@sema-agent/server 7.148.0 → 7.149.0

package/dist/plugins/one-time-migrations.js

@@ -10,8 +10,9 @@ import { StoreBootRefusalError } from "./store-contracts.js";
 import { decodeRunResultCellM44 } from "./run-store-sql.js";
 import { persistedPlaneOf } from "../terminal.js";
 import { RUN_PREVIEW_COARSE_PREFIXES_M45, normalizedRunPreviewM45 } from "./run-preview-m45.js";
-import { SHELL_SENTINEL_OWNER_M48, SHELL_SENTINEL_OWNER_TABLES_M48 } from "./shell-sentinel-owner-m48.js";
-import { LEGACY_SKILL_EXEMPTION_MARKER_ID, LEGACY_SKILL_EXEMPTION_PAGE, LEGACY_SKILL_EXEMPTION_TOOL_NAME } from "./approval-exemption-skill-m46.js";
+import { SHELL_SENTINEL_OWNER_M48, SHELL_SENTINEL_OWNER_TABLES_M48, shellSentinelOwnerWhereM48 } from "./shell-sentinel-owner-m48.js";
+import { LEGACY_SKILL_EXEMPTION_PAGE } from "./approval-exemption-skill-m46.js";
+import { SKILL_EXEMPTION_TOOL_NAME, readSqlSkillExemptionCutoff } from "./approval-exemption-skill-cutoff.js";
 import { PERMISSION_RULE_TABLE, SqlDurableRulePartitionProvider, isSqlBucketRefusal, isSqlBucketVanished, listRuleBucketOwners } from "./permission-rule-store-sql.js";
 import { SESSION_RULES_COLUMN } from "./session-rules-column.js";
 import { readJsonObjectColumn } from "./sql-json-column.js";
@@ -27,8 +28,9 @@ import { RENAMED_EXECUTION_LANE_M40, RETIRED_EXECUTION_LANE_WORD_M40, retiredExe
 import { retireImportedLayerRootAllows } from "./imported-layer-root-retirement.js";
 import { isUnusableArchive } from "../execution-placement.js";
 import { IDENTITY_COLUMN_NAME, SCENARIO_PREFIX_LIKE, SCENARIO_PREFIX_MARKER_ID, ScenarioPrefixSwitchRefusedError } from "./scenario-prefix-switch-m42.js";
-import { MIGRATION_MARKER_TABLE, migrationMarkerDdl } from "./one-time-migration-marker.js";
-import { expectedTableShapes } from "./schema-consistency.js";
+import { MIGRATION_MARKER_TABLE, SKILL_EXEMPTION_CUTOFF_ID, markIfAbsentSql, migrationMarkerDdl } from "./one-time-migration-marker.js";
+import { describeUpgradeDriftTail, expectedTableShapes } from "./schema-consistency.js";
+import { stopThenStartAction } from "./stop-then-start-sentence.js";
 const RETIRED_SESSION_RULE_BUCKETS = ["commandAllow", "commandDeny"];
 export function buildMigrationReceipts() {
     return {
@@ -66,6 +68,7 @@ export function buildMigrationReceipts() {
         runErrorCodeColumnRewritten: 0,
         runObjectivePreviewRewritten: 0,
         shellSentinelOwnersCleared: 0,
+        shellSentinelOwnerRowsRetained: [],
         checkpointHostSessionsBackfilled: 0,
         legacySkillExemptionsDropped: 0,
         executionPlacementSessionsUnreadable: [],
@@ -127,6 +130,7 @@ function changedAnything(r) {
         r.runErrorCodeColumnRewritten > 0 ||
         r.runObjectivePreviewRewritten > 0 ||
         r.shellSentinelOwnersCleared > 0 ||
+        r.shellSentinelOwnerRowsRetained.length > 0 ||
         r.checkpointHostSessionsBackfilled > 0 ||
         r.legacySkillExemptionsDropped > 0 ||
         r.executionPlacementSessionsUnreadable.length > 0 ||
@@ -152,6 +156,7 @@ function readingsSnapshot(r) {
         sessionRuleRowsWithUnreadableDeny: [...r.sessionRuleRowsWithUnreadableDeny],
         parkedApprovalCardRowsUnreadable: [...r.parkedApprovalCardRowsUnreadable],
         parkedApprovalCardRowsTooLong: [...r.parkedApprovalCardRowsTooLong],
+        shellSentinelOwnerRowsRetained: [...r.shellSentinelOwnerRowsRetained],
         executionPlacementSessionsUnreadable: [...r.executionPlacementSessionsUnreadable],
         localArchivesKeptStamped: [...r.localArchivesKeptStamped],
         localArchivesUnreadable: [...r.localArchivesUnreadable],
@@ -180,6 +185,17 @@ export class OneTimeMigrationInterruptedError extends Error {
         this.receipts = receipts;
     }
 }
+const WORKFLOW_JOURNAL_TABLE = "workflow_journal";
+const WORKFLOW_JOURNAL_OWNER_TABLE = "workflow_journal_owner";
+const WORKFLOW_JOURNAL_STAGING = `${WORKFLOW_JOURNAL_TABLE}_m24`;
+const WORKFLOW_JOURNAL_RETIRED = `${WORKFLOW_JOURNAL_TABLE}_m24_old`;
+const WORKFLOW_JOURNAL_SUPPLIED_COLUMN = "incarnation";
+const RETIRED_JOURNAL_SCOPE_COLUMN = "scope";
+const SESSION_POLICY_TABLE = "session_policy";
+const RETIRED_SESSION_RULES_COLUMN = "rules";
+const OLD_GRAMMAR_SESSION_RULES_COLUMN = "rule_entries_old_grammar";
+const RETIRED_ASK_CAUSE_COLUMN = "denied_reason";
+const ASK_EXECUTION_LANE_COLUMN = "execution_lane";
 export const ONE_TIME_MIGRATIONS = [
     {
         id: "M12",
@@ -250,6 +266,7 @@ export const ONE_TIME_MIGRATIONS = [
             "出路是先在一只带本条的版本上起服一次;② 行里仍带退役命令桶:SQL 店读回照旧答 `corrupt`(引擎的形读法点名那只桶,与本条在场时同一个结局),只是起服日志不再逐行点名 —— " +
             "运维在库里把那一行改写成引擎文法或删掉它(删会话即删规则);③ 跳过本条直接升的库同样没有改名那一拍的条目判读 —— 由 ① 的拒启接住(出路同 ①)",
         reportKeys: ["sessionRuleColumn", "sessionRuleRowsWithRetiredBuckets", "sessionRuleRowsWithOldGrammarEntries", "sessionRuleRowsWithUnreadableDeny"],
+        shapeChanges: [{ kind: "rename", table: SESSION_POLICY_TABLE, from: [RETIRED_SESSION_RULES_COLUMN, OLD_GRAMMAR_SESSION_RULES_COLUMN], to: SESSION_RULES_COLUMN.name }],
     },
     {
         id: "M18",
@@ -370,6 +387,7 @@ export const ONE_TIME_MIGRATIONS = [
         afterRemoval: "起服对账一族的列集探针接住(`schema-consistency.ts` 的 `assertSchemaMatchesCode`,常设):跳过了带本条的版本直接升的库,`workflow_journal` 上仍带 scope 列、没有 incarnation 列 = 库与代码列集不符 ⇒ " +
             "响亮拒启(`config.schema_mismatch`),拒句点名两列;出路是先在带本条的版本(7.133.x)起服一次让它走完,再升",
         reportKeys: ["workflowJournalScopeColumn", "workflowJournalOwnersBackfilled", "workflowJournalForeignScopeRowsRemoved"],
+        shapeChanges: [{ kind: "rebuild", table: WORKFLOW_JOURNAL_TABLE, whilePresent: RETIRED_JOURNAL_SCOPE_COLUMN, supplies: [WORKFLOW_JOURNAL_SUPPLIED_COLUMN] }],
     },
     {
         id: "M25",
@@ -497,13 +515,15 @@ export const ONE_TIME_MIGRATIONS = [
         afterRemoval: "起服对账一族的跳版库拒启臂接住:删码同版把 `device_session` / `device_session_retired` 两张表加进退役 schema 判据(`schema-consistency.ts` 的跳版库探针,先于建表)⇒ " +
             "跳过了带本条的版本直接升的库响亮拒启,出路 = 先在带本条的版本起服一次让切换走完,再升;缺执行放置列的库由列集对账缺列拒启(`config.schema_mismatch`,拒句给 ALTER),同一出路",
         reportKeys: ["executionPlacementColumnsAdded", "deviceBindingsMoved", "deviceBindingsOrphaned", "deviceBindingTablesDropped", "executionPlacementsBackfilled", "askExecutionLanesBackfilled", "executionPlacementSessionsUnreadable"],
+        shapeChanges: [{ kind: "add", table: APPROVAL_ASK_TABLE, column: ASK_EXECUTION_LANE_COLUMN, whilePresent: { table: "session_meta", anyOf: SESSION_EXT_MOVED_COLUMNS.map((c) => c.name) } }],
     },
     {
         id: "M33",
         introducedIn: "7.141.0",
         releasedOn: "2026-10-30",
         removableAfter: "2026-11-29",
-        removal: "删 `LocalSessionStore.migrateLocalArchives` 与它的私有助手 `anonymizeArchiveHeld` / `fillRowFacts`、`settleArchiveSnapshots` 里除最后一句常设臂 `assertNoArchiveSnapshots(dir)` 以外的一切(逐份消化的循环与 `settleArchiveSnapshot`)、" +
+        removal: "删 `LocalSessionStore.migrateLocalArchives` 与它的私有助手 `anonymizeArchiveHeld` / `fillRowFacts`、`settleArchiveSnapshots` 整只(逐份消化的循环与 `settleArchiveSnapshot`;`LocalBackend.ensureSchema` 里那一步)—— " +
+            "常设臂 `assertNoArchiveSnapshots`(只读)搬进数据根准入 `local-data-root-admission.ts` 的 `admitLocalDataRoot`(一格,本进程第一笔写之前判)、" +
             "`archiveSnapshotsSettled` 字段、`rowFactsFilled` / `ARCHIVE_SNAPSHOT_RECORD` / `ArchiveSnapshotRecord` / `readArchiveSnapshotRecord` / `sameLog` / " +
             "`ArchivedRowFacts` / `archivedRowFactsOf`(M47 仍在树时留着,随 M47 删)/ " +
             "`ArchiveRewriteStep` / `LocalArchiveMigrationReading` / `errnoOf`、" +
@@ -532,6 +552,10 @@ export const ONE_TIME_MIGRATIONS = [
             "出路 = 先在带本条的版本起服一次让迁移走完,再升(列册对账见幽灵列 / 缺列同样拒启,但它的拒句给的是加列,不是这一出路 —— 所以退役判据要在删码同版加上);" +
             "② local —— 信封号 1 的日志记录走 File 问账店「认不出的信封号」拒启(`unknown envelope version`,点名文件与出路:用写下它的那一版起服一次,或移开文件)",
         reportKeys: ["askCauseColumnsChanged", "askParkTriggersMoved", "askJournalRecordsUpgraded"],
+        shapeChanges: [
+            { kind: "rename", table: APPROVAL_ASK_TABLE, from: [RETIRED_ASK_CAUSE_COLUMN], to: APPROVAL_ASK_ENDING_CAUSE_COLUMN.name },
+            { kind: "add", table: APPROVAL_ASK_TABLE, column: APPROVAL_ASK_PARK_TRIGGER_COLUMN.name },
+        ],
     },
     {
         id: "M35",
@@ -609,10 +633,12 @@ export const ONE_TIME_MIGRATIONS = [
         removal: "删 `src/plugins/execution-lane-rename-m40.ts` 整只文件;本文件的 M40 步(`renameRetiredExecutionLaneWordsM40` / `refuseWhileRunsHeartbeat`〔它读的 `readLiveRunHeartbeat` / `LiveRunHeartbeat` 由 M41 / M42 共读,两条也已删码时随之删〕/ `ExecutionLaneRenameRefusedError` / " +
             "`EXECUTION_LANE_RENAME_REFUSED_CODE` / `ExecutionLaneRenameInput`,`migrateStepsOn` 第一步那一行与 `SqlOneTimeMigrationInput` 里的那一半)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `executionLaneWordsRenamed`、头注 M40 段;" +
             "`store-backend.ts` 的 `LocalBackend.ensureSchema` 第一步与 `executionLaneWordsRenamed` 字段、两只 SQL 后端递 `liveRunWindowMs` 的那一半;" +
+            "`local-session-store.ts` 的内核 `renameRetiredExecutionLaneWordsInCellsM40` 与数据根准入的具名读者 `readSessionMetaSidecarInWindow`(在内存里套的那一步;准入的解码点改用 `readSessionMetaSidecar`);" +
             "`LocalSessionStore.renameRetiredExecutionLaneWordM40`、`FileApprovalAskStore.renameRetiredExecutionLaneWordM40` 与内核的 `renameExecutionLaneWord`;" +
             "`approval-ask-store-sql.ts` / `execution-placement-sql.ts` 拒句里的 `retiredExecutionLaneHintM40(…)` 补句;`test/execution-lane-rename-m40.test.ts` 整只文件与 `test/execution-placement-switch-db-integration.test.ts` 的 M40 组",
         afterRemoval: "既有读口的拒臂接住(响亮,不再改名):仍带旧词的行 —— 跳过了带本条的版本直接升的库、窗关之后还在写的更早版本副本 —— SQL 问行读口拒、会话执行格读口拒(`ExecutionPlacementRowError`)," +
             "local 会话元数据边档整只严格拒启(`config.schema_mismatch`),local 问账日志由 M32 回填的词表外拒臂拒启(M32 删码之后:那只问行原样装回)。出路 = 升级时先过一次带本条的版本并起服",
+        stopThenStart: "renames the retired execution-lane word \"in-process\" to \"none\" on stored approval asks and sessions; a replica of an earlier version would keep writing the old word after the rename",
         reportKeys: ["executionLaneWordsRenamed"],
     },
     {
@@ -626,8 +652,9 @@ export const ONE_TIME_MIGRATIONS = [
             "留 ③ 的旁表臂(`migrateDeviceBindingsOntoSideTableStatements`:围栏拒句的「采旧」在任何库上仍要能落到执行格);M32 先于本条删码时这些随 M32 一并删;`readLiveRunHeartbeat` 在 M40 与 M42 也已删码时随之删;`test/session-ext-move-db-integration.test.ts` 整只文件",
         afterRemoval: "跳过了带本条的版本直接升上来的库:`session_meta` 上仍带部署格列 ⇒ 起服列册对账拒启(`config.schema_mismatch`,那几列是本树之外的多余列,拒句不给 ALTER —— 出路是带本条的版本);" +
             "部署格从旁表读,旧列上的值不被任何读者读。出路 = 升级时先过一次带本条的版本并起服",
+        stopThenStart: "moves the session deployment cells from session_meta to session_ext and then retires the old columns; a cell an earlier replica writes between the copy and the retirement is lost, and every cell write it makes afterwards fails",
         reportKeys: ["sessionExtRowsMoved", "sessionMetaColumnsDropped"],
-        dropsColumns: { session_meta: SESSION_EXT_MOVED_COLUMNS.map((c) => c.name) },
+        shapeChanges: [{ kind: "drop", table: "session_meta", columns: SESSION_EXT_MOVED_COLUMNS.map((c) => c.name) }],
     },
     {
         id: "M42",
@@ -636,9 +663,10 @@ export const ONE_TIME_MIGRATIONS = [
         removableAfter: "2026-12-08",
         removal: "删 `src/plugins/scenario-prefix-switch-m42.ts` 整只文件;本文件的 M42 步(`switchScenarioPrefixM42` / `scannedIdentityColumnsM42`,`migrateStepsOn` 第一步那一行)、报告 / 收据 / 日志的 `scenarioPrefixSourcesScanned`、头注 M42 段;" +
             "`readLiveRunHeartbeat` / `LiveRunHeartbeat` 在 M40 与 M41 也已删码时随之删;`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里 M42 那一腿(`switchLocalScenarioPrefixM42`)与四只 File 店的 `scenarioPrefixOwnerRowsM42`(run / 会话 / 问 / 附件);`test/scenario-prefix-switch-m42.test.ts` 与 `test/scenario-prefix-switch-db-integration.test.ts` 两只文件。" +
-            "标记表的属主 `one-time-migration-marker.ts` 在 M43 也已删码时随之删;库里留下的标记表 / 数据根里的标记文件无人再读,不删(起服列册对账只核本树声明的表)",
+            "标记表 `one-time-migration-marker.ts` 不随删(常设:中央建表语句建它,`Skill` 豁免截点那一行的家);库里留下的 `M42` 标记行 / 数据根里的标记文件无人再读,不删",
         afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升的库,存量里以 `_scn:` 开头的身份被恢复管线读作某个人的场景(拆不出合文法的场景与人的 ⇒ `owner.malformed_subject` 响亮)。" +
             "出路 = 升级时先过一次带本条的版本并起服(它扫一次、命中即拒启点名)",
+        stopThenStart: "scans stored identities for the reserved scenario prefix and records a marker; an earlier replica does not reserve the prefix and would keep accepting such identities after the scan",
         reportKeys: ["scenarioPrefixSourcesScanned"],
     },
     {
@@ -647,7 +675,7 @@ export const ONE_TIME_MIGRATIONS = [
         releasedOn: "2026-11-08",
         removableAfter: "2026-12-08",
         removal: "删本文件的 M43 步(`markWithdrawEnabledM43`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `withdrawMarkWritten`、头注 M43 段;" +
-            "`plugins/session-withdraw-sql.ts` 的 `WITHDRAW_MARK_ID` 与部署判据里读标记的那一句(撤回出口无条件启用);标记表 `one-time-migration-marker.ts` 在 M42 也已删码时随之删、`plugins/session-birth.ts` 的 `upgrade_pending` 词与出口计数里的同名词;" +
+            "`plugins/session-withdraw-sql.ts` 的 `WITHDRAW_MARK_ID` 与部署判据里读标记的那一句(撤回出口无条件启用);标记表 `one-time-migration-marker.ts` 不随删(常设)、`plugins/session-birth.ts` 的 `upgrade_pending` 词与出口计数里的同名词;" +
             "local 会话元数据格「没有 `clientWrites` 位 ⇒ upgrade_pending」那一臂;库里留下的标记行无人再读,不删(与 M42 同一张标记表)",
         afterRemoval: "窗 30 天之后更早版本的副本早已不在;标记行不再被任何读者读(留着无害)。跳过了带本条的版本直接升上来的库:撤回出口从第一次起服就启用 —— " +
             "跨两版以上的混跑本就不被支持(7.147.0 起的停-迁-起)。出路 = 升级时先过一次带本条的版本并起服",
@@ -685,9 +713,16 @@ export const ONE_TIME_MIGRATIONS = [
         removableAfter: "2026-12-08",
         removal: "删 `src/plugins/approval-exemption-skill-m46.ts` 整个文件;本文件的 M46 步(`dropLegacySkillExemptionsM46`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `legacySkillExemptionsDropped`、头注 M46 段、`logReceiptRows` 里的 `legacy_skill_exemptions_dropped` 一行;" +
             "`approval-exemption-store.ts` 的 `FileApprovalExemptionStore.dropToolRowsCreatedBeforeM46` 与 `LocalBackend.runOneTimeMigrations` 里那一格;" +
-            "`test/approval-exemption-skill-m46.test.ts` 整个文件、`test/one-time-migrations-db-integration.test.ts` 的 M46 组;标记表 `one-time-migration-marker.ts` 在 M42 / M43 也已删码时随之删(库里留下的 `M46` 标记行与数据根里的标记文件无人再读,不删)",
-        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升上来的库,7.116.0 之前写下的 `(会话, \"Skill\")` 豁免行照旧代答「不绑授予」的同名调用 —— 部署自挂一只叫 `Skill` 的工具、没有技能时," +
-            "那个人当年批的是「激活某技能」,代答的却是这只工具的调用。出路 = 升级时先过一次带本条的版本并起服(或运维手工删那些行:`DELETE FROM approval_exemption WHERE tool_name = 'Skill'` / 删会话)",
+            "`test/approval-exemption-skill-m46.test.ts` 整个文件、`test/one-time-migrations-db-integration.test.ts` 的 M46 组;" +
+            "跳版拒启臂的豁免:`store-backend.ts` 的 `withRetiredSchemaProbe` 与 `local-data-root-admission.ts` 的 `admitLocalDataRoot` 各一处 `migrationCarried(SKILL_EXEMPTION_CUTOFF_ID)` 实参、" +
+            "`assertSkillExemptionCutoffHeldOnPool` / `judgeSqlSkillExemptionCutoff` / `judgeLocalSkillExemptionCutoff` 的 `carried` 参数与它那一支(臂恒判;截点读不出的拒本来就不看它)。" +
+            "**不随本条删**(常设):`approval-exemption-skill-cutoff.ts` 整只(截点、工具名、两车道的判与落)、标记表 `one-time-migration-marker.ts` 与它的 `M46` 行(截点的家)、" +
+            "数据根里的 `one-time-migration-M46.marker`、`ensureSchema()` 的截点种子行、数据根准入锁内一步的落截点、`approval-exemption-store.ts` 的 `readExemptionLog`",
+        afterRemoval: "跳版拒启臂接住(常设,起服对账一族,先于本次起服对这只库的任何写;`approval-exemption-skill-cutoff.ts`):库里有首次放行早于 `Skill` 豁免截点 T0 的 `Skill` 行" +
+            "(SQL:标记表 `M46` 行 / local:`one-time-migration-M46.marker`;T0 缺席 ⇒ 任一 `Skill` 行)⇒ 拒启 `config.schema_mismatch`,零写 —— " +
+            "SQL 在 `ensureSchema()` 建表之前(`LegacySkillExemptionsPresentError`,与退役 schema 探针同一处),local 在数据根准入(读数种别 `skipped-required-migration`)。" +
+            "出路 = 先用一个仍带本条、不低于 7.148.0(local 还要不低于拒句里已记的引擎高水位)的版本对这只库完整起一次,再升;SQL 另可手工 `DELETE FROM approval_exemption WHERE tool_name = 'Skill'`。" +
+            "T0 由常设的一步落(SQL:`ensureSchema()` 建表之后的种子行;local:准入的锁内一步):判过、缺席才落 —— 删码之后全新的库照样有 T0,不会被自己写下的合法行拒",
         reportKeys: ["legacySkillExemptionsDropped"],
     },
     {
@@ -695,13 +730,13 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.148.0",
         releasedOn: "2026-11-08",
         removableAfter: "2026-12-08",
-        removal: "删 `LocalSessionStore.adoptArchiveTokensM47`(含欠账起服的 `required` 分档、证明 `assertArchiveTokensAdoptedM47` / `adoptionScopeOf` / `skippedFromAdoption` 与它那一处销账)与 `LocalArchiveTokenAdoption`、`archiveTokenAdoptionCarried`;" +
+        removal: "删 `LocalSessionStore.adoptArchiveTokensM47`(含欠账起服的 `required` 分档、证明 `assertArchiveTokensAdoptedM47` / `adoptionScopeOf` / `skippedFromAdoption` 与它那一处销账)与 `LocalArchiveTokenAdoption`;" +
             "收令牌欠账的记账(`recordArchiveTokenAdoptionPending`);窗内长第一格的规则 `firstCellIncarnationOf` / `LocalSessionStore.firstCellIncarnationHeld`(调用点 —— 补铸、登记、执行位回填、M33 的行回填与快照恢复 —— 回到新铸);" +
-            "`holdArchiveTokenAdoptionDuty` 的 `adoptionCarried` 参数与记账那一支、`store-backend.ts` 判前钩里传它的那一处(臂恒判);" +
+            "`judgeArchiveTokenAdoptionDuty` 的 `adoptionCarried` 参数与 `record` 那一支(`ArchiveTokenAdoptionDutyAction` 随之少 `record`,`settleArchiveTokenAdoptionDuty` 的那一臂同删)、`local-data-root-admission.ts` 里传它的那一处 `migrationCarried(\"M47\")`(臂恒判);" +
             "`LocalBackend.ensureSchema` 里对 `adoptArchiveTokensM47` 的调用与两只读数字段、`runOneTimeMigrations` 里报告两键那几行;报告 / 收据 / `changedAnything` / `readingFields` / `NO_SQL_MIGRATIONS` 的 `localArchiveTokensAdopted` / `localArchiveTokensMinted`、头注 M47 段;" +
             "M33 也已删码时连同 `archivedRowFactsOf` / `ArchivedRowFacts`;`test/local-root-one-row-store.test.ts` 里标题含 `P3` / `P4` 的格。" +
-            "**不随本条删**:跳版拒启臂 `holdArchiveTokenAdoptionDuty`(不带本条那一支:标记在而无格存档为零 ⇒ 销账放行)/ `archiveIdsWithoutCellSync` / `archiveTokenAdoptionPendingPresent` / `dischargeArchiveTokenAdoptionPending` / `ARCHIVE_TOKEN_ADOPTION_SINCE`、读数种别 `skipped-required-migration` 与它按高水位分支的拒句(常设)",
-        afterRemoval: "跳版拒启臂接住(常设,起服对账一族、数据根打开那一刻、引擎高水位抬之前):(打开之前的引擎高水位早于 7.148.0 或缺席 ∨ 数据根里的收令牌欠账标记还在 —— 带本条的版本打开过、没收完)" +
+            "**不随本条删**:跳版拒启臂 `judgeArchiveTokenAdoptionDuty`(不带本条那一支:标记在而无格存档为零 ⇒ `discharge`)/ `settleArchiveTokenAdoptionDuty` / `readSessionMetaCellsSync` / `archiveTokenAdoptionPendingPresent` / `dischargeArchiveTokenAdoptionPending` / `ARCHIVE_TOKEN_ADOPTION_SINCE`、读数种别 `skipped-required-migration` 与它按高水位分支的拒句(常设)",
+        afterRemoval: "跳版拒启臂接住(常设,数据根准入的一格:只读、本进程第一笔写之前、引擎高水位抬之前):(打开之前的引擎高水位早于 7.148.0 或缺席 ∨ 数据根里的收令牌欠账标记还在 —— 带本条的版本打开过、没收完)" +
             "∧ 根里有存档在而会话元数据格缺的会话 ⇒ 拒启 `config.schema_mismatch`(读数种别 `skipped-required-migration`,点名会话数与版本),零写、不抬高水位 —— " +
             "出路 = 先用一个仍带本条、不低于 7.148.0 且不低于已记高水位的版本(服务或 run-local)完整起一次,再升",
         reportKeys: ["localArchiveTokensAdopted", "localArchiveTokensMinted"],
@@ -711,14 +746,14 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.148.0",
         releasedOn: "2026-11-08",
         removableAfter: "2026-12-08",
-        removal: "删 `src/plugins/shell-sentinel-owner-m48.ts` 整个文件;本文件的 M48 步(`clearShellSentinelOwnersM48`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志的 `shellSentinelOwnersCleared`、头注 M48 段;" +
+        removal: "删 `src/plugins/shell-sentinel-owner-m48.ts` 整个文件;本文件的 M48 步(`clearShellSentinelOwnersM48`,`migrateStepsOn` 里那一行)、报告 / 收据 / `changedAnything` / `readingFields` / `readingsSnapshot` / 日志的 `shellSentinelOwnersCleared` 与 `shellSentinelOwnerRowsRetained`(连同 `logReceiptRows` 里 `shell_sentinel_rows_retained` 那一支)、头注 M48 段;" +
             "`SqlOneTimeMigrationInput` 里 M48 那一半(`ShellSentinelOwnerInput`)与它在两只 SQL 后端 / 测试夹具上的实参(`identityBoundary`);" +
-            "local 腿 `LocalSessionStore.clearShellSentinelOwnersM48` / `FileRunStore.clearShellSentinelOwnersM48` 与 `LocalBackend.runOneTimeMigrations` 里那一格(连同后端的 `identityBoundary` 字段);部署形表行 `identityBoundary` 不随删(dev-open 判据读它);" +
+            "local 腿 `LocalSessionStore.clearShellSentinelOwnersM48` / `countShellSentinelOwnersM48` 与 `FileRunStore.clearShellSentinelOwnersM48` / `countShellSentinelOwnersM48`,以及 `LocalBackend.runOneTimeMigrations` 里那两格(改写读数与留存读数)(连同后端的 `identityBoundary` 字段);部署形表行 `identityBoundary` 不随删(dev-open 判据读它);" +
             "`test/shell-sentinel-owner-m48.test.ts` 整个文件、`test/one-time-migrations-db-integration.test.ts` 的 M48 组",
         afterRemoval: "没有响亮臂(如实):没有身份边界的部署跳过了带本条的版本直接升上来,哨兵属主的存量行仍记着那个字面量,属主面表已不认它 —— 不带主体的本地单用户读不到、续不上那些会话与 run(404)," +
             "带同一个头的请求仍读得到(属主相同)。出路 = 升级时先过一次带本条的版本并起服(或运维手工 `UPDATE <表> SET owner = NULL WHERE owner = 'anon:shell-live'`,三张表见删法)。" +
             "有身份边界的部署本条本来就零改写,删码前后同答(哨兵是一位普通的具名属主)",
-        reportKeys: ["shellSentinelOwnersCleared"],
+        reportKeys: ["shellSentinelOwnersCleared", "shellSentinelOwnerRowsRetained"],
     },
     {
         id: "M49",
@@ -752,8 +787,9 @@ export const ONE_TIME_MIGRATIONS = [
         removableAfter: "2026-12-08",
         removal: "删本文件的 M51 步(`switchSessionDeletingM51` / `SessionDeletingSwitchRefusedError` / `SESSION_DELETING_SWITCH_REFUSED_CODE` / `SESSION_DELETING_MARK_ID`,`migrateStepsOn` 里那一行)、" +
             "报告 / 收据 / `changedAnything` / `readingFields` / `NO_SQL_MIGRATIONS` 的 `sessionDeletingSwitchMarked`、头注 M51 段;`test/session-deleting-state-db-integration.test.ts` 的 M51 组;" +
-            "标记表 `one-time-migration-marker.ts` 在 M42 / M43 / M46 也已删码时随之删(库里留下的 `M51` 标记行无人再读,不删)。**不随本条删**:在删态本身(列、围栏、规则 L 的在删半、终刀判令牌 —— 常设)",
+            "库里留下的 `M51` 标记行无人再读,不删。**不随本条删**:在删态本身(列、围栏、规则 L 的在删半、终刀判令牌 —— 常设)、标记表 `one-time-migration-marker.ts`(常设)",
         afterRemoval: "没有响亮臂(也无需):窗 30 天之后更早版本的副本早已不在;跳过了带本条的版本直接升上来的库 —— 跨两版以上的混跑本就不被支持(7.147.0 起的停-迁-起)。出路 = 升级时先过一次带本条的版本并起服",
+        stopThenStart: "switches session deletion to a deleting state that every replica must read; an earlier replica does not read it and would accept a submission on a session this version is deleting",
         reportKeys: ["sessionDeletingSwitchMarked"],
     },
 ];
@@ -768,21 +804,11 @@ export function migrationWindowEnd(id) {
         throw new Error(`one-time-migrations: ${id} is in the unreleased form (removableAfter: null) — there is no window end to quote yet`);
     return row.removableAfter;
 }
-export function columnsRemovedByPendingMigrations(registry = ONE_TIME_MIGRATIONS) {
-    const removals = new Map();
-    for (const row of registry) {
-        for (const [table, columns] of Object.entries(row.dropsColumns ?? {})) {
-            const owners = removals.get(table) ?? new Map();
-            for (const column of columns) {
-                const owner = owners.get(column);
-                if (owner !== undefined)
-                    throw new Error(`one-time-migrations: ${table}.${column} is claimed as dropped by both ${owner} and ${row.id} — one column has one dropping migration`);
-                owners.set(column, row.id);
-            }
-            removals.set(table, owners);
-        }
-    }
-    return removals;
+export function migrationCarried(id) {
+    return ONE_TIME_MIGRATIONS.some((w) => w.id === id);
+}
+export function stopThenStartMigrations(registry = ONE_TIME_MIGRATIONS) {
+    return registry.flatMap((row) => (row.stopThenStart === undefined ? [] : [{ id: row.id, reason: row.stopThenStart }]));
 }
 export const NO_SQL_MIGRATIONS = {
     sessionRuleColumn: "file-store",
@@ -1007,13 +1033,18 @@ async function rewriteRunObjectivePreviewM45(db, dialect, receipts) {
     }
 }
 export async function clearShellSentinelOwnersM48(db, dialect, receipts, input) {
-    if (input.identityBoundary !== false)
-        return;
-    const sentinelOwner = dialect === "mysql" ? "CAST(owner AS BINARY) = CAST(? AS BINARY)" : "owner = $1";
+    const rewrite = input.identityBoundary === false;
+    const sentinelOwner = shellSentinelOwnerWhereM48(dialect);
     for (const table of SHELL_SENTINEL_OWNER_TABLES_M48) {
         if (!(await tableExists(db, dialect, table)))
             continue;
-        receipts.shellSentinelOwnersCleared += await db.exec(`UPDATE ${table} SET owner = NULL WHERE ${sentinelOwner}`, [SHELL_SENTINEL_OWNER_M48]);
+        if (rewrite) {
+            receipts.shellSentinelOwnersCleared += await db.exec(`UPDATE ${table} SET owner = NULL WHERE ${sentinelOwner}`, [SHELL_SENTINEL_OWNER_M48]);
+            continue;
+        }
+        const rows = Number((await db.rows(`SELECT COUNT(*) AS n FROM ${table} WHERE ${sentinelOwner}`, [SHELL_SENTINEL_OWNER_M48]))[0]?.["n"] ?? 0);
+        if (rows > 0)
+            receipts.shellSentinelOwnerRowsRetained.push({ surface: table, rows });
     }
 }
 const HOST_SESSION_BACKFILL_PAGE = 500;
@@ -1038,27 +1069,22 @@ export async function dropLegacySkillExemptionsM46(db, dialect, receipts) {
     if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
         await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
     const ph = (i) => (dialect === "mysql" ? "?" : `$${i}`);
-    const readMark = async () => {
-        const [row] = await db.rows(`SELECT marked_at_ms FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = ${ph(1)}`, [LEGACY_SKILL_EXEMPTION_MARKER_ID]);
-        return row === undefined ? undefined : Number(row["marked_at_ms"]);
-    };
+    const readMark = () => readSqlSkillExemptionCutoff((sql, params) => db.rows(sql, params), dialect);
     let markedAtMs = await readMark();
     if (markedAtMs === undefined) {
-        await db.exec(dialect === "mysql"
-            ? `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES (?, ?) ON DUPLICATE KEY UPDATE migration_id = migration_id`
-            : `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES ($1, $2) ON CONFLICT (migration_id) DO NOTHING`, [LEGACY_SKILL_EXEMPTION_MARKER_ID, Date.now()]);
+        await db.exec(markIfAbsentSql(dialect), [SKILL_EXEMPTION_CUTOFF_ID, Date.now()]);
         markedAtMs = await readMark();
     }
-    if (markedAtMs === undefined || !Number.isFinite(markedAtMs))
-        throw new Error("one-time migration M46: the marker row is missing or unreadable right after it was written — refusing to delete rows without a recorded cutoff");
+    if (markedAtMs === undefined)
+        throw new Error("one-time migration M46: the marker row is missing right after it was written — refusing to delete rows without a recorded cutoff");
     const cutoff = new Date(markedAtMs);
     let after = "";
     for (;;) {
-        const page = await db.rows(`SELECT session_id FROM approval_exemption WHERE tool_name = ${ph(1)} AND created_at < ${ph(2)} AND session_id > ${ph(3)} ORDER BY session_id LIMIT ${LEGACY_SKILL_EXEMPTION_PAGE}`, [LEGACY_SKILL_EXEMPTION_TOOL_NAME, cutoff, after]);
+        const page = await db.rows(`SELECT session_id FROM approval_exemption WHERE tool_name = ${ph(1)} AND created_at < ${ph(2)} AND session_id > ${ph(3)} ORDER BY session_id LIMIT ${LEGACY_SKILL_EXEMPTION_PAGE}`, [SKILL_EXEMPTION_TOOL_NAME, cutoff, after]);
         if (page.length === 0)
             return;
         const sessionIds = page.map((r) => String(r["session_id"]));
-        receipts.legacySkillExemptionsDropped += await db.exec(`DELETE FROM approval_exemption WHERE tool_name = ${ph(1)} AND created_at < ${ph(2)} AND session_id IN (${sessionIds.map((_, i) => ph(i + 3)).join(", ")})`, [LEGACY_SKILL_EXEMPTION_TOOL_NAME, cutoff, ...sessionIds]);
+        receipts.legacySkillExemptionsDropped += await db.exec(`DELETE FROM approval_exemption WHERE tool_name = ${ph(1)} AND created_at < ${ph(2)} AND session_id IN (${sessionIds.map((_, i) => ph(i + 3)).join(", ")})`, [SKILL_EXEMPTION_TOOL_NAME, cutoff, ...sessionIds]);
         if (page.length < LEGACY_SKILL_EXEMPTION_PAGE)
             return;
         after = sessionIds[sessionIds.length - 1];
@@ -1072,21 +1098,19 @@ async function markWithdrawEnabledM43(db, dialect, receipts, input) {
         return;
     if ((await readLiveRunHeartbeat(db, dialect, input)) !== undefined)
         return;
-    receipts.withdrawMarkWritten += await db.exec(dialect === "mysql"
-        ? `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES (?, ?) ON DUPLICATE KEY UPDATE migration_id = migration_id`
-        : `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES ($1, $2) ON CONFLICT (migration_id) DO NOTHING`, [WITHDRAW_MARK_ID, Date.now()]);
+    receipts.withdrawMarkWritten += await db.exec(markIfAbsentSql(dialect), [WITHDRAW_MARK_ID, Date.now()]);
 }
 export const SESSION_DELETING_MARK_ID = "M51";
 export const SESSION_DELETING_SWITCH_REFUSED_CODE = "config.session_deleting_switch_refused";
 export class SessionDeletingSwitchRefusedError extends StoreBootRefusalError {
     code = SESSION_DELETING_SWITCH_REFUSED_CODE;
     reason = "live_runs";
-    constructor(live) {
+    constructor(live, tail = "") {
         super(`${SESSION_DELETING_SWITCH_REFUSED_CODE} (reason: live_runs): this version deletes a session through a deleting state that every replica must read ` +
             `(a submission on a session being deleted is refused), but ${live.liveRuns} running run(s) heartbeated on this database within the last ${live.windowSec}s (REAP_RUN_STALE_SEC) — ` +
             "a replica of an earlier version may still be serving; it does not read that state and would accept a submission on a session this version is deleting. Nothing was changed and no marker was written. " +
-            "Stop every replica of the earlier version, then start this version (stop, migrate, start — this release cannot be rolled across replicas of both versions). " +
-            `If every replica is already stopped, those are the runs they left behind: start this version again after ${live.after}`);
+            stopThenStartAction(live.after) +
+            tail);
         this.name = "SessionDeletingSwitchRefusedError";
     }
 }
@@ -1098,10 +1122,8 @@ async function switchSessionDeletingM51(db, dialect, receipts, input) {
         return;
     const heartbeat = await readLiveRunHeartbeat(db, dialect, input);
     if (heartbeat !== undefined)
-        throw new SessionDeletingSwitchRefusedError(heartbeat);
-    receipts.sessionDeletingSwitchMarked += await db.exec(dialect === "mysql"
-        ? `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES (?, ?) ON DUPLICATE KEY UPDATE migration_id = migration_id`
-        : `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES ($1, $2) ON CONFLICT (migration_id) DO NOTHING`, [SESSION_DELETING_MARK_ID, Date.now()]);
+        throw new SessionDeletingSwitchRefusedError(heartbeat, await describeUpgradeDriftTail((sql) => db.rows(sql), dialect));
+    receipts.sessionDeletingSwitchMarked += await db.exec(markIfAbsentSql(dialect), [SESSION_DELETING_MARK_ID, Date.now()]);
 }
 export async function scannedIdentityColumnsM42(db, dialect) {
     const scope = dialect === "mysql" ? "DATABASE()" : "current_schema()";
@@ -1133,13 +1155,11 @@ export async function switchScenarioPrefixM42(db, dialect, receipts, input) {
     }
     receipts.scenarioPrefixSourcesScanned += columns.length;
     if (hits.length > 0)
-        throw new ScenarioPrefixSwitchRefusedError("stored_prefix", hits);
+        throw new ScenarioPrefixSwitchRefusedError("stored_prefix", hits, undefined, await describeUpgradeDriftTail((sql) => db.rows(sql), dialect));
     const live = await readLiveRunHeartbeat(db, dialect, input);
     if (live !== undefined)
-        throw new ScenarioPrefixSwitchRefusedError("live_runs", [], live);
-    await db.exec(dialect === "mysql"
-        ? `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES (?, ?) ON DUPLICATE KEY UPDATE migration_id = migration_id`
-        : `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES ($1, $2) ON CONFLICT (migration_id) DO NOTHING`, [SCENARIO_PREFIX_MARKER_ID, Date.now()]);
+        throw new ScenarioPrefixSwitchRefusedError("live_runs", [], live, await describeUpgradeDriftTail((sql) => db.rows(sql), dialect));
+    await db.exec(markIfAbsentSql(dialect), [SCENARIO_PREFIX_MARKER_ID, Date.now()]);
 }
 export const EXECUTION_LANE_RENAME_REFUSED_CODE = "config.execution_lane_rename_refused";
 export class ExecutionLaneRenameRefusedError extends StoreBootRefusalError {
@@ -1215,8 +1235,8 @@ async function refuseWhileRunsHeartbeat(db, dialect, pendingRows, input) {
     throw new ExecutionLaneRenameRefusedError(pendingRows, liveRuns, restartAfter, `${pendingRows} stored rows (approval asks / sessions) carry the execution lane word "${RETIRED_EXECUTION_LANE_WORD_M40}", the name an earlier version gave the lane with no execution environment, ` +
         `which this version calls "${RENAMED_EXECUTION_LANE_M40}" and does not read; this boot renames them (one-time migration M40), but ${liveRuns} running runs on this database heartbeat within the last ${windowSec}s ` +
         `(REAP_RUN_STALE_SEC) — a replica of an earlier version is still serving, and it would keep writing the old word after the rename. No stored row was changed. ` +
-        "Stop every replica of the earlier version, then start this version (stop, migrate, start — this release cannot be rolled across replicas of both versions). " +
-        `If every replica is already stopped, those are the runs they left behind: start this version again after ${after}`);
+        stopThenStartAction(after) +
+        (await describeUpgradeDriftTail((sql) => db.rows(sql), dialect)));
 }
 export const SESSION_EXT_MOVE_REFUSED_CODE = "config.session_ext_move_refused";
 export class SessionExtMoveRefusedError extends StoreBootRefusalError {
@@ -1252,8 +1272,8 @@ export async function refuseSessionExtMoveWhileRunsHeartbeat(db, dialect, input)
     throw new SessionExtMoveRefusedError("live_runs", `${columns.length} session cells (${columns.map((c) => c.name).join(", ")}) still live on session_meta; this version keeps them on the side table ${SESSION_EXT_TABLE} and moves them on this boot ` +
         `(one-time migration M41: copy, verify, then drop the columns), but ${heartbeat.liveRuns} running runs on this database heartbeat within the last ${heartbeat.windowSec}s (REAP_RUN_STALE_SEC) — ` +
         "a replica of an earlier version is still serving; a cell it writes between the copy and the drop would be lost, and every cell write it makes after the drop fails. Nothing was changed. " +
-        "Stop every replica of the earlier version, then start this version (stop, migrate, start — this release cannot be rolled across replicas of both versions). " +
-        `If every replica is already stopped, those are the runs they left behind: start this version again after ${heartbeat.after}`);
+        stopThenStartAction(heartbeat.after) +
+        (await describeUpgradeDriftTail((sql) => db.rows(sql), dialect)));
 }
 export async function moveSessionCellsToSideTable(db, dialect, receipts) {
     const columns = await deploymentColumnsOnMeta(db, dialect);
@@ -1283,7 +1303,6 @@ export async function moveSessionCellsToSideTable(db, dialect, receipts) {
     await execUntil(db, `ALTER TABLE session_meta ${names.map((n) => `DROP COLUMN ${n}`).join(", ")}`, async () => (await deploymentColumnsOnMeta(db, dialect)).length === 0);
     receipts.sessionMetaColumnsDropped += columns.length;
 }
-const RETIRED_ASK_CAUSE_COLUMN = "denied_reason";
 function renameAskCauseColumnSql(dialect) {
     return dialect === "mysql"
         ? `ALTER TABLE ${APPROVAL_ASK_TABLE} CHANGE COLUMN ${RETIRED_ASK_CAUSE_COLUMN} ${APPROVAL_ASK_ENDING_CAUSE_COLUMN.mysql}`
@@ -1338,7 +1357,7 @@ async function readSwitchShape(db, dialect) {
 }
 async function askTableShape(db, dialect) {
     const askTable = await tableExists(db, dialect, APPROVAL_ASK_TABLE);
-    return { askTable, askLaneColumn: askTable && (await columnExists(db, dialect, APPROVAL_ASK_TABLE, "execution_lane")) };
+    return { askTable, askLaneColumn: askTable && (await columnExists(db, dialect, APPROVAL_ASK_TABLE, ASK_EXECUTION_LANE_COLUMN)) };
 }
 function switchStarted(s) {
     return s.placementColumns.has("execution_role") || s.parkedTable || s.cellsOnSideTable;
@@ -1644,11 +1663,6 @@ async function dropRetiredBreakerTable(db, dialect, receipts) {
     await execUntil(db, `DROP TABLE IF EXISTS ${RETIRED_BREAKER_TABLE}`, async () => !(await tableExists(db, dialect, RETIRED_BREAKER_TABLE)));
     receipts.retiredBreakerTablesDropped += 1;
 }
-const WORKFLOW_JOURNAL_TABLE = "workflow_journal";
-const WORKFLOW_JOURNAL_OWNER_TABLE = "workflow_journal_owner";
-const WORKFLOW_JOURNAL_STAGING = `${WORKFLOW_JOURNAL_TABLE}_m24`;
-const WORKFLOW_JOURNAL_RETIRED = `${WORKFLOW_JOURNAL_TABLE}_m24_old`;
-const RETIRED_JOURNAL_SCOPE_COLUMN = "scope";
 const M24_OWNER_INCARNATION = "m24-backfill";
 const M24_COPY_BATCH_BYTES = 32 * 1024 * 1024;
 const M24_COPY_SCAN_PAGE = 1000;
@@ -1662,7 +1676,7 @@ async function copyJournalInBatches(db, dialect) {
     const T = WORKFLOW_JOURNAL_TABLE;
     const bytes = dialect === "mysql" ? "LENGTH(result)" : "OCTET_LENGTH(result)";
     const copyHead = `INSERT INTO ${WORKFLOW_JOURNAL_STAGING} (run_id, incarnation, ordinal, call_key, result, created_at_ms) ` +
-        `SELECT ${T}.run_id, o.incarnation, ordinal, call_key, ${jsonColumnText(dialect, "result")}, created_at_ms FROM ${T} ` +
+        `SELECT ${T}.run_id, o.${WORKFLOW_JOURNAL_SUPPLIED_COLUMN}, ordinal, call_key, ${jsonColumnText(dialect, "result")}, created_at_ms FROM ${T} ` +
         `JOIN ${WORKFLOW_JOURNAL_OWNER_TABLE} o ON o.run_id = ${T}.run_id AND o.scope = ${T}.${RETIRED_JOURNAL_SCOPE_COLUMN} WHERE `;
     let after;
     for (;;) {
@@ -1724,9 +1738,6 @@ export async function moveWorkflowJournalScope(db, dialect, receipts) {
     }
     receipts.workflowJournalScopeColumn = "moved";
 }
-const SESSION_POLICY_TABLE = "session_policy";
-const RETIRED_SESSION_RULES_COLUMN = "rules";
-const OLD_GRAMMAR_SESSION_RULES_COLUMN = "rule_entries_old_grammar";
 const SESSION_RULES_SCAN_PAGE = 500;
 export function retiredSessionRuleBucketsOf(body) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
@@ -2141,6 +2152,7 @@ function readingFields(r) {
         runErrorCodeColumnRewritten: r.runErrorCodeColumnRewritten,
         runObjectivePreviewRewritten: r.runObjectivePreviewRewritten,
         shellSentinelOwnersCleared: r.shellSentinelOwnersCleared,
+        shellSentinelOwnerRowsRetained: r.shellSentinelOwnerRowsRetained.reduce((n, surface) => n + surface.rows, 0),
         checkpointHostSessionsBackfilled: r.checkpointHostSessionsBackfilled,
         legacySkillExemptionsDropped: r.legacySkillExemptionsDropped,
         executionPlacementSessionsUnreadable: r.executionPlacementSessionsUnreadable.length,
@@ -2242,6 +2254,17 @@ function logReceiptRows(log, backend, r) {
                 "(the next boot then migrates it) or the session is deleted. Named on every boot until then",
         });
     }
+    if (r.shellSentinelOwnerRowsRetained.length > 0) {
+        log.warn("shell_sentinel_rows_retained", {
+            backend,
+            rows: r.shellSentinelOwnerRowsRetained.reduce((n, surface) => n + surface.rows, 0),
+            surfaces: Object.fromEntries(r.shellSentinelOwnerRowsRetained.map((surface) => [surface.surface, surface.rows])),
+            note: "this deployment has an identity boundary, so the one-time migration that clears the old cli shell sentinel owner (`anon:shell-live`) to no owner did not touch these rows: they keep that owner, and only a caller whose principal is exactly that value reads them as its own " +
+                "(on the local backend session_meta = the session-metadata cells and task_run = the run rows). The reading comes from the configuration of THE ONE PROCESS that starts the migration, and the rewrite lands on the whole database / data root and cannot be undone: " +
+                "every process that opens this same database or data root (run-local, an embedding host's boot, a one-off tool process) must carry at least one identity key (service credential, auth bridge, REQUIRE_PRINCIPAL, direct door, read-only trace credential — any one is enough; the rewrite runs only when the starting process has none of them); " +
+                "a process started with no identity key at all first would clear these rows to no owner on the boundary deployment's behalf. To clear them deliberately, run the manual step in MIGRATION.md entry 86 of the 7.148.0 section. Counted on every start until then",
+        });
+    }
     if (r.legacySkillExemptionsDropped > 0) {
         log.warn("legacy_skill_exemptions_dropped", {
             backend,

package/dist/plugins/org-delivery-quota-store.d.ts

@@ -18,20 +18,43 @@ export interface OrgDeliveryQuotaPolicy {
     /** 一个收件人在一个窗里能收的封数上界(全部发件人合计)。 */
     readonly perRecipient: number;
 }
+/** 一次记账的判决:放行,或拒 + 到店钟当前窗结束的整秒数(头注「拒的判决带重试指引」)。 */
+export type OrgDeliveryQuotaVerdict = {
+    readonly granted: true;
+} | {
+    readonly granted: false;
+    readonly retryAfterSec: number;
+};
+/**
+ * 店读不出自己的状态(File 腿:快照坏了)⇒ **拒用**的那一只错。fail-closed:每一次记账都抛它,绝不当成「放行」。
+ * 两句话各有读者,所以分开存:`message` = 运维句(点名文件与坏处、出路 —— 只进运维日志);{@link ORG_DELIVERY_QUOTA_UNREADABLE_SENTENCE} = 上线的
+ * 固定句(不点名宿主路径、不带坏处原文 —— 调用方是组织里的任何成员,不是运维)。HTTP 兜底(`http/server.ts`)按本类映射成带因的 500
+ * (码字面量只写在那一处发送点,wire 码目录的扫描面看得见它)。
+ */
+export declare const ORG_DELIVERY_QUOTA_UNREADABLE_SENTENCE = "the cross-principal delivery quota state on this server cannot be read, so every delivery is refused until an operator repairs it \u2014 nothing was delivered, and retrying will not change the answer";
+export declare class OrgDeliveryQuotaUnreadableError extends Error {
+    constructor(operatorSentence: string);
+}
 export interface OrgDeliveryQuotaStore {
     /**
-     * 原子地把这位发件人的一次投递**尝试**算进店钟当前窗:未满 ⇒ +1、答 `true`;已满 ⇒ 什么都不记、答 `false`。
+     * 原子地把这位发件人的一次投递**尝试**算进店钟当前窗:未满 ⇒ +1、答放行;已满 ⇒ 什么都不记、答拒(带重试指引)。
      * 店读不出 / 写不进 ⇒ **抛**(调用方按失败处置,绝不当成「放行」)。
      */
-    admitAttempt(fromScope: string, policy: OrgDeliveryQuotaPolicy): Promise<boolean>;
+    admitAttempt(fromScope: string, policy: OrgDeliveryQuotaPolicy): Promise<OrgDeliveryQuotaVerdict>;
     /**
-     * 原子地把一封 (fromScope → toScope) 的信算进**店钟当前窗**的两只计数器:两界都未满 ⇒ 两只各 +1、答 `true`;
-     * 任一界已满 ⇒ 什么都不记、答 `false`。店读不出 / 写不进 ⇒ **抛**。
+     * 原子地把一封 (fromScope → toScope) 的信算进**店钟当前窗**的两只计数器:两界都未满 ⇒ 两只各 +1、答放行;
+     * 任一界已满 ⇒ 什么都不记、答拒(带重试指引)。店读不出 / 写不进 ⇒ **抛**。
      */
-    take(fromScope: string, toScope: string, policy: OrgDeliveryQuotaPolicy): Promise<boolean>;
+    take(fromScope: string, toScope: string, policy: OrgDeliveryQuotaPolicy): Promise<OrgDeliveryQuotaVerdict>;
 }
 /** 窗起点(一处算法,三条腿共用)。 */
 export declare function quotaWindowStart(nowMs: number, windowMs: number): number;
+/**
+ * 拒的判决的退避秒数(三条腿共用的**唯一**算式):店钟 `nowMs` 到当前窗结束,向上取整。≥ 1 是桶公式的推论、不另设下限:`nowMs` 严格早于窗末
+ * (`floor(now / w)` 之下 `(桶 + 1) × w − now ∈ (0, w]`),正数向上取整至少是 1 —— 窗末前最后 1 ms 也答 1,不叫客户端「立刻重试」。
+ * 桶与退避秒数的公式不在这里写第二份:都读 `observability/cost-quota.ts` 的 `alignedWindow` / `retryAfterSecUntil`(成本配额、速率限制器同锚)。
+ */
+export declare function quotaRetryAfterSec(nowMs: number, windowMs: number): number;
 /** 店里记着的那个窗(`heldStart`)的计数此刻还算不算数 —— 头注那条律的**唯一**写法:此刻的窗,或此刻的下一个窗。 */
 export declare function heldWindowCounts(heldStart: number, at: number, windowMs: number): boolean;
 /** 一位发件人的当前窗(`windowMs` = 开窗那一次的窗宽:窗何时结束是条目自己的事实,File 腿据它丢已过窗的条目)。 */
@@ -58,8 +81,8 @@ export declare class MemoryOrgDeliveryQuotaStore implements OrgDeliveryQuotaStor
     protected state: QuotaWindows;
     /** @param nowMs 店钟(单进程腿:店 = 这个进程,缺省本进程墙钟)。 */
     constructor(nowMs?: () => number);
-    admitAttempt(fromScope: string, policy: OrgDeliveryQuotaPolicy): Promise<boolean>;
-    take(fromScope: string, toScope: string, policy: OrgDeliveryQuotaPolicy): Promise<boolean>;
+    admitAttempt(fromScope: string, policy: OrgDeliveryQuotaPolicy): Promise<OrgDeliveryQuotaVerdict>;
+    take(fromScope: string, toScope: string, policy: OrgDeliveryQuotaPolicy): Promise<OrgDeliveryQuotaVerdict>;
     /**
      * 落新的整份状态,只留窗还没结束的条目(按条目自己的窗宽判;已结束的发件人 / 收件人整个丢掉 —— 有界:量 = 本窗活跃的主体数)。
      * 丢掉的条目按头注那条律本来就不再算数(过去的窗),所以剪枝不改任何判决;剪枝写在**这里**而不是 File 腿里,Memory 与 File
@@ -89,16 +112,16 @@ export declare class FileOrgDeliveryQuotaStore extends MemoryOrgDeliveryQuotaSto
         nowMs?: () => number;
         warn?: (event: string, fields: Record<string, unknown>) => void;
     });
-    admitAttempt(fromScope: string, policy: OrgDeliveryQuotaPolicy): Promise<boolean>;
-    take(fromScope: string, toScope: string, policy: OrgDeliveryQuotaPolicy): Promise<boolean>;
+    admitAttempt(fromScope: string, policy: OrgDeliveryQuotaPolicy): Promise<OrgDeliveryQuotaVerdict>;
+    take(fromScope: string, toScope: string, policy: OrgDeliveryQuotaPolicy): Promise<OrgDeliveryQuotaVerdict>;
     protected persist(next: QuotaWindows): void;
 }
 export declare class SqlOrgDeliveryQuotaStore implements OrgDeliveryQuotaStore {
     private readonly db;
     constructor(db: SqlDriver);
     private q;
-    admitAttempt(fromScope: string, policy: OrgDeliveryQuotaPolicy): Promise<boolean>;
-    take(fromScope: string, toScope: string, policy: OrgDeliveryQuotaPolicy): Promise<boolean>;
+    admitAttempt(fromScope: string, policy: OrgDeliveryQuotaPolicy): Promise<OrgDeliveryQuotaVerdict>;
+    take(fromScope: string, toScope: string, policy: OrgDeliveryQuotaPolicy): Promise<OrgDeliveryQuotaVerdict>;
     /**
      * 一个记账事务:库钟先读(池上一条值语句,不在事务里留普通 SELECT),判过 ⇒ 提交,判拒 ⇒ 回滚(零残留)。
      * 🔴 **引擎判了死锁 ⇒ 整事务重来**(`retryOnDeadlock`:全仓唯一的重来写法、唯一的上界与判据):被挑中的一方已整事务回滚、锁全放,