@sema-agent/server 7.130.0 → 7.132.0

package/dist/plugins/one-time-migrations.js

@@ -1,39 +1,102 @@
-import { SESSION_RULES_GRAMMAR, compileSessionRuleBucket, readSessionRulesShape } from "@sema-agent/core";
+import { PAUSE_REGISTRY, SESSION_RULES_GRAMMAR, compileSessionRuleBucket, isGateKind, readSessionRulesShape, unreadableDenyEntries } from "@sema-agent/core";
+import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
+import { dialectProtocolJsonEncoder } from "./sql-driver.js";
 import { SCHEMA_STATEMENTS, acquireEnsureSchemaLock, releaseEnsureSchemaLock } from "./tidb-pool.js";
 import { PG_SCHEMA_STATEMENTS, acquirePgEnsureSchemaLock, releasePgEnsureSchemaLock } from "./pg-pool.js";
 import { CENTRAL_SCHEMA_INDEXES } from "./schema-indexes.js";
 import { ensureIndexes } from "./ensure-index.js";
-import { decodeJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readNonNullJsonValueColumn, readOpaqueJsonValueColumn } from "./sql-json-column.js";
+import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readNonNullJsonValueColumn, readOpaqueJsonValueColumn, } from "./sql-json-column.js";
 import { SESSION_META_INCARNATION_COLUMN, mintSessionIncarnation } from "../session-incarnation.js";
-import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR, StoreBootRefusalError } from "./store-contracts.js";
+import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR } from "./store-contracts.js";
 import { PERMISSION_RULE_TABLE, purgeUndurableScopeRows } from "./permission-rule-store-sql.js";
-import { SCHEMA_MISMATCH_ERROR_CODE } from "./schema-consistency.js";
 import { SESSION_RULES_COLUMN } from "./session-rules-column.js";
 import { readJsonObjectColumn } from "./sql-json-column.js";
 import { retireStoredCardWords } from "../retired-card-words.js";
 import { redactSecrets } from "../trace/redact.js";
 const RETIRED_SESSION_RULE_BUCKETS = ["commandAllow", "commandDeny"];
-export function buildSessionRuleReceipts() {
-    return { rows: [], renamed: false };
+export function buildMigrationReceipts() {
+    return {
+        auditDetailJsonNullRows: 0,
+        sessionIncarnationsBackfilled: 0,
+        holderDeathCodeRowsBackfilled: 0,
+        allowRuleShadowRowsMigrated: 0,
+        allowRuleShadowRowsUnreadable: 0,
+        workflowParkIndexRowsCarried: 0,
+        undurableScopeRuleRows: [],
+        undurableScopeRuleBucketsDeferred: 0,
+        undurableScopeRuleBucketsUnreadable: [],
+        sessionRuleRowsWithRetiredBuckets: [],
+        sessionRuleRowsWithOldGrammarEntries: [],
+        sessionRuleRowsWithUnreadableDeny: [],
+        retiredCardWordAskRowsRewritten: 0,
+        retiredCardWordRowsUnreadable: 0,
+        parkedQuestionCardsWritten: 0,
+        parkedQuestionRowsLeftAsWritten: 0,
+        parkedRowGateKindsBackfilled: 0,
+        parkedRowsUnresumableExpired: 0,
+    };
+}
+function completedReport(r) {
+    const { sessionIncarnationColumn, workflowParkIndexKey, sessionRuleColumn } = r;
+    if (sessionIncarnationColumn === undefined || workflowParkIndexKey === undefined || sessionRuleColumn === undefined) {
+        throw new Error(`one-time migrations finished without settling a shape reading (M5 ${String(sessionIncarnationColumn)} / M9 ${String(workflowParkIndexKey)} / M17 ${String(sessionRuleColumn)}) — a step did not record it`);
+    }
+    return { ...r, sessionIncarnationColumn, workflowParkIndexKey, sessionRuleColumn };
+}
+function changedAnything(r) {
+    return (r.auditDetailJsonNullRows > 0 ||
+        r.sessionIncarnationColumn === "added" ||
+        r.sessionIncarnationsBackfilled > 0 ||
+        r.holderDeathCodeRowsBackfilled > 0 ||
+        r.allowRuleShadowRowsMigrated > 0 ||
+        r.allowRuleShadowRowsUnreadable > 0 ||
+        r.workflowParkIndexKey === "reshaped" ||
+        r.workflowParkIndexRowsCarried > 0 ||
+        r.undurableScopeRuleRows.length > 0 ||
+        r.undurableScopeRuleBucketsDeferred > 0 ||
+        r.undurableScopeRuleBucketsUnreadable.length > 0 ||
+        r.sessionRuleColumn === "renamed" ||
+        r.sessionRuleRowsWithRetiredBuckets.length > 0 ||
+        r.sessionRuleRowsWithOldGrammarEntries.length > 0 ||
+        r.sessionRuleRowsWithUnreadableDeny.length > 0 ||
+        r.retiredCardWordAskRowsRewritten > 0 ||
+        r.retiredCardWordRowsUnreadable > 0 ||
+        r.parkedQuestionCardsWritten > 0 ||
+        r.parkedQuestionRowsLeftAsWritten > 0 ||
+        r.parkedRowGateKindsBackfilled > 0 ||
+        r.parkedRowsUnresumableExpired > 0);
+}
+function readingsSnapshot(r) {
+    return {
+        ...r,
+        undurableScopeRuleRows: [...r.undurableScopeRuleRows],
+        undurableScopeRuleBucketsUnreadable: [...r.undurableScopeRuleBucketsUnreadable],
+        sessionRuleRowsWithRetiredBuckets: [...r.sessionRuleRowsWithRetiredBuckets],
+        sessionRuleRowsWithOldGrammarEntries: [...r.sessionRuleRowsWithOldGrammarEntries],
+        sessionRuleRowsWithUnreadableDeny: [...r.sessionRuleRowsWithUnreadableDeny],
+    };
+}
+function receiptSentence(r) {
+    const counts = Object.entries(readingFields(r))
+        .filter(([, v]) => (typeof v === "number" ? v > 0 : v !== undefined))
+        .map(([k, v]) => `${k}=${String(v)}`);
+    const rows = [
+        ...r.undurableScopeRuleRows.map((x) => `removed ${x.kind} in permission-rule bucket ${x.ownerKey} (${x.behavior} ${x.tool}, scope root ${JSON.stringify(x.scopeRoot)})`),
+        ...r.sessionRuleRowsWithOldGrammarEntries.map((x) => `${x.policyKey} (session ${x.sessionId}): toolAllowDropped=${JSON.stringify(x.toolAllowDropped)}`),
+        ...r.sessionRuleRowsWithUnreadableDeny.map((x) => `${x.policyKey} (session ${x.sessionId}): left as stored, toolDenyUnreadable=${JSON.stringify(x.toolDenyUnreadable)}${x.retiredBuckets !== undefined ? `, retiredBuckets=${JSON.stringify(x.retiredBuckets)}` : ""}`),
+    ];
+    return [counts.join(", "), ...rows].filter((part) => part !== "").join("; ");
 }
 export class OneTimeMigrationInterruptedError extends Error {
     receipts;
     constructor(cause, receipts) {
-        super(`${cause instanceof Error ? cause.message : String(cause)} — one-time migration M17 had already committed changes whose receipts the next boot cannot re-derive ` +
-            "(the rows below are rewritten, so a retry finds nothing left to remove from them) — record them before retrying: " +
-            receipts.sessionRuleRowsWithOldGrammarEntries.map((r) => `${r.policyKey} (session ${r.sessionId}): toolAllowDropped=${JSON.stringify(r.toolAllowDropped)}`).join("; "), { cause });
+        super(`${cause instanceof Error ? cause.message : String(cause)} — the one-time migrations had already committed changes before this failure; a retried boot finds that work done ` +
+            "and cannot report it again — record these readings before retrying: " +
+            receiptSentence(receipts), { cause });
         this.name = "OneTimeMigrationInterruptedError";
         this.receipts = receipts;
     }
 }
-function interruptedWith(cause, receipts) {
-    if (receipts.rows.length === 0)
-        return cause;
-    return new OneTimeMigrationInterruptedError(cause, {
-        ...(receipts.renamed ? { sessionRuleColumn: "renamed" } : {}),
-        sessionRuleRowsWithOldGrammarEntries: [...receipts.rows],
-    });
-}
 export const ONE_TIME_MIGRATIONS = [
     {
         id: "M4",
@@ -132,7 +195,7 @@ export const ONE_TIME_MIGRATIONS = [
         releasedOn: "2026-10-08",
         removableAfter: "2026-11-07",
         removal: "删 migrateOn 的 M11 步(`permission_rule` 在场探针 + `purgeUndurableScopeRows` 调用)与 `permission-rule-store-sql.ts` 的 `purgeUndurableScopeRows` / " +
-            "`purgeAllBuckets` / `purgeOneBucket` / `contentFreeRefusal` / `PurgeAccumulator` / `UndurableScopeRuleRow` / `UnreadableRuleBucket` / `UndurableScopePurge` / " +
+            "`purgeOneBucket` / `contentFreeRefusal` / `UndurableScopeRuleRow` / `UnreadableRuleBucket` / `UndurableScopePurgeReadings` / " +
             "`UndurableScopePurgeDb` / `UNDURABLE_PURGE_PAGE` / `UNDURABLE_PURGE_OCC_ATTEMPTS`、本文件的 `removedRuleRowNote`,以及 `BucketRefusedError` 的 `verdict` 位(若届时再无别的读者;" +
             "判官 `decodeBucketRow` 与写法 `writeBucket` 是读腿 / 写臂本身,留);报告、日志行(含逐行的 `permission_rule_row_removed` 与逐桶的 " +
             "`permission_rule_bucket_unreadable`)与 `NO_SQL_MIGRATIONS` 的 `undurableScopeRuleRows` / `undurableScopeRuleBucketsDeferred` / `undurableScopeRuleBucketsUnreadable`",
@@ -149,7 +212,7 @@ export const ONE_TIME_MIGRATIONS = [
         removal: "删模式词读法记号的判据与拒臂:`http/stored-body-replay.ts` 的 `permissionModeReadingUnstated`;`http/checkpoint-ctx.ts` 的 `permissionModeReadingStated` / `permissionModeReadingRefusal` / `PERMISSION_MODE_READINGS`、" +
             "`StoredBodyReplayRefusal` 的 `permission_mode_reading` 臂及其日志字段与答复臂、`buildCheckpointCtx` 与 `withPermissionModeRewritten` 两处记号写点" +
             "(后者删后 `resume-legs.ts` `drivePlanReview` 里对它的那一处调用回到只换体的 `{ ...ctx, body }`)、`CheckpointCtx.permissionModeReading`、" +
-            "`http/stored-body-replay.ts` `storedBodyReplayRefusal` 的 `autonomy` 形参(只服务这一问)与四个问点(`resume-legs.ts` 两处、`approval-sweeps.ts`、`routes/runs.ts`)传 `deps.config.autonomy` 的那一句",
+            "`http/stored-body-replay.ts` 里 `StoredReplayDeployment` 的 `autonomy` 位与 `storedBodyReplayRefusal` 读 `deployment.autonomy` 的那一句(这一位只服务这一问;四个问点传 `deps.config` 整份,home 位还服务 `permissions` 一问,不动)",
         afterRemoval: "没有响亮臂:删码之后仍停驻、在 7.121.x 及以前写下的行(把 `APPROVAL_TERMINAL_BACKSTOP_MS` 调长的部署,或跳过了带本条的版本直接升的库)在设了 " +
             "`AUTONOMY=plan` 的部署上按体里的原词重放(运维的 plan 不再被按段重钳)—— 升级前把这些停驻的 run 决掉 / 取消,或升级窗内设 `AUTONOMY=read-only`",
         reportKeys: [],
@@ -213,16 +276,15 @@ export const ONE_TIME_MIGRATIONS = [
         removal: "删 migrateOn 的 M17 步(`migrateSessionRuleGrammar`:`session_policy` 在场探针、旧名 → 进行中的名 → 判读 → 终名三段、退役命令桶扫描与点名)与 " +
             "`retiredSessionRuleBucketsOf` / `RetiredSessionRuleBucket` / `RETIRED_SESSION_RULE_BUCKETS` / `RETIRED_SESSION_RULES_COLUMN` / `OLD_GRAMMAR_SESSION_RULES_COLUMN` / `SESSION_RULES_SCAN_PAGE` / `SessionRuleRowRetiredBuckets` / " +
             "`oldGrammarEntriesOf` / `OldGrammarEntries` / `judgeOldGrammarRows` / `renameSessionRulesColumnSql` / `scanSessionRuleRows` / `SessionRuleScanRow` / " +
-            "`RETIRED_BUCKET_PATTERNS` / `SessionRuleRowOldGrammarEntries` / 收据账 `SessionRuleReceipts` / `buildSessionRuleReceipts` / `OneTimeMigrationReceipts` / " +
-            "`OneTimeMigrationInterruptedError` / `interruptedWith`(`migrateOn` 外层的那一道 try / catch)/ `logOneTimeMigrationsInterrupted` / `runAndLogOneTimeMigrations` 里的失败日志臂 / `logSessionRuleOldGrammarRows`;" +
-            "报告、日志行(含逐行的 `session_rule_row_retired_bucket` 与 `session_rule_row_old_grammar_entries`)与 `NO_SQL_MIGRATIONS` 的 `sessionRuleColumn` / " +
-            "`sessionRuleRowsWithRetiredBuckets` / `sessionRuleRowsWithOldGrammarEntries`;" +
+            "`RETIRED_BUCKET_PATTERNS` / `SessionRuleRowOldGrammarEntries` / `SessionRuleRowUnreadableDeny` / `UnreadableDenyEntry`;`logReceiptRows` 里 M17 的三段与 `receiptSentence` 里 M17 的两段;" +
+            "报告、日志行(含逐行的 `session_rule_row_retired_bucket` · `session_rule_row_old_grammar_entries` · `session_rule_row_unreadable_deny`)与 `NO_SQL_MIGRATIONS` 的 `sessionRuleColumn` / " +
+            "`sessionRuleRowsWithRetiredBuckets` / `sessionRuleRowsWithOldGrammarEntries` / `sessionRuleRowsWithUnreadableDeny`;" +
             "**列名本身留在中央 DDL 里**(`session-rules-column.ts`,它不是迁移的一部分)",
         afterRemoval: "① 列还叫 `rules`、或停在进行中的名 `rule_entries_old_grammar` 的存量库(跳过了带本条的版本直接升 / 判读没走完就跳版):起服列册探针 `schema-consistency.ts`(S-547)拒启 " +
             "`config.schema_mismatch`(缺 `rule_entries`、多那一列)—— " +
             "出路是先在一只带本条的版本上起服一次;② 行里仍带退役命令桶:SQL 店读回照旧答 `corrupt`(引擎的形读法点名那只桶,与本条在场时同一个结局),只是起服日志不再逐行点名 —— " +
             "运维在库里把那一行改写成引擎文法或删掉它(删会话即删规则);③ 跳过本条直接升的库同样没有改名那一拍的条目判读 —— 由 ① 的拒启接住(出路同 ①)",
-        reportKeys: ["sessionRuleColumn", "sessionRuleRowsWithRetiredBuckets", "sessionRuleRowsWithOldGrammarEntries"],
+        reportKeys: ["sessionRuleColumn", "sessionRuleRowsWithRetiredBuckets", "sessionRuleRowsWithOldGrammarEntries", "sessionRuleRowsWithUnreadableDeny"],
     },
     {
         id: "M18",
@@ -246,16 +308,60 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.130.0",
         releasedOn: "2026-10-16",
         removableAfter: "2026-11-15",
-        removal: "删 `src/stored-request-tool-axes-m19.ts` 整只文件(`storedToolAxesRereadM19` / `readToolAxesAsServer7129M19` / `StoredToolAxesRereadM19`);" +
-            "`boot/resolve-spec.ts` 里递给 `resolveRequestMcp` 的那一实参(`opts?.leg === \"fresh\" ? undefined : storedToolAxesRereadM19(…)`)与它的 import;" +
+        removal: "删 `src/stored-request-tool-axes-m19.ts` 整只文件(`storedToolAxesRereadM19` / `readToolAxesAsServer7129M19` / `readA2aToolAxesAsServer7131M19` / `StoredToolAxesRereadM19`);" +
+            "`boot/resolve-spec.ts` 里两条请求腿共用的那一行(`const storedToolAxes = opts?.leg === \"fresh\" ? undefined : storedToolAxesRereadM19(…)`)、递给 `resolveRequestMcp` / `resolveRequestA2a` 的两处实参与它的 import;" +
             "`task-mcp.ts` 里 `resolveRequestMcp` / `classifyRequestMcp` / `classifyHonored` / `validateRequestMcpEntries` / `normalizeServer` 的 `storedToolAxes` 形参、" +
-            "`toolAxesReread` 事实与运维行 `mcp_tool_axes_read_as_before_upgrade`,以及对本模块的型 import;`tool-axis-words.ts` 头注与两只谓词 JSDoc 里点名 M19 的那几处;" +
+            "`toolAxesReread` 事实与运维行 `mcp_tool_axes_read_as_before_upgrade`,以及对本模块的型 import(升级前读法的词表与两只谓词住在本模块里,随它一起删);" +
+            "`task-a2a.ts` 里 `resolveRequestA2a` / `validateRequestA2aEntries` / `normalizeA2aPeer` 的 `storedToolAxes` 形参、`toolAxesReread` 事实与运维行 `a2a_tool_axes_read_as_before_upgrade`、对本模块的型 import;" +
             "`test/mcp-tool-axes-m19.test.ts`(窗关那一格 —— 存量坏形整条不进、warn 与通告点名 `field: toolAxes` —— 改钉到 `test/task-mcp.test.ts`);" +
             "本文件的 `migrationWindowOpen`(若再无别的读者)",
         afterRemoval: "没有新的臂,接住它的是今天的读法(删码零行为变化:窗关那一刻起重读臂已经不生效):升级前存下的请求体里引擎判官判不过的 `toolAxes`,续跑重放时这一条 server 整条不进," +
             "运维 warn `mcp_injection_dropped`(`reason: malformed_entry`、`field: toolAxes`)+ 用户面通告 `mcp.injection_dropped`,兄弟照挂;停驻在这台 server 工具审批上的任务" +
             "批准后撞 `resume.tool_unavailable`(拒绝照常可出)—— 出路是拒绝那张卡,用改好的 `toolAxes` 重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、" +
-            "调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行(头注 M19 段)",
+            "调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行(头注 M19 段)。A2A 一面同:存量体里 `a2aPeers[].toolAxes` 判不过的对端续跑整条不挂," +
+            "运维 warn `a2a_injection_dropped` 点名,停驻在它 skill 上的审批批准后撞 `resume.tool_unavailable` —— 出路同上:拒绝那张卡,改好声明重新提交",
+        reportKeys: [],
+    },
+    {
+        id: "M20",
+        introducedIn: "7.131.0",
+        releasedOn: "2026-10-16",
+        removableAfter: "2026-11-15",
+        removal: "删 `src/stored-request-hooks-m20.ts` 整只文件(`storedHooksRereadM20` / `rereadStoredHooksM20` / `StoredHooksRereadM20` / `ENTRY_FIELD_NAMES` / `MATCHER_FIELD_NAMES` / `nodeAt` / `cloneDoc` / `removeKeyAt`);" +
+            "`boot/resolve-spec.ts` 里递给 `parseTaskSettings` 的重读座实参(`opts?.leg === \"fresh\" || !taskHooksHonored(config) ? {} : { storedHooksReread: storedHooksRereadM20(…) }`)与它的 import、" +
+            "`hooks_read_as_before_upgrade` 那一段 warn;`task-settings.ts` 的 `ParseTaskSettingsSeats` / `ParseTaskSettingsResult.hooksReread` / `parseTaskSettings` 第二形参与 hooks 臂里的重读那一支;" +
+            "`hooks/hook-runner.ts` 的 `ParseHooksConfigResult.pieces` / `HooksRefusalPiece`(若再无别的读者)与 `hooksCoordinate` 的 export;" +
+            "`test/hooks-stored-reread-m20.test.ts`(窗关那一格 —— 整份不采纳 + `server.hooks.resume-reader-refused` 计一笔 —— 改钉到 `test/hooks-entry-admission.test.ts` 的续跑腿组)",
+        afterRemoval: "没有新的臂,接住它的是今天的读法(删码零行为变化:窗关那一刻起重读臂已经不生效):升级前存下的请求体里带这两形的 `settings.hooks`,续跑重放时整份不采纳(其中真在拦的 `PreToolUse` 钩子也不再拦)," +
+            "运维 warn `task_settings_deferred`(字段 `hooks`)+ fail-open 登记 `server.hooks.resume-reader-refused`(计数 + 探针 + 一次性 warn,census 第 140 行),任务照常续跑 —— " +
+            "出路是把这类停驻任务决掉、删掉那个未知字段 / `__proto__` 键后重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行(头注 M20 段)",
+        reportKeys: [],
+    },
+    {
+        id: "M21",
+        introducedIn: "7.132.0",
+        releasedOn: "2026-10-18",
+        removableAfter: "2026-11-17",
+        removal: "删 migrateOn 的 M21 步(`repairParkedRows`:pending 候选分页扫描、门型回填、续不了的置 expired、问答卡词的整只文档读 + CAS 回写)与 `parkedRowRepairOf` / `ParkedRowRepair` / " +
+            "`M21_GATE` / `M21_PENDING_ACTION` / `PARKED_ROW_REPAIR_PAGE` / `QUESTION_CARD` / `PARKED_APPROVAL_GATE_KINDS` / `readM21Subtree` / `readM21Document` / `m21Subtree`;" +
+            "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `parkedQuestionCardsWritten` / `parkedQuestionRowsLeftAsWritten` / `parkedRowGateKindsBackfilled` / `parkedRowsUnresumableExpired`;" +
+            "`test/one-time-migrations.test.ts` 的 M21 组与 `test/one-time-migrations-db-integration.test.ts` 的 M21 格",
+        afterRemoval: "① 门上没有卡词的存量问答行(跳过了带本条的版本直接升的库、把 `APPROVAL_TERMINAL_BACKSTOP_MS` 调长的部署、local 车道 —— 那一车道本条从来够不着):没有新的臂,回到本条之前的读法 —— " +
+            "队列行不带卡词(壳显示通用审批卡),到期走 SLA 拒扫腿(模型读到「拒」),决断口仍按工具名认问答(`approve` 必须带 `answer`,否则 400);出路 = 升级前答完或拒掉;" +
+            "② `gate_kind` 为 NULL 的停驻行:既有响亮臂 —— 运维待批队列(`listPending`)不列它、计 `server.approvals.queue-row-gate-kind-missing`(决断口按门型绑定取行,本来就不认它);" +
+            "出路是运维把那一行置 expired 或删掉会话(终局收割照旧在 `terminal_at_ms` 收它)",
+        reportKeys: ["parkedQuestionCardsWritten", "parkedQuestionRowsLeftAsWritten", "parkedRowGateKindsBackfilled", "parkedRowsUnresumableExpired"],
+    },
+    {
+        id: "M22",
+        introducedIn: "7.132.0",
+        releasedOn: "2026-10-18",
+        removableAfter: "2026-11-17",
+        removal: "删 `config-lkg.ts` 的 formatVersion 4 读回迁移:`migrateV4Lkg` 与其上的窗注;`loadLkg` 里调它的那一支(`formatVersion !== 5` 那一段)与版本判据里的 `4`" +
+            "(4 回到「unknown formatVersion」拒;若 M13 / M15 仍在窗内,先删到期的那几条再删本条,版本判据收成只认 5)、`LkgReadMigration.fromFormat` 的 `4`;" +
+            "文件头注 formatVersion 5 一段里「4 的载荷 …」那两句;`test/center-artifact-v3-lane.test.ts` 的两格 4 读回(5 原样读回那一格留)",
+        afterRemoval: "既有响亮臂 `config_lkg_unusable`(`loadLkg` 对 4 答「unknown formatVersion 4」):4 读回 ⇒ 不可用,中心可达照拉(整拉,新 LKG 按 5 覆盖)、断着则 env 兜底 —— " +
+            "与回滚到 7.131.x 读 5 同一种处置",
         reportKeys: [],
     },
 ];
@@ -276,29 +382,16 @@ export const NO_SQL_MIGRATIONS = {
     sessionRuleColumn: "file-store",
     sessionRuleRowsWithRetiredBuckets: [],
     sessionRuleRowsWithOldGrammarEntries: [],
+    sessionRuleRowsWithUnreadableDeny: [],
     retiredCardWordAskRowsRewritten: 0,
     retiredCardWordRowsUnreadable: 0,
+    parkedQuestionCardsWritten: 0,
+    parkedQuestionRowsLeftAsWritten: 0,
+    parkedRowGateKindsBackfilled: 0,
+    parkedRowsUnresumableExpired: 0,
 };
 const AUDIT_TABLE = "device_audit";
 const AUDIT_DETAIL_COLUMN = "detail";
-const RETIRED_SNAPSHOT_TABLE = "snapshot_manifest";
-const RETIRED_STEER_SEAT_COLUMN = "pending_steer";
-export class RetiredSchemaPresentError extends StoreBootRefusalError {
-    found;
-    code = SCHEMA_MISMATCH_ERROR_CODE;
-    constructor(found) {
-        super(`${SCHEMA_MISMATCH_ERROR_CODE}: this database still carries schema that the one-time migrations of server 7.74.0–7.125.x retired — refusing to start. ` +
-            `Found: ${found.join("; ")}. ` +
-            `Both come from builds that predate those migrations, so this database never booted a build that still carried them — which also means the third one never ran: ` +
-            `ask-origin gates stored under the retired spelling \`unresolvable\` (in task_event.data and in checkpoint.execution_outcome) were not rewritten to \`ancestor_marked\`. ` +
-            `This build carries none of the three and will not guess. ` +
-            `Way out: start a server 7.125.x build once against this database and let its one-time migrations finish (it drops the table and the column and rewrites the spelling; ` +
-            `while the column still holds a steering instruction that can be delivered it refuses and names the rows and its own ways out), then upgrade to this build. ` +
-            `The check behind this refusal is read-only and runs before this build creates any table or rewrites anything: it changed nothing in the database.`);
-        this.found = found;
-        this.name = "RetiredSchemaPresentError";
-    }
-}
 function mysqlDb(conn) {
     return {
         async rows(sql, params) {
@@ -343,34 +436,6 @@ async function columnExists(db, dialect, table, column) {
     const sql = `SELECT 1 AS present FROM information_schema.columns WHERE table_schema = ${scope} AND table_name = '${table}' AND column_name = '${column}'`;
     return (await db.rows(sql)).length > 0;
 }
-async function assertRetiredSchemaAbsent(db, dialect) {
-    const found = [];
-    if (await tableExists(db, dialect, RETIRED_SNAPSHOT_TABLE))
-        found.push(`table ${RETIRED_SNAPSHOT_TABLE} (the retired whole-tree snapshot index)`);
-    if (await columnExists(db, dialect, "checkpoint", RETIRED_STEER_SEAT_COLUMN))
-        found.push(`column checkpoint.${RETIRED_STEER_SEAT_COLUMN} (the retired single-seat steering column)`);
-    if (found.length > 0)
-        throw new RetiredSchemaPresentError(found);
-}
-export async function assertRetiredSchemaAbsentOnPool(target) {
-    if (target.dialect === "tidb") {
-        const conn = await target.pool.getConnection();
-        try {
-            await assertRetiredSchemaAbsent(mysqlDb(conn), "tidb");
-        }
-        finally {
-            conn.release();
-        }
-        return;
-    }
-    const client = await target.pool.connect();
-    try {
-        await assertRetiredSchemaAbsent(pgDb(client), "pg");
-    }
-    finally {
-        client.release();
-    }
-}
 export async function runSqlOneTimeMigrations(dialect, pool) {
     return dialect === "tidb" ? withMysqlLock(pool, (db) => migrateOn(db, "tidb")) : withPgLock(pool, (db) => migrateOn(db, "pg"));
 }
@@ -403,44 +468,33 @@ async function withPgLock(pool, run) {
     }
 }
 async function migrateOn(db, dialect) {
-    const receipts = buildSessionRuleReceipts();
+    const receipts = buildMigrationReceipts();
     try {
-        return await migrateStepsOn(db, dialect, receipts);
+        await migrateStepsOn(db, dialect, receipts);
     }
     catch (e) {
-        throw interruptedWith(e, receipts);
+        throw changedAnything(receipts) ? new OneTimeMigrationInterruptedError(e, readingsSnapshot(receipts)) : e;
     }
+    return completedReport(receipts);
 }
 async function migrateStepsOn(db, dialect, receipts) {
-    const auditTablePresent = await tableExists(db, dialect, AUDIT_TABLE);
-    const auditDetailJsonNullRows = !auditTablePresent
-        ? 0
-        : await db.exec(`UPDATE ${AUDIT_TABLE} SET ${AUDIT_DETAIL_COLUMN} = NULL ` +
-            `WHERE ${AUDIT_DETAIL_COLUMN} IS NOT NULL AND ${jsonColumnTextExpr(dialect, AUDIT_DETAIL_COLUMN)} = 'null'`);
-    const { sessionIncarnationColumn, sessionIncarnationsBackfilled } = await migrateSessionIncarnations(db, dialect);
-    const holderDeathCodeRowsBackfilled = (await db.exec(dialect === "tidb"
-        ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND error = ?"
-        : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND error = $2", [RUN_HOLDER_DEATH_CODES.stalled, RUN_STALLED_ERROR])) +
-        (await db.exec(dialect === "tidb"
-            ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND (error = ? OR error LIKE ?)"
-            : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND (error = $2 OR error LIKE $3)", [RUN_HOLDER_DEATH_CODES.orphaned, RUN_ORPHANED_ERROR, `${RUN_ORPHANED_ERROR} (%`]));
-    const { migrated: allowRuleShadowRowsMigrated, unreadable: allowRuleShadowRowsUnreadable } = await migrateShadowedRuleKey(db, dialect);
-    const { askRows: retiredCardWordAskRowsRewritten, unreadable: retiredCardWordRowsUnreadable } = await migrateRetiredCardWords(db, dialect);
-    const { key: workflowParkIndexKey, carried: workflowParkIndexRowsCarried } = await reshapeWorkflowParkIndex(db, dialect);
-    const { sessionRuleColumn, sessionRuleRowsWithRetiredBuckets, sessionRuleRowsWithOldGrammarEntries } = await migrateSessionRuleGrammar(db, dialect, receipts);
-    let undurableScopeRuleRows = [];
-    let undurableScopeRuleBucketsDeferred = 0;
-    let undurableScopeRuleBucketsUnreadable = [];
-    if (await tableExists(db, dialect, PERMISSION_RULE_TABLE)) {
-        ({ removed: undurableScopeRuleRows, bucketsDeferred: undurableScopeRuleBucketsDeferred, bucketsUnreadable: undurableScopeRuleBucketsUnreadable } = await purgeUndurableScopeRows(db, dialect));
+    if (await tableExists(db, dialect, AUDIT_TABLE)) {
+        receipts.auditDetailJsonNullRows += await db.exec(`UPDATE ${AUDIT_TABLE} SET ${AUDIT_DETAIL_COLUMN} = NULL ` + `WHERE ${AUDIT_DETAIL_COLUMN} IS NOT NULL AND ${jsonColumnTextExpr(dialect, AUDIT_DETAIL_COLUMN)} = 'null'`);
     }
-    return {
-        auditDetailJsonNullRows,
-        sessionIncarnationColumn, sessionIncarnationsBackfilled, holderDeathCodeRowsBackfilled, allowRuleShadowRowsMigrated, allowRuleShadowRowsUnreadable,
-        workflowParkIndexKey, workflowParkIndexRowsCarried, undurableScopeRuleRows, undurableScopeRuleBucketsDeferred, undurableScopeRuleBucketsUnreadable,
-        sessionRuleColumn, sessionRuleRowsWithRetiredBuckets, sessionRuleRowsWithOldGrammarEntries,
-        retiredCardWordAskRowsRewritten, retiredCardWordRowsUnreadable,
-    };
+    await migrateSessionIncarnations(db, dialect, receipts);
+    receipts.holderDeathCodeRowsBackfilled += await db.exec(dialect === "tidb"
+        ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND error = ?"
+        : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND error = $2", [RUN_HOLDER_DEATH_CODES.stalled, RUN_STALLED_ERROR]);
+    receipts.holderDeathCodeRowsBackfilled += await db.exec(dialect === "tidb"
+        ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND (error = ? OR error LIKE ?)"
+        : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND (error = $2 OR error LIKE $3)", [RUN_HOLDER_DEATH_CODES.orphaned, RUN_ORPHANED_ERROR, `${RUN_ORPHANED_ERROR} (%`]);
+    await migrateShadowedRuleKey(db, dialect, receipts);
+    await migrateRetiredCardWords(db, dialect, receipts);
+    await reshapeWorkflowParkIndex(db, dialect, receipts);
+    await migrateSessionRuleGrammar(db, dialect, receipts);
+    await repairParkedRows(db, dialect, receipts);
+    if (await tableExists(db, dialect, PERMISSION_RULE_TABLE))
+        await purgeUndurableScopeRows(db, dialect, receipts);
 }
 const SESSION_POLICY_TABLE = "session_policy";
 const RETIRED_SESSION_RULES_COLUMN = "rules";
@@ -459,9 +513,10 @@ export function oldGrammarEntriesOf(body, rev) {
     const shaped = readSessionRulesShape({ ...buckets, rev });
     if ("fault" in shaped)
         return undefined;
+    const toolDenyUnreadable = unreadableDenyEntries(shaped.rules).map(({ entry, reason }) => ({ entry, reason }));
+    if (toolDenyUnreadable.length > 0)
+        return { toolAllowDropped: [], toolDenyUnreadable };
     const compiled = compileSessionRuleBucket(shaped.rules, "toolAllow");
-    if (body.grammar === undefined && compiled.inert.some((i) => i.reason === "wildcard_all"))
-        return { toolAllowDropped: [], wildcardMasked: true };
     const earlier = new Set(compiled.inert.filter((i) => i.reason === "earlier_grammar").map((i) => i.entry));
     const toolAllow = shaped.rules.toolAllow?.filter((e) => !earlier.has(e));
     const toolAllowDropped = (shaped.rules.toolAllow ?? []).filter((e) => earlier.has(e));
@@ -504,8 +559,14 @@ async function judgeOldGrammarRows(db, dialect, receipts) {
         : `UPDATE ${SESSION_POLICY_TABLE} SET ${column} = $1::jsonb WHERE policy_key = $2 AND ${text} = $3`;
     await scanSessionRuleRows(db, dialect, column, [], async (row) => {
         const read = oldGrammarEntriesOf(row.body, row.rev);
-        if (read?.wildcardMasked) {
-            receipts.rows.push({ policyKey: row.policyKey, sessionId: row.sessionId, toolAllowDropped: [], wildcardMasked: true });
+        if (read?.toolDenyUnreadable !== undefined) {
+            const retiredBuckets = retiredSessionRuleBucketsOf(row.body);
+            receipts.sessionRuleRowsWithUnreadableDeny.push({
+                policyKey: row.policyKey,
+                sessionId: row.sessionId,
+                toolDenyUnreadable: read.toolDenyUnreadable.map(({ entry, reason }) => ({ entry: redactSecrets(entry), reason })),
+                ...(retiredBuckets.length > 0 ? { retiredBuckets } : {}),
+            });
             return;
         }
         if (read?.rewritten === undefined)
@@ -514,32 +575,34 @@ async function judgeOldGrammarRows(db, dialect, receipts) {
             throw new Error(`one-time migration M17: session_policy row ${row.policyKey} changed while its rule entries were being rewritten under the in-progress column ${column} — no writer can reach the ` +
                 "table at that moment (builds up to 7.128.x lost the column, this build's replicas wait on the boot lock), so the step refuses rather than guess");
         }
-        if (read.toolAllowDropped.length > 0)
-            receipts.rows.push({ policyKey: row.policyKey, sessionId: row.sessionId, toolAllowDropped: read.toolAllowDropped.map((e) => redactSecrets(e)) });
+        if (read.toolAllowDropped.length > 0) {
+            receipts.sessionRuleRowsWithOldGrammarEntries.push({ policyKey: row.policyKey, sessionId: row.sessionId, toolAllowDropped: read.toolAllowDropped.map((e) => redactSecrets(e)) });
+        }
     });
 }
 export async function migrateSessionRuleGrammar(db, dialect, receipts) {
-    if (!(await tableExists(db, dialect, SESSION_POLICY_TABLE)))
-        return { sessionRuleColumn: "no-table", sessionRuleRowsWithRetiredBuckets: [], sessionRuleRowsWithOldGrammarEntries: [] };
+    if (!(await tableExists(db, dialect, SESSION_POLICY_TABLE))) {
+        receipts.sessionRuleColumn = "no-table";
+        return;
+    }
     const col = SESSION_RULES_COLUMN;
     const has = (column) => columnExists(db, dialect, SESSION_POLICY_TABLE, column);
     if (await has(RETIRED_SESSION_RULES_COLUMN)) {
         await execUntil(db, renameSessionRulesColumnSql(dialect, RETIRED_SESSION_RULES_COLUMN, OLD_GRAMMAR_SESSION_RULES_COLUMN), async () => !(await has(RETIRED_SESSION_RULES_COLUMN)));
     }
-    let sessionRuleColumn = "current";
     if (await has(OLD_GRAMMAR_SESSION_RULES_COLUMN)) {
         await judgeOldGrammarRows(db, dialect, receipts);
         await execUntil(db, renameSessionRulesColumnSql(dialect, OLD_GRAMMAR_SESSION_RULES_COLUMN, col.name), async () => !(await has(OLD_GRAMMAR_SESSION_RULES_COLUMN)) && (await has(col.name)));
-        receipts.renamed = true;
-        sessionRuleColumn = "renamed";
+        receipts.sessionRuleColumn = "renamed";
+    }
+    else {
+        receipts.sessionRuleColumn = "current";
     }
-    const named = [];
     await scanSessionRuleRows(db, dialect, col.name, RETIRED_BUCKET_PATTERNS, async (row) => {
         const buckets = retiredSessionRuleBucketsOf(row.body);
         if (buckets.length > 0)
-            named.push({ policyKey: row.policyKey, sessionId: row.sessionId, buckets });
+            receipts.sessionRuleRowsWithRetiredBuckets.push({ policyKey: row.policyKey, sessionId: row.sessionId, buckets });
     });
-    return { sessionRuleColumn, sessionRuleRowsWithRetiredBuckets: named, sessionRuleRowsWithOldGrammarEntries: receipts.rows };
 }
 function renameSessionRulesColumnSql(dialect, from, to) {
     const definition = SESSION_RULES_COLUMN.tidb.slice(SESSION_RULES_COLUMN.name.length);
@@ -556,7 +619,7 @@ async function primaryKeyWidth(db, dialect, table) {
 }
 const WORKFLOW_PARK_INDEX_STAGING = `${WORKFLOW_PARK_INDEX_TABLE}_m9`;
 const WORKFLOW_PARK_INDEX_RETIRED = `${WORKFLOW_PARK_INDEX_TABLE}_m9_old`;
-async function reshapeWorkflowParkIndex(db, dialect) {
+async function reshapeWorkflowParkIndex(db, dialect, receipts) {
     const T = WORKFLOW_PARK_INDEX_TABLE;
     const S = WORKFLOW_PARK_INDEX_STAGING;
     const O = WORKFLOW_PARK_INDEX_RETIRED;
@@ -567,11 +630,10 @@ async function reshapeWorkflowParkIndex(db, dialect) {
     const copyPointers = (to, from) => db.exec(dialect === "tidb"
         ? `INSERT IGNORE INTO ${to} (session_id, run_id, agent_key, scope) SELECT session_id, run_id, agent_key, scope FROM ${from}`
         : `INSERT INTO ${to} (session_id, run_id, agent_key, scope) SELECT session_id, run_id, agent_key, scope FROM ${from} ON CONFLICT DO NOTHING`);
-    let carried = 0;
     const resumed = await exists(S);
     if (resumed) {
         await db.exec(ddl);
-        carried += await copyPointers(T, S);
+        receipts.workflowParkIndexRowsCarried += await copyPointers(T, S);
         await execUntil(db, `DROP TABLE ${S}`, async () => !(await exists(S)));
     }
     if (await exists(O))
@@ -579,10 +641,11 @@ async function reshapeWorkflowParkIndex(db, dialect) {
     if ((await primaryKeyWidth(db, dialect, T)) !== 1) {
         if (await exists(T))
             await finishParkIndexShape(db, dialect);
-        return resumed ? { key: "reshaped", carried } : { key: "current", carried: 0 };
+        receipts.workflowParkIndexKey = resumed ? "reshaped" : "current";
+        return;
     }
     await db.exec(ddl.replace(`CREATE TABLE IF NOT EXISTS ${T} (`, `CREATE TABLE IF NOT EXISTS ${S} (`));
-    carried += await copyPointers(S, T);
+    receipts.workflowParkIndexRowsCarried += await copyPointers(S, T);
     const swapped = async () => !(await exists(S)) && (await exists(T)) && (await primaryKeyWidth(db, dialect, T)) !== 1;
     if (dialect === "tidb") {
         await execUntil(db, `RENAME TABLE ${T} TO ${O}, ${S} TO ${T}`, swapped);
@@ -592,7 +655,7 @@ async function reshapeWorkflowParkIndex(db, dialect) {
         await execAtomically(db, [`ALTER TABLE ${T} RENAME TO ${O}`, `ALTER TABLE ${S} RENAME TO ${T}`, `DROP TABLE ${O}`], async () => (await swapped()) && !(await exists(O)));
     }
     await finishParkIndexShape(db, dialect);
-    return { key: "reshaped", carried };
+    receipts.workflowParkIndexKey = "reshaped";
 }
 async function execAtomically(db, statements, postcondition) {
     try {
@@ -643,10 +706,8 @@ export function migrateShadowedRuleDescriptor(text) {
     return { kind: "rewrite", text: JSON.stringify(next) };
 }
 const SHADOWED_RULE_BATCH = 500;
-async function migrateShadowedRuleKey(db, dialect) {
+async function migrateShadowedRuleKey(db, dialect, receipts) {
     const like = `%"${RETIRED_SHADOWED_RULE_KEY}"%`;
-    let migrated = 0;
-    let unreadable = 0;
     let after = "";
     for (;;) {
         const rows = await db.rows(dialect === "tidb"
@@ -660,17 +721,17 @@ async function migrateShadowedRuleKey(db, dialect) {
                 continue;
             const next = migrateShadowedRuleDescriptor(text);
             if (next.kind === "unreadable") {
-                unreadable += 1;
+                receipts.allowRuleShadowRowsUnreadable += 1;
                 continue;
             }
             if (next.kind === "untouched")
                 continue;
-            migrated += await db.exec(dialect === "tidb"
+            receipts.allowRuleShadowRowsMigrated += await db.exec(dialect === "tidb"
                 ? `UPDATE checkpoint SET risk_descriptor = ? WHERE token = ? AND ${jsonColumnTextExpr(dialect, "risk_descriptor")} = ?`
                 : `UPDATE checkpoint SET risk_descriptor = $1 WHERE token = $2 AND ${jsonColumnTextExpr(dialect, "risk_descriptor")} = $3`, [next.text, token, text]);
         }
         if (rows.length < SHADOWED_RULE_BATCH)
-            return { migrated, unreadable };
+            return;
     }
 }
 const RETIRED_CARD_WORD_PATTERNS = ['%"shadowed"%', '%"governance_unavailable"%'];
@@ -692,11 +753,9 @@ export function migrateRetiredCardWordsInCardJson(text) {
     const next = retireStoredCardWords(decoded.value);
     return next.seats.length === 0 ? { kind: "untouched" } : { kind: "rewrite", text: JSON.stringify(next.value), value: next.value };
 }
-async function migrateRetiredCardWords(db, dialect) {
-    let askRows = 0;
-    let unreadable = 0;
+async function migrateRetiredCardWords(db, dialect, receipts) {
     if (!(await tableExists(db, dialect, "approval_ask")))
-        return { askRows, unreadable };
+        return;
     const cardText = jsonColumnTextExpr(dialect, "card_json");
     let after = "";
     for (;;) {
@@ -711,42 +770,129 @@ async function migrateRetiredCardWords(db, dialect) {
                 continue;
             const next = migrateRetiredCardWordsInCardJson(text);
             if (next.kind === "unreadable") {
-                unreadable += 1;
+                receipts.retiredCardWordRowsUnreadable += 1;
                 continue;
             }
             if (next.kind === "untouched")
                 continue;
-            askRows += await db.exec(dialect === "tidb"
+            receipts.retiredCardWordAskRowsRewritten += await db.exec(dialect === "tidb"
                 ? `UPDATE approval_ask SET card_json = ? WHERE ask_id = ? AND CAST(${cardText} AS BINARY) = CAST(? AS BINARY)`
                 : `UPDATE approval_ask SET card_json = $1 WHERE ask_id = $2 AND ${cardText} = $3`, [next.text, askId, text]);
         }
         if (rows.length < RETIRED_CARD_WORD_BATCH)
-            return { askRows, unreadable };
+            return;
+    }
+}
+const M21_GATE = { key: "gate", as: "m21_gate" };
+const M21_PENDING_ACTION = { key: "pendingAction", as: "m21_pending_action" };
+const PARKED_ROW_REPAIR_PAGE = 200;
+const QUESTION_CARD = "question";
+const PARKED_APPROVAL_GATE_KINDS = Object.keys(PAUSE_REGISTRY).filter((k) => PAUSE_REGISTRY[k].pending === "tool_approval");
+const readM21Subtree = createObjectColumnReader();
+const readM21Document = createObjectColumnReader();
+export function parkedRowRepairOf(gateKindCell, gate, pendingAction) {
+    const gateObj = gate !== null && typeof gate === "object" && !Array.isArray(gate) ? gate : undefined;
+    const columnKind = typeof gateKindCell === "string" && isGateKind(gateKindCell) ? gateKindCell : undefined;
+    const documentKind = gateObj !== undefined && isGateKind(gateObj.kind) ? gateObj.kind : undefined;
+    const kind = columnKind ?? documentKind;
+    const pa = pendingAction !== null && typeof pendingAction === "object" && !Array.isArray(pendingAction) ? pendingAction : undefined;
+    const questionCard = kind !== undefined &&
+        PARKED_APPROVAL_GATE_KINDS.includes(kind) &&
+        gateObj !== undefined &&
+        !Object.hasOwn(gateObj, "approvalCard") &&
+        pa?.kind === "tool_approval" &&
+        pa.toolName === ASK_USER_QUESTION_TOOL_NAME;
+    const columnNull = gateKindCell === null || gateKindCell === undefined;
+    return { ...(columnNull && documentKind !== undefined ? { gateKind: documentKind } : {}), questionCard, unresumable: columnNull && documentKind === undefined };
+}
+function m21Subtree(cell, where) {
+    try {
+        return decodeNullableJsonColumn(cell, readM21Subtree, where);
+    }
+    catch (e) {
+        if (!isJsonColumnBodyProblem(e))
+            throw e;
+        return undefined;
+    }
+}
+export async function repairParkedRows(db, dialect, receipts) {
+    const ph = (n) => (dialect === "tidb" ? "?" : `$${n}`);
+    const kinds = PARKED_APPROVAL_GATE_KINDS;
+    const kindSlots = kinds.map((_, i) => ph(i + 1)).join(", ");
+    const scan = `SELECT token, session_id, gate_kind, ${jsonColumnText(dialect, "checkpoint", M21_GATE)}, ${jsonColumnText(dialect, "checkpoint", M21_PENDING_ACTION)} FROM checkpoint ` +
+        `WHERE status = 'pending' AND (gate_kind IS NULL OR (gate_kind IN (${kindSlots}) AND tool_name = ${ph(kinds.length + 1)})) AND token > ${ph(kinds.length + 2)} ` +
+        `ORDER BY token LIMIT ${PARKED_ROW_REPAIR_PAGE}`;
+    const docText = jsonColumnTextExpr(dialect, "checkpoint");
+    const encode = dialectProtocolJsonEncoder(dialect);
+    let after = "";
+    for (;;) {
+        const page = await db.rows(scan, [...kinds, ASK_USER_QUESTION_TOOL_NAME, after]);
+        for (const r of page) {
+            const token = String(r.token);
+            after = token;
+            const plan = parkedRowRepairOf(r.gate_kind, m21Subtree(r[M21_GATE.as], "checkpoint.checkpoint $.gate (M21 parked-row repair)"), m21Subtree(r[M21_PENDING_ACTION.as], "checkpoint.checkpoint $.pendingAction (M21 parked-row repair)"));
+            if (plan.unresumable) {
+                receipts.parkedRowsUnresumableExpired += await db.exec(`UPDATE checkpoint SET status = 'expired', decided_at_ms = ${ph(1)} WHERE token = ${ph(2)} AND status = 'pending' AND gate_kind IS NULL`, [Date.now(), token]);
+                continue;
+            }
+            if (plan.gateKind !== undefined) {
+                receipts.parkedRowGateKindsBackfilled += await db.exec(`UPDATE checkpoint SET gate_kind = ${ph(1)} WHERE token = ${ph(2)} AND status = 'pending' AND gate_kind IS NULL`, [plan.gateKind, token]);
+            }
+            if (!plan.questionCard)
+                continue;
+            const [full] = await db.rows(`SELECT ${jsonColumnText(dialect, "checkpoint")} FROM checkpoint WHERE token = ${ph(1)} AND status = 'pending'`, [token]);
+            if (full === undefined)
+                continue;
+            let doc;
+            try {
+                doc = decodeJsonColumn(full.checkpoint, readM21Document, "checkpoint.checkpoint (M21 question-card repair)");
+            }
+            catch (e) {
+                if (!isJsonColumnBodyProblem(e))
+                    throw e;
+                receipts.parkedQuestionRowsLeftAsWritten += 1;
+                continue;
+            }
+            const gate = doc.gate;
+            if (Object.hasOwn(doc, "requirementsDigest") || gate === null || typeof gate !== "object" || Array.isArray(gate)) {
+                receipts.parkedQuestionRowsLeftAsWritten += 1;
+                continue;
+            }
+            const next = encode({ ...doc, gate: { ...gate, approvalCard: QUESTION_CARD } }, "checkpoint (M21 question-card repair)");
+            receipts.parkedQuestionCardsWritten += await db.exec(dialect === "tidb"
+                ? `UPDATE checkpoint SET checkpoint = ? WHERE token = ? AND status = 'pending' AND CAST(${docText} AS BINARY) = CAST(? AS BINARY)`
+                : `UPDATE checkpoint SET checkpoint = $1::jsonb WHERE token = $2 AND status = 'pending' AND ${docText} = $3`, [next, token, String(full.checkpoint)]);
+        }
+        if (page.length < PARKED_ROW_REPAIR_PAGE)
+            return;
     }
 }
 const INCARNATION_BACKFILL_BATCH = 500;
-async function migrateSessionIncarnations(db, dialect) {
-    if (!(await tableExists(db, dialect, "session_meta")))
-        return { sessionIncarnationColumn: "no-table", sessionIncarnationsBackfilled: 0 };
+async function migrateSessionIncarnations(db, dialect, receipts) {
+    if (!(await tableExists(db, dialect, "session_meta"))) {
+        receipts.sessionIncarnationColumn = "no-table";
+        return;
+    }
     const col = SESSION_META_INCARNATION_COLUMN;
-    let sessionIncarnationColumn = "present";
+    let column = "present";
     if (!(await columnExists(db, dialect, "session_meta", col.name))) {
         try {
             await db.exec(`ALTER TABLE session_meta ADD COLUMN ${dialect === "tidb" ? col.tidb : col.pg}`);
-            sessionIncarnationColumn = "added";
+            column = "added";
         }
         catch (e) {
             if (!(await columnExists(db, dialect, "session_meta", col.name)))
                 throw e;
         }
     }
-    return { sessionIncarnationColumn, sessionIncarnationsBackfilled: await backfillSessionIncarnations(db, dialect) };
+    receipts.sessionIncarnationColumn = column;
+    await backfillSessionIncarnations(db, dialect, receipts);
 }
-async function backfillSessionIncarnations(db, dialect) {
+async function backfillSessionIncarnations(db, dialect, receipts) {
     const remaining = async () => Number((await db.rows("SELECT COUNT(*) AS n FROM session_meta WHERE incarnation = ''"))[0]?.n ?? 0);
     const initial = await remaining();
     if (initial === 0)
-        return 0;
+        return;
     const ceiling = Math.ceil(initial / INCARNATION_BACKFILL_BATCH) * 2 + 2;
     let written = 0;
     let after;
@@ -756,7 +902,7 @@ async function backfillSessionIncarnations(db, dialect) {
             : await db.rows(`SELECT session_id FROM session_meta WHERE incarnation = '' AND session_id > ${dialect === "pg" ? "$1" : "?"} ORDER BY session_id LIMIT ${INCARNATION_BACKFILL_BATCH}`, [after])).map((r) => String(r.session_id));
         if (ids.length === 0) {
             if (after === undefined)
-                return written;
+                return;
             after = undefined;
             continue;
         }
@@ -767,7 +913,9 @@ async function backfillSessionIncarnations(db, dialect) {
         };
         const cases = ids.map((id) => `WHEN ${bind(id)} THEN ${bind(mintSessionIncarnation())}`).join(" ");
         const inList = ids.map((id) => bind(id)).join(", ");
-        written += await db.exec(`UPDATE session_meta SET incarnation = CASE session_id ${cases} END WHERE incarnation = '' AND session_id IN (${inList})`, params);
+        const landed = await db.exec(`UPDATE session_meta SET incarnation = CASE session_id ${cases} END WHERE incarnation = '' AND session_id IN (${inList})`, params);
+        written += landed;
+        receipts.sessionIncarnationsBackfilled += landed;
         after = ids.length < INCARNATION_BACKFILL_BATCH ? undefined : ids[ids.length - 1];
     }
     const left = await remaining();
@@ -776,33 +924,36 @@ async function backfillSessionIncarnations(db, dialect) {
             `(${written} written) — refusing to start rather than serve sessions whose occupant cannot be told apart. Retry the boot; ` +
             `if it repeats, something keeps writing rows without an incarnation (an older replica still inserting?).`);
     }
-    return written;
+}
+function readingFields(r) {
+    return {
+        auditDetailJsonNullRows: r.auditDetailJsonNullRows,
+        ...(r.sessionIncarnationColumn !== undefined ? { sessionIncarnationColumn: r.sessionIncarnationColumn } : {}),
+        sessionIncarnationsBackfilled: r.sessionIncarnationsBackfilled,
+        holderDeathCodeRowsBackfilled: r.holderDeathCodeRowsBackfilled,
+        allowRuleShadowRowsMigrated: r.allowRuleShadowRowsMigrated,
+        allowRuleShadowRowsUnreadable: r.allowRuleShadowRowsUnreadable,
+        ...(r.workflowParkIndexKey !== undefined ? { workflowParkIndexKey: r.workflowParkIndexKey } : {}),
+        workflowParkIndexRowsCarried: r.workflowParkIndexRowsCarried,
+        undurableScopeRuleRowsRemoved: r.undurableScopeRuleRows.length,
+        undurableScopeRuleBucketsDeferred: r.undurableScopeRuleBucketsDeferred,
+        undurableScopeRuleBucketsUnreadable: r.undurableScopeRuleBucketsUnreadable.length,
+        ...(r.sessionRuleColumn !== undefined ? { sessionRuleColumn: r.sessionRuleColumn } : {}),
+        sessionRuleRowsWithRetiredBuckets: r.sessionRuleRowsWithRetiredBuckets.length,
+        sessionRuleRowsWithOldGrammarEntries: r.sessionRuleRowsWithOldGrammarEntries.length,
+        sessionRuleRowsWithUnreadableDeny: r.sessionRuleRowsWithUnreadableDeny.length,
+        retiredCardWordAskRowsRewritten: r.retiredCardWordAskRowsRewritten,
+        retiredCardWordRowsUnreadable: r.retiredCardWordRowsUnreadable,
+        parkedQuestionCardsWritten: r.parkedQuestionCardsWritten,
+        parkedQuestionRowsLeftAsWritten: r.parkedQuestionRowsLeftAsWritten,
+        parkedRowGateKindsBackfilled: r.parkedRowGateKindsBackfilled,
+        parkedRowsUnresumableExpired: r.parkedRowsUnresumableExpired,
+    };
 }
 export function logOneTimeMigrations(log, backend, report) {
-    const changed = report.auditDetailJsonNullRows > 0 ||
-        report.sessionIncarnationColumn === "added" || report.sessionIncarnationsBackfilled > 0 || report.holderDeathCodeRowsBackfilled > 0 || report.allowRuleShadowRowsMigrated > 0 || report.allowRuleShadowRowsUnreadable > 0 ||
-        report.workflowParkIndexKey === "reshaped" || report.undurableScopeRuleRows.length > 0 || report.undurableScopeRuleBucketsDeferred > 0 ||
-        report.undurableScopeRuleBucketsUnreadable.length > 0 ||
-        report.sessionRuleColumn === "renamed" || report.sessionRuleRowsWithRetiredBuckets.length > 0 || report.sessionRuleRowsWithOldGrammarEntries.length > 0 ||
-        report.retiredCardWordAskRowsRewritten > 0 || report.retiredCardWordRowsUnreadable > 0;
-    (changed ? log.warn : log.info).call(log, "one_time_migrations_applied", {
+    (changedAnything(report) ? log.warn : log.info).call(log, "one_time_migrations_applied", {
         backend,
-        auditDetailJsonNullRows: report.auditDetailJsonNullRows,
-        sessionIncarnationColumn: report.sessionIncarnationColumn,
-        sessionIncarnationsBackfilled: report.sessionIncarnationsBackfilled,
-        holderDeathCodeRowsBackfilled: report.holderDeathCodeRowsBackfilled,
-        allowRuleShadowRowsMigrated: report.allowRuleShadowRowsMigrated,
-        allowRuleShadowRowsUnreadable: report.allowRuleShadowRowsUnreadable,
-        workflowParkIndexKey: report.workflowParkIndexKey,
-        workflowParkIndexRowsCarried: report.workflowParkIndexRowsCarried,
-        undurableScopeRuleRowsRemoved: report.undurableScopeRuleRows.length,
-        undurableScopeRuleBucketsDeferred: report.undurableScopeRuleBucketsDeferred,
-        undurableScopeRuleBucketsUnreadable: report.undurableScopeRuleBucketsUnreadable.length,
-        sessionRuleColumn: report.sessionRuleColumn,
-        sessionRuleRowsWithRetiredBuckets: report.sessionRuleRowsWithRetiredBuckets.length,
-        sessionRuleRowsWithOldGrammarEntries: report.sessionRuleRowsWithOldGrammarEntries.length,
-        retiredCardWordAskRowsRewritten: report.retiredCardWordAskRowsRewritten,
-        retiredCardWordRowsUnreadable: report.retiredCardWordRowsUnreadable,
+        ...readingFields(report),
         removableAfter: Object.fromEntries(ONE_TIME_MIGRATIONS.map((w) => [w.id, w.removableAfter])),
         note: "one-time persisted-data migrations (M4: audit details written as the JSON " +
             "text `null` by an earlier version folded to a SQL NULL, so \"no detail\" has exactly one on-disk spelling; M5: the " +
@@ -820,16 +971,23 @@ export function logOneTimeMigrations(log, backend, report) {
             "are read by the engine in the grammar the row carries (none = the grammar before the stamp) and rewritten as the same statement in the current grammar " +
             "(the column carries the in-progress name rule_entries_old_grammar until every row is rewritten, so an interrupted boot resumes there) — toolAllow entries " +
             "that the earlier grammar read as naming no tool are removed from the row, every row is stamped with the current grammar, one session_rule_row_old_grammar_entries " +
-            "line per row that lost entries; " +
+            "line per row that lost entries — except a row whose toolDeny holds an entry the engine reads as no rule: that row is left whole and unstamped (the engine refuses every " +
+            "call of such a session until an operator rewrites its rules), one session_rule_row_unreadable_deny line per row; " +
             "rows still holding a retired command bucket keep that bucket and are named, one session_rule_row_retired_bucket line per row on every boot; " +
             "M18: stored approval cards written by an earlier engine with two words the current engine retired rewritten — ruleOffersAbsence shadowed removed, ask class " +
             "governance_unavailable read as rule_unreadable; the engine's own parked-row documents are never rewritten (their row digest covers the ask class), they and " +
-            "the cards this step cannot reach are read the same way, counted under server.approval-card.retired-card-word-read). Each step " +
+            "the cards this step cannot reach are read the same way, counted under server.approval-card.retired-card-word-read; M21: suspended rows parked by an engine " +
+            "before the question card existed and still pending — a question approval whose gate carries no card — get the card word question (rows the engine sealed " +
+            "with its row digest are left as written and counted), and suspended rows with no gate kind on the row get it from the gate (a row whose gate names no " +
+            "registered kind cannot be resumed and is expired)). Each step " +
             "runs on every boot until its window closes (the release that introduced it + 30 days; the per-step date is in " +
             "removableAfter, null while that release is not published yet) and is deleted in the first minor after that — start a " +
             "version that still carries a step at least once before upgrading past its deletion.",
     });
-    for (const row of report.undurableScopeRuleRows) {
+    logReceiptRows(log, backend, report);
+}
+function logReceiptRows(log, backend, r) {
+    for (const row of r.undurableScopeRuleRows) {
         log.warn("permission_rule_row_removed", {
             backend,
             ownerKey: row.ownerKey,
@@ -840,7 +998,7 @@ export function logOneTimeMigrations(log, backend, report) {
             note: removedRuleRowNote(row.kind),
         });
     }
-    for (const bucket of report.undurableScopeRuleBucketsUnreadable) {
+    for (const bucket of r.undurableScopeRuleBucketsUnreadable) {
         log.warn("permission_rule_bucket_unreadable", {
             backend,
             ownerKey: bucket.ownerKey,
@@ -850,8 +1008,37 @@ export function logOneTimeMigrations(log, backend, report) {
                 "keeps being refused, as before this release, until someone repairs or deletes that row by hand",
         });
     }
-    logSessionRuleOldGrammarRows(log, backend, report.sessionRuleRowsWithOldGrammarEntries);
-    for (const row of report.sessionRuleRowsWithRetiredBuckets) {
+    for (const row of r.sessionRuleRowsWithOldGrammarEntries) {
+        log.warn("session_rule_row_old_grammar_entries", {
+            backend,
+            policyKey: row.policyKey,
+            sessionId: row.sessionId,
+            toolAllowDropped: row.toolAllowDropped,
+            note: "a session's stored rules were written before the rule-grammar stamp, when an entry was compared as a tool name as written; the engine reads such a row " +
+                "in that earlier grammar, where these toolAllow entries named no tool and admitted nothing, while in the current grammar they would be allow rules. " +
+                "The row was rewritten as the same statement in the current grammar: these entries were removed and the row stamped (an emptied list stays in place and allows " +
+                "nothing); toolDeny entries were left as written (a row whose toolDeny holds an entry the engine reads as no rule is not rewritten at all — it is named by " +
+                "session_rule_row_unreadable_deny instead). Every entry named on this line is named exactly once, by the boot that " +
+                "removed it — no later boot lists it again — so keep the line. Write the session's rules afresh through the session policy endpoint if an entry was meant as an allow rule",
+        });
+    }
+    for (const row of r.sessionRuleRowsWithUnreadableDeny) {
+        log.warn("session_rule_row_unreadable_deny", {
+            backend,
+            policyKey: row.policyKey,
+            sessionId: row.sessionId,
+            toolDenyUnreadable: row.toolDenyUnreadable,
+            ...(row.retiredBuckets !== undefined ? { retiredBuckets: row.retiredBuckets } : {}),
+            note: "a session's stored rules hold toolDeny entries the engine's rule reader reads as no rule at all (the reason on each entry is the reader's own word). The engine never " +
+                "reads rules it cannot read as fewer rules, so every tool call in this session is refused until the rules are rewritten. The row was not rewritten and not stamped " +
+                "with the current rule grammar: the stamp would only silence the engine's notice about the earlier grammar (config.session_rules_earlier_grammar) and lift nothing. " +
+                "Nothing was removed for you — a deny nobody can read is the operator's to rewrite. Write the session's rules afresh as an operator through the session policy " +
+                "endpoint (PUT /v1/sessions/:id/policy, a new value without the stored row's rev, leaving these entries out or spelling each as a rule), or delete the session " +
+                "(deleting the session deletes its rules). A line carrying retiredBuckets names a row that also holds a retired command bucket: the policy endpoint cannot read such a row " +
+                "(not even for an operator), so rewrite the row in the database in the current grammar (keep rev and gen) or delete the session. Each row is named exactly once, by the boot that ran the judgement — no later boot lists it again — so keep the line",
+        });
+    }
+    for (const row of r.sessionRuleRowsWithRetiredBuckets) {
         log.warn("session_rule_row_retired_bucket", {
             backend,
             policyKey: row.policyKey,
@@ -865,40 +1052,17 @@ export function logOneTimeMigrations(log, backend, report) {
         });
     }
 }
-function logSessionRuleOldGrammarRows(log, backend, rows) {
-    for (const row of rows) {
-        log.warn("session_rule_row_old_grammar_entries", {
-            backend,
-            policyKey: row.policyKey,
-            sessionId: row.sessionId,
-            toolAllowDropped: row.toolAllowDropped,
-            ...(row.wildcardMasked ? { wildcardMasked: true } : {}),
-            note: row.wildcardMasked
-                ? "a session's stored rules were written before the rule-grammar stamp and its toolAllow list holds `*`: the engine reads that list as void in every grammar (every call " +
-                    "refused), which hides what the other entries meant in the earlier grammar, so this row was NOT rewritten or stamped — it stays in its earlier grammar. To restore the other " +
-                    "entries, an operator rewrites the row without `*` (entries spelled as rules, `Bash(rm:*)`, then become allow rules — review them first)."
-                :
-                    "a session's stored rules were written before the rule-grammar stamp, when an entry was compared as a tool name as written; the engine reads such a row " +
-                        "in that earlier grammar, where these toolAllow entries named no tool and admitted nothing, while in the current grammar they would be allow rules. " +
-                        "The row was rewritten as the same statement in the current grammar: these entries were removed and the row stamped (an emptied list stays in place and allows " +
-                        "nothing); toolDeny entries read the same in every grammar and were left as written. Every entry named on this line is named exactly once, by the boot that " +
-                        "removed it — no later boot lists it again — so keep the line. Write the session's rules afresh through the session policy endpoint if an entry was meant as an allow rule",
-        });
-    }
-}
 function logOneTimeMigrationsInterrupted(log, backend, error) {
-    const { receipts } = error;
     log.warn("one_time_migrations_interrupted", {
         backend,
-        sessionRuleColumn: receipts.sessionRuleColumn ?? "in-progress",
-        sessionRuleRowsWithOldGrammarEntries: receipts.sessionRuleRowsWithOldGrammarEntries.length,
-        note: "the one-time migrations failed after committing changes whose receipts the next boot cannot re-derive: the session_rule_row_old_grammar_entries lines that follow name " +
-            "rows this boot already rewrote — a retried boot finds them rewritten and removes nothing from them. These lines are the only place the rewritten rows are ever " +
-            "reported — no later boot lists them — so save them. The failure itself follows as this boot's refusal. sessionRuleColumn \"renamed\": every row was rewritten and the final " +
-            "column name was published before the failure; \"in-progress\": the column still carries its in-progress name — the next boot rewrites the remaining rows (rows already " +
-            "rewritten are left alone) and publishes the final name",
+        ...readingFields(error.receipts),
+        note: "the one-time migrations failed after committing changes: the readings on this line and the lines that follow are what this boot already committed — a retried " +
+            "boot finds that work done and does not report it again, so these lines are the only record of them, written once by this boot — save them. The failure itself follows " +
+            "as this boot's refusal. A shape reading absent from this line (sessionIncarnationColumn / workflowParkIndexKey / sessionRuleColumn) belongs to a step that did not " +
+            "finish; sessionRuleColumn absent after session_rule_row_old_grammar_entries lines means the column still carries its in-progress name — the next boot rewrites the " +
+            "remaining rows (rows already rewritten are left alone) and publishes the final name",
     });
-    logSessionRuleOldGrammarRows(log, backend, receipts.sessionRuleRowsWithOldGrammarEntries);
+    logReceiptRows(log, backend, error.receipts);
 }
 export async function runAndLogOneTimeMigrations(log, backend) {
     let report;