@sema-agent/server 2.0.1 → 3.1.0

package/dist/capabilities/scenarios.js

@@ -14,9 +14,11 @@ import { skillsForScenario } from "./skills.js";
  * the operator configured — not Claude/Anthropic), so the agent never inherits the model's training-time
  * "I am Claude" hallucination.
  *
- * Live-caught incident (a Qwen3.5 deployment self-described as "running on a DeepSeek model"):
- * NOTHING substrate-specific may be hardcoded here — onboard is multi-provider (Qwen/GLM/Kimi/self-hosted
- * vLLM…), so a baked maker name makes every non-DeepSeek deployment misstate its own substrate. Same for
+ * Live-caught incident (a deployment served by one model family described itself as running on a DIFFERENT
+ * vendor's model, because that vendor's name was baked into this text):
+ * NOTHING substrate-specific may be hardcoded here — onboard is multi-provider (any OpenAI-/Anthropic-
+ * compatible endpoint, self-hosted vLLM included), so a baked maker name makes every deployment that is not
+ * that maker's misstate its own substrate. Same for
  * the gateway protocol (the brain stack serves Anthropic-compatible routes too — routing brain +
  * createAnthropicBrain — so "OpenAI-compatible gateway" would be the same class of lie). Neutral wording
  * (zero core-seam need; interpolating the model id would need a `StablePromptContext.model`

package/dist/config-center/apply-effective.js

@@ -25,9 +25,10 @@ function toModel(m, envDefaults = {}) {
         name: m.name,
         provider: m.provider,
         api: m.api,
-        // 实机 /model 切 Kimi 404 定谳: a catalog model MAY carry its own gateway URL — the
+        // 实机 /model 切换 404 定谳: a catalog model MAY carry its own gateway URL — the
         // hardcoded "" made core's brain fall back to the boot-env endpoint, so cross-endpoint `body.model`
-        // selection hit the WRONG gateway (kimi id → Qwen vLLM → 404). Absent still = "" (brain env default;
+        // selection hit the WRONG gateway (a model id routed to a gateway that does not serve it → 404).
+        // Absent still = "" (brain env default;
         // byte-compat for single-gateway rosters). core brain honors model.baseUrl; keys stay per-model via apiKeyEnv.
         baseUrl: m.baseUrl ?? "",
         // BL-8 extended (systematic-audit): fall back to the ENV-derived model's reasoning, not Boolean(undefined)=false —
@@ -220,7 +221,7 @@ export function applyEffective(config, eff, logger, opts = {}) {
         // NOTE: the wire face (this module's EffectiveConfig) carries the JSON body verbatim, so tierGroups ride
         // eff.models even though CenterModel doesn't type them — resolveActiveTiers reads them structurally.
         const activeTiers = resolveActiveTiers(eff.models) ?? {};
-        // [865]①(clay 生产实锤:onboard 选 kimi 实跑 Qwen)显式默认解析——enabled[0] 会被任何改变 pool 顺序的写
+        // [865]①(生产实锤:面板上选了 A 模型,实际跑的是目录里的另一个)显式默认解析——enabled[0] 会被任何改变 pool 顺序的写
         // 静默翻转,default 必须消费 wire 里已有的显式意图。解析单源 = resolveDefaultModelName(dry-run 的
         // wouldDefaultModel 共用同一只,报数与真 apply 永不撕裂——codex M2)。
         const picked = resolveDefaultModelName(eff, (n) => models[n] !== undefined, enabled[0].name, (source, name) => logger?.warn("sema_registry_default_dangling", { source, name, hint: "explicit default names a model that is not in the enabled catalog — falling to the next source" }));

package/dist/config-center/restart-signal.d.ts

@@ -1,5 +1,13 @@
 import type { EffectiveConfig } from "./types.js";
-export type RestartSlice = "skills" | "mcp" | "scenarios" | "runtime-gates" | "models-tiers";
+export type RestartSlice = "skills" | "mcp" | "scenarios" | "runtime-gates" | "models-tiers" | "degrade-route";
+/** What the CALLER must contribute about boot-baked catalog consumers that live OUTSIDE the Runner — the
+ *  slices cannot see them, because they are configured from env (`ServiceConfig`), not from the center's
+ *  EffectiveConfig. Absent/empty = that lane is off ⇒ its slice is inert (null on both sides). */
+export interface RestartSliceCtx {
+    /** `config.degrade.to` when REACTIVE degrade is on (env `MODEL_DEGRADE_TO` + `MODEL_DEGRADE_REACTIVE`);
+     *  undefined = the lane is off ⇒ no degrading brain was composed ⇒ nothing is boot-frozen. */
+    reactiveDegradeTo?: string;
+}
 /** Structured restart signal an orchestrator consumes (GET /health → `restart`). Change-detected against the
  *  process's BOOT config, NOT presence — so it stays absent when nothing baked-at-boot changed (presence would
  *  re-fire every refresh → a restart LOOP). `restartRequired` is always true when this object exists. */
@@ -16,7 +24,7 @@ export interface RestartSignal {
  *  nothing baked-at-boot changed (only hot-apply slices moved, or nothing) → no restart needed. An orchestrator
  *  can auto rolling-restart on a non-empty result WITHOUT a restart loop, because the comparison is always
  *  against boot (a refresh that re-fires the same diff is idempotent, not a fresh trigger). */
-export declare function restartReasons(boot: EffectiveConfig | undefined, current: EffectiveConfig): RestartSlice[];
+export declare function restartReasons(boot: EffectiveConfig | undefined, current: EffectiveConfig, ctx?: RestartSliceCtx): RestartSlice[];
 /** codex R10 (models-tiers 窗收口): TRUE when the MODEL PLANE (enabled models + active tier table + resolved
  *  default) of `next` differs from the last-APPLIED plane `prev`. Under a tier-frozen Runner (tiers non-empty at
  *  construction → private expanded copy) main.ts DEFERS the whole plane mutation until restart when this is true —

package/dist/config-center/restart-signal.js

@@ -7,7 +7,7 @@
  */
 import { resolveActiveTiers } from "@sema-agent/registry-core";
 import { RUNTIME_GATE_KEYS, runtimeGatePresent, resolveDefaultModelName } from "./apply-effective.js";
-const RESTART_SLICES = ["skills", "mcp", "scenarios", "runtime-gates", "models-tiers"];
+const RESTART_SLICES = ["skills", "mcp", "scenarios", "runtime-gates", "models-tiers", "degrade-route"];
 /** Canonical, key-sorted JSON (array order preserved) so two semantically-equal effective slices fingerprint
  *  identically regardless of object key order from the center serializer. */
 function stableStringify(v) {
@@ -31,7 +31,22 @@ function enabledOnly(rows) {
         return null;
     return rows.filter((r) => r.enabled !== false);
 }
-function restartSliceValue(eff, slice) {
+/** The degrade hop is built from the FULLY-DERIVED Model (`toModel`), so almost every catalog field on the
+ *  target reaches it (id → body.model, baseUrl → the endpoint, provider → which brain, maxTokens/compat/
+ *  extraBody/input → the request body, apiKeyEnv → the construction-time credential). We therefore fingerprint
+ *  the WHOLE entry minus the two fields that are provably HOT — `cost` (refreshed via
+ *  `mutateInPlace(pricing, buildPricing(config.models))`) and `quotaWeight` (via
+ *  `mutateInPlace(config.modelQuotaWeights, …)`) — so a pure re-pricing never restarts a worker. A DENY-list
+ *  (not an allow-list) on purpose: a catalog field added later rides the fingerprint automatically, so the
+ *  failure mode of drift is a spurious restart, never a silently missed one. */
+function degradeRouteFingerprint(entry) {
+    // `enabled` is dropped too, but for a different reason: `enabledOnly` already filtered on it, so among the
+    // entries that reach here it is `true`-or-absent — two encodings of ONE state. Keeping it would let a center
+    // serializer that starts/stops emitting the explicit `true` manufacture a restart out of nothing.
+    const { cost: _cost, quotaWeight: _quotaWeight, enabled: _enabled, ...route } = entry;
+    return route;
+}
+function restartSliceValue(eff, slice, ctx) {
     if (!eff)
         return null;
     switch (slice) {
@@ -69,14 +84,23 @@ function restartSliceValue(eff, slice) {
             const def = resolveDefaultModelName(eff, (n) => names.has(n), enabled?.[0]?.name ?? "");
             return { models: enabled, tiers: active, default: def.name };
         }
+        case "degrade-route": {
+            const to = ctx?.reactiveDegradeTo;
+            if (to === undefined)
+                return null; // lane off — no degrading brain exists to go stale
+            // Present↔absent is itself a change: with no enabled entry named `to`, createBrain composes NO
+            // degrading shell at all, so the flip only takes effect at the next boot.
+            const target = (enabledOnly(eff.models?.models) ?? []).find((m) => m.name === to);
+            return target ? degradeRouteFingerprint(target) : null;
+        }
     }
 }
 /** Restart-to-apply slices that DIFFER between this process's BOOT config and a freshly-pulled one. Empty =
  *  nothing baked-at-boot changed (only hot-apply slices moved, or nothing) → no restart needed. An orchestrator
  *  can auto rolling-restart on a non-empty result WITHOUT a restart loop, because the comparison is always
  *  against boot (a refresh that re-fires the same diff is idempotent, not a fresh trigger). */
-export function restartReasons(boot, current) {
-    return RESTART_SLICES.filter((s) => stableStringify(restartSliceValue(boot, s)) !== stableStringify(restartSliceValue(current, s)));
+export function restartReasons(boot, current, ctx) {
+    return RESTART_SLICES.filter((s) => stableStringify(restartSliceValue(boot, s, ctx)) !== stableStringify(restartSliceValue(current, s, ctx)));
 }
 /** codex R10 (models-tiers 窗收口): TRUE when the MODEL PLANE (enabled models + active tier table + resolved
  *  default) of `next` differs from the last-APPLIED plane `prev`. Under a tier-frozen Runner (tiers non-empty at

package/dist/config-lkg.d.ts

@@ -11,7 +11,8 @@ export interface PersistedLkg {
  *  `<dir>/<sha-hex>` 落盘,读侧**必验 hash**(content-addressed 的全部意义;坏文件=忽略重拉)。 */
 export declare function defaultSkillCacheDir(): string;
 /** 默认路径(scheduler store 同门:SEMA_CONFIG_DIR → ~/.sema)。`CONFIG_LKG_PATH` 覆写;
- *  `CONFIG_LKG_ENABLED=false` 关闭(读写双关;design/158 B4 正名前叫 `CONFIG_LKG_DISABLED=true`,兼容期内仍认)。 */
+ *  `CONFIG_LKG_ENABLED=false` 关闭(读写双关)。🪦 正名前的 `CONFIG_LKG_DISABLED` 自 server 3.0.0 起是
+ *  **fail-loud 墓碑**——设了(任何值)即拒启并指路新名,不再被读取。 */
 export declare function defaultLkgPath(worker: string | undefined): string;
 /** 原子落盘一个干净候选(tmp+rename,0600)。BEST-EFFORT:失败=一条 warn 的素材(调用方发),绝不
  *  影响在飞的应用链——LKG 缓存丢失的代价只是下次冷启动回到 env 兜底。 */

package/dist/config-lkg.js

@@ -30,7 +30,8 @@ export function defaultSkillCacheDir() {
     return join(process.env.SEMA_CONFIG_DIR ?? join(homedir(), ".sema"), "skill-cache");
 }
 /** 默认路径(scheduler store 同门:SEMA_CONFIG_DIR → ~/.sema)。`CONFIG_LKG_PATH` 覆写;
- *  `CONFIG_LKG_ENABLED=false` 关闭(读写双关;design/158 B4 正名前叫 `CONFIG_LKG_DISABLED=true`,兼容期内仍认)。 */
+ *  `CONFIG_LKG_ENABLED=false` 关闭(读写双关)。🪦 正名前的 `CONFIG_LKG_DISABLED` 自 server 3.0.0 起是
+ *  **fail-loud 墓碑**——设了(任何值)即拒启并指路新名,不再被读取。 */
 export function defaultLkgPath(worker) {
     const dir = process.env.SEMA_CONFIG_DIR ?? join(homedir(), ".sema");
     const key = (worker ?? "global").replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 64);

package/dist/config-types.d.ts

@@ -34,7 +34,7 @@ export interface ImageBakeConfig {
      *  2026-07-13, SWR 弃用): `docker.io/claybobby`(海外主源;CN 兜底=内网 Gitea registry)。 */
     registry: string | null;
     /** The build-host promoted fetch-once cache base injected as `--cache-base` (NEVER caller-settable — a foreign
-     *  origin would defeat the domestic-only iron rule). `BAKE_CACHE_BASE` (e.g. http://172.17.0.1:8099). */
+     *  origin would defeat the domestic-only iron rule). `BAKE_CACHE_BASE` (e.g. `http://<build-host>:<port>`). */
     cacheBase: string | null;
     /** The pinned current sandbox-base ref injected as `--base-ref` when the caller omits `baseRef` (§P2.4c default).
      *  When NULL the server falls back to the index's latest published `sandbox-base` digest (design §P2.4c
@@ -575,8 +575,9 @@ export interface ServiceConfigFlat {
     /** design/113 C4: host-lane project-memory injection (CLAUDE.md + git narrative). Default **ON** (subject to the
      *  host-lane + single-user gate), so "open like CC" works without config. `PROJECT_MEMORY_ENABLED=false` opts out.
      *  design/158 B4 (lens4 N8): this was `projectMemoryDisabled` — the ONE negative boolean on a ServiceConfig whose
-     *  other 16 flags are positive `*Enabled`/`*Allowed`, so every read site had to invert twice. The retired env name
-     *  `PROJECT_MEMORY_DISABLED` still works for one deprecation window (inverted, with a boot notice). */
+     *  other 16 flags are positive `*Enabled`/`*Allowed`, so every read site had to invert twice. 🪦 server 3.0.0:
+     *  the retired env name `PROJECT_MEMORY_DISABLED` is a **fail-loud tombstone** — setting it (any value) refuses
+     *  boot with a message naming this knob; it is no longer read. */
     projectMemoryEnabled: boolean;
     /** R7: override the shared scheduler store path. Default `SEMA_CONFIG_DIR`→`~/.sema/scheduled_tasks.json` (the
      *  server writer + the shell daemon reader MUST agree). `SCHEDULER_STORE_PATH`. */
@@ -689,8 +690,9 @@ export interface ServiceConfigFlat {
      *  ON for the host lane (CC-parity); set `LSP_HOST_ENABLED=false` to opt out. (`REMOTE_EXEC=host` only — ssh/adb/
      *  local-docker can't reach a local child process to the right filesystem.)
      *  design/158 B4 (lens4 N7): this lane used to share `LSP_ENABLED` with `lspEnabled` above — one env name driving
-     *  two OPPOSITE defaults. It now has its own knob; `LSP_ENABLED=false` remains a back-compat host opt-out (with a
-     *  boot notice naming the replacement) and `LSP_HOST_ENABLED` wins whenever it is set. */
+     *  two OPPOSITE defaults. It now has its own knob. 🪦 server 3.0.0: `LSP_ENABLED=false` (the pre-split host
+     *  opt-out) is a **fail-loud tombstone** — it refuses boot naming `LSP_HOST_ENABLED`; `LSP_ENABLED=true` keeps
+     *  its own meaning (the sandbox lane's opt-in above) and is unaffected. */
     lspHostEnabled: boolean;
     /** Graceful drain: how long SIGTERM waits for in-flight turns (live streams + bg/resume legs on this
      *  instance) to finish before the hard shutdown. During drain, new billable submissions get 503+Retry-After and

package/dist/config.d.ts

@@ -43,33 +43,38 @@ export declare function logConfigDiagnostics(logger: {
  *  Note the deliberate non-migrations: the posture family (`postureOn`) keeps its tri-state — its unset case is
  *  neither `true` nor `false` but "single-user ∧ infra-ready" — and the sentinel-valued knobs (`MEMORY_ENGINE`,
  *  `SANDBOX_PKG_SOURCE`, `MANUAL_MODE_SHELL_GATE`) are enums wearing a boolean's clothes, not booleans. */
-type ConfigKnobSource = "env" | "legacy-env" | "posture" | "default";
+/** 复审 2026-07-29 B4:3.0.0 把负名 env 改成 fail-loud 墓碑之后,legacy-env 这个 source 取值**永不可达**——
+ *  留着它等于在类型上书面承诺"还有一条 legacy 取值路径"。同批摘掉的还有 `ConfigKnobRecord.legacyName`
+ *  与它在 boot 诊断行里的输出:运维在日志里看到 `legacyName: HOST_BG_DISABLED` 的合理结论是"旧名还能
+ *  用",而实际设了就拒启——诊断面撒的谎比没有诊断更贵(它会让人先去试那个必然拒启的开关)。 */
+type ConfigKnobSource = "env" | "posture" | "default";
 export interface ConfigKnobRecord {
-    /** The CANONICAL env name (the positive one — a legacy alias appears in `legacyName`, never here). */
+    /** The env name. 3.0.0 起只有这一个名字 —— 负名别名已是墓碑(见 `boolEnvWithLegacyNegated`)。 */
     name: string;
     /** `opt-in` = default OFF, `opt-out` = default ON, `posture` = default derived from REQUIRE_PRINCIPAL ∧ infra. */
     polarity: "opt-in" | "opt-out" | "posture";
     value: boolean;
     source: ConfigKnobSource;
-    /** Set when the value came from (or the knob still accepts) a deprecated negative-form alias. */
-    legacyName?: string;
 }
 /** The registered boolean knobs, sorted by name — the data behind `logConfigDiagnostics`'s polarity table. */
 export declare function configKnobTable(): ConfigKnobRecord[];
-/** design/158 N8 (D-family) — a knob whose CANONICAL name is positive (`X_ENABLED`, default ON) but which keeps
- *  its retired negative name (`X_DISABLED`) working for one deprecation window.
+/** design/158 N8 (D-family) + server 3.0.0 墓碑 —— a knob whose CANONICAL name is positive (`X_ENABLED`,
+ *  default ON) and whose retired negative name (`X_DISABLED`) is now a **fail-loud tombstone**.
  *
  *  Why the flip at all: `X_DISABLED !== "true"` is a double negative at the read site, so the four knobs that
  *  used it (`PROJECT_MEMORY`, `CONFIG_LKG`, `HOST_BG`, `HOST_EXEC_SPOOL`) could not be read for their default
  *  without inverting twice in your head, and `projectMemoryDisabled` was the ONE negative boolean on a
  *  `ServiceConfig` that otherwise carries 16 positive `*Enabled`/`*Allowed` fields.
  *
- *  Resolution order (new name wins, so there is never an ambiguous both-set state):
+ *  🔴 3.0.0([1989],clay 令「不做兼容」):旧名不再有兼容窗——**设了就拒启**。这个函数保留 legacy 形参
+ *  不是为了继续读它,而正是为了**认出它在场并拒绝启动**(把墓碑放在唯一知道这对名字关系的地方)。
+ *
+ *  Resolution order:
  *   1. `X_ENABLED` set to a literal ⇒ that.
- *   2. `X_ENABLED` set to a non-literal ⇒ default + warning (the legacy name is NOT consulted — a typo in the
- *      new name must not silently hand control back to the deprecated one).
- *   3. `X_ENABLED` unset ∧ `X_DISABLED` set ⇒ the legacy site's exact contract, `X_DISABLED !== "true"`, plus a
- *      one-shot deprecation notice naming the replacement.
+ *   2. `X_ENABLED` set to a non-literal ⇒ default + warning (the tombstone is NOT consulted — a typo in the
+ *      new name must not turn into a boot refusal about an env the operator never set).
+ *   3. `X_ENABLED` unset ∧ `X_DISABLED` set(**任何值**,含 `"false"`)⇒ throw,文案指路新名。选拒启不选
+ *      静默忽略:静默会让升级部署的旧开关名义在、实际归默认——比拒启危险,且下游冒烟测试测不出来。
  *   4. neither ⇒ default. */
 export declare function boolEnvWithLegacyNegated(name: string, legacyNegatedName: string, def: boolean): boolean;
 /** LKG (last-known-good) persistence of the remote effective-config fetch. Read LAZILY at both main.ts sites

package/dist/config.js

@@ -132,7 +132,6 @@ export function logConfigDiagnostics(logger) {
                 polarity: k.polarity,
                 value: k.value,
                 source: k.source,
-                ...(k.legacyName ? { legacyName: k.legacyName } : {}),
             });
         }
     }
@@ -164,9 +163,6 @@ function optFinitePositiveEnv(name) {
 /** Keyed by canonical name so a knob read twice in one load (e.g. DURABLE_APPROVAL, once for the D-G boot
  *  invariant and once for the returned field) registers one row, not two. Reset per `loadConfig()`. */
 const CONFIG_KNOBS = new Map();
-/** Deprecated aliases already announced for this load — the lazily-read twins (HOST_BG/HOST_EXEC_SPOOL) resolve
- *  again on every use, and an operator does not need the same deprecation line once per command. */
-const KNOB_DEPRECATIONS_SEEN = new Set();
 /** The registered boolean knobs, sorted by name — the data behind `logConfigDiagnostics`'s polarity table. */
 export function configKnobTable() {
     return [...CONFIG_KNOBS.values()].sort((a, b) => a.name.localeCompare(b.name));
@@ -199,20 +195,23 @@ function boolEnv(name, def) {
     registerKnob({ name, polarity: def ? "opt-out" : "opt-in", value, source });
     return value;
 }
-/** design/158 N8 (D-family) — a knob whose CANONICAL name is positive (`X_ENABLED`, default ON) but which keeps
- *  its retired negative name (`X_DISABLED`) working for one deprecation window.
+/** design/158 N8 (D-family) + server 3.0.0 墓碑 —— a knob whose CANONICAL name is positive (`X_ENABLED`,
+ *  default ON) and whose retired negative name (`X_DISABLED`) is now a **fail-loud tombstone**.
  *
  *  Why the flip at all: `X_DISABLED !== "true"` is a double negative at the read site, so the four knobs that
  *  used it (`PROJECT_MEMORY`, `CONFIG_LKG`, `HOST_BG`, `HOST_EXEC_SPOOL`) could not be read for their default
  *  without inverting twice in your head, and `projectMemoryDisabled` was the ONE negative boolean on a
  *  `ServiceConfig` that otherwise carries 16 positive `*Enabled`/`*Allowed` fields.
  *
- *  Resolution order (new name wins, so there is never an ambiguous both-set state):
+ *  🔴 3.0.0([1989],clay 令「不做兼容」):旧名不再有兼容窗——**设了就拒启**。这个函数保留 legacy 形参
+ *  不是为了继续读它,而正是为了**认出它在场并拒绝启动**(把墓碑放在唯一知道这对名字关系的地方)。
+ *
+ *  Resolution order:
  *   1. `X_ENABLED` set to a literal ⇒ that.
- *   2. `X_ENABLED` set to a non-literal ⇒ default + warning (the legacy name is NOT consulted — a typo in the
- *      new name must not silently hand control back to the deprecated one).
- *   3. `X_ENABLED` unset ∧ `X_DISABLED` set ⇒ the legacy site's exact contract, `X_DISABLED !== "true"`, plus a
- *      one-shot deprecation notice naming the replacement.
+ *   2. `X_ENABLED` set to a non-literal ⇒ default + warning (the tombstone is NOT consulted — a typo in the
+ *      new name must not turn into a boot refusal about an env the operator never set).
+ *   3. `X_ENABLED` unset ∧ `X_DISABLED` set(**任何值**,含 `"false"`)⇒ throw,文案指路新名。选拒启不选
+ *      静默忽略:静默会让升级部署的旧开关名义在、实际归默认——比拒启危险,且下游冒烟测试测不出来。
  *   4. neither ⇒ default. */
 export function boolEnvWithLegacyNegated(name, legacyNegatedName, def) {
     const raw = process.env[name];
@@ -234,21 +233,17 @@ export function boolEnvWithLegacyNegated(name, legacyNegatedName, def) {
         source = "default";
     }
     else if (legacy !== undefined && legacy !== "") {
-        value = legacy !== "true"; // verbatim legacy contract: only the literal "true" disabled the feature
-        source = "legacy-env";
-        if (!KNOB_DEPRECATIONS_SEEN.has(legacyNegatedName)) {
-            KNOB_DEPRECATIONS_SEEN.add(legacyNegatedName);
-            CONFIG_NOTICES.push({
-                event: "config_env_deprecated_negated_name",
-                fields: { deprecated: legacyNegatedName, replacement: name, effective: String(value) },
-            });
-        }
+        // server 3.0.0([1989],clay 令「不做兼容」):负名旧 env = fail-loud 墓碑。设了(任何值,含
+        // "false"——设它的人同样以为它还生效)即拒启并指路新名。选拒启不选静默忽略:静默会让升级部署的
+        // 旧开关名义在、实际归默认——比拒启危险,而且下游/运维的冒烟测试测不出来。
+        throw new Error(`${legacyNegatedName} was removed in server 3.0.0 — set ${name}=${legacy !== "true"} instead ` +
+            `(positive-name knob, default ${def ? "on" : "off"}; migration table in USAGE.md)`);
     }
     else {
         value = def;
         source = "default";
     }
-    registerKnob({ name, polarity: def ? "opt-out" : "opt-in", value, source, legacyName: legacyNegatedName });
+    registerKnob({ name, polarity: def ? "opt-out" : "opt-in", value, source });
     return value;
 }
 /** LKG (last-known-good) persistence of the remote effective-config fetch. Read LAZILY at both main.ts sites
@@ -474,7 +469,15 @@ function parseStoreDomain(ctx) {
 function parseModelDomain() {
     // npm 卫生纪律:默认值不烤内网坐标 — localhost 占位(公开分发正确缺省);真网关一律显式 env。
     const gatewayBaseUrl = env("MODEL_GATEWAY_BASEURL", "http://127.0.0.1:8000/v1");
-    const modelId = env("MODEL_ID", "Qwen3.5-35B");
+    // server 3.0.0([1992] 真机 400 案根治):MODEL_ID **无出厂缺省**。旧缺省是一个只在开发环境存在的
+    // 模型名,对任何外部部署都必炸——且炸在离根因最远的地方(gateway 400 + title hook 连环告警),
+    // 用户看不出是没配模型。fail-loud at boot 指路配置,与 env 墓碑同哲学:让问题在最早、最清楚处现形。
+    const modelId = env("MODEL_ID", "");
+    if (modelId === "") {
+        throw new Error("MODEL_ID is required (no factory default since server 3.0.0) — set MODEL_ID=<model name your gateway serves>, " +
+            "or configure models via the sema-registry catalog; the old silent default was an internal-only model name " +
+            "that made every external deployment fail far from the cause (gateway 400)");
+    }
     // Model.api must reflect the brain that actually serves it (routing is by provider): an "anthropic"
     // provider runs the Anthropic brain, whose usage reports `input` EXCLUDING cached tokens. core ≥1.22
     // normalizes the cache-hit-rate denominator per api family — a wrong api makes promptTokens too small
@@ -915,16 +918,11 @@ function parseOrchestrationDomain(ctx) {
     // `LSP_ENABLED=false` keeps working as a host opt-out (it was the only one operators ever had) with a notice
     // naming the replacement, and `LSP_HOST_ENABLED` always wins when set.
     const lspHostEnabled = (() => {
-        const explicitHost = process.env.LSP_HOST_ENABLED;
-        if (explicitHost === undefined || explicitHost === "") {
-            if (process.env.LSP_ENABLED === "false") {
-                CONFIG_NOTICES.push({
-                    event: "config_env_deprecated_lane_alias",
-                    fields: { deprecated: "LSP_ENABLED=false", replacement: "LSP_HOST_ENABLED=false", lane: "host", effective: "false" },
-                });
-                registerKnob({ name: "LSP_HOST_ENABLED", polarity: "opt-out", value: false, source: "legacy-env", legacyName: "LSP_ENABLED" });
-                return false;
-            }
+        // server 3.0.0([1989],不做兼容):`LSP_ENABLED=false` 的 host 腿别名形 = fail-loud 墓碑。
+        // `LSP_ENABLED=true`(沙箱腿 opt-in 正名)不受影响——墓碑只咬「用沙箱名关 host 腿」的旧姿势。
+        if (process.env.LSP_ENABLED === "false") {
+            throw new Error("LSP_ENABLED=false no longer drives the HOST lane (removed in server 3.0.0) — set LSP_HOST_ENABLED=false " +
+                "for the host lane; LSP_ENABLED remains the SANDBOX-lane opt-in only (migration table in USAGE.md)");
         }
         return boolEnv("LSP_HOST_ENABLED", true);
     })();
@@ -1302,7 +1300,6 @@ export function loadConfig() {
     CONFIG_WARNINGS.length = 0; // repeated loadConfig() calls (test setup) must not accumulate stale warnings
     CONFIG_NOTICES.length = 0;
     CONFIG_KNOBS.clear(); // the polarity table describes THIS load, never a previous one's env
-    KNOB_DEPRECATIONS_SEEN.clear();
     // Posture gate: single-user turnkey (`REQUIRE_PRINCIPAL !== "true"` = one trusted super-admin on their own
     // box/tenant, CC's trust model) ⇒ the CC capability set defaults ON, each composed with its infra prereq; multi-tenant
     // (requirePrincipal) stays opt-in (gated + secured). This is the SAME discriminator LSP's host-default-ON uses,

package/dist/hooks/hook-llm.js

@@ -1,3 +1,4 @@
+import { matchCatalogModel } from "../model-select.js";
 export function createHookLlm(deps) {
     const { config, metrics } = deps;
     // anthropic 路由自己的 baseUrl(与 core createAnthropicBrain 同一解析链:model.baseUrl || config.baseUrl
@@ -40,6 +41,14 @@ export function createHookLlm(deps) {
         }
         if (config.models[requested])
             return shape(requested);
+        // 复审 2026-07-29 D1:目录键是 **name** 形,而调用点会传 **provider id** 形——`http/routes/tasks.ts`
+        // 的 titler 腿([1992]②「标题跟 turn」)对对象形 spec 传的就是 `spec.model.id`。registry 热应用后
+        // name 与 id 常态分叉(目录键是运维起的短名,`Model.id` 是 provider 侧的真名),单键索引下这类请求全落到下面那条
+        // 「不在目录里」⇒ 用户每选一次非主模型,标题就 llm_failed(对话本身正常),与 [1992] 同族的病形。
+        // 双键索引沿用同仓先例 [865]② `matchCatalogModel`:name 优先、id 扫目录值、跳过 `default` 别名键。
+        const byId = matchCatalogModel(requested, config.models);
+        if (byId !== undefined)
+            return shape(byId);
         if (requested === config.model.id)
             return shapeFrom(requested, config.model, requested);
         return { ok: false, error: `hook model "${requested}" is not in this deployment's catalog` };

package/dist/http/routes/approvals-assistant.js

@@ -746,7 +746,7 @@ export async function streamApprovals(req, res, cs, scope, pollMs = APPROVALS_ST
         }
         prev = cur;
         if (Date.now() - start > MAX_MS) {
-            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", code: "STREAM_MAX_DURATION", message: "approvals stream reached its 15-minute cap — reconnect to continue" })}\n\n`);
+            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "approvals stream reached its 15-minute cap — reconnect to continue" })}\n\n`);
             break;
         }
         if (Date.now() - lastBeat > 15_000) {

package/dist/http/routes/attachments.js

@@ -61,7 +61,7 @@ async function handleAttachmentsBody(req, res, url, ctx, miss) {
                 }
                 const allow = deps.config.attachmentMimeAllowlist;
                 if (allow && !allow.some((a) => a === mime || (a.endsWith("/*") && mime.startsWith(a.slice(0, -1))))) {
-                    sendError(res, 415, "attachment.mime_not_allowed", `mime '${mime}' is not in this deployment's allowlist`, { code: "attachment.mime_not_allowed", allowed: allow });
+                    sendError(res, 415, "attachment.mime_not_allowed", `mime '${mime}' is not in this deployment's allowlist`, { allowed: allow });
                     return;
                 }
                 const max = deps.config.attachmentMaxBytes ?? 32 * 1024 * 1024;
@@ -71,7 +71,7 @@ async function handleAttachmentsBody(req, res, url, ctx, miss) {
                 }
                 catch (err) {
                     if (err instanceof HttpError && err.status === 413) {
-                        sendError(res, 413, "attachment.too_large", `attachment exceeds the per-file limit (${max} bytes)`, { code: "attachment.too_large", maxBytes: max });
+                        sendError(res, 413, "attachment.too_large", `attachment exceeds the per-file limit (${max} bytes)`, { maxBytes: max });
                         return;
                     }
                     throw err;

package/dist/http/routes/memory-policy.js

@@ -76,11 +76,11 @@ async function handleMemoryPolicyBody(req, res, url, ctx, miss) {
             scope = decodeURIComponent(url.slice("/v1/memory/sync/".length));
         }
         catch {
-            sendError(res, 400, "memory_sync_invalid_scope", "malformed percent-encoding in :scope", { code: "memory_sync_invalid_scope" });
+            sendError(res, 400, "memory_sync_invalid_scope", "malformed percent-encoding in :scope");
             return;
         }
         if (scope.length === 0) {
-            sendError(res, 400, "memory_sync_invalid_scope", "missing :scope", { code: "memory_sync_invalid_scope" });
+            sendError(res, 400, "memory_sync_invalid_scope", "missing :scope");
             return;
         }
         if (scope !== formatUserScope(principal) && !explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
@@ -90,7 +90,7 @@ async function handleMemoryPolicyBody(req, res, url, ctx, miss) {
         const body = await readJson(req); // 413/400 (oversize / bad JSON) via the typed top-level catch — auth already done
         const parsed = parseMemorySyncRequest(body, scope);
         if (!parsed.ok) {
-            sendError(res, 422, "memory_sync_invalid_body", parsed.error, { code: "memory_sync_invalid_body" });
+            sendError(res, 422, "memory_sync_invalid_body", parsed.error);
             return;
         }
         try {

package/dist/http/routes/runs.js

@@ -154,7 +154,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             const taskId = clientTaskId ?? uuidv7();
             const created = await runStore.createRun(taskId, sessionId, prepared.auth?.principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));
             if (created.ok)
-                deps.sessionTitler?.maybeTitle(sessionId, prepared.spec.objective); // fire-and-forget session auto-title
+                deps.sessionTitler?.maybeTitle(sessionId, prepared.spec.objective, typeof prepared.spec.model === "string" ? prepared.spec.model : prepared.spec.model?.id); // fire-and-forget;model 跟 turn([1992]②)
             if (!created.ok) {
                 // race twin: two concurrent same-taskId submits (gateway retry racing the original) — the loser's
                 // session claim collides with ITS OWN taskId → idempotent 202 replay, not a 409 (the run exists, once).

package/dist/http/routes/session-sync.js

@@ -234,7 +234,7 @@ async function handleSessionSyncBody(req, res, url, ctx, miss) {
                 if (deps.snapshotBlobSqlCapBytes !== undefined && body.byteLength > deps.snapshotBlobSqlCapBytes) {
                     // 复审 D-F1/B-F2:归一漏网(多行体,旧门正则扫不到)——A6 迁移到 sendError 后此站点由
                     // errorCode 必填位置参数保结构(不再靠源级反射门兜底)。
-                    sendError(res, 413, "blob_too_large_for_sql", `blob of ${body.byteLength} bytes exceeds this deployment's SQL snapshot-blob cap (${deps.snapshotBlobSqlCapBytes} bytes — TiDB's txn-entry-size-limit is the low wall at 6MiB by default; the mysql-protocol packet limit sits above it) — configure MinIO object storage (MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY) for large snapshot blobs, or raise SNAPSHOT_BLOB_SQL_MAX_BYTES if your deployment lifted those limits`, { code: "blob_too_large_for_sql" });
+                    sendError(res, 413, "blob_too_large_for_sql", `blob of ${body.byteLength} bytes exceeds this deployment's SQL snapshot-blob cap (${deps.snapshotBlobSqlCapBytes} bytes — TiDB's txn-entry-size-limit is the low wall at 6MiB by default; the mysql-protocol packet limit sits above it) — configure MinIO object storage (MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY) for large snapshot blobs, or raise SNAPSHOT_BLOB_SQL_MAX_BYTES if your deployment lifted those limits`);
                     return;
                 }
                 if (createHash("sha256").update(body).digest("hex") !== hash) {
@@ -246,7 +246,7 @@ async function handleSessionSyncBody(req, res, url, ctx, miss) {
                 // blob as durably stored when it isn't.
                 const put = await fs.putBlob(hash, new Uint8Array(body));
                 if (!put.ok) {
-                    sendError(res, 502, put.error.code, "blob store write failed", { code: put.error.code });
+                    sendError(res, 502, put.error.code, "blob store write failed");
                     return;
                 }
                 res.writeHead(204).end(); // no body

package/dist/http/routes/sessions.js

@@ -796,7 +796,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
                 if (typeof fs.blobSizes === "function") {
                     const known = (await fs.blobSizes([hash])).get(hash);
                     if (known !== undefined && known > cap) {
-                        sendError(res, 413, "workspace_file_too_large", "file exceeds the single-file read limit — download it via the archive endpoint", { code: "workspace_file_too_large", sizeBytes: known, limit: cap });
+                        sendError(res, 413, "workspace_file_too_large", "file exceeds the single-file read limit — download it via the archive endpoint", { sizeBytes: known, limit: cap });
                         return;
                     }
                 }
@@ -806,7 +806,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
                     return;
                 }
                 if (bytes.byteLength > cap) {
-                    sendError(res, 413, "workspace_file_too_large", "file exceeds the single-file read limit — download it via the archive endpoint", { code: "workspace_file_too_large", sizeBytes: bytes.byteLength, limit: cap });
+                    sendError(res, 413, "workspace_file_too_large", "file exceeds the single-file read limit — download it via the archive endpoint", { sizeBytes: bytes.byteLength, limit: cap });
                     return;
                 }
                 // [1894]③:content-type 按扩展名(保守表,未知=octet-stream)+ 二进制判别头(首 8KiB NUL/控制

package/dist/http/routes/tasks.js

@@ -214,7 +214,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     const tid = earlyDurableTid ?? uuidv7(); // reuse the id already emitted as the X-Task-Id header (defensive mint if absent)
                     const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));
                     if (created.ok)
-                        deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective); // fire-and-forget; in-titler dedupe
+                        deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective, typeof prepared.spec.model === "string" ? prepared.spec.model : prepared.spec.model?.id); // fire-and-forget; in-titler dedupe;model 跟 turn([1992]②)
                     if (!created.ok) {
                         const conflict = { error: "session already has an active run — POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)", errorCode: "conflict.session_active_run", activeTaskId: created.activeTaskId };
                         // Headers are already SSE — encode the rejection as the stream's terminal event; the 409 in
@@ -966,7 +966,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));
                     if (!created.ok)
                         return { status: 409, body: { error: "session already has an active run — POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)", errorCode: "conflict.session_active_run", activeTaskId: created.activeTaskId } };
-                    deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective); // fire-and-forget session auto-title
+                    deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective, typeof prepared.spec.model === "string" ? prepared.spec.model : prepared.spec.model?.id); // fire-and-forget;model 跟 turn([1992]②)
                     durableTaskId = tid;
                 }
                 if (deps.checkpointStore && prepared.spec.sessionId) {

package/dist/http/routes/trace-usage.js

@@ -269,13 +269,13 @@ async function streamTaskTrace(req, res, runStore, taskId, staleMs) {
         }
         const stale = Date.now() - new Date(run.updatedAt).getTime() > staleMs;
         if (stale && events.length === 0) {
-            res.write(`event: error\ndata: ${JSON.stringify({ code: "WORKER_DOWN", message: "run stalled (instance lost?)" })}\n\n`);
+            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "WORKER_DOWN", message: "run stalled (instance lost?)" })}\n\n`);
             break;
         }
         if (Date.now() - start > MAX_MS) {
             // BL-16: the stream hit its 15-min cap but the RUN is still going — emit a terminal event so the client
             // can tell "reconnect to continue" from "task completed" (a silent close looked like completion).
-            res.write(`event: error\ndata: ${JSON.stringify({ code: "STREAM_MAX_DURATION", message: "trace stream reached its 15-minute cap — reconnect with Last-Event-ID to continue (the run is still active)" })}\n\n`);
+            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "trace stream reached its 15-minute cap — reconnect with Last-Event-ID to continue (the run is still active)" })}\n\n`);
             break;
         }
         if (events.length === 0) {

package/dist/http/routes/workflows.js

@@ -485,8 +485,10 @@ async function streamWorkflowRun(req, res, runId, scope) {
         }
     }
     catch {
+        // A1/A6/B:归一 error 帧形(`type` + 机器码)。此前只发人话 message ⇒ 消费端要么锚文案、要么把
+        // "流断了"和"流正常结束"混为一谈;`workflow.stream_error` 是本帧的铸码(附录 A `*.stream_error` 族)。
         if (!closed && !res.writableEnded)
-            res.write(`event: error\ndata: ${JSON.stringify({ message: "workflow stream error" })}\n\n`);
+            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "workflow.stream_error", message: "workflow stream error" })}\n\n`);
     }
     finally {
         clearInterval(hb);

package/dist/http/server.d.ts

@@ -197,7 +197,7 @@ export interface ServiceCoordinatorDeps {
     leaderEndpoint?: LeaderEndpoint;
     /** Fire-and-forget session auto-titler (first-submit hook; absent = feature dark). */
     sessionTitler?: {
-        maybeTitle(sessionId: string, objective: string): void;
+        maybeTitle(sessionId: string, objective: string, model?: string): void;
     };
 }
 /** **函数/构件缝**:main.ts 把跨多个子系统的动作编译成一个可调用面交给路由(路由不该自己