@sema-agent/server 7.123.0 → 7.124.0

package/dist/config-catalog.d.ts

@@ -1,6 +1,7 @@
+import { type RetiredEnvWire } from "@sema-agent/settings-schema";
 import type { ServiceConfig, ServiceConfigGroups } from "./config-types.js";
-import type { ConfigKnobRecord, RetiredEnvWire } from "./config.js";
-import type { RestartSlice } from "./config-center/restart-signal.js";
+import type { ConfigKnobRecord } from "./config.js";
+import type { RestartSlice } from "./web-admin-client/restart-signal.js";
 export declare const CATALOG_VALUE_TYPES: readonly ["boolean", "number", "string", "enum", "csv", "json", "path", "url", "secret", "opaque"];
 export type CatalogValueType = (typeof CATALOG_VALUE_TYPES)[number];
 export declare const CATALOG_TIMINGS: readonly ["hot", "restart", "deploy", "inert"];
@@ -14,7 +15,7 @@ export declare const CATALOG_RESTART_SLICES: readonly RestartSlice[];
 export interface CatalogCenterSeatSpec {
     readonly domain: string;
     readonly path: string;
-    /** `centerManagedKeys`(config-center 在管键集)里查「在管」用的键;models 面统一 "models"。 */
+    /** `centerManagedKeys`(web-admin 在管键集)里查「在管」用的键;models 面统一 "models"。 */
     readonly centerKey: string;
     readonly precedence: "center-wins" | "env-wins";
     readonly timing: "hot" | "restart" | "inert";
@@ -144,12 +145,8 @@ export interface ConfigCatalogInputs {
      *  它值级 import 了 core 与契约包(词表 / 中心凭证键名 / S-866 ⑤a 的 `DOMAIN_SCHEMAS` 座位门);这一格照旧由调用方传,
      *  只因为它是 wire 上的一段列表、由路由决定取哪一份。 */
     readonly centerDomains: readonly string[];
-    /** config-center 当前在管的 ServiceConfig 键集(缺席 = 没有配置管道)。 */
+    /** web-admin 当前在管的 ServiceConfig 键集(缺席 = 没有配置管道)。 */
     readonly centerManagedKeys?: ReadonlySet<string> | undefined;
-    /** S-885:退役 env 墓碑表的投影 —— 调用方传 `config.ts` 的 `buildRetiredEnvWire()`(同一张 `RETIRED_ENVS`,不手抄)。**必填**:
-     *  本模块不能值引 config.ts(`server-secret-env.ts` 值引本模块 ⇒ config → server-secret-env → config-catalog → config 成环,
-     *  干净进程直接 import 本模块即 TDZ 崩;codex r1 F2)⇒ 由调用方注入,缺了就是编译错而不是一张静默空表。 */
-    readonly retired: readonly RetiredEnvWire[];
 }
 export interface ConfigCatalogWire {
     readonly catalogVersion: 1;
@@ -164,8 +161,8 @@ export interface ConfigCatalogWire {
         readonly centerManaged: number;
     };
     readonly rows: readonly ConfigCatalogRow[];
-    /** S-885(7.106.0)—— 退役 env 墓碑表(`config.ts` 的 `RETIRED_ENVS`,在场即拒启)的投影,**恒在场**(可为空数组)。与 `rows` 分开:
-     *  rows 是「本进程会读的 env」,这里是「本进程会拒的旧名」—— 一个名字不会同时在两处(墓碑名没有读取点)。 */
+    /** S-885(7.106.0)—— 退役 env 墓碑表(settings-schema `RETIRED_ENVS`,本进程起服按它拒启)的投影 `buildRetiredEnvWire()`,**恒在场**
+     *  (可为空数组)。与 `rows` 分开:rows 是「本进程会读的 env」,这里是「本进程会拒的旧名」—— 一个名字不会同时在两处(墓碑名没有读取点)。 */
     readonly retired: readonly RetiredEnvWire[];
 }
 /**

package/dist/config-catalog.js

@@ -1,6 +1,6 @@
 import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES } from "@sema-agent/core";
 import { GLOBAL_SCOPE } from "@sema-agent/settings-schema/api/scopes";
-import { CENTER_CREDENTIAL_ENV, DOMAIN_SCHEMAS } from "@sema-agent/settings-schema";
+import { WEB_ADMIN_ENV, DOMAIN_SCHEMAS, buildRetiredEnvWire } from "@sema-agent/settings-schema";
 import { CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS, CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS, CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS } from "./center-credential-renewer.js";
 import { THINKING_FORMATS } from "./model-compat.js";
 import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CENTER_BASE_URL_RULE, CONFIG_PROVIDER_WORDS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
@@ -72,7 +72,7 @@ export const CONFIG_CATALOG = [
     r("ATTACHMENT_ORPHAN_GRACE_MS", "limitsHttp", "number", "附件孤儿对象 GC 宽限(ms;0=关本腿,坏值回默认+warn)", { staticDefault: "3600000", danger: DATA, center: cLimits("attachmentOrphanGraceMs") }),
     r("ATTACHMENT_UNBOUND_TTL_MS", "limitsHttp", "number", "未绑定附件的 TTL(ms)", { staticDefault: String(24 * 3600 * 1000), danger: DATA, configKey: "attachmentUnboundTtlMs", center: cLimits("attachmentUnboundTtlMs") }),
     r("AUTH_BRIDGE_AUDIENCE", "auth", "string", "registry SSO-JWT 验签期望 aud", { danger: SEC }),
-    r("AUTH_BRIDGE_ISSUER", "auth", "url", "registry SSO-JWT issuer(auth bridge 的开关之一;S-671 / C-R100 ① 起**不是**托管证据 —— 多租户只认 REQUIRE_PRINCIPAL=true)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 桥的装配处回退到 configCenter.baseUrl(配了 center 即默认开桥);显式值与回退值在托管判定上同判(都不算)", configKey: "authBridgeIssuer" }),
+    r("AUTH_BRIDGE_ISSUER", "auth", "url", "registry SSO-JWT issuer(auth bridge 的开关之一;S-671 / C-R100 ① 起**不是**托管证据 —— 多租户只认 REQUIRE_PRINCIPAL=true)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 桥的装配处回退到 webAdmin.baseUrl(配了 center 即默认开桥);显式值与回退值在托管判定上同判(都不算)", configKey: "authBridgeIssuer" }),
     r("AUTH_BRIDGE_JWKS_URL", "auth", "url", "registry SSO-JWT 的 JWKS 地址(缺省从 issuer 派生)", { danger: SEC }),
     r("AUTONOMY", "auth", "enum", "运维 autonomy 模式(read-only ⇒ 只读手 + 写面 roots,每段续跑重折,子代同受、委派照挂;ask ⇒ 恒 shellGate,每段重折;plan ⇒ 提交入口的模式词地板:新提交的任务以 permissionMode:plan 起步,请求词钳到它之下,写与非只读调用在调用时问 / 拒,批准计划之后整条 run 按批准的档跑完);center 腿热且 non-sticky(plan 地板只作用于之后提交的任务)", { danger: SEC, enumValues: AUTONOMY_MODES, configKey: "autonomy", center: cGov("autonomy") }),
     r("AUTO_MODE_CLASSIFIER_FALLBACK", "approval", "enum", "auto 分类器席答不出裁决时的梯子(main=主模型代判 / none=只留分类器那一级,整条拒)", { enumValues: ["main", "none"], danger: SEC, derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随引擎缺省 main(core 7.18.0 起;空串按未设,与其余词表旋钮同判);none = 7.77.0 及以前的行为逐字;词表外的值启动期拒启。权限轴放宽,升级须知见 DEPLOY-PREREQS", configKey: "autoModeClassifierFallback" }),
@@ -88,7 +88,7 @@ export const CONFIG_CATALOG = [
     r("BG_AGENT_RETENTION_MS", "orchestration", "number", "TERMINAL 后台 agent 行保留期(ms,reaper 按 scope 清)", { staticDefault: String(7 * 24 * 60 * 60 * 1000), danger: DATA, configKey: "backgroundAgentRetentionMs" }),
     r("BG_AGENT_STALE_RUNNING_MS", "orchestration", "number", "running 后台 agent 行写者心跳断更超此值翻 failed(ms;下限 10min 硬钳)", { staticDefault: String(15 * 60_000), configKey: "backgroundAgentStaleRunningMs" }),
     r("BIND_HOST", "auth", "string", "监听绑址(显式值恒生效)", { danger: SEC, derivedDefaultNote: "缺席:无鉴权写面(allowUnauthedWrites ∧ 零凭证)自动收窄 127.0.0.1,其余全接口", resolve: (c) => c.bindHost ?? null }),
-    r("CENTER_CREDENTIAL_RENEW_LEAD_MS", "integrations", "number", `center 凭证续签提前量(ms;${CENTER_CREDENTIAL_ENV.tokenFile} 指向人的登录会话信封时,访问令牌离到期 ≤ 本值即由引擎续签并原子改写同一文件;0 = 关续签只读信封;其余须为 [${CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS}, ${CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS}] 内整数,坏值拒启;裸行 / 值形凭证不续签)`, { staticDefault: String(CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS), danger: SEC, configKey: "centerCredentialRenewLeadMs" }),
+    r("CENTER_CREDENTIAL_RENEW_LEAD_MS", "integrations", "number", `center 凭证续签提前量(ms;${WEB_ADMIN_ENV.tokenFile} 指向人的登录会话信封时,访问令牌离到期 ≤ 本值即由引擎续签并原子改写同一文件;0 = 关续签只读信封;其余须为 [${CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS}, ${CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS}] 内整数,坏值拒启;裸行 / 值形凭证不续签)`, { staticDefault: String(CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS), danger: SEC, configKey: "centerCredentialRenewLeadMs" }),
     r("COMPLIANCE_ADDITIONAL_DENIES", "auth", "csv", "合规档位之上额外拒绝的能力名(只能收紧;词表=core 闭集,拼错拒启)", { danger: SEC }),
     r("COMPLIANCE_PROFILE", "auth", "enum", "本部署合规档位(core compliancePostureResolver 供数;拼错拒启)", { danger: SEC, enumValues: ["hipaa", "zdr"], resolve: (c) => c.compliancePosture?.profile ?? null }),
     r("CONFIG_BOOT_FETCH_BUDGET_MS", "integrations", "number", "boot 首拉配置的抢答窗(ms;过窗以 env/兜底起服,拉取转后台热应用)", { staticDefault: "1500", configKey: "configBootFetchBudgetMs" }),
@@ -97,7 +97,7 @@ export const CONFIG_CATALOG = [
     r("CONFIG_LKG_ENABLED", "integrations", "boolean", "last-known-good 配置盘缓存读写开关(仅远程 provider 有意义)", { staticDefault: "true", configKey: "configLkgEnabled" }),
     r("CONFIG_LKG_PATH", "integrations", "path", "LKG 落盘路径(设了 ⇒ 派生一条读拒行 = 这条绝对路径:根锚定,只守这一个文件,经符号链接的目录时引擎沿链连目标一起守;大小写不敏感;用户仓里同尾的路径读得到;空串拒启)", { derivedDefaultNote: "缺席 ⇒ 配置根(SEMA_CONFIG_DIR,缺省 ~/.sema)下按 worker + 凭证身份分箱派生", configKey: "configLkgPath" }),
     r("CONFIG_LOCAL_DIR", "integrations", "path", "本地配置源根(config.d/<domain>.json);兼作数据根回落链一环", { configKey: "configLocalDir", danger: DATA }),
-    r("CONFIG_PROVIDER", "integrations", "enum", "配置源双模选择(闭集,逐字比较;认不出的词 ⇒ 拒启,S-841)", { enumValues: CONFIG_PROVIDER_WORDS, derivedDefaultNote: "缺席:SEMA_REGISTRY_URL 在场 ⇒ remote,否则纯 env(无管道)", configKey: "configProvider" }),
+    r("CONFIG_PROVIDER", "integrations", "enum", "配置源双模选择(闭集,逐字比较;认不出的词 ⇒ 拒启,S-841)", { enumValues: CONFIG_PROVIDER_WORDS, derivedDefaultNote: `缺席:${WEB_ADMIN_ENV.url} 在场 ⇒ remote,否则纯 env(无管道)`, configKey: "configProvider" }),
     r("CONFIG_REQUIRE_ROSTER", "integrations", "boolean", "远程 registry 非 dryRun 时布防 ready 门:roster 未落地 ⇒ 计费提交 503 + /health ready:false(严格 'true')", { staticDefault: "false" }),
     r("CORS_ORIGIN", "auth", "csv", "CORS 白名单(单值 v1 兼容回显;多值按请求 Origin 匹配 + Vary;未设=无 CORS 面)", { danger: SEC, configKey: "corsOrigins" }),
     r("COST_QUOTA_WINDOW_SEC", "limitsHttp", "number", "per-principal 成本配额窗长(秒);SQL 腿窗长进桶主键 ⇒ center 腿显式 deferred(重启生效)", { staticDefault: "86400", danger: BILL, configKey: "costQuotaWindowSec", center: cLimits("costQuotaWindowSec", { timing: "restart", restartReason: "cost-quota-window" }) }),
@@ -105,7 +105,7 @@ export const CONFIG_CATALOG = [
     r("CROSS_SESSION_INBOUND", "approval", "enum", "入站跨会话消息的部署/组织层治理(CC settings 键名 crossSessionInbound 的 managed 层;未设=本层不表态≠ next-turn;词表外拒启)", { danger: SEC, enumValues: [...CROSS_SESSION_INBOUND_SETTINGS], configKey: "crossSessionInbound", derivedDefaultNote: "缺席 ⇒ managed 层不设,由其余层与 mode-parity 决定", resolve: (c) => c.crossSessionInbound ?? null }),
     r("DB_BACKEND", "store", "enum", "store 后端引擎选择(mysql 兼容/pg/本机文件店/纯内存)", { enumValues: STORE_BACKENDS, danger: DATA, derivedDefaultNote: "裸 boot ⇒ local(多租户裸 boot ⇒ memory + notice);有 SQL 信号 ⇒ mysql", configKey: "dbBackend", resolve: (c) => c.dbBackend }),
     r("DB_QUERY_TIMEOUT_MS", "store", "number", "per-query DB 超时(ms;坏值回默认姿态+warn,绝不 NaN 进 driver)", { derivedDefaultNote: "缺席 ⇒ 池级不设/计数族 30s(按引擎)", configKey: "dbQueryTimeoutMs" }),
-    r("DEFAULT_SCENARIO", "integrations", "string", "出厂缺省场景(编码产品出厂态;通用中性 persona 用 default 显式选回);必须是本部署在册的场景名(内建 ∪ 配置中心声明的),不在册 ⇒ 拒启", { staticDefault: "code", configKey: "defaultScenario" }),
+    r("DEFAULT_SCENARIO", "integrations", "string", "出厂缺省场景(编码产品出厂态;通用中性 persona 用 default 显式选回);必须是本部署在册的场景名(内建 ∪ web-admin 声明的),不在册 ⇒ 拒启", { staticDefault: "code", configKey: "defaultScenario" }),
     r("DELEGATION_MAX_CONCURRENT", "orchestration", "number", "委派入口并发帽", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省(CC parity 20)" }),
     r("DELEGATION_MAX_PER_SESSION", "orchestration", "number", "委派入口每会话累计帽", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省(CC parity 200)" }),
     r("DEVICE_DELIVERY_TIMEOUT_MS", "orchestration", "number", "device 车道等在途槽上限(ms;到期 device.busy)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 10s" }),
@@ -401,16 +401,16 @@ export const CONFIG_CATALOG = [
     r("SEMA_NPM_REGISTRY", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 npm registry 地址"),
     r("SEMA_PARENT_PID", "limitsHttp", "number", "引擎 parent 监视(壳 pid;被过继走或该 pid 不存在即把引擎标成孤儿——不直接停机,改用 ENGINE_ORPHAN_LINGER_MS 窗走同一条租约自退;0/负数语义完全不同 ⇒ 拒启)", { derivedDefaultNote: "缺席 ⇒ 看门狗不装配", configKey: "parentPid" }),
     r("SEMA_PIP_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 pip index 地址"),
-    r("SEMA_REGISTRY_ADMIN_TOKEN", "integrations", "secret", "写 center 的管理凭证(仅 boot 上报执行公钥用;刻意不入 ServiceConfig —— 不进 configHash/日志面)", { danger: SEC, scope: "bootstrap-only" }),
-    r("SEMA_REGISTRY_DRY_RUN", "integrations", "boolean", "center 腿 dry-run(拉而不应用)", { staticDefault: "false" }),
-    r("SEMA_REGISTRY_LIVE_URL", "integrations", "url", `fleet 活性组(心跳 / 注销、服务租约 = settings-schema FLEET_LIVE_PATHS)的中心基址:给管理面在就绪门后、活性面另走一条不看就绪的入口的部署。缺席 = SEMA_REGISTRY_URL。${CENTER_BASE_URL_RULE}`),
-    r(CENTER_CREDENTIAL_ENV.token, "integrations", "secret", `center 拉取凭据(值形;与 ${CENTER_CREDENTIAL_ENV.tokenFile} 二选一,都设=拒启)`, { danger: SEC }),
-    r(CENTER_CREDENTIAL_ENV.tokenFile, "integrations", "path", `center 拉取凭据文件(每条中心请求都重读 ⇒ 轮换 / 换账号不重启;与 ${CENTER_CREDENTIAL_ENV.token} 二选一,都设=拒启;内容两种类:裸行 = 静态 bearer / JSON 信封 user-session = 人的登录会话(可续签,S-698);文件不可读 / 为空 = 响亮 + 健康态 unreadable,不当作无凭证;内容读不成 / 多租户读到信封 = 拒启)`, { danger: SEC }),
-    r("SEMA_REGISTRY_URL", "integrations", "url", `sema-registry 地址(设了=remote 配置源开关)。${CENTER_BASE_URL_RULE}`),
-    r("SEMA_REGISTRY_WEB_URL", "integrations", "url", `中心 web 面的固定基址:引擎原样转述到 /health 的 center.webBaseUrl,壳按它拼会话深链(路径归壳)。缺席即缺席(引擎不拼不猜);只在接了中心(SEMA_REGISTRY_URL)时挂。${CENTER_BASE_URL_RULE}`),
-    r("SEMA_REGISTRY_WORKER", "integrations", "string", "本 worker 在 center 的名字(per-worker effective)"),
     r("SEMA_UV_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 uv index 地址"),
     r("SEMA_UV_PY_MIRROR", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 uv python 分发镜像地址"),
+    r(WEB_ADMIN_ENV.adminToken, "integrations", "secret", "写 web-admin 的管理凭证(仅 boot 上报执行公钥用;刻意不入 ServiceConfig —— 不进 configHash/日志面)", { danger: SEC, scope: "bootstrap-only" }),
+    r(WEB_ADMIN_ENV.dryRun, "integrations", "boolean", "web-admin 腿 dry-run(拉而不应用)", { staticDefault: "false" }),
+    r(WEB_ADMIN_ENV.liveUrl, "integrations", "url", `fleet 活性组(心跳 / 注销、服务租约 = settings-schema FLEET_LIVE_PATHS)的 web-admin 基址:给管理面在就绪门后、活性面另走一条不看就绪的入口的部署。缺席 = ${WEB_ADMIN_ENV.url}。传输地址,不参与中心身份互证。${CENTER_BASE_URL_RULE}`),
+    r(WEB_ADMIN_ENV.token, "integrations", "secret", `center 拉取凭据(值形;与 ${WEB_ADMIN_ENV.tokenFile} 二选一,都设=拒启)`, { danger: SEC }),
+    r(WEB_ADMIN_ENV.tokenFile, "integrations", "path", `center 拉取凭据文件(每条中心请求都重读 ⇒ 轮换 / 换账号不重启;与 ${WEB_ADMIN_ENV.token} 二选一,都设=拒启;内容两种类:裸行 = 静态 bearer / JSON 信封 user-session = 人的登录会话(可续签,S-698);文件不可读 / 为空 = 响亮 + 健康态 unreadable,不当作无凭证;内容读不成 / 多租户读到信封 = 拒启)`, { danger: SEC }),
+    r(WEB_ADMIN_ENV.url, "integrations", "url", `web-admin 基址(设了=remote 配置源开关;传输地址 —— 编排器注入的可以是集群内地址;AUTH_BRIDGE_ISSUER 缺席时它也是中心身份)。${CENTER_BASE_URL_RULE}`),
+    r(WEB_ADMIN_ENV.webUrl, "integrations", "url", `web-admin 人用界面的固定基址:引擎原样转述到 /health 的 center.webBaseUrl,壳按它拼会话深链(路径归壳)。缺席即缺席(引擎不拼不猜);只在接了中心(${WEB_ADMIN_ENV.url})时挂;必须与中心身份(AUTH_BRIDGE_ISSUER,缺席 = ${WEB_ADMIN_ENV.url})同主机同端口(http ↔ https 同族),否则拒启。${CENTER_BASE_URL_RULE}`),
+    r(WEB_ADMIN_ENV.worker, "integrations", "string", "本 worker 在 web-admin 上的名字(per-worker effective)"),
     r("SEND_USER_FILE_SANDBOX_PUT_ENDPOINT", "store", "url", "沙箱侧 presigned PUT Host 绑定 endpoint(in-cluster 可用内网面)", { derivedDefaultNote: "缺席 ⇒ publicEndpoint" }),
     r("SEND_USER_FILE_URL_TTL", "store", "number", "公链 TTL(秒;非法值回 0=永久轨,绝不 NaN 进签名)", { staticDefault: "0" }),
     r("SENSITIVE_WRITE_PATTERNS", "approval", "csv", "敏感路径写 deny 集(unset=core 推荐集;显式值整表替换;off/空=关 —— 真放松杆)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ core RECOMMENDED_SENSITIVE_PATTERNS", configKey: "sensitiveWritePatterns" }),
@@ -609,7 +609,7 @@ function valueClassOf(type) {
     return "plain";
 }
 export function buildConfigCatalog(inputs) {
-    const { config, env, boot, knobs, centerDomains, centerManagedKeys, retired } = inputs;
+    const { config, env, boot, knobs, centerDomains, centerManagedKeys } = inputs;
     const knobByName = new Map(knobs.map((k) => [k.name, k]));
     const rows = [...CONFIG_CATALOG]
         .sort((a, b) => (a.name < b.name ? -1 : 1))
@@ -686,7 +686,7 @@ export function buildConfigCatalog(inputs) {
             centerManaged: rows.filter((x) => x.center?.managedNow === true).length,
         },
         rows,
-        retired,
+        retired: buildRetiredEnvWire(),
     };
 }
 //# sourceMappingURL=config-catalog.js.map

package/dist/config-d-migration.d.ts

@@ -0,0 +1,32 @@
+import { type ConfigDirectoryMigration } from "@sema-agent/settings-schema/node";
+/** 一次起服迁移的结果:契约的结果闭集,外加本仓入口的两形(目录不在 ⇒ 不调;调用抛 ⇒ 失败)。纯数据。 */
+export type ConfigDirMigration = {
+    readonly kind: "no-config-dir";
+    readonly dir: string;
+} | {
+    readonly kind: "threw";
+    readonly dir: string;
+    readonly reason: string;
+} | (ConfigDirectoryMigration & {
+    readonly dir: string;
+});
+/**
+ * 对 `<root>/config.d` 的读回面跑一次契约的目录迁移(见文件头)。`root` = 本地配置根(`FileConfigStore` 吃的同一个)。
+ * 不抛:每一形都是一个结果,调用方 {@link logConfigDirMigration}。
+ */
+export declare function migrateLocalConfigDirectory(root: string): Promise<ConfigDirMigration>;
+/** 迁移结果的日志口(logger 的子集)。 */
+export interface ConfigDirMigrationLog {
+    info(msg: string, meta?: Record<string, unknown>): void;
+    warn(msg: string, meta?: Record<string, unknown>): void;
+}
+/**
+ * 一次起服迁移的**唯一**说法(两个入口同调),对契约结果穷举:
+ *  · `applied` ⇒ info `config_dir_migrated`(收据:迁移 id / 文档 / 坐标 / 处置,不带值;写回 / 删除的文件名);
+ *  · `noop` / `no-documents` / 目录不在 ⇒ 不出声(没有东西可迁);
+ *  · `refused` ⇒ warn `config_dir_migration_refused`(一字未写;逐条点名迁移 id、坐标与契约的拒句 —— 读侧随后对这些旧形照旧响亮拒);
+ *  · `unreadable` / 调用抛 ⇒ warn `config_dir_migration_failed`(一字未写或写到一半;原因 —— 坏文件的句子与读腿同一只判官)。
+ *  · `pending` 只在契约的 `check: true` 下出现,本仓从不传 ⇒ 撞上即是接线错,响亮抛。
+ */
+export declare function logConfigDirMigration(log: ConfigDirMigrationLog, m: ConfigDirMigration): void;
+//# sourceMappingURL=config-d-migration.d.ts.map

package/dist/config-d-migration.js

@@ -0,0 +1,59 @@
+import { stat } from "node:fs/promises";
+import { join } from "node:path";
+import { RETIRED_DOMAINS, formatConfigPath, isRetiredDomainName } from "@sema-agent/settings-schema";
+import { PORTABLE_DOMAINS, migrateConfigDirectory, nodeConfigDirectoryIo } from "@sema-agent/settings-schema/node";
+const READ_BACK_DOCUMENTS = [...PORTABLE_DOMAINS, ...Object.keys(RETIRED_DOMAINS).filter(isRetiredDomainName)];
+const errnoOf = (err) => (err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : undefined);
+export async function migrateLocalConfigDirectory(root) {
+    const dir = join(root, "config.d");
+    try {
+        if (!(await stat(dir)).isDirectory())
+            return { kind: "no-config-dir", dir };
+    }
+    catch (err) {
+        if (errnoOf(err) === "ENOENT")
+            return { kind: "no-config-dir", dir };
+    }
+    try {
+        return { ...(await migrateConfigDirectory(dir, { documents: READ_BACK_DOCUMENTS, io: nodeConfigDirectoryIo })), dir };
+    }
+    catch (err) {
+        return { kind: "threw", dir, reason: `${err instanceof Error ? err.message : String(err)}${errnoOf(err) !== undefined ? ` (${errnoOf(err)})` : ""}` };
+    }
+}
+export function logConfigDirMigration(log, m) {
+    switch (m.kind) {
+        case "no-config-dir":
+        case "no-documents":
+        case "noop":
+            return;
+        case "applied":
+            log.info("config_dir_migrated", {
+                dir: m.dir,
+                receipts: m.applied.map((r) => ({ migration: r.migration, document: r.document, path: formatConfigPath(r.path), appliedAs: r.appliedAs })),
+                written: m.written,
+                removed: m.removed,
+                note: "settings-schema one-time migrations rewrote the documents the local reader reads, once (idempotent: the next run changes nothing); files outside the reader's coverage were not touched",
+            });
+            return;
+        case "refused":
+            log.warn("config_dir_migration_refused", {
+                dir: m.dir,
+                refusals: m.refused,
+                why: m.why,
+                note: "nothing was written — the named coordinates cannot be migrated automatically; the reader refuses those old forms (each refusal names its migration id) until they are fixed by hand",
+            });
+            return;
+        case "unreadable":
+        case "threw":
+            log.warn("config_dir_migration_failed", { dir: m.dir, reason: m.reason, note: "the one-time migration did not complete — the reader judges the files as they are (old forms are refused loudly)" });
+            return;
+        case "pending":
+            throw new Error(`config.d migration: the contract answered "pending" (check-only) but this engine never asks for a check-only run — wiring error at ${m.dir}`);
+        default: {
+            const unhandled = m;
+            throw new Error(`config.d migration: unknown result ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+//# sourceMappingURL=config-d-migration.js.map

package/dist/config-invariants.d.ts

@@ -6,14 +6,14 @@
  * 打开、bake runner 凭据被删、直连门半开、reaper 追杀活 run……),而进程照跑。逐条在 stage 里手抄一遍
  * 是必错的形(抄漏一条没人会发现),所以本文件是**唯一**的表:
  *
- *  · stage 面(config-center):批1 的任一键触发**全表**校验,过不了 ⇒ 整批拒 + 旧值继续服务 + 铸
+ *  · stage 面(web-admin):批1 的任一键触发**全表**校验,过不了 ⇒ 整批拒 + 旧值继续服务 + 铸
  *    `restartReason`(运维据此知道「这个变更只能重启生效」,而不是被静默吞掉)。
  *  · boot 面:每条 throw 点旁挂 `CROSS-INVARIANT:<id>` 锚,由 test/config-hot/batch1-cross-invariants.test.ts
  *    双向对表 —— 新增一条拒启却不登记 = 门红。boot 的判据文本与拒启行为**逐字不变**(本批不改拒启),
  *    表在这一侧承担的是「不许有表外不变量」的登记职责。
  *
  * 🔴 **报文次序**(车PI 验修轮 F7,如实登记):boot 期一次只报一条。条目按 `bootAnchor` 分住几个区 —— `config.ts` 的 loadConfig 区与
- * `boot/stage-01-config.ts`(第 1 段)、`boot/execution-lane.ts`(第 2 段开头的车道合成步)、`boot/stage-02-registry-pull.ts`(第 2 段
+ * `boot/stage-01-config.ts`(第 1 段)、`boot/execution-lane.ts`(第 2 段开头的车道合成步)、`boot/stage-02-web-admin-pull.ts`(第 2 段
  * 目录应用之后)。**跨区次序 = 段序,区内次序 = 表序**:同时撞上两个区的两条,先到的区先报,与表序无关(例:`LEADER_ENABLED` + host
  * + 无 SQL 先报 loadConfig 区的 `leader-durable-store`,改完再在合成步撞 `leader-host-lane`)。锚点按「读什么键、那个键在哪一段定形」定,
  * 不为报文次序挪区 —— 多一次往返,没有安全后果。
@@ -34,9 +34,9 @@ import type { ServiceConfigFlat } from "./config-types.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "require-execution-lane";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "require-execution-lane" | "center-one-identity";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;
@@ -84,6 +84,16 @@ export declare function bakeRunnerCredentialRefusal(v: Pick<CrossInvariantView,
  * 「多副本」在 config 层判不了(副本数不是本进程的知识),可判的**代理**就是 durable 前提本身。
  */
 export declare function leaderDurableStoreRefusal(v: Pick<CrossInvariantView, "leaderEnabled" | "dbBackend">): string | undefined;
+/**
+ * `center-one-identity`(7.124.0)—— **中心只有一个身份**。引擎接的 web-admin 由三只旋钮描述:基址(`WEB_ADMIN_ENV.url`,传输地址)、
+ * 鉴权桥 issuer(`AUTH_BRIDGE_ISSUER`,缺席 = 基址 —— {@link authBridgeIssuerOf} 一只取值口)、web 基址(`WEB_ADMIN_ENV.webUrl`,上
+ * `/health.center.webBaseUrl`)。壳先判 `center.issuer` 是不是自己登录的那个中心,再按 `center.webBaseUrl` 拼会话深链 ⇒ 两者不是同一个中心
+ * = 把人带到另一个中心。规则:**web 基址必须落在身份(issuer)的 origin 族**。**origin 族 = `URL.host` 相同**(主机 + 非缺省端口;scheme 不比 ⇒ http ↔ https 同族:TLS 终结在
+ * 前面的部署两种写法都见)。判不出主机(issuer 不是 http(s) 的层级式 URL)= 证不了同一个中心 ⇒ 同样拒(fail-closed)。
+ * 基址 / 活性基址是**传输地址**,不参与:编排器给 worker 注入的基址是集群内地址,issuer 是对外域名 —— 两者天然不同主机,拿基址互证会拒掉
+ * 标准部署形。没有 web 基址 ⇒ 无可互证,过。
+ */
+export declare function centerIdentityRefusal(v: Pick<CrossInvariantView, "authBridgeIssuer" | "webAdmin">): string | undefined;
 export declare const CONFIG_CROSS_INVARIANTS: readonly CrossInvariant[];
 /**
  * 按 id 取**一条**(S-157②:boot 面的单源化出口)。

package/dist/config-invariants.js

@@ -3,6 +3,9 @@ import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { defaultModelRefusal, refusedNameMintedRefusal } from "./model-entry-refusal.js";
+import { WEB_ADMIN_ENV, httpUrlFlaws } from "@sema-agent/settings-schema";
+import { authBridgeIssuerOf } from "./auth-bridge.js";
+import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { executionLaneCaps, executionLaneOf, executionLaneRequiredRefusal, laneCapabilityHolds, REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
 export const LIVENESS_HEARTBEAT_MS = 30_000;
 const anyServiceAuth = (v) => Boolean(v.authToken) || Object.keys(v.authTokens ?? {}).length > 0;
@@ -61,6 +64,25 @@ export function leaderDurableStoreRefusal(v) {
             "(#193 车4 件2 / staleness ledger P1-9+P1-10 boot invariant)"
         : undefined;
 }
+export function centerIdentityRefusal(v) {
+    const webBaseUrl = v.webAdmin?.webBaseUrl;
+    if (webBaseUrl === undefined)
+        return undefined;
+    const identity = authBridgeIssuerOf(v);
+    if (identity === undefined)
+        return undefined;
+    const hostOf = (raw) => (httpUrlFlaws(raw, []).length === 0 ? new URL(raw).host : undefined);
+    const issuerHost = hostOf(identity.issuer);
+    const webHost = hostOf(webBaseUrl);
+    if (issuerHost !== undefined && issuerHost === webHost)
+        return undefined;
+    const issuerSeat = identity.source === "explicit" ? "AUTH_BRIDGE_ISSUER" : `AUTH_BRIDGE_ISSUER (unset, so ${WEB_ADMIN_ENV.url})`;
+    const issuerShown = issuerHost === undefined ? `${buildDisplaySafeUrl(identity.issuer)}, which is not an http(s) URL with a host` : `${buildDisplaySafeUrl(identity.issuer)} (host ${issuerHost})`;
+    return (`${WEB_ADMIN_ENV.webUrl}=${buildDisplaySafeUrl(webBaseUrl)} (host ${webHost ?? "?"}) is not on this engine's web-admin identity — ${issuerSeat} = ${issuerShown}. ` +
+        `A client checks the reported issuer against the web-admin it signed in to and then links sessions under the reported web console base, so both must name ` +
+        `the same web-admin: same host and port (http and https on one host count as one). Set ${WEB_ADMIN_ENV.webUrl} to that web-admin's console, set ` +
+        `AUTH_BRIDGE_ISSUER to the web-admin's public origin, or unset ${WEB_ADMIN_ENV.webUrl}. Refusing to boot.`);
+}
 export const CONFIG_CROSS_INVARIANTS = [
     {
         id: "run-stale-heartbeat",
@@ -217,16 +239,23 @@ export const CONFIG_CROSS_INVARIANTS = [
         id: "default-model-resolvable",
         keys: ["models", "modelRefusals"],
         restartReason: "default-model",
-        bootAnchor: { file: "src/boot/stage-02-registry-pull.ts", marker: "CROSS-INVARIANT:default-model-resolvable" },
+        bootAnchor: { file: "src/boot/stage-02-web-admin-pull.ts", marker: "CROSS-INVARIANT:default-model-resolvable" },
         check: ({ live, next }) => (next.models === live.models ? undefined : defaultModelRefusal(next, "catalog")),
     },
     {
         id: "refused-names-not-minted",
         keys: ["models", "tiers", "modelRefusals"],
         restartReason: "refused-model-name",
-        bootAnchor: { file: "src/boot/stage-02-registry-pull.ts", marker: "CROSS-INVARIANT:refused-names-not-minted" },
+        bootAnchor: { file: "src/boot/stage-02-web-admin-pull.ts", marker: "CROSS-INVARIANT:refused-names-not-minted" },
         check: ({ live, next }) => (next.models === live.models ? undefined : refusedNameMintedRefusal(next)),
     },
+    {
+        id: "center-one-identity",
+        keys: ["authBridgeIssuer", "webAdmin"],
+        restartReason: "center-identity",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:center-one-identity" },
+        check: ({ next }) => centerIdentityRefusal(next),
+    },
 ];
 export function crossInvariant(id) {
     const inv = CONFIG_CROSS_INVARIANTS.find((i) => i.id === id);

package/dist/config-lkg.d.ts

@@ -1,6 +1,7 @@
-/** 落盘信封。`effective`/`etag` 逐字=当时的 fetchEffective 返回(JSON verbatim 面)。`formatVersion` 的语义见头注(3 = 载荷的被丢目录条目记录是全的)。 */
+import { type MigrationReceipt } from "@sema-agent/settings-schema/one-time-migrations";
+/** 落盘信封。`effective`/`etag` 逐字=当时的 fetchEffective 返回(JSON verbatim 面)。`formatVersion` 的语义见头注(4 = 载荷是 settings-schema 11 的形)。 */
 export interface PersistedLkg {
-    formatVersion: 3;
+    formatVersion: 4;
     savedAt: string;
     worker: string;
     /** 拉到这份候选时所用凭证的身份(`center-credential.ts`;摘要形,不含凭证原文)。 */
@@ -46,19 +47,38 @@ export declare function lkgReadDenyRows(configLkgPath: string | undefined): {
 /** 原子落盘一个干净候选(tmp+rename,0600)。BEST-EFFORT:失败=一条 warn 的素材(调用方发),绝不
  *  影响在飞的应用链——LKG 缓存丢失的代价只是下次冷启动回到 env 兜底。 */
 export declare function saveLkg(path: string, worker: string | undefined, identity: string, effective: Record<string, unknown>, etag: string | undefined): Promise<void>;
+/** 一次读回做过的一次性迁移(调用方响亮打一行 `config_lkg_migrated`,并按 4 写回原位):`fromFormat` = 盘上的版本号;`note` = 信封层的说明
+ *  (2 → 3 那一步,{@link migrateV2Lkg});`receipts` = 载荷层 settings-schema 迁移的收据(只点名坐标与处置,不带值)。 */
+export interface LkgReadMigration {
+    readonly fromFormat: 2 | 3 | 4;
+    readonly note?: string;
+    readonly receipts: readonly MigrationReceipt[];
+}
 /**
  * 读盘上 LKG。返回 undefined 的所有情形都「安静地回 env 兜底」(调用方 warn 点名 reason):
  * 文件缺席/JSON 坏/信封形不对/worker 或凭证身份不匹配(防同名文件跨 worker / 跨账号串包;`CONFIG_LKG_PATH`
- * 单一路径时这是唯一的一道)/prompts 面复判失败。
- * `migrated`:读回时做过一次性迁移({@link migrateV2Lkg})—— 调用方响亮打一行。
+ * 单一路径时这是唯一的一道)/载荷有迁不动的旧形({@link migrateLkgPayload})/prompts 面复判失败。
+ * `migrated`:读回时做过一次性迁移(信封 2 → 3 或载荷的 settings-schema 迁移)—— 调用方响亮打一行,并把交回的 4 写回原位。
  */
 export declare function loadLkg(path: string, worker: string | undefined, identity: string): Promise<{
     lkg: PersistedLkg;
-    migrated?: string;
+    migrated?: LkgReadMigration;
 } | {
     lkg?: undefined;
     reason: string;
 }>;
+/**
+ * LKG 载荷(一份冻结的 effective)→ settings-schema 11 的形:调契约的 `migrateEffectiveSnapshot`(本仓不写任何一条改写规则;只认形、幂等,
+ * `version` / `updatedAt` 与其余信封键原样)。有收据 `refused`(迁不动 —— 例:同一份文档里 `atModelAllowlist` 与 `atMention` 并存、
+ * `runtime` 文档读不进)⇒ 交回拒因(**点名迁移 id 与契约的拒句**,不带值),调用方不读回这份 LKG:本仓应用 LKG 不经契约读腿,迁不动的旧形
+ * 留在载荷里就会被下游当作缺席静默略过(例:`atModelAllowlist` 不再有读者 = 限制被静默放宽)。
+ */
+export declare function migrateLkgPayload(effective: Record<string, unknown>): {
+    effective: Record<string, unknown>;
+    receipts: readonly MigrationReceipt[];
+} | {
+    refused: string;
+};
 /** 7.98.0 及以前的默认 LKG 路径(按当时的写法逐字保留 —— 这是盘上已有文件的名字,不是现行分箱规则)。 */
 export declare function legacyV1LkgPath(config: {
     readonly agentConfigDir?: string;
@@ -84,7 +104,7 @@ export type LegacyLkgMigration = {
  *  2. 旧文件没有(ENOENT / ENOTDIR)或不是 formatVersion 1 信封 ⇒ `none`。旧默认路径上却读不了 / 不是 JSON ⇒
  *     `not-migrated`(响亮,不当它不存在);`CONFIG_LKG_PATH` 同路径时这两形由 loadLkg 自己报(不重复打一行)。
  *  3. v1 信封只记 worker:唯一推得出身份的形是拉取令牌(身份 = worker,`pullTokenIdentity`)。此刻身份正是它、worker
- *     对得上、载荷过 {@link lkgPayloadProblem} ⇒ **先写后退役**(修复验证 N9):先按新格式把它写进 `binPath`(原子写,
+ *     对得上、载荷过 {@link migrateLkgPayload}(迁成 11 的形;迁不动 ⇒ 响亮拒、不写箱)与 {@link lkgPayloadProblem} ⇒ **先写后退役**(修复验证 N9):先按新格式把它写进 `binPath`(原子写,
  *     0600),写成了才把旧文件改名 `<legacyPath>.migrated-v1`。写失败 ⇒ `not-migrated`,旧文件原样留在原位,下一次
  *     照常可迁;写成之后改名失败 ⇒ 仍是 `migrated`(`retireError` 响一行),箱已在 ⇒ 下一次按判序 1 不再看旧文件。
  *     同路径(`CONFIG_LKG_PATH`)时新箱的写入会原子替换旧文件本身,所以旧字节在写之前留一份 `.migrated-v1` 副本

package/dist/config-lkg.js

@@ -1,4 +1,6 @@
 import { promises as fs } from "node:fs";
+import { migrateEffectiveSnapshot } from "@sema-agent/settings-schema/one-time-migrations";
+import { formatConfigPath } from "@sema-agent/settings-schema";
 import { join, dirname, resolve } from "node:path";
 import { randomBytes } from "node:crypto";
 import { validatePromptsDomain } from "./prompts-domain-validate.js";
@@ -25,7 +27,7 @@ export function lkgReadDenyRows(configLkgPath) {
     return [{ pattern: configLkgPath, caseSensitive: false }];
 }
 export async function saveLkg(path, worker, identity, effective, etag) {
-    const body = { formatVersion: 3, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
+    const body = { formatVersion: 4, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
     const tmp = `${path}.${randomBytes(6).toString("hex")}.tmp`;
     await fs.mkdir(dirname(path), { recursive: true });
     await fs.writeFile(tmp, JSON.stringify(body), { mode: 0o600 });
@@ -52,16 +54,44 @@ export async function loadLkg(path, worker, identity) {
     const formatVersion = p.formatVersion;
     if (formatVersion === 1)
         return { reason: "pre-identity LKG (formatVersion 1) — not read back: it cannot prove whose credential fetched it (S-651); the next clean candidate rewrites it" };
-    if (formatVersion !== 2 && formatVersion !== 3)
+    if (formatVersion !== 2 && formatVersion !== 3 && formatVersion !== 4)
         return { reason: `unknown formatVersion ${String(formatVersion)}` };
     if (typeof p.worker !== "string" || p.worker !== (worker ?? "global"))
         return { reason: `worker mismatch (file=${String(p.worker)})` };
     if (typeof p.identity !== "string" || p.identity !== identity)
         return { reason: "credential identity mismatch (the LKG was fetched under another credential identity — not read back)" };
-    const problem = lkgPayloadProblem(p.effective, p.etag);
+    if (p.effective === null || typeof p.effective !== "object" || Array.isArray(p.effective))
+        return { reason: "bad effective" };
+    let envelope = p;
+    let note;
+    if (formatVersion === 2) {
+        const v2 = migrateV2Lkg(envelope);
+        if (v2.lkg === undefined)
+            return v2;
+        envelope = v2.lkg;
+        note = v2.migrated;
+    }
+    const payload = migrateLkgPayload(envelope.effective);
+    if ("refused" in payload)
+        return { reason: payload.refused };
+    const problem = lkgPayloadProblem(payload.effective, envelope.etag);
     if (problem !== undefined)
         return { reason: problem };
-    return formatVersion === 2 ? migrateV2Lkg(p) : { lkg: p };
+    const lkg = { ...envelope, formatVersion: 4, effective: payload.effective };
+    const migrated = formatVersion !== 4 || payload.receipts.length > 0;
+    return migrated ? { lkg, migrated: { fromFormat: formatVersion, ...(note !== undefined ? { note } : {}), receipts: payload.receipts } } : { lkg };
+}
+export function migrateLkgPayload(effective) {
+    const m = migrateEffectiveSnapshot(effective);
+    const refused = m.receipts.filter((r) => r.appliedAs === "refused");
+    if (refused.length > 0) {
+        return {
+            refused: "settings-schema one-time migration refused part of this LKG's payload (" +
+                refused.map((r) => `${r.migration} ${r.document}:${formatConfigPath(r.path)} — ${r.reason}`).join("; ") +
+                ") — not read back: the engine applies an LKG without the contract's reader, so a form the migration cannot rewrite would be silently skipped; the next clean candidate rewrites it",
+        };
+    }
+    return { effective: m.effective, receipts: m.receipts };
 }
 const RETIRED_CATALOG_COORDINATE = /^models\.(0|[1-9][0-9]*)$/;
 function migrateDroppedIdentityRow(row) {
@@ -87,7 +117,7 @@ function migrateV2Lkg(lkg) {
         effective = { ...lkg.effective, models: { ...rest, droppedCatalogEntries: Array.isArray(retired) ? retired.map(migrateDroppedIdentityRow) : retired } };
     }
     return {
-        lkg: { ...envelope, formatVersion: 3, effective },
+        lkg: { ...envelope, effective },
         migrated: "formatVersion 2 → 3 (one-time): this LKG was written before every dropped catalog entry was recorded, so its etag is not reused — the next pull re-reads the whole candidate and re-mints the full record" +
             (hasRetired ? "; the retired carrier models.droppedIdentities was moved to models.droppedCatalogEntries" : ""),
     };
@@ -100,7 +130,7 @@ function lkgPayloadProblem(effective, etag) {
     const eff = effective;
     if (typeof eff.version !== "number")
         return "bad effective.version";
-    for (const [domain, arrayKey] of [["models", "models"], ["skills", "skills"], ["mcp", "servers"], ["scenarios", "scenarios"], ["runtime", null]]) {
+    for (const [domain, arrayKey] of [["models", "models"], ["skills", "skills"], ["mcp", "servers"], ["scenarios", "scenarios"], ["limits", null]]) {
         const v = eff[domain];
         if (v === undefined)
             continue;
@@ -112,12 +142,6 @@ function lkgPayloadProblem(effective, etag) {
                 return `bad effective.${domain}.${arrayKey}`;
         }
     }
-    {
-        const rt = eff.runtime;
-        if (rt && (rt.autonomy !== undefined || rt.commandPolicy !== undefined || rt.approvalRequire !== undefined)) {
-            return "legacy runtime governance keys (pre-0.7.1 mirror shape; no contract producer since LKG shipped) — refusing rather than silently dropping governance";
-        }
-    }
     const promptsRaw = eff.prompts;
     if (promptsRaw !== undefined && !validatePromptsDomain(promptsRaw).ok)
         return "prompts face fails re-validation";
@@ -168,7 +192,12 @@ export async function migrateV1Lkg(o) {
     if (o.identity !== pullTokenIdentity(o.worker)) {
         return refuse("its envelope records only the worker, and only a pull-token credential's identity (= the worker) can be derived from that — the current credential is not this worker's pull token, so the file cannot prove whose credential fetched it");
     }
-    const problem = lkgPayloadProblem(v1.effective, v1.etag);
+    if (v1.effective === null || typeof v1.effective !== "object" || Array.isArray(v1.effective))
+        return refuse("its payload is unusable (bad effective)");
+    const payload = migrateLkgPayload(v1.effective);
+    if ("refused" in payload)
+        return refuse(`its payload cannot be migrated to the current settings form (${payload.refused})`);
+    const problem = lkgPayloadProblem(payload.effective, v1.etag);
     if (problem !== undefined)
         return refuse(`its payload is unusable (${problem})`);
     const retiredTo = `${o.legacyPath}.migrated-v1`;
@@ -182,7 +211,7 @@ export async function migrateV1Lkg(o) {
         }
     }
     try {
-        await saveLkg(o.binPath, o.worker, o.identity, v1.effective, undefined);
+        await saveLkg(o.binPath, o.worker, o.identity, payload.effective, undefined);
     }
     catch (err) {
         return refuse(`writing it into this credential identity's bin failed (${String(err)}) — the old file is left in place and the migration retries on the next LKG read`);