@sema-agent/server 7.123.0 → 7.124.0

package/dist/{config-center → web-admin-client}/facade.js

@@ -1,5 +1,5 @@
-export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
-export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, MODEL_PLANE_DOMAINS, withModelPlaneOf, fullyLandedForLkg, } from "./apply-effective.js";
+export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, WebAdminHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
+export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, logEffectiveDiff, MODEL_PLANE_DOMAINS, withModelPlaneOf, fullyLandedForLkg, } from "./apply-effective.js";
 export { restartReasons, modelPlaneChanged, } from "./restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
 export { applyCenterReadFace, CENTER_READ_FACE_LIVE_KEYS } from "./read-face.js";

package/dist/{config-center → web-admin-client}/http-client.d.ts

@@ -9,11 +9,7 @@ import { type CenterEndpoint } from "./center-request.js";
  *  boot/refresh 的候选门直接消费。`droppedEntries`(S-704 ②):schema 逐条丢掉的条目(坐标 + 字段诊断)——
  *  **不**进候选门,调用方响亮点名、其余照用(分面单点 `splitFoldedReadWarnings`,与本地腿同一只)。
  *
- *  `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),与本地腿同键同义。折叠是**有损**的——
- *  `hosts-grandfathered` / `legacy-governance-lifted` 两员按律折成 `null`(值已被收编接受,见
- *  `read-warnings.ts` 头注),于是只看 `domainErrors` 的人**永远**看不见兼容臂有没有开着;而契约把
- *  `legacy-governance-lifted` 铸出来,理由逐字写在 `legacyGovernanceFromRuntime` 的 SUNSET 注里:
- *  「关窗的前提是有人知道它还开着」。两条读腿各返一份原流,那句话在本仓才成立。
+ *  `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),与本地腿同键同义(读者:一致性门的读腿适配器,见本地腿同名键注)。
  *  🔐 原流的 `error` 字段**未经** `redactConfigError`(那道脱敏挂在真正进日志流的 `domainErrors` 产出边界上)
  *  —— 任何把本键路由进结构化日志/审计流的消费者必须自己先脱敏。
  *
@@ -36,12 +32,12 @@ export declare function fetchEffective(center: CenterEndpoint, etag: string | un
  * Center pre-resolves the tighten-only intersection (fleet defaults ∩ tier ⊕ roles + overrides) and returns a
  * `runtimeCaps` block — the service passes it through verbatim (no further tightening, per center's ruling).
  *
- * 🔐 TOKEN/WORKER (center ruling, sema-registry `aeb4979`): two valid postures —
+ * 🔐 TOKEN/WORKER (center ruling, web-admin `aeb4979`): two valid postures —
  *   • FULL `SERVICE_PULL_TOKEN` + `?principal=` → full per-user body (caps + per-user config).
  *   • worker-scoped `wpt_<self>` + `?principal=&worker=<self>` → **caps-only** body (`{principal, configured,
  *     runtimeCaps, budget}`; never other tenants' config) — a worker MAY resolve its OWN worker's principals.
  *   A `wpt_` with NO `?worker=` (or a mismatched worker) still 403s. So we ALWAYS pass `?worker=` when the
- *   deployment has one (`SEMA_REGISTRY_WORKER`): it authorizes the wpt_ path AND is harmless on the full token
+ *   deployment has one (`SEMA_WEB_ADMIN_WORKER`): it authorizes the wpt_ path AND is harmless on the full token
  *   (the caps value is worker-independent — `resolveEntitlement` resolves from the principal alone; worker only
  *   scopes the config view we ignore). This re-adds the `worker` arg dropped in 1.14.0 (L2-3) — center's ruling
  *   makes it load-bearing for AUTHORIZATION, not for the caps value.
@@ -77,9 +73,9 @@ export declare function fetchPrincipalCaps(center: CenterEndpoint, principal: st
  * 因此 304 在传输层就是 fail-loud。
  */
 export declare function fetchPrincipalOrgMemory(center: CenterEndpoint, principal: string, fetchImpl?: typeof fetch, worker?: string): Promise<unknown>;
-/** An HTTP error from a config-center fetch that carries the response status so callers can branch on it
+/** An HTTP error from a web-admin fetch that carries the response status so callers can branch on it
  *  (e.g. translate a 404 to "unknown hash → undefined") WITHOUT parsing the message string. */
-export declare class ConfigCenterHttpError extends Error {
+export declare class WebAdminHttpError extends Error {
     readonly status: number;
     constructor(message: string, status: number);
 }
@@ -87,7 +83,7 @@ export declare class ConfigCenterHttpError extends Error {
  * Fetch one skill's body by content hash (`GET <content root>/skills/content/<hash>`, Bearer; the root is
  * `/api/v1/me` for a user-JWT credential and `/api/config` otherwise — center-request.ts) and VERIFY its
  * sha256 matches the manifest hash (integrity + rewrite check). The content is immutable per hash, so the
- * caller caches by hash and never re-fetches an unchanged skill. Throws a {@link ConfigCenterHttpError}
+ * caller caches by hash and never re-fetches an unchanged skill. Throws a {@link WebAdminHttpError}
  * (carrying `.status`) on an HTTP error — INCLUDING 404 — or a plain Error on hash mismatch. Callers that
  * want "unknown hash → undefined" parity with the local backend inspect `.status === 404` and swallow it;
  * the legacy `applyCenterSkills` path keeps treating every throw as "skip this skill, keep baseline".

package/dist/{config-center → web-admin-client}/http-client.js

@@ -9,7 +9,7 @@ export async function fetchEffective(center, etag, fetchImpl = fetch, worker) {
     if (res.status === 304)
         return null;
     if (!res.ok)
-        throw new Error(`config-center HTTP ${res.status}`);
+        throw new Error(`web-admin HTTP ${res.status}`);
     const warnings = [];
     const body = await res.json();
     const wire = readEffectiveWire(body, (w) => warnings.push(w));
@@ -35,7 +35,7 @@ export async function fetchPrincipalCaps(center, principal, etag, fetchImpl = fe
         return null;
     const parsedBody = PrincipalCapsWire.safeParse(raw.json);
     if (!parsedBody.success) {
-        throw new Error(`config-center principal-caps body failed schema validation: ${parsedBody.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ").slice(0, 600)}`);
+        throw new Error(`web-admin principal-caps body failed schema validation: ${parsedBody.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ").slice(0, 600)}`);
     }
     const body = parsedBody.data;
     assertPrincipalEcho(body.principal, principal);
@@ -79,7 +79,7 @@ export async function fetchPrincipalCaps(center, principal, etag, fetchImpl = fe
 }
 function assertPrincipalEcho(echoed, principal) {
     if (echoed !== undefined && echoed !== principal) {
-        throw new Error(`config-center principal-caps response echoes principal ${JSON.stringify(echoed)} but ${JSON.stringify(principal)} was requested — discarding the whole response`);
+        throw new Error(`web-admin principal-caps response echoes principal ${JSON.stringify(echoed)} but ${JSON.stringify(principal)} was requested — discarding the whole response`);
     }
 }
 async function requestPrincipalView(center, principal, etag, fetchImpl, worker) {
@@ -91,12 +91,12 @@ async function requestPrincipalView(center, principal, etag, fetchImpl, worker)
     };
     if (res.status === 304) {
         if (!etag)
-            throw new Error("config-center returned 304 to a non-conditional principal-caps request");
+            throw new Error("web-admin returned 304 to a non-conditional principal-caps request");
         stillCurrent();
         return null;
     }
     if (!res.ok)
-        throw new Error(`config-center principal-caps HTTP ${res.status}`);
+        throw new Error(`web-admin principal-caps HTTP ${res.status}`);
     const responseEtag = res.headers.get("etag");
     const json = await res.json();
     stillCurrent();
@@ -106,26 +106,26 @@ const PrincipalOrgMemoryEnvelope = PrincipalCapsWire.pick({ principal: true, org
 export async function fetchPrincipalOrgMemory(center, principal, fetchImpl = fetch, worker) {
     const raw = await requestPrincipalView(center, principal, undefined, fetchImpl, worker);
     if (raw === null)
-        throw new Error("config-center returned 304 to a non-conditional org-directory fetch");
+        throw new Error("web-admin returned 304 to a non-conditional org-directory fetch");
     const parsed = PrincipalOrgMemoryEnvelope.safeParse(raw.json);
     if (!parsed.success) {
-        throw new Error(`config-center org-memory section failed schema validation: ${parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ").slice(0, 600)}`);
+        throw new Error(`web-admin org-memory section failed schema validation: ${parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ").slice(0, 600)}`);
     }
     assertPrincipalEcho(parsed.data.principal, principal);
     return parsed.data.orgMemory;
 }
-export class ConfigCenterHttpError extends Error {
+export class WebAdminHttpError extends Error {
     status;
     constructor(message, status) {
         super(message);
         this.status = status;
-        this.name = "ConfigCenterHttpError";
+        this.name = "WebAdminHttpError";
     }
 }
 export async function fetchSkillContent(center, contentHash, fetchImpl = fetch) {
     const { res } = await centerFetch(center, { kind: "skill-content", contentHash }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
-        throw new ConfigCenterHttpError(`skill content HTTP ${res.status} for ${contentHash}`, res.status);
+        throw new WebAdminHttpError(`skill content HTTP ${res.status} for ${contentHash}`, res.status);
     const content = await res.text();
     const want = contentHash.replace(/^sha256:/, "").toLowerCase();
     const got = createHash("sha256").update(content, "utf8").digest("hex");
@@ -136,13 +136,13 @@ export async function fetchSkillContent(center, contentHash, fetchImpl = fetch)
 export async function fetchPromptArtifact(center, artifactDigest, fetchImpl = fetch) {
     const { res } = await centerFetch(center, { kind: "prompt-artifact", digest: artifactDigest }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
-        throw new ConfigCenterHttpError(`prompt artifact HTTP ${res.status} for ${artifactDigest}`, res.status);
+        throw new WebAdminHttpError(`prompt artifact HTTP ${res.status} for ${artifactDigest}`, res.status);
     return await res.json();
 }
 export async function fetchPromptBlob(center, contentDigest, fetchImpl = fetch) {
     const { res } = await centerFetch(center, { kind: "prompt-blob", digest: contentDigest }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
-        throw new ConfigCenterHttpError(`prompt blob HTTP ${res.status} for ${contentDigest}`, res.status);
+        throw new WebAdminHttpError(`prompt blob HTTP ${res.status} for ${contentDigest}`, res.status);
     const bytes = new Uint8Array(await res.arrayBuffer());
     const want = contentDigest.replace(/^sha256:/, "").toLowerCase();
     const got = createHash("sha256").update(bytes).digest("hex");

package/dist/{config-center → web-admin-client}/pull-state.d.ts

@@ -1,6 +1,6 @@
 /**
  * S-866 ②(设计稿 v1.1 §2②)—— 「这台引擎**此刻**是不是真的接着中心」的两件读数:最近一次实拉的结局(`lastPull`)与生效修订号
- * (`effectiveRevision`)。属主 = config-center 运行时(`boot/config-center.ts` 的 `centerPullState()`);读者 = caps `centerWiring`。
+ * (`effectiveRevision`)。属主 = web-admin 运行时(`boot/web-admin.ts` 的 `centerPullState()`);读者 = caps `centerWiring`。
  *
  * 纯叶(零值 import):词表与读面形住这里,运行时与读面两侧都从这里取型,不各写一份。
  */

package/dist/{config-center → web-admin-client}/read-face.js

@@ -59,7 +59,7 @@ export function applyCenterReadFace(config, eff, logger, apply = { phase: "boot"
         return report();
     }
     if (typeof domain !== "object" || Array.isArray(domain)) {
-        logger?.warn("sema_registry_read_face_invalid", {
+        logger?.warn("web_admin_read_face_invalid", {
             detail: `published readFace domain must be an object with optional {face,denyPatterns,denyBuiltinTiers,denyBuiltinExclude} — got ${Array.isArray(domain) ? "array" : typeof domain}`,
             kept: "the deployment's env READ-face posture is unchanged (refusing a malformed domain WHOLE — a half-applied read-containment posture is worse than none)",
         });
@@ -90,7 +90,7 @@ export function applyCenterReadFace(config, eff, logger, apply = { phase: "boot"
             resolveReadDenyBuiltins(builtinsArg(finalTiers, finalExclude));
     }
     catch (e) {
-        logger?.warn("sema_registry_read_face_invalid", {
+        logger?.warn("web_admin_read_face_invalid", {
             detail: e instanceof Error ? e.message : String(e),
             kept: "the deployment's env READ-face posture is unchanged (refusing the readFace domain WHOLE — applying half of a read-containment posture would read as 'policy landed' while part of it silently did not)",
         });
@@ -112,13 +112,13 @@ export function applyCenterReadFace(config, eff, logger, apply = { phase: "boot"
             config.readDenyBuiltinExclude = staged.readDenyBuiltinExclude;
     }
     if (envHeld.length > 0) {
-        logger?.warn("sema_registry_read_face_env_wins", {
+        logger?.warn("web_admin_read_face_env_wins", {
             keys: envHeld,
             note: "this machine's explicit env READ-face keys WIN over the published readFace domain (deployment sovereignty) — the published values for these keys were NOT applied; unset the env key if the org publication should own it",
         });
     }
     if (Object.keys(staged).length > 0) {
-        logger?.info("sema_registry_read_face", {
+        logger?.info("web_admin_read_face", {
             applied: Object.keys(staged).filter((k) => apply.phase === "boot" || KEY_MAP.some((r) => r.cfgKey === k && CENTER_READ_FACE_LIVE_KEYS.has(r.centerKey))),
             ...(staged.readFace !== undefined ? { face: staged.readFace } : {}),
             note: apply.phase === "boot"

package/dist/{config-center → web-admin-client}/read-warnings.d.ts

@@ -10,20 +10,17 @@
  * 截断:schema 的键列表有界(64),超界带 `truncatedFrom`(真实总数)——文案如实带上,消费方永远不把有界列表当穷举。
  * 词表是闭集:`switch` 穷举 `kind`,schema 加新 kind 这里编译红,不会静默漏臂。
  *
- * **归族判据两问**(下游两个消费者:候选门 = 非空 ⇒ 这棵树整拒、保 LKG;逐条丢弃面 = 响亮点名、其余照用):
- *  ① 值**已被收编接受**(写了、生效了、只是换了个位置或被夹住)⇒ 不入诊断面(`null`);
- *  ② 写了没生效的,按**失效的颗粒**分:丢的是**一条条目**(`entry-dropped`)⇒ `scope:"entry"` —— 这条条目单独
- *     不在,同域其余条目照用,候选**不**因它整拒;丢的是一个域 / 一组键 / 一个文件 ⇒ `scope:"domain"` —— 候选门错误。
+ * **归族判据**(下游两个消费者:候选门 = 非空 ⇒ 这棵树整拒、保 LKG;逐条丢弃面 = 响亮点名、其余照用):每一种告警都是
+ * 「写了没生效」,按**失效的颗粒**分:丢的是**一条条目**(`entry-dropped`)⇒ `scope:"entry"` —— 这条条目单独不在,同域其余条目照用,
+ * 候选**不**因它整拒;丢的是一个域 / 一组键 / 一个文件 ⇒ `scope:"domain"` —— 候选门错误。(settings-schema 11 起读路径上零抬升臂:
+ * 此前「值已被收编接受」的两种告警 `hosts-grandfathered` / `legacy-governance-lifted` 随抬升臂一起退役,旧形由一次性迁移改写,
+ * 读侧遇旧形一律拒 —— 没有「不入诊断面」的那一族了。)
  *
  * 🔴 S-704 ②(2026-09-24,凭据轴):此前 `entry-dropped` 归「候选门错误」(settings-schema 2.0.0 提货时的归族),于是
  * schema 的**逐条容错**在本仓的 refresh / 迟到 boot 两条腿上被**还原成整份拒** —— 目录里一条 `contextWindow:"abc"`
  * 就让整份目录停在上一代;而上一代若还是 env(boot 拉取失败 / 超窗且无 LKG),env 模型就一直服务、env 钥匙一直被送到
  * 网关缺省端点(红先实测:`config_candidate_rejected` + env 模型继续服务)。粒度对了规则反而更少:颗粒是条目的失效
  * 留在条目上,只有颗粒更粗的失效才动候选。
- * `legacy-governance-lifted`(0.5 期 runtime 文档里的治理三闸被抬进 governance 域)归①——那几个键**生效了**
- * (`buildEffective` 用抬升结果解析 governance),把它折成错误会让一份合法的 0.5 期存量配置每一次 refresh 都被
- * 候选门整拒,而它在 1.10.0 上零告警零 domainErrors(亲验读数)。兼容臂的关窗观测归属主(settings-schema 的
- * `onWarning` 流),不借候选门这条带副作用的通道传信息。
  */
 import { z } from "zod";
 import { type DroppedEntryIdentity, type DroppedEntryReasonCode, type EffectiveReadWarning } from "@sema-agent/settings-schema";
@@ -49,19 +46,28 @@ export type DroppedConfigEntry = {
     readonly reasonCode: DroppedEntryReasonCode;
 };
 /**
- * zod 形的错误 → 一行可读的字段诊断(`contextWindow: expected number, received string; api: custom`)。
- * **只读**每条 issue 的 `path`(键名)与 `code`,`invalid_type` 臂另读 `expected` / `received`(两者都是**类型词**)——
- * 刻意不读 `message`(自定义 refine 的 message 可以回声值)与 `invalid_enum_value` 等臂的 `received`(那是原值)。
- * 读不出 issues 形 ⇒ `undefined`(调用方退回既有文案)。模型面 stage 的逐条判据与本折叠点共用这一只(一个刻度)。
+ * zod 形的错误 → 一行可读的字段诊断(`contextWindow: Invalid input: expected number, received string; apiKeyEnv: <契约句>`)。
+ * 每条 issue 的句子只有一只读法 {@link issueSentenceOf}、坐标只有一只写法 {@link issueCoordinateOf}(整域面 {@link describeDomainIssues} 读同两只);
+ * 坐标缺席(issue 指整条)写 `(entry)`。
+ * 读不出 issues 形 ⇒ `undefined`(调用方退回既有文案)。模型面 stage 的逐条判据、目录载体的 `issues` 与本折叠点共用这一只(一个刻度)。
  */
 export declare function describeSchemaIssues(error: unknown): string | undefined;
 /**
- * zod 形错误 → 坏字段的**键路径**(去重保序;`(entry)` = 整条)。与 {@link describeSchemaIssues} 同一只读法(只读 `path`),
+ * zod 形错误 → 坏字段的**键路径**(去重保序;`(entry)` = 整条)。与 {@link describeSchemaIssues} 同一只坐标写法({@link issueCoordinateOf}),
  * 不含值。模型面 stage 的逐条判据(`judgeCatalogEntry`)与本折叠点的被丢条目身份共用这一只 —— 一个刻度。
  */
 export declare function describeSchemaIssueFields(error: unknown): string[];
-/** null = 不入诊断面(`hosts-grandfathered` / `legacy-governance-lifted`:值已被收编接受,与本地店同口径)。 */
-export declare function foldEffectiveReadWarning(w: EffectiveReadWarning): FoldedReadWarning | null;
+/** 契约句子里**值**的位置在本仓诊断面上的写法(一个洞,不回显值;句子的固定词 —— 迁移指路、词表出路、字段名 —— 原样)。 */
+export declare const SCHEMA_OPERAND_HOLE = "\u00ABvalue\u00BB";
+/**
+ * 整域失效(`domain-defaulted`)的诊断文案:逐条 issue `坐标: 句子`,句子读 {@link issueSentenceOf}(与逐条丢弃面同一只):带结构化操作数的契约句重铸、
+ * 操作数换成 {@link SCHEMA_OPERAND_HOLE};不带的(zod 内建句、退役键墓碑句、迁移指路)原样。读不出 issues 形 ⇒ 退回 {@link errorText}。
+ * 为什么不直接用 `error.message`:zod 4 的 message 是整份 issues 的 JSON —— 本地腿出口的引号段指纹(`redactConfigError`)会把它从第一个
+ * 引号到最后一个引号整段吞掉,契约拒句里点名的迁移 id(「旧形读写两面响亮拒、拒句点名迁移 id」)就到不了运维眼前。
+ */
+export declare function describeDomainIssues(error: unknown): string;
+/** 一条读告警 → 它的诊断面(每一种都进:见文件头「归族判据」)。 */
+export declare function foldEffectiveReadWarning(w: EffectiveReadWarning): FoldedReadWarning;
 /**
  * 🔴 S-712 / S-1295 —— **被丢目录条目的载体行**(载体 = `EffectiveConfig.models.droppedCatalogEntries`,读腿铸,随 effective 走 —— 盘上 LKG
  * 从同一个对象落盘,重启从 LKG 起服时它还在)。形的**唯一定义**(型由它推出;判据按它判盘上来的行)。
@@ -97,7 +103,8 @@ export type DroppedCatalogEntry = z.infer<typeof DroppedCatalogEntryRow>;
  * 两条读腿(远端 `http-client.ts` / 本地 `config-provider.ts`)共用的**分面单点**:折叠产物按 `scope` 分进候选门
  * (`domainErrors`)与逐条丢弃面(`droppedEntries`);逐条丢弃里的**目录条目**同一拍铸进目录载体(`droppedCatalogEntries`,
  * 一次遍历、一行折叠、一个词 —— 日志行与载体行不各算一次)。`switch` 穷举 —— 加一种 scope 不补臂 = 编译红,两腿不会各分各的。
- * 文案**未脱敏**:进日志流之前各腿在自己的产出边界上过 `redactConfigError`(与 `domainErrors` 同一道)。
+ * 文案**未脱敏**:进日志流之前各腿在自己的产出边界上脱敏 —— `domainErrors` 过 `redactConfigError`(引号段读法);`droppedEntries` 的文案是结构化句子
+ * (键名坐标 + 类型词 + 契约整句,值位是洞)、不含配置里的值,只过 `redactSecrets`(契约句的固定词里有引号 / 撇号,引号段读法会把迁移指路整段吞掉)。
  * 坏行本身照样走 `droppedEntries`(坐标 + 字段 + 词,不带值)。
  */
 export declare function splitFoldedReadWarnings(warnings: readonly EffectiveReadWarning[]): {

package/dist/{config-center → web-admin-client}/read-warnings.js

@@ -1,37 +1,52 @@
 import { z } from "zod";
-import { DROPPED_ENTRY_REASON_CODES, formatConfigPath, isDisclosableIdentity, } from "@sema-agent/settings-schema";
+import { DROPPED_ENTRY_REASON_CODES, formatConfigPath, isDisclosableIdentity, renderQuotedSentence, } from "@sema-agent/settings-schema";
 export function describeSchemaIssues(error) {
     const issues = schemaIssuesOf(error);
     if (issues === undefined)
         return undefined;
     return issues
-        .map((raw) => {
-        const i = (typeof raw === "object" && raw !== null ? raw : {});
-        const field = Array.isArray(i.path) && i.path.length > 0 ? i.path.map(String).join(".") : "(entry)";
-        const what = i.code === "invalid_type" && typeof i.expected === "string" && typeof i.received === "string"
-            ? `expected ${i.expected}, received ${i.received}`
-            : typeof i.code === "string"
-                ? i.code
-                : "invalid";
-        return `${field}: ${what}`;
-    })
+        .map((raw) => `${issueCoordinateOf(raw) ?? "(entry)"}: ${issueSentenceOf(raw)}`)
         .join("; ");
 }
+function issueCoordinateOf(raw) {
+    const p = typeof raw === "object" && raw !== null ? raw.path : undefined;
+    return Array.isArray(p) && p.length > 0 ? formatConfigPath(p) : undefined;
+}
+function issueSentenceOf(raw) {
+    const message = typeof raw === "object" && raw !== null ? raw.message : undefined;
+    return contractSentenceOf(raw) ?? (typeof message === "string" ? message : "(unreadable issue)");
+}
+function contractSentenceOf(raw) {
+    const params = (typeof raw === "object" && raw !== null ? raw.params : undefined);
+    return params !== undefined && Array.isArray(params.template) && Array.isArray(params.operands)
+        ? renderQuotedSentence(params, () => SCHEMA_OPERAND_HOLE)
+        : undefined;
+}
 function schemaIssuesOf(error) {
     const issues = typeof error === "object" && error !== null ? error.issues : undefined;
     return Array.isArray(issues) && issues.length > 0 ? issues : undefined;
 }
 export function describeSchemaIssueFields(error) {
     const issues = schemaIssuesOf(error) ?? [];
-    const fields = issues.map((raw) => {
-        const p = typeof raw === "object" && raw !== null ? raw.path : undefined;
-        return Array.isArray(p) && p.length > 0 ? p.map(String).join(".") : "(entry)";
-    });
-    return [...new Set(fields)];
+    return [...new Set(issues.map((raw) => issueCoordinateOf(raw) ?? "(entry)"))];
 }
 const MAX_ERROR_CHARS = 600;
-const cap = (s) => s.slice(0, MAX_ERROR_CHARS);
+const TRUNCATED_MARK = "…(truncated)";
+const cap = (s) => (s.length <= MAX_ERROR_CHARS ? s : `${s.slice(0, MAX_ERROR_CHARS - TRUNCATED_MARK.length)}${TRUNCATED_MARK}`);
 const errorText = (e) => (e instanceof Error ? e.message : String(e));
+export const SCHEMA_OPERAND_HOLE = "«value»";
+export function describeDomainIssues(error) {
+    const issues = schemaIssuesOf(error);
+    if (issues === undefined)
+        return errorText(error);
+    return issues
+        .map((raw) => {
+        const at = issueCoordinateOf(raw);
+        const sentence = issueSentenceOf(raw);
+        return at !== undefined ? `${at}: ${sentence}` : sentence;
+    })
+        .join("; ");
+}
 const keyList = (prefix, keys, truncatedFrom) => {
     const total = truncatedFrom ?? keys.length;
     const budget = MAX_ERROR_CHARS - prefix.length;
@@ -50,11 +65,8 @@ const keyList = (prefix, keys, truncatedFrom) => {
 };
 export function foldEffectiveReadWarning(w) {
     switch (w.kind) {
-        case "hosts-grandfathered":
-        case "legacy-governance-lifted":
-            return null;
         case "domain-defaulted":
-            return { scope: "domain", domain: w.domain, error: cap(errorText(w.error)) };
+            return { scope: "domain", domain: w.domain, error: cap(describeDomainIssues(w.error)) };
         case "entry-dropped":
             return { scope: "entry", domain: w.domain, entry: formatConfigPath(w.path), error: cap(`entry dropped by domain schema: ${describeSchemaIssues(w.error) ?? errorText(w.error)}`), reasonCode: droppedReasonCodeOf(w) };
         case "unknown-keys-dropped":
@@ -99,8 +111,6 @@ export function splitFoldedReadWarnings(warnings) {
     const droppedCatalogEntries = [];
     for (const w of warnings) {
         const f = foldEffectiveReadWarning(w);
-        if (f === null)
-            continue;
         switch (f.scope) {
             case "domain":
                 domainErrors.push({ domain: f.domain, error: f.error });

package/dist/{config-center → web-admin-client}/restart-signal.d.ts

@@ -39,8 +39,8 @@ export interface RestartSliceCtx {
 }
 /** S-741(车OG):本引擎发布的重启信号。形的唯一定义是 settings-schema 6.1.0 `RestartSignal`(`{ reasons, version, since }`,在场即信号,
  *  不夹 `restartRequired` 布尔;本地手写的那份接口已删),这里只把 `reasons` 收窄到本文件的闭集 {@link RestartSlice} —— 写口
- *  (`boot/config-center.ts` `publishRestart`)按它收,拼错 / 已退役的词编译红(opus 对抗腿 #2:直接用上游型时 `reasons` 是
- *  `string[]`,闭集的编译期判据丢了)。`/health.restart` 与 fleet 心跳 `restart` 两个出口交 config-center 同一只 `restartState()`
+ *  (`boot/web-admin.ts` `publishRestart`)按它收,拼错 / 已退役的词编译红(opus 对抗腿 #2:直接用上游型时 `reasons` 是
+ *  `string[]`,闭集的编译期判据丢了)。`/health.restart` 与 fleet 心跳 `restart` 两个出口交 web-admin 同一只 `restartState()`
  *  的同一个对象,按契约形出门。 */
 export type EngineRestartSignal = RestartSignal & {
     reasons: RestartSlice[];
@@ -89,6 +89,8 @@ export declare function restartReasons(boot: EffectiveConfig | undefined, curren
  *  undefined` (env-boot plane, no EffectiveConfig to compare) is conservatively "changed": the first center plane
  *  always swaps. Not gated on tier activity: a Runner's expanded catalog goes stale on ANY plane change,
  *  including a tiers-off flip, and the default entry rides the fingerprint because the Runner's copy carries its
- *  own `default` (codex R8; SAME resolver as applyEffective — resolveDefaultModelName, single source). */
+ *  own `default` (codex R8; SAME resolver as applyEffective — settings-schema `resolveCatalogDefaultModel`, single source: a
+ *  `named` default fingerprints by its name, a `{select}` default by its criteria — the engine resolves the same criteria over
+ *  the same fingerprinted catalog and tier table, so equal criteria on an unchanged plane give the same entry). */
 export declare function modelPlaneChanged(prev: EffectiveConfig | undefined, next: EffectiveConfig): boolean;
 //# sourceMappingURL=restart-signal.d.ts.map

package/dist/{config-center → web-admin-client}/restart-signal.js

@@ -1,7 +1,6 @@
-import { resolveActiveTiers } from "@sema-agent/settings-schema";
+import { resolveActiveTiers, resolveCatalogDefaultModel } from "@sema-agent/settings-schema";
 import { stableStringify } from "@sema-agent/settings-schema/hash";
 import { DEFAULT_PLUGIN_ALLOW_HOSTS, materializablePlugins } from "../capabilities/center-plugins.js";
-import { resolveDefaultModelName } from "./apply-effective.js";
 import { CENTER_READ_FACE_LIVE_KEYS } from "./read-face.js";
 const RESTART_SLICES = ["skills", "mcp", "a2a", "scenarios", "degrade-route", "read-face", "memory-consolidation"];
 function enabledOnly(rows) {
@@ -83,8 +82,8 @@ export function modelPlaneChanged(prev, next) {
         const enabled = enabledOnly(e.models?.models);
         const active = e.models ? (resolveActiveTiers(e.models) ?? null) : null;
         const names = new Set((enabled ?? []).map((m) => m.name));
-        const def = resolveDefaultModelName(e, (n) => names.has(n), enabled?.[0]?.name ?? "");
-        return stableStringify({ models: planeEntriesFingerprint(e.models?.models), tiers: active, default: def.name });
+        const def = e.models ? resolveCatalogDefaultModel(e.models, (n) => names.has(n), enabled?.[0]?.name ?? "") : undefined;
+        return stableStringify({ models: planeEntriesFingerprint(e.models?.models), tiers: active, default: def === undefined ? null : def.kind === "named" ? def.name : { select: def.select } });
     };
     return fp(prev) !== fp(next);
 }

package/dist/{config-center → web-admin-client}/skills-mcp.d.ts

@@ -5,7 +5,7 @@ import type { LoadedSkill } from "../capabilities/skills.js";
 import type { CenterEndpoint } from "./center-request.js";
 import type { CenterA2aPeer, CenterMcpServer, CenterSkillManifest } from "./types.js";
 /**
- * Merge center skills OVER the image baseline ([ref]-sibling B1; `sema-registry docs/MCP-SKILLS.md`). Load order =
+ * Merge center skills OVER the image baseline ([ref]-sibling B1; `web-admin docs/MCP-SKILLS.md`). Load order =
  * `loadSkills(SKILLS_DIR)` baseline → center skills lazily fetched by hash and overlaid BY NAME (center
  * wins on a clash → can override a built-in; guarded center-side by publisher RBAC + the publish gate).
  * `enabled:false` is skipped. Content is verified + cached by hash (same hash fetched once). A skill whose

package/dist/{config-center → web-admin-client}/skills-mcp.js

@@ -18,7 +18,7 @@ export async function applyCenterSkills(baseline, manifest, center, logger, fetc
             const text = await fsp.readFile(joinPath(diskCacheDir, hex), "utf8");
             if (skillContentHash(text) === hash)
                 return text;
-            logger?.warn("sema_registry_skill_cache_corrupt", { hash, note: "on-disk body fails its own hash — ignored, refetching from center" });
+            logger?.warn("web_admin_skill_cache_corrupt", { hash, note: "on-disk body fails its own hash — ignored, refetching from center" });
         }
         catch {
         }
@@ -34,7 +34,7 @@ export async function applyCenterSkills(baseline, manifest, center, logger, fetc
             const tmp = joinPath(diskCacheDir, `${hex}.${Math.random().toString(36).slice(2, 8)}.tmp`);
             await fsp.writeFile(tmp, content, { mode: 0o600 });
             await fsp.rename(tmp, joinPath(diskCacheDir, hex));
-        })().catch((err) => logger?.warn("sema_registry_skill_cache_write_failed", { hash, err: String(err) })));
+        })().catch((err) => logger?.warn("web_admin_skill_cache_write_failed", { hash, err: String(err) })));
     };
     const byName = new Map(baseline.map((s) => [s.spec.name, s]));
     const contentCache = new Map();
@@ -43,7 +43,7 @@ export async function applyCenterSkills(baseline, manifest, center, logger, fetc
         if (m.enabled === false)
             continue;
         if (seenNames.has(m.name))
-            logger?.warn("sema_registry_skill_duplicate_name", { name: m.name, note: "duplicate name in center manifest — last entry wins" });
+            logger?.warn("web_admin_skill_duplicate_name", { name: m.name, note: "duplicate name in center manifest — last entry wins" });
         seenNames.add(m.name);
         try {
             let content = contentCache.get(m.contentHash);
@@ -56,16 +56,16 @@ export async function applyCenterSkills(baseline, manifest, center, logger, fetc
             contentCache.set(m.contentHash, content);
             const overrodeBuiltin = byName.has(m.name);
             byName.set(m.name, { spec: { name: m.name, description: m.description, content }, scenarios: m.scenarios ?? [] });
-            logger?.info("sema_registry_skill", { name: m.name, hash: m.contentHash, scenarios: m.scenarios, overrodeBuiltin });
+            logger?.info("web_admin_skill", { name: m.name, hash: m.contentHash, scenarios: m.scenarios, overrodeBuiltin });
         }
         catch (err) {
-            logger?.warn("sema_registry_skill_failed", { name: m.name, hash: m.contentHash, err: String(err), note: "keeping baseline if any; skipping center version" });
+            logger?.warn("web_admin_skill_failed", { name: m.name, hash: m.contentHash, err: String(err), note: "keeping baseline if any; skipping center version" });
         }
     }
     await Promise.all(pendingWrites);
     return [...byName.values()];
 }
-function resolveRefs(refs, server, kind, logger, event = "sema_registry_mcp_env_missing", skipNote = "skipping this MCP server — referenced env var is unset in this service") {
+function resolveRefs(refs, server, kind, logger, event = "web_admin_mcp_env_missing", skipNote = "skipping this MCP server — referenced env var is unset in this service") {
     if (!refs)
         return {};
     const out = {};
@@ -86,7 +86,7 @@ export function resolveMcpServers(mcp, logger) {
         if (s.enabled === false)
             continue;
         if (!isUsableWireName(s.name)) {
-            logger?.warn("sema_registry_mcp_name_unusable", {
+            logger?.warn("web_admin_mcp_name_unusable", {
                 server: describeBadWireName(s.name),
                 note: "server SKIPPED — an MCP server name is its identity (it becomes the tool namespace prefix) and core REFUSES an out-of-bound name at prepare, which would fail every task in this scenario. Shorten the name and republish; sibling servers are unaffected.",
             });
@@ -99,7 +99,7 @@ export function resolveMcpServers(mcp, logger) {
             if (isContentOriginWord(s.contentOrigin))
                 contentOrigin = { contentOrigin: s.contentOrigin };
             else
-                logger?.warn("sema_registry_mcp_content_class_invalid", {
+                logger?.warn("web_admin_mcp_content_class_invalid", {
                     server: s.name,
                     value: describeBadContentOrigin(s.contentOrigin),
                     allowed: CONTENT_ORIGIN_WORDS,
@@ -109,7 +109,7 @@ export function resolveMcpServers(mcp, logger) {
         const source = readMcpSourceLabel(s.name, s.source);
         const facesRead = readMcpToolFaces(s.toolFaces);
         if (!facesRead.ok) {
-            logger?.warn("sema_registry_mcp_tool_faces_invalid", {
+            logger?.warn("web_admin_mcp_tool_faces_invalid", {
                 server: s.name,
                 problem: facesRead.problem,
                 note: "server SKIPPED — a toolFaces overlay is a NARROWING declaration (its pathTarget is what the sensitive-path / write fences read); mounting the server without it would silently drop the protection you declared. Fix the entry and republish.",
@@ -137,7 +137,7 @@ export function resolveMcpServers(mcp, logger) {
         }
     }
     if (out.length > 0)
-        logger?.info("sema_registry_mcp", { servers: out.map((s) => s.spec.name) });
+        logger?.info("web_admin_mcp", { servers: out.map((s) => s.spec.name) });
     return { servers: out, reservedNames };
 }
 export function mcpForScenario(center, scenario) {
@@ -153,13 +153,13 @@ export function resolveA2aPeers(a2a, logger) {
         if (p.enabled === false)
             continue;
         if (!isUsableWireName(p.name)) {
-            logger?.warn("sema_registry_a2a_name_unusable", {
+            logger?.warn("web_admin_a2a_name_unusable", {
                 peer: describeBadWireName(p.name),
                 note: "peer SKIPPED — an A2A peer name is its identity (it lands as the roster's `origin.peer`) and core REFUSES an out-of-bound name at prepare, which would fail every task in this scenario. Shorten the name and republish; sibling peers are unaffected.",
             });
             continue;
         }
-        const headers = resolveRefs(p.headerRefs, p.name, "header", logger, "sema_registry_a2a_env_missing", "skipping this A2A peer — referenced env var is unset in this service");
+        const headers = resolveRefs(p.headerRefs, p.name, "header", logger, "web_admin_a2a_env_missing", "skipping this A2A peer — referenced env var is unset in this service");
         if (headers === null)
             continue;
         out.push({
@@ -175,7 +175,7 @@ export function resolveA2aPeers(a2a, logger) {
         });
     }
     if (out.length > 0)
-        logger?.info("sema_registry_a2a", { peers: out.map((p) => p.spec.name) });
+        logger?.info("web_admin_a2a", { peers: out.map((p) => p.spec.name) });
     return out;
 }
 export function a2aForScenario(peers, scenario) {

package/dist/{config-center → web-admin-client}/stage-limits.d.ts

@@ -17,17 +17,11 @@ import type { Logger } from "../observability/logger.js";
 import { type Batch1LimitKey } from "./hot-keys-registry.js";
 import type { EffectiveLimits } from "./types.js";
 /**
- * stage 的入参视图。
- *
- * 🔴 `legacyGates` 是**已过旧位 presence 判据**的闸值(判据属主 = `runtimeGatePresent`,调用方过一遍再传)。
- * 两位刻意判据不同,不是疏忽:旧位(`runtime`)的容忍语义(例如 `costQuotaWindowSec: 0` 判「缺席」保 env)
- * 是既有 center 的在营契约,收紧它会把一个存量发布变成整批拒;新位(`limits`)从第一天起就是严判
- * (坏值 = 整批响亮拒)。判据属主各只有一个,谁都没有被复刻第二份。
+ * stage 的入参视图:`limits` 域是这些键的**唯一**发布位(settings-schema 11 退役了 `runtime` 域,它的旧位读法随之删)。
  */
 export interface LimitsSource {
     readonly version: number;
     readonly limits?: EffectiveLimits;
-    readonly legacyGates?: Readonly<Record<string, unknown>>;
 }
 /** 逐键 defer 的铸因(codex R2-F2):值合法但这一键**不热**,变更只能重启生效。 */
 export interface DeferredLimit {

package/dist/{config-center → web-admin-client}/stage-limits.js

@@ -69,7 +69,6 @@ function candidateView(config, assignments) {
 }
 export function stageLimits(config, eff, logger) {
     const baseline = baselineOf(config);
-    const legacy = eff.legacyGates ?? {};
     const assignments = [];
     const deletions = [];
     const changed = [];
@@ -79,7 +78,7 @@ export function stageLimits(config, eff, logger) {
     const rawLimits = eff.limits;
     if (rawLimits !== undefined && (rawLimits === null || typeof rawLimits !== "object" || Array.isArray(rawLimits))) {
         const rejected = { keys: [...BATCH1_LIMIT_KEYS], reason: `the published limits domain must be a JSON object — got ${rawLimits === null ? "null" : Array.isArray(rawLimits) ? "array" : typeof rawLimits}` };
-        logger?.warn("sema_registry_limits_invalid", {
+        logger?.warn("web_admin_limits_invalid", {
             ...rejected,
             version: eff.version,
             kept: "the whole limits batch is refused — a malformed container must never read as 'the center manages none of these keys' (that would silently revert every published ceiling to the env baseline)",
@@ -91,7 +90,7 @@ export function stageLimits(config, eff, logger) {
         const known = new Set([...BATCH1_LIMIT_KEYS, ...DEFERRED_LIMIT_KEYS.map((d) => d.key)]);
         const unconsumed = Object.keys(limits).filter((k) => !known.has(k));
         if (unconsumed.length > 0) {
-            logger?.warn("sema_registry_limits_unconsumed_keys", {
+            logger?.warn("web_admin_limits_unconsumed_keys", {
                 keys: unconsumed,
                 version: eff.version,
                 note: "published in the limits domain but not consumed by this server build (misspelled, or a later-batch key) — the value is inert until a batch that owns it ships",
@@ -99,7 +98,7 @@ export function stageLimits(config, eff, logger) {
         }
     }
     for (const key of BATCH1_LIMIT_KEYS) {
-        const published = limits !== undefined && Object.prototype.hasOwnProperty.call(limits, key) ? limits[key] : legacy[key];
+        const published = limits !== undefined && Object.prototype.hasOwnProperty.call(limits, key) ? limits[key] : undefined;
         let next;
         if (published === undefined) {
             next = baseline[key];
@@ -129,7 +128,7 @@ export function stageLimits(config, eff, logger) {
     }
     if (badKeys.length > 0) {
         const rejected = { keys: badKeys, reason: reason };
-        logger?.warn("sema_registry_limits_invalid", {
+        logger?.warn("web_admin_limits_invalid", {
             ...rejected,
             version: eff.version,
             kept: "the whole limits batch is refused — the prior values keep serving (a half-applied limit face means the published numbers and the live gate are different generations)",
@@ -140,7 +139,7 @@ export function stageLimits(config, eff, logger) {
     if (!verdict.ok) {
         const involved = changed.length > 0 ? changed : BATCH1_LIMIT_KEYS.slice();
         const rejected = { keys: [...involved], reason: verdict.reason, restartReason: verdict.restartReason };
-        logger?.warn("sema_registry_limits_invalid", {
+        logger?.warn("web_admin_limits_invalid", {
             ...rejected,
             invariant: verdict.id,
             version: eff.version,
@@ -149,7 +148,7 @@ export function stageLimits(config, eff, logger) {
         return { assignments: [], deletions: [], changed: [], deferred: [], rejected };
     }
     if (deferred.length > 0) {
-        logger?.warn("sema_registry_limits_deferred", {
+        logger?.warn("web_admin_limits_deferred", {
             keys: deferred.map((d) => d.key),
             version: eff.version,
             reasons: [...new Set(DEFERRED_LIMIT_KEYS.filter((d) => deferred.some((x) => x.key === d.key)).map((d) => d.why))],