@sema-agent/server 7.151.0 → 7.152.0

package/dist/config-catalog.js

@@ -5,8 +5,8 @@ import { DEVICE_RELAY_NONE, WEB_ADMIN_ENV, DOMAIN_SCHEMAS, buildRetiredEnvWire }
 import { CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS, CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS, CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS } from "./center-credential-renewer.js";
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS } from "./workspace-cache.js";
-import { SESSION_SNAPSHOT_BUCKET_DEFAULT, WORKSPACE_SNAPSHOT_BUCKET_DEFAULT } from "./object-store-buckets.js";
-import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_PREFIX_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE } from "./workspace-space.js";
+import { LEGACY_BLOB_ROOT_DEFAULT, S3_PUBLIC_BUCKET_DEFAULT, SESSION_SNAPSHOT_BUCKET_DEFAULT, SIGV4_PRESIGN_MAX_SEC, WORKSPACE_SNAPSHOT_BUCKET_DEFAULT, WORKSPACE_SNAPSHOT_PREFIX_DEFAULT, objectStoreActionOf } from "./object-store-buckets.js";
+import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE } from "./workspace-space.js";
 import { APPROVAL_ASK_RETENTION_DEFAULT_MS, APPROVAL_ASK_RETENTION_FLOOR_MS } from "./approval-ask-retention.js";
 import { SANDBOX_SECRET_SEAT_VERBS } from "./plugins/k8s-exec-protocol.js";
 import { ADOPTION_IMPORT_MAX_SESSIONS_DEFAULT, ADOPTION_IMPORT_MAX_SESSIONS_FLOOR, ADOPTION_IMPORT_MAX_SESSION_BYTES_CEILING, ADOPTION_IMPORT_MAX_SESSION_BYTES_DEFAULT, ADOPTION_IMPORT_MAX_SESSION_BYTES_FLOOR } from "./adoption/import-limits.js";
@@ -24,6 +24,7 @@ import { buildDisplaySafeUrlChecked } from "./trace/redact.js";
 import { describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 import { buildOutboundProxyPosture } from "./outbound-dispatcher.js";
 import { modelImageInput, modelReasoningDecl } from "./model-select.js";
+const BLOB_TTL_DEFAULT_SEC = ((ttl) => (ttl === "unsigned" ? undefined : ttl.defaultSec))(objectStoreActionOf("file-history/blob:GET").ttl);
 export const CATALOG_VALUE_TYPES = ["boolean", "number", "string", "enum", "csv", "json", "path", "url", "secret", "opaque"];
 export const CATALOG_TIMINGS = ["hot", "restart", "deploy", "inert"];
 export const CATALOG_DANGER_AXES = ["security", "billing", "data"];
@@ -384,8 +385,9 @@ export const CONFIG_CATALOG = [
     r("MYSQL_PORT", "store", "number", "MySQL 协议端口", { staticDefault: "3306" }),
     r("MYSQL_USER", "store", "string", "MySQL 协议用户", { danger: DATA }),
     r("NO_PROXY", "limitsHttp", "csv", "不走代理的目标(小写 `no_proxy` 同认且优先);语法 = undici 的:逗号或空白分隔,`host` 精确且含其子域、`.host` / `*.host` 后缀、`host:port` 限端口、`*` 全直连;**回环 / 未指定地址目标无论写没写都直连**(本仓的无条件规则,不是 NO_PROXY 的一条);boot 冻结", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 除回环外一律按 HTTP(S)_PROXY 走", resolve: (_c, env) => buildOutboundProxyPosture(env).noProxy }),
-    r("OPERATOR_PRINCIPALS", "auth", "csv", "operator 名单(全部运维面同一条读法:名单内的验过主体是运维;空名单 = 谁都不是;与 OPERATOR_SINGLE_USER 互斥;单用户部署与 OPERATOR_SINGLE_USER 二者必写其一,都不写则拒启 —— 服务进程起服第 1 段即拒,直接调 `createHttpServer` 的嵌入方装配时拒)", { danger: SEC, configKey: "operatorPrincipals" }),
-    r("OPERATOR_SINGLE_USER", "auth", "boolean", "单用户形当自己运维的显式声明(true ⇒ 这台部署的每个调用方在全部运维面都是运维;只在 REQUIRE_PRINCIPAL 未开且 OPERATOR_PRINCIPALS 为空时成立,否则拒启;单用户部署与具名 OPERATOR_PRINCIPALS 二者必写其一 —— 都不写则拒启(服务进程起服第 1 段;嵌入方装配运维面时),false 与缺席同判;起服冻结)", { staticDefault: "false", danger: SEC, configKey: "operatorSingleUser" }),
+    r("OPERATOR_DRAIN_PRINCIPALS", "auth", "csv", "名册的排空档 —— 只持排空一权的服务主体名单(名单内的验过主体可调 POST /v1/admin/drain,不是人:它的身份在其余每条路由上整次请求 403 auth.principal_confined,GET /health 按没出示凭据分档,它名下登记过的设备在 GET /v1/device/ws 的 hello 被拒 auth_failed;空 / 缺席 = 这一档没人;与 OPERATOR_PRINCIPALS 同一个名字 ⇒ 拒启;与 OPERATOR_SINGLE_USER 互斥;不算运维声明;起服冻结)", { danger: SEC, configKey: "operatorDrainPrincipals" }),
+    r("OPERATOR_PRINCIPALS", "auth", "csv", "operator 名单 —— 名册的全运维档(全部运维面同一条读法:名单内的验过主体是运维,持每一只运维权力,排空在内;空名单 = 谁都不是;与 OPERATOR_DRAIN_PRINCIPALS 不相交;与 OPERATOR_SINGLE_USER 互斥;单用户部署与 OPERATOR_SINGLE_USER 二者必写其一,都不写则拒启 —— 服务进程起服第 1 段即拒,直接调 `createHttpServer` 的嵌入方装配时拒)", { danger: SEC, configKey: "operatorPrincipals" }),
+    r("OPERATOR_SINGLE_USER", "auth", "boolean", "单用户形当自己运维的显式声明(true ⇒ 这台部署的每个调用方在全部运维面都是运维;只在 REQUIRE_PRINCIPAL 未开且 OPERATOR_PRINCIPALS 与 OPERATOR_DRAIN_PRINCIPALS 都为空时成立,否则拒启;单用户部署与具名 OPERATOR_PRINCIPALS 二者必写其一 —— 都不写则拒启(服务进程起服第 1 段;嵌入方装配运维面时),false 与缺席同判;起服冻结)", { staticDefault: "false", danger: SEC, configKey: "operatorSingleUser" }),
     r("OTEL_EXPORTER_OTLP_ENDPOINT", "observability", "url", "OTLP 出口(设了=开 otel)", { credentialPolicy: "mask" }),
     r("OTEL_EXPORTER_OTLP_HEADERS", "observability", "secret", "OTLP 出口头(k=v CSV;常载鉴权头 ⇒ 按凭据处置)", { credentialForm: "whole", danger: SEC }),
     r("OTEL_EXPORT_INTERVAL_MS", "observability", "number", "OTLP 批报周期(ms)", { staticDefault: "15000" }),
@@ -436,8 +438,8 @@ export const CONFIG_CATALOG = [
     r("RUN_MAX_CONCURRENT", "orchestration", "number", "本副本在飞 run 的全局并发帽(0 = 关;整数,坏值拒启):提交门(POST /v1/runs · A2A message/send · POST /v1/tasks · POST /v1/tasks/stream)在幂等重放之后判在飞数,已到帽 ⇒ 429 limit.rate_exceeded + reason run_concurrency_cap + Retry-After: 5;续跑 / 唤醒 / 审批作答不判", { staticDefault: "0", configKey: "runMaxConcurrent" }),
     r("RUN_MAX_CONCURRENT_PER_PRINCIPAL", "orchestration", "number", "同一已验提交主体在本副本的在飞 run 并发帽(0 = 关;整数,坏值拒启;无主体请求不判这一帽,只受 RUN_MAX_CONCURRENT)", { staticDefault: "0", configKey: "runMaxConcurrentPerPrincipal" }),
     r("RUN_STORE_STRICT_HYDRATE", "store", "enum", "file run-store 列不出 runs/ 时拒启的 fail-closed 门(缺省带病起动+响亮披露)", { enumValues: ["on", "off"], staticDefault: "off", danger: DATA, configKey: "runStoreStrictHydrate", booleanEnum: { true: "on", false: "off" } }),
-    r("S3_ENDPOINT", "store", "url", "外接 S3 兼容位(单独在场即开公链签发,兼作公网面)", { credentialPolicy: "mask", danger: DATA }),
-    r("S3_PUBLIC_BUCKET", "store", "string", "SendUserFile 公链桶", { derivedDefaultNote: "缺席 ⇒ sema-public" }),
+    r("S3_ENDPOINT", "store", "url", "外接 S3 兼容位(MINIO_ENDPOINT 缺席时作 SendUserFile 的对象存储端点,与 MINIO_ACCESS_KEY / MINIO_SECRET_KEY 同在才开签发;S3_PUBLIC_ENDPOINT 缺席时兼作公网面)", { credentialPolicy: "mask", danger: DATA }),
+    r("S3_PUBLIC_BUCKET", "store", "string", "SendUserFile 公链桶", { derivedDefaultNote: `缺席 ⇒ ${S3_PUBLIC_BUCKET_DEFAULT}` }),
     r("S3_PUBLIC_ENDPOINT", "store", "url", "SendUserFile 公网面 endpoint(跨仓契约名,禁改)", { credentialPolicy: "mask" }),
     r("SANDBOX_BASE_REF", "orchestration", "string", "bake 缺省 base ref(缺席回落 index 最新 sandbox-base)"),
     r("SANDBOX_ENV_FACTS", "orchestration", "boolean", "沙箱事实注入(# Environment 块的 profile/capabilities/pkgSource/egress/resume 事实);会话 scratchpad 的宣告不归本键管(它是写面的宣告,关事实不关 scratchpad)", { staticDefault: "true", configKey: "envFactsEnabled" }),
@@ -473,7 +475,7 @@ export const CONFIG_CATALOG = [
     r(WEB_ADMIN_ENV.webUrl, "integrations", "url", `web-admin 人用界面的固定基址:引擎原样转述到 /health 的 center.webBaseUrl,壳按它拼会话深链(路径归壳)。缺席即缺席(引擎不拼不猜);只在接了中心(${WEB_ADMIN_ENV.url})时挂;必须与中心身份(AUTH_BRIDGE_ISSUER,缺席 = ${WEB_ADMIN_ENV.url})同主机同端口(http ↔ https 同族),否则拒启。${CENTER_BASE_URL_RULE}`, { credentialPolicy: "refuse" }),
     r(WEB_ADMIN_ENV.worker, "integrations", "string", "本 worker 在 web-admin 上的名字(per-worker effective)"),
     r("SEND_USER_FILE_SANDBOX_PUT_ENDPOINT", "store", "url", "沙箱侧 presigned PUT Host 绑定 endpoint(in-cluster 可用内网面)", { credentialPolicy: "mask", derivedDefaultNote: "缺席 ⇒ publicEndpoint" }),
-    r("SEND_USER_FILE_URL_TTL", "store", "number", "公链 TTL(秒;非法值回 0=永久轨,绝不 NaN 进签名)", { staticDefault: "0" }),
+    r("SEND_USER_FILE_URL_TTL", "store", "number", `SendUserFile 链接有效期(秒;不设 / 0 = 永久公链轨,正整数 = 私有预签名链接,至多 ${SIGV4_PRESIGN_MAX_SEC}(SigV4 的 7 天);超过上限或不是十进制整数(如 \`1h\` / \`-5\` / \`3600.5\` / \`1e3\`)起服拒)`, { staticDefault: "0" }),
     r("SENSITIVE_WRITE_PATTERNS", "approval", "csv", "敏感路径写 deny 集(unset=core 推荐集;显式值整表替换;off/空=关 —— 真放松杆)。拒的是文件工具(Write / Edit / NotebookEdit,按路径);shell 命令写同一路径(重定向 / tee / cp …)不被这个集拒绝,走普通审批问", { danger: SEC, derivedDefaultNote: "缺席 ⇒ core RECOMMENDED_SENSITIVE_PATTERNS", configKey: "sensitiveWritePatterns" }),
     r("SERVICE_AUTH_TOKEN", "auth", "secret", "共享 service token(写面门;缺席且未开 ALLOW_UNAUTHED_WRITES ⇒ 拒提交)", { credentialForm: "whole", danger: SEC }),
     r("SERVICE_AUTH_TOKENS", "auth", "secret", "per-system 凭据表(tok=system CSV;source 从凭据派生,绝不自报)", { credentialForm: "token-table", danger: SEC }),
@@ -486,8 +488,8 @@ export const CONFIG_CATALOG = [
     r("SESSION_EVENTS_MAX_PROBES", "limitsHttp", "number", "session SSE 共享探针数帽", { derivedDefaultNote: "缺席 ⇒ 512" }),
     r("SESSION_EVENTS_WARM_MS", "limitsHttp", "number", "session SSE 温探针间隔(ms)", { derivedDefaultNote: "缺席 ⇒ 2000" }),
     r("SESSION_SNAPSHOT_BUCKET", "store", "string", "快照 blob 桶(兼 SendUserFile 私桶)", { derivedDefaultNote: `缺席 ⇒ ${SESSION_SNAPSHOT_BUCKET_DEFAULT}` }),
-    r("SESSION_SNAPSHOT_PREFIX", "store", "string", "快照 blob key 前缀", { derivedDefaultNote: "缺席 ⇒ blobs/(MinioBlobBackend 默认)" }),
-    r("SESSION_SNAPSHOT_TTL_SEC", "store", "number", "快照 presign TTL(秒;坏值省略走默认,绝不 NaN 签名)", { derivedDefaultNote: "缺席 ⇒ 3600(MinioBlobBackend 默认)" }),
+    r("SESSION_SNAPSHOT_PREFIX", "store", "string", "会话 blob 命名空间的 key 前缀(文件历史 / 附件 / 认领物件;共用一只会话快照桶的引擎各设各的,同桶同前缀的第二只库起服拒;以 attachments/ 或 file-history/ 结尾的值起服拒)", { derivedDefaultNote: `缺席 ⇒ 文件历史、附件与认领物件在桶根,退役快照纪元读 ${LEGACY_BLOB_ROOT_DEFAULT}` }),
+    r("SESSION_SNAPSHOT_TTL_SEC", "store", "number", `会话 blob 请求的 presign TTL(秒;十进制整数,0 告警后走缺省;超过 ${SIGV4_PRESIGN_MAX_SEC}(SigV4 的 7 天)或不是十进制整数(如 \`1h\` / \`-5\` / \`3600.5\` / \`1e3\` / \`0x10\`)起服拒)`, { derivedDefaultNote: `缺席 ⇒ ${BLOB_TTL_DEFAULT_SEC}(对象存储动作表 blob 行的缺省)` }),
     r("SIGHUP_IDLE_GRACE_MS", "limitsHttp", "number", "SIGHUP 空闲关停窗(ms;共享引擎形防误杀)", { staticDefault: "120000", configKey: "sighupIdleGraceMs" }),
     r("SKILLS_DIR", "integrations", "path", "出厂 skill 目录(设了就整个替换包内 skills/,不叠加;配置源的技能再按名盖上)", { derivedDefaultNote: "缺席 ⇒ 包内 skills/(相对模块解析,不是 cwd)", configKey: "skillsDir" }),
     r("SNAPSHOT_BLOB_ALLOW_SQL_BYTES", "store", "boolean", "云形缺 MinIO 时显式接受 SQL 店放快照字节(严格 'true';安全姿势开关不收宽松真值)", { staticDefault: "false", danger: DATA, configKey: "snapshotBlobAllowSql" }),
@@ -504,7 +506,6 @@ export const CONFIG_CATALOG = [
     r("STREAM_APPROVAL_ADHOC_GRACE_MS", "approval", "number", "流内审批 adhoc 腿窗后宽限(ms;须 window+grace < orphanTtl,破坏形拒启)", { staticDefault: "60000" }),
     r("STREAM_APPROVAL_ADMIT_MAX_PER_OWNER", "approval", "number", "流内审批 per-owner 未决帽", { staticDefault: "256" }),
     r("STREAM_APPROVAL_ADMIT_MAX_PER_TASK", "approval", "number", "流内审批 per-task 未决帽(超限 unavailable ⇒ park 路由)", { staticDefault: "32" }),
-    r("STREAM_APPROVAL_ENABLED", "approval", "boolean", "流内审批协议总开关(false=整链回 7.3.0 前行为的唯一干净还原键)", { staticDefault: "true", danger: SEC, configKey: "streamApproval" }),
     r("STREAM_APPROVAL_ORPHAN_TTL_MS", "approval", "number", "遗孤 ask 最终可判上界(ms,量 createdAt)", { staticDefault: String(7 * 24 * 60 * 60 * 1000) }),
     r("STREAM_APPROVAL_PENDING_GRACE_MS", "approval", "number", "崩溃恢复扫描宽限(ms;活属主常态必胜,reaper 只兜纯崩溃)", { staticDefault: "30000" }),
     r("STREAM_APPROVAL_RECONCILE_BATCH", "approval", "number", "对账收敛器每 tick 每段行数帽(整数)", { staticDefault: "200" }),
@@ -550,7 +551,7 @@ export const CONFIG_CATALOG = [
     r("WORKSPACE_SNAPSHOT_KEEP", "orchestration", "number", `k8s 工作区每个空间(会话住客)保留的快照份数(整数 [${WORKSPACE_SNAPSHOT_KEEP_RANGE.min}, ${WORKSPACE_SNAPSHOT_KEEP_RANGE.max}];写新快照后删最老的;域外拒启)`, { staticDefault: String(WORKSPACE_SNAPSHOT_KEEP_DEFAULT), danger: DATA }),
     r("WORKSPACE_SNAPSHOT_PREFIX", "orchestration", "string", "k8s 工作区快照 key 前缀:`/` 分隔的一段或多段普通 key 段(kata、libA/ws;每段以字母或数字开头,其后字母数字 . _ -);空段 / . / .. / 前导或尾随 / / 其它字符 ⇒ 拒启并点名第几段(config.workspace_snapshot_prefix_invalid)", { derivedDefaultNote: `缺席 ⇒ ${WORKSPACE_SNAPSHOT_PREFIX_DEFAULT}` }),
     r("WORKSPACE_SNAPSHOT_TIMEOUT_MS", "orchestration", "number", `k8s 工作区快照的时限(毫秒,整数 [${WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE.min}, ${WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE.max}];域外拒启):一个数管四处 —— run 末上传与连沙箱时恢复的墙钟上界、空间结束时回收座一次调用的绝对截止(卷与对象都在内)、下一条 run 等上一条存完的最长等待(提交围栏的存活上界);大文件读写的墙钟也是它。大工作区(构建目录 GB 级)撞上界 ⇒ 调大它或配 WORKSPACE_SNAPSHOT_EXCLUDE`, { staticDefault: String(WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT) }),
-    r("WORKSPACE_SNAPSHOT_TTL_SEC", "orchestration", "number", "k8s 工作区快照 presign TTL(秒)"),
+    r("WORKSPACE_SNAPSHOT_TTL_SEC", "orchestration", "number", `k8s 工作区快照 presign TTL(秒;十进制整数,0 = 缺省;按行的策略帽截到 3600;超过 ${SIGV4_PRESIGN_MAX_SEC}(SigV4 的 7 天)或不是十进制整数(如 \`1h\` / \`-5\` / \`3600.5\` / \`1e3\` / \`0x10\`)起服拒)`),
     r("WORKTREE_ALLOWED_ROOTS", "orchestration", "csv", "worktree 隔离纵深白名单(缺省 = [repoRoot])", { danger: SEC }),
     r("WORKTREE_BASE_COMMIT", "orchestration", "string", "worktree 基准 ref(缺省 core HEAD)"),
     r("WORKTREE_ISOLATION_ENABLED", "orchestration", "boolean", "git-worktree 隔离(与 REPO_ROOT 同在才开,半配保持 OFF)", { staticDefault: "false", danger: SEC }),

package/dist/config-dir-trust.js

@@ -1,7 +1,8 @@
 import { lstat, readdir, readlink, realpath, stat } from "node:fs/promises";
 import path from "node:path";
-import { CONFIG_ROOT_DOCUMENTS } from "@sema-agent/settings-schema";
-import { LOCAL_READER_DOCUMENTS } from "./config-d-migration.js";
+import { CONFIG_ROOT_DOCUMENTS, RETIRED_DOMAINS, isRetiredDomainName } from "@sema-agent/settings-schema";
+import { PORTABLE_DOMAINS } from "@sema-agent/settings-schema/node";
+import { REMOTE_EXEC_DOCUMENT } from "@sema-agent/settings-schema/remote-exec";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { HOST_PLATFORM } from "./plugins/host-platform.js";
 import { coversPath, parseMountinfo, readProcessMountinfo, visibleMountOf } from "./mountinfo.js";
@@ -219,6 +220,7 @@ async function confirmUnreached(lexical) {
     }
     return { kind: "unresolvable", path: lexical };
 }
+const LOCAL_READER_DOCUMENTS = [...PORTABLE_DOMAINS, ...Object.keys(RETIRED_DOMAINS).filter(isRetiredDomainName), REMOTE_EXEC_DOCUMENT];
 const documentFiles = () => LOCAL_READER_DOCUMENTS.map((d) => `${d}.json`);
 const rootDocumentFiles = () => CONFIG_ROOT_DOCUMENTS.map((d) => `${d}.json`);
 async function reach(lexical, want, ctx) {

package/dist/config-invariants.d.ts

@@ -35,9 +35,9 @@ import { type EnvTableReplacementInput } from "./env-model-table-gate.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "operator-declaration-required" | "operator-single-user-boundary" | "single-user-anonymous-boundary" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "env-table-replacement-acknowledged" | "center-one-identity" | "workflow-park-decision-domain" | "remote-config-provider-url" | "retention-lane-complete";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "operator-single-user" | "operator-roster-well-formed" | "operator-declaration-required" | "operator-single-user-boundary" | "single-user-anonymous-boundary" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "multi-tenant-shared-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "anthropic-credential-exclusive" | "model-route-endpoint" | "default-model-resolvable" | "refused-names-not-minted" | "env-table-replacement-acknowledged" | "center-one-identity" | "workflow-park-decision-domain" | "remote-config-provider-url" | "retention-lane-complete";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser" | "bindHost" | "bindHostSource" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin" | "configProvider" | "retentionPolicy" | "retentionSweep">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "operatorDrainPrincipals" | "operatorSingleUser" | "bindHost" | "sensitiveWritePatterns" | "leaderEnabled" | "selfOrchestrationEnabled" | "workflowRunStoreBackend" | "remoteExec" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "modelRefusals" | "tiers" | "authBridgeIssuer" | "webAdmin" | "configProvider" | "retentionPolicy" | "retentionSweep">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;
@@ -80,10 +80,21 @@ export declare function halfOpenDirectDoorRefusal(v: Pick<CrossInvariantView, "d
  */
 export declare function operatorPrincipalsRequiredRefusal(v: Pick<CrossInvariantView, "durableApproval" | "requirePrincipal" | "operatorPrincipals">): string | undefined;
 /**
- * `operator-single-user`([ref],[ref] ① 裁 A):「谁是 operator」一个事实一个来源。`OPERATOR_SINGLE_USER=true`(单用户形的每个调用方都是运维)
- * 只在单用户形、名单为空时成立:多租形没有「单一用户」(声明会把每个租户都变成运维);名单非空时两个来源答同一个问题。两形都拒,句子点名两根旋钮与出路。
+ * `operator-single-user`([ref],[ref] ① 裁 A):「谁是 operator」一个事实一个来源。`OPERATOR_SINGLE_USER=true`(单用户形的每个调用方都落全运维档)
+ * 只在单用户形、名册各档名单都空时成立:多租形没有「单一用户」(声明会把每个租户都变成运维);任一档名单非空时两个来源答同一个问题(档表 `operator-roster.ts` 逐档读)。
+ * 两形都拒,句子点名两根旋钮与出路(一档一句,穷举 switch:加一档不接句子 = 编译红)。
  */
-export declare function operatorSingleUserRefusal(v: Pick<CrossInvariantView, "operatorSingleUser" | "requirePrincipal" | "operatorPrincipals">): string | undefined;
+export declare function operatorSingleUserRefusal(v: Pick<CrossInvariantView, "operatorSingleUser" | "requirePrincipal" | "operatorPrincipals" | "operatorDrainPrincipals">): string | undefined;
+/**
+ * `operator-roster-well-formed` —— **名册良构**(档表 `operator-roster.ts` 逐档读;三臂,按序答第一条):
+ *  ① 每一档的名单是名字的列表(绕过类型手搓的配置放一串字符串 ⇒ `includes` 读成子串匹配 = 放宽);
+ *  ② **非人档**的每个名字都是一位主体的名字(与身份边界同一只名形判官 `principalShapeProblem`:空 / 不可见字符 / 保留标识 / 超长)—— 坏形的名字永远读不成一位验过的人,
+ *     也就永远圈禁不到(圈禁判在读人抛名形错时不判,这一臂让「不判」结构上无害);人档的坏形名字只是永远对不上任何人,不拒(没写新键的部署零差);
+ *  ③ 各档名单不相交 —— 一个名字的运维权力只在一档里答(与 `operator-single-user` 同理:两个来源答同一个问题 ⇒ 拒)。
+ * 拒句点名 env 与条数,不回显名字(名单是部署的身份配置,拒句进 stderr 与起服日志)。**两处调用、一只判据**:`loadConfig`(服务入口起服即拒)与装配路由的
+ * `createHttpServer`(嵌入方只过这一座)。env 独有、起服冻结 —— 热路径上同判(条目在下)。
+ */
+export declare function operatorRosterWellFormedRefusal(v: Pick<CrossInvariantView, "operatorPrincipals" | "operatorDrainPrincipals">): string | undefined;
 /**
  * `operator-declaration-required`([ref])—— **单用户部署必须说出谁是运维**。单用户形(租户轴不成立,`DEPLOYMENT_SHAPE_PREDICATES.multiTenant`)上
  * 「谁是运维」只有两种答法:`OPERATOR_SINGLE_USER=true`(每个调用方都是)或具名 `OPERATOR_PRINCIPALS`;两样都没有 = 没人能用这台部署的运维面
@@ -95,7 +106,7 @@ export declare function operatorSingleUserRefusal(v: Pick<CrossInvariantView, "o
  */
 export declare function operatorDeclarationRefusal(v: Pick<CrossInvariantView, "requirePrincipal" | "operatorPrincipals" | "operatorSingleUser">): string | undefined;
 /** {@link operatorSingleUserBoundaryRefusal} 读的键(条目的 `keys` 与「判正在改的那份」比较同读这一张)。 */
-declare const SINGLE_USER_BOUNDARY_KEYS: readonly ["operatorSingleUser", "authToken", "authTokens", "allowUnauthedWrites", "bindHost", "bindHostSource"];
+declare const SINGLE_USER_BOUNDARY_KEYS: readonly ["operatorSingleUser", "authToken", "authTokens", "allowUnauthedWrites", "bindHost"];
 type SingleUserBoundaryView = Pick<CrossInvariantView, (typeof SINGLE_USER_BOUNDARY_KEYS)[number]>;
 /**
  * `operator-single-user-boundary` —— **单用户声明要有一道身份边界**。`OPERATOR_SINGLE_USER=true` 让这台部署的每个调用方都是运维(`explicitOperatorOk`),
@@ -109,7 +120,7 @@ type SingleUserBoundaryView = Pick<CrossInvariantView, (typeof SINGLE_USER_BOUND
  */
 export declare function operatorSingleUserBoundaryRefusal(v: SingleUserBoundaryView): string | undefined;
 /** {@link singleUserAnonymousBoundaryRefusal} 读的键(条目的 `keys` 与「判正在改的那份」比较同读这一张)。 */
-declare const ANONYMOUS_BOUNDARY_KEYS: readonly ["requirePrincipal", "authToken", "authTokens", "allowUnauthedWrites", "bindHost", "bindHostSource"];
+declare const ANONYMOUS_BOUNDARY_KEYS: readonly ["requirePrincipal", "authToken", "authTokens", "allowUnauthedWrites", "bindHost"];
 type AnonymousBoundaryView = Pick<CrossInvariantView, (typeof ANONYMOUS_BOUNDARY_KEYS)[number]>;
 /**
  * `single-user-anonymous-boundary` —— **单用户部署上不带主体的 run 要有一道身份边界**。单用户形(部署形表 `multiTenant` 不成立)上,不带主体的 run 就是这台部署的那一个人:

package/dist/config-invariants.js

@@ -2,6 +2,7 @@ import { assertGuardPatternsUsable } from "./deployment-governance.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { anthropicCredentialRefusal } from "./model-route-gap.js";
+import { CATALOG_REFUSAL_LEG } from "./model-select.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { defaultModelRefusal, refusedNameMintedRefusal } from "./model-entry-refusal.js";
 import { judgeEnvTableReplacement } from "./env-model-table-gate.js";
@@ -11,6 +12,8 @@ import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { ALL_EXECUTION_LANES, executionLaneCaps } from "./execution-lane-caps.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 import { bindMustNarrow, listensLoopbackOnly, resolveBindHost } from "./bind-host.js";
+import { ROSTER_TIERS, ROSTER_TIER_ORDER, rosterNamesOf } from "./operator-roster.js";
+import { principalShapeProblem } from "./principal-shape.js";
 export const LIVENESS_HEARTBEAT_MS = 30_000;
 const directDoorConjuncts = (v) => Boolean(v.directApprovalDoor) && Boolean(v.durableApproval) && v.approvalHmacKeys.length > 0 && v.principalJwtPubkeys.length > 0 && Boolean(v.principalJwtIss) && Boolean(v.principalJwtAud);
 function multiTenantSharedLaneRefusal(v) {
@@ -51,8 +54,41 @@ export function operatorSingleUserRefusal(v) {
         return undefined;
     if (v.requirePrincipal)
         return "OPERATOR_SINGLE_USER=true but REQUIRE_PRINCIPAL=true — the declaration makes every caller an operator, which only fits a single-user deployment; a multi-tenant worker names its operators in OPERATOR_PRINCIPALS. Unset OPERATOR_SINGLE_USER, or unset REQUIRE_PRINCIPAL if this is a single-user deployment";
-    if (v.operatorPrincipals.length > 0)
-        return "OPERATOR_SINGLE_USER=true but OPERATOR_PRINCIPALS is also set — the two answer the same question (who is an operator) in two ways. Keep one: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment) or OPERATOR_PRINCIPALS (only the named principals)";
+    const named = ROSTER_TIER_ORDER.find((tier) => rosterNamesOf(tier, v).length > 0);
+    if (named === undefined)
+        return undefined;
+    switch (named) {
+        case "operator":
+            return "OPERATOR_SINGLE_USER=true but OPERATOR_PRINCIPALS is also set — the two answer the same question (who is an operator) in two ways. Keep one: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment) or OPERATOR_PRINCIPALS (only the named principals)";
+        case "drain":
+            return "OPERATOR_SINGLE_USER=true but OPERATOR_DRAIN_PRINCIPALS is also set — the declaration already makes every caller an operator who may drain, so a drain-only roster answers the same question (who may drain) a second way. Keep one: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment) or OPERATOR_DRAIN_PRINCIPALS (only the named drain-only service principals, with the operators named in OPERATOR_PRINCIPALS)";
+        default: {
+            const unknownTier = named;
+            throw new Error(`operatorSingleUserRefusal: unknown roster tier ${String(unknownTier)}`);
+        }
+    }
+}
+export function operatorRosterWellFormedRefusal(v) {
+    for (const tier of ROSTER_TIER_ORDER) {
+        const names = v[ROSTER_TIERS[tier].field];
+        if (names !== undefined && (!Array.isArray(names) || names.some((n) => typeof n !== "string")))
+            return `${ROSTER_TIERS[tier].env} must be a list of principal names, and the assembled configuration carries something else in that cell — an embedder passes an array of names (loadConfig always does) (invariant operator-roster-well-formed). Refusing to boot.`;
+    }
+    for (const tier of ROSTER_TIER_ORDER) {
+        if (ROSTER_TIERS[tier].person)
+            continue;
+        const malformed = rosterNamesOf(tier, v).filter((n) => principalShapeProblem(n) !== undefined).length;
+        if (malformed > 0)
+            return `${ROSTER_TIERS[tier].env} lists ${malformed} entr${malformed === 1 ? "y that is" : "ies that are"} not a principal name (empty, invisible or control characters, a reserved identifier, or over the principal length budget) — no verified caller can carry such a name, so it could never be confined. Remove those entries (MIGRATION.md, invariant operator-roster-well-formed). Refusing to boot.`;
+    }
+    for (const [i, a] of ROSTER_TIER_ORDER.entries()) {
+        const names = new Set(rosterNamesOf(a, v));
+        for (const b of ROSTER_TIER_ORDER.slice(i + 1)) {
+            const shared = rosterNamesOf(b, v).filter((n) => names.has(n)).length;
+            if (shared > 0)
+                return `${ROSTER_TIERS[a].env} and ${ROSTER_TIERS[b].env} name the same principal (${shared} name${shared === 1 ? "" : "s"} in both lists) — a principal's operator powers must be answered by one roster tier only. Remove each such name from one of the two lists (MIGRATION.md, invariant operator-roster-well-formed). Refusing to boot.`;
+        }
+    }
     return undefined;
 }
 export function operatorDeclarationRefusal(v) {
@@ -63,7 +99,7 @@ export function operatorDeclarationRefusal(v) {
         "Declare who operates it in one line: OPERATOR_SINGLE_USER=true (every caller of this single-user deployment is its operator — with a service credential or a loopback-only listener, or anyone who can reach the port is) or OPERATOR_PRINCIPALS=<principal,...> (only the named principals); " +
         "a worker called by more than one person is multi-tenant — set REQUIRE_PRINCIPAL=true instead (MIGRATION.md, invariant operator-declaration-required). Refusing to boot.");
 }
-const SINGLE_USER_BOUNDARY_KEYS = ["operatorSingleUser", "authToken", "authTokens", "allowUnauthedWrites", "bindHost", "bindHostSource"];
+const SINGLE_USER_BOUNDARY_KEYS = ["operatorSingleUser", "authToken", "authTokens", "allowUnauthedWrites", "bindHost"];
 function sameSingleUserBoundary(a, b) {
     return a.operatorSingleUser === b.operatorSingleUser && hasServiceAuth(a) === hasServiceAuth(b) && resolveBindHost(a) === resolveBindHost(b);
 }
@@ -83,9 +119,9 @@ function offHostListener(v) {
     const bound = resolveBindHost(v);
     if (listensLoopbackOnly(bound))
         return undefined;
-    return bound === undefined ? "every network interface (BIND_HOST is not set)" : `${bound}${v.bindHostSource === "HOST" ? " (from the HOST env var)" : ""}`;
+    return bound === undefined ? "every network interface (BIND_HOST is not set)" : bound;
 }
-const ANONYMOUS_BOUNDARY_KEYS = ["requirePrincipal", "authToken", "authTokens", "allowUnauthedWrites", "bindHost", "bindHostSource"];
+const ANONYMOUS_BOUNDARY_KEYS = ["requirePrincipal", "authToken", "authTokens", "allowUnauthedWrites", "bindHost"];
 function sameAnonymousBoundary(a, b) {
     return DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(a) === DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(b) && bindMustNarrow(a) === bindMustNarrow(b) && resolveBindHost(a) === resolveBindHost(b);
 }
@@ -243,11 +279,18 @@ export const CONFIG_CROSS_INVARIANTS = [
     },
     {
         id: "operator-single-user",
-        keys: ["operatorSingleUser", "requirePrincipal", "operatorPrincipals"],
+        keys: ["operatorSingleUser", "requirePrincipal", "operatorPrincipals", "operatorDrainPrincipals"],
         restartReason: "operator-principals",
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:operator-single-user" },
         check: ({ next }) => operatorSingleUserRefusal(next),
     },
+    {
+        id: "operator-roster-well-formed",
+        keys: ["operatorPrincipals", "operatorDrainPrincipals"],
+        restartReason: "operator-principals",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:operator-roster-well-formed" },
+        check: ({ next }) => operatorRosterWellFormedRefusal(next),
+    },
     {
         id: "operator-declaration-required",
         keys: ["requirePrincipal", "operatorPrincipals", "operatorSingleUser"],
@@ -384,14 +427,14 @@ export const CONFIG_CROSS_INVARIANTS = [
         keys: ["gatewayBaseUrl", "gatewayFallbackUrls", "anthropic", "models"],
         restartReason: "model-route-endpoint",
         bootAnchor: { file: "src/boot/stage-02-web-admin-pull.ts", marker: "CROSS-INVARIANT:model-route-endpoint" },
-        check: ({ live, next }) => (next.models === live.models ? undefined : modelRouteEndpointRefusal(next, "catalog")),
+        check: ({ live, next }) => (next.models === live.models ? undefined : modelRouteEndpointRefusal(next, CATALOG_REFUSAL_LEG)),
     },
     {
         id: "default-model-resolvable",
         keys: ["models", "modelRefusals"],
         restartReason: "default-model",
         bootAnchor: { file: "src/boot/stage-02-web-admin-pull.ts", marker: "CROSS-INVARIANT:default-model-resolvable" },
-        check: ({ live, next }) => (next.models === live.models ? undefined : defaultModelRefusal(next, "catalog")),
+        check: ({ live, next }) => (next.models === live.models ? undefined : defaultModelRefusal(next, CATALOG_REFUSAL_LEG)),
     },
     {
         id: "refused-names-not-minted",

package/dist/config-lkg.d.ts

@@ -1,4 +1,3 @@
-import { type MigrationReceipt } from "@sema-agent/settings-schema/one-time-migrations";
 import { type PublishedPromptArtifact } from "@sema-agent/core";
 import { type ConfigDirTrustHost } from "./config-dir-trust.js";
 /** 落盘信封。`effective`/`etag` 逐字=当时的 fetchEffective 返回(JSON verbatim 面)。`formatVersion` 的语义见头注(5 = 载荷的 prompts 是中心层唯一的那种 wire 形)。 */
@@ -65,11 +64,10 @@ export declare function lkgReadDenyRows(configLkgPath: string | undefined): {
  *  影响在飞的应用链——LKG 缓存丢失的代价只是下次冷启动回到 env 兜底。 */
 export declare function saveLkg(path: string, worker: string | undefined, identity: string, effective: Record<string, unknown>, etag: string | undefined): Promise<void>;
 /** 一次读回做过的一次性迁移(调用方响亮打一行 `config_lkg_migrated`,并按 5 写回原位):`fromFormat` = 盘上的版本号;`note` = 信封层的说明
- *  (2 → 3 那一步 {@link migrateV2Lkg} / 4 → 5 那一步 {@link migrateV4Lkg});`receipts` = 载荷层 settings-schema 迁移的收据(只点名坐标与处置,不带值)。 */
+ *  (4 → 5 那一步 {@link migrateV4Lkg})。 */
 export interface LkgReadMigration {
-    readonly fromFormat: 2 | 3 | 4 | 5;
-    readonly note?: string;
-    readonly receipts: readonly MigrationReceipt[];
+    readonly fromFormat: 4;
+    readonly note: string;
 }
 /** {@link loadLkg} 读之前判官要的两件:声明的属主(`CONFIG_LOCAL_OWNER_UID`,配置席 `configLocalOwnerUid`;与本地配置根同一张可信集)+ 宿主事实(测试注入;缺席 = 本进程)。 */
 export interface LkgReadTrust {
@@ -80,8 +78,8 @@ export interface LkgReadTrust {
  * 读盘上 LKG。返回 undefined 的所有情形都「安静地回 env 兜底」(调用方 warn 点名 reason):
  * 别人改得动这份文件(目录信任判官的发现)/
  * 文件缺席/JSON 坏/信封形不对/worker 或凭证身份不匹配(防同名文件跨 worker / 跨账号串包;`CONFIG_LKG_PATH`
- * 单一路径时这是唯一的一道)/载荷有迁不动的旧形({@link migrateLkgPayload})/prompts 面复判失败。
- * `migrated`:读回时做过一次性迁移(信封 2 → 3 / 4 → 5 或载荷的 settings-schema 迁移)—— 调用方响亮打一行,并把交回的 5 写回原位。
+ * 单一路径时这是唯一的一道)/载荷带着 4 之前的旧形(3 及更早 ⇒ 版本拒)/prompts 面复判失败。
+ * `migrated`:读回时做过一次性迁移(信封 4 → 5)—— 调用方响亮打一行,并把交回的 5 写回原位。
  * `prompts`:候选判官对这份载荷 prompts 面交出的中心层(引擎 verify 过的发布形 artifact;`undefined` = 载荷不带 prompts 键)—— 调用方采纳直接用它。
  */
 export declare function loadLkg(path: string, worker: string | undefined, identity: string, trust: LkgReadTrust): Promise<{
@@ -92,16 +90,4 @@ export declare function loadLkg(path: string, worker: string | undefined, identi
     lkg?: undefined;
     reason: string;
 }>;
-/**
- * LKG 载荷(一份冻结的 effective)→ settings-schema 11 的形:调契约的 `migrateEffectiveSnapshot`(本仓不写任何一条改写规则;只认形、幂等,
- * `version` / `updatedAt` 与其余信封键原样)。有收据 `refused`(迁不动 —— 例:同一份文档里 `atModelAllowlist` 与 `atMention` 并存、
- * `runtime` 文档读不进)⇒ 交回拒因(**点名迁移 id 与契约的拒句**,不带值),调用方不读回这份 LKG:本仓应用 LKG 不经契约读腿,迁不动的旧形
- * 留在载荷里就会被下游当作缺席静默略过(例:`atModelAllowlist` 不再有读者 = 限制被静默放宽)。
- */
-export declare function migrateLkgPayload(effective: Record<string, unknown>): {
-    effective: Record<string, unknown>;
-    receipts: readonly MigrationReceipt[];
-} | {
-    refused: string;
-};
 //# sourceMappingURL=config-lkg.d.ts.map

package/dist/config-lkg.js

@@ -1,6 +1,4 @@
 import { existsSync, promises as fs } from "node:fs";
-import { migrateEffectiveSnapshot } from "@sema-agent/settings-schema/one-time-migrations";
-import { formatConfigPath } from "@sema-agent/settings-schema";
 import { join, dirname, resolve } from "node:path";
 import { ensureDir } from "@sema-agent/core";
 import { judgeConfigCandidate } from "./web-admin-client/candidate-gate.js";
@@ -67,7 +65,7 @@ export async function loadLkg(path, worker, identity, trust) {
     const formatVersion = p.formatVersion;
     if (formatVersion === 1)
         return { reason: PRE_IDENTITY_LKG_REASON };
-    if (formatVersion !== 2 && formatVersion !== 3 && formatVersion !== 4 && formatVersion !== 5)
+    if (formatVersion !== 4 && formatVersion !== 5)
         return { reason: `unknown formatVersion ${String(formatVersion)}` };
     if (typeof p.worker !== "string" || p.worker !== (worker ?? "global"))
         return { reason: `worker mismatch (file=${String(p.worker)})` };
@@ -75,42 +73,19 @@ export async function loadLkg(path, worker, identity, trust) {
         return { reason: "credential identity mismatch (the LKG was fetched under another credential identity — not read back)" };
     if (p.effective === null || typeof p.effective !== "object" || Array.isArray(p.effective))
         return { reason: "bad effective" };
-    let envelope = p;
-    let note;
-    if (formatVersion === 2) {
-        const v2 = migrateV2Lkg(envelope);
-        if (v2.lkg === undefined)
-            return v2;
-        envelope = v2.lkg;
-        note = v2.migrated;
-    }
-    if (formatVersion !== 5) {
+    const envelope = p;
+    let migrated;
+    if (formatVersion === 4) {
         const v4 = migrateV4Lkg(envelope, formatVersion);
         if (v4.lkg === undefined)
             return v4;
-        note = note === undefined ? v4.migrated : `${note}; ${v4.migrated}`;
+        migrated = { fromFormat: formatVersion, note: v4.migrated };
     }
-    const payload = migrateLkgPayload(envelope.effective);
-    if ("refused" in payload)
-        return { reason: payload.refused };
-    const judged = lkgPayloadJudged(payload.effective, envelope.etag);
+    const judged = lkgPayloadJudged(envelope.effective, envelope.etag);
     if ("problem" in judged)
         return { reason: judged.problem };
-    const lkg = { ...envelope, formatVersion: 5, effective: payload.effective };
-    const migrated = formatVersion !== 5 || payload.receipts.length > 0;
-    return migrated ? { lkg, prompts: judged.prompts, migrated: { fromFormat: formatVersion, ...(note !== undefined ? { note } : {}), receipts: payload.receipts } } : { lkg, prompts: judged.prompts };
-}
-export function migrateLkgPayload(effective) {
-    const m = migrateEffectiveSnapshot(effective);
-    const refused = m.receipts.filter((r) => r.appliedAs === "refused");
-    if (refused.length > 0) {
-        return {
-            refused: "settings-schema one-time migration refused part of this LKG's payload (" +
-                refused.map((r) => `${r.migration} ${r.document}:${formatConfigPath(r.path)} — ${r.reason}`).join("; ") +
-                ") — not read back: the engine applies an LKG without the contract's reader, so a form the migration cannot rewrite would be silently skipped; the next clean candidate rewrites it",
-        };
-    }
-    return { effective: m.effective, receipts: m.receipts };
+    const lkg = { ...envelope, formatVersion: 5 };
+    return migrated === undefined ? { lkg, prompts: judged.prompts } : { lkg, prompts: judged.prompts, migrated };
 }
 function migrateV4Lkg(lkg, fromFormat) {
     if (Object.hasOwn(lkg.effective, "prompts")) {
@@ -122,35 +97,6 @@ function migrateV4Lkg(lkg, fromFormat) {
     }
     return { lkg, migrated: `formatVersion ${fromFormat} → 5 (one-time): the payload carries no prompts face, read back unchanged` };
 }
-const RETIRED_CATALOG_COORDINATE = /^models\.(0|[1-9][0-9]*)$/;
-function migrateDroppedIdentityRow(row) {
-    if (row === null || typeof row !== "object")
-        return row;
-    const r = row;
-    const at = typeof r.entry === "string" ? RETIRED_CATALOG_COORDINATE.exec(r.entry) : null;
-    const fields = r.fields;
-    if (at === null || typeof r.name !== "string" || (r.id !== undefined && typeof r.id !== "string") || !Array.isArray(fields) || !fields.every((f) => typeof f === "string") || typeof r.issues !== "string")
-        return row;
-    return { index: Number(at[1]), reasonCode: "entry-schema-invalid", identity: { name: r.name, ...(typeof r.id === "string" ? { id: r.id } : {}) }, fields: [...fields], issues: r.issues };
-}
-function migrateV2Lkg(lkg) {
-    const { etag: _incompleteCarrierValidator, ...envelope } = lkg;
-    const models = lkg.effective.models;
-    const hasRetired = models !== undefined && models !== null && typeof models === "object" && Object.hasOwn(models, "droppedIdentities");
-    let effective = lkg.effective;
-    if (hasRetired) {
-        const { droppedIdentities: retired, ...rest } = models;
-        if (Object.hasOwn(rest, "droppedCatalogEntries")) {
-            return { reason: "both the retired dropped-entry carrier (models.droppedIdentities) and its successor (models.droppedCatalogEntries) are present — no writer produces that shape; not read back" };
-        }
-        effective = { ...lkg.effective, models: { ...rest, droppedCatalogEntries: Array.isArray(retired) ? retired.map(migrateDroppedIdentityRow) : retired } };
-    }
-    return {
-        lkg: { ...envelope, effective },
-        migrated: "formatVersion 2 → 3 (one-time): this LKG was written before every dropped catalog entry was recorded, so its etag is not reused — the next pull re-reads the whole candidate and re-mints the full record" +
-            (hasRetired ? "; the retired carrier models.droppedIdentities was moved to models.droppedCatalogEntries" : ""),
-    };
-}
 function lkgPayloadJudged(effective, etag) {
     const problem = lkgPayloadShapeProblem(effective, etag);
     if (problem !== undefined)

package/dist/config-provider.d.ts

@@ -25,7 +25,7 @@ import type { ConfigProviderWord } from "./config-types.js";
  *  `effective.models.droppedCatalogEntries`(`GET /v1/models.droppedEntries` 的源,与 `models` 同世代)。 */
 /** `unreadFiles`:`config.d` 里读腿根本不读的文件(不是域 / 不是便携域)—— **不**进候选门(不是读的域判形失败),调用方一份一行
  *  `config_unread_file` 点名、其余照用;缺席 = 没有(本地读腿才会有)。 */
-/** `refusedDocuments`:被拒文档 —— 契约的类型 `ConfigDocumentRefusal`(`{ document, reason, error }`,墓碑另带 `migration`;`reason` 是契约闭集
+/** `refusedDocuments`:被拒文档 —— 契约的类型 `ConfigDocumentRefusal`(`{ document, reason, error }`,墓碑与文件层两臂同形;`reason` 是契约闭集
  *  `CONFIG_DOCUMENT_REFUSAL_REASONS`:`empty` / `invalid_json` / `not_object` / `io` / `too_deep` 文件层,`retired_domain` 墓碑)。读腿不抛,交成发现,候选判官以发现自带的词整拒这份候选
  *  (与域判形失败同一条回落链、同一行拒判);缺席 = 没有。远端腿:wire 上只有墓碑一种,那一键不进 effective、其余域照读、版本照读;本地腿:契约的单读口
  *  `FileConfigStore.read()` 交 `refused` ⇒ 被拒文档 = 那一读的拒单原样,什么域内容都没装配 —— 候选是空的 effective(被整拒,不会被应用),版本 = 那一读的契约版本(按文档内容寻址)。 */

package/dist/config-root-migration.d.ts

@@ -1,5 +1,5 @@
 import { type EnvModelsMigration } from "@sema-agent/settings-schema/node";
-import type { ConfigDirMigrationLog } from "./config-d-migration.js";
+import type { Logger } from "./observability/logger.js";
 /** 一次起服的输入:配置根、目标引擎的 env(契约只读两槽、只用来点名被顶替的 env 模型)、env 表是不是占位(严格名册布防 —— 与模型面闸同一只谓词)。 */
 export interface EnvModelsMigrationInput {
     readonly root: string;
@@ -9,5 +9,5 @@ export interface EnvModelsMigrationInput {
 /** 契约的迁移体调一次(本仓不改写它的判序,只调度)。 */
 export declare function runEnvModelsMigration(input: EnvModelsMigrationInput): Promise<EnvModelsMigration>;
 /** 结局的**唯一**说法(两个入口同调)。 */
-export declare function logEnvModelsMigration(log: ConfigDirMigrationLog, input: EnvModelsMigrationInput, m: EnvModelsMigration): void;
+export declare function logEnvModelsMigration(log: Pick<Logger, "info" | "warn">, input: EnvModelsMigrationInput, m: EnvModelsMigration): void;
 //# sourceMappingURL=config-root-migration.d.ts.map