@sema-agent/server 7.122.0 → 7.124.0

package/dist/{config-center → web-admin-client}/facade.d.ts

@@ -1,12 +1,12 @@
 /**
- * Config-center adapter — pull the effective config from the config-center control plane and
+ * Web-admin adapter — pull the effective config from the web-admin control plane and
  * apply it OVER the env-derived defaults (env = fallback, center = override). Follows the
  * "universal internal schema → translate at the boundary" pattern, with our security boundary kept:
  *
  * (name history: this module tracks the control plane's product name, which has changed over time
  * — registry → sema-web → sema-web-admin (2026-08-26 repo/product rename; an earlier revision of
  * this note listed "planned sema-admin" as the next step). The module itself keeps a neutral, product-name-free
- * identifier ("config-center") and does not chase the rename.)
+ * identifier ("web-admin") and does not chase the rename.)
  *
  *   - the CENTER owns the LOGICAL config: the model roster (names/capabilities/tier), the role map,
  *     and collab (multi-agent discussion) templates;
@@ -41,14 +41,14 @@
  *     (`governance.approvalRequire` left this list in S-668 波 2 — its own staged group, hot on both legs.)
  *
  * ([ref] A13, internal-lossless) This module is now a FACADE: the implementation lives
- * alongside it in `src/config-center/` split by responsibility group (HTTP client / EffectiveConfig
+ * alongside it in `src/web-admin-client/` split by responsibility group (HTTP client / EffectiveConfig
  * application / restart-signal detection / skills+MCP consumption). Every symbol below is
- * re-exported UNCHANGED — existing `from ".../config-center/facade.js"` imports need zero changes
+ * re-exported UNCHANGED — existing `from ".../web-admin-client/facade.js"` imports need zero changes
  * across a rename of this file's *contents*; a path rename (this move, 2026-07-29) does require the
  * importers to update, which was done in the same commit.
  */
-export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
-export { mutateInPlace, applyEffective, type ApplyReport, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, MODEL_PLANE_DOMAINS, type ModelPlaneDomain, type ModelPlaneOf, withModelPlaneOf, fullyLandedForLkg, } from "./apply-effective.js";
+export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, WebAdminHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
+export { mutateInPlace, applyEffective, type ApplyReport, applyRuntimeGates, applyRuntimeHot, logEffectiveDiff, MODEL_PLANE_DOMAINS, type ModelPlaneDomain, type ModelPlaneOf, withModelPlaneOf, fullyLandedForLkg, } from "./apply-effective.js";
 export { restartReasons, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type EngineRestartSignal, } from "./restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
 export { applyCenterReadFace, CENTER_READ_FACE_LIVE_KEYS, type CenterReadFaceApply, type CenterReadFaceReport, type ReadFaceBaseline } from "./read-face.js";

package/dist/{config-center → web-admin-client}/facade.js

@@ -1,5 +1,5 @@
-export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
-export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, MODEL_PLANE_DOMAINS, withModelPlaneOf, fullyLandedForLkg, } from "./apply-effective.js";
+export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, WebAdminHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
+export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, logEffectiveDiff, MODEL_PLANE_DOMAINS, withModelPlaneOf, fullyLandedForLkg, } from "./apply-effective.js";
 export { restartReasons, modelPlaneChanged, } from "./restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
 export { applyCenterReadFace, CENTER_READ_FACE_LIVE_KEYS } from "./read-face.js";

package/dist/{config-center → web-admin-client}/http-client.d.ts

@@ -9,11 +9,7 @@ import { type CenterEndpoint } from "./center-request.js";
  *  boot/refresh 的候选门直接消费。`droppedEntries`(S-704 ②):schema 逐条丢掉的条目(坐标 + 字段诊断)——
  *  **不**进候选门,调用方响亮点名、其余照用(分面单点 `splitFoldedReadWarnings`,与本地腿同一只)。
  *
- *  `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),与本地腿同键同义。折叠是**有损**的——
- *  `hosts-grandfathered` / `legacy-governance-lifted` 两员按律折成 `null`(值已被收编接受,见
- *  `read-warnings.ts` 头注),于是只看 `domainErrors` 的人**永远**看不见兼容臂有没有开着;而契约把
- *  `legacy-governance-lifted` 铸出来,理由逐字写在 `legacyGovernanceFromRuntime` 的 SUNSET 注里:
- *  「关窗的前提是有人知道它还开着」。两条读腿各返一份原流,那句话在本仓才成立。
+ *  `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),与本地腿同键同义(读者:一致性门的读腿适配器,见本地腿同名键注)。
  *  🔐 原流的 `error` 字段**未经** `redactConfigError`(那道脱敏挂在真正进日志流的 `domainErrors` 产出边界上)
  *  —— 任何把本键路由进结构化日志/审计流的消费者必须自己先脱敏。
  *
@@ -36,12 +32,12 @@ export declare function fetchEffective(center: CenterEndpoint, etag: string | un
  * Center pre-resolves the tighten-only intersection (fleet defaults ∩ tier ⊕ roles + overrides) and returns a
  * `runtimeCaps` block — the service passes it through verbatim (no further tightening, per center's ruling).
  *
- * 🔐 TOKEN/WORKER (center ruling, sema-registry `aeb4979`): two valid postures —
+ * 🔐 TOKEN/WORKER (center ruling, web-admin `aeb4979`): two valid postures —
  *   • FULL `SERVICE_PULL_TOKEN` + `?principal=` → full per-user body (caps + per-user config).
  *   • worker-scoped `wpt_<self>` + `?principal=&worker=<self>` → **caps-only** body (`{principal, configured,
  *     runtimeCaps, budget}`; never other tenants' config) — a worker MAY resolve its OWN worker's principals.
  *   A `wpt_` with NO `?worker=` (or a mismatched worker) still 403s. So we ALWAYS pass `?worker=` when the
- *   deployment has one (`SEMA_REGISTRY_WORKER`): it authorizes the wpt_ path AND is harmless on the full token
+ *   deployment has one (`SEMA_WEB_ADMIN_WORKER`): it authorizes the wpt_ path AND is harmless on the full token
  *   (the caps value is worker-independent — `resolveEntitlement` resolves from the principal alone; worker only
  *   scopes the config view we ignore). This re-adds the `worker` arg dropped in 1.14.0 (L2-3) — center's ruling
  *   makes it load-bearing for AUTHORIZATION, not for the caps value.
@@ -77,9 +73,9 @@ export declare function fetchPrincipalCaps(center: CenterEndpoint, principal: st
  * 因此 304 在传输层就是 fail-loud。
  */
 export declare function fetchPrincipalOrgMemory(center: CenterEndpoint, principal: string, fetchImpl?: typeof fetch, worker?: string): Promise<unknown>;
-/** An HTTP error from a config-center fetch that carries the response status so callers can branch on it
+/** An HTTP error from a web-admin fetch that carries the response status so callers can branch on it
  *  (e.g. translate a 404 to "unknown hash → undefined") WITHOUT parsing the message string. */
-export declare class ConfigCenterHttpError extends Error {
+export declare class WebAdminHttpError extends Error {
     readonly status: number;
     constructor(message: string, status: number);
 }
@@ -87,7 +83,7 @@ export declare class ConfigCenterHttpError extends Error {
  * Fetch one skill's body by content hash (`GET <content root>/skills/content/<hash>`, Bearer; the root is
  * `/api/v1/me` for a user-JWT credential and `/api/config` otherwise — center-request.ts) and VERIFY its
  * sha256 matches the manifest hash (integrity + rewrite check). The content is immutable per hash, so the
- * caller caches by hash and never re-fetches an unchanged skill. Throws a {@link ConfigCenterHttpError}
+ * caller caches by hash and never re-fetches an unchanged skill. Throws a {@link WebAdminHttpError}
  * (carrying `.status`) on an HTTP error — INCLUDING 404 — or a plain Error on hash mismatch. Callers that
  * want "unknown hash → undefined" parity with the local backend inspect `.status === 404` and swallow it;
  * the legacy `applyCenterSkills` path keeps treating every throw as "skip this skill, keep baseline".

package/dist/{config-center → web-admin-client}/http-client.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { readEffectiveWire, PrincipalCapsWire } from "@sema-agent/settings-schema";
 import { centerPromptsFromEffective } from "../prompts-domain-validate.js";
-import { splitFoldedReadWarnings, withDroppedIdentities } from "./read-warnings.js";
+import { splitFoldedReadWarnings, withDroppedCatalogEntries } from "./read-warnings.js";
 import { CENTER_PULL_TIMEOUT_MS, centerFetch } from "./center-request.js";
 import { answerStillCurrent } from "../center-credential.js";
 export async function fetchEffective(center, etag, fetchImpl = fetch, worker) {
@@ -9,7 +9,7 @@ export async function fetchEffective(center, etag, fetchImpl = fetch, worker) {
     if (res.status === 304)
         return null;
     if (!res.ok)
-        throw new Error(`config-center HTTP ${res.status}`);
+        throw new Error(`web-admin HTTP ${res.status}`);
     const warnings = [];
     const body = await res.json();
     const wire = readEffectiveWire(body, (w) => warnings.push(w));
@@ -18,8 +18,8 @@ export async function fetchEffective(center, etag, fetchImpl = fetch, worker) {
         delete wire.prompts;
     else
         wire.prompts = centerPrompts;
-    const { domainErrors, droppedEntries, droppedIdentities } = splitFoldedReadWarnings(warnings);
-    const effective = withDroppedIdentities(wire, droppedIdentities);
+    const { domainErrors, droppedEntries, droppedCatalogEntries } = splitFoldedReadWarnings(warnings);
+    const effective = withDroppedCatalogEntries(wire, droppedCatalogEntries);
     return {
         effective,
         etag: res.headers.get("etag") ?? undefined,
@@ -35,7 +35,7 @@ export async function fetchPrincipalCaps(center, principal, etag, fetchImpl = fe
         return null;
     const parsedBody = PrincipalCapsWire.safeParse(raw.json);
     if (!parsedBody.success) {
-        throw new Error(`config-center principal-caps body failed schema validation: ${parsedBody.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ").slice(0, 600)}`);
+        throw new Error(`web-admin principal-caps body failed schema validation: ${parsedBody.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ").slice(0, 600)}`);
     }
     const body = parsedBody.data;
     assertPrincipalEcho(body.principal, principal);
@@ -79,7 +79,7 @@ export async function fetchPrincipalCaps(center, principal, etag, fetchImpl = fe
 }
 function assertPrincipalEcho(echoed, principal) {
     if (echoed !== undefined && echoed !== principal) {
-        throw new Error(`config-center principal-caps response echoes principal ${JSON.stringify(echoed)} but ${JSON.stringify(principal)} was requested — discarding the whole response`);
+        throw new Error(`web-admin principal-caps response echoes principal ${JSON.stringify(echoed)} but ${JSON.stringify(principal)} was requested — discarding the whole response`);
     }
 }
 async function requestPrincipalView(center, principal, etag, fetchImpl, worker) {
@@ -91,12 +91,12 @@ async function requestPrincipalView(center, principal, etag, fetchImpl, worker)
     };
     if (res.status === 304) {
         if (!etag)
-            throw new Error("config-center returned 304 to a non-conditional principal-caps request");
+            throw new Error("web-admin returned 304 to a non-conditional principal-caps request");
         stillCurrent();
         return null;
     }
     if (!res.ok)
-        throw new Error(`config-center principal-caps HTTP ${res.status}`);
+        throw new Error(`web-admin principal-caps HTTP ${res.status}`);
     const responseEtag = res.headers.get("etag");
     const json = await res.json();
     stillCurrent();
@@ -106,26 +106,26 @@ const PrincipalOrgMemoryEnvelope = PrincipalCapsWire.pick({ principal: true, org
 export async function fetchPrincipalOrgMemory(center, principal, fetchImpl = fetch, worker) {
     const raw = await requestPrincipalView(center, principal, undefined, fetchImpl, worker);
     if (raw === null)
-        throw new Error("config-center returned 304 to a non-conditional org-directory fetch");
+        throw new Error("web-admin returned 304 to a non-conditional org-directory fetch");
     const parsed = PrincipalOrgMemoryEnvelope.safeParse(raw.json);
     if (!parsed.success) {
-        throw new Error(`config-center org-memory section failed schema validation: ${parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ").slice(0, 600)}`);
+        throw new Error(`web-admin org-memory section failed schema validation: ${parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ").slice(0, 600)}`);
     }
     assertPrincipalEcho(parsed.data.principal, principal);
     return parsed.data.orgMemory;
 }
-export class ConfigCenterHttpError extends Error {
+export class WebAdminHttpError extends Error {
     status;
     constructor(message, status) {
         super(message);
         this.status = status;
-        this.name = "ConfigCenterHttpError";
+        this.name = "WebAdminHttpError";
     }
 }
 export async function fetchSkillContent(center, contentHash, fetchImpl = fetch) {
     const { res } = await centerFetch(center, { kind: "skill-content", contentHash }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
-        throw new ConfigCenterHttpError(`skill content HTTP ${res.status} for ${contentHash}`, res.status);
+        throw new WebAdminHttpError(`skill content HTTP ${res.status} for ${contentHash}`, res.status);
     const content = await res.text();
     const want = contentHash.replace(/^sha256:/, "").toLowerCase();
     const got = createHash("sha256").update(content, "utf8").digest("hex");
@@ -136,13 +136,13 @@ export async function fetchSkillContent(center, contentHash, fetchImpl = fetch)
 export async function fetchPromptArtifact(center, artifactDigest, fetchImpl = fetch) {
     const { res } = await centerFetch(center, { kind: "prompt-artifact", digest: artifactDigest }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
-        throw new ConfigCenterHttpError(`prompt artifact HTTP ${res.status} for ${artifactDigest}`, res.status);
+        throw new WebAdminHttpError(`prompt artifact HTTP ${res.status} for ${artifactDigest}`, res.status);
     return await res.json();
 }
 export async function fetchPromptBlob(center, contentDigest, fetchImpl = fetch) {
     const { res } = await centerFetch(center, { kind: "prompt-blob", digest: contentDigest }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
-        throw new ConfigCenterHttpError(`prompt blob HTTP ${res.status} for ${contentDigest}`, res.status);
+        throw new WebAdminHttpError(`prompt blob HTTP ${res.status} for ${contentDigest}`, res.status);
     const bytes = new Uint8Array(await res.arrayBuffer());
     const want = contentDigest.replace(/^sha256:/, "").toLowerCase();
     const got = createHash("sha256").update(bytes).digest("hex");

package/dist/{config-center → web-admin-client}/pull-state.d.ts

@@ -1,6 +1,6 @@
 /**
  * S-866 ②(设计稿 v1.1 §2②)—— 「这台引擎**此刻**是不是真的接着中心」的两件读数:最近一次实拉的结局(`lastPull`)与生效修订号
- * (`effectiveRevision`)。属主 = config-center 运行时(`boot/config-center.ts` 的 `centerPullState()`);读者 = caps `centerWiring`。
+ * (`effectiveRevision`)。属主 = web-admin 运行时(`boot/web-admin.ts` 的 `centerPullState()`);读者 = caps `centerWiring`。
  *
  * 纯叶(零值 import):词表与读面形住这里,运行时与读面两侧都从这里取型,不各写一份。
  */

package/dist/{config-center → web-admin-client}/read-face.js

@@ -59,7 +59,7 @@ export function applyCenterReadFace(config, eff, logger, apply = { phase: "boot"
         return report();
     }
     if (typeof domain !== "object" || Array.isArray(domain)) {
-        logger?.warn("sema_registry_read_face_invalid", {
+        logger?.warn("web_admin_read_face_invalid", {
             detail: `published readFace domain must be an object with optional {face,denyPatterns,denyBuiltinTiers,denyBuiltinExclude} — got ${Array.isArray(domain) ? "array" : typeof domain}`,
             kept: "the deployment's env READ-face posture is unchanged (refusing a malformed domain WHOLE — a half-applied read-containment posture is worse than none)",
         });
@@ -90,7 +90,7 @@ export function applyCenterReadFace(config, eff, logger, apply = { phase: "boot"
             resolveReadDenyBuiltins(builtinsArg(finalTiers, finalExclude));
     }
     catch (e) {
-        logger?.warn("sema_registry_read_face_invalid", {
+        logger?.warn("web_admin_read_face_invalid", {
             detail: e instanceof Error ? e.message : String(e),
             kept: "the deployment's env READ-face posture is unchanged (refusing the readFace domain WHOLE — applying half of a read-containment posture would read as 'policy landed' while part of it silently did not)",
         });
@@ -112,13 +112,13 @@ export function applyCenterReadFace(config, eff, logger, apply = { phase: "boot"
             config.readDenyBuiltinExclude = staged.readDenyBuiltinExclude;
     }
     if (envHeld.length > 0) {
-        logger?.warn("sema_registry_read_face_env_wins", {
+        logger?.warn("web_admin_read_face_env_wins", {
             keys: envHeld,
             note: "this machine's explicit env READ-face keys WIN over the published readFace domain (deployment sovereignty) — the published values for these keys were NOT applied; unset the env key if the org publication should own it",
         });
     }
     if (Object.keys(staged).length > 0) {
-        logger?.info("sema_registry_read_face", {
+        logger?.info("web_admin_read_face", {
             applied: Object.keys(staged).filter((k) => apply.phase === "boot" || KEY_MAP.some((r) => r.cfgKey === k && CENTER_READ_FACE_LIVE_KEYS.has(r.centerKey))),
             ...(staged.readFace !== undefined ? { face: staged.readFace } : {}),
             note: apply.phase === "boot"

package/dist/web-admin-client/read-warnings.d.ts

@@ -0,0 +1,137 @@
+/**
+ * `EffectiveReadWarning` → 候选门口径的**单点**折叠(本地腿 `config-provider.ts` 与远程腿 `http-client.ts` 共用;
+ * 两腿各抄一份映射正是漂移的成因——远程腿曾漏掉一次改动,版本超前的 center 多一个字段就整份远程 refresh 整拒)。
+ *
+ * **律只有一条:未知键 = 候选门错误,零特例。** 「别的写者按契约放的扩展键」(壳写在 models 条目上的 `sema*`)
+ * 不是本函数要分辨的事——那由 settings-schema 的 `EXTENSION_NAMESPACES` 在**声明处**说清(登记的键既不点名也不计数,
+ * 1.5.0 起);到了这里的每一个键都是「写了没生效」的拼错或越界,与 domain-defaulted 同级。此前本仓在下游按 kind/
+ * 按域/按键路径闭集/按 64 满额四层猜意图,每层都被下一轮复审打穿——意图只能在声明处说,消费方不猜。
+ *
+ * 截断:schema 的键列表有界(64),超界带 `truncatedFrom`(真实总数)——文案如实带上,消费方永远不把有界列表当穷举。
+ * 词表是闭集:`switch` 穷举 `kind`,schema 加新 kind 这里编译红,不会静默漏臂。
+ *
+ * **归族判据**(下游两个消费者:候选门 = 非空 ⇒ 这棵树整拒、保 LKG;逐条丢弃面 = 响亮点名、其余照用):每一种告警都是
+ * 「写了没生效」,按**失效的颗粒**分:丢的是**一条条目**(`entry-dropped`)⇒ `scope:"entry"` —— 这条条目单独不在,同域其余条目照用,
+ * 候选**不**因它整拒;丢的是一个域 / 一组键 / 一个文件 ⇒ `scope:"domain"` —— 候选门错误。(settings-schema 11 起读路径上零抬升臂:
+ * 此前「值已被收编接受」的两种告警 `hosts-grandfathered` / `legacy-governance-lifted` 随抬升臂一起退役,旧形由一次性迁移改写,
+ * 读侧遇旧形一律拒 —— 没有「不入诊断面」的那一族了。)
+ *
+ * 🔴 S-704 ②(2026-09-24,凭据轴):此前 `entry-dropped` 归「候选门错误」(settings-schema 2.0.0 提货时的归族),于是
+ * schema 的**逐条容错**在本仓的 refresh / 迟到 boot 两条腿上被**还原成整份拒** —— 目录里一条 `contextWindow:"abc"`
+ * 就让整份目录停在上一代;而上一代若还是 env(boot 拉取失败 / 超窗且无 LKG),env 模型就一直服务、env 钥匙一直被送到
+ * 网关缺省端点(红先实测:`config_candidate_rejected` + env 模型继续服务)。粒度对了规则反而更少:颗粒是条目的失效
+ * 留在条目上,只有颗粒更粗的失效才动候选。
+ */
+import { z } from "zod";
+import { type DroppedEntryIdentity, type DroppedEntryReasonCode, type EffectiveReadWarning } from "@sema-agent/settings-schema";
+/** 折叠产物:`scope` 决定消费方做什么 —— `"domain"` 进候选门(`domainErrors`),`"entry"` 进逐条丢弃面(`droppedEntries`)。 */
+export type FoldedReadWarning = {
+    readonly scope: "domain";
+    readonly domain: string;
+    readonly error: string;
+} | {
+    readonly scope: "entry";
+    readonly domain: string;
+    readonly entry: string;
+    readonly error: string;
+    readonly reasonCode: DroppedEntryReasonCode;
+};
+/** 逐条丢弃面的一行(两条读腿的 `droppedEntries` 同形,`config_entry_dropped` 日志行读它):`entry` = 被丢那条的出门形坐标(`models.1`),
+ *  `error` = 哪些字段、为什么(人读),`reasonCode` = 为什么丢的**闭集词**(S-1295:settings-schema 铸、原样过境 —— 目录行的
+ *  `GET /v1/models.droppedEntries[].reasonCode` 就是这同一个词,取自同一次折叠的同一行)。 */
+export type DroppedConfigEntry = {
+    readonly domain: string;
+    readonly entry: string;
+    readonly error: string;
+    readonly reasonCode: DroppedEntryReasonCode;
+};
+/**
+ * zod 形的错误 → 一行可读的字段诊断(`contextWindow: Invalid input: expected number, received string; apiKeyEnv: <契约句>`)。
+ * 每条 issue 的句子只有一只读法 {@link issueSentenceOf}、坐标只有一只写法 {@link issueCoordinateOf}(整域面 {@link describeDomainIssues} 读同两只);
+ * 坐标缺席(issue 指整条)写 `(entry)`。
+ * 读不出 issues 形 ⇒ `undefined`(调用方退回既有文案)。模型面 stage 的逐条判据、目录载体的 `issues` 与本折叠点共用这一只(一个刻度)。
+ */
+export declare function describeSchemaIssues(error: unknown): string | undefined;
+/**
+ * zod 形错误 → 坏字段的**键路径**(去重保序;`(entry)` = 整条)。与 {@link describeSchemaIssues} 同一只坐标写法({@link issueCoordinateOf}),
+ * 不含值。模型面 stage 的逐条判据(`judgeCatalogEntry`)与本折叠点的被丢条目身份共用这一只 —— 一个刻度。
+ */
+export declare function describeSchemaIssueFields(error: unknown): string[];
+/** 契约句子里**值**的位置在本仓诊断面上的写法(一个洞,不回显值;句子的固定词 —— 迁移指路、词表出路、字段名 —— 原样)。 */
+export declare const SCHEMA_OPERAND_HOLE = "\u00ABvalue\u00BB";
+/**
+ * 整域失效(`domain-defaulted`)的诊断文案:逐条 issue `坐标: 句子`,句子读 {@link issueSentenceOf}(与逐条丢弃面同一只):带结构化操作数的契约句重铸、
+ * 操作数换成 {@link SCHEMA_OPERAND_HOLE};不带的(zod 内建句、退役键墓碑句、迁移指路)原样。读不出 issues 形 ⇒ 退回 {@link errorText}。
+ * 为什么不直接用 `error.message`:zod 4 的 message 是整份 issues 的 JSON —— 本地腿出口的引号段指纹(`redactConfigError`)会把它从第一个
+ * 引号到最后一个引号整段吞掉,契约拒句里点名的迁移 id(「旧形读写两面响亮拒、拒句点名迁移 id」)就到不了运维眼前。
+ */
+export declare function describeDomainIssues(error: unknown): string;
+/** 一条读告警 → 它的诊断面(每一种都进:见文件头「归族判据」)。 */
+export declare function foldEffectiveReadWarning(w: EffectiveReadWarning): FoldedReadWarning;
+/**
+ * 🔴 S-712 / S-1295 —— **被丢目录条目的载体行**(载体 = `EffectiveConfig.models.droppedCatalogEntries`,读腿铸,随 effective 走 —— 盘上 LKG
+ * 从同一个对象落盘,重启从 LKG 起服时它还在)。形的**唯一定义**(型由它推出;判据按它判盘上来的行)。
+ *
+ * **规则一条:读腿把 schema 逐条丢掉的每一条目录条目(`models` 域的 `["models", <下标>]`)记一行,写入时不挑;每个读者读自己要的那一部分。**
+ *  · 墓碑判据(`model-entry-refusal.ts` `judgeCatalogEntries`)—— 有名(`identity.name`)且未停用(`identity.enabled !== false`)的行;
+ *  · `GET /v1/models` 的 `droppedEntries`({@link buildDroppedEntriesWire})—— 每一行的下标、闭集词与可披露身份;
+ *  · `config_entry_dropped` 日志行读的是这一行由之而来的那条折叠行({@link DroppedConfigEntry},同一次折叠、同一个词)。
+ * (修前 S-712 的载体 `droppedIdentities` 在写入时只收「有名且启用」的行 —— 那是墓碑读者的筛子,装在了写入处;同一件事于是没有
+ * 第二个读者可用。筛子回到读者那里,载体就只剩「记下发生了什么」这一条律。)
+ *
+ * 🔐 不含值:`identity` 取告警自带的身份(settings-schema 只铸可披露的标识符 —— 秘密形 / 非标识符的串 ⇒ 该键缺席,三键都没有 ⇒ 整个缺席);
+ * `index` 是条目在**这次读到的那份目录文档** `models` 数组里的原下标(数,不是串);`fields` 是坏字段的键路径、`issues` 是
+ * {@link describeSchemaIssues} 的一行(键名 + 类型词)—— 后两者只供本机拒因句,不上 wire。
+ */
+export declare const DroppedCatalogEntryRow: z.ZodObject<{
+    index: z.ZodNumber;
+    reasonCode: z.ZodEnum<{
+        "entry-schema-invalid": "entry-schema-invalid";
+        "entry-key-invalid": "entry-key-invalid";
+        "entry-unreadable": "entry-unreadable";
+    }>;
+    identity: z.ZodOptional<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        id: z.ZodOptional<z.ZodString>;
+        enabled: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    fields: z.ZodArray<z.ZodString>;
+    issues: z.ZodString;
+}, z.core.$strict>;
+export type DroppedCatalogEntry = z.infer<typeof DroppedCatalogEntryRow>;
+/**
+ * 两条读腿(远端 `http-client.ts` / 本地 `config-provider.ts`)共用的**分面单点**:折叠产物按 `scope` 分进候选门
+ * (`domainErrors`)与逐条丢弃面(`droppedEntries`);逐条丢弃里的**目录条目**同一拍铸进目录载体(`droppedCatalogEntries`,
+ * 一次遍历、一行折叠、一个词 —— 日志行与载体行不各算一次)。`switch` 穷举 —— 加一种 scope 不补臂 = 编译红,两腿不会各分各的。
+ * 文案**未脱敏**:进日志流之前各腿在自己的产出边界上脱敏 —— `domainErrors` 过 `redactConfigError`(引号段读法);`droppedEntries` 的文案是结构化句子
+ * (键名坐标 + 类型词 + 契约整句,值位是洞)、不含配置里的值,只过 `redactSecrets`(契约句的固定词里有引号 / 撇号,引号段读法会把迁移指路整段吞掉)。
+ * 坏行本身照样走 `droppedEntries`(坐标 + 字段 + 词,不带值)。
+ */
+export declare function splitFoldedReadWarnings(warnings: readonly EffectiveReadWarning[]): {
+    domainErrors: Array<{
+        domain: string;
+        error: string;
+    }>;
+    droppedEntries: DroppedConfigEntry[];
+    droppedCatalogEntries: DroppedCatalogEntry[];
+};
+/** 把本次读交出的目录载体挂上 effective 的模型域(两腿同一只;空 ⇒ 不挂键)。 */
+export declare function withDroppedCatalogEntries<E extends {
+    models?: object;
+}>(effective: E, rows: readonly DroppedCatalogEntry[]): E;
+/** `GET /v1/models` 顶层 `droppedEntries` 的一行(wire 形;契约 §A.1d「`GET /v1/models` 的 `droppedEntries`」)。 */
+export interface DroppedEntryWireRow {
+    readonly index: number;
+    readonly reasonCode: DroppedEntryReasonCode;
+    readonly identity?: DroppedEntryIdentity;
+}
+/**
+ * S-1295 —— 本代目录的被丢条目(`config.droppedCatalogEntries`)→ `GET /v1/models` 的 `droppedEntries`。纯投影,**唯一**出口。
+ *  · 词:settings-schema 的闭集原样过境({@link reasonCodeForWire} 穷举:包加词 / 删词 ⇒ 本仓编译红,逼一次「这个词能不能上 wire」的显式决定);
+ *  · 身份:`name` / `id` 在出口再问一次包的 `isDisclosableIdentity`(唯一判据,import 不复制)—— 载体可能来自被手改的盘上 LKG,读腿铸的身份
+ *    本来就过了同一只判据;不可披露 ⇒ 该键不出门(不打码:打过码的串不再是身份);`enabled` 是布尔照带;三键都不剩 ⇒ `identity` 缺席;
+ *  · 不投 `fields` / `issues`(人读的诊断句,不是契约),不投坐标串(下标是数)。
+ * 恒返回数组(零条 = `[]`):键恒在场,缺席只意味着更早的 server。
+ */
+export declare function buildDroppedEntriesWire(rows: readonly DroppedCatalogEntry[]): DroppedEntryWireRow[];
+//# sourceMappingURL=read-warnings.d.ts.map

package/dist/web-admin-client/read-warnings.js

@@ -0,0 +1,168 @@
+import { z } from "zod";
+import { DROPPED_ENTRY_REASON_CODES, formatConfigPath, isDisclosableIdentity, renderQuotedSentence, } from "@sema-agent/settings-schema";
+export function describeSchemaIssues(error) {
+    const issues = schemaIssuesOf(error);
+    if (issues === undefined)
+        return undefined;
+    return issues
+        .map((raw) => `${issueCoordinateOf(raw) ?? "(entry)"}: ${issueSentenceOf(raw)}`)
+        .join("; ");
+}
+function issueCoordinateOf(raw) {
+    const p = typeof raw === "object" && raw !== null ? raw.path : undefined;
+    return Array.isArray(p) && p.length > 0 ? formatConfigPath(p) : undefined;
+}
+function issueSentenceOf(raw) {
+    const message = typeof raw === "object" && raw !== null ? raw.message : undefined;
+    return contractSentenceOf(raw) ?? (typeof message === "string" ? message : "(unreadable issue)");
+}
+function contractSentenceOf(raw) {
+    const params = (typeof raw === "object" && raw !== null ? raw.params : undefined);
+    return params !== undefined && Array.isArray(params.template) && Array.isArray(params.operands)
+        ? renderQuotedSentence(params, () => SCHEMA_OPERAND_HOLE)
+        : undefined;
+}
+function schemaIssuesOf(error) {
+    const issues = typeof error === "object" && error !== null ? error.issues : undefined;
+    return Array.isArray(issues) && issues.length > 0 ? issues : undefined;
+}
+export function describeSchemaIssueFields(error) {
+    const issues = schemaIssuesOf(error) ?? [];
+    return [...new Set(issues.map((raw) => issueCoordinateOf(raw) ?? "(entry)"))];
+}
+const MAX_ERROR_CHARS = 600;
+const TRUNCATED_MARK = "…(truncated)";
+const cap = (s) => (s.length <= MAX_ERROR_CHARS ? s : `${s.slice(0, MAX_ERROR_CHARS - TRUNCATED_MARK.length)}${TRUNCATED_MARK}`);
+const errorText = (e) => (e instanceof Error ? e.message : String(e));
+export const SCHEMA_OPERAND_HOLE = "«value»";
+export function describeDomainIssues(error) {
+    const issues = schemaIssuesOf(error);
+    if (issues === undefined)
+        return errorText(error);
+    return issues
+        .map((raw) => {
+        const at = issueCoordinateOf(raw);
+        const sentence = issueSentenceOf(raw);
+        return at !== undefined ? `${at}: ${sentence}` : sentence;
+    })
+        .join("; ");
+}
+const keyList = (prefix, keys, truncatedFrom) => {
+    const total = truncatedFrom ?? keys.length;
+    const budget = MAX_ERROR_CHARS - prefix.length;
+    const shown = [];
+    let used = 0;
+    const suffixFor = (n) => (n < total ? ` (+${total - n} more, list truncated)` : "");
+    for (const k of keys) {
+        const rendered = formatConfigPath(k);
+        const piece = (shown.length > 0 ? ", " : "") + rendered;
+        if (used + piece.length + suffixFor(shown.length + 1).length > budget)
+            break;
+        shown.push(rendered);
+        used += piece.length;
+    }
+    return `${prefix}${shown.join(", ")}${suffixFor(shown.length)}`;
+};
+export function foldEffectiveReadWarning(w) {
+    switch (w.kind) {
+        case "domain-defaulted":
+            return { scope: "domain", domain: w.domain, error: cap(describeDomainIssues(w.error)) };
+        case "entry-dropped":
+            return { scope: "entry", domain: w.domain, entry: formatConfigPath(w.path), error: cap(`entry dropped by domain schema: ${describeSchemaIssues(w.error) ?? errorText(w.error)}`), reasonCode: droppedReasonCodeOf(w) };
+        case "unknown-keys-dropped":
+            return { scope: "domain", domain: w.domain, error: keyList("unknown keys dropped by domain schema: ", w.keys, w.truncatedFrom) };
+        case "unknown-keys-carried":
+            return { scope: "domain", domain: w.domain, error: keyList("unknown keys carried to consumer (spelling?): ", w.keys, w.truncatedFrom) };
+        case "unread-config-file":
+            return { scope: "domain", domain: w.domain ?? "config.d", error: cap(`unread config file ${w.file} (${w.why})`) };
+        default: {
+            const never = w;
+            throw new Error(`unhandled EffectiveReadWarning kind: ${JSON.stringify(never)}`);
+        }
+    }
+}
+function droppedReasonCodeOf(w) {
+    if (w.reasonCode === undefined) {
+        throw new Error(`entry-dropped warning at ${formatConfigPath(w.path)} carries no reasonCode — settings-schema mints one on every dropped entry, so this warning did not come from the pinned package`);
+    }
+    return w.reasonCode;
+}
+export const DroppedCatalogEntryRow = z
+    .object({
+    index: z.number().int().nonnegative(),
+    reasonCode: z.enum(DROPPED_ENTRY_REASON_CODES),
+    identity: z.object({ name: z.string().optional(), id: z.string().optional(), enabled: z.boolean().optional() }).strict().optional(),
+    fields: z.array(z.string()),
+    issues: z.string(),
+})
+    .strict();
+function catalogIndexOf(w) {
+    return w.kind === "entry-dropped" && w.domain === "models" && w.path.length === 2 && w.path[0] === "models" && typeof w.path[1] === "number" ? w.path[1] : undefined;
+}
+function identityOf(i) {
+    if (i === undefined)
+        return undefined;
+    const out = { ...(i.name !== undefined ? { name: i.name } : {}), ...(i.id !== undefined ? { id: i.id } : {}), ...(i.enabled !== undefined ? { enabled: i.enabled } : {}) };
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+export function splitFoldedReadWarnings(warnings) {
+    const domainErrors = [];
+    const droppedEntries = [];
+    const droppedCatalogEntries = [];
+    for (const w of warnings) {
+        const f = foldEffectiveReadWarning(w);
+        switch (f.scope) {
+            case "domain":
+                domainErrors.push({ domain: f.domain, error: f.error });
+                break;
+            case "entry": {
+                droppedEntries.push({ domain: f.domain, entry: f.entry, error: f.error, reasonCode: f.reasonCode });
+                const index = catalogIndexOf(w);
+                if (index !== undefined && w.kind === "entry-dropped") {
+                    const identity = identityOf(w.identity);
+                    droppedCatalogEntries.push({ index, reasonCode: f.reasonCode, ...(identity !== undefined ? { identity } : {}), fields: describeSchemaIssueFields(w.error), issues: describeSchemaIssues(w.error) ?? "(schema issues unreadable)" });
+                }
+                break;
+            }
+            default: {
+                const never = f;
+                throw new Error(`unhandled folded read-warning scope: ${JSON.stringify(never)}`);
+            }
+        }
+    }
+    return { domainErrors, droppedEntries, droppedCatalogEntries };
+}
+export function withDroppedCatalogEntries(effective, rows) {
+    if (rows.length === 0 || effective.models === undefined)
+        return effective;
+    return { ...effective, models: { ...effective.models, droppedCatalogEntries: [...rows] } };
+}
+export function buildDroppedEntriesWire(rows) {
+    return rows.map((r) => {
+        const identity = disclosableIdentityOf(r.identity);
+        return { index: r.index, reasonCode: reasonCodeForWire(r.reasonCode), ...(identity !== undefined ? { identity } : {}) };
+    });
+}
+function reasonCodeForWire(code) {
+    switch (code) {
+        case "entry-schema-invalid":
+        case "entry-key-invalid":
+        case "entry-unreadable":
+            return code;
+        default: {
+            const never = code;
+            throw new Error(`unhandled DroppedEntryReasonCode: ${JSON.stringify(never)}`);
+        }
+    }
+}
+function disclosableIdentityOf(i) {
+    if (i === undefined)
+        return undefined;
+    const out = {
+        ...(i.name !== undefined && isDisclosableIdentity(i.name) ? { name: i.name } : {}),
+        ...(i.id !== undefined && isDisclosableIdentity(i.id) ? { id: i.id } : {}),
+        ...(i.enabled !== undefined ? { enabled: i.enabled } : {}),
+    };
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+//# sourceMappingURL=read-warnings.js.map

package/dist/{config-center → web-admin-client}/restart-signal.d.ts

@@ -39,8 +39,8 @@ export interface RestartSliceCtx {
 }
 /** S-741(车OG):本引擎发布的重启信号。形的唯一定义是 settings-schema 6.1.0 `RestartSignal`(`{ reasons, version, since }`,在场即信号,
  *  不夹 `restartRequired` 布尔;本地手写的那份接口已删),这里只把 `reasons` 收窄到本文件的闭集 {@link RestartSlice} —— 写口
- *  (`boot/config-center.ts` `publishRestart`)按它收,拼错 / 已退役的词编译红(opus 对抗腿 #2:直接用上游型时 `reasons` 是
- *  `string[]`,闭集的编译期判据丢了)。`/health.restart` 与 fleet 心跳 `restart` 两个出口交 config-center 同一只 `restartState()`
+ *  (`boot/web-admin.ts` `publishRestart`)按它收,拼错 / 已退役的词编译红(opus 对抗腿 #2:直接用上游型时 `reasons` 是
+ *  `string[]`,闭集的编译期判据丢了)。`/health.restart` 与 fleet 心跳 `restart` 两个出口交 web-admin 同一只 `restartState()`
  *  的同一个对象,按契约形出门。 */
 export type EngineRestartSignal = RestartSignal & {
     reasons: RestartSlice[];
@@ -89,6 +89,8 @@ export declare function restartReasons(boot: EffectiveConfig | undefined, curren
  *  undefined` (env-boot plane, no EffectiveConfig to compare) is conservatively "changed": the first center plane
  *  always swaps. Not gated on tier activity: a Runner's expanded catalog goes stale on ANY plane change,
  *  including a tiers-off flip, and the default entry rides the fingerprint because the Runner's copy carries its
- *  own `default` (codex R8; SAME resolver as applyEffective — resolveDefaultModelName, single source). */
+ *  own `default` (codex R8; SAME resolver as applyEffective — settings-schema `resolveCatalogDefaultModel`, single source: a
+ *  `named` default fingerprints by its name, a `{select}` default by its criteria — the engine resolves the same criteria over
+ *  the same fingerprinted catalog and tier table, so equal criteria on an unchanged plane give the same entry). */
 export declare function modelPlaneChanged(prev: EffectiveConfig | undefined, next: EffectiveConfig): boolean;
 //# sourceMappingURL=restart-signal.d.ts.map

package/dist/{config-center → web-admin-client}/restart-signal.js

@@ -1,7 +1,6 @@
-import { resolveActiveTiers } from "@sema-agent/settings-schema";
+import { resolveActiveTiers, resolveCatalogDefaultModel } from "@sema-agent/settings-schema";
 import { stableStringify } from "@sema-agent/settings-schema/hash";
 import { DEFAULT_PLUGIN_ALLOW_HOSTS, materializablePlugins } from "../capabilities/center-plugins.js";
-import { resolveDefaultModelName } from "./apply-effective.js";
 import { CENTER_READ_FACE_LIVE_KEYS } from "./read-face.js";
 const RESTART_SLICES = ["skills", "mcp", "a2a", "scenarios", "degrade-route", "read-face", "memory-consolidation"];
 function enabledOnly(rows) {
@@ -83,8 +82,8 @@ export function modelPlaneChanged(prev, next) {
         const enabled = enabledOnly(e.models?.models);
         const active = e.models ? (resolveActiveTiers(e.models) ?? null) : null;
         const names = new Set((enabled ?? []).map((m) => m.name));
-        const def = resolveDefaultModelName(e, (n) => names.has(n), enabled?.[0]?.name ?? "");
-        return stableStringify({ models: planeEntriesFingerprint(e.models?.models), tiers: active, default: def.name });
+        const def = e.models ? resolveCatalogDefaultModel(e.models, (n) => names.has(n), enabled?.[0]?.name ?? "") : undefined;
+        return stableStringify({ models: planeEntriesFingerprint(e.models?.models), tiers: active, default: def === undefined ? null : def.kind === "named" ? def.name : { select: def.select } });
     };
     return fp(prev) !== fp(next);
 }

package/dist/{config-center → web-admin-client}/skills-mcp.d.ts

@@ -5,7 +5,7 @@ import type { LoadedSkill } from "../capabilities/skills.js";
 import type { CenterEndpoint } from "./center-request.js";
 import type { CenterA2aPeer, CenterMcpServer, CenterSkillManifest } from "./types.js";
 /**
- * Merge center skills OVER the image baseline ([ref]-sibling B1; `sema-registry docs/MCP-SKILLS.md`). Load order =
+ * Merge center skills OVER the image baseline ([ref]-sibling B1; `web-admin docs/MCP-SKILLS.md`). Load order =
  * `loadSkills(SKILLS_DIR)` baseline → center skills lazily fetched by hash and overlaid BY NAME (center
  * wins on a clash → can override a built-in; guarded center-side by publisher RBAC + the publish gate).
  * `enabled:false` is skipped. Content is verified + cached by hash (same hash fetched once). A skill whose