *
@@ -181,6 +181,19 @@ export interface StoreBackend {
      *  「没有行 ⇒ 代码缺省 allow」—— 那是**放宽面**上的静默降级(permissionRule 那条禁令的同一理由)。
      *  File 形候真实的 local+governed 部署需求出现再落(候需求档)。 */
     memoryOptOutGrant(): MemoryOptOutGrantStore | undefined;
+    /** [ref]②([ref] §2.1b,core 7.0.2 [ref] 件2):会话 capture opt-out **记录**的 SQL 载体
+     *  (`session_capture_optout`)—— core `RunnerDeps.memoryCaptureRecordStore` /
+     *  `MemoryEngineOptions.captureRecordStore` 的持久层(Promise 形三腿)。与 §3.1 的**授权表**不是一个轴:
+     *  那张管「谁**可以** opt-out」(operator 写的 verdict),这张管「谁**已经** opt-out」(用户写的一次性
+     *  单向记录)。
+     *
+     *  🔴 **可选**(与 memoryOptOutGrant 同族):SQL 后端 = 双方言 twin;`local` 车道 **undefined**,且缺席是
+     *  一个真答案 —— 缺席时 core 用它的控制面文件三腿(`fileSessionCaptureRecordStore`),单机部署上那正是
+     *  重启可存活的正确载体(383 §2.1b:「absent = 文件三腿,单进程/单机字节不变」)。SQL 载体要解决的病
+     *  只在无状态多副本形:文件记录对 resume 副本不可见,「record not found」恰朝**继续采集**方向坏。
+     *  刻意不给 local 一个 SQL/内存 twin:内存形会在重启时把一条隐私记录静默丢掉(比文件三腿严格更差),
+     *  文件形 core 已自带。 */
+    sessionCaptureRecords(): SessionCaptureRecordStore | undefined;
     /** S-1 legacy-epoch discriminant (core `RunnerDeps.legacyRewindBoundaryProbe`): does the RETIRED whole-tree
      *  snapshot epoch hold a boundary for (sessionId, entryId)? Reads the legacy `snapshot_manifest` table.
      *  SQL backends only (local never had a whole-tree epoch table). Diagnostic input on the refusal path —
@@ -207,9 +220,9 @@ export interface StoreBackend {
      *  run_workflow tool deps (`dist/orchestration/run-workflow-tool.d.ts:65`), and the boot chain consumes it
      *  end-to-end: built in `boot/workflow-orchestration.ts` (`const workflowJournalStore = …backend.workflowJournal()`),
      *  threaded into RunnerDeps (`boot/runner-deps.ts` 的 `workflowJournalStore`), reaped on the maintenance tick
-     *  (`boot/reapers.ts` 同名字段), and read by `GET /v1/workflows/:id/journal` (`http/routes/workflows.ts`, [1402]). */
+     *  (`boot/reapers.ts` 同名字段), and read by `GET /v1/workflows/:id/journal` (`http/routes/workflows.ts`, [ref]). */
     workflowJournal(): ServiceWorkflowJournalStore;
-    /** design/73 §1 consumption sink for `RunnerDeps.onTaskOutcome` facts. REQUIRED on all backends:
+    /** [ref] §1 consumption sink for `RunnerDeps.onTaskOutcome` facts. REQUIRED on all backends:
      *  tidb/pg = the outcome-ledger twins (SQL rows, mapped via coreOutcomeToLedgerRow + verbatim core_outcome
      *  JSON); local = an owner-only JSONL File sink. Read-only v1 — records facts, drives no policy. */
     outcomeSink(): OutcomeSink;
@@ -224,7 +237,7 @@ export interface StoreBackend {
     /** Cloud-only stores below are OPTIONAL: the `local` (in-memory/file) backend omits them (it has no core
      *  in-memory twin carrying the service extras, and these are fleet/multi-replica concepts), so a local HTTP
      *  service degrades EXACTLY like today's no-DB env (the consumers gate on `backend?.X?.()`). TiDB/PG provide all. */
-    /** design/177 —— org 共享记忆库的供给面(core `RunnerDeps.sharedMemoryStores` + `/v1/shared-memory/*`
+    /** [ref] —— org 共享记忆库的供给面(core `RunnerDeps.sharedMemoryStores` + `/v1/shared-memory/*`
      *  只读面)。授权折叠**注入**:谁属于哪个 org 归 server 的目录面判,持久层只按判决出的 scope 集查表。
      *
      *  🔴 local 车道诚实缺席(不是"待补"):这个面的全部意义是**跨用户**共享一个团队库,而 local 后端是
@@ -239,7 +252,7 @@ export interface StoreBackend {
     imageIndex?(): ImageIndex;
     imageBake?(): ImageBake;
     /**
-     * #193 车4 件1(台账 P1-9):durable leader-run 登记表。**SQL 后端专有**,`local` 刻意省略。
+     * [ref] 车4 件1(台账 P1-9):durable leader-run 登记表。**SQL 后端专有**,`local` 刻意省略。
      *
      * 🔴 local 缺席不是欠账、也不是「以后补个 File 形」:leader run 是 N worker fan-out + 真 git push,
      * 而 config 层已经把「LEADER_ENABLED=true 且无外部 SQL 店」整个组合**拒启**了(件2 门②)——
@@ -256,7 +269,7 @@ export interface StoreBackend {
      */
     device?(): DeviceStore;
     /**
-     * #270 —— 托管留存的**破坏性**三方法(core `ManagedRetentionCapability` 的 server 侧真身)。
+     * [ref] —— 托管留存的**破坏性**三方法(core `ManagedRetentionCapability` 的 server 侧真身)。
      * **SQL 后端专有**,`local` 刻意省略:那三条腿是跨十余张表的单事务级联,file/in-memory 形没有事务面
      * 也没有那些表,所以它诚实声明 `retention:"none"`(见 `local-session-store.ts` 的同款注)。
      *
@@ -266,7 +279,7 @@ export interface StoreBackend {
      */
     retention?(opts: SqlRetentionStoreOptions): SqlRetentionStore;
     /**
-     * #270 车2 —— 留存执行面的**非破坏性**半场:sweep 租约、legal-hold 的放置/解除、审计表的读与
+     * [ref] 车2 —— 留存执行面的**非破坏性**半场:sweep 租约、legal-hold 的放置/解除、审计表的读与
      * 非破坏行的写。同样 SQL 专有(它写的三张表只在 SQL schema 里)。
      *
      * 🔴 与上一格**分家**是有意的:拿到本对象的消费方(operator 路由)结构上删不掉任何业务数据。
@@ -285,7 +298,7 @@ export interface StoreBackend {
     /** S3-TOB(设计 §1.4):the raw PG pool for the memory-engine DB backend's PgQueryFn binding (mirror of
      *  mysqlPool). undefined on non-PG backends. */
     pgPool(): PgPool | undefined;
-    /** design/183 form b(纯身份重绑)的 SQL 收编日志。**SQL 后端专有**(mysql/pg),`local` 刻意省略:
+    /** [ref] form b(纯身份重绑)的 SQL 收编日志。**SQL 后端专有**(mysql/pg),`local` 刻意省略:
      *  收编重绑的是**多租身份轴**,而 local 后端整个数据根就属那一个用户、库里没有 owner/scope 分区面
      *  ——在那儿开这道口只会让一个够不到任何东西的动作看起来可用。消费点按 `backend?.adoptionLog?.()`
      *  缺席即 501(诚实拒绝),与其它云专有 store 同姿势。 */
@@ -295,7 +308,7 @@ export interface StoreBackend {
      *  splits a fleet window into disjoint buckets = soft-limit leak). OPTIONAL: local backend omits (no fleet). */
     dbNowMs?(): Promise<number>;
 }
-/** (c)(clay 拍 a+c,2026-07-27;S-15 换店后域=file_history_blob,门与旋钮名不变)云形 blob 姿势门——
+/** (c)(clay 拍 a+c,2026-07-27;[ref] 换店后域=file_history_blob,门与旋钮名不变)云形 blob 姿势门——
  *  boot 时调用(boot/stores.ts),纯函数可单测。SQL 后端(mysql|pg)把 blob 字节落单行的形已被两役
  *  实证撞 mysql-协议包墙(D-1 附件 → 对象存储裁定):大字节归对象存储。per-file 历史的 blob=单文件
  *  字节,同一堵墙(>6MiB 的被 track 文件在 TiDB 上落不进 SQL 行 ⇒ trackEdit 拒 ⇒ 默认 DV-14 下该次
@@ -319,7 +332,7 @@ export declare function counterStoreLabel(store: unknown, kind: string | undefin
  *  reachability probe is the caller's first `ensureSchema`). Returns undefined when no DB is configured.
  *
  *  `onWarn` (additive, optional) is the boot-time warning sink the LOCAL backend needs for core's
- *  permission-rule DISCLOSURE face (#203 §1): an unreadable / checksum-mismatched / symlinked rule file
+ *  permission-rule DISCLOSURE face ([ref] §1): an unreadable / checksum-mismatched / symlinked rule file
  *  answers ZERO rules and says so — swallowing that turns a fail-closed degrade into a silent one.
  *  `onError` (additive, optional; F-D) is the **error-level** twin of that seat — 件6 的
  *  `file_run_store_hydrate_unreadable` 按成文承诺是 error 级,warn 座满足不了那句话。两座都是**加项**:

package/dist/plugins/store-backend.js

@@ -13,6 +13,7 @@ import { TiDBApprovalExemptionStore, PgApprovalExemptionStore, FileApprovalExemp
 import { TiDBApprovalAskStore, PgApprovalAskStore } from "./approval-ask-store-sql.js";
 import { InMemoryApprovalAskStore } from "./approval-ask-store-memory.js";
 import { TiDBMemoryOptOutGrantStore, PgMemoryOptOutGrantStore } from "./memory-optout-grant-store-sql.js";
+import { TiDBSessionCaptureRecordStore, PgSessionCaptureRecordStore } from "./session-capture-record-store-sql.js";
 import { TiDBSendFileLedger, PgSendFileLedger, FileSendFileLedger } from "./send-file-ledger.js";
 import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
 import { TiDBSessionPolicyStore, PgSessionPolicyStore } from "./session-policy-store-sql.js";
@@ -135,6 +136,7 @@ class TiDBBackend {
     sessionPolicy() { return new TiDBSessionPolicyStore(this.pool); }
     fileHistory() { return new TiDBFileHistoryStore(this.pool, historyBlobBackend(this.config, "tidb", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new TiDBMemoryOptOutGrantStore(this.pool); }
+    sessionCaptureRecords() { return new TiDBSessionCaptureRecordStore(this.pool); }
     legacyRewindBoundaryProbe(query) { return legacyProbeImpl("tidb", this.pool, query); }
     legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "tidb", this.pool); }
     legacySnapshotPurge(sessionId) { return legacyPurgeImpl("tidb", this.pool, sessionId); }
@@ -180,6 +182,7 @@ class PgBackend {
     sessionPolicy() { return new PgSessionPolicyStore(this.pool); }
     fileHistory() { return new PgFileHistoryStore(this.pool, historyBlobBackend(this.config, "pg", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new PgMemoryOptOutGrantStore(this.pool); }
+    sessionCaptureRecords() { return new PgSessionCaptureRecordStore(this.pool); }
     legacyRewindBoundaryProbe(query) { return legacyProbeImpl("pg", this.pool, query); }
     legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "pg", this.pool); }
     legacySnapshotPurge(sessionId) { return legacyPurgeImpl("pg", this.pool, sessionId); }
@@ -299,6 +302,7 @@ class LocalBackend {
     sessionPolicy() { return this.fileBackend.sessionPolicyStore; }
     fileHistory() { return this.fileBackend.fileHistoryStore; }
     memoryOptOutGrant() { return undefined; }
+    sessionCaptureRecords() { return undefined; }
     workflowJournal() { return this.workflowJournalStore; }
     outcomeSink() { return this.outcomeSinkInst; }
     session() { return this.sessionStore; }

package/dist/plugins/store-contracts.d.ts

@@ -1,5 +1,5 @@
 /**
- * Backend-NEUTRAL store contracts (design/158 A3 沉底).
+ * Backend-NEUTRAL store contracts ([ref] A3 沉底).
  *
  * The record/event/summary shapes (and the pure row-mapping helpers) shared by ALL store backends —
  * TiDB/MySQL, PostgreSQL, file, memory — plus their non-store consumers (http wire, trace, images,
@@ -30,7 +30,7 @@ export interface RunRecord {
     /** Which SYSTEM's credential submitted the run (oa/cc-mcp/portal…), derived at the auth gate — never
      *  self-declared. null = legacy single-token deployment (authenticated, no system identity). */
     source: string | null;
-    /** The replica currently HOLDING this run — written at createRun and TAKEN OVER by markResuming (S-51: a
+    /** The replica currently HOLDING this run — written at createRun and TAKEN OVER by markResuming ([ref]: a
      *  cross-replica resume moves the seat, so a reader comparing it with its own instanceId is asking "is the
      *  live leg here NOW", not "who minted the row"). Lets a preempt/cancel/steer handler tell "this run is on
      *  MY replica" (consult the in-process inflight/steerable map authoritatively) from "held elsewhere" (fall
@@ -46,7 +46,7 @@ export interface RunRecord {
  * 「这一行已经走到**终局**了吗」——`RunRecord["status"]`(= `"running" | TaskStatus`)的**穷举**判据,
  * 与类型定义同住一个文件(词表的属主 = 判据的属主)。
  *
- * 🔴 为什么是 `switch` 而不是一张 `ReadonlySet<string>`(2026-08-08,#176 二轮扫描 finding):终局词表
+ * 🔴 为什么是 `switch` 而不是一张 `ReadonlySet<string>`(2026-08-08,[ref] 二轮扫描 finding):终局词表
  * **真变过**(core 5.8.0 把 `"timeout"` 从 `TaskStatus` 里删了)。而集合形的门对象是 `string`,对词表
  * 两个方向都无钉:
  *   · **增词**(core 新加一个终局态)⇒ 集合不含它 ⇒ 该行被静默判成「非终局」,收敛器会一直等一个
@@ -69,7 +69,7 @@ export declare function isTerminalRunStatus(status: RunRecord["status"]): boolea
  * resource_limit 门)与 `needs_review`(`plan_review` / dry-run 拦截门,写点 = 各 store 的
  * `setNeedsReview`)。两者的行为面**完全一致**:行还活着、`task_active` claim 还占着、checkpoint 还能被
  * 决议。凡是「行是不是还停着」的判断只手抄 `=== "suspended"` 的地方,对 plan_review 腿一律给出**相反**
- * 结论 —— 它会被当成终局:取消谎报 "already terminal — no-op"(claim 从此无人释放,正是 [868] 那个把会话
+ * 结论 —— 它会被当成终局:取消谎报 "already terminal — no-op"(claim 从此无人释放,正是 [ref] 那个把会话
  * 锁死的指纹)、trace 面无帧、leader 面不触发 park 反应。这条判据的存在就是为了不再有第三次手抄。
  *
  * 未知词的方向与 {@link isTerminalRunStatus} 同向保守:判**不是** park。理由是消费点会据此做**不可逆**
@@ -176,7 +176,7 @@ export interface BakeTerminal {
     manifestSha?: string | null;
     tag?: string | null;
 }
-/** Raw SELECT row shape shared by BOTH SQL twins (design/158 S8 归位, A3 沉底 —
+/** Raw SELECT row shape shared by BOTH SQL twins ([ref] S8 归位, A3 沉底 —
  *  node-pg reads BIGINT-ish `exit_code` back as a string, hence `number | string | null`). */
 export interface BakeRow {
     bake_id: string;
@@ -207,9 +207,9 @@ export interface BakeRow {
     created_at: Date | string;
     updated_at: Date | string;
 }
-/** SELECT row → {@link BakeRecord} — shared by BOTH SQL twins (design/158 S8 归位, A3 沉底). */
+/** SELECT row → {@link BakeRecord} — shared by BOTH SQL twins ([ref] S8 归位, A3 沉底). */
 export declare function mapBakeRow(r: BakeRow): BakeRecord;
-/** Column list mapBakeRow expects — shared by BOTH SQL twins (design/158 S8 归位, A3 沉底). */
+/** Column list mapBakeRow expects — shared by BOTH SQL twins ([ref] S8 归位, A3 沉底). */
 export declare const BAKE_SELECT_COLS: string;
 /** Nested-build security posture (the operator console shows rootless vs privileged-dind). */
 export type ImageNestedBuildMode = "none" | "docker-cli-only" | "rootless-buildkit" | "privileged-dind";
@@ -275,7 +275,7 @@ export interface ImageListFilter extends ImageViewer {
     /** Opaque keyset cursor from a prior page's `nextCursor`. */
     cursor?: string;
 }
-/** Raw SELECT row shape shared by BOTH SQL twins (design/158 S8 归位, A3 沉底 —
+/** Raw SELECT row shape shared by BOTH SQL twins ([ref] S8 归位, A3 沉底 —
  *  node-pg reads BIGINT `size_bytes` back as a string, hence `number | string | null`). */
 export interface ImageRow {
     id: string;
@@ -300,6 +300,6 @@ export interface ImageRow {
     created_at: Date | string;
     updated_at: Date | string;
 }
-/** SELECT row → {@link ImageIndexEntry} — shared by BOTH SQL twins (design/158 S8 归位, A3 沉底). */
+/** SELECT row → {@link ImageIndexEntry} — shared by BOTH SQL twins ([ref] S8 归位, A3 沉底). */
 export declare function mapImageRow(r: ImageRow): ImageIndexEntry;
 //# sourceMappingURL=store-contracts.d.ts.map

package/dist/plugins/task-list-store-sql.d.ts

@@ -4,7 +4,7 @@ import { type TaskListStore } from "@sema-agent/core";
 export declare const TASK_LIST_META_TABLE = "task_list_meta";
 export declare const TASK_LIST_ITEM_TABLE = "task_list_item";
 /**
- * #318 `sessionId ↦ 本表的身份键`:`session:<可读前缀>-<sha256(sessionId) 前 16 位>`。
+ * [ref] `sessionId ↦ 本表的身份键`:`session:<可读前缀>-<sha256(sessionId) 前 16 位>`。
  *
  * 🔴 为什么不直接把 sessionId 当 listKey:sessionId 是**调用方可自报**的不透明串(提交门
  * `http/server.ts` 只卡 ≤64 **字符** —— [#15] 刻意的宽松提交契约,不卡字节数也不卡字符集)。
@@ -17,7 +17,7 @@ export declare const TASK_LIST_ITEM_TABLE = "task_list_item";
  * 判据:确定性(同 sessionId 跨副本/跨重启恒同键)、字节安全(纯 ASCII,≤ 8+24+1+16 = 49 字节)、
  * 抗碰撞(摘要取**全串**,可读前缀只为运维肉眼对账)。
  *
- * `session:` 是**命名空间**位:design/147 §6 D2 的团队共享清单将来若按 team 分区,两族键同表不撞。
+ * `session:` 是**命名空间**位:[ref] §6 D2 的团队共享清单将来若按 team 分区,两族键同表不撞。
  * 同族先例 = `env-facts.ts` 的 `scratchpadSessionSegment`(文件名面)——刻意**不**复用彼此的实现:
  * 一个键空间改了算法不该把另一个键空间的存量行全孤儿化。
  *
@@ -28,7 +28,7 @@ export declare function taskListKeyFor(sessionId: string): string;
 export declare function ensureTiDBTaskListSchema(pool: MySqlPool): Promise<void>;
 export declare function ensurePgTaskListSchema(q: (text: string, params?: unknown[]) => Promise<unknown>): Promise<void>;
 /**
- * 整份清单删除(#318 / E21 会话删除级联;codex R1-[high] 验真后加)。
+ * 整份清单删除([ref] / E21 会话删除级联;codex R1-[high] 验真后加)。
  *
  * 语义 = 「这个 listKey 的清单**不存在过**」:item 行 + meta 行(高水位 `next_id` / 插入序
  * `next_sort`)一并抹掉。⚠️ **meta 行必须一起删**:留着它,同一个 listKey 被重新登记后

package/dist/plugins/tidb-cost-quota.d.ts

@@ -1,15 +1,15 @@
 /**
- * Cross-replica per-key CUMULATIVE cost quota (design/30 P0-1). A thin {@link QuotaTracker} over the
+ * Cross-replica per-key CUMULATIVE cost quota ([ref] P0-1). A thin {@link QuotaTracker} over the
  * shared {@link WriteBehindCounter}: atomic write-behind aggregation, eventually consistent (SOFT
  * limiting — boundary overspend is bounded by the flush interval and backstopped by the HARD per-task
- * `maxCostUsd` gate). `scope_key` is opaque (principal today; team/feature later — design/30 N3).
+ * `maxCostUsd` gate). `scope_key` is opaque (principal today; team/feature later — [ref] N3).
  */
 import type { Pool } from "mysql2/promise";
 import type { QuotaDecision, QuotaLimits, QuotaTracker } from "../observability/cost-quota.js";
 import { type CounterDegradeHook } from "./write-behind-counter.js";
 export declare class TiDBCostQuota implements QuotaTracker {
     private readonly counter;
-    /** #322:限额=比较参数(行里只有花费);窗长换代经 counter.setWindowMs(桶键语义见那里)。 */
+    /** [ref]:限额=比较参数(行里只有花费);窗长换代经 counter.setWindowMs(桶键语义见那里)。 */
     private limitMicroUsd;
     private refreshRequested;
     private refreshIntervalMs;

package/dist/plugins/tidb-pool.js

@@ -1,6 +1,7 @@
 import mysql from "mysql2/promise";
 import { TIDB_APPROVAL_ASK_STATEMENTS } from "./approval-ask-store-sql.js";
 import { TIDB_MEMORY_OPTOUT_GRANT_STATEMENTS } from "./memory-optout-grant-store-sql.js";
+import { TIDB_SESSION_CAPTURE_OPTOUT_STATEMENTS } from "./session-capture-record-store-sql.js";
 import { TIDB_LEADER_RUN_STATEMENTS } from "./leader-run-store-sql.js";
 import { TIDB_ADOPTION_LOG_STATEMENTS } from "./adoption-log-sql.js";
 import { TIDB_PERMISSION_RULE_STATEMENTS } from "./permission-rule-store-sql.js";
@@ -258,6 +259,13 @@ export const SCHEMA_STATEMENTS = [
      -- 可见)+ 基数截断。NULL = 无供给(规则车道没武装 / 命令说不出规则 / 这只 ask 规则清不掉),读口
      -- 据此省键而不是铸空数组。
      rule_suggestions TEXT       NULL,
+     -- has_bidi_controls(S-30① / #356②;core 5.60.0 #438):bidi **在场位** —— core 在 park mint 写在
+     -- pendingAction(tool_approval 臂)上的那一位,put() 反范式成列,listPending 据它给 /v1/approvals 与
+     -- /v1/approvals/stream 的行铸 hasBidiControls:true(此前耐久运维队列一个位都没有:同一张卡
+     -- 「活着看得到告警、park 之后看不到」)。取值 **1 或 NULL、恒不写 0**:core 的契约是 true 或缺席
+     -- (缺席 = 没检出 ≠ 干净),一个 0 会把「没检出」谎成「已确认干净」。老行(本列诞生前 park 的)
+     -- NULL ⇒ 读口省键。clay 批 2026-07-26 TINYINT(1) 归一先例:布尔列 TiDB 侧 TINYINT(1)。
+     has_bidi_controls TINYINT(1) NULL,
      PRIMARY KEY (token),
      KEY idx_checkpoint_status_deadline (status, deadline),
      KEY idx_checkpoint_session_status (session_id, status)
@@ -589,6 +597,7 @@ export const SCHEMA_STATEMENTS = [
    ) COLLATE utf8mb4_bin`,
     ...TIDB_APPROVAL_ASK_STATEMENTS,
     ...TIDB_MEMORY_OPTOUT_GRANT_STATEMENTS,
+    ...TIDB_SESSION_CAPTURE_OPTOUT_STATEMENTS,
     ...TIDB_LEADER_RUN_STATEMENTS,
     `CREATE TABLE IF NOT EXISTS shared_memory_scope (
      -- 一个 org scope 一行。行缺席 = 该 org 从未开通 ⇒ 语义等价于 connected 且零 store(不是故障)。

package/dist/plugins/tidb-rate-limiter.d.ts

@@ -1,5 +1,5 @@
 /**
- * Cross-replica per-key request rate limiter (design/30 P0-2) — a thin {@link RateGate} over the shared
+ * Cross-replica per-key request rate limiter ([ref] P0-2) — a thin {@link RateGate} over the shared
  * {@link WriteBehindCounter}. Like the in-memory {@link RateLimiter}, `check` both COUNTS the request
  * and decides; here the count is summed fleet-wide via atomic write-behind aggregation.
  *
@@ -13,7 +13,7 @@ import type { RateDecision, RateGate, RateLimits } from "../observability/rate-l
 import { type CounterDegradeHook } from "./write-behind-counter.js";
 export declare class TiDBRateLimiter implements RateGate {
     private readonly counter;
-    /** 🔴 #322:限额是比较参数、不是行状态(SQL 腿的行里只有计数),所以换代只动它,库里一行都不用碰。 */
+    /** 🔴 [ref]:限额是比较参数、不是行状态(SQL 腿的行里只有计数),所以换代只动它,库里一行都不用碰。 */
     private limit;
     /** 装配点表达过的运维意图(「这条腿该有刷新环」)。关断哨兵靠它把环真正停掉/重开 —— 0 态零 SQL。 */
     private refreshRequested;

package/dist/plugins/tidb-session-storage.d.ts

@@ -8,7 +8,7 @@ import type { Pool } from "mysql2/promise";
  *   only if the branch leaf is still what the entry was built against. Two stateless runners that both
  *   woke the same session can't silently fork — the loser gets `SessionError("conflict")` (catch with
  *   `isSessionConflict`), with the `(session_id, seq)` primary key as the backstop for a racing writer
- *   that grabbed the same seq. (A-071 件2 更正:`leaf_seq` **不是**判据 —— 它是无条件的 `SET leaf_seq =
+ *   that grabbed the same seq. ([ref] 件2 更正:`leaf_seq` **不是**判据 —— 它是无条件的 `SET leaf_seq =
  *   leaf_seq + 1` 计数器,在同一事务内重读出来给事件铸 `seq`,从不进 WHERE。)
  * - The in-memory base tree is the wake-time snapshot; every write is also mirrored into it so the
  *   live harness keeps reading a consistent view. Wake is **bounded** to `[floor .. leaf]` (F3,
@@ -20,7 +20,7 @@ export declare class TiDBSessionStorage extends BaseSessionStorage {
     private readonly floorSeq;
     constructor(pool: Pool, sessionId: string, metadata: SessionMetadata, entries: SessionTreeEntry[], leafId: string | null, floorEntryId?: string | null, floorSeq?: number);
     /**
-     * [976] S3 RB-14 pull seam — `SessionStorage.getEpochAnchor?()`: the nearest epoch carrier BELOW the
+     * [ref] S3 [ref] pull seam — `SessionStorage.getEpochAnchor?()`: the nearest epoch carrier BELOW the
      * bounded-wake floor. core's `Session.getPromptEpoch()` (≥1.305) calls this only when the in-window
      * branch walk finds no carrier — i.e. a rewind/resumeAt cut inside the kept tail, where the compaction
      * restatement is a DESCENDANT of the cut and the root pin sits under the floor. Semantics per core's