@sema-agent/server 7.43.0 → 7.44.0

package/dist/boot/config-center.js

@@ -1,34 +1,3 @@
-/**
- * design/158 A10 尾刀:composition root 分段 —— **config-center 运行时**(boot 半场 + 60s refresh 循环 +
- * 两者之间的 center 能力消费点)。
- *
- * 上一刀把 12 个 boot 段搬进 `src/boot/*.ts`(纯搬运),独独留下这两段并写明理由:它们共享一组
- * **跨段可变状态**(`ccEtag / effective / latestEffective / lastRejectedCandidate / appliedPlaneEff /
- * planeDeferredNoHandoff / bootSkillStale / pendingRestart / bootLkgCandidate / lastPrewarmBodiesVerified /
- * lkgBooted / bootConfigPending / centerPrompts / pendingCatalogFaces / keyResolver / modelReadyState`),
- * 而 codex R10–R38 的重启风暴判据密集地建立在这些状态的**读写次序**上(哪一行先落盘、哪一行先发信号、
- * 哪个分支 splice 掉整组 reasons)。
- *
- * 本刀的做法:把这些 `let` 从 `main()` 的函数作用域搬进 **本工厂的闭包**——它们仍然是 `let`,**每一处
- * 读写的字面文本、次序、分支结构一行未改**(把 `x` 改写成 `state.x` 会把 800 行里的每一处读写都变成一次
- * 手工重写,那正是上一刀判定「不是搬运」的原因)。闭包 = 那个「持有状态的对象」;`main()` 只通过下面这
- * 组窄口读它们,与本目录既有的晚绑 getter 惯例(`getRunStore()` / `getKeyResolver()` / `getRunDenySweep()`)
- * 同款。
- *
- * ⚠️ **位置即契约**(调用点在 `main()` 里的相对次序不可动):
- *  1. `createConfigCenterRuntime()` 必须在 logger/metrics 之后、`openStores()` 之前 —— boot 拉取要在
- *     Runner/持久层建起来之前把 models/roles/teams 应用进 `config`(env 是兜底,center 覆盖其上)。
- *  2. `applyLocalRemoteExec()` 紧随其后、在 `createExecutionEnv()` 之前 —— 它就地改写 `config.remoteExec`,
- *     消费点(执行环境工厂)在下游。
- *  3. `applyCenterCapabilities()` 必须在 `loadSkills()` 之后、`buildScenarios()` 之前,且 **boot LKG 落盘点
- *     就在它里面**(F7/codex R26:先装载 skill 正文再落盘,否则「manifest 可见、正文没进缓存」的窗口会被
- *     发布成 boot 可见 LKG);plugins 让位判据要求 plugins 消费在 center 直发 skills **之后**。
- *  4. `applyCenterScenarios()` 必须在 `builtinScenarioDetails()` 捕获六内建名之后(探针要打纯内建工厂)。
- *  5. `initKeyResolver()` 留在原位(Runner 构造之后、ServiceDeps 装配之前)—— 首建要读的是 boot apply
- *     **之后**的 `config.modelApiKeyEnv/modelApiKeys`。
- *  6. `startRefreshLoop()` 必须在 `new Runner()` 之后 —— 它要 `runnerTierFrozen`(与构造函数读的是同一
- *     config 代际),且 boot-deferred 到货的续接就挂在这里。
- */
 import { createHash } from "node:crypto";
 import { readFile as fsReadFile } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -49,34 +18,14 @@ import { ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js
 import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, planeHasActiveTiers, fetchPromptArtifact } from "../config-center/facade.js";
 import { createMcpRevocationLedger, enabledMcpEntries } from "../config-center/mcp-revocation.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
-import { createConfigApplyLedger } from "../config-center/apply-ledger.js"; // #322 世代账
+import { createConfigApplyLedger } from "../config-center/apply-ledger.js";
 export async function createConfigCenterRuntime(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
-    // Config-center: pull the effective config on boot and apply it OVER the env
-    // defaults — env is the fallback. Unset or unreachable → keep the env-derived config. Applied BEFORE
-    // the Runner is built so models/roles/teams take effect. (Logical config only; secrets stay in env.)
     let ccEtag;
-    // Kept past the fetch so the deferred skills/mcp apply (which needs the live `skills` array + async
-    // content lazy-pull) can run right before buildScenarios, after applyEffective handled models/roles/teams.
-    // `effective` is the BOOT snapshot — the refresh loop never reassigns it, so restartReasons() compares each
-    // pull against what THIS process baked in (change-detection, not presence → no auto-restart loop).
     let effective;
-    // 提示词装配协议 §9.5-2 three-store split: `effective` above = the boot snapshot (diff baseline);
-    // `latestEffective` = the last candidate that passed validation AND was applied — the explicit
-    // last-known-good (LKG). A refresh candidate failing validation is REJECTED whole (§9.5-5): never
-    // applied, so the live config keeps serving this LKG instead of a domain falling to schema-default/
-    // empty. The third store (promptCandidate — a staged prompts-domain artifact awaiting activation)
-    // lands with the prompts domain itself; `lastRejectedCandidate` is its observability forerunner and
-    // the prompts-domain validation (core S1 schema) hooks into the same gate.
     let latestEffective;
     let lastRejectedCandidate;
-    // #322 世代账(§2):主键=上游 version(不造本地 epoch)。boot/refresh/迟到 boot 三条腿共用这一本;
-    // 候选被整拒的拍只推进 target ⇒ /health 的 stale 面从结构上可见。
     const applyLedger = createConfigApplyLedger();
-    // #325(test [4809],[4810] 阻断裁定):**收货序数**——CAS 与世代账的序轴。source version 在
-    // local 腿是内容哈希(registry-core file-store getVersion(),无序承诺),不能当序数比;这里按
-    // 收货顺序铸进程内单调 ordinal:version 变即 ++,等版本重放(etag 未推进的下一拍)沿用同
-    // ordinal=幂等语义保留。version 仍是跨副本对账的身份标(账里两者双报)。
     let generationOrdinal = 0;
     let lastGenerationVersion;
     const generationOf = (version) => {
@@ -86,47 +35,18 @@ export async function createConfigCenterRuntime(ctx) {
         }
         return generationOrdinal;
     };
-    // #322 追加件:手动触发口的实现指针 —— `startRefreshLoop` 起环时装上(cadence 与手动口共用的那只
-    // join 形拍)。未起环(纯 env 部署 / 还没到装配那一步)⇒ 恒 undefined ⇒ 端点诚实 4xx。
     let manualRefresh;
-    // codex R10 (models-tiers 窗收口): the last EffectiveConfig whose MODEL PLANE (models/roles/tiers/default) was
-    // actually applied to the live config — undefined = env plane (no center plane applied yet). When the Runner is
-    // tier-frozen, a refresh whose plane differs from THIS is deferred to restart (applyEffective deferModelPlane),
-    // keeping admission and the Runner on one catalog generation through the restart window.
     let appliedPlaneEff;
-    // codex R18: the persistent "deferred WITHOUT next-boot handoff" state — the one-shot warn is not enough
-    // (the etag advances → later ticks 304 and never re-enter the defer branch). Set when a plane defers with no
-    // restart-surviving LKG; cleared when a plane finally applies or a forced restart reason ships. Surfaced on
-    // /health (modelPlaneDeferred) + re-warned every refresh tick (incl. 304s).
     let planeDeferredNoHandoff;
-    // codex R35: STICKY live-skill application debt — the boot-baked skill table never rebuilds inside this
-    // process, so once the live application is known incomplete the debt survives every refresh (a
-    // same-generation 200 recomputes reasons vs boot as [] and would otherwise silently clear the signal).
-    // Set at the boot writer (R34 arms); folded into every tick's reasons; only a restart resolves it.
     let bootSkillStale = false;
-    // Config-center restart signal: set by the refresh loop when a pull's restart-to-apply slices
-    // (skills/mcp/scenarios/runtime-gates) differ from boot; read by GET /health for orchestrator auto-restart.
     let pendingRestart;
-    // DUAL-MODE-DESIGN §4: the config SOURCE is a backend-selectable seam — remote (config-center HTTP, the fleet
-    // default) | local (.env + config.d via @sema-agent/registry-core FileConfigStore, the single-machine/TOC source).
-    // The provider exists when SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL now boot-rejects, no dual-read) is set OR CONFIG_PROVIDER=local is explicit; neither = pure-env
-    // (byte-identical to before). The remote provider DELEGATES verbatim to fetchEffective, so the fleet path is
-    // unchanged; applyEffective consumes either source's EffectiveConfig identically (one resolver → no drift).
     const cc = config.configCenter;
-    // Sealed-box key custody: ensure this host's X25519 keypair(s) under
-    // <localDataRoot>/sealed-key/ (dir 0700, files 0600; SEVERAL may coexist — rotation keeps old private
-    // keys decrypting old ciphertexts) BEFORE the first effective pull, so a roster carrying
-    // `sealedApiKey` unseals on the boot apply. The public-key report is best-effort fire-and-forget:
-    // the center's execution-keys face is admin-gated and a worker only holds the pull token, so without
-    // an operator-provided SEMA_REGISTRY_ADMIN_TOKEN it prints the full public key for manual
-    // registration instead (honest posture — see reportExecutionPublicKey). Store failure is non-fatal:
-    // sealed models then warn per-model in applyEffective (fail-loud, never a silent apiKeyEnv fallback).
     let sealedKeys;
     try {
         sealedKeys = await ensureSealedKeyStore(join(config.localDataRoot ?? localRoot, "sealed-key"), logger);
         void reportExecutionPublicKey({
             baseUrl: cc?.baseUrl,
-            adminToken: process.env.SEMA_REGISTRY_ADMIN_TOKEN, // [2373]B-1:REGISTRY_ADMIN_TOKEN 双读已墓碑(在场即拒启)
+            adminToken: process.env.SEMA_REGISTRY_ADMIN_TOKEN,
             key: sealedKeys.latest,
             ...(cc?.worker ? { notes: `worker ${cc.worker}` } : {}),
             logger,
@@ -142,22 +62,6 @@ export async function createConfigCenterRuntime(ctx) {
             ...(config.configProvider === "local" ? { localDir: localRoot } : {}),
         })
         : undefined;
-    // boot ready 门 latch:布防时等中心 roster 落地——首次 effective 落 ≥1 enabled 模型即翻 true(one-way);
-    // 未布防则恒 ready。守的危险=**registry 部署的 fleet worker 在 roster 落地前拿占位模型跑计费任务**
-    // (E3 废除 workers.model 之后,占位模型正是 fleet worker 的常态起服姿势)。
-    //
-    // 🔧 复审 2026-07-29 P1-6 —— 布防判据从**推断**改成**运营者声明**。原式是
-    // `!(cc && !cc.dryRun) || Boolean(process.env.MODEL_ID)`,其中 `Boolean(process.env.MODEL_ID)` 是
-    // 3.0.0 前「运营者手上除了中心 roster 什么都没有」的代理判据。**server 3.0.0 起 `MODEL_ID` 必填**
-    // (未设 = loadConfig throw,见 config.ts parseModelDomain)⇒ 走到这一行时它必非空 ⇒ 初值恒 true ⇒
-    // 「等 roster」那条臂不可达、markRosterLanded 的门体是死码、/health 的 ready:false 与计费提交的 503
-    // 全不可能发生。注意这不是「危险消失了」:必填 MODEL_ID 恰恰让**每个** fleet worker 都带着占位模型
-    // 起服,危险比以前更常见——只是那个代理判据从此写不出来了。
-    //
-    // 于是改成显式声明:`CONFIG_REQUIRE_ROSTER=true`(与 CONFIG_LKG_* / CONFIG_BOOT_FETCH_BUDGET_MS 同族,
-    // 直读 env,不进 ServiceConfig——纯 boot 期姿势旋钮)。**缺省关 = 现有部署逐字节零变化**;开了才真的
-    // fail-closed 等 roster。仅远程 registry 且非 dryRun 车道可布防:dryRun 是 compare-only(中心 roster
-    // 从不被应用,拿它当就绪判据无意义),local provider / 纯 env 部署则没有「中心」可等。
     const rosterGateArmed = cc !== undefined && !cc.dryRun && process.env.CONFIG_REQUIRE_ROSTER === "true";
     const modelReadyState = { ready: !rosterGateArmed };
     const markRosterLanded = (eff) => {
@@ -166,14 +70,7 @@ export async function createConfigCenterRuntime(ctx) {
             logger.info("model_roster_landed", { note: "ready gate open — billable submissions accepted" });
         }
     };
-    // center prompts ref([1057]/[1062] 投影腿):**热采用,新任务边界生效**——core 1.316([1068] 裁 a/
-    // [1070]d)把 provider 声明纳入 epoch artifactDigest:声明变=digest 变=下任务边界自动重 pin,进行中
-    // 会话由 session epoch pin 保稳,resume 记账诚实(1.222 的 restart-to-apply 是 core 件落地前的正确
-    // 过渡姿势,[1068]① 官方确认后随 1.316 采用降级为热生效——与 center「发布=新任务生效」产品语义对齐)。
-    // 判形通过才采用(形校验=防 core-assemble-THROW 底线,非语义复检 [1057]①f);坏形=warn+沿用旧包。
     let centerPrompts;
-    /** codex-3 F1:一次失败的 catalog 过渡的目标面(undefined 目标=欠 disable)。etag 已推进时 provider
-     *  304 短路 adopt——本 marker 让每个 refresh 拍(含 304 拍)独立重试,直到过渡落地。 */
     let pendingCatalogFaces;
     const retryPendingCatalog = async (phase) => {
         if (!pendingCatalogFaces)
@@ -184,25 +81,8 @@ export async function createConfigCenterRuntime(ctx) {
             pendingCatalogFaces = undefined;
         }
     };
-    // e/b(catalog 轴消费面,[1236]① seam):core 的 CenterPromptSource——server 只给根路径,core 文件形
-    // 自管 `<root>/prompt-epoch/{artifacts,source-state.json}`;boot restore=磁盘 LKG(离线重启 candidate
-    // 存续/disabled 不复活,状态机全在 core)。RunnerDeps.promptSource 挂它;adopt 时经 applyCatalogToSource
-    // 推进两态过渡。restore 失败=warn(candidate 缺席,catalog 轴等下一次 adopt;declaration 轴/内置照跑)。
     const promptEpochDir = join(config.localDataRoot ?? localRoot, "prompt-epoch");
-    // codex-3 F2:effective 拉取是 worker 轴的(config LKG 同理 worker-keyed)——同根多 worker 进程共享
-    // content-addressed artifacts/(by-digest,天然安全),但 **candidate 状态必须按 worker 分箱**:共写一份
-    // source-state.json 会让 A 的撤下压掉 B 的 candidate、restart 恢复到别人 worker 的 catalog(错 worker
-    // 的系统提示词跑任务)。encodeURIComponent 消毒(worker 名进路径)。
-    // codex-5:无撞形分箱——缺席=字面 "global",配置了 worker= "worker-<sha256 前 16>"(哈希后天然单
-    // 段/无 dot-segment/与 "global" 不可能同名;worker 名任意字节也安全)。
     const promptStateDir = join(promptEpochDir, "state", cc?.worker === undefined ? "global" : `worker-${createHash("sha256").update(cc.worker).digest("hex").slice(0, 16)}`);
-    // codex-6 F1:File 店构造同步 mkdir——只读/不可写数据根会把「可选的 catalog 特性」变成整服务 boot
-    // 失败。守护工厂:文件形失败 ⇒ warn + Memory 店兜底(candidate 不跨重启持久,catalog 采用仍工作;
-    // 内置/declaration 轴完全不受影响)。
-    // [985]b / [1285] — §9.4 by-digest 补拉组合店:local miss(本副本从未采用过该 candidate / 盘失)⇒
-    // 从 center 按 digest 补拉 envelope ⇒ core verifyPromptArtifact 全管线(canonical 复算;**且回验
-    // 「拿到的=要的」digest 逐位**,center 答非所问=丢弃)⇒ best-effort 回写盘(下次直命中)。pinned
-    // resume 的 fail-loud miss 自此只剩「center 也没有」的真缺席。仅 remote 治理形(cc.baseUrl)挂补拉。
     const withByDigestBackfill = (inner) => cc?.baseUrl ? withPromptArtifactBackfill(inner, (d) => fetchPromptArtifact(cc.baseUrl, cc.token, d), logger) : inner;
     const promptSource = (() => {
         try {
@@ -217,10 +97,6 @@ export async function createConfigCenterRuntime(ctx) {
             return new CenterPromptSource({ store: withByDigestBackfill(new MemoryPromptArtifactStore()), stateStore: new MemoryPromptSourceStateStore(), engineVersion: CORE_ENGINE_VERSION });
         }
     })();
-    // codex-2 F4:只有「有配置源在治理且非 dry-run」才 restore 磁盘 candidate——provider-off/dry-run 姿势下
-    // 旧部署遗留的 active candidate 不得继续影响新任务(publish-gate-off/compare-only 语义)。不 restore 只
-    // 影响 candidate 面;pinned resume 的 by-digest 解析走 FilePromptArtifactStore.get(不依赖 restore),
-    // 旧会话恢复不受损。
     if (configProvider && !cc?.dryRun) {
         try {
             await promptSource.restore();
@@ -232,8 +108,6 @@ export async function createConfigCenterRuntime(ctx) {
     const adoptCenterPrompts = async (eff, phase) => {
         const raw = eff?.prompts;
         if (raw === undefined) {
-            // fail-closed 语义([1057]①d):publish 闸关=key 整体不出现 ⇒ 收敛回内置提示词(不是「保持旧包」——
-            // 闸关是显式撤下,沿用旧包会让「关闸」失效)。
             if (centerPrompts)
                 logger.info("center_prompts_cleared", { phase, note: "effective carries no prompts key (publish gate off) — built-in providers resume" });
             const cleared = await applyCatalogToSource(promptSource, undefined, centerPrompts, logger, phase);
@@ -242,7 +116,7 @@ export async function createConfigCenterRuntime(ctx) {
                 pendingCatalogFaces = undefined;
             }
             else {
-                pendingCatalogFaces = { target: undefined }; // failed disable — retried by the refresh hook (codex-3 F1)
+                pendingCatalogFaces = { target: undefined };
             }
             return;
         }
@@ -252,7 +126,6 @@ export async function createConfigCenterRuntime(ctx) {
             return;
         }
         if (centerPrompts?.identity !== v.value.identity) {
-            // [985]a §3:axes 观测两轴共存窗;declaration 轴字段照旧,catalog 轴报 artifactDigest(内容身份)。
             logger.info("center_prompts_adopted", {
                 phase,
                 axes: v.value.axes,
@@ -264,9 +137,6 @@ export async function createConfigCenterRuntime(ctx) {
             });
         }
         const transitioned = await applyCatalogToSource(promptSource, v.value, centerPrompts, logger, phase);
-        // codex-2 F2 + codex-3 F1:catalog 过渡失败 ⇒ 身份不推进(centerPrompts 保持 prev),且目标面记入
-        // pendingCatalogFaces——etag 会照常推进(其他域的采用不为 prompts 的盘错扣住),此后 provider 304
-        // 不再进本函数,重试由 refresh 拍上的 retryPendingCatalog 钩独立驱动(见 refresh 循环)。
         if (transitioned) {
             centerPrompts = v.value;
             pendingCatalogFaces = undefined;
@@ -275,57 +145,15 @@ export async function createConfigCenterRuntime(ctx) {
             pendingCatalogFaces = { target: v.value };
         }
     };
-    // Boot-deferred pull (clay 2026-07-17): when the boot fetch outlives its budget, the SAME promise is
-    // stashed here and, once the refresh tick exists (defined further down), chained to trigger an immediate
-    // hot-apply on arrival — the server meanwhile starts on the env fallback in <1s instead of hanging up to
-    // ~8s on a black-holed center (真机实测 5.7s = the "local server takes 5s" report).
     let bootConfigPending;
-    // LKG 落盘(clay 拍 2026-07-18;config-lkg.ts 顶注=全案由):remote lane 的干净候选持久化——boot 的
-    // 第三级来源(中心 > 盘上 LKG > env)。`lkgBooted` 标志决定 deferred continuation 的形:LKG 起服=有
-    // 完整 boot 基线 → 到货走普通 refreshTick(候选门+hot+restartReasons 对 LKG 比较,通常零差异=无环);
-    // 无 LKG=env 起服 → 到货走「迟到 boot」路径(deferredBootApply)。
     const lkgEnabled = configProvider?.kind === "remote" && configLkgEnabled();
     const lkgPath = process.env.CONFIG_LKG_PATH ?? defaultLkgPath(cc?.worker);
-    // codex R17/R20: a successful LOCAL write proves nothing about the NEXT instance seeing it — a stateless pod
-    // replaces its filesystem on restart, so treating a pod-local rename as "handoff confirmed" re-opens the R16
-    // rolling-restart storm. Next-instance visibility is a DEPLOYMENT contract only the operator can assert, and
-    // ONLY via the explicit knob: CONFIG_LKG_DURABLE=true declares the LKG path rides restart-surviving storage
-    // (host disk / PVC / shared volume). CONFIG_LKG_PATH is strictly a LOCATION override (R20: it can point at an
-    // ephemeral container path — a location says nothing about durability). Unset ⇒ the models-tiers restart
-    // reason stays suppressed on a deferred plane (old generation keeps serving; /health modelPlaneDeferred +
-    // per-tick warn carry the state) while normal LKG writes continue (they still help same-instance restarts).
     const lkgSurvivesRestart = lkgEnabled && process.env.CONFIG_LKG_DURABLE === "true";
     let lkgBooted = false;
-    let bootLkgCandidate; // F7:skills 装载后才落盘
-    // F1+F2(LKG 复审):awaited 落盘 + skill 正文预热——refresh 只落 manifest 的话,重启后 LKG-boot 在
-    // 中心不可达时新 skill 正文缓存缺失=软跳过(静默缺 skill)。预热=枚举 enabled manifest,把缺盘的正文
-    // 拉齐进 content-addressed 缓存(失败=warn 软降级,与 boot 的 skill_failed 同语义等级——skill 拉取
-    // 失败从不升级为配置拒绝);await 保证 restart 信号可见前 LKG+正文已落盘。
-    /** Returns TRUE iff the candidate is durably persisted for the NEXT boot (codex R16: the FORCED models-tiers
-     *  restart reason must never fire without a confirmed handoff — LKG disabled/unwritable + over-budget boot
-     *  pulls would otherwise turn the deferral into a rolling-restart storm: every restarted process boots the env
-     *  plane again, defers again, re-signals). Change-DETECTED reasons still ride regardless (their loop is the
-     *  pre-existing, documented no-LKG residual). */
-    // codex R37 loop-breaker proof: TRUE iff the LAST persistLkgDurable call hash-verified EVERY enabled skill
-    // body on disk. This is the "a restart can actually repair the live skill table" proof the NON-durable lane
-    // requires before publishing a skills restart — a successful manifest pull only proves the CONFIG endpoint
-    // works, not the SEPARATE body fetches; signaling on manifest-success alone lets a persistent body failure
-    // (404 / hash mismatch / timeout) restart-storm a stateless deployment (every replacement process fails the
-    // same body, signals again, is restarted again). With the proof, a storm cannot form: a boot that fails the
-    // body lacks the proof and only retains visible debt (no signal) until a later verify succeeds.
+    let bootLkgCandidate;
     let lastPrewarmBodiesVerified = false;
     const persistLkgDurable = async (effectiveObj, etag) => {
         lastPrewarmBodiesVerified = false;
-        // codex R21: the LOCAL provider's candidate IS the next-boot source (config.d on the same disk boot reads
-        // BEFORE Runner construction) — the handoff is inherent, no LKG needed. Without this arm a polled config.d
-        // edit that defers the plane (tier activation / tier-frozen change) could never authorize its own restart
-        // (lkgEnabled is remote-only, so even CONFIG_LKG_DURABLE couldn't help) — stuck in modelPlaneDeferred forever.
-        // codex R28 requalified: this TRUE covers the MODEL PLANE (what the deferral gate adjudicates). Skills are
-        // NOT part of the local handoff because the local lane does not consume a center-style skills domain AT ALL
-        // yet — the only boot consumer (applyCenterSkills) requires config.configCenter (remote HTTP), absent on
-        // CONFIG_PROVIDER=local; bodies live inline in config.d (LocalConfigProvider.fetchSkillContent) but no boot
-        // path reads them. Pre-existing local-lane gap (predates this train, nothing lost across restart that was
-        // ever applied); wiring boot skills through the ConfigProvider seam is the tracked follow-up (board).
         if (configProvider?.kind === "local")
             return true;
         if (!lkgEnabled)
@@ -334,15 +162,6 @@ export async function createConfigCenterRuntime(ctx) {
             if (effectiveObj.skills && config.configCenter) {
                 await applyCenterSkills([], effectiveObj.skills, config.configCenter.baseUrl, config.configCenter.token, logger, undefined, defaultSkillCacheDir());
             }
-            // codex R25/R26: skill BODIES are part of the handoff contract, and completeness gates PUBLICATION —
-            // applyCenterSkills swallows fetch/cache-write failures, so awaiting it proves nothing; verify every
-            // ENABLED manifest hash on disk (content-true) BEFORE the atomic LKG replace (R26: verifying after left
-            // an incomplete candidate as the boot-visible LKG — any crash/manual restart with the center down then
-            // boots that manifest, silently skips the uncached skills, and never re-signals because the manifest is
-            // the new boot baseline). On any miss/corruption the PREVIOUS good LKG stays in place; the per-tick
-            // retained-candidate retry re-attempts prewarm + verify + publish.
-            // Residual seam (honest, partial): the skill cache roots at SEMA_CONFIG_DIR while lkgPath can point
-            // elsewhere — CONFIG_LKG_DURABLE's contract requires BOTH on restart-surviving storage.
             const enabledSkills = (effectiveObj.skills?.skills ?? []).filter((m) => m.enabled !== false);
             const cacheDir = defaultSkillCacheDir();
             for (const m of enabledSkills) {
@@ -361,11 +180,8 @@ export async function createConfigCenterRuntime(ctx) {
                     return false;
                 }
             }
-            lastPrewarmBodiesVerified = true; // every enabled body verified on disk — the repair proof stands even if the LKG write below fails
+            lastPrewarmBodiesVerified = true;
             await saveLkg(lkgPath, cc?.worker, effectiveObj, etag);
-            // codex R17: TRUE = next-BOOT visibility, not merely a successful local rename — gated on the operator's
-            // restart-surviving-storage declaration (lkgSurvivesRestart above). A stateless pod's local write still
-            // helps same-instance restarts but must not authorize a forced restart.
             return lkgSurvivesRestart;
         }
         catch (err) {
@@ -374,9 +190,7 @@ export async function createConfigCenterRuntime(ctx) {
         }
     };
     if (configProvider) {
-        const dryRun = cc?.dryRun ?? false; // dry-run posture is remote-only (a local source has nothing to compare against)
-        // LKG 读腿(boot 超窗与硬失败两个入口共用):盘上有验证过的干净候选 → 当 boot 配置整套应用
-        // (skills/mcp 进 buildScenarios——这正是 env 兜底给不了的),etag 落位 → refresh 首拍 304 或正常增量。
+        const dryRun = cc?.dryRun ?? false;
         const bootFromLkg = async (why) => {
             if (!lkgEnabled || dryRun)
                 return null;
@@ -397,7 +211,7 @@ export async function createConfigCenterRuntime(ctx) {
             await adoptCenterPrompts(lkgR.effective, "boot-lkg");
             markRosterLanded(lkgR.effective);
             effective = lkgR.effective;
-            appliedPlaneEff = lkgR.effective; // model plane applied pre-Runner — this IS the Runner's generation
+            appliedPlaneEff = lkgR.effective;
             latestEffective = lkgR.effective;
             if (lkgR.etag !== undefined)
                 ccEtag = lkgR.etag;
@@ -410,7 +224,7 @@ export async function createConfigCenterRuntime(ctx) {
             let lkgFallback = null;
             if (raced === BOOT_FETCH_DEFERRED) {
                 bootConfigPending = bootFetch;
-                bootFetch.catch(() => { }); // settled in the background — failure handling lives on the refresh cadence
+                bootFetch.catch(() => { });
                 lkgFallback = await bootFromLkg("boot fetch deferred (budget exceeded)");
                 lkgBooted = lkgFallback !== null;
                 logger.warn("config_boot_fetch_deferred", {
@@ -422,9 +236,6 @@ export async function createConfigCenterRuntime(ctx) {
                         : "center slow/unreachable and no usable LKG — serving on the env fallback; the pull continues in the background (late-boot adoption on arrival). Raise CONFIG_BOOT_FETCH_BUDGET_MS to block boot instead.",
                 });
             }
-            // F4(LKG 复审):LKG 载荷的 apply 用专属 catch——走主分支会让 applyEffective 半程炸落到外层
-            // catch 的「config_source_unreachable_using_env」误导日志(中心明明只是慢)。坏 LKG=点名+env 兜底
-            // (in-place mutate 的混态风险与 live 坏载荷同级,浅域判形在 loadLkg 已挡结构性坏形)。
             if (raced === BOOT_FETCH_DEFERRED && lkgFallback) {
                 try {
                     await bootApplyLkgInline(lkgFallback);
@@ -436,23 +247,13 @@ export async function createConfigCenterRuntime(ctx) {
             }
             const r = raced === BOOT_FETCH_DEFERRED ? null : raced;
             if (r) {
-                // [898] tolerant read(registry-core 0.10.12,local lane):catalog 域坏文件不再连坐整包回落 env——
-                // 坏域按 default 落+per-domain warn 点名(文件路径在 error 文案里),好域照常生效。gate 域坏文件
-                // tolerant 仍 throw(READ 容错不放宽 gate fail-loud)⇒ 走下面既有整包 catch。
-                // §9.5-5 boot 与 refresh 的分工(codex F1:重启不得洗白坏候选):boot 照旧 tolerant APPLY(无 LKG
-                // 可保,带着好域起服务),但一个带错误的候选 ①不推进 ccEtag——refresh 首 poll 拿到同一棵树,候选门
-                // 当场整拒并持续 warn 到修复;②不写入 latestEffective——LKG 永远只指向完全干净的候选,拒绝日志的
-                // lkgVersion 也诚实(boot 带错=「(env)」)。markRosterLanded 保留:models 域自身干净才可能开门
-                // (坏 models 域 tolerant 落空=enabled 0=门不动),其他域的错误不构成扣住就绪门的理由。
                 const bootPromptsRaw = r.effective.prompts;
                 const bootPromptsOk = bootPromptsRaw === undefined || validatePromptsDomain(bootPromptsRaw).ok;
-                // 坏 prompts 面同 domainErrors 计入 not-clean(F6 boot 半场):etag 不进 → refresh 首拍同树整拒持续
-                // warn;LKG 不指向带坏 prompts 的候选。adoptCenterPrompts 自身会拒采用+点名。
                 let bootClean = (r.domainErrors ?? []).length === 0 && bootPromptsOk;
                 for (const de of r.domainErrors ?? [])
                     logger.warn("config_domain_invalid", { domain: de.domain, error: de.error, note: "tolerated at BOOT (corrupt file → schema defaults; dangling ref → reported as-is); the refresh path rejects such a candidate whole and keeps the LKG (§9.5-5)" });
                 if (dryRun) {
-                    logEffectiveDiff(config, r.effective, logger); // compare-only: log the would-be changes, keep env
+                    logEffectiveDiff(config, r.effective, logger);
                     if (bootClean)
                         ccEtag = r.etag;
                 }
@@ -467,33 +268,24 @@ export async function createConfigCenterRuntime(ctx) {
                             bootReport = rep;
                             applyLedger.recordApply(rep);
                         },
-                    }); // sealedKeys: unseal sealedApiKey → in-memory key pipeline
+                    });
                     applyLedger.applied(bootGen, r.effective.version);
-                    // codex R2-F1(boot 半场):某组被拒 ⇒ 这棵树**不干净** —— 与 domainErrors/坏 prompts 同处置
-                    // (etag 不进、不进 LKG 候选),否则一次带坏 limits 的 boot 会把它写成盘上的 LKG。
                     if (bootReport?.fullyApplied === false)
                         bootClean = false;
                     if (bootClean)
-                        ccEtag = r.etag; // 干净才推进 etag(判定要在 apply 之后——某组被拒也算不干净)
-                    await adoptCenterPrompts(r.effective, "boot"); // [1057] additive prompts key(判形采用;缺席=内置)
-                    markRosterLanded(r.effective); // boot pull 即落 roster 的常态:门在启动窗内就打开
-                    effective = r.effective; // skills/mcp applied below, before buildScenarios (restart-to-apply)
-                    appliedPlaneEff = r.effective; // model plane applied pre-Runner — this IS the Runner's generation
+                        ccEtag = r.etag;
+                    await adoptCenterPrompts(r.effective, "boot");
+                    markRosterLanded(r.effective);
+                    effective = r.effective;
+                    appliedPlaneEff = r.effective;
                     if (bootClean)
-                        latestEffective = r.effective; // LKG seed (§9.5-2): only a fully clean candidate may become the LKG
-                    // F7(LKG 复审三轮):boot 写点**延后**到 center skills 装载(applyCenterSkills+盘缓存)之后——
-                    // 先落 LKG 会让「新 skill 的 manifest 可见但正文没进缓存」窗口存在(此窗内崩+中心断=离线 boot
-                    // 静默缺 skill)。这里只记 candidate,真正落盘在 skills 装载后(main 后段)。
+                        latestEffective = r.effective;
                     if (bootClean && !lkgBooted)
                         bootLkgCandidate = { effective: r.effective, etag: r.etag };
-                    // [875]b:带上模型数与(local lane)真实目录来源——复验实录:CONFIG_LOCAL_DIR 误配(只设
-                    // LOCAL_DATA_ROOT)时 config.d 静默读不到、0 模型且无告警,排障只能靠猜。
                     const cfgModels = (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length;
                     const cfgDir = configProvider.kind === "local" ? { dir: configProvider.root } : {};
                     logger.info("config_loaded", { source: configProvider.kind, version: r.effective.version, worker: cc?.worker ?? "(global)", models: cfgModels, ...cfgDir });
                     if (configProvider.kind === "local" && cfgModels === 0) {
-                        // [3073]#204④ hint 真因三臂:域判形失败(文件在场却喊「空/指错」=对排障者说谎,真因在
-                        // config_domain_invalid 里但 hint 不指路)/ 全 enabled:false / 真空缺,三态分开点名。
                         const modelsDomainErr = (r.domainErrors ?? []).find((de) => de.domain === "models");
                         const totalModels = (r.effective.models?.models ?? []).length;
                         logger.warn("config_local_no_models", {
@@ -511,7 +303,6 @@ export async function createConfigCenterRuntime(ctx) {
         }
         catch (err) {
             logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
-            // 硬失败(fast-fail RST 等,非超窗)同样值得 LKG:上一进程的干净候选好过纯 env。
             const lkgFallback = await bootFromLkg(`boot fetch failed: ${String(err).slice(0, 120)}`);
             if (lkgFallback) {
                 lkgBooted = true;
@@ -525,84 +316,44 @@ export async function createConfigCenterRuntime(ctx) {
             }
         }
     }
-    // #A4([4147] 件1):READ 容纳面四键的 center 腿 —— **boot 期唯一装点**,两条 boot 路径(live 拉取与
-    // LKG 回落)在此汇合(`effective` 只在真应用的那两支被置;dry-run 只 diff 不 apply ⇒ 恒缺席 ⇒ 不落配,
-    // 与 observe-only 语义一致)。
-    // ⚠️ **位置即契约**:必须留在 `createConfigCenterRuntime` 的 boot 段里 —— 这四键在 main.ts 的
-    // `createRunnerDeps` 里被**取值捕获**(boot/runner-deps.ts 的四座),而那一步排在本函数 await 之后;
-    // 挪到 `applyCenterCapabilities`(skills/mcp 那条线,main.ts 后段)就晚了:配置改了、runner 已经拿着旧值,
-    // 是「半接=静默死特性」的教科书形。refresh 路径刻意不热应用(restart-to-apply,`read-face` 片通告)。
-    // 返回值 = 本机 env 显式占住的 readFace 键(部署事实,与本次发布内容无关)。喂给 `restartCtx()`,
-    // `read-face` 片于是只指纹**真会 boot-bake 的那部分** —— 否则 center 改一个本机永远用不上的键,
-    // 整片 fleet 会为一次对自己毫无影响的发布滚动重启一遍(codex 对抗复审 finding 2)。
-    // ⚠️ 必须在 apply **之前/之中**取:apply 之后 config 上的键分不清是 env 写的还是 center 刚落的。
-    // 域缺席(今天绝大多数部署)时函数只算这一件事就返回,零副作用。
     const readFaceEnvHeld = applyCenterReadFace(config, effective ?? { version: 0, updatedAt: "", models: { models: [], roles: {} } }, effective ? logger : undefined);
     if (!modelReadyState.ready)
         logger.warn("model_roster_pending", {
             note: "CONFIG_REQUIRE_ROSTER=true and no center roster has landed yet — the env MODEL_ID is treated as a PLACEHOLDER, so billable submissions 503 (and /health reports ready:false) until the first effective pull lands ≥1 enabled model. Unset the knob if this worker's env model is authoritative.",
         });
-    // Per-model API key (config-center `apiKeyEnv`): resolve each model's own upstream key per brain call /
-    // cascade rung. undefined when no per-model keys are configured → spec field stays unset (core default).
-    // `let` (not const): rebuilt on a config-center refresh so per-model key ADDITIONS hot-apply too (the
-    // resolver is undefined when no per-model keys exist, so in-place mutation alone wouldn't cover empty→non-empty).
     let keyResolver;
-    // 复审 2026-07-29 P1-11:restart 片里唯一一块 EffectiveConfig **看不见**的输入 —— 反应式降级车道由 env
-    // (MODEL_DEGRADE_TO / MODEL_DEGRADE_REACTIVE)开关,而它焊死的是 CENTER 目录里那条模型的路由面。读成
-    // 函数而非常量:`config.degrade` 今天由 env 独占(applyEffective 不写它),但若哪天中心接管这面,这里
-    // 自动跟着走,不会退化成 boot 期快照。车道关(默认)⇒ ctx 空 ⇒ 该片恒 null ⇒ 零行为变化。
-    // #324(core 5.50 design/338):mid-turn MCP 撤销台账。铸在这里(写路径归本 runtime:boot bake 铸
-    // baseline、refresh commit 喂 diff),读口经 `takeMcpRevocations()` 外借给 RunnerDeps 席。
-    // ⚠️ **取走即声明接线**:restart 豁免(纯删除向不签 mcp)只在 `mcpRevocationWired` 后生效——把豁免与
-    // 承接绑在同一动作上,main 若哪天删了接线行,豁免自动关回旧 restart 语义(fail-closed,#157;
-    // 反例=独立布尔,两处各写一遍必漂移,漂移方向正是「没人承接删除却不再签 restart」的静默 fail-open)。
     const mcpRevocations = createMcpRevocationLedger((ev) => logger.info("mcp_revocation_ledger", { ...(ev.revoked.length > 0 ? { revoked: ev.revoked } : {}), ...(ev.restored.length > 0 ? { restored: ev.restored } : {}) }));
     let mcpRevocationWired = false;
     const restartCtx = () => ({
         ...(config.degrade?.reactive ? { reactiveDegradeTo: config.degrade.to } : {}),
-        // #A4:env 占住的 readFace 键(boot 期一次性事实,env 不会在进程内变)。
         ...(readFaceEnvHeld.length > 0 ? { readFaceEnvHeld } : {}),
-        // codex F2 双门:席被取走(wired)**且** boot bake 真铸过 baseline(mount 真身在案)才豁免——
-        // boot 超时/纯 env 形的 mount 不是中心集,撤销腿承接不了删除,豁免必须关死走旧 restart 语义。
         ...(mcpRevocationWired && mcpRevocations.hasBaseline() ? { mcpRevocationLive: true } : {}),
     });
-    // #131-2:60s 刷新环的句柄提到 runtime 闭包层——stopRefreshLoop(hardShutdown 收尾链)要能清它。
     let ccTimer;
     return {
         providerKind: configProvider?.kind,
         promptSource,
         takeMcpRevocations: () => {
-            mcpRevocationWired = true; // 取走即声明接线(见铸造点注)——restart 豁免从此拍起生效
+            mcpRevocationWired = true;
             return mcpRevocations;
         },
-        mcpRevocationState: () => (configProvider ? mcpRevocations.view() : undefined), // 纯 env 形没有中心撤销语义 ⇒ 诚实缺席
+        mcpRevocationState: () => (configProvider ? mcpRevocations.view() : undefined),
         getKeyResolver: () => keyResolver,
         getCenterPrompts: () => centerPrompts,
         modelReady: () => modelReadyState.ready,
         restartState: () => pendingRestart,
         planeDeferredState: () => planeDeferredNoHandoff,
-        configApplyState: () => (configProvider ? applyLedger.view() : undefined), // 纯 env 形没有可对账的世代 ⇒ 诚实缺席,不报一对恒 0
+        configApplyState: () => (configProvider ? applyLedger.view() : undefined),
         async refreshNow() {
             if (!manualRefresh)
                 return "not-wired";
             return (await manualRefresh()) === "failed" ? "failed" : "triggered";
         },
         async applyLocalRemoteExec() {
-            // DUAL-MODE §4/§5 (center #1): in LOCAL config mode, source remoteExec from the SHARED
-            // `config.d/remote-exec.json` via the registry `loadRemoteExec` — the SAME file + zod validation that the
-            // client's `agent-cli config` writes, so client doctor and the engine read one source of truth (zero drift).
-            // Semantics (center, deliberate): file MISSING → undefined → keep the env/host default (config.ts already
-            // defaults host in local mode); file PRESENT → it wins; file empty/corrupt → the loader throws → fail-closed
-            // (an empty file silently falling back to host would be an isolation downgrade if the user meant local-docker).
             if (configProvider?.kind === "local") {
                 try {
-                    const fileRx = await loadRemoteExec(localRoot); // SAME root as the config provider above (no split-brain)
+                    const fileRx = await loadRemoteExec(localRoot);
                     if (fileRx) {
-                        // 🔴 center contract: the package RemoteExecSpec is the CONTRACT form (env-NAME refs: apiKeyEnv/tokenEnv/…);
-                        // our config.remoteExec is the RESOLVED form (values). `host` carries NO secrets so it maps 1:1 (contract
-                        // `workdir` ≡ our `workspaceBase`). The ISOLATED lanes (e2b/k8s/ssh/adb) need a NAME→value resolution
-                        // before use — a follow-on; until then they are sourced from REMOTE_EXEC env, so a file-source isolated
-                        // arm is ignored (NOT cast verbatim — that would feed an env-NAME where a value is expected).
                         if (fileRx.provider === "host") {
                             config.remoteExec = {
                                 provider: "host",
@@ -612,10 +363,6 @@ export async function createConfigCenterRuntime(ctx) {
                             logger.info("remote_exec_from_file", { provider: "host", root: localRoot });
                         }
                         else if (fileRx.provider === "local-docker") {
-                            // local-docker carries NO secret env-NAMEs (image/memory/cpus/network/workdir/mountPath only), so it
-                            // maps 1:1 from the contract form — no NAME→value resolution needed (unlike e2b/k8s/ssh). The contract
-                            // `workdir` is the in-container workspace ROOT ≡ our `mountPath`. DOCKER_HOST/secret env stay in the
-                            // worker's .env (the adapter reads its own process.env via the env-forward, not the file).
                             config.remoteExec = {
                                 provider: "local-docker",
                                 image: fileRx.image,
@@ -633,20 +380,14 @@ export async function createConfigCenterRuntime(ctx) {
                 }
                 catch (err) {
                     logger.error("remote_exec_file_invalid", { root: localRoot, err: String(err) });
-                    throw err; // fail-closed (center semantics): a corrupt remote-exec.json must not boot a wrong/weaker lane
+                    throw err;
                 }
             }
         },
         async applyCenterCapabilities(skills) {
-            // Sema-registry B1 (restart-to-apply, baked into scenarios below): overlay center skills (lazy-fetched by
-            // hash + sha256-verified) over the image baseline, center-wins-by-name; resolve center MCP servers' env-NAME
-            // refs to real values from this service's env. Both empty/unset → unchanged (image SKILLS_DIR, no MCP).
             if (effective?.skills && config.configCenter) {
                 skills = await applyCenterSkills(skills, effective.skills, config.configCenter.baseUrl, config.configCenter.token, logger, undefined, configLkgEnabled() ? defaultSkillCacheDir() : undefined);
             }
-            // plugins 域消费半场(契约 [1361]②/[1362]/[1366]①;2026-07-28 开工车):把 center 声明的插件引用
-            // 物化(https-only+ALLOW_HOSTS 纵深复验/sha 钉扎/隔离 clone/LKG)并装载其 skills —— **在 center 直发
-            // skills 之后**:撞名让位判据(收紧④,plugin 让位)以此刻的 skills 集为准。失败单条不连坐,永不拒启。
             if (effective?.plugins && config.configCenter) {
                 const pluginOut = await applyCenterPlugins(skills, effective, {
                     cacheRoot: join(config.localDataRoot ?? join(homedir(), ".ai-agent"), "plugin-cache"),
@@ -663,44 +404,21 @@ export async function createConfigCenterRuntime(ctx) {
                     }
                 }
             }
-            // F7:boot 的 LKG 落盘点。codex R26:走同一只 persistLkgDurable(完整性门在前)——此前裸 saveLkg 会把
-            // applyCenterSkills 静默吞掉失败的「缺正文 manifest」发布成 boot 可见 LKG(离线重启=静默缺 skill 且不再
-            // 有信号收敛)。校验失败=不落盘(warn 已在函数内),下一个干净候选/refresh 重试重写。
             if (bootLkgCandidate && lkgEnabled) {
                 const bootPublished = await persistLkgDurable(bootLkgCandidate.effective, bootLkgCandidate.etag).catch((err) => {
                     logger.warn("config_lkg_save_failed", { path: lkgPath, err: String(err), note: "boot LKG persist failed — retained for the per-tick retry" });
                     return false;
                 });
-                // codex R30: a failed/incomplete boot publication must enter the SAME retained-candidate retry lane as the
-                // refresh path — ccEtag has already advanced, so the next ticks 304 and nothing else would ever retry; a
-                // restart during a center outage would then boot stale/env config instead of the generation this process
-                // already applied. blocked=[] — everything WAS applied at boot, this is a publication-only retry (promotion
-                // with no withheld reasons publishes NO restart signal, it just completes the LKG and clears the state).
                 {
-                    // codex R32/R34: verify the boot's LIVE application UNCONDITIONALLY — applyCenterSkills skips an
-                    // unfetchable body (this process may run skill-stale / on an older same-name built-in), and the LKG
-                    // prewarm inside persistLkgDurable can succeed where the live fetch failed (bootPublished true, LKG
-                    // complete, process still stale). Any live miss ⇒ a skills restart: published immediately when the
-                    // handoff already stands, or carried in blocked for the 304-gated promotion when it doesn't.
                     const enabledManifest = (bootLkgCandidate.effective.skills?.skills ?? []).filter((m) => m.enabled !== false);
-                    // codex R33: the FULL runtime projection must match, not just name+body — a same-body built-in retained
-                    // after a failed center fetch can carry different scenarios/description (e.g. global exposure where the
-                    // manifest restricts to one scenario), and the scenario bundles baked right after are then stale.
                     const canonScenarios = (a) => [...(a ?? [])].sort().join("\u0000");
                     const liveSkillMiss = enabledManifest.some((m) => !skills.some((sk) => sk.spec.name === m.name &&
                         skillContentHash(sk.spec.content) === m.contentHash &&
                         sk.spec.description === m.description &&
                         canonScenarios(sk.scenarios) === canonScenarios(m.scenarios)));
                     if (liveSkillMiss)
-                        bootSkillStale = true; // codex R35: sticky — survives same-generation 200 recomputes
+                        bootSkillStale = true;
                     if (liveSkillMiss && (bootPublished || (!lkgSurvivesRestart && lastPrewarmBodiesVerified))) {
-                        // Signal NOW only on the arms where a restart PROVABLY repairs (codex R34/R36/R37):
-                        //  · durable + published — the complete LKG (manifest + hash-verified bodies) is the handoff;
-                        //  · NON-durable + body proof — the prewarm inside persistLkgDurable just hash-verified every enabled
-                        //    body on disk, so the miss was a TRANSIENT live-application failure and a restarted process
-                        //    re-pulls successfully. WITHOUT the proof (persistent 404/hash mismatch) publishing here would
-                        //    restart-storm a stateless deployment (codex R37) — that case falls to the retained-debt arm
-                        //    below: visible on /health, retried per confirming 304, promoted only once the proof holds.
                         pendingRestart = { restartRequired: true, reasons: ["skills"], version: bootLkgCandidate.effective.version, since: Date.now() };
                         logger.warn("config_boot_skill_stale_restart", { version: bootLkgCandidate.effective.version, durableHandoff: bootPublished, note: bootPublished ? "live skill application incomplete but the durable LKG carries the full candidate — skills restart published (the next boot reads the complete LKG)" : "live skill application incomplete on a non-durable deployment but every enabled body is verified in the cache — skills restart published (transient failure proven repaired; the restarted process re-pulls live)" });
                     }
@@ -712,26 +430,16 @@ export async function createConfigCenterRuntime(ctx) {
             }
             if (effective?.mcp)
                 config.mcpServers = resolveMcpServers(effective.mcp, logger);
-            // #324:撤销台账的 baseline 拍 = boot bake 的 enabled 条目表(mount 真身与台账「此前」同源单点;
-            // codex F1 修:带指纹,重加同名不同形不解除撤销)。域缺席/boot 超时 ⇒ null ⇒ 台账不铸 baseline
-            // (env 型 mcpServers 部署没有中心撤销语义)——此时 hasBaseline()=false,restart 豁免关死
-            // (codex F2 修:迟到 boot 采用的候选集≠mount 真身,**刻意不喂**,该形走旧 restart 语义收敛)。
             mcpRevocations.applyEnabledEntries(enabledMcpEntries(effective?.mcp), { isBaseline: true });
-            // DESIGN-269 车1 件1:A2A peers ride the SAME restart-to-apply line as MCP (one center pull, one
-            // resolution, no hot swap). Absent `a2a` domain ⇒ the key is never written ⇒ the leg does not exist.
             if (effective?.a2a)
                 config.a2aPeers = resolveA2aPeers(effective.a2a, logger);
             return skills;
         },
         applyCenterScenarios(t) {
             const { scenarioDeps, scenarios, scenarioDetails, builtinScenarioNames } = t;
-            // Center-declared scenarios (composition-as-config): overlay over the built-ins, center wins — it MAY
-            // shadow a built-in name (usability first), so shadows are logged loudly here for audit.
-            // Restart-to-apply like skills/mcp (this runs once at boot; a refresh carrying scenarios only signals).
             if (effective?.scenarios) {
                 const { overlay, shadows } = centerScenarios(scenarioDeps, effective.scenarios.scenarios, Object.keys(scenarios), logger);
                 Object.assign(scenarios, overlay);
-                // [C132]:可用性判据同源 —— 详情表与运行工厂读的是**同一只** scenarioDeps(repoClient 在场性)。
                 Object.assign(scenarioDetails, centerScenarioDetails(effective.scenarios.scenarios, builtinScenarioNames, scenarioDeps));
                 if (Object.keys(overlay).length > 0)
                     logger.info("sema_registry_scenarios", { scenarios: Object.keys(overlay), ...(shadows.length > 0 ? { shadowsBuiltin: shadows } : {}) });
@@ -739,11 +447,6 @@ export async function createConfigCenterRuntime(ctx) {
         },
         initKeyResolver() {
             keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
-            // PAIR-REVIEW F-6:Bearer-only 网关 × per-model key 组合死角的 boot 响亮告警——core 的 per-call auth 是
-            // **整体替换**语义(1.345:per-call apiKey 在场即剥构造期 Authorization,x-api-key 成唯一凭据),而
-            // key-resolver 只会产 { apiKey } 形;部署若以 ANTHROPIC_AUTH_TOKEN(Bearer)直连此类网关,则每个配了
-            // per-model key 的模型必 401 且无从自诊。headers 形支持候 core/registry additive 席位(跨仓件);此前
-            // 先把组合不可用讲清楚。只 warn 不拒:混合网关(两种头都收)是存在的,fail-open+可诊断。
             if (process.env.ANTHROPIC_AUTH_TOKEN && !process.env.ANTHROPIC_API_KEY && (Object.keys(config.modelApiKeys).length > 0 || Object.keys(config.modelApiKeyEnv).length > 0)) {
                 logger.warn("per_model_key_bearer_gateway_combo", {
                     perModelKeys: Object.keys(config.modelApiKeys).length + Object.keys(config.modelApiKeyEnv).length,
@@ -753,64 +456,23 @@ export async function createConfigCenterRuntime(ctx) {
         },
         startRefreshLoop(a) {
             const { runnerTierFrozen, pricing, limitSync, swapRunnerModels } = a;
-            // Config refresh: re-pull with the ETag; teams hot-reload via the registry. A models/roles
-            // change updates config but the live Runner keeps its startup set — logged so ops restart to apply.
-            // 提示词装配协议 §9.5-1/-3: the loop goes through the ConfigProvider seam (never the raw HTTP fetch —
-            // one resolver, no remote/local drift) and runs for the LOCAL provider too: config.d edits are picked
-            // up by the same 60s poll (the local provider's etag = the store's raws hash, so an unchanged tree is
-            // a cheap null and a corrupt↔fixed flip bumps the version). Local mode previously read config.d
-            // exactly once at boot.
             if (configProvider) {
                 const ccRef = config.configCenter;
-                // Single-flight (codex F2): an async tick body under setInterval has no serialization — a slow read
-                // (degraded disk/远端) outliving the 60s interval would let a LATER tick apply a newer candidate and
-                // the stalled OLDER read then complete and roll the config (and ccEtag) back. Skip the tick while one
-                // is in flight; the flag flips in `finally`, so a throw never wedges the loop shut.
                 let refreshInFlight = false;
-                // #322 追加件(codex R2-F3):拍的**结果**要能被手动触发口看见 —— `"failed"` = 这一拍的拉取/应用
-                // 抛了(下面的 catch 吞掉异常保住循环,但吞掉的事实必须传出去:operator 按下刷新时,「中心超时」
-                // 与「已刷新」必须可分辨,否则这个口的「诚实」二字就是假的)。
                 const refreshTick = async (prefetched) => {
                     if (refreshInFlight)
                         return "ok";
                     refreshInFlight = true;
                     try {
-                        // codex-3/4 F1:欠账的 catalog 过渡在**每个真拍**开头无条件重试——与 fetch 成败/候选好坏解耦
-                        // (304、fetch 抛错、候选被整拒的拍此前全都跳过重试=盘错恢复后过渡仍卡死)。次序安全:本拍
-                        // 若随后采用了更新候选,adopt 自会覆盖/清空 pending(先重试旧账、后采新目标,永不倒退)。
                         await retryPendingCatalog("refresh-retry");
-                        // codex R18: the stuck-deferred state must not vanish behind the advanced etag — re-warn + count on
-                        // EVERY tick (incl. 304s and fetch-error ticks) while it persists; /health carries the same state.
-                        // The RECOVERY (persist retry + promotion) moved BELOW the fetch (codex R29): promoting before
-                        // adjudicating the current source generation could publish a SUPERSEDED candidate N as the
-                        // boot-visible LKG while N+1 exists — a restart in that window resurrects withdrawn config.
                         if (planeDeferredNoHandoff) {
                             metrics.inc("models_tiers_plane_deferred_stuck_total");
                             logger.warn("models_tiers_deferred_no_handoff", { version: planeDeferredNoHandoff.version, since: planeDeferredNoHandoff.since, note: "candidate still retained without a next-boot handoff — mount restart-surviving LKG storage + CONFIG_LKG_DURABLE=true, or restart manually after ensuring the candidate is re-pulled at boot" });
                         }
-                        // F3(LKG 复审):LKG-boot 的 deferred 到货把 unconditional 结果直接喂进来——丢弃它再按 LKG 的
-                        // etag 条件拉,会在「center 重建且 etag 值撞旧」的场景永远 304=陈旧配置钉死;消费原始结果则
-                        // 应用后 ccEtag=真实新值,陈旧面消除(顺带省一次拉取)。
                         const r = prefetched !== undefined ? prefetched : await configProvider.fetchEffective(ccEtag);
-                        // codex R23/R29 recovery lane: a 304 (r === null) CONFIRMS the retained candidate's generation is
-                        // still the source's current one (its etag advanced when it was retained) — only then is it safe to
-                        // retry persistence and promote the withheld restart signal. A fetch that returned a NEWER candidate
-                        // takes the normal branches below (which replace/supersede the retained state); a fetch that THREW
-                        // never reaches here (freshness unknown ⇒ no promotion this tick). Retry only where promotion is
-                        // possible (durable-declared lane; R37 adds the non-durable skills-debt lane, whose retry doubles as
-                        // the repair proof) — elsewhere a per-tick write could never promote and just burns IO.
                         if (r === null && planeDeferredNoHandoff) {
-                            // Retry where promotion is possible: the durable-declared lane (full handoff), and — codex R37 —
-                            // the NON-durable skills-debt lane, where the retry's body prewarm+verify is the repair PROOF that
-                            // gates the withheld skills restart (see lastPrewarmBodiesVerified).
                             const skillsDebt = (planeDeferredNoHandoff.blocked ?? []).includes("skills");
                             const promoted = lkgSurvivesRestart || skillsDebt ? await persistLkgDurable(planeDeferredNoHandoff.candidate, planeDeferredNoHandoff.candidateEtag) : false;
-                            // codex R37 proof-gated promotion (non-durable lane): every enabled body now hash-verifies on disk
-                            // ⇒ the center + body endpoint are BOTH live, a restarted process re-pulls successfully — publish
-                            // the skills restart exactly now, never on manifest-success alone (restart-storm breaker: a boot
-                            // that fails the body again lacks the proof and returns to visible-debt, not to signaling).
-                            // models-tiers never rides this arm (R16: a FORCED plane restart requires a durable handoff), so a
-                            // retained candidate that ALSO defers the plane keeps everything withheld until durability exists.
                             const skillsProofPromotion = !promoted && !lkgSurvivesRestart && skillsDebt && lastPrewarmBodiesVerified && planeDeferredNoHandoff.planeDeferred !== true;
                             if (skillsProofPromotion) {
                                 pendingRestart = { restartRequired: true, reasons: ["skills"], version: planeDeferredNoHandoff.version, since: Date.now() };
@@ -818,10 +480,6 @@ export async function createConfigCenterRuntime(ctx) {
                                 planeDeferredNoHandoff = undefined;
                             }
                             else if (promoted) {
-                                // models-tiers joins only when the PLANE was deferred (codex R27: a skill-only retained candidate
-                                // must not manufacture a plane reason on promotion). codex R30: an EMPTY promotion (boot
-                                // publication retry — nothing was withheld, everything already applied) publishes NO restart
-                                // signal; it just completes the LKG and clears the state.
                                 const promotedReasons = [...new Set([...(planeDeferredNoHandoff.blocked ?? []), ...(planeDeferredNoHandoff.planeDeferred ? ["models-tiers"] : [])])];
                                 if (promotedReasons.length > 0) {
                                     pendingRestart = { restartRequired: true, reasons: promotedReasons, version: planeDeferredNoHandoff.version, since: Date.now() };
@@ -831,21 +489,8 @@ export async function createConfigCenterRuntime(ctx) {
                             }
                         }
                         if (r) {
-                            // #322 世代账:**拉到即算 target**(候选是否被采纳是下面的事)。整拒的拍只推进 target ⇒
-                            // target≠applied 的持续时长在 /health 上可见 —— 「持续卡在旧代」的副本从结构上可被摘除。
-                            const tickGen = generationOf(r.effective.version); // #325:收货序数(本拍全链同一个)
+                            const tickGen = generationOf(r.effective.version);
                             applyLedger.seenTarget(tickGen, r.effective.version);
-                            // §9.5-5 candidate gate: ANY invalid domain rejects the WHOLE candidate — the live config
-                            // keeps serving the LKG (`latestEffective`) instead of that domain falling to schema-default/
-                            // empty. ccEtag is deliberately NOT advanced: the bad tree stays visible (re-judged each poll),
-                            // and fixing the file bumps the version so the next poll lands. The dedupe key is the SORTED
-                            // de-duplicated domain set (codex F3: the collector's ordering isn't guaranteed, a raw join
-                            // would re-warn every poll), and the first warn carries the full per-domain error detail —
-                            // that's the actionable diagnosis, the key only mutes repeats. The prompts-domain artifact
-                            // validation (core S1) hooks into this same gate when it ships.
-                            // F6(二轮复审):prompts 面判形进候选门——坏 pack(重复 id/空数组/坏信封)若只在 boot 验,
-                            // refresh 会带着它推进 etag+发 restart 信号,重启后 boot 拒之回内置=好包 A 被坏包 B 顶掉。
-                            // 这里与 domainErrors 同门:坏形=整拒候选(etag 不进,LKG/现用包 A 继续服务,持续 warn 到修复)。
                             const promptsRaw = r.effective.prompts;
                             const promptsGate = promptsRaw !== undefined ? validatePromptsDomain(promptsRaw) : { ok: true };
                             const badDomains = [
@@ -867,35 +512,14 @@ export async function createConfigCenterRuntime(ctx) {
                                         note: "candidate rejected whole (§9.5-5) — live config keeps the last-known-good; fix the named files to unblock",
                                     });
                                 }
-                                return "ok"; // 拍本身跑完了(候选被判拒是**结论**,不是失败)
+                                return "ok";
                             }
                             lastRejectedCandidate = undefined;
-                            // ccEtag advances at the END of each branch (codex lens-1 HIGH): advancing before apply meant
-                            // an applyEffective throw mid-way left a MIXED-generation live config AND a cached etag — the
-                            // next poll 304'd, so the failed candidate was never retried. Now a throw keeps the old etag,
-                            // the next poll re-fetches the same candidate, and the (idempotent) re-apply self-heals.
                             if (ccRef?.dryRun) {
-                                logEffectiveDiff(config, r.effective, logger); // compare-only: surface ongoing center changes, apply nothing
+                                logEffectiveDiff(config, r.effective, logger);
                                 ccEtag = r.etag;
                             }
                             else {
-                                // refresh: teams + runtime governance + MODELS/ROLES/ROSTER now hot. teamsOnly skips
-                                // only the boot-only runtime GATES (rate/cost/approval). applyEffective mutates config.models/roles
-                                // IN PLACE (the Runner's live ref) — but `pricing` (separate object the Runner also reads live) and
-                                // `keyResolver` (closes over modelApiKeyEnv) are ours to refresh.
-                                // codex R10: hot-apply of the MODEL PLANE holds ONLY when the Runner shares our map (tier-less at
-                                // construction). A tier-frozen Runner keeps a private expanded copy — hot-applying a changed plane
-                                // would split admission from execution (same-key retarget silently routes/bills the stale Model
-                                // object through the restart window). Defer the plane; the models-tiers slice below signals the
-                                // orchestrator; the restarted process applies it at boot BEFORE Runner construction.
-                                // codex R12: defer also when the CANDIDATE activates tiers on a tier-less-booted Runner — it never
-                                // re-runs expandTiers, so hot-applying the arriving tier table would let tier words pass the
-                                // expanded admission gate while core throws "Unknown model ref" until restart. Hot-apply is safe
-                                // only when BOTH generations are tier-less.
-                                // core 5.49 swapModels 接缝在场 ⇒ defer 判据整条退役:plane 变更(含 tier-frozen /
-                                // 候选激活 tiers 两旧 defer 子臂,也含从前的 tier-less 就地热臂)一律经 swapPlane 在
-                                // commit 前换进全部 boot Runner——统一走 swap 让「Runner 私有目录 vs 共享表」两种姿势
-                                // 收敛成一种(swap 后 Runner 恒在私有目录上,后续变更继续 swap,无姿势追踪状态)。
                                 const planeChanged = modelPlaneChanged(appliedPlaneEff, r.effective);
                                 const planeDeferred = swapRunnerModels === undefined && (runnerTierFrozen || planeHasActiveTiers(r.effective)) && planeChanged;
                                 let applyReport;
@@ -910,25 +534,11 @@ export async function createConfigCenterRuntime(ctx) {
                                     ...(planeDeferred ? { deferModelPlane: true } : {}),
                                     ...(swapRunnerModels !== undefined && planeChanged ? { swapPlane: swapRunnerModels } : {}),
                                 });
-                                // [2283]③:CAS 拒绝(更旧世代)⇒ 本拍整体跳过——prompts 采用/pricing/keyResolver/restart
-                                // 对账/etag 推进/LKG 落盘都不得从旁路半应用同一个被拒世代(拒绝 warn 已在 applyEffective 留痕)。
                                 if (!committed)
-                                    return "ok"; // CAS 拒(更旧世代)——同上,拍成功地得出了「不采纳」
-                                // 🔴 #303 codex R1-F2(真 finding,红先钉在 test/apply-effective-stage-commit.test.ts):
-                                // commit 的**派生两件**必须紧贴 commit,零 await —— 修前它们在下面 `await adoptCenterPrompts`
-                                // 之后,而 commit 已经把 `config.models` 就地换代(三个消费面实时读)、把
-                                // `modelApiKeyEnv/modelApiKeys` 整表重赋值,老 `keyResolver` 却还闭包着**上一世代**的表。
-                                // 那段 await 里同名模型换端点+换 key 的下发 = 旧密钥发到新端点(401,或把上一家的凭据
-                                // 递给下一家);单纯换 key = 一窗瞬时 401。现在目录与密钥表成对换代。
-                                // (plane 被 defer 时 commit 压根没动模型面 ⇒ 这里按同一张旧表重建,内容不变,与修前同。)
-                                mutateInPlace(pricing, buildPricing(config.models)); // hot: cost/model changes; Runner reads this.deps.pricing live
-                                keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys); // hot: per-model key add/remove/change (env-ref + sealed)
-                                limitSync?.sync(); // #322 批1:限额座与 config 成对换代(同一条「派生件紧贴 commit」纪律)
-                                // #324:撤销台账拍(commit 接受即喂,与上面三件派生同族)。删除向由此**即时**生效
-                                // (core 每次 MCP dispatch 前探 isRevoked)——design/338 要消的「撤销等 restart」窗。
-                                // 放在 fullyApplied 判之前:mcp 域不在 limits 组,某组被整拒不构成扣住撤销的理由
-                                // (撤销是收紧向,宁早不晚)。baseline 未铸(boot 超时形)时这一喂只推 seen 集,
-                                // 恢复判据与 restart 豁免都被 hasBaseline 门关死(codex F2)。
+                                    return "ok";
+                                mutateInPlace(pricing, buildPricing(config.models));
+                                keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
+                                limitSync?.sync();
                                 mcpRevocations.applyEnabledEntries(enabledMcpEntries(r.effective.mcp));
                                 applyLedger.applied(tickGen, r.effective.version);
                                 if (planeDeferred) {
@@ -936,31 +546,11 @@ export async function createConfigCenterRuntime(ctx) {
                                 }
                                 else {
                                     appliedPlaneEff = r.effective;
-                                    planeDeferredNoHandoff = undefined; // plane landed — the stuck state (if any) is resolved
+                                    planeDeferredNoHandoff = undefined;
                                 }
-                                await adoptCenterPrompts(r.effective, "refresh"); // 热采用(core 1.316 声明轴:新任务边界自动重 pin,见 ref 注释)
-                                // codex R13: readiness may open ONLY off an APPLIED plane — a deferred candidate's roster is not
-                                // installed (config.models still the old/placeholder generation), so opening the billable gate on
-                                // it would route/bill the wrong model until restart. Deferred ⇒ gate stays as-is; the restarted
-                                // process applies the candidate pre-Runner and opens it at boot.
+                                await adoptCenterPrompts(r.effective, "refresh");
                                 if (!planeDeferred)
-                                    markRosterLanded(r.effective); // boot pull 失败/未发布时,refresh 落 roster 同样开门
-                                // (pricing/keyResolver 的重建已上提到 commit 紧邻处 —— 见上方 #303 R1-F2 注)
-                                // skills/mcp/scenarios/runtime-gates are baked into the live process at boot (buildScenarios / boot
-                                // middleware) — a refresh carrying a DIFFERENT value can't hot-apply, only a restart re-reads them.
-                                // We compare against the BOOT snapshot (`effective`), NOT presence: an orchestrator auto-restarts on
-                                // a non-empty `reasons` WITHOUT a restart loop (same diff every 60s is idempotent, not a fresh trigger).
-                                // Sticky `since`: keep the first-detected timestamp while `reasons` is unchanged; reset it when the set
-                                // changes; CLEAR the signal when a later pull reverts to boot (reasons empty) — restart no longer needed.
-                                // F2(LKG 复审):落盘 **await 且先于** restart 信号可见——orchestrator 见信号即杀进程,
-                                // fire-and-forget 的 rename 可能没完成 → 下一进程读旧 LKG → 同差异重现 = 本功能要消的环。
-                                // 顺序=先持久化(含 skill 正文预热,F1)再发信号;持久化失败=warn+照发(不发=配置永不生效;
-                                // 「盘坏+中心挂」双故障下环重现,接受并点名)。
-                                // 🔴 codex R2-F1(真 finding,红先):**没有完整应用的候选不许成为 LKG,也不许推进 etag**。
-                                // applyEffective 对「其余面提交了、某组被整拒」的候选返回 true;修前这里照旧落盘 + 推进
-                                // latestEffective/ccEtag ⇒ N-1 的好 LKG 被 N 盖掉,重启且中心不可达时 N 的那一组再次被拒 ⇒
-                                // 退到 env 基线 = **N-1 的限额保护丢了**。世代账已记下拒因(applied 不前进),这里只需早退:
-                                // 盘上的 LKG 与 etag 都停在上一个**完整**世代,下一拍重新判同一棵树(修好即自愈)。
+                                    markRosterLanded(r.effective);
                                 const fullyApplied = applyReport?.fullyApplied !== false;
                                 if (!fullyApplied) {
                                     logger.warn("config_candidate_partially_applied", {
@@ -968,79 +558,36 @@ export async function createConfigCenterRuntime(ctx) {
                                         rejected: applyReport?.limits.rejected?.keys ?? [],
                                         note: "a group of this candidate was refused — the live config keeps serving the prior values for it; the LKG and the ETag stay on the last FULLY applied generation (this tree is re-judged next tick)",
                                     });
-                                    return "ok"; // 同上:拍跑完了,结论是「这一代没能完整应用」(世代账 + 本行 warn 是它的读面)
+                                    return "ok";
                                 }
                                 const lkgPersisted = await persistLkgDurable(r.effective, r.etag);
                                 const reasons = restartReasons(effective, r.effective, restartCtx());
-                                // swapModels 接缝在场 ⇒ models-tiers 指纹的 boot 基线差异不再是重启理由:能走到这一行的
-                                // 候选,其模型面要么本拍已 swap 进全部 Runner、要么与已应用面相同(swap 拒绝在 committed
-                                // === false 早退了)——留着这个 reason 就是指纹注释里点名的「applied yet signalled」不一致,
-                                // orchestrator 会为一个已生效的变更滚动重启整片 fleet。degrade-route 面**不**跟着退役:
-                                // 它指纹的是 createBrain 在 boot 构造期捕获目标 Model 的降级壳(restart-signal.ts:180),
-                                // swapModels 只换 Runner 的目录代际、不重组 server 侧 brain 壳,该臂重启理由仍然诚实。
                                 if (swapRunnerModels !== undefined) {
                                     const mi = reasons.indexOf("models-tiers");
                                     if (mi >= 0)
                                         reasons.splice(mi, 1);
                                 }
-                                // codex R35: the sticky boot skill debt rides EVERY tick's reasons — change-detection vs boot is
-                                // blind to it (the stale table IS the boot baseline). Under a no-handoff deferral it folds into
-                                // blocked (promoted later); otherwise it keeps pendingRestart alive until the restart happens.
-                                // codex R38: change-DETECTED skills (manifest actually changed) is distinguished from the sticky
-                                // rider — the former keeps the pre-existing documented posture (rides regardless; the restart
-                                // pulls the NEW generation live), the latter is proof-gated below on the non-durable lane.
                                 const skillsChangeDetected = reasons.includes("skills");
                                 if (bootSkillStale && !skillsChangeDetected)
                                     reasons.push("skills");
-                                // codex R15/R16/R19: a DEFERRED plane is adjudicated by HANDOFF STATUS alone — independent of
-                                // whether change-detection already produced the reason (R19: an already-present models-tiers with
-                                // no handoff sailed through = the exact storm R16 closed). With a confirmed next-boot handoff the
-                                // reason is ensured present (R15: env-baseline blind spot) and the stuck state clears; without one
-                                // the reason is SUPPRESSED (a restart the next process cannot satisfy — over-budget boot pull + no
-                                // LKG — is a rolling-restart storm) and the persistent stuck state + per-tick warn carry the
-                                // observability instead. Non-plane reasons (skills/mcp/…) keep riding either way.
                                 if (planeDeferred) {
                                     if (lkgPersisted) {
                                         if (!reasons.includes("models-tiers"))
                                             reasons.push("models-tiers");
-                                        planeDeferredNoHandoff = undefined; // handoff exists — the restart signal carries observability
+                                        planeDeferredNoHandoff = undefined;
                                     }
                                     else {
-                                        // codex R22: suppress the candidate's ENTIRE restart signal, not just models-tiers — a
-                                        // co-occurring skills/mcp reason would still restart the worker, and with no handoff the
-                                        // replacement can't land ANY of this candidate (same over-budget pull) = the same storm.
-                                        // The blocked reasons stay observable (state + warn) and promote once a handoff exists.
                                         const blocked = reasons.splice(0, reasons.length);
                                         planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), ...(blocked.length > 0 ? { blocked } : {}), planeDeferred: true, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
                                         logger.warn("models_tiers_deferred_no_handoff", { version: r.effective.version, blockedReasons: blocked, note: "plane deferred but no NEXT-BOOT handoff (LKG disabled/unwritable, or storage not declared restart-surviving — set CONFIG_LKG_DURABLE=true) — the WHOLE restart signal is withheld (it would loop); the old generation keeps serving" });
                                     }
                                 }
                                 else if (lkgSurvivesRestart && !lkgPersisted) {
-                                    // codex R27/R31: retention is NOT conditional on restart reasons — a hot-only candidate
-                                    // (autonomy/prompts/teams/tier-less models) with a failed publication would otherwise advance
-                                    // the etag and never retry (304s), and a restart during a center outage would roll back to the
-                                    // older LKG (weaker governance). blocked may be [] = publication-only recovery (R30 promotion
-                                    // publishes no signal for an empty set).
-                                    // codex R27: a DURABLE-DECLARED deployment whose candidate publication is incomplete (skill-body
-                                    // verify failed → LKG not replaced) must not signal restart off that candidate either — the next
-                                    // boot would land the OLD LKG and re-signal while the center stays unavailable. Retain + withhold
-                                    // + per-tick retry-promote, same machinery as the deferred plane (no models-tiers added on
-                                    // promotion — the plane was NOT deferred here). Non-declared deployments keep the pre-existing
-                                    // documented posture (restart converges off a live boot pull when the center is healthy).
                                     const blocked = reasons.splice(0, reasons.length);
                                     planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), blocked, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
                                     logger.warn("restart_candidate_publication_incomplete", { version: r.effective.version, blockedReasons: blocked, note: "durable LKG declared but the candidate's publication is incomplete (skill bodies unverified) — restart signal withheld; retried every tick until the cache completes" });
                                 }
                                 else if (!planeDeferred && !lkgSurvivesRestart && bootSkillStale && !skillsChangeDetected && !lastPrewarmBodiesVerified) {
-                                    // codex R38: the NON-durable lane's sticky rider must clear the SAME proof gate as the boot/304
-                                    // arms (R37) — a same-generation 200 (center omits/rotates ETags or ignores conditionals) lands
-                                    // here with reasons=[skills] purely from the sticky debt, and publishing it unproven re-opens
-                                    // the restart storm R37 closed (every replacement fails the same body, 200s again, signals
-                                    // again). persistLkgDurable just ran for THIS candidate, so the proof flag is current: unproven
-                                    // ⇒ strip the rider from the publishable set and retain it as visible debt (the same
-                                    // planeDeferredNoHandoff machinery the 304 recovery lane re-verifies and proof-promotes).
-                                    // Proven or durable-handoff ⇒ the rider rides as before. Change-DETECTED skills is exempt
-                                    // (pre-existing posture — the restart pulls the NEW generation, a different repair claim).
                                     const i = reasons.indexOf("skills");
                                     if (i >= 0) {
                                         reasons.splice(i, 1);
@@ -1059,17 +606,10 @@ export async function createConfigCenterRuntime(ctx) {
                                 }
                                 logger.info("sema_registry_refreshed", {
                                     version: r.effective.version,
-                                    // hot-applied: teams + runtime governance (autonomy/commandPolicy) + MODELS/ROLES/ROSTER (+pricing
-                                    // +per-model keys). Still restart-to-apply: skills/mcp/scenarios + runtime GATES (rate/cost/approval).
                                     note: "teams + runtime governance + models/roles/roster hot-applied; skills/mcp/runtime-gates/scenarios are restart-to-apply",
-                                    // Structured signal: orchestrator consumes the SAME object via GET /health.restart.
                                     ...(pendingRestart ? { restartRequired: true, restartReasons: pendingRestart.reasons } : {}),
                                 });
-                                // BOTH the LKG and the etag advance ONLY after the whole apply/pricing/keyResolver/restart
-                                // chain succeeded (codex lens-3): if any step above throws, latestEffective keeps pointing at
-                                // the last FULLY-applied candidate and the etag stays put, so the next poll re-fetches and
-                                // re-applies the same candidate (idempotent self-heal) — the LKG never names a half-applied one.
-                                latestEffective = r.effective; // LKG advance (§9.5-2): candidate validated + fully applied
+                                latestEffective = r.effective;
                                 ccEtag = r.etag;
                             }
                         }
@@ -1083,15 +623,10 @@ export async function createConfigCenterRuntime(ctx) {
                     }
                     return "ok";
                 };
-                // #322 追加件(clay 当场裁定):**手动触发口**(POST /v1/admin/config/refresh)与 cadence 走**同一只**
-                // 拍。这里加的是 join 语义而不是第二条拉取路径:`refreshTick` 自己的 `refreshInFlight` 是「在飞就跳过」
-                // (对定时器是对的:下一拍 60s 后就来),而对一次**人发起的**触发,跳过等于骗人(回执说 triggered、
-                // 实际什么都没干)。所以 cadence 与手动口都经 `runTick`:在飞 ⇒ 返回**同一个 promise**(join),
-                // 空闲 ⇒ 起一拍。内层守卫保留(纵深:任何忘了走 runTick 的新调用点仍不会并发双拍)。
                 let inFlight;
                 const runTick = (prefetched) => {
                     if (inFlight)
-                        return inFlight; // join:全部 joiner 拿到**同一拍的同一个结果**(成功与失败都一样)
+                        return inFlight;
                     const p = refreshTick(prefetched).finally(() => {
                         inFlight = undefined;
                     });
@@ -1101,21 +636,9 @@ export async function createConfigCenterRuntime(ctx) {
                 manualRefresh = runTick;
                 ccTimer = setInterval(() => void runTick(), 60_000);
                 ccTimer.unref?.();
-                // Boot-deferred continuation(二轮复审 F5 改形):到货结果按「迟到的 boot」处理,而不是转普通 tick——
-                // 普通 tick 的 restartReasons(undefined, r) 会把 prompts/skills 面全判为差异 → restart → 中心持续慢时
-                // 下一进程又 deferred → 无限重启环。迟到 boot:①候选门同 F6(坏形=拒,cadence 重判);②热面
-                // teamsOnly apply(boot-only gates/skills/mcp 已按 env 建,迟到不可应用——诚实);③prompts adopt
-                // (进程刚起、会话面≈空,失真面⊆重启路径,且 adopt 后 prompts 不再贡献 restart 理由=prompts 无环);
-                // ④一次性诚实 restart 信号=剩余 restart-to-apply 面(skills/mcp/scenarios/gates)非空才发;⑤基线
-                // `effective`/LKG/etag 落位 → 后续 cadence 与到货值比较,不重复触发。⚠️ 残余环面(诚实记账):center
-                // 发布了 skills/mcp 且中心**持续**慢于 boot 预算时,每个新进程仍会为真缺失的 skills 面发一次 restart
-                // ——完整解=LKG 落盘(boot 直读上个进程的干净候选),已报 clay 裁量。
                 const deferredBootApply = async (r) => {
                     if (!r)
                         return;
-                    // F6(LKG 复审三轮):与 cadence tick 同一 single-flight 车道——deferred 的 skill 预热可能拖过 60s,
-                    // 期间 cadence 落了更新的候选 B,A 迟到完成再覆盖盘/信号=回滚。inFlight 时直接让行(丢弃 deferred
-                    // 结果无损:cadence 已经/即将拉到更新的),持有 flag 至信号发布后。
                     if (refreshInFlight)
                         return;
                     refreshInFlight = true;
@@ -1127,8 +650,8 @@ export async function createConfigCenterRuntime(ctx) {
                     }
                 };
                 const deferredBootApplyInner = async (r) => {
-                    const lateGen = generationOf(r.effective.version); // #325:收货序数(迟到 boot 拍全链同一个)
-                    applyLedger.seenTarget(lateGen, r.effective.version); // #322:迟到 boot 也是「见过这一代」
+                    const lateGen = generationOf(r.effective.version);
+                    applyLedger.seenTarget(lateGen, r.effective.version);
                     const promptsRaw = r.effective.prompts;
                     const promptsGate = promptsRaw !== undefined ? validatePromptsDomain(promptsRaw) : { ok: true };
                     if ((r.domainErrors ?? []).length > 0 || !promptsGate.ok) {
@@ -1144,13 +667,6 @@ export async function createConfigCenterRuntime(ctx) {
                         ccEtag = r.etag;
                         return;
                     }
-                    // codex R10 (deferred-boot twin of the refresh-lane guard): the Runner was built from the ENV plane before
-                    // this late arrival — if it froze a tier-expanded copy, the arriving center plane must not hot-apply
-                    // (admission/Runner split). Tier-less env boot (the common deferred-boot shape) keeps true hot-apply.
-                    // core 5.49 swapModels 在场 ⇒ 该守卫与正常 tick 腿(:936)同判据退役:候选面经 swapPlane 在
-                    // commit 前原子换进全部 boot Runner,admission/Runner split 不复存在。合并窗重扫 high(V2
-                    // 同能力多腿修一漏一现行犯):换装批只接了 tick 腿,这条迟到 boot 腿漏接 ⇒ 生产恒接
-                    // swapRunnerModels 的部署在 env 起服+首拉过窗时,plane 仍被整面 defer + 误签 restart。
                     const planeChangedLate = modelPlaneChanged(appliedPlaneEff, r.effective);
                     const planeDeferredLate = swapRunnerModels === undefined && (runnerTierFrozen || planeHasActiveTiers(r.effective)) && planeChangedLate;
                     let applyReportLate;
@@ -1165,13 +681,11 @@ export async function createConfigCenterRuntime(ctx) {
                         ...(planeDeferredLate ? { deferModelPlane: true } : {}),
                         ...(swapRunnerModels !== undefined && planeChangedLate ? { swapPlane: swapRunnerModels } : {}),
                     });
-                    // [2283]③(refresh 腿同款):CAS 拒绝 ⇒ 迟到 boot 拍整体跳过,旁路消费与 etag/LKG 都不动。
                     if (!committedLate)
                         return;
-                    // #303 R1-F2 的 late-boot 双胞胎(同一形,只修一条=另一条继续漏):派生两件紧贴 commit,零 await。
                     mutateInPlace(pricing, buildPricing(config.models));
                     keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
-                    limitSync?.sync(); // #322 批1(late-boot 双胞胎:只修一条腿 = 另一条继续漏)
+                    limitSync?.sync();
                     applyLedger.applied(lateGen, r.effective.version);
                     if (planeDeferredLate)
                         logger.warn("models_tiers_plane_deferred", { version: r.effective.version, note: "tier-frozen Runner (env tiers): the late-boot center model plane is NOT hot-applied — restart applies it" });
@@ -1181,9 +695,7 @@ export async function createConfigCenterRuntime(ctx) {
                     }
                     await adoptCenterPrompts(r.effective, "boot-deferred");
                     if (!planeDeferredLate)
-                        markRosterLanded(r.effective); // codex R13: same guard as the refresh lane — never open readiness off an unapplied plane
-                    // (pricing/keyResolver 的重建已上提到 commit 紧邻处 —— 见上方 #303 R1-F2 注)
-                    // codex R2-F1 的 late-boot 双胞胎(只修一条腿 = 另一条继续漏)。
+                        markRosterLanded(r.effective);
                     const fullyAppliedLate = applyReportLate?.fullyApplied !== false;
                     if (!fullyAppliedLate) {
                         logger.warn("config_candidate_partially_applied", {
@@ -1193,28 +705,16 @@ export async function createConfigCenterRuntime(ctx) {
                         });
                         return;
                     }
-                    effective = r.effective; // restart 比较基线=到货值(cadence 不再重复触发)
+                    effective = r.effective;
                     latestEffective = r.effective;
                     ccEtag = r.etag;
-                    const lkgPersistedLate = await persistLkgDurable(r.effective, r.etag); // F2 parity:信号可见前落盘+skill 正文预热
-                    const reasons = restartReasons(undefined, r.effective, restartCtx()); // (prompts 不在 restart slices——热采用已在上方 adopt)
-                    // swapModels 接缝在场 ⇒ models-tiers 摘除(:1007 正常 tick 腿同形同理由):能走到这一行的候选,
-                    // 模型面已本拍 swap 进全部 Runner(swap 拒绝在 committedLate === false 早退)——env 基线对候选的
-                    // 指纹差异不再是重启理由;degrade-route 不跟(brain 壳 boot 期捕获,swap 不重组)。
+                    const lkgPersistedLate = await persistLkgDurable(r.effective, r.etag);
+                    const reasons = restartReasons(undefined, r.effective, restartCtx());
                     if (swapRunnerModels !== undefined) {
                         const miLate = reasons.indexOf("models-tiers");
                         if (miLate >= 0)
                             reasons.splice(miLate, 1);
                     }
-                    // codex R15 (late-boot twin): tiered env boot + tier-less late candidate ⇒ deferral fires but BOTH slice
-                    // fingerprints reduce to null (undefined baseline, tier-less candidate) — no models-tiers reason, plane
-                    // deferred forever. Deferral is the ground truth; force the reason so the orchestrator restarts and the
-                    // next process lands the candidate at boot. codex R16: forced ONLY with a confirmed LKG handoff — without
-                    // it the restarted process re-enters this exact lane (env plane, late candidate) = restart storm; keep
-                    // serving the old generation and warn instead.
-                    // codex R19 (late-boot twin): handoff status decides, regardless of whether change-detection already
-                    // produced the reason — an active-tier candidate over an env boot deterministically carries models-tiers
-                    // from restartReasons(undefined, candidate), and letting it through with no handoff is the R16 storm.
                     if (planeDeferredLate) {
                         if (lkgPersistedLate) {
                             if (!reasons.includes("models-tiers"))
@@ -1222,16 +722,12 @@ export async function createConfigCenterRuntime(ctx) {
                             planeDeferredNoHandoff = undefined;
                         }
                         else {
-                            // codex R22 (late-boot twin): withhold the WHOLE signal — co-occurring skills/mcp reasons would
-                            // restart into the same over-budget/no-LKG lane and loop.
                             const blocked = reasons.splice(0, reasons.length);
                             planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), ...(blocked.length > 0 ? { blocked } : {}), planeDeferred: true, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
                             logger.warn("models_tiers_deferred_no_handoff", { version: r.effective.version, blockedReasons: blocked, note: "late-boot plane deferred but no NEXT-BOOT handoff (see CONFIG_LKG_DURABLE) — the WHOLE restart signal is withheld (it would loop); old generation keeps serving" });
                         }
                     }
                     else if (planeDeferredLate === false && lkgSurvivesRestart && !lkgPersistedLate) {
-                        // codex R31 (late-boot twin): retain failed publications even with zero restart reasons.
-                        // codex R27 (late-boot twin): durable-declared + incomplete publication ⇒ retain + withhold + retry.
                         const blocked = reasons.splice(0, reasons.length);
                         planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), blocked, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
                         logger.warn("restart_candidate_publication_incomplete", { version: r.effective.version, blockedReasons: blocked, note: "late-boot candidate publication incomplete on a durable-declared deployment — restart signal withheld; retried every tick" });
@@ -1240,15 +736,11 @@ export async function createConfigCenterRuntime(ctx) {
                         pendingRestart = { restartRequired: true, reasons, version: r.effective.version, since: Date.now() };
                     logger.info("config_loaded_deferred", { source: configProvider.kind, version: r.effective.version, models: (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length, ...(reasons.length > 0 ? { restartRequired: true, restartReasons: reasons } : {}) });
                 };
-                // LKG 起服的进程有完整 boot 基线 → 到货走普通 tick(候选门+hot+对 LKG 的 restartReasons,通常
-                // 零差异=无信号无环);env 起服(无 LKG)才走「迟到 boot」路径。
-                // 迟到 boot 的续接也走 runTick(同一只拍;手动口若正好在飞,这条会 join 它而不是并发跑第二拍)。
                 if (bootConfigPending)
                     void bootConfigPending.then((r) => void (lkgBooted ? runTick(r) : deferredBootApply(r)), () => { });
             }
         },
         stopRefreshLoop() {
-            // #131-2:hardShutdown 收尾链——停机中途不再热应用配置(幂等;env 部署没起环时是 no-op)。
             if (ccTimer !== undefined) {
                 clearInterval(ccTimer);
                 ccTimer = undefined;