@sema-agent/server 3.22.0 → 3.24.0

package/dist/bake-runner/main.d.ts

@@ -1,4 +1,4 @@
-import { type ImageApiClient, type ChildSpawner, type HostOps } from "./runner.js";
+import { type ImageApiClient, type ChildSpawner, type HostOps, type BakeRunnerLogger } from "./runner.js";
 interface RunnerEnv {
     imageApiBase: string;
     token: string;
@@ -14,7 +14,7 @@ interface RunnerEnv {
 declare function loadEnv(): RunnerEnv;
 /** The real image-api HTTP client. Authenticates claim/heartbeat with the runner bearer; ingest additionally
  *  carries the per-bake ingest secret header (so image-api can reject a stale/rogue runner — §P2.4e). */
-declare function makeApiClient(env: RunnerEnv): ImageApiClient;
+declare function makeApiClient(env: RunnerEnv, log: BakeRunnerLogger): ImageApiClient;
 /** The real child spawner: `setsid`-style detached process GROUP so a cancel/deadline kill signals the whole tree
  *  (channel-close / a plain kill of the immediate child does NOT stop a detached build — §P2.11). */
 declare function makeSpawner(): ChildSpawner;

package/dist/bake-runner/main.js

@@ -11,6 +11,7 @@ import { spawn, exec as execCb } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { promisify } from "node:util";
 import { createLogger } from "../observability/logger.js";
+import { parseNumOrFailNonNegative } from "../config.js";
 import { BakeRunner, } from "./runner.js";
 const exec = promisify(execCb);
 function loadEnv() {
@@ -28,14 +29,22 @@ function loadEnv() {
         recipeDir: process.env.RECIPE_DIR || "/opt/recipes",
         buildShPath: process.env.BUILD_SH_PATH || "e2b-template/dev-sandbox/build.sh",
         dataDir: process.env.BAKE_DATA_DIR || "/data",
-        heartbeatMs: Number(process.env.BAKE_HEARTBEAT_MS || "30000"),
-        idlePollMs: Number(process.env.BAKE_IDLE_POLL_MS || "5000"),
-        minFreeGb: Number(process.env.IMAGE_BAKE_MIN_FREE_GB || "20"),
+        // A2/E5 (gap-sweep 2026-08-01): these were bare `Number(process.env.X || default)` — a unit-suffixed or
+        // typo'd value (`"30s"`) silently became NaN, and NaN survives every downstream `??`/`?? default` guard
+        // (those only catch null/undefined). The fallout is a SILENT-LOOSENING pair: `clock.sleep(NaN)` resolves
+        // ~immediately (`setTimeout(fn, NaN)` behaves like a 0ms timer) turning the lease heartbeat into a tight
+        // POST loop against image-api, and `freeGb < NaN` is always false so the pre-flight disk guard silently
+        // never fires. `parseNumOrFailNonNegative` (config.ts, shared with leader/wire.ts's four resource knobs)
+        // fails loud at bake-runner startup instead — non-numeric OR negative both throw; unset/empty still falls
+        // back to the documented default (zero behavior change on the happy path).
+        heartbeatMs: parseNumOrFailNonNegative("BAKE_HEARTBEAT_MS", process.env.BAKE_HEARTBEAT_MS || "30000"),
+        idlePollMs: parseNumOrFailNonNegative("BAKE_IDLE_POLL_MS", process.env.BAKE_IDLE_POLL_MS || "5000"),
+        minFreeGb: parseNumOrFailNonNegative("IMAGE_BAKE_MIN_FREE_GB", process.env.IMAGE_BAKE_MIN_FREE_GB || "20"),
     };
 }
 /** The real image-api HTTP client. Authenticates claim/heartbeat with the runner bearer; ingest additionally
  *  carries the per-bake ingest secret header (so image-api can reject a stale/rogue runner — §P2.4e). */
-function makeApiClient(env) {
+function makeApiClient(env, log) {
     const auth = { authorization: `Bearer ${env.token}`, "content-type": "application/json" };
     return {
         // Long-poll claim (§P2.12): the bare `POST …/bakes/claim` finds the oldest queued bake AND leases it in one
@@ -46,13 +55,27 @@ function makeApiClient(env) {
                 headers: auth,
                 body: JSON.stringify({ runnerId: env.runnerId }),
             });
-            if (res.status === 204 || res.status === 409)
-                return null; // empty queue, or lost the single-flight CAS
-            if (!res.ok)
+            if (res.status === 204)
+                return null; // empty queue — the routine "nothing to do" case, no log line
+            // C6/C1 (2026-08-01): 401 (bad runner credential) / 409 (lost the single-flight CAS to another runner
+            // replica) / 5xx previously fell into this SAME silent-`null` branch as an empty queue — a misconfigured
+            // BAKE_RUNNER_TOKEN and a healthy idle runner were indistinguishable from the outside (both just idle-poll
+            // forever with zero log lines). `bake_claim_error` (loop()'s catch) only fires on a THROWN error — a non-ok
+            // HTTP response never throws — so this warn is the only trace a non-2xx claim response leaves anywhere.
+            if (!res.ok) {
+                log.warn("bake_claim_rejected", { status: res.status });
                 return null;
+            }
             const c = (await res.json());
-            if (!c.bakeId || !Array.isArray(c.argv) || !c.ingestSecret)
+            if (!c.bakeId || !Array.isArray(c.argv) || !c.ingestSecret) {
+                // A malformed 2xx body is worse than a rejection: image-api's claim call ATOMICALLY leases the bake
+                // server-side before returning it, so a shape we refuse to trust here is a bake already checked OUT
+                // from the queue that we are about to drop on the floor. We still can't safely act on an untrusted
+                // shape (no bakeId ⇒ no way to release/fail it), so this warn is the only surfacing point until
+                // image-api's stale-lease reaper reclaims it (§P2.7) — see runner.ts module doc for the reaper backstop.
+                log.warn("bake_claim_malformed", { status: res.status, bakeId: typeof c.bakeId === "string" ? c.bakeId : undefined });
                 return null;
+            }
             return {
                 bakeId: c.bakeId,
                 argv: c.argv.map(String),
@@ -223,7 +246,7 @@ async function main() {
         minFreeGb: env.minFreeGb,
     }); // NB: the token + per-bake ingest secret are NEVER logged (§P2.4e)
     const runner = new BakeRunner({
-        api: makeApiClient(env),
+        api: makeApiClient(env, log),
         spawner: makeSpawner(),
         host: makeHostOps(env),
         clock: makeClock(),

package/dist/boot/config-center.js

@@ -780,7 +780,11 @@ export async function createConfigCenterRuntime(ctx) {
                                 // expanded admission gate while core throws "Unknown model ref" until restart. Hot-apply is safe
                                 // only when BOTH generations are tier-less.
                                 const planeDeferred = (runnerTierFrozen || planeHasActiveTiers(r.effective)) && modelPlaneChanged(appliedPlaneEff, r.effective);
-                                applyEffective(config, r.effective, logger, { teamsOnly: true, sealedKeys, ...(planeDeferred ? { deferModelPlane: true } : {}) });
+                                const committed = applyEffective(config, r.effective, logger, { teamsOnly: true, sealedKeys, ...(planeDeferred ? { deferModelPlane: true } : {}) });
+                                // [2283]③:CAS 拒绝(更旧世代)⇒ 本拍整体跳过——prompts 采用/pricing/keyResolver/restart
+                                // 对账/etag 推进/LKG 落盘都不得从旁路半应用同一个被拒世代(拒绝 warn 已在 applyEffective 留痕)。
+                                if (!committed)
+                                    return;
                                 if (planeDeferred) {
                                     logger.warn("models_tiers_plane_deferred", { version: r.effective.version, note: "tier-frozen Runner: the changed model plane (models/roles/tiers/default) is NOT hot-applied — admission stays on the Runner's generation; restart applies the new plane (models-tiers restart signal rides /health)" });
                                 }
@@ -954,7 +958,10 @@ export async function createConfigCenterRuntime(ctx) {
                     // this late arrival — if it froze a tier-expanded copy, the arriving center plane must not hot-apply
                     // (admission/Runner split). Tier-less env boot (the common deferred-boot shape) keeps true hot-apply.
                     const planeDeferredLate = (runnerTierFrozen || planeHasActiveTiers(r.effective)) && modelPlaneChanged(appliedPlaneEff, r.effective);
-                    applyEffective(config, r.effective, logger, { teamsOnly: true, sealedKeys, ...(planeDeferredLate ? { deferModelPlane: true } : {}) });
+                    const committedLate = applyEffective(config, r.effective, logger, { teamsOnly: true, sealedKeys, ...(planeDeferredLate ? { deferModelPlane: true } : {}) });
+                    // [2283]③(refresh 腿同款):CAS 拒绝 ⇒ 迟到 boot 拍整体跳过,旁路消费与 etag/LKG 都不动。
+                    if (!committedLate)
+                        return;
                     if (planeDeferredLate)
                         logger.warn("models_tiers_plane_deferred", { version: r.effective.version, note: "tier-frozen Runner (env tiers): the late-boot center model plane is NOT hot-applied — restart applies it" });
                     else {

package/dist/capabilities/center-plugins.js

@@ -180,7 +180,7 @@ export async function applyCenterPlugins(baseline, eff, opts) {
             }
             if (!rootCheck.dir)
                 continue; // 无 skills 目录:合法(commands-only 插件,cli 壳的半场)
-            const loaded = loadSkills(rootCheck.dir);
+            const loaded = loadSkills(rootCheck.dir, { confineTo: liveDir }); // 不可信 lane:逐条目约束在 clone root 内(根守卫只守了 skills 根,根下 symlink 可逃逸) // 不可信 lane:逐条目约束在 clone root 内(根守卫只守了 skills 根,根下 symlink 可逃逸) // 不可信 lane:逐条目约束在 clone root 内(根守卫只守了 skills 根,根下 symlink 可逃逸)
             for (const skill of loaded) {
                 if (taken.has(skill.spec.name)) {
                     // 收紧④:plugin 让位(方向与 center-wins 相反,理由见模块顶注)。

package/dist/capabilities/skills.d.ts

@@ -31,7 +31,18 @@ export interface LoadedSkill {
     /** Scenarios this skill applies to; empty = global (every scenario). */
     scenarios: string[];
 }
-export declare function loadSkills(dir: string): LoadedSkill[];
+/** 加载 lane 的信任级。缺席(受控 lane:烤制进镜像的 skills 目录)= 维持既有语义,symlink 照跟
+ *  ——那个便利是有意的(`foo.md -> 共享文件`)。`confineTo` 在场(**不可信 lane**:第三方 git checkout,
+ *  见 center-plugins 的 plugin 装载)= 每个被读条目 realpath 后必须仍在该根之内,逃逸即抛。
+ *  🔴 为什么信任级必须是**参数**而不是注释里的假设:本函数的头注原写着「skills dir 全受控」,而
+ *  center-plugins 把它原样复用在 attacker-controlled 的 git checkout 上——git 原样保留仓里的 symlink,
+ *  于是 checkout 里某个 skill 条目(`任意 .md -> /宿主/任意文件`)会被读进 spec.files 进入提示词。resolvePluginSkillsRoot
+ *  只 realpath 守了 skills **根**,根下逐条目没守。 */
+export interface LoadSkillsOptions {
+    /** 不可信 lane 的约束根(通常=clone root)。缺席=受控 lane,不做逐条目约束。 */
+    confineTo?: string;
+}
+export declare function loadSkills(dir: string, opts?: LoadSkillsOptions): LoadedSkill[];
 /** Skills applicable to a scenario: those tagged with it, plus untagged (global) ones. */
 export declare function skillsForScenario(loaded: LoadedSkill[], scenario: string): SkillSpec[];
 export declare function parseFrontmatter(raw: string): {

package/dist/capabilities/skills.js

@@ -1,6 +1,20 @@
-import { readdirSync, readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
-export function loadSkills(dir) {
+import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { join, sep } from "node:path";
+/** `p` 的 realpath 必须落在 `rootReal` 之内(含自身),否则抛。`sep` 边界判定防 `/a/root-evil` 撞
+ *  `/a/root` 前缀。目标不存在 ⇒ realpath 抛 ENOENT,同样是拒绝(悬空链接不该被读)。 */
+function assertConfined(p, rootReal) {
+    let real;
+    try {
+        real = realpathSync(p);
+    }
+    catch (e) {
+        throw new Error(`skill entry ${p} is unreadable (dangling symlink or missing): ${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (real !== rootReal && !real.startsWith(rootReal + sep)) {
+        throw new Error(`skill entry ${p} escapes the plugin root (resolves outside ${rootReal}) — untrusted checkouts may not link to host files`);
+    }
+}
+export function loadSkills(dir, opts) {
     let entries;
     try {
         entries = readdirSync(dir, { withFileTypes: true });
@@ -21,17 +35,22 @@ export function loadSkills(dir) {
     // sort 保证加载顺序稳定(冲突报错的"先到者"也因此确定)。dotfile/dot 目录跳过(.DS_Store/.git 类
     // 环境杂物,不是 skill 内容);isFileLike 兼容 symlink(Dirent.isFile() 对 symlink 恒 false,而旧扁平
     // 实现 readFileSync 是跟链接的——不兼容会让 skills 目录下 `foo.md -> 共享文件` 这种软链无声消失)。
+    const confineRoot = opts?.confineTo !== undefined ? realpathSync(opts.confineTo) : undefined;
     const isFileLike = (entry, p) => entry.isFile() || (entry.isSymbolicLink() && statSync(p).isFile());
     const isDirLike = (entry, p) => entry.isDirectory() || (entry.isSymbolicLink() && statSync(p).isDirectory());
     for (const entry of entries.slice().sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))) {
         if (entry.name.startsWith("."))
             continue;
         if (isFileLike(entry, join(dir, entry.name)) && entry.name.endsWith(".md")) {
+            if (confineRoot !== undefined)
+                assertConfined(join(dir, entry.name), confineRoot);
             const raw = readFileSync(join(dir, entry.name), "utf8");
             push(parseSkill(raw, entry.name.replace(/\.md$/, "")), join(dir, entry.name));
         }
         else if (isDirLike(entry, join(dir, entry.name))) {
             const skillDir = join(dir, entry.name);
+            if (confineRoot !== undefined)
+                assertConfined(skillDir, confineRoot);
             let raw;
             try {
                 raw = readFileSync(join(skillDir, "SKILL.md"), "utf8");
@@ -41,8 +60,10 @@ export function loadSkills(dir) {
                 // 整个 skill 无声丢掉 → fail-loud
                 throw new Error(`skill directory ${skillDir} has no SKILL.md`);
             }
+            if (confineRoot !== undefined)
+                assertConfined(join(skillDir, "SKILL.md"), confineRoot);
             const skill = parseSkill(raw, entry.name);
-            const files = collectAttachments(skillDir, "");
+            const files = collectAttachments(skillDir, "", confineRoot);
             if (files.length > 0)
                 skill.spec.files = files;
             push(skill, join(skillDir, "SKILL.md"));
@@ -53,7 +74,7 @@ export function loadSkills(dir) {
 /** 目录形态附件:递归收 SKILL.md 之外的一切文件,path=相对 skill 目录(posix 斜杠),sort 稳定。
  *  dotfile/dot 目录跳过(交叉评审 M3):skill 目录若从别的 checkout 整拷,.git/config、.env 类隐藏物
  *  会连凭据一起进 spec.files 变成提示词可见附件——附件只收显式内容文件。symlink 跟链接(同扁平兼容)。 */
-function collectAttachments(skillDir, rel) {
+function collectAttachments(skillDir, rel, confineRoot) {
     const files = [];
     const here = rel === "" ? skillDir : join(skillDir, rel);
     for (const entry of readdirSync(here, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
@@ -64,9 +85,13 @@ function collectAttachments(skillDir, rel) {
         const dirLike = entry.isDirectory() || (entry.isSymbolicLink() && statSync(abs).isDirectory());
         const fileLike = entry.isFile() || (entry.isSymbolicLink() && statSync(abs).isFile());
         if (dirLike) {
-            files.push(...collectAttachments(skillDir, relPath));
+            if (confineRoot !== undefined)
+                assertConfined(abs, confineRoot);
+            files.push(...collectAttachments(skillDir, relPath, confineRoot));
         }
         else if (fileLike && relPath !== "SKILL.md") {
+            if (confineRoot !== undefined)
+                assertConfined(abs, confineRoot);
             files.push({ path: relPath, content: readFileSync(abs, "utf8") });
         }
     }

package/dist/config-center/apply-effective.d.ts

@@ -8,11 +8,14 @@ import type { EffectiveConfig } from "./types.js";
  *  `this.deps.models/roles/pricing` LIVE per-task and `/v1/models` reads `config.models` — both share the
  *  reference captured at boot, so mutating it (vs reassigning) updates both with no split, no Runner rebuild. */
 export declare function mutateInPlace<V>(target: Record<string, V>, source: Record<string, V>): void;
+/** 返回值=是否 COMMIT(false 仅在 [2283]③ 世代序 CAS 拒绝时)。caller 收到 false 必须把**同一世代的
+ *  旁路消费**(prompts 采用/pricing/keyResolver/etag 推进/LKG 落盘)一并跳过——否则 applyEffective 拒了
+ *  主面、旁路却半应用同一个被拒世代,混合世代从侧门回来。首次 apply(live 未登记)恒 true。 */
 export declare function applyEffective(config: ServiceConfig, eff: EffectiveConfig, logger?: Logger, opts?: {
     teamsOnly?: boolean;
     sealedKeys?: SealedKeyOpener;
     deferModelPlane?: boolean;
-}): void;
+}): boolean;
 /**
  * Apply the center `runtime` governance/limit gates OVER the env-derived config (mutates `config`).
  *
@@ -42,23 +45,6 @@ export type RuntimeGateKey = (typeof RUNTIME_GATE_KEYS)[number];
  *  divides by it; center's `.positive()` already enforces, belt-and-suspenders here). */
 export declare function runtimeGatePresent(rt: NonNullable<EffectiveConfig["runtime"]>, key: RuntimeGateKey): boolean;
 export declare function applyRuntimeGates(config: ServiceConfig, rt: EffectiveConfig["runtime"], logger?: Logger): void;
-/**
- * Apply the runtime governance "second baton" (center §10): `autonomy` + `commandPolicy`. UNLIKE the 6 gates in
- * {@link applyRuntimeGates}, these are per-request HOT (read live in main.ts `resolveSpec` via
- * `applyRuntimeGovernance`), so they apply on BOTH boot and refresh (NOT via RUNTIME_GATE_KEYS / restart-to-apply).
- *
- * 🔴 NON-STICKY (differs from the restart-to-apply gates on purpose — adversarial-review HIGH): a hot field that
- * center STOPS publishing must REVERT to the env baseline, not keep the last center value. The restart-to-apply
- * gates can be sticky because a refresh never touches them (the running middleware holds boot values until a
- * restart re-reads env+center); a HOT field has no such reset, so "absent ⇒ keep" would silently freeze a stale
- * center override (e.g. center published `auto`, then un-published it — the gate would stay OFF forever). So we
- * recompute every call as `present ? center : envBaseline`. The env baseline = `AUTONOMY` (re-derived, env is
- * immutable at runtime) for autonomy; `undefined` (no env scalar source) for commandPolicy.
- *
- * 🔴 commandPolicy is VALIDATED here (adversarial-review HIGH): an invalid command (glob/path/operator — which
- * core's EXACT-name matcher would silently never match → a hole) is rejected FAIL-LOUD and the prior good policy
- * is KEPT (a broken publish never half-applies a silently-weakened gate).
- */
 export declare function applyRuntimeHot(config: ServiceConfig, rt: EffectiveConfig["runtime"], logger?: Logger): void;
 /**
  * [865]① 显式默认解析——applyEffective 与 dry-run(logEffectiveDiff.wouldDefaultModel)共用的单源。优先级

package/dist/config-center/apply-effective.js

@@ -78,7 +78,74 @@ export function mutateInPlace(target, source) {
         delete target[k];
     Object.assign(target, source);
 }
+/** 每个 config 对象上一次 COMMIT 的世代号([2283]③ CAS 的 live 端)。WeakMap——config 回收即回收;
+ *  version 0(未发布/本地一次性 lane)不参与登记。 */
+const appliedGeneration = new WeakMap();
+/** 返回值=是否 COMMIT(false 仅在 [2283]③ 世代序 CAS 拒绝时)。caller 收到 false 必须把**同一世代的
+ *  旁路消费**(prompts 采用/pricing/keyResolver/etag 推进/LKG 落盘)一并跳过——否则 applyEffective 拒了
+ *  主面、旁路却半应用同一个被拒世代,混合世代从侧门回来。首次 apply(live 未登记)恒 true。 */
 export function applyEffective(config, eff, logger, opts = {}) {
+    const staged = stageEffective(config, eff, logger, opts);
+    const live = appliedGeneration.get(config);
+    if (staged.version > 0 && live !== undefined && staged.version < live) {
+        // [2283]③:两次拉取的 staging 并发/乱序完成时,慢的旧世代不得整体覆盖快的新世代——每次都是
+        // 「整世代」,但方向反了。拒绝必须留痕(C6);caller 的 etag 纪律本就只在 apply 成功后推进,
+        // 下一拍拉到的自然是更新的世代。等版本重放(etag 未推进的幂等重放)照常放行。
+        logger?.warn("sema_registry_stale_generation_refused", { staged: staged.version, live, note: "an older staged generation must not overwrite a newer committed one — refused whole; next poll replays" });
+        return false;
+    }
+    commitStaged(config, staged);
+    // ── post-commit notifications(全部世代描述性通知在最后一笔赋值之后,[2283]②)──
+    if (staged.modelPlane)
+        logger?.info("sema_registry_models", staged.modelPlane.infoLine);
+    if (staged.gatesInfo)
+        logger?.info("sema_registry_runtime", staged.gatesInfo);
+    if (Object.keys(staged.hot.infoLine).length > 0)
+        logger?.info("sema_registry_runtime_hot", staged.hot.infoLine);
+    for (const n of staged.teamsPlane?.notices ?? []) {
+        if (n.level === "warn")
+            logger?.warn(n.msg, n.fields);
+        else
+            logger?.info(n.msg, n.fields);
+    }
+    if (Object.keys(staged.projects).length > 0)
+        logger?.info("sema_registry_projects", { projects: Object.keys(staged.projects) });
+    return true;
+}
+/** COMMIT 段:纯赋值,零 await/零回调/零发射(源码钉守着——[2283]①②)。mutateInPlace/整对象重赋值/
+ *  registry 表整体换装(registerTeams/registerCollabWorkflows 皆为过滤+swap 的赋值形,无回调面)。 */
+function commitStaged(config, staged) {
+    const mp = staged.modelPlane;
+    if (mp) {
+        config.modelApiKeyEnv = mp.modelApiKeyEnv; // reassign ok — keyResolver is rebuilt from it on refresh (main.ts)
+        config.modelApiKeys = mp.modelApiKeys; // plaintext values — memory-only; poison markers ride the same map
+        mutateInPlace(config.modelQuotaWeights, mp.quotaWeights);
+        mutateInPlace(config.models, mp.models); // IN PLACE: keep the ref the Runner + /v1/models share (hot-apply)
+        config.model = config.models.default;
+        if (Object.keys(mp.roles).length > 0)
+            mutateInPlace(config.roles, mp.roles); // IN PLACE: Runner reads this.deps.roles live
+        mutateInPlace(config.tiers, mp.activeTiers);
+    }
+    if (staged.gateAssignments) {
+        for (const [k, v] of staged.gateAssignments)
+            config[k] = v;
+    }
+    if (staged.hot.setAutonomy)
+        config.autonomy = staged.hot.autonomyNext;
+    if (staged.hot.setCommandPolicy)
+        config.commandPolicy = staged.hot.commandPolicyNext;
+    const tp = staged.teamsPlane;
+    if (tp) {
+        registerTeams(tp.teams);
+        registerCollabWorkflows(tp.workflows);
+    }
+    mutateInPlace(config.projects, staged.projects); // IN PLACE: keep the ref per-request consumers captured at boot
+    if (staged.version > 0)
+        appliedGeneration.set(config, staged.version);
+}
+/** STAGE 段:一切计算/校验/解封/投影(可抛;抛=候选整体拒绝,活配置零触碰)。内容判定性 warn/error
+ *  (描述 eff 真伪,与是否 commit 无关)在此发;世代描述性 info 只装载荷,post-commit 发。 */
+function stageEffective(config, eff, logger, opts) {
     // version 0 / empty effective = the config-center has nothing for us yet — typically CONFIG_PUBLISH_MODE
     // is ON but nothing has been published. We do NOT wipe: models/roles fall back to env (the enabled>0
     // guard below), teams to BUILTIN_TEAMS (registerTeams resets to built-ins). Warn once at boot so the
@@ -96,6 +163,7 @@ export function applyEffective(config, eff, logger, opts = {}) {
     // split, no Runner rebuild, no core change. Caller (main.ts refresh) additionally refreshes `pricing` (same
     // ref) + rebuilds `keyResolver`. (Was startup-only when reassignment split the Runner's ref from config.)
     const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
+    let modelPlane;
     // codex R10: `deferModelPlane` skips the WHOLE model plane (models/roles/tiers + per-model keys) — main.ts
     // sets it when the Runner is tier-frozen (private expanded copy) and the plane changed: hot-applying would
     // split admission (/v1/models, catalog gates) from the Runner's frozen generation, letting a same-key retarget
@@ -189,11 +257,6 @@ export function applyEffective(config, eff, logger, opts = {}) {
                 logger?.warn("sema_registry_model_no_brain", { model: m.name, provider: m.provider, hint: "set ANTHROPIC_API_KEY in this service's env, else it mis-routes to the gateway brain" });
             }
         }
-        config.modelApiKeyEnv = modelApiKeyEnv; // reassign ok — keyResolver is rebuilt from it on refresh (main.ts)
-        // same rebuild contract; plaintext values — memory-only, never logged. Poison markers ride the same
-        // map (they ARE per-model key state: "configured but broken"); the cast bridges config.ts's
-        // plaintext-only field type until it is widened to Record<string, string | SealedKeyPoison>.
-        config.modelApiKeys = modelApiKeys; // 类型已放真(string | SealedKeyPoison),桥接 cast 退役
         // weight-at-burn 源:quotaWeight 按 name+id 双键索引(tracer 的 brain.call e.model=模型 id,
         // 目录键=name——双键免猜);非法值(≤0/NaN)按缺省 1 丢弃。IN PLACE 与 models 同批 hot-apply。
         const quotaWeights = {};
@@ -205,7 +268,6 @@ export function applyEffective(config, eff, logger, opts = {}) {
                     quotaWeights[m.id] = qw;
             }
         }
-        mutateInPlace(config.modelQuotaWeights, quotaWeights);
         const roles = {};
         for (const [role, tgt] of Object.entries(eff.models.roles ?? {})) {
             if ("model" in tgt)
@@ -225,15 +287,16 @@ export function applyEffective(config, eff, logger, opts = {}) {
         // 静默翻转,default 必须消费 wire 里已有的显式意图。解析单源 = resolveDefaultModelName(dry-run 的
         // wouldDefaultModel 共用同一只,报数与真 apply 永不撕裂——codex M2)。
         const picked = resolveDefaultModelName(eff, (n) => models[n] !== undefined, enabled[0].name, (source, name) => logger?.warn("sema_registry_default_dangling", { source, name, hint: "explicit default names a model that is not in the enabled catalog — falling to the next source" }));
-        const defaultName = picked.name;
-        const defaultSource = picked.source;
-        models.default = models[defaultName];
-        mutateInPlace(config.models, models); // IN PLACE: keep the ref the Runner + /v1/models share (hot-apply)
-        config.model = config.models.default;
-        if (Object.keys(roles).length > 0)
-            mutateInPlace(config.roles, roles); // IN PLACE: Runner reads this.deps.roles live
-        mutateInPlace(config.tiers, activeTiers);
-        logger?.info("sema_registry_models", { count: enabled.length, default: config.model.id, defaultSource, roles: Object.keys(roles), tiers: Object.keys(config.tiers), sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length });
+        models.default = models[picked.name];
+        modelPlane = {
+            models,
+            modelApiKeyEnv,
+            modelApiKeys,
+            quotaWeights,
+            roles,
+            activeTiers,
+            infoLine: { count: enabled.length, default: models.default.id, defaultSource: picked.source, roles: Object.keys(roles), tiers: Object.keys(activeTiers), sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length },
+        };
     }
     // Runtime governance/limit gates (phase-2): STARTUP only (restart-to-apply) — the live RateLimiter / CostQuota
     // / approval gate are built from `config` AFTER this in main.ts, so mutating it here before they're constructed
@@ -241,18 +304,18 @@ export function applyEffective(config, eff, logger, opts = {}) {
     // governance 切新位:治理三件优先读 governance 域(真值),runtime 旧位(双写镜像)fallback——
     // 双写期两处逐键相等语义不变;center 撤双写后 governance 即唯一来源。限额残余(rateLimit/cost 五件)仍在 runtime。
     const gatesView = eff.governance ? { ...eff.runtime, ...eff.governance } : eff.runtime;
-    if (!opts.teamsOnly)
-        applyRuntimeGates(config, gatesView, logger);
+    const gates = opts.teamsOnly ? undefined : stageRuntimeGates(gatesView);
     // Runtime governance "second baton" (center §10): autonomy + commandPolicy are per-request HOT (read live in
     // resolveSpec), NOT baked into boot middleware → apply on BOTH boot and refresh (outside the teamsOnly guard) so
     // they hot-reload. No restart-to-apply signal (they take effect on the next task without a restart).
-    applyRuntimeHot(config, gatesView, logger);
+    const hot = stageRuntimeHot(config, gatesView, logger);
     // Teams → registry (hot-reloadable; center overrides/extends the built-ins).
     // codex R11: teams + collab workflows carry MODEL REFERENCES (member.model / workflow model args) — when the
     // model plane is deferred (tier-frozen Runner, see the deferModelPlane guard above) these faces must defer
     // WITH it, or a candidate that atomically adds/retargets a model AND updates a team/workflow to reference it
     // publishes a mixed generation: the new template goes live while config.models/the Runner stay old (a new ref
     // fails as unknown; a same-name retarget silently executes stale). One catalog generation = one visibility.
+    let teamsPlane;
     if (opts.deferModelPlane !== true) {
         const teams = {};
         for (const t of (eff.teams?.teams ?? []).filter((t) => t.enabled !== false)) {
@@ -265,22 +328,22 @@ export function applyEffective(config, eff, logger, opts = {}) {
                 synthesizer: t.synthesizer ? { role: t.synthesizer.role, modelRole: t.synthesizer.modelRole, systemPrompt: t.synthesizer.systemPrompt } : undefined,
             };
         }
-        registerTeams(teams);
-        if (Object.keys(teams).length > 0)
-            logger?.info("sema_registry_teams", { teams: Object.keys(teams) });
         // collab → named-workflow projection(切片 1.5,design/140 统一解;切片① 的
         // TeamTemplate 投影已整体替换——纪律「别留双路径降级」)。可投影子集翻译成命名 workflow 注册条目
         // (执行体=core 内置 team-discussion 脚本,center 模板=defaultArgs 合并链第二级;键=collab id,shell
         // `/team`/LLM 经 Workflow({name}) 调用);子集外整条跳过+结构化上报,绝不静默降级。HOT:boot+refresh
-        // 双腿整表替换(非粘——center 停发即空表,内置 workflow 不受影响)。
+        // 双腿整表替换(非粘——center 停发即空表,内置 workflow 不受影响)。register* 在 commit 段成对换装。
         const projected = projectCollabToWorkflows(eff.collab?.templates);
-        registerCollabWorkflows(projected.workflows);
+        const notices = [];
+        if (Object.keys(teams).length > 0)
+            notices.push({ level: "info", msg: "sema_registry_teams", fields: { teams: Object.keys(teams) } });
         if (Object.keys(projected.workflows).length > 0)
-            logger?.info("sema_registry_collab_workflows", { workflows: Object.keys(projected.workflows) });
+            notices.push({ level: "info", msg: "sema_registry_collab_workflows", fields: { workflows: Object.keys(projected.workflows) } });
         if (projected.skipped.length > 0)
-            logger?.warn("sema_registry_collab_skipped", { skipped: projected.skipped });
+            notices.push({ level: "warn", msg: "sema_registry_collab_skipped", fields: { skipped: projected.skipped } });
         if (projected.notes.length > 0)
-            logger?.info("sema_registry_collab_notes", { notes: projected.notes });
+            notices.push({ level: "info", msg: "sema_registry_collab_notes", fields: { notes: projected.notes } });
+        teamsPlane = { teams, workflows: projected.workflows, notices };
     }
     // 142-S4 projects 域(registry-core 0.10.0):center 项目登记簿 → config.projects(键=
     // projectId)。消费是 per-request 查表(memoryScope 派生 + defaultScopes 种子,security.ts/main.ts),
@@ -304,9 +367,14 @@ export function applyEffective(config, eff, logger, opts = {}) {
             ...(Array.isArray(r.defaultScopes) ? { defaultScopes: r.defaultScopes.filter((x) => typeof x === "string") } : {}),
         };
     }
-    mutateInPlace(config.projects, projects); // IN PLACE: keep the ref per-request consumers captured at boot
-    if (Object.keys(projects).length > 0)
-        logger?.info("sema_registry_projects", { projects: Object.keys(projects) });
+    return {
+        version: typeof eff.version === "number" && Number.isFinite(eff.version) ? eff.version : 0,
+        ...(modelPlane !== undefined ? { modelPlane } : {}),
+        ...(gates !== undefined ? { gateAssignments: gates.assignments, ...(gates.info !== undefined ? { gatesInfo: gates.info } : {}) } : {}),
+        hot,
+        ...(teamsPlane !== undefined ? { teamsPlane } : {}),
+        projects,
+    };
 }
 /**
  * Apply the center `runtime` governance/limit gates OVER the env-derived config (mutates `config`).
@@ -342,18 +410,28 @@ export function runtimeGatePresent(rt, key) {
         return typeof v === "number" && v > 0;
     return typeof v === "number";
 }
-export function applyRuntimeGates(config, rt, logger) {
+/** [2283] stage 半场:六闸的赋值清单(纯计算,零变异)。commit 段照单赋值,通知载荷 post-commit 发。 */
+function stageRuntimeGates(rt) {
     if (!rt)
-        return;
+        return { assignments: [] };
+    const assignments = [];
     const applied = {};
     for (const key of RUNTIME_GATE_KEYS) {
         if (!runtimeGatePresent(rt, key))
             continue; // undefined / sentinel → keep env
-        config[key] = rt[key]; // present (incl. explicit 0/[]) → override
+        assignments.push([key, rt[key]]); // present (incl. explicit 0/[]) → override
         applied[key] = rt[key];
     }
-    if (Object.keys(applied).length > 0)
-        logger?.info("sema_registry_runtime", applied);
+    return { assignments, ...(Object.keys(applied).length > 0 ? { info: applied } : {}) };
+}
+export function applyRuntimeGates(config, rt, logger) {
+    // 独立调用面的兼容壳(测试/外部):stage → 就地赋值 → 通知。applyEffective 不走这里——它把
+    // assignments 并进自己的 commit 段以保住整世代原子性([2283]②)。
+    const s = stageRuntimeGates(rt);
+    for (const [k, v] of s.assignments)
+        config[k] = v;
+    if (s.info)
+        logger?.info("sema_registry_runtime", s.info);
 }
 /**
  * Apply the runtime governance "second baton" (center §10): `autonomy` + `commandPolicy`. UNLIKE the 6 gates in
@@ -372,34 +450,49 @@ export function applyRuntimeGates(config, rt, logger) {
  * core's EXACT-name matcher would silently never match → a hole) is rejected FAIL-LOUD and the prior good policy
  * is KEPT (a broken publish never half-applies a silently-weakened gate).
  */
-export function applyRuntimeHot(config, rt, logger) {
-    const applied = {};
+/** [2283] stage 半场:hot 二件的赋值决定(计算+校验;`sema_registry_commandpolicy_invalid` 是内容判定,
+ *  stage 期发——它描述 eff 的真伪,与是否 commit 无关)。对比基准=stage 时刻的 config 现值:stage 与
+ *  commit 同一同步 tick,期间无人能改 config(单线程),对比不失效。 */
+function stageRuntimeHot(config, rt, logger) {
+    const infoLine = {};
     // autonomy: present ⇒ center value; absent ⇒ revert to the env baseline (never a stale center override).
     const envAutonomy = parseAutonomy(process.env.AUTONOMY);
-    const nextAutonomy = rt?.autonomy !== undefined ? rt.autonomy : envAutonomy;
-    if (config.autonomy !== nextAutonomy) {
-        config.autonomy = nextAutonomy;
-        applied.autonomy = nextAutonomy ?? "(env-baseline)";
-    }
+    const autonomyNext = rt?.autonomy !== undefined ? rt.autonomy : envAutonomy;
+    const setAutonomy = config.autonomy !== autonomyNext;
+    if (setAutonomy)
+        infoLine.autonomy = autonomyNext ?? "(env-baseline)";
     // commandPolicy: present+valid ⇒ apply; present+invalid ⇒ fail-loud + keep prior; absent ⇒ revert to baseline
     // (undefined — no env scalar source for structured command rules). Only re-set + log on an ACTUAL change
     // (deep-equal compare) — refresh runs every ~60s and the policy is usually unchanged; logging every tick = noise.
+    let setCommandPolicy = false;
+    let commandPolicyNext;
     if (rt?.commandPolicy !== undefined) {
         const errors = validateCommandRules(rt.commandPolicy);
         if (errors.length > 0) {
             logger?.error("sema_registry_commandpolicy_invalid", { errors, kept: config.commandPolicy?.length ?? 0 });
         }
         else if (JSON.stringify(config.commandPolicy) !== JSON.stringify(rt.commandPolicy)) {
-            config.commandPolicy = rt.commandPolicy;
-            applied.commandPolicy = rt.commandPolicy.length; // log the COUNT, not the rules (avoid leaking on every refresh)
+            setCommandPolicy = true;
+            commandPolicyNext = rt.commandPolicy;
+            infoLine.commandPolicy = rt.commandPolicy.length; // log the COUNT, not the rules (avoid leaking on every refresh)
         }
     }
     else if (config.commandPolicy !== undefined) {
-        config.commandPolicy = undefined; // center stopped managing → revert to baseline (no env source)
-        applied.commandPolicy = "(env-baseline)";
+        setCommandPolicy = true;
+        commandPolicyNext = undefined; // center stopped managing → revert to baseline (no env source)
+        infoLine.commandPolicy = "(env-baseline)";
     }
-    if (Object.keys(applied).length > 0)
-        logger?.info("sema_registry_runtime_hot", applied);
+    return { setAutonomy, autonomyNext, setCommandPolicy, commandPolicyNext, infoLine };
+}
+export function applyRuntimeHot(config, rt, logger) {
+    // 独立调用面的兼容壳(测试/外部)——applyEffective 不走这里(同 applyRuntimeGates 的注)。
+    const s = stageRuntimeHot(config, rt, logger);
+    if (s.setAutonomy)
+        config.autonomy = s.autonomyNext;
+    if (s.setCommandPolicy)
+        config.commandPolicy = s.commandPolicyNext;
+    if (Object.keys(s.infoLine).length > 0)
+        logger?.info("sema_registry_runtime_hot", s.infoLine);
 }
 /** [865]①/H3:activeTierGroup 档绑定当默认时的档梯,与 core 单一语义源逐字对齐(core roles.js:
  *  `ROLE_TIER_DEFAULTS.default = "pro"` + `resolveTier` 从本档位置**只向低档**扫 DEFAULT_TIER_ORDER

package/dist/config-center/http-client.d.ts

@@ -1,10 +1,17 @@
-import type { EntitlementRuntimeCaps } from "@sema-agent/registry-core";
+import { type EntitlementRuntimeCaps } from "@sema-agent/registry-core";
 import type { ScenarioRuling } from "../capabilities/scenarios.js";
 import type { EffectiveConfig, ExecutionRuling } from "./types.js";
-/** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error. */
+/** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error, and on a
+ *  payload that is not an effective config at all(非对象 / version 非有限数 / gate 域坏形——[2281] 裁B)。
+ *  `domainErrors`:坏 catalog 域(schema default 已落)逐域单列——与本地腿 `FetchEffectiveResult` 同键同义,
+ *  boot/refresh 的候选门直接消费。 */
 export declare function fetchEffective(baseUrl: string, token: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
     effective: EffectiveConfig;
     etag?: string;
+    domainErrors?: Array<{
+        domain: string;
+        error: string;
+    }>;
 } | null>;
 /**
  * design/99 §K (core 1.157 `RunnerDeps.runtimeCapsResolver`) — GET the PER-PRINCIPAL runtime

package/dist/config-center/http-client.js

@@ -5,7 +5,11 @@
  * facade re-exports every symbol below unchanged).
  */
 import { createHash } from "node:crypto";
-/** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error. */
+import { readEffectiveWire } from "@sema-agent/registry-core";
+/** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error, and on a
+ *  payload that is not an effective config at all(非对象 / version 非有限数 / gate 域坏形——[2281] 裁B)。
+ *  `domainErrors`:坏 catalog 域(schema default 已落)逐域单列——与本地腿 `FetchEffectiveResult` 同键同义,
+ *  boot/refresh 的候选门直接消费。 */
 export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, worker) {
     // Defensive scheme guard: Node's fetch supports file:// — a mis-set
     // SEMA_REGISTRY_URL must not turn into a local-file read. Reject anything but http(s).
@@ -23,7 +27,21 @@ export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, wo
         return null;
     if (!res.ok)
         throw new Error(`config-center HTTP ${res.status}`);
-    return { effective: (await res.json()), etag: res.headers.get("etag") ?? undefined };
+    // [2281] 裁B(§M1):wire 载荷在**这个消费端边界**过 registry-core `readEffectiveWire`(0.12.0)真校验,
+    // 不再裸断言——「两个契约共用一个拼写不是一个被检查的契约」。判据与本地腿同源(parseDomain +
+    // DOMAIN_READ_FALLBACK):catalog 域坏形 → 该域 schema default + 下面折进 domainErrors(候选门在
+    // refresh 拒候选、boot 逐域 warn);gate 域坏形/垃圾载荷 → throw(caller 整包 catch 回落 env/LKG)。
+    // 未知顶层键 verbatim 透传(open-world:新 center 新域、legacy teams 键都不丢)。grandfather 类
+    // 警告(值已被收编接受)不算 error,不进 domainErrors——与本地店同口径。
+    const warnings = [];
+    const wire = readEffectiveWire(await res.json(), (w) => warnings.push(w));
+    const domainErrors = warnings
+        .filter((w) => w.kind === "domain-defaulted")
+        .map((w) => ({ domain: w.domain, error: (w.error instanceof Error ? w.error.message : String(w.error)).slice(0, 600) }));
+    // 经真校验后的 wire 值到 service 拼写副本的换装:两型同一契约面(EffectiveWire 是 service 型的同源超集,
+    // service 型只声明自己消费的域且全 optional)——此断言的前提正是上面那次校验,不再是裸信任。
+    const effective = wire;
+    return { effective, etag: res.headers.get("etag") ?? undefined, ...(domainErrors.length > 0 ? { domainErrors } : {}) };
 }
 /**
  * design/99 §K (core 1.157 `RunnerDeps.runtimeCapsResolver`) — GET the PER-PRINCIPAL runtime

package/dist/config-provider.js

@@ -91,10 +91,16 @@ export class RemoteConfigProvider {
         this.cc = cc;
         this.deps = deps;
     }
-    fetchEffective(etag) {
+    async fetchEffective(etag) {
         const fn = this.deps.fetchEffective ?? remoteFetchEffective;
         // 5th arg = worker scope; transport (fetchImpl) stays the config-center's default.
-        return fn(this.cc.baseUrl, this.cc.token, etag, undefined, this.cc.worker);
+        const r = await fn(this.cc.baseUrl, this.cc.token, etag, undefined, this.cc.worker);
+        if (r === null || r.domainErrors === undefined)
+            return r;
+        // [2281] 裁B:远程腿从此也产 domainErrors(http-client 消费端校验)。与本地腿同一条产出边界纪律:
+        // error 文本先过 redactConfigError(zod 错误会回声违规值——operand 指纹化,防受控值经
+        // config_candidate_rejected/config_domain_invalid 进结构化日志流)。
+        return { ...r, domainErrors: r.domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })) };
     }
     async fetchSkillContent(contentHash) {
         const fn = this.deps.fetchSkillContent ?? remoteFetchSkillContent;

package/dist/config.d.ts

@@ -25,6 +25,18 @@ export declare function numEnv(name: string, fallback: string): number;
  * `undefined`/空串 ⇒ 交给调用方的 fallback 语义处理(本函数只判「给了值但不是数」)。
  */
 export declare function parseNumOrFail(name: string, raw: string | undefined): number;
+/**
+ * `parseNumOrFail` layered with a non-negative floor — the SAME judgment `leader/wire.ts`'s (private,
+ * file-local) `parseNumOrFailNonNegative` already applies to its four resource knobs, exported here so a
+ * second call site (bake-runner's heartbeat/idle-poll/disk-guard knobs, gap-sweep 2026-08-01) can reuse the
+ * one shared primitive instead of re-deriving its own "reject a bad number" scheme. A negative value is
+ * JS-truthy, so a bare `|| default` fallback lets it straight through; for a duration knob that means
+ * `clock.sleep(-N)` fires ~immediately (the same tight-loop failure NaN causes), and for a threshold knob
+ * (`freeGb < minFreeGb`) a negative floor makes the comparison vacuously true/false depending on sign —
+ * either way the guard it configures goes silently slack. `undefined`/unset stays NaN (unchanged) so
+ * existing `|| fallback` chains built on `parseNumOrFail` are untouched by this stricter sibling.
+ */
+export declare function parseNumOrFailNonNegative(name: string, raw: string | undefined): number;
 export declare function drainConfigWarnings(): Array<{
     env: string;
     raw: string;

package/dist/config.js

@@ -94,6 +94,23 @@ export function parseNumOrFail(name, raw) {
         throw new Error(`env ${name}="${raw}" must be a number`);
     return n;
 }
+/**
+ * `parseNumOrFail` layered with a non-negative floor — the SAME judgment `leader/wire.ts`'s (private,
+ * file-local) `parseNumOrFailNonNegative` already applies to its four resource knobs, exported here so a
+ * second call site (bake-runner's heartbeat/idle-poll/disk-guard knobs, gap-sweep 2026-08-01) can reuse the
+ * one shared primitive instead of re-deriving its own "reject a bad number" scheme. A negative value is
+ * JS-truthy, so a bare `|| default` fallback lets it straight through; for a duration knob that means
+ * `clock.sleep(-N)` fires ~immediately (the same tight-loop failure NaN causes), and for a threshold knob
+ * (`freeGb < minFreeGb`) a negative floor makes the comparison vacuously true/false depending on sign —
+ * either way the guard it configures goes silently slack. `undefined`/unset stays NaN (unchanged) so
+ * existing `|| fallback` chains built on `parseNumOrFail` are untouched by this stricter sibling.
+ */
+export function parseNumOrFailNonNegative(name, raw) {
+    const n = parseNumOrFail(name, raw);
+    if (n < 0)
+        throw new Error(`env ${name}=${n} must not be negative`);
+    return n;
+}
 /** Numeric env with a [min,max] bound (BL-17): an out-of-range value FAILS at startup instead of being
  *  silently clamped/applied (e.g. a multi-hour MCP_ELICITATION_TTL_MS would silently never expire). */
 function numEnvBounded(name, fallback, min, max) {

package/dist/fleet/fleet-bus.js

@@ -203,9 +203,12 @@ export function fleetRunPublisher(bus, run) {
                 elapsedDonor.add(cid);
             const elapsed = elapsedDonor.has(cid) ? Date.now() - childStartedAt.get(cid) : undefined;
             if (donorName !== undefined || elapsed !== undefined) {
+                // cli [2297]①:donorName 只进 `name` 位。run-leg tick 手上没有独立的类型名([1364]③/core 1.350:
+                // name=display 标签、agentType=类型名),把 display 值同时写进 agentType 会让 fleet 的 TYPE 列显示
+                // description。缺源的键不铸(与「匿名行不铸假名」同一条原则);BCE 行自己的帧带真 agentType 时自然补上。
                 bus.publishTask({
                     id: bceRowId,
-                    ...(donorName !== undefined ? { name: donorName, agentType: donorName } : {}),
+                    ...(donorName !== undefined ? { name: donorName } : {}),
                     ...(elapsed !== undefined ? { elapsedMs: elapsed } : {}),
                 });
             }

package/dist/hooks/hook-llm.js

@@ -160,7 +160,7 @@ export function createHookLlm(deps) {
                 text = j.choices?.[0]?.message?.content ?? undefined;
             }
             metrics.inc("hook_llm_calls_total", { type: "prompt" });
-            return typeof text === "string" ? { ok: true, text } : { ok: false, error: "hook llm returned no content" };
+            return typeof text === "string" ? { ok: true, text } : { ok: false, error: "hook llm returned no content", code: "no_content" };
         }
         catch (e) {
             // 网络层失败原样只有 "TypeError: fetch failed"(不是人话):带上端点与 cause(ECONNREFUSED 等),

package/dist/hooks/hook-runner.d.ts

@@ -91,7 +91,11 @@ export type HookLlmCall = (opts: {
 } | {
     ok: false;
     error: string;
+    code?: HookLlmFailureCode;
 }>;
+/** 失败判别码(B8:判别一律走码,禁按 error 文案分支——v3.1 批2,统检第二波 high)。error 仍是给人看的
+ *  自由文本;code 是给控制流的。缺席=未分类失败(不重试、不特判)。 */
+export type HookLlmFailureCode = "no_content" | "hard_timeout";
 /**
  * 阶段三a:`http` 条目——契约语义 = POST hook 输入 JSON 到 `url`;headers 里的 `$NAME` 仅当 NAME 列在
  * `allowedEnvVars` 才从 worker 进程 env 插值(配置本身绝不携带密钥值,契约同边界)。

package/dist/hooks/hook-runner.js

@@ -383,7 +383,7 @@ async function runLlmHook(entry, payload, ctx, extra) {
     // 顺序是承重的 —— 包装句逐字预设会话在上文,放反了那句话本身就是在骗模型。
     const prompt = extra ? `${extra.transcript}\n\n---\n\n${wrapCondition("Stop", substituted)}` : substituted;
     // 载体外再包一层硬顶:契约说载体自己兜超时,但一个部署组装 bug 不该能挂死工具门(纵深)。
-    const hardTop = new Promise((r) => setTimeout(() => r({ ok: false, error: "__hook_llm_hard_timeout__" }), timeoutMs + 5_000).unref?.());
+    const hardTop = new Promise((r) => setTimeout(() => r({ ok: false, error: "hook llm hard-timeout backstop fired (carrier did not settle within timeoutMs+5s — deployment assembly bug)", code: "hard_timeout" }), timeoutMs + 5_000).unref?.());
     const invoke = () => Promise.race([
         call({
             prompt,
@@ -397,17 +397,17 @@ async function runLlmHook(entry, payload, ctx, extra) {
     // 🔴 **"一个字都没吐出来"重试一次**(仅 CC 评估者路)。这个失败形的后果是**判词被丢弃 ⇒ fail-open**
     // (该拦没拦),而它是**瞬态**的(推理档模型偶尔把额度用在 thinking 上)。
     // ⚠️ 只重试**无内容**,不重试"有内容但读不懂" —— 后者重试一次多半还是读不懂,而且那一格按设计就该放行。
-    if (extra && !res.ok && res.error.includes("returned no content")) {
+    if (extra && !res.ok && res.code === "no_content") { // B8:判别走码不走文案(v3.1 批2)
         ctx.logger.warn("hook_llm_no_content_retry", { event: "Stop" });
         res = await invoke();
         // 重试之后**仍然**没有内容 ⇒ 这一轮的守卫确实没能评估。发观测帧(纯 observe,不改变运行)——
         // 方向仍是 fail-open,但用户/壳侧要能知道「这轮没看住」,否则那个放行与「已达成」无法区分。
-        if (!res.ok && res.error.includes("returned no content")) {
+        if (!res.ok && res.code === "no_content") {
             ctx.onHookNotice?.({ kind: "hook_decision_unavailable", event: "Stop", reason: "no_content", detail: "carrier returned no content (after one retry)" });
         }
     }
     if (!res.ok) {
-        return res.error === "__hook_llm_hard_timeout__"
+        return res.code === "hard_timeout"
             ? { code: null, stdout: "", stderr: "", timedOut: true }
             : { code: null, stdout: "", stderr: "", timedOut: false, spawnError: clip(res.error, 500) };
     }

package/dist/http/routes/runs.js

@@ -1134,7 +1134,12 @@ async function handleRunVerbsBody(req, res, url, ctx, miss) {
         const parkArbiterUnreachable = details?.error === "park_arbiter_unreachable";
         const parkResumeWon = details?.error === "park_resume_won";
         const stillParked = details?.error === "parked_pending_approval" || details?.status === "parked";
-        if (stopVerb && details?.error !== undefined && (details.status === "running" || stillParked || parkResumeWon || parkArbiterUnreachable)) {
+        // v3.1 批2(统检第二波 high):判别方向翻转——旧形是 (status,error) 的**失败白名单**(status==="running"
+        // || 三个具名码),core 新增失败码且行状态不在 {running,parked} 时整个分支被跳过落 200,与上面注释自陈
+        // 的不变量(kill 没落地绝不读成功)正相悖(B5 联合非穷尽的 default-放行形;not_local/park 族/arbiter
+        // 三次历史新增全靠人追认)。新形:stop 动词的 error **在场即失败**(not_found 已在上方早退),具名臂
+        // 保留各自 errorCode,未知码落 stop.not_landed 兜底 409——新失败码默认可见,不默认成功。
+        if (stopVerb && details?.error !== undefined) {
             // 1.250:durable 回落臂(core stopTask agentStore 分支)对他实例 running 行应答 error="not_local"
             // (没有 kill 被尝试)——与「kill 尝试了没落地」(stop.not_landed)是不同的失败形,各给各的
             // errorCode(同 409 家族,additive)。

package/dist/http/server.js

@@ -1671,16 +1671,20 @@ export function createHttpServer(rawDeps) {
                             if (!rs || !taskId)
                                 return;
                             const t = e.type;
+                            // C2/C5(v3.1 批2):写失败留痕——同函数 onTaskNotification 的 park-enqueue 早按 2026-07-11
+                            // 对抗评审补了 warn(false park 指纹),这三处同构 fire-and-forget 此前裸吞:子代 tool 生命周期
+                            // 事件从 durable log 永久消失且零信号。结构上仍不能 await(同步回调),留痕不改调用形。
+                            const warnAppend = (kind) => (err) => deps.logger?.warn?.("forward_event_append_failed", { type: kind, taskId, err: err instanceof Error ? err.message : String(err) });
                             if (t === "task_progress") {
-                                void append("task_progress", taskProgressEventData(e)).catch(() => undefined);
+                                void append("task_progress", taskProgressEventData(e)).catch(warnAppend(t));
                             }
                             else if (t === "tool_start") {
                                 // C1 (core 1.219): a delegated child's forwarded tool lifecycle — durable via the SAME shared
                                 // whitelist+redact builders as the top stream (parity with the bg leg; deltas not persisted per-chunk).
-                                void append("tool_start", toolStartEventData(e)).catch(() => undefined);
+                                void append("tool_start", toolStartEventData(e)).catch(warnAppend(t));
                             }
                             else if (t === "tool_end") {
-                                void append("tool_end", toolEndEventData(e)).catch(() => undefined);
+                                void append("tool_end", toolEndEventData(e)).catch(warnAppend(t));
                             }
                         },
                         // background-completion observer — flip the child's fleet row +
@@ -2559,7 +2563,7 @@ function cors(res, req, origins, principalHeader) {
     // 后五项都是**真被 handler 读**的自定义头:`idempotency-key`(tasks/runs/images)、
     // `x-detach-on-disconnect`(tasks 断连不中止)、direct-door 决策证明三件套(approvals /decide 的
     // crypto 绑定腿 —— 缺了它,direct-door worker 上的 web 审批面在浏览器里根本用不了)。
-    res.setHeader("access-control-allow-headers", `content-type, authorization, last-event-id, ${principalHeader}, idempotency-key, x-detach-on-disconnect, x-approval-principal-token, x-approval-mac, x-approval-mac-kid`);
+    res.setHeader("access-control-allow-headers", `content-type, authorization, last-event-id, ${principalHeader}, idempotency-key, x-detach-on-disconnect, x-approval-principal-token, x-approval-mac, x-approval-mac-kid, if-none-match`);
     // 🔴 expose-headers 此前**整个缺席** ⇒ fetch 类客户端读不到 `X-Task-Id`(routes/tasks.ts 经 sseHeaders
     // 下发的 durable rewind handle)。tasks.ts 的 G15 meta 帧注释把这归因为「EventSource 与部分代理读不到
     // 响应头」—— 对 EventSource 成立,但对 fetch 客户端真因是这里缺 expose,meta 帧只是绕过。

package/dist/lsp/e2b-bridge.js

@@ -26,7 +26,16 @@ const TOKEN = process.env.LSP_TOKEN || '';
 const MAX = 50 * 1024 * 1024;
 const HEARTBEAT_MS = Number(process.env.LSP_HEARTBEAT_MS || 30000);
 const wss = new WebSocketServer({ host: '0.0.0.0', port: PORT });
+// A zero-listener 'error' on ANY EventEmitter throws and crashes the process (Node default). Without this, a
+// bind failure (e.g. EADDRINUSE — a second bridge start racing the same port) took down the WHOLE bridge
+// process, killing every language's LSP session in the sandbox, not just the one that failed to start (HRD-LSP-4).
+// Exit loud + explicit instead of an uncaught-exception dump so the failure is at least attributable.
+wss.on('error', (err) => { console.error('lsp-bridge wss error', err && err.message); process.exit(1); });
 wss.on('connection', (ws, req) => {
+  // Same zero-listener 'error' hazard as wss above, but per-connection: registered FIRST, before anything else
+  // touches this socket. Close (don't crash) — the heartbeat reaper's own ws.terminate() below is a routine
+  // source of a socket 'error' on an already-half-open connection (HRD-LSP-4).
+  ws.on('error', () => { try { ws.terminate(); } catch {} });
   const q = ((req && req.url) || '').split('?')[1] || '';
   if (TOKEN && new URLSearchParams(q).get('token') !== TOKEN) { ws.close(); return; } // auth (council #4)
   ws.isAlive = true;
@@ -37,7 +46,11 @@ wss.on('connection', (ws, req) => {
   const decode = makeFrameDecoder(MAX);
   child.stdout.on('data', (d) => { for (const f of decode(d)) ws.send(f); });
   ws.on('message', (data) => { const p = Buffer.from(data.toString(), 'utf8'); child.stdin.write('Content-Length: ' + p.length + '\r\n\r\n'); child.stdin.write(p); });
-  ws.on('close', () => child.kill());
+  // pid guard: the child 'error' handler above routes spawn FAILURES (missing binary — pid never assigned)
+  // through ws.close() → this 'close' handler. Killing a child whose pid was never assigned can signal the
+  // CALLER's process group instead of the (nonexistent) child (HRD-LSP-4; same hazard class as bake-runner's
+  // spawner, src/bake-runner/main.ts).
+  ws.on('close', () => { if (child.pid !== undefined) child.kill(); });
   child.on('exit', () => { try { ws.close(); } catch {} });
 });
 // Reap half-open connections: the E2B proxy kills a WS at ~60-75s and the kill can be SILENT on THIS side too —

package/dist/lsp/e2b-manager.d.ts

@@ -8,9 +8,11 @@ export interface E2bLspOptions {
         attempts: number;
         delayMs: number;
     };
-    /** Bridge auth token override. The manager pins ONE token per env+language: on a RE-open (transport heal
-     *  after the E2B proxy idle-killed the WS) the original bridge process is still listening with the FIRST
-     *  token — a fresh random token would be rejected and the reconnect would always fail. */
+    /** Bridge auth token override. The manager pins ONE token per env+PORT — the bridge RESOURCE, not the
+     *  language (`portForLanguage` maps several languages, e.g. typescript/javascript, onto the SAME port/process
+     *  — see `createE2bLspManager`). On a RE-open (transport heal after the E2B proxy idle-killed the WS) the
+     *  original bridge process is still listening with the FIRST token — a fresh random token would be rejected
+     *  and the reconnect would always fail. */
     token?: string;
     /** WS scheme for the bridge URL. E2B's `getHost` returns a public TLS proxy host → `wss` (default);
      *  the k8s adapter returns a cluster-internal `podIP:port` → plain `ws` (no TLS on the pod network;
@@ -19,7 +21,9 @@ export interface E2bLspOptions {
     /** Observability hook (open/heal/degrade events) — prod wires the service logger. */
     log?: (event: string, fields: Record<string, unknown>) => void;
 }
-/** Start (+ install on a non-baked template) the language server + bridge inside THIS env's sandbox, then connect. */
+/** Start (+ install on a non-baked template) the language server + bridge inside THIS env's sandbox, then connect.
+ *  Every call starts (or re-starts) the bridge unconditionally — the one production caller is
+ *  `createE2bLspManager`, which de-dupes per env+port before ever reaching here (see its doc). */
 export declare function openE2bLspTransport(language: string, env: LspCapableEnv, opts?: E2bLspOptions): Promise<LspTransport | undefined>;
 /** The single shared `LspServerManager` for the deployment (`RunnerDeps.lspManager`). */
 export declare function createE2bLspManager(opts?: E2bLspOptions): E2bLspManager;

package/dist/lsp/e2b-manager.js

@@ -12,19 +12,28 @@ import { randomUUID } from "node:crypto";
 import { connectWsLspTransport } from "./ws-transport.js";
 import { E2bLspManager } from "./manager.js";
 import { BRIDGE_DIR, BRIDGE_SOURCE, lspInstallCommand, lspStartCommand, portForLanguage, SERVER_CMD } from "./e2b-bridge.js";
-/** Start (+ install on a non-baked template) the language server + bridge inside THIS env's sandbox, then connect. */
-export async function openE2bLspTransport(language, env, opts) {
-    if (!SERVER_CMD[language])
-        return undefined; // no server for this language → graceful degrade
-    const connect = opts?.connect ?? connectWsLspTransport;
-    const retry = opts?.retry ?? { attempts: 6, delayMs: 1500 };
-    const port = portForLanguage(language);
+/** Write bridge.cjs + (foreground) install the language server, then start the bridge as a TRUE background
+ *  command. Returns whether the bridge is now up-or-starting (`false` only when the foreground install failed).
+ *  A single-shot primitive: it does NOT check whether a bridge is already listening on `port` — a caller that
+ *  can have two languages share one port (`createE2bLspManager`, since `portForLanguage` maps typescript AND
+ *  javascript onto 8123 off the same `SERVER_CMD`) MUST call this at most ONCE per env+port itself. A second
+ *  `node bridge.cjs` on an already-bound port surfaces as an EADDRINUSE `wss` 'error' (e2b-bridge.ts D6
+ *  hardening keeps that from crashing the sandbox, but the second attempt still fails and wastes a sandbox
+ *  round-trip for nothing — HRD-LSP-4). */
+async function startE2bBridge(language, env, port, token) {
     await env.writeFile(`${BRIDGE_DIR}/bridge.cjs`, BRIDGE_SOURCE).catch(() => undefined);
     const installed = await env.exec(lspInstallCommand(language)).catch(() => undefined);
     if (!installed || !installed.ok)
-        return undefined;
-    const token = opts?.token ?? randomUUID(); // per-session bridge auth — the getHost URL is public (council #4)
+        return false;
     await env.startBackground(lspStartCommand(language, port, token)).catch(() => undefined);
+    return true;
+}
+/** Connect (with retry) to an already-started bridge. Each call opens its OWN WS connection — the bridge spawns
+ *  a FRESH child language-server process per connection (e2b-bridge.ts `wss.on('connection', …)`), so two
+ *  languages sharing one bridge port each still get an isolated language-server instance. */
+async function connectE2bLspBridge(env, port, token, opts) {
+    const connect = opts?.connect ?? connectWsLspTransport;
+    const retry = opts?.retry ?? { attempts: 6, delayMs: 1500 };
     const root = env.workspaceHandle().mountPath;
     // the bridge starts as a background command → retry the WS connect (with the auth token) while it comes up
     const scheme = opts?.scheme ?? "wss";
@@ -39,26 +48,49 @@ export async function openE2bLspTransport(language, env, opts) {
     }
     return undefined;
 }
+/** Start (+ install on a non-baked template) the language server + bridge inside THIS env's sandbox, then connect.
+ *  Every call starts (or re-starts) the bridge unconditionally — the one production caller is
+ *  `createE2bLspManager`, which de-dupes per env+port before ever reaching here (see its doc). */
+export async function openE2bLspTransport(language, env, opts) {
+    if (!SERVER_CMD[language])
+        return undefined; // no server for this language → graceful degrade
+    const port = portForLanguage(language);
+    const token = opts?.token ?? randomUUID(); // per-session bridge auth — the getHost URL is public (council #4)
+    const started = await startE2bBridge(language, env, port, token);
+    if (!started)
+        return undefined;
+    return connectE2bLspBridge(env, port, token, opts);
+}
 /** The single shared `LspServerManager` for the deployment (`RunnerDeps.lspManager`). */
 export function createE2bLspManager(opts) {
-    // One bridge token per env+language, pinned across re-opens (heal after an idle-killed WS): the original
-    // bridge keeps listening with the first token, so the reconnect must present the SAME one. WeakMap → a
-    // destroyed task's tokens are collectible with its env.
-    const tokens = new WeakMap();
+    // One bridge PROCESS + token per env+PORT — not per env+language. `portForLanguage` maps typescript and
+    // javascript onto the SAME port (they share `SERVER_CMD`): keying by language minted two auth tokens for the
+    // one listening bridge (HRD-LSP-4) and re-invoked `startBackground` on an already-bound port on every open.
+    // WeakMap → a destroyed task's bridge bookkeeping is collectible with its env.
+    const bridges = new WeakMap();
     return new E2bLspManager({
         log: opts?.log,
-        transportFactory: (language, env) => {
-            let perLang = tokens.get(env);
-            if (!perLang) {
-                perLang = new Map();
-                tokens.set(env, perLang);
+        transportFactory: async (language, env) => {
+            if (!SERVER_CMD[language])
+                return undefined; // no server for this language → graceful degrade (mirrors
+            // openE2bLspTransport's own guard; MUST run before touching `bridges` — `portForLanguage` falls back to
+            // port 8123 for an unmapped language, which would otherwise silently borrow typescript's live bridge)
+            const port = portForLanguage(language);
+            let perPort = bridges.get(env);
+            if (!perPort) {
+                perPort = new Map();
+                bridges.set(env, perPort);
             }
-            let token = perLang.get(language);
-            if (!token) {
-                token = opts?.token ?? randomUUID();
-                perLang.set(language, token);
+            let bridge = perPort.get(port);
+            if (!bridge) {
+                const token = opts?.token ?? randomUUID();
+                bridge = { token, ready: startE2bBridge(language, env, port, token) };
+                perPort.set(port, bridge); // synchronous — no await above (run-to-completion dedupe guard, see E2bBridgeHandle.ready doc)
             }
-            return openE2bLspTransport(language, env, { ...opts, token });
+            const started = await bridge.ready;
+            if (!started)
+                return undefined;
+            return connectE2bLspBridge(env, port, bridge.token, opts);
         },
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "3.22.0",
+  "version": "3.24.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -55,7 +55,7 @@
   },
   "dependencies": {
     "@sema-agent/core": "^2.13.0",
-    "@sema-agent/registry-core": "^0.11.0",
+    "@sema-agent/registry-core": "^0.12.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",