@sema-agent/server 7.147.0 → 7.148.0

package/dist/plugins/one-time-migrations.js

@@ -7,7 +7,12 @@ import { PG_SCHEMA_STATEMENTS, acquirePgEnsureSchemaLock, releasePgEnsureSchemaL
 import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readOpaqueJsonValueColumn, } from "./sql-json-column.js";
 import { incarnationFromCell, sessionFaceFromRow } from "../session-incarnation.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
-import { PERMISSION_RULE_TABLE, SqlDurableRulePartitionProvider, isSqlBucketRefusal, isSqlBucketVanished, listRuleBucketOwners, purgeUndurableScopeRows } from "./permission-rule-store-sql.js";
+import { decodeRunResultCellM44 } from "./run-store-sql.js";
+import { persistedPlaneOf } from "../terminal.js";
+import { RUN_PREVIEW_COARSE_PREFIXES_M45, normalizedRunPreviewM45 } from "./run-preview-m45.js";
+import { SHELL_SENTINEL_OWNER_M48, SHELL_SENTINEL_OWNER_TABLES_M48 } from "./shell-sentinel-owner-m48.js";
+import { LEGACY_SKILL_EXEMPTION_MARKER_ID, LEGACY_SKILL_EXEMPTION_PAGE, LEGACY_SKILL_EXEMPTION_TOOL_NAME } from "./approval-exemption-skill-m46.js";
+import { PERMISSION_RULE_TABLE, SqlDurableRulePartitionProvider, isSqlBucketRefusal, isSqlBucketVanished, listRuleBucketOwners } from "./permission-rule-store-sql.js";
 import { SESSION_RULES_COLUMN } from "./session-rules-column.js";
 import { readJsonObjectColumn } from "./sql-json-column.js";
 import { retireStoredCardWords } from "../retired-card-words.js";
@@ -15,17 +20,18 @@ import { redactSecrets } from "../trace/redact.js";
 import { CLAIM_OWNERLESS_PLACED_SQL, claimOwnerlessParams, isOrphanSessionOwner, judgeDelegatedOwner } from "../delegated-session-owner.js";
 import { MAILBOX_KEYED_TABLES, mailboxKeyDeleteSql, storedMailboxKeyless } from "../stores-sql/mailbox-store-sql.js";
 import { backfillWriterStatement, countOrphanBindingsStatement, migrateDeviceBindingsOntoSideTableStatements, migrateDeviceBindingsStatement } from "./execution-placement-sql.js";
-import { EXECUTION_PLACEMENT_COLUMNS, SESSION_EXT_COLUMNS, SESSION_EXT_TABLE } from "./session-ext-table.js";
+import { WITHDRAW_MARK_ID } from "./session-withdraw-sql.js";
+import { EXECUTION_PLACEMENT_COLUMNS, SESSION_EXT_MOVED_COLUMNS, SESSION_EXT_TABLE } from "./session-ext-table.js";
 import { APPROVAL_ASK_ENDING_CAUSE_COLUMN, APPROVAL_ASK_EXECUTION_LANE_COLUMN, APPROVAL_ASK_PARK_TRIGGER_COLUMN, APPROVAL_ASK_TABLE } from "./approval-ask-store-sql.js";
 import { RENAMED_EXECUTION_LANE_M40, RETIRED_EXECUTION_LANE_WORD_M40, retiredExecutionLaneHintM40 } from "./execution-lane-rename-m40.js";
 import { retireImportedLayerRootAllows } from "./imported-layer-root-retirement.js";
 import { isUnusableArchive } from "../execution-placement.js";
+import { IDENTITY_COLUMN_NAME, SCENARIO_PREFIX_LIKE, SCENARIO_PREFIX_MARKER_ID, ScenarioPrefixSwitchRefusedError } from "./scenario-prefix-switch-m42.js";
+import { MIGRATION_MARKER_TABLE, migrationMarkerDdl } from "./one-time-migration-marker.js";
+import { expectedTableShapes } from "./schema-consistency.js";
 const RETIRED_SESSION_RULE_BUCKETS = ["commandAllow", "commandDeny"];
 export function buildMigrationReceipts() {
     return {
-        undurableScopeRuleRows: [],
-        undurableScopeRuleBucketsDeferred: 0,
-        undurableScopeRuleBucketsUnreadable: [],
         sessionRuleRowsWithRetiredBuckets: [],
         sessionRuleRowsWithOldGrammarEntries: [],
         sessionRuleRowsWithUnreadableDeny: [],
@@ -54,12 +60,22 @@ export function buildMigrationReceipts() {
         executionLaneWordsRenamed: 0,
         sessionExtRowsMoved: 0,
         sessionMetaColumnsDropped: 0,
+        scenarioPrefixSourcesScanned: 0,
+        withdrawMarkWritten: 0,
+        sessionDeletingSwitchMarked: 0,
+        runErrorCodeColumnRewritten: 0,
+        runObjectivePreviewRewritten: 0,
+        shellSentinelOwnersCleared: 0,
+        checkpointHostSessionsBackfilled: 0,
+        legacySkillExemptionsDropped: 0,
         executionPlacementSessionsUnreadable: [],
         localArchiveRowFactsBackfilled: 0,
         localArchivesAnonymized: 0,
         localArchivesKeptStamped: [],
         localArchivesUnreadable: [],
         localArchiveSnapshotsRecovered: 0,
+        localArchiveTokensAdopted: 0,
+        localArchiveTokensMinted: 0,
         askCauseColumnsChanged: 0,
         askParkTriggersMoved: 0,
         askJournalRecordsUpgraded: 0,
@@ -76,10 +92,7 @@ function completedReport(r) {
     return { ...r, sessionRuleColumn, workflowJournalScopeColumn };
 }
 function changedAnything(r) {
-    return (r.undurableScopeRuleRows.length > 0 ||
-        r.undurableScopeRuleBucketsDeferred > 0 ||
-        r.undurableScopeRuleBucketsUnreadable.length > 0 ||
-        r.sessionRuleColumn === "renamed" ||
+    return (r.sessionRuleColumn === "renamed" ||
         r.sessionRuleRowsWithRetiredBuckets.length > 0 ||
         r.sessionRuleRowsWithOldGrammarEntries.length > 0 ||
         r.sessionRuleRowsWithUnreadableDeny.length > 0 ||
@@ -109,12 +122,21 @@ function changedAnything(r) {
         r.executionLaneWordsRenamed > 0 ||
         r.sessionExtRowsMoved > 0 ||
         r.sessionMetaColumnsDropped > 0 ||
+        r.withdrawMarkWritten > 0 ||
+        r.sessionDeletingSwitchMarked > 0 ||
+        r.runErrorCodeColumnRewritten > 0 ||
+        r.runObjectivePreviewRewritten > 0 ||
+        r.shellSentinelOwnersCleared > 0 ||
+        r.checkpointHostSessionsBackfilled > 0 ||
+        r.legacySkillExemptionsDropped > 0 ||
         r.executionPlacementSessionsUnreadable.length > 0 ||
         r.localArchiveRowFactsBackfilled > 0 ||
         r.localArchivesAnonymized > 0 ||
         r.localArchivesKeptStamped.length > 0 ||
         r.localArchivesUnreadable.length > 0 ||
         r.localArchiveSnapshotsRecovered > 0 ||
+        r.localArchiveTokensAdopted > 0 ||
+        r.localArchiveTokensMinted > 0 ||
         r.askCauseColumnsChanged > 0 ||
         r.askParkTriggersMoved > 0 ||
         r.askJournalRecordsUpgraded > 0 ||
@@ -125,8 +147,6 @@ function changedAnything(r) {
 function readingsSnapshot(r) {
     return {
         ...r,
-        undurableScopeRuleRows: [...r.undurableScopeRuleRows],
-        undurableScopeRuleBucketsUnreadable: [...r.undurableScopeRuleBucketsUnreadable],
         sessionRuleRowsWithRetiredBuckets: [...r.sessionRuleRowsWithRetiredBuckets],
         sessionRuleRowsWithOldGrammarEntries: [...r.sessionRuleRowsWithOldGrammarEntries],
         sessionRuleRowsWithUnreadableDeny: [...r.sessionRuleRowsWithUnreadableDeny],
@@ -144,7 +164,6 @@ function receiptSentence(r) {
         .filter(([, v]) => (typeof v === "number" ? v > 0 : v !== undefined))
         .map(([k, v]) => `${k}=${String(v)}`);
     const rows = [
-        ...r.undurableScopeRuleRows.map((x) => `removed ${x.kind} in permission-rule bucket ${x.ownerKey} (${x.behavior} ${x.tool}, scope root ${JSON.stringify(x.scopeRoot)})`),
         ...r.sessionRuleRowsWithOldGrammarEntries.map((x) => `${x.policyKey} (session ${x.sessionId}): toolAllowDropped=${JSON.stringify(x.toolAllowDropped)}`),
         ...r.sessionRuleRowsWithUnreadableDeny.map((x) => `${x.policyKey} (session ${x.sessionId}): left as stored, toolDenyUnreadable=${JSON.stringify(x.toolDenyUnreadable)}${x.retiredBuckets !== undefined ? `, retiredBuckets=${JSON.stringify(x.retiredBuckets)}` : ""}`),
         ...r.importedLayerRootAllowsRetired.map((x) => `retired ${x.addsRetired} imported add(s) of an allow ${x.tool} rule in permission-rule bucket ${x.ownerKey} (${x.stillLive ? "the rule stays in effect through another approval" : "the rule no longer takes effect"})`),
@@ -162,35 +181,6 @@ export class OneTimeMigrationInterruptedError extends Error {
     }
 }
 export const ONE_TIME_MIGRATIONS = [
-    {
-        id: "M10",
-        introducedIn: "7.119.0",
-        releasedOn: "2026-10-08",
-        removableAfter: "2026-11-07",
-        removal: "删 local 车道的认领臂:`LocalSessionStore.register` 里「属主从没被记下的存量会话 ⇒ 带 principal 的登记认领它」那一支、认领日志行 `session_owner_claimed`" +
-            "(连同店构造参数里只为它存在的 `log` 位)与读本表 M10 行的 `ownerClaimWindowOpen`;`security.ts` `createAuthorizer` 里对无主会话的那次认领 `register` 调用;" +
-            "`http/routes/sessions.ts` 409 `conflict.session_ownerless` 句里「Ways out: on the local backend, during the upgrade window …」那半句(连同冻结表 " +
-            "`test/api-error-text-freeze.test.ts` 那一行、契约码目录 `docs/ASSISTANT-WIRE-CONTRACT.md` 那一行);本文件的 `migrationWindowOpen`(若再无别的读者)",
-        afterRemoval: "没有响亮臂(删码本身零行为变化:窗关那一刻起认领臂已经不生效):属主从没被记下的存量会话(边档那一格只有化身 —— 跳过了带本条的版本直接升," +
-            "或窗内从没被带 principal 提交过)照旧答无主(`headOf(id)?.owner` = null):它的会话规则这条路由读不了也改不了(409 `conflict.session_ownerless`)," +
-            "已存的规则对写下它们的 principal 的 run 照旧生效;出路 = 删会话(`DELETE /v1/sessions/:id`,规则随之删)",
-        reportKeys: [],
-    },
-    {
-        id: "M11",
-        introducedIn: "7.120.0",
-        releasedOn: "2026-10-08",
-        removableAfter: "2026-11-07",
-        removal: "删 migrateOn 的 M11 步(`permission_rule` 在场探针 + `purgeUndurableScopeRows` 调用)与 `permission-rule-store-sql.ts` 的 `purgeUndurableScopeRows` / " +
-            "`purgeOneBucket` / `contentFreeRefusal` / `UndurableScopeRuleRow` / `UnreadableRuleBucket` / `UndurableScopePurgeReadings` / " +
-            "`UndurableScopePurgeDb` / `UNDURABLE_PURGE_PAGE` / `UNDURABLE_PURGE_OCC_ATTEMPTS`、本文件的 `removedRuleRowNote`,以及 `BucketRefusedError` 的 `verdict` 位(若届时再无别的读者;" +
-            "判官 `decodeBucketRow` 与写法 `writeBucket` 是读腿 / 写臂本身,留);报告、日志行(含逐行的 `permission_rule_row_removed` 与逐桶的 " +
-            "`permission_rule_bucket_unreadable`)与 `NO_SQL_MIGRATIONS` 的 `undurableScopeRuleRows` / `undurableScopeRuleBucketsDeferred` / `undurableScopeRuleBucketsUnreadable`",
-        afterRemoval: "引擎读侧的既有响亮臂:scope root 不是完整绝对路径的存量行(跳过了带本条的版本直接升的库,或窗关之后别的写者写进来的)在有效视图里被丢、" +
-            "每次 run 一条 `permission.rule_row_dropped`(点名规则与 root)—— 那一行不参与任何检查,但撤销口删不动它(引擎的写臂对这种 scope 同样拒);" +
-            "出路 = 运维在库里把那只桶的那一行删掉(整桶 OCC 回写,指纹按 `buildRuleBucketChecksum` 重算)",
-        reportKeys: ["undurableScopeRuleRows", "undurableScopeRuleBucketsDeferred", "undurableScopeRuleBucketsUnreadable"],
-    },
     {
         id: "M12",
         introducedIn: "7.122.0",
@@ -313,7 +303,7 @@ export const ONE_TIME_MIGRATIONS = [
         removal: "删 `src/stored-request-hooks-m20.ts` 整只文件(`storedHooksRereadM20` / `rereadStoredHooksM20` / `StoredHooksRereadM20` / `MATCHER_FIELD_NAMES` / `nodeAt` / `cloneDoc` / `removeKeyAt`);" +
             "`boot/resolve-spec.ts` 里递给 `parseTaskSettings` 的重读座实参(`opts?.leg === \"fresh\" || !taskHooksHonored(config) ? {} : { storedHooksReread: storedHooksRereadM20(…) }`)与它的 import、" +
             "`hooks_read_as_before_upgrade` 那一段 warn;`task-settings.ts` 的 `ParseTaskSettingsSeats` / `ParseTaskSettingsResult.hooksReread` / `parseTaskSettings` 第二形参与 hooks 臂里的重读那一支;" +
-            "`hooks/hook-runner.ts` 的 `ParseHooksConfigResult.pieces` / `HooksRefusalPiece`(若再无别的读者)与 `hooksCoordinate` 的 export;" +
+            "`hooks/hook-runner.ts` 的 `ParseHooksConfigResult.pieces` / `HooksRefusalPiece`(若再无别的读者);" +
             "「请求成员读不出」一问上的重读座走线:`unread-request-members.ts` 的 `storedHooksRereadM20` import 与 `unreadRequestMembers` 里 `hooksReread` 那一行(递给 `parseTaskSettings` 的 `storedHooksReread` 座)、" +
             "`UnreadMembersLeg` 续跑臂的 `today` 字段(只为 M20 的窗问它)与 `http/stored-body-replay.ts`、`boot/resolve-spec.ts` 递 `today` 的那两处(`stored-body-replay.ts` 的 `today` 局部若 M19 已删再无读者一并删);" +
             "`test/hooks-stored-reread-m20.test.ts`(窗关那一格 —— 续跑拒 409 `resume_blocked_by_policy` —— 改钉到 `test/hooks-entry-admission.test.ts` 的续跑腿组)",
@@ -499,8 +489,9 @@ export const ONE_TIME_MIGRATIONS = [
             "`runSqlOneTimeMigrations` 的第三参 `ExecutionPlacementSwitchInput`(若再无别的条目用它)与它在两只 SQL 后端 / 测试夹具上的实参;local 腿(`LocalBackend.runOneTimeMigrations` 里的 `backfillLocalExecutionPlacements` 与 `FileRunStore.sessionIdsWithRuns`);" +
             "`execution-placement-sql.ts` 的 `backfillWriterStatement` / `migrateDeviceBindingsStatement` / `migrateDeviceBindingsOntoSideTableStatements` / `countOrphanBindingsStatement`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 `executionPlacementColumnsAdded` / `deviceBindingsMoved` / " +
             "`deviceBindingsOrphaned` / `deviceBindingTablesDropped` / `executionPlacementsBackfilled` / `executionPlacementSessionsUnreadable` 与 `device_bindings_orphaned` / `execution_placement_session_unreadable` 两行 warn;`test/execution-placement-switch-db-integration.test.ts` 整份与 `test/one-time-migrations.test.ts` 的 M32 组。" +
-            "**local 腿的回填席与它的点名词一并删**:`LocalSessionStore` 的 `executionPlacementBackfill`(属性与构造里的那一臂)、`execution-placement.ts` 的 `LocalPlacementBackfillSeat` / `UnusableArchive` / `UnusableArchiveWord`(含它的 `storage` 词 —— 读存档文件时抛了别的故障、`errno` 随带,该词只有回填点名用)/ `isUnusableArchive`、" +
-            "`ExecutionPlacementSessionUnreadable`;`local-session-store.ts` 里 `placementRead` 并回 `readExecutionPlacement`、`metaRead` 的 unusable 臂与 `forkingOf` 的 `storage` 臂改成就地上抛 `probe.fault`(`archiveFaultWord` / `unusableArchiveOf` 随词删,探针只留「不在」与已知在而用不了的读法);" +
+            "**local 腿的回填席与它的点名词一并删**:`LocalSessionStore` 的 `executionPlacementBackfill`(属性与构造里的那一臂)与它唯一的成员 `backfillPlacement`、`unusableArchiveOfFault`、" +
+            "`execution-placement.ts` 的 `LocalPlacementBackfillSeat` / `LocalPlacementBackfillOutcome` / `UnusableArchive` / `UnusableArchiveWord`(含它的 `storage` 词 —— 读存档文件时抛了别的故障、`errno` 随带,该词只有回填点名用)/ `isUnusableArchive`、" +
+            "`ExecutionPlacementSessionUnreadable`(会话店的观察与存档探针不随删:它们不带这几只型,说不出在不在就原样抛);" +
             "`test/execution-placement-switch-local.test.ts` 与 `test/execution-placement-local-boot-unreadable-e2e.test.ts` 整份。" +
             "**不随本条删**:执行放置八列、会话店的执行席、设备店的首绑 / 换绑两只写(常设的数据形)",
         afterRemoval: "起服对账一族的跳版库拒启臂接住:删码同版把 `device_session` / `device_session_retired` 两张表加进退役 schema 判据(`schema-consistency.ts` 的跳版库探针,先于建表)⇒ " +
@@ -513,13 +504,14 @@ export const ONE_TIME_MIGRATIONS = [
         releasedOn: "2026-10-30",
         removableAfter: "2026-11-29",
         removal: "删 `LocalSessionStore.migrateLocalArchives` 与它的私有助手 `anonymizeArchiveHeld` / `fillRowFacts`、`settleArchiveSnapshots` 里除最后一句常设臂 `assertNoArchiveSnapshots(dir)` 以外的一切(逐份消化的循环与 `settleArchiveSnapshot`)、" +
-            "`archiveSnapshotsSettled` 字段、`syncArchiveDirectory`、`rowFactsFilled` / `ArchivedRowFacts` / `archivedRowFactsOf` / `ARCHIVE_SNAPSHOT_RECORD` / `ArchiveSnapshotRecord` / `readArchiveSnapshotRecord` / `sameLog` / " +
+            "`archiveSnapshotsSettled` 字段、`rowFactsFilled` / `ARCHIVE_SNAPSHOT_RECORD` / `ArchiveSnapshotRecord` / `readArchiveSnapshotRecord` / `sameLog` / " +
+            "`ArchivedRowFacts` / `archivedRowFactsOf`(M47 仍在树时留着,随 M47 删)/ " +
             "`ArchiveRewriteStep` / `LocalArchiveMigrationReading` / `errnoOf`、" +
-            "`archiveRewriteReadScope` / `noteReplayInArchiveRewriteRead` 与 `createLocalSessionRepo` 座里调它的那一腿、`SidecarMap.syncToDisk`(若再无别的调用方)与 `fsyncPaths`(同);" +
+            "`archiveRewriteReadScope` / `noteReplayInArchiveRewriteRead` 与 `createLocalSessionRepo` 座里调它的那一腿、`SidecarMap.syncToDisk`(若再无别的调用方);" +
             "`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里对 `migrateLocalArchives` 的调用与报告五键的那五行;本文件的 `LocalArchiveKeptReason` / `LocalArchiveKeptStamped` / `LocalArchiveUnreadable`、" +
             "报告 / 收据 / `changedAnything` / `readingsSnapshot` / `readingFields` 里的 `localArchiveRowFactsBackfilled` / `localArchivesAnonymized` / `localArchivesKeptStamped` / `localArchivesUnreadable` / `localArchiveSnapshotsRecovered`、" +
             "`local_archive_kept_stamped` / `local_archive_unreadable` 两行 warn、读数行 note 里的 M33 句与头注 M33 段;`test/local-archive-owner.test.ts` 里标题含 `P3` / `P4` / `P5` / `P6` / `F1` / `F2` / `F3` 的格与 `legacyRoot` / `writeArchive` / `boot` / `M33_ZERO` / `m33Of` 助手。" +
-            "**不随本条删**:行格的 `createdAt` / `forkedFrom` 两键(常设的数据形)、`LocalArchiveSnapshotsPresentError` / `assertNoArchiveSnapshots` / `LOCAL_ARCHIVE_SNAPSHOT_DIR` 与 `LocalBackend.ensureSchema` 里调它的那一句、" +
+            "**不随本条删**:行格的 `createdAt` / `forkedFrom` 两键(常设的数据形)、存档目录屏障 `syncArchiveDirectory` 与 `fsyncPaths`(会话删序的常设一步)、`LocalArchiveSnapshotsPresentError` / `assertNoArchiveSnapshots` / `LOCAL_ARCHIVE_SNAPSHOT_DIR` 与 `LocalBackend.ensureSchema` 里调它的那一句、" +
             "`session-error-wire.ts` 的 `StampedSessionArchiveError` / `STAMPED_SESSION_ARCHIVE_SENTENCE` / `sessionErrorWireOf` 与本店带戳判的唯一读口 `assertArchiveAnonymous`(fork 的源、改日志推送的落点、会话同步导入第一阶段的早拒三处问它)、行上缺建档时刻的 F 类读法(`server.local-session-row.created-at-absent`)",
         afterRemoval: "三只常设臂接住:① 数据根下的快照目录非空 ⇒ 拒启(`config.local_archive_snapshot_present`,点名文件与两条出路);② 跳过了带本条的版本直接升的数据根(或本条留着的存档),带属主戳的存档被 fork、改日志的推送与会话同步导入第一阶段对 fork / stale 的早拒同一只具名拒(409 `conflict.session_archive_stamped` + 固定句,零写 / 行格净零写)," +
             "读 / 续跑 / 拉取照常 —— 出路 = 删掉会话后重推,或升级时先过一次带本条的版本并在窗内起服;③ 行上没有建档时刻的格(同一类数据根)⇒ 列表 / 会话视图 / 交出的元数据读纪元(F 类 tag 计数)",
@@ -614,7 +606,7 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.147.0",
         releasedOn: "2026-11-07",
         removableAfter: "2026-12-07",
-        removal: "删 `src/plugins/execution-lane-rename-m40.ts` 整只文件;本文件的 M40 步(`renameRetiredExecutionLaneWordsM40` / `refuseWhileRunsHeartbeat`〔它读的 `readLiveRunHeartbeat` / `LiveRunHeartbeat` 由 M41 共读,M41 也已删码时随之删〕/ `ExecutionLaneRenameRefusedError` / " +
+        removal: "删 `src/plugins/execution-lane-rename-m40.ts` 整只文件;本文件的 M40 步(`renameRetiredExecutionLaneWordsM40` / `refuseWhileRunsHeartbeat`〔它读的 `readLiveRunHeartbeat` / `LiveRunHeartbeat` 由 M41 / M42 共读,两条也已删码时随之删〕/ `ExecutionLaneRenameRefusedError` / " +
             "`EXECUTION_LANE_RENAME_REFUSED_CODE` / `ExecutionLaneRenameInput`,`migrateStepsOn` 第一步那一行与 `SqlOneTimeMigrationInput` 里的那一半)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `executionLaneWordsRenamed`、头注 M40 段;" +
             "`store-backend.ts` 的 `LocalBackend.ensureSchema` 第一步与 `executionLaneWordsRenamed` 字段、两只 SQL 后端递 `liveRunWindowMs` 的那一半;" +
             "`LocalSessionStore.renameRetiredExecutionLaneWordM40`、`FileApprovalAskStore.renameRetiredExecutionLaneWordM40` 与内核的 `renameExecutionLaneWord`;" +
@@ -631,10 +623,138 @@ export const ONE_TIME_MIGRATIONS = [
         removal: "删本文件的 M41 步(`moveSessionCellsToSideTable` / `refuseSessionExtMoveWhileRunsHeartbeat` / `deploymentColumnsOnMeta` / `SessionExtMoveRefusedError` / `SESSION_EXT_MOVE_REFUSED_CODE` / " +
             "`SessionExtMoveRefusalReason` / `sameCell` / `SESSION_EXT_MOVE_PAGE`,`migrateStepsOn` 里那两行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `sessionExtRowsMoved` / `sessionMetaColumnsDropped`、头注 M41 段;" +
             "M32 读形里的 `cellsOnSideTable` 判(它读本条的 `deploymentColumnsOnMeta`):M32 还在时改成恒旁表形 —— 删 M32 写 `session_meta` 八列的那些臂(② ④ ④b ⑥ 与 ③ 的 `migrateDeviceBindingsStatement` 臂)," +
-            "留 ③ 的旁表臂(`migrateDeviceBindingsOntoSideTableStatements`:围栏拒句的「采旧」在任何库上仍要能落到执行格);M32 先于本条删码时这些随 M32 一并删;`readLiveRunHeartbeat` 在 M40 也已删码时随之删;`test/session-ext-move-db-integration.test.ts` 整只文件",
+            "留 ③ 的旁表臂(`migrateDeviceBindingsOntoSideTableStatements`:围栏拒句的「采旧」在任何库上仍要能落到执行格);M32 先于本条删码时这些随 M32 一并删;`readLiveRunHeartbeat` 在 M40 与 M42 也已删码时随之删;`test/session-ext-move-db-integration.test.ts` 整只文件",
         afterRemoval: "跳过了带本条的版本直接升上来的库:`session_meta` 上仍带部署格列 ⇒ 起服列册对账拒启(`config.schema_mismatch`,那几列是本树之外的多余列,拒句不给 ALTER —— 出路是带本条的版本);" +
             "部署格从旁表读,旧列上的值不被任何读者读。出路 = 升级时先过一次带本条的版本并起服",
         reportKeys: ["sessionExtRowsMoved", "sessionMetaColumnsDropped"],
+        dropsColumns: { session_meta: SESSION_EXT_MOVED_COLUMNS.map((c) => c.name) },
+    },
+    {
+        id: "M42",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `src/plugins/scenario-prefix-switch-m42.ts` 整只文件;本文件的 M42 步(`switchScenarioPrefixM42` / `scannedIdentityColumnsM42`,`migrateStepsOn` 第一步那一行)、报告 / 收据 / 日志的 `scenarioPrefixSourcesScanned`、头注 M42 段;" +
+            "`readLiveRunHeartbeat` / `LiveRunHeartbeat` 在 M40 与 M41 也已删码时随之删;`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里 M42 那一腿(`switchLocalScenarioPrefixM42`)与四只 File 店的 `scenarioPrefixOwnerRowsM42`(run / 会话 / 问 / 附件);`test/scenario-prefix-switch-m42.test.ts` 与 `test/scenario-prefix-switch-db-integration.test.ts` 两只文件。" +
+            "标记表的属主 `one-time-migration-marker.ts` 在 M43 也已删码时随之删;库里留下的标记表 / 数据根里的标记文件无人再读,不删(起服列册对账只核本树声明的表)",
+        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升的库,存量里以 `_scn:` 开头的身份被恢复管线读作某个人的场景(拆不出合文法的场景与人的 ⇒ `owner.malformed_subject` 响亮)。" +
+            "出路 = 升级时先过一次带本条的版本并起服(它扫一次、命中即拒启点名)",
+        reportKeys: ["scenarioPrefixSourcesScanned"],
+    },
+    {
+        id: "M43",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删本文件的 M43 步(`markWithdrawEnabledM43`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `withdrawMarkWritten`、头注 M43 段;" +
+            "`plugins/session-withdraw-sql.ts` 的 `WITHDRAW_MARK_ID` 与部署判据里读标记的那一句(撤回出口无条件启用);标记表 `one-time-migration-marker.ts` 在 M42 也已删码时随之删、`plugins/session-birth.ts` 的 `upgrade_pending` 词与出口计数里的同名词;" +
+            "local 会话元数据格「没有 `clientWrites` 位 ⇒ upgrade_pending」那一臂;库里留下的标记行无人再读,不删(与 M42 同一张标记表)",
+        afterRemoval: "窗 30 天之后更早版本的副本早已不在;标记行不再被任何读者读(留着无害)。跳过了带本条的版本直接升上来的库:撤回出口从第一次起服就启用 —— " +
+            "跨两版以上的混跑本就不被支持(7.147.0 起的停-迁-起)。出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["withdrawMarkWritten"],
+    },
+    {
+        id: "M44",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删本文件的 M44 步(`rewriteRunErrorCodeColumnM44`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `runErrorCodeColumnRewritten`、头注 M44 段;" +
+            "`run-store-sql.ts` 的读侧半场 `m44ErrorCodeReadSide`(行映射的码改成只读列;窗内停驻行列空时读结果体的码)与 `decodeRunResultCellM44`;" +
+            "local 腿 `FileRunStore.migrateRunErrorCodeColumnM44` 与 `LocalBackend.runOneTimeMigrations` 里那一格;`test/run-error-code-column.test.ts` 的 M44 组与双库集成文件的 M44 组",
+        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升上来的库,旧行按列答 —— 停驻两口在列建立之前写下的 `needs_review` 行 `errorCode` 缺席(`review.pending` 仍在 `result` 里)、" +
+            "列里是没折过的原码的旧行答原码;`result.terminal.code` 仍在 `result` 里。调长了停驻终局兜底(`APPROVAL_TERMINAL_BACKSTOP_MS` > 30 天)的部署,窗关时还可能有更早版本写下的停驻没结清,读法同上。" +
+            "出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["runErrorCodeColumnRewritten"],
+    },
+    {
+        id: "M45",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `src/plugins/run-preview-m45.ts` 整个文件;本文件的 M45 步(`rewriteRunObjectivePreviewM45`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `runObjectivePreviewRewritten`、头注 M45 段;" +
+            "local 腿 `FileRunStore.migrateRunObjectivePreviewM45` 与 `LocalBackend.runOneTimeMigrations` 里那一格;" +
+            "`test/run-preview-m45.test.ts` 与 `test/helpers/run-preview-m45-rows.ts` 整个文件、`test/session-preview-single-source-db-integration.test.ts` 的 M45 组",
+        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升上来的库,7.124.0 之前写下的、以注入块起头的预览照旧按列答 —— 会话列表 / `GET /v1/tasks` / 助手任务行名 / 收件箱上显示那段块文本。" +
+            "出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["runObjectivePreviewRewritten"],
+    },
+    {
+        id: "M46",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `src/plugins/approval-exemption-skill-m46.ts` 整个文件;本文件的 M46 步(`dropLegacySkillExemptionsM46`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `legacySkillExemptionsDropped`、头注 M46 段、`logReceiptRows` 里的 `legacy_skill_exemptions_dropped` 一行;" +
+            "`approval-exemption-store.ts` 的 `FileApprovalExemptionStore.dropToolRowsCreatedBeforeM46` 与 `LocalBackend.runOneTimeMigrations` 里那一格;" +
+            "`test/approval-exemption-skill-m46.test.ts` 整个文件、`test/one-time-migrations-db-integration.test.ts` 的 M46 组;标记表 `one-time-migration-marker.ts` 在 M42 / M43 也已删码时随之删(库里留下的 `M46` 标记行与数据根里的标记文件无人再读,不删)",
+        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升上来的库,7.116.0 之前写下的 `(会话, \"Skill\")` 豁免行照旧代答「不绑授予」的同名调用 —— 部署自挂一只叫 `Skill` 的工具、没有技能时," +
+            "那个人当年批的是「激活某技能」,代答的却是这只工具的调用。出路 = 升级时先过一次带本条的版本并起服(或运维手工删那些行:`DELETE FROM approval_exemption WHERE tool_name = 'Skill'` / 删会话)",
+        reportKeys: ["legacySkillExemptionsDropped"],
+    },
+    {
+        id: "M47",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `LocalSessionStore.adoptArchiveTokensM47`(含欠账起服的 `required` 分档、证明 `assertArchiveTokensAdoptedM47` / `adoptionScopeOf` / `skippedFromAdoption` 与它那一处销账)与 `LocalArchiveTokenAdoption`、`archiveTokenAdoptionCarried`;" +
+            "收令牌欠账的记账(`recordArchiveTokenAdoptionPending`);窗内长第一格的规则 `firstCellIncarnationOf` / `LocalSessionStore.firstCellIncarnationHeld`(调用点 —— 补铸、登记、执行位回填、M33 的行回填与快照恢复 —— 回到新铸);" +
+            "`holdArchiveTokenAdoptionDuty` 的 `adoptionCarried` 参数与记账那一支、`store-backend.ts` 判前钩里传它的那一处(臂恒判);" +
+            "`LocalBackend.ensureSchema` 里对 `adoptArchiveTokensM47` 的调用与两只读数字段、`runOneTimeMigrations` 里报告两键那几行;报告 / 收据 / `changedAnything` / `readingFields` / `NO_SQL_MIGRATIONS` 的 `localArchiveTokensAdopted` / `localArchiveTokensMinted`、头注 M47 段;" +
+            "M33 也已删码时连同 `archivedRowFactsOf` / `ArchivedRowFacts`;`test/local-root-one-row-store.test.ts` 里标题含 `P3` / `P4` 的格。" +
+            "**不随本条删**:跳版拒启臂 `holdArchiveTokenAdoptionDuty`(不带本条那一支:标记在而无格存档为零 ⇒ 销账放行)/ `archiveIdsWithoutCellSync` / `archiveTokenAdoptionPendingPresent` / `dischargeArchiveTokenAdoptionPending` / `ARCHIVE_TOKEN_ADOPTION_SINCE`、读数种别 `skipped-required-migration` 与它按高水位分支的拒句(常设)",
+        afterRemoval: "跳版拒启臂接住(常设,起服对账一族、数据根打开那一刻、引擎高水位抬之前):(打开之前的引擎高水位早于 7.148.0 或缺席 ∨ 数据根里的收令牌欠账标记还在 —— 带本条的版本打开过、没收完)" +
+            "∧ 根里有存档在而会话元数据格缺的会话 ⇒ 拒启 `config.schema_mismatch`(读数种别 `skipped-required-migration`,点名会话数与版本),零写、不抬高水位 —— " +
+            "出路 = 先用一个仍带本条、不低于 7.148.0 且不低于已记高水位的版本(服务或 run-local)完整起一次,再升",
+        reportKeys: ["localArchiveTokensAdopted", "localArchiveTokensMinted"],
+    },
+    {
+        id: "M48",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `src/plugins/shell-sentinel-owner-m48.ts` 整个文件;本文件的 M48 步(`clearShellSentinelOwnersM48`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志的 `shellSentinelOwnersCleared`、头注 M48 段;" +
+            "`SqlOneTimeMigrationInput` 里 M48 那一半(`ShellSentinelOwnerInput`)与它在两只 SQL 后端 / 测试夹具上的实参(`identityBoundary`);" +
+            "local 腿 `LocalSessionStore.clearShellSentinelOwnersM48` / `FileRunStore.clearShellSentinelOwnersM48` 与 `LocalBackend.runOneTimeMigrations` 里那一格(连同后端的 `identityBoundary` 字段);部署形表行 `identityBoundary` 不随删(dev-open 判据读它);" +
+            "`test/shell-sentinel-owner-m48.test.ts` 整个文件、`test/one-time-migrations-db-integration.test.ts` 的 M48 组",
+        afterRemoval: "没有响亮臂(如实):没有身份边界的部署跳过了带本条的版本直接升上来,哨兵属主的存量行仍记着那个字面量,属主面表已不认它 —— 不带主体的本地单用户读不到、续不上那些会话与 run(404)," +
+            "带同一个头的请求仍读得到(属主相同)。出路 = 升级时先过一次带本条的版本并起服(或运维手工 `UPDATE <表> SET owner = NULL WHERE owner = 'anon:shell-live'`,三张表见删法)。" +
+            "有身份边界的部署本条本来就零改写,删码前后同答(哨兵是一位普通的具名属主)",
+        reportKeys: ["shellSentinelOwnersCleared"],
+    },
+    {
+        id: "M49",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删本文件的 M49 步(`backfillCheckpointHostSessionsM49`,`migrateStepsOn` 里那一行)与 `HOST_SESSION_BACKFILL_PAGE`、报告 / 收据 / 日志的 `checkpointHostSessionsBackfilled`、头注 M49 段;" +
+            "local 腿 `LocalCheckpointStore.backfillHostSessionsM49` 与 `LocalBackend.runOneTimeMigrations` 里那一格;`test/checkpoint-host-session.test.ts` 的 M49 组、" +
+            "`test/one-time-migrations-db-integration.test.ts` 的 M49 组。**不随本条删**:`host_session_id` 列、写口的 `hostSessionOf`、按 run 找卡的读口(常设)",
+        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升上来的库,升级前停下、升级后仍挂着的卡归属为空 —— 按 run 找卡的读口找不到它:取消那条 run 不作废它、" +
+            "两条停驻收割把那条 run 当成「卡已不在」收掉(`approval.expired`)、决断答 409 `conflict.resume_context_unavailable`,卡由终局兜底收割收走。出路 = 升级前答完 / 拒掉停驻的卡," +
+            "或升级时先过一次带本条的版本并起服(或运维手工 `UPDATE checkpoint SET host_session_id = session_id WHERE host_session_id IS NULL`)",
+        reportKeys: ["checkpointHostSessionsBackfilled"],
+    },
+    {
+        id: "M50",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `src/plugins/approval-ask-retired-delete-by-task-m50.ts` 整只文件(`RETIRED_DELETE_BY_TASK_OP_M50` / `retiredDeleteByTaskReplayOpenM50` / `retiredDeleteByTaskClosedWhyM50`);" +
+            "`approval-ask-store-file.ts` 重放里认它的那一段(`replayRecord` 里 `probe.op === RETIRED_DELETE_BY_TASK_OP_M50` 一段)、`retiredDeleteByTaskRecordsM50` 计数与构造器末段那一行 stderr、那一行 import、顶注里随 M50 的那半句;" +
+            "`approval-ask-store-memory.ts` 的 `deleteByTaskM50`;`test/approval-ask-session-cascade.test.ts` 的 M50 组(窗内 / 窗关当天 / 窗关次日 / 坏记录四格与 `withM50Window` 助手);本文件头注 M50 段",
+        afterRemoval: "既有的词表外动词拒启(`approval-ask-store-file.ts` 重放的动词闭集判,拒句点名账本路径,出路 = 用写下它的那一版起服一次或把文件挪开)—— 与窗关之后本条自己的拒启同一个结局,删码零行为变化。" +
+            "会撞上它的是窗内一次都没在带本条的版本上起过服的 local 数据根(跳过本版直接升的),账本里又恰好留着一条嵌入方写下的这只词",
+        reportKeys: [],
+    },
+    {
+        id: "M51",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删本文件的 M51 步(`switchSessionDeletingM51` / `SessionDeletingSwitchRefusedError` / `SESSION_DELETING_SWITCH_REFUSED_CODE` / `SESSION_DELETING_MARK_ID`,`migrateStepsOn` 里那一行)、" +
+            "报告 / 收据 / `changedAnything` / `readingFields` / `NO_SQL_MIGRATIONS` 的 `sessionDeletingSwitchMarked`、头注 M51 段;`test/session-deleting-state-db-integration.test.ts` 的 M51 组;" +
+            "标记表 `one-time-migration-marker.ts` 在 M42 / M43 / M46 也已删码时随之删(库里留下的 `M51` 标记行无人再读,不删)。**不随本条删**:在删态本身(列、围栏、规则 L 的在删半、终刀判令牌 —— 常设)",
+        afterRemoval: "没有响亮臂(也无需):窗 30 天之后更早版本的副本早已不在;跳过了带本条的版本直接升上来的库 —— 跨两版以上的混跑本就不被支持(7.147.0 起的停-迁-起)。出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["sessionDeletingSwitchMarked"],
     },
 ];
 export function migrationWindowOpen(window, today) {
@@ -648,10 +768,23 @@ export function migrationWindowEnd(id) {
         throw new Error(`one-time-migrations: ${id} is in the unreleased form (removableAfter: null) — there is no window end to quote yet`);
     return row.removableAfter;
 }
+export function columnsRemovedByPendingMigrations(registry = ONE_TIME_MIGRATIONS) {
+    const removals = new Map();
+    for (const row of registry) {
+        for (const [table, columns] of Object.entries(row.dropsColumns ?? {})) {
+            const owners = removals.get(table) ?? new Map();
+            for (const column of columns) {
+                const owner = owners.get(column);
+                if (owner !== undefined)
+                    throw new Error(`one-time-migrations: ${table}.${column} is claimed as dropped by both ${owner} and ${row.id} — one column has one dropping migration`);
+                owners.set(column, row.id);
+            }
+            removals.set(table, owners);
+        }
+    }
+    return removals;
+}
 export const NO_SQL_MIGRATIONS = {
-    undurableScopeRuleRows: [],
-    undurableScopeRuleBucketsDeferred: 0,
-    undurableScopeRuleBucketsUnreadable: [],
     sessionRuleColumn: "file-store",
     sessionRuleRowsWithRetiredBuckets: [],
     sessionRuleRowsWithOldGrammarEntries: [],
@@ -679,6 +812,8 @@ export const NO_SQL_MIGRATIONS = {
     deviceBindingTablesDropped: 0,
     sessionExtRowsMoved: 0,
     sessionMetaColumnsDropped: 0,
+    withdrawMarkWritten: 0,
+    sessionDeletingSwitchMarked: 0,
     askCauseColumnsChanged: 0,
     askParkTriggersMoved: 0,
 };
@@ -779,8 +914,14 @@ async function migrateOn(db, dialect, input) {
     return completedReport(receipts);
 }
 async function migrateStepsOn(db, dialect, receipts, input) {
+    await switchScenarioPrefixM42(db, dialect, receipts, input);
     await renameRetiredExecutionLaneWordsM40(db, dialect, receipts, input);
     await refuseSessionExtMoveWhileRunsHeartbeat(db, dialect, input);
+    await switchSessionDeletingM51(db, dialect, receipts, input);
+    await rewriteRunErrorCodeColumnM44(db, dialect, receipts);
+    await rewriteRunObjectivePreviewM45(db, dialect, receipts);
+    await clearShellSentinelOwnersM48(db, dialect, receipts, input);
+    await backfillCheckpointHostSessionsM49(db, dialect, receipts);
     await migrateRetiredCardWords(db, dialect, receipts);
     await splitApprovalAskCauseColumns(db, dialect, receipts);
     await migrateSessionRuleGrammar(db, dialect, receipts);
@@ -788,8 +929,6 @@ async function migrateStepsOn(db, dialect, receipts, input) {
     await backfillParkedApprovalCards(db, dialect, receipts);
     if (await tableExists(db, dialect, "session_meta"))
         await inheritPlacedSessionOwners(db, dialect, receipts);
-    if ((await tableExists(db, dialect, PERMISSION_RULE_TABLE)) && (await columnExists(db, dialect, PERMISSION_RULE_TABLE, "grammar")))
-        await purgeUndurableScopeRows(db, dialect, receipts);
     if ((await tableExists(db, dialect, PERMISSION_RULE_TABLE)) && (await columnExists(db, dialect, PERMISSION_RULE_TABLE, "grammar"))) {
         await retireImportedLayerRootAllows(createSqlImportedLayerRootSource({ dialect, query: (sql, params) => db.query(sql, params) }), receipts);
     }
@@ -799,6 +938,208 @@ async function migrateStepsOn(db, dialect, receipts, input) {
     await dropRejectedMailboxKeys(db, dialect, receipts);
     await switchExecutionPlacement(db, dialect, receipts, input);
     await moveSessionCellsToSideTable(db, dialect, receipts);
+    await markWithdrawEnabledM43(db, dialect, receipts, input);
+    await dropLegacySkillExemptionsM46(db, dialect, receipts);
+}
+const M44_PAGE = 500;
+async function rewriteRunErrorCodeColumnM44(db, dialect, receipts) {
+    if (!(await tableExists(db, dialect, "task_run")))
+        return;
+    receipts.runErrorCodeColumnRewritten += await db.exec("UPDATE task_run SET error_code = NULL WHERE status = 'running' AND error_code IS NOT NULL");
+    let after = "";
+    for (;;) {
+        const page = await db.rows(dialect === "mysql"
+            ? `SELECT task_id, status, updated_at, error_code, ${jsonColumnText(dialect, "result")} FROM task_run WHERE task_id > ? AND result IS NOT NULL AND status <> 'running' ORDER BY task_id LIMIT ${M44_PAGE}`
+            : `SELECT task_id, status, updated_at, error_code, ${jsonColumnText(dialect, "result")} FROM task_run WHERE task_id > $1 AND result IS NOT NULL AND status <> 'running' ORDER BY task_id LIMIT ${M44_PAGE}`, [after]);
+        for (const row of page) {
+            const taskId = String(row["task_id"]);
+            const first = await rewriteOneRunErrorCodeM44(db, dialect, row);
+            if (first !== 0) {
+                if (first > 0)
+                    receipts.runErrorCodeColumnRewritten += 1;
+                continue;
+            }
+            const [now] = await db.rows(dialect === "mysql"
+                ? `SELECT task_id, status, updated_at, error_code, ${jsonColumnText(dialect, "result")} FROM task_run WHERE task_id = ? AND result IS NOT NULL AND status <> 'running'`
+                : `SELECT task_id, status, updated_at, error_code, ${jsonColumnText(dialect, "result")} FROM task_run WHERE task_id = $1 AND result IS NOT NULL AND status <> 'running'`, [taskId]);
+            if (now !== undefined && (await rewriteOneRunErrorCodeM44(db, dialect, now)) > 0)
+                receipts.runErrorCodeColumnRewritten += 1;
+        }
+        if (page.length < M44_PAGE)
+            return;
+        after = String(page[page.length - 1]["task_id"]);
+    }
+}
+async function rewriteOneRunErrorCodeM44(db, dialect, row) {
+    const taskId = String(row["task_id"]);
+    const storedCode = row["error_code"] ?? null;
+    const result = decodeRunResultCellM44(row["result"], taskId);
+    if (result === "unreadable" || result === null)
+        return -1;
+    const target = persistedPlaneOf(result).errorCode ?? storedCode;
+    if (target === storedCode)
+        return -1;
+    return db.exec(dialect === "mysql"
+        ? "UPDATE task_run SET error_code = ? WHERE task_id = ? AND status = ? AND updated_at = ? AND error_code <=> ?"
+        : "UPDATE task_run SET error_code = $1 WHERE task_id = $2 AND status = $3 AND updated_at = $4 AND error_code IS NOT DISTINCT FROM $5", [target, taskId, String(row["status"]), row["updated_at"], storedCode]);
+}
+const M45_PAGE = 500;
+async function rewriteRunObjectivePreviewM45(db, dialect, receipts) {
+    if (!(await tableExists(db, dialect, "task_run")))
+        return;
+    const ph = (i) => (dialect === "mysql" ? "?" : `$${i}`);
+    const coarse = RUN_PREVIEW_COARSE_PREFIXES_M45.map((_, i) => `objective_preview LIKE ${ph(i + 2)}`).join(" OR ");
+    let after = "";
+    for (;;) {
+        const page = await db.rows(`SELECT task_id, objective_preview FROM task_run WHERE task_id > ${ph(1)} AND (${coarse}) ORDER BY task_id LIMIT ${M45_PAGE}`, [after, ...RUN_PREVIEW_COARSE_PREFIXES_M45]);
+        for (const row of page) {
+            const current = row["objective_preview"];
+            if (typeof current !== "string")
+                continue;
+            const target = normalizedRunPreviewM45(current);
+            if (target === undefined || target === current)
+                continue;
+            receipts.runObjectivePreviewRewritten += await db.exec(dialect === "mysql" ? "UPDATE task_run SET objective_preview = ? WHERE task_id = ? AND objective_preview = ?" : "UPDATE task_run SET objective_preview = $1 WHERE task_id = $2 AND objective_preview = $3", [target, String(row["task_id"]), current]);
+        }
+        if (page.length < M45_PAGE)
+            return;
+        after = String(page[page.length - 1]["task_id"]);
+    }
+}
+export async function clearShellSentinelOwnersM48(db, dialect, receipts, input) {
+    if (input.identityBoundary !== false)
+        return;
+    const sentinelOwner = dialect === "mysql" ? "CAST(owner AS BINARY) = CAST(? AS BINARY)" : "owner = $1";
+    for (const table of SHELL_SENTINEL_OWNER_TABLES_M48) {
+        if (!(await tableExists(db, dialect, table)))
+            continue;
+        receipts.shellSentinelOwnersCleared += await db.exec(`UPDATE ${table} SET owner = NULL WHERE ${sentinelOwner}`, [SHELL_SENTINEL_OWNER_M48]);
+    }
+}
+const HOST_SESSION_BACKFILL_PAGE = 500;
+async function backfillCheckpointHostSessionsM49(db, dialect, receipts) {
+    if (!(await tableExists(db, dialect, "checkpoint")) || !(await columnExists(db, dialect, "checkpoint", "host_session_id")))
+        return;
+    const ph = (i) => (dialect === "mysql" ? "?" : `$${i}`);
+    let after = "";
+    for (;;) {
+        const page = (await db.rows(`SELECT token FROM checkpoint WHERE host_session_id IS NULL AND token > ${ph(1)} ORDER BY token ASC LIMIT ${HOST_SESSION_BACKFILL_PAGE}`, [after])).map((r) => String(r.token));
+        if (page.length === 0)
+            return;
+        receipts.checkpointHostSessionsBackfilled += await db.exec(`UPDATE checkpoint SET host_session_id = session_id WHERE host_session_id IS NULL AND token IN (${page.map((_, i) => ph(i + 1)).join(", ")})`, page);
+        after = page[page.length - 1];
+        if (page.length < HOST_SESSION_BACKFILL_PAGE)
+            return;
+    }
+}
+export async function dropLegacySkillExemptionsM46(db, dialect, receipts) {
+    if (!(await tableExists(db, dialect, "approval_exemption")))
+        return;
+    if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
+        await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
+    const ph = (i) => (dialect === "mysql" ? "?" : `$${i}`);
+    const readMark = async () => {
+        const [row] = await db.rows(`SELECT marked_at_ms FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = ${ph(1)}`, [LEGACY_SKILL_EXEMPTION_MARKER_ID]);
+        return row === undefined ? undefined : Number(row["marked_at_ms"]);
+    };
+    let markedAtMs = await readMark();
+    if (markedAtMs === undefined) {
+        await db.exec(dialect === "mysql"
+            ? `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES (?, ?) ON DUPLICATE KEY UPDATE migration_id = migration_id`
+            : `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES ($1, $2) ON CONFLICT (migration_id) DO NOTHING`, [LEGACY_SKILL_EXEMPTION_MARKER_ID, Date.now()]);
+        markedAtMs = await readMark();
+    }
+    if (markedAtMs === undefined || !Number.isFinite(markedAtMs))
+        throw new Error("one-time migration M46: the marker row is missing or unreadable right after it was written — refusing to delete rows without a recorded cutoff");
+    const cutoff = new Date(markedAtMs);
+    let after = "";
+    for (;;) {
+        const page = await db.rows(`SELECT session_id FROM approval_exemption WHERE tool_name = ${ph(1)} AND created_at < ${ph(2)} AND session_id > ${ph(3)} ORDER BY session_id LIMIT ${LEGACY_SKILL_EXEMPTION_PAGE}`, [LEGACY_SKILL_EXEMPTION_TOOL_NAME, cutoff, after]);
+        if (page.length === 0)
+            return;
+        const sessionIds = page.map((r) => String(r["session_id"]));
+        receipts.legacySkillExemptionsDropped += await db.exec(`DELETE FROM approval_exemption WHERE tool_name = ${ph(1)} AND created_at < ${ph(2)} AND session_id IN (${sessionIds.map((_, i) => ph(i + 3)).join(", ")})`, [LEGACY_SKILL_EXEMPTION_TOOL_NAME, cutoff, ...sessionIds]);
+        if (page.length < LEGACY_SKILL_EXEMPTION_PAGE)
+            return;
+        after = sessionIds[sessionIds.length - 1];
+    }
+}
+async function markWithdrawEnabledM43(db, dialect, receipts, input) {
+    if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
+        await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
+    const marked = await db.rows(dialect === "mysql" ? `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = ?` : `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = $1`, [WITHDRAW_MARK_ID]);
+    if (marked.length > 0)
+        return;
+    if ((await readLiveRunHeartbeat(db, dialect, input)) !== undefined)
+        return;
+    receipts.withdrawMarkWritten += await db.exec(dialect === "mysql"
+        ? `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES (?, ?) ON DUPLICATE KEY UPDATE migration_id = migration_id`
+        : `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES ($1, $2) ON CONFLICT (migration_id) DO NOTHING`, [WITHDRAW_MARK_ID, Date.now()]);
+}
+export const SESSION_DELETING_MARK_ID = "M51";
+export const SESSION_DELETING_SWITCH_REFUSED_CODE = "config.session_deleting_switch_refused";
+export class SessionDeletingSwitchRefusedError extends StoreBootRefusalError {
+    code = SESSION_DELETING_SWITCH_REFUSED_CODE;
+    reason = "live_runs";
+    constructor(live) {
+        super(`${SESSION_DELETING_SWITCH_REFUSED_CODE} (reason: live_runs): this version deletes a session through a deleting state that every replica must read ` +
+            `(a submission on a session being deleted is refused), but ${live.liveRuns} running run(s) heartbeated on this database within the last ${live.windowSec}s (REAP_RUN_STALE_SEC) — ` +
+            "a replica of an earlier version may still be serving; it does not read that state and would accept a submission on a session this version is deleting. Nothing was changed and no marker was written. " +
+            "Stop every replica of the earlier version, then start this version (stop, migrate, start — this release cannot be rolled across replicas of both versions). " +
+            `If every replica is already stopped, those are the runs they left behind: start this version again after ${live.after}`);
+        this.name = "SessionDeletingSwitchRefusedError";
+    }
+}
+async function switchSessionDeletingM51(db, dialect, receipts, input) {
+    if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
+        await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
+    const marked = await db.rows(dialect === "mysql" ? `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = ?` : `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = $1`, [SESSION_DELETING_MARK_ID]);
+    if (marked.length > 0)
+        return;
+    const heartbeat = await readLiveRunHeartbeat(db, dialect, input);
+    if (heartbeat !== undefined)
+        throw new SessionDeletingSwitchRefusedError(heartbeat);
+    receipts.sessionDeletingSwitchMarked += await db.exec(dialect === "mysql"
+        ? `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES (?, ?) ON DUPLICATE KEY UPDATE migration_id = migration_id`
+        : `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES ($1, $2) ON CONFLICT (migration_id) DO NOTHING`, [SESSION_DELETING_MARK_ID, Date.now()]);
+}
+export async function scannedIdentityColumnsM42(db, dialect) {
+    const scope = dialect === "mysql" ? "DATABASE()" : "current_schema()";
+    const live = new Set((await db.rows(`SELECT table_name AS t, column_name AS c FROM information_schema.columns WHERE table_schema = ${scope}`)).map((r) => `${String(r["t"] ?? r["T"])}.${String(r["c"] ?? r["C"])}`));
+    const out = [];
+    for (const [table, shape] of await expectedTableShapes(dialect)) {
+        for (const c of shape.columns) {
+            if (!IDENTITY_COLUMN_NAME.test(c.name) || !/^\S+\s+(VAR)?(CHAR|BINARY)\(|^\S+\s+TEXT\b/i.test(c.ddl))
+                continue;
+            if (live.has(`${table}.${c.name}`))
+                out.push({ table, column: c.name });
+        }
+    }
+    return out.sort((a, b) => `${a.table}.${a.column}`.localeCompare(`${b.table}.${b.column}`));
+}
+export async function switchScenarioPrefixM42(db, dialect, receipts, input) {
+    if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
+        await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
+    const marked = await db.rows(dialect === "mysql" ? `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = ?` : `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = $1`, [SCENARIO_PREFIX_MARKER_ID]);
+    if (marked.length > 0)
+        return;
+    const columns = await scannedIdentityColumnsM42(db, dialect);
+    const hits = [];
+    for (const { table, column } of columns) {
+        const sql = dialect === "mysql" ? `SELECT COUNT(*) AS n FROM ${table} WHERE ${column} LIKE ? ESCAPE '!'` : `SELECT COUNT(*) AS n FROM ${table} WHERE ${column} LIKE $1 ESCAPE '!'`;
+        const n = Number((await db.rows(sql, [SCENARIO_PREFIX_LIKE]))[0]?.["n"] ?? 0);
+        if (n > 0)
+            hits.push({ source: `${table}.${column}`, rows: n });
+    }
+    receipts.scenarioPrefixSourcesScanned += columns.length;
+    if (hits.length > 0)
+        throw new ScenarioPrefixSwitchRefusedError("stored_prefix", hits);
+    const live = await readLiveRunHeartbeat(db, dialect, input);
+    if (live !== undefined)
+        throw new ScenarioPrefixSwitchRefusedError("live_runs", [], live);
+    await db.exec(dialect === "mysql"
+        ? `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES (?, ?) ON DUPLICATE KEY UPDATE migration_id = migration_id`
+        : `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES ($1, $2) ON CONFLICT (migration_id) DO NOTHING`, [SCENARIO_PREFIX_MARKER_ID, Date.now()]);
 }
 export const EXECUTION_LANE_RENAME_REFUSED_CODE = "config.execution_lane_rename_refused";
 export class ExecutionLaneRenameRefusedError extends StoreBootRefusalError {
@@ -891,7 +1232,7 @@ async function deploymentColumnsOnMeta(db, dialect) {
     if (!(await tableExists(db, dialect, "session_meta")))
         return [];
     const present = [];
-    for (const column of SESSION_EXT_COLUMNS)
+    for (const column of SESSION_EXT_MOVED_COLUMNS)
         if (await columnExists(db, dialect, "session_meta", column.name))
             present.push(column);
     return present;
@@ -1226,31 +1567,36 @@ export async function switchExecutionPlacement(db, dialect, receipts, input) {
         await step.run({ db, dialect, input, receipts, shape });
 }
 export async function backfillLocalExecutionPlacements(sessionIds, seat, input) {
-    const absent = [];
+    let backfilled = 0;
+    let ambiguous = 0;
     const unreadable = [];
     for (const root of sessionIds) {
-        const reading = await seat.read(root);
-        if (reading === undefined)
+        const out = await seat.backfill(root, input.lanes);
+        if (isUnusableArchive(out)) {
+            unreadable.push({ sessionId: root, fault: out.word, ...(out.errno !== undefined ? { errno: out.errno } : {}) });
             continue;
-        if (isUnusableArchive(reading))
-            unreadable.push({ sessionId: root, fault: reading.word, ...(reading.errno !== undefined ? { errno: reading.errno } : {}) });
-        else if (reading.cell.role === "absent")
-            absent.push({ root, occupant: reading.occupant });
-    }
-    if (absent.length === 0)
-        return { backfilled: 0, unreadable };
-    if (input.lanes.length !== 1) {
-        throw new ExecutionPlacementSwitchRefusedError("backfill_ambiguous", `the local data root holds sessions that have runs but no execution placement (${absent.length}), and the deployment declares ${input.lanes.length === 0 ? "no lane" : `${input.lanes.length} lanes (${input.lanes.join(", ")})`} — ` +
+        }
+        switch (out.outcome) {
+            case "placed":
+                backfilled += 1;
+                break;
+            case "ambiguous":
+                ambiguous += 1;
+                break;
+            case "skipped":
+                break;
+            default: {
+                const unknownOutcome = out;
+                throw new Error(`backfillLocalExecutionPlacements: no outcome ${JSON.stringify(unknownOutcome)}`);
+            }
+        }
+    }
+    if (ambiguous > 0) {
+        throw new ExecutionPlacementSwitchRefusedError("backfill_ambiguous", `the local data root holds sessions that have runs but no execution placement (${ambiguous}), and the deployment declares ${input.lanes.length === 0 ? "no lane" : `${input.lanes.length} lanes (${input.lanes.join(", ")})`} — ` +
             "with more than one lane there is no single right answer, and this server will not guess one. Nothing was changed. " +
             "Start this version once with a single declared lane (REMOTE_EXEC set to one lane), then declare the additional lanes");
     }
-    const lane = input.lanes[0];
-    let placed = 0;
-    for (const { root, occupant } of absent) {
-        if ((await seat.place(root, occupant, { role: "writer", lane })).outcome === "placed")
-            placed += 1;
-    }
-    return { backfilled: placed, unreadable };
+    return { backfilled, unreadable };
 }
 const UNKNOWN_LANE_ASKS_SHOWN = 5;
 export function backfillLocalAskExecutionLanes(store, input) {
@@ -1559,8 +1905,8 @@ async function migrateRetiredCardWords(db, dialect, receipts) {
             return;
     }
 }
-const M21_GATE = { key: "gate", as: "m21_gate" };
-const M21_PENDING_ACTION = { key: "pendingAction", as: "m21_pending_action" };
+const M21_GATE = { path: ["gate"], as: "m21_gate" };
+const M21_PENDING_ACTION = { path: ["pendingAction"], as: "m21_pending_action" };
 const PARKED_ROW_REPAIR_PAGE = 200;
 const QUESTION_CARD = "question";
 const readM21Subtree = createObjectColumnReader();
@@ -1759,9 +2105,6 @@ export async function inheritPlacedSessionOwners(db, dialect, receipts) {
 }
 function readingFields(r) {
     return {
-        undurableScopeRuleRowsRemoved: r.undurableScopeRuleRows.length,
-        undurableScopeRuleBucketsDeferred: r.undurableScopeRuleBucketsDeferred,
-        undurableScopeRuleBucketsUnreadable: r.undurableScopeRuleBucketsUnreadable.length,
         ...(r.sessionRuleColumn !== undefined ? { sessionRuleColumn: r.sessionRuleColumn } : {}),
         sessionRuleRowsWithRetiredBuckets: r.sessionRuleRowsWithRetiredBuckets.length,
         sessionRuleRowsWithOldGrammarEntries: r.sessionRuleRowsWithOldGrammarEntries.length,
@@ -1792,12 +2135,22 @@ function readingFields(r) {
         executionLaneWordsRenamed: r.executionLaneWordsRenamed,
         sessionExtRowsMoved: r.sessionExtRowsMoved,
         sessionMetaColumnsDropped: r.sessionMetaColumnsDropped,
+        scenarioPrefixSourcesScanned: r.scenarioPrefixSourcesScanned,
+        withdrawMarkWritten: r.withdrawMarkWritten,
+        sessionDeletingSwitchMarked: r.sessionDeletingSwitchMarked,
+        runErrorCodeColumnRewritten: r.runErrorCodeColumnRewritten,
+        runObjectivePreviewRewritten: r.runObjectivePreviewRewritten,
+        shellSentinelOwnersCleared: r.shellSentinelOwnersCleared,
+        checkpointHostSessionsBackfilled: r.checkpointHostSessionsBackfilled,
+        legacySkillExemptionsDropped: r.legacySkillExemptionsDropped,
         executionPlacementSessionsUnreadable: r.executionPlacementSessionsUnreadable.length,
         localArchiveRowFactsBackfilled: r.localArchiveRowFactsBackfilled,
         localArchivesAnonymized: r.localArchivesAnonymized,
         localArchivesKeptStamped: r.localArchivesKeptStamped.length,
         localArchivesUnreadable: r.localArchivesUnreadable.length,
         localArchiveSnapshotsRecovered: r.localArchiveSnapshotsRecovered,
+        localArchiveTokensAdopted: r.localArchiveTokensAdopted,
+        localArchiveTokensMinted: r.localArchiveTokensMinted,
         askCauseColumnsChanged: r.askCauseColumnsChanged,
         askParkTriggersMoved: r.askParkTriggersMoved,
         askJournalRecordsUpgraded: r.askJournalRecordsUpgraded,
@@ -1811,11 +2164,7 @@ export function logOneTimeMigrations(log, backend, report) {
         backend,
         ...readingFields(report),
         removableAfter: Object.fromEntries(ONE_TIME_MIGRATIONS.map((w) => [w.id, w.removableAfter])),
-        note: "one-time persisted-data migrations (M10 writes nothing at boot — on the local backend, while its window is open, the first task submitted with a principal " +
-            "on a session written by an earlier version (which recorded no owner) claims that session for the principal, one session_owner_claimed line per claim; " +
-            "M11: persisted permission rules whose project scope root is not a complete absolute path — accepted by earlier versions, dropped on every read " +
-            "by the current engine and not removable through DELETE /v1/rules — removed, one permission_rule_row_removed line per row; a bucket the read path " +
-            "refuses in whole is left untouched, one permission_rule_bucket_unreadable line per bucket; M17: the session-rules column renamed from `rules` to " +
+        note: "one-time persisted-data migrations (M17: the session-rules column renamed from `rules` to " +
             "`rule_entries`, so a build that reads rules under the earlier name-only grammar finds no column to misread; at that rename every row's rule entries " +
             "are read by the engine in the grammar the row carries (none = the grammar before the stamp) and rewritten as the same statement in the current grammar " +
             "(the column carries the in-progress name rule_entries_old_grammar until every row is rewritten, so an interrupted boot resumes there) — toolAllow entries " +
@@ -1893,6 +2242,15 @@ function logReceiptRows(log, backend, r) {
                 "(the next boot then migrates it) or the session is deleted. Named on every boot until then",
         });
     }
+    if (r.legacySkillExemptionsDropped > 0) {
+        log.warn("legacy_skill_exemptions_dropped", {
+            backend,
+            count: r.legacySkillExemptionsDropped,
+            note: "session approval-exemption rows for the engine's Skill tool that were written before this boot's first run of this step (by 7.116.0 or earlier for an activation card or a deployment-list question that named Skill, " +
+                "or by a later version for a call that granted nothing) were deleted: a stored row for a tool by that name would answer a call by that name — and when no skill is loaded a call by that name is another tool, not the activation the person approved. " +
+                "The people in those sessions are asked once more on their next Skill call. Rows written after this step first ran are never touched",
+        });
+    }
     if (r.deviceBindingsOrphaned > 0) {
         log.warn("device_bindings_orphaned", {
             backend,
@@ -1955,17 +2313,6 @@ function logReceiptRows(log, backend, r) {
                 "in the session store by hand if someone should read one, or leave them to the transcript retention",
         });
     }
-    for (const row of r.undurableScopeRuleRows) {
-        log.warn("permission_rule_row_removed", {
-            backend,
-            ownerKey: row.ownerKey,
-            kind: row.kind,
-            behavior: row.behavior,
-            tool: row.tool,
-            scopeRoot: row.scopeRoot,
-            note: removedRuleRowNote(row.kind),
-        });
-    }
     for (const row of r.importedLayerRootAllowsRetired) {
         log.warn("imported_layer_root_allow_retired", {
             backend,
@@ -1993,16 +2340,6 @@ function logReceiptRows(log, backend, r) {
                 "list the rules of every owner you know (`GET /v1/rules`) and remove what should not stand",
         });
     }
-    for (const bucket of r.undurableScopeRuleBucketsUnreadable) {
-        log.warn("permission_rule_bucket_unreadable", {
-            backend,
-            ownerKey: bucket.ownerKey,
-            why: bucket.why,
-            note: "a persisted permission-rule bucket that the read path refuses in whole was left untouched by the one-time removal of rows whose project scope root " +
-                "is not a complete absolute path (removing rows from a bucket the read path refuses would turn that refusal into a readable bucket): every read of it " +
-                "keeps being refused, as before this release, until someone repairs or deletes that row by hand",
-        });
-    }
     for (const row of r.sessionRuleRowsWithOldGrammarEntries) {
         log.warn("session_rule_row_old_grammar_entries", {
             backend,
@@ -2088,18 +2425,4 @@ function importedLayerRootSkipNote(reason) {
         }
     }
 }
-function removedRuleRowNote(kind) {
-    switch (kind) {
-        case "rule":
-            return "a persisted permission rule whose project scope root is not a complete absolute path was removed by a one-time migration: the current engine drops such a row on every read (it protected nothing) and refuses any write naming that scope, so it could not be revoked through DELETE /v1/rules; re-add it with the project's full path if it is still wanted";
-        case "revoked-rule":
-            return "a persisted permission rule row whose project scope root is not a complete absolute path, and which had no live approval left (every approval behind it was already removed, or it never had one), was removed by a one-time migration: the row took effect nowhere before and takes effect nowhere now — no action needed";
-        case "tombstone":
-            return "a revocation record (tombstone) whose project scope root is not a complete absolute path was removed by a one-time migration: it can only cover rules with that same scope, which were removed with it or were never there, so nothing it revoked comes back — no action needed";
-        default: {
-            const unknown = kind;
-            throw new Error(`M11: no log sentence for removed-row kind ${JSON.stringify(unknown)}`);
-        }
-    }
-}
 //# sourceMappingURL=one-time-migrations.js.map