@sema-agent/server 7.142.0 → 7.144.0

package/dist/plugins/mailbox-recipient-lifecycle.d.ts

@@ -1,11 +1,8 @@
 /**
- * 信箱**收件人生命周期面**([ref])—— core `MailboxStore` 契约里被点名、但机制**刻意不由 core 命名**的
- * 那一半:「这个收件人正在被部署删掉」。
- *
- * core 的原话(`core/store-contracts/mailbox-store-contract.ts` 的 `MailboxTombstonedRecipientContractHooks`
- * 逐字):「Put `(scope, handle)` into the deployment's PRE-DELETE state — whatever that is for this backend
- * (a cascade marking the session row, a `deleting` column, a tombstone table). Core does not name the
- * mechanism, only what `append` must then do.」 ⇒ 本文件就是 server 侧那个 "whatever"。
+ * 信箱**收件人生命周期面**([ref])—— 「这个收件人正在被部署删掉」。core 7.61.0 起它是 `MailboxStore` 契约里的一对可选成员
+ * (`retireRecipient` / `listRetiredRecipients`,一个能力:两个都在或都不在),经 core 的唯一判官 `mailboxRecipientLifecycleOf` 读
+ * (缺一半 ⇒ 判官拒)。本仓不另立型:{@link MailboxRecipientLifecycle} 就是那只判官答的形,{@link recipientLifecycleOf} 是本仓唯一的读法 ——
+ * 店带那一对 ⇒ 判官的答;不带 ⇒ {@link createDropOnlyRecipientLifecycle}(见文末「缺席形」)。
  *
  * ## 两个动词,各答一个问题
  *
@@ -50,30 +47,11 @@
  * 后端选择点(`boot/stores.ts` 的 `mailbox_store_enabled` 行)逐次落 `recipientTombstones` 读数,
  * 披露在 `docs/DEPLOY-PREREQS.md`。方向上它也不放宽任何东西 —— 两种形都**不收**给已删会话的信。
  */
-import type { MailboxStore } from "@sema-agent/core";
-/** 一条墓碑(= 一个已退役的收件人)。 */
-export interface MailboxRecipientTombstone {
-    /** 盒句柄(会话盒 = `session.<小写 id>`)。 */
-    readonly handle: string;
-    /** 退役时刻(epoch ms)——目录据此铸 `diedAt`。 */
-    readonly retiredAt: number;
-    /** 退役前的显示名(会话的删前 `title`);缺席 = 当时没有可用的名字。 */
-    readonly label?: string;
-}
-export interface MailboxRecipientLifecycle {
-    /**
-     * 把 `(scope, handle)` 置入**预删除态**:此后 `append` 一律以 `MAILBOX_TOMBSTONED_RECIPIENT_CODE` 拒。
-     * **只打标**——不删消息、不动租约、不碰盒行的高水位(理由 = core T2 试剂盒的两格副作用判据,见模块头)。
-     * 幂等(重复 retire 只更新时刻/名字)。
-     *
-     * @returns 是否真的落了一张耐久墓碑。`false` 有两种,都是「没落」:① 本后端没有预删除态,箱已被直接 `drop`
-     *          (拒的方向不变,退化的只有拒绝措辞与「正在删除中」那一行的可见性);② 这只键收件箱的键判官不收(SQL 两孪生:没有箱可打标,
-     *          这只键的 `append` 本来就以判官那一句拒,不带墓碑码)。
-     */
-    retireRecipient(scope: string, handle: string, at: number, label?: string): Promise<boolean>;
-    /** 本 scope 下句柄以 `handlePrefix` 开头的墓碑。无预删除态的后端恒返回空。 */
-    listRetiredRecipients(scope: string, handlePrefix: string): Promise<readonly MailboxRecipientTombstone[]>;
-}
+import { mailboxRecipientLifecycleOf, type MailboxStore } from "@sema-agent/core";
+/** 收件人生命周期面 = core 判官 `mailboxRecipientLifecycleOf` 答的那一对(本仓零份第二型;墓碑行型直接用 core 的 `MailboxRecipientTombstone`)。 */
+export type MailboxRecipientLifecycle = NonNullable<ReturnType<typeof mailboxRecipientLifecycleOf>>;
+/** 一只店的收件人生命周期面 —— 本仓唯一的读法:店带那一对 ⇒ core 判官的答(缺一半判官就拒,`config.invalid_argument`);不带 ⇒ drop-only 形。 */
+export declare function recipientLifecycleOf(store: MailboxStore): MailboxRecipientLifecycle;
 /**
  * 看不见收件人生命周期的后端的诚实形:retire = 直接把箱 `drop` 掉(**不**打标,因为没有可打标的地方),
  * 墓碑清单恒空。

package/dist/plugins/mailbox-recipient-lifecycle.js

@@ -1,3 +1,7 @@
+import { mailboxRecipientLifecycleOf } from "@sema-agent/core";
+export function recipientLifecycleOf(store) {
+    return mailboxRecipientLifecycleOf(store) ?? createDropOnlyRecipientLifecycle(store);
+}
 export function createDropOnlyRecipientLifecycle(store) {
     return {
         retireRecipient: async (scope, handle) => {

package/dist/plugins/mailbox-store-sql.d.ts

@@ -1,8 +1,7 @@
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import type { MailboxAckResult, MailboxAppendMessage, MailboxDecision, MailboxDecisionOutcome, MailboxLease, MailboxStore } from "@sema-agent/core";
+import type { MailboxAckResult, MailboxAppendMessage, MailboxDecision, MailboxDecisionOutcome, MailboxLease, MailboxRecipientTombstone, MailboxStore } from "@sema-agent/core";
 import { type IndexSpec } from "./ensure-index.js";
-import type { MailboxRecipientLifecycle, MailboxRecipientTombstone } from "./mailbox-recipient-lifecycle.js";
 import type { SqlDialect } from "./sql-driver.js";
 export declare const MAILBOX_TABLE = "mailbox";
 export declare const MAILBOX_MSG_TABLE = "mailbox_message";
@@ -12,6 +11,11 @@ export declare const MAILBOX_MSG_TABLE = "mailbox_message";
  *  —— `mailbox` 行是**盒**事实(next_seq / lease),墓碑是**收件人**事实,两者的生命周期本来就不同
  *  (`drop` 同时终结两者 —— 墓碑随箱亡,理由全文见 `mailbox-recipient-lifecycle.ts` 模块头)。 */
 export declare const MAILBOX_TOMBSTONE_TABLE = "mailbox_tombstone";
+/** 盒的**已收窗**(core 7.61.0):`ack` 删掉的带身份记录各留一行 `{ record_id, seq, digests }`,每盒恰留按 `seq` 最新的 `MAILBOX_CONSUMED_ID_WINDOW` 行;
+ *  `append` 在盒行锁之内连同持有行一起交引擎的 `judgeMailboxAppendById` 判(同记录 ⇒ 答它当时的 `seq`、零写;不同 ⇒ `mailbox.duplicate_record_id`)。
+ *  是**盒**事实(与 `next_seq` 同生命周期):`drop` 随盒删、`reap` 留着(它清掉的东西从没被收过)。新表而不是 `mailbox` 加列,理由同墓碑表(存量库零运维动作)。
+ *  `digests` = 引擎 `mailboxReplayDigests` 的四面摘要 JSON(只读那一只函数,不另算)。 */
+export declare const MAILBOX_CONSUMED_TABLE = "mailbox_consumed";
 /**
  * 身份键(`scope` / `handle` / lease `owner`)的 UTF-8 字节上界 = 键列宽(TiDB `VARBINARY(190)`;PG 列按字符,本判官在两方言上都按字节拒)。
  */
@@ -35,10 +39,10 @@ export type MailboxKeyColumn = "scope" | "handle" | "owner";
 /** 库里读回的一对键列判官拒不拒(与入口同一只判官;字节先无损读成串,读不成 = 不良构)。`reap` 的候选句柄与一次性迁移 M27 都按它判。 */
 export declare function storedMailboxKeyless(scopeKey: unknown, handle: unknown): boolean;
 /**
- * 收件箱表族:三张表的键都是 `(scope_key, handle)`。次序 = 锁序(盒行 → 消息行 → 墓碑行;盒行先删的理由见 `drop`)。
+ * 收件箱表族:四张表的键都是 `(scope_key, handle)`。次序 = 锁序(盒行 → 消息行 → 已收窗行 → 墓碑行;盒行先删的理由见 `drop`)。
  * 「丢掉一只箱」= 按这个次序逐表按键删 —— `drop` 与一次性迁移 M27 是同一组语句({@link mailboxKeyDeleteSql})。
  */
-export declare const MAILBOX_KEYED_TABLES: readonly ["mailbox", "mailbox_message", "mailbox_tombstone"];
+export declare const MAILBOX_KEYED_TABLES: readonly ["mailbox", "mailbox_message", "mailbox_consumed", "mailbox_tombstone"];
 export type MailboxKeyedTable = (typeof MAILBOX_KEYED_TABLES)[number];
 /** 按键删收件箱表族的一张表(两方言;参数 = [scope_key, handle])。 */
 export declare function mailboxKeyDeleteSql(dialect: SqlDialect, table: MailboxKeyedTable): string;
@@ -55,7 +59,7 @@ export declare function ensureTiDBMailboxSchema(pool: MySqlPool): Promise<void>;
 /** [ref]:本 store 的索引**声明**(两方言共用一份)。PG 侧由下面的 `ensurePgMailboxSchema` 应用,MySQL 侧由 `tidb-pool.ts` 的中央 `ensureSchema` 应用(那里内联 `KEY` 已在 `CREATE TABLE` 里 ⇒ 新建库探到即零 DDL,存量库缺谁补谁)。加索引以外的 schema 变更仍归运维,见 `plugins/ensure-index.ts` 头注。 */
 export declare const MAILBOX_INDEXES: readonly IndexSpec[];
 export declare function ensurePgMailboxSchema(q: (text: string, params?: unknown[]) => Promise<unknown>): Promise<void>;
-export declare class TiDBMailboxStore implements MailboxStore, MailboxRecipientLifecycle {
+export declare class TiDBMailboxStore implements MailboxStore {
     private readonly pool;
     private readonly logger?;
     /** [ref]([ref] §1.2⑥):跨进程安全**显式**声明 —— core 的 `mailboxCrossProcessMountVerdict` 只对字面 `true` 放行
@@ -82,15 +86,15 @@ export declare class TiDBMailboxStore implements MailboxStore, MailboxRecipientL
     reap(scope: string, now: number, opts?: {
         maxAgeMs?: number;
     }): Promise<number>;
-    /** 见 {@link MailboxRecipientLifecycle.retireRecipient}。**只打标**:不删消息、不动租约、不碰 next_seq。
+    /** 见 core `MailboxStore.retireRecipient`。**只打标**:不删消息、不动租约、不碰 next_seq。
      *  锁序 = 盒行先(与 append / claim / ack / drop / reap 五面统一 —— ABBA 死锁形不许在这里重开),
      *  于是 retire 与并发 append 在同一把行锁上串行:要么 append 先拿到 seq、要么它读到墓碑被拒,没有中间态。 */
     retireRecipient(scope: string, handle: string, at: number, label?: string): Promise<boolean>;
-    /** 见 {@link MailboxRecipientLifecycle.listRetiredRecipients}。前缀查带 `ESCAPE`(句柄是开集串,
+    /** 见 core `MailboxStore.listRetiredRecipients`。前缀查带 `ESCAPE`(句柄是开集串,
      *  `_`/`%` 若被当通配会把**别的**收件人一起列出来 —— 与本仓 `?q=` 面同一条 escapeLike 纪律)。 */
     listRetiredRecipients(scope: string, handlePrefix: string): Promise<readonly MailboxRecipientTombstone[]>;
 }
-export declare class PgMailboxStore implements MailboxStore, MailboxRecipientLifecycle {
+export declare class PgMailboxStore implements MailboxStore {
     private readonly pool;
     private readonly logger?;
     /** [ref] 跨进程安全显式声明(TiDB 孪生同注:事务 + 盒行 FOR UPDATE 锁序是真值前提;终验 = test/mailbox-cross-process-kit.test.ts pg 腿)。 */

package/dist/plugins/mailbox-store-sql.js

@@ -1,13 +1,14 @@
 import { isUtf8 } from "node:buffer";
-import { MAILBOX_INVALID_PEER_META_CODE, MAILBOX_RECORD_ID_MAX_CHARS, MAILBOX_TOMBSTONED_RECIPIENT_CODE, MailboxStoreError, assertMailboxDecisionMove, judgeMailboxAppendById, readMailboxAppend, readMailboxPeerMeta, readStoredMailboxDecision } from "@sema-agent/core";
+import { MAILBOX_CONSUMED_ID_WINDOW, MAILBOX_INVALID_PEER_META_CODE, MAILBOX_RECORD_ID_MAX_CHARS, MAILBOX_REPLAY_FACETS, MAILBOX_TOMBSTONED_RECIPIENT_CODE, MailboxStoreError, assertMailboxDecisionMove, judgeMailboxAppendById, mailboxReplayDigests, readMailboxAppend, readMailboxPeerMeta, readStoredMailboxDecision } from "@sema-agent/core";
 import { pgHasUnstorable, pgSanitizeText, PgUnstorableError } from "./pg-safe-json.js";
 import { isWellFormedUnicode } from "../principal-jwt.js";
 import { ensureIndexes } from "./ensure-index.js";
 import { escapeLike } from "./sql-escape.js";
-import { decodeNullableJsonColumn, foldJsonColumn, isJsonColumnBodyProblem, jsonColumnText, readStringArrayColumn } from "./sql-json-column.js";
+import { SqlJsonColumnError, decodeJsonColumn, decodeNullableJsonColumn, foldJsonColumn, isJsonColumnBodyProblem, jsonColumnText, readStringArrayColumn } from "./sql-json-column.js";
 export const MAILBOX_TABLE = "mailbox";
 export const MAILBOX_MSG_TABLE = "mailbox_message";
 export const MAILBOX_TOMBSTONE_TABLE = "mailbox_tombstone";
+export const MAILBOX_CONSUMED_TABLE = "mailbox_consumed";
 const TOMBSTONE_LABEL_MAX_CHARS = 120;
 function boundedLabel(label) {
     if (label === undefined || label === "")
@@ -49,8 +50,54 @@ function appendSnapshot(msg) {
     }
     return rec;
 }
-function replayedSeq(held, scope, handle, logger, asStored) {
-    return judgeMailboxAppendById(rowsToMessages(held, scope, handle, logger), asStored);
+function replayedSeq(held, consumed, scope, handle, logger, asStored) {
+    return judgeMailboxAppendById({ held: rowsToMessages(held, scope, handle, logger), consumed: consumedRecordsOf(consumed, scope, handle, logger) }, asStored);
+}
+function consumedRecordsOf(rows, scope, handle, logger) {
+    return rows.map((r) => {
+        const seq = Number(r.seq);
+        let digests;
+        try {
+            digests = decodeJsonColumn(bufToStr(r.digests), readConsumedDigestsShape, `${MAILBOX_CONSUMED_TABLE}.digests for seq ${seq}`);
+        }
+        catch (e) {
+            if (!(e instanceof SqlJsonColumnError))
+                throw e;
+            logger?.warn("mailbox_message_column_corrupt", {
+                scope,
+                handle,
+                seq,
+                column: "consumed_digests",
+                note: "appends under this record id are refused for the box (fail-closed); repair or delete this row of the received window",
+            });
+            throw new Error(`MailboxStore: received-window row seq ${seq} has unreadable digests (refusing — the replay judgment cannot be made)`);
+        }
+        return { id: String(r.record_id), seq, digests };
+    });
+}
+const readConsumedDigestsShape = (body) => {
+    if (typeof body !== "object" || body === null || Array.isArray(body))
+        return { problem: "the digests are not an object" };
+    const facets = body;
+    if (Object.keys(facets).length !== MAILBOX_REPLAY_FACETS.length || !MAILBOX_REPLAY_FACETS.every((f) => typeof facets[f] === "string")) {
+        return { problem: `the digests are not exactly the ${MAILBOX_REPLAY_FACETS.length} replay facets as strings` };
+    }
+    return { value: Object.freeze(Object.fromEntries(MAILBOX_REPLAY_FACETS.map((f) => [f, facets[f]]))) };
+};
+async function enterConsumedWindow(run, removed, scope, handle) {
+    const entered = removed.filter((m) => m.id !== undefined);
+    if (entered.length === 0)
+        return;
+    for (const m of entered) {
+        await run({ mysql: `INSERT INTO ${MAILBOX_CONSUMED_TABLE} (scope_key, handle, seq, record_id, digests) VALUES (?, ?, ?, ?, ?)`, pg: `INSERT INTO ${MAILBOX_CONSUMED_TABLE} (scope_key, handle, seq, record_id, digests) VALUES ($1, $2, $3, $4, $5)` }, [scope, handle, m.seq, m.id, JSON.stringify(mailboxReplayDigests(m))]);
+    }
+    const edge = await run({
+        mysql: `SELECT seq FROM ${MAILBOX_CONSUMED_TABLE} WHERE scope_key = ? AND handle = ? ORDER BY seq DESC LIMIT 1 OFFSET ?`,
+        pg: `SELECT seq FROM ${MAILBOX_CONSUMED_TABLE} WHERE scope_key = $1 AND handle = $2 ORDER BY seq DESC LIMIT 1 OFFSET $3`,
+    }, [scope, handle, MAILBOX_CONSUMED_ID_WINDOW - 1]);
+    if (edge.length === 0)
+        return;
+    await run({ mysql: `DELETE FROM ${MAILBOX_CONSUMED_TABLE} WHERE scope_key = ? AND handle = ? AND seq < ?`, pg: `DELETE FROM ${MAILBOX_CONSUMED_TABLE} WHERE scope_key = $1 AND handle = $2 AND seq < $3` }, [scope, handle, Number(edge[0].seq)]);
 }
 function asUtf8Stored(v) {
     return Buffer.from(v, "utf8").toString("utf8");
@@ -71,7 +118,7 @@ export function storedMailboxKeyless(scopeKey, handle) {
     const h = storedKeyText(handle);
     return scope === undefined || h === undefined || keyless(scope, h);
 }
-export const MAILBOX_KEYED_TABLES = [MAILBOX_TABLE, MAILBOX_MSG_TABLE, MAILBOX_TOMBSTONE_TABLE];
+export const MAILBOX_KEYED_TABLES = [MAILBOX_TABLE, MAILBOX_MSG_TABLE, MAILBOX_CONSUMED_TABLE, MAILBOX_TOMBSTONE_TABLE];
 export function mailboxKeyDeleteSql(dialect, table) {
     return dialect === "mysql" ? `DELETE FROM ${table} WHERE scope_key = ? AND handle = ?` : `DELETE FROM ${table} WHERE scope_key = $1 AND handle = $2`;
 }
@@ -210,6 +257,14 @@ export async function ensureTiDBMailboxSchema(pool) {
     record_id VARCHAR(${MAILBOX_RECORD_ID_MAX_CHARS}) NULL,
     PRIMARY KEY (scope_key, handle, seq),
     KEY idx_mbm_sent (scope_key, handle, sent_at_ms)
+  ) COLLATE utf8mb4_bin`);
+    await pool.query(`CREATE TABLE IF NOT EXISTS ${MAILBOX_CONSUMED_TABLE} (
+    scope_key VARBINARY(190) NOT NULL,
+    handle VARBINARY(190) NOT NULL,
+    seq BIGINT NOT NULL,
+    record_id VARCHAR(${MAILBOX_RECORD_ID_MAX_CHARS}) NOT NULL,
+    digests TEXT NOT NULL,
+    PRIMARY KEY (scope_key, handle, seq)
   ) COLLATE utf8mb4_bin`);
     await pool.query(`CREATE TABLE IF NOT EXISTS ${MAILBOX_TOMBSTONE_TABLE} (
     scope_key VARBINARY(190) NOT NULL,
@@ -247,6 +302,14 @@ export async function ensurePgMailboxSchema(q) {
     decision VARCHAR(16) COLLATE "C", -- core 7.57.0 #972b(TiDB twin 同注:留置决定,NULL = 从未 held;只经 moveDecision 移动,随记录亡)
     record_id VARCHAR(${MAILBOX_RECORD_ID_MAX_CHARS}) COLLATE "C", -- core 7.59.0(TiDB twin 同注:生产者铸的记录身份,NULL = 没说身份;盒行锁之内经引擎判,随记录亡)
     PRIMARY KEY (scope_key, handle, seq)
+  )`);
+    await q(`CREATE TABLE IF NOT EXISTS ${MAILBOX_CONSUMED_TABLE} (
+    scope_key VARCHAR(190) COLLATE "C" NOT NULL,
+    handle VARCHAR(190) COLLATE "C" NOT NULL,
+    seq BIGINT NOT NULL,
+    record_id VARCHAR(${MAILBOX_RECORD_ID_MAX_CHARS}) COLLATE "C" NOT NULL,
+    digests TEXT COLLATE "C" NOT NULL, -- TiDB twin 同注:已收窗(core 7.61.0),四面摘要 JSON
+    PRIMARY KEY (scope_key, handle, seq)
   )`);
     await q(`CREATE TABLE IF NOT EXISTS ${MAILBOX_TOMBSTONE_TABLE} (
     scope_key VARCHAR(190) COLLATE "C" NOT NULL,
@@ -299,7 +362,8 @@ export class TiDBMailboxStore {
                 throw tombstonedRecipientError(scope, handle);
             if (rec.id !== undefined) {
                 const [held] = await c.query(`SELECT seq, from_id, content, sent_at_ms, ${jsonColumnText("mysql", "hop_chain")}, ${jsonColumnText("mysql", "peer_meta")}, decision, record_id FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = ? AND handle = ? AND record_id = ? FOR UPDATE`, [scope, handle, rec.id]);
-                const replay = replayedSeq(held, scope, handle, this.logger, { ...rec, content: asUtf8Stored(rec.content), ...(rec.from !== undefined ? { from: asUtf8Stored(rec.from) } : {}) });
+                const [consumed] = await c.query(`SELECT seq, record_id, digests FROM ${MAILBOX_CONSUMED_TABLE} WHERE scope_key = ? AND handle = ? AND record_id = ? FOR UPDATE`, [scope, handle, rec.id]);
+                const replay = replayedSeq(held, consumed, scope, handle, this.logger, { ...rec, content: asUtf8Stored(rec.content), ...(rec.from !== undefined ? { from: asUtf8Stored(rec.from) } : {}) });
                 if (replay !== undefined)
                     return replay;
             }
@@ -338,7 +402,9 @@ export class TiDBMailboxStore {
             const [rows] = (await c.query(`SELECT lease_owner FROM ${MAILBOX_TABLE} WHERE scope_key = ? AND handle = ? FOR UPDATE`, [scope, handle]));
             if (rows.length === 0 || rows[0].lease_owner == null || bufToStr(rows[0].lease_owner) !== owner)
                 return { acked: false };
+            const [removed] = await c.query(`SELECT seq, from_id, content, sent_at_ms, ${jsonColumnText("mysql", "hop_chain")}, ${jsonColumnText("mysql", "peer_meta")}, decision, record_id FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = ? AND handle = ? AND seq <= ? AND record_id IS NOT NULL ORDER BY seq FOR UPDATE`, [scope, handle, upToSeq]);
             await c.query(`DELETE FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = ? AND handle = ? AND seq <= ?`, [scope, handle, upToSeq]);
+            await enterConsumedWindow(async (sql, params) => (await c.query(sql.mysql, params))[0], rowsToMessages(removed, scope, handle, this.logger), scope, handle);
             await c.query(`UPDATE ${MAILBOX_TABLE} SET lease_owner = NULL, lease_expires_at_ms = NULL, lease_max_seq = NULL
          WHERE scope_key = ? AND handle = ? AND lease_max_seq IS NOT NULL AND lease_max_seq <= ?`, [scope, handle, upToSeq]);
             return { acked: true };
@@ -475,7 +541,8 @@ export class PgMailboxStore {
                 throw tombstonedRecipientError(scope, handle);
             if (rec.id !== undefined) {
                 const { rows: held } = await c.query(`SELECT seq, from_id, content, sent_at_ms, ${jsonColumnText("pg", "hop_chain")}, ${jsonColumnText("pg", "peer_meta")}, decision, record_id FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = $1 AND handle = $2 AND record_id = $3 FOR UPDATE`, [scope, handle, rec.id]);
-                const replay = replayedSeq(held, scope, handle, this.logger, { ...rec, content });
+                const { rows: consumed } = await c.query(`SELECT seq, record_id, digests FROM ${MAILBOX_CONSUMED_TABLE} WHERE scope_key = $1 AND handle = $2 AND record_id = $3 FOR UPDATE`, [scope, handle, rec.id]);
+                const replay = replayedSeq(held, consumed, scope, handle, this.logger, { ...rec, content });
                 if (replay !== undefined)
                     return replay;
             }
@@ -511,7 +578,9 @@ export class PgMailboxStore {
             const r = (await c.query(`SELECT lease_owner FROM ${MAILBOX_TABLE} WHERE scope_key = $1 AND handle = $2 FOR UPDATE`, [scope, handle]));
             if (r.rows.length === 0 || r.rows[0].lease_owner == null || bufToStr(r.rows[0].lease_owner) !== owner)
                 return { acked: false };
+            const { rows: removed } = await c.query(`SELECT seq, from_id, content, sent_at_ms, ${jsonColumnText("pg", "hop_chain")}, ${jsonColumnText("pg", "peer_meta")}, decision, record_id FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = $1 AND handle = $2 AND seq <= $3 AND record_id IS NOT NULL ORDER BY seq FOR UPDATE`, [scope, handle, upToSeq]);
             await c.query(`DELETE FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = $1 AND handle = $2 AND seq <= $3`, [scope, handle, upToSeq]);
+            await enterConsumedWindow(async (sql, params) => (await c.query(sql.pg, params)).rows, rowsToMessages(removed, scope, handle, this.logger), scope, handle);
             await c.query(`UPDATE ${MAILBOX_TABLE} SET lease_owner = NULL, lease_expires_at_ms = NULL, lease_max_seq = NULL
          WHERE scope_key = $1 AND handle = $2 AND lease_max_seq IS NOT NULL AND lease_max_seq <= $3`, [scope, handle, upToSeq]);
             return { acked: true };

package/dist/plugins/memory-sync-store-pg.d.ts

@@ -3,9 +3,16 @@ import { type IndexSpec } from "./ensure-index.js";
 /** Table names (single source). SAME names as the TiDB twin (the two dialects never share one DB). */
 export declare const PG_MEMORY_SYNC_TABLES: {
     readonly syncCursor: "agent_memory_engine_sync_cursor";
+    readonly syncPartition: "agent_memory_engine_sync_partition";
     readonly pushQueue: "agent_memory_engine_push_queue";
     readonly history: "agent_memory_engine_history";
 };
+/**
+ * 一个层分区的化身的**唯一铸点**(两只方言孪生同读)。化身说的是「中心此刻答话的是这个分区的哪一份状态」:分区出生时铸一次、存进
+ * `agent_memory_engine_sync_partition`,此后每轮同步答它;库被清空重建 ⇒ 那一行随之没了,下一轮再出生 ⇒ 新值。两条契约句(引擎的):
+ * (i) 没有别的分区、别的状态带同一个值 —— 随机 UUID(122 位熵);(ii) 不带凭据 —— 客户端的引擎拒带凭据的化身(钉:十六进制与连字符,凭据判官判否)。
+ */
+export declare function mintSyncPartitionIncarnation(): string;
 /** What the caller hands `enqueue` — the transport-neutral unit (§3 传输中立包:payload = the full
  *  entry, opaque to this store; this queue never interprets it). */
 export interface PushQueueItem {
@@ -45,6 +52,11 @@ export interface CentralSyncCursor {
 /** The dialect-neutral contract both twins implement (anti-drift: one shared integration suite,
  *  test/memory-sync-store-db-integration.test.ts, runs the SAME scenarios against BOTH engines). */
 export interface MemorySyncStore {
+    /**
+     * 层分区 `scope` 的化身:有 ⇒ 存着的那一只;没有 ⇒ 分区此刻出生(铸点 {@link mintSyncPartitionIncarnation},插入即定;并发的第一次只有一只落定,
+     * 两边读回同一只)。中心同步每轮在任何读写之前读它一次、写完之后再读一次(栅栏两端,`memory-sync.ts`)。
+     */
+    partitionIncarnation(scope: string): Promise<string>;
     getCursor(scope: string, peer: string): Promise<CentralSyncCursor | undefined>;
     /** Whole-row replace (round semantics — baseRevs is swapped as one map, never merged). */
     putCursor(cursor: CentralSyncCursor): Promise<void>;
@@ -67,6 +79,8 @@ export declare function ensurePgMemorySyncSchema(query: PgQueryFn): Promise<void
  * ([ref] 车①② 裁定,沿用;不新铸码)。两个孪生共用本函数(MySQL 腿 import 它 —— 一条折码规则一个写者)。
  */
 export declare function refusingMemorySyncRow<T>(read: () => T): T;
+/** 读回的分区化身(两孪生同读):插入即定之后必有一行、值是非空串;否则响亮抛(不铸替身值 —— 一个读不出的化身没有安全的答法)。 */
+export declare function partitionIncarnationOf(value: unknown, scope: string): string;
 /** Options for {@link PgMemorySyncStore}. */
 export interface PgMemorySyncStoreOptions {
     /** How long a `claimDue` lease holds a row invisible before a crashed worker's claim self-heals.
@@ -77,6 +91,7 @@ export declare class PgMemorySyncStore implements MemorySyncStore {
     private readonly query;
     private readonly claimLeaseMs;
     constructor(query: PgQueryFn, opts?: PgMemorySyncStoreOptions);
+    partitionIncarnation(scope: string): Promise<string>;
     getCursor(scope: string, peer: string): Promise<CentralSyncCursor | undefined>;
     putCursor(cursor: CentralSyncCursor): Promise<void>;
     enqueue(item: PushQueueItem): Promise<void>;

package/dist/plugins/memory-sync-store-pg.js

@@ -1,12 +1,17 @@
+import { randomUUID } from "node:crypto";
 import { ensureIndexes } from "./ensure-index.js";
 import { pgSafeJsonStringify, pgProtocolJsonStringify } from "./pg-safe-json.js";
 import { assertMemoryScopeWidth } from "./memory-key-guards.js";
 import { decodeJsonColumn, decodeNullableJsonColumn, foldJsonColumn, jsonColumnText, readNonNullJsonValueColumn, readOpaqueJsonValueColumn, readStringRecordColumn, } from "./sql-json-column.js";
 export const PG_MEMORY_SYNC_TABLES = {
     syncCursor: "agent_memory_engine_sync_cursor",
+    syncPartition: "agent_memory_engine_sync_partition",
     pushQueue: "agent_memory_engine_push_queue",
     history: "agent_memory_engine_history",
 };
+export function mintSyncPartitionIncarnation() {
+    return randomUUID();
+}
 export const MEMORY_SYNC_INDEXES = [
     { table: `${PG_MEMORY_SYNC_TABLES.pushQueue}`, name: `idx_${PG_MEMORY_SYNC_TABLES.pushQueue}_next_attempt_ms`, columns: ["next_attempt_at_ms"] },
 ];
@@ -17,6 +22,11 @@ export async function ensurePgMemorySyncSchema(query) {
     base_revs     jsonb        NOT NULL,
     updated_at_ms bigint       NOT NULL,
     PRIMARY KEY (scope, peer)
+  )`);
+    await query(`CREATE TABLE IF NOT EXISTS ${PG_MEMORY_SYNC_TABLES.syncPartition} (
+    scope       varchar(190) COLLATE "C" NOT NULL,
+    incarnation varchar(64)  COLLATE "C" NOT NULL,
+    PRIMARY KEY (scope)
   )`);
     await query(`CREATE TABLE IF NOT EXISTS ${PG_MEMORY_SYNC_TABLES.pushQueue} (
     id                 char(36) COLLATE "C"     PRIMARY KEY,
@@ -37,6 +47,11 @@ export function refusingMemorySyncRow(read) {
         throw foldJsonColumn(e, (m) => `memory-sync store: ${m} — refusing rather than serve a sync row nobody can read`);
     }
 }
+export function partitionIncarnationOf(value, scope) {
+    if (typeof value === "string" && value.length > 0)
+        return value;
+    throw new Error(`memory-sync store: ${PG_MEMORY_SYNC_TABLES.syncPartition}.incarnation for scope ${scope} is ${value === undefined ? "missing after insert" : "not a non-empty string"} — refusing rather than answer a sync under an unknown state`);
+}
 function toMs(v) {
     return typeof v === "number" ? v : Number(v);
 }
@@ -51,6 +66,12 @@ export class PgMemorySyncStore {
         }
         this.claimLeaseMs = lease;
     }
+    async partitionIncarnation(scope) {
+        assertMemoryScopeWidth(scope);
+        await this.query(`INSERT INTO ${PG_MEMORY_SYNC_TABLES.syncPartition} (scope, incarnation) VALUES ($1, $2) ON CONFLICT (scope) DO NOTHING`, [scope, mintSyncPartitionIncarnation()]);
+        const res = await this.query(`SELECT incarnation FROM ${PG_MEMORY_SYNC_TABLES.syncPartition} WHERE scope = $1`, [scope]);
+        return partitionIncarnationOf(res.rows[0]?.incarnation, scope);
+    }
     async getCursor(scope, peer) {
         const res = await this.query(`SELECT ${jsonColumnText("pg", "base_revs")}, updated_at_ms FROM ${PG_MEMORY_SYNC_TABLES.syncCursor} WHERE scope = $1 AND peer = $2`, [scope, peer]);
         const row = res.rows[0];

package/dist/plugins/memory-sync-store-tidb.d.ts

@@ -5,6 +5,7 @@ import type { Pool } from "mysql2/promise";
  *  one database). */
 export declare const TIDB_MEMORY_SYNC_TABLES: {
     readonly syncCursor: "agent_memory_engine_sync_cursor";
+    readonly syncPartition: "agent_memory_engine_sync_partition";
     readonly pushQueue: "agent_memory_engine_push_queue";
     readonly history: "agent_memory_engine_history";
 };
@@ -21,6 +22,7 @@ export declare class TiDBMemorySyncStore implements MemorySyncStore {
     private readonly pool;
     private readonly claimLeaseMs;
     constructor(pool: Pool, opts?: TiDBMemorySyncStoreOptions);
+    partitionIncarnation(scope: string): Promise<string>;
     getCursor(scope: string, peer: string): Promise<CentralSyncCursor | undefined>;
     putCursor(cursor: CentralSyncCursor): Promise<void>;
     enqueue(item: PushQueueItem): Promise<void>;

package/dist/plugins/memory-sync-store-tidb.js

@@ -1,10 +1,11 @@
-import { historyRowFrom, refusingMemorySyncRow } from "./memory-sync-store-pg.js";
+import { historyRowFrom, mintSyncPartitionIncarnation, partitionIncarnationOf, refusingMemorySyncRow } from "./memory-sync-store-pg.js";
 import { decodeJsonColumn, jsonColumnText, readOpaqueJsonValueColumn, readStringRecordColumn } from "./sql-json-column.js";
 import { ensureIndexes } from "./ensure-index.js";
 import { MEMORY_SYNC_INDEXES, MEMORY_HISTORY_INDEXES, PG_MEMORY_SYNC_TABLES } from "./memory-sync-store-pg.js";
 import { assertMemoryScopeWidth } from "./memory-key-guards.js";
 export const TIDB_MEMORY_SYNC_TABLES = {
     syncCursor: "agent_memory_engine_sync_cursor",
+    syncPartition: "agent_memory_engine_sync_partition",
     pushQueue: "agent_memory_engine_push_queue",
     history: "agent_memory_engine_history",
 };
@@ -17,6 +18,11 @@ export async function ensureTiDBMemorySyncSchema(pool) {
     base_revs     JSON         NOT NULL,
     updated_at_ms BIGINT       NOT NULL,
     PRIMARY KEY (scope, peer)
+  ) COLLATE utf8mb4_bin`);
+    await pool.query(`CREATE TABLE IF NOT EXISTS ${TIDB_MEMORY_SYNC_TABLES.syncPartition} (
+    scope       VARCHAR(190) NOT NULL,
+    incarnation VARCHAR(64)  NOT NULL,
+    PRIMARY KEY (scope)
   ) COLLATE utf8mb4_bin`);
     await pool.query(`CREATE TABLE IF NOT EXISTS ${TIDB_MEMORY_SYNC_TABLES.pushQueue} (
     id                 CHAR(36)     NOT NULL,
@@ -45,6 +51,12 @@ export class TiDBMemorySyncStore {
         }
         this.claimLeaseMs = lease;
     }
+    async partitionIncarnation(scope) {
+        assertMemoryScopeWidth(scope);
+        await this.pool.query(`INSERT INTO ${TIDB_MEMORY_SYNC_TABLES.syncPartition} (scope, incarnation) VALUES (?, ?) ON DUPLICATE KEY UPDATE scope = scope`, [scope, mintSyncPartitionIncarnation()]);
+        const [rows] = await this.pool.query(`SELECT incarnation FROM ${TIDB_MEMORY_SYNC_TABLES.syncPartition} WHERE scope = ?`, [scope]);
+        return partitionIncarnationOf(rows[0]?.incarnation, scope);
+    }
     async getCursor(scope, peer) {
         const [rows] = await this.pool.query(`SELECT ${jsonColumnText("mysql", "base_revs")}, updated_at_ms FROM ${TIDB_MEMORY_SYNC_TABLES.syncCursor} WHERE scope = ? AND peer = ?`, [scope, peer]);
         const row = rows[0];

package/dist/plugins/one-time-migrations.d.ts

@@ -194,9 +194,10 @@
  *    (拒因点名版本与键);不带 ⇒ 载荷零改动读回,读回方按 5 写回原位,启动日志 `config_lkg_migrated` 一行。规则在 `config-lkg.ts` 顶注 formatVersion 5 一段与
  *    `migrateV4Lkg`。没有读数键(它不写库)。
  *  · **M23 存量 placed 子代行的属主**(7.133.0)—— 7.132.x 及以前两只 SQL 店建委派子代的 placed 行时属主恒 NULL,会话面的属主谓词对 NULL 放行 ⇒ 谁拿到子代的会话 id
- *    (父客户端在子代帧的 `transcriptId` 上收到)谁就读得到整段转录。7.133.0 起建行那一笔按委派继承律写属主(`src/delegated-session-owner.ts`,律的唯一属主),
+ *    (父客户端在子代帧的 `transcriptId` 上收到)谁就读得到整段转录。7.133.0–7.143.x 建行那一笔按本仓委派继承律写属主,7.144.0 起记引擎交的 `placement.owner`
+ *    (core 7.62.0 [ref];`src/delegated-session-owner.ts` 头注),
  *    属主为 NULL 的 placed 行只对 fleet 调用方放行(无主放行臂的唯一判据 `security.ts` 的 `ownerlessRowOpen`,常设的读面律,不随本条删);存量行 ⇒ **每次起服的幂等回填**,
- *    判据与建行逐字同一只(`judgeDelegatedOwner`,属主 = 判断时见证到的):根会话的行在 ⇒ 它的属主(根无主 ⇒ 子代仍无主,不写);根行不在 ⇒ 父会话的行;都不在(孤行)⇒
+ *    判据 = 旧律(`judgeDelegatedOwner`,属主 = 判断时见证到的;引擎当年的读数没有落库,读不回):根会话的行在 ⇒ 它的属主(根无主 ⇒ 子代仍无主,不写);根行不在 ⇒ 父会话的行;都不在(孤行)⇒
  *    哨兵属主 `_orphan:<id>`(保留主体前缀,任何已验身份都不等于它 —— 不留 NULL,宁可没人能读),计数 + 起服一行 warn `placed_session_owners_orphaned` 点名条数。记下的根 / 父是空串 ⇒ 读作没有那一格。
  *    **单趟**:按 `session_id` 键集分页扫 `placement_kind IS NOT NULL ∧ owner IS NULL` 的行,每一页一条语句连读根 / 父两行(属主、住客、是不是 placed 行;连接键套
  *    `NULLIF(…, '')`);回写 = 认领句(`CLAIM_OWNERLESS_PLACED_SQL`:只 CAS 子行自己 —— 扫描读到的化身 + `owner IS NULL` + `placement_kind IS NOT NULL`;扫描与回写之间根 / 父被删、
@@ -204,10 +205,9 @@
  *    化身为空的行(子代或来源行)⇒ 响亮拒(全仓「读到空化身」同一条律)。读数三格:写成的(`placedSessionOwnersInherited` / `placedSessionOwnersOrphaned`)与
  *    **残余** `placedSessionOwnersRemaining` = 律这一读判不出、因为它读到的来源本身还是一只无主的委派子代行的行(根已删、父是同样待回填的行,且排在它之后或在同一页里)。
  *    残余非零 ⇒ 读数行 warn;**不拒启、不重扫**:本文件的每一条在窗内每次起服都跑(「窗」一节),残余行只对 fleet 调用方放行(读面律),由之后起服的本条(一次至少再定下一层)
- *    或这一行的下一次停驻(停驻挂点按同一条律认领,`delegated-session-owner.ts` 的 `settleDelegatedOwner`)定下。根无主的子代(律就让它无主)不是残余,每次起服照样被扫到、照样不写。
- *    **够不到的一格(如实登记)**:local 车道没有 placed 行(引擎 File 店不实现 placement,子代住私店),本条不碰 local 的会话边档;local 店也不记委派树、
- *    不认领 ⇒ 经晋升腿进 local 宿主店的升级前子代行仍无主,它们再次停驻时停驻挂点照「属主不是律给的那一只 ⇒ 拒」处置(收口 = local 的 placement 协议;随包文字的补偿:
- *    local 带身份的部署升级前先把停驻待批的审批处理完)。窗 = 发布日 + 30 天(与 M19 / M21 同一条论证:
+ *    定下(7.144.0 起停驻挂点只比对、不认领)。根无主的子代(律就让它无主)不是残余,每次起服照样被扫到、照样不写。
+ *    **够不到的一格(如实登记)**:本条只扫 SQL 两店,不碰 local 的会话边档 ⇒ 经晋升腿进 local 宿主店的升级前子代行(普通行)仍无主;它们再次停驻时停驻挂点只比对
+ *    引擎交来的属主(复活腿 = 那一行自己的属主 ⇒ 无主照无主比对;随包文字的补偿:local 带身份的部署升级前先把停驻待批的审批处理完)。窗 = 发布日 + 30 天(与 M19 / M21 同一条论证:
  *    窗关时缺省部署上升级前的子代转录已被联合收割按 `BG_AGENT_RETENTION_MS` 收走;调长了留存的部署、滚动升级里旧副本在窗内新写的行如实登记,不为它们加长窗)。
  *  · **M24 workflow journal 的属主 scope 搬家**(7.133.0)—— 7.132.x 及以前 `workflow_journal` 的 scope 是**每一行**上的一列:读面按它判,写面(按
  *    `(run_id, ordinal)` 的 upsert)从不判它 ⇒ 别的 scope 的 append 落新序数插进一条 run、落既有序数覆盖属主的结果。7.133.0 起一条 run 的属主 scope 只记在
@@ -310,7 +310,7 @@
  *    · **local 车道**:没有绑定表、没有 `session_meta`(device 车道只在 SQL 后端)⇒ 只有 ④ 与回填前提:读本地 run 店有 run 的会话,执行席读出 absent 的 ⇒ 经同一只席 `place` 成 writer(表唯一项)
  *      (`LocalBackend.runOneTimeMigrations`);local 没有「切换收尾」的形可读 ⇒ 窗内每次起服都判,首跑之后它只碰认领与放置之间被打断的会话(与 `place` 会落下的格同值)。
  *      有 run、而**存档读不出**的会话 —— 会话元数据格缺(升级链上从没被再读过的老会话)而探针读不出,或 fork 创建的格而探针说不出存档在不在 ——:回填跳过它并点名
- *      (读数 `executionPlacementSessionsUnreadable` + 一行一条 warn `execution_placement_session_unreadable`,带会话 id 与故障词〔闭集 `corrupt_session` / `invalid_session` / `storage`;
+ *      (读数 `executionPlacementSessionsUnreadable` + 一行一条 warn `execution_placement_session_unreadable`,带会话 id 与故障词〔闭集 `corrupt_session` / `storage`;
  *      `storage` = 读存档文件时抛了别的故障:权限 / 磁盘 I/O / 超大,再带 `errno`〕),**不拒启**、一个字节没写 —— 回填只补一格放置、不动存档,读不出的存档不归它判
  *      (这一支只收**探针对这只会话的读故障**;会话元数据边档本身读不出、问账日志压实失败等整库级故障照旧拒启);该会话的请求照旧答存档的故障,存档修好(从留存副本恢复,
  *      或 `storage` 时权限 / 磁盘修好)后的下一次起服照常补放置;存档移走则它不再是本服务的会话(不补放置、不再点名;fork 创建的会话例外 —— 它的格还在,读作 fork 未落定,出路是同键重试那次 fork 或删除该会话)。
@@ -338,6 +338,25 @@
  *    起服迁移的 local 腿(`FileApprovalAskStore.upgradeJournalEnvelope`)一次压实把整本重写成 v2。
  *    **回滚**:7.141.x 对改名后的表每一条读写都响亮失败、对 v2 日志拒启 —— 回滚的唯一支持形 = 恢复升级前的备份,或手工把列改回(MIGRATION 写了语句)。
  *    读数:`askCauseColumnsChanged`(0–2 处表形改动)/ `askParkTriggersMoved`(SQL;local 恒 0)/ `askJournalRecordsUpgraded`(local;SQL 恒 0)。
+ *  · **M35 配置根上 env 模型表的决定(settings-schema SS-M11)**(7.143.0)—— 不在店里(与 M16 同为本地配置根上的起服迁移):本版起本地配置腿上,一份管模型面的
+ *    `config.d/models.json` 在 env 模型表已声明时,只有配置根上的决定文档 `config.env-models.json` 读作 `replaced` 才被采纳(否则模型面组拒
+ *    `config.catalog_replaces_env_models`,`env-model-table-gate.ts`);升级前这种目录静默顶替 env 表。本条保住升级前的读法:起服、本地配置第一次读之前
+ *    (`config-root-migration.ts`,两个入口同调),调契约的 `migrateEnvModelsDecision` —— 先读决定与目录,再独占创建运行记录 `config.migration.SS-M11.json`
+ *    (建成的进程是本根唯一的铸造者),决定缺席且目录管模型面才铸 `replaced`;运行记录在场之后决定缺席 ≡ `kept`。没有读数键(它不写库)。
+ *
+ *  · **M36 引擎 7.61.0 之前导入的、在每个项目根放行的全局 allow 退役**(7.143.0,引擎 7.61.0)—— 更早的导入门把用户层里从 `/` 写起的路径规则存成全局行:全局行在每个任务的
+ *    项目根读 `/x`,用户层在它自己的配置目录读,同一串字落店之后放行的是另一个地方。引擎不迁、不在读侧丢,只给一句判据(INTEGRATION-CORE §5.14):行是 allow ∧ add 的出处是
+ *    `imported-cc` ∧ scope 是 global ∧ `ruleBasesNeeded` 点名 `root` ⇒ 这只 add 退役;按 add、不按行(每只选中的行一只 observed-remove 墓碑,`removedDots` 恰是选中的 add,
+ *    人亲手同意过的 `user` add 留着);deny / ask 不退役。判据、读哪些桶、写在哪里与失败方向的唯一属主是 `imported-layer-root-retirement.ts`(头注逐条)—— 两腿同调一只函数:
+ *    SQL 在本段握锁的那一条连接上(`SqlDurableRulePartitionProvider` 收这条连接,墓碑经桶的写面 = 店内唯一写法 `writeBucket` 落),排在 M11 之后;local 在
+ *    `LocalBackend.runOneTimeMigrations` 里经引擎 File 分区的写面落(规则目录不在 ⇒ 没有行、零读,不为它建目录)。读的桶:SQL = 规则表里的每一只;File = 导入记录点名过的属主(引擎的 File 分区后端没有列桶口;缺口见那份头注)。
+ *    每次起服都跑(窗内;更早的引擎回滚上来会重新铸出这种 add),第二跑起零选零写。读数两键:退役了的行(一行一条 warn,不带规则正文)与没能读 / 写的桶(一桶一条 warn,
+ *    每次起服都报)。删码另有一个前提:不再支持回滚到引擎 7.61.0 之前(登记表 M36 的 removal)。
+ *
+ *  · **M37 存卡信封上委派出处的旧键(只有读侧)**(7.143.0,引擎 7.61.0)—— 引擎把审批请求的发起会话键 `sourceTaskId` 改名 `sourceSessionId`(值不变),本服务的卡随改、零别名;
+ *    本版之前铸的卡信封(`approval_ask.card_json` / local 问账)上那一格还是旧名,`.strict()` 的卡 schema 只认新名。存卡的唯一读者入口 `readStoredCardEnvelope`
+ *    在 M18 的读侧改写与 schema 之前把它改名(`approval-card.ts` 的 `renameRetiredSourceKey`,交浅拷贝、零写回,响亮计数)。不起服改写:存卡的寿命以分钟计、
+ *    升级前结清在途审批是部署前置(MIGRATION 本版第 17 条),读侧接住的是滚动升级窗里旧副本新写的与升级前已结仍被读的那几行。没有读数键。
  *
  * ## 收据账(一次起服一只,每一条迁移同一只)
  * 每一步把它**已提交**的改写 / 删除与点名读数当场记进同一只收据账({@link MigrationReceipts}):计数随每次提交累加、行随每次提交追加、形读数在那一步落定时写。走完 ⇒
@@ -357,9 +376,10 @@ import type { Pool as PgPool } from "pg";
 import { type AllowEntryInertReason, type GateKind } from "@sema-agent/core";
 import { type SqlDialect } from "./sql-driver.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
-import { type UndurableScopeRuleRow, type UnreadableRuleBucket } from "./permission-rule-store-sql.js";
+import { listRuleBucketOwners, type UndurableScopeRuleRow, type UnreadableRuleBucket } from "./permission-rule-store-sql.js";
 import type { SchemaProbeRead } from "./schema-live-columns.js";
 import type { ExecutionLane } from "../execution-lane-caps.js";
+import { type ImportedLayerRootAllowRetired, type ImportedLayerRootBucketSkipped, type ImportedLayerRootRetirementSource } from "./imported-layer-root-retirement.js";
 import { type LocalPlacementBackfillSeat, type UnusableArchiveWord } from "../execution-placement.js";
 /** 迁移读数(启动日志一行写全;测试按它断言,不靠日志文本)。 */
 export interface OneTimeMigrationReport {
@@ -410,7 +430,7 @@ export interface OneTimeMigrationReport {
      *  行数(SQL 独有;local 恒 0)。非零 ⇒ 另一行 warn 点名条数。 */
     readonly placedSessionOwnersOrphaned: number;
     /** M23:这一次起服留着无主的存量 placed 子代行 —— 律这一读判不出,因为它读到的来源本身还是一只无主的委派子代行(根已删、父待回填)。它们只对 fleet 调用方
-     *  放行(读面律),由之后起服的本条或它的下一次停驻定下。根无主的子代(律就让它无主)不算。行数(SQL 独有;local 恒 0)。非零 ⇒ 读数行 warn(不拒启)。 */
+     *  放行(读面律),由之后起服的本条定下。根无主的子代(律就让它无主)不算。行数(SQL 独有;local 恒 0)。非零 ⇒ 读数行 warn(不拒启)。 */
     readonly placedSessionOwnersRemaining: number;
     /** M24:workflow journal 的属主 scope —— `moved` = 本次把行上的 scope 列搬进 `workflow_journal_owner`(回填 + 删跨 scope 行 + 删列);`current` = 早已是新形
      *  (新库 / 第二跑:`workflow_journal` 上没有 scope 列);`file-store` = local 车道(core 的 File 店,属主 = 每条 run 的 journal 文件首行)。 */
@@ -462,6 +482,11 @@ export interface OneTimeMigrationReport {
     readonly askParkTriggersMoved: number;
     /** M34 local 腿:问账日志里信封号 1 的记录数(窗内读侧已按意义译读;本次一次压实把整本重写成 v2)。非零 = 真重写了日志。local 独有;SQL 恒 0。 */
     readonly askJournalRecordsUpgraded: number;
+    /** M36:本次退役了引擎 7.61.0 之前导入的全局 `/x` allow add 的行(一行一条:桶键 / 工具名 / 退役的 add 数 / 这一行是否还活着;不带规则正文),启动日志逐行 warn。
+     *  SQL 与 local 都有(同一只函数,见 `imported-layer-root-retirement.ts`)。非空 = 真写了墓碑;第二跑起恒空。 */
+    readonly importedLayerRootAllowsRetired: readonly ImportedLayerRootAllowRetired[];
+    /** M36:这次没能读 / 没能写的桶(闭集四词:读不出 / 写它的那一步里桶被并发删掉 / 没有写面或写面拒 / 并发争不过),一桶一条 warn;后两种那几行照旧放行,每次起服都点名直到处置。 */
+    readonly importedLayerRootBucketsSkipped: readonly ImportedLayerRootBucketSkipped[];
 }
 /** 退役的两只命令桶(引擎 7.51.0 起不是桶;只给 M17 点名认)。 */
 export type RetiredSessionRuleBucket = "commandAllow" | "commandDeny";
@@ -503,7 +528,7 @@ export interface ParkedApprovalCardRowTooLong extends ParkedApprovalCardRowUnrea
     readonly bytes: number;
 }
 /**
- * M32 local 腿被跳过的一只会话:会话 id 是点名坐标;故障词是闭集 {@link UnusableArchiveWord}(`corrupt_session` = 会话头读不出;`invalid_session` = 读得出、结构走不通;
+ * M32 local 腿被跳过的一只会话:会话 id 是点名坐标;故障词是闭集 {@link UnusableArchiveWord}(`corrupt_session` = 会话头读不出,或读得出而日志走不成一棵树;
  * `storage` = 读的时候抛了别的故障,I/O 级 —— 权限 / 磁盘 / 超大,此时 `errno` 带那只故障的 `code`)。盘上路径与故障句不出店。
  */
 export interface ExecutionPlacementSessionUnreadable {
@@ -601,7 +626,7 @@ export declare function migrationWindowOpen(window: Pick<OneTimeMigrationWindow,
  */
 export declare function migrationWindowEnd(id: string): string;
 /** local 车道上 SQL 独有的几条(M8 / M9 / M11 / M17 / M18 / M21 / M23 / M24 / M26 / M27 / M29)的读数(M6 与 M32 的回填两车道都有、M33 只在 local,local 腿的读数由 `LocalBackend.runOneTimeMigrations` 现算):那几张表 / 列在文件底座上从来不存在 ⇒ 如实答 absent / 0。 */
-export declare const NO_SQL_MIGRATIONS: Omit<OneTimeMigrationReport, "holderDeathCodeRowsBackfilled" | "executionPlacementsBackfilled" | "askExecutionLanesBackfilled" | "executionPlacementSessionsUnreadable" | "localArchiveRowFactsBackfilled" | "localArchivesAnonymized" | "localArchivesKeptStamped" | "localArchivesUnreadable" | "localArchiveSnapshotsRecovered" | "askJournalRecordsUpgraded">;
+export declare const NO_SQL_MIGRATIONS: Omit<OneTimeMigrationReport, "holderDeathCodeRowsBackfilled" | "executionPlacementsBackfilled" | "askExecutionLanesBackfilled" | "executionPlacementSessionsUnreadable" | "localArchiveRowFactsBackfilled" | "localArchivesAnonymized" | "localArchivesKeptStamped" | "localArchivesUnreadable" | "localArchiveSnapshotsRecovered" | "askJournalRecordsUpgraded" | "importedLayerRootAllowsRetired" | "importedLayerRootBucketsSkipped">;
 /** 启动期的日志口(logger 的子集)。两级各有其用,见 {@link logOneTimeMigrations}。 */
 export interface MigrationLogSink {
     warn(msg: string, meta?: Record<string, unknown>): void;
@@ -634,6 +659,11 @@ export interface MigrationDb {
  * 本函数**不问**退役 schema:带着它的库在更早处就被 `ensureSchema()` 自身拒掉了(起服对账一族 `schema-consistency.ts` 的探针口,先于建表);走公开序列
  * `createStoreBackend()` → `ensureSchema()` → `runOneTimeMigrations()` 的嵌入方与本服务的起服序列一样,有这一问、零动作。
  */
+/**
+ * M36 的 SQL 腿交给退役步的那一只源(读哪些桶 = 规则表里的每一只 · 桶的 durable 分区后端 · 店的判官):起服序列(握锁的那一条连接)与真库钉同一只构造,
+ * 判官不在两处各写一份。
+ */
+export declare function createSqlImportedLayerRootSource(exec: Parameters<typeof listRuleBucketOwners>[0]): ImportedLayerRootRetirementSource;
 export declare function runSqlOneTimeMigrations(dialect: SqlDialect, pool: MysqlPool | PgPool, input: ExecutionPlacementSwitchInput): Promise<OneTimeMigrationReport>;
 /**
  * M34 —— 问账行成因两列(判据与形见头注 M34 段)。三步,每一步先读形再判,DDL 按后置条件收敛({@link execUntil}),中断 ⇒ 下一次起服从首个未满足的后置条件续:
@@ -816,13 +846,13 @@ export declare function repairParkedRows(db: MigrationDb, dialect: SqlDialect, r
 export declare function backfillParkedApprovalCards(db: MigrationDb, dialect: SqlDialect, receipts: MigrationReceipts): Promise<void>;
 /**
  * M23 —— 存量 placed 子代行的属主回填,**每次起服单趟、幂等**(规则、为什么、够不到的一格见头注 M23 段):键集分页扫完 placed ∧ 属主 NULL 的行,每一行按唯一判据判
- * (`judgeDelegatedOwner`,建行那一笔与停驻挂点同一只:来源顺序根、父;属主 = 这一读见证到的):
- *  · 判出属主 ⇒ {@link CLAIM_OWNERLESS_PLACED_SQL}(只 CAS 子行自己,绑扫描读到的化身;与停驻挂点的认领**同一句、同一份绑参**;第二跑零命中);写成的按属主计进
+ * (`judgeDelegatedOwner`,旧律:来源顺序根、父;属主 = 这一读见证到的):
+ *  · 判出属主 ⇒ {@link CLAIM_OWNERLESS_PLACED_SQL}(只 CAS 子行自己,绑扫描读到的化身;第二跑零命中);写成的按属主计进
  *    `placedSessionOwnersOrphaned`(谁都不匹配:孤行哨兵,或继承自孤行祖先的同一只哨兵)或 `placedSessionOwnersInherited`,每一次提交当场记进收据账;零命中(这一行在扫描之后
  *    被写过 / 删过 / 换了住客)⇒ 不计,下一次起服按那时的律重判;
  *  · 判出无主:读到的来源本身是一只 placed 行(还没定下的委派子代行)⇒ 计进 `placedSessionOwnersRemaining`(残余);来源是普通会话(根无主)⇒ 律就让它无主,不计;
  *  · 扫到的任何一行化身为空 ⇒ 响亮拒(不论判不判得出属主;来源行同一条律)。
- * 不重扫、不拒启:残余由下一次起服或那一行的下一次停驻定下,期间只对 fleet 调用方放行(头注 M23 段)。
+ * 不重扫、不拒启:残余由下一次起服定下,期间只对 fleet 调用方放行(头注 M23 段)。
  */
 export declare function inheritPlacedSessionOwners(db: MigrationDb, dialect: SqlDialect, receipts: MigrationReceipts): Promise<void>;
 /**