@sema-agent/server 7.138.0 → 7.140.0

package/dist/plugins/one-time-migrations.js

@@ -8,7 +8,7 @@ import { CENTRAL_SCHEMA_INDEXES } from "./schema-indexes.js";
 import { ensureIndexes } from "./ensure-index.js";
 import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readNonNullJsonValueColumn, readOpaqueJsonValueColumn, } from "./sql-json-column.js";
 import { incarnationFromCell, sessionFaceFromRow } from "../session-incarnation.js";
-import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR } from "./store-contracts.js";
+import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR, StoreBootRefusalError } from "./store-contracts.js";
 import { PERMISSION_RULE_TABLE, purgeUndurableScopeRows } from "./permission-rule-store-sql.js";
 import { SESSION_RULES_COLUMN } from "./session-rules-column.js";
 import { readJsonObjectColumn } from "./sql-json-column.js";
@@ -16,6 +16,9 @@ import { retireStoredCardWords } from "../retired-card-words.js";
 import { redactSecrets } from "../trace/redact.js";
 import { CLAIM_OWNERLESS_PLACED_SQL, claimOwnerlessParams, isOrphanSessionOwner, judgeDelegatedOwner } from "../delegated-session-owner.js";
 import { MAILBOX_KEYED_TABLES, mailboxKeyDeleteSql, storedMailboxKeyless } from "./mailbox-store-sql.js";
+import { SESSION_META_PLACEMENT_COLUMNS, backfillWriterStatement, countOrphanBindingsStatement, migrateDeviceBindingsStatement } from "./execution-placement-sql.js";
+import { APPROVAL_ASK_EXECUTION_LANE_COLUMN, APPROVAL_ASK_TABLE } from "./approval-ask-store-sql.js";
+import { isUnusableArchive } from "../execution-placement.js";
 const RETIRED_SESSION_RULE_BUCKETS = ["commandAllow", "commandDeny"];
 export function buildMigrationReceipts() {
     return {
@@ -45,6 +48,13 @@ export function buildMigrationReceipts() {
         parkedApprovalCardsBackfilled: 0,
         parkedApprovalCardRowsUnreadable: [],
         parkedApprovalCardRowsTooLong: [],
+        executionPlacementColumnsAdded: 0,
+        deviceBindingsMoved: 0,
+        deviceBindingsOrphaned: 0,
+        deviceBindingTablesDropped: 0,
+        executionPlacementsBackfilled: 0,
+        askExecutionLanesBackfilled: 0,
+        executionPlacementSessionsUnreadable: [],
     };
 }
 function completedReport(r) {
@@ -83,7 +93,14 @@ function changedAnything(r) {
         r.mailboxRejectedKeyRowsRemoved > 0 ||
         r.parkedApprovalCardsBackfilled > 0 ||
         r.parkedApprovalCardRowsUnreadable.length > 0 ||
-        r.parkedApprovalCardRowsTooLong.length > 0);
+        r.parkedApprovalCardRowsTooLong.length > 0 ||
+        r.executionPlacementColumnsAdded > 0 ||
+        r.deviceBindingsMoved > 0 ||
+        r.deviceBindingsOrphaned > 0 ||
+        r.deviceBindingTablesDropped > 0 ||
+        r.executionPlacementsBackfilled > 0 ||
+        r.askExecutionLanesBackfilled > 0 ||
+        r.executionPlacementSessionsUnreadable.length > 0);
 }
 function readingsSnapshot(r) {
     return {
@@ -95,6 +112,7 @@ function readingsSnapshot(r) {
         sessionRuleRowsWithUnreadableDeny: [...r.sessionRuleRowsWithUnreadableDeny],
         parkedApprovalCardRowsUnreadable: [...r.parkedApprovalCardRowsUnreadable],
         parkedApprovalCardRowsTooLong: [...r.parkedApprovalCardRowsTooLong],
+        executionPlacementSessionsUnreadable: [...r.executionPlacementSessionsUnreadable],
     };
 }
 function receiptSentence(r) {
@@ -408,7 +426,7 @@ export const ONE_TIME_MIGRATIONS = [
             "`test/one-time-migrations.test.ts` 的 S-491 组与 `test/one-time-migrations-db-integration.test.ts` 的 M26 格。" +
             "**不随本条删**:键的铸点 `breakerKeyOf` / `routeDigestOf`(常设的键形)与新表 `breaker_state`",
         afterRemoval: "没有新的臂(如实):跳过了带本条的版本直接升的库,退役表 `circuit_breaker` 留在库里、没有读者也没有写者(断路器只读写 `breaker_state`)—— " +
-            "出路 = 升级时先过一次带本条的版本,或手工 `DROP TABLE circuit_breaker`(建议性状态,删表安全)",
+            "出路 = 升级时先过一次带本条的版本(它起服删掉退役表);不先过也无害 —— 退役表没有读者也没有写者,留在库里只占空间(建议性状态,无数据价值)",
         reportKeys: ["retiredBreakerTablesDropped"],
     },
     {
@@ -466,7 +484,7 @@ export const ONE_TIME_MIGRATIONS = [
             "改后句:「this session's stored request still carries a request key this version retired and nothing rewrites it any more; it is not replayed — the task stays suspended until someone cancels it and resubmits it as a new task (promptLean in place of promptProfile)」);" +
             "同族注释(每个半句只归本条或 M28 条之一,不重复改;标〔另一条的〕的几处住在另一条迁移的文件 / 头注段里,那条已先删则宿主已不在,跳过):`src/http/checkpoint-ctx.ts`:「两条出路(运维在一次性迁移的窗内重启本服务 ⇒ 起服改写存体、同一请求可再发;否则作为新任务重提,仍停驻的先取消)」改成「出路(作为新任务重提,仍停驻的先取消)」、「**窗的日期不手写**」起到「删法见登记表 M30 的」止整段删、「存体里的旧键由一次性迁移在起服时原地改写」改成「存体里的旧键没有迁移改写」、「(M30,`stored-request-prompt-profile-m30.ts`,行改写经本模块的 {@link rewriteStoredBodyKeys})。改写不到的残留行」改成「仍带旧键的残留行」、「;存体由 M30 起服改写」删、「与 {@link rewriteStoredBodyKeys}」删、「(存量行非凭据顶层体键的改写,凭据位与读法记号原样随行)」删;`src/http/wire-types.ts`:「由一次性迁移 M30 在起服时按同一张映射原地改写」改成「没有迁移改写」、「(`stored-request-prompt-profile-m30.ts`;M30 · 窗口见 `plugins/one-time-migrations.ts` 登记表)」删;`src/spec-fields.ts`:「由一次性迁移 M30 在起服时改写成 `promptLean`(`stored-request-prompt-profile-m30.ts`),」改成「不改写,」;`src/boot/stage-06-runners.ts`:「M30(存体里的退役请求键 `promptProfile` 原地改写)同在这里、」删、「(同一只 ctx 行改写店腿;不要封签器),同样早于任何续跑入口。」删;`src/plugins/checkpoint-store-sql.ts`:「、M30(退役请求键改写)」删;`src/plugins/one-time-migrations.ts`:〔另一条的〕「M30 用同一只;」删;`src/checkpoint-ctx-seal-m28.ts`:〔另一条的〕「(M30 用同一只)」删;`test/task-agents-876.test.ts`:「体由一次性迁移 M30 在起服时原地改写」改成「体没有迁移改写」;`test/allow-list-reading-park-refusal.test.ts`:「一次性迁移 M30 没改写到的残留」改成「没有迁移改写的残留」;`test/api-error-text-freeze.test.ts`:「一次性迁移 M30 没改写到的残留」改成「没有迁移改写的残留」、「洞 = 窗的最后一天(绝对日期)」起到「不手写。」止整段删;" +
             "`http/stored-body-replay.ts` 里 `RETIRED_KEY_REWRITE_MIGRATION` 的 JSDoc 随表删;" +
-            "`http/stored-body-replay.ts` 的 `RETIRED_KEY_REWRITE_MIGRATION`(`satisfies Record<RetiredRequestKey, string>`:M30 删后 `promptProfile` 仍是退役键,这张表只能整张删)、" +
+            "`http/stored-body-replay.ts` 的 `RETIRED_KEY_REWRITE_MIGRATION`(`satisfies Record<ReplayRefusedRetiredKey, string>`:M30 删后 `promptProfile` 仍是退役键,这张表只能整张删)、" +
             "判据里 `rewriteWindowEnd: migrationWindowEnd(…)` 那一项与 `migrationWindowEnd` 的引入行;`plugins/one-time-migrations.ts` 导出的 `migrationWindowEnd` 在无别的读者时一起删;" +
             "冻结表 `test/api-error-text-freeze.test.ts` 的 `FROZEN_RESULT_BODY_TEMPLATE` 里那一行搬回字面表(删完半句后拒句是整句字面);" +
             "`test/stored-request-prompt-profile-m30.test.ts` 的起服改写组、登记行组、「M28 登记行」组(M28 没先删时它还在:它读本文件顶部的引入与 COMMENTS 表,与登记行组同命)、「M30 起服接线」组(它钉的就是被删的那处调用与起服 info 行)与「M30 的混跑与回滚」组;「M30 的混跑与回滚」组随删:它读登记表头注 M30 段(随本行一起删)与 MIGRATION 7.137.0 节第 4 条(已发布的历史文字,留着不动);doc-claims ㊵ 的「嵌入方一段分清两只迁移的窗」格同样读本行的窗末日,随删(它与 M28 行共读,哪一行先删就先删这一格);「窗关后的残留」组保留,但它里面 (d) 读登记行的 `m30Row()` 用处(期望里的 `rewriteWindowEnd`)与 (d′) 整格随删,`m30Row` 助手随之删;" +
@@ -480,6 +498,39 @@ export const ONE_TIME_MIGRATIONS = [
             "(判据 `retired_request_key`,`http/stored-body-replay.ts`)、行字节不动 —— 出路 = 作为新任务重提(`promptLean` 代替 `promptProfile`;仍停驻的先取消),或升级时先过一次带本条的版本并在窗内起服",
         reportKeys: [],
     },
+    {
+        id: "M31",
+        introducedIn: "7.139.0",
+        releasedOn: "2026-10-29",
+        removableAfter: "2026-11-28",
+        removal: "删 `src/memory-sync-client.ts` 里的 `relocateSyncCursorsM31` / `SyncCursorRelocationM31Report` / `m31Window` / `scopeOfLegacyCursor` / `LEGACY_PEER_SEGMENT` / `LEGACY_ROOT_CURSOR_FILE`、" +
+            "`createMemorySyncRunner` 里的 `relocated` 旗标与 `round` 开头对 `relocateSyncCursorsM31` 的那一处调用(连同它上面那一行注释、info `memory_sync_cursor_relocated` 与 warn `memory_sync_cursor_not_relocated` 两行日志)、" +
+            "文件头注的 ⑤ 段与 `ONE_TIME_MIGRATIONS` / `migrationWindowOpen` / `OneTimeMigrationWindow` 的引入行;本文件头注的 M31 段;" +
+            "`test/memory-sync-client.test.ts` 里标题以 `🔴 M31:` 或 `M31 ` 起头的格、对 `relocateSyncCursorsM31` 的引入与常量 `LEGACY_PEER_DIR`,常量 `CURSOR_FILE` 的行注改成「没有读者」(用它的格随删后无人用它 ⇒ 常量一起删)",
+        afterRemoval: "没有新的臂(如实):跳过了带本条的版本直接升的数据根,升级前的游标还在 `sync-cursors/central/` 与 `sync-cursor-central.json`,没有读者 ⇒ 那几层以空基线首轮同步" +
+            "(两边都改过的条目按冲突上报,上一轮之后在一侧删掉的条目从另一侧回来)。出路 = 升级时先过一次带本条的版本并在窗内跑一轮同步,或升级前在旧版上跑完一轮同步、再删掉这些文件",
+        reportKeys: [],
+    },
+    {
+        id: "M32",
+        introducedIn: "7.139.0",
+        releasedOn: "2026-10-29",
+        removableAfter: "2026-11-28",
+        removal: "删 migrateStepsOn 的 M32 步(`switchExecutionPlacement`、步骤表 `EXECUTION_PLACEMENT_SWITCH_STEPS`、回填前提表 `EXECUTION_PLACEMENT_BACKFILL_NEEDS`、" +
+            "`readSwitchShape` / `switchStarted` / `switchComplete` / `refuseOnSwitchFence` / `refuseOnAmbiguousBackfill` / `sessionRowsAwaitingBackfill` / `bindingRootKey`、" +
+            "`RETIRED_DEVICE_BINDING_TABLE` / `PARKED_DEVICE_BINDING_TABLE` / `FENCE_ROOTS_SHOWN`、`ExecutionPlacementSwitchRefusedError` / `EXECUTION_PLACEMENT_SWITCH_REFUSED_CODE` / `ExecutionPlacementSwitchRefusalReason`)" +
+            "与 DDL 前探针(`assertExecutionPlacementSwitchAdmissible` / `assertExecutionPlacementSwitchAdmissibleOnPool`,`store-backend.ts` 的 `withRetiredSchemaProbe` 里调它的那一行);" +
+            "`runSqlOneTimeMigrations` 的第三参 `ExecutionPlacementSwitchInput`(若再无别的条目用它)与它在两只 SQL 后端 / 测试夹具上的实参;local 腿(`LocalBackend.runOneTimeMigrations` 里的 `backfillLocalExecutionPlacements` 与 `FileRunStore.sessionIdsWithRuns`);" +
+            "`execution-placement-sql.ts` 的 `backfillWriterStatement` / `migrateDeviceBindingsStatement` / `countOrphanBindingsStatement`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 `executionPlacementColumnsAdded` / `deviceBindingsMoved` / " +
+            "`deviceBindingsOrphaned` / `deviceBindingTablesDropped` / `executionPlacementsBackfilled` / `executionPlacementSessionsUnreadable` 与 `device_bindings_orphaned` / `execution_placement_session_unreadable` 两行 warn;`test/execution-placement-switch-db-integration.test.ts` 整份与 `test/one-time-migrations.test.ts` 的 M32 组。" +
+            "**local 腿的回填席与它的点名词一并删**:`LocalSessionStore` 的 `executionPlacementBackfill`(属性与构造里的那一臂)、`execution-placement.ts` 的 `LocalPlacementBackfillSeat` / `UnusableArchive` / `UnusableArchiveWord`(含它的 `storage` 词 —— 读存档文件时抛了别的故障、`errno` 随带,该词只有回填点名用)/ `isUnusableArchive`、" +
+            "`ExecutionPlacementSessionUnreadable`;`local-session-store.ts` 里 `placementRead` 并回 `readExecutionPlacement`、`metaRead` 的 unusable 臂与 `forkingOf` 的 `storage` 臂改成就地上抛 `probe.fault`(`archiveFaultWord` / `unusableArchiveOf` 随词删,探针只留「不在」与已知在而用不了的读法);" +
+            "`test/execution-placement-switch-local.test.ts` 与 `test/execution-placement-local-boot-unreadable-e2e.test.ts` 整份。" +
+            "**不随本条删**:执行放置八列、会话店的执行席、设备店的首绑 / 换绑两只写(常设的数据形)",
+        afterRemoval: "起服对账一族的跳版库拒启臂接住:删码同版把 `device_session` / `device_session_retired` 两张表加进退役 schema 判据(`schema-consistency.ts` 的跳版库探针,先于建表)⇒ " +
+            "跳过了带本条的版本直接升的库响亮拒启,出路 = 先在带本条的版本起服一次让切换走完,再升;缺执行放置列的库由列集对账缺列拒启(`config.schema_mismatch`,拒句给 ALTER),同一出路",
+        reportKeys: ["executionPlacementColumnsAdded", "deviceBindingsMoved", "deviceBindingsOrphaned", "deviceBindingTablesDropped", "executionPlacementsBackfilled", "askExecutionLanesBackfilled", "executionPlacementSessionsUnreadable"],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;
@@ -521,6 +572,10 @@ export const NO_SQL_MIGRATIONS = {
     parkedApprovalCardsBackfilled: 0,
     parkedApprovalCardRowsUnreadable: [],
     parkedApprovalCardRowsTooLong: [],
+    executionPlacementColumnsAdded: 0,
+    deviceBindingsMoved: 0,
+    deviceBindingsOrphaned: 0,
+    deviceBindingTablesDropped: 0,
 };
 function mysqlDb(conn) {
     return {
@@ -547,7 +602,7 @@ function pgDb(client) {
     };
 }
 async function tableExists(db, dialect, table) {
-    const sql = dialect === "tidb"
+    const sql = dialect === "mysql"
         ? `SELECT 1 AS present FROM information_schema.tables WHERE table_schema = DATABASE() AND table_name = '${table}'`
         : `SELECT 1 AS present FROM information_schema.tables WHERE table_schema = current_schema() AND table_name = '${table}'`;
     return (await db.rows(sql)).length > 0;
@@ -562,12 +617,12 @@ async function execUntil(db, sql, postcondition) {
     }
 }
 async function columnExists(db, dialect, table, column) {
-    const scope = dialect === "tidb" ? "DATABASE()" : "current_schema()";
+    const scope = dialect === "mysql" ? "DATABASE()" : "current_schema()";
     const sql = `SELECT 1 AS present FROM information_schema.columns WHERE table_schema = ${scope} AND table_name = '${table}' AND column_name = '${column}'`;
     return (await db.rows(sql)).length > 0;
 }
-export async function runSqlOneTimeMigrations(dialect, pool) {
-    return dialect === "tidb" ? withMysqlLock(pool, (db) => migrateOn(db, "tidb")) : withPgLock(pool, (db) => migrateOn(db, "pg"));
+export async function runSqlOneTimeMigrations(dialect, pool, input) {
+    return dialect === "mysql" ? withMysqlLock(pool, (db) => migrateOn(db, "mysql", input)) : withPgLock(pool, (db) => migrateOn(db, "pg", input));
 }
 async function withMysqlLock(pool, run) {
     const conn = await pool.getConnection();
@@ -597,21 +652,21 @@ async function withPgLock(pool, run) {
         client.release();
     }
 }
-async function migrateOn(db, dialect) {
+async function migrateOn(db, dialect, input) {
     const receipts = buildMigrationReceipts();
     try {
-        await migrateStepsOn(db, dialect, receipts);
+        await migrateStepsOn(db, dialect, receipts, input);
     }
     catch (e) {
         throw changedAnything(receipts) ? new OneTimeMigrationInterruptedError(e, readingsSnapshot(receipts)) : e;
     }
     return completedReport(receipts);
 }
-async function migrateStepsOn(db, dialect, receipts) {
-    receipts.holderDeathCodeRowsBackfilled += await db.exec(dialect === "tidb"
+async function migrateStepsOn(db, dialect, receipts, input) {
+    receipts.holderDeathCodeRowsBackfilled += await db.exec(dialect === "mysql"
         ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND error = ?"
         : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND error = $2", [RUN_HOLDER_DEATH_CODES.stalled, RUN_STALLED_ERROR]);
-    receipts.holderDeathCodeRowsBackfilled += await db.exec(dialect === "tidb"
+    receipts.holderDeathCodeRowsBackfilled += await db.exec(dialect === "mysql"
         ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND (error = ? OR error LIKE ?)"
         : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND (error = $2 OR error LIKE $3)", [RUN_HOLDER_DEATH_CODES.orphaned, RUN_ORPHANED_ERROR, `${RUN_ORPHANED_ERROR} (%`]);
     await migrateShadowedRuleKey(db, dialect, receipts);
@@ -628,6 +683,289 @@ async function migrateStepsOn(db, dialect, receipts) {
     if (await tableExists(db, dialect, RETIRED_BREAKER_TABLE))
         await dropRetiredBreakerTable(db, dialect, receipts);
     await dropRejectedMailboxKeys(db, dialect, receipts);
+    await switchExecutionPlacement(db, dialect, receipts, input);
+}
+const RETIRED_DEVICE_BINDING_TABLE = "device_session";
+const PARKED_DEVICE_BINDING_TABLE = "device_session_retired";
+const BINDING_COLUMNS = "root_session_id, device_id, owner_tenant, owner_subject, bound_at, rev";
+const FENCE_ROOTS_SHOWN = 20;
+export const EXECUTION_PLACEMENT_SWITCH_REFUSED_CODE = "config.execution_placement_switch_refused";
+export class ExecutionPlacementSwitchRefusedError extends StoreBootRefusalError {
+    reason;
+    code = EXECUTION_PLACEMENT_SWITCH_REFUSED_CODE;
+    constructor(reason, detail) {
+        super(`${EXECUTION_PLACEMENT_SWITCH_REFUSED_CODE} (reason: ${reason}): ${detail}`);
+        this.reason = reason;
+        this.name = "ExecutionPlacementSwitchRefusedError";
+    }
+}
+async function readSwitchShape(db, dialect) {
+    const sessionMeta = await tableExists(db, dialect, "session_meta");
+    const placementColumns = new Set();
+    if (sessionMeta)
+        for (const c of SESSION_META_PLACEMENT_COLUMNS)
+            if (await columnExists(db, dialect, "session_meta", c.name))
+                placementColumns.add(c.name);
+    return {
+        sessionMeta,
+        placementColumns,
+        bindingTable: await tableExists(db, dialect, RETIRED_DEVICE_BINDING_TABLE),
+        parkedTable: await tableExists(db, dialect, PARKED_DEVICE_BINDING_TABLE),
+        taskRun: sessionMeta && (await tableExists(db, dialect, "task_run")),
+        ...(await askTableShape(db, dialect)),
+    };
+}
+async function askTableShape(db, dialect) {
+    const askTable = await tableExists(db, dialect, APPROVAL_ASK_TABLE);
+    return { askTable, askLaneColumn: askTable && (await columnExists(db, dialect, APPROVAL_ASK_TABLE, "execution_lane")) };
+}
+function switchStarted(s) {
+    return s.placementColumns.has("execution_role") || s.parkedTable;
+}
+const SWITCH_COMPLETION_COLUMN = "fork_key";
+function switchComplete(s) {
+    return s.placementColumns.size === SESSION_META_PLACEMENT_COLUMNS.length && (!s.askTable || s.askLaneColumn) && !s.bindingTable && !s.parkedTable;
+}
+function askLaneBackfillSql(dialect) {
+    return dialect === "mysql"
+        ? `UPDATE ${APPROVAL_ASK_TABLE} a LEFT JOIN session_meta sm ON sm.session_id = a.session_id AND sm.placement_kind IS NULL SET a.execution_lane = COALESCE(sm.execution_lane, ?) WHERE a.execution_lane = ''`
+        : `UPDATE ${APPROVAL_ASK_TABLE} a SET execution_lane = COALESCE((SELECT sm.execution_lane FROM session_meta sm WHERE sm.session_id = a.session_id AND sm.placement_kind IS NULL), $1) WHERE a.execution_lane = ''`;
+}
+async function parkedRelationNamesWithRetiredPrefix(db) {
+    const rows = await db.rows(`SELECT i.relname AS name FROM pg_index x JOIN pg_class i ON i.oid = x.indexrelid JOIN pg_class t ON t.oid = x.indrelid WHERE t.relname = '${PARKED_DEVICE_BINDING_TABLE}' AND t.relnamespace = current_schema()::regnamespace AND i.relname LIKE '${RETIRED_DEVICE_BINDING_TABLE}\\_%'`);
+    return rows.map((r) => String(r["name"])).filter((name) => name.startsWith(`${RETIRED_DEVICE_BINDING_TABLE}_`) && !name.startsWith(PARKED_DEVICE_BINDING_TABLE));
+}
+const bindingRootKey = (dialect, alias) => (dialect === "mysql" ? `CONVERT(${alias}.root_session_id USING utf8mb4) COLLATE utf8mb4_bin` : `${alias}.root_session_id`);
+async function refuseOnSwitchFence(read, dialect, shape) {
+    if (!switchStarted(shape) || !shape.bindingTable)
+        return;
+    const rows = await read(`SELECT ${bindingRootKey(dialect, "ds")} AS root FROM ${RETIRED_DEVICE_BINDING_TABLE} ds LIMIT ${FENCE_ROOTS_SHOWN + 1}`);
+    if (rows.length === 0)
+        return;
+    const roots = rows.slice(0, FENCE_ROOTS_SHOWN).map((r) => (Buffer.isBuffer(r["root"]) ? r["root"].toString("utf8") : String(r["root"])));
+    const more = rows.length > FENCE_ROOTS_SHOWN ? ` (and more — the table holds over ${FENCE_ROOTS_SHOWN} rows)` : "";
+    const rename = dialect === "mysql" ? `RENAME TABLE ${RETIRED_DEVICE_BINDING_TABLE} TO ${PARKED_DEVICE_BINDING_TABLE};` : `ALTER TABLE ${RETIRED_DEVICE_BINDING_TABLE} RENAME TO ${PARKED_DEVICE_BINDING_TABLE};`;
+    const adopt = shape.parkedTable
+        ? `DELETE FROM ${PARKED_DEVICE_BINDING_TABLE} WHERE root_session_id IN (SELECT root_session_id FROM ${RETIRED_DEVICE_BINDING_TABLE}); INSERT INTO ${PARKED_DEVICE_BINDING_TABLE} (${BINDING_COLUMNS}) SELECT ${BINDING_COLUMNS} FROM ${RETIRED_DEVICE_BINDING_TABLE}; DELETE FROM ${RETIRED_DEVICE_BINDING_TABLE};`
+        : rename;
+    throw new ExecutionPlacementSwitchRefusedError("fence", `the switch of session↔device bindings onto the root session rows has started on this database, yet the retired binding table ${RETIRED_DEVICE_BINDING_TABLE} holds rows again — ` +
+        `an earlier server version still writing it after the switch began, or rows written by hand. This server cannot tell whether they are newer than the placements ` +
+        `already on the session rows and refuses to pick: nothing was changed (this check runs before any DDL). Root sessions in that table: ${roots.join(", ")}${more}. ` +
+        `Stop every earlier-version replica first, then choose one: adopt those rows (they overwrite the device placement of their root sessions on the next start): \`${adopt}\` — ` +
+        `or discard them (the session rows keep what they hold): \`DELETE FROM ${RETIRED_DEVICE_BINDING_TABLE};\` — then start this version again; its own migration removes the emptied table on that start`);
+}
+async function sessionRowsAwaitingBackfill(read, dialect, shape) {
+    if (!shape.sessionMeta || !shape.taskRun)
+        return false;
+    const bindingSource = shape.parkedTable ? PARKED_DEVICE_BINDING_TABLE : shape.bindingTable ? RETIRED_DEVICE_BINDING_TABLE : undefined;
+    const sql = "SELECT 1 AS hit FROM session_meta sm WHERE sm.placement_kind IS NULL" +
+        (shape.placementColumns.has("execution_role") ? " AND sm.execution_role IS NULL" : "") +
+        " AND EXISTS (SELECT 1 FROM task_run tr WHERE tr.session_id = sm.session_id)" +
+        (bindingSource !== undefined ? ` AND NOT EXISTS (SELECT 1 FROM ${bindingSource} ds WHERE ${bindingRootKey(dialect, "ds")} = sm.session_id)` : "") +
+        " LIMIT 1";
+    return (await read(sql)).length > 0;
+}
+async function askRowsAwaitingLane(read, _dialect, shape) {
+    if (!shape.askTable)
+        return false;
+    return (await read(`SELECT 1 AS hit FROM ${APPROVAL_ASK_TABLE}${shape.askLaneColumn ? " WHERE execution_lane = ''" : ""} LIMIT 1`)).length > 0;
+}
+const EXECUTION_PLACEMENT_BACKFILL_NEEDS = [
+    { what: "session rows that have runs but no execution placement (they would be placed on the only declared lane)", holds: sessionRowsAwaitingBackfill },
+    { what: "approval ask rows that do not record the execution lane they were raised on (they would record their root session's lane, or the only declared lane)", holds: askRowsAwaitingLane },
+];
+async function refuseOnAmbiguousBackfill(read, dialect, shape, lanes) {
+    if (!shape.sessionMeta || switchComplete(shape) || lanes.length === 1)
+        return;
+    const pending = [];
+    for (const need of EXECUTION_PLACEMENT_BACKFILL_NEEDS)
+        if (await need.holds(read, dialect, shape))
+            pending.push(need.what);
+    if (pending.length === 0)
+        return;
+    throw new ExecutionPlacementSwitchRefusedError("backfill_ambiguous", `this database still holds rows the switch must place on an execution lane (${pending.join("; ")}), and the deployment declares ${lanes.length === 0 ? "no lane" : `${lanes.length} lanes (${lanes.join(", ")})`} — ` +
+        "with more than one lane there is no single right answer, and this server will not guess one. Nothing was changed (this check runs before any DDL). " +
+        "Start this version once with a single declared lane (REMOTE_EXEC set to one lane) so the switch completes, then declare the additional lanes");
+}
+export async function assertExecutionPlacementSwitchAdmissible(read, dialect, input) {
+    const shape = await readSwitchShape({ rows: (sql) => read(sql) }, dialect);
+    if (!shape.sessionMeta)
+        return;
+    await refuseOnSwitchFence(read, dialect, shape);
+    await refuseOnAmbiguousBackfill(read, dialect, shape, input.lanes);
+}
+export async function assertExecutionPlacementSwitchAdmissibleOnPool(dialect, pool, input) {
+    if (dialect === "mysql") {
+        const conn = await pool.getConnection();
+        try {
+            await assertExecutionPlacementSwitchAdmissible(async (sql) => (await conn.query(sql))[0], "mysql", input);
+        }
+        finally {
+            conn.release();
+        }
+        return;
+    }
+    const client = await pool.connect();
+    try {
+        await assertExecutionPlacementSwitchAdmissible(async (sql) => (await client.query(sql)).rows, "pg", input);
+    }
+    finally {
+        client.release();
+    }
+}
+const EXECUTION_PLACEMENT_SWITCH_STEPS = [
+    {
+        id: "⓪ drop the empty retired binding table",
+        run: async ({ db, receipts, shape }) => {
+            const s = await shape();
+            if (!switchStarted(s) || !s.bindingTable)
+                return;
+            await execUntil(db, `DROP TABLE ${RETIRED_DEVICE_BINDING_TABLE}`, async () => !(await shape()).bindingTable);
+            receipts.deviceBindingTablesDropped += 1;
+        },
+    },
+    {
+        id: "① park the retired binding table",
+        run: async ({ db, dialect, shape }) => {
+            const s = await shape();
+            if (!s.bindingTable || s.placementColumns.has("execution_role"))
+                return;
+            const sql = dialect === "mysql" ? `RENAME TABLE ${RETIRED_DEVICE_BINDING_TABLE} TO ${PARKED_DEVICE_BINDING_TABLE}` : `ALTER TABLE ${RETIRED_DEVICE_BINDING_TABLE} RENAME TO ${PARKED_DEVICE_BINDING_TABLE}`;
+            await execUntil(db, sql, async () => {
+                const after = await shape();
+                return after.parkedTable && !after.bindingTable;
+            });
+        },
+    },
+    {
+        id: "①′ rename the parked table's constraints and indexes (PG)",
+        run: async ({ db, dialect, shape }) => {
+            if (dialect !== "pg" || !(await shape()).parkedTable)
+                return;
+            const stale = async () => parkedRelationNamesWithRetiredPrefix(db);
+            for (const name of await stale()) {
+                const renamed = `${PARKED_DEVICE_BINDING_TABLE}${name.slice(RETIRED_DEVICE_BINDING_TABLE.length)}`;
+                await execUntil(db, `ALTER INDEX "${name}" RENAME TO "${renamed}"`, async () => !(await stale()).includes(name));
+            }
+        },
+    },
+    {
+        id: "② add the execution placement columns",
+        run: async ({ db, dialect, receipts, shape }) => {
+            for (const column of SESSION_META_PLACEMENT_COLUMNS) {
+                if (column.name === SWITCH_COMPLETION_COLUMN)
+                    continue;
+                if ((await shape()).placementColumns.has(column.name))
+                    continue;
+                await execUntil(db, `ALTER TABLE session_meta ADD COLUMN ${column[dialect]}`, async () => (await shape()).placementColumns.has(column.name));
+                receipts.executionPlacementColumnsAdded += 1;
+            }
+            const ask = await shape();
+            if (ask.askTable && !ask.askLaneColumn) {
+                await execUntil(db, `ALTER TABLE ${APPROVAL_ASK_TABLE} ADD COLUMN ${APPROVAL_ASK_EXECUTION_LANE_COLUMN[dialect]}`, async () => (await shape()).askLaneColumn);
+                receipts.executionPlacementColumnsAdded += 1;
+            }
+        },
+    },
+    {
+        id: "③ move the bindings onto the root session rows",
+        run: async ({ db, dialect, receipts, shape }) => {
+            if (!(await shape()).parkedTable)
+                return;
+            const orphans = countOrphanBindingsStatement(dialect, PARKED_DEVICE_BINDING_TABLE);
+            receipts.deviceBindingsOrphaned += Number((await db.rows(orphans.text, orphans.values))[0]?.["orphans"] ?? 0);
+            const move = migrateDeviceBindingsStatement(dialect, PARKED_DEVICE_BINDING_TABLE);
+            receipts.deviceBindingsMoved += await db.exec(move.text, move.values);
+        },
+    },
+    {
+        id: "④ backfill placements of sessions with runs",
+        run: async ({ db, dialect, input, receipts, shape }) => {
+            const s = await shape();
+            if (input.lanes.length !== 1) {
+                await refuseOnAmbiguousBackfill((sql) => db.rows(sql), dialect, s, input.lanes);
+                return;
+            }
+            const lane = input.lanes[0];
+            const backfill = backfillWriterStatement(dialect, lane, new Date());
+            receipts.executionPlacementsBackfilled += await db.exec(backfill.text, backfill.values);
+        },
+    },
+    {
+        id: "④b backfill the execution lane of approval ask rows",
+        run: async ({ db, dialect, input, receipts, shape }) => {
+            const s = await shape();
+            if (!s.askTable || !s.askLaneColumn)
+                return;
+            if (input.lanes.length !== 1) {
+                await refuseOnAmbiguousBackfill((sql) => db.rows(sql), dialect, s, input.lanes);
+                return;
+            }
+            receipts.askExecutionLanesBackfilled += await db.exec(askLaneBackfillSql(dialect), [input.lanes[0]]);
+        },
+    },
+    {
+        id: "⑤ drop the parked binding table",
+        run: async ({ db, receipts, shape }) => {
+            if (!(await shape()).parkedTable)
+                return;
+            await execUntil(db, `DROP TABLE ${PARKED_DEVICE_BINDING_TABLE}`, async () => !(await shape()).parkedTable);
+            receipts.deviceBindingTablesDropped += 1;
+        },
+    },
+    {
+        id: "⑥ add the completion marker column",
+        run: async ({ db, dialect, receipts, shape }) => {
+            if ((await shape()).placementColumns.has(SWITCH_COMPLETION_COLUMN))
+                return;
+            const marker = SESSION_META_PLACEMENT_COLUMNS.find((c) => c.name === SWITCH_COMPLETION_COLUMN);
+            await execUntil(db, `ALTER TABLE session_meta ADD COLUMN ${marker[dialect]}`, async () => (await shape()).placementColumns.has(SWITCH_COMPLETION_COLUMN));
+            receipts.executionPlacementColumnsAdded += 1;
+        },
+    },
+];
+export async function switchExecutionPlacement(db, dialect, receipts, input) {
+    const shape = () => readSwitchShape(db, dialect);
+    const start = await shape();
+    if (!start.sessionMeta || switchComplete(start))
+        return;
+    await refuseOnSwitchFence((sql) => db.rows(sql), dialect, start);
+    for (const step of EXECUTION_PLACEMENT_SWITCH_STEPS)
+        await step.run({ db, dialect, input, receipts, shape });
+}
+export async function backfillLocalExecutionPlacements(sessionIds, seat, input) {
+    const absent = [];
+    const unreadable = [];
+    for (const root of sessionIds) {
+        const reading = await seat.read(root);
+        if (reading === undefined)
+            continue;
+        if (isUnusableArchive(reading))
+            unreadable.push({ sessionId: root, fault: reading.word, ...(reading.errno !== undefined ? { errno: reading.errno } : {}) });
+        else if (reading.cell.role === "absent")
+            absent.push({ root, occupant: reading.occupant });
+    }
+    if (absent.length === 0)
+        return { backfilled: 0, unreadable };
+    if (input.lanes.length !== 1) {
+        throw new ExecutionPlacementSwitchRefusedError("backfill_ambiguous", `the local data root holds sessions that have runs but no execution placement (${absent.length}), and the deployment declares ${input.lanes.length === 0 ? "no lane" : `${input.lanes.length} lanes (${input.lanes.join(", ")})`} — ` +
+            "with more than one lane there is no single right answer, and this server will not guess one. Nothing was changed. " +
+            "Start this version once with a single declared lane (REMOTE_EXEC set to one lane), then declare the additional lanes");
+    }
+    const lane = input.lanes[0];
+    let placed = 0;
+    for (const { root, occupant } of absent) {
+        if ((await seat.place(root, occupant, { role: "writer", lane })).outcome === "placed")
+            placed += 1;
+    }
+    return { backfilled: placed, unreadable };
+}
+export function backfillLocalAskExecutionLanes(store, input) {
+    return store.backfillExecutionLanes(input.lanes, (pending) => {
+        throw new ExecutionPlacementSwitchRefusedError("backfill_ambiguous", `the local approval ask journal holds asks that do not record the execution lane they were raised on (${pending}), and the deployment declares ${input.lanes.length === 0 ? "no lane" : `${input.lanes.length} lanes (${input.lanes.join(", ")})`} — ` +
+            "with more than one lane there is no single right answer, and this server will not guess one. Nothing was changed. " +
+            "Start this version once with a single declared lane (REMOTE_EXEC set to one lane), then declare the additional lanes");
+    });
 }
 const MAILBOX_KEY_SCAN_PAGE = 1000;
 async function dropRejectedMailboxKeys(db, dialect, receipts) {
@@ -635,7 +973,7 @@ async function dropRejectedMailboxKeys(db, dialect, receipts) {
     for (const table of MAILBOX_KEYED_TABLES)
         if (await tableExists(db, dialect, table))
             present.push(table);
-    const p = (i) => (dialect === "tidb" ? "?" : `$${i}`);
+    const p = (i) => (dialect === "mysql" ? "?" : `$${i}`);
     for (const table of present) {
         let after;
         for (;;) {
@@ -669,14 +1007,14 @@ const M24_OWNER_INCARNATION = "m24-backfill";
 const M24_COPY_BATCH_BYTES = 32 * 1024 * 1024;
 const M24_COPY_SCAN_PAGE = 1000;
 function journalKeyBound(dialect, op, first) {
-    const p = (i) => (dialect === "tidb" ? "?" : `$${first + i}`);
+    const p = (i) => (dialect === "mysql" ? "?" : `$${first + i}`);
     return op === "after"
         ? `(${WORKFLOW_JOURNAL_TABLE}.run_id > ${p(0)} OR (${WORKFLOW_JOURNAL_TABLE}.run_id = ${p(1)} AND ordinal > ${p(2)}))`
         : `(${WORKFLOW_JOURNAL_TABLE}.run_id < ${p(0)} OR (${WORKFLOW_JOURNAL_TABLE}.run_id = ${p(1)} AND ordinal <= ${p(2)}))`;
 }
 async function copyJournalInBatches(db, dialect) {
     const T = WORKFLOW_JOURNAL_TABLE;
-    const bytes = dialect === "tidb" ? "LENGTH(result)" : "OCTET_LENGTH(result)";
+    const bytes = dialect === "mysql" ? "LENGTH(result)" : "OCTET_LENGTH(result)";
     const copyHead = `INSERT INTO ${WORKFLOW_JOURNAL_STAGING} (run_id, incarnation, ordinal, call_key, result, created_at_ms) ` +
         `SELECT ${T}.run_id, o.incarnation, ordinal, call_key, ${jsonColumnText(dialect, "result")}, created_at_ms FROM ${T} ` +
         `JOIN ${WORKFLOW_JOURNAL_OWNER_TABLE} o ON o.run_id = ${T}.run_id AND o.scope = ${T}.${RETIRED_JOURNAL_SCOPE_COLUMN} WHERE `;
@@ -715,7 +1053,7 @@ export async function moveWorkflowJournalScope(db, dialect, receipts) {
         receipts.workflowJournalScopeColumn = "current";
         return;
     }
-    const ddl = (dialect === "tidb" ? SCHEMA_STATEMENTS : PG_SCHEMA_STATEMENTS).find((stmt) => stmt.includes(`CREATE TABLE IF NOT EXISTS ${T} (`));
+    const ddl = (dialect === "mysql" ? SCHEMA_STATEMENTS : PG_SCHEMA_STATEMENTS).find((stmt) => stmt.includes(`CREATE TABLE IF NOT EXISTS ${T} (`));
     if (ddl === undefined)
         throw new Error(`one-time migration M24: the central schema carries no definition of ${T} — refusing to rebuild a table it cannot define`);
     if (await exists(S))
@@ -729,7 +1067,7 @@ export async function moveWorkflowJournalScope(db, dialect, receipts) {
     await db.exec(ddl.replace(`CREATE TABLE IF NOT EXISTS ${T} (`, `CREATE TABLE IF NOT EXISTS ${S} (`));
     await copyJournalInBatches(db, dialect);
     const swapped = async () => !(await exists(S)) && (await exists(T)) && !(await legacy());
-    if (dialect === "tidb") {
+    if (dialect === "mysql") {
         await execUntil(db, `RENAME TABLE ${T} TO ${O}, ${S} TO ${T}`, swapped);
         receipts.workflowJournalForeignScopeRowsRemoved += foreign;
         await execUntil(db, `DROP TABLE IF EXISTS ${O}`, async () => !(await exists(O)));
@@ -772,9 +1110,9 @@ const M17_PROVEN_GRAMMAR = 1;
 const RETIRED_BUCKET_PATTERNS = ['%"commandDeny"%', '%"commandAllow"%'];
 async function scanSessionRuleRows(db, dialect, column, patterns, visit) {
     const text = jsonColumnTextExpr(dialect, column);
-    const prefilter = patterns.length === 0 ? "" : ` AND (${patterns.map((_, i) => `${text} LIKE ${dialect === "tidb" ? "?" : `$${i + 2}`}`).join(" OR ")})`;
-    const scan = dialect === "tidb"
-        ? `SELECT policy_key, session_id, rev, ${jsonColumnText("tidb", column)} FROM ${SESSION_POLICY_TABLE} WHERE policy_key > ?${prefilter} ORDER BY policy_key LIMIT ${SESSION_RULES_SCAN_PAGE}`
+    const prefilter = patterns.length === 0 ? "" : ` AND (${patterns.map((_, i) => `${text} LIKE ${dialect === "mysql" ? "?" : `$${i + 2}`}`).join(" OR ")})`;
+    const scan = dialect === "mysql"
+        ? `SELECT policy_key, session_id, rev, ${jsonColumnText("mysql", column)} FROM ${SESSION_POLICY_TABLE} WHERE policy_key > ?${prefilter} ORDER BY policy_key LIMIT ${SESSION_RULES_SCAN_PAGE}`
         : `SELECT policy_key, session_id, rev, ${jsonColumnText("pg", column)} FROM ${SESSION_POLICY_TABLE} WHERE policy_key > $1${prefilter} ORDER BY policy_key LIMIT ${SESSION_RULES_SCAN_PAGE}`;
     let cursor = "";
     for (;;) {
@@ -799,7 +1137,7 @@ async function scanSessionRuleRows(db, dialect, column, patterns, visit) {
 async function judgeOldGrammarRows(db, dialect, receipts) {
     const column = OLD_GRAMMAR_SESSION_RULES_COLUMN;
     const text = jsonColumnTextExpr(dialect, column);
-    const cas = dialect === "tidb"
+    const cas = dialect === "mysql"
         ? `UPDATE ${SESSION_POLICY_TABLE} SET ${column} = ? WHERE policy_key = ? AND CAST(${text} AS BINARY) = CAST(? AS BINARY)`
         : `UPDATE ${SESSION_POLICY_TABLE} SET ${column} = $1::jsonb WHERE policy_key = $2 AND ${text} = $3`;
     await scanSessionRuleRows(db, dialect, column, [], async (row) => {
@@ -850,12 +1188,12 @@ export async function migrateSessionRuleGrammar(db, dialect, receipts) {
     });
 }
 function renameSessionRulesColumnSql(dialect, from, to) {
-    const definition = SESSION_RULES_COLUMN.tidb.slice(SESSION_RULES_COLUMN.name.length);
-    return dialect === "tidb" ? `ALTER TABLE ${SESSION_POLICY_TABLE} CHANGE COLUMN ${from} ${to}${definition}` : `ALTER TABLE ${SESSION_POLICY_TABLE} RENAME COLUMN ${from} TO ${to}`;
+    const definition = SESSION_RULES_COLUMN.mysql.slice(SESSION_RULES_COLUMN.name.length);
+    return dialect === "mysql" ? `ALTER TABLE ${SESSION_POLICY_TABLE} CHANGE COLUMN ${from} ${to}${definition}` : `ALTER TABLE ${SESSION_POLICY_TABLE} RENAME COLUMN ${from} TO ${to}`;
 }
 const WORKFLOW_PARK_INDEX_TABLE = "workflow_agent_session";
 async function primaryKeyWidth(db, dialect, table) {
-    const sql = dialect === "tidb"
+    const sql = dialect === "mysql"
         ? `SELECT COUNT(*) AS n FROM information_schema.key_column_usage WHERE table_schema = DATABASE() AND table_name = '${table}' AND constraint_name = 'PRIMARY'`
         : `SELECT COUNT(*) AS n FROM information_schema.table_constraints tc JOIN information_schema.key_column_usage kcu ` +
             `ON kcu.constraint_name = tc.constraint_name AND kcu.table_schema = tc.table_schema AND kcu.table_name = tc.table_name ` +
@@ -869,10 +1207,10 @@ async function reshapeWorkflowParkIndex(db, dialect, receipts) {
     const S = WORKFLOW_PARK_INDEX_STAGING;
     const O = WORKFLOW_PARK_INDEX_RETIRED;
     const exists = (t) => tableExists(db, dialect, t);
-    const ddl = (dialect === "tidb" ? SCHEMA_STATEMENTS : PG_SCHEMA_STATEMENTS).find((stmt) => stmt.includes(`CREATE TABLE IF NOT EXISTS ${T} (`));
+    const ddl = (dialect === "mysql" ? SCHEMA_STATEMENTS : PG_SCHEMA_STATEMENTS).find((stmt) => stmt.includes(`CREATE TABLE IF NOT EXISTS ${T} (`));
     if (ddl === undefined)
         throw new Error(`one-time migration M9: the central schema carries no definition of ${T} — refusing to reshape a table it cannot rebuild`);
-    const copyPointers = (to, from) => db.exec(dialect === "tidb"
+    const copyPointers = (to, from) => db.exec(dialect === "mysql"
         ? `INSERT IGNORE INTO ${to} (session_id, run_id, agent_key, scope) SELECT session_id, run_id, agent_key, scope FROM ${from}`
         : `INSERT INTO ${to} (session_id, run_id, agent_key, scope) SELECT session_id, run_id, agent_key, scope FROM ${from} ON CONFLICT DO NOTHING`);
     const resumed = await exists(S);
@@ -892,7 +1230,7 @@ async function reshapeWorkflowParkIndex(db, dialect, receipts) {
     await db.exec(ddl.replace(`CREATE TABLE IF NOT EXISTS ${T} (`, `CREATE TABLE IF NOT EXISTS ${S} (`));
     receipts.workflowParkIndexRowsCarried += await copyPointers(S, T);
     const swapped = async () => !(await exists(S)) && (await exists(T)) && (await primaryKeyWidth(db, dialect, T)) !== 1;
-    if (dialect === "tidb") {
+    if (dialect === "mysql") {
         await execUntil(db, `RENAME TABLE ${T} TO ${O}, ${S} TO ${T}`, swapped);
         await execUntil(db, `DROP TABLE IF EXISTS ${O}`, async () => !(await exists(O)));
     }
@@ -922,7 +1260,7 @@ async function execAtomically(db, statements, postcondition) {
     }
 }
 async function finishParkIndexShape(db, dialect) {
-    await ensureIndexes(async (sql, params) => (dialect === "tidb" ? [await db.rows(sql, params)] : { rows: await db.rows(sql, params) }), dialect === "tidb" ? "mysql" : "pg", CENTRAL_SCHEMA_INDEXES.filter((spec) => spec.table === WORKFLOW_PARK_INDEX_TABLE));
+    await ensureIndexes(async (sql, params) => (dialect === "mysql" ? [await db.rows(sql, params)] : { rows: await db.rows(sql, params) }), dialect, CENTRAL_SCHEMA_INDEXES.filter((spec) => spec.table === WORKFLOW_PARK_INDEX_TABLE));
     if (dialect !== "pg")
         return;
     const conventional = `${WORKFLOW_PARK_INDEX_TABLE}_pkey`;
@@ -955,7 +1293,7 @@ async function migrateShadowedRuleKey(db, dialect, receipts) {
     const like = `%"${RETIRED_SHADOWED_RULE_KEY}"%`;
     let after = "";
     for (;;) {
-        const rows = await db.rows(dialect === "tidb"
+        const rows = await db.rows(dialect === "mysql"
             ? `SELECT token, ${jsonColumnText(dialect, "risk_descriptor")} FROM checkpoint WHERE ${jsonColumnTextExpr(dialect, "risk_descriptor")} LIKE ? AND token > ? ORDER BY token LIMIT ${SHADOWED_RULE_BATCH}`
             : `SELECT token, ${jsonColumnText(dialect, "risk_descriptor")} FROM checkpoint WHERE ${jsonColumnTextExpr(dialect, "risk_descriptor")} LIKE $1 AND token > $2 ORDER BY token LIMIT ${SHADOWED_RULE_BATCH}`, [like, after]);
         for (const r of rows) {
@@ -971,7 +1309,7 @@ async function migrateShadowedRuleKey(db, dialect, receipts) {
             }
             if (next.kind === "untouched")
                 continue;
-            receipts.allowRuleShadowRowsMigrated += await db.exec(dialect === "tidb"
+            receipts.allowRuleShadowRowsMigrated += await db.exec(dialect === "mysql"
                 ? `UPDATE checkpoint SET risk_descriptor = ? WHERE token = ? AND ${jsonColumnTextExpr(dialect, "risk_descriptor")} = ?`
                 : `UPDATE checkpoint SET risk_descriptor = $1 WHERE token = $2 AND ${jsonColumnTextExpr(dialect, "risk_descriptor")} = $3`, [next.text, token, text]);
         }
@@ -1004,7 +1342,7 @@ async function migrateRetiredCardWords(db, dialect, receipts) {
     const cardText = jsonColumnTextExpr(dialect, "card_json");
     let after = "";
     for (;;) {
-        const rows = await db.rows(dialect === "tidb"
+        const rows = await db.rows(dialect === "mysql"
             ? `SELECT ask_id, ${jsonColumnText(dialect, "card_json")} FROM approval_ask WHERE (${cardText} LIKE ? OR ${cardText} LIKE ?) AND ask_id > ? ORDER BY ask_id LIMIT ${RETIRED_CARD_WORD_BATCH}`
             : `SELECT ask_id, ${jsonColumnText(dialect, "card_json")} FROM approval_ask WHERE (${cardText} LIKE $1 OR ${cardText} LIKE $2) AND ask_id > $3 ORDER BY ask_id LIMIT ${RETIRED_CARD_WORD_BATCH}`, [...RETIRED_CARD_WORD_PATTERNS, after]);
         for (const r of rows) {
@@ -1020,7 +1358,7 @@ async function migrateRetiredCardWords(db, dialect, receipts) {
             }
             if (next.kind === "untouched")
                 continue;
-            receipts.retiredCardWordAskRowsRewritten += await db.exec(dialect === "tidb"
+            receipts.retiredCardWordAskRowsRewritten += await db.exec(dialect === "mysql"
                 ? `UPDATE approval_ask SET card_json = ? WHERE ask_id = ? AND CAST(${cardText} AS BINARY) = CAST(? AS BINARY)`
                 : `UPDATE approval_ask SET card_json = $1 WHERE ask_id = $2 AND ${cardText} = $3`, [next.text, askId, text]);
         }
@@ -1060,7 +1398,7 @@ function m21Subtree(cell, where) {
     }
 }
 export async function repairParkedRows(db, dialect, receipts) {
-    const ph = (n) => (dialect === "tidb" ? "?" : `$${n}`);
+    const ph = (n) => (dialect === "mysql" ? "?" : `$${n}`);
     const kinds = APPROVAL_GATE_KINDS;
     const kindSlots = kinds.map((_, i) => ph(i + 1)).join(", ");
     const scan = `SELECT token, session_id, gate_kind, ${jsonColumnText(dialect, "checkpoint", M21_GATE)}, ${jsonColumnText(dialect, "checkpoint", M21_PENDING_ACTION)} FROM checkpoint ` +
@@ -1103,7 +1441,7 @@ export async function repairParkedRows(db, dialect, receipts) {
                 continue;
             }
             const next = encode({ ...doc, gate: { ...gate, approvalCard: QUESTION_CARD } }, "checkpoint (M21 question-card repair)");
-            receipts.parkedQuestionCardsWritten += await db.exec(dialect === "tidb"
+            receipts.parkedQuestionCardsWritten += await db.exec(dialect === "mysql"
                 ? `UPDATE checkpoint SET checkpoint = ? WHERE token = ? AND status = 'pending' AND CAST(${docText} AS BINARY) = CAST(? AS BINARY)`
                 : `UPDATE checkpoint SET checkpoint = $1::jsonb WHERE token = $2 AND status = 'pending' AND ${docText} = $3`, [next, token, String(full.checkpoint)]);
         }
@@ -1116,7 +1454,7 @@ const readM29Document = createObjectColumnReader();
 export async function backfillParkedApprovalCards(db, dialect, receipts) {
     if (!(await columnExists(db, dialect, "checkpoint", "approval_card")))
         return;
-    const ph = (n) => (dialect === "tidb" ? "?" : `$${n}`);
+    const ph = (n) => (dialect === "mysql" ? "?" : `$${n}`);
     const kinds = APPROVAL_GATE_KINDS;
     const scan = `SELECT token FROM checkpoint WHERE status = 'pending' AND approval_card IS NULL AND gate_kind IN (${kinds.map((_, i) => ph(i + 1)).join(", ")}) ` +
         `AND token > ${ph(kinds.length + 1)} ORDER BY token LIMIT ${PARKED_CARD_BACKFILL_PAGE}`;
@@ -1172,7 +1510,7 @@ function placedOwnerScanSql(dialect) {
         "p.session_id AS parent_row, p.owner AS parent_owner, p.incarnation AS parent_incarnation, p.placement_kind AS parent_kind, " +
         "c.placement_root_session_id AS root_id, c.placement_parent_session_id AS parent_id " +
         "FROM session_meta c LEFT JOIN session_meta r ON r.session_id = NULLIF(c.placement_root_session_id, '') LEFT JOIN session_meta p ON p.session_id = NULLIF(c.placement_parent_session_id, '') " +
-        `WHERE c.placement_kind IS NOT NULL AND c.owner IS NULL AND c.session_id > ${dialect === "tidb" ? "?" : "$1"} ORDER BY c.session_id LIMIT ${PLACED_OWNER_SCAN_PAGE}`);
+        `WHERE c.placement_kind IS NOT NULL AND c.owner IS NULL AND c.session_id > ${dialect === "mysql" ? "?" : "$1"} ORDER BY c.session_id LIMIT ${PLACED_OWNER_SCAN_PAGE}`);
 }
 function scannedPlacement(r) {
     return {
@@ -1257,6 +1595,13 @@ function readingFields(r) {
         parkedApprovalCardsBackfilled: r.parkedApprovalCardsBackfilled,
         parkedApprovalCardRowsUnreadable: r.parkedApprovalCardRowsUnreadable.length,
         parkedApprovalCardRowsTooLong: r.parkedApprovalCardRowsTooLong.length,
+        executionPlacementColumnsAdded: r.executionPlacementColumnsAdded,
+        deviceBindingsMoved: r.deviceBindingsMoved,
+        deviceBindingsOrphaned: r.deviceBindingsOrphaned,
+        deviceBindingTablesDropped: r.deviceBindingTablesDropped,
+        executionPlacementsBackfilled: r.executionPlacementsBackfilled,
+        askExecutionLanesBackfilled: r.askExecutionLanesBackfilled,
+        executionPlacementSessionsUnreadable: r.executionPlacementSessionsUnreadable.length,
     };
 }
 export function logOneTimeMigrations(log, backend, report) {
@@ -1301,7 +1646,11 @@ export function logOneTimeMigrations(log, backend, report) {
             "delivery, reading nor session deletion would ever have touched them again; only the count is logged, never a key; M29: suspended rows " +
             "parked before the checkpoint column approval_card existed and still pending get that column — the approval card word on their gate, " +
             "derived by the same function the write path uses (the engine's checkpointIndexFacts); a row whose document cannot be read as a checkpoint " +
-            "is left NULL and counted, named by a parked_approval_card_row_unreadable line, and so is a row whose card word is longer than the column can hold, named by a parked_approval_card_row_too_long line). Each step " +
+            "is left NULL and counted, named by a parked_approval_card_row_unreadable line, and so is a row whose card word is longer than the column can hold, named by a parked_approval_card_row_too_long line; " +
+            "M32: session↔device bindings moved from the retired table device_session onto the root session rows (the table is first renamed device_session_retired, " +
+            "the eight execution placement columns are added to session_meta, every binding overwrites the device placement of its root session row — a binding whose " +
+            "root session row is gone is dropped and counted, named by a device_bindings_orphaned line — and the renamed table is dropped), and session rows that have " +
+            "runs but no execution placement placed on the only declared lane; once the switch is complete this step does nothing). Each step " +
             "runs on every boot until its window closes (the release that introduced it + 30 days; the per-step date is in " +
             "removableAfter, null while that release is not published yet) and is deleted in the first minor after that — start a " +
             "version that still carries a step at least once before upgrading past its deletion.",
@@ -1309,6 +1658,27 @@ export function logOneTimeMigrations(log, backend, report) {
     logReceiptRows(log, backend, report);
 }
 function logReceiptRows(log, backend, r) {
+    if (r.deviceBindingsOrphaned > 0) {
+        log.warn("device_bindings_orphaned", {
+            backend,
+            count: r.deviceBindingsOrphaned,
+            note: "session↔device bindings whose root session row no longer exists (or is a delegated child row) were dropped while moving bindings onto the root session rows — no session can run on them; nothing else changed",
+        });
+    }
+    for (const row of r.executionPlacementSessionsUnreadable) {
+        log.warn("execution_placement_session_unreadable", {
+            backend,
+            sessionId: row.sessionId,
+            fault: row.fault,
+            ...(row.errno !== undefined ? { errno: row.errno } : {}),
+            note: "a local session that has runs (and either no session-metadata cell — it was written before the cell existed and has not been read since — or a fork-created cell) has an archive the server cannot read, " +
+                "so its execution placement could not be backfilled. The session was skipped and nothing was written or changed: boot is not blocked, and every request that needs the " +
+                "session keeps answering the archive's own fault (fault names it: corrupt_session = the session header cannot be read; invalid_session = the stored log's structure is broken; " +
+                "storage = reading the archive file itself failed — errno names it, e.g. EACCES = no permission, EIO = disk I/O error, ERR_STRING_TOO_LONG = the file is too large to read) until the " +
+                "archive file under the data root's sessions directory is readable again — restored from a kept copy, or (storage) its permissions or disk repaired; the next boot then backfills its placement as for any other session. " +
+                "(Removing the archive file ends the warning but places nothing: the session then no longer exists on this server — except a fork-created session, whose cell stays and reads as a fork that has not landed: retry the same fork, or delete the session.) The session is named on every boot until then",
+        });
+    }
     for (const row of r.parkedApprovalCardRowsUnreadable) {
         log.warn("parked_approval_card_row_unreadable", {
             backend,