@sema-agent/server 7.11.0 → 7.12.0

package/dist/config.js

@@ -172,17 +172,34 @@ function numEnvBounded(name, fallback, min, max) {
         throw new Error(`env ${name}=${n} must be in [${min}, ${max}]`);
     return n;
 }
-/** Optional FAIL-SAFE numeric env for an OPTIONAL feature knob: a non-numeric / non-positive value yields `undefined`
- *  (the caller falls back to its own default) rather than NaN OR a hard startup throw. Used for SESSION_SNAPSHOT_TTL_SEC
- *  (finding 20): a typo like "600s" must NOT sign every presigned URL with X-Amz-Expires=NaN (total snapshot outage),
- *  but ALSO must not crash boot of an unrelated subsystem — degrade to the MinioBlobBackend default. */
-/** S20 (SILENT-FALLBACK P1): soft-knob parse rejects, collected here because config parsing runs BEFORE the
- *  logger exists. main.ts drains this once after createLogger and warns per entry ("configured X=raw is
- *  invalid, using the default"). Module-level on purpose; drain clears it (repeat loadConfig in tests is fine). */
 const CONFIG_WARNINGS = [];
 export function drainConfigWarnings() {
     return CONFIG_WARNINGS.splice(0, CONFIG_WARNINGS.length);
 }
+/**
+ * #210 —— 轮换钥两口(APPROVAL_HMAC_KEYS / PRINCIPAL_JWT_PUBKEYS)的诊断落点。
+ *
+ * 这两口的 fail-closed 方向本来就是对的(坏形 ⇒ 空钥集 ⇒ 门关着),本批**一个字都不动它**;补的是
+ * 「丢弃零留痕」:轮换新钥时写错一个字段,那一条被静默滤掉,旧钥还在于是一切照常,直到旧钥退役当天
+ * 全量回决一起 401 —— 故障与配置错误之间隔着几周,没有任何线索指回来。
+ *
+ * 走 CONFIG_WARNINGS(不是 throw):拒启会把一台**本来还能用旧钥服务**的 worker 直接打死,而这两口的
+ * 语义就是「集合里能用几把用几把」。`raw` 只写条目序号 + 缺陷字段名 —— 值不进日志(HMAC 那把是对称
+ * 密钥),`used` 恒不带(这不是夹取形,没有"采用值"可言)。
+ *
+ * 返回一只闭包(捕获 env 名)⇒ 按仓规命名 `announce*` 而非 `build*`。
+ */
+function announceKeySetRejection(envName) {
+    return (r) => CONFIG_WARNINGS.push({
+        env: envName,
+        raw: "<withheld: this env holds credential material>",
+        // ⚠️ 整份坏 ≠ 掉了一条(codex 自审 R3-F1 真修):`index: "-"` 说的是**整个** key-set 没解析出来,
+        // 于是信任锚**全空** —— 直连门整条关死、所有回决当场失效;而 `entry-rejected` 只是轮换里少进来
+        // 一把钥,旧钥还在服务。两者是不同量级的事故,告警规则必须分得开,不能挤在一个事件名下。
+        kind: r.index === "-" ? "set-rejected" : "entry-rejected",
+        detail: r.index === "-" ? r.reason : `entry #${r.index}: ${r.reason}`,
+    });
+}
 /** Boot NOTICES ([792]④): non-error decisions loadConfig makes that the operator should see once (e.g. the
  *  MODEL_PROVIDER inference below). Same pre-logger collection pattern as CONFIG_WARNINGS, but each entry
  *  carries its own event name + fields (the warnings drain has one fixed "invalid, using default" message
@@ -220,8 +237,33 @@ function buildExecLaneNotice(remoteExec) {
  *  after (main.ts, run-local.ts) — a new entry that forgets it would silently drop operator-facing diagnostics
  *  (run-local historically did exactly that), so the drain lives beside the collectors, not in one entrypoint. */
 export function logConfigDiagnostics(logger) {
-    for (const w of drainConfigWarnings())
-        logger.warn("config_env_invalid_using_default", { env: w.env, raw: w.raw });
+    // #210:四种诊断各有自己的事件名 —— 「invalid, using the default」对一个**合法但越界**的值、对一个被
+    // 保留的空串、对一条被丢弃的钥,都是错的描述,而运维的告警规则正是按事件名写的。穷尽 switch:词表加
+    // 一个种类而这里漏接 ⇒ `never` 赋值编译红(CLAUDE.md 闭集词表纪律)。
+    for (const w of drainConfigWarnings()) {
+        const kind = w.kind ?? "invalid-default";
+        switch (kind) {
+            case "clamped":
+                logger.warn("config_env_out_of_range_clamped", { env: w.env, raw: w.raw, used: w.used });
+                break;
+            case "empty-preserved":
+                logger.warn("config_env_empty_kept_prior_value", { env: w.env, used: w.used });
+                break;
+            case "entry-rejected":
+                logger.warn("config_env_entry_rejected", { env: w.env, entry: w.detail });
+                break;
+            case "set-rejected":
+                logger.warn("config_env_set_rejected", { env: w.env, problem: w.detail });
+                break;
+            case "invalid-default":
+                logger.warn("config_env_invalid_using_default", { env: w.env, raw: w.raw, ...(w.used !== undefined ? { used: w.used } : {}) });
+                break;
+            default: {
+                const unreachable = kind;
+                throw new Error(`unhandled config warning kind: ${String(unreachable)}`);
+            }
+        }
+    }
     for (const n of drainConfigNotices())
         logger.warn(n.event, n.fields);
     // #157 F 类观测:执行车道落点一行(见 EXEC_LANE_NOTICE 头注)。无条件发 —— boot 期本来就只跑一次,
@@ -264,6 +306,74 @@ function firstSetEnv(...names) {
     }
     return undefined;
 }
+/**
+ * #210(黑板 [3425]③)—— **E 类**旋钮的唯一夹取口:`numEnv` 的坏值拒启 + 越界**夹取并点名**。
+ *
+ * 为什么抽一只而不是 24 处各写各的:改前这 24 处清一色是 `Math.max(floor, numEnv(...))`,夹取本身是
+ * 刻意的(存量部署配了越界值也不该拒启),但**夹取事件零留痕** —— operator 把 `DRAIN_GRACE_MS` 设成
+ * `100`(以为单位是秒)后,进程按 10s 排空、日志里一个字都没有,直到某次滚动升级把在飞任务砍了才回头
+ * 查。24 处手写 `CONFIG_WARNINGS.push` 必然漂(有人忘记带 `used`、有人写错 env 名),判据只有一份才咬得住。
+ *
+ * 返回纯数值 ⇒ 按仓规叫 `clamp*` 而非 `create*`。
+ *
+ * ⚠️ `max` 缺省 `+Infinity` 而**不是**一个大整数上帽(codex 自审 R2-F2 真修):这 22 处里只有
+ * APPROVAL_AUTO_BUDGET 原本真有 `Math.min` 上帽,其余全是「只有地板」。给它们塞一个有限上界等于凭空长出
+ * 一条上限 —— 一个拿超大有限值当「实际上无限」哨兵的存量部署会被无预告改小,而本批对外宣称的正是「夹取
+ * 行为逐字保留」。上界只写在原本就有上界的那一处。
+ * (`Infinity` 本身进不来:`numEnv` 的 `Number.isFinite` 门已经把 `1e400` 拒在启动期。)
+ */
+function clampEnvWithWarn(name, fallback, min, max = Number.POSITIVE_INFINITY) {
+    const n = numEnv(name, fallback);
+    const used = Math.min(max, Math.max(min, n));
+    if (used !== n)
+        CONFIG_WARNINGS.push({ env: name, raw: env(name, fallback), used: String(used), kind: "clamped" });
+    return used;
+}
+/**
+ * #210 —— `numEnv` 的「fallback 不是字符串而是一个**已算出来的数**」变体。用在 cheap-model 的
+ * 窗口/上限两键上:未设时继承**主模型**的对应值,而不是继承一个字面量默认。
+ *
+ * 改前是 `process.env.X ? Number(X) : main` —— 真值门本身没错(空串已经落在「继承主模型」那一侧,本函数
+ * 逐字保留),错的是给了值之后的裸 `Number()`:`MODEL_CHEAP_CONTEXT_WINDOW=128k` 会静默铸出 NaN 窗口,
+ * 而窗口是被拿去做大小比较的,NaN 让每一处比较恒假 ⇒ 窗口守卫整条消失。
+ *
+ * ⚠️ cheap 的**单价**四键不走这里,走 {@link cheapCostEnv}:它们改前是 `?? ` 形,空串会落 0 而不是继承,
+ * 那条既有语义必须逐字保留(见该函数头注)。两族的空串语义不同源,别合并。
+ */
+function numEnvOr(name, fallback) {
+    const raw = process.env[name];
+    if (raw === undefined || raw === "")
+        return fallback;
+    return parseNumOrFail(name, raw);
+}
+/**
+ * #210 —— cheap 单价四键**专用**的变体(codex 自审 R1-F2 真修)。
+ *
+ * 与 `numEnvOr` 只差空串一条,而这条差别是有理由的:这四键改前写的是 `Number(env ?? main)`,空串会走进
+ * `Number("")` = **0**,也就是「这条车道按零计价」——那是一个**已经在生效**的语义,不是坏值。把它归一
+ * 成「继承主模型单价」会让一台存量部署的 cheap 车道账面单价从 0 跳到 PRO 价,配额可能当场把在跑的任务
+ * 拒掉。律条治的是**坏值静默**,不是顺手改既有语义,所以行为逐字保留、改为响亮:空串照旧落 0,但
+ * CONFIG_WARNINGS 点名(它几乎总是 compose `${VAR:-}` 漏配的产物,而不是有人真想要免费计价)。
+ */
+function cheapCostEnv(name, mainPrice) {
+    const raw = process.env[name];
+    if (raw === undefined)
+        return mainPrice;
+    if (raw === "") {
+        CONFIG_WARNINGS.push({ env: name, raw: "", used: "0", kind: "empty-preserved" });
+        return 0; // 改前 `Number("")` 的逐字行为
+    }
+    return parseNumOrFail(name, raw);
+}
+/** #210 —— 「真值门 + 裸 `Number()`」那一族(执行车道八旋钮)的收口:门照旧(未设/空串 ⇒ 键缺席,
+ *  与改前逐字相同),但**给了值**就必须是数,否则 boot 拒。NaN 超时进 adapter = 守卫整条消失,而车道
+ *  旋钮在安全轴上(CLAUDE.md「执行车道禁静默 fail-open」)。 */
+function optNumEnvStrict(name) {
+    const raw = process.env[name];
+    if (!raw)
+        return undefined; // 真值门原样保留:"" 与 "0" 皆视作未设(改前行为,本批不动这条语义)
+    return parseNumOrFail(name, raw);
+}
 function optFinitePositiveEnv(name) {
     const raw = process.env[name];
     if (raw === undefined || raw === "")
@@ -426,12 +536,15 @@ function buildExtraBody() {
         }
         Object.assign(body, parsed);
     }
+    // #210 A 档:与本函数自己的纪律对齐(坏 JSON 已经是 boot throw)—— 裸 `Number()` 的 NaN 会原样进
+    // `extraBody`,`JSON.stringify` 把它写成 `null`,网关要么 400 要么按缺省跑,两种都不是 operator 配的
+    // 那个值,而且哪一种都不会说出来。
     const fp = process.env.MODEL_FREQUENCY_PENALTY;
     const pp = process.env.MODEL_PRESENCE_PENALTY;
     if (fp !== undefined && fp !== "")
-        body.frequency_penalty = Number(fp);
+        body.frequency_penalty = parseNumOrFail("MODEL_FREQUENCY_PENALTY", fp);
     if (pp !== undefined && pp !== "")
-        body.presence_penalty = Number(pp);
+        body.presence_penalty = parseNumOrFail("MODEL_PRESENCE_PENALTY", pp);
     return Object.keys(body).length > 0 ? body : undefined;
 }
 /** [818]① 1M dual-window derivation (core 1.289 `Model.autoCompactTokens`): an EXPLICIT positive value wins
@@ -521,7 +634,9 @@ function parseStoreDomain(ctx) {
         tidb: needsDb && dbBackend === "mysql"
             ? {
                 host: env("MYSQL_HOST"),
-                port: Number(env("MYSQL_PORT", "3306")),
+                // #210 A 档:裸 Number ⇒ NaN 端口直进 driver(行为因驱动而异,多数是「连不上」而不是「说清
+                // 为什么」)。区间 [1,65535] 一并钉死 —— 端口的合法域是全域公理,不是本仓口味。
+                port: numEnvBounded("MYSQL_PORT", "3306", 1, 65535),
                 user: env("MYSQL_USER"),
                 password: env("MYSQL_PASSWORD", ""),
                 database: env("MYSQL_DATABASE"),
@@ -535,7 +650,7 @@ function parseStoreDomain(ctx) {
         pg: needsDb && dbBackend === "pg"
             ? {
                 host: env("PG_HOST"),
-                port: Number(env("PG_PORT", "5432")),
+                port: numEnvBounded("PG_PORT", "5432", 1, 65535), // #210 A 档,同 MYSQL_PORT 族
                 user: env("PG_USER"),
                 password: env("PG_PASSWORD", ""),
                 database: env("PG_DATABASE"),
@@ -666,21 +781,25 @@ function parseModelDomain() {
         // historical behavior (spend reads $0) — set MODEL_COST_* on a deploy to make `model_cost_micro_usd`
         // + the Fleet card's costUsd real. Numbers are the gateway's contract price (e.g. the review gateway's
         // deepseek-pro), owned by the operator — the center never stores them (design/15: secrets+billing in env).
+        // #210 A 档(黑板 [3425]③):四项单价与两项窗口一律 `numEnv`(坏值 boot 拒),不再裸 `Number()`。
+        // NaN 单价是本族里后果最重的一形:它顺着 `modelCostToPricing` 一路进 `costUsd`,而 `NaN > ceiling`
+        // 与 `NaN < ceiling` **同时为假** —— MAX_TASK_COST_USD / MAX_PRINCIPAL_COST_USD 两道天花板不是变松,
+        // 是**整条消失**,且账面读数就是空的,没有任何一处会响。
         cost: {
-            input: Number(env("MODEL_COST_INPUT", "0")),
-            output: Number(env("MODEL_COST_OUTPUT", "0")),
-            cacheRead: Number(env("MODEL_COST_CACHE_READ", "0")),
-            cacheWrite: Number(env("MODEL_COST_CACHE_WRITE", "0")),
+            input: numEnv("MODEL_COST_INPUT", "0"),
+            output: numEnv("MODEL_COST_OUTPUT", "0"),
+            cacheRead: numEnv("MODEL_COST_CACHE_READ", "0"),
+            cacheWrite: numEnv("MODEL_COST_CACHE_WRITE", "0"),
         },
-        contextWindow: Number(env("MODEL_CONTEXT_WINDOW", "262144")),
+        contextWindow: numEnv("MODEL_CONTEXT_WINDOW", "262144"),
         // [854]③a: env 车道缺省 4096 → 32000。4096 对 reasoning 模型太小(一次完整思考+答案都放不下,长输出
         // 任务被腰斩;上游同类缺省 32000)。per-model clamp:缺省值不越过本 entry 自己声明的 contextWindow
         // (操作员配了小窗口模型时,缺省输出上限不得超过窗口本身 —— env 车道 model entry 就在此装配,唯一可用
         // 约束即 MODEL_CONTEXT_WINDOW)。显式 MODEL_MAX_TOKENS 一如既往原样生效(显式配置=操作员意图,不 clamp);
         // catalog(config.d/models.json)与 center 车道不动(那是显式配置,BL-8 继承链读的是这里的最终值)。
         maxTokens: process.env.MODEL_MAX_TOKENS !== undefined && process.env.MODEL_MAX_TOKENS !== ""
-            ? Number(env("MODEL_MAX_TOKENS"))
-            : Math.min(32000, Number(env("MODEL_CONTEXT_WINDOW", "262144"))),
+            ? parseNumOrFail("MODEL_MAX_TOKENS", process.env.MODEL_MAX_TOKENS)
+            : Math.min(32000, numEnv("MODEL_CONTEXT_WINDOW", "262144")),
         // design/123 D2 (core 1.226): structural token-estimate coefficient (chars ≈ 1 token) feeding every
         // non-usage-anchored estimate in core (compaction trigger fallback, clearStale/trim defenses, cut-point
         // accounting). UNSET → omit = core default 4 (byte-compatible chars/4 heuristic). CJK-heavy models
@@ -725,17 +844,19 @@ function parseModelDomain() {
             // inherits the MAIN model's `cost` and subagent/summarize spend (council lenses, compaction) is
             // metered at the PRO per-token price → cost metric + per-principal quota over-count. Set
             // MODEL_CHEAP_COST_* to the real cheap price; unset → inherit the main cost (prior behavior, no change).
+            // #210 A 档:非数值 boot 拒(改前静默 NaN)。空串走 `cheapCostEnv` 的专门臂——它逐字保留改前的
+            // `Number("")`=0 并点名,理由见该函数头注(codex 自审 R1-F2)。
             cost: {
-                input: Number(process.env.MODEL_CHEAP_COST_INPUT ?? model.cost.input),
-                output: Number(process.env.MODEL_CHEAP_COST_OUTPUT ?? model.cost.output),
-                cacheRead: Number(process.env.MODEL_CHEAP_COST_CACHE_READ ?? model.cost.cacheRead),
-                cacheWrite: Number(process.env.MODEL_CHEAP_COST_CACHE_WRITE ?? model.cost.cacheWrite),
+                input: cheapCostEnv("MODEL_CHEAP_COST_INPUT", model.cost.input),
+                output: cheapCostEnv("MODEL_CHEAP_COST_OUTPUT", model.cost.output),
+                cacheRead: cheapCostEnv("MODEL_CHEAP_COST_CACHE_READ", model.cost.cacheRead),
+                cacheWrite: cheapCostEnv("MODEL_CHEAP_COST_CACHE_WRITE", model.cost.cacheWrite),
             },
             // systematic-audit: the cheap model also inherited the MAIN model's contextWindow/maxTokens/reasoning verbatim
             // via the `...model` spread — wrong if MODEL_CHEAP_ID points at a model with different limits/capability. Declare
             // them per cheap (MODEL_CHEAP_*); UNSET → inherit main (the documented "same gateway, just a different id" case).
-            contextWindow: process.env.MODEL_CHEAP_CONTEXT_WINDOW ? Number(process.env.MODEL_CHEAP_CONTEXT_WINDOW) : model.contextWindow,
-            maxTokens: process.env.MODEL_CHEAP_MAX_TOKENS ? Number(process.env.MODEL_CHEAP_MAX_TOKENS) : model.maxTokens,
+            contextWindow: numEnvOr("MODEL_CHEAP_CONTEXT_WINDOW", model.contextWindow),
+            maxTokens: numEnvOr("MODEL_CHEAP_MAX_TOKENS", model.maxTokens),
             // design/123 D2: charsPerToken per cheap slot — the spread inherits the MAIN model's coefficient,
             // wrong when the cheap slot is a different tokenizer family (e.g. CJK-dense deepseek cheap under an
             // anthropic main). MODEL_CHEAP_CHARS_PER_TOKEN overrides; UNSET → inherit main (same knob family).
@@ -850,7 +971,11 @@ function parseModelDomain() {
         degrade: process.env.MODEL_DEGRADE_TO
             ? {
                 to: env("MODEL_DEGRADE_TO"),
-                atCostFraction: Number(env("MODEL_DEGRADE_AT_COST_FRACTION", "0.7")),
+                // #210 A 档:本族里最必须拒的一条 —— NaN 阈值让 `spent/budget >= atCostFraction` 恒假,**降级
+                // 整条永久静默关闭**,而 operator 恰恰是配了 MODEL_DEGRADE_TO 才走到这里(他确信降级开着)。
+                // 不加 [0,1] 上下界:>1 是「实际上别降级」的合法表达,收窄会破已配了它的存量部署,而律条要治的
+                // 是坏值静默,不是把区间一起收了。
+                atCostFraction: numEnv("MODEL_DEGRADE_AT_COST_FRACTION", "0.7"),
                 reactive: boolEnv("MODEL_DEGRADE_REACTIVE", false),
                 // core 5.1.0([2390]②):词表=DegradeReason 全集;缺席时 core 默认含 server_error(默认门变宽),
                 // 本 env 是运维收窄/放宽的唯一旋钮。拼错词 boot 响亮拒——盲铸静默折无效成员是 TASK_TIMEOUT_SEC 同族病。
@@ -995,7 +1120,7 @@ function parseApprovalDomain(ctx) {
     const { postureOn } = ctx; // 跨域入参②:posture 三态(single-user turnkey ⇒ HITL 面默认 ON)
     // design/80 D-G: the direct-connect approval door anchors (all must be present to ACTIVATE; fail-closed).
     const directApprovalDoor = boolEnv("DIRECT_APPROVAL_DOOR", false);
-    const dgHmacKeys = parseApprovalHmacKeys(process.env.APPROVAL_HMAC_KEYS);
+    const dgHmacKeys = parseApprovalHmacKeys(process.env.APPROVAL_HMAC_KEYS, announceKeySetRejection("APPROVAL_HMAC_KEYS"));
     // DURABLE_APPROVAL 既是本域字段,也是直连门的硬前置 —— 那条前置的理由与断言在装配层的跨域不变量段。
     const durableApproval = boolEnv("DURABLE_APPROVAL", false);
     // [2380] core 5.0.0 RB-476:approval 名单里「永不匹配」的名字**装配期拒启**(带修正指引)。core 自己的
@@ -1013,8 +1138,9 @@ function parseApprovalDomain(ctx) {
         approvalDeny: rejectUnmatchableToolNames("APPROVAL_DENY", csv("APPROVAL_DENY")),
         durableApproval,
         resourceSuspend: boolEnv("RESOURCE_SUSPEND", false),
-        resourceSuspendTtlSec: Math.max(0, numEnv("RESOURCE_SUSPEND_TTL_SEC", "0")), // 0 ⇒ core default (30d)
-        approvalAutoBudget: Math.min(10000, Math.max(0, numEnv("APPROVAL_AUTO_BUDGET", "0"))), // clamp [0,10000]; 0 = off
+        // #210 B 档:夹取行为逐字保留(存量部署配了越界值不该拒启),但夹取当场点名(env+原值+采用值)。
+        resourceSuspendTtlSec: clampEnvWithWarn("RESOURCE_SUSPEND_TTL_SEC", "0", 0), // 0 ⇒ core default (30d)
+        approvalAutoBudget: clampEnvWithWarn("APPROVAL_AUTO_BUDGET", "0", 0, 10000), // clamp [0,10000]; 0 = off
         approvalNeverAuto: rejectUnmatchableToolNames("APPROVAL_NEVER_AUTO", csv("APPROVAL_NEVER_AUTO")),
         approvalHmacKeys: dgHmacKeys, // D-G: WIRED (see the field's JSDoc); empty ⇒ inactive, not unimplemented
         directApprovalDoor,
@@ -1028,13 +1154,45 @@ function parseApprovalDomain(ctx) {
                 return [];
             return trimmed.split(",").map((p) => p.trim()).filter((p) => p.length > 0);
         })(process.env.SENSITIVE_WRITE_PATTERNS),
-        // [1557]§四 → #153: opt-in only — any value other than the two real gate shapes (incl. "off"/unset) stays
-        // undefined (no field on the config object at all), so `applyRuntimeGovernance` never receives the knob and
-        // THIS knob contributes nothing to the governance pass (zero behavior change from it). Note that pass can
-        // still set `TaskSpec.shellGate` on its own account — `AUTONOMY=ask` derives "always" independently.
-        ...(process.env.MANUAL_MODE_SHELL_GATE === "always" || process.env.MANUAL_MODE_SHELL_GATE === "classify"
-            ? { manualModeShellGate: process.env.MANUAL_MODE_SHELL_GATE }
-            : {}),
+        // [1557]§四 → #153: opt-in only — the two real gate shapes ride; `off`/empty/unset leave the field ABSENT
+        // (no key on the config object at all), so `applyRuntimeGovernance` never receives the knob and THIS knob
+        // contributes nothing to the governance pass. Note that pass can still set `TaskSpec.shellGate` on its own
+        // account — `AUTONOMY=ask` derives "always" independently, and (design/201) an explicit client permission
+        // mode now supplies the BASE档 this knob tightens from.
+        //
+        // design/201 §4 —— 词表与非法值:合法值 = `always | classify | off | 空串/未设`,**其余 boot 拒启**。
+        // 动机是把**既有**风险变响亮而不是防将来:改前任何手滑值(`clasify`/`true`/`ON`)与未设置等效,
+        // 于是「我配了闸」的部署实际在无闸运行,且这件事零留痕。同层先例=`rejectUnmatchableToolNames`
+        // (上方,解析层拒启;#177 的 `assertGuardPatternsUsable` 在 deployment-governance 层,不是本层)。
+        //
+        // 🔴 **与兄弟旋钮的语义不对称是刻意的,禁止将来"统一"**:`SENSITIVE_WRITE_PATTERNS=off` 是一根
+        // **真放松杆**(清空 server 自己的产品默认推荐集 —— off = 对那份默认的显式退出);
+        // `MANUAL_MODE_SHELL_GATE=off` 是 **no-op**(归一成键缺席),因为本键的缺省不属于 server 产品默认,
+        // 而属于**车道翻译轴**(design/201 的 permissionMode 表),env 在这条轴上只有收紧半场、没有放松方向。
+        // 把 off 做成"关闸"就等于给部署级旋钮开一条放松通道,那正是 #153 修掉的病。所以 off 不静默:
+        // 归一的同时发一条 boot 诊断行(下面的 CONFIG_NOTICES),让运维不会按兄弟旋钮的直觉误读。
+        ...((raw) => {
+            const trimmed = (raw ?? "").trim();
+            if (trimmed === "always" || trimmed === "classify")
+                return { manualModeShellGate: trimmed };
+            if (trimmed === "" || trimmed === "off") {
+                if (trimmed === "off") {
+                    CONFIG_NOTICES.push({
+                        event: "manual_mode_shell_gate_off_is_noop",
+                        fields: {
+                            env: "MANUAL_MODE_SHELL_GATE",
+                            raw: trimmed,
+                            effect: "accepted as a no-op (normalized to the knob being absent) — this knob has a TIGHTEN half only, so `off` cannot relax anything; " +
+                                "the effective shell gate still comes from AUTONOMY and the client's permission mode. NOT symmetric with SENSITIVE_WRITE_PATTERNS=off, which really does clear a server-owned default set",
+                        },
+                    });
+                }
+                return {};
+            }
+            throw new Error(`env MANUAL_MODE_SHELL_GATE="${trimmed.slice(0, 120)}" is not a recognized value — use "always" (every shell call is gated), "classify" (core's classifier decides per call), or "off"/unset (this knob contributes nothing). ` +
+                `The words are matched EXACTLY (lowercase, surrounding whitespace trimmed): "OFF"/"Classify" land here too, deliberately — a closed word table with no case-folding is what keeps "it looked accepted" from meaning "it did nothing". ` +
+                `Refusing to boot rather than treating a misspelled value as "unset": that silently ran the deployment with NO shell gate while the operator believed one was configured`);
+        })(process.env.MANUAL_MODE_SHELL_GATE),
         mcpElicitation: {
             enabled: boolEnv("MCP_ELICITATION_ENABLED", false), // E23 inbound elicitation; default OFF (fail-closed)
             throttle: {
@@ -1053,10 +1211,16 @@ function parseApprovalDomain(ctx) {
             ttlMs: numEnvBounded("QUESTION_TTL_MS", String(DEFAULT_QUESTION_THROTTLE.ttlMs), 1_000, 3_600_000),
         },
         toolApprovalEnabled: postureOn("TOOL_APPROVAL_ENABLED"), // [816]/[820]② live tool-approval HITL; posture-gated (single-user → ON), mirrors askQuestion
-        // #154 车二:持久化权限规则车道的总开关。**默认 OFF**,理由(撤销面未落地之前只加放行不减)逐字见
-        // `ServiceApprovalConfig.permissionRulesEnabled`。**不**做 posture 派生:这条轴与「单用户交钥匙」
-        // 无关,它取决于运维接不接受「暂时只能改库收回」,那必须是一次显式表态。
-        permissionRulesEnabled: boolEnv("PERMISSION_RULES_ENABLED", false),
+        // #154 车二 → #203:持久化权限规则车道的总开关。**默认 ON**(clay [3396] 裁),理由与它此前默认
+        // OFF 的**唯一**前置(撤销面缺席)逐字见 `ServiceApprovalConfig.permissionRulesEnabled`。
+        // **不**做 posture 派生:这条轴与「单用户交钥匙」无关(多租户同样要它),所以它是一条与部署形态
+        // 正交的普通 opt-out 旋钮,而不是 `postureOn` 那一族。
+        permissionRulesEnabled: boolEnv("PERMISSION_RULES_ENABLED", true),
+        // 🔴 「运维**显式**表过态吗」是与取值分开的一位(同 `dbBackendExplicit` 的姿势)。它只有一个消费者:
+        // boot 期的休眠行审计(`boot/permission-rules-audit.ts`)——对显式开过的部署说「N 条规则随默认 ON
+        // 激活」是假话,那些行本来就是活的。判据与 `boolEnv` 认的字面量集**同源**(只有 "true"/"false"
+        // 算表态;空串按未设,拼错的值走 boolEnv 的告警臂并落回默认 ⇒ 也不算表态)。
+        permissionRulesEnabledExplicit: ((raw) => raw === "true" || raw === "false")(process.env["PERMISSION_RULES_ENABLED"]),
         // #151 车2(design/172 §3.3 D3):ToolApprovalCoordinator 窗长三元的安全余量。numEnv fail-loud 形,
         // 照邻居旋钮(approvalTimeoutSec 等)抄——坏形（非数字)在启动期炸,不静默折成 NaN。
         streamAskWindowMarginMs: numEnv("STREAM_ASK_WINDOW_MARGIN_MS", "10000"),
@@ -1071,6 +1235,49 @@ function parseApprovalDomain(ctx) {
         approvalTimeoutSec: numEnv("APPROVAL_TIMEOUT_SEC", "0"),
     };
 }
+/**
+ * #210:MEMORY_ENGINE 的**双族**闭集(codex 自审 R1-F3 真修,把第一版的 `on|off` 两词放宽)。
+ *
+ * 病灶只在**关**的那一侧:改前判据 `!== "off"` 让 `OFF` / `false` / `disabled` / `0` 全部读成「开」——
+ * operator 明确表达了「关掉记忆面」,引擎却照常往每个任务里注入记忆目录,而且零留痕。这一侧必须响亮。
+ *
+ * **开**的那一侧则相反:`true` / `1` / `yes` 改前就落在「开」上,意图与结果一致,把它们改成拒启是**纯
+ * 粹的新增故障**——一台按 `MEMORY_ENGINE=true` 跑了很久的部署会在升级时 boot 红,而它的配置从来没错过。
+ * 所以两族都收进词表,只有**两族都不认得**的词才拒(那种词无从推断意图,静默倒向任何一侧都是猜)。
+ */
+const MEMORY_ENGINE_ON_WORDS = ["on", "true", "1", "yes", "enabled"];
+const MEMORY_ENGINE_OFF_WORDS = ["off", "false", "0", "no", "disabled"];
+function parseMemoryEngineWord(word) {
+    const w = word.trim().toLowerCase();
+    if (MEMORY_ENGINE_ON_WORDS.includes(w))
+        return true;
+    if (MEMORY_ENGINE_OFF_WORDS.includes(w))
+        return false;
+    throw new Error(`env MEMORY_ENGINE="${word}" is not a known on/off word — use one of: ${MEMORY_ENGINE_ON_WORDS.join(" | ")} ` +
+        `(engine ON, the default) or ${MEMORY_ENGINE_OFF_WORDS.join(" | ")} (engine OFF). ` +
+        `An unrecognized value used to read as "on", so a misspelled kill-switch silently kept memory injection running.`);
+}
+/** #210:SANDBOX_PKG_SOURCE 的闭集校验(词表 = README/MIGRATION 成文的四词)。`none` 由调用点的三元
+ *  链先摘走(字段整个缺席),留在这里的只可能是前三词或一个手滑值。 */
+const SANDBOX_PKG_SOURCES = ["global", "cn", "custom", "none"];
+function pkgSourceEnv() {
+    const v = env("SANDBOX_PKG_SOURCE", "global"); // 空串/未设 ⇒ "global"(改前 `|| "global"` 的逐字语义)
+    if (!SANDBOX_PKG_SOURCES.includes(v)) {
+        throw new Error(`env SANDBOX_PKG_SOURCE="${v}" must be one of: ${SANDBOX_PKG_SOURCES.join(", ")}`);
+    }
+    return v;
+}
+/** #210:TOC 同步腿的一条**条数上限**。未设 ⇒ 键缺席(core 默认,改前行为);设了就必须是 ≥1 的整数,
+ *  否则 boot 拒 —— 「设了上限却静默丢弃」等价于「无上限」,方向与 operator 的意图相反。 */
+function syncEntryCap(name, field) {
+    const raw = process.env[name];
+    if (raw === undefined || raw === "")
+        return {};
+    const n = parseNumOrFail(name, raw);
+    if (!Number.isInteger(n) || n < 1)
+        throw new Error(`env ${name}="${raw}" must be an integer >= 1 (it is an entries-per-batch cap; an ignored cap means NO cap)`);
+    return { [field]: n };
+}
 /** 域:memory(记忆面 + TOC 同步腿)—— 记忆引擎开关/方言/根目录、scope 缺省、同步 client 三键、项目记忆。 */
 function parseMemoryDomain(ctx) {
     const { requirePrincipal } = ctx; // 跨域入参①:多租户下记忆面 DARK(scope 缺省不铸)
@@ -1078,7 +1285,15 @@ function parseMemoryDomain(ctx) {
     // (core RunnerDeps.memoryBackend), default ON with MEMORY_ENGINE=off as the explicit kill-switch.
     // The legacy MEMORY_BACKEND/EMBEDDING_* store plane was dropped without migration (those env vars are
     // no longer read). Single-user gating lives in main.ts (the engine is never wired multi-tenant).
-    const memoryEngineEnabled = process.env.MEMORY_ENGINE !== "off";
+    // #210 A 档(黑板 [3425]③):判据从 `!== "off"` 改**闭集**(姿势仿下面的 MEMORY_ENGINE_BACKEND)。
+    // 旧判据的病:任何非 `off` 的字面量都读成「开」—— `MEMORY_ENGINE=OFF` / `=false` / `=disabled` 是
+    // operator 明确表达「关掉记忆面」的三种最常见写法,每一种都让引擎**照常开着**并继续往任务里注入记忆
+    // 目录。这是「拼错的关词 = 静默不关」,与安全轴的词表纪律同族,所以拒启而不是 warn:一个自以为关了
+    // 记忆的部署,和一个明知开着的部署,不是同一个隐私姿态。
+    // ⚠️ 走 `env()` 而不是 `enumEnv()`:后者拿 `??` 取值,会把**空串**当成一个要比对词表的值 —— 而空串
+    // 在本仓一律等同未设(compose 的 `${MEMORY_ENGINE:-}` 模板天天产它),改前 `"" !== "off"` 也确实读成
+    // 「开」。词表化不该顺手把空串变成拒启。
+    const memoryEngineEnabled = parseMemoryEngineWord(env("MEMORY_ENGINE", "on"));
     // S3-TOB(边界重切后的 backend 选择,设计 §1.3):记忆持久面方言。缺省 file=现状零变化;
     // pg/tidb=DB 真身(零卷主档)——多租户点亮的唯一门(显式 opt-in,复审 F5:绝不静默翻转)。
     const memoryEngineBackendRaw = process.env.MEMORY_ENGINE_BACKEND ?? "file";
@@ -1122,7 +1337,17 @@ function parseMemoryDomain(ctx) {
         if (scope === undefined) {
             throw new Error("MEMORY_SYNC_URL is set but no sync scope is derivable (memory engine off or multi-tenant without an explicit scope) — set MEMORY_SYNC_SCOPE, or run the single-user file memory engine so MEMORY_SCOPE (default \"local\") provides one");
         }
-        memorySync = { url: memorySyncUrl, token: memorySyncToken, scope, ...((v) => (v !== undefined && Number.isInteger(v) && v >= 1 ? { maxPushEntries: v } : {}))(process.env.MEMORY_SYNC_MAX_PUSH_ENTRIES !== undefined ? Number(process.env.MEMORY_SYNC_MAX_PUSH_ENTRIES) : undefined), ...((v) => (v !== undefined && Number.isInteger(v) && v >= 1 ? { maxPullEntries: v } : {}))(process.env.MEMORY_SYNC_MAX_PULL_ENTRIES !== undefined ? Number(process.env.MEMORY_SYNC_MAX_PULL_ENTRIES) : undefined) };
+        // #210 A 档:两条上限改**拒启**(与本块自己的「半配置 fail-loud」纪律同源)。旧形是
+        // `Number.isInteger(v) && v>=1` 的三态过滤——不满足就**整个键消失**,而键消失 = core 走自己的默认
+        // = 「没有这条上限」。也就是说 operator 设了一条**收紧**用的上限、结果得到的是最松的那一档,而且
+        // 三种手滑(单位后缀 / 小数 / 0)都落到同一个静默出口。
+        memorySync = {
+            url: memorySyncUrl,
+            token: memorySyncToken,
+            scope,
+            ...syncEntryCap("MEMORY_SYNC_MAX_PUSH_ENTRIES", "maxPushEntries"),
+            ...syncEntryCap("MEMORY_SYNC_MAX_PULL_ENTRIES", "maxPullEntries"),
+        };
     }
     // design/158 B4 ② 的 D 家族四枚里,唯一落在 ServiceConfig 上的就是这枚(其余三枚只在使用点懒读,
     // 预登记留在 orchestration 域 —— 顺序与改前一致:本枚的弃用通知仍先于那三枚)。
@@ -1157,17 +1382,22 @@ function parseMemoryDomain(ctx) {
         memoryOrgGrantTtlMs,
         memoryOrgUnavailableBackoffMs,
         projectMemoryEnabled, // design/113 C4 opt-out, flipped positive in design/158 B4 (3.0.0 起 legacy PROJECT_MEMORY_DISABLED = fail-loud 墓碑)
-        syncImportLeaseStaleSec: Math.max(0, numEnv("SYNC_IMPORT_LEASE_STALE_SEC", "600")),
+        syncImportLeaseStaleSec: clampEnvWithWarn("SYNC_IMPORT_LEASE_STALE_SEC", "600", 0), // #210 B 档
     };
 }
 /** 域:auth(身份/凭证/绑址)—— service token 面、CORS、principal 头与开关、JWT 锚、autonomy、绑址。 */
 function parseAuthDomain(ctx) {
     const { requirePrincipal } = ctx; // 装配层已解析(它是四个域的共同入参),本域只负责把它落到字段上
     // design/80 D-G 直连门的 principal-JWT 锚:验签材料属 auth 域,门的激活与半开门不变量在装配层。
-    const principalJwtPubkeys = parsePrincipalJwks(process.env.PRINCIPAL_JWT_PUBKEYS);
+    const principalJwtPubkeys = parsePrincipalJwks(process.env.PRINCIPAL_JWT_PUBKEYS, announceKeySetRejection("PRINCIPAL_JWT_PUBKEYS"));
     const principalJwtIss = process.env.PRINCIPAL_JWT_ISS || undefined;
     const principalJwtAud = process.env.PRINCIPAL_JWT_AUD || undefined;
-    const principalJwtMaxTtlSec = Math.max(0, numEnv("PRINCIPAL_JWT_MAX_TTL_SEC", "120")); // 0 = no cap; default ≤120s
+    // #210:E 类里**唯一升档为拒启**的一条(其余 23 条保留夹取+点名)。理由是夹取方向与旋钮语义相反:
+    // `0` 在这条上是「无上限」的**显式表达**,于是 `Math.max(0, -1)` 把一个想收紧到「负数=全拒」的手滑
+    // 值,悄悄翻译成了整条上限里**最松**的那一档。收紧意图落成最松结果 ⇒ 夹取在这里是错的补偿,拒启才是。
+    // 复用既有原语 `parseNumOrFailNonNegative`(而不是 numEnvBounded 配一个假上界):它说的正是这条旋钮要
+    // 的判据「非负」,报错文案也直说;凭空塞一个上帽是 R2-F2 那一类的同族错。
+    const principalJwtMaxTtlSec = parseNumOrFailNonNegative("PRINCIPAL_JWT_MAX_TTL_SEC", env("PRINCIPAL_JWT_MAX_TTL_SEC", "120")); // 0 = no cap; default ≤120s
     // Per-system service credentials (token → system name). Parsed as a DOMAIN field (not inline in the return
     // literal) so the bake boot invariant at the assembly layer can assert the runner-credential→runnerPrincipal
     // mapping exists.
@@ -1274,12 +1504,12 @@ function parseOrchestrationDomain(ctx) {
                 provider: "e2b",
                 apiKey: process.env.E2B_API_KEY,
                 ...(process.env.E2B_TEMPLATE ? { template: process.env.E2B_TEMPLATE } : {}),
-                ...(process.env.E2B_TIMEOUT_MS ? { timeoutMs: Number(process.env.E2B_TIMEOUT_MS) } : {}),
+                ...((n) => (n !== undefined ? { timeoutMs: n } : {}))(optNumEnvStrict("E2B_TIMEOUT_MS")), // #210 A 档(见 optNumEnvStrict)
                 // Idle/liveness bound for a command (default 120s, the hang-fix). A long SILENT build —
                 // gradle's first dependency download produces no output for minutes (gate#2 P1 finding) — looks
                 // like a hang and gets killed; raise this for workers that run such tools. Agents should still
                 // prefer background+poll, but this is the operator escape hatch.
-                ...(process.env.E2B_LIVENESS_MS ? { livenessMs: Number(process.env.E2B_LIVENESS_MS) } : {}),
+                ...((n) => (n !== undefined ? { livenessMs: n } : {}))(optNumEnvStrict("E2B_LIVENESS_MS")), // #210 A 档
                 ...(process.env.E2B_ALLOW_NET ? { allowInternetAccess: boolEnv("E2B_ALLOW_NET", true) } : {}),
                 // Out-of-band secret/config env injected sandbox-wide (OA Phase-B, design/48 §5 gap 7):
                 // E2B_SANDBOX_ENV is a CSV of THIS worker's OWN env-var NAMES to forward into the sandbox under the
@@ -1307,7 +1537,7 @@ function parseOrchestrationDomain(ctx) {
                         ...(process.env.K8S_NAMESPACE ? { namespace: process.env.K8S_NAMESPACE } : {}),
                         ...(process.env.K8S_RUNTIME_CLASS != null ? { runtimeClass: process.env.K8S_RUNTIME_CLASS } : {}),
                         ...(process.env.K8S_MOUNT_PATH ? { mountPath: process.env.K8S_MOUNT_PATH } : {}),
-                        ...(process.env.K8S_TIMEOUT_MS ? { timeoutMs: Number(process.env.K8S_TIMEOUT_MS) } : {}),
+                        ...((n) => (n !== undefined ? { timeoutMs: n } : {}))(optNumEnvStrict("K8S_TIMEOUT_MS")), // #210 A 档
                         // Resource profile knob (resources are profile data, not mechanism — center/service
                         // config, never wire-hardcoded). Found live: 25-module gradle integration OOM'd the 2Gi default.
                         ...(process.env.K8S_MEMORY ? { memory: process.env.K8S_MEMORY } : {}),
@@ -1323,7 +1553,7 @@ function parseOrchestrationDomain(ctx) {
                                     secretKey: process.env.MINIO_SECRET_KEY,
                                     ...(process.env.MINIO_REGION ? { region: process.env.MINIO_REGION } : {}),
                                     ...(process.env.WORKSPACE_SNAPSHOT_PREFIX ? { keyPrefix: process.env.WORKSPACE_SNAPSHOT_PREFIX } : {}),
-                                    ...(process.env.WORKSPACE_SNAPSHOT_TTL_SEC ? { presignTtlSec: Number(process.env.WORKSPACE_SNAPSHOT_TTL_SEC) } : {}),
+                                    ...((n) => (n !== undefined ? { presignTtlSec: n } : {}))(optNumEnvStrict("WORKSPACE_SNAPSHOT_TTL_SEC")), // #210 A 档:NaN 会签出 X-Amz-Expires=NaN 的死链
                                 },
                             }
                             : {}),
@@ -1335,7 +1565,7 @@ function parseOrchestrationDomain(ctx) {
                                 host: process.env.SSH_HOST,
                                 username: process.env.SSH_USER,
                                 privateKey: normalizeSshPrivateKey(process.env.SSH_PRIVATE_KEY),
-                                ...(process.env.SSH_PORT ? { port: Number(process.env.SSH_PORT) } : {}),
+                                ...((n) => (n !== undefined ? { port: n } : {}))(optNumEnvStrict("SSH_PORT")), // #210 A 档
                                 ...(process.env.SSH_MOUNT_PATH ? { mountPath: process.env.SSH_MOUNT_PATH } : {}),
                             }
                             : // design/61: ADB → a real device (serial or host:port). adb binary must be on PATH in the image.
@@ -1351,7 +1581,7 @@ function parseOrchestrationDomain(ctx) {
                                             ? {
                                                 provider: "host",
                                                 ...(process.env.HOST_WORKSPACE_BASE ? { workspaceBase: process.env.HOST_WORKSPACE_BASE } : {}),
-                                                ...(process.env.HOST_COMMAND_TIMEOUT_MS ? { commandTimeoutMs: Number(process.env.HOST_COMMAND_TIMEOUT_MS) } : {}),
+                                                ...((n) => (n !== undefined ? { commandTimeoutMs: n } : {}))(optNumEnvStrict("HOST_COMMAND_TIMEOUT_MS")), // #210 A 档
                                             }
                                             : // DUAL-MODE §5: `local-docker` = a per-task container on THIS machine's docker daemon (isolation:true,
                                                 // suspendable:false). DOCKER_IMAGE is REQUIRED — no docker.io default (domestic-images iron rule); a
@@ -1367,7 +1597,7 @@ function parseOrchestrationDomain(ctx) {
                                                         ...(process.env.DOCKER_PATH ? { dockerPath: process.env.DOCKER_PATH } : {}),
                                                         ...(process.env.DOCKER_HOST ? { dockerHost: process.env.DOCKER_HOST } : {}),
                                                         ...(process.env.DOCKER_MEMORY ? { memory: process.env.DOCKER_MEMORY } : {}),
-                                                        ...(process.env.DOCKER_CPUS ? { cpus: Number(process.env.DOCKER_CPUS) } : {}),
+                                                        ...((n) => (n !== undefined ? { cpus: n } : {}))(optNumEnvStrict("DOCKER_CPUS")), // #210 A 档
                                                         // 鲁棒性批5 A1(2026-08-05):此前裸 `Number(process.env.DOCKER_PIDS_LIMIT)`——非数字值(如
                                                         // 手滑的 "512;") → NaN,而消费端(local-docker 执行环境)对 `pidsLimit` 的守卫是
                                                         // `?? 512`(只挡 null/undefined),NaN 穿透守卫;随后 `NaN > 0` 恒假,`--pids-limit` 整个
@@ -1378,7 +1608,7 @@ function parseOrchestrationDomain(ctx) {
                                                         ...(process.env.DOCKER_NETWORK
                                                             ? { network: enumEnv("DOCKER_NETWORK", "bridge", ["none", "bridge", "host"]) }
                                                             : {}),
-                                                        ...(process.env.DOCKER_COMMAND_TIMEOUT_MS ? { commandTimeoutMs: Number(process.env.DOCKER_COMMAND_TIMEOUT_MS) } : {}),
+                                                        ...((n) => (n !== undefined ? { commandTimeoutMs: n } : {}))(optNumEnvStrict("DOCKER_COMMAND_TIMEOUT_MS")), // #210 A 档
                                                         ...(process.env.DOCKER_SANDBOX_ENV ? { env: resolveEnvForward(process.env.DOCKER_SANDBOX_ENV) } : {}),
                                                     }
                                                     : // TOC first-run default: in LOCAL config mode (CONFIG_PROVIDER=local — the
@@ -1416,21 +1646,38 @@ function parseOrchestrationDomain(ctx) {
         selfOrchestrationWorkerIsolation: boolEnv("SELF_ORCHESTRATION_WORKER_ISOLATION", false),
         ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}),
         workflowRunStoreBackend: enumEnv("WORKFLOW_RUN_STORE", "auto", ["auto", "file", "memory"]), // SVC-1 + P1: auto = SQL backend when present (cross-replica), else File
-        workflowOrphanGraceMs: Math.max(60_000, numEnv("WORKFLOW_ORPHAN_GRACE_MS", String(24 * 60 * 60 * 1000))), // SVC-1: 24h default, floor 1m
-        workflowJournalRetentionMs: Math.max(60_000, numEnv("WORKFLOW_JOURNAL_RETENTION_MS", String(7 * 24 * 60 * 60 * 1000))), // SVC-2: 7d default, floor 1m
-        workflowRunRetentionMs: Math.max(60_000, numEnv("WORKFLOW_RUN_RETENTION_MS", String(30 * 24 * 60 * 60 * 1000))), // 30d default, floor 1m; SQL twins only
+        workflowOrphanGraceMs: clampEnvWithWarn("WORKFLOW_ORPHAN_GRACE_MS", String(24 * 60 * 60 * 1000), 60_000), // SVC-1: 24h default, floor 1m(#210 B 档:夹取点名)
+        workflowJournalRetentionMs: clampEnvWithWarn("WORKFLOW_JOURNAL_RETENTION_MS", String(7 * 24 * 60 * 60 * 1000), 60_000), // SVC-2: 7d default, floor 1m
+        workflowRunRetentionMs: clampEnvWithWarn("WORKFLOW_RUN_RETENTION_MS", String(30 * 24 * 60 * 60 * 1000), 60_000), // 30d default, floor 1m; SQL twins only
         ...(usageWindows ? { usageWindows } : {}), // design/166-T1:USAGE_WINDOWS 治理窗(fail-loud 已在 parseUsageWindows)
-        backgroundAgentRetentionMs: Math.max(60_000, numEnv("BG_AGENT_RETENTION_MS", String(7 * 24 * 60 * 60 * 1000))), // core 1.364: 7d default, floor 1m
-        backgroundAgentStaleRunningMs: Math.max(10 * 60_000, numEnv("BG_AGENT_STALE_RUNNING_MS", String(15 * 60_000))), // core 契约 ≥10min 硬钳(60s 写者心跳)
-        backgroundAgentParkClaimStaleMs: Math.max(60_000, numEnv("BG_AGENT_PARK_CLAIM_STALE_MS", String(60 * 60_000))), // [1575] F1 修:default 1h,floor 1m(零/负值都不该让整块清算失活)
-        rosterRetentionMs: Math.max(60_000, numEnv("ROSTER_RETENTION_MS", String(30 * 24 * 60 * 60 * 1000))), // [1522] MED2: 30d default, floor 1m; SQL twins only
+        backgroundAgentRetentionMs: clampEnvWithWarn("BG_AGENT_RETENTION_MS", String(7 * 24 * 60 * 60 * 1000), 60_000), // core 1.364: 7d default, floor 1m
+        backgroundAgentStaleRunningMs: clampEnvWithWarn("BG_AGENT_STALE_RUNNING_MS", String(15 * 60_000), 10 * 60_000), // core 契约 ≥10min 硬钳(60s 写者心跳)
+        backgroundAgentParkClaimStaleMs: clampEnvWithWarn("BG_AGENT_PARK_CLAIM_STALE_MS", String(60 * 60_000), 60_000), // [1575] F1 修:default 1h,floor 1m(零/负值都不该让整块清算失活)
+        rosterRetentionMs: clampEnvWithWarn("ROSTER_RETENTION_MS", String(30 * 24 * 60 * 60 * 1000), 60_000), // [1522] MED2: 30d default, floor 1m; SQL twins only
         // 修8: scratchpad sweep TTL — 0(or negative)= disabled; enabled values floor at 1m (a sub-minute TTL would
         // race in-flight tasks' scratchpad writes for no operational gain).
-        scratchpadSweepTtlMs: ((n) => (n <= 0 ? 0 : Math.max(60_000, n)))(numEnv("SCRATCHPAD_SWEEP_TTL_MS", String(7 * 24 * 60 * 60 * 1000))),
+        // #210 B 档,只对**下限夹取**点名:`≤0 ⇒ 0` 是上面那条设计注写明的「显式关本腿」,是 operator 的
+        // 意图本身,不是夹取,warn 它等于给正常配置刷噪声。
+        scratchpadSweepTtlMs: ((n, raw) => {
+            if (n <= 0)
+                return 0;
+            if (n < 60_000) {
+                // ⚠️ `raw` 记**环境原文**而不是 `String(n)`(codex 自审 R1-F4 真修):`1e3` / `+1000` / 带空白的
+                // ` 1000 ` 归一后都是 "1000",而 operator 要在 env 文件里找的正是他写下的那串字符。
+                CONFIG_WARNINGS.push({ env: "SCRATCHPAD_SWEEP_TTL_MS", raw, used: "60000", kind: "clamped" });
+                return 60_000;
+            }
+            return n;
+        })(numEnv("SCRATCHPAD_SWEEP_TTL_MS", String(7 * 24 * 60 * 60 * 1000)), env("SCRATCHPAD_SWEEP_TTL_MS", String(7 * 24 * 60 * 60 * 1000))),
         // RFC B5 region package-source selector — 🆕 default `global` (clay 拍 2026-07-13 海外为准:官方源 env-first
         // 对存量镜像即生效);国内部署显式 SANDBOX_PKG_SOURCE=cn;`none` = 完全不注入(旧 unset 行为,字节级不变)。
+        // #210 A 档:补闭集。此前**任何**词都原样透传进沙箱注入层——`SANDBOX_PKG_SOURCE=china`(拼错的
+        // `cn`)在国内部署上得到的是「一个认不出的源名」,注入层认不出就什么都不注入 = 静默回到官方源,
+        // 于是每次 pip/npm 都走境外、任务超时,而 operator 明明"配了国内源"。词表与 README 的四词同源。
+        // ⚠️ 不直接用 `enumEnv`:它把空串当一个**值**去比对词表,而这条旋钮改前是 `|| "global"`(空串=未设,
+        // compose 的 `${VAR:-}` 模板天天产空串)。走 `env(name, "global")` 先把空串归一成缺省,再验词表。
         ...(process.env.SANDBOX_PKG_SOURCE !== "none"
-            ? { sandboxPkgSource: process.env.SANDBOX_PKG_SOURCE || "global" }
+            ? { sandboxPkgSource: pkgSourceEnv() }
             : {}),
         sessionAutoTitle: boolEnv("SESSION_AUTO_TITLE", true), // session auto-title: default ON (one cheap call per session)
         selectEnvironmentTool: boolEnv("SELECT_ENVIRONMENT_TOOL", true), // RFC A2: default ON (mount additionally gated on k8s+catalog)
@@ -1445,33 +1692,53 @@ function parseOrchestrationDomain(ctx) {
             registry: process.env.BAKE_IMAGE_REGISTRY || null,
             cacheBase: process.env.BAKE_CACHE_BASE || null,
             defaultBaseRef: process.env.SANDBOX_BASE_REF || null,
-            leaseMs: Math.max(1000, numEnv("BAKE_LEASE_MS", "90000")),
-            staleMs: Math.max(1000, numEnv("BAKE_STALE_MS", "180000")),
-            submitRateMax: Math.max(0, numEnv("BAKE_SUBMIT_RATE_MAX", "10")),
-            submitRateWindowSec: Math.max(1, numEnv("BAKE_SUBMIT_RATE_WINDOW_SEC", "60")),
+            leaseMs: clampEnvWithWarn("BAKE_LEASE_MS", "90000", 1000), // #210 B 档(四条同族)
+            staleMs: clampEnvWithWarn("BAKE_STALE_MS", "180000", 1000),
+            submitRateMax: clampEnvWithWarn("BAKE_SUBMIT_RATE_MAX", "10", 0),
+            submitRateWindowSec: clampEnvWithWarn("BAKE_SUBMIT_RATE_WINDOW_SEC", "60", 1),
         },
     };
 }
 /** 域:limits+http(限额与 HTTP 面)—— 端口、附件/工作区体积与 TTL、成本与速率天花板、排空窗、回收周期。 */
 function parseLimitsHttpDomain() {
     return {
-        port: Number(env("PORT", "8090")),
+        // #210 A 档:裸 Number ⇒ NaN 直进 `server.listen(NaN)`(Node 当成 0 = 随机端口),于是服务起来了、
+        // 健康检查在**另一个**端口上、注册进 fleet 的地址是错的,全程零告警。[0,65535] 里 0 是合法的
+        // 「随机端口」(测试在用),不收窄。
+        port: numEnvBounded("PORT", "8090", 0, 65535),
         // D-1 孤儿对象 GC grace(复审 F10;0=关掉本腿,负/坏值走默认)。
-        attachmentOrphanGraceMs: ((v) => (v !== undefined && Number.isFinite(v) && v >= 0 ? v : 3_600_000))(process.env.ATTACHMENT_ORPHAN_GRACE_MS !== undefined ? Number(process.env.ATTACHMENT_ORPHAN_GRACE_MS) : undefined),
+        // #210 C 档(不升拒的理由写在这里,不是复述行为):这条旋钮的坏值后果**轻**——回落到 1h 宽限,方向
+        // 是「更晚回收」,不删多余的东西,不打开任何门;而它落在 D-1 附件面这种存量部署普遍设过的位置上,
+        // 拒启的破坏面明显大于收益。所以保留回默认,补 CONFIG_WARNINGS 点名(原值 + 采用值),让 operator
+        // 排空日志时看得见。`0` 是文档化的「关本腿」,合法且零 warn。
+        attachmentOrphanGraceMs: ((raw) => {
+            // ⚠️ 只把 `undefined` 当未设(**不是** `undefined || ""`):改前的判据是 `!== undefined` + `Number("")`
+            // = 0 = 「关本腿」,空串在这条上是一个**已生效的合法值**。加上一条空串归一化会静默把一台已经关了
+            // 孤儿清扫的部署改成 1h 宽限 —— 律条治的是坏值静默,不是顺手改既有语义。
+            if (raw === undefined)
+                return 3_600_000;
+            const v = Number(raw);
+            if (Number.isFinite(v) && v >= 0)
+                return v;
+            CONFIG_WARNINGS.push({ env: "ATTACHMENT_ORPHAN_GRACE_MS", raw, used: "3600000", kind: "invalid-default" });
+            return 3_600_000;
+        })(process.env.ATTACHMENT_ORPHAN_GRACE_MS),
         // workspace 浏览面(#3,[1894]①)单文件读上限。
         workspaceFileMaxBytes: optFinitePositiveEnv("WORKSPACE_FILE_MAX_BYTES") ?? 8 * 1024 * 1024,
-        attachmentMaxBytes: Math.max(1024, numEnv("ATTACHMENT_MAX_BYTES", String(32 * 1024 * 1024))),
+        attachmentMaxBytes: clampEnvWithWarn("ATTACHMENT_MAX_BYTES", String(32 * 1024 * 1024), 1024), // #210 B 档
         ...(process.env.ATTACHMENT_MIME_ALLOWLIST
             ? { attachmentMimeAllowlist: process.env.ATTACHMENT_MIME_ALLOWLIST.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean) }
             : {}),
-        attachmentUnboundTtlMs: Math.max(60_000, numEnv("ATTACHMENT_UNBOUND_TTL_MS", String(24 * 3600 * 1000))),
+        attachmentUnboundTtlMs: clampEnvWithWarn("ATTACHMENT_UNBOUND_TTL_MS", String(24 * 3600 * 1000), 60_000), // #210 B 档
         infraCostRates: {
-            toolCallMicroUsd: Math.max(0, numEnv("INFRA_COST_TOOL_CALL", "0")),
-            sandboxSecMicroUsd: Math.max(0, numEnv("INFRA_COST_SANDBOX_SEC", "0")),
-            egressGbMicroUsd: Math.max(0, numEnv("INFRA_COST_EGRESS_GB", "0")),
+            // #210 B 档:负单价夹到 0 是对的(负成本会让账面倒扣),但夹取必须点名——不然 operator 只看到
+            // 基建成本恒 0,查不到是自己那个负号被吃掉了。
+            toolCallMicroUsd: clampEnvWithWarn("INFRA_COST_TOOL_CALL", "0", 0),
+            sandboxSecMicroUsd: clampEnvWithWarn("INFRA_COST_SANDBOX_SEC", "0", 0),
+            egressGbMicroUsd: clampEnvWithWarn("INFRA_COST_EGRESS_GB", "0", 0),
         },
-        drainGraceMs: Math.max(10_000, numEnv("DRAIN_GRACE_MS", String(10 * 60 * 1000))), // SIGTERM drain window, default 10min, floor 10s
-        sighupIdleGraceMs: Math.max(5_000, numEnv("SIGHUP_IDLE_GRACE_MS", String(120_000))), // B3: SIGHUP idle-shutdown window, default 2min, floor 5s
+        drainGraceMs: clampEnvWithWarn("DRAIN_GRACE_MS", String(10 * 60 * 1000), 10_000), // SIGTERM drain window, default 10min, floor 10s(#210 B 档:把 600 当成"秒"填进来的手滑最常见,夹取后必须点名)
+        sighupIdleGraceMs: clampEnvWithWarn("SIGHUP_IDLE_GRACE_MS", String(120_000), 5_000), // B3: SIGHUP idle-shutdown window, default 2min, floor 5s
         // BL-9: numEnv (not bare Number) — a non-numeric typo FAILS at startup instead of becoming NaN, which would
         // silently DISABLE the operator cost/rate ceiling (every `> ceiling` comparison against NaN is false).
         rateLimitPerMin: numEnv("RATE_LIMIT_RPM", "0"),
@@ -1495,7 +1762,9 @@ function parseObservabilityDomain() {
         otel: process.env.OTEL_EXPORTER_OTLP_ENDPOINT
             ? {
                 endpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT.replace(/\/$/, ""),
-                intervalMs: Number(env("OTEL_EXPORT_INTERVAL_MS", "15000")),
+                // #210 A 档:NaN 周期进 setInterval ⇒ Node 归一成 1ms,出口从「每 15s 一批」变成**每毫秒**一批
+                // (打满 collector 且把本进程 CPU 吃光),而这是一条运维为了"看见"才配的旋钮。
+                intervalMs: numEnv("OTEL_EXPORT_INTERVAL_MS", "15000"),
                 serviceName: env("OTEL_SERVICE_NAME", "sema-server"),
                 // `OTEL_EXPORTER_OTLP_HEADERS` = comma-separated `k=v` pairs (e.g. an auth header).
                 headers: Object.fromEntries(csv("OTEL_EXPORTER_OTLP_HEADERS").map((kv) => {
@@ -1547,7 +1816,7 @@ function parseIntegrationsDomain() {
     return {
         // plugins 域 clone host 白名单(契约 [1361]①;缺省 github.com,逗号扩 https 镜像域)。
         pluginsAllowHosts: (process.env.PLUGINS_ALLOW_HOSTS ?? "github.com").split(",").map((h) => h.trim()).filter(Boolean),
-        configBootFetchBudgetMs: Math.max(0, numEnv("CONFIG_BOOT_FETCH_BUDGET_MS", "1500")), // boot 首拉抢答窗;过窗转后台补齐(clay 2026-07-17:本地 5s 启动=黑洞中心同步等待)
+        configBootFetchBudgetMs: clampEnvWithWarn("CONFIG_BOOT_FETCH_BUDGET_MS", "1500", 0), // boot 首拉抢答窗;过窗转后台补齐(clay 2026-07-17:本地 5s 启动=黑洞中心同步等待)。#210 B 档
         gitApiBaseUrl: process.env.GIT_API_BASEURL,
         gitApiToken: process.env.GIT_API_TOKEN,
         gitApiKind: parseGitApiKind(process.env.GIT_API_KIND, process.env.GIT_API_BASEURL),
@@ -1582,7 +1851,7 @@ const MODEL_PLANE_GROUP_KEYS = [
 const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
     "approvalHmacKeys", "durableApproval", "directApprovalDoor", "directDoorActive", "resourceSuspend",
-    "resourceSuspendTtlSec", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "streamAskWindowMarginMs", "streamApproval", "mcpElicitation",
+    "resourceSuspendTtlSec", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "mcpElicitation",
     "sensitiveWritePatterns", "manualModeShellGate",
 ];
 const MEMORY_GROUP_KEYS = [