@sema-agent/server 7.140.0 → 7.142.0

package/dist/plugins/local-session-window.d.ts

@@ -16,6 +16,12 @@
  *    branch below the floor — so the record the engine reads is the one the run's walk reaches.
  * Read-only: the log is read once (`exportEntries`, pure), no append log is opened, and the window refuses writes.
  *
+ * ## The metadata is the store's, not the archive's
+ * Both halves come from the local session store ({@link LocalSessionRows}) — this module opens no repo of its own. The metadata is the
+ * store's one projection of the session's row (`LocalSessionStore.sessionMetadataOf`: owner, creation time and fork lineage read from the
+ * session-meta cell, the same projection the store hands the engine), never the archive header's copy — an archive rebuilt by a log swap
+ * keeps the row's creation time. The log is the store's export of the archive.
+ *
  * ## Cost: one linear walk, the engine's
  * The branch is core's own `getPathToRoot` over the whole log (the walk every engine read of a local session makes, with its stop
  * rules: an entry without a parent ends it, a parent the log does not hold is `invalid_session`, an unknown leaf is `not_found`).
@@ -29,7 +35,15 @@
  * by `getPathToRoot` and the run's resume ancestor scan (the two walks core 7.54.1 guards; this module has no walker of its own left).
  * Pinned in `test/session-log-parent-cycle.test.ts`.
  */
-import { BaseSessionStorage } from "@sema-agent/core";
+import { BaseSessionStorage, type SessionMetadata, type SessionTreeEntry } from "@sema-agent/core";
+/**
+ * What the window reads, and from whom: the local session store's row projection and its export of the log (`LocalSessionStore` is the one
+ * implementation; `store-backend.ts#localSessionRowsOf` hands it out). `undefined` / `null` = no such session.
+ */
+export interface LocalSessionRows {
+    sessionMetadataOf(sessionId: string): Promise<SessionMetadata | undefined>;
+    exportEntries(sessionId: string): Promise<SessionTreeEntry[] | null>;
+}
 export declare class LocalSessionWindow extends BaseSessionStorage {
     /** The branch below the floor, root first (empty when the window is the whole branch). */
     private readonly below;
@@ -39,7 +53,7 @@ export declare class LocalSessionWindow extends BaseSessionStorage {
     /** `SessionStorage.getEpochAnchor?()` — the nearest carrier on the branch below the floor, as stored ({@link scanEpochAnchor}).
      *  A row's `seq` is its position on the branch; the whole branch is in memory, so one page holds every row. */
     getEpochAnchor(): Promise<unknown>;
-    /** Wake the window of `sessionId` under the local data root `root`; `null` if there is no such session. */
-    static wake(root: string, sessionId: string): Promise<LocalSessionWindow | null>;
+    /** Wake the window of `sessionId` from the local session store's rows; `null` if there is no such session. */
+    static wake(rows: LocalSessionRows, sessionId: string): Promise<LocalSessionWindow | null>;
 }
 //# sourceMappingURL=local-session-window.d.ts.map

package/dist/plugins/local-session-window.js

@@ -1,5 +1,4 @@
 import { BaseSessionStorage, InMemorySessionStorage, SessionError, boundedTail } from "@sema-agent/core";
-import { createLocalSessionRepo } from "./local-session-store.js";
 import { scanEpochAnchor } from "./session-epoch-anchor.js";
 export class LocalSessionWindow extends BaseSessionStorage {
     below;
@@ -16,18 +15,13 @@ export class LocalSessionWindow extends BaseSessionStorage {
     async getEpochAnchor() {
         return scanEpochAnchor(this.below.length, async (beforeSeq) => this.below.slice(0, beforeSeq).map((entry, seq) => ({ seq, entry })).reverse(), (row) => row.entry);
     }
-    static async wake(root, sessionId) {
-        const repo = createLocalSessionRepo(root);
-        let log;
-        try {
-            log = await repo.exportEntries(sessionId);
-        }
-        catch (e) {
-            if (e.code === "not_found")
-                return null;
-            throw e;
-        }
-        const metadata = (await repo.list()).find((m) => m.id === sessionId) ?? { id: sessionId, createdAt: new Date().toISOString() };
+    static async wake(rows, sessionId) {
+        const log = await rows.exportEntries(sessionId);
+        if (log === null)
+            return null;
+        const metadata = await rows.sessionMetadataOf(sessionId);
+        if (metadata === undefined)
+            return null;
         const whole = new InMemorySessionStorage({ entries: log });
         const leafId = await whole.getLeafId();
         const branch = await whole.getPathToRoot(leafId);

package/dist/plugins/local-task-attachment-store.d.ts

@@ -1,18 +1,28 @@
-import { type TaskAttachmentStore, type TaskAttachmentRecord } from "./task-attachment-store.js";
+import { type AttachmentStoreBindOutcome, type TaskAttachmentStore, type TaskAttachmentRecord } from "./task-attachment-store.js";
 export declare class LocalTaskAttachmentStore implements TaskAttachmentStore {
     private readonly dir;
     private metas;
     private hydration;
+    /** 变更串行段的尾(见 `serialized`):每只变更口排在上一只的落盘与合回之后。本店唯一一只。 */
+    private mutationTail;
     constructor(rootDir: string);
     private hydrate;
+    /**
+     * 本店**唯一**的变更串行段:凡改 `this.metas` 或删盘上行的口(put / bind / delete / deleteBySession / reapUnbound)把**整条操作**
+     * (判 + 落盘 + 合回内存)交进来,于是任何一只变更口都观察不到别的变更口做到一半的中间态 —— bind 落盘期间「副本已判、内存未合」
+     * 的那一段,收割 / 删除既不会判到旧内存、也不会把盘上正在落的行删掉。读口不进来:它们只读内存,不排队。
+     * 一只变更失败不堵后面的(尾巴吞掉失败,错原样上抛给它自己的调用方)。操作体里不得再调 `serialized`(会排在自己后面)。
+     */
+    private serialized;
     put(rec: TaskAttachmentRecord & {
         content: Uint8Array;
     }): Promise<void>;
     get(owner: string, id: string): Promise<TaskAttachmentRecord | null>;
     getContent(owner: string, id: string): Promise<Uint8Array | null>;
     private persistMeta;
-    bind(owner: string, ids: string[], sessionId: string, boundAtMs: number): Promise<number>;
+    bind(owner: string, ids: readonly string[], sessionId: string, boundAtMs: number): Promise<AttachmentStoreBindOutcome>;
     listBySession(sessionId: string): Promise<TaskAttachmentRecord[]>;
+    /** 删一行(meta + bytes + 内存索引)。只在 `serialized` 的操作体里调用。 */
     private removeRow;
     delete(owner: string, id: string): Promise<boolean>;
     deleteBySession(sessionId: string): Promise<number>;

package/dist/plugins/local-task-attachment-store.js

@@ -1,6 +1,6 @@
 import { promises as fsp } from "node:fs";
 import { join } from "node:path";
-import { TaskAttachmentRecordSchema } from "./task-attachment-store.js";
+import { bindRowsInProcess, TaskAttachmentRecordSchema } from "./task-attachment-store.js";
 import { createZodColumnReader, decodeJsonColumn } from "./sql-json-column.js";
 const ID_RE = /^[0-9a-f-]{16,64}$/i;
 const readAttachmentMeta = createZodColumnReader(TaskAttachmentRecordSchema);
@@ -8,6 +8,7 @@ export class LocalTaskAttachmentStore {
     dir;
     metas;
     hydration;
+    mutationTail = Promise.resolve();
     constructor(rootDir) {
         this.dir = join(rootDir, "attachments");
     }
@@ -37,17 +38,24 @@ export class LocalTaskAttachmentStore {
         })();
         return this.hydration;
     }
-    async put(rec) {
-        const metas = await this.hydrate();
-        await fsp.mkdir(this.dir, { recursive: true });
-        const { content, ...meta } = rec;
-        const binTmp = join(this.dir, `${rec.id}.bin.tmp`);
-        const metaTmp = join(this.dir, `${rec.id}.json.tmp`);
-        await fsp.writeFile(binTmp, Buffer.from(content));
-        await fsp.rename(binTmp, join(this.dir, `${rec.id}.bin`));
-        await fsp.writeFile(metaTmp, JSON.stringify(meta));
-        await fsp.rename(metaTmp, join(this.dir, `${rec.id}.json`));
-        metas.set(rec.id, { ...meta });
+    serialized(op) {
+        const run = this.mutationTail.then(op);
+        this.mutationTail = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    put(rec) {
+        return this.serialized(async () => {
+            const metas = await this.hydrate();
+            await fsp.mkdir(this.dir, { recursive: true });
+            const { content, ...meta } = rec;
+            const binTmp = join(this.dir, `${rec.id}.bin.tmp`);
+            const metaTmp = join(this.dir, `${rec.id}.json.tmp`);
+            await fsp.writeFile(binTmp, Buffer.from(content));
+            await fsp.rename(binTmp, join(this.dir, `${rec.id}.bin`));
+            await fsp.writeFile(metaTmp, JSON.stringify(meta));
+            await fsp.rename(metaTmp, join(this.dir, `${rec.id}.json`));
+            metas.set(rec.id, { ...meta });
+        });
     }
     async get(owner, id) {
         const m = (await this.hydrate()).get(id);
@@ -69,19 +77,29 @@ export class LocalTaskAttachmentStore {
         await fsp.writeFile(tmp, JSON.stringify(m));
         await fsp.rename(tmp, join(this.dir, `${m.id}.json`));
     }
-    async bind(owner, ids, sessionId, boundAtMs) {
-        const metas = await this.hydrate();
-        let bound = 0;
-        for (const id of ids) {
-            const m = metas.get(id);
-            if (!m || m.owner !== owner)
-                continue;
-            m.sessionId = sessionId;
-            m.boundAtMs = boundAtMs;
-            await this.persistMeta(m);
-            bound++;
-        }
-        return bound;
+    bind(owner, ids, sessionId, boundAtMs) {
+        return this.serialized(async () => {
+            const metas = await this.hydrate();
+            const draft = new Map(metas);
+            for (const id of new Set(ids)) {
+                const row = metas.get(id);
+                if (row !== undefined)
+                    draft.set(id, { ...row });
+            }
+            const { outcome, claimed } = bindRowsInProcess(draft, owner, ids, sessionId, boundAtMs);
+            const landed = [];
+            try {
+                for (const m of claimed) {
+                    await this.persistMeta(m);
+                    landed.push(m);
+                }
+            }
+            finally {
+                for (const m of landed)
+                    metas.set(m.id, m);
+            }
+            return outcome;
+        });
     }
     async listBySession(sessionId) {
         const metas = await this.hydrate();
@@ -95,26 +113,32 @@ export class LocalTaskAttachmentStore {
         await fsp.rm(join(this.dir, `${id}.bin`), { force: true });
         this.metas?.delete(id);
     }
-    async delete(owner, id) {
-        const m = (await this.hydrate()).get(id);
-        if (!m || m.owner !== owner)
-            return false;
-        await this.removeRow(id);
-        return true;
+    delete(owner, id) {
+        return this.serialized(async () => {
+            const m = (await this.hydrate()).get(id);
+            if (!m || m.owner !== owner)
+                return false;
+            await this.removeRow(id);
+            return true;
+        });
     }
-    async deleteBySession(sessionId) {
-        const metas = await this.hydrate();
-        const hit = [...metas.values()].filter((m) => m.sessionId === sessionId);
-        for (const m of hit)
-            await this.removeRow(m.id);
-        return hit.length;
+    deleteBySession(sessionId) {
+        return this.serialized(async () => {
+            const metas = await this.hydrate();
+            const hit = [...metas.values()].filter((m) => m.sessionId === sessionId);
+            for (const m of hit)
+                await this.removeRow(m.id);
+            return hit.length;
+        });
     }
-    async reapUnbound(olderThanMs) {
-        const metas = await this.hydrate();
-        const hit = [...metas.values()].filter((m) => m.sessionId === undefined && m.createdAtMs < olderThanMs);
-        for (const m of hit)
-            await this.removeRow(m.id);
-        return hit.length;
+    reapUnbound(olderThanMs) {
+        return this.serialized(async () => {
+            const metas = await this.hydrate();
+            const hit = [...metas.values()].filter((m) => m.sessionId === undefined && m.createdAtMs < olderThanMs);
+            for (const m of hit)
+                await this.removeRow(m.id);
+            return hit.length;
+        });
     }
 }
 //# sourceMappingURL=local-task-attachment-store.js.map

package/dist/plugins/memory-key-guards.d.ts

@@ -15,9 +15,9 @@ export declare const MEMORY_SLUG_COLUMN_CHARS = 512;
  *  sync_cursor/push_queue/history)。`formatUserScope`/`formatProjScope` 的段编码(百分号转义)会
  *  **膨胀**——非 ASCII principal 编码后可超列宽,故产出处与写口两道都要判。 */
 export declare const MEMORY_SCOPE_COLUMN_CHARS = 190;
-/** memory-sync 店 `sync_cursor.peer` 列宽(两方言 VARCHAR(190) 同宽)—— 中心侧请求的 `peer` 落这一列。两个读者:中心侧验型
- *  (`memory-sync.ts` `parseMemorySyncRequest`,超宽 400)与客户端的身份铸点(`memory-sync-client.ts` `memorySyncPeerOf`,超宽拒启:
- *  身份就是请求的 `peer`,装不进这一列的身份每一轮都会被中心拒)。 */
+/** memory-sync 店 `sync_cursor.peer` 列宽(两方言 VARCHAR(190) 同宽)—— 中心侧请求的 `peer` 落这一列。唯一读者 = 同步身份的铸点
+ *  (`memory-sync-identity.ts` `readMemorySyncIdentity`:规范化之后超宽 = `too-long`)—— 它的四个座位(客户端 `MEMORY_SYNC_URL` 拒启、中心声明
+ *  `MEMORY_SYNC_SERVE_IDENTITY` 拒启、会话触发的 `target` 400、中心入站的 `peer` 400)由此同宽:身份就是请求的 `peer`,装不进这一列的身份每一轮都会被中心拒。 */
 export declare const MEMORY_SYNC_PEER_COLUMN_CHARS = 190;
 export declare function assertSlugWidth(slug: string): void;
 export declare function assertMemoryScopeWidth(scope: string): void;

package/dist/plugins/memory-run-store.d.ts

@@ -1,6 +1,6 @@
 import { type UsageRow } from "../usage-analytics.js";
 import type { TaskStatus } from "@sema-agent/core";
-import { type FenceLanded, type InProcessClaimFence, type CreateRunOutcome, type NewRunMeta, type RunIdemBinding, type RunListQuery, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
+import { type FenceLanded, type FencedRun, type InProcessClaimFence, type CreateRunOutcome, type NewRunMeta, type RunIdemBinding, type RunListQuery, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef, type SettledLegMemoryObservation } from "./store-contracts.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 import { type SpaceCommitClaim, type SpaceCommitReading, type SpaceCommitState } from "../workspace-space-commit.js";
 /**
@@ -83,7 +83,7 @@ export declare class MemoryRunStore implements InProcessClaimFence {
     markResuming(taskId: string, instanceId: string): Promise<boolean>;
     getActiveTaskId(sessionId: string): Promise<string | undefined>;
     /** 认领当写栅栏用(契约 = `store-contracts.ts` 的 `InProcessClaimFence`):判、刷新活性与 `write` 是同一个同步段。 */
-    whileHoldingClaim(sessionId: string, taskId: string, write: () => FenceLanded): boolean;
+    whileHoldingClaim(sessionId: string, taskId: string, write: (run: FencedRun) => FenceLanded): boolean;
     getRun(taskId: string): Promise<RunRecord | undefined>;
     /** Runs newest-first, keyset on (createdAt, taskId) DESC; optional exact-match filters (owner is exact, like the SQL). */
     listRuns(opts: RunListQuery): Promise<RunRecord[]>;
@@ -92,6 +92,11 @@ export declare class MemoryRunStore implements InProcessClaimFence {
      *  `createdAt DESC, taskId DESC`,与本店 {@link MemoryRunStore.listSessions} 挑 `rn=1` 那一行的比较器逐字同一份)。
      */
     latestRunForSession(sessionId: string): Promise<LatestRunRef | undefined>;
+    /**
+     * [ref] —— 这个会话**最近一条已结腿**与它的记忆观测(规则属主 = `store-contracts.ts` 的 {@link SettledLegMemoryObservation};
+     * {@link SqlRunStore.latestMemoryObservationForSession} 的孪生:同一只已结谓词(`isTerminalRunStatus`)、同一个排序口径 —— 与本店 {@link MemoryRunStore.latestRunForSession} 的比较器逐字同一份)。
+     */
+    latestMemoryObservationForSession(sessionId: string): Promise<SettledLegMemoryObservation | undefined>;
     /** DISTINCT sessions newest-first by last activity (the CC /resume picker): latest run's preview/status + first/last/count. */
     listSessions(opts: {
         owner?: string;

package/dist/plugins/memory-run-store.js

@@ -1,7 +1,7 @@
 import { redactErrorMessage, redactLedgerEventData, sealRunRowResult } from "../observability/run-terminal.js";
 import { outwardPlane } from "../terminal.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
-import { RUN_HOLDER_DEATH_CODES, RUN_STALLED_ERROR } from "./store-contracts.js";
+import { RUN_HOLDER_DEATH_CODES, RUN_STALLED_ERROR, isTerminalRunStatus, settledLegObservationOf } from "./store-contracts.js";
 import { notifyRunTerminal } from "../observability/run-terminal.js";
 import { createInProcessSpaceCommitTable, fenceSpaceCommitAtTerminal } from "../workspace-space-commit.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
@@ -238,7 +238,7 @@ export class MemoryRunStore {
         if (this.active.get(sessionId) !== taskId || r === undefined || r.status !== "running")
             return false;
         r.updatedAt = new Date();
-        write();
+        write({ instanceId: r.instanceId });
         return true;
     }
     async getRun(taskId) {
@@ -273,6 +273,16 @@ export class MemoryRunStore {
         }
         return latest === undefined ? undefined : { taskId: latest.taskId, owner: latest.owner, createdAt: latest.createdAt.toISOString() };
     }
+    async latestMemoryObservationForSession(sessionId) {
+        let latest;
+        for (const r of this.runs.values()) {
+            if (r.sessionId !== sessionId || !isTerminalRunStatus(r.status))
+                continue;
+            if (latest === undefined || r.createdAt.getTime() > latest.createdAt.getTime() || (r.createdAt.getTime() === latest.createdAt.getTime() && r.taskId > latest.taskId))
+                latest = r;
+        }
+        return latest === undefined ? undefined : settledLegObservationOf(latest.taskId, latest.result);
+    }
     async listSessions(opts) {
         const bySession = new Map();
         for (const r of this.runs.values()) {

package/dist/plugins/one-time-migrations.d.ts

@@ -316,6 +316,28 @@
  *      或 `storage` 时权限 / 磁盘修好)后的下一次起服照常补放置;存档移走则它不再是本服务的会话(不补放置、不再点名;fork 创建的会话例外 —— 它的格还在,读作 fork 未落定,出路是同键重试那次 fork 或删除该会话)。
  *    · **旧版在已切换库上**:≤7.137.x 起服建回空 `device_session`,随后列册对账见执行列为幽灵列拒启、零行写;再起本版 ⇒ ⓪ 删掉那张空表。回滚的唯一支持形 = 恢复切换前的备份。
  *    读数:`executionPlacementColumnsAdded` / `deviceBindingsMoved` / `deviceBindingsOrphaned`(非零 ⇒ 另一行 warn)/ `deviceBindingTablesDropped` / `executionPlacementsBackfilled` / `executionPlacementSessionsUnreadable`(点名数组 `{ sessionId, fault, errno? }`,只 local;一行一条 warn),收据只记起服日志行。
+ *  · **M33 local 存档的行事实搬进行、带戳存档改写成匿名**(7.141.0;local 独有 —— SQL 孪生的行事实本来就只在 `session_meta` 行上)—— local 店的行事实(属主 / 化身 / 执行放置 /
+ *    建档时刻 / fork 谱系)只住在会话元数据边档的那一格,引擎仓是匿名内容仓(`local-session-store.ts` 头注「规则一」):本店交给引擎仓的写一律不交属主,交出的会话元数据是那一格的一只投影。
+ *    ≤7.140.x 写下的存量 ① 格里没有建档时刻 / 谱系(那两样只在存档头上)② 换装 / 导入写下的存档头带着导入者的属主戳(及其 fork 后代 —— fork 抄戳)⇒ **一次性**:
+ *    步 0 恢复先行(上一次被打断留下的快照逐份消化,`LocalSessionStore.settleArchiveSnapshots`;起服 `ensureSchema` 先调,迁移开头再调)· 步 1 枚举(引擎仓列表 ∪ 边档全部键;
+ *    只在边档里、头读不出的 ⇒ 点名 unreadable)· 步 2 行回填(列表里每只存档:格缺 ⇒ 建一格、属主「从没被记下」;格缺建档时刻 / 谱系 ⇒ 从存档头补;一次边档提交 + 文件与目录各 fsync,
+ *    在这之前不碰任何存档)· 步 3 存档归一(每只带戳存档,在它的会话写锁里):整档一次读 → 读时跳过了记录 ⇒ 留着(`records_skipped`)→ 引擎导入闸先验(带发言者归属)不过 ⇒ 留着
+ *    (`invalid`)→ 验后与原日志不逐条相等 ⇒ 留着(`normalizes`;迁移从不改内容)→ 快照记录(core `atomicWriteFile`)→ 以这一代为条件删存档 → 匿名导入 → 删快照。
+ *    留着的存档字节不动、点名(一行一条 warn);它们之后被 fork 拒、改日志的推送答 `conflict`(读、续跑、拉取照常),出路 = 删掉会话后重推。
+ *    **快照目录的常设拒启臂**(`assertNoArchiveSnapshots`,无窗;删码后仍在):起服时数据根下的快照目录非空 ⇒ 拒启(`config.local_archive_snapshot_present`,`StoreBootRefusalError` 族)。
+ *    **回滚**:边档对象形一格是严格形,上一版不认 `createdAt` / `forkedFrom` 两键 ⇒ 读本版写过的边档严格拒启 —— 回滚的唯一支持形 = 恢复升级前的数据根备份(MIGRATION 写了:升级前备份、先停光旧副本)。
+ *    读数:`localArchiveRowFactsBackfilled` / `localArchivesAnonymized` / `localArchivesKeptStamped`(点名数组 `{ sessionId, reason }`)/ `localArchivesUnreadable`(点名数组 `{ sessionId }`)/
+ *    `localArchiveSnapshotsRecovered`;只 local(SQL 恒零 / 空)。
+ *  · **M34 问账行成因两列**(7.142.0)—— ≤7.141.x 的 `approval_ask` 只有一列 `denied_reason`,按行的 state 承载两种意思(PARKING / PARKED 行上是转 park 的触发成因,VOID / DENIED 行上是
+ *    终态成因),对账器把 PARKING 行收成 DENIED / VOID 时终态成因**覆盖**了触发成因。本版一列一义:`ending_cause`(终态成因)+ `park_trigger`(触发成因,只由 expire claim 写一次)。
+ *    **SQL 两方言**({@link splitApprovalAskCauseColumns},锁内,M18 之后):① `denied_reason` 在 ⇒ 改名成 `ending_cause`(MySQL 协议 `CHANGE COLUMN`、PG `RENAME COLUMN`;后置条件 `execUntil`)——
+ *    改名让滚动窗里的旧副本对这张表的每一条读写**响亮失败**(它们的列清单点名 `denied_reason`),而不是把触发词写进终态列;② `park_trigger` 不在 ⇒ 加列;
+ *    ③ PARKING / PARKED 行上那一格搬进 `park_trigger`(`park_trigger IS NULL` 才搬),再把这两态上的 `ending_cause` 置空(两句各自幂等;第二跑起零命中)。
+ *    中断 ⇒ 下一次起服从首个未满足的后置条件续(钉:真库在改名之后续跑收敛)。终态行上被覆盖掉的触发词没有出处可补 —— 如实缺席。
+ *    **local 车道**(File 问账日志):信封号 1 → 2;窗内读侧半场按意义译 v1 记录(`approval-ask-store-file.ts` 的 `translateJournalV1Record`),
+ *    起服迁移的 local 腿(`FileApprovalAskStore.upgradeJournalEnvelope`)一次压实把整本重写成 v2。
+ *    **回滚**:7.141.x 对改名后的表每一条读写都响亮失败、对 v2 日志拒启 —— 回滚的唯一支持形 = 恢复升级前的备份,或手工把列改回(MIGRATION 写了语句)。
+ *    读数:`askCauseColumnsChanged`(0–2 处表形改动)/ `askParkTriggersMoved`(SQL;local 恒 0)/ `askJournalRecordsUpgraded`(local;SQL 恒 0)。
  *
  * ## 收据账(一次起服一只,每一条迁移同一只)
  * 每一步把它**已提交**的改写 / 删除与点名读数当场记进同一只收据账({@link MigrationReceipts}):计数随每次提交累加、行随每次提交追加、形读数在那一步落定时写。走完 ⇒
@@ -424,6 +446,22 @@ export interface OneTimeMigrationReport {
     /** M32 local 腿:该回填放置、却读不出的会话 —— 有 run、存档读不出(会话头读不出 / 结构走不通 / 读存档文件时抛了别的故障:权限 / 磁盘 I/O / 超大)。一个字节没写,起服不挡:
      *  该会话的请求照旧答存档的故障;存档修好(从留存副本恢复,或权限 / 磁盘修好)后的下一次起服照常补放置。点名行数组(会话 id + 故障词,`storage` 再带 errno),一行一条 warn,每次起服都报直到处置。SQL 独有的反面:SQL 没有这一形(行就是会话);SQL 恒空。 */
     readonly executionPlacementSessionsUnreadable: readonly ExecutionPlacementSessionUnreadable[];
+    /** M33:本次补了行事实(建档时刻 / fork 谱系)的会话元数据格数(含为「有存档、没有格」的会话新建的格)。local 独有;SQL 恒 0。非零 = 真写了存量行。 */
+    readonly localArchiveRowFactsBackfilled: number;
+    /** M33:本次由带属主戳改写成匿名的存档数(条目逐条相等,内容不改)。local 独有;SQL 恒 0。非零 = 真写了存量存档。 */
+    readonly localArchivesAnonymized: number;
+    /** M33:留着带戳的存档(点名 + 原因,一行一条 warn,每次起服都报直到处置)。local 独有;SQL 恒空。 */
+    readonly localArchivesKeptStamped: readonly LocalArchiveKeptStamped[];
+    /** M33:存档读不出的会话(边档里有格而存档头读不出,或整档读抛;点名,一行一条 warn,每次起服都报直到处置)。local 独有;SQL 恒空。 */
+    readonly localArchivesUnreadable: readonly LocalArchiveUnreadable[];
+    /** M33:本次起服消化掉的快照记录数(上一次被打断的改写留下的;补回 / 丢弃)。local 独有;SQL 恒 0。 */
+    readonly localArchiveSnapshotsRecovered: number;
+    /** M34:本次对 `approval_ask` 成因列做的表形改动数(改名 `denied_reason → ending_cause`、加 `park_trigger`;0–2)。非零 = 这次真改了表形。SQL 独有;local 恒 0。 */
+    readonly askCauseColumnsChanged: number;
+    /** M34:本次把那一格从 `ending_cause` 搬进 `park_trigger` 的 PARKING / PARKED 行数。非零 = 真写了存量行。SQL 独有;local 恒 0。 */
+    readonly askParkTriggersMoved: number;
+    /** M34 local 腿:问账日志里信封号 1 的记录数(窗内读侧已按意义译读;本次一次压实把整本重写成 v2)。非零 = 真重写了日志。local 独有;SQL 恒 0。 */
+    readonly askJournalRecordsUpgraded: number;
 }
 /** 退役的两只命令桶(引擎 7.51.0 起不是桶;只给 M17 点名认)。 */
 export type RetiredSessionRuleBucket = "commandAllow" | "commandDeny";
@@ -474,6 +512,24 @@ export interface ExecutionPlacementSessionUnreadable {
     /** 仅 `fault === "storage"` 且那只故障带字符串 `code` 时在场(`EACCES` / `EIO` / `ERR_STRING_TOO_LONG` ……)。 */
     readonly errno?: string;
 }
+/**
+ * M33 留着带戳的一只存档的原因(闭集):`invalid` = 引擎导入闸不收这份日志(重导会被拒);`normalizes` = 引擎导入会改写它的内容(重导不再逐条相等);
+ * `records_skipped` = 读这只存档时跳过了读不出的记录(重写会把盘上那几行字节抹掉)。三种都一个字节不动。
+ */
+export type LocalArchiveKeptReason = "invalid" | "normalizes" | "records_skipped";
+/** M33 留着带戳的一只存档:会话 id 是点名坐标 + 原因。日志内容与盘上路径不出店。 */
+export interface LocalArchiveKeptStamped {
+    readonly sessionId: string;
+    readonly reason: LocalArchiveKeptReason;
+    /** `reason: "invalid"` 时在场:引擎导入闸拒的那一句(条目 id + 结构毛病,不含条目内容)—— 运维据它找到挡住改写的那一条。 */
+    readonly detail?: string;
+}
+/** M33 读不出的一只:会话元数据边档里有它的格而存档头读不出(会话头坏),或列表读得出头、整档读抛。一个字节没写;会话的请求照旧答存档的故障。 */
+export interface LocalArchiveUnreadable {
+    readonly sessionId: string;
+    /** 读的时候抛的那只故障带串型 `code` 时在场(`EACCES` / `EIO` / `corrupt_session` …);盘上路径与故障句不出店。 */
+    readonly errno?: string;
+}
 /** 三个形读数(M9 主键 / M17 列名 / M24 scope 列)—— 那一步**落定**之前收据账里缺席(读数行要它们齐;被打断的那一行只带已落定的)。 */
 type ShapeReadingKey = "workflowParkIndexKey" | "sessionRuleColumn" | "workflowJournalScopeColumn";
 /**
@@ -544,8 +600,8 @@ export declare function migrationWindowOpen(window: Pick<OneTimeMigrationWindow,
  * 还没有日期可写)⇒ 响亮抛,不铸一句带空日期的句子。
  */
 export declare function migrationWindowEnd(id: string): string;
-/** local 车道上 SQL 独有的几条(M8 / M9 / M11 / M17 / M18 / M21 / M23 / M24 / M26 / M27 / M29)的读数(M6 与 M32 的回填两车道都有,local 腿的读数由 `LocalBackend.runOneTimeMigrations` 现算):那几张表 / 列在文件底座上从来不存在 ⇒ 如实答 absent / 0。 */
-export declare const NO_SQL_MIGRATIONS: Omit<OneTimeMigrationReport, "holderDeathCodeRowsBackfilled" | "executionPlacementsBackfilled" | "askExecutionLanesBackfilled" | "executionPlacementSessionsUnreadable">;
+/** local 车道上 SQL 独有的几条(M8 / M9 / M11 / M17 / M18 / M21 / M23 / M24 / M26 / M27 / M29)的读数(M6 与 M32 的回填两车道都有、M33 只在 local,local 腿的读数由 `LocalBackend.runOneTimeMigrations` 现算):那几张表 / 列在文件底座上从来不存在 ⇒ 如实答 absent / 0。 */
+export declare const NO_SQL_MIGRATIONS: Omit<OneTimeMigrationReport, "holderDeathCodeRowsBackfilled" | "executionPlacementsBackfilled" | "askExecutionLanesBackfilled" | "executionPlacementSessionsUnreadable" | "localArchiveRowFactsBackfilled" | "localArchivesAnonymized" | "localArchivesKeptStamped" | "localArchivesUnreadable" | "localArchiveSnapshotsRecovered" | "askJournalRecordsUpgraded">;
 /** 启动期的日志口(logger 的子集)。两级各有其用,见 {@link logOneTimeMigrations}。 */
 export interface MigrationLogSink {
     warn(msg: string, meta?: Record<string, unknown>): void;
@@ -579,6 +635,16 @@ export interface MigrationDb {
  * `createStoreBackend()` → `ensureSchema()` → `runOneTimeMigrations()` 的嵌入方与本服务的起服序列一样,有这一问、零动作。
  */
 export declare function runSqlOneTimeMigrations(dialect: SqlDialect, pool: MysqlPool | PgPool, input: ExecutionPlacementSwitchInput): Promise<OneTimeMigrationReport>;
+/**
+ * M34 —— 问账行成因两列(判据与形见头注 M34 段)。三步,每一步先读形再判,DDL 按后置条件收敛({@link execUntil}),中断 ⇒ 下一次起服从首个未满足的后置条件续:
+ *  ① `denied_reason` 在 ⇒ 改名成 `ending_cause`(后置条件:旧名不在 ∧ 新名在)—— 改名让滚动窗里的旧副本对这张表的每一条读写响亮失败;
+ *  ② `park_trigger` 不在 ⇒ 加列(列定义 = 建表 DDL 内联的同一份);
+ *  ③ PARKING / PARKED 行:`ending_cause` 里的词搬进 `park_trigger`(只搬 `park_trigger IS NULL` 的行),再把这两态上的 `ending_cause` 置空。两句而不是一句
+ *     `SET park_trigger = ending_cause, ending_cause = NULL`:一句的结果取决于赋值的求值次序(MySQL 协议方言按左到右读已改的值,PG 读原行),两句不依赖它;两句各自幂等,
+ *     中间被打断 ⇒ 下一次起服第一句零命中、第二句收尾(这期间读口照旧:终态成因读口在这两态上不作数)。本版写者不会在这两态上写终态成因 ⇒ 第二跑起两句都零命中。
+ * 表不在(中央 DDL 之前被调到)⇒ 零动作。读数:①② 各记 `askCauseColumnsChanged` +1;③ 第一句的受影响行数记 `askParkTriggersMoved`。
+ */
+export declare function splitApprovalAskCauseColumns(db: MigrationDb, dialect: SqlDialect, receipts: MigrationReceipts): Promise<void>;
 /** M32 的起服拒码(确定的拒启表态:再等也等不来另一个答案;不是线上 wire 码,与 `config.schema_mismatch` 同一族)。 */
 export declare const EXECUTION_PLACEMENT_SWITCH_REFUSED_CODE = "config.execution_placement_switch_refused";
 /** 拒因闭集:`fence` = 切换开始之后退役绑定表里又出现了行(旧版副本 / 手工写下的);`backfill_ambiguous` = 车道表不止一项而还有要回填的存量。 */