@sema-agent/server 2.0.0 → 2.0.1

package/dist/boot/config-center.js

@@ -0,0 +1,995 @@
+/**
+ * design/158 A10 尾刀:composition root 分段 —— **config-center 运行时**(boot 半场 + 60s refresh 循环 +
+ * 两者之间的 center 能力消费点)。
+ *
+ * 上一刀把 12 个 boot 段搬进 `src/boot/*.ts`(纯搬运),独独留下这两段并写明理由:它们共享一组
+ * **跨段可变状态**(`ccEtag / effective / latestEffective / lastRejectedCandidate / appliedPlaneEff /
+ * planeDeferredNoHandoff / bootSkillStale / pendingRestart / bootLkgCandidate / lastPrewarmBodiesVerified /
+ * lkgBooted / bootConfigPending / centerPrompts / pendingCatalogFaces / keyResolver / modelReadyState`),
+ * 而 codex R10–R38 的重启风暴判据密集地建立在这些状态的**读写次序**上(哪一行先落盘、哪一行先发信号、
+ * 哪个分支 splice 掉整组 reasons)。
+ *
+ * 本刀的做法:把这些 `let` 从 `main()` 的函数作用域搬进 **本工厂的闭包**——它们仍然是 `let`,**每一处
+ * 读写的字面文本、次序、分支结构一行未改**(把 `x` 改写成 `state.x` 会把 800 行里的每一处读写都变成一次
+ * 手工重写,那正是上一刀判定「不是搬运」的原因)。闭包 = 那个「持有状态的对象」;`main()` 只通过下面这
+ * 组窄口读它们,与本目录既有的晚绑 getter 惯例(`getRunStore()` / `getKeyResolver()` / `getRunDenySweep()`)
+ * 同款。
+ *
+ * ⚠️ **位置即契约**(调用点在 `main()` 里的相对次序不可动):
+ *  1. `createConfigCenterRuntime()` 必须在 logger/metrics 之后、`openStores()` 之前 —— boot 拉取要在
+ *     Runner/持久层建起来之前把 models/roles/teams 应用进 `config`(env 是兜底,center 覆盖其上)。
+ *  2. `applyLocalRemoteExec()` 紧随其后、在 `createExecutionEnv()` 之前 —— 它就地改写 `config.remoteExec`,
+ *     消费点(执行环境工厂)在下游。
+ *  3. `applyCenterCapabilities()` 必须在 `loadSkills()` 之后、`buildScenarios()` 之前,且 **boot LKG 落盘点
+ *     就在它里面**(F7/codex R26:先装载 skill 正文再落盘,否则「manifest 可见、正文没进缓存」的窗口会被
+ *     发布成 boot 可见 LKG);plugins 让位判据要求 plugins 消费在 center 直发 skills **之后**。
+ *  4. `applyCenterScenarios()` 必须在 `builtinScenarioDetails()` 捕获六内建名之后(探针要打纯内建工厂)。
+ *  5. `initKeyResolver()` 留在原位(Runner 构造之后、ServiceDeps 装配之前)—— 首建要读的是 boot apply
+ *     **之后**的 `config.modelApiKeyEnv/modelApiKeys`。
+ *  6. `startRefreshLoop()` 必须在 `new Runner()` 之后 —— 它要 `runnerTierFrozen`(与构造函数读的是同一
+ *     config 代际),且 boot-deferred 到货的续接就挂在这里。
+ */
+import { createHash } from "node:crypto";
+import { readFile as fsReadFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { loadRemoteExec } from "@sema-agent/registry-core/node";
+import { skillContentHash } from "@sema-agent/registry-core";
+import { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "@sema-agent/core";
+import { buildPricing } from "../budget.js";
+import { applyCenterPlugins } from "../capabilities/center-plugins.js";
+import { validatePromptsDomain, applyCatalogToSource, CORE_ENGINE_VERSION, withPromptArtifactBackfill } from "../capabilities/center-prompts.js";
+import { centerScenarios, centerScenarioDetails } from "../capabilities/scenarios.js";
+import { configLkgEnabled } from "../config.js";
+import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg } from "../config-lkg.js";
+import { createConfigProvider, raceBootFetch, BOOT_FETCH_DEFERRED } from "../config-provider.js";
+import { createKeyResolver } from "../key-resolver.js";
+import { ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
+import { applyEffective, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, restartReasons, modelPlaneChanged, planeHasActiveTiers, fetchPromptArtifact } from "../sema-registry.js";
+export async function createConfigCenterRuntime(ctx) {
+    const { config, logger, metrics, localRoot } = ctx;
+    // Sema registry (sema-registry): pull the effective config on boot and apply it OVER the env
+    // defaults — env is the fallback. Unset or unreachable → keep the env-derived config. Applied BEFORE
+    // the Runner is built so models/roles/teams take effect. (Logical config only; secrets stay in env.)
+    let ccEtag;
+    // Kept past the fetch so the deferred skills/mcp apply (which needs the live `skills` array + async
+    // content lazy-pull) can run right before buildScenarios, after applyEffective handled models/roles/teams.
+    // `effective` is the BOOT snapshot — the refresh loop never reassigns it, so restartReasons() compares each
+    // pull against what THIS process baked in (change-detection, not presence → no auto-restart loop).
+    let effective;
+    // 提示词装配协议 §9.5-2 three-store split: `effective` above = the boot snapshot (diff baseline);
+    // `latestEffective` = the last candidate that passed validation AND was applied — the explicit
+    // last-known-good (LKG). A refresh candidate failing validation is REJECTED whole (§9.5-5): never
+    // applied, so the live config keeps serving this LKG instead of a domain falling to schema-default/
+    // empty. The third store (promptCandidate — a staged prompts-domain artifact awaiting activation)
+    // lands with the prompts domain itself; `lastRejectedCandidate` is its observability forerunner and
+    // the prompts-domain validation (core S1 schema) hooks into the same gate.
+    let latestEffective;
+    let lastRejectedCandidate;
+    // codex R10 (models-tiers 窗收口): the last EffectiveConfig whose MODEL PLANE (models/roles/tiers/default) was
+    // actually applied to the live config — undefined = env plane (no center plane applied yet). When the Runner is
+    // tier-frozen, a refresh whose plane differs from THIS is deferred to restart (applyEffective deferModelPlane),
+    // keeping admission and the Runner on one catalog generation through the restart window.
+    let appliedPlaneEff;
+    // codex R18: the persistent "deferred WITHOUT next-boot handoff" state — the one-shot warn is not enough
+    // (the etag advances → later ticks 304 and never re-enter the defer branch). Set when a plane defers with no
+    // restart-surviving LKG; cleared when a plane finally applies or a forced restart reason ships. Surfaced on
+    // /health (modelPlaneDeferred) + re-warned every refresh tick (incl. 304s).
+    let planeDeferredNoHandoff;
+    // codex R35: STICKY live-skill application debt — the boot-baked skill table never rebuilds inside this
+    // process, so once the live application is known incomplete the debt survives every refresh (a
+    // same-generation 200 recomputes reasons vs boot as [] and would otherwise silently clear the signal).
+    // Set at the boot writer (R34 arms); folded into every tick's reasons; only a restart resolves it.
+    let bootSkillStale = false;
+    // Sema-registry restart signal: set by the refresh loop when a pull's restart-to-apply slices
+    // (skills/mcp/scenarios/runtime-gates) differ from boot; read by GET /health for orchestrator auto-restart.
+    let pendingRestart;
+    // DUAL-MODE-DESIGN §4: the config SOURCE is a backend-selectable seam — remote (sema-registry HTTP, the fleet
+    // default) | local (.env + config.d via @sema-agent/registry-core FileConfigStore, the single-machine/TOC source).
+    // The provider exists when SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL) is set OR CONFIG_PROVIDER=local is explicit; neither = pure-env
+    // (byte-identical to before). The remote provider DELEGATES verbatim to fetchEffective, so the fleet path is
+    // unchanged; applyEffective consumes either source's EffectiveConfig identically (one resolver → no drift).
+    const cc = config.configCenter;
+    // Sealed-box key custody: ensure this host's X25519 keypair(s) under
+    // <localDataRoot>/sealed-key/ (dir 0700, files 0600; SEVERAL may coexist — rotation keeps old private
+    // keys decrypting old ciphertexts) BEFORE the first effective pull, so a roster carrying
+    // `sealedApiKey` unseals on the boot apply. The public-key report is best-effort fire-and-forget:
+    // the center's execution-keys face is admin-gated and a worker only holds the pull token, so without
+    // an operator-provided SEMA_REGISTRY_ADMIN_TOKEN it prints the full public key for manual
+    // registration instead (honest posture — see reportExecutionPublicKey). Store failure is non-fatal:
+    // sealed models then warn per-model in applyEffective (fail-loud, never a silent apiKeyEnv fallback).
+    let sealedKeys;
+    try {
+        sealedKeys = await ensureSealedKeyStore(join(config.localDataRoot ?? localRoot, "sealed-key"), logger);
+        void reportExecutionPublicKey({
+            baseUrl: cc?.baseUrl,
+            adminToken: process.env.SEMA_REGISTRY_ADMIN_TOKEN || process.env.REGISTRY_ADMIN_TOKEN,
+            key: sealedKeys.latest,
+            ...(cc?.worker ? { notes: `worker ${cc.worker}` } : {}),
+            logger,
+        });
+    }
+    catch (err) {
+        logger.warn("sealed_key_store_unavailable", { err: String(err), note: "sealed api keys cannot be unsealed on this host — models carrying sealedApiKey will fail loud per-model" });
+    }
+    const configProvider = cc || config.configProvider === "local"
+        ? createConfigProvider({
+            ...(config.configProvider ? { provider: config.configProvider } : {}),
+            ...(cc ? { configCenter: { baseUrl: cc.baseUrl, token: cc.token, worker: cc.worker, dryRun: cc.dryRun } } : {}),
+            ...(config.configProvider === "local" ? { localDir: localRoot } : {}),
+        })
+        : undefined;
+    // boot ready 门 latch:仅「远程 registry 部署(非 dryRun)+ 无显式 env MODEL_ID」时等 roster——
+    // 首次 effective 落 ≥1 enabled 模型即翻 true(one-way)。其余姿势(env 模型在/local provider/dryRun/纯 env)
+    // 恒 ready=现有部署零影响。E3 废除 workers.model 后,fleet worker 的占位模型窗口由此门 fail-closed。
+    const modelReadyState = { ready: !(cc && !cc.dryRun) || Boolean(process.env.MODEL_ID) };
+    const markRosterLanded = (eff) => {
+        if (!modelReadyState.ready && (eff.models?.models ?? []).some((m) => m.enabled !== false)) {
+            modelReadyState.ready = true;
+            logger.info("model_roster_landed", { note: "ready gate open — billable submissions accepted" });
+        }
+    };
+    // center prompts ref([1057]/[1062] 投影腿):**热采用,新任务边界生效**——core 1.316([1068] 裁 a/
+    // [1070]d)把 provider 声明纳入 epoch artifactDigest:声明变=digest 变=下任务边界自动重 pin,进行中
+    // 会话由 session epoch pin 保稳,resume 记账诚实(1.222 的 restart-to-apply 是 core 件落地前的正确
+    // 过渡姿势,[1068]① 官方确认后随 1.316 采用降级为热生效——与 center「发布=新任务生效」产品语义对齐)。
+    // 判形通过才采用(形校验=防 core-assemble-THROW 底线,非语义复检 [1057]①f);坏形=warn+沿用旧包。
+    let centerPrompts;
+    /** codex-3 F1:一次失败的 catalog 过渡的目标面(undefined 目标=欠 disable)。etag 已推进时 provider
+     *  304 短路 adopt——本 marker 让每个 refresh 拍(含 304 拍)独立重试,直到过渡落地。 */
+    let pendingCatalogFaces;
+    const retryPendingCatalog = async (phase) => {
+        if (!pendingCatalogFaces)
+            return;
+        const { target } = pendingCatalogFaces;
+        if (await applyCatalogToSource(promptSource, target, centerPrompts, logger, phase)) {
+            centerPrompts = target;
+            pendingCatalogFaces = undefined;
+        }
+    };
+    // e/b(catalog 轴消费面,[1236]① seam):core 的 CenterPromptSource——server 只给根路径,core 文件形
+    // 自管 `<root>/prompt-epoch/{artifacts,source-state.json}`;boot restore=磁盘 LKG(离线重启 candidate
+    // 存续/disabled 不复活,状态机全在 core)。RunnerDeps.promptSource 挂它;adopt 时经 applyCatalogToSource
+    // 推进两态过渡。restore 失败=warn(candidate 缺席,catalog 轴等下一次 adopt;declaration 轴/内置照跑)。
+    const promptEpochDir = join(config.localDataRoot ?? localRoot, "prompt-epoch");
+    // codex-3 F2:effective 拉取是 worker 轴的(config LKG 同理 worker-keyed)——同根多 worker 进程共享
+    // content-addressed artifacts/(by-digest,天然安全),但 **candidate 状态必须按 worker 分箱**:共写一份
+    // source-state.json 会让 A 的撤下压掉 B 的 candidate、restart 恢复到别人 worker 的 catalog(错 worker
+    // 的系统提示词跑任务)。encodeURIComponent 消毒(worker 名进路径)。
+    // codex-5:无撞形分箱——缺席=字面 "global",配置了 worker= "worker-<sha256 前 16>"(哈希后天然单
+    // 段/无 dot-segment/与 "global" 不可能同名;worker 名任意字节也安全)。
+    const promptStateDir = join(promptEpochDir, "state", cc?.worker === undefined ? "global" : `worker-${createHash("sha256").update(cc.worker).digest("hex").slice(0, 16)}`);
+    // codex-6 F1:File 店构造同步 mkdir——只读/不可写数据根会把「可选的 catalog 特性」变成整服务 boot
+    // 失败。守护工厂:文件形失败 ⇒ warn + Memory 店兜底(candidate 不跨重启持久,catalog 采用仍工作;
+    // 内置/declaration 轴完全不受影响)。
+    // [985]b / [1285] — §9.4 by-digest 补拉组合店:local miss(本副本从未采用过该 candidate / 盘失)⇒
+    // 从 center 按 digest 补拉 envelope ⇒ core verifyPromptArtifact 全管线(canonical 复算;**且回验
+    // 「拿到的=要的」digest 逐位**,center 答非所问=丢弃)⇒ best-effort 回写盘(下次直命中)。pinned
+    // resume 的 fail-loud miss 自此只剩「center 也没有」的真缺席。仅 remote 治理形(cc.baseUrl)挂补拉。
+    const withByDigestBackfill = (inner) => cc?.baseUrl ? withPromptArtifactBackfill(inner, (d) => fetchPromptArtifact(cc.baseUrl, cc.token, d), logger) : inner;
+    const promptSource = (() => {
+        try {
+            return new CenterPromptSource({
+                store: withByDigestBackfill(new FilePromptArtifactStore(promptEpochDir)),
+                stateStore: new FilePromptSourceStateStore(promptStateDir),
+                engineVersion: CORE_ENGINE_VERSION,
+            });
+        }
+        catch (e) {
+            logger.warn("center_prompts_store_unwritable", { dir: promptEpochDir, err: String(e), note: "file-backed prompt-epoch store unavailable — memory fallback (catalog candidate not restart-durable); built-ins/declaration axis unaffected" });
+            return new CenterPromptSource({ store: withByDigestBackfill(new MemoryPromptArtifactStore()), stateStore: new MemoryPromptSourceStateStore(), engineVersion: CORE_ENGINE_VERSION });
+        }
+    })();
+    // codex-2 F4:只有「有配置源在治理且非 dry-run」才 restore 磁盘 candidate——provider-off/dry-run 姿势下
+    // 旧部署遗留的 active candidate 不得继续影响新任务(publish-gate-off/compare-only 语义)。不 restore 只
+    // 影响 candidate 面;pinned resume 的 by-digest 解析走 FilePromptArtifactStore.get(不依赖 restore),
+    // 旧会话恢复不受损。
+    if (configProvider && !cc?.dryRun) {
+        try {
+            await promptSource.restore();
+        }
+        catch (e) {
+            logger.warn("center_prompts_catalog_restore_failed", { err: String(e), note: "disk LKG unavailable — catalog candidate absent until the next adopt; declaration axis and built-ins unaffected" });
+        }
+    }
+    const adoptCenterPrompts = async (eff, phase) => {
+        const raw = eff?.prompts;
+        if (raw === undefined) {
+            // fail-closed 语义([1057]①d):publish 闸关=key 整体不出现 ⇒ 收敛回内置提示词(不是「保持旧包」——
+            // 闸关是显式撤下,沿用旧包会让「关闸」失效)。
+            if (centerPrompts)
+                logger.info("center_prompts_cleared", { phase, note: "effective carries no prompts key (publish gate off) — built-in providers resume" });
+            const cleared = await applyCatalogToSource(promptSource, undefined, centerPrompts, logger, phase);
+            if (cleared) {
+                centerPrompts = undefined;
+                pendingCatalogFaces = undefined;
+            }
+            else {
+                pendingCatalogFaces = { target: undefined }; // failed disable — retried by the refresh hook (codex-3 F1)
+            }
+            return;
+        }
+        const v = validatePromptsDomain(raw);
+        if (!v.ok) {
+            logger.warn("center_prompts_invalid", { phase, error: v.error, kept: centerPrompts?.declarations?.packId ?? (centerPrompts?.catalog ? "(catalog)" : "(builtin)"), note: "malformed prompts face rejected (core assemble would THROW per task) — keeping the previous pack/built-ins; fix the center payload" });
+            return;
+        }
+        if (centerPrompts?.identity !== v.value.identity) {
+            // [985]a §3:axes 观测两轴共存窗;declaration 轴字段照旧,catalog 轴报 artifactDigest(内容身份)。
+            logger.info("center_prompts_adopted", {
+                phase,
+                axes: v.value.axes,
+                ...(v.value.declarations
+                    ? { packId: v.value.declarations.packId, contentDigest: v.value.declarations.contentDigest, sections: v.value.declarations.sections.length, scenarioOverrides: Object.keys(v.value.declarations.scenarioOverrides ?? {}).length }
+                    : {}),
+                ...(v.value.catalog ? { artifactDigest: v.value.catalog.artifact.artifactDigest, catalogDigest: v.value.catalog.artifact.payload.catalogDigest, sourceRevision: v.value.catalog.sourceRevision } : {}),
+                note: "new tasks assemble the new pack (epoch re-pins at the next task boundary); in-flight sessions stay pinned",
+            });
+        }
+        const transitioned = await applyCatalogToSource(promptSource, v.value, centerPrompts, logger, phase);
+        // codex-2 F2 + codex-3 F1:catalog 过渡失败 ⇒ 身份不推进(centerPrompts 保持 prev),且目标面记入
+        // pendingCatalogFaces——etag 会照常推进(其他域的采用不为 prompts 的盘错扣住),此后 provider 304
+        // 不再进本函数,重试由 refresh 拍上的 retryPendingCatalog 钩独立驱动(见 refresh 循环)。
+        if (transitioned) {
+            centerPrompts = v.value;
+            pendingCatalogFaces = undefined;
+        }
+        else {
+            pendingCatalogFaces = { target: v.value };
+        }
+    };
+    // Boot-deferred pull (clay 2026-07-17): when the boot fetch outlives its budget, the SAME promise is
+    // stashed here and, once the refresh tick exists (defined further down), chained to trigger an immediate
+    // hot-apply on arrival — the server meanwhile starts on the env fallback in <1s instead of hanging up to
+    // ~8s on a black-holed center (真机实测 5.7s = the "local server takes 5s" report).
+    let bootConfigPending;
+    // LKG 落盘(clay 拍 2026-07-18;config-lkg.ts 顶注=全案由):remote lane 的干净候选持久化——boot 的
+    // 第三级来源(中心 > 盘上 LKG > env)。`lkgBooted` 标志决定 deferred continuation 的形:LKG 起服=有
+    // 完整 boot 基线 → 到货走普通 refreshTick(候选门+hot+restartReasons 对 LKG 比较,通常零差异=无环);
+    // 无 LKG=env 起服 → 到货走「迟到 boot」路径(deferredBootApply)。
+    const lkgEnabled = configProvider?.kind === "remote" && configLkgEnabled();
+    const lkgPath = process.env.CONFIG_LKG_PATH ?? defaultLkgPath(cc?.worker);
+    // codex R17/R20: a successful LOCAL write proves nothing about the NEXT instance seeing it — a stateless pod
+    // replaces its filesystem on restart, so treating a pod-local rename as "handoff confirmed" re-opens the R16
+    // rolling-restart storm. Next-instance visibility is a DEPLOYMENT contract only the operator can assert, and
+    // ONLY via the explicit knob: CONFIG_LKG_DURABLE=true declares the LKG path rides restart-surviving storage
+    // (host disk / PVC / shared volume). CONFIG_LKG_PATH is strictly a LOCATION override (R20: it can point at an
+    // ephemeral container path — a location says nothing about durability). Unset ⇒ the models-tiers restart
+    // reason stays suppressed on a deferred plane (old generation keeps serving; /health modelPlaneDeferred +
+    // per-tick warn carry the state) while normal LKG writes continue (they still help same-instance restarts).
+    const lkgSurvivesRestart = lkgEnabled && process.env.CONFIG_LKG_DURABLE === "true";
+    let lkgBooted = false;
+    let bootLkgCandidate; // F7:skills 装载后才落盘
+    // F1+F2(LKG 复审):awaited 落盘 + skill 正文预热——refresh 只落 manifest 的话,重启后 LKG-boot 在
+    // 中心不可达时新 skill 正文缓存缺失=软跳过(静默缺 skill)。预热=枚举 enabled manifest,把缺盘的正文
+    // 拉齐进 content-addressed 缓存(失败=warn 软降级,与 boot 的 skill_failed 同语义等级——skill 拉取
+    // 失败从不升级为配置拒绝);await 保证 restart 信号可见前 LKG+正文已落盘。
+    /** Returns TRUE iff the candidate is durably persisted for the NEXT boot (codex R16: the FORCED models-tiers
+     *  restart reason must never fire without a confirmed handoff — LKG disabled/unwritable + over-budget boot
+     *  pulls would otherwise turn the deferral into a rolling-restart storm: every restarted process boots the env
+     *  plane again, defers again, re-signals). Change-DETECTED reasons still ride regardless (their loop is the
+     *  pre-existing, documented no-LKG residual). */
+    // codex R37 loop-breaker proof: TRUE iff the LAST persistLkgDurable call hash-verified EVERY enabled skill
+    // body on disk. This is the "a restart can actually repair the live skill table" proof the NON-durable lane
+    // requires before publishing a skills restart — a successful manifest pull only proves the CONFIG endpoint
+    // works, not the SEPARATE body fetches; signaling on manifest-success alone lets a persistent body failure
+    // (404 / hash mismatch / timeout) restart-storm a stateless deployment (every replacement process fails the
+    // same body, signals again, is restarted again). With the proof, a storm cannot form: a boot that fails the
+    // body lacks the proof and only retains visible debt (no signal) until a later verify succeeds.
+    let lastPrewarmBodiesVerified = false;
+    const persistLkgDurable = async (effectiveObj, etag) => {
+        lastPrewarmBodiesVerified = false;
+        // codex R21: the LOCAL provider's candidate IS the next-boot source (config.d on the same disk boot reads
+        // BEFORE Runner construction) — the handoff is inherent, no LKG needed. Without this arm a polled config.d
+        // edit that defers the plane (tier activation / tier-frozen change) could never authorize its own restart
+        // (lkgEnabled is remote-only, so even CONFIG_LKG_DURABLE couldn't help) — stuck in modelPlaneDeferred forever.
+        // codex R28 requalified: this TRUE covers the MODEL PLANE (what the deferral gate adjudicates). Skills are
+        // NOT part of the local handoff because the local lane does not consume a center-style skills domain AT ALL
+        // yet — the only boot consumer (applyCenterSkills) requires config.configCenter (remote HTTP), absent on
+        // CONFIG_PROVIDER=local; bodies live inline in config.d (LocalConfigProvider.fetchSkillContent) but no boot
+        // path reads them. Pre-existing local-lane gap (predates this train, nothing lost across restart that was
+        // ever applied); wiring boot skills through the ConfigProvider seam is the tracked follow-up (board).
+        if (configProvider?.kind === "local")
+            return true;
+        if (!lkgEnabled)
+            return false;
+        try {
+            if (effectiveObj.skills && config.configCenter) {
+                await applyCenterSkills([], effectiveObj.skills, config.configCenter.baseUrl, config.configCenter.token, logger, undefined, defaultSkillCacheDir());
+            }
+            // codex R25/R26: skill BODIES are part of the handoff contract, and completeness gates PUBLICATION —
+            // applyCenterSkills swallows fetch/cache-write failures, so awaiting it proves nothing; verify every
+            // ENABLED manifest hash on disk (content-true) BEFORE the atomic LKG replace (R26: verifying after left
+            // an incomplete candidate as the boot-visible LKG — any crash/manual restart with the center down then
+            // boots that manifest, silently skips the uncached skills, and never re-signals because the manifest is
+            // the new boot baseline). On any miss/corruption the PREVIOUS good LKG stays in place; the per-tick
+            // retained-candidate retry re-attempts prewarm + verify + publish.
+            // Residual seam (honest, partial): the skill cache roots at SEMA_CONFIG_DIR while lkgPath can point
+            // elsewhere — CONFIG_LKG_DURABLE's contract requires BOTH on restart-surviving storage.
+            const enabledSkills = (effectiveObj.skills?.skills ?? []).filter((m) => m.enabled !== false);
+            const cacheDir = defaultSkillCacheDir();
+            for (const m of enabledSkills) {
+                const hex = m.contentHash.replace(/^sha256:/, "").toLowerCase();
+                if (!/^[0-9a-f]{64}$/.test(hex))
+                    return false;
+                try {
+                    const text = await fsReadFile(join(cacheDir, hex), "utf8");
+                    if (`sha256:${createHash("sha256").update(text, "utf8").digest("hex")}` !== `sha256:${hex}`) {
+                        logger.warn("config_lkg_skill_cache_incomplete", { skill: m.name, hash: m.contentHash, note: "cached body fails its hash — LKG NOT replaced, handoff NOT confirmed (the previous good LKG keeps serving offline boots)" });
+                        return false;
+                    }
+                }
+                catch {
+                    logger.warn("config_lkg_skill_cache_incomplete", { skill: m.name, hash: m.contentHash, note: "enabled skill body not in the cache — LKG NOT replaced, handoff NOT confirmed" });
+                    return false;
+                }
+            }
+            lastPrewarmBodiesVerified = true; // every enabled body verified on disk — the repair proof stands even if the LKG write below fails
+            await saveLkg(lkgPath, cc?.worker, effectiveObj, etag);
+            // codex R17: TRUE = next-BOOT visibility, not merely a successful local rename — gated on the operator's
+            // restart-surviving-storage declaration (lkgSurvivesRestart above). A stateless pod's local write still
+            // helps same-instance restarts but must not authorize a forced restart.
+            return lkgSurvivesRestart;
+        }
+        catch (err) {
+            logger.warn("config_lkg_save_failed", { path: lkgPath, err: String(err), note: "durable persist failed — restart signal proceeds anyway (a dead disk + dead center double-fault can re-loop; fix the disk)" });
+            return false;
+        }
+    };
+    if (configProvider) {
+        const dryRun = cc?.dryRun ?? false; // dry-run posture is remote-only (a local source has nothing to compare against)
+        // LKG 读腿(boot 超窗与硬失败两个入口共用):盘上有验证过的干净候选 → 当 boot 配置整套应用
+        // (skills/mcp 进 buildScenarios——这正是 env 兜底给不了的),etag 落位 → refresh 首拍 304 或正常增量。
+        const bootFromLkg = async (why) => {
+            if (!lkgEnabled || dryRun)
+                return null;
+            const read = await loadLkg(lkgPath, cc?.worker);
+            if (!read.lkg) {
+                if (read.reason !== "absent")
+                    logger.warn("config_lkg_unusable", { path: lkgPath, reason: read.reason, note: "ignoring the on-disk LKG — env fallback serves; the cache rewrites on the next clean candidate" });
+                return null;
+            }
+            logger.info("config_loaded_lkg", { path: lkgPath, savedAt: read.lkg.savedAt, why, note: "booting from the persisted last-known-good (all restart-to-apply faces included) — the live pull continues in the background and reconciles on arrival" });
+            return { effective: read.lkg.effective, ...(read.lkg.etag !== undefined ? { etag: read.lkg.etag } : {}) };
+        };
+        const bootApplyLkgInline = async (lkgR) => {
+            applyEffective(config, lkgR.effective, logger, { sealedKeys });
+            await adoptCenterPrompts(lkgR.effective, "boot-lkg");
+            markRosterLanded(lkgR.effective);
+            effective = lkgR.effective;
+            appliedPlaneEff = lkgR.effective; // model plane applied pre-Runner — this IS the Runner's generation
+            latestEffective = lkgR.effective;
+            if (lkgR.etag !== undefined)
+                ccEtag = lkgR.etag;
+            const cfgModels = (lkgR.effective.models?.models ?? []).filter((m) => m.enabled !== false).length;
+            logger.info("config_loaded", { source: "lkg", version: lkgR.effective.version, worker: cc?.worker ?? "(global)", models: cfgModels });
+        };
+        try {
+            const bootFetch = configProvider.fetchEffective(undefined);
+            const raced = await raceBootFetch(bootFetch, config.configBootFetchBudgetMs);
+            let lkgFallback = null;
+            if (raced === BOOT_FETCH_DEFERRED) {
+                bootConfigPending = bootFetch;
+                bootFetch.catch(() => { }); // settled in the background — failure handling lives on the refresh cadence
+                lkgFallback = await bootFromLkg("boot fetch deferred (budget exceeded)");
+                lkgBooted = lkgFallback !== null;
+                logger.warn("config_boot_fetch_deferred", {
+                    source: configProvider.kind,
+                    budgetMs: config.configBootFetchBudgetMs,
+                    lkg: lkgBooted,
+                    note: lkgBooted
+                        ? "center slow — booting from the persisted LKG; the pull continues in the background and reconciles via the refresh path on arrival"
+                        : "center slow/unreachable and no usable LKG — serving on the env fallback; the pull continues in the background (late-boot adoption on arrival). Raise CONFIG_BOOT_FETCH_BUDGET_MS to block boot instead.",
+                });
+            }
+            // F4(LKG 复审):LKG 载荷的 apply 用专属 catch——走主分支会让 applyEffective 半程炸落到外层
+            // catch 的「config_source_unreachable_using_env」误导日志(中心明明只是慢)。坏 LKG=点名+env 兜底
+            // (in-place mutate 的混态风险与 live 坏载荷同级,浅域判形在 loadLkg 已挡结构性坏形)。
+            if (raced === BOOT_FETCH_DEFERRED && lkgFallback) {
+                try {
+                    await bootApplyLkgInline(lkgFallback);
+                }
+                catch (applyErr) {
+                    lkgBooted = false;
+                    logger.warn("config_lkg_apply_failed", { err: String(applyErr), note: "persisted LKG failed to apply — env fallback serves; the cache rewrites on the next clean candidate" });
+                }
+            }
+            const r = raced === BOOT_FETCH_DEFERRED ? null : raced;
+            if (r) {
+                // [898] tolerant read(registry-core 0.10.12,local lane):catalog 域坏文件不再连坐整包回落 env——
+                // 坏域按 default 落+per-domain warn 点名(文件路径在 error 文案里),好域照常生效。gate 域坏文件
+                // tolerant 仍 throw(READ 容错不放宽 gate fail-loud)⇒ 走下面既有整包 catch。
+                // §9.5-5 boot 与 refresh 的分工(codex F1:重启不得洗白坏候选):boot 照旧 tolerant APPLY(无 LKG
+                // 可保,带着好域起服务),但一个带错误的候选 ①不推进 ccEtag——refresh 首 poll 拿到同一棵树,候选门
+                // 当场整拒并持续 warn 到修复;②不写入 latestEffective——LKG 永远只指向完全干净的候选,拒绝日志的
+                // lkgVersion 也诚实(boot 带错=「(env)」)。markRosterLanded 保留:models 域自身干净才可能开门
+                // (坏 models 域 tolerant 落空=enabled 0=门不动),其他域的错误不构成扣住就绪门的理由。
+                const bootPromptsRaw = r.effective.prompts;
+                const bootPromptsOk = bootPromptsRaw === undefined || validatePromptsDomain(bootPromptsRaw).ok;
+                // 坏 prompts 面同 domainErrors 计入 not-clean(F6 boot 半场):etag 不进 → refresh 首拍同树整拒持续
+                // warn;LKG 不指向带坏 prompts 的候选。adoptCenterPrompts 自身会拒采用+点名。
+                const bootClean = (r.domainErrors ?? []).length === 0 && bootPromptsOk;
+                if (bootClean)
+                    ccEtag = r.etag;
+                for (const de of r.domainErrors ?? [])
+                    logger.warn("config_domain_invalid", { domain: de.domain, error: de.error, note: "tolerated at BOOT (corrupt file → schema defaults; dangling ref → reported as-is); the refresh path rejects such a candidate whole and keeps the LKG (§9.5-5)" });
+                if (dryRun) {
+                    logEffectiveDiff(config, r.effective, logger); // compare-only: log the would-be changes, keep env
+                }
+                else {
+                    applyEffective(config, r.effective, logger, { sealedKeys }); // sealedKeys: unseal sealedApiKey → in-memory key pipeline
+                    await adoptCenterPrompts(r.effective, "boot"); // [1057] additive prompts key(判形采用;缺席=内置)
+                    markRosterLanded(r.effective); // boot pull 即落 roster 的常态:门在启动窗内就打开
+                    effective = r.effective; // skills/mcp applied below, before buildScenarios (restart-to-apply)
+                    appliedPlaneEff = r.effective; // model plane applied pre-Runner — this IS the Runner's generation
+                    if (bootClean)
+                        latestEffective = r.effective; // LKG seed (§9.5-2): only a fully clean candidate may become the LKG
+                    // F7(LKG 复审三轮):boot 写点**延后**到 center skills 装载(applyCenterSkills+盘缓存)之后——
+                    // 先落 LKG 会让「新 skill 的 manifest 可见但正文没进缓存」窗口存在(此窗内崩+中心断=离线 boot
+                    // 静默缺 skill)。这里只记 candidate,真正落盘在 skills 装载后(main 后段)。
+                    if (bootClean && !lkgBooted)
+                        bootLkgCandidate = { effective: r.effective, etag: r.etag };
+                    // [875]b:带上模型数与(local lane)真实目录来源——复验实录:CONFIG_LOCAL_DIR 误配(只设
+                    // LOCAL_DATA_ROOT)时 config.d 静默读不到、0 模型且无告警,排障只能靠猜。
+                    const cfgModels = (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length;
+                    const cfgDir = configProvider.kind === "local" ? { dir: configProvider.root } : {};
+                    logger.info("config_loaded", { source: configProvider.kind, version: r.effective.version, worker: cc?.worker ?? "(global)", models: cfgModels, ...cfgDir });
+                    if (configProvider.kind === "local" && cfgModels === 0)
+                        logger.warn("config_local_no_models", { ...cfgDir, hint: "config.d/models.json 空或 CONFIG_LOCAL_DIR 指错目录(选目录旋钮是 CONFIG_LOCAL_DIR,不是 LOCAL_DATA_ROOT)— 模型继续走 env 兜底" });
+                }
+            }
+        }
+        catch (err) {
+            logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
+            // 硬失败(fast-fail RST 等,非超窗)同样值得 LKG:上一进程的干净候选好过纯 env。
+            const lkgFallback = await bootFromLkg(`boot fetch failed: ${String(err).slice(0, 120)}`);
+            if (lkgFallback) {
+                lkgBooted = true;
+                try {
+                    await bootApplyLkgInline(lkgFallback);
+                }
+                catch (applyErr) {
+                    lkgBooted = false;
+                    logger.warn("config_lkg_apply_failed", { err: String(applyErr), note: "persisted LKG failed to apply — env fallback serves" });
+                }
+            }
+        }
+    }
+    if (!modelReadyState.ready)
+        logger.warn("model_roster_pending", { note: "registry deployment without an env model and no roster yet — billable submissions 503 until the first effective pull lands models" });
+    // Per-model API key (sema-registry `apiKeyEnv`): resolve each model's own upstream key per brain call /
+    // cascade rung. undefined when no per-model keys are configured → spec field stays unset (core default).
+    // `let` (not const): rebuilt on a sema-registry refresh so per-model key ADDITIONS hot-apply too (the
+    // resolver is undefined when no per-model keys exist, so in-place mutation alone wouldn't cover empty→non-empty).
+    let keyResolver;
+    return {
+        providerKind: configProvider?.kind,
+        promptSource,
+        getKeyResolver: () => keyResolver,
+        getCenterPrompts: () => centerPrompts,
+        modelReady: () => modelReadyState.ready,
+        restartState: () => pendingRestart,
+        planeDeferredState: () => planeDeferredNoHandoff,
+        async applyLocalRemoteExec() {
+            // DUAL-MODE §4/§5 (center #1): in LOCAL config mode, source remoteExec from the SHARED
+            // `config.d/remote-exec.json` via the registry `loadRemoteExec` — the SAME file + zod validation that the
+            // client's `agent-cli config` writes, so client doctor and the engine read one source of truth (zero drift).
+            // Semantics (center, deliberate): file MISSING → undefined → keep the env/host default (config.ts already
+            // defaults host in local mode); file PRESENT → it wins; file empty/corrupt → the loader throws → fail-closed
+            // (an empty file silently falling back to host would be an isolation downgrade if the user meant local-docker).
+            if (configProvider?.kind === "local") {
+                try {
+                    const fileRx = await loadRemoteExec(localRoot); // SAME root as the config provider above (no split-brain)
+                    if (fileRx) {
+                        // 🔴 center contract: the package RemoteExecSpec is the CONTRACT form (env-NAME refs: apiKeyEnv/tokenEnv/…);
+                        // our config.remoteExec is the RESOLVED form (values). `host` carries NO secrets so it maps 1:1 (contract
+                        // `workdir` ≡ our `workspaceBase`). The ISOLATED lanes (e2b/k8s/ssh/adb) need a NAME→value resolution
+                        // before use — a follow-on; until then they are sourced from REMOTE_EXEC env, so a file-source isolated
+                        // arm is ignored (NOT cast verbatim — that would feed an env-NAME where a value is expected).
+                        if (fileRx.provider === "host") {
+                            config.remoteExec = {
+                                provider: "host",
+                                ...(fileRx.workdir ? { workspaceBase: fileRx.workdir } : {}),
+                                ...(fileRx.commandTimeoutMs != null ? { commandTimeoutMs: fileRx.commandTimeoutMs } : {}),
+                            };
+                            logger.info("remote_exec_from_file", { provider: "host", root: localRoot });
+                        }
+                        else if (fileRx.provider === "local-docker") {
+                            // local-docker carries NO secret env-NAMEs (image/memory/cpus/network/workdir/mountPath only), so it
+                            // maps 1:1 from the contract form — no NAME→value resolution needed (unlike e2b/k8s/ssh). The contract
+                            // `workdir` is the in-container workspace ROOT ≡ our `mountPath`. DOCKER_HOST/secret env stay in the
+                            // worker's .env (the adapter reads its own process.env via the env-forward, not the file).
+                            config.remoteExec = {
+                                provider: "local-docker",
+                                image: fileRx.image,
+                                ...(fileRx.mountPath ? { mountPath: fileRx.mountPath } : fileRx.workdir ? { mountPath: fileRx.workdir } : {}),
+                                ...(fileRx.memory ? { memory: fileRx.memory } : {}),
+                                ...(fileRx.cpus != null ? { cpus: fileRx.cpus } : {}),
+                                ...(fileRx.network ? { network: fileRx.network } : {}),
+                            };
+                            logger.info("remote_exec_from_file", { provider: "local-docker", root: localRoot, image: fileRx.image });
+                        }
+                        else {
+                            logger.warn("remote_exec_file_isolated_lane_unwired", { provider: fileRx.provider, note: "e2b/k8s/ssh/adb are sourced from REMOTE_EXEC env until file-source NAME→value resolution lands (center field map)" });
+                        }
+                    }
+                }
+                catch (err) {
+                    logger.error("remote_exec_file_invalid", { root: localRoot, err: String(err) });
+                    throw err; // fail-closed (center semantics): a corrupt remote-exec.json must not boot a wrong/weaker lane
+                }
+            }
+        },
+        async applyCenterCapabilities(skills) {
+            // Sema-registry B1 (restart-to-apply, baked into scenarios below): overlay center skills (lazy-fetched by
+            // hash + sha256-verified) over the image baseline, center-wins-by-name; resolve center MCP servers' env-NAME
+            // refs to real values from this service's env. Both empty/unset → unchanged (image SKILLS_DIR, no MCP).
+            if (effective?.skills && config.configCenter) {
+                skills = await applyCenterSkills(skills, effective.skills, config.configCenter.baseUrl, config.configCenter.token, logger, undefined, configLkgEnabled() ? defaultSkillCacheDir() : undefined);
+            }
+            // plugins 域消费半场(契约 [1361]②/[1362]/[1366]①;2026-07-28 开工车):把 center 声明的插件引用
+            // 物化(https-only+ALLOW_HOSTS 纵深复验/sha 钉扎/隔离 clone/LKG)并装载其 skills —— **在 center 直发
+            // skills 之后**:撞名让位判据(收紧④,plugin 让位)以此刻的 skills 集为准。失败单条不连坐,永不拒启。
+            if (effective?.plugins && config.configCenter) {
+                const pluginOut = await applyCenterPlugins(skills, effective, {
+                    cacheRoot: join(config.localDataRoot ?? join(homedir(), ".ai-agent"), "plugin-cache"),
+                    allowHosts: config.pluginsAllowHosts,
+                    logger,
+                }).catch((err) => {
+                    logger.warn("center_plugins_apply_failed", { error: err instanceof Error ? err.message : String(err) });
+                    return undefined;
+                });
+                if (pluginOut) {
+                    skills = pluginOut.skills;
+                    if (pluginOut.failures.length + pluginOut.letGo.length + pluginOut.lkgUsed.length > 0) {
+                        logger.info("center_plugins_applied", { failures: pluginOut.failures, letGo: pluginOut.letGo, lkgUsed: pluginOut.lkgUsed });
+                    }
+                }
+            }
+            // F7:boot 的 LKG 落盘点。codex R26:走同一只 persistLkgDurable(完整性门在前)——此前裸 saveLkg 会把
+            // applyCenterSkills 静默吞掉失败的「缺正文 manifest」发布成 boot 可见 LKG(离线重启=静默缺 skill 且不再
+            // 有信号收敛)。校验失败=不落盘(warn 已在函数内),下一个干净候选/refresh 重试重写。
+            if (bootLkgCandidate && lkgEnabled) {
+                const bootPublished = await persistLkgDurable(bootLkgCandidate.effective, bootLkgCandidate.etag).catch((err) => {
+                    logger.warn("config_lkg_save_failed", { path: lkgPath, err: String(err), note: "boot LKG persist failed — retained for the per-tick retry" });
+                    return false;
+                });
+                // codex R30: a failed/incomplete boot publication must enter the SAME retained-candidate retry lane as the
+                // refresh path — ccEtag has already advanced, so the next ticks 304 and nothing else would ever retry; a
+                // restart during a center outage would then boot stale/env config instead of the generation this process
+                // already applied. blocked=[] — everything WAS applied at boot, this is a publication-only retry (promotion
+                // with no withheld reasons publishes NO restart signal, it just completes the LKG and clears the state).
+                {
+                    // codex R32/R34: verify the boot's LIVE application UNCONDITIONALLY — applyCenterSkills skips an
+                    // unfetchable body (this process may run skill-stale / on an older same-name built-in), and the LKG
+                    // prewarm inside persistLkgDurable can succeed where the live fetch failed (bootPublished true, LKG
+                    // complete, process still stale). Any live miss ⇒ a skills restart: published immediately when the
+                    // handoff already stands, or carried in blocked for the 304-gated promotion when it doesn't.
+                    const enabledManifest = (bootLkgCandidate.effective.skills?.skills ?? []).filter((m) => m.enabled !== false);
+                    // codex R33: the FULL runtime projection must match, not just name+body — a same-body built-in retained
+                    // after a failed center fetch can carry different scenarios/description (e.g. global exposure where the
+                    // manifest restricts to one scenario), and the scenario bundles baked right after are then stale.
+                    const canonScenarios = (a) => [...(a ?? [])].sort().join("\u0000");
+                    const liveSkillMiss = enabledManifest.some((m) => !skills.some((sk) => sk.spec.name === m.name &&
+                        skillContentHash(sk.spec.content) === m.contentHash &&
+                        sk.spec.description === m.description &&
+                        canonScenarios(sk.scenarios) === canonScenarios(m.scenarios)));
+                    if (liveSkillMiss)
+                        bootSkillStale = true; // codex R35: sticky — survives same-generation 200 recomputes
+                    if (liveSkillMiss && (bootPublished || (!lkgSurvivesRestart && lastPrewarmBodiesVerified))) {
+                        // Signal NOW only on the arms where a restart PROVABLY repairs (codex R34/R36/R37):
+                        //  · durable + published — the complete LKG (manifest + hash-verified bodies) is the handoff;
+                        //  · NON-durable + body proof — the prewarm inside persistLkgDurable just hash-verified every enabled
+                        //    body on disk, so the miss was a TRANSIENT live-application failure and a restarted process
+                        //    re-pulls successfully. WITHOUT the proof (persistent 404/hash mismatch) publishing here would
+                        //    restart-storm a stateless deployment (codex R37) — that case falls to the retained-debt arm
+                        //    below: visible on /health, retried per confirming 304, promoted only once the proof holds.
+                        pendingRestart = { restartRequired: true, reasons: ["skills"], version: bootLkgCandidate.effective.version, since: Date.now() };
+                        logger.warn("config_boot_skill_stale_restart", { version: bootLkgCandidate.effective.version, durableHandoff: bootPublished, note: bootPublished ? "live skill application incomplete but the durable LKG carries the full candidate — skills restart published (the next boot reads the complete LKG)" : "live skill application incomplete on a non-durable deployment but every enabled body is verified in the cache — skills restart published (transient failure proven repaired; the restarted process re-pulls live)" });
+                    }
+                    else if (liveSkillMiss || (!bootPublished && lkgSurvivesRestart)) {
+                        planeDeferredNoHandoff = { version: bootLkgCandidate.effective.version, since: Date.now(), blocked: liveSkillMiss ? ["skills"] : [], candidate: bootLkgCandidate.effective, ...(bootLkgCandidate.etag !== undefined ? { candidateEtag: bootLkgCandidate.etag } : {}) };
+                        logger.warn("config_lkg_boot_publication_retained", { version: bootLkgCandidate.effective.version, liveSkillMiss, durableDeclared: lkgSurvivesRestart, note: (lkgSurvivesRestart ? "boot LKG publication incomplete on a durable-declared deployment — candidate retained; the refresh loop retries after each confirming 304" : "live skill application incomplete on a non-durable deployment and the body cache could not be verified — skills debt retained WITHOUT a restart signal (codex R37: signaling now could restart-storm; each confirming 304 re-verifies and publishes once the bodies prove fetchable)") + (liveSkillMiss && lkgSurvivesRestart ? "; this process runs skill-stale, promotion will publish a skills restart" : "") });
+                    }
+                }
+            }
+            if (effective?.mcp)
+                config.mcpServers = resolveMcpServers(effective.mcp, logger);
+            return skills;
+        },
+        applyCenterScenarios(t) {
+            const { scenarioDeps, scenarios, scenarioDetails, builtinScenarioNames } = t;
+            // Center-declared scenarios (composition-as-config): overlay over the built-ins, center wins — it MAY
+            // shadow a built-in name (usability first), so shadows are logged loudly here for audit.
+            // Restart-to-apply like skills/mcp (this runs once at boot; a refresh carrying scenarios only signals).
+            if (effective?.scenarios) {
+                const { overlay, shadows } = centerScenarios(scenarioDeps, effective.scenarios.scenarios, Object.keys(scenarios), logger);
+                Object.assign(scenarios, overlay);
+                Object.assign(scenarioDetails, centerScenarioDetails(effective.scenarios.scenarios, builtinScenarioNames));
+                if (Object.keys(overlay).length > 0)
+                    logger.info("sema_registry_scenarios", { scenarios: Object.keys(overlay), ...(shadows.length > 0 ? { shadowsBuiltin: shadows } : {}) });
+            }
+        },
+        initKeyResolver() {
+            keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
+            // PAIR-REVIEW F-6:Bearer-only 网关 × per-model key 组合死角的 boot 响亮告警——core 的 per-call auth 是
+            // **整体替换**语义(1.345:per-call apiKey 在场即剥构造期 Authorization,x-api-key 成唯一凭据),而
+            // key-resolver 只会产 { apiKey } 形;部署若以 ANTHROPIC_AUTH_TOKEN(Bearer)直连此类网关,则每个配了
+            // per-model key 的模型必 401 且无从自诊。headers 形支持候 core/registry additive 席位(跨仓件);此前
+            // 先把组合不可用讲清楚。只 warn 不拒:混合网关(两种头都收)是存在的,fail-open+可诊断。
+            if (process.env.ANTHROPIC_AUTH_TOKEN && !process.env.ANTHROPIC_API_KEY && (Object.keys(config.modelApiKeys).length > 0 || Object.keys(config.modelApiKeyEnv).length > 0)) {
+                logger.warn("per_model_key_bearer_gateway_combo", {
+                    perModelKeys: Object.keys(config.modelApiKeys).length + Object.keys(config.modelApiKeyEnv).length,
+                    note: "ANTHROPIC_AUTH_TOKEN (Bearer) deployment with per-model keys: core's per-call auth REPLACES the Authorization header with x-api-key for those models — a Bearer-only gateway will 401 them. Remove the per-model key for such models, or use a gateway accepting x-api-key.",
+                });
+            }
+        },
+        startRefreshLoop(a) {
+            const { runnerTierFrozen, pricing } = a;
+            // Config refresh: re-pull with the ETag; teams hot-reload via the registry. A models/roles
+            // change updates config but the live Runner keeps its startup set — logged so ops restart to apply.
+            // 提示词装配协议 §9.5-1/-3: the loop goes through the ConfigProvider seam (never the raw HTTP fetch —
+            // one resolver, no remote/local drift) and runs for the LOCAL provider too: config.d edits are picked
+            // up by the same 60s poll (the local provider's etag = the store's raws hash, so an unchanged tree is
+            // a cheap null and a corrupt↔fixed flip bumps the version). Local mode previously read config.d
+            // exactly once at boot.
+            if (configProvider) {
+                const ccRef = config.configCenter;
+                // Single-flight (codex F2): an async tick body under setInterval has no serialization — a slow read
+                // (degraded disk/远端) outliving the 60s interval would let a LATER tick apply a newer candidate and
+                // the stalled OLDER read then complete and roll the config (and ccEtag) back. Skip the tick while one
+                // is in flight; the flag flips in `finally`, so a throw never wedges the loop shut.
+                let refreshInFlight = false;
+                const refreshTick = async (prefetched) => {
+                    if (refreshInFlight)
+                        return;
+                    refreshInFlight = true;
+                    try {
+                        // codex-3/4 F1:欠账的 catalog 过渡在**每个真拍**开头无条件重试——与 fetch 成败/候选好坏解耦
+                        // (304、fetch 抛错、候选被整拒的拍此前全都跳过重试=盘错恢复后过渡仍卡死)。次序安全:本拍
+                        // 若随后采用了更新候选,adopt 自会覆盖/清空 pending(先重试旧账、后采新目标,永不倒退)。
+                        await retryPendingCatalog("refresh-retry");
+                        // codex R18: the stuck-deferred state must not vanish behind the advanced etag — re-warn + count on
+                        // EVERY tick (incl. 304s and fetch-error ticks) while it persists; /health carries the same state.
+                        // The RECOVERY (persist retry + promotion) moved BELOW the fetch (codex R29): promoting before
+                        // adjudicating the current source generation could publish a SUPERSEDED candidate N as the
+                        // boot-visible LKG while N+1 exists — a restart in that window resurrects withdrawn config.
+                        if (planeDeferredNoHandoff) {
+                            metrics.inc("models_tiers_plane_deferred_stuck_total");
+                            logger.warn("models_tiers_deferred_no_handoff", { version: planeDeferredNoHandoff.version, since: planeDeferredNoHandoff.since, note: "candidate still retained without a next-boot handoff — mount restart-surviving LKG storage + CONFIG_LKG_DURABLE=true, or restart manually after ensuring the candidate is re-pulled at boot" });
+                        }
+                        // F3(LKG 复审):LKG-boot 的 deferred 到货把 unconditional 结果直接喂进来——丢弃它再按 LKG 的
+                        // etag 条件拉,会在「center 重建且 etag 值撞旧」的场景永远 304=陈旧配置钉死;消费原始结果则
+                        // 应用后 ccEtag=真实新值,陈旧面消除(顺带省一次拉取)。
+                        const r = prefetched !== undefined ? prefetched : await configProvider.fetchEffective(ccEtag);
+                        // codex R23/R29 recovery lane: a 304 (r === null) CONFIRMS the retained candidate's generation is
+                        // still the source's current one (its etag advanced when it was retained) — only then is it safe to
+                        // retry persistence and promote the withheld restart signal. A fetch that returned a NEWER candidate
+                        // takes the normal branches below (which replace/supersede the retained state); a fetch that THREW
+                        // never reaches here (freshness unknown ⇒ no promotion this tick). Retry only where promotion is
+                        // possible (durable-declared lane; R37 adds the non-durable skills-debt lane, whose retry doubles as
+                        // the repair proof) — elsewhere a per-tick write could never promote and just burns IO.
+                        if (r === null && planeDeferredNoHandoff) {
+                            // Retry where promotion is possible: the durable-declared lane (full handoff), and — codex R37 —
+                            // the NON-durable skills-debt lane, where the retry's body prewarm+verify is the repair PROOF that
+                            // gates the withheld skills restart (see lastPrewarmBodiesVerified).
+                            const skillsDebt = (planeDeferredNoHandoff.blocked ?? []).includes("skills");
+                            const promoted = lkgSurvivesRestart || skillsDebt ? await persistLkgDurable(planeDeferredNoHandoff.candidate, planeDeferredNoHandoff.candidateEtag) : false;
+                            // codex R37 proof-gated promotion (non-durable lane): every enabled body now hash-verifies on disk
+                            // ⇒ the center + body endpoint are BOTH live, a restarted process re-pulls successfully — publish
+                            // the skills restart exactly now, never on manifest-success alone (restart-storm breaker: a boot
+                            // that fails the body again lacks the proof and returns to visible-debt, not to signaling).
+                            // models-tiers never rides this arm (R16: a FORCED plane restart requires a durable handoff), so a
+                            // retained candidate that ALSO defers the plane keeps everything withheld until durability exists.
+                            const skillsProofPromotion = !promoted && !lkgSurvivesRestart && skillsDebt && lastPrewarmBodiesVerified && planeDeferredNoHandoff.planeDeferred !== true;
+                            if (skillsProofPromotion) {
+                                pendingRestart = { restartRequired: true, reasons: ["skills"], version: planeDeferredNoHandoff.version, since: Date.now() };
+                                logger.info("config_boot_skill_debt_promoted", { version: planeDeferredNoHandoff.version, note: "skill bodies verified on a source-confirmed-current candidate — the withheld skills restart is now published (non-durable lane, repair proven)" });
+                                planeDeferredNoHandoff = undefined;
+                            }
+                            else if (promoted) {
+                                // models-tiers joins only when the PLANE was deferred (codex R27: a skill-only retained candidate
+                                // must not manufacture a plane reason on promotion). codex R30: an EMPTY promotion (boot
+                                // publication retry — nothing was withheld, everything already applied) publishes NO restart
+                                // signal; it just completes the LKG and clears the state.
+                                const promotedReasons = [...new Set([...(planeDeferredNoHandoff.blocked ?? []), ...(planeDeferredNoHandoff.planeDeferred ? ["models-tiers"] : [])])];
+                                if (promotedReasons.length > 0) {
+                                    pendingRestart = { restartRequired: true, reasons: promotedReasons, version: planeDeferredNoHandoff.version, since: Date.now() };
+                                }
+                                logger.info("models_tiers_deferred_promoted", { version: planeDeferredNoHandoff.version, reasons: promotedReasons, note: promotedReasons.length > 0 ? "handoff persistence recovered on a source-confirmed-current candidate — the withheld restart signal is now published" : "boot publication retry completed — LKG now durable, no restart needed (nothing was withheld)" });
+                                planeDeferredNoHandoff = undefined;
+                            }
+                        }
+                        if (r) {
+                            // §9.5-5 candidate gate: ANY invalid domain rejects the WHOLE candidate — the live config
+                            // keeps serving the LKG (`latestEffective`) instead of that domain falling to schema-default/
+                            // empty. ccEtag is deliberately NOT advanced: the bad tree stays visible (re-judged each poll),
+                            // and fixing the file bumps the version so the next poll lands. The dedupe key is the SORTED
+                            // de-duplicated domain set (codex F3: the collector's ordering isn't guaranteed, a raw join
+                            // would re-warn every poll), and the first warn carries the full per-domain error detail —
+                            // that's the actionable diagnosis, the key only mutes repeats. The prompts-domain artifact
+                            // validation (core S1) hooks into this same gate when it ships.
+                            // F6(二轮复审):prompts 面判形进候选门——坏 pack(重复 id/空数组/坏信封)若只在 boot 验,
+                            // refresh 会带着它推进 etag+发 restart 信号,重启后 boot 拒之回内置=好包 A 被坏包 B 顶掉。
+                            // 这里与 domainErrors 同门:坏形=整拒候选(etag 不进,LKG/现用包 A 继续服务,持续 warn 到修复)。
+                            const promptsRaw = r.effective.prompts;
+                            const promptsGate = promptsRaw !== undefined ? validatePromptsDomain(promptsRaw) : { ok: true };
+                            const badDomains = [
+                                ...new Set([...(r.domainErrors ?? []).map((de) => de.domain), ...(promptsGate.ok ? [] : ["prompts"])]),
+                            ]
+                                .sort()
+                                .join(",");
+                            if (badDomains) {
+                                if (lastRejectedCandidate?.version !== r.effective.version || lastRejectedCandidate.domains !== badDomains) {
+                                    lastRejectedCandidate = { version: r.effective.version, domains: badDomains, at: Date.now() };
+                                    logger.warn("config_candidate_rejected", {
+                                        version: r.effective.version,
+                                        domains: badDomains,
+                                        errors: [
+                                            ...(r.domainErrors ?? []).map((de) => ({ domain: de.domain, error: de.error })),
+                                            ...(promptsGate.ok ? [] : [{ domain: "prompts", error: promptsGate.error }]),
+                                        ],
+                                        lkgVersion: latestEffective?.version ?? "(env)",
+                                        note: "candidate rejected whole (§9.5-5) — live config keeps the last-known-good; fix the named files to unblock",
+                                    });
+                                }
+                                return;
+                            }
+                            lastRejectedCandidate = undefined;
+                            // ccEtag advances at the END of each branch (codex lens-1 HIGH): advancing before apply meant
+                            // an applyEffective throw mid-way left a MIXED-generation live config AND a cached etag — the
+                            // next poll 304'd, so the failed candidate was never retried. Now a throw keeps the old etag,
+                            // the next poll re-fetches the same candidate, and the (idempotent) re-apply self-heals.
+                            if (ccRef?.dryRun) {
+                                logEffectiveDiff(config, r.effective, logger); // compare-only: surface ongoing center changes, apply nothing
+                                ccEtag = r.etag;
+                            }
+                            else {
+                                // refresh: teams + runtime governance + MODELS/ROLES/ROSTER now hot. teamsOnly skips
+                                // only the boot-only runtime GATES (rate/cost/approval). applyEffective mutates config.models/roles
+                                // IN PLACE (the Runner's live ref) — but `pricing` (separate object the Runner also reads live) and
+                                // `keyResolver` (closes over modelApiKeyEnv) are ours to refresh.
+                                // codex R10: hot-apply of the MODEL PLANE holds ONLY when the Runner shares our map (tier-less at
+                                // construction). A tier-frozen Runner keeps a private expanded copy — hot-applying a changed plane
+                                // would split admission from execution (same-key retarget silently routes/bills the stale Model
+                                // object through the restart window). Defer the plane; the models-tiers slice below signals the
+                                // orchestrator; the restarted process applies it at boot BEFORE Runner construction.
+                                // codex R12: defer also when the CANDIDATE activates tiers on a tier-less-booted Runner — it never
+                                // re-runs expandTiers, so hot-applying the arriving tier table would let tier words pass the
+                                // expanded admission gate while core throws "Unknown model ref" until restart. Hot-apply is safe
+                                // only when BOTH generations are tier-less.
+                                const planeDeferred = (runnerTierFrozen || planeHasActiveTiers(r.effective)) && modelPlaneChanged(appliedPlaneEff, r.effective);
+                                applyEffective(config, r.effective, logger, { teamsOnly: true, sealedKeys, ...(planeDeferred ? { deferModelPlane: true } : {}) });
+                                if (planeDeferred) {
+                                    logger.warn("models_tiers_plane_deferred", { version: r.effective.version, note: "tier-frozen Runner: the changed model plane (models/roles/tiers/default) is NOT hot-applied — admission stays on the Runner's generation; restart applies the new plane (models-tiers restart signal rides /health)" });
+                                }
+                                else {
+                                    appliedPlaneEff = r.effective;
+                                    planeDeferredNoHandoff = undefined; // plane landed — the stuck state (if any) is resolved
+                                }
+                                await adoptCenterPrompts(r.effective, "refresh"); // 热采用(core 1.316 声明轴:新任务边界自动重 pin,见 ref 注释)
+                                // codex R13: readiness may open ONLY off an APPLIED plane — a deferred candidate's roster is not
+                                // installed (config.models still the old/placeholder generation), so opening the billable gate on
+                                // it would route/bill the wrong model until restart. Deferred ⇒ gate stays as-is; the restarted
+                                // process applies the candidate pre-Runner and opens it at boot.
+                                if (!planeDeferred)
+                                    markRosterLanded(r.effective); // boot pull 失败/未发布时,refresh 落 roster 同样开门
+                                mutateInPlace(pricing, buildPricing(config.models)); // hot: cost/model changes; Runner reads this.deps.pricing live
+                                keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys); // hot: per-model key add/remove/change (env-ref + sealed)
+                                // skills/mcp/scenarios/runtime-gates are baked into the live process at boot (buildScenarios / boot
+                                // middleware) — a refresh carrying a DIFFERENT value can't hot-apply, only a restart re-reads them.
+                                // We compare against the BOOT snapshot (`effective`), NOT presence: an orchestrator auto-restarts on
+                                // a non-empty `reasons` WITHOUT a restart loop (same diff every 60s is idempotent, not a fresh trigger).
+                                // Sticky `since`: keep the first-detected timestamp while `reasons` is unchanged; reset it when the set
+                                // changes; CLEAR the signal when a later pull reverts to boot (reasons empty) — restart no longer needed.
+                                // F2(LKG 复审):落盘 **await 且先于** restart 信号可见——orchestrator 见信号即杀进程,
+                                // fire-and-forget 的 rename 可能没完成 → 下一进程读旧 LKG → 同差异重现 = 本功能要消的环。
+                                // 顺序=先持久化(含 skill 正文预热,F1)再发信号;持久化失败=warn+照发(不发=配置永不生效;
+                                // 「盘坏+中心挂」双故障下环重现,接受并点名)。
+                                const lkgPersisted = await persistLkgDurable(r.effective, r.etag);
+                                const reasons = restartReasons(effective, r.effective);
+                                // codex R35: the sticky boot skill debt rides EVERY tick's reasons — change-detection vs boot is
+                                // blind to it (the stale table IS the boot baseline). Under a no-handoff deferral it folds into
+                                // blocked (promoted later); otherwise it keeps pendingRestart alive until the restart happens.
+                                // codex R38: change-DETECTED skills (manifest actually changed) is distinguished from the sticky
+                                // rider — the former keeps the pre-existing documented posture (rides regardless; the restart
+                                // pulls the NEW generation live), the latter is proof-gated below on the non-durable lane.
+                                const skillsChangeDetected = reasons.includes("skills");
+                                if (bootSkillStale && !skillsChangeDetected)
+                                    reasons.push("skills");
+                                // codex R15/R16/R19: a DEFERRED plane is adjudicated by HANDOFF STATUS alone — independent of
+                                // whether change-detection already produced the reason (R19: an already-present models-tiers with
+                                // no handoff sailed through = the exact storm R16 closed). With a confirmed next-boot handoff the
+                                // reason is ensured present (R15: env-baseline blind spot) and the stuck state clears; without one
+                                // the reason is SUPPRESSED (a restart the next process cannot satisfy — over-budget boot pull + no
+                                // LKG — is a rolling-restart storm) and the persistent stuck state + per-tick warn carry the
+                                // observability instead. Non-plane reasons (skills/mcp/…) keep riding either way.
+                                if (planeDeferred) {
+                                    if (lkgPersisted) {
+                                        if (!reasons.includes("models-tiers"))
+                                            reasons.push("models-tiers");
+                                        planeDeferredNoHandoff = undefined; // handoff exists — the restart signal carries observability
+                                    }
+                                    else {
+                                        // codex R22: suppress the candidate's ENTIRE restart signal, not just models-tiers — a
+                                        // co-occurring skills/mcp reason would still restart the worker, and with no handoff the
+                                        // replacement can't land ANY of this candidate (same over-budget pull) = the same storm.
+                                        // The blocked reasons stay observable (state + warn) and promote once a handoff exists.
+                                        const blocked = reasons.splice(0, reasons.length);
+                                        planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), ...(blocked.length > 0 ? { blocked } : {}), planeDeferred: true, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
+                                        logger.warn("models_tiers_deferred_no_handoff", { version: r.effective.version, blockedReasons: blocked, note: "plane deferred but no NEXT-BOOT handoff (LKG disabled/unwritable, or storage not declared restart-surviving — set CONFIG_LKG_DURABLE=true) — the WHOLE restart signal is withheld (it would loop); the old generation keeps serving" });
+                                    }
+                                }
+                                else if (lkgSurvivesRestart && !lkgPersisted) {
+                                    // codex R27/R31: retention is NOT conditional on restart reasons — a hot-only candidate
+                                    // (autonomy/prompts/teams/tier-less models) with a failed publication would otherwise advance
+                                    // the etag and never retry (304s), and a restart during a center outage would roll back to the
+                                    // older LKG (weaker governance). blocked may be [] = publication-only recovery (R30 promotion
+                                    // publishes no signal for an empty set).
+                                    // codex R27: a DURABLE-DECLARED deployment whose candidate publication is incomplete (skill-body
+                                    // verify failed → LKG not replaced) must not signal restart off that candidate either — the next
+                                    // boot would land the OLD LKG and re-signal while the center stays unavailable. Retain + withhold
+                                    // + per-tick retry-promote, same machinery as the deferred plane (no models-tiers added on
+                                    // promotion — the plane was NOT deferred here). Non-declared deployments keep the pre-existing
+                                    // documented posture (restart converges off a live boot pull when the center is healthy).
+                                    const blocked = reasons.splice(0, reasons.length);
+                                    planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), blocked, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
+                                    logger.warn("restart_candidate_publication_incomplete", { version: r.effective.version, blockedReasons: blocked, note: "durable LKG declared but the candidate's publication is incomplete (skill bodies unverified) — restart signal withheld; retried every tick until the cache completes" });
+                                }
+                                else if (!planeDeferred && !lkgSurvivesRestart && bootSkillStale && !skillsChangeDetected && !lastPrewarmBodiesVerified) {
+                                    // codex R38: the NON-durable lane's sticky rider must clear the SAME proof gate as the boot/304
+                                    // arms (R37) — a same-generation 200 (center omits/rotates ETags or ignores conditionals) lands
+                                    // here with reasons=[skills] purely from the sticky debt, and publishing it unproven re-opens
+                                    // the restart storm R37 closed (every replacement fails the same body, 200s again, signals
+                                    // again). persistLkgDurable just ran for THIS candidate, so the proof flag is current: unproven
+                                    // ⇒ strip the rider from the publishable set and retain it as visible debt (the same
+                                    // planeDeferredNoHandoff machinery the 304 recovery lane re-verifies and proof-promotes).
+                                    // Proven or durable-handoff ⇒ the rider rides as before. Change-DETECTED skills is exempt
+                                    // (pre-existing posture — the restart pulls the NEW generation, a different repair claim).
+                                    const i = reasons.indexOf("skills");
+                                    if (i >= 0) {
+                                        reasons.splice(i, 1);
+                                        planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), blocked: ["skills"], candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
+                                        logger.warn("config_boot_skill_debt_withheld", { version: r.effective.version, note: "boot skill debt still unproven on a non-durable deployment (body cache does not verify) — skills restart withheld this tick; re-verified each tick and published once the bodies prove fetchable" });
+                                    }
+                                }
+                                if (reasons.length === 0) {
+                                    pendingRestart = undefined;
+                                }
+                                else if (!pendingRestart || pendingRestart.reasons.join(",") !== reasons.join(",")) {
+                                    pendingRestart = { restartRequired: true, reasons, version: r.effective.version, since: Date.now() };
+                                }
+                                else {
+                                    pendingRestart = { ...pendingRestart, version: r.effective.version };
+                                }
+                                logger.info("sema_registry_refreshed", {
+                                    version: r.effective.version,
+                                    // hot-applied: teams + runtime governance (autonomy/commandPolicy) + MODELS/ROLES/ROSTER (+pricing
+                                    // +per-model keys). Still restart-to-apply: skills/mcp/scenarios + runtime GATES (rate/cost/approval).
+                                    note: "teams + runtime governance + models/roles/roster hot-applied; skills/mcp/runtime-gates/scenarios are restart-to-apply",
+                                    // Structured signal: orchestrator consumes the SAME object via GET /health.restart.
+                                    ...(pendingRestart ? { restartRequired: true, restartReasons: pendingRestart.reasons } : {}),
+                                });
+                                // BOTH the LKG and the etag advance ONLY after the whole apply/pricing/keyResolver/restart
+                                // chain succeeded (codex lens-3): if any step above throws, latestEffective keeps pointing at
+                                // the last FULLY-applied candidate and the etag stays put, so the next poll re-fetches and
+                                // re-applies the same candidate (idempotent self-heal) — the LKG never names a half-applied one.
+                                latestEffective = r.effective; // LKG advance (§9.5-2): candidate validated + fully applied
+                                ccEtag = r.etag;
+                            }
+                        }
+                    }
+                    catch (err) {
+                        logger.warn("sema_registry_refresh_failed", { err: String(err), note: "etag NOT advanced — the same candidate is re-fetched and re-applied next poll" });
+                    }
+                    finally {
+                        refreshInFlight = false;
+                    }
+                };
+                const ccTimer = setInterval(() => void refreshTick(), 60_000);
+                ccTimer.unref?.();
+                // Boot-deferred continuation(二轮复审 F5 改形):到货结果按「迟到的 boot」处理,而不是转普通 tick——
+                // 普通 tick 的 restartReasons(undefined, r) 会把 prompts/skills 面全判为差异 → restart → 中心持续慢时
+                // 下一进程又 deferred → 无限重启环。迟到 boot:①候选门同 F6(坏形=拒,cadence 重判);②热面
+                // teamsOnly apply(boot-only gates/skills/mcp 已按 env 建,迟到不可应用——诚实);③prompts adopt
+                // (进程刚起、会话面≈空,失真面⊆重启路径,且 adopt 后 prompts 不再贡献 restart 理由=prompts 无环);
+                // ④一次性诚实 restart 信号=剩余 restart-to-apply 面(skills/mcp/scenarios/gates)非空才发;⑤基线
+                // `effective`/LKG/etag 落位 → 后续 cadence 与到货值比较,不重复触发。⚠️ 残余环面(诚实记账):center
+                // 发布了 skills/mcp 且中心**持续**慢于 boot 预算时,每个新进程仍会为真缺失的 skills 面发一次 restart
+                // ——完整解=LKG 落盘(boot 直读上个进程的干净候选),已报 clay 裁量。
+                const deferredBootApply = async (r) => {
+                    if (!r)
+                        return;
+                    // F6(LKG 复审三轮):与 cadence tick 同一 single-flight 车道——deferred 的 skill 预热可能拖过 60s,
+                    // 期间 cadence 落了更新的候选 B,A 迟到完成再覆盖盘/信号=回滚。inFlight 时直接让行(丢弃 deferred
+                    // 结果无损:cadence 已经/即将拉到更新的),持有 flag 至信号发布后。
+                    if (refreshInFlight)
+                        return;
+                    refreshInFlight = true;
+                    try {
+                        await deferredBootApplyInner(r);
+                    }
+                    finally {
+                        refreshInFlight = false;
+                    }
+                };
+                const deferredBootApplyInner = async (r) => {
+                    const promptsRaw = r.effective.prompts;
+                    const promptsGate = promptsRaw !== undefined ? validatePromptsDomain(promptsRaw) : { ok: true };
+                    if ((r.domainErrors ?? []).length > 0 || !promptsGate.ok) {
+                        logger.warn("config_boot_deferred_candidate_rejected", {
+                            version: r.effective.version,
+                            errors: [...(r.domainErrors ?? []).map((de) => ({ domain: de.domain, error: de.error })), ...(promptsGate.ok ? [] : [{ domain: "prompts", error: promptsGate.error }])],
+                            note: "late boot pull carried an invalid candidate — env fallback keeps serving; the refresh cadence re-judges the same tree (etag not advanced)",
+                        });
+                        return;
+                    }
+                    if (ccRef?.dryRun) {
+                        logEffectiveDiff(config, r.effective, logger);
+                        ccEtag = r.etag;
+                        return;
+                    }
+                    // codex R10 (deferred-boot twin of the refresh-lane guard): the Runner was built from the ENV plane before
+                    // this late arrival — if it froze a tier-expanded copy, the arriving center plane must not hot-apply
+                    // (admission/Runner split). Tier-less env boot (the common deferred-boot shape) keeps true hot-apply.
+                    const planeDeferredLate = (runnerTierFrozen || planeHasActiveTiers(r.effective)) && modelPlaneChanged(appliedPlaneEff, r.effective);
+                    applyEffective(config, r.effective, logger, { teamsOnly: true, sealedKeys, ...(planeDeferredLate ? { deferModelPlane: true } : {}) });
+                    if (planeDeferredLate)
+                        logger.warn("models_tiers_plane_deferred", { version: r.effective.version, note: "tier-frozen Runner (env tiers): the late-boot center model plane is NOT hot-applied — restart applies it" });
+                    else {
+                        appliedPlaneEff = r.effective;
+                        planeDeferredNoHandoff = undefined;
+                    }
+                    await adoptCenterPrompts(r.effective, "boot-deferred");
+                    if (!planeDeferredLate)
+                        markRosterLanded(r.effective); // codex R13: same guard as the refresh lane — never open readiness off an unapplied plane
+                    mutateInPlace(pricing, buildPricing(config.models));
+                    keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
+                    effective = r.effective; // restart 比较基线=到货值(cadence 不再重复触发)
+                    latestEffective = r.effective;
+                    ccEtag = r.etag;
+                    const lkgPersistedLate = await persistLkgDurable(r.effective, r.etag); // F2 parity:信号可见前落盘+skill 正文预热
+                    const reasons = restartReasons(undefined, r.effective); // (prompts 不在 restart slices——热采用已在上方 adopt)
+                    // codex R15 (late-boot twin): tiered env boot + tier-less late candidate ⇒ deferral fires but BOTH slice
+                    // fingerprints reduce to null (undefined baseline, tier-less candidate) — no models-tiers reason, plane
+                    // deferred forever. Deferral is the ground truth; force the reason so the orchestrator restarts and the
+                    // next process lands the candidate at boot. codex R16: forced ONLY with a confirmed LKG handoff — without
+                    // it the restarted process re-enters this exact lane (env plane, late candidate) = restart storm; keep
+                    // serving the old generation and warn instead.
+                    // codex R19 (late-boot twin): handoff status decides, regardless of whether change-detection already
+                    // produced the reason — an active-tier candidate over an env boot deterministically carries models-tiers
+                    // from restartReasons(undefined, candidate), and letting it through with no handoff is the R16 storm.
+                    if (planeDeferredLate) {
+                        if (lkgPersistedLate) {
+                            if (!reasons.includes("models-tiers"))
+                                reasons.push("models-tiers");
+                            planeDeferredNoHandoff = undefined;
+                        }
+                        else {
+                            // codex R22 (late-boot twin): withhold the WHOLE signal — co-occurring skills/mcp reasons would
+                            // restart into the same over-budget/no-LKG lane and loop.
+                            const blocked = reasons.splice(0, reasons.length);
+                            planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), ...(blocked.length > 0 ? { blocked } : {}), planeDeferred: true, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
+                            logger.warn("models_tiers_deferred_no_handoff", { version: r.effective.version, blockedReasons: blocked, note: "late-boot plane deferred but no NEXT-BOOT handoff (see CONFIG_LKG_DURABLE) — the WHOLE restart signal is withheld (it would loop); old generation keeps serving" });
+                        }
+                    }
+                    else if (planeDeferredLate === false && lkgSurvivesRestart && !lkgPersistedLate) {
+                        // codex R31 (late-boot twin): retain failed publications even with zero restart reasons.
+                        // codex R27 (late-boot twin): durable-declared + incomplete publication ⇒ retain + withhold + retry.
+                        const blocked = reasons.splice(0, reasons.length);
+                        planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), blocked, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
+                        logger.warn("restart_candidate_publication_incomplete", { version: r.effective.version, blockedReasons: blocked, note: "late-boot candidate publication incomplete on a durable-declared deployment — restart signal withheld; retried every tick" });
+                    }
+                    if (reasons.length > 0)
+                        pendingRestart = { restartRequired: true, reasons, version: r.effective.version, since: Date.now() };
+                    logger.info("config_loaded_deferred", { source: configProvider.kind, version: r.effective.version, models: (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length, ...(reasons.length > 0 ? { restartRequired: true, restartReasons: reasons } : {}) });
+                };
+                // LKG 起服的进程有完整 boot 基线 → 到货走普通 tick(候选门+hot+对 LKG 的 restartReasons,通常
+                // 零差异=无信号无环);env 起服(无 LKG)才走「迟到 boot」路径。
+                if (bootConfigPending)
+                    void bootConfigPending.then((r) => (lkgBooted ? refreshTick(r) : deferredBootApply(r)), () => { });
+            }
+        },
+    };
+}
+//# sourceMappingURL=config-center.js.map