@sema-agent/server 7.113.0 → 7.115.0

package/dist/boot/memory-consolidation.d.ts

@@ -160,7 +160,7 @@ export interface ConsolidationWiringFacts {
     /** 记忆后端自带控制面归属吗(`typeof backend.controlPlaneRoot === "string"` 且非空)。 */
     readonly controlPlaneOwned: boolean;
     /** 只进文案 —— 让「该去拧哪根旋钮」这句话指向该腿上**真的**有效的那一根。 */
-    readonly memoryEngineBackend: "file" | "pg" | "tidb";
+    readonly memoryEngineBackend: ServiceConfig["memoryEngineBackend"];
     /** 部署声明的 provenance 姿态(`config.memoryProvenance`;缺席 ≡ core 缺省 `carry`)。 */
     readonly provenance?: "off" | "carry";
 }

package/dist/boot/resolve-spec.js

@@ -9,7 +9,7 @@ import { gateScenarioRequest, mergeUserSkills, selectScenario } from "../capabil
 import { stampHandsLane, toolPolicyForHands } from "../capabilities/hands-lane.js";
 import { buildNoticeLaneFacts, shouldDiscloseNoPersistentMemory, withNoPersistentMemoryNotice } from "../capabilities/memory-notice.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
-import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
+import { assertGuardPatternsUsable, buildApprovalGrantNotice, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
 import { singleUserAutoAcceptBaselineApplies } from "../approval.js";
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane, scratchpadCoveringTaskRoot } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
@@ -34,7 +34,7 @@ import { normalizeAttachments, normalizeResilience, normalizeResumeAtMode, norma
 import { cwdHonored, deviceCwdHonored, effectiveHostWorkspace, inProcessSingleUserLane, isValidCwd, parseAdditionalDirectories, satisfiedByProcessCwd, shellEnvMismatchCount } from "../task-cwd.js";
 import { assertRequestA2aUnlocked, resolveRequestA2a } from "../task-a2a.js";
 import { assertRequestMcpContentOrigin, assertRequestMcpUnlocked, resolveRequestMcp } from "../task-mcp.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, acceptAppendSystemPrompt, applyTaskSettings, effectivePermissionMode, effectiveThinking, hasConstitutionAnchors, parseTaskSettings, providerDropsAppend, settingsPermissionBucketIssue, withPermissionMode } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, acceptAppendSystemPrompt, applyTaskSettings, effectivePermissionMode, effectiveThinking, hasConstitutionAnchors, parseTaskSettings, taskHooksHonored, providerDropsAppend, settingsPermissionBucketIssue, withPermissionMode } from "../task-settings.js";
 import { enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
@@ -59,6 +59,9 @@ export function createResolveSpec(ctx) {
     };
     if (onlySensitiveBaseline)
         logger.warn(onlySensitiveBaseline.event, onlySensitiveBaseline.fields);
+    const approvalGrantNotice = buildApprovalGrantNotice(config);
+    if (approvalGrantNotice)
+        logger.info(approvalGrantNotice.event, approvalGrantNotice.fields);
     const resolveSpec = async (body, req, auth, opts) => {
         assertRequestMcpUnlocked(body.mcpServers, lockedKeys);
         if (opts?.leg === "fresh")
@@ -210,7 +213,7 @@ export function createResolveSpec(ctx) {
             const hc = parsedSettings.settings?.hooks;
             if (!hc)
                 return undefined;
-            if (config.requirePrincipal === true) {
+            if (!taskHooksHonored(config)) {
                 logger.warn("task_hooks_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
                 return undefined;
             }

package/dist/boot/shutdown.d.ts

@@ -96,6 +96,25 @@ export interface ShutdownCtx {
      *  `backend.close()` 之前等它 quiesce —— 在飞的 `put`(审批 park / 资源挂起…,与审批协调器在不在场无关)不许被抽掉连接池。 */
     parkCommits: ParkCommitWatch | undefined;
 }
+/**
+ * 受控退的**后台宽限**还要等多久(ms)—— hardShutdown 软停后台 shell 之后、`process.exit` 之前,给软停过的行**一次**
+ * `HOST_BG_KILL_GRACE_MS` 收完合作清理(host 梯子:SIGTERM → 宽限 → 组 SIGKILL)。
+ *
+ * 没有这一步时,**无活连接**的干净停机里 `server.close` 回调立刻落地、链上其余步骤都是毫秒级,`exit` 几乎紧跟软停,退出边界钩同拍一枪
+ * 组 SIGKILL ⇒ 收到 SIGTERM 后要一点时间停容器 / 刷盘的后台 shell 被腰斩。**只缩不延**的两条:
+ *  · 起点是软停时刻(不是「别的步骤做完之后」)—— 慢 close / 审批面收尾已经耗掉的时间算进宽限里,链上别的等待不与它相加,取较晚者;
+ *  · 封顶在 hardShutdown 起点算的**同一个到期点**(`deadlineMs`,与审批面收尾 / 店 quiesce 共读)—— 运维把宽限调得再长,
+ *    退出也不晚于到期点,一定早于 15 s 的 `finalExit`,不延长停机总上限。
+ * `softStopped` = 本次软停的后台行数(core `reapAllSessionBackground` 的返回;0 ⇒ 没有梯子在跑、不欠宽限,空闲引擎的退出不变慢)。
+ * 该数里含后台 agent / workflow 行(core 不拆开数),它们没有 shell 梯子 ⇒ 只有这一形会**多**等(≤ 一个宽限),不会少等。
+ */
+export declare function backgroundGraceRemainingMs(a: {
+    softStopped: number;
+    softStoppedAt: number;
+    now: number;
+    graceMs: number;
+    deadlineMs: number;
+}): number;
 /**
  * `installShutdownHandlers` 的**摘除把手**([ref] 二轮重扫件4)。
  *

package/dist/boot/shutdown.js

@@ -2,11 +2,18 @@ import { Runner } from "@sema-agent/core";
 import { writeCrashLast, clearCrashLast, readCrashLast } from "./crash-last.js";
 import { createSighupIdleHandler } from "../sighup-idle.js";
 import { createParentWatch } from "../parent-watch.js";
+import { setTimeout as delay } from "node:timers/promises";
+import { HOST_BG_KILL_GRACE_MS } from "../plugins/remote-env-host.js";
 import { installProcessExitBoundary } from "./exit-boundary.js";
 import { createEngineLeaseTracker } from "./engine-lease.js";
 import { writeExitLast, readExitLast, clearExitLast } from "./exit-last.js";
 import { isScriptRealmRejection, describeRejectionReason } from "../orchestration/hardened-vm-runner.js";
 const HARD_STOP_GRACE_MS = 10_000;
+export function backgroundGraceRemainingMs(a) {
+    if (a.softStopped <= 0)
+        return 0;
+    return Math.max(0, Math.min(a.softStoppedAt + a.graceMs, a.deadlineMs) - a.now);
+}
 export function installShutdownHandlers(ctx) {
     const { config, logger, server, reaper, fleetReconcile, retentionLane, releaseRetentionLease, otelExporter, breakerState, costQuota, rateLimiter, runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState, storeLiveProbe, configCenter, version, deviceHub, toolApproval, parkCommits, } = ctx;
     const dataRoot = config.localDataRoot;
@@ -102,7 +109,10 @@ export function installShutdownHandlers(ctx) {
         subRunner.sessions.dispose();
         void lspManager?.dispose?.();
         void workflowNotifyJournal?.close?.();
-        exitBoundary.reapChildProcessesEarly();
+        const backgroundSoftStopped = exitBoundary.reapChildProcessesEarly();
+        const softStoppedAt = Date.now();
+        const backgroundGraceMs = backgroundGraceRemainingMs({ softStopped: backgroundSoftStopped, softStoppedAt, now: softStoppedAt, graceMs: HOST_BG_KILL_GRACE_MS, deadlineMs: graceDeadlineMs });
+        const backgroundGrace = backgroundGraceMs > 0 ? delay(backgroundGraceMs) : Promise.resolve();
         const drained = approvalDrain
             .then(() => parkCommits?.quiesce(graceDeadlineMs))
             .then((q) => {
@@ -120,6 +130,7 @@ export function installShutdownHandlers(ctx) {
             void Promise.all([retentionTeardown, ledgerStopped])
                 .then(() => (backend ? backend.close() : Promise.resolve()))
                 .then(() => routingStopped)
+                .finally(() => backgroundGrace)
                 .finally(() => process.exit(0));
         });
         const finalExit = setTimeout(() => { logger.warn("hard_shutdown_final_deadline", { afterMs: 15_000 }); process.exit(0); }, 15_000);

package/dist/capabilities/composite-members.d.ts

@@ -46,6 +46,7 @@ export declare const COMPOSITE_CAPABILITY_MEMBERS: {
     readonly webSearch: readonly ["backend"];
     readonly background: readonly ["listFace", "exitFaces"];
     readonly taskSettings: readonly ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks"];
+    readonly settings: readonly ["permissions"];
     readonly permissionModeAuto: readonly ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"];
     readonly writeProtection: readonly ["armed", "rows", "replaced"];
     readonly executionLane: readonly ["provider", "toolsOnThisHost", "isolated"];

package/dist/capabilities/composite-members.js

@@ -7,6 +7,7 @@ export const COMPOSITE_CAPABILITY_MEMBERS = {
     webSearch: ["backend"],
     background: ["listFace", "exitFaces"],
     taskSettings: ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks"],
+    settings: ["permissions"],
     permissionModeAuto: ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"],
     writeProtection: ["armed", "rows", "replaced"],
     executionLane: ["provider", "toolsOnThisHost", "isolated"],

package/dist/config-catalog.js

@@ -2,10 +2,11 @@ import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES } fr
 import { CENTER_CREDENTIAL_ENV, DOMAIN_SCHEMAS } from "@sema-agent/settings-schema";
 import { CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS, CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS, CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS } from "./center-credential-renewer.js";
 import { THINKING_FORMATS } from "./model-compat.js";
-import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CONFIG_PROVIDER_WORDS, DB_BACKEND_WORDS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
+import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CONFIG_PROVIDER_WORDS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
 import { webSearchProviderFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
+import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { MODEL_PROVIDER_WORDS } from "./model-provider.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
@@ -57,6 +58,7 @@ export const CONFIG_CATALOG = [
     r("ANTHROPIC_VERSION", "modelPlane", "string", "Anthropic API version 头(缺省由 SDK 定)"),
     r("APPROVAL_AUTO_BUDGET", "approval", "number", "每 run-leg 自动放行的普通门控工具调用数上限(0=关;防审批循环的熔断,不是安全 ask 的帽)", { staticDefault: "0", danger: SEC, configKey: "approvalAutoBudget" }),
     r("APPROVAL_DENY", "approval", "csv", "始终拒绝的工具名单(装配期拒不可匹配名)", { danger: SEC, configKey: "approvalDeny" }),
+    r("APPROVAL_GRANT", "approval", "csv", "运维的 allow 规则(工具名规则:精确名 / mcp__<server>__* / a2a__<peer>__*;命中 = 带理由放行,不再为这些调用出「没人表态」卡(不放掉任何一层自己的问);HTTP 提交 / durable 续跑 / 停驻后台 agent 赎回 / run-local 四腿同装(leader worker 首跑与修复腿到不了);不越过任何一层的 deny / ask;不是白名单;坏值拒启)", { danger: SEC, configKey: "approvalGrant", derivedDefaultNote: "缺席 = 空表(本层不表态,折叠与未设逐字同)" }),
     r("APPROVAL_HMAC_KEYS", "approval", "secret", "直连门(D-G)HMAC 完整性密钥集(空=直连门不激活)", { danger: SEC }),
     r("APPROVAL_NEVER_AUTO", "approval", "csv", "永不被 AUTO_BUDGET 自动放行的工具集(不可逆动作恒要人)", { danger: SEC, configKey: "approvalNeverAuto" }),
     r("APPROVAL_REQUIRE", "approval", "csv", "必须人审的工具名单(F4 门;center 腿热:refresh 拍整表换代,无 checkpoint 店的部署发非空名单 ⇒ 审批组整组拒)", { danger: SEC, configKey: "approvalRequire", center: cGov("approvalRequire") }),
@@ -99,7 +101,7 @@ export const CONFIG_CATALOG = [
     r("COST_QUOTA_WINDOW_SEC", "limitsHttp", "number", "per-principal 成本配额窗长(秒);SQL 腿窗长进桶主键 ⇒ center 腿显式 deferred(重启生效)", { staticDefault: "86400", danger: BILL, configKey: "costQuotaWindowSec", center: cLimits("costQuotaWindowSec", { timing: "restart", restartReason: "cost-quota-window" }) }),
     r("CROSS_SESSION_DIALOG_EXPIRY", "approval", "enum", "held 跨会话消息等待人审的期限(CC settings 键名 dialogExpiry;未设=不铸键,引擎自落缺省 5m;词表外拒启)", { danger: SEC, enumValues: [...CROSS_SESSION_DIALOG_EXPIRY_VALUES], configKey: "crossSessionDialogExpiry", derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省 5m", resolve: (c) => c.crossSessionDialogExpiry ?? null }),
     r("CROSS_SESSION_INBOUND", "approval", "enum", "入站跨会话消息的部署/组织层治理(CC settings 键名 crossSessionInbound 的 managed 层;未设=本层不表态≠ next-turn;词表外拒启)", { danger: SEC, enumValues: [...CROSS_SESSION_INBOUND_SETTINGS], configKey: "crossSessionInbound", derivedDefaultNote: "缺席 ⇒ managed 层不设,由其余层与 mode-parity 决定", resolve: (c) => c.crossSessionInbound ?? null }),
-    r("DB_BACKEND", "store", "enum", "store 后端引擎选择(mysql 兼容/pg/本机文件店/纯内存)", { enumValues: DB_BACKEND_WORDS, danger: DATA, derivedDefaultNote: "裸 boot ⇒ local(多租户裸 boot ⇒ memory + notice);有 SQL 信号 ⇒ mysql", configKey: "dbBackend", resolve: (c) => c.dbBackend }),
+    r("DB_BACKEND", "store", "enum", "store 后端引擎选择(mysql 兼容/pg/本机文件店/纯内存)", { enumValues: STORE_BACKENDS, danger: DATA, derivedDefaultNote: "裸 boot ⇒ local(多租户裸 boot ⇒ memory + notice);有 SQL 信号 ⇒ mysql", configKey: "dbBackend", resolve: (c) => c.dbBackend }),
     r("DB_QUERY_TIMEOUT_MS", "store", "number", "per-query DB 超时(ms;坏值回默认姿态+warn,绝不 NaN 进 driver)", { derivedDefaultNote: "缺席 ⇒ 池级不设/计数族 30s(按引擎)", configKey: "dbQueryTimeoutMs" }),
     r("DEFAULT_SCENARIO", "integrations", "string", "出厂缺省场景(编码产品出厂态;通用中性 persona 用 default 显式选回)", { staticDefault: "code", configKey: "defaultScenario" }),
     r("DELEGATION_MAX_CONCURRENT", "orchestration", "number", "委派入口并发帽", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省(CC parity 20)" }),
@@ -155,7 +157,7 @@ export const CONFIG_CATALOG = [
     r("HOST_BG_DEFAULT_TIMEOUT_SEC", "orchestration", "number", "host 后台 shell 缺省超时(秒)", { staticDefault: "300" }),
     r("HOST_BG_ENABLED", "orchestration", "boolean", "host 车道后台 shell 开关", { staticDefault: "true" }),
     r("HOST_BG_FILE_CAP", "orchestration", "number", "host 后台 shell 磁盘护栏(字节;失控输出被 reap)", { staticDefault: String(64 * 1024 * 1024) }),
-    r("HOST_BG_KILL_GRACE_MS", "orchestration", "number", "host 后台 shell SIGTERM→SIGKILL 宽限(ms);会话删除 / 会话停止口在软停与硬收之间等同一只", { staticDefault: "1000" }),
+    r("HOST_BG_KILL_GRACE_MS", "orchestration", "number", "host 后台 shell SIGTERM→SIGKILL 宽限(ms);会话删除 / 会话停止口在软停与硬收之间等同一只,受控退出(SIGTERM / SIGINT)在软停之后、退出之前也等一次(封顶在停机宽限窗内)", { staticDefault: "1000" }),
     r("HOST_BG_MAX_CONCURRENT", "orchestration", "number", "host 后台 shell 并发帽", { staticDefault: "8" }),
     r("HOST_BG_MAX_TIMEOUT_SEC", "orchestration", "number", "host 后台 shell 超时上限(秒)", { staticDefault: "1800" }),
     r("HOST_BG_MEM_CAP", "orchestration", "number", "host 后台 shell 内存流护栏(字节)", { staticDefault: String(8 * 1024 * 1024) }),
@@ -232,7 +234,7 @@ export const CONFIG_CATALOG = [
     r("MEMORY_EMBEDDER_MODEL", "memory", "string", "embeddings 模型名"),
     r("MEMORY_EMBEDDER_TIMEOUT_MS", "memory", "number", "单次 embed 活性上限(ms)", { staticDefault: "30000" }),
     r("MEMORY_ENGINE", "memory", "enum", "记忆引擎总开关(注入式文件记忆面;双族词表,未知词拒启)", { enumValues: ["on", "off"], staticDefault: "on", configKey: "memoryEngineEnabled", booleanEnum: { true: "on", false: "off" } }),
-    r("MEMORY_ENGINE_BACKEND", "memory", "enum", "记忆持久面方言(file=现状;pg/tidb=DB 真身,多租户点亮的唯一门)", { enumValues: ["file", "pg", "tidb"], staticDefault: "file", danger: DATA, configKey: "memoryEngineBackend" }),
+    r("MEMORY_ENGINE_BACKEND", "memory", "enum", "记忆持久面方言(file=现状;pg/tidb=DB 真身,多租户点亮的唯一门)", { enumValues: MEMORY_ENGINE_BACKENDS, staticDefault: "file", danger: DATA, configKey: "memoryEngineBackend" }),
     r("MEMORY_ENGINE_DIR", "memory", "path", "记忆引擎根覆写", { derivedDefaultNote: "缺席 ⇒ core 默认链(AGENT_DATA_DIR → ~/.ai-agent)", configKey: "memoryEngineDir" }),
     r("MEMORY_ENGINE_REMOTE_LANE", "memory", "enum", "远端执行车道上放行 file 记忆引擎的 plane-split 覆写", { enumValues: ["allow"] }),
     r("MEMORY_ORG_ADMISSION_MODE", "memory", "enum", "org 记忆准入模式(audit=判决照算纯观察)", { enumValues: ["audit", "enforce"], staticDefault: "enforce", danger: SEC, configKey: "memoryOrgAdmissionMode" }),
@@ -358,7 +360,7 @@ export const CONFIG_CATALOG = [
     r("REAP_RUN_STALE_SEC", "limitsHttp", "number", "run 活性判陈旧阈(秒)", { staticDefault: "120", configKey: "runStaleSec", center: cLimits("runStaleSec") }),
     r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)", { enumValues: REMOTE_EXEC_PROVIDER_WORDS, danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub(手带整族不挂;残余名册看活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点。想让这一形拒启见 REQUIRE_EXECUTION_LANE)", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
     r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基;core ExecutionEnv.homeDir 座)", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user;k8s/local-docker/ssh/adb/device ⇒ 无(`~/` 规则 422 响亮拒)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
-    r("REQUIRE_EXECUTION_LANE", "orchestration", "boolean", "开了之后:REMOTE_EXEC 未点名 ∧ CONFIG_PROVIDER≠local ⇒ **拒启**并点名该设什么。默认关 = 照旧启动,但执行环境是进程内 stub、手带整族不挂,任务仍回 status=completed(活体读数:mountedBy=hands 条目 10 → 0,名册 38 → 19)—— 与「模型不肯用工具」在用户面同形。残余名册判据 = 活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点。托管/云部署推荐开(docs/DEPLOY-PREREQS.md)", { staticDefault: "false", danger: SEC, configKey: "requireExecutionLane" }),
+    r("REQUIRE_EXECUTION_LANE", "orchestration", "boolean", "开了之后:REMOTE_EXEC 未点名 ∧ CONFIG_PROVIDER≠local ⇒ **拒启**并点名该设什么。默认关 = 照旧启动,但执行环境是进程内 stub、**零手带工具**(手带整族不挂;活体读数:mountedBy=hands 条目 10 → 0),名册里其余工具照常执行,任务仍回 status=completed —— 凡需要手的请求,与「模型不肯用工具」在用户面同形。判据 = 活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点;名册总条数随 core 版本走,不写死。托管/云部署推荐开(docs/DEPLOY-PREREQS.md)", { staticDefault: "false", danger: SEC, configKey: "requireExecutionLane" }),
     r("REQUIRE_PRINCIPAL", "auth", "boolean", "多租户开关(posture 判别位:true ⇒ CC 能力族默认收紧)", { staticDefault: "false", danger: SEC, configKey: "requirePrincipal" }),
     r("RESOURCE_SUSPEND", "approval", "boolean", "durable 路径 opt-in core resourceSuspend(预算/preempt ⇒ 可恢复挂起)", { staticDefault: "false", configKey: "resourceSuspend" }),
     r("RESOURCE_SUSPEND_MAX_SLICES", "approval", "number", "resume 链片数上限(0=不设;零进展循环兜底)", { staticDefault: "0", configKey: "resourceSuspendMaxSlices" }),
@@ -408,7 +410,7 @@ export const CONFIG_CATALOG = [
     r("SERVICE_AUTH_TOKEN", "auth", "secret", "共享 service token(写面门;缺席且未开 ALLOW_UNAUTHED_WRITES ⇒ 拒提交)", { danger: SEC }),
     r("SERVICE_AUTH_TOKENS", "auth", "secret", "per-system 凭据表(tok=system CSV;source 从凭据派生,绝不自报)", { danger: SEC }),
     r("SESSION_AUTO_TITLE", "orchestration", "boolean", "首次提交自动铸 session 标题(一次 cheap 调用)", { staticDefault: "true", danger: BILL, configKey: "sessionAutoTitle" }),
-    r("SESSION_BACKEND", "store", "enum", "session 店引擎(auto=探到 DB 用 DB,探不到回内存;回显=boot 解析后的真引擎)", { enumValues: ["memory", "mysql", "auto"], danger: DATA, derivedDefaultNote: "缺席:显式 DB_BACKEND=mysql|pg ⇒ mysql,否则 memory", configKey: "sessionBackend", resolve: (c) => (c.sessionBackend === "tidb" ? "mysql" : c.sessionBackend) }),
+    r("SESSION_BACKEND", "store", "enum", "session 店引擎(auto=探到 DB 用 DB,探不到回内存;回显=boot 解析后的真引擎)", { enumValues: SESSION_BACKENDS, danger: DATA, derivedDefaultNote: "缺席:显式 DB_BACKEND=mysql|pg ⇒ mysql,否则 memory", configKey: "sessionBackend", resolve: (c) => (c.sessionBackend === "tidb" ? "mysql" : c.sessionBackend) }),
     r("SESSION_CACHE_TTL_SEC", "store", "number", "session 读缓存 TTL(秒;0=关)", { staticDefault: "300", configKey: "sessionCacheTtlSec" }),
     r("SESSION_EVENTS_HOT_MS", "limitsHttp", "number", "session SSE 订阅热探针间隔(ms)", { derivedDefaultNote: "缺席 ⇒ 200" }),
     r("SESSION_EVENTS_MAX_CONNS", "limitsHttp", "number", "session SSE 并发连接帽", { derivedDefaultNote: "缺席 ⇒ 256" }),

package/dist/config-center/apply-effective.js

@@ -1,6 +1,6 @@
 import { resolveActiveTiers } from "@sema-agent/settings-schema";
 import { modelKeyPoison } from "../key-resolver.js";
-import { applyAutoCompactWindow, buildModelCostKey, findUnmatchableToolNames, formatUnmatchableToolNames, parseAutonomy } from "../config.js";
+import { applyAutoCompactWindow, buildModelCostKey, parseAutonomy, unmatchableToolNamesRefusal } from "../config.js";
 import { buildModelCompat, readModelCompat } from "../model-compat.js";
 import { buildModelHeadersKey } from "../model-entry-headers.js";
 import { validateCommandRules } from "../runtime-governance.js";
@@ -9,7 +9,7 @@ import { stageLimits } from "./stage-limits.js";
 import { APPROVAL_GROUP_KEYS, BATCH1_LIMIT_KEYS } from "./hot-keys-registry.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 import { crossInvariant } from "../config-invariants.js";
-import { DEFAULT_MODEL_MISSING_CODE, REFUSED_NAME_MINTED_CODE, judgeCatalogEntries, mintedRefusedNames, refusalEventOf, refusalWarnFields, malformedDroppedCarrierRefusal } from "../model-entry-refusal.js";
+import { DEFAULT_MODEL_MISSING_CODE, REFUSED_NAME_MINTED_CODE, judgeCatalogEntries, mintedRefusedNames, refusalEventOf, refusalWarnFields, refusedNameLogField, refusedNamesLogFields, malformedDroppedCarrierRefusal } from "../model-entry-refusal.js";
 import { judgeModelRouteEndpoint } from "../model-route-endpoint.js";
 import { gateIntentUnserviceableReason } from "../approval.js";
 import { refusedGroups } from "./apply-ledger.js";
@@ -314,7 +314,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
         if (usable.length > 0) {
             picked = resolveDefaultModelName(eff, (n) => models[n] !== undefined, usable[0].name, (source, name) => logger?.warn("sema_registry_default_dangling", {
                 source,
-                name,
+                ...(Object.hasOwn(verdict.refused, name) ? refusedNameLogField("name", name) : { name }),
                 ...(Object.hasOwn(verdict.refused, name) ? { unavailable: verdict.refused[name].code } : {}),
                 hint: "explicit default names a model that is not in the usable catalog (not enabled, or unavailable on this host — see `unavailable`) — falling to the next source",
             }));
@@ -327,7 +327,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
                 continue;
             }
             const refusal = Object.hasOwn(verdict.refused, target) ? verdict.refused[target] : undefined;
-            logger?.warn("sema_registry_tier_binding_unavailable", { tier, model: target, ...(refusal !== undefined ? { code: refusal.code } : {}), hint: "this tier binding names a model that is not in this generation's usable catalog — the binding is dropped (the tier word falls to the next lower bound tier, core's ladder); fix the entry or rebind the tier" });
+            logger?.warn("sema_registry_tier_binding_unavailable", { tier, ...(refusal !== undefined ? refusedNameLogField("model", target) : { model: target }), ...(refusal !== undefined ? { code: refusal.code } : {}), hint: "this tier binding names a model that is not in this generation's usable catalog — the binding is dropped (the tier word falls to the next lower bound tier, core's ladder); fix the entry or rebind the tier" });
         }
         const nextView = { ...config, models, tiers: activeTiers, modelRefusals: verdict.refused };
         const noDefault = crossInvariant("default-model-resolvable").check({ live: config, next: nextView });
@@ -343,7 +343,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
             const target = typeof spec === "string" ? spec : spec !== null && typeof spec === "object" && "model" in spec && typeof spec.model === "string" ? spec.model : undefined;
             const refusal = target !== undefined && Object.hasOwn(verdict.refused, target) ? verdict.refused[target] : undefined;
             if (refusal !== undefined) {
-                logger?.warn("sema_registry_role_binding_unavailable", { role, model: target, code: refusal.code, hint: ROLE_BINDING_UNAVAILABLE_HINT });
+                logger?.warn("sema_registry_role_binding_unavailable", { role, ...refusedNameLogField("model", target), code: refusal.code, hint: ROLE_BINDING_UNAVAILABLE_HINT });
             }
         }
         const atModelAllowlist = stageAtModelAllowlist(eff.models?.atModelAllowlist, models, logger);
@@ -357,7 +357,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
             roles,
             activeTiers,
             atModelAllowlist,
-            infoLine: { count: usable.length, ...(Object.keys(verdict.refused).length > 0 ? { unavailable: Object.keys(verdict.refused) } : {}), default: defaultModel.id, defaultSource: picked.source, roles: Object.keys(roles), tiers: Object.keys(activeTiers), atModelAllowlist: atModelAllowlist.length, sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length },
+            infoLine: { count: usable.length, ...(Object.keys(verdict.refused).length > 0 ? refusedNamesLogFields("unavailable", Object.keys(verdict.refused)) : {}), default: defaultModel.id, defaultSource: picked.source, roles: Object.keys(roles), tiers: Object.keys(activeTiers), atModelAllowlist: atModelAllowlist.length, sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length },
         };
         return { stages: { models: plane, collab: stageCollabDomain(eff) }, defaultName: picked.name, refused: verdict.refused };
     }
@@ -476,13 +476,13 @@ function stageApprovalRequire(raw) {
         return { ok: false, detail, reason: detail, names: nonString.map((e) => `[${e.i}]`), kept: KEPT_WOULD_REMOVE_GATE };
     }
     const names = raw.filter((n) => typeof n === "string").map((n) => n.trim()).filter((n) => n.length > 0);
-    const bad = findUnmatchableToolNames(names, { consumer: "tool-name-table", behavior: "deny" });
-    if (bad.length > 0) {
+    const unmatchable = unmatchableToolNamesRefusal("published governance.approvalRequire", names, { consumer: "tool-name-table", behavior: "deny" });
+    if (unmatchable !== undefined) {
         return {
             ok: false,
-            detail: formatUnmatchableToolNames("published governance.approvalRequire", bad),
-            reason: `published governance.approvalRequire has ${bad.length} entr${bad.length === 1 ? "y" : "ies"} that match no live tool (retired name / incomplete MCP name / CC-form rule) — the offending entries are named in the sema_registry_approval_require_invalid log line`,
-            names: bad.map((b) => b.name),
+            detail: unmatchable.message,
+            reason: `published governance.approvalRequire has ${unmatchable.names.length} entr${unmatchable.names.length === 1 ? "y" : "ies"} that match no live tool (retired name / incomplete MCP name / CC-form rule) — the offending entries are named in the sema_registry_approval_require_invalid log line`,
+            names: unmatchable.names,
             kept: KEPT_WOULD_MATCH_NOTHING,
         };
     }

package/dist/config-invariants.d.ts

@@ -57,6 +57,33 @@ export interface CrossInvariant {
     /** 返回拒因;`undefined` = 通过。 */
     check(input: CrossInvariantInput): string | undefined;
 }
+/**
+ * ── S-1008 ① 推广(车 UZ 推广轮):**拒因句单铸点**是一类 —— 下面五只是 `config.ts` 区里五条跨域拒启的**判据 + 句子的唯一属主**
+ * (`executionLaneRequiredRefusal` / `modelProviderRefusal` 同形):boot 的 throw(`config.ts`,锚在那儿)与注册表条目的 `check` **都调它**,
+ * 没有第二份文本可漂。修前这五条逐条两份不同的句子(boot 手写一份、表里另写一份),boot 那份是运维在 stderr 读到的(`config-validation.test.ts`
+ * 钉着它的指纹),表那份只在热路径上被调 —— 而热键集带不上这些键 ⇒ 实际无读者。句子**取 boot 那份**(逐字不变);类钉 =
+ * `test/config-hot/batch1-cross-invariants.test.ts` 的「类钉」一格(每条带 `bootAnchor` 的条目,boot 点不手写句子、且来自注册表本人或 check 同调的函数)。
+ * 参数取 `CrossInvariantView` 的窄 `Pick`:boot 期手里只有装配中的各域值,不是整只 config,按真字段名铸一个小对象传入。
+ */
+/** `direct-door-anchors` 的状态臂:半开的直连门(开着却缺锚点)。转换臂(门姿态翻转)只活在热路径,留在条目里。 */
+export declare function halfOpenDirectDoorRefusal(v: Pick<CrossInvariantView, "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals">): string | undefined;
+/**
+ * `operator-principals-required`([ref]-① 普查候选 1/2):BFF 多租户 durable 形(DURABLE_APPROVAL ∧ REQUIRE_PRINCIPAL,直连门关)的空 operator 名单 ——
+ * approvals-assistant 四个读面按裸 `isOperator` 划 scope,空名单 true-for-all ⇒ 任一租户 principal 可读他租户的待批队列。单租户 legacy(REQUIRE_PRINCIPAL 未设)刻意保留。
+ */
+export declare function operatorPrincipalsRequiredRefusal(v: Pick<CrossInvariantView, "durableApproval" | "requirePrincipal" | "operatorPrincipals">): string | undefined;
+/** `bake-operator-principals`(IMAGE-API-DESIGN §P2.4a):bake 门是 build-host 无限制执行面,空 operator 名单让 isOperator true-for-all = 无限制写入面。 */
+export declare function bakeOperatorPrincipalsRefusal(v: Pick<CrossInvariantView, "imageBakes" | "operatorPrincipals">): string | undefined;
+/**
+ * `bake-runner-credential`(IMAGE-API-DESIGN §P2.12 / H1):bake-runner 的身份由它的 bearer 凭据**派生**(token-derived `source`),不是自称的头 ——
+ * 没有 `system == BAKE_RUNNER_PRINCIPAL` 的 SERVICE_AUTH_TOKENS 条目,runner 永远过不了 isRunner,claim/ingest/heartbeat 整条管线静默全 403。
+ */
+export declare function bakeRunnerCredentialRefusal(v: Pick<CrossInvariantView, "imageBakes" | "authTokens">): string | undefined;
+/**
+ * `leader-durable-store`([ref] 车4 件2,台账 P1-9 / P1-10):leader run(N worker、最长 24h、以真 git push 收尾)的登记表没有外部 SQL 店就退化成进程内 Map。
+ * 「多副本」在 config 层判不了(副本数不是本进程的知识),可判的**代理**就是 durable 前提本身。
+ */
+export declare function leaderDurableStoreRefusal(v: Pick<CrossInvariantView, "leaderEnabled" | "dbBackend">): string | undefined;
 export declare const CONFIG_CROSS_INVARIANTS: readonly CrossInvariant[];
 /**
  * 按 id 取**一条**(S-157②:boot 面的单源化出口)。

package/dist/config-invariants.js

@@ -3,7 +3,7 @@ import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { defaultModelRefusal, refusedNameMintedRefusal } from "./model-entry-refusal.js";
-import { executionLaneCaps, executionLaneOf, laneCapabilityHolds, REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
+import { executionLaneCaps, executionLaneOf, executionLaneRequiredRefusal, laneCapabilityHolds, REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
 export const LIVENESS_HEARTBEAT_MS = 30_000;
 const anyServiceAuth = (v) => Boolean(v.authToken) || Object.keys(v.authTokens ?? {}).length > 0;
 const mustNarrowBind = (v) => Boolean(v.allowUnauthedWrites) && !anyServiceAuth(v);
@@ -16,6 +16,51 @@ function multiTenantSharedLaneRefusal(v) {
     return (`REQUIRE_PRINCIPAL=true (multi-tenant posture) with the "${lane}" execution lane runs every tenant's Bash on one shared target — ` +
         `this lane does not separate tenants; set REMOTE_EXEC to ${outlets.join(" / ")}, or unset REQUIRE_PRINCIPAL for a single-user box`);
 }
+export function halfOpenDirectDoorRefusal(v) {
+    if (!v.directApprovalDoor)
+        return undefined;
+    const missing = [];
+    if (!v.durableApproval)
+        missing.push("DURABLE_APPROVAL=true (the direct door's crypto gate only exists on the durable /decide path)");
+    if (v.approvalHmacKeys.length === 0)
+        missing.push("APPROVAL_HMAC_KEYS");
+    if (v.principalJwtPubkeys.length === 0)
+        missing.push("PRINCIPAL_JWT_PUBKEYS");
+    if (!v.principalJwtIss)
+        missing.push("PRINCIPAL_JWT_ISS");
+    if (!v.principalJwtAud)
+        missing.push("PRINCIPAL_JWT_AUD");
+    if (v.operatorPrincipals.length === 0)
+        missing.push("OPERATOR_PRINCIPALS (else isOperator is true-for-all)");
+    if (!v.requirePrincipal)
+        missing.push("REQUIRE_PRINCIPAL=true (a direct door is multi-tenant; without it an absent principal is anonymous and the self-asserted header governs owner/quota checks)");
+    return missing.length > 0 ? `DIRECT_APPROVAL_DOOR=true but D-G anchors are missing: ${missing.join(", ")} — refusing to start a half-open direct door (design/80 D-G boot invariant)` : undefined;
+}
+export function operatorPrincipalsRequiredRefusal(v) {
+    return v.durableApproval === true && v.requirePrincipal && v.operatorPrincipals.length === 0
+        ? "DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true but OPERATOR_PRINCIPALS is empty — on a multi-tenant worker the empty operator set makes isOperator() true-for-all, so every authenticated tenant could read every other tenant's pending-approval queue (GET /v1/approvals & siblings). Set OPERATOR_PRINCIPALS, or unset REQUIRE_PRINCIPAL if this is a single-tenant deployment (#157-① boot invariant)"
+        : undefined;
+}
+export function bakeOperatorPrincipalsRefusal(v) {
+    return v.imageBakes.enabled && v.operatorPrincipals.length === 0
+        ? "IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host; an empty operator set makes isOperator() true-for-all (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)"
+        : undefined;
+}
+export function bakeRunnerCredentialRefusal(v) {
+    const runner = v.imageBakes.runnerPrincipal;
+    return v.imageBakes.enabled && !Object.values(v.authTokens ?? {}).includes(runner)
+        ? `IMAGE_BAKES_ENABLED=true but no SERVICE_AUTH_TOKENS entry maps to the runner principal '${runner}' — the bake-runner authenticates by its credential (token-derived source), so a '<BAKE_RUNNER_TOKEN>=${runner}' SERVICE_AUTH_TOKENS entry is required or claim/ingest/heartbeat all 403 (IMAGE-API-DESIGN.md §P2.12 boot invariant)`
+        : undefined;
+}
+export function leaderDurableStoreRefusal(v) {
+    return v.leaderEnabled && v.dbBackend !== "mysql" && v.dbBackend !== "pg"
+        ? `LEADER_ENABLED=true but DB_BACKEND=${v.dbBackend} (no external SQL store) is refused: a leader run is an ` +
+            "N-worker fan-out lasting up to 24h that ends in a REAL git push, and without a durable store its registry is " +
+            "a per-process Map — a cross-replica GET 404s, a restart forgets the run, and a retried POST starts a SECOND " +
+            "push. Point the service at a durable store (DB_BACKEND=mysql|pg), or turn the leader off (unset LEADER_ENABLED) " +
+            "(#193 车4 件2 / staleness ledger P1-9+P1-10 boot invariant)"
+        : undefined;
+}
 export const CONFIG_CROSS_INVARIANTS = [
     {
         id: "run-stale-heartbeat",
@@ -39,57 +84,31 @@ export const CONFIG_CROSS_INVARIANTS = [
         keys: ["imageBakes", "authTokens"],
         restartReason: "bake-runner-credential",
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:bake-runner-credential" },
-        check: ({ next }) => next.imageBakes.enabled && !Object.values(next.authTokens ?? {}).includes(next.imageBakes.runnerPrincipal)
-            ? `IMAGE_BAKES_ENABLED is on but no SERVICE_AUTH_TOKENS entry maps to the runner principal '${next.imageBakes.runnerPrincipal}' — claim/ingest/heartbeat would all 403`
-            : undefined,
+        check: ({ next }) => bakeRunnerCredentialRefusal(next),
     },
     {
         id: "direct-door-anchors",
         keys: ["directApprovalDoor", "durableApproval", "approvalHmacKeys", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud", "requirePrincipal", "operatorPrincipals"],
         restartReason: "direct-door",
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:direct-door-anchors" },
-        check: ({ live, next }) => {
-            if (next.directApprovalDoor) {
-                const missing = [];
-                if (!next.durableApproval)
-                    missing.push("DURABLE_APPROVAL");
-                if (next.approvalHmacKeys.length === 0)
-                    missing.push("APPROVAL_HMAC_KEYS");
-                if (next.principalJwtPubkeys.length === 0)
-                    missing.push("PRINCIPAL_JWT_PUBKEYS");
-                if (!next.principalJwtIss)
-                    missing.push("PRINCIPAL_JWT_ISS");
-                if (!next.principalJwtAud)
-                    missing.push("PRINCIPAL_JWT_AUD");
-                if (next.operatorPrincipals.length === 0)
-                    missing.push("OPERATOR_PRINCIPALS");
-                if (!next.requirePrincipal)
-                    missing.push("REQUIRE_PRINCIPAL");
-                if (missing.length > 0)
-                    return `a half-open direct approval door is refused: missing ${missing.join(", ")}`;
-            }
-            return directDoorConjuncts(live) !== directDoorConjuncts(next)
+        check: ({ live, next }) => halfOpenDirectDoorRefusal(next) ??
+            (directDoorConjuncts(live) !== directDoorConjuncts(next)
                 ? "the direct-door posture (its conjunction of approval/JWT anchors) is decided at boot — refusing to hot-flip it (restart to change the door)"
-                : undefined;
-        },
+                : undefined),
     },
     {
         id: "operator-principals-required",
         keys: ["durableApproval", "requirePrincipal", "operatorPrincipals"],
         restartReason: "operator-principals",
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:operator-principals-required" },
-        check: ({ next }) => next.durableApproval === true && next.requirePrincipal && next.operatorPrincipals.length === 0
-            ? "DURABLE_APPROVAL + REQUIRE_PRINCIPAL with an EMPTY OPERATOR_PRINCIPALS makes isOperator() true-for-all — every authenticated tenant could read every other tenant's pending-approval queue"
-            : undefined,
+        check: ({ next }) => operatorPrincipalsRequiredRefusal(next),
     },
     {
         id: "bake-operator-principals",
         keys: ["imageBakes", "operatorPrincipals"],
         restartReason: "operator-principals",
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:bake-operator-principals" },
-        check: ({ next }) => next.imageBakes.enabled && next.operatorPrincipals.length === 0
-            ? "IMAGE_BAKES_ENABLED with an EMPTY OPERATOR_PRINCIPALS is a world-writable bake door (the runner runs build.sh on the privileged build host)"
-            : undefined,
+        check: ({ next }) => bakeOperatorPrincipalsRefusal(next),
     },
     {
         id: "sensitive-write-patterns",
@@ -111,9 +130,7 @@ export const CONFIG_CROSS_INVARIANTS = [
         keys: ["requireExecutionLane", "remoteExec"],
         restartReason: "execution-lane",
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:require-execution-lane" },
-        check: ({ next }) => next.requireExecutionLane && next.remoteExec === undefined
-            ? "REQUIRE_EXECUTION_LANE=true with no execution lane named (REMOTE_EXEC unset/empty and CONFIG_PROVIDER not \"local\") — the deployment asked to refuse this state"
-            : undefined,
+        check: ({ next }) => executionLaneRequiredRefusal(next),
     },
     {
         id: "leader-host-lane",
@@ -142,9 +159,7 @@ export const CONFIG_CROSS_INVARIANTS = [
         keys: ["leaderEnabled", "dbBackend"],
         restartReason: "leader-lane",
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:leader-durable-store" },
-        check: ({ next }) => next.leaderEnabled && next.dbBackend !== "mysql" && next.dbBackend !== "pg"
-            ? `LEADER_ENABLED with DB_BACKEND=${next.dbBackend} (no external SQL store) degrades the leader-run registry to a per-process Map`
-            : undefined,
+        check: ({ next }) => leaderDurableStoreRefusal(next),
     },
     {
         id: "device-durable-store",

package/dist/config-provider.d.ts

@@ -35,6 +35,22 @@ export type FetchEffectiveResult = {
     readWarnings: readonly EffectiveReadWarning[];
     credentialIdentity?: string;
 } | null;
+/**
+ * 引号段 = **一条规则**:先过 `redactSecrets`;文本里没有引号字符(`"` / `'`)⇒ 原样返回;有 ⇒ 从**第一个**引号到**最后一个**引号(含两端,
+ * 两种引号不分种类)整段换成**一个**指纹;`"` 的个数是奇数、或 `'` 的个数是奇数(落单 / 句子被截断)⇒ 从第一个引号遮到**文末**。
+ * 本函数不辨认任何一个引号是「开头」「收尾」「转义」还是「撇号」—— 生产方原文插值的值自己带引号时,句子里没有信号能把「值里的引号」与「值的边界」
+ * 分开,逐个辨认边界的读法每补一条豁免就多一种漏形。
+ *
+ * 为什么是超集:
+ *  · 配对读法(`/"[^"]*"|'[^']*'/g`)遮住的每一段都夹在两个引号之间,因此落在「第一个引号 … 最后一个引号」之内;
+ *  · 生产方放进引号里的值(不论值里带几个引号、怎么转义、撇号在哪)也都落在这一段之内 —— 值左边至少有一个引号、右边至少有一个引号;
+ *  · 引号个数不成对时遮到文末,只会更宽。
+ * 代价:两个操作数之间的固定词与第一个操作数之后的句子不再可读(例:`roster "#…" (not in the models catalog)`,原句里 `references unknown model`
+ * 一并进了指纹);首个引号之前的部分(引用完整性腿拼在前面的坐标 `rosters.0.models.0: `、固定句头)与末个引号之后的句尾仍是明文。
+ * 仍不覆盖:生产方**不加引号**直接插值的值(本函数看不见值在哪);句子被截断、而两种引号的个数恰好都是偶数的形。真收法在消息生产方给出结构化操作数、
+ * 不回声值(上游 settings-schema)。
+ */
+export declare function redactConfigError(text: string): string;
 /** Sentinel returned by {@link raceBootFetch} when the boot pull outlived its budget — the caller
  *  starts serving on the env fallback and the SAME promise settles in the background (never cancelled). */
 export declare const BOOT_FETCH_DEFERRED: unique symbol;

package/dist/config-provider.js

@@ -8,8 +8,17 @@ import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetc
 import { homedir } from "node:os";
 import { join } from "node:path";
 const OPERAND_FINGERPRINT_KEY = randomBytes(16);
-function redactConfigError(text) {
-    return redactSecrets(text).replace(/"[^"]*"|'[^']*'/g, (m) => `"#${createHmac("sha256", OPERAND_FINGERPRINT_KEY).update(m.slice(1, -1)).digest("hex").slice(0, 8)}"`);
+export function redactConfigError(text) {
+    const s = redactSecrets(text);
+    const first = s.search(/["']/);
+    if (first === -1)
+        return s;
+    const count = (q) => s.split(q).length - 1;
+    const fingerprint = (operand) => `"#${createHmac("sha256", OPERAND_FINGERPRINT_KEY).update(operand).digest("hex").slice(0, 8)}"`;
+    if (count('"') % 2 === 1 || count("'") % 2 === 1)
+        return `${s.slice(0, first)}${fingerprint(s.slice(first + 1))}`;
+    const last = Math.max(s.lastIndexOf('"'), s.lastIndexOf("'"));
+    return `${s.slice(0, first)}${fingerprint(s.slice(first + 1, last))}${s.slice(last + 1)}`;
 }
 export const BOOT_FETCH_DEFERRED = Symbol("boot-fetch-deferred");
 export function raceBootFetch(fetch, budgetMs) {