@sema-agent/server 7.139.0 → 7.141.0

package/dist/boot/stores.js

@@ -1,7 +1,7 @@
 import { join } from "node:path";
 import { FileBackgroundAgentStore, FileMailboxStore, FileRosterStore, InMemoryUsageWindowStore, mailboxCrossProcessMountVerdict } from "@sema-agent/core";
 import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
-import { buildMemorySyncEnabledFields, createMemorySyncRunner, createMemorySyncTransport } from "../memory-sync-client.js";
+import { startMemorySyncRunner } from "../memory-sync-client.js";
 import { memoryEmbedderFor } from "../plugins/memory-embedder.js";
 import { ensurePgMemoryEmbedderMetaSchema, reconcileEmbedderFingerprint } from "../plugins/memory-embedder-fingerprint.js";
 import { PgMemoryEngineBackend, ensurePgMemoryEngineSchema } from "../plugins/memory-engine-pg.js";
@@ -10,14 +10,16 @@ import { PgMemoryHistoryStore, PgMemorySyncStore, ensurePgMemoryHistorySchema, e
 import { TiDBMemoryHistoryStore, TiDBMemorySyncStore, ensureTiDBMemoryHistorySchema, ensureTiDBMemorySyncSchema } from "../plugins/memory-sync-store-tidb.js";
 import { MinioBlobBackend } from "../plugins/blob-backend.js";
 import { ensureSnapshotBuckets } from "../plugins/snapshot-bucket-presence.js";
-import { PgBackgroundAgentStore, TiDBBackgroundAgentStore, ensurePgBackgroundAgentSchema, ensureTiDBBackgroundAgentSchema } from "../plugins/background-agent-store-sql.js";
+import { PgBackgroundAgentStore, TiDBBackgroundAgentStore, ensurePgBackgroundAgentSchema, ensureTiDBBackgroundAgentSchema } from "../stores-sql/background-agent-store-sql.js";
 import { PgMailboxStore, TiDBMailboxStore, ensurePgMailboxSchema, ensureTiDBMailboxSchema } from "../plugins/mailbox-store-sql.js";
 import { createDropOnlyRecipientLifecycle } from "../plugins/mailbox-recipient-lifecycle.js";
-import { PgUsageWindowStore, TiDBUsageWindowStore, ensurePgUsageWindowSchema, ensureTiDBUsageWindowSchema } from "../plugins/usage-window-store-sql.js";
+import { PgUsageWindowStore, TiDBUsageWindowStore, ensurePgUsageWindowSchema, ensureTiDBUsageWindowSchema } from "../stores-sql/usage-window-store-sql.js";
 import { PgRosterStore, TiDBRosterStore, ensurePgRosterSchema, ensureTiDBRosterSchema } from "../plugins/roster-store-sql.js";
 import { LocalTaskAttachmentStore } from "../plugins/local-task-attachment-store.js";
 import { PgTaskAttachmentStore, TiDBTaskAttachmentStore, ensurePgTaskAttachmentSchema, ensureTiDBTaskAttachmentSchema } from "../plugins/task-attachment-store.js";
 import { createSessionStore } from "../plugins/session-store.js";
+import { buildSqlPoolMissingRefusal, missingSqlCoordinateKeys } from "../sql-engine-coordinates.js";
+import { runApprovalBatchKindlessCensus } from "../approval-batch-census.js";
 import { runAndLogOneTimeMigrations } from "../plugins/one-time-migrations.js";
 import { createTaskListLane } from "./task-list-lane.js";
 import { ensurePgTaskListSchema, ensureTiDBTaskListSchema } from "../plugins/task-list-store-sql.js";
@@ -27,21 +29,22 @@ import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback } from "..
 import { createMemoryEngineIncidentSink } from "../memory-incident-sink.js";
 import { announceLockedLegacyMemoryLayers } from "../memory-layer-legacy-lock.js";
 import { createEngineNoticeForwarder } from "./runner-deps.js";
-import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLanePosture, memoryEngineRootFor, memoryMountRootOf } from "../memory-scope.js";
+import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLanePosture, memoryEngineRootFor, memoryLayersNamedBy, memoryMountRootOf } from "../memory-scope.js";
+import { createMemoryScopeStores } from "../memory-scope-stores.js";
 import { assertToolResultProvenanceSchema } from "../plugins/tool-result-store-sql.js";
 import { assertPermissionRuleApprovalSchema, assertPermissionRuleTicketSchema } from "../plugins/permission-rule-store-sql.js";
 import { assertApprovalAskRuleMaterialSchema } from "../plugins/approval-ask-store-sql.js";
 import { assertSchemaMatchesCode } from "../plugins/schema-consistency.js";
-import { assertCheckpointColumnSchema } from "../plugins/checkpoint-store-sql.js";
+import { SqlCheckpointStore, assertCheckpointColumnSchema } from "../plugins/checkpoint-store-sql.js";
 import { assertFileHistorySchema } from "../plugins/file-history-store-sql.js";
-import { buildMemoryBoundaryLaneFacts, buildMemoryWriteBoundaryAudit, effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
+import { buildMemoryBoundaryLaneFacts, buildMemoryWriteBoundaryAudit } from "./memory-boundary.js";
 import { buildMemoryPosture } from "../memory-posture.js";
 import { headReadOf } from "../session-incarnation.js";
 import { establishSqlEnginePosture, sqlPoolsOf } from "../sql-engine-posture.js";
 import { buildStorePosture } from "../store-posture.js";
 const DARK_REASON_PROSE = {
     engine_off: () => "MEMORY_ENGINE=off",
-    multi_tenant_file_backend: () => "multi-tenant on the FILE backend (no tenant isolation; set MEMORY_ENGINE_BACKEND=pg|tidb to light up)",
+    multi_tenant_file_backend: () => "multi-tenant on the FILE backend (no tenant isolation; set MEMORY_ENGINE_BACKEND=pg|mysql to light up)",
     remote_lane_split: (lane) => `remote exec lane "${lane}" (worker/sandbox file planes split; MEMORY_ENGINE_REMOTE_LANE=allow overrides)`,
 };
 export async function assertApprovalAskRuleMaterialOnBackend(backend) {
@@ -50,7 +53,7 @@ export async function assertApprovalAskRuleMaterialOnBackend(backend) {
     if (pgPool)
         await assertApprovalAskRuleMaterialSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
     else if (mysqlPool)
-        await assertApprovalAskRuleMaterialSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+        await assertApprovalAskRuleMaterialSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "mysql");
 }
 export async function openStores(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
@@ -74,28 +77,32 @@ export async function openStores(ctx) {
         if (pgPool)
             await assertToolResultProvenanceSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
         else if (mysqlPool)
-            await assertToolResultProvenanceSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+            await assertToolResultProvenanceSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "mysql");
         if (pgPool)
             await assertCheckpointColumnSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
         else if (mysqlPool)
-            await assertCheckpointColumnSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+            await assertCheckpointColumnSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "mysql");
         if (config.permissionRulesEnabled) {
             if (pgPool)
                 await assertPermissionRuleApprovalSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
             else if (mysqlPool)
-                await assertPermissionRuleApprovalSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+                await assertPermissionRuleApprovalSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "mysql");
             if (pgPool)
                 await assertPermissionRuleTicketSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
             else if (mysqlPool)
-                await assertPermissionRuleTicketSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+                await assertPermissionRuleTicketSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "mysql");
         }
         if (pgPool)
             await assertFileHistorySchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
         else if (mysqlPool)
-            await assertFileHistorySchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+            await assertFileHistorySchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "mysql");
     }
     if (backend)
         await runAndLogOneTimeMigrations(logger, backend);
+    {
+        const censusStore = backend !== undefined && backend.kind !== "local" ? backend.checkpoint?.() : undefined;
+        void runApprovalBatchKindlessCensus(censusStore instanceof SqlCheckpointStore ? censusStore : undefined, logger);
+    }
     if ((process.env.REWIND_SNAPSHOT_MAX_MB ?? "") !== "") {
         logger.warn("rewind_snapshot_max_mb_retired", {
             note: "REWIND_SNAPSHOT_MAX_MB no longer has an effect: the whole-tree snapshot epoch is retired (S-15); per-edited-file history captures only files the agent touches, with no tree walk and no size gate. Remove the env var. Per-blob SQL sizing is governed by SNAPSHOT_BLOB_SQL_MAX_BYTES / object storage as before.",
@@ -115,6 +122,8 @@ export async function openStores(ctx) {
         config.sessionBackend = "tidb";
     let memoryEngine;
     const engineDataRoot = memoryEngineRootFor(config, localRoot);
+    const memoryEngineIncident = createMemoryEngineIncidentSink({ logger, metrics });
+    const scopeStoresOver = (deployment) => createMemoryScopeStores({ backend: deployment, root: engineDataRoot, namedLayers: () => memoryLayersNamedBy(config), onIncident: memoryEngineIncident });
     let memorySyncCursors;
     let vectorMode;
     if (config.memoryEngineBackend !== "file" && config.memoryEngineEnabled) {
@@ -133,7 +142,7 @@ export async function openStores(ctx) {
         if (dialect === "pg") {
             const pool = backend?.pgPool();
             if (!pool)
-                throw new Error("MEMORY_ENGINE_BACKEND=pg requires DB_BACKEND=pg (the memory engine binds the same PG pool) — refusing to start half-configured");
+                throw new Error(buildSqlPoolMissingRefusal({ engine: dialect, declared: config.dbBackend === dialect, missing: missingSqlCoordinateKeys(dialect, process.env) }));
             const q = async (text, params) => { const r = await pool.query(text, params); return { rows: r.rows }; };
             await ensurePgMemoryEngineSchema(q);
             await ensurePgMemoryHistorySchema(q);
@@ -165,19 +174,19 @@ export async function openStores(ctx) {
                 ...(embedder !== undefined ? { embedder } : {}),
             });
             vectorMode = pgMem.vectorMode;
-            memoryEngine = { backend: pgMem, root: engineDataRoot };
+            memoryEngine = scopeStoresOver(pgMem);
         }
         else {
             const pool = backend?.mysqlPool();
             if (!pool)
-                throw new Error("MEMORY_ENGINE_BACKEND=tidb requires DB_BACKEND=mysql — refusing to start half-configured");
+                throw new Error(buildSqlPoolMissingRefusal({ engine: dialect, declared: config.dbBackend === dialect, missing: missingSqlCoordinateKeys(dialect, process.env) }));
             await ensureTiDBMemoryEngineSchema(pool);
             await ensureTiDBMemoryHistorySchema(pool);
             await ensureTiDBMemorySyncSchema(pool);
             memorySyncCursors = new TiDBMemorySyncStore(pool);
             const tidbMem = new TiDBMemoryEngineBackend(pool, { history: countedHistorySink(new TiDBMemoryHistoryStore(pool)) });
             vectorMode = tidbMem.vectorMode;
-            memoryEngine = { backend: tidbMem, root: engineDataRoot };
+            memoryEngine = scopeStoresOver(tidbMem);
         }
         logger.info("memory_engine_enabled", {
             enabled: true,
@@ -189,7 +198,8 @@ export async function openStores(ctx) {
         });
     }
     else {
-        memoryEngine = memoryEngineBackendFor(config, undefined, createMemoryEngineIncidentSink({ logger, metrics }));
+        const fileEngine = memoryEngineBackendFor(config, undefined, memoryEngineIncident);
+        memoryEngine = fileEngine !== undefined ? scopeStoresOver(fileEngine.backend) : undefined;
         if (memoryEngine)
             announceLockedLegacyMemoryLayers(memoryMountRootOf(memoryEngine.backend, memoryEngine.root), createEngineNoticeForwarder(logger));
         if (memoryEngine && process.env.LOCAL_DATA_ROOT && !config.memoryEngineDir) {
@@ -205,17 +215,11 @@ export async function openStores(ctx) {
         const audit = buildMemoryWriteBoundaryAudit({
             memoryRoot: memoryMountRoot,
             ...laneFacts,
-            declaredCapable: effectiveMemoryPersistenceCapable(config),
+            declaredCapable: config.memoryPersistenceCapable,
             engineBackend: config.memoryEngineBackend,
         });
         for (const w of audit.warnings)
             logger.warn(w.tag, { detail: w.detail, lane: laneFacts.lane, root: memoryMountRoot ?? null });
-        if (config.memoryPersistenceCapable === undefined && effectiveMemoryPersistenceCapable(config) === true) {
-            logger.info?.("memory_persistence_capable_auto_declared", {
-                lane: laneFacts.lane,
-                detail: "REMOTE_EXEC=host: file tools run on this machine's filesystem, so the assembler declares memoryPersistenceCapable=true (the core-side remote-env withhold would otherwise silently drop the memory WRITE instruction on this lane). Override with MEMORY_PERSISTENCE_CAPABLE=true|false.",
-            });
-        }
     }
     let rosterStore;
     {
@@ -236,7 +240,7 @@ export async function openStores(ctx) {
             });
         }
         if (rosterStore)
-            logger.info("roster_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "tidb" : "file" });
+            logger.info("roster_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "mysql" : "file" });
     }
     let backgroundAgentStore;
     {
@@ -255,7 +259,7 @@ export async function openStores(ctx) {
             backgroundAgentStore = new FileBackgroundAgentStore(config.localDataRoot ?? localRoot);
         }
         if (backgroundAgentStore)
-            logger.info("background_agent_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "tidb" : "file" });
+            logger.info("background_agent_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "mysql" : "file" });
     }
     let taskAttachmentStore;
     {
@@ -285,7 +289,7 @@ export async function openStores(ctx) {
             taskAttachmentStore = new LocalTaskAttachmentStore(config.localDataRoot ?? localRoot);
         }
         if (taskAttachmentStore)
-            logger.info("task_attachment_store_enabled", { backend: pgPool ? "pg+minio" : mysqlPool ? "tidb+minio" : "file", maxBytes: config.attachmentMaxBytes });
+            logger.info("task_attachment_store_enabled", { backend: pgPool ? "pg+minio" : mysqlPool ? "mysql+minio" : "file", maxBytes: config.attachmentMaxBytes });
     }
     let mailboxStore;
     let mailboxRecipientLifecycle;
@@ -313,7 +317,7 @@ export async function openStores(ctx) {
         if (mailboxStore) {
             const laneVerdict = mailboxCrossProcessMountVerdict(mailboxStore);
             logger.info("mailbox_store_enabled", {
-                backend: pgPool ? "pg" : mysqlPool ? "tidb" : "file",
+                backend: pgPool ? "pg" : mysqlPool ? "mysql" : "file",
                 crossProcessSafe: mailboxStore.crossProcessSafe,
                 recipientTombstones: pgPool !== undefined || mysqlPool !== undefined,
                 peerLaneMountable: laneVerdict.ok,
@@ -339,9 +343,9 @@ export async function openStores(ctx) {
         else {
             usageWindowStore = new InMemoryUsageWindowStore();
         }
-        logger.info("usage_window_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "tidb" : backend?.fileUsageWindowStore !== undefined ? "file" : "memory", windows: config.usageWindows.length });
+        logger.info("usage_window_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "mysql" : backend?.fileUsageWindowStore !== undefined ? "file" : "memory", windows: config.usageWindows.length });
     }
-    const memoryExportBackend = config.memoryEngineBackend !== "file" ? memoryEngine?.backend : undefined;
+    const memoryExportStores = config.memoryEngineBackend !== "file" ? memoryEngine : undefined;
     const memoryLane = memoryEngineRemoteLanePosture(config);
     const memoryPosture = buildMemoryPosture({
         config,
@@ -363,18 +367,7 @@ export async function openStores(ctx) {
     let memorySyncRunner;
     if (config.memorySync) {
         if (memoryEngine) {
-            const transport = createMemorySyncTransport({ url: config.memorySync.url, token: config.memorySync.token });
-            memorySyncRunner = createMemorySyncRunner({
-                backend: memoryEngine.backend,
-                scope: config.memorySync.scope,
-                memoryRoot: memoryEngine.root,
-                transport,
-                log: logger,
-                ...(config.memorySync.maxPushEntries !== undefined ? { maxPushEntries: config.memorySync.maxPushEntries } : {}),
-                ...(config.memorySync.maxPullEntries !== undefined ? { maxPullEntries: config.memorySync.maxPullEntries } : {}),
-            });
-            logger.info("memory_sync_enabled", buildMemorySyncEnabledFields(transport.peer, config.memorySync.scope, memorySyncRunner.cursorPathFor(config.memorySync.scope)));
-            memorySyncRunner.trigger("boot");
+            memorySyncRunner = startMemorySyncRunner({ sync: config.memorySync, stores: memoryEngine, log: logger });
         }
         else {
             logger.warn("memory_sync_configured_but_memory_dark", { note: "MEMORY_SYNC_URL is set but the file memory engine is dark (multi-tenant / MEMORY_ENGINE=off / remote exec lane) — no sync rounds will run" });
@@ -444,7 +437,7 @@ export async function openStores(ctx) {
         : undefined;
     return {
         backend, storePosture, memoryEngine, engineDataRoot, memorySyncCursors, rosterStore, backgroundAgentStore, mailboxRecipientLifecycle,
-        taskAttachmentStore, mailboxStore, memoryExportBackend, memorySyncRunner, sessionStore, breakerState,
+        taskAttachmentStore, mailboxStore, memoryExportStores, memorySyncRunner, sessionStore, breakerState,
         usageWindowStore, memoryPosture, taskListLane, sqlEngine,
     };
 }

package/dist/boot/task-list-lane.d.ts

@@ -38,7 +38,7 @@ import type { Logger } from "../observability/logger.js";
 /** 同时活着的会话清单实例上限(LRU,逐最老)。与 perSessionCwd/perSessionShellEnv 同量级。 */
 export declare const MAX_TASK_LIST_SESSIONS = 4096;
 /** 车道实际落到哪个后端(启动日志 + 测试对表)。 */
-export type TaskListLaneBackend = "tidb" | "pg" | "memory";
+export type TaskListLaneBackend = "mysql" | "pg" | "memory";
 export interface TaskListLane {
     /** `sessionId ↦ 该会话的任务清单店`。同 sessionId 恒解析到同一份清单(SQL 形 = 同一批行;
      *  memory 形 = 同一只实例)。 */

package/dist/boot/task-list-lane.js

@@ -16,7 +16,7 @@ export function createTaskListLane(opts = {}) {
         purge = (sessionId) => deletePgTaskList(pgPool, taskListKeyFor(sessionId));
     }
     else if (mysqlPool) {
-        backend = "tidb";
+        backend = "mysql";
         mint = (sessionId) => createTiDBTaskListStore(mysqlPool, taskListKeyFor(sessionId));
         purge = (sessionId) => deleteTiDBTaskList(mysqlPool, taskListKeyFor(sessionId));
     }

package/dist/boot/web-admin.js

@@ -31,6 +31,15 @@ import { SHA256_HEX_RE } from "../digest-form.js";
 import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../web-admin-client/apply-ledger.js";
 import { announceReadDenyRows, buildDeploymentPostureSeats } from "./runner-deps.js";
 import { echoCallerText } from "../caller-text-echo.js";
+const MODELS_REJECTION_PHRASE = {
+    domain_invalid: "models 域判形失败",
+    empty: "读不出(空 / 纯空白:半写或截断)",
+    invalid_json: "读不出(不是合法的 JSON)",
+    not_object: "读不出(解析出来不是 JSON 对象:null / 数组 / 标量)",
+    io: "读不出(文件读失败:权限、路径是目录或 I/O 错误)",
+    too_deep: "读不出(嵌套过深:深过整棵目录的内容版本能算的层数)",
+    retired_domain: "是带事实的退役域文档",
+};
 function lkgReadNote(scope) {
     switch (scope) {
         case "whole":
@@ -202,6 +211,22 @@ export async function createWebAdminRuntime(ctx) {
         noteCandidateVerdict(ordinal, candidateRejectionOf(r, verdict, candidateSource().kind, Date.now()));
         logger.warn("config_candidate_rejected", buildCandidateRejectedFields(r, verdict, leg, { lkgVersion: latestEffective?.version ?? "(env)", ...localDirField }));
     };
+    const noteSourceAtApplied = () => {
+        const rejected = candidateRejection;
+        const appliedVersion = applyLedger.view().configAppliedVersion;
+        if (rejected === undefined || rejected.version === appliedVersion)
+            return;
+        const gen = generationOf(appliedVersion);
+        noteCandidateVerdict(gen, undefined);
+        if (!cc?.dryRun)
+            applyLedger.applied(gen, appliedVersion);
+        logger.info("config_source_back_to_applied", {
+            appliedVersion,
+            rejectedVersion: rejected.version,
+            domains: rejected.domains.join(","),
+            note: "the config source serves the applied generation again (unchanged-since-applied reply) — the rejected candidate is no longer its current one: candidateRejected cleared, target back to applied; the same breakage again is announced again",
+        });
+    };
     const selfReportListeners = [];
     const notifySelfReport = (changed) => {
         for (const listener of selfReportListeners) {
@@ -540,18 +565,18 @@ export async function createWebAdminRuntime(ctx) {
                 logger.warn("config_lkg_apply_failed", { err: String(applyErr), note: "persisted LKG failed to apply — env fallback serves; the cache rewrites on the next clean candidate" });
             }
         };
-        const warnLocalNoModels = (r, rejected) => {
-            const modelsDomainErr = (r.domainErrors ?? []).find((de) => de.domain === "models");
+        const warnLocalNoModels = (r, verdict) => {
+            const modelsRejection = verdict.verdict === "rejected" ? verdict.errors.find((e) => e.domain === "models") : undefined;
             const modelsDropped = (r.droppedEntries ?? []).filter((d) => d.domain === "models");
             const totalModels = (r.effective.models?.models ?? []).length;
             logger.warn("config_local_no_models", {
                 ...localDirField,
-                ...(modelsDomainErr ? { domainError: modelsDomainErr.error } : {}),
+                ...(modelsRejection ? { reason: modelsRejection.reason, domainError: modelsRejection.error } : {}),
                 ...(modelsDropped.length > 0 ? { droppedEntries: modelsDropped.map((d) => d.entry) } : {}),
-                hint: rejected && modelsDomainErr
-                    ? "config.d/models.json 在场但 models 域判形失败,整份本地候选被拒(真因见本行 domainError)— 模型继续走 env 兜底"
-                    : rejected
-                        ? "config.d 里别的域让整份本地候选被拒(判形失败,或带事实的退役域文档;坏域与真因见 config_candidate_rejected)— config.d/models.json 的模型不用,继续走 env 兜底"
+                hint: modelsRejection
+                    ? `config.d/models.json 在场但${MODELS_REJECTION_PHRASE[modelsRejection.reason]},整份本地候选被拒(成因词见本行 reason,真因见本行 domainError)— 模型继续走 env 兜底`
+                    : verdict.verdict === "rejected"
+                        ? "config.d 里别的域让整份本地候选被拒(坏域、成因词与真因见 config_candidate_rejected)— config.d/models.json 的模型不用,继续走 env 兜底"
                         : modelsDropped.length > 0 && totalModels === 0
                             ? "config.d/models.json 的条目全部被逐条丢弃(逐条真因见 config_entry_dropped)— 模型继续走 env 兜底"
                             : totalModels > 0
@@ -600,7 +625,7 @@ export async function createWebAdminRuntime(ctx) {
                         applyLedger.seenTarget(rejectedGen, r.effective.version);
                         announceCandidateRejected(r, bootVerdict, "boot", rejectedGen);
                         if (configProvider.kind === "local")
-                            warnLocalNoModels(r, true);
+                            warnLocalNoModels(r, bootVerdict);
                     }
                     else {
                         warnReadNotices(r, "boot");
@@ -645,7 +670,7 @@ export async function createWebAdminRuntime(ctx) {
                         const cfgModels = (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length;
                         logger.info("config_loaded", { source: configProvider.kind, version: r.effective.version, worker: cc?.worker ?? "(global)", models: cfgModels, ...localDirField });
                         if (configProvider.kind === "local" && cfgModels === 0)
-                            warnLocalNoModels(r, false);
+                            warnLocalNoModels(r, bootVerdict);
                     }
                 }
                 if (configProvider.kind === "remote")
@@ -959,6 +984,8 @@ export async function createWebAdminRuntime(ctx) {
                             logger.warn("models_tiers_deferred_no_handoff", { version: planeDeferredNoHandoff.version, since: planeDeferredNoHandoff.since, note: "candidate still retained without a next-boot handoff — mount restart-surviving LKG storage + CONFIG_LKG_DURABLE=true, or restart manually after ensuring the candidate is re-pulled at boot" });
                         }
                         const r = arrival !== undefined ? arrival.result : await pullEffective(configProvider, ccEtag);
+                        if (r === null)
+                            noteSourceAtApplied();
                         if (r === null && planeDeferredNoHandoff) {
                             const skillsDebt = (planeDeferredNoHandoff.blocked ?? []).includes("skills");
                             const promoted = lkgSurvivesRestart || skillsDebt ? await persistLkgDurable(planeDeferredNoHandoff.candidate, planeDeferredNoHandoff.candidateEtag) : false;

package/dist/capabilities/execution-lane.d.ts

@@ -5,8 +5,8 @@ export interface ExecutionLaneCapability {
     /** 工具跑的那台机器就是本进程这台吗(= server 盘上的绝对路径对模型的工具有没有意义)。
      *  属主 = 部署形表行 `toolsOnThisHost`,与 `skills[].baseDir` 的铸点同一行。 */
     readonly toolsOnThisHost: boolean;
-    /** [ref]:手在不在 OS 级隔离边界里(容器 / microVM / Kata pod)。**present-iff 本车道有手**(能力表 `coreRemoteExecutionEnv`);
-     *  值 = {@link laneIsolated}(能力表 `isolation` 位,与 boot `remote_exec_enabled.isolated` 同一只)。见头注 [ref] 段。 */
+    /** 手在不在 OS 级隔离边界里(容器 / microVM / Kata pod)。**present-iff 本车道有手**(执行环境块 `io`);
+     *  值 = {@link laneIsolated}(执行环境块 `isolation`,与 boot `remote_exec_enabled.isolated` 同一只)。见头注第三键段。 */
     readonly isolated?: boolean;
 }
 /**

package/dist/capabilities/scenarios.d.ts

@@ -87,7 +87,7 @@ export interface ScenarioContext {
      * 由**每一个**接了停驻挂点的取用方显式交出(一条读法,没有回落):请求腿 = 本请求经鉴权解析的会话与受理时那一读(`boot/resolve-spec.ts`);`/decide` 赎回面 = 行上的
      * `rootSessionId` 与赎回腿写口放行的那一位住客(`parked-revive-surface.ts`,交不交座都交)。它**只**喂停驻挂点,不挂任何会话级设施(那是 {@link sessionId} 的事,
      * 判据是「这只 bundle 是不是在那只会话上取用的」,与属主来源是两个独立判据)。缺席 = 没有根可交(boot 期探针、run-local、行上没有根)⇒ 律给哨兵。
-     * 挂点在停驻那一刻再读一次根行:住客不是见证的那一位(删了、同 id 被重新登记)⇒ 停驻否决 —— 不按新住客晋升或认领。
+     * 挂点在停驻那一刻再读一次根行:住客不是见证的那一位(删了、同 id 被重新登记)⇒ 停驻否决 —— 不按新住客认领。
      */
     delegationRoot?: DelegationRootWitness;
 }

package/dist/capability-facts.d.ts

@@ -140,6 +140,15 @@ export declare function mcpReconnect(d: Pick<Deps, "runStore" | "sessionStorage"
     runStore: Store<"runStore">;
     sessionStorage: HeadReadingSessionStore;
 }>;
+/**
+ * 在飞 run 的切档口(`POST /v1/runs/:id/permission-mode`)= 持久 run 账面 ∧ checkpoint 店(ctx 面)。后一格是承重的:切档要读这条 run 的
+ * **存储体**(本任务 settings 的 kill-switch 由受理判官折,与提交口同一份事实),也要把准入的词写回存储体(run 模式词的唯一来源,续跑腿读它);
+ * 没有 ctx 面的部署两件都做不了 ⇒ 不提供这一口(能力位 `permissionModeWrite` 同读本事实)。
+ */
+export declare function permissionModeWrite(d: Pick<Deps, "runStore" | "checkpointStore">): Fact<"run_store_absent" | "checkpoint_store_absent", {
+    runStore: Store<"runStore">;
+    checkpointStore: Store<"checkpointStore">;
+}>;
 export declare function sessionAuditView(d: Pick<Deps, "sessionAudit">): Fact<"session_audit_absent", {
     sessionAudit: Store<"sessionAudit">;
 }>;

package/dist/capability-facts.js

@@ -113,6 +113,15 @@ export function mcpReconnect(d) {
         return owned;
     return yes({ runStore: runs.runStore, sessionStorage: owned.sessionStorage });
 }
+export function permissionModeWrite(d) {
+    const runs = durableRuns(d);
+    if (!runs.available)
+        return runs;
+    const park = checkpointPark(d);
+    if (!park.available)
+        return park;
+    return yes({ runStore: runs.runStore, checkpointStore: park.checkpointStore });
+}
 export function sessionAuditView(d) {
     return d.sessionAudit !== undefined ? yes({ sessionAudit: d.sessionAudit }) : no("session_audit_absent");
 }

package/dist/card-void.d.ts

@@ -0,0 +1,38 @@
+/**
+ * **结算时作废一张本服务兑现不了的卡** —— 全仓「结算作废」的唯一动词:读卡 → 卡仍 pending ∧ 卡在调用方说的那只会话上 ⇒
+ * 按卡**自己的** scope 走 checkpoint 店的 `expire`(与引擎的本进程仲裁器、续跑的 resolve 同一只 CAS,恰一个赢家)。不新增任何持久态。
+ *
+ * 规则只有一条:**本服务兑现不了的卡不留在待决面上**。两个产地读这一只动词,各自只答「手里是哪一张卡、它该在哪只会话上」:
+ *  · 验证器自己的停驻(`verifier-pause-card.ts`):卡在验证器现铸的会话上,本服务的续跑链连不回它;
+ *  · 停驻没落定就以失败收场的腿(`runs.ts` 的 `voidHeldParkCard`:后台腿与续跑腿):卡在本 run 的会话上,但兑现它的那条 run 已经
+ *    `failed`、认领已放 —— 卡的命运先于认领释放(调用方先调本动词、再放认领)。
+ *
+ * 不抛:作废没做成(店读 / 作废抛错、卡的会话对不上、没接店)⇒ 卡回到「留在待决面上、由审批兜底收割收走」的形,按产地登记的 tag
+ * 响亮留痕(计数 + 探针行 + 一次 warn),结算照常往下走。卡已不 pending / 已不在 ⇒ 什么都不做(CAS 输给了别的结算者,结局相同)。
+ *
+ * ## 🚧 过渡(引擎动词到货即改调)
+ * 店级 `expire` 只作废卡,**不释放**引擎为这张卡钉住的会话(引擎在停驻时 pin 会话,只在续跑终局 / 续跑失败臂 unpin):
+ * 被作废的卡的会话在本副本内存里一直常驻到进程重启。引擎给出「作废停驻卡并释放其会话」的动词之后,本动词改调它(两个产地一字不改)。
+ */
+import type { CheckpointToken } from "@sema-agent/core";
+import { type FailOpenTag } from "./observability/fail-open.js";
+/** 结算点手里那只 checkpoint 店的两个动词:读卡(取它自己的 scope / 会话 / 状态)→ 按卡自己的 scope CAS 作废。 */
+export interface CardVoidPort {
+    get(token: CheckpointToken): Promise<{
+        readonly scope?: string;
+        readonly sessionId?: string;
+        readonly status?: string;
+    } | null>;
+    expire(token: CheckpointToken, scope: string): Promise<boolean>;
+}
+/** 要作废的那一张:停驻带回的凭据 + 它应在的会话(对不上就不动它 —— 只作废**这一张**)。 */
+export interface CardRef {
+    readonly token: CheckpointToken;
+    readonly sessionId: string | undefined;
+}
+/**
+ * 作废 `card`(见模块头注)。`tag` = 产地登记的 F 类 tag;`at` = 探针行上的产地现场(例 `leg=bg`),接在 `reason=` 之后;
+ * detail 形 `reason=<词>[ <at>][ err=<原句>]`,不含凭据。
+ */
+export declare function voidPendingCard(card: CardRef, cards: CardVoidPort | undefined, tag: FailOpenTag, at?: string): Promise<void>;
+//# sourceMappingURL=card-void.d.ts.map

package/dist/card-void.js

@@ -0,0 +1,23 @@
+import { errorText } from "./observability/err-text.js";
+import { recordFailOpen } from "./observability/fail-open.js";
+export async function voidPendingCard(card, cards, tag, at) {
+    const miss = (reason, err) => recordFailOpen(tag, `reason=${reason}${at === undefined ? "" : ` ${at}`}${err === undefined ? "" : ` err=${err}`}`);
+    if (cards === undefined) {
+        miss("no_checkpoint_store");
+        return;
+    }
+    try {
+        const live = await cards.get(card.token);
+        if (live === null || live.status !== "pending")
+            return;
+        if (card.sessionId === undefined || live.sessionId !== card.sessionId || typeof live.scope !== "string") {
+            miss("card_mismatch");
+            return;
+        }
+        await cards.expire(card.token, live.scope);
+    }
+    catch (e) {
+        miss("store_error", errorText(e));
+    }
+}
+//# sourceMappingURL=card-void.js.map

package/dist/config-catalog.js

@@ -1,6 +1,6 @@
 import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES } from "@sema-agent/core";
 import { GLOBAL_SCOPE } from "@sema-agent/settings-schema/api/scopes";
-import { WEB_ADMIN_ENV, DOMAIN_SCHEMAS, buildRetiredEnvWire } from "@sema-agent/settings-schema";
+import { DEVICE_RELAY_NONE, WEB_ADMIN_ENV, DOMAIN_SCHEMAS, buildRetiredEnvWire } from "@sema-agent/settings-schema";
 import { CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS, CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS, CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS } from "./center-credential-renewer.js";
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS } from "./workspace-cache.js";
@@ -14,7 +14,7 @@ import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CENTER_BASE_URL_RULE, CONFIG_PROVI
 import { DEVICE_HELLO_ACK_BOUNDS } from "./device-ws-protocol.js";
 import { webSearchProviderFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
-import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
+import { REMOTE_EXEC_PROVIDER_WORDS, SANDBOX_READ_FLOOR_DEFAULT, SANDBOX_READ_FLOOR_WORDS } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { MODEL_PROVIDER_WORDS } from "./model-provider.js";
 import { buildDisplaySafeUrlChecked } from "./trace/redact.js";
@@ -126,7 +126,7 @@ export const CONFIG_CATALOG = [
     r("DEVICE_MAX_INFLIGHT_PER_DEVICE", "orchestration", "number", `per-device 在途上限(超额云侧排队;原值进 helloAck.maxInflight;须为 ≥ ${DEVICE_HELLO_ACK_BOUNDS.maxInflight.min} 的规范十进制整数,其余拒启 —— 0 会让每次派发都 device.busy)`, { derivedDefaultNote: "缺席 ⇒ 4(§11-O3 裁定值)" }),
     r("DEVICE_MAX_PREAUTH_PER_REMOTE", "orchestration", "number", "未鉴权握手的 per-remote 并发帽(正整数或字面 off;XFF/NAT 形用 off+全局帽)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 8" }),
     r("DEVICE_RECONNECT_GRACE_MS", "orchestration", "number", `device 断连后在途不判丢的窗(ms;同 epoch 重连续接;原值进 helloAck.reconnectGraceMs;须为 [${DEVICE_HELLO_ACK_BOUNDS.reconnectGraceMs.min}, ${DEVICE_HELLO_ACK_BOUNDS.reconnectGraceMs.max}] 内规范十进制整数,其余拒启)`, { derivedDefaultNote: "缺席 ⇒ adapter 默认 120s" }),
-    r("DEVICE_RELAY_URL", "orchestration", "url", "设备直达入口:设备连不到本引擎自己的地址(引擎在中继 / 网关之后)时拨的那一个 ws(s) URL,逐字上 /v1/capabilities 的 deviceExecutor.relayUrl;须为无 userinfo / query / fragment、不带凭据形的 ws:// 或 wss:// 绝对地址,其余拒启。不从 FLEET_ADVERTISE_ADDRESS 派生(那是对中心公告的地址,受众不是设备)", { derivedDefaultNote: "缺席 ⇒ 能力面不带 relayUrl,设备按引擎地址 + deviceExecutor.wsPath 拨号" }),
+    r("DEVICE_RELAY_URL", "orchestration", "url", "设备入口(REMOTE_EXEC=device 必填):设备连不到本引擎自己的地址(引擎在中继 / 网关之后)时拨的那一个 ws(s) URL,逐字上 /v1/capabilities 的 deviceExecutor.relayUrl;或字面 none = 没有中继,设备按引擎地址 + deviceExecutor.wsPath 拨号(能力面不带 relayUrl;有设备绑定时起服 warn 点名绑定数)。URL 须为无 userinfo / query / fragment、不带凭据形的 ws:// 或 wss:// 绝对地址,其余拒启。不从 FLEET_ADVERTISE_ADDRESS 派生(那是对中心公告的地址,受众不是设备)", { enumValues: [DEVICE_RELAY_NONE], derivedDefaultNote: "无缺省:device 车道的必需键 —— 缺席 / 空串 / 只含空白拒起(撤中继声明的回滚序 = 先恢复引擎自己的入口,再写 none)" }),
     r("DEVICE_SUPERSEDE", "orchestration", "enum", "同 deviceId 二连的顶替策略", { enumValues: ["stale_only", "deny"], staticDefault: "stale_only", danger: SEC }),
     r("DIRECT_APPROVAL_DOOR", "approval", "boolean", "直连 /decide 门(无 BFF 的桌面/CLI 客户端;开 ⇒ 要求签名 JWT+HMAC 信封,principal 头降级不可信)", { staticDefault: "false", danger: SEC, configKey: "directApprovalDoor" }),
     r("DOCKER_COMMAND_TIMEOUT_MS", "orchestration", "number", "local-docker 车道单命令超时(ms)"),
@@ -250,7 +250,7 @@ export const CONFIG_CATALOG = [
     r("MCP_ELICITATION_TTL_MS", "approval", "number", "elicitation 无人应答释放窗(ms)", { derivedDefaultNote: "缺席 ⇒ 本服务出厂窗(DEFAULT_ELICITATION_THROTTLE)" }),
     r("MEMORY_AUTO_CONSOLIDATION", "memory", "enum", "记忆自动整理部署席(on=每个建议任务后整库整理跑,记忆内容自动外流到整理模型;off=显式关,胜过引擎缺省;未设=读引擎具名缺省)", { enumValues: ["on", "off"], derivedDefaultNote: "缺席 ⇒ 引擎具名缺省(**本版装的引擎是开**)——不配不等于关;前置=整理阀门开着(MEMORY_CONSOLIDATION_DRIVER=on,或未设而出厂缺省派生成开)", danger: SEC, resolve: (c) => c.memoryConsolidationDriver.autoRunOnRecommendation, booleanEnum: { true: "on", false: "off" } }),
     r("MEMORY_CAPTURE_POLICY", "memory", "enum", "记忆 capture 姿态(open=声明按面值;governed=按 per-principal verdict;capture-required=恒采)", { enumValues: ["open", "governed", "capture-required"], staticDefault: "open", danger: SEC, configKey: "memoryCapturePolicy" }),
-    r("MEMORY_CONSOLIDATION_DRIVER", "memory", "enum", "记忆折叠阀门(off=零装配零探针,两 admin 口 404 族;on=座解析 + 两 admin 口 + 引擎面整理两席)", { enumValues: ["on", "off"], derivedDefaultNote: "缺席 ⇒ 起服时派生:整理座不落主模型(MODEL_CHEAP_ID 在场且异于 MODEL_ID,或目录给 consolidate / summarize / flash 档位绑了别的模型)⇒ on;落主模型 ⇒ off + 起服 warn memory_consolidation_default_off_no_cheap_model;结构上跑不起来(无记忆引擎 / pg·tidb 记忆后端 / MEMORY_PROVENANCE=off)⇒ 恒 off 零提示。显式 on 而落主模型 ⇒ 照开 + warn memory_consolidation_on_main_model(按主模型计费)", danger: BILL, resolve: (_c, _env, boot) => (boot.memoryConsolidationValve === undefined ? undefined : boot.memoryConsolidationValve.enabled ? "on" : "off") }),
+    r("MEMORY_CONSOLIDATION_DRIVER", "memory", "enum", "记忆折叠阀门(off=零装配零探针,两 admin 口 404 族;on=座解析 + 两 admin 口 + 引擎面整理两席)", { enumValues: ["on", "off"], derivedDefaultNote: "缺席 ⇒ 起服时派生:整理座不落主模型(MODEL_CHEAP_ID 在场且异于 MODEL_ID,或目录给 consolidate / summarize / flash 档位绑了别的模型)⇒ on;落主模型 ⇒ off + 起服 warn memory_consolidation_default_off_no_cheap_model;结构上跑不起来(无记忆引擎 / pg·mysql 记忆后端 / MEMORY_PROVENANCE=off)⇒ 恒 off 零提示。显式 on 而落主模型 ⇒ 照开 + warn memory_consolidation_on_main_model(按主模型计费)", danger: BILL, resolve: (_c, _env, boot) => (boot.memoryConsolidationValve === undefined ? undefined : boot.memoryConsolidationValve.enabled ? "on" : "off") }),
     r("MEMORY_CONSOLIDATION_INTERVAL_SEC", "memory", "number", "折叠周期腿节律(秒;本 build 任何正值拒启 —— 周期腿未落地,恒 0)", { staticDefault: "0" }),
     r("MEMORY_CONSOLIDATION_SCOPES", "memory", "csv", "折叠阀门 scope 表(恰一条时=admin 口缺省;不是授权边界)"),
     r("MEMORY_DELEGATION_EVIDENCE", "memory", "enum", "委派臂污染标记的证据标准", { enumValues: ["static-face", "attested-only"], staticDefault: "static-face", danger: SEC, configKey: "memoryDelegationEvidence" }),
@@ -260,7 +260,7 @@ export const CONFIG_CATALOG = [
     r("MEMORY_EMBEDDER_MODEL", "memory", "string", "embeddings 模型名"),
     r("MEMORY_EMBEDDER_TIMEOUT_MS", "memory", "number", "单次 embed 活性上限(ms)", { staticDefault: "30000" }),
     r("MEMORY_ENGINE", "memory", "enum", "记忆引擎总开关(注入式文件记忆面;双族词表,未知词拒启)", { enumValues: ["on", "off"], staticDefault: "on", configKey: "memoryEngineEnabled", booleanEnum: { true: "on", false: "off" } }),
-    r("MEMORY_ENGINE_BACKEND", "memory", "enum", "记忆持久面方言(file=现状;pg/tidb=DB 真身,多租户点亮的唯一门)", { enumValues: MEMORY_ENGINE_BACKENDS, staticDefault: "file", danger: DATA, configKey: "memoryEngineBackend" }),
+    r("MEMORY_ENGINE_BACKEND", "memory", "enum", "记忆持久面方言(file=现状;pg/mysql=DB 真身,多租户点亮的唯一门;方言与 DB_BACKEND 同字)", { enumValues: MEMORY_ENGINE_BACKENDS, staticDefault: "file", danger: DATA, configKey: "memoryEngineBackend" }),
     r("MEMORY_ENGINE_DIR", "memory", "path", "记忆引擎根覆写", { derivedDefaultNote: "缺席 ⇒ core 默认链(AGENT_DATA_DIR → ~/.ai-agent)", configKey: "memoryEngineDir" }),
     r("MEMORY_ENGINE_REMOTE_LANE", "memory", "enum", "远端执行车道上放行 file 记忆引擎的 plane-split 覆写", { enumValues: ["allow"] }),
     r("MEMORY_ORG_ADMISSION_MODE", "memory", "enum", "org 记忆准入模式(audit=判决照算纯观察)", { enumValues: ["audit", "enforce"], staticDefault: "enforce", danger: SEC, configKey: "memoryOrgAdmissionMode" }),
@@ -395,12 +395,13 @@ export const CONFIG_CATALOG = [
     r("RATE_LIMIT_RPM", "limitsHttp", "number", "计费提交每分钟限流(0=关)", { staticDefault: "0", danger: BILL, configKey: "rateLimitPerMin", center: cLimits("rateLimitPerMin") }),
     r("READ_DENY_BUILTIN_EXCLUDE", "orchestration", "csv", "按行名删内建 deny 条目(档位之后生效;绝不削任务显式 deny)", { danger: SEC, configKey: "readDenyBuiltinExclude" }),
     r("READ_DENY_BUILTIN_TIERS", "orchestration", "csv", "内建 deny 表档位选择(闭集五档 credentials/shell-history/browser/wallet/agent-config;none=显式空姿态)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 出厂两档在岗 **credentials,agent-config**(core 7.34.0 R-2 起;7.22.0–7.33.x 曾为 OFF)。要全关显式写 none;要全五档显式写 credentials,shell-history,browser,wallet,agent-config;空值拒启(手滑与显式意图不许同形)", configKey: "readDenyBuiltinTiers" }),
+    r("READ_DENY_FLOOR_REQUIRED", "orchestration", "boolean", "要求读拒表的字节地板:true ⇒ 读拒表有行而执行环境不守地板(起服行 remote_exec_enabled.keepsReadFloor=false;此时另有起服 warn read_deny_floor_required_unkept)的 run 在准备期拒(config.read_deny_floor_unkept,一个命令都不起;同步提交 409)。出厂读拒档在岗 ⇒ 不守地板的车道(主机 / ssh / adb / device,以及读地板模块尚未服务或 SANDBOX_READ_FLOOR=off 的沙箱车道)上带手的 run 一律拒起", { staticDefault: "false", danger: SEC, derivedDefaultNote: "缺席 ⇒ 不要求:run 照跑,每 run 一条 operator 通告 config.read_deny_floor_unkept(engine_notice 日志;递归读照读表里的文件,通告不是保护)", configKey: "readDenyFloorRequired" }),
     r("READ_DENY_PATTERNS", "orchestration", "csv", "READ 面额外 deny pattern 表", { danger: SEC, configKey: "readDenyPatterns" }),
     r("READ_FACE", "orchestration", "enum", "READ 容纳面档位(env 逐键恒赢 center —— 部署主权表达)", { enumValues: ["open", "roots"], danger: SEC, derivedDefaultNote: "缺席 ⇒ 按 posture 派生(S-167):单用户 turnkey(REQUIRE_PRINCIPAL 未设)铸 open;多租户不铸键、core 默认 roots。生效来源见 GET /v1/diagnostics/wiring 的 readFace.source 四词", configKey: "readFace" }),
     r("REAP_INTERVAL_SEC", "limitsHttp", "number", "reaper 周期(秒)", { staticDefault: "60", configKey: "reapIntervalSec" }),
     r("REAP_RUN_STALE_SEC", "limitsHttp", "number", "run 活性判陈旧阈(秒)", { staticDefault: "120", configKey: "runStaleSec", center: cLimits("runStaleSec") }),
-    r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)", { enumValues: REMOTE_EXEC_PROVIDER_WORDS, danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub(手带整族不挂;残余名册看活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点。想让这一形拒启见 REQUIRE_EXECUTION_LANE)", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
-    r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基、引擎家锚拒读行的落点;core ExecutionEnv.homeDir 座)。声明优先:不声明时 k8s / local-docker / ssh / adb 车道建环境那一拍实测执行环境自己的 $HOME 填引擎手里的座(`~/` 形规则的下单门仍只认声明);k8s / local-docker / ssh 车道的声明会在每只执行环境开起来时与它的 $HOME 对证(同一只判官、同一句拒),不一致或问不出 ⇒ 那只环境不开", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user;k8s/local-docker/ssh/adb ⇒ 建环境时实测 $HOME(实测缺席 ⇒ 那只环境的座缺席:泄内容的递归读全 shell 面真人问、只读面拒,并响 warn execution_lane_home_undeclared);device ⇒ 无(设备协议没有家目录读数:起服 warn execution_lane_home_undeclared);`~/` 形规则的下单门恒只认声明(无声明即 422 响亮拒)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
+    r("REMOTE_EXEC", "orchestration", "enum", "执行车道选择(点名而配不齐/认不出 ⇒ 拒启,绝不静默降级到 host/stub)。形 = 部署声明的有序车道表(逗号分隔、首项缺省,契约 runtime.execution.lanes 的渲染形);本引擎每个进程只装一条车道 ⇒ 表里不止一条拒启,单词照旧", { enumValues: REMOTE_EXEC_PROVIDER_WORDS, danger: SEC, derivedDefaultNote: "缺席:CONFIG_PROVIDER=local ⇒ host;其余 ⇒ 进程内 stub(手带整族不挂;残余名册看活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点。想让这一形拒启见 REQUIRE_EXECUTION_LANE)", configKey: "remoteExec", resolve: (c) => c.remoteExec?.provider ?? null }),
+    r("REMOTE_EXEC_HOME_DIR", "orchestration", "path", "执行环境的 home 目录(`~/` 形权限规则的基、引擎家锚拒读行的落点;core ExecutionEnv.homeDir 座)。声明与车道出厂答案(host ⇒ 本进程家目录,e2b ⇒ /home/user)都是主张:读得出家目录的车道(k8s / local-docker / ssh / adb / e2b / host)在每只执行环境开起来时拿环境里命令看到的 $HOME 证它(同一只判官、同一句拒),不一致或问不出 ⇒ 那只环境不开;不声明且车道没有出厂答案时,建环境那一拍实测 $HOME 填引擎手里的座(`~/` 形规则的下单门仍只认 boot 期答案);device 读不了 ⇒ 声明即座、起服 warn execution_lane_home_unmeasured 披露未实测", { danger: SEC, derivedDefaultNote: "缺席:host/in-process ⇒ os.homedir();e2b ⇒ /home/user(两者都在环境开起来时与 $HOME 对证);k8s/local-docker/ssh/adb ⇒ 建环境时实测 $HOME(实测缺席 ⇒ 那只环境的座缺席:泄内容的递归读全 shell 面真人问、只读面拒,并响 warn execution_lane_home_undeclared);device ⇒ 无(设备协议没有家目录读数:起服 warn execution_lane_home_undeclared);`~/` 形规则的下单门恒只认声明(无声明即 422 响亮拒)", configKey: "remoteExecHomeDir", resolve: (c) => c.remoteExecHomeDir ?? null }),
     r("REQUIRE_EXECUTION_LANE", "orchestration", "boolean", "开了之后:REMOTE_EXEC 未点名 ∧ CONFIG_PROVIDER≠local ⇒ **拒启**并点名该设什么。默认关 = 照旧启动,但执行环境是进程内 stub、**零手带工具**(手带整族不挂;活体读数:mountedBy=hands 条目 10 → 0),名册里其余工具照常执行,任务仍回 status=completed —— 凡需要手的请求,与「模型不肯用工具」在用户面同形。判据 = 活体 wiring_manifest 里 mountedBy=hands 的条目数,不按工具名点;名册总条数随 core 版本走,不写死。托管/云部署推荐开(docs/DEPLOY-PREREQS.md)", { staticDefault: "false", danger: SEC, configKey: "requireExecutionLane" }),
     r("REQUIRE_PRINCIPAL", "auth", "boolean", "多租户开关(posture 判别位:true ⇒ CC 能力族默认收紧)", { staticDefault: "false", danger: SEC, configKey: "requirePrincipal" }),
     r("RESOURCE_SUSPEND", "approval", "boolean", "durable 路径 opt-in core resourceSuspend(预算/preempt ⇒ 可恢复挂起)", { staticDefault: "false", configKey: "resourceSuspend" }),
@@ -421,6 +422,7 @@ export const CONFIG_CATALOG = [
     r("SANDBOX_BASE_REF", "orchestration", "string", "bake 缺省 base ref(缺席回落 index 最新 sandbox-base)"),
     r("SANDBOX_ENV_FACTS", "orchestration", "boolean", "沙箱事实注入(# Environment 块的 profile/capabilities/pkgSource/egress/resume 事实);会话 scratchpad 的宣告不归本键管(S-842:它是写面的宣告,关事实不关 scratchpad)", { staticDefault: "true", configKey: "envFactsEnabled" }),
     r("SANDBOX_PKG_SOURCE", "orchestration", "enum", "沙箱包源选择(cn/global/custom;none=完全不注入)", { enumValues: ["global", "cn", "custom", "none"], staticDefault: "global" }),
+    r("SANDBOX_READ_FLOOR", "orchestration", "enum", "沙箱三车道(e2b / k8s / local-docker)的读拒表字节地板:keep = 沙箱读地板模块服务该车道时守地板(命令跑的每个程序都打不开读拒表判拒的路径,做不到就拒起该命令:spawn_error 首句点名原因词);off = 不守(车道块 keepsReadFloor=false,起动与没有模块时逐字同)。起服行 remote_exec_enabled.sandboxReadFloor 报生效状态(kept / off / unserved);别的车道上无作用;词表外 / 空串拒启", { enumValues: SANDBOX_READ_FLOOR_WORDS, staticDefault: SANDBOX_READ_FLOOR_DEFAULT, danger: SEC, derivedDefaultNote: "缺席 ⇒ keep;本版模块尚未服务任何沙箱车道(状态 unserved),三条沙箱车道照旧不守地板", configKey: "sandboxReadFloor" }),
     r("SCHEDULER_ENABLED", "orchestration", "boolean", "自唤醒 scheduler(host 车道单用户形)", { derivedDefaultNote: "posture 三态:缺席 = 单用户 ⇒ on / 多租户 ⇒ off(调度归 center)", configKey: "schedulerEnabled" }),
     r("SCHEDULER_SESSION_LIFETIME", "orchestration", "boolean", "session-lifetime 记录 host-signal(headless 壳注 false ⇒ CronCreate 前门拒)", { staticDefault: "true", configKey: "schedulerSessionLifetime" }),
     r("SCHEDULER_SESSION_WAKEUP", "orchestration", "boolean", "session 唤醒 host-signal(无常驻 daemon 的壳注 false)", { staticDefault: "true", configKey: "schedulerSessionWakeup" }),
@@ -450,7 +452,7 @@ export const CONFIG_CATALOG = [
     r(WEB_ADMIN_ENV.worker, "integrations", "string", "本 worker 在 web-admin 上的名字(per-worker effective)"),
     r("SEND_USER_FILE_SANDBOX_PUT_ENDPOINT", "store", "url", "沙箱侧 presigned PUT Host 绑定 endpoint(in-cluster 可用内网面)", { derivedDefaultNote: "缺席 ⇒ publicEndpoint" }),
     r("SEND_USER_FILE_URL_TTL", "store", "number", "公链 TTL(秒;非法值回 0=永久轨,绝不 NaN 进签名)", { staticDefault: "0" }),
-    r("SENSITIVE_WRITE_PATTERNS", "approval", "csv", "敏感路径写 deny 集(unset=core 推荐集;显式值整表替换;off/空=关 —— 真放松杆)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ core RECOMMENDED_SENSITIVE_PATTERNS", configKey: "sensitiveWritePatterns" }),
+    r("SENSITIVE_WRITE_PATTERNS", "approval", "csv", "敏感路径写 deny 集(unset=core 推荐集;显式值整表替换;off/空=关 —— 真放松杆)。拒的是文件工具(Write / Edit / NotebookEdit,按路径);shell 命令写同一路径(重定向 / tee / cp …)不被这个集拒绝,走普通审批问", { danger: SEC, derivedDefaultNote: "缺席 ⇒ core RECOMMENDED_SENSITIVE_PATTERNS", configKey: "sensitiveWritePatterns" }),
     r("SERVICE_AUTH_TOKEN", "auth", "secret", "共享 service token(写面门;缺席且未开 ALLOW_UNAUTHED_WRITES ⇒ 拒提交)", { danger: SEC }),
     r("SERVICE_AUTH_TOKENS", "auth", "secret", "per-system 凭据表(tok=system CSV;source 从凭据派生,绝不自报)", { danger: SEC }),
     r("SESSION_AUTO_TITLE", "orchestration", "boolean", "首次提交自动铸 session 标题(一次 cheap 调用)", { staticDefault: "true", danger: BILL, configKey: "sessionAutoTitle" }),
@@ -641,6 +643,8 @@ function sanitizeValue(spec, v) {
     const type = spec.type;
     if (type === "url") {
         if (typeof v === "string") {
+            if (spec.enumValues?.includes(v) === true)
+                return { value: v };
             if (v.includes(","))
                 return displayUrlItems(v.split(",").map((s) => s.trim()), true);
             const shown = buildDisplaySafeUrlChecked(v);