@sema-agent/server 2.0.0 → 2.0.1

package/dist/config.js

@@ -189,9 +189,10 @@ function boolEnv(name, def) {
             source = "env";
         }
         else if (!CONFIG_KNOBS.has(name)) {
-            // Previously a silent default at every hand-written site. Guarded on first registration because a few
-            // knobs are legitimately read twice in one load (IMAGE_BAKES_ENABLED by its two boot invariants and then
-            // by the returned field; DURABLE_APPROVAL by the D-G gate and then the field) — one typo, one warning.
+            // Previously a silent default at every hand-written site. Guarded on first registration: the LAZILY
+            // re-read knobs (boolEnvWithLegacyNegated's host twins, read per exec) must not grow this array for the
+            // process lifetime on one typo — one typo, one warning. (复审 2026-07-30 F6:早期理由「IMAGE_BAKES_
+            // ENABLED/DURABLE_APPROVAL 一次 load 读两次」已随九域拆分的去重失效,懒读族成为本守卫的现行理由。)
             CONFIG_WARNINGS.push({ env: name, raw });
         }
     }
@@ -338,35 +339,9 @@ export function applyAutoCompactWindow(m, explicit) {
     else
         delete target.autoCompactTokens;
 }
-export function loadConfig() {
-    CONFIG_WARNINGS.length = 0; // repeated loadConfig() calls (test setup) must not accumulate stale warnings
-    CONFIG_NOTICES.length = 0;
-    CONFIG_KNOBS.clear(); // the polarity table describes THIS load, never a previous one's env
-    KNOB_DEPRECATIONS_SEEN.clear();
-    // npm 卫生纪律:默认值不烤内网坐标 — localhost 占位(公开分发正确缺省);真网关一律显式 env。
-    const gatewayBaseUrl = env("MODEL_GATEWAY_BASEURL", "http://127.0.0.1:8000/v1");
-    const modelId = env("MODEL_ID", "Qwen3.5-35B");
-    // Posture gate: single-user turnkey (`REQUIRE_PRINCIPAL !== "true"` = one trusted super-admin on their own
-    // box/tenant, CC's trust model) ⇒ the CC capability set defaults ON, each composed with its infra prereq; multi-tenant
-    // (requirePrincipal) stays opt-in (gated + secured). This is the SAME discriminator LSP's host-default-ON uses,
-    // generalized into one posture switch (the PM's "not per-flag" ask). In `postureOn`, an explicit `X_ENABLED=true/false`
-    // ALWAYS wins; else the default = single-user ∧ infra-ready. 🔒 Multi-tenant (prod) is UNAFFECTED (postureOn → false).
-    // Parsed ONCE here (design/158 B4) instead of re-comparing `process.env.REQUIRE_PRINCIPAL` at the four sites
-    // that needed it — two of which spelled it `!== "true"` and two `=== "true"`, i.e. the same knob read in both
-    // polarities within one function. `boolEnv(x, false)` is value-identical to the old `=== "true"`.
-    const requirePrincipal = boolEnv("REQUIRE_PRINCIPAL", false);
-    const singleUserTurnkey = !requirePrincipal;
-    // `postureOn` takes the NAME (not the pre-read value) so the knob can register itself in the polarity table —
-    // the posture family is precisely the one whose default is NOT readable from its name, so leaving it out of the
-    // self-report would omit the worst offenders. Its tri-state semantics are unchanged: an explicit literal wins,
-    // anything else (including a typo — deliberately NOT warned here, unlike boolEnv) falls to the posture default.
-    const postureOn = (name, infraReady = true) => {
-        const envVal = process.env[name];
-        const explicit = envVal === "true" ? true : envVal === "false" ? false : undefined;
-        const value = explicit ?? (singleUserTurnkey && infraReady);
-        registerKnob({ name, polarity: "posture", value, source: explicit === undefined ? "posture" : "env" });
-        return value;
-    };
+/** 域:store(持久化)—— DB 引擎三态、session 后端、SQL coords、快照 BLOB / SendUserFile 对象存储。 */
+function parseStoreDomain(ctx) {
+    const { requirePrincipal } = ctx; // 跨域入参①:多租户裸 boot 的 memory 缺省由它决定(见下方注释)
     // `local` (clay 2026-06-25 seamless local↔cloud) = the DB-less in-memory/file StoreBackend, so a locally-run HTTP
     // service serves the same contract a cloud worker does. It has no SQL host/coords (createStoreBackend builds it
     // without tidb/pg), so it's always "reachable". (Parsed FIRST so the session/memory posture defaults below can
@@ -408,62 +383,6 @@ export function loadConfig() {
     const sqlEngineExplicit = !!process.env.DB_BACKEND && dbBackend !== "local" && dbBackend !== "memory";
     const sessionBackendRaw = enumEnv("SESSION_BACKEND", sqlEngineExplicit ? "mysql" : "memory", ["memory", "mysql", "tidb", "auto"]);
     const sessionBackend = sessionBackendRaw === "mysql" ? "tidb" : sessionBackendRaw;
-    // design/138 S1 (clay 2026-07-08): long-term memory = the injection-first file-based memory ENGINE
-    // (core RunnerDeps.memoryBackend), default ON with MEMORY_ENGINE=off as the explicit kill-switch.
-    // The legacy MEMORY_BACKEND/EMBEDDING_* store plane was dropped without migration (those env vars are
-    // no longer read). Single-user gating lives in main.ts (the engine is never wired multi-tenant).
-    const memoryEngineEnabled = process.env.MEMORY_ENGINE !== "off";
-    // S3-TOB(边界重切后的 backend 选择,设计 §1.3):记忆持久面方言。缺省 file=现状零变化;
-    // pg/tidb=DB 真身(零卷主档)——多租户点亮的唯一门(显式 opt-in,复审 F5:绝不静默翻转)。
-    const memoryEngineBackendRaw = process.env.MEMORY_ENGINE_BACKEND ?? "file";
-    if (!["file", "pg", "tidb"].includes(memoryEngineBackendRaw)) {
-        throw new Error(`MEMORY_ENGINE_BACKEND must be file|pg|tidb, got "${memoryEngineBackendRaw}"`);
-    }
-    const memoryEngineBackend = memoryEngineBackendRaw;
-    // workflowSizeGuideline: CC normalizes unknown→unrestricted (lenient), but an env knob typo
-    // silently degrading to "no guidance" is the half-config trap — fail-loud here (memoryEngineBackend
-    // posture; the ADVISORY nature is core's concern, the env spelling is ours).
-    const workflowSizeGuidelineRaw = process.env.WORKFLOW_SIZE_GUIDELINE;
-    if (workflowSizeGuidelineRaw !== undefined && !["small", "medium", "large", "unrestricted"].includes(workflowSizeGuidelineRaw)) {
-        throw new Error(`WORKFLOW_SIZE_GUIDELINE must be small|medium|large|unrestricted, got "${workflowSizeGuidelineRaw}"`);
-    }
-    const workflowSizeGuideline = workflowSizeGuidelineRaw;
-    // Single-user memory scope (hoisted from the config literal so the sync-scope default below can consume it):
-    // explicit MEMORY_SCOPE always wins; default "local" only when the engine is on AND single-user (see the
-    // literal-site comment on why multi-tenant/engine-off must stay undefined = memory dark).
-    const memoryScope = process.env.MEMORY_SCOPE ?? (memoryEngineEnabled && !requirePrincipal ? "local" : undefined);
-    // 142-S2.5-W1: TOC 同步 client 腿的三键(file memory 形态专用)。MEMORY_SYNC_URL 设了=开;
-    // 缺省 undefined=纯本地现状零变化。半配置 fail-loud(memoryEngineBackend 同款姿势,绝不静默降级):
-    //  - URL 有 TOKEN 无 ⇒ throw(中心同步面要 Bearer,缺 token 的“开了但永远 401”是半配置陷阱);
-    //  - TOKEN/SCOPE 有 URL 无 ⇒ throw(operator 显然想开同步,静默不跑=同款陷阱,对称拒启);
-    //  - DB backend(pg/tidb)配了任意同步键 ⇒ throw(中心侧自己就是 POST /v1/memory/sync/:scope 的权威,
-    //    不该再跑 client 腿——两个半场叠在一个进程是拓扑错误)。
-    // scope 缺省 = formatUserScope(memoryScope)(中心侧 owner 门的 user 盘键铸法);memoryScope 本身已是
-    // v2 typed key(user:/org:/proj:/userproj:,只可能来自 operator 显式 MEMORY_SCOPE)则原样直通——
-    // 再包一层会铸出 `user:user%3A...` 双包键(诚实偏离,报告记档)。
-    const memorySyncUrl = process.env.MEMORY_SYNC_URL || undefined;
-    const memorySyncToken = process.env.MEMORY_SYNC_TOKEN || undefined;
-    const memorySyncScopeRaw = process.env.MEMORY_SYNC_SCOPE || undefined;
-    let memorySync;
-    if (memorySyncUrl === undefined) {
-        if (memorySyncToken !== undefined || memorySyncScopeRaw !== undefined) {
-            throw new Error("MEMORY_SYNC_TOKEN/MEMORY_SYNC_SCOPE are set but MEMORY_SYNC_URL is not — refusing to start half-configured (set MEMORY_SYNC_URL to enable memory sync, or unset the other MEMORY_SYNC_* keys)");
-        }
-    }
-    else {
-        if (memoryEngineBackend !== "file") {
-            throw new Error(`MEMORY_SYNC_URL is a FILE-memory (TOC client) knob, but MEMORY_ENGINE_BACKEND=${memoryEngineBackend} — the DB memory plane IS the central sync authority (it serves POST /v1/memory/sync/:scope) and must not also run the client leg; unset MEMORY_SYNC_* here`);
-        }
-        if (memorySyncToken === undefined) {
-            throw new Error("MEMORY_SYNC_URL is set but MEMORY_SYNC_TOKEN is not — refusing to start half-configured (the central sync face requires a bearer token)");
-        }
-        const isV2ScopeKey = (k) => k.startsWith("user:") || k.startsWith("org:") || k.startsWith("proj:") || k.startsWith("userproj:");
-        const scope = memorySyncScopeRaw ?? (memoryScope !== undefined ? (isV2ScopeKey(memoryScope) ? memoryScope : formatUserScope(memoryScope)) : undefined);
-        if (scope === undefined) {
-            throw new Error("MEMORY_SYNC_URL is set but no sync scope is derivable (memory engine off or multi-tenant without an explicit scope) — set MEMORY_SYNC_SCOPE, or run the single-user file memory engine so MEMORY_SCOPE (default \"local\") provides one");
-        }
-        memorySync = { url: memorySyncUrl, token: memorySyncToken, scope, ...((v) => (v !== undefined && Number.isInteger(v) && v >= 1 ? { maxPushEntries: v } : {}))(process.env.MEMORY_SYNC_MAX_PUSH_ENTRIES !== undefined ? Number(process.env.MEMORY_SYNC_MAX_PUSH_ENTRIES) : undefined), ...((v) => (v !== undefined && Number.isInteger(v) && v >= 1 ? { maxPullEntries: v } : {}))(process.env.MEMORY_SYNC_MAX_PULL_ENTRIES !== undefined ? Number(process.env.MEMORY_SYNC_MAX_PULL_ENTRIES) : undefined) };
-    }
     // P0.5 variant-2: the file-backed `local` backend's data root. SAME resolution main.ts:102 (localRoot =
     // CONFIG_LOCAL_DIR ?? AGENT_DATA_DIR ?? ~/.ai-agent) + run-local.ts:198, so the HTTP service + a run-local on one
     // box open ONE boot-locked data dir. `LOCAL_DATA_ROOT` is an additional highest-priority override (the explicit
@@ -476,6 +395,86 @@ export function loadConfig() {
     const dbHostSet = dbBackend === "pg" ? !!process.env.PG_HOST : !!(process.env.MYSQL_HOST || process.env.TIDB_HOST);
     const needsTidb = sessionBackend === "tidb" || (sessionBackend === "auto" && dbHostSet);
     const needsDb = needsTidb;
+    return {
+        sessionBackend,
+        sessionCacheTtlSec: Number(env("SESSION_CACHE_TTL_SEC", "300")),
+        rewindSnapshotMaxMb: optFinitePositiveEnv("REWIND_SNAPSHOT_MAX_MB"), // soft knob (S20: bad value warns + default)
+        dbBackend,
+        dbBackendExplicit: dbBackendSet,
+        localDataRoot,
+        tidb: needsDb && dbBackend === "mysql"
+            ? {
+                host: env2("MYSQL_HOST", "TIDB_HOST"),
+                // default port follows the env family in use: MYSQL_HOST → 3306 (stock MySQL), TIDB_HOST → 4000 (TiDB)
+                port: Number(env2("MYSQL_PORT", "TIDB_PORT", process.env.MYSQL_HOST ? "3306" : "4000")),
+                user: env2("MYSQL_USER", "TIDB_USER"),
+                password: env2("MYSQL_PASSWORD", "TIDB_PASSWORD", ""),
+                database: env2("MYSQL_DATABASE", "TIDB_DATABASE"),
+                connectionLimit: process.env.MYSQL_POOL_SIZE || process.env.TIDB_POOL_SIZE
+                    ? Number(process.env.MYSQL_POOL_SIZE || process.env.TIDB_POOL_SIZE)
+                    : undefined,
+            }
+            : undefined,
+        pg: needsDb && dbBackend === "pg"
+            ? {
+                host: env("PG_HOST"),
+                port: Number(env("PG_PORT", "5432")),
+                user: env("PG_USER"),
+                password: env("PG_PASSWORD", ""),
+                database: env("PG_DATABASE"),
+                connectionLimit: process.env.PG_POOL_SIZE ? Number(process.env.PG_POOL_SIZE) : undefined,
+            }
+            : undefined,
+        // S9 deeper fix: per-query DB timeout (see the interface doc). Soft knob — a typo degrades to the default
+        // posture (pool-wide off / counter-family 30s) with an S20 boot warning, never NaN into a driver timer.
+        dbQueryTimeoutMs: optFinitePositiveEnv("DB_QUERY_TIMEOUT_MS"),
+        // E19/2c snapshot-BLOB object-store offload (clay 2026-06-26). Reuses the SAME adapter-held MinIO creds as the k8s
+        // workspace-snapshot lane (secret minio-agent-worker); all three keys required to enable, else the file-snapshot
+        // stores keep the SQL `snapshot_blob` default (byte-identical to today). Bucket = SESSION_SNAPSHOT_BUCKET (default
+        // "session-snapshots"); keyPrefix optional (default "blobs/" in MinioBlobBackend).
+        snapshotBlobStore: process.env.MINIO_ENDPOINT && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
+            ? {
+                endpoint: process.env.MINIO_ENDPOINT,
+                bucket: process.env.SESSION_SNAPSHOT_BUCKET ?? "session-snapshots",
+                accessKey: process.env.MINIO_ACCESS_KEY,
+                secretKey: process.env.MINIO_SECRET_KEY,
+                ...(process.env.MINIO_REGION ? { region: process.env.MINIO_REGION } : {}),
+                ...(process.env.SESSION_SNAPSHOT_PREFIX ? { keyPrefix: process.env.SESSION_SNAPSHOT_PREFIX } : {}),
+                // Fail-SAFE parse (finding 20): a non-numeric/non-positive value → omit (the MinioBlobBackend default 3600s
+                // applies), never NaN (which would sign every URL with X-Amz-Expires=NaN → total snapshot outage).
+                ...((ttl) => (ttl !== undefined ? { presignTtlSec: ttl } : {}))(optFinitePositiveEnv("SESSION_SNAPSHOT_TTL_SEC")),
+            }
+            : undefined,
+        // (a+c)(clay 2026-07-27)snapshot_blob 包墙修复两旋钮——语义见 ServiceConfig 字段注释。
+        snapshotBlobSqlMaxBytes: optFinitePositiveEnv("SNAPSHOT_BLOB_SQL_MAX_BYTES"),
+        snapshotBlobAllowSql: boolEnv("SNAPSHOT_BLOB_ALLOW_SQL_BYTES", false),
+        // SendUserFile 双轨公网直链(同三键开闸;S3_ENDPOINT 兼容位=外接 S3 场景内网/公网同址)。
+        // `||` 非 `??`(配置面自查 2026-07-14):env 惯例(env() helper 同款)空串=未设——`?? ` 会让
+        // 一个显式置空的 MINIO_ENDPOINT/S3_PUBLIC_ENDPOINT 把后备名吞掉(compose `${X:-}` 透传空串是常态)。
+        sendUserFile: (process.env.MINIO_ENDPOINT || process.env.S3_ENDPOINT) && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
+            ? {
+                endpoint: (process.env.MINIO_ENDPOINT || process.env.S3_ENDPOINT),
+                ...(process.env.S3_PUBLIC_ENDPOINT || process.env.S3_ENDPOINT
+                    ? { publicEndpoint: (process.env.S3_PUBLIC_ENDPOINT || process.env.S3_ENDPOINT) }
+                    : {}),
+                publicBucket: process.env.S3_PUBLIC_BUCKET ?? "sema-public",
+                privateBucket: process.env.SESSION_SNAPSHOT_BUCKET ?? "session-snapshots",
+                privateKeyPrefix: "sendfile/",
+                ...(process.env.SEND_USER_FILE_SANDBOX_PUT_ENDPOINT ? { sandboxPutEndpoint: process.env.SEND_USER_FILE_SANDBOX_PUT_ENDPOINT } : {}),
+                accessKey: process.env.MINIO_ACCESS_KEY,
+                secretKey: process.env.MINIO_SECRET_KEY,
+                ...(process.env.MINIO_REGION ? { region: process.env.MINIO_REGION } : {}),
+                // fail-SAFE:非法值回落 0(永久轨缺省),不 NaN 进签名。
+                defaultTtlSec: ((v) => (v !== undefined && Number.isInteger(v) && v >= 0 ? v : 0))(process.env.SEND_USER_FILE_URL_TTL !== undefined ? Number(process.env.SEND_USER_FILE_URL_TTL) : undefined),
+            }
+            : undefined,
+    };
+}
+/** 域:model(模型面)—— 网关坐标、Anthropic 路线、韧性旋钮、主/廉价 model entry、role 表、降级梯。 */
+function parseModelDomain() {
+    // npm 卫生纪律:默认值不烤内网坐标 — localhost 占位(公开分发正确缺省);真网关一律显式 env。
+    const gatewayBaseUrl = env("MODEL_GATEWAY_BASEURL", "http://127.0.0.1:8000/v1");
+    const modelId = env("MODEL_ID", "Qwen3.5-35B");
     // Model.api must reflect the brain that actually serves it (routing is by provider): an "anthropic"
     // provider runs the Anthropic brain, whose usage reports `input` EXCLUDING cached tokens. core ≥1.22
     // normalizes the cache-hit-rate denominator per api family — a wrong api makes promptTokens too small
@@ -664,97 +663,7 @@ export function loadConfig() {
                 ? { model: cur, systemPrompt: CODE_AGENT_PROMPT }
                 : { ...cur, systemPrompt: CODE_AGENT_PROMPT };
     }
-    // design/80 D-G: the direct-connect approval door anchors (all must be present to ACTIVATE; fail-closed).
-    const directApprovalDoor = boolEnv("DIRECT_APPROVAL_DOOR", false);
-    const principalJwtPubkeys = parsePrincipalJwks(process.env.PRINCIPAL_JWT_PUBKEYS);
-    const principalJwtIss = process.env.PRINCIPAL_JWT_ISS || undefined;
-    const principalJwtAud = process.env.PRINCIPAL_JWT_AUD || undefined;
-    const principalJwtMaxTtlSec = Math.max(0, numEnv("PRINCIPAL_JWT_MAX_TTL_SEC", "120")); // 0 = no cap; default ≤120s
-    const dgHmacKeys = parseApprovalHmacKeys(process.env.APPROVAL_HMAC_KEYS);
-    const dgOperators = csv("OPERATOR_PRINCIPALS");
-    // 🔴 the direct-door crypto gate lives ONLY in the durable (checkpointStore) /decide branch — so DURABLE_APPROVAL
-    // is a HARD precondition. Without it, checkpointStore is undefined, that branch is skipped, and the LEGACY
-    // approvalStore /decide (trusted-header, NO crypto) becomes the live path = a full bypass (adversarial CRITICAL).
-    const dgDurable = boolEnv("DURABLE_APPROVAL", false);
-    const directDoorActive = directApprovalDoor && dgDurable && dgHmacKeys.length > 0 && principalJwtPubkeys.length > 0 && !!principalJwtIss && !!principalJwtAud;
-    // 🔴 boot invariant (D-G §3): a half-configured direct door is the WORST state (looks on, verifies nothing) — and
-    // an empty OPERATOR_PRINCIPALS makes isOperator() true-for-all (= cross-tenant escalation). Refuse to start.
-    if (directApprovalDoor) {
-        const missing = [];
-        if (!dgDurable)
-            missing.push("DURABLE_APPROVAL=true (the direct door's crypto gate only exists on the durable /decide path)");
-        if (dgHmacKeys.length === 0)
-            missing.push("APPROVAL_HMAC_KEYS");
-        if (principalJwtPubkeys.length === 0)
-            missing.push("PRINCIPAL_JWT_PUBKEYS");
-        if (!principalJwtIss)
-            missing.push("PRINCIPAL_JWT_ISS");
-        if (!principalJwtAud)
-            missing.push("PRINCIPAL_JWT_AUD");
-        if (dgOperators.length === 0)
-            missing.push("OPERATOR_PRINCIPALS (else isOperator is true-for-all)");
-        // 🔴 F-fix (dim-6): a direct door is inherently MULTI-TENANT (per-task verified JWT principal). Without
-        // REQUIRE_PRINCIPAL=true an absent/invalid principal falls through as ANONYMOUS and the owner/quota checks
-        // degrade to the spoofable header for null-owner rows — refuse a direct door that doesn't require a principal.
-        if (!requirePrincipal)
-            missing.push("REQUIRE_PRINCIPAL=true (a direct door is multi-tenant; without it an absent principal is anonymous and the spoofable header governs owner/quota checks)");
-        if (missing.length) {
-            throw new Error(`DIRECT_APPROVAL_DOOR=true but D-G anchors are missing: ${missing.join(", ")} — refusing to start a half-open direct door (design/80 D-G boot invariant)`);
-        }
-    }
-    // Per-system service credentials (token → system name). Parsed HERE (not just in the return object) so the
-    // bake boot invariant below can assert the runner-credential→runnerPrincipal mapping exists.
-    const authTokens = Object.fromEntries((process.env.SERVICE_AUTH_TOKENS ?? "")
-        .split(",")
-        .map((s) => s.trim())
-        .filter((s) => s.includes("="))
-        .map((s) => [s.slice(0, s.indexOf("=")).trim(), s.slice(s.indexOf("=") + 1).trim()])
-        .filter(([tok, sys]) => tok.length > 0 && sys.length > 0));
-    const bakeRunnerPrincipal = env("BAKE_RUNNER_PRINCIPAL", "system:bake-runner");
-    // 🔴 boot invariant (IMAGE-API-DESIGN.md §P2.4a): the bake door is build-host-RCE-capable, and isOperator([],p)
-    // is true-for-all — so enabling bakes with an empty OPERATOR_PRINCIPALS = a WORLD-WRITABLE RCE door. Refuse to
-    // start (never a half-open bake door). The explicit-operator gate in server.ts is the runtime twin of this.
-    if (boolEnv("IMAGE_BAKES_ENABLED", false) && dgOperators.length === 0) {
-        throw new Error("IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host; an empty operator set makes isOperator() true-for-all (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)");
-    }
-    // 🔴 boot invariant (IMAGE-API-DESIGN.md §P2.12 / H1): the bake-runner identity is DERIVED from its bearer
-    // credential (token-derived `source`), never a self-asserted header — so a SERVICE_AUTH_TOKENS entry whose
-    // system == BAKE_RUNNER_PRINCIPAL MUST exist, else the runner can never satisfy isRunner and the entire
-    // claim/ingest/heartbeat pipeline is silently dead. Refuse to start a bake door with no runner credential.
-    if (boolEnv("IMAGE_BAKES_ENABLED", false) && !Object.values(authTokens).includes(bakeRunnerPrincipal)) {
-        throw new Error(`IMAGE_BAKES_ENABLED=true but no SERVICE_AUTH_TOKENS entry maps to the runner principal '${bakeRunnerPrincipal}' — the bake-runner authenticates by its credential (token-derived source), so a '<BAKE_RUNNER_TOKEN>=${bakeRunnerPrincipal}' SERVICE_AUTH_TOKENS entry is required or claim/ingest/heartbeat all 403 (IMAGE-API-DESIGN.md §P2.12 boot invariant)`);
-    }
-    // ── design/158 B4 ② — the four knobs whose canonical name went from negative to positive. Only the first
-    // lands on `ServiceConfig`; the other three are read lazily at their use sites (main.ts's LKG gate,
-    // remote-env-host's capability probe and exec path) but are resolved HERE too so that their polarity row and
-    // any legacy-alias deprecation notice are emitted once, at boot, with every other config diagnostic — an
-    // operator must not have to trigger a background shell before being told the name they set is retired.
-    const projectMemoryEnabled = boolEnvWithLegacyNegated("PROJECT_MEMORY_ENABLED", "PROJECT_MEMORY_DISABLED", true);
-    configLkgEnabled();
-    hostBackgroundShellEnabled();
-    hostExecSpoolEnabled();
-    // ── design/158 B4 ③ — LSP: one knob per lane. `LSP_ENABLED` used to drive BOTH the sandbox lane (opt-in,
-    // default OFF — it needs a baked `sema-code-lsp` template) and the host lane (opt-out, default ON — it needs
-    // nothing and degrades to grep/read), i.e. one env name with two OPPOSITE defaults and no way to silence the
-    // host lane without also naming the sandbox knob. `LSP_HOST_ENABLED` now owns the host lane; an explicit
-    // `LSP_ENABLED=false` keeps working as a host opt-out (it was the only one operators ever had) with a notice
-    // naming the replacement, and `LSP_HOST_ENABLED` always wins when set.
-    const lspHostEnabled = (() => {
-        const explicitHost = process.env.LSP_HOST_ENABLED;
-        if (explicitHost === undefined || explicitHost === "") {
-            if (process.env.LSP_ENABLED === "false") {
-                CONFIG_NOTICES.push({
-                    event: "config_env_deprecated_lane_alias",
-                    fields: { deprecated: "LSP_ENABLED=false", replacement: "LSP_HOST_ENABLED=false", lane: "host", effective: "false" },
-                });
-                registerKnob({ name: "LSP_HOST_ENABLED", polarity: "opt-out", value: false, source: "legacy-env", legacyName: "LSP_ENABLED" });
-                return false;
-            }
-        }
-        return boolEnv("LSP_HOST_ENABLED", true);
-    })();
     return {
-        port: Number(env("PORT", "8090")),
         gatewayBaseUrl,
         gatewayApiKey: process.env.MODEL_API_KEY,
         gatewayFallbackUrls: csv("MODEL_GATEWAY_FALLBACK_URLS"),
@@ -798,22 +707,228 @@ export function loadConfig() {
         tiers: {}, // 档位表:env lane 恒空(INERT);applyEffective 从 models.tierGroups 解析填充(保引用)
         projects: {}, // 142-S4 项目登记簿:env lane 恒空(INERT);applyEffective 从 projects 域填充(保引用)
         roles,
-        sessionBackend,
-        sessionCacheTtlSec: Number(env("SESSION_CACHE_TTL_SEC", "300")),
-        rewindSnapshotMaxMb: optFinitePositiveEnv("REWIND_SNAPSHOT_MAX_MB"), // soft knob (S20: bad value warns + default)
-        memoryEngineEnabled,
-        memoryEngineDir: process.env.MEMORY_ENGINE_DIR || undefined,
-        memoryEngineRemoteLaneAllowed: process.env.MEMORY_ENGINE_REMOTE_LANE === "allow", // N0: fail-closed default
-        // A single-user deployment has no principal, so `memoryScopeFor` falls back to `config.memoryScope` — and if
-        // THAT were unset the resolved scope would be undefined ⇒ resolveSpec builds NO `spec.memory` ⇒ the memory
-        // engine never materializes (the "wired-not-triggered" gap a §4 real test hit on the legacy plane).
+        cascadeLadder: csv("MODEL_CASCADE_LADDER"),
+        degrade: process.env.MODEL_DEGRADE_TO
+            ? {
+                to: env("MODEL_DEGRADE_TO"),
+                atCostFraction: Number(env("MODEL_DEGRADE_AT_COST_FRACTION", "0.7")),
+                reactive: boolEnv("MODEL_DEGRADE_REACTIVE", false),
+                downgradeOn: csv("MODEL_DEGRADE_ON").length
+                    ? csv("MODEL_DEGRADE_ON")
+                    : undefined,
+                // vision precheck (adversarial-review finding): the degrade TARGET is an external gateway
+                // model NOT in config.models, so resolveSpec's precheck (which only sees the picked model) can't see its
+                // vision capability — a vision-capable main + text-only degrade target would let images reach the text-only
+                // gateway as the opaque 400 the precheck prevents, AFTER admission, at runtime degrade. Declare it via
+                // MODEL_DEGRADE_TO_VISION (strict "true"). DEFAULT false = assume the cheaper degrade target is text-only
+                // (the common case, e.g. deepseek), so resolveSpec drops degrade for image-carrying tasks (main.ts).
+                toSupportsImages: boolEnv("MODEL_DEGRADE_TO_VISION", false),
+            }
+            : undefined,
+    };
+}
+/** 域:approval(审批/HITL 门)—— 审批名单与预算、durable 面、直连门开关与钥、敏感写门、elicitation。
+ *  注:直连门的**激活**(directDoorActive)与 D-G §3 半开门不变量是跨域合取,留在装配层。 */
+function parseApprovalDomain(ctx) {
+    const { postureOn } = ctx; // 跨域入参②:posture 三态(single-user turnkey ⇒ HITL 面默认 ON)
+    // design/80 D-G: the direct-connect approval door anchors (all must be present to ACTIVATE; fail-closed).
+    const directApprovalDoor = boolEnv("DIRECT_APPROVAL_DOOR", false);
+    const dgHmacKeys = parseApprovalHmacKeys(process.env.APPROVAL_HMAC_KEYS);
+    // DURABLE_APPROVAL 既是本域字段,也是直连门的硬前置 —— 那条前置的理由与断言在装配层的跨域不变量段。
+    const durableApproval = boolEnv("DURABLE_APPROVAL", false);
+    return {
+        approvalRequire: csv("APPROVAL_REQUIRE"),
+        approvalDeny: csv("APPROVAL_DENY"),
+        approvalPollMs: Number(env("APPROVAL_POLL_MS", "1500")),
+        durableApproval,
+        resourceSuspend: boolEnv("RESOURCE_SUSPEND", false),
+        resourceSuspendTtlSec: Math.max(0, numEnv("RESOURCE_SUSPEND_TTL_SEC", "0")), // 0 ⇒ core default (30d)
+        approvalAutoBudget: Math.min(10000, Math.max(0, numEnv("APPROVAL_AUTO_BUDGET", "0"))), // clamp [0,10000]; 0 = off
+        approvalNeverAuto: csv("APPROVAL_NEVER_AUTO"),
+        approvalHmacKeys: dgHmacKeys, // D-G: WIRED (see the field's JSDoc); empty ⇒ inactive, not unimplemented
+        directApprovalDoor,
+        // ③ sensitive-path write deny set: unset = core's recommended set; explicit value = full replacement
+        // (comma-separated); "off"/empty = disabled. Set curation is core's (成文 core-side); server passes through.
+        sensitiveWritePatterns: ((raw) => {
+            if (raw === undefined)
+                return [...RECOMMENDED_SENSITIVE_PATTERNS];
+            const trimmed = raw.trim();
+            if (trimmed === "" || trimmed.toLowerCase() === "off")
+                return [];
+            return trimmed.split(",").map((p) => p.trim()).filter((p) => p.length > 0);
+        })(process.env.SENSITIVE_WRITE_PATTERNS),
+        // [1557]§四: opt-in only — any value other than the two real gate shapes (incl. "off"/unset) stays undefined
+        // (no field on the config object at all), so the fs-write gate wiring never even considers it.
+        ...(process.env.MANUAL_MODE_SHELL_GATE === "always" || process.env.MANUAL_MODE_SHELL_GATE === "classify"
+            ? { manualModeShellGate: process.env.MANUAL_MODE_SHELL_GATE }
+            : {}),
+        mcpElicitation: {
+            enabled: boolEnv("MCP_ELICITATION_ENABLED", false), // E23 inbound elicitation; default OFF (fail-closed)
+            throttle: {
+                maxConcurrentPerRun: numEnvBounded("MCP_ELICITATION_MAX_CONCURRENT", String(DEFAULT_ELICITATION_THROTTLE.maxConcurrentPerRun), 1, 64),
+                maxTotalPerRun: numEnvBounded("MCP_ELICITATION_MAX_TOTAL", String(DEFAULT_ELICITATION_THROTTLE.maxTotalPerRun), 1, 10_000),
+                minIntervalMsPerServer: numEnvBounded("MCP_ELICITATION_MIN_INTERVAL_MS", String(DEFAULT_ELICITATION_THROTTLE.minIntervalMsPerServer), 0, 600_000),
+                ttlMs: numEnvBounded("MCP_ELICITATION_TTL_MS", String(DEFAULT_ELICITATION_THROTTLE.ttlMs), 1_000, 3_600_000),
+            },
+        },
+        askQuestionEnabled: postureOn("ASK_QUESTION_ENABLED"), // §4④ AskUserQuestion live HITL; posture-gated (single-user → ON)
+        toolApprovalEnabled: postureOn("TOOL_APPROVAL_ENABLED"), // [816]/[820]② live tool-approval HITL; posture-gated (single-user → ON), mirrors askQuestion
+        // [875]a 成文:0(缺省)= durable HITL 无限期等人,时间型 reapSuspended 不跑;file/memory lane 的回收
+        // 探针只在 DURABLE_APPROVAL=true 时注入(无 durable 的部署两只 suspended 回收器恒 NO-OP,parked 行的
+        // 恢复把手 = POST /v1/runs/:id/cancel,[868]①)。checkpoint 过期驱动的那只不受本旋钮门控。
+        approvalTimeoutSec: numEnv("APPROVAL_TIMEOUT_SEC", "0"),
+    };
+}
+/** 域:memory(记忆面 + TOC 同步腿)—— 记忆引擎开关/方言/根目录、scope 缺省、同步 client 三键、项目记忆。 */
+function parseMemoryDomain(ctx) {
+    const { requirePrincipal } = ctx; // 跨域入参①:多租户下记忆面 DARK(scope 缺省不铸)
+    // design/138 S1 (clay 2026-07-08): long-term memory = the injection-first file-based memory ENGINE
+    // (core RunnerDeps.memoryBackend), default ON with MEMORY_ENGINE=off as the explicit kill-switch.
+    // The legacy MEMORY_BACKEND/EMBEDDING_* store plane was dropped without migration (those env vars are
+    // no longer read). Single-user gating lives in main.ts (the engine is never wired multi-tenant).
+    const memoryEngineEnabled = process.env.MEMORY_ENGINE !== "off";
+    // S3-TOB(边界重切后的 backend 选择,设计 §1.3):记忆持久面方言。缺省 file=现状零变化;
+    // pg/tidb=DB 真身(零卷主档)——多租户点亮的唯一门(显式 opt-in,复审 F5:绝不静默翻转)。
+    const memoryEngineBackendRaw = process.env.MEMORY_ENGINE_BACKEND ?? "file";
+    if (!["file", "pg", "tidb"].includes(memoryEngineBackendRaw)) {
+        throw new Error(`MEMORY_ENGINE_BACKEND must be file|pg|tidb, got "${memoryEngineBackendRaw}"`);
+    }
+    const memoryEngineBackend = memoryEngineBackendRaw;
+    // Single-user memory scope (hoisted from the config literal so the sync-scope default below can consume it):
+    // explicit MEMORY_SCOPE always wins; default "local" only when the engine is on AND single-user (see the
+    // literal-site comment on why multi-tenant/engine-off must stay undefined = memory dark).
+    const memoryScope = process.env.MEMORY_SCOPE ?? (memoryEngineEnabled && !requirePrincipal ? "local" : undefined);
+    // 142-S2.5-W1: TOC 同步 client 腿的三键(file memory 形态专用)。MEMORY_SYNC_URL 设了=开;
+    // 缺省 undefined=纯本地现状零变化。半配置 fail-loud(memoryEngineBackend 同款姿势,绝不静默降级):
+    //  - URL 有 TOKEN 无 ⇒ throw(中心同步面要 Bearer,缺 token 的“开了但永远 401”是半配置陷阱);
+    //  - TOKEN/SCOPE 有 URL 无 ⇒ throw(operator 显然想开同步,静默不跑=同款陷阱,对称拒启);
+    //  - DB backend(pg/tidb)配了任意同步键 ⇒ throw(中心侧自己就是 POST /v1/memory/sync/:scope 的权威,
+    //    不该再跑 client 腿——两个半场叠在一个进程是拓扑错误)。
+    // scope 缺省 = formatUserScope(memoryScope)(中心侧 owner 门的 user 盘键铸法);memoryScope 本身已是
+    // v2 typed key(user:/org:/proj:/userproj:,只可能来自 operator 显式 MEMORY_SCOPE)则原样直通——
+    // 再包一层会铸出 `user:user%3A...` 双包键(诚实偏离,报告记档)。
+    const memorySyncUrl = process.env.MEMORY_SYNC_URL || undefined;
+    const memorySyncToken = process.env.MEMORY_SYNC_TOKEN || undefined;
+    const memorySyncScopeRaw = process.env.MEMORY_SYNC_SCOPE || undefined;
+    let memorySync;
+    if (memorySyncUrl === undefined) {
+        if (memorySyncToken !== undefined || memorySyncScopeRaw !== undefined) {
+            throw new Error("MEMORY_SYNC_TOKEN/MEMORY_SYNC_SCOPE are set but MEMORY_SYNC_URL is not — refusing to start half-configured (set MEMORY_SYNC_URL to enable memory sync, or unset the other MEMORY_SYNC_* keys)");
+        }
+    }
+    else {
+        if (memoryEngineBackend !== "file") {
+            throw new Error(`MEMORY_SYNC_URL is a FILE-memory (TOC client) knob, but MEMORY_ENGINE_BACKEND=${memoryEngineBackend} — the DB memory plane IS the central sync authority (it serves POST /v1/memory/sync/:scope) and must not also run the client leg; unset MEMORY_SYNC_* here`);
+        }
+        if (memorySyncToken === undefined) {
+            throw new Error("MEMORY_SYNC_URL is set but MEMORY_SYNC_TOKEN is not — refusing to start half-configured (the central sync face requires a bearer token)");
+        }
+        const isV2ScopeKey = (k) => k.startsWith("user:") || k.startsWith("org:") || k.startsWith("proj:") || k.startsWith("userproj:");
+        const scope = memorySyncScopeRaw ?? (memoryScope !== undefined ? (isV2ScopeKey(memoryScope) ? memoryScope : formatUserScope(memoryScope)) : undefined);
+        if (scope === undefined) {
+            throw new Error("MEMORY_SYNC_URL is set but no sync scope is derivable (memory engine off or multi-tenant without an explicit scope) — set MEMORY_SYNC_SCOPE, or run the single-user file memory engine so MEMORY_SCOPE (default \"local\") provides one");
+        }
+        memorySync = { url: memorySyncUrl, token: memorySyncToken, scope, ...((v) => (v !== undefined && Number.isInteger(v) && v >= 1 ? { maxPushEntries: v } : {}))(process.env.MEMORY_SYNC_MAX_PUSH_ENTRIES !== undefined ? Number(process.env.MEMORY_SYNC_MAX_PUSH_ENTRIES) : undefined), ...((v) => (v !== undefined && Number.isInteger(v) && v >= 1 ? { maxPullEntries: v } : {}))(process.env.MEMORY_SYNC_MAX_PULL_ENTRIES !== undefined ? Number(process.env.MEMORY_SYNC_MAX_PULL_ENTRIES) : undefined) };
+    }
+    // design/158 B4 ② 的 D 家族四枚里,唯一落在 ServiceConfig 上的就是这枚(其余三枚只在使用点懒读,
+    // 预登记留在 orchestration 域 —— 顺序与改前一致:本枚的弃用通知仍先于那三枚)。
+    const projectMemoryEnabled = boolEnvWithLegacyNegated("PROJECT_MEMORY_ENABLED", "PROJECT_MEMORY_DISABLED", true);
+    return {
+        memoryEngineEnabled,
+        memoryEngineDir: process.env.MEMORY_ENGINE_DIR || undefined,
+        memoryEngineRemoteLaneAllowed: process.env.MEMORY_ENGINE_REMOTE_LANE === "allow", // N0: fail-closed default
+        // A single-user deployment has no principal, so `memoryScopeFor` falls back to `config.memoryScope` — and if
+        // THAT were unset the resolved scope would be undefined ⇒ resolveSpec builds NO `spec.memory` ⇒ the memory
+        // engine never materializes (the "wired-not-triggered" gap a §4 real test hit on the legacy plane).
         // Default it to "local" for single-user (REQUIRE_PRINCIPAL !== "true") so TOC local memory works out-of-the-box
         // (CC-parity). Multi-tenant memory is DARK by design (design/138 S1: the file basement has no tenant isolation —
         // memoryScopeFor returns undefined there). An explicit MEMORY_SCOPE always wins.
         memoryEngineBackend,
-        ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}),
         memoryScope, // hoisted above (the 142-S2.5-W1 sync-scope default consumes it)
         ...(memorySync ? { memorySync } : {}),
+        projectMemoryEnabled, // design/113 C4 opt-out, flipped positive in design/158 B4 (legacy PROJECT_MEMORY_DISABLED still honored)
+        syncImportLeaseStaleSec: Math.max(0, numEnv("SYNC_IMPORT_LEASE_STALE_SEC", "600")),
+    };
+}
+/** 域:auth(身份/凭证/绑址)—— service token 面、CORS、principal 头与开关、JWT 锚、autonomy、绑址。 */
+function parseAuthDomain(ctx) {
+    const { requirePrincipal } = ctx; // 装配层已解析(它是四个域的共同入参),本域只负责把它落到字段上
+    // design/80 D-G 直连门的 principal-JWT 锚:验签材料属 auth 域,门的激活与半开门不变量在装配层。
+    const principalJwtPubkeys = parsePrincipalJwks(process.env.PRINCIPAL_JWT_PUBKEYS);
+    const principalJwtIss = process.env.PRINCIPAL_JWT_ISS || undefined;
+    const principalJwtAud = process.env.PRINCIPAL_JWT_AUD || undefined;
+    const principalJwtMaxTtlSec = Math.max(0, numEnv("PRINCIPAL_JWT_MAX_TTL_SEC", "120")); // 0 = no cap; default ≤120s
+    // Per-system service credentials (token → system name). Parsed as a DOMAIN field (not inline in the return
+    // literal) so the bake boot invariant at the assembly layer can assert the runner-credential→runnerPrincipal
+    // mapping exists.
+    const authTokens = Object.fromEntries((process.env.SERVICE_AUTH_TOKENS ?? "")
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.includes("="))
+        .map((s) => [s.slice(0, s.indexOf("=")).trim(), s.slice(s.indexOf("=") + 1).trim()])
+        .filter(([tok, sys]) => tok.length > 0 && sys.length > 0));
+    return {
+        // 绑址([1934]):BIND_HOST 优先,HOST 兼容(cli/桌面传的就是它);空串=未设。
+        bindHost: process.env.BIND_HOST || process.env.HOST || undefined,
+        authToken: process.env.SERVICE_AUTH_TOKEN,
+        authTokens,
+        allowUnauthedWrites: boolEnv("ALLOW_UNAUTHED_WRITES", false),
+        corsOrigins: (process.env.CORS_ORIGIN ?? "").split(",").map((s) => s.trim()).filter(Boolean),
+        principalHeader: headerNameEnv("PRINCIPAL_HEADER", "x-agent-principal"),
+        requirePrincipal,
+        // Runtime governance second baton (center §10): AUTONOMY env for the env/local path; sema-registry overlays
+        // it (applyRuntimeHot). commandPolicy is structured config — sema-registry-only (no flat env scalar form).
+        autonomy: parseAutonomy(process.env.AUTONOMY),
+        operatorPrincipals: csv("OPERATOR_PRINCIPALS"),
+        principalJwtPubkeys,
+        principalJwtIss,
+        principalJwtAud,
+        principalJwtMaxTtlSec,
+    };
+}
+/** 域:orchestration(编排 + 执行车道)—— remoteExec 五车道/worktree 隔离、leader/router/scheduler/fork、
+ *  workflow 与后台 agent 的存留旋钮、沙箱面(pkg 源/env facts/LSP)、烤镜像门。 */
+function parseOrchestrationDomain(ctx) {
+    const { postureOn } = ctx; // 跨域入参②:posture 三态(single-user turnkey ⇒ 自编排/fork/scheduler 默认 ON)
+    // workflowSizeGuideline: CC normalizes unknown→unrestricted (lenient), but an env knob typo
+    // silently degrading to "no guidance" is the half-config trap — fail-loud here (memoryEngineBackend
+    // posture; the ADVISORY nature is core's concern, the env spelling is ours).
+    const workflowSizeGuidelineRaw = process.env.WORKFLOW_SIZE_GUIDELINE;
+    if (workflowSizeGuidelineRaw !== undefined && !["small", "medium", "large", "unrestricted"].includes(workflowSizeGuidelineRaw)) {
+        throw new Error(`WORKFLOW_SIZE_GUIDELINE must be small|medium|large|unrestricted, got "${workflowSizeGuidelineRaw}"`);
+    }
+    const workflowSizeGuideline = workflowSizeGuidelineRaw;
+    const bakeRunnerPrincipal = env("BAKE_RUNNER_PRINCIPAL", "system:bake-runner");
+    // ── design/158 B4 ② — the four knobs whose canonical name went from negative to positive. Only the first
+    // lands on `ServiceConfig`; the other three are read lazily at their use sites (main.ts's LKG gate,
+    // remote-env-host's capability probe and exec path) but are resolved HERE too so that their polarity row and
+    // any legacy-alias deprecation notice are emitted once, at boot, with every other config diagnostic — an
+    // operator must not have to trigger a background shell before being told the name they set is retired.
+    // (家族的第一枚 PROJECT_MEMORY_ENABLED 是 memory 域的字段,已在那里解析 —— 通知顺序不变。)
+    configLkgEnabled();
+    hostBackgroundShellEnabled();
+    hostExecSpoolEnabled();
+    // ── design/158 B4 ③ — LSP: one knob per lane. `LSP_ENABLED` used to drive BOTH the sandbox lane (opt-in,
+    // default OFF — it needs a baked `sema-code-lsp` template) and the host lane (opt-out, default ON — it needs
+    // nothing and degrades to grep/read), i.e. one env name with two OPPOSITE defaults and no way to silence the
+    // host lane without also naming the sandbox knob. `LSP_HOST_ENABLED` now owns the host lane; an explicit
+    // `LSP_ENABLED=false` keeps working as a host opt-out (it was the only one operators ever had) with a notice
+    // naming the replacement, and `LSP_HOST_ENABLED` always wins when set.
+    const lspHostEnabled = (() => {
+        const explicitHost = process.env.LSP_HOST_ENABLED;
+        if (explicitHost === undefined || explicitHost === "") {
+            if (process.env.LSP_ENABLED === "false") {
+                CONFIG_NOTICES.push({
+                    event: "config_env_deprecated_lane_alias",
+                    fields: { deprecated: "LSP_ENABLED=false", replacement: "LSP_HOST_ENABLED=false", lane: "host", effective: "false" },
+                });
+                registerKnob({ name: "LSP_HOST_ENABLED", polarity: "opt-out", value: false, source: "legacy-env", legacyName: "LSP_ENABLED" });
+                return false;
+            }
+        }
+        return boolEnv("LSP_HOST_ENABLED", true);
+    })();
+    return {
         remoteExec: process.env.REMOTE_EXEC === "e2b" && process.env.E2B_API_KEY
             ? {
                 provider: "e2b",
@@ -940,121 +1055,6 @@ export function loadConfig() {
                 ...(process.env.WORKTREE_BASE_COMMIT ? { commit: process.env.WORKTREE_BASE_COMMIT } : {}),
             }
             : undefined,
-        dbBackend,
-        dbBackendExplicit: dbBackendSet,
-        localDataRoot,
-        tidb: needsDb && dbBackend === "mysql"
-            ? {
-                host: env2("MYSQL_HOST", "TIDB_HOST"),
-                // default port follows the env family in use: MYSQL_HOST → 3306 (stock MySQL), TIDB_HOST → 4000 (TiDB)
-                port: Number(env2("MYSQL_PORT", "TIDB_PORT", process.env.MYSQL_HOST ? "3306" : "4000")),
-                user: env2("MYSQL_USER", "TIDB_USER"),
-                password: env2("MYSQL_PASSWORD", "TIDB_PASSWORD", ""),
-                database: env2("MYSQL_DATABASE", "TIDB_DATABASE"),
-                connectionLimit: process.env.MYSQL_POOL_SIZE || process.env.TIDB_POOL_SIZE
-                    ? Number(process.env.MYSQL_POOL_SIZE || process.env.TIDB_POOL_SIZE)
-                    : undefined,
-            }
-            : undefined,
-        pg: needsDb && dbBackend === "pg"
-            ? {
-                host: env("PG_HOST"),
-                port: Number(env("PG_PORT", "5432")),
-                user: env("PG_USER"),
-                password: env("PG_PASSWORD", ""),
-                database: env("PG_DATABASE"),
-                connectionLimit: process.env.PG_POOL_SIZE ? Number(process.env.PG_POOL_SIZE) : undefined,
-            }
-            : undefined,
-        // S9 deeper fix: per-query DB timeout (see the interface doc). Soft knob — a typo degrades to the default
-        // posture (pool-wide off / counter-family 30s) with an S20 boot warning, never NaN into a driver timer.
-        dbQueryTimeoutMs: optFinitePositiveEnv("DB_QUERY_TIMEOUT_MS"),
-        // E19/2c snapshot-BLOB object-store offload (clay 2026-06-26). Reuses the SAME adapter-held MinIO creds as the k8s
-        // workspace-snapshot lane (secret minio-agent-worker); all three keys required to enable, else the file-snapshot
-        // stores keep the SQL `snapshot_blob` default (byte-identical to today). Bucket = SESSION_SNAPSHOT_BUCKET (default
-        // "session-snapshots"); keyPrefix optional (default "blobs/" in MinioBlobBackend).
-        snapshotBlobStore: process.env.MINIO_ENDPOINT && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
-            ? {
-                endpoint: process.env.MINIO_ENDPOINT,
-                bucket: process.env.SESSION_SNAPSHOT_BUCKET ?? "session-snapshots",
-                accessKey: process.env.MINIO_ACCESS_KEY,
-                secretKey: process.env.MINIO_SECRET_KEY,
-                ...(process.env.MINIO_REGION ? { region: process.env.MINIO_REGION } : {}),
-                ...(process.env.SESSION_SNAPSHOT_PREFIX ? { keyPrefix: process.env.SESSION_SNAPSHOT_PREFIX } : {}),
-                // Fail-SAFE parse (finding 20): a non-numeric/non-positive value → omit (the MinioBlobBackend default 3600s
-                // applies), never NaN (which would sign every URL with X-Amz-Expires=NaN → total snapshot outage).
-                ...((ttl) => (ttl !== undefined ? { presignTtlSec: ttl } : {}))(optFinitePositiveEnv("SESSION_SNAPSHOT_TTL_SEC")),
-            }
-            : undefined,
-        // (a+c)(clay 2026-07-27)snapshot_blob 包墙修复两旋钮——语义见 ServiceConfig 字段注释。
-        snapshotBlobSqlMaxBytes: optFinitePositiveEnv("SNAPSHOT_BLOB_SQL_MAX_BYTES"),
-        snapshotBlobAllowSql: boolEnv("SNAPSHOT_BLOB_ALLOW_SQL_BYTES", false),
-        // plugins 域 clone host 白名单(契约 [1361]①;缺省 github.com,逗号扩 https 镜像域)。
-        pluginsAllowHosts: (process.env.PLUGINS_ALLOW_HOSTS ?? "github.com").split(",").map((h) => h.trim()).filter(Boolean),
-        // 绑址([1934]):BIND_HOST 优先,HOST 兼容(cli/桌面传的就是它);空串=未设。
-        bindHost: process.env.BIND_HOST || process.env.HOST || undefined,
-        // D-1 孤儿对象 GC grace(复审 F10;0=关掉本腿,负/坏值走默认)。
-        attachmentOrphanGraceMs: ((v) => (v !== undefined && Number.isFinite(v) && v >= 0 ? v : 3_600_000))(process.env.ATTACHMENT_ORPHAN_GRACE_MS !== undefined ? Number(process.env.ATTACHMENT_ORPHAN_GRACE_MS) : undefined),
-        // workspace 浏览面(#3,[1894]①)单文件读上限。
-        workspaceFileMaxBytes: optFinitePositiveEnv("WORKSPACE_FILE_MAX_BYTES") ?? 8 * 1024 * 1024,
-        // SendUserFile 双轨公网直链(同三键开闸;S3_ENDPOINT 兼容位=外接 S3 场景内网/公网同址)。
-        // `||` 非 `??`(配置面自查 2026-07-14):env 惯例(env() helper 同款)空串=未设——`?? ` 会让
-        // 一个显式置空的 MINIO_ENDPOINT/S3_PUBLIC_ENDPOINT 把后备名吞掉(compose `${X:-}` 透传空串是常态)。
-        sendUserFile: (process.env.MINIO_ENDPOINT || process.env.S3_ENDPOINT) && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
-            ? {
-                endpoint: (process.env.MINIO_ENDPOINT || process.env.S3_ENDPOINT),
-                ...(process.env.S3_PUBLIC_ENDPOINT || process.env.S3_ENDPOINT
-                    ? { publicEndpoint: (process.env.S3_PUBLIC_ENDPOINT || process.env.S3_ENDPOINT) }
-                    : {}),
-                publicBucket: process.env.S3_PUBLIC_BUCKET ?? "sema-public",
-                privateBucket: process.env.SESSION_SNAPSHOT_BUCKET ?? "session-snapshots",
-                privateKeyPrefix: "sendfile/",
-                ...(process.env.SEND_USER_FILE_SANDBOX_PUT_ENDPOINT ? { sandboxPutEndpoint: process.env.SEND_USER_FILE_SANDBOX_PUT_ENDPOINT } : {}),
-                accessKey: process.env.MINIO_ACCESS_KEY,
-                secretKey: process.env.MINIO_SECRET_KEY,
-                ...(process.env.MINIO_REGION ? { region: process.env.MINIO_REGION } : {}),
-                // fail-SAFE:非法值回落 0(永久轨缺省),不 NaN 进签名。
-                defaultTtlSec: ((v) => (v !== undefined && Number.isInteger(v) && v >= 0 ? v : 0))(process.env.SEND_USER_FILE_URL_TTL !== undefined ? Number(process.env.SEND_USER_FILE_URL_TTL) : undefined),
-            }
-            : undefined,
-        authToken: process.env.SERVICE_AUTH_TOKEN,
-        authTokens,
-        allowUnauthedWrites: boolEnv("ALLOW_UNAUTHED_WRITES", false),
-        metricsToken: process.env.METRICS_TOKEN || undefined,
-        traceToken: process.env.TRACE_TOKEN || undefined,
-        corsOrigins: (process.env.CORS_ORIGIN ?? "").split(",").map((s) => s.trim()).filter(Boolean),
-        attachmentMaxBytes: Math.max(1024, numEnv("ATTACHMENT_MAX_BYTES", String(32 * 1024 * 1024))),
-        ...(process.env.ATTACHMENT_MIME_ALLOWLIST
-            ? { attachmentMimeAllowlist: process.env.ATTACHMENT_MIME_ALLOWLIST.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean) }
-            : {}),
-        attachmentUnboundTtlMs: Math.max(60_000, numEnv("ATTACHMENT_UNBOUND_TTL_MS", String(24 * 3600 * 1000))),
-        principalHeader: headerNameEnv("PRINCIPAL_HEADER", "x-agent-principal"),
-        requirePrincipal,
-        // Runtime governance second baton (center §10): AUTONOMY env for the env/local path; sema-registry overlays
-        // it (applyRuntimeHot). commandPolicy is structured config — sema-registry-only (no flat env scalar form).
-        autonomy: parseAutonomy(process.env.AUTONOMY),
-        approvalRequire: csv("APPROVAL_REQUIRE"),
-        operatorPrincipals: csv("OPERATOR_PRINCIPALS"),
-        cascadeLadder: csv("MODEL_CASCADE_LADDER"),
-        approvalDeny: csv("APPROVAL_DENY"),
-        approvalPollMs: Number(env("APPROVAL_POLL_MS", "1500")),
-        durableApproval: boolEnv("DURABLE_APPROVAL", false),
-        resourceSuspend: boolEnv("RESOURCE_SUSPEND", false),
-        resourceSuspendTtlSec: Math.max(0, numEnv("RESOURCE_SUSPEND_TTL_SEC", "0")), // 0 ⇒ core default (30d)
-        approvalAutoBudget: Math.min(10000, Math.max(0, numEnv("APPROVAL_AUTO_BUDGET", "0"))), // clamp [0,10000]; 0 = off
-        approvalNeverAuto: csv("APPROVAL_NEVER_AUTO"),
-        approvalHmacKeys: dgHmacKeys, // D-G: WIRED (see the field's JSDoc); empty ⇒ inactive, not unimplemented
-        directApprovalDoor,
-        principalJwtPubkeys,
-        principalJwtIss,
-        principalJwtAud,
-        principalJwtMaxTtlSec,
-        directDoorActive,
-        infraCostRates: {
-            toolCallMicroUsd: Math.max(0, numEnv("INFRA_COST_TOOL_CALL", "0")),
-            sandboxSecMicroUsd: Math.max(0, numEnv("INFRA_COST_SANDBOX_SEC", "0")),
-            egressGbMicroUsd: Math.max(0, numEnv("INFRA_COST_EGRESS_GB", "0")),
-        },
         leaderEnabled: boolEnv("LEADER_ENABLED", false),
         leaderFanoutEnabled: boolEnv("LEADER_FANOUT_ENABLED", true),
         routerEnabled: boolEnv("ROUTER_ENABLED", false), // A value router; default OFF (ship dark, enable after live validation)
@@ -1062,13 +1062,12 @@ export function loadConfig() {
         forkEnabled: postureOn("FORK_ENABLED"), // §4 CC /fork posture: single-user turnkey → default-ON for the LLM; multi-tenant honored only with a per-principal entitlement resolver (core enforces allowFork, registry-core 0.1.47; enableForkFromBody)
         experimentalObserverAgents: boolEnv("EXPERIMENTAL_OBSERVER_AGENTS", false), // observer 开闸线:显式 "true" 才开(实验面,core ships dark——非 postureOn);多租户只认 center caps,env 被忽略(applyObserverEnvOptIn boot warn)
         schedulerEnabled: postureOn("SCHEDULER_ENABLED"), // R7 自唤醒 posture: single-user turnkey → ON (CC self-wake); multi-tenant routes to center (opt-in)
-        projectMemoryEnabled, // design/113 C4 opt-out, flipped positive in design/158 B4 (legacy PROJECT_MEMORY_DISABLED still honored)
         planModeEnabled: boolEnv("PLAN_MODE_ENABLED", true), // EnterPlanMode (core 1.167) model-driven plan; 🆕 default ON (resident — clay), PLAN_MODE_ENABLED=false opts out
         ...(process.env.SCHEDULER_STORE_PATH ? { schedulerStorePath: process.env.SCHEDULER_STORE_PATH } : {}),
-        configBootFetchBudgetMs: Math.max(0, numEnv("CONFIG_BOOT_FETCH_BUDGET_MS", "1500")), // boot 首拉抢答窗;过窗转后台补齐(clay 2026-07-17:本地 5s 启动=黑洞中心同步等待)
         schedulerSessionWakeup: boolEnv("SCHEDULER_SESSION_WAKEUP", true), // [1009]② host-signal: default ON, the spawning shell opts a daemon-less engine out (PLAN_MODE_ENABLED 同形解析)
         selfOrchestrationModels: csv("SELF_ORCHESTRATION_MODELS"),
         selfOrchestrationWorkerIsolation: boolEnv("SELF_ORCHESTRATION_WORKER_ISOLATION", false),
+        ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}),
         workflowRunStoreBackend: enumEnv("WORKFLOW_RUN_STORE", "auto", ["auto", "file", "memory"]), // SVC-1 + P1: auto = SQL backend when present (cross-replica), else File
         workflowOrphanGraceMs: Math.max(60_000, numEnv("WORKFLOW_ORPHAN_GRACE_MS", String(24 * 60 * 60 * 1000))), // SVC-1: 24h default, floor 1m
         workflowJournalRetentionMs: Math.max(60_000, numEnv("WORKFLOW_JOURNAL_RETENTION_MS", String(7 * 24 * 60 * 60 * 1000))), // SVC-2: 7d default, floor 1m
@@ -1088,37 +1087,9 @@ export function loadConfig() {
         sessionAutoTitle: boolEnv("SESSION_AUTO_TITLE", true), // session auto-title: default ON (one cheap call per session)
         selectEnvironmentTool: boolEnv("SELECT_ENVIRONMENT_TOOL", true), // RFC A2: default ON (mount additionally gated on k8s+catalog)
         envFactsEnabled: boolEnv("SANDBOX_ENV_FACTS", true), // RFC A1: default ON (core 1.240.0 TaskSpec.envFacts; no-facts = no field)
-        // ③ sensitive-path write deny set: unset = core's recommended set; explicit value = full replacement
-        // (comma-separated); "off"/empty = disabled. Set curation is core's (成文 core-side); server passes through.
-        sensitiveWritePatterns: ((raw) => {
-            if (raw === undefined)
-                return [...RECOMMENDED_SENSITIVE_PATTERNS];
-            const trimmed = raw.trim();
-            if (trimmed === "" || trimmed.toLowerCase() === "off")
-                return [];
-            return trimmed.split(",").map((p) => p.trim()).filter((p) => p.length > 0);
-        })(process.env.SENSITIVE_WRITE_PATTERNS),
-        // [1557]§四: opt-in only — any value other than the two real gate shapes (incl. "off"/unset) stays undefined
-        // (no field on the config object at all), so the fs-write gate wiring never even considers it.
-        ...(process.env.MANUAL_MODE_SHELL_GATE === "always" || process.env.MANUAL_MODE_SHELL_GATE === "classify"
-            ? { manualModeShellGate: process.env.MANUAL_MODE_SHELL_GATE }
-            : {}),
         toolDeferLongtail: boolEnv("TOOL_DEFER_LONGTAIL", false), // [803]④ defer face: EXPERIMENTAL, default OFF
         lspEnabled: boolEnv("LSP_ENABLED", false), // sandbox lane: opt-in (needs a baked sema-code-lsp template)
         lspHostEnabled, // host lane: LSP_HOST_ENABLED, DEFAULT ON (CC-parity, degrades gracefully) — see the derivation above
-        drainGraceMs: Math.max(10_000, numEnv("DRAIN_GRACE_MS", String(10 * 60 * 1000))), // SIGTERM drain window, default 10min, floor 10s
-        sighupIdleGraceMs: Math.max(5_000, numEnv("SIGHUP_IDLE_GRACE_MS", String(120_000))), // B3: SIGHUP idle-shutdown window, default 2min, floor 5s
-        mcpElicitation: {
-            enabled: boolEnv("MCP_ELICITATION_ENABLED", false), // E23 inbound elicitation; default OFF (fail-closed)
-            throttle: {
-                maxConcurrentPerRun: numEnvBounded("MCP_ELICITATION_MAX_CONCURRENT", String(DEFAULT_ELICITATION_THROTTLE.maxConcurrentPerRun), 1, 64),
-                maxTotalPerRun: numEnvBounded("MCP_ELICITATION_MAX_TOTAL", String(DEFAULT_ELICITATION_THROTTLE.maxTotalPerRun), 1, 10_000),
-                minIntervalMsPerServer: numEnvBounded("MCP_ELICITATION_MIN_INTERVAL_MS", String(DEFAULT_ELICITATION_THROTTLE.minIntervalMsPerServer), 0, 600_000),
-                ttlMs: numEnvBounded("MCP_ELICITATION_TTL_MS", String(DEFAULT_ELICITATION_THROTTLE.ttlMs), 1_000, 3_600_000),
-            },
-        },
-        askQuestionEnabled: postureOn("ASK_QUESTION_ENABLED"), // §4④ AskUserQuestion live HITL; posture-gated (single-user → ON)
-        toolApprovalEnabled: postureOn("TOOL_APPROVAL_ENABLED"), // [816]/[820]② live tool-approval HITL; posture-gated (single-user → ON), mirrors askQuestion
         workflowAgentsReadOnly: boolEnv("WORKFLOW_AGENTS_READONLY", false), // [824]① TOB 保守旋钮:默认 off = workflow 子 agent 同权(CC parity)
         imageBakes: {
             enabled: boolEnv("IMAGE_BAKES_ENABLED", false),
@@ -1131,9 +1102,28 @@ export function loadConfig() {
             submitRateMax: Math.max(0, numEnv("BAKE_SUBMIT_RATE_MAX", "10")),
             submitRateWindowSec: Math.max(1, numEnv("BAKE_SUBMIT_RATE_WINDOW_SEC", "60")),
         },
-        toolTrace: boolEnv("TOOL_TRACE", false),
-        traceThinking: boolEnv("TRACE_THINKING", true), // default ON (clay)
-        logLevel: env("LOG_LEVEL", "info"),
+    };
+}
+/** 域:limits+http(限额与 HTTP 面)—— 端口、附件/工作区体积与 TTL、成本与速率天花板、排空窗、回收周期。 */
+function parseLimitsHttpDomain() {
+    return {
+        port: Number(env("PORT", "8090")),
+        // D-1 孤儿对象 GC grace(复审 F10;0=关掉本腿,负/坏值走默认)。
+        attachmentOrphanGraceMs: ((v) => (v !== undefined && Number.isFinite(v) && v >= 0 ? v : 3_600_000))(process.env.ATTACHMENT_ORPHAN_GRACE_MS !== undefined ? Number(process.env.ATTACHMENT_ORPHAN_GRACE_MS) : undefined),
+        // workspace 浏览面(#3,[1894]①)单文件读上限。
+        workspaceFileMaxBytes: optFinitePositiveEnv("WORKSPACE_FILE_MAX_BYTES") ?? 8 * 1024 * 1024,
+        attachmentMaxBytes: Math.max(1024, numEnv("ATTACHMENT_MAX_BYTES", String(32 * 1024 * 1024))),
+        ...(process.env.ATTACHMENT_MIME_ALLOWLIST
+            ? { attachmentMimeAllowlist: process.env.ATTACHMENT_MIME_ALLOWLIST.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean) }
+            : {}),
+        attachmentUnboundTtlMs: Math.max(60_000, numEnv("ATTACHMENT_UNBOUND_TTL_MS", String(24 * 3600 * 1000))),
+        infraCostRates: {
+            toolCallMicroUsd: Math.max(0, numEnv("INFRA_COST_TOOL_CALL", "0")),
+            sandboxSecMicroUsd: Math.max(0, numEnv("INFRA_COST_SANDBOX_SEC", "0")),
+            egressGbMicroUsd: Math.max(0, numEnv("INFRA_COST_EGRESS_GB", "0")),
+        },
+        drainGraceMs: Math.max(10_000, numEnv("DRAIN_GRACE_MS", String(10 * 60 * 1000))), // SIGTERM drain window, default 10min, floor 10s
+        sighupIdleGraceMs: Math.max(5_000, numEnv("SIGHUP_IDLE_GRACE_MS", String(120_000))), // B3: SIGHUP idle-shutdown window, default 2min, floor 5s
         // BL-9: numEnv (not bare Number) — a non-numeric typo FAILS at startup instead of becoming NaN, which would
         // silently DISABLE the operator cost/rate ceiling (every `> ceiling` comparison against NaN is false).
         rateLimitPerMin: numEnv("RATE_LIMIT_RPM", "0"),
@@ -1141,23 +1131,19 @@ export function loadConfig() {
         maxTaskTokens: numEnv("MAX_TASK_TOKENS", "0"),
         maxPrincipalCostUsd: numEnv("MAX_PRINCIPAL_COST_USD", "0"),
         costQuotaWindowSec: numEnv("COST_QUOTA_WINDOW_SEC", "86400"),
-        degrade: process.env.MODEL_DEGRADE_TO
-            ? {
-                to: env("MODEL_DEGRADE_TO"),
-                atCostFraction: Number(env("MODEL_DEGRADE_AT_COST_FRACTION", "0.7")),
-                reactive: boolEnv("MODEL_DEGRADE_REACTIVE", false),
-                downgradeOn: csv("MODEL_DEGRADE_ON").length
-                    ? csv("MODEL_DEGRADE_ON")
-                    : undefined,
-                // vision precheck (adversarial-review finding): the degrade TARGET is an external gateway
-                // model NOT in config.models, so resolveSpec's precheck (which only sees the picked model) can't see its
-                // vision capability — a vision-capable main + text-only degrade target would let images reach the text-only
-                // gateway as the opaque 400 the precheck prevents, AFTER admission, at runtime degrade. Declare it via
-                // MODEL_DEGRADE_TO_VISION (strict "true"). DEFAULT false = assume the cheaper degrade target is text-only
-                // (the common case, e.g. deepseek), so resolveSpec drops degrade for image-carrying tasks (main.ts).
-                toSupportsImages: boolEnv("MODEL_DEGRADE_TO_VISION", false),
-            }
-            : undefined,
+        reapIntervalSec: numEnv("REAP_INTERVAL_SEC", "60"),
+        runStaleSec: numEnv("REAP_RUN_STALE_SEC", "120"),
+        toolResultTtlSec: Number(env("TOOL_RESULT_TTL_SEC", "86400")),
+    };
+}
+/** 域:observability(可观测)—— 指标/追踪令牌、工具与思考轨迹开关、日志档位、OTLP 出口。 */
+function parseObservabilityDomain() {
+    return {
+        metricsToken: process.env.METRICS_TOKEN || undefined,
+        traceToken: process.env.TRACE_TOKEN || undefined,
+        toolTrace: boolEnv("TOOL_TRACE", false),
+        traceThinking: boolEnv("TRACE_THINKING", true), // default ON (clay)
+        logLevel: env("LOG_LEVEL", "info"),
         otel: process.env.OTEL_EXPORTER_OTLP_ENDPOINT
             ? {
                 endpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT.replace(/\/$/, ""),
@@ -1170,14 +1156,14 @@ export function loadConfig() {
                 })),
             }
             : undefined,
-        // [875]a 成文:0(缺省)= durable HITL 无限期等人,时间型 reapSuspended 不跑;file/memory lane 的回收
-        // 探针只在 DURABLE_APPROVAL=true 时注入(无 durable 的部署两只 suspended 回收器恒 NO-OP,parked 行的
-        // 恢复把手 = POST /v1/runs/:id/cancel,[868]①)。checkpoint 过期驱动的那只不受本旋钮门控。
-        approvalTimeoutSec: numEnv("APPROVAL_TIMEOUT_SEC", "0"),
-        reapIntervalSec: numEnv("REAP_INTERVAL_SEC", "60"),
-        runStaleSec: numEnv("REAP_RUN_STALE_SEC", "120"),
-        syncImportLeaseStaleSec: Math.max(0, numEnv("SYNC_IMPORT_LEASE_STALE_SEC", "600")),
-        toolResultTtlSec: Number(env("TOOL_RESULT_TTL_SEC", "86400")),
+    };
+}
+/** 域:misc-integration(外部集成)—— plugins clone 白名单、git/OA 面、场景与 skill 目录、sema-registry 接入。 */
+function parseIntegrationsDomain() {
+    return {
+        // plugins 域 clone host 白名单(契约 [1361]①;缺省 github.com,逗号扩 https 镜像域)。
+        pluginsAllowHosts: (process.env.PLUGINS_ALLOW_HOSTS ?? "github.com").split(",").map((h) => h.trim()).filter(Boolean),
+        configBootFetchBudgetMs: Math.max(0, numEnv("CONFIG_BOOT_FETCH_BUDGET_MS", "1500")), // boot 首拉抢答窗;过窗转后台补齐(clay 2026-07-17:本地 5s 启动=黑洞中心同步等待)
         gitApiBaseUrl: process.env.GIT_API_BASEURL,
         gitApiToken: process.env.GIT_API_TOKEN,
         // BEHAVIOR CHANGE([891] clay 硬裁定):出厂缺省场景 default→code(CC 编码 persona 蒸馏版)——
@@ -1219,6 +1205,198 @@ export function loadConfig() {
         configLocalDir: process.env.CONFIG_LOCAL_DIR || undefined,
     };
 }
+const STORE_GROUP_KEYS = [
+    "sessionBackend", "sessionCacheTtlSec", "rewindSnapshotMaxMb", "dbBackend", "dbBackendExplicit", "localDataRoot",
+    "tidb", "pg", "dbQueryTimeoutMs", "snapshotBlobStore", "snapshotBlobSqlMaxBytes", "snapshotBlobAllowSql", "sendUserFile",
+];
+const MODEL_PLANE_GROUP_KEYS = [
+    "gatewayBaseUrl", "gatewayApiKey", "gatewayFallbackUrls", "anthropic", "resilience", "model", "models",
+    "modelApiKeyEnv", "modelApiKeys", "modelQuotaWeights", "tiers", "projects", "roles", "cascadeLadder", "degrade",
+];
+const APPROVAL_GROUP_KEYS = [
+    "approvalRequire", "approvalDeny", "approvalPollMs", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
+    "approvalHmacKeys", "durableApproval", "directApprovalDoor", "directDoorActive", "resourceSuspend",
+    "resourceSuspendTtlSec", "askQuestionEnabled", "toolApprovalEnabled", "mcpElicitation", "sensitiveWritePatterns",
+    "manualModeShellGate",
+];
+const MEMORY_GROUP_KEYS = [
+    "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",
+    "memorySync", "projectMemoryEnabled", "syncImportLeaseStaleSec",
+];
+const AUTH_GROUP_KEYS = [
+    "authToken", "authTokens", "allowUnauthedWrites", "corsOrigins", "principalHeader", "requirePrincipal", "autonomy",
+    "commandPolicy", "operatorPrincipals", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud",
+    "principalJwtMaxTtlSec", "bindHost",
+];
+const ORCHESTRATION_GROUP_KEYS = [
+    "remoteExec", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
+    "selfOrchestrationModels", "selfOrchestrationWorkerIsolation", "forkEnabled", "experimentalObserverAgents",
+    "schedulerEnabled", "schedulerSessionWakeup", "schedulerStorePath", "planModeEnabled", "workflowRunStoreBackend",
+    "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "workflowAgentsReadOnly",
+    "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs",
+    "backgroundAgentParkClaimStaleMs", "rosterRetentionMs", "scratchpadSweepTtlMs", "sandboxPkgSource",
+    "sessionAutoTitle", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled",
+    "imageBakes",
+];
+const LIMITS_HTTP_GROUP_KEYS = [
+    "port", "attachmentOrphanGraceMs", "workspaceFileMaxBytes", "attachmentMaxBytes", "attachmentMimeAllowlist",
+    "attachmentUnboundTtlMs", "infraCostRates", "drainGraceMs", "sighupIdleGraceMs", "rateLimitPerMin", "maxTaskCostUsd",
+    "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec", "reapIntervalSec", "runStaleSec", "toolResultTtlSec",
+];
+const OBSERVABILITY_GROUP_KEYS = ["metricsToken", "traceToken", "toolTrace", "traceThinking", "logLevel", "otel"];
+const INTEGRATIONS_GROUP_KEYS = [
+    "pluginsAllowHosts", "mcpServers", "configBootFetchBudgetMs", "gitApiBaseUrl", "gitApiToken", "defaultScenario",
+    "skillsDir", "oaApiBaseUrl", "oaServiceToken", "oaIssue", "configCenter", "configProvider", "configLocalDir",
+];
+/** 组名 → 该组取景的平铺键(introspection 面:测试用它钉「每个平铺键恰好被一组取景」)。 */
+export const CONFIG_GROUP_KEYS = {
+    store: STORE_GROUP_KEYS,
+    modelPlane: MODEL_PLANE_GROUP_KEYS,
+    approval: APPROVAL_GROUP_KEYS,
+    memory: MEMORY_GROUP_KEYS,
+    auth: AUTH_GROUP_KEYS,
+    orchestration: ORCHESTRATION_GROUP_KEYS,
+    limitsHttp: LIMITS_HTTP_GROUP_KEYS,
+    observability: OBSERVABILITY_GROUP_KEYS,
+    integrations: INTEGRATIONS_GROUP_KEYS,
+};
+/** 一组的**取景器**:每个键一个 accessor,读的时候才去平铺面取值。
+ *  ⚠️ 刻意不是 `{...pick(flat, keys)}` 的快照——快照会在 sema-registry 热应用(`config.model = …`、
+ *  `mutateInPlace(config.models, …)`)之后变成一份**静默过期**的旧值;取景器没有第二份存储,故不存在
+ *  过期这个状态。`create*` 而非 `build*`:返回的是带行为(accessor)的活对象,不是纯数据。 */
+/** ⚠️ 语义边界(复审 2026-07-30 F4):组视图给**每个注册键**都装访问器,不看平铺面是否真有值——
+ *  `"tidb" in config.store` 恒 true、`Object.keys(config.store).length` 恒为注册表长度。本仓的
+ *  presence-as-semantics 判定(`"k" in x` / Object.keys 计数)**只能打平铺面**,组视图仅供点号读值。 */
+function createGroupView(flat, keys) {
+    const view = {};
+    for (const key of keys) {
+        Object.defineProperty(view, key, { get: () => flat[key], enumerable: true, configurable: true });
+    }
+    return view;
+}
+/** 把九个组视图挂到平铺配置上(**就地**,返回的就是同一个对象——视图必须看着这一个存储处)。
+ *
+ *  组键是**不可枚举**的:`Object.keys(config)` / `JSON.stringify(config)` / `{...config}` 的平铺面因此
+ *  逐字节不变(既有消费点、既有 dump/审计面零影响),代价是 spread 克隆不带组视图——克隆后要用组形,
+ *  再过一次本函数(读一个缺席的组是当场 TypeError,不会静默给旧值)。
+ *
+ *  `loadConfig` 是主调用点;测试夹具(test/helpers/make-config.ts)构造 `ServiceConfigFlat` 后同样过它。 */
+export function attachConfigGroups(flat) {
+    const groups = {
+        store: createGroupView(flat, STORE_GROUP_KEYS),
+        modelPlane: createGroupView(flat, MODEL_PLANE_GROUP_KEYS),
+        approval: createGroupView(flat, APPROVAL_GROUP_KEYS),
+        memory: createGroupView(flat, MEMORY_GROUP_KEYS),
+        auth: createGroupView(flat, AUTH_GROUP_KEYS),
+        orchestration: createGroupView(flat, ORCHESTRATION_GROUP_KEYS),
+        limitsHttp: createGroupView(flat, LIMITS_HTTP_GROUP_KEYS),
+        observability: createGroupView(flat, OBSERVABILITY_GROUP_KEYS),
+        integrations: createGroupView(flat, INTEGRATIONS_GROUP_KEYS),
+    };
+    for (const [name, view] of Object.entries(groups)) {
+        Object.defineProperty(flat, name, { value: view, enumerable: false, writable: false, configurable: true });
+    }
+    return flat;
+}
+export function loadConfig() {
+    CONFIG_WARNINGS.length = 0; // repeated loadConfig() calls (test setup) must not accumulate stale warnings
+    CONFIG_NOTICES.length = 0;
+    CONFIG_KNOBS.clear(); // the polarity table describes THIS load, never a previous one's env
+    KNOB_DEPRECATIONS_SEEN.clear();
+    // Posture gate: single-user turnkey (`REQUIRE_PRINCIPAL !== "true"` = one trusted super-admin on their own
+    // box/tenant, CC's trust model) ⇒ the CC capability set defaults ON, each composed with its infra prereq; multi-tenant
+    // (requirePrincipal) stays opt-in (gated + secured). This is the SAME discriminator LSP's host-default-ON uses,
+    // generalized into one posture switch (the PM's "not per-flag" ask). In `postureOn`, an explicit `X_ENABLED=true/false`
+    // ALWAYS wins; else the default = single-user ∧ infra-ready. 🔒 Multi-tenant (prod) is UNAFFECTED (postureOn → false).
+    // Parsed ONCE here (design/158 B4) instead of re-comparing `process.env.REQUIRE_PRINCIPAL` at the four sites
+    // that needed it — two of which spelled it `!== "true"` and two `=== "true"`, i.e. the same knob read in both
+    // polarities within one function. `boolEnv(x, false)` is value-identical to the old `=== "true"`.
+    const requirePrincipal = boolEnv("REQUIRE_PRINCIPAL", false);
+    const singleUserTurnkey = !requirePrincipal;
+    // `postureOn` takes the NAME (not the pre-read value) so the knob can register itself in the polarity table —
+    // the posture family is precisely the one whose default is NOT readable from its name, so leaving it out of the
+    // self-report would omit the worst offenders. Its tri-state semantics are unchanged: an explicit literal wins,
+    // anything else (including a typo — deliberately NOT warned here, unlike boolEnv) falls to the posture default.
+    const postureOn = (name, infraReady = true) => {
+        const envVal = process.env[name];
+        const explicit = envVal === "true" ? true : envVal === "false" ? false : undefined;
+        const value = explicit ?? (singleUserTurnkey && infraReady);
+        registerKnob({ name, polarity: "posture", value, source: explicit === undefined ? "posture" : "env" });
+        return value;
+    };
+    // ── 九域解析(纯解析)。调用次序贴合改前的 env 读序,故 CONFIG_NOTICES 的产出顺序逐条不变。
+    const store = parseStoreDomain({ requirePrincipal });
+    const modelPlane = parseModelDomain();
+    const approval = parseApprovalDomain({ postureOn });
+    const memory = parseMemoryDomain({ requirePrincipal });
+    const auth = parseAuthDomain({ requirePrincipal });
+    const orchestration = parseOrchestrationDomain({ postureOn });
+    const limitsHttp = parseLimitsHttpDomain();
+    const observability = parseObservabilityDomain();
+    const integrations = parseIntegrationsDomain();
+    // ── 跨域耦合与跨域不变量:两条门(D-G 直连门、bake 门)的判据各自横跨 approval/auth/orchestration 三域,
+    //    任何单域都不足以裁定,故留在装配层(旧名保留,断言与消息逐字不变)。
+    const { directApprovalDoor, durableApproval: dgDurable, approvalHmacKeys: dgHmacKeys } = approval;
+    const { principalJwtPubkeys, principalJwtIss, principalJwtAud, operatorPrincipals: dgOperators, authTokens } = auth;
+    const { enabled: imageBakesEnabled, runnerPrincipal: bakeRunnerPrincipal } = orchestration.imageBakes;
+    // 🔴 the direct-door crypto gate lives ONLY in the durable (checkpointStore) /decide branch — so DURABLE_APPROVAL
+    // is a HARD precondition. Without it, checkpointStore is undefined, that branch is skipped, and the LEGACY
+    // approvalStore /decide (trusted-header, NO crypto) becomes the live path = a full bypass (adversarial CRITICAL).
+    const directDoorActive = directApprovalDoor && dgDurable && dgHmacKeys.length > 0 && principalJwtPubkeys.length > 0 && !!principalJwtIss && !!principalJwtAud;
+    // 🔴 boot invariant (D-G §3): a half-configured direct door is the WORST state (looks on, verifies nothing) — and
+    // an empty OPERATOR_PRINCIPALS makes isOperator() true-for-all (= cross-tenant escalation). Refuse to start.
+    if (directApprovalDoor) {
+        const missing = [];
+        if (!dgDurable)
+            missing.push("DURABLE_APPROVAL=true (the direct door's crypto gate only exists on the durable /decide path)");
+        if (dgHmacKeys.length === 0)
+            missing.push("APPROVAL_HMAC_KEYS");
+        if (principalJwtPubkeys.length === 0)
+            missing.push("PRINCIPAL_JWT_PUBKEYS");
+        if (!principalJwtIss)
+            missing.push("PRINCIPAL_JWT_ISS");
+        if (!principalJwtAud)
+            missing.push("PRINCIPAL_JWT_AUD");
+        if (dgOperators.length === 0)
+            missing.push("OPERATOR_PRINCIPALS (else isOperator is true-for-all)");
+        // 🔴 F-fix (dim-6): a direct door is inherently MULTI-TENANT (per-task verified JWT principal). Without
+        // REQUIRE_PRINCIPAL=true an absent/invalid principal falls through as ANONYMOUS and the owner/quota checks
+        // degrade to the spoofable header for null-owner rows — refuse a direct door that doesn't require a principal.
+        if (!requirePrincipal)
+            missing.push("REQUIRE_PRINCIPAL=true (a direct door is multi-tenant; without it an absent principal is anonymous and the spoofable header governs owner/quota checks)");
+        if (missing.length) {
+            throw new Error(`DIRECT_APPROVAL_DOOR=true but D-G anchors are missing: ${missing.join(", ")} — refusing to start a half-open direct door (design/80 D-G boot invariant)`);
+        }
+    }
+    // 🔴 boot invariant (IMAGE-API-DESIGN.md §P2.4a): the bake door is build-host-RCE-capable, and isOperator([],p)
+    // is true-for-all — so enabling bakes with an empty OPERATOR_PRINCIPALS = a WORLD-WRITABLE RCE door. Refuse to
+    // start (never a half-open bake door). The explicit-operator gate in server.ts is the runtime twin of this.
+    if (imageBakesEnabled && dgOperators.length === 0) {
+        throw new Error("IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host; an empty operator set makes isOperator() true-for-all (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)");
+    }
+    // 🔴 boot invariant (IMAGE-API-DESIGN.md §P2.12 / H1): the bake-runner identity is DERIVED from its bearer
+    // credential (token-derived `source`), never a self-asserted header — so a SERVICE_AUTH_TOKENS entry whose
+    // system == BAKE_RUNNER_PRINCIPAL MUST exist, else the runner can never satisfy isRunner and the entire
+    // claim/ingest/heartbeat pipeline is silently dead. Refuse to start a bake door with no runner credential.
+    if (imageBakesEnabled && !Object.values(authTokens).includes(bakeRunnerPrincipal)) {
+        throw new Error(`IMAGE_BAKES_ENABLED=true but no SERVICE_AUTH_TOKENS entry maps to the runner principal '${bakeRunnerPrincipal}' — the bake-runner authenticates by its credential (token-derived source), so a '<BAKE_RUNNER_TOKEN>=${bakeRunnerPrincipal}' SERVICE_AUTH_TOKENS entry is required or claim/ingest/heartbeat all 403 (IMAGE-API-DESIGN.md §P2.12 boot invariant)`);
+    }
+    // 平铺面**单点展开**九域产物(唯一存储处),再挂上九个组视图。组视图是对这同一个对象的取景器,
+    // 不是第二份拷贝 —— 故 `config.limitsHttp.port === config.port` 恒成立,含热应用之后(见
+    // attachConfigGroups / config-types.ts 分组段)。
+    return attachConfigGroups({
+        ...store,
+        ...modelPlane,
+        ...approval,
+        ...memory,
+        ...auth,
+        ...orchestration,
+        ...limitsHttp,
+        ...observability,
+        ...integrations,
+        directDoorActive, // 跨域合取(approval × auth × requirePrincipal),见上
+    });
+}
 /** 有效监听绑址([1934])。**显式 `BIND_HOST`/`HOST` 恒生效**(operator 保留在任何形下明示暴露的
  *  权利);未显式时:**无鉴权写面 ⇒ 127.0.0.1**,其余 ⇒ undefined(Node 默认全接口,既有部署零影响)。
  *