@sema-agent/server 7.112.0 → 7.114.0

package/dist/config-invariants.js

@@ -3,7 +3,7 @@ import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { defaultModelRefusal, refusedNameMintedRefusal } from "./model-entry-refusal.js";
-import { executionLaneCaps, executionLaneOf, laneCapabilityHolds, REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
+import { executionLaneCaps, executionLaneOf, executionLaneRequiredRefusal, laneCapabilityHolds, REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
 export const LIVENESS_HEARTBEAT_MS = 30_000;
 const anyServiceAuth = (v) => Boolean(v.authToken) || Object.keys(v.authTokens ?? {}).length > 0;
 const mustNarrowBind = (v) => Boolean(v.allowUnauthedWrites) && !anyServiceAuth(v);
@@ -16,6 +16,51 @@ function multiTenantSharedLaneRefusal(v) {
     return (`REQUIRE_PRINCIPAL=true (multi-tenant posture) with the "${lane}" execution lane runs every tenant's Bash on one shared target — ` +
         `this lane does not separate tenants; set REMOTE_EXEC to ${outlets.join(" / ")}, or unset REQUIRE_PRINCIPAL for a single-user box`);
 }
+export function halfOpenDirectDoorRefusal(v) {
+    if (!v.directApprovalDoor)
+        return undefined;
+    const missing = [];
+    if (!v.durableApproval)
+        missing.push("DURABLE_APPROVAL=true (the direct door's crypto gate only exists on the durable /decide path)");
+    if (v.approvalHmacKeys.length === 0)
+        missing.push("APPROVAL_HMAC_KEYS");
+    if (v.principalJwtPubkeys.length === 0)
+        missing.push("PRINCIPAL_JWT_PUBKEYS");
+    if (!v.principalJwtIss)
+        missing.push("PRINCIPAL_JWT_ISS");
+    if (!v.principalJwtAud)
+        missing.push("PRINCIPAL_JWT_AUD");
+    if (v.operatorPrincipals.length === 0)
+        missing.push("OPERATOR_PRINCIPALS (else isOperator is true-for-all)");
+    if (!v.requirePrincipal)
+        missing.push("REQUIRE_PRINCIPAL=true (a direct door is multi-tenant; without it an absent principal is anonymous and the self-asserted header governs owner/quota checks)");
+    return missing.length > 0 ? `DIRECT_APPROVAL_DOOR=true but D-G anchors are missing: ${missing.join(", ")} — refusing to start a half-open direct door (design/80 D-G boot invariant)` : undefined;
+}
+export function operatorPrincipalsRequiredRefusal(v) {
+    return v.durableApproval === true && v.requirePrincipal && v.operatorPrincipals.length === 0
+        ? "DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true but OPERATOR_PRINCIPALS is empty — on a multi-tenant worker the empty operator set makes isOperator() true-for-all, so every authenticated tenant could read every other tenant's pending-approval queue (GET /v1/approvals & siblings). Set OPERATOR_PRINCIPALS, or unset REQUIRE_PRINCIPAL if this is a single-tenant deployment (#157-① boot invariant)"
+        : undefined;
+}
+export function bakeOperatorPrincipalsRefusal(v) {
+    return v.imageBakes.enabled && v.operatorPrincipals.length === 0
+        ? "IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host; an empty operator set makes isOperator() true-for-all (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)"
+        : undefined;
+}
+export function bakeRunnerCredentialRefusal(v) {
+    const runner = v.imageBakes.runnerPrincipal;
+    return v.imageBakes.enabled && !Object.values(v.authTokens ?? {}).includes(runner)
+        ? `IMAGE_BAKES_ENABLED=true but no SERVICE_AUTH_TOKENS entry maps to the runner principal '${runner}' — the bake-runner authenticates by its credential (token-derived source), so a '<BAKE_RUNNER_TOKEN>=${runner}' SERVICE_AUTH_TOKENS entry is required or claim/ingest/heartbeat all 403 (IMAGE-API-DESIGN.md §P2.12 boot invariant)`
+        : undefined;
+}
+export function leaderDurableStoreRefusal(v) {
+    return v.leaderEnabled && v.dbBackend !== "mysql" && v.dbBackend !== "pg"
+        ? `LEADER_ENABLED=true but DB_BACKEND=${v.dbBackend} (no external SQL store) is refused: a leader run is an ` +
+            "N-worker fan-out lasting up to 24h that ends in a REAL git push, and without a durable store its registry is " +
+            "a per-process Map — a cross-replica GET 404s, a restart forgets the run, and a retried POST starts a SECOND " +
+            "push. Point the service at a durable store (DB_BACKEND=mysql|pg), or turn the leader off (unset LEADER_ENABLED) " +
+            "(#193 车4 件2 / staleness ledger P1-9+P1-10 boot invariant)"
+        : undefined;
+}
 export const CONFIG_CROSS_INVARIANTS = [
     {
         id: "run-stale-heartbeat",
@@ -39,57 +84,31 @@ export const CONFIG_CROSS_INVARIANTS = [
         keys: ["imageBakes", "authTokens"],
         restartReason: "bake-runner-credential",
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:bake-runner-credential" },
-        check: ({ next }) => next.imageBakes.enabled && !Object.values(next.authTokens ?? {}).includes(next.imageBakes.runnerPrincipal)
-            ? `IMAGE_BAKES_ENABLED is on but no SERVICE_AUTH_TOKENS entry maps to the runner principal '${next.imageBakes.runnerPrincipal}' — claim/ingest/heartbeat would all 403`
-            : undefined,
+        check: ({ next }) => bakeRunnerCredentialRefusal(next),
     },
     {
         id: "direct-door-anchors",
         keys: ["directApprovalDoor", "durableApproval", "approvalHmacKeys", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud", "requirePrincipal", "operatorPrincipals"],
         restartReason: "direct-door",
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:direct-door-anchors" },
-        check: ({ live, next }) => {
-            if (next.directApprovalDoor) {
-                const missing = [];
-                if (!next.durableApproval)
-                    missing.push("DURABLE_APPROVAL");
-                if (next.approvalHmacKeys.length === 0)
-                    missing.push("APPROVAL_HMAC_KEYS");
-                if (next.principalJwtPubkeys.length === 0)
-                    missing.push("PRINCIPAL_JWT_PUBKEYS");
-                if (!next.principalJwtIss)
-                    missing.push("PRINCIPAL_JWT_ISS");
-                if (!next.principalJwtAud)
-                    missing.push("PRINCIPAL_JWT_AUD");
-                if (next.operatorPrincipals.length === 0)
-                    missing.push("OPERATOR_PRINCIPALS");
-                if (!next.requirePrincipal)
-                    missing.push("REQUIRE_PRINCIPAL");
-                if (missing.length > 0)
-                    return `a half-open direct approval door is refused: missing ${missing.join(", ")}`;
-            }
-            return directDoorConjuncts(live) !== directDoorConjuncts(next)
+        check: ({ live, next }) => halfOpenDirectDoorRefusal(next) ??
+            (directDoorConjuncts(live) !== directDoorConjuncts(next)
                 ? "the direct-door posture (its conjunction of approval/JWT anchors) is decided at boot — refusing to hot-flip it (restart to change the door)"
-                : undefined;
-        },
+                : undefined),
     },
     {
         id: "operator-principals-required",
         keys: ["durableApproval", "requirePrincipal", "operatorPrincipals"],
         restartReason: "operator-principals",
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:operator-principals-required" },
-        check: ({ next }) => next.durableApproval === true && next.requirePrincipal && next.operatorPrincipals.length === 0
-            ? "DURABLE_APPROVAL + REQUIRE_PRINCIPAL with an EMPTY OPERATOR_PRINCIPALS makes isOperator() true-for-all — every authenticated tenant could read every other tenant's pending-approval queue"
-            : undefined,
+        check: ({ next }) => operatorPrincipalsRequiredRefusal(next),
     },
     {
         id: "bake-operator-principals",
         keys: ["imageBakes", "operatorPrincipals"],
         restartReason: "operator-principals",
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:bake-operator-principals" },
-        check: ({ next }) => next.imageBakes.enabled && next.operatorPrincipals.length === 0
-            ? "IMAGE_BAKES_ENABLED with an EMPTY OPERATOR_PRINCIPALS is a world-writable bake door (the runner runs build.sh on the privileged build host)"
-            : undefined,
+        check: ({ next }) => bakeOperatorPrincipalsRefusal(next),
     },
     {
         id: "sensitive-write-patterns",
@@ -111,9 +130,7 @@ export const CONFIG_CROSS_INVARIANTS = [
         keys: ["requireExecutionLane", "remoteExec"],
         restartReason: "execution-lane",
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:require-execution-lane" },
-        check: ({ next }) => next.requireExecutionLane && next.remoteExec === undefined
-            ? "REQUIRE_EXECUTION_LANE=true with no execution lane named (REMOTE_EXEC unset/empty and CONFIG_PROVIDER not \"local\") — the deployment asked to refuse this state"
-            : undefined,
+        check: ({ next }) => executionLaneRequiredRefusal(next),
     },
     {
         id: "leader-host-lane",
@@ -142,9 +159,7 @@ export const CONFIG_CROSS_INVARIANTS = [
         keys: ["leaderEnabled", "dbBackend"],
         restartReason: "leader-lane",
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:leader-durable-store" },
-        check: ({ next }) => next.leaderEnabled && next.dbBackend !== "mysql" && next.dbBackend !== "pg"
-            ? `LEADER_ENABLED with DB_BACKEND=${next.dbBackend} (no external SQL store) degrades the leader-run registry to a per-process Map`
-            : undefined,
+        check: ({ next }) => leaderDurableStoreRefusal(next),
     },
     {
         id: "device-durable-store",

package/dist/config-types.d.ts

@@ -18,6 +18,7 @@ import type { InfraCostRates } from "./observability/cost-taxonomy.js";
 import type { Autonomy, CommandRule } from "./runtime-governance.js";
 import type { CenterCredentialSource } from "./center-credential.js";
 import type { GitApiKind } from "./git-api-kind.js";
+import type { MemoryEngineBackend, StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
 import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
 /** [ref]:记忆向量面的 embedder 坐标(env `MEMORY_EMBEDDER_*` 解析结果;单一属主 = 本类型,
  *  `plugins/memory-embedder.ts` 的工厂直接消费它,不复制形状)。语义与三问见
@@ -54,13 +55,6 @@ export type RetentionMode = (typeof RETENTION_MODES)[number];
  */
 export declare const CONFIG_PROVIDER_WORDS: readonly ["local", "remote"];
 export type ConfigProviderWord = (typeof CONFIG_PROVIDER_WORDS)[number];
-/**
- * S-866 ① —— `DB_BACKEND` 的闭集词表(**一处**:`config.ts` 的枚举解析、配置目录的 enum 行、caps `store.declared` / `store.backend`
- * 三处共读;S-2 设计稿 v1 写的契约包 `STORE_ENGINES` 不存在,搬进契约包是 [ref] A-5 的另票)。`mysql` = 任一 MySQL 协议服务器
- * (MySQL / TiDB / MariaDB);`local` = 本机文件店;`memory` = 纯内存(显式 opt-out,或多租裸 boot 的缺省)。
- */
-export declare const DB_BACKEND_WORDS: readonly ["mysql", "pg", "local", "memory"];
-export type DbBackendWord = (typeof DB_BACKEND_WORDS)[number];
 /** [ref] §3/§4 —— sweep lane 的节律与灰度档(语义与三问见 {@link ServiceConfigFlat.retentionSweep})。 */
 export interface RetentionSweepConfig {
     /** `audit-only` = 照跑照判、只记 `audit_only` 行,**不调任何破坏性方法**;`enforce` = 真删。默认前者。 */
@@ -702,7 +696,7 @@ export interface ServiceConfigFlat {
      *     pg 部署的检索**恒 lexical**(词面 jaccard),向量列空转。配上这几键 = 该部署真正拿到语义检索。
      *  ② **半配为何拒启**:三键里少任何一件,「向量面」都无从组装。静默忽略的后果不是功能缺席,而是
      *     **operator 以为开了**——检索照常返回结果(词面档),质量差异只在最终答案里,任何日志都不报。
-     *     所以照 `MEMORY_SYNC_*` / `REQUIRED_ENVS_BY_LANE` 的同款姿势整拒并点名缺哪几键。
+     *     所以照 `MEMORY_SYNC_*` / [ref] 车道必需键(`laneRequiredEnv`)的同款姿势整拒并点名缺哪几键。
      *  ③ **维度守卫为何是拒启不是 warn**:向量列写错维度是**静默毒库**形([ref] 裁③)——错长度的向量
      *     既不会让 DB 报错(本仓 pg 记忆表的 embedding 是 `jsonb`,无维度约束),也不会让检索报错(维度
      *     不匹配的行只是悄悄退回词面档),只会让「向量面开着」这句话变成谎。所以坏 DIM(非正整数)在
@@ -1003,7 +997,7 @@ export interface ServiceConfigFlat {
      *  MYSQL_* replacement named (see RETIRED_ENVS in config.ts). `mysql` reads MYSQL_* coords only.
      *  TiDB itself stays fully supported (any MySQL-protocol engine works — memory no longer needs a VECTOR
      *  column since [ref] moved it onto the file engine). Env: DB_BACKEND. */
-    dbBackend: DbBackendWord;
+    dbBackend: StoreBackendWord;
     /** clay 拍(2026-07-27):operator 是否显式设了 DB_BACKEND。main.ts 的降级判据——**默认推导**的
      *  local(裸 boot)在 mkdir/ensure 失败时降级 memory + warn + gauge(auto-DB 不可达先例);
      *  **显式** DB_BACKEND=local 失败仍 fail-loud(operator 要了 durable,静默丢=丢数据)。 */
@@ -1884,7 +1878,7 @@ export interface ServiceConfigFlat {
      * 结束等待的确实是本仓的窗;其余三臂结束等待的是容量/连接/装配,自报恒缺席。
      *
      * 🔴 **`deny` 交给引擎的形(S-689)**:部署政策拒对象臂 `{allow:false, settledBy:"policy", reason}` ⇒ 引擎结算
-     * `policy_refused`(`who.party:"none"`)、模型读策略句(「部署政策拒了、此处没有交互审批,别重试、做不需审批的
+     * `policy_refused`(`who.party:"policy"` —— core 7.39.0 #1265 起;此前 `"none"`)、模型读策略句(「部署政策拒了、此处没有交互审批,别重试、做不需审批的
      * 部分」)、run 不以「用户拒绝」收束而是继续。修前是裸 `false` —— 引擎契约里那就是「一个人拒了」
      * (`human_refused` / `haltedOnUserRejection`),与本键「没有人会来」的自声明正好相反。(b)(c) 两臂照旧带
      * `"timeout"` 自报(`approval_window_expired`)。
@@ -2053,7 +2047,7 @@ export interface ServiceConfigFlat {
      *  404 there (P1-2: our own repos live on GitHub and were unreviewable). Unknown word = refuse boot. */
     gitApiKind: GitApiKind;
     /** S3-TOB 设计 §1.3:memory 持久面方言(env MEMORY_ENGINE_BACKEND,缺省 file)。boot-only。 */
-    memoryEngineBackend: "file" | "pg" | "tidb";
+    memoryEngineBackend: MemoryEngineBackend;
     /** CC `workflowSizeGuideline` (advisory, injected into the Workflow tool card via
      *  core `RunnerDeps.workflowLimits.sizeGuideline`). env WORKFLOW_SIZE_GUIDELINE; unset = absent =
      *  byte-compat (core treats missing/unrestricted identically). boot-only (per-task card snapshot). */

package/dist/config-types.js

@@ -2,7 +2,6 @@ import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
 export const TASK_WRITE_FACE_ESCALATIONS = ["allow", "refuse"];
 export const RETENTION_MODES = ["audit-only", "enforce"];
 export const CONFIG_PROVIDER_WORDS = ["local", "remote"];
-export const DB_BACKEND_WORDS = ["mysql", "pg", "local", "memory"];
 export const MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC = 300;
 export const MAX_TIMER_DELAY_MS = 2_147_483_647;
 export const AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS = { minMs: 1_000, maxMs: MAX_TIMER_DELAY_MS };

package/dist/config.d.ts

@@ -1,5 +1,4 @@
 import { type Model, type PathRuleBases, type RuleBehavior } from "@sema-agent/core";
-import { type RemoteExecProvider } from "./execution-lane-caps.js";
 import { type Autonomy } from "./runtime-governance.js";
 import { type RunnerEnvNameAllowlistKnob, type ServerEnvNameAllowlistKnob } from "./env-name-allowlist-knobs.js";
 import type { ServiceConfig, ServiceConfigFlat, ServiceConfigGroups } from "./config-types.js";
@@ -252,21 +251,6 @@ export declare const configLkgEnabled: () => boolean;
 export declare const hostBackgroundShellEnabled: () => boolean;
 /** The `host` exec lane's spool-file stdio form; false ⇒ the pre-1.226 pipe fallback (read per exec). */
 export declare const hostExecSpoolEnabled: () => boolean;
-/**
- * 每条执行车道**必需的 env 键名**([ref] 的 fail-closed 拒启门按它点名缺件;见 `parseOrchestrationDomain`
- * 里那处 `REMOTE_EXEC` 校验)。
- *
- * 键集 = `RemoteExecProvider`(判别联合派生,`execution-lane-caps.ts`):配置面加一条 provider 臂而
- * 这里不加行 = **编译红**(codex R1-F2)。此前是 `Record<string, …>`,漏一行只表现为该词在 boot 期被判
- * 「不是执行车道」—— fail-closed 但把「新车道」讲成「拼错了」,运维照着报文永远查不到成因。
- *
- * 🔴 **S-599:提到模块顶层导出**(此前是 `parseOrchestrationDomain` 的函数内局部)。零语义变,动机是
- * 部署面需要**同一张表**:`deploy/sema-up/lib/lanes.json` 的每行必须登记它那条车道的必需键名,根 /
- * review compose 的 environment 白名单必须把**全部**车道的必需键透传出去 —— 那两处若各手抄一份名单,
- * 加一条车道就会静默分叉(选得到、起不来,而 config 的拒启报文里那个键在 compose 里根本不存在)。
- * 门 = `test/deploy-lanes-contract.test.ts`,它读的是本表而不是任何副本。
- */
-export declare const REQUIRED_ENVS_BY_LANE: Record<RemoteExecProvider, readonly string[]>;
 /** 名单型 env 旋钮的**唯一**解析器(规则全文见上方 `ENV_NAME_ALLOWLIST_KNOBS` 头注)。`undefined` = 没配(未设 / 空串)。
  *  服务侧旋钮要交本进程的姿态(③);runner 旋钮没有姿态,签名上就不收 —— 读者与行形由叶表的类型一起定,传错是编译红。 */
 export declare function parseEnvNameAllowlist(knob: ServerEnvNameAllowlistKnob, singleUserTurnkey: boolean): readonly string[] | undefined;

package/dist/config.js

@@ -10,14 +10,17 @@ import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { isV2ScopeKey, memoryReplicationCoverage, replicationCovers } from "./memory-scope.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
-import { CONFIG_PROVIDER_WORDS, DB_BACKEND_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS } from "./config-types.js";
+import { CONFIG_PROVIDER_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS } from "./config-types.js";
+import { resolveLocalDataRoot } from "./local-data-root.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
 import { buildReadFacePostureNotice, readFaceForPosture } from "./read-face-posture.js";
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
-import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, isSingleMachineDefaultLane } from "./execution-lane-caps.js";
+import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
+import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
+import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
@@ -483,15 +486,6 @@ function boolEnv(name, def) {
 export const configLkgEnabled = () => boolEnv("CONFIG_LKG_ENABLED", true);
 export const hostBackgroundShellEnabled = () => boolEnv("HOST_BG_ENABLED", true);
 export const hostExecSpoolEnabled = () => boolEnv("HOST_EXEC_SPOOL_ENABLED", true);
-export const REQUIRED_ENVS_BY_LANE = {
-    e2b: ["E2B_API_KEY"],
-    k8s: ["K8S_SANDBOX_IMAGE"],
-    ssh: ["SSH_HOST", "SSH_USER", "SSH_PRIVATE_KEY"],
-    adb: ["ADB_SERIAL"],
-    host: [],
-    "local-docker": ["DOCKER_IMAGE"],
-    device: [],
-};
 function parseReadDenyPatternsEnv(raw) {
     let arr;
     try {
@@ -861,7 +855,7 @@ function parseStoreDomain(ctx) {
         !!(process.env.MYSQL_HOST || process.env.PG_HOST);
     const bareBoot = !dbBackendSet && !sqlSignal;
     const multiTenantBareBoot = bareBoot && requirePrincipal;
-    const dbBackend = enumEnv("DB_BACKEND", bareBoot ? (multiTenantBareBoot ? "memory" : "local") : "mysql", DB_BACKEND_WORDS);
+    const dbBackend = enumEnv("DB_BACKEND", bareBoot ? (multiTenantBareBoot ? "memory" : "local") : "mysql", STORE_BACKENDS);
     if (multiTenantBareBoot) {
         CONFIG_NOTICES.push({
             level: "warn",
@@ -872,9 +866,9 @@ function parseStoreDomain(ctx) {
         });
     }
     const sqlEngineExplicit = !!process.env.DB_BACKEND && dbBackend !== "local" && dbBackend !== "memory";
-    const sessionBackendRaw = enumEnv("SESSION_BACKEND", sqlEngineExplicit ? "mysql" : "memory", ["memory", "mysql", "auto"]);
+    const sessionBackendRaw = enumEnv("SESSION_BACKEND", sqlEngineExplicit ? "mysql" : "memory", SESSION_BACKENDS);
     const sessionBackend = sessionBackendRaw === "mysql" ? "tidb" : sessionBackendRaw;
-    const localDataRoot = process.env.LOCAL_DATA_ROOT || process.env.CONFIG_LOCAL_DIR || process.env.AGENT_DATA_DIR || join(homedir(), ".ai-agent");
+    const localDataRoot = resolveLocalDataRoot(process.env, homedir());
     const dbHostSet = dbBackend === "pg" ? !!process.env.PG_HOST : !!process.env.MYSQL_HOST;
     const needsTidb = sessionBackend === "tidb" || (sessionBackend === "auto" && dbHostSet);
     const needsDb = needsTidb;
@@ -1644,11 +1638,7 @@ function parseMemoryConsolidationDriver() {
 function parseMemoryDomain(ctx) {
     const { requirePrincipal } = ctx;
     const memoryEngineEnabled = parseMemoryEngineWord(env("MEMORY_ENGINE", "on"));
-    const memoryEngineBackendRaw = process.env.MEMORY_ENGINE_BACKEND ?? "file";
-    if (!["file", "pg", "tidb"].includes(memoryEngineBackendRaw)) {
-        throw new Error(`MEMORY_ENGINE_BACKEND must be file|pg|tidb, got "${memoryEngineBackendRaw}"`);
-    }
-    const memoryEngineBackend = memoryEngineBackendRaw;
+    const memoryEngineBackend = enumEnv("MEMORY_ENGINE_BACKEND", "file", MEMORY_ENGINE_BACKENDS);
     const memoryScope = process.env.MEMORY_SCOPE ?? (memoryEngineEnabled && !requirePrincipal ? "local" : undefined);
     const memorySyncUrl = process.env.MEMORY_SYNC_URL || undefined;
     const memorySyncToken = process.env.MEMORY_SYNC_TOKEN || undefined;
@@ -1864,12 +1854,12 @@ function parseOrchestrationDomain(ctx) {
     {
         const lane = process.env.REMOTE_EXEC;
         if (lane !== undefined && lane !== "") {
-            const required = Object.entries(REQUIRED_ENVS_BY_LANE).find(([word]) => word === lane)?.[1];
-            if (required === undefined) {
-                throw new Error(`REMOTE_EXEC="${lane}" is not an execution lane — valid: ${Object.keys(REQUIRED_ENVS_BY_LANE).join(" | ")}. ` +
+            const word = REMOTE_EXEC_PROVIDER_WORDS.find((w) => w === lane);
+            if (word === undefined) {
+                throw new Error(`REMOTE_EXEC="${lane}" is not an execution lane — valid: ${REMOTE_EXEC_PROVIDER_WORDS.join(" | ")}. ` +
                     `An unrecognized value used to fall through to the host/in-process lane silently; refusing to start instead (#157).`);
             }
-            const missing = required.filter((name) => !process.env[name]);
+            const missing = laneRequiredEnv(word).filter((name) => !process.env[name]);
             if (missing.length > 0) {
                 throw new Error(`REMOTE_EXEC=${lane} but required env ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} missing/empty — ` +
                     `refusing to start rather than silently downgrading to the host/in-process lane (#157; unset REMOTE_EXEC if you meant no sandbox lane).`);
@@ -2406,54 +2396,39 @@ export function loadConfig() {
     const integrations = parseIntegrationsDomain({ requirePrincipal, configProvider });
     const { directApprovalDoor, durableApproval: dgDurable, approvalHmacKeys: dgHmacKeys } = approval;
     const { principalJwtPubkeys, principalJwtIss, principalJwtAud, operatorPrincipals: dgOperators, authTokens } = auth;
-    const { enabled: imageBakesEnabled, runnerPrincipal: bakeRunnerPrincipal } = orchestration.imageBakes;
     const directDoorActive = directApprovalDoor && dgDurable && dgHmacKeys.length > 0 && principalJwtPubkeys.length > 0 && !!principalJwtIss && !!principalJwtAud;
-    if (directApprovalDoor) {
-        const missing = [];
-        if (!dgDurable)
-            missing.push("DURABLE_APPROVAL=true (the direct door's crypto gate only exists on the durable /decide path)");
-        if (dgHmacKeys.length === 0)
-            missing.push("APPROVAL_HMAC_KEYS");
-        if (principalJwtPubkeys.length === 0)
-            missing.push("PRINCIPAL_JWT_PUBKEYS");
-        if (!principalJwtIss)
-            missing.push("PRINCIPAL_JWT_ISS");
-        if (!principalJwtAud)
-            missing.push("PRINCIPAL_JWT_AUD");
-        if (dgOperators.length === 0)
-            missing.push("OPERATOR_PRINCIPALS (else isOperator is true-for-all)");
-        if (!requirePrincipal)
-            missing.push("REQUIRE_PRINCIPAL=true (a direct door is multi-tenant; without it an absent principal is anonymous and the self-asserted header governs owner/quota checks)");
-        if (missing.length) {
-            throw new Error(`DIRECT_APPROVAL_DOOR=true but D-G anchors are missing: ${missing.join(", ")} — refusing to start a half-open direct door (design/80 D-G boot invariant)`);
-        }
+    const doorRefusal = halfOpenDirectDoorRefusal({
+        directApprovalDoor,
+        durableApproval: dgDurable,
+        approvalHmacKeys: dgHmacKeys,
+        principalJwtPubkeys,
+        principalJwtIss,
+        principalJwtAud,
+        requirePrincipal,
+        operatorPrincipals: dgOperators,
+    });
+    if (doorRefusal !== undefined) {
+        throw new Error(doorRefusal);
+    }
+    const operatorsRefusal = operatorPrincipalsRequiredRefusal({ durableApproval: dgDurable, requirePrincipal, operatorPrincipals: dgOperators });
+    if (operatorsRefusal !== undefined) {
+        throw new Error(operatorsRefusal);
+    }
+    const bakeOperatorsRefusal = bakeOperatorPrincipalsRefusal({ imageBakes: orchestration.imageBakes, operatorPrincipals: dgOperators });
+    if (bakeOperatorsRefusal !== undefined) {
+        throw new Error(bakeOperatorsRefusal);
+    }
+    const bakeRunnerRefusal = bakeRunnerCredentialRefusal({ imageBakes: orchestration.imageBakes, authTokens });
+    if (bakeRunnerRefusal !== undefined) {
+        throw new Error(bakeRunnerRefusal);
+    }
+    const leaderStoreRefusal = leaderDurableStoreRefusal({ leaderEnabled: orchestration.leaderEnabled, dbBackend: store.dbBackend });
+    if (leaderStoreRefusal !== undefined) {
+        throw new Error(leaderStoreRefusal);
     }
-    if (dgDurable && requirePrincipal && dgOperators.length === 0) {
-        throw new Error("DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true but OPERATOR_PRINCIPALS is empty — on a multi-tenant worker the empty operator set makes isOperator() true-for-all, so every authenticated tenant could read every other tenant's pending-approval queue (GET /v1/approvals & siblings). Set OPERATOR_PRINCIPALS, or unset REQUIRE_PRINCIPAL if this is a single-tenant deployment (#157-① boot invariant)");
-    }
-    if (imageBakesEnabled && dgOperators.length === 0) {
-        throw new Error("IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host; an empty operator set makes isOperator() true-for-all (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)");
-    }
-    if (imageBakesEnabled && !Object.values(authTokens).includes(bakeRunnerPrincipal)) {
-        throw new Error(`IMAGE_BAKES_ENABLED=true but no SERVICE_AUTH_TOKENS entry maps to the runner principal '${bakeRunnerPrincipal}' — the bake-runner authenticates by its credential (token-derived source), so a '<BAKE_RUNNER_TOKEN>=${bakeRunnerPrincipal}' SERVICE_AUTH_TOKENS entry is required or claim/ingest/heartbeat all 403 (IMAGE-API-DESIGN.md §P2.12 boot invariant)`);
-    }
-    if (orchestration.leaderEnabled && store.dbBackend !== "mysql" && store.dbBackend !== "pg") {
-        throw new Error(`LEADER_ENABLED=true but DB_BACKEND=${store.dbBackend} (no external SQL store) is refused: a leader run is an ` +
-            "N-worker fan-out lasting up to 24h that ends in a REAL git push, and without a durable store its registry is " +
-            "a per-process Map — a cross-replica GET 404s, a restart forgets the run, and a retried POST starts a SECOND " +
-            "push. Point the service at a durable store (DB_BACKEND=mysql|pg), or turn the leader off (unset LEADER_ENABLED) " +
-            "(#193 车4 件2 / staleness ledger P1-9+P1-10 boot invariant)");
-    }
-    if (orchestration.requireExecutionLane && orchestration.remoteExec === undefined) {
-        throw new Error(`REQUIRE_EXECUTION_LANE=true but NO execution lane is named on this deployment — refusing to start. ` +
-            `With no lane the engine falls back to its in-process stub environment, where at least the Bash tool is ` +
-            `not mounted, yet every task still returns status=completed — indistinguishable from "the model chose ` +
-            `not to use its tools". (What the roster actually keeps is a per-run fact: read the wiring_manifest ` +
-            `event and count entries whose mountedBy is "hands".) ` +
-            `Cause: REMOTE_EXEC is unset/empty AND CONFIG_PROVIDER is not "local". ` +
-            `Fix: set REMOTE_EXEC to one of ${REMOTE_EXEC_PROVIDER_WORDS.join(" | ")} (and that lane's required env), ` +
-            `or set CONFIG_PROVIDER=local to take the single-machine \`host\` default, ` +
-            `or unset REQUIRE_EXECUTION_LANE to keep running without hands on purpose.`);
+    const laneRequiredRefusal = executionLaneRequiredRefusal(orchestration);
+    if (laneRequiredRefusal !== undefined) {
+        throw new Error(laneRequiredRefusal);
     }
     {
         const envLaneDispatchable = !isRosterGateArmed(integrations.configCenter);

package/dist/env-facts.d.ts

@@ -1,4 +1,5 @@
 import type { ImageCapabilities } from "./plugins/store-contracts.js";
+import type { RemoteExecProvider } from "./execution-lane-caps.js";
 export interface SandboxEnvFacts {
     profile?: string;
     capabilities?: string[];
@@ -53,7 +54,8 @@ export declare function buildEnvFacts(opts: {
  *  codex 复审 medium:k8s 必须按**有效快照能力**分叉,不能只看车道名——s3Snapshot 未配=park-only,
  *  resume 是全新 pod 且**工作区不恢复**,「文件已从快照恢复」那句会让模型信赖不存在的文件(比缺席
  *  更糟的谎)。 */
-export declare function resumeFactsForLane(provider: "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "host" | "device" | undefined, caps?: {
+export declare function resumeFactsForLane(provider: RemoteExecProvider | undefined, // 车道词 = settings-schema 词表正本(经本仓读口取型,不手抄;表加词 ⇒ 下方穷举 switch 编译红)
+caps?: {
     k8sSnapshot?: boolean;
 }): SandboxEnvFacts["resumeFacts"] | undefined;
 /** Path-safe session segment: the session id can be CALLER-SUPPLIED (body.sessionId), so it must not be able to

package/dist/env-facts.js

@@ -42,8 +42,12 @@ export function resumeFactsForLane(provider, caps) {
         case "host":
         case undefined:
             return { scratch: "preserved" };
-        default:
+        case "local-docker":
             return undefined;
+        default: {
+            const unreachable = provider;
+            return unreachable;
+        }
     }
 }
 export function scratchpadSessionSegment(sessionId) {

package/dist/execution-lane-caps.d.ts

@@ -1,16 +1,13 @@
+import { type ExecutionLane as DeclarableLane, type ExecutionLaneRow } from "@sema-agent/settings-schema/execution-lanes";
 import type { ServiceConfigFlat } from "./config-types.js";
 /** 一位能力的三态。`single-user-only` = 车道支持,但只在单用户部署(`requirePrincipal !== true`)开 ——
  *  多租户下这一位必须关(host 家族的 cwd/scheduler/backgroundShell/LSP 都是这一档,理由同源:
  *  一个租户的输入不许把 agent 指向 worker 宿主上另一个租户/运维的文件与进程)。 */
 export type LaneCapability = "supported" | "unsupported" | "single-user-only";
-/** `REMOTE_EXEC` 判别联合里的 provider 词全集 —— **派生自真配置型**,不是手抄一份。
- *  手抄的那份挡不住本模块要挡的病:给 `ServiceConfigFlat["remoteExec"]` 加一条臂(`remote-docker` 就是
- *  config-types.ts 里写着的下一条)可以完全不碰本文件而编译通过,穷举 switch 于是只对**自己的**副本穷举,
- *  能力表与普查数组一起静默漏行(codex R1-F2)。派生之后:配置加臂 ⇒ 本文件的 switch/词表/夹具同时编译红。 */
-export type RemoteExecProvider = NonNullable<ServiceConfigFlat["remoteExec"]>["provider"];
-/** 闭集:执行车道全集 = provider 词 + `in-process`(`REMOTE_EXEC` 未设的进程内 stub 形,配置面无 provider
- *  可派生 —— 它是「没有 remoteExec」这个状态的名字)。加词 ⇒ {@link executionLaneCaps} 的穷举 switch 与
- *  {@link EXECUTION_LANE_WORDS} 两处都编译红,这正是要的(「加词必须逐位表态」)。 */
+/** `REMOTE_EXEC` 能写下去的车道词全集 = settings-schema 词表正本的 `ExecutionLane`(**派生**,本仓零手抄)。 */
+export type RemoteExecProvider = DeclarableLane;
+/** 闭集:执行车道全集 = 表的可声明车道 + `in-process`(`REMOTE_EXEC` 未设的进程内 stub 形 —— 它是「没有 remoteExec」
+ *  这个状态的名字,不在表里)。表加词 ⇒ {@link executionLaneCaps} 的穷举 switch 编译红,这正是要的(「加词必须逐位表态」)。 */
 export type ExecutionLane = "in-process" | RemoteExecProvider;
 /**
  * per-lane 能力位。每一位的注里点名**今天真正做判决的那处代码**——对账测试按这些坐标跑真函数,
@@ -88,12 +85,13 @@ export interface ExecutionLaneCaps {
      *  · `single-user-only` = 所有任务落在**同一个共享目标**上(worker 宿主:host;一台常驻 SSH 对端:ssh;一台 ADB 设备:adb)
      *    ⇒ 只许单用户部署用。
      * 本位**没有** `unsupported` 这一档(那会读成「谁都不许用」,不是车道事实)—— 型上收窄掉,每条车道必须在两档里表态。
-     * 🔴 **本位即执法源**(车PI 验修轮 F8,如实登记):唯一消费点是 `config-invariants.ts` 的 `multi-tenant-shared-lane`(经
-     * {@link laneCapabilityHolds} 落成布尔),能力表对账格里本位的「判别式」读的就是这张表 —— 自指,只证明消费点读的是本位,不证明本位
-     * 的值对。本位值的**独立作者** = 部署面 `deploy/sema-up/lib/lanes.json` 的 users 列(只有 host / e2b / k8s 三行)+ 行为格
-     * (`test/multi-tenant-shared-lane.test.ts`:ssh / adb 的工厂给两个租户的任务铸出的 env 报同一个 `workspaceHandle().sandboxId`)。
-     * local-docker / device / in-process 的 `supported` 今天没有独立预言机(e2b / local-docker 的句柄要连上才有,k8s 连前恒 `(unconnected)`,
-     * 都不是零成本格)—— 改这几行时按适配器事实自查。
+     * 🔴 **7.114.0 起本位的值不在本仓写**:七条可声明车道读 settings-schema 词表正本的表行(`executionLaneRow(lane).tenantSeparation`;
+     * 中心写闸的 `requirePrincipal ∧ single-user-only` 交叉判与本仓 `multi-tenant-shared-lane` 拒启读的是同一个值,不会分叉);
+     * 只有 `in-process` 一格是本仓自己的事实(它不在表里)。
+     * 唯一消费点是 `config-invariants.ts` 的 `multi-tenant-shared-lane`(经 {@link laneCapabilityHolds} 落成布尔)。本位值与本仓**运行期事实**
+     * 不矛盾的对账 = `test/execution-lanes-schema-conformance.test.ts`(隔离位 / 共享文件平面 ⇒ 租户档的蕴含 + 唯一一条「不隔离却分租户」
+     * 的车道 = device 点名);ssh / adb 「两租户同一目标」的行为预言机 = `test/multi-tenant-shared-lane.test.ts`
+     * (两个租户的任务铸出的 env 报同一个 `workspaceHandle().sandboxId`)。
      */
     readonly tenantSeparation: Exclude<LaneCapability, "unsupported">;
 }
@@ -117,23 +115,49 @@ export interface ExecutionLaneCaps {
  *    恰是诚实形(§4.3.4)。
  */
 export declare function executionLaneCaps(lane: ExecutionLane): ExecutionLaneCaps;
-/** 一个开放字符串是不是闭集里的词。判据 = 词表键在不在,故与联合天然同源。 */
-export declare function isExecutionLane(word: string): word is ExecutionLane;
-/** 车道普查全集(顺序 = 词表声明序;对账测试按它逐 lane 跑真判别式)。 */
+/**
+ * 车道普查全集 = 本仓内部状态名 `in-process` + 词表正本的可声明车道(次序 = 正本声明序;对账测试按它逐 lane 跑真判别式)。
+ * 由正本派生、不手维护(手维护的「全表」已被代码反证漏过行)。
+ */
 export declare const ALL_EXECUTION_LANES: readonly ExecutionLane[];
+/** 一个开放字符串是不是闭集里的词(不做前缀 / 大小写宽容)。 */
+export declare function isExecutionLane(word: string): word is ExecutionLane;
 /**
- * `REMOTE_EXEC` **真能写下去的**那几个词(= {@link ALL_EXECUTION_LANES} 去掉 `in-process`:后者是
- * 「没有 remoteExec」这个状态的名字,env 里写它没有意义)。
- *
- * 🔴 S-426 以点改面:此前 `config-catalog.ts` 的 `REMOTE_EXEC` 行把这张表**手抄**成一个
- * `enumValues: ["e2b","k8s",…]` 字面量(字段静态型是 `readonly string[]`,与 {@link RemoteExecProvider}
- * 零类型联系)。病形与 S-382 逮到的 `WEB_SEARCH_PROVIDER` 逐字同族:给
- * `ServiceConfigFlat["remoteExec"]` 加一条 provider 臂(config-types.ts 里写着的下一条就是
- * `remote-docker`),本文件的穷举 switch 与词表**会**编译红,而目录行不会 —— 于是运维在
- * `GET /v1/config/catalog` 上读到的可写词集静默少一个,新车道成了「配了但目录说不认识」。
- * 收成一只派生数组之后,目录行**就用它本人**(身份相等有钉),全仓只剩这一张表。
+ * `REMOTE_EXEC` **真能写下去的**那几个词 = settings-schema 词表正本的 `EXECUTION_LANE_WORDS`(冻结副本,次序逐字同)。
+ * 读者:配置目录 `REMOTE_EXEC` 行的 `enumValues`(**就用它本人**,身份相等有钉 —— S-426 修过「目录手抄一份词表」的病)、
+ * [ref] 拒启句的 `valid:` 列表、`REQUIRE_EXECUTION_LANE` 拒启句的出路、`multi-tenant-shared-lane` 拒启句的出路车道。
+ * 7.114.0 起全仓唯一的车道词来源是正本;本常量只是它在本仓的那一个读口。
  */
 export declare const REMOTE_EXEC_PROVIDER_WORDS: readonly RemoteExecProvider[];
+/** 一条可声明车道在词表正本里的那一行(必需 / 可选 env 四栏 + 租户档)。加载期自检过完备性,所以对任何 {@link RemoteExecProvider} 都有行。 */
+export declare function executionLaneRow(lane: RemoteExecProvider): ExecutionLaneRow;
+/**
+ * 一条车道**必需**的 env 键名 = 正本表行的 `requiredEnv ∪ requiredSecretEnv`(次序:非密坐标在前、密钥在后 —— 与 7.113.0 本仓手写表逐字同)。
+ * 读者:`config.ts` 的 [ref] 拒启门(点了名却缺件 ⇒ 点名缺哪几键)、部署面门(`test/deploy-lanes-contract.test.ts`:`lanes.json` 每行登记
+ * 本车道必需键、根 / review compose 透传全部车道必需键之并)、`scripts/gen-lanes-json.mjs`(从同一张正本生成 `lanes.json` 的必需键列)。
+ * device 没有必需 env(设备是运行期连进来的;它的 boot 前提是跨键的,在跨域不变量区拒启)。
+ */
+export declare function laneRequiredEnv(lane: RemoteExecProvider): readonly string[];
+/**
+ * S-598 件③ / S-1008 —— **「`REQUIRE_EXECUTION_LANE=true` ∧ 没有任何车道被点名 ⇒ 拒启」的判据与拒因句的唯一属主**(`modelProviderRefusal` /
+ * `modelRouteEndpointRefusal` 同形:属主在叶模块,执法点各自调它,登记在 `config-invariants.ts`)。
+ *
+ * 🔴 病(S-1008,test d327-g6-engine-7112 OBS-4 / OBS-5;2026-10-03 亲核):修前**两份句子**。运行期真拒启的是 `config.ts` 手写 throw
+ * (点名 `REQUIRE_EXECUTION_LANE` / `REMOTE_EXEC` + 修法,用户在 stderr 读到的就是它);注册表条目另写了一句短的
+ * 「the deployment asked to refuse this state」,而它只在 `config-center/stage-limits.ts` 的全表校验里被调 —— 候选视图只装
+ * `BATCH1_LIMIT_KEYS` 的限额键,带不上这两键 ⇒ 对本条恒 `next === live`,**那一句没有任何读者**(test 六个拒启格 stderr 里零命中)。
+ * 改一份另一份不跟。现形:boot 的 throw 与注册表条目的 `check` **都**调本函数 —— 一只判据、一句话,没有第二份文本可漂。
+ *
+ * 判据读**装配结果**(`executionLaneOf` = 全仓唯一的缺席归一读口,缺席 ⇒ `in-process`),不重判 env:`remoteExec` 缺席**就是**
+ * 「`REMOTE_EXEC` 未设/空串 ∧ `CONFIG_PROVIDER ≠ local`」这条三元链尾臂的落点;点了名却配不齐 / 认不出归 [ref] 那条既有拒启(两句话各说各的问题)。
+ *
+ * 句子的量词纪律(S-1008 ②):stub 车道上**手带族**(`wiring_manifest.tools.entries[].mountedBy === "hands"`)整族不挂,名册里其余工具
+ * 照常执行(test R1n:`Now` 真执行成功)—— 不写「零工具」;名册**总条数**随 core 版本走,不写进句子(S-1008 ③)。
+ */
+export declare function executionLaneRequiredRefusal(deployment: {
+    readonly requireExecutionLane: boolean;
+    readonly remoteExec?: ServiceConfigFlat["remoteExec"];
+}): string | undefined;
 /**
  * `config.remoteExec?.provider` → 车道词。**全仓唯一**的缺席归一读口(S-602 门 D:`?? "in-process"` 只许住在这里,
  * `?? "host"` 与 `lane === undefined || lane === "host"` 同义折零容忍)。
@@ -144,9 +168,9 @@ export declare const REMOTE_EXEC_PROVIDER_WORDS: readonly RemoteExecProvider[];
  *
  * 两个重载 = 类型收窄([ref] §2.2 A):喂**已装配的** config 形(`RemoteExecProvider | undefined`)⇒
  * 返回型里没有 `undefined`,调用点不必为一条不可达的臂写兜底(兜底写多了就是下一处折词);喂开放字符串
- * (测试、外部输入)⇒ 返回含 `undefined`,逼调用点表态。第一个重载的成立依据是**编译期**的:
- * `RemoteExecProvider ⊂ ExecutionLane`(`ExecutionLane` 由它派生),而 {@link EXECUTION_LANE_WORDS} 是
- * `Record<ExecutionLane, true>` —— 少一个词编译红,所以对 `RemoteExecProvider` 的每一个值 `isExecutionLane` 恒真。
+ * (测试、外部输入)⇒ 返回含 `undefined`,逼调用点表态。第一个重载的成立依据是**构造**的:
+ * `RemoteExecProvider` 是正本元组 `EXECUTION_LANE_WORDS` 的元素型,而 {@link isExecutionLane} 的集合正是由那只元组
+ * (加 `in-process`)建成 ⇒ 对 `RemoteExecProvider` 的每一个值 `isExecutionLane` 恒真(对账格逐词跑过)。
  */
 export declare function executionLaneOf(provider: RemoteExecProvider | undefined): ExecutionLane;
 export declare function executionLaneOf(provider: string | undefined): ExecutionLane | undefined;