Applications can currently open cursors and run schema operations (create, drop, truncate, alter) directly on internal tables: the ingest and stable constituents of layered tables (file:*.wt_ingest / file:*.wt_stable), as well as the disaggregated shared metadata and shared history store tables. These tables are internal implementation details: reading a constituent bypasses the layered composite view, writing to one can break layered table invariants, and their format and existence are not a stable contract.

We should create a guard that refuses such access by default, with an explicit opt-in (session-level debug configuration) so that internal tests and debugging workflows can still access these tables directly.