@sema-agent/server 7.142.0 → 7.143.0

package/dist/plugins/mailbox-store-sql.js

@@ -1,13 +1,14 @@
 import { isUtf8 } from "node:buffer";
-import { MAILBOX_INVALID_PEER_META_CODE, MAILBOX_RECORD_ID_MAX_CHARS, MAILBOX_TOMBSTONED_RECIPIENT_CODE, MailboxStoreError, assertMailboxDecisionMove, judgeMailboxAppendById, readMailboxAppend, readMailboxPeerMeta, readStoredMailboxDecision } from "@sema-agent/core";
+import { MAILBOX_CONSUMED_ID_WINDOW, MAILBOX_INVALID_PEER_META_CODE, MAILBOX_RECORD_ID_MAX_CHARS, MAILBOX_REPLAY_FACETS, MAILBOX_TOMBSTONED_RECIPIENT_CODE, MailboxStoreError, assertMailboxDecisionMove, judgeMailboxAppendById, mailboxReplayDigests, readMailboxAppend, readMailboxPeerMeta, readStoredMailboxDecision } from "@sema-agent/core";
 import { pgHasUnstorable, pgSanitizeText, PgUnstorableError } from "./pg-safe-json.js";
 import { isWellFormedUnicode } from "../principal-jwt.js";
 import { ensureIndexes } from "./ensure-index.js";
 import { escapeLike } from "./sql-escape.js";
-import { decodeNullableJsonColumn, foldJsonColumn, isJsonColumnBodyProblem, jsonColumnText, readStringArrayColumn } from "./sql-json-column.js";
+import { SqlJsonColumnError, decodeJsonColumn, decodeNullableJsonColumn, foldJsonColumn, isJsonColumnBodyProblem, jsonColumnText, readStringArrayColumn } from "./sql-json-column.js";
 export const MAILBOX_TABLE = "mailbox";
 export const MAILBOX_MSG_TABLE = "mailbox_message";
 export const MAILBOX_TOMBSTONE_TABLE = "mailbox_tombstone";
+export const MAILBOX_CONSUMED_TABLE = "mailbox_consumed";
 const TOMBSTONE_LABEL_MAX_CHARS = 120;
 function boundedLabel(label) {
     if (label === undefined || label === "")
@@ -49,8 +50,54 @@ function appendSnapshot(msg) {
     }
     return rec;
 }
-function replayedSeq(held, scope, handle, logger, asStored) {
-    return judgeMailboxAppendById(rowsToMessages(held, scope, handle, logger), asStored);
+function replayedSeq(held, consumed, scope, handle, logger, asStored) {
+    return judgeMailboxAppendById({ held: rowsToMessages(held, scope, handle, logger), consumed: consumedRecordsOf(consumed, scope, handle, logger) }, asStored);
+}
+function consumedRecordsOf(rows, scope, handle, logger) {
+    return rows.map((r) => {
+        const seq = Number(r.seq);
+        let digests;
+        try {
+            digests = decodeJsonColumn(bufToStr(r.digests), readConsumedDigestsShape, `${MAILBOX_CONSUMED_TABLE}.digests for seq ${seq}`);
+        }
+        catch (e) {
+            if (!(e instanceof SqlJsonColumnError))
+                throw e;
+            logger?.warn("mailbox_message_column_corrupt", {
+                scope,
+                handle,
+                seq,
+                column: "consumed_digests",
+                note: "appends under this record id are refused for the box (fail-closed); repair or delete this row of the received window",
+            });
+            throw new Error(`MailboxStore: received-window row seq ${seq} has unreadable digests (refusing — the replay judgment cannot be made)`);
+        }
+        return { id: String(r.record_id), seq, digests };
+    });
+}
+const readConsumedDigestsShape = (body) => {
+    if (typeof body !== "object" || body === null || Array.isArray(body))
+        return { problem: "the digests are not an object" };
+    const facets = body;
+    if (Object.keys(facets).length !== MAILBOX_REPLAY_FACETS.length || !MAILBOX_REPLAY_FACETS.every((f) => typeof facets[f] === "string")) {
+        return { problem: `the digests are not exactly the ${MAILBOX_REPLAY_FACETS.length} replay facets as strings` };
+    }
+    return { value: Object.freeze(Object.fromEntries(MAILBOX_REPLAY_FACETS.map((f) => [f, facets[f]]))) };
+};
+async function enterConsumedWindow(run, removed, scope, handle) {
+    const entered = removed.filter((m) => m.id !== undefined);
+    if (entered.length === 0)
+        return;
+    for (const m of entered) {
+        await run({ mysql: `INSERT INTO ${MAILBOX_CONSUMED_TABLE} (scope_key, handle, seq, record_id, digests) VALUES (?, ?, ?, ?, ?)`, pg: `INSERT INTO ${MAILBOX_CONSUMED_TABLE} (scope_key, handle, seq, record_id, digests) VALUES ($1, $2, $3, $4, $5)` }, [scope, handle, m.seq, m.id, JSON.stringify(mailboxReplayDigests(m))]);
+    }
+    const edge = await run({
+        mysql: `SELECT seq FROM ${MAILBOX_CONSUMED_TABLE} WHERE scope_key = ? AND handle = ? ORDER BY seq DESC LIMIT 1 OFFSET ?`,
+        pg: `SELECT seq FROM ${MAILBOX_CONSUMED_TABLE} WHERE scope_key = $1 AND handle = $2 ORDER BY seq DESC LIMIT 1 OFFSET $3`,
+    }, [scope, handle, MAILBOX_CONSUMED_ID_WINDOW - 1]);
+    if (edge.length === 0)
+        return;
+    await run({ mysql: `DELETE FROM ${MAILBOX_CONSUMED_TABLE} WHERE scope_key = ? AND handle = ? AND seq < ?`, pg: `DELETE FROM ${MAILBOX_CONSUMED_TABLE} WHERE scope_key = $1 AND handle = $2 AND seq < $3` }, [scope, handle, Number(edge[0].seq)]);
 }
 function asUtf8Stored(v) {
     return Buffer.from(v, "utf8").toString("utf8");
@@ -71,7 +118,7 @@ export function storedMailboxKeyless(scopeKey, handle) {
     const h = storedKeyText(handle);
     return scope === undefined || h === undefined || keyless(scope, h);
 }
-export const MAILBOX_KEYED_TABLES = [MAILBOX_TABLE, MAILBOX_MSG_TABLE, MAILBOX_TOMBSTONE_TABLE];
+export const MAILBOX_KEYED_TABLES = [MAILBOX_TABLE, MAILBOX_MSG_TABLE, MAILBOX_CONSUMED_TABLE, MAILBOX_TOMBSTONE_TABLE];
 export function mailboxKeyDeleteSql(dialect, table) {
     return dialect === "mysql" ? `DELETE FROM ${table} WHERE scope_key = ? AND handle = ?` : `DELETE FROM ${table} WHERE scope_key = $1 AND handle = $2`;
 }
@@ -210,6 +257,14 @@ export async function ensureTiDBMailboxSchema(pool) {
     record_id VARCHAR(${MAILBOX_RECORD_ID_MAX_CHARS}) NULL,
     PRIMARY KEY (scope_key, handle, seq),
     KEY idx_mbm_sent (scope_key, handle, sent_at_ms)
+  ) COLLATE utf8mb4_bin`);
+    await pool.query(`CREATE TABLE IF NOT EXISTS ${MAILBOX_CONSUMED_TABLE} (
+    scope_key VARBINARY(190) NOT NULL,
+    handle VARBINARY(190) NOT NULL,
+    seq BIGINT NOT NULL,
+    record_id VARCHAR(${MAILBOX_RECORD_ID_MAX_CHARS}) NOT NULL,
+    digests TEXT NOT NULL,
+    PRIMARY KEY (scope_key, handle, seq)
   ) COLLATE utf8mb4_bin`);
     await pool.query(`CREATE TABLE IF NOT EXISTS ${MAILBOX_TOMBSTONE_TABLE} (
     scope_key VARBINARY(190) NOT NULL,
@@ -247,6 +302,14 @@ export async function ensurePgMailboxSchema(q) {
     decision VARCHAR(16) COLLATE "C", -- core 7.57.0 #972b(TiDB twin 同注:留置决定,NULL = 从未 held;只经 moveDecision 移动,随记录亡)
     record_id VARCHAR(${MAILBOX_RECORD_ID_MAX_CHARS}) COLLATE "C", -- core 7.59.0(TiDB twin 同注:生产者铸的记录身份,NULL = 没说身份;盒行锁之内经引擎判,随记录亡)
     PRIMARY KEY (scope_key, handle, seq)
+  )`);
+    await q(`CREATE TABLE IF NOT EXISTS ${MAILBOX_CONSUMED_TABLE} (
+    scope_key VARCHAR(190) COLLATE "C" NOT NULL,
+    handle VARCHAR(190) COLLATE "C" NOT NULL,
+    seq BIGINT NOT NULL,
+    record_id VARCHAR(${MAILBOX_RECORD_ID_MAX_CHARS}) COLLATE "C" NOT NULL,
+    digests TEXT COLLATE "C" NOT NULL, -- TiDB twin 同注:已收窗(core 7.61.0),四面摘要 JSON
+    PRIMARY KEY (scope_key, handle, seq)
   )`);
     await q(`CREATE TABLE IF NOT EXISTS ${MAILBOX_TOMBSTONE_TABLE} (
     scope_key VARCHAR(190) COLLATE "C" NOT NULL,
@@ -299,7 +362,8 @@ export class TiDBMailboxStore {
                 throw tombstonedRecipientError(scope, handle);
             if (rec.id !== undefined) {
                 const [held] = await c.query(`SELECT seq, from_id, content, sent_at_ms, ${jsonColumnText("mysql", "hop_chain")}, ${jsonColumnText("mysql", "peer_meta")}, decision, record_id FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = ? AND handle = ? AND record_id = ? FOR UPDATE`, [scope, handle, rec.id]);
-                const replay = replayedSeq(held, scope, handle, this.logger, { ...rec, content: asUtf8Stored(rec.content), ...(rec.from !== undefined ? { from: asUtf8Stored(rec.from) } : {}) });
+                const [consumed] = await c.query(`SELECT seq, record_id, digests FROM ${MAILBOX_CONSUMED_TABLE} WHERE scope_key = ? AND handle = ? AND record_id = ? FOR UPDATE`, [scope, handle, rec.id]);
+                const replay = replayedSeq(held, consumed, scope, handle, this.logger, { ...rec, content: asUtf8Stored(rec.content), ...(rec.from !== undefined ? { from: asUtf8Stored(rec.from) } : {}) });
                 if (replay !== undefined)
                     return replay;
             }
@@ -338,7 +402,9 @@ export class TiDBMailboxStore {
             const [rows] = (await c.query(`SELECT lease_owner FROM ${MAILBOX_TABLE} WHERE scope_key = ? AND handle = ? FOR UPDATE`, [scope, handle]));
             if (rows.length === 0 || rows[0].lease_owner == null || bufToStr(rows[0].lease_owner) !== owner)
                 return { acked: false };
+            const [removed] = await c.query(`SELECT seq, from_id, content, sent_at_ms, ${jsonColumnText("mysql", "hop_chain")}, ${jsonColumnText("mysql", "peer_meta")}, decision, record_id FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = ? AND handle = ? AND seq <= ? AND record_id IS NOT NULL ORDER BY seq FOR UPDATE`, [scope, handle, upToSeq]);
             await c.query(`DELETE FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = ? AND handle = ? AND seq <= ?`, [scope, handle, upToSeq]);
+            await enterConsumedWindow(async (sql, params) => (await c.query(sql.mysql, params))[0], rowsToMessages(removed, scope, handle, this.logger), scope, handle);
             await c.query(`UPDATE ${MAILBOX_TABLE} SET lease_owner = NULL, lease_expires_at_ms = NULL, lease_max_seq = NULL
          WHERE scope_key = ? AND handle = ? AND lease_max_seq IS NOT NULL AND lease_max_seq <= ?`, [scope, handle, upToSeq]);
             return { acked: true };
@@ -475,7 +541,8 @@ export class PgMailboxStore {
                 throw tombstonedRecipientError(scope, handle);
             if (rec.id !== undefined) {
                 const { rows: held } = await c.query(`SELECT seq, from_id, content, sent_at_ms, ${jsonColumnText("pg", "hop_chain")}, ${jsonColumnText("pg", "peer_meta")}, decision, record_id FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = $1 AND handle = $2 AND record_id = $3 FOR UPDATE`, [scope, handle, rec.id]);
-                const replay = replayedSeq(held, scope, handle, this.logger, { ...rec, content });
+                const { rows: consumed } = await c.query(`SELECT seq, record_id, digests FROM ${MAILBOX_CONSUMED_TABLE} WHERE scope_key = $1 AND handle = $2 AND record_id = $3 FOR UPDATE`, [scope, handle, rec.id]);
+                const replay = replayedSeq(held, consumed, scope, handle, this.logger, { ...rec, content });
                 if (replay !== undefined)
                     return replay;
             }
@@ -511,7 +578,9 @@ export class PgMailboxStore {
             const r = (await c.query(`SELECT lease_owner FROM ${MAILBOX_TABLE} WHERE scope_key = $1 AND handle = $2 FOR UPDATE`, [scope, handle]));
             if (r.rows.length === 0 || r.rows[0].lease_owner == null || bufToStr(r.rows[0].lease_owner) !== owner)
                 return { acked: false };
+            const { rows: removed } = await c.query(`SELECT seq, from_id, content, sent_at_ms, ${jsonColumnText("pg", "hop_chain")}, ${jsonColumnText("pg", "peer_meta")}, decision, record_id FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = $1 AND handle = $2 AND seq <= $3 AND record_id IS NOT NULL ORDER BY seq FOR UPDATE`, [scope, handle, upToSeq]);
             await c.query(`DELETE FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = $1 AND handle = $2 AND seq <= $3`, [scope, handle, upToSeq]);
+            await enterConsumedWindow(async (sql, params) => (await c.query(sql.pg, params)).rows, rowsToMessages(removed, scope, handle, this.logger), scope, handle);
             await c.query(`UPDATE ${MAILBOX_TABLE} SET lease_owner = NULL, lease_expires_at_ms = NULL, lease_max_seq = NULL
          WHERE scope_key = $1 AND handle = $2 AND lease_max_seq IS NOT NULL AND lease_max_seq <= $3`, [scope, handle, upToSeq]);
             return { acked: true };

package/dist/plugins/memory-sync-store-pg.d.ts

@@ -3,9 +3,16 @@ import { type IndexSpec } from "./ensure-index.js";
 /** Table names (single source). SAME names as the TiDB twin (the two dialects never share one DB). */
 export declare const PG_MEMORY_SYNC_TABLES: {
     readonly syncCursor: "agent_memory_engine_sync_cursor";
+    readonly syncPartition: "agent_memory_engine_sync_partition";
     readonly pushQueue: "agent_memory_engine_push_queue";
     readonly history: "agent_memory_engine_history";
 };
+/**
+ * 一个层分区的化身的**唯一铸点**(两只方言孪生同读)。化身说的是「中心此刻答话的是这个分区的哪一份状态」:分区出生时铸一次、存进
+ * `agent_memory_engine_sync_partition`,此后每轮同步答它;库被清空重建 ⇒ 那一行随之没了,下一轮再出生 ⇒ 新值。两条契约句(引擎的):
+ * (i) 没有别的分区、别的状态带同一个值 —— 随机 UUID(122 位熵);(ii) 不带凭据 —— 客户端的引擎拒带凭据的化身(钉:十六进制与连字符,凭据判官判否)。
+ */
+export declare function mintSyncPartitionIncarnation(): string;
 /** What the caller hands `enqueue` — the transport-neutral unit (§3 传输中立包:payload = the full
  *  entry, opaque to this store; this queue never interprets it). */
 export interface PushQueueItem {
@@ -45,6 +52,11 @@ export interface CentralSyncCursor {
 /** The dialect-neutral contract both twins implement (anti-drift: one shared integration suite,
  *  test/memory-sync-store-db-integration.test.ts, runs the SAME scenarios against BOTH engines). */
 export interface MemorySyncStore {
+    /**
+     * 层分区 `scope` 的化身:有 ⇒ 存着的那一只;没有 ⇒ 分区此刻出生(铸点 {@link mintSyncPartitionIncarnation},插入即定;并发的第一次只有一只落定,
+     * 两边读回同一只)。中心同步每轮在任何读写之前读它一次、写完之后再读一次(栅栏两端,`memory-sync.ts`)。
+     */
+    partitionIncarnation(scope: string): Promise<string>;
     getCursor(scope: string, peer: string): Promise<CentralSyncCursor | undefined>;
     /** Whole-row replace (round semantics — baseRevs is swapped as one map, never merged). */
     putCursor(cursor: CentralSyncCursor): Promise<void>;
@@ -67,6 +79,8 @@ export declare function ensurePgMemorySyncSchema(query: PgQueryFn): Promise<void
  * ([ref] 车①② 裁定,沿用;不新铸码)。两个孪生共用本函数(MySQL 腿 import 它 —— 一条折码规则一个写者)。
  */
 export declare function refusingMemorySyncRow<T>(read: () => T): T;
+/** 读回的分区化身(两孪生同读):插入即定之后必有一行、值是非空串;否则响亮抛(不铸替身值 —— 一个读不出的化身没有安全的答法)。 */
+export declare function partitionIncarnationOf(value: unknown, scope: string): string;
 /** Options for {@link PgMemorySyncStore}. */
 export interface PgMemorySyncStoreOptions {
     /** How long a `claimDue` lease holds a row invisible before a crashed worker's claim self-heals.
@@ -77,6 +91,7 @@ export declare class PgMemorySyncStore implements MemorySyncStore {
     private readonly query;
     private readonly claimLeaseMs;
     constructor(query: PgQueryFn, opts?: PgMemorySyncStoreOptions);
+    partitionIncarnation(scope: string): Promise<string>;
     getCursor(scope: string, peer: string): Promise<CentralSyncCursor | undefined>;
     putCursor(cursor: CentralSyncCursor): Promise<void>;
     enqueue(item: PushQueueItem): Promise<void>;

package/dist/plugins/memory-sync-store-pg.js

@@ -1,12 +1,17 @@
+import { randomUUID } from "node:crypto";
 import { ensureIndexes } from "./ensure-index.js";
 import { pgSafeJsonStringify, pgProtocolJsonStringify } from "./pg-safe-json.js";
 import { assertMemoryScopeWidth } from "./memory-key-guards.js";
 import { decodeJsonColumn, decodeNullableJsonColumn, foldJsonColumn, jsonColumnText, readNonNullJsonValueColumn, readOpaqueJsonValueColumn, readStringRecordColumn, } from "./sql-json-column.js";
 export const PG_MEMORY_SYNC_TABLES = {
     syncCursor: "agent_memory_engine_sync_cursor",
+    syncPartition: "agent_memory_engine_sync_partition",
     pushQueue: "agent_memory_engine_push_queue",
     history: "agent_memory_engine_history",
 };
+export function mintSyncPartitionIncarnation() {
+    return randomUUID();
+}
 export const MEMORY_SYNC_INDEXES = [
     { table: `${PG_MEMORY_SYNC_TABLES.pushQueue}`, name: `idx_${PG_MEMORY_SYNC_TABLES.pushQueue}_next_attempt_ms`, columns: ["next_attempt_at_ms"] },
 ];
@@ -17,6 +22,11 @@ export async function ensurePgMemorySyncSchema(query) {
     base_revs     jsonb        NOT NULL,
     updated_at_ms bigint       NOT NULL,
     PRIMARY KEY (scope, peer)
+  )`);
+    await query(`CREATE TABLE IF NOT EXISTS ${PG_MEMORY_SYNC_TABLES.syncPartition} (
+    scope       varchar(190) COLLATE "C" NOT NULL,
+    incarnation varchar(64)  COLLATE "C" NOT NULL,
+    PRIMARY KEY (scope)
   )`);
     await query(`CREATE TABLE IF NOT EXISTS ${PG_MEMORY_SYNC_TABLES.pushQueue} (
     id                 char(36) COLLATE "C"     PRIMARY KEY,
@@ -37,6 +47,11 @@ export function refusingMemorySyncRow(read) {
         throw foldJsonColumn(e, (m) => `memory-sync store: ${m} — refusing rather than serve a sync row nobody can read`);
     }
 }
+export function partitionIncarnationOf(value, scope) {
+    if (typeof value === "string" && value.length > 0)
+        return value;
+    throw new Error(`memory-sync store: ${PG_MEMORY_SYNC_TABLES.syncPartition}.incarnation for scope ${scope} is ${value === undefined ? "missing after insert" : "not a non-empty string"} — refusing rather than answer a sync under an unknown state`);
+}
 function toMs(v) {
     return typeof v === "number" ? v : Number(v);
 }
@@ -51,6 +66,12 @@ export class PgMemorySyncStore {
         }
         this.claimLeaseMs = lease;
     }
+    async partitionIncarnation(scope) {
+        assertMemoryScopeWidth(scope);
+        await this.query(`INSERT INTO ${PG_MEMORY_SYNC_TABLES.syncPartition} (scope, incarnation) VALUES ($1, $2) ON CONFLICT (scope) DO NOTHING`, [scope, mintSyncPartitionIncarnation()]);
+        const res = await this.query(`SELECT incarnation FROM ${PG_MEMORY_SYNC_TABLES.syncPartition} WHERE scope = $1`, [scope]);
+        return partitionIncarnationOf(res.rows[0]?.incarnation, scope);
+    }
     async getCursor(scope, peer) {
         const res = await this.query(`SELECT ${jsonColumnText("pg", "base_revs")}, updated_at_ms FROM ${PG_MEMORY_SYNC_TABLES.syncCursor} WHERE scope = $1 AND peer = $2`, [scope, peer]);
         const row = res.rows[0];

package/dist/plugins/memory-sync-store-tidb.d.ts

@@ -5,6 +5,7 @@ import type { Pool } from "mysql2/promise";
  *  one database). */
 export declare const TIDB_MEMORY_SYNC_TABLES: {
     readonly syncCursor: "agent_memory_engine_sync_cursor";
+    readonly syncPartition: "agent_memory_engine_sync_partition";
     readonly pushQueue: "agent_memory_engine_push_queue";
     readonly history: "agent_memory_engine_history";
 };
@@ -21,6 +22,7 @@ export declare class TiDBMemorySyncStore implements MemorySyncStore {
     private readonly pool;
     private readonly claimLeaseMs;
     constructor(pool: Pool, opts?: TiDBMemorySyncStoreOptions);
+    partitionIncarnation(scope: string): Promise<string>;
     getCursor(scope: string, peer: string): Promise<CentralSyncCursor | undefined>;
     putCursor(cursor: CentralSyncCursor): Promise<void>;
     enqueue(item: PushQueueItem): Promise<void>;

package/dist/plugins/memory-sync-store-tidb.js

@@ -1,10 +1,11 @@
-import { historyRowFrom, refusingMemorySyncRow } from "./memory-sync-store-pg.js";
+import { historyRowFrom, mintSyncPartitionIncarnation, partitionIncarnationOf, refusingMemorySyncRow } from "./memory-sync-store-pg.js";
 import { decodeJsonColumn, jsonColumnText, readOpaqueJsonValueColumn, readStringRecordColumn } from "./sql-json-column.js";
 import { ensureIndexes } from "./ensure-index.js";
 import { MEMORY_SYNC_INDEXES, MEMORY_HISTORY_INDEXES, PG_MEMORY_SYNC_TABLES } from "./memory-sync-store-pg.js";
 import { assertMemoryScopeWidth } from "./memory-key-guards.js";
 export const TIDB_MEMORY_SYNC_TABLES = {
     syncCursor: "agent_memory_engine_sync_cursor",
+    syncPartition: "agent_memory_engine_sync_partition",
     pushQueue: "agent_memory_engine_push_queue",
     history: "agent_memory_engine_history",
 };
@@ -17,6 +18,11 @@ export async function ensureTiDBMemorySyncSchema(pool) {
     base_revs     JSON         NOT NULL,
     updated_at_ms BIGINT       NOT NULL,
     PRIMARY KEY (scope, peer)
+  ) COLLATE utf8mb4_bin`);
+    await pool.query(`CREATE TABLE IF NOT EXISTS ${TIDB_MEMORY_SYNC_TABLES.syncPartition} (
+    scope       VARCHAR(190) NOT NULL,
+    incarnation VARCHAR(64)  NOT NULL,
+    PRIMARY KEY (scope)
   ) COLLATE utf8mb4_bin`);
     await pool.query(`CREATE TABLE IF NOT EXISTS ${TIDB_MEMORY_SYNC_TABLES.pushQueue} (
     id                 CHAR(36)     NOT NULL,
@@ -45,6 +51,12 @@ export class TiDBMemorySyncStore {
         }
         this.claimLeaseMs = lease;
     }
+    async partitionIncarnation(scope) {
+        assertMemoryScopeWidth(scope);
+        await this.pool.query(`INSERT INTO ${TIDB_MEMORY_SYNC_TABLES.syncPartition} (scope, incarnation) VALUES (?, ?) ON DUPLICATE KEY UPDATE scope = scope`, [scope, mintSyncPartitionIncarnation()]);
+        const [rows] = await this.pool.query(`SELECT incarnation FROM ${TIDB_MEMORY_SYNC_TABLES.syncPartition} WHERE scope = ?`, [scope]);
+        return partitionIncarnationOf(rows[0]?.incarnation, scope);
+    }
     async getCursor(scope, peer) {
         const [rows] = await this.pool.query(`SELECT ${jsonColumnText("mysql", "base_revs")}, updated_at_ms FROM ${TIDB_MEMORY_SYNC_TABLES.syncCursor} WHERE scope = ? AND peer = ?`, [scope, peer]);
         const row = rows[0];

package/dist/plugins/one-time-migrations.d.ts

@@ -338,6 +338,25 @@
  *    起服迁移的 local 腿(`FileApprovalAskStore.upgradeJournalEnvelope`)一次压实把整本重写成 v2。
  *    **回滚**:7.141.x 对改名后的表每一条读写都响亮失败、对 v2 日志拒启 —— 回滚的唯一支持形 = 恢复升级前的备份,或手工把列改回(MIGRATION 写了语句)。
  *    读数:`askCauseColumnsChanged`(0–2 处表形改动)/ `askParkTriggersMoved`(SQL;local 恒 0)/ `askJournalRecordsUpgraded`(local;SQL 恒 0)。
+ *  · **M35 配置根上 env 模型表的决定(settings-schema SS-M11)**(7.143.0)—— 不在店里(与 M16 同为本地配置根上的起服迁移):本版起本地配置腿上,一份管模型面的
+ *    `config.d/models.json` 在 env 模型表已声明时,只有配置根上的决定文档 `config.env-models.json` 读作 `replaced` 才被采纳(否则模型面组拒
+ *    `config.catalog_replaces_env_models`,`env-model-table-gate.ts`);升级前这种目录静默顶替 env 表。本条保住升级前的读法:起服、本地配置第一次读之前
+ *    (`config-root-migration.ts`,两个入口同调),调契约的 `migrateEnvModelsDecision` —— 先读决定与目录,再独占创建运行记录 `config.migration.SS-M11.json`
+ *    (建成的进程是本根唯一的铸造者),决定缺席且目录管模型面才铸 `replaced`;运行记录在场之后决定缺席 ≡ `kept`。没有读数键(它不写库)。
+ *
+ *  · **M36 引擎 7.61.0 之前导入的、在每个项目根放行的全局 allow 退役**(7.143.0,引擎 7.61.0)—— 更早的导入门把用户层里从 `/` 写起的路径规则存成全局行:全局行在每个任务的
+ *    项目根读 `/x`,用户层在它自己的配置目录读,同一串字落店之后放行的是另一个地方。引擎不迁、不在读侧丢,只给一句判据(INTEGRATION-CORE §5.14):行是 allow ∧ add 的出处是
+ *    `imported-cc` ∧ scope 是 global ∧ `ruleBasesNeeded` 点名 `root` ⇒ 这只 add 退役;按 add、不按行(每只选中的行一只 observed-remove 墓碑,`removedDots` 恰是选中的 add,
+ *    人亲手同意过的 `user` add 留着);deny / ask 不退役。判据、读哪些桶、写在哪里与失败方向的唯一属主是 `imported-layer-root-retirement.ts`(头注逐条)—— 两腿同调一只函数:
+ *    SQL 在本段握锁的那一条连接上(`SqlDurableRulePartitionProvider` 收这条连接,墓碑经桶的写面 = 店内唯一写法 `writeBucket` 落),排在 M11 之后;local 在
+ *    `LocalBackend.runOneTimeMigrations` 里经引擎 File 分区的写面落(规则目录不在 ⇒ 没有行、零读,不为它建目录)。读的桶:SQL = 规则表里的每一只;File = 导入记录点名过的属主(引擎的 File 分区后端没有列桶口;缺口见那份头注)。
+ *    每次起服都跑(窗内;更早的引擎回滚上来会重新铸出这种 add),第二跑起零选零写。读数两键:退役了的行(一行一条 warn,不带规则正文)与没能读 / 写的桶(一桶一条 warn,
+ *    每次起服都报)。删码另有一个前提:不再支持回滚到引擎 7.61.0 之前(登记表 M36 的 removal)。
+ *
+ *  · **M37 存卡信封上委派出处的旧键(只有读侧)**(7.143.0,引擎 7.61.0)—— 引擎把审批请求的发起会话键 `sourceTaskId` 改名 `sourceSessionId`(值不变),本服务的卡随改、零别名;
+ *    本版之前铸的卡信封(`approval_ask.card_json` / local 问账)上那一格还是旧名,`.strict()` 的卡 schema 只认新名。存卡的唯一读者入口 `readStoredCardEnvelope`
+ *    在 M18 的读侧改写与 schema 之前把它改名(`approval-card.ts` 的 `renameRetiredSourceKey`,交浅拷贝、零写回,响亮计数)。不起服改写:存卡的寿命以分钟计、
+ *    升级前结清在途审批是部署前置(MIGRATION 本版第 17 条),读侧接住的是滚动升级窗里旧副本新写的与升级前已结仍被读的那几行。没有读数键。
  *
  * ## 收据账(一次起服一只,每一条迁移同一只)
  * 每一步把它**已提交**的改写 / 删除与点名读数当场记进同一只收据账({@link MigrationReceipts}):计数随每次提交累加、行随每次提交追加、形读数在那一步落定时写。走完 ⇒
@@ -357,9 +376,10 @@ import type { Pool as PgPool } from "pg";
 import { type AllowEntryInertReason, type GateKind } from "@sema-agent/core";
 import { type SqlDialect } from "./sql-driver.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
-import { type UndurableScopeRuleRow, type UnreadableRuleBucket } from "./permission-rule-store-sql.js";
+import { listRuleBucketOwners, type UndurableScopeRuleRow, type UnreadableRuleBucket } from "./permission-rule-store-sql.js";
 import type { SchemaProbeRead } from "./schema-live-columns.js";
 import type { ExecutionLane } from "../execution-lane-caps.js";
+import { type ImportedLayerRootAllowRetired, type ImportedLayerRootBucketSkipped, type ImportedLayerRootRetirementSource } from "./imported-layer-root-retirement.js";
 import { type LocalPlacementBackfillSeat, type UnusableArchiveWord } from "../execution-placement.js";
 /** 迁移读数(启动日志一行写全;测试按它断言,不靠日志文本)。 */
 export interface OneTimeMigrationReport {
@@ -462,6 +482,11 @@ export interface OneTimeMigrationReport {
     readonly askParkTriggersMoved: number;
     /** M34 local 腿:问账日志里信封号 1 的记录数(窗内读侧已按意义译读;本次一次压实把整本重写成 v2)。非零 = 真重写了日志。local 独有;SQL 恒 0。 */
     readonly askJournalRecordsUpgraded: number;
+    /** M36:本次退役了引擎 7.61.0 之前导入的全局 `/x` allow add 的行(一行一条:桶键 / 工具名 / 退役的 add 数 / 这一行是否还活着;不带规则正文),启动日志逐行 warn。
+     *  SQL 与 local 都有(同一只函数,见 `imported-layer-root-retirement.ts`)。非空 = 真写了墓碑;第二跑起恒空。 */
+    readonly importedLayerRootAllowsRetired: readonly ImportedLayerRootAllowRetired[];
+    /** M36:这次没能读 / 没能写的桶(闭集四词:读不出 / 写它的那一步里桶被并发删掉 / 没有写面或写面拒 / 并发争不过),一桶一条 warn;后两种那几行照旧放行,每次起服都点名直到处置。 */
+    readonly importedLayerRootBucketsSkipped: readonly ImportedLayerRootBucketSkipped[];
 }
 /** 退役的两只命令桶(引擎 7.51.0 起不是桶;只给 M17 点名认)。 */
 export type RetiredSessionRuleBucket = "commandAllow" | "commandDeny";
@@ -601,7 +626,7 @@ export declare function migrationWindowOpen(window: Pick<OneTimeMigrationWindow,
  */
 export declare function migrationWindowEnd(id: string): string;
 /** local 车道上 SQL 独有的几条(M8 / M9 / M11 / M17 / M18 / M21 / M23 / M24 / M26 / M27 / M29)的读数(M6 与 M32 的回填两车道都有、M33 只在 local,local 腿的读数由 `LocalBackend.runOneTimeMigrations` 现算):那几张表 / 列在文件底座上从来不存在 ⇒ 如实答 absent / 0。 */
-export declare const NO_SQL_MIGRATIONS: Omit<OneTimeMigrationReport, "holderDeathCodeRowsBackfilled" | "executionPlacementsBackfilled" | "askExecutionLanesBackfilled" | "executionPlacementSessionsUnreadable" | "localArchiveRowFactsBackfilled" | "localArchivesAnonymized" | "localArchivesKeptStamped" | "localArchivesUnreadable" | "localArchiveSnapshotsRecovered" | "askJournalRecordsUpgraded">;
+export declare const NO_SQL_MIGRATIONS: Omit<OneTimeMigrationReport, "holderDeathCodeRowsBackfilled" | "executionPlacementsBackfilled" | "askExecutionLanesBackfilled" | "executionPlacementSessionsUnreadable" | "localArchiveRowFactsBackfilled" | "localArchivesAnonymized" | "localArchivesKeptStamped" | "localArchivesUnreadable" | "localArchiveSnapshotsRecovered" | "askJournalRecordsUpgraded" | "importedLayerRootAllowsRetired" | "importedLayerRootBucketsSkipped">;
 /** 启动期的日志口(logger 的子集)。两级各有其用,见 {@link logOneTimeMigrations}。 */
 export interface MigrationLogSink {
     warn(msg: string, meta?: Record<string, unknown>): void;
@@ -634,6 +659,11 @@ export interface MigrationDb {
  * 本函数**不问**退役 schema:带着它的库在更早处就被 `ensureSchema()` 自身拒掉了(起服对账一族 `schema-consistency.ts` 的探针口,先于建表);走公开序列
  * `createStoreBackend()` → `ensureSchema()` → `runOneTimeMigrations()` 的嵌入方与本服务的起服序列一样,有这一问、零动作。
  */
+/**
+ * M36 的 SQL 腿交给退役步的那一只源(读哪些桶 = 规则表里的每一只 · 桶的 durable 分区后端 · 店的判官):起服序列(握锁的那一条连接)与真库钉同一只构造,
+ * 判官不在两处各写一份。
+ */
+export declare function createSqlImportedLayerRootSource(exec: Parameters<typeof listRuleBucketOwners>[0]): ImportedLayerRootRetirementSource;
 export declare function runSqlOneTimeMigrations(dialect: SqlDialect, pool: MysqlPool | PgPool, input: ExecutionPlacementSwitchInput): Promise<OneTimeMigrationReport>;
 /**
  * M34 —— 问账行成因两列(判据与形见头注 M34 段)。三步,每一步先读形再判,DDL 按后置条件收敛({@link execUntil}),中断 ⇒ 下一次起服从首个未满足的后置条件续:

package/dist/plugins/one-time-migrations.js

@@ -9,7 +9,7 @@ import { ensureIndexes } from "./ensure-index.js";
 import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readNonNullJsonValueColumn, readOpaqueJsonValueColumn, } from "./sql-json-column.js";
 import { incarnationFromCell, sessionFaceFromRow } from "../session-incarnation.js";
 import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR, StoreBootRefusalError } from "./store-contracts.js";
-import { PERMISSION_RULE_TABLE, purgeUndurableScopeRows } from "./permission-rule-store-sql.js";
+import { PERMISSION_RULE_TABLE, SqlDurableRulePartitionProvider, isSqlBucketRefusal, isSqlBucketVanished, listRuleBucketOwners, purgeUndurableScopeRows } from "./permission-rule-store-sql.js";
 import { SESSION_RULES_COLUMN } from "./session-rules-column.js";
 import { readJsonObjectColumn } from "./sql-json-column.js";
 import { retireStoredCardWords } from "../retired-card-words.js";
@@ -18,6 +18,7 @@ import { CLAIM_OWNERLESS_PLACED_SQL, claimOwnerlessParams, isOrphanSessionOwner,
 import { MAILBOX_KEYED_TABLES, mailboxKeyDeleteSql, storedMailboxKeyless } from "./mailbox-store-sql.js";
 import { SESSION_META_PLACEMENT_COLUMNS, backfillWriterStatement, countOrphanBindingsStatement, migrateDeviceBindingsStatement } from "./execution-placement-sql.js";
 import { APPROVAL_ASK_ENDING_CAUSE_COLUMN, APPROVAL_ASK_EXECUTION_LANE_COLUMN, APPROVAL_ASK_PARK_TRIGGER_COLUMN, APPROVAL_ASK_TABLE } from "./approval-ask-store-sql.js";
+import { retireImportedLayerRootAllows } from "./imported-layer-root-retirement.js";
 import { isUnusableArchive } from "../execution-placement.js";
 const RETIRED_SESSION_RULE_BUCKETS = ["commandAllow", "commandDeny"];
 export function buildMigrationReceipts() {
@@ -63,6 +64,8 @@ export function buildMigrationReceipts() {
         askCauseColumnsChanged: 0,
         askParkTriggersMoved: 0,
         askJournalRecordsUpgraded: 0,
+        importedLayerRootAllowsRetired: [],
+        importedLayerRootBucketsSkipped: [],
     };
 }
 function completedReport(r) {
@@ -116,7 +119,9 @@ function changedAnything(r) {
         r.localArchiveSnapshotsRecovered > 0 ||
         r.askCauseColumnsChanged > 0 ||
         r.askParkTriggersMoved > 0 ||
-        r.askJournalRecordsUpgraded > 0);
+        r.askJournalRecordsUpgraded > 0 ||
+        r.importedLayerRootAllowsRetired.length > 0 ||
+        r.importedLayerRootBucketsSkipped.length > 0);
 }
 function readingsSnapshot(r) {
     return {
@@ -131,6 +136,8 @@ function readingsSnapshot(r) {
         executionPlacementSessionsUnreadable: [...r.executionPlacementSessionsUnreadable],
         localArchivesKeptStamped: [...r.localArchivesKeptStamped],
         localArchivesUnreadable: [...r.localArchivesUnreadable],
+        importedLayerRootAllowsRetired: [...r.importedLayerRootAllowsRetired],
+        importedLayerRootBucketsSkipped: [...r.importedLayerRootBucketsSkipped],
     };
 }
 function receiptSentence(r) {
@@ -141,6 +148,7 @@ function receiptSentence(r) {
         ...r.undurableScopeRuleRows.map((x) => `removed ${x.kind} in permission-rule bucket ${x.ownerKey} (${x.behavior} ${x.tool}, scope root ${JSON.stringify(x.scopeRoot)})`),
         ...r.sessionRuleRowsWithOldGrammarEntries.map((x) => `${x.policyKey} (session ${x.sessionId}): toolAllowDropped=${JSON.stringify(x.toolAllowDropped)}`),
         ...r.sessionRuleRowsWithUnreadableDeny.map((x) => `${x.policyKey} (session ${x.sessionId}): left as stored, toolDenyUnreadable=${JSON.stringify(x.toolDenyUnreadable)}${x.retiredBuckets !== undefined ? `, retiredBuckets=${JSON.stringify(x.retiredBuckets)}` : ""}`),
+        ...r.importedLayerRootAllowsRetired.map((x) => `retired ${x.addsRetired} imported add(s) of an allow ${x.tool} rule in permission-rule bucket ${x.ownerKey} (${x.stillLive ? "the rule stays in effect through another approval" : "the rule no longer takes effect"})`),
     ];
     return [counts.join(", "), ...rows].filter((part) => part !== "").join("; ");
 }
@@ -583,6 +591,47 @@ export const ONE_TIME_MIGRATIONS = [
             "② local —— 信封号 1 的日志记录走 File 问账店「认不出的信封号」拒启(`unknown envelope version`,点名文件与出路:用写下它的那一版起服一次,或移开文件)",
         reportKeys: ["askCauseColumnsChanged", "askParkTriggersMoved", "askJournalRecordsUpgraded"],
     },
+    {
+        id: "M35",
+        introducedIn: "7.143.0",
+        releasedOn: "2026-10-31",
+        removableAfter: "2026-11-30",
+        removal: "删 `config-root-migration.ts` 整只文件与两个入口的调用(`boot/stage-02-web-admin-pull.ts` 目录信任判官之后、`run-local.ts` 同一位置各两行 + import);" +
+            "`test/env-model-table-gate.test.ts` 里标题以 `迁移` 起头的那一组;部署文档里「起服自动铸 config.env-models.json」那一句。" +
+            "**不随本条删**:模型面闸 `env-model-table-gate.ts`、`LocalConfigProvider` 读决定(etag 覆盖)、目录信任判官的根级文档名单(常设)",
+        afterRemoval: "常设的模型面闸接住:跳过了带本条的版本直接升的本地根(或运行记录在场而决定缺席的根),决定缺席读作 kept ⇒ env 模型表已声明时管模型面的本地目录被组拒 " +
+            "`config.catalog_replaces_env_models`,拒句点名被顶替的 env 模型与两条出路(在配置根写 `config.env-models.json` = `{\"envModels\":\"replaced\"}`,或撤掉 MODEL_ID / MODEL_CHEAP_ID)",
+        reportKeys: [],
+    },
+    {
+        id: "M36",
+        introducedIn: "7.143.0",
+        releasedOn: "2026-10-31",
+        removableAfter: "2026-11-30",
+        removal: "**删码前提**:本服务已不支持回滚到引擎 7.61.0 之前的版本(更早的引擎的导入门会重新铸出这种 add,本条要在每次起服把它们收掉)—— 窗关时仍支持这种回滚 ⇒ 本行两格顺延(改日期,并在本注里写明为什么),不删。" +
+            "删什么:`src/plugins/imported-layer-root-retirement.ts` 整个文件;migrateStepsOn 的 M36 步(规则表与 `grammar` 列的在场探针 + 对 `retireImportedLayerRootAllows` 的调用)与握锁连接上的 `query` 口" +
+            "(`LockedMigrationDb` 与 `mysqlDb` / `pgDb` 里的那一员,若届时再无别的步骤用它);`permission-rule-store-sql.ts` 的 `listRuleBucketOwners` / `isSqlBucketRefusal` / `isSqlBucketVanished` / `RuleBucketVanishedError`(取点那一句的具名类,届时若再无别的读者按类判它,收回成裸错)/ `IMPORT_RECORD_KIND`;" +
+            "`permission-rule-store-file.ts` 的 `FileRuleApprovalRecordStore.importRecordOwners`;`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里 M36 那一腿(规则目录在场判与那一处调用)与报告两键的那两行;" +
+            "本文件的 `createSqlImportedLayerRootSource` 与 `importedLayerRootAllowsRetired` / `importedLayerRootBucketsSkipped`(报告 / 收据 / `changedAnything` / `readingsSnapshot` / `readingFields` / `receiptSentence` / `NO_SQL_MIGRATIONS` 的排除表)、" +
+            "`imported_layer_root_allow_retired` / `imported_layer_root_bucket_skipped` 两行 warn 与 `importedLayerRootSkipNote`、读数行 note 里的 M36 句与头注 M36 段;" +
+            "`test/imported-layer-root-retirement.test.ts`、`test/imported-layer-root-retirement-db-integration.test.ts`(连同 `scripts/db-integration-files.json` 里它那一行)与 `test/helpers/imported-layer-root-fixture.ts` 整文件。" +
+            "**不随本条删**:`SqlDurableRulePartitionProvider` 收「方言 + 执行口」的那一形(`BucketSql`;常设,池照旧满足它)",
+        afterRemoval: "没有响亮臂(如实):删码之后,跳过了带本条的版本直接升的库(或回滚到引擎 7.61.0 之前、在其上又导入过的库),存量的这种全局 `/x` allow 照旧在每个项目根放行,本服务不再点名 —— " +
+            "出路 = 升级时先过一次带本条的版本并起服;或运维列出桶里出处为导入(`adds[].origin` = `imported-cc`)、scope 为全局、从 `/` 写起的 allow(`GET /v1/rules`)并撤掉(`DELETE /v1/rules`,撤的是这条规则的全部批准)",
+        reportKeys: ["importedLayerRootAllowsRetired", "importedLayerRootBucketsSkipped"],
+    },
+    {
+        id: "M37",
+        introducedIn: "7.143.0",
+        releasedOn: "2026-10-31",
+        removableAfter: "2026-11-30",
+        removal: "删 `approval-card.ts` 的 `renameRetiredSourceKey` 与 `readStoredCardEnvelope` 里调它的那一步(回到直接把传入的那一只交 M18 改写)、" +
+            "fail-open tag `server.approval-card.retired-card-key-read`(`observability/fail-open.ts` 与 `docs/FAIL-OPEN-CENSUS.md` 那一行)、" +
+            "`test/approval-card-source-key-m37.test.ts` 整只文件、本文件头注 M37 段",
+        afterRemoval: "既有坏行臂接住(响亮,不再改名):仍带旧键的存卡(跳过了带本条的版本直接升的库、窗关之后还在写的 7.142.x 副本)整卡读不出 —— 断连重放跳过 + 一次 warn、" +
+            "幂等重入走 park、回决口按要人",
+        reportKeys: [],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;
@@ -633,6 +682,10 @@ export const NO_SQL_MIGRATIONS = {
 };
 function mysqlDb(conn) {
     return {
+        async query(sql, params) {
+            const [r] = await conn.query(sql, params === undefined ? [] : [...params]);
+            return Array.isArray(r) ? { rows: r, affected: 0 } : { rows: [], affected: Number(r.affectedRows ?? 0) };
+        },
         async rows(sql, params) {
             const [rows] = params === undefined ? await conn.query(sql) : await conn.query(sql, [...params]);
             return rows;
@@ -645,6 +698,10 @@ function mysqlDb(conn) {
 }
 function pgDb(client) {
     return {
+        async query(sql, params) {
+            const r = await client.query(sql, params === undefined ? [] : [...params]);
+            return { rows: r.rows, affected: r.rowCount ?? 0 };
+        },
         async rows(sql, params) {
             const r = params === undefined ? await client.query(sql) : await client.query(sql, [...params]);
             return r.rows;
@@ -675,6 +732,9 @@ async function columnExists(db, dialect, table, column) {
     const sql = `SELECT 1 AS present FROM information_schema.columns WHERE table_schema = ${scope} AND table_name = '${table}' AND column_name = '${column}'`;
     return (await db.rows(sql)).length > 0;
 }
+export function createSqlImportedLayerRootSource(exec) {
+    return { candidateOwners: () => listRuleBucketOwners(exec), durable: new SqlDurableRulePartitionProvider(exec), isWholeBucketRefusal: isSqlBucketRefusal, isVanishedBucket: isSqlBucketVanished };
+}
 export async function runSqlOneTimeMigrations(dialect, pool, input) {
     return dialect === "mysql" ? withMysqlLock(pool, (db) => migrateOn(db, "mysql", input)) : withPgLock(pool, (db) => migrateOn(db, "pg", input));
 }
@@ -734,6 +794,9 @@ async function migrateStepsOn(db, dialect, receipts, input) {
         await inheritPlacedSessionOwners(db, dialect, receipts);
     if ((await tableExists(db, dialect, PERMISSION_RULE_TABLE)) && (await columnExists(db, dialect, PERMISSION_RULE_TABLE, "grammar")))
         await purgeUndurableScopeRows(db, dialect, receipts);
+    if ((await tableExists(db, dialect, PERMISSION_RULE_TABLE)) && (await columnExists(db, dialect, PERMISSION_RULE_TABLE, "grammar"))) {
+        await retireImportedLayerRootAllows(createSqlImportedLayerRootSource({ dialect, query: (sql, params) => db.query(sql, params) }), receipts);
+    }
     await moveWorkflowJournalScope(db, dialect, receipts);
     if (await tableExists(db, dialect, RETIRED_BREAKER_TABLE))
         await dropRetiredBreakerTable(db, dialect, receipts);
@@ -1687,6 +1750,8 @@ function readingFields(r) {
         askCauseColumnsChanged: r.askCauseColumnsChanged,
         askParkTriggersMoved: r.askParkTriggersMoved,
         askJournalRecordsUpgraded: r.askJournalRecordsUpgraded,
+        importedLayerRootAllowsRetired: r.importedLayerRootAllowsRetired.length,
+        importedLayerRootBucketsSkipped: r.importedLayerRootBucketsSkipped.length,
     };
 }
 export function logOneTimeMigrations(log, backend, report) {
@@ -1744,7 +1809,11 @@ export function logOneTimeMigrations(log, backend, report) {
             "M34: the approval ask table's single cause column denied_reason — the reason a row was moved to the delivery surface while it is PARKING or PARKED, " +
             "the reason it ended without a human answer while it is VOID or DENIED, overwritten by the second when a parked row was closed — renamed ending_cause, " +
             "a column park_trigger added, and the word on PARKING and PARKED rows moved into park_trigger; on the local backend the approval ask journal is rewritten " +
-            "once with record envelope 2, its envelope-1 records read with the same meaning). Each step " +
+            "once with record envelope 2, its envelope-1 records read with the same meaning; " +
+            "M36: allow approvals that an import before engine 7.61.0 stored as global rules from a settings file's user-layer path written from `/` — which the user layer reads at its " +
+            "configuration directory and a global rule reads at every task's project root — retired by tombstones naming exactly those approvals (a rule that also holds an approval a person " +
+            "gave directly stays in effect; deny and ask rules are never retired), one imported_layer_root_allow_retired line per rule; a bucket that could not be read or written, or that another replica deleted while it was being written, is named by an " +
+            "imported_layer_root_bucket_skipped line on every boot). Each step " +
             "runs on every boot until its window closes (the release that introduced it + 30 days; the per-step date is in " +
             "removableAfter, null while that release is not published yet) and is deleted in the first minor after that — start a " +
             "version that still carries a step at least once before upgrading past its deletion.",
@@ -1847,6 +1916,23 @@ function logReceiptRows(log, backend, r) {
             note: removedRuleRowNote(row.kind),
         });
     }
+    for (const row of r.importedLayerRootAllowsRetired) {
+        log.warn("imported_layer_root_allow_retired", {
+            backend,
+            ownerKey: row.ownerKey,
+            tool: row.tool,
+            addsRetired: row.addsRetired,
+            stillLive: row.stillLive,
+            note: "an allow rule imported from a settings file's user layer by an import before engine 7.61.0 was written from `/` — the user layer reads such a path at its own configuration " +
+                "directory — and was stored as a global rule, which reads it at every task's project root: it let that path be acted on in every project without a question. A one-time migration " +
+                "retired the imported approval of it (a tombstone naming exactly that approval). stillLive false = the rule no longer takes effect and an action it covered asks again; stillLive true = " +
+                "the rule stays in effect through another approval of it (one a person gave directly). To carry the rule again, spell its directory out (`//<directory>/…`, or `~/<path>` under the home) " +
+                "and approve it again. This line is written once, by the boot that retired it — keep it; the rule text is not on it (list the bucket's rules to see what remains)",
+        });
+    }
+    for (const bucket of r.importedLayerRootBucketsSkipped) {
+        log.warn("imported_layer_root_bucket_skipped", { backend, ownerKey: bucket.ownerKey, reason: bucket.reason, why: bucket.why, note: importedLayerRootSkipNote(bucket.reason) });
+    }
     for (const bucket of r.undurableScopeRuleBucketsUnreadable) {
         log.warn("permission_rule_bucket_unreadable", {
             backend,
@@ -1925,6 +2011,23 @@ export async function runAndLogOneTimeMigrations(log, backend) {
     }
     logOneTimeMigrations(log, backend.kind, report);
 }
+function importedLayerRootSkipNote(reason) {
+    const head = "the one-time retirement of allow approvals that an import before engine 7.61.0 stored as global rules from a user-layer path written from `/` (read at every project root) did not finish in this permission-rule bucket: ";
+    switch (reason) {
+        case "bucket_unreadable":
+            return `${head}the bucket could not be read. The read path refuses such a bucket in whole as well, so none of its rules takes effect; once it is repaired, the next boot retires what it selects. Named on every boot until then`;
+        case "vanished":
+            return `${head}the bucket was deleted (by another replica) while this step was writing to it. Nothing is left to retire and none of its rules takes effect; not a boot refusal`;
+        case "not_writable":
+            return `${head}it holds approvals the retirement selects, but no tombstone could be written (the bucket is served read-only — a rule-store adoption in progress — or the store refused the tombstone), so those allow rules keep taking effect at every project root. Finish the adoption or repair the store and restart; named on every boot until then`;
+        case "contended":
+            return `${head}every write lost to a concurrent writer. Those allow rules keep taking effect until a later boot retires them; named on every boot until then`;
+        default: {
+            const unknown = reason;
+            throw new Error(`M36: no log sentence for skip reason ${JSON.stringify(unknown)}`);
+        }
+    }
+}
 function removedRuleRowNote(kind) {
     switch (kind) {
         case "rule":

package/dist/plugins/org-delivery-quota-store.d.ts

@@ -101,7 +101,7 @@ export declare class SqlOrgDeliveryQuotaStore implements OrgDeliveryQuotaStore {
     take(fromScope: string, toScope: string, policy: OrgDeliveryQuotaPolicy): Promise<boolean>;
     /**
      * 一个记账事务:库钟先读(池上一条值语句,不在事务里留普通 SELECT),判过 ⇒ 提交,判拒 ⇒ 回滚(零残留)。
-     * 🔴 **引擎判了死锁 ⇒ 整事务重来**(有界,`isDeadlockError` 是全仓唯一的可重试锁故障判据):被挑中的一方已整事务回滚、锁全放,
+     * 🔴 **引擎判了死锁 ⇒ 整事务重来**(`retryOnDeadlock`:全仓唯一的重来写法、唯一的上界与判据):被挑中的一方已整事务回滚、锁全放,
      * 重来时读-判-写全部重做,语义等价。真 InnoDB(REPEATABLE READ)上这条路是真的:窗前进时按收件人前缀删旧对偶行要取范围 / 间隙锁,
      * 两位相邻收件人同时翻窗、各自往两人之间的间隙里插新对偶行 ⇒ 互等(TiDB 无间隙锁、PG 读已提交不取间隙锁)。谁当牺牲者是引擎的任意选择,
      * 抛给调用方等于把一次内部仲裁当成投递失败。锁等待超时**不**重来(延迟信号,照抛)。