@sema-agent/server 7.146.0 → 7.148.0

package/dist/boot/stores.d.ts

@@ -1,3 +1,4 @@
+import { sessionBoxMountVerdict } from "@sema-agent/core";
 import type { ServiceConfig } from "../config.js";
 import { type MemorySyncRunner } from "../memory-sync-client.js";
 import type { Logger } from "../observability/logger.js";
@@ -6,11 +7,14 @@ import { type MemorySyncStore } from "../plugins/memory-sync-store-pg.js";
 import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import { type StoreBackend } from "../plugins/store-backend.js";
 import { type MemoryScopeStores } from "../memory-scope-stores.js";
+import { type StoreEvidence } from "../store-posture.js";
 export interface OpenStoresCtx {
     config: ServiceConfig;
     logger: Logger;
     metrics: Metrics;
     localRoot: string;
+    /** 店的持久性起服证据(起服第 2 段段首 `captureBootStoreEvidence` 取的那一份;直接调本函数的测试同一只取证)。 */
+    storeEvidence: StoreEvidence;
 }
 /**
  * durable 回决腿的规则位给 `approval_ask` 加了 `rule_command`/`rule_scope_root` 两列,而 `ensureAsk` 的 INSERT 与每一条读**无条件**引用它们 ⇒ 存量表上整条流内审批协议
@@ -20,6 +24,14 @@ export interface OpenStoresCtx {
  * 不在这里手抄一份,也不在别处再求一遍(手抄的判据会漂,漂的方向要么是拒启误伤、要么是该拒不拒;再求一遍的 park 设施位手上没有那只店)。本函数只做探:有 SQL 池就探,local 后端无池则无事。
  */
 export declare function assertApprovalAskRuleMaterialOnBackend(backend: StoreBackend | undefined): Promise<void>;
+/**
+ * 起服报告 `session_box_mount` 那一行(纯数据):引擎会话盒挂载判官的判决 → 级别与键集,唯一一处。挂得上 ⇒ info `{ peerLaneMountable: true }`;
+ * 挂不上 ⇒ warn `{ peerLaneMountable: false, peerLaneRefusal: <引擎的码>, reason: <引擎的句> }`。{@link openStores} 对本部署装的那一对店问一次、按它落行。
+ */
+export declare function buildSessionBoxMountLine(verdict: ReturnType<typeof sessionBoxMountVerdict>): {
+    readonly level: "info" | "warn";
+    readonly fields: Readonly<Record<string, unknown>>;
+};
 export declare function openStores(ctx: OpenStoresCtx): Promise<{
     backend: StoreBackend | undefined;
     storePosture: import("../store-posture.js").StorePosture;

package/dist/boot/stores.js

@@ -1,5 +1,5 @@
 import { join } from "node:path";
-import { FileBackgroundAgentStore, FileMailboxStore, FileRosterStore, InMemoryUsageWindowStore, mailboxCrossProcessMountVerdict } from "@sema-agent/core";
+import { FileBackgroundAgentStore, FileMailboxStore, FileRosterStore, InMemoryUsageWindowStore, sessionBoxMountVerdict } from "@sema-agent/core";
 import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
 import { startMemorySyncRunner } from "../memory-sync-client.js";
 import { errorCodeOf, errorKindOf } from "../observability/err-text.js";
@@ -12,6 +12,7 @@ import { TiDBMemoryHistoryStore, TiDBMemorySyncStore, ensureTiDBMemoryHistorySch
 import { MinioBlobBackend } from "../plugins/blob-backend.js";
 import { ensureSnapshotBuckets } from "../plugins/snapshot-bucket-presence.js";
 import { PgBackgroundAgentStore, TiDBBackgroundAgentStore, ensurePgBackgroundAgentSchema, ensureTiDBBackgroundAgentSchema } from "../stores-sql/background-agent-store-sql.js";
+import { recordFailOpen } from "../observability/fail-open.js";
 import { PgMailboxStore, TiDBMailboxStore, ensurePgMailboxSchema, ensureTiDBMailboxSchema } from "../stores-sql/mailbox-store-sql.js";
 import { recipientLifecycleOf } from "../plugins/mailbox-recipient-lifecycle.js";
 import { PgUsageWindowStore, TiDBUsageWindowStore, ensurePgUsageWindowSchema, ensureTiDBUsageWindowSchema } from "../stores-sql/usage-window-store-sql.js";
@@ -25,23 +26,24 @@ import { createTaskListLane } from "./task-list-lane.js";
 import { ensurePgTaskListSchema, ensureTiDBTaskListSchema } from "../plugins/task-list-store-sql.js";
 import { assertDeviceAuditRebindEventSchema, ensurePgDeviceSchema, ensureTiDBDeviceSchema } from "../plugins/device-store-sql.js";
 import { mysqlDriver, pgDriver } from "../plugins/sql-driver.js";
-import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback, workflowJournalOf } from "../plugins/store-backend.js";
+import { assertCloudSnapshotBlobPosture, localClientWritesOf, openStoreBackendWithFallback, workflowJournalOf } from "../plugins/store-backend.js";
 import { createMemoryEngineIncidentSink } from "../memory-incident-sink.js";
 import { announceLockedLegacyMemoryLayers } from "../memory-layer-legacy-lock.js";
 import { createEngineNoticeForwarder } from "./runner-deps.js";
-import { buildMemoryRemoteLaneWarn, canonicalPathOf, judgeMemoryRootOutsideDataRoot, memoryEngineBackendFor, memoryEngineRemoteLanePosture, memoryEngineRootFor, memoryMountRootOf } from "../memory-scope.js";
+import { announceMemoryLedgerForm, buildMemoryRemoteLaneWarn, canonicalPathOf, judgeMemoryRootOutsideDataRoot, memoryEngineBackendFor, memoryEngineRemoteLanePosture, memoryEngineRootFor, memoryMountRootOf } from "../memory-scope.js";
 import { createMemoryScopeStores } from "../memory-scope-stores.js";
 import { assertToolResultProvenanceSchema } from "../stores-sql/tool-result-store-sql.js";
 import { assertPermissionRuleApprovalSchema, assertPermissionRuleTicketSchema } from "../plugins/permission-rule-store-sql.js";
 import { assertApprovalAskRuleMaterialSchema } from "../plugins/approval-ask-store-sql.js";
 import { assertSchemaMatchesCode } from "../plugins/schema-consistency.js";
+import { assertSessionExtCascadeOn } from "../plugins/session-ext-table.js";
 import { SqlCheckpointStore, assertCheckpointColumnSchema } from "../stores-sql/checkpoint-store-sql.js";
-import { assertFileHistorySchema } from "../plugins/file-history-store-sql.js";
+import { assertFileHistorySchema } from "../stores-sql/file-history-store-sql.js";
 import { buildMemoryBoundaryLaneFacts, buildMemoryWriteBoundaryAudit } from "./memory-boundary.js";
 import { buildMemoryPosture } from "../memory-posture.js";
 import { headReadOf } from "../session-incarnation.js";
 import { establishSqlEnginePosture, sqlPoolsOf } from "../sql-engine-posture.js";
-import { buildStorePosture } from "../store-posture.js";
+import { buildStoreFreshStartLine, buildStorePosture } from "../store-posture.js";
 import { seatText } from "../trace/exit-seat.js";
 import { buildStoreSweepBounds, createJournalSweepLeg, createStoreSweep } from "../plugins/store-sweep.js";
 const DARK_REASON_PROSE = {
@@ -57,8 +59,13 @@ export async function assertApprovalAskRuleMaterialOnBackend(backend) {
     else if (mysqlPool)
         await assertApprovalAskRuleMaterialSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "mysql");
 }
+export function buildSessionBoxMountLine(verdict) {
+    return verdict.ok
+        ? { level: "info", fields: { peerLaneMountable: true } }
+        : { level: "warn", fields: { peerLaneMountable: false, peerLaneRefusal: verdict.code, reason: verdict.reason } };
+}
 export async function openStores(ctx) {
-    const { config, logger, metrics, localRoot } = ctx;
+    const { config, logger, metrics, localRoot, storeEvidence } = ctx;
     let backend;
     let storeDegradedReason;
     const dsnConfigured = !!(config.tidb || config.pg);
@@ -67,12 +74,10 @@ export async function openStores(ctx) {
         config.dbBackend === "local" ||
         (config.sessionBackend === "auto" && dsnConfigured);
     if (wantDb) {
-        const opened = await openStoreBackendWithFallback(config, logger);
+        const opened = await openStoreBackendWithFallback(config, logger, { runStallVerdicts: (landed) => metrics.inc("runs_reaped_total", { kind: "stale" }, landed) });
         backend = opened.backend;
         storeDegradedReason = opened.degradedReason;
     }
-    const storePosture = buildStorePosture({ declared: config.dbBackend, assembled: backend?.kind, degradedReason: storeDegradedReason });
-    metrics.setGauge("store_backend_degraded", storePosture.degradedReason !== undefined ? 1 : 0);
     {
         const mysqlPool = backend?.mysqlPool?.();
         const pgPool = backend?.pgPool?.();
@@ -98,6 +103,10 @@ export async function openStores(ctx) {
             await assertFileHistorySchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
         else if (mysqlPool)
             await assertFileHistorySchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "mysql");
+        if (pgPool)
+            await assertSessionExtCascadeOn(pgDriver(pgPool));
+        else if (mysqlPool)
+            await assertSessionExtCascadeOn(mysqlDriver(mysqlPool));
     }
     if (backend)
         await runAndLogOneTimeMigrations(logger, backend);
@@ -159,7 +168,7 @@ export async function openStores(ctx) {
             });
             if (embedder !== undefined && config.memoryEmbedder !== undefined) {
                 await ensurePgMemoryEmbedderMetaSchema(q);
-                await reconcileEmbedderFingerprint(q, { model: config.memoryEmbedder.model, dimensions: config.memoryEmbedder.dimensions }, { log: logger });
+                await reconcileEmbedderFingerprint(q, { model: config.memoryEmbedder.model, dimensions: config.memoryEmbedder.dimensions }, { log: logger, reembedConfirmed: config.memoryEmbedder.reembedConfirmed === true });
             }
             else {
                 logger.info("memory_embedder_identity_absent", {
@@ -197,6 +206,7 @@ export async function openStores(ctx) {
         });
     }
     else {
+        await announceMemoryLedgerForm(config, undefined, logger);
         const fileEngine = memoryEngineBackendFor(config, undefined, memoryEngineIncident);
         memoryEngine = fileEngine !== undefined ? scopeStoresOver(fileEngine.backend) : undefined;
         if (memoryEngine)
@@ -212,6 +222,17 @@ export async function openStores(ctx) {
             }
         }
     }
+    const storePosture = buildStorePosture({
+        declared: config.dbBackend,
+        assembled: backend?.kind,
+        degradedReason: storeDegradedReason,
+        evidence: storeEvidence,
+        memoryRootWired: config.memoryEngineBackend === "file" && memoryEngine !== undefined,
+    });
+    metrics.setGauge("store_backend_degraded", storePosture.degradedReason !== undefined ? 1 : 0);
+    const freshStart = buildStoreFreshStartLine(storePosture, storeEvidence);
+    if (freshStart !== undefined)
+        logger.info("store_fresh_start", freshStart);
     {
         const laneFacts = buildMemoryBoundaryLaneFacts(config, process.cwd());
         const memoryMountRoot = memoryEngine ? memoryMountRootOf(memoryEngine.backend, memoryEngine.root) : undefined;
@@ -257,11 +278,11 @@ export async function openStores(ctx) {
         if (pgPool) {
             const q = async (text, params) => { const r = await pgPool.query(text, params); return { rows: r.rows }; };
             await ensurePgBackgroundAgentSchema(q);
-            backgroundAgentStore = new PgBackgroundAgentStore(q);
+            backgroundAgentStore = new PgBackgroundAgentStore(q, recordFailOpen);
         }
         else if (mysqlPool) {
             await ensureTiDBBackgroundAgentSchema(mysqlPool);
-            backgroundAgentStore = new TiDBBackgroundAgentStore(mysqlPool);
+            backgroundAgentStore = new TiDBBackgroundAgentStore(mysqlPool, recordFailOpen);
         }
         else if (backend?.kind === "local") {
             backgroundAgentStore = new FileBackgroundAgentStore(config.localDataRoot ?? localRoot);
@@ -294,7 +315,7 @@ export async function openStores(ctx) {
             }
         }
         else if (backend?.kind === "local") {
-            taskAttachmentStore = new LocalTaskAttachmentStore(config.localDataRoot ?? localRoot);
+            taskAttachmentStore = new LocalTaskAttachmentStore(config.localDataRoot ?? localRoot, { clientWrites: localClientWritesOf(backend) });
         }
         if (taskAttachmentStore)
             logger.info("task_attachment_store_enabled", { backend: pgPool ? "pg+minio" : mysqlPool ? "mysql+minio" : "file", maxBytes: config.attachmentMaxBytes });
@@ -322,13 +343,10 @@ export async function openStores(ctx) {
         if (mailboxStore)
             mailboxRecipientLifecycle = recipientLifecycleOf(mailboxStore);
         if (mailboxStore) {
-            const laneVerdict = mailboxCrossProcessMountVerdict(mailboxStore);
             logger.info("mailbox_store_enabled", {
                 backend: pgPool ? "pg" : mysqlPool ? "mysql" : "file",
                 crossProcessSafe: mailboxStore.crossProcessSafe,
                 recipientTombstones: pgPool !== undefined || mysqlPool !== undefined,
-                peerLaneMountable: laneVerdict.ok,
-                ...(laneVerdict.ok ? {} : { peerLaneRefusal: laneVerdict.code }),
             });
         }
     }
@@ -397,7 +415,7 @@ export async function openStores(ctx) {
             await ensurePgDeviceSchema(async (text, params) => pgPool.query(text, params));
         if (mysqlPool)
             await ensureTiDBDeviceSchema(mysqlPool);
-        if (config.remoteExec?.provider === "device") {
+        if (config.remoteExec.provider === "device") {
             if (pgPool)
                 await assertDeviceAuditRebindEventSchema(pgDriver(pgPool));
             else if (mysqlPool)
@@ -429,6 +447,10 @@ export async function openStores(ctx) {
         });
     }
     metrics.dynamicGauge("sessions_warm", "Sessions held in the warm cache", () => sessionStore.size);
+    if (mailboxStore !== undefined) {
+        const line = buildSessionBoxMountLine(sessionBoxMountVerdict(mailboxStore, sessionStore));
+        logger[line.level]("session_box_mount", line.fields);
+    }
     const breakerState = backend?.breaker && config.resilience.circuitBreaker
         ? backend
             .breaker((streak) => {

package/dist/boot/task-list-lane.d.ts

@@ -55,14 +55,14 @@ export interface TaskListLane {
      * 所有权,故按 sessionId 单键删。
      *
      * 幂等(没写过任何任务的会话删 0 行);错误如实上抛 —— E21 的次序契约要求子腿失败就中止,让
-     * session_meta 留着、幂等重试收敛(session-faces.ts 顶注)。
+     * session_meta 留着、幂等重试收敛(删净执行体 `session-erase.ts` 头注:行最后删)。
      *
      * 📌 **残余,如实登记**(codex R2-[high] 判真、**射程外**):删除进行中若有一次并发 `storeFor`,
      * 它会拿到一只新铸的可写店,写入可能落在 purge 事务提交**之后** ⇒ 行被重建、留给下一个化身。
      * 这不是本腿独有的窗口,而是**整条 E21 级联共有的**残余(anchors / exemption / policy / attachment /
-     * snapshot / task_list 全是按 session_id 单键删、且各自开始时刻不同),`session-faces.ts` 的 purge
-     * 协调器里那段「残余,如实登记」逐字记着它与它的两条收口候选。真正消灭它要么让整条级联化身原子
-     * (单事务横跨十余张表 + 对象存储),要么引入**跨副本 durable 的会话化身号**并让每次写校验它 ——
+     * snapshot / task_list 全是按 session_id 单键删)。删净执行体(`session-erase.ts`)让 SQL 上的整条级联落进一个事务、
+     * local 上落进会话店的一节写锁,但并发 `storeFor` 铸的可写店不读那只锁 / 不看那一事务 —— 写仍可能落在删净之后。真正消灭它
+     * 要么让每次写在会话行锁下校验住客,要么引入**跨副本 durable 的会话化身号**并让每次写校验它 ——
      * 两者都是设计级改动(属主裁决 + 三问),给 task-list 单独发明一套围栏只会在同一语义面上多一个
      * 写者。⇒ 归入既有的那条后续件,不在本批自作主张。
      */

package/dist/boot/web-admin.d.ts

@@ -89,8 +89,10 @@ export interface WebAdminRuntime {
         degradeRoute: DegradeRouteWatch;
         checkpointStorePresent: boolean;
     }): void;
-    /** [ref]-2:停刷新环(hardShutdown 收尾链;幂等,未起环时 no-op)。[ref]:中心凭证续签器的定时器同停(同一条收尾链)。 */
-    stopRefreshLoop(): void;
+    /** [ref]-2:停刷新环(hardShutdown 收尾链;幂等,未起环时 no-op)。[ref]:中心凭证续签器的定时器同停(同一条收尾链)。
+     *  返回的 promise = 续签器 `stop()` 的那一只:已经发出的那一次续签落定(新信封落盘或按失败落定)之后 settle,从不 reject —— 进程出口
+     *  (停机的退出链、起服前探针)等它再退,中心已答应的轮换不被进程退出腰斩。 */
+    stopRefreshLoop(): Promise<void>;
     /** [ref]:`/health.centerCredential` 的取值口 —— 凭证来源的健康态 + 续签器状态;都健康 / 没有中心 ⇒ `undefined`(键缺席)。 */
     centerCredentialState(): CenterCredentialHealthView | undefined;
     /** [ref]:`/health.centerIdentityNotice` 的取值口 —— 中心凭证换人后的**最近一条**通告(`center_identity_demoted` 已降到无中心配置档 / `center_identity_landed`

package/dist/boot/web-admin.js

@@ -7,12 +7,12 @@ import { stableStringify } from "@sema-agent/settings-schema/hash";
 import { buildModelRefusalsSignal } from "../model-entry-refusal.js";
 import { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "@sema-agent/core";
 import { buildPricing } from "../budget.js";
-import { applyCenterPlugins } from "../capabilities/center-plugins.js";
+import { applyCenterPlugins, pluginCacheRootFor } from "../capabilities/center-plugins.js";
 import { applyCenterArtifact, centerSourceOnError, withPromptArtifactBackfill } from "../capabilities/center-prompts.js";
 import { centerScenarios, centerScenarioDetails } from "../capabilities/scenarios.js";
 import { isRosterGateArmed } from "../config.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
-import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg } from "../config-lkg.js";
+import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg, preIdentityLkgLeftover, PRE_IDENTITY_LKG_REASON } from "../config-lkg.js";
 import { answerStillCurrent, centerStateBin, credentialIdentityNow, judgeCenterCredentialAtBoot } from "../center-credential.js";
 import { createCenterConfigTier } from "../center-config-tier.js";
 import { buildCenterCredentialHealthView, createCenterCredentialRenewer } from "../center-credential-renewer.js";
@@ -20,8 +20,10 @@ import { centerManagedConfigKeys } from "../web-admin-client/apply-effective.js"
 import { configSourceKind, createConfigProvider, raceBootFetch, BOOT_FETCH_DEFERRED } from "../config-provider.js";
 import { REMOTE_CATALOG_SOURCE } from "../env-model-table-gate.js";
 import { ConfigDirUntrustedError } from "../config-dir-trust.js";
+import { ConfigPullError, ConfigPullSupersededError, asConfigPullError, configPullFailureNote } from "../config-pull-failure.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { buildSealedKeyPublicFace, ensureCheckpointCtxSealing, ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
+import { sealedKeyDirOf } from "../sealed-key-layout.js";
 import { anthropicLaneCredentialOf } from "../model-route-gap.js";
 import { applyEffective, applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, mutateInPlace, logEffectiveDiff, applySkillsManifest, skillManifestEntriesNotInstalled, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, NO_CENTER_EFFECTIVE, isNoCenterEffective, fetchPromptArtifact } from "../web-admin-client/facade.js";
 import { buildConfigHandoff, buildRestartSignal, configHandoffMissing } from "../fleet/engine-signal.js";
@@ -29,7 +31,7 @@ import { createMcpRevocationLedger, enabledMcpEntries } from "../web-admin-clien
 import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "../web-admin-client/read-warnings.js";
 import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, candidateRejectionOf, judgeConfigCandidate } from "../web-admin-client/candidate-gate.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
-import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../web-admin-client/apply-ledger.js";
+import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneOutcome, refusedGroups } from "../web-admin-client/apply-ledger.js";
 import { announceReadDenyRows, buildDeploymentPostureSeats } from "./runner-deps.js";
 import { seatText } from "../trace/exit-seat.js";
 const MODELS_REJECTION_PHRASE = {
@@ -133,6 +135,15 @@ export async function createWebAdminRuntime(ctx) {
             validatorIdentity.delete(oldest.value);
     };
     const pullEffective = async (provider, etag) => {
+        try {
+            return await pullEffectiveOnce(provider, etag);
+        }
+        catch (err) {
+            throw asConfigPullError(err);
+        }
+    };
+    const refreshFailureCause = (err) => (err instanceof ConfigPullError ? err.pullCause : "apply_refused");
+    const pullEffectiveOnce = async (provider, etag) => {
         if (provider.kind === "local")
             return provider.fetchEffective(etag);
         const before = currentIdentity();
@@ -140,7 +151,7 @@ export async function createWebAdminRuntime(ctx) {
         const r = await provider.fetchEffective(conditional);
         const used = r === null ? before : r.credentialIdentity;
         if (cc === undefined || !answerStillCurrent(cc.credential, used)) {
-            throw new Error("center credential identity changed while the effective pull was in flight — response discarded; the next pull runs under the current credential");
+            throw new ConfigPullSupersededError("center credential identity changed while the effective pull was in flight — response discarded; the next pull runs under the current credential");
         }
         if (r !== null) {
             candidateIdentity.set(r.effective, used);
@@ -148,7 +159,7 @@ export async function createWebAdminRuntime(ctx) {
         }
         return r;
     };
-    const sealedKeyDir = config.sealedKeyDir ?? join(config.localDataRoot ?? localRoot, "sealed-key");
+    const sealedKeyDir = sealedKeyDirOf(config, localRoot);
     let sealedKeys;
     try {
         sealedKeys = await ensureSealedKeyStore(sealedKeyDir, logger);
@@ -213,7 +224,7 @@ export async function createWebAdminRuntime(ctx) {
         const domains = verdict.domains.join(",");
         if (candidateRejection?.version === r.effective.version && candidateRejection.domains.join(",") === domains)
             return;
-        admitArrival(ordinal, candidateRejectionOf(r, verdict, candidateSource().kind, Date.now()));
+        admitArrival(ordinal, candidateRejectionOf(r, verdict, candidateSource().kind, Date.now(), localDirField.dir));
         logger.warn("config_candidate_rejected", buildCandidateRejectedFields(r, verdict, leg, { lkgVersion: latestEffective?.version ?? "(env)", ...localDirField }));
     };
     const noteSourceAtApplied = () => {
@@ -422,8 +433,7 @@ export async function createWebAdminRuntime(ctx) {
         handoff = { ...(applied !== undefined ? { applied } : {}), ...(durable !== undefined ? { durable } : {}) };
         latchHandoff();
     };
-    const markApplied = (gen, eff) => {
-        applyLedger.applied(gen, eff.version);
+    const markApplied = (eff) => {
         if (isNoCenterEffective(eff))
             noteHandoff({ noneApplied: true });
         else
@@ -432,6 +442,7 @@ export async function createWebAdminRuntime(ctx) {
         if (landed !== undefined)
             announceTier(landed);
     };
+    const closeApplied = (gen, eff) => applyLedger.applied(gen, eff.version);
     let lkgBooted = false;
     let bootLkgCandidate;
     let lastPrewarmBodiesVerified = false;
@@ -495,10 +506,13 @@ export async function createWebAdminRuntime(ctx) {
                 return null;
             }
             const lkgPath = lkgPathFor(identity);
-            const read = await loadLkg(lkgPath, cc?.worker, identity);
+            const read = await loadLkg(lkgPath, cc?.worker, identity, { declaredOwnerUid: config.configLocalOwnerUid });
             if (!read.lkg) {
                 if (read.reason !== "absent")
                     logger.warn("config_lkg_unusable", { path: lkgPath, reason: read.reason, note: "ignoring the on-disk LKG — env fallback serves; the cache rewrites on the next clean candidate" });
+                const leftover = read.reason === "absent" && config.configLkgPath === undefined ? preIdentityLkgLeftover(config, cc?.worker, lkgPath) : undefined;
+                if (leftover !== undefined)
+                    logger.warn("config_lkg_unusable", { path: leftover, reason: PRE_IDENTITY_LKG_REASON, note: "a last-known-good written by 7.98.0 or earlier sits at the pre-identity default name and is never read — delete this file (a cache, not data); env fallback serves, and the next clean candidate writes this credential identity's own LKG" });
                 return null;
             }
             if (currentIdentity() !== identity) {
@@ -544,9 +558,10 @@ export async function createWebAdminRuntime(ctx) {
             const lkgIdentity = candidateIdentityOf(lkgR.effective);
             if (lkgSurvivesRestart && lkgIdentity !== undefined)
                 noteHandoff({ durable: { version: lkgR.effective.version, identity: lkgIdentity } });
-            markApplied(lkgGen, lkgR.effective);
+            markApplied(lkgR.effective);
+            closeApplied(lkgGen, lkgR.effective);
             await adoptCenterPrompts(lkgR.effective, lkgR.prompts, "boot-lkg");
-            const lkgPlane = modelPlaneCommitted(lkgReport);
+            const lkgPlane = modelPlaneOutcome(lkgReport) === "landed";
             if (lkgPlane)
                 markRosterLanded(lkgR.effective);
             effective = lkgR.effective;
@@ -592,7 +607,6 @@ export async function createWebAdminRuntime(ctx) {
                                 : "config.d/models.json 空或 CONFIG_LOCAL_DIR 指错目录(选目录旋钮是 CONFIG_LOCAL_DIR,不是 LOCAL_DATA_ROOT)— 模型继续走 env 兜底",
             });
         };
-        let bootApplyPhase = false;
         try {
             const bootFetch = pullEffective(configProvider, undefined);
             const raced = await raceBootFetch(bootFetch, config.configBootFetchBudgetMs);
@@ -611,7 +625,6 @@ export async function createWebAdminRuntime(ctx) {
             }
             const r = raced === BOOT_FETCH_DEFERRED ? null : raced;
             if (r) {
-                bootApplyPhase = true;
                 for (const de of r.domainErrors ?? [])
                     logger.warn("config_domain_invalid", { domain: de.domain, error: de.error, note: CONFIG_DOMAIN_INVALID_NOTE });
                 if (dryRun) {
@@ -651,18 +664,20 @@ export async function createWebAdminRuntime(ctx) {
                                 recordApply(rep, bootArrival);
                             },
                         });
-                        markApplied(bootGen, r.effective);
+                        markApplied(r.effective);
+                        closeApplied(bootGen, r.effective);
                         const bootClean = fullyLandedForLkg(r, bootReport);
                         if (bootClean)
                             ccEtag = r.etag;
                         await adoptCenterPrompts(r.effective, bootVerdict.prompts, "boot");
-                        let bootPlaneEff = modelPlaneCommitted(bootReport) ? r.effective : undefined;
-                        if (bootPlaneEff === undefined) {
+                        const bootOutcome = modelPlaneOutcome(bootReport);
+                        let bootPlaneEff = bootOutcome === "landed" ? r.effective : undefined;
+                        if (bootOutcome === "refused" || bootOutcome === undefined) {
                             const lkgPlane = await bootFromLkg("boot candidate's model plane was refused", "model-plane");
                             if (lkgPlane) {
                                 let planeReport;
                                 applyEffective(config, withModelPlaneOf(r.effective, lkgPlane.effective), logger, { leg: "boot", catalogSource: lkgPlane.catalogSource, sealedKeys, generation: bootGen, report: (rep) => (planeReport = rep) });
-                                if (modelPlaneCommitted(planeReport)) {
+                                if (modelPlaneOutcome(planeReport) === "landed") {
                                     bootPlaneEff = lkgPlane.effective;
                                     logger.warn("config_model_plane_from_lkg", { version: r.effective.version, lkgVersion: lkgPlane.effective.version, note: "the live candidate's model plane was refused at boot — serving the LKG's model plane (the catalog and what rides with it) with the live candidate's other groups; the refresh cadence re-judges the candidate" });
                                 }
@@ -690,11 +705,11 @@ export async function createWebAdminRuntime(ctx) {
         catch (err) {
             if (err instanceof ConfigDirUntrustedError)
                 throw err;
-            if (bootApplyPhase)
-                logger.warn("config_apply_refused", { source: configProvider.kind, err: seatText("operator-log-text", String(err)), note: "the pulled candidate failed to apply at boot — falling back to the LKG / env; this is not a reachability failure" });
+            if (err instanceof ConfigPullError)
+                logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, cause: err.pullCause, err: seatText("operator-log-text", String(err)), note: configPullFailureNote(err.pullCause) });
             else
-                logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: seatText("operator-log-text", String(err)) });
-            await bootFallBackWhole(`${bootApplyPhase ? "boot apply refused" : "boot fetch failed"}: ${seatText("operator-log-text", String(err))}`);
+                logger.warn("config_apply_refused", { source: configProvider.kind, err: seatText("operator-log-text", String(err)), note: "the pulled candidate failed to apply at boot — falling back to the LKG / env; this is not a reachability failure" });
+            await bootFallBackWhole(`${err instanceof ConfigPullError ? "boot fetch failed" : "boot apply refused"}: ${seatText("operator-log-text", String(err))}`);
         }
         if (!dryRun && cc !== undefined && currentIdentity() !== promptStateIdentity)
             await rebasePromptState(currentIdentity(), "boot-end");
@@ -776,7 +791,7 @@ export async function createWebAdminRuntime(ctx) {
                 skills = await applySkillsManifest(skills, effective.skills, candidateSource(), logger);
             if (effective?.plugins !== undefined) {
                 const pluginOut = await applyCenterPlugins(skills, effective, {
-                    cacheRoot: join(config.localDataRoot ?? join(homedir(), ".ai-agent"), "plugin-cache"),
+                    cacheRoot: pluginCacheRootFor(config.localDataRoot ?? join(homedir(), ".ai-agent")),
                     allowHosts: config.pluginsAllowHosts,
                     toolsShareThisFilesystem: DEPLOYMENT_SHAPE_PREDICATES.toolsOnThisHost.holds(config),
                     logger,
@@ -839,6 +854,7 @@ export async function createWebAdminRuntime(ctx) {
         startRefreshLoop(a) {
             const { pricing, limitSync, swapRunnerDeps, ceilingVerdict, consolidationSeat, degradeRoute, checkpointStorePresent } = a;
             const signalRestart = (c) => {
+                closeApplied(c.gen, c.effective);
                 const reasons = restartReasons(c.baseline, c.effective, restartCtx(consolidationSeat?.read(), degradeRoute.read()));
                 const skillsChangeDetected = reasons.includes("skills");
                 if (bootSkillStale && !skillsChangeDetected)
@@ -934,8 +950,8 @@ export async function createWebAdminRuntime(ctx) {
                     if (phase !== "boot-deferred")
                         mcpRevocations.applyEnabledEntries(enabledMcpEntries(eff.mcp));
                     applyLiveReadFace(eff, swapRunnerDeps, phase);
-                    markApplied(gen, eff);
-                    const planeCommitted = modelPlaneCommitted(report);
+                    markApplied(eff);
+                    const planeCommitted = modelPlaneOutcome(report) === "landed";
                     if (planeCommitted)
                         appliedPlaneEff = noCenter ? undefined : eff;
                     planeDeferredNoHandoff = undefined;
@@ -954,6 +970,7 @@ export async function createWebAdminRuntime(ctx) {
                     if (!hot.committed) {
                         throw new Error("the no-center tier was refused (the Runners did not accept the env model table) — the previous account's center configuration is still in force; retried next tick");
                     }
+                    closeApplied(gen, NO_CENTER_EFFECTIVE);
                     if (hot.report !== undefined && !hot.report.fullyApplied) {
                         logger.warn("center_identity_demotion_partial", { groups: refusedGroups(hot.report).map((g) => g.group), note: "a group of the no-center tier was refused — that group keeps its previous values (loud; the env base for that group could not be applied)" });
                     }
@@ -1045,7 +1062,7 @@ export async function createWebAdminRuntime(ctx) {
                                         groups: refused.map((g) => g.group),
                                         note: "a group of this candidate was refused — the live config keeps serving the prior values for it; the LKG and the ETag stay on the last FULLY applied generation (this tree is re-judged next tick)",
                                     });
-                                    const partialSignal = signalRestart({ applied: "partial", effective: r.effective, baseline: effective, refused: refused.map((g) => g.group) });
+                                    const partialSignal = signalRestart({ applied: "partial", gen: tickGen, effective: r.effective, baseline: effective, refused: refused.map((g) => g.group) });
                                     logger.info("web_admin_refreshed", {
                                         version: r.effective.version,
                                         note: "partially applied — the refused group(s) keep their prior values (see config_candidate_partially_applied); the other groups hot-applied; restart fields as on a complete tick",
@@ -1054,7 +1071,7 @@ export async function createWebAdminRuntime(ctx) {
                                     return "ok";
                                 }
                                 const lkgPersisted = await persistLkgDurable(r.effective, r.etag);
-                                const signal = signalRestart({ applied: "complete", effective: r.effective, ...(r.etag !== undefined ? { etag: r.etag } : {}), baseline: effective, lkgPersisted });
+                                const signal = signalRestart({ applied: "complete", gen: tickGen, effective: r.effective, ...(r.etag !== undefined ? { etag: r.etag } : {}), baseline: effective, lkgPersisted });
                                 logger.info("web_admin_refreshed", {
                                     version: r.effective.version,
                                     note: "runtime governance (incl. approvalRequire) + limits + models/roles/roster hot-applied; skills/mcp/a2a/scenarios are restart-to-apply",
@@ -1066,7 +1083,7 @@ export async function createWebAdminRuntime(ctx) {
                         }
                     }
                     catch (err) {
-                        logger.warn("web_admin_refresh_failed", { err: seatText("operator-log-text", String(err)), note: "etag NOT advanced — the same candidate is re-fetched and re-applied next poll" });
+                        logger.warn("web_admin_refresh_failed", { cause: refreshFailureCause(err), err: seatText("operator-log-text", String(err)), note: "etag NOT advanced — the same candidate is re-fetched and re-applied next poll" });
                         return "failed";
                     }
                     finally {
@@ -1075,16 +1092,17 @@ export async function createWebAdminRuntime(ctx) {
                     return "ok";
                 };
                 let inFlight;
-                const runTick = (arrival) => {
+                const enterLane = (body) => {
                     if (inFlight)
                         return inFlight;
-                    const p = refreshTick(arrival).finally(() => {
+                    const p = body().finally(() => {
                         inFlight = undefined;
                         afterLane();
                     });
                     inFlight = p;
                     return p;
                 };
+                const runTick = (arrival) => enterLane(() => refreshTick(arrival));
                 const requestTick = () => {
                     if (ccTimer === undefined || ownRead)
                         return;
@@ -1115,21 +1133,22 @@ export async function createWebAdminRuntime(ctx) {
                     requestTick();
                 const deferredBootApply = async (r, arrivalGen) => {
                     if (!r)
-                        return;
+                        return "ok";
                     if (refreshInFlight)
-                        return;
+                        return "ok";
                     refreshInFlight = true;
                     try {
                         await deferredBootApplyInner(r, useArrivalGeneration(r.effective.version, arrivalGen));
                         if (configProvider.kind === "remote")
                             lastPull = "ok";
+                        return "ok";
                     }
                     catch (err) {
-                        logger.warn("web_admin_refresh_failed", { err: seatText("operator-log-text", String(err)), leg: "boot-deferred", note: "etag NOT advanced — the refresh cadence re-fetches and re-applies the same candidate" });
+                        logger.warn("web_admin_refresh_failed", { cause: refreshFailureCause(err), err: seatText("operator-log-text", String(err)), leg: "boot-deferred", note: "etag NOT advanced — the refresh cadence re-fetches and re-applies the same candidate" });
+                        return "failed";
                     }
                     finally {
                         refreshInFlight = false;
-                        afterLane();
                     }
                 };
                 const deferredBootApplyInner = async (r, lateGen) => {
@@ -1159,7 +1178,7 @@ export async function createWebAdminRuntime(ctx) {
                             groups: refusedLate.map((g) => g.group),
                             note: "late-boot candidate had a refused group — the LKG/ETag stay on the last FULLY applied generation; the refresh cadence re-judges the same tree",
                         });
-                        const partialSignalLate = signalRestart({ applied: "partial", effective: r.effective, baseline: undefined, refused: refusedLate.map((g) => g.group) });
+                        const partialSignalLate = signalRestart({ applied: "partial", gen: lateGen, effective: r.effective, baseline: undefined, refused: refusedLate.map((g) => g.group) });
                         logger.info("config_loaded_deferred", { source: configProvider.kind, version: r.effective.version, models: (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length, ...restartLogFields(partialSignalLate) });
                         return;
                     }
@@ -1167,16 +1186,16 @@ export async function createWebAdminRuntime(ctx) {
                     latestEffective = r.effective;
                     ccEtag = r.etag;
                     const lkgPersistedLate = await persistLkgDurable(r.effective, r.etag);
-                    const signalLate = signalRestart({ applied: "complete", effective: r.effective, ...(r.etag !== undefined ? { etag: r.etag } : {}), baseline: undefined, lkgPersisted: lkgPersistedLate });
+                    const signalLate = signalRestart({ applied: "complete", gen: lateGen, effective: r.effective, ...(r.etag !== undefined ? { etag: r.etag } : {}), baseline: undefined, lkgPersisted: lkgPersistedLate });
                     logger.info("config_loaded_deferred", { source: configProvider.kind, version: r.effective.version, models: (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length, ...restartLogFields(signalLate) });
                 };
                 if (bootConfigPending) {
                     const arrivalGen = reserveArrivalGeneration();
-                    const continueArrival = (r) => void (lkgBooted ? runTick({ result: r, ordinal: arrivalGen }) : deferredBootApply(r, arrivalGen));
+                    const continueArrival = (r) => void (lkgBooted ? runTick({ result: r, ordinal: arrivalGen }) : enterLane(() => deferredBootApply(r, arrivalGen)));
                     void bootConfigPending.then((r) => {
                         if (r !== null && configProvider.kind === "remote" && candidateIdentityOf(r.effective) !== currentIdentity()) {
                             logger.warn("config_boot_arrival_identity_changed", { note: "the late boot pull landed under a center credential that is no longer current — not adopted; re-pulling once under the current credential" });
-                            void pullEffective(configProvider, undefined).then(continueArrival, (err) => logger.warn("config_boot_arrival_repull_failed", { err: seatText("operator-log-text", String(err)), note: "the refresh cadence retries under the current credential" }));
+                            void pullEffective(configProvider, undefined).then(continueArrival, (err) => logger.warn("config_boot_arrival_repull_failed", { cause: refreshFailureCause(err), err: seatText("operator-log-text", String(err)), note: "the refresh cadence retries under the current credential" }));
                             return;
                         }
                         continueArrival(r);
@@ -1189,9 +1208,10 @@ export async function createWebAdminRuntime(ctx) {
                 clearInterval(ccTimer);
                 ccTimer = undefined;
             }
-            credentialRenewer?.stop();
+            const credentialSettled = credentialRenewer?.stop() ?? Promise.resolve();
             unwatchCredential?.();
             unwatchCredential = undefined;
+            return credentialSettled;
         },
         centerCredentialState() {
             return cc === undefined ? undefined : buildCenterCredentialHealthView(cc.credential.health(), credentialRenewer);

package/dist/boot/webfetch-summarize-lane.d.ts

@@ -24,7 +24,7 @@
  * 当年 core 的摘要器没有凭据座,只能在 brain 外面包一层注入 `options.apiKey`(`createPerModelKeyBrain`)。
  * core 7.51.0 起 `WebFetchSummarizerOptions.getApiKeyAndHeaders` 是与 `TaskSpec` / `SideQuerySpec` 同一签名的座
  * (每次摘要按摘要器的模型解一次,`{ apiKey, headers }` 两半都收)⇒ 那层包装退役:`RunnerDeps.brain` 原样交给
- * 摘要器,座位由与 side-query / 记忆整理**同一只**座位工厂(`createPerModelAuthSeat`)填充:
+ * 摘要器,座位由与 side-query **同一只**座位工厂(`createPerModelAuthSeat`)填充(两面都每次现取模型、不焊模型;记忆整理席焊住 Model,凭据随座冻结,见 `boot/memory-consolidation.ts`):
  *  · 有 per-model key ⇒ 请求带模型自己的凭据;
  *  · 无 ⇒ 座位回 `undefined` ⇒ 交回 core 按它自己的 key↔URL 配对法判(部署根上的模型带网关 key;
  *    entry URL 不在部署根上 ⇒ `route.credential_mismatch` 响亮拒 —— core 7.51.0 起没有「未声明部署根」的

package/dist/boot-reclaim.d.ts

@@ -15,7 +15,9 @@ export interface ReclaimableRunStore {
 }
 /** A checkpoint store just enough to answer "is this session a resume-in-progress?" (pending checkpoint). */
 export interface ReclaimCheckpointProbe {
-    findPendingTokenBySession: (sessionId: string) => Promise<unknown>;
+    findPendingTokenBySession: (sessionId: string, scope: undefined, binding: {
+        readonly axis: "run";
+    }) => Promise<unknown>;
 }
 /**
  * Reclaim runs orphaned by a previous host-lane engine process (flip orphaned `running` → failed + release their

package/dist/boot-reclaim.js

@@ -3,7 +3,7 @@ export async function reclaimOrphansAtBoot(runStore, checkpointStore, logger) {
     if (typeof store?.reclaimOrphanedAtBoot !== "function")
         return 0;
     const isResumable = checkpointStore
-        ? async (sid) => Boolean(await checkpointStore.findPendingTokenBySession(sid))
+        ? async (sid) => Boolean(await checkpointStore.findPendingTokenBySession(sid, undefined, { axis: "run" }))
         : undefined;
     const reclaimedCount = await store.reclaimOrphanedAtBoot(isResumable);
     if (reclaimedCount > 0)