@sema-agent/server 7.100.0 → 7.101.0

package/dist/config-center/apply-effective.js

@@ -1,4 +1,4 @@
-import { resolveActiveTiers, SEALED_BOX_ALG } from "@sema-agent/settings-schema";
+import { resolveActiveTiers } from "@sema-agent/settings-schema";
 import { sealedKeyPoison } from "../sealed-key.js";
 import { applyAutoCompactWindow, buildModelCostKey, findUnmatchableToolNames, formatUnmatchableToolNames, parseAutonomy } from "../config.js";
 import { buildModelCompat, readModelCompat } from "../model-compat.js";
@@ -8,6 +8,7 @@ import { stageLimits } from "./stage-limits.js";
 import { APPROVAL_GROUP_KEYS, BATCH1_LIMIT_KEYS } from "./hot-keys-registry.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 import { crossInvariant } from "../config-invariants.js";
+import { judgeCatalogEntries, mintedRefusedNames, refusalEventOf, refusalWarnFields, REFUSED_NAME_MINTED_CODE, unreadableDroppedRefusal } from "../model-entry-refusal.js";
 import { gateIntentUnserviceableReason } from "../approval.js";
 import { refusedGroups } from "./apply-ledger.js";
 const charsPerTokenOf = (v) => (typeof v === "number" && Number.isFinite(v) && v > 0 ? v : undefined);
@@ -104,9 +105,10 @@ export function applyEffective(config, eff, logger, opts) {
         logger?.warn("sema_registry_stale_generation_refused", { staged: staged.version, stagedOrdinal: gen, live, note: "an older staged generation must not overwrite a newer committed one — refused whole; next poll replays" });
         return false;
     }
-    if (staged.modelPlane !== undefined && opts.swapPlane !== undefined) {
+    const mp = staged.modelPlaneGroup.stages.models;
+    if (mp !== undefined && opts.swapPlane !== undefined) {
         try {
-            opts.swapPlane({ models: staged.modelPlane.models, tiers: staged.modelPlane.activeTiers });
+            opts.swapPlane({ models: mp.models, tiers: mp.activeTiers });
         }
         catch (err) {
             logger?.warn("sema_registry_model_plane_swap_refused", {
@@ -131,19 +133,20 @@ export function applyEffective(config, eff, logger, opts) {
                     ...(staged.limits.rejected ? { rejected: staged.limits.rejected } : {}),
                 },
                 approvalGate: groupReportOf(staged.approvalGate),
+                modelPlane: modelPlaneGroupReport(staged.modelPlaneGroup),
             },
         };
         opts.report({ ...report, fullyApplied: refusedGroups(report).length === 0 });
     }
     if (staged.limits.changed.length > 0)
         logger?.info("sema_registry_limits", { version: staged.version, keys: staged.limits.changed });
-    if (staged.modelPlane)
-        logger?.info("sema_registry_models", staged.modelPlane.infoLine);
+    if (mp)
+        logger?.info("sema_registry_models", mp.infoLine);
     if (staged.approvalGate.next !== undefined)
         logger?.info("sema_registry_runtime", { version: staged.version, approvalRequire: staged.approvalGate.next });
     if (Object.keys(staged.hot.infoLine).length > 0)
         logger?.info("sema_registry_runtime_hot", staged.hot.infoLine);
-    for (const n of staged.collabPlane.notices) {
+    for (const n of staged.modelPlaneGroup.stages.collab?.notices ?? []) {
         if (n.level === "warn")
             logger?.warn(n.msg, n.fields);
         else
@@ -154,10 +157,11 @@ export function applyEffective(config, eff, logger, opts) {
     return true;
 }
 function commitStaged(config, staged) {
-    const mp = staged.modelPlane;
+    const mp = staged.modelPlaneGroup.stages.models;
     if (mp) {
         config.modelApiKeyEnv = mp.modelApiKeyEnv;
         config.modelApiKeys = mp.modelApiKeys;
+        config.modelRefusals = mp.modelRefusals;
         mutateInPlace(config.modelQuotaWeights, mp.quotaWeights);
         mutateInPlace(config.models, mp.models);
         config.model = config.models.default;
@@ -175,61 +179,90 @@ function commitStaged(config, staged) {
         config.autonomy = staged.hot.autonomyNext;
     if (staged.hot.setCommandPolicy)
         config.commandPolicy = staged.hot.commandPolicyNext;
-    registerCollabWorkflows(staged.collabPlane.workflows);
+    const collab = staged.modelPlaneGroup.stages.collab;
+    if (collab !== undefined)
+        registerCollabWorkflows(collab.workflows);
     mutateInPlace(config.projects, staged.projects);
 }
-function stageEffective(config, eff, logger, opts) {
-    if (opts.leg === "boot" && !eff.version) {
-        logger?.warn("sema_registry_unpublished", {
-            version: eff.version,
-            note: "empty/unpublished effective config — using env + built-in fallback; publish a config or unset CONFIG_PUBLISH_MODE",
-        });
-    }
+export const MODEL_PLANE_DOMAINS = ["models", "collab"];
+const MODEL_PLANE_SURFACES = {
+    models: ["models", "model", "modelRefusals", "modelApiKeyEnv", "modelApiKeys", "modelQuotaWeights", "roles", "tiers", "atModelAllowlist"],
+    collab: ["collabWorkflows"],
+};
+const MODEL_PLANE_GROUP_KEYS = MODEL_PLANE_DOMAINS.flatMap((d) => MODEL_PLANE_SURFACES[d]);
+export function withModelPlaneOf(target, source) {
+    const out = { ...target };
+    for (const d of MODEL_PLANE_DOMAINS)
+        takeModelPlaneDomain(out, source, d);
+    return out;
+}
+function takeModelPlaneDomain(out, source, d) {
+    const v = source[d];
+    if (v === undefined)
+        delete out[d];
+    else
+        out[d] = v;
+}
+export function buildEnvOnlyModelPlane() {
+    return { models: { models: [], roles: {} } };
+}
+function modelPlaneGroupReport(group) {
+    return {
+        applied: MODEL_PLANE_DOMAINS.flatMap((d) => (group.stages[d] !== undefined ? MODEL_PLANE_SURFACES[d] : [])),
+        ...(group.rejected !== undefined ? { rejected: { keys: group.rejected.keys, reason: group.rejected.reason } } : {}),
+    };
+}
+const ROLE_BINDING_UNAVAILABLE_HINT = "tasks resolving this role fail: alias/tier expansion cannot mint this name; the engine refuses it loud — bind the role to a usable model, or make the entry usable (see the entry's own warn)";
+function stageModelPlane(config, eff, logger, sealedKeys) {
     const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
-    let modelPlane;
-    if (enabled.length > 0) {
+    const droppedEnabled = eff.models?.droppedIdentities;
+    if (enabled.length === 0 && !(Array.isArray(droppedEnabled) && droppedEnabled.length > 0))
+        return { stages: { collab: stageCollabDomain(eff) } };
+    {
+        const verdict = judgeCatalogEntries(enabled, { anthropicRouteMounted: config.anthropic !== undefined }, eff.models.droppedIdentities);
+        for (const [name, r] of Object.entries(verdict.refused))
+            logger?.warn(refusalEventOf(r.reason), refusalWarnFields(name, r));
+        const refuse = (invariant, reason, detail = {}) => {
+            logger?.warn("sema_registry_model_plane_refused", {
+                version: typeof eff.version === "number" ? eff.version : 0,
+                invariant,
+                reason,
+                ...detail,
+                kept: "the model plane of this candidate is refused as a group — the current model plane (catalog / roles / tiers / refusals / allowlist, and the collab workflows that reference it) keeps serving and the other groups of this candidate still apply; the candidate is not fully applied (LKG / ETag stay on the last fully applied generation) and is re-judged next pull",
+            });
+            return { stages: {}, rejected: { keys: MODEL_PLANE_GROUP_KEYS, reason, invariant }, refused: verdict.refused };
+        };
+        if (verdict.unreadable.length > 0) {
+            logger?.warn("sema_registry_model_entry_dropped_unproven", {
+                entries: [...verdict.unreadable],
+                code: REFUSED_NAME_MINTED_CODE,
+                hint: "these catalog entries were dropped by the settings-schema read and the raw document could not be matched to the snapshot that was parsed (e.g. the local file changed between two reads) — their names cannot be proven, so no tombstone can be minted and the candidate's model plane is refused (a name nobody can prove cannot be shown not to be re-minted by the tier/alias expansion); the next read re-judges",
+            });
+            return refuse("refused-names-not-minted", unreadableDroppedRefusal(verdict.unreadable));
+        }
+        const usable = verdict.usable;
         const models = {};
         const modelApiKeyEnv = {};
         const modelApiKeys = {};
         const envModel = envDerivedModel(config);
         const envDefaults = { maxTokens: envModel.maxTokens, contextWindow: envModel.contextWindow, reasoning: envModel.reasoning, charsPerToken: envModel.charsPerToken, defaultThinking: envModel.defaultThinking, compat: envModel.compat };
-        for (const m of enabled) {
-            const rawBaseUrl = m.baseUrl;
-            let safeUrl = rawBaseUrl;
-            if (rawBaseUrl) {
-                let ok = false;
-                try {
-                    const u = new URL(rawBaseUrl);
-                    ok = u.protocol === "http:" || u.protocol === "https:";
-                }
-                catch {
-                    ok = false;
-                }
-                if (ok)
-                    logger?.warn("sema_registry_model_base_url", { model: m.name, baseUrl: buildDisplaySafeUrl(rawBaseUrl), hint: "registry-directed gateway override — this model's key authenticates AGAINST THIS URL" });
-                else {
-                    logger?.warn("sema_registry_model_base_url_rejected", { model: m.name, baseUrl: buildDisplaySafeUrl(String(rawBaseUrl)), hint: "only http(s) URLs are honored — falling back to the deployment gateway (MODEL_GATEWAY_BASEURL); with none declared the whole candidate is refused (model-route-endpoint)" });
-                    safeUrl = undefined;
-                }
-            }
-            models[m.name] = toModel(safeUrl === rawBaseUrl ? m : { ...m, baseUrl: safeUrl }, envDefaults, logger);
+        for (const m of usable) {
+            if (m.baseUrl)
+                logger?.warn("sema_registry_model_base_url", { model: m.name, baseUrl: buildDisplaySafeUrl(m.baseUrl), hint: "registry-directed gateway override — this model's key authenticates AGAINST THIS URL" });
+            models[m.name] = toModel(m, envDefaults, logger);
             if (m.sealedApiKey) {
                 const s = m.sealedApiKey;
-                if (s.alg !== SEALED_BOX_ALG) {
-                    logger?.warn("sema_registry_model_sealed_key_bad_alg", { model: m.name, alg: String(s.alg), expected: SEALED_BOX_ALG, hint: "unsupported sealed-box alg — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback; contract v1 pins the alg)" });
-                    modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "unsupported_alg");
-                }
-                else if (!opts.sealedKeys) {
+                if (!sealedKeys) {
                     logger?.warn("sema_registry_model_sealed_key_no_store", { model: m.name, publicKeyId: s.publicKeyId, hint: "no sealed-key store on this host (boot custody init failed or lane unwired) — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback)" });
                     modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "no_key_store");
                 }
-                else if (!opts.sealedKeys.has(s.publicKeyId)) {
-                    logger?.warn("sema_registry_model_sealed_key_no_private_key", { model: m.name, publicKeyId: s.publicKeyId, held: opts.sealedKeys.ids(), hint: "ciphertext targets a private key this host doesn't hold (rotated away / other host) — key POISONED: tasks on this model fail loud until the operator re-pastes the key in the web UI (it seals against the newest registered public key)" });
+                else if (!sealedKeys.has(s.publicKeyId)) {
+                    logger?.warn("sema_registry_model_sealed_key_no_private_key", { model: m.name, publicKeyId: s.publicKeyId, held: sealedKeys.ids(), hint: "ciphertext targets a private key this host doesn't hold (rotated away / other host) — key POISONED: tasks on this model fail loud until the operator re-pastes the key in the web UI (it seals against the newest registered public key)" });
                     modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "stale_ciphertext");
                 }
                 else {
                     try {
-                        modelApiKeys[m.name] = opts.sealedKeys.open(s.ciphertext, s.publicKeyId);
+                        modelApiKeys[m.name] = sealedKeys.open(s.ciphertext, s.publicKeyId);
                     }
                     catch (err) {
                         logger?.warn("sema_registry_model_sealed_key_open_failed", { model: m.name, publicKeyId: s.publicKeyId, err: String(err), hint: "corrupt/foreign ciphertext — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback)" });
@@ -243,12 +276,9 @@ function stageEffective(config, eff, logger, opts) {
                 else
                     logger?.warn("sema_registry_model_key_env_missing", { model: m.name, apiKeyEnv: m.apiKeyEnv, hint: "env var not set in this service — model falls back to the gateway key" });
             }
-            if (m.provider === "anthropic" && !config.anthropic) {
-                logger?.warn("sema_registry_model_no_brain", { model: m.name, provider: m.provider, hint: "set ANTHROPIC_API_KEY in this service's env, else it mis-routes to the gateway brain" });
-            }
         }
         const quotaWeights = {};
-        for (const m of enabled) {
+        for (const m of usable) {
             const qw = typeof m.quotaWeight === "number" && Number.isFinite(m.quotaWeight) && m.quotaWeight > 0 ? m.quotaWeight : undefined;
             if (qw !== undefined) {
                 quotaWeights[m.name] = qw;
@@ -266,38 +296,80 @@ function stageEffective(config, eff, logger, opts) {
                 centerRoles[role] = { select: tgt.select };
         }
         const roles = { ...envRolesBaseline.get(config), ...centerRoles };
-        const activeTiers = resolveActiveTiers(eff.models) ?? {};
-        const picked = resolveDefaultModelName(eff, (n) => models[n] !== undefined, enabled[0].name, (source, name) => logger?.warn("sema_registry_default_dangling", { source, name, hint: "explicit default names a model that is not in the enabled catalog — falling to the next source" }));
-        models.default = models[picked.name];
-        const endpointRefusal = crossInvariant("model-route-endpoint").check({ live: config, next: { ...config, models } });
-        if (endpointRefusal !== undefined) {
-            throw new Error(`candidate model plane refused whole (cross-invariant model-route-endpoint): ${endpointRefusal} ` +
-                "The current generation keeps serving; the candidate is re-judged on the next pull.");
+        let picked;
+        if (usable.length > 0) {
+            picked = resolveDefaultModelName(eff, (n) => models[n] !== undefined, usable[0].name, (source, name) => logger?.warn("sema_registry_default_dangling", {
+                source,
+                name,
+                ...(Object.hasOwn(verdict.refused, name) ? { unavailable: verdict.refused[name].code } : {}),
+                hint: "explicit default names a model that is not in the usable catalog (not enabled, or unavailable on this host — see `unavailable`) — falling to the next source",
+            }));
+            models.default = models[picked.name];
+        }
+        const activeTiers = {};
+        for (const [tier, target] of Object.entries(resolveActiveTiers(eff.models) ?? {})) {
+            if (models[target] !== undefined) {
+                activeTiers[tier] = target;
+                continue;
+            }
+            const refusal = Object.hasOwn(verdict.refused, target) ? verdict.refused[target] : undefined;
+            logger?.warn("sema_registry_tier_binding_unavailable", { tier, model: target, ...(refusal !== undefined ? { code: refusal.code } : {}), hint: "this tier binding names a model that is not in this generation's usable catalog — the binding is dropped (the tier word falls to the next lower bound tier, core's ladder); fix the entry or rebind the tier" });
+        }
+        const nextView = { ...config, models, tiers: activeTiers, modelRefusals: verdict.refused };
+        const noDefault = crossInvariant("default-model-resolvable").check({ live: config, next: nextView });
+        if (noDefault !== undefined)
+            return refuse("default-model-resolvable", noDefault);
+        const endpointRefusal = crossInvariant("model-route-endpoint").check({ live: config, next: nextView });
+        if (endpointRefusal !== undefined)
+            return refuse("model-route-endpoint", endpointRefusal);
+        const minted = crossInvariant("refused-names-not-minted").check({ live: config, next: nextView });
+        if (minted !== undefined)
+            return refuse("refused-names-not-minted", minted, { minted: mintedRefusedNames(nextView) });
+        for (const [role, spec] of Object.entries(roles)) {
+            const target = typeof spec === "string" ? spec : spec !== null && typeof spec === "object" && "model" in spec && typeof spec.model === "string" ? spec.model : undefined;
+            const refusal = target !== undefined && Object.hasOwn(verdict.refused, target) ? verdict.refused[target] : undefined;
+            if (refusal !== undefined) {
+                logger?.warn("sema_registry_role_binding_unavailable", { role, model: target, code: refusal.code, hint: ROLE_BINDING_UNAVAILABLE_HINT });
+            }
         }
         const atModelAllowlist = stageAtModelAllowlist(eff.models?.atModelAllowlist, models, logger);
-        modelPlane = {
+        const defaultModel = models.default;
+        const plane = {
             models,
             modelApiKeyEnv,
             modelApiKeys,
+            modelRefusals: { ...verdict.refused },
             quotaWeights,
             roles,
             activeTiers,
             atModelAllowlist,
-            infoLine: { count: enabled.length, default: models.default.id, defaultSource: picked.source, roles: Object.keys(roles), tiers: Object.keys(activeTiers), atModelAllowlist: atModelAllowlist.length, sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length },
+            infoLine: { count: usable.length, ...(Object.keys(verdict.refused).length > 0 ? { unavailable: Object.keys(verdict.refused) } : {}), default: defaultModel.id, defaultSource: picked.source, roles: Object.keys(roles), tiers: Object.keys(activeTiers), atModelAllowlist: atModelAllowlist.length, sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length },
         };
+        return { stages: { models: plane, collab: stageCollabDomain(eff) }, defaultName: picked.name, refused: verdict.refused };
     }
-    const approvalGate = stageApprovalGate(config, eff.governance, opts, logger);
-    const limits = stageLimits(config, { version: typeof eff.version === "number" ? eff.version : 0, ...("limits" in eff ? { limits: eff.limits } : {}), legacyGates: legacyGateValues(eff.runtime) }, logger);
-    const hot = stageRuntimeHot(config, eff.governance, logger);
+}
+function stageCollabDomain(eff) {
     const projected = projectCollabToWorkflows(eff.collab?.templates);
-    const collabNotices = [];
+    const notices = [];
     if (Object.keys(projected.workflows).length > 0)
-        collabNotices.push({ level: "info", msg: "sema_registry_collab_workflows", fields: { workflows: Object.keys(projected.workflows) } });
+        notices.push({ level: "info", msg: "sema_registry_collab_workflows", fields: { workflows: Object.keys(projected.workflows) } });
     if (projected.skipped.length > 0)
-        collabNotices.push({ level: "warn", msg: "sema_registry_collab_skipped", fields: { skipped: projected.skipped } });
+        notices.push({ level: "warn", msg: "sema_registry_collab_skipped", fields: { skipped: projected.skipped } });
     if (projected.notes.length > 0)
-        collabNotices.push({ level: "info", msg: "sema_registry_collab_notes", fields: { notes: projected.notes } });
-    const collabPlane = { workflows: projected.workflows, notices: collabNotices };
+        notices.push({ level: "info", msg: "sema_registry_collab_notes", fields: { notes: projected.notes } });
+    return { workflows: projected.workflows, notices };
+}
+function stageEffective(config, eff, logger, opts) {
+    if (opts.leg === "boot" && !eff.version) {
+        logger?.warn("sema_registry_unpublished", {
+            version: eff.version,
+            note: "empty/unpublished effective config — using env + built-in fallback; publish a config or unset CONFIG_PUBLISH_MODE",
+        });
+    }
+    const modelPlaneGroup = stageModelPlane(config, eff, logger, opts.sealedKeys);
+    const approvalGate = stageApprovalGate(config, eff.governance, opts, logger);
+    const limits = stageLimits(config, { version: typeof eff.version === "number" ? eff.version : 0, ...("limits" in eff ? { limits: eff.limits } : {}), legacyGates: legacyGateValues(eff.runtime) }, logger);
+    const hot = stageRuntimeHot(config, eff.governance, logger);
     const projDomain = eff.projects;
     const rawProjects = (projDomain && typeof projDomain === "object" && !Array.isArray(projDomain) &&
         "projects" in projDomain && typeof projDomain.projects === "object"
@@ -316,11 +388,10 @@ function stageEffective(config, eff, logger, opts) {
     }
     return {
         version: typeof eff.version === "number" && Number.isFinite(eff.version) ? eff.version : 0,
-        ...(modelPlane !== undefined ? { modelPlane } : {}),
+        modelPlaneGroup,
         approvalGate,
         limits,
         hot,
-        collabPlane,
         projects,
     };
 }
@@ -522,6 +593,8 @@ export function resolveDefaultModelName(eff, has, fallback, onDangling) {
 }
 export function logEffectiveDiff(config, eff, logger) {
     const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
+    const plane = stageModelPlane(config, eff, undefined, undefined);
+    const refused = plane.refused ?? {};
     const centerModels = enabled.map((m) => ({ name: m.name, id: m.id, provider: m.provider, apiKeyEnv: m.apiKeyEnv ?? null, tier: m.tier ?? null }));
     const envModels = Object.entries(config.models).map(([name, m]) => ({ name, id: m.id, provider: m.provider }));
     const centerRoles = Object.fromEntries(Object.entries(eff.models?.roles ?? {}).map(([r, t]) => [r, "model" in t ? t.model : { select: t.select }]));
@@ -529,7 +602,9 @@ export function logEffectiveDiff(config, eff, logger) {
         note: "DRY RUN — registry config NOT applied; unset SEMA_REGISTRY_DRY_RUN to go live",
         version: eff.version,
         wouldOverrideModels: enabled.length > 0,
-        wouldDefaultModel: enabled.length > 0 ? resolveDefaultModelName(eff, (n) => enabled.some((m) => m.name === n), enabled[0].name).name : null,
+        wouldDefaultModel: plane.defaultName ?? null,
+        ...(Object.keys(refused).length > 0 ? { wouldRefuse: Object.fromEntries(Object.entries(refused).map(([n, r]) => [n, r.code])) } : {}),
+        ...(plane.rejected !== undefined ? { wouldRefuseModelPlane: { invariant: plane.rejected.invariant, reason: plane.rejected.reason } } : {}),
         currentDefaultModel: config.model.id,
         models: { center: centerModels, envDerived: envModels },
         roles: { center: centerRoles, current: config.roles },

package/dist/config-center/apply-ledger.d.ts

@@ -25,9 +25,13 @@
  *  · `limitsHttp` —— [ref] 批1 限额组(属主 `stage-limits.ts`);
  *  · `approvalGate` —— S-668 波 2 审批组(`governance.approvalRequire`;属主 `apply-effective.ts` 的
  *    `stageApprovalGate`:坏形 / 工具名匹配不到 / ④ 门意图不可服务 ⇒ 整组拒)。
- * 两组同姿势、各用各的判据表(审批组**不**复用限额组的跨键不变量表 —— 那张表的候选视图只叠限额键)。
+ *  · `modelPlane` —— 模型面组(组内有哪些 effective 域的**唯一定义** = `apply-effective.ts` 的 `MODEL_PLANE_DOMAINS`:models 域 =
+ *    目录 / roles / tiers / 拒因表 / 名单 / 钥匙表,collab 域 = 引用它的命名 workflow 注册表;属主 `stageModelPlane`:
+ *    模型面三条跨键不变量 `default-model-resolvable` / `model-route-endpoint` / `refused-names-not-minted` 任一不成立 ⇒ 整组拒,
+ *    组内各域都停在上一代。opus 腿 O3(7.101.0 合并复审):此前这三条是 stage 抛 = 整份候选中止,同候选其余组陪葬)。
+ * 各组同姿势、各用各的判据表(审批组**不**复用限额组的跨键不变量表 —— 那张表的候选视图只叠限额键)。
  */
-export declare const CONFIG_APPLY_GROUPS: readonly ["limitsHttp", "approvalGate"];
+export declare const CONFIG_APPLY_GROUPS: readonly ["limitsHttp", "approvalGate", "modelPlane"];
 export type ConfigApplyGroup = (typeof CONFIG_APPLY_GROUPS)[number];
 /** 一组的收敛状态(读面形对所有组相同)。 */
 export interface ConfigApplyGroupState {
@@ -88,6 +92,12 @@ export declare function refusedGroups(report: ConfigApplyReport): Array<{
     readonly keys: readonly string[];
     readonly reason: string;
 }>;
+/**
+ * O3:这一次 apply 的**模型面组**(组内各域 = `MODEL_PLANE_DOMAINS`,目录与引用它的 collab 模板同进退)落地了没有(整组被拒 ⇒
+ * false;报告缺席 = 没走到 commit ⇒ false,如实)。调用方据此决定「Runner 现在跑的是哪一代模型面」(`appliedPlaneEff`,swap 判据的
+ * 基准)、名册门开不开、以及 boot 要不要按组回落 LKG —— 都只许从真落地的模型面推进。
+ */
+export declare function modelPlaneCommitted(report: ConfigApplyReport | undefined): boolean;
 export interface ConfigApplyLedger {
     /** 拉到一个候选(无论后续是否应用)。ordinal=收货序数,version=身份标。 */
     seenTarget(ordinal: number, version: number): void;

package/dist/config-center/apply-ledger.js

@@ -1,10 +1,13 @@
-export const CONFIG_APPLY_GROUPS = ["limitsHttp", "approvalGate"];
+export const CONFIG_APPLY_GROUPS = ["limitsHttp", "approvalGate", "modelPlane"];
 export function refusedGroups(report) {
     return CONFIG_APPLY_GROUPS.flatMap((group) => {
         const r = report.groups[group].rejected;
         return r ? [{ group, keys: r.keys, reason: r.reason }] : [];
     });
 }
+export function modelPlaneCommitted(report) {
+    return report !== undefined && report.groups.modelPlane.rejected === undefined;
+}
 export function createConfigApplyLedger(now = () => Date.now()) {
     let targetOrd = 0;
     let appliedOrd = 0;

package/dist/config-center/facade.d.ts

@@ -48,7 +48,7 @@
  * importers to update, which was done in the same commit.
  */
 export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
-export { mutateInPlace, applyEffective, type ApplyReport, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, } from "./apply-effective.js";
+export { mutateInPlace, applyEffective, type ApplyReport, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, MODEL_PLANE_DOMAINS, type ModelPlaneDomain, type ModelPlaneOf, withModelPlaneOf, buildEnvOnlyModelPlane, } from "./apply-effective.js";
 export { restartReasons, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type RestartSignal, } from "./restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
 export { applyCenterReadFace, CENTER_READ_FACE_LIVE_KEYS, type CenterReadFaceApply, type CenterReadFaceReport, type ReadFaceBaseline } from "./read-face.js";

package/dist/config-center/facade.js

@@ -1,5 +1,5 @@
 export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
-export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, } from "./apply-effective.js";
+export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, MODEL_PLANE_DOMAINS, withModelPlaneOf, buildEnvOnlyModelPlane, } from "./apply-effective.js";
 export { restartReasons, modelPlaneChanged, } from "./restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
 export { applyCenterReadFace, CENTER_READ_FACE_LIVE_KEYS } from "./read-face.js";

package/dist/config-center/http-client.d.ts

@@ -1,11 +1,13 @@
 import { type EffectiveReadWarning, type EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
 import type { ScenarioRuling } from "../capabilities/scenarios.js";
 import type { EffectiveConfig, ExecutionRuling } from "./types.js";
+import { type DroppedConfigEntry } from "./read-warnings.js";
 import { type CenterEndpoint } from "./center-request.js";
 /** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error, and on a
  *  payload that is not an effective config at all(非对象 / version 非有限数 / gate 域坏形——[ref] 裁B)。
  *  `domainErrors`:坏 catalog 域(schema default 已落)逐域单列——与本地腿 `FetchEffectiveResult` 同键同义,
- *  boot/refresh 的候选门直接消费。
+ *  boot/refresh 的候选门直接消费。`droppedEntries`(S-704 ②):schema 逐条丢掉的条目(坐标 + 字段诊断)——
+ *  **不**进候选门,调用方响亮点名、其余照用(分面单点 `splitFoldedReadWarnings`,与本地腿同一只)。
  *
  *  `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),与本地腿同键同义。折叠是**有损**的——
  *  `hosts-grandfathered` / `legacy-governance-lifted` 两员按律折成 `null`(值已被收编接受,见
@@ -24,6 +26,7 @@ export declare function fetchEffective(center: CenterEndpoint, etag: string | un
         domain: string;
         error: string;
     }>;
+    droppedEntries?: DroppedConfigEntry[];
     readWarnings: readonly EffectiveReadWarning[];
     credentialIdentity: string;
 } | null>;

package/dist/config-center/http-client.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { readEffectiveWire, PrincipalCapsWire } from "@sema-agent/settings-schema";
 import { centerPromptsFromEffective } from "../prompts-domain-validate.js";
-import { foldEffectiveReadWarning } from "./read-warnings.js";
+import { splitFoldedReadWarnings, withDroppedIdentities } from "./read-warnings.js";
 import { centerFetch } from "./center-request.js";
 import { answerStillCurrent } from "../center-credential.js";
 const CENTER_PULL_TIMEOUT_MS = 8000;
@@ -12,20 +12,25 @@ export async function fetchEffective(center, etag, fetchImpl = fetch, worker) {
     if (!res.ok)
         throw new Error(`config-center HTTP ${res.status}`);
     const warnings = [];
-    const wire = readEffectiveWire(await res.json(), (w) => warnings.push(w));
+    const body = await res.json();
+    const wire = readEffectiveWire(body, (w) => warnings.push(w));
     const centerPrompts = centerPromptsFromEffective(wire);
     if (centerPrompts === undefined)
         delete wire.prompts;
     else
         wire.prompts = centerPrompts;
-    const domainErrors = [];
-    for (const w of warnings) {
-        const f = foldEffectiveReadWarning(w);
-        if (f !== null)
-            domainErrors.push(f);
-    }
-    const effective = wire;
-    return { effective, etag: res.headers.get("etag") ?? undefined, readWarnings: warnings, credentialIdentity: identity, ...(domainErrors.length > 0 ? { domainErrors } : {}) };
+    const rawModels = typeof body === "object" && body !== null && !Array.isArray(body) ? body.models : undefined;
+    const parsedModels = wire.models?.models;
+    const { domainErrors, droppedEntries, droppedIdentities } = splitFoldedReadWarnings(warnings, { raw: rawModels, parsed: Array.isArray(parsedModels) ? parsedModels : undefined });
+    const effective = withDroppedIdentities(wire, droppedIdentities);
+    return {
+        effective,
+        etag: res.headers.get("etag") ?? undefined,
+        readWarnings: warnings,
+        credentialIdentity: identity,
+        ...(domainErrors.length > 0 ? { domainErrors } : {}),
+        ...(droppedEntries.length > 0 ? { droppedEntries } : {}),
+    };
 }
 export async function fetchPrincipalCaps(center, principal, etag, fetchImpl = fetch, worker) {
     const raw = await requestPrincipalView(center, principal, etag, fetchImpl, worker);

package/dist/config-center/read-warnings.d.ts

@@ -10,20 +10,129 @@
  * 截断:schema 的键列表有界(64),超界带 `truncatedFrom`(真实总数)——文案如实带上,消费方永远不把有界列表当穷举。
  * 词表是闭集:`switch` 穷举 `kind`,schema 加新 kind 这里编译红,不会静默漏臂。
  *
- * **归族只有一条判据**(下游只有一个消费者——候选门:非空 ⇒ 这棵树整拒、保 LKG):
- * 运维**写了而没生效**的 ⇒ 候选门错误;值**已被收编接受**(写了、生效了、只是换了个位置或被夹住)⇒ 不入诊断面。
- * settings-schema 2.0.0 的两员新告警各自入族,没有新开第三档:`entry-dropped`(逐条容错丢掉的那条条目——
- * 运维写下的模型/服务器没进目录,与 `domain-defaulted` 是同一件事的细/粗两档)归前者;
- * `legacy-governance-lifted`(0.5 期 runtime 文档里的治理三闸被抬进 governance 域)归后者——那几个键**生效了**
+ * **归族判据两问**(下游两个消费者:候选门 = 非空 ⇒ 这棵树整拒、保 LKG;逐条丢弃面 = 响亮点名、其余照用):
+ *  ① 值**已被收编接受**(写了、生效了、只是换了个位置或被夹住)⇒ 不入诊断面(`null`);
+ *  ② 写了没生效的,按**失效的颗粒**分:丢的是**一条条目**(`entry-dropped`)⇒ `scope:"entry"` —— 这条条目单独
+ *     不在,同域其余条目照用,候选**不**因它整拒;丢的是一个域 / 一组键 / 一个文件 ⇒ `scope:"domain"` —— 候选门错误。
+ *
+ * 🔴 S-704 ②(2026-09-24,凭据轴):此前 `entry-dropped` 归「候选门错误」(settings-schema 2.0.0 提货时的归族),于是
+ * schema 的**逐条容错**在本仓的 refresh / 迟到 boot 两条腿上被**还原成整份拒** —— 目录里一条 `contextWindow:"abc"`
+ * 就让整份目录停在上一代;而上一代若还是 env(boot 拉取失败 / 超窗且无 LKG),env 模型就一直服务、env 钥匙一直被送到
+ * 网关缺省端点(红先实测:`config_candidate_rejected` + env 模型继续服务)。粒度对了规则反而更少:颗粒是条目的失效
+ * 留在条目上,只有颗粒更粗的失效才动候选。
+ * `legacy-governance-lifted`(0.5 期 runtime 文档里的治理三闸被抬进 governance 域)归①——那几个键**生效了**
  * (`buildEffective` 用抬升结果解析 governance),把它折成错误会让一份合法的 0.5 期存量配置每一次 refresh 都被
  * 候选门整拒,而它在 1.10.0 上零告警零 domainErrors(亲验读数)。兼容臂的关窗观测归属主(settings-schema 的
  * `onWarning` 流),不借候选门这条带副作用的通道传信息。
  */
-import { type EffectiveReadWarning } from "@sema-agent/settings-schema";
+import { type ConfigPath, type EffectiveReadWarning } from "@sema-agent/settings-schema";
+/** 折叠产物:`scope` 决定消费方做什么 —— `"domain"` 进候选门(`domainErrors`),`"entry"` 进逐条丢弃面(`droppedEntries`)。 */
 export type FoldedReadWarning = {
+    readonly scope: "domain";
+    readonly domain: string;
+    readonly error: string;
+} | {
+    readonly scope: "entry";
+    readonly domain: string;
+    readonly entry: string;
+    readonly error: string;
+};
+/** 逐条丢弃面的一行(两条读腿的 `droppedEntries` 同形):`entry` = 被丢那条的出门形坐标(`models.1`),`error` = 哪些字段、为什么。 */
+export type DroppedConfigEntry = {
     readonly domain: string;
+    readonly entry: string;
     readonly error: string;
 };
+/**
+ * zod 形的错误 → 一行可读的字段诊断(`contextWindow: expected number, received string; api: custom`)。
+ * **只读**每条 issue 的 `path`(键名)与 `code`,`invalid_type` 臂另读 `expected` / `received`(两者都是**类型词**)——
+ * 刻意不读 `message`(自定义 refine 的 message 可以回声值)与 `invalid_enum_value` 等臂的 `received`(那是原值)。
+ * 读不出 issues 形 ⇒ `undefined`(调用方退回既有文案)。模型面 stage 的逐条判据与本折叠点共用这一只(一个刻度)。
+ */
+export declare function describeSchemaIssues(error: unknown): string | undefined;
+/**
+ * zod 形错误 → 坏字段的**键路径**(去重保序;`(entry)` = 整条)。与 {@link describeSchemaIssues} 同一只读法(只读 `path`),
+ * 不含值。模型面 stage 的逐条判据(`judgeCatalogEntry`)与本折叠点的被丢条目身份共用这一只 —— 一个刻度。
+ */
+export declare function describeSchemaIssueFields(error: unknown): string[];
 /** null = 不入诊断面(`hosts-grandfathered` / `legacy-governance-lifted`:值已被收编接受,与本地店同口径)。 */
 export declare function foldEffectiveReadWarning(w: EffectiveReadWarning): FoldedReadWarning | null;
+/**
+ * 🔴 S-712 —— 一条被 schema 逐条丢掉的**启用**目录条目的身份(模型面墓碑的来源;载体 = `EffectiveConfig.models.droppedIdentities`,
+ * 随 effective 走 —— 盘上 LKG 从同一个对象落盘,重启从 LKG 起服墓碑不丢)。
+ *
+ * 为什么要交出身份:条目被丢之后它的名字从目录里消失,而档位增广(core `expandTiers`)会把一个**空出来的**档位词 / CC 别名
+ * (条目恰好叫 `sonnet` / `pro` …)重新铸到另一条条目上 —— 显式点它的请求与点名它的角色绑定就这样被静默换了目的地
+ * (gpt-6 腿 F2 / F3,真复现)。身份进 `modelRefusals` 之后,不变量 `refused-names-not-minted` 才判得到它。
+ *
+ * 🔐 纯身份,不含值:`name` / `id` / `provider` 只取**字符串**(条目自己写的词,本就进日志与拒因句),`fields` 是坏字段的
+ * **键路径**,`issues` 是 {@link describeSchemaIssues} 的一行(键名 + 类型词)—— 被丢条目的原值(可能是一段贴错位置的凭据)
+ * 绝不进载体、日志、LKG 与 400 拒因句。
+ */
+export interface DroppedModelIdentity {
+    /** 出门形坐标(`models.1`),与同一次读的 `droppedEntries[].entry` 同一串。 */
+    readonly entry: string;
+    /** 条目写的 `name`。**缺席 = 身份证明不了**(只剩一形:原文档与本次解析对不上 / 坐标在原文档里不存在,见 {@link droppedEntryIdentity})
+     *  ⇒ 模型面整组拒:证明不了的名字无从证明它不被增广铸出。原文档那一格读到了却没有字符串名的行**不进**载体(没有可保留的名字,
+     *  与停用同处置 —— 7.101.0 验修轮 V-2)。 */
+    readonly name?: string;
+    readonly id?: string;
+    readonly provider?: string;
+    readonly fields: readonly string[];
+    readonly issues: string;
+}
+/** 本次读的模型域**原文**与**解析产物**(两腿各自手里都有这两件:远端 = 响应体与 `readEffectiveWire` 输出;本地 = 盘上
+ *  `config.d/models.json` 与 `FileConfigStore` 输出)。 */
+export interface ModelsDomainSource {
+    /** 模型域的原始文档(`{ models: [...], roles, … }`);读不到 ⇒ `undefined`(身份一律证明不了)。 */
+    readonly raw: unknown;
+    /** 同一次读解析后幸存的条目(schema 逐条丢弃之后的 `models.models`)。 */
+    readonly parsed: readonly unknown[] | undefined;
+}
+/**
+ * 一条被丢行在原文档里那一格的读数 —— **三态**(7.101.0 验修轮 V-2,规则变小:「读不出」只剩一种含义):
+ *  · `named`:格读到了、`name` 是字符串 ⇒ 身份已定(启用的铸墓碑,停用的不是);
+ *  · `nameless`:格读到了、没有字符串 `name`(`null` / 数 / 整格不是对象)⇒ 身份**也**已定:**没有可保留的名字** —— 请求、
+ *    `@`-mention、角色绑定都点不到一个非字符串名,档位增广也铸不出它 ⇒ 与 `enabled:false` 同处置(不是墓碑、不拒组);
+ *  · `undefined`(由 {@link droppedEntryIdentity} 答):格读不到 —— 坐标在原文档里不存在;调用方在原文档与本次解析对不上
+ *    (`sameRead` 假)时根本不来读 ⇒ 两者同是「身份证明不了」,交一条不带 `name` 的载体(模型面据此整组拒)。
+ * 此前 `nameless` 被折进「读不出」⇒ 一行 `{ name: null }` 的坏行(哪怕是停用的)就让整个模型面被拒(codex 验修腿 V-2,boot 腿对
+ * v7.100.0 的窄回归:那时 boot 对同一文档宽容采纳幸存条目)。
+ */
+export type DroppedEntryCell = {
+    readonly kind: "named";
+    readonly name: string;
+    readonly id?: string;
+    readonly provider?: string;
+    readonly enabled: boolean;
+} | {
+    readonly kind: "nameless";
+};
+/**
+ * 🔴 S-712 **唯一**的身份读法:按告警坐标(`path`,模型域文档内的段坐标 —— settings-schema 已把它回写成原文档坐标)回读
+ * 原文档那一格,答 {@link DroppedEntryCell} 三态之一;坐标在原文档里走不通 ⇒ `undefined`(格读不到)。字符串才算
+ * (`name` / `id` / `provider`),`enabled` 只认字面 `false` 为停用。
+ * settings-schema 6.1.0 的 `entry-dropped` 自带 `name` / `id` 到货后,本函数改读告警(同一只函数,换数据源),原文档入参随之删除。
+ */
+export declare function droppedEntryIdentity(rawDoc: unknown, path: ConfigPath): DroppedEntryCell | undefined;
+/**
+ * 两条读腿(远端 `http-client.ts` / 本地 `config-provider.ts`)共用的**分面单点**:折叠产物按 `scope` 分进候选门
+ * (`domainErrors`)与逐条丢弃面(`droppedEntries`)。`switch` 穷举 —— 加一种 scope 不补臂 = 编译红,两腿不会各分各的。
+ * 文案**未脱敏**:进日志流之前各腿在自己的产出边界上过 `redactConfigError`(与 `domainErrors` 同一道)。
+ * S-712:同一次折叠把被丢**模型目录条目**的身份交出(`droppedIdentities`,见 {@link DroppedModelIdentity}),按 {@link DroppedEntryCell}
+ * 三态分流:有名且启用 ⇒ 墓碑;停用的、没有字符串名的 ⇒ 不进载体(停用 = 不在目录,与 7.100.0 同义;无名 = 没有可保留的名字);
+ * 格读不到 / 原文档对不上 ⇒ 不带 `name` 的载体(证明不了)。坏行本身照样走 `droppedEntries`(坐标 + 字段,不带值)。
+ */
+export declare function splitFoldedReadWarnings(warnings: readonly EffectiveReadWarning[], models: ModelsDomainSource): {
+    domainErrors: Array<{
+        domain: string;
+        error: string;
+    }>;
+    droppedEntries: DroppedConfigEntry[];
+    droppedIdentities: DroppedModelIdentity[];
+};
+/** S-712:把本次读交出的被丢身份挂上 effective 的模型域(两腿同一只;空 ⇒ 不挂键)。 */
+export declare function withDroppedIdentities<E extends {
+    models?: object;
+}>(effective: E, droppedIdentities: readonly DroppedModelIdentity[]): E;
 //# sourceMappingURL=read-warnings.d.ts.map