@sema-agent/server 7.123.0 → 7.124.1

package/dist/hosted-posture.d.ts

@@ -30,11 +30,11 @@
  * (`PRINCIPAL_JWT_PUBKEYS/ISS/AUD` 任一在场;`AUTH_BRIDGE_ISSUER` 显式在场),[ref] ① 裁 (a) 撤回:
  *  · **真假阳**:本机自起引擎、配了 principal-JWT / auth-bridge 签发方的单用户部署(web-admin 8090 真案)
  *    在 7.98.0 被判托管而拒启,只能滚回 7.93.5;
- *  · **与回退 issuer 不同判**:auth-bridge 的 `?? configCenter.baseUrl` 回退(`boot/stage-09-leader.ts`)
+ *  · **与回退 issuer 不同判**:auth-bridge 的 `?? webAdmin.baseUrl` 回退(`boot/stage-09-leader.ts`)
  *    从来不算证据,而回退桥的引擎同样把单用户授予开给每一个验签通过的 registry JWT 调用者 —— 同一个
  *    租户轴事实,「显式写了 issuer」与「从 center 推出 issuer」是同一形。裁定后两者同判。
  * ⇒ 签发方配置是**身份验签轴**(谁的 JWT 算数),不是租户轴(这台机器有几个主人)。「受控于控制面」
- * (`SEMA_REGISTRY_*`,含 worker 名)同理是 fleet 管理轴,本判据同样不读。
+ * (`SEMA_WEB_ADMIN_*`,含 worker 名)同理是 fleet 管理轴,本判据同样不读。
  *
  * 随两臂一起删掉的(按类删干净,规则集变小):S-564 腿①「托管 ∧ 未开 `REQUIRE_PRINCIPAL` ⇒ 拒启」
  * (判据只剩读 `requirePrincipal` 的那一臂之后,那条合取恒假 ⇒ 结构上不可达)及其跨键不变量行;
@@ -44,9 +44,9 @@
  *
  * 假阳 = 一台单用户部署被收走一个它一直在用的能力(7.98.0 时还会被拒启)。词表不收任何推断臂:
  *  · ❌ `PRINCIPAL_JWT_*` / `AUTH_BRIDGE_ISSUER` 在场 —— 见上一段([ref] ① 撤回;加回来 = 翻案,要新裁定)。
- *  · ❌ `configCenter`(含 `worker` 名)/ auth-bridge 的 center 回退 —— fleet 管理轴。初版(车LT)收过
+ *  · ❌ `webAdmin`(含 `worker` 名)/ auth-bridge 的 center 回退 —— fleet 管理轴。初版(车LT)收过
  *    `managed-worker` 臂,实测两个反例后撤回:`run-local.ts` 强设 `REQUIRE_PRINCIPAL=false` 的本机 CLI 在一个
- *    带 registry 键的共享 `.env` 上拒启;本仓自己的 `test/config-coverage-blocks.test.ts` configCenter 两格当场红。
+ *    带 registry 键的共享 `.env` 上拒启;本仓自己的 `test/config-coverage-blocks.test.ts` webAdmin 两格当场红。
  *  · ❌ `operatorPrincipals` 非空 —— **真假阳**:`IMAGE_BAKES_ENABLED` 那条既有不变量
  *    (`config-invariants.ts` 的 `bake-operator-principals`)**强制**开烤门的部署把它填非空。
  *  · ❌ `SERVICE_AUTH_TOKENS` 条目数 —— 一台机器上同时给 cli 与 web-admin 发一只令牌是单用户常态。

package/dist/http/admission.js

@@ -1,5 +1,5 @@
 import { APPROVAL_REACH, MCP_IMAGE_MAX_BASE64, isApprovalReach, isPermissionMode, isThinkingLevel, expandTiers } from "@sema-agent/core";
-import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
+import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError } from "../security.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
@@ -15,6 +15,7 @@ import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { skillCarriesRetiredManifest } from "./retired-skill-manifest.js";
 import { resolveDevicePlacementIntent } from "./device-placement.js";
 import { sendError, httpErrorCode } from "./send.js";
+import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 const APPROVAL_REACH_WORDS = APPROVAL_REACH.map((word) => JSON.stringify(word)).join(" / ");
 export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
 export const MAX_SYSTEM_PROMPT_CHARS = 16_384;
@@ -51,8 +52,7 @@ export const SKILL_MANIFEST_RETIRED = "skill.manifest was retired in core 7.41.0
 const MAX_IMAGES_PER_REQUEST = 20;
 const MAX_IMAGE_BASE64_BYTES = MCP_IMAGE_MAX_BASE64;
 function mentionableNames(config, catalog) {
-    const allowlist = config.atModelAllowlist ?? [];
-    return Object.keys(catalog).filter((n) => n !== "default" && isModelAllowlisted(n, catalog, allowlist, config.modelRefusals));
+    return Object.keys(catalog).filter((n) => n !== "default" && isAtMentionable(n, catalog, config.atMention, config.modelRefusals));
 }
 function refuseUnavailableModel(res, config, field, ref) {
     const hit = refusedCatalogEntry(ref, config.modelRefusals);
@@ -377,7 +377,7 @@ export function createAdmission(ctx) {
             const wantsSelfOrchestration = body.selfOrchestration === true
                 || parseTaskSettings(body.settings).settings?.ultracode === true;
             if (!admission.available && wantsSelfOrchestration) {
-                sendError(res, 501, "capability.self_orchestration_required", "self-orchestration is enabled on this worker (SELF_ORCHESTRATION_ENABLED) but it is multi-tenant (REQUIRE_PRINCIPAL) and wires NO per-principal entitlement source, so the engine's allowWorkflows gate — which is tighten-only, meaning an absent resolver leaves it UNGATED — is fail-closed for every principal: no request can ever get the workflow engine here (GET /v1/capabilities reports workflows:false with workflowsGate.denial \"entitlement_resolver_absent\"). Wire a config center (SEMA_REGISTRY_URL + token, not dry-run) to gate it per principal, or set SELF_ORCHESTRATION_ENABLED=false — the honest posture for a worker that cannot grant it. To submit this task without the workflow engine, drop selfOrchestration / settings.ultracode; ultracode's other half (the max thinking tier) is available as reasoningEffort: \"max\"");
+                sendError(res, 501, "capability.self_orchestration_required", `self-orchestration is enabled on this worker (SELF_ORCHESTRATION_ENABLED) but it is multi-tenant (REQUIRE_PRINCIPAL) and wires NO per-principal entitlement source, so the engine's allowWorkflows gate — which is tighten-only, meaning an absent resolver leaves it UNGATED — is fail-closed for every principal: no request can ever get the workflow engine here (GET /v1/capabilities reports workflows:false with workflowsGate.denial "entitlement_resolver_absent"). Wire a web-admin (${WEB_ADMIN_ENV.url} + token, not dry-run) to gate it per principal, or set SELF_ORCHESTRATION_ENABLED=false — the honest posture for a worker that cannot grant it. To submit this task without the workflow engine, drop selfOrchestration / settings.ultracode; ultracode's other half (the max thinking tier) is available as reasoningEffort: "max"`);
                 return null;
             }
         }

package/dist/http/checkpoint-ctx.d.ts

@@ -77,6 +77,7 @@ export declare function buildCheckpointCtx(fields: {
     body: TaskRequestBody;
     memoryScope?: string | undefined;
     unattendedLeg?: true;
+    writerVersion: string;
 }): CheckpointCtx;
 /**
  * 模式词的**第二个写者** —— `plan_review` 的批准 / 编辑把这条 run 的体词从 `plan` 写成批准的档(`resume-legs.ts` `drivePlanReview`,调用点只有那一处;
@@ -130,10 +131,14 @@ export declare function allowListReadingRefusal(era: AllowListReadingEra): {
         retriable: true;
     };
 };
-/** 一条停驻行的持久化体在本版上**不能**重放时,是哪一条规则拒的(闭集;加一条 ⇒ {@link storedBodyReplayAnswer} 的 switch 编译红)。 */
+/**
+ * 一条停驻行的持久化体在本版上**不能**重放时,是哪一条规则拒的(闭集;加一条 ⇒ {@link storedBodyReplayAnswer} 的 switch 编译红)。
+ * 答 `checkpoint.unsupported_version` 的两臂随带这一行的写者版本(续跑上下文的 `writerVersion`,缺席 = 本版之前写下的行)—— 那一码的两版本键由它铸({@link buildCheckpointVersionKeys})。
+ */
 export type StoredBodyReplayRefusal = {
     readonly kind: "allow_list_reading";
     readonly era: AllowListReadingEra;
+    readonly writerVersion?: string;
 } | {
     readonly kind: "skill_deny_inert";
     readonly entry: SkillDenyInertEntry;
@@ -141,7 +146,18 @@ export type StoredBodyReplayRefusal = {
     readonly kind: "permission_mode_reading";
     readonly stored: PermissionMode | undefined;
     readonly floor: PermissionMode;
+    readonly writerVersion?: string;
 };
+/**
+ * 🔴 **`checkpoint.unsupported_version` 的 409 体上两个版本键 —— 唯一铸法;本码每一个铸点同一条律**(core 原码镜像 = `resume-legs.ts` 的 catch 臂;本服务自铸的两只拒
+ * = {@link storedBodyReplayAnswer} 的 allow 读法 / 模式词读法两臂):续跑上下文带写者版本 ⇒ `{ writerVersion, readerVersion }`;不带(本版之前写下的行)⇒ `{}`,不编值。
+ * 两值相等也照带 —— 那是事实(不是版本问题,出路照码与报文);写者比读者新才是「回到写它的那一版去决」。`readerVersion` 由调用方传本进程的服务版本
+ * (本模块零值依赖,不自取)。纯数据。
+ */
+export declare function buildCheckpointVersionKeys(writerVersion: string | undefined, readerVersion: string): {
+    writerVersion: string;
+    readerVersion: string;
+} | Record<string, never>;
 /** 续跑家族交回的拒答复形(`{ status, body }`,由 `sendResumeOutcome` / 各路由发送;`body` 至少 `error` + `errorCode`)。 */
 export interface ResumeRefusalAnswer {
     readonly status: number;
@@ -169,8 +185,9 @@ export declare function storedBodyReplayLogFields(refusal: StoredBodyReplayRefus
     note: string;
 };
 /**
- * `stored-body-replay.ts` `storedBodyReplayRefusal` 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};技能拒侧 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
+ * `stored-body-replay.ts` `storedBodyReplayRefusal` 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};模式词记号 ⇒ {@link permissionModeReadingRefusal};
+ * 这两只答 `checkpoint.unsupported_version`,体按那一码的键律补两版本键,`readerVersion` = 调用方传的本进程服务版本;技能拒侧 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
  * `request.field_invalid` 同码同句 —— 体上只有这一个问题时;存量体同时还踩中 `resolveSpec` 更早的拒〔三桶超帽 / 托管姿态〕时,提交侧答更早那条、续跑侧答本句,两边都是拒,指路不同)。
  */
-export declare function storedBodyReplayAnswer(refusal: StoredBodyReplayRefusal): ResumeRefusalAnswer;
+export declare function storedBodyReplayAnswer(refusal: StoredBodyReplayRefusal, readerVersion: string): ResumeRefusalAnswer;
 //# sourceMappingURL=checkpoint-ctx.d.ts.map

package/dist/http/checkpoint-ctx.js

@@ -14,6 +14,7 @@ export function bodyCarriesAllowList(body) {
 export function buildCheckpointCtx(fields) {
     return {
         body: fields.body,
+        writerVersion: fields.writerVersion,
         ...(fields.memoryScope !== undefined ? { memoryScope: fields.memoryScope } : {}),
         ...(fields.unattendedLeg === true ? { unattendedLeg: true } : {}),
         ...(bodyCarriesAllowList(fields.body) ? { permissionsAllowReading: "allow_layer" } : {}),
@@ -73,6 +74,9 @@ export function allowListReadingRefusal(era) {
         }
     }
 }
+export function buildCheckpointVersionKeys(writerVersion, readerVersion) {
+    return writerVersion !== undefined ? { writerVersion, readerVersion } : {};
+}
 export function resumeBlockedByPolicyAnswer(message, blockedBy, extra) {
     return {
         status: 409,
@@ -93,14 +97,18 @@ export function storedBodyReplayLogFields(refusal) {
         }
     }
 }
-export function storedBodyReplayAnswer(refusal) {
+export function storedBodyReplayAnswer(refusal, readerVersion) {
     switch (refusal.kind) {
-        case "allow_list_reading":
-            return allowListReadingRefusal(refusal.era);
+        case "allow_list_reading": {
+            const answer = allowListReadingRefusal(refusal.era);
+            return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };
+        }
         case "skill_deny_inert":
             return resumeBlockedByPolicyAnswer(refusal.entry.message, "request.field_invalid");
-        case "permission_mode_reading":
-            return permissionModeReadingRefusal();
+        case "permission_mode_reading": {
+            const answer = permissionModeReadingRefusal();
+            return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };
+        }
         default: {
             const unhandled = refusal;
             throw new Error(`stored-body replay refusal ${JSON.stringify(unhandled)} has no answer`);

package/dist/http/dispatch.js

@@ -208,11 +208,11 @@ export function createDispatch(ctx) {
             res.end(deps.metrics.render());
             return;
         }
-        if (deps.registryJwtVerifier) {
+        if (deps.webAdminJwtVerifier) {
             const authz = req.headers.authorization ?? "";
             const rawBearer = /^Bearer\s/i.test(authz) ? authz.replace(/^Bearer\s+/i, "") : "";
             if (rawBearer && looksLikeJwt(rawBearer)) {
-                const v = await deps.registryJwtVerifier.verify(rawBearer);
+                const v = await deps.webAdminJwtVerifier.verify(rawBearer);
                 if (v.ok) {
                     setSsoPrincipal(req, v.identity.principal);
                     req.headers[deps.config.principalHeader.toLowerCase()] = v.identity.principal;

package/dist/http/durable-run-leg.js

@@ -9,6 +9,7 @@ import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
 import { buildCheckpointCtx } from "./checkpoint-ctx.js";
+import { serviceVersion } from "../service-version.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const { deps } = ctx;
     const { inflightRuns, preemptableRuns, steerableRuns } = ctx.registry;
@@ -32,7 +33,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
         return { status: placementReject.status, body: devicePlacementErrorBody(placementReject) };
     commitSessionInheritEnv(deps, args.prepared.spec.sessionId, args.prepared.body);
     if (deps.checkpointStore) {
-        await deps.checkpointStore.putCtx(sessionId, buildCheckpointCtx({ body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope }));
+        await deps.checkpointStore.putCtx(sessionId, buildCheckpointCtx({ body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope, writerVersion: serviceVersion() }));
     }
     const anchorOwner = args.prepared.auth?.principal ?? null;
     const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);

package/dist/http/health-self-report.d.ts

@@ -7,12 +7,12 @@
  *  · `auth.required` = 全局凭据门的武装谓词(`hasServiceAuth`,由 `dispatch.ts` 交进来 —— 门与本位读同一次求值的同一只函数);
  *  · `auth.kinds` = {@link IDENTITY_SOURCES}(`verifiedIdentitySource` 的回值闭集)里,这台部署的装配**能**回的那几个词:
  *    `service_token` ⇐ 全局门武装(`systemFor` 只在配了 service token 时回得出值)· `sso` ⇐ 鉴权桥装了(入口预认证只在
- *    `registryJwtVerifier` 在场时挂身份)· `direct_door_jwt` ⇐ 直连门开着(`verifiedIdentitySource` 那一臂的第一个合取项);
+ *    `webAdminJwtVerifier` 在场时挂身份)· `direct_door_jwt` ⇐ 直连门开着(`verifiedIdentitySource` 那一臂的第一个合取项);
  *  · `auth.identityAttach` = kinds 里有没有**带调用方身份**的一类({@link carriesCallerIdentity},穷举):`service_token` 认的是系统
  *    (`systemFor` 回系统名或 null),不是人;
  *  · `operator` = 能力事实 `operatorLane`(operator 面族的 501 门读的同一只;名单本身不上 wire);
  *  · `center.issuer` = 鉴权桥 issuer 的唯一取值 `authBridgeIssuerOf`(装配 `boot/stage-09-leader.ts` 与 caps `centerWiring.issuer` 同读);
- *  · `center.webBaseUrl` = 运维旋钮 `SEMA_REGISTRY_WEB_URL`(`config.configCenter.webBaseUrl`,接了中心才挂;起服时已判成固定基址);
+ *  · `center.webBaseUrl` = 运维旋钮 `SEMA_WEB_ADMIN_WEB_URL`(`config.webAdmin.webBaseUrl`,接了中心才挂;起服时已判成固定基址);
  *  · `center.sessionsVisible` = 中心的 web 面能不能列出本引擎的会话 —— 四件接线事实全在才可能:中心车道配齐(`centerLaneConfigured`,
  *    租约 / 用量 / 公告同一只谓词)∧ 公告地址在(配置席 `fleetAdvertiseAddress`:web 面只拨中心登记过的实例地址)∧ 鉴权桥在(web 面带的是
  *    中心铸的中继令牌,不带 service token)∧ 会话枚举面在(事实 `sessionList`,web 面中继 `GET /v1/sessions`);缺任一 ⇒ `false`。
@@ -22,7 +22,7 @@
  * ## 无鉴权面
  * `/health` 排在凭据门之前、缺省全网卡监听:本模块只出闭集词、布尔与运维要发布的 URL。两只 URL 值都过 display-safe 律
  * (`buildDisplaySafeUrl`,所有展示面 URL 的同一个铸点):userinfo 落地、query 值成记号、尾斜杠折掉 —— issuer 的来源
- * (`AUTH_BRIDGE_ISSUER` / `SEMA_REGISTRY_URL`)起服时不判凭据形,这一道是它上无鉴权面的唯一闸。令牌、名单、worker 名、凭证一概不上。
+ * (`AUTH_BRIDGE_ISSUER` / `SEMA_WEB_ADMIN_URL`)起服时不判凭据形,这一道是它上无鉴权面的唯一闸。令牌、名单、worker 名、凭证一概不上。
  * 同一张面上本模块之外还有一个**调用方自取**的串(如实,7.123.0 起;`model` / `dataRoot` / `version` 等其余非闭集的名是部署自己的事实,不是调用方放进来的):排空中的动作号 `engineSignal.draining.actionId`(`fleet/engine-signal.ts` 铸,契约 §0.4)——
  * 引擎自起的排空是引擎的闭集词,经排空口(operator-only)进的排空是调用方自取的幂等键**原样**(契约包今天只要求非空串,推荐 `manual:<uuid>`),
  * 所以那一键不是闭集词:调用方不要往里放秘密或人名。
@@ -59,5 +59,5 @@ export interface HealthSelfReport {
  * 三键的**唯一铸点**(`build*`:纯数据)。`credentialGateArmed` 由 `dispatch.ts` 交进来 —— 它是全局凭据门自己的那一句
  * (`hasServiceAuth`),本模块不另求一遍(另求就是第二个写者)。
  */
-export declare function buildHealthSelfReport(deps: Pick<FlatServiceDeps, "config" | "registryJwtVerifier" | "sessionStorage" | "runStore">, credentialGateArmed: boolean): HealthSelfReport;
+export declare function buildHealthSelfReport(deps: Pick<FlatServiceDeps, "config" | "webAdminJwtVerifier" | "sessionStorage" | "runStore">, credentialGateArmed: boolean): HealthSelfReport;
 //# sourceMappingURL=health-self-report.d.ts.map

package/dist/http/health-self-report.js

@@ -1,7 +1,7 @@
 import { IDENTITY_SOURCES } from "./principal-gate.js";
 import { operatorLane, sessionList } from "../capability-facts.js";
 import { authBridgeIssuerOf } from "../auth-bridge.js";
-import { centerLaneConfigured } from "../config-center/center-request.js";
+import { centerLaneConfigured } from "../web-admin-client/center-request.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export const IDENTITY_ATTACH_WORDS = ["available", "unavailable"];
 export const OPERATOR_PRESENCE_WORDS = ["present", "absent"];
@@ -35,10 +35,10 @@ function identitySourceWired(kind, a) {
 }
 export function buildHealthSelfReport(deps, credentialGateArmed) {
     const { config } = deps;
-    const bridgeWired = deps.registryJwtVerifier !== undefined;
+    const bridgeWired = deps.webAdminJwtVerifier !== undefined;
     const kinds = IDENTITY_SOURCES.filter((k) => identitySourceWired(k, { credentialGateArmed, bridgeWired, directDoorActive: config.directDoorActive }));
     const issuer = authBridgeIssuerOf(config)?.issuer;
-    const webBaseUrl = config.configCenter?.webBaseUrl;
+    const webBaseUrl = config.webAdmin?.webBaseUrl;
     const sessionsVisible = centerLaneConfigured(config) && config.fleetAdvertiseAddress !== undefined && bridgeWired && sessionList(deps).available ? (config.requirePrincipal ? true : "unknown") : false;
     return {
         auth: { required: credentialGateArmed, kinds, identityAttach: kinds.some(carriesCallerIdentity) ? "available" : "unavailable" },

package/dist/http/idempotency.d.ts

@@ -14,7 +14,7 @@ import type { WiringManifestReceipt } from "./wire-types.js";
  * map grows past a threshold (no O(n) scan on the hot path). Single-threaded event-loop semantics: each HTTP
  * request is its own task, so there is no get→set race within a tick.
  *
- * (Caller context: the sema-registry review gateway mints/echoes the Idempotency-Key and routes a given key to
+ * (Caller context: the web-admin review gateway mints/echoes the Idempotency-Key and routes a given key to
  * the same worker, so this PER-POD cache is the worker-side backstop against a retried submission re-running —
  * and re-billing. Cross-pod / cross-restart exactly-once needs store-backing; the durable async /v1/runs path
  * is the alternative for long tasks.)

package/dist/http/resume-legs.d.ts

@@ -23,10 +23,11 @@ import type { RunRegistry, RouteHelpers, RouteLegs } from "./route-ctx.js";
 import type { createRequestGuards } from "./request-guards.js";
 import type { FlatServiceDeps } from "./server.js";
 /**
- * {@link CHECKPOINT_ERROR_DISPOSITION} 的读口(纯函数,resume 腿的 catch 臂与钉共用)。运行期遇到表外的码(装树 core 比本二进制多一个码的版本偏斜 ——
- * 型面上拼不出来)⇒ `"terminal"`:与 `by_reason` 认不得的词同一条 fail-closed 方向(不宽容默认成可重试),也与修前手列串的缺省逐字相同。
+ * 🔴 **一次 `CheckpointError` 拒的处置 —— 唯一读口**:{@link CHECKPOINT_ERROR_DISPOSITION} 的读法(doctrine 在那张表头)。resume 腿的 catch 臂只调它一次,
+ * 行的落点与 wire 的 `retriable` 都读这一个结果。纯函数,钉直接调。运行期遇到表外的码(装树 core 比本二进制多一个码的版本偏斜 —— 型面上拼不出来)
+ * ⇒ `"terminal"`:与 `by_reason` 认不得的词同一条 fail-closed 方向(不宽容默认成可重试),也与修前手列串的缺省逐字相同。
  */
-export declare function checkpointErrorDisposition(e: CheckpointError): "cancelled" | "retriable" | "terminal";
+export declare function resumeRefusalDisposition(e: CheckpointError): "cancelled" | "retriable" | "terminal";
 export declare function createResumeLegs(ctx: {
     deps: FlatServiceDeps;
     runnerFor: FlatServiceDeps["runnerFor"];

package/dist/http/resume-legs.js

@@ -17,12 +17,15 @@ import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTermi
 import { defaultSubagentTailBus } from "../fleet/subagent-tail-bus.js";
 import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerDurablyRecordable } from "../tool-approval.js";
 import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
+import { APPROVAL_ENDING_CAUSES } from "../approval-deny-reasons.js";
+import { serviceVersion } from "../service-version.js";
 import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { withPrincipal } from "../observability/principal-context.js";
 import { withModelReachScope } from "../model-reach-scope.js";
 import { createInstructionSelectionLeg } from "../instruction-selection.js";
 import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
+import { buildRunObjectivePreview } from "../user-authored-text.js";
 import { createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../trace/engine-notice-wire.js";
 import { reasoningDeltaBytes, reasoningSegmentEventId } from "../trace/model-segment.js";
@@ -43,7 +46,7 @@ import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
 import { deploymentListAsks } from "../approval.js";
 import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
-import { resumeBlockedByPolicyAnswer, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
+import { buildCheckpointVersionKeys, resumeBlockedByPolicyAnswer, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
 import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 import { httpErrorCode } from "./send.js";
 function isCheckpointReopenedFailure(r) {
@@ -108,7 +111,7 @@ const CHECKPOINT_ERROR_DISPOSITION = {
     "steering.invalid_content": "terminal",
     "steering.queue_full": "terminal",
 };
-export function checkpointErrorDisposition(e) {
+export function resumeRefusalDisposition(e) {
     const word = Object.hasOwn(CHECKPOINT_ERROR_DISPOSITION, e.code) ? CHECKPOINT_ERROR_DISPOSITION[e.code] : undefined;
     switch (word) {
         case "cancelled":
@@ -135,14 +138,26 @@ const CHECKPOINT_ERROR_FIELD_ROLE = {
     taskConfig: "config",
     inheritedGate: "config",
 };
-const ROLE_MINTS_RESUME_OUTCOME_INVALID = {
-    binding: false,
-    answer: false,
-    outcome_cell: true,
-    regrant: true,
-    config: false,
+const FIELD_ROLE_CAUSE = {
+    binding: APPROVAL_ENDING_CAUSES.BINDING_CHANGED,
+    answer: APPROVAL_ENDING_CAUSES.ANSWER_INVALID,
+    outcome_cell: APPROVAL_ENDING_CAUSES.OUTCOME_CELL_INVALID,
+    regrant: APPROVAL_ENDING_CAUSES.OUTCOME_CELL_INVALID,
+    config: undefined,
 };
-const NON_BINDING_INVALID_OUTCOME_FIELDS = new Set(Object.keys(CHECKPOINT_ERROR_FIELD_ROLE).filter((f) => ROLE_MINTS_RESUME_OUTCOME_INVALID[CHECKPOINT_ERROR_FIELD_ROLE[f]]));
+const WIRE_CODE_OF_DECISION_REFUSAL = {
+    [APPROVAL_ENDING_CAUSES.BINDING_CHANGED]: "approval_binding_mismatch",
+    [APPROVAL_ENDING_CAUSES.ANSWER_INVALID]: "resume_outcome_invalid",
+    [APPROVAL_ENDING_CAUSES.OUTCOME_CELL_INVALID]: "resume_outcome_invalid",
+};
+const UNCLASSIFIED_INVALID_OUTCOME_CODE = WIRE_CODE_OF_DECISION_REFUSAL[APPROVAL_ENDING_CAUSES.BINDING_CHANGED];
+function decisionRefusalCauseOf(e, gate) {
+    if (gate !== "policy_ask")
+        return APPROVAL_ENDING_CAUSES.OUTCOME_CELL_INVALID;
+    const field = e.detail?.field;
+    const role = field !== undefined && Object.hasOwn(CHECKPOINT_ERROR_FIELD_ROLE, field) ? CHECKPOINT_ERROR_FIELD_ROLE[field] : undefined;
+    return role === undefined ? undefined : FIELD_ROLE_CAUSE[role];
+}
 function notResumableAnswer() {
     return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
 }
@@ -420,7 +435,7 @@ export function createResumeLegs(ctx) {
     };
     const refuseStoredBodyReplay = (sessionId, refusal) => {
         deps.logger?.warn?.("resume_refused_stored_body", { sessionId, ...storedBodyReplayLogFields(refusal) });
-        return storedBodyReplayAnswer(refusal);
+        return storedBodyReplayAnswer(refusal, serviceVersion());
     };
     const resolveResumeSpecOrBlocked = async (ctx, req, auth) => {
         const replay = storedBodyReplayRefusal(ctx, deps.config.autonomy);
@@ -460,7 +475,7 @@ export function createResumeLegs(ctx) {
     async function driveResumeLeg(args, onAccepted) {
         const resumeLegStartedAt = Date.now();
         const { runner: legRunner, token, sessionId, principal, fleetScope, taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx } = args;
-        const commitResumeCtx = () => deps.checkpointStore.putCtx(resumeCtx.sessionId, resumeCtx.ctx).catch((e) => {
+        const commitResumeCtx = () => deps.checkpointStore.putCtx(resumeCtx.sessionId, { ...resumeCtx.ctx, writerVersion: serviceVersion() }).catch((e) => {
             deps.metrics?.inc("resume_ctx_not_persisted_total");
             deps.logger?.warn?.("resume_ctx_not_persisted", { sessionId: resumeCtx.sessionId, gate: outcome.gate, error: errorText(e), note: "this continuation runs with the body it was given; the durable rebuild input still holds the PREVIOUS body, so the NEXT continuation of this session rebuilds from that one (never wider than this leg's)" });
         });
@@ -494,7 +509,7 @@ export function createResumeLegs(ctx) {
             const freshId = uuidv7();
             const created = await deps.runStore.createRun(freshId, sessionId, principal ?? null, deps.instanceId ?? "default", {
                 source: args.mintFreshRun.source,
-                objectivePreview: resumeObjective ? redactSecrets(resumeObjective).slice(0, 120) : null,
+                objectivePreview: buildRunObjectivePreview(resumeObjective ?? ""),
             });
             if (!created.ok) {
                 return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
@@ -969,7 +984,8 @@ export function createResumeLegs(ctx) {
         }
         catch (e) {
             if (e instanceof CheckpointError) {
-                const disposition = checkpointErrorDisposition(e);
+                const refusalCause = e.code === "checkpoint.invalid_outcome" ? decisionRefusalCauseOf(e, outcome.gate) : undefined;
+                const disposition = resumeRefusalDisposition(e);
                 if (disposition === "cancelled") {
                     const cs2 = deps.checkpointStore;
                     if (cs2) {
@@ -1020,16 +1036,13 @@ export function createResumeLegs(ctx) {
                     body: {
                         ...(taskId !== undefined ? { taskId } : {}),
                         error: e.message,
-                        errorCode: e.code === "checkpoint.invalid_outcome"
-                            ? (outcome.gate === "policy_ask" && !NON_BINDING_INVALID_OUTCOME_FIELDS.has(String(e.detail?.field ?? ""))
-                                ? "approval_binding_mismatch"
-                                : "resume_outcome_invalid")
-                            : e.code,
+                        errorCode: e.code === "checkpoint.invalid_outcome" ? (refusalCause !== undefined ? WIRE_CODE_OF_DECISION_REFUSAL[refusalCause] : UNCLASSIFIED_INVALID_OUTCOME_CODE) : e.code,
                         ...(e.detail?.field ? { field: e.detail.field } : {}),
                         ...((e.code === "resume.usage_window_exhausted" || e.code === "resume.preflight_rejected") && typeof e.detail?.retryAfterMs === "number" && Number.isFinite(e.detail.retryAfterMs) && e.detail.retryAfterMs > 0
                             ? { retryAfterSec: Math.max(1, Math.ceil(e.detail.retryAfterMs / 1000)) }
                             : {}),
                         ...(retriable ? { retriable: true } : {}),
+                        ...(e.code === "checkpoint.unsupported_version" ? buildCheckpointVersionKeys(resumeCtx.ctx.writerVersion, serviceVersion()) : {}),
                     },
                 };
             }

package/dist/http/route-ctx.d.ts

@@ -176,6 +176,14 @@ export interface CheckpointCtx {
      * 不改词的续跑腿写回传原 ctx ⇒ 记号随行。
      */
     permissionModeReading?: import("./checkpoint-ctx.js").PermissionModeReading;
+    /**
+     * 🔴 S-1365 —— **写这份上下文的服务版本**(`package.json` 的 `version`),**服务端写、不来自请求体**(与 {@link unattendedLeg} 同为 `body` 的兄弟键)。
+     * 写点两个:`buildCheckpointCtx`(每一次新的持久化写)与续跑腿的写回({@link DriveResumeArgs.resumeCtx} 的唯一写点,CAS 赢点盖本进程的版本 —— 接下来写下一张停车行的就是它)。
+     * 读者:`checkpoint.unsupported_version` 的 409 体 —— 原样带出 `writerVersion`,与本引擎的 `readerVersion` 并列(运维据此知道该回哪一版去决);
+     * 两键唯一铸法 `checkpoint-ctx.ts` `buildCheckpointVersionKeys`,本码每个铸点同调。它是**上下文**,不是拒因:成因与码都不读它。
+     * 缺席 = 本版之前写下的行(不回填):那一码的体不带两键,如实不猜。不是一次性迁移 —— 这一格是常设的事实位,没有删除条件。
+     */
+    writerVersion?: string;
 }
 /** B4①(命名化):`driveResumeIntoRunLog` 的入参形(resume 家族共用)——原为 9 成员内联匿名对象。 */
 export interface DriveResumeArgs {

package/dist/http/routes/admin-config-refresh.d.ts

@@ -7,7 +7,7 @@
  * 身份 → 授权 →(本口无 body,无验型步)。
  *
  * 🔴 语义 = **触发一次既有的 refresh 拍**,不是「再实现一遍拉取」:实现面是
- * `configCenter.refreshNow()`,它与 60s cadence 共用同一只 join 形拍(在飞则 join,绝不并发双拍)。
+ * `webAdmin.refreshNow()`,它与 60s cadence 共用同一只 join 形拍(在飞则 join,绝不并发双拍)。
  * 回执里的两个世代号取自**同一本**世代账(`/health` 的三键同源)—— 两面各算一次迟早会各说各话。
  *
  * 🔴 没有配置管道(纯 env 形)⇒ 诚实 409 指路,**不吞成 200**:一个「triggered:true 但什么都没发生」的

package/dist/http/routes/admin-config-refresh.js

@@ -24,7 +24,7 @@ export async function handleAdminConfigRefresh(req, res, match, ctx) {
             const trigger = deps.configRefreshNow;
             const outcome = trigger ? await trigger() : "not-wired";
             if (outcome === "failed") {
-                sendError(res, 502, "internal.config_refresh_failed", "the config refresh tick failed (source unreachable / unreadable / apply error) — the live config is unchanged; see the worker's sema_registry_refresh_failed log line for the cause");
+                sendError(res, 502, "internal.config_refresh_failed", "the config refresh tick failed (source unreachable / unreadable / apply error) — the live config is unchanged; see the worker's web_admin_refresh_failed log line for the cause");
                 return;
             }
             if (outcome === "not-wired") {

package/dist/http/routes/admin-drain.d.ts

@@ -6,7 +6,7 @@
  * 进入排空经 `drainState.enter`(收尾链装的唯一入口)。
  *  · 门序 = operator 面的既有口径(`routes/retention-ops.ts` 逐字):身份 → 授权 → 验型;billable=false,**刻意不吃排空 503**
  *    (排空中的重放必须能拿到 `already_draining` 回执,吃了就自锁)。
- *  · 判序:体坏 ⇒ 400 `request.field_invalid`(零状态变化)→ 没有收尾链(嵌入宿主 / 测试夹具)⇒ 501 `capability.drain_state_required`
+ *  · 判序:体坏(含动作号不是标识符形 —— settings-schema 11 `DRAIN_ACTION_ID`)⇒ 400 `request.field_invalid`(零状态变化)→ 没有收尾链(嵌入宿主 / 测试夹具)⇒ 501 `capability.drain_state_required`
  *    → 身份不符 ⇒ 409 `conflict.fleet_identity`(零状态变化;拒句点名不符的字段,不回显值)→ 入口:已在排空 / 硬停已在进行 ⇒ 200 回执
  *    (这一发的期限不会被采用);这一发会进入排空而 `deadlineAt` 离进入那一拍超过 `FLEET_LEASE_OUTAGE_MAX_MS`(`config.fleetLeaseOutageMaxMs`,
  *    本口随入参声明的准入上界,`fleet/drain-entry.ts` 规则 2)⇒ 入口答拒、本口 400 `request.field_invalid`(零状态变化;拒句点名字段、上界的

package/dist/http/routes/admin-drain.js

@@ -1,10 +1,11 @@
-import { readDrainRequest } from "@sema-agent/settings-schema/fleet";
+import { DRAIN_ACTION_ID, readDrainRequest } from "@sema-agent/settings-schema/fleet";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import * as facts from "../../capability-facts.js";
 import { fleetScopeOf } from "../../config-types.js";
 import { drainIdentityMismatches } from "../../fleet/drain-entry.js";
 import { assertNever } from "../route-ctx.js";
+import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 export const ADMIN_DRAIN_PATH = "/v1/admin/drain";
 const OPERATOR_ONLY_MESSAGE = "drain declaration is operator-only: the caller principal is not in OPERATOR_PRINCIPALS";
 export async function handleAdminDrain(req, res, match, ctx) {
@@ -26,7 +27,7 @@ export async function handleAdminDrain(req, res, match, ctx) {
             }
             const request = readDrainRequest(await ctx.helpers.readJson(req));
             if (request === undefined) {
-                sendError(res, 400, "request.field_invalid", "the drain request must be { actionId, worker, deadlineAt, scope?, expectedGeneration?, instanceId?, term? }: actionId a non-empty idempotency key, worker this engine's worker name, deadlineAt epoch milliseconds, expectedGeneration a canonical decimal string (\"7\") — nothing was changed");
+                sendError(res, 400, "request.field_invalid", `the drain request must be { actionId, worker, deadlineAt, scope?, expectedGeneration?, instanceId?, term? }: actionId an idempotency key in identifier form (${DRAIN_ACTION_ID.source} — it is republished on GET /health, so no spaces or free text), worker this engine's worker name, deadlineAt epoch milliseconds, expectedGeneration a canonical decimal string ("7") — nothing was changed`);
                 return;
             }
             const enter = deps.drainState?.enter;
@@ -34,9 +35,9 @@ export async function handleAdminDrain(req, res, match, ctx) {
                 sendError(res, 501, "capability.drain_state_required", "this deployment has no drain entry wired (embedded in another process?) — there is no drain for this request to enter");
                 return;
             }
-            const mismatched = drainIdentityMismatches(request, { scope: deps.config.fleetScope, worker: deps.config.configCenter?.worker, generation: deps.config.fleetGeneration, instanceId: deps.instanceId });
+            const mismatched = drainIdentityMismatches(request, { scope: deps.config.fleetScope, worker: deps.config.webAdmin?.worker, generation: deps.config.fleetGeneration, instanceId: deps.instanceId });
             if (mismatched.length > 0) {
-                sendError(res, 409, "conflict.fleet_identity", `the drain request names a different instance than this engine (mismatched: ${mismatched.join(", ")}) — nothing was changed; compare with this engine's GET /health (worker comes from SEMA_REGISTRY_WORKER, generation from FLEET_GENERATION, scope from FLEET_SCOPE — unset, and a request without scope, mean "${fleetScopeOf(undefined)}")`);
+                sendError(res, 409, "conflict.fleet_identity", `the drain request names a different instance than this engine (mismatched: ${mismatched.join(", ")}) — nothing was changed; compare with this engine's GET /health (worker comes from ${WEB_ADMIN_ENV.worker}, generation from FLEET_GENERATION, scope from FLEET_SCOPE — unset, and a request without scope, mean "${fleetScopeOf(undefined)}")`);
                 return;
             }
             const answer = enter({ actionId: request.actionId, deadlineAt: request.deadlineAt, deadlineBoundMs: deps.config.fleetLeaseOutageMaxMs });

package/dist/http/routes/approvals-assistant.js

@@ -11,7 +11,7 @@ import { PLAN_APPROVE_PERMISSION_MODES_AFTER, isPlanApprovePermissionModeAfter,
 import { MAX_APPROVAL_NONCE_CHARS } from "../../plugins/approval-nonce-store.js";
 import { redactedPreview, redactSecrets } from "../../trace/redact.js";
 import { redactRiskDescriptor } from "../../observability/run-terminal.js";
-import { fleetRunLabels } from "../../fleet/fleet-bus.js";
+import { buildRunName } from "../../fleet/fleet-bus.js";
 import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
@@ -384,12 +384,12 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 .map((r) => {
                 const s = byGate.get(r.sessionId);
                 const gate = s ? { kind: s.gateKind, severity: s.severity ?? null, spentMicroUsd: s.spentMicroUsd ?? null, deadline: s.deadline ?? null } : null;
-                const preview = r.objectivePreview?.trim() ? r.objectivePreview : undefined;
-                const label = preview !== undefined ? fleetRunLabels(preview).name : undefined;
+                const preview = r.objectivePreview ?? undefined;
+                const label = preview === undefined ? undefined : buildRunName(preview);
                 return {
                     taskId: r.taskId, sessionId: r.sessionId, status: r.status, needsAttention: !!gate, gate,
                     ...(label !== undefined ? { name: label } : {}),
-                    ...(preview !== undefined && label !== preview ? { description: preview } : {}),
+                    ...(preview !== undefined && preview.trim() !== "" && label !== preview ? { description: preview } : {}),
                     createdAt: r.createdAt, updatedAt: r.updatedAt,
                 };
             })

package/dist/http/routes/capabilities.js

@@ -1,6 +1,6 @@
 import { PERMISSION_MODES, expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
-import { modelImageInput, isModelAllowlisted, selectableCatalog } from "../../model-select.js";
-import { buildDroppedEntriesWire } from "../../config-center/read-warnings.js";
+import { modelImageInput, isAtMentionable, selectableCatalog } from "../../model-select.js";
+import { buildDroppedEntriesWire } from "../../web-admin-client/read-warnings.js";
 import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
 import { projectSealedKeyCapability } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
@@ -10,7 +10,7 @@ import { autonomyKeepsOpenWriteFace, autonomyModeFloor } from "../../runtime-gov
 import { DEVICE_PROTOCOL_VERSION, DEVICE_WS_PATH } from "../../device-ws-protocol.js";
 import { a2aInjectionHonored } from "../../task-a2a.js";
 import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey, buildMcpProbeInflightRefusal, buildMcpProbeRateKey, buildMcpProbeRateRefusal, createMcpProbeLocal, buildMcpProbeDeclarationRefusal, buildMcpProbeIncompleteRefusal, McpProbeIncomplete, MCP_PROBE_HTTP_STATUS, MCP_PROBE_MAX_INFLIGHT, MCP_PROBE_VERDICT_TIMEOUT_MS, createMcpProbeWalk, readMcpProbeBody, } from "../../capabilities/mcp-probe.js";
-import { mcpForScenario } from "../../config-center/facade.js";
+import { mcpForScenario } from "../../web-admin-client/facade.js";
 import { sendJson, sendError } from "../send.js";
 import { assertNever } from "../route-ctx.js";
 import { fileHistoryCaptureOf } from "../../file-history-capture.js";
@@ -237,7 +237,7 @@ export async function handleCapabilities(req, res, match, ctx) {
         }
         case "models": {
             const atCatalog = selectableCatalog(deps.config.models, deps.config.tiers, deps.config.modelRefusals);
-            const atAllowlist = deps.config.atModelAllowlist ?? [];
+            const atMention = deps.config.atMention;
             const models = Object.entries(deps.config.models)
                 .filter(([name]) => name !== "default")
                 .map(([name, m]) => ({
@@ -250,7 +250,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
                 ...((levels) => (levels !== undefined ? { supportedEffortLevels: [...levels] } : {}))(reasoningEffortLevelsOf(m)),
                 ...(m.compat !== undefined ? { compat: m.compat } : {}),
-                ...(atAllowlist.length > 0 ? { atMentionable: isModelAllowlisted(name, atCatalog, atAllowlist, deps.config.modelRefusals) } : {}),
+                ...(atMention.mode !== "all" ? { atMentionable: isAtMentionable(name, atCatalog, atMention, deps.config.modelRefusals) } : {}),
                 routePairing: routePairingOf(deps, name, m),
             }));
             const nonAlias = Object.entries(deps.config.models).filter(([n]) => n !== "default");

package/dist/http/routes/config-catalog.js

@@ -3,7 +3,7 @@ import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sendOperatorPrincipalsRequired } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { buildRetiredEnvWire, configKnobTable } from "../../config.js";
+import { configKnobTable } from "../../config.js";
 import { buildConfigCatalog } from "../../config-catalog.js";
 export const CONFIG_CATALOG_PATH = "/v1/config/catalog";
 const OPERATOR_ONLY_MESSAGE = "the config catalog is operator-only: the caller principal is not in OPERATOR_PRINCIPALS";
@@ -40,8 +40,7 @@ export async function handleConfigCatalog(req, res, match, ctx) {
                 boot: { ...(deps.memoryConsolidationValve !== undefined ? { memoryConsolidationValve: deps.memoryConsolidationValve } : {}) },
                 knobs: configKnobTable(),
                 centerDomains: DOMAINS,
-                centerManagedKeys: deps.configCenterManagedKeys?.(),
-                retired: buildRetiredEnvWire(),
+                centerManagedKeys: deps.webAdminManagedKeys?.(),
             }));
             return;
         }

package/dist/http/routes/diagnostics.js

@@ -14,7 +14,7 @@ export function buildServerWiringGates(input) {
         backend: input.backend,
         parkFacility: input.checkpointStore !== undefined,
     });
-    const noCenterArm = (knob) => `this knob has no config-center arm on this deployment — it is set by ${knob} on this machine, or derived from the deployment posture`;
+    const noCenterArm = (knob) => `this knob has no web-admin arm on this deployment — it is set by ${knob} on this machine, or derived from the deployment posture`;
     return {
         streamApproval: gate.active ? "active" : gate.reason,
         durableApproval: buildPostureKnobReading(input.durableApproval, {