@sema-agent/server 7.143.0 → 7.144.0

package/dist/plugins/checkpoint-store-sql.js

@@ -1,10 +1,10 @@
 import { parkedApprovalCard } from "../approval-content-kind.js";
 import { createHash } from "node:crypto";
 import { CHECKPOINT_FACET_SQL, CHECKPOINT_SWEEP_ORDER_SQL, CheckpointIndexRefusedError, judgeCheckpointIndexCells } from "./checkpoint-index-columns.js";
-import { CheckpointError, isGateKind, MAX_RULE_TEXT_CHARS, validatePendingSteer, appendPendingSteer, winnerFromOutcome, summarizeCheckpoint, checkpointRevOf, MAX_SUPPORTED_CHECKPOINT_VERSION, ExecutionOutcomeConflictError, executionRecordDisposition, executionVerdict, } from "@sema-agent/core";
+import { CheckpointError, isGateKind, MAX_RULE_TEXT_CHARS, validatePendingSteer, appendPendingSteer, winnerFromOutcome, summarizeCheckpoint, checkpointRevOf, judgeCheckpointRow, CONTRACT_KIT_ENGINE_VERSION, ExecutionOutcomeConflictError, executionRecordDisposition, executionVerdict, } from "@sema-agent/core";
 import { redactDeep, redactSecrets } from "../trace/redact.js";
-import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, countKindlessBatchOffers, parkRowCarriesSkillCardFacts, parkRowFacts, readRuleOfferList, skillCardFacts } from "../approval-card.js";
-import { assertJsonColumnWritable, createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, foldJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readJsonArrayColumn, readJsonObjectColumn, readNonNullJsonValueColumn, } from "./sql-json-column.js";
+import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, countKindlessBatchOffers, parkRowFacts, readRuleOfferList, skillCardFacts } from "../approval-card.js";
+import { assertJsonColumnWritable, createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, foldJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, jsonColumnTextSha256, readJsonArrayColumn, readJsonColumnTextSha256, readJsonObjectColumn, readNonNullJsonValueColumn, } from "./sql-json-column.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { durableRowIdentity, withoutCheckpointToken } from "../checkpoint-identity.js";
 import { mysqlDriver, pgDriver, dialectProtocolJsonEncoder } from "./sql-driver.js";
@@ -21,6 +21,35 @@ export const TERMINAL_GRACE_MS = 3_600_000;
 export function tokenFingerprint(token) {
     return "sha256:" + createHash("sha256").update(token).digest("hex").slice(0, 12);
 }
+const STORED_ROW_MEMO_CAP = 8192;
+class StoredRowProjectionMemo {
+    rows = new Map();
+    keyOf(sha256) {
+        return `${sha256}@${CONTRACT_KIT_ENGINE_VERSION}`;
+    }
+    get(sha256) {
+        const key = this.keyOf(sha256);
+        const hit = this.rows.get(key);
+        if (hit !== undefined) {
+            this.rows.delete(key);
+            this.rows.set(key, hit);
+        }
+        return hit;
+    }
+    set(sha256, projection) {
+        const key = this.keyOf(sha256);
+        this.rows.delete(key);
+        this.rows.set(key, projection);
+        while (this.rows.size > STORED_ROW_MEMO_CAP) {
+            const oldest = this.rows.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.rows.delete(oldest);
+        }
+    }
+}
+const STORED_ROW_READ_BATCH = 100;
+const CHECKPOINT_SHA256_AS = "checkpoint_sha256";
 const GATE_KIND_IS_LIVE_RUN_PARK = {
     human: true,
     irreversible_ask: true,
@@ -236,7 +265,7 @@ export function approvalDecisionOfWinner(winner, boundCallId) {
         }
     }
 }
-export function pendingActionToolCallId(body) {
+function pendingActionToolCallId(body) {
     if (typeof body !== "object" || body === null)
         return { readable: false };
     if ("sourceTaskId" in body)
@@ -265,17 +294,22 @@ export function pendingActionToolCallId(body) {
         return { readable: false };
     return { readable: true, toolCallId: id, boundInputHash: bih, kind, sourceSessionId };
 }
-function pendingActionOfColumn(cell, where) {
-    let body;
+export function candidateIdentityOf(cp) {
+    if (judgeCheckpointRow(cp).kind === "lacking")
+        return { readable: false };
+    return pendingActionToolCallId(cp);
+}
+function candidateIdentityOfColumn(cell, where) {
+    let cp;
     try {
-        body = decodeJsonColumn(cell, readJsonObjectColumn, `checkpoint.checkpoint ${where}`);
+        cp = decodeCheckpointColumn(cell, where);
     }
     catch (e) {
         if (!isJsonColumnBodyProblem(e))
             throw e;
         return { readable: false };
     }
-    return pendingActionToolCallId(body);
+    return candidateIdentityOf(cp);
 }
 function readActorAssertion(v) {
     if (typeof v !== "object" || v === null)
@@ -346,6 +380,7 @@ export class SqlCheckpointStore {
     fidelity = "json";
     execution = { outcome: true };
     claims;
+    storedRowMemo = new StoredRowProjectionMemo();
     constructor(db, logger, opts = {}) {
         this.db = db;
         this.logger = logger;
@@ -433,16 +468,12 @@ export class SqlCheckpointStore {
         }
     }
     async get(token) {
-        const { rows } = await this.db.query(this.q(`SELECT version, status, ${jsonColumnText("mysql", "checkpoint")}, ${jsonColumnText("mysql", "outcome")}, reopen_reason, rev, ` +
-            `${jsonColumnText("mysql", "pending_steer_queue")}, ${jsonColumnText("mysql", "execution_outcome")}, execution_at_ms FROM checkpoint WHERE token = ?`, `SELECT version, status, ${jsonColumnText("pg", "checkpoint")}, ${jsonColumnText("pg", "outcome")}, reopen_reason, rev, ` +
+        const { rows } = await this.db.query(this.q(`SELECT status, ${jsonColumnText("mysql", "checkpoint")}, ${jsonColumnText("mysql", "outcome")}, reopen_reason, rev, ` +
+            `${jsonColumnText("mysql", "pending_steer_queue")}, ${jsonColumnText("mysql", "execution_outcome")}, execution_at_ms FROM checkpoint WHERE token = ?`, `SELECT status, ${jsonColumnText("pg", "checkpoint")}, ${jsonColumnText("pg", "outcome")}, reopen_reason, rev, ` +
             `${jsonColumnText("pg", "pending_steer_queue")}, ${jsonColumnText("pg", "execution_outcome")}, execution_at_ms FROM checkpoint WHERE token = $1`), [token]);
         const r = rows[0];
         if (!r)
             return null;
-        const version = Number(r.version);
-        if (version > MAX_SUPPORTED_CHECKPOINT_VERSION) {
-            throw new Error(`checkpoint format version ${version} is newer than this build supports (max ${MAX_SUPPORTED_CHECKPOINT_VERSION}) — upgrade the service to resume it`);
-        }
         const cp = refusing("a checkpoint nobody can resume", () => decodeCheckpointColumn(r.checkpoint, `for token ${tokenFingerprint(token)}`));
         cp.status = r.status;
         const outcomeRaw = refusing("a decision record nobody can read", () => decodeOutcomeColumn(r.outcome, `for token ${tokenFingerprint(token)}`));
@@ -468,7 +499,6 @@ export class SqlCheckpointStore {
         this.logger?.info?.("checkpoint_get", {
             tokenFp: tokenFingerprint(token),
             status: cp.status,
-            version,
             hasWorkspaceHandle: !!cp.state?.workspaceHandle,
             snapshotId: cp.state?.workspaceHandle?.snapshotId,
         });
@@ -558,7 +588,8 @@ export class SqlCheckpointStore {
         const d = this.db.dialect;
         const base = `SELECT c.session_id, c.token, c.scope, c.tool_name, c.tool_call_id, ${jsonColumnText(d, "tool_input")}, c.bound_input_hash, ` +
             `${jsonColumnText(d, "risk_descriptor")}, ${jsonColumnText(d, "rule_suggestions")}, c.has_bidi_controls, c.created_at_ms, c.deadline, c.gate_kind, c.approval_card, ta.task_id, ` +
-            `${jsonColumnText(d, "checkpoint", PARK_ROW_PENDING_ACTION)}, ${jsonColumnText(d, "checkpoint", PARK_ROW_CHECKPOINT_ID)} ` +
+            `${jsonColumnText(d, "checkpoint", PARK_ROW_PENDING_ACTION)}, ${jsonColumnText(d, "checkpoint", PARK_ROW_CHECKPOINT_ID)}, ` +
+            `${jsonColumnTextSha256(d, "checkpoint", CHECKPOINT_SHA256_AS)} ` +
             "FROM checkpoint c LEFT JOIN task_active ta ON ta.session_id = c.session_id WHERE c.status='pending'";
         const { rows } = scope
             ? await this.db.query(`${base}${this.q(" AND c.scope=?", " AND c.scope=$1")} ORDER BY c.created_at_ms ASC`, [scope])
@@ -592,43 +623,77 @@ export class SqlCheckpointStore {
                 ...(approvalCard !== undefined ? { approvalCard } : {}),
                 ...parkRowFacts(pendingAction),
             };
-            return [{ row, token: String(r.token), readSkillCard: parkRowCarriesSkillCardFacts(pendingAction) }];
+            return [{ row, token: String(r.token), sha256: readJsonColumnTextSha256(r[CHECKPOINT_SHA256_AS], "checkpoint.checkpoint_sha256 (operator queue row)") }];
+        });
+        const projections = await this.storedRowProjections(entries);
+        const out = entries.map((e) => {
+            const p = projections.get(e.token);
+            return p === undefined ? e.row : { ...e.row, ...p.skillCardFacts, rowVerdict: p.rowVerdict };
         });
-        const out = [];
-        for (const e of entries)
-            out.push(e.readSkillCard ? { ...e.row, ...(await this.readParkedSkillCardFacts(e.token)) } : e.row);
         return out.sort((a, b) => (b.riskDescriptor?.severity ?? 0) - (a.riskDescriptor?.severity ?? 0) || a.createdAt - b.createdAt);
     }
-    async readParkedSkillCardFacts(token) {
-        const { rows } = await this.db.query(this.q(`SELECT ${jsonColumnText("mysql", "checkpoint")} FROM checkpoint WHERE token = ? AND status = 'pending'`, `SELECT ${jsonColumnText("pg", "checkpoint")} FROM checkpoint WHERE token = $1 AND status = 'pending'`), [token]);
-        const r = rows[0];
-        if (r === undefined)
-            return {};
+    async storedRowProjections(rows) {
+        const out = new Map();
+        const misses = [];
+        const expected = new Map();
+        for (const { token, sha256 } of rows) {
+            expected.set(token, sha256);
+            const hit = this.storedRowMemo.get(sha256);
+            if (hit === undefined)
+                misses.push(token);
+            else
+                out.set(token, hit);
+        }
+        for (let i = 0; i < misses.length; i += STORED_ROW_READ_BATCH) {
+            const batch = misses.slice(i, i + STORED_ROW_READ_BATCH);
+            const { rows: read } = await this.db.query(this.q(`SELECT token, ${jsonColumnText("mysql", "checkpoint")}, ${jsonColumnTextSha256("mysql", "checkpoint", CHECKPOINT_SHA256_AS)} FROM checkpoint ` +
+                `WHERE status = 'pending' AND token IN (${batch.map(() => "?").join(", ")})`, `SELECT token, ${jsonColumnText("pg", "checkpoint")}, ${jsonColumnTextSha256("pg", "checkpoint", CHECKPOINT_SHA256_AS)} FROM checkpoint ` +
+                `WHERE status = 'pending' AND token IN (${batch.map((_, j) => `$${j + 1}`).join(", ")})`), batch);
+            for (const r of read) {
+                const token = String(r.token);
+                const sha256 = readJsonColumnTextSha256(r[CHECKPOINT_SHA256_AS], "checkpoint.checkpoint_sha256 (whole-row read)");
+                const projection = this.projectStoredRow(r, sha256);
+                if (projection !== undefined && sha256 === expected.get(token))
+                    out.set(token, projection);
+            }
+        }
+        return out;
+    }
+    projectStoredRow(r, sha256) {
         let cp;
         try {
-            cp = decodeCheckpointColumn(r.checkpoint, "(operator queue row, skill-card facts)");
+            cp = decodeCheckpointColumn(r.checkpoint, "(operator queue row, whole-row read)");
         }
         catch (e) {
             if (!isJsonColumnBodyProblem(e))
                 throw e;
             recordFailOpen("server.approvals.park-row-blob-unreadable");
-            return {};
+            return undefined;
         }
+        let summary;
         try {
-            return skillCardFacts(summarizeCheckpoint(cp));
+            summary = summarizeCheckpoint(cp);
         }
         catch {
             recordFailOpen("server.approvals.park-row-blob-unreadable");
-            return {};
+            return { rowVerdict: judgeCheckpointRow(cp), skillCardFacts: {} };
         }
+        const projection = { rowVerdict: summary.rowVerdict, skillCardFacts: skillCardFacts(summary) };
+        this.storedRowMemo.set(sha256, projection);
+        return projection;
     }
     async listByScope(scope) {
-        const { rows } = await this.db.query(this.q(`SELECT ${jsonColumnText("mysql", "checkpoint")}, status FROM checkpoint WHERE status = 'pending' AND scope = ? ORDER BY created_at_ms ASC LIMIT 500`, `SELECT ${jsonColumnText("pg", "checkpoint")}, status FROM checkpoint WHERE status = 'pending' AND scope = $1 ORDER BY created_at_ms ASC LIMIT 500`), [scope]);
+        const { rows } = await this.db.query(this.q(`SELECT ${jsonColumnText("mysql", "checkpoint")}, ${jsonColumnTextSha256("mysql", "checkpoint", CHECKPOINT_SHA256_AS)}, status FROM checkpoint WHERE status = 'pending' AND scope = ? ORDER BY created_at_ms ASC LIMIT 500`, `SELECT ${jsonColumnText("pg", "checkpoint")}, ${jsonColumnTextSha256("pg", "checkpoint", CHECKPOINT_SHA256_AS)}, status FROM checkpoint WHERE status = 'pending' AND scope = $1 ORDER BY created_at_ms ASC LIMIT 500`), [scope]);
         const out = [];
         for (const r of rows) {
+            const sha256 = readJsonColumnTextSha256(r[CHECKPOINT_SHA256_AS], `checkpoint.checkpoint_sha256 in the ${scope} scheduler view`);
             const cp = refusing("a checkpoint nobody can resume", () => decodeCheckpointColumn(r.checkpoint, `in the ${scope} scheduler view`));
             cp.status = r.status;
-            out.push(summarizeCheckpoint(cp, (sentence) => recordFailOpen("server.checkpoint.inbox-risk-axes-damaged", withoutCheckpointToken(sentence, cp.token))));
+            const memo = this.storedRowMemo.get(sha256);
+            const summary = summarizeCheckpoint(cp, (sentence) => recordFailOpen("server.checkpoint.inbox-risk-axes-damaged", withoutCheckpointToken(sentence, cp.token)), memo?.rowVerdict);
+            if (memo === undefined)
+                this.storedRowMemo.set(sha256, { rowVerdict: summary.rowVerdict, skillCardFacts: skillCardFacts(summary) });
+            out.push(summary);
         }
         return out;
     }
@@ -642,8 +707,8 @@ export class SqlCheckpointStore {
         return rows[0] ? String(rows[0].token) : null;
     }
     async findCheckpointCandidatesForAsk(scope, sessionId, toolCallId, sinceMs) {
-        const { rows } = await this.db.query(this.q(`SELECT token, status, created_at_ms, tool_call_id, bound_input_hash, version, ${jsonColumnText("mysql", "checkpoint")} FROM checkpoint ` +
-            "WHERE scope=? AND session_id=? AND created_at_ms>=? AND (tool_call_id=? OR tool_call_id IS NULL) ORDER BY created_at_ms ASC", `SELECT token, status, created_at_ms, tool_call_id, bound_input_hash, version, ${jsonColumnText("pg", "checkpoint")} FROM checkpoint ` +
+        const { rows } = await this.db.query(this.q(`SELECT token, status, created_at_ms, tool_call_id, bound_input_hash, ${jsonColumnText("mysql", "checkpoint")} FROM checkpoint ` +
+            "WHERE scope=? AND session_id=? AND created_at_ms>=? AND (tool_call_id=? OR tool_call_id IS NULL) ORDER BY created_at_ms ASC", `SELECT token, status, created_at_ms, tool_call_id, bound_input_hash, ${jsonColumnText("pg", "checkpoint")} FROM checkpoint ` +
             "WHERE scope=$1 AND session_id=$2 AND created_at_ms>=$3 AND (tool_call_id=$4 OR tool_call_id IS NULL) ORDER BY created_at_ms ASC"), [scope, sessionId, sinceMs, toolCallId]);
         const out = [];
         for (const r of rows) {
@@ -654,11 +719,7 @@ export class SqlCheckpointStore {
                 boundInputHash: r.bound_input_hash == null ? null : String(r.bound_input_hash),
                 sourceSessionId: null,
             };
-            if (Number(r.version) > MAX_SUPPORTED_CHECKPOINT_VERSION) {
-                out.push({ ...base, boundCallId: null, unparseable: true });
-                continue;
-            }
-            const derived = pendingActionOfColumn(r.checkpoint, `for token ${tokenFingerprint(String(r.token))}`);
+            const derived = candidateIdentityOfColumn(r.checkpoint, `for token ${tokenFingerprint(String(r.token))}`);
             if (!derived.readable) {
                 out.push({ ...base, boundCallId: null, unparseable: true });
                 continue;

package/dist/plugins/fork-routing-session-store.d.ts

@@ -32,7 +32,7 @@
  * 路由表 LRU 上限 {@link ROUTE_MAX}:满额逐最老(refresh-on-use);被逐后下次 `acquire` 按上述规则重derive
  * (requireExisting 的 host-first 重试仍落对店),中途 touch/noteTaskRun 缺路由=落 transient(no-op 级)。
  */
-import { type SessionStore, type AcquiredSession, type SessionStoreSummary, type SessionPlacement, type PlacedSessionRow } from "@sema-agent/core";
+import { type SessionStore, type AcquiredSession, type SessionHead, type SessionStoreSummary, type SessionPlacement, type PlacedSessionRow } from "@sema-agent/core";
 import type { ExecutionPlacementSeat } from "../execution-placement.js";
 import type { ForkToFn } from "./session-fork.js";
 /** acquire 选项形(core 5.48 SessionStore 契约):[ref] placement=受信 spawner 的分区建会话声明。 */
@@ -63,6 +63,13 @@ export declare class ForkRoutingSessionStore implements SessionStore {
     readonly executionPlacement?: ExecutionPlacementSeat;
     /** fork 续写的店契约透传(host 有才有):目标在 host 店原子新建,新 id 与源一并记 host 路由(与 {@link fork} 的 host 腿同)。 */
     readonly forkTo?: ForkToFn;
+    /**
+     * core `SessionStore.headOf`(按 id 读一行:属主 / 住客 / 叶子)—— **按 acquire 的路由转发**({@link pick}:placed 名册 → 路由表 → 未知落 transient,
+     * 与 acquire 对同一只 id 落的店同一只),所以答的就是 acquire 交出的那只会话所在的行(core 7.62.0 [ref] 盒义务 7:声明 placements 的店答 `headOf`,
+     * 住客与 acquire 交出的同源;引擎在子 Runner 上据它读「没人派生的 run」自己那一行定委派树属主)。两只店都答 `headOf` 才声明:有一边答不了 ⇒ 不声明
+     * (半只读口会把那一边的行答成「不在」)。
+     */
+    readonly headOf?: (sessionId: string) => Promise<SessionHead | undefined>;
     constructor(host: SessionStore, transient: SessionStore);
     private remember;
     private pick;

package/dist/plugins/fork-routing-session-store.js

@@ -11,6 +11,7 @@ export class ForkRoutingSessionStore {
     listPlaced;
     executionPlacement;
     forkTo;
+    headOf;
     constructor(host, transient) {
         this.host = host;
         this.transient = transient;
@@ -23,6 +24,11 @@ export class ForkRoutingSessionStore {
         if (host.fork === undefined && transient.fork === undefined) {
             this.fork = undefined;
         }
+        const hostHeadOf = host.headOf;
+        const transientHeadOf = transient.headOf;
+        if (typeof hostHeadOf === "function" && typeof transientHeadOf === "function") {
+            this.headOf = (id) => (this.pick(id) === host ? hostHeadOf.call(host, id) : transientHeadOf.call(transient, id));
+        }
         const hostFaces = host;
         if (hostFaces.executionPlacement !== undefined)
             this.executionPlacement = hostFaces.executionPlacement;

package/dist/plugins/local-checkpoint-store.d.ts

@@ -147,11 +147,9 @@ export declare class LocalCheckpointStore {
      *  · **没有列,所以没有列/blob 一致性门**:SQL 孪生的两道矛盾门(`tool_call_id` 与 `bound_input_hash`
      *    的列 vs blob)在本形结构上不存在 —— 本形只有 blob 这一个真源,谈不上两份互相矛盾。判别力因此**不弱**:
      *    那两道门防的是「外部改库 / schema 偏斜让列与 blob 分家」,而本形没有可分家的第二份。
-     *  · **没有行级版本闸**:本类 `peekScopeByToken` 顶注已亲核过这条事实 —— 本形的 `get()` 没有行级版本闸,
-     *    唯一的读不动形是账本重放级(整店同时读不动)。所以 SQL 孪生那道 `version > MAX_SUPPORTED` 的
-     *    `unparseable` 臂在这里没有对应物;本口的 `unparseable` 只由**窄读器**判(blob 形不合)。
-     *  · **窄读器是同一只** `pendingActionToolCallId`(与 SQL 孪生共用,零第二份手抄):身份三元组的第一维
-     *    `sourceSessionId`、`boundInputHash`、以及「读不出 vs 确定不匹配」的三态,全部由它一家判。
+     *  · **身份判词是同一只** `candidateIdentityOf`(与 SQL 孪生共用,零第二份手抄):先问 core 判官(答 `lacking` ⇒ `unparseable`,
+     *    7.144.0 起两只孪生同一臂 —— 修前只有 SQL 孪生按版本列比,本形没有对应物),再由窄读器判身份三元组的第一维 `sourceSessionId`、
+     *    `boundInputHash`、以及「读不出 vs 确定不匹配」的三态。
      */
     findCheckpointCandidatesForAsk(scope: string, sessionId: string, toolCallId: string, sinceMs: number): Promise<CheckpointAskCandidate[]>;
     /**
@@ -159,9 +157,9 @@ export declare class LocalCheckpointStore {
      * 语义与存在理由的唯一属主 = SQL 侧 `peekScopeByToken` 顶注。
      *
      * ⚠️ 形差如实记:SQL 孪生那口是真「轻读」(只 SELECT scope 一列),本形没有列可选 —— core 的 File 店
-     * 只给 `get(token)`,所以这里读的是**整行**。后果对本形无害:本形的 `get()` 没有行级版本闸(唯一的
-     * 读不动形是账本重放级 = 整店同时读不动,`findPendingTokenBySession` 先抛),所以「行体读得出而 scope
-     * 读不出」这一支在本形结构上不存在。哪天本形补了行级闸,这里要跟着改成不碰行体的读。
+     * 只给 `get(token)`,所以这里读的是**整行**。后果对本形无害:本形的 `get()` 没有行级拒(两只孪生 7.144.0 起都不按版本拒 ——
+     * 本引擎续不续由 core 判官在续跑时答;本形连 SQL 孪生剩下的坏体一臂也没有,唯一的读不动形是账本重放级 = 整店同时读不动,
+     * `findPendingTokenBySession` 先抛),所以「行体读得出而 scope 读不出」这一支在本形结构上不存在。哪天本形补了行级拒,这里要跟着改成不碰行体的读。
      */
     peekScopeByToken(token: CheckpointToken): Promise<string | null | undefined>;
     /** `undefined` = no pending row; else the owner scope (local scopes are always strings — never null).

package/dist/plugins/local-checkpoint-store.js

@@ -6,7 +6,7 @@ import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync, unlinkSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { FileCheckpointStore, atomicWriteFile, executionVerdict, sanitizePathComponent, } from "@sema-agent/core";
-import { approvalDecisionOfWinner, approvalPayloadFingerprint, boundedRuleOffers, boundedToolInput, pendingActionToolCallId, pendingRowPrecedes, queueRowGateKind, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS } from "./checkpoint-store-sql.js";
+import { approvalDecisionOfWinner, approvalPayloadFingerprint, boundedRuleOffers, boundedToolInput, candidateIdentityOf, pendingRowPrecedes, queueRowGateKind, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS } from "./checkpoint-store-sql.js";
 import { quarantineUnreadableSidecar } from "./local-sidecar-quarantine.js";
 import { createZodColumnReader, decodeJsonColumn, foldJsonColumn, readStringArrayColumn } from "./sql-json-column.js";
 import { UNMANAGED_RETENTION } from "./retention-store-sql.js";
@@ -194,6 +194,7 @@ export class LocalCheckpointStore {
                 ...((card) => (card !== undefined ? { approvalCard: card } : {}))(parkedApprovalCard(cp.gate)),
                 ...parkRowFacts(cp.pendingAction),
                 ...skillCardFacts(summary),
+                rowVerdict: summary.rowVerdict,
             });
         }
         return rows.sort((a, b) => (b.riskDescriptor?.severity ?? 0) - (a.riskDescriptor?.severity ?? 0) || a.createdAt - b.createdAt);
@@ -276,7 +277,7 @@ export class LocalCheckpointStore {
             if (cp.scope !== scope || cp.sessionId !== sessionId || cp.createdAt < sinceMs)
                 continue;
             const base = { token: t, status: cp.status, createdAtMs: cp.createdAt };
-            const derived = pendingActionToolCallId(cp);
+            const derived = candidateIdentityOf(cp);
             if (!derived.readable) {
                 out.push({ ...base, sourceSessionId: null, boundCallId: null, boundInputHash: null, unparseable: true });
                 continue;

package/dist/plugins/local-session-store.d.ts

@@ -1,5 +1,4 @@
 import { FileSessionRepo, type AcquiredSession, type PlacedSessionRow, type SessionHead, type SessionPlacementRecord, type SessionStore, type SessionRepo, type SessionMetadata, type SessionTreeEntry, type StoreDurability } from "@sema-agent/core";
-import { type OwnerlessClaim } from "../delegated-session-owner.js";
 import { type PlacementAcquireOpts } from "./session-placement.js";
 import { z } from "zod";
 import { StoreBootRefusalError, type SessionRunClaimSource, type SessionRunRollupSource, type SessionSummary } from "./store-contracts.js";
@@ -30,11 +29,39 @@ export declare const SESSION_META_CELL_OBJECT: z.ZodObject<{
     createdAt: z.ZodOptional<z.ZodString>;
     forkedFrom: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
+/** 严格边档清册里一只边档的对账读数(拒句的逐文件一段;{@link LocalDataRootSchemaMismatchError.findings})。 */
+export interface LocalSidecarMismatch {
+    /** 文件的绝对路径。 */
+    readonly path: string;
+    /** 角色(`<文件名> (the local <角色> sidecar)`)。 */
+    readonly label: string;
+    /** 读不出的种别:`not-json` / `malformed`(形),或 I/O 的 errno(`EACCES` …;没有 errno ⇒ `unreadable`)。 */
+    readonly problem: string;
+    /** 格里本构建不认得的键(非空 ⇒ 这只边档是更新的引擎写下的:数据根比本构建新)。 */
+    readonly unknownFields: readonly string[];
+}
+/**
+ * **local 数据根的「本构建读不出」拒**(起服对账一族的 local 腿;机读码与 SQL 列册对账同一个 `config.schema_mismatch`,拒句同形)。
+ * 一只严格边档用它那一只严格读者读不出 ⇒ 这一只拒,文件原地不动、一个字节不改。两处触发、一只类:
+ *  · `boot` —— 起服对账({@link LocalSessionStore.assertStrictSidecarsReadable},唯一调用点 `LocalBackend.ensureSchema()`)把清册里每一只读不出的合成一只:拒启;
+ *  · `serving` —— 起服之后这只边档第一次被碰时才读不出(嵌入方跳过了 `ensureSchema()`;或起服后别的写者把它写成本构建读不出的形,在替换之前那一读里看见):
+ *    读不出的是**形**(`not-json` / `malformed`,确定的判词)⇒ 这只边档在本进程里从此每一读每一写都交这一只(重启才重判);碰它的请求失败(把它交给 HTTP 全局兜底的路由:
+ *    500 `internal.error` + 一行 error 级 `request_error` 带本码;自己接住故障的路由按各自的 500 臂答)。I/O 故障(非确定)不粘。
+ * 属 {@link StoreBootRefusalError} 族:起服降级臂不吞它(缺省推导的 local 不会被吃成内存后端)。拒句零原文:只点名文件、种别与不认得的键名,不带任何值。
+ */
+export declare class LocalDataRootSchemaMismatchError extends StoreBootRefusalError {
+    readonly findings: readonly LocalSidecarMismatch[];
+    readonly when: "boot" | "serving";
+    /** 机读码(与 SQL 列册对账 / 退役 schema 的拒启同一个)。 */
+    readonly code = "config.schema_mismatch";
+    constructor(findings: readonly LocalSidecarMismatch[], when: "boot" | "serving");
+}
 /**
  * local 车道会话存档的**唯一 repo 出口**:本仓里每一只读 `<root>/sessions/*.jsonl` 的 `FileSessionRepo` 都从这里取(`LocalSessionStore` 的底座;会话视图窗不再自开 repo,
  * 它的元数据与日志都由店交出 —— `local-session-window.ts`),所以坏记录的披露座只有这一份接线。座 = F 类 `server.session-repo.corrupt-record-skipped`(会话存档里读不出的记录丢的是可用性:
- * 历史少一截 / 列表少一行,不开任何门;计数单位 = 一条被跳过的记录,逐命中探针行,warn 每进程一次),外加两条作用域腿:会话打开作用域(`noteReplayInSessionOpenScope`:
- * 只在 `openSessionForItself` 的作用域里才记)与一次性迁移 M33 的整档读作用域({@link noteReplayInArchiveRewriteRead});作用域外 —— 列表 / 导出 / 视图 —— 两条腿都是空操作,那些读只进运维面。
+ * 历史少一截 / 列表少一行,不开任何门;计数单位 = 一条被跳过的记录,逐命中探针行,warn 每进程一次),外加一条作用域腿:一次性迁移 M33 的整档读作用域({@link noteReplayInArchiveRewriteRead});
+ * 作用域外那条腿是空操作。用户面的丢失账不经这只座:core 的 `FileSessionRepo` 把回放的计数记在它交出的存储上(`getReplayLoss`),引擎在 run 里读它说
+ * `session.lineage_rerooted`(core 7.62.0 [ref];本仓 7.104.0–7.143.0 在这里另铸 `session.records_skipped`,7.144.0 退役 —— 一个事实一个来源)。
  */
 export declare function createLocalSessionRepo(root: string): FileSessionRepo;
 /** 快照目录名(数据根下;本店自有的目录与格式)。常设拒启臂 {@link assertNoArchiveSnapshots} 读它,所以它活得比 M33 的码久。 */
@@ -101,11 +128,6 @@ export declare class LocalSessionStore implements SessionStore {
         olderThanMs?: number;
         scope?: string;
     }) => Promise<PlacedSessionRow[]>;
-    /**
-     * 委派继承律的认领口(`delegated-session-owner.ts`;停驻挂点对宿主无主子代行的认领):这只会话的那一位住客(判断时读到的化身)仍无主、且是 placed 行 ⇒ 写 `owner`,
-     * 返回是否写成。与 `placementOf` 同在或同缺(`delegatedOwnerHostOf`)。随一次性迁移 M23 的窗同删(登记表 M23 行)。
-     */
-    readonly claimOwnerless?: OwnerlessClaim;
     /** placement 的唯一读法(repo 的 `placementOf`;repo 不记 placement ⇒ 恒答缺席 —— 那种 repo 里没有 placed 行)。 */
     private readonly recordedPlacementOf;
     /** In-flight acquisitions keyed by id, so concurrent acquire(sameId) in one process share one (mirrors TiDBSessionStore). */
@@ -170,7 +192,12 @@ export declare class LocalSessionStore implements SessionStore {
      * 盘上有会话而边档里没有它那一格 ⇒ 第一次读补铸一格只有化身的(属主没有事实可写)并落盘。严格读(读不出 ⇒ 整只拒,见 `SidecarMap.strict`)。
      */
     private readonly meta;
-    /** 认领行(`session_owner_claimed`,一次性迁移 M10 的认领臂,窗口见 `plugins/one-time-migrations.ts` 登记表)与委派孤行 warn(`delegated_session_owner_orphaned`)的出口。 */
+    /**
+     * [ref] —— 本店的**严格边档清册**(今天一只:会话元数据)。唯一来源 = 构造里 `sidecar(…, strict)` 那一参:工厂造出严格读的边档时同一手登进来,
+     * 没有第二张手写名单。读者只有起服对账 {@link assertStrictSidecarsReadable}。
+     */
+    private readonly strictSidecars;
+    /** 认领行(`session_owner_claimed`,一次性迁移 M10 的认领臂,窗口见 `plugins/one-time-migrations.ts` 登记表)的出口(本店今天只有这一行经它;委派孤行 warn 的铸点已不在 `src/`)。 */
     private readonly log;
     /**
      * 按会话的写锁(表见 {@link SESSION_WRITE_LOCKS_BY_ROOT})—— 会话行两位的**每一笔**写(用户的行格写原语:判 → 边档草稿 → 落盘 → 发布;自动标题器的
@@ -204,12 +231,18 @@ export declare class LocalSessionStore implements SessionStore {
      *  @param dataDir  the SAME data dir the file-backed repo persists under (LocalBackend passes `fileBackend.root`).
      *                  When given, lastActivity is persisted to `<dataDir>/session-last-activity.json` so it survives a
      *                  restart (the file-backed deployment); omit it for the in-memory deployment (nothing survives).
-     *  @param opts.log the `session_owner_claimed` / `delegated_session_owner_orphaned` lines' sink (LocalBackend passes a logger at the deployment's
-     *                  LOG_LEVEL; absent ⇒ an info-level JSON-line logger — a claim or an orphaned delegated row is never silent).
+     *  @param opts.log the `session_owner_claimed` line's sink (LocalBackend passes a logger at the deployment's
+     *                  LOG_LEVEL; absent ⇒ an info-level JSON-line logger — a claim is never silent).
      *  @param opts.durability / opts.placements the deployment's declaration ({@link LocalSessionStoreDeclaration}; see the two fields). */
     constructor(repo: HeadReadingSessionRepo & Partial<PlacementRecordingRepo>, runs: SessionRunRollupSource & SessionRunClaimSource, dataDir?: string, opts?: {
         log?: Pick<Logger, "info" | "warn">;
     } & LocalSessionStoreDeclaration);
+    /**
+     * [ref] —— **起服对账的 local 腿**(SQL 列册对账的对位;唯一调用点 `LocalBackend.ensureSchema()`,排在 M33 快照消化之前 —— 消化会写会话元数据格):
+     * 严格边档清册里的每一只读一次盘(`SidecarMap.reconcile`:冷 ⇒ 载入那一读;已载入 ⇒ 重读只判);读不出的合成**一只** {@link LocalDataRootSchemaMismatchError}
+     * (`boot` 形,逐文件一段)⇒ 拒启,开始服务之前。每一只只会以那一只拒失败(严格读的拒臂把读不出的每一形都收成它);别的故障原样上抛(响亮,不归并)。内存部署(没有数据根)⇒ 零读。
+     */
+    assertStrictSidecarsReadable(): Promise<void>;
     /**
      * 这一格此刻是不是 `forking`(fork 创建的格 {@link isForkCreatedCell} ∧ 存档不在)。存档在不在只问 repo 的唯一探针 {@link probeArchive} 的「不在」—— **只问有没有**:存档在而用不了(会话头读不出 / 截断)
      * 是「在」,内容读不读得出归真正读内容的那一读(门之后、体之前读一次叶子,读不出 ⇒ `corrupt_session`)。所以带键的会话与不带键的会话在执行席上同形,坏档照样能被换装修好
@@ -258,10 +291,10 @@ export declare class LocalSessionStore implements SessionStore {
     private withSessionWriteLock;
     /**
      * 盘上这只会话的存档此刻是什么状态(repo 的**唯一探针**;`open` 读整只存档,所以只在边档里没有那一格、或要判 `forking` 时才走到这里)。三种答案:
-     * 不在(`not_found`)· 在而读得出 · 读不出({@link UnusableArchive}:`corrupt_session` / `invalid_session` = 在而内容用不了;`storage` = 读的时候抛了别的故障,I/O 级,
+     * 不在(`not_found`)· 在而读得出 · 读不出({@link UnusableArchive}:`corrupt_session` = 在而内容用不了;`storage` = 读的时候抛了别的故障,I/O 级,
      * 说不出在不在 —— 词的读法见 {@link archiveFaultWord})。探针**不吞也不改**那只故障:{@link UnusableArchive.fault} 就是抛出来的那一只,每个读者各自决定上抛还是点名 ——
      * 要对这份存档动手的({@link existsInRepo};{@link metaOf};{@link readExecutionPlacement})一律上抛它;一次性迁移 M32 的回填({@link executionPlacementBackfill})经
-     * {@link metaRead} / {@link forkingRead} 收下它、点名跳过,不上抛。只问有没有的 {@link forkingRead} 把 `corrupt_session` / `invalid_session` 读作「在」(存档找到了),`storage` 不替它答。
+     * {@link metaRead} / {@link forkingRead} 收下它、点名跳过,不上抛。只问有没有的 {@link forkingRead} 把 `corrupt_session` 读作「在」(存档找到了),`storage` 不替它答。
      */
     private probeArchive;
     /**
@@ -270,7 +303,7 @@ export declare class LocalSessionStore implements SessionStore {
      */
     private placementProbe;
     /**
-     * 改写面与执行席的读法({@link placementProbe} 的一形):placed ⇒ 那份元组;普通 ⇒ `undefined`;行头读不出(`corrupt_session` / `invalid_session`)⇒ `undefined` —— 没有可读的
+     * 改写面与执行席的读法({@link placementProbe} 的一形):placed ⇒ 那份元组;普通 ⇒ `undefined`;行头读不出(`corrupt_session`)⇒ `undefined` —— 没有可读的
      * placement 记录,这一行按普通行答,内容读不读得出归真正读内容的那一读(坏档照样换得掉,与 forking 探针同一条规矩);说不出(`storage`)⇒ 抛那只故障。
      * core 7.61.0 起 repo 的探针按行头的元组自己读、不整头解码:placed 行的属主格坏了探针照答元组(本臂不再接得住 placed 行)—— 探针拒只剩「行头记录整个读不出」,
      * 那时没有任何元组可守(`test/local-session-placement.test.ts` 的 [ref] 三格)。
@@ -290,7 +323,7 @@ export declare class LocalSessionStore implements SessionStore {
     private metaOf;
     /**
      * {@link metaOf} 的本体(三态,不抛「用不了」):边档里有那一格 ⇒ 读它;没有 ⇒ 问**唯一探针** {@link probeArchive} 一次 —— 不在 ⇒ 无此会话;在而读得出 ⇒ 补铸({@link cellOfPresent});
-     * 读不出 ⇒ {@link UnusableArchive}(**不补铸**:不替一份读不出的存档铸化身;`corrupt_session` / `invalid_session` 两词的故障换成具名拒 {@link SessionOwnerUnreadableError} ——
+     * 读不出 ⇒ {@link UnusableArchive}(**不补铸**:不替一份读不出的存档铸化身;`corrupt_session` 的故障换成具名拒 {@link SessionOwnerUnreadableError} ——
      * 格缺 ∧ 存档用不了 = 这只会话没有可读的属主,见 {@link ownerUnreadableArchive})。要动存档的读者({@link metaOf})把它上抛;不动存档、只要「有没有」的读者
      * ({@link executionPlacementBackfill})原样收下。
      */
@@ -451,17 +484,16 @@ export declare class LocalSessionStore implements SessionStore {
     /** 这次 acquire 要落的 placement:只有声明了分区的店才收(未声明 ⇒ `undefined`,会话就是普通会话 —— core `SessionStore.placements` 缺席的读法)。 */
     private declaredPlacement;
     private load;
-    /** 为这只会话打开它自己的存档,锁内一形(调用方持这只会话的写锁,见 {@link load})。[ref]:这是「为这只会话打开它自己的存档」的那一次
-     *  (引擎 prepare 的 acquire)⇒ 包在打开作用域里:这次回放跳过了记录 ⇒ 打开成功后铸一帧 `session.records_skipped` 投给这只会话(唯一铸点
-     *  与作用域见 `session-records-skipped-notice.ts`);读不出(`corrupt_session`)照旧原样上抛,不铸。存档只读这一次:住客那一格缺(更早版本
+    /** 为这只会话打开它自己的存档,锁内一形(调用方持这只会话的写锁,见 {@link load})。回放跳过了记录 ⇒ 交出的存储带着那份丢失账(core 文件店的
+     *  `getReplayLoss`,经 {@link occupiedBy} 的视图原样转发),引擎在 run 里说 `session.lineage_rerooted`;读不出(`corrupt_session`)原样上抛。存档只读这一次:住客那一格缺(更早版本
      *  写下的会话)时,这次打开就是补铸的证明({@link handOut})。GUARD(open 腿):打开一只已存在的会话**不写属主** —— 记下的属主(含「登记为
      *  无主」)一个字节不动,没被记下的也不在这里替它记成无主:打开不是一个属主事实(7.119.0 前这一腿把「不知道」记成进程内存里的 null,重启即失)。 */
     private openForItselfHeld;
     /**
      * 带 placement 的按 id 首建(锁内一形,调用方持这只会话的写锁、已判过存档不在且不是 fork 创建的格)。写序 = **判别位先落**:先建存档(引擎文件 repo 把元组写进行头、
-     * 首写不可变),再写会话元数据那一格(化身新铸;属主按委派继承律 —— 根会话的属主,根行不在取父,都不在 ⇒ 孤行哨兵 + 一行 warn;读法与次序只住在
-     * `delegated-session-owner.ts` 的 `createPlacedSessionRow`,三只店同调)。崩在两笔之间 = 存档在而格缺 = 一只 placed 行、属主从没被记下(读作无主;
-     * 这形只在 fleet 调用方可读,停驻挂点的认领口 {@link claimOwnerless} 按委派律补上)。
+     * 首写不可变),再写会话元数据那一格(化身新铸;属主 = `placement.owner` 原样 —— core 7.62.0 [ref] 盒义务 7:委派树的属主是引擎判的,店只记、不推断;
+     * 唯一读法 `placedSessionOwnerOf`,在建存档之前判,坏值 ⇒ 响亮拒、一个字节不写;SQL 孪生同调)。崩在两笔之间 = 存档在而格缺 = 一只 placed 行、属主从没被记下
+     * (读作无主;本店没有回填臂 —— M23 的扫描与回写是 SQL 语句,只在两只 SQL 店跑 —— 这一行在具名树的停驻挂点被否决、响亮,匿名树 `null === null` 照放;SQL 孪生的同形由 M23 在窗内回填)。
      * 格已在而存档不在(登记先落了格、存档还没建 —— 一只普通会话的行)⇒ `placement_refused`(SQL 孪生:登记过的行在,带 placement 的建读回缺席元组,同一判)。
      * 建后读回准入(镜像方向):别的进程(同一数据根上的 run-local 腿)在这一刻抢先建了同 id 的存档 ⇒ repo 返回的是那一只 ⇒ 元组缺席 / 异组 ⇒ 响亮拒。
      */
@@ -488,11 +520,6 @@ export declare class LocalSessionStore implements SessionStore {
      * 整段在这只会话的写锁里(与删除 / 换装 / 登记同一把)。
      */
     release(sessionId: string): Promise<void>;
-    /**
-     * 委派继承律的认领口(锁内 CAS):placed 行、那一格的化身 = `incarnation`、属主无主(记下的 `null` 或从没被记下)⇒ 写 `owner`、返回 true;任何一条不符 ⇒ false、零写
-     * (SQL 孪生的 `CLAIM_OWNERLESS_PLACED_SQL` 同四个条件)。placement 读不出 ⇒ 上抛(不写)。
-     */
-    private claimOwnerlessPlaced;
     /**
      * P0.5 variant-2 (E16, clay 2026-06-26) — enumerate the caller's sessions (CC /resume picker) from the SESSION
      * abstraction (`repo.list()`), keyset-paginated newest-first by last activity. Session IDENTITY comes from the
@@ -621,7 +648,7 @@ export declare class LocalSessionStore implements SessionStore {
      *  ③ 内容,按写口的动词(唯一读法在下面这一只 switch;这里不读那一格、不判属主,只换**内容**;交给引擎仓的属主恒缺席 —— 规则一):
      *    · `create` / `judged`(导入):原地换锁里读到的那一份存档的日志(没有存档 ⇒ 导入新建一只,匿名),以锁里读到的存档头为 `expect.row`(**行代号**:
      *      读与写之间存档换了一代 ⇒ 引擎仓拒 `conflict`;它判不出同一代里的追加)。匿名导入只换匿名存档的日志 —— 仍带属主戳的存档(更早的版本写下、一次性迁移 M33
-     *      改写不了的,或跳版升上来的)本店先以具名拒 `StampedSessionArchiveError` 答(与 fork 同一只;引擎导入律同样会拒,本店不重写、不绕,只让拒带对的出路)。
+     *      改写不了的,或跳版升上来的)到不了这里:暂存提交在一切「谁赢」的判之前就以具名拒答了它({@link assertArchiveAnonymousHeld},唯一的一读);`create` 落在没有存档的名上,`replace` 先清存档。
      *      读存档、校验、存档判与写在引擎仓里是一步,抛在哪一处内容都一个字节没动 ⇒ 撤回 ②({@link withdrawImportCell}:行原样 —— 净零写,SQL 孪生的事务回滚同义)再原样上抛;
      *    · `replace`(接口句「先清既有对话日志,再导入」):先清掉内容存档(不带 `expect` —— 带了就得先读它的头,读不出的存档就清不掉),再导入一只新存档。
      *      清不可撤:清过之后导入再抛(I/O 故障),内容就没了,行留 ② 落下的 mirror(只读方向,下次推送补齐)—— 已发版本的 replace 同形(删后导入)。
@@ -667,10 +694,18 @@ export declare class LocalSessionStore implements SessionStore {
     readStagedEntries(stagingId: string): Promise<SessionTreeEntry[]>;
     /** Drop a finished/aborted local staging handle from the registry (called by the handle on commit/abort). */
     forgetStaging(stagingId: string): void;
+    /**
+     * 带戳存档的唯一一判(调用方持这只会话的写锁;只读、零写):这份存档的头仍记着属主戳(更早的版本导入 / 换装写下的,一次性迁移 M33 改写不了的,或跳版升上来的)⇒
+     * {@link StampedSessionArchiveError}。引擎导入律不让匿名导入替换带戳存档,本店不重写、不绕 —— 只让拒带对的出路(fork 的源另有一读,同一只具名拒,见 {@link forkTo})。
+     * 这是「这份存档的日志根本换不了」的判,所以排在一切「谁赢」的判之前({@link commitStagedImport}):换不了的存档上谈不上同步冲突或载荷分叉,
+     * 那两条拒的出路(带同意重来)都是死路 —— 唯一的出路在这一句里。
+     */
+    private assertArchiveAnonymousHeld;
     /**
      * {@link LocalStagingHandle.commit} 的整段 —— **一次持锁**(这只会话的写锁,{@link withSessionWriteLock}):属主 CAS(此刻的属主格 = 这次导入的门判过的那一格,
-     * 否则抛 {@link StagedCommitOwnerChangedError},一个字节不写;在判目的端日志之前判,SQL 孪生同序)→ 提交时重新分类(目的端此刻的日志 vs staged)
-     * → 拒未经同意的 fork / stale / 载荷分叉 → 本处写者拒 → 换装(导入写序 ①②③,落点 `judged` = 上面这一判;化身与 fork 键按换装律沿用)或 identical 且内容相同时日志不动、
+     * 否则抛 {@link StagedCommitOwnerChangedError},一个字节不写;在判目的端日志之前判,SQL 孪生同序)→ 分区判 → 提交时重新分类(目的端此刻的日志 vs staged)→
+     * 这一提交要换日志(不是「id 与内容都相同」那一支)⇒ 带戳存档判({@link assertArchiveAnonymousHeld};只有 local 店有带戳存档,SQL 孪生没有这一步)→
+     * 拒未经同意的 fork / stale / 载荷分叉(带戳判在它们之前:带戳存档上日志换不了,同步冲突与载荷分叉的出路 —— 带同意重来 —— 无从谈起)→ 本处写者拒 → 换装(导入写序 ①②③,落点 `judged` = 上面这一判;化身与 fork 键按换装律沿用)或 identical 且内容相同时日志不动、
      * 行照样落(② 那一格:重戳属主 + mirror)→ 两支同记新近(推送即活动)→ **在同一次持锁里**
      * 读出落定的会话面交回。锁放下之前谁也换不掉这一位住客,所以交回的面就是这次提交落下的那一位(SQL 孪生在提交事务里读同一行,同义);
      * 提交之后按住客条件写的重放(会话行两位)只认这只面,不再重读。改属主的每一条写腿(登记 / 删除 / 导入 / 换装)都在同一把锁里,所以锁内这一读到锁放下都成立。