@sema-agent/server 7.146.0 → 7.148.0

package/dist/plugins/one-time-migrations.js

@@ -4,29 +4,34 @@ import { judgeCheckpointIndexCells } from "./checkpoint-index-columns.js";
 import { dialectProtocolJsonEncoder } from "./sql-driver.js";
 import { SCHEMA_STATEMENTS, acquireEnsureSchemaLock, releaseEnsureSchemaLock } from "./tidb-pool.js";
 import { PG_SCHEMA_STATEMENTS, acquirePgEnsureSchemaLock, releasePgEnsureSchemaLock } from "./pg-pool.js";
-import { CENTRAL_SCHEMA_INDEXES } from "./schema-indexes.js";
-import { ensureIndexes } from "./ensure-index.js";
 import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readOpaqueJsonValueColumn, } from "./sql-json-column.js";
 import { incarnationFromCell, sessionFaceFromRow } from "../session-incarnation.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
-import { PERMISSION_RULE_TABLE, SqlDurableRulePartitionProvider, isSqlBucketRefusal, isSqlBucketVanished, listRuleBucketOwners, purgeUndurableScopeRows } from "./permission-rule-store-sql.js";
+import { decodeRunResultCellM44 } from "./run-store-sql.js";
+import { persistedPlaneOf } from "../terminal.js";
+import { RUN_PREVIEW_COARSE_PREFIXES_M45, normalizedRunPreviewM45 } from "./run-preview-m45.js";
+import { SHELL_SENTINEL_OWNER_M48, SHELL_SENTINEL_OWNER_TABLES_M48 } from "./shell-sentinel-owner-m48.js";
+import { LEGACY_SKILL_EXEMPTION_MARKER_ID, LEGACY_SKILL_EXEMPTION_PAGE, LEGACY_SKILL_EXEMPTION_TOOL_NAME } from "./approval-exemption-skill-m46.js";
+import { PERMISSION_RULE_TABLE, SqlDurableRulePartitionProvider, isSqlBucketRefusal, isSqlBucketVanished, listRuleBucketOwners } from "./permission-rule-store-sql.js";
 import { SESSION_RULES_COLUMN } from "./session-rules-column.js";
 import { readJsonObjectColumn } from "./sql-json-column.js";
 import { retireStoredCardWords } from "../retired-card-words.js";
 import { redactSecrets } from "../trace/redact.js";
 import { CLAIM_OWNERLESS_PLACED_SQL, claimOwnerlessParams, isOrphanSessionOwner, judgeDelegatedOwner } from "../delegated-session-owner.js";
 import { MAILBOX_KEYED_TABLES, mailboxKeyDeleteSql, storedMailboxKeyless } from "../stores-sql/mailbox-store-sql.js";
-import { SESSION_META_PLACEMENT_COLUMNS, backfillWriterStatement, countOrphanBindingsStatement, migrateDeviceBindingsStatement } from "./execution-placement-sql.js";
+import { backfillWriterStatement, countOrphanBindingsStatement, migrateDeviceBindingsOntoSideTableStatements, migrateDeviceBindingsStatement } from "./execution-placement-sql.js";
+import { WITHDRAW_MARK_ID } from "./session-withdraw-sql.js";
+import { EXECUTION_PLACEMENT_COLUMNS, SESSION_EXT_MOVED_COLUMNS, SESSION_EXT_TABLE } from "./session-ext-table.js";
 import { APPROVAL_ASK_ENDING_CAUSE_COLUMN, APPROVAL_ASK_EXECUTION_LANE_COLUMN, APPROVAL_ASK_PARK_TRIGGER_COLUMN, APPROVAL_ASK_TABLE } from "./approval-ask-store-sql.js";
+import { RENAMED_EXECUTION_LANE_M40, RETIRED_EXECUTION_LANE_WORD_M40, retiredExecutionLaneHintM40 } from "./execution-lane-rename-m40.js";
 import { retireImportedLayerRootAllows } from "./imported-layer-root-retirement.js";
 import { isUnusableArchive } from "../execution-placement.js";
+import { IDENTITY_COLUMN_NAME, SCENARIO_PREFIX_LIKE, SCENARIO_PREFIX_MARKER_ID, ScenarioPrefixSwitchRefusedError } from "./scenario-prefix-switch-m42.js";
+import { MIGRATION_MARKER_TABLE, migrationMarkerDdl } from "./one-time-migration-marker.js";
+import { expectedTableShapes } from "./schema-consistency.js";
 const RETIRED_SESSION_RULE_BUCKETS = ["commandAllow", "commandDeny"];
 export function buildMigrationReceipts() {
     return {
-        workflowParkIndexRowsCarried: 0,
-        undurableScopeRuleRows: [],
-        undurableScopeRuleBucketsDeferred: 0,
-        undurableScopeRuleBucketsUnreadable: [],
         sessionRuleRowsWithRetiredBuckets: [],
         sessionRuleRowsWithOldGrammarEntries: [],
         sessionRuleRowsWithUnreadableDeny: [],
@@ -52,33 +57,42 @@ export function buildMigrationReceipts() {
         deviceBindingTablesDropped: 0,
         executionPlacementsBackfilled: 0,
         askExecutionLanesBackfilled: 0,
+        executionLaneWordsRenamed: 0,
+        sessionExtRowsMoved: 0,
+        sessionMetaColumnsDropped: 0,
+        scenarioPrefixSourcesScanned: 0,
+        withdrawMarkWritten: 0,
+        sessionDeletingSwitchMarked: 0,
+        runErrorCodeColumnRewritten: 0,
+        runObjectivePreviewRewritten: 0,
+        shellSentinelOwnersCleared: 0,
+        checkpointHostSessionsBackfilled: 0,
+        legacySkillExemptionsDropped: 0,
         executionPlacementSessionsUnreadable: [],
         localArchiveRowFactsBackfilled: 0,
         localArchivesAnonymized: 0,
         localArchivesKeptStamped: [],
         localArchivesUnreadable: [],
         localArchiveSnapshotsRecovered: 0,
+        localArchiveTokensAdopted: 0,
+        localArchiveTokensMinted: 0,
         askCauseColumnsChanged: 0,
         askParkTriggersMoved: 0,
         askJournalRecordsUpgraded: 0,
         importedLayerRootAllowsRetired: [],
         importedLayerRootBucketsSkipped: [],
+        importedLayerRootBucketsUnnamed: 0,
     };
 }
 function completedReport(r) {
-    const { workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn } = r;
-    if (workflowParkIndexKey === undefined || sessionRuleColumn === undefined || workflowJournalScopeColumn === undefined) {
-        throw new Error(`one-time migrations finished without settling a shape reading (M9 ${String(workflowParkIndexKey)} / M17 ${String(sessionRuleColumn)} / M24 ${String(workflowJournalScopeColumn)}) — a step did not record it`);
+    const { sessionRuleColumn, workflowJournalScopeColumn } = r;
+    if (sessionRuleColumn === undefined || workflowJournalScopeColumn === undefined) {
+        throw new Error(`one-time migrations finished without settling a shape reading (M17 ${String(sessionRuleColumn)} / M24 ${String(workflowJournalScopeColumn)}) — a step did not record it`);
     }
-    return { ...r, workflowParkIndexKey, sessionRuleColumn, workflowJournalScopeColumn };
+    return { ...r, sessionRuleColumn, workflowJournalScopeColumn };
 }
 function changedAnything(r) {
-    return (r.workflowParkIndexKey === "reshaped" ||
-        r.workflowParkIndexRowsCarried > 0 ||
-        r.undurableScopeRuleRows.length > 0 ||
-        r.undurableScopeRuleBucketsDeferred > 0 ||
-        r.undurableScopeRuleBucketsUnreadable.length > 0 ||
-        r.sessionRuleColumn === "renamed" ||
+    return (r.sessionRuleColumn === "renamed" ||
         r.sessionRuleRowsWithRetiredBuckets.length > 0 ||
         r.sessionRuleRowsWithOldGrammarEntries.length > 0 ||
         r.sessionRuleRowsWithUnreadableDeny.length > 0 ||
@@ -105,23 +119,34 @@ function changedAnything(r) {
         r.deviceBindingTablesDropped > 0 ||
         r.executionPlacementsBackfilled > 0 ||
         r.askExecutionLanesBackfilled > 0 ||
+        r.executionLaneWordsRenamed > 0 ||
+        r.sessionExtRowsMoved > 0 ||
+        r.sessionMetaColumnsDropped > 0 ||
+        r.withdrawMarkWritten > 0 ||
+        r.sessionDeletingSwitchMarked > 0 ||
+        r.runErrorCodeColumnRewritten > 0 ||
+        r.runObjectivePreviewRewritten > 0 ||
+        r.shellSentinelOwnersCleared > 0 ||
+        r.checkpointHostSessionsBackfilled > 0 ||
+        r.legacySkillExemptionsDropped > 0 ||
         r.executionPlacementSessionsUnreadable.length > 0 ||
         r.localArchiveRowFactsBackfilled > 0 ||
         r.localArchivesAnonymized > 0 ||
         r.localArchivesKeptStamped.length > 0 ||
         r.localArchivesUnreadable.length > 0 ||
         r.localArchiveSnapshotsRecovered > 0 ||
+        r.localArchiveTokensAdopted > 0 ||
+        r.localArchiveTokensMinted > 0 ||
         r.askCauseColumnsChanged > 0 ||
         r.askParkTriggersMoved > 0 ||
         r.askJournalRecordsUpgraded > 0 ||
         r.importedLayerRootAllowsRetired.length > 0 ||
-        r.importedLayerRootBucketsSkipped.length > 0);
+        r.importedLayerRootBucketsSkipped.length > 0 ||
+        r.importedLayerRootBucketsUnnamed > 0);
 }
 function readingsSnapshot(r) {
     return {
         ...r,
-        undurableScopeRuleRows: [...r.undurableScopeRuleRows],
-        undurableScopeRuleBucketsUnreadable: [...r.undurableScopeRuleBucketsUnreadable],
         sessionRuleRowsWithRetiredBuckets: [...r.sessionRuleRowsWithRetiredBuckets],
         sessionRuleRowsWithOldGrammarEntries: [...r.sessionRuleRowsWithOldGrammarEntries],
         sessionRuleRowsWithUnreadableDeny: [...r.sessionRuleRowsWithUnreadableDeny],
@@ -139,7 +164,6 @@ function receiptSentence(r) {
         .filter(([, v]) => (typeof v === "number" ? v > 0 : v !== undefined))
         .map(([k, v]) => `${k}=${String(v)}`);
     const rows = [
-        ...r.undurableScopeRuleRows.map((x) => `removed ${x.kind} in permission-rule bucket ${x.ownerKey} (${x.behavior} ${x.tool}, scope root ${JSON.stringify(x.scopeRoot)})`),
         ...r.sessionRuleRowsWithOldGrammarEntries.map((x) => `${x.policyKey} (session ${x.sessionId}): toolAllowDropped=${JSON.stringify(x.toolAllowDropped)}`),
         ...r.sessionRuleRowsWithUnreadableDeny.map((x) => `${x.policyKey} (session ${x.sessionId}): left as stored, toolDenyUnreadable=${JSON.stringify(x.toolDenyUnreadable)}${x.retiredBuckets !== undefined ? `, retiredBuckets=${JSON.stringify(x.retiredBuckets)}` : ""}`),
         ...r.importedLayerRootAllowsRetired.map((x) => `retired ${x.addsRetired} imported add(s) of an allow ${x.tool} rule in permission-rule bucket ${x.ownerKey} (${x.stillLive ? "the rule stays in effect through another approval" : "the rule no longer takes effect"})`),
@@ -157,53 +181,6 @@ export class OneTimeMigrationInterruptedError extends Error {
     }
 }
 export const ONE_TIME_MIGRATIONS = [
-    {
-        id: "M9",
-        introducedIn: "7.118.0",
-        releasedOn: "2026-10-07",
-        removableAfter: "2026-11-06",
-        removal: "删 migrateOn 的 M9 步(`reshapeWorkflowParkIndex` / `execAtomically` / `finishParkIndexShape`:收尾段、主键宽度探针、暂存表复制、换名、删旧表、索引补建、主键约束名)与 " +
-            "`primaryKeyWidth` / `WORKFLOW_PARK_INDEX_TABLE` / `WORKFLOW_PARK_INDEX_STAGING` / `WORKFLOW_PARK_INDEX_RETIRED`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 " +
-            "`workflowParkIndexKey` / `workflowParkIndexRowsCarried`;**连同读侧半场一起删**(都是「引擎 7.43 及以前写下的 workflow 子代停驻记录」这同一件事,同窗同删,不另起登记行):" +
-            "`orchestration/workflow-agent-session-index.ts` 的 `older_engine` 读臂(`routeWorkflowPark` 规则 ③、`WorkflowParkRoute` 与 `parked-decide.ts` `ParkOrigin` 上 `cause` 里的这一词," +
-            "`denyWorkflowParksUnreadable` 的对应分支;`unreadable` 成为唯一成因)与随包排空判据 `workflow-park-holder`(`scripts/drain-check.mysql.sql` / `scripts/drain-check.pg.sql` 的那一段" +
-            "与文件头判据清单里的那一行、`scripts/drain-check-local.mjs` 的 `DRAIN_CRITERIA` 那一条与 `readParkIndex`,以及 `MIGRATION.md` / `docs/DEPLOY-PREREQS.md` 里点名它的说明)",
-        afterRemoval: "没有响亮臂:删码之后仍是旧主键(只有 `session_id`)的库(跳过了带本条的版本直接升)上,同一个子会话只能有一枚指针 —— 续跑链 / 分叉里" +
-            "后写的那条记录覆盖先写的,判决只看得到一条记录:分叉判不出、链尾可能被更早的记录盖掉(决定投给那一条)。运维手工照中央 DDL 重建这张表即可" +
-            "(它是派生投影,丢了只丢升级那一刻还停驻着的旧卡的指针 —— 那些卡改答诚实 miss)。读侧半场删后:升级那一刻还停驻着、点名它的条目没有持有者位的存量卡" +
-            "(跳过了带本条的版本直接升的库)路由判 `none` ⇒ 落 legacy 腿,答 `409 conflict.resume_context_unavailable`(响亮,但成因是子会话没有续跑上下文,不再是 " +
-            "`decide.workflow_parks_unreadable`);出路不变(续跑发起它的那条 workflow run);随包排空判据没了,换钉前没有机器读数可数这些卡",
-        reportKeys: ["workflowParkIndexKey", "workflowParkIndexRowsCarried"],
-    },
-    {
-        id: "M10",
-        introducedIn: "7.119.0",
-        releasedOn: "2026-10-08",
-        removableAfter: "2026-11-07",
-        removal: "删 local 车道的认领臂:`LocalSessionStore.register` 里「属主从没被记下的存量会话 ⇒ 带 principal 的登记认领它」那一支、认领日志行 `session_owner_claimed`" +
-            "(连同店构造参数里只为它存在的 `log` 位)与读本表 M10 行的 `ownerClaimWindowOpen`;`security.ts` `createAuthorizer` 里对无主会话的那次认领 `register` 调用;" +
-            "`http/routes/sessions.ts` 409 `conflict.session_ownerless` 句里「Ways out: on the local backend, during the upgrade window …」那半句(连同冻结表 " +
-            "`test/api-error-text-freeze.test.ts` 那一行、契约码目录 `docs/ASSISTANT-WIRE-CONTRACT.md` 那一行);本文件的 `migrationWindowOpen`(若再无别的读者)",
-        afterRemoval: "没有响亮臂(删码本身零行为变化:窗关那一刻起认领臂已经不生效):属主从没被记下的存量会话(边档那一格只有化身 —— 跳过了带本条的版本直接升," +
-            "或窗内从没被带 principal 提交过)照旧答无主(`headOf(id)?.owner` = null):它的会话规则这条路由读不了也改不了(409 `conflict.session_ownerless`)," +
-            "已存的规则对写下它们的 principal 的 run 照旧生效;出路 = 删会话(`DELETE /v1/sessions/:id`,规则随之删)",
-        reportKeys: [],
-    },
-    {
-        id: "M11",
-        introducedIn: "7.120.0",
-        releasedOn: "2026-10-08",
-        removableAfter: "2026-11-07",
-        removal: "删 migrateOn 的 M11 步(`permission_rule` 在场探针 + `purgeUndurableScopeRows` 调用)与 `permission-rule-store-sql.ts` 的 `purgeUndurableScopeRows` / " +
-            "`purgeOneBucket` / `contentFreeRefusal` / `UndurableScopeRuleRow` / `UnreadableRuleBucket` / `UndurableScopePurgeReadings` / " +
-            "`UndurableScopePurgeDb` / `UNDURABLE_PURGE_PAGE` / `UNDURABLE_PURGE_OCC_ATTEMPTS`、本文件的 `removedRuleRowNote`,以及 `BucketRefusedError` 的 `verdict` 位(若届时再无别的读者;" +
-            "判官 `decodeBucketRow` 与写法 `writeBucket` 是读腿 / 写臂本身,留);报告、日志行(含逐行的 `permission_rule_row_removed` 与逐桶的 " +
-            "`permission_rule_bucket_unreadable`)与 `NO_SQL_MIGRATIONS` 的 `undurableScopeRuleRows` / `undurableScopeRuleBucketsDeferred` / `undurableScopeRuleBucketsUnreadable`",
-        afterRemoval: "引擎读侧的既有响亮臂:scope root 不是完整绝对路径的存量行(跳过了带本条的版本直接升的库,或窗关之后别的写者写进来的)在有效视图里被丢、" +
-            "每次 run 一条 `permission.rule_row_dropped`(点名规则与 root)—— 那一行不参与任何检查,但撤销口删不动它(引擎的写臂对这种 scope 同样拒);" +
-            "出路 = 运维在库里把那只桶的那一行删掉(整桶 OCC 回写,指纹按 `buildRuleBucketChecksum` 重算)",
-        reportKeys: ["undurableScopeRuleRows", "undurableScopeRuleBucketsDeferred", "undurableScopeRuleBucketsUnreadable"],
-    },
     {
         id: "M12",
         introducedIn: "7.122.0",
@@ -307,6 +284,9 @@ export const ONE_TIME_MIGRATIONS = [
             "`test/task-a2a.test.ts` 里的克隆钉(标题去掉开头的 `🔴 ` 后以 `克隆钉:` 开头的各格,整格删;按这个精确前缀删,不按标题里的「M19 重读」之类泛词删 —— 那会误删同文件里的通用不变式钉),以及三格不带前缀、删码后要改写的钉:`需要「读」的两个键…` 那格的 `readRequestToolAxes` 调用方名单(`normalizeA2aPeer` 只在 M19 重读臂里调它,删后名单只剩 `mintPeerSnapshot`,标题里「与读器里 M19 重读产物的那一次」半句同删)、`读器与门的差别只有三格…` 改成两格(删 ③ 的注释行与标题里的 ③)、`请求入口快照的形…` 里 `snapshotRequestA2a(…, { reread: false })` 的第二实参(删 `reread` 形参后改成单参);" +
             "`test/one-time-migration-window-gate.test.ts` 里 M19 一节中与克隆有关的三格(声明抽取器正负控 · 删法条与克隆名字两向对账 · 克隆钉标题前缀对账)与它们共用的帮手 `declaredNames`;" +
             "`test/mcp-tool-axes-m19.test.ts`(窗关那一格 —— 存量坏形整条不进、warn 与通告点名 `field: toolAxes` —— 改钉到 `test/task-mcp.test.ts`);" +
+            "「请求成员读不出」一问上的重读座走线:`http/stored-body-replay.ts` 里递给 `unreadRequestMembers` 的 `storedToolAxes: storedToolAxesRereadM19(today)` 与它的 import," +
+            "`unread-request-members.ts` 的 `StoredToolAxesRereadM19` 型 import、`UnreadMembersLeg` 续跑臂的 `storedToolAxes` 字段与 `unreadRequestMembers` 里取它、递给两只谓词的那几处," +
+            "`task-mcp.ts` 的 `requestMcpTransportUnread` 与 `task-a2a.ts` 的 `requestA2aHeadersUnread` 的 `storedToolAxes` 形参(连同它们递给 `normalizeServer` / `normalizeA2aPeer` 的那一实参);" +
             "本文件的 `migrationWindowOpen`(若再无别的读者)",
         afterRemoval: "没有新的臂,接住它的是今天的读法(删码零行为变化:窗关那一刻起重读臂已经不生效):升级前存下的请求体里引擎判官判不过的 `toolAxes`,续跑重放时这一条 server 整条不进," +
             "运维 warn `mcp_injection_dropped`(`reason: malformed_entry`、`field: toolAxes`)+ 用户面通告 `mcp.injection_dropped`,兄弟照挂;停驻在这台 server 工具审批上的任务" +
@@ -320,14 +300,16 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.131.0",
         releasedOn: "2026-10-16",
         removableAfter: "2026-11-15",
-        removal: "删 `src/stored-request-hooks-m20.ts` 整只文件(`storedHooksRereadM20` / `rereadStoredHooksM20` / `StoredHooksRereadM20` / `ENTRY_FIELD_NAMES` / `MATCHER_FIELD_NAMES` / `nodeAt` / `cloneDoc` / `removeKeyAt`);" +
+        removal: "删 `src/stored-request-hooks-m20.ts` 整只文件(`storedHooksRereadM20` / `rereadStoredHooksM20` / `StoredHooksRereadM20` / `MATCHER_FIELD_NAMES` / `nodeAt` / `cloneDoc` / `removeKeyAt`);" +
             "`boot/resolve-spec.ts` 里递给 `parseTaskSettings` 的重读座实参(`opts?.leg === \"fresh\" || !taskHooksHonored(config) ? {} : { storedHooksReread: storedHooksRereadM20(…) }`)与它的 import、" +
             "`hooks_read_as_before_upgrade` 那一段 warn;`task-settings.ts` 的 `ParseTaskSettingsSeats` / `ParseTaskSettingsResult.hooksReread` / `parseTaskSettings` 第二形参与 hooks 臂里的重读那一支;" +
-            "`hooks/hook-runner.ts` 的 `ParseHooksConfigResult.pieces` / `HooksRefusalPiece`(若再无别的读者)与 `hooksCoordinate` 的 export;" +
-            "`test/hooks-stored-reread-m20.test.ts`(窗关那一格 —— 整份不采纳 + `server.hooks.resume-reader-refused` 计一笔 —— 改钉到 `test/hooks-entry-admission.test.ts` 的续跑腿组)",
-        afterRemoval: "没有新的臂,接住它的是今天的读法(删码零行为变化:窗关那一刻起重读臂已经不生效):升级前存下的请求体里带这两形的 `settings.hooks`,续跑重放时整份不采纳(其中真在拦的 `PreToolUse` 钩子也不再拦)," +
-            "运维 warn `task_settings_deferred`(字段 `hooks`)+ fail-open 登记 `server.hooks.resume-reader-refused`(计数 + 探针 + 一次性 warn,census 第 140 行),任务照常续跑 —— " +
-            "出路是把这类停驻任务决掉、删掉那个未知字段 / `__proto__` 键后重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行(头注 M20 段)",
+            "`hooks/hook-runner.ts` 的 `ParseHooksConfigResult.pieces` / `HooksRefusalPiece`(若再无别的读者);" +
+            "「请求成员读不出」一问上的重读座走线:`unread-request-members.ts` 的 `storedHooksRereadM20` import 与 `unreadRequestMembers` 里 `hooksReread` 那一行(递给 `parseTaskSettings` 的 `storedHooksReread` 座)、" +
+            "`UnreadMembersLeg` 续跑臂的 `today` 字段(只为 M20 的窗问它)与 `http/stored-body-replay.ts`、`boot/resolve-spec.ts` 递 `today` 的那两处(`stored-body-replay.ts` 的 `today` 局部若 M19 已删再无读者一并删);" +
+            "`test/hooks-stored-reread-m20.test.ts`(窗关那一格 —— 续跑拒 409 `resume_blocked_by_policy` —— 改钉到 `test/hooks-entry-admission.test.ts` 的续跑腿组)",
+        afterRemoval: "没有新的臂,接住它的是今天的读法(删码零行为变化:窗关那一刻起重读臂已经不生效):升级前存下的请求体里带这两形的 `settings.hooks`,在会采纳 hooks 的车道上续跑被拒 —— " +
+            "「请求成员读不出」判据(`src/unread-request-members.ts`)答 409 `resume_blocked_by_policy`(`blockedBy: request.field_invalid`,`field: settings.hooks`),卡仍待决、行不动(7.147.0 起;此前是整份不采纳照跑)—— " +
+            "出路是取消这类停驻任务、删掉那个未知字段 / `__proto__` 键后重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行(头注 M20 段)",
         reportKeys: [],
     },
     {
@@ -505,10 +487,11 @@ export const ONE_TIME_MIGRATIONS = [
             "`RETIRED_DEVICE_BINDING_TABLE` / `PARKED_DEVICE_BINDING_TABLE` / `FENCE_ROOTS_SHOWN`、`ExecutionPlacementSwitchRefusedError` / `EXECUTION_PLACEMENT_SWITCH_REFUSED_CODE` / `ExecutionPlacementSwitchRefusalReason`)" +
             "与 DDL 前探针(`assertExecutionPlacementSwitchAdmissible` / `assertExecutionPlacementSwitchAdmissibleOnPool`,`store-backend.ts` 的 `withRetiredSchemaProbe` 里调它的那一行);" +
             "`runSqlOneTimeMigrations` 的第三参 `ExecutionPlacementSwitchInput`(若再无别的条目用它)与它在两只 SQL 后端 / 测试夹具上的实参;local 腿(`LocalBackend.runOneTimeMigrations` 里的 `backfillLocalExecutionPlacements` 与 `FileRunStore.sessionIdsWithRuns`);" +
-            "`execution-placement-sql.ts` 的 `backfillWriterStatement` / `migrateDeviceBindingsStatement` / `countOrphanBindingsStatement`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 `executionPlacementColumnsAdded` / `deviceBindingsMoved` / " +
+            "`execution-placement-sql.ts` 的 `backfillWriterStatement` / `migrateDeviceBindingsStatement` / `migrateDeviceBindingsOntoSideTableStatements` / `countOrphanBindingsStatement`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 `executionPlacementColumnsAdded` / `deviceBindingsMoved` / " +
             "`deviceBindingsOrphaned` / `deviceBindingTablesDropped` / `executionPlacementsBackfilled` / `executionPlacementSessionsUnreadable` 与 `device_bindings_orphaned` / `execution_placement_session_unreadable` 两行 warn;`test/execution-placement-switch-db-integration.test.ts` 整份与 `test/one-time-migrations.test.ts` 的 M32 组。" +
-            "**local 腿的回填席与它的点名词一并删**:`LocalSessionStore` 的 `executionPlacementBackfill`(属性与构造里的那一臂)、`execution-placement.ts` 的 `LocalPlacementBackfillSeat` / `UnusableArchive` / `UnusableArchiveWord`(含它的 `storage` 词 —— 读存档文件时抛了别的故障、`errno` 随带,该词只有回填点名用)/ `isUnusableArchive`、" +
-            "`ExecutionPlacementSessionUnreadable`;`local-session-store.ts` 里 `placementRead` 并回 `readExecutionPlacement`、`metaRead` 的 unusable 臂与 `forkingOf` 的 `storage` 臂改成就地上抛 `probe.fault`(`archiveFaultWord` / `unusableArchiveOf` 随词删,探针只留「不在」与已知在而用不了的读法);" +
+            "**local 腿的回填席与它的点名词一并删**:`LocalSessionStore` 的 `executionPlacementBackfill`(属性与构造里的那一臂)与它唯一的成员 `backfillPlacement`、`unusableArchiveOfFault`、" +
+            "`execution-placement.ts` 的 `LocalPlacementBackfillSeat` / `LocalPlacementBackfillOutcome` / `UnusableArchive` / `UnusableArchiveWord`(含它的 `storage` 词 —— 读存档文件时抛了别的故障、`errno` 随带,该词只有回填点名用)/ `isUnusableArchive`、" +
+            "`ExecutionPlacementSessionUnreadable`(会话店的观察与存档探针不随删:它们不带这几只型,说不出在不在就原样抛);" +
             "`test/execution-placement-switch-local.test.ts` 与 `test/execution-placement-local-boot-unreadable-e2e.test.ts` 整份。" +
             "**不随本条删**:执行放置八列、会话店的执行席、设备店的首绑 / 换绑两只写(常设的数据形)",
         afterRemoval: "起服对账一族的跳版库拒启臂接住:删码同版把 `device_session` / `device_session_retired` 两张表加进退役 schema 判据(`schema-consistency.ts` 的跳版库探针,先于建表)⇒ " +
@@ -521,13 +504,14 @@ export const ONE_TIME_MIGRATIONS = [
         releasedOn: "2026-10-30",
         removableAfter: "2026-11-29",
         removal: "删 `LocalSessionStore.migrateLocalArchives` 与它的私有助手 `anonymizeArchiveHeld` / `fillRowFacts`、`settleArchiveSnapshots` 里除最后一句常设臂 `assertNoArchiveSnapshots(dir)` 以外的一切(逐份消化的循环与 `settleArchiveSnapshot`)、" +
-            "`archiveSnapshotsSettled` 字段、`syncArchiveDirectory`、`rowFactsFilled` / `ArchivedRowFacts` / `archivedRowFactsOf` / `ARCHIVE_SNAPSHOT_RECORD` / `ArchiveSnapshotRecord` / `readArchiveSnapshotRecord` / `sameLog` / " +
+            "`archiveSnapshotsSettled` 字段、`rowFactsFilled` / `ARCHIVE_SNAPSHOT_RECORD` / `ArchiveSnapshotRecord` / `readArchiveSnapshotRecord` / `sameLog` / " +
+            "`ArchivedRowFacts` / `archivedRowFactsOf`(M47 仍在树时留着,随 M47 删)/ " +
             "`ArchiveRewriteStep` / `LocalArchiveMigrationReading` / `errnoOf`、" +
-            "`archiveRewriteReadScope` / `noteReplayInArchiveRewriteRead` 与 `createLocalSessionRepo` 座里调它的那一腿、`SidecarMap.syncToDisk`(若再无别的调用方)与 `fsyncPaths`(同);" +
+            "`archiveRewriteReadScope` / `noteReplayInArchiveRewriteRead` 与 `createLocalSessionRepo` 座里调它的那一腿、`SidecarMap.syncToDisk`(若再无别的调用方);" +
             "`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里对 `migrateLocalArchives` 的调用与报告五键的那五行;本文件的 `LocalArchiveKeptReason` / `LocalArchiveKeptStamped` / `LocalArchiveUnreadable`、" +
             "报告 / 收据 / `changedAnything` / `readingsSnapshot` / `readingFields` 里的 `localArchiveRowFactsBackfilled` / `localArchivesAnonymized` / `localArchivesKeptStamped` / `localArchivesUnreadable` / `localArchiveSnapshotsRecovered`、" +
             "`local_archive_kept_stamped` / `local_archive_unreadable` 两行 warn、读数行 note 里的 M33 句与头注 M33 段;`test/local-archive-owner.test.ts` 里标题含 `P3` / `P4` / `P5` / `P6` / `F1` / `F2` / `F3` 的格与 `legacyRoot` / `writeArchive` / `boot` / `M33_ZERO` / `m33Of` 助手。" +
-            "**不随本条删**:行格的 `createdAt` / `forkedFrom` 两键(常设的数据形)、`LocalArchiveSnapshotsPresentError` / `assertNoArchiveSnapshots` / `LOCAL_ARCHIVE_SNAPSHOT_DIR` 与 `LocalBackend.ensureSchema` 里调它的那一句、" +
+            "**不随本条删**:行格的 `createdAt` / `forkedFrom` 两键(常设的数据形)、存档目录屏障 `syncArchiveDirectory` 与 `fsyncPaths`(会话删序的常设一步)、`LocalArchiveSnapshotsPresentError` / `assertNoArchiveSnapshots` / `LOCAL_ARCHIVE_SNAPSHOT_DIR` 与 `LocalBackend.ensureSchema` 里调它的那一句、" +
             "`session-error-wire.ts` 的 `StampedSessionArchiveError` / `STAMPED_SESSION_ARCHIVE_SENTENCE` / `sessionErrorWireOf` 与本店带戳判的唯一读口 `assertArchiveAnonymous`(fork 的源、改日志推送的落点、会话同步导入第一阶段的早拒三处问它)、行上缺建档时刻的 F 类读法(`server.local-session-row.created-at-absent`)",
         afterRemoval: "三只常设臂接住:① 数据根下的快照目录非空 ⇒ 拒启(`config.local_archive_snapshot_present`,点名文件与两条出路);② 跳过了带本条的版本直接升的数据根(或本条留着的存档),带属主戳的存档被 fork、改日志的推送与会话同步导入第一阶段对 fork / stale 的早拒同一只具名拒(409 `conflict.session_archive_stamped` + 固定句,零写 / 行格净零写)," +
             "读 / 续跑 / 拉取照常 —— 出路 = 删掉会话后重推,或升级时先过一次带本条的版本并在窗内起服;③ 行上没有建档时刻的格(同一类数据根)⇒ 列表 / 会话视图 / 交出的元数据读纪元(F 类 tag 计数)",
@@ -570,13 +554,13 @@ export const ONE_TIME_MIGRATIONS = [
             "删什么:`src/plugins/imported-layer-root-retirement.ts` 整个文件;migrateStepsOn 的 M36 步(规则表与 `grammar` 列的在场探针 + 对 `retireImportedLayerRootAllows` 的调用)与握锁连接上的 `query` 口" +
             "(`LockedMigrationDb` 与 `mysqlDb` / `pgDb` 里的那一员,若届时再无别的步骤用它);`permission-rule-store-sql.ts` 的 `listRuleBucketOwners` / `isSqlBucketRefusal` / `isSqlBucketVanished` / `RuleBucketVanishedError`(取点那一句的具名类,届时若再无别的读者按类判它,收回成裸错)/ `IMPORT_RECORD_KIND`;" +
             "`permission-rule-store-file.ts` 的 `FileRuleApprovalRecordStore.importRecordOwners` / `fileRuleBucketOwners` / `isFileBucketDamaged`;`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里 M36 那一腿(规则目录在场判与那一处调用)与报告两键的那两行;" +
-            "本文件的 `createSqlImportedLayerRootSource` 与 `importedLayerRootAllowsRetired` / `importedLayerRootBucketsSkipped`(报告 / 收据 / `changedAnything` / `readingsSnapshot` / `readingFields` / `receiptSentence` / `NO_SQL_MIGRATIONS` 的排除表)、" +
-            "`imported_layer_root_allow_retired` / `imported_layer_root_bucket_skipped` 两行 warn 与 `importedLayerRootSkipNote`、读数行 note 里的 M36 句与头注 M36 段;" +
+            "本文件的 `createSqlImportedLayerRootSource` 与 `importedLayerRootAllowsRetired` / `importedLayerRootBucketsSkipped` / `importedLayerRootBucketsUnnamed`(报告 / 收据 / `changedAnything` / `readingsSnapshot` / `readingFields` / `receiptSentence` / `NO_SQL_MIGRATIONS` 的排除表)、" +
+            "`imported_layer_root_allow_retired` / `imported_layer_root_bucket_skipped` / `imported_layer_root_buckets_unnamed` 三行 warn 与 `importedLayerRootSkipNote`、读数行 note 里的 M36 句与头注 M36 段;" +
             "`test/imported-layer-root-retirement.test.ts`、`test/imported-layer-root-retirement-db-integration.test.ts`(连同 `scripts/db-integration-files.json` 里它那一行)与 `test/helpers/imported-layer-root-fixture.ts` 整文件。" +
             "**不随本条删**:`SqlDurableRulePartitionProvider` 收「方言 + 执行口」的那一形(`BucketSql`;常设,池照旧满足它)",
         afterRemoval: "没有响亮臂(如实):删码之后,跳过了带本条的版本直接升的库(或回滚到引擎 7.61.0 之前、在其上又导入过的库),存量的这种全局 `/x` allow 照旧在每个项目根放行,本服务不再点名 —— " +
             "出路 = 升级时先过一次带本条的版本并起服;或运维列出桶里出处为导入(`adds[].origin` = `imported-cc`)、scope 为全局、从 `/` 写起的 allow(`GET /v1/rules`)并撤掉(`DELETE /v1/rules`,撤的是这条规则的全部批准)",
-        reportKeys: ["importedLayerRootAllowsRetired", "importedLayerRootBucketsSkipped"],
+        reportKeys: ["importedLayerRootAllowsRetired", "importedLayerRootBucketsSkipped", "importedLayerRootBucketsUnnamed"],
     },
     {
         id: "M37",
@@ -604,6 +588,174 @@ export const ONE_TIME_MIGRATIONS = [
             "出路是取消那条 run,把凭据挪进引擎进程环境后重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行、窗内续跑过又停驻到窗外的任务(头注 M38 段)",
         reportKeys: [],
     },
+    {
+        id: "M39",
+        introducedIn: "7.147.0",
+        releasedOn: "2026-11-07",
+        removableAfter: "2026-12-07",
+        removal: "删 `src/plugins/local-data-dir-modes-m39.ts` 整只文件;`store-backend.ts` 里 `LocalBackend.runOneTimeMigrations` 开头调它的那一段(两只日志座的接线)、`dataDirLayout` 字段与它的赋值、顶部的 import(含 `memoryEngineRootFor`),以及 `runOneTimeMigrations` 与 `discloseWarn` 注释里点名 M39 的那两句;" +
+            "各店为名册导出的目录路径函数(`fileRunStoreDirsFor` / `localCheckpointStoreDirsFor` / `attachmentStoreDirFor` / `scratchpadRootFor` / `memorySyncCursorDirFor`)只剩本店自己读的去掉 `export` 与注释里的 M39 一句(`pluginCacheRootFor` 组合根仍读,留);" +
+            "`test/data-dir-modes-upgrade-m39.test.ts` 整只文件;`test/data-dir-law-census.test.ts` 例外名册里 `plugins/local-data-dir-modes-m39.ts` 那一行、模式值例外名册里它那一行、「M39 名册零字面路径」一格与「字面量 = ensureDir 铸出的模式」一格里的迁移半场;本文件头注 M39 段;重生成 `docs/core-consumption/READ-TABLE.json`(迁移读 core 的 `physicalPathOf` 那一行随之去掉)。" +
+            "**不随本条删**:数据根建目录只经 `ensureDir` 这条律本身(常设)、`plugins/owner-only-file-mode.ts`(本服务文件的 `0600` 唯一值与原子写的两个出口:异步出口常设,同步出口按它自己的退役条件 —— core 的原子写改成独占新建 tmp —— 走,不随本条)及它们的钉 —— `test/data-dir-law-census.test.ts`(`src/**` 零裸 mkdir、零手写 0o700、文件模式只认一个名字、tmp 只在一只写口里铸)与 `test/data-dir-modes.test.ts`(每只 local 店首建目录 0700、旧 tmp 不被复用)",
+        afterRemoval: "没有响亮臂(如实,也无需):删码之后,跳过了带本条的版本直接升的数据根,升级前铸成的 0755 目录原样留着(新建的目录一律 0700,不受影响;里面的文件多半仍是 0600),本服务不再点名 —— " +
+            "出路 = 运维一次 `chmod 700` 数据根下 `runs`(及其子目录)· `space-commits` · `checkpoint-ctx` · `.tmp` · `attachments` · `scratchpad`(及其子目录)· `plugin-cache`(及其子目录)· `<记忆引擎根>/sync-cursors`,或升级时先过一次带本条的版本并起服",
+        reportKeys: [],
+    },
+    {
+        id: "M40",
+        introducedIn: "7.147.0",
+        releasedOn: "2026-11-07",
+        removableAfter: "2026-12-07",
+        removal: "删 `src/plugins/execution-lane-rename-m40.ts` 整只文件;本文件的 M40 步(`renameRetiredExecutionLaneWordsM40` / `refuseWhileRunsHeartbeat`〔它读的 `readLiveRunHeartbeat` / `LiveRunHeartbeat` 由 M41 / M42 共读,两条也已删码时随之删〕/ `ExecutionLaneRenameRefusedError` / " +
+            "`EXECUTION_LANE_RENAME_REFUSED_CODE` / `ExecutionLaneRenameInput`,`migrateStepsOn` 第一步那一行与 `SqlOneTimeMigrationInput` 里的那一半)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `executionLaneWordsRenamed`、头注 M40 段;" +
+            "`store-backend.ts` 的 `LocalBackend.ensureSchema` 第一步与 `executionLaneWordsRenamed` 字段、两只 SQL 后端递 `liveRunWindowMs` 的那一半;" +
+            "`LocalSessionStore.renameRetiredExecutionLaneWordM40`、`FileApprovalAskStore.renameRetiredExecutionLaneWordM40` 与内核的 `renameExecutionLaneWord`;" +
+            "`approval-ask-store-sql.ts` / `execution-placement-sql.ts` 拒句里的 `retiredExecutionLaneHintM40(…)` 补句;`test/execution-lane-rename-m40.test.ts` 整只文件与 `test/execution-placement-switch-db-integration.test.ts` 的 M40 组",
+        afterRemoval: "既有读口的拒臂接住(响亮,不再改名):仍带旧词的行 —— 跳过了带本条的版本直接升的库、窗关之后还在写的更早版本副本 —— SQL 问行读口拒、会话执行格读口拒(`ExecutionPlacementRowError`)," +
+            "local 会话元数据边档整只严格拒启(`config.schema_mismatch`),local 问账日志由 M32 回填的词表外拒臂拒启(M32 删码之后:那只问行原样装回)。出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["executionLaneWordsRenamed"],
+    },
+    {
+        id: "M41",
+        introducedIn: "7.147.0",
+        releasedOn: "2026-11-07",
+        removableAfter: "2026-12-07",
+        removal: "删本文件的 M41 步(`moveSessionCellsToSideTable` / `refuseSessionExtMoveWhileRunsHeartbeat` / `deploymentColumnsOnMeta` / `SessionExtMoveRefusedError` / `SESSION_EXT_MOVE_REFUSED_CODE` / " +
+            "`SessionExtMoveRefusalReason` / `sameCell` / `SESSION_EXT_MOVE_PAGE`,`migrateStepsOn` 里那两行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `sessionExtRowsMoved` / `sessionMetaColumnsDropped`、头注 M41 段;" +
+            "M32 读形里的 `cellsOnSideTable` 判(它读本条的 `deploymentColumnsOnMeta`):M32 还在时改成恒旁表形 —— 删 M32 写 `session_meta` 八列的那些臂(② ④ ④b ⑥ 与 ③ 的 `migrateDeviceBindingsStatement` 臂)," +
+            "留 ③ 的旁表臂(`migrateDeviceBindingsOntoSideTableStatements`:围栏拒句的「采旧」在任何库上仍要能落到执行格);M32 先于本条删码时这些随 M32 一并删;`readLiveRunHeartbeat` 在 M40 与 M42 也已删码时随之删;`test/session-ext-move-db-integration.test.ts` 整只文件",
+        afterRemoval: "跳过了带本条的版本直接升上来的库:`session_meta` 上仍带部署格列 ⇒ 起服列册对账拒启(`config.schema_mismatch`,那几列是本树之外的多余列,拒句不给 ALTER —— 出路是带本条的版本);" +
+            "部署格从旁表读,旧列上的值不被任何读者读。出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["sessionExtRowsMoved", "sessionMetaColumnsDropped"],
+        dropsColumns: { session_meta: SESSION_EXT_MOVED_COLUMNS.map((c) => c.name) },
+    },
+    {
+        id: "M42",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `src/plugins/scenario-prefix-switch-m42.ts` 整只文件;本文件的 M42 步(`switchScenarioPrefixM42` / `scannedIdentityColumnsM42`,`migrateStepsOn` 第一步那一行)、报告 / 收据 / 日志的 `scenarioPrefixSourcesScanned`、头注 M42 段;" +
+            "`readLiveRunHeartbeat` / `LiveRunHeartbeat` 在 M40 与 M41 也已删码时随之删;`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里 M42 那一腿(`switchLocalScenarioPrefixM42`)与四只 File 店的 `scenarioPrefixOwnerRowsM42`(run / 会话 / 问 / 附件);`test/scenario-prefix-switch-m42.test.ts` 与 `test/scenario-prefix-switch-db-integration.test.ts` 两只文件。" +
+            "标记表的属主 `one-time-migration-marker.ts` 在 M43 也已删码时随之删;库里留下的标记表 / 数据根里的标记文件无人再读,不删(起服列册对账只核本树声明的表)",
+        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升的库,存量里以 `_scn:` 开头的身份被恢复管线读作某个人的场景(拆不出合文法的场景与人的 ⇒ `owner.malformed_subject` 响亮)。" +
+            "出路 = 升级时先过一次带本条的版本并起服(它扫一次、命中即拒启点名)",
+        reportKeys: ["scenarioPrefixSourcesScanned"],
+    },
+    {
+        id: "M43",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删本文件的 M43 步(`markWithdrawEnabledM43`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `withdrawMarkWritten`、头注 M43 段;" +
+            "`plugins/session-withdraw-sql.ts` 的 `WITHDRAW_MARK_ID` 与部署判据里读标记的那一句(撤回出口无条件启用);标记表 `one-time-migration-marker.ts` 在 M42 也已删码时随之删、`plugins/session-birth.ts` 的 `upgrade_pending` 词与出口计数里的同名词;" +
+            "local 会话元数据格「没有 `clientWrites` 位 ⇒ upgrade_pending」那一臂;库里留下的标记行无人再读,不删(与 M42 同一张标记表)",
+        afterRemoval: "窗 30 天之后更早版本的副本早已不在;标记行不再被任何读者读(留着无害)。跳过了带本条的版本直接升上来的库:撤回出口从第一次起服就启用 —— " +
+            "跨两版以上的混跑本就不被支持(7.147.0 起的停-迁-起)。出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["withdrawMarkWritten"],
+    },
+    {
+        id: "M44",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删本文件的 M44 步(`rewriteRunErrorCodeColumnM44`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `runErrorCodeColumnRewritten`、头注 M44 段;" +
+            "`run-store-sql.ts` 的读侧半场 `m44ErrorCodeReadSide`(行映射的码改成只读列;窗内停驻行列空时读结果体的码)与 `decodeRunResultCellM44`;" +
+            "local 腿 `FileRunStore.migrateRunErrorCodeColumnM44` 与 `LocalBackend.runOneTimeMigrations` 里那一格;`test/run-error-code-column.test.ts` 的 M44 组与双库集成文件的 M44 组",
+        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升上来的库,旧行按列答 —— 停驻两口在列建立之前写下的 `needs_review` 行 `errorCode` 缺席(`review.pending` 仍在 `result` 里)、" +
+            "列里是没折过的原码的旧行答原码;`result.terminal.code` 仍在 `result` 里。调长了停驻终局兜底(`APPROVAL_TERMINAL_BACKSTOP_MS` > 30 天)的部署,窗关时还可能有更早版本写下的停驻没结清,读法同上。" +
+            "出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["runErrorCodeColumnRewritten"],
+    },
+    {
+        id: "M45",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `src/plugins/run-preview-m45.ts` 整个文件;本文件的 M45 步(`rewriteRunObjectivePreviewM45`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `runObjectivePreviewRewritten`、头注 M45 段;" +
+            "local 腿 `FileRunStore.migrateRunObjectivePreviewM45` 与 `LocalBackend.runOneTimeMigrations` 里那一格;" +
+            "`test/run-preview-m45.test.ts` 与 `test/helpers/run-preview-m45-rows.ts` 整个文件、`test/session-preview-single-source-db-integration.test.ts` 的 M45 组",
+        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升上来的库,7.124.0 之前写下的、以注入块起头的预览照旧按列答 —— 会话列表 / `GET /v1/tasks` / 助手任务行名 / 收件箱上显示那段块文本。" +
+            "出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["runObjectivePreviewRewritten"],
+    },
+    {
+        id: "M46",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `src/plugins/approval-exemption-skill-m46.ts` 整个文件;本文件的 M46 步(`dropLegacySkillExemptionsM46`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `legacySkillExemptionsDropped`、头注 M46 段、`logReceiptRows` 里的 `legacy_skill_exemptions_dropped` 一行;" +
+            "`approval-exemption-store.ts` 的 `FileApprovalExemptionStore.dropToolRowsCreatedBeforeM46` 与 `LocalBackend.runOneTimeMigrations` 里那一格;" +
+            "`test/approval-exemption-skill-m46.test.ts` 整个文件、`test/one-time-migrations-db-integration.test.ts` 的 M46 组;标记表 `one-time-migration-marker.ts` 在 M42 / M43 也已删码时随之删(库里留下的 `M46` 标记行与数据根里的标记文件无人再读,不删)",
+        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升上来的库,7.116.0 之前写下的 `(会话, \"Skill\")` 豁免行照旧代答「不绑授予」的同名调用 —— 部署自挂一只叫 `Skill` 的工具、没有技能时," +
+            "那个人当年批的是「激活某技能」,代答的却是这只工具的调用。出路 = 升级时先过一次带本条的版本并起服(或运维手工删那些行:`DELETE FROM approval_exemption WHERE tool_name = 'Skill'` / 删会话)",
+        reportKeys: ["legacySkillExemptionsDropped"],
+    },
+    {
+        id: "M47",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `LocalSessionStore.adoptArchiveTokensM47`(含欠账起服的 `required` 分档、证明 `assertArchiveTokensAdoptedM47` / `adoptionScopeOf` / `skippedFromAdoption` 与它那一处销账)与 `LocalArchiveTokenAdoption`、`archiveTokenAdoptionCarried`;" +
+            "收令牌欠账的记账(`recordArchiveTokenAdoptionPending`);窗内长第一格的规则 `firstCellIncarnationOf` / `LocalSessionStore.firstCellIncarnationHeld`(调用点 —— 补铸、登记、执行位回填、M33 的行回填与快照恢复 —— 回到新铸);" +
+            "`holdArchiveTokenAdoptionDuty` 的 `adoptionCarried` 参数与记账那一支、`store-backend.ts` 判前钩里传它的那一处(臂恒判);" +
+            "`LocalBackend.ensureSchema` 里对 `adoptArchiveTokensM47` 的调用与两只读数字段、`runOneTimeMigrations` 里报告两键那几行;报告 / 收据 / `changedAnything` / `readingFields` / `NO_SQL_MIGRATIONS` 的 `localArchiveTokensAdopted` / `localArchiveTokensMinted`、头注 M47 段;" +
+            "M33 也已删码时连同 `archivedRowFactsOf` / `ArchivedRowFacts`;`test/local-root-one-row-store.test.ts` 里标题含 `P3` / `P4` 的格。" +
+            "**不随本条删**:跳版拒启臂 `holdArchiveTokenAdoptionDuty`(不带本条那一支:标记在而无格存档为零 ⇒ 销账放行)/ `archiveIdsWithoutCellSync` / `archiveTokenAdoptionPendingPresent` / `dischargeArchiveTokenAdoptionPending` / `ARCHIVE_TOKEN_ADOPTION_SINCE`、读数种别 `skipped-required-migration` 与它按高水位分支的拒句(常设)",
+        afterRemoval: "跳版拒启臂接住(常设,起服对账一族、数据根打开那一刻、引擎高水位抬之前):(打开之前的引擎高水位早于 7.148.0 或缺席 ∨ 数据根里的收令牌欠账标记还在 —— 带本条的版本打开过、没收完)" +
+            "∧ 根里有存档在而会话元数据格缺的会话 ⇒ 拒启 `config.schema_mismatch`(读数种别 `skipped-required-migration`,点名会话数与版本),零写、不抬高水位 —— " +
+            "出路 = 先用一个仍带本条、不低于 7.148.0 且不低于已记高水位的版本(服务或 run-local)完整起一次,再升",
+        reportKeys: ["localArchiveTokensAdopted", "localArchiveTokensMinted"],
+    },
+    {
+        id: "M48",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `src/plugins/shell-sentinel-owner-m48.ts` 整个文件;本文件的 M48 步(`clearShellSentinelOwnersM48`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志的 `shellSentinelOwnersCleared`、头注 M48 段;" +
+            "`SqlOneTimeMigrationInput` 里 M48 那一半(`ShellSentinelOwnerInput`)与它在两只 SQL 后端 / 测试夹具上的实参(`identityBoundary`);" +
+            "local 腿 `LocalSessionStore.clearShellSentinelOwnersM48` / `FileRunStore.clearShellSentinelOwnersM48` 与 `LocalBackend.runOneTimeMigrations` 里那一格(连同后端的 `identityBoundary` 字段);部署形表行 `identityBoundary` 不随删(dev-open 判据读它);" +
+            "`test/shell-sentinel-owner-m48.test.ts` 整个文件、`test/one-time-migrations-db-integration.test.ts` 的 M48 组",
+        afterRemoval: "没有响亮臂(如实):没有身份边界的部署跳过了带本条的版本直接升上来,哨兵属主的存量行仍记着那个字面量,属主面表已不认它 —— 不带主体的本地单用户读不到、续不上那些会话与 run(404)," +
+            "带同一个头的请求仍读得到(属主相同)。出路 = 升级时先过一次带本条的版本并起服(或运维手工 `UPDATE <表> SET owner = NULL WHERE owner = 'anon:shell-live'`,三张表见删法)。" +
+            "有身份边界的部署本条本来就零改写,删码前后同答(哨兵是一位普通的具名属主)",
+        reportKeys: ["shellSentinelOwnersCleared"],
+    },
+    {
+        id: "M49",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删本文件的 M49 步(`backfillCheckpointHostSessionsM49`,`migrateStepsOn` 里那一行)与 `HOST_SESSION_BACKFILL_PAGE`、报告 / 收据 / 日志的 `checkpointHostSessionsBackfilled`、头注 M49 段;" +
+            "local 腿 `LocalCheckpointStore.backfillHostSessionsM49` 与 `LocalBackend.runOneTimeMigrations` 里那一格;`test/checkpoint-host-session.test.ts` 的 M49 组、" +
+            "`test/one-time-migrations-db-integration.test.ts` 的 M49 组。**不随本条删**:`host_session_id` 列、写口的 `hostSessionOf`、按 run 找卡的读口(常设)",
+        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升上来的库,升级前停下、升级后仍挂着的卡归属为空 —— 按 run 找卡的读口找不到它:取消那条 run 不作废它、" +
+            "两条停驻收割把那条 run 当成「卡已不在」收掉(`approval.expired`)、决断答 409 `conflict.resume_context_unavailable`,卡由终局兜底收割收走。出路 = 升级前答完 / 拒掉停驻的卡," +
+            "或升级时先过一次带本条的版本并起服(或运维手工 `UPDATE checkpoint SET host_session_id = session_id WHERE host_session_id IS NULL`)",
+        reportKeys: ["checkpointHostSessionsBackfilled"],
+    },
+    {
+        id: "M50",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `src/plugins/approval-ask-retired-delete-by-task-m50.ts` 整只文件(`RETIRED_DELETE_BY_TASK_OP_M50` / `retiredDeleteByTaskReplayOpenM50` / `retiredDeleteByTaskClosedWhyM50`);" +
+            "`approval-ask-store-file.ts` 重放里认它的那一段(`replayRecord` 里 `probe.op === RETIRED_DELETE_BY_TASK_OP_M50` 一段)、`retiredDeleteByTaskRecordsM50` 计数与构造器末段那一行 stderr、那一行 import、顶注里随 M50 的那半句;" +
+            "`approval-ask-store-memory.ts` 的 `deleteByTaskM50`;`test/approval-ask-session-cascade.test.ts` 的 M50 组(窗内 / 窗关当天 / 窗关次日 / 坏记录四格与 `withM50Window` 助手);本文件头注 M50 段",
+        afterRemoval: "既有的词表外动词拒启(`approval-ask-store-file.ts` 重放的动词闭集判,拒句点名账本路径,出路 = 用写下它的那一版起服一次或把文件挪开)—— 与窗关之后本条自己的拒启同一个结局,删码零行为变化。" +
+            "会撞上它的是窗内一次都没在带本条的版本上起过服的 local 数据根(跳过本版直接升的),账本里又恰好留着一条嵌入方写下的这只词",
+        reportKeys: [],
+    },
+    {
+        id: "M51",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删本文件的 M51 步(`switchSessionDeletingM51` / `SessionDeletingSwitchRefusedError` / `SESSION_DELETING_SWITCH_REFUSED_CODE` / `SESSION_DELETING_MARK_ID`,`migrateStepsOn` 里那一行)、" +
+            "报告 / 收据 / `changedAnything` / `readingFields` / `NO_SQL_MIGRATIONS` 的 `sessionDeletingSwitchMarked`、头注 M51 段;`test/session-deleting-state-db-integration.test.ts` 的 M51 组;" +
+            "标记表 `one-time-migration-marker.ts` 在 M42 / M43 / M46 也已删码时随之删(库里留下的 `M51` 标记行无人再读,不删)。**不随本条删**:在删态本身(列、围栏、规则 L 的在删半、终刀判令牌 —— 常设)",
+        afterRemoval: "没有响亮臂(也无需):窗 30 天之后更早版本的副本早已不在;跳过了带本条的版本直接升上来的库 —— 跨两版以上的混跑本就不被支持(7.147.0 起的停-迁-起)。出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["sessionDeletingSwitchMarked"],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;
@@ -616,12 +768,23 @@ export function migrationWindowEnd(id) {
         throw new Error(`one-time-migrations: ${id} is in the unreleased form (removableAfter: null) — there is no window end to quote yet`);
     return row.removableAfter;
 }
+export function columnsRemovedByPendingMigrations(registry = ONE_TIME_MIGRATIONS) {
+    const removals = new Map();
+    for (const row of registry) {
+        for (const [table, columns] of Object.entries(row.dropsColumns ?? {})) {
+            const owners = removals.get(table) ?? new Map();
+            for (const column of columns) {
+                const owner = owners.get(column);
+                if (owner !== undefined)
+                    throw new Error(`one-time-migrations: ${table}.${column} is claimed as dropped by both ${owner} and ${row.id} — one column has one dropping migration`);
+                owners.set(column, row.id);
+            }
+            removals.set(table, owners);
+        }
+    }
+    return removals;
+}
 export const NO_SQL_MIGRATIONS = {
-    workflowParkIndexKey: "file-ledger",
-    workflowParkIndexRowsCarried: 0,
-    undurableScopeRuleRows: [],
-    undurableScopeRuleBucketsDeferred: 0,
-    undurableScopeRuleBucketsUnreadable: [],
     sessionRuleColumn: "file-store",
     sessionRuleRowsWithRetiredBuckets: [],
     sessionRuleRowsWithOldGrammarEntries: [],
@@ -647,6 +810,10 @@ export const NO_SQL_MIGRATIONS = {
     deviceBindingsMoved: 0,
     deviceBindingsOrphaned: 0,
     deviceBindingTablesDropped: 0,
+    sessionExtRowsMoved: 0,
+    sessionMetaColumnsDropped: 0,
+    withdrawMarkWritten: 0,
+    sessionDeletingSwitchMarked: 0,
     askCauseColumnsChanged: 0,
     askParkTriggersMoved: 0,
 };
@@ -703,7 +870,7 @@ async function columnExists(db, dialect, table, column) {
     return (await db.rows(sql)).length > 0;
 }
 export function createSqlImportedLayerRootSource(exec) {
-    return { candidateOwners: () => listRuleBucketOwners(exec), durable: new SqlDurableRulePartitionProvider(exec), isWholeBucketRefusal: isSqlBucketRefusal, isVanishedBucket: isSqlBucketVanished };
+    return { candidateOwners: async () => ({ owners: await listRuleBucketOwners(exec), unnamedBuckets: 0 }), durable: new SqlDurableRulePartitionProvider(exec), isWholeBucketRefusal: isSqlBucketRefusal, isVanishedBucket: isSqlBucketVanished };
 }
 export async function runSqlOneTimeMigrations(dialect, pool, input) {
     return dialect === "mysql" ? withMysqlLock(pool, (db) => migrateOn(db, "mysql", input)) : withPgLock(pool, (db) => migrateOn(db, "pg", input));
@@ -747,16 +914,21 @@ async function migrateOn(db, dialect, input) {
     return completedReport(receipts);
 }
 async function migrateStepsOn(db, dialect, receipts, input) {
+    await switchScenarioPrefixM42(db, dialect, receipts, input);
+    await renameRetiredExecutionLaneWordsM40(db, dialect, receipts, input);
+    await refuseSessionExtMoveWhileRunsHeartbeat(db, dialect, input);
+    await switchSessionDeletingM51(db, dialect, receipts, input);
+    await rewriteRunErrorCodeColumnM44(db, dialect, receipts);
+    await rewriteRunObjectivePreviewM45(db, dialect, receipts);
+    await clearShellSentinelOwnersM48(db, dialect, receipts, input);
+    await backfillCheckpointHostSessionsM49(db, dialect, receipts);
     await migrateRetiredCardWords(db, dialect, receipts);
     await splitApprovalAskCauseColumns(db, dialect, receipts);
-    await reshapeWorkflowParkIndex(db, dialect, receipts);
     await migrateSessionRuleGrammar(db, dialect, receipts);
     await repairParkedRows(db, dialect, receipts);
     await backfillParkedApprovalCards(db, dialect, receipts);
     if (await tableExists(db, dialect, "session_meta"))
         await inheritPlacedSessionOwners(db, dialect, receipts);
-    if ((await tableExists(db, dialect, PERMISSION_RULE_TABLE)) && (await columnExists(db, dialect, PERMISSION_RULE_TABLE, "grammar")))
-        await purgeUndurableScopeRows(db, dialect, receipts);
     if ((await tableExists(db, dialect, PERMISSION_RULE_TABLE)) && (await columnExists(db, dialect, PERMISSION_RULE_TABLE, "grammar"))) {
         await retireImportedLayerRootAllows(createSqlImportedLayerRootSource({ dialect, query: (sql, params) => db.query(sql, params) }), receipts);
     }
@@ -765,6 +937,351 @@ async function migrateStepsOn(db, dialect, receipts, input) {
         await dropRetiredBreakerTable(db, dialect, receipts);
     await dropRejectedMailboxKeys(db, dialect, receipts);
     await switchExecutionPlacement(db, dialect, receipts, input);
+    await moveSessionCellsToSideTable(db, dialect, receipts);
+    await markWithdrawEnabledM43(db, dialect, receipts, input);
+    await dropLegacySkillExemptionsM46(db, dialect, receipts);
+}
+const M44_PAGE = 500;
+async function rewriteRunErrorCodeColumnM44(db, dialect, receipts) {
+    if (!(await tableExists(db, dialect, "task_run")))
+        return;
+    receipts.runErrorCodeColumnRewritten += await db.exec("UPDATE task_run SET error_code = NULL WHERE status = 'running' AND error_code IS NOT NULL");
+    let after = "";
+    for (;;) {
+        const page = await db.rows(dialect === "mysql"
+            ? `SELECT task_id, status, updated_at, error_code, ${jsonColumnText(dialect, "result")} FROM task_run WHERE task_id > ? AND result IS NOT NULL AND status <> 'running' ORDER BY task_id LIMIT ${M44_PAGE}`
+            : `SELECT task_id, status, updated_at, error_code, ${jsonColumnText(dialect, "result")} FROM task_run WHERE task_id > $1 AND result IS NOT NULL AND status <> 'running' ORDER BY task_id LIMIT ${M44_PAGE}`, [after]);
+        for (const row of page) {
+            const taskId = String(row["task_id"]);
+            const first = await rewriteOneRunErrorCodeM44(db, dialect, row);
+            if (first !== 0) {
+                if (first > 0)
+                    receipts.runErrorCodeColumnRewritten += 1;
+                continue;
+            }
+            const [now] = await db.rows(dialect === "mysql"
+                ? `SELECT task_id, status, updated_at, error_code, ${jsonColumnText(dialect, "result")} FROM task_run WHERE task_id = ? AND result IS NOT NULL AND status <> 'running'`
+                : `SELECT task_id, status, updated_at, error_code, ${jsonColumnText(dialect, "result")} FROM task_run WHERE task_id = $1 AND result IS NOT NULL AND status <> 'running'`, [taskId]);
+            if (now !== undefined && (await rewriteOneRunErrorCodeM44(db, dialect, now)) > 0)
+                receipts.runErrorCodeColumnRewritten += 1;
+        }
+        if (page.length < M44_PAGE)
+            return;
+        after = String(page[page.length - 1]["task_id"]);
+    }
+}
+async function rewriteOneRunErrorCodeM44(db, dialect, row) {
+    const taskId = String(row["task_id"]);
+    const storedCode = row["error_code"] ?? null;
+    const result = decodeRunResultCellM44(row["result"], taskId);
+    if (result === "unreadable" || result === null)
+        return -1;
+    const target = persistedPlaneOf(result).errorCode ?? storedCode;
+    if (target === storedCode)
+        return -1;
+    return db.exec(dialect === "mysql"
+        ? "UPDATE task_run SET error_code = ? WHERE task_id = ? AND status = ? AND updated_at = ? AND error_code <=> ?"
+        : "UPDATE task_run SET error_code = $1 WHERE task_id = $2 AND status = $3 AND updated_at = $4 AND error_code IS NOT DISTINCT FROM $5", [target, taskId, String(row["status"]), row["updated_at"], storedCode]);
+}
+const M45_PAGE = 500;
+async function rewriteRunObjectivePreviewM45(db, dialect, receipts) {
+    if (!(await tableExists(db, dialect, "task_run")))
+        return;
+    const ph = (i) => (dialect === "mysql" ? "?" : `$${i}`);
+    const coarse = RUN_PREVIEW_COARSE_PREFIXES_M45.map((_, i) => `objective_preview LIKE ${ph(i + 2)}`).join(" OR ");
+    let after = "";
+    for (;;) {
+        const page = await db.rows(`SELECT task_id, objective_preview FROM task_run WHERE task_id > ${ph(1)} AND (${coarse}) ORDER BY task_id LIMIT ${M45_PAGE}`, [after, ...RUN_PREVIEW_COARSE_PREFIXES_M45]);
+        for (const row of page) {
+            const current = row["objective_preview"];
+            if (typeof current !== "string")
+                continue;
+            const target = normalizedRunPreviewM45(current);
+            if (target === undefined || target === current)
+                continue;
+            receipts.runObjectivePreviewRewritten += await db.exec(dialect === "mysql" ? "UPDATE task_run SET objective_preview = ? WHERE task_id = ? AND objective_preview = ?" : "UPDATE task_run SET objective_preview = $1 WHERE task_id = $2 AND objective_preview = $3", [target, String(row["task_id"]), current]);
+        }
+        if (page.length < M45_PAGE)
+            return;
+        after = String(page[page.length - 1]["task_id"]);
+    }
+}
+export async function clearShellSentinelOwnersM48(db, dialect, receipts, input) {
+    if (input.identityBoundary !== false)
+        return;
+    const sentinelOwner = dialect === "mysql" ? "CAST(owner AS BINARY) = CAST(? AS BINARY)" : "owner = $1";
+    for (const table of SHELL_SENTINEL_OWNER_TABLES_M48) {
+        if (!(await tableExists(db, dialect, table)))
+            continue;
+        receipts.shellSentinelOwnersCleared += await db.exec(`UPDATE ${table} SET owner = NULL WHERE ${sentinelOwner}`, [SHELL_SENTINEL_OWNER_M48]);
+    }
+}
+const HOST_SESSION_BACKFILL_PAGE = 500;
+async function backfillCheckpointHostSessionsM49(db, dialect, receipts) {
+    if (!(await tableExists(db, dialect, "checkpoint")) || !(await columnExists(db, dialect, "checkpoint", "host_session_id")))
+        return;
+    const ph = (i) => (dialect === "mysql" ? "?" : `$${i}`);
+    let after = "";
+    for (;;) {
+        const page = (await db.rows(`SELECT token FROM checkpoint WHERE host_session_id IS NULL AND token > ${ph(1)} ORDER BY token ASC LIMIT ${HOST_SESSION_BACKFILL_PAGE}`, [after])).map((r) => String(r.token));
+        if (page.length === 0)
+            return;
+        receipts.checkpointHostSessionsBackfilled += await db.exec(`UPDATE checkpoint SET host_session_id = session_id WHERE host_session_id IS NULL AND token IN (${page.map((_, i) => ph(i + 1)).join(", ")})`, page);
+        after = page[page.length - 1];
+        if (page.length < HOST_SESSION_BACKFILL_PAGE)
+            return;
+    }
+}
+export async function dropLegacySkillExemptionsM46(db, dialect, receipts) {
+    if (!(await tableExists(db, dialect, "approval_exemption")))
+        return;
+    if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
+        await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
+    const ph = (i) => (dialect === "mysql" ? "?" : `$${i}`);
+    const readMark = async () => {
+        const [row] = await db.rows(`SELECT marked_at_ms FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = ${ph(1)}`, [LEGACY_SKILL_EXEMPTION_MARKER_ID]);
+        return row === undefined ? undefined : Number(row["marked_at_ms"]);
+    };
+    let markedAtMs = await readMark();
+    if (markedAtMs === undefined) {
+        await db.exec(dialect === "mysql"
+            ? `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES (?, ?) ON DUPLICATE KEY UPDATE migration_id = migration_id`
+            : `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES ($1, $2) ON CONFLICT (migration_id) DO NOTHING`, [LEGACY_SKILL_EXEMPTION_MARKER_ID, Date.now()]);
+        markedAtMs = await readMark();
+    }
+    if (markedAtMs === undefined || !Number.isFinite(markedAtMs))
+        throw new Error("one-time migration M46: the marker row is missing or unreadable right after it was written — refusing to delete rows without a recorded cutoff");
+    const cutoff = new Date(markedAtMs);
+    let after = "";
+    for (;;) {
+        const page = await db.rows(`SELECT session_id FROM approval_exemption WHERE tool_name = ${ph(1)} AND created_at < ${ph(2)} AND session_id > ${ph(3)} ORDER BY session_id LIMIT ${LEGACY_SKILL_EXEMPTION_PAGE}`, [LEGACY_SKILL_EXEMPTION_TOOL_NAME, cutoff, after]);
+        if (page.length === 0)
+            return;
+        const sessionIds = page.map((r) => String(r["session_id"]));
+        receipts.legacySkillExemptionsDropped += await db.exec(`DELETE FROM approval_exemption WHERE tool_name = ${ph(1)} AND created_at < ${ph(2)} AND session_id IN (${sessionIds.map((_, i) => ph(i + 3)).join(", ")})`, [LEGACY_SKILL_EXEMPTION_TOOL_NAME, cutoff, ...sessionIds]);
+        if (page.length < LEGACY_SKILL_EXEMPTION_PAGE)
+            return;
+        after = sessionIds[sessionIds.length - 1];
+    }
+}
+async function markWithdrawEnabledM43(db, dialect, receipts, input) {
+    if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
+        await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
+    const marked = await db.rows(dialect === "mysql" ? `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = ?` : `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = $1`, [WITHDRAW_MARK_ID]);
+    if (marked.length > 0)
+        return;
+    if ((await readLiveRunHeartbeat(db, dialect, input)) !== undefined)
+        return;
+    receipts.withdrawMarkWritten += await db.exec(dialect === "mysql"
+        ? `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES (?, ?) ON DUPLICATE KEY UPDATE migration_id = migration_id`
+        : `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES ($1, $2) ON CONFLICT (migration_id) DO NOTHING`, [WITHDRAW_MARK_ID, Date.now()]);
+}
+export const SESSION_DELETING_MARK_ID = "M51";
+export const SESSION_DELETING_SWITCH_REFUSED_CODE = "config.session_deleting_switch_refused";
+export class SessionDeletingSwitchRefusedError extends StoreBootRefusalError {
+    code = SESSION_DELETING_SWITCH_REFUSED_CODE;
+    reason = "live_runs";
+    constructor(live) {
+        super(`${SESSION_DELETING_SWITCH_REFUSED_CODE} (reason: live_runs): this version deletes a session through a deleting state that every replica must read ` +
+            `(a submission on a session being deleted is refused), but ${live.liveRuns} running run(s) heartbeated on this database within the last ${live.windowSec}s (REAP_RUN_STALE_SEC) — ` +
+            "a replica of an earlier version may still be serving; it does not read that state and would accept a submission on a session this version is deleting. Nothing was changed and no marker was written. " +
+            "Stop every replica of the earlier version, then start this version (stop, migrate, start — this release cannot be rolled across replicas of both versions). " +
+            `If every replica is already stopped, those are the runs they left behind: start this version again after ${live.after}`);
+        this.name = "SessionDeletingSwitchRefusedError";
+    }
+}
+async function switchSessionDeletingM51(db, dialect, receipts, input) {
+    if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
+        await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
+    const marked = await db.rows(dialect === "mysql" ? `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = ?` : `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = $1`, [SESSION_DELETING_MARK_ID]);
+    if (marked.length > 0)
+        return;
+    const heartbeat = await readLiveRunHeartbeat(db, dialect, input);
+    if (heartbeat !== undefined)
+        throw new SessionDeletingSwitchRefusedError(heartbeat);
+    receipts.sessionDeletingSwitchMarked += await db.exec(dialect === "mysql"
+        ? `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES (?, ?) ON DUPLICATE KEY UPDATE migration_id = migration_id`
+        : `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES ($1, $2) ON CONFLICT (migration_id) DO NOTHING`, [SESSION_DELETING_MARK_ID, Date.now()]);
+}
+export async function scannedIdentityColumnsM42(db, dialect) {
+    const scope = dialect === "mysql" ? "DATABASE()" : "current_schema()";
+    const live = new Set((await db.rows(`SELECT table_name AS t, column_name AS c FROM information_schema.columns WHERE table_schema = ${scope}`)).map((r) => `${String(r["t"] ?? r["T"])}.${String(r["c"] ?? r["C"])}`));
+    const out = [];
+    for (const [table, shape] of await expectedTableShapes(dialect)) {
+        for (const c of shape.columns) {
+            if (!IDENTITY_COLUMN_NAME.test(c.name) || !/^\S+\s+(VAR)?(CHAR|BINARY)\(|^\S+\s+TEXT\b/i.test(c.ddl))
+                continue;
+            if (live.has(`${table}.${c.name}`))
+                out.push({ table, column: c.name });
+        }
+    }
+    return out.sort((a, b) => `${a.table}.${a.column}`.localeCompare(`${b.table}.${b.column}`));
+}
+export async function switchScenarioPrefixM42(db, dialect, receipts, input) {
+    if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
+        await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
+    const marked = await db.rows(dialect === "mysql" ? `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = ?` : `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = $1`, [SCENARIO_PREFIX_MARKER_ID]);
+    if (marked.length > 0)
+        return;
+    const columns = await scannedIdentityColumnsM42(db, dialect);
+    const hits = [];
+    for (const { table, column } of columns) {
+        const sql = dialect === "mysql" ? `SELECT COUNT(*) AS n FROM ${table} WHERE ${column} LIKE ? ESCAPE '!'` : `SELECT COUNT(*) AS n FROM ${table} WHERE ${column} LIKE $1 ESCAPE '!'`;
+        const n = Number((await db.rows(sql, [SCENARIO_PREFIX_LIKE]))[0]?.["n"] ?? 0);
+        if (n > 0)
+            hits.push({ source: `${table}.${column}`, rows: n });
+    }
+    receipts.scenarioPrefixSourcesScanned += columns.length;
+    if (hits.length > 0)
+        throw new ScenarioPrefixSwitchRefusedError("stored_prefix", hits);
+    const live = await readLiveRunHeartbeat(db, dialect, input);
+    if (live !== undefined)
+        throw new ScenarioPrefixSwitchRefusedError("live_runs", [], live);
+    await db.exec(dialect === "mysql"
+        ? `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES (?, ?) ON DUPLICATE KEY UPDATE migration_id = migration_id`
+        : `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES ($1, $2) ON CONFLICT (migration_id) DO NOTHING`, [SCENARIO_PREFIX_MARKER_ID, Date.now()]);
+}
+export const EXECUTION_LANE_RENAME_REFUSED_CODE = "config.execution_lane_rename_refused";
+export class ExecutionLaneRenameRefusedError extends StoreBootRefusalError {
+    pendingRows;
+    liveRuns;
+    restartAfter;
+    code = EXECUTION_LANE_RENAME_REFUSED_CODE;
+    constructor(pendingRows, liveRuns, restartAfter, detail) {
+        super(`${EXECUTION_LANE_RENAME_REFUSED_CODE}: ${detail}`);
+        this.pendingRows = pendingRows;
+        this.liveRuns = liveRuns;
+        this.restartAfter = restartAfter;
+        this.name = "ExecutionLaneRenameRefusedError";
+    }
+}
+export class ExecutionLaneRenameWriteRefusedError extends StoreBootRefusalError {
+    file;
+    code = EXECUTION_LANE_RENAME_REFUSED_CODE;
+    errno;
+    constructor(file, cause) {
+        const errno = typeof cause?.code === "string" ? cause.code : undefined;
+        const fault = errno ?? (cause instanceof Error ? cause.message : String(cause));
+        super(`${EXECUTION_LANE_RENAME_REFUSED_CODE}: one-time migration M40 could not rewrite ${file} (${fault}) — it still records the retired execution-lane word ` +
+            `"${RETIRED_EXECUTION_LANE_WORD_M40}" (now "${RENAMED_EXECUTION_LANE_M40}"), which this build refuses to read, so it refuses to start rather than run without that data. ` +
+            `The file is unchanged. Restore write access to the file and its directory (clear an immutable flag, remount read-write, free disk space), then restart: the rename runs again on the next start.`, { cause });
+        this.file = file;
+        this.name = "ExecutionLaneRenameWriteRefusedError";
+        this.errno = errno;
+    }
+}
+const EXECUTION_LANE_TABLES = [APPROVAL_ASK_TABLE, "session_meta", SESSION_EXT_TABLE];
+export async function renameRetiredExecutionLaneWordsM40(db, dialect, receipts, input) {
+    const tables = [];
+    for (const table of EXECUTION_LANE_TABLES)
+        if (await columnExists(db, dialect, table, "execution_lane"))
+            tables.push(table);
+    let pendingRows = 0;
+    for (const table of tables) {
+        const [row] = await db.rows(`SELECT COUNT(*) AS n FROM ${table} WHERE execution_lane = ${dialect === "mysql" ? "?" : "$1"}`, [RETIRED_EXECUTION_LANE_WORD_M40]);
+        pendingRows += Number(row?.["n"] ?? 0);
+    }
+    if (pendingRows === 0)
+        return;
+    await refuseWhileRunsHeartbeat(db, dialect, pendingRows, input);
+    for (const table of tables) {
+        receipts.executionLaneWordsRenamed += await db.exec(dialect === "mysql" ? `UPDATE ${table} SET execution_lane = ? WHERE execution_lane = ?` : `UPDATE ${table} SET execution_lane = $1 WHERE execution_lane = $2`, [RENAMED_EXECUTION_LANE_M40, RETIRED_EXECUTION_LANE_WORD_M40]);
+    }
+}
+async function readLiveRunHeartbeat(db, dialect, input) {
+    if (!(await tableExists(db, dialect, "task_run")))
+        return undefined;
+    const since = new Date(Date.now() - input.liveRunWindowMs);
+    const [row] = await db.rows(`SELECT COUNT(*) AS n, MAX(updated_at) AS newest FROM task_run WHERE status = 'running' AND updated_at >= ${dialect === "mysql" ? "?" : "$1"}`, [since]);
+    const liveRuns = Number(row?.["n"] ?? 0);
+    if (liveRuns === 0)
+        return undefined;
+    const newestCell = row?.["newest"];
+    const newest = newestCell instanceof Date ? newestCell : new Date(String(newestCell));
+    const now = Date.now();
+    const restartAtMs = (Number.isNaN(newest.getTime()) ? now : newest.getTime()) + input.liveRunWindowMs;
+    return {
+        liveRuns,
+        windowSec: Math.round(input.liveRunWindowMs / 1000),
+        restartAfter: new Date(restartAtMs).toISOString(),
+        after: `${new Date(restartAtMs).toISOString()} (${Math.max(0, Math.ceil((restartAtMs - now) / 1000))}s from now)`,
+    };
+}
+async function refuseWhileRunsHeartbeat(db, dialect, pendingRows, input) {
+    const heartbeat = await readLiveRunHeartbeat(db, dialect, input);
+    if (heartbeat === undefined)
+        return;
+    const { liveRuns, windowSec, restartAfter, after } = heartbeat;
+    throw new ExecutionLaneRenameRefusedError(pendingRows, liveRuns, restartAfter, `${pendingRows} stored rows (approval asks / sessions) carry the execution lane word "${RETIRED_EXECUTION_LANE_WORD_M40}", the name an earlier version gave the lane with no execution environment, ` +
+        `which this version calls "${RENAMED_EXECUTION_LANE_M40}" and does not read; this boot renames them (one-time migration M40), but ${liveRuns} running runs on this database heartbeat within the last ${windowSec}s ` +
+        `(REAP_RUN_STALE_SEC) — a replica of an earlier version is still serving, and it would keep writing the old word after the rename. No stored row was changed. ` +
+        "Stop every replica of the earlier version, then start this version (stop, migrate, start — this release cannot be rolled across replicas of both versions). " +
+        `If every replica is already stopped, those are the runs they left behind: start this version again after ${after}`);
+}
+export const SESSION_EXT_MOVE_REFUSED_CODE = "config.session_ext_move_refused";
+export class SessionExtMoveRefusedError extends StoreBootRefusalError {
+    reason;
+    code = SESSION_EXT_MOVE_REFUSED_CODE;
+    constructor(reason, detail) {
+        super(`${SESSION_EXT_MOVE_REFUSED_CODE} (reason: ${reason}): ${detail}`);
+        this.reason = reason;
+        this.name = "SessionExtMoveRefusedError";
+    }
+}
+async function deploymentColumnsOnMeta(db, dialect) {
+    if (!(await tableExists(db, dialect, "session_meta")))
+        return [];
+    const present = [];
+    for (const column of SESSION_EXT_MOVED_COLUMNS)
+        if (await columnExists(db, dialect, "session_meta", column.name))
+            present.push(column);
+    return present;
+}
+const sameCell = (dialect, column) => {
+    const side = column.name === "pinned" ? "COALESCE(se.pinned, FALSE)" : `se.${column.name}`;
+    return dialect === "mysql" ? `sm.${column.name} <=> ${side}` : `sm.${column.name} IS NOT DISTINCT FROM ${side}`;
+};
+const SESSION_EXT_MOVE_PAGE = 500;
+export async function refuseSessionExtMoveWhileRunsHeartbeat(db, dialect, input) {
+    const columns = await deploymentColumnsOnMeta(db, dialect);
+    if (columns.length === 0)
+        return;
+    const heartbeat = await readLiveRunHeartbeat(db, dialect, input);
+    if (heartbeat === undefined)
+        return;
+    throw new SessionExtMoveRefusedError("live_runs", `${columns.length} session cells (${columns.map((c) => c.name).join(", ")}) still live on session_meta; this version keeps them on the side table ${SESSION_EXT_TABLE} and moves them on this boot ` +
+        `(one-time migration M41: copy, verify, then drop the columns), but ${heartbeat.liveRuns} running runs on this database heartbeat within the last ${heartbeat.windowSec}s (REAP_RUN_STALE_SEC) — ` +
+        "a replica of an earlier version is still serving; a cell it writes between the copy and the drop would be lost, and every cell write it makes after the drop fails. Nothing was changed. " +
+        "Stop every replica of the earlier version, then start this version (stop, migrate, start — this release cannot be rolled across replicas of both versions). " +
+        `If every replica is already stopped, those are the runs they left behind: start this version again after ${heartbeat.after}`);
+}
+export async function moveSessionCellsToSideTable(db, dialect, receipts) {
+    const columns = await deploymentColumnsOnMeta(db, dialect);
+    if (columns.length === 0)
+        return;
+    const names = columns.map((c) => c.name);
+    const p = dialect === "mysql" ? () => "?" : (n) => `$${n}`;
+    const upsert = `INSERT INTO ${SESSION_EXT_TABLE} (session_id, ${names.join(", ")}) SELECT session_id, ${names.join(", ")} FROM session_meta ` +
+        `WHERE session_id > ${p(1)} AND session_id <= ${p(2)} ` +
+        (dialect === "mysql" ? `ON DUPLICATE KEY UPDATE ${names.map((n) => `${SESSION_EXT_TABLE}.${n} = VALUES(${n})`).join(", ")}` : `ON CONFLICT (session_id) DO UPDATE SET ${names.map((n) => `${n} = EXCLUDED.${n}`).join(", ")}`);
+    let after = "";
+    for (;;) {
+        const page = await db.rows(`SELECT session_id FROM session_meta WHERE session_id > ${p(1)} ORDER BY session_id LIMIT ${SESSION_EXT_MOVE_PAGE}`, [after]);
+        if (page.length === 0)
+            break;
+        const last = String(page[page.length - 1]["session_id"]);
+        await db.exec(upsert, [after, last]);
+        receipts.sessionExtRowsMoved += page.length;
+        after = last;
+    }
+    const [mismatch] = await db.rows(`SELECT sm.session_id FROM session_meta sm LEFT JOIN ${SESSION_EXT_TABLE} se ON se.session_id = sm.session_id WHERE NOT (${columns.map((c) => sameCell(dialect, c)).join(" AND ")}) LIMIT 1`);
+    if (mismatch !== undefined) {
+        throw new SessionExtMoveRefusedError("copy_mismatch", `after copying the session cells (${names.join(", ")}) from session_meta to ${SESSION_EXT_TABLE}, session ${String(mismatch["session_id"])} does not hold the same values on both tables — ` +
+            "a writer changed it while this boot copied (an earlier-version replica still serving), or the copy did not land. No column was dropped. " +
+            "Stop every replica of the earlier version and start this version again: the copy runs again from the start");
+    }
+    await execUntil(db, `ALTER TABLE session_meta ${names.map((n) => `DROP COLUMN ${n}`).join(", ")}`, async () => (await deploymentColumnsOnMeta(db, dialect)).length === 0);
+    receipts.sessionMetaColumnsDropped += columns.length;
 }
 const RETIRED_ASK_CAUSE_COLUMN = "denied_reason";
 function renameAskCauseColumnSql(dialect) {
@@ -806,12 +1323,13 @@ async function readSwitchShape(db, dialect) {
     const sessionMeta = await tableExists(db, dialect, "session_meta");
     const placementColumns = new Set();
     if (sessionMeta)
-        for (const c of SESSION_META_PLACEMENT_COLUMNS)
+        for (const c of EXECUTION_PLACEMENT_COLUMNS)
             if (await columnExists(db, dialect, "session_meta", c.name))
                 placementColumns.add(c.name);
     return {
         sessionMeta,
         placementColumns,
+        cellsOnSideTable: sessionMeta && (await deploymentColumnsOnMeta(db, dialect)).length === 0,
         bindingTable: await tableExists(db, dialect, RETIRED_DEVICE_BINDING_TABLE),
         parkedTable: await tableExists(db, dialect, PARKED_DEVICE_BINDING_TABLE),
         taskRun: sessionMeta && (await tableExists(db, dialect, "task_run")),
@@ -823,11 +1341,11 @@ async function askTableShape(db, dialect) {
     return { askTable, askLaneColumn: askTable && (await columnExists(db, dialect, APPROVAL_ASK_TABLE, "execution_lane")) };
 }
 function switchStarted(s) {
-    return s.placementColumns.has("execution_role") || s.parkedTable;
+    return s.placementColumns.has("execution_role") || s.parkedTable || s.cellsOnSideTable;
 }
 const SWITCH_COMPLETION_COLUMN = "fork_key";
 function switchComplete(s) {
-    return s.placementColumns.size === SESSION_META_PLACEMENT_COLUMNS.length && (!s.askTable || s.askLaneColumn) && !s.bindingTable && !s.parkedTable;
+    return (s.placementColumns.size === EXECUTION_PLACEMENT_COLUMNS.length || s.cellsOnSideTable) && (!s.askTable || s.askLaneColumn) && !s.bindingTable && !s.parkedTable;
 }
 function askLaneBackfillSql(dialect) {
     return dialect === "mysql"
@@ -878,7 +1396,7 @@ const EXECUTION_PLACEMENT_BACKFILL_NEEDS = [
     { what: "approval ask rows that do not record the execution lane they were raised on (they would record their root session's lane, or the only declared lane)", holds: askRowsAwaitingLane },
 ];
 async function refuseOnAmbiguousBackfill(read, dialect, shape, lanes) {
-    if (!shape.sessionMeta || switchComplete(shape) || lanes.length === 1)
+    if (!shape.sessionMeta || shape.cellsOnSideTable || switchComplete(shape) || lanes.length === 1)
         return;
     const pending = [];
     for (const need of EXECUTION_PLACEMENT_BACKFILL_NEEDS)
@@ -931,7 +1449,7 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
         id: "① park the retired binding table",
         run: async ({ db, dialect, shape }) => {
             const s = await shape();
-            if (!s.bindingTable || s.placementColumns.has("execution_role"))
+            if (!s.bindingTable || s.placementColumns.has("execution_role") || s.cellsOnSideTable)
                 return;
             const sql = dialect === "mysql" ? `RENAME TABLE ${RETIRED_DEVICE_BINDING_TABLE} TO ${PARKED_DEVICE_BINDING_TABLE}` : `ALTER TABLE ${RETIRED_DEVICE_BINDING_TABLE} RENAME TO ${PARKED_DEVICE_BINDING_TABLE}`;
             await execUntil(db, sql, async () => {
@@ -955,7 +1473,9 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
     {
         id: "② add the execution placement columns",
         run: async ({ db, dialect, receipts, shape }) => {
-            for (const column of SESSION_META_PLACEMENT_COLUMNS) {
+            if ((await shape()).cellsOnSideTable)
+                return;
+            for (const column of EXECUTION_PLACEMENT_COLUMNS) {
                 if (column.name === SWITCH_COMPLETION_COLUMN)
                     continue;
                 if ((await shape()).placementColumns.has(column.name))
@@ -973,10 +1493,17 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
     {
         id: "③ move the bindings onto the root session rows",
         run: async ({ db, dialect, receipts, shape }) => {
-            if (!(await shape()).parkedTable)
+            const s = await shape();
+            if (!s.parkedTable)
                 return;
             const orphans = countOrphanBindingsStatement(dialect, PARKED_DEVICE_BINDING_TABLE);
             receipts.deviceBindingsOrphaned += Number((await db.rows(orphans.text, orphans.values))[0]?.["orphans"] ?? 0);
+            if (s.cellsOnSideTable) {
+                const [ensure, move] = migrateDeviceBindingsOntoSideTableStatements(dialect, PARKED_DEVICE_BINDING_TABLE);
+                await db.exec(ensure.text, ensure.values);
+                receipts.deviceBindingsMoved += await db.exec(move.text, move.values);
+                return;
+            }
             const move = migrateDeviceBindingsStatement(dialect, PARKED_DEVICE_BINDING_TABLE);
             receipts.deviceBindingsMoved += await db.exec(move.text, move.values);
         },
@@ -985,6 +1512,8 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
         id: "④ backfill placements of sessions with runs",
         run: async ({ db, dialect, input, receipts, shape }) => {
             const s = await shape();
+            if (s.cellsOnSideTable)
+                return;
             if (input.lanes.length !== 1) {
                 await refuseOnAmbiguousBackfill((sql) => db.rows(sql), dialect, s, input.lanes);
                 return;
@@ -998,7 +1527,7 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
         id: "④b backfill the execution lane of approval ask rows",
         run: async ({ db, dialect, input, receipts, shape }) => {
             const s = await shape();
-            if (!s.askTable || !s.askLaneColumn)
+            if (!s.askTable || !s.askLaneColumn || s.cellsOnSideTable)
                 return;
             if (input.lanes.length !== 1) {
                 await refuseOnAmbiguousBackfill((sql) => db.rows(sql), dialect, s, input.lanes);
@@ -1019,9 +1548,10 @@ const EXECUTION_PLACEMENT_SWITCH_STEPS = [
     {
         id: "⑥ add the completion marker column",
         run: async ({ db, dialect, receipts, shape }) => {
-            if ((await shape()).placementColumns.has(SWITCH_COMPLETION_COLUMN))
+            const s = await shape();
+            if (s.placementColumns.has(SWITCH_COMPLETION_COLUMN) || s.cellsOnSideTable)
                 return;
-            const marker = SESSION_META_PLACEMENT_COLUMNS.find((c) => c.name === SWITCH_COMPLETION_COLUMN);
+            const marker = EXECUTION_PLACEMENT_COLUMNS.find((c) => c.name === SWITCH_COMPLETION_COLUMN);
             await execUntil(db, `ALTER TABLE session_meta ADD COLUMN ${marker[dialect]}`, async () => (await shape()).placementColumns.has(SWITCH_COMPLETION_COLUMN));
             receipts.executionPlacementColumnsAdded += 1;
         },
@@ -1037,35 +1567,48 @@ export async function switchExecutionPlacement(db, dialect, receipts, input) {
         await step.run({ db, dialect, input, receipts, shape });
 }
 export async function backfillLocalExecutionPlacements(sessionIds, seat, input) {
-    const absent = [];
+    let backfilled = 0;
+    let ambiguous = 0;
     const unreadable = [];
     for (const root of sessionIds) {
-        const reading = await seat.read(root);
-        if (reading === undefined)
+        const out = await seat.backfill(root, input.lanes);
+        if (isUnusableArchive(out)) {
+            unreadable.push({ sessionId: root, fault: out.word, ...(out.errno !== undefined ? { errno: out.errno } : {}) });
             continue;
-        if (isUnusableArchive(reading))
-            unreadable.push({ sessionId: root, fault: reading.word, ...(reading.errno !== undefined ? { errno: reading.errno } : {}) });
-        else if (reading.cell.role === "absent")
-            absent.push({ root, occupant: reading.occupant });
-    }
-    if (absent.length === 0)
-        return { backfilled: 0, unreadable };
-    if (input.lanes.length !== 1) {
-        throw new ExecutionPlacementSwitchRefusedError("backfill_ambiguous", `the local data root holds sessions that have runs but no execution placement (${absent.length}), and the deployment declares ${input.lanes.length === 0 ? "no lane" : `${input.lanes.length} lanes (${input.lanes.join(", ")})`} — ` +
+        }
+        switch (out.outcome) {
+            case "placed":
+                backfilled += 1;
+                break;
+            case "ambiguous":
+                ambiguous += 1;
+                break;
+            case "skipped":
+                break;
+            default: {
+                const unknownOutcome = out;
+                throw new Error(`backfillLocalExecutionPlacements: no outcome ${JSON.stringify(unknownOutcome)}`);
+            }
+        }
+    }
+    if (ambiguous > 0) {
+        throw new ExecutionPlacementSwitchRefusedError("backfill_ambiguous", `the local data root holds sessions that have runs but no execution placement (${ambiguous}), and the deployment declares ${input.lanes.length === 0 ? "no lane" : `${input.lanes.length} lanes (${input.lanes.join(", ")})`} — ` +
             "with more than one lane there is no single right answer, and this server will not guess one. Nothing was changed. " +
             "Start this version once with a single declared lane (REMOTE_EXEC set to one lane), then declare the additional lanes");
     }
-    const lane = input.lanes[0];
-    let placed = 0;
-    for (const { root, occupant } of absent) {
-        if ((await seat.place(root, occupant, { role: "writer", lane })).outcome === "placed")
-            placed += 1;
-    }
-    return { backfilled: placed, unreadable };
+    return { backfilled, unreadable };
 }
+const UNKNOWN_LANE_ASKS_SHOWN = 5;
 export function backfillLocalAskExecutionLanes(store, input) {
-    return store.backfillExecutionLanes(input.lanes, (pending) => {
-        throw new ExecutionPlacementSwitchRefusedError("backfill_ambiguous", `the local approval ask journal holds asks that do not record the execution lane they were raised on (${pending}), and the deployment declares ${input.lanes.length === 0 ? "no lane" : `${input.lanes.length} lanes (${input.lanes.join(", ")})`} — ` +
+    return store.backfillExecutionLanes(input.lanes, (refusal) => {
+        if (refusal.kind === "unknown_lane") {
+            const shown = refusal.asks.slice(0, UNKNOWN_LANE_ASKS_SHOWN).map((a) => `${a.askId} = ${JSON.stringify(a.word)}${retiredExecutionLaneHintM40(a.word) === "" ? "" : " (the retired name of none)"}`);
+            const more = refusal.asks.length > shown.length ? ` and ${refusal.asks.length - shown.length} more` : "";
+            throw new ExecutionPlacementSwitchRefusedError("unknown_lane", `the local approval ask journal holds ${refusal.asks.length} asks whose recorded execution lane is not a lane this version knows (${shown.join(", ")}${more}) — ` +
+                "recording the deployment's lane over it would rewrite the lane the ask was raised on, and this server will not guess one. Nothing was changed. " +
+                "The journal was written by a newer version or altered by hand: start the version that wrote it, or restore the journal from a copy");
+        }
+        throw new ExecutionPlacementSwitchRefusedError("backfill_ambiguous", `the local approval ask journal holds asks that do not record the execution lane they were raised on (${refusal.pending}), and the deployment declares ${input.lanes.length === 0 ? "no lane" : `${input.lanes.length} lanes (${input.lanes.join(", ")})`} — ` +
             "with more than one lane there is no single right answer, and this server will not guess one. Nothing was changed. " +
             "Start this version once with a single declared lane (REMOTE_EXEC set to one lane), then declare the additional lanes");
     });
@@ -1294,55 +1837,6 @@ function renameSessionRulesColumnSql(dialect, from, to) {
     const definition = SESSION_RULES_COLUMN.mysql.slice(SESSION_RULES_COLUMN.name.length);
     return dialect === "mysql" ? `ALTER TABLE ${SESSION_POLICY_TABLE} CHANGE COLUMN ${from} ${to}${definition}` : `ALTER TABLE ${SESSION_POLICY_TABLE} RENAME COLUMN ${from} TO ${to}`;
 }
-const WORKFLOW_PARK_INDEX_TABLE = "workflow_agent_session";
-async function primaryKeyWidth(db, dialect, table) {
-    const sql = dialect === "mysql"
-        ? `SELECT COUNT(*) AS n FROM information_schema.key_column_usage WHERE table_schema = DATABASE() AND table_name = '${table}' AND constraint_name = 'PRIMARY'`
-        : `SELECT COUNT(*) AS n FROM information_schema.table_constraints tc JOIN information_schema.key_column_usage kcu ` +
-            `ON kcu.constraint_name = tc.constraint_name AND kcu.table_schema = tc.table_schema AND kcu.table_name = tc.table_name ` +
-            `WHERE tc.table_schema = current_schema() AND tc.table_name = '${table}' AND tc.constraint_type = 'PRIMARY KEY'`;
-    return Number((await db.rows(sql))[0]?.n ?? 0);
-}
-const WORKFLOW_PARK_INDEX_STAGING = `${WORKFLOW_PARK_INDEX_TABLE}_m9`;
-const WORKFLOW_PARK_INDEX_RETIRED = `${WORKFLOW_PARK_INDEX_TABLE}_m9_old`;
-async function reshapeWorkflowParkIndex(db, dialect, receipts) {
-    const T = WORKFLOW_PARK_INDEX_TABLE;
-    const S = WORKFLOW_PARK_INDEX_STAGING;
-    const O = WORKFLOW_PARK_INDEX_RETIRED;
-    const exists = (t) => tableExists(db, dialect, t);
-    const ddl = (dialect === "mysql" ? SCHEMA_STATEMENTS : PG_SCHEMA_STATEMENTS).find((stmt) => stmt.includes(`CREATE TABLE IF NOT EXISTS ${T} (`));
-    if (ddl === undefined)
-        throw new Error(`one-time migration M9: the central schema carries no definition of ${T} — refusing to reshape a table it cannot rebuild`);
-    const copyPointers = (to, from) => db.exec(dialect === "mysql"
-        ? `INSERT IGNORE INTO ${to} (session_id, run_id, agent_key, scope) SELECT session_id, run_id, agent_key, scope FROM ${from}`
-        : `INSERT INTO ${to} (session_id, run_id, agent_key, scope) SELECT session_id, run_id, agent_key, scope FROM ${from} ON CONFLICT DO NOTHING`);
-    const resumed = await exists(S);
-    if (resumed) {
-        await db.exec(ddl);
-        receipts.workflowParkIndexRowsCarried += await copyPointers(T, S);
-        await execUntil(db, `DROP TABLE ${S}`, async () => !(await exists(S)));
-    }
-    if (await exists(O))
-        await execUntil(db, `DROP TABLE ${O}`, async () => !(await exists(O)));
-    if ((await primaryKeyWidth(db, dialect, T)) !== 1) {
-        if (await exists(T))
-            await finishParkIndexShape(db, dialect);
-        receipts.workflowParkIndexKey = resumed ? "reshaped" : "current";
-        return;
-    }
-    await db.exec(ddl.replace(`CREATE TABLE IF NOT EXISTS ${T} (`, `CREATE TABLE IF NOT EXISTS ${S} (`));
-    receipts.workflowParkIndexRowsCarried += await copyPointers(S, T);
-    const swapped = async () => !(await exists(S)) && (await exists(T)) && (await primaryKeyWidth(db, dialect, T)) !== 1;
-    if (dialect === "mysql") {
-        await execUntil(db, `RENAME TABLE ${T} TO ${O}, ${S} TO ${T}`, swapped);
-        await execUntil(db, `DROP TABLE IF EXISTS ${O}`, async () => !(await exists(O)));
-    }
-    else {
-        await execAtomically(db, [`ALTER TABLE ${T} RENAME TO ${O}`, `ALTER TABLE ${S} RENAME TO ${T}`, `DROP TABLE ${O}`], async () => (await swapped()) && !(await exists(O)));
-    }
-    await finishParkIndexShape(db, dialect);
-    receipts.workflowParkIndexKey = "reshaped";
-}
 async function execAtomically(db, statements, postcondition) {
     try {
         await db.exec("BEGIN");
@@ -1362,16 +1856,6 @@ async function execAtomically(db, statements, postcondition) {
             throw e;
     }
 }
-async function finishParkIndexShape(db, dialect) {
-    await ensureIndexes(async (sql, params) => (dialect === "mysql" ? [await db.rows(sql, params)] : { rows: await db.rows(sql, params) }), dialect, CENTRAL_SCHEMA_INDEXES.filter((spec) => spec.table === WORKFLOW_PARK_INDEX_TABLE));
-    if (dialect !== "pg")
-        return;
-    const conventional = `${WORKFLOW_PARK_INDEX_TABLE}_pkey`;
-    const pk = await db.rows(`SELECT constraint_name FROM information_schema.table_constraints WHERE table_schema = current_schema() AND table_name = '${WORKFLOW_PARK_INDEX_TABLE}' AND constraint_type = 'PRIMARY KEY'`);
-    const name = pk[0]?.constraint_name;
-    if (typeof name === "string" && name !== conventional)
-        await db.exec(`ALTER TABLE ${WORKFLOW_PARK_INDEX_TABLE} RENAME CONSTRAINT ${name} TO ${conventional}`);
-}
 const RETIRED_CARD_WORD_PATTERNS = ['%"shadowed"%', '%"governance_unavailable"%'];
 const RETIRED_CARD_WORD_BATCH = 500;
 function decodeForM18(text, where) {
@@ -1421,8 +1905,8 @@ async function migrateRetiredCardWords(db, dialect, receipts) {
             return;
     }
 }
-const M21_GATE = { key: "gate", as: "m21_gate" };
-const M21_PENDING_ACTION = { key: "pendingAction", as: "m21_pending_action" };
+const M21_GATE = { path: ["gate"], as: "m21_gate" };
+const M21_PENDING_ACTION = { path: ["pendingAction"], as: "m21_pending_action" };
 const PARKED_ROW_REPAIR_PAGE = 200;
 const QUESTION_CARD = "question";
 const readM21Subtree = createObjectColumnReader();
@@ -1621,11 +2105,6 @@ export async function inheritPlacedSessionOwners(db, dialect, receipts) {
 }
 function readingFields(r) {
     return {
-        ...(r.workflowParkIndexKey !== undefined ? { workflowParkIndexKey: r.workflowParkIndexKey } : {}),
-        workflowParkIndexRowsCarried: r.workflowParkIndexRowsCarried,
-        undurableScopeRuleRowsRemoved: r.undurableScopeRuleRows.length,
-        undurableScopeRuleBucketsDeferred: r.undurableScopeRuleBucketsDeferred,
-        undurableScopeRuleBucketsUnreadable: r.undurableScopeRuleBucketsUnreadable.length,
         ...(r.sessionRuleColumn !== undefined ? { sessionRuleColumn: r.sessionRuleColumn } : {}),
         sessionRuleRowsWithRetiredBuckets: r.sessionRuleRowsWithRetiredBuckets.length,
         sessionRuleRowsWithOldGrammarEntries: r.sessionRuleRowsWithOldGrammarEntries.length,
@@ -1653,17 +2132,31 @@ function readingFields(r) {
         deviceBindingTablesDropped: r.deviceBindingTablesDropped,
         executionPlacementsBackfilled: r.executionPlacementsBackfilled,
         askExecutionLanesBackfilled: r.askExecutionLanesBackfilled,
+        executionLaneWordsRenamed: r.executionLaneWordsRenamed,
+        sessionExtRowsMoved: r.sessionExtRowsMoved,
+        sessionMetaColumnsDropped: r.sessionMetaColumnsDropped,
+        scenarioPrefixSourcesScanned: r.scenarioPrefixSourcesScanned,
+        withdrawMarkWritten: r.withdrawMarkWritten,
+        sessionDeletingSwitchMarked: r.sessionDeletingSwitchMarked,
+        runErrorCodeColumnRewritten: r.runErrorCodeColumnRewritten,
+        runObjectivePreviewRewritten: r.runObjectivePreviewRewritten,
+        shellSentinelOwnersCleared: r.shellSentinelOwnersCleared,
+        checkpointHostSessionsBackfilled: r.checkpointHostSessionsBackfilled,
+        legacySkillExemptionsDropped: r.legacySkillExemptionsDropped,
         executionPlacementSessionsUnreadable: r.executionPlacementSessionsUnreadable.length,
         localArchiveRowFactsBackfilled: r.localArchiveRowFactsBackfilled,
         localArchivesAnonymized: r.localArchivesAnonymized,
         localArchivesKeptStamped: r.localArchivesKeptStamped.length,
         localArchivesUnreadable: r.localArchivesUnreadable.length,
         localArchiveSnapshotsRecovered: r.localArchiveSnapshotsRecovered,
+        localArchiveTokensAdopted: r.localArchiveTokensAdopted,
+        localArchiveTokensMinted: r.localArchiveTokensMinted,
         askCauseColumnsChanged: r.askCauseColumnsChanged,
         askParkTriggersMoved: r.askParkTriggersMoved,
         askJournalRecordsUpgraded: r.askJournalRecordsUpgraded,
         importedLayerRootAllowsRetired: r.importedLayerRootAllowsRetired.length,
         importedLayerRootBucketsSkipped: r.importedLayerRootBucketsSkipped.length,
+        importedLayerRootBucketsUnnamed: r.importedLayerRootBucketsUnnamed,
     };
 }
 export function logOneTimeMigrations(log, backend, report) {
@@ -1671,12 +2164,7 @@ export function logOneTimeMigrations(log, backend, report) {
         backend,
         ...readingFields(report),
         removableAfter: Object.fromEntries(ONE_TIME_MIGRATIONS.map((w) => [w.id, w.removableAfter])),
-        note: "one-time persisted-data migrations (M9: the workflow park pointer index rebuilt with the key (session, run), " +
-            "its rows carried over; M10 writes nothing at boot — on the local backend, while its window is open, the first task submitted with a principal " +
-            "on a session written by an earlier version (which recorded no owner) claims that session for the principal, one session_owner_claimed line per claim; " +
-            "M11: persisted permission rules whose project scope root is not a complete absolute path — accepted by earlier versions, dropped on every read " +
-            "by the current engine and not removable through DELETE /v1/rules — removed, one permission_rule_row_removed line per row; a bucket the read path " +
-            "refuses in whole is left untouched, one permission_rule_bucket_unreadable line per bucket; M17: the session-rules column renamed from `rules` to " +
+        note: "one-time persisted-data migrations (M17: the session-rules column renamed from `rules` to " +
             "`rule_entries`, so a build that reads rules under the earlier name-only grammar finds no column to misread; at that rename every row's rule entries " +
             "are read by the engine in the grammar the row carries (none = the grammar before the stamp) and rewritten as the same statement in the current grammar " +
             "(the column carries the in-progress name rule_entries_old_grammar until every row is rewritten, so an interrupted boot resumes there) — toolAllow entries " +
@@ -1721,7 +2209,10 @@ export function logOneTimeMigrations(log, backend, report) {
             "M36: allow approvals that an import before engine 7.61.0 stored as global rules from a settings file's user-layer path written from `/` — which the user layer reads at its " +
             "configuration directory and a global rule reads at every task's project root — retired by tombstones naming exactly those approvals (a rule that also holds an approval a person " +
             "gave directly stays in effect; deny and ask rules are never retired), one imported_layer_root_allow_retired line per rule; a bucket that could not be read or written, or that another replica deleted while it was being written, is named by an " +
-            "imported_layer_root_bucket_skipped line on every boot). Each step " +
+            "imported_layer_root_bucket_skipped line on every boot; " +
+            "M40: the stored execution lane word in-process — the name earlier versions gave the lane with no execution environment, which this version calls none and does not read — " +
+            "rewritten as none on approval ask rows and session rows (on the local backend: in the session metadata file and the approval ask journal); a boot that finds such rows while " +
+            "runs on the same database still heartbeat refuses with nothing changed, because a replica of an earlier version is still serving and would keep writing the old word). Each step " +
             "runs on every boot until its window closes (the release that introduced it + 30 days; the per-step date is in " +
             "removableAfter, null while that release is not published yet) and is deleted in the first minor after that — start a " +
             "version that still carries a step at least once before upgrading past its deletion.",
@@ -1751,6 +2242,15 @@ function logReceiptRows(log, backend, r) {
                 "(the next boot then migrates it) or the session is deleted. Named on every boot until then",
         });
     }
+    if (r.legacySkillExemptionsDropped > 0) {
+        log.warn("legacy_skill_exemptions_dropped", {
+            backend,
+            count: r.legacySkillExemptionsDropped,
+            note: "session approval-exemption rows for the engine's Skill tool that were written before this boot's first run of this step (by 7.116.0 or earlier for an activation card or a deployment-list question that named Skill, " +
+                "or by a later version for a call that granted nothing) were deleted: a stored row for a tool by that name would answer a call by that name — and when no skill is loaded a call by that name is another tool, not the activation the person approved. " +
+                "The people in those sessions are asked once more on their next Skill call. Rows written after this step first ran are never touched",
+        });
+    }
     if (r.deviceBindingsOrphaned > 0) {
         log.warn("device_bindings_orphaned", {
             backend,
@@ -1813,17 +2313,6 @@ function logReceiptRows(log, backend, r) {
                 "in the session store by hand if someone should read one, or leave them to the transcript retention",
         });
     }
-    for (const row of r.undurableScopeRuleRows) {
-        log.warn("permission_rule_row_removed", {
-            backend,
-            ownerKey: row.ownerKey,
-            kind: row.kind,
-            behavior: row.behavior,
-            tool: row.tool,
-            scopeRoot: row.scopeRoot,
-            note: removedRuleRowNote(row.kind),
-        });
-    }
     for (const row of r.importedLayerRootAllowsRetired) {
         log.warn("imported_layer_root_allow_retired", {
             backend,
@@ -1841,14 +2330,14 @@ function logReceiptRows(log, backend, r) {
     for (const bucket of r.importedLayerRootBucketsSkipped) {
         log.warn("imported_layer_root_bucket_skipped", { backend, ownerKey: bucket.ownerKey, reason: bucket.reason, why: bucket.why, note: importedLayerRootSkipNote(bucket.reason) });
     }
-    for (const bucket of r.undurableScopeRuleBucketsUnreadable) {
-        log.warn("permission_rule_bucket_unreadable", {
+    if (r.importedLayerRootBucketsUnnamed > 0) {
+        log.warn("imported_layer_root_buckets_unnamed", {
             backend,
-            ownerKey: bucket.ownerKey,
-            why: bucket.why,
-            note: "a persisted permission-rule bucket that the read path refuses in whole was left untouched by the one-time removal of rows whose project scope root " +
-                "is not a complete absolute path (removing rows from a bucket the read path refuses would turn that refusal into a readable bucket): every read of it " +
-                "keeps being refused, as before this release, until someone repairs or deletes that row by hand",
+            count: r.importedLayerRootBucketsUnnamed,
+            note: "this many permission-rule bucket files are present in the rules directory but neither the directory (the local owner's bucket, the identities its adoption marker names) " +
+                "nor this store's import records name their owner (a bucket file is named by a one-way digest of its owner), so the one-time retirement of imported allow rules written from `/` " +
+                "did not read them: any such rule in them stays in effect. This is a gap in the census, not a statement that they are empty. Each boot reports it again; " +
+                "list the rules of every owner you know (`GET /v1/rules`) and remove what should not stand",
         });
     }
     for (const row of r.sessionRuleRowsWithOldGrammarEntries) {
@@ -1901,7 +2390,7 @@ function logOneTimeMigrationsInterrupted(log, backend, error) {
         ...readingFields(error.receipts),
         note: "the one-time migrations failed after committing changes: the readings on this line and the lines that follow are what this boot already committed — a retried " +
             "boot finds that work done and does not report it again, so these lines are the only record of them, written once by this boot — save them. The failure itself follows " +
-            "as this boot's refusal. A shape reading absent from this line (workflowParkIndexKey / sessionRuleColumn / workflowJournalScopeColumn) belongs to a step that did not " +
+            "as this boot's refusal. A shape reading absent from this line (sessionRuleColumn / workflowJournalScopeColumn) belongs to a step that did not " +
             "finish; sessionRuleColumn absent after session_rule_row_old_grammar_entries lines means the column still carries its in-progress name — the next boot rewrites the " +
             "remaining rows (rows already rewritten are left alone) and publishes the final name",
     });
@@ -1936,18 +2425,4 @@ function importedLayerRootSkipNote(reason) {
         }
     }
 }
-function removedRuleRowNote(kind) {
-    switch (kind) {
-        case "rule":
-            return "a persisted permission rule whose project scope root is not a complete absolute path was removed by a one-time migration: the current engine drops such a row on every read (it protected nothing) and refuses any write naming that scope, so it could not be revoked through DELETE /v1/rules; re-add it with the project's full path if it is still wanted";
-        case "revoked-rule":
-            return "a persisted permission rule row whose project scope root is not a complete absolute path, and which had no live approval left (every approval behind it was already removed, or it never had one), was removed by a one-time migration: the row took effect nowhere before and takes effect nowhere now — no action needed";
-        case "tombstone":
-            return "a revocation record (tombstone) whose project scope root is not a complete absolute path was removed by a one-time migration: it can only cover rules with that same scope, which were removed with it or were never there, so nothing it revoked comes back — no action needed";
-        default: {
-            const unknown = kind;
-            throw new Error(`M11: no log sentence for removed-row kind ${JSON.stringify(unknown)}`);
-        }
-    }
-}
 //# sourceMappingURL=one-time-migrations.js.map