@sema-agent/server 7.150.0 → 7.152.0

package/dist/plugins/one-time-migrations.js

@@ -5,6 +5,8 @@ import { dialectProtocolJsonEncoder } from "./sql-driver.js";
 import { SCHEMA_STATEMENTS, acquireEnsureSchemaLock, releaseEnsureSchemaLock } from "./tidb-pool.js";
 import { PG_SCHEMA_STATEMENTS, acquirePgEnsureSchemaLock, releasePgEnsureSchemaLock } from "./pg-pool.js";
 import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readOpaqueJsonValueColumn, } from "./sql-json-column.js";
+import { rewrittenBackgroundRecordM53, rewrittenToolEndDataM53 } from "./store-fault-sentence-m53.js";
+import { pgSafeJsonStringify } from "./pg-safe-json.js";
 import { incarnationFromCell, sessionFaceFromRow } from "../session-incarnation.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
 import { decodeRunResultCellM44 } from "./run-store-sql.js";
@@ -31,8 +33,9 @@ import { IDENTITY_COLUMN_NAME, SCENARIO_PREFIX_LIKE, SCENARIO_PREFIX_MARKER_ID,
 import { MIGRATION_MARKER_TABLE, SKILL_EXEMPTION_CUTOFF_ID, markIfAbsentSql, migrationMarkerDdl } from "./one-time-migration-marker.js";
 import { describeUpgradeDriftTail, expectedTableShapes } from "./schema-consistency.js";
 import { olderReplicaEvidenceSentence, stopThenStartAction } from "./stop-then-start-sentence.js";
-import { buildThisReplicaRegistration, knowsCapability, readReplicaRegistrations, registerReplica } from "./replica-registration.js";
-import { assertReplicaTablesPresent, assertServingRequirementsMet } from "./serving-requirement.js";
+import { buildThisReplicaRegistration, registerReplica } from "./replica-registration.js";
+import { assertReplicaTablesPresent, assertServingRequirementsMet, recordServingRequirement } from "./serving-requirement.js";
+import { assertStopThenStartDeclarations, guardOwedStopThenStart, readOlderReplicaEvidence } from "./stop-then-start.js";
 const RETIRED_SESSION_RULE_BUCKETS = ["commandAllow", "commandDeny"];
 export function buildMigrationReceipts() {
     return {
@@ -67,6 +70,8 @@ export function buildMigrationReceipts() {
         scenarioPrefixSourcesScanned: 0,
         withdrawMarkWritten: 0,
         sessionDeletingSwitchMarked: 0,
+        storeFaultSentencesRewritten: 0,
+        checkpointDisplayColumnsDropped: 0,
         runErrorCodeColumnRewritten: 0,
         runObjectivePreviewRewritten: 0,
         shellSentinelOwnersCleared: 0,
@@ -129,6 +134,8 @@ function changedAnything(r) {
         r.sessionMetaColumnsDropped > 0 ||
         r.withdrawMarkWritten > 0 ||
         r.sessionDeletingSwitchMarked > 0 ||
+        r.storeFaultSentencesRewritten > 0 ||
+        r.checkpointDisplayColumnsDropped > 0 ||
         r.runErrorCodeColumnRewritten > 0 ||
         r.runObjectivePreviewRewritten > 0 ||
         r.shellSentinelOwnersCleared > 0 ||
@@ -198,45 +205,9 @@ const RETIRED_SESSION_RULES_COLUMN = "rules";
 const OLD_GRAMMAR_SESSION_RULES_COLUMN = "rule_entries_old_grammar";
 const RETIRED_ASK_CAUSE_COLUMN = "denied_reason";
 const ASK_EXECUTION_LANE_COLUMN = "execution_lane";
+const RETIRED_CHECKPOINT_DISPLAY_COLUMNS = ["tool_name", "tool_input", "risk_descriptor", "rule_suggestions", "has_bidi_controls"];
+const CHECKPOINT_DISPLAY_COLUMNS_DROP_M54 = { kind: "drop", table: "checkpoint", columns: RETIRED_CHECKPOINT_DISPLAY_COLUMNS };
 export const ONE_TIME_MIGRATIONS = [
-    {
-        id: "M13",
-        introducedIn: "7.123.0",
-        releasedOn: "2026-10-10",
-        removableAfter: "2026-11-09",
-        removal: "删 `config-lkg.ts` 的 formatVersion 2 读回迁移:`migrateV2Lkg` / `migrateDroppedIdentityRow` / `RETIRED_CATALOG_COORDINATE` 与其上的窗注;`loadLkg` 的 2 臂" +
-            "(版本判据里的 `2` 与 `formatVersion === 2 ? migrateV2Lkg(…)` 那一支 —— 2 回到「unknown formatVersion」拒)、返回型的 `migrated` 位与 JSDoc 里说它的那一行、" +
-            "文件头注「2 读回时一次性迁移」那一句;`boot/web-admin.ts` 读 `read.migrated` 打 `config_lkg_migrated` 的那一行(这一行与 M15 / M22 的读回迁移共用 —— 三条都删完才整段删,先删 M13 时只去掉信封 2 → 3 那一路的 `migrated` 来源);契约 §A.1d " +
-            "`droppedEntries` 一节「升级窗(如实)」那一条与 §A.1d `[config.model_refused_name_minted]` 那一条里「LKG 载体 `droppedIdentities` 读回时一次性迁移」那半句;手写 formatVersion 2 信封的测试夹具" +
-            "(`test/config-lkg.test.ts`、`test/config-hot/batch1-version-ordinal.test.ts` 改写成 3;`test/models-dropped-entries-s1295.test.ts` 的旧 LKG 迁移格改钉 2 读回不可用)",
-        afterRemoval: "既有响亮臂 `config_lkg_unusable`(`loadLkg` 对 2 答「unknown formatVersion 2」):2 读回 ⇒ 不可用,中心可达照拉(整拉,读腿铸出完整载体,新 LKG 按 3 覆盖)、" +
-            "断着则 env 兜底,下一份干净候选重写 —— 与回滚到 7.122.0 读 3 同一种处置",
-        reportKeys: [],
-    },
-    {
-        id: "M15",
-        introducedIn: "7.124.0",
-        releasedOn: "2026-10-11",
-        removableAfter: "2026-11-10",
-        removal: "删 `config-lkg.ts` 的载荷迁移:`migrateLkgPayload` 与其上的窗注、`loadLkg` 里调它的那一段(载荷照旧过 `lkgPayloadJudged`)、`LkgReadMigration.receipts`" +
-            "(信封 2 → 3 的 M13 若已先删,`LkgReadMigration` 与 `migrated` 位一并删)、对 `@sema-agent/settings-schema/one-time-migrations` 的 import;`loadLkg` 的版本判据收成" +
-            "只认 4(3 回到「unknown formatVersion」拒);`boot/web-admin.ts` 读回后按 4 写回的那一段;文件头注 formatVersion 4 一段里「每次读回都过迁移」那一句;" +
-            "`test/ss11-stored-migrations.test.ts` 的 M15 组(4 原样读回那一格留)",
-        afterRemoval: "既有响亮臂 `config_lkg_unusable`(`loadLkg` 对 3 答「unknown formatVersion 3」):旧载荷的 LKG 读回 ⇒ 不可用,中心可达照拉(整拉,新 LKG 按 4 覆盖)、" +
-            "断着则 env 兜底 —— 与回滚到 7.123.0 读 4 同一种处置",
-        reportKeys: [],
-    },
-    {
-        id: "M16",
-        introducedIn: "7.124.0",
-        releasedOn: "2026-10-11",
-        removableAfter: "2026-11-10",
-        removal: "删 `config-d-migration.ts` 整只文件与两个入口的调用(`boot/web-admin.ts` 建本地配置源之后、`run-local.ts` 建配置源之后各一行 + import);" +
-            "`test/ss11-stored-migrations.test.ts` 的 M16 组;部署文档里「起服自动迁 config.d」那一句(运维仍可手跑契约命令行,直到契约删族)",
-        afterRemoval: "契约读腿的墓碑(永久):config.d 里还带旧形的域文档 —— `runtime.json` 带事实 ⇒ `RetiredDomainError` 整份读不出;`atModelAllowlist` / `models.default` ⇒ " +
-            "models 域降级、rosters 整份读不出 —— 拒句点名迁移 id;出路是运维手跑契约命令行(契约删族之后只剩手改)",
-        reportKeys: [],
-    },
     {
         id: "M17",
         introducedIn: "7.129.0",
@@ -253,6 +224,7 @@ export const ONE_TIME_MIGRATIONS = [
             "`config.schema_mismatch`(缺 `rule_entries`、多那一列)—— " +
             "出路是先在一只带本条的版本上起服一次;② 行里仍带退役命令桶:SQL 店读回照旧答 `corrupt`(引擎的形读法点名那只桶,与本条在场时同一个结局),只是起服日志不再逐行点名 —— " +
             "运维在库里把那一行改写成引擎文法或删掉它(删会话即删规则);③ 跳过本条直接升的库同样没有改名那一拍的条目判读 —— 由 ① 的拒启接住(出路同 ①)",
+        stopThenStart: null,
         reportKeys: ["sessionRuleColumn", "sessionRuleRowsWithRetiredBuckets", "sessionRuleRowsWithOldGrammarEntries", "sessionRuleRowsWithUnreadableDeny"],
         shapeChanges: [{ kind: "rename", table: SESSION_POLICY_TABLE, from: [RETIRED_SESSION_RULES_COLUMN, OLD_GRAMMAR_SESSION_RULES_COLUMN], to: SESSION_RULES_COLUMN.name }],
     },
@@ -271,6 +243,7 @@ export const ONE_TIME_MIGRATIONS = [
             "幂等重入走 park、回决口按要人;仍带它们的待决停驻行(把 `APPROVAL_TERMINAL_BACKSTOP_MS` 调长的部署、local 车道引擎 File 店里窗关仍未决的 —— 停驻行从来不由本服务改写," +
             "窗内靠读侧改写读,窗关后读侧改写删)由本服务的读面按坏行处置:运维队列行缺那一位 + `server.approval-card.closed-word-out-of-set` 计数、耐久 `/decide` 的 remember 按强制(只放行这一次)。" +
             "引擎续跑不受影响:续跑入口读行摘要、不按今日闭集重判停驻行上的这两座,行字节引擎怎么写的还是怎么在",
+        stopThenStart: null,
         reportKeys: ["retiredCardWordAskRowsRewritten", "retiredCardWordRowsUnreadable"],
     },
     {
@@ -298,6 +271,7 @@ export const ONE_TIME_MIGRATIONS = [
             "批准后撞 `resume.tool_unavailable`(拒绝照常可出)—— 出路是拒绝那张卡,用改好的 `toolAxes` 重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、" +
             "调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行(头注 M19 段)。A2A 一面同:存量体里 `a2aPeers[].toolAxes` 判不过的对端续跑整条不挂," +
             "运维 warn `a2a_injection_dropped` 点名,停驻在它 skill 上的审批批准后撞 `resume.tool_unavailable` —— 出路同上:拒绝那张卡,改好声明重新提交",
+        stopThenStart: null,
         reportKeys: [],
     },
     {
@@ -315,6 +289,7 @@ export const ONE_TIME_MIGRATIONS = [
         afterRemoval: "没有新的臂,接住它的是今天的读法(删码零行为变化:窗关那一刻起重读臂已经不生效):升级前存下的请求体里带这两形的 `settings.hooks`,在会采纳 hooks 的车道上续跑被拒 —— " +
             "「请求成员读不出」判据(`src/unread-request-members.ts`)答 409 `resume_blocked_by_policy`(`blockedBy: request.field_invalid`,`field: settings.hooks`),卡仍待决、行不动(7.147.0 起;此前是整份不采纳照跑)—— " +
             "出路是取消这类停驻任务、删掉那个未知字段 / `__proto__` 键后重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行(头注 M20 段)",
+        stopThenStart: null,
         reportKeys: [],
     },
     {
@@ -330,6 +305,7 @@ export const ONE_TIME_MIGRATIONS = [
             "队列行不带卡词(壳显示通用审批卡),到期走 SLA 拒扫腿(模型读到「拒」),决断口仍按工具名认问答(`approve` 必须带 `answer`,否则 400);出路 = 升级前答完或拒掉;" +
             "② `gate_kind` 为 NULL 的停驻行:既有响亮臂 —— 运维待批队列(`listPending`)不列它、计 `server.approvals.queue-row-gate-kind-missing`(决断口按门型绑定取行,本来就不认它);" +
             "出路是运维把那一行置 expired 或删掉会话(终局收割照旧在 `terminal_at_ms` 收它)",
+        stopThenStart: null,
         reportKeys: ["parkedQuestionCardsWritten", "parkedQuestionRowsLeftAsWritten", "parkedRowGateKindsBackfilled", "parkedRowsUnresumableExpired"],
     },
     {
@@ -337,11 +313,12 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.132.0",
         releasedOn: "2026-10-18",
         removableAfter: "2026-11-17",
-        removal: "删 `config-lkg.ts` 的 formatVersion 4 读回迁移:`migrateV4Lkg` 与其上的窗注;`loadLkg` 里调它的那一支(`formatVersion !== 5` 那一段)与版本判据里的 `4`" +
-            "(4 回到「unknown formatVersion」拒;若 M13 / M15 仍在窗内,先删到期的那几条再删本条,版本判据收成只认 5)、`LkgReadMigration.fromFormat` 的 `4`;" +
+        removal: "删 `config-lkg.ts` 的 formatVersion 4 读回迁移:`migrateV4Lkg` 与其上的窗注;`loadLkg` 里调它的那一支(`formatVersion === 4` 那一段)与版本判据里的 `4`" +
+            "(4 回到「unknown formatVersion」拒,版本判据收成只认 5)、`LkgReadMigration` 与 `loadLkg` 返回型的 `migrated` 位(它只服务这一条)、`boot/web-admin.ts` 打 `config_lkg_migrated` 并按当期信封写回的那一段;" +
             "文件头注 formatVersion 5 一段里「4 的载荷 …」那两句;`test/center-artifact-v3-lane.test.ts` 的两格 4 读回(5 原样读回那一格留)",
         afterRemoval: "既有响亮臂 `config_lkg_unusable`(`loadLkg` 对 4 答「unknown formatVersion 4」):4 读回 ⇒ 不可用,中心可达照拉(整拉,新 LKG 按 5 覆盖)、断着则 env 兜底 —— " +
             "与回滚到 7.131.x 读 5 同一种处置",
+        stopThenStart: null,
         reportKeys: [],
     },
     {
@@ -360,6 +337,7 @@ export const ONE_TIME_MIGRATIONS = [
             "其余调用方答 404(与别人的行同体)—— 出路是升级时先过一次带本条的版本,或运维按 `placement_root_session_id`(缺则 `placement_parent_session_id`)那一行的属主手工回填、" +
             "推不出的写一个任何主体都不匹配的值;停驻挂点只比对宿主行属主与引擎交来的属主(复活腿交那一行自己的属主),不写无主行;" +
             "建行那一笔记 `placement.owner` 不随本条删(那是常设的写法 —— core 盒义务 7,不是迁移)",
+        stopThenStart: null,
         reportKeys: ["placedSessionOwnersInherited", "placedSessionOwnersOrphaned", "placedSessionOwnersRemaining"],
     },
     {
@@ -374,6 +352,7 @@ export const ONE_TIME_MIGRATIONS = [
             "`test/one-time-migrations.test.ts` 的 M24 组与 `test/one-time-migrations-db-integration.test.ts` 的 M24 格。**不随本条删**:属主表、行主键里的令牌与店的写面 / 读面墙(那是常设的数据形)",
         afterRemoval: "起服对账一族的列集探针接住(`schema-consistency.ts` 的 `assertSchemaMatchesCode`,常设):跳过了带本条的版本直接升的库,`workflow_journal` 上仍带 scope 列、没有 incarnation 列 = 库与代码列集不符 ⇒ " +
             "响亮拒启(`config.schema_mismatch`),拒句点名两列;出路是先在带本条的版本(7.133.x)起服一次让它走完,再升",
+        stopThenStart: null,
         reportKeys: ["workflowJournalScopeColumn", "workflowJournalOwnersBackfilled", "workflowJournalForeignScopeRowsRemoved"],
         shapeChanges: [{ kind: "rebuild", table: WORKFLOW_JOURNAL_TABLE, whilePresent: RETIRED_JOURNAL_SCOPE_COLUMN, supplies: [WORKFLOW_JOURNAL_SUPPLIED_COLUMN] }],
     },
@@ -387,6 +366,7 @@ export const ONE_TIME_MIGRATIONS = [
             "`test/memory-project-layer-fold.test.ts` 的 ① 格与 `test/memory-project-layer-fold-db-integration.test.ts` 整份、" +
             "`test/project-identity.test.ts` 的 `repo:` 金样格(公式金样改钉 `p` 档摘要)",
         afterRemoval: "没有新的臂(如实):窗内一次都没跑过任务的项目,它的 `repo:` 层留在库里、不再被任何读列表包含(不读、不删;起服拒只管运维点名这一族);出路 = 升级时先过一次带本条的版本并在每个项目跑一次任务",
+        stopThenStart: null,
         reportKeys: [],
     },
     {
@@ -399,6 +379,7 @@ export const ONE_TIME_MIGRATIONS = [
             "**不随本条删**:键的铸点 `breakerKeyOf` / `routeDigestOf`(常设的键形)与新表 `breaker_state`",
         afterRemoval: "没有新的臂(如实):跳过了带本条的版本直接升的库,退役表 `circuit_breaker` 留在库里、没有读者也没有写者(断路器只读写 `breaker_state`)—— " +
             "出路 = 升级时先过一次带本条的版本(它起服删掉退役表);不先过也无害 —— 退役表没有读者也没有写者,留在库里只占空间(建议性状态,无数据价值)",
+        stopThenStart: null,
         reportKeys: ["retiredBreakerTablesDropped"],
     },
     {
@@ -411,6 +392,7 @@ export const ONE_TIME_MIGRATIONS = [
             "`MAILBOX_KEYED_TABLES` / `mailboxKeyDeleteSql`(`drop` 的常设语句)",
         afterRemoval: "没有新的臂(如实):跳过了带本条的版本直接升的库,判官拒的键的行留在库里,任何入口对它都按「箱不在」答(不读、不投、不清)—— 出路 = 升级时先过一次带本条的版本," +
             "或照 `docs/DEPLOY-PREREQS.md` 7.133.0 SQL 节的查法按键手工删",
+        stopThenStart: null,
         reportKeys: ["mailboxRejectedKeyRowsRemoved"],
     },
     {
@@ -428,6 +410,7 @@ export const ONE_TIME_MIGRATIONS = [
             "**不随本条删**:凭据位密封的常设规则(封口 / 开口 / 闭集 / 读口第四态 / 409 码 / 装配期拒启)",
         afterRemoval: "读口对凭据位上明文的常设拒臂接住:跳过了带本条的版本直接升的库,带明文凭据的停驻行续跑答 409 `conflict.checkpoint_ctx_unsealable`(`reason:\"plaintext\"`)," +
             "行字节不动 —— 出路 = 作为新任务重提(仍停驻的先取消),或升级时先过一次带本条的版本",
+        stopThenStart: null,
         reportKeys: [],
     },
     {
@@ -440,6 +423,7 @@ export const ONE_TIME_MIGRATIONS = [
             "`test/checkpoint-index-columns-db-integration.test.ts` 的 M29 格。**不随本条删**:`approval_card` 列、写口的派生、到期 facet 的生成谓词(常设)",
         afterRemoval: "没有新的臂(如实):跳过了带本条的版本直接升的库,升级前停驻、升级后仍挂着的行卡列是 NULL —— 生成谓词读门型的 facet(审批门 ⇒ SLA 拒扫腿),问答行到期被拒扫" +
             "(引擎对问答拒收 `sla_timeout`,拒扫腿每拍一条失败,由 `terminal_at_ms` 兜底收割);运维队列行不带卡词。出路 = 升级前答完 / 拒掉停驻的问答,或升级时先过一次带本条的版本",
+        stopThenStart: null,
         reportKeys: ["parkedApprovalCardsBackfilled", "parkedApprovalCardRowsUnreadable", "parkedApprovalCardRowsTooLong"],
     },
     {
@@ -468,6 +452,7 @@ export const ONE_TIME_MIGRATIONS = [
             "**不随本条删**:续跑判据的第四问(退役请求键闭集 `RETIRED_REQUEST_KEYS` / `retiredRequestKeyOf` / `retiredRequestKeyRefusal`,常设)",
         afterRemoval: "续跑判据第四问的常设拒臂接住:跳过了带本条的版本直接升的库(或窗内从没起过本版的部署),体里仍带 `promptProfile` 的停驻行续跑在五个问点上答 409 `checkpoint.unsupported_version`" +
             "(判据 `retired_request_key`,`http/stored-body-replay.ts`)、行字节不动 —— 出路 = 作为新任务重提(`promptLean` 代替 `promptProfile`;仍停驻的先取消),或升级时先过一次带本条的版本并在窗内起服",
+        stopThenStart: null,
         reportKeys: [],
     },
     {
@@ -481,6 +466,7 @@ export const ONE_TIME_MIGRATIONS = [
             "`test/memory-sync-client.test.ts` 里标题以 `🔴 M31:` 或 `M31 ` 起头的格、对 `relocateSyncCursorsM31` 的引入与常量 `LEGACY_PEER_DIR`,常量 `CURSOR_FILE` 的行注改成「没有读者」(用它的格随删后无人用它 ⇒ 常量一起删)",
         afterRemoval: "没有新的臂(如实):跳过了带本条的版本直接升的数据根,升级前的游标还在 `sync-cursors/central/` 与 `sync-cursor-central.json`,没有读者 ⇒ 那几层以空基线首轮同步" +
             "(两边都改过的条目按冲突上报,上一轮之后在一侧删掉的条目从另一侧回来)。出路 = 升级时先过一次带本条的版本并在窗内跑一轮同步,或升级前在旧版上跑完一轮同步、再删掉这些文件",
+        stopThenStart: null,
         reportKeys: [],
     },
     {
@@ -502,6 +488,7 @@ export const ONE_TIME_MIGRATIONS = [
             "**不随本条删**:执行放置八列、会话店的执行席、设备店的首绑 / 换绑两只写(常设的数据形)",
         afterRemoval: "起服对账一族的跳版库拒启臂接住:删码同版把 `device_session` / `device_session_retired` 两张表加进退役 schema 判据(`schema-consistency.ts` 的跳版库探针,先于建表)⇒ " +
             "跳过了带本条的版本直接升的库响亮拒启,出路 = 先在带本条的版本起服一次让切换走完,再升;缺执行放置列的库由列集对账缺列拒启(`config.schema_mismatch`,拒句给 ALTER),同一出路",
+        stopThenStart: null,
         reportKeys: ["executionPlacementColumnsAdded", "deviceBindingsMoved", "deviceBindingsOrphaned", "deviceBindingTablesDropped", "executionPlacementsBackfilled", "askExecutionLanesBackfilled", "executionPlacementSessionsUnreadable"],
         shapeChanges: [{ kind: "add", table: APPROVAL_ASK_TABLE, column: ASK_EXECUTION_LANE_COLUMN, whilePresent: { table: "session_meta", anyOf: SESSION_EXT_MOVED_COLUMNS.map((c) => c.name) } }],
     },
@@ -523,6 +510,7 @@ export const ONE_TIME_MIGRATIONS = [
             "`session-error-wire.ts` 的 `StampedSessionArchiveError` / `STAMPED_SESSION_ARCHIVE_SENTENCE` / `sessionErrorWireOf` 与本店带戳判的唯一读口 `assertArchiveAnonymous`(fork 的源、改日志推送的落点、会话同步导入第一阶段的早拒三处问它)、行上缺建档时刻的 F 类读法(`server.local-session-row.created-at-absent`)",
         afterRemoval: "三只常设臂接住:① 数据根下的快照目录非空 ⇒ 拒启(`config.local_archive_snapshot_present`,点名文件与两条出路);② 跳过了带本条的版本直接升的数据根(或本条留着的存档),带属主戳的存档被 fork、改日志的推送与会话同步导入第一阶段对 fork / stale 的早拒同一只具名拒(409 `conflict.session_archive_stamped` + 固定句,零写 / 行格净零写)," +
             "读 / 续跑 / 拉取照常 —— 出路 = 删掉会话后重推,或升级时先过一次带本条的版本并在窗内起服;③ 行上没有建档时刻的格(同一类数据根)⇒ 列表 / 会话视图 / 交出的元数据读纪元(F 类 tag 计数)",
+        stopThenStart: null,
         reportKeys: ["localArchiveRowFactsBackfilled", "localArchivesAnonymized", "localArchivesKeptStamped", "localArchivesUnreadable", "localArchiveSnapshotsRecovered"],
     },
     {
@@ -539,6 +527,7 @@ export const ONE_TIME_MIGRATIONS = [
         afterRemoval: "两只常设臂接住:① SQL —— 删码同版把 `approval_ask.denied_reason` 加进退役 schema 判据(`schema-consistency.ts` 的跳版库探针,先于建表)⇒ 跳过了带本条的版本直接升的库响亮拒启," +
             "出路 = 先在带本条的版本起服一次让迁移走完,再升(列册对账见幽灵列 / 缺列同样拒启,但它的拒句给的是加列,不是这一出路 —— 所以退役判据要在删码同版加上);" +
             "② local —— 信封号 1 的日志记录走 File 问账店「认不出的信封号」拒启(`unknown envelope version`,点名文件与出路:用写下它的那一版起服一次,或移开文件)",
+        stopThenStart: null,
         reportKeys: ["askCauseColumnsChanged", "askParkTriggersMoved", "askJournalRecordsUpgraded"],
         shapeChanges: [
             { kind: "rename", table: APPROVAL_ASK_TABLE, from: [RETIRED_ASK_CAUSE_COLUMN], to: APPROVAL_ASK_ENDING_CAUSE_COLUMN.name },
@@ -555,6 +544,7 @@ export const ONE_TIME_MIGRATIONS = [
             "**不随本条删**:模型面闸 `env-model-table-gate.ts`、`LocalConfigProvider` 读决定(etag 覆盖)、目录信任判官的根级文档名单(常设)",
         afterRemoval: "常设的模型面闸接住:跳过了带本条的版本直接升的本地根(或运行记录在场而决定缺席的根),决定缺席读作 kept ⇒ env 模型表已声明时管模型面的本地目录被组拒 " +
             "`config.catalog_replaces_env_models`,拒句点名被顶替的 env 模型与两条出路(在配置根写 `config.env-models.json` = `{\"envModels\":\"replaced\"}`,或撤掉 MODEL_ID / MODEL_CHEAP_ID)",
+        stopThenStart: null,
         reportKeys: [],
     },
     {
@@ -572,6 +562,7 @@ export const ONE_TIME_MIGRATIONS = [
             "**不随本条删**:`SqlDurableRulePartitionProvider` 收「方言 + 执行口」的那一形(`BucketSql`;常设,池照旧满足它)",
         afterRemoval: "没有响亮臂(如实):删码之后,跳过了带本条的版本直接升的库(或回滚到引擎 7.61.0 之前、在其上又导入过的库),存量的这种全局 `/x` allow 照旧在每个项目根放行,本服务不再点名 —— " +
             "出路 = 升级时先过一次带本条的版本并起服;或运维列出桶里出处为导入(`adds[].origin` = `imported-cc`)、scope 为全局、从 `/` 写起的 allow(`GET /v1/rules`)并撤掉(`DELETE /v1/rules`,撤的是这条规则的全部批准)",
+        stopThenStart: null,
         reportKeys: ["importedLayerRootAllowsRetired", "importedLayerRootBucketsSkipped", "importedLayerRootBucketsUnnamed"],
     },
     {
@@ -584,6 +575,7 @@ export const ONE_TIME_MIGRATIONS = [
             "`test/approval-card-source-key-m37.test.ts` 整只文件、本文件头注 M37 段",
         afterRemoval: "既有坏行臂接住(响亮,不再改名):仍带旧键的存卡(跳过了带本条的版本直接升的库、窗关之后还在写的 7.142.x 副本)整卡读不出 —— 断连重放跳过 + 一次 warn、" +
             "幂等重入走 park、回决口按要人",
+        stopThenStart: null,
         reportKeys: [],
     },
     {
@@ -598,6 +590,7 @@ export const ONE_TIME_MIGRATIONS = [
             "`test/settings-env-credential.test.ts` 里窗开的三格(剥键照续 / 剥空登记空表 / 预判窗开不拦)与「窗关当天仍开」那格、`withM38Window` 助手(窗关的几格改成不注入窗直接断言拒)、M38 登记行那一格;本文件头注 M38 段",
         afterRemoval: "没有新的臂,接住它的是窗关之后的读法(删码零行为变化:窗关那一刻起剥键臂已经不生效):存体 `settings.env` 里仍带凭据条目的停驻行,续跑前的预判拒(409 `resume_blocked_by_policy`,`blockedBy: request.env_credential_refused`,机读位点名键与命中类),卡仍 pending —— " +
             "出路是取消那条 run,把凭据挪进引擎进程环境后重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行、窗内续跑过又停驻到窗外的任务(头注 M38 段)",
+        stopThenStart: null,
         reportKeys: [],
     },
     {
@@ -611,6 +604,7 @@ export const ONE_TIME_MIGRATIONS = [
             "**不随本条删**:数据根建目录只经 `ensureDir` 这条律本身(常设)、`plugins/owner-only-file-mode.ts`(本服务文件的 `0600` 唯一值与原子写的两个出口:异步出口常设,同步出口按它自己的退役条件 —— core 的原子写改成独占新建 tmp —— 走,不随本条)及它们的钉 —— `test/data-dir-law-census.test.ts`(`src/**` 零裸 mkdir、零手写 0o700、文件模式只认一个名字、tmp 只在一只写口里铸)与 `test/data-dir-modes.test.ts`(每只 local 店首建目录 0700、旧 tmp 不被复用)",
         afterRemoval: "没有响亮臂(如实,也无需):删码之后,跳过了带本条的版本直接升的数据根,升级前铸成的 0755 目录原样留着(新建的目录一律 0700,不受影响;里面的文件多半仍是 0600),本服务不再点名 —— " +
             "出路 = 运维一次 `chmod 700` 数据根下 `runs`(及其子目录)· `space-commits` · `checkpoint-ctx` · `.tmp` · `attachments` · `scratchpad`(及其子目录)· `plugin-cache`(及其子目录)· `<记忆引擎根>/sync-cursors`,或升级时先过一次带本条的版本并起服",
+        stopThenStart: null,
         reportKeys: [],
     },
     {
@@ -618,7 +612,7 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.147.0",
         releasedOn: "2026-11-07",
         removableAfter: "2026-12-07",
-        removal: "删 `src/plugins/execution-lane-rename-m40.ts` 整只文件;本文件的 M40 步(`renameRetiredExecutionLaneWordsM40` / `refuseWhileRunsHeartbeat`〔读证据的那一处调用;证据读法 `readOlderReplicaEvidence` 与判活窗输入归 M52 行〕/ `ExecutionLaneRenameRefusedError` / " +
+        removal: "删 `src/plugins/execution-lane-rename-m40.ts` 整只文件;本文件的 M40 步(`renameRetiredExecutionLaneWordsM40` / `refuseExecutionLaneRenameM40`〔本行 `stopThenStart.refuse`;证据读法 `readOlderReplicaEvidence`、判活窗输入与守卫段归 `stop-then-start.ts`,常设,不随本行删〕/ `ExecutionLaneRenameRefusedError` / " +
             "`EXECUTION_LANE_RENAME_REFUSED_CODE`,`migrateStepsOn` 第一步那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `executionLaneWordsRenamed`、头注 M40 段;" +
             "`store-backend.ts` 的 `LocalBackend.ensureSchema` 第一步与 `executionLaneWordsRenamed` 字段;" +
             "`local-session-store.ts` 的内核 `renameRetiredExecutionLaneWordsInCellsM40` 与数据根准入的具名读者 `readSessionMetaSidecarInWindow`(在内存里套的那一步;准入的解码点改用 `readSessionMetaSidecar`);" +
@@ -629,6 +623,8 @@ export const ONE_TIME_MIGRATIONS = [
         stopThenStart: {
             reason: "renames the retired execution-lane word \"in-process\" to \"none\" on stored approval asks and sessions; a replica of an earlier version would keep writing the old word after the rename",
             owedOn: owesExecutionLaneRenameM40,
+            refuse: refuseExecutionLaneRenameM40,
+            fence: { kind: "accepted", residual: "an earlier replica keeps writing the old word after the rename; this version's readers refuse such a row loudly, and the next boot inside the window renames it again" },
         },
         reportKeys: ["executionLaneWordsRenamed"],
     },
@@ -637,8 +633,8 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.147.0",
         releasedOn: "2026-11-07",
         removableAfter: "2026-12-07",
-        removal: "删本文件的 M41 步(`moveSessionCellsToSideTable` / `refuseSessionExtMoveWhileRunsHeartbeat` / `deploymentColumnsOnMeta` / `SessionExtMoveRefusedError` / `SESSION_EXT_MOVE_REFUSED_CODE` / " +
-            "`SessionExtMoveRefusalReason` / `sameCell` / `SESSION_EXT_MOVE_PAGE`,`migrateStepsOn` 里那两行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `sessionExtRowsMoved` / `sessionMetaColumnsDropped`、头注 M41 段;" +
+        removal: "删本文件的 M41 步(`moveSessionCellsToSideTable` / `refuseSessionExtMoveM41`〔本行 `stopThenStart.refuse`〕/ `deploymentColumnsOnMeta` / `SessionExtMoveRefusedError` / `SESSION_EXT_MOVE_REFUSED_CODE` / " +
+            "`SessionExtMoveRefusalReason` / `sameCell` / `SESSION_EXT_MOVE_PAGE`,`migrateStepsOn` 里那一行)、报告 / 收据 / 日志 / `NO_SQL_MIGRATIONS` 的 `sessionExtRowsMoved` / `sessionMetaColumnsDropped`、头注 M41 段;" +
             "M32 读形里的 `cellsOnSideTable` 判(它读本条的 `deploymentColumnsOnMeta`):M32 还在时改成恒旁表形 —— 删 M32 写 `session_meta` 八列的那些臂(② ④ ④b ⑥ 与 ③ 的 `migrateDeviceBindingsStatement` 臂)," +
             "留 ③ 的旁表臂(`migrateDeviceBindingsOntoSideTableStatements`:围栏拒句的「采旧」在任何库上仍要能落到执行格);M32 先于本条删码时这些随 M32 一并删;`test/session-ext-move-db-integration.test.ts` 整只文件。能力名单 `REPLICA_CAPABILITIES` 里的 `M41` 不删(只增)",
         afterRemoval: "跳过了带本条的版本直接升上来的库:`session_meta` 上仍带部署格列 ⇒ 起服列册对账拒启(`config.schema_mismatch`,那几列是本树之外的多余列,拒句不给 ALTER —— 出路是带本条的版本);" +
@@ -646,6 +642,8 @@ export const ONE_TIME_MIGRATIONS = [
         stopThenStart: {
             reason: "moves the session deployment cells from session_meta to session_ext and then retires the old columns; a cell an earlier replica writes between the copy and the retirement is lost, and every cell write it makes afterwards fails",
             owedOn: owesSessionExtMoveM41,
+            refuse: refuseSessionExtMoveM41,
+            fence: { kind: "accepted", residual: "a cell an earlier replica writes between the copy and the column drop is lost; after the drop every cell write it makes fails" },
         },
         reportKeys: ["sessionExtRowsMoved", "sessionMetaColumnsDropped"],
         shapeChanges: [{ kind: "drop", table: "session_meta", columns: SESSION_EXT_MOVED_COLUMNS.map((c) => c.name) }],
@@ -655,7 +653,7 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.148.0",
         releasedOn: "2026-11-08",
         removableAfter: "2026-12-08",
-        removal: "删 `src/plugins/scenario-prefix-switch-m42.ts` 整只文件;本文件的 M42 步(`switchScenarioPrefixM42` / `scannedIdentityColumnsM42`,`migrateStepsOn` 第一步那一行)、报告 / 收据 / 日志的 `scenarioPrefixSourcesScanned`、头注 M42 段;" +
+        removal: "删 `src/plugins/scenario-prefix-switch-m42.ts` 整只文件;本文件的 M42 步(`switchScenarioPrefixM42` / `scannedIdentityColumnsM42` / `refuseScenarioPrefixSwitchM42`〔本行 `stopThenStart.refuse`〕,`migrateStepsOn` 第一步那一行)、报告 / 收据 / 日志的 `scenarioPrefixSourcesScanned`、头注 M42 段;" +
             "`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里 M42 那一腿(`switchLocalScenarioPrefixM42`)与四只 File 店的 `scenarioPrefixOwnerRowsM42`(run / 会话 / 问 / 附件);`test/scenario-prefix-switch-m42.test.ts` 与 `test/scenario-prefix-switch-db-integration.test.ts` 两只文件。" +
             "标记表 `one-time-migration-marker.ts` 不随删(常设:中央建表语句建它,`Skill` 豁免截点那一行的家);库里留下的 `M42` 标记行 / 数据根里的标记文件无人再读,不删",
         afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升的库,存量里以 `_scn:` 开头的身份被恢复管线读作某个人的场景(拆不出合文法的场景与人的 ⇒ `owner.malformed_subject` 响亮)。" +
@@ -663,6 +661,8 @@ export const ONE_TIME_MIGRATIONS = [
         stopThenStart: {
             reason: "scans stored identities for the reserved scenario prefix and records a marker; an earlier replica does not reserve the prefix and would keep accepting such identities after the scan",
             owedOn: owesScenarioPrefixSwitchM42,
+            refuse: refuseScenarioPrefixSwitchM42,
+            fence: { kind: "accepted", residual: "an earlier replica keeps accepting identities that start with the reserved scenario prefix after the scan; this version reads such an identity as someone else's scenario" },
         },
         reportKeys: ["scenarioPrefixSourcesScanned"],
     },
@@ -676,6 +676,7 @@ export const ONE_TIME_MIGRATIONS = [
             "local 会话元数据格「没有 `clientWrites` 位 ⇒ upgrade_pending」那一臂;库里留下的标记行无人再读,不删(与 M42 同一张标记表)",
         afterRemoval: "窗 30 天之后更早版本的副本早已不在;标记行不再被任何读者读(留着无害)。跳过了带本条的版本直接升上来的库:撤回出口从第一次起服就启用 —— " +
             "跨两版以上的混跑本就不被支持(7.147.0 起的停-迁-起)。出路 = 升级时先过一次带本条的版本并起服",
+        stopThenStart: null,
         reportKeys: ["withdrawMarkWritten"],
     },
     {
@@ -689,6 +690,7 @@ export const ONE_TIME_MIGRATIONS = [
         afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升上来的库,旧行按列答 —— 停驻两口在列建立之前写下的 `needs_review` 行 `errorCode` 缺席(`review.pending` 仍在 `result` 里)、" +
             "列里是没折过的原码的旧行答原码;`result.terminal.code` 仍在 `result` 里。调长了停驻终局兜底(`APPROVAL_TERMINAL_BACKSTOP_MS` > 30 天)的部署,窗关时还可能有更早版本写下的停驻没结清,读法同上。" +
             "出路 = 升级时先过一次带本条的版本并起服",
+        stopThenStart: null,
         reportKeys: ["runErrorCodeColumnRewritten"],
     },
     {
@@ -701,6 +703,7 @@ export const ONE_TIME_MIGRATIONS = [
             "`test/run-preview-m45.test.ts` 与 `test/helpers/run-preview-m45-rows.ts` 整个文件、`test/session-preview-single-source-db-integration.test.ts` 的 M45 组",
         afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升上来的库,7.124.0 之前写下的、以注入块起头的预览照旧按列答 —— 会话列表 / `GET /v1/tasks` / 助手任务行名 / 收件箱上显示那段块文本。" +
             "出路 = 升级时先过一次带本条的版本并起服",
+        stopThenStart: null,
         reportKeys: ["runObjectivePreviewRewritten"],
     },
     {
@@ -720,6 +723,7 @@ export const ONE_TIME_MIGRATIONS = [
             "SQL 在 `ensureSchema()` 建表之前(`LegacySkillExemptionsPresentError`,与退役 schema 探针同一处),local 在数据根准入(读数种别 `skipped-required-migration`)。" +
             "出路 = 先用一个仍带本条、不低于 7.148.0(local 还要不低于拒句里已记的引擎高水位)的版本对这只库完整起一次,再升;SQL 另可手工 `DELETE FROM approval_exemption WHERE tool_name = 'Skill'`。" +
             "T0 由常设的一步落(SQL:`ensureSchema()` 建表之后的种子行;local:准入的锁内一步):判过、缺席才落 —— 删码之后全新的库照样有 T0,不会被自己写下的合法行拒",
+        stopThenStart: null,
         reportKeys: ["legacySkillExemptionsDropped"],
     },
     {
@@ -736,6 +740,7 @@ export const ONE_TIME_MIGRATIONS = [
         afterRemoval: "跳版拒启臂接住(常设,数据根准入的一格:只读、本进程第一笔写之前、引擎高水位抬之前):(打开之前的引擎高水位早于 7.148.0 或缺席 ∨ 数据根里的收令牌欠账标记还在 —— 带本条的版本打开过、没收完)" +
             "∧ 根里有存档在而会话元数据格缺的会话 ⇒ 拒启 `config.schema_mismatch`(读数种别 `skipped-required-migration`,点名会话数与版本),零写、不抬高水位 —— " +
             "出路 = 先用一个仍带本条、不低于 7.148.0 且不低于已记高水位的版本(服务或 run-local)完整起一次,再升",
+        stopThenStart: null,
         reportKeys: ["localArchiveTokensAdopted", "localArchiveTokensMinted"],
     },
     {
@@ -750,6 +755,7 @@ export const ONE_TIME_MIGRATIONS = [
         afterRemoval: "没有响亮臂(如实):没有身份边界的部署跳过了带本条的版本直接升上来,哨兵属主的存量行仍记着那个字面量,属主面表已不认它 —— 不带主体的本地单用户读不到、续不上那些会话与 run(404)," +
             "带同一个头的请求仍读得到(属主相同)。出路 = 升级时先过一次带本条的版本并起服(或运维手工 `UPDATE <表> SET owner = NULL WHERE owner = 'anon:shell-live'`,三张表见删法)。" +
             "有身份边界的部署本条本来就零改写,删码前后同答(哨兵是一位普通的具名属主)",
+        stopThenStart: null,
         reportKeys: ["shellSentinelOwnersCleared", "shellSentinelOwnerRowsRetained"],
     },
     {
@@ -763,6 +769,7 @@ export const ONE_TIME_MIGRATIONS = [
         afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升上来的库,升级前停下、升级后仍挂着的卡归属为空 —— 按 run 找卡的读口找不到它:取消那条 run 不作废它、" +
             "两条停驻收割把那条 run 当成「卡已不在」收掉(`approval.expired`)、决断答 409 `conflict.resume_context_unavailable`,卡由终局兜底收割收走。出路 = 升级前答完 / 拒掉停驻的卡," +
             "或升级时先过一次带本条的版本并起服(或运维手工 `UPDATE checkpoint SET host_session_id = session_id WHERE host_session_id IS NULL`)",
+        stopThenStart: null,
         reportKeys: ["checkpointHostSessionsBackfilled"],
     },
     {
@@ -775,6 +782,7 @@ export const ONE_TIME_MIGRATIONS = [
             "`approval-ask-store-memory.ts` 的 `deleteByTaskM50`;`test/approval-ask-session-cascade.test.ts` 的 M50 组(窗内 / 窗关当天 / 窗关次日 / 坏记录四格与 `withM50Window` 助手);本文件头注 M50 段",
         afterRemoval: "既有的词表外动词拒启(`approval-ask-store-file.ts` 重放的动词闭集判,拒句点名账本路径,出路 = 用写下它的那一版起服一次或把文件挪开)—— 与窗关之后本条自己的拒启同一个结局,删码零行为变化。" +
             "会撞上它的是窗内一次都没在带本条的版本上起过服的 local 数据根(跳过本版直接升的),账本里又恰好留着一条嵌入方写下的这只词",
+        stopThenStart: null,
         reportKeys: [],
     },
     {
@@ -782,28 +790,49 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.148.0",
         releasedOn: "2026-11-08",
         removableAfter: "2026-12-08",
-        removal: "删本文件的 M51 步(`switchSessionDeletingM51` / `SessionDeletingSwitchRefusedError` / `SESSION_DELETING_SWITCH_REFUSED_CODE` / `SESSION_DELETING_MARK_ID`,`migrateStepsOn` 里那一行)、" +
+        removal: "删本文件的 M51 步(`switchSessionDeletingM51` / `refuseSessionDeletingSwitchM51`〔本行 `stopThenStart.refuse`〕/ `SessionDeletingSwitchRefusedError` / `SESSION_DELETING_SWITCH_REFUSED_CODE` / `SESSION_DELETING_MARK_ID`,`migrateStepsOn` 里那一行)、" +
             "报告 / 收据 / `changedAnything` / `readingFields` / `NO_SQL_MIGRATIONS` 的 `sessionDeletingSwitchMarked`、头注 M51 段;`test/session-deleting-state-db-integration.test.ts` 的 M51 组;" +
             "库里留下的 `M51` 标记行无人再读,不删。**不随本条删**:在删态本身(列、围栏、规则 L 的在删半、终刀判令牌 —— 常设)、标记表 `one-time-migration-marker.ts`(常设)",
         afterRemoval: "没有响亮臂(也无需):窗 30 天之后更早版本的副本早已不在;跳过了带本条的版本直接升上来的库 —— 跨两版以上的混跑本就不被支持(7.147.0 起的停-迁-起)。出路 = 升级时先过一次带本条的版本并起服",
         stopThenStart: {
             reason: "switches session deletion to a deleting state that every replica must read; an earlier replica does not read it and would accept a submission on a session this version is deleting",
             owedOn: owesSessionDeletingSwitchM51,
+            refuse: refuseSessionDeletingSwitchM51,
+            fence: { kind: "accepted", residual: "an earlier replica does not read the deleting state and may accept a submission on a session this version is deleting" },
         },
         reportKeys: ["sessionDeletingSwitchMarked"],
     },
     {
-        id: "M52",
-        introducedIn: "7.150.0",
-        releasedOn: "2026-11-09",
-        removableAfter: "2026-12-09",
-        removal: "删 `readOlderReplicaEvidence` 的心跳一半(按 `instance_id` 分组读 `task_run` 心跳的那一句、减去登记为知道该迁移的持有者那一步)与它的判活窗输入:`LiveRunWindowInput`、`SqlOneTimeMigrationInput` 里的那一半、" +
-            "`store-backend.ts` 的 `buildSqlOneTimeMigrationInput` 读 `runStaleSec` 的那一半、夹具 `test/helpers/db-schema-boot.ts` 的 `liveRunWindowMs`;停-迁-起守卫若已全部删码(M40 / M41 / M42 / M43 / M51 的窗都早于本条关)," +
-            "连同 `readOlderReplicaEvidence` 与 `stop-then-start-sentence.ts` 的 `OlderReplicaEvidence` / `OlderReplicaHolder` / `olderReplicaEvidenceSentence` 一并删;" +
-            "`test/run-liveness-single-source-gate.test.ts` ② 的 `one-time-migrations.ts` 白名单行与 ③ `store-backend.ts` 理由里「一次性迁移守卫」半句;`test/older-replica-evidence-db-integration.test.ts` 的证据组;头注 M52 段。" +
-            "**不随本条删**:副本能力登记(`replica-registration.ts`,能力名单只增)与起服准入(`serving-requirement.ts`)—— 常设",
-        afterRemoval: "没有响亮臂(如实):早于副本登记的副本不登记,删码之后它们对停-迁-起守卫完全不可见,忙与闲同 —— 发布日之后的天数不证明旧进程不在;出路只有运维:起带停-迁-起迁移的版本之前停光早于本条的副本",
-        reportKeys: [],
+        id: "M53",
+        introducedIn: "7.151.0",
+        releasedOn: "2026-11-10",
+        removableAfter: "2026-12-10",
+        removal: "删本文件的 M53 步(`rewriteStoreFaultSentencesM53` / `rewriteBackgroundAgentRowsM53` / `rewriteToolEndEventsM53` / `M53_PAGE` / `M53_BACKGROUND_AGENT_TABLE`,`migrateStepsOn` 里那两行)、整只 `store-fault-sentence-m53.ts`、" +
+            "报告 / 收据 / `changedAnything` / `readingFields` / `NO_SQL_MIGRATIONS` 的 `storeFaultSentencesRewritten`、头注 M53 段;`test/store-fault-sentence-m53.test.ts` 与 `test/store-fault-sentence-m53-db-integration.test.ts`(`scripts/db-integration-files.json` 里它那一行同删)。" +
+            "**不随本条删**:店边界本身(`terminal.ts` 的 `storeBoundaryFault`、`store-boundary.ts` 的封口 —— 常设)",
+        afterRemoval: "没有响亮臂(如实):跳过了带本条的版本直接升的库上,换句之前落盘的后台子代行与 run 事件卡格仍带库驱动的原句(回读 / 回放照原样渲染);出路只有运维:按留存清理,或手删那些行",
+        stopThenStart: null,
+        reportKeys: ["storeFaultSentencesRewritten"],
+    },
+    {
+        id: "M54",
+        introducedIn: "7.152.0",
+        releasedOn: "2026-11-11",
+        removableAfter: "2026-12-11",
+        removal: "删本文件的 M54 步(`dropCheckpointDisplayColumnsM54` / `owesCheckpointDisplayColumnsDropM54` / `refuseCheckpointDisplayColumnsDropM54`〔本行 `stopThenStart.owedOn` / `refuse`〕/ `CheckpointDisplayColumnsDropRefusedError` / " +
+            "`CHECKPOINT_DISPLAY_COLUMNS_DROP_REFUSED_CODE` / `RETIRED_CHECKPOINT_DISPLAY_COLUMNS` / `CHECKPOINT_DISPLAY_COLUMNS_DROP_M54`,`migrateStepsOn` 里那一行)、报告 / 收据 / `changedAnything` / `readingFields` / `NO_SQL_MIGRATIONS` 的 " +
+            "`checkpointDisplayColumnsDropped`、头注 M54 段;`test/checkpoint-display-columns-drop-m54.test.ts` 与 `test/checkpoint-display-columns-drop-m54-db-integration.test.ts`(`scripts/db-integration-files.json` 里它那一行同删)。" +
+            "能力名单 `REPLICA_CAPABILITIES` 里的 `M54` 不删(只增)。**不随本条删**:读时投影 `buildQueueActionFacts` / `boundedToolInput` 与给人看的入参的读法 `src/human-facing-args.ts`(常设)",
+        afterRemoval: "跳过了带本条的版本直接升上来的库:`checkpoint` 上仍带那几列 ⇒ 起服列册对账拒启(`config.schema_mismatch`,它们是本树之外的多余列,拒句不给 ALTER —— 出路是带本条的版本);" +
+            "列上的值不被任何读者读。出路 = 升级时先过一次带本条的版本并起服",
+        stopThenStart: {
+            reason: "retires the checkpoint display-copy columns (the approval queue reads a pending call's tool name, input, risk descriptor, rule offers and bidi bit from the suspended checkpoint itself); after the retirement every approval an earlier replica parks and every approval-queue read it serves fails",
+            owedOn: owesCheckpointDisplayColumnsDropM54,
+            refuse: refuseCheckpointDisplayColumnsDropM54,
+            fence: { kind: "structural", fencedBy: CHECKPOINT_DISPLAY_COLUMNS_DROP_M54 },
+        },
+        reportKeys: ["checkpointDisplayColumnsDropped"],
+        shapeChanges: [CHECKPOINT_DISPLAY_COLUMNS_DROP_M54],
     },
 ];
 export function migrationWindowOpen(window, today) {
@@ -821,7 +850,7 @@ export function migrationCarried(id) {
     return ONE_TIME_MIGRATIONS.some((w) => w.id === id);
 }
 export function stopThenStartMigrations(registry = ONE_TIME_MIGRATIONS) {
-    return registry.flatMap((row) => (row.stopThenStart === undefined ? [] : [{ id: row.id, ...row.stopThenStart }]));
+    return registry.flatMap((row) => row.stopThenStart === null ? [] : [{ id: row.id, introducedIn: row.introducedIn, ...(row.shapeChanges !== undefined ? { shapeChanges: row.shapeChanges } : {}), ...row.stopThenStart }]);
 }
 export const NO_SQL_MIGRATIONS = {
     sessionRuleColumn: "file-store",
@@ -853,6 +882,8 @@ export const NO_SQL_MIGRATIONS = {
     sessionMetaColumnsDropped: 0,
     withdrawMarkWritten: 0,
     sessionDeletingSwitchMarked: 0,
+    storeFaultSentencesRewritten: 0,
+    checkpointDisplayColumnsDropped: 0,
     askCauseColumnsChanged: 0,
     askParkTriggersMoved: 0,
 };
@@ -912,6 +943,8 @@ export function createSqlImportedLayerRootSource(exec) {
     return { candidateOwners: async () => ({ owners: await listRuleBucketOwners(exec), unnamedBuckets: 0 }), durable: new SqlDurableRulePartitionProvider(exec), isWholeBucketRefusal: isSqlBucketRefusal, isVanishedBucket: isSqlBucketVanished };
 }
 export async function runSqlOneTimeMigrations(dialect, pool, input, me = buildThisReplicaRegistration()) {
+    const stopThenStart = stopThenStartMigrations();
+    assertStopThenStartDeclarations(stopThenStart);
     const head = async (db) => {
         await assertReplicaTablesPresent(db, dialect, me);
         await registerReplica(db, dialect, me, Date.now());
@@ -919,6 +952,7 @@ export async function runSqlOneTimeMigrations(dialect, pool, input, me = buildTh
     };
     const locked = async (db) => {
         await assertServingRequirementsMet(db, me);
+        await guardOwedStopThenStart(db, dialect, input, stopThenStart);
         return migrateOn(db, dialect, input);
     };
     return dialect === "mysql" ? withMysqlLock(pool, head, locked) : withPgLock(pool, head, locked);
@@ -966,10 +1000,9 @@ async function migrateOn(db, dialect, input) {
     return completedReport(receipts);
 }
 async function migrateStepsOn(db, dialect, receipts, input) {
-    await switchScenarioPrefixM42(db, dialect, receipts, input);
-    await renameRetiredExecutionLaneWordsM40(db, dialect, receipts, input);
-    await refuseSessionExtMoveWhileRunsHeartbeat(db, dialect, input);
-    await switchSessionDeletingM51(db, dialect, receipts, input);
+    await switchScenarioPrefixM42(db, dialect, receipts);
+    await renameRetiredExecutionLaneWordsM40(db, dialect, receipts);
+    await switchSessionDeletingM51(db, dialect, receipts);
     await rewriteRunErrorCodeColumnM44(db, dialect, receipts);
     await rewriteRunObjectivePreviewM45(db, dialect, receipts);
     await clearShellSentinelOwnersM48(db, dialect, receipts, input);
@@ -979,6 +1012,7 @@ async function migrateStepsOn(db, dialect, receipts, input) {
     await migrateSessionRuleGrammar(db, dialect, receipts);
     await repairParkedRows(db, dialect, receipts);
     await backfillParkedApprovalCards(db, dialect, receipts);
+    await dropCheckpointDisplayColumnsM54(db, dialect, receipts);
     if (await tableExists(db, dialect, "session_meta"))
         await inheritPlacedSessionOwners(db, dialect, receipts);
     if ((await tableExists(db, dialect, PERMISSION_RULE_TABLE)) && (await columnExists(db, dialect, PERMISSION_RULE_TABLE, "grammar"))) {
@@ -992,6 +1026,7 @@ async function migrateStepsOn(db, dialect, receipts, input) {
     await moveSessionCellsToSideTable(db, dialect, receipts);
     await markWithdrawEnabledM43(db, dialect, receipts, input);
     await dropLegacySkillExemptionsM46(db, dialect, receipts);
+    await rewriteStoreFaultSentencesM53(db, dialect, receipts);
 }
 const M44_PAGE = 500;
 async function rewriteRunErrorCodeColumnM44(db, dialect, receipts) {
@@ -1035,6 +1070,71 @@ async function rewriteOneRunErrorCodeM44(db, dialect, row) {
         ? "UPDATE task_run SET error_code = ? WHERE task_id = ? AND status = ? AND updated_at = ? AND error_code <=> ?"
         : "UPDATE task_run SET error_code = $1 WHERE task_id = $2 AND status = $3 AND updated_at = $4 AND error_code IS NOT DISTINCT FROM $5", [target, taskId, String(row["status"]), row["updated_at"], storedCode]);
 }
+const M53_PAGE = 500;
+const M53_BACKGROUND_AGENT_TABLE = "background_agent";
+async function rewriteStoreFaultSentencesM53(db, dialect, receipts) {
+    if (await tableExists(db, dialect, M53_BACKGROUND_AGENT_TABLE))
+        await rewriteBackgroundAgentRowsM53(db, dialect, receipts);
+    if (await tableExists(db, dialect, "task_event"))
+        await rewriteToolEndEventsM53(db, dialect, receipts);
+}
+async function rewriteBackgroundAgentRowsM53(db, dialect, receipts) {
+    let after;
+    for (;;) {
+        const cursor = after === undefined ? "" : dialect === "mysql" ? " AND (scope_key, handle) > (?, ?)" : " AND (scope_key, handle) > ($1, $2)";
+        const page = await db.rows(`SELECT scope_key, handle, rev, ${jsonColumnText(dialect, "record_json")} FROM ${M53_BACKGROUND_AGENT_TABLE} WHERE ${jsonColumnTextExpr(dialect, "record_json")} LIKE '%"errorCode"%'${cursor} ORDER BY scope_key, handle LIMIT ${M53_PAGE}`, after === undefined ? [] : [after.scope, after.handle]);
+        for (const row of page) {
+            let record;
+            try {
+                record = decodeJsonColumn(row["record_json"], readJsonObjectColumn, `${M53_BACKGROUND_AGENT_TABLE}.record_json for handle ${String(row["handle"])}`);
+            }
+            catch (err) {
+                if (isJsonColumnBodyProblem(err))
+                    continue;
+                throw err;
+            }
+            const rewritten = rewrittenBackgroundRecordM53(record);
+            if (rewritten === undefined)
+                continue;
+            const rev = Number(row["rev"]);
+            const next = { ...rewritten, rev: rev + 1 };
+            receipts.storeFaultSentencesRewritten += await db.exec(dialect === "mysql"
+                ? `UPDATE ${M53_BACKGROUND_AGENT_TABLE} SET record_json = ?, rev = ? WHERE scope_key = ? AND handle = ? AND rev = ?`
+                : `UPDATE ${M53_BACKGROUND_AGENT_TABLE} SET record_json = $1, rev = $2 WHERE scope_key = $3 AND handle = $4 AND rev = $5`, [dialect === "mysql" ? JSON.stringify(next) : pgSafeJsonStringify(next), rev + 1, row["scope_key"], row["handle"], row["rev"]]);
+        }
+        if (page.length < M53_PAGE)
+            return;
+        const last = page[page.length - 1];
+        after = { scope: last["scope_key"], handle: last["handle"] };
+    }
+}
+async function rewriteToolEndEventsM53(db, dialect, receipts) {
+    const carded = dialect === "mysql" ? "JSON_EXTRACT(data, '$.structured.errorCode') IS NOT NULL" : "data->'structured'->>'errorCode' IS NOT NULL";
+    let after;
+    for (;;) {
+        const cursor = after === undefined ? "" : dialect === "mysql" ? " AND (task_id, seq) > (?, ?)" : " AND (task_id, seq) > ($1, $2)";
+        const page = await db.rows(`SELECT task_id, seq, ${jsonColumnText(dialect, "data")} FROM task_event WHERE type = 'tool_end' AND ${carded}${cursor} ORDER BY task_id, seq LIMIT ${M53_PAGE}`, after === undefined ? [] : [after.taskId, after.seq]);
+        for (const row of page) {
+            let data;
+            try {
+                data = decodeJsonColumn(row["data"], readJsonObjectColumn, `task_event.data for task ${String(row["task_id"])} seq ${String(row["seq"])}`);
+            }
+            catch (err) {
+                if (isJsonColumnBodyProblem(err))
+                    continue;
+                throw err;
+            }
+            const next = rewrittenToolEndDataM53(data);
+            if (next === undefined)
+                continue;
+            receipts.storeFaultSentencesRewritten += await db.exec(dialect === "mysql" ? "UPDATE task_event SET data = ? WHERE task_id = ? AND seq = ?" : "UPDATE task_event SET data = $1::jsonb WHERE task_id = $2 AND seq = $3", [dialect === "mysql" ? JSON.stringify(next) : pgSafeJsonStringify(next), String(row["task_id"]), row["seq"]]);
+        }
+        if (page.length < M53_PAGE)
+            return;
+        const last = page[page.length - 1];
+        after = { taskId: String(last["task_id"]), seq: last["seq"] };
+    }
+}
 const M45_PAGE = 500;
 async function rewriteRunObjectivePreviewM45(db, dialect, receipts) {
     if (!(await tableExists(db, dialect, "task_run")))
@@ -1140,6 +1240,18 @@ async function owesSessionExtMoveM41(read, dialect) {
 async function owesScenarioPrefixSwitchM42(read, dialect) {
     return !(await migrationMarked(read, dialect, SCENARIO_PREFIX_MARKER_ID));
 }
+async function owesCheckpointDisplayColumnsDropM54(read, dialect) {
+    return (await retiredDisplayColumnsPresent({ rows: read }, dialect)).length > 0;
+}
+async function retiredDisplayColumnsPresent(db, dialect) {
+    if (!(await tableExists(db, dialect, "checkpoint")))
+        return [];
+    const present = [];
+    for (const column of RETIRED_CHECKPOINT_DISPLAY_COLUMNS)
+        if (await columnExists(db, dialect, "checkpoint", column))
+            present.push(column);
+    return present;
+}
 async function owesSessionDeletingSwitchM51(read, dialect) {
     return !(await migrationMarked(read, dialect, SESSION_DELETING_MARK_ID));
 }
@@ -1157,14 +1269,15 @@ export class SessionDeletingSwitchRefusedError extends StoreBootRefusalError {
         this.name = "SessionDeletingSwitchRefusedError";
     }
 }
-async function switchSessionDeletingM51(db, dialect, receipts, input) {
+async function refuseSessionDeletingSwitchM51(evidence, read, dialect) {
+    return new SessionDeletingSwitchRefusedError(evidence, await describeUpgradeDriftTail(read, dialect));
+}
+async function switchSessionDeletingM51(db, dialect, receipts) {
     if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
         await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
     if (!(await owesSessionDeletingSwitchM51((sql) => db.rows(sql), dialect)))
         return;
-    const evidence = await readOlderReplicaEvidence(db, dialect, input, "M51");
-    if (evidence !== undefined)
-        throw new SessionDeletingSwitchRefusedError(evidence, await describeUpgradeDriftTail((sql) => db.rows(sql), dialect));
+    await recordServingRequirement(db, dialect, "M51", Date.now());
     receipts.sessionDeletingSwitchMarked += await db.exec(markIfAbsentSql(dialect), [SESSION_DELETING_MARK_ID, Date.now()]);
 }
 export async function scannedIdentityColumnsM42(db, dialect) {
@@ -1181,9 +1294,10 @@ export async function scannedIdentityColumnsM42(db, dialect) {
     }
     return out.sort((a, b) => `${a.table}.${a.column}`.localeCompare(`${b.table}.${b.column}`));
 }
-export async function switchScenarioPrefixM42(db, dialect, receipts, input) {
-    if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
-        await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
+async function refuseScenarioPrefixSwitchM42(evidence, read, dialect) {
+    return new ScenarioPrefixSwitchRefusedError("older_replica", [], evidence, await describeUpgradeDriftTail(read, dialect));
+}
+export async function switchScenarioPrefixM42(db, dialect, receipts) {
     if (!(await owesScenarioPrefixSwitchM42((sql) => db.rows(sql), dialect)))
         return;
     const columns = await scannedIdentityColumnsM42(db, dialect);
@@ -1197,9 +1311,9 @@ export async function switchScenarioPrefixM42(db, dialect, receipts, input) {
     receipts.scenarioPrefixSourcesScanned += columns.length;
     if (hits.length > 0)
         throw new ScenarioPrefixSwitchRefusedError("stored_prefix", hits, undefined, await describeUpgradeDriftTail((sql) => db.rows(sql), dialect));
-    const evidence = await readOlderReplicaEvidence(db, dialect, input, "M42");
-    if (evidence !== undefined)
-        throw new ScenarioPrefixSwitchRefusedError("older_replica", [], evidence, await describeUpgradeDriftTail((sql) => db.rows(sql), dialect));
+    if (!(await tableExists(db, dialect, MIGRATION_MARKER_TABLE)))
+        await execUntil(db, migrationMarkerDdl(dialect), () => tableExists(db, dialect, MIGRATION_MARKER_TABLE));
+    await recordServingRequirement(db, dialect, "M42", Date.now());
     await db.exec(markIfAbsentSql(dialect), [SCENARIO_PREFIX_MARKER_ID, Date.now()]);
 }
 export const EXECUTION_LANE_RENAME_REFUSED_CODE = "config.execution_lane_rename_refused";
@@ -1244,64 +1358,46 @@ async function executionLaneWordRowsM40(read, dialect) {
     }
     return { tables, pendingRows };
 }
-export async function renameRetiredExecutionLaneWordsM40(db, dialect, receipts, input) {
+export async function renameRetiredExecutionLaneWordsM40(db, dialect, receipts) {
     const { tables, pendingRows } = await executionLaneWordRowsM40((sql) => db.rows(sql), dialect);
     if (pendingRows === 0)
         return;
-    await refuseWhileRunsHeartbeat(db, dialect, pendingRows, input);
+    await recordServingRequirement(db, dialect, "M40", Date.now());
     for (const table of tables) {
         receipts.executionLaneWordsRenamed += await db.exec(dialect === "mysql" ? `UPDATE ${table} SET execution_lane = ? WHERE execution_lane = ?` : `UPDATE ${table} SET execution_lane = $1 WHERE execution_lane = $2`, [RENAMED_EXECUTION_LANE_M40, RETIRED_EXECUTION_LANE_WORD_M40]);
     }
 }
-export async function readOlderReplicaEvidence(db, dialect, input, migrationId) {
-    if (!(await tableExists(db, dialect, "task_run")))
-        return undefined;
-    const since = new Date(Date.now() - input.liveRunWindowMs);
-    const groups = (await db.rows(`SELECT instance_id, COUNT(*) AS n, MAX(updated_at) AS newest FROM task_run WHERE status = 'running' AND updated_at >= ${dialect === "mysql" ? "?" : "$1"} GROUP BY instance_id`, [since]))
-        .map((r) => ({ holder: typeof r["instance_id"] === "string" ? r["instance_id"] : undefined, runs: Number(r["n"] ?? 0), newest: r["newest"] }))
-        .filter((g) => g.runs > 0);
-    if (groups.length === 0)
-        return undefined;
-    const registered = await readReplicaRegistrations({ query: async (sql, params) => ({ rows: await db.rows(sql, params), affected: 0 }) }, dialect, groups.flatMap((g) => (g.holder === undefined ? [] : [g.holder])));
-    let unregisteredRuns = 0;
-    let newestMs = Number.NaN;
-    const registeredWithout = [];
-    for (const g of groups) {
-        const r = g.holder === undefined ? undefined : registered.get(g.holder);
-        if (r !== undefined && knowsCapability(r.capabilities, migrationId))
-            continue;
-        if (r === undefined)
-            unregisteredRuns += g.runs;
-        else
-            registeredWithout.push({ instanceId: r.instanceId, releaseLine: r.releaseLine, hostName: r.hostName, pid: r.pid, runs: g.runs });
-        const cell = g.newest instanceof Date ? g.newest : new Date(String(g.newest));
-        if (!Number.isNaN(cell.getTime()) && !(cell.getTime() <= newestMs))
-            newestMs = cell.getTime();
-    }
-    const liveRuns = unregisteredRuns + registeredWithout.reduce((n, h) => n + h.runs, 0);
-    if (liveRuns === 0)
-        return undefined;
-    const now = Date.now();
-    const restartAtMs = (Number.isNaN(newestMs) ? now : newestMs) + input.liveRunWindowMs;
-    return {
-        migration: migrationId,
-        liveRuns,
-        windowSec: Math.round(input.liveRunWindowMs / 1000),
-        restartAfter: new Date(restartAtMs).toISOString(),
-        after: `${new Date(restartAtMs).toISOString()} (${Math.max(0, Math.ceil((restartAtMs - now) / 1000))}s from now)`,
-        unregisteredRuns,
-        registeredWithout: registeredWithout.sort((a, b) => a.instanceId.localeCompare(b.instanceId)),
-    };
-}
-async function refuseWhileRunsHeartbeat(db, dialect, pendingRows, input) {
-    const evidence = await readOlderReplicaEvidence(db, dialect, input, "M40");
-    if (evidence === undefined)
-        return;
-    throw new ExecutionLaneRenameRefusedError(pendingRows, evidence.liveRuns, evidence.restartAfter, `${pendingRows} stored rows (approval asks / sessions) carry the execution lane word "${RETIRED_EXECUTION_LANE_WORD_M40}", the name an earlier version gave the lane with no execution environment, ` +
+async function refuseExecutionLaneRenameM40(evidence, read, dialect) {
+    const { pendingRows } = await executionLaneWordRowsM40(read, dialect);
+    return new ExecutionLaneRenameRefusedError(pendingRows, evidence.liveRuns, evidence.restartAfter, `${pendingRows} stored rows (approval asks / sessions) carry the execution lane word "${RETIRED_EXECUTION_LANE_WORD_M40}", the name an earlier version gave the lane with no execution environment, ` +
         `which this version calls "${RENAMED_EXECUTION_LANE_M40}" and does not read; this boot renames them (one-time migration M40), but ${olderReplicaEvidenceSentence(evidence)} ` +
         `— a replica of an earlier version may still be serving, and it would keep writing the old word after the rename. No stored row was changed. ` +
         stopThenStartAction(evidence.after) +
-        (await describeUpgradeDriftTail((sql) => db.rows(sql), dialect)));
+        (await describeUpgradeDriftTail(read, dialect)));
+}
+export const CHECKPOINT_DISPLAY_COLUMNS_DROP_REFUSED_CODE = "config.checkpoint_display_columns_drop_refused";
+export class CheckpointDisplayColumnsDropRefusedError extends StoreBootRefusalError {
+    code = CHECKPOINT_DISPLAY_COLUMNS_DROP_REFUSED_CODE;
+    reason = "older_replica";
+    constructor(evidence, tail = "") {
+        super(`${CHECKPOINT_DISPLAY_COLUMNS_DROP_REFUSED_CODE} (reason: older_replica): this version reads a suspended approval's tool name, input, risk descriptor, rule offers and ` +
+            `bidi bit from the checkpoint itself and drops the checkpoint columns ${RETIRED_CHECKPOINT_DISPLAY_COLUMNS.join(", ")} on this boot (one-time migration M54), but ${olderReplicaEvidenceSentence(evidence)} — ` +
+            "a replica of an earlier version may still be serving; after the drop every approval it parks and every approval-queue read it serves fails. Nothing was changed. " +
+            stopThenStartAction(evidence.after) +
+            tail);
+        this.name = "CheckpointDisplayColumnsDropRefusedError";
+    }
+}
+async function refuseCheckpointDisplayColumnsDropM54(evidence, read, dialect) {
+    return new CheckpointDisplayColumnsDropRefusedError(evidence, await describeUpgradeDriftTail(read, dialect));
+}
+export async function dropCheckpointDisplayColumnsM54(db, dialect, receipts) {
+    const present = await retiredDisplayColumnsPresent(db, dialect);
+    if (present.length === 0)
+        return;
+    await recordServingRequirement(db, dialect, "M54", Date.now());
+    await execUntil(db, `ALTER TABLE checkpoint ${present.map((c) => `DROP COLUMN ${c}`).join(", ")}`, async () => (await retiredDisplayColumnsPresent(db, dialect)).length === 0);
+    receipts.checkpointDisplayColumnsDropped += present.length;
 }
 export const SESSION_EXT_MOVE_REFUSED_CODE = "config.session_ext_move_refused";
 export class SessionExtMoveRefusedError extends StoreBootRefusalError {
@@ -1327,23 +1423,19 @@ const sameCell = (dialect, column) => {
     return dialect === "mysql" ? `sm.${column.name} <=> ${side}` : `sm.${column.name} IS NOT DISTINCT FROM ${side}`;
 };
 const SESSION_EXT_MOVE_PAGE = 500;
-export async function refuseSessionExtMoveWhileRunsHeartbeat(db, dialect, input) {
-    const columns = await deploymentColumnsOnMeta(db, dialect);
-    if (columns.length === 0)
-        return;
-    const evidence = await readOlderReplicaEvidence(db, dialect, input, "M41");
-    if (evidence === undefined)
-        return;
-    throw new SessionExtMoveRefusedError("older_replica", `${columns.length} session cells (${columns.map((c) => c.name).join(", ")}) still live on session_meta; this version keeps them on the side table ${SESSION_EXT_TABLE} and moves them on this boot ` +
+async function refuseSessionExtMoveM41(evidence, read, dialect) {
+    const columns = await deploymentColumnsOnMeta({ rows: read }, dialect);
+    return new SessionExtMoveRefusedError("older_replica", `${columns.length} session cells (${columns.map((c) => c.name).join(", ")}) still live on session_meta; this version keeps them on the side table ${SESSION_EXT_TABLE} and moves them on this boot ` +
         `(one-time migration M41: copy, verify, then drop the columns), but ${olderReplicaEvidenceSentence(evidence)} — ` +
         "a replica of an earlier version may still be serving; a cell it writes between the copy and the drop would be lost, and every cell write it makes after the drop fails. Nothing was changed. " +
         stopThenStartAction(evidence.after) +
-        (await describeUpgradeDriftTail((sql) => db.rows(sql), dialect)));
+        (await describeUpgradeDriftTail(read, dialect)));
 }
 export async function moveSessionCellsToSideTable(db, dialect, receipts) {
     const columns = await deploymentColumnsOnMeta(db, dialect);
     if (columns.length === 0)
         return;
+    await recordServingRequirement(db, dialect, "M41", Date.now());
     const names = columns.map((c) => c.name);
     const p = dialect === "mysql" ? () => "?" : (n) => `$${n}`;
     const upsert = `INSERT INTO ${SESSION_EXT_TABLE} (session_id, ${names.join(", ")}) SELECT session_id, ${names.join(", ")} FROM session_meta ` +
@@ -2017,13 +2109,13 @@ export async function repairParkedRows(db, dialect, receipts) {
     const kinds = APPROVAL_GATE_KINDS;
     const kindSlots = kinds.map((_, i) => ph(i + 1)).join(", ");
     const scan = `SELECT token, session_id, gate_kind, ${jsonColumnText(dialect, "checkpoint", M21_GATE)}, ${jsonColumnText(dialect, "checkpoint", M21_PENDING_ACTION)} FROM checkpoint ` +
-        `WHERE status = 'pending' AND (gate_kind IS NULL OR (gate_kind IN (${kindSlots}) AND tool_name = ${ph(kinds.length + 1)})) AND token > ${ph(kinds.length + 2)} ` +
+        `WHERE status = 'pending' AND (gate_kind IS NULL OR gate_kind IN (${kindSlots})) AND token > ${ph(kinds.length + 1)} ` +
         `ORDER BY token LIMIT ${PARKED_ROW_REPAIR_PAGE}`;
     const docText = jsonColumnTextExpr(dialect, "checkpoint");
     const encode = dialectProtocolJsonEncoder(dialect);
     let after = "";
     for (;;) {
-        const page = await db.rows(scan, [...kinds, ASK_USER_QUESTION_TOOL_NAME, after]);
+        const page = await db.rows(scan, [...kinds, after]);
         for (const r of page) {
             const token = String(r.token);
             after = token;
@@ -2214,6 +2306,8 @@ function readingFields(r) {
         scenarioPrefixSourcesScanned: r.scenarioPrefixSourcesScanned,
         withdrawMarkWritten: r.withdrawMarkWritten,
         sessionDeletingSwitchMarked: r.sessionDeletingSwitchMarked,
+        storeFaultSentencesRewritten: r.storeFaultSentencesRewritten,
+        checkpointDisplayColumnsDropped: r.checkpointDisplayColumnsDropped,
         runErrorCodeColumnRewritten: r.runErrorCodeColumnRewritten,
         runObjectivePreviewRewritten: r.runObjectivePreviewRewritten,
         shellSentinelOwnersCleared: r.shellSentinelOwnersCleared,