@sema-agent/server 7.145.0 → 7.147.0

package/dist/plugins/device-store-sql.js

@@ -2,7 +2,7 @@ import { mysqlDriver, pgDriver, dialectJsonEncoder } from "./sql-driver.js";
 import { isDupKeyError, isCheckViolationError } from "./sql-errors.js";
 import { DEVICE_AUDIT_EVENTS, assertAcquireShape, assertDeviceIdShape, assertDeviceOwnerShape, assertEnrollTokenHashShape, assertIssueTokenShape, assertNewDeviceShape, assertPlaceDeviceShape, assertRebindShape, assertRevokeShape, assertWholeSeconds, parseDeviceAuditEvent, parseDevicePlatformOs, parseDeviceStatus, } from "../device-store.js";
 import { WRITABLE, boundDeviceOf, settledDeviceBindOutcome, settledDeviceRebindOutcome } from "../execution-placement.js";
-import { bindDeviceStatement, countDeviceBindingsOn, lockRootAndReadClaim, placeWriterStatement, readPlacementOn, rebindDeviceStatement, rowsOnSqlExec } from "./execution-placement-sql.js";
+import { bindDeviceStatement, countDeviceBindingsOn, lockRootAndReadClaim, placeWriterStatement, readPlacementOn, rebindDeviceStatement, rowsOnSqlExec, writeCellOn } from "./execution-placement-sql.js";
 import { ensureIndexes } from "./ensure-index.js";
 import { decodeJsonColumn, foldJsonColumn, jsonColumnText, readJsonObjectColumn } from "./sql-json-column.js";
 export const DEVICES_TABLE = "device";
@@ -520,11 +520,9 @@ export class SqlDeviceStore {
             const now = new Date();
             const device = { id: input.deviceId, owner: input.owner };
             const stmt = reading.cell.role === "absent"
-                ? placeWriterStatement(this.db.dialect, input.root, input.occupant, { lane: "device", device }, now)
-                : bindDeviceStatement(this.db.dialect, input.root, input.occupant, device, now);
-            const res = await conn.query(stmt.text, [...stmt.values]);
-            if (res.affected !== 1)
-                throw new Error(`device-store: first bind of session ${input.root} affected ${res.affected} rows under a held row lock — engine anomaly, refusing to guess`);
+                ? placeWriterStatement(this.db.dialect, input.root, { lane: "device", device }, now)
+                : bindDeviceStatement(this.db.dialect, input.root, device, now);
+            await writeCellOn(conn, this.db.dialect, input.root, stmt);
             await conn.commit();
             const placed = { id: input.deviceId, owner: { tenant: input.owner.tenant, subject: input.owner.subject }, rev: 0, placedAt: now.toISOString() };
             return { outcome: "bound", device: placed };
@@ -564,10 +562,7 @@ export class SqlDeviceStore {
             }
             const from = boundDeviceOf(reading.cell).id;
             const now = new Date();
-            const stmt = rebindDeviceStatement(this.db.dialect, input.root, input.occupant, input.owner, input.expectedRev, input.targetDeviceId, now);
-            const cas = await conn.query(stmt.text, [...stmt.values]);
-            if (cas.affected !== 1)
-                throw new Error(`device-store: rebind CAS affected ${cas.affected} rows under a held row lock — engine anomaly, refusing to guess`);
+            await writeCellOn(conn, this.db.dialect, input.root, rebindDeviceStatement(this.db.dialect, input.root, input.owner, input.expectedRev, input.targetDeviceId, now));
             const rev = input.expectedRev + 1;
             await this.insertAuditOn(conn, { event: "session_rebound", deviceId: input.targetDeviceId, owner: input.owner, detail: { from, to: input.targetDeviceId, rev } });
             await conn.commit();

package/dist/plugins/execution-lane-rename-m40.d.ts

@@ -0,0 +1,20 @@
+/**
+ * 🔴 一次性迁移 **M40**(窗口见 `plugins/one-time-migrations.ts` 登记表 M40 行;头注 M40 段):没有执行环境的那条车道的存词由退役名改成 `none`。
+ *
+ * 本文件是那一对词与「读到退役词时补哪一句」的**唯一属主**:SQL 腿(`one-time-migrations.ts` 的 M40 步,两方言两张表)、local 两腿(会话元数据边档 ——
+ * `LocalSessionStore.renameRetiredExecutionLaneWordM40`,排在严格边档对账之前;问账日志 —— `FileApprovalAskStore.renameRetiredExecutionLaneWordM40`,
+ * 排在 M32 回填之前)与两只 SQL 读口的拒句(`approval-ask-store-sql.ts` / `execution-placement-sql.ts`)都读这里。窗关删码 = 删这只文件与上面那几处调用。
+ *
+ * 本文件只 import 类型(零运行期依赖)⇒ 被一次性迁移段与它 import 的店文件同时读,不成环。
+ */
+import type { ExecutionLane } from "../execution-lane-caps.js";
+/** 退役的存词(本版之前的部署在没有声明车道时铸下的那一个)。本版的车道闭集里没有它,任何读口读到都响亮拒。 */
+export declare const RETIRED_EXECUTION_LANE_WORD_M40 = "in-process";
+/** 它的新名:声明「这一部署没有执行环境」的那条车道。 */
+export declare const RENAMED_EXECUTION_LANE_M40: ExecutionLane;
+/**
+ * 读口拒句的补句:读到的词就是退役词 ⇒ 说清它是什么、为什么还在(迁移之后又被写下 = 有一只更早版本的副本还在服务)与出路;别的词 ⇒ 空串(拒句不变)。
+ * 起服的迁移改完之后,只有混跑的旧副本还会写下它(版本围栏见登记表 M40 行与 MIGRATION 本版节)。
+ */
+export declare function retiredExecutionLaneHintM40(word: string): string;
+//# sourceMappingURL=execution-lane-rename-m40.d.ts.map

package/dist/plugins/execution-lane-rename-m40.js

@@ -0,0 +1,10 @@
+export const RETIRED_EXECUTION_LANE_WORD_M40 = "in-process";
+export const RENAMED_EXECUTION_LANE_M40 = "none";
+export function retiredExecutionLaneHintM40(word) {
+    if (word !== RETIRED_EXECUTION_LANE_WORD_M40)
+        return "";
+    return (` — "${RETIRED_EXECUTION_LANE_WORD_M40}" is the name an earlier version gave the lane with no execution environment, which this version calls "${RENAMED_EXECUTION_LANE_M40}"; ` +
+        "the one-time migration M40 at boot renames every stored copy, so this row was written afterwards by a replica of an earlier version that is still serving. " +
+        "Stop every replica of the earlier version, then restart this version once (its boot renames what they wrote)");
+}
+//# sourceMappingURL=execution-lane-rename-m40.js.map

package/dist/plugins/execution-placement-sql.d.ts

@@ -1,92 +1,40 @@
 /**
- * **执行放置的 SQL 唯一模块** —— `session_meta` 上 `execution_*` 七列 + `fork_key` 一列的列定义、住客谓词、行 → 格解码、每一种转换的语句,
- * 与「写事务内先锁根行再读认领」那一读。规则在 `src/execution-placement.ts` 头注;本模块只说 SQL。
+ * **执行放置的 SQL 唯一模块** —— 执行放置七列 + `fork_key` 一列的列定义、行 → 格解码、每一种转换的语句,与「写事务内先锁根行再读认领」那一读。
+ * 规则在 `src/execution-placement.ts` 头注;本模块只说 SQL。
  *
- * ## 属主
- *  · **列定义唯一属主**(两方言):中央 DDL(`tidb-pool.ts` 的 `CREATE TABLE session_meta`、`pg-session-storage.ts` 的 `PG_SESSION_SCHEMA`)内插
- *    {@link sessionMetaPlacementColumnsDdl}(先例:`SESSION_META_INCARNATION_COLUMN`);起服列册对账(`schema-consistency.ts`)从同一份建表文本解析期望列集。
- *    存量库的加列只由一次性迁移做,`ensureSchema` 不 ALTER(SCHEMA POLICY)。
- *  · **语句唯一属主**:会话店(执行席、导入写口)与设备店(首绑 / 换绑 / 绑定数)、一次性迁移(搬绑定 / 回填)的事务都借这里的语句,别处零手写。
- *    语句是方言无关的 `{ text, values }`(调用方用自己的连接跑:SqlDriver 的 `SqlTxConn`、node-pg 的客户端、mysql2 的连接都行)。
+ * ## 格住在部署旁表
+ * 八列住 `session_ext`(会话的部署格旁表,建表 / 外键 / 补行的唯一属主 = `session-ext-table.ts`;一会话一行,`ON DELETE CASCADE` 随 `session_meta` 行走),
+ * 不在引擎座表 `session_meta` 上(一张表一个 DDL 属主)。旁表行不在 = 八列全缺省(absent / 非键控 fork);写者在锁住根行之后按需补行。
  *
- * ## 住客谓词(写与 judged 复核的唯一定址)
- * `session_id = :root AND incarnation = :inc AND owner <=> :owner(PG:IS NOT DISTINCT FROM)AND placement_kind IS NULL` —— core 行期望判官 `sessionRowMatches`
- * (属主 + 化身;会话行格写原语在锁住的行上判的就是它,`session-row.ts`)的 SQL 拼法(同一化身的属主会变:local M10 认领、identical 重戳、SQL 导入提交点改属主)。
- * 0 行一律按住客复读分类(判官在 `execution-placement.ts`),永不对现住客重试。
+ * ## 属主
+ *  · 列定义住旁表属主(`session-ext-table.ts` 的 `EXECUTION_PLACEMENT_COLUMNS`;一次性迁移 M32 / M41 读同一份)。
+ *  · **语句唯一属主**:执行席、会话店的事务内钩(导入落 mirror)、设备店(首绑 / 换绑 / 绑定数)与一次性迁移的事务都借这里的语句,别处零手写。
+ *    语句是方言无关的 `{ text, values }`(调用方用自己的连接跑)。
  *
- * ## 读写序律(写事务内的认领读)
- * 改根住客 / 放置的每个写者(换绑 CAS · 导入三写口 · identical 补 mirror · 删除终刀 · 留存删除)在写事务内、用该事务自己的连接先 `FOR UPDATE` 锁根
- * `session_meta` 行,再以新语句锁定读 `task_active(root)`({@link lockRootAndReadClaim}):有认领 ⇒ 不写。全局锁序:设备行 → 根 meta → `task_*`
- * (`run-store-sql.ts` 的 `createRun` 同序先锁根行)。认领持有者自己的初始放置写(place / bind)是唯一例外,不读认领、仍按住客谓词。
+ * ## 写序律(一条,所有部署格的写者同一条)
+ * 改住客 / 放置的每个写者(place · 首绑 / 换绑 · identical 补 mirror · 导入写口 · 删除终刀 · 留存删除)在写事务内、用该事务自己的连接:
+ * ① `FOR UPDATE` 锁根 `session_meta` 行(读住客:属主 + 化身 + 委派判别位)→ ② 需要时新语句锁定读认领 `task_active(root)`({@link lockRootAndReadClaim})
+ * → ③ 补旁表行、再锁定读这一格({@link readCellOn};先补后锁:锁定读永远落在一行在的记录上,InnoDB 间隙锁不会让两只补行互等)→ 判官(住客对不对、格是什么)
+ * → ④ 一句按格谓词定址的 UPDATE。
+ * 住客由 ① 的锁钉住(删除 / 重登记 / 改属主都要先拿这把锁),所以写语句只按格谓词定址、不再带住客谓词;持锁判过「可写」之后 UPDATE 必中一行,0 行即引擎异常。
+ * 全局锁序:设备行 → 根 meta → `task_*` → 旁表行(`run-store-sql.ts` 的 `createRun` 同序先锁根行)。认领持有者自己的初始放置写(place / 首绑)是唯一不读认领的写。
  */
 import type { SqlDialect, SqlDriver, SqlExec } from "./sql-driver.js";
 import type { DeviceOwner } from "../device-store.js";
 import { type ExecutionLane } from "../execution-lane-caps.js";
-import { type SessionFace } from "../session-incarnation.js";
 import { type ExecutionPlacementCell, type ExecutionPlacementReading, type ExecutionPlacementSeat } from "../execution-placement.js";
 /** 一条语句:文本 + 按序的参数(`?` / `$n` 已按方言铸好)。 */
 export interface PlacementStatement {
     readonly text: string;
     readonly values: readonly unknown[];
 }
-/**
- * `session_meta` 的八列(执行放置七列 + `fork_key`)—— 两方言各一句,**唯一属主**。宽度:车道词 ≤ 32、设备 id 与 `device` 表同宽 64、
- * 属主两列与设备店同宽 190、fork 键 255(服务端拼的不透明串)。PG 文本列 `COLLATE "C"`(与同表同形)。全部可空:NULL = absent / 非键控 fork。
- */
-export declare const SESSION_META_PLACEMENT_COLUMNS: readonly [{
-    readonly name: "execution_role";
-    readonly mysql: "execution_role VARCHAR(16) NULL";
-    readonly pg: "execution_role VARCHAR(16) COLLATE \"C\"";
-}, {
-    readonly name: "execution_lane";
-    readonly mysql: "execution_lane VARCHAR(32) NULL";
-    readonly pg: "execution_lane VARCHAR(32) COLLATE \"C\"";
-}, {
-    readonly name: "execution_device_id";
-    readonly mysql: "execution_device_id VARCHAR(64) NULL";
-    readonly pg: "execution_device_id VARCHAR(64) COLLATE \"C\"";
-}, {
-    readonly name: "execution_device_owner_tenant";
-    readonly mysql: "execution_device_owner_tenant VARCHAR(190) NULL";
-    readonly pg: "execution_device_owner_tenant VARCHAR(190) COLLATE \"C\"";
-}, {
-    readonly name: "execution_device_owner_subject";
-    readonly mysql: "execution_device_owner_subject VARCHAR(190) NULL";
-    readonly pg: "execution_device_owner_subject VARCHAR(190) COLLATE \"C\"";
-}, {
-    readonly name: "execution_placed_at";
-    readonly mysql: "execution_placed_at DATETIME(3) NULL";
-    readonly pg: "execution_placed_at TIMESTAMPTZ(3)";
-}, {
-    readonly name: "execution_rev";
-    readonly mysql: "execution_rev BIGINT NULL";
-    readonly pg: "execution_rev BIGINT";
-}, {
-    readonly name: "fork_key";
-    readonly mysql: "fork_key VARCHAR(255) NULL";
-    readonly pg: "fork_key VARCHAR(255) COLLATE \"C\"";
-}];
-/** 中央 DDL 内插的那一段(列与列之间逗号分隔,不带首尾逗号)。 */
-export declare function sessionMetaPlacementColumnsDdl(dialect: SqlDialect): string;
-/** 导入提交点同句落 mirror 的 SET 片段与守卫谓词(会话店的提交点 UPDATE 内插这两段:`SET …, ${MIRROR_ON_COMMIT_SET} WHERE session_id = ? AND ${MIRROR_ON_COMMIT_GUARD}`)。 */
-export declare const MIRROR_ON_COMMIT_SET = "execution_role = 'mirror'";
-export declare const MIRROR_ON_COMMIT_GUARD = "(execution_role IS NULL OR execution_role <> 'writer')";
-/** 导入新建 / 换装重插的那一行在执行与 fork 两格上的值:`fork_key` = 沿用的键(或 NULL)、`execution_role` = mirror(列名与值同出一处)。 */
-export declare function importedRowCells(forkKey: string | null): {
-    readonly columns: string;
-    readonly values: readonly unknown[];
-};
-/** 读一行放置要的列(住客两列 + 委派判别位 + 执行七列;行 → 读数的唯一解码 {@link placementReadingFromRow} 吃的就是这一组)。导入写口的事务内锁读内插它。 */
-export declare const SESSION_META_PLACEMENT_READ_COLUMNS = "owner, incarnation, placement_kind, execution_role, execution_lane, execution_device_id, execution_device_owner_tenant, execution_device_owner_subject, execution_placed_at, execution_rev";
-/** 按根读一行(`lock` ⇒ `FOR UPDATE`:写事务内的当前读;非事务读不加锁)。 */
-export declare function readPlacementRowStatement(dialect: SqlDialect, root: string, opts: {
-    readonly lock: boolean;
-}): PlacementStatement;
+/** 按根的一次池读(非事务;不加锁):根行 LEFT JOIN 旁表行。写事务内的当前读是 {@link readPlacementOn}(两句锁定读)。 */
+export declare function readPlacementRowStatement(dialect: SqlDialect, root: string): PlacementStatement;
 /**
  * place:absent → writer(L[, D]),`execution_rev = 0`。非 device 车道由会话店的执行席用(`device` 缺);device 车道的首绑由设备店在锁住设备行的
- * 同一事务里用(`device` 在场)。时刻用调用方的钟(与 `updated_at` 同一只)。
+ * 同一事务里用(`device` 在场)。时刻用调用方的钟。只在写序律 ① 锁住根行、判官答「可写」之后、{@link ensureSessionExtRowStatement} 补过行之后跑。
  */
-export declare function placeWriterStatement(dialect: SqlDialect, root: string, occupant: SessionFace, cell: {
+export declare function placeWriterStatement(dialect: SqlDialect, root: string, cell: {
     readonly lane: ExecutionLane;
     readonly device?: {
         readonly id: string;
@@ -94,14 +42,14 @@ export declare function placeWriterStatement(dialect: SqlDialect, root: string,
     };
 }, now: Date): PlacementStatement;
 /** bind:writer(device, ∅) → writer(device, D)(fresh 首绑撞上迁移回填的格),`execution_rev = 0`。 */
-export declare function bindDeviceStatement(dialect: SqlDialect, root: string, occupant: SessionFace, device: {
+export declare function bindDeviceStatement(dialect: SqlDialect, root: string, device: {
     readonly id: string;
     readonly owner: DeviceOwner;
 }, now: Date): PlacementStatement;
-/** rebind:writer(device, D) → writer(device, D'),按住客 ∧ 两属主列 ∧ rev 定址,`execution_rev + 1`(恒变列)。属主两列不动(换绑只在同一属主的设备之间)。 */
-export declare function rebindDeviceStatement(dialect: SqlDialect, root: string, occupant: SessionFace, owner: DeviceOwner, expectedRev: number, targetDeviceId: string, now: Date): PlacementStatement;
+/** rebind:writer(device, D) → writer(device, D'),按格 ∧ 两属主列 ∧ rev 定址,`execution_rev + 1`(恒变列)。属主两列不动(换绑只在同一属主的设备之间)。 */
+export declare function rebindDeviceStatement(dialect: SqlDialect, root: string, owner: DeviceOwner, expectedRev: number, targetDeviceId: string, now: Date): PlacementStatement;
 /**
- * 带设备列的根会话行(非委派分区行上 `execution_device_id` 非空):绑定数的读只用它**缩小**读的行 —— 一条绑定必有设备列,反之不然;
+ * 带设备列的根会话格(旁表上 `execution_device_id` 非空、根行不是委派分区行):绑定数的读只用它**缩小**读的行 —— 一条绑定必有设备列,反之不然;
  * 是不是一条绑定只由行的唯一解码 {@link placementCellFromRow} + `boundDeviceOf` 判(SQL 不另判一遍)。两方言同一句。
  */
 export declare function deviceCellRowsStatement(): PlacementStatement;
@@ -110,16 +58,23 @@ export declare function deviceCellRowsStatement(): PlacementStatement;
  * (设备在而属主 / rev / 时刻缺、设备落在别的车道)原样抛 {@link ExecutionPlacementRowError},不当一条绑定数进去,也不当没有。
  */
 export declare function countDeviceBindingsOn(conn: PlacementRowsOn): Promise<number>;
-/** identical 臂补 mirror:absent / mirror → mirror,WHERE 住客谓词 ∧ 不是 writer。 */
-export declare function markMirrorStatement(dialect: SqlDialect, root: string, occupant: SessionFace): PlacementStatement;
-/** 回填(一次性迁移):无执行格、非委派分区、有 run 行的会话行 ⇒ writer(表唯一项)。幂等(第二次跑零行)。 */
+/** identical 臂补 mirror(导入写口同一句):absent / mirror → mirror,WHERE 不是 writer。写序律同 {@link placeWriterStatement}。 */
+export declare function markMirrorStatement(dialect: SqlDialect, root: string): PlacementStatement;
+/** 回填(一次性迁移 M32,窗内;写的是 7.139–7.146 形 —— 八列在 `session_meta` 上,M41 随后连同其余部署格搬进旁表):无执行格、非委派分区、有 run 行的会话行 ⇒ writer(表唯一项)。幂等(第二次跑零行)。 */
 export declare function backfillWriterStatement(dialect: SqlDialect, lane: ExecutionLane, now: Date): PlacementStatement;
 /**
- * 搬绑定(一次性迁移):按 `sourceTable`(退役改名后的绑定表,列 = `root_session_id, device_id, owner_tenant, owner_subject, bound_at, rev`)整行覆盖
+ * 搬绑定(一次性迁移 M32,窗内;写 7.139–7.146 形的 `session_meta` 八列,同 {@link backfillWriterStatement}):按 `sourceTable`(退役改名后的绑定表,列 = `root_session_id, device_id, owner_tenant, owner_subject, bound_at, rev`)整行覆盖
  * 根会话行的 device 位(`rev` 原值、`bound_at → execution_placed_at`)。只碰非委派分区行。MySQL 协议那张表的列是 VARBINARY ⇒ 转成字符串再比 / 再写。
  * `sourceTable` 是调用方的常量表名(不是用户输入)。
  */
 export declare function migrateDeviceBindingsStatement(dialect: SqlDialect, sourceTable: string): PlacementStatement;
+/**
+ * 搬绑定的**旁表形**(一次性迁移 M32 ③,窗内;库已是旁表形 —— M41 之后、或本版起的新库,执行格住 `session_ext`):与 {@link migrateDeviceBindingsStatement}
+ * 同一组覆盖(`rev` 原值、`bound_at → execution_placed_at`、只碰非委派分区行),按写序律先补旁表行(旁表属主的补行语句 {@link ensureSessionExtRowsStatement},不碰任何格)、
+ * 再一句 UPDATE 只写执行格(受影响行数 = 搬了几行,与 7.139–7.146 形同一读法)。
+ * 两句按序跑;`sourceTable` 是调用方的常量表名。
+ */
+export declare function migrateDeviceBindingsOntoSideTableStatements(dialect: SqlDialect, sourceTable: string): readonly [ensure: PlacementStatement, move: PlacementStatement];
 /** 搬绑定的孤儿计数(绑定行指向的根会话行不在,或是委派分区行 ⇒ 丢弃):迁移收据里点名的那个数。 */
 export declare function countOrphanBindingsStatement(dialect: SqlDialect, sourceTable: string): PlacementStatement;
 /** 一行放置读不通(角色 / 车道不在闭集,或列的组合不是四态之一)—— 响亮拒,不读作 absent(那等于把一行坏数据当成「还没放」放行给首交)。 */
@@ -144,18 +99,38 @@ export interface RootClaimReading {
     readonly activeTaskId: string | null;
 }
 /**
- * 读写序律那一读(头注):**同一连接**上先 `SELECT … FROM session_meta WHERE session_id = ? FOR UPDATE` 锁根行,再以新语句
- * `SELECT task_id FROM task_active WHERE session_id = ? FOR UPDATE` 锁定读认领(PG 读已提交下取新快照、TiDB 悲观事务是当前读)。
- * 只在写事务内调;池级 `getActiveTaskId` 不是它(另一只连接,不在锁序里)。根行不在 ⇒ 不读认领。
+ * 写序律 ②:根行已被本事务锁住之后,以新语句 `SELECT task_id FROM task_active WHERE session_id = ? FOR UPDATE` 锁定读认领(PG 读已提交下取新快照、
+ * TiDB 悲观事务是当前读)。只在写事务内、锁根行之后调(会话店的事务内钩在店锁住根行之后调它;其余写者经 {@link lockRootAndReadClaim} 一步做完 ① ②)。
+ */
+export declare function readClaimOn(conn: PlacementRowsOn, dialect: SqlDialect, root: string): Promise<string | null>;
+/**
+ * 写序律 ① ②(头注):**同一连接**上先锁根行,再锁定读认领。只在写事务内调;池级 `getActiveTaskId` 不是它(另一只连接,不在锁序里)。根行不在 ⇒ 不读认领。
  */
 export declare function lockRootAndReadClaim(conn: PlacementRowsOn, dialect: SqlDialect, root: string): Promise<RootClaimReading>;
-/** 写事务内按根的当前读(`FOR UPDATE`)→ 读数。 */
+/**
+ * 写序律 ③:锁住的旁表这一格。只在根行已被本事务锁住之后调。**先补行、再锁定读**(补行 = 缺省一行,读法与行不在同一):锁定读永远落在一行在的记录上 ——
+ * InnoDB 可重复读下,锁定读一只不在的键拿的是间隙锁(彼此兼容),两只事务随后各自补行时插入意向锁互等 ⇒ 死锁。之后的格写({@link writeCellOn})只剩一句 UPDATE。
+ */
+export declare function readCellOn(conn: PlacementRowsOn, dialect: SqlDialect, root: string): Promise<Exclude<ExecutionPlacementCell, {
+    role: "forking";
+}>>;
+/** 写事务内按根的当前读(写序律 ① + ③,两句锁定读)→ 读数。行不在 / 委派分区行 ⇒ `undefined`。 */
 export declare function readPlacementOn(conn: PlacementRowsOn, dialect: SqlDialect, root: string): Promise<ExecutionPlacementReading | undefined>;
+/** 格写只用到的那一面:一句语句、交回受影响行数(驱动的事务连接 `SqlExec` 与会话店交给部署钩的 `SessionTxStatements` 都满足它)。 */
+export interface PlacementCellWriter {
+    query(sql: string, params?: unknown[]): Promise<{
+        readonly affected: number;
+    }>;
+}
+/**
+ * 写序律 ④:一句格写(持锁判过「可写」之后;旁表行已在 —— 锁它的那一读 {@link readCellOn} 补的)。格写必中一行,0 行即引擎异常 ⇒ 响亮抛,不折成业务答案。
+ */
+export declare function writeCellOn(exec: PlacementCellWriter, dialect: SqlDialect, root: string, statement: PlacementStatement): Promise<void>;
 /**
- * SQL 会话店的执行席(两孪生同一只实现:语句与判官都在这里与 `execution-placement.ts`,方言只在语句文本里)。`db` = 店自己的池包成的 SqlDriver。
- *  · `read` —— 一次池读;
- *  · `place` —— 一句自动提交的 UPDATE(认领持有者自己的初始放置写:不读认领、按住客谓词);0 行 ⇒ 按根复读、交判官分类;
- *  · `markMirror` —— 一只事务:锁根行读认领 → 锁定读这一行 → 判官 → 有认领 ⇒ `active` → UPDATE(持锁下必中一行)。
+ * SQL 会话店的执行席(两孪生同一只实现:语句与判官都在这里与 `execution-placement.ts`,方言只在语句文本里)。`db` = 店的池包成的 SqlDriver。
+ *  · `read` —— 一次池读(根行 LEFT JOIN 旁表行);
+ *  · `place` —— 一只事务:锁根行读格(写序律 ① ③,不读认领:认领持有者自己的初始放置写;③ 先补行再锁定读)→ 判官 → 格写;
+ *  · `markMirror` —— 一只事务:锁根行读认领(① ②)→ 补行 + 锁定读这一格(③)→ 判官 → 有认领 ⇒ `active` → 格写。
  */
 export declare function createSqlExecutionPlacementSeat(db: Pick<SqlDriver, "dialect" | "query" | "connect">): ExecutionPlacementSeat;
 //# sourceMappingURL=execution-placement-sql.d.ts.map

package/dist/plugins/execution-placement-sql.js

@@ -1,29 +1,15 @@
 import { isExecutionLane } from "../execution-lane-caps.js";
+import { retiredExecutionLaneHintM40 } from "./execution-lane-rename-m40.js";
 import { sessionFaceFromRow } from "../session-incarnation.js";
 import { toIso } from "./sql-row-helpers.js";
+import { SESSION_EXT_TABLE, ensureSessionExtRowStatement, ensureSessionExtRowsStatement } from "./session-ext-table.js";
 import { WRITABLE, assertPlaceableLane, boundDeviceOf, settledMirrorOutcome, settledPlaceOutcome, } from "../execution-placement.js";
-export const SESSION_META_PLACEMENT_COLUMNS = [
-    { name: "execution_role", mysql: "execution_role VARCHAR(16) NULL", pg: `execution_role VARCHAR(16) COLLATE "C"` },
-    { name: "execution_lane", mysql: "execution_lane VARCHAR(32) NULL", pg: `execution_lane VARCHAR(32) COLLATE "C"` },
-    { name: "execution_device_id", mysql: "execution_device_id VARCHAR(64) NULL", pg: `execution_device_id VARCHAR(64) COLLATE "C"` },
-    { name: "execution_device_owner_tenant", mysql: "execution_device_owner_tenant VARCHAR(190) NULL", pg: `execution_device_owner_tenant VARCHAR(190) COLLATE "C"` },
-    { name: "execution_device_owner_subject", mysql: "execution_device_owner_subject VARCHAR(190) NULL", pg: `execution_device_owner_subject VARCHAR(190) COLLATE "C"` },
-    { name: "execution_placed_at", mysql: "execution_placed_at DATETIME(3) NULL", pg: "execution_placed_at TIMESTAMPTZ(3)" },
-    { name: "execution_rev", mysql: "execution_rev BIGINT NULL", pg: "execution_rev BIGINT" },
-    { name: "fork_key", mysql: "fork_key VARCHAR(255) NULL", pg: `fork_key VARCHAR(255) COLLATE "C"` },
-];
-export function sessionMetaPlacementColumnsDdl(dialect) {
-    return SESSION_META_PLACEMENT_COLUMNS.map((c) => c[dialect]).join(",\n     ");
-}
 const WRITER = "writer";
 const MIRROR = "mirror";
 const NOT_WRITER = "(execution_role IS NULL OR execution_role <> 'writer')";
-export const MIRROR_ON_COMMIT_SET = "execution_role = 'mirror'";
-export const MIRROR_ON_COMMIT_GUARD = NOT_WRITER;
-export function importedRowCells(forkKey) {
-    return { columns: "fork_key, execution_role", values: [forkKey, MIRROR] };
-}
-export const SESSION_META_PLACEMENT_READ_COLUMNS = "owner, incarnation, placement_kind, execution_role, execution_lane, execution_device_id, execution_device_owner_tenant, execution_device_owner_subject, execution_placed_at, execution_rev";
+const EXECUTION_CELL_COLUMNS = "execution_role, execution_lane, execution_device_id, execution_device_owner_tenant, execution_device_owner_subject, execution_placed_at, execution_rev";
+const OCCUPANT_COLUMNS = "owner, incarnation, placement_kind";
+const READING_COLUMNS = `sm.owner, sm.incarnation, sm.placement_kind, ${EXECUTION_CELL_COLUMNS.split(", ").map((c) => `se.${c}`).join(", ")}`;
 function binder(dialect) {
     const values = [];
     return {
@@ -34,38 +20,37 @@ function binder(dialect) {
         },
     };
 }
-function occupantPredicate(dialect, p, root, occupant) {
-    const nullSafeEq = dialect === "pg" ? "IS NOT DISTINCT FROM" : "<=>";
-    return `session_id = ${p(root)} AND incarnation = ${p(occupant.incarnation)} AND owner ${nullSafeEq} ${p(occupant.owner)} AND placement_kind IS NULL`;
-}
-export function readPlacementRowStatement(dialect, root, opts) {
+export function readPlacementRowStatement(dialect, root) {
     const b = binder(dialect);
-    return { text: `SELECT ${SESSION_META_PLACEMENT_READ_COLUMNS} FROM session_meta WHERE session_id = ${b.p(root)}${opts.lock ? " FOR UPDATE" : ""}`, values: b.values };
+    return { text: `SELECT ${READING_COLUMNS} FROM session_meta sm LEFT JOIN ${SESSION_EXT_TABLE} se ON se.session_id = sm.session_id WHERE sm.session_id = ${b.p(root)}`, values: b.values };
 }
-export function placeWriterStatement(dialect, root, occupant, cell, now) {
+export function placeWriterStatement(dialect, root, cell, now) {
     const b = binder(dialect);
     const set = `execution_role = '${WRITER}', execution_lane = ${b.p(cell.lane)}, execution_device_id = ${b.p(cell.device?.id ?? null)}, ` +
         `execution_device_owner_tenant = ${b.p(cell.device?.owner.tenant ?? null)}, execution_device_owner_subject = ${b.p(cell.device?.owner.subject ?? null)}, ` +
         `execution_placed_at = ${b.p(now)}, execution_rev = 0`;
-    return { text: `UPDATE session_meta SET ${set} WHERE ${occupantPredicate(dialect, b.p, root, occupant)} AND execution_role IS NULL`, values: b.values };
+    return { text: `UPDATE ${SESSION_EXT_TABLE} SET ${set} WHERE session_id = ${b.p(root)} AND execution_role IS NULL`, values: b.values };
 }
-export function bindDeviceStatement(dialect, root, occupant, device, now) {
+export function bindDeviceStatement(dialect, root, device, now) {
     const b = binder(dialect);
     const set = `execution_device_id = ${b.p(device.id)}, execution_device_owner_tenant = ${b.p(device.owner.tenant)}, execution_device_owner_subject = ${b.p(device.owner.subject)}, execution_placed_at = ${b.p(now)}, execution_rev = 0`;
     return {
-        text: `UPDATE session_meta SET ${set} WHERE ${occupantPredicate(dialect, b.p, root, occupant)} AND execution_role = '${WRITER}' AND execution_lane = 'device' AND execution_device_id IS NULL`,
+        text: `UPDATE ${SESSION_EXT_TABLE} SET ${set} WHERE session_id = ${b.p(root)} AND execution_role = '${WRITER}' AND execution_lane = 'device' AND execution_device_id IS NULL`,
         values: b.values,
     };
 }
-export function rebindDeviceStatement(dialect, root, occupant, owner, expectedRev, targetDeviceId, now) {
+export function rebindDeviceStatement(dialect, root, owner, expectedRev, targetDeviceId, now) {
     const b = binder(dialect);
     const set = `execution_device_id = ${b.p(targetDeviceId)}, execution_placed_at = ${b.p(now)}, execution_rev = execution_rev + 1`;
-    const where = `${occupantPredicate(dialect, b.p, root, occupant)} AND execution_role = '${WRITER}' AND execution_lane = 'device' ` +
+    const where = `session_id = ${b.p(root)} AND execution_role = '${WRITER}' AND execution_lane = 'device' ` +
         `AND execution_device_owner_tenant = ${b.p(owner.tenant)} AND execution_device_owner_subject = ${b.p(owner.subject)} AND execution_rev = ${b.p(expectedRev)}`;
-    return { text: `UPDATE session_meta SET ${set} WHERE ${where}`, values: b.values };
+    return { text: `UPDATE ${SESSION_EXT_TABLE} SET ${set} WHERE ${where}`, values: b.values };
 }
 export function deviceCellRowsStatement() {
-    return { text: `SELECT session_id, ${SESSION_META_PLACEMENT_READ_COLUMNS} FROM session_meta WHERE execution_device_id IS NOT NULL AND placement_kind IS NULL`, values: [] };
+    return {
+        text: `SELECT se.session_id, ${EXECUTION_CELL_COLUMNS.split(", ").map((c) => `se.${c}`).join(", ")} FROM ${SESSION_EXT_TABLE} se JOIN session_meta sm ON sm.session_id = se.session_id WHERE se.execution_device_id IS NOT NULL AND sm.placement_kind IS NULL`,
+        values: [],
+    };
 }
 export async function countDeviceBindingsOn(conn) {
     const s = deviceCellRowsStatement();
@@ -75,9 +60,9 @@ export async function countDeviceBindingsOn(conn) {
             bindings += 1;
     return bindings;
 }
-export function markMirrorStatement(dialect, root, occupant) {
+export function markMirrorStatement(dialect, root) {
     const b = binder(dialect);
-    return { text: `UPDATE session_meta SET execution_role = '${MIRROR}' WHERE ${occupantPredicate(dialect, b.p, root, occupant)} AND ${NOT_WRITER}`, values: b.values };
+    return { text: `UPDATE ${SESSION_EXT_TABLE} SET execution_role = '${MIRROR}' WHERE session_id = ${b.p(root)} AND ${NOT_WRITER}`, values: b.values };
 }
 export function backfillWriterStatement(dialect, lane, now) {
     const b = binder(dialect);
@@ -105,6 +90,31 @@ export function migrateDeviceBindingsStatement(dialect, sourceTable) {
         values: [],
     };
 }
+export function migrateDeviceBindingsOntoSideTableStatements(dialect, sourceTable) {
+    if (dialect === "pg") {
+        return [
+            ensureSessionExtRowsStatement(dialect, `SELECT sm.session_id FROM ${sourceTable} ds JOIN session_meta sm ON sm.session_id = ds.root_session_id WHERE sm.placement_kind IS NULL`),
+            {
+                text: `UPDATE ${SESSION_EXT_TABLE} SET execution_role = '${WRITER}', execution_lane = 'device', execution_device_id = ds.device_id, ` +
+                    "execution_device_owner_tenant = ds.owner_tenant, execution_device_owner_subject = ds.owner_subject, execution_placed_at = ds.bound_at, execution_rev = ds.rev " +
+                    `FROM ${sourceTable} ds, session_meta sm WHERE ds.root_session_id = ${SESSION_EXT_TABLE}.session_id AND sm.session_id = ${SESSION_EXT_TABLE}.session_id AND sm.placement_kind IS NULL`,
+                values: [],
+            },
+        ];
+    }
+    const str = (col) => `CONVERT(ds.${col} USING utf8mb4)`;
+    const rootKey = `${str("root_session_id")} COLLATE utf8mb4_bin`;
+    return [
+        ensureSessionExtRowsStatement(dialect, `SELECT sm.session_id FROM ${sourceTable} ds JOIN session_meta sm ON ${rootKey} = sm.session_id WHERE sm.placement_kind IS NULL`),
+        {
+            text: `UPDATE ${SESSION_EXT_TABLE} se JOIN session_meta sm ON sm.session_id = se.session_id JOIN ${sourceTable} ds ON ${rootKey} = se.session_id ` +
+                `SET se.execution_role = '${WRITER}', se.execution_lane = 'device', se.execution_device_id = ${str("device_id")}, ` +
+                `se.execution_device_owner_tenant = ${str("owner_tenant")}, se.execution_device_owner_subject = ${str("owner_subject")}, se.execution_placed_at = ds.bound_at, se.execution_rev = ds.rev ` +
+                "WHERE sm.placement_kind IS NULL",
+            values: [],
+        },
+    ];
+}
 export function countOrphanBindingsStatement(dialect, sourceTable) {
     const rootKey = dialect === "pg" ? "ds.root_session_id" : "CONVERT(ds.root_session_id USING utf8mb4) COLLATE utf8mb4_bin";
     return {
@@ -135,7 +145,7 @@ export function placementCellFromRow(root, row) {
         throw new ExecutionPlacementRowError(root, `role ${JSON.stringify(text(role))} is not writer / mirror / NULL`);
     const lane = isNull(row.execution_lane) ? "" : text(row.execution_lane);
     if (!isExecutionLane(lane))
-        throw new ExecutionPlacementRowError(root, `writer lane ${JSON.stringify(lane)} is not an execution lane`);
+        throw new ExecutionPlacementRowError(root, `writer lane ${JSON.stringify(lane)} is not an execution lane${retiredExecutionLaneHintM40(lane)}`);
     if (isNull(row.execution_device_id)) {
         if (deviceCols.some((v) => !isNull(v)))
             throw new ExecutionPlacementRowError(root, "device owner without a device");
@@ -164,37 +174,69 @@ export function placementReadingFromRow(root, row) {
 export function rowsOnSqlExec(exec) {
     return async (sql, values) => (await exec.query(sql, [...values])).rows;
 }
-export async function lockRootAndReadClaim(conn, dialect, root) {
+async function lockRootOn(conn, dialect, root) {
+    const ph = dialect === "pg" ? "$1" : "?";
+    return (await conn(`SELECT ${OCCUPANT_COLUMNS} FROM session_meta WHERE session_id = ${ph} FOR UPDATE`, [root]))[0];
+}
+export async function readClaimOn(conn, dialect, root) {
     const ph = dialect === "pg" ? "$1" : "?";
-    const row = await conn(`SELECT session_id FROM session_meta WHERE session_id = ${ph} FOR UPDATE`, [root]);
-    if (row.length === 0)
-        return { rowPresent: false, activeTaskId: null };
     const claim = await conn(`SELECT task_id FROM task_active WHERE session_id = ${ph} FOR UPDATE`, [root]);
-    return { rowPresent: true, activeTaskId: claim[0] === undefined ? null : text(claim[0].task_id) };
+    return claim[0] === undefined ? null : text(claim[0].task_id);
+}
+export async function lockRootAndReadClaim(conn, dialect, root) {
+    if ((await lockRootOn(conn, dialect, root)) === undefined)
+        return { rowPresent: false, activeTaskId: null };
+    return { rowPresent: true, activeTaskId: await readClaimOn(conn, dialect, root) };
+}
+export async function readCellOn(conn, dialect, root) {
+    const ph = dialect === "pg" ? "$1" : "?";
+    const ensure = ensureSessionExtRowStatement(dialect, root);
+    await conn(ensure.text, ensure.values);
+    const row = (await conn(`SELECT ${EXECUTION_CELL_COLUMNS} FROM ${SESSION_EXT_TABLE} WHERE session_id = ${ph} FOR UPDATE`, [root]))[0];
+    return placementCellFromRow(root, row ?? {});
 }
 export async function readPlacementOn(conn, dialect, root) {
-    const s = readPlacementRowStatement(dialect, root, { lock: true });
-    return placementReadingFromRow(root, (await conn(s.text, s.values))[0]);
+    const occupant = await lockRootOn(conn, dialect, root);
+    if (occupant === undefined || !isNull(occupant.placement_kind))
+        return undefined;
+    return { occupant: sessionFaceFromRow(root, isNull(occupant.owner) ? null : text(occupant.owner), occupant.incarnation), cell: await readCellOn(conn, dialect, root) };
+}
+export async function writeCellOn(exec, dialect, root, statement) {
+    const res = await exec.query(statement.text, [...statement.values]);
+    if (res.affected !== 1)
+        throw placementInvariant(root, `a cell write (${statement.text.slice(0, 48)}…)`);
 }
 function placementInvariant(root, what) {
-    return new Error(`execution placement of session ${root}: ${what} matched no row while a re-read finds the cell writable — engine/driver anomaly, refusing to guess`);
+    return new Error(`execution placement of session ${root}: ${what} matched no row under a held root-row lock after the judge found the cell writable — engine/driver anomaly, refusing to guess`);
 }
 export function createSqlExecutionPlacementSeat(db) {
     const read = async (root) => {
-        const s = readPlacementRowStatement(db.dialect, root, { lock: false });
+        const s = readPlacementRowStatement(db.dialect, root);
         return placementReadingFromRow(root, (await db.query(s.text, [...s.values])).rows[0]);
     };
     return {
         read,
         async place(root, occupant, cell) {
             assertPlaceableLane(root, cell);
-            const s = placeWriterStatement(db.dialect, root, occupant, { lane: cell.lane }, new Date());
-            if ((await db.query(s.text, [...s.values])).affected === 1)
+            const conn = await db.connect();
+            try {
+                await conn.begin();
+                const settled = settledPlaceOutcome(root, await readPlacementOn(rowsOnSqlExec(conn), db.dialect, root), occupant, cell);
+                if (settled !== WRITABLE) {
+                    await conn.rollback();
+                    return settled;
+                }
+                await writeCellOn(conn, db.dialect, root, placeWriterStatement(db.dialect, root, { lane: cell.lane }, new Date()));
+                await conn.commit();
                 return { outcome: "placed" };
-            const settled = settledPlaceOutcome(root, await read(root), occupant, cell);
-            if (settled === WRITABLE)
-                throw placementInvariant(root, "place");
-            return settled;
+            }
+            catch (err) {
+                await conn.rollback().catch(() => undefined);
+                throw err;
+            }
+            finally {
+                conn.release();
+            }
         },
         async markMirror(root, occupant) {
             const conn = await db.connect();
@@ -215,9 +257,7 @@ export function createSqlExecutionPlacementSeat(db) {
                     await conn.rollback();
                     return { outcome: "active", activeTaskId: claim.activeTaskId };
                 }
-                const s = markMirrorStatement(db.dialect, root, occupant);
-                if ((await conn.query(s.text, [...s.values])).affected !== 1)
-                    throw placementInvariant(root, "markMirror under a held row lock");
+                await writeCellOn(conn, db.dialect, root, markMirrorStatement(db.dialect, root));
                 await conn.commit();
                 return { outcome: "mirrored" };
             }

package/dist/plugins/file-run-store.d.ts

@@ -8,8 +8,8 @@ import { type SpaceCommitClaim, type SpaceCommitReading, type SpaceCommitState }
  * `RUN_STORE_STRICT_HYDRATE=on` 下 hydrate 列不出 `runs/` 时的**拒启**类型([ref] 件B;codex 对抗复审
  * R1-[high] 验真后从裸 `Error` 升成具名类型)。
  *
- * 🔴 **为什么必须是一个类型而不是一句文案**:`openStoreBackendWithFallback` 对**默认推导**的 local
- * (`DB_BACKEND` 未设)有一条既有降级臂 —— mkdir / 只读盘那类「这台机器存不了盘」的失败降级到内存继续起。
+ * 🔴 **为什么必须是一个类型而不是一句文案**(修前形;降级臂改按数据根状态判之后,`runs/` 在场的根已不会降级,类型仍是拒句的属主):`openStoreBackendWithFallback` 对**默认推导**的 local
+ * (`DB_BACKEND` 未设)曾有一条按错误种类判的降级臂 —— mkdir / 只读盘那类「这台机器存不了盘」的失败降级到内存继续起。
  * 本拒启从 `new LocalBackend(...)` 里冒出来,长得和它们一模一样,不给它一个可判别的身份就会被同一个
  * catch 吞掉:operator 明确要的 **fail-closed 反而变成 fail-open**,而且丢的正是持久 run 账本(这根旋钮
  * 存在的全部理由)。判据锚在**类型**上,不在文案上 —— 文案会改,类型不会(同文件族先例:`AdoptionError`
@@ -22,6 +22,13 @@ import { type SpaceCommitClaim, type SpaceCommitReading, type SpaceCommitState }
 export declare class RunStoreStrictHydrateError extends StoreBootRefusalError {
     readonly name = "RunStoreStrictHydrateError";
 }
+/** run 店在数据根下自己铸的目录(构造器与一次性迁移 M39 的名册同读这一只:名册的路径 = 店真实铸的路径)。 */
+export declare function fileRunStoreDirsFor(root: string): {
+    readonly runs: string;
+    readonly active: string;
+    readonly tmp: string;
+    readonly spaceCommits: string;
+};
 export declare class FileRunStore implements InProcessClaimFence {
     private readonly runsDir;
     private readonly activeDir;
@@ -96,7 +103,7 @@ export declare class FileRunStore implements InProcessClaimFence {
      *
      * `readJsonlRecords` 对 ENOENT 答 `[]`、对其余读错(EACCES / EIO / EISDIR / ENOTDIR)**抛普通 Error**
      * (亲验 core `dist/stores/file/fs-atomic.js`)。那个普通 Error 从构造器冒出去之后,在**默认
-     * 推导**的 local 后端上会被 `openStoreBackendWithFallback` 的降级臂吞成 memory —— 也就是说 strict 开着
+     * 推导**的 local 后端上修前会被 `openStoreBackendWithFallback` 的降级臂吞成 memory —— 也就是说 strict 开着
      * 也照样带着残缺账本(或直接换成内存)起动,两处 readdir 门白守。
      *
      * ⇒ strict 档:非 ENOENT 的读盘失败一律转成 {@link RunStoreStrictHydrateError}(带路径 + 原文),由
@@ -118,13 +125,21 @@ export declare class FileRunStore implements InProcessClaimFence {
      */
     private refuseIfUnreadable;
     private hydrate;
-    /** run.json 的整文件原子替换 —— {@link persist} 的落盘那一半,不碰索引。 */
+    /** run.json 的整文件原子替换 —— {@link persist} 的落盘那一半,不碰索引(只有 `persist` 调它)。 */
     private writeRunFile;
-    /** Commit a RunRow to disk (whole-file atomic replace) AND the index — the single write path for every status change.
-     *  落盘在前、`runs.set` 在后:落盘抛 ⇒ 索引原样。要「全有或全无」的写口因此不在索引里那只行上原地先改再调 —— 原地改过的行,落盘一抛就是「内存已改、盘上没改」。
-     *  两种不原地的写法:对**副本**调本口(索引里换成副本:`releaseIdemKey` / `bindIdemBodyFingerprint` / `takeOverClaim`);或副本只走 {@link writeRunFile},
-     *  落成之后把改动**合回索引里的同一只行**(`fillObjectivePreview`)——后一种用在会撞进收割腿 await 窗的写口上:`reapSuspended` 等收割腿在 probe 的 await 之间手里持着索引里的行对象,
-     *  await 之后的复核读的就是这只对象,索引里的行被换成副本,它们就看不见之后的认领 / 取消了。 */
+    /**
+     * 索引里的行**只有这一条写律**,每个写口(建行 / 状态迁移 / 心跳 / 取消位 / 幂等绑定 / 接管 / 预览补写)都走它:
+     * **对副本判改 → 落盘成功 → 把改动合进索引里的同一只行对象**(索引里没有这一行才 `set` —— 建行)。
+     * 写口的形状恒为「在入口守卫读到的行上判,`{ ...r, 改动 }` 铸一份副本,交给本口」;`RunRow` 字段全 `readonly`,原地改一只行编不过。
+     *
+     * 三条后果都从这一条律拿到,不另设规则:
+     *  · 落盘抛 ⇒ 索引里的行一字未动 —— 内存与盘同值,入口守卫读到的还是旧状态,重试照常补回。原地先改再落盘的写法,抛的那一拍把内存和盘劈成两半,
+     *    而改过的 `status` 还会让「首个终局写者赢」一类守卫把重试挡回 —— 盘上永远落不下那一笔(终局结果丢失,重启后被当孤儿记成 failed);
+     *  · 落成之后索引里还是**同一只**行对象 —— 跨 await 持着行的收割腿(`reapSuspended` / `failSuspendedWithExpiredCheckpoint` / `reclaimOrphanedAtBoot`)
+     *    await 之后的复核读的就是手上这只对象,换成副本它们就看不见期间的认领 / 取消 / 接管(再写一遍,把已被别腿落定的行盖掉);
+     *  · 落盘与合回之间没有让出点(本口同步、体内无 await)⇒ 别的写者与收割腿读到的要么是落成前的行、要么是落成后的行,没有「盘已新、索引未合」的中间态。
+     *    在落盘与合回之间插 await 或别的事,就回到了收割写者会撞中间态的形(`test/file-run-store-persist-law.test.ts` 的结构钉守这一格)。
+     */
     private persist;
     private eventLogFor;
     /** Create a run iff the session has no active run (the task_active unique-key claim) AND no submission key of this
@@ -143,10 +158,9 @@ export declare class FileRunStore implements InProcessClaimFence {
      *  different claim locks) cannot both pass the check: the loser observes the winner's row. */
     private commitNewRun;
     /** run 行预览的写一次补写(SQL 孪生同义:列仍是 null 才写,建行写过 / 已补过的不动;行不在 ⇒ 无事)。
-     *  **副本判改 → 落盘 → 合回**:先把改动落在副本上写盘,落盘抛 ⇒ 内存里的行一字未动(预览仍是 null)、盘上也原样,下一次补写照常再试;
-     *  落成之后再把预览合回索引里的**同一只**行对象(不换对象:跨 await 持着行的收割腿复核读的是手上这只对象)。
+     *  走 {@link persist} 的写律:落盘抛 ⇒ 内存里的行一字未动(预览仍是 null)、盘上也原样,下一次补写照常再试 ——
      *  原地先改再落盘,抛的那一拍就把内存和盘劈成两半(内存带预览、盘上 null),且「列已有值」的早退让这一分叉再也补不回来。
-     *  本体同步执行到底,中间没有 await ⇒ 副本落盘与合回之间没有别的写者插进来。 */
+     *  预览补写不碰 `updatedAt`(一次预览补写不是一次活性刷新)。 */
     fillObjectivePreview(taskId: string, preview: string): Promise<void>;
     requestCancel(taskId: string, owner: string | null): Promise<boolean>;
     isCancelRequested(taskId: string, owner: string | null): Promise<boolean>;
@@ -372,12 +386,6 @@ export declare class FileRunStore implements InProcessClaimFence {
     private releaseClaim;
     /** Drop a run entirely (registry + event log + open fd + on-disk dir) — used by deleteBySession. */
     private dropRun;
-    /**
-     * 一次性迁移 **M6 的 local 腿**(窗、删法与删后谁接住:窗口见 `plugins/one-time-migrations.ts` 登记表):把 ≤7.115.x 写下的死亡判决行
-     * (`failed` ∧ 码列空 ∧ 句子是那两句,判据 = `readLegacyHolderDeathCode`)补上机读码,盘上(`run.json` 整份原子替换,同 `persist`)与内存同改。
-     * 起服时调(`LocalBackend.runOneTimeMigrations`,任何读者之前);数据根独占 ⇒ 本车道没有滚动升级窗,不需要读侧半场。幂等:第二跑零命中零写盘。
-     */
-    migrateLegacyHolderDeathCodes(): number;
     /**
      * 一次性迁移 **M32 的 local 腿**(执行放置回填;窗、删法与删后谁接住:窗口见 `plugins/one-time-migrations.ts` 登记表):有 run 行的会话 id(去重)。
      * 起服时调(`LocalBackend.runOneTimeMigrations`,任何读者之前);读内存索引(构造时已从盘上 hydrate),零写。