@sema-agent/server 7.134.0 → 7.136.0

package/dist/boot/runner-deps.js

@@ -18,7 +18,10 @@ import { buildCrossSessionInboundLayers, crossSessionDialogExpiryOf } from "../c
 import { createPeerDirectory } from "../peer-directory.js";
 import { storeFormRefusalInIncident } from "../memory-store-refusal.js";
 import { coreFileHistoryCaptureSeat } from "../file-history-capture.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { rewindFailureCode } from "../file-history-disclosure.js";
+import { errorKindOf } from "../observability/err-text.js";
+import { buildShownUrlsInText } from "../url-refusal.js";
 export function createRunnerDepsOnAsk(toolApproval) {
     if (!toolApproval)
         return undefined;
@@ -235,10 +238,10 @@ export function createRunnerDeps(ctx) {
         fileHistoryCapture: coreFileHistoryCaptureSeat(fileHistoryStore, config.fileHistoryCapture),
         permissionRuleStore: permissionRuleStore ? permissionRuleStore : undefined,
         onBackgroundChildEvent: fleetBackgroundChildPublisher(fleetBus, (msg, fields) => logger.info(msg, fields)),
-        loadProjectMemory: config.requirePrincipal !== true && config.projectMemoryEnabled
+        loadProjectMemory: !DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(config) && config.projectMemoryEnabled
             ? makeLoadProjectMemory({ logger, instructionSource: createInstructionSourceSeat(sessionStore, sharedRunnerDeps.onNotice) })
             : undefined,
-        probeInstructionSources: config.remoteExec?.provider === "host" && config.requirePrincipal !== true && config.projectMemoryEnabled
+        probeInstructionSources: DEPLOYMENT_SHAPE_PREDICATES.callerOwnsWorkerDisk.holds(config) && config.projectMemoryEnabled
             ? makeProbeInstructionSources()
             : undefined,
         ...selfOrchestrationDeps,
@@ -262,12 +265,12 @@ export function createRunnerDeps(ctx) {
                 return;
             }
             if (ctx.phase === "mcp") {
-                logger.warn("mcp_server_unavailable", { sessionId: ctx.sessionId, info: String(err) });
+                logger.warn("mcp_server_unavailable", { sessionId: ctx.sessionId, kind: errorKindOf(err), info: buildShownUrlsInText(String(err)) });
                 metrics.inc("mcp_server_unavailable_total");
                 return;
             }
             if (ctx.phase === "a2a") {
-                logger.warn("a2a_peer_unavailable", { sessionId: ctx.sessionId, info: String(err) });
+                logger.warn("a2a_peer_unavailable", { sessionId: ctx.sessionId, kind: errorKindOf(err), info: buildShownUrlsInText(String(err)) });
                 metrics.inc("a2a_peer_unavailable_total");
                 return;
             }

package/dist/boot/session-faces.d.ts

@@ -42,7 +42,7 @@ export interface SessionFacesCtx {
     approvalExemptionStore: ReturnType<StoreBackend["approvalExemption"]> | undefined;
     sessionPolicyStore: ReturnType<StoreBackend["sessionPolicy"]> | undefined;
     taskAttachmentStore: TaskAttachmentStore | undefined;
-    /** S-589:文件历史的**擦除脸**(后端在即在,与 `FILE_HISTORY_CAPTURE` 无关;只有删除类动词)。E21 删除读它,
+    /** [ref]:文件历史的**擦除脸**(后端在即在,与 `FILE_HISTORY_CAPTURE` 无关;只有删除类动词)。E21 删除读它,
      *  不读捕获脸 —— 关掉捕获的部署照样要删得掉已捕获的文件字节(旋钮只管写入,从不管擦除)。 */
     fileHistoryErasure: FileHistoryErasureFace | undefined;
     workflowCompletionInbox: WorkflowCompletionInbox | undefined;
@@ -56,10 +56,10 @@ export interface SessionFacesCtx {
      *  (`boot/stores.ts` 同段铸);缺席 = 本部署无耐久 mailbox ⇒ 无箱可退役。 */
     mailboxStore: RunnerDeps["mailboxStore"];
     mailboxRecipientLifecycle: MailboxRecipientLifecycle | undefined;
-    /** S-790 件B:后台子代的耐久店(与 `RunnerDeps.backgroundAgentStore` 同实例)—— 删除协调器据它枚举以本会话为根的子代并结束
+    /** [ref] 件B:后台子代的耐久店(与 `RunnerDeps.backgroundAgentStore` 同实例)—— 删除协调器据它枚举以本会话为根的子代并结束
      *  它们(E21 级联的一条腿,做完才删元数据)。缺席 = 本部署没有耐久后台子代(纯内存 dev);那一形只剩本进程登记表里的活行,照样停。 */
     backgroundAgentStore: RunnerDeps["backgroundAgentStore"];
-    /** S-965:用户输入受理账本的**店**(E21 级联的一条腿:该会话的受理行随会话删)。与受理 / 收敛 / 告知读的是同一只(stage-07 取一次)。
+    /** [ref]:用户输入受理账本的**店**(E21 级联的一条腿:该会话的受理行随会话删)。与受理 / 收敛 / 告知读的是同一只(stage-07 取一次)。
      *  缺席 = 本部署没装账本(env-only:没有 backend / run 店)⇒ 无行可删。 */
     userInputLedgerStore: UserInputLedgerStore | undefined;
     /** k8s 车道工作区空间的回收座(配了构建缓存卷或快照存储时在场;与托管留存 sweep 同一只)—— E21 级联的一条腿:会话删了 =

package/dist/boot/session-faces.js

@@ -7,7 +7,7 @@ import { SessionWatchRegistry, posIntEnv } from "../session-watch.js";
 import { defaultTaskRegistry, peerSessionBoxHandle } from "@sema-agent/core";
 import { reapSessionBackgroundHard } from "../background-session-reap.js";
 import { probeSessionChildren, retireSessionChildren, SessionChildrenStopIncompleteError } from "../session-children-retire.js";
-import { SessionIncarnationMissingError, redactIncarnations, sessionFaceReadOf } from "../session-incarnation.js";
+import { headReadOf, redactIncarnations } from "../session-incarnation.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 export function createSessionFaces(ctx) {
     const { config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore, resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileHistoryErasure, workflowCompletionInbox, taskListLane, deviceStore, dropSessionScoped, mailboxStore, mailboxRecipientLifecycle, backgroundAgentStore, userInputLedgerStore, spaceReclaimer, } = ctx;
@@ -15,6 +15,7 @@ export function createSessionFaces(ctx) {
     const auditPgPool = backend?.pgPool();
     const auditLocalRoot = backend?.kind === "local" ? (config.localDataRoot ?? localRoot) : undefined;
     const ownerAware = sessionStore;
+    const headOf = headReadOf(sessionStore);
     const sessionAudit = mysqlPool || auditPgPool || auditLocalRoot
         ? async (sessionId, opts) => {
             const handles = opts !== undefined && resumeAnchorStore !== undefined ? buildRewindHandles(await resumeAnchorStore.listBySession(sessionId), opts.reader) : undefined;
@@ -25,49 +26,29 @@ export function createSessionFaces(ctx) {
                     : await buildSessionAuditLocal(auditLocalRoot, sessionId, handles);
             if (!audit)
                 return undefined;
-            const [owner, placement] = await Promise.all([ownerAware.ownerOf?.(sessionId), opts !== undefined ? ownerAware.placementOf?.(sessionId) : undefined]);
+            const [head, placement] = await Promise.all([headOf?.(sessionId), opts !== undefined ? ownerAware.placementOf?.(sessionId) : undefined]);
+            const owner = head?.owner;
             const agent = sessionAgentOf(placement);
             return { ...audit, owner: owner ?? null, ...(agent !== undefined ? { agent } : {}) };
         }
         : undefined;
-    const sessionWatchRegistry = ownerAware.getHead && ownerAware.ownerOf
-        ? new SessionWatchRegistry(async (sid) => (await ownerAware.getHead(sid)) ?? { owner: undefined, leafId: null }, {
+    const sessionWatchRegistry = headOf
+        ? new SessionWatchRegistry(async (sid) => (await headOf(sid)) ?? { owner: undefined, leafId: null }, {
             hotMs: posIntEnv(process.env.SESSION_EVENTS_HOT_MS, 200),
             warmMs: posIntEnv(process.env.SESSION_EVENTS_WARM_MS, 2000),
             maxWatchedSessions: posIntEnv(process.env.SESSION_EVENTS_MAX_PROBES, 512, 100_000),
         })
         : undefined;
     setLeafAdvanceListener(sessionWatchRegistry ? (sid, leaf, owner, seq) => sessionWatchRegistry.notifyLocal(sid, leaf, owner, seq) : undefined);
-    const readSessionFace = sessionFaceReadOf(sessionStore);
-    const occupantSpaceKeyOf = async (sessionId, owner) => {
-        if (readSessionFace === undefined)
-            return undefined;
-        try {
-            const face = await readSessionFace(sessionId);
-            return face !== undefined && face.owner === owner ? face.incarnation : undefined;
-        }
-        catch (err) {
-            if (err instanceof SessionIncarnationMissingError)
-                return undefined;
-            const reason = "occupant_unreadable";
-            recordFailOpen("server.workspace-cache.reclaim-failed", `reason=${reason}`);
-            logger.warn("workspace_cache_reclaim_failed", {
-                sessionId,
-                reason,
-                error: redactIncarnations(String(err)),
-                effect: "the deleted session's space could not be read, so its build-cache volume and snapshot objects are not reclaimed (the session delete went ahead) — delete the volume by label sema.space; the objects fall to the bucket's lifecycle rule",
-            });
-            return undefined;
-        }
-    };
     const purgeSession = ownerAware.deleteSession
         ? async (sessionId, owner) => {
-            if (ownerAware.ownerOf) {
-                const stillOwner = await ownerAware.ownerOf(sessionId);
-                if (stillOwner !== owner)
+            let spaceKey;
+            if (headOf) {
+                const head = await headOf(sessionId);
+                if (head?.owner !== owner)
                     return { deleted: false };
+                spaceKey = spaceReclaimer !== undefined ? head.incarnation : undefined;
             }
-            const spaceKey = spaceReclaimer !== undefined ? await occupantSpaceKeyOf(sessionId, owner) : undefined;
             const childScope = owner ?? "default";
             const reach = await probeSessionChildren({ agentStore: backgroundAgentStore, checkpointStore, registry: defaultTaskRegistry }, sessionId, childScope);
             if (!reach.reachable) {

package/dist/boot/shutdown.d.ts

@@ -9,12 +9,12 @@
  *     时点即"从此刻起信号可被优雅处理";提前注册会让一个尚未 listen 的进程走 drain 分支。
  *  2. 三个 `process.on` 的**相对次序**保持 SIGTERM → SIGINT → SIGHUP(与原文件逐字一致);
  *     它们互不覆盖,但 handler 之间共享 `closing`/`draining` 两个 latch,次序变化会改变
- *     "第二个信号"的语义读数。S-752 起「排空期的第二发」只有**一条**判据({@link installShutdownHandlers}
+ *     "第二个信号"的语义读数。[ref] 起「排空期的第二发」只有**一条**判据({@link installShutdownHandlers}
  *     内 `onStopSignalWhileDraining`:与排空起点相隔 ≥ `drainSecondSignalMinGapMs` 才硬停),SIGTERM / SIGINT 共用。
  *  3. `clearInterval(reaper)` 必须是 hardShutdown 的第一件事(在 `server.close()` 之前),否则
  *     收尾期还会有 reaper tick 打向正在关闭的池。
- *  4. **进程级监听一律成对**([ref] 二轮件4):本函数装的六只(三信号 + [ref]① 双钩 + S-557 退出边界钩
- *     —— S-560 起后者由 {@link installProcessExitBoundary} 代装,摘除仍并进同一把手)只能经返回的
+ *  4. **进程级监听一律成对**([ref] 二轮件4):本函数装的六只(三信号 + [ref]① 双钩 + [ref] 退出边界钩
+ *     —— [ref] 起后者由 {@link installProcessExitBoundary} 代装,摘除仍并进同一把手)只能经返回的
  *     {@link ShutdownHandle} 摘 —— 调用方手写「摘三信号」的收尾会把双钩漏在进程上,而陈旧的那只
  *     rejection 钩仍握着 `process.exit(1)`,会对后续无关的 rejection 把进程打掉。
  */
@@ -84,10 +84,10 @@ export interface ShutdownCtx {
     webAdmin: {
         stopRefreshLoop(): void;
     } | undefined;
-    /** S-929:活体审批协调器(`TOOL_APPROVAL_ENABLED` 关 ⇒ 缺席)。hardShutdown 起点调它的 `drainForShutdown`:本进程握着的活卡
+    /** [ref]:活体审批协调器(`TOOL_APPROVAL_ENABLED` 关 ⇒ 缺席)。hardShutdown 起点调它的 `drainForShutdown`:本进程握着的活卡
      *  按断连同路收场、审计留有序关停记号 —— 否则下一次 boot 把有序重启读成崩溃(`crashed_before_park`)。 */
     toolApproval: ToolApprovalCoordinator | undefined;
-    /** S-929 F1:checkpoint 店的 park 提交观察层(`plugins/park-commit-watch.ts`;在场 ⇔ 本部署有 checkpoint 店)。hardShutdown 在
+    /** [ref] F1:checkpoint 店的 park 提交观察层(`plugins/park-commit-watch.ts`;在场 ⇔ 本部署有 checkpoint 店)。hardShutdown 在
      *  `backend.close()` 之前等它 quiesce —— 在飞的 `put`(审批 park / 资源挂起…,与审批协调器在不在场无关)不许被抽掉连接池。 */
     parkCommits: ParkCommitWatch | undefined;
     /** 编排器片 2 件 3:服务租约客户端(在场 ⇔ fleet 成员 ∧ 中心车道配齐)。hardShutdown 起点停它的续租定时器(文件头契约 3 同族)。 */

package/dist/boot/side-query-lane.d.ts

@@ -32,7 +32,7 @@
  * 都经 core 的座位供给 per-model 凭据,本仓不再在任何一面包 brain。
  *
  * 🔴 **poison(声明的钥匙拿不到)上抛,绝不静默回落网关 key** —— `resolveModelApiKey` 抛
- * `ModelKeyPoisonedError` 是「这个模型配了自己的钥匙(托管密钥解不开 / S-896 起 `apiKeyEnv` 变量缺席)却拿不到」的响亮态;吞成 undefined 等于用共享
+ * `ModelKeyPoisonedError` 是「这个模型配了自己的钥匙(托管密钥解不开 / [ref] 起 `apiKeyEnv` 变量缺席)却拿不到」的响亮态;吞成 undefined 等于用共享
  * 网关账号去打这只模型的上游,正是毒丸机制存在的理由(CLAUDE.md [ref] 安全轴 fail-closed)。换装后
  * 这条语义由 core 承载得更彻底:座位抛 ⇒ `runSideQuery` 的 `await` 直接上抛,brain 一个字节都没发。
  *
@@ -48,7 +48,7 @@
  * 复判 —— 部署声明了 `config.baseUrl` 而 entry URL 不在那个根上、凭据又只有部署级那一份 ⇒
  * `route.credential_mismatch` 响亮拒;连部署级凭据都没有 ⇒ `route.credential_missing`。**三面同批**
  * (主推理链 / side-query / WebFetch 摘要走的是同一只 brain 栈),旋钮 = 给模型自己的凭据(当年还有第二条:不声明
- * `config.baseUrl`,走 core 的 `"unpinned"` 快速起步姿态 —— core 7.51.0 #1531 起该姿态退役,一份部署凭据只配一个根)。
+ * `config.baseUrl`,走 core 的 `"unpinned"` 快速起步姿态 —— core 7.51.0 [ref] 起该姿态退役,一份部署凭据只配一个根)。
  * ⇒ [ref] 要的「三面同批 + 旋钮」由上游一次交齐。
  *
  * 于是本席的 `isOffRouteBaseUrl` + `recordFailOpen("server.model-key.off-route-model-uses-gateway-key")`

package/dist/boot/stage-04-stores.d.ts

@@ -15,7 +15,7 @@ export declare function runStage04(ctx: Awaited<ReturnType<typeof runStage03>>):
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
-    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
     memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
     memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;

package/dist/boot/stage-05-execution-env.d.ts

@@ -30,7 +30,7 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
-    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
     memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
     memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;

package/dist/boot/stage-05-execution-env.js

@@ -2,18 +2,18 @@ import { assertDeploymentModsAdmitted, createDeploymentMods } from "./deployment
 import { isBrandedDeployment } from "../capabilities/brand-identity.js";
 import { assertDeviceLaneWired, createDeviceLane } from "./device-lane.js";
 import { assertWorkspaceSpaceReadable, createExecutionEnv } from "./execution-env.js";
-import { incarnationReadOf } from "../session-incarnation.js";
+import { headReadOf } from "../session-incarnation.js";
 import * as facts from "../capability-facts.js";
 import { sessionStoreLabelOf } from "../store-posture.js";
 import { runStore } from "./late-binds.js";
 export async function runStage05(ctx) {
     const { backend, config, instanceId, logger, metrics, sessionStore, taskAttachmentStore } = ctx;
     const deviceLane = config.remoteExec?.provider === "device" ? createDeviceLane({ config, logger, metrics, backend, replicaId: instanceId }) : undefined;
-    const incarnationOf = incarnationReadOf(sessionStore);
+    const headOf = headReadOf(sessionStore);
     const spaceCommits = backend !== undefined ? () => runStore : undefined;
-    const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv, fenceSessionOwner, dropSessionScoped, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}), ...(spaceCommits !== undefined ? { spaceCommits } : {}), ...(incarnationOf !== undefined ? { incarnationOf } : {}) });
+    const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv, fenceSessionOwner, dropSessionScoped, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}), ...(spaceCommits !== undefined ? { spaceCommits } : {}), ...(headOf !== undefined ? { headOf } : {}) });
     assertDeviceLaneWired(config.remoteExec?.provider === "device", deviceLane, executionEnvFactory !== undefined);
-    assertWorkspaceSpaceReadable(facts.workspaceSpace(config), { incarnationOf, spaceCommits }, facts.workspaceCache(config), sessionStoreLabelOf(config.sessionBackend, backend?.kind));
+    assertWorkspaceSpaceReadable(facts.workspaceSpace(config), { headOf, spaceCommits }, facts.workspaceCache(config), sessionStoreLabelOf(config.sessionBackend, backend?.kind));
     const deploymentMods = createDeploymentMods({ metrics, ...(config.toolTrace ? { traceLogger: logger } : {}), brandIdentity: isBrandedDeployment(config) });
     if (config.toolTrace)
         logger.info("tool_trace_enabled", {});

package/dist/boot/stage-06-runners.d.ts

@@ -93,7 +93,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
-    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
     memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
     memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;

package/dist/boot/stage-06-runners.js

@@ -5,7 +5,6 @@ import { cardRuleScopeRoot } from "../task-cwd.js";
 import { ForkRoutingSessionStore } from "../plugins/fork-routing-session-store.js";
 import { withoutHands } from "../capabilities/hands-lane.js";
 import { isBrandedDeployment } from "../capabilities/brand-identity.js";
-import { redactSecrets } from "../trace/redact.js";
 import { hasServiceAuth } from "../http/server.js";
 import { operatorRosterPresent } from "../http/principal-gate.js";
 import { workflowModelAllowlistFor } from "../task-workflow.js";
@@ -183,7 +182,6 @@ export async function runStage06(ctx) {
         ? createSessionTitler({
             setTitleIfNull: titleCapable.setTitleIfNull.bind(sessionStore),
             probeTitle: titleCapable.probeTitle.bind(sessionStore),
-            redact: redactSecrets,
             llm: (o) => hookLlm({ prompt: o.prompt, timeoutMs: o.timeoutMs, model: o.model }),
             logger,
             metrics,

package/dist/boot/stage-07-capability-layer.d.ts

@@ -108,7 +108,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
-    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
     memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
     memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;

package/dist/boot/stage-08-reapers.d.ts

@@ -121,7 +121,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
-    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
     memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
     memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;

package/dist/boot/stage-09-leader.d.ts

@@ -145,7 +145,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
-    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
     memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
     memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;

package/dist/boot/stage-10-http-server.d.ts

@@ -144,7 +144,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
-    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
     memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
     memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;

package/dist/boot/stores.js

@@ -9,7 +9,7 @@ import { TiDBMemoryEngineBackend, ensureTiDBMemoryEngineSchema } from "../plugin
 import { PgMemoryHistoryStore, PgMemorySyncStore, ensurePgMemoryHistorySchema, ensurePgMemorySyncSchema } from "../plugins/memory-sync-store-pg.js";
 import { TiDBMemoryHistoryStore, TiDBMemorySyncStore, ensureTiDBMemoryHistorySchema, ensureTiDBMemorySyncSchema } from "../plugins/memory-sync-store-tidb.js";
 import { MinioBlobBackend } from "../plugins/blob-backend.js";
-import { ensureSnapshotBucket } from "../plugins/snapshot-bucket-presence.js";
+import { ensureSnapshotBuckets } from "../plugins/snapshot-bucket-presence.js";
 import { PgBackgroundAgentStore, TiDBBackgroundAgentStore, ensurePgBackgroundAgentSchema, ensureTiDBBackgroundAgentSchema } from "../plugins/background-agent-store-sql.js";
 import { PgMailboxStore, TiDBMailboxStore, ensurePgMailboxSchema, ensureTiDBMailboxSchema } from "../plugins/mailbox-store-sql.js";
 import { createDropOnlyRecipientLifecycle } from "../plugins/mailbox-recipient-lifecycle.js";
@@ -36,6 +36,7 @@ import { assertCheckpointColumnSchema } from "../plugins/checkpoint-store-sql.js
 import { assertFileHistorySchema } from "../plugins/file-history-store-sql.js";
 import { buildMemoryBoundaryLaneFacts, buildMemoryWriteBoundaryAudit, effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 import { buildMemoryPosture } from "../memory-posture.js";
+import { headReadOf } from "../session-incarnation.js";
 import { establishSqlEnginePosture, sqlPoolsOf } from "../sql-engine-posture.js";
 import { buildStorePosture } from "../store-posture.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
@@ -57,8 +58,7 @@ export async function openStores(ctx) {
     let backend;
     let storeDegradedReason;
     const dsnConfigured = !!(config.tidb || config.pg);
-    if (config.snapshotBlobStore)
-        await ensureSnapshotBucket(config.snapshotBlobStore, config.storeLockWaitMs, logger);
+    await ensureSnapshotBuckets(config, logger);
     const wantDb = config.sessionBackend === "tidb" ||
         config.dbBackend === "local" ||
         (config.sessionBackend === "auto" && dsnConfigured);
@@ -423,7 +423,7 @@ export async function openStores(ctx) {
     }
     if (backend)
         assertCloudSnapshotBlobPosture(backend.kind, config);
-    if (!config.requirePrincipal && sessionStore.ownerOf) {
+    if (!config.requirePrincipal && headReadOf(sessionStore) !== undefined) {
         logger.warn("principal_optional", {
             note: "owner-aware session store with REQUIRE_PRINCIPAL=false — owned sessions are protected, but headerless callers can create/share anonymous sessions; set REQUIRE_PRINCIPAL=true for multi-tenant",
         });

package/dist/boot/web-admin.d.ts

@@ -35,21 +35,21 @@ export interface CenterScenarioOverlayTargets {
     /** overlay 前捕获的六内建名(centerScenarioDetails 的 shadow 判据)。 */
     builtinScenarioNames: string[];
 }
-/** S-740 / S-741 / S-768:web-admin 持有的三样自报状态(fleet 心跳读它们)—— 闭集:加一样 = 写口与订阅方一起表态。 */
+/** [ref] / [ref] / [ref]:web-admin 持有的三样自报状态(fleet 心跳读它们)—— 闭集:加一样 = 写口与订阅方一起表态。 */
 export type SelfReportChange = "roster_landed" | "restart_signal" | "model_refusals";
 /** 跨段可变状态的**唯一**对外读口 + 三个原位动作。字段语义见各方法上的注释。 */
 export interface WebAdminRuntime {
     /** 配置源形态;`undefined` = 纯 env 部署(本运行时的所有分支不存在)。 */
     readonly providerKind: "remote" | "local" | undefined;
-    /** S-737:本进程模型钥匙保管店的**公钥面**(只有最新那把公钥;私钥 / 持有 id 列表 / 开箱口结构上够不着,见
+    /** [ref]:本进程模型钥匙保管店的**公钥面**(只有最新那把公钥;私钥 / 持有 id 列表 / 开箱口结构上够不着,见
      *  `sealed-key.ts` `SealedKeyPublicFace`)。present-iff boot 期建店成功 —— 建店与配置源形态无关(纯 env / 本地 / 远程
      *  三形都建),失败 ⇒ `undefined`(`sealed_key_store_unavailable` 那一行已响亮告警)。店只在 boot 建一次、进程内不换钥匙,
      *  所以这是一个值,不是 getter。唯一读者 = `GET /v1/capabilities` 的 `sealedKey` 段(stage-10 经 deps 交过去)。 */
     readonly sealedKeyPublic: SealedKeyPublicFace | undefined;
-    /** S-1907:**停驻行凭据封签器**(`sealed-key.ts` `ensureCheckpointCtxSealing`:这一域自己的保管店 `<数据根>/sealed-key/checkpoint-ctx-keys/` —— 一个域一对钥匙,
+    /** [ref]:**停驻行凭据封签器**(`sealed-key.ts` `ensureCheckpointCtxSealing`:这一域自己的保管店 `<数据根>/sealed-key/checkpoint-ctx-keys/` —— 一个域一对钥匙,
      *  与模型钥匙那只店不共用;封 = 最新公钥;开 = 按封签上的 id 精确选私钥、只认绑着本行会话的停驻行信封)。present-iff 这一域建店并自检成功(与模型钥匙店各自成败)。
      *  读者:HTTP 面(`ServiceDeps.checkpointCtxSealing`,stage-10)、leader worker 的续跑上下文(stage-09)与一次性迁移 M28(stage-06);起服第 6 段对
-     *  「checkpoint 店在、它不在」拒启。私钥、保管目录、持有 id 列表照旧够不着(S-737 的结构性那一半不变)。 */
+     *  「checkpoint 店在、它不在」拒启。私钥、保管目录、持有 id 列表照旧够不着([ref] 的结构性那一半不变)。 */
     readonly checkpointCtxSealing: CheckpointCtxSealing | undefined;
     /** core `CenterPromptSource`(RunnerDeps / subRunner 必须同实例)。 */
     readonly promptSource: CenterPromptSource;
@@ -63,18 +63,18 @@ export interface WebAdminRuntime {
      *  `limitSync`([ref] 批1)= 恒构造的两只限额座的换代口:commit 之后**零 await 内**推一把,与 pricing /
      *  keyResolver 那两件派生重建同族(缺席 = 这条腿本部署没装配,例如 run-local)。
      *  `swapRunnerDeps`(core 7.10.0 `Runner.swapDeps` 一扇门)= **可换席**的换装口,**必填**:模型面 plane
-     *  变更候选在 commit 前喂给全部 boot Runner 原子换代;S-174 起 read **face** 席也走同一只函数(见 refresh
-     *  拍里的 `applyLiveReadFace`)。S-668 波 0 起必填 —— 它缺席的那一形(模型面整面 defer 到重启 + `models-tiers`
+     *  变更候选在 commit 前喂给全部 boot Runner 原子换代;[ref] 起 read **face** 席也走同一只函数(见 refresh
+     *  拍里的 `applyLiveReadFace`)。[ref] 波 0 起必填 —— 它缺席的那一形(模型面整面 defer 到重启 + `models-tiers`
      *  重启片)在生产上从来到不了(stage-08 唯一调用点恒传),随片一起退役;要刷新环就要有 Runner 可换。
-     *  `ceilingVerdict`(S-232)= 「配了 $ 天花板但目录未定价」这条判决的活载体,与 `limitSync` **同族同序**
+     *  `ceilingVerdict`([ref])= 「配了 $ 天花板但目录未定价」这条判决的活载体,与 `limitSync` **同族同序**
      *  (commit 之后、零 await 内重判一次;判决不翻转就静默)。缺席 = 这条腿本部署没装配(run-local 一次性
      *  CLI 之后不再有刷新拍,它继续用纯判据判一次)。
-     *  `consolidationSeat`(S-668 波 0,过渡)= 整理驱动席的两侧读数口,喂 `memory-consolidation` 重启片;
+     *  `consolidationSeat`([ref] 波 0,过渡)= 整理驱动席的两侧读数口,喂 `memory-consolidation` 重启片;
      *  缺席 = 阀门关着(没有 boot 烤死的席)。
-     *  `degradeRoute`(S-794,**必填**)= 反应式降级壳的两侧读数口(brain.ts `createBrainAssembly` 的产物 `degradeRoute`,`baked` 在焊壳处
+     *  `degradeRoute`([ref],**必填**)= 反应式降级壳的两侧读数口(brain.ts `createBrainAssembly` 的产物 `degradeRoute`,`baked` 在焊壳处
      *  算好随装配交出),喂 `degrade-route` 重启片。必填而不是可选:车道没开 / 没焊壳由席自己答「两侧同为 null」,缺席没有合法含义 ——
      *  可选就是一条「接线漏了 ⇒ 片永远不签」的静默路([ref])。
-     *  `checkpointStorePresent`(S-668 波 2,**必填**)= 部署事实「本进程建没建出 checkpoint 店」(stage-06 的产物,
+     *  `checkpointStorePresent`([ref] 波 2,**必填**)= 部署事实「本进程建没建出 checkpoint 店」(stage-06 的产物,
      *  不在 ServiceConfig 里)。审批名单转热之后,热腿要用它判 ④「门意图不可服务」(与 boot 拒启同一只判据);
      *  必填 = 刷新环不可能在不知道这件事的情况下热应用审批名单。 */
     startRefreshLoop(a: {
@@ -86,11 +86,11 @@ export interface WebAdminRuntime {
         degradeRoute: DegradeRouteWatch;
         checkpointStorePresent: boolean;
     }): void;
-    /** [ref]-2:停刷新环(hardShutdown 收尾链;幂等,未起环时 no-op)。S-698:中心凭证续签器的定时器同停(同一条收尾链)。 */
+    /** [ref]-2:停刷新环(hardShutdown 收尾链;幂等,未起环时 no-op)。[ref]:中心凭证续签器的定时器同停(同一条收尾链)。 */
     stopRefreshLoop(): void;
-    /** S-698:`/health.centerCredential` 的取值口 —— 凭证来源的健康态 + 续签器状态;都健康 / 没有中心 ⇒ `undefined`(键缺席)。 */
+    /** [ref]:`/health.centerCredential` 的取值口 —— 凭证来源的健康态 + 续签器状态;都健康 / 没有中心 ⇒ `undefined`(键缺席)。 */
     centerCredentialState(): CenterCredentialHealthView | undefined;
-    /** S-667:`/health.centerIdentityNotice` 的取值口 —— 中心凭证换人后的**最近一条**通告(`center_identity_demoted` 已降到无中心配置档 / `center_identity_landed`
+    /** [ref]:`/health.centerIdentityNotice` 的取值口 —— 中心凭证换人后的**最近一条**通告(`center_identity_demoted` 已降到无中心配置档 / `center_identity_landed`
      *  新身份的配置已换上;码、冻结句与状态机见 `center-config-tier.ts`)。从未换过人 / 没有中心 ⇒ `undefined`(键缺席)。值形就是 wire 形 `{ code, message, at }`。 */
     centerIdentityNoticeState(): CenterIdentityNotice | undefined;
     /** [ref](core 5.50 [ref]):mid-turn MCP 撤销台账读口,喂 `RunnerDeps.mcpRevocations` 席。
@@ -108,7 +108,7 @@ export interface WebAdminRuntime {
     /** boot ready 门:布防(`CONFIG_REQUIRE_ROSTER=true`,远程 registry 非 dryRun)且 roster 未落地 =
      *  计费提交 503 + /health ready:false。缺省未布防 ⇒ 恒 true。 */
     modelReady(): boolean;
-    /** S-740 / S-741:本副本**自报状态**里由 web-admin 持有的那两样 —— roster 落地(`modelReady` 翻真,one-way latch)与
+    /** [ref] / [ref]:本副本**自报状态**里由 web-admin 持有的那两样 —— roster 落地(`modelReady` 翻真,one-way latch)与
      *  restart 信号(`restartState()` 出现 / 消失 / 变)—— 任一翻转的那一拍通知订阅者。装配层接 fleet 心跳的 `announceNow`,
      *  让中心在翻转当刻就知道本副本可路由 / 要重启(不等下一拍心跳;draining 那一样由收尾链直调 `announceNow`,同一个触发)。
      *  在状态**写定之后**调用,同步、逐个,入参 = 这一次翻的是哪一样(闭集 {@link SelfReportChange});不回放(订阅方在订阅前已读过
@@ -121,18 +121,18 @@ export interface WebAdminRuntime {
      *  同一只谓词)∧ 应用着的那一代 ≠ 最后确认耐久接力的那一代(接力账;合成律 `buildConfigHandoff`)。非耐久部署 / 本地腿 / 没有配置管道 ⇒ 缺席。
      *  两个事实两张脸:「要重启但扣着」归 `restart.withheld`,「声明了耐久接力而这一代没确认」归本键。 */
     configHandoffState(): ConfigHandoff | undefined;
-    /** S-768:`/health.modelRefusals` 与 fleet 心跳 `modelRefusals` 的**同一只**取值口(settings-schema 6.2.0 `ModelRefusalsSignal` 形:
+    /** [ref]:`/health.modelRefusals` 与 fleet 心跳 `modelRefusals` 的**同一只**取值口(settings-schema 6.2.0 `ModelRefusalsSignal` 形:
      *  名 → 码 + 组拒码)。描述**最近一次被判的那份中心候选目录**(每次候选 apply 的报告 `ApplyReport.modelRefusals` 投影;组拒时就是被拒
      *  的那份 —— 引擎自己的拒因表不换代)。没有可报的拒 / 没有配置管道 / 还没判过候选 ⇒ `undefined`(键缺席)。值变了 ⇒ 通知自报订阅者。 */
     modelRefusalsState(): ModelRefusalsSignal | undefined;
-    /** S-1457:`GET /v1/models.candidateRejected` 的取值口 —— 最近一次候选被判官整拒的结论(`candidateRejection` 座;域集就是判官交出的 `rejected.domains`)。
+    /** [ref]:`GET /v1/models.candidateRejected` 的取值口 —— 最近一次候选被判官整拒的结论(`candidateRejection` 座;域集就是判官交出的 `rejected.domains`)。
      *  present-iff 当前生效的配置是因判官整拒了最近一份候选而回落的那一份:后来的候选被判 clean 即撤下;还没判过候选 / 没有配置管道 ⇒ `undefined`(键缺席)。
      *  dry-run 姿势(`webAdmin.dryRun`,compare-only)恒 `undefined`:候选从不被应用,生效配置恒是 env,拒判是预演读数(日志行照响),不是配置没换的原因。 */
     candidateRejectionState(): CandidateRejection | undefined;
     /** [ref] 世代账:/health 的 target/applied/失败持续时长三键 + 诊断端点的 configApply 段(同一份读数)。
      *  `undefined` = 本部署没有配置管道(纯 env worker)⇒ 两个读面的形状**逐字不变**(additive 纪律)。 */
     configApplyState(): ConfigApplyLedgerView | undefined;
-    /** S-866 ②:caps `centerWiring.effectivePull` / `effectiveRevision` 的取值口 —— `lastPull`(新状态,只此一枚:boot 实拉 / 迟到 boot 到货 /
+    /** [ref] ②:caps `centerWiring.effectivePull` / `effectiveRevision` 的取值口 —— `lastPull`(新状态,只此一枚:boot 实拉 / 迟到 boot 到货 /
      *  refresh 拍收尾写)+ 与 `configApplyState()` **同一只** ledger 视图的已应用修订号。形与词表见 `web-admin-client/pull-state.ts`。 */
     centerPullState(): CenterPullView;
     /** DESIGN-278 §5 S2([ref]):center **当前在管**的 ServiceConfig 键集 —— `GET /v1/config/catalog` 判

package/dist/boot/web-admin.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { readFile as fsReadFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { WEB_ADMIN_ENV, formatConfigPath, skillContentHash } from "@sema-agent/settings-schema";
+import { WEB_ADMIN_ENV, formatConfigPath } from "@sema-agent/settings-schema";
 import { stableStringify } from "@sema-agent/settings-schema/hash";
 import { buildModelRefusalsSignal } from "../model-entry-refusal.js";
 import { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "@sema-agent/core";
@@ -11,8 +11,8 @@ import { applyCenterPlugins } from "../capabilities/center-plugins.js";
 import { applyCenterArtifact, centerSourceOnError, withPromptArtifactBackfill } from "../capabilities/center-prompts.js";
 import { centerScenarios, centerScenarioDetails } from "../capabilities/scenarios.js";
 import { isRosterGateArmed } from "../config.js";
-import { toolsRunOnThisHost } from "../task-cwd.js";
-import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg, legacyV1LkgPath, migrateV1Lkg } from "../config-lkg.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
+import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg } from "../config-lkg.js";
 import { answerStillCurrent, centerStateBin, credentialIdentityNow, judgeCenterCredentialAtBoot } from "../center-credential.js";
 import { createCenterConfigTier } from "../center-config-tier.js";
 import { buildCenterCredentialHealthView, createCenterCredentialRenewer } from "../center-credential-renewer.js";
@@ -21,7 +21,8 @@ import { createConfigProvider, raceBootFetch, serviceConfigSourceKind, BOOT_FETC
 import { ConfigDirUntrustedError } from "../config-dir-trust.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { buildSealedKeyPublicFace, ensureCheckpointCtxSealing, ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
-import { applyEffective, applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, mutateInPlace, logEffectiveDiff, applySkillsManifest, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, NO_CENTER_EFFECTIVE, isNoCenterEffective, fetchPromptArtifact } from "../web-admin-client/facade.js";
+import { anthropicLaneCredentialOf } from "../model-route-gap.js";
+import { applyEffective, applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, mutateInPlace, logEffectiveDiff, applySkillsManifest, skillManifestEntriesNotInstalled, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, NO_CENTER_EFFECTIVE, isNoCenterEffective, fetchPromptArtifact } from "../web-admin-client/facade.js";
 import { buildConfigHandoff, buildRestartSignal, configHandoffMissing } from "../fleet/engine-signal.js";
 import { createMcpRevocationLedger, enabledMcpEntries } from "../web-admin-client/mcp-revocation.js";
 import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "../web-admin-client/read-warnings.js";
@@ -133,7 +134,7 @@ export async function createWebAdminRuntime(ctx) {
         }
         return r;
     };
-    const sealedKeyDir = join(config.localDataRoot ?? localRoot, "sealed-key");
+    const sealedKeyDir = config.sealedKeyDir ?? join(config.localDataRoot ?? localRoot, "sealed-key");
     let sealedKeys;
     try {
         sealedKeys = await ensureSealedKeyStore(sealedKeyDir, logger);
@@ -146,6 +147,11 @@ export async function createWebAdminRuntime(ctx) {
         });
     }
     catch (err) {
+        if (config.sealedKeyDir !== undefined) {
+            throw new Error(`SEALED_KEY_DIR=${config.sealedKeyDir}: the declared model-key custody directory cannot hold a sealed-key store (${String(err)}) — ` +
+                `refusing to start rather than run with every sealed model unusable (no_key_store). Make that directory creatable, owned by ` +
+                `the service user and chmod-able to 0700 on a writable filesystem, or unset SEALED_KEY_DIR to use <data root>/sealed-key.`);
+        }
         logger.warn("sealed_key_store_unavailable", { err: String(err), note: "sealed api keys cannot be unsealed on this host — models carrying sealedApiKey will fail loud per-model" });
     }
     let checkpointCtxSealing;
@@ -153,7 +159,7 @@ export async function createWebAdminRuntime(ctx) {
         checkpointCtxSealing = await ensureCheckpointCtxSealing(sealedKeyDir, logger);
     }
     catch (err) {
-        logger.warn("checkpoint_ctx_sealing_unavailable", { err: err instanceof Error ? err.message : String(err), note: "suspended tasks' request credentials cannot be sealed on this host; with durable approvals on the boot refuses — make <data root>/sealed-key/checkpoint-ctx-keys/ creatable and chmod-able by the service, or repair / remove a key file there whose public and private halves do not belong together" });
+        logger.warn("checkpoint_ctx_sealing_unavailable", { err: err instanceof Error ? err.message : String(err), dir: join(sealedKeyDir, "checkpoint-ctx-keys"), note: "suspended tasks' request credentials cannot be sealed on this host; with durable approvals on the boot refuses — make that directory (under the sealed-key custody directory: SEALED_KEY_DIR, default <data root>/sealed-key) creatable and chmod-able by the service, or repair / remove a key file there whose public and private halves do not belong together" });
     }
     const configProvider = serviceConfigSourceKind(config) !== undefined
         ? createConfigProvider({
@@ -458,19 +464,6 @@ export async function createWebAdminRuntime(ctx) {
                 return null;
             }
             const lkgPath = lkgPathFor(identity);
-            const legacy = await migrateV1Lkg({ legacyPath: config.configLkgPath ?? legacyV1LkgPath(config, cc?.worker), binPath: lkgPath, worker: cc?.worker, identity });
-            switch (legacy.outcome) {
-                case "none":
-                    break;
-                case "migrated":
-                    logger.info("config_lkg_migrated", { from: legacy.from, retiredTo: legacy.retiredTo, to: lkgPath, note: "formatVersion 1 LKG (pull-token identity = this worker) migrated once into this credential identity's bin; the old file was renamed, not deleted" });
-                    if (legacy.retireError !== undefined)
-                        logger.warn("config_lkg_legacy_not_retired", { path: legacy.from, reason: legacy.retireError, note: "the bin was written and is used; only the old file's rename / copy failed" });
-                    break;
-                case "not-migrated":
-                    logger.warn("config_lkg_unusable", { path: legacy.path, reason: legacy.reason, note: "env fallback serves; the cache rewrites on the next clean candidate" });
-                    return null;
-            }
             const read = await loadLkg(lkgPath, cc?.worker, identity);
             if (!read.lkg) {
                 if (read.reason !== "absent")
@@ -749,7 +742,7 @@ export async function createWebAdminRuntime(ctx) {
                 const pluginOut = await applyCenterPlugins(skills, effective, {
                     cacheRoot: join(config.localDataRoot ?? join(homedir(), ".ai-agent"), "plugin-cache"),
                     allowHosts: config.pluginsAllowHosts,
-                    toolsShareThisFilesystem: toolsRunOnThisHost(config),
+                    toolsShareThisFilesystem: DEPLOYMENT_SHAPE_PREDICATES.toolsOnThisHost.holds(config),
                     logger,
                 }).catch((err) => {
                     logger.warn("center_plugins_apply_failed", { error: err instanceof Error ? err.message : String(err) });
@@ -768,12 +761,7 @@ export async function createWebAdminRuntime(ctx) {
                     return false;
                 });
                 {
-                    const enabledManifest = (bootLkgCandidate.effective.skills?.skills ?? []).filter((m) => m.enabled !== false);
-                    const canonScenarios = (a) => [...(a ?? [])].sort().join("\u0000");
-                    const liveSkillMiss = enabledManifest.some((m) => !skills.some((sk) => sk.spec.name === m.name &&
-                        skillContentHash(sk.spec.content) === m.contentHash &&
-                        sk.spec.description === m.description &&
-                        canonScenarios(sk.scenarios) === canonScenarios(m.scenarios)));
+                    const liveSkillMiss = skillManifestEntriesNotInstalled(skills, bootLkgCandidate.effective.skills?.skills ?? []).length > 0;
                     if (liveSkillMiss)
                         bootSkillStale = true;
                     if (liveSkillMiss && (bootPublished || (!lkgSurvivesRestart && lastPrewarmBodiesVerified))) {
@@ -805,7 +793,7 @@ export async function createWebAdminRuntime(ctx) {
         },
         initKeyResolver() {
             keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
-            if (process.env.ANTHROPIC_AUTH_TOKEN && !process.env.ANTHROPIC_API_KEY && (Object.keys(config.modelApiKeys).length > 0 || Object.keys(config.modelApiKeyEnv).length > 0)) {
+            if (anthropicLaneCredentialOf(config.anthropic ?? {})?.kind === "bearer" && (Object.keys(config.modelApiKeys).length > 0 || Object.keys(config.modelApiKeyEnv).length > 0)) {
                 logger.warn("per_model_key_bearer_gateway_combo", {
                     perModelKeys: Object.keys(config.modelApiKeys).length + Object.keys(config.modelApiKeyEnv).length,
                     note: "ANTHROPIC_AUTH_TOKEN (Bearer) deployment with per-model keys: core's per-call auth REPLACES the Authorization header with x-api-key for those models — a Bearer-only gateway will 401 them. Remove the per-model key for such models, or use a gateway accepting x-api-key.",

package/dist/boot/workflow-orchestration.js

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { LocalWorkflowAgentSessionIndex } from "../orchestration/workflow-agent-session-index.js";
 import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
-import { FileWorkflowCompletionInbox, InMemoryWorkflowCompletionInbox, resolveCompletionRoute } from "../orchestration/workflow-completion-inbox.js";
+import { FileWorkflowCompletionInbox, InMemoryWorkflowCompletionInbox, buildWorkflowCompleteInboxEntry, resolveCompletionRoute } from "../orchestration/workflow-completion-inbox.js";
 import { FileWorkflowNotifyJournalStore, JournalingWorkflowRunStore, WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
 import { SubagentSteerRegistry } from "../orchestration/subagent-steer.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
@@ -40,14 +40,7 @@ export function createWorkflowOrchestration(ctx) {
             const route = await resolveCompletionRoute(p, getRunStore() ? (id) => getRunStore().getRun(id) : undefined, config.requirePrincipal === true);
             if (!route)
                 return;
-            await workflowCompletionInbox.enqueue({
-                sessionId: route.sessionId,
-                owner: route.owner,
-                runId: p.runId,
-                status: p.status,
-                summary: p.summary,
-                enqueuedAt: Date.now(),
-            });
+            await workflowCompletionInbox.enqueue(buildWorkflowCompleteInboxEntry(route, p, Date.now()));
         }
         catch (err) {
             logger.warn("workflow_completion_enqueue_failed", { runId: p.runId, err: String(err) });