@sema-agent/server 7.147.0 → 7.149.0

package/dist/plugins/one-time-migrations.js

@@ -7,7 +7,13 @@ import { PG_SCHEMA_STATEMENTS, acquirePgEnsureSchemaLock, releasePgEnsureSchemaL
 import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readOpaqueJsonValueColumn, } from "./sql-json-column.js";
 import { incarnationFromCell, sessionFaceFromRow } from "../session-incarnation.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
-import { PERMISSION_RULE_TABLE, SqlDurableRulePartitionProvider, isSqlBucketRefusal, isSqlBucketVanished, listRuleBucketOwners, purgeUndurableScopeRows } from "./permission-rule-store-sql.js";
+import { decodeRunResultCellM44 } from "./run-store-sql.js";
+import { persistedPlaneOf } from "../terminal.js";
+import { RUN_PREVIEW_COARSE_PREFIXES_M45, normalizedRunPreviewM45 } from "./run-preview-m45.js";
+import { SHELL_SENTINEL_OWNER_M48, SHELL_SENTINEL_OWNER_TABLES_M48, shellSentinelOwnerWhereM48 } from "./shell-sentinel-owner-m48.js";
+import { LEGACY_SKILL_EXEMPTION_PAGE } from "./approval-exemption-skill-m46.js";
+import { SKILL_EXEMPTION_TOOL_NAME, readSqlSkillExemptionCutoff } from "./approval-exemption-skill-cutoff.js";
+import { PERMISSION_RULE_TABLE, SqlDurableRulePartitionProvider, isSqlBucketRefusal, isSqlBucketVanished, listRuleBucketOwners } from "./permission-rule-store-sql.js";
 import { SESSION_RULES_COLUMN } from "./session-rules-column.js";
 import { readJsonObjectColumn } from "./sql-json-column.js";
 import { retireStoredCardWords } from "../retired-card-words.js";
@@ -15,17 +21,19 @@ import { redactSecrets } from "../trace/redact.js";
 import { CLAIM_OWNERLESS_PLACED_SQL, claimOwnerlessParams, isOrphanSessionOwner, judgeDelegatedOwner } from "../delegated-session-owner.js";
 import { MAILBOX_KEYED_TABLES, mailboxKeyDeleteSql, storedMailboxKeyless } from "../stores-sql/mailbox-store-sql.js";
 import { backfillWriterStatement, countOrphanBindingsStatement, migrateDeviceBindingsOntoSideTableStatements, migrateDeviceBindingsStatement } from "./execution-placement-sql.js";
-import { EXECUTION_PLACEMENT_COLUMNS, SESSION_EXT_COLUMNS, SESSION_EXT_TABLE } from "./session-ext-table.js";
+import { WITHDRAW_MARK_ID } from "./session-withdraw-sql.js";
+import { EXECUTION_PLACEMENT_COLUMNS, SESSION_EXT_MOVED_COLUMNS, SESSION_EXT_TABLE } from "./session-ext-table.js";
 import { APPROVAL_ASK_ENDING_CAUSE_COLUMN, APPROVAL_ASK_EXECUTION_LANE_COLUMN, APPROVAL_ASK_PARK_TRIGGER_COLUMN, APPROVAL_ASK_TABLE } from "./approval-ask-store-sql.js";
 import { RENAMED_EXECUTION_LANE_M40, RETIRED_EXECUTION_LANE_WORD_M40, retiredExecutionLaneHintM40 } from "./execution-lane-rename-m40.js";
 import { retireImportedLayerRootAllows } from "./imported-layer-root-retirement.js";
 import { isUnusableArchive } from "../execution-placement.js";
+import { IDENTITY_COLUMN_NAME, SCENARIO_PREFIX_LIKE, SCENARIO_PREFIX_MARKER_ID, ScenarioPrefixSwitchRefusedError } from "./scenario-prefix-switch-m42.js";
+import { MIGRATION_MARKER_TABLE, SKILL_EXEMPTION_CUTOFF_ID, markIfAbsentSql, migrationMarkerDdl } from "./one-time-migration-marker.js";
+import { describeUpgradeDriftTail, expectedTableShapes } from "./schema-consistency.js";
+import { stopThenStartAction } from "./stop-then-start-sentence.js";
 const RETIRED_SESSION_RULE_BUCKETS = ["commandAllow", "commandDeny"];
 export function buildMigrationReceipts() {
     return {
-        undurableScopeRuleRows: [],
-        undurableScopeRuleBucketsDeferred: 0,
-        undurableScopeRuleBucketsUnreadable: [],
         sessionRuleRowsWithRetiredBuckets: [],
         sessionRuleRowsWithOldGrammarEntries: [],
         sessionRuleRowsWithUnreadableDeny: [],
@@ -54,12 +62,23 @@ export function buildMigrationReceipts() {
         executionLaneWordsRenamed: 0,
         sessionExtRowsMoved: 0,
         sessionMetaColumnsDropped: 0,
+        scenarioPrefixSourcesScanned: 0,
+        withdrawMarkWritten: 0,
+        sessionDeletingSwitchMarked: 0,
+        runErrorCodeColumnRewritten: 0,
+        runObjectivePreviewRewritten: 0,
+        shellSentinelOwnersCleared: 0,
+        shellSentinelOwnerRowsRetained: [],
+        checkpointHostSessionsBackfilled: 0,
+        legacySkillExemptionsDropped: 0,
         executionPlacementSessionsUnreadable: [],
         localArchiveRowFactsBackfilled: 0,
         localArchivesAnonymized: 0,
         localArchivesKeptStamped: [],
         localArchivesUnreadable: [],
         localArchiveSnapshotsRecovered: 0,
+        localArchiveTokensAdopted: 0,
+        localArchiveTokensMinted: 0,
         askCauseColumnsChanged: 0,
         askParkTriggersMoved: 0,
         askJournalRecordsUpgraded: 0,
@@ -76,10 +95,7 @@ function completedReport(r) {
     return { ...r, sessionRuleColumn, workflowJournalScopeColumn };
 }
 function changedAnything(r) {
-    return (r.undurableScopeRuleRows.length > 0 ||
-        r.undurableScopeRuleBucketsDeferred > 0 ||
-        r.undurableScopeRuleBucketsUnreadable.length > 0 ||
-        r.sessionRuleColumn === "renamed" ||
+    return (r.sessionRuleColumn === "renamed" ||
         r.sessionRuleRowsWithRetiredBuckets.length > 0 ||
         r.sessionRuleRowsWithOldGrammarEntries.length > 0 ||
         r.sessionRuleRowsWithUnreadableDeny.length > 0 ||
@@ -109,12 +125,22 @@ function changedAnything(r) {
         r.executionLaneWordsRenamed > 0 ||
         r.sessionExtRowsMoved > 0 ||
         r.sessionMetaColumnsDropped > 0 ||
+        r.withdrawMarkWritten > 0 ||
+        r.sessionDeletingSwitchMarked > 0 ||
+        r.runErrorCodeColumnRewritten > 0 ||
+        r.runObjectivePreviewRewritten > 0 ||
+        r.shellSentinelOwnersCleared > 0 ||
+        r.shellSentinelOwnerRowsRetained.length > 0 ||
+        r.checkpointHostSessionsBackfilled > 0 ||
+        r.legacySkillExemptionsDropped > 0 ||
         r.executionPlacementSessionsUnreadable.length > 0 ||
         r.localArchiveRowFactsBackfilled > 0 ||
         r.localArchivesAnonymized > 0 ||
         r.localArchivesKeptStamped.length > 0 ||
         r.localArchivesUnreadable.length > 0 ||
         r.localArchiveSnapshotsRecovered > 0 ||
+        r.localArchiveTokensAdopted > 0 ||
+        r.localArchiveTokensMinted > 0 ||
         r.askCauseColumnsChanged > 0 ||
         r.askParkTriggersMoved > 0 ||
         r.askJournalRecordsUpgraded > 0 ||
@@ -125,13 +151,12 @@ function changedAnything(r) {
 function readingsSnapshot(r) {
     return {
         ...r,
-        undurableScopeRuleRows: [...r.undurableScopeRuleRows],
-        undurableScopeRuleBucketsUnreadable: [...r.undurableScopeRuleBucketsUnreadable],
         sessionRuleRowsWithRetiredBuckets: [...r.sessionRuleRowsWithRetiredBuckets],
         sessionRuleRowsWithOldGrammarEntries: [...r.sessionRuleRowsWithOldGrammarEntries],
         sessionRuleRowsWithUnreadableDeny: [...r.sessionRuleRowsWithUnreadableDeny],
         parkedApprovalCardRowsUnreadable: [...r.parkedApprovalCardRowsUnreadable],
         parkedApprovalCardRowsTooLong: [...r.parkedApprovalCardRowsTooLong],
+        shellSentinelOwnerRowsRetained: [...r.shellSentinelOwnerRowsRetained],
         executionPlacementSessionsUnreadable: [...r.executionPlacementSessionsUnreadable],
         localArchivesKeptStamped: [...r.localArchivesKeptStamped],
         localArchivesUnreadable: [...r.localArchivesUnreadable],
@@ -144,7 +169,6 @@ function receiptSentence(r) {
         .filter(([, v]) => (typeof v === "number" ? v > 0 : v !== undefined))
         .map(([k, v]) => `${k}=${String(v)}`);
     const rows = [
-        ...r.undurableScopeRuleRows.map((x) => `removed ${x.kind} in permission-rule bucket ${x.ownerKey} (${x.behavior} ${x.tool}, scope root ${JSON.stringify(x.scopeRoot)})`),
         ...r.sessionRuleRowsWithOldGrammarEntries.map((x) => `${x.policyKey} (session ${x.sessionId}): toolAllowDropped=${JSON.stringify(x.toolAllowDropped)}`),
         ...r.sessionRuleRowsWithUnreadableDeny.map((x) => `${x.policyKey} (session ${x.sessionId}): left as stored, toolDenyUnreadable=${JSON.stringify(x.toolDenyUnreadable)}${x.retiredBuckets !== undefined ? `, retiredBuckets=${JSON.stringify(x.retiredBuckets)}` : ""}`),
         ...r.importedLayerRootAllowsRetired.map((x) => `retired ${x.addsRetired} imported add(s) of an allow ${x.tool} rule in permission-rule bucket ${x.ownerKey} (${x.stillLive ? "the rule stays in effect through another approval" : "the rule no longer takes effect"})`),
@@ -161,36 +185,18 @@ export class OneTimeMigrationInterruptedError extends Error {
         this.receipts = receipts;
     }
 }
+const WORKFLOW_JOURNAL_TABLE = "workflow_journal";
+const WORKFLOW_JOURNAL_OWNER_TABLE = "workflow_journal_owner";
+const WORKFLOW_JOURNAL_STAGING = `${WORKFLOW_JOURNAL_TABLE}_m24`;
+const WORKFLOW_JOURNAL_RETIRED = `${WORKFLOW_JOURNAL_TABLE}_m24_old`;
+const WORKFLOW_JOURNAL_SUPPLIED_COLUMN = "incarnation";
+const RETIRED_JOURNAL_SCOPE_COLUMN = "scope";
+const SESSION_POLICY_TABLE = "session_policy";
+const RETIRED_SESSION_RULES_COLUMN = "rules";
+const OLD_GRAMMAR_SESSION_RULES_COLUMN = "rule_entries_old_grammar";
+const RETIRED_ASK_CAUSE_COLUMN = "denied_reason";
+const ASK_EXECUTION_LANE_COLUMN = "execution_lane";
 export const ONE_TIME_MIGRATIONS = [
-    {
-        id: "M10",
-        introducedIn: "7.119.0",
-        releasedOn: "2026-10-08",
-        removableAfter: "2026-11-07",
-        removal: "删 local 车道的认领臂:`LocalSessionStore.register` 里「属主从没被记下的存量会话 ⇒ 带 principal 的登记认领它」那一支、认领日志行 `session_owner_claimed`" +
-            "(连同店构造参数里只为它存在的 `log` 位)与读本表 M10 行的 `ownerClaimWindowOpen`;`security.ts` `createAuthorizer` 里对无主会话的那次认领 `register` 调用;" +
-            "`http/routes/sessions.ts` 409 `conflict.session_ownerless` 句里「Ways out: on the local backend, during the upgrade window …」那半句(连同冻结表 " +
-            "`test/api-error-text-freeze.test.ts` 那一行、契约码目录 `docs/ASSISTANT-WIRE-CONTRACT.md` 那一行);本文件的 `migrationWindowOpen`(若再无别的读者)",
-        afterRemoval: "没有响亮臂(删码本身零行为变化:窗关那一刻起认领臂已经不生效):属主从没被记下的存量会话(边档那一格只有化身 —— 跳过了带本条的版本直接升," +
-            "或窗内从没被带 principal 提交过)照旧答无主(`headOf(id)?.owner` = null):它的会话规则这条路由读不了也改不了(409 `conflict.session_ownerless`)," +
-            "已存的规则对写下它们的 principal 的 run 照旧生效;出路 = 删会话(`DELETE /v1/sessions/:id`,规则随之删)",
-        reportKeys: [],
-    },
-    {
-        id: "M11",
-        introducedIn: "7.120.0",
-        releasedOn: "2026-10-08",
-        removableAfter: "2026-11-07",
-        removal: "删 migrateOn 的 M11 步(`permission_rule` 在场探针 + `purgeUndurableScopeRows` 调用)与 `permission-rule-store-sql.ts` 的 `purgeUndurableScopeRows` / " +
-            "`purgeOneBucket` / `contentFreeRefusal` / `UndurableScopeRuleRow` / `UnreadableRuleBucket` / `UndurableScopePurgeReadings` / " +
-            "`UndurableScopePurgeDb` / `UNDURABLE_PURGE_PAGE` / `UNDURABLE_PURGE_OCC_ATTEMPTS`、本文件的 `removedRuleRowNote`,以及 `BucketRefusedError` 的 `verdict` 位(若届时再无别的读者;" +
-            "判官 `decodeBucketRow` 与写法 `writeBucket` 是读腿 / 写臂本身,留);报告、日志行(含逐行的 `permission_rule_row_removed` 与逐桶的 " +
-            "`permission_rule_bucket_unreadable`)与 `NO_SQL_MIGRATIONS` 的 `undurableScopeRuleRows` / `undurableScopeRuleBucketsDeferred` / `undurableScopeRuleBucketsUnreadable`",
-        afterRemoval: "引擎读侧的既有响亮臂:scope root 不是完整绝对路径的存量行(跳过了带本条的版本直接升的库,或窗关之后别的写者写进来的)在有效视图里被丢、" +
-            "每次 run 一条 `permission.rule_row_dropped`(点名规则与 root)—— 那一行不参与任何检查,但撤销口删不动它(引擎的写臂对这种 scope 同样拒);" +
-            "出路 = 运维在库里把那只桶的那一行删掉(整桶 OCC 回写,指纹按 `buildRuleBucketChecksum` 重算)",
-        reportKeys: ["undurableScopeRuleRows", "undurableScopeRuleBucketsDeferred", "undurableScopeRuleBucketsUnreadable"],
-    },
     {
         id: "M12",
         introducedIn: "7.122.0",
@@ -260,6 +266,7 @@ export const ONE_TIME_MIGRATIONS = [
             "出路是先在一只带本条的版本上起服一次;② 行里仍带退役命令桶:SQL 店读回照旧答 `corrupt`(引擎的形读法点名那只桶,与本条在场时同一个结局),只是起服日志不再逐行点名 —— " +
             "运维在库里把那一行改写成引擎文法或删掉它(删会话即删规则);③ 跳过本条直接升的库同样没有改名那一拍的条目判读 —— 由 ① 的拒启接住(出路同 ①)",
         reportKeys: ["sessionRuleColumn", "sessionRuleRowsWithRetiredBuckets", "sessionRuleRowsWithOldGrammarEntries", "sessionRuleRowsWithUnreadableDeny"],
+        shapeChanges: [{ kind: "rename", table: SESSION_POLICY_TABLE, from: [RETIRED_SESSION_RULES_COLUMN, OLD_GRAMMAR_SESSION_RULES_COLUMN], to: SESSION_RULES_COLUMN.name }],
     },
     {
         id: "M18",
@@ -313,7 +320,7 @@ export const ONE_TIME_MIGRATIONS = [
         removal: "删 `src/stored-request-hooks-m20.ts` 整只文件(`storedHooksRereadM20` / `rereadStoredHooksM20` / `StoredHooksRereadM20` / `MATCHER_FIELD_NAMES` / `nodeAt` / `cloneDoc` / `removeKeyAt`);" +
             "`boot/resolve-spec.ts` 里递给 `parseTaskSettings` 的重读座实参(`opts?.leg === \"fresh\" || !taskHooksHonored(config) ? {} : { storedHooksReread: storedHooksRereadM20(…) }`)与它的 import、" +
             "`hooks_read_as_before_upgrade` 那一段 warn;`task-settings.ts` 的 `ParseTaskSettingsSeats` / `ParseTaskSettingsResult.hooksReread` / `parseTaskSettings` 第二形参与 hooks 臂里的重读那一支;" +
-            "`hooks/hook-runner.ts` 的 `ParseHooksConfigResult.pieces` / `HooksRefusalPiece`(若再无别的读者)与 `hooksCoordinate` 的 export;" +
+            "`hooks/hook-runner.ts` 的 `ParseHooksConfigResult.pieces` / `HooksRefusalPiece`(若再无别的读者);" +
             "「请求成员读不出」一问上的重读座走线:`unread-request-members.ts` 的 `storedHooksRereadM20` import 与 `unreadRequestMembers` 里 `hooksReread` 那一行(递给 `parseTaskSettings` 的 `storedHooksReread` 座)、" +
             "`UnreadMembersLeg` 续跑臂的 `today` 字段(只为 M20 的窗问它)与 `http/stored-body-replay.ts`、`boot/resolve-spec.ts` 递 `today` 的那两处(`stored-body-replay.ts` 的 `today` 局部若 M19 已删再无读者一并删);" +
             "`test/hooks-stored-reread-m20.test.ts`(窗关那一格 —— 续跑拒 409 `resume_blocked_by_policy` —— 改钉到 `test/hooks-entry-admission.test.ts` 的续跑腿组)",
@@ -380,6 +387,7 @@ export const ONE_TIME_MIGRATIONS = [
         afterRemoval: "起服对账一族的列集探针接住(`schema-consistency.ts` 的 `assertSchemaMatchesCode`,常设):跳过了带本条的版本直接升的库,`workflow_journal` 上仍带 scope 列、没有 incarnation 列 = 库与代码列集不符 ⇒ " +
             "响亮拒启(`config.schema_mismatch`),拒句点名两列;出路是先在带本条的版本(7.133.x)起服一次让它走完,再升",
         reportKeys: ["workflowJournalScopeColumn", "workflowJournalOwnersBackfilled", "workflowJournalForeignScopeRowsRemoved"],
+        shapeChanges: [{ kind: "rebuild", table: WORKFLOW_JOURNAL_TABLE, whilePresent: RETIRED_JOURNAL_SCOPE_COLUMN, supplies: [WORKFLOW_JOURNAL_SUPPLIED_COLUMN] }],
     },
     {
         id: "M25",
@@ -499,27 +507,31 @@ export const ONE_TIME_MIGRATIONS = [
             "`runSqlOneTimeMigrations` 的第三参 `ExecutionPlacementSwitchInput`(若再无别的条目用它)与它在两只 SQL 后端 / 测试夹具上的实参;local 腿(`LocalBackend.runOneTimeMigrations` 里的 `backfillLocalExecutionPlacements` 与 `FileRunStore.sessionIdsWithRuns`);" +
             "`execution-placement-sql.ts` 的 `backfillWriterStatement` / `migrateDeviceBindingsStatement` / `migrateDeviceBindingsOntoSideTableStatements` / `countOrphanBindingsStatement`;报告、日志行与 `NO_SQL_MIGRATIONS` 的 `executionPlacementColumnsAdded` / `deviceBindingsMoved` / " +
             "`deviceBindingsOrphaned` / `deviceBindingTablesDropped` / `executionPlacementsBackfilled` / `executionPlacementSessionsUnreadable` 与 `device_bindings_orphaned` / `execution_placement_session_unreadable` 两行 warn;`test/execution-placement-switch-db-integration.test.ts` 整份与 `test/one-time-migrations.test.ts` 的 M32 组。" +
-            "**local 腿的回填席与它的点名词一并删**:`LocalSessionStore` 的 `executionPlacementBackfill`(属性与构造里的那一臂)、`execution-placement.ts` 的 `LocalPlacementBackfillSeat` / `UnusableArchive` / `UnusableArchiveWord`(含它的 `storage` 词 —— 读存档文件时抛了别的故障、`errno` 随带,该词只有回填点名用)/ `isUnusableArchive`、" +
-            "`ExecutionPlacementSessionUnreadable`;`local-session-store.ts` 里 `placementRead` 并回 `readExecutionPlacement`、`metaRead` 的 unusable 臂与 `forkingOf` 的 `storage` 臂改成就地上抛 `probe.fault`(`archiveFaultWord` / `unusableArchiveOf` 随词删,探针只留「不在」与已知在而用不了的读法);" +
+            "**local 腿的回填席与它的点名词一并删**:`LocalSessionStore` 的 `executionPlacementBackfill`(属性与构造里的那一臂)与它唯一的成员 `backfillPlacement`、`unusableArchiveOfFault`、" +
+            "`execution-placement.ts` 的 `LocalPlacementBackfillSeat` / `LocalPlacementBackfillOutcome` / `UnusableArchive` / `UnusableArchiveWord`(含它的 `storage` 词 —— 读存档文件时抛了别的故障、`errno` 随带,该词只有回填点名用)/ `isUnusableArchive`、" +
+            "`ExecutionPlacementSessionUnreadable`(会话店的观察与存档探针不随删:它们不带这几只型,说不出在不在就原样抛);" +
             "`test/execution-placement-switch-local.test.ts` 与 `test/execution-placement-local-boot-unreadable-e2e.test.ts` 整份。" +
             "**不随本条删**:执行放置八列、会话店的执行席、设备店的首绑 / 换绑两只写(常设的数据形)",
         afterRemoval: "起服对账一族的跳版库拒启臂接住:删码同版把 `device_session` / `device_session_retired` 两张表加进退役 schema 判据(`schema-consistency.ts` 的跳版库探针,先于建表)⇒ " +
             "跳过了带本条的版本直接升的库响亮拒启,出路 = 先在带本条的版本起服一次让切换走完,再升;缺执行放置列的库由列集对账缺列拒启(`config.schema_mismatch`,拒句给 ALTER),同一出路",
         reportKeys: ["executionPlacementColumnsAdded", "deviceBindingsMoved", "deviceBindingsOrphaned", "deviceBindingTablesDropped", "executionPlacementsBackfilled", "askExecutionLanesBackfilled", "executionPlacementSessionsUnreadable"],
+        shapeChanges: [{ kind: "add", table: APPROVAL_ASK_TABLE, column: ASK_EXECUTION_LANE_COLUMN, whilePresent: { table: "session_meta", anyOf: SESSION_EXT_MOVED_COLUMNS.map((c) => c.name) } }],
     },
     {
         id: "M33",
         introducedIn: "7.141.0",
         releasedOn: "2026-10-30",
         removableAfter: "2026-11-29",
-        removal: "删 `LocalSessionStore.migrateLocalArchives` 与它的私有助手 `anonymizeArchiveHeld` / `fillRowFacts`、`settleArchiveSnapshots` 里除最后一句常设臂 `assertNoArchiveSnapshots(dir)` 以外的一切(逐份消化的循环与 `settleArchiveSnapshot`)、" +
-            "`archiveSnapshotsSettled` 字段、`syncArchiveDirectory`、`rowFactsFilled` / `ArchivedRowFacts` / `archivedRowFactsOf` / `ARCHIVE_SNAPSHOT_RECORD` / `ArchiveSnapshotRecord` / `readArchiveSnapshotRecord` / `sameLog` / " +
+        removal: "删 `LocalSessionStore.migrateLocalArchives` 与它的私有助手 `anonymizeArchiveHeld` / `fillRowFacts`、`settleArchiveSnapshots` 整只(逐份消化的循环与 `settleArchiveSnapshot`;`LocalBackend.ensureSchema` 里那一步)—— " +
+            "常设臂 `assertNoArchiveSnapshots`(只读)搬进数据根准入 `local-data-root-admission.ts` 的 `admitLocalDataRoot`(一格,本进程第一笔写之前判)、" +
+            "`archiveSnapshotsSettled` 字段、`rowFactsFilled` / `ARCHIVE_SNAPSHOT_RECORD` / `ArchiveSnapshotRecord` / `readArchiveSnapshotRecord` / `sameLog` / " +
+            "`ArchivedRowFacts` / `archivedRowFactsOf`(M47 仍在树时留着,随 M47 删)/ " +
             "`ArchiveRewriteStep` / `LocalArchiveMigrationReading` / `errnoOf`、" +
-            "`archiveRewriteReadScope` / `noteReplayInArchiveRewriteRead` 与 `createLocalSessionRepo` 座里调它的那一腿、`SidecarMap.syncToDisk`(若再无别的调用方)与 `fsyncPaths`(同);" +
+            "`archiveRewriteReadScope` / `noteReplayInArchiveRewriteRead` 与 `createLocalSessionRepo` 座里调它的那一腿、`SidecarMap.syncToDisk`(若再无别的调用方);" +
             "`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里对 `migrateLocalArchives` 的调用与报告五键的那五行;本文件的 `LocalArchiveKeptReason` / `LocalArchiveKeptStamped` / `LocalArchiveUnreadable`、" +
             "报告 / 收据 / `changedAnything` / `readingsSnapshot` / `readingFields` 里的 `localArchiveRowFactsBackfilled` / `localArchivesAnonymized` / `localArchivesKeptStamped` / `localArchivesUnreadable` / `localArchiveSnapshotsRecovered`、" +
             "`local_archive_kept_stamped` / `local_archive_unreadable` 两行 warn、读数行 note 里的 M33 句与头注 M33 段;`test/local-archive-owner.test.ts` 里标题含 `P3` / `P4` / `P5` / `P6` / `F1` / `F2` / `F3` 的格与 `legacyRoot` / `writeArchive` / `boot` / `M33_ZERO` / `m33Of` 助手。" +
-            "**不随本条删**:行格的 `createdAt` / `forkedFrom` 两键(常设的数据形)、`LocalArchiveSnapshotsPresentError` / `assertNoArchiveSnapshots` / `LOCAL_ARCHIVE_SNAPSHOT_DIR` 与 `LocalBackend.ensureSchema` 里调它的那一句、" +
+            "**不随本条删**:行格的 `createdAt` / `forkedFrom` 两键(常设的数据形)、存档目录屏障 `syncArchiveDirectory` 与 `fsyncPaths`(会话删序的常设一步)、`LocalArchiveSnapshotsPresentError` / `assertNoArchiveSnapshots` / `LOCAL_ARCHIVE_SNAPSHOT_DIR` 与 `LocalBackend.ensureSchema` 里调它的那一句、" +
             "`session-error-wire.ts` 的 `StampedSessionArchiveError` / `STAMPED_SESSION_ARCHIVE_SENTENCE` / `sessionErrorWireOf` 与本店带戳判的唯一读口 `assertArchiveAnonymous`(fork 的源、改日志推送的落点、会话同步导入第一阶段的早拒三处问它)、行上缺建档时刻的 F 类读法(`server.local-session-row.created-at-absent`)",
         afterRemoval: "三只常设臂接住:① 数据根下的快照目录非空 ⇒ 拒启(`config.local_archive_snapshot_present`,点名文件与两条出路);② 跳过了带本条的版本直接升的数据根(或本条留着的存档),带属主戳的存档被 fork、改日志的推送与会话同步导入第一阶段对 fork / stale 的早拒同一只具名拒(409 `conflict.session_archive_stamped` + 固定句,零写 / 行格净零写)," +
             "读 / 续跑 / 拉取照常 —— 出路 = 删掉会话后重推,或升级时先过一次带本条的版本并在窗内起服;③ 行上没有建档时刻的格(同一类数据根)⇒ 列表 / 会话视图 / 交出的元数据读纪元(F 类 tag 计数)",
@@ -540,6 +552,10 @@ export const ONE_TIME_MIGRATIONS = [
             "出路 = 先在带本条的版本起服一次让迁移走完,再升(列册对账见幽灵列 / 缺列同样拒启,但它的拒句给的是加列,不是这一出路 —— 所以退役判据要在删码同版加上);" +
             "② local —— 信封号 1 的日志记录走 File 问账店「认不出的信封号」拒启(`unknown envelope version`,点名文件与出路:用写下它的那一版起服一次,或移开文件)",
         reportKeys: ["askCauseColumnsChanged", "askParkTriggersMoved", "askJournalRecordsUpgraded"],
+        shapeChanges: [
+            { kind: "rename", table: APPROVAL_ASK_TABLE, from: [RETIRED_ASK_CAUSE_COLUMN], to: APPROVAL_ASK_ENDING_CAUSE_COLUMN.name },
+            { kind: "add", table: APPROVAL_ASK_TABLE, column: APPROVAL_ASK_PARK_TRIGGER_COLUMN.name },
+        ],
     },
     {
         id: "M35",
@@ -614,13 +630,15 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.147.0",
         releasedOn: "2026-11-07",
         removableAfter: "2026-12-07",
-        removal: "删 `src/plugins/execution-lane-rename-m40.ts` 整只文件;本文件的 M40 步(`renameRetiredExecutionLaneWordsM40` / `refuseWhileRunsHeartbeat`〔它读的 `readLiveRunHeartbeat` / `LiveRunHeartbeat` 由 M41 共读,M41 也已删码时随之删〕/ `ExecutionLaneRenameRefusedError` / " +
+        removal: "删 `src/plugins/execution-lane-rename-m40.ts` 整只文件;本文件的 M40 步(`renameRetiredExecutionLaneWordsM40` / `refuseWhileRunsHeartbeat`〔它读的 `readLiveRunHeartbeat` / `LiveRunHeartbeat` 由 M41 / M42 共读,两条也已删码时随之删〕/ `ExecutionLaneRenameRefusedError` / " +
             "`EXECUTION_LANE_RENAME_REFUSED_CODE` / `ExecutionLaneRenameInput`,`migrateStepsOn` 第一步那一行与 `SqlOneTimeMigrationInput` 里的那一半)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `executionLaneWordsRenamed`、头注 M40 段;" +
             "`store-backend.ts` 的 `LocalBackend.ensureSchema` 第一步与 `executionLaneWordsRenamed` 字段、两只 SQL 后端递 `liveRunWindowMs` 的那一半;" +
+            "`local-session-store.ts` 的内核 `renameRetiredExecutionLaneWordsInCellsM40` 与数据根准入的具名读者 `readSessionMetaSidecarInWindow`(在内存里套的那一步;准入的解码点改用 `readSessionMetaSidecar`);" +
             "`LocalSessionStore.renameRetiredExecutionLaneWordM40`、`FileApprovalAskStore.renameRetiredExecutionLaneWordM40` 与内核的 `renameExecutionLaneWord`;" +
             "`approval-ask-store-sql.ts` / `execution-placement-sql.ts` 拒句里的 `retiredExecutionLaneHintM40(…)` 补句;`test/execution-lane-rename-m40.test.ts` 整只文件与 `test/execution-placement-switch-db-integration.test.ts` 的 M40 组",
         afterRemoval: "既有读口的拒臂接住(响亮,不再改名):仍带旧词的行 —— 跳过了带本条的版本直接升的库、窗关之后还在写的更早版本副本 —— SQL 问行读口拒、会话执行格读口拒(`ExecutionPlacementRowError`)," +
             "local 会话元数据边档整只严格拒启(`config.schema_mismatch`),local 问账日志由 M32 回填的词表外拒臂拒启(M32 删码之后:那只问行原样装回)。出路 = 升级时先过一次带本条的版本并起服",
+        stopThenStart: "renames the retired execution-lane word \"in-process\" to \"none\" on stored approval asks and sessions; a replica of an earlier version would keep writing the old word after the rename",
         reportKeys: ["executionLaneWordsRenamed"],
     },
     {
@@ -631,10 +649,148 @@ export const ONE_TIME_MIGRATIONS = [
         removal: "删本文件的 M41 步(`moveSessionCellsToSideTable` / `refuseSessionExtMoveWhileRunsHeartbeat` / `deploymentColumnsOnMeta` / `SessionExtMoveRefusedError` / `SESSION_EXT_MOVE_REFUSED_CODE` / " +
             "`SessionExtMoveRefusalReason` / `sameCell` / `SESSION_EXT_MOVE_PAGE`,`migrateStepsOn` 里那两行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `sessionExtRowsMoved` / `sessionMetaColumnsDropped`、头注 M41 段;" +
             "M32 读形里的 `cellsOnSideTable` 判(它读本条的 `deploymentColumnsOnMeta`):M32 还在时改成恒旁表形 —— 删 M32 写 `session_meta` 八列的那些臂(② ④ ④b ⑥ 与 ③ 的 `migrateDeviceBindingsStatement` 臂)," +
-            "留 ③ 的旁表臂(`migrateDeviceBindingsOntoSideTableStatements`:围栏拒句的「采旧」在任何库上仍要能落到执行格);M32 先于本条删码时这些随 M32 一并删;`readLiveRunHeartbeat` 在 M40 也已删码时随之删;`test/session-ext-move-db-integration.test.ts` 整只文件",
+            "留 ③ 的旁表臂(`migrateDeviceBindingsOntoSideTableStatements`:围栏拒句的「采旧」在任何库上仍要能落到执行格);M32 先于本条删码时这些随 M32 一并删;`readLiveRunHeartbeat` 在 M40 与 M42 也已删码时随之删;`test/session-ext-move-db-integration.test.ts` 整只文件",
         afterRemoval: "跳过了带本条的版本直接升上来的库:`session_meta` 上仍带部署格列 ⇒ 起服列册对账拒启(`config.schema_mismatch`,那几列是本树之外的多余列,拒句不给 ALTER —— 出路是带本条的版本);" +
             "部署格从旁表读,旧列上的值不被任何读者读。出路 = 升级时先过一次带本条的版本并起服",
+        stopThenStart: "moves the session deployment cells from session_meta to session_ext and then retires the old columns; a cell an earlier replica writes between the copy and the retirement is lost, and every cell write it makes afterwards fails",
         reportKeys: ["sessionExtRowsMoved", "sessionMetaColumnsDropped"],
+        shapeChanges: [{ kind: "drop", table: "session_meta", columns: SESSION_EXT_MOVED_COLUMNS.map((c) => c.name) }],
+    },
+    {
+        id: "M42",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `src/plugins/scenario-prefix-switch-m42.ts` 整只文件;本文件的 M42 步(`switchScenarioPrefixM42` / `scannedIdentityColumnsM42`,`migrateStepsOn` 第一步那一行)、报告 / 收据 / 日志的 `scenarioPrefixSourcesScanned`、头注 M42 段;" +
+            "`readLiveRunHeartbeat` / `LiveRunHeartbeat` 在 M40 与 M41 也已删码时随之删;`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里 M42 那一腿(`switchLocalScenarioPrefixM42`)与四只 File 店的 `scenarioPrefixOwnerRowsM42`(run / 会话 / 问 / 附件);`test/scenario-prefix-switch-m42.test.ts` 与 `test/scenario-prefix-switch-db-integration.test.ts` 两只文件。" +
+            "标记表 `one-time-migration-marker.ts` 不随删(常设:中央建表语句建它,`Skill` 豁免截点那一行的家);库里留下的 `M42` 标记行 / 数据根里的标记文件无人再读,不删",
+        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升的库,存量里以 `_scn:` 开头的身份被恢复管线读作某个人的场景(拆不出合文法的场景与人的 ⇒ `owner.malformed_subject` 响亮)。" +
+            "出路 = 升级时先过一次带本条的版本并起服(它扫一次、命中即拒启点名)",
+        stopThenStart: "scans stored identities for the reserved scenario prefix and records a marker; an earlier replica does not reserve the prefix and would keep accepting such identities after the scan",
+        reportKeys: ["scenarioPrefixSourcesScanned"],
+    },
+    {
+        id: "M43",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删本文件的 M43 步(`markWithdrawEnabledM43`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `withdrawMarkWritten`、头注 M43 段;" +
+            "`plugins/session-withdraw-sql.ts` 的 `WITHDRAW_MARK_ID` 与部署判据里读标记的那一句(撤回出口无条件启用);标记表 `one-time-migration-marker.ts` 不随删(常设)、`plugins/session-birth.ts` 的 `upgrade_pending` 词与出口计数里的同名词;" +
+            "local 会话元数据格「没有 `clientWrites` 位 ⇒ upgrade_pending」那一臂;库里留下的标记行无人再读,不删(与 M42 同一张标记表)",
+        afterRemoval: "窗 30 天之后更早版本的副本早已不在;标记行不再被任何读者读(留着无害)。跳过了带本条的版本直接升上来的库:撤回出口从第一次起服就启用 —— " +
+            "跨两版以上的混跑本就不被支持(7.147.0 起的停-迁-起)。出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["withdrawMarkWritten"],
+    },
+    {
+        id: "M44",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删本文件的 M44 步(`rewriteRunErrorCodeColumnM44`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `runErrorCodeColumnRewritten`、头注 M44 段;" +
+            "`run-store-sql.ts` 的读侧半场 `m44ErrorCodeReadSide`(行映射的码改成只读列;窗内停驻行列空时读结果体的码)与 `decodeRunResultCellM44`;" +
+            "local 腿 `FileRunStore.migrateRunErrorCodeColumnM44` 与 `LocalBackend.runOneTimeMigrations` 里那一格;`test/run-error-code-column.test.ts` 的 M44 组与双库集成文件的 M44 组",
+        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升上来的库,旧行按列答 —— 停驻两口在列建立之前写下的 `needs_review` 行 `errorCode` 缺席(`review.pending` 仍在 `result` 里)、" +
+            "列里是没折过的原码的旧行答原码;`result.terminal.code` 仍在 `result` 里。调长了停驻终局兜底(`APPROVAL_TERMINAL_BACKSTOP_MS` > 30 天)的部署,窗关时还可能有更早版本写下的停驻没结清,读法同上。" +
+            "出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["runErrorCodeColumnRewritten"],
+    },
+    {
+        id: "M45",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `src/plugins/run-preview-m45.ts` 整个文件;本文件的 M45 步(`rewriteRunObjectivePreviewM45`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `runObjectivePreviewRewritten`、头注 M45 段;" +
+            "local 腿 `FileRunStore.migrateRunObjectivePreviewM45` 与 `LocalBackend.runOneTimeMigrations` 里那一格;" +
+            "`test/run-preview-m45.test.ts` 与 `test/helpers/run-preview-m45-rows.ts` 整个文件、`test/session-preview-single-source-db-integration.test.ts` 的 M45 组",
+        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升上来的库,7.124.0 之前写下的、以注入块起头的预览照旧按列答 —— 会话列表 / `GET /v1/tasks` / 助手任务行名 / 收件箱上显示那段块文本。" +
+            "出路 = 升级时先过一次带本条的版本并起服",
+        reportKeys: ["runObjectivePreviewRewritten"],
+    },
+    {
+        id: "M46",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `src/plugins/approval-exemption-skill-m46.ts` 整个文件;本文件的 M46 步(`dropLegacySkillExemptionsM46`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `legacySkillExemptionsDropped`、头注 M46 段、`logReceiptRows` 里的 `legacy_skill_exemptions_dropped` 一行;" +
+            "`approval-exemption-store.ts` 的 `FileApprovalExemptionStore.dropToolRowsCreatedBeforeM46` 与 `LocalBackend.runOneTimeMigrations` 里那一格;" +
+            "`test/approval-exemption-skill-m46.test.ts` 整个文件、`test/one-time-migrations-db-integration.test.ts` 的 M46 组;" +
+            "跳版拒启臂的豁免:`store-backend.ts` 的 `withRetiredSchemaProbe` 与 `local-data-root-admission.ts` 的 `admitLocalDataRoot` 各一处 `migrationCarried(SKILL_EXEMPTION_CUTOFF_ID)` 实参、" +
+            "`assertSkillExemptionCutoffHeldOnPool` / `judgeSqlSkillExemptionCutoff` / `judgeLocalSkillExemptionCutoff` 的 `carried` 参数与它那一支(臂恒判;截点读不出的拒本来就不看它)。" +
+            "**不随本条删**(常设):`approval-exemption-skill-cutoff.ts` 整只(截点、工具名、两车道的判与落)、标记表 `one-time-migration-marker.ts` 与它的 `M46` 行(截点的家)、" +
+            "数据根里的 `one-time-migration-M46.marker`、`ensureSchema()` 的截点种子行、数据根准入锁内一步的落截点、`approval-exemption-store.ts` 的 `readExemptionLog`",
+        afterRemoval: "跳版拒启臂接住(常设,起服对账一族,先于本次起服对这只库的任何写;`approval-exemption-skill-cutoff.ts`):库里有首次放行早于 `Skill` 豁免截点 T0 的 `Skill` 行" +
+            "(SQL:标记表 `M46` 行 / local:`one-time-migration-M46.marker`;T0 缺席 ⇒ 任一 `Skill` 行)⇒ 拒启 `config.schema_mismatch`,零写 —— " +
+            "SQL 在 `ensureSchema()` 建表之前(`LegacySkillExemptionsPresentError`,与退役 schema 探针同一处),local 在数据根准入(读数种别 `skipped-required-migration`)。" +
+            "出路 = 先用一个仍带本条、不低于 7.148.0(local 还要不低于拒句里已记的引擎高水位)的版本对这只库完整起一次,再升;SQL 另可手工 `DELETE FROM approval_exemption WHERE tool_name = 'Skill'`。" +
+            "T0 由常设的一步落(SQL:`ensureSchema()` 建表之后的种子行;local:准入的锁内一步):判过、缺席才落 —— 删码之后全新的库照样有 T0,不会被自己写下的合法行拒",
+        reportKeys: ["legacySkillExemptionsDropped"],
+    },
+    {
+        id: "M47",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `LocalSessionStore.adoptArchiveTokensM47`(含欠账起服的 `required` 分档、证明 `assertArchiveTokensAdoptedM47` / `adoptionScopeOf` / `skippedFromAdoption` 与它那一处销账)与 `LocalArchiveTokenAdoption`;" +
+            "收令牌欠账的记账(`recordArchiveTokenAdoptionPending`);窗内长第一格的规则 `firstCellIncarnationOf` / `LocalSessionStore.firstCellIncarnationHeld`(调用点 —— 补铸、登记、执行位回填、M33 的行回填与快照恢复 —— 回到新铸);" +
+            "`judgeArchiveTokenAdoptionDuty` 的 `adoptionCarried` 参数与 `record` 那一支(`ArchiveTokenAdoptionDutyAction` 随之少 `record`,`settleArchiveTokenAdoptionDuty` 的那一臂同删)、`local-data-root-admission.ts` 里传它的那一处 `migrationCarried(\"M47\")`(臂恒判);" +
+            "`LocalBackend.ensureSchema` 里对 `adoptArchiveTokensM47` 的调用与两只读数字段、`runOneTimeMigrations` 里报告两键那几行;报告 / 收据 / `changedAnything` / `readingFields` / `NO_SQL_MIGRATIONS` 的 `localArchiveTokensAdopted` / `localArchiveTokensMinted`、头注 M47 段;" +
+            "M33 也已删码时连同 `archivedRowFactsOf` / `ArchivedRowFacts`;`test/local-root-one-row-store.test.ts` 里标题含 `P3` / `P4` 的格。" +
+            "**不随本条删**:跳版拒启臂 `judgeArchiveTokenAdoptionDuty`(不带本条那一支:标记在而无格存档为零 ⇒ `discharge`)/ `settleArchiveTokenAdoptionDuty` / `readSessionMetaCellsSync` / `archiveTokenAdoptionPendingPresent` / `dischargeArchiveTokenAdoptionPending` / `ARCHIVE_TOKEN_ADOPTION_SINCE`、读数种别 `skipped-required-migration` 与它按高水位分支的拒句(常设)",
+        afterRemoval: "跳版拒启臂接住(常设,数据根准入的一格:只读、本进程第一笔写之前、引擎高水位抬之前):(打开之前的引擎高水位早于 7.148.0 或缺席 ∨ 数据根里的收令牌欠账标记还在 —— 带本条的版本打开过、没收完)" +
+            "∧ 根里有存档在而会话元数据格缺的会话 ⇒ 拒启 `config.schema_mismatch`(读数种别 `skipped-required-migration`,点名会话数与版本),零写、不抬高水位 —— " +
+            "出路 = 先用一个仍带本条、不低于 7.148.0 且不低于已记高水位的版本(服务或 run-local)完整起一次,再升",
+        reportKeys: ["localArchiveTokensAdopted", "localArchiveTokensMinted"],
+    },
+    {
+        id: "M48",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `src/plugins/shell-sentinel-owner-m48.ts` 整个文件;本文件的 M48 步(`clearShellSentinelOwnersM48`,`migrateStepsOn` 里那一行)、报告 / 收据 / `changedAnything` / `readingFields` / `readingsSnapshot` / 日志的 `shellSentinelOwnersCleared` 与 `shellSentinelOwnerRowsRetained`(连同 `logReceiptRows` 里 `shell_sentinel_rows_retained` 那一支)、头注 M48 段;" +
+            "`SqlOneTimeMigrationInput` 里 M48 那一半(`ShellSentinelOwnerInput`)与它在两只 SQL 后端 / 测试夹具上的实参(`identityBoundary`);" +
+            "local 腿 `LocalSessionStore.clearShellSentinelOwnersM48` / `countShellSentinelOwnersM48` 与 `FileRunStore.clearShellSentinelOwnersM48` / `countShellSentinelOwnersM48`,以及 `LocalBackend.runOneTimeMigrations` 里那两格(改写读数与留存读数)(连同后端的 `identityBoundary` 字段);部署形表行 `identityBoundary` 不随删(dev-open 判据读它);" +
+            "`test/shell-sentinel-owner-m48.test.ts` 整个文件、`test/one-time-migrations-db-integration.test.ts` 的 M48 组",
+        afterRemoval: "没有响亮臂(如实):没有身份边界的部署跳过了带本条的版本直接升上来,哨兵属主的存量行仍记着那个字面量,属主面表已不认它 —— 不带主体的本地单用户读不到、续不上那些会话与 run(404)," +
+            "带同一个头的请求仍读得到(属主相同)。出路 = 升级时先过一次带本条的版本并起服(或运维手工 `UPDATE <表> SET owner = NULL WHERE owner = 'anon:shell-live'`,三张表见删法)。" +
+            "有身份边界的部署本条本来就零改写,删码前后同答(哨兵是一位普通的具名属主)",
+        reportKeys: ["shellSentinelOwnersCleared", "shellSentinelOwnerRowsRetained"],
+    },
+    {
+        id: "M49",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删本文件的 M49 步(`backfillCheckpointHostSessionsM49`,`migrateStepsOn` 里那一行)与 `HOST_SESSION_BACKFILL_PAGE`、报告 / 收据 / 日志的 `checkpointHostSessionsBackfilled`、头注 M49 段;" +
+            "local 腿 `LocalCheckpointStore.backfillHostSessionsM49` 与 `LocalBackend.runOneTimeMigrations` 里那一格;`test/checkpoint-host-session.test.ts` 的 M49 组、" +
+            "`test/one-time-migrations-db-integration.test.ts` 的 M49 组。**不随本条删**:`host_session_id` 列、写口的 `hostSessionOf`、按 run 找卡的读口(常设)",
+        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升上来的库,升级前停下、升级后仍挂着的卡归属为空 —— 按 run 找卡的读口找不到它:取消那条 run 不作废它、" +
+            "两条停驻收割把那条 run 当成「卡已不在」收掉(`approval.expired`)、决断答 409 `conflict.resume_context_unavailable`,卡由终局兜底收割收走。出路 = 升级前答完 / 拒掉停驻的卡," +
+            "或升级时先过一次带本条的版本并起服(或运维手工 `UPDATE checkpoint SET host_session_id = session_id WHERE host_session_id IS NULL`)",
+        reportKeys: ["checkpointHostSessionsBackfilled"],
+    },
+    {
+        id: "M50",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删 `src/plugins/approval-ask-retired-delete-by-task-m50.ts` 整只文件(`RETIRED_DELETE_BY_TASK_OP_M50` / `retiredDeleteByTaskReplayOpenM50` / `retiredDeleteByTaskClosedWhyM50`);" +
+            "`approval-ask-store-file.ts` 重放里认它的那一段(`replayRecord` 里 `probe.op === RETIRED_DELETE_BY_TASK_OP_M50` 一段)、`retiredDeleteByTaskRecordsM50` 计数与构造器末段那一行 stderr、那一行 import、顶注里随 M50 的那半句;" +
+            "`approval-ask-store-memory.ts` 的 `deleteByTaskM50`;`test/approval-ask-session-cascade.test.ts` 的 M50 组(窗内 / 窗关当天 / 窗关次日 / 坏记录四格与 `withM50Window` 助手);本文件头注 M50 段",
+        afterRemoval: "既有的词表外动词拒启(`approval-ask-store-file.ts` 重放的动词闭集判,拒句点名账本路径,出路 = 用写下它的那一版起服一次或把文件挪开)—— 与窗关之后本条自己的拒启同一个结局,删码零行为变化。" +
+            "会撞上它的是窗内一次都没在带本条的版本上起过服的 local 数据根(跳过本版直接升的),账本里又恰好留着一条嵌入方写下的这只词",
+        reportKeys: [],
+    },
+    {
+        id: "M51",
+        introducedIn: "7.148.0",
+        releasedOn: "2026-11-08",
+        removableAfter: "2026-12-08",
+        removal: "删本文件的 M51 步(`switchSessionDeletingM51` / `SessionDeletingSwitchRefusedError` / `SESSION_DELETING_SWITCH_REFUSED_CODE` / `SESSION_DELETING_MARK_ID`,`migrateStepsOn` 里那一行)、" +
+            "报告 / 收据 / `changedAnything` / `readingFields` / `NO_SQL_MIGRATIONS` 的 `sessionDeletingSwitchMarked`、头注 M51 段;`test/session-deleting-state-db-integration.test.ts` 的 M51 组;" +
+            "库里留下的 `M51` 标记行无人再读,不删。**不随本条删**:在删态本身(列、围栏、规则 L 的在删半、终刀判令牌 —— 常设)、标记表 `one-time-migration-marker.ts`(常设)",
+        afterRemoval: "没有响亮臂(也无需):窗 30 天之后更早版本的副本早已不在;跳过了带本条的版本直接升上来的库 —— 跨两版以上的混跑本就不被支持(7.147.0 起的停-迁-起)。出路 = 升级时先过一次带本条的版本并起服",
+        stopThenStart: "switches session deletion to a deleting state that every replica must read; an earlier replica does not read it and would accept a submission on a session this version is deleting",
+        reportKeys: ["sessionDeletingSwitchMarked"],
     },
 ];
 export function migrationWindowOpen(window, today) {
@@ -648,10 +804,13 @@ export function migrationWindowEnd(id) {
         throw new Error(`one-time-migrations: ${id} is in the unreleased form (removableAfter: null) — there is no window end to quote yet`);
     return row.removableAfter;
 }
+export function migrationCarried(id) {
+    return ONE_TIME_MIGRATIONS.some((w) => w.id === id);
+}
+export function stopThenStartMigrations(registry = ONE_TIME_MIGRATIONS) {
+    return registry.flatMap((row) => (row.stopThenStart === undefined ? [] : [{ id: row.id, reason: row.stopThenStart }]));
+}
 export const NO_SQL_MIGRATIONS = {
-    undurableScopeRuleRows: [],
-    undurableScopeRuleBucketsDeferred: 0,
-    undurableScopeRuleBucketsUnreadable: [],
     sessionRuleColumn: "file-store",
     sessionRuleRowsWithRetiredBuckets: [],
     sessionRuleRowsWithOldGrammarEntries: [],
@@ -679,6 +838,8 @@ export const NO_SQL_MIGRATIONS = {
     deviceBindingTablesDropped: 0,
     sessionExtRowsMoved: 0,
     sessionMetaColumnsDropped: 0,
+    withdrawMarkWritten: 0,
+    sessionDeletingSwitchMarked: 0,
     askCauseColumnsChanged: 0,
     askParkTriggersMoved: 0,
 };
@@ -779,8 +940,14 @@ async function migrateOn(db, dialect, input) {
     return completedReport(receipts);
 }
 async function migrateStepsOn(db, dialect, receipts, input) {
+    await switchScenarioPrefixM42(db, dialect, receipts, input);
     await renameRetiredExecutionLaneWordsM40(db, dialect, receipts, input);
     await refuseSessionExtMoveWhileRunsHeartbeat(db, dialect, input);
+    await switchSessionDeletingM51(db, dialect, receipts, input);
+    await rewriteRunErrorCodeColumnM44(db, dialect, receipts);
+    await rewriteRunObjectivePreviewM45(db, dialect, receipts);
+    await clearShellSentinelOwnersM48(db, dialect, receipts, input);
+    await backfillCheckpointHostSessionsM49(db, dialect, receipts);
     await migrateRetiredCardWords(db, dialect, receipts);
     await splitApprovalAskCauseColumns(db, dialect, receipts);
     await migrateSessionRuleGrammar(db, dialect, receipts);
@@ -788,8 +955,6 @@ async function migrateStepsOn(db, dialect, receipts, input) {
     await backfillParkedApprovalCards(db, dialect, receipts);
     if (await tableExists(db, dialect, "session_meta"))
         await inheritPlacedSessionOwners(db, dialect, receipts);
-    if ((await tableExists(db, dialect, PERMISSION_RULE_TABLE)) && (await columnExists(db, dialect, PERMISSION_RULE_TABLE, "grammar")))
-        await purgeUndurableScopeRows(db, dialect, receipts);
     if ((await tableExists(db, dialect, PERMISSION_RULE_TABLE)) && (await columnExists(db, dialect, PERMISSION_RULE_TABLE, "grammar"))) {
         await retireImportedLayerRootAllows(createSqlImportedLayerRootSource({ dialect, query: (sql, params) => db.query(sql, params) }), receipts);
     }
@@ -799,6 +964,202 @@ async function migrateStepsOn(db, dialect, receipts, input) {
     await dropRejectedMailboxKeys(db, dialect, receipts);
     await switchExecutionPlacement(db, dialect, receipts, input);
     await moveSessionCellsToSideTable(db, dialect, receipts);
+    await markWithdrawEnabledM43(db, dialect, receipts, input);
+    await dropLegacySkillExemptionsM46(db, dialect, receipts);
+}
+const M44_PAGE = 500;
+async function rewriteRunErrorCodeColumnM44(db, dialect, receipts) {
+    if (!(await tableExists(db, dialect, "task_run")))
+        return;
+    receipts.runErrorCodeColumnRewritten += await db.exec("UPDATE task_run SET error_code = NULL WHERE status = 'running' AND error_code IS NOT NULL");
+    let after = "";
+    for (;;) {
+        const page = await db.rows(dialect === "mysql"
+            ? `SELECT task_id, status, updated_at, error_code, ${jsonColumnText(dialect, "result")} FROM task_run WHERE task_id > ? AND result IS NOT NULL AND status <> 'running' ORDER BY task_id LIMIT ${M44_PAGE}`
+            : `SELECT task_id, status, updated_at, error_code, ${jsonColumnText(dialect, "result")} FROM task_run WHERE task_id > $1 AND result IS NOT NULL AND status <> 'running' ORDER BY task_id LIMIT ${M44_PAGE}`, [after]);
+        for (const row of page) {
+            const taskId = String(row["task_id"]);
+            const first = await rewriteOneRunErrorCodeM44(db, dialect, row);
+            if (first !== 0) {
+                if (first > 0)
+                    receipts.runErrorCodeColumnRewritten += 1;
+                continue;
+            }
+            const [now] = await db.rows(dialect === "mysql"
+                ? `SELECT task_id, status, updated_at, error_code, ${jsonColumnText(dialect, "result")} FROM task_run WHERE task_id = ? AND result IS NOT NULL AND status <> 'running'`
+                : `SELECT task_id, status, updated_at, error_code, ${jsonColumnText(dialect, "result")} FROM task_run WHERE task_id = $1 AND result IS NOT NULL AND status <> 'running'`, [taskId]);
+            if (now !== undefined && (await rewriteOneRunErrorCodeM44(db, dialect, now)) > 0)
+                receipts.runErrorCodeColumnRewritten += 1;
+        }
+        if (page.length < M44_PAGE)
+            return;
+        after = String(page[page.length - 1]["task_id"]);
+    }
+}
+async function rewriteOneRunErrorCodeM44(db, dialect, row) {
+    const taskId = String(row["task_id"]);
+    const storedCode = row["error_code"] ?? null;
+    const result = decodeRunResultCellM44(row["result"], taskId);
+    if (result === "unreadable" || result === null)
+        return -1;
+    const target = persistedPlaneOf(result).errorCode ?? storedCode;
+    if (target === storedCode)
+        return -1;
+    return db.exec(dialect === "mysql"
+        ? "UPDATE task_run SET error_code = ? WHERE task_id = ? AND status = ? AND updated_at = ? AND error_code <=> ?"
+        : "UPDATE task_run SET error_code = $1 WHERE task_id = $2 AND status = $3 AND updated_at = $4 AND error_code IS NOT DISTINCT FROM $5", [target, taskId, String(row["status"]), row["updated_at"], storedCode]);
+}
+const M45_PAGE = 500;
+async function rewriteRunObjectivePreviewM45(db, dialect, receipts) {
+    if (!(await tableExists(db, dialect, "task_run")))
+        return;
+    const ph = (i) => (dialect === "mysql" ? "?" : `$${i}`);
+    const coarse = RUN_PREVIEW_COARSE_PREFIXES_M45.map((_, i) => `objective_preview LIKE ${ph(i + 2)}`).join(" OR ");
+    let after = "";
+    for (;;) {
+        const page = await db.rows(`SELECT task_id, objective_preview FROM task_run WHERE task_id > ${ph(1)} AND (${coarse}) ORDER BY task_id LIMIT ${M45_PAGE}`, [after, ...RUN_PREVIEW_COARSE_PREFIXES_M45]);
+        for (const row of page) {
+            const current = row["objective_preview"];
+            if (typeof current !== "string")
+                continue;
+            const target = normalizedRunPreviewM45(current);
+            if (target === undefined || target === current)
+                continue;
+            receipts.runObjectivePreviewRewritten += await db.exec(dialect === "mysql" ? "UPDATE task_run SET objective_preview = ? WHERE task_id = ? AND objective_preview = ?" : "UPDATE task_run SET objective_preview = $1 WHERE task_id = $2 AND objective_preview = $3", [target, String(row["task_id"]), current]);
+        }
+        if (page.length < M45_PAGE)
+            return;
+        after = String(page[page.length - 1]["task_id"]);
+    }
+}
+export async function clearShellSentinelOwnersM48(db, dialect, receipts, input) {
+    const rewrite = input.identityBoundary === false;
+    const sentinelOwner = shellSentinelOwnerWhereM48(dialect);
+    for (const table of SHELL_SENTINEL_OWNER_TABLES_M48) {
+        if (!(await tableExists(db, dialect, table)))
+            continue;
+        if (rewrite) {
+            receipts.shellSentinelOwnersCleared += await db.exec(`UPDATE ${table} SET owner = NULL WHERE ${sentinelOwner}`, [SHELL_SENTINEL_OWNER_M48]);
+            continue;
+        }
+        const rows = Number((await db.rows(`SELECT COUNT(*) AS n FROM ${table} WHERE ${sentinelOwner}`, [SHELL_SENTINEL_OWNER_M48]))[0]?.["n"] ?? 0);
+        if (rows > 0)
+            receipts.shellSentinelOwnerRowsRetained.push({ surface: table, rows });
+    }
+}
+const HOST_SESSION_BACKFILL_PAGE = 500;
+async function backfillCheckpointHostSessionsM49(db, dialect, receipts) {
+    if (!(await tableExists(db, dialect, "checkpoint")) || !(await columnExists(db, dialect, "checkpoint", "host_session_id")))
+        return;
+    const ph = (i) => (dialect === "mysql" ? "?" : `$${i}`);
+    let after = "";
+    for (;;) {
+        const page = (await db.rows(`SELECT token FROM checkpoint WHERE host_session_id IS NULL AND token > ${ph(1)} ORDER BY token ASC LIMIT ${HOST_SESSION_BACKFILL_PAGE}`, [after])).map((r) => String(r.token));
+        if (page.length === 0)
+            return;
+        receipts.checkpointHostSessionsBackfilled += await db.exec(`UPDATE checkpoint SET host_session_id = session_id WHERE host_session_id IS NULL AND token IN (${page.map((_, i) => ph(i + 1)).join(", ")})`, page);
+        after = page[page.length - 1];
+        if (page.length < HOST_SESSION_BACKFILL_PAGE)
+            return;
+    }
+}
+export async function dropLegacySkillExemptionsM46(db, dialect, receipts) {
+    if (!(await tableExists(db, dialect, "approval_exemption")))
+        return;
+    if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
+        await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
+    const ph = (i) => (dialect === "mysql" ? "?" : `$${i}`);
+    const readMark = () => readSqlSkillExemptionCutoff((sql, params) => db.rows(sql, params), dialect);
+    let markedAtMs = await readMark();
+    if (markedAtMs === undefined) {
+        await db.exec(markIfAbsentSql(dialect), [SKILL_EXEMPTION_CUTOFF_ID, Date.now()]);
+        markedAtMs = await readMark();
+    }
+    if (markedAtMs === undefined)
+        throw new Error("one-time migration M46: the marker row is missing right after it was written — refusing to delete rows without a recorded cutoff");
+    const cutoff = new Date(markedAtMs);
+    let after = "";
+    for (;;) {
+        const page = await db.rows(`SELECT session_id FROM approval_exemption WHERE tool_name = ${ph(1)} AND created_at < ${ph(2)} AND session_id > ${ph(3)} ORDER BY session_id LIMIT ${LEGACY_SKILL_EXEMPTION_PAGE}`, [SKILL_EXEMPTION_TOOL_NAME, cutoff, after]);
+        if (page.length === 0)
+            return;
+        const sessionIds = page.map((r) => String(r["session_id"]));
+        receipts.legacySkillExemptionsDropped += await db.exec(`DELETE FROM approval_exemption WHERE tool_name = ${ph(1)} AND created_at < ${ph(2)} AND session_id IN (${sessionIds.map((_, i) => ph(i + 3)).join(", ")})`, [SKILL_EXEMPTION_TOOL_NAME, cutoff, ...sessionIds]);
+        if (page.length < LEGACY_SKILL_EXEMPTION_PAGE)
+            return;
+        after = sessionIds[sessionIds.length - 1];
+    }
+}
+async function markWithdrawEnabledM43(db, dialect, receipts, input) {
+    if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
+        await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
+    const marked = await db.rows(dialect === "mysql" ? `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = ?` : `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = $1`, [WITHDRAW_MARK_ID]);
+    if (marked.length > 0)
+        return;
+    if ((await readLiveRunHeartbeat(db, dialect, input)) !== undefined)
+        return;
+    receipts.withdrawMarkWritten += await db.exec(markIfAbsentSql(dialect), [WITHDRAW_MARK_ID, Date.now()]);
+}
+export const SESSION_DELETING_MARK_ID = "M51";
+export const SESSION_DELETING_SWITCH_REFUSED_CODE = "config.session_deleting_switch_refused";
+export class SessionDeletingSwitchRefusedError extends StoreBootRefusalError {
+    code = SESSION_DELETING_SWITCH_REFUSED_CODE;
+    reason = "live_runs";
+    constructor(live, tail = "") {
+        super(`${SESSION_DELETING_SWITCH_REFUSED_CODE} (reason: live_runs): this version deletes a session through a deleting state that every replica must read ` +
+            `(a submission on a session being deleted is refused), but ${live.liveRuns} running run(s) heartbeated on this database within the last ${live.windowSec}s (REAP_RUN_STALE_SEC) — ` +
+            "a replica of an earlier version may still be serving; it does not read that state and would accept a submission on a session this version is deleting. Nothing was changed and no marker was written. " +
+            stopThenStartAction(live.after) +
+            tail);
+        this.name = "SessionDeletingSwitchRefusedError";
+    }
+}
+async function switchSessionDeletingM51(db, dialect, receipts, input) {
+    if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
+        await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
+    const marked = await db.rows(dialect === "mysql" ? `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = ?` : `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = $1`, [SESSION_DELETING_MARK_ID]);
+    if (marked.length > 0)
+        return;
+    const heartbeat = await readLiveRunHeartbeat(db, dialect, input);
+    if (heartbeat !== undefined)
+        throw new SessionDeletingSwitchRefusedError(heartbeat, await describeUpgradeDriftTail((sql) => db.rows(sql), dialect));
+    receipts.sessionDeletingSwitchMarked += await db.exec(markIfAbsentSql(dialect), [SESSION_DELETING_MARK_ID, Date.now()]);
+}
+export async function scannedIdentityColumnsM42(db, dialect) {
+    const scope = dialect === "mysql" ? "DATABASE()" : "current_schema()";
+    const live = new Set((await db.rows(`SELECT table_name AS t, column_name AS c FROM information_schema.columns WHERE table_schema = ${scope}`)).map((r) => `${String(r["t"] ?? r["T"])}.${String(r["c"] ?? r["C"])}`));
+    const out = [];
+    for (const [table, shape] of await expectedTableShapes(dialect)) {
+        for (const c of shape.columns) {
+            if (!IDENTITY_COLUMN_NAME.test(c.name) || !/^\S+\s+(VAR)?(CHAR|BINARY)\(|^\S+\s+TEXT\b/i.test(c.ddl))
+                continue;
+            if (live.has(`${table}.${c.name}`))
+                out.push({ table, column: c.name });
+        }
+    }
+    return out.sort((a, b) => `${a.table}.${a.column}`.localeCompare(`${b.table}.${b.column}`));
+}
+export async function switchScenarioPrefixM42(db, dialect, receipts, input) {
+    if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
+        await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
+    const marked = await db.rows(dialect === "mysql" ? `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = ?` : `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = $1`, [SCENARIO_PREFIX_MARKER_ID]);
+    if (marked.length > 0)
+        return;
+    const columns = await scannedIdentityColumnsM42(db, dialect);
+    const hits = [];
+    for (const { table, column } of columns) {
+        const sql = dialect === "mysql" ? `SELECT COUNT(*) AS n FROM ${table} WHERE ${column} LIKE ? ESCAPE '!'` : `SELECT COUNT(*) AS n FROM ${table} WHERE ${column} LIKE $1 ESCAPE '!'`;
+        const n = Number((await db.rows(sql, [SCENARIO_PREFIX_LIKE]))[0]?.["n"] ?? 0);
+        if (n > 0)
+            hits.push({ source: `${table}.${column}`, rows: n });
+    }
+    receipts.scenarioPrefixSourcesScanned += columns.length;
+    if (hits.length > 0)
+        throw new ScenarioPrefixSwitchRefusedError("stored_prefix", hits, undefined, await describeUpgradeDriftTail((sql) => db.rows(sql), dialect));
+    const live = await readLiveRunHeartbeat(db, dialect, input);
+    if (live !== undefined)
+        throw new ScenarioPrefixSwitchRefusedError("live_runs", [], live, await describeUpgradeDriftTail((sql) => db.rows(sql), dialect));
+    await db.exec(markIfAbsentSql(dialect), [SCENARIO_PREFIX_MARKER_ID, Date.now()]);
 }
 export const EXECUTION_LANE_RENAME_REFUSED_CODE = "config.execution_lane_rename_refused";
 export class ExecutionLaneRenameRefusedError extends StoreBootRefusalError {
@@ -874,8 +1235,8 @@ async function refuseWhileRunsHeartbeat(db, dialect, pendingRows, input) {
     throw new ExecutionLaneRenameRefusedError(pendingRows, liveRuns, restartAfter, `${pendingRows} stored rows (approval asks / sessions) carry the execution lane word "${RETIRED_EXECUTION_LANE_WORD_M40}", the name an earlier version gave the lane with no execution environment, ` +
         `which this version calls "${RENAMED_EXECUTION_LANE_M40}" and does not read; this boot renames them (one-time migration M40), but ${liveRuns} running runs on this database heartbeat within the last ${windowSec}s ` +
         `(REAP_RUN_STALE_SEC) — a replica of an earlier version is still serving, and it would keep writing the old word after the rename. No stored row was changed. ` +
-        "Stop every replica of the earlier version, then start this version (stop, migrate, start — this release cannot be rolled across replicas of both versions). " +
-        `If every replica is already stopped, those are the runs they left behind: start this version again after ${after}`);
+        stopThenStartAction(after) +
+        (await describeUpgradeDriftTail((sql) => db.rows(sql), dialect)));
 }
 export const SESSION_EXT_MOVE_REFUSED_CODE = "config.session_ext_move_refused";
 export class SessionExtMoveRefusedError extends StoreBootRefusalError {
@@ -891,7 +1252,7 @@ async function deploymentColumnsOnMeta(db, dialect) {
     if (!(await tableExists(db, dialect, "session_meta")))
         return [];
     const present = [];
-    for (const column of SESSION_EXT_COLUMNS)
+    for (const column of SESSION_EXT_MOVED_COLUMNS)
         if (await columnExists(db, dialect, "session_meta", column.name))
             present.push(column);
     return present;
@@ -911,8 +1272,8 @@ export async function refuseSessionExtMoveWhileRunsHeartbeat(db, dialect, input)
     throw new SessionExtMoveRefusedError("live_runs", `${columns.length} session cells (${columns.map((c) => c.name).join(", ")}) still live on session_meta; this version keeps them on the side table ${SESSION_EXT_TABLE} and moves them on this boot ` +
         `(one-time migration M41: copy, verify, then drop the columns), but ${heartbeat.liveRuns} running runs on this database heartbeat within the last ${heartbeat.windowSec}s (REAP_RUN_STALE_SEC) — ` +
         "a replica of an earlier version is still serving; a cell it writes between the copy and the drop would be lost, and every cell write it makes after the drop fails. Nothing was changed. " +
-        "Stop every replica of the earlier version, then start this version (stop, migrate, start — this release cannot be rolled across replicas of both versions). " +
-        `If every replica is already stopped, those are the runs they left behind: start this version again after ${heartbeat.after}`);
+        stopThenStartAction(heartbeat.after) +
+        (await describeUpgradeDriftTail((sql) => db.rows(sql), dialect)));
 }
 export async function moveSessionCellsToSideTable(db, dialect, receipts) {
     const columns = await deploymentColumnsOnMeta(db, dialect);
@@ -942,7 +1303,6 @@ export async function moveSessionCellsToSideTable(db, dialect, receipts) {
     await execUntil(db, `ALTER TABLE session_meta ${names.map((n) => `DROP COLUMN ${n}`).join(", ")}`, async () => (await deploymentColumnsOnMeta(db, dialect)).length === 0);
     receipts.sessionMetaColumnsDropped += columns.length;
 }
-const RETIRED_ASK_CAUSE_COLUMN = "denied_reason";
 function renameAskCauseColumnSql(dialect) {
     return dialect === "mysql"
         ? `ALTER TABLE ${APPROVAL_ASK_TABLE} CHANGE COLUMN ${RETIRED_ASK_CAUSE_COLUMN} ${APPROVAL_ASK_ENDING_CAUSE_COLUMN.mysql}`
@@ -997,7 +1357,7 @@ async function readSwitchShape(db, dialect) {
 }
 async function askTableShape(db, dialect) {
     const askTable = await tableExists(db, dialect, APPROVAL_ASK_TABLE);
-    return { askTable, askLaneColumn: askTable && (await columnExists(db, dialect, APPROVAL_ASK_TABLE, "execution_lane")) };
+    return { askTable, askLaneColumn: askTable && (await columnExists(db, dialect, APPROVAL_ASK_TABLE, ASK_EXECUTION_LANE_COLUMN)) };
 }
 function switchStarted(s) {
     return s.placementColumns.has("execution_role") || s.parkedTable || s.cellsOnSideTable;
@@ -1226,31 +1586,36 @@ export async function switchExecutionPlacement(db, dialect, receipts, input) {
         await step.run({ db, dialect, input, receipts, shape });
 }
 export async function backfillLocalExecutionPlacements(sessionIds, seat, input) {
-    const absent = [];
+    let backfilled = 0;
+    let ambiguous = 0;
     const unreadable = [];
     for (const root of sessionIds) {
-        const reading = await seat.read(root);
-        if (reading === undefined)
+        const out = await seat.backfill(root, input.lanes);
+        if (isUnusableArchive(out)) {
+            unreadable.push({ sessionId: root, fault: out.word, ...(out.errno !== undefined ? { errno: out.errno } : {}) });
             continue;
-        if (isUnusableArchive(reading))
-            unreadable.push({ sessionId: root, fault: reading.word, ...(reading.errno !== undefined ? { errno: reading.errno } : {}) });
-        else if (reading.cell.role === "absent")
-            absent.push({ root, occupant: reading.occupant });
-    }
-    if (absent.length === 0)
-        return { backfilled: 0, unreadable };
-    if (input.lanes.length !== 1) {
-        throw new ExecutionPlacementSwitchRefusedError("backfill_ambiguous", `the local data root holds sessions that have runs but no execution placement (${absent.length}), and the deployment declares ${input.lanes.length === 0 ? "no lane" : `${input.lanes.length} lanes (${input.lanes.join(", ")})`} — ` +
+        }
+        switch (out.outcome) {
+            case "placed":
+                backfilled += 1;
+                break;
+            case "ambiguous":
+                ambiguous += 1;
+                break;
+            case "skipped":
+                break;
+            default: {
+                const unknownOutcome = out;
+                throw new Error(`backfillLocalExecutionPlacements: no outcome ${JSON.stringify(unknownOutcome)}`);
+            }
+        }
+    }
+    if (ambiguous > 0) {
+        throw new ExecutionPlacementSwitchRefusedError("backfill_ambiguous", `the local data root holds sessions that have runs but no execution placement (${ambiguous}), and the deployment declares ${input.lanes.length === 0 ? "no lane" : `${input.lanes.length} lanes (${input.lanes.join(", ")})`} — ` +
             "with more than one lane there is no single right answer, and this server will not guess one. Nothing was changed. " +
             "Start this version once with a single declared lane (REMOTE_EXEC set to one lane), then declare the additional lanes");
     }
-    const lane = input.lanes[0];
-    let placed = 0;
-    for (const { root, occupant } of absent) {
-        if ((await seat.place(root, occupant, { role: "writer", lane })).outcome === "placed")
-            placed += 1;
-    }
-    return { backfilled: placed, unreadable };
+    return { backfilled, unreadable };
 }
 const UNKNOWN_LANE_ASKS_SHOWN = 5;
 export function backfillLocalAskExecutionLanes(store, input) {
@@ -1298,11 +1663,6 @@ async function dropRetiredBreakerTable(db, dialect, receipts) {
     await execUntil(db, `DROP TABLE IF EXISTS ${RETIRED_BREAKER_TABLE}`, async () => !(await tableExists(db, dialect, RETIRED_BREAKER_TABLE)));
     receipts.retiredBreakerTablesDropped += 1;
 }
-const WORKFLOW_JOURNAL_TABLE = "workflow_journal";
-const WORKFLOW_JOURNAL_OWNER_TABLE = "workflow_journal_owner";
-const WORKFLOW_JOURNAL_STAGING = `${WORKFLOW_JOURNAL_TABLE}_m24`;
-const WORKFLOW_JOURNAL_RETIRED = `${WORKFLOW_JOURNAL_TABLE}_m24_old`;
-const RETIRED_JOURNAL_SCOPE_COLUMN = "scope";
 const M24_OWNER_INCARNATION = "m24-backfill";
 const M24_COPY_BATCH_BYTES = 32 * 1024 * 1024;
 const M24_COPY_SCAN_PAGE = 1000;
@@ -1316,7 +1676,7 @@ async function copyJournalInBatches(db, dialect) {
     const T = WORKFLOW_JOURNAL_TABLE;
     const bytes = dialect === "mysql" ? "LENGTH(result)" : "OCTET_LENGTH(result)";
     const copyHead = `INSERT INTO ${WORKFLOW_JOURNAL_STAGING} (run_id, incarnation, ordinal, call_key, result, created_at_ms) ` +
-        `SELECT ${T}.run_id, o.incarnation, ordinal, call_key, ${jsonColumnText(dialect, "result")}, created_at_ms FROM ${T} ` +
+        `SELECT ${T}.run_id, o.${WORKFLOW_JOURNAL_SUPPLIED_COLUMN}, ordinal, call_key, ${jsonColumnText(dialect, "result")}, created_at_ms FROM ${T} ` +
         `JOIN ${WORKFLOW_JOURNAL_OWNER_TABLE} o ON o.run_id = ${T}.run_id AND o.scope = ${T}.${RETIRED_JOURNAL_SCOPE_COLUMN} WHERE `;
     let after;
     for (;;) {
@@ -1378,9 +1738,6 @@ export async function moveWorkflowJournalScope(db, dialect, receipts) {
     }
     receipts.workflowJournalScopeColumn = "moved";
 }
-const SESSION_POLICY_TABLE = "session_policy";
-const RETIRED_SESSION_RULES_COLUMN = "rules";
-const OLD_GRAMMAR_SESSION_RULES_COLUMN = "rule_entries_old_grammar";
 const SESSION_RULES_SCAN_PAGE = 500;
 export function retiredSessionRuleBucketsOf(body) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
@@ -1559,8 +1916,8 @@ async function migrateRetiredCardWords(db, dialect, receipts) {
             return;
     }
 }
-const M21_GATE = { key: "gate", as: "m21_gate" };
-const M21_PENDING_ACTION = { key: "pendingAction", as: "m21_pending_action" };
+const M21_GATE = { path: ["gate"], as: "m21_gate" };
+const M21_PENDING_ACTION = { path: ["pendingAction"], as: "m21_pending_action" };
 const PARKED_ROW_REPAIR_PAGE = 200;
 const QUESTION_CARD = "question";
 const readM21Subtree = createObjectColumnReader();
@@ -1759,9 +2116,6 @@ export async function inheritPlacedSessionOwners(db, dialect, receipts) {
 }
 function readingFields(r) {
     return {
-        undurableScopeRuleRowsRemoved: r.undurableScopeRuleRows.length,
-        undurableScopeRuleBucketsDeferred: r.undurableScopeRuleBucketsDeferred,
-        undurableScopeRuleBucketsUnreadable: r.undurableScopeRuleBucketsUnreadable.length,
         ...(r.sessionRuleColumn !== undefined ? { sessionRuleColumn: r.sessionRuleColumn } : {}),
         sessionRuleRowsWithRetiredBuckets: r.sessionRuleRowsWithRetiredBuckets.length,
         sessionRuleRowsWithOldGrammarEntries: r.sessionRuleRowsWithOldGrammarEntries.length,
@@ -1792,12 +2146,23 @@ function readingFields(r) {
         executionLaneWordsRenamed: r.executionLaneWordsRenamed,
         sessionExtRowsMoved: r.sessionExtRowsMoved,
         sessionMetaColumnsDropped: r.sessionMetaColumnsDropped,
+        scenarioPrefixSourcesScanned: r.scenarioPrefixSourcesScanned,
+        withdrawMarkWritten: r.withdrawMarkWritten,
+        sessionDeletingSwitchMarked: r.sessionDeletingSwitchMarked,
+        runErrorCodeColumnRewritten: r.runErrorCodeColumnRewritten,
+        runObjectivePreviewRewritten: r.runObjectivePreviewRewritten,
+        shellSentinelOwnersCleared: r.shellSentinelOwnersCleared,
+        shellSentinelOwnerRowsRetained: r.shellSentinelOwnerRowsRetained.reduce((n, surface) => n + surface.rows, 0),
+        checkpointHostSessionsBackfilled: r.checkpointHostSessionsBackfilled,
+        legacySkillExemptionsDropped: r.legacySkillExemptionsDropped,
         executionPlacementSessionsUnreadable: r.executionPlacementSessionsUnreadable.length,
         localArchiveRowFactsBackfilled: r.localArchiveRowFactsBackfilled,
         localArchivesAnonymized: r.localArchivesAnonymized,
         localArchivesKeptStamped: r.localArchivesKeptStamped.length,
         localArchivesUnreadable: r.localArchivesUnreadable.length,
         localArchiveSnapshotsRecovered: r.localArchiveSnapshotsRecovered,
+        localArchiveTokensAdopted: r.localArchiveTokensAdopted,
+        localArchiveTokensMinted: r.localArchiveTokensMinted,
         askCauseColumnsChanged: r.askCauseColumnsChanged,
         askParkTriggersMoved: r.askParkTriggersMoved,
         askJournalRecordsUpgraded: r.askJournalRecordsUpgraded,
@@ -1811,11 +2176,7 @@ export function logOneTimeMigrations(log, backend, report) {
         backend,
         ...readingFields(report),
         removableAfter: Object.fromEntries(ONE_TIME_MIGRATIONS.map((w) => [w.id, w.removableAfter])),
-        note: "one-time persisted-data migrations (M10 writes nothing at boot — on the local backend, while its window is open, the first task submitted with a principal " +
-            "on a session written by an earlier version (which recorded no owner) claims that session for the principal, one session_owner_claimed line per claim; " +
-            "M11: persisted permission rules whose project scope root is not a complete absolute path — accepted by earlier versions, dropped on every read " +
-            "by the current engine and not removable through DELETE /v1/rules — removed, one permission_rule_row_removed line per row; a bucket the read path " +
-            "refuses in whole is left untouched, one permission_rule_bucket_unreadable line per bucket; M17: the session-rules column renamed from `rules` to " +
+        note: "one-time persisted-data migrations (M17: the session-rules column renamed from `rules` to " +
             "`rule_entries`, so a build that reads rules under the earlier name-only grammar finds no column to misread; at that rename every row's rule entries " +
             "are read by the engine in the grammar the row carries (none = the grammar before the stamp) and rewritten as the same statement in the current grammar " +
             "(the column carries the in-progress name rule_entries_old_grammar until every row is rewritten, so an interrupted boot resumes there) — toolAllow entries " +
@@ -1893,6 +2254,26 @@ function logReceiptRows(log, backend, r) {
                 "(the next boot then migrates it) or the session is deleted. Named on every boot until then",
         });
     }
+    if (r.shellSentinelOwnerRowsRetained.length > 0) {
+        log.warn("shell_sentinel_rows_retained", {
+            backend,
+            rows: r.shellSentinelOwnerRowsRetained.reduce((n, surface) => n + surface.rows, 0),
+            surfaces: Object.fromEntries(r.shellSentinelOwnerRowsRetained.map((surface) => [surface.surface, surface.rows])),
+            note: "this deployment has an identity boundary, so the one-time migration that clears the old cli shell sentinel owner (`anon:shell-live`) to no owner did not touch these rows: they keep that owner, and only a caller whose principal is exactly that value reads them as its own " +
+                "(on the local backend session_meta = the session-metadata cells and task_run = the run rows). The reading comes from the configuration of THE ONE PROCESS that starts the migration, and the rewrite lands on the whole database / data root and cannot be undone: " +
+                "every process that opens this same database or data root (run-local, an embedding host's boot, a one-off tool process) must carry at least one identity key (service credential, auth bridge, REQUIRE_PRINCIPAL, direct door, read-only trace credential — any one is enough; the rewrite runs only when the starting process has none of them); " +
+                "a process started with no identity key at all first would clear these rows to no owner on the boundary deployment's behalf. To clear them deliberately, run the manual step in MIGRATION.md entry 86 of the 7.148.0 section. Counted on every start until then",
+        });
+    }
+    if (r.legacySkillExemptionsDropped > 0) {
+        log.warn("legacy_skill_exemptions_dropped", {
+            backend,
+            count: r.legacySkillExemptionsDropped,
+            note: "session approval-exemption rows for the engine's Skill tool that were written before this boot's first run of this step (by 7.116.0 or earlier for an activation card or a deployment-list question that named Skill, " +
+                "or by a later version for a call that granted nothing) were deleted: a stored row for a tool by that name would answer a call by that name — and when no skill is loaded a call by that name is another tool, not the activation the person approved. " +
+                "The people in those sessions are asked once more on their next Skill call. Rows written after this step first ran are never touched",
+        });
+    }
     if (r.deviceBindingsOrphaned > 0) {
         log.warn("device_bindings_orphaned", {
             backend,
@@ -1955,17 +2336,6 @@ function logReceiptRows(log, backend, r) {
                 "in the session store by hand if someone should read one, or leave them to the transcript retention",
         });
     }
-    for (const row of r.undurableScopeRuleRows) {
-        log.warn("permission_rule_row_removed", {
-            backend,
-            ownerKey: row.ownerKey,
-            kind: row.kind,
-            behavior: row.behavior,
-            tool: row.tool,
-            scopeRoot: row.scopeRoot,
-            note: removedRuleRowNote(row.kind),
-        });
-    }
     for (const row of r.importedLayerRootAllowsRetired) {
         log.warn("imported_layer_root_allow_retired", {
             backend,
@@ -1993,16 +2363,6 @@ function logReceiptRows(log, backend, r) {
                 "list the rules of every owner you know (`GET /v1/rules`) and remove what should not stand",
         });
     }
-    for (const bucket of r.undurableScopeRuleBucketsUnreadable) {
-        log.warn("permission_rule_bucket_unreadable", {
-            backend,
-            ownerKey: bucket.ownerKey,
-            why: bucket.why,
-            note: "a persisted permission-rule bucket that the read path refuses in whole was left untouched by the one-time removal of rows whose project scope root " +
-                "is not a complete absolute path (removing rows from a bucket the read path refuses would turn that refusal into a readable bucket): every read of it " +
-                "keeps being refused, as before this release, until someone repairs or deletes that row by hand",
-        });
-    }
     for (const row of r.sessionRuleRowsWithOldGrammarEntries) {
         log.warn("session_rule_row_old_grammar_entries", {
             backend,
@@ -2088,18 +2448,4 @@ function importedLayerRootSkipNote(reason) {
         }
     }
 }
-function removedRuleRowNote(kind) {
-    switch (kind) {
-        case "rule":
-            return "a persisted permission rule whose project scope root is not a complete absolute path was removed by a one-time migration: the current engine drops such a row on every read (it protected nothing) and refuses any write naming that scope, so it could not be revoked through DELETE /v1/rules; re-add it with the project's full path if it is still wanted";
-        case "revoked-rule":
-            return "a persisted permission rule row whose project scope root is not a complete absolute path, and which had no live approval left (every approval behind it was already removed, or it never had one), was removed by a one-time migration: the row took effect nowhere before and takes effect nowhere now — no action needed";
-        case "tombstone":
-            return "a revocation record (tombstone) whose project scope root is not a complete absolute path was removed by a one-time migration: it can only cover rules with that same scope, which were removed with it or were never there, so nothing it revoked comes back — no action needed";
-        default: {
-            const unknown = kind;
-            throw new Error(`M11: no log sentence for removed-row kind ${JSON.stringify(unknown)}`);
-        }
-    }
-}
 //# sourceMappingURL=one-time-migrations.js.map