@sema-agent/server 7.145.0 → 7.147.0

package/dist/plugins/one-time-migrations.js

@@ -4,29 +4,25 @@ import { judgeCheckpointIndexCells } from "./checkpoint-index-columns.js";
 import { dialectProtocolJsonEncoder } from "./sql-driver.js";
 import { SCHEMA_STATEMENTS, acquireEnsureSchemaLock, releaseEnsureSchemaLock } from "./tidb-pool.js";
 import { PG_SCHEMA_STATEMENTS, acquirePgEnsureSchemaLock, releasePgEnsureSchemaLock } from "./pg-pool.js";
-import { CENTRAL_SCHEMA_INDEXES } from "./schema-indexes.js";
-import { ensureIndexes } from "./ensure-index.js";
-import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readNonNullJsonValueColumn, readOpaqueJsonValueColumn, } from "./sql-json-column.js";
+import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readOpaqueJsonValueColumn, } from "./sql-json-column.js";
 import { incarnationFromCell, sessionFaceFromRow } from "../session-incarnation.js";
-import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR, StoreBootRefusalError } from "./store-contracts.js";
+import { StoreBootRefusalError } from "./store-contracts.js";
 import { PERMISSION_RULE_TABLE, SqlDurableRulePartitionProvider, isSqlBucketRefusal, isSqlBucketVanished, listRuleBucketOwners, purgeUndurableScopeRows } from "./permission-rule-store-sql.js";
 import { SESSION_RULES_COLUMN } from "./session-rules-column.js";
 import { readJsonObjectColumn } from "./sql-json-column.js";
 import { retireStoredCardWords } from "../retired-card-words.js";
 import { redactSecrets } from "../trace/redact.js";
 import { CLAIM_OWNERLESS_PLACED_SQL, claimOwnerlessParams, isOrphanSessionOwner, judgeDelegatedOwner } from "../delegated-session-owner.js";
-import { MAILBOX_KEYED_TABLES, mailboxKeyDeleteSql, storedMailboxKeyless } from "./mailbox-store-sql.js";
-import { SESSION_META_PLACEMENT_COLUMNS, backfillWriterStatement, countOrphanBindingsStatement, migrateDeviceBindingsStatement } from "./execution-placement-sql.js";
+import { MAILBOX_KEYED_TABLES, mailboxKeyDeleteSql, storedMailboxKeyless } from "../stores-sql/mailbox-store-sql.js";
+import { backfillWriterStatement, countOrphanBindingsStatement, migrateDeviceBindingsOntoSideTableStatements, migrateDeviceBindingsStatement } from "./execution-placement-sql.js";
+import { EXECUTION_PLACEMENT_COLUMNS, SESSION_EXT_COLUMNS, SESSION_EXT_TABLE } from "./session-ext-table.js";
 import { APPROVAL_ASK_ENDING_CAUSE_COLUMN, APPROVAL_ASK_EXECUTION_LANE_COLUMN, APPROVAL_ASK_PARK_TRIGGER_COLUMN, APPROVAL_ASK_TABLE } from "./approval-ask-store-sql.js";
+import { RENAMED_EXECUTION_LANE_M40, RETIRED_EXECUTION_LANE_WORD_M40, retiredExecutionLaneHintM40 } from "./execution-lane-rename-m40.js";
 import { retireImportedLayerRootAllows } from "./imported-layer-root-retirement.js";
 import { isUnusableArchive } from "../execution-placement.js";
 const RETIRED_SESSION_RULE_BUCKETS = ["commandAllow", "commandDeny"];
 export function buildMigrationReceipts() {
     return {
-        holderDeathCodeRowsBackfilled: 0,
-        allowRuleShadowRowsMigrated: 0,
-        allowRuleShadowRowsUnreadable: 0,
-        workflowParkIndexRowsCarried: 0,
         undurableScopeRuleRows: [],
         undurableScopeRuleBucketsDeferred: 0,
         undurableScopeRuleBucketsUnreadable: [],
@@ -55,6 +51,9 @@ export function buildMigrationReceipts() {
         deviceBindingTablesDropped: 0,
         executionPlacementsBackfilled: 0,
         askExecutionLanesBackfilled: 0,
+        executionLaneWordsRenamed: 0,
+        sessionExtRowsMoved: 0,
+        sessionMetaColumnsDropped: 0,
         executionPlacementSessionsUnreadable: [],
         localArchiveRowFactsBackfilled: 0,
         localArchivesAnonymized: 0,
@@ -66,22 +65,18 @@ export function buildMigrationReceipts() {
         askJournalRecordsUpgraded: 0,
         importedLayerRootAllowsRetired: [],
         importedLayerRootBucketsSkipped: [],
+        importedLayerRootBucketsUnnamed: 0,
     };
 }
 function completedReport(r) {
-    const { workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn } = r;
-    if (workflowParkIndexKey === undefined || sessionRuleColumn === undefined || workflowJournalScopeColumn === undefined) {
-        throw new Error(`one-time migrations finished without settling a shape reading (M9 ${String(workflowParkIndexKey)} / M17 ${String(sessionRuleColumn)} / M24 ${String(workflowJournalScopeColumn)}) — a step did not record it`);
+    const { sessionRuleColumn, workflowJournalScopeColumn } = r;
+    if (sessionRuleColumn === undefined || workflowJournalScopeColumn === undefined) {
+        throw new Error(`one-time migrations finished without settling a shape reading (M17 ${String(sessionRuleColumn)} / M24 ${String(workflowJournalScopeColumn)}) — a step did not record it`);
     }
-    return { ...r, workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn };
+    return { ...r, sessionRuleColumn, workflowJournalScopeColumn };
 }
 function changedAnything(r) {
-    return (r.holderDeathCodeRowsBackfilled > 0 ||
-        r.allowRuleShadowRowsMigrated > 0 ||
-        r.allowRuleShadowRowsUnreadable > 0 ||
-        r.workflowParkIndexKey === "reshaped" ||
-        r.workflowParkIndexRowsCarried > 0 ||
-        r.undurableScopeRuleRows.length > 0 ||
+    return (r.undurableScopeRuleRows.length > 0 ||
         r.undurableScopeRuleBucketsDeferred > 0 ||
         r.undurableScopeRuleBucketsUnreadable.length > 0 ||
         r.sessionRuleColumn === "renamed" ||
@@ -111,6 +106,9 @@ function changedAnything(r) {
         r.deviceBindingTablesDropped > 0 ||
         r.executionPlacementsBackfilled > 0 ||
         r.askExecutionLanesBackfilled > 0 ||
+        r.executionLaneWordsRenamed > 0 ||
+        r.sessionExtRowsMoved > 0 ||
+        r.sessionMetaColumnsDropped > 0 ||
         r.executionPlacementSessionsUnreadable.length > 0 ||
         r.localArchiveRowFactsBackfilled > 0 ||
         r.localArchivesAnonymized > 0 ||
@@ -121,7 +119,8 @@ function changedAnything(r) {
         r.askParkTriggersMoved > 0 ||
         r.askJournalRecordsUpgraded > 0 ||
         r.importedLayerRootAllowsRetired.length > 0 ||
-        r.importedLayerRootBucketsSkipped.length > 0);
+        r.importedLayerRootBucketsSkipped.length > 0 ||
+        r.importedLayerRootBucketsUnnamed > 0);
 }
 function readingsSnapshot(r) {
     return {
@@ -163,60 +162,6 @@ export class OneTimeMigrationInterruptedError extends Error {
     }
 }
 export const ONE_TIME_MIGRATIONS = [
-    {
-        id: "M6",
-        introducedIn: "7.116.0",
-        releasedOn: "2026-10-05",
-        removableAfter: "2026-11-04",
-        removal: "删 migrateOn 的 M6 步(`task_run` 两条 `UPDATE … SET error_code`)与 local 腿 `FileRunStore.migrateLegacyHolderDeathCodes`(及 " +
-            "`LocalBackend.runOneTimeMigrations` 里那一格);报告与日志行的 `holderDeathCodeRowsBackfilled`;**连同读侧半场一起删**:" +
-            "`store-contracts.ts` 的 `readLegacyHolderDeathCode` 与 SQL 行映射 `run-store-sql.ts#rowToRun` 里对它的调用(码列改回原样读)",
-        afterRemoval: "没有响亮臂:窗关删码之后仍只有句子、码列为空的行(跳过了所有带 M6 的版本直接升的库,或窗关之后还在写的 ≤7.115.x 副本)不再被判成持有者死亡 —— " +
-            "用户输入受理账本的收敛判词(`user-input-ledger.ts` `judgeOpen`)对这种行落到「其余」臂 `leg_over`:补落 `settled{leg_end}`、不告知,那条 run 上" +
-            "丢掉的 steer 不再告诉用户;`GET /v1/runs/:id` 上 `errorCode` 缺席、只剩 `error` 句子",
-        reportKeys: ["holderDeathCodeRowsBackfilled"],
-    },
-    {
-        id: "M7",
-        introducedIn: "7.117.0",
-        releasedOn: "2026-10-06",
-        removableAfter: "2026-11-05",
-        removal: "删 `http/checkpoint-ctx.ts` 的读法记号判据与拒臂(`allowListReadingUnstated` / `allowListReadingEraOf` / `allowListReadingRefusal` / " +
-            "`PERMISSIONS_ALLOW_READINGS` / `ALLOW_LIST_READING_ERAS`、`buildCheckpointCtx` 里的记号写点)、`CheckpointCtx.permissionsAllowReading`、" +
-            "`resume-legs.ts` 两个判点与 `approval-sweeps.ts` 的跳过臂、随包排空判据 `permissions-allow-list`(两份 SQL + 本地脚本那一条)",
-        afterRemoval: "没有响亮臂:删码之后仍停驻、体里带非空 allow 的旧读法行(把 `APPROVAL_TERMINAL_BACKSTOP_MS` 调长的部署,或跳过了带本条的版本直接升的库)会被按" +
-            "当前读法静默重放(名单时代的行:名单外的工具放开;表态时代的行:普通问不再问)—— 升级前按 MIGRATION 7.117.0 节跑排空判据清零",
-        reportKeys: [],
-    },
-    {
-        id: "M8",
-        introducedIn: "7.117.0",
-        releasedOn: "2026-10-06",
-        removableAfter: "2026-11-05",
-        removal: "删 migrateOn 的 M8 步(`checkpoint.risk_descriptor` 的旧键扫描 + CAS 回写)与 `migrateShadowedRuleKey` / `migrateShadowedRuleDescriptor`;" +
-            "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `allowRuleShadowRowsMigrated` / `allowRuleShadowRowsUnreadable`",
-        afterRemoval: "没有响亮臂:删码之后仍带旧键的停驻行(跳过了带本条的版本直接升的库)在运维待批队列上只缺结构化披露 `allowRuleShadowed`;旧键的文本仍经脱敏叶表" +
-            "「认不得的键按内容脱敏」一条脱敏后原样显示,卡上 `message` 里引擎写好的那句话不受影响",
-        reportKeys: ["allowRuleShadowRowsMigrated", "allowRuleShadowRowsUnreadable"],
-    },
-    {
-        id: "M9",
-        introducedIn: "7.118.0",
-        releasedOn: "2026-10-07",
-        removableAfter: "2026-11-06",
-        removal: "删 migrateOn 的 M9 步(`reshapeWorkflowParkIndex` / `execAtomically` / `finishParkIndexShape`:收尾段、主键宽度探针、暂存表复制、换名、删旧表、索引补建、主键约束名)与 " +
-            "`primaryKeyWidth` / `WORKFLOW_PARK_INDEX_TABLE` / `WORKFLOW_PARK_INDEX_STAGING` / `WORKFLOW_PARK_INDEX_RETIRED`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 " +
-            "`workflowParkIndexKey` / `workflowParkIndexRowsCarried`;**连同读侧半场一起删**(都是「引擎 7.43 及以前写下的 workflow 子代停驻记录」这同一件事,同窗同删,不另起登记行):" +
-            "`orchestration/workflow-agent-session-index.ts` 的 `older_engine` 读臂(`routeWorkflowPark` 规则 ③、`WorkflowParkRoute` 与 `parked-decide.ts` `ParkOrigin` 上 `cause` 里的这一词," +
-            "`denyWorkflowParksUnreadable` 的对应分支;`unreadable` 成为唯一成因)与随包排空判据 `workflow-park-holder`(`scripts/drain-check.mysql.sql` / `scripts/drain-check.pg.sql` 的那一段" +
-            "与文件头判据清单里的那一行、`scripts/drain-check-local.mjs` 的 `DRAIN_CRITERIA` 那一条与 `readParkIndex`,以及 `MIGRATION.md` / `docs/DEPLOY-PREREQS.md` 里点名它的说明)",
-        afterRemoval: "没有响亮臂:删码之后仍是旧主键(只有 `session_id`)的库(跳过了带本条的版本直接升)上,同一个子会话只能有一枚指针 —— 续跑链 / 分叉里" +
-            "后写的那条记录覆盖先写的,判决只看得到一条记录:分叉判不出、链尾可能被更早的记录盖掉(决定投给那一条)。运维手工照中央 DDL 重建这张表即可" +
-            "(它是派生投影,丢了只丢升级那一刻还停驻着的旧卡的指针 —— 那些卡改答诚实 miss)。读侧半场删后:升级那一刻还停驻着、点名它的条目没有持有者位的存量卡" +
-            "(跳过了带本条的版本直接升的库)路由判 `none` ⇒ 落 legacy 腿,答 `409 conflict.resume_context_unavailable`(响亮,但成因是子会话没有续跑上下文,不再是 " +
-            "`decide.workflow_parks_unreadable`);出路不变(续跑发起它的那条 workflow run);随包排空判据没了,换钉前没有机器读数可数这些卡",
-        reportKeys: ["workflowParkIndexKey", "workflowParkIndexRowsCarried"],
-    },
     {
         id: "M10",
         introducedIn: "7.119.0",
@@ -349,6 +294,9 @@ export const ONE_TIME_MIGRATIONS = [
             "`test/task-a2a.test.ts` 里的克隆钉(标题去掉开头的 `🔴 ` 后以 `克隆钉:` 开头的各格,整格删;按这个精确前缀删,不按标题里的「M19 重读」之类泛词删 —— 那会误删同文件里的通用不变式钉),以及三格不带前缀、删码后要改写的钉:`需要「读」的两个键…` 那格的 `readRequestToolAxes` 调用方名单(`normalizeA2aPeer` 只在 M19 重读臂里调它,删后名单只剩 `mintPeerSnapshot`,标题里「与读器里 M19 重读产物的那一次」半句同删)、`读器与门的差别只有三格…` 改成两格(删 ③ 的注释行与标题里的 ③)、`请求入口快照的形…` 里 `snapshotRequestA2a(…, { reread: false })` 的第二实参(删 `reread` 形参后改成单参);" +
             "`test/one-time-migration-window-gate.test.ts` 里 M19 一节中与克隆有关的三格(声明抽取器正负控 · 删法条与克隆名字两向对账 · 克隆钉标题前缀对账)与它们共用的帮手 `declaredNames`;" +
             "`test/mcp-tool-axes-m19.test.ts`(窗关那一格 —— 存量坏形整条不进、warn 与通告点名 `field: toolAxes` —— 改钉到 `test/task-mcp.test.ts`);" +
+            "「请求成员读不出」一问上的重读座走线:`http/stored-body-replay.ts` 里递给 `unreadRequestMembers` 的 `storedToolAxes: storedToolAxesRereadM19(today)` 与它的 import," +
+            "`unread-request-members.ts` 的 `StoredToolAxesRereadM19` 型 import、`UnreadMembersLeg` 续跑臂的 `storedToolAxes` 字段与 `unreadRequestMembers` 里取它、递给两只谓词的那几处," +
+            "`task-mcp.ts` 的 `requestMcpTransportUnread` 与 `task-a2a.ts` 的 `requestA2aHeadersUnread` 的 `storedToolAxes` 形参(连同它们递给 `normalizeServer` / `normalizeA2aPeer` 的那一实参);" +
             "本文件的 `migrationWindowOpen`(若再无别的读者)",
         afterRemoval: "没有新的臂,接住它的是今天的读法(删码零行为变化:窗关那一刻起重读臂已经不生效):升级前存下的请求体里引擎判官判不过的 `toolAxes`,续跑重放时这一条 server 整条不进," +
             "运维 warn `mcp_injection_dropped`(`reason: malformed_entry`、`field: toolAxes`)+ 用户面通告 `mcp.injection_dropped`,兄弟照挂;停驻在这台 server 工具审批上的任务" +
@@ -362,14 +310,16 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.131.0",
         releasedOn: "2026-10-16",
         removableAfter: "2026-11-15",
-        removal: "删 `src/stored-request-hooks-m20.ts` 整只文件(`storedHooksRereadM20` / `rereadStoredHooksM20` / `StoredHooksRereadM20` / `ENTRY_FIELD_NAMES` / `MATCHER_FIELD_NAMES` / `nodeAt` / `cloneDoc` / `removeKeyAt`);" +
+        removal: "删 `src/stored-request-hooks-m20.ts` 整只文件(`storedHooksRereadM20` / `rereadStoredHooksM20` / `StoredHooksRereadM20` / `MATCHER_FIELD_NAMES` / `nodeAt` / `cloneDoc` / `removeKeyAt`);" +
             "`boot/resolve-spec.ts` 里递给 `parseTaskSettings` 的重读座实参(`opts?.leg === \"fresh\" || !taskHooksHonored(config) ? {} : { storedHooksReread: storedHooksRereadM20(…) }`)与它的 import、" +
             "`hooks_read_as_before_upgrade` 那一段 warn;`task-settings.ts` 的 `ParseTaskSettingsSeats` / `ParseTaskSettingsResult.hooksReread` / `parseTaskSettings` 第二形参与 hooks 臂里的重读那一支;" +
             "`hooks/hook-runner.ts` 的 `ParseHooksConfigResult.pieces` / `HooksRefusalPiece`(若再无别的读者)与 `hooksCoordinate` 的 export;" +
-            "`test/hooks-stored-reread-m20.test.ts`(窗关那一格 —— 整份不采纳 + `server.hooks.resume-reader-refused` 计一笔 —— 改钉到 `test/hooks-entry-admission.test.ts` 的续跑腿组)",
-        afterRemoval: "没有新的臂,接住它的是今天的读法(删码零行为变化:窗关那一刻起重读臂已经不生效):升级前存下的请求体里带这两形的 `settings.hooks`,续跑重放时整份不采纳(其中真在拦的 `PreToolUse` 钩子也不再拦)," +
-            "运维 warn `task_settings_deferred`(字段 `hooks`)+ fail-open 登记 `server.hooks.resume-reader-refused`(计数 + 探针 + 一次性 warn,census 第 140 行),任务照常续跑 —— " +
-            "出路是把这类停驻任务决掉、删掉那个未知字段 / `__proto__` 键后重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行(头注 M20 段)",
+            "「请求成员读不出」一问上的重读座走线:`unread-request-members.ts` 的 `storedHooksRereadM20` import 与 `unreadRequestMembers` 里 `hooksReread` 那一行(递给 `parseTaskSettings` 的 `storedHooksReread` 座)、" +
+            "`UnreadMembersLeg` 续跑臂的 `today` 字段(只为 M20 的窗问它)与 `http/stored-body-replay.ts`、`boot/resolve-spec.ts` 递 `today` 的那两处(`stored-body-replay.ts` 的 `today` 局部若 M19 已删再无读者一并删);" +
+            "`test/hooks-stored-reread-m20.test.ts`(窗关那一格 —— 续跑拒 409 `resume_blocked_by_policy` —— 改钉到 `test/hooks-entry-admission.test.ts` 的续跑腿组)",
+        afterRemoval: "没有新的臂,接住它的是今天的读法(删码零行为变化:窗关那一刻起重读臂已经不生效):升级前存下的请求体里带这两形的 `settings.hooks`,在会采纳 hooks 的车道上续跑被拒 —— " +
+            "「请求成员读不出」判据(`src/unread-request-members.ts`)答 409 `resume_blocked_by_policy`(`blockedBy: request.field_invalid`,`field: settings.hooks`),卡仍待决、行不动(7.147.0 起;此前是整份不采纳照跑)—— " +
+            "出路是取消这类停驻任务、删掉那个未知字段 / `__proto__` 键后重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行(头注 M20 段)",
         reportKeys: [],
     },
     {
@@ -411,7 +361,7 @@ export const ONE_TIME_MIGRATIONS = [
             "`test/one-time-migrations.test.ts` 的 M23 组与 `test/one-time-migrations-db-integration.test.ts` 的 M23 格。" +
             "**不随本条删**:`ORPHAN_SESSION_OWNER_PREFIX` 与它在 `security.ts` 保留主体前缀里的登记(已落库的行可能带哨兵,永久保留);" +
             "属主为 NULL 的 placed 行只对 fleet 调用方放行(`security.ts` 的 `ownerlessRowOpen` / `sessionOwnerCellOf` 与各门读 `placementOf` 的那一次)—— 那是常设的读面律",
-        afterRemoval: "会话面的读面律(常设,不随本条删)接住:跳过了带本条的版本直接升的库里,属主为 NULL 的存量 placed 子代行只对 fleet 调用方放行(出示 service 凭据、不报主体;dev-open)," +
+        afterRemoval: "会话面的读面律(常设,不随本条删)接住:跳过了带本条的版本直接升的库里,属主为 NULL 的存量 placed 子代行只对 fleet 调用方放行(出示 service 凭据、不报主体 —— 除非部署声明 `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT=false`,那时这一形是无身份调用方、不在其内;或 dev-open 部署上的任何调用方)," +
             "其余调用方答 404(与别人的行同体)—— 出路是升级时先过一次带本条的版本,或运维按 `placement_root_session_id`(缺则 `placement_parent_session_id`)那一行的属主手工回填、" +
             "推不出的写一个任何主体都不匹配的值;停驻挂点只比对宿主行属主与引擎交来的属主(复活腿交那一行自己的属主),不写无主行;" +
             "建行那一笔记 `placement.owner` 不随本条删(那是常设的写法 —— core 盒义务 7,不是迁移)",
@@ -472,13 +422,13 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.134.0",
         releasedOn: "2026-10-21",
         removableAfter: "2026-11-20",
-        removal: "删 `src/checkpoint-ctx-seal-m28.ts` 整个文件(`sealCheckpointCtxCredentialsM28`)与起服第 6 段(`src/boot/stage-06-runners.ts`)顶部对 `sealCheckpointCtxCredentialsM28` 的 import 行与对它的那一处调用(连同起服 info 行 `checkpoint_ctx_credentials_sealed`);两孪生共有的 ctx 行改写店腿(`src/plugins/checkpoint-store-sql.ts` 与 `src/plugins/local-checkpoint-store.ts` 里的 `rewriteCtxRows` / `CtxRowsRewrite` / `CtxRowRewrite` / `CheckpointCtxRowsRewriter` / 扫描页 `CTX_REWRITE_PAGE`)只在本表再无别的条目用它时(今天 M30 也用)一起删;店腿删时 `test/checkpoint-ctx-sealed-brand.test.ts` 里 `rewriteCtxRows` 的断言(`@ts-expect-error` 与 `void local.rewriteCtxRows(` 两行)一起删 —— 店腿不在后那一行的 tsc 错变成「属性不存在」,`@ts-expect-error` 照样满足,断言静默变空 —— 同文件 `putCtx` 的常设断言保留;**店腿格不随本条删**:`test/checkpoint-ctx-rows-rewrite-db-integration.test.ts`(店腿自己的 CAS / 分页 / 一行装不下三格)与 `test/checkpoint-ctx-rows-rewrite-local.test.ts`(读不出的档 / 信封 updatedAt 不动两格)用中性的行改写、不借任何一条迁移的函数,店腿还有用户时它们要活着;店腿删时两个文件整文件随店腿删,`scripts/db-integration-files.json` 里 db 那个文件的行同删;店腿删时的同族注释(店腿是两条迁移共用的,谁后删谁做;两条 removal 都点名,逐条同字面):`src/http/checkpoint-ctx.ts`:「与一次性迁移的 ctx 行改写店腿(`rewriteCtxRows`)」删;`test/checkpoint-ctx-sealed-brand.test.ts`:「与 ctx 行改写回调(M28 / M30 共用)」删、「,M28 行改写回调交回裸对象 —— 三处都是 tsc 错」改成「 —— 两处都是 tsc 错」;`test/checkpoint-ctx-credential-seal-db-integration.test.ts`:「另有各随一条一次性迁移的格」起到「别的文件的行一个都不碰);」止整段删;" +
+        removal: "删 `src/checkpoint-ctx-seal-m28.ts` 整个文件(`sealCheckpointCtxCredentialsM28`)与起服第 6 段(`src/boot/stage-06-runners.ts`)顶部对 `sealCheckpointCtxCredentialsM28` 的 import 行与对它的那一处调用(连同起服 info 行 `checkpoint_ctx_credentials_sealed`);两孪生共有的 ctx 行改写店腿(`src/stores-sql/checkpoint-store-sql.ts`、`src/plugins/checkpoint-store-face.ts` 与 `src/plugins/local-checkpoint-store.ts` 里的 `rewriteCtxRows` / `CtxRowsRewrite` / `CtxRowRewrite` / `CheckpointCtxRowsRewriter` / 扫描页 `CTX_REWRITE_PAGE`)只在本表再无别的条目用它时(今天 M30 也用)一起删;店腿删时 `test/checkpoint-ctx-sealed-brand.test.ts` 里 `rewriteCtxRows` 的断言(`@ts-expect-error` 与 `void local.rewriteCtxRows(` 两行)一起删 —— 店腿不在后那一行的 tsc 错变成「属性不存在」,`@ts-expect-error` 照样满足,断言静默变空 —— 同文件 `putCtx` 的常设断言保留;**店腿格不随本条删**:`test/checkpoint-ctx-rows-rewrite-db-integration.test.ts`(店腿自己的 CAS / 分页 / 一行装不下三格)与 `test/checkpoint-ctx-rows-rewrite-local.test.ts`(读不出的档 / 信封 updatedAt 不动两格)用中性的行改写、不借任何一条迁移的函数,店腿还有用户时它们要活着;店腿删时两个文件整文件随店腿删,`scripts/db-integration-files.json` 里 db 那个文件的行同删;店腿删时的同族注释(店腿是两条迁移共用的,谁后删谁做;两条 removal 都点名,逐条同字面):`src/http/checkpoint-ctx.ts`:「与一次性迁移的 ctx 行改写店腿(`rewriteCtxRows`)」删;`test/checkpoint-ctx-sealed-brand.test.ts`:「与 ctx 行改写回调(M28 / M30 共用)」删、「,M28 行改写回调交回裸对象 —— 三处都是 tsc 错」改成「 —— 两处都是 tsc 错」;`test/checkpoint-ctx-credential-seal-db-integration.test.ts`:「另有各随一条一次性迁移的格」起到「别的文件的行一个都不碰);」止整段删;" +
             "`http/checkpoint-ctx.ts` 的 `sealStoredCheckpointCtxM28`;`test/checkpoint-ctx-seal-m28.test.ts` 整个文件与 `test/checkpoint-ctx-credential-seal-db-integration.test.ts` 里的「[M28] 明文旧行」那一格(它调 `sealStoredCheckpointCtxM28`);" +
             "`test/doc-claims-upgrade-notes.test.ts` ㊵ 组里读这处调用与日志行的三行断言随删(两格本身与其余断言留着;不删就是删码后这两格红):「锚(嵌入方段的每件事实读实现)」格的 `callSites(\"sealCheckpointCtxCredentialsM28\")` 一行;" +
             "「锚(恢复句的每件事实读实现)」格里 guarded 上对 `sealCheckpointCtxCredentialsM28` 调用的断言与对 `logger.info(\"checkpoint_ctx_credentials_sealed\"` 日志行的断言两行;" +
             "`test/stored-request-prompt-profile-m30.test.ts` 里钉起服第 6 段调用次序的那一格(`describe` 名含「起服接线」;M30 删码时才删它,M28 的窗先关,先删 M28 时它要活着)里读 M28 调用位置的 `const m28` 那一行(它用 indexOf 找 `sealCheckpointCtxCredentialsM28` 的调用)与「M28 在那一臂里」「M30 在那一臂里、M28 之后」两条断言,改成只相对 `guard` 比较 M30 的位置;" +
             "依赖本行的格(行一删就红):doc-claims ㊵ 的「嵌入方一段分清两只迁移的窗」格(读 M28 / M30 两行的窗末日;哪一行先删就先删这一格,MIGRATION 7.137.0 节的文字是已发布的历史、留着不动),`test/stored-request-prompt-profile-m30.test.ts` 里「M28 登记行」组整组随删(组内三格都读 M28 行的 `removal`:「M28 的 removal 同样点名」「M28 删法条补四类漏项」「同一注释半句只归一条 removal」)、同文件 SHARED 表里 rows 含 M28 的五行改成只剩 M30 并入 SITES(M30 的登记行组已先删时该表已不在,这一句无事可做);" +
-            "同族注释(每个半句只归本条或 M30 条之一,不重复改;标〔另一条的〕的几处住在另一条迁移的文件 / 头注段里,那条已先删则宿主已不在,跳过):`src/http/checkpoint-ctx.ts`:「一次性迁移 M28 对存量行用同一只走法」删、「({@link sealStoredCheckpointCtxM28})」删、「、{@link sealStoredCheckpointCtxM28}」删、「(开口与 M28 同一只)」删、「(更早版本写下、M28 还没扫到)」改成「(更早版本写下)」、「读写两侧与一次性迁移 M28 共用」改成「读写两侧共用」、「已落盘的行由 M28 补封」改成「已落盘的行不补封(要补封须另起迁移)」、「M28 封的是」起到「窗外加位要另起迁移)。」止整段删、「(读写两侧与 M28 共用这一只)」改成「(读写两侧共用这一只)」、「(开口与 M28 共用这一只判词,闭集三词)」改成「(开口用这一只判词,闭集三词)」、「开口去开它;M28 不动它;」改成「开口去开它;」、「M28 把它封好;」删、「M28 不动它(留给读口响亮拒)」改成「(留给读口响亮拒)」、「封口 / 开口 / M28 共用的那一只」改成「封口 / 开口共用的那一只」;`src/sealed-key.ts`:「起服的一次性迁移 M28 会用它把还读得懂的明文行换成谁都开不开的密文」改成「新写的停驻行会被封成谁都开不开的密文」;`src/boot/web-admin.ts`:「与一次性迁移 M28(stage-06)」删、「M28 会拿它毁掉还读得懂的行」改成「新写的停驻行会被封成谁都开不开的密文」;`src/boot/stage-06-runners.ts`:「也是一次性迁移 M28 要它的地方。M28 在任何路由装配之前跑(窗外不扫;读数一行 info)。」删、「排在 M28 之后」删;`src/plugins/checkpoint-store-sql.ts`:「M28(凭据位明文封好)」删;`src/stored-request-prompt-profile-m30.ts`:〔另一条的〕「,与 M28 同一只」删、〔另一条的〕「本条与 M28 同在起服第 6 段」改成「本条在起服第 6 段」、〔另一条的〕「(M28 用同一只)」删;`src/plugins/one-time-migrations.ts`:〔另一条的〕「起服第 6 段 M28 之后调一次」改成「起服第 6 段调一次」、〔另一条的〕「店腿是两孪生共有的 `rewriteCtxRows`,与 M28 同一只」改成「店腿是两孪生共有的 `rewriteCtxRows`」;`test/owner-gate-single-owner.test.ts`:「两只封口 `sealCheckpointCtx` / `sealStoredCheckpointCtxM28` 经它」改成「封口 `sealCheckpointCtx` 经它」;`test/drain-check-local.test.ts`:「封口 / 开口 / M28 共用的凭据位遍历器」改成「封口 / 开口共用的凭据位遍历器」;`test/checkpoint-ctx-credential-seal.test.ts`:「(否则 M28 会把可用的明文行换成谁都开不开的密文)」改成「(否则新写的停驻行会被封成谁都开不开的密文)」;`test/helpers/ctx-sealing.ts`:「 / M28 的行改写」删;`test/checkpoint-ctx-credential-seal-db-integration.test.ts`:「/ `checkpoint-ctx-seal-m28.test.ts`」删、「窗与读数那一层在 local 半场(`checkpoint-ctx-seal-m28.test.ts`)钉」起到「两半场共用同一只行改写 `sealStoredCheckpointCtxM28`。」止整段删;`test/checkpoint-ctx-sealed-brand.test.ts`:「与 M28 的行改写(`sealStoredCheckpointCtxM28`)」删;" +
+            "同族注释(每个半句只归本条或 M30 条之一,不重复改;标〔另一条的〕的几处住在另一条迁移的文件 / 头注段里,那条已先删则宿主已不在,跳过):`src/http/checkpoint-ctx.ts`:「一次性迁移 M28 对存量行用同一只走法」删、「({@link sealStoredCheckpointCtxM28})」删、「、{@link sealStoredCheckpointCtxM28}」删、「(开口与 M28 同一只)」删、「(更早版本写下、M28 还没扫到)」改成「(更早版本写下)」、「读写两侧与一次性迁移 M28 共用」改成「读写两侧共用」、「已落盘的行由 M28 补封」改成「已落盘的行不补封(要补封须另起迁移)」、「M28 封的是」起到「窗外加位要另起迁移)。」止整段删、「(读写两侧与 M28 共用这一只)」改成「(读写两侧共用这一只)」、「(开口与 M28 共用这一只判词,闭集三词)」改成「(开口用这一只判词,闭集三词)」、「开口去开它;M28 不动它;」改成「开口去开它;」、「M28 把它封好;」删、「M28 不动它(留给读口响亮拒)」改成「(留给读口响亮拒)」、「封口 / 开口 / M28 共用的那一只」改成「封口 / 开口共用的那一只」;`src/sealed-key.ts`:「起服的一次性迁移 M28 会用它把还读得懂的明文行换成谁都开不开的密文」改成「新写的停驻行会被封成谁都开不开的密文」;`src/boot/web-admin.ts`:「与一次性迁移 M28(stage-06)」删、「M28 会拿它毁掉还读得懂的行」改成「新写的停驻行会被封成谁都开不开的密文」;`src/boot/stage-06-runners.ts`:「也是一次性迁移 M28 要它的地方。M28 在任何路由装配之前跑(窗外不扫;读数一行 info)。」删、「排在 M28 之后」删;`src/plugins/checkpoint-store-face.ts`:「M28(凭据位明文封好)」删;`src/stored-request-prompt-profile-m30.ts`:〔另一条的〕「,与 M28 同一只」删、〔另一条的〕「本条与 M28 同在起服第 6 段」改成「本条在起服第 6 段」、〔另一条的〕「(M28 用同一只)」删;`src/plugins/one-time-migrations.ts`:〔另一条的〕「起服第 6 段 M28 之后调一次」改成「起服第 6 段调一次」、〔另一条的〕「店腿是两孪生共有的 `rewriteCtxRows`,与 M28 同一只」改成「店腿是两孪生共有的 `rewriteCtxRows`」;`test/owner-gate-single-owner.test.ts`:「两只封口 `sealCheckpointCtx` / `sealStoredCheckpointCtxM28` 经它」改成「封口 `sealCheckpointCtx` 经它」;`test/drain-check-local.test.ts`:「封口 / 开口 / M28 共用的凭据位遍历器」改成「封口 / 开口共用的凭据位遍历器」;`test/checkpoint-ctx-credential-seal.test.ts`:「(否则 M28 会把可用的明文行换成谁都开不开的密文)」改成「(否则新写的停驻行会被封成谁都开不开的密文)」;`test/helpers/ctx-sealing.ts`:「 / M28 的行改写」删;`test/checkpoint-ctx-credential-seal-db-integration.test.ts`:「/ `checkpoint-ctx-seal-m28.test.ts`」删、「窗与读数那一层在 local 半场(`checkpoint-ctx-seal-m28.test.ts`)钉」起到「两半场共用同一只行改写 `sealStoredCheckpointCtxM28`。」止整段删;`test/checkpoint-ctx-sealed-brand.test.ts`:「与 M28 的行改写(`sealStoredCheckpointCtxM28`)」删;" +
             "**不随本条删**:凭据位密封的常设规则(封口 / 开口 / 闭集 / 读口第四态 / 409 码 / 装配期拒启)",
         afterRemoval: "读口对凭据位上明文的常设拒臂接住:跳过了带本条的版本直接升的库,带明文凭据的停驻行续跑答 409 `conflict.checkpoint_ctx_unsealable`(`reason:\"plaintext\"`)," +
             "行字节不动 —— 出路 = 作为新任务重提(仍停驻的先取消),或升级时先过一次带本条的版本",
@@ -502,13 +452,13 @@ export const ONE_TIME_MIGRATIONS = [
         releasedOn: "2026-10-25",
         removableAfter: "2026-11-24",
         removal: "删 `src/stored-request-prompt-profile-m30.ts` 整个文件(`retirePromptProfileM30` / `retirePromptProfileRowM30` / `PromptProfileRetireM30Report`)与起服第 6 段(`src/boot/stage-06-runners.ts`)顶部对 `retirePromptProfileM30` 的 import 行与对它的那一处调用(连同起服 info 行 `checkpoint_ctx_prompt_profile_rewritten`);" +
-            "`http/checkpoint-ctx.ts` 的 `rewriteStoredBodyKeys` 与 `CREDENTIAL_SLOT_ROOTS`(若再无别的调用方);两孪生共有的 ctx 行改写店腿(`src/plugins/checkpoint-store-sql.ts` 与 `src/plugins/local-checkpoint-store.ts` 里的 `rewriteCtxRows` / `CtxRowsRewrite` / `CtxRowRewrite` / `CheckpointCtxRowsRewriter` / `CTX_REWRITE_PAGE`)只在本表再无别的条目用它时一起删(今天 M28 也用);店腿删时 `test/checkpoint-ctx-sealed-brand.test.ts` 里 `rewriteCtxRows` 的断言(`@ts-expect-error` 与 `void local.rewriteCtxRows(` 两行)一起删 —— 店腿不在后那一行的 tsc 错变成「属性不存在」,`@ts-expect-error` 照样满足,断言静默变空 —— 同文件 `putCtx` 的常设断言保留;**店腿格不随本条删**:`test/checkpoint-ctx-rows-rewrite-db-integration.test.ts`(店腿自己的 CAS / 分页 / 一行装不下三格)与 `test/checkpoint-ctx-rows-rewrite-local.test.ts`(读不出的档 / 信封 updatedAt 不动两格)用中性的行改写、不借任何一条迁移的函数,店腿还有用户时它们要活着;店腿删时两个文件整文件随店腿删,`scripts/db-integration-files.json` 里 db 那个文件的行同删;店腿删时的同族注释(店腿是两条迁移共用的,谁后删谁做;两条 removal 都点名,逐条同字面):`src/http/checkpoint-ctx.ts`:「与一次性迁移的 ctx 行改写店腿(`rewriteCtxRows`)」删;`test/checkpoint-ctx-sealed-brand.test.ts`:「与 ctx 行改写回调(M28 / M30 共用)」删、「,M28 行改写回调交回裸对象 —— 三处都是 tsc 错」改成「 —— 两处都是 tsc 错」;`test/checkpoint-ctx-credential-seal-db-integration.test.ts`:「另有各随一条一次性迁移的格」起到「别的文件的行一个都不碰);」止整段删;" +
+            "`http/checkpoint-ctx.ts` 的 `rewriteStoredBodyKeys` 与 `CREDENTIAL_SLOT_ROOTS`(若再无别的调用方);两孪生共有的 ctx 行改写店腿(`src/stores-sql/checkpoint-store-sql.ts`、`src/plugins/checkpoint-store-face.ts` 与 `src/plugins/local-checkpoint-store.ts` 里的 `rewriteCtxRows` / `CtxRowsRewrite` / `CtxRowRewrite` / `CheckpointCtxRowsRewriter` / `CTX_REWRITE_PAGE`)只在本表再无别的条目用它时一起删(今天 M28 也用);店腿删时 `test/checkpoint-ctx-sealed-brand.test.ts` 里 `rewriteCtxRows` 的断言(`@ts-expect-error` 与 `void local.rewriteCtxRows(` 两行)一起删 —— 店腿不在后那一行的 tsc 错变成「属性不存在」,`@ts-expect-error` 照样满足,断言静默变空 —— 同文件 `putCtx` 的常设断言保留;**店腿格不随本条删**:`test/checkpoint-ctx-rows-rewrite-db-integration.test.ts`(店腿自己的 CAS / 分页 / 一行装不下三格)与 `test/checkpoint-ctx-rows-rewrite-local.test.ts`(读不出的档 / 信封 updatedAt 不动两格)用中性的行改写、不借任何一条迁移的函数,店腿还有用户时它们要活着;店腿删时两个文件整文件随店腿删,`scripts/db-integration-files.json` 里 db 那个文件的行同删;店腿删时的同族注释(店腿是两条迁移共用的,谁后删谁做;两条 removal 都点名,逐条同字面):`src/http/checkpoint-ctx.ts`:「与一次性迁移的 ctx 行改写店腿(`rewriteCtxRows`)」删;`test/checkpoint-ctx-sealed-brand.test.ts`:「与 ctx 行改写回调(M28 / M30 共用)」删、「,M28 行改写回调交回裸对象 —— 三处都是 tsc 错」改成「 —— 两处都是 tsc 错」;`test/checkpoint-ctx-credential-seal-db-integration.test.ts`:「另有各随一条一次性迁移的格」起到「别的文件的行一个都不碰);」止整段删;" +
             "`http/checkpoint-ctx.ts` 的拒句铸点 `retiredRequestKeyRefusal`:模板串里从「If whoever operates this deployment restarts this server on or before 〈窗末日〉 (UTC), the stored request is rewritten in place and the same request can be sent again; otherwise submit」起的整段换成大写开头的「Submit」(窗关后重启不再改写;只删半句会留下句首小写、悬空的 otherwise),模板串变回整句双引号字面 —— 删后整句(逐字;冻结表那一行搬回字面表时也是这一句):「this task was suspended by an earlier server version and its stored request still carries promptProfile, a request key this version no longer reads (it was replaced by the boolean promptLean: classic is promptLean: false, simple is leaving promptLean out), so continuing would run the task with a prompt form it was not submitted with. Nothing was decided and nothing was resumed. Submit the work again as a new task with promptLean in place of promptProfile, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel).」," +
             "它的第二参数 `rewriteWindowEnd` 同删(定义处与私有的 `storedBodyReplayArmAnswer` 里 `retired_request_key` 臂上的那一处调用),`StoredBodyReplayRefusal` 的 `retired_request_key` 臂上的必填字段 `rewriteWindowEnd` 同删;" +
             "`src/trace/self-minted-wire.ts` 的 `refusalSentenceForm` 里「409 checkpoint.unsupported_version#retired_request_key」那一行(自铸句型登记):骨架 attr 尾上的「submit the work again」改成「Submit the work again」(删后整句的形),since 改写成删码所在的版本(该表的律:改 attr 的同时改 since);" +
             "`http/checkpoint-ctx.ts` 的日志字段铸点 `storedBodyReplayLogFields` 里 `retired_request_key` 臂的 `note` 句改成常设拒臂的句子(原句里「the one-time rewrite at startup did not reach it」与「or a restart of this version inside the window rewrites the row」两半删码后成假话,与本行 afterRemoval 的「出路 = 重提」矛盾;" +
             "改后句:「this session's stored request still carries a request key this version retired and nothing rewrites it any more; it is not replayed — the task stays suspended until someone cancels it and resubmits it as a new task (promptLean in place of promptProfile)」);" +
-            "同族注释(每个半句只归本条或 M28 条之一,不重复改;标〔另一条的〕的几处住在另一条迁移的文件 / 头注段里,那条已先删则宿主已不在,跳过):`src/http/checkpoint-ctx.ts`:「两条出路(运维在一次性迁移的窗内重启本服务 ⇒ 起服改写存体、同一请求可再发;否则作为新任务重提,仍停驻的先取消)」改成「出路(作为新任务重提,仍停驻的先取消)」、「**窗的日期不手写**」起到「删法见登记表 M30 的」止整段删、「存体里的旧键由一次性迁移在起服时原地改写」改成「存体里的旧键没有迁移改写」、「(M30,`stored-request-prompt-profile-m30.ts`,行改写经本模块的 {@link rewriteStoredBodyKeys})。改写不到的残留行」改成「仍带旧键的残留行」、「;存体由 M30 起服改写」删、「与 {@link rewriteStoredBodyKeys}」删、「(存量行非凭据顶层体键的改写,凭据位与读法记号原样随行)」删;`src/http/wire-types.ts`:「由一次性迁移 M30 在起服时按同一张映射原地改写」改成「没有迁移改写」、「(`stored-request-prompt-profile-m30.ts`;M30 · 窗口见 `plugins/one-time-migrations.ts` 登记表)」删;`src/spec-fields.ts`:「由一次性迁移 M30 在起服时改写成 `promptLean`(`stored-request-prompt-profile-m30.ts`),」改成「不改写,」;`src/boot/stage-06-runners.ts`:「M30(存体里的退役请求键 `promptProfile` 原地改写)同在这里、」删、「(同一只 ctx 行改写店腿;不要封签器),同样早于任何续跑入口。」删;`src/plugins/checkpoint-store-sql.ts`:「、M30(退役请求键改写)」删;`src/plugins/one-time-migrations.ts`:〔另一条的〕「M30 用同一只;」删;`src/checkpoint-ctx-seal-m28.ts`:〔另一条的〕「(M30 用同一只)」删;`test/task-agents-876.test.ts`:「体由一次性迁移 M30 在起服时原地改写」改成「体没有迁移改写」;`test/allow-list-reading-park-refusal.test.ts`:「一次性迁移 M30 没改写到的残留」改成「没有迁移改写的残留」;`test/api-error-text-freeze.test.ts`:「一次性迁移 M30 没改写到的残留」改成「没有迁移改写的残留」、「洞 = 窗的最后一天(绝对日期)」起到「不手写。」止整段删;" +
+            "同族注释(每个半句只归本条或 M28 条之一,不重复改;标〔另一条的〕的几处住在另一条迁移的文件 / 头注段里,那条已先删则宿主已不在,跳过):`src/http/checkpoint-ctx.ts`:「两条出路(运维在一次性迁移的窗内重启本服务 ⇒ 起服改写存体、同一请求可再发;否则作为新任务重提,仍停驻的先取消)」改成「出路(作为新任务重提,仍停驻的先取消)」、「**窗的日期不手写**」起到「删法见登记表 M30 的」止整段删、「存体里的旧键由一次性迁移在起服时原地改写」改成「存体里的旧键没有迁移改写」、「(M30,`stored-request-prompt-profile-m30.ts`,行改写经本模块的 {@link rewriteStoredBodyKeys})。改写不到的残留行」改成「仍带旧键的残留行」、「;存体由 M30 起服改写」删、「与 {@link rewriteStoredBodyKeys}」删、「(存量行非凭据顶层体键的改写,凭据位与读法记号原样随行)」删;`src/http/wire-types.ts`:「由一次性迁移 M30 在起服时按同一张映射原地改写」改成「没有迁移改写」、「(`stored-request-prompt-profile-m30.ts`;M30 · 窗口见 `plugins/one-time-migrations.ts` 登记表)」删;`src/spec-fields.ts`:「由一次性迁移 M30 在起服时改写成 `promptLean`(`stored-request-prompt-profile-m30.ts`),」改成「不改写,」;`src/boot/stage-06-runners.ts`:「M30(存体里的退役请求键 `promptProfile` 原地改写)同在这里、」删、「(同一只 ctx 行改写店腿;不要封签器),同样早于任何续跑入口。」删;`src/plugins/checkpoint-store-face.ts`:「、M30(退役请求键改写)」删;`src/plugins/one-time-migrations.ts`:〔另一条的〕「M30 用同一只;」删;`src/checkpoint-ctx-seal-m28.ts`:〔另一条的〕「(M30 用同一只)」删;`test/task-agents-876.test.ts`:「体由一次性迁移 M30 在起服时原地改写」改成「体没有迁移改写」;`test/allow-list-reading-park-refusal.test.ts`:「一次性迁移 M30 没改写到的残留」改成「没有迁移改写的残留」;`test/api-error-text-freeze.test.ts`:「一次性迁移 M30 没改写到的残留」改成「没有迁移改写的残留」、「洞 = 窗的最后一天(绝对日期)」起到「不手写。」止整段删;" +
             "`http/stored-body-replay.ts` 里 `RETIRED_KEY_REWRITE_MIGRATION` 的 JSDoc 随表删;" +
             "`http/stored-body-replay.ts` 的 `RETIRED_KEY_REWRITE_MIGRATION`(`satisfies Record<ReplayRefusedRetiredKey, string>`:M30 删后 `promptProfile` 仍是退役键,这张表只能整张删)、" +
             "判据里 `rewriteWindowEnd: migrationWindowEnd(…)` 那一项与 `migrationWindowEnd` 的引入行;`plugins/one-time-migrations.ts` 导出的 `migrationWindowEnd` 在无别的读者时一起删;" +
@@ -547,7 +497,7 @@ export const ONE_TIME_MIGRATIONS = [
             "`RETIRED_DEVICE_BINDING_TABLE` / `PARKED_DEVICE_BINDING_TABLE` / `FENCE_ROOTS_SHOWN`、`ExecutionPlacementSwitchRefusedError` / `EXECUTION_PLACEMENT_SWITCH_REFUSED_CODE` / `ExecutionPlacementSwitchRefusalReason`)" +
             "与 DDL 前探针(`assertExecutionPlacementSwitchAdmissible` / `assertExecutionPlacementSwitchAdmissibleOnPool`,`store-backend.ts` 的 `withRetiredSchemaProbe` 里调它的那一行);" +
             "`runSqlOneTimeMigrations` 的第三参 `ExecutionPlacementSwitchInput`(若再无别的条目用它)与它在两只 SQL 后端 / 测试夹具上的实参;local 腿(`LocalBackend.runOneTimeMigrations` 里的 `backfillLocalExecutionPlacements` 与 `FileRunStore.sessionIdsWithRuns`);" +
-            "`execution-placement-sql.ts` 的 `backfillWriterStatement` / `migrateDeviceBindingsStatement` / `countOrphanBindingsStatement`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 `executionPlacementColumnsAdded` / `deviceBindingsMoved` / " +
+            "`execution-placement-sql.ts` 的 `backfillWriterStatement` / `migrateDeviceBindingsStatement` / `migrateDeviceBindingsOntoSideTableStatements` / `countOrphanBindingsStatement`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 `executionPlacementColumnsAdded` / `deviceBindingsMoved` / " +
             "`deviceBindingsOrphaned` / `deviceBindingTablesDropped` / `executionPlacementsBackfilled` / `executionPlacementSessionsUnreadable` 与 `device_bindings_orphaned` / `execution_placement_session_unreadable` 两行 warn;`test/execution-placement-switch-db-integration.test.ts` 整份与 `test/one-time-migrations.test.ts` 的 M32 组。" +
             "**local 腿的回填席与它的点名词一并删**:`LocalSessionStore` 的 `executionPlacementBackfill`(属性与构造里的那一臂)、`execution-placement.ts` 的 `LocalPlacementBackfillSeat` / `UnusableArchive` / `UnusableArchiveWord`(含它的 `storage` 词 —— 读存档文件时抛了别的故障、`errno` 随带,该词只有回填点名用)/ `isUnusableArchive`、" +
             "`ExecutionPlacementSessionUnreadable`;`local-session-store.ts` 里 `placementRead` 并回 `readExecutionPlacement`、`metaRead` 的 unusable 臂与 `forkingOf` 的 `storage` 臂改成就地上抛 `probe.fault`(`archiveFaultWord` / `unusableArchiveOf` 随词删,探针只留「不在」与已知在而用不了的读法);" +
@@ -611,14 +561,14 @@ export const ONE_TIME_MIGRATIONS = [
         removal: "**删码前提**:本服务已不支持回滚到引擎 7.61.0 之前的版本(更早的引擎的导入门会重新铸出这种 add,本条要在每次起服把它们收掉)—— 窗关时仍支持这种回滚 ⇒ 本行两格顺延(改日期,并在本注里写明为什么),不删。" +
             "删什么:`src/plugins/imported-layer-root-retirement.ts` 整个文件;migrateStepsOn 的 M36 步(规则表与 `grammar` 列的在场探针 + 对 `retireImportedLayerRootAllows` 的调用)与握锁连接上的 `query` 口" +
             "(`LockedMigrationDb` 与 `mysqlDb` / `pgDb` 里的那一员,若届时再无别的步骤用它);`permission-rule-store-sql.ts` 的 `listRuleBucketOwners` / `isSqlBucketRefusal` / `isSqlBucketVanished` / `RuleBucketVanishedError`(取点那一句的具名类,届时若再无别的读者按类判它,收回成裸错)/ `IMPORT_RECORD_KIND`;" +
-            "`permission-rule-store-file.ts` 的 `FileRuleApprovalRecordStore.importRecordOwners`;`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里 M36 那一腿(规则目录在场判与那一处调用)与报告两键的那两行;" +
-            "本文件的 `createSqlImportedLayerRootSource` 与 `importedLayerRootAllowsRetired` / `importedLayerRootBucketsSkipped`(报告 / 收据 / `changedAnything` / `readingsSnapshot` / `readingFields` / `receiptSentence` / `NO_SQL_MIGRATIONS` 的排除表)、" +
-            "`imported_layer_root_allow_retired` / `imported_layer_root_bucket_skipped` 两行 warn 与 `importedLayerRootSkipNote`、读数行 note 里的 M36 句与头注 M36 段;" +
+            "`permission-rule-store-file.ts` 的 `FileRuleApprovalRecordStore.importRecordOwners` / `fileRuleBucketOwners` / `isFileBucketDamaged`;`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里 M36 那一腿(规则目录在场判与那一处调用)与报告两键的那两行;" +
+            "本文件的 `createSqlImportedLayerRootSource` 与 `importedLayerRootAllowsRetired` / `importedLayerRootBucketsSkipped` / `importedLayerRootBucketsUnnamed`(报告 / 收据 / `changedAnything` / `readingsSnapshot` / `readingFields` / `receiptSentence` / `NO_SQL_MIGRATIONS` 的排除表)、" +
+            "`imported_layer_root_allow_retired` / `imported_layer_root_bucket_skipped` / `imported_layer_root_buckets_unnamed` 三行 warn 与 `importedLayerRootSkipNote`、读数行 note 里的 M36 句与头注 M36 段;" +
             "`test/imported-layer-root-retirement.test.ts`、`test/imported-layer-root-retirement-db-integration.test.ts`(连同 `scripts/db-integration-files.json` 里它那一行)与 `test/helpers/imported-layer-root-fixture.ts` 整文件。" +
             "**不随本条删**:`SqlDurableRulePartitionProvider` 收「方言 + 执行口」的那一形(`BucketSql`;常设,池照旧满足它)",
         afterRemoval: "没有响亮臂(如实):删码之后,跳过了带本条的版本直接升的库(或回滚到引擎 7.61.0 之前、在其上又导入过的库),存量的这种全局 `/x` allow 照旧在每个项目根放行,本服务不再点名 —— " +
             "出路 = 升级时先过一次带本条的版本并起服;或运维列出桶里出处为导入(`adds[].origin` = `imported-cc`)、scope 为全局、从 `/` 写起的 allow(`GET /v1/rules`)并撤掉(`DELETE /v1/rules`,撤的是这条规则的全部批准)",
-        reportKeys: ["importedLayerRootAllowsRetired", "importedLayerRootBucketsSkipped"],
+        reportKeys: ["importedLayerRootAllowsRetired", "importedLayerRootBucketsSkipped", "importedLayerRootBucketsUnnamed"],
     },
     {
         id: "M37",
@@ -632,6 +582,60 @@ export const ONE_TIME_MIGRATIONS = [
             "幂等重入走 park、回决口按要人",
         reportKeys: [],
     },
+    {
+        id: "M38",
+        introducedIn: "7.146.0",
+        releasedOn: "2026-11-06",
+        removableAfter: "2026-12-06",
+        removal: "删 `src/stored-request-env-credentials-m38.ts` 整只文件(`storedEnvCredentialsDropM38`);" +
+            "`boot/resolve-spec.ts` 里凭据判据那一段的重放腿分支(`opts?.leg !== \"fresh\" && storedEnvCredentialsDropM38(…)` 那一臂、`withoutKeys` 那一行、`settings_env_credentials_dropped` 那一行 warn)与 `storedEnvCredentialsDropM38` / `withoutKeys` 的 import —— 判据命中改为两腿一律抛,`settingsEnv` 改回 `const`;" +
+            "`task-settings.ts` 的 `withoutKeys`(`readSettingsEnv` 一只读法、`ParseTaskSettingsSeats.settingsEnv` 座与 `resolveSpec` 两腿递它**不删**:判据与装配读同一份是常设的,不随窗走;删后 `reaching` 不再出现 `{}`,`SettingsEnvLayer` 文档里那半句一起删);" +
+            "`http/stored-body-replay.ts` 预判那一臂里的窗问(`storedEnvCredentialsDropM38(…)`,删后命中即拒)与它的 import;" +
+            "`test/settings-env-credential.test.ts` 里窗开的三格(剥键照续 / 剥空登记空表 / 预判窗开不拦)与「窗关当天仍开」那格、`withM38Window` 助手(窗关的几格改成不注入窗直接断言拒)、M38 登记行那一格;本文件头注 M38 段",
+        afterRemoval: "没有新的臂,接住它的是窗关之后的读法(删码零行为变化:窗关那一刻起剥键臂已经不生效):存体 `settings.env` 里仍带凭据条目的停驻行,续跑前的预判拒(409 `resume_blocked_by_policy`,`blockedBy: request.env_credential_refused`,机读位点名键与命中类),卡仍 pending —— " +
+            "出路是取消那条 run,把凭据挪进引擎进程环境后重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行、窗内续跑过又停驻到窗外的任务(头注 M38 段)",
+        reportKeys: [],
+    },
+    {
+        id: "M39",
+        introducedIn: "7.147.0",
+        releasedOn: "2026-11-07",
+        removableAfter: "2026-12-07",
+        removal: "删 `src/plugins/local-data-dir-modes-m39.ts` 整只文件;`store-backend.ts` 里 `LocalBackend.runOneTimeMigrations` 开头调它的那一段(两只日志座的接线)、`dataDirLayout` 字段与它的赋值、顶部的 import(含 `memoryEngineRootFor`),以及 `runOneTimeMigrations` 与 `discloseWarn` 注释里点名 M39 的那两句;" +
+            "各店为名册导出的目录路径函数(`fileRunStoreDirsFor` / `localCheckpointStoreDirsFor` / `attachmentStoreDirFor` / `scratchpadRootFor` / `memorySyncCursorDirFor`)只剩本店自己读的去掉 `export` 与注释里的 M39 一句(`pluginCacheRootFor` 组合根仍读,留);" +
+            "`test/data-dir-modes-upgrade-m39.test.ts` 整只文件;`test/data-dir-law-census.test.ts` 例外名册里 `plugins/local-data-dir-modes-m39.ts` 那一行、模式值例外名册里它那一行、「M39 名册零字面路径」一格与「字面量 = ensureDir 铸出的模式」一格里的迁移半场;本文件头注 M39 段;重生成 `docs/core-consumption/READ-TABLE.json`(迁移读 core 的 `physicalPathOf` 那一行随之去掉)。" +
+            "**不随本条删**:数据根建目录只经 `ensureDir` 这条律本身(常设)、`plugins/owner-only-file-mode.ts`(本服务文件的 `0600` 唯一值与原子写的两个出口:异步出口常设,同步出口按它自己的退役条件 —— core 的原子写改成独占新建 tmp —— 走,不随本条)及它们的钉 —— `test/data-dir-law-census.test.ts`(`src/**` 零裸 mkdir、零手写 0o700、文件模式只认一个名字、tmp 只在一只写口里铸)与 `test/data-dir-modes.test.ts`(每只 local 店首建目录 0700、旧 tmp 不被复用)",
+        afterRemoval: "没有响亮臂(如实,也无需):删码之后,跳过了带本条的版本直接升的数据根,升级前铸成的 0755 目录原样留着(新建的目录一律 0700,不受影响;里面的文件多半仍是 0600),本服务不再点名 —— " +
+            "出路 = 运维一次 `chmod 700` 数据根下 `runs`(及其子目录)· `space-commits` · `checkpoint-ctx` · `.tmp` · `attachments` · `scratchpad`(及其子目录)· `plugin-cache`(及其子目录)· `<记忆引擎根>/sync-cursors`,或升级时先过一次带本条的版本并起服",
+        reportKeys: [],
+    },
+    {
+        id: "M40",
+        introducedIn: "7.147.0",
+        releasedOn: "2026-11-07",
+        removableAfter: "2026-12-07",
+        removal: "删 `src/plugins/execution-lane-rename-m40.ts` 整只文件;本文件的 M40 步(`renameRetiredExecutionLaneWordsM40` / `refuseWhileRunsHeartbeat`〔它读的 `readLiveRunHeartbeat` / `LiveRunHeartbeat` 由 M41 共读,M41 也已删码时随之删〕/ `ExecutionLaneRenameRefusedError` / " +
+            "`EXECUTION_LANE_RENAME_REFUSED_CODE` / `ExecutionLaneRenameInput`,`migrateStepsOn` 第一步那一行与 `SqlOneTimeMigrationInput` 里的那一半)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `executionLaneWordsRenamed`、头注 M40 段;" +
+            "`store-backend.ts` 的 `LocalBackend.ensureSchema` 第一步与 `executionLaneWordsRenamed` 字段、两只 SQL 后端递 `liveRunWindowMs` 的那一半;" +
+            "`LocalSessionStore.renameRetiredExecutionLaneWordM40`、`FileApprovalAskStore.renameRetiredExecutionLaneWordM40` 与内核的 `renameExecutionLaneWord`;" +
+            "`approval-ask-store-sql.ts` / `execution-placement-sql.ts` 拒句里的 `retiredExecutionLaneHintM40(…)` 补句;`test/execution-lane-rename-m40.test.ts` 整只文件与 `test/execution-placement-switch-db-integration.test.ts` 的 M40 组",
+        afterRemoval: "既有读口的拒臂接住(响亮,不再改名):仍带旧词的行 —— 跳过了带本条的版本直接升的库、窗关之后还在写的更早版本副本 —— SQL 问行读口拒、会话执行格读口拒(`ExecutionPlacementRowError`)," +
+            "local 会话元数据边档整只严格拒启(`config.schema_mismatch`),local 问账日志由 M32 回填的词表外拒臂拒启(M32 删码之后:那只问行原样装回)。出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["executionLaneWordsRenamed"],
+    },
+    {
+        id: "M41",
+        introducedIn: "7.147.0",
+        releasedOn: "2026-11-07",
+        removableAfter: "2026-12-07",
+        removal: "删本文件的 M41 步(`moveSessionCellsToSideTable` / `refuseSessionExtMoveWhileRunsHeartbeat` / `deploymentColumnsOnMeta` / `SessionExtMoveRefusedError` / `SESSION_EXT_MOVE_REFUSED_CODE` / " +
+            "`SessionExtMoveRefusalReason` / `sameCell` / `SESSION_EXT_MOVE_PAGE`,`migrateStepsOn` 里那两行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `sessionExtRowsMoved` / `sessionMetaColumnsDropped`、头注 M41 段;" +
+            "M32 读形里的 `cellsOnSideTable` 判(它读本条的 `deploymentColumnsOnMeta`):M32 还在时改成恒旁表形 —— 删 M32 写 `session_meta` 八列的那些臂(② ④ ④b ⑥ 与 ③ 的 `migrateDeviceBindingsStatement` 臂)," +
+            "留 ③ 的旁表臂(`migrateDeviceBindingsOntoSideTableStatements`:围栏拒句的「采旧」在任何库上仍要能落到执行格);M32 先于本条删码时这些随 M32 一并删;`readLiveRunHeartbeat` 在 M40 也已删码时随之删;`test/session-ext-move-db-integration.test.ts` 整只文件",
+        afterRemoval: "跳过了带本条的版本直接升上来的库:`session_meta` 上仍带部署格列 ⇒ 起服列册对账拒启(`config.schema_mismatch`,那几列是本树之外的多余列,拒句不给 ALTER —— 出路是带本条的版本);" +
+            "部署格从旁表读,旧列上的值不被任何读者读。出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["sessionExtRowsMoved", "sessionMetaColumnsDropped"],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;
@@ -645,10 +649,6 @@ export function migrationWindowEnd(id) {
     return row.removableAfter;
 }
 export const NO_SQL_MIGRATIONS = {
-    allowRuleShadowRowsMigrated: 0,
-    allowRuleShadowRowsUnreadable: 0,
-    workflowParkIndexKey: "file-ledger",
-    workflowParkIndexRowsCarried: 0,
     undurableScopeRuleRows: [],
     undurableScopeRuleBucketsDeferred: 0,
     undurableScopeRuleBucketsUnreadable: [],
@@ -677,6 +677,8 @@ export const NO_SQL_MIGRATIONS = {
     deviceBindingsMoved: 0,
     deviceBindingsOrphaned: 0,
     deviceBindingTablesDropped: 0,
+    sessionExtRowsMoved: 0,
+    sessionMetaColumnsDropped: 0,
     askCauseColumnsChanged: 0,
     askParkTriggersMoved: 0,
 };
@@ -733,7 +735,7 @@ async function columnExists(db, dialect, table, column) {
     return (await db.rows(sql)).length > 0;
 }
 export function createSqlImportedLayerRootSource(exec) {
-    return { candidateOwners: () => listRuleBucketOwners(exec), durable: new SqlDurableRulePartitionProvider(exec), isWholeBucketRefusal: isSqlBucketRefusal, isVanishedBucket: isSqlBucketVanished };
+    return { candidateOwners: async () => ({ owners: await listRuleBucketOwners(exec), unnamedBuckets: 0 }), durable: new SqlDurableRulePartitionProvider(exec), isWholeBucketRefusal: isSqlBucketRefusal, isVanishedBucket: isSqlBucketVanished };
 }
 export async function runSqlOneTimeMigrations(dialect, pool, input) {
     return dialect === "mysql" ? withMysqlLock(pool, (db) => migrateOn(db, "mysql", input)) : withPgLock(pool, (db) => migrateOn(db, "pg", input));
@@ -777,16 +779,10 @@ async function migrateOn(db, dialect, input) {
     return completedReport(receipts);
 }
 async function migrateStepsOn(db, dialect, receipts, input) {
-    receipts.holderDeathCodeRowsBackfilled += await db.exec(dialect === "mysql"
-        ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND error = ?"
-        : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND error = $2", [RUN_HOLDER_DEATH_CODES.stalled, RUN_STALLED_ERROR]);
-    receipts.holderDeathCodeRowsBackfilled += await db.exec(dialect === "mysql"
-        ? "UPDATE task_run SET error_code = ? WHERE status = 'failed' AND error_code IS NULL AND (error = ? OR error LIKE ?)"
-        : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND (error = $2 OR error LIKE $3)", [RUN_HOLDER_DEATH_CODES.orphaned, RUN_ORPHANED_ERROR, `${RUN_ORPHANED_ERROR} (%`]);
-    await migrateShadowedRuleKey(db, dialect, receipts);
+    await renameRetiredExecutionLaneWordsM40(db, dialect, receipts, input);
+    await refuseSessionExtMoveWhileRunsHeartbeat(db, dialect, input);
     await migrateRetiredCardWords(db, dialect, receipts);
     await splitApprovalAskCauseColumns(db, dialect, receipts);
-    await reshapeWorkflowParkIndex(db, dialect, receipts);
     await migrateSessionRuleGrammar(db, dialect, receipts);
     await repairParkedRows(db, dialect, receipts);
     await backfillParkedApprovalCards(db, dialect, receipts);
@@ -802,6 +798,149 @@ async function migrateStepsOn(db, dialect, receipts, input) {
         await dropRetiredBreakerTable(db, dialect, receipts);
     await dropRejectedMailboxKeys(db, dialect, receipts);
     await switchExecutionPlacement(db, dialect, receipts, input);
+    await moveSessionCellsToSideTable(db, dialect, receipts);
+}
+export const EXECUTION_LANE_RENAME_REFUSED_CODE = "config.execution_lane_rename_refused";
+export class ExecutionLaneRenameRefusedError extends StoreBootRefusalError {
+    pendingRows;
+    liveRuns;
+    restartAfter;
+    code = EXECUTION_LANE_RENAME_REFUSED_CODE;
+    constructor(pendingRows, liveRuns, restartAfter, detail) {
+        super(`${EXECUTION_LANE_RENAME_REFUSED_CODE}: ${detail}`);
+        this.pendingRows = pendingRows;
+        this.liveRuns = liveRuns;
+        this.restartAfter = restartAfter;
+        this.name = "ExecutionLaneRenameRefusedError";
+    }
+}
+export class ExecutionLaneRenameWriteRefusedError extends StoreBootRefusalError {
+    file;
+    code = EXECUTION_LANE_RENAME_REFUSED_CODE;
+    errno;
+    constructor(file, cause) {
+        const errno = typeof cause?.code === "string" ? cause.code : undefined;
+        const fault = errno ?? (cause instanceof Error ? cause.message : String(cause));
+        super(`${EXECUTION_LANE_RENAME_REFUSED_CODE}: one-time migration M40 could not rewrite ${file} (${fault}) — it still records the retired execution-lane word ` +
+            `"${RETIRED_EXECUTION_LANE_WORD_M40}" (now "${RENAMED_EXECUTION_LANE_M40}"), which this build refuses to read, so it refuses to start rather than run without that data. ` +
+            `The file is unchanged. Restore write access to the file and its directory (clear an immutable flag, remount read-write, free disk space), then restart: the rename runs again on the next start.`, { cause });
+        this.file = file;
+        this.name = "ExecutionLaneRenameWriteRefusedError";
+        this.errno = errno;
+    }
+}
+const EXECUTION_LANE_TABLES = [APPROVAL_ASK_TABLE, "session_meta", SESSION_EXT_TABLE];
+export async function renameRetiredExecutionLaneWordsM40(db, dialect, receipts, input) {
+    const tables = [];
+    for (const table of EXECUTION_LANE_TABLES)
+        if (await columnExists(db, dialect, table, "execution_lane"))
+            tables.push(table);
+    let pendingRows = 0;
+    for (const table of tables) {
+        const [row] = await db.rows(`SELECT COUNT(*) AS n FROM ${table} WHERE execution_lane = ${dialect === "mysql" ? "?" : "$1"}`, [RETIRED_EXECUTION_LANE_WORD_M40]);
+        pendingRows += Number(row?.["n"] ?? 0);
+    }
+    if (pendingRows === 0)
+        return;
+    await refuseWhileRunsHeartbeat(db, dialect, pendingRows, input);
+    for (const table of tables) {
+        receipts.executionLaneWordsRenamed += await db.exec(dialect === "mysql" ? `UPDATE ${table} SET execution_lane = ? WHERE execution_lane = ?` : `UPDATE ${table} SET execution_lane = $1 WHERE execution_lane = $2`, [RENAMED_EXECUTION_LANE_M40, RETIRED_EXECUTION_LANE_WORD_M40]);
+    }
+}
+async function readLiveRunHeartbeat(db, dialect, input) {
+    if (!(await tableExists(db, dialect, "task_run")))
+        return undefined;
+    const since = new Date(Date.now() - input.liveRunWindowMs);
+    const [row] = await db.rows(`SELECT COUNT(*) AS n, MAX(updated_at) AS newest FROM task_run WHERE status = 'running' AND updated_at >= ${dialect === "mysql" ? "?" : "$1"}`, [since]);
+    const liveRuns = Number(row?.["n"] ?? 0);
+    if (liveRuns === 0)
+        return undefined;
+    const newestCell = row?.["newest"];
+    const newest = newestCell instanceof Date ? newestCell : new Date(String(newestCell));
+    const now = Date.now();
+    const restartAtMs = (Number.isNaN(newest.getTime()) ? now : newest.getTime()) + input.liveRunWindowMs;
+    return {
+        liveRuns,
+        windowSec: Math.round(input.liveRunWindowMs / 1000),
+        restartAfter: new Date(restartAtMs).toISOString(),
+        after: `${new Date(restartAtMs).toISOString()} (${Math.max(0, Math.ceil((restartAtMs - now) / 1000))}s from now)`,
+    };
+}
+async function refuseWhileRunsHeartbeat(db, dialect, pendingRows, input) {
+    const heartbeat = await readLiveRunHeartbeat(db, dialect, input);
+    if (heartbeat === undefined)
+        return;
+    const { liveRuns, windowSec, restartAfter, after } = heartbeat;
+    throw new ExecutionLaneRenameRefusedError(pendingRows, liveRuns, restartAfter, `${pendingRows} stored rows (approval asks / sessions) carry the execution lane word "${RETIRED_EXECUTION_LANE_WORD_M40}", the name an earlier version gave the lane with no execution environment, ` +
+        `which this version calls "${RENAMED_EXECUTION_LANE_M40}" and does not read; this boot renames them (one-time migration M40), but ${liveRuns} running runs on this database heartbeat within the last ${windowSec}s ` +
+        `(REAP_RUN_STALE_SEC) — a replica of an earlier version is still serving, and it would keep writing the old word after the rename. No stored row was changed. ` +
+        "Stop every replica of the earlier version, then start this version (stop, migrate, start — this release cannot be rolled across replicas of both versions). " +
+        `If every replica is already stopped, those are the runs they left behind: start this version again after ${after}`);
+}
+export const SESSION_EXT_MOVE_REFUSED_CODE = "config.session_ext_move_refused";
+export class SessionExtMoveRefusedError extends StoreBootRefusalError {
+    reason;
+    code = SESSION_EXT_MOVE_REFUSED_CODE;
+    constructor(reason, detail) {
+        super(`${SESSION_EXT_MOVE_REFUSED_CODE} (reason: ${reason}): ${detail}`);
+        this.reason = reason;
+        this.name = "SessionExtMoveRefusedError";
+    }
+}
+async function deploymentColumnsOnMeta(db, dialect) {
+    if (!(await tableExists(db, dialect, "session_meta")))
+        return [];
+    const present = [];
+    for (const column of SESSION_EXT_COLUMNS)
+        if (await columnExists(db, dialect, "session_meta", column.name))
+            present.push(column);
+    return present;
+}
+const sameCell = (dialect, column) => {
+    const side = column.name === "pinned" ? "COALESCE(se.pinned, FALSE)" : `se.${column.name}`;
+    return dialect === "mysql" ? `sm.${column.name} <=> ${side}` : `sm.${column.name} IS NOT DISTINCT FROM ${side}`;
+};
+const SESSION_EXT_MOVE_PAGE = 500;
+export async function refuseSessionExtMoveWhileRunsHeartbeat(db, dialect, input) {
+    const columns = await deploymentColumnsOnMeta(db, dialect);
+    if (columns.length === 0)
+        return;
+    const heartbeat = await readLiveRunHeartbeat(db, dialect, input);
+    if (heartbeat === undefined)
+        return;
+    throw new SessionExtMoveRefusedError("live_runs", `${columns.length} session cells (${columns.map((c) => c.name).join(", ")}) still live on session_meta; this version keeps them on the side table ${SESSION_EXT_TABLE} and moves them on this boot ` +
+        `(one-time migration M41: copy, verify, then drop the columns), but ${heartbeat.liveRuns} running runs on this database heartbeat within the last ${heartbeat.windowSec}s (REAP_RUN_STALE_SEC) — ` +
+        "a replica of an earlier version is still serving; a cell it writes between the copy and the drop would be lost, and every cell write it makes after the drop fails. Nothing was changed. " +
+        "Stop every replica of the earlier version, then start this version (stop, migrate, start — this release cannot be rolled across replicas of both versions). " +
+        `If every replica is already stopped, those are the runs they left behind: start this version again after ${heartbeat.after}`);
+}
+export async function moveSessionCellsToSideTable(db, dialect, receipts) {
+    const columns = await deploymentColumnsOnMeta(db, dialect);
+    if (columns.length === 0)
+        return;
+    const names = columns.map((c) => c.name);
+    const p = dialect === "mysql" ? () => "?" : (n) => `$${n}`;
+    const upsert = `INSERT INTO ${SESSION_EXT_TABLE} (session_id, ${names.join(", ")}) SELECT session_id, ${names.join(", ")} FROM session_meta ` +
+        `WHERE session_id > ${p(1)} AND session_id <= ${p(2)} ` +
+        (dialect === "mysql" ? `ON DUPLICATE KEY UPDATE ${names.map((n) => `${SESSION_EXT_TABLE}.${n} = VALUES(${n})`).join(", ")}` : `ON CONFLICT (session_id) DO UPDATE SET ${names.map((n) => `${n} = EXCLUDED.${n}`).join(", ")}`);
+    let after = "";
+    for (;;) {
+        const page = await db.rows(`SELECT session_id FROM session_meta WHERE session_id > ${p(1)} ORDER BY session_id LIMIT ${SESSION_EXT_MOVE_PAGE}`, [after]);
+        if (page.length === 0)
+            break;
+        const last = String(page[page.length - 1]["session_id"]);
+        await db.exec(upsert, [after, last]);
+        receipts.sessionExtRowsMoved += page.length;
+        after = last;
+    }
+    const [mismatch] = await db.rows(`SELECT sm.session_id FROM session_meta sm LEFT JOIN ${SESSION_EXT_TABLE} se ON se.session_id = sm.session_id WHERE NOT (${columns.map((c) => sameCell(dialect, c)).join(" AND ")}) LIMIT 1`);
+    if (mismatch !== undefined) {
+        throw new SessionExtMoveRefusedError("copy_mismatch", `after copying the session cells (${names.join(", ")}) from session_meta to ${SESSION_EXT_TABLE}, session ${String(mismatch["session_id"])} does not hold the same values on both tables — ` +
+            "a writer changed it while this boot copied (an earlier-version replica still serving), or the copy did not land. No column was dropped. " +
+            "Stop every replica of the earlier version and start this version again: the copy runs again from the start");
+    }
+    await execUntil(db, `ALTER TABLE session_meta ${names.map((n) => `DROP COLUMN ${n}`).join(", ")}`, async () => (await deploymentColumnsOnMeta(db, dialect)).length === 0);
+    receipts.sessionMetaColumnsDropped += columns.length;
 }
 const RETIRED_ASK_CAUSE_COLUMN = "denied_reason";
 function renameAskCauseColumnSql(dialect) {
@@ -843,12 +982,13 @@ async function readSwitchShape(db, dialect) {
     const sessionMeta = await tableExists(db, dialect, "session_meta");
     const placementColumns = new Set();
     if (sessionMeta)
-        for (const c of SESSION_META_PLACEMENT_COLUMNS)
+        for (const c of EXECUTION_PLACEMENT_COLUMNS)
             if (await columnExists(db, dialect, "session_meta", c.name))
                 placementColumns.add(c.name);
     return {
         sessionMeta,
         placementColumns,
+        cellsOnSideTable: sessionMeta && (await deploymentColumnsOnMeta(db, dialect)).length === 0,
         bindingTable: await tableExists(db, dialect, RETIRED_DEVICE_BINDING_TABLE),
         parkedTable: await tableExists(db, dialect, PARKED_DEVICE_BINDING_TABLE),
         taskRun: sessionMeta && (await tableExists(db, dialect, "task_run")),
@@ -860,11 +1000,11 @@ async function askTableShape(db, dialect) {
     return { askTable, askLaneColumn: askTable && (await columnExists(db, dialect, APPROVAL_ASK_TABLE, "execution_lane")) };
 }
 function switchStarted(s) {
-    return s.placementColumns.has("execution_role") || s.parkedTable;
+    return s.placementColumns.has("execution_role") || s.parkedTable || s.cellsOnSideTable;
 }
 const SWITCH_COMPLETION_COLUMN = "fork_key";
 function switchComplete(s) {
-    return s.placementColumns.size === SESSION_META_PLACEMENT_COLUMNS.length && (!s.askTable || s.askLaneColumn) && !s.bindingTable && !s.parkedTable;
+    return (s.placementColumns.size === EXECUTION_PLACEMENT_COLUMNS.length || s.cellsOnSideTable) && (!s.askTable || s.askLaneColumn) && !s.bindingTable && !s.parkedTable;
 }
 function askLaneBackfillSql(dialect) {
     return dialect === "mysql"
@@ -915,7 +1055,7 @@ const EXECUTION_PLACEMENT_BACKFILL_NEEDS = [
     { what: "approval ask rows that do not record the execution lane they were raised on (they would record their root session's lane, or the only declared lane)", holds: askRowsAwaitingLane },
 ];
 async function refuseOnAmbiguousBackfill(read, dialect, shape, lanes) {
-    if (!shape.sessionMeta || switchComplete(shape) || lanes.length === 1)
+    if (!shape.sessionMeta || shape.cellsOnSideTable || switchComplete(shape) || lanes.length === 1)
         return;
     const pending = [];
     for (const need of EXECUTION_PLACEMENT_BACKFILL_NEEDS)
@@ -968,7 +1108,7 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
         id: "① park the retired binding table",
         run: async ({ db, dialect, shape }) => {
             const s = await shape();
-            if (!s.bindingTable || s.placementColumns.has("execution_role"))
+            if (!s.bindingTable || s.placementColumns.has("execution_role") || s.cellsOnSideTable)
                 return;
             const sql = dialect === "mysql" ? `RENAME TABLE ${RETIRED_DEVICE_BINDING_TABLE} TO ${PARKED_DEVICE_BINDING_TABLE}` : `ALTER TABLE ${RETIRED_DEVICE_BINDING_TABLE} RENAME TO ${PARKED_DEVICE_BINDING_TABLE}`;
             await execUntil(db, sql, async () => {
@@ -992,7 +1132,9 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
     {
         id: "② add the execution placement columns",
         run: async ({ db, dialect, receipts, shape }) => {
-            for (const column of SESSION_META_PLACEMENT_COLUMNS) {
+            if ((await shape()).cellsOnSideTable)
+                return;
+            for (const column of EXECUTION_PLACEMENT_COLUMNS) {
                 if (column.name === SWITCH_COMPLETION_COLUMN)
                     continue;
                 if ((await shape()).placementColumns.has(column.name))
@@ -1010,10 +1152,17 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
     {
         id: "③ move the bindings onto the root session rows",
         run: async ({ db, dialect, receipts, shape }) => {
-            if (!(await shape()).parkedTable)
+            const s = await shape();
+            if (!s.parkedTable)
                 return;
             const orphans = countOrphanBindingsStatement(dialect, PARKED_DEVICE_BINDING_TABLE);
             receipts.deviceBindingsOrphaned += Number((await db.rows(orphans.text, orphans.values))[0]?.["orphans"] ?? 0);
+            if (s.cellsOnSideTable) {
+                const [ensure, move] = migrateDeviceBindingsOntoSideTableStatements(dialect, PARKED_DEVICE_BINDING_TABLE);
+                await db.exec(ensure.text, ensure.values);
+                receipts.deviceBindingsMoved += await db.exec(move.text, move.values);
+                return;
+            }
             const move = migrateDeviceBindingsStatement(dialect, PARKED_DEVICE_BINDING_TABLE);
             receipts.deviceBindingsMoved += await db.exec(move.text, move.values);
         },
@@ -1022,6 +1171,8 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
         id: "④ backfill placements of sessions with runs",
         run: async ({ db, dialect, input, receipts, shape }) => {
             const s = await shape();
+            if (s.cellsOnSideTable)
+                return;
             if (input.lanes.length !== 1) {
                 await refuseOnAmbiguousBackfill((sql) => db.rows(sql), dialect, s, input.lanes);
                 return;
@@ -1035,7 +1186,7 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
         id: "④b backfill the execution lane of approval ask rows",
         run: async ({ db, dialect, input, receipts, shape }) => {
             const s = await shape();
-            if (!s.askTable || !s.askLaneColumn)
+            if (!s.askTable || !s.askLaneColumn || s.cellsOnSideTable)
                 return;
             if (input.lanes.length !== 1) {
                 await refuseOnAmbiguousBackfill((sql) => db.rows(sql), dialect, s, input.lanes);
@@ -1056,9 +1207,10 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
     {
         id: "⑥ add the completion marker column",
         run: async ({ db, dialect, receipts, shape }) => {
-            if ((await shape()).placementColumns.has(SWITCH_COMPLETION_COLUMN))
+            const s = await shape();
+            if (s.placementColumns.has(SWITCH_COMPLETION_COLUMN) || s.cellsOnSideTable)
                 return;
-            const marker = SESSION_META_PLACEMENT_COLUMNS.find((c) => c.name === SWITCH_COMPLETION_COLUMN);
+            const marker = EXECUTION_PLACEMENT_COLUMNS.find((c) => c.name === SWITCH_COMPLETION_COLUMN);
             await execUntil(db, `ALTER TABLE session_meta ADD COLUMN ${marker[dialect]}`, async () => (await shape()).placementColumns.has(SWITCH_COMPLETION_COLUMN));
             receipts.executionPlacementColumnsAdded += 1;
         },
@@ -1100,9 +1252,17 @@ export async function backfillLocalExecutionPlacements(sessionIds, seat, input)
     }
     return { backfilled: placed, unreadable };
 }
+const UNKNOWN_LANE_ASKS_SHOWN = 5;
 export function backfillLocalAskExecutionLanes(store, input) {
-    return store.backfillExecutionLanes(input.lanes, (pending) => {
-        throw new ExecutionPlacementSwitchRefusedError("backfill_ambiguous", `the local approval ask journal holds asks that do not record the execution lane they were raised on (${pending}), and the deployment declares ${input.lanes.length === 0 ? "no lane" : `${input.lanes.length} lanes (${input.lanes.join(", ")})`} — ` +
+    return store.backfillExecutionLanes(input.lanes, (refusal) => {
+        if (refusal.kind === "unknown_lane") {
+            const shown = refusal.asks.slice(0, UNKNOWN_LANE_ASKS_SHOWN).map((a) => `${a.askId} = ${JSON.stringify(a.word)}${retiredExecutionLaneHintM40(a.word) === "" ? "" : " (the retired name of none)"}`);
+            const more = refusal.asks.length > shown.length ? ` and ${refusal.asks.length - shown.length} more` : "";
+            throw new ExecutionPlacementSwitchRefusedError("unknown_lane", `the local approval ask journal holds ${refusal.asks.length} asks whose recorded execution lane is not a lane this version knows (${shown.join(", ")}${more}) — ` +
+                "recording the deployment's lane over it would rewrite the lane the ask was raised on, and this server will not guess one. Nothing was changed. " +
+                "The journal was written by a newer version or altered by hand: start the version that wrote it, or restore the journal from a copy");
+        }
+        throw new ExecutionPlacementSwitchRefusedError("backfill_ambiguous", `the local approval ask journal holds asks that do not record the execution lane they were raised on (${refusal.pending}), and the deployment declares ${input.lanes.length === 0 ? "no lane" : `${input.lanes.length} lanes (${input.lanes.join(", ")})`} — ` +
             "with more than one lane there is no single right answer, and this server will not guess one. Nothing was changed. " +
             "Start this version once with a single declared lane (REMOTE_EXEC set to one lane), then declare the additional lanes");
     });
@@ -1331,55 +1491,6 @@ function renameSessionRulesColumnSql(dialect, from, to) {
     const definition = SESSION_RULES_COLUMN.mysql.slice(SESSION_RULES_COLUMN.name.length);
     return dialect === "mysql" ? `ALTER TABLE ${SESSION_POLICY_TABLE} CHANGE COLUMN ${from} ${to}${definition}` : `ALTER TABLE ${SESSION_POLICY_TABLE} RENAME COLUMN ${from} TO ${to}`;
 }
-const WORKFLOW_PARK_INDEX_TABLE = "workflow_agent_session";
-async function primaryKeyWidth(db, dialect, table) {
-    const sql = dialect === "mysql"
-        ? `SELECT COUNT(*) AS n FROM information_schema.key_column_usage WHERE table_schema = DATABASE() AND table_name = '${table}' AND constraint_name = 'PRIMARY'`
-        : `SELECT COUNT(*) AS n FROM information_schema.table_constraints tc JOIN information_schema.key_column_usage kcu ` +
-            `ON kcu.constraint_name = tc.constraint_name AND kcu.table_schema = tc.table_schema AND kcu.table_name = tc.table_name ` +
-            `WHERE tc.table_schema = current_schema() AND tc.table_name = '${table}' AND tc.constraint_type = 'PRIMARY KEY'`;
-    return Number((await db.rows(sql))[0]?.n ?? 0);
-}
-const WORKFLOW_PARK_INDEX_STAGING = `${WORKFLOW_PARK_INDEX_TABLE}_m9`;
-const WORKFLOW_PARK_INDEX_RETIRED = `${WORKFLOW_PARK_INDEX_TABLE}_m9_old`;
-async function reshapeWorkflowParkIndex(db, dialect, receipts) {
-    const T = WORKFLOW_PARK_INDEX_TABLE;
-    const S = WORKFLOW_PARK_INDEX_STAGING;
-    const O = WORKFLOW_PARK_INDEX_RETIRED;
-    const exists = (t) => tableExists(db, dialect, t);
-    const ddl = (dialect === "mysql" ? SCHEMA_STATEMENTS : PG_SCHEMA_STATEMENTS).find((stmt) => stmt.includes(`CREATE TABLE IF NOT EXISTS ${T} (`));
-    if (ddl === undefined)
-        throw new Error(`one-time migration M9: the central schema carries no definition of ${T} — refusing to reshape a table it cannot rebuild`);
-    const copyPointers = (to, from) => db.exec(dialect === "mysql"
-        ? `INSERT IGNORE INTO ${to} (session_id, run_id, agent_key, scope) SELECT session_id, run_id, agent_key, scope FROM ${from}`
-        : `INSERT INTO ${to} (session_id, run_id, agent_key, scope) SELECT session_id, run_id, agent_key, scope FROM ${from} ON CONFLICT DO NOTHING`);
-    const resumed = await exists(S);
-    if (resumed) {
-        await db.exec(ddl);
-        receipts.workflowParkIndexRowsCarried += await copyPointers(T, S);
-        await execUntil(db, `DROP TABLE ${S}`, async () => !(await exists(S)));
-    }
-    if (await exists(O))
-        await execUntil(db, `DROP TABLE ${O}`, async () => !(await exists(O)));
-    if ((await primaryKeyWidth(db, dialect, T)) !== 1) {
-        if (await exists(T))
-            await finishParkIndexShape(db, dialect);
-        receipts.workflowParkIndexKey = resumed ? "reshaped" : "current";
-        return;
-    }
-    await db.exec(ddl.replace(`CREATE TABLE IF NOT EXISTS ${T} (`, `CREATE TABLE IF NOT EXISTS ${S} (`));
-    receipts.workflowParkIndexRowsCarried += await copyPointers(S, T);
-    const swapped = async () => !(await exists(S)) && (await exists(T)) && (await primaryKeyWidth(db, dialect, T)) !== 1;
-    if (dialect === "mysql") {
-        await execUntil(db, `RENAME TABLE ${T} TO ${O}, ${S} TO ${T}`, swapped);
-        await execUntil(db, `DROP TABLE IF EXISTS ${O}`, async () => !(await exists(O)));
-    }
-    else {
-        await execAtomically(db, [`ALTER TABLE ${T} RENAME TO ${O}`, `ALTER TABLE ${S} RENAME TO ${T}`, `DROP TABLE ${O}`], async () => (await swapped()) && !(await exists(O)));
-    }
-    await finishParkIndexShape(db, dialect);
-    receipts.workflowParkIndexKey = "reshaped";
-}
 async function execAtomically(db, statements, postcondition) {
     try {
         await db.exec("BEGIN");
@@ -1399,64 +1510,6 @@ async function execAtomically(db, statements, postcondition) {
             throw e;
     }
 }
-async function finishParkIndexShape(db, dialect) {
-    await ensureIndexes(async (sql, params) => (dialect === "mysql" ? [await db.rows(sql, params)] : { rows: await db.rows(sql, params) }), dialect, CENTRAL_SCHEMA_INDEXES.filter((spec) => spec.table === WORKFLOW_PARK_INDEX_TABLE));
-    if (dialect !== "pg")
-        return;
-    const conventional = `${WORKFLOW_PARK_INDEX_TABLE}_pkey`;
-    const pk = await db.rows(`SELECT constraint_name FROM information_schema.table_constraints WHERE table_schema = current_schema() AND table_name = '${WORKFLOW_PARK_INDEX_TABLE}' AND constraint_type = 'PRIMARY KEY'`);
-    const name = pk[0]?.constraint_name;
-    if (typeof name === "string" && name !== conventional)
-        await db.exec(`ALTER TABLE ${WORKFLOW_PARK_INDEX_TABLE} RENAME CONSTRAINT ${name} TO ${conventional}`);
-}
-const RETIRED_SHADOWED_RULE_KEY = "shadowedRule";
-export function migrateShadowedRuleDescriptor(text) {
-    let parsed;
-    try {
-        parsed = decodeJsonColumn(text, readNonNullJsonValueColumn, "checkpoint.risk_descriptor (M8 rewrite)");
-    }
-    catch (error) {
-        if (isJsonColumnBodyProblem(error))
-            return { kind: "unreadable", error };
-        throw error;
-    }
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
-        return { kind: "untouched" };
-    const { [RETIRED_SHADOWED_RULE_KEY]: old, ...rest } = parsed;
-    if (typeof old !== "string")
-        return { kind: "untouched" };
-    const next = Object.hasOwn(rest, "allowRuleShadowed") ? rest : { ...rest, allowRuleShadowed: [{ member: "persisted", entries: [old] }] };
-    return { kind: "rewrite", text: JSON.stringify(next) };
-}
-const SHADOWED_RULE_BATCH = 500;
-async function migrateShadowedRuleKey(db, dialect, receipts) {
-    const like = `%"${RETIRED_SHADOWED_RULE_KEY}"%`;
-    let after = "";
-    for (;;) {
-        const rows = await db.rows(dialect === "mysql"
-            ? `SELECT token, ${jsonColumnText(dialect, "risk_descriptor")} FROM checkpoint WHERE ${jsonColumnTextExpr(dialect, "risk_descriptor")} LIKE ? AND token > ? ORDER BY token LIMIT ${SHADOWED_RULE_BATCH}`
-            : `SELECT token, ${jsonColumnText(dialect, "risk_descriptor")} FROM checkpoint WHERE ${jsonColumnTextExpr(dialect, "risk_descriptor")} LIKE $1 AND token > $2 ORDER BY token LIMIT ${SHADOWED_RULE_BATCH}`, [like, after]);
-        for (const r of rows) {
-            const token = String(r.token);
-            after = token;
-            const text = r.risk_descriptor;
-            if (typeof text !== "string")
-                continue;
-            const next = migrateShadowedRuleDescriptor(text);
-            if (next.kind === "unreadable") {
-                receipts.allowRuleShadowRowsUnreadable += 1;
-                continue;
-            }
-            if (next.kind === "untouched")
-                continue;
-            receipts.allowRuleShadowRowsMigrated += await db.exec(dialect === "mysql"
-                ? `UPDATE checkpoint SET risk_descriptor = ? WHERE token = ? AND ${jsonColumnTextExpr(dialect, "risk_descriptor")} = ?`
-                : `UPDATE checkpoint SET risk_descriptor = $1 WHERE token = $2 AND ${jsonColumnTextExpr(dialect, "risk_descriptor")} = $3`, [next.text, token, text]);
-        }
-        if (rows.length < SHADOWED_RULE_BATCH)
-            return;
-    }
-}
 const RETIRED_CARD_WORD_PATTERNS = ['%"shadowed"%', '%"governance_unavailable"%'];
 const RETIRED_CARD_WORD_BATCH = 500;
 function decodeForM18(text, where) {
@@ -1706,11 +1759,6 @@ export async function inheritPlacedSessionOwners(db, dialect, receipts) {
 }
 function readingFields(r) {
     return {
-        holderDeathCodeRowsBackfilled: r.holderDeathCodeRowsBackfilled,
-        allowRuleShadowRowsMigrated: r.allowRuleShadowRowsMigrated,
-        allowRuleShadowRowsUnreadable: r.allowRuleShadowRowsUnreadable,
-        ...(r.workflowParkIndexKey !== undefined ? { workflowParkIndexKey: r.workflowParkIndexKey } : {}),
-        workflowParkIndexRowsCarried: r.workflowParkIndexRowsCarried,
         undurableScopeRuleRowsRemoved: r.undurableScopeRuleRows.length,
         undurableScopeRuleBucketsDeferred: r.undurableScopeRuleBucketsDeferred,
         undurableScopeRuleBucketsUnreadable: r.undurableScopeRuleBucketsUnreadable.length,
@@ -1741,6 +1789,9 @@ function readingFields(r) {
         deviceBindingTablesDropped: r.deviceBindingTablesDropped,
         executionPlacementsBackfilled: r.executionPlacementsBackfilled,
         askExecutionLanesBackfilled: r.askExecutionLanesBackfilled,
+        executionLaneWordsRenamed: r.executionLaneWordsRenamed,
+        sessionExtRowsMoved: r.sessionExtRowsMoved,
+        sessionMetaColumnsDropped: r.sessionMetaColumnsDropped,
         executionPlacementSessionsUnreadable: r.executionPlacementSessionsUnreadable.length,
         localArchiveRowFactsBackfilled: r.localArchiveRowFactsBackfilled,
         localArchivesAnonymized: r.localArchivesAnonymized,
@@ -1752,6 +1803,7 @@ function readingFields(r) {
         askJournalRecordsUpgraded: r.askJournalRecordsUpgraded,
         importedLayerRootAllowsRetired: r.importedLayerRootAllowsRetired.length,
         importedLayerRootBucketsSkipped: r.importedLayerRootBucketsSkipped.length,
+        importedLayerRootBucketsUnnamed: r.importedLayerRootBucketsUnnamed,
     };
 }
 export function logOneTimeMigrations(log, backend, report) {
@@ -1759,12 +1811,7 @@ export function logOneTimeMigrations(log, backend, report) {
         backend,
         ...readingFields(report),
         removableAfter: Object.fromEntries(ONE_TIME_MIGRATIONS.map((w) => [w.id, w.removableAfter])),
-        note: "one-time persisted-data migrations (M6: run rows failed by a " +
-            "holder-death verdict written by an earlier version with only the sentence got the machine-readable code run.stalled / " +
-            "run.orphaned; M7 writes nothing — it is the window of the refusal that keeps a suspended task whose stored allow list was written " +
-            "under an earlier reading from resuming under the current one; M8: parked rows' allow-layer disclosure written by an earlier engine " +
-            "under its old key shadowedRule rewritten to allowRuleShadowed; M9: the workflow park pointer index rebuilt with the key (session, run), " +
-            "its rows carried over; M10 writes nothing at boot — on the local backend, while its window is open, the first task submitted with a principal " +
+        note: "one-time persisted-data migrations (M10 writes nothing at boot — on the local backend, while its window is open, the first task submitted with a principal " +
             "on a session written by an earlier version (which recorded no owner) claims that session for the principal, one session_owner_claimed line per claim; " +
             "M11: persisted permission rules whose project scope root is not a complete absolute path — accepted by earlier versions, dropped on every read " +
             "by the current engine and not removable through DELETE /v1/rules — removed, one permission_rule_row_removed line per row; a bucket the read path " +
@@ -1813,7 +1860,10 @@ export function logOneTimeMigrations(log, backend, report) {
             "M36: allow approvals that an import before engine 7.61.0 stored as global rules from a settings file's user-layer path written from `/` — which the user layer reads at its " +
             "configuration directory and a global rule reads at every task's project root — retired by tombstones naming exactly those approvals (a rule that also holds an approval a person " +
             "gave directly stays in effect; deny and ask rules are never retired), one imported_layer_root_allow_retired line per rule; a bucket that could not be read or written, or that another replica deleted while it was being written, is named by an " +
-            "imported_layer_root_bucket_skipped line on every boot). Each step " +
+            "imported_layer_root_bucket_skipped line on every boot; " +
+            "M40: the stored execution lane word in-process — the name earlier versions gave the lane with no execution environment, which this version calls none and does not read — " +
+            "rewritten as none on approval ask rows and session rows (on the local backend: in the session metadata file and the approval ask journal); a boot that finds such rows while " +
+            "runs on the same database still heartbeat refuses with nothing changed, because a replica of an earlier version is still serving and would keep writing the old word). Each step " +
             "runs on every boot until its window closes (the release that introduced it + 30 days; the per-step date is in " +
             "removableAfter, null while that release is not published yet) and is deleted in the first minor after that — start a " +
             "version that still carries a step at least once before upgrading past its deletion.",
@@ -1933,6 +1983,16 @@ function logReceiptRows(log, backend, r) {
     for (const bucket of r.importedLayerRootBucketsSkipped) {
         log.warn("imported_layer_root_bucket_skipped", { backend, ownerKey: bucket.ownerKey, reason: bucket.reason, why: bucket.why, note: importedLayerRootSkipNote(bucket.reason) });
     }
+    if (r.importedLayerRootBucketsUnnamed > 0) {
+        log.warn("imported_layer_root_buckets_unnamed", {
+            backend,
+            count: r.importedLayerRootBucketsUnnamed,
+            note: "this many permission-rule bucket files are present in the rules directory but neither the directory (the local owner's bucket, the identities its adoption marker names) " +
+                "nor this store's import records name their owner (a bucket file is named by a one-way digest of its owner), so the one-time retirement of imported allow rules written from `/` " +
+                "did not read them: any such rule in them stays in effect. This is a gap in the census, not a statement that they are empty. Each boot reports it again; " +
+                "list the rules of every owner you know (`GET /v1/rules`) and remove what should not stand",
+        });
+    }
     for (const bucket of r.undurableScopeRuleBucketsUnreadable) {
         log.warn("permission_rule_bucket_unreadable", {
             backend,
@@ -1993,7 +2053,7 @@ function logOneTimeMigrationsInterrupted(log, backend, error) {
         ...readingFields(error.receipts),
         note: "the one-time migrations failed after committing changes: the readings on this line and the lines that follow are what this boot already committed — a retried " +
             "boot finds that work done and does not report it again, so these lines are the only record of them, written once by this boot — save them. The failure itself follows " +
-            "as this boot's refusal. A shape reading absent from this line (workflowParkIndexKey / sessionRuleColumn / workflowJournalScopeColumn) belongs to a step that did not " +
+            "as this boot's refusal. A shape reading absent from this line (sessionRuleColumn / workflowJournalScopeColumn) belongs to a step that did not " +
             "finish; sessionRuleColumn absent after session_rule_row_old_grammar_entries lines means the column still carries its in-progress name — the next boot rewrites the " +
             "remaining rows (rows already rewritten are left alone) and publishes the final name",
     });