@sema-agent/server 7.139.0 → 7.140.0

package/dist/boot/stage-09-leader.d.ts

@@ -172,16 +172,12 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     instanceId: string;
     mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
-    memoryEngine: {
-        backend: import("@sema-agent/core").MemoryBackend;
-        root: string;
-    } | undefined;
-    memoryExportBackend: import("@sema-agent/core").MemoryBackend | undefined;
+    memoryEngine: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
+    memoryExportStores: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
     memoryPosture: import("../memory-posture.js").MemoryPosture;
     memorySyncCursors: import("../plugins/memory-sync-store-pg.js").MemorySyncStore | undefined;
     memorySyncRunner: import("../memory-sync-client.js").MemorySyncRunner | undefined;
     rosterStore: import("@sema-agent/core").RosterStore | undefined;
-    sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
     sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
     sessionStore: import("@sema-agent/core").SessionStore<import("@sema-agent/core").SessionStoreSummary, import("@sema-agent/core").SessionListQuery>;
     sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;

package/dist/boot/stage-10-http-server.d.ts

@@ -171,16 +171,12 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     instanceId: string;
     mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
-    memoryEngine: {
-        backend: import("@sema-agent/core").MemoryBackend;
-        root: string;
-    } | undefined;
-    memoryExportBackend: import("@sema-agent/core").MemoryBackend | undefined;
+    memoryEngine: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
+    memoryExportStores: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
     memoryPosture: import("../memory-posture.js").MemoryPosture;
     memorySyncCursors: import("../plugins/memory-sync-store-pg.js").MemorySyncStore | undefined;
     memorySyncRunner: import("../memory-sync-client.js").MemorySyncRunner | undefined;
     rosterStore: import("@sema-agent/core").RosterStore | undefined;
-    sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
     sessionCaptureRecords: import("../plugins/store-backend.js").SessionCaptureRecordSource | undefined;
     sessionStore: import("@sema-agent/core").SessionStore<import("@sema-agent/core").SessionStoreSummary, import("@sema-agent/core").SessionListQuery>;
     sqlEngine: import("../plugins/sql-driver.js").SqlEngineReading | undefined;

package/dist/boot/stage-10-http-server.js

@@ -7,6 +7,7 @@ import { isPricingConfigured } from "../budget.js";
 import { createHandsRunnerSelector } from "../capabilities/hands-lane.js";
 import { createHttpServer } from "../http/server.js";
 import { exportMemoryScope } from "../memory-export.js";
+import { memoryStoreForRequest } from "../memory-scope-stores.js";
 import { performMemorySync } from "../memory-sync.js";
 import { backgroundAgentOutput, taskHandleOutput, taskHandleStop } from "../runs.js";
 import { createStoreLiveProbe } from "../store-live-probe.js";
@@ -29,7 +30,7 @@ import { bindServerLateSeats } from "./late-binds.js";
 import { serviceVersion } from "../service-version.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export async function runStage10(ctx) {
-    const { peerDesk, approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, config, webAdmin, consolidationValve, costQuota, deploymentModsLoaded, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, loadedSkills, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, memorySyncRunner, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, sandboxGitPlane, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngine, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowParkDecisions, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate } = ctx;
+    const { peerDesk, approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, config, webAdmin, consolidationValve, costQuota, deploymentModsLoaded, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, loadedSkills, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportStores, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, memorySyncRunner, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, sandboxGitPlane, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngine, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowParkDecisions, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate } = ctx;
     const stores = {
         runStore,
         resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
@@ -86,9 +87,9 @@ export async function runStage10(ctx) {
         subagentTaskOutput: (handle, access) => backgroundAgentOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
         taskHandleOutput: (handle, access) => taskHandleOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
         taskHandleStop: (handle, access) => taskHandleStop(defaultTaskRegistry, handle, access, backgroundAgentStore),
-        memoryExport: memoryExportBackend ? (scope) => exportMemoryScope(memoryExportBackend, scope) : undefined,
-        memorySync: memoryExportBackend && memorySyncCursors
-            ? (scope, syncReq) => performMemorySync(memoryExportBackend, memorySyncCursors, scope, syncReq)
+        memoryExport: memoryExportStores ? (scope) => exportMemoryScope(memoryStoreForRequest(memoryExportStores, [scope]), scope) : undefined,
+        memorySync: memoryExportStores && memorySyncCursors
+            ? (scope, syncReq) => performMemorySync(memoryStoreForRequest(memoryExportStores, [scope]), memorySyncCursors, scope, syncReq)
             : undefined,
         memoryBundleExport: memoryBundleFaces ? memoryBundleFaces.exportScopes : undefined,
         memoryBundleImport: memoryBundleFaces ? memoryBundleFaces.importBundle : undefined,

package/dist/boot/stores.d.ts

@@ -1,4 +1,3 @@
-import { type MemoryBackend } from "@sema-agent/core";
 import type { ServiceConfig } from "../config.js";
 import { type MemorySyncRunner } from "../memory-sync-client.js";
 import type { Logger } from "../observability/logger.js";
@@ -7,6 +6,7 @@ import { type MemorySyncStore } from "../plugins/memory-sync-store-pg.js";
 import { type MailboxRecipientLifecycle } from "../plugins/mailbox-recipient-lifecycle.js";
 import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import { type StoreBackend } from "../plugins/store-backend.js";
+import { type MemoryScopeStores } from "../memory-scope-stores.js";
 export interface OpenStoresCtx {
     config: ServiceConfig;
     logger: Logger;
@@ -24,10 +24,7 @@ export declare function assertApprovalAskRuleMaterialOnBackend(backend: StoreBac
 export declare function openStores(ctx: OpenStoresCtx): Promise<{
     backend: StoreBackend | undefined;
     storePosture: import("../store-posture.js").StorePosture;
-    memoryEngine: {
-        backend: MemoryBackend;
-        root: string;
-    } | undefined;
+    memoryEngine: MemoryScopeStores | undefined;
     engineDataRoot: string;
     memorySyncCursors: MemorySyncStore | undefined;
     rosterStore: import("@sema-agent/core").RosterStore | undefined;
@@ -35,7 +32,7 @@ export declare function openStores(ctx: OpenStoresCtx): Promise<{
     mailboxRecipientLifecycle: MailboxRecipientLifecycle | undefined;
     taskAttachmentStore: TaskAttachmentStore | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
-    memoryExportBackend: MemoryBackend | undefined;
+    memoryExportStores: MemoryScopeStores | undefined;
     memorySyncRunner: MemorySyncRunner | undefined;
     sessionStore: import("@sema-agent/core").SessionStore<import("@sema-agent/core").SessionStoreSummary, import("@sema-agent/core").SessionListQuery>;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;

package/dist/boot/stores.js

@@ -1,7 +1,7 @@
 import { join } from "node:path";
 import { FileBackgroundAgentStore, FileMailboxStore, FileRosterStore, InMemoryUsageWindowStore, mailboxCrossProcessMountVerdict } from "@sema-agent/core";
 import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
-import { buildMemorySyncEnabledFields, createMemorySyncRunner, createMemorySyncTransport } from "../memory-sync-client.js";
+import { startMemorySyncRunner } from "../memory-sync-client.js";
 import { memoryEmbedderFor } from "../plugins/memory-embedder.js";
 import { ensurePgMemoryEmbedderMetaSchema, reconcileEmbedderFingerprint } from "../plugins/memory-embedder-fingerprint.js";
 import { PgMemoryEngineBackend, ensurePgMemoryEngineSchema } from "../plugins/memory-engine-pg.js";
@@ -10,10 +10,10 @@ import { PgMemoryHistoryStore, PgMemorySyncStore, ensurePgMemoryHistorySchema, e
 import { TiDBMemoryHistoryStore, TiDBMemorySyncStore, ensureTiDBMemoryHistorySchema, ensureTiDBMemorySyncSchema } from "../plugins/memory-sync-store-tidb.js";
 import { MinioBlobBackend } from "../plugins/blob-backend.js";
 import { ensureSnapshotBuckets } from "../plugins/snapshot-bucket-presence.js";
-import { PgBackgroundAgentStore, TiDBBackgroundAgentStore, ensurePgBackgroundAgentSchema, ensureTiDBBackgroundAgentSchema } from "../plugins/background-agent-store-sql.js";
+import { PgBackgroundAgentStore, TiDBBackgroundAgentStore, ensurePgBackgroundAgentSchema, ensureTiDBBackgroundAgentSchema } from "../stores-sql/background-agent-store-sql.js";
 import { PgMailboxStore, TiDBMailboxStore, ensurePgMailboxSchema, ensureTiDBMailboxSchema } from "../plugins/mailbox-store-sql.js";
 import { createDropOnlyRecipientLifecycle } from "../plugins/mailbox-recipient-lifecycle.js";
-import { PgUsageWindowStore, TiDBUsageWindowStore, ensurePgUsageWindowSchema, ensureTiDBUsageWindowSchema } from "../plugins/usage-window-store-sql.js";
+import { PgUsageWindowStore, TiDBUsageWindowStore, ensurePgUsageWindowSchema, ensureTiDBUsageWindowSchema } from "../stores-sql/usage-window-store-sql.js";
 import { PgRosterStore, TiDBRosterStore, ensurePgRosterSchema, ensureTiDBRosterSchema } from "../plugins/roster-store-sql.js";
 import { LocalTaskAttachmentStore } from "../plugins/local-task-attachment-store.js";
 import { PgTaskAttachmentStore, TiDBTaskAttachmentStore, ensurePgTaskAttachmentSchema, ensureTiDBTaskAttachmentSchema } from "../plugins/task-attachment-store.js";
@@ -27,14 +27,15 @@ import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback } from "..
 import { createMemoryEngineIncidentSink } from "../memory-incident-sink.js";
 import { announceLockedLegacyMemoryLayers } from "../memory-layer-legacy-lock.js";
 import { createEngineNoticeForwarder } from "./runner-deps.js";
-import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLanePosture, memoryEngineRootFor, memoryMountRootOf } from "../memory-scope.js";
+import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLanePosture, memoryEngineRootFor, memoryLayersNamedBy, memoryMountRootOf } from "../memory-scope.js";
+import { createMemoryScopeStores } from "../memory-scope-stores.js";
 import { assertToolResultProvenanceSchema } from "../plugins/tool-result-store-sql.js";
 import { assertPermissionRuleApprovalSchema, assertPermissionRuleTicketSchema } from "../plugins/permission-rule-store-sql.js";
 import { assertApprovalAskRuleMaterialSchema } from "../plugins/approval-ask-store-sql.js";
 import { assertSchemaMatchesCode } from "../plugins/schema-consistency.js";
 import { assertCheckpointColumnSchema } from "../plugins/checkpoint-store-sql.js";
 import { assertFileHistorySchema } from "../plugins/file-history-store-sql.js";
-import { buildMemoryBoundaryLaneFacts, buildMemoryWriteBoundaryAudit, effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
+import { buildMemoryBoundaryLaneFacts, buildMemoryWriteBoundaryAudit } from "./memory-boundary.js";
 import { buildMemoryPosture } from "../memory-posture.js";
 import { headReadOf } from "../session-incarnation.js";
 import { establishSqlEnginePosture, sqlPoolsOf } from "../sql-engine-posture.js";
@@ -50,7 +51,7 @@ export async function assertApprovalAskRuleMaterialOnBackend(backend) {
     if (pgPool)
         await assertApprovalAskRuleMaterialSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
     else if (mysqlPool)
-        await assertApprovalAskRuleMaterialSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+        await assertApprovalAskRuleMaterialSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "mysql");
 }
 export async function openStores(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
@@ -74,25 +75,25 @@ export async function openStores(ctx) {
         if (pgPool)
             await assertToolResultProvenanceSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
         else if (mysqlPool)
-            await assertToolResultProvenanceSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+            await assertToolResultProvenanceSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "mysql");
         if (pgPool)
             await assertCheckpointColumnSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
         else if (mysqlPool)
-            await assertCheckpointColumnSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+            await assertCheckpointColumnSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "mysql");
         if (config.permissionRulesEnabled) {
             if (pgPool)
                 await assertPermissionRuleApprovalSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
             else if (mysqlPool)
-                await assertPermissionRuleApprovalSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+                await assertPermissionRuleApprovalSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "mysql");
             if (pgPool)
                 await assertPermissionRuleTicketSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
             else if (mysqlPool)
-                await assertPermissionRuleTicketSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+                await assertPermissionRuleTicketSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "mysql");
         }
         if (pgPool)
             await assertFileHistorySchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
         else if (mysqlPool)
-            await assertFileHistorySchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+            await assertFileHistorySchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "mysql");
     }
     if (backend)
         await runAndLogOneTimeMigrations(logger, backend);
@@ -115,6 +116,8 @@ export async function openStores(ctx) {
         config.sessionBackend = "tidb";
     let memoryEngine;
     const engineDataRoot = memoryEngineRootFor(config, localRoot);
+    const memoryEngineIncident = createMemoryEngineIncidentSink({ logger, metrics });
+    const scopeStoresOver = (deployment) => createMemoryScopeStores({ backend: deployment, root: engineDataRoot, namedLayers: () => memoryLayersNamedBy(config), onIncident: memoryEngineIncident });
     let memorySyncCursors;
     let vectorMode;
     if (config.memoryEngineBackend !== "file" && config.memoryEngineEnabled) {
@@ -165,7 +168,7 @@ export async function openStores(ctx) {
                 ...(embedder !== undefined ? { embedder } : {}),
             });
             vectorMode = pgMem.vectorMode;
-            memoryEngine = { backend: pgMem, root: engineDataRoot };
+            memoryEngine = scopeStoresOver(pgMem);
         }
         else {
             const pool = backend?.mysqlPool();
@@ -177,7 +180,7 @@ export async function openStores(ctx) {
             memorySyncCursors = new TiDBMemorySyncStore(pool);
             const tidbMem = new TiDBMemoryEngineBackend(pool, { history: countedHistorySink(new TiDBMemoryHistoryStore(pool)) });
             vectorMode = tidbMem.vectorMode;
-            memoryEngine = { backend: tidbMem, root: engineDataRoot };
+            memoryEngine = scopeStoresOver(tidbMem);
         }
         logger.info("memory_engine_enabled", {
             enabled: true,
@@ -189,7 +192,8 @@ export async function openStores(ctx) {
         });
     }
     else {
-        memoryEngine = memoryEngineBackendFor(config, undefined, createMemoryEngineIncidentSink({ logger, metrics }));
+        const fileEngine = memoryEngineBackendFor(config, undefined, memoryEngineIncident);
+        memoryEngine = fileEngine !== undefined ? scopeStoresOver(fileEngine.backend) : undefined;
         if (memoryEngine)
             announceLockedLegacyMemoryLayers(memoryMountRootOf(memoryEngine.backend, memoryEngine.root), createEngineNoticeForwarder(logger));
         if (memoryEngine && process.env.LOCAL_DATA_ROOT && !config.memoryEngineDir) {
@@ -205,17 +209,11 @@ export async function openStores(ctx) {
         const audit = buildMemoryWriteBoundaryAudit({
             memoryRoot: memoryMountRoot,
             ...laneFacts,
-            declaredCapable: effectiveMemoryPersistenceCapable(config),
+            declaredCapable: config.memoryPersistenceCapable,
             engineBackend: config.memoryEngineBackend,
         });
         for (const w of audit.warnings)
             logger.warn(w.tag, { detail: w.detail, lane: laneFacts.lane, root: memoryMountRoot ?? null });
-        if (config.memoryPersistenceCapable === undefined && effectiveMemoryPersistenceCapable(config) === true) {
-            logger.info?.("memory_persistence_capable_auto_declared", {
-                lane: laneFacts.lane,
-                detail: "REMOTE_EXEC=host: file tools run on this machine's filesystem, so the assembler declares memoryPersistenceCapable=true (the core-side remote-env withhold would otherwise silently drop the memory WRITE instruction on this lane). Override with MEMORY_PERSISTENCE_CAPABLE=true|false.",
-            });
-        }
     }
     let rosterStore;
     {
@@ -236,7 +234,7 @@ export async function openStores(ctx) {
             });
         }
         if (rosterStore)
-            logger.info("roster_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "tidb" : "file" });
+            logger.info("roster_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "mysql" : "file" });
     }
     let backgroundAgentStore;
     {
@@ -255,7 +253,7 @@ export async function openStores(ctx) {
             backgroundAgentStore = new FileBackgroundAgentStore(config.localDataRoot ?? localRoot);
         }
         if (backgroundAgentStore)
-            logger.info("background_agent_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "tidb" : "file" });
+            logger.info("background_agent_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "mysql" : "file" });
     }
     let taskAttachmentStore;
     {
@@ -285,7 +283,7 @@ export async function openStores(ctx) {
             taskAttachmentStore = new LocalTaskAttachmentStore(config.localDataRoot ?? localRoot);
         }
         if (taskAttachmentStore)
-            logger.info("task_attachment_store_enabled", { backend: pgPool ? "pg+minio" : mysqlPool ? "tidb+minio" : "file", maxBytes: config.attachmentMaxBytes });
+            logger.info("task_attachment_store_enabled", { backend: pgPool ? "pg+minio" : mysqlPool ? "mysql+minio" : "file", maxBytes: config.attachmentMaxBytes });
     }
     let mailboxStore;
     let mailboxRecipientLifecycle;
@@ -313,7 +311,7 @@ export async function openStores(ctx) {
         if (mailboxStore) {
             const laneVerdict = mailboxCrossProcessMountVerdict(mailboxStore);
             logger.info("mailbox_store_enabled", {
-                backend: pgPool ? "pg" : mysqlPool ? "tidb" : "file",
+                backend: pgPool ? "pg" : mysqlPool ? "mysql" : "file",
                 crossProcessSafe: mailboxStore.crossProcessSafe,
                 recipientTombstones: pgPool !== undefined || mysqlPool !== undefined,
                 peerLaneMountable: laneVerdict.ok,
@@ -339,9 +337,9 @@ export async function openStores(ctx) {
         else {
             usageWindowStore = new InMemoryUsageWindowStore();
         }
-        logger.info("usage_window_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "tidb" : backend?.fileUsageWindowStore !== undefined ? "file" : "memory", windows: config.usageWindows.length });
+        logger.info("usage_window_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "mysql" : backend?.fileUsageWindowStore !== undefined ? "file" : "memory", windows: config.usageWindows.length });
     }
-    const memoryExportBackend = config.memoryEngineBackend !== "file" ? memoryEngine?.backend : undefined;
+    const memoryExportStores = config.memoryEngineBackend !== "file" ? memoryEngine : undefined;
     const memoryLane = memoryEngineRemoteLanePosture(config);
     const memoryPosture = buildMemoryPosture({
         config,
@@ -363,18 +361,7 @@ export async function openStores(ctx) {
     let memorySyncRunner;
     if (config.memorySync) {
         if (memoryEngine) {
-            const transport = createMemorySyncTransport({ url: config.memorySync.url, token: config.memorySync.token });
-            memorySyncRunner = createMemorySyncRunner({
-                backend: memoryEngine.backend,
-                scope: config.memorySync.scope,
-                memoryRoot: memoryEngine.root,
-                transport,
-                log: logger,
-                ...(config.memorySync.maxPushEntries !== undefined ? { maxPushEntries: config.memorySync.maxPushEntries } : {}),
-                ...(config.memorySync.maxPullEntries !== undefined ? { maxPullEntries: config.memorySync.maxPullEntries } : {}),
-            });
-            logger.info("memory_sync_enabled", buildMemorySyncEnabledFields(transport.peer, config.memorySync.scope, memorySyncRunner.cursorPathFor(config.memorySync.scope)));
-            memorySyncRunner.trigger("boot");
+            memorySyncRunner = startMemorySyncRunner({ sync: config.memorySync, stores: memoryEngine, log: logger });
         }
         else {
             logger.warn("memory_sync_configured_but_memory_dark", { note: "MEMORY_SYNC_URL is set but the file memory engine is dark (multi-tenant / MEMORY_ENGINE=off / remote exec lane) — no sync rounds will run" });
@@ -444,7 +431,7 @@ export async function openStores(ctx) {
         : undefined;
     return {
         backend, storePosture, memoryEngine, engineDataRoot, memorySyncCursors, rosterStore, backgroundAgentStore, mailboxRecipientLifecycle,
-        taskAttachmentStore, mailboxStore, memoryExportBackend, memorySyncRunner, sessionStore, breakerState,
+        taskAttachmentStore, mailboxStore, memoryExportStores, memorySyncRunner, sessionStore, breakerState,
         usageWindowStore, memoryPosture, taskListLane, sqlEngine,
     };
 }

package/dist/boot/task-list-lane.d.ts

@@ -38,7 +38,7 @@ import type { Logger } from "../observability/logger.js";
 /** 同时活着的会话清单实例上限(LRU,逐最老)。与 perSessionCwd/perSessionShellEnv 同量级。 */
 export declare const MAX_TASK_LIST_SESSIONS = 4096;
 /** 车道实际落到哪个后端(启动日志 + 测试对表)。 */
-export type TaskListLaneBackend = "tidb" | "pg" | "memory";
+export type TaskListLaneBackend = "mysql" | "pg" | "memory";
 export interface TaskListLane {
     /** `sessionId ↦ 该会话的任务清单店`。同 sessionId 恒解析到同一份清单(SQL 形 = 同一批行;
      *  memory 形 = 同一只实例)。 */

package/dist/boot/task-list-lane.js

@@ -16,7 +16,7 @@ export function createTaskListLane(opts = {}) {
         purge = (sessionId) => deletePgTaskList(pgPool, taskListKeyFor(sessionId));
     }
     else if (mysqlPool) {
-        backend = "tidb";
+        backend = "mysql";
         mint = (sessionId) => createTiDBTaskListStore(mysqlPool, taskListKeyFor(sessionId));
         purge = (sessionId) => deleteTiDBTaskList(mysqlPool, taskListKeyFor(sessionId));
     }

package/dist/boot/web-admin.js

@@ -31,6 +31,14 @@ import { SHA256_HEX_RE } from "../digest-form.js";
 import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../web-admin-client/apply-ledger.js";
 import { announceReadDenyRows, buildDeploymentPostureSeats } from "./runner-deps.js";
 import { echoCallerText } from "../caller-text-echo.js";
+const MODELS_REJECTION_PHRASE = {
+    domain_invalid: "models 域判形失败",
+    empty: "读不出(空 / 纯空白:半写或截断)",
+    invalid_json: "读不出(不是合法的 JSON)",
+    not_object: "读不出(解析出来不是 JSON 对象:null / 数组 / 标量)",
+    io: "读不出(文件读失败:权限、路径是目录或 I/O 错误)",
+    retired_domain: "是带事实的退役域文档",
+};
 function lkgReadNote(scope) {
     switch (scope) {
         case "whole":
@@ -202,6 +210,22 @@ export async function createWebAdminRuntime(ctx) {
         noteCandidateVerdict(ordinal, candidateRejectionOf(r, verdict, candidateSource().kind, Date.now()));
         logger.warn("config_candidate_rejected", buildCandidateRejectedFields(r, verdict, leg, { lkgVersion: latestEffective?.version ?? "(env)", ...localDirField }));
     };
+    const noteSourceAtApplied = () => {
+        const rejected = candidateRejection;
+        const appliedVersion = applyLedger.view().configAppliedVersion;
+        if (rejected === undefined || rejected.version === appliedVersion)
+            return;
+        const gen = generationOf(appliedVersion);
+        noteCandidateVerdict(gen, undefined);
+        if (!cc?.dryRun)
+            applyLedger.applied(gen, appliedVersion);
+        logger.info("config_source_back_to_applied", {
+            appliedVersion,
+            rejectedVersion: rejected.version,
+            domains: rejected.domains.join(","),
+            note: "the config source serves the applied generation again (unchanged-since-applied reply) — the rejected candidate is no longer its current one: candidateRejected cleared, target back to applied; the same breakage again is announced again",
+        });
+    };
     const selfReportListeners = [];
     const notifySelfReport = (changed) => {
         for (const listener of selfReportListeners) {
@@ -540,18 +564,18 @@ export async function createWebAdminRuntime(ctx) {
                 logger.warn("config_lkg_apply_failed", { err: String(applyErr), note: "persisted LKG failed to apply — env fallback serves; the cache rewrites on the next clean candidate" });
             }
         };
-        const warnLocalNoModels = (r, rejected) => {
-            const modelsDomainErr = (r.domainErrors ?? []).find((de) => de.domain === "models");
+        const warnLocalNoModels = (r, verdict) => {
+            const modelsRejection = verdict.verdict === "rejected" ? verdict.errors.find((e) => e.domain === "models") : undefined;
             const modelsDropped = (r.droppedEntries ?? []).filter((d) => d.domain === "models");
             const totalModels = (r.effective.models?.models ?? []).length;
             logger.warn("config_local_no_models", {
                 ...localDirField,
-                ...(modelsDomainErr ? { domainError: modelsDomainErr.error } : {}),
+                ...(modelsRejection ? { reason: modelsRejection.reason, domainError: modelsRejection.error } : {}),
                 ...(modelsDropped.length > 0 ? { droppedEntries: modelsDropped.map((d) => d.entry) } : {}),
-                hint: rejected && modelsDomainErr
-                    ? "config.d/models.json 在场但 models 域判形失败,整份本地候选被拒(真因见本行 domainError)— 模型继续走 env 兜底"
-                    : rejected
-                        ? "config.d 里别的域让整份本地候选被拒(判形失败,或带事实的退役域文档;坏域与真因见 config_candidate_rejected)— config.d/models.json 的模型不用,继续走 env 兜底"
+                hint: modelsRejection
+                    ? `config.d/models.json 在场但${MODELS_REJECTION_PHRASE[modelsRejection.reason]},整份本地候选被拒(成因词见本行 reason,真因见本行 domainError)— 模型继续走 env 兜底`
+                    : verdict.verdict === "rejected"
+                        ? "config.d 里别的域让整份本地候选被拒(坏域、成因词与真因见 config_candidate_rejected)— config.d/models.json 的模型不用,继续走 env 兜底"
                         : modelsDropped.length > 0 && totalModels === 0
                             ? "config.d/models.json 的条目全部被逐条丢弃(逐条真因见 config_entry_dropped)— 模型继续走 env 兜底"
                             : totalModels > 0
@@ -600,7 +624,7 @@ export async function createWebAdminRuntime(ctx) {
                         applyLedger.seenTarget(rejectedGen, r.effective.version);
                         announceCandidateRejected(r, bootVerdict, "boot", rejectedGen);
                         if (configProvider.kind === "local")
-                            warnLocalNoModels(r, true);
+                            warnLocalNoModels(r, bootVerdict);
                     }
                     else {
                         warnReadNotices(r, "boot");
@@ -645,7 +669,7 @@ export async function createWebAdminRuntime(ctx) {
                         const cfgModels = (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length;
                         logger.info("config_loaded", { source: configProvider.kind, version: r.effective.version, worker: cc?.worker ?? "(global)", models: cfgModels, ...localDirField });
                         if (configProvider.kind === "local" && cfgModels === 0)
-                            warnLocalNoModels(r, false);
+                            warnLocalNoModels(r, bootVerdict);
                     }
                 }
                 if (configProvider.kind === "remote")
@@ -959,6 +983,8 @@ export async function createWebAdminRuntime(ctx) {
                             logger.warn("models_tiers_deferred_no_handoff", { version: planeDeferredNoHandoff.version, since: planeDeferredNoHandoff.since, note: "candidate still retained without a next-boot handoff — mount restart-surviving LKG storage + CONFIG_LKG_DURABLE=true, or restart manually after ensuring the candidate is re-pulled at boot" });
                         }
                         const r = arrival !== undefined ? arrival.result : await pullEffective(configProvider, ccEtag);
+                        if (r === null)
+                            noteSourceAtApplied();
                         if (r === null && planeDeferredNoHandoff) {
                             const skillsDebt = (planeDeferredNoHandoff.blocked ?? []).includes("skills");
                             const promoted = lkgSurvivesRestart || skillsDebt ? await persistLkgDurable(planeDeferredNoHandoff.candidate, planeDeferredNoHandoff.candidateEtag) : false;

package/dist/capabilities/execution-lane.d.ts

@@ -5,8 +5,8 @@ export interface ExecutionLaneCapability {
     /** 工具跑的那台机器就是本进程这台吗(= server 盘上的绝对路径对模型的工具有没有意义)。
      *  属主 = 部署形表行 `toolsOnThisHost`,与 `skills[].baseDir` 的铸点同一行。 */
     readonly toolsOnThisHost: boolean;
-    /** [ref]:手在不在 OS 级隔离边界里(容器 / microVM / Kata pod)。**present-iff 本车道有手**(能力表 `coreRemoteExecutionEnv`);
-     *  值 = {@link laneIsolated}(能力表 `isolation` 位,与 boot `remote_exec_enabled.isolated` 同一只)。见头注 [ref] 段。 */
+    /** 手在不在 OS 级隔离边界里(容器 / microVM / Kata pod)。**present-iff 本车道有手**(执行环境块 `io`);
+     *  值 = {@link laneIsolated}(执行环境块 `isolation`,与 boot `remote_exec_enabled.isolated` 同一只)。见头注第三键段。 */
     readonly isolated?: boolean;
 }
 /**

package/dist/config-catalog.js

@@ -395,12 +395,13 @@ export const CONFIG_CATALOG = [
     r("RATE_LIMIT_RPM", "limitsHttp", "number", "计费提交每分钟限流(0=关)", { staticDefault: "0", danger: BILL, configKey: "rateLimitPerMin", center: cLimits("rateLimitPerMin") }),
     r("READ_DENY_BUILTIN_EXCLUDE", "orchestration", "csv", "按行名删内建 deny 条目(档位之后生效;绝不削任务显式 deny)", { danger: SEC, configKey: "readDenyBuiltinExclude" }),
     r("READ_DENY_BUILTIN_TIERS", "orchestration", "csv", "内建 deny 表档位选择(闭集五档 credentials/shell-history/browser/wallet/agent-config;none=显式空姿态)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 出厂两档在岗 **credentials,agent-config**(core 7.34.0 R-2 起;7.22.0–7.33.x 曾为 OFF)。要全关显式写 none;要全五档显式写 credentials,shell-history,browser,wallet,agent-config;空值拒启(手滑与显式意图不许同形)", configKey: "readDenyBuiltinTiers" }),
+    r("READ_DENY_FLOOR_REQUIRED", "orchestration", "boolean", "要求读拒表的字节地板:true ⇒ 读拒表有行而执行环境不守地板(起服行 remote_exec_enabled.keepsReadFloor=false;此时另有起服 warn read_deny_floor_required_unkept)的 run 在准备期拒(config.read_deny_floor_unkept,一个命令都不起;同步提交 409)。出厂读拒档在岗 ⇒ 这类车道上带手的 run 一律拒起", { staticDefault: "false", danger: SEC, derivedDefaultNote: "缺席 ⇒ 不要求:run 照跑,每 run 一条 operator 通告 config.read_deny_floor_unkept(engine_notice 日志;递归读照读表里的文件,通告不是保护)", configKey: "readDenyFloorRequired" }),
     r("READ_DENY_PATTERNS", "orchestration", "csv", "READ 面额外 deny pattern 表", { danger: SEC, configKey: "readDenyPatterns" }),
     r("READ_FACE", "orchestration", "enum", "READ 容纳面档位(env 逐键恒赢 center —— 部署主权表达)", { enumValues: ["open", "roots"], danger: SEC, derivedDefaultNote: "缺席 ⇒ 按 posture 派生(S-167):单用户 turnkey(REQUIRE_PRINCIPAL 未设)铸 open;多租户不铸键、core 默认 roots。生效来源见 GET /v1/diagnostics/wiring 的 readFace.source 四词", configKey: "readFace" }),
     r("REAP_INTERVAL_SEC", "limitsHttp", "number", "reaper 周期(秒)", { staticDefault: "60", configKey: "reapIntervalSec" }),
     r("REAP_RUN_STALE_SEC", "limitsHttp", "number", "run 活性判陈旧阈(秒)", { staticDefault: "120", configKey: "runStaleSec", center: cLimits("runStaleSec") }),
     r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)", { enumValues: REMOTE_EXEC_PROVIDER_WORDS, danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub(手带整族不挂;残余名册看活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点。想让这一形拒启见 REQUIRE_EXECUTION_LANE)", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
-    r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基、引擎家锚拒读行的落点;core ExecutionEnv.homeDir 座)。声明优先:不声明时 k8s / local-docker / ssh / adb 车道建环境那一拍实测执行环境自己的 $HOME 填引擎手里的座(`~/` 形规则的下单门仍只认声明);k8s / local-docker / ssh 车道的声明会在每只执行环境开起来时与它的 $HOME 对证(同一只判官、同一句拒),不一致或问不出 ⇒ 那只环境不开", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user;k8s/local-docker/ssh/adb ⇒ 建环境时实测 $HOME(实测缺席 ⇒ 那只环境的座缺席:泄内容的递归读全 shell 面真人问、只读面拒,并响 warn execution_lane_home_undeclared);device ⇒ 无(设备协议没有家目录读数:起服 warn execution_lane_home_undeclared);`~/` 形规则的下单门恒只认声明(无声明即 422 响亮拒)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
+    r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基、引擎家锚拒读行的落点;core ExecutionEnv.homeDir 座)。声明与车道出厂答案(host ⇒ 本进程家目录,e2b ⇒ /home/user)都是主张:读得出家目录的车道(k8s / local-docker / ssh / adb / e2b / host)在每只执行环境开起来时拿环境里命令看到的 $HOME 证它(同一只判官、同一句拒),不一致或问不出 ⇒ 那只环境不开;不声明且车道没有出厂答案时,建环境那一拍实测 $HOME 填引擎手里的座(`~/` 形规则的下单门仍只认 boot 期答案);device 读不了 ⇒ 声明即座、起服 warn execution_lane_home_unmeasured 披露未实测", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user(两者都在环境开起来时与 $HOME 对证);k8s/local-docker/ssh/adb ⇒ 建环境时实测 $HOME(实测缺席 ⇒ 那只环境的座缺席:泄内容的递归读全 shell 面真人问、只读面拒,并响 warn execution_lane_home_undeclared);device ⇒ 无(设备协议没有家目录读数:起服 warn execution_lane_home_undeclared);`~/` 形规则的下单门恒只认声明(无声明即 422 响亮拒)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
     r("REQUIRE_EXECUTION_LANE", "orchestration", "boolean", "开了之后:REMOTE_EXEC 未点名 ∧ CONFIG_PROVIDER≠local ⇒ **拒启**并点名该设什么。默认关 = 照旧启动,但执行环境是进程内 stub、**零手带工具**(手带整族不挂;活体读数:mountedBy=hands 条目 10 → 0),名册里其余工具照常执行,任务仍回 status=completed —— 凡需要手的请求,与「模型不肯用工具」在用户面同形。判据 = 活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点;名册总条数随 core 版本走,不写死。托管/云部署推荐开(docs/DEPLOY-PREREQS.md)", { staticDefault: "false", danger: SEC, configKey: "requireExecutionLane" }),
     r("REQUIRE_PRINCIPAL", "auth", "boolean", "多租户开关(posture 判别位:true ⇒ CC 能力族默认收紧)", { staticDefault: "false", danger: SEC, configKey: "requirePrincipal" }),
     r("RESOURCE_SUSPEND", "approval", "boolean", "durable 路径 opt-in core resourceSuspend(预算/preempt ⇒ 可恢复挂起)", { staticDefault: "false", configKey: "resourceSuspend" }),

package/dist/config-provider.d.ts

@@ -1,15 +1,12 @@
-import { type DroppedConfigEntry, type RetiredDomainFinding, type UnreadConfigFile, type UnreadConfigKey } from "./web-admin-client/read-warnings.js";
-import { FileConfigStore } from "@sema-agent/settings-schema/node";
-import { type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
+import { type DroppedConfigEntry, type UnreadConfigFile, type UnreadConfigKey } from "./web-admin-client/read-warnings.js";
+import { type ConfigDocumentRefusal, type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./web-admin-client/facade.js";
 import type { CenterEndpoint } from "./web-admin-client/center-request.js";
 import type { ConfigProviderWord } from "./config-types.js";
 /** Result of a `fetchEffective` — EXACTLY the web-admin's return: the effective config + its etag, or
  *  `null` for "unchanged" (remote 304; local: the version matched the caller's prior etag).
- *  `domainErrors`([ref] registry-core 0.10.12 tolerant seam,local lane only):catalog 域坏文件不再
- *  连坐全包回落 env——坏域按该域 schema default 落+错误单列,好域照常生效;caller(main.ts)对每条打
- *  per-domain warn 点名坏域。gate 域(governance/rosters/…)坏文件 tolerant 仍 throw(READ 容错不放宽
- *  gate fail-loud,registry-core 半场精化)——那条路走既有的整包 catch。 */
+ *  `domainErrors`:某个**读得出**的域判形失败(schema 坏形 / 拼错键 / 悬空引用;那个域已按契约的域档位落缺省或被逐条判过)—— 候选判官以
+ *  `domain_invalid` 整拒;缺席 = 没有。读不出的**文档**不在这里(见 `refusedDocuments`)。 */
 /** 壳写在 `config.d/models.json` 条目上的装饰键(`sema*`)自 settings-schema 1.5.0 起是**声明过的扩展命名空间**
  *  (`EXTENSION_NAMESPACES`):schema 照旧 strip、但不再报「未知键」,所以本函数收到的每一个未知键都是拼错/越界 ⇒ 候选门错误。
  *  此前把这类键当「通知」放行的整套下游机制(域豁免/键路径闭集/满额特判/单独的通知面)已全部撤回——意图在声明处说,消费方不猜。 */
@@ -25,9 +22,10 @@ import type { ConfigProviderWord } from "./config-types.js";
  *  `effective.models.droppedCatalogEntries`(`GET /v1/models.droppedEntries` 的源,与 `models` 同世代)。 */
 /** `unreadFiles`:`config.d` 里读腿根本不读的文件(不是域 / 不是便携域)—— **不**进候选门(不是读的域判形失败),调用方一份一行
  *  `config_unread_file` 点名、其余照用;缺席 = 没有(本地读腿才会有)。 */
-/** `retiredDomains`([ref]):带事实的退役域文档(契约包的墓碑)—— 读腿不抛,交成发现,候选判官以成因 `retired_domain` 整拒这份候选(与域判形失败
- *  同一条回落链、同一行拒判);缺席 = 没有。远端腿:那一键不进 effective、其余域照读;本地腿:契约读腿在读便携域之前就拒,交出的候选只有版本
- *  (这棵树的内容版本,哈希含退役文件 ⇒ 改 / 删它版本即变),内容是空的 effective(被整拒,不会被应用)。 */
+/** `refusedDocuments`:被拒文档 —— 契约的类型 `ConfigDocumentRefusal`(`{ document, reason, error }`,墓碑另带 `migration`;`reason` 是契约闭集
+ *  `CONFIG_DOCUMENT_REFUSAL_REASONS`:`empty` / `invalid_json` / `not_object` / `io` 文件层,`retired_domain` 墓碑)。读腿不抛,交成发现,候选判官以发现自带的词整拒这份候选
+ *  (与域判形失败同一条回落链、同一行拒判);缺席 = 没有。远端腿:wire 上只有墓碑一种,那一键不进 effective、其余域照读、版本照读;本地腿:契约的严读拒了这棵树 ⇒
+ *  被拒文档 = 契约整目录拒单 `inspectBundle` 的原样,什么内容都没读到 —— 候选是空的 effective(被整拒,不会被应用),版本 = 拒单那一读的契约版本(按文档内容寻址)。 */
 /** `unreadKeys`:本地读腿读了那份文件、却结构上不读其中一键(`prompts.json` 的 `workers`)—— 同 `unreadFiles`,不进候选门,调用方一键一行 `config_unread_key`。 */
 export type FetchEffectiveResult = {
     effective: EffectiveConfig;
@@ -39,7 +37,7 @@ export type FetchEffectiveResult = {
     droppedEntries?: DroppedConfigEntry[];
     unreadFiles?: UnreadConfigFile[];
     unreadKeys?: UnreadConfigKey[];
-    retiredDomains?: RetiredDomainFinding[];
+    refusedDocuments?: ConfigDocumentRefusal[];
     readWarnings: readonly EffectiveReadWarning[];
     credentialIdentity?: string;
 } | null;
@@ -159,16 +157,19 @@ export declare class RemoteConfigProvider implements ConfigProvider {
  * stable change-detector. We map that down to the service-local `EffectiveConfig` shape and surface the
  * version as the etag (so the caller's "skip re-apply if etag unchanged" works locally too).
  */
+/** 本地读腿对契约文件店只有一种读法 —— 严读 `getEffective()`。注入缝(测试)按这一形给;容错档位不在这条腿的类型里。 */
+export interface StrictConfigStore {
+    getEffective(): Promise<AgentConfigEffective>;
+}
 export declare class LocalConfigProvider implements ConfigProvider {
     #private;
     readonly kind: "local";
     /** 本地配置源不留正文盘缓存:正文就内联在 config.d 里(同一块盘),缓存它是第二份真源。 */
     readonly skillBodyCacheDir: undefined;
-    private readonly store;
     /** [ref]b 可观测性:config_loaded 日志要能回答「到底读的哪个目录」——复验实录:只设 LOCAL_DATA_ROOT 时
      *  config.d 静默读不到且 0 模型无告警(CONFIG_LOCAL_DIR 才是本 lane 的选目录旋钮)。 */
     readonly root: string;
-    constructor(root: string, store?: FileConfigStore, trust?: {
+    constructor(root: string, store?: StrictConfigStore, trust?: {
         readonly declaredOwnerUid: number | undefined;
     });
     fetchEffective(etag: string | undefined): Promise<FetchEffectiveResult>;