@sema-agent/server 7.135.0 → 7.137.0

package/dist/plugins/one-time-migrations.js

@@ -1,13 +1,13 @@
-import { SESSION_RULES_GRAMMAR, compileSessionRuleBucket, isGateKind, readSessionRulesShape, unreadableDenyEntries } from "@sema-agent/core";
+import { compileSessionRuleBucket, isGateKind, readSessionRulesShape, unreadableDenyEntries } from "@sema-agent/core";
 import { APPROVAL_GATE_KINDS, ASK_USER_QUESTION_TOOL_NAME, isApprovalGateKind } from "../approval-content-kind.js";
-import { APPROVAL_CARD_COLUMN_MAX_BYTES, buildCheckpointIndexCells } from "./checkpoint-index-columns.js";
+import { judgeCheckpointIndexCells } from "./checkpoint-index-columns.js";
 import { dialectProtocolJsonEncoder } from "./sql-driver.js";
 import { SCHEMA_STATEMENTS, acquireEnsureSchemaLock, releaseEnsureSchemaLock } from "./tidb-pool.js";
 import { PG_SCHEMA_STATEMENTS, acquirePgEnsureSchemaLock, releasePgEnsureSchemaLock } from "./pg-pool.js";
 import { CENTRAL_SCHEMA_INDEXES } from "./schema-indexes.js";
 import { ensureIndexes } from "./ensure-index.js";
 import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readNonNullJsonValueColumn, readOpaqueJsonValueColumn, } from "./sql-json-column.js";
-import { SESSION_META_INCARNATION_COLUMN, incarnationFromCell, mintSessionIncarnation, sessionFaceFromRow } from "../session-incarnation.js";
+import { incarnationFromCell, sessionFaceFromRow } from "../session-incarnation.js";
 import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR } from "./store-contracts.js";
 import { PERMISSION_RULE_TABLE, purgeUndurableScopeRows } from "./permission-rule-store-sql.js";
 import { SESSION_RULES_COLUMN } from "./session-rules-column.js";
@@ -19,7 +19,6 @@ import { MAILBOX_KEYED_TABLES, mailboxKeyDeleteSql, storedMailboxKeyless } from
 const RETIRED_SESSION_RULE_BUCKETS = ["commandAllow", "commandDeny"];
 export function buildMigrationReceipts() {
     return {
-        sessionIncarnationsBackfilled: 0,
         holderDeathCodeRowsBackfilled: 0,
         allowRuleShadowRowsMigrated: 0,
         allowRuleShadowRowsUnreadable: 0,
@@ -49,16 +48,14 @@ export function buildMigrationReceipts() {
     };
 }
 function completedReport(r) {
-    const { sessionIncarnationColumn, workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn } = r;
-    if (sessionIncarnationColumn === undefined || workflowParkIndexKey === undefined || sessionRuleColumn === undefined || workflowJournalScopeColumn === undefined) {
-        throw new Error(`one-time migrations finished without settling a shape reading (M5 ${String(sessionIncarnationColumn)} / M9 ${String(workflowParkIndexKey)} / M17 ${String(sessionRuleColumn)} / M24 ${String(workflowJournalScopeColumn)}) — a step did not record it`);
+    const { workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn } = r;
+    if (workflowParkIndexKey === undefined || sessionRuleColumn === undefined || workflowJournalScopeColumn === undefined) {
+        throw new Error(`one-time migrations finished without settling a shape reading (M9 ${String(workflowParkIndexKey)} / M17 ${String(sessionRuleColumn)} / M24 ${String(workflowJournalScopeColumn)}) — a step did not record it`);
     }
-    return { ...r, sessionIncarnationColumn, workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn };
+    return { ...r, workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn };
 }
 function changedAnything(r) {
-    return (r.sessionIncarnationColumn === "added" ||
-        r.sessionIncarnationsBackfilled > 0 ||
-        r.holderDeathCodeRowsBackfilled > 0 ||
+    return (r.holderDeathCodeRowsBackfilled > 0 ||
         r.allowRuleShadowRowsMigrated > 0 ||
         r.allowRuleShadowRowsUnreadable > 0 ||
         r.workflowParkIndexKey === "reshaped" ||
@@ -122,18 +119,6 @@ export class OneTimeMigrationInterruptedError extends Error {
     }
 }
 export const ONE_TIME_MIGRATIONS = [
-    {
-        id: "M5",
-        introducedIn: "7.104.0",
-        releasedOn: "2026-09-28",
-        removableAfter: "2026-10-28",
-        removal: "删 migrateOn 的 M5 步(`session_meta` 在场探针、`incarnation` 列在场探针 + `ADD COLUMN`、空化身回填循环)与 `backfillSessionIncarnations`;" +
-            "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `sessionIncarnationColumn` / `sessionIncarnationsBackfilled`;**列本身留在中央 DDL 里**(它不是迁移的一部分)",
-        afterRemoval: "① 列不在的存量库:起服列册探针 `schema-consistency.ts`(S-547)的缺列臂拒启 `config.schema_mismatch`,拒句里的 `ALTER TABLE … ADD COLUMN` " +
-            "由同一份 DDL 生成(响亮);② 列在但行上仍是空化身(跳过了带 M5 的版本直接升):会话店头读投成活住客(`sessionFaceOfHead`)时对那一行响亮拒 " +
-            "`session.incarnation_missing`(parked 决定腿因此拒、记忆座退回按 id 绑定并 warn)—— 运维手工给那些行填一只随机令牌即可",
-        reportKeys: ["sessionIncarnationColumn", "sessionIncarnationsBackfilled"],
-    },
     {
         id: "M6",
         introducedIn: "7.116.0",
@@ -225,7 +210,8 @@ export const ONE_TIME_MIGRATIONS = [
         removal: "删模式词读法记号的判据与拒臂:`http/stored-body-replay.ts` 的 `permissionModeReadingUnstated`;`http/checkpoint-ctx.ts` 的 `permissionModeReadingStated` / `permissionModeReadingRefusal` / `PERMISSION_MODE_READINGS`、" +
             "`StoredBodyReplayRefusal` 的 `permission_mode_reading` 臂及其日志字段与答复臂、`buildCheckpointCtx` 与 `withPermissionModeRewritten` 两处记号写点" +
             "(后者删后 `resume-legs.ts` `drivePlanReview` 里对它的那一处调用回到只换体的 `{ ...ctx, body }`)、`CheckpointCtx.permissionModeReading`、" +
-            "`http/stored-body-replay.ts` 里 `StoredReplayDeployment` 的 `autonomy` 位与 `storedBodyReplayRefusal` 读 `deployment.autonomy` 的那一句(这一位只服务这一问;四个问点传 `deps.config` 整份,home 位还服务 `permissions` 一问,不动)",
+            "`http/stored-body-replay.ts` 里 `StoredReplayDeployment` 的 `autonomy` 位与 `storedBodyReplayRefusal` 读 `deployment.autonomy` 的那一句(这一位只服务这一问;四个问点传 `deps.config` 整份,home 位还服务 `permissions` 一问,不动);" +
+            "`test/stored-request-prompt-profile-m30.test.ts` 的 SHARED 表里 `StoredBodyReplayRefusal` 那一行(rows 含 M12;M30 的登记行组已先删时该表已不在,这一句无事可做):rows 去掉 M12、整行并入同文件的 SITES(值 = 该行的 files 数组)",
         afterRemoval: "没有响亮臂:删码之后仍停驻、在 7.121.x 及以前写下的行(把 `APPROVAL_TERMINAL_BACKSTOP_MS` 调长的部署,或跳过了带本条的版本直接升的库)在设了 " +
             "`AUTONOMY=plan` 的部署上按体里的原词重放(运维的 plan 不再被按段重钳)—— 升级前把这些停驻的 run 决掉 / 取消,或升级窗内设 `AUTONOMY=read-only`",
         reportKeys: [],
@@ -237,26 +223,13 @@ export const ONE_TIME_MIGRATIONS = [
         removableAfter: "2026-11-09",
         removal: "删 `config-lkg.ts` 的 formatVersion 2 读回迁移:`migrateV2Lkg` / `migrateDroppedIdentityRow` / `RETIRED_CATALOG_COORDINATE` 与其上的窗注;`loadLkg` 的 2 臂" +
             "(版本判据里的 `2` 与 `formatVersion === 2 ? migrateV2Lkg(…)` 那一支 —— 2 回到「unknown formatVersion」拒)、返回型的 `migrated` 位与 JSDoc 里说它的那一行、" +
-            "文件头注「2 读回时一次性迁移」那一句;`boot/web-admin.ts` 读 `read.migrated` 打 `config_lkg_migrated` 的那一行(formatVersion 1 迁移的同名事件那一行留);" +
-            "`migrateV1Lkg` 里不带 v1 的 etag 那一句旁注对 `migrateV2Lkg` 的引用(不带 etag 的规则本身留 —— v1 载荷同样没有完整的被丢条目记录);契约 §A.1d " +
+            "文件头注「2 读回时一次性迁移」那一句;`boot/web-admin.ts` 读 `read.migrated` 打 `config_lkg_migrated` 的那一行(这一行与 M15 / M22 的读回迁移共用 —— 三条都删完才整段删,先删 M13 时只去掉信封 2 → 3 那一路的 `migrated` 来源);契约 §A.1d " +
             "`droppedEntries` 一节「升级窗(如实)」那一条与 §A.1d `[config.model_refused_name_minted]` 那一条里「LKG 载体 `droppedIdentities` 读回时一次性迁移」那半句;手写 formatVersion 2 信封的测试夹具" +
             "(`test/config-lkg.test.ts`、`test/config-hot/batch1-version-ordinal.test.ts` 改写成 3;`test/models-dropped-entries-s1295.test.ts` 的旧 LKG 迁移格改钉 2 读回不可用)",
         afterRemoval: "既有响亮臂 `config_lkg_unusable`(`loadLkg` 对 2 答「unknown formatVersion 2」):2 读回 ⇒ 不可用,中心可达照拉(整拉,读腿铸出完整载体,新 LKG 按 3 覆盖)、" +
             "断着则 env 兜底,下一份干净候选重写 —— 与回滚到 7.122.0 读 3 同一种处置",
         reportKeys: [],
     },
-    {
-        id: "M14",
-        introducedIn: "7.99.0",
-        releasedOn: "2026-09-24",
-        removableAfter: "2026-10-24",
-        removal: "删 `config-lkg.ts` 的 formatVersion 1 迁移:`legacyV1LkgPath` / `migrateV1Lkg` 与其上的窗注(`loadLkg` 的 1 臂今天已是拒句,不动);" +
-            "`boot/web-admin.ts` `bootFromLkg` 里调用 `migrateV1Lkg` 的那一段(含它打 `config_lkg_migrated` / 推不出身份时响亮拒的那两行);" +
-            "`migrateV1Lkg` 的测试格(`test/config-lkg.test.ts` v1 迁移组)",
-        afterRemoval: "既有响亮臂 `config_lkg_unusable`(`loadLkg` 对 1 答「pre-identity LKG (formatVersion 1) — not read back …」):旧默认路径上的 v1 文件不再被迁进箱、" +
-            "原样留在盘上;中心可达照拉(整拉,新 LKG 按现行箱名落盘)、断着则 env 兜底",
-        reportKeys: [],
-    },
     {
         id: "M15",
         introducedIn: "7.124.0",
@@ -322,10 +295,15 @@ export const ONE_TIME_MIGRATIONS = [
         releasedOn: "2026-10-16",
         removableAfter: "2026-11-15",
         removal: "删 `src/stored-request-tool-axes-m19.ts` 整只文件(`storedToolAxesRereadM19` / `readToolAxesAsServer7129M19` / `readA2aToolAxesAsServer7131M19` / `StoredToolAxesRereadM19`);" +
-            "`boot/resolve-spec.ts` 里两条请求腿共用的那一行(`const storedToolAxes = opts?.leg === \"fresh\" ? undefined : storedToolAxesRereadM19(…)`)、递给 `resolveRequestMcp` / `resolveRequestA2a` 的两处实参与它的 import;" +
+            "`boot/resolve-spec.ts` 里两条请求腿共用的那一行(`const storedToolAxes = opts?.leg === \"fresh\" ? undefined : storedToolAxesRereadM19(…)`,在腿首、A2A 快照之前求值)、" +
+            "`snapshotRequestA2a(…, { reread: storedToolAxes !== undefined })` 的第二实参、`parts` 里的 `storedToolAxes`(类型与解构)、递给 `resolveRequestMcp` / `resolveRequestA2a` 的两处实参与它的 import;" +
             "`task-mcp.ts` 里 `resolveRequestMcp` / `classifyRequestMcp` / `classifyHonored` / `validateRequestMcpEntries` / `normalizeServer` 的 `storedToolAxes` 形参、" +
             "`toolAxesReread` 事实与运维行 `mcp_tool_axes_read_as_before_upgrade`,以及对本模块的型 import(升级前读法的词表与两只谓词住在本模块里,随它一起删);" +
-            "`task-a2a.ts` 里 `resolveRequestA2a` / `validateRequestA2aEntries` / `normalizeA2aPeer` 的 `storedToolAxes` 形参、`toolAxesReread` 事实与运维行 `a2a_tool_axes_read_as_before_upgrade`、对本模块的型 import;" +
+            "`task-a2a.ts` 里 `resolveRequestA2a` / `validateRequestA2aEntries` / `normalizeA2aPeer` 的 `storedToolAxes` 形参、`toolAxesReread` 事实与运维行 `a2a_tool_axes_read_as_before_upgrade`、对本模块的型 import," +
+            "以及只为重读座存在的克隆机器的全部名字:`cloneDeclaration` / `DeclarationClone` / `CloneFrame` / `openCloneNode` / `putCloneMember`、快照类型 `PeerSnapshot` 的字段 `toolAxesDeclared` 与 `mintPeerSnapshot` / `snapshotPeer` / `snapshotRequestA2a` 的 `reread` 形参、`toolAxesNotCloneableIssue`、读器里 `declared` 那一臂(`node:util` 的 `types` 与 `errorKindOf` 的 import 若再无别的读者一并删);" +
+            "随克隆一起退役的两句例外文字:`USAGE.md` 里 `a2a_injection_dropped` 条目 `reason` 那句「只有一臂例外 … `declaration not cloneable (<because>) — …`」与 `task-a2a.ts` 里 `A2aInjectionDrop.reason` 注的同一句例外(删后 `reason` 恒与 400 拒句同一句,回到「逐字同一句」不带例外);" +
+            "`test/task-a2a.test.ts` 里的克隆钉(标题去掉开头的 `🔴 ` 后以 `克隆钉:` 开头的各格,整格删;按这个精确前缀删,不按标题里的「M19 重读」之类泛词删 —— 那会误删同文件里的通用不变式钉),以及三格不带前缀、删码后要改写的钉:`需要「读」的两个键…` 那格的 `readRequestToolAxes` 调用方名单(`normalizeA2aPeer` 只在 M19 重读臂里调它,删后名单只剩 `mintPeerSnapshot`,标题里「与读器里 M19 重读产物的那一次」半句同删)、`读器与门的差别只有三格…` 改成两格(删 ③ 的注释行与标题里的 ③)、`请求入口快照的形…` 里 `snapshotRequestA2a(…, { reread: false })` 的第二实参(删 `reread` 形参后改成单参);" +
+            "`test/one-time-migration-window-gate.test.ts` 里 M19 一节中与克隆有关的三格(声明抽取器正负控 · 删法条与克隆名字两向对账 · 克隆钉标题前缀对账)与它们共用的帮手 `declaredNames`;" +
             "`test/mcp-tool-axes-m19.test.ts`(窗关那一格 —— 存量坏形整条不进、warn 与通告点名 `field: toolAxes` —— 改钉到 `test/task-mcp.test.ts`);" +
             "本文件的 `migrationWindowOpen`(若再无别的读者)",
         afterRemoval: "没有新的臂,接住它的是今天的读法(删码零行为变化:窗关那一刻起重读臂已经不生效):升级前存下的请求体里引擎判官判不过的 `toolAxes`,续跑重放时这一条 server 整条不进," +
@@ -451,8 +429,13 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.134.0",
         releasedOn: "2026-10-21",
         removableAfter: "2026-11-20",
-        removal: "删 `src/checkpoint-ctx-seal-m28.ts` 整个文件与起服第 6 段对它的那一处调用;两孪生的店腿 `rewriteCtxRowsM28` 与读数型 `CtxRowsRewriteM28`;" +
-            "`http/checkpoint-ctx.ts` 的 `sealStoredCheckpointCtxM28`;`test/checkpoint-ctx-seal-m28.test.ts` 与 `test/checkpoint-ctx-credential-seal-db-integration.test.ts` 的 M28 格。" +
+        removal: "删 `src/checkpoint-ctx-seal-m28.ts` 整个文件(`sealCheckpointCtxCredentialsM28`)与起服第 6 段(`src/boot/stage-06-runners.ts`)顶部对 `sealCheckpointCtxCredentialsM28` 的 import 行与对它的那一处调用(连同起服 info 行 `checkpoint_ctx_credentials_sealed`);两孪生共有的 ctx 行改写店腿(`src/plugins/checkpoint-store-sql.ts` 与 `src/plugins/local-checkpoint-store.ts` 里的 `rewriteCtxRows` / `CtxRowsRewrite` / `CtxRowRewrite` / `CheckpointCtxRowsRewriter` / 扫描页 `CTX_REWRITE_PAGE`)只在本表再无别的条目用它时(今天 M30 也用)一起删;店腿删时 `test/checkpoint-ctx-sealed-brand.test.ts` 里 `rewriteCtxRows` 的断言(`@ts-expect-error` 与 `void local.rewriteCtxRows(` 两行)一起删 —— 店腿不在后那一行的 tsc 错变成「属性不存在」,`@ts-expect-error` 照样满足,断言静默变空 —— 同文件 `putCtx` 的常设断言保留;**店腿格不随本条删**:`test/checkpoint-ctx-rows-rewrite-db-integration.test.ts`(店腿自己的 CAS / 分页 / 一行装不下三格)与 `test/checkpoint-ctx-rows-rewrite-local.test.ts`(读不出的档 / 信封 updatedAt 不动两格)用中性的行改写、不借任何一条迁移的函数,店腿还有用户时它们要活着;店腿删时两个文件整文件随店腿删,`scripts/db-integration-files.json` 里 db 那个文件的行同删;店腿删时的同族注释(店腿是两条迁移共用的,谁后删谁做;两条 removal 都点名,逐条同字面):`src/http/checkpoint-ctx.ts`:「与一次性迁移的 ctx 行改写店腿(`rewriteCtxRows`)」删;`test/checkpoint-ctx-sealed-brand.test.ts`:「与 ctx 行改写回调(M28 / M30 共用)」删、「,M28 行改写回调交回裸对象 —— 三处都是 tsc 错」改成「 —— 两处都是 tsc 错」;`test/checkpoint-ctx-credential-seal-db-integration.test.ts`:「另有各随一条一次性迁移的格」起到「别的文件的行一个都不碰);」止整段删;" +
+            "`http/checkpoint-ctx.ts` 的 `sealStoredCheckpointCtxM28`;`test/checkpoint-ctx-seal-m28.test.ts` 整个文件与 `test/checkpoint-ctx-credential-seal-db-integration.test.ts` 里的「[M28] 明文旧行」那一格(它调 `sealStoredCheckpointCtxM28`);" +
+            "`test/doc-claims-upgrade-notes.test.ts` ㊵ 组里读这处调用与日志行的三行断言随删(两格本身与其余断言留着;不删就是删码后这两格红):「锚(嵌入方段的每件事实读实现)」格的 `callSites(\"sealCheckpointCtxCredentialsM28\")` 一行;" +
+            "「锚(恢复句的每件事实读实现)」格里 guarded 上对 `sealCheckpointCtxCredentialsM28` 调用的断言与对 `logger.info(\"checkpoint_ctx_credentials_sealed\"` 日志行的断言两行;" +
+            "`test/stored-request-prompt-profile-m30.test.ts` 里钉起服第 6 段调用次序的那一格(`describe` 名含「起服接线」;M30 删码时才删它,M28 的窗先关,先删 M28 时它要活着)里读 M28 调用位置的 `const m28` 那一行(它用 indexOf 找 `sealCheckpointCtxCredentialsM28` 的调用)与「M28 在那一臂里」「M30 在那一臂里、M28 之后」两条断言,改成只相对 `guard` 比较 M30 的位置;" +
+            "依赖本行的格(行一删就红):doc-claims ㊵ 的「嵌入方一段分清两只迁移的窗」格(读 M28 / M30 两行的窗末日;哪一行先删就先删这一格,MIGRATION 7.137.0 节的文字是已发布的历史、留着不动),`test/stored-request-prompt-profile-m30.test.ts` 里「M28 登记行」组整组随删(组内三格都读 M28 行的 `removal`:「M28 的 removal 同样点名」「M28 删法条补四类漏项」「同一注释半句只归一条 removal」)、同文件 SHARED 表里 rows 含 M28 的五行改成只剩 M30 并入 SITES(M30 的登记行组已先删时该表已不在,这一句无事可做);" +
+            "同族注释(每个半句只归本条或 M30 条之一,不重复改;标〔另一条的〕的几处住在另一条迁移的文件 / 头注段里,那条已先删则宿主已不在,跳过):`src/http/checkpoint-ctx.ts`:「一次性迁移 M28 对存量行用同一只走法」删、「({@link sealStoredCheckpointCtxM28})」删、「、{@link sealStoredCheckpointCtxM28}」删、「(开口与 M28 同一只)」删、「(更早版本写下、M28 还没扫到)」改成「(更早版本写下)」、「读写两侧与一次性迁移 M28 共用」改成「读写两侧共用」、「已落盘的行由 M28 补封」改成「已落盘的行不补封(要补封须另起迁移)」、「M28 封的是」起到「窗外加位要另起迁移)。」止整段删、「(读写两侧与 M28 共用这一只)」改成「(读写两侧共用这一只)」、「(开口与 M28 共用这一只判词,闭集三词)」改成「(开口用这一只判词,闭集三词)」、「开口去开它;M28 不动它;」改成「开口去开它;」、「M28 把它封好;」删、「M28 不动它(留给读口响亮拒)」改成「(留给读口响亮拒)」、「封口 / 开口 / M28 共用的那一只」改成「封口 / 开口共用的那一只」;`src/sealed-key.ts`:「起服的一次性迁移 M28 会用它把还读得懂的明文行换成谁都开不开的密文」改成「新写的停驻行会被封成谁都开不开的密文」;`src/boot/web-admin.ts`:「与一次性迁移 M28(stage-06)」删、「M28 会拿它毁掉还读得懂的行」改成「新写的停驻行会被封成谁都开不开的密文」;`src/boot/stage-06-runners.ts`:「也是一次性迁移 M28 要它的地方。M28 在任何路由装配之前跑(窗外不扫;读数一行 info)。」删、「排在 M28 之后」删;`src/plugins/checkpoint-store-sql.ts`:「M28(凭据位明文封好)」删;`src/stored-request-prompt-profile-m30.ts`:〔另一条的〕「,与 M28 同一只」删、〔另一条的〕「本条与 M28 同在起服第 6 段」改成「本条在起服第 6 段」、〔另一条的〕「(M28 用同一只)」删;`src/plugins/one-time-migrations.ts`:〔另一条的〕「起服第 6 段 M28 之后调一次」改成「起服第 6 段调一次」、〔另一条的〕「店腿是两孪生共有的 `rewriteCtxRows`,与 M28 同一只」改成「店腿是两孪生共有的 `rewriteCtxRows`」;`test/owner-gate-single-owner.test.ts`:「两只封口 `sealCheckpointCtx` / `sealStoredCheckpointCtxM28` 经它」改成「封口 `sealCheckpointCtx` 经它」;`test/drain-check-local.test.ts`:「封口 / 开口 / M28 共用的凭据位遍历器」改成「封口 / 开口共用的凭据位遍历器」;`test/checkpoint-ctx-credential-seal.test.ts`:「(否则 M28 会把可用的明文行换成谁都开不开的密文)」改成「(否则新写的停驻行会被封成谁都开不开的密文)」;`test/helpers/ctx-sealing.ts`:「 / M28 的行改写」删;`test/checkpoint-ctx-credential-seal-db-integration.test.ts`:「/ `checkpoint-ctx-seal-m28.test.ts`」删、「窗与读数那一层在 local 半场(`checkpoint-ctx-seal-m28.test.ts`)钉」起到「两半场共用同一只行改写 `sealStoredCheckpointCtxM28`。」止整段删;`test/checkpoint-ctx-sealed-brand.test.ts`:「与 M28 的行改写(`sealStoredCheckpointCtxM28`)」删;" +
             "**不随本条删**:凭据位密封的常设规则(封口 / 开口 / 闭集 / 读口第四态 / 409 码 / 装配期拒启)",
         afterRemoval: "读口对凭据位上明文的常设拒臂接住:跳过了带本条的版本直接升的库,带明文凭据的停驻行续跑答 409 `conflict.checkpoint_ctx_unsealable`(`reason:\"plaintext\"`)," +
             "行字节不动 —— 出路 = 作为新任务重提(仍停驻的先取消),或升级时先过一次带本条的版本",
@@ -463,20 +446,54 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.135.0",
         releasedOn: "2026-10-22",
         removableAfter: "2026-11-21",
-        removal: "删 migrateOn 的 M29 步(`backfillParkedApprovalCards`:列在场探针、pending 候选分页扫描、整只文档读 + 同一只派生 + CAS 写列)与 `PARKED_CARD_BACKFILL_PAGE` / `readM29Document` / `m29CardOf`;" +
+        removal: "删 migrateOn 的 M29 步(`backfillParkedApprovalCards`:列在场探针、pending 候选分页扫描、整只文档读 + 写口那一只判官 + CAS 写列)与 `PARKED_CARD_BACKFILL_PAGE` / `readM29Document` / `m29Judge`;" +
             "报告、日志行(含逐行的 `parked_approval_card_row_unreadable` / `parked_approval_card_row_too_long`)与 `NO_SQL_MIGRATIONS` 的 `parkedApprovalCardsBackfilled` / `parkedApprovalCardRowsUnreadable` / `parkedApprovalCardRowsTooLong`;`test/one-time-migrations.test.ts` 的 M29 组与 " +
             "`test/checkpoint-index-columns-db-integration.test.ts` 的 M29 格。**不随本条删**:`approval_card` 列、写口的派生、到期 facet 的生成谓词(常设)",
         afterRemoval: "没有新的臂(如实):跳过了带本条的版本直接升的库,升级前停驻、升级后仍挂着的行卡列是 NULL —— 生成谓词读门型的 facet(审批门 ⇒ SLA 拒扫腿),问答行到期被拒扫" +
             "(引擎对问答拒收 `sla_timeout`,拒扫腿每拍一条失败,由 `terminal_at_ms` 兜底收割);运维队列行不带卡词。出路 = 升级前答完 / 拒掉停驻的问答,或升级时先过一次带本条的版本",
         reportKeys: ["parkedApprovalCardsBackfilled", "parkedApprovalCardRowsUnreadable", "parkedApprovalCardRowsTooLong"],
     },
+    {
+        id: "M30",
+        introducedIn: "7.137.0",
+        releasedOn: "2026-10-25",
+        removableAfter: "2026-11-24",
+        removal: "删 `src/stored-request-prompt-profile-m30.ts` 整个文件(`retirePromptProfileM30` / `retirePromptProfileRowM30` / `PromptProfileRetireM30Report`)与起服第 6 段(`src/boot/stage-06-runners.ts`)顶部对 `retirePromptProfileM30` 的 import 行与对它的那一处调用(连同起服 info 行 `checkpoint_ctx_prompt_profile_rewritten`);" +
+            "`http/checkpoint-ctx.ts` 的 `rewriteStoredBodyKeys` 与 `CREDENTIAL_SLOT_ROOTS`(若再无别的调用方);两孪生共有的 ctx 行改写店腿(`src/plugins/checkpoint-store-sql.ts` 与 `src/plugins/local-checkpoint-store.ts` 里的 `rewriteCtxRows` / `CtxRowsRewrite` / `CtxRowRewrite` / `CheckpointCtxRowsRewriter` / `CTX_REWRITE_PAGE`)只在本表再无别的条目用它时一起删(今天 M28 也用);店腿删时 `test/checkpoint-ctx-sealed-brand.test.ts` 里 `rewriteCtxRows` 的断言(`@ts-expect-error` 与 `void local.rewriteCtxRows(` 两行)一起删 —— 店腿不在后那一行的 tsc 错变成「属性不存在」,`@ts-expect-error` 照样满足,断言静默变空 —— 同文件 `putCtx` 的常设断言保留;**店腿格不随本条删**:`test/checkpoint-ctx-rows-rewrite-db-integration.test.ts`(店腿自己的 CAS / 分页 / 一行装不下三格)与 `test/checkpoint-ctx-rows-rewrite-local.test.ts`(读不出的档 / 信封 updatedAt 不动两格)用中性的行改写、不借任何一条迁移的函数,店腿还有用户时它们要活着;店腿删时两个文件整文件随店腿删,`scripts/db-integration-files.json` 里 db 那个文件的行同删;店腿删时的同族注释(店腿是两条迁移共用的,谁后删谁做;两条 removal 都点名,逐条同字面):`src/http/checkpoint-ctx.ts`:「与一次性迁移的 ctx 行改写店腿(`rewriteCtxRows`)」删;`test/checkpoint-ctx-sealed-brand.test.ts`:「与 ctx 行改写回调(M28 / M30 共用)」删、「,M28 行改写回调交回裸对象 —— 三处都是 tsc 错」改成「 —— 两处都是 tsc 错」;`test/checkpoint-ctx-credential-seal-db-integration.test.ts`:「另有各随一条一次性迁移的格」起到「别的文件的行一个都不碰);」止整段删;" +
+            "`http/checkpoint-ctx.ts` 的拒句铸点 `retiredRequestKeyRefusal`:模板串里从「If whoever operates this deployment restarts this server on or before 〈窗末日〉 (UTC), the stored request is rewritten in place and the same request can be sent again; otherwise submit」起的整段换成大写开头的「Submit」(窗关后重启不再改写;只删半句会留下句首小写、悬空的 otherwise),模板串变回整句双引号字面 —— 删后整句(逐字;冻结表那一行搬回字面表时也是这一句):「this task was suspended by an earlier server version and its stored request still carries promptProfile, a request key this version no longer reads (it was replaced by the boolean promptLean: classic is promptLean: false, simple is leaving promptLean out), so continuing would run the task with a prompt form it was not submitted with. Nothing was decided and nothing was resumed. Submit the work again as a new task with promptLean in place of promptProfile, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel).」," +
+            "它的第二参数 `rewriteWindowEnd` 同删(定义处与私有的 `storedBodyReplayArmAnswer` 里 `retired_request_key` 臂上的那一处调用),`StoredBodyReplayRefusal` 的 `retired_request_key` 臂上的必填字段 `rewriteWindowEnd` 同删;" +
+            "`src/trace/self-minted-wire.ts` 的 `refusalSentenceForm` 里「409 checkpoint.unsupported_version#retired_request_key」那一行(自铸句型登记):骨架 attr 尾上的「submit the work again」改成「Submit the work again」(删后整句的形),since 改写成删码所在的版本(该表的律:改 attr 的同时改 since);" +
+            "`http/checkpoint-ctx.ts` 的日志字段铸点 `storedBodyReplayLogFields` 里 `retired_request_key` 臂的 `note` 句改成常设拒臂的句子(原句里「the one-time rewrite at startup did not reach it」与「or a restart of this version inside the window rewrites the row」两半删码后成假话,与本行 afterRemoval 的「出路 = 重提」矛盾;" +
+            "改后句:「this session's stored request still carries a request key this version retired and nothing rewrites it any more; it is not replayed — the task stays suspended until someone cancels it and resubmits it as a new task (promptLean in place of promptProfile)」);" +
+            "同族注释(每个半句只归本条或 M28 条之一,不重复改;标〔另一条的〕的几处住在另一条迁移的文件 / 头注段里,那条已先删则宿主已不在,跳过):`src/http/checkpoint-ctx.ts`:「两条出路(运维在一次性迁移的窗内重启本服务 ⇒ 起服改写存体、同一请求可再发;否则作为新任务重提,仍停驻的先取消)」改成「出路(作为新任务重提,仍停驻的先取消)」、「**窗的日期不手写**」起到「删法见登记表 M30 的」止整段删、「存体里的旧键由一次性迁移在起服时原地改写」改成「存体里的旧键没有迁移改写」、「(M30,`stored-request-prompt-profile-m30.ts`,行改写经本模块的 {@link rewriteStoredBodyKeys})。改写不到的残留行」改成「仍带旧键的残留行」、「;存体由 M30 起服改写」删、「与 {@link rewriteStoredBodyKeys}」删、「(存量行非凭据顶层体键的改写,凭据位与读法记号原样随行)」删;`src/http/wire-types.ts`:「由一次性迁移 M30 在起服时按同一张映射原地改写」改成「没有迁移改写」、「(`stored-request-prompt-profile-m30.ts`;M30 · 窗口见 `plugins/one-time-migrations.ts` 登记表)」删;`src/spec-fields.ts`:「由一次性迁移 M30 在起服时改写成 `promptLean`(`stored-request-prompt-profile-m30.ts`),」改成「不改写,」;`src/boot/stage-06-runners.ts`:「M30(存体里的退役请求键 `promptProfile` 原地改写)同在这里、」删、「(同一只 ctx 行改写店腿;不要封签器),同样早于任何续跑入口。」删;`src/plugins/checkpoint-store-sql.ts`:「、M30(退役请求键改写)」删;`src/plugins/one-time-migrations.ts`:〔另一条的〕「M30 用同一只;」删;`src/checkpoint-ctx-seal-m28.ts`:〔另一条的〕「(M30 用同一只)」删;`test/task-agents-876.test.ts`:「体由一次性迁移 M30 在起服时原地改写」改成「体没有迁移改写」;`test/allow-list-reading-park-refusal.test.ts`:「一次性迁移 M30 没改写到的残留」改成「没有迁移改写的残留」;`test/api-error-text-freeze.test.ts`:「一次性迁移 M30 没改写到的残留」改成「没有迁移改写的残留」、「洞 = 窗的最后一天(绝对日期)」起到「不手写。」止整段删;" +
+            "`http/stored-body-replay.ts` 里 `RETIRED_KEY_REWRITE_MIGRATION` 的 JSDoc 随表删;" +
+            "`http/stored-body-replay.ts` 的 `RETIRED_KEY_REWRITE_MIGRATION`(`satisfies Record<RetiredRequestKey, string>`:M30 删后 `promptProfile` 仍是退役键,这张表只能整张删)、" +
+            "判据里 `rewriteWindowEnd: migrationWindowEnd(…)` 那一项与 `migrationWindowEnd` 的引入行;`plugins/one-time-migrations.ts` 导出的 `migrationWindowEnd` 在无别的读者时一起删;" +
+            "冻结表 `test/api-error-text-freeze.test.ts` 的 `FROZEN_RESULT_BODY_TEMPLATE` 里那一行搬回字面表(删完半句后拒句是整句字面);" +
+            "`test/stored-request-prompt-profile-m30.test.ts` 的起服改写组、登记行组、「M28 登记行」组(M28 没先删时它还在:它读本文件顶部的引入与 COMMENTS 表,与登记行组同命)、「M30 起服接线」组(它钉的就是被删的那处调用与起服 info 行)与「M30 的混跑与回滚」组;「M30 的混跑与回滚」组随删:它读登记表头注 M30 段(随本行一起删)与 MIGRATION 7.137.0 节第 4 条(已发布的历史文字,留着不动);doc-claims ㊵ 的「嵌入方一段分清两只迁移的窗」格同样读本行的窗末日,随删(它与 M28 行共读,哪一行先删就先删这一格);「窗关后的残留」组保留,但它里面 (d) 读登记行的 `m30Row()` 用处(期望里的 `rewriteWindowEnd`)与 (d′) 整格随删,`m30Row` 助手随之删;" +
+            "`test/checkpoint-ctx-credential-seal-db-integration.test.ts` 的 M30 格与文件头对 `retirePromptProfileRowM30` 的引入行(模块删后这一行不删就是编译红);" +
+            "`test/stored-request-prompt-profile-m30.test.ts` 顶部:beforeEach / afterEach 钩子与 store / root 夹具、ctxFiles / bodyOf 助手只服务已删各组 ⇒ 随删;连同已删各组用的引入行一起删(对 `retirePromptProfileM30` 与 `migrationWindowEnd` 的引入、ONE_TIME_MIGRATIONS、vitest 的 beforeEach / afterEach / vi、node:fs、node:path、对 `migrationSectionFor`(`./helpers/migration-section.js`,只服务混跑组)的引入与各 helpers 的引入等;模块与导出删后这几行不删就是编译红),本钉自己的 SITES / SHARED / LOCATORS / COMMENTS 四张表与 codeMentions / commentText / renderComment / checkCommentEdit / checkMintSentence 助手(含 CommentEdit 型)与 LEG_COMMENTS 表及它们的引入(ts / eachNode / parseSource / existsSync)随登记行组删;" +
+            "「窗关后的残留」组留下,留下的引入:storedBodyReplayRefusal、storedBodyReplayAnswer、makeConfig、CheckpointCtx 与 vitest 的 describe / expect / it;legacyBody 助手与它用的 TaskRequestBody 也留着;" +
+            "`test/doc-claims-upgrade-notes.test.ts` ㊵ 组里读这处调用与日志行的三行断言随删(两格本身与其余断言留着;不删就是删码后这两格红):「锚(嵌入方段的每件事实读实现)」格的 `callSites(\"retirePromptProfileM30\")` 一行;" +
+            "「锚(恢复句的每件事实读实现)」格里 guarded 上对 `retirePromptProfileM30` 调用的断言与对 `logger.info(\"checkpoint_ctx_prompt_profile_rewritten\"` 日志行的断言两行。" +
+            "**不随本条删**:续跑判据的第四问(退役请求键闭集 `RETIRED_REQUEST_KEYS` / `retiredRequestKeyOf` / `retiredRequestKeyRefusal`,常设)",
+        afterRemoval: "续跑判据第四问的常设拒臂接住:跳过了带本条的版本直接升的库(或窗内从没起过本版的部署),体里仍带 `promptProfile` 的停驻行续跑在五个问点上答 409 `checkpoint.unsupported_version`" +
+            "(判据 `retired_request_key`,`http/stored-body-replay.ts`)、行字节不动 —— 出路 = 作为新任务重提(`promptLean` 代替 `promptProfile`;仍停驻的先取消),或升级时先过一次带本条的版本并在窗内起服",
+        reportKeys: [],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;
 }
+export function migrationWindowEnd(id) {
+    const row = ONE_TIME_MIGRATIONS.find((w) => w.id === id);
+    if (row === undefined)
+        throw new Error(`one-time-migrations: the registry has no ${id} row — a sentence that quotes its window outlived the row; delete it with that row`);
+    if (row.removableAfter === null)
+        throw new Error(`one-time-migrations: ${id} is in the unreleased form (removableAfter: null) — there is no window end to quote yet`);
+    return row.removableAfter;
+}
 export const NO_SQL_MIGRATIONS = {
-    sessionIncarnationColumn: "lazy-on-read",
-    sessionIncarnationsBackfilled: 0,
     allowRuleShadowRowsMigrated: 0,
     allowRuleShadowRowsUnreadable: 0,
     workflowParkIndexKey: "file-ledger",
@@ -592,7 +609,6 @@ async function migrateOn(db, dialect) {
     return completedReport(receipts);
 }
 async function migrateStepsOn(db, dialect, receipts) {
-    await migrateSessionIncarnations(db, dialect, receipts);
     receipts.holderDeathCodeRowsBackfilled += await db.exec(dialect === "tidb"
         ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND error = ?"
         : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND error = $2", [RUN_HOLDER_DEATH_CODES.stalled, RUN_STALLED_ERROR]);
@@ -751,8 +767,9 @@ export function oldGrammarEntriesOf(body, rev) {
     const toolAllowDropped = (shaped.rules.toolAllow ?? []).filter((e) => earlier.has(e));
     if (toolAllowDropped.length === 0 && body.grammar !== undefined)
         return { toolAllowDropped };
-    return { toolAllowDropped, rewritten: { ...body, ...(toolAllow !== undefined ? { toolAllow } : {}), grammar: SESSION_RULES_GRAMMAR } };
+    return { toolAllowDropped, rewritten: { ...body, ...(toolAllow !== undefined ? { toolAllow } : {}), grammar: M17_PROVEN_GRAMMAR } };
 }
+const M17_PROVEN_GRAMMAR = 1;
 const RETIRED_BUCKET_PATTERNS = ['%"commandDeny"%', '%"commandAllow"%'];
 async function scanSessionRuleRows(db, dialect, column, patterns, visit) {
     const text = jsonColumnTextExpr(dialect, column);
@@ -1113,25 +1130,32 @@ export async function backfillParkedApprovalCards(db, dialect, receipts) {
             const [full] = await db.rows(`SELECT session_id, ${jsonColumnText(dialect, "checkpoint")} FROM checkpoint WHERE token = ${ph(1)} AND status = 'pending'`, [token]);
             if (full === undefined)
                 continue;
-            const reading = m29CardOf(full.checkpoint);
-            if (reading.kind === "unreadable") {
-                receipts.parkedApprovalCardRowsUnreadable.push({ sessionId: String(full.session_id) });
-                continue;
-            }
-            if (reading.card === null)
-                continue;
-            const bytes = Buffer.byteLength(reading.card, "utf8");
-            if (bytes > APPROVAL_CARD_COLUMN_MAX_BYTES[dialect]) {
-                receipts.parkedApprovalCardRowsTooLong.push({ sessionId: String(full.session_id), bytes });
-                continue;
+            const reading = m29Judge(full.checkpoint, dialect);
+            switch (reading.kind) {
+                case "unreadable":
+                    receipts.parkedApprovalCardRowsUnreadable.push({ sessionId: String(full.session_id) });
+                    continue;
+                case "card_too_long":
+                    receipts.parkedApprovalCardRowsTooLong.push({ sessionId: String(full.session_id), bytes: reading.bytes });
+                    continue;
+                case "cells": {
+                    const card = reading.cells.approval_card;
+                    if (card === null)
+                        continue;
+                    receipts.parkedApprovalCardsBackfilled += await db.exec(`UPDATE checkpoint SET approval_card = ${ph(1)} WHERE token = ${ph(2)} AND status = 'pending' AND approval_card IS NULL`, [card, token]);
+                    continue;
+                }
+                default: {
+                    const unhandled = reading;
+                    throw new Error(`M29: unhandled judgement ${JSON.stringify(unhandled)}`);
+                }
             }
-            receipts.parkedApprovalCardsBackfilled += await db.exec(`UPDATE checkpoint SET approval_card = ${ph(1)} WHERE token = ${ph(2)} AND status = 'pending' AND approval_card IS NULL`, [reading.card, token]);
         }
         if (page.length < PARKED_CARD_BACKFILL_PAGE)
             return;
     }
 }
-function m29CardOf(cell) {
+function m29Judge(cell, dialect) {
     let doc;
     try {
         doc = decodeJsonColumn(cell, readM29Document, "checkpoint.checkpoint (M29 approval-card backfill)");
@@ -1141,11 +1165,7 @@ function m29CardOf(cell) {
             throw e;
         return { kind: "unreadable" };
     }
-    const gate = doc.gate;
-    const pendingAction = doc.pendingAction;
-    if (typeof gate !== "object" || gate === null || typeof pendingAction !== "object" || pendingAction === null)
-        return { kind: "unreadable" };
-    return { kind: "card", card: buildCheckpointIndexCells(doc).approval_card };
+    return judgeCheckpointIndexCells(doc, dialect);
 }
 const PLACED_OWNER_SCAN_PAGE = 500;
 function placedOwnerScanSql(dialect) {
@@ -1207,68 +1227,8 @@ export async function inheritPlacedSessionOwners(db, dialect, receipts) {
             return;
     }
 }
-const INCARNATION_BACKFILL_BATCH = 500;
-async function migrateSessionIncarnations(db, dialect, receipts) {
-    if (!(await tableExists(db, dialect, "session_meta"))) {
-        receipts.sessionIncarnationColumn = "no-table";
-        return;
-    }
-    const col = SESSION_META_INCARNATION_COLUMN;
-    let column = "present";
-    if (!(await columnExists(db, dialect, "session_meta", col.name))) {
-        try {
-            await db.exec(`ALTER TABLE session_meta ADD COLUMN ${dialect === "tidb" ? col.tidb : col.pg}`);
-            column = "added";
-        }
-        catch (e) {
-            if (!(await columnExists(db, dialect, "session_meta", col.name)))
-                throw e;
-        }
-    }
-    receipts.sessionIncarnationColumn = column;
-    await backfillSessionIncarnations(db, dialect, receipts);
-}
-async function backfillSessionIncarnations(db, dialect, receipts) {
-    const remaining = async () => Number((await db.rows("SELECT COUNT(*) AS n FROM session_meta WHERE incarnation = ''"))[0]?.n ?? 0);
-    const initial = await remaining();
-    if (initial === 0)
-        return;
-    const ceiling = Math.ceil(initial / INCARNATION_BACKFILL_BATCH) * 2 + 2;
-    let written = 0;
-    let after;
-    for (let round = 0; round < ceiling; round++) {
-        const ids = (after === undefined
-            ? await db.rows(`SELECT session_id FROM session_meta WHERE incarnation = '' ORDER BY session_id LIMIT ${INCARNATION_BACKFILL_BATCH}`)
-            : await db.rows(`SELECT session_id FROM session_meta WHERE incarnation = '' AND session_id > ${dialect === "pg" ? "$1" : "?"} ORDER BY session_id LIMIT ${INCARNATION_BACKFILL_BATCH}`, [after])).map((r) => String(r.session_id));
-        if (ids.length === 0) {
-            if (after === undefined)
-                return;
-            after = undefined;
-            continue;
-        }
-        const params = [];
-        const bind = (v) => {
-            params.push(v);
-            return dialect === "pg" ? `$${params.length}` : "?";
-        };
-        const cases = ids.map((id) => `WHEN ${bind(id)} THEN ${bind(mintSessionIncarnation())}`).join(" ");
-        const inList = ids.map((id) => bind(id)).join(", ");
-        const landed = await db.exec(`UPDATE session_meta SET incarnation = CASE session_id ${cases} END WHERE incarnation = '' AND session_id IN (${inList})`, params);
-        written += landed;
-        receipts.sessionIncarnationsBackfilled += landed;
-        after = ids.length < INCARNATION_BACKFILL_BATCH ? undefined : ids[ids.length - 1];
-    }
-    const left = await remaining();
-    if (left > 0) {
-        throw new Error(`one-time migration M5: ${left} session_meta row(s) still carry an empty incarnation after ${ceiling} backfill round(s) ` +
-            `(${written} written) — refusing to start rather than serve sessions whose occupant cannot be told apart. Retry the boot; ` +
-            `if it repeats, something keeps writing rows without an incarnation (an older replica still inserting?).`);
-    }
-}
 function readingFields(r) {
     return {
-        ...(r.sessionIncarnationColumn !== undefined ? { sessionIncarnationColumn: r.sessionIncarnationColumn } : {}),
-        sessionIncarnationsBackfilled: r.sessionIncarnationsBackfilled,
         holderDeathCodeRowsBackfilled: r.holderDeathCodeRowsBackfilled,
         allowRuleShadowRowsMigrated: r.allowRuleShadowRowsMigrated,
         allowRuleShadowRowsUnreadable: r.allowRuleShadowRowsUnreadable,
@@ -1305,8 +1265,7 @@ export function logOneTimeMigrations(log, backend, report) {
         backend,
         ...readingFields(report),
         removableAfter: Object.fromEntries(ONE_TIME_MIGRATIONS.map((w) => [w.id, w.removableAfter])),
-        note: "one-time persisted-data migrations (M5: the " +
-            "session incarnation column added and every session row without one minted its own token; M6: run rows failed by a " +
+        note: "one-time persisted-data migrations (M6: run rows failed by a " +
             "holder-death verdict written by an earlier version with only the sentence got the machine-readable code run.stalled / " +
             "run.orphaned; M7 writes nothing — it is the window of the refusal that keeps a suspended task whose stored allow list was written " +
             "under an earlier reading from resuming under the current one; M8: parked rows' allow-layer disclosure written by an earlier engine " +
@@ -1463,7 +1422,7 @@ function logOneTimeMigrationsInterrupted(log, backend, error) {
         ...readingFields(error.receipts),
         note: "the one-time migrations failed after committing changes: the readings on this line and the lines that follow are what this boot already committed — a retried " +
             "boot finds that work done and does not report it again, so these lines are the only record of them, written once by this boot — save them. The failure itself follows " +
-            "as this boot's refusal. A shape reading absent from this line (sessionIncarnationColumn / workflowParkIndexKey / sessionRuleColumn / workflowJournalScopeColumn) belongs to a step that did not " +
+            "as this boot's refusal. A shape reading absent from this line (workflowParkIndexKey / sessionRuleColumn / workflowJournalScopeColumn) belongs to a step that did not " +
             "finish; sessionRuleColumn absent after session_rule_row_old_grammar_entries lines means the column still carries its in-progress name — the next boot rewrites the " +
             "remaining rows (rows already rewritten are left alone) and publishes the final name",
     });

package/dist/plugins/permission-rule-store-file.js

@@ -4,7 +4,7 @@ import { readdirSync } from "node:fs";
 import { performance } from "node:perf_hooks";
 import { FileDurableRulePartitionProvider, AppendLog, ensureDir, } from "@sema-agent/core";
 import { z } from "zod";
-import { DurableRuleScopeSchema, RuleOffer2Schema, buildRulePayloadHash, recordOwnerOf, refusedOwnerSentence } from "./permission-rule-store-sql.js";
+import { DurableRuleScopeSchema, RuleOfferColumn, buildRulePayloadHash, recordOwnerOf, refusedOwnerSentence } from "./permission-rule-store-sql.js";
 import { replayJsonlGuarded } from "../observability/corrupt-read-seat.js";
 import { EDITED_RULE_BREADTH_WARNING_CODES, RULE_APPROVAL_KINDS, RULE_APPROVAL_RECORD_SCHEMA, RULE_APPROVAL_STATES, RULE_BEHAVIORS, readRuleOwner } from "@sema-agent/core";
 const RuleDotSchema = z.object({ actor: z.string().min(1), counter: z.number().int().nonnegative().safe() }).strict();
@@ -26,7 +26,7 @@ const ApprovalRecordSchema = z
     kind: z.enum(RULE_APPROVAL_KINDS),
     state: z.enum(RULE_APPROVAL_STATES),
     candidates: z.array(RuleCandidateSchema),
-    offers: z.array(RuleOffer2Schema),
+    offers: z.array(RuleOfferColumn),
     createdAt: z.string(),
     toolCallId: z.string().optional(),
     boundInputHash: z.string().optional(),

package/dist/plugins/permission-rule-store-sql.d.ts

@@ -31,23 +31,23 @@ export declare function writerOfSqlRuleStore(store: DurableRulePartition): Permi
  * (下方 `RuleCandidateSchema`;File 店的审批记录读同一只)。
  */
 export declare const DurableRuleScopeSchema: z.ZodType<RuleScope>;
-export declare const RuleOffer2Schema: z.ZodUnion<readonly [z.ZodObject<{
-    kind: z.ZodLiteral<"single">;
-    candidate: z.ZodNumber;
-}, z.core.$strict>, z.ZodObject<{
-    kind: z.ZodLiteral<"batch">;
-    candidates: z.ZodArray<z.ZodNumber>;
-    segments: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    uncoveredSegments: z.ZodOptional<z.ZodNumber>;
-    uncoveredDetail: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        segment: z.ZodString;
-        reason: z.ZodEnum<{
-            redirection: "redirection";
-            no_rule_form: "no_rule_form";
-            cap_overflow: "cap_overflow";
-        }>;
-    }, z.core.$strict>>>;
-}, z.core.$strict>]>;
+/** [ref] §4.1 —— 记录上的 OPTION 结构(core `RuleOffer2`):按 index 引用 `candidates`,绝不携带规则文本副本。
+ *
+ *  🔴 **形的读法只有 core 的一只**(core 7.56.0 [ref] `readRuleOffer2`;它也是 core 同意入口的记录检查读选项的那一只):不是平记录 / 形不声明的成员 /
+ *  下标不是非负安全整数 / 无成员的批 / 段不是串列 / 理由行不恰是段 + 理由 ⇒ `malformed`;种类词或理由词出闭集 ⇒ `unknown_word`。任何一个 problem ⇒ 本列读不出 ⇒
+ *  整行 / 整面拒(照本店 JSON 列读回的既有姿势,响亮,不端半截)。本仓不再手写臂表(修前一份逐臂 `.strict()` 的 zod 联合 = 同一个形的第二个读者;
+ *  唯一的具名差异是「无成员的批」—— zod 收、读法拒,而 core 的记录检查本来就拒)。成员 disjoint 等语义完整性仍归 core 的读侧检查,店只担保形。
+ *  这只 zod 型只是把 core 读法接进本店既有的列读者(`createZodColumnReader`)与记录 schema 的适配,不判任何一格;File 店读本店导出的这一只。 */
+export declare const RuleOfferColumn: z.ZodPipe<z.ZodUnknown, z.ZodTransform<{
+    readonly kind: "single";
+    readonly candidate: number;
+} | {
+    readonly kind: "batch";
+    readonly candidates: readonly number[];
+    readonly segments?: readonly string[];
+    readonly uncoveredSegments?: number;
+    readonly uncoveredDetail?: readonly import("@sema-agent/core").UncoveredSegmentDetail[];
+}, unknown>>;
 export declare const PERMISSION_RULE_TABLE = "permission_rule";
 export declare const PERMISSION_RULE_APPROVAL_TABLE = "permission_rule_approval";
 export declare const PERMISSION_RULE_TICKET_TABLE = "permission_rule_ticket";

package/dist/plugins/permission-rule-store-sql.js

@@ -1,6 +1,6 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { z } from "zod";
-import { applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, foldDelta, isValidDurableScope, parseRuleText, readRowBehavior, screenRuleSyncState, PERMISSION_RULE_WRITER, RULE_ADD_ORIGINS, RULE_APPROVAL_KINDS, RULE_APPROVAL_RECORD_SCHEMA, RULE_APPROVAL_STATES, RULE_BEHAVIORS, RULE_SYNC_DROP_CODES, EDITED_RULE_BREADTH_WARNING_CODES, PERSISTED_RULE_MATCHES, UNCOVERED_SEGMENT_REASONS, EMPTY_DURABLE_RULE_PARTITION, PERMISSION_RULES_LATER_GRAMMAR_CODE, RULE_OFFER_KINDS, SESSION_RULES_GRAMMAR, readRuleGrammarStamp, readRuleOwner, } from "@sema-agent/core";
+import { applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, foldDelta, isValidDurableScope, parseRuleText, readRowBehavior, screenRuleSyncState, PERMISSION_RULE_WRITER, RULE_ADD_ORIGINS, RULE_APPROVAL_KINDS, RULE_APPROVAL_RECORD_SCHEMA, RULE_APPROVAL_STATES, RULE_BEHAVIORS, RULE_SYNC_DROP_CODES, EDITED_RULE_BREADTH_WARNING_CODES, PERSISTED_RULE_MATCHES, EMPTY_DURABLE_RULE_PARTITION, PERMISSION_RULES_LATER_GRAMMAR_CODE, SESSION_RULES_GRAMMAR, readRuleGrammarStamp, readRuleOwner, principalNameOf, readRuleOffer2, } from "@sema-agent/core";
 import { dialectProtocolJsonEncoder, sqlDbNowMs, SQL_DB_NOW_MS } from "./sql-driver.js";
 import { isMissingColumnError } from "./sql-errors.js";
 import { canonicalJsonStringify } from "@sema-agent/core";
@@ -90,19 +90,14 @@ const RedeemedDotsSchema = z.record(z.string(), RuleDotSchema);
 const RuleEditedSchema = z
     .object({ index: z.number().int().nonnegative().safe(), text: z.string(), at: z.string(), warnings: z.array(z.enum(EDITED_RULE_BREADTH_WARNING_CODES)).optional() })
     .strict();
-const RULE_OFFER2_ARMS = {
-    single: z.object({ kind: z.literal("single"), candidate: z.number().int().nonnegative().safe() }).strict(),
-    batch: z
-        .object({
-        kind: z.literal("batch"),
-        candidates: z.array(z.number().int().nonnegative().safe()),
-        segments: z.array(z.string()).optional(),
-        uncoveredSegments: z.number().int().nonnegative().safe().optional(),
-        uncoveredDetail: z.array(z.object({ segment: z.string(), reason: z.enum(UNCOVERED_SEGMENT_REASONS) }).strict()).optional(),
-    })
-        .strict(),
-};
-export const RuleOffer2Schema = z.union([RULE_OFFER2_ARMS.single, RULE_OFFER2_ARMS.batch]);
+export const RuleOfferColumn = z.unknown().transform((raw, ctx) => {
+    const read = readRuleOffer2(raw);
+    if ("problem" in read) {
+        ctx.addIssue({ code: "custom", message: `the stored rule offer does not read (${read.problem})` });
+        return z.NEVER;
+    }
+    return read.offer;
+});
 export const PERMISSION_RULE_TABLE = "permission_rule";
 export const PERMISSION_RULE_APPROVAL_TABLE = "permission_rule_approval";
 export const PERMISSION_RULE_TICKET_TABLE = "permission_rule_ticket";
@@ -364,7 +359,7 @@ const readTombstonesJson = createZodColumnReader(z.array(RuleTombstoneSchema));
 const readQuarantinedJson = createZodColumnReader(z.array(QuarantinedRuleAddRowSchema));
 const readObservedVectorJson = createZodColumnReader(FrontierSchema);
 const readCandidatesJson = createZodColumnReader(z.array(RuleCandidateSchema));
-const readOffersJson = createZodColumnReader(z.array(RuleOffer2Schema));
+const readOffersJson = createZodColumnReader(z.array(RuleOfferColumn));
 const readRedeemedDotsJson = createZodColumnReader(RedeemedDotsSchema);
 const readEditedJson = createZodColumnReader(RuleEditedSchema);
 async function refusingUnreadableColumns(what, fn) {
@@ -578,9 +573,13 @@ export class SqlDurableRulePartitionProvider {
         this.now = now;
     }
     forPrincipal(principal) {
-        if (typeof principal !== "string" || principal === "")
+        if (principal === undefined || principal === "")
             return EMPTY_DURABLE_RULE_PARTITION;
-        return new SqlDurableRulePartition(this.db, { kind: "principal", principal }, this.now);
+        const name = principalNameOf(principal);
+        if (name === undefined) {
+            throw new Error('the principal given is not a principal name — refusing to resolve a bucket for it; a provided value that names nobody is not "no principal"');
+        }
+        return new SqlDurableRulePartition(this.db, { kind: "principal", principal: name }, this.now);
     }
     forLocalOwner() {
         return new SqlDurableRulePartition(this.db, { kind: "local-owner" }, this.now);

package/dist/plugins/pg-pool.js

@@ -1,6 +1,7 @@
 import pg from "pg";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { pollUntilLocked } from "./ensure-schema-lock-policy.js";
+import { RUN_IDENTITY_COLUMNS } from "../identity-source.js";
 import { ensureSchema as ensureSessionSchema } from "./pg-session-storage.js";
 import { ensureSchema as ensureToolResultSchema } from "./tool-result-store-sql.js";
 import { ensureSchema as ensureCostQuotaSchema } from "./pg-cost-quota.js";
@@ -32,6 +33,9 @@ export const PG_SCHEMA_STATEMENTS = [
      instance_id VARCHAR(64) COLLATE "C",
      job_id      VARCHAR(64) COLLATE "C",
      source      VARCHAR(64) COLLATE "C",
+     -- identity_*: the run's identity tuple (semantics in the MySQL twin, tidb-pool.ts task_run; column definitions' single owner =
+     -- src/identity-source.ts RUN_IDENTITY_COLUMNS).
+     ${RUN_IDENTITY_COLUMNS.pg},
      -- 🔴 **刻意不写 COLLATE C** —— 本表其余字符串列都钉了,只有这一根是例外,理由是实测出来的
      -- (#192,codex 复审 round5;证据 scratchpad/evidence/u6-lower-collate-c.txt):
      --   PG 的 lower() 按**表达式的排序规则**决定大小写映射,而 C 只带 ASCII 映射 ⇒

package/dist/plugins/pg-session-storage.js

@@ -17,7 +17,7 @@ import { BASELINE_IO_DEADLINE_MS, decodeInstructionSource, encodeInstructionSour
 import { MANAGED_RETENTION } from "./retention-store-sql.js";
 import { SESSION_META_INCARNATION_COLUMN, carriedIncarnation, headFromRow, incarnationFromCell, mintSessionIncarnation, sessionFaceFromRow } from "../session-incarnation.js";
 import { ensureIndexes } from "./ensure-index.js";
-import { assertFirstOwnerWritable, forkOwnerOf } from "./session-ownership.js";
+import { assertFirstOwnerWritable, forkOwnerOf, isSessionOwnerValue } from "./session-ownership.js";
 import { forkCopyOf, forkPointOf } from "./session-fork.js";
 const isDupKey = isPgUniqueViolation;
 function baselineQuery(text, values) {
@@ -219,7 +219,7 @@ export class PgSessionStore {
         return { session: new StoredSession(storage), sessionId };
     }
     async register(sessionId, owner) {
-        if (typeof owner !== "string" && owner !== null) {
+        if (!isSessionOwnerValue(owner)) {
             if ((await this.headOf(sessionId)) !== undefined)
                 return;
             assertFirstOwnerWritable(sessionId, owner);

package/dist/plugins/remote-env-adb.d.ts

@@ -85,6 +85,9 @@ export declare class RemoteAdbExecutionEnv implements RemoteExecutionEnv {
     /** core 7.49.0 [ref]:shell 子进程真拿到的 `CDPATH` 条目 —— 本车道的命令跑在 Android 设备的 shell 里(设备自己的 env),本类不读那份 env ⇒ `"unknown"`(core 契约:说不出就说 unknown,
      *  不许报一张没读过的空表;删除守卫因此对裸 `cd <相对名>` 之后的删除问人,而不是按「没有 CDPATH」放行)。 */
     readonly cdPath: "unknown";
+    /** core 7.56.0 [ref]:shell 子进程继承的环境里收不到的条目 —— 本车道 shell 的环境在 Android 设备上**构建**(本进程的 env 从不注入,只有引擎逐次交的 `env`
+     *  这条显式授予),没有一条是从本进程继承的 ⇒ `[]`(core 契约:「`[]` when its shell environment is built rather than inherited」)。 */
+    readonly withheldEnv: readonly [];
     private readonly cfg;
     private readonly spawnFn;
     private readonly injectedConnectOnce?;

package/dist/plugins/remote-env-adb.js

@@ -37,6 +37,7 @@ export class RemoteAdbExecutionEnv {
     }
     homeSeat;
     cdPath = "unknown";
+    withheldEnv = [];
     cfg;
     spawnFn;
     injectedConnectOnce;

package/dist/plugins/remote-env-device.d.ts

@@ -89,6 +89,9 @@ export declare class RemoteDeviceExecutionEnv implements RemoteExecutionEnv {
     /** core 7.49.0 [ref]:shell 子进程真拿到的 `CDPATH` 条目 —— 本车道的命令跑在设备上(设备自己的 env),本类不读那份 env ⇒ `"unknown"`(core 契约:说不出就说 unknown,
      *  不许报一张没读过的空表;删除守卫因此对裸 `cd <相对名>` 之后的删除问人,而不是按「没有 CDPATH」放行)。 */
     readonly cdPath: "unknown";
+    /** core 7.56.0 [ref]:shell 子进程继承的环境里收不到的条目 —— 本车道 shell 的环境在设备上**构建**(本进程的 env 从不注入,只有引擎逐次交的 `env`
+     *  这条显式授予),没有一条是从本进程继承的 ⇒ `[]`(core 契约:「`[]` when its shell environment is built rather than inherited」)。 */
+    readonly withheldEnv: readonly [];
     /**
      * 🔴 `suspendable: false` 在 core 契约里**同时断言**「工作区在目标上外部持久」(remote-env.ts 的
      * load-bearing 不变量)—— 设备工作区 = 员工机磁盘,真持久 ✅,park-only 降级腿因此合法可用。