@sema-agent/server 7.146.0 → 7.147.0

package/dist/plugins/blob-backend.js

@@ -1,57 +1,11 @@
 import { createHash } from "node:crypto";
 import { presignS3Url, presignS3ListUrl } from "./s3-presign.js";
 import { isNoSuchBucketAnswer } from "./s3-answer.js";
-import { connectJudged, mysqlDriver, packetWallStatementBytes, pgDriver, rowWallPayloadBytes, sqlWallsOf } from "./sql-driver.js";
-import { createLogger } from "../observability/logger.js";
-const BLOB_GC_GRACE_MS = 3_600_000;
-export const SQL_TEXT_PROTOCOL_BLOB_INFLATION = 2;
-export function packetWallBlobCap(maxPacketBytes) {
-    return Math.floor(packetWallStatementBytes(maxPacketBytes) / SQL_TEXT_PROTOCOL_BLOB_INFLATION);
-}
-export function sqlBlobDefaultCapBytes(walls) {
-    return sqlBlobDefaultCapOf(walls)?.capBytes;
-}
-export function sqlBlobDefaultCapOf(walls) {
-    const legs = [];
-    if (walls.maxRowBytes !== null)
-        legs.push({ capBytes: rowWallPayloadBytes(walls.maxRowBytes, "blob"), source: walls.sources.maxRowBytes });
-    if (walls.maxPacketBytes !== null)
-        legs.push({ capBytes: packetWallBlobCap(walls.maxPacketBytes), source: walls.sources.maxPacketBytes });
-    return legs.reduce((best, leg) => (best === undefined || leg.capBytes < best.capBytes ? leg : best), undefined);
-}
-export function sqlBlobCapOf(explicitCapBytes, connection) {
-    return explicitCapBytes !== undefined ? { capBytes: explicitCapBytes, source: "operator" } : sqlBlobDefaultCapOf(sqlWallsOf(connection));
-}
-export function sqlBlobCapBytes(explicitCapBytes, connection) {
-    return sqlBlobCapOf(explicitCapBytes, connection)?.capBytes;
-}
-export function capBoundByPacketWall(cap, walls) {
-    return cap.source !== "operator" && walls.maxPacketBytes !== null && packetWallBlobCap(walls.maxPacketBytes) === cap.capBytes;
-}
-export function sqlBlobCapRefusalText(byteLen, cap) {
-    const objectStorage = "configure MinIO object storage (MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY) for large snapshot blobs";
-    const head = `blob of ${byteLen} bytes exceeds this deployment's SQL snapshot-blob cap (${cap.capBytes} bytes — `;
-    switch (cap.source) {
-        case "operator":
-            return `${head}set by the operator's SNAPSHOT_BLOB_SQL_MAX_BYTES) — ${objectStorage}, or raise SNAPSHOT_BLOB_SQL_MAX_BYTES if the database allows larger writes`;
-        case "reported":
-            return `${head}the smaller of the database's single-row limit (TiDB txn-entry-size-limit, 6MiB by default) and about half its max_allowed_packet (the text protocol doubles a blob inside the statement)) — ${objectStorage}, or raise SNAPSHOT_BLOB_SQL_MAX_BYTES if your deployment lifted those limits`;
-        case "assumed":
-            return `${head}the database's limits were not read — engine facts not read yet, or a limit could not be read — so the smallest documented default wall applies) — retry shortly, ${objectStorage}, or set SNAPSHOT_BLOB_SQL_MAX_BYTES to the limit your deployment actually has`;
-        default: {
-            const unhandled = cap.source;
-            throw new Error(`blob cap refusal without a sentence: ${String(unhandled)}`);
-        }
-    }
-}
-export class BlobTooLargeError extends Error {
-    cap;
-    code = "blob_too_large_for_sql";
-    constructor(byteLen, cap) {
-        super(sqlBlobCapRefusalText(byteLen, cap));
-        this.cap = cap;
-        this.name = "BlobTooLargeError";
-    }
+export async function readAtAddress(port, hash) {
+    const bytes = await port.get(hash);
+    if (bytes === undefined)
+        return undefined;
+    return createHash("sha256").update(bytes).digest("hex") === hash ? bytes : undefined;
 }
 const MINIO_OP_CONCURRENCY = 16;
 async function mapBounded(items, limit, fn) {
@@ -64,143 +18,24 @@ async function mapBounded(items, limit, fn) {
     });
     await Promise.all(workers);
 }
-export class SqlBlobBackend {
-    dialect;
-    pool;
-    explicitCapBytes;
-    table;
-    db;
-    log;
-    constructor(dialect, pool, maxBytes, table = "snapshot_blob", log) {
-        this.dialect = dialect;
-        this.pool = pool;
-        this.explicitCapBytes = maxBytes;
-        this.table = table;
-        this.db = dialect === "mysql" ? mysqlDriver(pool) : pgDriver(pool);
-        this.log = log ?? createLogger();
-    }
-    async putBlob(hash, bytes) {
-        const judged = await connectJudged(this.db, (facts) => {
-            const connection = { dialect: this.dialect, facts };
-            const cap = sqlBlobCapOf(this.explicitCapBytes, connection);
-            if (cap === undefined || bytes.byteLength <= cap.capBytes)
-                return undefined;
-            return { cap, packetBound: capBoundByPacketWall(cap, sqlWallsOf(connection)) };
-        }, (refusal) => refusal.packetBound, this.log);
-        if (judged.refusal !== undefined)
-            throw new BlobTooLargeError(bytes.byteLength, judged.refusal.cap);
-        try {
-            await judged.conn.query(this.dialect === "mysql"
-                ? `INSERT INTO ${this.table} (blob_hash, byte_len, bytes, created_at) VALUES (?,?,?,?) ON DUPLICATE KEY UPDATE created_at = VALUES(created_at)`
-                : `INSERT INTO ${this.table} (blob_hash, byte_len, bytes, created_at) VALUES ($1,$2,$3,$4) ON CONFLICT (blob_hash) DO UPDATE SET created_at = EXCLUDED.created_at`, [hash, bytes.byteLength, Buffer.from(bytes), new Date()]);
-        }
-        finally {
-            judged.conn.release();
-        }
-    }
-    async getBlob(hash) {
-        if (this.dialect === "mysql") {
-            const [rows] = await this.pool.query(`SELECT bytes FROM ${this.table} WHERE blob_hash = ?`, [hash]);
-            return rows[0]?.bytes != null ? new Uint8Array(rows[0].bytes) : undefined;
-        }
-        const b = await this.pool.query(`SELECT bytes FROM ${this.table} WHERE blob_hash = $1`, [hash]);
-        return b.rows[0]?.bytes != null ? new Uint8Array(b.rows[0].bytes) : undefined;
-    }
-    async hasBlobs(hashes) {
-        return sqlHasBlobs(this.dialect, this.pool, hashes, this.table);
-    }
-    async deleteBlobs(hashes) {
-        const deleted = await sqlDeleteIndexRowsPastGrace(this.dialect, this.pool, hashes, this.table);
-        return deleted.length;
-    }
-}
-async function sqlHasBlobs(dialect, pool, hashes, table = "snapshot_blob") {
-    if (hashes.length === 0)
-        return new Set();
-    const distinct = [...new Set(hashes)];
-    if (dialect === "mysql") {
-        const ph = distinct.map(() => "?").join(",");
-        const [rows] = await pool.query(`SELECT blob_hash FROM ${table} WHERE blob_hash IN (${ph})`, distinct);
-        return new Set(rows.map((r) => String(r.blob_hash)));
-    }
-    const ph = distinct.map((_, i) => `$${i + 1}`).join(",");
-    const r = await pool.query(`SELECT blob_hash FROM ${table} WHERE blob_hash IN (${ph})`, distinct);
-    return new Set(r.rows.map((row) => row.blob_hash));
-}
-export async function sqlBlobSizes(dialect, pool, hashes) {
-    if (hashes.length === 0)
-        return new Map();
-    const distinct = [...new Set(hashes)];
-    const CHUNK = 1000;
-    const out = new Map();
-    for (let i = 0; i < distinct.length; i += CHUNK) {
-        const part = distinct.slice(i, i + CHUNK);
-        if (dialect === "mysql") {
-            const ph = part.map(() => "?").join(",");
-            const [rows] = await pool.query(`SELECT blob_hash, byte_len FROM snapshot_blob WHERE blob_hash IN (${ph})`, part);
-            for (const r of rows)
-                out.set(String(r.blob_hash), Number(r.byte_len));
-        }
-        else {
-            const ph = part.map((_, j) => `$${j + 1}`).join(",");
-            const r = await pool.query(`SELECT blob_hash, byte_len FROM snapshot_blob WHERE blob_hash IN (${ph})`, part);
-            for (const row of r.rows)
-                out.set(row.blob_hash, Number(row.byte_len));
-        }
-    }
-    return out;
-}
-async function sqlDeleteIndexRowsPastGrace(dialect, pool, hashes, table = "snapshot_blob") {
-    if (hashes.length === 0)
-        return [];
-    const distinct = [...new Set(hashes)];
-    const cutoff = new Date(Date.now() - BLOB_GC_GRACE_MS);
-    if (dialect === "mysql") {
-        const ph = distinct.map(() => "?").join(",");
-        const grace = await pool
-            .query(`SELECT blob_hash FROM ${table} WHERE created_at < ? AND blob_hash IN (${ph})`, [cutoff, ...distinct])
-            .then(([rows]) => rows.map((r) => String(r.blob_hash)))
-            .catch(() => []);
-        if (grace.length === 0)
-            return [];
-        const gph = grace.map(() => "?").join(",");
-        await pool
-            .query(`DELETE FROM ${table} WHERE created_at < ? AND blob_hash IN (${gph})`, [cutoff, ...grace])
-            .catch(() => undefined);
-        return grace;
-    }
-    const ph = distinct.map((_, i) => `$${i + 2}`).join(",");
-    const r = await pool
-        .query(`DELETE FROM ${table} WHERE created_at < $1 AND blob_hash IN (${ph}) RETURNING blob_hash`, [cutoff, ...distinct])
-        .catch(() => undefined);
-    return (r?.rows ?? []).map((row) => row.blob_hash);
-}
 export const OBJECT_STORE_IO_TIMEOUT_MS = 120_000;
 export class MinioBlobBackend {
     cfg;
     keyPrefix;
     ttl;
-    indexPool;
-    indexDialect;
-    indexTable;
-    constructor(cfg, index) {
+    constructor(cfg) {
         this.cfg = cfg;
         this.keyPrefix = cfg.keyPrefix ?? "blobs/";
         this.ttl = cfg.presignTtlSec ?? 3600;
-        this.indexTable = index?.table ?? "snapshot_blob";
-        if (index) {
-            this.indexDialect = index.dialect;
-            this.indexPool = index.pool;
-        }
     }
-    objectKey(hash) {
-        return `${this.keyPrefix}${hash}`;
+    objectKey(key) {
+        return `${this.keyPrefix}${key}`;
     }
-    presign(hash, method) {
+    presign(key, method) {
         return presignS3Url({
             endpoint: this.cfg.endpoint,
             bucket: this.cfg.bucket,
-            key: this.objectKey(hash),
+            key: this.objectKey(key),
             method: method,
             accessKey: this.cfg.accessKey,
             secretKey: this.cfg.secretKey,
@@ -208,57 +43,50 @@ export class MinioBlobBackend {
             expiresSec: this.ttl,
         });
     }
-    async putBlob(hash, bytes) {
-        const url = this.presign(hash, "PUT");
+    async put(key, bytes) {
+        const url = this.presign(key, "PUT");
         const res = await (this.cfg.fetchImpl ?? fetch)(url, { method: "PUT", body: bytes, signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
         if (!res.ok) {
             const detail = await res.text().catch(() => "");
-            throw new Error(`MinioBlobBackend.putBlob ${hash}: HTTP ${res.status} ${detail.slice(0, 200)}`);
-        }
-        if (this.indexPool && this.indexDialect) {
-            if (this.indexDialect === "mysql") {
-                await this.indexPool.query(`INSERT INTO ${this.indexTable} (blob_hash, byte_len, bytes, created_at) VALUES (?,?,NULL,?) ON DUPLICATE KEY UPDATE created_at = VALUES(created_at)`, [hash, bytes.byteLength, new Date()]);
-            }
-            else {
-                await this.indexPool.query(`INSERT INTO ${this.indexTable} (blob_hash, byte_len, bytes, created_at) VALUES ($1,$2,NULL,$3) ON CONFLICT (blob_hash) DO UPDATE SET created_at = EXCLUDED.created_at`, [hash, bytes.byteLength, new Date()]);
-            }
+            throw new Error(`MinioBlobBackend.put ${key}: HTTP ${res.status} ${detail.slice(0, 200)}`);
         }
     }
-    async getBlob(hash) {
-        const url = this.presign(hash, "GET");
+    async get(key) {
+        const url = this.presign(key, "GET");
         let res;
         try {
             res = await (this.cfg.fetchImpl ?? fetch)(url, { method: "GET", signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
         }
         catch (err) {
-            throw new Error(`MinioBlobBackend.getBlob ${hash}: transient fetch failure: ${err.message}`);
+            throw new Error(`MinioBlobBackend.get ${key}: transient fetch failure: ${err.message}`);
         }
         if (res.status === 404)
             return undefined;
         if (!res.ok) {
             const detail = await res.text().catch(() => "");
-            throw new Error(`MinioBlobBackend.getBlob ${hash}: transient HTTP ${res.status} ${detail.slice(0, 200)}`);
+            throw new Error(`MinioBlobBackend.get ${key}: transient HTTP ${res.status} ${detail.slice(0, 200)}`);
         }
-        const buf = new Uint8Array(await res.arrayBuffer());
-        if (createHash("sha256").update(buf).digest("hex") !== hash)
-            return undefined;
-        return buf;
+        return new Uint8Array(await res.arrayBuffer());
     }
-    async hasBlobs(hashes) {
-        if (this.indexPool && this.indexDialect)
-            return sqlHasBlobs(this.indexDialect, this.indexPool, hashes, this.indexTable);
-        const distinct = [...new Set(hashes)];
-        const present = new Set();
-        await mapBounded(distinct, MINIO_OP_CONCURRENCY, async (hash) => {
+    async delete(keys) {
+        const distinct = [...new Set(keys)];
+        let failed = 0;
+        let firstFailure;
+        await mapBounded(distinct, MINIO_OP_CONCURRENCY, async (key) => {
             try {
-                const res = await (this.cfg.fetchImpl ?? fetch)(this.presign(hash, "HEAD"), { method: "HEAD", signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
-                if (res.ok)
-                    present.add(hash);
+                const res = await (this.cfg.fetchImpl ?? fetch)(this.presign(key, "DELETE"), { method: "DELETE", signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
+                if (res.ok || res.status === 404)
+                    return;
+                failed++;
+                firstFailure ??= `${key}: HTTP ${res.status}`;
             }
-            catch {
+            catch (err) {
+                failed++;
+                firstFailure ??= `${key}: ${err instanceof Error ? err.message : String(err)}`;
             }
         });
-        return present;
+        if (failed > 0)
+            throw new Error(`MinioBlobBackend.delete: ${failed} of ${distinct.length} object(s) could not be deleted (first: ${firstFailure})`);
     }
     async *listObjects() {
         const f = this.cfg.fetchImpl ?? fetch;
@@ -333,29 +161,5 @@ export class MinioBlobBackend {
             return { state: "missing" };
         return { state: "unknown", detail: `HTTP ${res.status}` };
     }
-    async deleteBlobs(hashes) {
-        if (hashes.length === 0)
-            return 0;
-        let toDelete;
-        if (this.indexPool && this.indexDialect) {
-            toDelete = await sqlDeleteIndexRowsPastGrace(this.indexDialect, this.indexPool, hashes, this.indexTable);
-        }
-        else {
-            toDelete = [...new Set(hashes)];
-        }
-        if (toDelete.length === 0)
-            return 0;
-        let okCount = 0;
-        await mapBounded(toDelete, MINIO_OP_CONCURRENCY, async (hash) => {
-            try {
-                const res = await (this.cfg.fetchImpl ?? fetch)(this.presign(hash, "DELETE"), { method: "DELETE", signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
-                if (res.ok || res.status === 404)
-                    okCount++;
-            }
-            catch {
-            }
-        });
-        return okCount;
-    }
 }
 //# sourceMappingURL=blob-backend.js.map

package/dist/plugins/caching-session-store.d.ts

@@ -24,12 +24,17 @@ export type SessionHeadReader = Required<Pick<SessionStore, "headOf">>;
  *
  * **One rule: a warm entry is served only while the store's head for that session still names the occupant and the leaf
  * the entry holds.** Every hit reads the head first (`headOf` — one primary-key row read on the SQL twins); head gone, another
- * occupant (core `compareOccupants` — anything but `same`, `unknown` included), or leaf moved ⇒ the entry is dropped and the
+ * occupant (core `compareOccupants` — anything but `same`), or leaf moved ⇒ the entry is dropped and the
  * session is woken from the store again ({@link CachingOptions.onStaleHit}). The leaf is half the token because it is exactly
  * what the stores' conditional writes compare (`expectedLeafId`): a handle this cache hands out is never behind the store's
  * leaf, so those writes fail only on a genuinely concurrent write — two runs writing one session at the same time. The
  * occupant is the other half: a row another replica deleted and created again under the same id can stand at the leaf the
- * entry holds (both empty — `null`), and serving the old view would hand a run the previous occupant's token. Any number of
+ * entry holds (both empty — `null`), and serving the old view would hand a run the previous occupant's token. Whether two
+ * cells name one occupant is core's one reading (7.65.0): a token on both sides and equal ⇒ `same`; no token on either side (absent,
+ * `""`, a non-string) ⇒ `same` too — every store write that creates a row mints a token, so two token-less readings of one id are one
+ * row generation, and the leaf still has to match; a token on one side only ⇒ `different` (no token is never a wildcard). A run handed
+ * a token-less view still cannot write through it: the write path takes its token from `sessionFaceOfHead`, which refuses a token-less
+ * head (`SessionIncarnationMissingError`). Any number of
  * replicas may share one store under any routing; session affinity only raises the hit rate.
  *
  * Open item (the same before this rule): a write that rewrites history while leaving the final leaf id where it was —
@@ -84,12 +89,12 @@ export declare class CachingSessionStore implements SessionStore {
     /** The auto-titler's NULL-only title write (SQL twins + local sidecar carry it; pure pass-through). */
     readonly setTitleIfNull?: (sessionId: string, title: string) => Promise<boolean>;
     readonly probeTitle?: (sessionId: string) => Promise<"none" | "untitled" | "titled">;
-    /** [ref] —— 换源通告的基线面(`session_meta.instruction_source` / local sidecar),纯转发、不经暖缓存。
+    /** [ref] —— 换源通告的基线面(`session_ext.instruction_source` / local sidecar),纯转发、不经暖缓存。
      *  🔴 必须转发(与 retention / placements 同一条教训):默认 `SESSION_CACHE_TTL_SEC=300` 把真店包进本类,
      *  而装配点按「店上两个方法都在」判席 —— 不转发 = 默认部署上换源通告**静默不发**,且没有任何一处报错。 */
     readonly readInstructionSource?: InstructionSourceStore["readInstructionSource"];
     readonly recordInstructionSource?: InstructionSourceStore["recordInstructionSource"];
-    /** 会话行的位置与项目那一格(`session_meta.workspace` / local sidecar;`session-workspace.ts`),纯转发、不经暖缓存。
+    /** 会话行的位置与项目那一格(`session_ext.workspace` / local sidecar;`session-workspace.ts`),纯转发、不经暖缓存。
      *  🔴 必须转发(同上一条教训):装配点与 resolveSpec 按「店上两个方法都在」判这一面 —— 不转发 = 默认部署上不记行、续跑腿不续声明项目,且没有任何一处报错。 */
     readonly readSessionWorkspace?: SessionWorkspaceStore["readSessionWorkspace"];
     readonly recordSessionWorkspace?: SessionWorkspaceStore["recordSessionWorkspace"];

package/dist/plugins/checkpoint-index-columns.d.ts

@@ -60,7 +60,7 @@ export declare function buildCheckpointIndexCells(cp: Checkpoint): CheckpointInd
 /**
  * `approval_card` 列放得下的卡词**字节数**(UTF-8 字节,不是字符数),按方言各一格(键表对 {@link SqlDialect} 闭合:加一种方言 ⇒ 编译红)。
  * MySQL 协议(TiDB / MySQL)的列型是 `TEXT`,上限 65,535 字节 —— 严格模式下超长写入抛 `Data too long`,非严格模式静默截成半只卡词;PG 的 `TEXT` 没有这个上限。
- * 列型的属主是中央 DDL(`tidb-pool.ts` / `pg-pool.ts` 的 `approval_card`),本表只是那一列的容量事实(`test/checkpoint-index-columns.test.ts` 把两处同读,换列型 ⇒ 红)。
+ * 列型的属主是中央 DDL(`tidb-pool.ts` / `pg-pool.ts` 的 `approval_card`),本表按那个列型读类型容量表(`text-column-capacity.ts`,容量数字不在这里另抄;`test/checkpoint-index-columns.test.ts` 把列型与本表同读,换列型 ⇒ 红)。
  * 引擎照存集外词、长度不由本仓定,但引擎铸得出的卡词是闭集短词 —— 超出容量的只会是手改 / 外来写者写下的文档;读这张表的只有 {@link judgeCheckpointIndexCells}
  * (写口超出 ⇒ 类型化拒,M29 超出 ⇒ 计数 + 点名跳过、不挡起服)。
  */

package/dist/plugins/checkpoint-index-columns.js

@@ -1,4 +1,5 @@
 import { CARD_FACET_OVERRIDES, PAUSE_REGISTRY, checkpointIndexFacts } from "@sema-agent/core";
+import { TEXT_COLUMN_TYPE_MAX_BYTES } from "./text-column-capacity.js";
 export const CHECKPOINT_INDEX_COLUMNS = {
     token: "token",
     scope: "scope",
@@ -33,8 +34,8 @@ export function buildCheckpointIndexCells(cp) {
     };
 }
 export const APPROVAL_CARD_COLUMN_MAX_BYTES = {
-    mysql: 65_535,
-    pg: Number.POSITIVE_INFINITY,
+    mysql: TEXT_COLUMN_TYPE_MAX_BYTES.mysql.TEXT,
+    pg: TEXT_COLUMN_TYPE_MAX_BYTES.pg.TEXT,
 };
 export function judgeCheckpointIndexCells(cp, dialect) {
     const gate = cp.gate;

package/dist/plugins/checkpoint-store-face.d.ts

@@ -290,7 +290,7 @@ export declare function boundedRuleOffers(raw: unknown, opts?: {
 /**
  * {@link SqlCheckpointStore.get} 读到的 `checkpoint` 列字节读不成一只检查点(JSON 字面 `null` / 标量 / 数组 / 非 JSON)时抛的拒 —— 就是店的拒绝契约类
  * {@link StoreCorruptError}(`kind:"corrupt"` + 坐标,所有认它的读口原样认它),外加**引擎判官对这一格原样字节的判决**:列表面对同一格答的就是它
- * ({@link verdictOfUnreadableBody},`rowVerdict`),所以决断口("行自己拒")说的出路句取这一只判决的 `sentence`、不另铸(决断口 {@link rowRefusalMessageOf})。
+ * ({@link verdictOfUnreadableBody},`rowVerdict`),所以决断口("行自己拒")答的码与出路句取这一只判决的 `code` / `sentence`、不另铸(决断口 `rowRefusalAnswer`)。
  * 判决在抛的这一拍现算(纯函数、全函数,不读钟不读库);店自己的诊断(`message`:坐标 + 体的问题)原样保留。
  */
 export declare class UnreadableCheckpointRowError extends StoreCorruptError {

package/dist/plugins/device-store-sql.d.ts

@@ -86,7 +86,7 @@ export declare function ensurePgDeviceSchema(q: PgQuery): Promise<void>;
  * (读侧 `parseDeviceAuditEvent`),CHECK 只是纵深 —— 所以给运维的是**手工**约束级重建语句
  * (drop + 按当前闭集 add),历史一行不丢,纵深回到当前词表。
  *
- * 调用点:`boot/stores.ts`,**只在 device 车道真会装配时探**(`config.remoteExec?.provider ===
+ * 调用点:`boot/stores.ts`,**只在 device 车道真会装配时探**(`config.remoteExec.provider ===
  * "device"`,与 main.ts 的 `createDeviceLane` 谓词同源)——非 device 部署零审计写点,为它拒启是纯误伤
  * ([ref] round2 的同一条收窄)。
  */
@@ -142,7 +142,7 @@ export declare class SqlDeviceStore implements DeviceStore {
     private lockDeviceStatus;
     /**
      * §4.3.2 首绑(§3.3 转换表 place / bind 两行)—— **一只事务**:锁设备行(active ∧ 属主)→ 锁定读根会话行的执行格 → 判官
-     * {@link settledDeviceBindOutcome}(与内存参照实现同一只)→ absent 用 place 语句、writer(device, ∅) 用 bind 语句,写只按住客谓词。
+     * {@link settledDeviceBindOutcome}(与内存参照实现同一只)→ 补旁表行 + absent 用 place 语句、writer(device, ∅) 用 bind 语句(住客由根行的锁钉住,写按格谓词定址)。
      *
      * 不读认领:这是认领持有者自己的初始放置写(读写序律唯一的例外,`execution-placement-sql.ts` 头注)。锁序:设备行 → 根 `session_meta`。
      * 持着根行的锁判过「可写」之后那句 UPDATE 不可能 0 行 —— 0 行即驱动 / 引擎异常,响亮抛,不折成业务分支([ref])。

package/dist/plugins/device-store-sql.js

@@ -2,7 +2,7 @@ import { mysqlDriver, pgDriver, dialectJsonEncoder } from "./sql-driver.js";
 import { isDupKeyError, isCheckViolationError } from "./sql-errors.js";
 import { DEVICE_AUDIT_EVENTS, assertAcquireShape, assertDeviceIdShape, assertDeviceOwnerShape, assertEnrollTokenHashShape, assertIssueTokenShape, assertNewDeviceShape, assertPlaceDeviceShape, assertRebindShape, assertRevokeShape, assertWholeSeconds, parseDeviceAuditEvent, parseDevicePlatformOs, parseDeviceStatus, } from "../device-store.js";
 import { WRITABLE, boundDeviceOf, settledDeviceBindOutcome, settledDeviceRebindOutcome } from "../execution-placement.js";
-import { bindDeviceStatement, countDeviceBindingsOn, lockRootAndReadClaim, placeWriterStatement, readPlacementOn, rebindDeviceStatement, rowsOnSqlExec } from "./execution-placement-sql.js";
+import { bindDeviceStatement, countDeviceBindingsOn, lockRootAndReadClaim, placeWriterStatement, readPlacementOn, rebindDeviceStatement, rowsOnSqlExec, writeCellOn } from "./execution-placement-sql.js";
 import { ensureIndexes } from "./ensure-index.js";
 import { decodeJsonColumn, foldJsonColumn, jsonColumnText, readJsonObjectColumn } from "./sql-json-column.js";
 export const DEVICES_TABLE = "device";
@@ -520,11 +520,9 @@ export class SqlDeviceStore {
             const now = new Date();
             const device = { id: input.deviceId, owner: input.owner };
             const stmt = reading.cell.role === "absent"
-                ? placeWriterStatement(this.db.dialect, input.root, input.occupant, { lane: "device", device }, now)
-                : bindDeviceStatement(this.db.dialect, input.root, input.occupant, device, now);
-            const res = await conn.query(stmt.text, [...stmt.values]);
-            if (res.affected !== 1)
-                throw new Error(`device-store: first bind of session ${input.root} affected ${res.affected} rows under a held row lock — engine anomaly, refusing to guess`);
+                ? placeWriterStatement(this.db.dialect, input.root, { lane: "device", device }, now)
+                : bindDeviceStatement(this.db.dialect, input.root, device, now);
+            await writeCellOn(conn, this.db.dialect, input.root, stmt);
             await conn.commit();
             const placed = { id: input.deviceId, owner: { tenant: input.owner.tenant, subject: input.owner.subject }, rev: 0, placedAt: now.toISOString() };
             return { outcome: "bound", device: placed };
@@ -564,10 +562,7 @@ export class SqlDeviceStore {
             }
             const from = boundDeviceOf(reading.cell).id;
             const now = new Date();
-            const stmt = rebindDeviceStatement(this.db.dialect, input.root, input.occupant, input.owner, input.expectedRev, input.targetDeviceId, now);
-            const cas = await conn.query(stmt.text, [...stmt.values]);
-            if (cas.affected !== 1)
-                throw new Error(`device-store: rebind CAS affected ${cas.affected} rows under a held row lock — engine anomaly, refusing to guess`);
+            await writeCellOn(conn, this.db.dialect, input.root, rebindDeviceStatement(this.db.dialect, input.root, input.owner, input.expectedRev, input.targetDeviceId, now));
             const rev = input.expectedRev + 1;
             await this.insertAuditOn(conn, { event: "session_rebound", deviceId: input.targetDeviceId, owner: input.owner, detail: { from, to: input.targetDeviceId, rev } });
             await conn.commit();

package/dist/plugins/execution-lane-rename-m40.d.ts

@@ -0,0 +1,20 @@
+/**
+ * 🔴 一次性迁移 **M40**(窗口见 `plugins/one-time-migrations.ts` 登记表 M40 行;头注 M40 段):没有执行环境的那条车道的存词由退役名改成 `none`。
+ *
+ * 本文件是那一对词与「读到退役词时补哪一句」的**唯一属主**:SQL 腿(`one-time-migrations.ts` 的 M40 步,两方言两张表)、local 两腿(会话元数据边档 ——
+ * `LocalSessionStore.renameRetiredExecutionLaneWordM40`,排在严格边档对账之前;问账日志 —— `FileApprovalAskStore.renameRetiredExecutionLaneWordM40`,
+ * 排在 M32 回填之前)与两只 SQL 读口的拒句(`approval-ask-store-sql.ts` / `execution-placement-sql.ts`)都读这里。窗关删码 = 删这只文件与上面那几处调用。
+ *
+ * 本文件只 import 类型(零运行期依赖)⇒ 被一次性迁移段与它 import 的店文件同时读,不成环。
+ */
+import type { ExecutionLane } from "../execution-lane-caps.js";
+/** 退役的存词(本版之前的部署在没有声明车道时铸下的那一个)。本版的车道闭集里没有它,任何读口读到都响亮拒。 */
+export declare const RETIRED_EXECUTION_LANE_WORD_M40 = "in-process";
+/** 它的新名:声明「这一部署没有执行环境」的那条车道。 */
+export declare const RENAMED_EXECUTION_LANE_M40: ExecutionLane;
+/**
+ * 读口拒句的补句:读到的词就是退役词 ⇒ 说清它是什么、为什么还在(迁移之后又被写下 = 有一只更早版本的副本还在服务)与出路;别的词 ⇒ 空串(拒句不变)。
+ * 起服的迁移改完之后,只有混跑的旧副本还会写下它(版本围栏见登记表 M40 行与 MIGRATION 本版节)。
+ */
+export declare function retiredExecutionLaneHintM40(word: string): string;
+//# sourceMappingURL=execution-lane-rename-m40.d.ts.map

package/dist/plugins/execution-lane-rename-m40.js

@@ -0,0 +1,10 @@
+export const RETIRED_EXECUTION_LANE_WORD_M40 = "in-process";
+export const RENAMED_EXECUTION_LANE_M40 = "none";
+export function retiredExecutionLaneHintM40(word) {
+    if (word !== RETIRED_EXECUTION_LANE_WORD_M40)
+        return "";
+    return (` — "${RETIRED_EXECUTION_LANE_WORD_M40}" is the name an earlier version gave the lane with no execution environment, which this version calls "${RENAMED_EXECUTION_LANE_M40}"; ` +
+        "the one-time migration M40 at boot renames every stored copy, so this row was written afterwards by a replica of an earlier version that is still serving. " +
+        "Stop every replica of the earlier version, then restart this version once (its boot renames what they wrote)");
+}
+//# sourceMappingURL=execution-lane-rename-m40.js.map