@sema-agent/server 7.103.2 → 7.105.0

package/dist/config-types.d.ts

@@ -47,6 +47,13 @@ export declare const TASK_WRITE_FACE_ESCALATIONS: readonly ["allow", "refuse"];
 export type TaskWriteFaceEscalation = (typeof TASK_WRITE_FACE_ESCALATIONS)[number];
 export declare const RETENTION_MODES: readonly ["audit-only", "enforce"];
 export type RetentionMode = (typeof RETENTION_MODES)[number];
+/**
+ * S-841 —— `CONFIG_PROVIDER` 的词表闭集(**属主在此**:`loadConfig` 的唯一读点、config-center 工厂、执行车道合成步、
+ * 配置目录的 enum 行共读这一份)。缺席 / 空串 = 未表态(配了 `SEMA_REGISTRY_URL` ⇒ 中心,否则纯 env);两词之外 ⇒ 拒启。
+ * 修前是开放词:认不出的词被配置源判官当 `local`、被隐式 host 臂当「不是 local」,一个旋钮在一个进程里有两种读法。
+ */
+export declare const CONFIG_PROVIDER_WORDS: readonly ["local", "remote"];
+export type ConfigProviderWord = (typeof CONFIG_PROVIDER_WORDS)[number];
 /** [ref] §3/§4 —— sweep lane 的节律与灰度档(语义与三问见 {@link ServiceConfigFlat.retentionSweep})。 */
 export interface RetentionSweepConfig {
     /** `audit-only` = 照跑照判、只记 `audit_only` 行,**不调任何破坏性方法**;`enforce` = 真删。默认前者。 */
@@ -193,9 +200,17 @@ export declare function buildDefaultResilience(): ServiceConfigFlat["resilience"
  * {@link ServiceConfigFlat.memoryConsolidationDriver})。纯数据。
  */
 export interface MemoryConsolidationDriverConfig {
-    /** 阀门(env `MEMORY_CONSOLIDATION_DRIVER=on|off`,缺省 `off`)。`false` = 零装配零探针:
-     *  座不解析、引擎不构造、两个 admin 口整个不挂(404 族,**不是** 501)、能力位翻假。 */
-    enabled: boolean;
+    /**
+     * 阀门的**部署表态**(env `MEMORY_CONSOLIDATION_DRIVER=on|off`,原词)。**缺席 = 没表态,不是 off**。
+     *
+     * 🔴 S-824 / clay **[ref]**(取代 [ref] ① 的「出厂 off」实况):出厂缺省 = **开,但只在整理座不落主模型时生效**
+     * (`MODEL_CHEAP_ID` 在场,或目录给 consolidate / summarize / flash 档位绑了别的模型);否则不开并在起服时提示一行。
+     * 这件事要等**目录应用之后**、记忆引擎接线之后才判得出来,所以本字段只记表态,开不开由 boot 第 6 段的
+     * `resolveConsolidationValve`(`boot/memory-consolidation.ts`)一次判定 —— 那是阀门开关**唯一**的属主。
+     * 显式 `on` / `off` 恒赢;阀门关 = 零装配零探针:座不解析、引擎不构造、两个 admin 口整个不挂(404 族,
+     * **不是** 501)、能力位翻假。
+     */
+    valve?: "on" | "off";
     /**
      * 周期腿节律(秒;env `MEMORY_CONSOLIDATION_INTERVAL_SEC`,缺省 `0` = 不周期跑)。
      * 🔴 **本 build 里任何正值都拒启**:结构上没有周期腿(没有可用的真互斥基建 —— 全文与偏离登记见
@@ -225,7 +240,8 @@ export interface MemoryConsolidationDriverConfig {
      *  · `true`(`=on`)= 武装。**武装是一条出口决定,不是性能旋钮**:每个建议任务之后会有一次整库整理跑,
      *    记忆内容自动外流到配置的整理模型 —— 设它之前请读 `boot/memory-consolidation.ts` 的 EGRESS 段。
      *
-     * ⚠️ **前置 = `MEMORY_CONSOLIDATION_DRIVER=on`**(且记忆引擎接了线)。阀门开着 ⇒ 引擎那半场的整理两席
+     * ⚠️ **前置 = 整理阀门开着**(`MEMORY_CONSOLIDATION_DRIVER=on`,或未设而 [ref] 出厂缺省派生成开 —— 见 {@link valve};
+     * 且记忆引擎接了线)。阀门开着 ⇒ 引擎那半场的整理两席
      * (`RunnerDeps.memoryConsolidation` + `memoryConsolidationDriver`)由**同一只已解析座**接上
      * (S-399,`boot/runner-deps.ts` 的 `ctx.consolidationSeat` 那一段)⇒ 本旋钮真的生效;阀门关着 ⇒ 两席
      * 一个键都不写,而 core 对「武装但没接整理席」的处置是**每一次 prepare 都抛** `config.auto_consolidation`
@@ -761,12 +777,12 @@ export interface ServiceConfigFlat {
     /**
      * [ref](core 5.58 [ref] 片②)—— 记忆 **consolidation driver 阀门**的三根旋钮。
      * **恒在场**(不是可选块,与 {@link retentionSweep} 同姿态):三根都有文档化的缺省,而缺省本身
-     * 是一条要能被读出来的姿态 —— `{enabled:false, intervalSec:0, scopes:[]}` = 「阀门关着」。
+     * 是一条要能被读出来的姿态 —— `{intervalSec:0, scopes:[]}`(`valve` 键缺席)= 「阀门没表态,出厂缺省在 boot 期派生」。
      *
      * 三问(设计稿 §消长账):谁需要 = 记忆库只涨不折的 TOB 部署(检索质量随库龄衰减);谁被伤 =
      * 误开 + 错 role 的部署(一轮 consolidation 读全库 ~1e5 prompt tokens,静默升级到最贵 default
-     * 就是把一次维护跑成一笔意外账单);补偿 = 阀门默认关 + 座解析失败拒启 + D3 投影把每轮花了什么
-     * 摆出来 + v1 只有**手动**阀门(不信任周期腿之前可人工控节奏)。
+     * 就是把一次维护跑成一笔意外账单);补偿 = 出厂缺省只在整理座**不落主模型**时开([ref];落主模型 ⇒ 不开 +
+     * 起服提示)+ 座解析失败拒启 + D3 投影把每轮花了什么摆出来 + v1 只有**手动**阀门(不信任周期腿之前可人工控节奏)。
      *
      * 语义与解析见 {@link MemoryConsolidationDriverConfig} 与 config.ts 的 `parseMemoryDomain`。
      */
@@ -1051,11 +1067,12 @@ export interface ServiceConfigFlat {
     fileHistory?: {
         retention?: FileHistoryRetentionPolicy;
     };
-    /** S-589:文件历史**捕获**总开关(`FILE_HISTORY_CAPTURE`,布尔词表,缺省 true,未知词拒启)。三条车道
-     *  (local / mysql / pg)同一语义:`false` ⇒ 装配点不把历史店交给 core(`RunnerDeps.fileHistoryStore` 缺席 ⇒
-     *  首次触碰捕获结构上不发生),同时没有 rewind / restore / `rewindFilesTo` / 2c session-sync(那几位能力位与
-     *  能力词 `fileHistoryCapture:"off"` 同源翻关)。**只管写入,不管擦除**:已捕获的历史照旧随会话删除 / 留存
-     *  规则清理,翻旋钮本身不做批量删除。判定的唯一属主是 `file-history-capture.ts` 的 `assembleFileHistory`。
+    /** S-589 / S-724:文件历史**捕获**总开关(`FILE_HISTORY_CAPTURE`,布尔词表,缺省 true,未知词拒启)。三条车道
+     *  (local / mysql / pg)同一语义:`false` ⇒ 装配点照接历史店,但给 core 的部署捕获位 `RunnerDeps.fileHistoryCapture: "off"`
+     *  (首次触碰备份 / 回合边界 / fork 携带结构上不发生;能力词 `fileHistoryCapture:"off"` 同一只判定派生)。**只关捕获**:
+     *  已存历史照常服务 restore / rewind / 2c session-sync(S-589 时旋钮关 = 摘店,连已存历史也读不了;S-724 改落 core 的捕获位)。
+     *  **不管擦除**:已捕获的历史照旧随会话删除 / 留存规则清理,翻旋钮本身不做批量删除。没有店的部署形不下发捕获位
+     *  (core 对「off 但没店」拒 prepare,而没店本来就不捕获)。判定的唯一属主是 `file-history-capture.ts`。
      *  刻意**不**并进上面的 `fileHistory` 键:那一格是 core 店构造选项的同域键形,原样透传给 core。 */
     fileHistoryCapture: boolean;
     /** plugins 域 clone host 白名单(`PLUGINS_ALLOW_HOSTS`,缺省 github.com;契约 [ref]① 双保险面,
@@ -1526,8 +1543,11 @@ export interface ServiceConfigFlat {
     selectEnvironmentTool: boolean;
     /** RFC A1: inject structured sandbox envFacts into the task (`TaskSpec.envFacts` — core 1.240.0 whitelist
      *  field; rendered as the `# Environment` block, sanitized+bounded core-side). Default ON —
-     *  facts only ride when the deployment actually knows them (image binding/pkgSource/egress), absent = block
-     *  unchanged. `SANDBOX_ENV_FACTS=false` opts out. */
+     *  facts only ride when the deployment actually knows them (image binding/pkgSource/egress/resume facts), absent =
+     *  block unchanged. `SANDBOX_ENV_FACTS=false` opts out of the SANDBOX facts only.
+     *  🔴 S-842:the session scratchpad declaration (`envFacts.scratchpadDir`) is NOT under this knob — it is the write
+     *  surface's declaration (core opens the root-fence hole for it and teaches it by the same verdict), not a display
+     *  fact; gating it would close the scratchpad together with the display. */
     envFactsEnabled: boolean;
     /** ③ sensitive-path write DENY set (core 1.295 `createSensitivePathPolicy`). The PATTERN SET is core's call
      *  (RECOMMENDED_SENSITIVE_PATTERNS — .env/.ssh/keys/.git hooks+config/cloud creds/histories, rationale
@@ -2054,8 +2074,9 @@ export interface ServiceConfigFlat {
     centerCredentialRenewLeadMs: number;
     /** Dual-mode config SOURCE (DUAL-MODE-DESIGN §4): "remote" (sema-registry HTTP) | "local" (.env + config.d
      *  via @sema-agent/settings-schema FileConfigStore) | unset → remote if SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL now boot-rejects, no dual-read) is set, else pure-env.
-     *  Env: CONFIG_PROVIDER. The same resolver/EffectiveConfig either way (can't drift). */
-    configProvider?: string;
+     *  Env: CONFIG_PROVIDER —— S-841 起闭集 {@link CONFIG_PROVIDER_WORDS}(认不出的词拒启;空串 = 未设)。
+     *  The same resolver/EffectiveConfig either way (can't drift). */
+    configProvider?: ConfigProviderWord;
     /** Root dir holding `config.d/<domain>.json` for the local config source. Env: CONFIG_LOCAL_DIR. */
     configLocalDir?: string;
 }

package/dist/config-types.js

@@ -1,6 +1,7 @@
 import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
 export const TASK_WRITE_FACE_ESCALATIONS = ["allow", "refuse"];
 export const RETENTION_MODES = ["audit-only", "enforce"];
+export const CONFIG_PROVIDER_WORDS = ["local", "remote"];
 export const MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC = 300;
 export const MAX_TIMER_DELAY_MS = 2_147_483_647;
 export const AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS = { minMs: 1_000, maxMs: MAX_TIMER_DELAY_MS };

package/dist/config.d.ts

@@ -75,8 +75,9 @@ export declare function parseNumOrFailNonNegative(name: string, raw: string | un
  * 采用值也被报成夹取、而钥集条目**被丢弃**(没有任何采用值、也不该印 raw)却被报成「坏值回默认」。
  * 告警规则是按事件名分流的,报错的种类就是报错的事实本身;可选字段的在场性是实现细节,不该被当契约用。
  *
- * `invalid-default` 是**缺省种类**(不写 `kind` 即是它)—— 历史形 `{env,raw}` 的三个存量生产者
- * (`optFinitePositiveEnv` / `boolEnv` / `boolEnvWithLegacyNegated`)因此逐字不动,它们的断言也不破。
+ * `invalid-default` 是**缺省种类**(不写 `kind` 即是它)—— 历史形 `{env,raw}` 的存量生产者(`optFinitePositiveEnv`)
+ * 因此逐字不动,它的断言也不破。(布尔族 `boolEnv` 自 [ref]-rc2 起未知词在 `parseBoolWord` 里拒启,不再往这里 push;
+ * S-588 起旧负名走墓碑表 —— 两者都不是本种类的生产者。)
  */
 type ConfigWarningKind = "invalid-default" | "clamped" | "empty-preserved" | "entry-rejected" | "set-rejected" | "ineffective";
 interface ConfigWarning {
@@ -90,10 +91,23 @@ interface ConfigWarning {
     detail?: string;
 }
 export declare function drainConfigWarnings(): ConfigWarning[];
-export declare function drainConfigNotices(): Array<{
+/** Boot NOTICES ([ref]④): non-error decisions loadConfig makes that the operator should see once (e.g. the
+ *  MODEL_PROVIDER inference below). Same pre-logger collection pattern as CONFIG_WARNINGS, but each entry
+ *  carries its own event name + fields (the warnings drain has one fixed "invalid, using default" message
+ *  which would misdescribe an inference). main.ts drains + logs right after createLogger.
+ *
+ *  S-176 —— 每条带一个**级别**(闭集两词,排空处穷举 switch)。此前这一格固定按 warn 排空,于是「每次 boot 都成立的
+ *  常态事实」(posture 派生的档位)在这里没有位置:进 warn 会让一台一个字节都没配错的单机每次启动报警,另开一个
+ *  收集器又是第五条日志族。级别写在**铸点**(不是按事件名在排空处猜):
+ *   · `warn` —— 运维要看一眼的决定(推断出的 provider、被丢掉的缺省行、no-op 旋钮……):既有的每一条;
+ *   · `info` —— 常态事实,每次这样配就每次成立,不是异常(与执行车道落点那一行同级)。 */
+type ConfigNoticeLevel = "warn" | "info";
+export interface ConfigNotice {
+    level: ConfigNoticeLevel;
     event: string;
     fields: Record<string, string>;
-}>;
+}
+export declare function drainConfigNotices(): ConfigNotice[];
 /** F10 (codex audit): drain + log BOTH pre-logger diagnostic collectors (S20 soft-knob warnings + [ref]④ boot
  *  notices) in one place. EVERY entrypoint that calls loadConfig() then builds a logger must call this right
  *  after (main.ts, run-local.ts) — a new entry that forgets it would silently drop operator-facing diagnostics
@@ -169,10 +183,10 @@ export declare function buildUnpricedCeilingNotice(models: Record<string, Model>
  *  stated, so it was re-invented per line and the suffix stopped predicting anything.
  *
  *  Semantics are the two dialects' semantics VERBATIM — an opt-in knob is `boolEnv(x, false)`, an opt-out knob is
- *  `boolEnv(x, true)` — so this migration is value-preserving on every input. The one addition: a value that is
- *  neither literal (`1`, `yes`, `TRUE`) still lands on the knob's default (as before) but now raises a config
- *  warning instead of being swallowed, which is the whole failure mode operators kept hitting (`LSP_ENABLED=1`
- *  reads as "on" to a human and as "off" to `=== "true"`).
+ *  `boolEnv(x, true)` — for the two literals and for unset. Anything else goes through `parseBoolWord` ([ref]-rc2,
+ *  [ref]): `1`/`0`/`yes`/`no`/`on`/`off` in any case are read as the operator meant them (`LSP_ENABLED=1` reads as
+ *  "on" to a human, and now to the parser too), and an unknown word REFUSES TO BOOT — it no longer lands on the
+ *  default with a warning (that was this helper's first form, retired with [ref]-rc2; S-588 corrected this note).
  *
  *  Note the deliberate non-migrations: the posture family (`postureOn`) keeps its tri-state — its unset case is
  *  neither `true` nor `false` but "single-user ∧ infra-ready" — and the sentinel-valued knobs (`MEMORY_ENGINE`,
@@ -183,7 +197,7 @@ export declare function buildUnpricedCeilingNotice(models: Record<string, Model>
  *  用",而实际设了就拒启——诊断面撒的谎比没有诊断更贵(它会让人先去试那个必然拒启的开关)。 */
 type ConfigKnobSource = "env" | "posture" | "default";
 export interface ConfigKnobRecord {
-    /** The env name. 3.0.0 起只有这一个名字 —— 负名别名已是墓碑(见 `boolEnvWithLegacyNegated`)。 */
+    /** The env name. 3.0.0 起只有这一个名字 —— 负名别名已是墓碑(`RETIRED_ENVS` 的 replaced 行,S-588 起在场即拒)。 */
     name: string;
     /** `opt-in` = default OFF, `opt-out` = default ON, `posture` = default derived from REQUIRE_PRINCIPAL ∧ infra. */
     polarity: "opt-in" | "opt-out" | "posture";
@@ -192,28 +206,12 @@ export interface ConfigKnobRecord {
 }
 /** The registered boolean knobs, sorted by name — the data behind `logConfigDiagnostics`'s polarity table. */
 export declare function configKnobTable(): ConfigKnobRecord[];
-/** [ref] N8 (D-family) + server 3.0.0 墓碑 —— a knob whose CANONICAL name is positive (`X_ENABLED`,
- *  default ON) and whose retired negative name (`X_DISABLED`) is now a **fail-loud tombstone**.
- *
- *  Why the flip at all: `X_DISABLED !== "true"` is a double negative at the read site, so the four knobs that
- *  used it (`PROJECT_MEMORY`, `CONFIG_LKG`, `HOST_BG`, `HOST_EXEC_SPOOL`) could not be read for their default
- *  without inverting twice in your head, and `projectMemoryDisabled` was the ONE negative boolean on a
- *  `ServiceConfig` that otherwise carries 16 positive `*Enabled`/`*Allowed` fields.
- *
- *  🔴 3.0.0([ref],clay 令「不做兼容」):旧名不再有兼容窗——**设了就拒启**。这个函数保留 legacy 形参
- *  不是为了继续读它,而正是为了**认出它在场并拒绝启动**(把墓碑放在唯一知道这对名字关系的地方)。
- *
- *  Resolution order:
- *   1. `X_ENABLED` set to a literal ⇒ that.
- *   2. `X_ENABLED` set to a non-literal ⇒ default + warning (the tombstone is NOT consulted — a typo in the
- *      new name must not turn into a boot refusal about an env the operator never set).
- *   3. `X_ENABLED` unset ∧ `X_DISABLED` set(**任何值**,含 `"false"`)⇒ throw,文案指路新名。选拒启不选
- *      静默忽略:静默会让升级部署的旧开关名义在、实际归默认——比拒启危险,且下游冒烟测试测不出来。
- *   4. neither ⇒ default. */
-export declare function boolEnvWithLegacyNegated(name: string, legacyNegatedName: string, def: boolean): boolean;
-/** LKG (last-known-good) persistence of the remote effective-config fetch. Read LAZILY at both main.ts sites
+/** [ref] B4 ②:D 族四枚(`PROJECT_MEMORY` / `CONFIG_LKG` / `HOST_BG` / `HOST_EXEC_SPOOL`)的正名 —— 缺省开,读点只读正名。
+ *  3.0.0 之前它们叫 `X_DISABLED`(读点上的双重否定);那四个旧负名是墓碑,在 `RETIRED_ENVS` 里(S-588 起在场即拒启,不论正名在不在)。
+ *
+ *  LKG (last-known-good) persistence of the remote effective-config fetch. Read LAZILY at both main.ts sites
  *  rather than lifted onto `ServiceConfig`, so this stays a pure env knob; `loadConfig` pre-registers it (below)
- *  so its polarity row and any deprecation notice appear at boot with everything else. */
+ *  so its polarity row appears at boot with everything else. */
 export declare const configLkgEnabled: () => boolean;
 /** The `host` exec lane's background-shell capability kill switch (read per capability probe in remote-env-host.ts). */
 export declare const hostBackgroundShellEnabled: () => boolean;

package/dist/config.js

@@ -10,10 +10,10 @@ import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { isV2ScopeKey, memoryReplicationCoverage } from "./memory-scope.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
-import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS } from "./config-types.js";
+import { CONFIG_PROVIDER_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS } from "./config-types.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
-import { readFaceForPosture } from "./read-face-posture.js";
+import { buildReadFacePostureNotice, readFaceForPosture } from "./read-face-posture.js";
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
@@ -130,6 +130,10 @@ const RETIRED_ENVS = [
             "widened retry; 0 = no engine clock on that segment and the transport's header / body clocks off too — the TCP + TLS connect " +
             "keeps the transport's own clock)",
     ],
+    ["PROJECT_MEMORY_DISABLED", "PROJECT_MEMORY_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: PROJECT_MEMORY_DISABLED=true is PROJECT_MEMORY_ENABLED=false (the positive name defaults on)"],
+    ["CONFIG_LKG_DISABLED", "CONFIG_LKG_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: CONFIG_LKG_DISABLED=true is CONFIG_LKG_ENABLED=false (the positive name defaults on)"],
+    ["HOST_BG_DISABLED", "HOST_BG_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: HOST_BG_DISABLED=true is HOST_BG_ENABLED=false (the positive name defaults on)"],
+    ["HOST_EXEC_SPOOL_DISABLED", "HOST_EXEC_SPOOL_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: HOST_EXEC_SPOOL_DISABLED=true is HOST_EXEC_SPOOL_ENABLED=false (the positive name defaults on)"],
 ];
 const RETIRED_ENV_SENTENCE = {
     renamed: (hits) => `${hits.map(([old, to]) => `${old} → use ${to}`).join("; ")} — rename the env key(s); the value semantics are unchanged`,
@@ -147,7 +151,7 @@ function rejectRetiredEnvs() {
     if (hit.length === 0)
         return;
     const parts = Object.keys(RETIRED_ENV_SENTENCE).flatMap((kind) => retiredEnvSentence(kind, hit));
-    throw new Error(`retired env name(s) set [${RETIRED_ENV_REFUSAL_CODE}] ([2354] 兼容面全清,5.0.0 起拒启): ${parts.join(" | ")}.`);
+    throw new Error(`retired env name(s) set [${RETIRED_ENV_REFUSAL_CODE}] — refused while present, whether or not the replacement is also set: ${parts.join(" | ")}.`);
 }
 export function numEnv(name, fallback) {
     return parseNumOrFail(name, env(name, fallback));
@@ -201,13 +205,24 @@ export function drainConfigNotices() {
     return CONFIG_NOTICES.splice(0, CONFIG_NOTICES.length);
 }
 let EXEC_LANE_NOTICE;
-function buildExecLaneNotice(remoteExec) {
+function buildExecLaneNotice(remoteExec, configProvider) {
     const explicit = process.env.REMOTE_EXEC !== undefined && process.env.REMOTE_EXEC !== "";
     return {
         lane: executionLaneOf(remoteExec?.provider),
-        source: explicit ? "explicit-env" : process.env.CONFIG_PROVIDER === "local" ? "default-local-provider" : "default-unset",
+        source: explicit ? "explicit-env" : configProvider === "local" ? "default-local-provider" : "default-unset",
     };
 }
+function parseConfigProvider() {
+    const raw = process.env.CONFIG_PROVIDER;
+    if (raw === undefined || raw === "")
+        return undefined;
+    const word = CONFIG_PROVIDER_WORDS.find((w) => w === raw);
+    if (word === undefined) {
+        throw new Error(`env CONFIG_PROVIDER="${raw.slice(0, 120)}" must be one of: ${CONFIG_PROVIDER_WORDS.join(", ")} — or leave it unset (then SEMA_REGISTRY_URL, if set, selects the center as the config source; otherwise this worker is env-only). ` +
+            `The word is matched exactly (no trimming, no case folding). Refusing to boot rather than guessing: the config source, the execution-lane default and the local config root all key on this one word.`);
+    }
+    return word;
+}
 export function logConfigDiagnostics(logger) {
     for (const w of drainConfigWarnings()) {
         const kind = w.kind ?? "invalid-default";
@@ -236,8 +251,20 @@ export function logConfigDiagnostics(logger) {
             }
         }
     }
-    for (const n of drainConfigNotices())
-        logger.warn(n.event, n.fields);
+    for (const n of drainConfigNotices()) {
+        switch (n.level) {
+            case "warn":
+                logger.warn(n.event, n.fields);
+                break;
+            case "info":
+                logger.info?.(n.event, n.fields);
+                break;
+            default: {
+                const unreachable = n.level;
+                throw new Error(`unhandled config notice level: ${String(unreachable)}`);
+            }
+        }
+    }
     const laneNotice = EXEC_LANE_NOTICE;
     EXEC_LANE_NOTICE = undefined;
     if (laneNotice && logger.info)
@@ -433,30 +460,9 @@ function boolEnv(name, def) {
     registerKnob({ name, polarity: def ? "opt-out" : "opt-in", value, source });
     return value;
 }
-export function boolEnvWithLegacyNegated(name, legacyNegatedName, def) {
-    const raw = process.env[name];
-    const legacy = process.env[legacyNegatedName];
-    let value;
-    let source;
-    const parsedCanonical = parseBoolWord(name, raw);
-    if (parsedCanonical !== undefined) {
-        value = parsedCanonical;
-        source = "env";
-    }
-    else if (legacy !== undefined && legacy !== "") {
-        throw new Error(`${legacyNegatedName} was removed in server 3.0.0 — set ${name}=${legacy !== "true"} instead ` +
-            `(positive-name knob, default ${def ? "on" : "off"}; migration table in USAGE.md)`);
-    }
-    else {
-        value = def;
-        source = "default";
-    }
-    registerKnob({ name, polarity: def ? "opt-out" : "opt-in", value, source });
-    return value;
-}
-export const configLkgEnabled = () => boolEnvWithLegacyNegated("CONFIG_LKG_ENABLED", "CONFIG_LKG_DISABLED", true);
-export const hostBackgroundShellEnabled = () => boolEnvWithLegacyNegated("HOST_BG_ENABLED", "HOST_BG_DISABLED", true);
-export const hostExecSpoolEnabled = () => boolEnvWithLegacyNegated("HOST_EXEC_SPOOL_ENABLED", "HOST_EXEC_SPOOL_DISABLED", true);
+export const configLkgEnabled = () => boolEnv("CONFIG_LKG_ENABLED", true);
+export const hostBackgroundShellEnabled = () => boolEnv("HOST_BG_ENABLED", true);
+export const hostExecSpoolEnabled = () => boolEnv("HOST_EXEC_SPOOL_ENABLED", true);
 export const REQUIRED_ENVS_BY_LANE = {
     e2b: ["E2B_API_KEY"],
     k8s: ["K8S_SANDBOX_IMAGE"],
@@ -537,6 +543,7 @@ export function parseEnvNameAllowlist(knob, singleUserTurnkey) {
                 return [];
             case "honored":
                 CONFIG_NOTICES.push({
+                    level: "warn",
                     event: "config_env_forwarded_multi_tenant",
                     fields: {
                         env: knob,
@@ -640,6 +647,7 @@ function parseWriteProtectedTableEnv(extraRaw, replaceRaw) {
     const dropped = posture.droppedDefaultRows ?? [];
     CONFIG_NOTICES.push(posture.source === "off"
         ? {
+            level: "warn",
             event: "write_protection_table_disabled",
             fields: {
                 env: "WRITE_PROTECTED_TABLE_REPLACE",
@@ -650,6 +658,7 @@ function parseWriteProtectedTableEnv(extraRaw, replaceRaw) {
             },
         }
         : {
+            level: "warn",
             event: "write_protection_table_replaced",
             fields: {
                 env: "WRITE_PROTECTED_TABLE_REPLACE",
@@ -801,6 +810,7 @@ function noticeAutoCompactAboveWindow(slot, envName, m) {
     if (act === undefined || window <= 0 || act <= window)
         return;
     CONFIG_NOTICES.push({
+        level: "warn",
         event: "auto_compact_tokens_above_context_window",
         fields: {
             slot,
@@ -822,6 +832,7 @@ function parseStoreDomain(ctx) {
     const dbBackend = enumEnv("DB_BACKEND", bareBoot ? (multiTenantBareBoot ? "memory" : "local") : "mysql", ["mysql", "pg", "local", "memory"]);
     if (multiTenantBareBoot) {
         CONFIG_NOTICES.push({
+            level: "warn",
             event: "db_backend_default_memory_multi_tenant",
             fields: {
                 note: "REQUIRE_PRINCIPAL=true with no DB_BACKEND — the single-user default (local file store) is incompatible with multi-tenant (no tenant isolation in the file owner map), so this deployment runs IN-MEMORY (runs/sessions lost on restart, durable runs 501). Configure DB_BACKEND=mysql|pg for a durable multi-tenant deployment.",
@@ -928,6 +939,7 @@ function parseModelDomain() {
             return explicitProvider;
         if (inferredAnthropicBaseUrl && inferredAnthropicCred) {
             CONFIG_NOTICES.push({
+                level: "warn",
                 event: "model_provider_inferred",
                 fields: {
                     provider: "anthropic",
@@ -973,11 +985,28 @@ function parseModelDomain() {
     const cheapId = process.env.MODEL_CHEAP_ID;
     if (cheapId && modelId === "") {
         CONFIG_NOTICES.push({
+            level: "warn",
             event: "model_cheap_slot_without_main",
             fields: { hint: "MODEL_CHEAP_ID is set but MODEL_ID is not — the env cheap slot derives from the env main model, so it is not minted; the catalog (config.d/models.json or the config center) serves the roles. Set MODEL_ID to use the env slots, or unset MODEL_CHEAP_ID to silence this line." },
         });
     }
-    const cheapModel = cheapId && modelId !== ""
+    const cheapIsMain = cheapId !== undefined && cheapId !== "" && modelId !== "" && cheapId === modelId;
+    if (cheapIsMain) {
+        CONFIG_NOTICES.push({
+            level: "warn",
+            event: "config_env_entry_cheap_same_as_main",
+            fields: {
+                env: "MODEL_CHEAP_ID",
+                model: modelId,
+                hint: `MODEL_CHEAP_ID names the same model as MODEL_ID ("${modelId}") — the env cheap slot is the main gateway under a different id, ` +
+                    `so the same id IS the main model: no cheap slot is minted and subagent / summarize stay on the main model (roles -> default); ` +
+                    `any other MODEL_CHEAP_* key set here describes that slot and is not applied. Set MODEL_CHEAP_ID to a different (cheaper) model ` +
+                    `id to run those roles cheap, or declare two differently-named entries in config.d/models.json to give one upstream id a second ` +
+                    `shape (price / reasoning / window); unset MODEL_CHEAP_ID to silence this line.`,
+            },
+        });
+    }
+    const cheapModel = cheapId && modelId !== "" && !cheapIsMain
         ? {
             ...model,
             id: cheapId,
@@ -998,6 +1027,7 @@ function parseModelDomain() {
     const mainAct = optFinitePositiveEnv("MODEL_AUTO_COMPACT_TOKENS");
     if (applyAutoCompactWindow(model, mainAct) === "removed-1m" && modelId !== "") {
         CONFIG_NOTICES.push({
+            level: "warn",
             event: "auto_compact_window_not_derived_1m",
             fields: {
                 slot: "main",
@@ -1013,6 +1043,7 @@ function parseModelDomain() {
         if (applyAutoCompactWindow(cheapModel, cheapAct) === "removed-1m") {
             const inherited = process.env.MODEL_CHEAP_CONTEXT_WINDOW === undefined || process.env.MODEL_CHEAP_CONTEXT_WINDOW === "";
             CONFIG_NOTICES.push({
+                level: "warn",
                 event: "auto_compact_window_not_derived_1m",
                 fields: {
                     slot: "cheap",
@@ -1029,6 +1060,7 @@ function parseModelDomain() {
     const gatewayApiKey = process.env.MODEL_API_KEY;
     if (gatewayBaseUrl === undefined && gatewayApiKey !== undefined && gatewayApiKey !== "") {
         CONFIG_NOTICES.push({
+            level: "warn",
             event: "model_gateway_key_unpaired",
             fields: {
                 hint: "MODEL_API_KEY is set but MODEL_GATEWAY_BASEURL is not — MODEL_API_KEY is the gateway's credential and pairs only with the gateway's own root, so with no gateway it is NOT loaded and is sent to no route (a model with its own baseUrl authenticates with its own per-model key). Set MODEL_GATEWAY_BASEURL to use it, or unset MODEL_API_KEY to silence this line.",
@@ -1308,6 +1340,7 @@ function parseApprovalDomain(ctx) {
             if (trimmed === "" || trimmed === "off") {
                 if (trimmed === "off") {
                     CONFIG_NOTICES.push({
+                        level: "warn",
                         event: "manual_mode_shell_gate_off_is_noop",
                         fields: {
                             env: "MANUAL_MODE_SHELL_GATE",
@@ -1526,7 +1559,7 @@ function parseMemoryConsolidationDriver() {
             `who believes the valve is armed gets a 404 rather than a diagnosis). This knob is new in server 7.46 and has no legacy ` +
             `spellings to preserve, unlike MEMORY_ENGINE's two-family word table.`);
     }
-    const enabled = word === "on";
+    const valve = word === "on" || word === "off" ? word : undefined;
     const autoWord = requireNonBlank("MEMORY_AUTO_CONSOLIDATION", process.env.MEMORY_AUTO_CONSOLIDATION);
     if (autoWord !== undefined && autoWord !== "on" && autoWord !== "off") {
         throw new Error(`MEMORY_AUTO_CONSOLIDATION must be exactly "on" or "off", got ${JSON.stringify(autoWord)} — this knob decides whether memory content ` +
@@ -1558,12 +1591,12 @@ function parseMemoryConsolidationDriver() {
     }
     const scopesRaw = requireNonBlank("MEMORY_CONSOLIDATION_SCOPES", process.env.MEMORY_CONSOLIDATION_SCOPES);
     const scopes = scopesRaw !== undefined ? csv("MEMORY_CONSOLIDATION_SCOPES") : [];
-    if (!enabled && (intervalSec > 0 || scopes.length > 0)) {
-        throw new Error(`MEMORY_CONSOLIDATION_INTERVAL_SEC / MEMORY_CONSOLIDATION_SCOPES are configured but MEMORY_CONSOLIDATION_DRIVER is not "on" — ` +
-            `the consolidation valve is OFF, so neither knob reaches anything (the two admin endpoints are not even mounted). ` +
-            `Set MEMORY_CONSOLIDATION_DRIVER=on, or unset the other two.`);
-    }
-    return { enabled, intervalSec, scopes, ...(autoRunOnRecommendation !== undefined ? { autoRunOnRecommendation } : {}) };
+    return {
+        ...(valve !== undefined ? { valve } : {}),
+        intervalSec,
+        scopes,
+        ...(autoRunOnRecommendation !== undefined ? { autoRunOnRecommendation } : {}),
+    };
 }
 function parseMemoryDomain(ctx) {
     const { requirePrincipal } = ctx;
@@ -1605,6 +1638,7 @@ function parseMemoryDomain(ctx) {
     const replication = memoryReplicationCoverage(memorySync !== undefined ? { memorySync } : {});
     if (replication.kind === "scopes" && memoryEngineEnabled && !requirePrincipal && memoryScope !== undefined) {
         CONFIG_NOTICES.push({
+            level: "warn",
             event: "memory_project_scope_yields_to_sync",
             fields: {
                 replicatedScopes: replication.scopes.join(","),
@@ -1615,7 +1649,7 @@ function parseMemoryDomain(ctx) {
             },
         });
     }
-    const projectMemoryEnabled = boolEnvWithLegacyNegated("PROJECT_MEMORY_ENABLED", "PROJECT_MEMORY_DISABLED", true);
+    const projectMemoryEnabled = boolEnv("PROJECT_MEMORY_ENABLED", true);
     const memoryOrgAdmissionMode = enumEnv("MEMORY_ORG_ADMISSION_MODE", "enforce", ["audit", "enforce"]);
     const memoryOrgDirectoryJson = process.env.MEMORY_ORG_DIRECTORY_JSON || undefined;
     const memoryOrgGrantTtlMs = numEnvBounded("MEMORY_ORG_GRANT_TTL_MS", "60000", 1000, 3_600_000);
@@ -1787,11 +1821,15 @@ function parseOrchestrationDomain(ctx) {
             }
         }
     }
+    const readFaceFacts = process.env.READ_FACE !== undefined
+        ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]), readFaceSource: "env" }
+        : readFaceForPosture(singleUserTurnkey);
+    const readFaceNotice = buildReadFacePostureNotice(readFaceFacts);
+    if (readFaceNotice !== undefined)
+        CONFIG_NOTICES.push({ level: "info", ...readFaceNotice });
     return {
         requireExecutionLane: boolEnv("REQUIRE_EXECUTION_LANE", false),
-        ...(process.env.READ_FACE !== undefined
-            ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]), readFaceSource: "env" }
-            : readFaceForPosture(singleUserTurnkey)),
+        ...readFaceFacts,
         ...optionalEnumKey("taskWriteFaceEscalation", "TASK_WRITE_FACE_ESCALATION", process.env.TASK_WRITE_FACE_ESCALATION, TASK_WRITE_FACE_ESCALATIONS),
         ...(process.env.READ_DENY_PATTERNS !== undefined ? { readDenyPatterns: parseReadDenyPatternsEnv(process.env.READ_DENY_PATTERNS) } : {}),
         ...(() => {
@@ -1910,7 +1948,7 @@ function parseOrchestrationDomain(ctx) {
                                                                 ...(process.env.DEVICE_SUPERSEDE ? { supersede: enumEnv("DEVICE_SUPERSEDE", "stale_only", ["stale_only", "deny"]) } : {}),
                                                             }
                                                             :
-                                                                process.env.CONFIG_PROVIDER === "local"
+                                                                ctx.configProvider === "local"
                                                                     ? { provider: "host" }
                                                                     : undefined,
         worktreeIsolation: boolEnv("WORKTREE_ISOLATION_ENABLED", false) && process.env.WORKTREE_REPO_ROOT
@@ -2028,7 +2066,13 @@ function parseLimitsHttpDomain() {
         costQuotaWindowSec: numEnv("COST_QUOTA_WINDOW_SEC", "86400"),
         reapIntervalSec: numEnv("REAP_INTERVAL_SEC", "60"),
         runStaleSec: numEnv("REAP_RUN_STALE_SEC", "120"),
-        toolResultTtlSec: numEnv("TOOL_RESULT_TTL_SEC", "86400"),
+        toolResultTtlSec: (() => {
+            const ttl = numEnv("TOOL_RESULT_TTL_SEC", "86400");
+            if (ttl <= 0) {
+                throw new Error(`env TOOL_RESULT_TTL_SEC=${ttl} must be > 0 — it is the age (seconds) after which an offloaded tool result is reaped, so 0 or less puts the cutoff at or after now and every reaper tick would delete ALL of them; there is no "off": set a larger value to keep results longer (the config center refuses the same value)`);
+            }
+            return ttl;
+        })(),
     };
 }
 function parseObservabilityDomain() {
@@ -2081,7 +2125,7 @@ function parseGitApiKind(raw, baseUrl) {
     return kind;
 }
 function parseIntegrationsDomain(ctx) {
-    const { requirePrincipal } = ctx;
+    const { requirePrincipal, configProvider } = ctx;
     return {
         pluginsAllowHosts: (process.env.PLUGINS_ALLOW_HOSTS ?? "github.com").split(",").map((h) => h.trim()).filter(Boolean),
         configBootFetchBudgetMs: clampEnvWithWarn("CONFIG_BOOT_FETCH_BUDGET_MS", "1500", 0),
@@ -2092,7 +2136,7 @@ function parseIntegrationsDomain(ctx) {
         skillsDir: env("SKILLS_DIR", defaultSkillsDir()),
         centerCredentialRenewLeadMs: parseCenterCredentialRenewLeadMs(process.env.CENTER_CREDENTIAL_RENEW_LEAD_MS),
         configCenter: process.env.SEMA_REGISTRY_URL ? parseConfigCenter(env("SEMA_REGISTRY_URL"), requirePrincipal) : undefined,
-        configProvider: process.env.CONFIG_PROVIDER || undefined,
+        ...(configProvider !== undefined ? { configProvider } : {}),
         configLocalDir: process.env.CONFIG_LOCAL_DIR || undefined,
         a2aServe: parseA2aServe(),
     };
@@ -2281,6 +2325,7 @@ export function loadConfig() {
     CONFIG_KNOBS.clear();
     const requirePrincipal = boolEnv("REQUIRE_PRINCIPAL", false);
     const singleUserTurnkey = !requirePrincipal;
+    const configProvider = parseConfigProvider();
     const postureOn = (name, infraReady = true) => {
         const explicit = parseBoolWord(name, process.env[name]);
         const value = explicit ?? (singleUserTurnkey && infraReady);
@@ -2293,10 +2338,10 @@ export function loadConfig() {
     const approval = parseApprovalDomain({ postureOn, singleUserTurnkey, infraReady: durableStoreReady });
     const memory = parseMemoryDomain({ requirePrincipal });
     const auth = parseAuthDomain({ requirePrincipal });
-    const orchestration = parseOrchestrationDomain({ postureOn, singleUserTurnkey });
+    const orchestration = parseOrchestrationDomain({ postureOn, singleUserTurnkey, configProvider });
     const limitsHttp = parseLimitsHttpDomain();
     const observability = parseObservabilityDomain();
-    const integrations = parseIntegrationsDomain({ requirePrincipal });
+    const integrations = parseIntegrationsDomain({ requirePrincipal, configProvider });
     const { directApprovalDoor, durableApproval: dgDurable, approvalHmacKeys: dgHmacKeys } = approval;
     const { principalJwtPubkeys, principalJwtIss, principalJwtAud, operatorPrincipals: dgOperators, authTokens } = auth;
     const { enabled: imageBakesEnabled, runnerPrincipal: bakeRunnerPrincipal } = orchestration.imageBakes;
@@ -2330,14 +2375,6 @@ export function loadConfig() {
     if (imageBakesEnabled && !Object.values(authTokens).includes(bakeRunnerPrincipal)) {
         throw new Error(`IMAGE_BAKES_ENABLED=true but no SERVICE_AUTH_TOKENS entry maps to the runner principal '${bakeRunnerPrincipal}' — the bake-runner authenticates by its credential (token-derived source), so a '<BAKE_RUNNER_TOKEN>=${bakeRunnerPrincipal}' SERVICE_AUTH_TOKENS entry is required or claim/ingest/heartbeat all 403 (IMAGE-API-DESIGN.md §P2.12 boot invariant)`);
     }
-    if (orchestration.leaderEnabled && orchestration.remoteExec?.provider === "host") {
-        throw new Error("LEADER_ENABLED=true + REMOTE_EXEC=host is refused: the leader wire pins ONE absolute workspace path " +
-            "(LEADER_WORKSPACE / the /home/user default) for every sub-worker, while the host adapter gives each env a " +
-            "DIFFERENT random directory — so N concurrent host workers would share one physical git worktree and " +
-            "corrupt each other's state SILENTLY (per-worker workspace is not wired on this lane yet). Run the leader " +
-            "on an isolated lane (REMOTE_EXEC=e2b or k8s), or turn the leader off (unset LEADER_ENABLED) " +
-            "(#193 车4 件2 / staleness ledger P1-10 boot invariant)");
-    }
     if (orchestration.leaderEnabled && store.dbBackend !== "mysql" && store.dbBackend !== "pg") {
         throw new Error(`LEADER_ENABLED=true but DB_BACKEND=${store.dbBackend} (no external SQL store) is refused: a leader run is an ` +
             "N-worker fan-out lasting up to 24h that ends in a REAL git push, and without a durable store its registry is " +
@@ -2345,25 +2382,6 @@ export function loadConfig() {
             "push. Point the service at a durable store (DB_BACKEND=mysql|pg), or turn the leader off (unset LEADER_ENABLED) " +
             "(#193 车4 件2 / staleness ledger P1-9+P1-10 boot invariant)");
     }
-    {
-        const deviceLane = orchestration.remoteExec?.provider === "device";
-        const deviceSqlStore = (store.dbBackend === "mysql" && store.tidb !== undefined) || (store.dbBackend === "pg" && store.pg !== undefined);
-        if (deviceLane && !deviceSqlStore) {
-            throw new Error(`REMOTE_EXEC=device with DB_BACKEND=${store.dbBackend} and no SQL connection coordinates built is refused ` +
-                "[device-durable-store]: the device registry, the session↔device binding and the device audit trail are all " +
-                "SQL-backed — without a real SQL store the binding lives in this process only, so a restart forgets WHICH device " +
-                "a parked run must resume onto and a second replica cannot see it at all. Note DB_BACKEND alone is not enough: " +
-                "SESSION_BACKEND=memory (or auto with no MYSQL_HOST/PG_HOST) builds no coordinates at all. Configure a durable " +
-                "store (DB_BACKEND=mysql|pg + its *_HOST/*_USER/*_DATABASE), or unset REMOTE_EXEC " +
-                "(device-executor-lane-v2 §4.7 boot invariant)");
-        }
-        if (deviceLane && !dgDurable) {
-            throw new Error("REMOTE_EXEC=device without DURABLE_APPROVAL=true is refused [device-durable-approval]: a personal device goes " +
-                "offline (lid closed, network drop) at arbitrary points, so an in-flight approval that outlives the window MUST " +
-                "have a park exit — without the durable approval store there is none and the run is stuck with nowhere to persist. " +
-                "Set DURABLE_APPROVAL=true, or unset REMOTE_EXEC (device-executor-lane-v2 §4.7 boot invariant)");
-        }
-    }
     if (orchestration.requireExecutionLane && orchestration.remoteExec === undefined) {
         throw new Error(`REQUIRE_EXECUTION_LANE=true but NO execution lane is named on this deployment — refusing to start. ` +
             `With no lane the engine falls back to its in-process stub environment, where at least the Bash tool is ` +
@@ -2387,7 +2405,7 @@ export function loadConfig() {
             throw new Error(refusal);
         }
     }
-    EXEC_LANE_NOTICE = buildExecLaneNotice(orchestration.remoteExec);
+    EXEC_LANE_NOTICE = buildExecLaneNotice(orchestration.remoteExec, configProvider);
     return attachConfigGroups({
         ...store,
         ...modelPlane,