@sema-agent/server 7.52.1 → 7.54.0

package/dist/plugins/session-capture-record-store-sql.d.ts

@@ -0,0 +1,99 @@
+/**
+ * [ref] seam②([ref] §2.1b,core 7.0.2 [ref] 件2;黑板 [ref]/[ref]/[ref] 键形对齐)——
+ * **会话 capture opt-out 记录的 SQL 载体** `session_capture_optout`:core `SessionCaptureRecordStore`
+ * 的 Promise 形实现。SINGLE-FILE DUAL-DIALECT([ref] A12 形,照 memory-optout-grant-store-sql.ts:
+ * 一个 `SqlSessionCaptureRecordStore` 接 `SqlDriver`,两个薄 ctor 子类落方言绑定)。
+ *
+ * ── 为什么要这只店(core layout.d.ts §2.1b 原文方向)────────────────────────────────────────────
+ * core 缺省载体 = 控制面文件三腿(`fileSessionCaptureRecordStore`)。无状态多副本部署上文件形对 resume
+ * 副本不可见 ——「record not found」恰好朝**继续采集**的方向坏(server F1 点名的形)。SQL 载体让一条
+ * 一次性隐私记录跨副本存活;供给它同时是 §2.1b 的能力信号:远端车道的 `capture:"off"` 声明从
+ * 409 `config.memory_capture_unsupported` 稳态转为真持久([ref] 前的稳态自此解除)。
+ *
+ * ── 三腿逐腿失败法(core 契约,dist layout.d.ts + 文件三腿实现逐字亲读;引擎消费点 engine.js 亲读)──
+ *   · `mark` **create-only / first-record-wins,恒不 reject**:dup-key ⇒ `"existed"`(幂等重宣告,
+ *     第一条记录赢 —— 恒不 UPDATE);其余任何失败(断连/超时/超宽键)⇒ `"unpersisted"`
+ *     (383 §2.8:只存在于进程内的 opt-out 会被第一次 resume 打破,「没落住」是具名拒绝,调用方必须
+ *     拒跑 —— 永不静默降级)。引擎侧对 rejection 也折 `"unpersisted"`(engine.js mark 的 `.then(settle,
+ *     () => "unpersisted")`),本店仍自行 catch:契约写在店上,不赖调用方兜底。
+ *   · `read` **fail-closed**:行在而解不出 ⇒ 返回**合成记录**(句式与 core 文件腿逐字同形 ——
+ *     损坏不许把一条隐私请求洗回采集);无行 ⇒ `undefined`(缺席才是「采集开」);存在性本身不可立
+ *     (SQL 故障)⇒ **reject**(引擎 catch 折 INDETERMINATE fault 轴:故障永不谎报成「用户请求过」,
+ *     也永不谎报成「没有记录」)。
+ *   · `list` 枚举失败 ⇒ **reject**(读不出的名册不是空名册 —— consolidation 资格臂据此 fail-closed 拒整理,
+ *     engine.consolidationEligibility 亲读);单行解不出 ⇒ 合成记录(绝不静默漏行:漏一行 = 蒸馏器放大
+ *     一条作者要求扣留的内容)。
+ *
+ * ── 键形法:**编码规范形**(codex R2-[high] 验真后改形;grant 店的「形状拒」在这里是错的)────────
+ * 提交面把 sessionId 定为**任意不透明串**(server.ts submit 门:「LENGTH-ONLY — NOT a uuidv7 shape
+ * check」,≤64 字符,run-local `--session` / 匿名分享 id 等都合法)——带空白/控制字符的 id 是**在契约内**
+ * 的真会话,店若按字节形状拒它,后果=该会话在 SQL 部署上「opt-out 永远落不住(unpersisted)+ 采集态
+ * 永远 indeterminate(commits 全抑制)」,是部署契约不兼容,不是输入加固。所以键列**不存生字节**,存
+ * `encodeURIComponent(sessionId)` 规范形 —— 与 **core 文件三腿给文件名做的编码逐字同源**(layout.js
+ * `captureOptOutPath` 亲读),两载体一个键法:
+ *   · 编码字母表(`A-Za-z0-9-_.!~*'()%`)天然**无空白无控制字符** ⇒ TiDB utf8mb4_bin 的 PAD SPACE
+ *     尾空格折行隐患在字母表层面消灭,任意合法 id 字节精确、互不串行;
+ *   · 64 字符 id 编码上界 192 ⇒ 列宽 255 恒容;编码后超 255 的 id(>64 字符,提交面本就拒)在 `mark`
+ *     上答 `"unpersisted"`、在 `read` 上答 `undefined` —— 后者是**可证明的缺席**(本店写腿从不落这种键,
+ *     列宽也物理放不下),不是 indeterminate;
+ *   · `list` 逐行做**规范形往返校验**(decode 失败 / re-encode ≠ 原字节 ⇒ 整名册 **reject**):带外/损坏
+ *     写入的非规范键(如生尾空格 "s1 ")若被静默放行,roster 键与 lineage 贡献者键精确比对不上 ⇒
+ *     consolidation 资格臂**漏排除** opt-out 会话 = 蒸馏放大被扣留内容(codex R2-[medium] 验真);
+ *     reject 让资格臂 fail-closed 拒整理(`memory.consolidation_governance_unreadable`),方向正确。
+ *
+ * ── 列 ──────────────────────────────────────────────────────────────────────────────────────────
+ *   session_id  VARCHAR(255) PK  会话 id 的 encodeURIComponent 规范形(见上;宽=64 字符 id 的编码上界)
+ *   at_ms       BIGINT NOT NULL  记录时刻(core `SessionCaptureOptOutRecord.at`,恒引擎钟)
+ *   reason      TEXT NOT NULL    自由文本(verb 的 reason ≤500 由 wire 验;声明腿/SDK 直连宿主不设上限
+ *                                —— TEXT 而不是 VARCHAR(500):列溢出会把一条隐私请求变成 "unpersisted",
+ *                                为省字节引入那个失败向不值)
+ * 刻意**无** updated_* 审计列:记录是一次性单向的(first-record-wins,恒不改写),`at_ms` 就是全部时间事实。
+ *
+ * ── 方言差异(显式写在调用点,A12 doctrine)──────────────────────────────────────────────────────
+ *   · `?` vs `$n` 占位符;
+ *   · create-only:两方言都走**裸 INSERT + dup-key 判**(`sql-errors.ts` 的 `isDupKeyError` 单一登记谓词)
+ *     而不是 `INSERT IGNORE` / `ON CONFLICT DO NOTHING` —— IGNORE 在 MySQL 协议下连带吞掉溢出/截断类
+ *     错误(把「没落住」洗成「落了」),DO NOTHING 则要靠 affected==0 反推 dup(与「没插但也没错」不可
+ *     判别)。裸 INSERT 让三种结局(插入成功/键已在/真失败)各有各的信号,恰是 mark 三态要的判别度。
+ *   · BIGINT 读回:TiDB number,PG string —— `readAtMs` 两形都认,其余按行级损坏折合成记录(见 read 法)。
+ */
+import type { Pool as MySqlPool } from "mysql2/promise";
+import type { Pool as PgPool } from "pg";
+import type { SessionCaptureOptOutMarkOutcome, SessionCaptureOptOutRecord, SessionCaptureRecordStore } from "@sema-agent/core";
+import type { PgQueryFn } from "./pg-query.js";
+import { type SqlDriver, type SqlDialect } from "./sql-driver.js";
+export declare const SESSION_CAPTURE_OPTOUT_TABLE = "session_capture_optout";
+/** 键列宽(64 字符 id 的 encodeURIComponent 上界 192 ≤ 255;DDL 与守卫同源此常量)。 */
+export declare const SESSION_CAPTURE_KEY_WIDTH = 255;
+/** 键的规范形 = core 文件三腿给文件名做的同一只编码(layout.js `captureOptOutPath` 亲读)。 */
+export declare function encodeSessionCaptureKey(sessionId: string): string;
+/**
+ * `list` 的规范形往返校验(codex R2-[medium]):表里的键必须恰是某个 id 的 `encodeURIComponent` 输出。
+ * decode 失败 ⇒ **抛**具名错(原错随 `cause` 上交,不折默认值 —— [ref] 门② SHAPE C:catch 不许只 return
+ * 默认值);re-encode ≠ 原字节(如带外写入的生尾空格键、小写十六进制)⇒ 返回 `undefined`;两形调用方都
+ * **拒整本名册**(fail-closed:一个比对不上 lineage 贡献者的键 = 资格臂漏排除 = 蒸馏放大被扣留内容)。
+ */
+export declare function decodeCanonicalSessionCaptureKey(raw: string): string | undefined;
+/** 双方言 SessionCaptureRecordStore(Promise 形三腿)。见文件头的逐腿失败法。 */
+export declare class SqlSessionCaptureRecordStore implements SessionCaptureRecordStore {
+    private readonly driver;
+    private readonly dialect;
+    constructor(driver: SqlDriver, dialect: SqlDialect);
+    /** create-only / first-record-wins;**恒不 reject**(任何失败 ⇒ `"unpersisted"`,调用方必须拒跑)。 */
+    mark(sessionId: string, record: SessionCaptureOptOutRecord): Promise<SessionCaptureOptOutMarkOutcome>;
+    /** fail-closed 读:无行 ⇒ undefined;行在解不出 ⇒ 合成记录;SQL 故障 ⇒ reject(引擎折 fault 轴)。 */
+    read(sessionId: string): Promise<SessionCaptureOptOutRecord | undefined>;
+    /** 全名册。枚举失败 ⇒ reject(读不出的名册不是空名册);值列损坏 ⇒ 合成记录,绝不静默漏行;
+     *  **键**非规范形 ⇒ reject 整本(codex R2-[medium]:一个比对不上 lineage 贡献者的键若被静默放行,
+     *  资格臂就漏排除该会话 = 蒸馏放大被扣留内容;拒整本让 consolidation fail-closed 拒整理)。 */
+    list(): Promise<Record<string, SessionCaptureOptOutRecord>>;
+}
+export declare class TiDBSessionCaptureRecordStore extends SqlSessionCaptureRecordStore {
+    constructor(pool: MySqlPool);
+}
+export declare class PgSessionCaptureRecordStore extends SqlSessionCaptureRecordStore {
+    constructor(pool: PgPool);
+}
+export declare const TIDB_SESSION_CAPTURE_OPTOUT_STATEMENTS: readonly string[];
+export declare function ensurePgSessionCaptureOptOutSchema(q: PgQueryFn): Promise<void>;
+//# sourceMappingURL=session-capture-record-store-sql.d.ts.map

package/dist/plugins/session-capture-record-store-sql.js

@@ -0,0 +1,110 @@
+import { mysqlDriver, pgDriver } from "./sql-driver.js";
+import { isDupKeyError } from "./sql-errors.js";
+export const SESSION_CAPTURE_OPTOUT_TABLE = "session_capture_optout";
+const UNREADABLE_RECORD_REASON = "capture opt-out record present but unreadable (kept fail-closed)";
+export const SESSION_CAPTURE_KEY_WIDTH = 255;
+export function encodeSessionCaptureKey(sessionId) {
+    return encodeURIComponent(sessionId);
+}
+export function decodeCanonicalSessionCaptureKey(raw) {
+    let decoded;
+    try {
+        decoded = decodeURIComponent(raw);
+    }
+    catch (err) {
+        throw new Error(`session capture opt-out roster holds a non-canonical key (undecodable: ${err instanceof Error ? err.message : String(err)}) — refusing the enumeration fail-closed`, { cause: err });
+    }
+    return encodeURIComponent(decoded) === raw ? decoded : undefined;
+}
+function ph(dialect, n) {
+    return dialect === "pg" ? `$${n}` : "?";
+}
+function readAtMs(v) {
+    if (typeof v === "number" && Number.isFinite(v))
+        return v;
+    if (typeof v === "string" && /^\d+$/.test(v))
+        return Number(v);
+    if (typeof v === "bigint")
+        return Number(v);
+    return undefined;
+}
+function toRecord(r) {
+    const at = readAtMs(r.at_ms);
+    const reason = r.reason;
+    if (at === undefined || typeof reason !== "string")
+        return { at: 0, reason: UNREADABLE_RECORD_REASON };
+    return { at, reason };
+}
+export class SqlSessionCaptureRecordStore {
+    driver;
+    dialect;
+    constructor(driver, dialect) {
+        this.driver = driver;
+        this.dialect = dialect;
+    }
+    async mark(sessionId, record) {
+        const key = encodeSessionCaptureKey(sessionId);
+        if (key.length > SESSION_CAPTURE_KEY_WIDTH)
+            return "unpersisted";
+        const d = this.dialect;
+        try {
+            await this.driver.query(`INSERT INTO ${SESSION_CAPTURE_OPTOUT_TABLE} (session_id, at_ms, reason) VALUES (${ph(d, 1)}, ${ph(d, 2)}, ${ph(d, 3)})`, [key, record.at, record.reason]);
+            return "created";
+        }
+        catch (err) {
+            if (isDupKeyError(d, err))
+                return "existed";
+            return "unpersisted";
+        }
+    }
+    async read(sessionId) {
+        const key = encodeSessionCaptureKey(sessionId);
+        if (key.length > SESSION_CAPTURE_KEY_WIDTH)
+            return undefined;
+        const res = await this.driver.query(`SELECT at_ms, reason FROM ${SESSION_CAPTURE_OPTOUT_TABLE} WHERE session_id = ${ph(this.dialect, 1)}`, [key]);
+        const row = res.rows[0];
+        if (row === undefined)
+            return undefined;
+        return toRecord(row);
+    }
+    async list() {
+        const res = await this.driver.query(`SELECT session_id, at_ms, reason FROM ${SESSION_CAPTURE_OPTOUT_TABLE} ORDER BY session_id ASC`);
+        const out = Object.create(null);
+        for (const r of res.rows) {
+            const raw = r.session_id;
+            const decoded = typeof raw === "string" ? decodeCanonicalSessionCaptureKey(raw) : undefined;
+            if (decoded === undefined) {
+                throw new Error(`session capture opt-out roster holds a non-canonical key (out-of-band or corrupted row) — refusing the whole enumeration fail-closed: a key that cannot round-trip the canonical encoding cannot be matched against lineage contributors, and a silently passed-through one would let consolidation amplify withheld content`);
+            }
+            out[decoded] = toRecord(r);
+        }
+        return out;
+    }
+}
+export class TiDBSessionCaptureRecordStore extends SqlSessionCaptureRecordStore {
+    constructor(pool) {
+        super(mysqlDriver(pool), "tidb");
+    }
+}
+export class PgSessionCaptureRecordStore extends SqlSessionCaptureRecordStore {
+    constructor(pool) {
+        super(pgDriver(pool), "pg");
+    }
+}
+export const TIDB_SESSION_CAPTURE_OPTOUT_STATEMENTS = [
+    `CREATE TABLE IF NOT EXISTS ${SESSION_CAPTURE_OPTOUT_TABLE} (
+    session_id VARCHAR(255) NOT NULL,
+    at_ms BIGINT NOT NULL,
+    reason TEXT NOT NULL,
+    PRIMARY KEY (session_id)
+  ) COLLATE utf8mb4_bin`,
+];
+export async function ensurePgSessionCaptureOptOutSchema(q) {
+    await q(`CREATE TABLE IF NOT EXISTS ${SESSION_CAPTURE_OPTOUT_TABLE} (
+    session_id VARCHAR(255) COLLATE "C" NOT NULL,
+    at_ms BIGINT NOT NULL,
+    reason TEXT COLLATE "C" NOT NULL,
+    PRIMARY KEY (session_id)
+  )`);
+}
+//# sourceMappingURL=session-capture-record-store-sql.js.map

package/dist/plugins/session-placement.d.ts

@@ -1,5 +1,5 @@
 /**
- * #292 C18(core 5.48.0 design/323「不造新店」提货批,黑板 [4743] 点名义务)——**subagent 转录持久化**
+ * [ref] C18(core 5.48.0 [ref]「不造新店」提货批,黑板 [ref] 点名义务)——**subagent 转录持久化**
  * 的 placement 语义,SQL 孪生共用的一份判据。
  *
  * ## 这是什么

package/dist/plugins/session-policy-store-sql.d.ts

@@ -4,7 +4,7 @@ import type { Pool as PgPool } from "pg";
 import { type SqlDriver } from "./sql-driver.js";
 /** `session_policy.policy_key` 的**唯一铸造点**(core 复合键的 sha256)。
  *
- *  🔴 导出而不是让收编腿再抄一份(clay 宪法「schema 单一属主禁复制」):design/183 form b 的身份重绑要
+ *  🔴 导出而不是让收编腿再抄一份(clay 宪法「schema 单一属主禁复制」):[ref] form b 的身份重绑要
  *  逐行重算这把键(身份在 hash 的**原像**里,等值 UPDATE 够不着)。两处各写一遍 sha256 表达式的下场是
  *  某天有人在这里改了 key 公式而收编腿还在按旧式算 —— 迁完的行从此谁也读不到,且**静默**。 */
 export declare const policyKeyFor: (sessionId: string, principal: string | undefined) => string;
@@ -14,7 +14,7 @@ export declare class SqlSessionPolicyStore implements SessionPolicyStore {
     constructor(db: SqlDriver);
     /** Pick the dialect's SQL text. Both statements stay written out at the call site ON PURPOSE. */
     private q;
-    /** 判据属主 = `sql-errors.ts`(A-032 P1-①;本站点旧形已是并集形,收编后语义不变)。 */
+    /** 判据属主 = `sql-errors.ts`([ref] P1-①;本站点旧形已是并集形,收编后语义不变)。 */
     private isDupKey;
     /** Read the stored rules for (session, principal-owner); null when none (parity with InMemory). */
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;

package/dist/plugins/session-store.d.ts

@@ -14,7 +14,7 @@ export declare function createSessionStore(config: ServiceConfig, backend?: Stor
     inc(name: string, labels?: Record<string, string>, n?: number): void;
 }): SessionStore;
 /**
- * core 1.382(design/153,[1561] 提货单①②)`SubagentToolOptions.background.ensureChildSessionDurable`
+ * core 1.382([ref],[ref] 提货单①②)`SubagentToolOptions.background.ensureChildSessionDurable`
  * 的实现体——从 main.ts 装配点抽出为可独立测试的纯函数(main.ts 里的其余装配闭包历来无单测覆盖,
  * 这条因为承载真实的 park/veto 裁决,拆出来直接钉)。
  *
@@ -27,7 +27,7 @@ export declare function createSessionStore(config: ServiceConfig, backend?: Stor
  * (F-7 案:让"真会话在 transient"赢过"host 店里的同 id 空壳"),会把"只在 transient 店有真内容"误判成
  * "host 店已经有了"。这里要问的是纯粹"host 店本身是否已经有这份真内容",必须绕开那层路由。
  *
- * 🔴 [1575] F3(cli 复查抓获,真红确认)调用方前提——**本函数假设 `hostStore.release()` 是"归还租约"
+ * 🔴 [ref] F3(cli 复查抓获,真红确认)调用方前提——**本函数假设 `hostStore.release()` 是"归还租约"
  * 语义(不销毁内容)**,这对 core `TiDBSessionStore` 成立(`release()` 逐字注释「Durable history is
  * retained; just drop any in-flight cache entry」),但对无 repo 构造的 `TtlSessionStore`(`createSessionStore`
  * 在 `SESSION_BACKEND !== "tidb"` 时返回的那种)**不成立**——那个店形的 `release()` 是整删会话
@@ -39,7 +39,7 @@ export declare function createSessionStore(config: ServiceConfig, backend?: Stor
  */
 export declare function ensureSessionDurable(hostStore: SessionStore, sessionId: string): Promise<void>;
 /**
- * [1593] 主动晋升版 ensureChildSessionDurable(cli TiDB 真机撞获:1.263 的只查不迁形在拆店生产形下
+ * [ref] 主动晋升版 ensureChildSessionDurable(cli TiDB 真机撞获:1.263 的只查不迁形在拆店生产形下
  * 恒否决 park——bg 子会话住 subRunner 私有 TTL 店、从不在 host 店,core 收 veto 即 expire checkpoint
  * (14ms~2s)+ settle failed,赎回窗口不存在):
  *   1. 快路:已在 host 店且有真内容 → 直接通过(幂等/重入)。

package/dist/plugins/shared-memory-store-sql.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/177 — the SQL `SharedMemoryStoreProvider`: the deployment's ORG-scoped shared memory libraries
+ * [ref] — the SQL `SharedMemoryStoreProvider`: the deployment's ORG-scoped shared memory libraries
  * (`memory_list` / `memory_read`), served out of the durable store instead of a BYOM host callback.
  *
  * ─────────────────────────────────────────────────────────────────────────────────────────────────
@@ -12,7 +12,7 @@
  * is the DEPLOYMENT's admin plane (migrations, an import job, an operator face) and is deliberately
  * NOT reachable from any model-facing surface in this repo.
  *
- * 🔴 ORG PLANE ≠ THE LOCAL MEMORY CHAIN (设计 182 §13). `agent_memory_engine_*` (the design/138
+ * 🔴 ORG PLANE ≠ THE LOCAL MEMORY CHAIN (设计 182 §13). `agent_memory_engine_*` (the [ref]
  * MemoryEngine) and these three tables share NOTHING: no join, no view, no shared row, no shared
  * scope registry. The local chain is an entry-transactional index injection with a write path; this
  * one is a read-only document library. Bridging them in EITHER direction would let harvested private
@@ -135,7 +135,7 @@ export declare function assertScopeKey(scopeKey: string): void;
 export declare function assertDocumentPath(path: string): void;
 /**
  * The dual-dialect implementation. Every statement is written out in BOTH texts at its call site
- * (design/158 A12 判据:方言差异必须显式) — the `q(tidbSql, pgSql)` helper never builds one text.
+ * ([ref] A12 判据:方言差异必须显式) — the `q(tidbSql, pgSql)` helper never builds one text.
  */
 export declare class SqlSharedMemoryStore implements SharedMemoryStoreProvider {
     private readonly db;
@@ -156,7 +156,7 @@ export declare class SqlSharedMemoryStore implements SharedMemoryStoreProvider {
     /**
      * 盘状态 + 库登记,**一个事务一个快照**(轮2 F3 修)。
      *
-     * 🔴 A-010.11(两臂不对称,验真后修):此前 PG 臂显式抬隔离级别、**MySQL 臂只靠服务端默认值**,
+     * 🔴 [ref](两臂不对称,验真后修):此前 PG 臂显式抬隔离级别、**MySQL 臂只靠服务端默认值**,
      * 注里写的是「MySQL/TiDB 的默认隔离级别就是 REPEATABLE READ ⇒ 天然同快照」。那句话对**默认配置**
      * 为真,但 `transaction_isolation` 是可设的服务端/会话变量:一台跑 READ COMMITTED 的实例(托管
      * MySQL 的厂商默认、中间层代理、运维手改)会把「一个事务一个快照」悄悄降成「每条语句各自取快照」,
@@ -203,7 +203,7 @@ export declare class SqlSharedMemoryStore implements SharedMemoryStoreProvider {
      * Remove one document. Scope-fenced like {@link putDocument} (a stale delete must not reach a
      * successor tenant's library). Returns whether a row was actually there.
      *
-     * 🔴 A-010.14(验真后修):此前围栏是**两条独立语句** —— `assertOwnedBy()` 先查一次登记表,然后另
+     * 🔴 [ref](验真后修):此前围栏是**两条独立语句** —— `assertOwnedBy()` 先查一次登记表,然后另
      * 起一条 DELETE。它自称与 `putDocument` 对齐,但 `putDocument` 的检查与写是**同事务同行锁**
      * (`FOR UPDATE`),而这里的两条语句之间有一道真窗:登记检查通过之后、DELETE 发出之前,另一个 org
      * 完成 `deleteStore` + `putStore` 的 id 复用,这条 DELETE 就落进**继任租户**的库里删掉他们的文档。

package/dist/plugins/sql-driver.d.ts

@@ -1,6 +1,6 @@
 /**
  * Backend-NEUTRAL SQL exec/transaction seam for the "single-file dual-dialect" store collapses
- * (design/158 A12 定型半场). Sibling of `sql-escape.ts` / `sql-row-helpers.ts` / `store-contracts.ts`:
+ * ([ref] A12 定型半场). Sibling of `sql-escape.ts` / `sql-row-helpers.ts` / `store-contracts.ts`:
  * a leaf module with ZERO store logic, so a collapsed pair never has to load the other dialect's
  * adapter to reach a driver call.
  *
@@ -19,7 +19,7 @@
  *   - WHICH unique key collided (mysql2 `sqlMessage` text vs pg `err.constraint`) — that lives with
  *     the store that needs it, because the attribution rule is store-specific, not driver-generic.
  *     ⚠️ The dup-key predicate ITSELF is NOT store-specific and no longer lives at the call sites:
- *     `sql-errors.ts` owns it (A-032 P1-①; 7+ hand-rolled copies had drifted into three different
+ *     `sql-errors.ts` owns it ([ref] P1-①; 7+ hand-rolled copies had drifted into three different
  *     recognition sets, so the same driver error got opposite verdicts in different stores).
  *   - per-query timeouts: mysql2 takes `{sql, timeout}` while node-pg takes a `QueryConfig` with
  *     `query_timeout`. The counter family (write-behind-counter.ts) needs those and keeps its own
@@ -31,7 +31,7 @@
  * divergence is visible rather than hidden inside `begin()`.
  *
  * ─────────────────────────────────────────────────────────────────────────────────────────────────
- * REPLICATION PLAYBOOK — collapsing the remaining tidb-/pg- twin pairs (design/158 A12)
+ * REPLICATION PLAYBOOK — collapsing the remaining tidb-/pg- twin pairs ([ref] A12)
  * ─────────────────────────────────────────────────────────────────────────────────────────────────
  * Reference collapses: image-bake-store-sql.ts (class + transactions) and checkpoint-store-sql.ts
  * (class, no transactions). Function-style stores follow task-list-store-sql.ts instead (inline
@@ -64,7 +64,7 @@
  *   (sqlMessage vs err.constraint; the dup-key predicate itself = `sql-errors.ts`) · PG-only protocol-byte handling
  *   (pgSafeJsonStringify / pgProtocolJsonStringify / pgSanitizeText / pgHasUnstorable) · DDL. Each arm's
  *   BEHAVIOR (what pgSafeJsonStringify/pgProtocolJsonStringify actually do to the bytes) stays written out
- *   in `pg-safe-json.ts`, untouched — `dialectJsonEncoder`/`dialectProtocolJsonEncoder` below (design/158
+ *   in `pg-safe-json.ts`, untouched — `dialectJsonEncoder`/`dialectProtocolJsonEncoder` below ([ref]
  *   redesign①) only collect the identical `dialect === "tidb" ? JSON.stringify(v) : pgSafe…(v)` DISPATCH
  *   ternary that five call sites duplicated verbatim; they are not a new abstraction over the encodings
  *   themselves, so this does not violate the rule above.
@@ -94,7 +94,7 @@ export interface SqlTxConn extends SqlExec {
     /** TiDB: `BEGIN PESSIMISTIC` (current-read txn). PG: plain `BEGIN`. */
     beginPessimistic(): Promise<void>;
     /**
-     * Open a transaction whose reads are pinned to ONE snapshot (A-010.11).
+     * Open a transaction whose reads are pinned to ONE snapshot ([ref]).
      *
      * 🔴 Why this is a named verb and not "just `begin()` — MySQL defaults to REPEATABLE READ anyway":
      * a *server default* is not a structural guarantee. `transaction_isolation` is a settable
@@ -125,13 +125,13 @@ export interface SqlDriver extends SqlExec {
 export declare function mysqlDriver(pool: MySqlPool): SqlDriver;
 /** PostgreSQL driver. Transaction control is issued as STATEMENTS (node-pg has no native verbs). */
 export declare function pgDriver(pool: PgPool): SqlDriver;
-/** design/158 redesign① — the "safe" JSON-column encoder DISPATCH (run-store/outcome-ledger's identical
+/** [ref] redesign① — the "safe" JSON-column encoder DISPATCH (run-store/outcome-ledger's identical
  *  ternary, collected): TiDB stores `JSON.stringify` verbatim; PG goes through `pgSafeJsonStringify`'s
  *  protocol-byte defenses (a raw NUL/lone-surrogate would otherwise throw mid-write). Returns a 1-arg
  *  encoder; call sites invoke `dialectJsonEncoder(this.db.dialect)(value)` inline — the dispatch is the
  *  collected thing, not a cached field. */
 export declare const dialectJsonEncoder: (dialect: SqlDialect) => ((v: unknown) => string);
-/** design/158 redesign① — the "protocol" JSON-column encoder DISPATCH (approval-store/checkpoint-store's
+/** [ref] redesign① — the "protocol" JSON-column encoder DISPATCH (approval-store/checkpoint-store's
  *  identical ternary, collected): TiDB stores `JSON.stringify` verbatim (the `label` arg is ignored on that
  *  arm — TiDB has no protocol-byte envelope to name); PG goes through `pgProtocolJsonStringify(v, label)`,
  *  whose `label` names the field in its error text on an unstorable-byte reject. */

package/dist/plugins/sql-errors.d.ts

@@ -1,5 +1,5 @@
 /**
- * SQL 驱动错误的**方言判别**——「这是不是唯一键冲突」的单一属主(A-032 P1-①,病族
+ * SQL 驱动错误的**方言判别**——「这是不是唯一键冲突」的单一属主([ref] P1-①,病族
  * single-semantic-multi-site-drift)。`sql-escape.ts` / `sql-row-helpers.ts` / `store-contracts.ts`
  * 的同级叶子:零 store 逻辑、零驱动依赖(不 import mysql2/pg),纯谓词。
  *
@@ -50,7 +50,7 @@ export declare const MYSQL_ER_BAD_FIELD_CODE = "ER_BAD_FIELD_ERROR";
  * 🔴 单一属主的理由与 {@link isDupKeyError} 逐字同源(本文件顶注的 single-semantic-multi-site-drift):
  * 判据一旦复制,两处的识别集就会各自漂,而这条谓词的错判方向**特别贵** —— 它守的是一句**破坏性**的
  * 错误指路(「去 DROP TABLE」)。超时、连接重置、取消、资源不足、列级权限被拒、表整个不存在,每一种
- * 都会让探针抛错;把它们诊断成「删表重建」比它要挡的缺陷更贵(#340 codex 交叉复审 round2/round3
+ * 都会让探针抛错;把它们诊断成「删表重建」比它要挡的缺陷更贵([ref] codex 交叉复审 round2/round3
  * [high] 两轮收窄后的终形)。认不出的一律**不是**缺列(fail-safe:宁可把一次真缺列报成原始错误)。
  *
  * MySQL 侧两个归因键都认(mysql2 的 `code`/`errno` 是同一件事的两种写法),与 dup-key 那条同姿势。

package/dist/plugins/sql-escape.d.ts

@@ -1,5 +1,5 @@
 /**
- * Backend-NEUTRAL SQL string escaping (design/158 A3 沉底).
+ * Backend-NEUTRAL SQL string escaping ([ref] A3 沉底).
  *
  * Lives in its own leaf so no adapter has to load another dialect's adapter module to get a pure
  * string transform (the PG stores used to runtime-import the TiDB tool-result store for exactly

package/dist/plugins/sql-row-helpers.d.ts

@@ -1,5 +1,5 @@
 /**
- * Shared pure row-mapping helpers for the SQL store twins (design/158 S8 纯 helper 归位).
+ * Shared pure row-mapping helpers for the SQL store twins ([ref] S8 纯 helper 归位).
  *
  * These were duplicated verbatim across the pg-/tidb- store twin pairs; each store imports the flavor
  * it was written against (usually under its historical local alias, e.g. `parseJsonStrict as

package/dist/plugins/store-backend.d.ts

@@ -1,6 +1,6 @@
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import type { SessionStore, SessionPolicyStore, FileHistoryStore, WorkflowJournalStore, ToolResultStore } from "@sema-agent/core";
+import type { SessionStore, SessionPolicyStore, FileHistoryStore, WorkflowJournalStore, ToolResultStore, SessionCaptureRecordStore } from "@sema-agent/core";
 import { type OutcomeSink } from "./file-outcome-sink.js";
 import { type InboxWarn } from "./workflow-run-store-sql.js";
 import { FileRunStore } from "./file-run-store.js";
@@ -38,16 +38,16 @@ export type RunStore = TiDBRunStore | PgRunStore | FileRunStore;
  *  FileResumeAnchorStore is the FILE-backed local twin (P0.5 variant-1; survives restart). */
 export type ResumeAnchorStore = TiDBResumeAnchorStore | PgResumeAnchorStore | FileResumeAnchorStore;
 export type { ApprovalExemptionStore } from "./approval-exemption-store.js";
-/** #151(design/172 v3.1 §3.0-§3.2 流内审批协议持久层):`ApprovalAskStore` 接口 + 行/补丁类型。
+/** [ref]([ref] v3.1 §3.0-§3.2 流内审批协议持久层):`ApprovalAskStore` 接口 + 行/补丁类型。
  *  车3 刀 3a 起 `StoreBackend.approvalAsk()` 已在(见接口体的那条注)。 */
 export type { ApprovalAskStore, AskRow, NewAskRow, AskTransitionPatch, DecideAskInput, DecideResult, ExpireResult, BindGateInput, BatchRow, AskDecision } from "./approval-ask-store-sql.js";
 /** E6 SessionPolicyStore — core's interface PLUS the service `deleteBySession` (E21 purge; only the durable twins carry
  *  it, core's InMemory omits it → optional). tidb/pg = durable twins; local = core's InMemorySessionPolicyStore (works
  *  local — rules need no cloud-only infra). The shared env-gated equivalence suite keeps the twins byte-matched to InMemory. */
 export type ServiceSessionPolicyStore = SessionPolicyStore;
-/** S-15 per-edited-file rewind FileHistoryStore — core's interface PLUS the service extras only the SQL twins
+/** [ref] per-edited-file rewind FileHistoryStore — core's interface PLUS the service extras only the SQL twins
  *  carry (optional so the local lane's core `FileFileHistoryStore` still fits). Replaces the retired E19
- *  whole-tree `ServiceFileSnapshotStore` (design/381: the boundary covers the TRACKED set only — files this
+ *  whole-tree `ServiceFileSnapshotStore` ([ref]: the boundary covers the TRACKED set only — files this
  *  session edited; there is no whole-tree manifest anymore). Also the 2c history-transfer store
  *  (exportHistory/importHistory + the blob negotiation faces below). */
 export type ServiceFileHistoryStore = FileHistoryStore & {
@@ -92,7 +92,7 @@ export type ServiceWorkflowJournalStore = WorkflowJournalStore & {
 };
 export type ImageIndex = TiDBImageIndex | PgImageIndex;
 export type ImageBake = TiDBImageBake | PgImageBake;
-/** #193 车4 件1:durable leader-run 登记表的双方言孪生(union 同族——TS 私有字段让具体类名义上不同)。 */
+/** [ref] 车4 件1:durable leader-run 登记表的双方言孪生(union 同族——TS 私有字段让具体类名义上不同)。 */
 export type LeaderRunStore = TiDBLeaderRunStore | PgLeaderRunStore;
 /** The FULL checkpoint store (core CheckpointStore + the service operator-queue/ctx methods listPending/
  *  listByScope/findPendingTokenBySession/peekPendingScope/putCtx/getCtx/reapCtx) — the SQL twins carry them,
@@ -129,7 +129,7 @@ export interface StoreBackend {
     /** Per-session per-toolName approval exemption ("本会话不再询问") — an approval MEMORY the F4
      *  ask-gate consults after deny/neverAuto. REQUIRED on all backends (works local, like resumeAnchor). */
     approvalExemption(): ApprovalExemptionStore;
-    /** #151(design/172 §3.0-§3.2)流内审批协议持久层:每个流内工具调用一行的 ask 状态机 + 批行。
+    /** [ref]([ref] §3.0-§3.2)流内审批协议持久层:每个流内工具调用一行的 ask 状态机 + 批行。
      *  REQUIRED on all backends — tidb/pg = SQL 双方言 twin;local = {@link InMemoryApprovalAskStore}。
      *
      *  🔴 local 形的代价必须在这里说清楚(而不是留给读者自己发现):InMemory 的 STREAM_PENDING/DECIDED/
@@ -144,7 +144,7 @@ export interface StoreBackend {
      *  D1 逐字现行为(store 缺席 = 现行 `tool_approval` 活卡腿一字不变)。 */
     approvalAsk(): ApprovalAskStoreType;
     /**
-     * #154 车二(core 5.18.0 design/179 + 5.22.0 design/182):**持久化权限规则店**(「不再询问」车道)
+     * [ref] 车二(core 5.18.0 [ref] + 5.22.0 [ref]):**持久化权限规则店**(「不再询问」车道)
      * 三面 —— 规则桶 provider / durable 审批记录 / server 自铸的 CC 导入票。
      *
      * 🔴 **可选**(与上面那些 REQUIRED 家族不同),缺席是一个真答案:core 的 `RunnerDeps.permissionRuleStore`
@@ -153,7 +153,7 @@ export interface StoreBackend {
      *
      * `local` 车道**刻意不给 in-memory twin**:一条规则是「人授权过的持久事实」,进程内 Map 形会在重启时
      * 静默丢掉那份授权,而消费端(下一次同命令的 ask)读到的是「没有规则」——那是**放宽面**上的静默降级。
-     * ✅ **#203 §1 已落 File 形**(那条注写下的解除条件逐字是「先落 File 形,core 现成
+     * ✅ **[ref] §1 已落 File 形**(那条注写下的解除条件逐字是「先落 File 形,core 现成
      * `FilePermissionRuleStoreProvider` 即可当模子」——本车照办):`local` 现在返回一个**跨重启存活**的
      * 三面束,storeWired 在单机车道上真为 true。in-memory twin 的禁令不变,它禁的是「会遗忘的店」,
      * 不是「单机的店」。
@@ -165,11 +165,11 @@ export interface StoreBackend {
     /** E6 durable SessionPolicyStore (operator-tightened per-session tool rules). REQUIRED on all backends — works local
      *  (local = core's InMemorySessionPolicyStore), like resumeAnchor. Backs core's RunnerDeps.sessionPolicyStore. */
     sessionPolicy(): ServiceSessionPolicyStore;
-    /** S-15 per-edited-file rewind FileHistoryStore (trackEdit/annulTrack/snapshot/restore over the tracked set;
+    /** [ref] per-edited-file rewind FileHistoryStore (trackEdit/annulTrack/snapshot/restore over the tracked set;
      *  also the 2c history-transfer store). REQUIRED on all backends (local = core's file-backed
      *  `FileFileHistoryStore` under the data root). Backs core's RunnerDeps.fileHistoryStore. */
     fileHistory(): ServiceFileHistoryStore;
-    /** design/383 §3.1 / S-50 §一(S-49 S-2):per-principal **memory-capture opt-out 授权表**
+    /** [ref] §3.1 / [ref] §一([ref] S-2):per-principal **memory-capture opt-out 授权表**
      *  (`memory_optout_grant`)—— `RuntimeCaps.allowMemoryOptOut` 的本地 verdict 源(三层折叠:per-principal
      *  行 → 部署缺省哨兵行 → 代码缺省 allow)+ `/v1/admin/memory-optout` 四端点的持久层。
      *
@@ -181,6 +181,19 @@ export interface StoreBackend {
      *  「没有行 ⇒ 代码缺省 allow」—— 那是**放宽面**上的静默降级(permissionRule 那条禁令的同一理由)。
      *  File 形候真实的 local+governed 部署需求出现再落(候需求档)。 */
     memoryOptOutGrant(): MemoryOptOutGrantStore | undefined;
+    /** [ref]②([ref] §2.1b,core 7.0.2 [ref] 件2):会话 capture opt-out **记录**的 SQL 载体
+     *  (`session_capture_optout`)—— core `RunnerDeps.memoryCaptureRecordStore` /
+     *  `MemoryEngineOptions.captureRecordStore` 的持久层(Promise 形三腿)。与 §3.1 的**授权表**不是一个轴:
+     *  那张管「谁**可以** opt-out」(operator 写的 verdict),这张管「谁**已经** opt-out」(用户写的一次性
+     *  单向记录)。
+     *
+     *  🔴 **可选**(与 memoryOptOutGrant 同族):SQL 后端 = 双方言 twin;`local` 车道 **undefined**,且缺席是
+     *  一个真答案 —— 缺席时 core 用它的控制面文件三腿(`fileSessionCaptureRecordStore`),单机部署上那正是
+     *  重启可存活的正确载体(383 §2.1b:「absent = 文件三腿,单进程/单机字节不变」)。SQL 载体要解决的病
+     *  只在无状态多副本形:文件记录对 resume 副本不可见,「record not found」恰朝**继续采集**方向坏。
+     *  刻意不给 local 一个 SQL/内存 twin:内存形会在重启时把一条隐私记录静默丢掉(比文件三腿严格更差),
+     *  文件形 core 已自带。 */
+    sessionCaptureRecords(): SessionCaptureRecordStore | undefined;
     /** S-1 legacy-epoch discriminant (core `RunnerDeps.legacyRewindBoundaryProbe`): does the RETIRED whole-tree
      *  snapshot epoch hold a boundary for (sessionId, entryId)? Reads the legacy `snapshot_manifest` table.
      *  SQL backends only (local never had a whole-tree epoch table). Diagnostic input on the refusal path —
@@ -207,9 +220,9 @@ export interface StoreBackend {
      *  run_workflow tool deps (`dist/orchestration/run-workflow-tool.d.ts:65`), and the boot chain consumes it
      *  end-to-end: built in `boot/workflow-orchestration.ts` (`const workflowJournalStore = …backend.workflowJournal()`),
      *  threaded into RunnerDeps (`boot/runner-deps.ts` 的 `workflowJournalStore`), reaped on the maintenance tick
-     *  (`boot/reapers.ts` 同名字段), and read by `GET /v1/workflows/:id/journal` (`http/routes/workflows.ts`, [1402]). */
+     *  (`boot/reapers.ts` 同名字段), and read by `GET /v1/workflows/:id/journal` (`http/routes/workflows.ts`, [ref]). */
     workflowJournal(): ServiceWorkflowJournalStore;
-    /** design/73 §1 consumption sink for `RunnerDeps.onTaskOutcome` facts. REQUIRED on all backends:
+    /** [ref] §1 consumption sink for `RunnerDeps.onTaskOutcome` facts. REQUIRED on all backends:
      *  tidb/pg = the outcome-ledger twins (SQL rows, mapped via coreOutcomeToLedgerRow + verbatim core_outcome
      *  JSON); local = an owner-only JSONL File sink. Read-only v1 — records facts, drives no policy. */
     outcomeSink(): OutcomeSink;
@@ -224,7 +237,7 @@ export interface StoreBackend {
     /** Cloud-only stores below are OPTIONAL: the `local` (in-memory/file) backend omits them (it has no core
      *  in-memory twin carrying the service extras, and these are fleet/multi-replica concepts), so a local HTTP
      *  service degrades EXACTLY like today's no-DB env (the consumers gate on `backend?.X?.()`). TiDB/PG provide all. */
-    /** design/177 —— org 共享记忆库的供给面(core `RunnerDeps.sharedMemoryStores` + `/v1/shared-memory/*`
+    /** [ref] —— org 共享记忆库的供给面(core `RunnerDeps.sharedMemoryStores` + `/v1/shared-memory/*`
      *  只读面)。授权折叠**注入**:谁属于哪个 org 归 server 的目录面判,持久层只按判决出的 scope 集查表。
      *
      *  🔴 local 车道诚实缺席(不是"待补"):这个面的全部意义是**跨用户**共享一个团队库,而 local 后端是
@@ -239,7 +252,7 @@ export interface StoreBackend {
     imageIndex?(): ImageIndex;
     imageBake?(): ImageBake;
     /**
-     * #193 车4 件1(台账 P1-9):durable leader-run 登记表。**SQL 后端专有**,`local` 刻意省略。
+     * [ref] 车4 件1(台账 P1-9):durable leader-run 登记表。**SQL 后端专有**,`local` 刻意省略。
      *
      * 🔴 local 缺席不是欠账、也不是「以后补个 File 形」:leader run 是 N worker fan-out + 真 git push,
      * 而 config 层已经把「LEADER_ENABLED=true 且无外部 SQL 店」整个组合**拒启**了(件2 门②)——
@@ -256,7 +269,7 @@ export interface StoreBackend {
      */
     device?(): DeviceStore;
     /**
-     * #270 —— 托管留存的**破坏性**三方法(core `ManagedRetentionCapability` 的 server 侧真身)。
+     * [ref] —— 托管留存的**破坏性**三方法(core `ManagedRetentionCapability` 的 server 侧真身)。
      * **SQL 后端专有**,`local` 刻意省略:那三条腿是跨十余张表的单事务级联,file/in-memory 形没有事务面
      * 也没有那些表,所以它诚实声明 `retention:"none"`(见 `local-session-store.ts` 的同款注)。
      *
@@ -266,7 +279,7 @@ export interface StoreBackend {
      */
     retention?(opts: SqlRetentionStoreOptions): SqlRetentionStore;
     /**
-     * #270 车2 —— 留存执行面的**非破坏性**半场:sweep 租约、legal-hold 的放置/解除、审计表的读与
+     * [ref] 车2 —— 留存执行面的**非破坏性**半场:sweep 租约、legal-hold 的放置/解除、审计表的读与
      * 非破坏行的写。同样 SQL 专有(它写的三张表只在 SQL schema 里)。
      *
      * 🔴 与上一格**分家**是有意的:拿到本对象的消费方(operator 路由)结构上删不掉任何业务数据。
@@ -285,7 +298,7 @@ export interface StoreBackend {
     /** S3-TOB(设计 §1.4):the raw PG pool for the memory-engine DB backend's PgQueryFn binding (mirror of
      *  mysqlPool). undefined on non-PG backends. */
     pgPool(): PgPool | undefined;
-    /** design/183 form b(纯身份重绑)的 SQL 收编日志。**SQL 后端专有**(mysql/pg),`local` 刻意省略:
+    /** [ref] form b(纯身份重绑)的 SQL 收编日志。**SQL 后端专有**(mysql/pg),`local` 刻意省略:
      *  收编重绑的是**多租身份轴**,而 local 后端整个数据根就属那一个用户、库里没有 owner/scope 分区面
      *  ——在那儿开这道口只会让一个够不到任何东西的动作看起来可用。消费点按 `backend?.adoptionLog?.()`
      *  缺席即 501(诚实拒绝),与其它云专有 store 同姿势。 */
@@ -295,7 +308,7 @@ export interface StoreBackend {
      *  splits a fleet window into disjoint buckets = soft-limit leak). OPTIONAL: local backend omits (no fleet). */
     dbNowMs?(): Promise<number>;
 }
-/** (c)(clay 拍 a+c,2026-07-27;S-15 换店后域=file_history_blob,门与旋钮名不变)云形 blob 姿势门——
+/** (c)(clay 拍 a+c,2026-07-27;[ref] 换店后域=file_history_blob,门与旋钮名不变)云形 blob 姿势门——
  *  boot 时调用(boot/stores.ts),纯函数可单测。SQL 后端(mysql|pg)把 blob 字节落单行的形已被两役
  *  实证撞 mysql-协议包墙(D-1 附件 → 对象存储裁定):大字节归对象存储。per-file 历史的 blob=单文件
  *  字节,同一堵墙(>6MiB 的被 track 文件在 TiDB 上落不进 SQL 行 ⇒ trackEdit 拒 ⇒ 默认 DV-14 下该次
@@ -319,7 +332,7 @@ export declare function counterStoreLabel(store: unknown, kind: string | undefin
  *  reachability probe is the caller's first `ensureSchema`). Returns undefined when no DB is configured.
  *
  *  `onWarn` (additive, optional) is the boot-time warning sink the LOCAL backend needs for core's
- *  permission-rule DISCLOSURE face (#203 §1): an unreadable / checksum-mismatched / symlinked rule file
+ *  permission-rule DISCLOSURE face ([ref] §1): an unreadable / checksum-mismatched / symlinked rule file
  *  answers ZERO rules and says so — swallowing that turns a fail-closed degrade into a silent one.
  *  `onError` (additive, optional; F-D) is the **error-level** twin of that seat — 件6 的
  *  `file_run_store_hydrate_unreadable` 按成文承诺是 error 级,warn 座满足不了那句话。两座都是**加项**:

package/dist/plugins/store-backend.js

@@ -13,6 +13,7 @@ import { TiDBApprovalExemptionStore, PgApprovalExemptionStore, FileApprovalExemp
 import { TiDBApprovalAskStore, PgApprovalAskStore } from "./approval-ask-store-sql.js";
 import { InMemoryApprovalAskStore } from "./approval-ask-store-memory.js";
 import { TiDBMemoryOptOutGrantStore, PgMemoryOptOutGrantStore } from "./memory-optout-grant-store-sql.js";
+import { TiDBSessionCaptureRecordStore, PgSessionCaptureRecordStore } from "./session-capture-record-store-sql.js";
 import { TiDBSendFileLedger, PgSendFileLedger, FileSendFileLedger } from "./send-file-ledger.js";
 import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
 import { TiDBSessionPolicyStore, PgSessionPolicyStore } from "./session-policy-store-sql.js";
@@ -135,6 +136,7 @@ class TiDBBackend {
     sessionPolicy() { return new TiDBSessionPolicyStore(this.pool); }
     fileHistory() { return new TiDBFileHistoryStore(this.pool, historyBlobBackend(this.config, "tidb", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new TiDBMemoryOptOutGrantStore(this.pool); }
+    sessionCaptureRecords() { return new TiDBSessionCaptureRecordStore(this.pool); }
     legacyRewindBoundaryProbe(query) { return legacyProbeImpl("tidb", this.pool, query); }
     legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "tidb", this.pool); }
     legacySnapshotPurge(sessionId) { return legacyPurgeImpl("tidb", this.pool, sessionId); }
@@ -180,6 +182,7 @@ class PgBackend {
     sessionPolicy() { return new PgSessionPolicyStore(this.pool); }
     fileHistory() { return new PgFileHistoryStore(this.pool, historyBlobBackend(this.config, "pg", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new PgMemoryOptOutGrantStore(this.pool); }
+    sessionCaptureRecords() { return new PgSessionCaptureRecordStore(this.pool); }
     legacyRewindBoundaryProbe(query) { return legacyProbeImpl("pg", this.pool, query); }
     legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "pg", this.pool); }
     legacySnapshotPurge(sessionId) { return legacyPurgeImpl("pg", this.pool, sessionId); }
@@ -299,6 +302,7 @@ class LocalBackend {
     sessionPolicy() { return this.fileBackend.sessionPolicyStore; }
     fileHistory() { return this.fileBackend.fileHistoryStore; }
     memoryOptOutGrant() { return undefined; }
+    sessionCaptureRecords() { return undefined; }
     workflowJournal() { return this.workflowJournalStore; }
     outcomeSink() { return this.outcomeSinkInst; }
     session() { return this.sessionStore; }
@@ -315,7 +319,7 @@ export function createStoreBackend(config, onWarn, onError) {
     if (config.dbBackend === "pg") {
         if (!config.pg)
             return undefined;
-        const pool = createPgPool(pgPoolOptions(config.pg, config.dbQueryTimeoutMs));
+        const pool = createPgPool(pgPoolOptions(config.pg, config.dbQueryTimeoutMs), onWarn);
         return new PgBackend(pool, config);
     }
     if (!config.tidb)