@sema-agent/server 7.123.0 → 7.124.1

package/dist/plugins/one-time-migrations.js

@@ -169,7 +169,7 @@ export const ONE_TIME_MIGRATIONS = [
         removableAfter: "2026-11-09",
         removal: "删 `config-lkg.ts` 的 formatVersion 2 读回迁移:`migrateV2Lkg` / `migrateDroppedIdentityRow` / `RETIRED_CATALOG_COORDINATE` 与其上的窗注;`loadLkg` 的 2 臂" +
             "(版本判据里的 `2` 与 `formatVersion === 2 ? migrateV2Lkg(…)` 那一支 —— 2 回到「unknown formatVersion」拒)、返回型的 `migrated` 位与 JSDoc 里说它的那一行、" +
-            "文件头注「2 读回时一次性迁移」那一句;`boot/config-center.ts` 读 `read.migrated` 打 `config_lkg_migrated` 的那一行(formatVersion 1 迁移的同名事件那一行留);" +
+            "文件头注「2 读回时一次性迁移」那一句;`boot/web-admin.ts` 读 `read.migrated` 打 `config_lkg_migrated` 的那一行(formatVersion 1 迁移的同名事件那一行留);" +
             "`migrateV1Lkg` 里不带 v1 的 etag 那一句旁注对 `migrateV2Lkg` 的引用(不带 etag 的规则本身留 —— v1 载荷同样没有完整的被丢条目记录);契约 §A.1d " +
             "`droppedEntries` 一节「升级窗(如实)」那一条与 §A.1d `[config.model_refused_name_minted]` 那一条里「LKG 载体 `droppedIdentities` 读回时一次性迁移」那半句;手写 formatVersion 2 信封的测试夹具" +
             "(`test/config-lkg.test.ts`、`test/config-hot/batch1-version-ordinal.test.ts` 改写成 3;`test/models-dropped-entries-s1295.test.ts` 的旧 LKG 迁移格改钉 2 读回不可用)",
@@ -183,12 +183,36 @@ export const ONE_TIME_MIGRATIONS = [
         releasedOn: "2026-09-24",
         removableAfter: "2026-10-24",
         removal: "删 `config-lkg.ts` 的 formatVersion 1 迁移:`legacyV1LkgPath` / `migrateV1Lkg` 与其上的窗注(`loadLkg` 的 1 臂今天已是拒句,不动);" +
-            "`boot/config-center.ts` `bootFromLkg` 里调用 `migrateV1Lkg` 的那一段(含它打 `config_lkg_migrated` / 推不出身份时响亮拒的那两行);" +
+            "`boot/web-admin.ts` `bootFromLkg` 里调用 `migrateV1Lkg` 的那一段(含它打 `config_lkg_migrated` / 推不出身份时响亮拒的那两行);" +
             "`migrateV1Lkg` 的测试格(`test/config-lkg.test.ts` v1 迁移组)",
         afterRemoval: "既有响亮臂 `config_lkg_unusable`(`loadLkg` 对 1 答「pre-identity LKG (formatVersion 1) — not read back …」):旧默认路径上的 v1 文件不再被迁进箱、" +
             "原样留在盘上;中心可达照拉(整拉,新 LKG 按现行箱名落盘)、断着则 env 兜底",
         reportKeys: [],
     },
+    {
+        id: "M15",
+        introducedIn: "7.124.0",
+        releasedOn: "2026-10-11",
+        removableAfter: "2026-11-10",
+        removal: "删 `config-lkg.ts` 的载荷迁移:`migrateLkgPayload` 与其上的窗注、`loadLkg` 里调它的那一段(载荷照旧过 `lkgPayloadProblem`)、`LkgReadMigration.receipts`" +
+            "(信封 2 → 3 的 M13 若已先删,`LkgReadMigration` 与 `migrated` 位一并删)、对 `@sema-agent/settings-schema/one-time-migrations` 的 import;`loadLkg` 的版本判据收成" +
+            "只认 4(3 回到「unknown formatVersion」拒);`boot/web-admin.ts` 读回后按 4 写回的那一段;文件头注 formatVersion 4 一段里「每次读回都过迁移」那一句;" +
+            "`test/ss11-stored-migrations.test.ts` 的 M15 组(4 原样读回那一格留)",
+        afterRemoval: "既有响亮臂 `config_lkg_unusable`(`loadLkg` 对 3 答「unknown formatVersion 3」):旧载荷的 LKG 读回 ⇒ 不可用,中心可达照拉(整拉,新 LKG 按 4 覆盖)、" +
+            "断着则 env 兜底 —— 与回滚到 7.123.0 读 4 同一种处置",
+        reportKeys: [],
+    },
+    {
+        id: "M16",
+        introducedIn: "7.124.0",
+        releasedOn: "2026-10-11",
+        removableAfter: "2026-11-10",
+        removal: "删 `config-d-migration.ts` 整只文件与两个入口的调用(`boot/web-admin.ts` 建本地配置源之后、`run-local.ts` 建配置源之后各一行 + import);" +
+            "`test/ss11-stored-migrations.test.ts` 的 M16 组;部署文档里「起服自动迁 config.d」那一句(运维仍可手跑契约命令行,直到契约删族)",
+        afterRemoval: "契约读腿的墓碑(永久):config.d 里还带旧形的域文档 —— `runtime.json` 带事实 ⇒ `RetiredDomainError` 整份读不出;`atModelAllowlist` / `models.default` ⇒ " +
+            "models 域降级、rosters 整份读不出 —— 拒句点名迁移 id;出路是运维手跑契约命令行(契约删族之后只剩手改)",
+        reportKeys: [],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;

package/dist/plugins/scheduler-support.d.ts

@@ -1,6 +1,6 @@
 import { SchedulerError } from "@sema-agent/core";
 import type { SchedulerCapability, ScheduledIntent, SchedulerContext, ScheduledTaskId, ScheduledTaskSummary } from "@sema-agent/core";
-import type { SchedulerRecord } from "@sema-agent/settings-schema/scheduler-store";
+import type { SchedulerParseWarning, SchedulerRecord } from "@sema-agent/settings-schema/scheduler-store";
 export type { SchedulerRecord };
 /** core `Result<T,E>` shape (harness/types) — `{ok:true,value} | {ok:false,error}`. */
 type Result<T, E> = {
@@ -31,23 +31,42 @@ export declare function validateIntent(intent: ScheduledIntent, caps: Caps, nowM
 export declare function defaultSchedulerStorePath(config: {
     readonly agentConfigDir?: string;
 }): string;
+/** 调度店读写的日志口(logger 的子集)。 */
+export interface SchedulerStoreLog {
+    warn(msg: string, meta?: Record<string, unknown>): void;
+    info(msg: string, meta?: Record<string, unknown>): void;
+}
+/**
+ * 一次读的告警 → 日志(settings-schema 11 的调度店读口恒交回告警,没有静默模式)。告警是闭集,穷举;**不带记录原文**(`malformed-record`
+ * 的 `record` 可能是任意内容 —— 只报下标):
+ *  · `unreadable-file` ⇒ warn(整份文件不是 JSON 数组:读成零条,写者一律不写 —— 见 `mutateSchedulerStore`);
+ *  · `malformed-record` ⇒ warn(这一条读不懂、被跳过;下一个写者落盘时它就没了);
+ *  · `stale-session-record` ⇒ info(会话链上过期 ≥ 7 天的记录,读时丢、下一个写者落盘);
+ *  · `one-time-migration` ⇒ info(SS-M3 的读时改写收据:durable 记录换上新键,下一个写者落盘)。
+ */
+export declare function logSchedulerWarnings(log: SchedulerStoreLog, path: string, warnings: readonly SchedulerParseWarning[]): void;
 /**
- * File-backed SchedulerCapability (durable across daemon restarts). Store = a single JSON file (atomic write via
- * the registry-core /node binding). The resident shell daemon reads the same store to fire intents. `now`
- * injectable for tests.
+ * File-backed SchedulerCapability (durable across daemon restarts). Store = a single JSON file shared with the resident shell
+ * daemon. Every WRITE goes through the contract's ONE mutation primitive `mutateSchedulerStore` (optimistic witness + atomic
+ * write; a naked load → save is the lost-update race against the daemon's fire / reap writers). A store file that is not a JSON
+ * array is `unreadable_file`: nothing is written over it (the caller gets an `io` error). Reads (`list`) use the contract's read
+ * port; every read's warnings go to the log ({@link logSchedulerWarnings}). `now` injectable for tests.
  */
 export declare class FileSchedulerBackend implements SchedulerCapability {
     readonly schedulerCapabilities: Caps;
     private readonly storePath;
     private readonly now;
-    /** `storePath` 必填:路径是装配层从配置定的事实(`SCHEDULER_STORE_PATH` ?? {@link defaultSchedulerStorePath}),本类不自己找缺省。 */
+    private readonly log;
+    /** `storePath` 必填:路径是装配层从配置定的事实(`SCHEDULER_STORE_PATH` ?? {@link defaultSchedulerStorePath}),本类不自己找缺省。
+     *  `log` 必填:店的每次读都交回告警(读不懂的文件 / 被跳过的记录 / 读时改写),没有不出声的读法。 */
     constructor(opts: {
         storePath: string;
+        log: SchedulerStoreLog;
         caps?: Partial<Caps>;
         now?: () => number;
     });
-    private load;
-    private save;
+    /** 一次读改写(契约的唯一写原语)。`fn` 必须纯、可重放(并发写者落地时整段重放);返回 `null` = 不写。拿不到结果的三形各成一个 `io` 错。 */
+    private mutate;
     schedule(intent: ScheduledIntent, ctx: SchedulerContext): Promise<Result<{
         id: ScheduledTaskId;
     }, SchedulerError>>;

package/dist/plugins/scheduler-support.js

@@ -1,7 +1,7 @@
 import { join } from "node:path";
 import { randomBytes, createHash } from "node:crypto";
 import { SchedulerError, isValidCronExpr } from "@sema-agent/core";
-import { loadSchedulerStore, saveSchedulerStore } from "@sema-agent/settings-schema/node";
+import { loadSchedulerStore, mutateSchedulerStore } from "@sema-agent/settings-schema/node";
 import { configRootOf } from "../sema-config-dir.js";
 const ok = (value) => ({ ok: true, value });
 const err = (error) => ({ ok: false, error });
@@ -62,20 +62,67 @@ function computeNextRunMs(when, nowMs) {
 export function defaultSchedulerStorePath(config) {
     return join(configRootOf(config), "scheduled_tasks.json");
 }
+export function logSchedulerWarnings(log, path, warnings) {
+    for (const w of warnings) {
+        switch (w.kind) {
+            case "unreadable-file":
+                log.warn("scheduler_store_unreadable", { path, why: w.why, note: "the scheduled-task store is not a JSON array — it reads as zero records and no writer overwrites it; fix or remove the file" });
+                break;
+            case "malformed-record":
+                log.warn("scheduler_store_record_malformed", { path, index: w.index, note: "this record does not read and is skipped (the next write drops it)" });
+                break;
+            case "stale-session-record":
+                log.info("scheduler_store_record_stale", { path, index: w.index, id: w.id, note: "a session-chained record whose next run is ≥ 7 days past — dropped on read (the next write persists the drop)" });
+                break;
+            case "one-time-migration":
+                log.info("scheduler_store_record_migrated", { path, index: w.index, migration: w.receipt.migration, appliedAs: w.receipt.appliedAs, note: "settings-schema one-time migration rewrote this record on read (the next write persists it)" });
+                break;
+            default: {
+                const unhandled = w;
+                throw new Error(`scheduler store: unknown read warning ${JSON.stringify(unhandled)}`);
+            }
+        }
+    }
+}
 export class FileSchedulerBackend {
     schedulerCapabilities;
     storePath;
     now;
+    log;
     constructor(opts) {
         this.schedulerCapabilities = { ...DEFAULT_SCHEDULER_CAPS, ...(opts.caps ?? {}) };
         this.storePath = opts.storePath;
+        this.log = opts.log;
         this.now = opts.now ?? (() => Date.now());
     }
-    load() {
-        return loadSchedulerStore(this.storePath);
-    }
-    save(records) {
-        saveSchedulerStore(this.storePath, records);
+    mutate(fn, what) {
+        let result;
+        let produced = false;
+        let mutation;
+        try {
+            mutation = mutateSchedulerStore(this.storePath, (records) => {
+                const r = fn(records);
+                result = r.result;
+                produced = true;
+                return r.next;
+            }, { nowMs: this.now() });
+        }
+        catch (e) {
+            return err(new SchedulerError("io", `failed to ${what}`, e));
+        }
+        logSchedulerWarnings(this.log, this.storePath, mutation.warnings);
+        if (mutation.ok || mutation.reason === "aborted")
+            return produced ? ok(result) : err(new SchedulerError("io", `failed to ${what}`));
+        switch (mutation.reason) {
+            case "unreadable_file":
+                return err(new SchedulerError("io", `failed to ${what}: the scheduled-task store file is not a JSON array — nothing was written over it`));
+            case "conflict_exhausted":
+                return err(new SchedulerError("io", `failed to ${what}: concurrent writers kept changing the store — nothing was written`));
+            default: {
+                const unhandled = mutation;
+                throw new Error(`scheduler store: unknown mutation outcome ${JSON.stringify(unhandled)}`);
+            }
+        }
     }
     async schedule(intent, ctx) {
         const nowMs = this.now();
@@ -88,60 +135,56 @@ export class FileSchedulerBackend {
         if (intent.lifetime === "session" && this.schedulerCapabilities.supportsSessionLifetime === false) {
             return err(new SchedulerError("invalid_schedule", 'lifetime:"session" is not supported on this deployment (no resident daemon reaps session-lifetime records — the row would be an orphan)'));
         }
-        const records = this.load();
         const key = dedupKey(ctx.scope, intent, ctx.sessionId);
-        const existingIdx = records.findIndex((r) => {
-            const rr = r;
-            return r.scope === ctx.scope && dedupKey(r.scope, { when: r.when, label: r.label, lifetime: rr.lifetime }, r.sessionId) === key;
-        });
-        const scopeCount = records.filter((r) => r.scope === ctx.scope).length;
-        if (existingIdx < 0 && scopeCount >= this.schedulerCapabilities.maxScheduledPerScope) {
-            return err(new SchedulerError("limit_exceeded", `scope at cap (${this.schedulerCapabilities.maxScheduledPerScope})`));
-        }
-        const id = (existingIdx >= 0 ? records[existingIdx].id : randomBytes(12).toString("base64url"));
-        const rec = {
-            id,
-            scope: ctx.scope,
-            ...(ctx.principal ? { principal: ctx.principal } : {}),
-            ...(ctx.sessionId ? { sessionId: ctx.sessionId } : {}),
-            prompt: intent.prompt,
-            when: intent.when,
-            ...(intent.label ? { label: intent.label } : {}),
-            ...(intent.mode ? { mode: intent.mode } : {}),
-            ...(intent.lifetime ? { lifetime: intent.lifetime } : {}),
-            ...(intent.recurring !== undefined ? { recurring: intent.recurring } : {}),
-            createdMs: nowMs,
-            ...(computeNextRunMs(intent.when, nowMs) !== undefined ? { nextRunMs: computeNextRunMs(intent.when, nowMs) } : {}),
-        };
-        if (existingIdx >= 0)
-            records[existingIdx] = rec;
-        else
-            records.push(rec);
-        try {
-            this.save(records);
-        }
-        catch (e) {
-            return err(new SchedulerError("io", "failed to persist scheduled task", e));
-        }
-        return ok({ id });
+        const decided = this.mutate((records) => {
+            const existingIdx = records.findIndex((r) => {
+                const rr = r;
+                return r.scope === ctx.scope && dedupKey(r.scope, { when: r.when, label: r.label, lifetime: rr.lifetime }, r.sessionId) === key;
+            });
+            const scopeCount = records.filter((r) => r.scope === ctx.scope).length;
+            if (existingIdx < 0 && scopeCount >= this.schedulerCapabilities.maxScheduledPerScope) {
+                return { next: null, result: err(new SchedulerError("limit_exceeded", `scope at cap (${this.schedulerCapabilities.maxScheduledPerScope})`)) };
+            }
+            const id = (existingIdx >= 0 ? records[existingIdx].id : randomBytes(12).toString("base64url"));
+            const rec = {
+                id,
+                scope: ctx.scope,
+                ...(ctx.principal ? { principal: ctx.principal } : {}),
+                ...(ctx.sessionId ? { sessionId: ctx.sessionId } : {}),
+                prompt: intent.prompt,
+                when: intent.when,
+                ...(intent.label ? { label: intent.label } : {}),
+                ...(intent.mode ? { mode: intent.mode } : {}),
+                ...(intent.lifetime ? { lifetime: intent.lifetime } : {}),
+                ...(intent.recurring !== undefined ? { recurring: intent.recurring } : {}),
+                createdMs: nowMs,
+                ...(computeNextRunMs(intent.when, nowMs) !== undefined ? { nextRunMs: computeNextRunMs(intent.when, nowMs) } : {}),
+            };
+            const next = existingIdx >= 0 ? records.map((r, i) => (i === existingIdx ? rec : r)) : [...records, rec];
+            return { next, result: ok({ id }) };
+        }, "persist scheduled task");
+        return decided.ok ? decided.value : decided;
     }
     async cancel(id, ctx) {
-        const records = this.load();
-        const idx = records.findIndex((r) => r.id === id);
-        if (idx < 0 || records[idx].scope !== ctx.scope) {
-            return err(new SchedulerError("not_found", `no scheduled task ${id} in your scope (wrong id, already cancelled, or not yours)`));
-        }
-        records.splice(idx, 1);
+        const decided = this.mutate((records) => {
+            const idx = records.findIndex((r) => r.id === id);
+            if (idx < 0 || records[idx].scope !== ctx.scope) {
+                return { next: null, result: err(new SchedulerError("not_found", `no scheduled task ${id} in your scope (wrong id, already cancelled, or not yours)`)) };
+            }
+            return { next: records.filter((_, i) => i !== idx), result: ok(undefined) };
+        }, "persist cancellation");
+        return decided.ok ? decided.value : decided;
+    }
+    async list(ctx) {
+        let read;
         try {
-            this.save(records);
+            read = loadSchedulerStore(this.storePath, { nowMs: this.now() });
         }
         catch (e) {
-            return err(new SchedulerError("io", "failed to persist cancellation", e));
+            return err(new SchedulerError("io", "failed to read the scheduled-task store", e));
         }
-        return ok(undefined);
-    }
-    async list(ctx) {
-        const summaries = this.load()
+        logSchedulerWarnings(this.log, this.storePath, read.warnings);
+        const summaries = read.records
             .filter((r) => r.scope === ctx.scope)
             .map((r) => ({
             id: r.id,

package/dist/plugins/store-backend.js

@@ -242,12 +242,12 @@ class LocalBackend {
             throw new Error(`DB_BACKEND=local cannot open data dir ${root}: ${e instanceof Error ? e.message : String(e)}` +
                 (tail === undefined ? "" : ` ${tail}`));
         }
-        this.sessionStore = new LocalSessionStore(createLocalSessionRepo(this.fileBackend.root), this.fileBackend.root, { log: createLogger(config.logLevel) });
         const corruptReadWarn = (msg, fields) => this.discloseWarn(msg, fields);
         this.runStore = new FileRunStore(this.fileBackend.root, {
             error: (msg, fields) => void (this.onError ?? this.onWarn)?.(msg, fields),
             strictHydrate: config.runStoreStrictHydrate,
         });
+        this.sessionStore = new LocalSessionStore(createLocalSessionRepo(this.fileBackend.root), this.runStore, this.fileBackend.root, { log: createLogger(config.logLevel) });
         this.resumeAnchorStore = new FileResumeAnchorStore(this.fileBackend.root);
         this.approvalExemptionStore = new FileApprovalExemptionStore(this.fileBackend.root, { warn: corruptReadWarn });
         this.approvalNonceStore = new FileApprovalNonceStore(this.fileBackend.root, { warn: corruptReadWarn });

package/dist/plugins/store-contracts.d.ts

@@ -216,7 +216,7 @@ export interface RunRecord {
      *  被取消了没有」看终局码;判「一条还在跑的 run 上有没有人按过取消」才看这一位。 */
     cancelRequested: boolean;
     /** First ~120 chars of the objective (secret-redacted at write) — the list's "what is this task" glance.
-     *  null for rows predating the column. */
+     *  一个事实位:`""` = 建过预览、剥完没有用户正文(只有注入块 / 空 objective);null = 没记录(更早版本建的行 / 列前的行)。 */
     objectivePreview: string | null;
     createdAt: string;
     updatedAt: string;
@@ -337,9 +337,8 @@ export declare function isParkedRunStatus(status: RunRecord["status"]): boolean;
  * 两个不同的忙闲。
  *
  * 🔴 **未知词 / 无读数 ⇒ 词缺席(`undefined`),不是 `idle`**(诚实缺席,不是静默兜底):
- *  · `lastStatus === ""` 有两个真来源 ——(a)SQL 双生:这条会话**还没有任何 run**;(b)local 文件车道:
- *    该 lister **结构上说不出** run 状态(`local-session-store.ts:465` 自陈的诚实降级 `lastStatus: ""`)。
- *    两者都不是「我知道它闲着」,所以都不许铸出 `idle` 这个断言;
+ *  · `lastStatus === ""` 的真来源:这条会话**还没有任何 run**(SQL 双生与 local 会话店同;local 会话店的 run 店是必填位,没有「说不出 run 状态」的装配形)。
+ *    它不是「我知道它闲着」,所以不许铸出 `idle` 这个断言;
  *  · 读不懂的词(滚动升级里新副本写入的新状态词经裸 cast 读到本进程)同判 —— 与
  *    {@link isTerminalRunStatus} 族的保守方向一致。
  *  · **缺席怎么渲染是 core 的辖域,本仓一个字都不复述**(S-514-JU:此处原写着「core 对缺席渲染成 `idle`」
@@ -407,6 +406,23 @@ export interface SessionSummary {
      *  titled OR the lister face has no session_meta (the legacy task_run aggregate / memory twins — honest degrade). */
     title: string | null;
 }
+/**
+ * S-1371 —— 会话**枚举面**读 run 账里「每会话的 run 投影」的窄读面:`runCount` / `lastStatus` / `lastRunId` / `lastTaskRunId` 四位,
+ * 同一次读、同一条「最新一条」的口径。
+ *
+ * 为什么是 run 店自己的 `listSessions`、不另造一只读口:这四位在 SQL 双生里就是 `task_run` 的 `rn=1` JOIN(计数、最新一条的状态与 task_id、
+ * 最新一条 `result.runId`),在文件 / 内存 run 店里就是 `listSessions` 的同口径聚合(`created_at DESC, task_id DESC` 取最新一条、数全部)——
+ * 它们本来就是**同一个问题的同一份答案**。local 会话店(会话身份来自会话仓、不是 run 账)读这一只,一行里就不会出现两个来源各答一遍
+ * 「最新一条是谁」(此前 `runCount` / `lastStatus` 读 run 店、`lastRunId` / `lastTaskRunId` 读进程内座:重启后同一行「有终态词、`lastRunId` 为 null」);
+ * 不另造的另一半理由:再造一只 `listBySession` 就要在三个孪生里各落一遍并重新证一遍同口径。
+ *
+ * 只收四位:`Pick` 把读面钉死在它真用的键上(其余键 —— 预览 / 属主 / 时刻 —— 在会话仓那边另有来源,不许从这里混读)。
+ */
+export interface SessionRunRollupSource {
+    listSessions(opts: {
+        limit: number;
+    }): Promise<ReadonlyArray<Pick<SessionSummary, "sessionId" | "runCount" | "lastStatus" | "lastRunId" | "lastTaskRunId">>>;
+}
 /**
  * S-297 —— 「这个会话**最近一条腿**是哪一条 run」的窄读面(`latestRunForSession` 的回值)。
  *

package/dist/plugins/web-search.d.ts

@@ -40,7 +40,7 @@
  *    换的时候要核对的等价点:本文件的 `normalize()` 统一形状 + `max` 截断 +
  *    `setWebSearchBadPayloadObserver` 观测器,core 的 adapter 都没有,得在外层补回来。
  *
- * ③ **四级优先级语义未定**(env / config-center / per-scenario / per-request 谁压谁)。
+ * ③ **四级优先级语义未定**(env / web-admin / per-scenario / per-request 谁压谁)。
  *    🔴 三问里「谁被伤」这条决定了默认值:一个**只配了模型 key** 的既有部署,若新语义让某一级
  *    能自行打开搜索,它就在升级后**凭空长出一条出网工具** —— 那是安全姿态变更,不是特性。
  *    ⇒ 语义定稿前,任何新的开启通道**默认 OFF**;开启必须是部署方的显式动作。

package/dist/plugins/web-search.js

@@ -1,6 +1,7 @@
 import { validateHeaderValue } from "node:http";
 import { createSearxngSearchBackend } from "@sema-agent/core";
-import { isHierarchicalUrl, redactSecrets } from "../trace/redact.js";
+import { isHierarchicalUrl } from "@sema-agent/settings-schema";
+import { redactSecrets } from "../trace/redact.js";
 export const WEB_SEARCH_PROVIDERS = ["brave", "tavily", "searxng"];
 function isWebSearchProvider(word) {
     return WEB_SEARCH_PROVIDERS.includes(word);

package/dist/posture-source.d.ts

@@ -19,7 +19,7 @@
  * 得到一句谁都不认的空话,或者更坏:一句**对某些键是假的**话。
  *
  * 🔴 `centerMeaning` 是 G-7(test [ref])的修复面,成因是一次真的过期断言:这一臂原本硬编码
- * 「applied from the config-center (**restart-to-apply**)」,而 S-174(core 7.10.0 [ref])之后
+ * 「applied from the web-admin (**restart-to-apply**)」,而 S-174(core 7.10.0 [ref])之后
  * `readFace.face` 是**热换席**(`Runner.swapDeps({readFace})`,下一拍 refresh 当场换进全部 Runner,
  * `read-face` 重启片也不再为它签理由)——运维照那句话去滚动重启一片 fleet,重启的是一个已经生效的变更。
  * 生效时机是**键**的事实,不是四词表的属性,所以它跟 `postureMeaning` 一样归键。

package/dist/read-face-posture.d.ts

@@ -11,14 +11,14 @@
  *
  * 于是本模块把「档位」与「档位是谁定的」拆成两个字段:值仍是 `open | roots | 缺席`,来源是本文件的
  * **四词闭集**。来源不是装饰:
- *  ① `config-center/read-face.ts` 的 **env 恒赢**判据此前用的是「`config.readFace` 键在不在场」这个
+ *  ① `web-admin-client/read-face.ts` 的 **env 恒赢**判据此前用的是「`config.readFace` 键在不在场」这个
  *     **代理**;posture 会铸键,代理当场失真(center 的 face 会被一台从没设过 env 的机器挡掉)。
  *     换成读来源之后判据说的就是它真正想说的那件事:**这台机器的 env 显式占住了这个键吗**。
  *  ② 运维面:`GET /v1/diagnostics/wiring` 报 `{face, source, note}`,「为什么这台机器是 open」有答案
  *     (裁定的补偿项:升级即放开,得让运维看得见并知道怎么钉回)。
  *
  * ## 优先序(三态,与 `config.ts` 的 `postureOn` 同形)
- * `env 显式` > `center 发布` > `posture 派生` > `引擎默认`。env 恒赢的论证逐字见 `config-center/read-face.ts`
+ * `env 显式` > `center 发布` > `posture 派生` > `引擎默认`。env 恒赢的论证逐字见 `web-admin-client/read-face.ts`
  * 头注①(READ 容纳面描述的是**这台机器的磁盘上有什么**,组织的下发面不知道)。
  *
  * ## 定界
@@ -54,7 +54,7 @@ export declare function readFaceForPosture(singleUserTurnkey: boolean): ReadFace
  *
  *  🔴 `center` 那句话的事实来源是 S-174(core 7.10.0 [ref]):`RunnerDeps.readFace` 进了 core 的可换席
  *  闭集 `SWAPPABLE_DEP_SEATS` ⇒ 组织发布/撤回一个档位,**下一拍 refresh 当场换进全部 Runner**,
- *  `config-center/restart-signal.ts` 的 `read-face` 片也不再为它签重启理由(判据同源 =
+ *  `web-admin-client/restart-signal.ts` 的 `read-face` 片也不再为它签重启理由(判据同源 =
  *  `CENTER_READ_FACE_LIVE_KEYS`,由 core 的 `isSwappableDepSeat` 派生)。本句此前逐字写着
  *  「(restart-to-apply)」—— G-7 抓获的那条过期断言,方向恰好是「让运维为一个已生效的变更重启 fleet」。
  *  ⚠️ 只说 `face` 这一席:三个 deny 键仍是 boot-baked,那半场的话不在这条读面上(它们没有来源位)。 */

package/dist/read-face-posture.js

@@ -7,7 +7,7 @@ export function readFaceSourceNote(source) {
     return postureSourceNote({
         knob: "READ_FACE",
         source,
-        centerMeaning: "published by the config-center and applied HOT — the containment FACE is a swappable engine seat (core 7.10.0), so the next refresh (or POST /v1/admin/config/refresh) swaps it into every Runner with NO restart; set READ_FACE on this machine to take the key back",
+        centerMeaning: "published by the web-admin and applied HOT — the containment FACE is a swappable engine seat (core 7.10.0), so the next refresh (or POST /v1/admin/config/refresh) swaps it into every Runner with NO restart; set READ_FACE on this machine to take the key back",
         postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): reads outside the workspace roots are allowed by default — set READ_FACE=roots to pin the containing posture back",
     });
 }

package/dist/run-local.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { DEFAULT_MODEL_REF, resolveTaskModel } from "./model-select.js";
+import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, resolveTaskModel } from "./model-select.js";
 import { defaultModelRefusal, modelUnavailableMessage } from "./model-entry-refusal.js";
 import { createDurableAbsenceSeat } from "./observability/corrupt-read-seat.js";
 import { outwardPlane } from "./terminal.js";
@@ -25,7 +25,8 @@ import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { configLocalRoot, configProviderKind, createConfigProvider } from "./config-provider.js";
 import { composeExecutionLane } from "./boot/execution-lane.js";
 import { judgeConsolidationValve } from "./boot/memory-consolidation.js";
-import { applyEffective, applyCenterReadFace, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./config-center/facade.js";
+import { logConfigDirMigration, migrateLocalConfigDirectory } from "./config-d-migration.js";
+import { applyEffective, applyCenterReadFace, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./web-admin-client/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
 import { executionLaneHomeDir, executionLaneOf } from "./execution-lane-caps.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "./project-memory.js";
@@ -337,6 +338,8 @@ export async function runLocal(argv, deps = {}) {
         return 2;
     }
     const configProvider = createConfigProvider(providerInput);
+    if (configProvider.kind === "local")
+        logConfigDirMigration(logger, await migrateLocalConfigDirectory(root));
     let effective;
     try {
         const r = await configProvider.fetchEffective(undefined);
@@ -613,7 +616,7 @@ export async function runLocal(argv, deps = {}) {
         }
         throw err;
     }
-    const mention = resolveTaskModel(undefined, args.objective, config.models, undefined, config.modelRefusals);
+    const mention = resolveTaskModel(undefined, args.objective, config.models, DEFAULT_AT_MENTION, config.modelRefusals);
     if (mention.unavailable !== undefined) {
         const { requested, name, refusal } = mention.unavailable;
         printErr(`cannot run: ${modelUnavailableMessage("@-mention", requested, name, refusal)}`);

package/dist/runtime-caps-resolver.d.ts

@@ -65,8 +65,8 @@
  */
 import type { RuntimeCaps } from "@sema-agent/core";
 import type { EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
-import { fetchPrincipalCaps, type ExecutionRuling } from "./config-center/facade.js";
-import type { CenterEndpoint } from "./config-center/center-request.js";
+import { fetchPrincipalCaps, type ExecutionRuling } from "./web-admin-client/facade.js";
+import type { CenterEndpoint } from "./web-admin-client/center-request.js";
 import type { ScenarioRuling } from "./capabilities/scenarios.js";
 import type { ServiceConfig } from "./config-types.js";
 import { type Logger } from "./observability/logger.js";
@@ -75,7 +75,7 @@ export declare function resetExecutionLaneDefaultTraceForTest(): void;
 export interface EntitlementsResolverOpts {
     /** S-651:中心端点(基址 + 凭证**来源**;每次抓取取一次值,不持有启动快照)。 */
     center: CenterEndpoint;
-    /** This worker's name (`SEMA_REGISTRY_WORKER`), passed as `?worker=` so a worker-scoped `wpt_<self>` token can
+    /** This worker's name (`SEMA_WEB_ADMIN_WORKER`), passed as `?worker=` so a worker-scoped `wpt_<self>` token can
      *  resolve its OWN worker's principal caps (caps-only); harmless on a full token (the caps value
      *  is worker-independent). Omitted ⇒ no `?worker=` (a full-token, non-fleet deployment). */
     worker?: string;
@@ -135,7 +135,7 @@ export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | u
  * (`RuntimeCaps.autoMode` 三态逐 principal 解,[ref] 起「缺席=不阻」),任何部署级布尔都对它说不了话——
  * 所以本谓词为 false **不再**意味着 auto 不武装;「会不会武装」由 `auto-mode-face.ts` 的三项合取答。
  */
-export declare function centerEntitlementSourceWired(config: Pick<ServiceConfig, "configCenter">): boolean;
+export declare function centerEntitlementSourceWired(config: Pick<ServiceConfig, "webAdmin">): boolean;
 /** The two per-principal faces served off ONE caps fetch + cache. */
 export interface PrincipalEntitlementsClient {
     /** core's `RunnerDeps.runtimeCapsResolver` seam — FAIL-CLOSED on error (deny workflows/fork/autoMode;

package/dist/runtime-caps-resolver.js

@@ -1,4 +1,4 @@
-import { fetchPrincipalCaps } from "./config-center/facade.js";
+import { fetchPrincipalCaps } from "./web-admin-client/facade.js";
 import { createIdentityBins } from "./center-credential.js";
 import { HttpError } from "./security.js";
 import { createLogger } from "./observability/logger.js";
@@ -53,7 +53,7 @@ export function toCoreRuntimeCaps(ent) {
     return Object.keys(caps).length ? caps : undefined;
 }
 export function centerEntitlementSourceWired(config) {
-    return config.configCenter !== undefined && !config.configCenter.dryRun;
+    return config.webAdmin !== undefined && !config.webAdmin.dryRun;
 }
 export function gateExecutionLane(ruling, ownLane, logger = defaultLogger) {
     if (!ruling) {

package/dist/runtime-governance.d.ts

@@ -1,7 +1,7 @@
 /**
  * Runtime governance compiler — the "second baton" (center §10, core 1.114.0): turn the
- * operator's declarative `runtime.autonomy` + `runtime.commandPolicy` (`@sema-agent/settings-schema`,
- * carried to the service via sema-registry `EffectiveConfig.runtime`) into TIGHTEN-ONLY overrides on the
+ * operator's declarative `governance.autonomy` + `governance.commandPolicy` (`@sema-agent/settings-schema`,
+ * carried to the service in the effective config's `governance` domain) into TIGHTEN-ONLY overrides on the
  * per-task `TaskSpec`. Pure so it is unit-testable in isolation (the spec is otherwise assembled inside
  * main.ts's `resolveSpec`).
  *
@@ -28,7 +28,7 @@ import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 import { type GovernanceOverrides } from "./governance-overrides.js";
 /** 运维 autonomy 四档的**闭集**(同上)。`config.ts` 的 `parseAutonomy` 也从这里读 —— 四档词表全仓一份。 */
-export declare const AUTONOMY_MODES: ["read-only", "ask", "plan", "auto"];
+export declare const AUTONOMY_MODES: ("plan" | "auto" | "ask" | "read-only")[];
 /** A per-command governance rule (registry `runtime.commandPolicy[]`) —— **型也从契约派生**:
  *  契约给 `command` 加一条 refine / 给 `decision` 加一个判词,本仓的型当场跟上(或在下面的
  *  `RANK` / 穷尽 switch 上编译红),而不是靠人记得把手写联合改一遍。 */
@@ -39,7 +39,7 @@ export type Autonomy = NonNullable<GovernanceConfig["autonomy"]>;
 export declare const COARSE_SHELL_TOOLS_MIRROR: readonly string[];
 /** Validate `commandPolicy` rules — the shape (array of {command, decision}), the `command` (a bare argv[0] name,
  *  see {@link VALID_COMMAND_NAME}), AND the `decision` enum. Returns the list of human-readable errors (empty =
- *  OK). Called at config-apply (config-center/facade.ts `applyRuntimeHot`) so a malformed rule that BYPASSED the
+ *  OK). Called at config-apply (web-admin-client/facade.ts `applyRuntimeHot`) so a malformed rule that BYPASSED the
  *  registry schema (a hand-edited config.d / a non-conformant publish) is rejected LOUDLY rather than
  *  silently mis-compiling — review MEDIUM: an out-of-enum `decision` (e.g. "DENY") would otherwise fall through
  *  {@link compileCommandPolicyLayers}'s `decision==="deny"?…:"ask"` to ASK, silently WEAKENING an intended deny. */
@@ -176,7 +176,7 @@ export declare function autonomyKeepsOpenWriteFace(autonomy: Autonomy | undefine
  * 是 always」。`commandPolicy` 不入判据:它产的是 `toolPolicy` 的 ask,不抬 shellGate 档,与本格无关。
  *
  * ⚠️ **已知残留(codex 交叉复审 2026-08-11 逮到,如实登记而不是掩盖)**:本判据读的是**当下**的
- * config,而 `config.autonomy` 是**热改**的(`config-center/apply-effective.ts` 就地写 `config.autonomy`)。
+ * config,而 `config.autonomy` 是**热改**的(`web-admin-client/apply-effective.ts` 就地写 `config.autonomy`)。
  * 于是失真是**双向**的,不是我原先写的「只往缺席方向」:
  *  · 缺席向(常见):mint 之后运维把 `AUTONOMY=ask` 撤了 ⇒ 老 park 行归不出治理出身,少标一个;
  *  · **在场向**(窄):一条**纯 SUP 路由**产的门(`ROUTER_ENABLED` 开 ∧ 路由判 supervisor ∧ 当时治理层

package/dist/sealed-key.d.ts

@@ -2,7 +2,7 @@ import type { Logger } from "./observability/logger.js";
 /** Algorithm tag — MUST equal registry-core's `SEALED_BOX_ALG` (v1 sole value; a different alg on
  *  the wire is a loud per-model rejection in applyEffective, never a guess). */
 export declare const SEALED_KEY_ALG = "libsodium-sealedbox-x25519";
-/** The subset applyEffective needs (keeps sema-registry decoupled from fs/boot concerns). */
+/** The subset applyEffective needs (keeps web-admin decoupled from fs/boot concerns). */
 export interface SealedKeyOpener {
     has(publicKeyId: string): boolean;
     /** All private-key ids this host holds (surfaces in the no-private-key warn for operator triage). */
@@ -62,17 +62,17 @@ export declare function deriveKeyId(publicKeyRaw: Uint8Array): string;
  */
 export declare function ensureSealedKeyStore(dir: string, logger?: Logger): Promise<SealedKeyStore>;
 /**
- * Best-effort public-key registration with the sema-registry (`POST /api/config/execution-keys`).
+ * Best-effort public-key registration with the web-admin (`POST /api/config/execution-keys`).
  *
  * HONESTY over fake automation: that endpoint is ADMIN-gated, and a fleet worker only holds
  * SERVICE_PULL_TOKEN — so automatic registration works ONLY when the operator deliberately provides
- * an admin token (SEMA_REGISTRY_ADMIN_TOKEN in this service's env; the REGISTRY_ADMIN_TOKEN alias was tombstoned in 5.0.0). Without
+ * an admin token (SEMA_WEB_ADMIN_ADMIN_TOKEN in this service's env; its older names are settings-schema tombstones). Without
  * one we do the next-best REAL thing: print the FULL public key + id at boot (a public key is not a
  * secret) with the exact registration instructions, and warn that the web "paste key" face stays
  * dark for this host until an admin registers it. Never throws (fire-and-forget from boot).
  */
 export declare function reportExecutionPublicKey(opts: {
-    /** sema-registry base URL (config.configCenter.baseUrl). Absent = no center → manual print only. */
+    /** web-admin base URL (config.webAdmin.baseUrl). Absent = no center → manual print only. */
     baseUrl?: string;
     /** Admin bearer for the center's config write face. Absent = manual print (see above). */
     adminToken?: string;

package/dist/sealed-key.js

@@ -4,7 +4,8 @@ import { join } from "node:path";
 import _sodium from "libsodium-wrappers";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { createCenterCredentialSource } from "./center-credential.js";
-import { centerFetch } from "./config-center/center-request.js";
+import { centerFetch } from "./web-admin-client/center-request.js";
+import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 export const SEALED_KEY_ALG = "libsodium-sealedbox-x25519";
 const SEAL_OVERHEAD_BYTES = 48;
 const BASE64_STRICT = /^[A-Za-z0-9+/]+={0,2}$/;
@@ -101,7 +102,7 @@ export async function reportExecutionPublicKey(opts) {
         });
     };
     if (!baseUrl || !adminToken) {
-        manual(!baseUrl ? "no registry configured (SEMA_REGISTRY_URL unset)" : "no admin token (SEMA_REGISTRY_ADMIN_TOKEN unset; the worker's pull token cannot write execution keys)");
+        manual(!baseUrl ? `no web-admin configured (${WEB_ADMIN_ENV.url} unset)` : `no admin token (${WEB_ADMIN_ENV.adminToken} unset; the worker's pull token cannot write execution keys)`);
         return;
     }
     try {

package/dist/security.d.ts

@@ -17,9 +17,9 @@ export interface SessionListItem {
     /** K-5c (shell §K): the latest run's task_id — the shell's one-hop live-tail re-attach anchor on resume. */
     lastRunId: string | null;
     /** [ref]([ref]/[ref]):the LATEST run's **engine run id**(`TaskResult.runId`)when known —— OMIT-when-absent,
-     *  恒不铸 null。runs-ledger listers 从 latest run 的 `result` JSON 提取(终局与 park 时写、认领续跑即清空 —— S-173 ⇒ 在跑 latest 键诚实缺席);
-     *  local lister 走 `noteTaskRun` 席实时记录(⇒ 在跑也在场)——两面缺席集合不完全相等,读法一致:
-     *  缺席 = 「此行无已知 engine runId」,禁读成其它含义。⚠️ 与 `lastRunId`(= latest run 的 **task_id**)
+     *  恒不铸 null。所有 lister(SQL 双生、local 会话店 —— 它的 run 店是必填位)从 latest run 的 `result` JSON 提取(终局与 park 时写、认领续跑即清空 —— S-173
+     *  ⇒ 在跑 latest 键诚实缺席)。
+     *  读法一致:缺席 = 「此行无已知 engine runId」,禁读成其它含义。⚠️ 与 `lastRunId`(= latest run 的 **task_id**)
      *  是两条身份轴,命名对齐 core `SessionStoreSummary.lastTaskRunId`。wire:additive 键零投影透传
      *  (sessions-list.ts);sema-sdk spec `SessionSummary` 闭集候 SDK 半场开键([ref]/.82 班车)。 */
     lastTaskRunId?: string;