@sema-agent/server 7.101.1 → 7.103.0

package/dist/config.d.ts

@@ -1,6 +1,7 @@
 import { type Model, type PathRuleBases, type RuleBehavior } from "@sema-agent/core";
 import { type RemoteExecProvider } from "./execution-lane-caps.js";
 import { type Autonomy } from "./runtime-governance.js";
+import { type RunnerEnvNameAllowlistKnob, type ServerEnvNameAllowlistKnob } from "./env-name-allowlist-knobs.js";
 import type { ServiceConfig, ServiceConfigFlat, ServiceConfigGroups } from "./config-types.js";
 /** [ref] A1: the config TYPE face lives in the leaf module config-types.ts; re-exported here so
  *  every existing `from "./config.js"` importer compiles unchanged (pure-type consumers should prefer
@@ -31,6 +32,8 @@ export declare function parseUsageWindows(raw: string | undefined): readonly {
     maxCostUsd?: number;
     anchor: "first-use" | "rolling";
 }[] | undefined;
+/** 墓碑拒启码(机读;拒句方括号里)。 */
+export declare const RETIRED_ENV_REFUSAL_CODE = "config.env_key_retired";
 /** Numeric env with validation: a non-numeric value FAILS at startup instead of silently becoming `NaN`
  *  (which e.g. slips past the `runStaleSec` liveness guard and silently disables the reaper). */
 export declare function numEnv(name: string, fallback: string): number;
@@ -231,6 +234,10 @@ export declare const hostExecSpoolEnabled: () => boolean;
  * 门 = `test/deploy-lanes-contract.test.ts`,它读的是本表而不是任何副本。
  */
 export declare const REQUIRED_ENVS_BY_LANE: Record<RemoteExecProvider, readonly string[]>;
+/** 名单型 env 旋钮的**唯一**解析器(规则全文见上方 `ENV_NAME_ALLOWLIST_KNOBS` 头注)。`undefined` = 没配(未设 / 空串)。
+ *  服务侧旋钮要交本进程的姿态(③);runner 旋钮没有姿态,签名上就不收 —— 读者与行形由叶表的类型一起定,传错是编译红。 */
+export declare function parseEnvNameAllowlist(knob: ServerEnvNameAllowlistKnob, singleUserTurnkey: boolean): readonly string[] | undefined;
+export declare function parseEnvNameAllowlist(knob: RunnerEnvNameAllowlistKnob): readonly string[] | undefined;
 /** [ref]① 1M dual-window (core 1.289 `Model.autoCompactTokens`): an EXPLICIT positive value wins (env
  *  `MODEL_AUTO_COMPACT_TOKENS` / center roster `autoCompactTokens`); else the **model-id table** applies —
  *  sonnet-5-family id ∧ contextWindow>=1e6 ⇒ 967000 (the faithful shape of CC's single-entry per-model

package/dist/config.js

@@ -4,13 +4,13 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, isModelPriced, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, parseRuleText } from "@sema-agent/core";
-import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/settings-schema";
+import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, CENTER_CREDENTIAL_ENV } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { isV2ScopeKey, memoryReplicationCoverage } from "./memory-scope.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
-import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
+import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS } from "./config-types.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
 import { readFaceForPosture } from "./read-face-posture.js";
@@ -20,12 +20,13 @@ import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf } from "./execution-lane-caps.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
+import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 import { allowlistedEnv } from "./server-secret-env.js";
-import { ENV_NAME_ALLOWLIST_KNOBS, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
+import { ENV_NAME_ALLOWLIST_KNOBS, ENV_NAME_ALLOWLIST_KNOB_NAMES, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
     return (process.env[name] ?? "")
@@ -103,10 +104,11 @@ function defaultSkillsDir() {
         return "skills";
     }
 }
+export const RETIRED_ENV_REFUSAL_CODE = "config.env_key_retired";
 const RETIRED_ENVS = [
     ["TIDB_HOST", "MYSQL_HOST", "renamed"], ["TIDB_PORT", "MYSQL_PORT", "renamed"], ["TIDB_USER", "MYSQL_USER", "renamed"],
     ["TIDB_PASSWORD", "MYSQL_PASSWORD", "renamed"], ["TIDB_DATABASE", "MYSQL_DATABASE", "renamed"], ["TIDB_POOL_SIZE", "MYSQL_POOL_SIZE", "renamed"],
-    ["CONFIG_CENTER_URL", "SEMA_REGISTRY_URL", "renamed"], ["CONFIG_CENTER_TOKEN", "SEMA_REGISTRY_TOKEN", "renamed"],
+    ["CONFIG_CENTER_URL", "SEMA_REGISTRY_URL", "renamed"], ["CONFIG_CENTER_TOKEN", CENTER_CREDENTIAL_ENV.token, "renamed"],
     ["CONFIG_CENTER_DRY_RUN", "SEMA_REGISTRY_DRY_RUN", "renamed"], ["CONFIG_CENTER_WORKER", "SEMA_REGISTRY_WORKER", "renamed"],
     ["ANTHROPIC_BASEURL", "ANTHROPIC_BASE_URL", "renamed"],
     ["REGISTRY_ADMIN_TOKEN", "SEMA_REGISTRY_ADMIN_TOKEN", "renamed"],
@@ -119,22 +121,33 @@ const RETIRED_ENVS = [
     ["OA_ISSUE_LABELS", "the OA scenario was removed in 5.0.0", "removed"],
     ["APPROVAL_POLL_MS", "the OA poll-approval lane was removed in 5.0.0; the durable checkpoint lane is the only gate", "removed"],
     ["LEADER_CONFLICT_ROUNDS", "the bounded merge-conflict-resolution agent was deleted in 7.83.0 按 C-R63 删除,合不上交用户:leader 交回 result.conflict(分支 + 冲突文件),run 状态 needs_human", "removed"],
+    [
+        "MODEL_CONNECT_TIMEOUT_MS",
+        "MODEL_FIRST_BYTE_TIMEOUT_MS",
+        "replaced",
+        "since core 7.33.0 the TCP + TLS connect clock is the transport's own; the wait from sending the request to its response headers — " +
+            "what this key really bounded — is MODEL_FIRST_BYTE_TIMEOUT_MS (unset = core's own default, plus an upload allowance and one " +
+            "widened retry; 0 = no engine clock on that segment and the transport's header / body clocks off too — the TCP + TLS connect " +
+            "keeps the transport's own clock)",
+    ],
 ];
+const RETIRED_ENV_SENTENCE = {
+    renamed: (hits) => `${hits.map(([old, to]) => `${old} → use ${to}`).join("; ")} — rename the env key(s); the value semantics are unchanged`,
+    replaced: (hits) => `${hits.map(([old, to, , why]) => `${old} → ${to} (${why})`).join("; ")} — set the replacement deliberately: ` +
+        `its value semantics differ from the retired key's, so do not copy the old value across unread`,
+    removed: (hits) => `${hits.map(([old, why]) => `${old} (${why})`).join("; ")} — remove the env key(s): the capability itself was retired, ` +
+        `there is no replacement name and no rename that restores it`,
+};
+function retiredEnvSentence(kind, hit) {
+    const ofKind = hit.filter((h) => h[2] === kind);
+    return ofKind.length > 0 ? [RETIRED_ENV_SENTENCE[kind](ofKind)] : [];
+}
 function rejectRetiredEnvs() {
     const hit = RETIRED_ENVS.filter(([o]) => process.env[o] !== undefined && process.env[o] !== "");
     if (hit.length === 0)
         return;
-    const renamed = hit.filter(([, , k]) => k === "renamed");
-    const removed = hit.filter(([, , k]) => k === "removed");
-    const parts = [];
-    if (renamed.length > 0) {
-        parts.push(`${renamed.map(([o, n]) => `${o} → use ${n}`).join("; ")} — rename the env key(s); the value semantics are unchanged`);
-    }
-    if (removed.length > 0) {
-        parts.push(`${removed.map(([o, n]) => `${o} (${n})`).join("; ")} — remove the env key(s): the capability itself was retired, ` +
-            `there is no replacement name and no rename that restores it`);
-    }
-    throw new Error(`retired env name(s) set ([2354] 兼容面全清,5.0.0 起拒启): ${parts.join(" | ")}.`);
+    const parts = Object.keys(RETIRED_ENV_SENTENCE).flatMap((kind) => retiredEnvSentence(kind, hit));
+    throw new Error(`retired env name(s) set [${RETIRED_ENV_REFUSAL_CODE}] ([2354] 兼容面全清,5.0.0 起拒启): ${parts.join(" | ")}.`);
 }
 export function numEnv(name, fallback) {
     return parseNumOrFail(name, env(name, fallback));
@@ -490,9 +503,8 @@ function parseNameListEnv(name, raw, opts) {
     return names;
 }
 const ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const ENV_NAME_ALLOWLIST_KNOB_NAMES = new Set(Object.keys(ENV_NAME_ALLOWLIST_KNOBS));
 const ENV_NAME_ALLOWLIST_WITHHELD = "<withheld: entries are not echoed — a value pasted in place of a name can pass the name check>";
-function parseEnvNameAllowlist(knob, singleUserTurnkey) {
+export function parseEnvNameAllowlist(knob, singleUserTurnkey) {
     const raw = process.env[knob];
     if (raw === undefined || raw === "")
         return undefined;
@@ -512,7 +524,7 @@ function parseEnvNameAllowlist(knob, singleUserTurnkey) {
             " — refusing to start rather than silently allowing a partial list (#157). The value is not echoed (a pasted NAME=value pair may carry a secret)." +
             ` Write ${knob}=NAME,NAME with bare variable names, e.g. ${spec.example}.`);
     });
-    if (!singleUserTurnkey) {
+    if ("multiTenant" in spec && singleUserTurnkey !== true) {
         const posture = spec.multiTenant;
         switch (posture.kind) {
             case "ignored":
@@ -664,6 +676,36 @@ function optionalEnumKey(key, envName, raw, allowed) {
     }
     return { [key]: raw };
 }
+function parseAutoModeClassifierTimeoutMs(raw) {
+    if (raw === undefined || raw === "")
+        return {};
+    const { minMs, maxMs } = AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS;
+    const n = /^[1-9]\d*$/.test(raw) ? Number(raw) : Number.NaN;
+    if (!Number.isSafeInteger(n) || n < minMs || n > maxMs) {
+        const shown = raw.length > 40 ? `${raw.slice(0, 40)}…(${raw.length} chars)` : raw;
+        throw new Error(`env AUTO_MODE_CLASSIFIER_TIMEOUT_MS=${JSON.stringify(shown)} must be a whole number of milliseconds in [${minMs}, ${maxMs}] ` +
+            `(decimal digits only; unset = core's own default). It caps ONE rung of the auto-mode classifier ladder — a rung past the cap ` +
+            `did not rule, and with no rung left the gated call is DENIED. "0" has no "off" meaning on this seat; a sub-second value is the ` +
+            `seconds-for-milliseconds slip; above ${maxMs} Node collapses the timer to 1ms. Refusing to boot rather than running the core ` +
+            `default while the operator believes their value is in force (#210).`);
+    }
+    return { autoModeClassifierTimeoutMs: n };
+}
+function parseFirstByteTimeoutMs(raw) {
+    if (raw === undefined || raw === "")
+        return {};
+    const { minMs, maxMs } = FIRST_BYTE_TIMEOUT_BOUNDS;
+    const n = /^(0|[1-9]\d*)$/.test(raw) ? Number(raw) : Number.NaN;
+    if (!Number.isSafeInteger(n) || n < minMs || n > maxMs) {
+        const shown = raw.length > 40 ? `${raw.slice(0, 40)}…(${raw.length} chars)` : raw;
+        throw new Error(`env MODEL_FIRST_BYTE_TIMEOUT_MS=${JSON.stringify(shown)} must be a number of milliseconds: a whole number in [${minMs}, ${maxMs}] ` +
+            `(decimal digits only; unset = core's own default). It bounds the wait from sending the request to its response headers; "0" = no engine clock on ` +
+            `that segment and the transport's header / body clocks off too (the TCP + TLS connect keeps the transport's own clock); ` +
+            `above ${maxMs} Node collapses the timer to 1ms. Refusing to boot rather ` +
+            `than running the core default while the operator believes their value is in force (#210).`);
+    }
+    return { firstByteTimeoutMs: n };
+}
 function headerNameEnv(name, fallback) {
     const v = env(name, fallback);
     if (!/^[A-Za-z0-9_-]+$/.test(v))
@@ -1029,7 +1071,7 @@ function parseModelDomain() {
             }
             : undefined,
         resilience: {
-            connectTimeoutMs: numEnv("MODEL_CONNECT_TIMEOUT_MS", String(RESILIENCE_DEFAULTS.connectTimeoutMs.value)),
+            ...parseFirstByteTimeoutMs(process.env.MODEL_FIRST_BYTE_TIMEOUT_MS),
             firstTokenTimeoutMs: numEnv("MODEL_FIRST_TOKEN_TIMEOUT_MS", String(RESILIENCE_DEFAULTS.firstTokenTimeoutMs.value)),
             idleTimeoutMs: numEnv("MODEL_IDLE_TIMEOUT_MS", String(RESILIENCE_DEFAULTS.idleTimeoutMs.value)),
             circuitBreaker: boolEnv("MODEL_CIRCUIT_BREAKER", RESILIENCE_DEFAULTS.circuitBreaker.value),
@@ -1167,7 +1209,6 @@ export function formatUnmatchableToolNames(source, bad) {
     return (`${source} names tool(s) that can never match a live tool (these lists are RAW whole-name comparisons — core 5.0.0 RB-476 removed the alias/auto-prefix folds): ` +
         bad.map((b) => `${presentToolName(b.name)} → ${b.guidance}`).join("; ")).replace(CONTROL_AND_BIDI_STRIP_RE, "");
 }
-const MAX_TIMER_DELAY_MS = 2_147_483_647;
 function streamApprovalConfig(gates) {
     const cfg = {
         enabled: boolEnv("STREAM_APPROVAL_ENABLED", true),
@@ -1284,6 +1325,7 @@ function parseApprovalDomain(ctx) {
         })(process.env.MANUAL_MODE_SHELL_GATE),
         permissionsDisableAutoMode: boolEnv("PERMISSIONS_DISABLE_AUTO_MODE", false),
         ...optionalEnumKey("autoModeClassifierFallback", "AUTO_MODE_CLASSIFIER_FALLBACK", process.env.AUTO_MODE_CLASSIFIER_FALLBACK, ["main", "none"]),
+        ...parseAutoModeClassifierTimeoutMs(process.env.AUTO_MODE_CLASSIFIER_TIMEOUT_MS),
         ...optionalEnumKey("crossSessionInbound", "CROSS_SESSION_INBOUND", process.env.CROSS_SESSION_INBOUND, CROSS_SESSION_INBOUND_SETTINGS),
         ...optionalEnumKey("crossSessionDialogExpiry", "CROSS_SESSION_DIALOG_EXPIRY", process.env.CROSS_SESSION_DIALOG_EXPIRY, CROSS_SESSION_DIALOG_EXPIRY_VALUES),
         mcpElicitation: {
@@ -1400,6 +1442,22 @@ function lingerMsEnv(name, raw, defaultMs, disableHint) {
     }
     return n;
 }
+function parseDrainSecondSignalMinGapMs(raw) {
+    if (raw === undefined || raw === "")
+        return DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS;
+    const { minMs, maxMs } = DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS;
+    const n = /^(0|[1-9]\d*)$/.test(raw) ? Number(raw) : Number.NaN;
+    if (!Number.isSafeInteger(n) || n < minMs || n > maxMs) {
+        const shown = raw.length > 40 ? `${raw.slice(0, 40)}…(${raw.length} chars)` : raw;
+        throw new Error(`env DRAIN_SECOND_SIGNAL_MIN_GAP_MS=${JSON.stringify(shown)} must be a whole number of milliseconds in [${minMs}, ${maxMs}] ` +
+            `(decimal digits only; unset = ${DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS}). During a drain, a second SIGTERM / SIGINT hard-stops ` +
+            `only when it arrives at least this long after the drain began — closer ones are the same beat delivered twice and are ` +
+            `ignored. "0" turns that filter off (every second signal hard-stops, the 7.101.x behavior); above ${maxMs} (the ` +
+            `DRAIN_GRACE_MS floor) a second signal could never count inside the shortest drain window. Refusing to boot rather ` +
+            `than running the default while the operator believes their value is in force (#210).`);
+    }
+    return n;
+}
 function parseMemoryEmbedder(ctx) {
     const endpoint = process.env.MEMORY_EMBEDDER_ENDPOINT || undefined;
     const model = process.env.MEMORY_EMBEDDER_MODEL || undefined;
@@ -1926,7 +1984,7 @@ function parseOrchestrationDomain(ctx) {
 export const LIMITS_HTTP_FLOORS = {
     attachmentMaxBytes: 1024,
     attachmentUnboundTtlMs: 60_000,
-    drainGraceMs: 10_000,
+    drainGraceMs: DRAIN_GRACE_FLOOR_MS,
 };
 function parseLimitsHttpDomain() {
     return {
@@ -1957,6 +2015,7 @@ function parseLimitsHttpDomain() {
             })(),
         },
         drainGraceMs: clampEnvWithWarn("DRAIN_GRACE_MS", String(10 * 60 * 1000), LIMITS_HTTP_FLOORS.drainGraceMs),
+        drainSecondSignalMinGapMs: parseDrainSecondSignalMinGapMs(process.env.DRAIN_SECOND_SIGNAL_MIN_GAP_MS),
         sighupIdleGraceMs: clampEnvWithWarn("SIGHUP_IDLE_GRACE_MS", String(120_000), 5_000),
         ...parentPidEnv(),
         engineAutoExit: boolEnv("ENGINE_AUTO_EXIT", false),
@@ -2021,7 +2080,8 @@ function parseGitApiKind(raw, baseUrl) {
     }
     return kind;
 }
-function parseIntegrationsDomain() {
+function parseIntegrationsDomain(ctx) {
+    const { requirePrincipal } = ctx;
     return {
         pluginsAllowHosts: (process.env.PLUGINS_ALLOW_HOSTS ?? "github.com").split(",").map((h) => h.trim()).filter(Boolean),
         configBootFetchBudgetMs: clampEnvWithWarn("CONFIG_BOOT_FETCH_BUDGET_MS", "1500", 0),
@@ -2030,17 +2090,19 @@ function parseIntegrationsDomain() {
         gitApiKind: parseGitApiKind(process.env.GIT_API_KIND, process.env.GIT_API_BASEURL),
         defaultScenario: env("DEFAULT_SCENARIO", "code"),
         skillsDir: env("SKILLS_DIR", defaultSkillsDir()),
-        configCenter: process.env.SEMA_REGISTRY_URL ? parseConfigCenter(env("SEMA_REGISTRY_URL")) : undefined,
+        centerCredentialRenewLeadMs: parseCenterCredentialRenewLeadMs(process.env.CENTER_CREDENTIAL_RENEW_LEAD_MS),
+        configCenter: process.env.SEMA_REGISTRY_URL ? parseConfigCenter(env("SEMA_REGISTRY_URL"), requirePrincipal) : undefined,
         configProvider: process.env.CONFIG_PROVIDER || undefined,
         configLocalDir: process.env.CONFIG_LOCAL_DIR || undefined,
         a2aServe: parseA2aServe(),
     };
 }
-function parseConfigCenter(baseUrl) {
+function parseConfigCenter(baseUrl, requirePrincipal) {
     const worker = process.env.SEMA_REGISTRY_WORKER || undefined;
+    const declared = readCenterCredentialDeclaration();
     return {
         baseUrl,
-        credential: createCenterCredentialSource(readCenterCredentialDeclaration(), worker),
+        credential: createCenterCredentialSource(declared.from === "file" ? { ...declared, multiTenant: requirePrincipal } : declared, worker),
         dryRun: boolEnv("SEMA_REGISTRY_DRY_RUN", false),
         worker,
     };
@@ -2141,7 +2203,7 @@ const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
     "approvalHmacKeys", "durableApproval", "durableApprovalSource", "streamAskWindowMsSource", "directApprovalDoor", "directDoorActive", "resourceSuspend",
     "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "mcpElicitation",
-    "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "autoModeClassifierFallback", "crossSessionInbound", "crossSessionDialogExpiry",
+    "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "autoModeClassifierFallback", "autoModeClassifierTimeoutMs", "crossSessionInbound", "crossSessionDialogExpiry",
 ];
 const MEMORY_GROUP_KEYS = [
     "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",
@@ -2166,7 +2228,7 @@ const ORCHESTRATION_GROUP_KEYS = [
 ];
 const LIMITS_HTTP_GROUP_KEYS = [
     "port", "attachmentOrphanGraceMs", "workspaceFileMaxBytes", "attachmentMaxBytes", "attachmentMimeAllowlist",
-    "attachmentUnboundTtlMs", "infraCostRates", "drainGraceMs", "sighupIdleGraceMs", "parentPid",
+    "attachmentUnboundTtlMs", "infraCostRates", "drainGraceMs", "drainSecondSignalMinGapMs", "sighupIdleGraceMs", "parentPid",
     "engineAutoExit", "engineLingerMs", "engineOrphanLingerMs",
     "rateLimitPerMin", "maxTaskCostUsd",
     "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec", "reapIntervalSec", "runStaleSec", "toolResultTtlSec",
@@ -2174,7 +2236,7 @@ const LIMITS_HTTP_GROUP_KEYS = [
 const OBSERVABILITY_GROUP_KEYS = ["metricsToken", "traceToken", "toolTrace", "traceThinking", "logLevel", "otel"];
 const INTEGRATIONS_GROUP_KEYS = [
     "pluginsAllowHosts", "mcpServers", "a2aPeers", "a2aServe", "configBootFetchBudgetMs", "gitApiBaseUrl", "gitApiToken", "gitApiKind", "defaultScenario",
-    "skillsDir", "configCenter", "configProvider", "configLocalDir",
+    "skillsDir", "centerCredentialRenewLeadMs", "configCenter", "configProvider", "configLocalDir",
 ];
 export const CONFIG_GROUP_KEYS = {
     store: STORE_GROUP_KEYS,
@@ -2234,7 +2296,7 @@ export function loadConfig() {
     const orchestration = parseOrchestrationDomain({ postureOn, singleUserTurnkey });
     const limitsHttp = parseLimitsHttpDomain();
     const observability = parseObservabilityDomain();
-    const integrations = parseIntegrationsDomain();
+    const integrations = parseIntegrationsDomain({ requirePrincipal });
     const { directApprovalDoor, durableApproval: dgDurable, approvalHmacKeys: dgHmacKeys } = approval;
     const { principalJwtPubkeys, principalJwtIss, principalJwtAud, operatorPrincipals: dgOperators, authTokens } = auth;
     const { enabled: imageBakesEnabled, runnerPrincipal: bakeRunnerPrincipal } = orchestration.imageBakes;

package/dist/device-store.d.ts

@@ -50,7 +50,7 @@ export declare const DEVICE_RATE_LIMIT_CODE: "limit.rate_exceeded";
  * 排空/停机拒绝复用**既有**的通用码(`draining`,`docs/ASSISTANT-WIRE-CONTRACT.md` 附录 A 已收录,503)。
  *
  * 🔴 刻意不铸 `device.draining`([ref]/[ref]):§4.8 的 device 闭集**冻结**且无 draining 成员,而排空
- * 语义面全部署早有属主词 —— HTTP 计费提交拒臂(`sendError(res, 503, "draining", …)`,SDK spec 逐字引用
+ * 语义面全部署早有属主词 —— HTTP 计费提交拒臂(`http/readiness.ts` 的 `billableRefusalOf` 唯一铸点,S-739 前是 `sendError(res, 503, "draining", …)`;SDK spec 逐字引用
  * 的冻结字面)、drain 期新 upgrade 拒(503)、WS hello 拒帧 / bye 帧的 `draining` 分支键。为同一语义再铸
  * `device.*` 同义码 = 消费端要认两套(上面 rate-limit 条的同一判据);且 `device.draining` 在 HTTP 层
  * 零发送点,写进附录 A 即幽灵行(`error-code-catalog-live` 的「文档多码」臂当场红)。

package/dist/env-name-allowlist-knobs.d.ts

@@ -4,31 +4,45 @@
  * 解析规则(未设 / 形错拒启 / 姿态 / 生效名单)的全文在 `config.ts` `parseEnvNameAllowlist` 的头注;本表只装**各旋钮自己的**事实,
  * 不是解析规则:
  *  · `example` 进拒句;
- *  · `multiTenant` = `REQUIRE_PRINCIPAL=true` 下名单作不作数。
+ *  · `multiTenant` = `REQUIRE_PRINCIPAL=true` 下名单作不作数 —— **只有服务进程读的旋钮有这一列**(姿态是服务进程的概念):
  *    - `LSP_ENV_ALLOW` ⇒ ignored:host 腿语言服务器在多租户姿态下本来就不起,名单无处作数,设了要说出来(S-699)。
  *    - 两只沙箱名单 ⇒ honored:S-713 照录修前语义(任何姿态下都转发),S-715 主会话裁定维持 —— 沙箱 env 是部署方为隔离沙箱显式配的
  *      带外凭据(e2b / docker 车道本来就是多租户 fleet 的主形),与 LSP 那条「本机子进程」的形不同;多租户下起服说一句。
- * 表是 `Record<旋钮, …>`:闭集加一只旋钮而不补行 = 编译红。
+ *  · `BAKE_ENV_ALLOW`(S-684 残余,7.103.0)由 **bake-runner 进程**读(构建宿主守护进程:没有主体、没有租户 ⇒ 没有姿态列,
+ *    不进 {@link describeAllowlistPostures} 的姿态句)。它与三只服务侧旋钮同一只解析器、同一只「点名放行」谓词、同一条「原文按凭据类」律。
+ * 表是 `Record<旋钮, …>`:闭集加一只旋钮而不补行 = 编译红;行形随读它的进程定(服务进程 ⇒ 必须写姿态列)。
  *
  * 🔴 **姿态列只在这里写一次**([ref];7.101.0 合并复审 O9):凡要对人说「多租户下哪只旋钮忽略、哪只照转发」的句子,一律取
  * {@link describeAllowlistPostures} 的读数 —— 今天三处:`config_env_forwarded_multi_tenant.note`(`config.ts` 解析器)、LSP 剥除现场的
  * 出路句(`observability/secret-env-scrub.ts`)、配置目录 `LSP_ENV_ALLOW` 行(`config-catalog.ts`)。修前三处各手抄一遍,表改一格它们
  * 当场撒谎。为什么是纯叶:`config-catalog.ts` 被 `config.ts` 值引,表留在 `config.ts` 会成装载环。
  */
-export type EnvNameAllowlistKnob = "LSP_ENV_ALLOW" | "E2B_SANDBOX_ENV" | "DOCKER_SANDBOX_ENV";
+/** 服务进程(`config.ts` `loadConfig`)读的名单型旋钮 —— 有多租户姿态。 */
+export type ServerEnvNameAllowlistKnob = "LSP_ENV_ALLOW" | "E2B_SANDBOX_ENV" | "DOCKER_SANDBOX_ENV";
+/** bake-runner 进程(`bake-runner/main.ts` `loadEnv`)读的名单型旋钮 —— 构建宿主守护进程没有主体 / 租户,没有姿态。 */
+export type RunnerEnvNameAllowlistKnob = "BAKE_ENV_ALLOW";
+export type EnvNameAllowlistKnob = ServerEnvNameAllowlistKnob | RunnerEnvNameAllowlistKnob;
 export type EnvNameAllowlistPosture = {
     readonly kind: "honored";
 } | {
     readonly kind: "ignored";
     readonly why: string;
 };
+/** 服务侧旋钮一行:拒句示例 + 多租户姿态。 */
+export interface ServerEnvNameAllowlistKnobRow {
+    readonly example: string;
+    readonly multiTenant: EnvNameAllowlistPosture;
+}
+/** runner 旋钮一行:只有拒句示例(没有姿态可言)。 */
+export interface RunnerEnvNameAllowlistKnobRow {
+    readonly example: string;
+}
 export type EnvNameAllowlistKnobTable = {
-    readonly [K in EnvNameAllowlistKnob]: {
-        readonly example: string;
-        readonly multiTenant: EnvNameAllowlistPosture;
-    };
+    readonly [K in EnvNameAllowlistKnob]: K extends ServerEnvNameAllowlistKnob ? ServerEnvNameAllowlistKnobRow : RunnerEnvNameAllowlistKnobRow;
 };
 export declare const ENV_NAME_ALLOWLIST_KNOBS: EnvNameAllowlistKnobTable;
+/** 名单型旋钮的全部名字(四只;表键派生)—— 两处用:解析器的「点名名单型旋钮 = 形错」、剥除的「名单原文按凭据类」臂。 */
+export declare const ENV_NAME_ALLOWLIST_KNOB_NAMES: ReadonlySet<string>;
 /**
  * 多租户姿态句 —— **由表派生**,不许在别处手写。形:`under REQUIRE_PRINCIPAL=true: <旋钮> is ignored; <旋钮> / <旋钮> are forwarded as configured`
  * (按 {@link POSTURE_PHRASE} 的 kind 序分组、组内按表序;空组不出现)。只有旋钮名与姿态,不带任何名单内容。

package/dist/env-name-allowlist-knobs.js

@@ -5,15 +5,20 @@ export const ENV_NAME_ALLOWLIST_KNOBS = {
     },
     E2B_SANDBOX_ENV: { example: "E2B_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
     DOCKER_SANDBOX_ENV: { example: "DOCKER_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
+    BAKE_ENV_ALLOW: { example: "BAKE_ENV_ALLOW=REGISTRY_PASSWORD,NPM_TOKEN" },
 };
+export const ENV_NAME_ALLOWLIST_KNOB_NAMES = new Set(Object.keys(ENV_NAME_ALLOWLIST_KNOBS));
 const POSTURE_PHRASE = {
     ignored: { one: "is ignored", many: "are ignored" },
     honored: { one: "is forwarded as configured", many: "are forwarded as configured" },
 };
 export function describeAllowlistPostures(table = ENV_NAME_ALLOWLIST_KNOBS) {
-    const knobs = Object.keys(table);
+    const postured = Object.keys(table).flatMap((k) => {
+        const row = table[k];
+        return "multiTenant" in row ? [{ knob: k, kind: row.multiTenant.kind }] : [];
+    });
     const groups = Object.keys(POSTURE_PHRASE).flatMap((kind) => {
-        const named = knobs.filter((k) => table[k].multiTenant.kind === kind);
+        const named = postured.filter((p) => p.kind === kind).map((p) => p.knob);
         if (named.length === 0)
             return [];
         const phrase = POSTURE_PHRASE[kind];

package/dist/fleet-client.d.ts

@@ -4,16 +4,28 @@
  *  - **可选分层(D3)**:仅当 center 已配置(sema-registry lane 的 baseUrl+token+worker)∧ `FLEET_ADVERTISE_ADDRESS`
  *    显式声明时才启动 —— 不配 center 的部署零行为变化。address 不自猜(k8s pod IP / docker alias / 127.0.0.1:port
  *    只有部署环境自己知道,故用显式 env)。
- *  - **announce=注册=心跳同形状幂等 upsert**:boot 后 POST 一次 + 每 heartbeatMs 续;`ready` 今 = `!draining`(实现只读
- *    `isDraining()`,announce 本身在 boot 之后才起;S-740 起与 /health 就绪同一只谓词 —— 车OC 6b 注释改真,实现归 S-740)。
- *  - **draining 翻转即刻再 announce**(第一时间自摘流,比任何观测都快);退出前 DELETE(显式注销,幂等)。
+ *  - **announce=注册=心跳同形状幂等 upsert**:boot 后(listen 之后)POST 一次 + 每 heartbeatMs 续。
+ *    `ready` / `draining` 两字段由**同一只**就绪谓词的同一次读铸(S-740:`http/readiness.ts` 的 `readinessOf`,
+ *    与 `/health.ready`、`GET /readyz`、计费提交门同源):`ready = verdict.ready`(= roster 已落 ∧ ¬draining),
+ *    `draining = reasons ∋ "draining"`。修前 `ready = !isDraining()`,不含 roster ⇒ roster 未落时心跳说「就绪」
+ *    而计费提交在 503。
+ *  - **`restart?`(S-741)**:在场 ⇔ 本副本必须重启才能应用配置 —— 取自 `/health.restart` **同一只**取值口(装配层接
+ *    `deployment.restartState`,config-center 的 `restartState()`),同一个对象,形 = settings-schema `RestartSignal`;
+ *    缺席即键缺席(中心按行整体替换,不合并 —— 一条不带它的心跳就是「不再需要」)。
+ *  - **`modelRefusals?`(S-768)**:在场 ⇔ 本副本对最近一次被判的中心候选目录有可报的拒(逐条名 → 码 / 模型面组拒码)—— 取自
+ *    `/health.modelRefusals` **同一只**取值口(装配层接 `deployment.modelRefusalsState`),同一个对象,形 = settings-schema
+ *    `ModelRefusalsSignal`;缺席即键缺席(同 `restart`)。
+ *  - **自报状态翻转即刻再 announce**(第一时间自摘流 / 自挂流 / 报重启 / 报拒因,比任何观测都快):draining 翻转由收尾链直调
+ *    `announceNow`;roster 落地、restart 信号与模型拒因变化由装配层把 config-center 的 `onSelfReportChange` 接到 `announceNow`
+ *    (两处 = 两类输入各自的唯一写者,触发都是 `announceNow`)。退出前 DELETE(显式注销,幂等)。
  *  - **usage 批报**:tracer 的 `brain.call` 已带 ALS principal —— FleetUsageAccumulator 按 principal×model
  *    累计,每窗口(默认 60s,半开 [windowStartMs, windowEndMs))POST /api/fleet/usage。幂等键
  *    (worker,instanceId,windowStartMs) 重发安全;**发送失败 → merge 回累计器**,并入下一窗(失败窗从未入账,
  *    向前合并不会双计 —— 只延迟,不丢量)。
  *  - 全部 fire-and-forget + swallow-guarded:fleet 面是运维旁路,绝不影响任务面;网络错误只 warn 一次/连败类。
  */
-import { UsageReport } from "@sema-agent/settings-schema/fleet";
+import { UsageReport, type ModelRefusalsSignal, type RestartSignal } from "@sema-agent/settings-schema/fleet";
+import type { ReadinessVerdict } from "./http/readiness.js";
 import { type CenterEndpoint } from "./config-center/center-request.js";
 /** Bound on distinct principal×model keys per window — a runaway/multi-tenant burst collapses into
  *  `__other__` instead of growing unbounded (same posture as budget.ts cardinalityGuard). */
@@ -65,8 +77,15 @@ export interface FleetClientOpts {
     /** Reachable base URL of THIS instance — the operator's explicit declaration (`FLEET_ADVERTISE_ADDRESS`). */
     advertiseAddress: string;
     version: string;
-    /** Live drain flag (drainState) — read at every announce. */
-    isDraining: () => boolean;
+    /** S-740:就绪判(装配层接 `readinessOf(deployment)` —— HTTP 面读的同一个 deps 组)。每条公告现读**一次**,
+     *  `ready` 与 `draining` 两字段都由这一次读铸(不会撕裂成 `ready:true` + `draining:true`)。 */
+    readiness: () => ReadinessVerdict;
+    /** S-741:restart 信号(装配层接 `/health` 同一只取值口 `deployment.restartState`)。每条公告现读一次;`undefined` ⇒ 公告不带
+     *  `restart` 键。必填:心跳面没有「不知道要不要重启」这一形。 */
+    restart: () => RestartSignal | undefined;
+    /** S-768:模型拒因信号(装配层接 `/health` 同一只取值口 `deployment.modelRefusalsState`)。每条公告现读一次;`undefined` ⇒ 公告不带
+     *  `modelRefusals` 键。必填:与 `restart` 同 —— 心跳面没有「不知道有没有拒」这一形(老引擎不发这个键,中心按 `version` 判「不可知」)。 */
+    modelRefusals: () => ModelRefusalsSignal | undefined;
     usage?: FleetUsageAccumulator;
     heartbeatMs?: number;
     usageWindowMs?: number;
@@ -78,7 +97,8 @@ export interface FleetClientOpts {
     fetchImpl?: typeof fetch;
 }
 export interface FleetClient {
-    /** Immediate out-of-cycle announce — call when `draining` flips (self-remove from routing FIRST). */
+    /** Immediate out-of-cycle announce — call when a self-reported input flips (draining: self-remove from routing FIRST;
+     *  roster landed: become routable without waiting a heartbeat; restart signal changed: S-741). */
     announceNow: () => Promise<void>;
     /** Stop timers + best-effort DELETE deregistration (bounded; never throws). */
     stop: () => Promise<void>;

package/dist/fleet-client.js

@@ -81,17 +81,24 @@ export function startFleetClient(opts) {
     const send = (route, method, json) => centerFetch(opts.center, { kind: route }, { method, json, timeoutMs: FLEET_CLIENT_FETCH_TIMEOUT_MS, fetchImpl: f });
     let stopped = false;
     let failStreak = 0;
-    const announceNow = async () => {
-        const body = {
-            instanceId: opts.instanceId,
-            worker: opts.center.worker,
-            address: opts.advertiseAddress,
-            version: opts.version,
-            ready: !opts.isDraining(),
-            draining: opts.isDraining(),
-            heartbeatMs,
-        };
+    const announceOnce = async () => {
+        if (stopped)
+            return;
         try {
+            const verdict = opts.readiness();
+            const restart = opts.restart();
+            const modelRefusals = opts.modelRefusals();
+            const body = {
+                instanceId: opts.instanceId,
+                worker: opts.center.worker,
+                address: opts.advertiseAddress,
+                version: opts.version,
+                ready: verdict.ready,
+                draining: !verdict.ready && verdict.reasons.includes("draining"),
+                heartbeatMs,
+                ...(restart !== undefined ? { restart } : {}),
+                ...(modelRefusals !== undefined ? { modelRefusals } : {}),
+            };
             const { res } = await send("fleet-instances", "POST", body);
             if (!res.ok)
                 throw new Error(`announce ${res.status}${await rejectionSnippet(res)}`);
@@ -105,6 +112,26 @@ export function startFleetClient(opts) {
                 opts.logger?.warn("fleet_announce_failed", { error: err instanceof Error ? err.message : String(err) });
         }
     };
+    let inFlight;
+    let again = false;
+    const announceNow = () => {
+        if (inFlight !== undefined) {
+            again = true;
+            return inFlight;
+        }
+        inFlight = (async () => {
+            try {
+                do {
+                    again = false;
+                    await announceOnce();
+                } while (again && !stopped);
+            }
+            finally {
+                inFlight = undefined;
+            }
+        })();
+        return inFlight;
+    };
     let windowStartMs = Date.now();
     const flushUsage = async () => {
         if (!opts.usage)
@@ -131,13 +158,17 @@ export function startFleetClient(opts) {
     hb.unref?.();
     const uw = opts.usage ? setInterval(() => void flushUsage(), usageWindowMs) : undefined;
     uw?.unref?.();
+    let stopping = false;
     const stop = async () => {
-        if (stopped)
+        if (stopping)
             return;
-        stopped = true;
+        stopping = true;
         clearInterval(hb);
         if (uw)
             clearInterval(uw);
+        while (inFlight !== undefined)
+            await inFlight;
+        stopped = true;
         await flushUsage();
         try {
             await send("fleet-instances", "DELETE", { instanceId: opts.instanceId, worker: opts.center.worker });

package/dist/fleet-lease.d.ts

@@ -116,7 +116,7 @@ export declare class FleetLeaseManager {
 /**
  * Env/config gate(与 startFleetClientFromEnv 同 D3 分层姿势,但 lease 不需要 FLEET_ADVERTISE_ADDRESS ——
  * 它是出站消费面,不是入站可达性声明):sema-registry lane 配齐(baseUrl + **声明了**凭证 + worker)即启;任一缺失 →
- * undefined,非 fleet 部署零行为变化。S-651:按**声明**装、不按内容装 —— `SEMA_REGISTRY_TOKEN_FILE` 在场而
+ * undefined,非 fleet 部署零行为变化。S-651:按**声明**装、不按内容装 —— `SEMA_REGISTRY_TOKEN_FILE`(`CENTER_CREDENTIAL_ENV.tokenFile`)在场而
  * 文件此刻不可读,管理器照样装上(每次协商取值,失败走响亮的鉴权失败臂;文件恢复即恢复)。
  */
 export declare function createFleetLeaseFromEnv(cfg: {

package/dist/host-lsp-manager.d.ts

@@ -9,7 +9,7 @@
  * `scrubServerSecrets` 的结果)。
  *
  * ## 规则(一句)
- * 语言服务器子进程的 env = {@link scrubServerSecrets}(process.env) ∪ 部署方点名放回的键(S-699,见下节;缺省空名单)——
+ * 语言服务器子进程的 env = `scrubServerSecrets`(process.env) ∪ 部署方点名放回的键(S-699,见下节;缺省空名单)——
  * 剥除与模型可驱动的 host shell(`inheritEnv:"scrub"`)
  * 和 project-memory 的 git 子进程**同一只函数**:目录 `type:"secret"` 键按名剥 ∘ core 形状规则按形剥。只交 core 的默认
  * 会漏掉形状规则认不出的本仓凭据键(今天是 `OTEL_EXPORTER_OTLP_HEADERS`),那正是 S-684 当初的病形。
@@ -23,8 +23,9 @@
  * ## 点名放行(S-699,`LSP_ENV_ALLOW`)
  * 剥除会连语言服务器自己的真实依赖一起剥掉(`.npmrc` 的 `${NPM_TOKEN}` 插值、rust-analyzer `cargo metadata` 私有 registry 的
  * `CARGO_REGISTRIES_<名>_TOKEN` —— 形状规则按名判,分不出「给语言服务器用的令牌」与「编排器的令牌」)。出路 = 部署方点名:
- * env = {@link scrubServerSecrets}(process.env) 之上把 `config.lspEnvAllow` 点到的键经 {@link allowlistedEnv}(与 host shell
- * `inheritEnv:[names]` 同一只谓词)从原 env 原样放回;没点到的照旧剥。名单由 `config.ts` 解析(形错拒启;
+ * env = `scrubServerSecrets`(process.env) 之上把 `config.lspEnvAllow` 点到的键经 `allowlistedEnv`(与 host shell
+ * `inheritEnv:[names]` 同一只谓词)从原 env 原样放回;没点到的照旧剥 —— 7.103.0 起这件组合只有一只:{@link hostSubprocessEnv}
+ * (`server-secret-env.ts`,bake-runner 的 `BAKE_ENV_ALLOW` 调同一只)。名单由 `config.ts` 解析(形错拒启;
  * `REQUIRE_PRINCIPAL=true` 下落空名单并 warn 一次),本函数只读 `config.lspEnvAllow`,不在这里再判一次姿态。
  * 放回的键不是剥除 ⇒ 不进 `secret_env_scrubbed` 的键表与计数;剥掉的键经既有现场 `server.lsp.spawn-env` 一行 warn
  * (带当前放行名单与出路句),这一行就是「剥了什么」的用户可见面 —— 语言服务器侧从不报。

package/dist/host-lsp-manager.js

@@ -1,11 +1,7 @@
 import { NodeLspManager } from "@sema-agent/core";
-import { recordSecretEnvScrub } from "./observability/secret-env-scrub.js";
-import { allowlistedEnv, scrubServerSecrets } from "./server-secret-env.js";
+import { hostSubprocessEnv } from "./server-secret-env.js";
 export function createHostLspManager(config, log) {
-    const scrubFindings = [];
-    const composed = { ...scrubServerSecrets(process.env, scrubFindings), ...allowlistedEnv(config.lspEnvAllow, process.env) };
-    const findings = scrubFindings.filter((f) => composed[f.key] === undefined);
-    recordSecretEnvScrub("server.lsp.spawn-env", findings, config.lspEnvAllow);
+    const composed = hostSubprocessEnv({ site: "server.lsp.spawn-env", allow: config.lspEnvAllow });
     const env = {};
     for (const [k, v] of Object.entries(composed))
         if (v !== undefined)

package/dist/http/approval-sweeps.js

@@ -6,6 +6,7 @@ import { APPROVAL_GATE_KINDS } from "../tool-approval.js";
 import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import { hasServiceAuth } from "./dispatch.js";
 import { gatedPrincipal } from "./principal-gate.js";
+import { readinessOf, billableRefusalOf } from "./readiness.js";
 export function createApprovalSweeps(ctx) {
     const { deps, resumeCheckpoint, mayDiscloseRowError } = ctx;
     const denySweepClockGuard = createWallClockJumpGuard({
@@ -71,26 +72,10 @@ export function createApprovalSweeps(ctx) {
         if (!hasServiceAuth(deps.config) && !deps.config.allowUnauthedWrites) {
             return { status: 503, body: { error: "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions", errorCode: "auth.service_token_required" } };
         }
-        if (deps.drainState?.draining) {
-            return {
-                status: 503,
-                body: {
-                    error: "draining",
-                    errorCode: "draining",
-                    message: "this instance is draining for shutdown/upgrade — retry against the replacement instance",
-                    ...(deps.drainState.reason ? { reason: deps.drainState.reason } : {}),
-                },
-            };
-        }
-        if (deps.modelReady && !deps.modelReady()) {
-            return {
-                status: 503,
-                body: {
-                    error: "model_roster_pending",
-                    errorCode: "state.model_roster_pending",
-                    message: "this worker has no model yet (waiting for the first effective-config pull to land the roster) — retry shortly",
-                },
-            };
+        const readiness = readinessOf(deps);
+        if (!readiness.ready) {
+            const refusal = billableRefusalOf(readiness, deps.drainState?.reason);
+            return { status: refusal.status, body: refusal.body };
         }
         if (deps.costQuota && req.httpReq) {
             const quotaPrincipal = gatedPrincipal(req.httpReq, deps.config);