@sema-agent/server 7.132.0 → 7.133.0

package/dist/plugins/one-time-migrations.d.ts

@@ -200,6 +200,62 @@
  *    4 及更早的载荷若带 prompts,那是 13.x 的两轴 wire(引擎当期不读)。`config-lkg.ts` `loadLkg` 读回 4(及迁到 4 的 2 / 3)时:载荷带 prompts ⇒ 不读回
  *    (拒因点名版本与键);不带 ⇒ 载荷零改动读回,读回方按 5 写回原位,启动日志 `config_lkg_migrated` 一行。规则在 `config-lkg.ts` 顶注 formatVersion 5 一段与
  *    `migrateV4Lkg`。没有读数键(它不写库)。
+ *  · **M23 存量 placed 子代行的属主**(7.133.0)—— 7.132.x 及以前两只 SQL 店建委派子代的 placed 行时属主恒 NULL,会话面的属主谓词对 NULL 放行 ⇒ 谁拿到子代的会话 id
+ *    (父客户端在子代帧的 `transcriptId` 上收到)谁就读得到整段转录。7.133.0 起建行那一笔按委派继承律写属主(`src/delegated-session-owner.ts`,律的唯一属主),
+ *    属主为 NULL 的 placed 行只对 fleet 调用方放行(无主放行臂的唯一判据 `security.ts` 的 `ownerlessRowOpen`,常设的读面律,不随本条删);存量行 ⇒ **每次起服的幂等回填**,
+ *    判据与建行逐字同一只(`judgeDelegatedOwner`,属主 = 判断时见证到的):根会话的行在 ⇒ 它的属主(根无主 ⇒ 子代仍无主,不写);根行不在 ⇒ 父会话的行;都不在(孤行)⇒
+ *    哨兵属主 `_orphan:<id>`(保留主体前缀,任何已验身份都不等于它 —— 不留 NULL,宁可没人能读),计数 + 起服一行 warn `placed_session_owners_orphaned` 点名条数。记下的根 / 父是空串 ⇒ 读作没有那一格。
+ *    **单趟**:按 `session_id` 键集分页扫 `placement_kind IS NOT NULL ∧ owner IS NULL` 的行,每一页一条语句连读根 / 父两行(属主、住客、是不是 placed 行;连接键套
+ *    `NULLIF(…, '')`);回写 = 认领句(`CLAIM_OWNERLESS_PLACED_SQL`:只 CAS 子行自己 —— 扫描读到的化身 + `owner IS NULL` + `placement_kind IS NOT NULL`;扫描与回写之间根 / 父被删、
+ *    同 id 重建、换住客,写进去的仍是扫描那一读见证到的属主;这一行自己被删、同 id 换了住客或已被别的写者写过 ⇒ 零命中,下一次起服按那时的律重判);
+ *    化身为空的行(子代或来源行)⇒ 响亮拒(全仓「读到空化身」同一条律)。读数三格:写成的(`placedSessionOwnersInherited` / `placedSessionOwnersOrphaned`)与
+ *    **残余** `placedSessionOwnersRemaining` = 律这一读判不出、因为它读到的来源本身还是一只无主的委派子代行的行(根已删、父是同样待回填的行,且排在它之后或在同一页里)。
+ *    残余非零 ⇒ 读数行 warn;**不拒启、不重扫**:本文件的每一条在窗内每次起服都跑(「窗」一节),残余行只对 fleet 调用方放行(读面律),由之后起服的本条(一次至少再定下一层)
+ *    或这一行的下一次停驻(停驻挂点按同一条律认领,`delegated-session-owner.ts` 的 `settleDelegatedOwner`)定下。根无主的子代(律就让它无主)不是残余,每次起服照样被扫到、照样不写。
+ *    **够不到的一格(如实登记)**:local 车道没有 placed 行(引擎 File 店不实现 placement,子代住私店),本条不碰 local 的会话边档;local 店也不记委派树、
+ *    不认领 ⇒ 经晋升腿进 local 宿主店的升级前子代行仍无主,它们再次停驻时停驻挂点照「属主不是律给的那一只 ⇒ 拒」处置(收口 = local 的 placement 协议;随包文字的补偿:
+ *    local 带身份的部署升级前先把停驻待批的审批处理完)。窗 = 发布日 + 30 天(与 M19 / M21 同一条论证:
+ *    窗关时缺省部署上升级前的子代转录已被联合收割按 `BG_AGENT_RETENTION_MS` 收走;调长了留存的部署、滚动升级里旧副本在窗内新写的行如实登记,不为它们加长窗)。
+ *  · **M24 workflow journal 的属主 scope 搬家**(7.133.0)—— 7.132.x 及以前 `workflow_journal` 的 scope 是**每一行**上的一列:读面按它判,写面(按
+ *    `(run_id, ordinal)` 的 upsert)从不判它 ⇒ 别的 scope 的 append 落新序数插进一条 run、落既有序数覆盖属主的结果。7.133.0 起一条 run 的属主 scope 只记在
+ *    `workflow_journal_owner` 一行(主键 `run_id`,带认领时新铸的 `incarnation`),店的写面与读面经同一只谓词判;journal 行上不再有 scope 列,改带写下它的那只
+ *    属主记录的 `incarnation`,且它是主键的一段:`(run_id, incarnation, ordinal)`(一行只属于写下它的那只属主记录,`workflow-journal-store-sql.ts` 顶注)。
+ *    主键换形 ⇒ 与 M9 同一种做法 —— **复制 + 原子换名**。存量库(正表上 scope 列在场 = 没经过本条)⇒ ① 上一次换名之前被打断留下的暂存表删掉重来(正表在换名
+ *    之前一个字节不动,暂存表只是它的不完整拷贝)② **回填属主**:每条还没有属主记录的 run 一行 —— scope = 该 run **最小序数**那一行的 scope(主键
+ *    `(run_id, ordinal)` 保证恰一行;引擎按序铸序数,最小序数就是这条 run 最先记下的那一步),`incarnation` = 常量 `M24_OWNER_INCARNATION`(令牌只需在同一
+ *    run_id 的先后几只记录之间不同:回填的是它已知的第一只,之后的认领铸随机令牌),`appended_at_ms` = 该 run 最晚的 `created_at_ms`(属主记录自己的 GC 时钟,
+ *    不早于它的任何一行);带 `NOT EXISTS`,续跑只补缺的 ③ 数跨 scope 行(scope ≠ 属主的行 —— 旧写面放进来的别的 scope 的写;新形里不可表示,不搬)
+ *    ④ 照**中央 DDL 的同一条语句**换表名建暂存表 `workflow_journal_m24`,按旧主键键集分批(每批 `result` 字节有界、各自提交)搬与属主同 scope 的行(带属主记录的令牌)⑤ **原子换名**:TiDB 一条
+ *    `RENAME TABLE 正 TO 待删, 暂存 TO 正` 后删待删旧表;PG 两条换名、删旧表与主键约束名改回常规名在同一个事务里 —— 换名提交那一刻跨 scope 行随旧表一起消失,计数进读数 +
+ *    起服一行 warn `workflow_journal_foreign_scope_rows_removed`。正表上 scope 列不在 ⇒ `current`(新库 / 第二跑;TiDB 上一次换名之后被打断 ⇒ 只补删待删旧表)。写它们的 scope 失去那几条 resume 重放,退化为活跑。破坏性的换名排在「破坏性步骤」一节。滚动升级:换名之后仍在跑的 ≤7.132.x 副本的 journal 语句点名
+ *    不存在的列、响亮失败(先停光旧副本再起新,`docs/DEPLOY-PREREQS.md` 的 7.133.0 SQL 后端一节);复制之后、换名之前旧副本写进旧表的行随旧表删掉(那几步续跑时活跑)。
+ *    local 车道的店是 core 的 File 店(属主 = 每条 run 的 journal 文件首行)⇒ `file-store` / 0 / 0。
+ *
+ *  · **M25 单用户记忆项目层换键形**(7.133.0)—— 不在店里、不在起服里(与 M10 同为**窗内才存在的行为臂**,但它是改写):项目层键从 `repo:<sha256(项目根)[:24]>`
+ *    (7.98.0–7.132.x)换成带主体、跨设备的 `userrepo:<属主段>/<档>.<摘要>`(文法 `project-layer-key.ts`)。退役键是路径哈希、反推不出路径 ⇒ 起服没法枚举改写;
+ *    改为**每个项目第一次跑任务时**由项目层准备一步(`memory-project-layer.ts` `createMemoryProjectLayers`)把该 checkout 的 `repo:` 层经 core `migrateScope`
+ *    折进新键(File 与两只 SQL 孪生同一条;id 保留、CAS,冲突留原地下次再试)。同一窗同删的另一半:同步客户端腿的旧游标文件 `sync-cursor-<peer>.json`(只按 peer 分区)
+ *    第一轮收编为同步层的新游标(`memory-sync-client.ts` `adoptLegacyCursor`)。本条不写起服读数(`reportKeys` 空,与 M7 / M10 同形);折了什么由运行期 info
+ *    `memory_project_layer_folded` / `memory_sync_cursor_adopted` 说。常设的另一条律(`r` 档时本 checkout 的 `p` 档折进当前档)不是迁移,不随本条删。
+ *  · **M26 删掉退役的共享断路器表 `circuit_breaker`**(7.133.0)—— 断路器键的路由段从 baseUrl **原串**换成路由身份的摘要(铸点与形 `breaker-key.ts`),
+ *    新一代键写**新表** `breaker_state`(中央 DDL 建)。旧表 `circuit_breaker` 的行是旧键(`<provider>:<id>@<baseUrl>`,网关根原串 query 可带凭据),
+ *    新代码不读不写它、它也没有 TTL 腿 ⇒ 不删就永远在共享库里。**整只删表**(`DROP TABLE IF EXISTS circuit_breaker`,不看任何一行的内容):
+ *    不从键的形去推断哪一行是旧的,也不碰新表里的活状态。断路器状态是秒级的建议性活数据,所以不做「旧键改写成新键」;新表从空开始、按阈值重新计数。
+ *    幂等与本段每一条同:第二次起服表已不在 ⇒ 零动作。滚动升级窗里还在跑的旧副本写旧表会失败(建议性写穿,吞掉并计数 —— 它们退回各自进程内的
+ *    断路器);窗里重启的旧副本按自己的 DDL 重建空的旧表,下一次新副本起服再删。读数 = 删掉的退役表数(0 / 1),一行键都不进日志。
+ *    local 车道没有这张表(断路器是进程内的)⇒ 恒 0。
+ *  · **M27 收件箱里判官拒的键的行**(7.133.0)—— 收件箱的键列本版只有一只判官 `mailboxKeyProblem`(`mailbox-store-sql.ts`:良构 Unicode ∧ 无控制字符 ∧
+ *    UTF-8 ≤ 190 字节 ∧ scope 非空),律是「判官拒的键没有箱」:两方言每一只入口对它答「箱不在」(`reap` 对候选扫描交回的被拒句柄同样跳过),会话删除的打标 / 丢箱
+ *    两步也不再碰它。7.132.x 及以前的 PostgreSQL 孪生只拒 NUL 与孤立代理 ⇒ 带别的控制字符(HTAB …)的主体 / 会话 handle 写下过箱(可信主体头收 HTAB、
+ *    JWT `sub` 收任何控制字符);MySQL 协议孪生 7.132.x 已拒控制字符与超宽键(更早版本写下的同删)。那样的行在新律下谁都够不着、正文永久留库 ⇒ **一次性删除**:
+ *    三张表(`mailbox` / `mailbox_message` / `mailbox_tombstone`,在场的才扫 —— 收件箱表由店在本段之后建,新库上三张都还不在)按 `(scope_key, handle)` 键集分页扫键
+ *    (只取两只键列,正文不出库),键读回进程问**同一只判官**(`storedMailboxKeyless`:TiDB 的原字节先无损读成串,不是 UTF-8 的字节 —— 没有任何串编码成它 —— 判不良构;
+ *    SQL 里不重述判据,两份判据迟早分叉),判官拒的那只键按 `drop` 的
+ *    锁序与语句逐表删(`MAILBOX_KEYED_TABLES` / `mailboxKeyDeleteSql`),参数是读回的原字节。删掉的行数进读数 `mailboxRejectedKeyRowsRemoved`(一只键都不进日志)。
+ *    幂等:只按判官挑,第二次起服零命中;每句自动提交、不包事务 —— 被打断就由下一次起服接着删剩下的。**不在本条之内(如实登记)**:① lease owner 列 —— 它不是
+ *    箱的键;判官拒的 owner 持不了租(`ack` / `releaseLease` 照「不是持租者」答、`claimLease` 抛),存量那一格随租约到期失效;② MySQL 协议上带孤立代理的主体
+ *    在升级前写下的箱 —— 驱动把孤立代理换成 U+FFFD 的三字节,库里的键与字面带 U+FFFD 的那只主体的键逐字节相同,判官收这只键 ⇒ 不删(挑出来就得删掉一只律认为
+ *    存在的箱)。local 车道用引擎自己的 File 信箱(盘上格式归引擎)⇒ 恒 0。
  *
  * ## 收据账(一次起服一只,每一条迁移同一只)
  * 每一步把它**已提交**的改写 / 删除与点名读数当场记进同一只收据账({@link MigrationReceipts}):计数随每次提交累加、行随每次提交追加、形读数在那一步落定时写。走完 ⇒
@@ -210,7 +266,9 @@
  *
  * ## 幂等
  * 改写的几条都可重复跑(M4:`detail IS NOT NULL AND … = 'null'`;M5:列在场探针 + `WHERE incarnation = ''`;M6:`WHERE error_code IS NULL`;
- * M8 / M18:字样扫描 + CAS 回写 —— 写过的行不再命中;M17 的改写只在改名那一拍跑,第二跑列名已是新名 ⇒ 零读零写;续判时已带戳的行零动作)。并发起动由 {@link runSqlOneTimeMigrations} 的 advisory 锁 + 每步的后置条件判据兜住(见那里)。
+ * M8 / M18:字样扫描 + CAS 回写 —— 写过的行不再命中;M17 的改写只在改名那一拍跑,第二跑列名已是新名 ⇒ 零读零写;续判时已带戳的行零动作;
+ * M24:正表 scope 列在场探针 —— 换名之后只补收尾(删待删旧表),换名之前被打断则暂存表删掉重建、回填只补缺的属主记录(`NOT EXISTS`);
+ * M27:只按判官挑 —— 删过的键不再被扫到)。并发起动由 {@link runSqlOneTimeMigrations} 的 advisory 锁 + 每步的后置条件判据兜住(见那里)。
  */
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
@@ -268,6 +326,25 @@ export interface OneTimeMigrationReport {
     readonly parkedRowGateKindsBackfilled: number;
     /** M21:`gate_kind` 为 NULL、门子树里读不出一只 core 登记门型的停驻行 —— 引擎续不了(`pauseOf` 拒)⇒ 置 expired 的行数(SQL 独有;local 恒 0)。非零 = 真改了存量行。 */
     readonly parkedRowsUnresumableExpired: number;
+    /** M23:本次给属主为 NULL 的存量 placed 子代行写上委派树属主(根的,根行不在取父的)的行数(SQL 独有;local 恒 0)。非零 = 真写了存量行。 */
+    readonly placedSessionOwnersInherited: number;
+    /** M23:写上了谁都不匹配的属主的存量 placed 子代行 —— 根 / 父两行都已不在(孤行哨兵),或继承自这样一只祖先(同一只哨兵);没有任何调用方能读它们,运维可手工改属主。
+     *  行数(SQL 独有;local 恒 0)。非零 ⇒ 另一行 warn 点名条数。 */
+    readonly placedSessionOwnersOrphaned: number;
+    /** M23:这一次起服留着无主的存量 placed 子代行 —— 律这一读判不出,因为它读到的来源本身还是一只无主的委派子代行(根已删、父待回填)。它们只对 fleet 调用方
+     *  放行(读面律),由之后起服的本条或它的下一次停驻定下。根无主的子代(律就让它无主)不算。行数(SQL 独有;local 恒 0)。非零 ⇒ 读数行 warn(不拒启)。 */
+    readonly placedSessionOwnersRemaining: number;
+    /** M24:workflow journal 的属主 scope —— `moved` = 本次把行上的 scope 列搬进 `workflow_journal_owner`(回填 + 删跨 scope 行 + 删列);`current` = 早已是新形
+     *  (新库 / 第二跑:`workflow_journal` 上没有 scope 列);`file-store` = local 车道(core 的 File 店,属主 = 每条 run 的 journal 文件首行)。 */
+    readonly workflowJournalScopeColumn: "moved" | "current" | "file-store";
+    /** M24:本次回填的属主行数(每条还没有属主行的 run 一行)。非零 = 这次迁移真写了存量库。 */
+    readonly workflowJournalOwnersBackfilled: number;
+    /** M24:本次删掉的跨 scope 行数(scope ≠ 那条 run 属主的 journal 行 —— 旧写面放进来的别的 scope 的写)。非零 ⇒ 另一行 warn 点名条数。 */
+    readonly workflowJournalForeignScopeRowsRemoved: number;
+    /** M26:本次删掉的退役断路器表数(`circuit_breaker`;0 / 1,SQL 独有,local 恒 0)。只有计数 —— 旧形键带着 URL,一行都不读。 */
+    readonly retiredBreakerTablesDropped: number;
+    /** M27:本次从收件箱三张表(盒 / 消息 / 墓碑)删掉的、键(scope / handle)过不了收件箱键判官的行数(SQL 独有,local 恒 0)。只有计数 —— 键是主体与会话 handle,一只都不进日志。 */
+    readonly mailboxRejectedKeyRowsRemoved: number;
 }
 /** 退役的两只命令桶(引擎 7.51.0 起不是桶;只给 M17 点名认)。 */
 export type RetiredSessionRuleBucket = "commandAllow" | "commandDeny";
@@ -301,7 +378,7 @@ export interface SessionRuleRowUnreadableDeny {
     readonly retiredBuckets?: readonly RetiredSessionRuleBucket[];
 }
 /** 三个形读数(M5 列 / M9 主键 / M17 列名)—— 那一步**落定**之前收据账里缺席(读数行要它们齐;被打断的那一行只带已落定的)。 */
-type ShapeReadingKey = "sessionIncarnationColumn" | "workflowParkIndexKey" | "sessionRuleColumn";
+type ShapeReadingKey = "sessionIncarnationColumn" | "workflowParkIndexKey" | "sessionRuleColumn" | "workflowJournalScopeColumn";
 /**
  * 读数的「已记下的那些」形:形读数可缺席(那一步还没落定),其余每一键与 {@link OneTimeMigrationReport} 同名同形。读数行({@link logOneTimeMigrations})与
  * 被打断的那一行({@link logOneTimeMigrationsInterrupted})读同一只投影({@link readingFields}),拒因({@link OneTimeMigrationInterruptedError})带的也是这一形。
@@ -364,7 +441,7 @@ export declare const ONE_TIME_MIGRATIONS: readonly OneTimeMigrationWindow[];
  * 只给**窗内才生效的行为臂**用(M10 的认领、M19 / M20 的续跑重读):那种臂过了窗就停,不等删码车 —— 删码因此是零行为变化,而窗只写在本表这一处。
  */
 export declare function migrationWindowOpen(window: Pick<OneTimeMigrationWindow, "removableAfter">, today: string): boolean;
-/** local 车道上 SQL 独有的几条(M4 / M5 / M8 / M9 / M11 / M17 / M18 / M21)的读数(M6 两车道都有,local 腿的读数由 `LocalBackend.runOneTimeMigrations` 现算):那几张表 / 列在文件底座上从来不存在 ⇒ 如实答 absent / 0。 */
+/** local 车道上 SQL 独有的几条(M4 / M5 / M8 / M9 / M11 / M17 / M18 / M21 / M23 / M24 / M26 / M27)的读数(M6 两车道都有,local 腿的读数由 `LocalBackend.runOneTimeMigrations` 现算):那几张表 / 列在文件底座上从来不存在 ⇒ 如实答 absent / 0。 */
 export declare const NO_SQL_MIGRATIONS: Omit<OneTimeMigrationReport, "holderDeathCodeRowsBackfilled">;
 /** 启动期的日志口(logger 的子集)。两级各有其用,见 {@link logOneTimeMigrations}。 */
 export interface MigrationLogSink {
@@ -392,13 +469,30 @@ export interface MigrationDb {
  * 每条改表 DDL 的成功判据仍是它的**后置条件**({@link execUntil}),「另一个副本抢先把同一张表换了形」不会把滚动升级变成启动失败循环。
  *
  * ## 次序(codex r1 [medium] 同轮)
- * 非破坏改写(M4–M9、M18:改值不丢信息 / 加法 DDL / 复制 + 换名)在前,破坏性步骤(M11 的删行)排在最后;
- * M11 自己半途失败时,拒因自带已删的行(`purgeUndurableScopeRows`)—— 否则重试看不见已删的行,证据永久消失。
+ * 非破坏改写(M4–M9、M18:改值不丢信息 / 加法 DDL / 复制 + 换名)在前,破坏性步骤(M11 的删行、M24 丢下跨 scope 行的换名)排在最后;
+ * M11 自己半途失败时,拒因自带已删的行(`purgeUndurableScopeRows`)—— 否则重试看不见已删的行,证据永久消失;M24 的丢行计数在换名提交之后进收据账。
  *
  * 本函数**不问**退役 schema:带着它的库在更早处就被 `ensureSchema()` 自身拒掉了(起服对账一族 `schema-consistency.ts` 的探针口,先于建表);走公开序列
  * `createStoreBackend()` → `ensureSchema()` → `runOneTimeMigrations()` 的嵌入方与本服务的起服序列一样,有这一问、零动作。
  */
 export declare function runSqlOneTimeMigrations(dialect: "tidb" | "pg", pool: MysqlPool | PgPool): Promise<OneTimeMigrationReport>;
+/**
+ * M24(7.133.0)—— workflow journal 的属主 scope 从逐行列搬进 `workflow_journal_owner` 一行,journal 行改按 `(run_id, incarnation, ordinal)` 记。规则与理由在
+ * 头注 M24 段;这里只写各步为什么这样写。
+ *
+ *  **判据 = 正表上 scope 列在不在**(旧形的标志;新形里没有这一列)。不在 ⇒ 新形:只补收尾(上一次在 TiDB 换名之后、删旧表之前被打断留下的待删旧表),读数 `current`。
+ *  在 ⇒ 旧形,**正表在换名之前一个字节不动**:
+ *  ① 残留的暂存表(上一次换名之前被打断)删掉重来 —— 它只是正表的一份不完整拷贝。
+ *  ② **回填属主**(`INSERT … SELECT`,两方言同一句):每条 run 取**最小序数**那一行 —— 旧主键 `(run_id, ordinal)` 保证每条 run 恰一行,于是一条语句里不会对同一个
+ *     run_id 插两次;`appended_at_ms` 取该 run 最晚的 `created_at_ms`(属主记录的 GC 时钟因此不早于它的任何一行)。`NOT EXISTS`:续跑只补缺的,已在的属主记录一个字节不改。
+ *  ③ 数跨 scope 行(scope ≠ 属主):它们不搬 —— 新形里一条 run 只有一个 scope;它们只可能是旧写面放进来的别的 scope 的写(读它们的只有写它们的那个 scope 的
+ *     resume,丢掉 = 那几步退化为活跑)。计数在换名提交之后才进收据账(那一刻它们才真的随旧表消失)。
+ *  ④ 照**中央 DDL 的同一条语句**换表名建暂存表(不手抄第二份),按旧主键键集分批 `INSERT … SELECT` 搬与属主同 scope 的行、带属主记录的令牌(新主键下不会撞键:旧主键唯一 ×
+ *     每条 run 一只属主;每批字节有界、各自提交 —— 整表一条语句会撞 TiDB 的事务总量上限,见 {@link M24_COPY_BATCH_BYTES})。
+ *  ⑤ **原子换名**:TiDB 一条 `RENAME TABLE 正 TO 待删, 暂存 TO 正`,之后删待删旧表;PG 两条换名、删旧表与主键约束名改回常规名在**同一个事务**里({@link execAtomically})
+ *     —— 中途死 = 整段回滚,盘上回到「正表旧形 + 暂存表」,下一次起动从 ① 重来。每一条 DDL 按后置条件收敛({@link execUntil} / {@link execAtomically})。
+ */
+export declare function moveWorkflowJournalScope(db: MigrationDb, dialect: "tidb" | "pg", receipts: MigrationReceipts): Promise<void>;
 /**
  * M17 —— 一份存量规则体带哪几只退役命令桶(纯函数,点名判据):只认**对象上自有**的 `commandAllow` / `commandDeny` 键(不论值形 —— 坏形的退役桶照样是退役桶);
  * 不是对象 / 没有这两个键 / 条目文字里出现同名字样 ⇒ 空。不改写:新文法写不出旧命令桶的拒(头注 M17 段 ③)。
@@ -493,6 +587,17 @@ export declare function parkedRowRepairOf(gateKindCell: unknown, gate: unknown,
  * 每一次提交当场记进收据账。
  */
 export declare function repairParkedRows(db: MigrationDb, dialect: "tidb" | "pg", receipts: MigrationReceipts): Promise<void>;
+/**
+ * M23 —— 存量 placed 子代行的属主回填,**每次起服单趟、幂等**(规则、为什么、够不到的一格见头注 M23 段):键集分页扫完 placed ∧ 属主 NULL 的行,每一行按唯一判据判
+ * (`judgeDelegatedOwner`,建行那一笔与停驻挂点同一只:来源顺序根、父;属主 = 这一读见证到的):
+ *  · 判出属主 ⇒ {@link CLAIM_OWNERLESS_PLACED_SQL}(只 CAS 子行自己,绑扫描读到的化身;与停驻挂点的认领**同一句、同一份绑参**;第二跑零命中);写成的按属主计进
+ *    `placedSessionOwnersOrphaned`(谁都不匹配:孤行哨兵,或继承自孤行祖先的同一只哨兵)或 `placedSessionOwnersInherited`,每一次提交当场记进收据账;零命中(这一行在扫描之后
+ *    被写过 / 删过 / 换了住客)⇒ 不计,下一次起服按那时的律重判;
+ *  · 判出无主:读到的来源本身是一只 placed 行(还没定下的委派子代行)⇒ 计进 `placedSessionOwnersRemaining`(残余);来源是普通会话(根无主)⇒ 律就让它无主,不计;
+ *  · 扫到的任何一行化身为空 ⇒ 响亮拒(不论判不判得出属主;来源行同一条律)。
+ * 不重扫、不拒启:残余由下一次起服或那一行的下一次停驻定下,期间只对 fleet 调用方放行(头注 M23 段)。
+ */
+export declare function inheritPlacedSessionOwners(db: MigrationDb, dialect: "tidb" | "pg", receipts: MigrationReceipts): Promise<void>;
 /**
  * 启动日志的读数行。零命中(第二跑起的常态)也照发 —— 「跑过了、什么都没改」与「压根没跑」必须可分辨。
  *

package/dist/plugins/one-time-migrations.js

@@ -6,13 +6,15 @@ import { PG_SCHEMA_STATEMENTS, acquirePgEnsureSchemaLock, releasePgEnsureSchemaL
 import { CENTRAL_SCHEMA_INDEXES } from "./schema-indexes.js";
 import { ensureIndexes } from "./ensure-index.js";
 import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readNonNullJsonValueColumn, readOpaqueJsonValueColumn, } from "./sql-json-column.js";
-import { SESSION_META_INCARNATION_COLUMN, mintSessionIncarnation } from "../session-incarnation.js";
+import { SESSION_META_INCARNATION_COLUMN, incarnationFromCell, mintSessionIncarnation, sessionFaceFromRow } from "../session-incarnation.js";
 import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR } from "./store-contracts.js";
 import { PERMISSION_RULE_TABLE, purgeUndurableScopeRows } from "./permission-rule-store-sql.js";
 import { SESSION_RULES_COLUMN } from "./session-rules-column.js";
 import { readJsonObjectColumn } from "./sql-json-column.js";
 import { retireStoredCardWords } from "../retired-card-words.js";
 import { redactSecrets } from "../trace/redact.js";
+import { CLAIM_OWNERLESS_PLACED_SQL, claimOwnerlessParams, isOrphanSessionOwner, judgeDelegatedOwner } from "../delegated-session-owner.js";
+import { MAILBOX_KEYED_TABLES, mailboxKeyDeleteSql, storedMailboxKeyless } from "./mailbox-store-sql.js";
 const RETIRED_SESSION_RULE_BUCKETS = ["commandAllow", "commandDeny"];
 export function buildMigrationReceipts() {
     return {
@@ -34,14 +36,21 @@ export function buildMigrationReceipts() {
         parkedQuestionRowsLeftAsWritten: 0,
         parkedRowGateKindsBackfilled: 0,
         parkedRowsUnresumableExpired: 0,
+        placedSessionOwnersInherited: 0,
+        placedSessionOwnersOrphaned: 0,
+        placedSessionOwnersRemaining: 0,
+        workflowJournalOwnersBackfilled: 0,
+        workflowJournalForeignScopeRowsRemoved: 0,
+        retiredBreakerTablesDropped: 0,
+        mailboxRejectedKeyRowsRemoved: 0,
     };
 }
 function completedReport(r) {
-    const { sessionIncarnationColumn, workflowParkIndexKey, sessionRuleColumn } = r;
-    if (sessionIncarnationColumn === undefined || workflowParkIndexKey === undefined || sessionRuleColumn === undefined) {
-        throw new Error(`one-time migrations finished without settling a shape reading (M5 ${String(sessionIncarnationColumn)} / M9 ${String(workflowParkIndexKey)} / M17 ${String(sessionRuleColumn)}) — a step did not record it`);
+    const { sessionIncarnationColumn, workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn } = r;
+    if (sessionIncarnationColumn === undefined || workflowParkIndexKey === undefined || sessionRuleColumn === undefined || workflowJournalScopeColumn === undefined) {
+        throw new Error(`one-time migrations finished without settling a shape reading (M5 ${String(sessionIncarnationColumn)} / M9 ${String(workflowParkIndexKey)} / M17 ${String(sessionRuleColumn)} / M24 ${String(workflowJournalScopeColumn)}) — a step did not record it`);
     }
-    return { ...r, sessionIncarnationColumn, workflowParkIndexKey, sessionRuleColumn };
+    return { ...r, sessionIncarnationColumn, workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn };
 }
 function changedAnything(r) {
     return (r.auditDetailJsonNullRows > 0 ||
@@ -64,7 +73,15 @@ function changedAnything(r) {
         r.parkedQuestionCardsWritten > 0 ||
         r.parkedQuestionRowsLeftAsWritten > 0 ||
         r.parkedRowGateKindsBackfilled > 0 ||
-        r.parkedRowsUnresumableExpired > 0);
+        r.parkedRowsUnresumableExpired > 0 ||
+        r.placedSessionOwnersInherited > 0 ||
+        r.placedSessionOwnersOrphaned > 0 ||
+        r.placedSessionOwnersRemaining > 0 ||
+        r.workflowJournalScopeColumn === "moved" ||
+        r.workflowJournalOwnersBackfilled > 0 ||
+        r.workflowJournalForeignScopeRowsRemoved > 0 ||
+        r.retiredBreakerTablesDropped > 0 ||
+        r.mailboxRejectedKeyRowsRemoved > 0);
 }
 function readingsSnapshot(r) {
     return {
@@ -364,6 +381,75 @@ export const ONE_TIME_MIGRATIONS = [
             "与回滚到 7.131.x 读 5 同一种处置",
         reportKeys: [],
     },
+    {
+        id: "M23",
+        introducedIn: "7.133.0",
+        releasedOn: "2026-10-21",
+        removableAfter: "2026-11-20",
+        removal: "删 migrateOn 的 M23 步(`inheritPlacedSessionOwners`:placed ∧ 属主 NULL 的行按 session_id 键集分页单趟扫描 + 同一条语句连读根 / 父两行 + 按认领句回写属主)与 `PLACED_OWNER_SCAN_PAGE` / `placedOwnerScanSql` / `scannedPlacement` / `scannedFaces` / `scannedPlacedSources`(`isOrphanSessionOwner` 若再无别的读者一并删);" +
+            "**同窗同删的另一半**(认领:按律给升级前写下的无主子代行写属主 —— 停驻挂点对宿主无主行做的就是本条对那一行的单行步):`delegated-session-owner.ts` 的 `CLAIM_OWNERLESS_PLACED_SQL` / `claimOwnerlessParams` / `OwnerlessClaim` / " +
+            "`settleDelegatedOwner` 的认领一步(删后它只剩树比对与属主比对)/ `DelegationTreeStore.claimOwnerless`," +
+            "两只 SQL 店(`tidb-session-store.ts` / `pg-session-storage.ts`)的 `claimOwnerless`、`CachingSessionStore` 的转发、`OwnerAwareSessionStore.claimOwnerless`、`delegatedOwnerHostOf` 对它的「与 `placementOf` 同在或同缺」;" +
+            "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `placedSessionOwnersInherited` / `placedSessionOwnersOrphaned` / `placedSessionOwnersRemaining` 与 `placed_session_owners_orphaned` 那一行 warn;" +
+            "`test/one-time-migrations.test.ts` 的 M23 组与 `test/one-time-migrations-db-integration.test.ts` 的 M23 格。" +
+            "**不随本条删**:属主为 NULL 的 placed 行只对 fleet 调用方放行(`security.ts` 的 `ownerlessRowOpen` / `sessionOwnerCellOf` 与各门读 `placementOf` 的那一次)—— 那是常设的读面律",
+        afterRemoval: "会话面的读面律(常设,不随本条删)接住:跳过了带本条的版本直接升的库里,属主为 NULL 的存量 placed 子代行只对 fleet 调用方放行(出示 service 凭据、不报主体;dev-open)," +
+            "其余调用方答 404(与别人的行同体)—— 出路是升级时先过一次带本条的版本,或运维按 `placement_root_session_id`(缺则 `placement_parent_session_id`)那一行的属主手工回填、" +
+            "推不出的写一个任何主体都不匹配的值;停驻挂点读到无主的宿主子代行 ⇒ 回到比对的既有臂:无主 ≠ 律给的属主 ⇒ 停驻否决(fail-closed,响亮;出路同上);" +
+            "建行那一笔的继承律不随本条删(那是常设的写法,不是迁移)",
+        reportKeys: ["placedSessionOwnersInherited", "placedSessionOwnersOrphaned", "placedSessionOwnersRemaining"],
+    },
+    {
+        id: "M24",
+        introducedIn: "7.133.0",
+        releasedOn: "2026-10-21",
+        removableAfter: "2026-11-20",
+        removal: "删 migrateOn 的 M24 步(`moveWorkflowJournalScope`:scope 列在场探针 + 删残留暂存表 / 待删旧表 + 回填属主记录 + 数跨 scope 行 + 照中央 DDL 建暂存表 + 整表复制 + 原子换名 + 删旧表 + PG 主键约束名)与 " +
+            "`copyJournalInBatches` / `journalKeyBound` / `WORKFLOW_JOURNAL_TABLE` / `WORKFLOW_JOURNAL_OWNER_TABLE` / `WORKFLOW_JOURNAL_STAGING` / `WORKFLOW_JOURNAL_RETIRED` / `RETIRED_JOURNAL_SCOPE_COLUMN` / " +
+            "`M24_OWNER_INCARNATION` / `M24_COPY_BATCH_BYTES` / `M24_COPY_SCAN_PAGE`;" +
+            "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `workflowJournalScopeColumn` / `workflowJournalOwnersBackfilled` / `workflowJournalForeignScopeRowsRemoved` 与 `workflow_journal_foreign_scope_rows_removed` 那一行 warn;" +
+            "`test/one-time-migrations.test.ts` 的 M24 组与 `test/one-time-migrations-db-integration.test.ts` 的 M24 格。**不随本条删**:属主表、行主键里的令牌与店的写面 / 读面墙(那是常设的数据形)",
+        afterRemoval: "起服对账一族的列集探针接住(`schema-consistency.ts` 的 `assertSchemaMatchesCode`,常设):跳过了带本条的版本直接升的库,`workflow_journal` 上仍带 scope 列、没有 incarnation 列 = 库与代码列集不符 ⇒ " +
+            "响亮拒启(`config.schema_mismatch`),拒句点名两列;出路是先在带本条的版本(7.133.x)起服一次让它走完,再升",
+        reportKeys: ["workflowJournalScopeColumn", "workflowJournalOwnersBackfilled", "workflowJournalForeignScopeRowsRemoved"],
+    },
+    {
+        id: "M25",
+        introducedIn: "7.133.0",
+        releasedOn: "2026-10-21",
+        removableAfter: "2026-11-20",
+        removal: "删 `project-identity.ts` 的 `mintRepoScopeKey`(与它的窗注;`RETIRED_PROJECT_KEY_PREFIX` 留给 `isServerMintedProjectKey` 的起服拒)与 `projectLayerForTaskRoot` 的 `foldFrom` 里它那一员" +
+            "(`p` 档那一员留 —— 常设律);`memory-sync-client.ts` 的 `legacyMemorySyncCursorPath` / `adoptLegacyCursor` 与 runner 里调它的那一段(`legacyCursorChecked`);" +
+            "`test/memory-project-layer-fold.test.ts` 的 ① 格与 `test/memory-project-layer-fold-db-integration.test.ts` 整份、`test/memory-sync-client.test.ts` 的旧游标收编格、" +
+            "`test/project-identity.test.ts` 的 `repo:` 金样格(公式金样改钉 `p` 档摘要)",
+        afterRemoval: "没有新的臂(如实):窗内一次都没跑过任务的项目,它的 `repo:` 层留在库里、不再被任何读列表包含(不读、不删;起服拒只管运维点名这一族);出路 = 升级时先过一次带本条的版本并在每个项目跑一次任务。" +
+            "同步腿的旧游标文件不再收编:同步层从空基线首轮重收敛(两边都改过的条目按冲突上报,不静默丢)",
+        reportKeys: [],
+    },
+    {
+        id: "M26",
+        introducedIn: "7.133.0",
+        releasedOn: "2026-10-21",
+        removableAfter: "2026-11-20",
+        removal: "删 migrateOn 的 M26 步(`dropRetiredBreakerTable`)与 `RETIRED_BREAKER_TABLE`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 `retiredBreakerTablesDropped`;" +
+            "`test/one-time-migrations.test.ts` 的 S-491 组与 `test/one-time-migrations-db-integration.test.ts` 的 M26 格。" +
+            "**不随本条删**:键的铸点 `breakerKeyOf` / `routeDigestOf`(常设的键形)与新表 `breaker_state`",
+        afterRemoval: "没有新的臂(如实):跳过了带本条的版本直接升的库,退役表 `circuit_breaker` 留在库里、没有读者也没有写者(断路器只读写 `breaker_state`)—— " +
+            "出路 = 升级时先过一次带本条的版本,或手工 `DROP TABLE circuit_breaker`(建议性状态,删表安全)",
+        reportKeys: ["retiredBreakerTablesDropped"],
+    },
+    {
+        id: "M27",
+        introducedIn: "7.133.0",
+        releasedOn: "2026-10-21",
+        removableAfter: "2026-11-20",
+        removal: "删 migrateOn 的 M27 步(`dropRejectedMailboxKeys`)与 `MAILBOX_KEY_SCAN_PAGE`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 `mailboxRejectedKeyRowsRemoved`;" +
+            "`test/one-time-migrations.test.ts` 的 M27 组。**不随本条删**:判官 `mailboxKeyProblem`、存储键读回判 `storedMailboxKeyless`(常设 `reap` 读候选句柄也经它)与「判官拒的键没有箱」那条入口律(含 `reap` 跳过候选扫描交回的被拒句柄)、" +
+            "`MAILBOX_KEYED_TABLES` / `mailboxKeyDeleteSql`(`drop` 的常设语句)",
+        afterRemoval: "没有新的臂(如实):跳过了带本条的版本直接升的库,判官拒的键的行留在库里,任何入口对它都按「箱不在」答(不读、不投、不清)—— 出路 = 升级时先过一次带本条的版本," +
+            "或照 `docs/DEPLOY-PREREQS.md` 7.133.0 SQL 节的查法按键手工删",
+        reportKeys: ["mailboxRejectedKeyRowsRemoved"],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;
@@ -389,6 +475,14 @@ export const NO_SQL_MIGRATIONS = {
     parkedQuestionRowsLeftAsWritten: 0,
     parkedRowGateKindsBackfilled: 0,
     parkedRowsUnresumableExpired: 0,
+    placedSessionOwnersInherited: 0,
+    placedSessionOwnersOrphaned: 0,
+    placedSessionOwnersRemaining: 0,
+    workflowJournalScopeColumn: "file-store",
+    workflowJournalOwnersBackfilled: 0,
+    workflowJournalForeignScopeRowsRemoved: 0,
+    retiredBreakerTablesDropped: 0,
+    mailboxRejectedKeyRowsRemoved: 0,
 };
 const AUDIT_TABLE = "device_audit";
 const AUDIT_DETAIL_COLUMN = "detail";
@@ -493,8 +587,125 @@ async function migrateStepsOn(db, dialect, receipts) {
     await reshapeWorkflowParkIndex(db, dialect, receipts);
     await migrateSessionRuleGrammar(db, dialect, receipts);
     await repairParkedRows(db, dialect, receipts);
+    if (await tableExists(db, dialect, "session_meta"))
+        await inheritPlacedSessionOwners(db, dialect, receipts);
     if (await tableExists(db, dialect, PERMISSION_RULE_TABLE))
         await purgeUndurableScopeRows(db, dialect, receipts);
+    await moveWorkflowJournalScope(db, dialect, receipts);
+    if (await tableExists(db, dialect, RETIRED_BREAKER_TABLE))
+        await dropRetiredBreakerTable(db, dialect, receipts);
+    await dropRejectedMailboxKeys(db, dialect, receipts);
+}
+const MAILBOX_KEY_SCAN_PAGE = 1000;
+async function dropRejectedMailboxKeys(db, dialect, receipts) {
+    const present = [];
+    for (const table of MAILBOX_KEYED_TABLES)
+        if (await tableExists(db, dialect, table))
+            present.push(table);
+    const p = (i) => (dialect === "tidb" ? "?" : `$${i}`);
+    for (const table of present) {
+        let after;
+        for (;;) {
+            const page = await db.rows(`SELECT DISTINCT scope_key, handle FROM ${table}` +
+                (after === undefined ? "" : ` WHERE scope_key > ${p(1)} OR (scope_key = ${p(2)} AND handle > ${p(3)})`) +
+                ` ORDER BY scope_key, handle LIMIT ${MAILBOX_KEY_SCAN_PAGE}`, after === undefined ? undefined : [after[0], after[0], after[1]]);
+            for (const row of page) {
+                if (!storedMailboxKeyless(row.scope_key, row.handle))
+                    continue;
+                for (const t of present)
+                    receipts.mailboxRejectedKeyRowsRemoved += await db.exec(mailboxKeyDeleteSql(dialect, t), [row.scope_key, row.handle]);
+            }
+            if (page.length < MAILBOX_KEY_SCAN_PAGE)
+                break;
+            const last = page[page.length - 1];
+            after = [last.scope_key, last.handle];
+        }
+    }
+}
+const RETIRED_BREAKER_TABLE = "circuit_breaker";
+async function dropRetiredBreakerTable(db, dialect, receipts) {
+    await execUntil(db, `DROP TABLE IF EXISTS ${RETIRED_BREAKER_TABLE}`, async () => !(await tableExists(db, dialect, RETIRED_BREAKER_TABLE)));
+    receipts.retiredBreakerTablesDropped += 1;
+}
+const WORKFLOW_JOURNAL_TABLE = "workflow_journal";
+const WORKFLOW_JOURNAL_OWNER_TABLE = "workflow_journal_owner";
+const WORKFLOW_JOURNAL_STAGING = `${WORKFLOW_JOURNAL_TABLE}_m24`;
+const WORKFLOW_JOURNAL_RETIRED = `${WORKFLOW_JOURNAL_TABLE}_m24_old`;
+const RETIRED_JOURNAL_SCOPE_COLUMN = "scope";
+const M24_OWNER_INCARNATION = "m24-backfill";
+const M24_COPY_BATCH_BYTES = 32 * 1024 * 1024;
+const M24_COPY_SCAN_PAGE = 1000;
+function journalKeyBound(dialect, op, first) {
+    const p = (i) => (dialect === "tidb" ? "?" : `$${first + i}`);
+    return op === "after"
+        ? `(${WORKFLOW_JOURNAL_TABLE}.run_id > ${p(0)} OR (${WORKFLOW_JOURNAL_TABLE}.run_id = ${p(1)} AND ordinal > ${p(2)}))`
+        : `(${WORKFLOW_JOURNAL_TABLE}.run_id < ${p(0)} OR (${WORKFLOW_JOURNAL_TABLE}.run_id = ${p(1)} AND ordinal <= ${p(2)}))`;
+}
+async function copyJournalInBatches(db, dialect) {
+    const T = WORKFLOW_JOURNAL_TABLE;
+    const bytes = dialect === "tidb" ? "LENGTH(result)" : "OCTET_LENGTH(result)";
+    const copyHead = `INSERT INTO ${WORKFLOW_JOURNAL_STAGING} (run_id, incarnation, ordinal, call_key, result, created_at_ms) ` +
+        `SELECT ${T}.run_id, o.incarnation, ordinal, call_key, ${jsonColumnText(dialect, "result")}, created_at_ms FROM ${T} ` +
+        `JOIN ${WORKFLOW_JOURNAL_OWNER_TABLE} o ON o.run_id = ${T}.run_id AND o.scope = ${T}.${RETIRED_JOURNAL_SCOPE_COLUMN} WHERE `;
+    let after;
+    for (;;) {
+        const page = await db.rows(`SELECT ${T}.run_id, ordinal, ${bytes} AS n FROM ${T}` + (after === undefined ? "" : ` WHERE ${journalKeyBound(dialect, "after", 1)}`) + ` ORDER BY run_id, ordinal LIMIT ${M24_COPY_SCAN_PAGE}`, after === undefined ? [] : [after[0], after[0], after[1]]);
+        if (page.length === 0)
+            return;
+        let end = 0;
+        let total = 0;
+        while (end < page.length) {
+            const n = Number(page[end].n);
+            if (end > 0 && total + n > M24_COPY_BATCH_BYTES)
+                break;
+            total += n;
+            end += 1;
+        }
+        const last = page[end - 1];
+        const upTo = [String(last.run_id), Number(last.ordinal)];
+        if (after === undefined)
+            await db.exec(copyHead + journalKeyBound(dialect, "upTo", 1), [upTo[0], upTo[0], upTo[1]]);
+        else
+            await db.exec(`${copyHead}${journalKeyBound(dialect, "after", 1)} AND ${journalKeyBound(dialect, "upTo", 4)}`, [after[0], after[0], after[1], upTo[0], upTo[0], upTo[1]]);
+        after = upTo;
+    }
+}
+export async function moveWorkflowJournalScope(db, dialect, receipts) {
+    const T = WORKFLOW_JOURNAL_TABLE;
+    const S = WORKFLOW_JOURNAL_STAGING;
+    const O = WORKFLOW_JOURNAL_RETIRED;
+    const exists = (t) => tableExists(db, dialect, t);
+    const legacy = () => columnExists(db, dialect, T, RETIRED_JOURNAL_SCOPE_COLUMN);
+    if (!(await legacy())) {
+        if (await exists(O))
+            await execUntil(db, `DROP TABLE ${O}`, async () => !(await exists(O)));
+        receipts.workflowJournalScopeColumn = "current";
+        return;
+    }
+    const ddl = (dialect === "tidb" ? SCHEMA_STATEMENTS : PG_SCHEMA_STATEMENTS).find((stmt) => stmt.includes(`CREATE TABLE IF NOT EXISTS ${T} (`));
+    if (ddl === undefined)
+        throw new Error(`one-time migration M24: the central schema carries no definition of ${T} — refusing to rebuild a table it cannot define`);
+    if (await exists(S))
+        await execUntil(db, `DROP TABLE ${S}`, async () => !(await exists(S)));
+    receipts.workflowJournalOwnersBackfilled += await db.exec(`INSERT INTO ${WORKFLOW_JOURNAL_OWNER_TABLE} (run_id, scope, incarnation, appended_at_ms) ` +
+        `SELECT j.run_id, j.${RETIRED_JOURNAL_SCOPE_COLUMN}, '${M24_OWNER_INCARNATION}', m.last_ms FROM ${T} j ` +
+        `JOIN (SELECT run_id, MIN(ordinal) AS first_ordinal, MAX(created_at_ms) AS last_ms FROM ${T} GROUP BY run_id) m ` +
+        `ON m.run_id = j.run_id AND m.first_ordinal = j.ordinal ` +
+        `WHERE NOT EXISTS (SELECT 1 FROM ${WORKFLOW_JOURNAL_OWNER_TABLE} o WHERE o.run_id = j.run_id)`);
+    const foreign = Number((await db.rows(`SELECT COUNT(*) AS n FROM ${T} j JOIN ${WORKFLOW_JOURNAL_OWNER_TABLE} o ON o.run_id = j.run_id WHERE j.${RETIRED_JOURNAL_SCOPE_COLUMN} <> o.scope`))[0]?.n ?? 0);
+    await db.exec(ddl.replace(`CREATE TABLE IF NOT EXISTS ${T} (`, `CREATE TABLE IF NOT EXISTS ${S} (`));
+    await copyJournalInBatches(db, dialect);
+    const swapped = async () => !(await exists(S)) && (await exists(T)) && !(await legacy());
+    if (dialect === "tidb") {
+        await execUntil(db, `RENAME TABLE ${T} TO ${O}, ${S} TO ${T}`, swapped);
+        receipts.workflowJournalForeignScopeRowsRemoved += foreign;
+        await execUntil(db, `DROP TABLE IF EXISTS ${O}`, async () => !(await exists(O)));
+    }
+    else {
+        await execAtomically(db, [`ALTER TABLE ${T} RENAME TO ${O}`, `ALTER TABLE ${S} RENAME TO ${T}`, `DROP TABLE ${O}`, `ALTER TABLE ${T} RENAME CONSTRAINT ${S}_pkey TO ${T}_pkey`], async () => (await swapped()) && !(await exists(O)));
+        receipts.workflowJournalForeignScopeRowsRemoved += foreign;
+    }
+    receipts.workflowJournalScopeColumn = "moved";
 }
 const SESSION_POLICY_TABLE = "session_policy";
 const RETIRED_SESSION_RULES_COLUMN = "rules";
@@ -867,6 +1078,66 @@ export async function repairParkedRows(db, dialect, receipts) {
             return;
     }
 }
+const PLACED_OWNER_SCAN_PAGE = 500;
+function placedOwnerScanSql(dialect) {
+    return ("SELECT c.session_id, c.incarnation, r.session_id AS root_row, r.owner AS root_owner, r.incarnation AS root_incarnation, r.placement_kind AS root_kind, " +
+        "p.session_id AS parent_row, p.owner AS parent_owner, p.incarnation AS parent_incarnation, p.placement_kind AS parent_kind, " +
+        "c.placement_root_session_id AS root_id, c.placement_parent_session_id AS parent_id " +
+        "FROM session_meta c LEFT JOIN session_meta r ON r.session_id = NULLIF(c.placement_root_session_id, '') LEFT JOIN session_meta p ON p.session_id = NULLIF(c.placement_parent_session_id, '') " +
+        `WHERE c.placement_kind IS NOT NULL AND c.owner IS NULL AND c.session_id > ${dialect === "tidb" ? "?" : "$1"} ORDER BY c.session_id LIMIT ${PLACED_OWNER_SCAN_PAGE}`);
+}
+function scannedPlacement(r) {
+    return {
+        ...(typeof r.root_id === "string" ? { rootSessionId: r.root_id } : {}),
+        ...(typeof r.parent_id === "string" ? { parentSessionId: r.parent_id } : {}),
+    };
+}
+function scannedFaces(r) {
+    const faces = new Map();
+    const put = (id, row, owner, incarnation) => {
+        if (typeof id !== "string" || row === null || row === undefined)
+            return;
+        faces.set(id, sessionFaceFromRow(id, typeof owner === "string" ? owner : null, incarnation));
+    };
+    put(r.root_id, r.root_row, r.root_owner, r.root_incarnation);
+    put(r.parent_id, r.parent_row, r.parent_owner, r.parent_incarnation);
+    return faces;
+}
+function scannedPlacedSources(r) {
+    const placed = new Set();
+    if (typeof r.root_id === "string" && r.root_row !== null && r.root_row !== undefined && r.root_kind !== null && r.root_kind !== undefined)
+        placed.add(r.root_id);
+    if (typeof r.parent_id === "string" && r.parent_row !== null && r.parent_row !== undefined && r.parent_kind !== null && r.parent_kind !== undefined)
+        placed.add(r.parent_id);
+    return placed;
+}
+export async function inheritPlacedSessionOwners(db, dialect, receipts) {
+    const scan = placedOwnerScanSql(dialect);
+    const cas = CLAIM_OWNERLESS_PLACED_SQL[dialect];
+    let after = "";
+    for (;;) {
+        const page = await db.rows(scan, [after]);
+        for (const r of page) {
+            const sessionId = String(r.session_id);
+            after = sessionId;
+            const incarnation = incarnationFromCell(sessionId, r.incarnation);
+            const judged = judgeDelegatedOwner(sessionId, scannedPlacement(r), scannedFaces(r));
+            const owner = judged.inherited.owner;
+            if (owner === null) {
+                if (judged.inherited.kind === "inherited" && scannedPlacedSources(r).has(judged.inherited.from))
+                    receipts.placedSessionOwnersRemaining += 1;
+                continue;
+            }
+            const landed = await db.exec(cas, [...claimOwnerlessParams(sessionId, incarnation, owner)]);
+            if (isOrphanSessionOwner(owner))
+                receipts.placedSessionOwnersOrphaned += landed;
+            else
+                receipts.placedSessionOwnersInherited += landed;
+        }
+        if (page.length < PLACED_OWNER_SCAN_PAGE)
+            return;
+    }
+}
 const INCARNATION_BACKFILL_BATCH = 500;
 async function migrateSessionIncarnations(db, dialect, receipts) {
     if (!(await tableExists(db, dialect, "session_meta"))) {
@@ -948,6 +1219,14 @@ function readingFields(r) {
         parkedQuestionRowsLeftAsWritten: r.parkedQuestionRowsLeftAsWritten,
         parkedRowGateKindsBackfilled: r.parkedRowGateKindsBackfilled,
         parkedRowsUnresumableExpired: r.parkedRowsUnresumableExpired,
+        placedSessionOwnersInherited: r.placedSessionOwnersInherited,
+        placedSessionOwnersOrphaned: r.placedSessionOwnersOrphaned,
+        placedSessionOwnersRemaining: r.placedSessionOwnersRemaining,
+        ...(r.workflowJournalScopeColumn !== undefined ? { workflowJournalScopeColumn: r.workflowJournalScopeColumn } : {}),
+        workflowJournalOwnersBackfilled: r.workflowJournalOwnersBackfilled,
+        workflowJournalForeignScopeRowsRemoved: r.workflowJournalForeignScopeRowsRemoved,
+        retiredBreakerTablesDropped: r.retiredBreakerTablesDropped,
+        mailboxRejectedKeyRowsRemoved: r.mailboxRejectedKeyRowsRemoved,
     };
 }
 export function logOneTimeMigrations(log, backend, report) {
@@ -979,7 +1258,19 @@ export function logOneTimeMigrations(log, backend, report) {
             "the cards this step cannot reach are read the same way, counted under server.approval-card.retired-card-word-read; M21: suspended rows parked by an engine " +
             "before the question card existed and still pending — a question approval whose gate carries no card — get the card word question (rows the engine sealed " +
             "with its row digest are left as written and counted), and suspended rows with no gate kind on the row get it from the gate (a row whose gate names no " +
-            "registered kind cannot be resumed and is expired)). Each step " +
+            "registered kind cannot be resumed and is expired); M23: delegated (placed) session rows written ownerless by an earlier version get the owner of their " +
+            "delegation tree as this boot reads it — the root session's owner, or the parent's when the root row is gone; a row under an ownerless root stays ownerless; a row whose root and parent " +
+            "are both gone gets an owner no caller can match and the rows below it inherit that owner, all counted and named by a placed_session_owners_orphaned line; " +
+            "placedSessionOwnersRemaining counts the rows this boot could not settle because the session they inherit from was itself still ownerless — until a later boot or " +
+            "their next park settles them, only fleet callers can read them; M24: the scope that owns a workflow run's resume journal moved from a column on every journal row " +
+            "into one row per run in workflow_journal_owner — each run got the scope of its lowest-ordinal row, and the journal table was rebuilt (copy + atomic rename) " +
+            "keyed by (run, owner-record incarnation, ordinal) without the scope column; rows another scope had written into the run were not carried " +
+            "(counted, one workflow_journal_foreign_scope_rows_removed line); M26: the retired shared circuit-breaker table circuit_breaker dropped — its keys " +
+            "carried a route's base URL, which could carry a credential from the URL's query, and the whole table is dropped rather than judged row by row; " +
+            "the breakers live in the new table breaker_state, which this step never touches; only the count is logged, never a key; M27: rows of the three " +
+            "mailbox tables (mailbox / mailbox_message / mailbox_tombstone) whose key — scope or handle — the mailbox key judge refuses (control characters, " +
+            "malformed Unicode, wider than 190 UTF-8 bytes, empty scope) removed, a whole box at a time: no entry point reaches such a key any more, so neither " +
+            "delivery, reading nor session deletion would ever have touched them again; only the count is logged, never a key). Each step " +
             "runs on every boot until its window closes (the release that introduced it + 30 days; the per-step date is in " +
             "removableAfter, null while that release is not published yet) and is deleted in the first minor after that — start a " +
             "version that still carries a step at least once before upgrading past its deletion.",
@@ -987,6 +1278,27 @@ export function logOneTimeMigrations(log, backend, report) {
     logReceiptRows(log, backend, report);
 }
 function logReceiptRows(log, backend, r) {
+    if (r.workflowJournalForeignScopeRowsRemoved > 0) {
+        log.warn("workflow_journal_foreign_scope_rows_removed", {
+            backend,
+            rows: r.workflowJournalForeignScopeRowsRemoved,
+            note: "workflow journal rows whose scope differed from the scope that owns their run were removed while the run's owning scope moved into workflow_journal_owner. " +
+                "Earlier versions accepted an append from another scope into a run (a new step was inserted, an existing step overwritten under the owner's scope); the current " +
+                "schema keeps one scope per run, so such rows have nowhere to live. Only the scope that wrote them could read them, and only to replay those steps when resuming " +
+                "that run — such a resume now runs those steps live. No action needed",
+        });
+    }
+    if (r.placedSessionOwnersOrphaned > 0) {
+        log.warn("placed_session_owners_orphaned", {
+            backend,
+            rows: r.placedSessionOwnersOrphaned,
+            note: "delegated (placed) session rows that an earlier version wrote without an owner were given an owner no caller can match, in one of two forms: a row whose root and parent " +
+                "sessions are both gone gets `_orphan:<its own session id>`; a row whose parent is such a row inherits that same value, `_orphan:<that ancestor's session id>` (rows below it " +
+                "inherit it in turn). Their transcripts are no longer readable through the session faces by anyone but fleet-wide and operator callers. They are the rows whose owner " +
+                "starts with `_orphan:` (an owner naming the row's own id had no surviving ancestor; one naming another session came down from that orphaned ancestor); set a real owner " +
+                "in the session store by hand if someone should read one, or leave them to the transcript retention",
+        });
+    }
     for (const row of r.undurableScopeRuleRows) {
         log.warn("permission_rule_row_removed", {
             backend,
@@ -1058,7 +1370,7 @@ function logOneTimeMigrationsInterrupted(log, backend, error) {
         ...readingFields(error.receipts),
         note: "the one-time migrations failed after committing changes: the readings on this line and the lines that follow are what this boot already committed — a retried " +
             "boot finds that work done and does not report it again, so these lines are the only record of them, written once by this boot — save them. The failure itself follows " +
-            "as this boot's refusal. A shape reading absent from this line (sessionIncarnationColumn / workflowParkIndexKey / sessionRuleColumn) belongs to a step that did not " +
+            "as this boot's refusal. A shape reading absent from this line (sessionIncarnationColumn / workflowParkIndexKey / sessionRuleColumn / workflowJournalScopeColumn) belongs to a step that did not " +
             "finish; sessionRuleColumn absent after session_rule_row_old_grammar_entries lines means the column still carries its in-progress name — the next boot rewrites the " +
             "remaining rows (rows already rewritten are left alone) and publishes the final name",
     });