@sema-agent/server 7.148.0 → 7.150.0

package/dist/plugins/one-time-migrations.js

@@ -10,8 +10,9 @@ import { StoreBootRefusalError } from "./store-contracts.js";
 import { decodeRunResultCellM44 } from "./run-store-sql.js";
 import { persistedPlaneOf } from "../terminal.js";
 import { RUN_PREVIEW_COARSE_PREFIXES_M45, normalizedRunPreviewM45 } from "./run-preview-m45.js";
-import { SHELL_SENTINEL_OWNER_M48, SHELL_SENTINEL_OWNER_TABLES_M48 } from "./shell-sentinel-owner-m48.js";
-import { LEGACY_SKILL_EXEMPTION_MARKER_ID, LEGACY_SKILL_EXEMPTION_PAGE, LEGACY_SKILL_EXEMPTION_TOOL_NAME } from "./approval-exemption-skill-m46.js";
+import { SHELL_SENTINEL_OWNER_M48, SHELL_SENTINEL_OWNER_TABLES_M48, shellSentinelOwnerWhereM48 } from "./shell-sentinel-owner-m48.js";
+import { LEGACY_SKILL_EXEMPTION_PAGE } from "./approval-exemption-skill-m46.js";
+import { SKILL_EXEMPTION_TOOL_NAME, readSqlSkillExemptionCutoff } from "./approval-exemption-skill-cutoff.js";
 import { PERMISSION_RULE_TABLE, SqlDurableRulePartitionProvider, isSqlBucketRefusal, isSqlBucketVanished, listRuleBucketOwners } from "./permission-rule-store-sql.js";
 import { SESSION_RULES_COLUMN } from "./session-rules-column.js";
 import { readJsonObjectColumn } from "./sql-json-column.js";
@@ -27,8 +28,11 @@ import { RENAMED_EXECUTION_LANE_M40, RETIRED_EXECUTION_LANE_WORD_M40, retiredExe
 import { retireImportedLayerRootAllows } from "./imported-layer-root-retirement.js";
 import { isUnusableArchive } from "../execution-placement.js";
 import { IDENTITY_COLUMN_NAME, SCENARIO_PREFIX_LIKE, SCENARIO_PREFIX_MARKER_ID, ScenarioPrefixSwitchRefusedError } from "./scenario-prefix-switch-m42.js";
-import { MIGRATION_MARKER_TABLE, migrationMarkerDdl } from "./one-time-migration-marker.js";
-import { expectedTableShapes } from "./schema-consistency.js";
+import { MIGRATION_MARKER_TABLE, SKILL_EXEMPTION_CUTOFF_ID, markIfAbsentSql, migrationMarkerDdl } from "./one-time-migration-marker.js";
+import { describeUpgradeDriftTail, expectedTableShapes } from "./schema-consistency.js";
+import { olderReplicaEvidenceSentence, stopThenStartAction } from "./stop-then-start-sentence.js";
+import { buildThisReplicaRegistration, knowsCapability, readReplicaRegistrations, registerReplica } from "./replica-registration.js";
+import { assertReplicaTablesPresent, assertServingRequirementsMet } from "./serving-requirement.js";
 const RETIRED_SESSION_RULE_BUCKETS = ["commandAllow", "commandDeny"];
 export function buildMigrationReceipts() {
     return {
@@ -66,6 +70,7 @@ export function buildMigrationReceipts() {
         runErrorCodeColumnRewritten: 0,
         runObjectivePreviewRewritten: 0,
         shellSentinelOwnersCleared: 0,
+        shellSentinelOwnerRowsRetained: [],
         checkpointHostSessionsBackfilled: 0,
         legacySkillExemptionsDropped: 0,
         executionPlacementSessionsUnreadable: [],
@@ -127,6 +132,7 @@ function changedAnything(r) {
         r.runErrorCodeColumnRewritten > 0 ||
         r.runObjectivePreviewRewritten > 0 ||
         r.shellSentinelOwnersCleared > 0 ||
+        r.shellSentinelOwnerRowsRetained.length > 0 ||
         r.checkpointHostSessionsBackfilled > 0 ||
         r.legacySkillExemptionsDropped > 0 ||
         r.executionPlacementSessionsUnreadable.length > 0 ||
@@ -152,6 +158,7 @@ function readingsSnapshot(r) {
         sessionRuleRowsWithUnreadableDeny: [...r.sessionRuleRowsWithUnreadableDeny],
         parkedApprovalCardRowsUnreadable: [...r.parkedApprovalCardRowsUnreadable],
         parkedApprovalCardRowsTooLong: [...r.parkedApprovalCardRowsTooLong],
+        shellSentinelOwnerRowsRetained: [...r.shellSentinelOwnerRowsRetained],
         executionPlacementSessionsUnreadable: [...r.executionPlacementSessionsUnreadable],
         localArchivesKeptStamped: [...r.localArchivesKeptStamped],
         localArchivesUnreadable: [...r.localArchivesUnreadable],
@@ -180,21 +187,18 @@ export class OneTimeMigrationInterruptedError extends Error {
         this.receipts = receipts;
     }
 }
+const WORKFLOW_JOURNAL_TABLE = "workflow_journal";
+const WORKFLOW_JOURNAL_OWNER_TABLE = "workflow_journal_owner";
+const WORKFLOW_JOURNAL_STAGING = `${WORKFLOW_JOURNAL_TABLE}_m24`;
+const WORKFLOW_JOURNAL_RETIRED = `${WORKFLOW_JOURNAL_TABLE}_m24_old`;
+const WORKFLOW_JOURNAL_SUPPLIED_COLUMN = "incarnation";
+const RETIRED_JOURNAL_SCOPE_COLUMN = "scope";
+const SESSION_POLICY_TABLE = "session_policy";
+const RETIRED_SESSION_RULES_COLUMN = "rules";
+const OLD_GRAMMAR_SESSION_RULES_COLUMN = "rule_entries_old_grammar";
+const RETIRED_ASK_CAUSE_COLUMN = "denied_reason";
+const ASK_EXECUTION_LANE_COLUMN = "execution_lane";
 export const ONE_TIME_MIGRATIONS = [
-    {
-        id: "M12",
-        introducedIn: "7.122.0",
-        releasedOn: "2026-10-09",
-        removableAfter: "2026-11-08",
-        removal: "删模式词读法记号的判据与拒臂:`http/stored-body-replay.ts` 的 `permissionModeReadingUnstated`;`http/checkpoint-ctx.ts` 的 `permissionModeReadingStated` / `permissionModeReadingRefusal` / `PERMISSION_MODE_READINGS`、" +
-            "`StoredBodyReplayRefusal` 的 `permission_mode_reading` 臂及其日志字段与答复臂、`buildCheckpointCtx` 与 `withPermissionModeRewritten` 两处记号写点" +
-            "(后者删后 `resume-legs.ts` `drivePlanReview` 里对它的那一处调用回到只换体的 `{ ...ctx, body }`)、`CheckpointCtx.permissionModeReading`、" +
-            "`http/stored-body-replay.ts` 里 `StoredReplayDeployment` 的 `autonomy` 位与 `storedBodyReplayRefusal` 读 `deployment.autonomy` 的那一句(这一位只服务这一问;四个问点传 `deps.config` 整份,home 位还服务 `permissions` 一问,不动);" +
-            "`test/stored-request-prompt-profile-m30.test.ts` 的 SHARED 表里 `StoredBodyReplayRefusal` 那一行(rows 含 M12;M30 的登记行组已先删时该表已不在,这一句无事可做):rows 去掉 M12、整行并入同文件的 SITES(值 = 该行的 files 数组)",
-        afterRemoval: "没有响亮臂:删码之后仍停驻、在 7.121.x 及以前写下的行(把 `APPROVAL_TERMINAL_BACKSTOP_MS` 调长的部署,或跳过了带本条的版本直接升的库)在设了 " +
-            "`AUTONOMY=plan` 的部署上按体里的原词重放(运维的 plan 不再被按段重钳)—— 升级前把这些停驻的 run 决掉 / 取消,或升级窗内设 `AUTONOMY=read-only`",
-        reportKeys: [],
-    },
     {
         id: "M13",
         introducedIn: "7.123.0",
@@ -250,6 +254,7 @@ export const ONE_TIME_MIGRATIONS = [
             "出路是先在一只带本条的版本上起服一次;② 行里仍带退役命令桶:SQL 店读回照旧答 `corrupt`(引擎的形读法点名那只桶,与本条在场时同一个结局),只是起服日志不再逐行点名 —— " +
             "运维在库里把那一行改写成引擎文法或删掉它(删会话即删规则);③ 跳过本条直接升的库同样没有改名那一拍的条目判读 —— 由 ① 的拒启接住(出路同 ①)",
         reportKeys: ["sessionRuleColumn", "sessionRuleRowsWithRetiredBuckets", "sessionRuleRowsWithOldGrammarEntries", "sessionRuleRowsWithUnreadableDeny"],
+        shapeChanges: [{ kind: "rename", table: SESSION_POLICY_TABLE, from: [RETIRED_SESSION_RULES_COLUMN, OLD_GRAMMAR_SESSION_RULES_COLUMN], to: SESSION_RULES_COLUMN.name }],
     },
     {
         id: "M18",
@@ -370,6 +375,7 @@ export const ONE_TIME_MIGRATIONS = [
         afterRemoval: "起服对账一族的列集探针接住(`schema-consistency.ts` 的 `assertSchemaMatchesCode`,常设):跳过了带本条的版本直接升的库,`workflow_journal` 上仍带 scope 列、没有 incarnation 列 = 库与代码列集不符 ⇒ " +
             "响亮拒启(`config.schema_mismatch`),拒句点名两列;出路是先在带本条的版本(7.133.x)起服一次让它走完,再升",
         reportKeys: ["workflowJournalScopeColumn", "workflowJournalOwnersBackfilled", "workflowJournalForeignScopeRowsRemoved"],
+        shapeChanges: [{ kind: "rebuild", table: WORKFLOW_JOURNAL_TABLE, whilePresent: RETIRED_JOURNAL_SCOPE_COLUMN, supplies: [WORKFLOW_JOURNAL_SUPPLIED_COLUMN] }],
     },
     {
         id: "M25",
@@ -497,13 +503,15 @@ export const ONE_TIME_MIGRATIONS = [
         afterRemoval: "起服对账一族的跳版库拒启臂接住:删码同版把 `device_session` / `device_session_retired` 两张表加进退役 schema 判据(`schema-consistency.ts` 的跳版库探针,先于建表)⇒ " +
             "跳过了带本条的版本直接升的库响亮拒启,出路 = 先在带本条的版本起服一次让切换走完,再升;缺执行放置列的库由列集对账缺列拒启(`config.schema_mismatch`,拒句给 ALTER),同一出路",
         reportKeys: ["executionPlacementColumnsAdded", "deviceBindingsMoved", "deviceBindingsOrphaned", "deviceBindingTablesDropped", "executionPlacementsBackfilled", "askExecutionLanesBackfilled", "executionPlacementSessionsUnreadable"],
+        shapeChanges: [{ kind: "add", table: APPROVAL_ASK_TABLE, column: ASK_EXECUTION_LANE_COLUMN, whilePresent: { table: "session_meta", anyOf: SESSION_EXT_MOVED_COLUMNS.map((c) => c.name) } }],
     },
     {
         id: "M33",
         introducedIn: "7.141.0",
         releasedOn: "2026-10-30",
         removableAfter: "2026-11-29",
-        removal: "删 `LocalSessionStore.migrateLocalArchives` 与它的私有助手 `anonymizeArchiveHeld` / `fillRowFacts`、`settleArchiveSnapshots` 里除最后一句常设臂 `assertNoArchiveSnapshots(dir)` 以外的一切(逐份消化的循环与 `settleArchiveSnapshot`)、" +
+        removal: "删 `LocalSessionStore.migrateLocalArchives` 与它的私有助手 `anonymizeArchiveHeld` / `fillRowFacts`、`settleArchiveSnapshots` 整只(逐份消化的循环与 `settleArchiveSnapshot`;`LocalBackend.ensureSchema` 里那一步)—— " +
+            "常设臂 `assertNoArchiveSnapshots`(只读)搬进数据根准入 `local-data-root-admission.ts` 的 `admitLocalDataRoot`(一格,本进程第一笔写之前判)、" +
             "`archiveSnapshotsSettled` 字段、`rowFactsFilled` / `ARCHIVE_SNAPSHOT_RECORD` / `ArchiveSnapshotRecord` / `readArchiveSnapshotRecord` / `sameLog` / " +
             "`ArchivedRowFacts` / `archivedRowFactsOf`(M47 仍在树时留着,随 M47 删)/ " +
             "`ArchiveRewriteStep` / `LocalArchiveMigrationReading` / `errnoOf`、" +
@@ -532,6 +540,10 @@ export const ONE_TIME_MIGRATIONS = [
             "出路 = 先在带本条的版本起服一次让迁移走完,再升(列册对账见幽灵列 / 缺列同样拒启,但它的拒句给的是加列,不是这一出路 —— 所以退役判据要在删码同版加上);" +
             "② local —— 信封号 1 的日志记录走 File 问账店「认不出的信封号」拒启(`unknown envelope version`,点名文件与出路:用写下它的那一版起服一次,或移开文件)",
         reportKeys: ["askCauseColumnsChanged", "askParkTriggersMoved", "askJournalRecordsUpgraded"],
+        shapeChanges: [
+            { kind: "rename", table: APPROVAL_ASK_TABLE, from: [RETIRED_ASK_CAUSE_COLUMN], to: APPROVAL_ASK_ENDING_CAUSE_COLUMN.name },
+            { kind: "add", table: APPROVAL_ASK_TABLE, column: APPROVAL_ASK_PARK_TRIGGER_COLUMN.name },
+        ],
     },
     {
         id: "M35",
@@ -606,13 +618,18 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.147.0",
         releasedOn: "2026-11-07",
         removableAfter: "2026-12-07",
-        removal: "删 `src/plugins/execution-lane-rename-m40.ts` 整只文件;本文件的 M40 步(`renameRetiredExecutionLaneWordsM40` / `refuseWhileRunsHeartbeat`〔它读的 `readLiveRunHeartbeat` / `LiveRunHeartbeat` 由 M41 / M42 共读,两条也已删码时随之删〕/ `ExecutionLaneRenameRefusedError` / " +
-            "`EXECUTION_LANE_RENAME_REFUSED_CODE` / `ExecutionLaneRenameInput`,`migrateStepsOn` 第一步那一行与 `SqlOneTimeMigrationInput` 里的那一半)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `executionLaneWordsRenamed`、头注 M40 段;" +
-            "`store-backend.ts` 的 `LocalBackend.ensureSchema` 第一步与 `executionLaneWordsRenamed` 字段、两只 SQL 后端递 `liveRunWindowMs` 的那一半;" +
+        removal: "删 `src/plugins/execution-lane-rename-m40.ts` 整只文件;本文件的 M40 步(`renameRetiredExecutionLaneWordsM40` / `refuseWhileRunsHeartbeat`〔读证据的那一处调用;证据读法 `readOlderReplicaEvidence` 与判活窗输入归 M52 行〕/ `ExecutionLaneRenameRefusedError` / " +
+            "`EXECUTION_LANE_RENAME_REFUSED_CODE`,`migrateStepsOn` 第一步那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `executionLaneWordsRenamed`、头注 M40 段;" +
+            "`store-backend.ts` 的 `LocalBackend.ensureSchema` 第一步与 `executionLaneWordsRenamed` 字段;" +
+            "`local-session-store.ts` 的内核 `renameRetiredExecutionLaneWordsInCellsM40` 与数据根准入的具名读者 `readSessionMetaSidecarInWindow`(在内存里套的那一步;准入的解码点改用 `readSessionMetaSidecar`);" +
             "`LocalSessionStore.renameRetiredExecutionLaneWordM40`、`FileApprovalAskStore.renameRetiredExecutionLaneWordM40` 与内核的 `renameExecutionLaneWord`;" +
             "`approval-ask-store-sql.ts` / `execution-placement-sql.ts` 拒句里的 `retiredExecutionLaneHintM40(…)` 补句;`test/execution-lane-rename-m40.test.ts` 整只文件与 `test/execution-placement-switch-db-integration.test.ts` 的 M40 组",
         afterRemoval: "既有读口的拒臂接住(响亮,不再改名):仍带旧词的行 —— 跳过了带本条的版本直接升的库、窗关之后还在写的更早版本副本 —— SQL 问行读口拒、会话执行格读口拒(`ExecutionPlacementRowError`)," +
             "local 会话元数据边档整只严格拒启(`config.schema_mismatch`),local 问账日志由 M32 回填的词表外拒臂拒启(M32 删码之后:那只问行原样装回)。出路 = 升级时先过一次带本条的版本并起服",
+        stopThenStart: {
+            reason: "renames the retired execution-lane word \"in-process\" to \"none\" on stored approval asks and sessions; a replica of an earlier version would keep writing the old word after the rename",
+            owedOn: owesExecutionLaneRenameM40,
+        },
         reportKeys: ["executionLaneWordsRenamed"],
     },
     {
@@ -623,11 +640,15 @@ export const ONE_TIME_MIGRATIONS = [
         removal: "删本文件的 M41 步(`moveSessionCellsToSideTable` / `refuseSessionExtMoveWhileRunsHeartbeat` / `deploymentColumnsOnMeta` / `SessionExtMoveRefusedError` / `SESSION_EXT_MOVE_REFUSED_CODE` / " +
             "`SessionExtMoveRefusalReason` / `sameCell` / `SESSION_EXT_MOVE_PAGE`,`migrateStepsOn` 里那两行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `sessionExtRowsMoved` / `sessionMetaColumnsDropped`、头注 M41 段;" +
             "M32 读形里的 `cellsOnSideTable` 判(它读本条的 `deploymentColumnsOnMeta`):M32 还在时改成恒旁表形 —— 删 M32 写 `session_meta` 八列的那些臂(② ④ ④b ⑥ 与 ③ 的 `migrateDeviceBindingsStatement` 臂)," +
-            "留 ③ 的旁表臂(`migrateDeviceBindingsOntoSideTableStatements`:围栏拒句的「采旧」在任何库上仍要能落到执行格);M32 先于本条删码时这些随 M32 一并删;`readLiveRunHeartbeat` 在 M40 与 M42 也已删码时随之删;`test/session-ext-move-db-integration.test.ts` 整只文件",
+            "留 ③ 的旁表臂(`migrateDeviceBindingsOntoSideTableStatements`:围栏拒句的「采旧」在任何库上仍要能落到执行格);M32 先于本条删码时这些随 M32 一并删;`test/session-ext-move-db-integration.test.ts` 整只文件。能力名单 `REPLICA_CAPABILITIES` 里的 `M41` 不删(只增)",
         afterRemoval: "跳过了带本条的版本直接升上来的库:`session_meta` 上仍带部署格列 ⇒ 起服列册对账拒启(`config.schema_mismatch`,那几列是本树之外的多余列,拒句不给 ALTER —— 出路是带本条的版本);" +
             "部署格从旁表读,旧列上的值不被任何读者读。出路 = 升级时先过一次带本条的版本并起服",
+        stopThenStart: {
+            reason: "moves the session deployment cells from session_meta to session_ext and then retires the old columns; a cell an earlier replica writes between the copy and the retirement is lost, and every cell write it makes afterwards fails",
+            owedOn: owesSessionExtMoveM41,
+        },
         reportKeys: ["sessionExtRowsMoved", "sessionMetaColumnsDropped"],
-        dropsColumns: { session_meta: SESSION_EXT_MOVED_COLUMNS.map((c) => c.name) },
+        shapeChanges: [{ kind: "drop", table: "session_meta", columns: SESSION_EXT_MOVED_COLUMNS.map((c) => c.name) }],
     },
     {
         id: "M42",
@@ -635,10 +656,14 @@ export const ONE_TIME_MIGRATIONS = [
         releasedOn: "2026-11-08",
         removableAfter: "2026-12-08",
         removal: "删 `src/plugins/scenario-prefix-switch-m42.ts` 整只文件;本文件的 M42 步(`switchScenarioPrefixM42` / `scannedIdentityColumnsM42`,`migrateStepsOn` 第一步那一行)、报告 / 收据 / 日志的 `scenarioPrefixSourcesScanned`、头注 M42 段;" +
-            "`readLiveRunHeartbeat` / `LiveRunHeartbeat` 在 M40 与 M41 也已删码时随之删;`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里 M42 那一腿(`switchLocalScenarioPrefixM42`)与四只 File 店的 `scenarioPrefixOwnerRowsM42`(run / 会话 / 问 / 附件);`test/scenario-prefix-switch-m42.test.ts` 与 `test/scenario-prefix-switch-db-integration.test.ts` 两只文件。" +
-            "标记表的属主 `one-time-migration-marker.ts` 在 M43 也已删码时随之删;库里留下的标记表 / 数据根里的标记文件无人再读,不删(起服列册对账只核本树声明的表)",
+            "`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里 M42 那一腿(`switchLocalScenarioPrefixM42`)与四只 File 店的 `scenarioPrefixOwnerRowsM42`(run / 会话 / 问 / 附件);`test/scenario-prefix-switch-m42.test.ts` 与 `test/scenario-prefix-switch-db-integration.test.ts` 两只文件。" +
+            "标记表 `one-time-migration-marker.ts` 不随删(常设:中央建表语句建它,`Skill` 豁免截点那一行的家);库里留下的 `M42` 标记行 / 数据根里的标记文件无人再读,不删",
         afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升的库,存量里以 `_scn:` 开头的身份被恢复管线读作某个人的场景(拆不出合文法的场景与人的 ⇒ `owner.malformed_subject` 响亮)。" +
             "出路 = 升级时先过一次带本条的版本并起服(它扫一次、命中即拒启点名)",
+        stopThenStart: {
+            reason: "scans stored identities for the reserved scenario prefix and records a marker; an earlier replica does not reserve the prefix and would keep accepting such identities after the scan",
+            owedOn: owesScenarioPrefixSwitchM42,
+        },
         reportKeys: ["scenarioPrefixSourcesScanned"],
     },
     {
@@ -647,7 +672,7 @@ export const ONE_TIME_MIGRATIONS = [
         releasedOn: "2026-11-08",
         removableAfter: "2026-12-08",
         removal: "删本文件的 M43 步(`markWithdrawEnabledM43`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `withdrawMarkWritten`、头注 M43 段;" +
-            "`plugins/session-withdraw-sql.ts` 的 `WITHDRAW_MARK_ID` 与部署判据里读标记的那一句(撤回出口无条件启用);标记表 `one-time-migration-marker.ts` 在 M42 也已删码时随之删、`plugins/session-birth.ts` 的 `upgrade_pending` 词与出口计数里的同名词;" +
+            "`plugins/session-withdraw-sql.ts` 的 `WITHDRAW_MARK_ID` 与部署判据里读标记的那一句(撤回出口无条件启用);标记表 `one-time-migration-marker.ts` 不随删(常设)、`plugins/session-birth.ts` 的 `upgrade_pending` 词与出口计数里的同名词;" +
             "local 会话元数据格「没有 `clientWrites` 位 ⇒ upgrade_pending」那一臂;库里留下的标记行无人再读,不删(与 M42 同一张标记表)",
         afterRemoval: "窗 30 天之后更早版本的副本早已不在;标记行不再被任何读者读(留着无害)。跳过了带本条的版本直接升上来的库:撤回出口从第一次起服就启用 —— " +
             "跨两版以上的混跑本就不被支持(7.147.0 起的停-迁-起)。出路 = 升级时先过一次带本条的版本并起服",
@@ -685,9 +710,16 @@ export const ONE_TIME_MIGRATIONS = [
         removableAfter: "2026-12-08",
         removal: "删 `src/plugins/approval-exemption-skill-m46.ts` 整个文件;本文件的 M46 步(`dropLegacySkillExemptionsM46`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `legacySkillExemptionsDropped`、头注 M46 段、`logReceiptRows` 里的 `legacy_skill_exemptions_dropped` 一行;" +
             "`approval-exemption-store.ts` 的 `FileApprovalExemptionStore.dropToolRowsCreatedBeforeM46` 与 `LocalBackend.runOneTimeMigrations` 里那一格;" +
-            "`test/approval-exemption-skill-m46.test.ts` 整个文件、`test/one-time-migrations-db-integration.test.ts` 的 M46 组;标记表 `one-time-migration-marker.ts` 在 M42 / M43 也已删码时随之删(库里留下的 `M46` 标记行与数据根里的标记文件无人再读,不删)",
-        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升上来的库,7.116.0 之前写下的 `(会话, \"Skill\")` 豁免行照旧代答「不绑授予」的同名调用 —— 部署自挂一只叫 `Skill` 的工具、没有技能时," +
-            "那个人当年批的是「激活某技能」,代答的却是这只工具的调用。出路 = 升级时先过一次带本条的版本并起服(或运维手工删那些行:`DELETE FROM approval_exemption WHERE tool_name = 'Skill'` / 删会话)",
+            "`test/approval-exemption-skill-m46.test.ts` 整个文件、`test/one-time-migrations-db-integration.test.ts` 的 M46 组;" +
+            "跳版拒启臂的豁免:`store-backend.ts` 的 `withRetiredSchemaProbe` 与 `local-data-root-admission.ts` 的 `admitLocalDataRoot` 各一处 `migrationCarried(SKILL_EXEMPTION_CUTOFF_ID)` 实参、" +
+            "`assertSkillExemptionCutoffHeldOnPool` / `judgeSqlSkillExemptionCutoff` / `judgeLocalSkillExemptionCutoff` 的 `carried` 参数与它那一支(臂恒判;截点读不出的拒本来就不看它)。" +
+            "**不随本条删**(常设):`approval-exemption-skill-cutoff.ts` 整只(截点、工具名、两车道的判与落)、标记表 `one-time-migration-marker.ts` 与它的 `M46` 行(截点的家)、" +
+            "数据根里的 `one-time-migration-M46.marker`、`ensureSchema()` 的截点种子行、数据根准入锁内一步的落截点、`approval-exemption-store.ts` 的 `readExemptionLog`",
+        afterRemoval: "跳版拒启臂接住(常设,起服对账一族,先于本次起服对这只库的任何写;`approval-exemption-skill-cutoff.ts`):库里有首次放行早于 `Skill` 豁免截点 T0 的 `Skill` 行" +
+            "(SQL:标记表 `M46` 行 / local:`one-time-migration-M46.marker`;T0 缺席 ⇒ 任一 `Skill` 行)⇒ 拒启 `config.schema_mismatch`,零写 —— " +
+            "SQL 在 `ensureSchema()` 建表之前(`LegacySkillExemptionsPresentError`,与退役 schema 探针同一处),local 在数据根准入(读数种别 `skipped-required-migration`)。" +
+            "出路 = 先用一个仍带本条、不低于 7.148.0(local 还要不低于拒句里已记的引擎高水位)的版本对这只库完整起一次,再升;SQL 另可手工 `DELETE FROM approval_exemption WHERE tool_name = 'Skill'`。" +
+            "T0 由常设的一步落(SQL:`ensureSchema()` 建表之后的种子行;local:准入的锁内一步):判过、缺席才落 —— 删码之后全新的库照样有 T0,不会被自己写下的合法行拒",
         reportKeys: ["legacySkillExemptionsDropped"],
     },
     {
@@ -695,13 +727,13 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.148.0",
         releasedOn: "2026-11-08",
         removableAfter: "2026-12-08",
-        removal: "删 `LocalSessionStore.adoptArchiveTokensM47`(含欠账起服的 `required` 分档、证明 `assertArchiveTokensAdoptedM47` / `adoptionScopeOf` / `skippedFromAdoption` 与它那一处销账)与 `LocalArchiveTokenAdoption`、`archiveTokenAdoptionCarried`;" +
+        removal: "删 `LocalSessionStore.adoptArchiveTokensM47`(含欠账起服的 `required` 分档、证明 `assertArchiveTokensAdoptedM47` / `adoptionScopeOf` / `skippedFromAdoption` 与它那一处销账)与 `LocalArchiveTokenAdoption`;" +
             "收令牌欠账的记账(`recordArchiveTokenAdoptionPending`);窗内长第一格的规则 `firstCellIncarnationOf` / `LocalSessionStore.firstCellIncarnationHeld`(调用点 —— 补铸、登记、执行位回填、M33 的行回填与快照恢复 —— 回到新铸);" +
-            "`holdArchiveTokenAdoptionDuty` 的 `adoptionCarried` 参数与记账那一支、`store-backend.ts` 判前钩里传它的那一处(臂恒判);" +
+            "`judgeArchiveTokenAdoptionDuty` 的 `adoptionCarried` 参数与 `record` 那一支(`ArchiveTokenAdoptionDutyAction` 随之少 `record`,`settleArchiveTokenAdoptionDuty` 的那一臂同删)、`local-data-root-admission.ts` 里传它的那一处 `migrationCarried(\"M47\")`(臂恒判);" +
             "`LocalBackend.ensureSchema` 里对 `adoptArchiveTokensM47` 的调用与两只读数字段、`runOneTimeMigrations` 里报告两键那几行;报告 / 收据 / `changedAnything` / `readingFields` / `NO_SQL_MIGRATIONS` 的 `localArchiveTokensAdopted` / `localArchiveTokensMinted`、头注 M47 段;" +
             "M33 也已删码时连同 `archivedRowFactsOf` / `ArchivedRowFacts`;`test/local-root-one-row-store.test.ts` 里标题含 `P3` / `P4` 的格。" +
-            "**不随本条删**:跳版拒启臂 `holdArchiveTokenAdoptionDuty`(不带本条那一支:标记在而无格存档为零 ⇒ 销账放行)/ `archiveIdsWithoutCellSync` / `archiveTokenAdoptionPendingPresent` / `dischargeArchiveTokenAdoptionPending` / `ARCHIVE_TOKEN_ADOPTION_SINCE`、读数种别 `skipped-required-migration` 与它按高水位分支的拒句(常设)",
-        afterRemoval: "跳版拒启臂接住(常设,起服对账一族、数据根打开那一刻、引擎高水位抬之前):(打开之前的引擎高水位早于 7.148.0 或缺席 ∨ 数据根里的收令牌欠账标记还在 —— 带本条的版本打开过、没收完)" +
+            "**不随本条删**:跳版拒启臂 `judgeArchiveTokenAdoptionDuty`(不带本条那一支:标记在而无格存档为零 ⇒ `discharge`)/ `settleArchiveTokenAdoptionDuty` / `readSessionMetaCellsSync` / `archiveTokenAdoptionPendingPresent` / `dischargeArchiveTokenAdoptionPending` / `ARCHIVE_TOKEN_ADOPTION_SINCE`、读数种别 `skipped-required-migration` 与它按高水位分支的拒句(常设)",
+        afterRemoval: "跳版拒启臂接住(常设,数据根准入的一格:只读、本进程第一笔写之前、引擎高水位抬之前):(打开之前的引擎高水位早于 7.148.0 或缺席 ∨ 数据根里的收令牌欠账标记还在 —— 带本条的版本打开过、没收完)" +
             "∧ 根里有存档在而会话元数据格缺的会话 ⇒ 拒启 `config.schema_mismatch`(读数种别 `skipped-required-migration`,点名会话数与版本),零写、不抬高水位 —— " +
             "出路 = 先用一个仍带本条、不低于 7.148.0 且不低于已记高水位的版本(服务或 run-local)完整起一次,再升",
         reportKeys: ["localArchiveTokensAdopted", "localArchiveTokensMinted"],
@@ -711,14 +743,14 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.148.0",
         releasedOn: "2026-11-08",
         removableAfter: "2026-12-08",
-        removal: "删 `src/plugins/shell-sentinel-owner-m48.ts` 整个文件;本文件的 M48 步(`clearShellSentinelOwnersM48`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志的 `shellSentinelOwnersCleared`、头注 M48 段;" +
+        removal: "删 `src/plugins/shell-sentinel-owner-m48.ts` 整个文件;本文件的 M48 步(`clearShellSentinelOwnersM48`,`migrateStepsOn` 里那一行)、报告 / 收据 / `changedAnything` / `readingFields` / `readingsSnapshot` / 日志的 `shellSentinelOwnersCleared` 与 `shellSentinelOwnerRowsRetained`(连同 `logReceiptRows` 里 `shell_sentinel_rows_retained` 那一支)、头注 M48 段;" +
             "`SqlOneTimeMigrationInput` 里 M48 那一半(`ShellSentinelOwnerInput`)与它在两只 SQL 后端 / 测试夹具上的实参(`identityBoundary`);" +
-            "local 腿 `LocalSessionStore.clearShellSentinelOwnersM48` / `FileRunStore.clearShellSentinelOwnersM48` 与 `LocalBackend.runOneTimeMigrations` 里那一格(连同后端的 `identityBoundary` 字段);部署形表行 `identityBoundary` 不随删(dev-open 判据读它);" +
+            "local 腿 `LocalSessionStore.clearShellSentinelOwnersM48` / `countShellSentinelOwnersM48` 与 `FileRunStore.clearShellSentinelOwnersM48` / `countShellSentinelOwnersM48`,以及 `LocalBackend.runOneTimeMigrations` 里那两格(改写读数与留存读数)(连同后端的 `identityBoundary` 字段);部署形表行 `identityBoundary` 不随删(dev-open 判据读它);" +
             "`test/shell-sentinel-owner-m48.test.ts` 整个文件、`test/one-time-migrations-db-integration.test.ts` 的 M48 组",
         afterRemoval: "没有响亮臂(如实):没有身份边界的部署跳过了带本条的版本直接升上来,哨兵属主的存量行仍记着那个字面量,属主面表已不认它 —— 不带主体的本地单用户读不到、续不上那些会话与 run(404)," +
             "带同一个头的请求仍读得到(属主相同)。出路 = 升级时先过一次带本条的版本并起服(或运维手工 `UPDATE <表> SET owner = NULL WHERE owner = 'anon:shell-live'`,三张表见删法)。" +
             "有身份边界的部署本条本来就零改写,删码前后同答(哨兵是一位普通的具名属主)",
-        reportKeys: ["shellSentinelOwnersCleared"],
+        reportKeys: ["shellSentinelOwnersCleared", "shellSentinelOwnerRowsRetained"],
     },
     {
         id: "M49",
@@ -752,10 +784,27 @@ export const ONE_TIME_MIGRATIONS = [
         removableAfter: "2026-12-08",
         removal: "删本文件的 M51 步(`switchSessionDeletingM51` / `SessionDeletingSwitchRefusedError` / `SESSION_DELETING_SWITCH_REFUSED_CODE` / `SESSION_DELETING_MARK_ID`,`migrateStepsOn` 里那一行)、" +
             "报告 / 收据 / `changedAnything` / `readingFields` / `NO_SQL_MIGRATIONS` 的 `sessionDeletingSwitchMarked`、头注 M51 段;`test/session-deleting-state-db-integration.test.ts` 的 M51 组;" +
-            "标记表 `one-time-migration-marker.ts` 在 M42 / M43 / M46 也已删码时随之删(库里留下的 `M51` 标记行无人再读,不删)。**不随本条删**:在删态本身(列、围栏、规则 L 的在删半、终刀判令牌 —— 常设)",
+            "库里留下的 `M51` 标记行无人再读,不删。**不随本条删**:在删态本身(列、围栏、规则 L 的在删半、终刀判令牌 —— 常设)、标记表 `one-time-migration-marker.ts`(常设)",
         afterRemoval: "没有响亮臂(也无需):窗 30 天之后更早版本的副本早已不在;跳过了带本条的版本直接升上来的库 —— 跨两版以上的混跑本就不被支持(7.147.0 起的停-迁-起)。出路 = 升级时先过一次带本条的版本并起服",
+        stopThenStart: {
+            reason: "switches session deletion to a deleting state that every replica must read; an earlier replica does not read it and would accept a submission on a session this version is deleting",
+            owedOn: owesSessionDeletingSwitchM51,
+        },
         reportKeys: ["sessionDeletingSwitchMarked"],
     },
+    {
+        id: "M52",
+        introducedIn: "7.150.0",
+        releasedOn: "2026-11-09",
+        removableAfter: "2026-12-09",
+        removal: "删 `readOlderReplicaEvidence` 的心跳一半(按 `instance_id` 分组读 `task_run` 心跳的那一句、减去登记为知道该迁移的持有者那一步)与它的判活窗输入:`LiveRunWindowInput`、`SqlOneTimeMigrationInput` 里的那一半、" +
+            "`store-backend.ts` 的 `buildSqlOneTimeMigrationInput` 读 `runStaleSec` 的那一半、夹具 `test/helpers/db-schema-boot.ts` 的 `liveRunWindowMs`;停-迁-起守卫若已全部删码(M40 / M41 / M42 / M43 / M51 的窗都早于本条关)," +
+            "连同 `readOlderReplicaEvidence` 与 `stop-then-start-sentence.ts` 的 `OlderReplicaEvidence` / `OlderReplicaHolder` / `olderReplicaEvidenceSentence` 一并删;" +
+            "`test/run-liveness-single-source-gate.test.ts` ② 的 `one-time-migrations.ts` 白名单行与 ③ `store-backend.ts` 理由里「一次性迁移守卫」半句;`test/older-replica-evidence-db-integration.test.ts` 的证据组;头注 M52 段。" +
+            "**不随本条删**:副本能力登记(`replica-registration.ts`,能力名单只增)与起服准入(`serving-requirement.ts`)—— 常设",
+        afterRemoval: "没有响亮臂(如实):早于副本登记的副本不登记,删码之后它们对停-迁-起守卫完全不可见,忙与闲同 —— 发布日之后的天数不证明旧进程不在;出路只有运维:起带停-迁-起迁移的版本之前停光早于本条的副本",
+        reportKeys: [],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;
@@ -768,21 +817,11 @@ export function migrationWindowEnd(id) {
         throw new Error(`one-time-migrations: ${id} is in the unreleased form (removableAfter: null) — there is no window end to quote yet`);
     return row.removableAfter;
 }
-export function columnsRemovedByPendingMigrations(registry = ONE_TIME_MIGRATIONS) {
-    const removals = new Map();
-    for (const row of registry) {
-        for (const [table, columns] of Object.entries(row.dropsColumns ?? {})) {
-            const owners = removals.get(table) ?? new Map();
-            for (const column of columns) {
-                const owner = owners.get(column);
-                if (owner !== undefined)
-                    throw new Error(`one-time-migrations: ${table}.${column} is claimed as dropped by both ${owner} and ${row.id} — one column has one dropping migration`);
-                owners.set(column, row.id);
-            }
-            removals.set(table, owners);
-        }
-    }
-    return removals;
+export function migrationCarried(id) {
+    return ONE_TIME_MIGRATIONS.some((w) => w.id === id);
+}
+export function stopThenStartMigrations(registry = ONE_TIME_MIGRATIONS) {
+    return registry.flatMap((row) => (row.stopThenStart === undefined ? [] : [{ id: row.id, ...row.stopThenStart }]));
 }
 export const NO_SQL_MIGRATIONS = {
     sessionRuleColumn: "file-store",
@@ -872,16 +911,27 @@ async function columnExists(db, dialect, table, column) {
 export function createSqlImportedLayerRootSource(exec) {
     return { candidateOwners: async () => ({ owners: await listRuleBucketOwners(exec), unnamedBuckets: 0 }), durable: new SqlDurableRulePartitionProvider(exec), isWholeBucketRefusal: isSqlBucketRefusal, isVanishedBucket: isSqlBucketVanished };
 }
-export async function runSqlOneTimeMigrations(dialect, pool, input) {
-    return dialect === "mysql" ? withMysqlLock(pool, (db) => migrateOn(db, "mysql", input)) : withPgLock(pool, (db) => migrateOn(db, "pg", input));
+export async function runSqlOneTimeMigrations(dialect, pool, input, me = buildThisReplicaRegistration()) {
+    const head = async (db) => {
+        await assertReplicaTablesPresent(db, dialect, me);
+        await registerReplica(db, dialect, me, Date.now());
+        await assertServingRequirementsMet(db, me);
+    };
+    const locked = async (db) => {
+        await assertServingRequirementsMet(db, me);
+        return migrateOn(db, dialect, input);
+    };
+    return dialect === "mysql" ? withMysqlLock(pool, head, locked) : withPgLock(pool, head, locked);
 }
-async function withMysqlLock(pool, run) {
+async function withMysqlLock(pool, head, run) {
     const conn = await pool.getConnection();
     let locked = false;
     try {
+        const db = mysqlDb(conn);
+        await head(db);
         await acquireEnsureSchemaLock(conn, "oneTimeMigrations");
         locked = true;
-        return await run(mysqlDb(conn));
+        return await run(db);
     }
     finally {
         if (locked)
@@ -889,13 +939,15 @@ async function withMysqlLock(pool, run) {
         conn.release();
     }
 }
-async function withPgLock(pool, run) {
+async function withPgLock(pool, head, run) {
     const client = await pool.connect();
     let locked = false;
     try {
+        const db = pgDb(client);
+        await head(db);
         await acquirePgEnsureSchemaLock(client, "oneTimeMigrations");
         locked = true;
-        return await run(pgDb(client));
+        return await run(db);
     }
     finally {
         if (locked)
@@ -1007,13 +1059,18 @@ async function rewriteRunObjectivePreviewM45(db, dialect, receipts) {
     }
 }
 export async function clearShellSentinelOwnersM48(db, dialect, receipts, input) {
-    if (input.identityBoundary !== false)
-        return;
-    const sentinelOwner = dialect === "mysql" ? "CAST(owner AS BINARY) = CAST(? AS BINARY)" : "owner = $1";
+    const rewrite = input.identityBoundary === false;
+    const sentinelOwner = shellSentinelOwnerWhereM48(dialect);
     for (const table of SHELL_SENTINEL_OWNER_TABLES_M48) {
         if (!(await tableExists(db, dialect, table)))
             continue;
-        receipts.shellSentinelOwnersCleared += await db.exec(`UPDATE ${table} SET owner = NULL WHERE ${sentinelOwner}`, [SHELL_SENTINEL_OWNER_M48]);
+        if (rewrite) {
+            receipts.shellSentinelOwnersCleared += await db.exec(`UPDATE ${table} SET owner = NULL WHERE ${sentinelOwner}`, [SHELL_SENTINEL_OWNER_M48]);
+            continue;
+        }
+        const rows = Number((await db.rows(`SELECT COUNT(*) AS n FROM ${table} WHERE ${sentinelOwner}`, [SHELL_SENTINEL_OWNER_M48]))[0]?.["n"] ?? 0);
+        if (rows > 0)
+            receipts.shellSentinelOwnerRowsRetained.push({ surface: table, rows });
     }
 }
 const HOST_SESSION_BACKFILL_PAGE = 500;
@@ -1038,27 +1095,22 @@ export async function dropLegacySkillExemptionsM46(db, dialect, receipts) {
     if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
         await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
     const ph = (i) => (dialect === "mysql" ? "?" : `$${i}`);
-    const readMark = async () => {
-        const [row] = await db.rows(`SELECT marked_at_ms FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = ${ph(1)}`, [LEGACY_SKILL_EXEMPTION_MARKER_ID]);
-        return row === undefined ? undefined : Number(row["marked_at_ms"]);
-    };
+    const readMark = () => readSqlSkillExemptionCutoff((sql, params) => db.rows(sql, params), dialect);
     let markedAtMs = await readMark();
     if (markedAtMs === undefined) {
-        await db.exec(dialect === "mysql"
-            ? `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES (?, ?) ON DUPLICATE KEY UPDATE migration_id = migration_id`
-            : `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES ($1, $2) ON CONFLICT (migration_id) DO NOTHING`, [LEGACY_SKILL_EXEMPTION_MARKER_ID, Date.now()]);
+        await db.exec(markIfAbsentSql(dialect), [SKILL_EXEMPTION_CUTOFF_ID, Date.now()]);
         markedAtMs = await readMark();
     }
-    if (markedAtMs === undefined || !Number.isFinite(markedAtMs))
-        throw new Error("one-time migration M46: the marker row is missing or unreadable right after it was written — refusing to delete rows without a recorded cutoff");
+    if (markedAtMs === undefined)
+        throw new Error("one-time migration M46: the marker row is missing right after it was written — refusing to delete rows without a recorded cutoff");
     const cutoff = new Date(markedAtMs);
     let after = "";
     for (;;) {
-        const page = await db.rows(`SELECT session_id FROM approval_exemption WHERE tool_name = ${ph(1)} AND created_at < ${ph(2)} AND session_id > ${ph(3)} ORDER BY session_id LIMIT ${LEGACY_SKILL_EXEMPTION_PAGE}`, [LEGACY_SKILL_EXEMPTION_TOOL_NAME, cutoff, after]);
+        const page = await db.rows(`SELECT session_id FROM approval_exemption WHERE tool_name = ${ph(1)} AND created_at < ${ph(2)} AND session_id > ${ph(3)} ORDER BY session_id LIMIT ${LEGACY_SKILL_EXEMPTION_PAGE}`, [SKILL_EXEMPTION_TOOL_NAME, cutoff, after]);
         if (page.length === 0)
             return;
         const sessionIds = page.map((r) => String(r["session_id"]));
-        receipts.legacySkillExemptionsDropped += await db.exec(`DELETE FROM approval_exemption WHERE tool_name = ${ph(1)} AND created_at < ${ph(2)} AND session_id IN (${sessionIds.map((_, i) => ph(i + 3)).join(", ")})`, [LEGACY_SKILL_EXEMPTION_TOOL_NAME, cutoff, ...sessionIds]);
+        receipts.legacySkillExemptionsDropped += await db.exec(`DELETE FROM approval_exemption WHERE tool_name = ${ph(1)} AND created_at < ${ph(2)} AND session_id IN (${sessionIds.map((_, i) => ph(i + 3)).join(", ")})`, [SKILL_EXEMPTION_TOOL_NAME, cutoff, ...sessionIds]);
         if (page.length < LEGACY_SKILL_EXEMPTION_PAGE)
             return;
         after = sessionIds[sessionIds.length - 1];
@@ -1070,38 +1122,50 @@ async function markWithdrawEnabledM43(db, dialect, receipts, input) {
     const marked = await db.rows(dialect === "mysql" ? `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = ?` : `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = $1`, [WITHDRAW_MARK_ID]);
     if (marked.length > 0)
         return;
-    if ((await readLiveRunHeartbeat(db, dialect, input)) !== undefined)
+    if ((await readOlderReplicaEvidence(db, dialect, input, "M43")) !== undefined)
         return;
-    receipts.withdrawMarkWritten += await db.exec(dialect === "mysql"
-        ? `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES (?, ?) ON DUPLICATE KEY UPDATE migration_id = migration_id`
-        : `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES ($1, $2) ON CONFLICT (migration_id) DO NOTHING`, [WITHDRAW_MARK_ID, Date.now()]);
+    receipts.withdrawMarkWritten += await db.exec(markIfAbsentSql(dialect), [WITHDRAW_MARK_ID, Date.now()]);
+}
+async function migrationMarked(read, dialect, id) {
+    if (!(await tableExists({ rows: read }, dialect, MIGRATION_MARKER_TABLE)))
+        return false;
+    return (await read(`SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = '${id}'`)).length > 0;
+}
+async function owesExecutionLaneRenameM40(read, dialect) {
+    return (await executionLaneWordRowsM40(read, dialect)).pendingRows > 0;
+}
+async function owesSessionExtMoveM41(read, dialect) {
+    return (await deploymentColumnsOnMeta({ rows: read }, dialect)).length > 0;
+}
+async function owesScenarioPrefixSwitchM42(read, dialect) {
+    return !(await migrationMarked(read, dialect, SCENARIO_PREFIX_MARKER_ID));
+}
+async function owesSessionDeletingSwitchM51(read, dialect) {
+    return !(await migrationMarked(read, dialect, SESSION_DELETING_MARK_ID));
 }
 export const SESSION_DELETING_MARK_ID = "M51";
 export const SESSION_DELETING_SWITCH_REFUSED_CODE = "config.session_deleting_switch_refused";
 export class SessionDeletingSwitchRefusedError extends StoreBootRefusalError {
     code = SESSION_DELETING_SWITCH_REFUSED_CODE;
-    reason = "live_runs";
-    constructor(live) {
-        super(`${SESSION_DELETING_SWITCH_REFUSED_CODE} (reason: live_runs): this version deletes a session through a deleting state that every replica must read ` +
-            `(a submission on a session being deleted is refused), but ${live.liveRuns} running run(s) heartbeated on this database within the last ${live.windowSec}s (REAP_RUN_STALE_SEC) — ` +
+    reason = "older_replica";
+    constructor(evidence, tail = "") {
+        super(`${SESSION_DELETING_SWITCH_REFUSED_CODE} (reason: older_replica): this version deletes a session through a deleting state that every replica must read ` +
+            `(a submission on a session being deleted is refused), but ${olderReplicaEvidenceSentence(evidence)} — ` +
             "a replica of an earlier version may still be serving; it does not read that state and would accept a submission on a session this version is deleting. Nothing was changed and no marker was written. " +
-            "Stop every replica of the earlier version, then start this version (stop, migrate, start — this release cannot be rolled across replicas of both versions). " +
-            `If every replica is already stopped, those are the runs they left behind: start this version again after ${live.after}`);
+            stopThenStartAction(evidence.after) +
+            tail);
         this.name = "SessionDeletingSwitchRefusedError";
     }
 }
 async function switchSessionDeletingM51(db, dialect, receipts, input) {
     if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
         await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
-    const marked = await db.rows(dialect === "mysql" ? `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = ?` : `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = $1`, [SESSION_DELETING_MARK_ID]);
-    if (marked.length > 0)
+    if (!(await owesSessionDeletingSwitchM51((sql) => db.rows(sql), dialect)))
         return;
-    const heartbeat = await readLiveRunHeartbeat(db, dialect, input);
-    if (heartbeat !== undefined)
-        throw new SessionDeletingSwitchRefusedError(heartbeat);
-    receipts.sessionDeletingSwitchMarked += await db.exec(dialect === "mysql"
-        ? `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES (?, ?) ON DUPLICATE KEY UPDATE migration_id = migration_id`
-        : `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES ($1, $2) ON CONFLICT (migration_id) DO NOTHING`, [SESSION_DELETING_MARK_ID, Date.now()]);
+    const evidence = await readOlderReplicaEvidence(db, dialect, input, "M51");
+    if (evidence !== undefined)
+        throw new SessionDeletingSwitchRefusedError(evidence, await describeUpgradeDriftTail((sql) => db.rows(sql), dialect));
+    receipts.sessionDeletingSwitchMarked += await db.exec(markIfAbsentSql(dialect), [SESSION_DELETING_MARK_ID, Date.now()]);
 }
 export async function scannedIdentityColumnsM42(db, dialect) {
     const scope = dialect === "mysql" ? "DATABASE()" : "current_schema()";
@@ -1120,8 +1184,7 @@ export async function scannedIdentityColumnsM42(db, dialect) {
 export async function switchScenarioPrefixM42(db, dialect, receipts, input) {
     if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
         await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
-    const marked = await db.rows(dialect === "mysql" ? `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = ?` : `SELECT 1 AS present FROM ${MIGRATION_MARKER_TABLE} WHERE migration_id = $1`, [SCENARIO_PREFIX_MARKER_ID]);
-    if (marked.length > 0)
+    if (!(await owesScenarioPrefixSwitchM42((sql) => db.rows(sql), dialect)))
         return;
     const columns = await scannedIdentityColumnsM42(db, dialect);
     const hits = [];
@@ -1133,13 +1196,11 @@ export async function switchScenarioPrefixM42(db, dialect, receipts, input) {
     }
     receipts.scenarioPrefixSourcesScanned += columns.length;
     if (hits.length > 0)
-        throw new ScenarioPrefixSwitchRefusedError("stored_prefix", hits);
-    const live = await readLiveRunHeartbeat(db, dialect, input);
-    if (live !== undefined)
-        throw new ScenarioPrefixSwitchRefusedError("live_runs", [], live);
-    await db.exec(dialect === "mysql"
-        ? `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES (?, ?) ON DUPLICATE KEY UPDATE migration_id = migration_id`
-        : `INSERT INTO ${MIGRATION_MARKER_TABLE} (migration_id, marked_at_ms) VALUES ($1, $2) ON CONFLICT (migration_id) DO NOTHING`, [SCENARIO_PREFIX_MARKER_ID, Date.now()]);
+        throw new ScenarioPrefixSwitchRefusedError("stored_prefix", hits, undefined, await describeUpgradeDriftTail((sql) => db.rows(sql), dialect));
+    const evidence = await readOlderReplicaEvidence(db, dialect, input, "M42");
+    if (evidence !== undefined)
+        throw new ScenarioPrefixSwitchRefusedError("older_replica", [], evidence, await describeUpgradeDriftTail((sql) => db.rows(sql), dialect));
+    await db.exec(markIfAbsentSql(dialect), [SCENARIO_PREFIX_MARKER_ID, Date.now()]);
 }
 export const EXECUTION_LANE_RENAME_REFUSED_CODE = "config.execution_lane_rename_refused";
 export class ExecutionLaneRenameRefusedError extends StoreBootRefusalError {
@@ -1171,16 +1232,20 @@ export class ExecutionLaneRenameWriteRefusedError extends StoreBootRefusalError
     }
 }
 const EXECUTION_LANE_TABLES = [APPROVAL_ASK_TABLE, "session_meta", SESSION_EXT_TABLE];
-export async function renameRetiredExecutionLaneWordsM40(db, dialect, receipts, input) {
+async function executionLaneWordRowsM40(read, dialect) {
     const tables = [];
     for (const table of EXECUTION_LANE_TABLES)
-        if (await columnExists(db, dialect, table, "execution_lane"))
+        if (await columnExists({ rows: read }, dialect, table, "execution_lane"))
             tables.push(table);
     let pendingRows = 0;
     for (const table of tables) {
-        const [row] = await db.rows(`SELECT COUNT(*) AS n FROM ${table} WHERE execution_lane = ${dialect === "mysql" ? "?" : "$1"}`, [RETIRED_EXECUTION_LANE_WORD_M40]);
+        const [row] = await read(`SELECT COUNT(*) AS n FROM ${table} WHERE execution_lane = '${RETIRED_EXECUTION_LANE_WORD_M40}'`);
         pendingRows += Number(row?.["n"] ?? 0);
     }
+    return { tables, pendingRows };
+}
+export async function renameRetiredExecutionLaneWordsM40(db, dialect, receipts, input) {
+    const { tables, pendingRows } = await executionLaneWordRowsM40((sql) => db.rows(sql), dialect);
     if (pendingRows === 0)
         return;
     await refuseWhileRunsHeartbeat(db, dialect, pendingRows, input);
@@ -1188,35 +1253,55 @@ export async function renameRetiredExecutionLaneWordsM40(db, dialect, receipts,
         receipts.executionLaneWordsRenamed += await db.exec(dialect === "mysql" ? `UPDATE ${table} SET execution_lane = ? WHERE execution_lane = ?` : `UPDATE ${table} SET execution_lane = $1 WHERE execution_lane = $2`, [RENAMED_EXECUTION_LANE_M40, RETIRED_EXECUTION_LANE_WORD_M40]);
     }
 }
-async function readLiveRunHeartbeat(db, dialect, input) {
+export async function readOlderReplicaEvidence(db, dialect, input, migrationId) {
     if (!(await tableExists(db, dialect, "task_run")))
         return undefined;
     const since = new Date(Date.now() - input.liveRunWindowMs);
-    const [row] = await db.rows(`SELECT COUNT(*) AS n, MAX(updated_at) AS newest FROM task_run WHERE status = 'running' AND updated_at >= ${dialect === "mysql" ? "?" : "$1"}`, [since]);
-    const liveRuns = Number(row?.["n"] ?? 0);
+    const groups = (await db.rows(`SELECT instance_id, COUNT(*) AS n, MAX(updated_at) AS newest FROM task_run WHERE status = 'running' AND updated_at >= ${dialect === "mysql" ? "?" : "$1"} GROUP BY instance_id`, [since]))
+        .map((r) => ({ holder: typeof r["instance_id"] === "string" ? r["instance_id"] : undefined, runs: Number(r["n"] ?? 0), newest: r["newest"] }))
+        .filter((g) => g.runs > 0);
+    if (groups.length === 0)
+        return undefined;
+    const registered = await readReplicaRegistrations({ query: async (sql, params) => ({ rows: await db.rows(sql, params), affected: 0 }) }, dialect, groups.flatMap((g) => (g.holder === undefined ? [] : [g.holder])));
+    let unregisteredRuns = 0;
+    let newestMs = Number.NaN;
+    const registeredWithout = [];
+    for (const g of groups) {
+        const r = g.holder === undefined ? undefined : registered.get(g.holder);
+        if (r !== undefined && knowsCapability(r.capabilities, migrationId))
+            continue;
+        if (r === undefined)
+            unregisteredRuns += g.runs;
+        else
+            registeredWithout.push({ instanceId: r.instanceId, releaseLine: r.releaseLine, hostName: r.hostName, pid: r.pid, runs: g.runs });
+        const cell = g.newest instanceof Date ? g.newest : new Date(String(g.newest));
+        if (!Number.isNaN(cell.getTime()) && !(cell.getTime() <= newestMs))
+            newestMs = cell.getTime();
+    }
+    const liveRuns = unregisteredRuns + registeredWithout.reduce((n, h) => n + h.runs, 0);
     if (liveRuns === 0)
         return undefined;
-    const newestCell = row?.["newest"];
-    const newest = newestCell instanceof Date ? newestCell : new Date(String(newestCell));
     const now = Date.now();
-    const restartAtMs = (Number.isNaN(newest.getTime()) ? now : newest.getTime()) + input.liveRunWindowMs;
+    const restartAtMs = (Number.isNaN(newestMs) ? now : newestMs) + input.liveRunWindowMs;
     return {
+        migration: migrationId,
         liveRuns,
         windowSec: Math.round(input.liveRunWindowMs / 1000),
         restartAfter: new Date(restartAtMs).toISOString(),
         after: `${new Date(restartAtMs).toISOString()} (${Math.max(0, Math.ceil((restartAtMs - now) / 1000))}s from now)`,
+        unregisteredRuns,
+        registeredWithout: registeredWithout.sort((a, b) => a.instanceId.localeCompare(b.instanceId)),
     };
 }
 async function refuseWhileRunsHeartbeat(db, dialect, pendingRows, input) {
-    const heartbeat = await readLiveRunHeartbeat(db, dialect, input);
-    if (heartbeat === undefined)
+    const evidence = await readOlderReplicaEvidence(db, dialect, input, "M40");
+    if (evidence === undefined)
         return;
-    const { liveRuns, windowSec, restartAfter, after } = heartbeat;
-    throw new ExecutionLaneRenameRefusedError(pendingRows, liveRuns, restartAfter, `${pendingRows} stored rows (approval asks / sessions) carry the execution lane word "${RETIRED_EXECUTION_LANE_WORD_M40}", the name an earlier version gave the lane with no execution environment, ` +
-        `which this version calls "${RENAMED_EXECUTION_LANE_M40}" and does not read; this boot renames them (one-time migration M40), but ${liveRuns} running runs on this database heartbeat within the last ${windowSec}s ` +
-        `(REAP_RUN_STALE_SEC) — a replica of an earlier version is still serving, and it would keep writing the old word after the rename. No stored row was changed. ` +
-        "Stop every replica of the earlier version, then start this version (stop, migrate, start — this release cannot be rolled across replicas of both versions). " +
-        `If every replica is already stopped, those are the runs they left behind: start this version again after ${after}`);
+    throw new ExecutionLaneRenameRefusedError(pendingRows, evidence.liveRuns, evidence.restartAfter, `${pendingRows} stored rows (approval asks / sessions) carry the execution lane word "${RETIRED_EXECUTION_LANE_WORD_M40}", the name an earlier version gave the lane with no execution environment, ` +
+        `which this version calls "${RENAMED_EXECUTION_LANE_M40}" and does not read; this boot renames them (one-time migration M40), but ${olderReplicaEvidenceSentence(evidence)} ` +
+        `— a replica of an earlier version may still be serving, and it would keep writing the old word after the rename. No stored row was changed. ` +
+        stopThenStartAction(evidence.after) +
+        (await describeUpgradeDriftTail((sql) => db.rows(sql), dialect)));
 }
 export const SESSION_EXT_MOVE_REFUSED_CODE = "config.session_ext_move_refused";
 export class SessionExtMoveRefusedError extends StoreBootRefusalError {
@@ -1246,14 +1331,14 @@ export async function refuseSessionExtMoveWhileRunsHeartbeat(db, dialect, input)
     const columns = await deploymentColumnsOnMeta(db, dialect);
     if (columns.length === 0)
         return;
-    const heartbeat = await readLiveRunHeartbeat(db, dialect, input);
-    if (heartbeat === undefined)
+    const evidence = await readOlderReplicaEvidence(db, dialect, input, "M41");
+    if (evidence === undefined)
         return;
-    throw new SessionExtMoveRefusedError("live_runs", `${columns.length} session cells (${columns.map((c) => c.name).join(", ")}) still live on session_meta; this version keeps them on the side table ${SESSION_EXT_TABLE} and moves them on this boot ` +
-        `(one-time migration M41: copy, verify, then drop the columns), but ${heartbeat.liveRuns} running runs on this database heartbeat within the last ${heartbeat.windowSec}s (REAP_RUN_STALE_SEC) — ` +
-        "a replica of an earlier version is still serving; a cell it writes between the copy and the drop would be lost, and every cell write it makes after the drop fails. Nothing was changed. " +
-        "Stop every replica of the earlier version, then start this version (stop, migrate, start — this release cannot be rolled across replicas of both versions). " +
-        `If every replica is already stopped, those are the runs they left behind: start this version again after ${heartbeat.after}`);
+    throw new SessionExtMoveRefusedError("older_replica", `${columns.length} session cells (${columns.map((c) => c.name).join(", ")}) still live on session_meta; this version keeps them on the side table ${SESSION_EXT_TABLE} and moves them on this boot ` +
+        `(one-time migration M41: copy, verify, then drop the columns), but ${olderReplicaEvidenceSentence(evidence)} — ` +
+        "a replica of an earlier version may still be serving; a cell it writes between the copy and the drop would be lost, and every cell write it makes after the drop fails. Nothing was changed. " +
+        stopThenStartAction(evidence.after) +
+        (await describeUpgradeDriftTail((sql) => db.rows(sql), dialect)));
 }
 export async function moveSessionCellsToSideTable(db, dialect, receipts) {
     const columns = await deploymentColumnsOnMeta(db, dialect);
@@ -1283,7 +1368,6 @@ export async function moveSessionCellsToSideTable(db, dialect, receipts) {
     await execUntil(db, `ALTER TABLE session_meta ${names.map((n) => `DROP COLUMN ${n}`).join(", ")}`, async () => (await deploymentColumnsOnMeta(db, dialect)).length === 0);
     receipts.sessionMetaColumnsDropped += columns.length;
 }
-const RETIRED_ASK_CAUSE_COLUMN = "denied_reason";
 function renameAskCauseColumnSql(dialect) {
     return dialect === "mysql"
         ? `ALTER TABLE ${APPROVAL_ASK_TABLE} CHANGE COLUMN ${RETIRED_ASK_CAUSE_COLUMN} ${APPROVAL_ASK_ENDING_CAUSE_COLUMN.mysql}`
@@ -1338,7 +1422,7 @@ async function readSwitchShape(db, dialect) {
 }
 async function askTableShape(db, dialect) {
     const askTable = await tableExists(db, dialect, APPROVAL_ASK_TABLE);
-    return { askTable, askLaneColumn: askTable && (await columnExists(db, dialect, APPROVAL_ASK_TABLE, "execution_lane")) };
+    return { askTable, askLaneColumn: askTable && (await columnExists(db, dialect, APPROVAL_ASK_TABLE, ASK_EXECUTION_LANE_COLUMN)) };
 }
 function switchStarted(s) {
     return s.placementColumns.has("execution_role") || s.parkedTable || s.cellsOnSideTable;
@@ -1644,11 +1728,6 @@ async function dropRetiredBreakerTable(db, dialect, receipts) {
     await execUntil(db, `DROP TABLE IF EXISTS ${RETIRED_BREAKER_TABLE}`, async () => !(await tableExists(db, dialect, RETIRED_BREAKER_TABLE)));
     receipts.retiredBreakerTablesDropped += 1;
 }
-const WORKFLOW_JOURNAL_TABLE = "workflow_journal";
-const WORKFLOW_JOURNAL_OWNER_TABLE = "workflow_journal_owner";
-const WORKFLOW_JOURNAL_STAGING = `${WORKFLOW_JOURNAL_TABLE}_m24`;
-const WORKFLOW_JOURNAL_RETIRED = `${WORKFLOW_JOURNAL_TABLE}_m24_old`;
-const RETIRED_JOURNAL_SCOPE_COLUMN = "scope";
 const M24_OWNER_INCARNATION = "m24-backfill";
 const M24_COPY_BATCH_BYTES = 32 * 1024 * 1024;
 const M24_COPY_SCAN_PAGE = 1000;
@@ -1662,7 +1741,7 @@ async function copyJournalInBatches(db, dialect) {
     const T = WORKFLOW_JOURNAL_TABLE;
     const bytes = dialect === "mysql" ? "LENGTH(result)" : "OCTET_LENGTH(result)";
     const copyHead = `INSERT INTO ${WORKFLOW_JOURNAL_STAGING} (run_id, incarnation, ordinal, call_key, result, created_at_ms) ` +
-        `SELECT ${T}.run_id, o.incarnation, ordinal, call_key, ${jsonColumnText(dialect, "result")}, created_at_ms FROM ${T} ` +
+        `SELECT ${T}.run_id, o.${WORKFLOW_JOURNAL_SUPPLIED_COLUMN}, ordinal, call_key, ${jsonColumnText(dialect, "result")}, created_at_ms FROM ${T} ` +
         `JOIN ${WORKFLOW_JOURNAL_OWNER_TABLE} o ON o.run_id = ${T}.run_id AND o.scope = ${T}.${RETIRED_JOURNAL_SCOPE_COLUMN} WHERE `;
     let after;
     for (;;) {
@@ -1724,9 +1803,6 @@ export async function moveWorkflowJournalScope(db, dialect, receipts) {
     }
     receipts.workflowJournalScopeColumn = "moved";
 }
-const SESSION_POLICY_TABLE = "session_policy";
-const RETIRED_SESSION_RULES_COLUMN = "rules";
-const OLD_GRAMMAR_SESSION_RULES_COLUMN = "rule_entries_old_grammar";
 const SESSION_RULES_SCAN_PAGE = 500;
 export function retiredSessionRuleBucketsOf(body) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
@@ -2141,6 +2217,7 @@ function readingFields(r) {
         runErrorCodeColumnRewritten: r.runErrorCodeColumnRewritten,
         runObjectivePreviewRewritten: r.runObjectivePreviewRewritten,
         shellSentinelOwnersCleared: r.shellSentinelOwnersCleared,
+        shellSentinelOwnerRowsRetained: r.shellSentinelOwnerRowsRetained.reduce((n, surface) => n + surface.rows, 0),
         checkpointHostSessionsBackfilled: r.checkpointHostSessionsBackfilled,
         legacySkillExemptionsDropped: r.legacySkillExemptionsDropped,
         executionPlacementSessionsUnreadable: r.executionPlacementSessionsUnreadable.length,
@@ -2242,6 +2319,17 @@ function logReceiptRows(log, backend, r) {
                 "(the next boot then migrates it) or the session is deleted. Named on every boot until then",
         });
     }
+    if (r.shellSentinelOwnerRowsRetained.length > 0) {
+        log.warn("shell_sentinel_rows_retained", {
+            backend,
+            rows: r.shellSentinelOwnerRowsRetained.reduce((n, surface) => n + surface.rows, 0),
+            surfaces: Object.fromEntries(r.shellSentinelOwnerRowsRetained.map((surface) => [surface.surface, surface.rows])),
+            note: "this deployment has an identity boundary, so the one-time migration that clears the old cli shell sentinel owner (`anon:shell-live`) to no owner did not touch these rows: they keep that owner, and only a caller whose principal is exactly that value reads them as its own " +
+                "(on the local backend session_meta = the session-metadata cells and task_run = the run rows). The reading comes from the configuration of THE ONE PROCESS that starts the migration, and the rewrite lands on the whole database / data root and cannot be undone: " +
+                "every process that opens this same database or data root (run-local, an embedding host's boot, a one-off tool process) must carry at least one identity key (service credential, auth bridge, REQUIRE_PRINCIPAL, direct door, read-only trace credential — any one is enough; the rewrite runs only when the starting process has none of them); " +
+                "a process started with no identity key at all first would clear these rows to no owner on the boundary deployment's behalf. To clear them deliberately, run the manual step in MIGRATION.md entry 86 of the 7.148.0 section. Counted on every start until then",
+        });
+    }
     if (r.legacySkillExemptionsDropped > 0) {
         log.warn("legacy_skill_exemptions_dropped", {
             backend,