@sema-agent/server 7.122.0 → 7.123.0

package/dist/config.js

@@ -28,23 +28,20 @@ import { lkgPathOverrideOf } from "./config-lkg.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
-import { allowLayerEntryCountIssue, describeEmptyToolSegmentEntry, describeInertRuleEntries, emptyToolSegmentEntryOf, inertRuleEntriesOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { allowLayerEntryCountIssue, describeInertRuleEntries, inertRuleEntriesOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { buildHttpUrlRefusal, httpUrlFlaws } from "./url-shape.js";
-import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
+import { csvOf, envLaneTable, judgeModelRouteGap, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
 import { displayListEntry } from "./list-entry-display.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 import { allowlistedEnv } from "./server-secret-env.js";
 import { ENV_NAME_ALLOWLIST_KNOBS, ENV_NAME_ALLOWLIST_KNOB_NAMES, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
-    return (process.env[name] ?? "")
-        .split(",")
-        .map((s) => s.trim())
-        .filter(Boolean);
+    return csvOf(process.env[name]);
 }
 export function parseAutonomy(raw) {
     const v = raw?.trim();
@@ -312,14 +309,6 @@ export function logConfigDiagnostics(logger) {
         }
     }
 }
-function firstSetEnv(...names) {
-    for (const n of names) {
-        const v = process.env[n];
-        if (v !== undefined && v !== "")
-            return v;
-    }
-    return undefined;
-}
 function clampEnvWithWarn(name, fallback, min, max = Number.POSITIVE_INFINITY) {
     const n = numEnv(name, fallback);
     const used = Math.min(max, Math.max(min, n));
@@ -952,44 +941,37 @@ export function isRosterGateArmed(configCenter) {
     return configCenter !== undefined && !configCenter.dryRun && process.env.CONFIG_REQUIRE_ROSTER === "true";
 }
 function parseModelDomain() {
-    const gatewayBaseUrl = firstSetEnv("MODEL_GATEWAY_BASEURL");
-    const modelId = env("MODEL_ID", "");
-    const explicitProvider = process.env.MODEL_PROVIDER;
-    if (explicitProvider !== undefined && explicitProvider !== "") {
-        const refusal = modelProviderRefusal(explicitProvider);
+    const route = readModelRouteEnv(process.env);
+    const gatewayBaseUrl = route.gatewayBaseUrl;
+    const modelId = route.mainId;
+    if (route.providerSource === "explicit") {
+        const refusal = modelProviderRefusal(route.provider);
         if (refusal !== undefined) {
             throw new Error(refusal);
         }
     }
     for (const [envKey, raw, knob] of [
         ["MODEL_GATEWAY_BASEURL", gatewayBaseUrl ?? "", "MODEL_API_KEY"],
-        ...csv("MODEL_GATEWAY_FALLBACK_URLS").map((u, i) => [`MODEL_GATEWAY_FALLBACK_URLS[${i}]`, u, "MODEL_API_KEY"]),
-        ["ANTHROPIC_BASE_URL", firstSetEnv("ANTHROPIC_BASE_URL") ?? "", "ANTHROPIC_API_KEY"],
+        ...route.gatewayFallbackUrls.map((u, i) => [`MODEL_GATEWAY_FALLBACK_URLS[${i}]`, u, "MODEL_API_KEY"]),
+        ["ANTHROPIC_BASE_URL", route.anthropicBaseUrl ?? "", "ANTHROPIC_API_KEY"],
     ]) {
         const refusal = modelRouteUrlRefusal(envKey, raw, knob);
         if (refusal !== undefined) {
             throw new Error(refusal);
         }
     }
-    const inferredAnthropicBaseUrl = firstSetEnv("ANTHROPIC_BASE_URL");
-    const inferredAnthropicCred = firstSetEnv("ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN");
-    const provider = (() => {
-        if (explicitProvider !== undefined && explicitProvider !== "")
-            return explicitProvider;
-        if (inferredAnthropicBaseUrl && inferredAnthropicCred) {
-            CONFIG_NOTICES.push({
-                level: "warn",
-                event: "model_provider_inferred",
-                fields: {
-                    provider: "anthropic",
-                    baseUrl: buildDisplaySafeUrl(inferredAnthropicBaseUrl),
-                    hint: "MODEL_PROVIDER is unset but an explicit ANTHROPIC base URL + credential are configured — inferred provider=anthropic (set MODEL_PROVIDER explicitly to override)",
-                },
-            });
-            return "anthropic";
-        }
-        return "gateway";
-    })();
+    const provider = route.provider;
+    if (route.providerSource === "inferred") {
+        CONFIG_NOTICES.push({
+            level: "warn",
+            event: "model_provider_inferred",
+            fields: {
+                provider: "anthropic",
+                baseUrl: buildDisplaySafeUrl(route.anthropicBaseUrl),
+                hint: "MODEL_PROVIDER is unset but an explicit ANTHROPIC base URL + credential are configured — inferred provider=anthropic (set MODEL_PROVIDER explicitly to override)",
+            },
+        });
+    }
     const extraBody = buildExtraBody();
     const thinkingDefault = parseDefaultThinking(process.env.MODEL_DEFAULT_THINKING);
     const envCompatDeclared = buildModelCompat({
@@ -1021,35 +1003,40 @@ function parseModelDomain() {
         ...(envCompat ? { compat: envCompat } : {}),
         ...(extraBody ? { extraBody } : {}),
     };
-    const cheapId = process.env.MODEL_CHEAP_ID;
-    if (cheapId && modelId === "") {
-        CONFIG_NOTICES.push({
-            level: "warn",
-            event: "model_cheap_slot_without_main",
-            fields: { hint: "MODEL_CHEAP_ID is set but MODEL_ID is not — the env cheap slot derives from the env main model, so it is not minted; the catalog (config.d/models.json or the config center) serves the roles. Set MODEL_ID to use the env slots, or unset MODEL_CHEAP_ID to silence this line." },
-        });
-    }
-    const cheapIsMain = cheapId !== undefined && cheapId !== "" && modelId !== "" && cheapId === modelId;
-    if (cheapIsMain) {
-        CONFIG_NOTICES.push({
-            level: "warn",
-            event: "config_env_entry_cheap_same_as_main",
-            fields: {
-                env: "MODEL_CHEAP_ID",
-                model: modelId,
-                hint: `MODEL_CHEAP_ID names the same model as MODEL_ID ("${modelId}") — the env cheap slot is the main gateway under a different id, ` +
-                    `so the same id IS the main model: no cheap slot is minted and subagent / summarize stay on the main model (roles -> default); ` +
-                    `any other MODEL_CHEAP_* key set here describes that slot and is not applied. Set MODEL_CHEAP_ID to a different (cheaper) model ` +
-                    `id to run those roles cheap, or declare two differently-named entries in config.d/models.json to give one upstream id a second ` +
-                    `shape (price / reasoning / window); unset MODEL_CHEAP_ID to silence this line.`,
-            },
-        });
+    const cheapSlot = route.cheapSlot;
+    switch (cheapSlot.kind) {
+        case "without_main":
+            CONFIG_NOTICES.push({
+                level: "warn",
+                event: "model_cheap_slot_without_main",
+                fields: { hint: "MODEL_CHEAP_ID is set but MODEL_ID is not — the env cheap slot derives from the env main model, so it is not minted; the catalog (config.d/models.json or the config center) serves the roles. Set MODEL_ID to use the env slots, or unset MODEL_CHEAP_ID to silence this line." },
+            });
+            break;
+        case "same_as_main":
+            CONFIG_NOTICES.push({
+                level: "warn",
+                event: "config_env_entry_cheap_same_as_main",
+                fields: {
+                    env: "MODEL_CHEAP_ID",
+                    model: modelId,
+                    hint: `MODEL_CHEAP_ID names the same model as MODEL_ID ("${modelId}") — the env cheap slot is the main gateway under a different id, ` +
+                        `so the same id IS the main model: no cheap slot is minted and subagent / summarize stay on the main model (roles -> default); ` +
+                        `any other MODEL_CHEAP_* key set here describes that slot and is not applied. Set MODEL_CHEAP_ID to a different (cheaper) model ` +
+                        `id to run those roles cheap, or declare two differently-named entries in config.d/models.json to give one upstream id a second ` +
+                        `shape (price / reasoning / window); unset MODEL_CHEAP_ID to silence this line.`,
+                },
+            });
+            break;
+        case "absent":
+        case "minted":
+            break;
     }
-    const cheapModel = cheapId && modelId !== "" && !cheapIsMain
+    const cheapMintedId = mintedCheapId(cheapSlot);
+    const cheapModel = cheapMintedId !== undefined
         ? {
             ...model,
-            id: cheapId,
-            name: cheapId,
+            id: cheapMintedId,
+            name: cheapMintedId,
             input: ((v) => (v === undefined ? model.input : v ? ["text", "image"] : ["text"]))(parseBoolWord("MODEL_CHEAP_VISION", process.env.MODEL_CHEAP_VISION)),
             ...buildModelCostKey(buildCostOrAbsent({
                 input: costEnv("MODEL_CHEAP_COST_INPUT", "declares-zero"),
@@ -1093,9 +1080,7 @@ function parseModelDomain() {
         }
         noticeAutoCompactAboveWindow("cheap", "MODEL_CHEAP_AUTO_COMPACT_TOKENS", cheapModel);
     }
-    const models = modelId === "" ? {} : { default: model, [model.id]: model };
-    if (cheapModel)
-        models[cheapModel.id] = cheapModel;
+    const models = envLaneTable(modelId, model, cheapModel);
     const gatewayApiKey = process.env.MODEL_API_KEY;
     if (gatewayBaseUrl === undefined && gatewayApiKey !== undefined && gatewayApiKey !== "") {
         CONFIG_NOTICES.push({
@@ -1129,13 +1114,13 @@ function parseModelDomain() {
     const degradeOn = parseDegradeOn(csv("MODEL_DEGRADE_ON"));
     return {
         ...(gatewayBaseUrl !== undefined ? { gatewayBaseUrl, gatewayApiKey } : {}),
-        gatewayFallbackUrls: csv("MODEL_GATEWAY_FALLBACK_URLS"),
+        gatewayFallbackUrls: route.gatewayFallbackUrls,
         ...(process.env.GATEWAY_MAX_RETRIES ? { gatewayMaxRetries: numEnvBounded("GATEWAY_MAX_RETRIES", "2", 0, 20) } : {}),
-        anthropic: firstSetEnv("ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN")
+        anthropic: route.anthropicRouteMounted
             ? {
-                apiKey: firstSetEnv("ANTHROPIC_API_KEY"),
-                authToken: firstSetEnv("ANTHROPIC_AUTH_TOKEN"),
-                baseUrl: firstSetEnv("ANTHROPIC_BASE_URL"),
+                apiKey: route.anthropicApiKey,
+                authToken: route.anthropicAuthToken,
+                baseUrl: route.anthropicBaseUrl,
                 version: process.env.ANTHROPIC_VERSION,
                 cacheBreakpoints: boolEnv("ANTHROPIC_CACHE_BREAKPOINTS", true),
                 ...(process.env.ANTHROPIC_MAX_RETRIES ? { maxRetries: numEnv("ANTHROPIC_MAX_RETRIES", "2") } : {}),
@@ -1155,6 +1140,7 @@ function parseModelDomain() {
         modelApiKeyEnv: {},
         modelApiKeys: {},
         modelRefusals: {},
+        droppedCatalogEntries: [],
         modelQuotaWeights: {},
         tiers: {},
         projects: {},
@@ -1272,9 +1258,6 @@ export function approvalGrantRefusal(names) {
     const over = allowLayerEntryCountIssue(APPROVAL_GRANT_ENV, names);
     if (over !== undefined)
         return `${over.message} — refusing to start rather than running with a truncated list`;
-    const empty = emptyToolSegmentEntryOf(names);
-    if (empty !== undefined)
-        return `${describeEmptyToolSegmentEntry(APPROVAL_GRANT_ENV, empty)} — refusing to start rather than running without it`;
     const inert = inertRuleEntriesOf(names, "allow");
     if (inert.length > 0)
         return `${describeInertRuleEntries(APPROVAL_GRANT_ENV, inert)} — the engine would grant nothing for ${inert.length === 1 ? "it" : "them"}; refusing to start rather than running with an allow rule that never takes effect`;
@@ -1375,7 +1358,7 @@ function parseApprovalDomain(ctx) {
             const trimmed = raw.trim();
             if (trimmed === "" || trimmed.toLowerCase() === "off")
                 return [];
-            return trimmed.split(",").map((p) => p.trim()).filter((p) => p.length > 0);
+            return csvOf(trimmed);
         })(process.env.SENSITIVE_WRITE_PATTERNS),
         ...((decision) => (decision === undefined ? {} : { writeProtectedPaths: decision }))(parseWriteProtectedTableEnv(process.env.WRITE_PROTECTED_EXTRA, process.env.WRITE_PROTECTED_TABLE_REPLACE)),
         ...((raw) => {
@@ -1826,7 +1809,7 @@ function parseAuthDomain(ctx) {
         authToken: process.env.SERVICE_AUTH_TOKEN,
         authTokens,
         allowUnauthedWrites: boolEnv("ALLOW_UNAUTHED_WRITES", false),
-        corsOrigins: (process.env.CORS_ORIGIN ?? "").split(",").map((s) => s.trim()).filter(Boolean),
+        corsOrigins: csv("CORS_ORIGIN"),
         principalHeader: headerNameEnv("PRINCIPAL_HEADER", "x-agent-principal"),
         requirePrincipal,
         autonomy: parseAutonomy(process.env.AUTONOMY),
@@ -2011,7 +1994,7 @@ function parseOrchestrationDomain(ctx) {
             ? {
                 repoRoot: process.env.WORKTREE_REPO_ROOT,
                 ...(process.env.WORKTREE_ALLOWED_ROOTS
-                    ? { allowedRoots: process.env.WORKTREE_ALLOWED_ROOTS.split(",").map((s) => s.trim()).filter(Boolean) }
+                    ? { allowedRoots: csv("WORKTREE_ALLOWED_ROOTS") }
                     : {}),
                 ...(process.env.WORKTREE_BASE_COMMIT ? { commit: process.env.WORKTREE_BASE_COMMIT } : {}),
             }
@@ -2095,7 +2078,7 @@ function parseLimitsHttpDomain() {
         workspaceFileMaxBytes: optFinitePositiveEnv("WORKSPACE_FILE_MAX_BYTES") ?? 8 * 1024 * 1024,
         attachmentMaxBytes: clampEnvWithWarn("ATTACHMENT_MAX_BYTES", String(32 * 1024 * 1024), LIMITS_HTTP_FLOORS.attachmentMaxBytes),
         ...(process.env.ATTACHMENT_MIME_ALLOWLIST
-            ? { attachmentMimeAllowlist: process.env.ATTACHMENT_MIME_ALLOWLIST.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean) }
+            ? { attachmentMimeAllowlist: csv("ATTACHMENT_MIME_ALLOWLIST").map((s) => s.toLowerCase()) }
             : {}),
         attachmentUnboundTtlMs: clampEnvWithWarn("ATTACHMENT_UNBOUND_TTL_MS", String(24 * 3600 * 1000), LIMITS_HTTP_FLOORS.attachmentUnboundTtlMs),
         infraCostRates: {
@@ -2190,7 +2173,7 @@ function parseIntegrationsDomain(ctx) {
     const fleetAdvertiseAddress = parseFleetAdvertiseAddress(process.env.FLEET_ADVERTISE_ADDRESS);
     fleetFenceLaneOf({ ...fleetGeneration, configCenter, ...fleetAdvertiseAddress });
     return {
-        pluginsAllowHosts: (process.env.PLUGINS_ALLOW_HOSTS ?? "github.com").split(",").map((h) => h.trim()).filter(Boolean),
+        pluginsAllowHosts: csvOf(process.env.PLUGINS_ALLOW_HOSTS ?? "github.com"),
         configBootFetchBudgetMs: clampEnvWithWarn("CONFIG_BOOT_FETCH_BUDGET_MS", "1500", 0),
         gitApiBaseUrl: process.env.GIT_API_BASEURL,
         gitApiToken: process.env.GIT_API_TOKEN,
@@ -2388,7 +2371,7 @@ const STORE_GROUP_KEYS = [
 ];
 const MODEL_PLANE_GROUP_KEYS = [
     "gatewayBaseUrl", "gatewayApiKey", "gatewayFallbackUrls", "gatewayMaxRetries", "anthropic", "resilience", "model", "envModel", "models",
-    "modelApiKeyEnv", "modelApiKeys", "modelRefusals", "modelQuotaWeights", "tiers", "projects", "roles", "atModelAllowlist", "cascadeLadder", "degrade",
+    "modelApiKeyEnv", "modelApiKeys", "modelRefusals", "droppedCatalogEntries", "modelQuotaWeights", "tiers", "projects", "roles", "atModelAllowlist", "cascadeLadder", "degrade",
 ];
 const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto", "approvalGrant",
@@ -2527,15 +2510,9 @@ export function loadConfig() {
         throw new Error(laneRequiredRefusal);
     }
     {
-        const envLaneDispatchable = !isRosterGateArmed(integrations.configCenter);
-        const refusal = modelRouteEndpointRefusal({
-            gatewayBaseUrl: modelPlane.gatewayBaseUrl,
-            gatewayFallbackUrls: modelPlane.gatewayFallbackUrls,
-            anthropic: modelPlane.anthropic,
-            models: envLaneDispatchable ? modelPlane.models : {},
-        });
-        if (refusal !== undefined) {
-            throw new Error(refusal);
+        const routeGap = judgeModelRouteGap(process.env, { envLaneDispatchable: !isRosterGateArmed(integrations.configCenter) });
+        if (routeGap.gap !== "none") {
+            throw new Error(routeGap.reason);
         }
     }
     EXEC_LANE_NOTICE = buildExecLaneNotice(orchestration.remoteExec);

package/dist/fleet/engine-signal.d.ts

@@ -5,7 +5,7 @@
  *
  *  1. **一只铸点,三个出口**:{@link mintEngineSignal} 是「引擎此刻自己说自己什么」的唯一来源。`GET /health`(诊断面)、
  *     `GET /readyz`(就绪探针)与 fleet 心跳(`fleet-client.ts`)各读它**一次**,再按各自的出口形投影;没有出口另算一遍
- *     就绪 / 重启 / 代际 / 租约。
+ *     就绪 / 排空 / 重启 / 代际 / 租约 / 世代账,也没有出口绕过它去读 `deps` 上的这些输入。
  *  2. **就绪**仍只有一只谓词(`http/readiness.ts` 的 `readinessOf`),铸点把它的判决原样带上(`verdict`)。`/readyz` 200 ⇔
  *     `ready ∧ ¬draining ∧ leaseState ≠ denied` —— 后两项不是新判据:`draining` 本来就是就绪原因,而租约被拒**同一拍**经
  *     唯一的排空入口进入排空(`fleet/serving-lease.ts`),所以「被拒 ⇒ 排空 ⇒ 不就绪」是构造出来的,不靠第二只谓词。
@@ -15,21 +15,25 @@
  *     是安全可重启的,扣着的片不阻止它们);被扣的片为空(只差发布重试)⇒ 不是重启事实,不铸(契约 `RestartSignal.reasons` 至少一词;
  *     那一形的面只有每拍一行运维 warn + 计数)。「扣着」在两出口上只有这一种读法(7.120.x 的 `/health.modelPlaneDeferred` 本版删除)。
  *     合成只在 {@link buildRestartSignal} 一处,`restartState()` 是它唯一的调用方 —— 两个出口读的是同一只取值口。
- *  4. **代际与实例**:`generation` = env `FLEET_GENERATION` 的回声(规范十进制串;非规范在 boot 拒启,见 `config.ts`);
- *     缺席 ⇔ 非 fleet 成员。`instanceId` = 本进程起步自铸的那一只(`boot/stage-03` 的 uuidv7),不读 env。
- *  5. **出口方言**(契约 `EngineSignal` 与今天两出口的既有形两处不同:`draining` 是布尔、`/health` 就绪时不带 `ready` —— 契约包
- *     自己的 `EngineSignal` 头注写明了这两处;世代账两键 settings-schema 9.0.0 起契约也是数,与引擎同形)—— 两出口**照旧**用 8.0 方言。心跳体的类型
- *     **就是**契约 `InstanceAnnouncement`(中心按它 `safeParse`;8.2.0 起它类型化 `generation` / `leaseState` / `leaseUntil`),没有
- *     契约外的键:世代账(`configTargetVersion` / `configAppliedVersion`)契约心跳形没有座位,只上 `/health`。新增的键
- *     (`generation` / `leaseState` / `leaseUntil`、`restart.withheld`)只在 fleet 成员 / 扣着的候选在场时出现 ⇒ 非 fleet 部署的
- *     两出口逐字节同 7.120.0。方言收口归契约包下一个 major(布尔 `draining` 对退役、两出口整只承载 `EngineSignal`)与中心提货之后,
- *     由引擎同版翻转 —— 不在本层另造第二方言。
+ *  4. **代际**:`generation` = env `FLEET_GENERATION` 的回声(规范十进制串;非规范在 boot 拒启,见 `config.ts`);缺席 ⇔ 非 fleet 成员。
+ *     **身份不是引擎态**:`instanceId`(本进程起步自铸的那一只,`boot/stage-03` 的 uuidv7)是体的身份,只在两出口体的**顶层**说一次,
+ *     铸点不读它、契约形里不重复它。
+ *  5. **两形一读(展开 / 收缩)**:两出口今天各发两形 —— 嵌套键 {@link ENGINE_SIGNAL_KEY}(契约 `EngineSignal` 整只,{@link buildEngineSignal}),
+ *     与 8.0 扁平方言(布尔 `draining` + `drainingSince`、`/health` 就绪时不带 `ready`、`restart`、成员三键、`/health` 的世代账)。两形读的是
+ *     **同一次**铸点读数里的**同一个字段**,投影全在本模块({@link buildEngineSignal} / {@link heartbeatReadinessKeys} / {@link healthDrainingKeys} /
+ *     {@link fleetMembershipKeys} / {@link healthConfigLedgerKeys}),出口文件不拼引擎态的键。排空在两形上读的都是排空**事实**(`EngineDraining`,
+ *     三键齐才在),不是就绪原因 —— 所以「`engineSignal.draining` 在场 ⇔ 扁平 `draining` 为真、`drainingSince` = `engineSignal.draining.since`」
+ *     是构造出来的,不靠「唯一入口整组写四键」这条运行时不变量(那条不变量只管就绪原因与事实一致)。
+ *     心跳体 = 契约 `InstanceAnnouncement` + 嵌套键这一只:契约包 10.x 的心跳形还没有它的座位,10.x 中心按默认 strip 解析丢掉它、照收心跳;
+ *     世代账扁平两键契约心跳形没有座位,只上 `/health`(嵌套形里有,两出口都带)。非 fleet 部署的扁平键与 7.122.0 逐字同。
+ *     收缩:扁平布尔对(`draining` / `drainingSince`)settings-schema 12.0.0 从契约形删、本引擎 7.124.0+ 删发(届时删它们的投影);嵌套键名在
+ *     契约包自有这只常量的那一版提货时改读它。
  *  6. **租约四态的词表属主是契约包**(`LeaseState`):本模块的读数型 {@link ServingLeaseView} 按它逐词对齐(下面的编译期断言两向钉),
  *     契约加一个词 ⇒ 本仓编译红,不会悄悄多出一个本仓读不出的态。
  *
- * 模块形:纯函数(只值 import 契约包与 `http/readiness.ts`)—— `http/` 与 `fleet-client.ts` 都读它,不许长出回环。
+ * 模块形:纯函数(契约包只 import 型;值 import 只有两只纯叶 `http/readiness.ts` 与 `fleet/drain-entry.ts`)—— `http/` 与 `fleet-client.ts` 都读它,不许长出回环。
  */
-import type { EngineDraining, InstanceAnnouncement, LeaseState, RestartSignal } from "@sema-agent/settings-schema/fleet";
+import type { EngineDraining, EngineSignal, InstanceAnnouncement, LeaseState, RestartSignal } from "@sema-agent/settings-schema/fleet";
 import { type ReadinessInputs, type ReadinessVerdict } from "../http/readiness.js";
 /**
  * 租约此刻的读数(租约客户端交出;纯数据)。态的词表 = 契约 `LeaseState`(四词的语义在契约注里:`none` 不生效 / `granted` 持有 /
@@ -94,9 +98,16 @@ export declare function configHandoffMissing(ledger: ConfigHandoffLedger): boole
 /** `configHandoff` 的**唯一**合成点(纯):缺着 ⇒ `{ state: "missing", version: 应用着的那一代, since }`;否则缺席。`since` 由持账方锁存(发现缺着的那一拍)。
  *  `build*` = 纯数据;config-center 的 `configHandoffState()` 是唯一调用方。 */
 export declare function buildConfigHandoff(ledger: ConfigHandoffLedger, since: number | undefined): ConfigHandoff | undefined;
+/** 世代账的一次读数(config-center 的 `configApplyState()` 交出的那一份里本模块读的五键;`/health` 扁平五键与嵌套形的两键读同一份)。 */
+export interface ConfigLedgerReading {
+    readonly configTargetVersion: number;
+    readonly configAppliedVersion: number;
+    readonly configTargetOrdinal: number;
+    readonly configAppliedOrdinal: number;
+    readonly configApplyStaleMs?: number;
+}
 /** 铸点读的输入 —— `ServiceDeps` 上的同名键(HTTP 面与心跳读的是**同一个**对象)。 */
 export interface EngineSignalInputs extends ReadinessInputs {
-    readonly instanceId?: string;
     /** `config.fleetGeneration` = env `FLEET_GENERATION` 的回声(boot 已判规范;缺席 ⇔ 非 fleet 成员)。 */
     readonly config?: {
         readonly fleetGeneration?: string;
@@ -108,34 +119,54 @@ export interface EngineSignalInputs extends ReadinessInputs {
     };
     readonly restartState?: () => RestartSignal | undefined;
     readonly servingLease?: () => ServingLeaseView;
-    readonly configApplyState?: () => {
-        readonly configTargetVersion: number;
-        readonly configAppliedVersion: number;
-    } | undefined;
+    readonly configApplyState?: () => ConfigLedgerReading | undefined;
 }
 /** 铸出的信号(纯数据)。 */
 export interface EngineSignalFacts {
     /** 就绪判(`readinessOf` 原样)。 */
     readonly verdict: ReadinessVerdict;
-    /** 在场 ⇔ 排空中(契约 `EngineDraining`:动作 / 起点 / 期限)。 */
+    /** 在场 ⇔ 排空中(契约 `EngineDraining`:动作 / 起点 / 期限)—— 两出口两形读排空的唯一字段(规则 5)。 */
     readonly draining?: EngineDraining;
     readonly restart?: RestartSignal;
     readonly generation?: string;
-    readonly instanceId?: string;
     readonly lease: ServingLeaseView;
-    readonly configTargetVersion?: number;
-    readonly configAppliedVersion?: number;
+    /** 世代账的那一次读数(未接线 ⇒ 缺席)。 */
+    readonly configApply?: ConfigLedgerReading;
 }
 /** **唯一**铸点(活判,每次调用现读输入)。 */
 export declare function mintEngineSignal(deps: EngineSignalInputs): EngineSignalFacts;
+/**
+ * 两出口体上嵌套引擎信号的键名(规则 5;两出口同一只拼法)。契约包 10.x 没有这只常量(它的心跳形也没有这一座位);契约包自有它的那一版
+ * 提货时,本常量删、改读契约包的。
+ */
+export declare const ENGINE_SIGNAL_KEY = "engineSignal";
+/** 体上的嵌套引擎信号:键 {@link ENGINE_SIGNAL_KEY},值 = 契约 `EngineSignal`。 */
+export type EngineSignalCarrier = {
+    readonly [ENGINE_SIGNAL_KEY]: EngineSignal;
+};
+/**
+ * 契约形 `EngineSignal` 的**唯一**投影(规则 5;两出口同调,同一次读数 ⇒ 同值同序)。键序照契约形:`ready` 恒说;`draining` = 排空事实;
+ * `restart` = 取值口交出的那个对象;成员三键 = {@link fleetMembershipKeys};世代账两键 = 同一次读数。身份不在这里(规则 4)。`build*` = 纯数据。
+ */
+export declare function buildEngineSignal(s: EngineSignalFacts): EngineSignal;
 /**
  * fleet 成员身份三键的**唯一**投影(两出口同调,同值同序):`generation` / `leaseState` / `leaseUntil`。
  * 在场律:非 fleet 成员(无 `generation`)⇒ 空对象(两出口逐字节同 7.120.0);成员 ⇒ `generation` + `leaseState` 恒在,
  * `leaseUntil` 只在 `granted`。
  */
 export declare function fleetMembershipKeys(s: EngineSignalFacts): FleetMembershipKeys;
-/** 出口的 8.0 方言布尔 `draining`(心跳 `InstanceAnnouncement.draining` / `/health.draining`):就绪原因含排空。 */
-export declare function drainingFlag(s: EngineSignalFacts): boolean;
+/** 心跳的 8.0 扁平方言 `ready` / `draining`(恒带,`false` 也带):`ready` = 就绪判,`draining` = 排空事实在场(规则 5,与嵌套形读同一个字段)。 */
+export declare function heartbeatReadinessKeys(s: EngineSignalFacts): Pick<InstanceAnnouncement, "ready" | "draining">;
+/** `/health` 的 8.0 扁平排空对:只在排空中带 —— `draining: true` + `drainingSince` = 排空事实的 `since`(规则 5,与嵌套形读同一个字段)。 */
+export declare function healthDrainingKeys(s: EngineSignalFacts): {
+    readonly draining?: true;
+    readonly drainingSince?: number;
+};
+/**
+ * `/health` 的世代账扁平键(未接线 ⇒ 全缺席):target / applied 两版本(与嵌套形同一次读数)+ 两只收货序数(进程内单调,「见过多少代 / 停在哪一代」
+ * 的推进判据)+ `configApplyStaleMs`(两者持续不等的时长,收敛即缺席)。只上 `/health`(契约心跳形没有这些座位)。
+ */
+export declare function healthConfigLedgerKeys(s: EngineSignalFacts): Partial<ConfigLedgerReading>;
 /**
  * `/health.restartRequired`(冗余顶层布尔,壳读它决定要不要问用户重启)的投影:在场 ⇔ 有**可执行**的重启信号
  * (`restart` 在场且未被扣)—— 与 7.120.0 的读数逐字同(那时被扣的候选根本不出 `restart`)。

package/dist/fleet/engine-signal.js

@@ -23,15 +23,24 @@ export function mintEngineSignal(deps) {
     const ds = deps.drainState;
     const draining = ds === undefined ? undefined : drainingFactOf(ds);
     const restart = deps.restartState?.();
-    const gen = deps.configApplyState?.();
+    const configApply = deps.configApplyState?.();
     return {
         verdict,
         ...(draining !== undefined ? { draining } : {}),
         ...(restart !== undefined ? { restart } : {}),
         ...(deps.config?.fleetGeneration !== undefined ? { generation: deps.config.fleetGeneration } : {}),
-        ...(deps.instanceId !== undefined ? { instanceId: deps.instanceId } : {}),
         lease: deps.servingLease?.() ?? LEASE_NONE,
-        ...(gen !== undefined ? { configTargetVersion: gen.configTargetVersion, configAppliedVersion: gen.configAppliedVersion } : {}),
+        ...(configApply !== undefined ? { configApply } : {}),
+    };
+}
+export const ENGINE_SIGNAL_KEY = "engineSignal";
+export function buildEngineSignal(s) {
+    return {
+        ready: s.verdict.ready,
+        ...(s.draining !== undefined ? { draining: s.draining } : {}),
+        ...(s.restart !== undefined ? { restart: s.restart } : {}),
+        ...fleetMembershipKeys(s),
+        ...(s.configApply !== undefined ? { configTargetVersion: s.configApply.configTargetVersion, configAppliedVersion: s.configApply.configAppliedVersion } : {}),
     };
 }
 export function fleetMembershipKeys(s) {
@@ -51,8 +60,23 @@ export function fleetMembershipKeys(s) {
         }
     }
 }
-export function drainingFlag(s) {
-    return !s.verdict.ready && s.verdict.reasons.includes("draining");
+export function heartbeatReadinessKeys(s) {
+    return { ready: s.verdict.ready, draining: s.draining !== undefined };
+}
+export function healthDrainingKeys(s) {
+    return s.draining === undefined ? {} : { draining: true, drainingSince: s.draining.since };
+}
+export function healthConfigLedgerKeys(s) {
+    const g = s.configApply;
+    if (g === undefined)
+        return {};
+    return {
+        configTargetVersion: g.configTargetVersion,
+        configAppliedVersion: g.configAppliedVersion,
+        configTargetOrdinal: g.configTargetOrdinal,
+        configAppliedOrdinal: g.configAppliedOrdinal,
+        ...(g.configApplyStaleMs !== undefined ? { configApplyStaleMs: g.configApplyStaleMs } : {}),
+    };
 }
 export function restartActionable(s) {
     return s.restart !== undefined && s.restart.withheld !== true;

package/dist/fleet-client.d.ts

@@ -6,10 +6,12 @@
  *    配置席 `fleetAdvertiseAddress`(env `FLEET_ADVERTISE_ADDRESS`,`loadConfig` 解析一次;可达性是运维的话,不自猜:k8s pod IP /
  *    docker alias / 127.0.0.1:port 只有部署环境自己知道)。不配中心的部署零行为变化;配了中心而不公告的引擎只报用量、不注册(7.105.0 及以前它连用量都不报)。
  *  - **announce=注册=心跳同形状幂等 upsert**:boot 后(listen 之后)POST 一次 + 每 heartbeatMs 续。
- *    `ready` / `draining` 两字段由**同一只**就绪谓词的同一次读铸(S-740:`http/readiness.ts` 的 `readinessOf`,
- *    与 `/health.ready`、`GET /readyz`、计费提交门同源):`ready = verdict.ready`(= roster 已落 ∧ ¬draining),
- *    `draining = reasons ∋ "draining"`。修前 `ready = !isDraining()`,不含 roster ⇒ roster 未落时心跳说「就绪」
- *    而计费提交在 503。
+ *    `ready` / `draining` 两字段由引擎信号铸点的同一次读铸(S-740:`ready` = `http/readiness.ts` `readinessOf` 的判,
+ *    与 `/health.ready`、`GET /readyz`、计费提交门同源;= roster 已落 ∧ ¬draining),`draining` = 排空事实在场(与嵌套
+ *    `engineSignal.draining` 同一个字段,`fleet/engine-signal.ts` 规则 5)。修前 `ready = !isDraining()`,不含 roster ⇒ roster 未落时
+ *    心跳说「就绪」而计费提交在 503。
+ *  - **`engineSignal`(7.123.0)**:引擎态整只(契约 `EngineSignal`),与扁平键同一次读数;契约包 10.x 的心跳形没有它的座位(10.x 中心
+ *    默认 strip 解析丢掉它、照收心跳);扁平布尔 `draining` settings-schema 12.0.0 删、本引擎 7.124.0+ 删发。
  *  - **`restart?`(S-741)**:在场 ⇔ 本副本必须重启才能应用配置 —— 取自 `/health.restart` **同一只**取值口(装配层接
  *    `deployment.restartState`,config-center 的 `restartState()`),同一个对象,形 = settings-schema `RestartSignal`;
  *    缺席即键缺席(中心按行整体替换,不合并 —— 一条不带它的心跳就是「不再需要」)。
@@ -80,8 +82,8 @@ export interface FleetClientOpts {
     advertiseAddress?: string | undefined;
     version: string;
     /** 编排器片 2 件 1:引擎信号的**一只铸点**(装配层接 `mintEngineSignal(deployment)` —— `/health` 与 `/readyz` 读的同一只、同一个 deps 组)。
-     *  每条公告现铸**一次**,`ready` / `draining` / `restart` / 代际与租约三键 / 世代账都取自这一次(不会撕裂成 `ready:true` + `draining:true`,
-     *  也不会出现心跳与 `/health` 各算一份重启或租约)。修前是 `readiness` + `restart` 两只取值口(S-740 / S-741),合进这一只。 */
+     *  每条公告现铸**一次**,嵌套 `engineSignal` 与扁平 `ready` / `draining` / `restart` / 代际与租约三键都取自这一次(不会撕裂成 `ready:true` +
+     *  `draining:true`,也不会出现心跳与 `/health` 各算一份重启或租约)。修前是 `readiness` + `restart` 两只取值口(S-740 / S-741),合进这一只。 */
     signal: () => EngineSignalFacts;
     /** S-768:模型拒因信号(装配层接 `/health` 同一只取值口 `deployment.modelRefusalsState`)。每条公告现读一次;`undefined` ⇒ 公告不带
      *  `modelRefusals` 键。必填:与 `restart` 同 —— 心跳面没有「不知道有没有拒」这一形(老引擎不发这个键,中心按 `version` 判「不可知」)。 */

package/dist/fleet-client.js

@@ -1,5 +1,5 @@
 import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS, readCapabilityReading } from "@sema-agent/settings-schema/fleet";
-import { drainingFlag, fleetMembershipKeys } from "./fleet/engine-signal.js";
+import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, heartbeatReadinessKeys } from "./fleet/engine-signal.js";
 import { centerFetch, centerLaneConfigured } from "./config-center/center-request.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 export const FLEET_USAGE_KEY_CAP = 1024;
@@ -99,18 +99,19 @@ export function startFleetClient(opts) {
             return;
         try {
             const signal = opts.signal();
+            const engineSignal = buildEngineSignal(signal);
             const modelRefusals = opts.modelRefusals();
             const body = {
                 instanceId: opts.instanceId,
                 worker: opts.center.worker,
                 address,
                 version: opts.version,
-                ready: signal.verdict.ready,
-                draining: drainingFlag(signal),
+                ...heartbeatReadinessKeys(signal),
                 heartbeatMs,
                 ...(signal.restart !== undefined ? { restart: signal.restart } : {}),
                 ...(modelRefusals !== undefined ? { modelRefusals } : {}),
                 ...fleetMembershipKeys(signal),
+                [ENGINE_SIGNAL_KEY]: engineSignal,
             };
             const { res } = await send("fleet-instances", "POST", body);
             if (!res.ok)

package/dist/http/dispatch.js

@@ -6,7 +6,7 @@ import { ROUTE_METHOD_ORDER } from "./route-ctx.js";
 import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath, isSubscriptionRequest } from "./route-table.js";
 import { sendJson, sendError, isSseResponse, endSseWithError } from "./send.js";
 import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal, billableRefusalOf } from "./readiness.js";
-import { fleetMembershipKeys, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
+import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, healthConfigLedgerKeys, healthDrainingKeys, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
 import { buildHealthSelfReport } from "./health-self-report.js";
 import { authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, verifiedIdentitySource } from "./principal-gate.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
@@ -128,6 +128,7 @@ export function createDispatch(ctx) {
         }
         if (req.method === "GET" && url === "/health") {
             const signal = mintEngineSignal(deps);
+            const engineSignal = buildEngineSignal(signal);
             const configHash = createHash("sha256")
                 .update(JSON.stringify({ model: deps.config.model.id, sessionBackend: deps.config.sessionBackend, dbBackend: deps.config.dbBackend, dataRoot: deps.config.localDataRoot, configProvider: deps.config.configProvider, remoteExec: deps.config.remoteExec?.provider, port: deps.config.port }))
                 .digest("hex")
@@ -135,7 +136,7 @@ export function createDispatch(ctx) {
             sendJson(res, 200, {
                 status: "ok",
                 ...(typeof deps.capabilities?.version === "string" ? { version: deps.capabilities.version } : {}),
-                ...(deps.drainState?.draining ? { draining: true, ...(deps.drainState.since ? { drainingSince: deps.drainState.since } : {}) } : {}),
+                ...healthDrainingKeys(signal),
                 ...(deps.drainState?.inflight ? { inflight: deps.drainState.inflight() } : {}),
                 ...(deps.storePosture?.degradedReason !== undefined ? { durable: false, storeDegraded: true } : {}),
                 ...healthReadinessKeys(signal.verdict),
@@ -156,18 +157,7 @@ export function createDispatch(ctx) {
                     const configHandoff = deps.configHandoffState?.();
                     return configHandoff ? { configHandoff } : {};
                 })(),
-                ...(() => {
-                    const gen = deps.configApplyState?.();
-                    if (!gen)
-                        return {};
-                    return {
-                        configTargetVersion: gen.configTargetVersion,
-                        configAppliedVersion: gen.configAppliedVersion,
-                        configTargetOrdinal: gen.configTargetOrdinal,
-                        configAppliedOrdinal: gen.configAppliedOrdinal,
-                        ...(gen.configApplyStaleMs !== undefined ? { configApplyStaleMs: gen.configApplyStaleMs } : {}),
-                    };
-                })(),
+                ...healthConfigLedgerKeys(signal),
                 ...(() => {
                     const credential = deps.centerCredentialState?.();
                     return credential ? { centerCredential: credential } : {};
@@ -185,6 +175,7 @@ export function createDispatch(ctx) {
                         storeProbe: { live: probe.live, ageMs: probe.ageMs, ...(probe.error !== undefined ? { error: publicStoreProbeError(probe.error) } : {}) },
                     };
                 })(),
+                [ENGINE_SIGNAL_KEY]: engineSignal,
             });
             return;
         }

package/dist/http/health-self-report.d.ts

@@ -23,6 +23,9 @@
  * `/health` 排在凭据门之前、缺省全网卡监听:本模块只出闭集词、布尔与运维要发布的 URL。两只 URL 值都过 display-safe 律
  * (`buildDisplaySafeUrl`,所有展示面 URL 的同一个铸点):userinfo 落地、query 值成记号、尾斜杠折掉 —— issuer 的来源
  * (`AUTH_BRIDGE_ISSUER` / `SEMA_REGISTRY_URL`)起服时不判凭据形,这一道是它上无鉴权面的唯一闸。令牌、名单、worker 名、凭证一概不上。
+ * 同一张面上本模块之外还有一个**调用方自取**的串(如实,7.123.0 起;`model` / `dataRoot` / `version` 等其余非闭集的名是部署自己的事实,不是调用方放进来的):排空中的动作号 `engineSignal.draining.actionId`(`fleet/engine-signal.ts` 铸,契约 §0.4)——
+ * 引擎自起的排空是引擎的闭集词,经排空口(operator-only)进的排空是调用方自取的幂等键**原样**(契约包今天只要求非空串,推荐 `manual:<uuid>`),
+ * 所以那一键不是闭集词:调用方不要往里放秘密或人名。
  *
  * ## 在场律
  * 三键**恒在场**;缺席 = 老 worker(≤7.120.x)。`center.issuer` / `center.webBaseUrl` 缺席即缺席(没有鉴权桥 / 没配旋钮),不拼不猜。

package/dist/http/routes/capabilities.js

@@ -1,5 +1,6 @@
 import { PERMISSION_MODES, expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
 import { modelImageInput, isModelAllowlisted, selectableCatalog } from "../../model-select.js";
+import { buildDroppedEntriesWire } from "../../config-center/read-warnings.js";
 import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
 import { projectSealedKeyCapability } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
@@ -254,7 +255,7 @@ export async function handleCapabilities(req, res, match, ctx) {
             }));
             const nonAlias = Object.entries(deps.config.models).filter(([n]) => n !== "default");
             const defaultName = (nonAlias.find(([, m]) => m === deps.config.model) ?? nonAlias.find(([, m]) => m.id === deps.config.model.id))?.[0];
-            sendJson(res, 200, { models, default: deps.config.model.id, defaultModel: { id: deps.config.model.id, ...(defaultName ? { name: defaultName } : {}) } });
+            sendJson(res, 200, { models, default: deps.config.model.id, defaultModel: { id: deps.config.model.id, ...(defaultName ? { name: defaultName } : {}) }, droppedEntries: buildDroppedEntriesWire(deps.config.droppedCatalogEntries) });
             return;
         }
         default: