@sema-agent/server 7.124.1 → 7.125.1

package/dist/boot/session-faces.js

@@ -1,4 +1,4 @@
-import { buildSessionAudit, buildSessionAuditLocal, buildSessionAuditPg } from "../audit.js";
+import { buildRewindHandles, buildSessionAudit, buildSessionAuditLocal, buildSessionAuditPg } from "../audit.js";
 import { makeDegenerateInstrument } from "../degenerate-instrument.js";
 import { PlanCacheProbe } from "../plan-cache-probe.js";
 import { purgeScratchpadDir } from "../env-facts.js";
@@ -14,12 +14,13 @@ export function createSessionFaces(ctx) {
     const auditLocalRoot = backend?.kind === "local" ? (config.localDataRoot ?? localRoot) : undefined;
     const ownerAware = sessionStore;
     const sessionAudit = mysqlPool || auditPgPool || auditLocalRoot
-        ? async (sessionId) => {
+        ? async (sessionId, opts) => {
+            const handles = opts !== undefined && resumeAnchorStore !== undefined ? buildRewindHandles(await resumeAnchorStore.listBySession(sessionId), opts.reader) : undefined;
             const audit = mysqlPool
-                ? await buildSessionAudit(mysqlPool, sessionId)
+                ? await buildSessionAudit(mysqlPool, sessionId, handles)
                 : auditPgPool
-                    ? await buildSessionAuditPg(auditPgPool, sessionId)
-                    : await buildSessionAuditLocal(auditLocalRoot, sessionId);
+                    ? await buildSessionAuditPg(auditPgPool, sessionId, handles)
+                    : await buildSessionAuditLocal(auditLocalRoot, sessionId, handles);
             if (!audit)
                 return undefined;
             return { ...audit, owner: (await ownerAware.ownerOf?.(sessionId)) ?? null };

package/dist/boot/stage-02-web-admin-pull.js

@@ -2,10 +2,14 @@ import { createUnpricedCeilingVerdict } from "./unpriced-ceiling-verdict.js";
 import { createWebAdminRuntime } from "./web-admin.js";
 import { composeExecutionLane, FILE_SOURCED_LANES } from "./execution-lane.js";
 import { serviceConfigSourceKind } from "../config-provider.js";
+import { logConfigDirMigration, migrateLocalConfigDirectory } from "../config-d-migration.js";
 import { defaultModelRefusal, refusedNameMintedRefusal } from "../model-entry-refusal.js";
 export async function runStage02(ctx) {
     const { config, localRoot, logger, metrics } = ctx;
-    await composeExecutionLane(config, { configSource: serviceConfigSourceKind(config), localRoot, logger, drivesFromFile: FILE_SOURCED_LANES });
+    const configSource = serviceConfigSourceKind(config);
+    if (configSource === "local")
+        logConfigDirMigration(logger, await migrateLocalConfigDirectory(localRoot));
+    await composeExecutionLane(config, { configSource, localRoot, logger, drivesFromFile: FILE_SOURCED_LANES });
     const webAdmin = await createWebAdminRuntime({ config, logger, metrics, localRoot });
     const noDefaultModel = defaultModelRefusal(config, "env");
     if (noDefaultModel !== undefined) {

package/dist/boot/stage-05-execution-env.js

@@ -1,12 +1,16 @@
 import { createToolTracer, createPermissionDeniedMeter } from "../observability/tool-trace.js";
 import { composeHooks } from "../hooks/hook-runner.js";
 import { assertDeviceLaneWired, createDeviceLane } from "./device-lane.js";
-import { createExecutionEnv } from "./execution-env.js";
+import { assertWorkspaceSpaceReadable, createExecutionEnv } from "./execution-env.js";
+import { sessionFaceReaderOf } from "./session-incarnation-seat.js";
+import * as facts from "../capability-facts.js";
+import { sessionStoreLabelOf } from "../store-posture.js";
 export function runStage05(ctx) {
-    const { backend, config, instanceId, logger, metrics, taskAttachmentStore } = ctx;
+    const { backend, config, instanceId, logger, metrics, sessionStore, taskAttachmentStore } = ctx;
     const deviceLane = config.remoteExec?.provider === "device" ? createDeviceLane({ config, logger, metrics, backend, replicaId: instanceId }) : undefined;
     const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv, fenceSessionOwner, dropSessionScoped, noteSessionIncarnation, sessionIncarnationOf, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}) });
     assertDeviceLaneWired(config.remoteExec?.provider === "device", deviceLane, executionEnvFactory !== undefined);
+    assertWorkspaceSpaceReadable(facts.workspaceSpace(config), sessionFaceReaderOf(sessionStore), sessionStoreLabelOf(config.sessionBackend, backend?.kind));
     const toolTracer = config.toolTrace ? createToolTracer(logger) : undefined;
     if (toolTracer)
         logger.info("tool_trace_enabled", {});

package/dist/boot/stage-09-leader.d.ts

@@ -17,7 +17,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
         childrenAlive: readonly string[];
     }>) | undefined;
     webAdminJwtVerifier: import("../auth-bridge.js").WebAdminJwtVerifier | undefined;
-    sessionAudit: ((sessionId: string) => Promise<{
+    sessionAudit: ((sessionId: string, opts?: import("../audit.js").SessionAuditReadOpts) => Promise<{
         owner: string | null;
         sessionId: string;
         createdAt: string;

package/dist/boot/stage-10-http-server.d.ts

@@ -16,7 +16,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
         childrenAlive: readonly string[];
     }>) | undefined;
     webAdminJwtVerifier: import("../auth-bridge.js").WebAdminJwtVerifier | undefined;
-    sessionAudit: ((sessionId: string) => Promise<{
+    sessionAudit: ((sessionId: string, opts?: import("../audit.js").SessionAuditReadOpts) => Promise<{
         owner: string | null;
         sessionId: string;
         createdAt: string;

package/dist/boot/web-admin.js

@@ -9,20 +9,21 @@ import { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore
 import { buildPricing } from "../budget.js";
 import { applyCenterPlugins } from "../capabilities/center-plugins.js";
 import { applyCatalogToSource, withPromptArtifactBackfill } from "../capabilities/center-prompts.js";
-import { validatePromptsDomain, CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
+import { CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
 import { centerScenarios, centerScenarioDetails } from "../capabilities/scenarios.js";
 import { isRosterGateArmed } from "../config.js";
 import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg, legacyV1LkgPath, migrateV1Lkg } from "../config-lkg.js";
 import { answerStillCurrent, centerStateBin, credentialIdentityNow, judgeCenterCredentialAtBoot } from "../center-credential.js";
 import { buildCenterCredentialHealthView, createCenterCredentialRenewer } from "../center-credential-renewer.js";
 import { centerManagedConfigKeys } from "../web-admin-client/apply-effective.js";
-import { logConfigDirMigration, migrateLocalConfigDirectory } from "../config-d-migration.js";
 import { createConfigProvider, raceBootFetch, serviceConfigSourceKind, BOOT_FETCH_DEFERRED } from "../config-provider.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { buildSealedKeyPublicFace, ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
 import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, fetchPromptArtifact } from "../web-admin-client/facade.js";
 import { buildConfigHandoff, buildRestartSignal, configHandoffMissing } from "../fleet/engine-signal.js";
 import { createMcpRevocationLedger, enabledMcpEntries } from "../web-admin-client/mcp-revocation.js";
+import { buildUnreadConfigFileFields } from "../web-admin-client/read-warnings.js";
+import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, judgeConfigCandidate } from "../web-admin-client/candidate-gate.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
 import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../web-admin-client/apply-ledger.js";
 function lkgReadNote(scope) {
@@ -127,11 +128,12 @@ export async function createWebAdminRuntime(ctx) {
             localDir: localRoot,
         })
         : undefined;
-    if (configProvider?.kind === "local")
-        logConfigDirMigration(logger, await migrateLocalConfigDirectory(localRoot));
+    const localDirField = configProvider?.kind === "local" ? { dir: configProvider.root } : {};
     const rosterGateArmed = isRosterGateArmed(cc);
     const modelReadyState = { ready: !rosterGateArmed };
-    const warnDroppedEntries = (r, phase) => {
+    const warnReadNotices = (r, phase) => {
+        for (const f of r.unreadFiles ?? [])
+            logger.warn("config_unread_file", buildUnreadConfigFileFields(f, localDirField.dir));
         for (const d of r.droppedEntries ?? []) {
             logger.warn("config_entry_dropped", {
                 domain: d.domain,
@@ -144,6 +146,13 @@ export async function createWebAdminRuntime(ctx) {
             });
         }
     };
+    const announceCandidateRejected = (r, verdict, leg) => {
+        const domains = verdict.domains.join(",");
+        if (lastRejectedCandidate?.version === r.effective.version && lastRejectedCandidate.domains === domains)
+            return;
+        lastRejectedCandidate = { version: r.effective.version, domains, at: Date.now() };
+        logger.warn("config_candidate_rejected", buildCandidateRejectedFields(r, verdict, leg, { lkgVersion: latestEffective?.version ?? "(env)", ...localDirField }));
+    };
     const selfReportListeners = [];
     const notifySelfReport = (changed) => {
         for (const listener of selfReportListeners) {
@@ -275,13 +284,12 @@ export async function createWebAdminRuntime(ctx) {
     };
     if (configProvider && !cc?.dryRun)
         await rebasePromptState(promptStateIdentity, "boot");
-    const adoptCenterPrompts = async (eff, phase) => {
+    const adoptCenterPrompts = async (eff, prompts, phase) => {
         const adoptedIdentity = candidateIdentityOf(eff);
         if (adoptedIdentity !== undefined && adoptedIdentity !== promptStateIdentity) {
             await rebasePromptState(adoptedIdentity, phase);
         }
-        const raw = eff?.prompts;
-        if (raw === undefined) {
+        if (prompts === undefined) {
             if (centerPrompts)
                 logger.info("center_prompts_cleared", { phase, note: "effective carries no prompts key (publish gate off) — built-in providers resume" });
             const cleared = await applyCatalogToSource(catalogSource, undefined, centerPrompts, logger, phase);
@@ -294,29 +302,24 @@ export async function createWebAdminRuntime(ctx) {
             }
             return;
         }
-        const v = validatePromptsDomain(raw);
-        if (!v.ok) {
-            logger.warn("center_prompts_invalid", { phase, error: v.error, kept: centerPrompts?.declarations?.packId ?? (centerPrompts?.catalog ? "(catalog)" : "(builtin)"), note: "malformed prompts face rejected (core assemble would THROW per task) — keeping the previous pack/built-ins; fix the center payload" });
-            return;
-        }
-        if (centerPrompts?.identity !== v.value.identity) {
+        if (centerPrompts?.identity !== prompts.identity) {
             logger.info("center_prompts_adopted", {
                 phase,
-                axes: v.value.axes,
-                ...(v.value.declarations
-                    ? { packId: v.value.declarations.packId, contentDigest: v.value.declarations.contentDigest, sections: v.value.declarations.sections.length, scenarioOverrides: Object.keys(v.value.declarations.scenarioOverrides ?? {}).length }
+                axes: prompts.axes,
+                ...(prompts.declarations
+                    ? { packId: prompts.declarations.packId, contentDigest: prompts.declarations.contentDigest, sections: prompts.declarations.sections.length, scenarioOverrides: Object.keys(prompts.declarations.scenarioOverrides ?? {}).length }
                     : {}),
-                ...(v.value.catalog ? { artifactDigest: v.value.catalog.artifact.artifactDigest, catalogDigest: v.value.catalog.artifact.payload.catalogDigest, sourceRevision: v.value.catalog.sourceRevision } : {}),
+                ...(prompts.catalog ? { artifactDigest: prompts.catalog.artifact.artifactDigest, catalogDigest: prompts.catalog.artifact.payload.catalogDigest, sourceRevision: prompts.catalog.sourceRevision } : {}),
                 note: "new tasks assemble the new pack (epoch re-pins at the next task boundary); in-flight sessions stay pinned",
             });
         }
-        const transitioned = await applyCatalogToSource(catalogSource, v.value, centerPrompts, logger, phase);
+        const transitioned = await applyCatalogToSource(catalogSource, prompts, centerPrompts, logger, phase);
         if (transitioned) {
-            centerPrompts = v.value;
+            centerPrompts = prompts;
             pendingCatalogFaces = undefined;
         }
         else {
-            pendingCatalogFaces = { target: v.value };
+            pendingCatalogFaces = { target: prompts };
         }
     };
     let bootConfigPending;
@@ -442,7 +445,7 @@ export async function createWebAdminRuntime(ctx) {
             const lkgEffective = read.lkg.effective;
             candidateIdentity.set(lkgEffective, identity);
             bindValidator(read.lkg.etag, identity);
-            return { effective: lkgEffective, ...(read.lkg.etag !== undefined ? { etag: read.lkg.etag } : {}) };
+            return { effective: lkgEffective, ...(read.lkg.etag !== undefined ? { etag: read.lkg.etag } : {}), prompts: read.prompts };
         };
         const bootApplyLkgInline = async (lkgR) => {
             const lkgGen = generationOf(lkgR.effective.version);
@@ -461,7 +464,7 @@ export async function createWebAdminRuntime(ctx) {
             if (lkgSurvivesRestart && lkgIdentity !== undefined)
                 noteHandoff({ durable: { version: lkgR.effective.version, identity: lkgIdentity } });
             markApplied(lkgGen, lkgR.effective.version);
-            await adoptCenterPrompts(lkgR.effective, "boot-lkg");
+            await adoptCenterPrompts(lkgR.effective, lkgR.prompts, "boot-lkg");
             const lkgPlane = modelPlaneCommitted(lkgReport);
             if (lkgPlane)
                 markRosterLanded(lkgR.effective);
@@ -476,16 +479,46 @@ export async function createWebAdminRuntime(ctx) {
             const cfgModels = (lkgR.effective.models?.models ?? []).filter((m) => m.enabled !== false).length;
             logger.info("config_loaded", { source: "lkg", version: lkgR.effective.version, worker: cc?.worker ?? "(global)", models: cfgModels });
         };
+        const bootFallBackWhole = async (why) => {
+            const lkgFallback = await bootFromLkg(why, "whole");
+            if (!lkgFallback)
+                return;
+            lkgBooted = true;
+            try {
+                await bootApplyLkgInline(lkgFallback);
+            }
+            catch (applyErr) {
+                lkgBooted = false;
+                logger.warn("config_lkg_apply_failed", { err: String(applyErr), note: "persisted LKG failed to apply — env fallback serves; the cache rewrites on the next clean candidate" });
+            }
+        };
+        const warnLocalNoModels = (r, rejected) => {
+            const modelsDomainErr = (r.domainErrors ?? []).find((de) => de.domain === "models");
+            const modelsDropped = (r.droppedEntries ?? []).filter((d) => d.domain === "models");
+            const totalModels = (r.effective.models?.models ?? []).length;
+            logger.warn("config_local_no_models", {
+                ...localDirField,
+                ...(modelsDomainErr ? { domainError: modelsDomainErr.error } : {}),
+                ...(modelsDropped.length > 0 ? { droppedEntries: modelsDropped.map((d) => d.entry) } : {}),
+                hint: rejected && modelsDomainErr
+                    ? "config.d/models.json 在场但 models 域判形失败,整份本地候选被拒(真因见本行 domainError)— 模型继续走 env 兜底"
+                    : rejected
+                        ? "config.d 里别的域判形失败,整份本地候选被拒(坏域与真因见 config_candidate_rejected)— config.d/models.json 的模型不用,继续走 env 兜底"
+                        : modelsDropped.length > 0 && totalModels === 0
+                            ? "config.d/models.json 的条目全部被逐条丢弃(逐条真因见 config_entry_dropped)— 模型继续走 env 兜底"
+                            : totalModels > 0
+                                ? `config.d/models.json 有 ${totalModels} 条模型但全部 enabled:false — 模型继续走 env 兜底`
+                                : "config.d/models.json 空或 CONFIG_LOCAL_DIR 指错目录(选目录旋钮是 CONFIG_LOCAL_DIR,不是 LOCAL_DATA_ROOT)— 模型继续走 env 兜底",
+            });
+        };
         let bootApplyPhase = false;
         try {
             const bootFetch = pullEffective(configProvider, undefined);
             const raced = await raceBootFetch(bootFetch, config.configBootFetchBudgetMs);
-            let lkgFallback = null;
             if (raced === BOOT_FETCH_DEFERRED) {
                 bootConfigPending = bootFetch;
                 bootFetch.catch(() => { });
-                lkgFallback = await bootFromLkg("boot fetch deferred (budget exceeded)", "whole");
-                lkgBooted = lkgFallback !== null;
+                await bootFallBackWhole("boot fetch deferred (budget exceeded)");
                 logger.warn("config_boot_fetch_deferred", {
                     source: configProvider.kind,
                     budgetMs: config.configBootFetchBudgetMs,
@@ -495,84 +528,76 @@ export async function createWebAdminRuntime(ctx) {
                         : "center slow/unreachable and no usable LKG — serving on the env fallback; the pull continues in the background (late-boot adoption on arrival). Raise CONFIG_BOOT_FETCH_BUDGET_MS to block boot instead.",
                 });
             }
-            if (raced === BOOT_FETCH_DEFERRED && lkgFallback) {
-                try {
-                    await bootApplyLkgInline(lkgFallback);
-                }
-                catch (applyErr) {
-                    lkgBooted = false;
-                    logger.warn("config_lkg_apply_failed", { err: String(applyErr), note: "persisted LKG failed to apply — env fallback serves; the cache rewrites on the next clean candidate" });
-                }
-            }
             const r = raced === BOOT_FETCH_DEFERRED ? null : raced;
             if (r) {
                 bootApplyPhase = true;
                 for (const de of r.domainErrors ?? [])
-                    logger.warn("config_domain_invalid", { domain: de.domain, error: de.error, note: "tolerated at BOOT (corrupt file → schema defaults; dangling ref → reported as-is); the refresh path rejects such a candidate whole and keeps the LKG (§9.5-5)" });
-                warnDroppedEntries(r, "boot");
+                    logger.warn("config_domain_invalid", { domain: de.domain, error: de.error, note: CONFIG_DOMAIN_INVALID_NOTE });
                 if (dryRun) {
-                    logEffectiveDiff(config, r.effective, logger);
-                    if (fullyLandedForLkg(r, undefined))
+                    const dryVerdict = judgeConfigCandidate(r);
+                    if (dryVerdict.verdict === "rejected") {
+                        announceCandidateRejected(r, dryVerdict, "boot");
+                    }
+                    else {
+                        warnReadNotices(r, "boot");
+                        logEffectiveDiff(config, r.effective, logger);
                         ccEtag = r.etag;
+                    }
                 }
                 else {
-                    const bootGen = generationOf(r.effective.version);
-                    applyLedger.seenTarget(bootGen, r.effective.version);
-                    let bootReport;
-                    applyEffective(config, r.effective, logger, {
-                        leg: "boot",
-                        sealedKeys,
-                        generation: bootGen,
-                        report: (rep) => {
-                            bootReport = rep;
-                            recordApply(rep);
-                        },
-                    });
-                    markApplied(bootGen, r.effective.version);
-                    const bootClean = fullyLandedForLkg(r, bootReport);
-                    if (bootClean)
-                        ccEtag = r.etag;
-                    await adoptCenterPrompts(r.effective, "boot");
-                    let bootPlaneEff = modelPlaneCommitted(bootReport) ? r.effective : undefined;
-                    if (bootPlaneEff === undefined) {
-                        const lkgPlane = await bootFromLkg("boot candidate's model plane was refused", "model-plane");
-                        if (lkgPlane) {
-                            let planeReport;
-                            applyEffective(config, withModelPlaneOf(r.effective, lkgPlane.effective), logger, { leg: "boot", sealedKeys, generation: bootGen, report: (rep) => (planeReport = rep) });
-                            if (modelPlaneCommitted(planeReport)) {
-                                bootPlaneEff = lkgPlane.effective;
-                                logger.warn("config_model_plane_from_lkg", { version: r.effective.version, lkgVersion: lkgPlane.effective.version, note: "the live candidate's model plane was refused at boot — serving the LKG's model plane (catalog and the collab templates that reference it) with the live candidate's other groups; the refresh cadence re-judges the candidate" });
-                            }
-                        }
+                    const bootVerdict = judgeConfigCandidate(r);
+                    if (bootVerdict.verdict === "rejected") {
+                        await bootFallBackWhole(`boot candidate rejected: ${bootVerdict.domains.join(",")}`);
+                        const rejectedGen = generationOf(r.effective.version);
+                        applyLedger.seenTarget(rejectedGen, r.effective.version);
+                        announceCandidateRejected(r, bootVerdict, "boot");
+                        if (configProvider.kind === "local")
+                            warnLocalNoModels(r, true);
                     }
-                    if (bootPlaneEff !== undefined)
-                        markRosterLanded(bootPlaneEff);
-                    effective = r.effective;
-                    if (bootPlaneEff !== undefined)
-                        appliedPlaneEff = bootPlaneEff;
-                    if (bootClean)
-                        latestEffective = r.effective;
-                    if (bootClean && !lkgBooted)
-                        bootLkgCandidate = { effective: r.effective, etag: r.etag };
-                    const cfgModels = (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length;
-                    const cfgDir = configProvider.kind === "local" ? { dir: configProvider.root } : {};
-                    logger.info("config_loaded", { source: configProvider.kind, version: r.effective.version, worker: cc?.worker ?? "(global)", models: cfgModels, ...cfgDir });
-                    if (configProvider.kind === "local" && cfgModels === 0) {
-                        const modelsDomainErr = (r.domainErrors ?? []).find((de) => de.domain === "models");
-                        const modelsDropped = (r.droppedEntries ?? []).filter((d) => d.domain === "models");
-                        const totalModels = (r.effective.models?.models ?? []).length;
-                        logger.warn("config_local_no_models", {
-                            ...cfgDir,
-                            ...(modelsDomainErr ? { domainError: modelsDomainErr.error } : {}),
-                            ...(modelsDropped.length > 0 ? { droppedEntries: modelsDropped.map((d) => d.entry) } : {}),
-                            hint: modelsDomainErr
-                                ? "config.d/models.json 在场但 models 域判形失败落 default(真因见本行 domainError)— 模型继续走 env 兜底"
-                                : modelsDropped.length > 0 && totalModels === 0
-                                    ? "config.d/models.json 的条目全部被逐条丢弃(逐条真因见 config_entry_dropped)— 模型继续走 env 兜底"
-                                    : totalModels > 0
-                                        ? `config.d/models.json 有 ${totalModels} 条模型但全部 enabled:false — 模型继续走 env 兜底`
-                                        : "config.d/models.json 空或 CONFIG_LOCAL_DIR 指错目录(选目录旋钮是 CONFIG_LOCAL_DIR,不是 LOCAL_DATA_ROOT)— 模型继续走 env 兜底",
+                    else {
+                        warnReadNotices(r, "boot");
+                        const bootGen = generationOf(r.effective.version);
+                        applyLedger.seenTarget(bootGen, r.effective.version);
+                        let bootReport;
+                        applyEffective(config, r.effective, logger, {
+                            leg: "boot",
+                            sealedKeys,
+                            generation: bootGen,
+                            report: (rep) => {
+                                bootReport = rep;
+                                recordApply(rep);
+                            },
                         });
+                        markApplied(bootGen, r.effective.version);
+                        const bootClean = fullyLandedForLkg(r, bootReport);
+                        if (bootClean)
+                            ccEtag = r.etag;
+                        await adoptCenterPrompts(r.effective, bootVerdict.prompts, "boot");
+                        let bootPlaneEff = modelPlaneCommitted(bootReport) ? r.effective : undefined;
+                        if (bootPlaneEff === undefined) {
+                            const lkgPlane = await bootFromLkg("boot candidate's model plane was refused", "model-plane");
+                            if (lkgPlane) {
+                                let planeReport;
+                                applyEffective(config, withModelPlaneOf(r.effective, lkgPlane.effective), logger, { leg: "boot", sealedKeys, generation: bootGen, report: (rep) => (planeReport = rep) });
+                                if (modelPlaneCommitted(planeReport)) {
+                                    bootPlaneEff = lkgPlane.effective;
+                                    logger.warn("config_model_plane_from_lkg", { version: r.effective.version, lkgVersion: lkgPlane.effective.version, note: "the live candidate's model plane was refused at boot — serving the LKG's model plane (catalog and the collab templates that reference it) with the live candidate's other groups; the refresh cadence re-judges the candidate" });
+                                }
+                            }
+                        }
+                        if (bootPlaneEff !== undefined)
+                            markRosterLanded(bootPlaneEff);
+                        effective = r.effective;
+                        if (bootPlaneEff !== undefined)
+                            appliedPlaneEff = bootPlaneEff;
+                        if (bootClean)
+                            latestEffective = r.effective;
+                        if (bootClean && !lkgBooted)
+                            bootLkgCandidate = { effective: r.effective, etag: r.etag };
+                        const cfgModels = (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length;
+                        logger.info("config_loaded", { source: configProvider.kind, version: r.effective.version, worker: cc?.worker ?? "(global)", models: cfgModels, ...localDirField });
+                        if (configProvider.kind === "local" && cfgModels === 0)
+                            warnLocalNoModels(r, false);
                     }
                 }
                 if (configProvider.kind === "remote")
@@ -584,17 +609,7 @@ export async function createWebAdminRuntime(ctx) {
                 logger.warn("config_apply_refused", { source: configProvider.kind, err: String(err), note: "the pulled candidate failed to apply at boot — falling back to the LKG / env; this is not a reachability failure" });
             else
                 logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
-            const lkgFallback = await bootFromLkg(`${bootApplyPhase ? "boot apply refused" : "boot fetch failed"}: ${String(err).slice(0, 120)}`, "whole");
-            if (lkgFallback) {
-                lkgBooted = true;
-                try {
-                    await bootApplyLkgInline(lkgFallback);
-                }
-                catch (applyErr) {
-                    lkgBooted = false;
-                    logger.warn("config_lkg_apply_failed", { err: String(applyErr), note: "persisted LKG failed to apply — env fallback serves" });
-                }
-            }
+            await bootFallBackWhole(`${bootApplyPhase ? "boot apply refused" : "boot fetch failed"}: ${String(err).slice(0, 120)}`);
         }
         if (!dryRun && cc !== undefined && currentIdentity() !== promptStateIdentity)
             await rebasePromptState(currentIdentity(), "boot-end");
@@ -841,32 +856,13 @@ export async function createWebAdminRuntime(ctx) {
                         if (r) {
                             const tickGen = arrival !== undefined ? useArrivalGeneration(r.effective.version, arrival.ordinal) : generationOf(r.effective.version);
                             applyLedger.seenTarget(tickGen, r.effective.version);
-                            const promptsRaw = r.effective.prompts;
-                            const promptsGate = promptsRaw !== undefined ? validatePromptsDomain(promptsRaw) : { ok: true };
-                            const badDomains = [
-                                ...new Set([...(r.domainErrors ?? []).map((de) => de.domain), ...(promptsGate.ok ? [] : ["prompts"])]),
-                            ]
-                                .sort()
-                                .join(",");
-                            if (badDomains) {
-                                if (lastRejectedCandidate?.version !== r.effective.version || lastRejectedCandidate.domains !== badDomains) {
-                                    lastRejectedCandidate = { version: r.effective.version, domains: badDomains, at: Date.now() };
-                                    logger.warn("config_candidate_rejected", {
-                                        version: r.effective.version,
-                                        domains: badDomains,
-                                        errors: [
-                                            ...(r.domainErrors ?? []).map((de) => ({ domain: de.domain, error: de.error })),
-                                            ...(promptsGate.ok ? [] : [{ domain: "prompts", error: promptsGate.error }]),
-                                        ],
-                                        ...(r.droppedEntries !== undefined ? { droppedEntries: r.droppedEntries } : {}),
-                                        lkgVersion: latestEffective?.version ?? "(env)",
-                                        note: "candidate rejected whole (§9.5-5) — live config keeps the last-known-good; fix the named files to unblock",
-                                    });
-                                }
+                            const verdict = judgeConfigCandidate(r);
+                            if (verdict.verdict === "rejected") {
+                                announceCandidateRejected(r, verdict, arrival !== undefined ? "late-boot" : "refresh");
                                 return "ok";
                             }
                             lastRejectedCandidate = undefined;
-                            warnDroppedEntries(r, "refresh");
+                            warnReadNotices(r, "refresh");
                             if (ccRef?.dryRun) {
                                 logEffectiveDiff(config, r.effective, logger);
                                 ccEtag = r.etag;
@@ -898,7 +894,7 @@ export async function createWebAdminRuntime(ctx) {
                                 if (tickPlane)
                                     appliedPlaneEff = r.effective;
                                 planeDeferredNoHandoff = undefined;
-                                await adoptCenterPrompts(r.effective, "refresh");
+                                await adoptCenterPrompts(r.effective, verdict.prompts, "refresh");
                                 if (tickPlane)
                                     markRosterLanded(r.effective);
                                 if (!fullyLandedForLkg(r, applyReport)) {
@@ -969,18 +965,12 @@ export async function createWebAdminRuntime(ctx) {
                 };
                 const deferredBootApplyInner = async (r, lateGen) => {
                     applyLedger.seenTarget(lateGen, r.effective.version);
-                    const promptsRaw = r.effective.prompts;
-                    const promptsGate = promptsRaw !== undefined ? validatePromptsDomain(promptsRaw) : { ok: true };
-                    if ((r.domainErrors ?? []).length > 0 || !promptsGate.ok) {
-                        logger.warn("config_boot_deferred_candidate_rejected", {
-                            version: r.effective.version,
-                            errors: [...(r.domainErrors ?? []).map((de) => ({ domain: de.domain, error: de.error })), ...(promptsGate.ok ? [] : [{ domain: "prompts", error: promptsGate.error }])],
-                            ...(r.droppedEntries !== undefined ? { droppedEntries: r.droppedEntries } : {}),
-                            note: "late boot pull carried an invalid candidate — env fallback keeps serving; the refresh cadence re-judges the same tree (etag not advanced)",
-                        });
+                    const lateVerdict = judgeConfigCandidate(r);
+                    if (lateVerdict.verdict === "rejected") {
+                        announceCandidateRejected(r, lateVerdict, "late-boot");
                         return;
                     }
-                    warnDroppedEntries(r, "boot-deferred");
+                    warnReadNotices(r, "boot-deferred");
                     if (ccRef?.dryRun) {
                         logEffectiveDiff(config, r.effective, logger);
                         ccEtag = r.etag;
@@ -1011,7 +1001,7 @@ export async function createWebAdminRuntime(ctx) {
                     if (latePlane)
                         appliedPlaneEff = r.effective;
                     planeDeferredNoHandoff = undefined;
-                    await adoptCenterPrompts(r.effective, "boot-deferred");
+                    await adoptCenterPrompts(r.effective, lateVerdict.prompts, "boot-deferred");
                     if (latePlane)
                         markRosterLanded(r.effective);
                     if (!fullyLandedForLkg(r, applyReportLate)) {

package/dist/capabilities/center-wiring.d.ts

@@ -7,7 +7,8 @@
  * ## 形与 present-iff
  * 整个键只在接了中心(`config.webAdmin` 在场)时出现;`lease:"absent"`(中心三件不齐 ⇒ 没装租约管理器)时 `leaseHealth` /
  * `failMode` / `caller` 三键缺席。「键缺席」于是两义:老 worker / 没接中心 —— 同一体的 `version` 能分。
- *  · `effectivePull` = 最近一次实拉成功(`lastPull === "ok"`;LKG 起服 / 从未成功 / 最近一拍失败 = false);
+ *  · `effectivePull` = 最近一次实拉中心答了(`lastPull === "ok"`):拉取失败形(拉取失败后 LKG 起服 / 从未成功 / 最近一拍失败)= false;
+ *    起服遇拒读回 LKG 且中心答了 = true(304、被候选判官整拒的拍同理);
  *  · `effectiveRevision` = 与 `/health.configAppliedVersion` 同一只 ledger 视图(`web-admin-client/pull-state.ts`);
  *  · `lease` / `leaseHealth` / `failMode` / `caller` = 租约管理器的 `snapshot()` 与生效姿态(与执行的那一只同源);
  *  · `usageReport` = 用量环装没装(装配事实:累加器与环同一只谓词 `centerLaneConfigured`);

package/dist/capabilities/composite-members.d.ts

@@ -53,6 +53,7 @@ export declare const COMPOSITE_CAPABILITY_MEMBERS: {
     readonly retention: readonly ["mode", "maxAgeDays"];
     readonly workflowsGate: readonly ["engineCan", "denial"];
     readonly sealedKey: readonly ["alg", "publicKeyId", "publicKey"];
+    readonly workspaceSync: readonly ["persist", "keep"];
 };
 type CompositeTable = typeof COMPOSITE_CAPABILITY_MEMBERS;
 /** 值的**具名成员对象臂**(标量 / 字面词 / `false` / `null` / `undefined` / 数组 / 函数臂剥掉)。 */

package/dist/capabilities/composite-members.js

@@ -14,6 +14,7 @@ export const COMPOSITE_CAPABILITY_MEMBERS = {
     retention: ["mode", "maxAgeDays"],
     workflowsGate: ["engineCan", "denial"],
     sealedKey: ["alg", "publicKeyId", "publicKey"],
+    workspaceSync: ["persist", "keep"],
 };
 export function gateCompositeMembers(body) {
     return body;

package/dist/capability-facts.d.ts

@@ -23,6 +23,7 @@ import type { ServiceConfig } from "./config.js";
 import type { OwnerAwareSessionStore } from "./security.js";
 import type { ServiceFileHistoryStore } from "./plugins/store-backend.js";
 import { resolveStreamApprovalGate } from "./tool-approval.js";
+import { type WorkspaceSyncCapability } from "./workspace-space.js";
 /** why 闭集:词 → 给运维看的一句义(诊断 / 测试读它;wire 上的拒句由各门自写)。 */
 export declare const CAPABILITY_FACT_WHY: {
     readonly run_store_absent: "no durable run store is wired (DB_BACKEND=mysql|pg|local)";
@@ -36,6 +37,7 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly session_leaf_face_absent: "the session store has no leaf-read face (sessionStorage.getLeafId)";
     readonly session_lister_absent: "no session enumerator is wired (session store or run store listSessions)";
     readonly session_fork_face_absent: "the session store has no fork face";
+    readonly session_row_faces_absent: "the session store has no session-row faces (sessionFaceOf / sessionSummaryOf / patchSessionMeta)";
     readonly session_purge_absent: "no session purge coordinator is wired";
     readonly session_policy_store_absent: "no session policy store is wired";
     readonly store_backend_absent: "no store backend is wired (DB_BACKEND=memory, multi-tenant bare boot, or half-configured SQL)";
@@ -79,6 +81,8 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly scheduler_disabled: "the self-wake scheduler is off (SCHEDULER_ENABLED)";
     readonly multi_tenant_deployment: "this is a multi-tenant deployment (REQUIRE_PRINCIPAL=true)";
     readonly not_host_lane: "the execution lane is not the single-user host lane (REMOTE_EXEC=host)";
+    readonly not_k8s_lane: "the execution lane is not the k8s pod sandbox (REMOTE_EXEC=k8s)";
+    readonly workspace_snapshot_store_absent: "no workspace snapshot store is configured (MINIO_ENDPOINT / MINIO_ACCESS_KEY / MINIO_SECRET_KEY)";
 };
 export type CapabilityFactWhy = keyof typeof CAPABILITY_FACT_WHY;
 /** 不可用臂。 */
@@ -137,6 +141,12 @@ export declare function sessionList(d: Pick<Deps, "sessionStorage" | "runStore">
 export declare function sessionFork(d: Pick<Deps, "sessionStorage">): Fact<"session_fork_face_absent" | "session_owner_face_absent", {
     sessionStorage: WithMethods<OwnerAwareSessionStore, "ownerOf" | "fork">;
 }>;
+/** 会话行可写位(`PATCH /v1/sessions/:id`):会话店的会话面(属主 + 化身一次读 —— 门判属主、写与读回按化身条件)∧ 行写口(写后按同一住客读回)。
+ *  三只 durable 店(SQL 双生 / local)都带;内存 dev 店没有 ⇒ 501。
+ *  本面**没有**独立能力位(契约附录 B.2c 登记):老 worker 对这一动词答 405,本事实为假的部署答 501。 */
+export declare function sessionPatch(d: Pick<Deps, "sessionStorage">): Fact<"session_row_faces_absent", {
+    sessionStorage: WithMethods<OwnerAwareSessionStore, "sessionFaceOf" | "patchSessionMeta">;
+}>;
 export declare function sessionDelete(d: Pick<Deps, "purgeSession" | "sessionStorage">): Fact<"session_purge_absent" | "session_owner_face_absent", {
     purge: Store<"purgeSession">;
     sessionStorage: OwnedSessionStore;
@@ -145,10 +155,12 @@ export declare function sessionPolicy(d: Pick<Deps, "sessionPolicyStore" | "sess
     policyStore: Store<"sessionPolicyStore">;
     sessionStorage: OwnedSessionStore;
 }>;
-type SyncSessionStore = WithMethods<OwnerAwareSessionStore, "ownerOf" | "exportEntries" | "exportEntriesStream" | "beginImportStaging">;
-type SessionSyncWhy = "store_backend_absent" | "session_owner_face_absent" | "file_history_store_absent" | "session_export_absent" | "session_import_staging_absent" | "policy_purge_absent";
+type SyncSessionStore = WithMethods<OwnerAwareSessionStore, "ownerOf" | "exportEntries" | "exportEntriesStream" | "beginImportStaging" | "sessionFaceOf" | "sessionSummaryOf" | "patchSessionMeta">;
+type SessionSyncWhy = "store_backend_absent" | "session_owner_face_absent" | "file_history_store_absent" | "session_export_absent" | "session_import_staging_absent" | "session_row_faces_absent" | "policy_purge_absent";
 /** 会话对等同步的**对话半族**(manifest / entries / plan / import 两相):后端 ∧ 属主面 ∧ 文件历史店 ∧ 导出两面 ∧
- *  staged 导入面 ∧ policy 店能清(overwrite-dst 的 commit 要擦目的端旧 policy 行)。文件历史的 blob 搬运是另一只事实。 */
+ *  staged 导入面 ∧ 会话行三口(manifest 带 `title` / `pinned`、导入经唯一写口按导入落定的那一位住客重放它们 —— 会话面读住客)∧
+ *  policy 店能清(overwrite-dst 的 commit 要擦目的端旧 policy 行)。
+ *  文件历史的 blob 搬运是另一只事实。 */
 export declare function sessionSync(d: Pick<Deps, "backend" | "sessionStorage" | "fileHistoryStore" | "sessionPolicyStore">): Fact<SessionSyncWhy, {
     backend: Store<"backend">;
     sessionStorage: SyncSessionStore;
@@ -290,6 +302,19 @@ export declare function workflowsJournal(d: Pick<Deps, "workflowRunStore" | "wor
     store: Store<"workflowRunStore">;
     journal: Store<"workflowJournalStore">;
 }>;
+/**
+ * k8s 车道工作区跨轮保留的有效策略 —— k8s 车道 ∧ 快照存储在场 ⇒ `{ persist, keep }`(未表态的旋钮取缺省,缺省值属主
+ * `workspace-space.ts`;`persist` 缺省 `off`,opt-in `space`)。**唯一读法**:能力位 `workspaceSync` 投影它的见证,k8s 适配器工厂(`boot/execution-env.ts`)把同一份
+ * 见证交给适配器(适配器自己不再解析策略)。`persist: "off"` 仍是 available(存储在、没开 —— 缺省或运维显式 off)—— 与缺席不同义。
+ *
+ * **为何只读配置仍恒真**:`space` 的空间按会话住客分区,住客只有一只读口 —— 会话店的 `sessionFaceOf`。会话店没有它(内存会话店)的
+ * 组合在起服时就被拒(`boot/execution-env.ts` 的 `assertWorkspaceSpaceReadable`,装配第 5 段,读的正是本事实的见证)⇒ 凡是起得来、
+ * 报 `space` 的部署都读得出住客,本事实不需要运行期依赖(再加一位 = 同一前提两处判)。剩下的「这条 run 读不到住客」是逐 run 的读失败
+ * (适配器的 `unavailable` 臂,响亮一行),不是部署形。
+ */
+export declare function workspaceSpace(c: Pick<ServiceConfig, "remoteExec">): Fact<"not_k8s_lane" | "workspace_snapshot_store_absent", {
+    policy: WorkspaceSyncCapability;
+}>;
 /** 自唤醒调度器挂在宿主 env 上:`SCHEDULER_ENABLED` ∧ 单用户 ∧ host 车道。装配(`boot/execution-env.ts`)与能力位同调。 */
 export declare function hostScheduler(c: Pick<ServiceConfig, "schedulerEnabled" | "requirePrincipal" | "remoteExec">): Fact<"scheduler_disabled" | "multi_tenant_deployment" | "not_host_lane">;
 export {};