@sema-agent/server 7.131.0 → 7.133.0

package/dist/plugins/one-time-migrations.js

@@ -1,39 +1,119 @@
-import { SESSION_RULES_GRAMMAR, compileSessionRuleBucket, readSessionRulesShape } from "@sema-agent/core";
+import { PAUSE_REGISTRY, SESSION_RULES_GRAMMAR, compileSessionRuleBucket, isGateKind, readSessionRulesShape, unreadableDenyEntries } from "@sema-agent/core";
+import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
+import { dialectProtocolJsonEncoder } from "./sql-driver.js";
 import { SCHEMA_STATEMENTS, acquireEnsureSchemaLock, releaseEnsureSchemaLock } from "./tidb-pool.js";
 import { PG_SCHEMA_STATEMENTS, acquirePgEnsureSchemaLock, releasePgEnsureSchemaLock } from "./pg-pool.js";
 import { CENTRAL_SCHEMA_INDEXES } from "./schema-indexes.js";
 import { ensureIndexes } from "./ensure-index.js";
-import { decodeJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readNonNullJsonValueColumn, readOpaqueJsonValueColumn } from "./sql-json-column.js";
-import { SESSION_META_INCARNATION_COLUMN, mintSessionIncarnation } from "../session-incarnation.js";
-import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR, StoreBootRefusalError } from "./store-contracts.js";
+import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readNonNullJsonValueColumn, readOpaqueJsonValueColumn, } from "./sql-json-column.js";
+import { SESSION_META_INCARNATION_COLUMN, incarnationFromCell, mintSessionIncarnation, sessionFaceFromRow } from "../session-incarnation.js";
+import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR } from "./store-contracts.js";
 import { PERMISSION_RULE_TABLE, purgeUndurableScopeRows } from "./permission-rule-store-sql.js";
-import { SCHEMA_MISMATCH_ERROR_CODE } from "./schema-consistency.js";
 import { SESSION_RULES_COLUMN } from "./session-rules-column.js";
 import { readJsonObjectColumn } from "./sql-json-column.js";
 import { retireStoredCardWords } from "../retired-card-words.js";
 import { redactSecrets } from "../trace/redact.js";
+import { CLAIM_OWNERLESS_PLACED_SQL, claimOwnerlessParams, isOrphanSessionOwner, judgeDelegatedOwner } from "../delegated-session-owner.js";
+import { MAILBOX_KEYED_TABLES, mailboxKeyDeleteSql, storedMailboxKeyless } from "./mailbox-store-sql.js";
 const RETIRED_SESSION_RULE_BUCKETS = ["commandAllow", "commandDeny"];
-export function buildSessionRuleReceipts() {
-    return { rows: [], renamed: false };
+export function buildMigrationReceipts() {
+    return {
+        auditDetailJsonNullRows: 0,
+        sessionIncarnationsBackfilled: 0,
+        holderDeathCodeRowsBackfilled: 0,
+        allowRuleShadowRowsMigrated: 0,
+        allowRuleShadowRowsUnreadable: 0,
+        workflowParkIndexRowsCarried: 0,
+        undurableScopeRuleRows: [],
+        undurableScopeRuleBucketsDeferred: 0,
+        undurableScopeRuleBucketsUnreadable: [],
+        sessionRuleRowsWithRetiredBuckets: [],
+        sessionRuleRowsWithOldGrammarEntries: [],
+        sessionRuleRowsWithUnreadableDeny: [],
+        retiredCardWordAskRowsRewritten: 0,
+        retiredCardWordRowsUnreadable: 0,
+        parkedQuestionCardsWritten: 0,
+        parkedQuestionRowsLeftAsWritten: 0,
+        parkedRowGateKindsBackfilled: 0,
+        parkedRowsUnresumableExpired: 0,
+        placedSessionOwnersInherited: 0,
+        placedSessionOwnersOrphaned: 0,
+        placedSessionOwnersRemaining: 0,
+        workflowJournalOwnersBackfilled: 0,
+        workflowJournalForeignScopeRowsRemoved: 0,
+        retiredBreakerTablesDropped: 0,
+        mailboxRejectedKeyRowsRemoved: 0,
+    };
+}
+function completedReport(r) {
+    const { sessionIncarnationColumn, workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn } = r;
+    if (sessionIncarnationColumn === undefined || workflowParkIndexKey === undefined || sessionRuleColumn === undefined || workflowJournalScopeColumn === undefined) {
+        throw new Error(`one-time migrations finished without settling a shape reading (M5 ${String(sessionIncarnationColumn)} / M9 ${String(workflowParkIndexKey)} / M17 ${String(sessionRuleColumn)} / M24 ${String(workflowJournalScopeColumn)}) — a step did not record it`);
+    }
+    return { ...r, sessionIncarnationColumn, workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn };
+}
+function changedAnything(r) {
+    return (r.auditDetailJsonNullRows > 0 ||
+        r.sessionIncarnationColumn === "added" ||
+        r.sessionIncarnationsBackfilled > 0 ||
+        r.holderDeathCodeRowsBackfilled > 0 ||
+        r.allowRuleShadowRowsMigrated > 0 ||
+        r.allowRuleShadowRowsUnreadable > 0 ||
+        r.workflowParkIndexKey === "reshaped" ||
+        r.workflowParkIndexRowsCarried > 0 ||
+        r.undurableScopeRuleRows.length > 0 ||
+        r.undurableScopeRuleBucketsDeferred > 0 ||
+        r.undurableScopeRuleBucketsUnreadable.length > 0 ||
+        r.sessionRuleColumn === "renamed" ||
+        r.sessionRuleRowsWithRetiredBuckets.length > 0 ||
+        r.sessionRuleRowsWithOldGrammarEntries.length > 0 ||
+        r.sessionRuleRowsWithUnreadableDeny.length > 0 ||
+        r.retiredCardWordAskRowsRewritten > 0 ||
+        r.retiredCardWordRowsUnreadable > 0 ||
+        r.parkedQuestionCardsWritten > 0 ||
+        r.parkedQuestionRowsLeftAsWritten > 0 ||
+        r.parkedRowGateKindsBackfilled > 0 ||
+        r.parkedRowsUnresumableExpired > 0 ||
+        r.placedSessionOwnersInherited > 0 ||
+        r.placedSessionOwnersOrphaned > 0 ||
+        r.placedSessionOwnersRemaining > 0 ||
+        r.workflowJournalScopeColumn === "moved" ||
+        r.workflowJournalOwnersBackfilled > 0 ||
+        r.workflowJournalForeignScopeRowsRemoved > 0 ||
+        r.retiredBreakerTablesDropped > 0 ||
+        r.mailboxRejectedKeyRowsRemoved > 0);
+}
+function readingsSnapshot(r) {
+    return {
+        ...r,
+        undurableScopeRuleRows: [...r.undurableScopeRuleRows],
+        undurableScopeRuleBucketsUnreadable: [...r.undurableScopeRuleBucketsUnreadable],
+        sessionRuleRowsWithRetiredBuckets: [...r.sessionRuleRowsWithRetiredBuckets],
+        sessionRuleRowsWithOldGrammarEntries: [...r.sessionRuleRowsWithOldGrammarEntries],
+        sessionRuleRowsWithUnreadableDeny: [...r.sessionRuleRowsWithUnreadableDeny],
+    };
+}
+function receiptSentence(r) {
+    const counts = Object.entries(readingFields(r))
+        .filter(([, v]) => (typeof v === "number" ? v > 0 : v !== undefined))
+        .map(([k, v]) => `${k}=${String(v)}`);
+    const rows = [
+        ...r.undurableScopeRuleRows.map((x) => `removed ${x.kind} in permission-rule bucket ${x.ownerKey} (${x.behavior} ${x.tool}, scope root ${JSON.stringify(x.scopeRoot)})`),
+        ...r.sessionRuleRowsWithOldGrammarEntries.map((x) => `${x.policyKey} (session ${x.sessionId}): toolAllowDropped=${JSON.stringify(x.toolAllowDropped)}`),
+        ...r.sessionRuleRowsWithUnreadableDeny.map((x) => `${x.policyKey} (session ${x.sessionId}): left as stored, toolDenyUnreadable=${JSON.stringify(x.toolDenyUnreadable)}${x.retiredBuckets !== undefined ? `, retiredBuckets=${JSON.stringify(x.retiredBuckets)}` : ""}`),
+    ];
+    return [counts.join(", "), ...rows].filter((part) => part !== "").join("; ");
 }
 export class OneTimeMigrationInterruptedError extends Error {
     receipts;
     constructor(cause, receipts) {
-        super(`${cause instanceof Error ? cause.message : String(cause)} — one-time migration M17 had already committed changes whose receipts the next boot cannot re-derive ` +
-            "(the rows below are rewritten, so a retry finds nothing left to remove from them) — record them before retrying: " +
-            receipts.sessionRuleRowsWithOldGrammarEntries.map((r) => `${r.policyKey} (session ${r.sessionId}): toolAllowDropped=${JSON.stringify(r.toolAllowDropped)}`).join("; "), { cause });
+        super(`${cause instanceof Error ? cause.message : String(cause)} — the one-time migrations had already committed changes before this failure; a retried boot finds that work done ` +
+            "and cannot report it again — record these readings before retrying: " +
+            receiptSentence(receipts), { cause });
         this.name = "OneTimeMigrationInterruptedError";
         this.receipts = receipts;
     }
 }
-function interruptedWith(cause, receipts) {
-    if (receipts.rows.length === 0)
-        return cause;
-    return new OneTimeMigrationInterruptedError(cause, {
-        ...(receipts.renamed ? { sessionRuleColumn: "renamed" } : {}),
-        sessionRuleRowsWithOldGrammarEntries: [...receipts.rows],
-    });
-}
 export const ONE_TIME_MIGRATIONS = [
     {
         id: "M4",
@@ -132,7 +212,7 @@ export const ONE_TIME_MIGRATIONS = [
         releasedOn: "2026-10-08",
         removableAfter: "2026-11-07",
         removal: "删 migrateOn 的 M11 步(`permission_rule` 在场探针 + `purgeUndurableScopeRows` 调用)与 `permission-rule-store-sql.ts` 的 `purgeUndurableScopeRows` / " +
-            "`purgeAllBuckets` / `purgeOneBucket` / `contentFreeRefusal` / `PurgeAccumulator` / `UndurableScopeRuleRow` / `UnreadableRuleBucket` / `UndurableScopePurge` / " +
+            "`purgeOneBucket` / `contentFreeRefusal` / `UndurableScopeRuleRow` / `UnreadableRuleBucket` / `UndurableScopePurgeReadings` / " +
             "`UndurableScopePurgeDb` / `UNDURABLE_PURGE_PAGE` / `UNDURABLE_PURGE_OCC_ATTEMPTS`、本文件的 `removedRuleRowNote`,以及 `BucketRefusedError` 的 `verdict` 位(若届时再无别的读者;" +
             "判官 `decodeBucketRow` 与写法 `writeBucket` 是读腿 / 写臂本身,留);报告、日志行(含逐行的 `permission_rule_row_removed` 与逐桶的 " +
             "`permission_rule_bucket_unreadable`)与 `NO_SQL_MIGRATIONS` 的 `undurableScopeRuleRows` / `undurableScopeRuleBucketsDeferred` / `undurableScopeRuleBucketsUnreadable`",
@@ -213,16 +293,15 @@ export const ONE_TIME_MIGRATIONS = [
         removal: "删 migrateOn 的 M17 步(`migrateSessionRuleGrammar`:`session_policy` 在场探针、旧名 → 进行中的名 → 判读 → 终名三段、退役命令桶扫描与点名)与 " +
             "`retiredSessionRuleBucketsOf` / `RetiredSessionRuleBucket` / `RETIRED_SESSION_RULE_BUCKETS` / `RETIRED_SESSION_RULES_COLUMN` / `OLD_GRAMMAR_SESSION_RULES_COLUMN` / `SESSION_RULES_SCAN_PAGE` / `SessionRuleRowRetiredBuckets` / " +
             "`oldGrammarEntriesOf` / `OldGrammarEntries` / `judgeOldGrammarRows` / `renameSessionRulesColumnSql` / `scanSessionRuleRows` / `SessionRuleScanRow` / " +
-            "`RETIRED_BUCKET_PATTERNS` / `SessionRuleRowOldGrammarEntries` / 收据账 `SessionRuleReceipts` / `buildSessionRuleReceipts` / `OneTimeMigrationReceipts` / " +
-            "`OneTimeMigrationInterruptedError` / `interruptedWith`(`migrateOn` 外层的那一道 try / catch)/ `logOneTimeMigrationsInterrupted` / `runAndLogOneTimeMigrations` 里的失败日志臂 / `logSessionRuleOldGrammarRows`;" +
-            "报告、日志行(含逐行的 `session_rule_row_retired_bucket` 与 `session_rule_row_old_grammar_entries`)与 `NO_SQL_MIGRATIONS` 的 `sessionRuleColumn` / " +
-            "`sessionRuleRowsWithRetiredBuckets` / `sessionRuleRowsWithOldGrammarEntries`;" +
+            "`RETIRED_BUCKET_PATTERNS` / `SessionRuleRowOldGrammarEntries` / `SessionRuleRowUnreadableDeny` / `UnreadableDenyEntry`;`logReceiptRows` 里 M17 的三段与 `receiptSentence` 里 M17 的两段;" +
+            "报告、日志行(含逐行的 `session_rule_row_retired_bucket` · `session_rule_row_old_grammar_entries` · `session_rule_row_unreadable_deny`)与 `NO_SQL_MIGRATIONS` 的 `sessionRuleColumn` / " +
+            "`sessionRuleRowsWithRetiredBuckets` / `sessionRuleRowsWithOldGrammarEntries` / `sessionRuleRowsWithUnreadableDeny`;" +
             "**列名本身留在中央 DDL 里**(`session-rules-column.ts`,它不是迁移的一部分)",
         afterRemoval: "① 列还叫 `rules`、或停在进行中的名 `rule_entries_old_grammar` 的存量库(跳过了带本条的版本直接升 / 判读没走完就跳版):起服列册探针 `schema-consistency.ts`(S-547)拒启 " +
             "`config.schema_mismatch`(缺 `rule_entries`、多那一列)—— " +
             "出路是先在一只带本条的版本上起服一次;② 行里仍带退役命令桶:SQL 店读回照旧答 `corrupt`(引擎的形读法点名那只桶,与本条在场时同一个结局),只是起服日志不再逐行点名 —— " +
             "运维在库里把那一行改写成引擎文法或删掉它(删会话即删规则);③ 跳过本条直接升的库同样没有改名那一拍的条目判读 —— 由 ① 的拒启接住(出路同 ①)",
-        reportKeys: ["sessionRuleColumn", "sessionRuleRowsWithRetiredBuckets", "sessionRuleRowsWithOldGrammarEntries"],
+        reportKeys: ["sessionRuleColumn", "sessionRuleRowsWithRetiredBuckets", "sessionRuleRowsWithOldGrammarEntries", "sessionRuleRowsWithUnreadableDeny"],
     },
     {
         id: "M18",
@@ -246,16 +325,18 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.130.0",
         releasedOn: "2026-10-16",
         removableAfter: "2026-11-15",
-        removal: "删 `src/stored-request-tool-axes-m19.ts` 整只文件(`storedToolAxesRereadM19` / `readToolAxesAsServer7129M19` / `StoredToolAxesRereadM19`);" +
-            "`boot/resolve-spec.ts` 里递给 `resolveRequestMcp` 的那一实参(`opts?.leg === \"fresh\" ? undefined : storedToolAxesRereadM19(…)`)与它的 import;" +
+        removal: "删 `src/stored-request-tool-axes-m19.ts` 整只文件(`storedToolAxesRereadM19` / `readToolAxesAsServer7129M19` / `readA2aToolAxesAsServer7131M19` / `StoredToolAxesRereadM19`);" +
+            "`boot/resolve-spec.ts` 里两条请求腿共用的那一行(`const storedToolAxes = opts?.leg === \"fresh\" ? undefined : storedToolAxesRereadM19(…)`)、递给 `resolveRequestMcp` / `resolveRequestA2a` 的两处实参与它的 import;" +
             "`task-mcp.ts` 里 `resolveRequestMcp` / `classifyRequestMcp` / `classifyHonored` / `validateRequestMcpEntries` / `normalizeServer` 的 `storedToolAxes` 形参、" +
-            "`toolAxesReread` 事实与运维行 `mcp_tool_axes_read_as_before_upgrade`,以及对本模块的型 import;`tool-axis-words.ts` 头注与两只谓词 JSDoc 里点名 M19 的那几处;" +
+            "`toolAxesReread` 事实与运维行 `mcp_tool_axes_read_as_before_upgrade`,以及对本模块的型 import(升级前读法的词表与两只谓词住在本模块里,随它一起删);" +
+            "`task-a2a.ts` 里 `resolveRequestA2a` / `validateRequestA2aEntries` / `normalizeA2aPeer` 的 `storedToolAxes` 形参、`toolAxesReread` 事实与运维行 `a2a_tool_axes_read_as_before_upgrade`、对本模块的型 import;" +
             "`test/mcp-tool-axes-m19.test.ts`(窗关那一格 —— 存量坏形整条不进、warn 与通告点名 `field: toolAxes` —— 改钉到 `test/task-mcp.test.ts`);" +
             "本文件的 `migrationWindowOpen`(若再无别的读者)",
         afterRemoval: "没有新的臂,接住它的是今天的读法(删码零行为变化:窗关那一刻起重读臂已经不生效):升级前存下的请求体里引擎判官判不过的 `toolAxes`,续跑重放时这一条 server 整条不进," +
             "运维 warn `mcp_injection_dropped`(`reason: malformed_entry`、`field: toolAxes`)+ 用户面通告 `mcp.injection_dropped`,兄弟照挂;停驻在这台 server 工具审批上的任务" +
             "批准后撞 `resume.tool_unavailable`(拒绝照常可出)—— 出路是拒绝那张卡,用改好的 `toolAxes` 重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、" +
-            "调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行(头注 M19 段)",
+            "调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行(头注 M19 段)。A2A 一面同:存量体里 `a2aPeers[].toolAxes` 判不过的对端续跑整条不挂," +
+            "运维 warn `a2a_injection_dropped` 点名,停驻在它 skill 上的审批批准后撞 `resume.tool_unavailable` —— 出路同上:拒绝那张卡,改好声明重新提交",
         reportKeys: [],
     },
     {
@@ -273,6 +354,102 @@ export const ONE_TIME_MIGRATIONS = [
             "出路是把这类停驻任务决掉、删掉那个未知字段 / `__proto__` 键后重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行(头注 M20 段)",
         reportKeys: [],
     },
+    {
+        id: "M21",
+        introducedIn: "7.132.0",
+        releasedOn: "2026-10-18",
+        removableAfter: "2026-11-17",
+        removal: "删 migrateOn 的 M21 步(`repairParkedRows`:pending 候选分页扫描、门型回填、续不了的置 expired、问答卡词的整只文档读 + CAS 回写)与 `parkedRowRepairOf` / `ParkedRowRepair` / " +
+            "`M21_GATE` / `M21_PENDING_ACTION` / `PARKED_ROW_REPAIR_PAGE` / `QUESTION_CARD` / `PARKED_APPROVAL_GATE_KINDS` / `readM21Subtree` / `readM21Document` / `m21Subtree`;" +
+            "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `parkedQuestionCardsWritten` / `parkedQuestionRowsLeftAsWritten` / `parkedRowGateKindsBackfilled` / `parkedRowsUnresumableExpired`;" +
+            "`test/one-time-migrations.test.ts` 的 M21 组与 `test/one-time-migrations-db-integration.test.ts` 的 M21 格",
+        afterRemoval: "① 门上没有卡词的存量问答行(跳过了带本条的版本直接升的库、把 `APPROVAL_TERMINAL_BACKSTOP_MS` 调长的部署、local 车道 —— 那一车道本条从来够不着):没有新的臂,回到本条之前的读法 —— " +
+            "队列行不带卡词(壳显示通用审批卡),到期走 SLA 拒扫腿(模型读到「拒」),决断口仍按工具名认问答(`approve` 必须带 `answer`,否则 400);出路 = 升级前答完或拒掉;" +
+            "② `gate_kind` 为 NULL 的停驻行:既有响亮臂 —— 运维待批队列(`listPending`)不列它、计 `server.approvals.queue-row-gate-kind-missing`(决断口按门型绑定取行,本来就不认它);" +
+            "出路是运维把那一行置 expired 或删掉会话(终局收割照旧在 `terminal_at_ms` 收它)",
+        reportKeys: ["parkedQuestionCardsWritten", "parkedQuestionRowsLeftAsWritten", "parkedRowGateKindsBackfilled", "parkedRowsUnresumableExpired"],
+    },
+    {
+        id: "M22",
+        introducedIn: "7.132.0",
+        releasedOn: "2026-10-18",
+        removableAfter: "2026-11-17",
+        removal: "删 `config-lkg.ts` 的 formatVersion 4 读回迁移:`migrateV4Lkg` 与其上的窗注;`loadLkg` 里调它的那一支(`formatVersion !== 5` 那一段)与版本判据里的 `4`" +
+            "(4 回到「unknown formatVersion」拒;若 M13 / M15 仍在窗内,先删到期的那几条再删本条,版本判据收成只认 5)、`LkgReadMigration.fromFormat` 的 `4`;" +
+            "文件头注 formatVersion 5 一段里「4 的载荷 …」那两句;`test/center-artifact-v3-lane.test.ts` 的两格 4 读回(5 原样读回那一格留)",
+        afterRemoval: "既有响亮臂 `config_lkg_unusable`(`loadLkg` 对 4 答「unknown formatVersion 4」):4 读回 ⇒ 不可用,中心可达照拉(整拉,新 LKG 按 5 覆盖)、断着则 env 兜底 —— " +
+            "与回滚到 7.131.x 读 5 同一种处置",
+        reportKeys: [],
+    },
+    {
+        id: "M23",
+        introducedIn: "7.133.0",
+        releasedOn: "2026-10-21",
+        removableAfter: "2026-11-20",
+        removal: "删 migrateOn 的 M23 步(`inheritPlacedSessionOwners`:placed ∧ 属主 NULL 的行按 session_id 键集分页单趟扫描 + 同一条语句连读根 / 父两行 + 按认领句回写属主)与 `PLACED_OWNER_SCAN_PAGE` / `placedOwnerScanSql` / `scannedPlacement` / `scannedFaces` / `scannedPlacedSources`(`isOrphanSessionOwner` 若再无别的读者一并删);" +
+            "**同窗同删的另一半**(认领:按律给升级前写下的无主子代行写属主 —— 停驻挂点对宿主无主行做的就是本条对那一行的单行步):`delegated-session-owner.ts` 的 `CLAIM_OWNERLESS_PLACED_SQL` / `claimOwnerlessParams` / `OwnerlessClaim` / " +
+            "`settleDelegatedOwner` 的认领一步(删后它只剩树比对与属主比对)/ `DelegationTreeStore.claimOwnerless`," +
+            "两只 SQL 店(`tidb-session-store.ts` / `pg-session-storage.ts`)的 `claimOwnerless`、`CachingSessionStore` 的转发、`OwnerAwareSessionStore.claimOwnerless`、`delegatedOwnerHostOf` 对它的「与 `placementOf` 同在或同缺」;" +
+            "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `placedSessionOwnersInherited` / `placedSessionOwnersOrphaned` / `placedSessionOwnersRemaining` 与 `placed_session_owners_orphaned` 那一行 warn;" +
+            "`test/one-time-migrations.test.ts` 的 M23 组与 `test/one-time-migrations-db-integration.test.ts` 的 M23 格。" +
+            "**不随本条删**:属主为 NULL 的 placed 行只对 fleet 调用方放行(`security.ts` 的 `ownerlessRowOpen` / `sessionOwnerCellOf` 与各门读 `placementOf` 的那一次)—— 那是常设的读面律",
+        afterRemoval: "会话面的读面律(常设,不随本条删)接住:跳过了带本条的版本直接升的库里,属主为 NULL 的存量 placed 子代行只对 fleet 调用方放行(出示 service 凭据、不报主体;dev-open)," +
+            "其余调用方答 404(与别人的行同体)—— 出路是升级时先过一次带本条的版本,或运维按 `placement_root_session_id`(缺则 `placement_parent_session_id`)那一行的属主手工回填、" +
+            "推不出的写一个任何主体都不匹配的值;停驻挂点读到无主的宿主子代行 ⇒ 回到比对的既有臂:无主 ≠ 律给的属主 ⇒ 停驻否决(fail-closed,响亮;出路同上);" +
+            "建行那一笔的继承律不随本条删(那是常设的写法,不是迁移)",
+        reportKeys: ["placedSessionOwnersInherited", "placedSessionOwnersOrphaned", "placedSessionOwnersRemaining"],
+    },
+    {
+        id: "M24",
+        introducedIn: "7.133.0",
+        releasedOn: "2026-10-21",
+        removableAfter: "2026-11-20",
+        removal: "删 migrateOn 的 M24 步(`moveWorkflowJournalScope`:scope 列在场探针 + 删残留暂存表 / 待删旧表 + 回填属主记录 + 数跨 scope 行 + 照中央 DDL 建暂存表 + 整表复制 + 原子换名 + 删旧表 + PG 主键约束名)与 " +
+            "`copyJournalInBatches` / `journalKeyBound` / `WORKFLOW_JOURNAL_TABLE` / `WORKFLOW_JOURNAL_OWNER_TABLE` / `WORKFLOW_JOURNAL_STAGING` / `WORKFLOW_JOURNAL_RETIRED` / `RETIRED_JOURNAL_SCOPE_COLUMN` / " +
+            "`M24_OWNER_INCARNATION` / `M24_COPY_BATCH_BYTES` / `M24_COPY_SCAN_PAGE`;" +
+            "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `workflowJournalScopeColumn` / `workflowJournalOwnersBackfilled` / `workflowJournalForeignScopeRowsRemoved` 与 `workflow_journal_foreign_scope_rows_removed` 那一行 warn;" +
+            "`test/one-time-migrations.test.ts` 的 M24 组与 `test/one-time-migrations-db-integration.test.ts` 的 M24 格。**不随本条删**:属主表、行主键里的令牌与店的写面 / 读面墙(那是常设的数据形)",
+        afterRemoval: "起服对账一族的列集探针接住(`schema-consistency.ts` 的 `assertSchemaMatchesCode`,常设):跳过了带本条的版本直接升的库,`workflow_journal` 上仍带 scope 列、没有 incarnation 列 = 库与代码列集不符 ⇒ " +
+            "响亮拒启(`config.schema_mismatch`),拒句点名两列;出路是先在带本条的版本(7.133.x)起服一次让它走完,再升",
+        reportKeys: ["workflowJournalScopeColumn", "workflowJournalOwnersBackfilled", "workflowJournalForeignScopeRowsRemoved"],
+    },
+    {
+        id: "M25",
+        introducedIn: "7.133.0",
+        releasedOn: "2026-10-21",
+        removableAfter: "2026-11-20",
+        removal: "删 `project-identity.ts` 的 `mintRepoScopeKey`(与它的窗注;`RETIRED_PROJECT_KEY_PREFIX` 留给 `isServerMintedProjectKey` 的起服拒)与 `projectLayerForTaskRoot` 的 `foldFrom` 里它那一员" +
+            "(`p` 档那一员留 —— 常设律);`memory-sync-client.ts` 的 `legacyMemorySyncCursorPath` / `adoptLegacyCursor` 与 runner 里调它的那一段(`legacyCursorChecked`);" +
+            "`test/memory-project-layer-fold.test.ts` 的 ① 格与 `test/memory-project-layer-fold-db-integration.test.ts` 整份、`test/memory-sync-client.test.ts` 的旧游标收编格、" +
+            "`test/project-identity.test.ts` 的 `repo:` 金样格(公式金样改钉 `p` 档摘要)",
+        afterRemoval: "没有新的臂(如实):窗内一次都没跑过任务的项目,它的 `repo:` 层留在库里、不再被任何读列表包含(不读、不删;起服拒只管运维点名这一族);出路 = 升级时先过一次带本条的版本并在每个项目跑一次任务。" +
+            "同步腿的旧游标文件不再收编:同步层从空基线首轮重收敛(两边都改过的条目按冲突上报,不静默丢)",
+        reportKeys: [],
+    },
+    {
+        id: "M26",
+        introducedIn: "7.133.0",
+        releasedOn: "2026-10-21",
+        removableAfter: "2026-11-20",
+        removal: "删 migrateOn 的 M26 步(`dropRetiredBreakerTable`)与 `RETIRED_BREAKER_TABLE`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 `retiredBreakerTablesDropped`;" +
+            "`test/one-time-migrations.test.ts` 的 S-491 组与 `test/one-time-migrations-db-integration.test.ts` 的 M26 格。" +
+            "**不随本条删**:键的铸点 `breakerKeyOf` / `routeDigestOf`(常设的键形)与新表 `breaker_state`",
+        afterRemoval: "没有新的臂(如实):跳过了带本条的版本直接升的库,退役表 `circuit_breaker` 留在库里、没有读者也没有写者(断路器只读写 `breaker_state`)—— " +
+            "出路 = 升级时先过一次带本条的版本,或手工 `DROP TABLE circuit_breaker`(建议性状态,删表安全)",
+        reportKeys: ["retiredBreakerTablesDropped"],
+    },
+    {
+        id: "M27",
+        introducedIn: "7.133.0",
+        releasedOn: "2026-10-21",
+        removableAfter: "2026-11-20",
+        removal: "删 migrateOn 的 M27 步(`dropRejectedMailboxKeys`)与 `MAILBOX_KEY_SCAN_PAGE`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 `mailboxRejectedKeyRowsRemoved`;" +
+            "`test/one-time-migrations.test.ts` 的 M27 组。**不随本条删**:判官 `mailboxKeyProblem`、存储键读回判 `storedMailboxKeyless`(常设 `reap` 读候选句柄也经它)与「判官拒的键没有箱」那条入口律(含 `reap` 跳过候选扫描交回的被拒句柄)、" +
+            "`MAILBOX_KEYED_TABLES` / `mailboxKeyDeleteSql`(`drop` 的常设语句)",
+        afterRemoval: "没有新的臂(如实):跳过了带本条的版本直接升的库,判官拒的键的行留在库里,任何入口对它都按「箱不在」答(不读、不投、不清)—— 出路 = 升级时先过一次带本条的版本," +
+            "或照 `docs/DEPLOY-PREREQS.md` 7.133.0 SQL 节的查法按键手工删",
+        reportKeys: ["mailboxRejectedKeyRowsRemoved"],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;
@@ -291,29 +468,24 @@ export const NO_SQL_MIGRATIONS = {
     sessionRuleColumn: "file-store",
     sessionRuleRowsWithRetiredBuckets: [],
     sessionRuleRowsWithOldGrammarEntries: [],
+    sessionRuleRowsWithUnreadableDeny: [],
     retiredCardWordAskRowsRewritten: 0,
     retiredCardWordRowsUnreadable: 0,
+    parkedQuestionCardsWritten: 0,
+    parkedQuestionRowsLeftAsWritten: 0,
+    parkedRowGateKindsBackfilled: 0,
+    parkedRowsUnresumableExpired: 0,
+    placedSessionOwnersInherited: 0,
+    placedSessionOwnersOrphaned: 0,
+    placedSessionOwnersRemaining: 0,
+    workflowJournalScopeColumn: "file-store",
+    workflowJournalOwnersBackfilled: 0,
+    workflowJournalForeignScopeRowsRemoved: 0,
+    retiredBreakerTablesDropped: 0,
+    mailboxRejectedKeyRowsRemoved: 0,
 };
 const AUDIT_TABLE = "device_audit";
 const AUDIT_DETAIL_COLUMN = "detail";
-const RETIRED_SNAPSHOT_TABLE = "snapshot_manifest";
-const RETIRED_STEER_SEAT_COLUMN = "pending_steer";
-export class RetiredSchemaPresentError extends StoreBootRefusalError {
-    found;
-    code = SCHEMA_MISMATCH_ERROR_CODE;
-    constructor(found) {
-        super(`${SCHEMA_MISMATCH_ERROR_CODE}: this database still carries schema that the one-time migrations of server 7.74.0–7.125.x retired — refusing to start. ` +
-            `Found: ${found.join("; ")}. ` +
-            `Both come from builds that predate those migrations, so this database never booted a build that still carried them — which also means the third one never ran: ` +
-            `ask-origin gates stored under the retired spelling \`unresolvable\` (in task_event.data and in checkpoint.execution_outcome) were not rewritten to \`ancestor_marked\`. ` +
-            `This build carries none of the three and will not guess. ` +
-            `Way out: start a server 7.125.x build once against this database and let its one-time migrations finish (it drops the table and the column and rewrites the spelling; ` +
-            `while the column still holds a steering instruction that can be delivered it refuses and names the rows and its own ways out), then upgrade to this build. ` +
-            `The check behind this refusal is read-only and runs before this build creates any table or rewrites anything: it changed nothing in the database.`);
-        this.found = found;
-        this.name = "RetiredSchemaPresentError";
-    }
-}
 function mysqlDb(conn) {
     return {
         async rows(sql, params) {
@@ -358,34 +530,6 @@ async function columnExists(db, dialect, table, column) {
     const sql = `SELECT 1 AS present FROM information_schema.columns WHERE table_schema = ${scope} AND table_name = '${table}' AND column_name = '${column}'`;
     return (await db.rows(sql)).length > 0;
 }
-async function assertRetiredSchemaAbsent(db, dialect) {
-    const found = [];
-    if (await tableExists(db, dialect, RETIRED_SNAPSHOT_TABLE))
-        found.push(`table ${RETIRED_SNAPSHOT_TABLE} (the retired whole-tree snapshot index)`);
-    if (await columnExists(db, dialect, "checkpoint", RETIRED_STEER_SEAT_COLUMN))
-        found.push(`column checkpoint.${RETIRED_STEER_SEAT_COLUMN} (the retired single-seat steering column)`);
-    if (found.length > 0)
-        throw new RetiredSchemaPresentError(found);
-}
-export async function assertRetiredSchemaAbsentOnPool(target) {
-    if (target.dialect === "tidb") {
-        const conn = await target.pool.getConnection();
-        try {
-            await assertRetiredSchemaAbsent(mysqlDb(conn), "tidb");
-        }
-        finally {
-            conn.release();
-        }
-        return;
-    }
-    const client = await target.pool.connect();
-    try {
-        await assertRetiredSchemaAbsent(pgDb(client), "pg");
-    }
-    finally {
-        client.release();
-    }
-}
 export async function runSqlOneTimeMigrations(dialect, pool) {
     return dialect === "tidb" ? withMysqlLock(pool, (db) => migrateOn(db, "tidb")) : withPgLock(pool, (db) => migrateOn(db, "pg"));
 }
@@ -418,44 +562,150 @@ async function withPgLock(pool, run) {
     }
 }
 async function migrateOn(db, dialect) {
-    const receipts = buildSessionRuleReceipts();
+    const receipts = buildMigrationReceipts();
     try {
-        return await migrateStepsOn(db, dialect, receipts);
+        await migrateStepsOn(db, dialect, receipts);
     }
     catch (e) {
-        throw interruptedWith(e, receipts);
+        throw changedAnything(receipts) ? new OneTimeMigrationInterruptedError(e, readingsSnapshot(receipts)) : e;
     }
+    return completedReport(receipts);
 }
 async function migrateStepsOn(db, dialect, receipts) {
-    const auditTablePresent = await tableExists(db, dialect, AUDIT_TABLE);
-    const auditDetailJsonNullRows = !auditTablePresent
-        ? 0
-        : await db.exec(`UPDATE ${AUDIT_TABLE} SET ${AUDIT_DETAIL_COLUMN} = NULL ` +
-            `WHERE ${AUDIT_DETAIL_COLUMN} IS NOT NULL AND ${jsonColumnTextExpr(dialect, AUDIT_DETAIL_COLUMN)} = 'null'`);
-    const { sessionIncarnationColumn, sessionIncarnationsBackfilled } = await migrateSessionIncarnations(db, dialect);
-    const holderDeathCodeRowsBackfilled = (await db.exec(dialect === "tidb"
+    if (await tableExists(db, dialect, AUDIT_TABLE)) {
+        receipts.auditDetailJsonNullRows += await db.exec(`UPDATE ${AUDIT_TABLE} SET ${AUDIT_DETAIL_COLUMN} = NULL ` + `WHERE ${AUDIT_DETAIL_COLUMN} IS NOT NULL AND ${jsonColumnTextExpr(dialect, AUDIT_DETAIL_COLUMN)} = 'null'`);
+    }
+    await migrateSessionIncarnations(db, dialect, receipts);
+    receipts.holderDeathCodeRowsBackfilled += await db.exec(dialect === "tidb"
         ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND error = ?"
-        : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND error = $2", [RUN_HOLDER_DEATH_CODES.stalled, RUN_STALLED_ERROR])) +
-        (await db.exec(dialect === "tidb"
-            ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND (error = ? OR error LIKE ?)"
-            : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND (error = $2 OR error LIKE $3)", [RUN_HOLDER_DEATH_CODES.orphaned, RUN_ORPHANED_ERROR, `${RUN_ORPHANED_ERROR} (%`]));
-    const { migrated: allowRuleShadowRowsMigrated, unreadable: allowRuleShadowRowsUnreadable } = await migrateShadowedRuleKey(db, dialect);
-    const { askRows: retiredCardWordAskRowsRewritten, unreadable: retiredCardWordRowsUnreadable } = await migrateRetiredCardWords(db, dialect);
-    const { key: workflowParkIndexKey, carried: workflowParkIndexRowsCarried } = await reshapeWorkflowParkIndex(db, dialect);
-    const { sessionRuleColumn, sessionRuleRowsWithRetiredBuckets, sessionRuleRowsWithOldGrammarEntries } = await migrateSessionRuleGrammar(db, dialect, receipts);
-    let undurableScopeRuleRows = [];
-    let undurableScopeRuleBucketsDeferred = 0;
-    let undurableScopeRuleBucketsUnreadable = [];
-    if (await tableExists(db, dialect, PERMISSION_RULE_TABLE)) {
-        ({ removed: undurableScopeRuleRows, bucketsDeferred: undurableScopeRuleBucketsDeferred, bucketsUnreadable: undurableScopeRuleBucketsUnreadable } = await purgeUndurableScopeRows(db, dialect));
+        : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND error = $2", [RUN_HOLDER_DEATH_CODES.stalled, RUN_STALLED_ERROR]);
+    receipts.holderDeathCodeRowsBackfilled += await db.exec(dialect === "tidb"
+        ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND (error = ? OR error LIKE ?)"
+        : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND (error = $2 OR error LIKE $3)", [RUN_HOLDER_DEATH_CODES.orphaned, RUN_ORPHANED_ERROR, `${RUN_ORPHANED_ERROR} (%`]);
+    await migrateShadowedRuleKey(db, dialect, receipts);
+    await migrateRetiredCardWords(db, dialect, receipts);
+    await reshapeWorkflowParkIndex(db, dialect, receipts);
+    await migrateSessionRuleGrammar(db, dialect, receipts);
+    await repairParkedRows(db, dialect, receipts);
+    if (await tableExists(db, dialect, "session_meta"))
+        await inheritPlacedSessionOwners(db, dialect, receipts);
+    if (await tableExists(db, dialect, PERMISSION_RULE_TABLE))
+        await purgeUndurableScopeRows(db, dialect, receipts);
+    await moveWorkflowJournalScope(db, dialect, receipts);
+    if (await tableExists(db, dialect, RETIRED_BREAKER_TABLE))
+        await dropRetiredBreakerTable(db, dialect, receipts);
+    await dropRejectedMailboxKeys(db, dialect, receipts);
+}
+const MAILBOX_KEY_SCAN_PAGE = 1000;
+async function dropRejectedMailboxKeys(db, dialect, receipts) {
+    const present = [];
+    for (const table of MAILBOX_KEYED_TABLES)
+        if (await tableExists(db, dialect, table))
+            present.push(table);
+    const p = (i) => (dialect === "tidb" ? "?" : `$${i}`);
+    for (const table of present) {
+        let after;
+        for (;;) {
+            const page = await db.rows(`SELECT DISTINCT scope_key, handle FROM ${table}` +
+                (after === undefined ? "" : ` WHERE scope_key > ${p(1)} OR (scope_key = ${p(2)} AND handle > ${p(3)})`) +
+                ` ORDER BY scope_key, handle LIMIT ${MAILBOX_KEY_SCAN_PAGE}`, after === undefined ? undefined : [after[0], after[0], after[1]]);
+            for (const row of page) {
+                if (!storedMailboxKeyless(row.scope_key, row.handle))
+                    continue;
+                for (const t of present)
+                    receipts.mailboxRejectedKeyRowsRemoved += await db.exec(mailboxKeyDeleteSql(dialect, t), [row.scope_key, row.handle]);
+            }
+            if (page.length < MAILBOX_KEY_SCAN_PAGE)
+                break;
+            const last = page[page.length - 1];
+            after = [last.scope_key, last.handle];
+        }
+    }
+}
+const RETIRED_BREAKER_TABLE = "circuit_breaker";
+async function dropRetiredBreakerTable(db, dialect, receipts) {
+    await execUntil(db, `DROP TABLE IF EXISTS ${RETIRED_BREAKER_TABLE}`, async () => !(await tableExists(db, dialect, RETIRED_BREAKER_TABLE)));
+    receipts.retiredBreakerTablesDropped += 1;
+}
+const WORKFLOW_JOURNAL_TABLE = "workflow_journal";
+const WORKFLOW_JOURNAL_OWNER_TABLE = "workflow_journal_owner";
+const WORKFLOW_JOURNAL_STAGING = `${WORKFLOW_JOURNAL_TABLE}_m24`;
+const WORKFLOW_JOURNAL_RETIRED = `${WORKFLOW_JOURNAL_TABLE}_m24_old`;
+const RETIRED_JOURNAL_SCOPE_COLUMN = "scope";
+const M24_OWNER_INCARNATION = "m24-backfill";
+const M24_COPY_BATCH_BYTES = 32 * 1024 * 1024;
+const M24_COPY_SCAN_PAGE = 1000;
+function journalKeyBound(dialect, op, first) {
+    const p = (i) => (dialect === "tidb" ? "?" : `$${first + i}`);
+    return op === "after"
+        ? `(${WORKFLOW_JOURNAL_TABLE}.run_id > ${p(0)} OR (${WORKFLOW_JOURNAL_TABLE}.run_id = ${p(1)} AND ordinal > ${p(2)}))`
+        : `(${WORKFLOW_JOURNAL_TABLE}.run_id < ${p(0)} OR (${WORKFLOW_JOURNAL_TABLE}.run_id = ${p(1)} AND ordinal <= ${p(2)}))`;
+}
+async function copyJournalInBatches(db, dialect) {
+    const T = WORKFLOW_JOURNAL_TABLE;
+    const bytes = dialect === "tidb" ? "LENGTH(result)" : "OCTET_LENGTH(result)";
+    const copyHead = `INSERT INTO ${WORKFLOW_JOURNAL_STAGING} (run_id, incarnation, ordinal, call_key, result, created_at_ms) ` +
+        `SELECT ${T}.run_id, o.incarnation, ordinal, call_key, ${jsonColumnText(dialect, "result")}, created_at_ms FROM ${T} ` +
+        `JOIN ${WORKFLOW_JOURNAL_OWNER_TABLE} o ON o.run_id = ${T}.run_id AND o.scope = ${T}.${RETIRED_JOURNAL_SCOPE_COLUMN} WHERE `;
+    let after;
+    for (;;) {
+        const page = await db.rows(`SELECT ${T}.run_id, ordinal, ${bytes} AS n FROM ${T}` + (after === undefined ? "" : ` WHERE ${journalKeyBound(dialect, "after", 1)}`) + ` ORDER BY run_id, ordinal LIMIT ${M24_COPY_SCAN_PAGE}`, after === undefined ? [] : [after[0], after[0], after[1]]);
+        if (page.length === 0)
+            return;
+        let end = 0;
+        let total = 0;
+        while (end < page.length) {
+            const n = Number(page[end].n);
+            if (end > 0 && total + n > M24_COPY_BATCH_BYTES)
+                break;
+            total += n;
+            end += 1;
+        }
+        const last = page[end - 1];
+        const upTo = [String(last.run_id), Number(last.ordinal)];
+        if (after === undefined)
+            await db.exec(copyHead + journalKeyBound(dialect, "upTo", 1), [upTo[0], upTo[0], upTo[1]]);
+        else
+            await db.exec(`${copyHead}${journalKeyBound(dialect, "after", 1)} AND ${journalKeyBound(dialect, "upTo", 4)}`, [after[0], after[0], after[1], upTo[0], upTo[0], upTo[1]]);
+        after = upTo;
     }
-    return {
-        auditDetailJsonNullRows,
-        sessionIncarnationColumn, sessionIncarnationsBackfilled, holderDeathCodeRowsBackfilled, allowRuleShadowRowsMigrated, allowRuleShadowRowsUnreadable,
-        workflowParkIndexKey, workflowParkIndexRowsCarried, undurableScopeRuleRows, undurableScopeRuleBucketsDeferred, undurableScopeRuleBucketsUnreadable,
-        sessionRuleColumn, sessionRuleRowsWithRetiredBuckets, sessionRuleRowsWithOldGrammarEntries,
-        retiredCardWordAskRowsRewritten, retiredCardWordRowsUnreadable,
-    };
+}
+export async function moveWorkflowJournalScope(db, dialect, receipts) {
+    const T = WORKFLOW_JOURNAL_TABLE;
+    const S = WORKFLOW_JOURNAL_STAGING;
+    const O = WORKFLOW_JOURNAL_RETIRED;
+    const exists = (t) => tableExists(db, dialect, t);
+    const legacy = () => columnExists(db, dialect, T, RETIRED_JOURNAL_SCOPE_COLUMN);
+    if (!(await legacy())) {
+        if (await exists(O))
+            await execUntil(db, `DROP TABLE ${O}`, async () => !(await exists(O)));
+        receipts.workflowJournalScopeColumn = "current";
+        return;
+    }
+    const ddl = (dialect === "tidb" ? SCHEMA_STATEMENTS : PG_SCHEMA_STATEMENTS).find((stmt) => stmt.includes(`CREATE TABLE IF NOT EXISTS ${T} (`));
+    if (ddl === undefined)
+        throw new Error(`one-time migration M24: the central schema carries no definition of ${T} — refusing to rebuild a table it cannot define`);
+    if (await exists(S))
+        await execUntil(db, `DROP TABLE ${S}`, async () => !(await exists(S)));
+    receipts.workflowJournalOwnersBackfilled += await db.exec(`INSERT INTO ${WORKFLOW_JOURNAL_OWNER_TABLE} (run_id, scope, incarnation, appended_at_ms) ` +
+        `SELECT j.run_id, j.${RETIRED_JOURNAL_SCOPE_COLUMN}, '${M24_OWNER_INCARNATION}', m.last_ms FROM ${T} j ` +
+        `JOIN (SELECT run_id, MIN(ordinal) AS first_ordinal, MAX(created_at_ms) AS last_ms FROM ${T} GROUP BY run_id) m ` +
+        `ON m.run_id = j.run_id AND m.first_ordinal = j.ordinal ` +
+        `WHERE NOT EXISTS (SELECT 1 FROM ${WORKFLOW_JOURNAL_OWNER_TABLE} o WHERE o.run_id = j.run_id)`);
+    const foreign = Number((await db.rows(`SELECT COUNT(*) AS n FROM ${T} j JOIN ${WORKFLOW_JOURNAL_OWNER_TABLE} o ON o.run_id = j.run_id WHERE j.${RETIRED_JOURNAL_SCOPE_COLUMN} <> o.scope`))[0]?.n ?? 0);
+    await db.exec(ddl.replace(`CREATE TABLE IF NOT EXISTS ${T} (`, `CREATE TABLE IF NOT EXISTS ${S} (`));
+    await copyJournalInBatches(db, dialect);
+    const swapped = async () => !(await exists(S)) && (await exists(T)) && !(await legacy());
+    if (dialect === "tidb") {
+        await execUntil(db, `RENAME TABLE ${T} TO ${O}, ${S} TO ${T}`, swapped);
+        receipts.workflowJournalForeignScopeRowsRemoved += foreign;
+        await execUntil(db, `DROP TABLE IF EXISTS ${O}`, async () => !(await exists(O)));
+    }
+    else {
+        await execAtomically(db, [`ALTER TABLE ${T} RENAME TO ${O}`, `ALTER TABLE ${S} RENAME TO ${T}`, `DROP TABLE ${O}`, `ALTER TABLE ${T} RENAME CONSTRAINT ${S}_pkey TO ${T}_pkey`], async () => (await swapped()) && !(await exists(O)));
+        receipts.workflowJournalForeignScopeRowsRemoved += foreign;
+    }
+    receipts.workflowJournalScopeColumn = "moved";
 }
 const SESSION_POLICY_TABLE = "session_policy";
 const RETIRED_SESSION_RULES_COLUMN = "rules";
@@ -474,9 +724,10 @@ export function oldGrammarEntriesOf(body, rev) {
     const shaped = readSessionRulesShape({ ...buckets, rev });
     if ("fault" in shaped)
         return undefined;
+    const toolDenyUnreadable = unreadableDenyEntries(shaped.rules).map(({ entry, reason }) => ({ entry, reason }));
+    if (toolDenyUnreadable.length > 0)
+        return { toolAllowDropped: [], toolDenyUnreadable };
     const compiled = compileSessionRuleBucket(shaped.rules, "toolAllow");
-    if (body.grammar === undefined && compiled.inert.some((i) => i.reason === "wildcard_all"))
-        return { toolAllowDropped: [], wildcardMasked: true };
     const earlier = new Set(compiled.inert.filter((i) => i.reason === "earlier_grammar").map((i) => i.entry));
     const toolAllow = shaped.rules.toolAllow?.filter((e) => !earlier.has(e));
     const toolAllowDropped = (shaped.rules.toolAllow ?? []).filter((e) => earlier.has(e));
@@ -519,8 +770,14 @@ async function judgeOldGrammarRows(db, dialect, receipts) {
         : `UPDATE ${SESSION_POLICY_TABLE} SET ${column} = $1::jsonb WHERE policy_key = $2 AND ${text} = $3`;
     await scanSessionRuleRows(db, dialect, column, [], async (row) => {
         const read = oldGrammarEntriesOf(row.body, row.rev);
-        if (read?.wildcardMasked) {
-            receipts.rows.push({ policyKey: row.policyKey, sessionId: row.sessionId, toolAllowDropped: [], wildcardMasked: true });
+        if (read?.toolDenyUnreadable !== undefined) {
+            const retiredBuckets = retiredSessionRuleBucketsOf(row.body);
+            receipts.sessionRuleRowsWithUnreadableDeny.push({
+                policyKey: row.policyKey,
+                sessionId: row.sessionId,
+                toolDenyUnreadable: read.toolDenyUnreadable.map(({ entry, reason }) => ({ entry: redactSecrets(entry), reason })),
+                ...(retiredBuckets.length > 0 ? { retiredBuckets } : {}),
+            });
             return;
         }
         if (read?.rewritten === undefined)
@@ -529,32 +786,34 @@ async function judgeOldGrammarRows(db, dialect, receipts) {
             throw new Error(`one-time migration M17: session_policy row ${row.policyKey} changed while its rule entries were being rewritten under the in-progress column ${column} — no writer can reach the ` +
                 "table at that moment (builds up to 7.128.x lost the column, this build's replicas wait on the boot lock), so the step refuses rather than guess");
         }
-        if (read.toolAllowDropped.length > 0)
-            receipts.rows.push({ policyKey: row.policyKey, sessionId: row.sessionId, toolAllowDropped: read.toolAllowDropped.map((e) => redactSecrets(e)) });
+        if (read.toolAllowDropped.length > 0) {
+            receipts.sessionRuleRowsWithOldGrammarEntries.push({ policyKey: row.policyKey, sessionId: row.sessionId, toolAllowDropped: read.toolAllowDropped.map((e) => redactSecrets(e)) });
+        }
     });
 }
 export async function migrateSessionRuleGrammar(db, dialect, receipts) {
-    if (!(await tableExists(db, dialect, SESSION_POLICY_TABLE)))
-        return { sessionRuleColumn: "no-table", sessionRuleRowsWithRetiredBuckets: [], sessionRuleRowsWithOldGrammarEntries: [] };
+    if (!(await tableExists(db, dialect, SESSION_POLICY_TABLE))) {
+        receipts.sessionRuleColumn = "no-table";
+        return;
+    }
     const col = SESSION_RULES_COLUMN;
     const has = (column) => columnExists(db, dialect, SESSION_POLICY_TABLE, column);
     if (await has(RETIRED_SESSION_RULES_COLUMN)) {
         await execUntil(db, renameSessionRulesColumnSql(dialect, RETIRED_SESSION_RULES_COLUMN, OLD_GRAMMAR_SESSION_RULES_COLUMN), async () => !(await has(RETIRED_SESSION_RULES_COLUMN)));
     }
-    let sessionRuleColumn = "current";
     if (await has(OLD_GRAMMAR_SESSION_RULES_COLUMN)) {
         await judgeOldGrammarRows(db, dialect, receipts);
         await execUntil(db, renameSessionRulesColumnSql(dialect, OLD_GRAMMAR_SESSION_RULES_COLUMN, col.name), async () => !(await has(OLD_GRAMMAR_SESSION_RULES_COLUMN)) && (await has(col.name)));
-        receipts.renamed = true;
-        sessionRuleColumn = "renamed";
+        receipts.sessionRuleColumn = "renamed";
+    }
+    else {
+        receipts.sessionRuleColumn = "current";
     }
-    const named = [];
     await scanSessionRuleRows(db, dialect, col.name, RETIRED_BUCKET_PATTERNS, async (row) => {
         const buckets = retiredSessionRuleBucketsOf(row.body);
         if (buckets.length > 0)
-            named.push({ policyKey: row.policyKey, sessionId: row.sessionId, buckets });
+            receipts.sessionRuleRowsWithRetiredBuckets.push({ policyKey: row.policyKey, sessionId: row.sessionId, buckets });
     });
-    return { sessionRuleColumn, sessionRuleRowsWithRetiredBuckets: named, sessionRuleRowsWithOldGrammarEntries: receipts.rows };
 }
 function renameSessionRulesColumnSql(dialect, from, to) {
     const definition = SESSION_RULES_COLUMN.tidb.slice(SESSION_RULES_COLUMN.name.length);
@@ -571,7 +830,7 @@ async function primaryKeyWidth(db, dialect, table) {
 }
 const WORKFLOW_PARK_INDEX_STAGING = `${WORKFLOW_PARK_INDEX_TABLE}_m9`;
 const WORKFLOW_PARK_INDEX_RETIRED = `${WORKFLOW_PARK_INDEX_TABLE}_m9_old`;
-async function reshapeWorkflowParkIndex(db, dialect) {
+async function reshapeWorkflowParkIndex(db, dialect, receipts) {
     const T = WORKFLOW_PARK_INDEX_TABLE;
     const S = WORKFLOW_PARK_INDEX_STAGING;
     const O = WORKFLOW_PARK_INDEX_RETIRED;
@@ -582,11 +841,10 @@ async function reshapeWorkflowParkIndex(db, dialect) {
     const copyPointers = (to, from) => db.exec(dialect === "tidb"
         ? `INSERT IGNORE INTO ${to} (session_id, run_id, agent_key, scope) SELECT session_id, run_id, agent_key, scope FROM ${from}`
         : `INSERT INTO ${to} (session_id, run_id, agent_key, scope) SELECT session_id, run_id, agent_key, scope FROM ${from} ON CONFLICT DO NOTHING`);
-    let carried = 0;
     const resumed = await exists(S);
     if (resumed) {
         await db.exec(ddl);
-        carried += await copyPointers(T, S);
+        receipts.workflowParkIndexRowsCarried += await copyPointers(T, S);
         await execUntil(db, `DROP TABLE ${S}`, async () => !(await exists(S)));
     }
     if (await exists(O))
@@ -594,10 +852,11 @@ async function reshapeWorkflowParkIndex(db, dialect) {
     if ((await primaryKeyWidth(db, dialect, T)) !== 1) {
         if (await exists(T))
             await finishParkIndexShape(db, dialect);
-        return resumed ? { key: "reshaped", carried } : { key: "current", carried: 0 };
+        receipts.workflowParkIndexKey = resumed ? "reshaped" : "current";
+        return;
     }
     await db.exec(ddl.replace(`CREATE TABLE IF NOT EXISTS ${T} (`, `CREATE TABLE IF NOT EXISTS ${S} (`));
-    carried += await copyPointers(S, T);
+    receipts.workflowParkIndexRowsCarried += await copyPointers(S, T);
     const swapped = async () => !(await exists(S)) && (await exists(T)) && (await primaryKeyWidth(db, dialect, T)) !== 1;
     if (dialect === "tidb") {
         await execUntil(db, `RENAME TABLE ${T} TO ${O}, ${S} TO ${T}`, swapped);
@@ -607,7 +866,7 @@ async function reshapeWorkflowParkIndex(db, dialect) {
         await execAtomically(db, [`ALTER TABLE ${T} RENAME TO ${O}`, `ALTER TABLE ${S} RENAME TO ${T}`, `DROP TABLE ${O}`], async () => (await swapped()) && !(await exists(O)));
     }
     await finishParkIndexShape(db, dialect);
-    return { key: "reshaped", carried };
+    receipts.workflowParkIndexKey = "reshaped";
 }
 async function execAtomically(db, statements, postcondition) {
     try {
@@ -658,10 +917,8 @@ export function migrateShadowedRuleDescriptor(text) {
     return { kind: "rewrite", text: JSON.stringify(next) };
 }
 const SHADOWED_RULE_BATCH = 500;
-async function migrateShadowedRuleKey(db, dialect) {
+async function migrateShadowedRuleKey(db, dialect, receipts) {
     const like = `%"${RETIRED_SHADOWED_RULE_KEY}"%`;
-    let migrated = 0;
-    let unreadable = 0;
     let after = "";
     for (;;) {
         const rows = await db.rows(dialect === "tidb"
@@ -675,17 +932,17 @@ async function migrateShadowedRuleKey(db, dialect) {
                 continue;
             const next = migrateShadowedRuleDescriptor(text);
             if (next.kind === "unreadable") {
-                unreadable += 1;
+                receipts.allowRuleShadowRowsUnreadable += 1;
                 continue;
             }
             if (next.kind === "untouched")
                 continue;
-            migrated += await db.exec(dialect === "tidb"
+            receipts.allowRuleShadowRowsMigrated += await db.exec(dialect === "tidb"
                 ? `UPDATE checkpoint SET risk_descriptor = ? WHERE token = ? AND ${jsonColumnTextExpr(dialect, "risk_descriptor")} = ?`
                 : `UPDATE checkpoint SET risk_descriptor = $1 WHERE token = $2 AND ${jsonColumnTextExpr(dialect, "risk_descriptor")} = $3`, [next.text, token, text]);
         }
         if (rows.length < SHADOWED_RULE_BATCH)
-            return { migrated, unreadable };
+            return;
     }
 }
 const RETIRED_CARD_WORD_PATTERNS = ['%"shadowed"%', '%"governance_unavailable"%'];
@@ -707,11 +964,9 @@ export function migrateRetiredCardWordsInCardJson(text) {
     const next = retireStoredCardWords(decoded.value);
     return next.seats.length === 0 ? { kind: "untouched" } : { kind: "rewrite", text: JSON.stringify(next.value), value: next.value };
 }
-async function migrateRetiredCardWords(db, dialect) {
-    let askRows = 0;
-    let unreadable = 0;
+async function migrateRetiredCardWords(db, dialect, receipts) {
     if (!(await tableExists(db, dialect, "approval_ask")))
-        return { askRows, unreadable };
+        return;
     const cardText = jsonColumnTextExpr(dialect, "card_json");
     let after = "";
     for (;;) {
@@ -726,42 +981,189 @@ async function migrateRetiredCardWords(db, dialect) {
                 continue;
             const next = migrateRetiredCardWordsInCardJson(text);
             if (next.kind === "unreadable") {
-                unreadable += 1;
+                receipts.retiredCardWordRowsUnreadable += 1;
                 continue;
             }
             if (next.kind === "untouched")
                 continue;
-            askRows += await db.exec(dialect === "tidb"
+            receipts.retiredCardWordAskRowsRewritten += await db.exec(dialect === "tidb"
                 ? `UPDATE approval_ask SET card_json = ? WHERE ask_id = ? AND CAST(${cardText} AS BINARY) = CAST(? AS BINARY)`
                 : `UPDATE approval_ask SET card_json = $1 WHERE ask_id = $2 AND ${cardText} = $3`, [next.text, askId, text]);
         }
         if (rows.length < RETIRED_CARD_WORD_BATCH)
-            return { askRows, unreadable };
+            return;
+    }
+}
+const M21_GATE = { key: "gate", as: "m21_gate" };
+const M21_PENDING_ACTION = { key: "pendingAction", as: "m21_pending_action" };
+const PARKED_ROW_REPAIR_PAGE = 200;
+const QUESTION_CARD = "question";
+const PARKED_APPROVAL_GATE_KINDS = Object.keys(PAUSE_REGISTRY).filter((k) => PAUSE_REGISTRY[k].pending === "tool_approval");
+const readM21Subtree = createObjectColumnReader();
+const readM21Document = createObjectColumnReader();
+export function parkedRowRepairOf(gateKindCell, gate, pendingAction) {
+    const gateObj = gate !== null && typeof gate === "object" && !Array.isArray(gate) ? gate : undefined;
+    const columnKind = typeof gateKindCell === "string" && isGateKind(gateKindCell) ? gateKindCell : undefined;
+    const documentKind = gateObj !== undefined && isGateKind(gateObj.kind) ? gateObj.kind : undefined;
+    const kind = columnKind ?? documentKind;
+    const pa = pendingAction !== null && typeof pendingAction === "object" && !Array.isArray(pendingAction) ? pendingAction : undefined;
+    const questionCard = kind !== undefined &&
+        PARKED_APPROVAL_GATE_KINDS.includes(kind) &&
+        gateObj !== undefined &&
+        !Object.hasOwn(gateObj, "approvalCard") &&
+        pa?.kind === "tool_approval" &&
+        pa.toolName === ASK_USER_QUESTION_TOOL_NAME;
+    const columnNull = gateKindCell === null || gateKindCell === undefined;
+    return { ...(columnNull && documentKind !== undefined ? { gateKind: documentKind } : {}), questionCard, unresumable: columnNull && documentKind === undefined };
+}
+function m21Subtree(cell, where) {
+    try {
+        return decodeNullableJsonColumn(cell, readM21Subtree, where);
+    }
+    catch (e) {
+        if (!isJsonColumnBodyProblem(e))
+            throw e;
+        return undefined;
+    }
+}
+export async function repairParkedRows(db, dialect, receipts) {
+    const ph = (n) => (dialect === "tidb" ? "?" : `$${n}`);
+    const kinds = PARKED_APPROVAL_GATE_KINDS;
+    const kindSlots = kinds.map((_, i) => ph(i + 1)).join(", ");
+    const scan = `SELECT token, session_id, gate_kind, ${jsonColumnText(dialect, "checkpoint", M21_GATE)}, ${jsonColumnText(dialect, "checkpoint", M21_PENDING_ACTION)} FROM checkpoint ` +
+        `WHERE status = 'pending' AND (gate_kind IS NULL OR (gate_kind IN (${kindSlots}) AND tool_name = ${ph(kinds.length + 1)})) AND token > ${ph(kinds.length + 2)} ` +
+        `ORDER BY token LIMIT ${PARKED_ROW_REPAIR_PAGE}`;
+    const docText = jsonColumnTextExpr(dialect, "checkpoint");
+    const encode = dialectProtocolJsonEncoder(dialect);
+    let after = "";
+    for (;;) {
+        const page = await db.rows(scan, [...kinds, ASK_USER_QUESTION_TOOL_NAME, after]);
+        for (const r of page) {
+            const token = String(r.token);
+            after = token;
+            const plan = parkedRowRepairOf(r.gate_kind, m21Subtree(r[M21_GATE.as], "checkpoint.checkpoint $.gate (M21 parked-row repair)"), m21Subtree(r[M21_PENDING_ACTION.as], "checkpoint.checkpoint $.pendingAction (M21 parked-row repair)"));
+            if (plan.unresumable) {
+                receipts.parkedRowsUnresumableExpired += await db.exec(`UPDATE checkpoint SET status = 'expired', decided_at_ms = ${ph(1)} WHERE token = ${ph(2)} AND status = 'pending' AND gate_kind IS NULL`, [Date.now(), token]);
+                continue;
+            }
+            if (plan.gateKind !== undefined) {
+                receipts.parkedRowGateKindsBackfilled += await db.exec(`UPDATE checkpoint SET gate_kind = ${ph(1)} WHERE token = ${ph(2)} AND status = 'pending' AND gate_kind IS NULL`, [plan.gateKind, token]);
+            }
+            if (!plan.questionCard)
+                continue;
+            const [full] = await db.rows(`SELECT ${jsonColumnText(dialect, "checkpoint")} FROM checkpoint WHERE token = ${ph(1)} AND status = 'pending'`, [token]);
+            if (full === undefined)
+                continue;
+            let doc;
+            try {
+                doc = decodeJsonColumn(full.checkpoint, readM21Document, "checkpoint.checkpoint (M21 question-card repair)");
+            }
+            catch (e) {
+                if (!isJsonColumnBodyProblem(e))
+                    throw e;
+                receipts.parkedQuestionRowsLeftAsWritten += 1;
+                continue;
+            }
+            const gate = doc.gate;
+            if (Object.hasOwn(doc, "requirementsDigest") || gate === null || typeof gate !== "object" || Array.isArray(gate)) {
+                receipts.parkedQuestionRowsLeftAsWritten += 1;
+                continue;
+            }
+            const next = encode({ ...doc, gate: { ...gate, approvalCard: QUESTION_CARD } }, "checkpoint (M21 question-card repair)");
+            receipts.parkedQuestionCardsWritten += await db.exec(dialect === "tidb"
+                ? `UPDATE checkpoint SET checkpoint = ? WHERE token = ? AND status = 'pending' AND CAST(${docText} AS BINARY) = CAST(? AS BINARY)`
+                : `UPDATE checkpoint SET checkpoint = $1::jsonb WHERE token = $2 AND status = 'pending' AND ${docText} = $3`, [next, token, String(full.checkpoint)]);
+        }
+        if (page.length < PARKED_ROW_REPAIR_PAGE)
+            return;
+    }
+}
+const PLACED_OWNER_SCAN_PAGE = 500;
+function placedOwnerScanSql(dialect) {
+    return ("SELECT c.session_id, c.incarnation, r.session_id AS root_row, r.owner AS root_owner, r.incarnation AS root_incarnation, r.placement_kind AS root_kind, " +
+        "p.session_id AS parent_row, p.owner AS parent_owner, p.incarnation AS parent_incarnation, p.placement_kind AS parent_kind, " +
+        "c.placement_root_session_id AS root_id, c.placement_parent_session_id AS parent_id " +
+        "FROM session_meta c LEFT JOIN session_meta r ON r.session_id = NULLIF(c.placement_root_session_id, '') LEFT JOIN session_meta p ON p.session_id = NULLIF(c.placement_parent_session_id, '') " +
+        `WHERE c.placement_kind IS NOT NULL AND c.owner IS NULL AND c.session_id > ${dialect === "tidb" ? "?" : "$1"} ORDER BY c.session_id LIMIT ${PLACED_OWNER_SCAN_PAGE}`);
+}
+function scannedPlacement(r) {
+    return {
+        ...(typeof r.root_id === "string" ? { rootSessionId: r.root_id } : {}),
+        ...(typeof r.parent_id === "string" ? { parentSessionId: r.parent_id } : {}),
+    };
+}
+function scannedFaces(r) {
+    const faces = new Map();
+    const put = (id, row, owner, incarnation) => {
+        if (typeof id !== "string" || row === null || row === undefined)
+            return;
+        faces.set(id, sessionFaceFromRow(id, typeof owner === "string" ? owner : null, incarnation));
+    };
+    put(r.root_id, r.root_row, r.root_owner, r.root_incarnation);
+    put(r.parent_id, r.parent_row, r.parent_owner, r.parent_incarnation);
+    return faces;
+}
+function scannedPlacedSources(r) {
+    const placed = new Set();
+    if (typeof r.root_id === "string" && r.root_row !== null && r.root_row !== undefined && r.root_kind !== null && r.root_kind !== undefined)
+        placed.add(r.root_id);
+    if (typeof r.parent_id === "string" && r.parent_row !== null && r.parent_row !== undefined && r.parent_kind !== null && r.parent_kind !== undefined)
+        placed.add(r.parent_id);
+    return placed;
+}
+export async function inheritPlacedSessionOwners(db, dialect, receipts) {
+    const scan = placedOwnerScanSql(dialect);
+    const cas = CLAIM_OWNERLESS_PLACED_SQL[dialect];
+    let after = "";
+    for (;;) {
+        const page = await db.rows(scan, [after]);
+        for (const r of page) {
+            const sessionId = String(r.session_id);
+            after = sessionId;
+            const incarnation = incarnationFromCell(sessionId, r.incarnation);
+            const judged = judgeDelegatedOwner(sessionId, scannedPlacement(r), scannedFaces(r));
+            const owner = judged.inherited.owner;
+            if (owner === null) {
+                if (judged.inherited.kind === "inherited" && scannedPlacedSources(r).has(judged.inherited.from))
+                    receipts.placedSessionOwnersRemaining += 1;
+                continue;
+            }
+            const landed = await db.exec(cas, [...claimOwnerlessParams(sessionId, incarnation, owner)]);
+            if (isOrphanSessionOwner(owner))
+                receipts.placedSessionOwnersOrphaned += landed;
+            else
+                receipts.placedSessionOwnersInherited += landed;
+        }
+        if (page.length < PLACED_OWNER_SCAN_PAGE)
+            return;
     }
 }
 const INCARNATION_BACKFILL_BATCH = 500;
-async function migrateSessionIncarnations(db, dialect) {
-    if (!(await tableExists(db, dialect, "session_meta")))
-        return { sessionIncarnationColumn: "no-table", sessionIncarnationsBackfilled: 0 };
+async function migrateSessionIncarnations(db, dialect, receipts) {
+    if (!(await tableExists(db, dialect, "session_meta"))) {
+        receipts.sessionIncarnationColumn = "no-table";
+        return;
+    }
     const col = SESSION_META_INCARNATION_COLUMN;
-    let sessionIncarnationColumn = "present";
+    let column = "present";
     if (!(await columnExists(db, dialect, "session_meta", col.name))) {
         try {
             await db.exec(`ALTER TABLE session_meta ADD COLUMN ${dialect === "tidb" ? col.tidb : col.pg}`);
-            sessionIncarnationColumn = "added";
+            column = "added";
         }
         catch (e) {
             if (!(await columnExists(db, dialect, "session_meta", col.name)))
                 throw e;
         }
     }
-    return { sessionIncarnationColumn, sessionIncarnationsBackfilled: await backfillSessionIncarnations(db, dialect) };
+    receipts.sessionIncarnationColumn = column;
+    await backfillSessionIncarnations(db, dialect, receipts);
 }
-async function backfillSessionIncarnations(db, dialect) {
+async function backfillSessionIncarnations(db, dialect, receipts) {
     const remaining = async () => Number((await db.rows("SELECT COUNT(*) AS n FROM session_meta WHERE incarnation = ''"))[0]?.n ?? 0);
     const initial = await remaining();
     if (initial === 0)
-        return 0;
+        return;
     const ceiling = Math.ceil(initial / INCARNATION_BACKFILL_BATCH) * 2 + 2;
     let written = 0;
     let after;
@@ -771,7 +1173,7 @@ async function backfillSessionIncarnations(db, dialect) {
             : await db.rows(`SELECT session_id FROM session_meta WHERE incarnation = '' AND session_id > ${dialect === "pg" ? "$1" : "?"} ORDER BY session_id LIMIT ${INCARNATION_BACKFILL_BATCH}`, [after])).map((r) => String(r.session_id));
         if (ids.length === 0) {
             if (after === undefined)
-                return written;
+                return;
             after = undefined;
             continue;
         }
@@ -782,7 +1184,9 @@ async function backfillSessionIncarnations(db, dialect) {
         };
         const cases = ids.map((id) => `WHEN ${bind(id)} THEN ${bind(mintSessionIncarnation())}`).join(" ");
         const inList = ids.map((id) => bind(id)).join(", ");
-        written += await db.exec(`UPDATE session_meta SET incarnation = CASE session_id ${cases} END WHERE incarnation = '' AND session_id IN (${inList})`, params);
+        const landed = await db.exec(`UPDATE session_meta SET incarnation = CASE session_id ${cases} END WHERE incarnation = '' AND session_id IN (${inList})`, params);
+        written += landed;
+        receipts.sessionIncarnationsBackfilled += landed;
         after = ids.length < INCARNATION_BACKFILL_BATCH ? undefined : ids[ids.length - 1];
     }
     const left = await remaining();
@@ -791,33 +1195,44 @@ async function backfillSessionIncarnations(db, dialect) {
             `(${written} written) — refusing to start rather than serve sessions whose occupant cannot be told apart. Retry the boot; ` +
             `if it repeats, something keeps writing rows without an incarnation (an older replica still inserting?).`);
     }
-    return written;
+}
+function readingFields(r) {
+    return {
+        auditDetailJsonNullRows: r.auditDetailJsonNullRows,
+        ...(r.sessionIncarnationColumn !== undefined ? { sessionIncarnationColumn: r.sessionIncarnationColumn } : {}),
+        sessionIncarnationsBackfilled: r.sessionIncarnationsBackfilled,
+        holderDeathCodeRowsBackfilled: r.holderDeathCodeRowsBackfilled,
+        allowRuleShadowRowsMigrated: r.allowRuleShadowRowsMigrated,
+        allowRuleShadowRowsUnreadable: r.allowRuleShadowRowsUnreadable,
+        ...(r.workflowParkIndexKey !== undefined ? { workflowParkIndexKey: r.workflowParkIndexKey } : {}),
+        workflowParkIndexRowsCarried: r.workflowParkIndexRowsCarried,
+        undurableScopeRuleRowsRemoved: r.undurableScopeRuleRows.length,
+        undurableScopeRuleBucketsDeferred: r.undurableScopeRuleBucketsDeferred,
+        undurableScopeRuleBucketsUnreadable: r.undurableScopeRuleBucketsUnreadable.length,
+        ...(r.sessionRuleColumn !== undefined ? { sessionRuleColumn: r.sessionRuleColumn } : {}),
+        sessionRuleRowsWithRetiredBuckets: r.sessionRuleRowsWithRetiredBuckets.length,
+        sessionRuleRowsWithOldGrammarEntries: r.sessionRuleRowsWithOldGrammarEntries.length,
+        sessionRuleRowsWithUnreadableDeny: r.sessionRuleRowsWithUnreadableDeny.length,
+        retiredCardWordAskRowsRewritten: r.retiredCardWordAskRowsRewritten,
+        retiredCardWordRowsUnreadable: r.retiredCardWordRowsUnreadable,
+        parkedQuestionCardsWritten: r.parkedQuestionCardsWritten,
+        parkedQuestionRowsLeftAsWritten: r.parkedQuestionRowsLeftAsWritten,
+        parkedRowGateKindsBackfilled: r.parkedRowGateKindsBackfilled,
+        parkedRowsUnresumableExpired: r.parkedRowsUnresumableExpired,
+        placedSessionOwnersInherited: r.placedSessionOwnersInherited,
+        placedSessionOwnersOrphaned: r.placedSessionOwnersOrphaned,
+        placedSessionOwnersRemaining: r.placedSessionOwnersRemaining,
+        ...(r.workflowJournalScopeColumn !== undefined ? { workflowJournalScopeColumn: r.workflowJournalScopeColumn } : {}),
+        workflowJournalOwnersBackfilled: r.workflowJournalOwnersBackfilled,
+        workflowJournalForeignScopeRowsRemoved: r.workflowJournalForeignScopeRowsRemoved,
+        retiredBreakerTablesDropped: r.retiredBreakerTablesDropped,
+        mailboxRejectedKeyRowsRemoved: r.mailboxRejectedKeyRowsRemoved,
+    };
 }
 export function logOneTimeMigrations(log, backend, report) {
-    const changed = report.auditDetailJsonNullRows > 0 ||
-        report.sessionIncarnationColumn === "added" || report.sessionIncarnationsBackfilled > 0 || report.holderDeathCodeRowsBackfilled > 0 || report.allowRuleShadowRowsMigrated > 0 || report.allowRuleShadowRowsUnreadable > 0 ||
-        report.workflowParkIndexKey === "reshaped" || report.undurableScopeRuleRows.length > 0 || report.undurableScopeRuleBucketsDeferred > 0 ||
-        report.undurableScopeRuleBucketsUnreadable.length > 0 ||
-        report.sessionRuleColumn === "renamed" || report.sessionRuleRowsWithRetiredBuckets.length > 0 || report.sessionRuleRowsWithOldGrammarEntries.length > 0 ||
-        report.retiredCardWordAskRowsRewritten > 0 || report.retiredCardWordRowsUnreadable > 0;
-    (changed ? log.warn : log.info).call(log, "one_time_migrations_applied", {
+    (changedAnything(report) ? log.warn : log.info).call(log, "one_time_migrations_applied", {
         backend,
-        auditDetailJsonNullRows: report.auditDetailJsonNullRows,
-        sessionIncarnationColumn: report.sessionIncarnationColumn,
-        sessionIncarnationsBackfilled: report.sessionIncarnationsBackfilled,
-        holderDeathCodeRowsBackfilled: report.holderDeathCodeRowsBackfilled,
-        allowRuleShadowRowsMigrated: report.allowRuleShadowRowsMigrated,
-        allowRuleShadowRowsUnreadable: report.allowRuleShadowRowsUnreadable,
-        workflowParkIndexKey: report.workflowParkIndexKey,
-        workflowParkIndexRowsCarried: report.workflowParkIndexRowsCarried,
-        undurableScopeRuleRowsRemoved: report.undurableScopeRuleRows.length,
-        undurableScopeRuleBucketsDeferred: report.undurableScopeRuleBucketsDeferred,
-        undurableScopeRuleBucketsUnreadable: report.undurableScopeRuleBucketsUnreadable.length,
-        sessionRuleColumn: report.sessionRuleColumn,
-        sessionRuleRowsWithRetiredBuckets: report.sessionRuleRowsWithRetiredBuckets.length,
-        sessionRuleRowsWithOldGrammarEntries: report.sessionRuleRowsWithOldGrammarEntries.length,
-        retiredCardWordAskRowsRewritten: report.retiredCardWordAskRowsRewritten,
-        retiredCardWordRowsUnreadable: report.retiredCardWordRowsUnreadable,
+        ...readingFields(report),
         removableAfter: Object.fromEntries(ONE_TIME_MIGRATIONS.map((w) => [w.id, w.removableAfter])),
         note: "one-time persisted-data migrations (M4: audit details written as the JSON " +
             "text `null` by an earlier version folded to a SQL NULL, so \"no detail\" has exactly one on-disk spelling; M5: the " +
@@ -835,16 +1250,56 @@ export function logOneTimeMigrations(log, backend, report) {
             "are read by the engine in the grammar the row carries (none = the grammar before the stamp) and rewritten as the same statement in the current grammar " +
             "(the column carries the in-progress name rule_entries_old_grammar until every row is rewritten, so an interrupted boot resumes there) — toolAllow entries " +
             "that the earlier grammar read as naming no tool are removed from the row, every row is stamped with the current grammar, one session_rule_row_old_grammar_entries " +
-            "line per row that lost entries; " +
+            "line per row that lost entries — except a row whose toolDeny holds an entry the engine reads as no rule: that row is left whole and unstamped (the engine refuses every " +
+            "call of such a session until an operator rewrites its rules), one session_rule_row_unreadable_deny line per row; " +
             "rows still holding a retired command bucket keep that bucket and are named, one session_rule_row_retired_bucket line per row on every boot; " +
             "M18: stored approval cards written by an earlier engine with two words the current engine retired rewritten — ruleOffersAbsence shadowed removed, ask class " +
             "governance_unavailable read as rule_unreadable; the engine's own parked-row documents are never rewritten (their row digest covers the ask class), they and " +
-            "the cards this step cannot reach are read the same way, counted under server.approval-card.retired-card-word-read). Each step " +
+            "the cards this step cannot reach are read the same way, counted under server.approval-card.retired-card-word-read; M21: suspended rows parked by an engine " +
+            "before the question card existed and still pending — a question approval whose gate carries no card — get the card word question (rows the engine sealed " +
+            "with its row digest are left as written and counted), and suspended rows with no gate kind on the row get it from the gate (a row whose gate names no " +
+            "registered kind cannot be resumed and is expired); M23: delegated (placed) session rows written ownerless by an earlier version get the owner of their " +
+            "delegation tree as this boot reads it — the root session's owner, or the parent's when the root row is gone; a row under an ownerless root stays ownerless; a row whose root and parent " +
+            "are both gone gets an owner no caller can match and the rows below it inherit that owner, all counted and named by a placed_session_owners_orphaned line; " +
+            "placedSessionOwnersRemaining counts the rows this boot could not settle because the session they inherit from was itself still ownerless — until a later boot or " +
+            "their next park settles them, only fleet callers can read them; M24: the scope that owns a workflow run's resume journal moved from a column on every journal row " +
+            "into one row per run in workflow_journal_owner — each run got the scope of its lowest-ordinal row, and the journal table was rebuilt (copy + atomic rename) " +
+            "keyed by (run, owner-record incarnation, ordinal) without the scope column; rows another scope had written into the run were not carried " +
+            "(counted, one workflow_journal_foreign_scope_rows_removed line); M26: the retired shared circuit-breaker table circuit_breaker dropped — its keys " +
+            "carried a route's base URL, which could carry a credential from the URL's query, and the whole table is dropped rather than judged row by row; " +
+            "the breakers live in the new table breaker_state, which this step never touches; only the count is logged, never a key; M27: rows of the three " +
+            "mailbox tables (mailbox / mailbox_message / mailbox_tombstone) whose key — scope or handle — the mailbox key judge refuses (control characters, " +
+            "malformed Unicode, wider than 190 UTF-8 bytes, empty scope) removed, a whole box at a time: no entry point reaches such a key any more, so neither " +
+            "delivery, reading nor session deletion would ever have touched them again; only the count is logged, never a key). Each step " +
             "runs on every boot until its window closes (the release that introduced it + 30 days; the per-step date is in " +
             "removableAfter, null while that release is not published yet) and is deleted in the first minor after that — start a " +
             "version that still carries a step at least once before upgrading past its deletion.",
     });
-    for (const row of report.undurableScopeRuleRows) {
+    logReceiptRows(log, backend, report);
+}
+function logReceiptRows(log, backend, r) {
+    if (r.workflowJournalForeignScopeRowsRemoved > 0) {
+        log.warn("workflow_journal_foreign_scope_rows_removed", {
+            backend,
+            rows: r.workflowJournalForeignScopeRowsRemoved,
+            note: "workflow journal rows whose scope differed from the scope that owns their run were removed while the run's owning scope moved into workflow_journal_owner. " +
+                "Earlier versions accepted an append from another scope into a run (a new step was inserted, an existing step overwritten under the owner's scope); the current " +
+                "schema keeps one scope per run, so such rows have nowhere to live. Only the scope that wrote them could read them, and only to replay those steps when resuming " +
+                "that run — such a resume now runs those steps live. No action needed",
+        });
+    }
+    if (r.placedSessionOwnersOrphaned > 0) {
+        log.warn("placed_session_owners_orphaned", {
+            backend,
+            rows: r.placedSessionOwnersOrphaned,
+            note: "delegated (placed) session rows that an earlier version wrote without an owner were given an owner no caller can match, in one of two forms: a row whose root and parent " +
+                "sessions are both gone gets `_orphan:<its own session id>`; a row whose parent is such a row inherits that same value, `_orphan:<that ancestor's session id>` (rows below it " +
+                "inherit it in turn). Their transcripts are no longer readable through the session faces by anyone but fleet-wide and operator callers. They are the rows whose owner " +
+                "starts with `_orphan:` (an owner naming the row's own id had no surviving ancestor; one naming another session came down from that orphaned ancestor); set a real owner " +
+                "in the session store by hand if someone should read one, or leave them to the transcript retention",
+        });
+    }
+    for (const row of r.undurableScopeRuleRows) {
         log.warn("permission_rule_row_removed", {
             backend,
             ownerKey: row.ownerKey,
@@ -855,7 +1310,7 @@ export function logOneTimeMigrations(log, backend, report) {
             note: removedRuleRowNote(row.kind),
         });
     }
-    for (const bucket of report.undurableScopeRuleBucketsUnreadable) {
+    for (const bucket of r.undurableScopeRuleBucketsUnreadable) {
         log.warn("permission_rule_bucket_unreadable", {
             backend,
             ownerKey: bucket.ownerKey,
@@ -865,8 +1320,37 @@ export function logOneTimeMigrations(log, backend, report) {
                 "keeps being refused, as before this release, until someone repairs or deletes that row by hand",
         });
     }
-    logSessionRuleOldGrammarRows(log, backend, report.sessionRuleRowsWithOldGrammarEntries);
-    for (const row of report.sessionRuleRowsWithRetiredBuckets) {
+    for (const row of r.sessionRuleRowsWithOldGrammarEntries) {
+        log.warn("session_rule_row_old_grammar_entries", {
+            backend,
+            policyKey: row.policyKey,
+            sessionId: row.sessionId,
+            toolAllowDropped: row.toolAllowDropped,
+            note: "a session's stored rules were written before the rule-grammar stamp, when an entry was compared as a tool name as written; the engine reads such a row " +
+                "in that earlier grammar, where these toolAllow entries named no tool and admitted nothing, while in the current grammar they would be allow rules. " +
+                "The row was rewritten as the same statement in the current grammar: these entries were removed and the row stamped (an emptied list stays in place and allows " +
+                "nothing); toolDeny entries were left as written (a row whose toolDeny holds an entry the engine reads as no rule is not rewritten at all — it is named by " +
+                "session_rule_row_unreadable_deny instead). Every entry named on this line is named exactly once, by the boot that " +
+                "removed it — no later boot lists it again — so keep the line. Write the session's rules afresh through the session policy endpoint if an entry was meant as an allow rule",
+        });
+    }
+    for (const row of r.sessionRuleRowsWithUnreadableDeny) {
+        log.warn("session_rule_row_unreadable_deny", {
+            backend,
+            policyKey: row.policyKey,
+            sessionId: row.sessionId,
+            toolDenyUnreadable: row.toolDenyUnreadable,
+            ...(row.retiredBuckets !== undefined ? { retiredBuckets: row.retiredBuckets } : {}),
+            note: "a session's stored rules hold toolDeny entries the engine's rule reader reads as no rule at all (the reason on each entry is the reader's own word). The engine never " +
+                "reads rules it cannot read as fewer rules, so every tool call in this session is refused until the rules are rewritten. The row was not rewritten and not stamped " +
+                "with the current rule grammar: the stamp would only silence the engine's notice about the earlier grammar (config.session_rules_earlier_grammar) and lift nothing. " +
+                "Nothing was removed for you — a deny nobody can read is the operator's to rewrite. Write the session's rules afresh as an operator through the session policy " +
+                "endpoint (PUT /v1/sessions/:id/policy, a new value without the stored row's rev, leaving these entries out or spelling each as a rule), or delete the session " +
+                "(deleting the session deletes its rules). A line carrying retiredBuckets names a row that also holds a retired command bucket: the policy endpoint cannot read such a row " +
+                "(not even for an operator), so rewrite the row in the database in the current grammar (keep rev and gen) or delete the session. Each row is named exactly once, by the boot that ran the judgement — no later boot lists it again — so keep the line",
+        });
+    }
+    for (const row of r.sessionRuleRowsWithRetiredBuckets) {
         log.warn("session_rule_row_retired_bucket", {
             backend,
             policyKey: row.policyKey,
@@ -880,40 +1364,17 @@ export function logOneTimeMigrations(log, backend, report) {
         });
     }
 }
-function logSessionRuleOldGrammarRows(log, backend, rows) {
-    for (const row of rows) {
-        log.warn("session_rule_row_old_grammar_entries", {
-            backend,
-            policyKey: row.policyKey,
-            sessionId: row.sessionId,
-            toolAllowDropped: row.toolAllowDropped,
-            ...(row.wildcardMasked ? { wildcardMasked: true } : {}),
-            note: row.wildcardMasked
-                ? "a session's stored rules were written before the rule-grammar stamp and its toolAllow list holds `*`: the engine reads that list as void in every grammar (every call " +
-                    "refused), which hides what the other entries meant in the earlier grammar, so this row was NOT rewritten or stamped — it stays in its earlier grammar. To restore the other " +
-                    "entries, an operator rewrites the row without `*` (entries spelled as rules, `Bash(rm:*)`, then become allow rules — review them first)."
-                :
-                    "a session's stored rules were written before the rule-grammar stamp, when an entry was compared as a tool name as written; the engine reads such a row " +
-                        "in that earlier grammar, where these toolAllow entries named no tool and admitted nothing, while in the current grammar they would be allow rules. " +
-                        "The row was rewritten as the same statement in the current grammar: these entries were removed and the row stamped (an emptied list stays in place and allows " +
-                        "nothing); toolDeny entries read the same in every grammar and were left as written. Every entry named on this line is named exactly once, by the boot that " +
-                        "removed it — no later boot lists it again — so keep the line. Write the session's rules afresh through the session policy endpoint if an entry was meant as an allow rule",
-        });
-    }
-}
 function logOneTimeMigrationsInterrupted(log, backend, error) {
-    const { receipts } = error;
     log.warn("one_time_migrations_interrupted", {
         backend,
-        sessionRuleColumn: receipts.sessionRuleColumn ?? "in-progress",
-        sessionRuleRowsWithOldGrammarEntries: receipts.sessionRuleRowsWithOldGrammarEntries.length,
-        note: "the one-time migrations failed after committing changes whose receipts the next boot cannot re-derive: the session_rule_row_old_grammar_entries lines that follow name " +
-            "rows this boot already rewrote — a retried boot finds them rewritten and removes nothing from them. These lines are the only place the rewritten rows are ever " +
-            "reported — no later boot lists them — so save them. The failure itself follows as this boot's refusal. sessionRuleColumn \"renamed\": every row was rewritten and the final " +
-            "column name was published before the failure; \"in-progress\": the column still carries its in-progress name — the next boot rewrites the remaining rows (rows already " +
-            "rewritten are left alone) and publishes the final name",
+        ...readingFields(error.receipts),
+        note: "the one-time migrations failed after committing changes: the readings on this line and the lines that follow are what this boot already committed — a retried " +
+            "boot finds that work done and does not report it again, so these lines are the only record of them, written once by this boot — save them. The failure itself follows " +
+            "as this boot's refusal. A shape reading absent from this line (sessionIncarnationColumn / workflowParkIndexKey / sessionRuleColumn / workflowJournalScopeColumn) belongs to a step that did not " +
+            "finish; sessionRuleColumn absent after session_rule_row_old_grammar_entries lines means the column still carries its in-progress name — the next boot rewrites the " +
+            "remaining rows (rows already rewritten are left alone) and publishes the final name",
     });
-    logSessionRuleOldGrammarRows(log, backend, receipts.sessionRuleRowsWithOldGrammarEntries);
+    logReceiptRows(log, backend, error.receipts);
 }
 export async function runAndLogOneTimeMigrations(log, backend) {
     let report;