@sema-agent/server 7.138.0 → 7.140.0

package/dist/plugins/store-backend.d.ts

@@ -16,7 +16,7 @@ import { type MemoryOptOutGrantStore } from "./memory-optout-grant-store-sql.js"
 import { type SendFileLedger } from "./send-file-ledger.js";
 import type { UserInputLedgerStore } from "../user-input-ledger.js";
 import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
-import { type SessionPolicyStoreLogger } from "./session-policy-store-sql.js";
+import { type SessionPolicyStoreLogger } from "../stores-sql/session-policy-store-sql.js";
 import type { ServiceConfig } from "../config-types.js";
 import { TiDBRunStore, PgRunStore } from "./run-store-sql.js";
 import { TiDBCheckpointStore, PgCheckpointStore } from "./checkpoint-store-sql.js";
@@ -256,11 +256,9 @@ export interface StoreBackend {
      *  `fileSessionCaptureRecordStore(controlDir)` 按平面现造,依托是**记忆引擎的控制面目录** ⇒ 记忆面暗的
      *  部署上该平面不存在,于是这一支**随引擎接线门缺席**(唯一的 `undefined` 成因,逐字理由见 LocalBackend 的实装注)。
      *
-     *  🔴 修前 local 恒 `undefined` 且注称「缺席是一个真答案」—— 那句话在**事实层面**成立(单机的正确载体
-     *  确实就是文件三腿)、在**接线层面**是假的:core 的 `captureCarrierUnsupported`
-     *  (core 7.13.0 `prepare-task.js`)判的是「这个席位在不在」而不是「文件形能不能用」,叠上
-     *  `isRemoteExecutionEnv` 的接口形鸭子判(`remote-env.js`)把本仓 host lane 一并算作 remote,
-     *  于是单机默认部署上 `memoryCapture:"off"` 两条 ingress 结构性不可达([ref])。
+     *  🔴 local 不能答 `undefined`:引擎的 `captureCarrierUnsupported`(`prepare-task.js`)判的是「这个席位在不在」而不是「文件形能不能用」,
+     *  叠上执行环境块 `hostLocalPaths` 为假 —— 本地后端上跑沙箱 / 远端车道的部署,席位缺席 ⇒ `memoryCapture:"off"` 两条 ingress 结构性不可达。
+     *  (引擎按接口形判 remote 的那些版本里 host 车道也在射程;今天按块判,host 不在,供店对它是无害的同址声明。)
      *  刻意仍不给 local 一个**内存** twin:内存形会在重启时把一条隐私记录静默丢掉(比文件三腿严格更差)。 */
     sessionCaptureRecords(): SessionCaptureRecordSource | undefined;
     /** Retired-epoch byte hygiene: GC grace-passed orphan `snapshot_blob` rows/objects — the whole-tree snapshot
@@ -350,7 +348,7 @@ export interface StoreBackend {
      */
     leaderRun?(): LeaderRunStore;
     /**
-     * device lane 的四表店(device-executor-lane-v2 §6,车A-2 交店 / 车A-4 接线)。**SQL 后端专有**,
+     * device lane 的三表店(device-executor-lane-v2 §6,车A-2 交店 / 车A-4 接线;绑定写在根会话行的执行格上,与会话店同一只池)。**SQL 后端专有**,
      * `local` 刻意省略 —— 与 {@link leaderRun} 逐字同一条理由:config 层已经把「`REMOTE_EXEC=device` 且
      * 无外部 SQL 店」整个组合拒启了(`device-durable-store` 不变量),所以 local 车道上根本不存在一个需要
      * 这四张表的 device worker。消费点按 `backend?.device?.()` 取,缺席 ⇒ `boot/device-lane.ts` 的

package/dist/plugins/store-backend.js

@@ -13,7 +13,8 @@ import { LocalWorkflowParkDecisionStore } from "../orchestration/workflow-park-d
 import { StoreBootRefusalError } from "./store-contracts.js";
 import { buildStoreOpenRefusalTail } from "./store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./store-lock-wait.js";
-import { NO_SQL_MIGRATIONS, runSqlOneTimeMigrations } from "./one-time-migrations.js";
+import { NO_SQL_MIGRATIONS, assertExecutionPlacementSwitchAdmissibleOnPool, backfillLocalAskExecutionLanes, backfillLocalExecutionPlacements, runSqlOneTimeMigrations } from "./one-time-migrations.js";
+import { deployedExecutionLanes } from "../execution-lane-caps.js";
 import { assertRetiredSchemaAbsentOnPool } from "./schema-consistency.js";
 import { LocalSessionStore, createLocalSessionRepo } from "./local-session-store.js";
 import { LocalCheckpointStore } from "./local-checkpoint-store.js";
@@ -29,7 +30,7 @@ import { TiDBSendFileLedger, PgSendFileLedger, FileSendFileLedger } from "./send
 import { FileUserInputLedgerStore } from "./user-input-ledger-file.js";
 import { TiDBUserInputLedgerStore, PgUserInputLedgerStore } from "./user-input-ledger-sql.js";
 import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
-import { TiDBSessionPolicyStore, PgSessionPolicyStore } from "./session-policy-store-sql.js";
+import { TiDBSessionPolicyStore, PgSessionPolicyStore } from "../stores-sql/session-policy-store-sql.js";
 import { TiDBWorkflowJournalStore, PgWorkflowJournalStore } from "./workflow-journal-store-sql.js";
 import { TiDBFileHistoryStore, PgFileHistoryStore, FILE_HISTORY_BLOB_TABLE, FILE_HISTORY_BLOB_KEY_PREFIX } from "./file-history-store-sql.js";
 import { MinioBlobBackend, SqlBlobBackend } from "./blob-backend.js";
@@ -91,7 +92,7 @@ function legacyBlobBackend(config, dialect, pool) {
 async function legacySweepImpl(config, dialect, pool) {
     const sql = "SELECT blob_hash FROM snapshot_blob";
     let orphans;
-    if (dialect === "tidb") {
+    if (dialect === "mysql") {
         const [rows] = await pool.query(sql);
         orphans = rows.map((r) => String(r.blob_hash));
     }
@@ -134,12 +135,12 @@ class TiDBBackend {
     sendFileLedger() { return new TiDBSendFileLedger(this.pool); }
     userInputLedger() { return new TiDBUserInputLedgerStore(this.pool); }
     sessionPolicy(logger) { return new TiDBSessionPolicyStore(this.pool, logger); }
-    fileHistory() { return new TiDBFileHistoryStore(this.pool, historyBlobBackend(this.config, "tidb", this.pool), this.config.fileHistory); }
+    fileHistory() { return new TiDBFileHistoryStore(this.pool, historyBlobBackend(this.config, "mysql", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new TiDBMemoryOptOutGrantStore(this.pool); }
     sessionCaptureRecords() { return () => (this.captureRecordsInst ??= new TiDBSessionCaptureRecordStore(this.pool)); }
     captureRecordsInst;
-    legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "tidb", this.pool); }
-    runOneTimeMigrations() { return runSqlOneTimeMigrations("tidb", this.pool); }
+    legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "mysql", this.pool); }
+    runOneTimeMigrations() { return runSqlOneTimeMigrations("mysql", this.pool, { lanes: deployedExecutionLanes(this.config) }); }
     workflowJournal() { return new TiDBWorkflowJournalStore(this.pool); }
     outcomeSink() { return new TiDBOutcomeLedger(this.pool); }
     workflowRun(onWarn) { return new TiDBWorkflowRunStore(this.pool, onWarn); }
@@ -193,7 +194,7 @@ class PgBackend {
     sessionCaptureRecords() { return () => (this.captureRecordsInst ??= new PgSessionCaptureRecordStore(this.pool)); }
     captureRecordsInst;
     legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "pg", this.pool); }
-    runOneTimeMigrations() { return runSqlOneTimeMigrations("pg", this.pool); }
+    runOneTimeMigrations() { return runSqlOneTimeMigrations("pg", this.pool, { lanes: deployedExecutionLanes(this.config) }); }
     workflowJournal() { return new PgWorkflowJournalStore(this.pool); }
     outcomeSink() { return new PgOutcomeLedger(this.pool); }
     workflowRun(onWarn) { return new PgWorkflowRunStore(this.pool, onWarn); }
@@ -239,7 +240,9 @@ class LocalBackend {
     onError;
     discloseWarn;
     parkDecisionLedgerRoot;
+    executionLanes;
     constructor(root, config, onWarn, onError) {
+        this.executionLanes = deployedExecutionLanes(config);
         this.onWarn = onWarn;
         this.discloseWarn = onWarn ?? ((msg, meta) => console.warn(msg, meta));
         this.onError = onError;
@@ -282,7 +285,15 @@ class LocalBackend {
     }
     async ensureSchema() { }
     async runOneTimeMigrations() {
-        return { ...NO_SQL_MIGRATIONS, holderDeathCodeRowsBackfilled: this.runStore.migrateLegacyHolderDeathCodes() };
+        const holderDeathCodeRowsBackfilled = this.runStore.migrateLegacyHolderDeathCodes();
+        const placements = await backfillLocalExecutionPlacements(this.runStore.sessionIdsWithRuns(), this.sessionStore.executionPlacementBackfill, { lanes: this.executionLanes });
+        return {
+            ...NO_SQL_MIGRATIONS,
+            holderDeathCodeRowsBackfilled,
+            executionPlacementsBackfilled: placements.backfilled,
+            executionPlacementSessionsUnreadable: placements.unreadable,
+            askExecutionLanesBackfilled: backfillLocalAskExecutionLanes(this.approvalAskStore, { lanes: this.executionLanes }),
+        };
     }
     async close() {
         await this.sessionStore.dispose();
@@ -364,17 +375,18 @@ export function createStoreBackend(config, onWarn, onError) {
         if (!config.pg)
             return undefined;
         const pool = createPgPool(pgPoolOptions(config.pg, config.dbQueryTimeoutMs), onWarn);
-        return withRetiredSchemaProbe(new PgBackend(pool, config), { dialect: "pg", pool });
+        return withRetiredSchemaProbe(new PgBackend(pool, config), { dialect: "pg", pool }, { lanes: deployedExecutionLanes(config) });
     }
     if (!config.tidb)
         return undefined;
     const pool = createTidbPool(config);
-    return withRetiredSchemaProbe(new TiDBBackend(pool, config), { dialect: "tidb", pool });
+    return withRetiredSchemaProbe(new TiDBBackend(pool, config), { dialect: "mysql", pool }, { lanes: deployedExecutionLanes(config) });
 }
-function withRetiredSchemaProbe(inner, target) {
+function withRetiredSchemaProbe(inner, target, executionPlacementSwitch) {
     const guarded = Object.create(inner);
     guarded.ensureSchema = async () => {
         await assertRetiredSchemaAbsentOnPool(target);
+        await assertExecutionPlacementSwitchAdmissibleOnPool(target.dialect, target.pool, executionPlacementSwitch);
         await inner.ensureSchema();
     };
     return guarded;

package/dist/plugins/store-contracts.d.ts

@@ -276,26 +276,36 @@ export interface NewRunMeta {
     idem?: RunIdemBinding | null;
 }
 /**
- * `RunStore.createRun` 的结局 —— 三形,一形一句话:
+ * `RunStore.createRun` 的结局 —— 四形,一形一句话:
  *  · `{ ok: true }` —— 新行已建、会话 claim 已拿;
  *  · `{ ok: false, existing }` —— 这次提交的一把**幂等钥匙**已经指向一条行:`idem_key`(`Idempotency-Key`)或
  *    `task_id`(调用方自铸的 `body.taskId`)—— 两把钥匙是**同一条律**(资源行上的唯一键),先认 `idem_key` 再认 `task_id`。
  *    这是「原子赢或观察」的**观察**臂:行原样交回,没建新行、没动会话;回执由提交面的唯一回执函数判。
- *  · `{ ok: false, activeTaskId }` —— 会话被**别的** run 占着(双发守卫),没建行。
- * 另两位在每一形上恒 `undefined`(读 `created.existing` / `created.activeTaskId` 不用先窄化,判别仍是穷举的)。
+ *  · `{ ok: false, activeTaskId }` —— 会话被**别的** run 占着(双发守卫),没建行;
+ *  · `{ ok: false, sessionAbsent: true }` —— 根会话行不在(SQL 孪生在认领事务里锁根行读到零行:受理之后会话被删),没建行、没认领。
+ *    进程内两孪生(File / Memory)的账本里没有会话行,不答这一形。
+ * 其余几位在每一形上恒 `undefined`(读 `created.existing` / `created.activeTaskId` / `created.sessionAbsent` 不用先窄化,判别仍是穷举的)。
  */
 export type CreateRunOutcome = {
     ok: true;
     existing?: undefined;
     activeTaskId?: undefined;
+    sessionAbsent?: undefined;
 } | {
     ok: false;
     existing: RunRecord;
     activeTaskId?: undefined;
+    sessionAbsent?: undefined;
 } | {
     ok: false;
     existing?: undefined;
     activeTaskId: string;
+    sessionAbsent?: undefined;
+} | {
+    ok: false;
+    existing?: undefined;
+    activeTaskId?: undefined;
+    sessionAbsent: true;
 };
 /** SQL 认领栅栏的结局:`held: false` = 认领此刻不是这条 run 的(或它已不在跑),`write` 一次都没调。 */
 export type ClaimFenced<T> = {
@@ -504,13 +514,16 @@ export interface SessionSummary {
      *  零迁移路线 —— result 在终局与 park 时写、认领续跑即清空([ref])⇒ 在跑 run 键诚实缺席);OMIT-when-absent,恒不铸 null。轴辨析与
      *  wire 半场见 `security.ts SessionListItem.lastTaskRunId`(同名同义)。 */
     lastTaskRunId?: string;
-    /** The session's title: the user's (`patchSessionMeta`, unconditional; `null` clears it back to automatic) or the auto-titler's
+    /** The session's title: the user's (`writeSessionRowCells`; `null` clears it back to automatic) or the auto-titler's
      *  (cheap-model one-liner, `setTitleIfNull` — fills NULL only). null = not (yet) titled OR the lister face has no session_meta (the legacy
      *  task_run aggregate / memory twins — honest degrade). Writer order: `src/session-row.ts`. */
     title: string | null;
-    /** Pinned by the user (`patchSessionMeta`). Always present, `false` by default; the legacy task_run aggregate / memory
+    /** Pinned by the user (`writeSessionRowCells`). Always present, `false` by default; the legacy task_run aggregate / memory
      *  twins answer `false` (no session_meta ⇒ nothing there can pin it). */
     pinned: boolean;
+    /** 行标签(`src/session-row.ts` 的 `sessionRowTagOf`):这一位住客「PATCH 能写的每一格」的单向摘要,present-iff 这一行可被条件写(店有行格写原语 ∧ 行上有化身);
+     *  只经店的列表行映射铸(`sessionRowTagKey`)。没有会话行的 lister(legacy task_run 聚合 / 内存孪生)缺席。wire 半场见 `security.ts SessionListItem.rowTag`(同名同义)。 */
+    rowTag?: string;
 }
 /**
  * [ref] —— 会话**枚举面**读 run 账里「每会话的 run 投影」的窄读面:`runCount` / `lastStatus` / `lastRunId` / `lastTaskRunId` 四位,
@@ -529,6 +542,13 @@ export interface SessionRunRollupSource {
         limit: number;
     }): Promise<ReadonlyArray<Pick<SessionSummary, "sessionId" | "runCount" | "lastStatus" | "lastRunId" | "lastTaskRunId">>>;
 }
+/**
+ * 会话**此刻的 run 认领**(单活槽)的窄读面 —— run 店的 `getActiveTaskId`,同一个问题在 SQL 孪生里是写事务内对 `task_active` 的锁定读。
+ * local 会话店的执行席在 `markMirror` 的写锁内读它,判序与 SQL 孪生同(行不在 / 住客不同 / writer / mirror 先判,认领只拦「absent → mirror」这一笔写)。
+ */
+export interface SessionRunClaimSource {
+    getActiveTaskId(sessionId: string): Promise<string | undefined>;
+}
 /**
  * [ref] —— 「这个会话**最近一条腿**是哪一条 run」的窄读面(`latestRunForSession` 的回值)。
  *

package/dist/plugins/task-list-store-sql.js

@@ -68,33 +68,33 @@ export async function ensurePgTaskListSchema(q) {
   )`);
 }
 async function ensureMeta(exec, dialect, listKey) {
-    await exec(dialect === "tidb"
+    await exec(dialect === "mysql"
         ? `INSERT INTO ${TASK_LIST_META_TABLE} (list_key, next_id, next_sort) VALUES (?, 1, 1) ON DUPLICATE KEY UPDATE list_key = list_key`
         : `INSERT INTO ${TASK_LIST_META_TABLE} (list_key, next_id, next_sort) VALUES ($1, 1, 1) ON CONFLICT (list_key) DO NOTHING`, [listKey]);
 }
 async function allocateOn(exec, dialect, listKey) {
     await ensureMeta(exec, dialect, listKey);
-    const rows = await exec(dialect === "tidb"
+    const rows = await exec(dialect === "mysql"
         ? `SELECT next_id FROM ${TASK_LIST_META_TABLE} WHERE list_key = ? FOR UPDATE`
         : `SELECT next_id FROM ${TASK_LIST_META_TABLE} WHERE list_key = $1 FOR UPDATE`, [listKey]);
     const id = Number(rows[0].next_id);
-    await exec(dialect === "tidb"
+    await exec(dialect === "mysql"
         ? `UPDATE ${TASK_LIST_META_TABLE} SET next_id = ? WHERE list_key = ?`
         : `UPDATE ${TASK_LIST_META_TABLE} SET next_id = $1 WHERE list_key = $2`, [id + 1, listKey]);
     return String(id);
 }
 async function setOn(exec, dialect, listKey, id, itemJson) {
     await ensureMeta(exec, dialect, listKey);
-    const rows = await exec(dialect === "tidb"
+    const rows = await exec(dialect === "mysql"
         ? `SELECT next_sort FROM ${TASK_LIST_META_TABLE} WHERE list_key = ? FOR UPDATE`
         : `SELECT next_sort FROM ${TASK_LIST_META_TABLE} WHERE list_key = $1 FOR UPDATE`, [listKey]);
     const sort = Number(rows[0].next_sort);
-    await exec(dialect === "tidb"
+    await exec(dialect === "mysql"
         ? `INSERT INTO ${TASK_LIST_ITEM_TABLE} (list_key, id, id_num, sort_seq, item_json) VALUES (?, ?, ?, ?, ?)
          ON DUPLICATE KEY UPDATE item_json = VALUES(item_json)`
         : `INSERT INTO ${TASK_LIST_ITEM_TABLE} (list_key, id, id_num, sort_seq, item_json) VALUES ($1, $2, $3, $4, $5)
          ON CONFLICT (list_key, id) DO UPDATE SET item_json = EXCLUDED.item_json`, [listKey, id, arrayIndexOf(id), sort, itemJson]);
-    await exec(dialect === "tidb"
+    await exec(dialect === "mysql"
         ? `UPDATE ${TASK_LIST_META_TABLE} SET next_sort = ? WHERE list_key = ?`
         : `UPDATE ${TASK_LIST_META_TABLE} SET next_sort = $1 WHERE list_key = $2`, [sort + 1, listKey]);
 }
@@ -160,29 +160,29 @@ export function createTiDBTaskListStore(pool, listKey) {
     };
     const build = (q, inTx) => ({
         get: async (id) => {
-            const [rows] = (await q.query(`SELECT ${jsonColumnText("tidb", "item_json")} FROM ${TASK_LIST_ITEM_TABLE} WHERE list_key = ? AND id = ?${inTx ? " FOR UPDATE" : ""}`, [listKey, id]));
+            const [rows] = (await q.query(`SELECT ${jsonColumnText("mysql", "item_json")} FROM ${TASK_LIST_ITEM_TABLE} WHERE list_key = ? AND id = ?${inTx ? " FOR UPDATE" : ""}`, [listKey, id]));
             return rows.length > 0 ? parseItem(rows[0].item_json, `for list ${listKey} item ${JSON.stringify(id)}`) : undefined;
         },
         set: async (id, item) => {
             if (item.metadata)
                 assertJsonMetadata(item.metadata);
             const json = JSON.stringify(item);
-            await (inTx ? setOn(execOn(q), "tidb", listKey, id, json) : tx((c) => setOn(execOn(c), "tidb", listKey, id, json)));
+            await (inTx ? setOn(execOn(q), "mysql", listKey, id, json) : tx((c) => setOn(execOn(c), "mysql", listKey, id, json)));
         },
         delete: async (id) => {
             const [res] = (await q.query(`DELETE FROM ${TASK_LIST_ITEM_TABLE} WHERE list_key = ? AND id = ?`, [listKey, id]));
             return res.affectedRows === 1;
         },
         list: async () => {
-            const [rows] = (await q.query(`SELECT ${jsonColumnText("tidb", "item_json")} FROM ${TASK_LIST_ITEM_TABLE} WHERE list_key = ? ORDER BY id_num IS NULL, id_num, sort_seq${inTx ? " FOR UPDATE" : ""}`, [listKey]));
+            const [rows] = (await q.query(`SELECT ${jsonColumnText("mysql", "item_json")} FROM ${TASK_LIST_ITEM_TABLE} WHERE list_key = ? ORDER BY id_num IS NULL, id_num, sort_seq${inTx ? " FOR UPDATE" : ""}`, [listKey]));
             return rows.map((r) => parseItem(r.item_json, `for list ${listKey} (enumeration)`));
         },
-        allocateId: async () => (inTx ? allocateOn(execOn(q), "tidb", listKey) : tx((c) => allocateOn(execOn(c), "tidb", listKey))),
+        allocateId: async () => (inTx ? allocateOn(execOn(q), "mysql", listKey) : tx((c) => allocateOn(execOn(c), "mysql", listKey))),
         ...(inTx
             ? {}
             : {
                 mutate: (fn) => tx(async (c) => {
-                    await ensureMeta(execOn(c), "tidb", listKey);
+                    await ensureMeta(execOn(c), "mysql", listKey);
                     await c.query(`SELECT next_id FROM ${TASK_LIST_META_TABLE} WHERE list_key = ? FOR UPDATE`, [listKey]);
                     return fn(build(c, true));
                 }),

package/dist/plugins/tidb-pool.d.ts

@@ -38,11 +38,15 @@ export declare function createTidbPool(config: ServiceConfig): Pool;
  * ── SCHEMA POLICY (clay 裁,2026-07-26) ─────────────────────────────────────────────────────────────
  * 本仓 schema 的唯一真源 = **这份代码**(此数组 + `pg-pool.ts` 的 PG 孪生)。口径:
  *
- *  1. **删库重建,不做增量。** 尚未上生产、单人本地,存量库一律 DROP DATABASE 重建;因此这里**不再保留
- *     任何 `ALTER TABLE` 增量 seam**。历史上的 21 条 ADD COLUMN / 3 条 CREATE INDEX / 1 条 MODIFY COLUMN
- *     已于 2026-07-26 全部折进下面的 `CREATE TABLE`(它们承载的语义已逐条搬成列上的行内注释 —— 那些注释
- *     是 pre-migration 行为契约的**唯一书面记录**,删注释 = 丢语义)。
- *  2. **不许再新增 `ALTER TABLE` seam。** 要改列/加列/改可空性 ⇒ 直接改下面的 `CREATE TABLE`,然后重建库。
+ *  1. **代码是唯一真源,不做增量。** 存量库缺列由部署者按拒启句里逐字打印的 `ALTER TABLE … ADD COLUMN …`
+ *     自己执行:列集对账与拒启句永不改库。进程自己对**已存在的表**发的 DDL 只有两种 —— 幂等加索引(`ensureIndex`,
+ *     只动索引、不碰列)与登记在册的一次性迁移(每条有窗、有登记行 `one-time-migrations.ts`);加列 / 改列 / 改名 /
+ *     删表只有后者做。因此这里**不再保留任何 `ALTER TABLE` 增量 seam**。历史上的 21 条
+ *     ADD COLUMN / 3 条 CREATE INDEX / 1 条 MODIFY COLUMN 已于 2026-07-26 全部折进下面的 `CREATE TABLE`
+ *     (它们承载的语义已逐条搬成列上的行内注释 —— 那些注释是 pre-migration 行为契约的**唯一书面记录**,
+ *     删注释 = 丢语义)。
+ *  2. **不许再新增 `ALTER TABLE` seam。** 要加列 ⇒ 直接改下面的 `CREATE TABLE`:新建库随它到货;带数据的存量库由列集对账拒启并逐列打印 `ALTER`,部署者自己执行(**不重建带数据的库**)。
+ *     改列类型 / 改可空性 / 改写存量字节 —— 列集对账只比列名、看不见这类漂移 —— 另走一次性迁移(带窗)或在升级步里写明手工语句。只有空库 / 开发机可以整库重建(销毁全部数据)。
  *     (再开增量通道就等于把「代码是真源」变回「代码 + 一串按时间排的补丁才是真源」。)
  *  3. 生成的全集 SQL 基线导出到 `docs/schema/baseline-mysql.sql`(由本数组机器生成;它是**产物**,不是真源
  *     —— 冲突时以本文件为准并重新生成)。
@@ -83,8 +87,9 @@ export declare const SCHEMA_INDEXES: readonly IndexSpec[];
  *
  *  Per the SCHEMA POLICY on {@link SCHEMA_STATEMENTS} this is a pure CREATE run — there are NO additive
  *  ALTER/CREATE-INDEX seams and no information_schema probes any more (2026-07-26): the schema contract is
- *  drop-and-recreate, so every column / index / nullability lives in its `CREATE TABLE`. Do not reintroduce a
- *  migration loop here; change the CREATE and rebuild the database.
+ *  code-as-single-source, so every column / index / nullability lives in its `CREATE TABLE`; an existing database that lacks
+ *  a column is refused at boot with the ALTER statements printed and its deployer runs them. Do not reintroduce a
+ *  migration loop here; change the CREATE (only a throwaway dev database may be recreated, which destroys all of its data).
  *
  *  Concurrency: callers run this concurrently — tests fan ALL integration suites out in parallel (each
  *  beforeAll calls ensureSchema), and in production every replica calls it at boot (`--scale service=4`).

package/dist/plugins/tidb-pool.js

@@ -7,6 +7,7 @@ import { TIDB_ADOPTION_LOG_STATEMENTS } from "./adoption-log-sql.js";
 import { TIDB_PERMISSION_RULE_STATEMENTS } from "./permission-rule-store-sql.js";
 import { TIDB_RETENTION_STATEMENTS } from "./retention-store-sql.js";
 import { SESSION_META_INCARNATION_COLUMN } from "../session-incarnation.js";
+import { sessionMetaPlacementColumnsDdl } from "./execution-placement-sql.js";
 import { SESSION_META_WORKSPACE_COLUMN } from "./session-workspace-cell.js";
 import { RUN_IDENTITY_COLUMNS } from "../identity-source.js";
 import { SESSION_RULES_COLUMN } from "./session-rules-column.js";
@@ -63,11 +64,11 @@ export const SCHEMA_STATEMENTS = [
      leaf_id     VARCHAR(64)  NULL,
      leaf_seq    BIGINT       NOT NULL DEFAULT 0,
      -- title: ONE column, two writers, one law (src/session-row.ts): the user's write (PATCH /v1/sessions/:id →
-     -- patchSessionMeta, unconditional; null = cleared back to the automatic title) and the auto-titler (cheap-model
+     -- writeSessionRowCells, unconditional unless the PATCH carries expectedRowTag; null = cleared back to the automatic title) and the auto-titler (cheap-model
      -- one-liner on a submit that finds it NULL; setTitleIfNull, fills NULL only) — a user-set title is never overwritten,
      -- a cleared one is filled again. Width = SESSION_TITLE_MAX_CHARS (the wire bound).
      title       VARCHAR(${SESSION_TITLE_MAX_CHARS}) NULL,
-     -- pinned: the user's pin (PATCH /v1/sessions/:id → patchSessionMeta); every list row carries it, false by default.
+     -- pinned: the user's pin (PATCH /v1/sessions/:id → writeSessionRowCells); every list row carries it, false by default.
      pinned      BOOLEAN      NOT NULL DEFAULT FALSE,
      -- instruction_source(S-690):本会话**上一次 run** 选中的项目指令文件 = 换源通告(instructions.source_changed)
      -- 的基线。NULL = 还没有任何 run 记过(首 run 只写不发);'' = 记过、那一次没有项目指令文件;其余 = 链成员相对路径
@@ -78,7 +79,7 @@ export const SCHEMA_STATEMENTS = [
      -- NULL = 还没有任何腿记过;唯一写者 = 腿的记录座(src/session-workspace.ts),列属主 = src/plugins/session-workspace-cell.ts
      -- (列定义、形读者、编解码;存量库缺这一列 ⇒ 起服列册对账拒启,拒句里给出 ALTER)。下一条腿的 TaskSpec.projectId 读它的 project.id。
      -- 服务端元数据:不进 wire 会话面、不进模型上下文;住在会话行上 ⇒ 随会话删除 / 留存清扫一起消失,fork 出的新行为 NULL。
-     ${SESSION_META_WORKSPACE_COLUMN.tidb},
+     ${SESSION_META_WORKSPACE_COLUMN.mysql},
      -- #292 C18(core 5.48.0 design/323)subagent 转录持久化 —— placement 元组,**创建时一次落行、
      -- first-write 不可变**(register 的 ON DUPLICATE 臂永不重写这六列)。判别位 = placement_kind:
      -- 在场 ⇒ 该会话住在 placement 分区里(不上宿主枚举、claim 形 acquire 恒拒、release=真删除、
@@ -95,7 +96,12 @@ export const SCHEMA_STATEMENTS = [
      -- 无 id 创建 / fork / 导入新行),删除随行消失,同 id 重登记铸新的;'' = 没铸过,读口响亮拒。列定义的唯一属主 =
      -- src/session-incarnation.ts 的 SESSION_META_INCARNATION_COLUMN(存量库缺这一列 ⇒ 起服列册对账拒启,拒句里的 ALTER 由本建表语句生成)。
      -- 不上 wire、不进模型上下文、日志只打前 8 位。
-     ${SESSION_META_INCARNATION_COLUMN.tidb},
+     ${SESSION_META_INCARNATION_COLUMN.mysql},
+     -- 执行放置:根会话行上**这一位住客**的一格 —— execution_role('writer' | 'mirror' | NULL = absent)、execution_lane、device 车道的设备与绑定属主、
+     -- 放下时刻、换绑序号;写只按住客谓词 (session_id, incarnation, owner) ∧ placement_kind IS NULL(换了住客 = 这一格不在)。fork_key = 建这一行的那次
+     -- fork 请求的键(只由 fork 创建点写,此后每个写携带)。规则在 src/execution-placement.ts,列定义与语句的唯一属主 = src/plugins/execution-placement-sql.ts
+     -- (存量库缺这些列 ⇒ 起服列册对账拒启;加列只由一次性迁移做)。
+     ${sessionMetaPlacementColumnsDdl("mysql")},
      PRIMARY KEY (session_id),
      KEY idx_session_meta_owner (owner),
      -- listPlaced 的检索腿(kind + 租户 + 年龄升序);普通会话这三列全 NULL ⇒ 不占索引选择性。
@@ -167,7 +173,7 @@ export const SCHEMA_STATEMENTS = [
      -- (rows from before these columns, unauthenticated-write acceptance, a run someone else accepted on the owner's behalf) ⇒ not
      -- qualified. Column definitions' single owner = src/identity-source.ts RUN_IDENTITY_COLUMNS (the boot column probe derives its
      -- ALTER suggestion from this statement). \`source\` above is attribution only, never an authentication source.
-     ${RUN_IDENTITY_COLUMNS.tidb},
+     ${RUN_IDENTITY_COLUMNS.mysql},
      -- objective_preview: the list's "what is this task" glance — redacted + truncated at write.
      objective_preview VARCHAR(160) NULL,
      -- cancel_requested: durable cross-replica CANCEL flag. The running instance's heartbeat tick honors it
@@ -302,7 +308,7 @@ export const SCHEMA_STATEMENTS = [
      -- approval_card(core 7.55.0 #1468 P1 阶段二):门上的卡词**照存**(core checkpointIndexFacts(cp).approvalCard:TOOL_APPROVAL_CARDS 的词,或本引擎不认的串 ——
      -- 留着,更晚的引擎读得对);非审批门 / 无卡 / 非串 = NULL。写口与一次性迁移 M29 的存量回填同一只派生(plugins/checkpoint-index-columns.ts)。
      -- 读者:到期 facet 的生成谓词(由 core CARD_FACET_OVERRIDES + PAUSE_REGISTRY 生成;**不存 facet 本身** —— 存一份会在 core 改表那天陈旧)、运维队列行的卡。
-     -- 本仓不发 ALTER:存量库缺这一列 ⇒ 起服列册对账拒启并给 ADD COLUMN 句(持久数据:表里是在飞的停驻,不删表重建)。
+     -- 本仓不发 ALTER:存量库缺这一列 ⇒ 起服列册对账拒启并给 ADD COLUMN 句(持久数据:表里是在飞的停驻,只加列)。
      -- 列型 TEXT 而不是定长 VARCHAR:引擎照存集外词,长度不由本仓定(191 字的集外词照存)。TEXT 自己的容量是 65,535 **字节**(plugins/checkpoint-index-columns.ts 的
      -- APPROVAL_CARD_COLUMN_MAX_BYTES):引擎铸的卡词是闭集短词,超出只会是手改 / 外来写者的存量行 —— M29 回填对这样的行计数 + 点名跳过,不写、不挡起服。
      approval_card TEXT         NULL,
@@ -457,7 +463,7 @@ export const SCHEMA_STATEMENTS = [
      principal  VARCHAR(190) NULL,
      -- 会话规则(三只桶,引擎的规则条目文法)。列定义唯一属主 = src/plugins/session-rules-column.ts 的 SESSION_RULES_COLUMN(一列一文法:
      -- 7.128.x 及以前这一列叫 rules、按整串工具名读;存量库由一次性迁移 M17 改名,带退役命令桶的行原样留着、读回判坏并逐行点名,见那份文件与 one-time-migrations.ts)。
-     ${SESSION_RULES_COLUMN.tidb},
+     ${SESSION_RULES_COLUMN.mysql},
      rev        BIGINT       NOT NULL,
      -- gen (core 7.25.0 StoredSessionRules.gen, S-529 二期):这一行的**血统**。rev 只在一条血统内计数,
      -- deleteBySession 终结血统并把下一代的号留在 session_policy_rev_mark.gen 上,于是活规则读者能把

package/dist/plugins/tidb-session-storage.js

@@ -9,8 +9,8 @@ import { jsonColumnText } from "./sql-json-column.js";
 import { incarnationFromCell } from "../session-incarnation.js";
 const SESSION_EVENT_BY_TYPE_HINT = "/*+ USE_INDEX(session_event, idx_session_event_type) */";
 export const SESSION_EVENT_LATEST_BY_TYPE_SQL = {
-    floor: `SELECT ${SESSION_EVENT_BY_TYPE_HINT} ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? AND type = 'compaction' ORDER BY seq DESC LIMIT 1`,
-    epochAnchor: `SELECT ${SESSION_EVENT_BY_TYPE_HINT} seq, ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? AND seq < ? AND type IN ('prompt_epoch','compaction') ORDER BY seq DESC LIMIT 100`,
+    floor: `SELECT ${SESSION_EVENT_BY_TYPE_HINT} ${jsonColumnText("mysql", "payload")} FROM session_event WHERE session_id = ? AND type = 'compaction' ORDER BY seq DESC LIMIT 1`,
+    epochAnchor: `SELECT ${SESSION_EVENT_BY_TYPE_HINT} seq, ${jsonColumnText("mysql", "payload")} FROM session_event WHERE session_id = ? AND seq < ? AND type IN ('prompt_epoch','compaction') ORDER BY seq DESC LIMIT 100`,
 };
 const isDupKey = isMysqlDupKeyError;
 export class TiDBSessionStorage extends BaseSessionStorage {
@@ -35,7 +35,7 @@ export class TiDBSessionStorage extends BaseSessionStorage {
         if (!meta)
             return null;
         const { floorEntryId, floorSeq } = await TiDBSessionStorage.computeFloor(pool, sessionId);
-        const [eventRows] = await pool.query(`SELECT seq, ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? AND seq >= ? ORDER BY seq ASC`, [sessionId, floorSeq]);
+        const [eventRows] = await pool.query(`SELECT seq, ${jsonColumnText("mysql", "payload")} FROM session_event WHERE session_id = ? AND seq >= ? ORDER BY seq ASC`, [sessionId, floorSeq]);
         const entries = eventRows.map((r) => decodeSessionEventPayload(r.payload, sessionId, r.seq));
         const placement = placementFromRow(meta);
         const metadata = { id: sessionId, createdAt: toIso(meta.created_at), incarnation: incarnationFromCell(sessionId, meta.incarnation), ...(placement !== undefined ? { placement } : {}) };
@@ -58,7 +58,7 @@ export class TiDBSessionStorage extends BaseSessionStorage {
         const inMem = await super.getEntry(id);
         if (inMem)
             return inMem;
-        const [rows] = await this.pool.query(`SELECT ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? AND entry_id = ?`, [this.sessionId, id]);
+        const [rows] = await this.pool.query(`SELECT ${jsonColumnText("mysql", "payload")} FROM session_event WHERE session_id = ? AND entry_id = ?`, [this.sessionId, id]);
         if (rows[0] === undefined)
             return undefined;
         return decodeSessionEventPayload(rows[0].payload, this.sessionId, id);

package/dist/plugins/tidb-session-store.d.ts

@@ -15,12 +15,13 @@ import type { Pool } from "mysql2/promise";
 import { type InstructionSourceBaseline } from "../instruction-source-notice.js";
 import type { SessionWorkspace } from "../session-workspace.js";
 import type { RetentionDeclaration } from "@sema-agent/core";
-import { type SessionFace } from "../session-incarnation.js";
 import type { SessionSummary } from "./store-contracts.js";
-import type { SessionRowPatch } from "../session-row.js";
+import { type ClientSessionRowWrite, type ReplaySessionRowWrite, type ReplaySessionRowWriteOutcome, type SessionRowPatch, type SessionRowWriteOutcome } from "../session-row.js";
 import { type OrphanOwnerLog } from "../delegated-session-owner.js";
 import { type PlacementAcquireOpts } from "./session-placement.js";
 import { type StagingHandle } from "../session-sync-kernel.js";
+import { type ForkTarget, type ForkToOutcome } from "./session-fork.js";
+import { type ExecutionPlacementSeat } from "../execution-placement.js";
 export declare class TiDBSessionStore implements SessionStore {
     private readonly pool;
     /** 托管留存声明 = 装配交给它的词(后端按扫车道开不开给;不给 ⇒ `"none"`)。读法逐字见
@@ -38,6 +39,13 @@ export declare class TiDBSessionStore implements SessionStore {
     private readonly pending;
     /** 委派子代孤行那一行 warn 的去处(`delegated-session-owner.ts`;装配给部署的 logger,缺席 ⇒ 缺省 logger,不静默)。 */
     private readonly log;
+    /**
+     * 执行席 —— 根会话行上这一位住客的那一格的唯一读口与 place / markMirror 两只写口(规则在 `src/execution-placement.ts`;
+     * 实现与语句的唯一属主 = `execution-placement-sql.ts`,两孪生同一只实现,本店只交自己的池)。
+     */
+    readonly executionPlacement: ExecutionPlacementSeat;
+    /** 本店的池包成的 SqlDriver:执行席与会话行格写原语的事务都经它借连接(连接初始化钉住事务读语义,`sql-driver.ts`)。 */
+    private readonly db;
     constructor(pool: Pool, opts?: {
         readonly log?: OrphanOwnerLog;
         readonly retention?: RetentionDeclaration;
@@ -83,7 +91,7 @@ export declare class TiDBSessionStore implements SessionStore {
     }): Promise<PlacedSessionRow[]>;
     /**
      * core `SessionStore.headOf` —— 这一行的属主、住客、叶子,**一条 PK SELECT、一行**(两次独立读在删除 / 重登记的缝里能拼出混世代组合;
-     * 单行单读天然一致)。`undefined` = 无此会话。本店按 id 问这一行的**唯一**读口:授权口的属主、parked 两读的住客、SSE 探针的叶子、
+     * 单行单读天然一致)。`undefined` = 无此会话。本店按 id 问这一行的**唯一**读口:授权口的属主、k8s 工作区空间的住客、SSE 探针的叶子、
      * resume-at 的叶子都是它的投影(此前的 `ownerOf` / `sessionFaceOf` / `incarnationOf` / `getLeafId` / `getHead` 五只读全部并进来;规则见
      * `session-incarnation.ts` 头注)。化身那一格经 `headFromRow` 的 `absent` 读法(空 ⇒ 住客未知);要一位活住客的读者经 `sessionFaceOfHead` 响亮拒空。
      * 只读、不取会话、不上锁、绕过暖缓存 —— 跑到一半读也安全(写的安全是追加时的 CAS)。
@@ -135,21 +143,24 @@ export declare class TiDBSessionStore implements SessionStore {
      *  row of the list face (no such session / placed). The run-preview subqueries are scoped to the same id (an index read on
      *  `task_run.session_id`, not the whole-ledger aggregate the list pays). */
     sessionSummaryOf(sessionId: string): Promise<SessionSummary | undefined>;
-    /** The session row's writable bits — the ONLY writer of a user-set title / pin (writer order: `src/session-row.ts`):
-     *  `title` unconditional (a string = the user's title — the auto-titler's {@link setTitleIfNull} fills NULL only, so it always
-     *  wins; `null` = cleared back to the automatic title, which the auto-titler fills again on a later submit), `pinned` as given.
-     *  Only a row of the list face takes it (`placement_kind IS NULL`), and only the occupant the caller verified (`incarnation = ?`
-     *  from `face` — a session deleted and re-registered by anyone after the caller's gate is another occupant: zero rows updated).
-     *  The read-back carries the same condition, so the answer is that occupant's list row or `undefined` (the decision does not
-     *  read `affectedRows`: an UPDATE that wrote identical values and one that matched nothing differ there by driver flags, the
-     *  conditioned read-back does not). `updated_at` is NOT touched (a rename is not activity — the list's newest-first order stays put). */
-    patchSessionMeta(sessionId: string, patch: SessionRowPatch, face: SessionFace): Promise<SessionSummary | undefined>;
+    /** {@link sessionSummaryOf} 那一读 + 读到它时行上的住客(写原语的应答行要复核住客,`settleSessionRowWrite`)。 */
+    private listRowOf;
+    /**
+     * 会话行格写原语 —— 用户标题 / 置顶的唯一写口(规则与判序:`src/session-row.ts` 头注「写原语」;事务与语句:`session-row-sql.ts`,PG 孪生同一只实现)。
+     * 一只经 `SqlDriver.connect()` 的事务锁住根行、交 core 判官判行期望(属主 + 化身)→ 写者身份(客户端写在镜像上 ⇒ `mirror`)→ 标签 → 写;
+     * 应答行在提交 / 回滚之后另读(列表行同一只投影,含新 `rowTag`)、复核仍是判过的那一位住客。只写列表面上的行(委派分区行 ⇒ `absent`);
+     * `updated_at` 不动(改名不是活动)。重载按入口分:`replay` 的结局只有 `written` / `absent`。
+     */
+    writeSessionRowCells(sessionId: string, cells: SessionRowPatch, how: ClientSessionRowWrite): Promise<SessionRowWriteOutcome<SessionSummary>>;
+    writeSessionRowCells(sessionId: string, cells: SessionRowPatch, how: ReplaySessionRowWrite): Promise<ReplaySessionRowWriteOutcome<SessionSummary>>;
     /**
      * The list projection's ONE SELECT + row mapper ({@link listSessions} and {@link sessionSummaryOf} both read through it).
      * `runSessionId` scopes the two run-preview subqueries to one session (the single-row read); the list leaves them whole.
      * Placeholder order follows the text: subquery params, then `where` params, then the LIMIT.
+     * `sm.incarnation` is read for the row tag only (`rowTag`, `sessionRowTagKey` — present-iff the row has a token) and the answer row's occupant
+     * check; it never enters the list row itself.
      */
-    private selectSummaries;
+    private selectListRows;
     /** Cheap pre-LLM probe: "none" = session_meta row not yet REGISTERED (createRun fires
      *  before the Runner's session acquire — the titler retries), "untitled" / "titled" as read. */
     probeTitle(sessionId: string): Promise<"none" | "untitled" | "titled">;
@@ -193,6 +204,17 @@ export declare class TiDBSessionStore implements SessionStore {
      * bypassed — and re-seq it dense from 0 into the new session, ids/parents/payload byte-verbatim.
      */
     fork(sourceId: string, owner?: string | null): Promise<string | null>;
+    /**
+     * **fork 续写的店契约**(三店同一只私有体;core `fork` 是它的投影):把源会话的整份历史拷进调用方给的目标 id。
+     *  1. **原子目标创建**:事务首句 `INSERT INTO session_meta (…, fork_key) VALUES (:target, …)`,主键即排他(meta 先,随后拷事件、COMMIT);
+     *  2. **赢家分类**:撞上已在的目标 ⇒ 输方整笔回滚,在新视图里读目标、按属主与 fork 键分类({@link classifyForkTarget});读不到(赢方在分类前回滚或被删)
+     *     ⇒ 整笔重跑一次,再撞而仍读不到 ⇒ {@link ForkTargetUnsettledError}(不猜);
+     *  3. 单事务 ⇒ 无中间态;`fork_key` 只由这里写(此后每个写携带:UPDATE 只碰点名列,整段换装经 `carriedRowCells` 带回)。
+     * 源不在 ⇒ `null`(先于目标判:源被删之后的同键重试答「源不在」)。新行 = 新住客(化身新铸),执行格 absent(INSERT 列名显式)。
+     */
+    forkTo(sourceId: string, owner: string | null, target: ForkTarget): Promise<ForkToOutcome | null>;
+    /** {@link forkTo} 的一次尝试:`"unsettled"` = 撞上目标而回滚之后读不到它(交给外层重跑一次)。 */
+    private forkToOnce;
     /**
      * 2c session-sync — EXPORT a session's full durable entry log for cross-backend migration. This is the
      * READ half of {@link fork}, surfaced as the core `SessionRepo.exportEntries` seam: the WHOLE `session_event` log,
@@ -239,29 +261,38 @@ export declare class TiDBSessionStore implements SessionStore {
      *       exactly-one-root / leaf-resolvable / structural refs present) — we persist its VERBATIM output and do NOT
      *       re-implement any of those checks in SQL ([[core-service-boundary]]; the same discipline fork's hand-SQL
      *       was warned about). A violation throws `SessionError("invalid_session")` and NOTHING is written.
-     * The write itself mirrors fork: re-seq dense from 0, entry_id/parent_id/payload/ts verbatim, in ONE txn with
-     * `session_meta` LAST as the commit point (a mid-import crash leaves orphan events with no meta = invisible to
-     * wake, never a half-session). The leaf is the replayed leaf (core's `leafIdAfterEntry`), matching core's import.
+     * The write: re-seq dense from 0, entry_id/parent_id/payload/ts verbatim, in ONE txn (COMMIT is the sole commit point), written
+     * **lock-or-create, meta first** (读写序律,`execution-placement-sql.ts` 头注):the `session_meta` row is occupied first (an existing row ⇒
+     * refused before anything else about it is read), locked, the run claim on the root is read on THIS connection (a claim ⇒
+     * `SessionActiveRunError`, nothing written), then the entries. The leaf is the replayed leaf (core's `leafIdAfterEntry`), matching core's import.
      */
     importEntries(sessionId: string, owner: string | null, entries: SessionTreeEntry[]): Promise<void>;
     /**
      * 2c session-sync (§7/§8) — IDEMPOTENT REPLACE: purge any existing conversation log for `sessionId` then re-import
-     * `entries` verbatim under `owner`, ALL in ONE txn. Unlike {@link importEntries} (a plain INSERT that crashes on a
-     * duplicate PK when the session already exists at the destination), replace is safe to run OVER an existing session
+     * `entries` verbatim under `owner`, ALL in ONE txn. Unlike {@link importEntries} (fresh-only: an existing session at the
+     * destination is refused), replace is safe to run OVER an existing session
      * — the §7 fast-forward path and a §8 retry-to-completion both land on it. The validate gate runs FIRST (fail-closed,
-     * before any write), then DELETE events + the OWNER-GUARDED meta delete (defense-in-depth, mirrors {@link deleteSession}
-     * — a wrong-owner caller can never replace another tenant's session), then the SAME shared insert body importEntries
-     * uses (so there is ONE source of the insert logic, no copy-paste drift). session_meta is still written LAST = commit
-     * point, so a mid-replace crash (post-delete, pre-insert) leaves orphan-free state (no meta = invisible to wake).
+     * before any write), then the OWNER-GUARDED meta delete (defense-in-depth, mirrors {@link deleteSession}
+     * — a wrong-owner caller can never replace another tenant's session: its delete matches nothing and the re-insert collides on the PK),
+     * then the SAME shared write body importEntries uses (session_meta first, the in-txn claim read, then the events swapped) — ONE source of
+     * the write logic, no copy-paste drift. COMMIT is the sole commit point: a mid-replace crash rolls the whole swap back.
      */
     replaceEntries(sessionId: string, owner: string | null, entries: SessionTreeEntry[]): Promise<void>;
     /**
-     * Shared insert half of {@link importEntries} / {@link replaceEntries} (ONE source of the insert logic, no drift):
-     * write the validated entries re-seq dense from 0 (entry_id/parent_id/type/ts verbatim), THEN session_meta LAST as
-     * the commit point. Runs inside the caller's open transaction (`conn`) so the caller owns begin/commit/rollback.
+     * Shared write half of {@link importEntries} / {@link replaceEntries} (ONE source of the write logic, no drift), in the global lock
+     * order (根 `session_meta` 先于 `task_*` 与 `session_event`):
+     *  ① session_meta FIRST — `create` occupies the row (`ON DUPLICATE KEY UPDATE session_id = session_id`: an existing row is left as it is),
+     *     `replace` is a plain INSERT after the caller's owner-guarded delete (a foreign row collides on the PK — the existing refusal);
+     *     owner = the RE-STAMPED authenticated principal (never the bundle's); 化身与 fork 键按 `carriedRowCells`(或新铸),执行格 = mirror
+     *     —— 导入落下的行是「写者在别处」(列名与值同出 `importedRowCells`);
+     *  ② `create`: lock the row and judge it is the one this call occupied (化身 = 本次铸的)— a row that existed before ⇒ refused before
+     *     anything else about it is read (no claim read on someone else's row);
+     *  ③ 读写序律:the run claim on the root, read on THIS connection after the row lock (`lockRootAndReadClaim`) — a claim ⇒ `SessionActiveRunError`;
+     *  ④ the validated entries re-seq dense from 0 (entry_id/parent_id/type/ts verbatim); `replace` drops the old log first.
+     * Runs inside the caller's open transaction (`conn`) so the caller owns begin/commit/rollback (COMMIT is the sole commit point).
      * `validated` is the OUTPUT of {@link validateEntriesForImport} (the caller runs the gate before opening the txn).
      */
-    private insertValidatedLog;
+    private writeImportedLog;
     /**
      * 2c session-sync P1d-β (PUSH streaming, §15) — begin a STAGED import into `realSessionId` under the shadow id
      * `${realSessionId}#stg-${token}`. The route mints the uuidv7 `token` (the store never calls uuidv7/Date.now itself