@sema-agent/server 7.130.0 → 7.131.0

package/dist/boot/stage-10-http-server.js

@@ -103,7 +103,6 @@ export async function runStage10(ctx) {
         sessionMirrorRuling: principalCaps
             ? async (p) => (await principalCaps.executionRuling(p))?.sessionMirror
             : undefined,
-        scenarioGate: createScenarioGate({ config, scenarios, principalCaps, logger }, "peek"),
         instrumentDegenerate,
         sideQueryAccounting,
         parkedReviveSurface: parkedReviveSurface ? parkedReviveSurface : undefined,
@@ -212,7 +211,8 @@ export async function runStage10(ctx) {
     });
     const runnerFor = createHandsRunnerSelector({ full: runner, handsless: handslessRunner });
     const sideQuery = createSideQueryLane({ brain, config, getKeyResolver: () => webAdmin.getKeyResolver() });
-    const server = createHttpServer({ runner, runnerFor, sideQuery, config, resolveSpec, stores, coordinators, seams, observability, governance, deployment, knobs });
+    const scenarioGate = createScenarioGate({ config, scenarios, principalCaps, logger }, "peek");
+    const server = createHttpServer({ runner, runnerFor, sideQuery, scenarioGate, config, resolveSpec, stores, coordinators, seams, observability, governance, deployment, knobs });
     bindServerLateSeats({ config, logger, server });
     const fleetReconcile = startFleetReconciler({
         bus: fleetBus,
@@ -284,8 +284,11 @@ export async function runStage10(ctx) {
     const failoverFirstByte = buildFailoverFirstByteNotice(config);
     if (failoverFirstByte)
         logger.warn("failover_first_byte_lane", failoverFirstByte);
+    const bound = server.address();
+    if (bound === null || typeof bound === "string")
+        throw new Error(`http server listening without a TCP address (server.address() = ${JSON.stringify(bound)})`);
     logger.info("listening", {
-        port: config.port,
+        port: bound.port,
         bindHost: bindHost ?? "0.0.0.0/::(all interfaces)",
         ...(bindHost === "127.0.0.1" && !config.bindHost
             ? { bindHostNote: "auto-narrowed to loopback: write face is unauthenticated (ALLOW_UNAUTHED_WRITES with no service token). Set BIND_HOST explicitly to override." }

package/dist/capabilities/builtin-tools.js

@@ -1,7 +1,8 @@
 import { Type } from "typebox";
+import { NOW_TOOL_NAME } from "./host-tool-names.js";
 export function nowTool() {
     return {
-        name: "Now",
+        name: NOW_TOOL_NAME,
         description: "Return the current date-time as an ISO-8601 UTC string. Use when the task involves dates/deadlines/'today'.",
         effect: "read",
         parameters: Type.Object({}),

package/dist/capabilities/composite-members.d.ts

@@ -54,6 +54,7 @@ export declare const COMPOSITE_CAPABILITY_MEMBERS: {
     readonly workflowsGate: readonly ["engineCan", "denial"];
     readonly sealedKey: readonly ["alg", "publicKeyId", "publicKey"];
     readonly workspaceSync: readonly ["persist", "keep", "timeoutMs", "cache"];
+    readonly userAttachments: readonly ["entries", "kinds", "supplies", "limits"];
 };
 type CompositeTable = typeof COMPOSITE_CAPABILITY_MEMBERS;
 /** 值的**具名成员对象臂**(标量 / 字面词 / `false` / `null` / `undefined` / 数组 / 函数臂剥掉)。 */

package/dist/capabilities/composite-members.js

@@ -15,6 +15,7 @@ export const COMPOSITE_CAPABILITY_MEMBERS = {
     workflowsGate: ["engineCan", "denial"],
     sealedKey: ["alg", "publicKeyId", "publicKey"],
     workspaceSync: ["persist", "keep", "timeoutMs", "cache"],
+    userAttachments: ["entries", "kinds", "supplies", "limits"],
 };
 export function gateCompositeMembers(body) {
     return body;

package/dist/capabilities/hands-lane.js

@@ -1,5 +1,5 @@
 import { handBandEffects, judgeRuleToolName, combinePolicies, createAllowDenyPolicy } from "@sema-agent/core";
-import { NO_DECLARED_TOOL_NAMES } from "../namespaced-rule-name.js";
+import { TOOL_NAME_ROSTER } from "../namespaced-rule-name.js";
 export function withoutHands(deps) {
     const { executionEnvFactory: _handsDropped, lspManager: _lspDropped, ...rest } = deps;
     return rest;
@@ -20,7 +20,7 @@ export const HANDS_BAND_TOOL_NAMES = Object.freeze([
     "EnterWorktree",
     "ExitWorktree",
     "ListAgents",
-].filter((n, i, all) => judgeRuleToolName(n, NO_DECLARED_TOOL_NAMES).kind === "current" && all.indexOf(n) === i));
+].filter((n, i, all) => judgeRuleToolName(n, TOOL_NAME_ROSTER).kind === "current" && all.indexOf(n) === i));
 export const HANDS_DUAL_USE_TOOL_NAMES = Object.freeze(["TaskOutput", "TaskStop", "SendMessage", "AgentTranscript", "ListAgents"]);
 export const HANDS_EXCLUSIVE_TOOL_NAMES = Object.freeze(HANDS_BAND_TOOL_NAMES.filter((n) => !HANDS_DUAL_USE_TOOL_NAMES.includes(n)));
 export function handsDenyPolicy() {

package/dist/capabilities/host-tool-names.d.ts

@@ -0,0 +1,17 @@
+/**
+ * **本仓自己铸给模型的工具的名字** —— 唯一的名字源(叶模块,零依赖)。铸它们的地方(`builtin-tools.ts` / `send-user-file-tool.ts` / `select-environment-tool.ts` / `repo-tools.ts`)
+ * 与读它们的地方(工具名清单的受理判:`rule-entry-list.ts` 的名册;场景详情的工具名单;长尾延迟披露集)都从这里取,不手抄。
+ *
+ * 为什么受理口要知道它们:请求的 `allowTools` / `excludeTools` / 子代的 `allowTools` / `denyTools` 里把 `SendUserFile` 写成 `SENDUSERFILE`,引擎只在开跑时按这一 run 真挂着的名册告运维;
+ * 受理口读不到那份名册,读得到的是「引擎目录 ∪ 本仓自铸的这几只」—— 不把这几只放进名册,它们的孪生就是受理口漏掉的同一类静默失效。
+ * 宿主之外的调用方工具、MCP / A2A 对端的工具不在其中(前者本仓不挂,后者是协议名,由协议段判)。
+ */
+export declare const NOW_TOOL_NAME = "Now";
+export declare const SEND_USER_FILE_TOOL_NAME = "SendUserFile";
+export declare const SELECT_ENVIRONMENT_TOOL_NAME = "SelectEnvironment";
+export declare const REPO_TREE_TOOL_NAME = "repo_tree";
+export declare const REPO_READ_FILE_TOOL_NAME = "repo_read_file";
+export declare const REPO_PULL_DIFF_TOOL_NAME = "repo_pull_diff";
+/** 本仓自铸的全部工具名(受理口工具名清单的名册成员;加一只自铸工具 ⇒ 这里加一行)。 */
+export declare const HOST_TOOL_NAMES: ReadonlySet<string>;
+//# sourceMappingURL=host-tool-names.d.ts.map

package/dist/capabilities/host-tool-names.js

@@ -0,0 +1,15 @@
+export const NOW_TOOL_NAME = "Now";
+export const SEND_USER_FILE_TOOL_NAME = "SendUserFile";
+export const SELECT_ENVIRONMENT_TOOL_NAME = "SelectEnvironment";
+export const REPO_TREE_TOOL_NAME = "repo_tree";
+export const REPO_READ_FILE_TOOL_NAME = "repo_read_file";
+export const REPO_PULL_DIFF_TOOL_NAME = "repo_pull_diff";
+export const HOST_TOOL_NAMES = new Set([
+    NOW_TOOL_NAME,
+    SEND_USER_FILE_TOOL_NAME,
+    SELECT_ENVIRONMENT_TOOL_NAME,
+    REPO_TREE_TOOL_NAME,
+    REPO_READ_FILE_TOOL_NAME,
+    REPO_PULL_DIFF_TOOL_NAME,
+]);
+//# sourceMappingURL=host-tool-names.js.map

package/dist/capabilities/mcp-probe.js

@@ -53,7 +53,7 @@ function entryKeyIssue(entry, at) {
             scanKeyClosure(t, `${at}.transport.`, new Set(keys), NO_TOLERATED_KEYS, buckets);
     }
     if (buckets.unknown.length === 0) {
-        const refusal = requestEntryIdentityRefusal(entry);
+        const refusal = requestEntryIdentityRefusal(entry, at);
         if (refusal === undefined)
             return null;
         return refusal.errorCode === "request.body_shape" ? shapeRefusal(refusal.message) : fieldRefusal(refusal.message);
@@ -74,7 +74,7 @@ function entryValueIssue(entry, at) {
     if (dropped !== undefined || read.ok.length !== 1) {
         const field = dropped?.field ?? "entry";
         return fieldRefusal(`${at}.${field} is not a usable value${urlEchoFor(entry, field)} — this endpoint refuses the whole list rather than dialing a silently shortened one` +
-            ` (a task submission would instead drop just this declaration and mount its siblings; a probe answering "can I use these" must not quietly answer about fewer)`);
+            ` (a probe answering "can I use these" must not quietly answer about fewer)`);
     }
     if (read.badContentOrigin.length > 0) {
         return fieldRefusal(`${at}.contentOrigin must be one of ${CONTENT_ORIGIN_WORDS.map((w) => `"${w}"`).join(" | ")} — got ${describeBadContentOrigin(entry.contentOrigin)} (omit the key for the default: this server's tools classify as external content)`);
@@ -90,7 +90,7 @@ function declarationDowngradeIssue(entry, spec, at) {
         return null;
     diff.sort();
     return fieldRefusal(`${keyClosureClause(diff, "unusable value(s)")} — this deployment's declaration reader could not use these exactly as written, and a probe must not dial a configuration that differs from the one you declared` +
-        " (a task submission would instead keep the server and silently drop just these, which is why the two faces disagree here on purpose; this endpoint refuses, because the reading would then describe a server you did not ask about)");
+        " (this endpoint refuses, because the reading would then describe a server you did not ask about)");
 }
 function declaredAsJudged(entry) {
     const declared = entry;

package/dist/capabilities/repo-tools.js

@@ -1,5 +1,6 @@
 import { Type } from "typebox";
 import { z } from "zod";
+import { REPO_PULL_DIFF_TOOL_NAME, REPO_READ_FILE_TOOL_NAME, REPO_TREE_TOOL_NAME } from "./host-tool-names.js";
 export function parseRepo(input) {
     const s = input.trim().replace(/\.git$/, "");
     const m = /^[a-z]+:\/\/[^/]+\/(.+)$/i.exec(s);
@@ -160,7 +161,7 @@ export function repoToolsFor(client, coords) {
     const ref = (r) => (r ? Promise.resolve(r) : client.defaultBranch(coords));
     return [
         {
-            name: "repo_tree",
+            name: REPO_TREE_TOOL_NAME,
             description: "List file paths in the repository (recursive). Use this first to understand structure, then read specific files.",
             effect: "read",
             parameters: Type.Object({ ref: Type.Optional(Type.String({ description: "branch/tag/sha; default = repo default branch" })) }),
@@ -171,7 +172,7 @@ export function repoToolsFor(client, coords) {
             },
         },
         {
-            name: "repo_read_file",
+            name: REPO_READ_FILE_TOOL_NAME,
             description: "Read one file's text from the repository. Read only the files you need (just-in-time).",
             effect: "read",
             parameters: Type.Object({ path: Type.String(), ref: Type.Optional(Type.String()) }),
@@ -181,7 +182,7 @@ export function repoToolsFor(client, coords) {
             },
         },
         {
-            name: "repo_pull_diff",
+            name: REPO_PULL_DIFF_TOOL_NAME,
             description: "Get the unified diff of a pull request by its number (for reviewing a PR's changes).",
             effect: "read",
             parameters: Type.Object({ index: Type.Integer({ description: "the PR number" }) }),

package/dist/capabilities/scenarios.d.ts

@@ -296,16 +296,17 @@ export declare function danglingScenarioRefusal(name: string, source: ScenarioNa
  */
 export declare function gateScenarioRequest(ruling: ScenarioRuling | undefined, bodyScenario: unknown, defaultScenario: string, known: readonly string[], logger?: Logger, principal?: string): string;
 /**
- * 一条请求点名的场景名过门 —— {@link gateScenarioRequest} 的**唯一一处实参装配**。
+ * 一条请求的场景名过门 —— {@link gateScenarioRequest} 的**唯一一处实参装配**。
  *
  * 门的六个实参各有来源:中心裁定(`principalCaps.scenarioRuling`,按 principal)、请求点名的名字、部署缺省场景、**在册词表**
- * (`Object.keys(scenarios)` —— 场景表活引用,不抄快照)、日志与 principal。「这个场景能看见什么」这类问题有不止一个读面
- * (任务提交腿 `resolveSpec`、`GET /v1/capabilities/mcp?scenario=` 的状态面),每个读面自己拼一遍这六个实参 = 第二只门:
- * 两面对「在册」「放行」各判各的,读面就开始对不上 run。所以装配只在这里,读面持有的是**绑好的门**。
+ * (`Object.keys(scenarios)` —— 场景表活引用,不抄快照)、日志与 principal。「此主体在此场景能看见什么」这类问题有不止一个读口
+ * (任务提交腿 `resolveSpec`、`run-local`、`GET /v1/capabilities/mcp` 的状态面、`GET /v1/sessions/:id/mcp` / `…/a2a` 两张会话面板),
+ * 每个读口自己拼一遍这六个实参 = 第二只门:两口对「在册」「放行」「缺席取谁」各判各的,读口就开始对不上 run。
+ * 所以装配只在这里,读口持有的是**绑好的门**;凡回答这类问题的口,场景名都由门给 —— 点名与缺席都问。
  *
  * 契约:`(principal, requested) => 在册的场景名`(返回值一定在册;被拒 ⇒ 抛 {@link gateScenarioRequest} 的那几只 typed 错,
- * 读面不改写)。`requested` 非串 ⇒ 门走指派链(ruling 胜者,否则部署缺省)—— 状态面只在**请求点名了**时才问门。
- * `principalCaps` 缺席(无中心 / 干跑 / 嵌入方)⇒ 无 ruling,门退回「请求名或部署缺省」那条现状链。
+ * 读口不改写)。`requested` 非串(缺席)⇒ 门走指派链(ruling 胜者,否则部署缺省),与 run 时同一读法。
+ * `principalCaps` 缺席(无中心 / 干跑 / 嵌入方 / `run-local`)⇒ 无 ruling,门退回「请求名或部署缺省」那条现状链。
  */
 export interface ScenarioGateSources {
     readonly config: {
@@ -323,7 +324,7 @@ export type ScenarioGate = (principal: string | undefined, requested: unknown) =
 /**
  * 门问中心裁定走哪条腿(闭集;新增一词 ⇒ 下面的穷尽 `switch` 编译红)—— 与 `resolveRuntimeCaps` / `peekRuntimeCaps` 是同一对:
  *  · `enforce` —— 任务提交腿:中心裁定走执法腿,center 硬失败铸下的 fail-closed 降级项两腿都认;
- *  · `peek` —— 读面(`GET /v1/capabilities/mcp?scenario=`):只读腿,同一只缓存 / 同一条抓取 / 同一份 fail-open 判决,但硬失败铸的降级项只对读面自己算数,
+ *  · `peek` —— 读面(`GET /v1/capabilities/mcp` 状态面、`GET /v1/sessions/:id/mcp` / `…/a2a` 两张会话面板):只读腿,同一只缓存 / 同一条抓取 / 同一份 fail-open 判决,但硬失败铸的降级项只对读面自己算数,
  *    不替这个主体的真提交留下 `{allowWorkflows:false, allowFork:false, autoMode:false}` 的短窗 deny(读面不许成为别人被拒的原因)。
  */
 export type ScenarioGateLeg = "enforce" | "peek";

package/dist/capabilities/scenarios.js

@@ -2,6 +2,7 @@ import { CODE_AGENT_PROMPT, CODE_SYSTEM_PROMPT, DEFAULT_SYSTEM_PROMPT, WEB_FETCH
 import { HttpError, createCodedHttpError } from "../security.js";
 import { createSubagentExtraTools, extraToolsErrorFields, nowTool } from "./builtin-tools.js";
 import { parseRepo, repoToolsFor } from "./repo-tools.js";
+import { NOW_TOOL_NAME, REPO_PULL_DIFF_TOOL_NAME, REPO_READ_FILE_TOOL_NAME, REPO_TREE_TOOL_NAME } from "./host-tool-names.js";
 import { stablePrompt } from "./prompt.js";
 import { createWebSearchBackend, judgeRequestWebSearch } from "../plugins/web-search.js";
 import { skillsForScenario } from "./skills.js";
@@ -119,16 +120,16 @@ export function builtinScenarioDetails(scenarios, deps) {
             return fallback;
         }
     };
-    const REPO_TOOLS = ["repo_tree", "repo_read_file", "repo_pull_diff", "Now"];
+    const REPO_TOOLS = [REPO_TREE_TOOL_NAME, REPO_READ_FILE_TOOL_NAME, REPO_PULL_DIFF_TOOL_NAME, NOW_TOOL_NAME];
     const mk = (name, summary, toolset, tools, promptSummary) => ({
         name, source: "builtin", builtin: true, summary, toolset, tools, promptSummary, enabled: true,
         ...availabilityFields(deps, toolset),
     });
     const details = {
-        code: mk("code", "编码主场景([891] 出厂缺省;CC 编码 persona 蒸馏版,default 全量工具面;终验旋钮独立)", "full-body", probe("code", {}, undefined, ["Now"]), deps.brandIdentity
+        code: mk("code", "编码主场景([891] 出厂缺省;CC 编码 persona 蒸馏版,default 全量工具面;终验旋钮独立)", "full-body", probe("code", {}, undefined, [NOW_TOOL_NAME]), deps.brandIdentity
             ? "Sema 产品身份 + core 编码完全体提示词(CODE_AGENT persona+自治自检;CC 血统对表)"
             : "core 编码完全体提示词(CODE_AGENT persona+自治自检;CC 血统对表)"),
-        default: mk("default", "通用/助理场景(域中性 persona,CC agent loop 全量工具面;[891] 起非出厂缺省,显式可选)", "full-body", probe("default", {}, undefined, ["Now"]), deps.brandIdentity ? "Sema 产品身份 + core 默认宪法(结构层由引擎合成)" : "core 默认宪法(中性,无场景附加 persona)"),
+        default: mk("default", "通用/助理场景(域中性 persona,CC agent loop 全量工具面;[891] 起非出厂缺省,显式可选)", "full-body", probe("default", {}, undefined, [NOW_TOOL_NAME]), deps.brandIdentity ? "Sema 产品身份 + core 默认宪法(结构层由引擎合成)" : "core 默认宪法(中性,无场景附加 persona)"),
         "code-review": mk("code-review", "代码评审(clone-free 只读仓库工具)", "repo-readonly", probe("code-review", { repo: "probe/probe" }, undefined, REPO_TOOLS), "评审员提示词(产出契约)"),
         scan: mk("scan", "中性只读仓库扫描(输出契约由 objective+skills 决定)", "repo-readonly", probe("scan", { repo: "probe/probe" }, undefined, REPO_TOOLS), "无场景附加提示词(objective+center skills 拥有输出契约)"),
     };
@@ -149,7 +150,7 @@ export function centerScenarioDetails(specs, builtinNames, deps) {
             builtin: builtinNames.includes(spec.name),
             summary: "",
             toolset: spec.toolset,
-            tools: spec.toolset === "repo-readonly" ? ["repo_tree", "repo_read_file", "repo_pull_diff", "Now"] : ["Now"],
+            tools: spec.toolset === "repo-readonly" ? [REPO_TREE_TOOL_NAME, REPO_READ_FILE_TOOL_NAME, REPO_PULL_DIFF_TOOL_NAME, NOW_TOOL_NAME] : [NOW_TOOL_NAME],
             promptSummary: "",
             enabled: true,
             ...availabilityFields(deps, spec.toolset),

package/dist/capabilities/select-environment-tool.js

@@ -1,4 +1,5 @@
 import { Type } from "typebox";
+import { SELECT_ENVIRONMENT_TOOL_NAME } from "./host-tool-names.js";
 import { BoundedSessionMap } from "../bounded-session-map.js";
 import { resolveSandboxImageRef } from "../per-task-image.js";
 export class SessionEnvironmentSelection {
@@ -22,7 +23,7 @@ async function availableProfiles(catalog, viewer) {
 }
 export function selectEnvironmentTool(deps) {
     return {
-        name: "SelectEnvironment",
+        name: SELECT_ENVIRONMENT_TOOL_NAME,
         description: "Switch this session's sandbox environment (image profile) or discover available ones. " +
             "Call with no arguments to list available profiles and their capabilities. " +
             "Call with `profile` (optionally `capabilitiesNeeded`) to select one. " +

package/dist/capabilities/send-user-file-tool.d.ts

@@ -43,7 +43,6 @@ export declare function sendUserFileTool(deps: {
     }) => Promise<IssuedFileLink>;
     emitter: SendUserFileEmitter;
 }): ToolSpec;
-export declare const SEND_USER_FILE_TOOL_NAME = "SendUserFile";
 /**
  * The deployment's group for the delegated-child injection (`createSubagentExtraTools` in `builtin-tools.ts` composes it with
  * `Now` into the delegation tool's `extraTools` factory AND its `extraToolNames` roster — one list, read twice): SendUserFile,

package/dist/capabilities/send-user-file-tool.js

@@ -1,6 +1,7 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { Type } from "typebox";
 import { builtinAgentDefinitions } from "@sema-agent/core";
+import { SEND_USER_FILE_TOOL_NAME } from "./host-tool-names.js";
 export class SendUserFileEmitter {
     als = new AsyncLocalStorage();
     runWithContext(ctx, fn) {
@@ -19,7 +20,7 @@ export const SEND_USER_FILE_MAX_BYTES = 100 * 1024 * 1024;
 export const SEND_USER_FILE_MAX_CAPTION = 500;
 export function sendUserFileTool(deps) {
     return {
-        name: "SendUserFile",
+        name: SEND_USER_FILE_TOOL_NAME,
         description: "Send file(s) to the user — surfaced as downloadable/inline cards in their pane. " +
             "Use when the file itself is the deliverable (generated charts, reports, screenshots, build artifacts) " +
             "and you want it surfaced, not just mentioned. Files must already exist on local disk (this tool sends " +
@@ -91,7 +92,6 @@ export function sendUserFileTool(deps) {
         },
     };
 }
-export const SEND_USER_FILE_TOOL_NAME = "SendUserFile";
 const READONLY_BUILTIN_AGENT_TYPES = new Set(builtinAgentDefinitions().map((d) => d.name));
 export function subagentSendUserFileExtraTools(deps) {
     return { tools: [deps.spec], forSpawn: (ctx) => !(ctx.agentType !== undefined && READONLY_BUILTIN_AGENT_TYPES.has(ctx.agentType)) };

package/dist/capabilities/tool-defer.js

@@ -1,4 +1,5 @@
-export const LONGTAIL_DEFER_TOOLS = new Set(["SelectEnvironment"]);
+import { SELECT_ENVIRONMENT_TOOL_NAME } from "./host-tool-names.js";
+export const LONGTAIL_DEFER_TOOLS = new Set([SELECT_ENVIRONMENT_TOOL_NAME]);
 export function applyLongtailDefer(tools, enabled) {
     if (!enabled)
         return tools;

package/dist/config-catalog.js

@@ -16,7 +16,7 @@ import { MODEL_PROVIDER_WORDS } from "./model-provider.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 import { buildOutboundProxyPosture } from "./outbound-dispatcher.js";
-import { modelSupportsImages } from "./model-select.js";
+import { modelImageInput, modelReasoningDecl } from "./model-select.js";
 export const CATALOG_VALUE_TYPES = ["boolean", "number", "string", "enum", "csv", "json", "path", "url", "secret", "opaque"];
 export const CATALOG_TIMINGS = ["hot", "restart", "deploy", "inert"];
 export const CATALOG_DANGER_AXES = ["security", "billing", "data"];
@@ -303,14 +303,18 @@ export const CONFIG_CATALOG = [
     r("MODEL_FIRST_BYTE_TIMEOUT_MS", "modelPlane", "number", `请求发出 → 响应头的等待(ms;缺席 = core 缺省 + 上传宽限;到点 core 自有一次加宽重试,配了 MODEL_GATEWAY_FALLBACK_URLS 也一样(之后才切备;server 不铸 firstByteRetries);0 = 该段不设引擎钟、传输层的响应头 / 响应体钟也关(TCP + TLS 建连仍归传输层自己的钟);自托管慢网关按排队 + prefill 留足;failover 拓扑想快切须显式设小;须为 [${FIRST_BYTE_TIMEOUT_BOUNDS.minMs}, ${FIRST_BYTE_TIMEOUT_BOUNDS.maxMs}] 内十进制整数,其余拒启)`, { derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随 core 缺省(本仓不复制上游数字;core 改缺省本旋钮照映不改)", resolve: (c) => c.resilience.firstByteTimeoutMs ?? null }),
     r("MODEL_FIRST_TOKEN_TIMEOUT_MS", "modelPlane", "number", "首 token 超时(ms;0 = 该段不设引擎钟、传输层的响应体钟也关 —— 开流不吐字的唯一看门狗;自托管长 prefill 后端按此档留足)", { staticDefault: String(RESILIENCE_DEFAULTS.firstTokenTimeoutMs.value) }),
     r("MODEL_FREQUENCY_PENALTY", "modelPlane", "number", "frequency_penalty 直通(压过 EXTRA_BODY 同键)"),
-    r("MODEL_GATEWAY_BASEURL", "modelPlane", "url", "openai 兼容网关 base URL(S-623:**无出厂缺省** —— 配置能派发到的每条 openai 兼容路由都必须解析到显式端点(条目自己的 baseUrl,或本键),否则拒启 / 热路径整批拒,机读码 `config.model_route_endpoint_missing`,拒因点名条目并给出本机写法 `MODEL_GATEWAY_BASEURL=<本机网关>/v1`;anthropic 单路由部署不设本键合法;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo` —— WHATWG 禁止用带凭据的 URL 构造 fetch Request,凭据放 MODEL_API_KEY;S-483:解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`;S-514:带 `#fragment` 拒启,机读码 `config.model_route_url_fragment`)", { derivedDefaultNote: "缺席 ⇒ 本部署没有网关(不铸键);有 openai 路由落不到端点 ⇒ 拒启", configKey: "gatewayBaseUrl", center: cModels("models[].baseUrl") }),
+    r("MODEL_GATEWAY_BASEURL", "modelPlane", "url", "openai 兼容网关 base URL(S-623:**无出厂缺省** —— 将要服务的那张表(目录被采纳判目录表,否则判 env 表)里每条 openai 兼容路由都必须解析到显式端点(条目自己的 baseUrl,或本键),否则拒启 / 热路径整批拒,机读码 `config.model_route_endpoint_missing`,拒因点名条目并给出本机写法 `MODEL_GATEWAY_BASEURL=<本机网关>/v1`;anthropic 单路由部署不设本键合法;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo` —— WHATWG 禁止用带凭据的 URL 构造 fetch Request,凭据放 MODEL_API_KEY;S-483:解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`;S-514:带 `#fragment` 拒启,机读码 `config.model_route_url_fragment`)", { derivedDefaultNote: "缺席 ⇒ 本部署没有网关(不铸键);有 openai 路由落不到端点 ⇒ 拒启", configKey: "gatewayBaseUrl", center: cModels("models[].baseUrl") }),
     r("MODEL_GATEWAY_FALLBACK_URLS", "modelPlane", "url", "网关故障转移地址表(CSV;S-623:主网关 MODEL_GATEWAY_BASEURL 未设而本键设了 ⇒ 拒启,机读码 `config.gateway_fallback_without_primary` —— 备用是主网关的镜像;S-475:**逐项**判 userinfo,任一项带 ⇒ 拒启,机读码 `config.gateway_url_userinfo`;S-483:逐项判可解析性,机读码 `config.model_route_url_invalid`;S-514:**逐项**判 `#fragment`,机读码 `config.model_route_url_fragment`)", { configKey: "gatewayFallbackUrls" }),
-    r("MODEL_ID", "modelPlane", "string", "主模型 id(3.0.0 起无出厂缺省,缺 ⇒ 拒启指路)", { configKey: "model", resolve: (c) => c.model.id, center: cModels("models[].id") }),
+    r("MODEL_ID", "modelPlane", "string", "主模型 id(3.0.0 起无出厂缺省;env 表的主槽。目录被采纳时整张换掉 env 表、本键不服务,目录第一次采纳那一拍说一行 `config_env_set_but_ineffective`;目录缺席时它是兜底,两者皆无 ⇒ 拒启指路)", { configKey: "model", resolve: (c) => c.model.id, center: cModels("models[].id") }),
     r("MODEL_IDLE_TIMEOUT_MS", "modelPlane", "number", "流中静默看门狗(ms;0 = 该段不设引擎钟、传输层的响应体钟也关)", { staticDefault: String(RESILIENCE_DEFAULTS.idleTimeoutMs.value) }),
     r("MODEL_MAX_TOKENS", "modelPlane", "number", "主模型输出上限", { derivedDefaultNote: "缺席 ⇒ min(32000, contextWindow)", resolve: (c) => c.model.maxTokens ?? null, center: cModels("models[].maxTokens") }),
     r("MODEL_PRESENCE_PENALTY", "modelPlane", "number", "presence_penalty 直通"),
     r("MODEL_PROVIDER", "modelPlane", "enum", "主模型 provider(路由选 brain;S-461 起是闭集,词表外的值启动期拒启并点名机读码 `config.model_provider_invalid`)", { enumValues: MODEL_PROVIDER_WORDS, derivedDefaultNote: "缺席:ANTHROPIC base+cred 同在 ⇒ anthropic,否则 gateway", resolve: (c) => c.model.provider, center: cModels("models[].provider") }),
-    r("MODEL_REASONING", "modelPlane", "boolean", "主模型 reasoning 声明", { staticDefault: "true", resolve: (c) => c.model.reasoning ?? null, center: cModels("models[].reasoning") }),
+    r("MODEL_REASONING", "modelPlane", "boolean", "主模型 reasoning 声明(三态:true / false / 缺席 = 未声明)", {
+        derivedDefaultNote: "缺席 ⇒ 不铸 `Model.reasoning`(没有 true 缺省);引擎按真值读,缺席与 false 同读 —— 思考档不随请求发出;要开思考写 MODEL_REASONING=true。`GET /v1/models` 该行不带 `reasoning` 键",
+        resolve: (c) => modelReasoningDecl(c.model) ?? null,
+        center: cModels("models[].reasoning"),
+    }),
     r("MODEL_REASONING_EFFORT_LEVELS", "modelPlane", "csv", "openai 端点接受的思考档集(六档子集;高档 clamp-down 不 422;anthropic 腿不铸此键;未知词拒启)", {
         derivedDefaultNote: "缺席 ⇒ 不铸 compat,core 走保守梯(minimal|low|medium|high),xhigh/max 被 clamp 下来",
         resolve: (c) => {
@@ -332,7 +336,14 @@ export const CONFIG_CATALOG = [
         },
     }),
     r("MODEL_VERIFIER", "modelPlane", "string", "verify 门的异构 verifier(须命中目录;typo 回 default 并 boot warn=自评自批)", { derivedDefaultNote: "缺席/不在目录 ⇒ default(=implementer,去相关性失效警告)" }),
-    r("MODEL_VISION", "modelPlane", "boolean", "主模型 vision 声明(false = 明说不收图:带图请求的图被换成占位句交给模型,提交时计数并告警)", { staticDefault: "true", resolve: (c) => modelSupportsImages(c.model), center: cModels("models[].vision") }),
+    r("MODEL_VISION", "modelPlane", "boolean", "主模型 vision 声明(三态:true / false / 缺席 = 未声明;false = 明说不收图:带图请求的图被换成占位句交给模型,提交时计数并告警)", {
+        derivedDefaultNote: "缺席 ⇒ 不铸 `Model.input`(没有 true 缺省);引擎与带图预检都按「收」读(图原样交给模型,不出信号);`GET /v1/models` 该行不带 `vision` 键。要让预检对纯文本模型出信号写 MODEL_VISION=false",
+        resolve: (c) => {
+            const v = modelImageInput(c.model);
+            return v === "undeclared" ? null : v === "yes";
+        },
+        center: cModels("models[].vision"),
+    }),
     r("MYSQL_DATABASE", "store", "string", "MySQL 协议库名(选中该引擎时必填)", { danger: DATA }),
     r("MYSQL_HOST", "store", "string", "MySQL 协议主机(在场即算 SQL 信号,参与 DB_BACKEND 默认推导)", { danger: DATA }),
     r("MYSQL_PASSWORD", "store", "secret", "MySQL 协议口令", { danger: SEC }),

package/dist/config-invariants.js

@@ -232,8 +232,8 @@ export const CONFIG_CROSS_INVARIANTS = [
         id: "model-route-endpoint",
         keys: ["gatewayBaseUrl", "gatewayFallbackUrls", "anthropic", "models"],
         restartReason: "model-route-endpoint",
-        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:model-route-endpoint" },
-        check: ({ live, next }) => (next.models === live.models ? undefined : modelRouteEndpointRefusal(next)),
+        bootAnchor: { file: "src/boot/stage-02-web-admin-pull.ts", marker: "CROSS-INVARIANT:model-route-endpoint" },
+        check: ({ live, next }) => (next.models === live.models ? undefined : modelRouteEndpointRefusal(next, "catalog")),
     },
     {
         id: "default-model-resolvable",

package/dist/config-provider.js

@@ -149,8 +149,8 @@ export function mapToServiceEffective(eff, version) {
                 ...(m.sealedApiKey !== undefined ? { sealedApiKey: m.sealedApiKey } : {}),
                 ...(m.quotaWeight !== undefined ? { quotaWeight: m.quotaWeight } : {}),
                 tier: m.tier,
-                reasoning: m.reasoning,
-                vision: m.vision,
+                ...(m.reasoning !== undefined ? { reasoning: m.reasoning } : {}),
+                ...(m.vision !== undefined ? { vision: m.vision } : {}),
                 ...(m.contextWindow !== undefined ? { contextWindow: m.contextWindow } : {}),
                 ...(m.maxTokens !== undefined ? { maxTokens: m.maxTokens } : {}),
                 ...(typeof m.autoCompactTokens === "number" ? { autoCompactTokens: m.autoCompactTokens } : {}),

package/dist/config-types.d.ts

@@ -548,6 +548,12 @@ export interface ServiceConfigFlat {
      *
      * 🔴 **必填、无可选形**:一个 `?` 会立刻招来一条「缺席就回落 `config.model`」的臂,而那条臂正是本键
      * 要消灭的东西([ref]:同一语义面禁两个写者)。测试夹具与 `loadConfig` 一样,与 `model` 同源铸。
+     *
+     * 🔴 **同引用是契约**:env 表服务时 `model` 与 `envModel` **恒是同一个对象**(`loadConfig` 把同一只模型放进两个键)。
+     * `servedModelTableLeg`(`model-select.ts`)拿这条**引用相等**当「这个进程服务的是哪张表」的唯一状态位 —— `model` 换成目录缺省 ⇒ 不再同引用 ⇒ 服务的是目录表。
+     * 所以写口恰好两处:`config.ts` 的铸造点(两键同一个对象)与 `web-admin-client/apply-effective.ts` 的 `commitStaged`(只换 `model`,`envModel` 永不被写);
+     * 克隆模型对象、或嵌入方手搓 `ServiceConfig` 时把两键指向两只对象,这一位会被误读成「目录在服务」(拒因句选错视图、`MODEL_ID` 通告误发)。
+     * 源码钉(`test/served-model-route.test.ts` 的类钉)把这两处写口列成白名单。
      */
     envModel: Model;
     /** Model catalog by name (1.24): always `default` + the main model's id, plus an optional cheap model.

package/dist/config.d.ts

@@ -229,7 +229,7 @@ export declare function parseEnvNameAllowlist(knob: RunnerEnvNameAllowlistKnob):
  *  Shared by the env lane (main + cheap models) and the center lane (web-admin toModel). */
 export declare function applyAutoCompactWindow(m: Model, explicit?: number): "explicit" | "sonnet5" | "removed-1m" | "removed";
 /**
- * **严格名册布防**的唯一判据(boot 就绪门 `boot/web-admin.ts` 与 S-623 端点判据同调这一只)。
+ * **严格名册布防**的唯一判据(boot 就绪门 `boot/web-admin.ts` 与装配第 2 段的路由端点判官同调这一只)。
  *
  * 布防 = 远程 registry ∧ 非 dryRun ∧ `CONFIG_REQUIRE_ROSTER=true`(严格 `"true"`,直读 env、不进 ServiceConfig —— 纯
  * boot 期姿势旋钮,原判据逐字搬来,零语义变化)。布防时运维声明 env MODEL_ID 是**占位**:名册落地前计费提交 503、
@@ -332,7 +332,7 @@ export declare function unmatchableToolNamesRefusal(source: string, names: reado
  * 7.117.0(core 7.42.0)起这张表整份投 `RunnerDeps.allowedTools`(引擎 allow 层的部署成员,构造时读一次),判据是**引擎的读法**,与请求的两张
  * allow 表同一份(`rule-entry-list.ts`):
  *  ① 值不是字符串表 ⇒ 拒(env 的 CSV 恒给字符串表;判在这里是为了「值一旦换了来源,第一道判仍在」);
- *  ② 引擎读成空的条目(`compileAllowList(names, "allow", 名册 = 空集).inert` 非空 —— `*`、`mcp__*`、写路径 / 域名形、带空白或畸形的名字,以及
+ *  ② 引擎读成空的条目(`compileAllowList(names, "allow", 名册).inert` 非空 —— `*`、`mcp__*`、写路径 / 域名形、带空白或畸形的名字,以及
  *     core 7.43.0 起条目名过引擎判官读成 `tool_name` 的退役名 / 无前缀短名 / 对端段铸不出,core 7.48.0 #1400 起含工具段为空的 `mcp__<srv>__`;
  *     7.116.0–7.122.x 那一形由本仓先拒,随之退役)⇒ 拒,句子点名条目、引擎给的原因词(名字层带判词与现名)、
  *     该怎么写。请求的 allow 侧对 ② 只收通告;运维这一侧拒启:这是运维自己的配置,写错了当场改,而引擎对读成空的部署条目只在每一跑发一条通告。

package/dist/config.js

@@ -1,9 +1,9 @@
 import { readFileSync } from "node:fs";
-import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF } from "./model-select.js";
+import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, mintCapabilityKeys } from "./model-select.js";
 import { homedir } from "node:os";
 import { join, posix as posixPath } from "node:path";
 import { fileURLToPath } from "node:url";
-import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
+import { compileAllowList, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -22,7 +22,7 @@ import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat,
 import {} from "./posture-source.js";
 import { COST_QUOTA_WINDOW_SEC_RANGE, costQuotaWindowSecInRange } from "./observability/cost-quota.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
-import { describeUnmatchableRuleName, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
+import { TOOL_NAME_ROSTER, describeUnmatchableRuleName, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
 import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, centerIdentityRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
 import { declaredSemaConfigDir } from "./sema-config-dir.js";
 import { lkgPathOverrideOf } from "./config-lkg.js";
@@ -33,14 +33,14 @@ import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
-import { allowLayerEntryCountIssue, describeInertRuleEntries, inertRuleEntriesOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { MAX_NAMED_INERT_ENTRIES, allowLayerEntryCountIssue, describeInertRuleEntries, inertRuleEntriesOf, inertRuleEntryGuidance, ruleEntryListShapeOk } from "./rule-entry-list.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { httpUrlFlaws } from "@sema-agent/settings-schema";
 import { buildHttpUrlRefusal } from "./url-refusal.js";
-import { csvOf, envLaneTable, judgeModelRouteGap, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
+import { csvOf, envLaneTable, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
 import { displayListEntry } from "./list-entry-display.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 import { allowlistedEnv } from "./server-secret-env.js";
@@ -925,14 +925,14 @@ function parseModelDomain() {
         thinkingFormat: parseThinkingFormat(process.env.MODEL_THINKING_FORMAT),
     });
     const envCompat = provider === "anthropic" ? undefined : envCompatDeclared;
+    const modelCapability = { reasoning: parseBoolWord("MODEL_REASONING", process.env.MODEL_REASONING), vision: parseBoolWord("MODEL_VISION", process.env.MODEL_VISION) };
     const model = {
         id: modelId,
         name: modelId,
         api: provider === "anthropic" ? "anthropic-messages" : "openai-completions",
         provider,
         baseUrl: "",
-        reasoning: boolEnv("MODEL_REASONING", true),
-        input: boolEnv("MODEL_VISION", true) ? ["text", "image"] : ["text"],
+        ...mintCapabilityKeys(modelCapability),
         ...buildModelCostKey(buildCostOrAbsent({
             input: costEnv("MODEL_COST_INPUT", "unset"),
             output: costEnv("MODEL_COST_OUTPUT", "unset"),
@@ -983,7 +983,7 @@ function parseModelDomain() {
             ...model,
             id: cheapMintedId,
             name: cheapMintedId,
-            input: ((v) => (v === undefined ? model.input : v ? ["text", "image"] : ["text"]))(parseBoolWord("MODEL_CHEAP_VISION", process.env.MODEL_CHEAP_VISION)),
+            ...mintCapabilityKeys({ reasoning: parseBoolWord("MODEL_CHEAP_REASONING", process.env.MODEL_CHEAP_REASONING), vision: parseBoolWord("MODEL_CHEAP_VISION", process.env.MODEL_CHEAP_VISION) }),
             ...buildModelCostKey(buildCostOrAbsent({
                 input: costEnv("MODEL_CHEAP_COST_INPUT", "declares-zero"),
                 output: costEnv("MODEL_CHEAP_COST_OUTPUT", "declares-zero"),
@@ -993,7 +993,6 @@ function parseModelDomain() {
             contextWindow: numEnvOr("MODEL_CHEAP_CONTEXT_WINDOW", model.contextWindow),
             maxTokens: numEnvOr("MODEL_CHEAP_MAX_TOKENS", model.maxTokens),
             ...(optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") !== undefined ? { charsPerToken: optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") } : {}),
-            reasoning: parseBoolWord("MODEL_CHEAP_REASONING", process.env.MODEL_CHEAP_REASONING) ?? model.reasoning,
         }
         : undefined;
     const mainAct = optFinitePositiveEnv("MODEL_AUTO_COMPACT_TOKENS");
@@ -1183,8 +1182,15 @@ function findUnmatchableToolNames(names, opts) {
             out.push({ name, guidance: uncompilable });
             continue;
         }
-        if (verdict !== undefined)
+        if (verdict !== undefined) {
             out.push({ name, guidance: describeUnmatchableRuleName(verdict, subject) });
+            continue;
+        }
+        const nearMiss = compileAllowList([subject], "deny", TOOL_NAME_ROSTER).inert.find((i) => i.reason === "near_miss");
+        if (nearMiss?.currentName !== undefined) {
+            const rest = name.startsWith(subject) ? name.slice(subject.length) : "";
+            out.push({ name, guidance: inertRuleEntryGuidance({ ...nearMiss, currentName: `${nearMiss.currentName}${rest}` }) });
+        }
     }
     return out;
 }
@@ -1192,9 +1198,10 @@ export function unmatchableToolNamesRefusal(source, names, judgment) {
     const bad = findUnmatchableToolNames(names, judgment);
     if (bad.length === 0)
         return undefined;
+    const named = bad.slice(0, MAX_NAMED_INERT_ENTRIES).map((b) => `${displayListEntry(b.name)} → ${b.guidance}`).join("; ");
     const message = (`${source} has ${bad.length === 1 ? "an entry" : "entries"} that can never take effect — ${bad.length === 1 ? "it" : "each"} would never match a live tool or cannot be compiled into a rule ` +
         `(names are read exactly as written: no alias folding, no protocol prefix added): ` +
-        bad.map((b) => `${displayListEntry(b.name)} → ${b.guidance}`).join("; ")).replace(CONTROL_AND_BIDI_STRIP_RE, "");
+        (bad.length > MAX_NAMED_INERT_ENTRIES ? `${named}; and ${bad.length - MAX_NAMED_INERT_ENTRIES} more` : named)).replace(CONTROL_AND_BIDI_STRIP_RE, "");
     return { message, names: bad.map((b) => b.name) };
 }
 const APPROVAL_GRANT_ENV = "APPROVAL_GRANT";
@@ -2521,12 +2528,6 @@ export function loadConfig() {
     if (laneRequiredRefusal !== undefined) {
         throw new Error(laneRequiredRefusal);
     }
-    {
-        const routeGap = judgeModelRouteGap(process.env, { envLaneDispatchable: !isRosterGateArmed(integrations.webAdmin) });
-        if (routeGap.gap !== "none") {
-            throw new Error(routeGap.reason);
-        }
-    }
     EXEC_LANE_NOTICE = buildExecLaneNotice(orchestration.remoteExec);
     return attachConfigGroups({
         ...store,

package/dist/elicitation.d.ts

@@ -19,6 +19,13 @@ export interface ElicitationFrame {
      *  no core-stream anchor, so no `eventId` (absence is honest, not an omission); this is the frame's own time
      *  coordinate instead, same posture as the stream-approval frames' `serverNowMs`. */
     serverNowMs?: number;
+    /** "elicitation" only (additive; the same window pair `question` carries): the coordinator's OWN answer window —
+     *  at expiry the ask releases as `decline`. Minted from the SAME `ttlMs` the `setTimeout` below arms (one source), so
+     *  a form replayed from the ledger can be judged still-waiting (no `elicitation_complete` with this id ∧
+     *  `expiresAtMs` not reached) or lapsed even when the close row never landed (a lost write, a crashed replica). */
+    expiresInMs?: number;
+    /** "elicitation" only: `serverNowMs + expiresInMs` — the absolute deadline on the server's clock. */
+    expiresAtMs?: number;
 }
 /** The per-run context `onElicit` recovers via ALS. `emit` delivers a frame to the run's live stream;
  *  `abortSignal` (the run's own cancel signal) lets a run-abort promptly cancel an elicitation parked awaiting a

package/dist/elicitation.js

@@ -112,18 +112,33 @@ export class ElicitationCoordinator {
         signal?.addEventListener("abort", onAbort, { once: true });
         ctx.abortSignal?.addEventListener("abort", onAbort, { once: true });
         this.pending.set(id, { settle, owner: ctx.owner, taskId: ctx.taskId });
-        try {
-            await ctx.emit({ type: "elicitation", elicitationId: id, mcpServerName: req.server, message, ...(requestedSchema !== undefined ? { requestedSchema } : {}), mode: "form", serverNowMs: this.now() });
+        const emitted = (async () => {
+            const now = this.now();
+            return ctx.emit({ type: "elicitation", elicitationId: id, mcpServerName: req.server, message, ...(requestedSchema !== undefined ? { requestedSchema } : {}), mode: "form", serverNowMs: now, expiresInMs: this.throttle.ttlMs, expiresAtMs: now + this.throttle.ttlMs });
+        })().then(() => "ok", () => "failed");
+        const delivery = await Promise.race([emitted, answerP.then(() => "stalled")]);
+        if (delivery === "ok") {
             rc.total += 1;
             rc.lastByServer.set(req.server, t);
         }
-        catch {
+        else if (delivery === "failed") {
             recordFailOpen("server.elicitation.open-frame-undelivered", `elicitation=${id} server=${req.server}`);
             settle({ action: "decline" });
         }
         const answer = await answerP;
-        void Promise.resolve()
-            .then(() => ctx.emit({ type: "elicitation_complete", elicitationId: id, mcpServerName: req.server, action: answer.action, serverNowMs: this.now() }))
+        void emitted
+            .then((result) => {
+            if (result === "failed") {
+                if (delivery === "stalled")
+                    recordFailOpen("server.elicitation.open-frame-undelivered", `elicitation=${id} server=${req.server}`);
+                return undefined;
+            }
+            if (delivery === "stalled") {
+                rc.total += 1;
+                rc.lastByServer.set(req.server, t);
+            }
+            return ctx.emit({ type: "elicitation_complete", elicitationId: id, mcpServerName: req.server, action: answer.action, serverNowMs: this.now() });
+        })
             .catch(() => recordFailOpen("server.elicitation.complete-breadcrumb-dropped", `elicitation=${id}`));
         return answer;
     };