@sema-agent/server 7.146.0 → 7.147.0

package/dist/plugins/one-time-migrations.js

@@ -4,8 +4,6 @@ import { judgeCheckpointIndexCells } from "./checkpoint-index-columns.js";
 import { dialectProtocolJsonEncoder } from "./sql-driver.js";
 import { SCHEMA_STATEMENTS, acquireEnsureSchemaLock, releaseEnsureSchemaLock } from "./tidb-pool.js";
 import { PG_SCHEMA_STATEMENTS, acquirePgEnsureSchemaLock, releasePgEnsureSchemaLock } from "./pg-pool.js";
-import { CENTRAL_SCHEMA_INDEXES } from "./schema-indexes.js";
-import { ensureIndexes } from "./ensure-index.js";
 import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readOpaqueJsonValueColumn, } from "./sql-json-column.js";
 import { incarnationFromCell, sessionFaceFromRow } from "../session-incarnation.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
@@ -16,14 +14,15 @@ import { retireStoredCardWords } from "../retired-card-words.js";
 import { redactSecrets } from "../trace/redact.js";
 import { CLAIM_OWNERLESS_PLACED_SQL, claimOwnerlessParams, isOrphanSessionOwner, judgeDelegatedOwner } from "../delegated-session-owner.js";
 import { MAILBOX_KEYED_TABLES, mailboxKeyDeleteSql, storedMailboxKeyless } from "../stores-sql/mailbox-store-sql.js";
-import { SESSION_META_PLACEMENT_COLUMNS, backfillWriterStatement, countOrphanBindingsStatement, migrateDeviceBindingsStatement } from "./execution-placement-sql.js";
+import { backfillWriterStatement, countOrphanBindingsStatement, migrateDeviceBindingsOntoSideTableStatements, migrateDeviceBindingsStatement } from "./execution-placement-sql.js";
+import { EXECUTION_PLACEMENT_COLUMNS, SESSION_EXT_COLUMNS, SESSION_EXT_TABLE } from "./session-ext-table.js";
 import { APPROVAL_ASK_ENDING_CAUSE_COLUMN, APPROVAL_ASK_EXECUTION_LANE_COLUMN, APPROVAL_ASK_PARK_TRIGGER_COLUMN, APPROVAL_ASK_TABLE } from "./approval-ask-store-sql.js";
+import { RENAMED_EXECUTION_LANE_M40, RETIRED_EXECUTION_LANE_WORD_M40, retiredExecutionLaneHintM40 } from "./execution-lane-rename-m40.js";
 import { retireImportedLayerRootAllows } from "./imported-layer-root-retirement.js";
 import { isUnusableArchive } from "../execution-placement.js";
 const RETIRED_SESSION_RULE_BUCKETS = ["commandAllow", "commandDeny"];
 export function buildMigrationReceipts() {
     return {
-        workflowParkIndexRowsCarried: 0,
         undurableScopeRuleRows: [],
         undurableScopeRuleBucketsDeferred: 0,
         undurableScopeRuleBucketsUnreadable: [],
@@ -52,6 +51,9 @@ export function buildMigrationReceipts() {
         deviceBindingTablesDropped: 0,
         executionPlacementsBackfilled: 0,
         askExecutionLanesBackfilled: 0,
+        executionLaneWordsRenamed: 0,
+        sessionExtRowsMoved: 0,
+        sessionMetaColumnsDropped: 0,
         executionPlacementSessionsUnreadable: [],
         localArchiveRowFactsBackfilled: 0,
         localArchivesAnonymized: 0,
@@ -63,19 +65,18 @@ export function buildMigrationReceipts() {
         askJournalRecordsUpgraded: 0,
         importedLayerRootAllowsRetired: [],
         importedLayerRootBucketsSkipped: [],
+        importedLayerRootBucketsUnnamed: 0,
     };
 }
 function completedReport(r) {
-    const { workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn } = r;
-    if (workflowParkIndexKey === undefined || sessionRuleColumn === undefined || workflowJournalScopeColumn === undefined) {
-        throw new Error(`one-time migrations finished without settling a shape reading (M9 ${String(workflowParkIndexKey)} / M17 ${String(sessionRuleColumn)} / M24 ${String(workflowJournalScopeColumn)}) — a step did not record it`);
+    const { sessionRuleColumn, workflowJournalScopeColumn } = r;
+    if (sessionRuleColumn === undefined || workflowJournalScopeColumn === undefined) {
+        throw new Error(`one-time migrations finished without settling a shape reading (M17 ${String(sessionRuleColumn)} / M24 ${String(workflowJournalScopeColumn)}) — a step did not record it`);
     }
-    return { ...r, workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn };
+    return { ...r, sessionRuleColumn, workflowJournalScopeColumn };
 }
 function changedAnything(r) {
-    return (r.workflowParkIndexKey === "reshaped" ||
-        r.workflowParkIndexRowsCarried > 0 ||
-        r.undurableScopeRuleRows.length > 0 ||
+    return (r.undurableScopeRuleRows.length > 0 ||
         r.undurableScopeRuleBucketsDeferred > 0 ||
         r.undurableScopeRuleBucketsUnreadable.length > 0 ||
         r.sessionRuleColumn === "renamed" ||
@@ -105,6 +106,9 @@ function changedAnything(r) {
         r.deviceBindingTablesDropped > 0 ||
         r.executionPlacementsBackfilled > 0 ||
         r.askExecutionLanesBackfilled > 0 ||
+        r.executionLaneWordsRenamed > 0 ||
+        r.sessionExtRowsMoved > 0 ||
+        r.sessionMetaColumnsDropped > 0 ||
         r.executionPlacementSessionsUnreadable.length > 0 ||
         r.localArchiveRowFactsBackfilled > 0 ||
         r.localArchivesAnonymized > 0 ||
@@ -115,7 +119,8 @@ function changedAnything(r) {
         r.askParkTriggersMoved > 0 ||
         r.askJournalRecordsUpgraded > 0 ||
         r.importedLayerRootAllowsRetired.length > 0 ||
-        r.importedLayerRootBucketsSkipped.length > 0);
+        r.importedLayerRootBucketsSkipped.length > 0 ||
+        r.importedLayerRootBucketsUnnamed > 0);
 }
 function readingsSnapshot(r) {
     return {
@@ -157,24 +162,6 @@ export class OneTimeMigrationInterruptedError extends Error {
     }
 }
 export const ONE_TIME_MIGRATIONS = [
-    {
-        id: "M9",
-        introducedIn: "7.118.0",
-        releasedOn: "2026-10-07",
-        removableAfter: "2026-11-06",
-        removal: "删 migrateOn 的 M9 步(`reshapeWorkflowParkIndex` / `execAtomically` / `finishParkIndexShape`:收尾段、主键宽度探针、暂存表复制、换名、删旧表、索引补建、主键约束名)与 " +
-            "`primaryKeyWidth` / `WORKFLOW_PARK_INDEX_TABLE` / `WORKFLOW_PARK_INDEX_STAGING` / `WORKFLOW_PARK_INDEX_RETIRED`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 " +
-            "`workflowParkIndexKey` / `workflowParkIndexRowsCarried`;**连同读侧半场一起删**(都是「引擎 7.43 及以前写下的 workflow 子代停驻记录」这同一件事,同窗同删,不另起登记行):" +
-            "`orchestration/workflow-agent-session-index.ts` 的 `older_engine` 读臂(`routeWorkflowPark` 规则 ③、`WorkflowParkRoute` 与 `parked-decide.ts` `ParkOrigin` 上 `cause` 里的这一词," +
-            "`denyWorkflowParksUnreadable` 的对应分支;`unreadable` 成为唯一成因)与随包排空判据 `workflow-park-holder`(`scripts/drain-check.mysql.sql` / `scripts/drain-check.pg.sql` 的那一段" +
-            "与文件头判据清单里的那一行、`scripts/drain-check-local.mjs` 的 `DRAIN_CRITERIA` 那一条与 `readParkIndex`,以及 `MIGRATION.md` / `docs/DEPLOY-PREREQS.md` 里点名它的说明)",
-        afterRemoval: "没有响亮臂:删码之后仍是旧主键(只有 `session_id`)的库(跳过了带本条的版本直接升)上,同一个子会话只能有一枚指针 —— 续跑链 / 分叉里" +
-            "后写的那条记录覆盖先写的,判决只看得到一条记录:分叉判不出、链尾可能被更早的记录盖掉(决定投给那一条)。运维手工照中央 DDL 重建这张表即可" +
-            "(它是派生投影,丢了只丢升级那一刻还停驻着的旧卡的指针 —— 那些卡改答诚实 miss)。读侧半场删后:升级那一刻还停驻着、点名它的条目没有持有者位的存量卡" +
-            "(跳过了带本条的版本直接升的库)路由判 `none` ⇒ 落 legacy 腿,答 `409 conflict.resume_context_unavailable`(响亮,但成因是子会话没有续跑上下文,不再是 " +
-            "`decide.workflow_parks_unreadable`);出路不变(续跑发起它的那条 workflow run);随包排空判据没了,换钉前没有机器读数可数这些卡",
-        reportKeys: ["workflowParkIndexKey", "workflowParkIndexRowsCarried"],
-    },
     {
         id: "M10",
         introducedIn: "7.119.0",
@@ -307,6 +294,9 @@ export const ONE_TIME_MIGRATIONS = [
             "`test/task-a2a.test.ts` 里的克隆钉(标题去掉开头的 `🔴 ` 后以 `克隆钉:` 开头的各格,整格删;按这个精确前缀删,不按标题里的「M19 重读」之类泛词删 —— 那会误删同文件里的通用不变式钉),以及三格不带前缀、删码后要改写的钉:`需要「读」的两个键…` 那格的 `readRequestToolAxes` 调用方名单(`normalizeA2aPeer` 只在 M19 重读臂里调它,删后名单只剩 `mintPeerSnapshot`,标题里「与读器里 M19 重读产物的那一次」半句同删)、`读器与门的差别只有三格…` 改成两格(删 ③ 的注释行与标题里的 ③)、`请求入口快照的形…` 里 `snapshotRequestA2a(…, { reread: false })` 的第二实参(删 `reread` 形参后改成单参);" +
             "`test/one-time-migration-window-gate.test.ts` 里 M19 一节中与克隆有关的三格(声明抽取器正负控 · 删法条与克隆名字两向对账 · 克隆钉标题前缀对账)与它们共用的帮手 `declaredNames`;" +
             "`test/mcp-tool-axes-m19.test.ts`(窗关那一格 —— 存量坏形整条不进、warn 与通告点名 `field: toolAxes` —— 改钉到 `test/task-mcp.test.ts`);" +
+            "「请求成员读不出」一问上的重读座走线:`http/stored-body-replay.ts` 里递给 `unreadRequestMembers` 的 `storedToolAxes: storedToolAxesRereadM19(today)` 与它的 import," +
+            "`unread-request-members.ts` 的 `StoredToolAxesRereadM19` 型 import、`UnreadMembersLeg` 续跑臂的 `storedToolAxes` 字段与 `unreadRequestMembers` 里取它、递给两只谓词的那几处," +
+            "`task-mcp.ts` 的 `requestMcpTransportUnread` 与 `task-a2a.ts` 的 `requestA2aHeadersUnread` 的 `storedToolAxes` 形参(连同它们递给 `normalizeServer` / `normalizeA2aPeer` 的那一实参);" +
             "本文件的 `migrationWindowOpen`(若再无别的读者)",
         afterRemoval: "没有新的臂,接住它的是今天的读法(删码零行为变化:窗关那一刻起重读臂已经不生效):升级前存下的请求体里引擎判官判不过的 `toolAxes`,续跑重放时这一条 server 整条不进," +
             "运维 warn `mcp_injection_dropped`(`reason: malformed_entry`、`field: toolAxes`)+ 用户面通告 `mcp.injection_dropped`,兄弟照挂;停驻在这台 server 工具审批上的任务" +
@@ -320,14 +310,16 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.131.0",
         releasedOn: "2026-10-16",
         removableAfter: "2026-11-15",
-        removal: "删 `src/stored-request-hooks-m20.ts` 整只文件(`storedHooksRereadM20` / `rereadStoredHooksM20` / `StoredHooksRereadM20` / `ENTRY_FIELD_NAMES` / `MATCHER_FIELD_NAMES` / `nodeAt` / `cloneDoc` / `removeKeyAt`);" +
+        removal: "删 `src/stored-request-hooks-m20.ts` 整只文件(`storedHooksRereadM20` / `rereadStoredHooksM20` / `StoredHooksRereadM20` / `MATCHER_FIELD_NAMES` / `nodeAt` / `cloneDoc` / `removeKeyAt`);" +
             "`boot/resolve-spec.ts` 里递给 `parseTaskSettings` 的重读座实参(`opts?.leg === \"fresh\" || !taskHooksHonored(config) ? {} : { storedHooksReread: storedHooksRereadM20(…) }`)与它的 import、" +
             "`hooks_read_as_before_upgrade` 那一段 warn;`task-settings.ts` 的 `ParseTaskSettingsSeats` / `ParseTaskSettingsResult.hooksReread` / `parseTaskSettings` 第二形参与 hooks 臂里的重读那一支;" +
             "`hooks/hook-runner.ts` 的 `ParseHooksConfigResult.pieces` / `HooksRefusalPiece`(若再无别的读者)与 `hooksCoordinate` 的 export;" +
-            "`test/hooks-stored-reread-m20.test.ts`(窗关那一格 —— 整份不采纳 + `server.hooks.resume-reader-refused` 计一笔 —— 改钉到 `test/hooks-entry-admission.test.ts` 的续跑腿组)",
-        afterRemoval: "没有新的臂,接住它的是今天的读法(删码零行为变化:窗关那一刻起重读臂已经不生效):升级前存下的请求体里带这两形的 `settings.hooks`,续跑重放时整份不采纳(其中真在拦的 `PreToolUse` 钩子也不再拦)," +
-            "运维 warn `task_settings_deferred`(字段 `hooks`)+ fail-open 登记 `server.hooks.resume-reader-refused`(计数 + 探针 + 一次性 warn,census 第 140 行),任务照常续跑 —— " +
-            "出路是把这类停驻任务决掉、删掉那个未知字段 / `__proto__` 键后重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行(头注 M20 段)",
+            "「请求成员读不出」一问上的重读座走线:`unread-request-members.ts` 的 `storedHooksRereadM20` import 与 `unreadRequestMembers` 里 `hooksReread` 那一行(递给 `parseTaskSettings` 的 `storedHooksReread` 座)、" +
+            "`UnreadMembersLeg` 续跑臂的 `today` 字段(只为 M20 的窗问它)与 `http/stored-body-replay.ts`、`boot/resolve-spec.ts` 递 `today` 的那两处(`stored-body-replay.ts` 的 `today` 局部若 M19 已删再无读者一并删);" +
+            "`test/hooks-stored-reread-m20.test.ts`(窗关那一格 —— 续跑拒 409 `resume_blocked_by_policy` —— 改钉到 `test/hooks-entry-admission.test.ts` 的续跑腿组)",
+        afterRemoval: "没有新的臂,接住它的是今天的读法(删码零行为变化:窗关那一刻起重读臂已经不生效):升级前存下的请求体里带这两形的 `settings.hooks`,在会采纳 hooks 的车道上续跑被拒 —— " +
+            "「请求成员读不出」判据(`src/unread-request-members.ts`)答 409 `resume_blocked_by_policy`(`blockedBy: request.field_invalid`,`field: settings.hooks`),卡仍待决、行不动(7.147.0 起;此前是整份不采纳照跑)—— " +
+            "出路是取消这类停驻任务、删掉那个未知字段 / `__proto__` 键后重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行(头注 M20 段)",
         reportKeys: [],
     },
     {
@@ -505,7 +497,7 @@ export const ONE_TIME_MIGRATIONS = [
             "`RETIRED_DEVICE_BINDING_TABLE` / `PARKED_DEVICE_BINDING_TABLE` / `FENCE_ROOTS_SHOWN`、`ExecutionPlacementSwitchRefusedError` / `EXECUTION_PLACEMENT_SWITCH_REFUSED_CODE` / `ExecutionPlacementSwitchRefusalReason`)" +
             "与 DDL 前探针(`assertExecutionPlacementSwitchAdmissible` / `assertExecutionPlacementSwitchAdmissibleOnPool`,`store-backend.ts` 的 `withRetiredSchemaProbe` 里调它的那一行);" +
             "`runSqlOneTimeMigrations` 的第三参 `ExecutionPlacementSwitchInput`(若再无别的条目用它)与它在两只 SQL 后端 / 测试夹具上的实参;local 腿(`LocalBackend.runOneTimeMigrations` 里的 `backfillLocalExecutionPlacements` 与 `FileRunStore.sessionIdsWithRuns`);" +
-            "`execution-placement-sql.ts` 的 `backfillWriterStatement` / `migrateDeviceBindingsStatement` / `countOrphanBindingsStatement`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 `executionPlacementColumnsAdded` / `deviceBindingsMoved` / " +
+            "`execution-placement-sql.ts` 的 `backfillWriterStatement` / `migrateDeviceBindingsStatement` / `migrateDeviceBindingsOntoSideTableStatements` / `countOrphanBindingsStatement`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 `executionPlacementColumnsAdded` / `deviceBindingsMoved` / " +
             "`deviceBindingsOrphaned` / `deviceBindingTablesDropped` / `executionPlacementsBackfilled` / `executionPlacementSessionsUnreadable` 与 `device_bindings_orphaned` / `execution_placement_session_unreadable` 两行 warn;`test/execution-placement-switch-db-integration.test.ts` 整份与 `test/one-time-migrations.test.ts` 的 M32 组。" +
             "**local 腿的回填席与它的点名词一并删**:`LocalSessionStore` 的 `executionPlacementBackfill`(属性与构造里的那一臂)、`execution-placement.ts` 的 `LocalPlacementBackfillSeat` / `UnusableArchive` / `UnusableArchiveWord`(含它的 `storage` 词 —— 读存档文件时抛了别的故障、`errno` 随带,该词只有回填点名用)/ `isUnusableArchive`、" +
             "`ExecutionPlacementSessionUnreadable`;`local-session-store.ts` 里 `placementRead` 并回 `readExecutionPlacement`、`metaRead` 的 unusable 臂与 `forkingOf` 的 `storage` 臂改成就地上抛 `probe.fault`(`archiveFaultWord` / `unusableArchiveOf` 随词删,探针只留「不在」与已知在而用不了的读法);" +
@@ -570,13 +562,13 @@ export const ONE_TIME_MIGRATIONS = [
             "删什么:`src/plugins/imported-layer-root-retirement.ts` 整个文件;migrateStepsOn 的 M36 步(规则表与 `grammar` 列的在场探针 + 对 `retireImportedLayerRootAllows` 的调用)与握锁连接上的 `query` 口" +
             "(`LockedMigrationDb` 与 `mysqlDb` / `pgDb` 里的那一员,若届时再无别的步骤用它);`permission-rule-store-sql.ts` 的 `listRuleBucketOwners` / `isSqlBucketRefusal` / `isSqlBucketVanished` / `RuleBucketVanishedError`(取点那一句的具名类,届时若再无别的读者按类判它,收回成裸错)/ `IMPORT_RECORD_KIND`;" +
             "`permission-rule-store-file.ts` 的 `FileRuleApprovalRecordStore.importRecordOwners` / `fileRuleBucketOwners` / `isFileBucketDamaged`;`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里 M36 那一腿(规则目录在场判与那一处调用)与报告两键的那两行;" +
-            "本文件的 `createSqlImportedLayerRootSource` 与 `importedLayerRootAllowsRetired` / `importedLayerRootBucketsSkipped`(报告 / 收据 / `changedAnything` / `readingsSnapshot` / `readingFields` / `receiptSentence` / `NO_SQL_MIGRATIONS` 的排除表)、" +
-            "`imported_layer_root_allow_retired` / `imported_layer_root_bucket_skipped` 两行 warn 与 `importedLayerRootSkipNote`、读数行 note 里的 M36 句与头注 M36 段;" +
+            "本文件的 `createSqlImportedLayerRootSource` 与 `importedLayerRootAllowsRetired` / `importedLayerRootBucketsSkipped` / `importedLayerRootBucketsUnnamed`(报告 / 收据 / `changedAnything` / `readingsSnapshot` / `readingFields` / `receiptSentence` / `NO_SQL_MIGRATIONS` 的排除表)、" +
+            "`imported_layer_root_allow_retired` / `imported_layer_root_bucket_skipped` / `imported_layer_root_buckets_unnamed` 三行 warn 与 `importedLayerRootSkipNote`、读数行 note 里的 M36 句与头注 M36 段;" +
             "`test/imported-layer-root-retirement.test.ts`、`test/imported-layer-root-retirement-db-integration.test.ts`(连同 `scripts/db-integration-files.json` 里它那一行)与 `test/helpers/imported-layer-root-fixture.ts` 整文件。" +
             "**不随本条删**:`SqlDurableRulePartitionProvider` 收「方言 + 执行口」的那一形(`BucketSql`;常设,池照旧满足它)",
         afterRemoval: "没有响亮臂(如实):删码之后,跳过了带本条的版本直接升的库(或回滚到引擎 7.61.0 之前、在其上又导入过的库),存量的这种全局 `/x` allow 照旧在每个项目根放行,本服务不再点名 —— " +
             "出路 = 升级时先过一次带本条的版本并起服;或运维列出桶里出处为导入(`adds[].origin` = `imported-cc`)、scope 为全局、从 `/` 写起的 allow(`GET /v1/rules`)并撤掉(`DELETE /v1/rules`,撤的是这条规则的全部批准)",
-        reportKeys: ["importedLayerRootAllowsRetired", "importedLayerRootBucketsSkipped"],
+        reportKeys: ["importedLayerRootAllowsRetired", "importedLayerRootBucketsSkipped", "importedLayerRootBucketsUnnamed"],
     },
     {
         id: "M37",
@@ -604,6 +596,46 @@ export const ONE_TIME_MIGRATIONS = [
             "出路是取消那条 run,把凭据挪进引擎进程环境后重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行、窗内续跑过又停驻到窗外的任务(头注 M38 段)",
         reportKeys: [],
     },
+    {
+        id: "M39",
+        introducedIn: "7.147.0",
+        releasedOn: "2026-11-07",
+        removableAfter: "2026-12-07",
+        removal: "删 `src/plugins/local-data-dir-modes-m39.ts` 整只文件;`store-backend.ts` 里 `LocalBackend.runOneTimeMigrations` 开头调它的那一段(两只日志座的接线)、`dataDirLayout` 字段与它的赋值、顶部的 import(含 `memoryEngineRootFor`),以及 `runOneTimeMigrations` 与 `discloseWarn` 注释里点名 M39 的那两句;" +
+            "各店为名册导出的目录路径函数(`fileRunStoreDirsFor` / `localCheckpointStoreDirsFor` / `attachmentStoreDirFor` / `scratchpadRootFor` / `memorySyncCursorDirFor`)只剩本店自己读的去掉 `export` 与注释里的 M39 一句(`pluginCacheRootFor` 组合根仍读,留);" +
+            "`test/data-dir-modes-upgrade-m39.test.ts` 整只文件;`test/data-dir-law-census.test.ts` 例外名册里 `plugins/local-data-dir-modes-m39.ts` 那一行、模式值例外名册里它那一行、「M39 名册零字面路径」一格与「字面量 = ensureDir 铸出的模式」一格里的迁移半场;本文件头注 M39 段;重生成 `docs/core-consumption/READ-TABLE.json`(迁移读 core 的 `physicalPathOf` 那一行随之去掉)。" +
+            "**不随本条删**:数据根建目录只经 `ensureDir` 这条律本身(常设)、`plugins/owner-only-file-mode.ts`(本服务文件的 `0600` 唯一值与原子写的两个出口:异步出口常设,同步出口按它自己的退役条件 —— core 的原子写改成独占新建 tmp —— 走,不随本条)及它们的钉 —— `test/data-dir-law-census.test.ts`(`src/**` 零裸 mkdir、零手写 0o700、文件模式只认一个名字、tmp 只在一只写口里铸)与 `test/data-dir-modes.test.ts`(每只 local 店首建目录 0700、旧 tmp 不被复用)",
+        afterRemoval: "没有响亮臂(如实,也无需):删码之后,跳过了带本条的版本直接升的数据根,升级前铸成的 0755 目录原样留着(新建的目录一律 0700,不受影响;里面的文件多半仍是 0600),本服务不再点名 —— " +
+            "出路 = 运维一次 `chmod 700` 数据根下 `runs`(及其子目录)· `space-commits` · `checkpoint-ctx` · `.tmp` · `attachments` · `scratchpad`(及其子目录)· `plugin-cache`(及其子目录)· `<记忆引擎根>/sync-cursors`,或升级时先过一次带本条的版本并起服",
+        reportKeys: [],
+    },
+    {
+        id: "M40",
+        introducedIn: "7.147.0",
+        releasedOn: "2026-11-07",
+        removableAfter: "2026-12-07",
+        removal: "删 `src/plugins/execution-lane-rename-m40.ts` 整只文件;本文件的 M40 步(`renameRetiredExecutionLaneWordsM40` / `refuseWhileRunsHeartbeat`〔它读的 `readLiveRunHeartbeat` / `LiveRunHeartbeat` 由 M41 共读,M41 也已删码时随之删〕/ `ExecutionLaneRenameRefusedError` / " +
+            "`EXECUTION_LANE_RENAME_REFUSED_CODE` / `ExecutionLaneRenameInput`,`migrateStepsOn` 第一步那一行与 `SqlOneTimeMigrationInput` 里的那一半)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `executionLaneWordsRenamed`、头注 M40 段;" +
+            "`store-backend.ts` 的 `LocalBackend.ensureSchema` 第一步与 `executionLaneWordsRenamed` 字段、两只 SQL 后端递 `liveRunWindowMs` 的那一半;" +
+            "`LocalSessionStore.renameRetiredExecutionLaneWordM40`、`FileApprovalAskStore.renameRetiredExecutionLaneWordM40` 与内核的 `renameExecutionLaneWord`;" +
+            "`approval-ask-store-sql.ts` / `execution-placement-sql.ts` 拒句里的 `retiredExecutionLaneHintM40(…)` 补句;`test/execution-lane-rename-m40.test.ts` 整只文件与 `test/execution-placement-switch-db-integration.test.ts` 的 M40 组",
+        afterRemoval: "既有读口的拒臂接住(响亮,不再改名):仍带旧词的行 —— 跳过了带本条的版本直接升的库、窗关之后还在写的更早版本副本 —— SQL 问行读口拒、会话执行格读口拒(`ExecutionPlacementRowError`)," +
+            "local 会话元数据边档整只严格拒启(`config.schema_mismatch`),local 问账日志由 M32 回填的词表外拒臂拒启(M32 删码之后:那只问行原样装回)。出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["executionLaneWordsRenamed"],
+    },
+    {
+        id: "M41",
+        introducedIn: "7.147.0",
+        releasedOn: "2026-11-07",
+        removableAfter: "2026-12-07",
+        removal: "删本文件的 M41 步(`moveSessionCellsToSideTable` / `refuseSessionExtMoveWhileRunsHeartbeat` / `deploymentColumnsOnMeta` / `SessionExtMoveRefusedError` / `SESSION_EXT_MOVE_REFUSED_CODE` / " +
+            "`SessionExtMoveRefusalReason` / `sameCell` / `SESSION_EXT_MOVE_PAGE`,`migrateStepsOn` 里那两行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `sessionExtRowsMoved` / `sessionMetaColumnsDropped`、头注 M41 段;" +
+            "M32 读形里的 `cellsOnSideTable` 判(它读本条的 `deploymentColumnsOnMeta`):M32 还在时改成恒旁表形 —— 删 M32 写 `session_meta` 八列的那些臂(② ④ ④b ⑥ 与 ③ 的 `migrateDeviceBindingsStatement` 臂)," +
+            "留 ③ 的旁表臂(`migrateDeviceBindingsOntoSideTableStatements`:围栏拒句的「采旧」在任何库上仍要能落到执行格);M32 先于本条删码时这些随 M32 一并删;`readLiveRunHeartbeat` 在 M40 也已删码时随之删;`test/session-ext-move-db-integration.test.ts` 整只文件",
+        afterRemoval: "跳过了带本条的版本直接升上来的库:`session_meta` 上仍带部署格列 ⇒ 起服列册对账拒启(`config.schema_mismatch`,那几列是本树之外的多余列,拒句不给 ALTER —— 出路是带本条的版本);" +
+            "部署格从旁表读,旧列上的值不被任何读者读。出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["sessionExtRowsMoved", "sessionMetaColumnsDropped"],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;
@@ -617,8 +649,6 @@ export function migrationWindowEnd(id) {
     return row.removableAfter;
 }
 export const NO_SQL_MIGRATIONS = {
-    workflowParkIndexKey: "file-ledger",
-    workflowParkIndexRowsCarried: 0,
     undurableScopeRuleRows: [],
     undurableScopeRuleBucketsDeferred: 0,
     undurableScopeRuleBucketsUnreadable: [],
@@ -647,6 +677,8 @@ export const NO_SQL_MIGRATIONS = {
     deviceBindingsMoved: 0,
     deviceBindingsOrphaned: 0,
     deviceBindingTablesDropped: 0,
+    sessionExtRowsMoved: 0,
+    sessionMetaColumnsDropped: 0,
     askCauseColumnsChanged: 0,
     askParkTriggersMoved: 0,
 };
@@ -703,7 +735,7 @@ async function columnExists(db, dialect, table, column) {
     return (await db.rows(sql)).length > 0;
 }
 export function createSqlImportedLayerRootSource(exec) {
-    return { candidateOwners: () => listRuleBucketOwners(exec), durable: new SqlDurableRulePartitionProvider(exec), isWholeBucketRefusal: isSqlBucketRefusal, isVanishedBucket: isSqlBucketVanished };
+    return { candidateOwners: async () => ({ owners: await listRuleBucketOwners(exec), unnamedBuckets: 0 }), durable: new SqlDurableRulePartitionProvider(exec), isWholeBucketRefusal: isSqlBucketRefusal, isVanishedBucket: isSqlBucketVanished };
 }
 export async function runSqlOneTimeMigrations(dialect, pool, input) {
     return dialect === "mysql" ? withMysqlLock(pool, (db) => migrateOn(db, "mysql", input)) : withPgLock(pool, (db) => migrateOn(db, "pg", input));
@@ -747,9 +779,10 @@ async function migrateOn(db, dialect, input) {
     return completedReport(receipts);
 }
 async function migrateStepsOn(db, dialect, receipts, input) {
+    await renameRetiredExecutionLaneWordsM40(db, dialect, receipts, input);
+    await refuseSessionExtMoveWhileRunsHeartbeat(db, dialect, input);
     await migrateRetiredCardWords(db, dialect, receipts);
     await splitApprovalAskCauseColumns(db, dialect, receipts);
-    await reshapeWorkflowParkIndex(db, dialect, receipts);
     await migrateSessionRuleGrammar(db, dialect, receipts);
     await repairParkedRows(db, dialect, receipts);
     await backfillParkedApprovalCards(db, dialect, receipts);
@@ -765,6 +798,149 @@ async function migrateStepsOn(db, dialect, receipts, input) {
         await dropRetiredBreakerTable(db, dialect, receipts);
     await dropRejectedMailboxKeys(db, dialect, receipts);
     await switchExecutionPlacement(db, dialect, receipts, input);
+    await moveSessionCellsToSideTable(db, dialect, receipts);
+}
+export const EXECUTION_LANE_RENAME_REFUSED_CODE = "config.execution_lane_rename_refused";
+export class ExecutionLaneRenameRefusedError extends StoreBootRefusalError {
+    pendingRows;
+    liveRuns;
+    restartAfter;
+    code = EXECUTION_LANE_RENAME_REFUSED_CODE;
+    constructor(pendingRows, liveRuns, restartAfter, detail) {
+        super(`${EXECUTION_LANE_RENAME_REFUSED_CODE}: ${detail}`);
+        this.pendingRows = pendingRows;
+        this.liveRuns = liveRuns;
+        this.restartAfter = restartAfter;
+        this.name = "ExecutionLaneRenameRefusedError";
+    }
+}
+export class ExecutionLaneRenameWriteRefusedError extends StoreBootRefusalError {
+    file;
+    code = EXECUTION_LANE_RENAME_REFUSED_CODE;
+    errno;
+    constructor(file, cause) {
+        const errno = typeof cause?.code === "string" ? cause.code : undefined;
+        const fault = errno ?? (cause instanceof Error ? cause.message : String(cause));
+        super(`${EXECUTION_LANE_RENAME_REFUSED_CODE}: one-time migration M40 could not rewrite ${file} (${fault}) — it still records the retired execution-lane word ` +
+            `"${RETIRED_EXECUTION_LANE_WORD_M40}" (now "${RENAMED_EXECUTION_LANE_M40}"), which this build refuses to read, so it refuses to start rather than run without that data. ` +
+            `The file is unchanged. Restore write access to the file and its directory (clear an immutable flag, remount read-write, free disk space), then restart: the rename runs again on the next start.`, { cause });
+        this.file = file;
+        this.name = "ExecutionLaneRenameWriteRefusedError";
+        this.errno = errno;
+    }
+}
+const EXECUTION_LANE_TABLES = [APPROVAL_ASK_TABLE, "session_meta", SESSION_EXT_TABLE];
+export async function renameRetiredExecutionLaneWordsM40(db, dialect, receipts, input) {
+    const tables = [];
+    for (const table of EXECUTION_LANE_TABLES)
+        if (await columnExists(db, dialect, table, "execution_lane"))
+            tables.push(table);
+    let pendingRows = 0;
+    for (const table of tables) {
+        const [row] = await db.rows(`SELECT COUNT(*) AS n FROM ${table} WHERE execution_lane = ${dialect === "mysql" ? "?" : "$1"}`, [RETIRED_EXECUTION_LANE_WORD_M40]);
+        pendingRows += Number(row?.["n"] ?? 0);
+    }
+    if (pendingRows === 0)
+        return;
+    await refuseWhileRunsHeartbeat(db, dialect, pendingRows, input);
+    for (const table of tables) {
+        receipts.executionLaneWordsRenamed += await db.exec(dialect === "mysql" ? `UPDATE ${table} SET execution_lane = ? WHERE execution_lane = ?` : `UPDATE ${table} SET execution_lane = $1 WHERE execution_lane = $2`, [RENAMED_EXECUTION_LANE_M40, RETIRED_EXECUTION_LANE_WORD_M40]);
+    }
+}
+async function readLiveRunHeartbeat(db, dialect, input) {
+    if (!(await tableExists(db, dialect, "task_run")))
+        return undefined;
+    const since = new Date(Date.now() - input.liveRunWindowMs);
+    const [row] = await db.rows(`SELECT COUNT(*) AS n, MAX(updated_at) AS newest FROM task_run WHERE status = 'running' AND updated_at >= ${dialect === "mysql" ? "?" : "$1"}`, [since]);
+    const liveRuns = Number(row?.["n"] ?? 0);
+    if (liveRuns === 0)
+        return undefined;
+    const newestCell = row?.["newest"];
+    const newest = newestCell instanceof Date ? newestCell : new Date(String(newestCell));
+    const now = Date.now();
+    const restartAtMs = (Number.isNaN(newest.getTime()) ? now : newest.getTime()) + input.liveRunWindowMs;
+    return {
+        liveRuns,
+        windowSec: Math.round(input.liveRunWindowMs / 1000),
+        restartAfter: new Date(restartAtMs).toISOString(),
+        after: `${new Date(restartAtMs).toISOString()} (${Math.max(0, Math.ceil((restartAtMs - now) / 1000))}s from now)`,
+    };
+}
+async function refuseWhileRunsHeartbeat(db, dialect, pendingRows, input) {
+    const heartbeat = await readLiveRunHeartbeat(db, dialect, input);
+    if (heartbeat === undefined)
+        return;
+    const { liveRuns, windowSec, restartAfter, after } = heartbeat;
+    throw new ExecutionLaneRenameRefusedError(pendingRows, liveRuns, restartAfter, `${pendingRows} stored rows (approval asks / sessions) carry the execution lane word "${RETIRED_EXECUTION_LANE_WORD_M40}", the name an earlier version gave the lane with no execution environment, ` +
+        `which this version calls "${RENAMED_EXECUTION_LANE_M40}" and does not read; this boot renames them (one-time migration M40), but ${liveRuns} running runs on this database heartbeat within the last ${windowSec}s ` +
+        `(REAP_RUN_STALE_SEC) — a replica of an earlier version is still serving, and it would keep writing the old word after the rename. No stored row was changed. ` +
+        "Stop every replica of the earlier version, then start this version (stop, migrate, start — this release cannot be rolled across replicas of both versions). " +
+        `If every replica is already stopped, those are the runs they left behind: start this version again after ${after}`);
+}
+export const SESSION_EXT_MOVE_REFUSED_CODE = "config.session_ext_move_refused";
+export class SessionExtMoveRefusedError extends StoreBootRefusalError {
+    reason;
+    code = SESSION_EXT_MOVE_REFUSED_CODE;
+    constructor(reason, detail) {
+        super(`${SESSION_EXT_MOVE_REFUSED_CODE} (reason: ${reason}): ${detail}`);
+        this.reason = reason;
+        this.name = "SessionExtMoveRefusedError";
+    }
+}
+async function deploymentColumnsOnMeta(db, dialect) {
+    if (!(await tableExists(db, dialect, "session_meta")))
+        return [];
+    const present = [];
+    for (const column of SESSION_EXT_COLUMNS)
+        if (await columnExists(db, dialect, "session_meta", column.name))
+            present.push(column);
+    return present;
+}
+const sameCell = (dialect, column) => {
+    const side = column.name === "pinned" ? "COALESCE(se.pinned, FALSE)" : `se.${column.name}`;
+    return dialect === "mysql" ? `sm.${column.name} <=> ${side}` : `sm.${column.name} IS NOT DISTINCT FROM ${side}`;
+};
+const SESSION_EXT_MOVE_PAGE = 500;
+export async function refuseSessionExtMoveWhileRunsHeartbeat(db, dialect, input) {
+    const columns = await deploymentColumnsOnMeta(db, dialect);
+    if (columns.length === 0)
+        return;
+    const heartbeat = await readLiveRunHeartbeat(db, dialect, input);
+    if (heartbeat === undefined)
+        return;
+    throw new SessionExtMoveRefusedError("live_runs", `${columns.length} session cells (${columns.map((c) => c.name).join(", ")}) still live on session_meta; this version keeps them on the side table ${SESSION_EXT_TABLE} and moves them on this boot ` +
+        `(one-time migration M41: copy, verify, then drop the columns), but ${heartbeat.liveRuns} running runs on this database heartbeat within the last ${heartbeat.windowSec}s (REAP_RUN_STALE_SEC) — ` +
+        "a replica of an earlier version is still serving; a cell it writes between the copy and the drop would be lost, and every cell write it makes after the drop fails. Nothing was changed. " +
+        "Stop every replica of the earlier version, then start this version (stop, migrate, start — this release cannot be rolled across replicas of both versions). " +
+        `If every replica is already stopped, those are the runs they left behind: start this version again after ${heartbeat.after}`);
+}
+export async function moveSessionCellsToSideTable(db, dialect, receipts) {
+    const columns = await deploymentColumnsOnMeta(db, dialect);
+    if (columns.length === 0)
+        return;
+    const names = columns.map((c) => c.name);
+    const p = dialect === "mysql" ? () => "?" : (n) => `$${n}`;
+    const upsert = `INSERT INTO ${SESSION_EXT_TABLE} (session_id, ${names.join(", ")}) SELECT session_id, ${names.join(", ")} FROM session_meta ` +
+        `WHERE session_id > ${p(1)} AND session_id <= ${p(2)} ` +
+        (dialect === "mysql" ? `ON DUPLICATE KEY UPDATE ${names.map((n) => `${SESSION_EXT_TABLE}.${n} = VALUES(${n})`).join(", ")}` : `ON CONFLICT (session_id) DO UPDATE SET ${names.map((n) => `${n} = EXCLUDED.${n}`).join(", ")}`);
+    let after = "";
+    for (;;) {
+        const page = await db.rows(`SELECT session_id FROM session_meta WHERE session_id > ${p(1)} ORDER BY session_id LIMIT ${SESSION_EXT_MOVE_PAGE}`, [after]);
+        if (page.length === 0)
+            break;
+        const last = String(page[page.length - 1]["session_id"]);
+        await db.exec(upsert, [after, last]);
+        receipts.sessionExtRowsMoved += page.length;
+        after = last;
+    }
+    const [mismatch] = await db.rows(`SELECT sm.session_id FROM session_meta sm LEFT JOIN ${SESSION_EXT_TABLE} se ON se.session_id = sm.session_id WHERE NOT (${columns.map((c) => sameCell(dialect, c)).join(" AND ")}) LIMIT 1`);
+    if (mismatch !== undefined) {
+        throw new SessionExtMoveRefusedError("copy_mismatch", `after copying the session cells (${names.join(", ")}) from session_meta to ${SESSION_EXT_TABLE}, session ${String(mismatch["session_id"])} does not hold the same values on both tables — ` +
+            "a writer changed it while this boot copied (an earlier-version replica still serving), or the copy did not land. No column was dropped. " +
+            "Stop every replica of the earlier version and start this version again: the copy runs again from the start");
+    }
+    await execUntil(db, `ALTER TABLE session_meta ${names.map((n) => `DROP COLUMN ${n}`).join(", ")}`, async () => (await deploymentColumnsOnMeta(db, dialect)).length === 0);
+    receipts.sessionMetaColumnsDropped += columns.length;
 }
 const RETIRED_ASK_CAUSE_COLUMN = "denied_reason";
 function renameAskCauseColumnSql(dialect) {
@@ -806,12 +982,13 @@ async function readSwitchShape(db, dialect) {
     const sessionMeta = await tableExists(db, dialect, "session_meta");
     const placementColumns = new Set();
     if (sessionMeta)
-        for (const c of SESSION_META_PLACEMENT_COLUMNS)
+        for (const c of EXECUTION_PLACEMENT_COLUMNS)
             if (await columnExists(db, dialect, "session_meta", c.name))
                 placementColumns.add(c.name);
     return {
         sessionMeta,
         placementColumns,
+        cellsOnSideTable: sessionMeta && (await deploymentColumnsOnMeta(db, dialect)).length === 0,
         bindingTable: await tableExists(db, dialect, RETIRED_DEVICE_BINDING_TABLE),
         parkedTable: await tableExists(db, dialect, PARKED_DEVICE_BINDING_TABLE),
         taskRun: sessionMeta && (await tableExists(db, dialect, "task_run")),
@@ -823,11 +1000,11 @@ async function askTableShape(db, dialect) {
     return { askTable, askLaneColumn: askTable && (await columnExists(db, dialect, APPROVAL_ASK_TABLE, "execution_lane")) };
 }
 function switchStarted(s) {
-    return s.placementColumns.has("execution_role") || s.parkedTable;
+    return s.placementColumns.has("execution_role") || s.parkedTable || s.cellsOnSideTable;
 }
 const SWITCH_COMPLETION_COLUMN = "fork_key";
 function switchComplete(s) {
-    return s.placementColumns.size === SESSION_META_PLACEMENT_COLUMNS.length && (!s.askTable || s.askLaneColumn) && !s.bindingTable && !s.parkedTable;
+    return (s.placementColumns.size === EXECUTION_PLACEMENT_COLUMNS.length || s.cellsOnSideTable) && (!s.askTable || s.askLaneColumn) && !s.bindingTable && !s.parkedTable;
 }
 function askLaneBackfillSql(dialect) {
     return dialect === "mysql"
@@ -878,7 +1055,7 @@ const EXECUTION_PLACEMENT_BACKFILL_NEEDS = [
     { what: "approval ask rows that do not record the execution lane they were raised on (they would record their root session's lane, or the only declared lane)", holds: askRowsAwaitingLane },
 ];
 async function refuseOnAmbiguousBackfill(read, dialect, shape, lanes) {
-    if (!shape.sessionMeta || switchComplete(shape) || lanes.length === 1)
+    if (!shape.sessionMeta || shape.cellsOnSideTable || switchComplete(shape) || lanes.length === 1)
         return;
     const pending = [];
     for (const need of EXECUTION_PLACEMENT_BACKFILL_NEEDS)
@@ -931,7 +1108,7 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
         id: "① park the retired binding table",
         run: async ({ db, dialect, shape }) => {
             const s = await shape();
-            if (!s.bindingTable || s.placementColumns.has("execution_role"))
+            if (!s.bindingTable || s.placementColumns.has("execution_role") || s.cellsOnSideTable)
                 return;
             const sql = dialect === "mysql" ? `RENAME TABLE ${RETIRED_DEVICE_BINDING_TABLE} TO ${PARKED_DEVICE_BINDING_TABLE}` : `ALTER TABLE ${RETIRED_DEVICE_BINDING_TABLE} RENAME TO ${PARKED_DEVICE_BINDING_TABLE}`;
             await execUntil(db, sql, async () => {
@@ -955,7 +1132,9 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
     {
         id: "② add the execution placement columns",
         run: async ({ db, dialect, receipts, shape }) => {
-            for (const column of SESSION_META_PLACEMENT_COLUMNS) {
+            if ((await shape()).cellsOnSideTable)
+                return;
+            for (const column of EXECUTION_PLACEMENT_COLUMNS) {
                 if (column.name === SWITCH_COMPLETION_COLUMN)
                     continue;
                 if ((await shape()).placementColumns.has(column.name))
@@ -973,10 +1152,17 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
     {
         id: "③ move the bindings onto the root session rows",
         run: async ({ db, dialect, receipts, shape }) => {
-            if (!(await shape()).parkedTable)
+            const s = await shape();
+            if (!s.parkedTable)
                 return;
             const orphans = countOrphanBindingsStatement(dialect, PARKED_DEVICE_BINDING_TABLE);
             receipts.deviceBindingsOrphaned += Number((await db.rows(orphans.text, orphans.values))[0]?.["orphans"] ?? 0);
+            if (s.cellsOnSideTable) {
+                const [ensure, move] = migrateDeviceBindingsOntoSideTableStatements(dialect, PARKED_DEVICE_BINDING_TABLE);
+                await db.exec(ensure.text, ensure.values);
+                receipts.deviceBindingsMoved += await db.exec(move.text, move.values);
+                return;
+            }
             const move = migrateDeviceBindingsStatement(dialect, PARKED_DEVICE_BINDING_TABLE);
             receipts.deviceBindingsMoved += await db.exec(move.text, move.values);
         },
@@ -985,6 +1171,8 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
         id: "④ backfill placements of sessions with runs",
         run: async ({ db, dialect, input, receipts, shape }) => {
             const s = await shape();
+            if (s.cellsOnSideTable)
+                return;
             if (input.lanes.length !== 1) {
                 await refuseOnAmbiguousBackfill((sql) => db.rows(sql), dialect, s, input.lanes);
                 return;
@@ -998,7 +1186,7 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
         id: "④b backfill the execution lane of approval ask rows",
         run: async ({ db, dialect, input, receipts, shape }) => {
             const s = await shape();
-            if (!s.askTable || !s.askLaneColumn)
+            if (!s.askTable || !s.askLaneColumn || s.cellsOnSideTable)
                 return;
             if (input.lanes.length !== 1) {
                 await refuseOnAmbiguousBackfill((sql) => db.rows(sql), dialect, s, input.lanes);
@@ -1019,9 +1207,10 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
     {
         id: "⑥ add the completion marker column",
         run: async ({ db, dialect, receipts, shape }) => {
-            if ((await shape()).placementColumns.has(SWITCH_COMPLETION_COLUMN))
+            const s = await shape();
+            if (s.placementColumns.has(SWITCH_COMPLETION_COLUMN) || s.cellsOnSideTable)
                 return;
-            const marker = SESSION_META_PLACEMENT_COLUMNS.find((c) => c.name === SWITCH_COMPLETION_COLUMN);
+            const marker = EXECUTION_PLACEMENT_COLUMNS.find((c) => c.name === SWITCH_COMPLETION_COLUMN);
             await execUntil(db, `ALTER TABLE session_meta ADD COLUMN ${marker[dialect]}`, async () => (await shape()).placementColumns.has(SWITCH_COMPLETION_COLUMN));
             receipts.executionPlacementColumnsAdded += 1;
         },
@@ -1063,9 +1252,17 @@ export async function backfillLocalExecutionPlacements(sessionIds, seat, input)
     }
     return { backfilled: placed, unreadable };
 }
+const UNKNOWN_LANE_ASKS_SHOWN = 5;
 export function backfillLocalAskExecutionLanes(store, input) {
-    return store.backfillExecutionLanes(input.lanes, (pending) => {
-        throw new ExecutionPlacementSwitchRefusedError("backfill_ambiguous", `the local approval ask journal holds asks that do not record the execution lane they were raised on (${pending}), and the deployment declares ${input.lanes.length === 0 ? "no lane" : `${input.lanes.length} lanes (${input.lanes.join(", ")})`} — ` +
+    return store.backfillExecutionLanes(input.lanes, (refusal) => {
+        if (refusal.kind === "unknown_lane") {
+            const shown = refusal.asks.slice(0, UNKNOWN_LANE_ASKS_SHOWN).map((a) => `${a.askId} = ${JSON.stringify(a.word)}${retiredExecutionLaneHintM40(a.word) === "" ? "" : " (the retired name of none)"}`);
+            const more = refusal.asks.length > shown.length ? ` and ${refusal.asks.length - shown.length} more` : "";
+            throw new ExecutionPlacementSwitchRefusedError("unknown_lane", `the local approval ask journal holds ${refusal.asks.length} asks whose recorded execution lane is not a lane this version knows (${shown.join(", ")}${more}) — ` +
+                "recording the deployment's lane over it would rewrite the lane the ask was raised on, and this server will not guess one. Nothing was changed. " +
+                "The journal was written by a newer version or altered by hand: start the version that wrote it, or restore the journal from a copy");
+        }
+        throw new ExecutionPlacementSwitchRefusedError("backfill_ambiguous", `the local approval ask journal holds asks that do not record the execution lane they were raised on (${refusal.pending}), and the deployment declares ${input.lanes.length === 0 ? "no lane" : `${input.lanes.length} lanes (${input.lanes.join(", ")})`} — ` +
             "with more than one lane there is no single right answer, and this server will not guess one. Nothing was changed. " +
             "Start this version once with a single declared lane (REMOTE_EXEC set to one lane), then declare the additional lanes");
     });
@@ -1294,55 +1491,6 @@ function renameSessionRulesColumnSql(dialect, from, to) {
     const definition = SESSION_RULES_COLUMN.mysql.slice(SESSION_RULES_COLUMN.name.length);
     return dialect === "mysql" ? `ALTER TABLE ${SESSION_POLICY_TABLE} CHANGE COLUMN ${from} ${to}${definition}` : `ALTER TABLE ${SESSION_POLICY_TABLE} RENAME COLUMN ${from} TO ${to}`;
 }
-const WORKFLOW_PARK_INDEX_TABLE = "workflow_agent_session";
-async function primaryKeyWidth(db, dialect, table) {
-    const sql = dialect === "mysql"
-        ? `SELECT COUNT(*) AS n FROM information_schema.key_column_usage WHERE table_schema = DATABASE() AND table_name = '${table}' AND constraint_name = 'PRIMARY'`
-        : `SELECT COUNT(*) AS n FROM information_schema.table_constraints tc JOIN information_schema.key_column_usage kcu ` +
-            `ON kcu.constraint_name = tc.constraint_name AND kcu.table_schema = tc.table_schema AND kcu.table_name = tc.table_name ` +
-            `WHERE tc.table_schema = current_schema() AND tc.table_name = '${table}' AND tc.constraint_type = 'PRIMARY KEY'`;
-    return Number((await db.rows(sql))[0]?.n ?? 0);
-}
-const WORKFLOW_PARK_INDEX_STAGING = `${WORKFLOW_PARK_INDEX_TABLE}_m9`;
-const WORKFLOW_PARK_INDEX_RETIRED = `${WORKFLOW_PARK_INDEX_TABLE}_m9_old`;
-async function reshapeWorkflowParkIndex(db, dialect, receipts) {
-    const T = WORKFLOW_PARK_INDEX_TABLE;
-    const S = WORKFLOW_PARK_INDEX_STAGING;
-    const O = WORKFLOW_PARK_INDEX_RETIRED;
-    const exists = (t) => tableExists(db, dialect, t);
-    const ddl = (dialect === "mysql" ? SCHEMA_STATEMENTS : PG_SCHEMA_STATEMENTS).find((stmt) => stmt.includes(`CREATE TABLE IF NOT EXISTS ${T} (`));
-    if (ddl === undefined)
-        throw new Error(`one-time migration M9: the central schema carries no definition of ${T} — refusing to reshape a table it cannot rebuild`);
-    const copyPointers = (to, from) => db.exec(dialect === "mysql"
-        ? `INSERT IGNORE INTO ${to} (session_id, run_id, agent_key, scope) SELECT session_id, run_id, agent_key, scope FROM ${from}`
-        : `INSERT INTO ${to} (session_id, run_id, agent_key, scope) SELECT session_id, run_id, agent_key, scope FROM ${from} ON CONFLICT DO NOTHING`);
-    const resumed = await exists(S);
-    if (resumed) {
-        await db.exec(ddl);
-        receipts.workflowParkIndexRowsCarried += await copyPointers(T, S);
-        await execUntil(db, `DROP TABLE ${S}`, async () => !(await exists(S)));
-    }
-    if (await exists(O))
-        await execUntil(db, `DROP TABLE ${O}`, async () => !(await exists(O)));
-    if ((await primaryKeyWidth(db, dialect, T)) !== 1) {
-        if (await exists(T))
-            await finishParkIndexShape(db, dialect);
-        receipts.workflowParkIndexKey = resumed ? "reshaped" : "current";
-        return;
-    }
-    await db.exec(ddl.replace(`CREATE TABLE IF NOT EXISTS ${T} (`, `CREATE TABLE IF NOT EXISTS ${S} (`));
-    receipts.workflowParkIndexRowsCarried += await copyPointers(S, T);
-    const swapped = async () => !(await exists(S)) && (await exists(T)) && (await primaryKeyWidth(db, dialect, T)) !== 1;
-    if (dialect === "mysql") {
-        await execUntil(db, `RENAME TABLE ${T} TO ${O}, ${S} TO ${T}`, swapped);
-        await execUntil(db, `DROP TABLE IF EXISTS ${O}`, async () => !(await exists(O)));
-    }
-    else {
-        await execAtomically(db, [`ALTER TABLE ${T} RENAME TO ${O}`, `ALTER TABLE ${S} RENAME TO ${T}`, `DROP TABLE ${O}`], async () => (await swapped()) && !(await exists(O)));
-    }
-    await finishParkIndexShape(db, dialect);
-    receipts.workflowParkIndexKey = "reshaped";
-}
 async function execAtomically(db, statements, postcondition) {
     try {
         await db.exec("BEGIN");
@@ -1362,16 +1510,6 @@ async function execAtomically(db, statements, postcondition) {
             throw e;
     }
 }
-async function finishParkIndexShape(db, dialect) {
-    await ensureIndexes(async (sql, params) => (dialect === "mysql" ? [await db.rows(sql, params)] : { rows: await db.rows(sql, params) }), dialect, CENTRAL_SCHEMA_INDEXES.filter((spec) => spec.table === WORKFLOW_PARK_INDEX_TABLE));
-    if (dialect !== "pg")
-        return;
-    const conventional = `${WORKFLOW_PARK_INDEX_TABLE}_pkey`;
-    const pk = await db.rows(`SELECT constraint_name FROM information_schema.table_constraints WHERE table_schema = current_schema() AND table_name = '${WORKFLOW_PARK_INDEX_TABLE}' AND constraint_type = 'PRIMARY KEY'`);
-    const name = pk[0]?.constraint_name;
-    if (typeof name === "string" && name !== conventional)
-        await db.exec(`ALTER TABLE ${WORKFLOW_PARK_INDEX_TABLE} RENAME CONSTRAINT ${name} TO ${conventional}`);
-}
 const RETIRED_CARD_WORD_PATTERNS = ['%"shadowed"%', '%"governance_unavailable"%'];
 const RETIRED_CARD_WORD_BATCH = 500;
 function decodeForM18(text, where) {
@@ -1621,8 +1759,6 @@ export async function inheritPlacedSessionOwners(db, dialect, receipts) {
 }
 function readingFields(r) {
     return {
-        ...(r.workflowParkIndexKey !== undefined ? { workflowParkIndexKey: r.workflowParkIndexKey } : {}),
-        workflowParkIndexRowsCarried: r.workflowParkIndexRowsCarried,
         undurableScopeRuleRowsRemoved: r.undurableScopeRuleRows.length,
         undurableScopeRuleBucketsDeferred: r.undurableScopeRuleBucketsDeferred,
         undurableScopeRuleBucketsUnreadable: r.undurableScopeRuleBucketsUnreadable.length,
@@ -1653,6 +1789,9 @@ function readingFields(r) {
         deviceBindingTablesDropped: r.deviceBindingTablesDropped,
         executionPlacementsBackfilled: r.executionPlacementsBackfilled,
         askExecutionLanesBackfilled: r.askExecutionLanesBackfilled,
+        executionLaneWordsRenamed: r.executionLaneWordsRenamed,
+        sessionExtRowsMoved: r.sessionExtRowsMoved,
+        sessionMetaColumnsDropped: r.sessionMetaColumnsDropped,
         executionPlacementSessionsUnreadable: r.executionPlacementSessionsUnreadable.length,
         localArchiveRowFactsBackfilled: r.localArchiveRowFactsBackfilled,
         localArchivesAnonymized: r.localArchivesAnonymized,
@@ -1664,6 +1803,7 @@ function readingFields(r) {
         askJournalRecordsUpgraded: r.askJournalRecordsUpgraded,
         importedLayerRootAllowsRetired: r.importedLayerRootAllowsRetired.length,
         importedLayerRootBucketsSkipped: r.importedLayerRootBucketsSkipped.length,
+        importedLayerRootBucketsUnnamed: r.importedLayerRootBucketsUnnamed,
     };
 }
 export function logOneTimeMigrations(log, backend, report) {
@@ -1671,8 +1811,7 @@ export function logOneTimeMigrations(log, backend, report) {
         backend,
         ...readingFields(report),
         removableAfter: Object.fromEntries(ONE_TIME_MIGRATIONS.map((w) => [w.id, w.removableAfter])),
-        note: "one-time persisted-data migrations (M9: the workflow park pointer index rebuilt with the key (session, run), " +
-            "its rows carried over; M10 writes nothing at boot — on the local backend, while its window is open, the first task submitted with a principal " +
+        note: "one-time persisted-data migrations (M10 writes nothing at boot — on the local backend, while its window is open, the first task submitted with a principal " +
             "on a session written by an earlier version (which recorded no owner) claims that session for the principal, one session_owner_claimed line per claim; " +
             "M11: persisted permission rules whose project scope root is not a complete absolute path — accepted by earlier versions, dropped on every read " +
             "by the current engine and not removable through DELETE /v1/rules — removed, one permission_rule_row_removed line per row; a bucket the read path " +
@@ -1721,7 +1860,10 @@ export function logOneTimeMigrations(log, backend, report) {
             "M36: allow approvals that an import before engine 7.61.0 stored as global rules from a settings file's user-layer path written from `/` — which the user layer reads at its " +
             "configuration directory and a global rule reads at every task's project root — retired by tombstones naming exactly those approvals (a rule that also holds an approval a person " +
             "gave directly stays in effect; deny and ask rules are never retired), one imported_layer_root_allow_retired line per rule; a bucket that could not be read or written, or that another replica deleted while it was being written, is named by an " +
-            "imported_layer_root_bucket_skipped line on every boot). Each step " +
+            "imported_layer_root_bucket_skipped line on every boot; " +
+            "M40: the stored execution lane word in-process — the name earlier versions gave the lane with no execution environment, which this version calls none and does not read — " +
+            "rewritten as none on approval ask rows and session rows (on the local backend: in the session metadata file and the approval ask journal); a boot that finds such rows while " +
+            "runs on the same database still heartbeat refuses with nothing changed, because a replica of an earlier version is still serving and would keep writing the old word). Each step " +
             "runs on every boot until its window closes (the release that introduced it + 30 days; the per-step date is in " +
             "removableAfter, null while that release is not published yet) and is deleted in the first minor after that — start a " +
             "version that still carries a step at least once before upgrading past its deletion.",
@@ -1841,6 +1983,16 @@ function logReceiptRows(log, backend, r) {
     for (const bucket of r.importedLayerRootBucketsSkipped) {
         log.warn("imported_layer_root_bucket_skipped", { backend, ownerKey: bucket.ownerKey, reason: bucket.reason, why: bucket.why, note: importedLayerRootSkipNote(bucket.reason) });
     }
+    if (r.importedLayerRootBucketsUnnamed > 0) {
+        log.warn("imported_layer_root_buckets_unnamed", {
+            backend,
+            count: r.importedLayerRootBucketsUnnamed,
+            note: "this many permission-rule bucket files are present in the rules directory but neither the directory (the local owner's bucket, the identities its adoption marker names) " +
+                "nor this store's import records name their owner (a bucket file is named by a one-way digest of its owner), so the one-time retirement of imported allow rules written from `/` " +
+                "did not read them: any such rule in them stays in effect. This is a gap in the census, not a statement that they are empty. Each boot reports it again; " +
+                "list the rules of every owner you know (`GET /v1/rules`) and remove what should not stand",
+        });
+    }
     for (const bucket of r.undurableScopeRuleBucketsUnreadable) {
         log.warn("permission_rule_bucket_unreadable", {
             backend,
@@ -1901,7 +2053,7 @@ function logOneTimeMigrationsInterrupted(log, backend, error) {
         ...readingFields(error.receipts),
         note: "the one-time migrations failed after committing changes: the readings on this line and the lines that follow are what this boot already committed — a retried " +
             "boot finds that work done and does not report it again, so these lines are the only record of them, written once by this boot — save them. The failure itself follows " +
-            "as this boot's refusal. A shape reading absent from this line (workflowParkIndexKey / sessionRuleColumn / workflowJournalScopeColumn) belongs to a step that did not " +
+            "as this boot's refusal. A shape reading absent from this line (sessionRuleColumn / workflowJournalScopeColumn) belongs to a step that did not " +
             "finish; sessionRuleColumn absent after session_rule_row_old_grammar_entries lines means the column still carries its in-progress name — the next boot rewrites the " +
             "remaining rows (rows already rewritten are left alone) and publishes the final name",
     });