@sema-agent/server 7.43.0 → 7.44.0

package/dist/config-center/apply-effective.js

@@ -1,10 +1,3 @@
-/**
- * EffectiveConfig application — mutate the boot `ServiceConfig` OVER with a pulled `EffectiveConfig`
- * (models/roles/tiers/projects `applyEffective`, the 6 runtime gates `applyRuntimeGates`, the per-request-hot
- * governance baton `applyRuntimeHot`) plus their shared helpers (`toModel`, `mutateInPlace`,
- * `resolveDefaultModelName`, `logEffectiveDiff`, `runtimeHasActiveGate`). Split out of `facade.ts`
- * (design/158 A13, internal-lossless — the facade re-exports every symbol below unchanged).
- */
 import { isThinkingLevel } from "@sema-agent/core";
 import { resolveActiveTiers, SEALED_BOX_ALG } from "@sema-agent/registry-core";
 import { sealedKeyPoison } from "../sealed-key.js";
@@ -15,11 +8,8 @@ import { registerTeams } from "../capabilities/team.js";
 import { stageLimits } from "./stage-limits.js";
 import { BATCH1_LIMIT_KEYS } from "./hot-keys-registry.js";
 const asModelThinking = (v) => (v && isThinkingLevel(v) && v !== "off" ? v : undefined);
-/** design/123: accept only a positive finite roster charsPerToken (fail-safe to env default / core 4). */
 const charsPerTokenOf = (v) => (typeof v === "number" && Number.isFinite(v) && v > 0 ? v : undefined);
 function toModel(m, envDefaults = {}) {
-    // design/111 L2②: a center model MAY declare defaultThinking/reasoningEffortLevels; absent → inherit the env-derived
-    // model's values (BL-8 — same class as reasoning/contextWindow/maxTokens, else a roster silently drops the env default).
     const thinkingDefault = asModelThinking(m.defaultThinking) ?? envDefaults.defaultThinking;
     const effortLevels = (m.reasoningEffortLevels ? m.reasoningEffortLevels.map(asModelThinking).filter((x) => x !== undefined) : undefined) ?? envDefaults.reasoningEffortLevels ?? [];
     const model = {
@@ -27,102 +17,35 @@ function toModel(m, envDefaults = {}) {
         name: m.name,
         provider: m.provider,
         api: m.api,
-        // 实机 /model 切换 404 定谳: a catalog model MAY carry its own gateway URL — the
-        // hardcoded "" made core's brain fall back to the boot-env endpoint, so cross-endpoint `body.model`
-        // selection hit the WRONG gateway (a model id routed to a gateway that does not serve it → 404).
-        // Absent still = "" (brain env default;
-        // byte-compat for single-gateway rosters). core brain honors model.baseUrl; keys stay per-model via apiKeyEnv.
         baseUrl: m.baseUrl ?? "",
-        // BL-8 extended (systematic-audit): fall back to the ENV-derived model's reasoning, not Boolean(undefined)=false —
-        // else a center roster that omits `reasoning` SILENTLY disables it even though the env lane defaults it ON
-        // (config.ts MODEL_REASONING="true"). A center model MAY set false to override. Same class as contextWindow/maxTokens.
         reasoning: m.reasoning !== undefined ? Boolean(m.reasoning) : (envDefaults.reasoning ?? true),
         input: m.vision ? ["text", "image"] : ["text"],
-        // BL-8: fall back to the ENV-derived model's value (MODEL_CONTEXT_WINDOW / MODEL_MAX_TOKENS), not a
-        // hardcoded literal — else a center roster that replaces the env model SILENTLY clamps maxTokens to 4096
-        // (the prod review-gw runs deepseek at 32000), shrinking every response. A center model MAY still set its
-        // own value to override. (ROBUSTNESS-BACKLOG:28 / BL-8.)
         contextWindow: m.contextWindow ?? envDefaults.contextWindow ?? 262144,
         maxTokens: m.maxTokens ?? envDefaults.maxTokens ?? 4096,
-        // design/123 D2 (BL-8 class): center override ?? env default (MODEL_CHARS_PER_TOKEN) ?? omit = core 4.
-        // Positive-finite guard mirrors the env lane — a bad roster value must not zero structural estimates.
         ...(charsPerTokenOf(m.charsPerToken) !== undefined || envDefaults.charsPerToken !== undefined
             ? { charsPerToken: charsPerTokenOf(m.charsPerToken) ?? envDefaults.charsPerToken }
             : {}),
         cost: m.cost
             ? { input: m.cost.input, output: m.cost.output, cacheRead: m.cost.cacheRead ?? 0, cacheWrite: m.cost.cacheWrite ?? 0 }
             : { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-        // Explicit cache family by provider (core 1.23) — same as the env path in config.ts. Anthropic brain
-        // reports input EXCLUDING cached; the openai gateway INCLUDES it (design/18).
         params: { ...(m.tier ? { tier: m.tier } : {}), promptCacheFamily: m.provider === "anthropic" ? "input-excludes-cached" : "input-includes-cached" },
-        // design/111 L2②: per-model default thinking + endpoint-accepted tiers (center override ?? env default, BL-8).
         ...(thinkingDefault ? { defaultThinking: thinkingDefault } : {}),
         ...(effortLevels.length > 0 && m.provider !== "anthropic" ? { compat: { reasoningEffortLevels: effortLevels } } : {}),
-        // Generation tuning (1.60) carried verbatim — without this a center roster that replaces the env model
-        // would silently drop the degenerate-looping prevention (freq/pres penalties). Absent → unchanged.
         ...(m.extraBody ? { extraBody: m.extraBody } : {}),
-        // Per-model behavior-slot sentences ([998]⑤c consumer half) — verbatim, same posture as extraBody.
         ...(Array.isArray(m.promptGuidance) && m.promptGuidance.length > 0 ? { promptGuidance: m.promptGuidance.map(String) } : {}),
     };
-    // [818]①/A-065 P2-6 1M dual-window: an explicit roster `autoCompactTokens` (structural, like tier
-    // passthroughs) wins; else the model-id table (sonnet-5 family ∧ >=1M ⇒ 967000 — CC ships that value
-    // per-model, not per window width; see applyAutoCompactWindow header); else absent. A non-sonnet 1M roster
-    // model gets NO implicit value — roster culture is explicit declaration. Same helper as the env lane.
     const explicitAct = m.autoCompactTokens;
     applyAutoCompactWindow(model, typeof explicitAct === "number" ? explicitAct : undefined);
     return model;
 }
-/** Apply center config OVER the env-derived config (mutates `config`). Empty domains keep env defaults. */
-/** Replace a record's contents IN PLACE (clear keys, copy source) so holders of the SAME reference see the
- *  change. This is what makes models/roles/pricing HOT-apply: core's Runner reads
- *  `this.deps.models/roles/pricing` LIVE per-task and `/v1/models` reads `config.models` — both share the
- *  reference captured at boot, so mutating it (vs reassigning) updates both with no split, no Runner rebuild. */
 export function mutateInPlace(target, source) {
     for (const k of Object.keys(target))
         delete target[k];
     Object.assign(target, source);
 }
-/** 每个 config 对象上一次 COMMIT 的世代号([2283]③ CAS 的 live 端)。WeakMap——config 回收即回收;
- *  version 0(未发布/本地一次性 lane)不参与登记。 */
 const appliedGeneration = new WeakMap();
-/** [2311]/[2314] 裁①:env 派生 roles 基线(首次进入模型面 apply 时快照,冻结拷贝)。roles 的 file/center
- *  lane 语义=**逐键 override,env 基线为底,非粘**——上游(registry-core resolveEffectiveForWorker)本就是
- *  逐键 merge 链;整表替换会让低信任写者(center 编辑面)静默抹掉 operator 的 env 部署契约(MODEL_VERIFIER
- *  反自评等),且旧守卫 `length>0` 粘住的不是 env 底而是**上一个 center 世代**(applyRuntimeHot 头注
- *  NON-STICKY 论证同族,roles 曾漏在纪律外——cli [2311] 实测「用户撤销被静默吞掉」即此)。 */
 const envRolesBaseline = new WeakMap();
-/**
- * #233 / A-002.8 —— 无法解读的名单条目的**代表元**。
- *
- * 为什么需要它(codex 复审 R1 真 finding):把坏条目**丢掉**会让 `[7, null]` 这种「在场但一条都读不
- * 懂」的名单塌成**空数组**,而空数组在消费端的语义恰恰是「治理关闭 = 全放行」—— 一个表达"我要限制"
- * 的配置,因为写错了类型,反而把门整个打开。方向必须反过来:名单在场 = operator 意图限制;读不懂的
- * 条目 ⇒ 换成一个**永不可能是 catalog name** 的代表元(前导 NUL,registry-core 的 name 词法不可能产
- * 出),于是它在归一时解不到任何目录条目 ⇒ 谁都准不了。
- *
- * 后果是**有界的**:被拒的只有「用户逐 turn 显式点模型」这一件事;`default` / roles / 档位表照常,
- * 任务照跑。写错配置的代价是"点不了模型"而不是"服务不可用",且 warn 当场点名成因。
- * 🔴 只活在内存判定面:不进 wire(`/v1/models` 只发布尔)、不进日志(warn 打的是原始坏值的类型标记)。
- */
 export const UNPARSABLE_AT_MODEL_ALLOWLIST_ENTRY = "\u0000<unparsable-at-model-allowlist-entry>";
-/**
- * #233 / A-002.8 —— `models.atModelAllowlist` 的 STAGE 侧归一(纯函数,可抛的事都不做)。
- *
- * 语义(registry-core `ModelsDomain.atModelAllowlist` 的 JSDoc 同源):**缺席/空 = 全放行**。返回值恒是
- * 一个新数组,调用点每次 apply 整表重算 ⇒ **非粘**。
- *
- * ⚠️ 入参刻意收 `unknown`:`EffectiveConfig` 把它声明成 `string[]`,但 **local lane 的 eff 来自
- * `FileConfigStore` 的原始 JSON**(不是 zod 输出),类型在那条腿上不是运行时保证。
- *
- * 坏形处置(不静默,三条各有一句;共同的方向 = **在场即意图限制,读不懂就更严不更松**):
- *  - 字段在场但**不是数组** ⇒ 响亮 warn + 落**一条代表元**(见上)= 用户逐 turn 选择全拒。刻意不按
- *    "缺席"处置:那会把一个写坏了的**限制**声明翻译成"不限制",正是治理轴上最不该有的失败方向。
- *    也刻意不整代拒绝:那会把整个模型面(models/roles/tiers/密钥)一起拖下水,爆炸半径不成比例。
- *  - 数组里的**非串/空串**成员 ⇒ **逐条换成代表元**(不是丢弃)+ warn:名单只会更窄,不会更宽。
- *  - 成员名**不在本世代启用目录里**(悬空 ref)⇒ warn(照 `sema_registry_default_dangling` 先例)。
- *    保留原串:悬空成员在消费侧本就归一不到任何条目;留声必须有——名单整条悬空时"谁都点不了"是
- *    fail-closed 的真后果,运维要能一眼看见成因。
- */
 function stageAtModelAllowlist(raw, models, logger) {
     if (raw === undefined || raw === null)
         return [];
@@ -160,24 +83,12 @@ function stageAtModelAllowlist(raw, models, logger) {
 }
 export function applyEffective(config, eff, logger, opts = {}) {
     const staged = stageEffective(config, eff, logger, opts);
-    // #325(test [4809]):CAS 的序轴=**收货序数**(opts.generation,config-center 收货处铸的进程内
-    // 单调 ordinal),不再是 source version——local 腿的 version 是内容哈希(registry-core file-store
-    // getVersion(),上游只承诺「同 files⇒同 number」,无序承诺),按它比序会把哈希更小的合法新代
-    // 永久静默拒掉。generation 缺席(单元测试/一次性 lane)退回 version:既有单调 version 语义不变。
     const gen = opts.generation ?? staged.version;
     const live = appliedGeneration.get(config);
     if (staged.version > 0 && live !== undefined && gen < live) {
-        // [2283]③:两次拉取的 staging 并发/乱序完成时,慢的旧世代不得整体覆盖快的新世代——每次都是
-        // 「整世代」,但方向反了。拒绝必须留痕(C6);caller 的 etag 纪律本就只在 apply 成功后推进,
-        // 下一拍拉到的自然是更新的世代。等版本重放(etag 未推进的幂等重放,同 ordinal)照常放行。
         logger?.warn("sema_registry_stale_generation_refused", { staged: staged.version, stagedOrdinal: gen, live, note: "an older staged generation must not overwrite a newer committed one — refused whole; next poll replays" });
         return false;
     }
-    // core 5.49 `Runner.swapModels` 换装腿([4775]①,defer 臂退役):caller 传入 swapPlane 时,staged
-    // 模型面在 COMMIT 之前先喂给全部 boot Runner 原子换代——swap 自己 expandTiers 验证候选,抛=原代
-    // byte-identical 不动 ⇒ 这里按候选整拒处理(与 CAS 拒同一 false 臂:活配置零触碰、etag 不进、
-    // 下一拍原样重判,中心修好即自愈)。先 swap 后 commit 的次序是硬约束:反过来 commit 先落,swap 再
-    // 抛,admission(config.models)已在新代而执行(Runner 私有目录)还在旧代——正是 R10 封掉的分裂窗。
     if (staged.modelPlane !== undefined && opts.swapPlane !== undefined) {
         try {
             opts.swapPlane({ models: staged.modelPlane.models, tiers: staged.modelPlane.activeTiers });
@@ -193,9 +104,7 @@ export function applyEffective(config, eff, logger, opts = {}) {
     }
     commitStaged(config, staged);
     if (staged.version > 0)
-        appliedGeneration.set(config, gen); // #325:CAS 的 live 端=收货序数
-    // ── post-commit notifications(全部世代描述性通知在最后一笔赋值之后,[2283]②)──
-    // #322 世代账:apply 报告也是「世代描述性通知」⇒ 同样在 commit 之后发(commit 段零回调纪律不破)。
+        appliedGeneration.set(config, gen);
     opts.report?.({
         version: staged.version,
         ...(opts.generation !== undefined ? { ordinal: opts.generation } : {}),
@@ -224,34 +133,22 @@ export function applyEffective(config, eff, logger, opts = {}) {
         logger?.info("sema_registry_projects", { projects: Object.keys(staged.projects) });
     return true;
 }
-/** COMMIT 段:纯赋值,零 await/零回调/零发射(源码钉守着——[2283]①②)。mutateInPlace/整对象重赋值/
- *  registry 表整体换装(registerTeams/registerCollabWorkflows 皆为过滤+swap 的赋值形,无回调面)。 */
 function commitStaged(config, staged) {
     const mp = staged.modelPlane;
     if (mp) {
-        config.modelApiKeyEnv = mp.modelApiKeyEnv; // reassign ok — keyResolver is rebuilt from it on refresh (main.ts)
-        config.modelApiKeys = mp.modelApiKeys; // plaintext values — memory-only; poison markers ride the same map
+        config.modelApiKeyEnv = mp.modelApiKeyEnv;
+        config.modelApiKeys = mp.modelApiKeys;
         mutateInPlace(config.modelQuotaWeights, mp.quotaWeights);
-        mutateInPlace(config.models, mp.models); // IN PLACE: keep the ref the Runner + /v1/models share (hot-apply)
+        mutateInPlace(config.models, mp.models);
         config.model = config.models.default;
-        mutateInPlace(config.roles, mp.roles); // IN PLACE: Runner reads this.deps.roles live([2314] 裁①:staged roles 已是 env 底+center 逐键 merge 的整表,无条件落——旧 `length>0` 守卫=空表粘住上一 center 世代)
+        mutateInPlace(config.roles, mp.roles);
         mutateInPlace(config.tiers, mp.activeTiers);
-        // #233:整表重赋值(不是 mutateInPlace)—— 本键的全部消费点(resolveSpec / side-query / GET /v1/models /
-        // 未知模型 400 的 available)都是**逐请求**从 `config` 上读,没有任何一处在 boot 期捕获这个数组本身
-        // (与 `config.modelApiKeyEnv` 的 "reassign ok" 同判据)。非粘由 stage 侧整表重算保证。
-        // 🔴 刻意与整个模型面**同生共死**(在 `if (mp)` 里,不在外面):名单说的是"这本目录里哪些可点",
-        // 所以它必须与它描述的那本目录同世代。plane 被跳过时(deferModelPlane 的 tier-frozen 窗口 /
-        // 本世代零启用模型 ⇒ 目录仍是上一世代或 env 底),名单跟着一起停在同一世代——把新名单配到旧目录上
-        // 才是真正的错配(按新名字判旧目录 = 全员悬空 = 谁都点不了)。
         config.atModelAllowlist = mp.atModelAllowlist;
     }
     if (staged.gateAssignments) {
         for (const [k, v] of staged.gateAssignments)
             config[k] = v;
     }
-    // #322 批1:limitsHttp 组的整批赋值(stage 已保证「要么全在、要么全空」)。缺席基线的键**删**而不是
-    // 写 undefined —— 本仓的 presence-as-semantics 判定(`"k" in config`)只打平铺面,写 undefined 会让
-    // 「center 撤键回默认」看起来像「显式设成 undefined」。
     for (const [k, v] of staged.limits.assignments)
         config[k] = v;
     for (const k of staged.limits.deletions)
@@ -265,47 +162,23 @@ function commitStaged(config, staged) {
         registerTeams(tp.teams);
         registerCollabWorkflows(tp.workflows);
     }
-    mutateInPlace(config.projects, staged.projects); // IN PLACE: keep the ref per-request consumers captured at boot
-    // 世代登记在 applyEffective 内做(#325:登记的是收货序数 gen,不是 source version)。
+    mutateInPlace(config.projects, staged.projects);
 }
-/** STAGE 段:一切计算/校验/解封/投影(可抛;抛=候选整体拒绝,活配置零触碰)。内容判定性 warn/error
- *  (描述 eff 真伪,与是否 commit 无关)在此发;世代描述性 info 只装载荷,post-commit 发。 */
 function stageEffective(config, eff, logger, opts) {
-    // version 0 / empty effective = the config-center has nothing for us yet — typically CONFIG_PUBLISH_MODE
-    // is ON but nothing has been published. We do NOT wipe: models/roles fall back to env (the enabled>0
-    // guard below), teams to BUILTIN_TEAMS (registerTeams resets to built-ins). Warn once at boot so the
-    // operator knows their config isn't live (publish a version, or disable the publish gate). See the
-    // config-center's ORCHESTRATOR-REVIEW §④ publish-gate contract.
     if (!opts.teamsOnly && !eff.version) {
         logger?.warn("sema_registry_unpublished", {
             version: eff.version,
             note: "empty/unpublished effective config — using env + built-in fallback; publish a config or unset CONFIG_PUBLISH_MODE",
         });
     }
-    // models/roles HOT-apply on BOTH boot and refresh (TOC "save = effective"). We MUTATE
-    // config.models/roles IN PLACE (mutateInPlace) — NOT reassign — so the live Runner (reads `this.deps.models/
-    // roles` per-task by reference) and `/v1/models` (reads config.models) share the one updated object with NO
-    // split, no Runner rebuild, no core change. Caller (main.ts refresh) additionally refreshes `pricing` (same
-    // ref) + rebuilds `keyResolver`. (Was startup-only when reassignment split the Runner's ref from config.)
     const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
     let modelPlane;
-    // codex R10: `deferModelPlane` skips the WHOLE model plane (models/roles/tiers + per-model keys) — main.ts
-    // sets it when the Runner is tier-frozen (private expanded copy) and the plane changed: hot-applying would
-    // split admission (/v1/models, catalog gates) from the Runner's frozen generation, letting a same-key retarget
-    // silently route/bill the stale Model object through the restart window. Deferred = live plane stays on the
-    // Runner's generation; the models-tiers restart slice signals the orchestrator; the restarted process applies
-    // the new plane at boot BEFORE Runner construction. Caller logs the deferral (never silent).
     if (enabled.length > 0 && opts.deferModelPlane !== true) {
         const models = {};
         const modelApiKeyEnv = {};
-        const modelApiKeys = {}; // sealed-box 解封明文(内存-only,绝不日志/落盘)或毒丸标记(解封失败,见下)
-        // Capture the env-derived model's generation bounds BEFORE the loop overwrites config.model (line below):
-        // a center model that omits maxTokens/contextWindow inherits the operator's env values, not a literal (BL-8).
+        const modelApiKeys = {};
         const envDefaults = { maxTokens: config.model.maxTokens, contextWindow: config.model.contextWindow, reasoning: config.model.reasoning, charsPerToken: config.model.charsPerToken, defaultThinking: config.model.defaultThinking, reasoningEffortLevels: config.model.compat?.reasoningEffortLevels };
         for (const m of enabled) {
-            // Guard (since 1.128.0): a registry baseUrl now DIRECTS model traffic (incl. that model's
-            // Authorization key) — a registry editor is a lower-trust writer than the env, so a non-http(s)/unparsable
-            // value is REJECTED back to "" (boot-env gateway) and every honored override is logged (observable routing).
             const rawBaseUrl = m.baseUrl;
             let safeUrl = rawBaseUrl;
             if (rawBaseUrl) {
@@ -325,22 +198,6 @@ function stageEffective(config, eff, logger, opts) {
                 }
             }
             models[m.name] = toModel(safeUrl === rawBaseUrl ? m : { ...m, baseUrl: safeUrl }, envDefaults);
-            // Sealed-box custody (registry-core 0.10.5): a model MAY carry `sealedApiKey` — the
-            // api key pasted in the web UI and sealed BROWSER-SIDE against this host's X25519 public key; the
-            // center stores only the ciphertext. We unseal with the private key registered under the EXACT
-            // `publicKeyId` (no try-every-key scanning — the contract selects precisely) and inject the
-            // plaintext into the in-memory per-model key pipeline (config.modelApiKeys → getApiKeyAndHeaders).
-            // Mutual exclusion (contract): sealed OUTRANKS apiKeyEnv when both are set — and STRICTLY so: a
-            // sealed key that fails to unseal (missing private key / bad base64 / MAC failure) does NOT fall
-            // back to the env-NAME reference. Falling back would turn "the key I pasted isn't live" into a
-            // silent misroute onto some stale env key; we fail LOUD (warn). And since a merely-ABSENT map
-            // entry is indistinguishable from "no per-model key configured" — which with a gateway
-            // MODEL_API_KEY deployed meant the model's tasks silently burned the shared account — a failed
-            // unseal plants a POISON PILL in the map instead of injecting nothing: the key resolver turns it
-            // into a task-level SealedKeyPoisonedError on every brain call (the gateway key is NEVER a silent
-            // fallback for a broken sealed key) until the operator fixes custody and a later apply delivers a
-            // decryptable ciphertext (the rebuild below makes recovery automatic). 🔴 Neither the plaintext
-            // NOR the ciphertext ever reaches a log line or the poison object (write-only discipline).
             if (m.sealedApiKey) {
                 const s = m.sealedApiKey;
                 if (s.alg !== SEALED_BOX_ALG) {
@@ -365,25 +222,16 @@ function stageEffective(config, eff, logger, opts) {
                     }
                 }
             }
-            // Per-model key: center declares the env var NAME (never the secret) holding this model's upstream
-            // key. Drives the spec's getApiKeyAndHeaders so each model authenticates with its own account; the
-            // value is resolved from process.env in THIS service (secrets stay in env, design/15). A model
-            // without apiKeyEnv (or whose env var is unset) falls back to the gateway key — purely additive.
-            // (`else if` on sealedApiKey ABSENCE: a sealed model never consults the env reference — see above.)
             else if (m.apiKeyEnv) {
                 if (process.env[m.apiKeyEnv])
                     modelApiKeyEnv[m.name] = m.apiKeyEnv;
                 else
                     logger?.warn("sema_registry_model_key_env_missing", { model: m.name, apiKeyEnv: m.apiKeyEnv, hint: "env var not set in this service — model falls back to the gateway key" });
             }
-            // A center model whose provider has no matching brain in THIS service's env will mis-route:
-            // createRoutingBrain falls back to the gateway brain. The anthropic route needs ANTHROPIC_API_KEY.
             if (m.provider === "anthropic" && !config.anthropic) {
                 logger?.warn("sema_registry_model_no_brain", { model: m.name, provider: m.provider, hint: "set ANTHROPIC_API_KEY in this service's env, else it mis-routes to the gateway brain" });
             }
         }
-        // weight-at-burn 源:quotaWeight 按 name+id 双键索引(tracer 的 brain.call e.model=模型 id,
-        // 目录键=name——双键免猜);非法值(≤0/NaN)按缺省 1 丢弃。IN PLACE 与 models 同批 hot-apply。
         const quotaWeights = {};
         for (const m of enabled) {
             const qw = typeof m.quotaWeight === "number" && Number.isFinite(m.quotaWeight) && m.quotaWeight > 0 ? m.quotaWeight : undefined;
@@ -393,8 +241,6 @@ function stageEffective(config, eff, logger, opts) {
                     quotaWeights[m.id] = qw;
             }
         }
-        // [2311]/[2314] 裁①:首次进入模型面 apply 时快照 env 派生基线(此刻 config.roles 尚未被任何 center
-        // 世代写过——boot 序=loadConfig→applyEffective;deferModelPlane 跳过的 apply 不进本分支,不污染)。
         if (!envRolesBaseline.has(config))
             envRolesBaseline.set(config, { ...config.roles });
         const centerRoles = {};
@@ -404,25 +250,10 @@ function stageEffective(config, eff, logger, opts) {
             else if ("select" in tgt)
                 centerRoles[role] = { select: tgt.select };
         }
-        // 逐键 override(env 底)+ 非粘:每次 apply 从基线整表重算——center 撤键/发空表 = 该键/整表回 env 底,
-        // 上一世代绝不驻留;center 同名键盖 env(operator 两边都配时 center 编辑面可见可审)。
         const roles = { ...envRolesBaseline.get(config), ...centerRoles };
-        // registry-core 0.9.0: tier groups → the engine's single active tier table. `resolveActiveTiers`
-        // is registry-core's ONE resolution point (active group → its bound tiers; no active / dangling / all-unbound
-        // → undefined = INERT). Values are catalog NAME strings (open, not enum'd); dangling bindings were already
-        // culled center-side. mutateInPlace keeps the reference RunnerDeps.tiers holds — the expansion itself happens
-        // at Runner CONSTRUCTION (core 1.265 expandTiers), so a refresh-time change is restart-to-apply like models.
-        // [2373]B-6:EffectiveConfig.models 已声明 tierGroups/activeTierGroup(types.ts)——旧「CenterModel
-        // doesn't type them」注随宽铸一起退役;resolveActiveTiers 收 registry-core 形,窄化一步即可。
         const activeTiers = resolveActiveTiers(eff.models) ?? {};
-        // [865]①(生产实锤:面板上选了 A 模型,实际跑的是目录里的另一个)显式默认解析——enabled[0] 会被任何改变 pool 顺序的写
-        // 静默翻转,default 必须消费 wire 里已有的显式意图。解析单源 = resolveDefaultModelName(dry-run 的
-        // wouldDefaultModel 共用同一只,报数与真 apply 永不撕裂——codex M2)。
         const picked = resolveDefaultModelName(eff, (n) => models[n] !== undefined, enabled[0].name, (source, name) => logger?.warn("sema_registry_default_dangling", { source, name, hint: "explicit default names a model that is not in the enabled catalog — falling to the next source" }));
         models.default = models[picked.name];
-        // #233 / A-002.8 `@`-mention 允许名单:与 roles 同族的**非粘整表重算**——每次 modelPlane apply 都从
-        // 本世代的 eff 重算,center 撤名单/发空表 ⇒ 本表清空 ⇒ 回「全放行」。粘写法(`length>0` 才写)会让
-        // 上一个 center 世代的名单常驻 = **收不回的治理锁**(roles 那条 [2314] 裁①同族病,不重犯)。
         const atModelAllowlist = stageAtModelAllowlist(eff.models?.atModelAllowlist, models, logger);
         modelPlane = {
             models,
@@ -435,47 +266,21 @@ function stageEffective(config, eff, logger, opts) {
             infoLine: { count: enabled.length, default: models.default.id, defaultSource: picked.source, roles: Object.keys(roles), tiers: Object.keys(activeTiers), atModelAllowlist: atModelAllowlist.length, sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length },
         };
     }
-    // Runtime governance/limit gates (phase-2): STARTUP only (restart-to-apply) — the live RateLimiter / CostQuota
-    // / approval gate are built from `config` AFTER this in main.ts, so mutating it here before they're constructed
-    // is what takes effect; a refresh (teamsOnly) must NOT touch them (the running gates hold their boot values).
-    // governance 切新位:治理三件优先读 governance 域(真值),runtime 旧位(双写镜像)fallback——
-    // 双写期两处逐键相等语义不变;center 撤双写后 governance 即唯一来源。限额残余(rateLimit/cost 五件)仍在 runtime。
     const gatesView = eff.governance ? { ...eff.runtime, ...eff.governance } : eff.runtime;
     const gates = opts.teamsOnly ? undefined : stageRuntimeGates(gatesView, logger);
-    // #322 批1:limitsHttp 组是**热**的 ⇒ 与 hot 二件同姿势,boot 与 refresh 双腿都算(不在 teamsOnly 门内)。
-    // 五个既有闸键因此从 `stageRuntimeGates` 的 boot-only 车道**移出**(RUNTIME_GATE_KEYS 里剩 approvalRequire),
-    // 单一属主:一个键只能有一个写者,否则 boot 一次 refresh 一次的两条腿迟早给出不同答案。
-    // 🔴 `limits` 按**键存在性**透传,不按真值(codex R1-F1 同族):`null`/`0`/`""` 这些畸形值必须原样送到
-    // stage 的判形门上去,truthy 过滤会把它们折成「域缺席」= 静默回 env 底,正是那条 finding 要堵的形。
     const limits = stageLimits(config, { version: typeof eff.version === "number" ? eff.version : 0, ...("limits" in eff ? { limits: eff.limits } : {}), legacyGates: legacyGateValues(eff.runtime) }, logger);
-    // Runtime governance "second baton" (center §10): autonomy + commandPolicy are per-request HOT (read live in
-    // resolveSpec), NOT baked into boot middleware → apply on BOTH boot and refresh (outside the teamsOnly guard) so
-    // they hot-reload. No restart-to-apply signal (they take effect on the next task without a restart).
     const hot = stageRuntimeHot(config, gatesView, logger);
-    // Teams → registry (hot-reloadable; center overrides/extends the built-ins).
-    // codex R11: teams + collab workflows carry MODEL REFERENCES (member.model / workflow model args) — when the
-    // model plane is deferred (tier-frozen Runner, see the deferModelPlane guard above) these faces must defer
-    // WITH it, or a candidate that atomically adds/retargets a model AND updates a team/workflow to reference it
-    // publishes a mixed generation: the new template goes live while config.models/the Runner stay old (a new ref
-    // fails as unknown; a same-name retarget silently executes stale). One catalog generation = one visibility.
     let teamsPlane;
     if (opts.deferModelPlane !== true) {
         const teams = {};
         for (const t of (eff.teams?.teams ?? []).filter((t) => t.enabled !== false)) {
             teams[t.name] = {
                 name: t.name,
-                // F8: honor member.model (core TeamMember.model supports it) — was silently dropped, leaving the
-                // member to fall back to the "team" role instead of the operator's chosen model.
                 members: t.members.map((mm) => ({ role: mm.role, ...(mm.model ? { model: mm.model } : {}), modelRole: mm.modelRole, systemPrompt: mm.systemPrompt })),
                 rounds: t.rounds,
                 synthesizer: t.synthesizer ? { role: t.synthesizer.role, modelRole: t.synthesizer.modelRole, systemPrompt: t.synthesizer.systemPrompt } : undefined,
             };
         }
-        // collab → named-workflow projection(切片 1.5,design/140 统一解;切片① 的
-        // TeamTemplate 投影已整体替换——纪律「别留双路径降级」)。可投影子集翻译成命名 workflow 注册条目
-        // (执行体=core 内置 team-discussion 脚本,center 模板=defaultArgs 合并链第二级;键=collab id,shell
-        // `/team`/LLM 经 Workflow({name}) 调用);子集外整条跳过+结构化上报,绝不静默降级。HOT:boot+refresh
-        // 双腿整表替换(非粘——center 停发即空表,内置 workflow 不受影响)。register* 在 commit 段成对换装。
         const projected = projectCollabToWorkflows(eff.collab?.templates);
         const notices = [];
         if (Object.keys(teams).length > 0)
@@ -488,12 +293,6 @@ function stageEffective(config, eff, logger, opts) {
             notices.push({ level: "info", msg: "sema_registry_collab_notes", fields: { notes: projected.notes } });
         teamsPlane = { teams, workflows: projected.workflows, notices };
     }
-    // 142-S4 projects 域(registry-core 0.10.0):center 项目登记簿 → config.projects(键=
-    // projectId)。消费是 per-request 查表(memoryScope 派生 + defaultScopes 种子,security.ts/main.ts),
-    // 所以 boot+refresh 双腿都 mutateInPlace 热应用(整表替换,非粘——center 停发即清空);env lane 恒空。
-    // [2373]B-8:裸 Record 臂删——registry-core 0.13.0 ProjectsConfig 只有包裹形 `{projects:{...}}`
-    // (types.d.ts:3599,且 :12231 钉进 EffectiveConfig),裸形无 producer(与 Q15 declared 双形容忍同族)。
-    // 防御保留:非 object 条目跳过,字段逐个验型(wire verbatim,不信任形状)。
     const projDomain = eff.projects;
     const rawProjects = (projDomain && typeof projDomain === "object" && !Array.isArray(projDomain) &&
         "projects" in projDomain && typeof projDomain.projects === "object"
@@ -502,7 +301,7 @@ function stageEffective(config, eff, logger, opts) {
     const projects = {};
     for (const [pid, reg] of Object.entries(rawProjects)) {
         if (!reg || typeof reg !== "object" || Array.isArray(reg))
-            continue; // defensive: non-object entry → skip
+            continue;
         const r = reg;
         projects[pid] = {
             ...(typeof r.displayName === "string" ? { displayName: r.displayName } : {}),
@@ -520,38 +319,8 @@ function stageEffective(config, eff, logger, opts) {
         projects,
     };
 }
-/**
- * Apply the center `runtime` governance/limit gates OVER the env-derived config (mutates `config`).
- *
- * UNIFORM presence semantics across all 6 gates (center `f95438a` adopted this from our sentinel flag —
- * SERVICE-INTEGRATION「Runtime 治理/限额闸」): all six fields are center `.optional()`, so
- *   `undefined` = center isn't managing it → KEEP env;
- *   present (any value, INCLUDING an explicit 0 / [] = "publish the gate OFF") → OVERRIDE env.
- * (Earlier center had `rateLimitPerMin`/`approvalRequire` as `.default(0/[])`, which would have let a default
- *  silently disable an env-set gate — we flagged it, center made all six optional, so a plain presence rule is
- *  now both correct and uniform. No sentinel special-casing.)
- *
- * Only guard: `costQuotaWindowSec` must be `> 0` (a 0 window is nonsensical — core divides by it). Center's
- * schema is `.positive()` so it can't send 0; this is belt-and-suspenders.
- *
- * Per-worker overrides ride the per-worker `/effective?worker=` response (center merges WorkerSpec.runtime over
- * the fleet default server-side), so this single "effective beats env" rule already honors per-worker > fleet.
- */
-/** The 6 runtime governance/limit gates, in ONE place (council DRY): the consume loop, the restart-to-apply
- *  signal, and the dry-run diff all derive from this list, so adding a 7th gate is a single edit and can't
- *  silently miss `runtimeHasActiveGate` (which would break the restart-to-apply warning). All six share keys
- *  across `EffectiveConfig["runtime"]` and `ServiceConfig`. Exported (not in the original single-file form) so
- *  the sibling restart-signal module can share the identical key list + presence rule. */
 export const RUNTIME_GATE_KEYS = ["rateLimitPerMin", "approvalRequire", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
-/**
- * #322 批1:六闸里**已转热**的五个(限额族)——它们的属主是 `stage-limits.ts`(boot+refresh 双腿),
- * 所以 boot-only 的闸车道不再写它们,`runtime-gates` 重启片也不再为它们铸重启理由(键是热的却还要求重启
- * = 白白滚动重启整片 fleet)。剩下的 `approvalRequire` 仍是 restart-to-apply,归批2。
- */
 export const HOT_RUNTIME_GATE_KEYS = new Set(BATCH1_LIMIT_KEYS);
-/** Uniform presence rule (center f95438a): a gate is "managed" when the field is present — any number (incl. 0),
- *  or an array for approvalRequire. Sole guard: costQuotaWindowSec must be > 0 (a 0 window is nonsensical — core
- *  divides by it; center's `.positive()` already enforces, belt-and-suspenders here). */
 export function runtimeGatePresent(rt, key) {
     const v = rt[key];
     if (key === "approvalRequire")
@@ -560,42 +329,17 @@ export function runtimeGatePresent(rt, key) {
         return typeof v === "number" && v > 0;
     return typeof v === "number";
 }
-/**
- * A1:中心下发的 `approvalRequire` 名单**按 env 腿同款判据**验过再落配。此前只验 `Array.isArray` 就逐字
- * 落配——含退役工具名(`bash`/`Task`/`KillShell`)或 pre-prefix/不完整 MCP 名(`figma__x`/`mcp__figma`)时
- * 该名单项永不匹配任何现役工具,审批门静默失守,而同一拼法从 env 腿(`APPROVAL_REQUIRE`)进来是 boot 拒启
- * ——两腿判据不对称,写配置的人无从知道自己踩的是哪一条。判据单点=config.ts `findUnmatchableToolNames`。
- *
- * 处置形照本文件既有的域级拒绝先例(`commandPolicy` 非法 ⇒ fail-loud + 保留前值):常驻进程不能因为一次
- * 坏发布 crash,所以**只拒这一个域**(其余五闸照常应用)、保留前值、留一条响亮 warn。「半应用一个被静默
- * 削弱的门」才是要堵的那种失败。
- *
- * 顺带 C1-2:数组项 trim + 去空串,与 env csv 归一(`csv()` 的 `.map(trim).filter(Boolean)`)一致——
- * 否则 `" Bash "` 从中心腿进来会是个永不匹配的名字,正是本条要消灭的那类静默失效。
- *
- * ⚠️ codex R1(#186 同批复审):**形错必须拒域,不能折成 `[]`**。旧实现先按 `typeof === "string"` 过滤再验
- * 判据,于是 `[123]`(非串项)与 `"Bash"`(整个不是数组)双双归约成空名单、判据自然干净 ⇒ 被当作「运维
- * 显式把闸关掉」落配,把前值换成空门且**零告警**。方向与 A1 相反(A1 是门空转,这条是门蒸发),但同属本域
- * 要堵的失败,且在安全轴上是静默 fail-open。判据分家:**空串/纯空白仍丢弃**(C1-2 的 env csv 归一,env 腿
- * 产不出非串项),**非串项 / 非数组=形错 ⇒ 拒整域保前值**;显式 `[]` 依旧是合法的「闸关掉」。
- */
 function stageApprovalRequire(raw, logger) {
-    // `kept` 逐臂说真话:内容臂的后果是「门空转」,形错臂的后果是「门蒸发」——两句不能混用。
     const refuse = (detail, names, kept) => {
         logger?.warn("sema_registry_approval_require_invalid", { detail, names: [...names], kept });
         return {};
     };
     const KEPT_WOULD_MATCH_NOTHING = "the prior approvalRequire is unchanged — the published list would have silently matched nothing";
     const KEPT_WOULD_REMOVE_GATE = "the prior approvalRequire is unchanged — coercing this malformed value would have silently REMOVED the approval gate";
-    // 形错门(codex R1),先于内容判据:此处**不能**静默归一,归一的结果恰好是「空门」。
-    // 非数组一支是**纵深防御**:唯一调用点先过 `runtimeGatePresent`(判 `Array.isArray`),非数组在那里就按
-    // 「缺席」跳过、保前值——已是 fail-safe。本函数签名收 `unknown`,所以自己也把这一形收口,免得 present
-    // 判据日后放宽时非数组悄悄掉进下面的归一腿(测试两支都钉了)。
     if (!Array.isArray(raw)) {
         return refuse(`published runtime.approvalRequire must be an ARRAY of whole tool names — got ${raw === null ? "null" : typeof raw}. ` +
             `Refusing the domain instead of coercing it: an empty list means "no approval gate", so coercing a malformed value would SILENTLY remove the gate.`, [], KEPT_WOULD_REMOVE_GATE);
     }
-    // 逐项报**下标 + 实际类型**(运维要能在发布件里定位到那一项;只报个数无法行动)。
     const nonString = raw
         .map((n, i) => (typeof n === "string" ? undefined : { i, t: n === null ? "null" : typeof n }))
         .filter((e) => e !== undefined);
@@ -604,7 +348,6 @@ function stageApprovalRequire(raw, logger) {
             `(${nonString.map((e) => `[${e.i}]:${e.t}`).join(", ")}) — every entry must be a whole tool name string. ` +
             `Refusing the domain instead of dropping them: dropping every entry would SILENTLY remove the approval gate.`, nonString.map((e) => `[${e.i}]`), KEPT_WOULD_REMOVE_GATE);
     }
-    // wire verbatim ⇒ 空串/纯空白按 env csv 归一丢弃(C1-2);元素形状已在上面的形错门收口。
     const names = raw.filter((n) => typeof n === "string").map((n) => n.trim()).filter((n) => n.length > 0);
     const bad = findUnmatchableToolNames(names);
     if (bad.length > 0) {
@@ -612,8 +355,6 @@ function stageApprovalRequire(raw, logger) {
     }
     return { value: names };
 }
-/** [2283] stage 半场:六闸的赋值清单(纯计算,零变异)。commit 段照单赋值,通知载荷 post-commit 发。
- *  A1 的名单校验是**内容判定**(描述 eff 的真伪,与是否 commit 无关)⇒ 与 commandPolicy 同,stage 期发 warn。 */
 function stageRuntimeGates(rt, logger) {
     if (!rt)
         return { assignments: [] };
@@ -621,24 +362,22 @@ function stageRuntimeGates(rt, logger) {
     const applied = {};
     for (const key of RUNTIME_GATE_KEYS) {
         if (HOT_RUNTIME_GATE_KEYS.has(key))
-            continue; // #322 批1:属主已移交 stage-limits(热腿),一个键只许一个写者
+            continue;
         if (!runtimeGatePresent(rt, key))
-            continue; // undefined / sentinel → keep env
+            continue;
         if (key === "approvalRequire") {
             const staged = stageApprovalRequire(rt[key], logger);
             if (staged.value === undefined)
-                continue; // 判据未过 ⇒ 只拒该域,保留前值(其余闸不受牵连)
+                continue;
             assignments.push([key, staged.value]);
             applied[key] = staged.value;
             continue;
         }
-        assignments.push([key, rt[key]]); // present (incl. explicit 0/[]) → override
+        assignments.push([key, rt[key]]);
         applied[key] = rt[key];
     }
     return { assignments, ...(Object.keys(applied).length > 0 ? { info: applied } : {}) };
 }
-/** #322:旧位(`runtime`)里**已过 presence 判据**的限额闸值。判据属主恒是 `runtimeGatePresent`
- *  —— stage-limits 不复刻它,只消费它的产物(两位判据不同的理由见 stage-limits 的 `LimitsSource` 注)。 */
 function legacyGateValues(rt) {
     const out = {};
     if (!rt)
@@ -649,10 +388,6 @@ function legacyGateValues(rt) {
     return out;
 }
 export function applyRuntimeGates(config, rt, logger) {
-    // 独立调用面的兼容壳(测试/外部):stage → 就地赋值 → 通知。applyEffective 不走这里——它把
-    // assignments 并进自己的 commit 段以保住整世代原子性([2283]②)。
-    // #322:限额五闸的属主已移交热腿,所以本壳**同样**要过 stage-limits —— 否则一个仍叫 applyRuntimeGates
-    // 的函数会静默漏掉六个键里的五个(比改名更坏的那种沉默)。
     const s = stageRuntimeGates(rt, logger);
     for (const [k, v] of s.assignments)
         config[k] = v;
@@ -665,37 +400,13 @@ export function applyRuntimeGates(config, rt, logger) {
     if (Object.keys(info).length > 0)
         logger?.info("sema_registry_runtime", info);
 }
-/**
- * Apply the runtime governance "second baton" (center §10): `autonomy` + `commandPolicy`. UNLIKE the 6 gates in
- * {@link applyRuntimeGates}, these are per-request HOT (read live in main.ts `resolveSpec` via
- * `applyRuntimeGovernance`), so they apply on BOTH boot and refresh (NOT via RUNTIME_GATE_KEYS / restart-to-apply).
- *
- * 🔴 NON-STICKY (differs from the restart-to-apply gates on purpose — adversarial-review HIGH): a hot field that
- * center STOPS publishing must REVERT to the env baseline, not keep the last center value. The restart-to-apply
- * gates can be sticky because a refresh never touches them (the running middleware holds boot values until a
- * restart re-reads env+center); a HOT field has no such reset, so "absent ⇒ keep" would silently freeze a stale
- * center override (e.g. center published `auto`, then un-published it — the gate would stay OFF forever). So we
- * recompute every call as `present ? center : envBaseline`. The env baseline = `AUTONOMY` (re-derived, env is
- * immutable at runtime) for autonomy; `undefined` (no env scalar source) for commandPolicy.
- *
- * 🔴 commandPolicy is VALIDATED here (adversarial-review HIGH): an invalid command (glob/path/operator — which
- * core's EXACT-name matcher would silently never match → a hole) is rejected FAIL-LOUD and the prior good policy
- * is KEPT (a broken publish never half-applies a silently-weakened gate).
- */
-/** [2283] stage 半场:hot 二件的赋值决定(计算+校验;`sema_registry_commandpolicy_invalid` 是内容判定,
- *  stage 期发——它描述 eff 的真伪,与是否 commit 无关)。对比基准=stage 时刻的 config 现值:stage 与
- *  commit 同一同步 tick,期间无人能改 config(单线程),对比不失效。 */
 function stageRuntimeHot(config, rt, logger) {
     const infoLine = {};
-    // autonomy: present ⇒ center value; absent ⇒ revert to the env baseline (never a stale center override).
     const envAutonomy = parseAutonomy(process.env.AUTONOMY);
     const autonomyNext = rt?.autonomy !== undefined ? rt.autonomy : envAutonomy;
     const setAutonomy = config.autonomy !== autonomyNext;
     if (setAutonomy)
         infoLine.autonomy = autonomyNext ?? "(env-baseline)";
-    // commandPolicy: present+valid ⇒ apply; present+invalid ⇒ fail-loud + keep prior; absent ⇒ revert to baseline
-    // (undefined — no env scalar source for structured command rules). Only re-set + log on an ACTUAL change
-    // (deep-equal compare) — refresh runs every ~60s and the policy is usually unchanged; logging every tick = noise.
     let setCommandPolicy = false;
     let commandPolicyNext;
     if (rt?.commandPolicy !== undefined) {
@@ -706,18 +417,17 @@ function stageRuntimeHot(config, rt, logger) {
         else if (JSON.stringify(config.commandPolicy) !== JSON.stringify(rt.commandPolicy)) {
             setCommandPolicy = true;
             commandPolicyNext = rt.commandPolicy;
-            infoLine.commandPolicy = rt.commandPolicy.length; // log the COUNT, not the rules (avoid leaking on every refresh)
+            infoLine.commandPolicy = rt.commandPolicy.length;
         }
     }
     else if (config.commandPolicy !== undefined) {
         setCommandPolicy = true;
-        commandPolicyNext = undefined; // center stopped managing → revert to baseline (no env source)
+        commandPolicyNext = undefined;
         infoLine.commandPolicy = "(env-baseline)";
     }
     return { setAutonomy, autonomyNext, setCommandPolicy, commandPolicyNext, infoLine };
 }
 export function applyRuntimeHot(config, rt, logger) {
-    // 独立调用面的兼容壳(测试/外部)——applyEffective 不走这里(同 applyRuntimeGates 的注)。
     const s = stageRuntimeHot(config, rt, logger);
     if (s.setAutonomy)
         config.autonomy = s.autonomyNext;
@@ -726,22 +436,7 @@ export function applyRuntimeHot(config, rt, logger) {
     if (Object.keys(s.infoLine).length > 0)
         logger?.info("sema_registry_runtime_hot", s.infoLine);
 }
-/** [865]①/H3:activeTierGroup 档绑定当默认时的档梯,与 core 单一语义源逐字对齐(core roles.js:
- *  `ROLE_TIER_DEFAULTS.default = "pro"` + `resolveTier` 从本档位置**只向低档**扫 DEFAULT_TIER_ORDER
- *  [ultra,max,pro,flash,lite] ⇒ pro→flash→lite,绝不向上抓 max/ultra——引擎运行时对 "default" 角色就是
- *  这么解析的,applyEffective 的 default 若用别的梯子会与真路由再度撕裂,codex H3)。 */
 const DEFAULT_ROLE_TIER_LADDER = ["pro", "flash", "lite"];
-/**
- * [865]① 显式默认解析——applyEffective 与 dry-run(logEffectiveDiff.wouldDefaultModel)共用的单源。优先级
- * (显式源指向不在目录/未启用的名 ⇒ onDangling 回调后落下一级,绝不静默指错模型):
- *   1) eff.models.default 结构键 —— ✅ 既得路径([874] registry-core 0.10.11 落 `default?: string` schema
- *      键+per-worker /effective 直通;本地 lane 由 config-provider mapToServiceEffective 直通)。写面悬空 ref
- *      由 registry-core superRefine fail-loud;存量/未经 schema 路径仍走本函数的 warn 降级(双层姿势与
- *      activeTierGroup 同构)。(1.200-1.202 期间此级恒空=当时如实的前行 seam,codex H2 注记已兑现。)
- *   2) roles.default 的显式 {model} 绑定(现有 wire 真源)。
- *   3) activeTierGroup 档绑定,按 {@link DEFAULT_ROLE_TIER_LADDER}(= core 对 "default" 角色的档语义)。
- *   4) fallback(enabled[0]——原兜底,唯一不触发 onDangling 的落点)。
- */
 export function resolveDefaultModelName(eff, has, fallback, onDangling) {
     const activeTiers = resolveActiveTiers(eff.models) ?? {};
     const structural = eff.models?.default;
@@ -760,11 +455,6 @@ export function resolveDefaultModelName(eff, has, fallback, onDangling) {
     }
     return { name: fallback, source: "enabled[0]" };
 }
-/**
- * Read-only comparison (SEMA_REGISTRY_DRY_RUN): log what the center config WOULD change vs the current
- * (env-derived) config, WITHOUT applying it. The safe-rollout step the config-center recommends — verify
- * the center's models/roles/teams match (or intentionally differ from) the env baseline before going live.
- */
 export function logEffectiveDiff(config, eff, logger) {
     const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
     const centerModels = enabled.map((m) => ({ name: m.name, id: m.id, provider: m.provider, apiKeyEnv: m.apiKeyEnv ?? null, tier: m.tier ?? null }));
@@ -774,9 +464,7 @@ export function logEffectiveDiff(config, eff, logger) {
     logger?.warn("sema_registry_dry_run", {
         note: "DRY RUN — registry config NOT applied; unset SEMA_REGISTRY_DRY_RUN to go live",
         version: eff.version,
-        wouldOverrideModels: enabled.length > 0, // empty/unpublished center → env baseline kept (no override)
-        // [865]①/codex M2:与 applyEffective 同一只解析器——dry-run 的上线前核验必须报真 apply 会选的默认,
-        // 报 enabled[0] 会让核验对显式默认(roles.default/tier 档)配置给出错误结论。
+        wouldOverrideModels: enabled.length > 0,
         wouldDefaultModel: enabled.length > 0 ? resolveDefaultModelName(eff, (n) => enabled.some((m) => m.name === n), enabled[0].name).name : null,
         currentDefaultModel: config.model.id,
         models: { center: centerModels, envDerived: envModels },
@@ -785,14 +473,11 @@ export function logEffectiveDiff(config, eff, logger) {
         skills: { centerWouldLoad: (eff.skills?.skills ?? []).filter((s) => s.enabled !== false).map((s) => s.name) },
         mcp: { centerWouldRegister: (eff.mcp?.servers ?? []).filter((s) => s.enabled !== false).map((s) => s.name) },
         runtime: {
-            // What the gates would become if applied (present center value overrides; absent → kept env shown as current).
             center: eff.runtime ?? null,
             current: Object.fromEntries(RUNTIME_GATE_KEYS.map((k) => [k, config[k]])),
         },
     });
 }
-/** True if the center `runtime` carries any managed gate (a PRESENT field) — i.e. a refresh that changed it
- *  needs a restart to take effect (restart-to-apply). Same key list + presence rule as applyRuntimeGates. */
 export function runtimeHasActiveGate(rt) {
     if (!rt)
         return false;