@sema-agent/server 7.138.0 → 7.140.0

package/dist/plugins/approval-ask-store-sql.d.ts

@@ -44,6 +44,7 @@ import { type AskState, type BatchState } from "../approval-ask-machine.js";
 import type { HostSettledBy } from "../host-decision.js";
 import { type AskRowCause, type SettleCause } from "../approval-deny-reasons.js";
 import { type IndexSpec } from "./ensure-index.js";
+import { type ExecutionLane } from "../execution-lane-caps.js";
 export type AskDecision = "approve" | "deny";
 export interface AskRow {
     askId: string;
@@ -52,6 +53,11 @@ export interface AskRow {
     sessionId: string;
     /** 租户 scope——哨兵归一在消费层(车2+),店里存原值(设计定稿 §3)。 */
     owner: string | null;
+    /**
+     * 造这只问的那条执行的车道(审批出处带车道:问行唯一铸点 `ensureAsk` 与 `taskId` / `sessionId` 同处写;既有行命中一个字节不改)。
+     * 读根授权只读问自己记下的车道。存量行随执行放置切换的一次性迁移回填(SQL `approval_ask.execution_lane`、local 问账日志压实)。
+     */
+    executionLane: ExecutionLane;
     batchId: string;
     toolCallId: string;
     /** 车3 §3.2′ 换轴:数值 `leg` → `legKey`(= `sha256(resume token)` 的 hex,首腿空串)。语义与派生
@@ -174,6 +180,8 @@ export interface NewAskRow {
     sourceTaskId: string;
     sessionId: string;
     owner?: string | null;
+    /** 出处的执行车道(必填;语义见 {@link AskRow.executionLane})。 */
+    executionLane: ExecutionLane;
     batchId: string;
     toolCallId: string;
     legKey: string;
@@ -562,6 +570,14 @@ export interface ApprovalAskStore {
     getBatch(batchId: string): Promise<BatchRow | null>;
 }
 export declare const APPROVAL_ASK_TABLE = "approval_ask";
+/**
+ * `approval_ask.execution_lane` 的列定义(两方言;唯一属主)—— 建表 DDL 内联它,存量库的加列只由执行放置切换的一次性迁移做(`one-time-migrations.ts` M32 步 ②),
+ * 那一步也读这里的定义。`DEFAULT ''` 只为存量库一句加列;回填(同迁移步 ④b)之后没有 '' 行,读口对 '' 与词表外的值一律响亮拒({@link executionLaneColumnOf})。
+ */
+export declare const APPROVAL_ASK_EXECUTION_LANE_COLUMN: {
+    readonly mysql: "execution_lane VARCHAR(32) NOT NULL DEFAULT ''";
+    readonly pg: "execution_lane VARCHAR(32) COLLATE \"C\" NOT NULL DEFAULT ''";
+};
 export declare const APPROVAL_BATCH_TABLE = "approval_batch";
 /**
  * TiDB/MySQL-protocol 侧的两条建表语句,**抽成导出数组**(车3 刀 3a):`tidb-pool.ts` 的
@@ -571,7 +587,8 @@ export declare const APPROVAL_BATCH_TABLE = "approval_batch";
  * 下面的 `ensureTiDBApprovalAskSchema` 保留为遍历这个数组的薄壳(集成测试直接调它建表,
  * 不必为了建两张表去拉起整套中央 schema)。
  *
- * SCHEMA POLICY 同 `tidb-pool.ts` 头注:纯 CREATE,禁 ALTER 增量 seam,改列直接改这里 + 重建库
+ * SCHEMA POLICY 同 `tidb-pool.ts` 头注:纯 CREATE,禁 ALTER 增量 seam,加列直接改这里(新建库随它到货;带数据的存量库由列集对账拒启并打印 `ALTER`,部署者自己执行;
+ * 改列类型 / 可空性列集对账看不见,另走一次性迁移;只有空库 / 开发机可以整库重建〔销毁全部数据〕)
  * (`docs/schema/baseline-mysql.sql` 是由这些文本机器录制出的**产物**,永不手改)。
  *
  * ── 列宽的**测量依据**([ref] A10;U2 逐列取证在档)──────────────────────────────────────────────────
@@ -619,18 +636,18 @@ export declare function ensurePgApprovalAskSchema(q: PgQueryFn): Promise<void>;
  * [ref] 升级前置断言 —— **拒启**,不是 warn(形照 [ref] 的 `assertPermissionRuleApprovalSchema` /
  * [ref] 的 `assertToolResultProvenanceSchema` 两条先例)。
  *
- * 病:本仓不发 `ALTER TABLE`(SCHEMA POLICY:改列就改 CREATE + 删库重建)。于是一台**没删表**就升上来
+ * 病:本仓不发 `ALTER TABLE`(SCHEMA POLICY:代码是唯一真源,存量库缺列由部署者按拒启句打印的 ALTER 自己执行)。于是一台**没跟上**就升上来
  * 的部署,`CREATE TABLE IF NOT EXISTS` 对存量 `approval_ask` 是空操作 —— 本车新加的
  * `rule_command` / `rule_scope_root` 两列不在,而 `ensureAsk` 的 INSERT 与 `askCols` 的每一条读
  * **无条件**引用它们。后果不是「少一个新功能」,是**整条流内审批协议**在那台机器上是坏的:
  *  · 每一只 ask 的 `ensureAsk` 撞 unknown column ⇒ 被 `noteStoreError` 吞掉 ⇒ 整只 ask 退回 park 路由
  *    (卡不落库、`GET /v1/approvals` 的重放面恒空、迟到决议腿恒 404);
  *  · 而 `/v1/capabilities` 的 `streamApproval` 仍然报 active ⇒「says yes ⟺ route works」整句为假。
- * 没有这道断言,运维得不到**任何**「这次升级必须重建表」的信号 —— 正是 [ref]「禁静默降级」要挡的形。
+ * 没有这道断言,运维得不到**任何**「这次升级必须先给表加列」的信号 —— 正是 [ref]「禁静默降级」要挡的形。
  *
  * 判据 = **能力探测**(恒空的 `WHERE 1=0` 读)+ **方言的缺列错误码**(判据属主 `sql-errors.ts` 的
- * {@link isMissingColumnError});其余错误**原样 rethrow**,一个字都不加工 —— 一句破坏性的
- * 「去 DROP TABLE」指路比它要挡的缺陷更贵([ref] 那两轮收窄的结论逐字继承)。
+ * {@link isMissingColumnError});其余错误**原样 rethrow**,一个字都不加工 —— 把一次瞬时故障诊断成「缺列」的拒因
+ * 比它要挡的缺陷更贵([ref] 那两轮收窄的结论逐字继承)。拒因的出路是**闭集三条**(与整库对账同一份,{@link describeProbedTableDrift}),没有销毁性的一条。
  *
  * 🔴 位置与两条先例同款:**不在** `ensureSchema` 里(那条通道的契约是「只发 CREATE」,有运行时门看着),
  * 放在 DDL 之后、任何路由装配之前;且**只在流内审批协议真会上场时**跑(判据 = 与协调器同一个符号

package/dist/plugins/approval-ask-store-sql.js

@@ -2,8 +2,10 @@ import { mysqlDriver, pgDriver, dialectJsonEncoder } from "./sql-driver.js";
 import { ASK_TERMINAL, canAskTransition } from "../approval-ask-machine.js";
 import { APPROVAL_ENDING_CAUSES, causeOfAskRow } from "../approval-deny-reasons.js";
 import { isDupKeyError, isMissingColumnError } from "./sql-errors.js";
+import { describeProbedTableDrift } from "./schema-drift-sentence.js";
 import { decodeJsonColumn, foldJsonColumn, jsonColumnText, readJsonObjectColumn, readTriStateJsonValueColumn } from "./sql-json-column.js";
 import { ensureIndexes } from "./ensure-index.js";
+import { isExecutionLane } from "../execution-lane-caps.js";
 export function assertIntegralEpochMs(field, value) {
     if (!Number.isSafeInteger(value)) {
         throw new TypeError(`approval-ask store: ${field} must be an integer epoch-ms (BIGINT column), got ${String(value)}`);
@@ -99,6 +101,17 @@ export function projectDecideReading(row, owner) {
     return askRowCarriesOwner(row, owner) ? row : null;
 }
 export const APPROVAL_ASK_TABLE = "approval_ask";
+export const APPROVAL_ASK_EXECUTION_LANE_COLUMN = {
+    mysql: "execution_lane VARCHAR(32) NOT NULL DEFAULT ''",
+    pg: `execution_lane VARCHAR(32) COLLATE "C" NOT NULL DEFAULT ''`,
+};
+function executionLaneColumnOf(raw, askId) {
+    const lane = typeof raw === "string" ? raw : "";
+    if (!isExecutionLane(lane)) {
+        throw new Error(`approval-ask-store: ask ${askId} carries execution_lane ${JSON.stringify(lane)}, which is not an execution lane — the execution placement switch migration backfills every row; refusing rather than guess the lane this ask was raised on`);
+    }
+    return lane;
+}
 export const APPROVAL_BATCH_TABLE = "approval_batch";
 export const TIDB_APPROVAL_ASK_STATEMENTS = [
     `CREATE TABLE IF NOT EXISTS ${APPROVAL_BATCH_TABLE} (
@@ -118,6 +131,9 @@ export const TIDB_APPROVAL_ASK_STATEMENTS = [
     source_task_id VARCHAR(255) NOT NULL,
     session_id VARCHAR(64) NOT NULL,
     owner VARCHAR(190) NULL,
+    -- execution_lane:造这只问的那条执行的车道(审批出处带车道;ensureAsk 铸行时写,既有行命中不改)。DEFAULT '' 只为存量库一句加列
+    -- (一次性迁移加列并按根会话放置回填,迁移后没有 '' 行)。
+    ${APPROVAL_ASK_EXECUTION_LANE_COLUMN.mysql},
     batch_id VARCHAR(64) NOT NULL,
     tool_call_id VARCHAR(255) NOT NULL,
     -- leg_key: 车3 §3.2′ 身份轴——sha256(resume checkpoint token) 的 hex(64 字符),首腿存空串。
@@ -172,7 +188,7 @@ export const TIDB_APPROVAL_ASK_STATEMENTS = [
     UNIQUE KEY uq_approval_ask_idem (task_id, idempotency_key),
     KEY idx_ask_task_state (task_id, state),
     -- idx_ask_session_state: 车3 §5.1 的 sync 腿开流重放读口(listPendingBySession)的支撑索引。
-    -- 表尚未进生产 + SCHEMA POLICY 是删库重建 ⇒ 此刻加索引零迁移成本,晚一车加就要动生产表。
+    -- 表尚未进生产 ⇒ 此刻加索引零迁移成本,晚一车加就要动生产表。
     KEY idx_ask_session_state (session_id, state),
     KEY idx_ask_batch (batch_id),
     KEY idx_ask_state (state)
@@ -206,6 +222,8 @@ export async function ensurePgApprovalAskSchema(q) {
     source_task_id VARCHAR(255) COLLATE "C" NOT NULL,
     session_id VARCHAR(64) COLLATE "C" NOT NULL,
     owner VARCHAR(190) COLLATE "C",
+    -- execution_lane —— MySQL twin 逐字同形(语义见那侧注)。
+    ${APPROVAL_ASK_EXECUTION_LANE_COLUMN.pg},
     batch_id VARCHAR(64) COLLATE "C" NOT NULL,
     tool_call_id VARCHAR(255) COLLATE "C" NOT NULL,
     -- leg_key: 车3 §3.2′ 身份轴——sha256(resume checkpoint token) 的 hex(64 字符),首腿存空串
@@ -258,18 +276,16 @@ export async function assertApprovalAskRuleMaterialSchema(query, dialect) {
             `persisted on the row too, so a replica that does not hold the waiting leg replays the approved bytes; every ask-row ` +
             `write and read names these columns unconditionally, so on this table the whole in-stream approval protocol degrades silently (no card ` +
             `is persisted, the replay list stays empty, late decisions 404) while /v1/capabilities still reports it active. ` +
-            `This repository ships no ALTER TABLE migrations, so the table must be recreated: run ` +
-            `\`DROP TABLE ${APPROVAL_ASK_TABLE}; DROP TABLE ${APPROVAL_BATCH_TABLE};\` on the ` +
-            `${dialect === "pg" ? "PostgreSQL" : "MySQL-protocol"} backend and restart — the schema is recreated at boot. ` +
-            `The cost is bounded: these two tables hold IN-FLIGHT approval asks (cards awaiting an answer) plus settled ` +
-            `bookkeeping; the durable park face (checkpoint rows) and the persisted rules themselves are untouched, so an ` +
-            `in-flight card falls back to the durable gate (\`POST /v1/approvals/:sessionId/decide\`). ` +
-            `Underlying probe error: ${err instanceof Error ? err.message : String(err)}`);
+            `The table holds IN-FLIGHT approval asks (cards awaiting an answer) plus settled bookkeeping; the durable park face ` +
+            `(checkpoint rows) and the persisted rules themselves are untouched, so an in-flight card falls back to the durable gate ` +
+            `(\`POST /v1/approvals/:sessionId/decide\`) until the columns exist.\n` +
+            `Underlying probe error: ${err instanceof Error ? err.message : String(err)}\n\n` +
+            (await describeProbedTableDrift(query, dialect, [APPROVAL_ASK_TABLE])));
     }
 }
 function askCols(dialect) {
     return [
-        "ask_id, task_id, source_task_id, session_id, owner, batch_id, tool_call_id, leg_key, parent_tool_call_id, bound_input_hash, state",
+        "ask_id, task_id, source_task_id, session_id, owner, execution_lane, batch_id, tool_call_id, leg_key, parent_tool_call_id, bound_input_hash, state",
         "provisional, rev, decision",
         jsonColumnText(dialect, "decision_actor"),
         "decision_note, settled_by",
@@ -307,6 +323,7 @@ function mapAskRowBody(r, askId) {
         sourceTaskId: String(r.source_task_id),
         sessionId: String(r.session_id),
         owner: strOrNull(r.owner),
+        executionLane: executionLaneColumnOf(r.execution_lane, askId),
         batchId: String(r.batch_id),
         toolCallId: String(r.tool_call_id),
         legKey: String(r.leg_key),
@@ -369,7 +386,7 @@ function patchColumns(patch, json) {
     return out;
 }
 function ph(dialect, n) {
-    return dialect === "tidb" ? "?" : `$${n}`;
+    return dialect === "mysql" ? "?" : `$${n}`;
 }
 function pendingClaimWhere(dialect, firstParam) {
     return `ask_id = ${ph(dialect, firstParam)} AND batch_id = ${ph(dialect, firstParam + 1)} AND state = 'STREAM_PENDING'`;
@@ -377,15 +394,15 @@ function pendingClaimWhere(dialect, firstParam) {
 function decideOwnerWhere(dialect, owner, param) {
     if (owner === null)
         return { sql: "owner IS NULL", params: [] };
-    return dialect === "tidb" ? { sql: "CAST(owner AS BINARY) = CAST(? AS BINARY)", params: [owner] } : { sql: `owner = ${ph(dialect, param)}`, params: [owner] };
+    return dialect === "mysql" ? { sql: "CAST(owner AS BINARY) = CAST(? AS BINARY)", params: [owner] } : { sql: `owner = ${ph(dialect, param)}`, params: [owner] };
 }
 export class SqlApprovalAskStore {
     db;
     constructor(db) {
         this.db = db;
     }
-    q(tidb, pg) {
-        return this.db.dialect === "tidb" ? tidb : pg;
+    q(mysql, pg) {
+        return this.db.dialect === "mysql" ? mysql : pg;
     }
     json(value) {
         return dialectJsonEncoder(this.db.dialect)(value);
@@ -394,7 +411,7 @@ export class SqlApprovalAskStore {
         return isDupKeyError(this.db.dialect, e);
     }
     async getAskOn(conn, askId) {
-        const { rows } = await conn.query(this.q(`SELECT ${askCols("tidb")} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = ?`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = $1`), [askId]);
+        const { rows } = await conn.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = ?`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = $1`), [askId]);
         return rows[0] ? mapAskRow(rows[0]) : null;
     }
     async getBatchOn(conn, batchId) {
@@ -410,14 +427,15 @@ export class SqlApprovalAskStore {
         try {
             await conn.begin();
             await conn.query(this.q(`INSERT IGNORE INTO ${APPROVAL_BATCH_TABLE} (batch_id, task_id, state, rev, created_at_ms, updated_at_ms) VALUES (?, ?, 'OPEN', 0, ?, ?)`, `INSERT INTO ${APPROVAL_BATCH_TABLE} (batch_id, task_id, state, rev, created_at_ms, updated_at_ms) VALUES ($1, $2, 'OPEN', 0, $3, $4) ON CONFLICT (batch_id) DO NOTHING`), [row.batchId, row.taskId, now, now]);
-            const askInsert = await conn.query(this.q(`INSERT IGNORE INTO ${APPROVAL_ASK_TABLE} (ask_id, task_id, source_task_id, session_id, owner, batch_id, tool_call_id, leg_key, parent_tool_call_id, bound_input_hash, state, provisional, rev, decision, decision_actor, decision_note, settled_by, decided_at_ms, denied_reason, gate_token, gate_bound_call_id, gate_bound_input_hash, idempotency_key, card_json, rule_command, rule_scope_root, schema_version, expires_at_ms, created_at_ms, updated_at_ms) ` +
-                "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'STREAM_PENDING', 0, 0, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, ?, ?, ?, ?, ?, ?, ?)", `INSERT INTO ${APPROVAL_ASK_TABLE} (ask_id, task_id, source_task_id, session_id, owner, batch_id, tool_call_id, leg_key, parent_tool_call_id, bound_input_hash, state, provisional, rev, decision, decision_actor, decision_note, settled_by, decided_at_ms, denied_reason, gate_token, gate_bound_call_id, gate_bound_input_hash, idempotency_key, card_json, rule_command, rule_scope_root, schema_version, expires_at_ms, created_at_ms, updated_at_ms) ` +
-                "VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, 'STREAM_PENDING', 0, 0, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, $11, $12, $13, $14, $15, $16, $17) ON CONFLICT (ask_id) DO NOTHING"), [
+            const askInsert = await conn.query(this.q(`INSERT IGNORE INTO ${APPROVAL_ASK_TABLE} (ask_id, task_id, source_task_id, session_id, owner, execution_lane, batch_id, tool_call_id, leg_key, parent_tool_call_id, bound_input_hash, state, provisional, rev, decision, decision_actor, decision_note, settled_by, decided_at_ms, denied_reason, gate_token, gate_bound_call_id, gate_bound_input_hash, idempotency_key, card_json, rule_command, rule_scope_root, schema_version, expires_at_ms, created_at_ms, updated_at_ms) ` +
+                "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'STREAM_PENDING', 0, 0, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, ?, ?, ?, ?, ?, ?, ?)", `INSERT INTO ${APPROVAL_ASK_TABLE} (ask_id, task_id, source_task_id, session_id, owner, execution_lane, batch_id, tool_call_id, leg_key, parent_tool_call_id, bound_input_hash, state, provisional, rev, decision, decision_actor, decision_note, settled_by, decided_at_ms, denied_reason, gate_token, gate_bound_call_id, gate_bound_input_hash, idempotency_key, card_json, rule_command, rule_scope_root, schema_version, expires_at_ms, created_at_ms, updated_at_ms) ` +
+                "VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, 'STREAM_PENDING', 0, 0, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, $12, $13, $14, $15, $16, $17, $18) ON CONFLICT (ask_id) DO NOTHING"), [
                 row.askId,
                 row.taskId,
                 row.sourceTaskId,
                 row.sessionId,
                 row.owner ?? null,
+                row.executionLane,
                 row.batchId,
                 row.toolCallId,
                 row.legKey,
@@ -686,40 +704,40 @@ export class SqlApprovalAskStore {
         }
     }
     async listByState(state, limit) {
-        const { rows } = await this.db.query(this.q(`SELECT ${askCols("tidb")} FROM ${APPROVAL_ASK_TABLE} WHERE state = ? ORDER BY updated_at_ms ASC, created_at_ms ASC LIMIT ?`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE state = $1 ORDER BY updated_at_ms ASC, created_at_ms ASC LIMIT $2`), [state, limit]);
+        const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE state = ? ORDER BY updated_at_ms ASC, created_at_ms ASC LIMIT ?`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE state = $1 ORDER BY updated_at_ms ASC, created_at_ms ASC LIMIT $2`), [state, limit]);
         return rows.map(mapAskRow);
     }
     async listPendingByTask(taskId, signal) {
         if (signal?.aborted === true)
             throw abortedReadError("listPendingByTask");
-        const { rows } = await withReadSignal(this.db.query(this.q(`SELECT ${askCols("tidb")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = ? AND state = 'STREAM_PENDING' ORDER BY created_at_ms ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = $1 AND state = 'STREAM_PENDING' ORDER BY created_at_ms ASC`), [taskId]), signal, "listPendingByTask");
+        const { rows } = await withReadSignal(this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = ? AND state = 'STREAM_PENDING' ORDER BY created_at_ms ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = $1 AND state = 'STREAM_PENDING' ORDER BY created_at_ms ASC`), [taskId]), signal, "listPendingByTask");
         return rows.map(mapAskRow);
     }
     async listPendingBySession(sessionId, owner, signal) {
         if (signal?.aborted === true)
             throw abortedReadError("listPendingBySession");
         const { rows } = await withReadSignal(this.db.query(owner === null
-            ? this.q(`SELECT ${askCols("tidb")} FROM ${APPROVAL_ASK_TABLE} WHERE session_id = ? AND state = 'STREAM_PENDING' AND owner IS NULL ORDER BY created_at_ms ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE session_id = $1 AND state = 'STREAM_PENDING' AND owner IS NULL ORDER BY created_at_ms ASC`)
-            : this.q(`SELECT ${askCols("tidb")} FROM ${APPROVAL_ASK_TABLE} WHERE session_id = ? AND state = 'STREAM_PENDING' AND owner = ? ORDER BY created_at_ms ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE session_id = $1 AND state = 'STREAM_PENDING' AND owner = $2 ORDER BY created_at_ms ASC`), owner === null ? [sessionId] : [sessionId, owner]), signal, "listPendingBySession");
+            ? this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE session_id = ? AND state = 'STREAM_PENDING' AND owner IS NULL ORDER BY created_at_ms ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE session_id = $1 AND state = 'STREAM_PENDING' AND owner IS NULL ORDER BY created_at_ms ASC`)
+            : this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE session_id = ? AND state = 'STREAM_PENDING' AND owner = ? ORDER BY created_at_ms ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE session_id = $1 AND state = 'STREAM_PENDING' AND owner = $2 ORDER BY created_at_ms ASC`), owner === null ? [sessionId] : [sessionId, owner]), signal, "listPendingBySession");
         return rows.map(mapAskRow);
     }
     async listByCall(call) {
-        const { rows } = await this.db.query(this.q(`SELECT ${askCols("tidb")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = ? AND leg_key = ? AND tool_call_id = ? AND source_task_id = ? ORDER BY created_at_ms ASC, ask_id ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = $1 AND leg_key = $2 AND tool_call_id = $3 AND source_task_id = $4 ORDER BY created_at_ms ASC, ask_id ASC`), [call.taskId, call.legKey, call.toolCallId, call.sourceTaskId]);
+        const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = ? AND leg_key = ? AND tool_call_id = ? AND source_task_id = ? ORDER BY created_at_ms ASC, ask_id ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = $1 AND leg_key = $2 AND tool_call_id = $3 AND source_task_id = $4 ORDER BY created_at_ms ASC, ask_id ASC`), [call.taskId, call.legKey, call.toolCallId, call.sourceTaskId]);
         return rows.map(mapAskRow).filter((r) => askRowOnCall(r, call));
     }
     async listParkingBySession(sessionId) {
-        const { rows } = await this.db.query(this.q(`SELECT ${askCols("tidb")} FROM ${APPROVAL_ASK_TABLE} WHERE session_id = ? AND state = 'PARKING' ORDER BY created_at_ms ASC, ask_id ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE session_id = $1 AND state = 'PARKING' ORDER BY created_at_ms ASC, ask_id ASC`), [sessionId]);
+        const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE session_id = ? AND state = 'PARKING' ORDER BY created_at_ms ASC, ask_id ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE session_id = $1 AND state = 'PARKING' ORDER BY created_at_ms ASC, ask_id ASC`), [sessionId]);
         return rows.map(mapAskRow).filter((r) => r.sessionId === sessionId);
     }
     async getAsk(askId) {
-        const { rows } = await this.db.query(this.q(`SELECT ${askCols("tidb")} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = ?`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = $1`), [
+        const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = ?`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = $1`), [
             askId,
         ]);
         return rows[0] ? mapAskRow(rows[0]) : null;
     }
     async getByIdempotencyKey(taskId, key) {
         assertIdempotencyKeyShape(key);
-        const { rows } = await this.db.query(this.q(`SELECT ${askCols("tidb")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = ? AND idempotency_key = ?`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = $1 AND idempotency_key = $2`), [taskId, key]);
+        const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = ? AND idempotency_key = ?`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = $1 AND idempotency_key = $2`), [taskId, key]);
         return rows[0] ? mapAskRow(rows[0]) : null;
     }
     async deferReconcile(askId, expectedState, expectedRev, nowMs) {
@@ -754,7 +772,7 @@ export class SqlApprovalAskStore {
         const ANCHOR_COLUMNS = ["task_id", "session_id", "source_task_id"];
         let keepSql = "";
         let keepParams = [];
-        if (keep.length > 0 && dialect === "tidb") {
+        if (keep.length > 0 && dialect === "mysql") {
             const list = keep.map(() => "?").join(", ");
             keepSql = ANCHOR_COLUMNS.map((c) => ` AND ${c} NOT IN (${list})`).join("");
             keepParams = ANCHOR_COLUMNS.flatMap(() => keep);

package/dist/plugins/approval-nonce-store.js

@@ -10,15 +10,15 @@ export class SqlApprovalNonceStore {
     constructor(db) {
         this.db = db;
     }
-    q(tidb, pg) {
-        return this.db.dialect === "tidb" ? tidb : pg;
+    q(mysql, pg) {
+        return this.db.dialect === "mysql" ? mysql : pg;
     }
     async nowMs() {
         return sqlDbNowMs(this.db, APPROVAL_NONCE_TABLE);
     }
     async consume(sessionId, nonce, expiresAtMs) {
         try {
-            await this.db.query(this.q(`INSERT INTO ${APPROVAL_NONCE_TABLE} (session_id, nonce, consumed_at_ms, expires_at_ms) VALUES (?,?,${SQL_DB_NOW_MS.tidb},?)`, `INSERT INTO ${APPROVAL_NONCE_TABLE} (session_id, nonce, consumed_at_ms, expires_at_ms) VALUES ($1,$2,${SQL_DB_NOW_MS.pg},$3)`), [sessionId, nonce, expiresAtMs]);
+            await this.db.query(this.q(`INSERT INTO ${APPROVAL_NONCE_TABLE} (session_id, nonce, consumed_at_ms, expires_at_ms) VALUES (?,?,${SQL_DB_NOW_MS.mysql},?)`, `INSERT INTO ${APPROVAL_NONCE_TABLE} (session_id, nonce, consumed_at_ms, expires_at_ms) VALUES ($1,$2,${SQL_DB_NOW_MS.pg},$3)`), [sessionId, nonce, expiresAtMs]);
             return true;
         }
         catch (err) {
@@ -28,7 +28,7 @@ export class SqlApprovalNonceStore {
         }
     }
     async reapExpired() {
-        const res = await this.db.query(this.q(`DELETE FROM ${APPROVAL_NONCE_TABLE} WHERE expires_at_ms <= ${SQL_DB_NOW_MS.tidb}`, `DELETE FROM ${APPROVAL_NONCE_TABLE} WHERE expires_at_ms <= ${SQL_DB_NOW_MS.pg}`), []);
+        const res = await this.db.query(this.q(`DELETE FROM ${APPROVAL_NONCE_TABLE} WHERE expires_at_ms <= ${SQL_DB_NOW_MS.mysql}`, `DELETE FROM ${APPROVAL_NONCE_TABLE} WHERE expires_at_ms <= ${SQL_DB_NOW_MS.pg}`), []);
         return res.affected;
     }
 }

package/dist/plugins/blob-backend.d.ts

@@ -1,6 +1,6 @@
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import { type SqlEngineFacts, type SqlEngineReading, type SqlWallSource, type SqlWallsReading } from "./sql-driver.js";
+import { type SqlEngineFacts, type SqlEngineReading, type SqlWallSource, type SqlWallsReading, type SqlDialect } from "./sql-driver.js";
 import { type Logger } from "../observability/logger.js";
 /**
  * 文本协议的 blob 膨胀律 —— mysql2 `query()` 把 Buffer 参数写成 `X'<hex>'`,一字节两个字符,所以承载一个 blob 的语句至少是它的 2 倍。
@@ -115,7 +115,7 @@ export declare class SqlBlobBackend implements BlobBackend {
     private readonly db;
     /** Where a stale connection's replacement is logged ({@link connectJudged}); the boot assembly passes the service logger. */
     private readonly log;
-    constructor(dialect: "tidb" | "pg", pool: MysqlPool | PgPool, maxBytes?: number, table?: string, log?: Pick<Logger, "warn">);
+    constructor(dialect: SqlDialect, pool: MysqlPool | PgPool, maxBytes?: number, table?: string, log?: Pick<Logger, "warn">);
     /** The created_at-refreshing content-addressed upsert — VERBATIM the tidb/pg stores' `putBlobRow`. Refreshes
      *  created_at even on a dedup hit so a re-used/just-written blob is "touched=now" and GC-grace-protected.
      *  (a): an over-cap blob is REJECTED (typed {@link BlobTooLargeError}) BEFORE the driver ever sees the bytes —
@@ -140,7 +140,7 @@ export declare class SqlBlobBackend implements BlobBackend {
 /** SHARED index op(workspace 浏览面 #3,[ref]②)—— per-blob 字节数,读 SQL INDEX 的 `byte_len`
  *  列(sqlHasBlobs 同款单 IN 查询;MinIO 后端的 bytes-NULL 索引行同样带 byte_len,两后端同源)。
  *  tree/file 面的 size 投影与「超限先拒后拉」都靠它——绝不为拿大小去 getBlob 整块字节。 */
-export declare function sqlBlobSizes(dialect: "tidb" | "pg", pool: MysqlPool | PgPool, hashes: string[]): Promise<Map<string, number>>;
+export declare function sqlBlobSizes(dialect: SqlDialect, pool: MysqlPool | PgPool, hashes: string[]): Promise<Map<string, number>>;
 export interface MinioBlobBackendConfig {
     endpoint: string;
     bucket: string;
@@ -198,7 +198,7 @@ export declare class MinioBlobBackend implements BlobBackend {
     /** Blob-domain index table ([ref] 域隔离,SqlBlobBackend.table 同款;默认 = E19 纪元的 snapshot_blob)。 */
     private readonly indexTable;
     constructor(cfg: MinioBlobBackendConfig, index?: {
-        dialect: "tidb" | "pg";
+        dialect: SqlDialect;
         pool: MysqlPool | PgPool;
         table?: string;
     });

package/dist/plugins/blob-backend.js

@@ -76,7 +76,7 @@ export class SqlBlobBackend {
         this.pool = pool;
         this.explicitCapBytes = maxBytes;
         this.table = table;
-        this.db = dialect === "tidb" ? mysqlDriver(pool) : pgDriver(pool);
+        this.db = dialect === "mysql" ? mysqlDriver(pool) : pgDriver(pool);
         this.log = log ?? createLogger();
     }
     async putBlob(hash, bytes) {
@@ -90,7 +90,7 @@ export class SqlBlobBackend {
         if (judged.refusal !== undefined)
             throw new BlobTooLargeError(bytes.byteLength, judged.refusal.cap);
         try {
-            await judged.conn.query(this.dialect === "tidb"
+            await judged.conn.query(this.dialect === "mysql"
                 ? `INSERT INTO ${this.table} (blob_hash, byte_len, bytes, created_at) VALUES (?,?,?,?) ON DUPLICATE KEY UPDATE created_at = VALUES(created_at)`
                 : `INSERT INTO ${this.table} (blob_hash, byte_len, bytes, created_at) VALUES ($1,$2,$3,$4) ON CONFLICT (blob_hash) DO UPDATE SET created_at = EXCLUDED.created_at`, [hash, bytes.byteLength, Buffer.from(bytes), new Date()]);
         }
@@ -99,7 +99,7 @@ export class SqlBlobBackend {
         }
     }
     async getBlob(hash) {
-        if (this.dialect === "tidb") {
+        if (this.dialect === "mysql") {
             const [rows] = await this.pool.query(`SELECT bytes FROM ${this.table} WHERE blob_hash = ?`, [hash]);
             return rows[0]?.bytes != null ? new Uint8Array(rows[0].bytes) : undefined;
         }
@@ -118,7 +118,7 @@ async function sqlHasBlobs(dialect, pool, hashes, table = "snapshot_blob") {
     if (hashes.length === 0)
         return new Set();
     const distinct = [...new Set(hashes)];
-    if (dialect === "tidb") {
+    if (dialect === "mysql") {
         const ph = distinct.map(() => "?").join(",");
         const [rows] = await pool.query(`SELECT blob_hash FROM ${table} WHERE blob_hash IN (${ph})`, distinct);
         return new Set(rows.map((r) => String(r.blob_hash)));
@@ -135,7 +135,7 @@ export async function sqlBlobSizes(dialect, pool, hashes) {
     const out = new Map();
     for (let i = 0; i < distinct.length; i += CHUNK) {
         const part = distinct.slice(i, i + CHUNK);
-        if (dialect === "tidb") {
+        if (dialect === "mysql") {
             const ph = part.map(() => "?").join(",");
             const [rows] = await pool.query(`SELECT blob_hash, byte_len FROM snapshot_blob WHERE blob_hash IN (${ph})`, part);
             for (const r of rows)
@@ -155,7 +155,7 @@ async function sqlDeleteIndexRowsPastGrace(dialect, pool, hashes, table = "snaps
         return [];
     const distinct = [...new Set(hashes)];
     const cutoff = new Date(Date.now() - BLOB_GC_GRACE_MS);
-    if (dialect === "tidb") {
+    if (dialect === "mysql") {
         const ph = distinct.map(() => "?").join(",");
         const grace = await pool
             .query(`SELECT blob_hash FROM ${table} WHERE created_at < ? AND blob_hash IN (${ph})`, [cutoff, ...distinct])
@@ -216,7 +216,7 @@ export class MinioBlobBackend {
             throw new Error(`MinioBlobBackend.putBlob ${hash}: HTTP ${res.status} ${detail.slice(0, 200)}`);
         }
         if (this.indexPool && this.indexDialect) {
-            if (this.indexDialect === "tidb") {
+            if (this.indexDialect === "mysql") {
                 await this.indexPool.query(`INSERT INTO ${this.indexTable} (blob_hash, byte_len, bytes, created_at) VALUES (?,?,NULL,?) ON DUPLICATE KEY UPDATE created_at = VALUES(created_at)`, [hash, bytes.byteLength, new Date()]);
             }
             else {

package/dist/plugins/breaker-state-sql.js

@@ -24,8 +24,8 @@ export class SqlBreakerState {
         this.db = db;
         this.onWriteFail = onWriteFail;
     }
-    q(tidb, pg) {
-        return this.db.dialect === "tidb" ? tidb : pg;
+    q(mysql, pg) {
+        return this.db.dialect === "mysql" ? mysql : pg;
     }
     get(key) {
         return this.cache.get(key);

package/dist/plugins/caching-session-store.d.ts

@@ -54,7 +54,7 @@ export declare class CachingSessionStore implements SessionStore {
     private readonly onStaleHit?;
     /** core `SessionStore.headOf` —— 按 id 读一行(属主 / 住客 / 叶子)的唯一读口,**纯转发、不经暖缓存**(答的是行,绝不从暖缓存里那只会话的元数据答 ——
      *  缓存的会话活得比「另一只店删掉又重建了这一行」长)。内层店必有(本类的暖命中按它核新鲜)。🔴 必须转发:生产默认把真店包进本类,授权口 / 属主门 /
-     *  parked 两读 / k8s 工作区空间 / SSE 探针 / resume-at 读的都是本类。 */
+     *  k8s 工作区空间 / SSE 探针 / resume-at 读的都是本类。 */
     readonly headOf: SessionHeadReader["headOf"];
     readonly register?: (sessionId: string, owner: string | null) => Promise<void>;
     /** [ref] 委派继承律的认领口,纯转发(写的是行上的属主那一格 —— 只 CAS 子行自己,不碰暖缓存里的会话;停驻挂点在默认部署上读的就是本类 —— 与 `placementOf` 同转发同缺:内店记录委派树 ⇒ 两只都在)。 */
@@ -72,12 +72,16 @@ export declare class CachingSessionStore implements SessionStore {
         q?: string;
     }) => Promise<SessionListItem[]>;
     readonly fork?: (sourceId: string, owner: string | null) => Promise<string | null>;
+    /** fork 续写的店契约(原样转发;与 fork 同理绕过暖缓存 —— 读写的是持久行,新 id 本来就不在缓存里)。 */
+    readonly forkTo?: OwnerAwareSessionStore["forkTo"];
+    /** 执行席(原样转发:放置是会话**行**上的一格,缓存只缓存会话日志的暖句柄,不缓存行格 —— 读与写都直达内层店)。 */
+    readonly executionPlacement?: OwnerAwareSessionStore["executionPlacement"];
     readonly deleteSession?: (sessionId: string, owner: string | null) => Promise<boolean>;
     /** The session row's list projection for one id + its writable bits (`title` / `pinned`) — DURABLE, pure pass-through
      *  (they read / write `session_meta` / the local sidecars, never the warm cache). 🔴 Must forward (the retention / placements
      *  lesson): the production default wraps the real store in this class, and the route's fact `sessionPatch` reads THIS object. */
     readonly sessionSummaryOf?: (sessionId: string) => Promise<SessionListItem | undefined>;
-    readonly patchSessionMeta?: OwnerAwareSessionStore["patchSessionMeta"];
+    readonly writeSessionRowCells?: OwnerAwareSessionStore["writeSessionRowCells"];
     /** The auto-titler's NULL-only title write (SQL twins + local sidecar carry it; pure pass-through). */
     readonly setTitleIfNull?: (sessionId: string, title: string) => Promise<boolean>;
     readonly probeTitle?: (sessionId: string) => Promise<"none" | "untitled" | "titled">;

package/dist/plugins/caching-session-store.js

@@ -12,9 +12,11 @@ export class CachingSessionStore {
     claimOwnerless;
     listSessions;
     fork;
+    forkTo;
+    executionPlacement;
     deleteSession;
     sessionSummaryOf;
-    patchSessionMeta;
+    writeSessionRowCells;
     setTitleIfNull;
     probeTitle;
     readInstructionSource;
@@ -57,8 +59,8 @@ export class CachingSessionStore {
             this.listSessions = ownerAware.listSessions.bind(inner);
         if (ownerAware.sessionSummaryOf)
             this.sessionSummaryOf = ownerAware.sessionSummaryOf.bind(inner);
-        if (ownerAware.patchSessionMeta)
-            this.patchSessionMeta = ownerAware.patchSessionMeta.bind(inner);
+        if (ownerAware.writeSessionRowCells)
+            this.writeSessionRowCells = ownerAware.writeSessionRowCells.bind(inner);
         if (ownerAware.setTitleIfNull)
             this.setTitleIfNull = ownerAware.setTitleIfNull.bind(inner);
         if (ownerAware.probeTitle)
@@ -73,6 +75,10 @@ export class CachingSessionStore {
             this.recordSessionWorkspace = ownerAware.recordSessionWorkspace.bind(inner);
         if (ownerAware.fork)
             this.fork = ownerAware.fork.bind(inner);
+        if (ownerAware.forkTo)
+            this.forkTo = ownerAware.forkTo.bind(inner);
+        if (ownerAware.executionPlacement)
+            this.executionPlacement = ownerAware.executionPlacement;
         if (ownerAware.exportEntries)
             this.exportEntries = ownerAware.exportEntries.bind(inner);
         if (ownerAware.listEntryIds)

package/dist/plugins/checkpoint-index-columns.js

@@ -33,7 +33,7 @@ export function buildCheckpointIndexCells(cp) {
     };
 }
 export const APPROVAL_CARD_COLUMN_MAX_BYTES = {
-    tidb: 65_535,
+    mysql: 65_535,
     pg: Number.POSITIVE_INFINITY,
 };
 export function judgeCheckpointIndexCells(cp, dialect) {
@@ -83,7 +83,7 @@ function renderFacetCase(compared) {
     return `CASE ${CHECKPOINT_FACET_CASES.map((c) => `WHEN ${compared(c.column)} IN (${c.words.map(literal).join(", ")}) THEN ${literal(c.facet)}`).join(" ")} END`;
 }
 export const CHECKPOINT_FACET_SQL = Object.freeze({
-    tidb: renderFacetCase((column) => `CAST(${column} AS BINARY)`),
+    mysql: renderFacetCase((column) => `CAST(${column} AS BINARY)`),
     pg: renderFacetCase((column) => column),
 });
 export const CHECKPOINT_SWEEP_ORDER_SQL = "CASE WHEN approval_card IS NULL THEN 1 ELSE 0 END ASC, deadline ASC, token ASC";

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -240,8 +240,8 @@ export declare function pendingRowPrecedes(a: {
  *
  * 🔴 为什么是一张表而不是每列一个 `assert*ColumnSchema` 函数([ref] 归一):[ref]① 那次是一列一函数,
  * 本批 [ref] 又要加两列 —— 照抄就是第二、第三份三十行的同形代码,而它们**唯一的差别只有列名与那句话**。
- * 探测法(恒空 `WHERE 1=0` 读 + 方言缺列码)、失败方向(只在**可证**缺列时才给删表指路)、恢复动作
- * (DROP TABLE checkpoint 的代价交代)三者对整张表是同一条,所以规则只留一条,列变成数据:下一次加列
+ * 探测法(恒空 `WHERE 1=0` 读 + 方言缺列码)、失败方向(只在**可证**缺列时才拒)、恢复动作
+ * (部署者按拒因打印的 ALTER 在原表上加列;表里是在飞的停驻,不动它)三者对整张表是同一条,所以规则只留一条,列变成数据:下一次加列
  * 只加一行,不再多一条规则。
  */
 export declare const CHECKPOINT_ADDED_COLUMNS: ReadonlyArray<{
@@ -254,14 +254,15 @@ export declare const CHECKPOINT_ADDED_COLUMNS: ReadonlyArray<{
  * 依据是本仓 assert*Schema 探针族的真先例与失败方向本身)。[ref] 起判据对 {@link CHECKPOINT_ADDED_COLUMNS}
  * **整张列册**跑(见那张表的头注:归一的理由)。
  *
- * 病:本仓不发 `ALTER TABLE`(SCHEMA POLICY:改列就改 CREATE + 删库重建)。一台**没删表**就升上来的
+ * 病:本仓不发 `ALTER TABLE`(SCHEMA POLICY:代码是唯一真源,存量库缺列由部署者按拒启句打印的 ALTER 自己执行)。一台**没跟上**就升上来的
  * 部署,`CREATE TABLE IF NOT EXISTS` 对存量 `checkpoint` 是空操作 —— 后加的列不在,而写口与读口
  * **无条件**引用它们。没有这道断言,服务照常过启动与健康检查,直到运行期才响,且首撞点在用户的
  * 审批 / resume 路径上。
  *
  * 判据 = **能力探测**(恒空的 `WHERE 1=0` 读)+ **方言的缺列错误码**({@link isMissingColumnError},
- * 判据属主 `sql-errors.ts`);其余错误**原样 rethrow**,一个字都不加工 —— 一句破坏性的「去 DROP TABLE」
- * 指路比它要挡的缺陷更贵([ref] 两轮收窄的结论逐字继承)。
+ * 判据属主 `sql-errors.ts`);其余错误**原样 rethrow**,一个字都不加工 —— 把一次瞬时故障诊断成「缺列」的拒因
+ * 比它要挡的缺陷更贵([ref] 两轮收窄的结论逐字继承)。拒因的出路是**闭集三条**(与整库对账同一份,{@link describeProbedTableDrift}),
+ * 没有销毁性的一条:这张表里是在飞的停驻,出路是原表上加列。
  *
  * 位置:与三条先例同款,不在 `ensureSchema` 里(那条通道的契约是「只发 CREATE」),放在 boot 的
  * store 装配段、路由装配之前;**无条件**跑(与 [ref] tool_result 探针同档)——checkpoint 表在两方言的