@sema-agent/server 2.0.1 → 3.0.0

package/dist/config-types.d.ts

@@ -34,7 +34,7 @@ export interface ImageBakeConfig {
      *  2026-07-13, SWR 弃用): `docker.io/claybobby`(海外主源;CN 兜底=内网 Gitea registry)。 */
     registry: string | null;
     /** The build-host promoted fetch-once cache base injected as `--cache-base` (NEVER caller-settable — a foreign
-     *  origin would defeat the domestic-only iron rule). `BAKE_CACHE_BASE` (e.g. http://172.17.0.1:8099). */
+     *  origin would defeat the domestic-only iron rule). `BAKE_CACHE_BASE` (e.g. `http://<build-host>:<port>`). */
     cacheBase: string | null;
     /** The pinned current sandbox-base ref injected as `--base-ref` when the caller omits `baseRef` (§P2.4c default).
      *  When NULL the server falls back to the index's latest published `sandbox-base` digest (design §P2.4c
@@ -575,8 +575,9 @@ export interface ServiceConfigFlat {
     /** design/113 C4: host-lane project-memory injection (CLAUDE.md + git narrative). Default **ON** (subject to the
      *  host-lane + single-user gate), so "open like CC" works without config. `PROJECT_MEMORY_ENABLED=false` opts out.
      *  design/158 B4 (lens4 N8): this was `projectMemoryDisabled` — the ONE negative boolean on a ServiceConfig whose
-     *  other 16 flags are positive `*Enabled`/`*Allowed`, so every read site had to invert twice. The retired env name
-     *  `PROJECT_MEMORY_DISABLED` still works for one deprecation window (inverted, with a boot notice). */
+     *  other 16 flags are positive `*Enabled`/`*Allowed`, so every read site had to invert twice. 🪦 server 3.0.0:
+     *  the retired env name `PROJECT_MEMORY_DISABLED` is a **fail-loud tombstone** — setting it (any value) refuses
+     *  boot with a message naming this knob; it is no longer read. */
     projectMemoryEnabled: boolean;
     /** R7: override the shared scheduler store path. Default `SEMA_CONFIG_DIR`→`~/.sema/scheduled_tasks.json` (the
      *  server writer + the shell daemon reader MUST agree). `SCHEDULER_STORE_PATH`. */
@@ -689,8 +690,9 @@ export interface ServiceConfigFlat {
      *  ON for the host lane (CC-parity); set `LSP_HOST_ENABLED=false` to opt out. (`REMOTE_EXEC=host` only — ssh/adb/
      *  local-docker can't reach a local child process to the right filesystem.)
      *  design/158 B4 (lens4 N7): this lane used to share `LSP_ENABLED` with `lspEnabled` above — one env name driving
-     *  two OPPOSITE defaults. It now has its own knob; `LSP_ENABLED=false` remains a back-compat host opt-out (with a
-     *  boot notice naming the replacement) and `LSP_HOST_ENABLED` wins whenever it is set. */
+     *  two OPPOSITE defaults. It now has its own knob. 🪦 server 3.0.0: `LSP_ENABLED=false` (the pre-split host
+     *  opt-out) is a **fail-loud tombstone** — it refuses boot naming `LSP_HOST_ENABLED`; `LSP_ENABLED=true` keeps
+     *  its own meaning (the sandbox lane's opt-in above) and is unaffected. */
     lspHostEnabled: boolean;
     /** Graceful drain: how long SIGTERM waits for in-flight turns (live streams + bg/resume legs on this
      *  instance) to finish before the hard shutdown. During drain, new billable submissions get 503+Retry-After and

package/dist/config.d.ts

@@ -43,33 +43,38 @@ export declare function logConfigDiagnostics(logger: {
  *  Note the deliberate non-migrations: the posture family (`postureOn`) keeps its tri-state — its unset case is
  *  neither `true` nor `false` but "single-user ∧ infra-ready" — and the sentinel-valued knobs (`MEMORY_ENGINE`,
  *  `SANDBOX_PKG_SOURCE`, `MANUAL_MODE_SHELL_GATE`) are enums wearing a boolean's clothes, not booleans. */
-type ConfigKnobSource = "env" | "legacy-env" | "posture" | "default";
+/** 复审 2026-07-29 B4:3.0.0 把负名 env 改成 fail-loud 墓碑之后,legacy-env 这个 source 取值**永不可达**——
+ *  留着它等于在类型上书面承诺"还有一条 legacy 取值路径"。同批摘掉的还有 `ConfigKnobRecord.legacyName`
+ *  与它在 boot 诊断行里的输出:运维在日志里看到 `legacyName: HOST_BG_DISABLED` 的合理结论是"旧名还能
+ *  用",而实际设了就拒启——诊断面撒的谎比没有诊断更贵(它会让人先去试那个必然拒启的开关)。 */
+type ConfigKnobSource = "env" | "posture" | "default";
 export interface ConfigKnobRecord {
-    /** The CANONICAL env name (the positive one — a legacy alias appears in `legacyName`, never here). */
+    /** The env name. 3.0.0 起只有这一个名字 —— 负名别名已是墓碑(见 `boolEnvWithLegacyNegated`)。 */
     name: string;
     /** `opt-in` = default OFF, `opt-out` = default ON, `posture` = default derived from REQUIRE_PRINCIPAL ∧ infra. */
     polarity: "opt-in" | "opt-out" | "posture";
     value: boolean;
     source: ConfigKnobSource;
-    /** Set when the value came from (or the knob still accepts) a deprecated negative-form alias. */
-    legacyName?: string;
 }
 /** The registered boolean knobs, sorted by name — the data behind `logConfigDiagnostics`'s polarity table. */
 export declare function configKnobTable(): ConfigKnobRecord[];
-/** design/158 N8 (D-family) — a knob whose CANONICAL name is positive (`X_ENABLED`, default ON) but which keeps
- *  its retired negative name (`X_DISABLED`) working for one deprecation window.
+/** design/158 N8 (D-family) + server 3.0.0 墓碑 —— a knob whose CANONICAL name is positive (`X_ENABLED`,
+ *  default ON) and whose retired negative name (`X_DISABLED`) is now a **fail-loud tombstone**.
  *
  *  Why the flip at all: `X_DISABLED !== "true"` is a double negative at the read site, so the four knobs that
  *  used it (`PROJECT_MEMORY`, `CONFIG_LKG`, `HOST_BG`, `HOST_EXEC_SPOOL`) could not be read for their default
  *  without inverting twice in your head, and `projectMemoryDisabled` was the ONE negative boolean on a
  *  `ServiceConfig` that otherwise carries 16 positive `*Enabled`/`*Allowed` fields.
  *
- *  Resolution order (new name wins, so there is never an ambiguous both-set state):
+ *  🔴 3.0.0([1989],clay 令「不做兼容」):旧名不再有兼容窗——**设了就拒启**。这个函数保留 legacy 形参
+ *  不是为了继续读它,而正是为了**认出它在场并拒绝启动**(把墓碑放在唯一知道这对名字关系的地方)。
+ *
+ *  Resolution order:
  *   1. `X_ENABLED` set to a literal ⇒ that.
- *   2. `X_ENABLED` set to a non-literal ⇒ default + warning (the legacy name is NOT consulted — a typo in the
- *      new name must not silently hand control back to the deprecated one).
- *   3. `X_ENABLED` unset ∧ `X_DISABLED` set ⇒ the legacy site's exact contract, `X_DISABLED !== "true"`, plus a
- *      one-shot deprecation notice naming the replacement.
+ *   2. `X_ENABLED` set to a non-literal ⇒ default + warning (the tombstone is NOT consulted — a typo in the
+ *      new name must not turn into a boot refusal about an env the operator never set).
+ *   3. `X_ENABLED` unset ∧ `X_DISABLED` set(**任何值**,含 `"false"`)⇒ throw,文案指路新名。选拒启不选
+ *      静默忽略:静默会让升级部署的旧开关名义在、实际归默认——比拒启危险,且下游冒烟测试测不出来。
  *   4. neither ⇒ default. */
 export declare function boolEnvWithLegacyNegated(name: string, legacyNegatedName: string, def: boolean): boolean;
 /** LKG (last-known-good) persistence of the remote effective-config fetch. Read LAZILY at both main.ts sites

package/dist/config.js

@@ -132,7 +132,6 @@ export function logConfigDiagnostics(logger) {
                 polarity: k.polarity,
                 value: k.value,
                 source: k.source,
-                ...(k.legacyName ? { legacyName: k.legacyName } : {}),
             });
         }
     }
@@ -164,9 +163,6 @@ function optFinitePositiveEnv(name) {
 /** Keyed by canonical name so a knob read twice in one load (e.g. DURABLE_APPROVAL, once for the D-G boot
  *  invariant and once for the returned field) registers one row, not two. Reset per `loadConfig()`. */
 const CONFIG_KNOBS = new Map();
-/** Deprecated aliases already announced for this load — the lazily-read twins (HOST_BG/HOST_EXEC_SPOOL) resolve
- *  again on every use, and an operator does not need the same deprecation line once per command. */
-const KNOB_DEPRECATIONS_SEEN = new Set();
 /** The registered boolean knobs, sorted by name — the data behind `logConfigDiagnostics`'s polarity table. */
 export function configKnobTable() {
     return [...CONFIG_KNOBS.values()].sort((a, b) => a.name.localeCompare(b.name));
@@ -199,20 +195,23 @@ function boolEnv(name, def) {
     registerKnob({ name, polarity: def ? "opt-out" : "opt-in", value, source });
     return value;
 }
-/** design/158 N8 (D-family) — a knob whose CANONICAL name is positive (`X_ENABLED`, default ON) but which keeps
- *  its retired negative name (`X_DISABLED`) working for one deprecation window.
+/** design/158 N8 (D-family) + server 3.0.0 墓碑 —— a knob whose CANONICAL name is positive (`X_ENABLED`,
+ *  default ON) and whose retired negative name (`X_DISABLED`) is now a **fail-loud tombstone**.
  *
  *  Why the flip at all: `X_DISABLED !== "true"` is a double negative at the read site, so the four knobs that
  *  used it (`PROJECT_MEMORY`, `CONFIG_LKG`, `HOST_BG`, `HOST_EXEC_SPOOL`) could not be read for their default
  *  without inverting twice in your head, and `projectMemoryDisabled` was the ONE negative boolean on a
  *  `ServiceConfig` that otherwise carries 16 positive `*Enabled`/`*Allowed` fields.
  *
- *  Resolution order (new name wins, so there is never an ambiguous both-set state):
+ *  🔴 3.0.0([1989],clay 令「不做兼容」):旧名不再有兼容窗——**设了就拒启**。这个函数保留 legacy 形参
+ *  不是为了继续读它,而正是为了**认出它在场并拒绝启动**(把墓碑放在唯一知道这对名字关系的地方)。
+ *
+ *  Resolution order:
  *   1. `X_ENABLED` set to a literal ⇒ that.
- *   2. `X_ENABLED` set to a non-literal ⇒ default + warning (the legacy name is NOT consulted — a typo in the
- *      new name must not silently hand control back to the deprecated one).
- *   3. `X_ENABLED` unset ∧ `X_DISABLED` set ⇒ the legacy site's exact contract, `X_DISABLED !== "true"`, plus a
- *      one-shot deprecation notice naming the replacement.
+ *   2. `X_ENABLED` set to a non-literal ⇒ default + warning (the tombstone is NOT consulted — a typo in the
+ *      new name must not turn into a boot refusal about an env the operator never set).
+ *   3. `X_ENABLED` unset ∧ `X_DISABLED` set(**任何值**,含 `"false"`)⇒ throw,文案指路新名。选拒启不选
+ *      静默忽略:静默会让升级部署的旧开关名义在、实际归默认——比拒启危险,且下游冒烟测试测不出来。
  *   4. neither ⇒ default. */
 export function boolEnvWithLegacyNegated(name, legacyNegatedName, def) {
     const raw = process.env[name];
@@ -234,21 +233,17 @@ export function boolEnvWithLegacyNegated(name, legacyNegatedName, def) {
         source = "default";
     }
     else if (legacy !== undefined && legacy !== "") {
-        value = legacy !== "true"; // verbatim legacy contract: only the literal "true" disabled the feature
-        source = "legacy-env";
-        if (!KNOB_DEPRECATIONS_SEEN.has(legacyNegatedName)) {
-            KNOB_DEPRECATIONS_SEEN.add(legacyNegatedName);
-            CONFIG_NOTICES.push({
-                event: "config_env_deprecated_negated_name",
-                fields: { deprecated: legacyNegatedName, replacement: name, effective: String(value) },
-            });
-        }
+        // server 3.0.0([1989],clay 令「不做兼容」):负名旧 env = fail-loud 墓碑。设了(任何值,含
+        // "false"——设它的人同样以为它还生效)即拒启并指路新名。选拒启不选静默忽略:静默会让升级部署的
+        // 旧开关名义在、实际归默认——比拒启危险,而且下游/运维的冒烟测试测不出来。
+        throw new Error(`${legacyNegatedName} was removed in server 3.0.0 — set ${name}=${legacy !== "true"} instead ` +
+            `(positive-name knob, default ${def ? "on" : "off"}; migration table in USAGE.md)`);
     }
     else {
         value = def;
         source = "default";
     }
-    registerKnob({ name, polarity: def ? "opt-out" : "opt-in", value, source, legacyName: legacyNegatedName });
+    registerKnob({ name, polarity: def ? "opt-out" : "opt-in", value, source });
     return value;
 }
 /** LKG (last-known-good) persistence of the remote effective-config fetch. Read LAZILY at both main.ts sites
@@ -474,7 +469,15 @@ function parseStoreDomain(ctx) {
 function parseModelDomain() {
     // npm 卫生纪律:默认值不烤内网坐标 — localhost 占位(公开分发正确缺省);真网关一律显式 env。
     const gatewayBaseUrl = env("MODEL_GATEWAY_BASEURL", "http://127.0.0.1:8000/v1");
-    const modelId = env("MODEL_ID", "Qwen3.5-35B");
+    // server 3.0.0([1992] 真机 400 案根治):MODEL_ID **无出厂缺省**。旧缺省是一个只在开发环境存在的
+    // 模型名,对任何外部部署都必炸——且炸在离根因最远的地方(gateway 400 + title hook 连环告警),
+    // 用户看不出是没配模型。fail-loud at boot 指路配置,与 env 墓碑同哲学:让问题在最早、最清楚处现形。
+    const modelId = env("MODEL_ID", "");
+    if (modelId === "") {
+        throw new Error("MODEL_ID is required (no factory default since server 3.0.0) — set MODEL_ID=<model name your gateway serves>, " +
+            "or configure models via the sema-registry catalog; the old silent default was an internal-only model name " +
+            "that made every external deployment fail far from the cause (gateway 400)");
+    }
     // Model.api must reflect the brain that actually serves it (routing is by provider): an "anthropic"
     // provider runs the Anthropic brain, whose usage reports `input` EXCLUDING cached tokens. core ≥1.22
     // normalizes the cache-hit-rate denominator per api family — a wrong api makes promptTokens too small
@@ -915,16 +918,11 @@ function parseOrchestrationDomain(ctx) {
     // `LSP_ENABLED=false` keeps working as a host opt-out (it was the only one operators ever had) with a notice
     // naming the replacement, and `LSP_HOST_ENABLED` always wins when set.
     const lspHostEnabled = (() => {
-        const explicitHost = process.env.LSP_HOST_ENABLED;
-        if (explicitHost === undefined || explicitHost === "") {
-            if (process.env.LSP_ENABLED === "false") {
-                CONFIG_NOTICES.push({
-                    event: "config_env_deprecated_lane_alias",
-                    fields: { deprecated: "LSP_ENABLED=false", replacement: "LSP_HOST_ENABLED=false", lane: "host", effective: "false" },
-                });
-                registerKnob({ name: "LSP_HOST_ENABLED", polarity: "opt-out", value: false, source: "legacy-env", legacyName: "LSP_ENABLED" });
-                return false;
-            }
+        // server 3.0.0([1989],不做兼容):`LSP_ENABLED=false` 的 host 腿别名形 = fail-loud 墓碑。
+        // `LSP_ENABLED=true`(沙箱腿 opt-in 正名)不受影响——墓碑只咬「用沙箱名关 host 腿」的旧姿势。
+        if (process.env.LSP_ENABLED === "false") {
+            throw new Error("LSP_ENABLED=false no longer drives the HOST lane (removed in server 3.0.0) — set LSP_HOST_ENABLED=false " +
+                "for the host lane; LSP_ENABLED remains the SANDBOX-lane opt-in only (migration table in USAGE.md)");
         }
         return boolEnv("LSP_HOST_ENABLED", true);
     })();
@@ -1302,7 +1300,6 @@ export function loadConfig() {
     CONFIG_WARNINGS.length = 0; // repeated loadConfig() calls (test setup) must not accumulate stale warnings
     CONFIG_NOTICES.length = 0;
     CONFIG_KNOBS.clear(); // the polarity table describes THIS load, never a previous one's env
-    KNOB_DEPRECATIONS_SEEN.clear();
     // Posture gate: single-user turnkey (`REQUIRE_PRINCIPAL !== "true"` = one trusted super-admin on their own
     // box/tenant, CC's trust model) ⇒ the CC capability set defaults ON, each composed with its infra prereq; multi-tenant
     // (requirePrincipal) stays opt-in (gated + secured). This is the SAME discriminator LSP's host-default-ON uses,

package/dist/hooks/hook-llm.js

@@ -1,3 +1,4 @@
+import { matchCatalogModel } from "../model-select.js";
 export function createHookLlm(deps) {
     const { config, metrics } = deps;
     // anthropic 路由自己的 baseUrl(与 core createAnthropicBrain 同一解析链:model.baseUrl || config.baseUrl
@@ -40,6 +41,14 @@ export function createHookLlm(deps) {
         }
         if (config.models[requested])
             return shape(requested);
+        // 复审 2026-07-29 D1:目录键是 **name** 形,而调用点会传 **provider id** 形——`http/routes/tasks.ts`
+        // 的 titler 腿([1992]②「标题跟 turn」)对对象形 spec 传的就是 `spec.model.id`。registry 热应用后
+        // name 与 id 常态分叉(目录键是运维起的短名,`Model.id` 是 provider 侧的真名),单键索引下这类请求全落到下面那条
+        // 「不在目录里」⇒ 用户每选一次非主模型,标题就 llm_failed(对话本身正常),与 [1992] 同族的病形。
+        // 双键索引沿用同仓先例 [865]② `matchCatalogModel`:name 优先、id 扫目录值、跳过 `default` 别名键。
+        const byId = matchCatalogModel(requested, config.models);
+        if (byId !== undefined)
+            return shape(byId);
         if (requested === config.model.id)
             return shapeFrom(requested, config.model, requested);
         return { ok: false, error: `hook model "${requested}" is not in this deployment's catalog` };

package/dist/http/routes/approvals-assistant.js

@@ -746,7 +746,7 @@ export async function streamApprovals(req, res, cs, scope, pollMs = APPROVALS_ST
         }
         prev = cur;
         if (Date.now() - start > MAX_MS) {
-            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", code: "STREAM_MAX_DURATION", message: "approvals stream reached its 15-minute cap — reconnect to continue" })}\n\n`);
+            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "approvals stream reached its 15-minute cap — reconnect to continue" })}\n\n`);
             break;
         }
         if (Date.now() - lastBeat > 15_000) {

package/dist/http/routes/attachments.js

@@ -61,7 +61,7 @@ async function handleAttachmentsBody(req, res, url, ctx, miss) {
                 }
                 const allow = deps.config.attachmentMimeAllowlist;
                 if (allow && !allow.some((a) => a === mime || (a.endsWith("/*") && mime.startsWith(a.slice(0, -1))))) {
-                    sendError(res, 415, "attachment.mime_not_allowed", `mime '${mime}' is not in this deployment's allowlist`, { code: "attachment.mime_not_allowed", allowed: allow });
+                    sendError(res, 415, "attachment.mime_not_allowed", `mime '${mime}' is not in this deployment's allowlist`, { allowed: allow });
                     return;
                 }
                 const max = deps.config.attachmentMaxBytes ?? 32 * 1024 * 1024;
@@ -71,7 +71,7 @@ async function handleAttachmentsBody(req, res, url, ctx, miss) {
                 }
                 catch (err) {
                     if (err instanceof HttpError && err.status === 413) {
-                        sendError(res, 413, "attachment.too_large", `attachment exceeds the per-file limit (${max} bytes)`, { code: "attachment.too_large", maxBytes: max });
+                        sendError(res, 413, "attachment.too_large", `attachment exceeds the per-file limit (${max} bytes)`, { maxBytes: max });
                         return;
                     }
                     throw err;

package/dist/http/routes/memory-policy.js

@@ -76,11 +76,11 @@ async function handleMemoryPolicyBody(req, res, url, ctx, miss) {
             scope = decodeURIComponent(url.slice("/v1/memory/sync/".length));
         }
         catch {
-            sendError(res, 400, "memory_sync_invalid_scope", "malformed percent-encoding in :scope", { code: "memory_sync_invalid_scope" });
+            sendError(res, 400, "memory_sync_invalid_scope", "malformed percent-encoding in :scope");
             return;
         }
         if (scope.length === 0) {
-            sendError(res, 400, "memory_sync_invalid_scope", "missing :scope", { code: "memory_sync_invalid_scope" });
+            sendError(res, 400, "memory_sync_invalid_scope", "missing :scope");
             return;
         }
         if (scope !== formatUserScope(principal) && !explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
@@ -90,7 +90,7 @@ async function handleMemoryPolicyBody(req, res, url, ctx, miss) {
         const body = await readJson(req); // 413/400 (oversize / bad JSON) via the typed top-level catch — auth already done
         const parsed = parseMemorySyncRequest(body, scope);
         if (!parsed.ok) {
-            sendError(res, 422, "memory_sync_invalid_body", parsed.error, { code: "memory_sync_invalid_body" });
+            sendError(res, 422, "memory_sync_invalid_body", parsed.error);
             return;
         }
         try {

package/dist/http/routes/runs.js

@@ -154,7 +154,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             const taskId = clientTaskId ?? uuidv7();
             const created = await runStore.createRun(taskId, sessionId, prepared.auth?.principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));
             if (created.ok)
-                deps.sessionTitler?.maybeTitle(sessionId, prepared.spec.objective); // fire-and-forget session auto-title
+                deps.sessionTitler?.maybeTitle(sessionId, prepared.spec.objective, typeof prepared.spec.model === "string" ? prepared.spec.model : prepared.spec.model?.id); // fire-and-forget;model 跟 turn([1992]②)
             if (!created.ok) {
                 // race twin: two concurrent same-taskId submits (gateway retry racing the original) — the loser's
                 // session claim collides with ITS OWN taskId → idempotent 202 replay, not a 409 (the run exists, once).

package/dist/http/routes/session-sync.js

@@ -234,7 +234,7 @@ async function handleSessionSyncBody(req, res, url, ctx, miss) {
                 if (deps.snapshotBlobSqlCapBytes !== undefined && body.byteLength > deps.snapshotBlobSqlCapBytes) {
                     // 复审 D-F1/B-F2:归一漏网(多行体,旧门正则扫不到)——A6 迁移到 sendError 后此站点由
                     // errorCode 必填位置参数保结构(不再靠源级反射门兜底)。
-                    sendError(res, 413, "blob_too_large_for_sql", `blob of ${body.byteLength} bytes exceeds this deployment's SQL snapshot-blob cap (${deps.snapshotBlobSqlCapBytes} bytes — TiDB's txn-entry-size-limit is the low wall at 6MiB by default; the mysql-protocol packet limit sits above it) — configure MinIO object storage (MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY) for large snapshot blobs, or raise SNAPSHOT_BLOB_SQL_MAX_BYTES if your deployment lifted those limits`, { code: "blob_too_large_for_sql" });
+                    sendError(res, 413, "blob_too_large_for_sql", `blob of ${body.byteLength} bytes exceeds this deployment's SQL snapshot-blob cap (${deps.snapshotBlobSqlCapBytes} bytes — TiDB's txn-entry-size-limit is the low wall at 6MiB by default; the mysql-protocol packet limit sits above it) — configure MinIO object storage (MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY) for large snapshot blobs, or raise SNAPSHOT_BLOB_SQL_MAX_BYTES if your deployment lifted those limits`);
                     return;
                 }
                 if (createHash("sha256").update(body).digest("hex") !== hash) {
@@ -246,7 +246,7 @@ async function handleSessionSyncBody(req, res, url, ctx, miss) {
                 // blob as durably stored when it isn't.
                 const put = await fs.putBlob(hash, new Uint8Array(body));
                 if (!put.ok) {
-                    sendError(res, 502, put.error.code, "blob store write failed", { code: put.error.code });
+                    sendError(res, 502, put.error.code, "blob store write failed");
                     return;
                 }
                 res.writeHead(204).end(); // no body

package/dist/http/routes/sessions.js

@@ -796,7 +796,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
                 if (typeof fs.blobSizes === "function") {
                     const known = (await fs.blobSizes([hash])).get(hash);
                     if (known !== undefined && known > cap) {
-                        sendError(res, 413, "workspace_file_too_large", "file exceeds the single-file read limit — download it via the archive endpoint", { code: "workspace_file_too_large", sizeBytes: known, limit: cap });
+                        sendError(res, 413, "workspace_file_too_large", "file exceeds the single-file read limit — download it via the archive endpoint", { sizeBytes: known, limit: cap });
                         return;
                     }
                 }
@@ -806,7 +806,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
                     return;
                 }
                 if (bytes.byteLength > cap) {
-                    sendError(res, 413, "workspace_file_too_large", "file exceeds the single-file read limit — download it via the archive endpoint", { code: "workspace_file_too_large", sizeBytes: bytes.byteLength, limit: cap });
+                    sendError(res, 413, "workspace_file_too_large", "file exceeds the single-file read limit — download it via the archive endpoint", { sizeBytes: bytes.byteLength, limit: cap });
                     return;
                 }
                 // [1894]③:content-type 按扩展名(保守表,未知=octet-stream)+ 二进制判别头(首 8KiB NUL/控制

package/dist/http/routes/tasks.js

@@ -214,7 +214,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     const tid = earlyDurableTid ?? uuidv7(); // reuse the id already emitted as the X-Task-Id header (defensive mint if absent)
                     const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));
                     if (created.ok)
-                        deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective); // fire-and-forget; in-titler dedupe
+                        deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective, typeof prepared.spec.model === "string" ? prepared.spec.model : prepared.spec.model?.id); // fire-and-forget; in-titler dedupe;model 跟 turn([1992]②)
                     if (!created.ok) {
                         const conflict = { error: "session already has an active run — POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)", errorCode: "conflict.session_active_run", activeTaskId: created.activeTaskId };
                         // Headers are already SSE — encode the rejection as the stream's terminal event; the 409 in
@@ -966,7 +966,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));
                     if (!created.ok)
                         return { status: 409, body: { error: "session already has an active run — POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)", errorCode: "conflict.session_active_run", activeTaskId: created.activeTaskId } };
-                    deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective); // fire-and-forget session auto-title
+                    deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective, typeof prepared.spec.model === "string" ? prepared.spec.model : prepared.spec.model?.id); // fire-and-forget;model 跟 turn([1992]②)
                     durableTaskId = tid;
                 }
                 if (deps.checkpointStore && prepared.spec.sessionId) {

package/dist/http/routes/trace-usage.js

@@ -269,13 +269,13 @@ async function streamTaskTrace(req, res, runStore, taskId, staleMs) {
         }
         const stale = Date.now() - new Date(run.updatedAt).getTime() > staleMs;
         if (stale && events.length === 0) {
-            res.write(`event: error\ndata: ${JSON.stringify({ code: "WORKER_DOWN", message: "run stalled (instance lost?)" })}\n\n`);
+            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "WORKER_DOWN", message: "run stalled (instance lost?)" })}\n\n`);
             break;
         }
         if (Date.now() - start > MAX_MS) {
             // BL-16: the stream hit its 15-min cap but the RUN is still going — emit a terminal event so the client
             // can tell "reconnect to continue" from "task completed" (a silent close looked like completion).
-            res.write(`event: error\ndata: ${JSON.stringify({ code: "STREAM_MAX_DURATION", message: "trace stream reached its 15-minute cap — reconnect with Last-Event-ID to continue (the run is still active)" })}\n\n`);
+            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "trace stream reached its 15-minute cap — reconnect with Last-Event-ID to continue (the run is still active)" })}\n\n`);
             break;
         }
         if (events.length === 0) {

package/dist/http/routes/workflows.js

@@ -485,8 +485,10 @@ async function streamWorkflowRun(req, res, runId, scope) {
         }
     }
     catch {
+        // A1/A6/B:归一 error 帧形(`type` + 机器码)。此前只发人话 message ⇒ 消费端要么锚文案、要么把
+        // "流断了"和"流正常结束"混为一谈;`workflow.stream_error` 是本帧的铸码(附录 A `*.stream_error` 族)。
         if (!closed && !res.writableEnded)
-            res.write(`event: error\ndata: ${JSON.stringify({ message: "workflow stream error" })}\n\n`);
+            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "workflow.stream_error", message: "workflow stream error" })}\n\n`);
     }
     finally {
         clearInterval(hb);

package/dist/http/server.d.ts

@@ -197,7 +197,7 @@ export interface ServiceCoordinatorDeps {
     leaderEndpoint?: LeaderEndpoint;
     /** Fire-and-forget session auto-titler (first-submit hook; absent = feature dark). */
     sessionTitler?: {
-        maybeTitle(sessionId: string, objective: string): void;
+        maybeTitle(sessionId: string, objective: string, model?: string): void;
     };
 }
 /** **函数/构件缝**:main.ts 把跨多个子系统的动作编译成一个可调用面交给路由(路由不该自己

package/dist/http/server.js

@@ -281,7 +281,7 @@ export function createHttpServer(rawDeps) {
             // 4xx, not a 500. Everything else is a genuine internal error: log the cause, never echo it (info disclosure).
             if (err instanceof HttpError) {
                 if (!res.headersSent)
-                    sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.code ? { code: err.code } : {}), ...(err.extra ?? {}) });
+                    sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.extra ?? {}) });
                 else
                     res.end();
                 return;
@@ -1091,7 +1091,7 @@ export function createHttpServer(rawDeps) {
             if (err instanceof HttpError) {
                 // Typed rejection: echo the stable `code` + any structured extras (e.g. the scenario
                 // allowlist) beside the human message — machine code on the wire, prose stays with the shell/web.
-                sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.code ? { code: err.code } : {}), ...(err.extra ?? {}) });
+                sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.extra ?? {}) });
                 return null;
             }
             throw err;
@@ -1181,6 +1181,27 @@ export function createHttpServer(rawDeps) {
         }
         if (!cp)
             return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
+        // 🔴 GATE-KIND GUARD ([1995]①,`gate_not_resumable` / `gate_not_plan_review` 的**反方向镜像**):这条腿
+        // 只解 TOOL 审批门(core gateMatch:`human` / `irreversible_ask` ↔ outcome.gate "policy_ask")。此前它无
+        // 条件铸 outcome{gate:"policy_ask"} 交给 core —— 一个 plan_review / resource_limit / task_done park 被误
+        // 路由到 /decide(而 /v1/approvals 把它们与工具审批**混在同一个队列**里、toolName 同为 null)就会深入到
+        // core 的 `checkpoint.gate_mismatch`。那是 core 的 **pre-CAS** 拒绝(checkpoint 仍 pending),但 server 的
+        // CheckpointError 分类表把 gate_mismatch 归为 TERMINAL ⇒ 行被 setTerminal 成 failed + 释放 task_active,
+        // 于是「行说这活死了、park 却还活着」:claim 泄漏(同 session 可并发起第二个 run)、事后用正确的腿救能
+        // 200 真跑完却拿不到 taskId、run 行永停 failed(账本与现实分叉)。这里 pre-CAS 纯拒绝:不动 checkpoint、
+        // 不动 run 行、不烧模型腿,与另外两条腿的守卫同姿势(core 的 gate-match 仍是 fail-closed 兜底)。
+        // ⚠️ 门放在 parked 赎回腿**之前**:赎回腿同样只铸 policy_ask outcome,错门 cp 在那条链上只会更深地炸。
+        // D-D SLA deny-sweep 不受影响:它的取行查询本就只选 gate_kind IN ('human','irreversible_ask')。
+        const decideGateKind = cp.gate?.kind;
+        if (decideGateKind !== "human" && decideGateKind !== "irreversible_ask") {
+            return {
+                status: 409,
+                body: {
+                    error: `task is suspended on a '${decideGateKind ?? "unknown"}' gate, not a tool approval — a plan_review gate is resolved via POST /v1/assistant/tasks/:id/plan_review, a resource_limit suspension via POST /v1/assistant/tasks/:id/resume`,
+                    errorCode: "gate_not_tool_approval",
+                },
+            };
+        }
         // design/153 件3d parked 赎回腿([1574]/[1584]/[1588] core 裁定;src/parked-decide.ts):该 pending
         // checkpoint 若属于一个 parked 后台子代,decide 必须走 claim→裸 execute(reviveClaim) 链——legacy 腿的
         // resumeStream 会绕开 bg registry(无 consumeParkedFlip、行永 parked、生命周期分叉),故 parked-first。
@@ -1243,7 +1264,7 @@ export function createHttpServer(rawDeps) {
             if (e instanceof HttpError) {
                 return {
                     status: 409,
-                    body: { error: `resume blocked by an admission policy change: ${e.message}`, code: "resume_blocked_by_policy", errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) },
+                    body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) },
                 };
             }
             throw e;
@@ -1871,7 +1892,6 @@ export function createHttpServer(rawDeps) {
                     status,
                     body: {
                         error: e.message,
-                        code: e.code,
                         // invalid_outcome means DIFFERENT things per gate: for policy_ask it IS the D-1 action-binding
                         // mismatch; for plan_review/dry_run_review it is a content-sanitize reject (editedPlan/reason carried a
                         // forbidden tag) — give those a gate-appropriate code so the UI routes to the right recovery, not the
@@ -2210,7 +2230,7 @@ export function createHttpServer(rawDeps) {
         res.setHeader("retry-after", String(adm.retryAfterSec));
         // E4 定稿:429 带 typed code + center 结构化字段 verbatim 透传(windowType/remaining/resetAt/
         // isEstimate/pool)——人话文案归壳/web(契约如此),error 串保留旧消费者兼容。
-        sendError(res, 429, "quota_exhausted", "budget exhausted (quota lease)", { code: "quota_exhausted", retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) });
+        sendError(res, 429, "quota_exhausted", "budget exhausted (quota lease)", { retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) });
         return true;
     }
     /** Apply the per-principal rate limit; responds 429 and returns true when the caller is over. */

package/dist/http/sse-log.js

@@ -55,7 +55,7 @@ export async function streamSseLog(req, res, provider, id, staleMs) {
         if (Date.now() - start > MAX_MS) {
             // BL-16: cap reached but the run continues — emit a terminal reconnect signal (not a silent close, which
             // a client couldn't distinguish from a completed run). Distinct from the `failed`/`done` run events.
-            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", code: "STREAM_MAX_DURATION", message: "stream reached its 15-minute cap — reconnect with Last-Event-ID to continue (the run is still active)" })}\n\n`);
+            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "stream reached its 15-minute cap — reconnect with Last-Event-ID to continue (the run is still active)" })}\n\n`);
             break;
         }
         if (events.length === 0) {

package/dist/main.js

@@ -237,7 +237,7 @@ async function main() {
             setTitleIfNull: titleCapable.setTitleIfNull.bind(sessionStore),
             probeTitle: titleCapable.probeTitle.bind(sessionStore),
             redact: redactSecrets, // audit 2026-07-13: scrub a model-echoed secret before persist/list/log
-            llm: (o) => hookLlm({ prompt: o.prompt, timeoutMs: o.timeoutMs }),
+            llm: (o) => hookLlm({ prompt: o.prompt, timeoutMs: o.timeoutMs, model: o.model }),
             logger,
             metrics,
         })

package/dist/model-select.d.ts

@@ -10,7 +10,7 @@
  * untrusted body/text can pick WHICH configured model but can never inject a baseUrl/apiKey (parseModelMention
  * only ever returns an allow-listed catalog name).
  *
- * [865]②(clay 生产实锤:onboard 选 kimi 实跑 Qwen):
+ * [865]②(生产实锤:面板上选了 A 模型,实际跑的是目录里的另一个):
  *  - explicit ref 走 name+id 双键索引({@link matchCatalogModel})——壳 boot 回读的 mainLoopModel 是 **id 形**,
  *    目录键是 **name 形**,单键索引把 id 形请求当「未知」静默落 default = session 中途静默换模型(最恶性的
  *    上下文污染路径)。

package/dist/model-select.js

@@ -11,7 +11,7 @@ import { parseModelMention } from "@sema-agent/core";
  * untrusted body/text can pick WHICH configured model but can never inject a baseUrl/apiKey (parseModelMention
  * only ever returns an allow-listed catalog name).
  *
- * [865]②(clay 生产实锤:onboard 选 kimi 实跑 Qwen):
+ * [865]②(生产实锤:面板上选了 A 模型,实际跑的是目录里的另一个):
  *  - explicit ref 走 name+id 双键索引({@link matchCatalogModel})——壳 boot 回读的 mainLoopModel 是 **id 形**,
  *    目录键是 **name 形**,单键索引把 id 形请求当「未知」静默落 default = session 中途静默换模型(最恶性的
  *    上下文污染路径)。

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -1,6 +1,6 @@
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import { type Checkpoint, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type ResumeOutcome, type ResolveExpectation, type ReopenReason, type RiskDescriptor } from "@sema-agent/core";
+import { type Checkpoint, type CheckpointGate, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type ResumeOutcome, type ResolveExpectation, type ReopenReason, type RiskDescriptor } from "@sema-agent/core";
 import { type SqlDriver } from "./sql-driver.js";
 /**
  * design/80 D-1 (§3 invariant #3 — crash-safe reaper backstop): an ABSOLUTE upper bound on a pending
@@ -38,10 +38,18 @@ export interface PendingCheckpoint {
      *  resume binds to the EXACT action they saw (a stale view is then rejected fail-closed PRE-CAS). `boundCallId`
      *  === `toolCallId` (the pending tool call); `boundInputHash` is the server-minted opaque hash of the shown
      *  input (NEVER recomputed by the portal — echoed verbatim). Surfacing them here is what makes the D-1 TOCTOU
-     *  guard REACHABLE by the portal (without it the portal can only do the unbound legacy fallback). `null` on a
-     *  pre-D-1 / legacy-deserialized checkpoint ⇒ the consumer falls back to the unbound resolve. */
-    boundCallId: string | null;
-    boundInputHash: string | null;
+     *  guard REACHABLE by the portal (without it the portal can only do the unbound legacy fallback).
+     *  🔴 [1995]②: ABSENT (key omitted, never `null`) on a park with no tool action (plan_review /
+     *  resource_limit / task_done) or a pre-D-1 legacy row ⇒ the consumer falls back to the unbound resolve.
+     *  The wire contract (§1) is "an absent nullable field is OMITTED, not null" — a `null` here invited a
+     *  consumer to treat the key's PRESENCE as "there is a binding" and echo `null` back into /decide. */
+    boundCallId?: string;
+    boundInputHash?: string;
+    /** 🔴 [1995]③ (additive): the checkpoint's gate kind — the operator queue mixes tool approvals with
+     *  plan_review / resource_limit / task_done parks (all of which carry `toolName: null`), so a durable-recovery
+     *  consumer needs this to ROUTE a row to the right wire (`/decide` vs `/plan_review` vs `/resume`). Absent
+     *  only for a legacy SQL row suspended before the `gate_kind` column existed. */
+    gateKind?: CheckpointGate["kind"];
     /** The suspended run's taskId (task_active join) — the key to the run/trace ("view task context"). */
     taskId: string | null;
     /** The pending tool call's args (post-hook), redacted + bounded — for tool_approval the write payload, for a

package/dist/plugins/checkpoint-store-sql.js

@@ -305,13 +305,15 @@ export class SqlCheckpointStore {
      *  joined from task_active (the JOIN KEY to the run/trace — a suspended run KEEPS its
      *  session claim, so the join is live for every pending row; null only in pathological windows). */
     async listPending(scope) {
-        const base = "SELECT c.session_id, c.scope, c.tool_name, c.tool_call_id, c.tool_input, c.bound_input_hash, c.risk_descriptor, c.created_at, c.deadline, ta.task_id " +
+        const base = "SELECT c.session_id, c.scope, c.tool_name, c.tool_call_id, c.tool_input, c.bound_input_hash, c.risk_descriptor, c.created_at, c.deadline, c.gate_kind, ta.task_id " +
             "FROM checkpoint c LEFT JOIN task_active ta ON ta.session_id = c.session_id WHERE c.status='pending'";
         const { rows } = scope
             ? await this.db.query(`${base}${this.q(" AND c.scope=?", " AND c.scope=$1")} ORDER BY c.created_at ASC`, [scope])
             : await this.db.query(`${base} ORDER BY c.created_at ASC`);
         const out = rows.map((r) => {
             const toolCallId = r.tool_call_id ?? null;
+            const boundInputHash = r.bound_input_hash ?? null;
+            const gateKind = r.gate_kind ?? null;
             return {
                 sessionId: String(r.session_id),
                 scope: String(r.scope),
@@ -319,8 +321,13 @@ export class SqlCheckpointStore {
                 toolCallId,
                 // D-1: boundCallId === the pending tool call id; boundInputHash is the server-minted opaque hash. The
                 // portal echoes BOTH on /decide so the resume binds to the exact action shown (TOCTOU guard reachable).
-                boundCallId: toolCallId,
-                boundInputHash: r.bound_input_hash ?? null,
+                // [1995]②: a park with no tool action (plan_review / resource_limit / task_done — both columns NULL)
+                // OMITS the keys entirely; the wire contract says absent, never `null` (LOCAL twin does the same).
+                ...(toolCallId !== null ? { boundCallId: toolCallId } : {}),
+                ...(boundInputHash !== null ? { boundInputHash } : {}),
+                // [1995]③ additive: the gate kind the row is parked on (NULL only on a pre-`gate_kind` legacy row) —
+                // lets a durable-recovery consumer route plan / tool / resource off this ONE queue.
+                ...(gateKind !== null ? { gateKind } : {}),
                 taskId: r.task_id ?? null,
                 // Both drivers return the JSON column already parsed; null for pre-migration rows. PG 库内恒干净
                 // (拒绝式)——直读即审阅面=执行面。

package/dist/plugins/local-checkpoint-store.js

@@ -192,8 +192,14 @@ export class LocalCheckpointStore {
                 scope: cp.scope,
                 toolName: pa?.toolName ?? null,
                 toolCallId,
-                boundCallId: toolCallId,
-                boundInputHash: pa?.boundInputHash ?? null,
+                // [1995]②: the D-1 binding fields are OMITTED when the park has no tool action (plan_review /
+                // resource_limit / task_done) — the wire contract says an absent nullable field is ABSENT, not `null`
+                // (a consumer branching on "key present ⇒ there is a binding" would echo `null` back into /decide).
+                ...(toolCallId !== null ? { boundCallId: toolCallId } : {}),
+                ...(pa?.boundInputHash !== undefined ? { boundInputHash: pa.boundInputHash } : {}),
+                // [1995]③ additive: which gate this row is parked on, so a durable-recovery consumer can route
+                // plan / tool / resource off the SAME queue (toolName is null for every non-tool gate).
+                ...(gate?.kind !== undefined ? { gateKind: gate.kind } : {}),
                 taskId: (await this.opts.getActiveTaskId?.(cp.sessionId)) ?? null,
                 input: boundedToolInput(pa?.args),
                 createdAt: cp.createdAt,