@sema-agent/server 7.123.0 → 7.124.0

package/dist/fleet-client.d.ts

@@ -1,6 +1,6 @@
 /**
  * Fleet worker-side wiring(announce/heartbeat + usage 批报;契约 = registry-core 0.1.48+
- * `/fleet`,center 端点 = sema-registry `/api/fleet/*`)。设计要点:
+ * `/fleet`,center 端点 = web-admin `/api/fleet/*`)。设计要点:
  *  - **可选分层(D3),两条环各自有门(S-866 ④)**:客户端在中心车道配齐时启动(`centerLaneConfigured` —— baseUrl + 声明了
  *    凭证 + worker,与租约管理器、用量累加器**同一只**谓词);**用量环**只要这三件;**公告环**(announce / 心跳 / 注销)另要
  *    配置席 `fleetAdvertiseAddress`(env `FLEET_ADVERTISE_ADDRESS`,`loadConfig` 解析一次;可达性是运维的话,不自猜:k8s pod IP /
@@ -13,13 +13,13 @@
  *  - **`engineSignal`(7.123.0)**:引擎态整只(契约 `EngineSignal`),与扁平键同一次读数;契约包 10.x 的心跳形没有它的座位(10.x 中心
  *    默认 strip 解析丢掉它、照收心跳);扁平布尔 `draining` settings-schema 12.0.0 删、本引擎 7.124.0+ 删发。
  *  - **`restart?`(S-741)**:在场 ⇔ 本副本必须重启才能应用配置 —— 取自 `/health.restart` **同一只**取值口(装配层接
- *    `deployment.restartState`,config-center 的 `restartState()`),同一个对象,形 = settings-schema `RestartSignal`;
+ *    `deployment.restartState`,web-admin 的 `restartState()`),同一个对象,形 = settings-schema `RestartSignal`;
  *    缺席即键缺席(中心按行整体替换,不合并 —— 一条不带它的心跳就是「不再需要」)。
  *  - **`modelRefusals?`(S-768)**:在场 ⇔ 本副本对最近一次被判的中心候选目录有可报的拒(逐条名 → 码 / 模型面组拒码)—— 取自
  *    `/health.modelRefusals` **同一只**取值口(装配层接 `deployment.modelRefusalsState`),同一个对象,形 = settings-schema
  *    `ModelRefusalsSignal`;缺席即键缺席(同 `restart`)。
  *  - **自报状态翻转即刻再 announce**(第一时间自摘流 / 自挂流 / 报重启 / 报拒因,比任何观测都快):draining 翻转由收尾链直调
- *    `announceNow`;roster 落地、restart 信号与模型拒因变化由装配层把 config-center 的 `onSelfReportChange` 接到 `announceNow`
+ *    `announceNow`;roster 落地、restart 信号与模型拒因变化由装配层把 web-admin 的 `onSelfReportChange` 接到 `announceNow`
  *    (两处 = 两类输入各自的唯一写者,触发都是 `announceNow`)。退出前 DELETE(显式注销,幂等)。
  *  - **usage 批报**:tracer 的 `brain.call` 已带 ALS principal —— FleetUsageAccumulator 按 principal×model
  *    累计,每窗口(默认 60s,半开 [windowStartMs, windowEndMs))POST /api/fleet/usage。幂等键
@@ -27,9 +27,9 @@
  *    向前合并不会双计 —— 只延迟,不丢量)。
  *  - 全部 fire-and-forget + swallow-guarded:fleet 面是运维旁路,绝不影响任务面;网络错误只 warn 一次/连败类。
  */
-import { UsageReport, type CapabilityReading, type CenterCapabilities, type ModelRefusalsSignal } from "@sema-agent/settings-schema/fleet";
+import { UsageReport, type CapabilityReading, type WebAdminCapabilities, type ModelRefusalsSignal } from "@sema-agent/settings-schema/fleet";
 import { type EngineSignalFacts } from "./fleet/engine-signal.js";
-import { type CenterEndpoint } from "./config-center/center-request.js";
+import { type CenterEndpoint } from "./web-admin-client/center-request.js";
 /** Bound on distinct principal×model keys per window — a runaway/multi-tenant burst collapses into
  *  `__other__` instead of growing unbounded (same posture as budget.ts cardinalityGuard). */
 export declare const FLEET_USAGE_KEY_CAP = 1024;
@@ -91,7 +91,7 @@ export interface FleetClientOpts {
     /** 编排器片 2:每一次**能力读数**交出去一次(装配层接服务租约客户端的 `noteCenterCapabilities`)。规则见 {@link capabilityReadingOf}:
      *  只有 `declared`(交出宣告的位)与 `undeclared`(交 `undefined` = 老中心没宣告)是读数;`unreadable`(体读不出 / 不是对象 /
      *  `capabilities` 键在场而形坏)不是读数 ⇒ 不调,上一次读数与它的钟原样。失败的公告同样不调(没听到 ≠ 没有)。 */
-    onCenterCapabilities?: (caps: CenterCapabilities | undefined) => void;
+    onCenterCapabilities?: (caps: WebAdminCapabilities | undefined) => void;
     usage?: FleetUsageAccumulator;
     heartbeatMs?: number;
     usageWindowMs?: number;
@@ -148,7 +148,7 @@ export declare function startFleetClient(opts: FleetClientOpts): FleetClient;
  * deployments); an address set while only the worker is missing is warned (half-configured announce).
  */
 export declare function startFleetClientFromConfig(cfg: {
-    configCenter?: (CenterEndpoint & {
+    webAdmin?: (CenterEndpoint & {
         worker?: string;
     }) | undefined;
     fleetAdvertiseAddress?: string | undefined;

package/dist/fleet-client.js

@@ -1,7 +1,8 @@
 import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS, readCapabilityReading } from "@sema-agent/settings-schema/fleet";
 import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, heartbeatReadinessKeys } from "./fleet/engine-signal.js";
-import { centerFetch, centerLaneConfigured } from "./config-center/center-request.js";
+import { centerFetch, centerLaneConfigured } from "./web-admin-client/center-request.js";
 import { recordFailOpen } from "./observability/fail-open.js";
+import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 export const FLEET_USAGE_KEY_CAP = 1024;
 export const FLEET_CLIENT_FETCH_TIMEOUT_MS = 5000;
 export class FleetUsageAccumulator {
@@ -230,14 +231,14 @@ export function startFleetClient(opts) {
     return { announceNow, stopRouting, flushFinalUsage };
 }
 export function startFleetClientFromConfig(cfg, opts) {
-    const cc = cfg.configCenter;
+    const cc = cfg.webAdmin;
     const address = cfg.fleetAdvertiseAddress;
     if (!centerLaneConfigured(cfg)) {
         if (address !== undefined && cc?.baseUrl && cc.credential.declared) {
-            opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but SEMA_REGISTRY_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
+            opts.logger?.warn("fleet_client_no_worker_scope", { note: `FLEET_ADVERTISE_ADDRESS set but ${WEB_ADMIN_ENV.worker} missing — announce needs the worker (dispatch key); fleet client not started` });
         }
         return undefined;
     }
-    return startFleetClient({ ...opts, center: cfg.configCenter, advertiseAddress: address });
+    return startFleetClient({ ...opts, center: cfg.webAdmin, advertiseAddress: address });
 }
 //# sourceMappingURL=fleet-client.js.map

package/dist/fleet-lease.d.ts

@@ -1,4 +1,4 @@
-import { type CenterEndpoint } from "./config-center/center-request.js";
+import { type CenterEndpoint } from "./web-admin-client/center-request.js";
 /** 负缓存 TTL:非 lease-enforced 的 principal 多久后再问一次 center(entitlement 升级为 lease 的收敛上界)。 */
 export declare const NOT_LEASE_TTL_MS: number;
 /** center 判 budget exhausted 后,多久内的重复提交直接拒绝而不再打 center(防 per-request 打爆)。 */
@@ -141,11 +141,11 @@ export declare class FleetLeaseManager {
 /**
  * Env/config gate:中心车道配齐({@link centerLaneConfigured} —— 与 fleet 用量环 / 用量累加器**同一只**谓词,S-866 ④)即启;
  * 不需要 FLEET_ADVERTISE_ADDRESS(它是出站消费面,不是入站可达性声明)。缺任一件 → undefined,非 fleet 部署零行为变化。
- * S-651:按**声明**装、不按内容装 —— `SEMA_REGISTRY_TOKEN_FILE`(`CENTER_CREDENTIAL_ENV.tokenFile`)在场而
+ * S-651:按**声明**装、不按内容装 —— `SEMA_WEB_ADMIN_TOKEN_FILE`(`WEB_ADMIN_ENV.tokenFile`)在场而
  * 文件此刻不可读,管理器照样装上(每次协商取值,失败走响亮的鉴权失败臂;文件恢复即恢复)。
  */
 export declare function createFleetLeaseFromEnv(cfg: {
-    configCenter?: (CenterEndpoint & {
+    webAdmin?: (CenterEndpoint & {
         worker?: string;
     }) | undefined;
     fleetLeaseFailClosed: boolean;

package/dist/fleet-lease.js

@@ -1,6 +1,6 @@
 import { QuotaLease, leaseExhausted, shouldRenewLease } from "@sema-agent/settings-schema/fleet";
 import { CenterCredentialUnavailableError } from "./center-credential.js";
-import { centerFetch, centerLaneConfigured } from "./config-center/center-request.js";
+import { centerFetch, centerLaneConfigured } from "./web-admin-client/center-request.js";
 export const NOT_LEASE_TTL_MS = 10 * 60 * 1000;
 export const EXHAUSTED_RETRY_MS = 30 * 1000;
 export const LEASE_PRINCIPAL_CAP = 4096;
@@ -174,7 +174,7 @@ export class FleetLeaseManager {
 export function createFleetLeaseFromEnv(cfg, opts) {
     if (!centerLaneConfigured(cfg))
         return undefined;
-    const cc = cfg.configCenter;
+    const cc = cfg.webAdmin;
     return new FleetLeaseManager({ ...opts, center: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker }, failMode: cfg.fleetLeaseFailClosed ? "closed" : "open" });
 }
 //# sourceMappingURL=fleet-lease.js.map

package/dist/host-lsp-manager.d.ts

@@ -18,7 +18,7 @@
  *
  * ## 时刻
  * env 在**构造时**取一次快照(boot / run-local 起腿时),而不是 core 默认那样每次 spawn 现取:`NodeLspManagerOptions.env`
- * 是一份静态记录。本仓的 `process.env` 是 boot 期输入(热配置走配置中心,不改 `process.env`),两者在本仓部署上同值。
+ * 是一份静态记录。本仓的 `process.env` 是 boot 期输入(热配置走 web-admin,不改 `process.env`),两者在本仓部署上同值。
  *
  * ## 点名放行(S-699,`LSP_ENV_ALLOW`)
  * 剥除会连语言服务器自己的真实依赖一起剥掉(`.npmrc` 的 `${NPM_TOKEN}` 插值、rust-analyzer `cargo metadata` 私有 registry 的

package/dist/hosted-posture.d.ts

@@ -30,11 +30,11 @@
  * (`PRINCIPAL_JWT_PUBKEYS/ISS/AUD` 任一在场;`AUTH_BRIDGE_ISSUER` 显式在场),[ref] ① 裁 (a) 撤回:
  *  · **真假阳**:本机自起引擎、配了 principal-JWT / auth-bridge 签发方的单用户部署(web-admin 8090 真案)
  *    在 7.98.0 被判托管而拒启,只能滚回 7.93.5;
- *  · **与回退 issuer 不同判**:auth-bridge 的 `?? configCenter.baseUrl` 回退(`boot/stage-09-leader.ts`)
+ *  · **与回退 issuer 不同判**:auth-bridge 的 `?? webAdmin.baseUrl` 回退(`boot/stage-09-leader.ts`)
  *    从来不算证据,而回退桥的引擎同样把单用户授予开给每一个验签通过的 registry JWT 调用者 —— 同一个
  *    租户轴事实,「显式写了 issuer」与「从 center 推出 issuer」是同一形。裁定后两者同判。
  * ⇒ 签发方配置是**身份验签轴**(谁的 JWT 算数),不是租户轴(这台机器有几个主人)。「受控于控制面」
- * (`SEMA_REGISTRY_*`,含 worker 名)同理是 fleet 管理轴,本判据同样不读。
+ * (`SEMA_WEB_ADMIN_*`,含 worker 名)同理是 fleet 管理轴,本判据同样不读。
  *
  * 随两臂一起删掉的(按类删干净,规则集变小):S-564 腿①「托管 ∧ 未开 `REQUIRE_PRINCIPAL` ⇒ 拒启」
  * (判据只剩读 `requirePrincipal` 的那一臂之后,那条合取恒假 ⇒ 结构上不可达)及其跨键不变量行;
@@ -44,9 +44,9 @@
  *
  * 假阳 = 一台单用户部署被收走一个它一直在用的能力(7.98.0 时还会被拒启)。词表不收任何推断臂:
  *  · ❌ `PRINCIPAL_JWT_*` / `AUTH_BRIDGE_ISSUER` 在场 —— 见上一段([ref] ① 撤回;加回来 = 翻案,要新裁定)。
- *  · ❌ `configCenter`(含 `worker` 名)/ auth-bridge 的 center 回退 —— fleet 管理轴。初版(车LT)收过
+ *  · ❌ `webAdmin`(含 `worker` 名)/ auth-bridge 的 center 回退 —— fleet 管理轴。初版(车LT)收过
  *    `managed-worker` 臂,实测两个反例后撤回:`run-local.ts` 强设 `REQUIRE_PRINCIPAL=false` 的本机 CLI 在一个
- *    带 registry 键的共享 `.env` 上拒启;本仓自己的 `test/config-coverage-blocks.test.ts` configCenter 两格当场红。
+ *    带 registry 键的共享 `.env` 上拒启;本仓自己的 `test/config-coverage-blocks.test.ts` webAdmin 两格当场红。
  *  · ❌ `operatorPrincipals` 非空 —— **真假阳**:`IMAGE_BAKES_ENABLED` 那条既有不变量
  *    (`config-invariants.ts` 的 `bake-operator-principals`)**强制**开烤门的部署把它填非空。
  *  · ❌ `SERVICE_AUTH_TOKENS` 条目数 —— 一台机器上同时给 cli 与 web-admin 发一只令牌是单用户常态。

package/dist/http/admission.js

@@ -1,5 +1,5 @@
 import { APPROVAL_REACH, MCP_IMAGE_MAX_BASE64, isApprovalReach, isPermissionMode, isThinkingLevel, expandTiers } from "@sema-agent/core";
-import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
+import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError } from "../security.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
@@ -15,6 +15,7 @@ import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { skillCarriesRetiredManifest } from "./retired-skill-manifest.js";
 import { resolveDevicePlacementIntent } from "./device-placement.js";
 import { sendError, httpErrorCode } from "./send.js";
+import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 const APPROVAL_REACH_WORDS = APPROVAL_REACH.map((word) => JSON.stringify(word)).join(" / ");
 export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
 export const MAX_SYSTEM_PROMPT_CHARS = 16_384;
@@ -51,8 +52,7 @@ export const SKILL_MANIFEST_RETIRED = "skill.manifest was retired in core 7.41.0
 const MAX_IMAGES_PER_REQUEST = 20;
 const MAX_IMAGE_BASE64_BYTES = MCP_IMAGE_MAX_BASE64;
 function mentionableNames(config, catalog) {
-    const allowlist = config.atModelAllowlist ?? [];
-    return Object.keys(catalog).filter((n) => n !== "default" && isModelAllowlisted(n, catalog, allowlist, config.modelRefusals));
+    return Object.keys(catalog).filter((n) => n !== "default" && isAtMentionable(n, catalog, config.atMention, config.modelRefusals));
 }
 function refuseUnavailableModel(res, config, field, ref) {
     const hit = refusedCatalogEntry(ref, config.modelRefusals);
@@ -377,7 +377,7 @@ export function createAdmission(ctx) {
             const wantsSelfOrchestration = body.selfOrchestration === true
                 || parseTaskSettings(body.settings).settings?.ultracode === true;
             if (!admission.available && wantsSelfOrchestration) {
-                sendError(res, 501, "capability.self_orchestration_required", "self-orchestration is enabled on this worker (SELF_ORCHESTRATION_ENABLED) but it is multi-tenant (REQUIRE_PRINCIPAL) and wires NO per-principal entitlement source, so the engine's allowWorkflows gate — which is tighten-only, meaning an absent resolver leaves it UNGATED — is fail-closed for every principal: no request can ever get the workflow engine here (GET /v1/capabilities reports workflows:false with workflowsGate.denial \"entitlement_resolver_absent\"). Wire a config center (SEMA_REGISTRY_URL + token, not dry-run) to gate it per principal, or set SELF_ORCHESTRATION_ENABLED=false — the honest posture for a worker that cannot grant it. To submit this task without the workflow engine, drop selfOrchestration / settings.ultracode; ultracode's other half (the max thinking tier) is available as reasoningEffort: \"max\"");
+                sendError(res, 501, "capability.self_orchestration_required", `self-orchestration is enabled on this worker (SELF_ORCHESTRATION_ENABLED) but it is multi-tenant (REQUIRE_PRINCIPAL) and wires NO per-principal entitlement source, so the engine's allowWorkflows gate — which is tighten-only, meaning an absent resolver leaves it UNGATED — is fail-closed for every principal: no request can ever get the workflow engine here (GET /v1/capabilities reports workflows:false with workflowsGate.denial "entitlement_resolver_absent"). Wire a web-admin (${WEB_ADMIN_ENV.url} + token, not dry-run) to gate it per principal, or set SELF_ORCHESTRATION_ENABLED=false — the honest posture for a worker that cannot grant it. To submit this task without the workflow engine, drop selfOrchestration / settings.ultracode; ultracode's other half (the max thinking tier) is available as reasoningEffort: "max"`);
                 return null;
             }
         }

package/dist/http/checkpoint-ctx.d.ts

@@ -77,6 +77,7 @@ export declare function buildCheckpointCtx(fields: {
     body: TaskRequestBody;
     memoryScope?: string | undefined;
     unattendedLeg?: true;
+    writerVersion: string;
 }): CheckpointCtx;
 /**
  * 模式词的**第二个写者** —— `plan_review` 的批准 / 编辑把这条 run 的体词从 `plan` 写成批准的档(`resume-legs.ts` `drivePlanReview`,调用点只有那一处;
@@ -130,10 +131,14 @@ export declare function allowListReadingRefusal(era: AllowListReadingEra): {
         retriable: true;
     };
 };
-/** 一条停驻行的持久化体在本版上**不能**重放时,是哪一条规则拒的(闭集;加一条 ⇒ {@link storedBodyReplayAnswer} 的 switch 编译红)。 */
+/**
+ * 一条停驻行的持久化体在本版上**不能**重放时,是哪一条规则拒的(闭集;加一条 ⇒ {@link storedBodyReplayAnswer} 的 switch 编译红)。
+ * 答 `checkpoint.unsupported_version` 的两臂随带这一行的写者版本(续跑上下文的 `writerVersion`,缺席 = 本版之前写下的行)—— 那一码的两版本键由它铸({@link buildCheckpointVersionKeys})。
+ */
 export type StoredBodyReplayRefusal = {
     readonly kind: "allow_list_reading";
     readonly era: AllowListReadingEra;
+    readonly writerVersion?: string;
 } | {
     readonly kind: "skill_deny_inert";
     readonly entry: SkillDenyInertEntry;
@@ -141,7 +146,18 @@ export type StoredBodyReplayRefusal = {
     readonly kind: "permission_mode_reading";
     readonly stored: PermissionMode | undefined;
     readonly floor: PermissionMode;
+    readonly writerVersion?: string;
 };
+/**
+ * 🔴 **`checkpoint.unsupported_version` 的 409 体上两个版本键 —— 唯一铸法;本码每一个铸点同一条律**(core 原码镜像 = `resume-legs.ts` 的 catch 臂;本服务自铸的两只拒
+ * = {@link storedBodyReplayAnswer} 的 allow 读法 / 模式词读法两臂):续跑上下文带写者版本 ⇒ `{ writerVersion, readerVersion }`;不带(本版之前写下的行)⇒ `{}`,不编值。
+ * 两值相等也照带 —— 那是事实(不是版本问题,出路照码与报文);写者比读者新才是「回到写它的那一版去决」。`readerVersion` 由调用方传本进程的服务版本
+ * (本模块零值依赖,不自取)。纯数据。
+ */
+export declare function buildCheckpointVersionKeys(writerVersion: string | undefined, readerVersion: string): {
+    writerVersion: string;
+    readerVersion: string;
+} | Record<string, never>;
 /** 续跑家族交回的拒答复形(`{ status, body }`,由 `sendResumeOutcome` / 各路由发送;`body` 至少 `error` + `errorCode`)。 */
 export interface ResumeRefusalAnswer {
     readonly status: number;
@@ -169,8 +185,9 @@ export declare function storedBodyReplayLogFields(refusal: StoredBodyReplayRefus
     note: string;
 };
 /**
- * `stored-body-replay.ts` `storedBodyReplayRefusal` 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};技能拒侧 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
+ * `stored-body-replay.ts` `storedBodyReplayRefusal` 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};模式词记号 ⇒ {@link permissionModeReadingRefusal};
+ * 这两只答 `checkpoint.unsupported_version`,体按那一码的键律补两版本键,`readerVersion` = 调用方传的本进程服务版本;技能拒侧 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
  * `request.field_invalid` 同码同句 —— 体上只有这一个问题时;存量体同时还踩中 `resolveSpec` 更早的拒〔三桶超帽 / 托管姿态〕时,提交侧答更早那条、续跑侧答本句,两边都是拒,指路不同)。
  */
-export declare function storedBodyReplayAnswer(refusal: StoredBodyReplayRefusal): ResumeRefusalAnswer;
+export declare function storedBodyReplayAnswer(refusal: StoredBodyReplayRefusal, readerVersion: string): ResumeRefusalAnswer;
 //# sourceMappingURL=checkpoint-ctx.d.ts.map

package/dist/http/checkpoint-ctx.js

@@ -14,6 +14,7 @@ export function bodyCarriesAllowList(body) {
 export function buildCheckpointCtx(fields) {
     return {
         body: fields.body,
+        writerVersion: fields.writerVersion,
         ...(fields.memoryScope !== undefined ? { memoryScope: fields.memoryScope } : {}),
         ...(fields.unattendedLeg === true ? { unattendedLeg: true } : {}),
         ...(bodyCarriesAllowList(fields.body) ? { permissionsAllowReading: "allow_layer" } : {}),
@@ -73,6 +74,9 @@ export function allowListReadingRefusal(era) {
         }
     }
 }
+export function buildCheckpointVersionKeys(writerVersion, readerVersion) {
+    return writerVersion !== undefined ? { writerVersion, readerVersion } : {};
+}
 export function resumeBlockedByPolicyAnswer(message, blockedBy, extra) {
     return {
         status: 409,
@@ -93,14 +97,18 @@ export function storedBodyReplayLogFields(refusal) {
         }
     }
 }
-export function storedBodyReplayAnswer(refusal) {
+export function storedBodyReplayAnswer(refusal, readerVersion) {
     switch (refusal.kind) {
-        case "allow_list_reading":
-            return allowListReadingRefusal(refusal.era);
+        case "allow_list_reading": {
+            const answer = allowListReadingRefusal(refusal.era);
+            return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };
+        }
         case "skill_deny_inert":
             return resumeBlockedByPolicyAnswer(refusal.entry.message, "request.field_invalid");
-        case "permission_mode_reading":
-            return permissionModeReadingRefusal();
+        case "permission_mode_reading": {
+            const answer = permissionModeReadingRefusal();
+            return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };
+        }
         default: {
             const unhandled = refusal;
             throw new Error(`stored-body replay refusal ${JSON.stringify(unhandled)} has no answer`);

package/dist/http/dispatch.js

@@ -208,11 +208,11 @@ export function createDispatch(ctx) {
             res.end(deps.metrics.render());
             return;
         }
-        if (deps.registryJwtVerifier) {
+        if (deps.webAdminJwtVerifier) {
             const authz = req.headers.authorization ?? "";
             const rawBearer = /^Bearer\s/i.test(authz) ? authz.replace(/^Bearer\s+/i, "") : "";
             if (rawBearer && looksLikeJwt(rawBearer)) {
-                const v = await deps.registryJwtVerifier.verify(rawBearer);
+                const v = await deps.webAdminJwtVerifier.verify(rawBearer);
                 if (v.ok) {
                     setSsoPrincipal(req, v.identity.principal);
                     req.headers[deps.config.principalHeader.toLowerCase()] = v.identity.principal;

package/dist/http/durable-run-leg.js

@@ -9,6 +9,7 @@ import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
 import { buildCheckpointCtx } from "./checkpoint-ctx.js";
+import { serviceVersion } from "../service-version.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const { deps } = ctx;
     const { inflightRuns, preemptableRuns, steerableRuns } = ctx.registry;
@@ -32,7 +33,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
         return { status: placementReject.status, body: devicePlacementErrorBody(placementReject) };
     commitSessionInheritEnv(deps, args.prepared.spec.sessionId, args.prepared.body);
     if (deps.checkpointStore) {
-        await deps.checkpointStore.putCtx(sessionId, buildCheckpointCtx({ body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope }));
+        await deps.checkpointStore.putCtx(sessionId, buildCheckpointCtx({ body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope, writerVersion: serviceVersion() }));
     }
     const anchorOwner = args.prepared.auth?.principal ?? null;
     const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);

package/dist/http/health-self-report.d.ts

@@ -7,12 +7,12 @@
  *  · `auth.required` = 全局凭据门的武装谓词(`hasServiceAuth`,由 `dispatch.ts` 交进来 —— 门与本位读同一次求值的同一只函数);
  *  · `auth.kinds` = {@link IDENTITY_SOURCES}(`verifiedIdentitySource` 的回值闭集)里,这台部署的装配**能**回的那几个词:
  *    `service_token` ⇐ 全局门武装(`systemFor` 只在配了 service token 时回得出值)· `sso` ⇐ 鉴权桥装了(入口预认证只在
- *    `registryJwtVerifier` 在场时挂身份)· `direct_door_jwt` ⇐ 直连门开着(`verifiedIdentitySource` 那一臂的第一个合取项);
+ *    `webAdminJwtVerifier` 在场时挂身份)· `direct_door_jwt` ⇐ 直连门开着(`verifiedIdentitySource` 那一臂的第一个合取项);
  *  · `auth.identityAttach` = kinds 里有没有**带调用方身份**的一类({@link carriesCallerIdentity},穷举):`service_token` 认的是系统
  *    (`systemFor` 回系统名或 null),不是人;
  *  · `operator` = 能力事实 `operatorLane`(operator 面族的 501 门读的同一只;名单本身不上 wire);
  *  · `center.issuer` = 鉴权桥 issuer 的唯一取值 `authBridgeIssuerOf`(装配 `boot/stage-09-leader.ts` 与 caps `centerWiring.issuer` 同读);
- *  · `center.webBaseUrl` = 运维旋钮 `SEMA_REGISTRY_WEB_URL`(`config.configCenter.webBaseUrl`,接了中心才挂;起服时已判成固定基址);
+ *  · `center.webBaseUrl` = 运维旋钮 `SEMA_WEB_ADMIN_WEB_URL`(`config.webAdmin.webBaseUrl`,接了中心才挂;起服时已判成固定基址);
  *  · `center.sessionsVisible` = 中心的 web 面能不能列出本引擎的会话 —— 四件接线事实全在才可能:中心车道配齐(`centerLaneConfigured`,
  *    租约 / 用量 / 公告同一只谓词)∧ 公告地址在(配置席 `fleetAdvertiseAddress`:web 面只拨中心登记过的实例地址)∧ 鉴权桥在(web 面带的是
  *    中心铸的中继令牌,不带 service token)∧ 会话枚举面在(事实 `sessionList`,web 面中继 `GET /v1/sessions`);缺任一 ⇒ `false`。
@@ -22,7 +22,7 @@
  * ## 无鉴权面
  * `/health` 排在凭据门之前、缺省全网卡监听:本模块只出闭集词、布尔与运维要发布的 URL。两只 URL 值都过 display-safe 律
  * (`buildDisplaySafeUrl`,所有展示面 URL 的同一个铸点):userinfo 落地、query 值成记号、尾斜杠折掉 —— issuer 的来源
- * (`AUTH_BRIDGE_ISSUER` / `SEMA_REGISTRY_URL`)起服时不判凭据形,这一道是它上无鉴权面的唯一闸。令牌、名单、worker 名、凭证一概不上。
+ * (`AUTH_BRIDGE_ISSUER` / `SEMA_WEB_ADMIN_URL`)起服时不判凭据形,这一道是它上无鉴权面的唯一闸。令牌、名单、worker 名、凭证一概不上。
  * 同一张面上本模块之外还有一个**调用方自取**的串(如实,7.123.0 起;`model` / `dataRoot` / `version` 等其余非闭集的名是部署自己的事实,不是调用方放进来的):排空中的动作号 `engineSignal.draining.actionId`(`fleet/engine-signal.ts` 铸,契约 §0.4)——
  * 引擎自起的排空是引擎的闭集词,经排空口(operator-only)进的排空是调用方自取的幂等键**原样**(契约包今天只要求非空串,推荐 `manual:<uuid>`),
  * 所以那一键不是闭集词:调用方不要往里放秘密或人名。
@@ -59,5 +59,5 @@ export interface HealthSelfReport {
  * 三键的**唯一铸点**(`build*`:纯数据)。`credentialGateArmed` 由 `dispatch.ts` 交进来 —— 它是全局凭据门自己的那一句
  * (`hasServiceAuth`),本模块不另求一遍(另求就是第二个写者)。
  */
-export declare function buildHealthSelfReport(deps: Pick<FlatServiceDeps, "config" | "registryJwtVerifier" | "sessionStorage" | "runStore">, credentialGateArmed: boolean): HealthSelfReport;
+export declare function buildHealthSelfReport(deps: Pick<FlatServiceDeps, "config" | "webAdminJwtVerifier" | "sessionStorage" | "runStore">, credentialGateArmed: boolean): HealthSelfReport;
 //# sourceMappingURL=health-self-report.d.ts.map

package/dist/http/health-self-report.js

@@ -1,7 +1,7 @@
 import { IDENTITY_SOURCES } from "./principal-gate.js";
 import { operatorLane, sessionList } from "../capability-facts.js";
 import { authBridgeIssuerOf } from "../auth-bridge.js";
-import { centerLaneConfigured } from "../config-center/center-request.js";
+import { centerLaneConfigured } from "../web-admin-client/center-request.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export const IDENTITY_ATTACH_WORDS = ["available", "unavailable"];
 export const OPERATOR_PRESENCE_WORDS = ["present", "absent"];
@@ -35,10 +35,10 @@ function identitySourceWired(kind, a) {
 }
 export function buildHealthSelfReport(deps, credentialGateArmed) {
     const { config } = deps;
-    const bridgeWired = deps.registryJwtVerifier !== undefined;
+    const bridgeWired = deps.webAdminJwtVerifier !== undefined;
     const kinds = IDENTITY_SOURCES.filter((k) => identitySourceWired(k, { credentialGateArmed, bridgeWired, directDoorActive: config.directDoorActive }));
     const issuer = authBridgeIssuerOf(config)?.issuer;
-    const webBaseUrl = config.configCenter?.webBaseUrl;
+    const webBaseUrl = config.webAdmin?.webBaseUrl;
     const sessionsVisible = centerLaneConfigured(config) && config.fleetAdvertiseAddress !== undefined && bridgeWired && sessionList(deps).available ? (config.requirePrincipal ? true : "unknown") : false;
     return {
         auth: { required: credentialGateArmed, kinds, identityAttach: kinds.some(carriesCallerIdentity) ? "available" : "unavailable" },

package/dist/http/idempotency.d.ts

@@ -14,7 +14,7 @@ import type { WiringManifestReceipt } from "./wire-types.js";
  * map grows past a threshold (no O(n) scan on the hot path). Single-threaded event-loop semantics: each HTTP
  * request is its own task, so there is no get→set race within a tick.
  *
- * (Caller context: the sema-registry review gateway mints/echoes the Idempotency-Key and routes a given key to
+ * (Caller context: the web-admin review gateway mints/echoes the Idempotency-Key and routes a given key to
  * the same worker, so this PER-POD cache is the worker-side backstop against a retried submission re-running —
  * and re-billing. Cross-pod / cross-restart exactly-once needs store-backing; the durable async /v1/runs path
  * is the alternative for long tasks.)

package/dist/http/resume-legs.d.ts

@@ -23,10 +23,11 @@ import type { RunRegistry, RouteHelpers, RouteLegs } from "./route-ctx.js";
 import type { createRequestGuards } from "./request-guards.js";
 import type { FlatServiceDeps } from "./server.js";
 /**
- * {@link CHECKPOINT_ERROR_DISPOSITION} 的读口(纯函数,resume 腿的 catch 臂与钉共用)。运行期遇到表外的码(装树 core 比本二进制多一个码的版本偏斜 ——
- * 型面上拼不出来)⇒ `"terminal"`:与 `by_reason` 认不得的词同一条 fail-closed 方向(不宽容默认成可重试),也与修前手列串的缺省逐字相同。
+ * 🔴 **一次 `CheckpointError` 拒的处置 —— 唯一读口**:{@link CHECKPOINT_ERROR_DISPOSITION} 的读法(doctrine 在那张表头)。resume 腿的 catch 臂只调它一次,
+ * 行的落点与 wire 的 `retriable` 都读这一个结果。纯函数,钉直接调。运行期遇到表外的码(装树 core 比本二进制多一个码的版本偏斜 —— 型面上拼不出来)
+ * ⇒ `"terminal"`:与 `by_reason` 认不得的词同一条 fail-closed 方向(不宽容默认成可重试),也与修前手列串的缺省逐字相同。
  */
-export declare function checkpointErrorDisposition(e: CheckpointError): "cancelled" | "retriable" | "terminal";
+export declare function resumeRefusalDisposition(e: CheckpointError): "cancelled" | "retriable" | "terminal";
 export declare function createResumeLegs(ctx: {
     deps: FlatServiceDeps;
     runnerFor: FlatServiceDeps["runnerFor"];

package/dist/http/resume-legs.js

@@ -17,12 +17,15 @@ import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTermi
 import { defaultSubagentTailBus } from "../fleet/subagent-tail-bus.js";
 import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerDurablyRecordable } from "../tool-approval.js";
 import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
+import { APPROVAL_ENDING_CAUSES } from "../approval-deny-reasons.js";
+import { serviceVersion } from "../service-version.js";
 import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { withPrincipal } from "../observability/principal-context.js";
 import { withModelReachScope } from "../model-reach-scope.js";
 import { createInstructionSelectionLeg } from "../instruction-selection.js";
 import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
+import { buildRunObjectivePreview } from "../user-authored-text.js";
 import { createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../trace/engine-notice-wire.js";
 import { reasoningDeltaBytes, reasoningSegmentEventId } from "../trace/model-segment.js";
@@ -43,7 +46,7 @@ import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
 import { deploymentListAsks } from "../approval.js";
 import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
-import { resumeBlockedByPolicyAnswer, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
+import { buildCheckpointVersionKeys, resumeBlockedByPolicyAnswer, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
 import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 import { httpErrorCode } from "./send.js";
 function isCheckpointReopenedFailure(r) {
@@ -108,7 +111,7 @@ const CHECKPOINT_ERROR_DISPOSITION = {
     "steering.invalid_content": "terminal",
     "steering.queue_full": "terminal",
 };
-export function checkpointErrorDisposition(e) {
+export function resumeRefusalDisposition(e) {
     const word = Object.hasOwn(CHECKPOINT_ERROR_DISPOSITION, e.code) ? CHECKPOINT_ERROR_DISPOSITION[e.code] : undefined;
     switch (word) {
         case "cancelled":
@@ -135,14 +138,26 @@ const CHECKPOINT_ERROR_FIELD_ROLE = {
     taskConfig: "config",
     inheritedGate: "config",
 };
-const ROLE_MINTS_RESUME_OUTCOME_INVALID = {
-    binding: false,
-    answer: false,
-    outcome_cell: true,
-    regrant: true,
-    config: false,
+const FIELD_ROLE_CAUSE = {
+    binding: APPROVAL_ENDING_CAUSES.BINDING_CHANGED,
+    answer: APPROVAL_ENDING_CAUSES.ANSWER_INVALID,
+    outcome_cell: APPROVAL_ENDING_CAUSES.OUTCOME_CELL_INVALID,
+    regrant: APPROVAL_ENDING_CAUSES.OUTCOME_CELL_INVALID,
+    config: undefined,
 };
-const NON_BINDING_INVALID_OUTCOME_FIELDS = new Set(Object.keys(CHECKPOINT_ERROR_FIELD_ROLE).filter((f) => ROLE_MINTS_RESUME_OUTCOME_INVALID[CHECKPOINT_ERROR_FIELD_ROLE[f]]));
+const WIRE_CODE_OF_DECISION_REFUSAL = {
+    [APPROVAL_ENDING_CAUSES.BINDING_CHANGED]: "approval_binding_mismatch",
+    [APPROVAL_ENDING_CAUSES.ANSWER_INVALID]: "resume_outcome_invalid",
+    [APPROVAL_ENDING_CAUSES.OUTCOME_CELL_INVALID]: "resume_outcome_invalid",
+};
+const UNCLASSIFIED_INVALID_OUTCOME_CODE = WIRE_CODE_OF_DECISION_REFUSAL[APPROVAL_ENDING_CAUSES.BINDING_CHANGED];
+function decisionRefusalCauseOf(e, gate) {
+    if (gate !== "policy_ask")
+        return APPROVAL_ENDING_CAUSES.OUTCOME_CELL_INVALID;
+    const field = e.detail?.field;
+    const role = field !== undefined && Object.hasOwn(CHECKPOINT_ERROR_FIELD_ROLE, field) ? CHECKPOINT_ERROR_FIELD_ROLE[field] : undefined;
+    return role === undefined ? undefined : FIELD_ROLE_CAUSE[role];
+}
 function notResumableAnswer() {
     return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
 }
@@ -420,7 +435,7 @@ export function createResumeLegs(ctx) {
     };
     const refuseStoredBodyReplay = (sessionId, refusal) => {
         deps.logger?.warn?.("resume_refused_stored_body", { sessionId, ...storedBodyReplayLogFields(refusal) });
-        return storedBodyReplayAnswer(refusal);
+        return storedBodyReplayAnswer(refusal, serviceVersion());
     };
     const resolveResumeSpecOrBlocked = async (ctx, req, auth) => {
         const replay = storedBodyReplayRefusal(ctx, deps.config.autonomy);
@@ -460,7 +475,7 @@ export function createResumeLegs(ctx) {
     async function driveResumeLeg(args, onAccepted) {
         const resumeLegStartedAt = Date.now();
         const { runner: legRunner, token, sessionId, principal, fleetScope, taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx } = args;
-        const commitResumeCtx = () => deps.checkpointStore.putCtx(resumeCtx.sessionId, resumeCtx.ctx).catch((e) => {
+        const commitResumeCtx = () => deps.checkpointStore.putCtx(resumeCtx.sessionId, { ...resumeCtx.ctx, writerVersion: serviceVersion() }).catch((e) => {
             deps.metrics?.inc("resume_ctx_not_persisted_total");
             deps.logger?.warn?.("resume_ctx_not_persisted", { sessionId: resumeCtx.sessionId, gate: outcome.gate, error: errorText(e), note: "this continuation runs with the body it was given; the durable rebuild input still holds the PREVIOUS body, so the NEXT continuation of this session rebuilds from that one (never wider than this leg's)" });
         });
@@ -494,7 +509,7 @@ export function createResumeLegs(ctx) {
             const freshId = uuidv7();
             const created = await deps.runStore.createRun(freshId, sessionId, principal ?? null, deps.instanceId ?? "default", {
                 source: args.mintFreshRun.source,
-                objectivePreview: resumeObjective ? redactSecrets(resumeObjective).slice(0, 120) : null,
+                objectivePreview: buildRunObjectivePreview(resumeObjective ?? ""),
             });
             if (!created.ok) {
                 return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
@@ -969,7 +984,8 @@ export function createResumeLegs(ctx) {
         }
         catch (e) {
             if (e instanceof CheckpointError) {
-                const disposition = checkpointErrorDisposition(e);
+                const refusalCause = e.code === "checkpoint.invalid_outcome" ? decisionRefusalCauseOf(e, outcome.gate) : undefined;
+                const disposition = resumeRefusalDisposition(e);
                 if (disposition === "cancelled") {
                     const cs2 = deps.checkpointStore;
                     if (cs2) {
@@ -1020,16 +1036,13 @@ export function createResumeLegs(ctx) {
                     body: {
                         ...(taskId !== undefined ? { taskId } : {}),
                         error: e.message,
-                        errorCode: e.code === "checkpoint.invalid_outcome"
-                            ? (outcome.gate === "policy_ask" && !NON_BINDING_INVALID_OUTCOME_FIELDS.has(String(e.detail?.field ?? ""))
-                                ? "approval_binding_mismatch"
-                                : "resume_outcome_invalid")
-                            : e.code,
+                        errorCode: e.code === "checkpoint.invalid_outcome" ? (refusalCause !== undefined ? WIRE_CODE_OF_DECISION_REFUSAL[refusalCause] : UNCLASSIFIED_INVALID_OUTCOME_CODE) : e.code,
                         ...(e.detail?.field ? { field: e.detail.field } : {}),
                         ...((e.code === "resume.usage_window_exhausted" || e.code === "resume.preflight_rejected") && typeof e.detail?.retryAfterMs === "number" && Number.isFinite(e.detail.retryAfterMs) && e.detail.retryAfterMs > 0
                             ? { retryAfterSec: Math.max(1, Math.ceil(e.detail.retryAfterMs / 1000)) }
                             : {}),
                         ...(retriable ? { retriable: true } : {}),
+                        ...(e.code === "checkpoint.unsupported_version" ? buildCheckpointVersionKeys(resumeCtx.ctx.writerVersion, serviceVersion()) : {}),
                     },
                 };
             }

package/dist/http/route-ctx.d.ts

@@ -176,6 +176,14 @@ export interface CheckpointCtx {
      * 不改词的续跑腿写回传原 ctx ⇒ 记号随行。
      */
     permissionModeReading?: import("./checkpoint-ctx.js").PermissionModeReading;
+    /**
+     * 🔴 S-1365 —— **写这份上下文的服务版本**(`package.json` 的 `version`),**服务端写、不来自请求体**(与 {@link unattendedLeg} 同为 `body` 的兄弟键)。
+     * 写点两个:`buildCheckpointCtx`(每一次新的持久化写)与续跑腿的写回({@link DriveResumeArgs.resumeCtx} 的唯一写点,CAS 赢点盖本进程的版本 —— 接下来写下一张停车行的就是它)。
+     * 读者:`checkpoint.unsupported_version` 的 409 体 —— 原样带出 `writerVersion`,与本引擎的 `readerVersion` 并列(运维据此知道该回哪一版去决);
+     * 两键唯一铸法 `checkpoint-ctx.ts` `buildCheckpointVersionKeys`,本码每个铸点同调。它是**上下文**,不是拒因:成因与码都不读它。
+     * 缺席 = 本版之前写下的行(不回填):那一码的体不带两键,如实不猜。不是一次性迁移 —— 这一格是常设的事实位,没有删除条件。
+     */
+    writerVersion?: string;
 }
 /** B4①(命名化):`driveResumeIntoRunLog` 的入参形(resume 家族共用)——原为 9 成员内联匿名对象。 */
 export interface DriveResumeArgs {

package/dist/http/routes/admin-config-refresh.d.ts

@@ -7,7 +7,7 @@
  * 身份 → 授权 →(本口无 body,无验型步)。
  *
  * 🔴 语义 = **触发一次既有的 refresh 拍**,不是「再实现一遍拉取」:实现面是
- * `configCenter.refreshNow()`,它与 60s cadence 共用同一只 join 形拍(在飞则 join,绝不并发双拍)。
+ * `webAdmin.refreshNow()`,它与 60s cadence 共用同一只 join 形拍(在飞则 join,绝不并发双拍)。
  * 回执里的两个世代号取自**同一本**世代账(`/health` 的三键同源)—— 两面各算一次迟早会各说各话。
  *
  * 🔴 没有配置管道(纯 env 形)⇒ 诚实 409 指路,**不吞成 200**:一个「triggered:true 但什么都没发生」的

package/dist/http/routes/admin-config-refresh.js

@@ -24,7 +24,7 @@ export async function handleAdminConfigRefresh(req, res, match, ctx) {
             const trigger = deps.configRefreshNow;
             const outcome = trigger ? await trigger() : "not-wired";
             if (outcome === "failed") {
-                sendError(res, 502, "internal.config_refresh_failed", "the config refresh tick failed (source unreachable / unreadable / apply error) — the live config is unchanged; see the worker's sema_registry_refresh_failed log line for the cause");
+                sendError(res, 502, "internal.config_refresh_failed", "the config refresh tick failed (source unreachable / unreadable / apply error) — the live config is unchanged; see the worker's web_admin_refresh_failed log line for the cause");
                 return;
             }
             if (outcome === "not-wired") {

package/dist/http/routes/admin-drain.d.ts

@@ -6,7 +6,7 @@
  * 进入排空经 `drainState.enter`(收尾链装的唯一入口)。
  *  · 门序 = operator 面的既有口径(`routes/retention-ops.ts` 逐字):身份 → 授权 → 验型;billable=false,**刻意不吃排空 503**
  *    (排空中的重放必须能拿到 `already_draining` 回执,吃了就自锁)。
- *  · 判序:体坏 ⇒ 400 `request.field_invalid`(零状态变化)→ 没有收尾链(嵌入宿主 / 测试夹具)⇒ 501 `capability.drain_state_required`
+ *  · 判序:体坏(含动作号不是标识符形 —— settings-schema 11 `DRAIN_ACTION_ID`)⇒ 400 `request.field_invalid`(零状态变化)→ 没有收尾链(嵌入宿主 / 测试夹具)⇒ 501 `capability.drain_state_required`
  *    → 身份不符 ⇒ 409 `conflict.fleet_identity`(零状态变化;拒句点名不符的字段,不回显值)→ 入口:已在排空 / 硬停已在进行 ⇒ 200 回执
  *    (这一发的期限不会被采用);这一发会进入排空而 `deadlineAt` 离进入那一拍超过 `FLEET_LEASE_OUTAGE_MAX_MS`(`config.fleetLeaseOutageMaxMs`,
  *    本口随入参声明的准入上界,`fleet/drain-entry.ts` 规则 2)⇒ 入口答拒、本口 400 `request.field_invalid`(零状态变化;拒句点名字段、上界的