@sema-agent/server 7.120.0 → 7.121.0

package/dist/boot/shutdown.js

@@ -8,14 +8,16 @@ import { installProcessExitBoundary } from "./exit-boundary.js";
 import { createEngineLeaseTracker } from "./engine-lease.js";
 import { writeExitLast, readExitLast, clearExitLast } from "./exit-last.js";
 import { isScriptRealmRejection, describeRejectionReason } from "../orchestration/hardened-vm-runner.js";
+import { DRAIN_CAUSE_COUNTS_AS_FIRST_STOP_SIGNAL, HARD_STOP_ACTION_ID } from "../fleet/drain-entry.js";
 const HARD_STOP_GRACE_MS = 10_000;
+const FINAL_EXIT_MS = 15_000;
 export function backgroundGraceRemainingMs(a) {
     if (a.softStopped <= 0)
         return 0;
     return Math.max(0, Math.min(a.softStoppedAt + a.graceMs, a.deadlineMs) - a.now);
 }
 export function installShutdownHandlers(ctx) {
-    const { config, logger, server, reaper, fleetReconcile, retentionLane, releaseRetentionLease, otelExporter, breakerState, costQuota, rateLimiter, runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState, storeLiveProbe, configCenter, version, deviceHub, toolApproval, parkCommits, } = ctx;
+    const { config, logger, server, reaper, fleetReconcile, retentionLane, releaseRetentionLease, otelExporter, breakerState, costQuota, rateLimiter, runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState, storeLiveProbe, configCenter, version, deviceHub, toolApproval, parkCommits, servingLease, } = ctx;
     const dataRoot = config.localDataRoot;
     if (dataRoot) {
         const prior = readCrashLast(dataRoot);
@@ -69,12 +71,14 @@ export function installShutdownHandlers(ctx) {
     };
     process.on("unhandledRejection", onUnhandledRejection);
     let closing = false;
+    let closingAt = 0;
     let parentWatch;
     let engineLease;
     const hardShutdown = () => {
         if (closing)
             return;
         closing = true;
+        closingAt = Date.now();
         if (dataRoot)
             clearCrashLast(dataRoot);
         const graceDeadlineMs = Date.now() + HARD_STOP_GRACE_MS;
@@ -101,6 +105,7 @@ export function installShutdownHandlers(ctx) {
         parentWatch?.stop();
         engineLease?.stop();
         storeLiveProbe?.stop();
+        servingLease?.stop();
         void deviceHub?.close().catch((err) => logger.warn("device_hub_close_failed", { err: String(err) }));
         configCenter?.stopRefreshLoop();
         otelExporter?.stop();
@@ -133,7 +138,7 @@ export function installShutdownHandlers(ctx) {
                 .finally(() => backgroundGrace)
                 .finally(() => process.exit(0));
         });
-        const finalExit = setTimeout(() => { logger.warn("hard_shutdown_final_deadline", { afterMs: 15_000 }); process.exit(0); }, 15_000);
+        const finalExit = setTimeout(() => { logger.warn("hard_shutdown_final_deadline", { afterMs: FINAL_EXIT_MS }); process.exit(0); }, FINAL_EXIT_MS);
         finalExit.unref?.();
         server.closeIdleConnections?.();
         const forceClose = setTimeout(() => server.closeAllConnections?.(), HARD_STOP_GRACE_MS);
@@ -141,36 +146,67 @@ export function installShutdownHandlers(ctx) {
     };
     let draining = false;
     let drainStartedAt = 0;
+    let firstStopSignalAt;
     let drainTick;
-    const drainThenShutdown = () => {
-        if (closing || draining)
-            return;
+    let current;
+    const enterDrain = (entry, bySignal = false, at = Date.now()) => {
+        if (current !== undefined)
+            return { ...current, state: "already_draining" };
+        if (closing)
+            return { actionId: HARD_STOP_ACTION_ID, since: closingAt, deadlineAt: closingAt + FINAL_EXIT_MS, state: "already_draining" };
         draining = true;
         drainStartedAt = performance.now();
+        firstStopSignalAt = bySignal ? drainStartedAt : undefined;
+        const since = at;
+        current = { actionId: entry.actionId, since, deadlineAt: entry.deadlineAt };
         drainState.draining = true;
-        deviceHub?.beginDrain({ graceMs: () => config.drainGraceMs });
-        drainState.since = Date.now();
+        drainState.since = since;
+        drainState.actionId = entry.actionId;
+        drainState.deadlineAt = entry.deadlineAt;
+        const windowMs = Math.max(0, entry.deadlineAt - since);
+        const deadlineMono = drainStartedAt + windowMs;
+        deviceHub?.beginDrain({ graceMs: () => windowMs });
+        drainState.yieldInflight?.();
+        toolApproval?.beginDrain();
         void fleetClient?.announceNow();
         const inflight = drainState.inflight?.() ?? 0;
-        logger.info("draining_started", { inflight, graceMs: config.drainGraceMs });
+        logger.info("draining_started", { actionId: entry.actionId, inflight, deadlineAt: entry.deadlineAt, windowMs });
         if (inflight === 0) {
             hardShutdown();
-            return;
+            return { ...current, state: "draining" };
         }
         const tick = setInterval(() => {
             const n = drainState.inflight?.() ?? 0;
-            const elapsed = Math.round(performance.now() - drainStartedAt);
-            if (n === 0 || elapsed >= config.drainGraceMs) {
+            const now = performance.now();
+            if (n === 0 || now >= deadlineMono) {
                 clearInterval(tick);
                 drainTick = undefined;
-                logger.info("drain_complete", { inflight: n, elapsedMs: elapsed, timedOut: n > 0 });
+                logger.info("drain_complete", { actionId: entry.actionId, inflight: n, elapsedMs: Math.round(now - drainStartedAt), timedOut: n > 0 });
                 hardShutdown();
             }
         }, 1_000);
         drainTick = tick;
+        return { ...current, state: "draining" };
+    };
+    const drainOnCause = (cause) => {
+        const at = Date.now();
+        enterDrain({ actionId: cause, deadlineAt: at + config.drainGraceMs }, DRAIN_CAUSE_COUNTS_AS_FIRST_STOP_SIGNAL[cause], at);
     };
+    const enterByRequest = (entry) => enterDrain(entry);
+    drainState.enter = enterByRequest;
     const onStopSignalWhileDraining = (signal) => {
-        const sinceFirst = performance.now() - drainStartedAt;
+        const now = performance.now();
+        if (firstStopSignalAt === undefined) {
+            firstStopSignalAt = now;
+            logger.info("drain_signal_after_request_drain_ignored", {
+                signal,
+                actionId: current?.actionId,
+                deadlineAt: current?.deadlineAt,
+                note: "this drain was entered by a drain request / lease denial / self-exit and its deadline is fixed — the first stop signal does not shorten it; a second stop signal at least DRAIN_SECOND_SIGNAL_MIN_GAP_MS later hard-stops",
+            });
+            return;
+        }
+        const sinceFirst = now - firstStopSignalAt;
         const minGapMs = config.drainSecondSignalMinGapMs;
         if (sinceFirst < minGapMs) {
             logger.info("drain_duplicate_signal_ignored", { signal, sinceFirstMs: Math.floor(sinceFirst), minGapMs });
@@ -180,7 +216,7 @@ export function installShutdownHandlers(ctx) {
         hardShutdown();
     };
     const firstStopSignal = {
-        SIGTERM: drainThenShutdown,
+        SIGTERM: () => drainOnCause("signal:SIGTERM"),
         SIGINT: hardShutdown,
     };
     const onStopSignal = (signal) => {
@@ -200,7 +236,7 @@ export function installShutdownHandlers(ctx) {
         inflight: () => drainState.inflight?.() ?? 0,
         lastActivityAt: () => drainState.lastActivityAt?.() ?? 0,
         isStopped: () => closing || draining,
-        escalate: drainThenShutdown,
+        escalate: () => drainOnCause("signal:SIGHUP"),
         shutdown: hardShutdown,
         idleGraceMs: config.sighupIdleGraceMs,
         log: (event, fields) => logger.info(event, fields),
@@ -231,7 +267,7 @@ export function installShutdownHandlers(ctx) {
             selfExit: (report) => {
                 if (dataRoot)
                     writeExitLast(dataRoot, { version, ...report });
-                drainThenShutdown();
+                drainOnCause("self-exit:attachment");
             },
             lingerMs: config.engineAutoExit ? config.engineLingerMs : Number.POSITIVE_INFINITY,
             ...(config.parentPid !== undefined
@@ -259,6 +295,8 @@ export function installShutdownHandlers(ctx) {
             }
             parentWatch?.stop();
             engineLease?.stop();
+            if (drainState.enter === enterByRequest)
+                drainState.enter = undefined;
         },
     };
 }

package/dist/boot/stage-09-leader.d.ts

@@ -1,14 +1,7 @@
 import type { runStage08 } from "./stage-08-reapers.js";
+import type { DrainState } from "../fleet/drain-entry.js";
 export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>): {
-    drainState: {
-        draining: boolean;
-        since?: number;
-        reason?: string;
-        inflight?: () => number;
-        lastActivityAt?: () => number;
-        attachedStreams?: () => number;
-        lastAttachEndedAt?: () => number;
-    };
+    drainState: DrainState;
     hookWakeBus: {
         deliver?: (sessionId: string, text: string) => Promise<boolean>;
     };

package/dist/boot/stage-10-http-server.d.ts

@@ -1,14 +1,6 @@
 import type { runStage09 } from "./stage-09-leader.js";
 export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>): Promise<{
-    drainState: {
-        draining: boolean;
-        since?: number;
-        reason?: string;
-        inflight?: () => number;
-        lastActivityAt?: () => number;
-        attachedStreams?: () => number;
-        lastAttachEndedAt?: () => number;
-    };
+    drainState: import("../fleet/drain-entry.js").DrainState;
     hookWakeBus: {
         deliver?: (sessionId: string, text: string) => Promise<boolean>;
     };

package/dist/boot/stage-10-http-server.js

@@ -13,9 +13,11 @@ import { SQL_BLOB_DEFAULT_MAX_BYTES } from "../plugins/blob-backend.js";
 import { createStoreLiveProbe } from "../store-live-probe.js";
 import { counterStoreLabel } from "../plugins/store-backend.js";
 import { sessionStoreLabelOf } from "../store-posture.js";
-import { startFleetClientFromEnv } from "../fleet-client.js";
+import { startFleetClientFromConfig } from "../fleet-client.js";
 import { createCenterWiringReader } from "../capabilities/center-wiring.js";
-import { readinessOf } from "../http/readiness.js";
+import { mintEngineSignal } from "../fleet/engine-signal.js";
+import { createServingLeaseClient } from "../fleet/serving-lease.js";
+import { fleetFenceLaneOf } from "../config.js";
 import { createResolveSpec } from "./resolve-spec.js";
 import { executionLaneOf } from "../execution-lane-caps.js";
 import { startFleetReconciler } from "../fleet/fleet-reconciler.js";
@@ -133,6 +135,24 @@ export async function runStage10(ctx) {
     const storeLiveProbe = backend && backend.kind !== "local" && backend.dbNowMs && config.storeProbeIntervalMs > 0
         ? createStoreLiveProbe({ probe: () => backend.dbNowMs(), intervalMs: config.storeProbeIntervalMs, logger })
         : undefined;
+    const fenceLane = fleetFenceLaneOf(config);
+    const servingLease = fenceLane !== undefined
+        ? createServingLeaseClient({
+            center: fenceLane.center,
+            generation: fenceLane.generation,
+            instanceId,
+            dataRoot: config.localDataRoot,
+            outageMaxMs: config.fleetLeaseOutageMaxMs,
+            drain: (entry) => {
+                const enter = drainState.enter;
+                if (enter === undefined)
+                    throw new Error("serving lease denied before the drain entry was installed — refusing to keep serving without a drain");
+                enter(entry);
+            },
+            drainWindowMs: () => config.drainGraceMs,
+            logger: { info: (m, d) => logger.info(m, d ?? {}), warn: (m, d) => logger.warn(m, d ?? {}), error: (m, d) => logger.error(m, d ?? {}) },
+        })
+        : undefined;
     const deployment = {
         sessionStoreLabel: sessionStoreLabelOf(config.sessionBackend, backend?.kind),
         modelReady: () => configCenter.modelReady(),
@@ -154,15 +174,16 @@ export async function runStage10(ctx) {
             },
         },
         restartState: () => configCenter.restartState(),
-        planeDeferredState: () => configCenter.planeDeferredState(),
         configApplyState: () => configCenter.configApplyState(),
         centerCredentialState: () => configCenter.centerCredentialState(),
         modelRefusalsState: () => configCenter.modelRefusalsState(),
+        configHandoffState: () => configCenter.configHandoffState(),
         mcpRevocations,
         mcpRevocationState: () => configCenter.mcpRevocationState(),
         configRefreshNow: () => configCenter.refreshNow(),
         configCenterManagedKeys: () => configCenter.centerManagedKeys(),
         drainState,
+        servingLease: servingLease ? () => servingLease.view() : undefined,
         storePosture,
         centerWiring: createCenterWiringReader({ config, pullState: () => configCenter.centerPullState(), fleetLease, usageReport: fleetUsage !== undefined }),
         storeLiveState: storeLiveProbe ? () => storeLiveProbe.state() : undefined,
@@ -244,19 +265,19 @@ export async function runStage10(ctx) {
             ...("code" in e ? { code: String(e.code) } : {}),
         });
     });
-    const fleetClient = startFleetClientFromEnv(config, {
+    const fleetClient = startFleetClientFromConfig(config, {
         instanceId,
         version: serviceVersion(),
-        readiness: () => readinessOf(deployment),
-        restart: () => deployment.restartState?.(),
+        signal: () => mintEngineSignal({ ...deployment, config }),
         modelRefusals: () => deployment.modelRefusalsState?.(),
+        ...(servingLease ? { onCenterCapabilities: (caps) => servingLease.noteCenterCapabilities(caps) } : {}),
         ...(fleetUsage ? { usage: fleetUsage } : {}),
         logger: { info: (m, d) => logger.info(m, d ?? {}), warn: (m, d) => logger.warn(m, d ?? {}) },
     });
     configCenter.onSelfReportChange(() => void fleetClient?.announceNow());
     if (fleetClient) {
-        const advertised = process.env.FLEET_ADVERTISE_ADDRESS ?? "";
-        logger.info("fleet_client_started", { worker: config.configCenter?.worker, usageReport: fleetUsage !== undefined, announce: advertised !== "", ...(advertised !== "" ? { address: buildDisplaySafeUrl(advertised) } : {}) });
+        const advertised = config.fleetAdvertiseAddress;
+        logger.info("fleet_client_started", { worker: config.configCenter?.worker, usageReport: fleetUsage !== undefined, announce: advertised !== undefined, ...(advertised !== undefined ? { address: buildDisplaySafeUrl(advertised) } : {}) });
     }
     const failoverFirstByte = buildFailoverFirstByteNotice(config);
     if (failoverFirstByte)
@@ -310,7 +331,9 @@ export async function runStage10(ctx) {
         deviceHub: deviceLane?.hub,
         retentionLane: retentionLaneStarted,
         releaseRetentionLease: retentionLaneStore !== undefined ? () => retentionLaneStore.release(instanceId) : undefined,
+        servingLease,
     });
+    servingLease?.resumeStickyDenial();
     return { ...ctx };
 }
 //# sourceMappingURL=stage-10-http-server.js.map

package/dist/capabilities/composite-members.d.ts

@@ -39,7 +39,7 @@ import type { NamedKeysOf } from "../request-key-closure.js";
  */
 export declare const COMPOSITE_CAPABILITY_MEMBERS: {
     readonly deviceExecutor: readonly ["enabled", "protocolVersion", "maxInflightPerDevice", "wsPath", "management"];
-    readonly fleet: readonly ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice"];
+    readonly fleet: readonly ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice", "leaseClient", "generationEcho"];
     readonly memoryEngine: readonly ["backend", "vectorMode"];
     readonly store: readonly ["declared", "backend", "durable", "degradedReason", "sql"];
     readonly centerWiring: readonly ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "caller"];

package/dist/capabilities/composite-members.js

@@ -1,6 +1,6 @@
 export const COMPOSITE_CAPABILITY_MEMBERS = {
     deviceExecutor: ["enabled", "protocolVersion", "maxInflightPerDevice", "wsPath", "management"],
-    fleet: ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice"],
+    fleet: ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice", "leaseClient", "generationEcho"],
     memoryEngine: ["backend", "vectorMode"],
     store: ["declared", "backend", "durable", "degradedReason", "sql"],
     centerWiring: ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "caller"],

package/dist/config-catalog.js

@@ -1,8 +1,9 @@
 import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES } from "@sema-agent/core";
+import { GLOBAL_SCOPE } from "@sema-agent/settings-schema/api/scopes";
 import { CENTER_CREDENTIAL_ENV, DOMAIN_SCHEMAS } from "@sema-agent/settings-schema";
 import { CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS, CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS, CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS } from "./center-credential-renewer.js";
 import { THINKING_FORMATS } from "./model-compat.js";
-import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CONFIG_PROVIDER_WORDS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
+import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CENTER_BASE_URL_RULE, CONFIG_PROVIDER_WORDS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
 import { webSearchProviderFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
@@ -93,7 +94,7 @@ export const CONFIG_CATALOG = [
     r("CONFIG_BOOT_FETCH_BUDGET_MS", "integrations", "number", "boot 首拉配置的抢答窗(ms;过窗以 env/兜底起服,拉取转后台热应用)", { staticDefault: "1500", configKey: "configBootFetchBudgetMs" }),
     r("CONFIG_CATALOG_ENABLED", "auth", "boolean", "本目录端点 GET /v1/config/catalog 的旋钮(operator-only 面;合规部署可关 ⇒ 路径 404 + 能力位翻假)", { staticDefault: "true", danger: SEC, configKey: "configCatalogEnabled" }),
     r("CONFIG_LKG_DURABLE", "integrations", "boolean", "LKG 跨重启 handoff(严格 'true' 才开:重启先用 LKG 起服,tier 候选借此落地)", { staticDefault: "false" }),
-    r("CONFIG_LKG_ENABLED", "integrations", "boolean", "last-known-good 配置盘缓存读写开关(仅远程 provider 有意义)", { staticDefault: "true" }),
+    r("CONFIG_LKG_ENABLED", "integrations", "boolean", "last-known-good 配置盘缓存读写开关(仅远程 provider 有意义)", { staticDefault: "true", configKey: "configLkgEnabled" }),
     r("CONFIG_LKG_PATH", "integrations", "path", "LKG 落盘路径(设了 ⇒ 派生读拒行:这条路径与它的真实落点各一行,按路径段串匹配 —— 任意深度出现即拒、大小写不敏感,用户仓里同段串的路径一并读不到;空串拒启)", { derivedDefaultNote: "缺席 ⇒ 配置根(SEMA_CONFIG_DIR,缺省 ~/.sema)下按 worker + 凭证身份分箱派生", configKey: "configLkgPath" }),
     r("CONFIG_LOCAL_DIR", "integrations", "path", "本地配置源根(config.d/<domain>.json);兼作数据根回落链一环", { configKey: "configLocalDir", danger: DATA }),
     r("CONFIG_PROVIDER", "integrations", "enum", "配置源双模选择(闭集,逐字比较;认不出的词 ⇒ 拒启,S-841)", { enumValues: CONFIG_PROVIDER_WORDS, derivedDefaultNote: "缺席:SEMA_REGISTRY_URL 在场 ⇒ remote,否则纯 env(无管道)", configKey: "configProvider" }),
@@ -127,7 +128,7 @@ export const CONFIG_CATALOG = [
     r("DOCKER_PIDS_LIMIT", "orchestration", "number", "local-docker fork-bomb 背栓(--pids-limit;非法值回 adapter 默认 512+warn)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ adapter 默认 512" }),
     r("DOCKER_SANDBOX_ENV", "orchestration", "secret", "local-docker 车道每条 docker exec 以 -e 注入的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值不进 spec/center/日志;与 LSP_ENV_ALLOW / E2B_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { danger: SEC }),
     r("DRAIN_GRACE_MS", "limitsHttp", "number", "SIGTERM 优雅排空窗(ms;期间新计费提交 503+Retry-After)。出厂默认是**服务器部署**的取值;壳自 spawn 的引擎会被壳注入更短的窗 ⇒ 排壳形关机预算时以本行的 effectiveValue(= 本进程实际生效值)为准,不照抄 staticDefault", { staticDefault: String(10 * 60 * 1000), configKey: "drainGraceMs", center: cLimits("drainGraceMs") }),
-    r("DRAIN_SECOND_SIGNAL_MIN_GAP_MS", "limitsHttp", "number", `排空期「第二发信号 = 硬停」的最小间隔(ms;锚 = 排空起点。SIGTERM / SIGINT 与起点相隔不足 ⇒ 同一拍的重复投递,一行 drain_duplicate_signal_ignored 后忽略、排空继续;0 = 关,恒按第二发硬停;须为 [${DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS.minMs}, ${DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS.maxMs}] 内十进制整数(上界 = DRAIN_GRACE_MS 地板),小数 / 负数 / 越界拒启)`, { staticDefault: String(DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS), configKey: "drainSecondSignalMinGapMs" }),
+    r("DRAIN_SECOND_SIGNAL_MIN_GAP_MS", "limitsHttp", "number", `排空期「第二发信号 = 硬停」的最小间隔(ms;锚 = 本次排空的第一发停止信号 —— SIGTERM / SIGHUP 升级进的排空,入口那一发就是它;排空口 / 租约被拒 / 附着租约自退进的排空,到达的第一发被吸收、不缩短期限。SIGTERM / SIGINT 与锚相隔不足 ⇒ 同一拍的重复投递,一行 drain_duplicate_signal_ignored 后忽略、排空继续;0 = 关,恒按第二发硬停;须为 [${DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS.minMs}, ${DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS.maxMs}] 内十进制整数(上界 = DRAIN_GRACE_MS 地板),小数 / 负数 / 越界拒启)`, { staticDefault: String(DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS), configKey: "drainSecondSignalMinGapMs" }),
     r("DURABLE_APPROVAL", "approval", "boolean", "durable suspend/resume HITL(需 SQL 店;决定 checkpointStore 与 /v1/approvals 面的存在性)", { danger: SEC, derivedDefaultNote: "posture 三态(S-178):显式词恒赢,缺席 = 单用户(REQUIRE_PRINCIPAL≠true)且有耐久店 ⇒ on / 多租户或无耐久店 ⇒ off;生效来源见 GET /v1/diagnostics/wiring 的 serverGates.durableApproval.source", configKey: "durableApproval" }),
     r("E2B_ALLOW_NET", "orchestration", "boolean", "e2b 沙箱出网许可", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 不铸键(adapter 默认允许)" }),
     r("E2B_API_KEY", "orchestration", "secret", "E2B 车道 API 凭据(REMOTE_EXEC=e2b 必需件)", { danger: [...SEC, ...BILL] }),
@@ -147,8 +148,11 @@ export const CONFIG_CATALOG = [
     r("EXPERIMENTAL_OBSERVER_AGENTS", "orchestration", "boolean", "observer 开闸线(实验面 ship-dark;多租户只认 center caps,env 被忽略)", { staticDefault: "false", configKey: "experimentalObserverAgents" }),
     r("FILE_HISTORY_CAPTURE", "store", "boolean", "文件历史**捕获**总开关(三条车道同义)。关 = 不再捕获任何改动文件的首次快照(落 core 的部署捕获位 `RunnerDeps.fileHistoryCapture: \"off\"`,能力词 `fileHistoryCapture` 翻 off);S-724(7.104.0)起**只关捕获**:历史店照接,已存历史照常 restoreFiles / rewindFilesTo / 2c session-sync。关掉 ≠ 删掉:已捕获的历史不被批量删除,仍按会话删除与留存规则清理 —— 要清存量走 DELETE 会话或留存旋钮;没有「整库历史不可用」的旋钮", { staticDefault: "true", danger: DATA, configKey: "fileHistoryCapture" }),
     r("FILE_HISTORY_RETENTION_KEEP", "store", "number", "per-file rewind 历史的保留上限(与 core FileStorageBackend 同域键形,三条车道一套语义)", { danger: DATA, derivedDefaultNote: "缺席 ⇒ core 缺省 100" }),
-    r("FLEET_ADVERTISE_ADDRESS", "integrations", "url", "fleet 面向 center 公告的本 worker 可达地址(中心车道配齐 + 本键 ⇒ 公告环;坏形拒启。用量环不看本键,S-866 ④)"),
+    r("FLEET_ADVERTISE_ADDRESS", "integrations", "url", "fleet 面向 center 公告的本 worker 可达地址(中心车道配齐 + 本键 ⇒ 公告环;无条件解析,非 http(s) 拒启,空串 = 未设。用量环不看本键,S-866 ④)", { configKey: "fleetAdvertiseAddress" }),
+    r("FLEET_GENERATION", "integrations", "string", "fleet 成员的代际(配置渲染器写;引擎回声到心跳与 /health 的 generation)。缺席 ⇔ 非 fleet 成员(不续服务租约、不受围栏);在场必须是规范十进制串(\"0\" / \"7\";空串、前导零、符号、空白拒启)", { danger: SEC, configKey: "fleetGeneration" }),
     r("FLEET_LEASE_FAIL_CLOSED", "integrations", "boolean", "租约连接级失败(中心鉴权拒 / 凭证不可读 / 不可达 / 5xx / 超时 / 坏体)时计费入口拒 503 fleet.lease_unavailable(true)还是放行(false);409 not-lease 与耗尽 429 不受它管;词表外拒启", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 按部署姿态派生:REQUIRE_PRINCIPAL=true ⇒ true(多租:额度是安全轴);单用户 ⇒ false(AP 姿态)。显式值压过派生。生效值见 caps centerWiring.failMode", configKey: "fleetLeaseFailClosed" }),
+    r("FLEET_LEASE_OUTAGE_MAX_MS", "integrations", "number", "服务租约中心不可达的容忍上限 T_max(ms):租约过期满这么久 ⇒ 新计费提交 503 state.lease_expired(取消 / HITL 应答 / 续跑 / 读面照放行,在飞不动,/readyz 不翻);只在 fleet 成员 ∧ 中心宣告 servingLease 能力位时生效;< 60000(租约 TTL 地板)或非整数拒启", { danger: SEC, staticDefault: String(FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS), configKey: "fleetLeaseOutageMaxMs" }),
+    r("FLEET_SCOPE", "integrations", "string", "本引擎所在的租户 scope(配置渲染器为多租引擎写;唯一读者 = 排空口 POST /v1/admin/drain 的身份比对,请求不带 scope 也读成缺省 scope)。在场必须是 scope id 形(小写字母 / 数字 / 内部连字符,1–64;空串拒启);与 FLEET_GENERATION 不联动(成员缺席 ⇒ 缺省 scope)。续租体与心跳不带它(scope 由中心凭证绑定)", { danger: SEC, staticDefault: GLOBAL_SCOPE, configKey: "fleetScope" }),
     r("FORK_ENABLED", "orchestration", "boolean", "CC /fork(core Fork 工具)装配开关", { derivedDefaultNote: "posture 三态:缺席 = 单用户 ⇒ on / 多租户 ⇒ off(per-principal entitlement 另判)", configKey: "forkEnabled" }),
     r("GATEWAY_MAX_RETRIES", "modelPlane", "number", "openai 兼容腿每次调用重试上限", { derivedDefaultNote: "缺席 ⇒ 不传引擎,引擎默认当家" }),
     r("GIT_API_BASEURL", "integrations", "url", "repo 工具的 Git host API base", { configKey: "gitApiBaseUrl" }),
@@ -399,9 +403,11 @@ export const CONFIG_CATALOG = [
     r("SEMA_PIP_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 pip index 地址"),
     r("SEMA_REGISTRY_ADMIN_TOKEN", "integrations", "secret", "写 center 的管理凭证(仅 boot 上报执行公钥用;刻意不入 ServiceConfig —— 不进 configHash/日志面)", { danger: SEC, scope: "bootstrap-only" }),
     r("SEMA_REGISTRY_DRY_RUN", "integrations", "boolean", "center 腿 dry-run(拉而不应用)", { staticDefault: "false" }),
+    r("SEMA_REGISTRY_LIVE_URL", "integrations", "url", `fleet 活性组(心跳 / 注销、服务租约 = settings-schema FLEET_LIVE_PATHS)的中心基址:给管理面在就绪门后、活性面另走一条不看就绪的入口的部署。缺席 = SEMA_REGISTRY_URL。${CENTER_BASE_URL_RULE}`),
     r(CENTER_CREDENTIAL_ENV.token, "integrations", "secret", `center 拉取凭据(值形;与 ${CENTER_CREDENTIAL_ENV.tokenFile} 二选一,都设=拒启)`, { danger: SEC }),
     r(CENTER_CREDENTIAL_ENV.tokenFile, "integrations", "path", `center 拉取凭据文件(每条中心请求都重读 ⇒ 轮换 / 换账号不重启;与 ${CENTER_CREDENTIAL_ENV.token} 二选一,都设=拒启;内容两种类:裸行 = 静态 bearer / JSON 信封 user-session = 人的登录会话(可续签,S-698);文件不可读 / 为空 = 响亮 + 健康态 unreadable,不当作无凭证;内容读不成 / 多租户读到信封 = 拒启)`, { danger: SEC }),
-    r("SEMA_REGISTRY_URL", "integrations", "url", "sema-registry 地址(设了=remote 配置源开关)"),
+    r("SEMA_REGISTRY_URL", "integrations", "url", `sema-registry 地址(设了=remote 配置源开关)。${CENTER_BASE_URL_RULE}`),
+    r("SEMA_REGISTRY_WEB_URL", "integrations", "url", `中心 web 面的固定基址:引擎原样转述到 /health 的 center.webBaseUrl,壳按它拼会话深链(路径归壳)。缺席即缺席(引擎不拼不猜);只在接了中心(SEMA_REGISTRY_URL)时挂。${CENTER_BASE_URL_RULE}`),
     r("SEMA_REGISTRY_WORKER", "integrations", "string", "本 worker 在 center 的名字(per-worker effective)"),
     r("SEMA_UV_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 uv index 地址"),
     r("SEMA_UV_PY_MIRROR", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 uv python 分发镜像地址"),

package/dist/config-center/center-request.d.ts

@@ -8,13 +8,15 @@ export declare const SETTINGS_SCHEMA_MAJOR: string;
 /** 一个中心端点 = 基址 + 凭证来源(`ServiceConfig.configCenter` 结构上满足)。 */
 export interface CenterEndpoint {
     readonly baseUrl: string;
+    /** 活性组的基址(env `SEMA_REGISTRY_LIVE_URL` 的回声;缺席 ⇒ 活性组也打 {@link baseUrl})。「缺席 = 主基址」这条规则只在 {@link centerFetch} 读。 */
+    readonly liveBaseUrl?: string | undefined;
     readonly credential: CenterCredentialSource;
 }
 /**
  * S-866 ④ —— 「中心车道配齐」的**唯一**谓词:基址 ∧ **声明了**凭证(S-651:按声明,不按此刻读不读得出)∧ worker。
  *
  * 三处同调、不许各抄一份门:租约管理器(`fleet-lease.ts` `createFleetLeaseFromEnv`)、fleet 客户端的用量环
- * (`fleet-client.ts` `startFleetClientFromEnv`)、用量累加器(`boot/budget-tracing.ts`)。公告环另要一件可达性声明
+ * (`fleet-client.ts` `startFleetClientFromConfig`)、用量累加器(`boot/budget-tracing.ts`)。公告环另要一件可达性声明
  * `FLEET_ADVERTISE_ADDRESS` —— 那是公告环自己的第四件,不在本谓词里:用量是出站上报,与「中心能不能打到我」无关
  * (7.105.0 及以前累加器与用量环都挂在公告地址上,不公告的引擎于是从不报用量,租约的已耗量只剩中心自己的估计)。
  */
@@ -47,6 +49,8 @@ export type CenterRoute = {
     readonly kind: "fleet-instances";
 } | {
     readonly kind: "fleet-usage";
+} | {
+    readonly kind: "fleet-serving-lease";
 } | {
     readonly kind: "execution-keys";
 };
@@ -68,6 +72,17 @@ export interface CenterRequestInit {
     readonly timeoutMs: number;
     readonly fetchImpl?: typeof fetch;
 }
+/**
+ * 「后面要拼路径的基址」的**唯一**判官 —— 中心基址三席(`SEMA_REGISTRY_URL` / `SEMA_REGISTRY_LIVE_URL` / `SEMA_REGISTRY_WEB_URL`)与
+ * 本实例的公告地址(`FLEET_ADVERTISE_ADDRESS`,中心往它后面拼 `/v1/...`)同读:可解析的 URL,scheme 是 http / https(Node 的 fetch 认
+ * `file://` / `data:`,配错的地址不许变成读本地文件),**不带** userinfo / query / fragment(凭据不进一个会被记日志、转述、拼路径的值;
+ * query / fragment 挂在基址上,一拼路径就落到错的位置:`http://x?a=1` + `/api/…` = `http://x?a=1/api/…`)。起服时 `config.ts` 判(拒启),
+ * 请求期 {@link centerFetch} 对同一份基址再判一次(自拼 `ServiceConfig` 的嵌入方也吃同一条规则)。合格 ⇒ `undefined`;否则交回**点名规则**
+ * 的短语(只回显 scheme,不回显值)。
+ */
+/** 判官「scheme 不是 http / https」那条规则的不变句 —— 拒句 = `<席> ${PATH_BASE_SCHEME_RULE} (got "<scheme>")`(只回显 scheme)。钉读这一只,不手抄。 */
+export declare const PATH_BASE_SCHEME_RULE = "scheme must be http or https";
+export declare function pathBaseUrlFlaw(raw: string): string | undefined;
 /**
  * S-698 —— 凭证续签:`POST {issuer}/api/v1/auth/token/refresh`,form `refresh_token=…`(settings-schema `AUTH_V1_PATHS.tokenRefresh`)。
  *  · 以 `issuer` 为根(可带路径前缀;同源与否由续签器先判,本函数只装配);query / fragment 不带过去。

package/dist/config-center/center-request.js

@@ -1,5 +1,6 @@
 import settingsSchemaPackage from "@sema-agent/settings-schema/package.json" with { type: "json" };
 import { AUTH_V1_PATHS } from "@sema-agent/settings-schema/api/auth";
+import { FLEET_LIVE_PATHS, FLEET_PATHS } from "@sema-agent/settings-schema/fleet";
 import { CenterCredentialUnavailableError } from "../center-credential.js";
 export const SCHEMA_MAJOR_HEADER = "x-sema-schema-major";
 export const CENTER_PULL_TIMEOUT_MS = 8000;
@@ -43,15 +44,41 @@ function routePath(route, kind) {
         case "prompt-blob":
             return `${contentRoot(kind)}/prompts/blobs/${encodeURIComponent(route.digest)}`;
         case "fleet-leases":
-            return "/api/fleet/leases";
+            return FLEET_PATHS.quotaLeases;
         case "fleet-instances":
-            return "/api/fleet/instances";
+            return FLEET_PATHS.instances;
         case "fleet-usage":
-            return "/api/fleet/usage";
+            return FLEET_PATHS.usage;
+        case "fleet-serving-lease":
+            return FLEET_PATHS.servingLease;
         case "execution-keys":
             return "/api/config/execution-keys";
     }
 }
+export const PATH_BASE_SCHEME_RULE = "scheme must be http or https";
+export function pathBaseUrlFlaw(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        parsed = undefined;
+    }
+    if (parsed === undefined)
+        return "is not a parseable URL (no scheme? it must look like http(s)://host[:port][/path])";
+    const broken = [
+        ...(parsed.protocol !== "http:" && parsed.protocol !== "https:" ? [`${PATH_BASE_SCHEME_RULE} (got "${parsed.protocol.replace(/:$/, "")}")`] : []),
+        ...(parsed.username !== "" || parsed.password !== "" ? ["must not carry userinfo (credentials never ride in a base URL: it is logged, reported and has paths appended)"] : []),
+        ...(parsed.search !== "" || raw.includes("?") ? ["must not carry a query (request paths are appended to this base)"] : []),
+        ...(parsed.hash !== "" || raw.includes("#") ? ["must not carry a fragment (request paths are appended to this base)"] : []),
+    ];
+    return broken.length === 0 ? undefined : broken.join("; ");
+}
+function assertPathBaseUrl(raw, what) {
+    const flaw = pathBaseUrlFlaw(raw);
+    if (flaw !== undefined)
+        throw new Error(`${what} ${flaw}`);
+}
 function assertHttpScheme(url, what) {
     const scheme = url.protocol;
     if (scheme !== "http:" && scheme !== "https:")
@@ -72,7 +99,7 @@ export async function centerTokenRefresh(issuer, refreshToken, init) {
     });
 }
 export async function centerFetch(center, route, init) {
-    assertHttpScheme(new URL(center.baseUrl), "SEMA_REGISTRY_URL");
+    assertPathBaseUrl(center.baseUrl, "SEMA_REGISTRY_URL");
     const cred = center.credential.read();
     if (!cred.ok)
         throw new CenterCredentialUnavailableError(cred.reason);
@@ -83,7 +110,11 @@ export async function centerFetch(center, route, init) {
         headers["content-type"] = "application/json";
     if (init.etag)
         headers["if-none-match"] = init.etag;
-    const url = `${center.baseUrl.replace(/\/+$/, "")}${routePath(route, cred.kind)}`;
+    const path = routePath(route, cred.kind);
+    const liveBase = FLEET_LIVE_PATHS.includes(path) ? center.liveBaseUrl : undefined;
+    if (liveBase !== undefined)
+        assertPathBaseUrl(liveBase, "SEMA_REGISTRY_LIVE_URL");
+    const url = `${(liveBase ?? center.baseUrl).replace(/\/+$/, "")}${path}`;
     const res = await (init.fetchImpl ?? fetch)(url, {
         method: init.method ?? "GET",
         headers,

package/dist/config-types.d.ts

@@ -121,6 +121,16 @@ export declare const DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS: {
     readonly maxMs: 10000;
 };
 export declare const DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS = 250;
+/**
+ * 本仓读一个租户 scope 的**唯一**读法:给了就是它,缺席 = settings-schema 的缺省 scope(`GLOBAL_SCOPE`;缺省值只在契约包里写一处)。
+ * 引擎自己的 scope(`config.ts` 解析 env `FLEET_SCOPE`)与排空请求的 `scope`(`fleet/drain-entry.ts`)走同一只 —— 两侧缺席的读法不会分家。
+ * 住在本叶(而不在 `fleet/drain-entry.ts`):`config.ts` 读它,而 drain-entry 值引 `plugins/store-contracts.ts`,config 不值引 plugins 层。
+ */
+export declare function fleetScopeOf(raw: string | undefined): string;
+/** 中心基址三席(`SEMA_REGISTRY_URL` / `SEMA_REGISTRY_LIVE_URL` / `SEMA_REGISTRY_WEB_URL`)的形句 —— 判官 `config-center/center-request.ts` `pathBaseUrlFlaw` 一只(公告地址同判),配置目录三行同读这一句。 */
+export declare const CENTER_BASE_URL_RULE = "\u8BBE\u4E86\u5C31\u5FC5\u987B\u662F\u53EF\u89E3\u6790\u7684 http(s) URL,\u4E14\u4E0D\u5E26\u51ED\u636E / query / fragment(\u57FA\u5740\u540E\u9762\u8981\u62FC\u8DEF\u5F84);\u574F\u5F62\u62D2\u542F(\u6CA1\u63A5\u4E2D\u5FC3\u4E5F\u62D2)";
+/** 编排器片 2:`FLEET_LEASE_OUTAGE_MAX_MS` 的缺省(24 h)—— 中心 / 库故障、中心降级在今天都靠 LKG 无限期容忍,10 分钟级的窗会把它们变成数据面停服。 */
+export declare const FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS = 86400000;
 /**
  * S-753(core 7.33.0 #1121)—— `MODEL_FIRST_BYTE_TIMEOUT_MS`(→ core `BrainTimeoutConfig.firstByteTimeoutMs`,`fetch()` → 响应头
  * 的等待)的**合法域**,闭区间、整数 ms。解析器(`config.ts`)与目录行(`config-catalog.ts`)共读这一处。
@@ -2001,6 +2011,9 @@ export interface ServiceConfigFlat {
     /** LKG 落盘路径的覆写(`CONFIG_LKG_PATH`,绝对路径;单一读法 `config-lkg.ts` `lkgPathOverrideOf`)。缺席 = LKG 落在配置根下按箱派生。
      *  读者:LKG 的落盘 / 读回(`boot/config-center.ts`)与读拒行(部署姿态座席族 —— LKG 在哪,读拒就守哪,`lkgReadDenyRows`)。 */
     configLkgPath?: string;
+    /** 远程配置的 LKG(last-known-good)盘缓存读写开关(`CONFIG_LKG_ENABLED`,缺省开;只对远程 provider 有意义)。单一读法:`loadConfig` 铸这一席
+     *  (同时登记极性行),`boot/config-center.ts` 的两个读点(boot 的 LKG 来源判定、skill 正文缓存目录)只读它 —— 起服之后改环境变量不影响。 */
+    configLkgEnabled: boolean;
     /** Structured log level. */
     logLevel: "debug" | "info" | "warn" | "error";
     /** Per-principal request cap per minute on task/run endpoints. 0 disables. */
@@ -2090,9 +2103,15 @@ export interface ServiceConfigFlat {
      *  `credential`(S-651,BREAKING:取代 7.98.0 及以前的 `token: string` 启动快照):凭证来源活对象
      *  (`center-credential.ts`),每条出站请求经它取一次值 —— `SEMA_REGISTRY_TOKEN`(值)或
      *  `SEMA_REGISTRY_TOKEN_FILE`(每次读文件,轮换 / 换账号不重启)二选一(两键名与判官的属主 = settings-schema
-     *  `CENTER_CREDENTIAL_ENV` / `judgeCenterCredentialDeclaration`,S-742)。 */
+     *  `CENTER_CREDENTIAL_ENV` / `judgeCenterCredentialDeclaration`,S-742)。
+     *  `liveBaseUrl`(编排器片 2,env `SEMA_REGISTRY_LIVE_URL`):fleet 活性组(心跳 / 注销、服务租约 —— settings-schema `FLEET_LIVE_PATHS`)的基址,
+     *  给「管理面在就绪门后、活性面另走一条不看就绪的入口」的部署;缺席 ⇒ 活性组也打 `baseUrl`(这条缺省只在 `centerFetch` 读)。
+     *  `webBaseUrl`(7.121.0,env `SEMA_REGISTRY_WEB_URL`):这个中心的 **web 面固定基址**,运维声明、引擎原样转述到 `/health.center.webBaseUrl`
+     *  (壳按它拼会话深链;路径怎么拼归壳)。起服时判成「可拼路径的基址」:http(s)、不带凭据 / query / fragment,否则拒启;缺席即缺席,引擎不拼不猜。 */
     configCenter?: {
         baseUrl: string;
+        liveBaseUrl?: string;
+        webBaseUrl?: string;
         credential: CenterCredentialSource;
         dryRun: boolean;
         worker?: string;
@@ -2103,6 +2122,23 @@ export interface ServiceConfigFlat {
      *  显式值压过派生(部署级旋钮无条件,与 `READ_FACE` 缺省按 posture 派生 S-167 同形)。只在装了租约管理器的部署上有意义
      *  (`lease:"absent"` 的部署不参与);生效值上 caps `centerWiring.failMode`。 */
     fleetLeaseFailClosed: boolean;
+    /** 编排器片 2:fleet 成员的**代际**(env `FLEET_GENERATION`,settings-schema `FLEET_GENERATION_ENV`;配置渲染器是唯一写手)。
+     *  缺席 ⇔ 非 fleet 成员(单机形:不续服务租约、不受围栏)。在场则必须是规范十进制串(`"0"`、`"7"`;不许前导零 / 符号 / 空白 / 空串),
+     *  否则拒启 —— 「设了但读不成代际」是渲染器或手配的事故,不是「非成员」。引擎把它原样回声到心跳与 `/health`(`generation`)。 */
+    fleetGeneration?: string;
+    /** 编排器片 2:本引擎所在的**租户 scope**(env `FLEET_SCOPE`,配置渲染器写)。`loadConfig` 解析一次:缺席 ⇒ 缺省 scope(settings-schema
+     *  `GLOBAL_SCOPE`,经本文件的 `fleetScopeOf` —— 本仓唯一读法);在场必须是 settings-schema `ScopeId` 形,否则拒启。
+     *  唯一读者 = 排空口 `POST /v1/admin/drain` 的身份比对;续租体与心跳不带它(那两处的 scope 由中心凭证绑定)。 */
+    fleetScope: string;
+    /** `FLEET_ADVERTISE_ADDRESS`:本实例对中心公告的可达地址(运维声明;k8s pod IP / docker alias / 127.0.0.1:port 只有部署环境自己知道)。
+     *  `loadConfig` **无条件**解析一次:未设 / 空串 ⇒ 缺席(公告环不装);在场必须是可解析的 http(s) URL,否则拒启。读者:fleet 公告环、
+     *  围栏判官 `fleetFenceLaneOf`、`/health.center.sessionsVisible`、启动日志 —— 都读这一席,不读 env。 */
+    fleetAdvertiseAddress?: string;
+    /** 编排器片 2:服务租约**中心不可达的容忍上限** `T_max`(ms;env `FLEET_LEASE_OUTAGE_MAX_MS`)。租约过期(中心不可达 / 答 unknown)之后照常服务,
+     *  直到过期满这么久 ⇒ 新计费提交 503 `state.lease_expired`(取消 / HITL 应答 / 续跑 / 读面照放行),在飞不动、不自停;中心恢复授予即恢复。
+     *  缺省 86 400 000(24 h);地板 = 服务租约 TTL 地板(settings-schema `SERVING_LEASE_TTL_FLOOR_MS`,60 s);不许 0 / 无穷,坏值拒启。
+     *  只在租约生效时有意义(fleet 成员 ∧ 中心宣告了 `servingLease` 能力位)。 */
+    fleetLeaseOutageMaxMs: number;
     /** S-698(design-325 §2):中心凭证**续签提前量**(ms)—— `SEMA_REGISTRY_TOKEN_FILE` 指向人的登录会话信封
      *  (`kind:"user-session"`)时,访问令牌离到期 ≤ 本值即由引擎续签并原子改写同一文件(`center-credential-renewer.ts`)。
      *  缺省 5 min;`0` = 关续签、只读信封(壳负责续);其余必须是整数毫秒且落在 `CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS`(一次续签请求的
@@ -2134,13 +2170,13 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  config 这一层它只是一句声明。 */
 export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "agentConfigDir" | "configLkgPath">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "drainSecondSignalMinGapMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */
 export type ServiceObservabilityConfig = Pick<ServiceConfigFlat, "metricsToken" | "traceToken" | "toolTrace" | "traceThinking" | "logLevel" | "otel">;
 /** 组:integrations(外部集成)。`mcpServers` / `a2aPeers` 由 sema-registry 适配器填(无 env 腿),归本组。 */
-export type ServiceIntegrationsConfig = Pick<ServiceConfigFlat, "pluginsAllowHosts" | "mcpServers" | "a2aPeers" | "a2aServe" | "configBootFetchBudgetMs" | "gitApiBaseUrl" | "gitApiToken" | "gitApiKind" | "defaultScenario" | "skillsDir" | "centerCredentialRenewLeadMs" | "configCenter" | "fleetLeaseFailClosed" | "configProvider" | "configLocalDir">;
+export type ServiceIntegrationsConfig = Pick<ServiceConfigFlat, "pluginsAllowHosts" | "mcpServers" | "a2aPeers" | "a2aServe" | "configBootFetchBudgetMs" | "gitApiBaseUrl" | "gitApiToken" | "gitApiKind" | "defaultScenario" | "skillsDir" | "centerCredentialRenewLeadMs" | "configCenter" | "fleetLeaseFailClosed" | "fleetGeneration" | "fleetScope" | "fleetAdvertiseAddress" | "fleetLeaseOutageMaxMs" | "configProvider" | "configLocalDir">;
 /** 九个组槽。每组恒在场(`loadConfig` / `attachConfigGroups` 装好才交出配置),故不可选——新代码写
  *  `config.modelPlane.model` 不需要 `?.`(可选组会把 `Model` 污染成 `Model | undefined`)。 */
 export interface ServiceConfigGroups {

package/dist/config-types.js

@@ -1,4 +1,5 @@
 import { DRAIN_GRACE_FLOOR_MS } from "@sema-agent/settings-schema/fleet";
+import { GLOBAL_SCOPE } from "@sema-agent/settings-schema/api/scopes";
 export const TASK_WRITE_FACE_ESCALATIONS = ["allow", "refuse"];
 export const RETENTION_MODES = ["audit-only", "enforce"];
 export const CONFIG_PROVIDER_WORDS = ["local", "remote"];
@@ -8,6 +9,11 @@ export const AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS = { minMs: 1_000, maxMs: MAX_TI
 export { DRAIN_GRACE_FLOOR_MS };
 export const DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS = { minMs: 0, maxMs: DRAIN_GRACE_FLOOR_MS };
 export const DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS = 250;
+export function fleetScopeOf(raw) {
+    return raw ?? GLOBAL_SCOPE;
+}
+export const CENTER_BASE_URL_RULE = "设了就必须是可解析的 http(s) URL,且不带凭据 / query / fragment(基址后面要拼路径);坏形拒启(没接中心也拒)";
+export const FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS = 86_400_000;
 export const FIRST_BYTE_TIMEOUT_BOUNDS = { minMs: 0, maxMs: MAX_TIMER_DELAY_MS };
 export const RESILIENCE_DEFAULTS = {
     firstTokenTimeoutMs: { env: "MODEL_FIRST_TOKEN_TIMEOUT_MS", value: 600_000 },