@sema-agent/server 7.116.1 → 7.118.0

package/dist/parked-decide.js

@@ -1,4 +1,4 @@
-import { readRunParks } from "./orchestration/workflow-agent-session-index.js";
+import { routeWorkflowPark } from "./orchestration/workflow-agent-session-index.js";
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
 import { backgroundScopesForCheckpointScope, decodeCheckpointScope } from "./security.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
@@ -20,19 +20,30 @@ export async function findParkOrigin(sources, cp) {
     if (index === undefined || runStore === undefined)
         return undefined;
     try {
-        const row = await index.findByAgentSession(cp.sessionId);
-        if (row === null)
+        const pointers = await index.listByAgentSession(cp.sessionId);
+        if (pointers.length === 0)
             return undefined;
-        const run = await runStore.get(row.runId);
-        if (run === null)
-            return undefined;
-        const parks = readRunParks(run);
-        if (parks === undefined)
-            return { kind: "workflow_parks_unreadable", runId: row.runId, run };
-        const park = parks.find((p) => p.sessionId === cp.sessionId && p.token === cp.token);
-        if (park === undefined)
-            return undefined;
-        return { kind: "workflow", runId: row.runId, run, park };
+        const runs = [];
+        for (const runId of new Set(pointers.map((p) => p.runId))) {
+            const run = await runStore.get(runId);
+            if (run !== null)
+                runs.push(run);
+        }
+        const route = routeWorkflowPark(cp.sessionId, runs);
+        switch (route.kind) {
+            case "held":
+                return route.park.token === cp.token ? { kind: "workflow", runId: route.runId, run: route.run, park: route.park } : undefined;
+            case "forked":
+                return { kind: "workflow_park_forked", runIds: route.runIds };
+            case "unproven":
+                return { kind: "workflow_parks_unreadable", runId: route.runId, run: route.run, cause: route.cause, ...(route.readableHolderRunId !== undefined ? { readableHolderRunId: route.readableHolderRunId } : {}) };
+            case "none":
+                return undefined;
+            default: {
+                const unhandled = route;
+                throw new Error(`unhandled workflow park route: ${JSON.stringify(unhandled)}`);
+            }
+        }
     }
     catch (e) {
         quiet(sources.warn, "workflow_park_probe_failed", { error: e instanceof Error ? e.message : String(e) });
@@ -90,12 +101,39 @@ export function buildParkedResumeOutcome(req) {
     };
 }
 export function denyWorkflowParksUnreadable(origin) {
+    switch (origin.cause) {
+        case "older_engine":
+            return {
+                status: 409,
+                body: {
+                    error: "this decision cannot be matched to the pending step it belongs to: the run's record was written by an earlier engine version, which did not record which run is waiting on each pending step — and that record is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resume the run itself instead — `Workflow({resumeFromRunId})` with the runId below — and once the resumed run is waiting on this step again it records itself as the one waiting, after which deciding here works normally. Only if the engine also refuses that resume is the run truly unrecoverable",
+                    errorCode: "decide.workflow_parks_unreadable",
+                    runId: origin.runId,
+                },
+            };
+        case "unreadable":
+            return {
+                status: 409,
+                body: {
+                    error: "this decision cannot be matched to the pending step it belongs to: this run's record cannot be read (the list of pending steps the run owns is damaged: one of its entries is malformed, or it is not a list at all) — and that list is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resuming does not clear this: the damaged record keeps naming this step whatever runs after it, so the decision stays undeliverable until whoever operates this deployment repairs that record (the runId below); after that, deciding here works normally. When the response also carries readableHolderRunId, that run's record is readable and is the latest one waiting on this step — it is where the work can be carried on, but the damaged record above still keeps this decision from being delivered until that record is fixed",
+                    errorCode: "decide.workflow_parks_unreadable",
+                    runId: origin.runId,
+                    ...(origin.readableHolderRunId !== undefined ? { readableHolderRunId: origin.readableHolderRunId } : {}),
+                },
+            };
+        default: {
+            const unhandled = origin.cause;
+            throw new Error(`unhandled workflow parks-unreadable cause: ${String(unhandled)}`);
+        }
+    }
+}
+export function denyWorkflowParkForked(origin) {
     return {
         status: 409,
         body: {
-            error: "this decision cannot be matched to the pending step it belongs to: this run's record was written by an older engine, or one of its entries is damaged, so it no longer says which pending steps the run owns — and that list is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resume the run itself instead — `Workflow({resumeFromRunId})` with the runId below — and the engine rebuilds that list from its own records as it admits the resume, after which deciding here works normally. Only if the engine also refuses that resume is the run truly unrecoverable",
-            errorCode: "decide.workflow_parks_unreadable",
-            runId: origin.runId,
+            error: "this decision cannot be delivered: the same run was resumed more than once and every resumed copy listed in runIds is waiting on this same step, so there is no single run to hand the decision to. Nothing was delivered and the approval card stays pending. Resume one of the runs listed in runIds; once that run is waiting on this step again, deciding here works normally",
+            errorCode: "decide.workflow_park_forked",
+            runIds: [...origin.runIds],
         },
     };
 }

package/dist/permission-rule-list.d.ts

@@ -1,25 +1,23 @@
 /**
- * **规则表的唯一编译口** —— 一张工具名规则表(`allow` / `ask` / `deny` 之一)编成一只 `ToolPolicy`。
+ * **规则表的唯一编译口** —— 一张工具名规则表(`ask` / `deny` 之一)编成一只 `ToolPolicy`。读者:请求腿的 `settings.permissions.{ask,deny}`
+ * 两桶(`task-settings.ts` 的 `deriveSettingsPolicy`)。
  *
- * 两类读者,同一只编译口(编译与校验各只有一份,不在别处另写第二份文法):
- *  · 请求腿的 `settings.permissions.{allow,ask,deny}` 三桶(`task-settings.ts` 的 `deriveSettingsPolicy`);
- *  · 运维的 allow 规则 `APPROVAL_GRANT`(`runtime-governance.ts` 的 `applyRuntimeGovernance`,经部署治理链的单一构造口
- *    `deployment-governance.ts` 交进来 —— HTTP 提交 / durable 续跑 / 停驻后台 agent 的跨副本赎回 / run-local 四条腿同装)。
+ * 🔴 core 7.42.0 起策略只说 deny / ask:allow 规则有且只有引擎 allow 层的两个席位 —— 请求的 `settings.permissions.allow` 整份投
+ * `TaskSpec.allowedTools`(`task-settings.ts` 的 `applyTaskSettings`),运维的 `APPROVAL_GRANT` 投 `RunnerDeps.allowedTools`
+ * (`boot/runner-deps.ts` 的部署姿态座席族)。本口的 `behavior` 型直接是 core 的 `PermissionRule["behavior"]`(不手抄:core 收窄,这里跟着收窄)。
  *
- * 为什么住在一只叶模块里(不留在 `task-settings.ts`):运维那一侧的启动校验在 `config.ts` 里跑(坏值 = 拒启),而
- * `task-settings.ts` 值引 `config.ts` —— 编译口留在那里,`config.ts` 要调它就闭合一只 ESM 装载环。本模块只 import core 与
- * `text-bidi.ts`(纯叶),三处读者引它都不成环。
+ * 为什么住在一只叶模块里(不留在 `task-settings.ts`):本模块只 import core 与 `text-bidi.ts`(纯叶),读者引它不成环。
  */
-import { type PathRuleBases, type RuleBehavior, type ToolPolicy } from "@sema-agent/core";
-/** 一张表里规则条数的上限 —— 请求腿 wire 门(`task-settings.ts` 的三桶判形)读的也是这一个名字:core 的缺省帽是 256,
+import { type PathRuleBases, type PermissionRule, type ToolPolicy } from "@sema-agent/core";
+/** 一张表里规则条数的上限 —— 请求腿 wire 门(`task-settings.ts` 的 deny / ask 两桶判形)读的也是这一个名字:core 的缺省帽是 256,
  *  不对齐的话第 257 条起编译当场抛,等于服务端自己收下的东西自己反悔。 */
 export declare const MAX_PERMISSION_RULES_PER_LIST = 1000;
-/** A name-keyed rule-list ToolPolicy: a tool named by `names` gets `behavior` (an `allow` hit states the allow with
- *  `decisionReason: "rule"`; `ask` tightens to an approval gate; `deny` hard-blocks); every other tool is out of
- *  scope (`defaultAction: "allow"` = this policy has no opinion about anything it does not name). Composed deny-wins
- *  with the rest of the fold, so `ask` / `deny` only ever tighten and an `allow` never overrides a deny or an ask.
+/** A name-keyed rule-list ToolPolicy: a tool named by `names` gets `behavior` (`ask` tightens to an approval gate;
+ *  `deny` hard-blocks); every other tool is out of scope (`defaultAction: "allow"` = this policy has no opinion about
+ *  anything it does not name — core 7.42.0: it states nothing and clears nothing). Composed deny-wins with the rest of
+ *  the fold, so both only ever tighten.
  *
- *  `source` = 这张表**写在哪**(请求腿 `settings.permissions.<桶>`;运维腿 `APPROVAL_GRANT`)。它盖进每条规则(core 的 deny / ask
+ *  `source` = 这张表**写在哪**(请求腿 `settings.permissions.<桶>`)。它盖进每条规则(core 的 deny / ask
  *  句里点名它:`flagged by permission rule "mcp__figma__*" (settings.permissions.ask)`),编不出来时的错误句也点名它;只是出处,
  *  不带任何优先级(层序在各自的折叠里)。
  *
@@ -32,7 +30,7 @@ export declare const MAX_PERMISSION_RULES_PER_LIST = 1000;
  *  `deny:["mcp__figma__*"]` 却**真拦** —— deny 走 `createAllowDenyPolicy`,它用的是 core 的
  *  `namespacedCoveringEntries/Hit`。同族分家,差的只是解析器。
  *
- *  ⇒ **规则表的 policy 面现在同源**:三种态度都由 `createPermissionRulePolicy` 的 covering 车道解,底下是
+ *  ⇒ **规则表的 policy 面现在同源**:两种态度都由 `createPermissionRulePolicy` 的 covering 车道解,底下是
  *  core 的**同一只** `namespacedRuleNameCovers`(协议无关:`mcp__`/`a2a__` 同解;peer 段精确比;工具段 `*`/glob 覆盖)。
  *  本仓**不自写第二套 glob** —— 那正是当年分家的成因。
  *
@@ -56,26 +54,17 @@ export declare const MAX_PERMISSION_RULES_PER_LIST = 1000;
  *     这里;真正新增的是「名字里带反斜杠」「单条 > 512 字符」这两族永不匹配的拼法。
  *     ✅ **不对称已收口([ref]①,[ref] 销)**:codex finding-2 当年如实登记的「同样两族拼法在 `deny`
  *     上仍是静默 no-op」已修 —— 判据搬进单点成文的 `unmatchableToolNamesRefusal`,它拿 core 自己的 `validatePermissionRules`
- *     对同一串跑一遍文法(不自铸第二套判词),于是三张表对这两族说同一句话。S-654 (c) 起 `allow` 也收。
+ *     对同一串跑一遍文法(不自铸第二套判词),于是各表对这两族说同一句话。
  *     ⚠️ 存量 resume:带这两族拼法的**已存 body** 在 resume 腿会 422(resolve-spec 翻)。这**不是**新造的姿态——A3
  *     (`rejectUnmatchableSettingsNames`)早就对存量 body 里的退役名/短名同样抛,且 `applyTaskSettings` 腿有专门的回归钉。
  *     判据同一条:一个**静默不存在的审批门**比一次响亮失败更贵。codex 建议的「给非法存量条目保留旧的逐字比对」被**驳回**:
  *     那正是把 fail-open 请回来。
- *   · `caps.maxRules` 对齐 {@link MAX_PERMISSION_RULES_PER_LIST}(理由见那只常量)。core 的 set-level cap 连 `skip` 都照抛,
- *     所以运维腿的启动校验还要**试编一次**(`approvalGrantRefusal`)才拦得住超帽 —— 判据仍是本函数这一只。
- *   · 不再自铸 `decisionReason:"rule"` —— core 的规则策略本就不铸这个键(allow 命中由 core 自己铸 `"rule"`),且 core 侧唯一区分它的
+ *   · `caps.maxRules` 对齐 {@link MAX_PERMISSION_RULES_PER_LIST}(理由见那只常量);请求腿的受理门先按同一个数拒超帽(400)。
+ *   · 不自铸 `decisionReason` —— core 的规则策略本就不铸这个键,且 core 侧唯一区分它的
  *     两处(prepare-task 的继承 grant 复用判据、park 的 rule-suggestion 门)对 `"rule"` 与 `undefined` **同待**(只把 `"hook"`
  *     排除在外),dist 亲读在案。审计归因改由 `matchedAskRule` + `source` 承担,后者比前者强:它还让 core 的 auto-mode 分类器
  *     **拒绝**替人清掉这条 ask(「运维写下的『每次问我』不是分类器的犹豫」),方向是收紧。
- *
- * 🔴 **S-654 (c)(7.115.0,core 7.40.0 #1065):三种态度同一个编译口,`allow` 也走这里** —— `behavior: "allow"` 的规则命中 = core 带
- *  `decisionReason: "rule"` 的放行 —— allow 规则给出「有人表态」—— 它回答的是没人表态的服务器工具 / A2A 技能调用;内置工具上引擎自己的写门、shell 检查照问,deny / ask 照赢(与参照实现的 `permissions.allow` 在内置工具上**不同**:那边 `allow: ["Edit"]` 跳过编辑确认,这里不放掉引擎的写门);未命中 = `defaultAction: "allow"` 的裸 allow
- *  = 不表态、照常判。修前请求腿的 allow 编成 `createAllowDenyPolicy({ allow })` 的**名单**(名单在场 ⇒ 名单外的工具一律拒),与写它的人要的
- *  「替这些工具表态」方向相反;终端因此从不投这只桶。core 7.40.0 起没人表态的服务器工具调用要问,allow 规则就是那张卡的常设答案
- *  (`mcp__<server>__*` 一条覆盖整台服务器)。allow 规则**不越过** deny / ask:折叠 deny > ask > allow,任何一层的 deny / ask 照赢;
- *  它只在没人反对时给出那句表态。core 的 allow 文法只收工具名形(精确名 / `mcp__`·`a2a__` covering 形),内容形放行(`Bash(npm:*)` /
- *  `Edit(src/**)` / 参数级)core 拒编,两条腿与 deny / ask 同一个出口(判据 `unmatchableToolNamesRefusal`)。
- *  7.115.0 起运维的 `APPROVAL_GRANT` 也编在这里(无人值守腿没有请求体,那是运维为自己接的服务器表态的唯一位置)。 */
-/** `behavior` = 这张表的态度 —— 型直接是 core 的 `RuleBehavior`(不手抄:core 加一种态度,这里与它同步、读者 tsc 上见到)。 */
-export declare function createRuleListPolicy(names: readonly string[], behavior: RuleBehavior, source: string, pathBases: PathRuleBases | undefined): ToolPolicy;
+ */
+/** `behavior` = 这张表的态度 —— 型直接是 core 的 `PermissionRule["behavior"]`(不手抄:core 加 / 减一种态度,这里与它同步、读者 tsc 上见到)。 */
+export declare function createRuleListPolicy(names: readonly string[], behavior: PermissionRule["behavior"], source: string, pathBases: PathRuleBases | undefined): ToolPolicy;
 //# sourceMappingURL=permission-rule-list.d.ts.map

package/dist/permission-rule-vocab.d.ts

@@ -10,12 +10,13 @@ import type { RuleApprovalRecord, RuleBehavior } from "@sema-agent/core";
  */
 export declare function isPersistedRuleTool(name: string): boolean;
 /**
- * `PersistedRuleMatch` 五员(core 顶注逐字):`exact` / `prefix`(历史 colon-star,永久兼容读、复合前缀形的
+ * `PersistedRuleMatch` 七员(core 顶注逐字):`exact` / `prefix`(历史 colon-star,永久兼容读、复合前缀形的
  * 唯一拼写)/ `wildcard`([ref] 尾 space-star,单命令体上与 prefix **同一谓词**,建议面自此铸它)/
  * `subpath`(Read 目录形,永不容纳任何命令)/ `path`(core 7.9.0 [ref]:路径族 deny/ask/allow 的模式文法
- * —— `//abs`、`~/`、`/root-relative`、cwd 相对,段内 `*`、跨段 `**`)。
+ * —— `//abs`、`~/`、`/root-relative`、cwd 相对,段内 `*`、跨段 `**`)/ `name` / `name_prefix`(core 7.43.0 #1318:`Skill` 的名字文法 ——
+ * `Skill(<名>)` 精确、`Skill(<前缀>:*)` 名字前缀、无词界;技能卡的建议行 `match: "name"`)。
  */
-export declare const PERSISTED_RULE_MATCHES: readonly ["exact", "prefix", "wildcard", "subpath", "path"];
+export declare const PERSISTED_RULE_MATCHES: readonly ["exact", "prefix", "wildcard", "subpath", "path", "name", "name_prefix"];
 /**
  * S-511 —— `RuleBehavior` 每一员在**无同意仪式的直接写口**(`POST /v1/rules`)上的逐员表态。
  *

package/dist/permission-rule-vocab.js

@@ -2,7 +2,7 @@ import { ruleToolGrammarOf } from "@sema-agent/core";
 export function isPersistedRuleTool(name) {
     return ruleToolGrammarOf(name) !== undefined;
 }
-export const PERSISTED_RULE_MATCHES = ["exact", "prefix", "wildcard", "subpath", "path"];
+export const PERSISTED_RULE_MATCHES = ["exact", "prefix", "wildcard", "subpath", "path", "name", "name_prefix"];
 const MATCHES_PIN = true;
 void MATCHES_PIN;
 export const DIRECT_RULE_WRITE_ADMITS = {

package/dist/plugins/approval-ask-store-sql.d.ts

@@ -82,8 +82,8 @@ export interface AskRow {
     decisionNote: string | null;
     /**
      * 🔴 S-558(#1016 的持久半场)—— 这条决议的**结算来源**:`null` = 一个人答的(= 缺席律,core 对
-     * 不带这一格的 outcome 逐字按 `"human"` 读),非 null = 宿主自报的那个词(今天 wire 上只开
-     * `"policy"`,词表属主恒是 core —— 见 {@link HostSettledBy})。
+     * 不带这一格的 outcome 逐字按 `"human"` 读),非 null = 宿主自报的那个词(S-1154 起写进来的只有决定体出处位
+     * `decidedBy:"policy"` 经 `liveSettledBy` 映射来的 `"policy"`,allow 与 deny 两向都写;词表属主恒是 core —— 见 {@link HostSettledBy})。
      *
      * **为什么必须是行上的一格**(病灶,7.93.3 合并树 codex ① 验真):`settledBy` 此前只到达**当次**回决的
      * 即时回调,行上不留痕 ⇒ 重放 / 再入 / 同 askId 的兄弟等待者 / 歧义提交恢复读回的是裸 `false`,
@@ -230,8 +230,8 @@ export interface DecideAskInput {
      * 🔴 S-558:本次回决的**结算来源**,与决议同一条 UPDATE 落列 `settled_by`(语义/两态读法/为什么是
      * 自己一列,全在 {@link AskRow.settledBy})。缺席 ⇒ 列 NULL ⇒ 读回是「一个人答的」。
      *
-     * 店**不判词**(词表属主是 core):写什么存什么。店只判**形** —— `assertDecideSettledBy` 的两条
-     * (长度 ≤ 列宽、只与 `deny` 同行),理由见那只门的顶注;三 twin 同判。
+     * 店**不判词**(词表属主是 core):写什么存什么。店只判**形** —— `assertDecideSettledBy` 的那一条
+     * (长度 ≤ 列宽;S-1154 起 approve 行也可以带来源位),理由见那只门的顶注;三 twin 同判。
      */
     settledBy?: HostSettledBy;
     /** [ref]:ctrl+g 编辑实参,与决议同一条 UPDATE 落列(语义三态见 {@link AskRow.updatedInput})。
@@ -270,26 +270,23 @@ export declare function assertIntegralEpochMs(field: string, value: number): voi
 export declare function assertIdempotencyKeyShape(key: string): void;
 /** `settled_by` 列宽 = 这一格的唯一尺(两方言 DDL 与下面的形门读同一个常量,不手抄第二份)。 */
 export declare const MAX_SETTLED_BY_CHARS = 16;
-/** `settled_by` 这一列装得下这个词吗(1..{@link MAX_SETTLED_BY_CHARS})—— 形门 ① 的**谓词本身**,店门口
- *  ({@link assertDecideSettledBy})与耐久 ask 回决口的 CAS 前体门(S-843:确定的体形错误拒成 400,不落进提交歧义臂)
- *  读同一只,尺不抄第二份。 */
+/** `settled_by` 这一列装得下这个词吗(1..{@link MAX_SETTLED_BY_CHARS})—— 店门口形门({@link assertDecideSettledBy})的**谓词本身**。
+ *  S-1154 起决定口不再读它:wire 上的出处位是闭集(`host-decision.ts` 的 `APPROVAL_DECIDED_BY`),映射到这一列的词恒在尺内。 */
 export declare function settledByFitsColumn(v: string): boolean;
 /**
  * S-558 的**入店卫生门**(三 twin 同判,与 {@link assertIdempotencyKeyShape} / {@link assertIntegralEpochMs} 同族)。
- * 判的是**形**,不是**词** —— 词表属主恒是 core(`resolveAsk` 对自报词表外的值是响亮 fail-closed deny),
- * 本层一个词都不认识。两条:
+ * 判的是**形**,不是**词** —— 词表属主恒是 core,本层一个词都不认识。一条:
  *
- * ① **长度 ≤ 列宽**。`settled_by` 是 `VARCHAR(16)` 的闭集词列,而值来自 wire(两条回决腿只证得出「它是个串」)。
- *    不拦的话:MySQL 协议侧非严格模式**静默截断**、PG 侧直接报错 —— 同一份调用方代码在两个后端拿到两种
- *    答案(`assertIdempotencyKeyShape` 的 PAD SPACE 论证逐字同源),而**被截断过的词与原词是两个词**:
- *    一条决议的来源在库里变成了另一件事。空串同拒(core 那边它不是词,存进去只会读成一个假的「非人」)。
- * ② **只与 `deny` 同行**。core 的契约明写两个非人词只在 `allow:false` 上合法(`{allow:true,settledBy}` 是
- *    fail-closed 拒),两条回决腿也都在**裁决之前**照此响亮拒(`tool-approval.ts` 的
- *    `SETTLED_BY_DENY_ONLY`,两腿共用一份文案)。在店门口再执行一次不是「第二个判官」:判的不是词而是**这一对列能不能共存**。
- *    收益是结构性的 —— 「approve 行带来源位」从此在写面不可表示,读回铸点(`outcomeOfDecidedRow`)的 allow 臂
- *    因此**证得出**不会丢掉任何真事实,而不是靠记性。
+ * **长度 ≤ 列宽**。`settled_by` 是 `VARCHAR(16)` 的闭集词列。不拦的话:MySQL 协议侧非严格模式**静默截断**、PG 侧直接
+ * 报错 —— 同一份调用方代码在两个后端拿到两种答案(`assertIdempotencyKeyShape` 的 PAD SPACE 论证逐字同源),而**被截断过的
+ * 词与原词是两个词**:一条决议的来源在库里变成了另一件事。空串同拒(core 那边它不是词,存进去只会读成一个假的「非人」)。
+ *
+ * 🔴 S-1154:此前的第二条「只与 `deny` 同行」**删了** —— 它的前提(「只有人能批准一个要执行的动作,core 对 `{allow:true,settledBy}`
+ * 一律 fail-closed 拒」)自 core 7.39.0 起不成立:策略的放行铸 `policy_allowed`,决定体的出处位 `decidedBy:"policy"` 在 allow 与 deny
+ * 上都落这一列,approve 行带来源位是一条合法的行(读回铸点 `outcomeOfDecidedRow` 两向都读它)。今天写这一列的只有两条路:决定口经
+ * `liveSettledBy` 映射来的 `"policy"`,与 `claimTerminal(refuse)` 的 {@link POLICY_REFUSAL_DECISION} —— 都是 core 在两向上都收的词。
  */
-export declare function assertDecideSettledBy(decision: Pick<DecideAskInput, "decision" | "settledBy">): void;
+export declare function assertDecideSettledBy(decision: Pick<DecideAskInput, "settledBy">): void;
 /**
  * [ref] 车3 刀 3b(§14.2 遗留记账):两条**重放读口**被调用方的 deadline 掐断时抛的具名错误。
  *
@@ -324,7 +321,7 @@ export type AskTerminalClaimIntent = "expire" | "cancel" | "refuse";
  * `refuse` 意图落行的决议(NP-2)—— **部署政策拒**:deny + 结算来源 `policy`。来源词的型取 core 的 `HostSettledBy`
  * (core 改词 / 退词 ⇒ 这里 tsc 红);协调器交给 core 的那一只(`tool-approval.ts` 的 `UnattendedPolicyRefusal`)读的是
  * **同一个**常量,于是「行上记的来源」与「首判交出去的来源」在构造上是一个词。三 twin 落行前都过 {@link assertDecideSettledBy}
- * (settled_by 的唯一形门:长度 ≤ 列宽、只与 deny 同行)。
+ * (settled_by 的唯一形门:长度 ≤ 列宽)。
  */
 export declare const POLICY_REFUSAL_DECISION: {
     readonly decision: "deny";

package/dist/plugins/approval-ask-store-sql.js

@@ -24,9 +24,6 @@ export function assertDecideSettledBy(decision) {
     if (!settledByFitsColumn(v)) {
         throw new Error(`invalid settledBy: the settlement source is one word from the engine's closed set and lands in a VARCHAR(${MAX_SETTLED_BY_CHARS}) column — must be 1-${MAX_SETTLED_BY_CHARS} chars (got ${JSON.stringify(v.slice(0, 32))}${v.length > 32 ? "…" : ""}, length ${v.length})`);
     }
-    if (decision.decision !== "deny") {
-        throw new Error(`invalid settledBy: a settlement source is only representable on a deny row (got decision="${decision.decision}") — only a person approves an action that EXECUTES, so an approve row carrying a non-human settlement source is a row no replay could honestly hand back to the engine`);
-    }
 }
 export class ApprovalAskReadAbortedError extends Error {
     constructor(where) {

package/dist/plugins/one-time-migrations.d.ts

@@ -24,6 +24,15 @@ export interface OneTimeMigrationReport {
     readonly sessionIncarnationsBackfilled: number;
     /** M6:本次给「只有句子」的死亡判决行补上机读码的 run 行数(SQL `task_run` / local `run.json`)。非零 = 这次迁移真写了存量行(与 M4 同一条纪律)。 */
     readonly holderDeathCodeRowsBackfilled: number;
+    /** M8:本次把 `checkpoint.risk_descriptor` 的旧披露键 `shadowedRule` 改写成 `allowRuleShadowed` 的行数(SQL 独有;local 恒 0)。非零 = 真写了存量行。 */
+    readonly allowRuleShadowRowsMigrated: number;
+    /** M8:带旧键字样、但这一格的 JSON 读不懂 ⇒ 没改写的行数(留给读口自己的响亮臂;非零 = 运维该看一眼这些行)。SQL 独有;local 恒 0。 */
+    readonly allowRuleShadowRowsUnreadable: number;
+    /** M9:workflow park 指针索引的主键 —— `reshaped` = 本次把只有 `session_id` 的主键改成 `(session_id, run_id)`;`current` = 早已是新形
+     *  (新库 / 第二跑);`file-ledger` = local 文件车道(账本一行本来就是一条 run 的指针集,没有主键可改)。 */
+    readonly workflowParkIndexKey: "reshaped" | "current" | "file-ledger";
+    /** M9:改形时原样搬进新表的指针行数(`current` / `file-ledger` 时恒 0)。非零 = 这次迁移真重建了一张表,运维该看见一次。 */
+    readonly workflowParkIndexRowsCarried: number;
 }
 /**
  * S-590 —— 一条一次性迁移的窗(登记表的一行;纯数据)。字段注写着每个值的取证方式,改一行之前照着重核。
@@ -95,6 +104,22 @@ export declare class RetiredSteerSeatError extends Error {
  * @throws {RetiredSteerSeatError} M2 探到非空的退役席位(唯一的拒启臂)。
  */
 export declare function runSqlOneTimeMigrations(dialect: "tidb" | "pg", pool: MysqlPool | PgPool): Promise<OneTimeMigrationReport>;
+/** M8 一行改写的结论:改写后的文本 / 这一行不用动 / 读不懂(解析错误原样交出,调用方计数进读数)。 */
+export type ShadowedRuleRewrite = {
+    readonly kind: "rewrite";
+    readonly text: string;
+} | {
+    readonly kind: "untouched";
+} | {
+    readonly kind: "unreadable";
+    readonly error: unknown;
+};
+/**
+ * M8 的**一行**改写(纯函数;导出给钉用):`risk_descriptor` 的 JSON 文本里顶层带字符串 `shadowedRule` ⇒ 改写(旧键删、`allowRuleShadowed`
+ * 由旧值铸一条 `persisted` 记录;行上已经有 `allowRuleShadowed` ⇒ 只删旧键,不并);不是对象 / 没有旧键 / 旧键不是字符串 ⇒ `untouched`;
+ * JSON 读不懂 ⇒ `unreadable`(这一行不动,交给读口自己的响亮臂;迁移不替它猜,但把它数进读数,不静默)。
+ */
+export declare function migrateShadowedRuleDescriptor(text: string): ShadowedRuleRewrite;
 /**
  * M3 的**纯**改写(local 车道的账本行逐条走它;SQL 两腿在服务端用等价的 JSON 路径表达同一件事)。
  * 不改原对象(调用方与账本共享引用):有变更时换一只信封,原记录一个字节不动;无变更 ⇒ 返回

package/dist/plugins/one-time-migrations.js

@@ -1,6 +1,8 @@
-import { acquireEnsureSchemaLock, releaseEnsureSchemaLock } from "./tidb-pool.js";
-import { acquirePgEnsureSchemaLock, releasePgEnsureSchemaLock } from "./pg-pool.js";
-import { jsonColumnTextExpr } from "./sql-json-column.js";
+import { SCHEMA_STATEMENTS, acquireEnsureSchemaLock, releaseEnsureSchemaLock } from "./tidb-pool.js";
+import { PG_SCHEMA_STATEMENTS, acquirePgEnsureSchemaLock, releasePgEnsureSchemaLock } from "./pg-pool.js";
+import { CENTRAL_SCHEMA_INDEXES } from "./schema-indexes.js";
+import { ensureIndexes } from "./ensure-index.js";
+import { decodeJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readNonNullJsonValueColumn } from "./sql-json-column.js";
 import { SESSION_META_INCARNATION_COLUMN, mintSessionIncarnation } from "../session-incarnation.js";
 import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR } from "./store-contracts.js";
 export const ONE_TIME_MIGRATIONS = [
@@ -76,6 +78,47 @@ export const ONE_TIME_MIGRATIONS = [
             "丢掉的 steer 不再告诉用户;`GET /v1/runs/:id` 上 `errorCode` 缺席、只剩 `error` 句子",
         reportKeys: ["holderDeathCodeRowsBackfilled"],
     },
+    {
+        id: "M7",
+        introducedIn: "7.117.0",
+        releasedOn: "2026-10-06",
+        removableAfter: "2026-11-05",
+        removal: "删 `http/checkpoint-ctx.ts` 的读法记号判据与拒臂(`allowListReadingUnstated` / `allowListReadingEraOf` / `allowListReadingRefusal` / " +
+            "`PERMISSIONS_ALLOW_READINGS` / `ALLOW_LIST_READING_ERAS`、`buildCheckpointCtx` 里的记号写点)、`CheckpointCtx.permissionsAllowReading`、" +
+            "`resume-legs.ts` 两个判点与 `approval-sweeps.ts` 的跳过臂、随包排空判据 `permissions-allow-list`(两份 SQL + 本地脚本那一条)",
+        afterRemoval: "没有响亮臂:删码之后仍停驻、体里带非空 allow 的旧读法行(把 `APPROVAL_TERMINAL_BACKSTOP_MS` 调长的部署,或跳过了带本条的版本直接升的库)会被按" +
+            "当前读法静默重放(名单时代的行:名单外的工具放开;表态时代的行:普通问不再问)—— 升级前按 MIGRATION 7.117.0 节跑排空判据清零",
+        reportKeys: [],
+    },
+    {
+        id: "M8",
+        introducedIn: "7.117.0",
+        releasedOn: "2026-10-06",
+        removableAfter: "2026-11-05",
+        removal: "删 migrateOn 的 M8 步(`checkpoint.risk_descriptor` 的旧键扫描 + CAS 回写)与 `migrateShadowedRuleKey` / `migrateShadowedRuleDescriptor`;" +
+            "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `allowRuleShadowRowsMigrated` / `allowRuleShadowRowsUnreadable`",
+        afterRemoval: "没有响亮臂:删码之后仍带旧键的停驻行(跳过了带本条的版本直接升的库)在运维待批队列上只缺结构化披露 `allowRuleShadowed`;旧键的文本仍经脱敏叶表" +
+            "「认不得的键按内容脱敏」一条脱敏后原样显示,卡上 `message` 里引擎写好的那句话不受影响",
+        reportKeys: ["allowRuleShadowRowsMigrated", "allowRuleShadowRowsUnreadable"],
+    },
+    {
+        id: "M9",
+        introducedIn: "7.118.0",
+        releasedOn: "2026-10-07",
+        removableAfter: "2026-11-06",
+        removal: "删 migrateOn 的 M9 步(`reshapeWorkflowParkIndex` / `execAtomically` / `finishParkIndexShape`:收尾段、主键宽度探针、暂存表复制、换名、删旧表、索引补建、主键约束名)与 " +
+            "`primaryKeyWidth` / `WORKFLOW_PARK_INDEX_TABLE` / `WORKFLOW_PARK_INDEX_STAGING` / `WORKFLOW_PARK_INDEX_RETIRED`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 " +
+            "`workflowParkIndexKey` / `workflowParkIndexRowsCarried`;**连同读侧半场一起删**(都是「引擎 7.43 及以前写下的 workflow 子代停驻记录」这同一件事,同窗同删,不另起登记行):" +
+            "`orchestration/workflow-agent-session-index.ts` 的 `older_engine` 读臂(`routeWorkflowPark` 规则 ③、`WorkflowParkRoute` 与 `parked-decide.ts` `ParkOrigin` 上 `cause` 里的这一词," +
+            "`denyWorkflowParksUnreadable` 的对应分支;`unreadable` 成为唯一成因)与随包排空判据 `workflow-park-holder`(`scripts/drain-check.mysql.sql` / `scripts/drain-check.pg.sql` 的那一段" +
+            "与文件头判据清单里的那一行、`scripts/drain-check-local.mjs` 的 `DRAIN_CRITERIA` 那一条与 `readParkIndex`,以及 `MIGRATION.md` / `docs/DEPLOY-PREREQS.md` 里点名它的说明)",
+        afterRemoval: "没有响亮臂:删码之后仍是旧主键(只有 `session_id`)的库(跳过了带本条的版本直接升)上,同一个子会话只能有一枚指针 —— 续跑链 / 分叉里" +
+            "后写的那条记录覆盖先写的,判决只看得到一条记录:分叉判不出、链尾可能被更早的记录盖掉(决定投给那一条)。运维手工照中央 DDL 重建这张表即可" +
+            "(它是派生投影,丢了只丢升级那一刻还停驻着的旧卡的指针 —— 那些卡改答诚实 miss)。读侧半场删后:升级那一刻还停驻着、点名它的条目没有持有者位的存量卡" +
+            "(跳过了带本条的版本直接升的库)路由判 `none` ⇒ 落 legacy 腿,答 `409 conflict.resume_context_unavailable`(响亮,但成因是子会话没有续跑上下文,不再是 " +
+            "`decide.workflow_parks_unreadable`);出路不变(续跑发起它的那条 workflow run);随包排空判据没了,换钉前没有机器读数可数这些卡",
+        reportKeys: ["workflowParkIndexKey", "workflowParkIndexRowsCarried"],
+    },
 ];
 export const NO_SQL_MIGRATIONS = {
     retiredSnapshotTable: "absent",
@@ -85,6 +128,10 @@ export const NO_SQL_MIGRATIONS = {
     auditDetailJsonNullRows: 0,
     sessionIncarnationColumn: "lazy-on-read",
     sessionIncarnationsBackfilled: 0,
+    allowRuleShadowRowsMigrated: 0,
+    allowRuleShadowRowsUnreadable: 0,
+    workflowParkIndexKey: "file-ledger",
+    workflowParkIndexRowsCarried: 0,
 };
 const RETIRED_SNAPSHOT_TABLE = "snapshot_manifest";
 const RETIRED_STEER_SEAT_COLUMN = "pending_steer";
@@ -224,6 +271,8 @@ async function migrateOn(db, dialect) {
         (await db.exec(dialect === "tidb"
             ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND (error = ? OR error LIKE ?)"
             : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND (error = $2 OR error LIKE $3)", [RUN_HOLDER_DEATH_CODES.orphaned, RUN_ORPHANED_ERROR, `${RUN_ORPHANED_ERROR} (%`]));
+    const { migrated: allowRuleShadowRowsMigrated, unreadable: allowRuleShadowRowsUnreadable } = await migrateShadowedRuleKey(db, dialect);
+    const { key: workflowParkIndexKey, carried: workflowParkIndexRowsCarried } = await reshapeWorkflowParkIndex(db, dialect);
     let retiredSnapshotTable = "absent";
     let retiredSnapshotRows = 0;
     let retiredSteerSeatColumn = "absent";
@@ -256,9 +305,138 @@ async function migrateOn(db, dialect) {
     }
     return {
         retiredSnapshotTable, retiredSnapshotRows, retiredSteerSeatColumn, retiredSteerSeatStaleRows, askOriginRowsMigrated, auditDetailJsonNullRows,
-        sessionIncarnationColumn, sessionIncarnationsBackfilled, holderDeathCodeRowsBackfilled,
+        sessionIncarnationColumn, sessionIncarnationsBackfilled, holderDeathCodeRowsBackfilled, allowRuleShadowRowsMigrated, allowRuleShadowRowsUnreadable,
+        workflowParkIndexKey, workflowParkIndexRowsCarried,
     };
 }
+const WORKFLOW_PARK_INDEX_TABLE = "workflow_agent_session";
+async function primaryKeyWidth(db, dialect, table) {
+    const sql = dialect === "tidb"
+        ? `SELECT COUNT(*) AS n FROM information_schema.key_column_usage WHERE table_schema = DATABASE() AND table_name = '${table}' AND constraint_name = 'PRIMARY'`
+        : `SELECT COUNT(*) AS n FROM information_schema.table_constraints tc JOIN information_schema.key_column_usage kcu ` +
+            `ON kcu.constraint_name = tc.constraint_name AND kcu.table_schema = tc.table_schema AND kcu.table_name = tc.table_name ` +
+            `WHERE tc.table_schema = current_schema() AND tc.table_name = '${table}' AND tc.constraint_type = 'PRIMARY KEY'`;
+    return Number((await db.rows(sql))[0]?.n ?? 0);
+}
+const WORKFLOW_PARK_INDEX_STAGING = `${WORKFLOW_PARK_INDEX_TABLE}_m9`;
+const WORKFLOW_PARK_INDEX_RETIRED = `${WORKFLOW_PARK_INDEX_TABLE}_m9_old`;
+async function reshapeWorkflowParkIndex(db, dialect) {
+    const T = WORKFLOW_PARK_INDEX_TABLE;
+    const S = WORKFLOW_PARK_INDEX_STAGING;
+    const O = WORKFLOW_PARK_INDEX_RETIRED;
+    const exists = (t) => tableExists(db, dialect, t);
+    const ddl = (dialect === "tidb" ? SCHEMA_STATEMENTS : PG_SCHEMA_STATEMENTS).find((stmt) => stmt.includes(`CREATE TABLE IF NOT EXISTS ${T} (`));
+    if (ddl === undefined)
+        throw new Error(`one-time migration M9: the central schema carries no definition of ${T} — refusing to reshape a table it cannot rebuild`);
+    const copyPointers = (to, from) => db.exec(dialect === "tidb"
+        ? `INSERT IGNORE INTO ${to} (session_id, run_id, agent_key, scope) SELECT session_id, run_id, agent_key, scope FROM ${from}`
+        : `INSERT INTO ${to} (session_id, run_id, agent_key, scope) SELECT session_id, run_id, agent_key, scope FROM ${from} ON CONFLICT DO NOTHING`);
+    let carried = 0;
+    const resumed = await exists(S);
+    if (resumed) {
+        await db.exec(ddl);
+        carried += await copyPointers(T, S);
+        await execUntil(db, `DROP TABLE ${S}`, async () => !(await exists(S)));
+    }
+    if (await exists(O))
+        await execUntil(db, `DROP TABLE ${O}`, async () => !(await exists(O)));
+    if ((await primaryKeyWidth(db, dialect, T)) !== 1) {
+        if (await exists(T))
+            await finishParkIndexShape(db, dialect);
+        return resumed ? { key: "reshaped", carried } : { key: "current", carried: 0 };
+    }
+    await db.exec(ddl.replace(`CREATE TABLE IF NOT EXISTS ${T} (`, `CREATE TABLE IF NOT EXISTS ${S} (`));
+    carried += await copyPointers(S, T);
+    const swapped = async () => !(await exists(S)) && (await exists(T)) && (await primaryKeyWidth(db, dialect, T)) !== 1;
+    if (dialect === "tidb") {
+        await execUntil(db, `RENAME TABLE ${T} TO ${O}, ${S} TO ${T}`, swapped);
+        await execUntil(db, `DROP TABLE IF EXISTS ${O}`, async () => !(await exists(O)));
+    }
+    else {
+        await execAtomically(db, [`ALTER TABLE ${T} RENAME TO ${O}`, `ALTER TABLE ${S} RENAME TO ${T}`, `DROP TABLE ${O}`], async () => (await swapped()) && !(await exists(O)));
+    }
+    await finishParkIndexShape(db, dialect);
+    return { key: "reshaped", carried };
+}
+async function execAtomically(db, statements, postcondition) {
+    try {
+        await db.exec("BEGIN");
+        for (const sql of statements)
+            await db.exec(sql);
+        await db.exec("COMMIT");
+    }
+    catch (e) {
+        try {
+            await db.exec("ROLLBACK");
+        }
+        catch (rollbackError) {
+            throw new Error(`one-time migration: a transactional DDL step failed (${e instanceof Error ? e.message : String(e)}) and could not be rolled back on this connection ` +
+                `(${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}) — the database rolls the transaction back when the connection closes; the next start resumes`, { cause: e });
+        }
+        if (!(await postcondition()))
+            throw e;
+    }
+}
+async function finishParkIndexShape(db, dialect) {
+    await ensureIndexes(async (sql, params) => (dialect === "tidb" ? [await db.rows(sql, params)] : { rows: await db.rows(sql, params) }), dialect === "tidb" ? "mysql" : "pg", CENTRAL_SCHEMA_INDEXES.filter((spec) => spec.table === WORKFLOW_PARK_INDEX_TABLE));
+    if (dialect !== "pg")
+        return;
+    const conventional = `${WORKFLOW_PARK_INDEX_TABLE}_pkey`;
+    const pk = await db.rows(`SELECT constraint_name FROM information_schema.table_constraints WHERE table_schema = current_schema() AND table_name = '${WORKFLOW_PARK_INDEX_TABLE}' AND constraint_type = 'PRIMARY KEY'`);
+    const name = pk[0]?.constraint_name;
+    if (typeof name === "string" && name !== conventional)
+        await db.exec(`ALTER TABLE ${WORKFLOW_PARK_INDEX_TABLE} RENAME CONSTRAINT ${name} TO ${conventional}`);
+}
+const RETIRED_SHADOWED_RULE_KEY = "shadowedRule";
+export function migrateShadowedRuleDescriptor(text) {
+    let parsed;
+    try {
+        parsed = decodeJsonColumn(text, readNonNullJsonValueColumn, "checkpoint.risk_descriptor (M8 rewrite)");
+    }
+    catch (error) {
+        if (isJsonColumnBodyProblem(error))
+            return { kind: "unreadable", error };
+        throw error;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+        return { kind: "untouched" };
+    const { [RETIRED_SHADOWED_RULE_KEY]: old, ...rest } = parsed;
+    if (typeof old !== "string")
+        return { kind: "untouched" };
+    const next = Object.hasOwn(rest, "allowRuleShadowed") ? rest : { ...rest, allowRuleShadowed: [{ member: "persisted", entries: [old] }] };
+    return { kind: "rewrite", text: JSON.stringify(next) };
+}
+const SHADOWED_RULE_BATCH = 500;
+async function migrateShadowedRuleKey(db, dialect) {
+    const like = `%"${RETIRED_SHADOWED_RULE_KEY}"%`;
+    let migrated = 0;
+    let unreadable = 0;
+    let after = "";
+    for (;;) {
+        const rows = await db.rows(dialect === "tidb"
+            ? `SELECT token, ${jsonColumnText(dialect, "risk_descriptor")} FROM checkpoint WHERE ${jsonColumnTextExpr(dialect, "risk_descriptor")} LIKE ? AND token > ? ORDER BY token LIMIT ${SHADOWED_RULE_BATCH}`
+            : `SELECT token, ${jsonColumnText(dialect, "risk_descriptor")} FROM checkpoint WHERE ${jsonColumnTextExpr(dialect, "risk_descriptor")} LIKE $1 AND token > $2 ORDER BY token LIMIT ${SHADOWED_RULE_BATCH}`, [like, after]);
+        for (const r of rows) {
+            const token = String(r.token);
+            after = token;
+            const text = r.risk_descriptor;
+            if (typeof text !== "string")
+                continue;
+            const next = migrateShadowedRuleDescriptor(text);
+            if (next.kind === "unreadable") {
+                unreadable += 1;
+                continue;
+            }
+            if (next.kind === "untouched")
+                continue;
+            migrated += await db.exec(dialect === "tidb"
+                ? `UPDATE checkpoint SET risk_descriptor = ? WHERE token = ? AND ${jsonColumnTextExpr(dialect, "risk_descriptor")} = ?`
+                : `UPDATE checkpoint SET risk_descriptor = $1 WHERE token = $2 AND ${jsonColumnTextExpr(dialect, "risk_descriptor")} = $3`, [next.text, token, text]);
+        }
+        if (rows.length < SHADOWED_RULE_BATCH)
+            return { migrated, unreadable };
+    }
+}
 const INCARNATION_BACKFILL_BATCH = 500;
 async function migrateSessionIncarnations(db, dialect) {
     if (!(await tableExists(db, dialect, "session_meta")))
@@ -329,7 +507,8 @@ export function migrateRetiredAskOrigin(type, data) {
 }
 export function logOneTimeMigrations(log, backend, report) {
     const changed = report.retiredSnapshotTable === "dropped" || report.retiredSteerSeatColumn === "dropped" || report.askOriginRowsMigrated > 0 || report.auditDetailJsonNullRows > 0 ||
-        report.sessionIncarnationColumn === "added" || report.sessionIncarnationsBackfilled > 0 || report.holderDeathCodeRowsBackfilled > 0;
+        report.sessionIncarnationColumn === "added" || report.sessionIncarnationsBackfilled > 0 || report.holderDeathCodeRowsBackfilled > 0 || report.allowRuleShadowRowsMigrated > 0 || report.allowRuleShadowRowsUnreadable > 0 ||
+        report.workflowParkIndexKey === "reshaped";
     (changed ? log.warn : log.info).call(log, "one_time_migrations_applied", {
         backend,
         retiredSnapshotTable: report.retiredSnapshotTable,
@@ -341,13 +520,20 @@ export function logOneTimeMigrations(log, backend, report) {
         sessionIncarnationColumn: report.sessionIncarnationColumn,
         sessionIncarnationsBackfilled: report.sessionIncarnationsBackfilled,
         holderDeathCodeRowsBackfilled: report.holderDeathCodeRowsBackfilled,
+        allowRuleShadowRowsMigrated: report.allowRuleShadowRowsMigrated,
+        allowRuleShadowRowsUnreadable: report.allowRuleShadowRowsUnreadable,
+        workflowParkIndexKey: report.workflowParkIndexKey,
+        workflowParkIndexRowsCarried: report.workflowParkIndexRowsCarried,
         removableAfter: Object.fromEntries(ONE_TIME_MIGRATIONS.map((w) => [w.id, w.removableAfter])),
         note: "one-time persisted-data migrations (M1: retired whole-tree snapshot index table dropped; M2: retired single-seat " +
             "steering column dropped; M3: retired ask-origin spelling rewritten in place; M4: audit details written as the JSON " +
             "text `null` by an earlier version folded to a SQL NULL, so \"no detail\" has exactly one on-disk spelling; M5: the " +
             "session incarnation column added and every session row without one minted its own token; M6: run rows failed by a " +
             "holder-death verdict written by an earlier version with only the sentence got the machine-readable code run.stalled / " +
-            "run.orphaned). Each step " +
+            "run.orphaned; M7 writes nothing — it is the window of the refusal that keeps a suspended task whose stored allow list was written " +
+            "under an earlier reading from resuming under the current one; M8: parked rows' allow-layer disclosure written by an earlier engine " +
+            "under its old key shadowedRule rewritten to allowRuleShadowed; M9: the workflow park pointer index rebuilt with the key (session, run), " +
+            "its rows carried over). Each step " +
             "runs on every boot until its window closes (the release that introduced it + 30 days; the per-step date is in " +
             "removableAfter, null while that release is not published yet) and is deleted in the first minor after that — start a " +
             "version that still carries a step at least once before upgrading past its deletion.",

package/dist/plugins/pg-pool.js

@@ -282,7 +282,7 @@ export const PG_SCHEMA_STATEMENTS = [
      run_id     VARCHAR(191) COLLATE "C" NOT NULL,
      agent_key  VARCHAR(191) COLLATE "C" NOT NULL,
      scope      VARCHAR(190) COLLATE "C" NOT NULL,
-     PRIMARY KEY (session_id)
+     PRIMARY KEY (session_id, run_id)
    )`,
     `CREATE TABLE IF NOT EXISTS workflow_completion_inbox (
      seq            BIGSERIAL,

package/dist/plugins/tidb-pool.js

@@ -528,7 +528,7 @@ export const SCHEMA_STATEMENTS = [
      run_id     VARCHAR(191) NOT NULL,
      agent_key  VARCHAR(191) NOT NULL,
      scope      VARCHAR(190) NOT NULL,
-     PRIMARY KEY (session_id),
+     PRIMARY KEY (session_id, run_id),
      KEY idx_wfagentsess_run (run_id)
    ) COLLATE utf8mb4_bin`,
     `CREATE TABLE IF NOT EXISTS workflow_completion_inbox (