@sema-agent/server 7.134.0 → 7.136.0

package/dist/plugins/one-time-migrations.js

@@ -1,12 +1,13 @@
-import { PAUSE_REGISTRY, SESSION_RULES_GRAMMAR, compileSessionRuleBucket, isGateKind, readSessionRulesShape, unreadableDenyEntries } from "@sema-agent/core";
-import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
+import { SESSION_RULES_GRAMMAR, compileSessionRuleBucket, isGateKind, readSessionRulesShape, unreadableDenyEntries } from "@sema-agent/core";
+import { APPROVAL_GATE_KINDS, ASK_USER_QUESTION_TOOL_NAME, isApprovalGateKind } from "../approval-content-kind.js";
+import { judgeCheckpointIndexCells } from "./checkpoint-index-columns.js";
 import { dialectProtocolJsonEncoder } from "./sql-driver.js";
 import { SCHEMA_STATEMENTS, acquireEnsureSchemaLock, releaseEnsureSchemaLock } from "./tidb-pool.js";
 import { PG_SCHEMA_STATEMENTS, acquirePgEnsureSchemaLock, releasePgEnsureSchemaLock } from "./pg-pool.js";
 import { CENTRAL_SCHEMA_INDEXES } from "./schema-indexes.js";
 import { ensureIndexes } from "./ensure-index.js";
 import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readNonNullJsonValueColumn, readOpaqueJsonValueColumn, } from "./sql-json-column.js";
-import { SESSION_META_INCARNATION_COLUMN, incarnationFromCell, mintSessionIncarnation, sessionFaceFromRow } from "../session-incarnation.js";
+import { incarnationFromCell, sessionFaceFromRow } from "../session-incarnation.js";
 import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR } from "./store-contracts.js";
 import { PERMISSION_RULE_TABLE, purgeUndurableScopeRows } from "./permission-rule-store-sql.js";
 import { SESSION_RULES_COLUMN } from "./session-rules-column.js";
@@ -18,8 +19,6 @@ import { MAILBOX_KEYED_TABLES, mailboxKeyDeleteSql, storedMailboxKeyless } from
 const RETIRED_SESSION_RULE_BUCKETS = ["commandAllow", "commandDeny"];
 export function buildMigrationReceipts() {
     return {
-        auditDetailJsonNullRows: 0,
-        sessionIncarnationsBackfilled: 0,
         holderDeathCodeRowsBackfilled: 0,
         allowRuleShadowRowsMigrated: 0,
         allowRuleShadowRowsUnreadable: 0,
@@ -43,20 +42,20 @@ export function buildMigrationReceipts() {
         workflowJournalForeignScopeRowsRemoved: 0,
         retiredBreakerTablesDropped: 0,
         mailboxRejectedKeyRowsRemoved: 0,
+        parkedApprovalCardsBackfilled: 0,
+        parkedApprovalCardRowsUnreadable: [],
+        parkedApprovalCardRowsTooLong: [],
     };
 }
 function completedReport(r) {
-    const { sessionIncarnationColumn, workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn } = r;
-    if (sessionIncarnationColumn === undefined || workflowParkIndexKey === undefined || sessionRuleColumn === undefined || workflowJournalScopeColumn === undefined) {
-        throw new Error(`one-time migrations finished without settling a shape reading (M5 ${String(sessionIncarnationColumn)} / M9 ${String(workflowParkIndexKey)} / M17 ${String(sessionRuleColumn)} / M24 ${String(workflowJournalScopeColumn)}) — a step did not record it`);
+    const { workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn } = r;
+    if (workflowParkIndexKey === undefined || sessionRuleColumn === undefined || workflowJournalScopeColumn === undefined) {
+        throw new Error(`one-time migrations finished without settling a shape reading (M9 ${String(workflowParkIndexKey)} / M17 ${String(sessionRuleColumn)} / M24 ${String(workflowJournalScopeColumn)}) — a step did not record it`);
     }
-    return { ...r, sessionIncarnationColumn, workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn };
+    return { ...r, workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn };
 }
 function changedAnything(r) {
-    return (r.auditDetailJsonNullRows > 0 ||
-        r.sessionIncarnationColumn === "added" ||
-        r.sessionIncarnationsBackfilled > 0 ||
-        r.holderDeathCodeRowsBackfilled > 0 ||
+    return (r.holderDeathCodeRowsBackfilled > 0 ||
         r.allowRuleShadowRowsMigrated > 0 ||
         r.allowRuleShadowRowsUnreadable > 0 ||
         r.workflowParkIndexKey === "reshaped" ||
@@ -81,7 +80,10 @@ function changedAnything(r) {
         r.workflowJournalOwnersBackfilled > 0 ||
         r.workflowJournalForeignScopeRowsRemoved > 0 ||
         r.retiredBreakerTablesDropped > 0 ||
-        r.mailboxRejectedKeyRowsRemoved > 0);
+        r.mailboxRejectedKeyRowsRemoved > 0 ||
+        r.parkedApprovalCardsBackfilled > 0 ||
+        r.parkedApprovalCardRowsUnreadable.length > 0 ||
+        r.parkedApprovalCardRowsTooLong.length > 0);
 }
 function readingsSnapshot(r) {
     return {
@@ -91,6 +93,8 @@ function readingsSnapshot(r) {
         sessionRuleRowsWithRetiredBuckets: [...r.sessionRuleRowsWithRetiredBuckets],
         sessionRuleRowsWithOldGrammarEntries: [...r.sessionRuleRowsWithOldGrammarEntries],
         sessionRuleRowsWithUnreadableDeny: [...r.sessionRuleRowsWithUnreadableDeny],
+        parkedApprovalCardRowsUnreadable: [...r.parkedApprovalCardRowsUnreadable],
+        parkedApprovalCardRowsTooLong: [...r.parkedApprovalCardRowsTooLong],
     };
 }
 function receiptSentence(r) {
@@ -115,29 +119,6 @@ export class OneTimeMigrationInterruptedError extends Error {
     }
 }
 export const ONE_TIME_MIGRATIONS = [
-    {
-        id: "M4",
-        introducedIn: "7.93.5",
-        releasedOn: "2026-09-21",
-        removableAfter: "2026-10-21",
-        removal: "删 migrateOn 的 M4 步(`device_audit` 在场探针 + `UPDATE … SET detail = NULL`)与 `AUDIT_TABLE` / `AUDIT_DETAIL_COLUMN`;" +
-            "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `auditDetailJsonNullRows`;它若是表里最后一条,按头注「窗」一节整个文件一起删",
-        afterRemoval: "`device-store-sql.ts` `listAudit` 的读形拒(S-550:一行读不出形 ⇒ 整页拒,刻意不逐行隔离):含一行 JSON 文本 `null` 的那一页" +
-            "读不出来,拒句点名行 id —— 响亮,但那一页会一直读不出来,直到运维手工把那些行的 `detail` 置成 SQL NULL",
-        reportKeys: ["auditDetailJsonNullRows"],
-    },
-    {
-        id: "M5",
-        introducedIn: "7.104.0",
-        releasedOn: "2026-09-28",
-        removableAfter: "2026-10-28",
-        removal: "删 migrateOn 的 M5 步(`session_meta` 在场探针、`incarnation` 列在场探针 + `ADD COLUMN`、空化身回填循环)与 `backfillSessionIncarnations`;" +
-            "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `sessionIncarnationColumn` / `sessionIncarnationsBackfilled`;**列本身留在中央 DDL 里**(它不是迁移的一部分)",
-        afterRemoval: "① 列不在的存量库:起服列册探针 `schema-consistency.ts`(S-547)的缺列臂拒启 `config.schema_mismatch`,拒句里的 `ALTER TABLE … ADD COLUMN` " +
-            "由同一份 DDL 生成(响亮);② 列在但行上仍是空化身(跳过了带 M5 的版本直接升):会话店读口 `sessionFaceOf` 对那一行响亮拒 " +
-            "`session.incarnation_missing`(parked 决定腿因此拒、记忆座退回按 id 绑定并 warn)—— 运维手工给那些行填一只随机令牌即可",
-        reportKeys: ["sessionIncarnationColumn", "sessionIncarnationsBackfilled"],
-    },
     {
         id: "M6",
         introducedIn: "7.116.0",
@@ -202,7 +183,7 @@ export const ONE_TIME_MIGRATIONS = [
             "`http/routes/sessions.ts` 409 `conflict.session_ownerless` 句里「Ways out: on the local backend, during the upgrade window …」那半句(连同冻结表 " +
             "`test/api-error-text-freeze.test.ts` 那一行、契约码目录 `docs/ASSISTANT-WIRE-CONTRACT.md` 那一行);本文件的 `migrationWindowOpen`(若再无别的读者)",
         afterRemoval: "没有响亮臂(删码本身零行为变化:窗关那一刻起认领臂已经不生效):属主从没被记下的存量会话(边档那一格只有化身 —— 跳过了带本条的版本直接升," +
-            "或窗内从没被带 principal 提交过)照旧答无主(`ownerOf` = null):它的会话规则这条路由读不了也改不了(409 `conflict.session_ownerless`)," +
+            "或窗内从没被带 principal 提交过)照旧答无主(`headOf(id)?.owner` = null):它的会话规则这条路由读不了也改不了(409 `conflict.session_ownerless`)," +
             "已存的规则对写下它们的 principal 的 run 照旧生效;出路 = 删会话(`DELETE /v1/sessions/:id`,规则随之删)",
         reportKeys: [],
     },
@@ -241,26 +222,13 @@ export const ONE_TIME_MIGRATIONS = [
         removableAfter: "2026-11-09",
         removal: "删 `config-lkg.ts` 的 formatVersion 2 读回迁移:`migrateV2Lkg` / `migrateDroppedIdentityRow` / `RETIRED_CATALOG_COORDINATE` 与其上的窗注;`loadLkg` 的 2 臂" +
             "(版本判据里的 `2` 与 `formatVersion === 2 ? migrateV2Lkg(…)` 那一支 —— 2 回到「unknown formatVersion」拒)、返回型的 `migrated` 位与 JSDoc 里说它的那一行、" +
-            "文件头注「2 读回时一次性迁移」那一句;`boot/web-admin.ts` 读 `read.migrated` 打 `config_lkg_migrated` 的那一行(formatVersion 1 迁移的同名事件那一行留);" +
-            "`migrateV1Lkg` 里不带 v1 的 etag 那一句旁注对 `migrateV2Lkg` 的引用(不带 etag 的规则本身留 —— v1 载荷同样没有完整的被丢条目记录);契约 §A.1d " +
+            "文件头注「2 读回时一次性迁移」那一句;`boot/web-admin.ts` 读 `read.migrated` 打 `config_lkg_migrated` 的那一行(这一行与 M15 / M22 的读回迁移共用 —— 三条都删完才整段删,先删 M13 时只去掉信封 2 → 3 那一路的 `migrated` 来源);契约 §A.1d " +
             "`droppedEntries` 一节「升级窗(如实)」那一条与 §A.1d `[config.model_refused_name_minted]` 那一条里「LKG 载体 `droppedIdentities` 读回时一次性迁移」那半句;手写 formatVersion 2 信封的测试夹具" +
             "(`test/config-lkg.test.ts`、`test/config-hot/batch1-version-ordinal.test.ts` 改写成 3;`test/models-dropped-entries-s1295.test.ts` 的旧 LKG 迁移格改钉 2 读回不可用)",
         afterRemoval: "既有响亮臂 `config_lkg_unusable`(`loadLkg` 对 2 答「unknown formatVersion 2」):2 读回 ⇒ 不可用,中心可达照拉(整拉,读腿铸出完整载体,新 LKG 按 3 覆盖)、" +
             "断着则 env 兜底,下一份干净候选重写 —— 与回滚到 7.122.0 读 3 同一种处置",
         reportKeys: [],
     },
-    {
-        id: "M14",
-        introducedIn: "7.99.0",
-        releasedOn: "2026-09-24",
-        removableAfter: "2026-10-24",
-        removal: "删 `config-lkg.ts` 的 formatVersion 1 迁移:`legacyV1LkgPath` / `migrateV1Lkg` 与其上的窗注(`loadLkg` 的 1 臂今天已是拒句,不动);" +
-            "`boot/web-admin.ts` `bootFromLkg` 里调用 `migrateV1Lkg` 的那一段(含它打 `config_lkg_migrated` / 推不出身份时响亮拒的那两行);" +
-            "`migrateV1Lkg` 的测试格(`test/config-lkg.test.ts` v1 迁移组)",
-        afterRemoval: "既有响亮臂 `config_lkg_unusable`(`loadLkg` 对 1 答「pre-identity LKG (formatVersion 1) — not read back …」):旧默认路径上的 v1 文件不再被迁进箱、" +
-            "原样留在盘上;中心可达照拉(整拉,新 LKG 按现行箱名落盘)、断着则 env 兜底",
-        reportKeys: [],
-    },
     {
         id: "M15",
         introducedIn: "7.124.0",
@@ -326,10 +294,15 @@ export const ONE_TIME_MIGRATIONS = [
         releasedOn: "2026-10-16",
         removableAfter: "2026-11-15",
         removal: "删 `src/stored-request-tool-axes-m19.ts` 整只文件(`storedToolAxesRereadM19` / `readToolAxesAsServer7129M19` / `readA2aToolAxesAsServer7131M19` / `StoredToolAxesRereadM19`);" +
-            "`boot/resolve-spec.ts` 里两条请求腿共用的那一行(`const storedToolAxes = opts?.leg === \"fresh\" ? undefined : storedToolAxesRereadM19(…)`)、递给 `resolveRequestMcp` / `resolveRequestA2a` 的两处实参与它的 import;" +
+            "`boot/resolve-spec.ts` 里两条请求腿共用的那一行(`const storedToolAxes = opts?.leg === \"fresh\" ? undefined : storedToolAxesRereadM19(…)`,在腿首、A2A 快照之前求值)、" +
+            "`snapshotRequestA2a(…, { reread: storedToolAxes !== undefined })` 的第二实参、`parts` 里的 `storedToolAxes`(类型与解构)、递给 `resolveRequestMcp` / `resolveRequestA2a` 的两处实参与它的 import;" +
             "`task-mcp.ts` 里 `resolveRequestMcp` / `classifyRequestMcp` / `classifyHonored` / `validateRequestMcpEntries` / `normalizeServer` 的 `storedToolAxes` 形参、" +
             "`toolAxesReread` 事实与运维行 `mcp_tool_axes_read_as_before_upgrade`,以及对本模块的型 import(升级前读法的词表与两只谓词住在本模块里,随它一起删);" +
-            "`task-a2a.ts` 里 `resolveRequestA2a` / `validateRequestA2aEntries` / `normalizeA2aPeer` 的 `storedToolAxes` 形参、`toolAxesReread` 事实与运维行 `a2a_tool_axes_read_as_before_upgrade`、对本模块的型 import;" +
+            "`task-a2a.ts` 里 `resolveRequestA2a` / `validateRequestA2aEntries` / `normalizeA2aPeer` 的 `storedToolAxes` 形参、`toolAxesReread` 事实与运维行 `a2a_tool_axes_read_as_before_upgrade`、对本模块的型 import," +
+            "以及只为重读座存在的克隆机器的全部名字:`cloneDeclaration` / `DeclarationClone` / `CloneFrame` / `openCloneNode` / `putCloneMember`、快照类型 `PeerSnapshot` 的字段 `toolAxesDeclared` 与 `mintPeerSnapshot` / `snapshotPeer` / `snapshotRequestA2a` 的 `reread` 形参、`toolAxesNotCloneableIssue`、读器里 `declared` 那一臂(`node:util` 的 `types` 与 `errorKindOf` 的 import 若再无别的读者一并删);" +
+            "随克隆一起退役的两句例外文字:`USAGE.md` 里 `a2a_injection_dropped` 条目 `reason` 那句「只有一臂例外 … `declaration not cloneable (<because>) — …`」与 `task-a2a.ts` 里 `A2aInjectionDrop.reason` 注的同一句例外(删后 `reason` 恒与 400 拒句同一句,回到「逐字同一句」不带例外);" +
+            "`test/task-a2a.test.ts` 里的克隆钉(标题去掉开头的 `🔴 ` 后以 `克隆钉:` 开头的各格,整格删;按这个精确前缀删,不按标题里的「M19 重读」之类泛词删 —— 那会误删同文件里的通用不变式钉),以及三格不带前缀、删码后要改写的钉:`需要「读」的两个键…` 那格的 `readRequestToolAxes` 调用方名单(`normalizeA2aPeer` 只在 M19 重读臂里调它,删后名单只剩 `mintPeerSnapshot`,标题里「与读器里 M19 重读产物的那一次」半句同删)、`读器与门的差别只有三格…` 改成两格(删 ③ 的注释行与标题里的 ③)、`请求入口快照的形…` 里 `snapshotRequestA2a(…, { reread: false })` 的第二实参(删 `reread` 形参后改成单参);" +
+            "`test/one-time-migration-window-gate.test.ts` 里 M19 一节中与克隆有关的三格(声明抽取器正负控 · 删法条与克隆名字两向对账 · 克隆钉标题前缀对账)与它们共用的帮手 `declaredNames`;" +
             "`test/mcp-tool-axes-m19.test.ts`(窗关那一格 —— 存量坏形整条不进、warn 与通告点名 `field: toolAxes` —— 改钉到 `test/task-mcp.test.ts`);" +
             "本文件的 `migrationWindowOpen`(若再无别的读者)",
         afterRemoval: "没有新的臂,接住它的是今天的读法(删码零行为变化:窗关那一刻起重读臂已经不生效):升级前存下的请求体里引擎判官判不过的 `toolAxes`,续跑重放时这一条 server 整条不进," +
@@ -360,7 +333,7 @@ export const ONE_TIME_MIGRATIONS = [
         releasedOn: "2026-10-18",
         removableAfter: "2026-11-17",
         removal: "删 migrateOn 的 M21 步(`repairParkedRows`:pending 候选分页扫描、门型回填、续不了的置 expired、问答卡词的整只文档读 + CAS 回写)与 `parkedRowRepairOf` / `ParkedRowRepair` / " +
-            "`M21_GATE` / `M21_PENDING_ACTION` / `PARKED_ROW_REPAIR_PAGE` / `QUESTION_CARD` / `PARKED_APPROVAL_GATE_KINDS` / `readM21Subtree` / `readM21Document` / `m21Subtree`;" +
+            "`M21_GATE` / `M21_PENDING_ACTION` / `PARKED_ROW_REPAIR_PAGE` / `QUESTION_CARD` / `readM21Subtree` / `readM21Document` / `m21Subtree`;" +
             "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `parkedQuestionCardsWritten` / `parkedQuestionRowsLeftAsWritten` / `parkedRowGateKindsBackfilled` / `parkedRowsUnresumableExpired`;" +
             "`test/one-time-migrations.test.ts` 的 M21 组与 `test/one-time-migrations-db-integration.test.ts` 的 M21 格",
         afterRemoval: "① 门上没有卡词的存量问答行(跳过了带本条的版本直接升的库、把 `APPROVAL_TERMINAL_BACKSTOP_MS` 调长的部署、local 车道 —— 那一车道本条从来够不着):没有新的臂,回到本条之前的读法 —— " +
@@ -462,14 +435,23 @@ export const ONE_TIME_MIGRATIONS = [
             "行字节不动 —— 出路 = 作为新任务重提(仍停驻的先取消),或升级时先过一次带本条的版本",
         reportKeys: [],
     },
+    {
+        id: "M29",
+        introducedIn: "7.135.0",
+        releasedOn: "2026-10-22",
+        removableAfter: "2026-11-21",
+        removal: "删 migrateOn 的 M29 步(`backfillParkedApprovalCards`:列在场探针、pending 候选分页扫描、整只文档读 + 写口那一只判官 + CAS 写列)与 `PARKED_CARD_BACKFILL_PAGE` / `readM29Document` / `m29Judge`;" +
+            "报告、日志行(含逐行的 `parked_approval_card_row_unreadable` / `parked_approval_card_row_too_long`)与 `NO_SQL_MIGRATIONS` 的 `parkedApprovalCardsBackfilled` / `parkedApprovalCardRowsUnreadable` / `parkedApprovalCardRowsTooLong`;`test/one-time-migrations.test.ts` 的 M29 组与 " +
+            "`test/checkpoint-index-columns-db-integration.test.ts` 的 M29 格。**不随本条删**:`approval_card` 列、写口的派生、到期 facet 的生成谓词(常设)",
+        afterRemoval: "没有新的臂(如实):跳过了带本条的版本直接升的库,升级前停驻、升级后仍挂着的行卡列是 NULL —— 生成谓词读门型的 facet(审批门 ⇒ SLA 拒扫腿),问答行到期被拒扫" +
+            "(引擎对问答拒收 `sla_timeout`,拒扫腿每拍一条失败,由 `terminal_at_ms` 兜底收割);运维队列行不带卡词。出路 = 升级前答完 / 拒掉停驻的问答,或升级时先过一次带本条的版本",
+        reportKeys: ["parkedApprovalCardsBackfilled", "parkedApprovalCardRowsUnreadable", "parkedApprovalCardRowsTooLong"],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;
 }
 export const NO_SQL_MIGRATIONS = {
-    auditDetailJsonNullRows: 0,
-    sessionIncarnationColumn: "lazy-on-read",
-    sessionIncarnationsBackfilled: 0,
     allowRuleShadowRowsMigrated: 0,
     allowRuleShadowRowsUnreadable: 0,
     workflowParkIndexKey: "file-ledger",
@@ -495,9 +477,10 @@ export const NO_SQL_MIGRATIONS = {
     workflowJournalForeignScopeRowsRemoved: 0,
     retiredBreakerTablesDropped: 0,
     mailboxRejectedKeyRowsRemoved: 0,
+    parkedApprovalCardsBackfilled: 0,
+    parkedApprovalCardRowsUnreadable: [],
+    parkedApprovalCardRowsTooLong: [],
 };
-const AUDIT_TABLE = "device_audit";
-const AUDIT_DETAIL_COLUMN = "detail";
 function mysqlDb(conn) {
     return {
         async rows(sql, params) {
@@ -584,10 +567,6 @@ async function migrateOn(db, dialect) {
     return completedReport(receipts);
 }
 async function migrateStepsOn(db, dialect, receipts) {
-    if (await tableExists(db, dialect, AUDIT_TABLE)) {
-        receipts.auditDetailJsonNullRows += await db.exec(`UPDATE ${AUDIT_TABLE} SET ${AUDIT_DETAIL_COLUMN} = NULL ` + `WHERE ${AUDIT_DETAIL_COLUMN} IS NOT NULL AND ${jsonColumnTextExpr(dialect, AUDIT_DETAIL_COLUMN)} = 'null'`);
-    }
-    await migrateSessionIncarnations(db, dialect, receipts);
     receipts.holderDeathCodeRowsBackfilled += await db.exec(dialect === "tidb"
         ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND error = ?"
         : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND error = $2", [RUN_HOLDER_DEATH_CODES.stalled, RUN_STALLED_ERROR]);
@@ -599,9 +578,10 @@ async function migrateStepsOn(db, dialect, receipts) {
     await reshapeWorkflowParkIndex(db, dialect, receipts);
     await migrateSessionRuleGrammar(db, dialect, receipts);
     await repairParkedRows(db, dialect, receipts);
+    await backfillParkedApprovalCards(db, dialect, receipts);
     if (await tableExists(db, dialect, "session_meta"))
         await inheritPlacedSessionOwners(db, dialect, receipts);
-    if (await tableExists(db, dialect, PERMISSION_RULE_TABLE))
+    if ((await tableExists(db, dialect, PERMISSION_RULE_TABLE)) && (await columnExists(db, dialect, PERMISSION_RULE_TABLE, "grammar")))
         await purgeUndurableScopeRows(db, dialect, receipts);
     await moveWorkflowJournalScope(db, dialect, receipts);
     if (await tableExists(db, dialect, RETIRED_BREAKER_TABLE))
@@ -1010,7 +990,6 @@ const M21_GATE = { key: "gate", as: "m21_gate" };
 const M21_PENDING_ACTION = { key: "pendingAction", as: "m21_pending_action" };
 const PARKED_ROW_REPAIR_PAGE = 200;
 const QUESTION_CARD = "question";
-const PARKED_APPROVAL_GATE_KINDS = Object.keys(PAUSE_REGISTRY).filter((k) => PAUSE_REGISTRY[k].pending === "tool_approval");
 const readM21Subtree = createObjectColumnReader();
 const readM21Document = createObjectColumnReader();
 export function parkedRowRepairOf(gateKindCell, gate, pendingAction) {
@@ -1020,7 +999,7 @@ export function parkedRowRepairOf(gateKindCell, gate, pendingAction) {
     const kind = columnKind ?? documentKind;
     const pa = pendingAction !== null && typeof pendingAction === "object" && !Array.isArray(pendingAction) ? pendingAction : undefined;
     const questionCard = kind !== undefined &&
-        PARKED_APPROVAL_GATE_KINDS.includes(kind) &&
+        isApprovalGateKind(kind) &&
         gateObj !== undefined &&
         !Object.hasOwn(gateObj, "approvalCard") &&
         pa?.kind === "tool_approval" &&
@@ -1040,7 +1019,7 @@ function m21Subtree(cell, where) {
 }
 export async function repairParkedRows(db, dialect, receipts) {
     const ph = (n) => (dialect === "tidb" ? "?" : `$${n}`);
-    const kinds = PARKED_APPROVAL_GATE_KINDS;
+    const kinds = APPROVAL_GATE_KINDS;
     const kindSlots = kinds.map((_, i) => ph(i + 1)).join(", ");
     const scan = `SELECT token, session_id, gate_kind, ${jsonColumnText(dialect, "checkpoint", M21_GATE)}, ${jsonColumnText(dialect, "checkpoint", M21_PENDING_ACTION)} FROM checkpoint ` +
         `WHERE status = 'pending' AND (gate_kind IS NULL OR (gate_kind IN (${kindSlots}) AND tool_name = ${ph(kinds.length + 1)})) AND token > ${ph(kinds.length + 2)} ` +
@@ -1090,6 +1069,61 @@ export async function repairParkedRows(db, dialect, receipts) {
             return;
     }
 }
+const PARKED_CARD_BACKFILL_PAGE = 200;
+const readM29Document = createObjectColumnReader();
+export async function backfillParkedApprovalCards(db, dialect, receipts) {
+    if (!(await columnExists(db, dialect, "checkpoint", "approval_card")))
+        return;
+    const ph = (n) => (dialect === "tidb" ? "?" : `$${n}`);
+    const kinds = APPROVAL_GATE_KINDS;
+    const scan = `SELECT token FROM checkpoint WHERE status = 'pending' AND approval_card IS NULL AND gate_kind IN (${kinds.map((_, i) => ph(i + 1)).join(", ")}) ` +
+        `AND token > ${ph(kinds.length + 1)} ORDER BY token LIMIT ${PARKED_CARD_BACKFILL_PAGE}`;
+    let after = "";
+    for (;;) {
+        const page = await db.rows(scan, [...kinds, after]);
+        for (const r of page) {
+            const token = String(r.token);
+            after = token;
+            const [full] = await db.rows(`SELECT session_id, ${jsonColumnText(dialect, "checkpoint")} FROM checkpoint WHERE token = ${ph(1)} AND status = 'pending'`, [token]);
+            if (full === undefined)
+                continue;
+            const reading = m29Judge(full.checkpoint, dialect);
+            switch (reading.kind) {
+                case "unreadable":
+                    receipts.parkedApprovalCardRowsUnreadable.push({ sessionId: String(full.session_id) });
+                    continue;
+                case "card_too_long":
+                    receipts.parkedApprovalCardRowsTooLong.push({ sessionId: String(full.session_id), bytes: reading.bytes });
+                    continue;
+                case "cells": {
+                    const card = reading.cells.approval_card;
+                    if (card === null)
+                        continue;
+                    receipts.parkedApprovalCardsBackfilled += await db.exec(`UPDATE checkpoint SET approval_card = ${ph(1)} WHERE token = ${ph(2)} AND status = 'pending' AND approval_card IS NULL`, [card, token]);
+                    continue;
+                }
+                default: {
+                    const unhandled = reading;
+                    throw new Error(`M29: unhandled judgement ${JSON.stringify(unhandled)}`);
+                }
+            }
+        }
+        if (page.length < PARKED_CARD_BACKFILL_PAGE)
+            return;
+    }
+}
+function m29Judge(cell, dialect) {
+    let doc;
+    try {
+        doc = decodeJsonColumn(cell, readM29Document, "checkpoint.checkpoint (M29 approval-card backfill)");
+    }
+    catch (e) {
+        if (!isJsonColumnBodyProblem(e))
+            throw e;
+        return { kind: "unreadable" };
+    }
+    return judgeCheckpointIndexCells(doc, dialect);
+}
 const PLACED_OWNER_SCAN_PAGE = 500;
 function placedOwnerScanSql(dialect) {
     return ("SELECT c.session_id, c.incarnation, r.session_id AS root_row, r.owner AS root_owner, r.incarnation AS root_incarnation, r.placement_kind AS root_kind, " +
@@ -1150,69 +1184,8 @@ export async function inheritPlacedSessionOwners(db, dialect, receipts) {
             return;
     }
 }
-const INCARNATION_BACKFILL_BATCH = 500;
-async function migrateSessionIncarnations(db, dialect, receipts) {
-    if (!(await tableExists(db, dialect, "session_meta"))) {
-        receipts.sessionIncarnationColumn = "no-table";
-        return;
-    }
-    const col = SESSION_META_INCARNATION_COLUMN;
-    let column = "present";
-    if (!(await columnExists(db, dialect, "session_meta", col.name))) {
-        try {
-            await db.exec(`ALTER TABLE session_meta ADD COLUMN ${dialect === "tidb" ? col.tidb : col.pg}`);
-            column = "added";
-        }
-        catch (e) {
-            if (!(await columnExists(db, dialect, "session_meta", col.name)))
-                throw e;
-        }
-    }
-    receipts.sessionIncarnationColumn = column;
-    await backfillSessionIncarnations(db, dialect, receipts);
-}
-async function backfillSessionIncarnations(db, dialect, receipts) {
-    const remaining = async () => Number((await db.rows("SELECT COUNT(*) AS n FROM session_meta WHERE incarnation = ''"))[0]?.n ?? 0);
-    const initial = await remaining();
-    if (initial === 0)
-        return;
-    const ceiling = Math.ceil(initial / INCARNATION_BACKFILL_BATCH) * 2 + 2;
-    let written = 0;
-    let after;
-    for (let round = 0; round < ceiling; round++) {
-        const ids = (after === undefined
-            ? await db.rows(`SELECT session_id FROM session_meta WHERE incarnation = '' ORDER BY session_id LIMIT ${INCARNATION_BACKFILL_BATCH}`)
-            : await db.rows(`SELECT session_id FROM session_meta WHERE incarnation = '' AND session_id > ${dialect === "pg" ? "$1" : "?"} ORDER BY session_id LIMIT ${INCARNATION_BACKFILL_BATCH}`, [after])).map((r) => String(r.session_id));
-        if (ids.length === 0) {
-            if (after === undefined)
-                return;
-            after = undefined;
-            continue;
-        }
-        const params = [];
-        const bind = (v) => {
-            params.push(v);
-            return dialect === "pg" ? `$${params.length}` : "?";
-        };
-        const cases = ids.map((id) => `WHEN ${bind(id)} THEN ${bind(mintSessionIncarnation())}`).join(" ");
-        const inList = ids.map((id) => bind(id)).join(", ");
-        const landed = await db.exec(`UPDATE session_meta SET incarnation = CASE session_id ${cases} END WHERE incarnation = '' AND session_id IN (${inList})`, params);
-        written += landed;
-        receipts.sessionIncarnationsBackfilled += landed;
-        after = ids.length < INCARNATION_BACKFILL_BATCH ? undefined : ids[ids.length - 1];
-    }
-    const left = await remaining();
-    if (left > 0) {
-        throw new Error(`one-time migration M5: ${left} session_meta row(s) still carry an empty incarnation after ${ceiling} backfill round(s) ` +
-            `(${written} written) — refusing to start rather than serve sessions whose occupant cannot be told apart. Retry the boot; ` +
-            `if it repeats, something keeps writing rows without an incarnation (an older replica still inserting?).`);
-    }
-}
 function readingFields(r) {
     return {
-        auditDetailJsonNullRows: r.auditDetailJsonNullRows,
-        ...(r.sessionIncarnationColumn !== undefined ? { sessionIncarnationColumn: r.sessionIncarnationColumn } : {}),
-        sessionIncarnationsBackfilled: r.sessionIncarnationsBackfilled,
         holderDeathCodeRowsBackfilled: r.holderDeathCodeRowsBackfilled,
         allowRuleShadowRowsMigrated: r.allowRuleShadowRowsMigrated,
         allowRuleShadowRowsUnreadable: r.allowRuleShadowRowsUnreadable,
@@ -1239,6 +1212,9 @@ function readingFields(r) {
         workflowJournalForeignScopeRowsRemoved: r.workflowJournalForeignScopeRowsRemoved,
         retiredBreakerTablesDropped: r.retiredBreakerTablesDropped,
         mailboxRejectedKeyRowsRemoved: r.mailboxRejectedKeyRowsRemoved,
+        parkedApprovalCardsBackfilled: r.parkedApprovalCardsBackfilled,
+        parkedApprovalCardRowsUnreadable: r.parkedApprovalCardRowsUnreadable.length,
+        parkedApprovalCardRowsTooLong: r.parkedApprovalCardRowsTooLong.length,
     };
 }
 export function logOneTimeMigrations(log, backend, report) {
@@ -1246,9 +1222,7 @@ export function logOneTimeMigrations(log, backend, report) {
         backend,
         ...readingFields(report),
         removableAfter: Object.fromEntries(ONE_TIME_MIGRATIONS.map((w) => [w.id, w.removableAfter])),
-        note: "one-time persisted-data migrations (M4: audit details written as the JSON " +
-            "text `null` by an earlier version folded to a SQL NULL, so \"no detail\" has exactly one on-disk spelling; M5: the " +
-            "session incarnation column added and every session row without one minted its own token; M6: run rows failed by a " +
+        note: "one-time persisted-data migrations (M6: run rows failed by a " +
             "holder-death verdict written by an earlier version with only the sentence got the machine-readable code run.stalled / " +
             "run.orphaned; M7 writes nothing — it is the window of the refusal that keeps a suspended task whose stored allow list was written " +
             "under an earlier reading from resuming under the current one; M8: parked rows' allow-layer disclosure written by an earlier engine " +
@@ -1282,7 +1256,10 @@ export function logOneTimeMigrations(log, backend, report) {
             "the breakers live in the new table breaker_state, which this step never touches; only the count is logged, never a key; M27: rows of the three " +
             "mailbox tables (mailbox / mailbox_message / mailbox_tombstone) whose key — scope or handle — the mailbox key judge refuses (control characters, " +
             "malformed Unicode, wider than 190 UTF-8 bytes, empty scope) removed, a whole box at a time: no entry point reaches such a key any more, so neither " +
-            "delivery, reading nor session deletion would ever have touched them again; only the count is logged, never a key). Each step " +
+            "delivery, reading nor session deletion would ever have touched them again; only the count is logged, never a key; M29: suspended rows " +
+            "parked before the checkpoint column approval_card existed and still pending get that column — the approval card word on their gate, " +
+            "derived by the same function the write path uses (the engine's checkpointIndexFacts); a row whose document cannot be read as a checkpoint " +
+            "is left NULL and counted, named by a parked_approval_card_row_unreadable line, and so is a row whose card word is longer than the column can hold, named by a parked_approval_card_row_too_long line). Each step " +
             "runs on every boot until its window closes (the release that introduced it + 30 days; the per-step date is in " +
             "removableAfter, null while that release is not published yet) and is deleted in the first minor after that — start a " +
             "version that still carries a step at least once before upgrading past its deletion.",
@@ -1290,6 +1267,26 @@ export function logOneTimeMigrations(log, backend, report) {
     logReceiptRows(log, backend, report);
 }
 function logReceiptRows(log, backend, r) {
+    for (const row of r.parkedApprovalCardRowsUnreadable) {
+        log.warn("parked_approval_card_row_unreadable", {
+            backend,
+            sessionId: row.sessionId,
+            note: "a suspended approval row's checkpoint document cannot be read as a checkpoint the engine can resume (the body is not a JSON object, or the gate / pending-action member is missing), so its approval card " +
+                "could not be derived. The row was not backfilled and not touched: the checkpoint.approval_card column stays NULL and the document is exactly as it was. Such a row cannot be resumed either; " +
+                "find it by its session id and repair or remove the checkpoint document, or delete the session. The row is named on every boot until then",
+        });
+    }
+    for (const row of r.parkedApprovalCardRowsTooLong) {
+        log.warn("parked_approval_card_row_too_long", {
+            backend,
+            sessionId: row.sessionId,
+            bytes: row.bytes,
+            note: "a suspended approval row's gate carries an approval card word longer than the checkpoint.approval_card column can hold (the MySQL-protocol column is TEXT: 65,535 UTF-8 bytes). " +
+                "The engine mints short card words only, so this row was edited by hand or written by something other than the engine. It was not backfilled and not truncated: the " +
+                "column stays NULL and the read paths read the row as carrying no card (its document is untouched). Find the row by its session id and shorten " +
+                "or remove the approvalCard member of its gate in the checkpoint document (the next boot then backfills it), or delete the session. The row is named on every boot until then",
+        });
+    }
     if (r.workflowJournalForeignScopeRowsRemoved > 0) {
         log.warn("workflow_journal_foreign_scope_rows_removed", {
             backend,
@@ -1382,7 +1379,7 @@ function logOneTimeMigrationsInterrupted(log, backend, error) {
         ...readingFields(error.receipts),
         note: "the one-time migrations failed after committing changes: the readings on this line and the lines that follow are what this boot already committed — a retried " +
             "boot finds that work done and does not report it again, so these lines are the only record of them, written once by this boot — save them. The failure itself follows " +
-            "as this boot's refusal. A shape reading absent from this line (sessionIncarnationColumn / workflowParkIndexKey / sessionRuleColumn / workflowJournalScopeColumn) belongs to a step that did not " +
+            "as this boot's refusal. A shape reading absent from this line (workflowParkIndexKey / sessionRuleColumn / workflowJournalScopeColumn) belongs to a step that did not " +
             "finish; sessionRuleColumn absent after session_rule_row_old_grammar_entries lines means the column still carries its in-progress name — the next boot rewrites the " +
             "remaining rows (rows already rewritten are left alone) and publishes the final name",
     });

package/dist/plugins/outcome-ledger-sql.d.ts

@@ -89,7 +89,7 @@ export declare function coreOutcomeToLedgerRow(o: CoreTaskOutcome): TaskOutcome;
  * drop-and-recreate, and NO new `ALTER TABLE` seams are added here; fold into the CREATE instead.
  */
 export declare const PG_OUTCOME_LEDGER_SCHEMA: string[];
-/** S-287:本 store 的索引**声明**(两方言共用一份)。PG 侧由下面的 `ensurePgOutcomeLedgerSchema` 应用,MySQL 侧由 `tidb-pool.ts` 的中央 `ensureSchema` 应用(那里内联 `KEY` 已在 `CREATE TABLE` 里 ⇒ 新建库探到即零 DDL,存量库缺谁补谁)。加索引以外的 schema 变更仍归运维,见 `plugins/ensure-index.ts` 头注。 */
+/** [ref]:本 store 的索引**声明**(两方言共用一份)。PG 侧由下面的 `ensurePgOutcomeLedgerSchema` 应用,MySQL 侧由 `tidb-pool.ts` 的中央 `ensureSchema` 应用(那里内联 `KEY` 已在 `CREATE TABLE` 里 ⇒ 新建库探到即零 DDL,存量库缺谁补谁)。加索引以外的 schema 变更仍归运维,见 `plugins/ensure-index.ts` 头注。 */
 export declare const OUTCOME_LEDGER_INDEXES: readonly IndexSpec[];
 /** Idempotent self-contained PG schema apply (for the integration test; central aggregation via pg-pool.ts). */
 export declare function ensurePgOutcomeLedgerSchema(pool: PgPool | PoolClient): Promise<void>;

package/dist/plugins/park-commit-watch.d.ts

@@ -1,5 +1,5 @@
 /**
- * 🔴 **S-929 F1(7.108.0 [ref] 合并复审 codex 腿 A ①,[high] 回归修)—— park 提交的唯一观察点。**
+ * 🔴 **[ref] F1(7.108.0 [ref] 合并复审 codex 腿 A ①,[high] 回归修)—— park 提交的唯一观察点。**
  *
  * core 的 durable park 就是对本仓 checkpoint 店的一次 `put`(SQL 孪生 / 本地文件店都是本仓的 `CheckpointStore` 实现,
  * 一只实例、四个消费点 —— 见 `boot/stage-06-runners.ts` 的构造注)。审批协调器交出 park 路由(ask 回调返回 `"unavailable"`)
@@ -19,7 +19,7 @@
  * **已提交**的 park 报成失败;一只不收尾的订阅者会把 core 的停驻挂住(订阅者自己给自己的工作上墙钟上限)。
  * 两个订阅者,各管一件「这只停车行提交了」之后的事:
  *  · 审批协调器 —— 有序关停下写候着的审计 settle 行(sink 自吞失败并按 [ref] 留痕,同 tag 扩射程,见协调器);
- *  · 对账收敛器 —— S-1280:这次调用的 `PARKING` 行在这一拍收口成 `PARKED`(判据 1 那一只判官的即时调用,`approval-reconciler.ts`
+ *  · 对账收敛器 —— [ref]:这次调用的 `PARKING` 行在这一拍收口成 `PARKED`(判据 1 那一只判官的即时调用,`approval-reconciler.ts`
  *    `bindCommittedPark`;它自带墙钟预算、失败只留痕,周期扫兜底)。`put` 等它(至多到它的预算)⇒ 健康时 core 的停驻返回之时行已收口;
  *    预算到点它就交还 `put`、不再发新的店调用,已发出的那一次经 {@link ParkCommitWatch.track} 留在在飞里 ⇒ 收尾链的 `quiesce`
  *    在 `backend.close()` 之前等到它落定。
@@ -46,7 +46,7 @@ export interface ParkCommitWatch {
     onParkCommitted(listener: ParkCommittedListener): void;
     /**
      * 把订阅者在 `put` 交还之后**仍可能在跑**的那段工作记进在飞:`quiesce` 等它落定(成功或失败都算落定),返回同一个 promise。
-     * 用途(S-1280):订阅者给自己的工作上了墙钟预算,到点就把 `put` 交还 core —— 而此刻已经发出的那次店调用还没回来;不记进来,
+     * 用途([ref]):订阅者给自己的工作上了墙钟预算,到点就把 `put` 交还 core —— 而此刻已经发出的那次店调用还没回来;不记进来,
      * 收尾链会读到「静默」并在它底下关池。
      */
     track<T>(work: Promise<T>): Promise<T>;

package/dist/plugins/permission-rule-store-file.d.ts

@@ -12,9 +12,9 @@ import { type RuleCandidate } from "@sema-agent/core";
 export declare class FileRuleApprovalRecordStore implements RuleApprovalRecordStore {
     private readonly rows;
     private readonly log;
-    /** 本面的损坏闸(S-582 起由重放属主交回;置位后每个方法第一行响亮拒)。 */
+    /** 本面的损坏闸([ref] 起由重放属主交回;置位后每个方法第一行响亮拒)。 */
     private readonly gate;
-    /** @param warn 腐读披露座(S-582;缺席 ⇒ 属主退回 `console.warn`)。 */
+    /** @param warn 腐读披露座([ref];缺席 ⇒ 属主退回 `console.warn`)。 */
     constructor(dir: string, warn?: Logger["warn"]);
     /** 取证/自证用:本面是否因内部损坏而 fail-closed。 */
     get corrupt(): boolean;
@@ -42,11 +42,11 @@ export declare class FileRuleApprovalRecordStore implements RuleApprovalRecordSt
 export declare class FileRuleImportTicketStore {
     private readonly rows;
     private readonly log;
-    /** 本面的损坏闸(S-582 起由重放属主交回)。 */
+    /** 本面的损坏闸([ref] 起由重放属主交回)。 */
     private readonly gate;
     /** 单调钟(判定用)。与 {@link now}(墙钟,记账用)是两只不同的钟,别混。 */
     private readonly monotonic;
-    /** @param warn 腐读披露座(S-582;缺席 ⇒ 属主退回 `console.warn`)。 */
+    /** @param warn 腐读披露座([ref];缺席 ⇒ 属主退回 `console.warn`)。 */
     constructor(dir: string, now?: () => number, warn?: Logger["warn"], monotonic?: () => number);
     private readonly now;
     /** 取证/自证用:本面是否因内部损坏而 fail-closed。 */
@@ -105,7 +105,7 @@ export interface FilePermissionRuleStores extends PermissionRuleStoreBundle {
  * `onError` 接的是 core 规则文件的**披露面**(读不出来 / 校验和不符 / 撞上符号链接时它答零规则并
  * 说出来)。接住它打一条 warn 是**必须**的:那条路径上「零规则」与「真的没有规则」在读面上同形,
  * 不留痕就变成一次静默的 fail-closed(用户会突然被反复询问,却没有任何线索)。
- * `warn`(S-582)接的是本仓审批记录 / 导入票两份日志的**腐读座**(逐行披露 + 计数;缺席 ⇒ `console.warn`)。
+ * `warn`([ref])接的是本仓审批记录 / 导入票两份日志的**腐读座**(逐行披露 + 计数;缺席 ⇒ `console.warn`)。
  */
 export declare function createFilePermissionRuleStores(root: string, opts?: {
     onError?: (message: string) => void;

package/dist/plugins/permission-rule-store-file.js

@@ -4,28 +4,19 @@ import { readdirSync } from "node:fs";
 import { performance } from "node:perf_hooks";
 import { FileDurableRulePartitionProvider, AppendLog, ensureDir, } from "@sema-agent/core";
 import { z } from "zod";
-import { DurableRuleScopeSchema, buildRulePayloadHash } from "./permission-rule-store-sql.js";
+import { DurableRuleScopeSchema, RuleOffer2Schema, buildRulePayloadHash, recordOwnerOf, refusedOwnerSentence } from "./permission-rule-store-sql.js";
 import { replayJsonlGuarded } from "../observability/corrupt-read-seat.js";
-import { EDITED_RULE_BREADTH_WARNING_CODES, RULE_APPROVAL_KINDS, RULE_APPROVAL_RECORD_SCHEMA, RULE_APPROVAL_STATES, RULE_BEHAVIORS, RULE_OWNER_KINDS, UNCOVERED_SEGMENT_REASONS } from "@sema-agent/core";
+import { EDITED_RULE_BREADTH_WARNING_CODES, RULE_APPROVAL_KINDS, RULE_APPROVAL_RECORD_SCHEMA, RULE_APPROVAL_STATES, RULE_BEHAVIORS, readRuleOwner } from "@sema-agent/core";
 const RuleDotSchema = z.object({ actor: z.string().min(1), counter: z.number().int().nonnegative().safe() }).strict();
 const RuleCandidateSchema = z.object({ behavior: z.enum(RULE_BEHAVIORS), rule: z.string(), scope: DurableRuleScopeSchema }).strict();
-const RuleOffer2Schema = z.union([
-    z.object({ kind: z.literal("single"), candidate: z.number().int().nonnegative().safe() }).strict(),
-    z
-        .object({
-        kind: z.literal("batch"),
-        candidates: z.array(z.number().int().nonnegative().safe()),
-        segments: z.array(z.string()).optional(),
-        uncoveredSegments: z.number().int().nonnegative().safe().optional(),
-        uncoveredDetail: z.array(z.object({ segment: z.string(), reason: z.enum(UNCOVERED_SEGMENT_REASONS) }).strict()).optional(),
-    })
-        .strict(),
-]);
-const OWNER_SHAPE_BY_KIND = {
-    principal: z.object({ kind: z.literal("principal"), principal: z.string() }).strict(),
-    "local-owner": z.object({ kind: z.literal("local-owner") }).strict(),
-};
-const RuleOwnerSchema = z.union([OWNER_SHAPE_BY_KIND.principal, OWNER_SHAPE_BY_KIND["local-owner"]]);
+const RuleOwnerSchema = z.unknown().transform((raw, ctx) => {
+    const owner = readRuleOwner(raw);
+    if (owner === undefined) {
+        ctx.addIssue({ code: "custom", message: "not a rule owner (the engine's readRuleOwner reads none: a plain record whose kind is a member and, for a principal, whose name is not empty or whitespace-only)" });
+        return z.NEVER;
+    }
+    return owner;
+});
 const ApprovalRecordSchema = z
     .object({
     id: z.string().min(1),
@@ -163,6 +154,8 @@ export class FileRuleApprovalRecordStore {
     }
     async create(record) {
         this.gate.assertUsable();
+        if (recordOwnerOf(record) === undefined)
+            throw new Error(refusedOwnerSentence(record.id));
         if (this.rows.has(record.id))
             throw new Error(`rule approval record ${record.id} already exists`);
         this.log.append({ op: "put", record }, true);