@sema-agent/server 7.100.0 → 7.101.1

package/dist/config-center/read-warnings.js

@@ -1,4 +1,33 @@
 import { formatConfigPath } from "@sema-agent/settings-schema";
+export function describeSchemaIssues(error) {
+    const issues = schemaIssuesOf(error);
+    if (issues === undefined)
+        return undefined;
+    return issues
+        .map((raw) => {
+        const i = (typeof raw === "object" && raw !== null ? raw : {});
+        const field = Array.isArray(i.path) && i.path.length > 0 ? i.path.map(String).join(".") : "(entry)";
+        const what = i.code === "invalid_type" && typeof i.expected === "string" && typeof i.received === "string"
+            ? `expected ${i.expected}, received ${i.received}`
+            : typeof i.code === "string"
+                ? i.code
+                : "invalid";
+        return `${field}: ${what}`;
+    })
+        .join("; ");
+}
+function schemaIssuesOf(error) {
+    const issues = typeof error === "object" && error !== null ? error.issues : undefined;
+    return Array.isArray(issues) && issues.length > 0 ? issues : undefined;
+}
+export function describeSchemaIssueFields(error) {
+    const issues = schemaIssuesOf(error) ?? [];
+    const fields = issues.map((raw) => {
+        const p = typeof raw === "object" && raw !== null ? raw.path : undefined;
+        return Array.isArray(p) && p.length > 0 ? p.map(String).join(".") : "(entry)";
+    });
+    return [...new Set(fields)];
+}
 const MAX_ERROR_CHARS = 600;
 const cap = (s) => s.slice(0, MAX_ERROR_CHARS);
 const errorText = (e) => (e instanceof Error ? e.message : String(e));
@@ -24,19 +53,100 @@ export function foldEffectiveReadWarning(w) {
         case "legacy-governance-lifted":
             return null;
         case "domain-defaulted":
-            return { domain: w.domain, error: cap(errorText(w.error)) };
+            return { scope: "domain", domain: w.domain, error: cap(errorText(w.error)) };
         case "entry-dropped":
-            return { domain: w.domain, error: cap(`entry dropped by domain schema: ${formatConfigPath(w.path)} (${errorText(w.error)})`) };
+            return { scope: "entry", domain: w.domain, entry: formatConfigPath(w.path), error: cap(`entry dropped by domain schema: ${describeSchemaIssues(w.error) ?? errorText(w.error)}`) };
         case "unknown-keys-dropped":
-            return { domain: w.domain, error: keyList("unknown keys dropped by domain schema: ", w.keys, w.truncatedFrom) };
+            return { scope: "domain", domain: w.domain, error: keyList("unknown keys dropped by domain schema: ", w.keys, w.truncatedFrom) };
         case "unknown-keys-carried":
-            return { domain: w.domain, error: keyList("unknown keys carried to consumer (spelling?): ", w.keys, w.truncatedFrom) };
+            return { scope: "domain", domain: w.domain, error: keyList("unknown keys carried to consumer (spelling?): ", w.keys, w.truncatedFrom) };
         case "unread-config-file":
-            return { domain: w.domain ?? "config.d", error: cap(`unread config file ${w.file} (${w.why})`) };
+            return { scope: "domain", domain: w.domain ?? "config.d", error: cap(`unread config file ${w.file} (${w.why})`) };
         default: {
             const never = w;
             throw new Error(`unhandled EffectiveReadWarning kind: ${JSON.stringify(never)}`);
         }
     }
 }
+const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+export function droppedEntryIdentity(rawDoc, path) {
+    let at = rawDoc;
+    for (const seg of path) {
+        if (typeof seg === "number") {
+            if (!Array.isArray(at) || !Number.isInteger(seg) || seg < 0 || seg >= at.length)
+                return undefined;
+            at = at[seg];
+        }
+        else {
+            if (!isRecord(at) || !Object.hasOwn(at, seg))
+                return undefined;
+            at = at[seg];
+        }
+    }
+    if (!isRecord(at) || typeof at.name !== "string")
+        return { kind: "nameless" };
+    return { kind: "named", name: at.name, ...(typeof at.id === "string" ? { id: at.id } : {}), ...(typeof at.provider === "string" ? { provider: at.provider } : {}), enabled: at.enabled !== false };
+}
+function isModelEntryDrop(w) {
+    return w.kind === "entry-dropped" && w.domain === "models" && w.path.length === 2 && w.path[0] === "models" && typeof w.path[1] === "number";
+}
+function sameRead(source, dropped) {
+    const rawModels = isRecord(source.raw) ? source.raw.models : undefined;
+    if (!Array.isArray(rawModels) || source.parsed === undefined)
+        return false;
+    if ([...dropped].some((i) => i >= rawModels.length))
+        return false;
+    const survivors = rawModels.filter((_, i) => !dropped.has(i));
+    return survivors.length === source.parsed.length && survivors.every((s, k) => isRecord(s) && isRecord(source.parsed[k]) && s.name === source.parsed[k].name);
+}
+export function splitFoldedReadWarnings(warnings, models) {
+    const domainErrors = [];
+    const droppedEntries = [];
+    for (const w of warnings) {
+        const f = foldEffectiveReadWarning(w);
+        if (f === null)
+            continue;
+        switch (f.scope) {
+            case "domain":
+                domainErrors.push({ domain: f.domain, error: f.error });
+                break;
+            case "entry":
+                droppedEntries.push({ domain: f.domain, entry: f.entry, error: f.error });
+                break;
+            default: {
+                const never = f;
+                throw new Error(`unhandled folded read-warning scope: ${JSON.stringify(never)}`);
+            }
+        }
+    }
+    const modelDrops = warnings.filter(isModelEntryDrop);
+    const readable = sameRead(models, new Set(modelDrops.map((w) => w.path[1])));
+    const droppedIdentities = [];
+    for (const w of modelDrops) {
+        const unproven = { entry: formatConfigPath(w.path), fields: describeSchemaIssueFields(w.error), issues: describeSchemaIssues(w.error) ?? "(schema issues unreadable)" };
+        const cell = readable ? droppedEntryIdentity(models.raw, w.path) : undefined;
+        if (cell === undefined) {
+            droppedIdentities.push(unproven);
+            continue;
+        }
+        switch (cell.kind) {
+            case "nameless":
+                break;
+            case "named":
+                if (cell.enabled)
+                    droppedIdentities.push({ ...unproven, name: cell.name, ...(cell.id !== undefined ? { id: cell.id } : {}), ...(cell.provider !== undefined ? { provider: cell.provider } : {}) });
+                break;
+            default: {
+                const never = cell;
+                throw new Error(`unhandled dropped-entry cell: ${JSON.stringify(never)}`);
+            }
+        }
+    }
+    return { domainErrors, droppedEntries, droppedIdentities };
+}
+export function withDroppedIdentities(effective, droppedIdentities) {
+    if (droppedIdentities.length === 0 || effective.models === undefined)
+        return effective;
+    return { ...effective, models: { ...effective.models, droppedIdentities: [...droppedIdentities] } };
+}
 //# sourceMappingURL=read-warnings.js.map

package/dist/config-center/types.d.ts

@@ -8,6 +8,7 @@
 import type { ToolContentOrigin } from "@sema-agent/core";
 import type { CollabTemplateWire } from "../capabilities/collab-wire.js";
 import type { Autonomy, CommandRule } from "../runtime-governance.js";
+import type { DroppedModelIdentity } from "./read-warnings.js";
 export interface CenterModel {
     name: string;
     id: string;
@@ -263,6 +264,11 @@ export interface EffectiveConfig {
         default?: string;
         tierGroups?: unknown;
         activeTierGroup?: string;
+        /** 🔴 S-712 —— **本仓读腿铸的**载体(不是 wire 键:中心在模型域里写同名键会被 schema 当未知键剥掉并进候选门):这次读
+         *  被 schema 逐条丢掉的**启用**目录条目的身份。模型面 stage 把它们铸成 `config.model_entry_invalid` 墓碑进 `modelRefusals`,
+         *  不变量 `refused-names-not-minted` 据此判增广有没有把它们的名字铸到别的条目上。挂在 effective 上(而不是读结果旁边)是为了
+         *  **随 effective 落 LKG**:重启从 LKG 起服时墓碑还在。形见 {@link DroppedModelIdentity}(纯身份,不含值)。 */
+        droppedIdentities?: DroppedModelIdentity[];
     };
     /** registry-core 0.7 collab domain (teams' successor) — consumed by the slice-1.5 projection
      *  (projectCollabToWorkflows → registerCollabWorkflows). Both lanes carry it: the remote worker /effective view

package/dist/config-invariants.d.ts

@@ -28,9 +28,9 @@ import type { ServiceConfigFlat } from "./config-types.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "model-route-endpoint" | "require-execution-lane";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "require-execution-lane";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;

package/dist/config-invariants.js

@@ -2,6 +2,7 @@ import { assertGuardPatternsUsable } from "./deployment-governance.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
+import { defaultModelRefusal, refusedNameMintedRefusal } from "./model-entry-refusal.js";
 export const LIVENESS_HEARTBEAT_MS = 30_000;
 const anyServiceAuth = (v) => Boolean(v.authToken) || Object.keys(v.authTokens ?? {}).length > 0;
 const mustNarrowBind = (v) => Boolean(v.allowUnauthedWrites) && !anyServiceAuth(v);
@@ -166,6 +167,20 @@ export const CONFIG_CROSS_INVARIANTS = [
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:model-route-endpoint" },
         check: ({ live, next }) => (next.models === live.models ? undefined : modelRouteEndpointRefusal(next)),
     },
+    {
+        id: "default-model-resolvable",
+        keys: ["models", "modelRefusals"],
+        restartReason: "default-model",
+        bootAnchor: { file: "src/boot/stage-02-registry-pull.ts", marker: "CROSS-INVARIANT:default-model-resolvable" },
+        check: ({ live, next }) => (next.models === live.models ? undefined : defaultModelRefusal(next, "catalog")),
+    },
+    {
+        id: "refused-names-not-minted",
+        keys: ["models", "tiers", "modelRefusals"],
+        restartReason: "refused-model-name",
+        bootAnchor: { file: "src/boot/stage-02-registry-pull.ts", marker: "CROSS-INVARIANT:refused-names-not-minted" },
+        check: ({ live, next }) => (next.models === live.models ? undefined : refusedNameMintedRefusal(next)),
+    },
 ];
 export function crossInvariant(id) {
     const inv = CONFIG_CROSS_INVARIANTS.find((i) => i.id === id);

package/dist/config-provider.d.ts

@@ -1,3 +1,4 @@
+import { type DroppedConfigEntry } from "./config-center/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
 import { type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./config-center/facade.js";
@@ -20,6 +21,8 @@ import type { CenterEndpoint } from "./config-center/center-request.js";
  *  路由进日志/审计流的消费者必须自己先脱敏。 */
 /** `credentialIdentity`(S-651 / [ref] E-15):远程腿恒在场 = 这次拉取所用凭证的身份(分箱键来源);本地腿
  *  缺席(没有凭证 —— config.d 就在本机盘上)。 */
+/** `droppedEntries`(S-704 ②):schema 逐条丢掉的条目(坐标 + 字段诊断,已脱敏)—— **不**进候选门,调用方逐条响亮
+ *  点名、其余照用;缺席 = 这次读零逐条丢弃(与 `domainErrors` 同一种缺席即无的形)。 */
 export type FetchEffectiveResult = {
     effective: EffectiveConfig;
     etag?: string;
@@ -27,6 +30,7 @@ export type FetchEffectiveResult = {
         domain: string;
         error: string;
     }>;
+    droppedEntries?: DroppedConfigEntry[];
     readWarnings: readonly EffectiveReadWarning[];
     credentialIdentity?: string;
 } | null;

package/dist/config-provider.js

@@ -1,6 +1,7 @@
 import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
-import { foldEffectiveReadWarning } from "./config-center/read-warnings.js";
+import { splitFoldedReadWarnings, withDroppedIdentities } from "./config-center/read-warnings.js";
+import { readFile, stat } from "node:fs/promises";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
 import { findSkillContent, skillContentHash, refIntegrityIssues, createSiblingResolver, formatConfigPath, REF_CHECKED_DOMAINS, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
@@ -11,6 +12,24 @@ const OPERAND_FINGERPRINT_KEY = randomBytes(16);
 function redactConfigError(text) {
     return redactSecrets(text).replace(/"[^"]*"|'[^']*'/g, (m) => `"#${createHmac("sha256", OPERAND_FINGERPRINT_KEY).update(m.slice(1, -1)).digest("hex").slice(0, 8)}"`);
 }
+async function readRawDomainDoc(path) {
+    try {
+        const doc = JSON.parse(await readFile(path, "utf8"));
+        return { ok: true, doc };
+    }
+    catch (e) {
+        return { ok: false, why: e instanceof Error ? e.message : String(e) };
+    }
+}
+async function statSignature(path) {
+    try {
+        const st = await stat(path, { bigint: true });
+        return { ok: true, sig: `${st.ino}:${st.size}:${st.mtimeNs}:${st.ctimeNs}` };
+    }
+    catch (e) {
+        return { ok: false, why: e instanceof Error ? e.message : String(e) };
+    }
+}
 export const BOOT_FETCH_DEFERRED = Symbol("boot-fetch-deferred");
 export function raceBootFetch(fetch, budgetMs) {
     if (budgetMs <= 0)
@@ -33,9 +52,13 @@ export class RemoteConfigProvider {
     async fetchEffective(etag) {
         const fn = this.deps.fetchEffective ?? remoteFetchEffective;
         const r = await fn(this.cc, etag, undefined, this.cc.worker);
-        if (r === null || r.domainErrors === undefined)
+        if (r === null || (r.domainErrors === undefined && r.droppedEntries === undefined))
             return r;
-        return { ...r, domainErrors: r.domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })) };
+        return {
+            ...r,
+            ...(r.domainErrors !== undefined ? { domainErrors: r.domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })) } : {}),
+            ...(r.droppedEntries !== undefined ? { droppedEntries: r.droppedEntries.map((d) => ({ ...d, error: redactConfigError(d.error) })) } : {}),
+        };
     }
     async fetchSkillContent(contentHash) {
         const fn = this.deps.fetchSkillContent ?? remoteFetchSkillContent;
@@ -60,15 +83,11 @@ export class LocalConfigProvider {
         this.store = store ?? new FileConfigStore(root);
     }
     async fetchEffective(etag) {
-        const parseWarnings = [];
         const readWarnings = [];
         const store = this.#injectedStore ??
             new FileConfigStore(this.root, {
                 onWarning: (w) => {
                     readWarnings.push(w);
-                    const f = foldEffectiveReadWarning(w);
-                    if (f !== null)
-                        parseWarnings.push(f);
                 },
             });
         const { effective: eff, domainErrors } = await store.getEffective({ tolerant: true });
@@ -82,9 +101,45 @@ export class LocalConfigProvider {
             if (issues.length > 0)
                 refErrors.push({ domain: d, error: issues.map((i) => `${formatConfigPath(i.path)}: ${redactConfigError(i.message)}`).join("; ") });
         }
-        const parseErrors = parseWarnings.map((w) => ({ domain: w.domain, error: redactConfigError(w.error) }));
+        const modelDropped = readWarnings.some((w) => w.kind === "entry-dropped" && w.domain === "models");
+        const rawModels = modelDropped ? await this.#provenRawModelsDoc(store, eff.version) : undefined;
+        const folded = splitFoldedReadWarnings(readWarnings, { raw: rawModels, parsed: eff.models.models ?? [] });
+        const parseErrors = folded.domainErrors.map((w) => ({ domain: w.domain, error: redactConfigError(w.error) }));
+        const droppedEntries = folded.droppedEntries.map((d) => ({ ...d, error: redactConfigError(d.error) }));
         const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...parseErrors, ...refErrors];
-        return { effective: mapToServiceEffective(eff, eff.version), etag: tag, readWarnings, ...(errors.length > 0 ? { domainErrors: errors } : {}) };
+        return {
+            effective: withDroppedIdentities(mapToServiceEffective(eff, eff.version), folded.droppedIdentities),
+            etag: tag,
+            readWarnings,
+            ...(errors.length > 0 ? { domainErrors: errors } : {}),
+            ...(droppedEntries.length > 0 ? { droppedEntries } : {}),
+        };
+    }
+    async #provenRawModelsDoc(store, version) {
+        const path = store.domainPath("models");
+        const unproven = (why) => {
+            logger.warn("config_models_raw_unproven", { dir: this.root, why: redactConfigError(why), note: "the dropped model entries of this read cannot be identified from the exact snapshot that was parsed — the candidate's model plane is refused as a group (no tombstone is taken from another version of the file); the next poll re-reads" });
+            return undefined;
+        };
+        const s1 = await statSignature(path);
+        const raw = await readRawDomainDoc(path);
+        let again;
+        try {
+            again = (await (this.#injectedStore ?? new FileConfigStore(this.root)).getEffective({ tolerant: true })).effective.version;
+        }
+        catch (e) {
+            again = `re-parse failed: ${e instanceof Error ? e.message : String(e)}`;
+        }
+        const s2 = await statSignature(path);
+        if (!raw.ok)
+            return unproven(`config.d/models.json unreadable on the identity re-read: ${raw.why}`);
+        if (typeof again !== "number")
+            return unproven(again);
+        if (!s1.ok || !s2.ok || s1.sig !== s2.sig)
+            return unproven("config.d/models.json changed (or could not be stat-ed) while its identity re-read was being proven");
+        if (again !== version)
+            return unproven("config.d changed between the parse and the identity re-read (content version differs)");
+        return raw.doc;
     }
     async fetchSkillContent(contentHash) {
         const skills = await this.store.getDomain("skills");

package/dist/config-types.d.ts

@@ -8,6 +8,7 @@
 import type { ReadFaceSource } from "./read-face-posture.js";
 import type { PostureSource } from "./posture-source.js";
 import type { SealedKeyPoison } from "./sealed-key.js";
+import type { ModelEntryRefusal } from "./model-entry-refusal.js";
 import type { A2aServerSpec, CompliancePosture, CrossSessionDialogExpiry, CrossSessionInboundSetting, FileHistoryRetentionPolicy, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy, WriteProtectedEntry } from "@sema-agent/core";
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 import type { ElicitationThrottle } from "./elicitation.js";
@@ -465,6 +466,16 @@ export interface ServiceConfigFlat {
      *  Env path: empty;populated ONLY by applyEffective(重赋值;keyResolver 随 boot/refresh 重建)。 */
     /** 值=解封明文 或 SealedKeyPoison 毒丸(解封失败标记;key-resolver 对其任务级 throw,恒不落 gateway key 兜底)。 */
     modelApiKeys: Record<string, string | SealedKeyPoison>;
+    /**
+     * S-704 —— **已发布但本部署不可用**的目录条目:catalog NAME → 拒因(`model-entry-refusal.ts` 的闭集码
+     * `config.model_no_brain` / `config.model_entry_invalid` + 上游 id + 一句出路,不含任何值)。
+     *
+     * 这些条目**不在** `models` 里(不可点、不列、不当缺省、不进钥匙表 —— 永远不被改路到另一条 brain / 另一个端点);
+     * 本表只为一件事存在:一次**显式**选中它的请求(body.model / `@name` / settings.model / compactionModel /
+     * agents[].model / side-query / run-local / hook)拿到「为什么」(`request.model_unavailable` + 码),而不是
+     * 「没这模型」。env 腿恒空;只由 applyEffective 与 `models` **同世代同 commit** 整表重赋值(非粘)。
+     */
+    modelRefusals: Readonly<Record<string, ModelEntryRefusal>>;
     /** 配额倍率表(name+id 双键→ModelEntry.quotaWeight):weight-at-burn 的运行时源——tracer 在
      *  brain.call 记账点读它算 weightedTokens(lease 双轴+usage 批报)。registry apply IN-PLACE hot-apply;
      *  env lane 恒空(无倍率概念,weight=1 兜底)。 */
@@ -759,6 +770,8 @@ export interface ServiceConfigFlat {
         timeoutMs?: number;
         livenessMs?: number;
         allowInternetAccess?: boolean;
+        /** S-713 —— `E2B_SANDBOX_ENV=NAME,NAME` 点到、且本进程环境里真有的键 ⇒ 原值(经唯一的「点名放行」谓词 `allowlistedEnv`,
+         *  空串值照带)。键缺席 = 旋钮未设 / 空串;名单形错(空段 / 非变量名形 / 点名名单型旋钮)拒启,源里没有的名按序号 warn。 */
         sandboxEnv?: Record<string, string>;
         mountPath?: string;
         /** [ref]:崩溃遗留沙盒回收腿(E2B_ORPHAN_RECLAIM,默认 true;判据与 v1 边界见
@@ -843,6 +856,8 @@ export interface ServiceConfigFlat {
         dropAllCaps?: boolean;
         network?: "none" | "bridge" | "host";
         commandTimeoutMs?: number;
+        /** S-713 —— `DOCKER_SANDBOX_ENV=NAME,NAME` 点到、且本进程环境里真有的键 ⇒ 原值(与 e2b 的 `sandboxEnv` 同一只解析器、
+         *  同一只谓词;每条 `docker exec` 以 `-e K=V` 注入)。键缺席 = 旋钮未设 / 空串。 */
         env?: Record<string, string>;
     };
     /**
@@ -1578,6 +1593,16 @@ export interface ServiceConfigFlat {
      *  opt-out) is a **fail-loud tombstone** — it refuses boot naming `LSP_HOST_ENABLED`; `LSP_ENABLED=true` keeps
      *  its own meaning (the sandbox lane's opt-in above) and is unaffected. */
     lspHostEnabled: boolean;
+    /** S-699 —— host-lane language-server env **named allowlist** (`LSP_ENV_ALLOW=NAME,NAME`). The language server's env is
+     *  `scrubServerSecrets(process.env)`; each name here is put back **verbatim** from the service's own env on top of that
+     *  (`allowlistedEnv`, the same "named keys pass" predicate as the host shell's `inheritEnv:[names]`) — the deployer
+     *  explicitly accepts handing that value to code the language server runs. Unnamed secret-shaped keys stay stripped.
+     *  `[]` = nothing put back (the default: unset / empty string). A malformed list (empty segment / not an env-var name /
+     *  the name of a name-list knob — S-713: one parser for all three) refuses boot naming the key, without echoing the value. `REQUIRE_PRINCIPAL=true` ⇒ always `[]` (ignored, one boot
+     *  warn) — the multi-tenant posture keeps the full strip. Single-user: only names that EXIST in this process's env
+     *  make it into this list (an absent name is a per-index boot warn) — so every downstream echo of it (the scrub
+     *  disclosure's `allowed`, the config catalog) carries real key names only, never a value pasted in place of a name. */
+    lspEnvAllow: readonly string[];
     /** Graceful drain: how long SIGTERM waits for in-flight turns (live streams + bg/resume legs on this
      *  instance) to finish before the hard shutdown. During drain, new billable submissions get 503+Retry-After and
      *  /health carries `draining:true`. Default 10min (an interactive turn is minutes, not seconds — a
@@ -1733,8 +1758,9 @@ export interface ServiceConfigFlat {
      * **不看任何客户端表态**(纯部署级;memory: operator-knob-must-be-unconditional —— [ref] shellGate 让
      * 一个部署级旋钮的生死由客户端 posture 决定,同病犯过两次)。
      *
-     * 施加点 = `ToolApprovalCoordinator` 的构造参 `unattendedPolicy` **一处**,五条「无人可答」的臂读同一
-     * 个值(设计稿 §1 的表:(a) 有店窗到期赢 CAS /(b) 无店窗到期 /(c) 店报错 catch /(d) windowZero 与
+     * 施加点 = `ToolApprovalCoordinator` 的构造参 `unattendedPolicy`,五条「无人可答」的臂读同一
+     * 个值;对账收敛器的同名构造参(S-706,`boot/reapers.ts` 恒传同一个部署值)只供它的孤儿段打同一只终态 claim ——
+     * 两处读同一个值,于是崩溃恢复与 live 腿同答(设计稿 §1 的表:(a) 有店窗到期赢 CAS /(b) 无店窗到期 /(c) 店报错 catch /(d) windowZero 与
      * headless 腿 /(e) 断连强转 + emit 全灭 + 写侧准入超限 + **投递集合入口活性过滤清空**([ref] 归
      * 位:与「查无活流」同一件事实的两个时刻,详见 `askBroadcast` 的该臂注))。`"timeout"` 宿主自报只留在 (b)(c) ——
      * 结束等待的确实是本仓的窗;其余三臂结束等待的是容量/连接/装配,自报恒缺席。
@@ -1762,13 +1788,16 @@ export interface ServiceConfigFlat {
      *  · **持久回放**(窗到期后向真源收敛、`ensureAsk` 幂等重入撞上已终结的行)读出 PARKING/PARKED 时
      *    **同样按旋钮改判** —— 它们与 (a) 是同一件事(赢家可能是别的副本或上一次调用),不统一的话同一只
      *    ask 的终局会取决于「谁赢了那把 CAS / 重试没重试」。人的真决议回放不受影响。
-     *  · 唯一**不受**改判的是 `ensureAsk` 身份未定 / 坏行两臂(「身份不确定」的处置,不是「没有人」的
-     *    处置),于是 `deny` 部署上仍可能落极少数 park(店抖动期),已知且有意的残余。
+     *  · `ensureAsk` 身份未定 / 坏行两臂**同样**改判(S-702,7.101.0;此前是唯一的例外,deny 部署上店抖动期仍会落 park):
+     *    两臂的处置不变(不编造 wire 身份、不在身份未定时呈卡收人决),「不呈卡之后交什么」过同一个政策口 —— deny ⇒ 部署
+     *    政策拒,本次插下的行同落政策结算(归属证不出的行不当场动 —— 可能正被别的登记呈卡 —— 由收敛器孤儿段收);
+     *    park ⇒ `"unavailable"` 逐字不变。
      *  · 🔴 `deny` 部署上政策结算**当场落行**(NP-2,7.100.0):窗到期 / emit 全灭两臂的店终局 claim 是 `refuse` 意图
      *    —— 这一只 ask 行 CAS 成 DECIDED(deny) + `settled_by="policy"`(按 ask 作用域,不碰批、不连坐兄弟),与交给
      *    引擎的那一只同一个来源词 ⇒ 重入 / 收敛后重入回放同一个政策拒,不退化成裸 `false`(人拒)。修前行停 PARKING,
-     *    run 完成后收敛器转 DENIED 且不带来源。仍按 PARKING 记账的只剩别的写者推进的行(park 政策副本 / 切换政策之前)
-     *    与崩溃后收敛器孤儿腿代打 expire 的行(后者 run 终局后成 DENIED、归因 `routing_failure`,已知残余)。
+     *    run 完成后收敛器转 DENIED 且不带来源。崩溃恢复腿(收敛器孤儿段)与两条兜底臂调**同一只** claim(`settleByPolicy`,
+     *    S-702 / S-706,7.101.0),于是本旋钮也施加到收敛器上(装配点恒传)。仍按 PARKING 记账的只剩别的写者推进的行
+     *    (park 政策副本 / 切换政策之前)。
      *  · 🔴 `deny` 部署上**批是单 ask 批**(S-689 codex R1-F1;`deriveAskScopedBatchId`):批是 park 路由的单位,
      *    整腿一批的前提是「批一关腿就随 park 结束」;deny 下引擎拿到部署政策拒后腿继续跑,整腿一批会让首只到期
      *    把批关掉(同腿后续的卡人批不动)、把兄弟连坐成 VOID(裸 `false` = 人拒)。
@@ -1943,7 +1972,7 @@ export interface ServiceConfigFlat {
 /** 组:store(持久化)—— DB 引擎三态、session 后端、SQL coords、快照 BLOB / SendUserFile 对象存储。 */
 export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "sessionCacheTtlSec" | "storeProbeIntervalMs" | "storeLockWaitMs" | "dbBackend" | "dbBackendExplicit" | "localDataRoot" | "runStoreStrictHydrate" | "tidb" | "pg" | "dbQueryTimeoutMs" | "snapshotBlobStore" | "snapshotBlobSqlMaxBytes" | "snapshotBlobAllowSql" | "fileHistory" | "fileHistoryCapture" | "sendUserFile">;
 /** 组:modelPlane(模型面)—— 网关坐标、Anthropic 路线、韧性旋钮、主/廉价 model entry、role 表、降级梯。 */
-export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
+export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelRefusals" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
 export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "crossSessionInbound" | "crossSessionDialogExpiry">;
@@ -1957,7 +1986,7 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  config 这一层它只是一句声明。 */
 export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */