@sema-agent/server 7.43.0 → 7.44.0

package/dist/config.js

@@ -3,12 +3,12 @@ import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveLockedKeys } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/registry-core";
-import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js"; // design/158 A4: the parser leaf — NOT security.js (base config layer must not value-import the 55KiB auth module)
+import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
-import { isV2ScopeKey } from "./memory-scope.js"; // A-002.4: v2 scope 前缀词表的单一属主(纯谓词,无反向依赖)
+import { isV2ScopeKey } from "./memory-scope.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
-import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js"; // P1-2: 方言词表叶模块(config 不得值引 capabilities 层)
-import { RETENTION_MODES } from "./config-types.js"; // #270 车2:留存灰度档的闭集词表(值导入 —— config-types 是纯叶,无装载环)
+import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
+import { RETENTION_MODES } from "./config-types.js";
 export { RETENTION_MODES } from "./config-types.js";
 function csv(name) {
     return (process.env[name] ?? "")
@@ -17,11 +17,6 @@ function csv(name) {
         .filter(Boolean);
 }
 const AUTONOMY_MODES = ["read-only", "ask", "plan", "auto"];
-/** Parse the AUTONOMY env into a validated autonomy mode. Unset/empty → undefined (unmanaged → no extra
- *  tightening). An UNKNOWN value FAILS at startup rather than silently becoming a no-op (a typo'd `AUTONOMY=readonly`
- *  must not silently leave a deployment ungoverned — fail-loud, same discipline as numEnv). Exported so the HOT
- *  config overlay (config-center/facade.ts `applyRuntimeHot`) can re-derive the ENV BASELINE to revert to when center
- *  stops managing `autonomy` (a stale center override must not stick — see applyRuntimeHot). */
 export function parseAutonomy(raw) {
     const v = raw?.trim();
     if (!v)
@@ -31,10 +26,6 @@ export function parseAutonomy(raw) {
     }
     return v;
 }
-/** design/166-T1 — parse `USAGE_WINDOWS`(单键 JSON 数组;逐窗散键在窗数可变时组合爆炸,JSON 是唯一
- *  封闭形)。unset/空串 → undefined(关)。fail-loud 族(numEnv 同纪律):坏 JSON/非数组/空数组/
- *  非正有限整数/未知 anchor 全部 boot throw 点名——「设了但无意义」静默关掉=部署方以为有治理实际没有。
- *  server 严于 core(core 允 maxTokens=0=恒拒锅;这里要求正整数,0 配置显然是笔误不是意图)。 */
 export function parseUsageWindows(raw) {
     const v = raw?.trim();
     if (!v)
@@ -59,9 +50,6 @@ export function parseUsageWindows(raw) {
     });
     return Object.freeze(out);
 }
-/** Resolve a CSV of env-var NAMES into a {NAME: value} map from THIS process's env (out-of-band secret
- *  forwarding into a sandbox). A name with no value set is skipped (not forwarded as undefined). The values
- *  are secrets — they live only in the returned map (in-memory), never logged. */
 function resolveEnvForward(csvNames) {
     const out = {};
     for (const name of csvNames.split(",").map((s) => s.trim()).filter(Boolean)) {
@@ -80,17 +68,12 @@ function env(name, fallback) {
     }
     return v;
 }
-/** 出厂 skill 目录的缺省 = 包内 `skills/`(相对本模块解析),不是 cwd 相对的裸 "skills"。
- *  真 bug(live 战役 2026-07-15 抓获):npm 全局装的 CLE 从用户 cwd 起引擎,裸 "skills" 解析到
- *  cwd/skills(不存在)⇒ skills:0,所有烤入 skill 在 npm 分发面全空转(bench 日志 skills:0 即此)。
- *  dist/config.js 与 skills/ 同在包根下的 ../skills;src 跑测试时 ../skills 同样是仓根 skills(一致)。
- *  SKILLS_DIR 显式设仍覆盖此缺省;Docker(WORKDIR 包根+COPY skills)解析到 /app/skills 不破。 */
 function defaultSkillsDir() {
     try {
         return fileURLToPath(new URL("../skills", import.meta.url));
     }
     catch {
-        return "skills"; // import.meta 不可用的兜底(不应发生在 ESM 构建里)
+        return "skills";
     }
 }
 const RETIRED_ENVS = [
@@ -99,8 +82,7 @@ const RETIRED_ENVS = [
     ["CONFIG_CENTER_URL", "SEMA_REGISTRY_URL", "renamed"], ["CONFIG_CENTER_TOKEN", "SEMA_REGISTRY_TOKEN", "renamed"],
     ["CONFIG_CENTER_DRY_RUN", "SEMA_REGISTRY_DRY_RUN", "renamed"], ["CONFIG_CENTER_WORKER", "SEMA_REGISTRY_WORKER", "renamed"],
     ["ANTHROPIC_BASEURL", "ANTHROPIC_BASE_URL", "renamed"],
-    ["REGISTRY_ADMIN_TOKEN", "SEMA_REGISTRY_ADMIN_TOKEN", "renamed"], // [2373]B-1:墓碑族唯一漏网的双读(config-center.ts 发射点)
-    // [2354] OA 场景整体退役(clay 令 2026-08-01):配置本身作废,无替代名 ⇒ removed 族。
+    ["REGISTRY_ADMIN_TOKEN", "SEMA_REGISTRY_ADMIN_TOKEN", "renamed"],
     ["OA_API_BASEURL", "the OA scenario was removed in 5.0.0", "removed"],
     ["OA_SERVICE_TOKEN", "the OA scenario was removed in 5.0.0", "removed"],
     ["OA_ISSUE_TOKEN", "the OA scenario was removed in 5.0.0", "removed"],
@@ -126,21 +108,9 @@ function rejectRetiredEnvs() {
     }
     throw new Error(`retired env name(s) set ([2354] 兼容面全清,5.0.0 起拒启): ${parts.join(" | ")}.`);
 }
-/** Numeric env with validation: a non-numeric value FAILS at startup instead of silently becoming `NaN`
- *  (which e.g. slips past the `runStaleSec` liveness guard and silently disables the reaper). */
 export function numEnv(name, fallback) {
     return parseNumOrFail(name, env(name, fallback));
 }
-/**
- * 数值 env 的核心判据,**接受 raw 值**(而非自己去读 process.env),这样注入式配置也能复用同一条判据。
- *
- * 提出来的理由(2026-08-01 gap-sweep):`leader/wire.ts` 的四个资源旋钮各自手写了
- * `Number(x) || default`,因为 numEnv 只会读 process.env、够不到它们注入进来的 env 对象。
- * 结果是同一个失败模式在另一处复发,而且**回落方向更坏**:那边落到的是慷慨的默认值,
- * 症状从「设了没生效」变成「想收紧却被松绑」。判据只有一份,谁都能调,才不会各写各的。
- *
- * `undefined`/空串 ⇒ 交给调用方的 fallback 语义处理(本函数只判「给了值但不是数」)。
- */
 export function parseNumOrFail(name, raw) {
     if (raw === undefined)
         return NaN;
@@ -149,25 +119,12 @@ export function parseNumOrFail(name, raw) {
         throw new Error(`env ${name}="${raw}" must be a number`);
     return n;
 }
-/**
- * `parseNumOrFail` layered with a non-negative floor — the SAME judgment `leader/wire.ts`'s (private,
- * file-local) `parseNumOrFailNonNegative` already applies to its four resource knobs, exported here so a
- * second call site (bake-runner's heartbeat/idle-poll/disk-guard knobs, gap-sweep 2026-08-01) can reuse the
- * one shared primitive instead of re-deriving its own "reject a bad number" scheme. A negative value is
- * JS-truthy, so a bare `|| default` fallback lets it straight through; for a duration knob that means
- * `clock.sleep(-N)` fires ~immediately (the same tight-loop failure NaN causes), and for a threshold knob
- * (`freeGb < minFreeGb`) a negative floor makes the comparison vacuously true/false depending on sign —
- * either way the guard it configures goes silently slack. `undefined`/unset stays NaN (unchanged) so
- * existing `|| fallback` chains built on `parseNumOrFail` are untouched by this stricter sibling.
- */
 export function parseNumOrFailNonNegative(name, raw) {
     const n = parseNumOrFail(name, raw);
     if (n < 0)
         throw new Error(`env ${name}=${n} must not be negative`);
     return n;
 }
-/** Numeric env with a [min,max] bound (BL-17): an out-of-range value FAILS at startup instead of being
- *  silently clamped/applied (e.g. a multi-hour MCP_ELICITATION_TTL_MS would silently never expire). */
 function numEnvBounded(name, fallback, min, max) {
     const n = numEnv(name, fallback);
     if (n < min || n > max)
@@ -178,55 +135,19 @@ const CONFIG_WARNINGS = [];
 export function drainConfigWarnings() {
     return CONFIG_WARNINGS.splice(0, CONFIG_WARNINGS.length);
 }
-/**
- * #210 —— 轮换钥两口(APPROVAL_HMAC_KEYS / PRINCIPAL_JWT_PUBKEYS)的诊断落点。
- *
- * 这两口的 fail-closed 方向本来就是对的(坏形 ⇒ 空钥集 ⇒ 门关着),本批**一个字都不动它**;补的是
- * 「丢弃零留痕」:轮换新钥时写错一个字段,那一条被静默滤掉,旧钥还在于是一切照常,直到旧钥退役当天
- * 全量回决一起 401 —— 故障与配置错误之间隔着几周,没有任何线索指回来。
- *
- * 走 CONFIG_WARNINGS(不是 throw):拒启会把一台**本来还能用旧钥服务**的 worker 直接打死,而这两口的
- * 语义就是「集合里能用几把用几把」。`raw` 只写条目序号 + 缺陷字段名 —— 值不进日志(HMAC 那把是对称
- * 密钥),`used` 恒不带(这不是夹取形,没有"采用值"可言)。
- *
- * 返回一只闭包(捕获 env 名)⇒ 按仓规命名 `announce*` 而非 `build*`。
- */
 function announceKeySetRejection(envName) {
     return (r) => CONFIG_WARNINGS.push({
         env: envName,
         raw: "<withheld: this env holds credential material>",
-        // ⚠️ 整份坏 ≠ 掉了一条(codex 自审 R3-F1 真修):`index: "-"` 说的是**整个** key-set 没解析出来,
-        // 于是信任锚**全空** —— 直连门整条关死、所有回决当场失效;而 `entry-rejected` 只是轮换里少进来
-        // 一把钥,旧钥还在服务。两者是不同量级的事故,告警规则必须分得开,不能挤在一个事件名下。
         kind: r.index === "-" ? "set-rejected" : "entry-rejected",
         detail: r.index === "-" ? r.reason : `entry #${r.index}: ${r.reason}`,
     });
 }
-/** Boot NOTICES ([792]④): non-error decisions loadConfig makes that the operator should see once (e.g. the
- *  MODEL_PROVIDER inference below). Same pre-logger collection pattern as CONFIG_WARNINGS, but each entry
- *  carries its own event name + fields (the warnings drain has one fixed "invalid, using default" message
- *  which would misdescribe an inference). main.ts drains + logs right after createLogger. */
 const CONFIG_NOTICES = [];
 export function drainConfigNotices() {
     return CONFIG_NOTICES.splice(0, CONFIG_NOTICES.length);
 }
-/** #157([2762]§五,F 类观测,零行为变化)—— 本次 boot 的执行车道落点 + 它的来源。
- *  为什么单开一格:REMOTE_EXEC 未设/空串时的落点由 CONFIG_PROVIDER 隐式决定(local ⇒ host 真机,其余 ⇒
- *  进程内 stub),而这个落点此前在日志里零留痕 —— 运维拿到一台 worker,无从确认「它跑的是哪条执行通道、
- *  是显式配的还是默认落的」。与 CONFIG_WARNINGS / CONFIG_NOTICES 同为 pre-logger 收集(config 解析早于
- *  logger 建立),但级别是 **info**:这是每次 boot 都成立的常态事实,不是异常,而 CONFIG_NOTICES 那一格
- *  固定按 warn 排空。
- *  单槽(不是队列):一次 boot 只有一个落点;重复 loadConfig(测试)覆写即可,不会堆积。
- *  ⚠️ 写入时机=装配尾(见 loadConfig),不是解析途中:写早了,任何**后置**拒启(limits 域数值、跨域
- *  不变量)都会留下一条「其实没启起来」的落点;而 loadConfig 开头的清槽保证失败的一轮不会把**上一轮**
- *  的落点串给下一次排空(交叉复审 medium,2026-08-06)。
- *  ⚠️ 边界:记的是 **ENV 解析出的**落点。local 形的 `config.d/remote-exec.json` 覆写发生在 main.ts 的
- *  applyLocalRemoteExec(晚于本行排空),它自己另记 `remote_exec_from_file` —— 两行合读才是最终 lane。 */
 let EXEC_LANE_NOTICE;
-/** 从**已装配好的** remoteExec 派生落点一行(而不是在 REMOTE_EXEC 那条三元链的各臂里分别记账):
- *  分臂记账要靠「校验过了 ⇒ 必落对应那一臂」这条人肉维护的同源假设,链子哪天多一臂就悄悄失真;
- *  取装配结果则天然跟随。`in-process` = REMOTE_EXEC 未设的进程内 stub 姿态,沿用既有词表
- *  (config-center/types.ts 的 provider 词表、run-local 的 `?? "in-process"` 同名)。 */
 function buildExecLaneNotice(remoteExec) {
     const explicit = process.env.REMOTE_EXEC !== undefined && process.env.REMOTE_EXEC !== "";
     return {
@@ -234,14 +155,7 @@ function buildExecLaneNotice(remoteExec) {
         source: explicit ? "explicit-env" : process.env.CONFIG_PROVIDER === "local" ? "default-local-provider" : "default-unset",
     };
 }
-/** F10 (codex audit): drain + log BOTH pre-logger diagnostic collectors (S20 soft-knob warnings + [792]④ boot
- *  notices) in one place. EVERY entrypoint that calls loadConfig() then builds a logger must call this right
- *  after (main.ts, run-local.ts) — a new entry that forgets it would silently drop operator-facing diagnostics
- *  (run-local historically did exactly that), so the drain lives beside the collectors, not in one entrypoint. */
 export function logConfigDiagnostics(logger) {
-    // #210:四种诊断各有自己的事件名 —— 「invalid, using the default」对一个**合法但越界**的值、对一个被
-    // 保留的空串、对一条被丢弃的钥,都是错的描述,而运维的告警规则正是按事件名写的。穷尽 switch:词表加
-    // 一个种类而这里漏接 ⇒ `never` 赋值编译红(CLAUDE.md 闭集词表纪律)。
     for (const w of drainConfigWarnings()) {
         const kind = w.kind ?? "invalid-default";
         switch (kind) {
@@ -271,22 +185,10 @@ export function logConfigDiagnostics(logger) {
     }
     for (const n of drainConfigNotices())
         logger.warn(n.event, n.fields);
-    // #157 F 类观测:执行车道落点一行(见 EXEC_LANE_NOTICE 头注)。无条件发 —— boot 期本来就只跑一次,
-    // 不需要 once-per-hit 抑制。先取后清:排空语义与上面两格一致(重复调用不重放同一条)。`info` 与
-    // `debug` 同为可选,理由同上 —— 老 embedder 传进来的 warn-only logger 仍能编译、仍拿得到警告。
     const laneNotice = EXEC_LANE_NOTICE;
     EXEC_LANE_NOTICE = undefined;
     if (laneNotice && logger.info)
         logger.info("exec_lane_selected", { lane: laneNotice.lane, source: laneNotice.source });
-    // design/158 N9 (polarity self-report): a `*_ENABLED` suffix does NOT carry its default — the repo grew four
-    // dialects for it (opt-in / opt-out / posture tri-state / negative name). Rather than force operators to read
-    // config.ts to learn what a knob does when unset, boolEnv-parsed knobs register themselves and we print one
-    // debug line per knob: name → polarity → effective value → where that value came from. `debug` is optional so
-    // an older embedder-supplied logger shape (warn-only) still compiles and still gets the warnings above.
-    // 复审 2026-07-29 #6 — the table covers a LOAD, not the catalog: five boolEnv calls sit inside conditional
-    // config shapes (E2B_ALLOW_NET only when set; K8S_INSECURE_TLS / DOCKER_DROP_CAPS only under their provider
-    // branch; MODEL_DEGRADE_REACTIVE / MODEL_DEGRADE_TO_VISION only when MODEL_DEGRADE_TO is set) and register
-    // only when that shape is active — absence of a row means "not a live knob in this config", not "off".
     if (logger.debug) {
         for (const k of configKnobTable()) {
             logger.debug("config_knob_polarity", {
@@ -298,11 +200,6 @@ export function logConfigDiagnostics(logger) {
         }
     }
 }
-/** F8 (codex audit): first NON-EMPTY env among aliased names — "" = unset, the same convention `env()` uses.
- *  A plain `??` chain treats an EMPTY first choice as SET and shadows a configured fallback (e.g.
- *  `ANTHROPIC_BASEURL=""` from a compose `${VAR:-}` template hiding a real `ANTHROPIC_BASE_URL`, or an empty
- *  `ANTHROPIC_API_KEY` suppressing the whole route despite a valid `ANTHROPIC_AUTH_TOKEN`). Shared by the
- *  MODEL_PROVIDER inference AND the anthropic route assembly so the two predicates can never drift. */
 function firstSetEnv(...names) {
     for (const n of names) {
         const v = process.env[n];
@@ -311,22 +208,6 @@ function firstSetEnv(...names) {
     }
     return undefined;
 }
-/**
- * #210(黑板 [3425]③)—— **E 类**旋钮的唯一夹取口:`numEnv` 的坏值拒启 + 越界**夹取并点名**。
- *
- * 为什么抽一只而不是 24 处各写各的:改前这 24 处清一色是 `Math.max(floor, numEnv(...))`,夹取本身是
- * 刻意的(存量部署配了越界值也不该拒启),但**夹取事件零留痕** —— operator 把 `DRAIN_GRACE_MS` 设成
- * `100`(以为单位是秒)后,进程按 10s 排空、日志里一个字都没有,直到某次滚动升级把在飞任务砍了才回头
- * 查。24 处手写 `CONFIG_WARNINGS.push` 必然漂(有人忘记带 `used`、有人写错 env 名),判据只有一份才咬得住。
- *
- * 返回纯数值 ⇒ 按仓规叫 `clamp*` 而非 `create*`。
- *
- * ⚠️ `max` 缺省 `+Infinity` 而**不是**一个大整数上帽(codex 自审 R2-F2 真修):这 22 处里只有
- * APPROVAL_AUTO_BUDGET 原本真有 `Math.min` 上帽,其余全是「只有地板」。给它们塞一个有限上界等于凭空长出
- * 一条上限 —— 一个拿超大有限值当「实际上无限」哨兵的存量部署会被无预告改小,而本批对外宣称的正是「夹取
- * 行为逐字保留」。上界只写在原本就有上界的那一处。
- * (`Infinity` 本身进不来:`numEnv` 的 `Number.isFinite` 门已经把 `1e400` 拒在启动期。)
- */
 function clampEnvWithWarn(name, fallback, min, max = Number.POSITIVE_INFINITY) {
     const n = numEnv(name, fallback);
     const used = Math.min(max, Math.max(min, n));
@@ -334,49 +215,26 @@ function clampEnvWithWarn(name, fallback, min, max = Number.POSITIVE_INFINITY) {
         CONFIG_WARNINGS.push({ env: name, raw: env(name, fallback), used: String(used), kind: "clamped" });
     return used;
 }
-/**
- * #210 —— `numEnv` 的「fallback 不是字符串而是一个**已算出来的数**」变体。用在 cheap-model 的
- * 窗口/上限两键上:未设时继承**主模型**的对应值,而不是继承一个字面量默认。
- *
- * 改前是 `process.env.X ? Number(X) : main` —— 真值门本身没错(空串已经落在「继承主模型」那一侧,本函数
- * 逐字保留),错的是给了值之后的裸 `Number()`:`MODEL_CHEAP_CONTEXT_WINDOW=128k` 会静默铸出 NaN 窗口,
- * 而窗口是被拿去做大小比较的,NaN 让每一处比较恒假 ⇒ 窗口守卫整条消失。
- *
- * ⚠️ cheap 的**单价**四键不走这里,走 {@link cheapCostEnv}:它们改前是 `?? ` 形,空串会落 0 而不是继承,
- * 那条既有语义必须逐字保留(见该函数头注)。两族的空串语义不同源,别合并。
- */
 function numEnvOr(name, fallback) {
     const raw = process.env[name];
     if (raw === undefined || raw === "")
         return fallback;
     return parseNumOrFail(name, raw);
 }
-/**
- * #210 —— cheap 单价四键**专用**的变体(codex 自审 R1-F2 真修)。
- *
- * 与 `numEnvOr` 只差空串一条,而这条差别是有理由的:这四键改前写的是 `Number(env ?? main)`,空串会走进
- * `Number("")` = **0**,也就是「这条车道按零计价」——那是一个**已经在生效**的语义,不是坏值。把它归一
- * 成「继承主模型单价」会让一台存量部署的 cheap 车道账面单价从 0 跳到 PRO 价,配额可能当场把在跑的任务
- * 拒掉。律条治的是**坏值静默**,不是顺手改既有语义,所以行为逐字保留、改为响亮:空串照旧落 0,但
- * CONFIG_WARNINGS 点名(它几乎总是 compose `${VAR:-}` 漏配的产物,而不是有人真想要免费计价)。
- */
 function cheapCostEnv(name, mainPrice) {
     const raw = process.env[name];
     if (raw === undefined)
         return mainPrice;
     if (raw === "") {
         CONFIG_WARNINGS.push({ env: name, raw: "", used: "0", kind: "empty-preserved" });
-        return 0; // 改前 `Number("")` 的逐字行为
+        return 0;
     }
     return parseNumOrFail(name, raw);
 }
-/** #210 —— 「真值门 + 裸 `Number()`」那一族(执行车道八旋钮)的收口:门照旧(未设/空串 ⇒ 键缺席,
- *  与改前逐字相同),但**给了值**就必须是数,否则 boot 拒。NaN 超时进 adapter = 守卫整条消失,而车道
- *  旋钮在安全轴上(CLAUDE.md「执行车道禁静默 fail-open」)。 */
 function optNumEnvStrict(name) {
     const raw = process.env[name];
     if (!raw)
-        return undefined; // 真值门原样保留:"" 与 "0" 皆视作未设(改前行为,本批不动这条语义)
+        return undefined;
     return parseNumOrFail(name, raw);
 }
 function optFinitePositiveEnv(name) {
@@ -385,27 +243,18 @@ function optFinitePositiveEnv(name) {
         return undefined;
     const n = Number(raw);
     if (!(Number.isFinite(n) && n > 0)) {
-        CONFIG_WARNINGS.push({ env: name, raw }); // S20: previously a silent swallow — caller quietly used the default
+        CONFIG_WARNINGS.push({ env: name, raw });
         return undefined;
     }
     return n;
 }
-/** Keyed by canonical name so a knob read twice in one load (e.g. DURABLE_APPROVAL, once for the D-G boot
- *  invariant and once for the returned field) registers one row, not two. Reset per `loadConfig()`. */
 const CONFIG_KNOBS = new Map();
-/** The registered boolean knobs, sorted by name — the data behind `logConfigDiagnostics`'s polarity table. */
 export function configKnobTable() {
     return [...CONFIG_KNOBS.values()].sort((a, b) => a.name.localeCompare(b.name));
 }
 function registerKnob(rec) {
     CONFIG_KNOBS.set(rec.name, rec);
 }
-/** #241-rc2([3740]③→[3742] 裁定,双臂不留静默):布尔 env 的**闭集词表**解析。
- *  放宽臂=收 true/false/1/0/yes/no/on/off(大小写不敏感)——`=1` 是运维直觉写法,意图明确按意图执行
- *  (operator-knob 宪法方向);拒启臂=未知词**抛错**(boot 拒启带词表指路,照 #186 响亮拒先例)——
- *  行为承重键(DURABLE_APPROVAL 决定 checkpointStore 存在性 ⇒ /v1/approvals 路由存在性)静默回默认的
- *  真实后果是「审批面整条静默缺席」([3740]② cli/test 真机链)。返回 undefined = raw 未设/空串(沿用
- *  `env()` 的空串=未设约定),由调用方走默认/legacy 分派。 */
 const BOOL_TRUE_WORDS = new Set(["true", "1", "yes", "on"]);
 const BOOL_FALSE_WORDS = new Set(["false", "0", "no", "off"]);
 function parseBoolWord(name, raw) {
@@ -421,47 +270,23 @@ function parseBoolWord(name, raw) {
         `decides whether the checkpoint store — and with it /v1/approvals — exists at all).`);
 }
 function boolEnv(name, def) {
-    // #241-rc2:词表解析(见 parseBoolWord 顶注)。未知词在 parseBoolWord 里抛 = boot 拒启——旧形的
-    // 「CONFIG_WARNINGS 一条 warn + 回默认」臂就此退役(懒读族的防重复 push 守卫随臂一起退役:未知词
-    // 现在到不了任何 push)。
     const parsed = parseBoolWord(name, process.env[name]);
     const value = parsed ?? def;
     const source = parsed !== undefined ? "env" : "default";
     registerKnob({ name, polarity: def ? "opt-out" : "opt-in", value, source });
     return value;
 }
-/** design/158 N8 (D-family) + server 3.0.0 墓碑 —— a knob whose CANONICAL name is positive (`X_ENABLED`,
- *  default ON) and whose retired negative name (`X_DISABLED`) is now a **fail-loud tombstone**.
- *
- *  Why the flip at all: `X_DISABLED !== "true"` is a double negative at the read site, so the four knobs that
- *  used it (`PROJECT_MEMORY`, `CONFIG_LKG`, `HOST_BG`, `HOST_EXEC_SPOOL`) could not be read for their default
- *  without inverting twice in your head, and `projectMemoryDisabled` was the ONE negative boolean on a
- *  `ServiceConfig` that otherwise carries 16 positive `*Enabled`/`*Allowed` fields.
- *
- *  🔴 3.0.0([1989],clay 令「不做兼容」):旧名不再有兼容窗——**设了就拒启**。这个函数保留 legacy 形参
- *  不是为了继续读它,而正是为了**认出它在场并拒绝启动**(把墓碑放在唯一知道这对名字关系的地方)。
- *
- *  Resolution order:
- *   1. `X_ENABLED` set to a literal ⇒ that.
- *   2. `X_ENABLED` set to a non-literal ⇒ default + warning (the tombstone is NOT consulted — a typo in the
- *      new name must not turn into a boot refusal about an env the operator never set).
- *   3. `X_ENABLED` unset ∧ `X_DISABLED` set(**任何值**,含 `"false"`)⇒ throw,文案指路新名。选拒启不选
- *      静默忽略:静默会让升级部署的旧开关名义在、实际归默认——比拒启危险,且下游冒烟测试测不出来。
- *   4. neither ⇒ default. */
 export function boolEnvWithLegacyNegated(name, legacyNegatedName, def) {
     const raw = process.env[name];
     const legacy = process.env[legacyNegatedName];
     let value;
     let source;
-    const parsedCanonical = parseBoolWord(name, raw); // #241-rc2:与 boolEnv 同一词表同一拒启臂(单一属主)
+    const parsedCanonical = parseBoolWord(name, raw);
     if (parsedCanonical !== undefined) {
         value = parsedCanonical;
         source = "env";
     }
     else if (legacy !== undefined && legacy !== "") {
-        // server 3.0.0([1989],clay 令「不做兼容」):负名旧 env = fail-loud 墓碑。设了(任何值,含
-        // "false"——设它的人同样以为它还生效)即拒启并指路新名。选拒启不选静默忽略:静默会让升级部署的
-        // 旧开关名义在、实际归默认——比拒启危险,而且下游/运维的冒烟测试测不出来。
         throw new Error(`${legacyNegatedName} was removed in server 3.0.0 — set ${name}=${legacy !== "true"} instead ` +
             `(positive-name knob, default ${def ? "on" : "off"}; migration table in USAGE.md)`);
     }
@@ -472,20 +297,9 @@ export function boolEnvWithLegacyNegated(name, legacyNegatedName, def) {
     registerKnob({ name, polarity: def ? "opt-out" : "opt-in", value, source });
     return value;
 }
-/** LKG (last-known-good) persistence of the remote effective-config fetch. Read LAZILY at both main.ts sites
- *  rather than lifted onto `ServiceConfig`, so this stays a pure env knob; `loadConfig` pre-registers it (below)
- *  so its polarity row and any deprecation notice appear at boot with everything else. */
 export const configLkgEnabled = () => boolEnvWithLegacyNegated("CONFIG_LKG_ENABLED", "CONFIG_LKG_DISABLED", true);
-/** The `host` exec lane's background-shell capability kill switch (read per capability probe in remote-env-host.ts). */
 export const hostBackgroundShellEnabled = () => boolEnvWithLegacyNegated("HOST_BG_ENABLED", "HOST_BG_DISABLED", true);
-/** The `host` exec lane's spool-file stdio form; false ⇒ the pre-1.226 pipe fallback (read per exec). */
 export const hostExecSpoolEnabled = () => boolEnvWithLegacyNegated("HOST_EXEC_SPOOL_ENABLED", "HOST_EXEC_SPOOL_DISABLED", true);
-/** Enum env with validation: a typo (e.g. SESSION_BACKEND misspelled as `Tidb`) FAILS at startup instead of being silently
- *  cast to the union type and degrading to the default backend (dropping the persistence the operator asked for). */
-/** #246:READ_DENY_PATTERNS 的 env 形=JSON 数组,元素为 `"pattern"` 裸字符串简写或 {pattern, caseSensitive?}
- *  (与 core `ReadDenyEntry = string | {…}` 词表同宽——合并码扫 C6:USAGE 承诺了简写而 parser 只收对象形,
- *  批内自相矛盾)。boot 即用 core 的 `compileReadDeny` 预验(引擎同一套规则,宿主不自造第二份校验语义)
- *  ——JSON 坏形/编不过一律拒启(响亮:安全面追加表静默折默认=静默丢保护,#157 禁令方向)。 */
 function parseReadDenyPatternsEnv(raw) {
     let arr;
     try {
@@ -498,7 +312,7 @@ function parseReadDenyPatternsEnv(raw) {
         throw new Error('READ_DENY_PATTERNS must be a JSON array of "pattern" strings or {pattern, caseSensitive?} objects');
     const entries = arr.map((it, i) => {
         if (typeof it === "string")
-            return { pattern: it, caseSensitive: false }; // 裸串简写 ≡ {pattern}(大小写默认不敏感,与对象形缺席 caseSensitive 一致)
+            return { pattern: it, caseSensitive: false };
         if (typeof it !== "object" || it === null || typeof it.pattern !== "string") {
             throw new Error(`READ_DENY_PATTERNS[${i}] must be a string or an object with a string 'pattern'`);
         }
@@ -507,21 +321,9 @@ function parseReadDenyPatternsEnv(raw) {
             throw new Error(`READ_DENY_PATTERNS[${i}].caseSensitive must be boolean when present`);
         return { pattern: it.pattern, caseSensitive: cs === true };
     });
-    compileReadDeny(entries); // 引擎规则预验;抛错原样上抛=拒启
+    compileReadDeny(entries);
     return entries;
 }
-/**
- * #253 件 G5(core 5.33.0 #245,clay 裁定件)—— 内建 deny 表管理面两键的 env 形:**逗号分隔的名字表**。
- *
- * 形状选择的理由:两个值域都是**短的、闭集或表内的名字**(四个档名 / 内建表的行名),JSON 数组在这里
- * 只会让运维多写一层引号;`READ_DENY_PATTERNS` 用 JSON 是因为它的元素是**带可选字段的对象**。
- *
- * 🔴 **空串拒启,不折成 `[]`**:core 把 `tiers: []` 定义成一个合法姿态(「一档内建都不要」),但一个
- * **空 env**(`READ_DENY_BUILTIN_TIERS=` / 变量没展开)在运维现场几乎总是手滑,而它的后果是**整张内建
- * 敏感路径表被关掉** —— 让手滑与显式意图长得一样,正是 #157「安全轴上禁静默 fail-open」要禁的形。
- * 要那个姿态就显式写 `none`(本仓的哨兵词,不是 core 词表的一员 —— 它在解析层就被翻成 `[]`)。
- * exclude 侧没有对应的哨兵:一个「什么都不删」的 exclude 就是**不设这个 env**。
- */
 function parseNameListEnv(name, raw, opts) {
     const parts = raw.split(",").map((s) => s.trim());
     if (opts?.emptySentinel !== undefined && parts.length === 1 && parts[0] === opts.emptySentinel)
@@ -534,15 +336,7 @@ function parseNameListEnv(name, raw, opts) {
     }
     return names;
 }
-/**
- * #253 件 G5 —— 两键的**引擎规则预验**:交给 core 自己的 `resolveReadDenyBuiltins`(闭集档名 + 表内行名
- * 两类坏值它都响亮抛),宿主**不自造第二份判定语义**(与 `READ_DENY_PATTERNS` 走 `compileReadDeny` 的
- * 姿势逐字同款)。抛出的文案前面缀上出问题的 env 名 —— core 的原文点名的是那个非法值,运维还需要知道
- * 是哪一个变量写错了。
- */
 function assertReadDenyBuiltinsResolvable(tiers, exclude) {
-    // 分两次校验(而不是一次喂两键):core 的文案点名的是**那个非法值**,而运维还需要知道是**哪个变量**
-    // 写错了 —— 一次喂两键就只能在文案里同时挂两个名字,把排查面又糊回去。
     const check = (which, config) => {
         try {
             resolveReadDenyBuiltins(config);
@@ -562,39 +356,24 @@ function enumEnv(name, fallback, allowed) {
         throw new Error(`env ${name}="${v}" must be one of: ${allowed.join(", ")}`);
     return v;
 }
-/** A single HTTP header-name env: it is both read as a request header AND interpolated into the CORS
- *  `access-control-allow-headers` list, so a value with a comma/space would split that list (and isn't a
- *  valid header name anyway). Reject anything but header-token chars at startup (council). */
 function headerNameEnv(name, fallback) {
     const v = env(name, fallback);
     if (!/^[A-Za-z0-9_-]+$/.test(v))
         throw new Error(`env ${name}="${v}" must be a single header name ([A-Za-z0-9_-]+)`);
     return v;
 }
-/**
- * Accept an SSH private key in whatever single-line form a secret store can hold. A PEM key is multi-line, but
- * sema-registry's `POST /api/config/secrets` rejects newlines — so let the value arrive base64-encoded (the
- * recommended self-serve form) or with escaped `\n`, and reconstruct the real PEM here for ssh2.
- */
 function normalizeSshPrivateKey(raw) {
     const v = raw.trim();
     if (v.includes("BEGIN ") && v.includes("PRIVATE KEY")) {
-        return v.includes("\n") ? raw : v.replace(/\\n/g, "\n"); // already PEM (real newlines) or escaped-\n single line
+        return v.includes("\n") ? raw : v.replace(/\\n/g, "\n");
     }
     try {
-        return Buffer.from(v, "base64").toString("utf8"); // base64-of-PEM (newline-free → secrets-API friendly)
+        return Buffer.from(v, "base64").toString("utf8");
     }
     catch {
         return raw;
     }
 }
-/**
- * Build `Model.extraBody` (core 1.60 generation-tuning passthrough) from env, or undefined when nothing
- * is set (so a deployment that sets none is byte-for-byte unaffected). MODEL_EXTRA_BODY (raw JSON) is the
- * general escape hatch; MODEL_FREQUENCY_PENALTY / MODEL_PRESENCE_PENALTY are typed conveniences merged on
- * top (they win over the same key in MODEL_EXTRA_BODY). Throws on malformed JSON — fail loud at boot, not
- * a silently-ignored tuning knob.
- */
 function buildExtraBody() {
     const body = {};
     const raw = process.env.MODEL_EXTRA_BODY;
@@ -611,9 +390,6 @@ function buildExtraBody() {
         }
         Object.assign(body, parsed);
     }
-    // #210 A 档:与本函数自己的纪律对齐(坏 JSON 已经是 boot throw)—— 裸 `Number()` 的 NaN 会原样进
-    // `extraBody`,`JSON.stringify` 把它写成 `null`,网关要么 400 要么按缺省跑,两种都不是 operator 配的
-    // 那个值,而且哪一种都不会说出来。
     const fp = process.env.MODEL_FREQUENCY_PENALTY;
     const pp = process.env.MODEL_PRESENCE_PENALTY;
     if (fp !== undefined && fp !== "")
@@ -622,24 +398,10 @@ function buildExtraBody() {
         body.presence_penalty = parseNumOrFail("MODEL_PRESENCE_PENALTY", pp);
     return Object.keys(body).length > 0 ? body : undefined;
 }
-/** A-065 P2-6:967000 的适用面是 **model-id 表**,不是窗宽几何——core `context-edit.d.ts` 原文:CC 的
- *  1M autocompact 特判是 "sonnet-5-only … a per-model config delivery, **not geometry**"。判 sonnet-5 系
- *  容忍两种部署 id 形:日期后缀(claude-sonnet-5-20260101)与网关路由前缀(anthropic/claude-sonnet-5)。 */
 function isSonnet5Family(id) {
     const bare = id.slice(id.lastIndexOf("/") + 1);
     return bare === "claude-sonnet-5" || bare.startsWith("claude-sonnet-5-");
 }
-/** [818]① 1M dual-window (core 1.289 `Model.autoCompactTokens`): an EXPLICIT positive value wins (env
- *  `MODEL_AUTO_COMPACT_TOKENS` / center roster `autoCompactTokens`); else the **model-id table** applies —
- *  sonnet-5-family id ∧ contextWindow>=1e6 ⇒ 967000 (the faithful shape of CC's single-entry per-model
- *  config; a small-window sonnet is NOT derived — a field above the physical window is undefined core
- *  behavior); anything else ⇒ REMOVED (a spread-inherited value from a bigger-window base model would
- *  mis-trigger a small window). ⚠️ A-065 P2-6 rescinded the old `contextWindow>=1e6 ⇒ 967000` derivation:
- *  it handed a sonnet-5-only constant to ANY 1M model with no corpus/upstream backing (the earlier note
- *  here claiming this was "the exact CC alignment core recommends embedders set" mis-read core's per-model
- *  advice as a width rule). Returns a discriminant so the env lane can turn the removed implicit value into
- *  a loud CONFIG_NOTICES line ("removed-1m"); the center lane's roster culture is explicit declaration.
- *  Shared by the env lane (main + cheap models) and the center lane (sema-registry toModel). */
 export function applyAutoCompactWindow(m, explicit) {
     const target = m;
     if (explicit !== undefined && Number.isFinite(explicit) && explicit > 0) {
@@ -654,35 +416,13 @@ export function applyAutoCompactWindow(m, explicit) {
     delete target.autoCompactTokens;
     return was1m ? "removed-1m" : "removed";
 }
-/** 域:store(持久化)—— DB 引擎三态、session 后端、SQL coords、快照 BLOB / SendUserFile 对象存储。 */
 function parseStoreDomain(ctx) {
-    const { requirePrincipal } = ctx; // 跨域入参①:多租户裸 boot 的 memory 缺省由它决定(见下方注释)
-    // `local` (clay 2026-06-25 seamless local↔cloud) = the DB-less in-memory/file StoreBackend, so a locally-run HTTP
-    // service serves the same contract a cloud worker does. It has no SQL host/coords (createStoreBackend builds it
-    // without tidb/pg), so it's always "reachable". (Parsed FIRST so the session/memory posture defaults below can
-    // key off the chosen engine.) Wording (clay 2026-07-06): canonical value `mysql` = any MySQL-protocol server
-    // (MySQL / TiDB / MariaDB). 🔴 A-054.6: this comment used to end "`tidb` accepted as a back-compat alias" — that
-    // has been FALSE since [2354] retired the public name (see the enum 19 lines below: `tidb` is not in the closed
-    // set, so passing it as this variable's value fails boot). The internal "tidb" label survives only in the sessionBackend mapping and
-    // the SQL coords, which are NOT the public env vocabulary. TiDB itself stays fully supported and is the recommended
-    // MySQL-protocol engine when semantic memory is on (native VECTOR(dim) recall) — you select it with `mysql`.
-    // clay 拍(2026-07-27,[1845] 桌面撞 501 案后):**裸 boot 默认 durable(local file 店)**。
-    // 旧默认「纯内存」让每个宿主(cli fixture/桌面/web BFF)都要手工记得 DB_BACKEND=local,漏设 =
-    // 「跑完的任务重启就丢 + durable runs 面 501」——单机是主流形,直觉预期是留得住。三态:
-    //  - 未设 ⇒ local(单用户形;多租户例外见下)。默认推导的 local 在 main.ts 侧 mkdir/ensure 失败
-    //    时**降级 memory + warn + gauge**(auto-DB 不可达先例),显式 DB_BACKEND=local 才 fail-loud。
-    //  - DB_BACKEND=memory ⇒ 显式纯内存 opt-out(CI/临时 server「不留盘上残余」的出口)。
-    //  - 多租户裸 boot(REQUIRE_PRINCIPAL=true 且未设)⇒ 保持 memory + notice:local 与多租户互斥
-    //    (main.ts 硬拒,owner map 无租户隔离),默认不得把多租户裸 boot 变成拒启。
+    const { requirePrincipal } = ctx;
     const dbBackendSet = !!process.env.DB_BACKEND;
-    // 「裸 boot」判定必须**无任何 SQL 信号**才成立——SESSION_BACKEND=mysql/auto 或 TIDB/MYSQL/PG coords
-    // 在场时,dbBackend 的旧默认 "mysql" 是**引擎选择器**(auto 探测/coords 构建都 key 它),默认切
-    // local 会把这些既有形错切到文件店(回归钉在 config-coverage)。
     const sqlSignal = (!!process.env.SESSION_BACKEND && process.env.SESSION_BACKEND !== "memory") ||
         !!(process.env.MYSQL_HOST || process.env.PG_HOST);
     const bareBoot = !dbBackendSet && !sqlSignal;
     const multiTenantBareBoot = bareBoot && requirePrincipal;
-    // [2354]:公名枚举不再收 "tidb"(enumEnv 对越集值自带拒启);内部逻辑不变。
     const dbBackend = enumEnv("DB_BACKEND", bareBoot ? (multiTenantBareBoot ? "memory" : "local") : "mysql", ["mysql", "pg", "local", "memory"]);
     if (multiTenantBareBoot) {
         CONFIG_NOTICES.push({
@@ -692,74 +432,42 @@ function parseStoreDomain(ctx) {
             },
         });
     }
-    // Asymmetry收编 (clay 2026-07-06, overseas-pilot pit #1): an EXPLICIT `DB_BACKEND=mysql/pg` is the operator
-    // asking for a durable SQL deployment — default sessions onto it (fail-fast, same as an explicit
-    // SESSION_BACKEND=mysql) instead of silently keeping the in-memory default ("DB_BACKEND=pg engaged nothing,
-    // session:memory, PG 0 tables"). DB_BACKEND=local keeps its own coercion in main.ts (it needs the built
-    // backend); an UNSET DB_BACKEND keeps the memory default (no surprise DB requirement on a bare boot).
-    // `mysql` is accepted as an alias of the internal durable label `tidb` (see ServiceConfig.sessionBackend).
     const sqlEngineExplicit = !!process.env.DB_BACKEND && dbBackend !== "local" && dbBackend !== "memory";
-    const sessionBackendRaw = enumEnv("SESSION_BACKEND", sqlEngineExplicit ? "mysql" : "memory", ["memory", "mysql", "auto"]); // [2354]:公名 "tidb" 退役
+    const sessionBackendRaw = enumEnv("SESSION_BACKEND", sqlEngineExplicit ? "mysql" : "memory", ["memory", "mysql", "auto"]);
     const sessionBackend = sessionBackendRaw === "mysql" ? "tidb" : sessionBackendRaw;
-    // P0.5 variant-2: the file-backed `local` backend's data root. Same tail as main.ts's `localRoot` and
-    // run-local.ts's `root` (CONFIG_LOCAL_DIR → AGENT_DATA_DIR → ~/.ai-agent), so the HTTP service + a run-local
-    // on one box open ONE boot-locked data dir. `LOCAL_DATA_ROOT` is an additional highest-priority override
-    // (the explicit "the local backend's data lives HERE" knob). Only the `local` backend consumes it
-    // (createStoreBackend), but it's always resolved (cheap, env-deterministic).
-    // ⚠️ 缝合审 M6:上面那句「same resolution」**只在没设 LOCAL_DATA_ROOT 时成立** —— 旧注释断言了无条件
-    // 相同,那是假的。设了它就只有数据根跟着走,config.d/remote-exec.json 仍从配置根读 ⇒ 两根分家。
-    // 不改解析(改了会让现有部署的 config.d 当场失踪),改成分家时 boot 期出声:见 `splitLocalRoots`。
     const localDataRoot = process.env.LOCAL_DATA_ROOT || process.env.CONFIG_LOCAL_DIR || process.env.AGENT_DATA_DIR || join(homedir(), ".ai-agent");
-    // `auto` builds the DB coords only when a host is actually configured — otherwise it stays memory with no
-    // probe. (Explicit mysql always builds them so a missing host fails loudly.) `needsDb` is engine-agnostic;
-    // the connection coords are built for whichever engine `dbBackend` selects (MYSQL_* preferred, TIDB_* alias).
     const dbHostSet = dbBackend === "pg" ? !!process.env.PG_HOST : !!process.env.MYSQL_HOST;
     const needsTidb = sessionBackend === "tidb" || (sessionBackend === "auto" && dbHostSet);
     const needsDb = needsTidb;
     return {
         sessionBackend,
-        sessionCacheTtlSec: numEnv("SESSION_CACHE_TTL_SEC", "300"), // A2 同族:NaN ⇒ `> 0` 假 ⇒ 缓存静默关
-        // B1(/health 活体 store 探测):后台探针间隔;0=显式关,负值/非数响亮拒(fail-loud 族)。
-        // 只在 SQL 后端接线(main.ts 门 backend.kind!=="local"),local/memory 部署恒不挂环。
+        sessionCacheTtlSec: numEnv("SESSION_CACHE_TTL_SEC", "300"),
         storeProbeIntervalMs: numEnvBounded("STORE_PROBE_INTERVAL_MS", "15000", 0, 3_600_000),
-        rewindSnapshotMaxMb: optFinitePositiveEnv("REWIND_SNAPSHOT_MAX_MB"), // soft knob (S20: bad value warns + default)
+        rewindSnapshotMaxMb: optFinitePositiveEnv("REWIND_SNAPSHOT_MAX_MB"),
         dbBackend,
         dbBackendExplicit: dbBackendSet,
         localDataRoot,
         tidb: needsDb && dbBackend === "mysql"
             ? {
                 host: env("MYSQL_HOST"),
-                // #210 A 档:裸 Number ⇒ NaN 端口直进 driver(行为因驱动而异,多数是「连不上」而不是「说清
-                // 为什么」)。区间 [1,65535] 一并钉死 —— 端口的合法域是全域公理,不是本仓口味。
                 port: numEnvBounded("MYSQL_PORT", "3306", 1, 65535),
                 user: env("MYSQL_USER"),
                 password: env("MYSQL_PASSWORD", ""),
                 database: env("MYSQL_DATABASE"),
-                // 鲁棒性批5 A2(2026-08-05):此前裸 `Number(process.env.MYSQL_POOL_SIZE)` ——一个手滑值(如
-                // "20;drop") → NaN,driver 的 `connectionLimit` 直接拿到 NaN 而不是走池大小默认,行为因驱动
-                // 而异(未必 fail-loud)。optFinitePositiveEnv 与 dbQueryTimeoutMs 同款:非法值回默认(undefined
-                // = driver 默认池大小)+ S20 boot 警告,合法值照常生效。
                 connectionLimit: optFinitePositiveEnv("MYSQL_POOL_SIZE"),
             }
             : undefined,
         pg: needsDb && dbBackend === "pg"
             ? {
                 host: env("PG_HOST"),
-                port: numEnvBounded("PG_PORT", "5432", 1, 65535), // #210 A 档,同 MYSQL_PORT 族
+                port: numEnvBounded("PG_PORT", "5432", 1, 65535),
                 user: env("PG_USER"),
                 password: env("PG_PASSWORD", ""),
                 database: env("PG_DATABASE"),
-                // 同 MYSQL_POOL_SIZE 族(鲁棒性批5 A2)。
                 connectionLimit: optFinitePositiveEnv("PG_POOL_SIZE"),
             }
             : undefined,
-        // S9 deeper fix: per-query DB timeout (see the interface doc). Soft knob — a typo degrades to the default
-        // posture (pool-wide off / counter-family 30s) with an S20 boot warning, never NaN into a driver timer.
         dbQueryTimeoutMs: optFinitePositiveEnv("DB_QUERY_TIMEOUT_MS"),
-        // E19/2c snapshot-BLOB object-store offload (clay 2026-06-26). Reuses the SAME adapter-held MinIO creds as the k8s
-        // workspace-snapshot lane (secret minio-agent-worker); all three keys required to enable, else the file-snapshot
-        // stores keep the SQL `snapshot_blob` default (byte-identical to today). Bucket = SESSION_SNAPSHOT_BUCKET (default
-        // "session-snapshots"); keyPrefix optional (default "blobs/" in MinioBlobBackend).
         snapshotBlobStore: process.env.MINIO_ENDPOINT && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
             ? {
                 endpoint: process.env.MINIO_ENDPOINT,
@@ -768,17 +476,11 @@ function parseStoreDomain(ctx) {
                 secretKey: process.env.MINIO_SECRET_KEY,
                 ...(process.env.MINIO_REGION ? { region: process.env.MINIO_REGION } : {}),
                 ...(process.env.SESSION_SNAPSHOT_PREFIX ? { keyPrefix: process.env.SESSION_SNAPSHOT_PREFIX } : {}),
-                // Fail-SAFE parse (finding 20): a non-numeric/non-positive value → omit (the MinioBlobBackend default 3600s
-                // applies), never NaN (which would sign every URL with X-Amz-Expires=NaN → total snapshot outage).
                 ...((ttl) => (ttl !== undefined ? { presignTtlSec: ttl } : {}))(optFinitePositiveEnv("SESSION_SNAPSHOT_TTL_SEC")),
             }
             : undefined,
-        // (a+c)(clay 2026-07-27)snapshot_blob 包墙修复两旋钮——语义见 ServiceConfig 字段注释。
         snapshotBlobSqlMaxBytes: optFinitePositiveEnv("SNAPSHOT_BLOB_SQL_MAX_BYTES"),
         snapshotBlobAllowSql: boolEnv("SNAPSHOT_BLOB_ALLOW_SQL_BYTES", false),
-        // SendUserFile 双轨公网直链(同三键开闸;S3_ENDPOINT 兼容位=外接 S3 场景内网/公网同址)。
-        // `||` 非 `??`(配置面自查 2026-07-14):env 惯例(env() helper 同款)空串=未设——`?? ` 会让
-        // 一个显式置空的 MINIO_ENDPOINT/S3_PUBLIC_ENDPOINT 把后备名吞掉(compose `${X:-}` 透传空串是常态)。
         sendUserFile: (process.env.MINIO_ENDPOINT || process.env.S3_ENDPOINT) && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
             ? {
                 endpoint: (process.env.MINIO_ENDPOINT || process.env.S3_ENDPOINT),
@@ -792,42 +494,21 @@ function parseStoreDomain(ctx) {
                 accessKey: process.env.MINIO_ACCESS_KEY,
                 secretKey: process.env.MINIO_SECRET_KEY,
                 ...(process.env.MINIO_REGION ? { region: process.env.MINIO_REGION } : {}),
-                // fail-SAFE:非法值回落 0(永久轨缺省),不 NaN 进签名。
                 defaultTtlSec: ((v) => (v !== undefined && Number.isInteger(v) && v >= 0 ? v : 0))(process.env.SEND_USER_FILE_URL_TTL !== undefined ? Number(process.env.SEND_USER_FILE_URL_TTL) : undefined),
             }
             : undefined,
     };
 }
-/** 域:model(模型面)—— 网关坐标、Anthropic 路线、韧性旋钮、主/廉价 model entry、role 表、降级梯。 */
 function parseModelDomain() {
-    // npm 卫生纪律:默认值不烤内网坐标 — localhost 占位(公开分发正确缺省);真网关一律显式 env。
     const gatewayBaseUrl = env("MODEL_GATEWAY_BASEURL", "http://127.0.0.1:8000/v1");
-    // server 3.0.0([1992] 真机 400 案根治):MODEL_ID **无出厂缺省**。旧缺省是一个只在开发环境存在的
-    // 模型名,对任何外部部署都必炸——且炸在离根因最远的地方(gateway 400 + title hook 连环告警),
-    // 用户看不出是没配模型。fail-loud at boot 指路配置,与 env 墓碑同哲学:让问题在最早、最清楚处现形。
     const modelId = env("MODEL_ID", "");
     if (modelId === "") {
         throw new Error("MODEL_ID is required (no factory default since server 3.0.0) — set MODEL_ID=<model name your gateway serves>, " +
             "or configure models via the sema-registry catalog; the old silent default was an internal-only model name " +
             "that made every external deployment fail far from the cause (gateway 400)");
     }
-    // Model.api must reflect the brain that actually serves it (routing is by provider): an "anthropic"
-    // provider runs the Anthropic brain, whose usage reports `input` EXCLUDING cached tokens. core ≥1.22
-    // normalizes the cache-hit-rate denominator per api family (`cacheFamilyOf` picks the fold formula from
-    // `Model.api`) — a wrong api picks the wrong family, so the normalized total (core 3.0.0: `totalInputTokens`,
-    // core's own cacheHitRate = cachedTokens/totalInputTokens) comes out too small and cacheHitRate exceeds
-    // 100%. (Brains select by provider, not api, so this only fixes accounting.)
-    //
-    // Default inference ([792]④, core ruling 2026-07-14): an EXPLICIT MODEL_PROVIDER always wins (unchanged).
-    // When it is unset but the operator explicitly configured an Anthropic-protocol base URL AND a matching
-    // credential (the EXACT same `firstSetEnv` predicates the `anthropic` route assembly below uses — F8:
-    // non-empty selection, so an EMPTY first alias can't shadow a set fallback), the default is "anthropic" +
-    // a one-line boot notice — a clean-machine user pointing ANTHROPIC_BASE_URL at an Anthropic-compatible
-    // upstream must not have the model silently routed to the (unconfigured) openai gateway. Base URL alone or
-    // credential alone does NOT infer (a bare ANTHROPIC_API_KEY historically only assembles the cloud route for
-    // registry-declared anthropic models); neither present ⇒ "gateway", byte-identical to before.
-    const explicitProvider = process.env.MODEL_PROVIDER; // env() semantics: "" = unset
-    const inferredAnthropicBaseUrl = firstSetEnv("ANTHROPIC_BASE_URL"); // [2354]:无下划线非标名退役(墓碑)
+    const explicitProvider = process.env.MODEL_PROVIDER;
+    const inferredAnthropicBaseUrl = firstSetEnv("ANTHROPIC_BASE_URL");
     const inferredAnthropicCred = firstSetEnv("ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN");
     const provider = (() => {
         if (explicitProvider !== undefined && explicitProvider !== "")
@@ -845,12 +526,6 @@ function parseModelDomain() {
         }
         return "gateway";
     })();
-    // Generation-tuning passthrough (core 1.60 `Model.extraBody`, merged via applyExtraBody — brain-owned
-    // keys like temperature/max_tokens ALWAYS win, core warns on collision; unset → request unchanged).
-    // frequency/presence penalty are the common case (suppress degenerate looping at the source — the
-    // prevention to core's degenerate-repetition safety net); MODEL_EXTRA_BODY is the JSON escape hatch
-    // (top_k, logit_bias, …). MUST be STATIC (stable key order per cache namespace, else the prefix cache
-    // breaks — design/9/31), so it's built once here from fixed env, never per-task.
     const extraBody = buildExtraBody();
     const thinkingDefault = (() => { const v = process.env.MODEL_DEFAULT_THINKING; return v && isThinkingLevel(v) && v !== "off" ? v : undefined; })();
     const effortLevels = (process.env.MODEL_REASONING_EFFORT_LEVELS ?? "").split(",").map((s) => s.trim()).filter((s) => isThinkingLevel(s) && s !== "off");
@@ -859,27 +534,9 @@ function parseModelDomain() {
         name: modelId,
         api: provider === "anthropic" ? "anthropic-messages" : "openai-completions",
         provider,
-        // Empty so the URL is owned by the BRAIN layer: each composed brain (gateway / failover fallback /
-        // Anthropic route) supplies its own baseUrl, and the brain resolves `model.baseUrl || config.baseUrl`.
-        // A non-empty value here would override every brain to one URL — breaking failover AND the Anthropic
-        // route (it would POST to the vLLM gateway). See design/15.
         baseUrl: "",
-        reasoning: boolEnv("MODEL_REASONING", true), // #245:直读族收编词表(rc.2 登记的 7.17 件)
-        // vision precheck: the modality list drives BOTH the `model_no_vision` 422 (main.ts resolveSpec,
-        // when body.images hits a text-only model) AND the vision flag on GET /v1/models. The env-lane default model
-        // declares vision via MODEL_VISION — DEFAULT "true" keeps the historical image-capable behavior, so set
-        // MODEL_VISION=false for a text-only model (e.g. deepseek) to make the precheck actually fire instead of letting
-        // images透传 to an opaque downstream-gateway 400. (The centralized config-center lane derives input from its own
-        // per-model vision flag — see config-center/facade.ts.)
-        input: boolEnv("MODEL_VISION", true) ? ["text", "image"] : ["text"], // #245
-        // Per-1M-token USD pricing (core `modelCostToPricing`: input→inputPer1M, …). Default 0 keeps the
-        // historical behavior (spend reads $0) — set MODEL_COST_* on a deploy to make `model_cost_micro_usd`
-        // + the Fleet card's costUsd real. Numbers are the gateway's contract price (e.g. the review gateway's
-        // deepseek-pro), owned by the operator — the center never stores them (design/15: secrets+billing in env).
-        // #210 A 档(黑板 [3425]③):四项单价与两项窗口一律 `numEnv`(坏值 boot 拒),不再裸 `Number()`。
-        // NaN 单价是本族里后果最重的一形:它顺着 `modelCostToPricing` 一路进 `costUsd`,而 `NaN > ceiling`
-        // 与 `NaN < ceiling` **同时为假** —— MAX_TASK_COST_USD / MAX_PRINCIPAL_COST_USD 两道天花板不是变松,
-        // 是**整条消失**,且账面读数就是空的,没有任何一处会响。
+        reasoning: boolEnv("MODEL_REASONING", true),
+        input: boolEnv("MODEL_VISION", true) ? ["text", "image"] : ["text"],
         cost: {
             input: numEnv("MODEL_COST_INPUT", "0"),
             output: numEnv("MODEL_COST_OUTPUT", "0"),
@@ -887,79 +544,34 @@ function parseModelDomain() {
             cacheWrite: numEnv("MODEL_COST_CACHE_WRITE", "0"),
         },
         contextWindow: numEnv("MODEL_CONTEXT_WINDOW", "262144"),
-        // [854]③a: env 车道缺省 4096 → 32000。4096 对 reasoning 模型太小(一次完整思考+答案都放不下,长输出
-        // 任务被腰斩;上游同类缺省 32000)。per-model clamp:缺省值不越过本 entry 自己声明的 contextWindow
-        // (操作员配了小窗口模型时,缺省输出上限不得超过窗口本身 —— env 车道 model entry 就在此装配,唯一可用
-        // 约束即 MODEL_CONTEXT_WINDOW)。显式 MODEL_MAX_TOKENS 一如既往原样生效(显式配置=操作员意图,不 clamp);
-        // catalog(config.d/models.json)与 center 车道不动(那是显式配置,BL-8 继承链读的是这里的最终值)。
         maxTokens: process.env.MODEL_MAX_TOKENS !== undefined && process.env.MODEL_MAX_TOKENS !== ""
             ? parseNumOrFail("MODEL_MAX_TOKENS", process.env.MODEL_MAX_TOKENS)
             : Math.min(32000, numEnv("MODEL_CONTEXT_WINDOW", "262144")),
-        // design/123 D2 (core 1.226): structural token-estimate coefficient (chars ≈ 1 token) feeding every
-        // non-usage-anchored estimate in core (compaction trigger fallback, clearStale/trim defenses, cut-point
-        // accounting). UNSET → omit = core default 4 (byte-compatible chars/4 heuristic). CJK-heavy models
-        // (deepseek on Chinese tasks) should set 2–3 — chars/4 underestimates Chinese by 60–75%, letting the
-        // request-layer defenses pass over-window requests. optFinitePositiveEnv: a typo'd value degrades to
-        // the safe core default rather than zeroing every structural estimate (soft knob, no fail-loud boot).
         ...(optFinitePositiveEnv("MODEL_CHARS_PER_TOKEN") !== undefined ? { charsPerToken: optFinitePositiveEnv("MODEL_CHARS_PER_TOKEN") } : {}),
-        // Cache family = the BRAIN's usage semantics (design/18): the Anthropic brain reports `input`
-        // EXCLUDING cached, the openai gateway brain INCLUDES it. Declare it EXPLICITLY (core 1.23
-        // `model.params.promptCacheFamily`) instead of leaving core to INFER it from `model.api` — cleaner,
-        // and `api` stays free to mean only "wire format". core warns + clamps if it's wrong (1.23).
         params: { promptCacheFamily: provider === "anthropic" ? "input-excludes-cached" : "input-includes-cached" },
-        // design/111 L2②: defaultThinking = this model's DEFAULT tier (resolution chain `spec.thinking ?? role.thinking ??
-        // model.defaultThinking`, prepare-task). reasoningEffortLevels (openai endpoints only — Anthropic budget honors the
-        // full range) DECLARES which tiers the endpoint accepts so a higher requested tier clamps DOWN instead of 422'ing.
         ...(thinkingDefault ? { defaultThinking: thinkingDefault } : {}),
         ...(effortLevels.length > 0 && provider !== "anthropic" ? { compat: { reasoningEffortLevels: effortLevels } } : {}),
         ...(extraBody ? { extraBody } : {}),
     };
-    // 1.24 role map: a catalog + role→model so subsystems resolve a ROLE (cost tiering) instead of a hard
-    // model name. An optional cheap model on the SAME gateway (MODEL_CHEAP_ID — just a different id) serves
-    // the `subagent`+`summarize` roles, so council lenses & compaction run cheap while the lead/arbiter/team
-    // stay on the main model. Unset MODEL_CHEAP_ID → every role resolves to the main model (unchanged).
     const cheapId = process.env.MODEL_CHEAP_ID;
     const cheapModel = cheapId
         ? {
             ...model,
             id: cheapId,
             name: cheapId,
-            // vision precheck (adversarial-review finding): the cheap model must declare its OWN vision
-            // capability. Spreading `...model` inherits the MAIN model's `input` modality, so a vision-capable main +
-            // text-only cheap (e.g. MODEL_CHEAP_ID=deepseek for subagent/summarize) would advertise vision on /v1/models
-            // AND defeat the precheck (config.models[cheapId] is user-pickable via body.model) — the SAME dead-code-on-a-lane
-            // class clay caught on the env main model. MODEL_CHEAP_VISION declares it (strict "true"); UNSET → inherit the
-            // main model's input (prior behavior, no change — the documented "same gateway, just a different id" case).
-            // #245:三态语义不变(缺席/空串 ⇒ 继承主模型),词面收编 parseBoolWord(未知词 boot 拒)。
             input: ((v) => (v === undefined ? model.input : v ? ["text", "image"] : ["text"]))(parseBoolWord("MODEL_CHEAP_VISION", process.env.MODEL_CHEAP_VISION)),
-            // Own pricing: pricing is keyed by model id (budget.buildPricing), so without this the cheap model
-            // inherits the MAIN model's `cost` and subagent/summarize spend (council lenses, compaction) is
-            // metered at the PRO per-token price → cost metric + per-principal quota over-count. Set
-            // MODEL_CHEAP_COST_* to the real cheap price; unset → inherit the main cost (prior behavior, no change).
-            // #210 A 档:非数值 boot 拒(改前静默 NaN)。空串走 `cheapCostEnv` 的专门臂——它逐字保留改前的
-            // `Number("")`=0 并点名,理由见该函数头注(codex 自审 R1-F2)。
             cost: {
                 input: cheapCostEnv("MODEL_CHEAP_COST_INPUT", model.cost.input),
                 output: cheapCostEnv("MODEL_CHEAP_COST_OUTPUT", model.cost.output),
                 cacheRead: cheapCostEnv("MODEL_CHEAP_COST_CACHE_READ", model.cost.cacheRead),
                 cacheWrite: cheapCostEnv("MODEL_CHEAP_COST_CACHE_WRITE", model.cost.cacheWrite),
             },
-            // systematic-audit: the cheap model also inherited the MAIN model's contextWindow/maxTokens/reasoning verbatim
-            // via the `...model` spread — wrong if MODEL_CHEAP_ID points at a model with different limits/capability. Declare
-            // them per cheap (MODEL_CHEAP_*); UNSET → inherit main (the documented "same gateway, just a different id" case).
             contextWindow: numEnvOr("MODEL_CHEAP_CONTEXT_WINDOW", model.contextWindow),
             maxTokens: numEnvOr("MODEL_CHEAP_MAX_TOKENS", model.maxTokens),
-            // design/123 D2: charsPerToken per cheap slot — the spread inherits the MAIN model's coefficient,
-            // wrong when the cheap slot is a different tokenizer family (e.g. CJK-dense deepseek cheap under an
-            // anthropic main). MODEL_CHEAP_CHARS_PER_TOKEN overrides; UNSET → inherit main (same knob family).
             ...(optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") !== undefined ? { charsPerToken: optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") } : {}),
-            reasoning: parseBoolWord("MODEL_CHEAP_REASONING", process.env.MODEL_CHEAP_REASONING) ?? model.reasoning, // #245:三态同上
+            reasoning: parseBoolWord("MODEL_CHEAP_REASONING", process.env.MODEL_CHEAP_REASONING) ?? model.reasoning,
         }
         : undefined;
-    // [818]①/A-065 P2-6:1M dual-window is now the MODEL-ID table (sonnet-5 family ∧ >=1e6 ⇒ 967000, see
-    // applyAutoCompactWindow header — core's own words: "sonnet-5-only … per-model config delivery, not
-    // geometry"). MODEL_AUTO_COMPACT_TOKENS is the explicit knob for any other model; a 1M window that gets
-    // neither is announced loudly (the pre-P2-6 implicit 967000 must not vanish silently).
     const mainAct = optFinitePositiveEnv("MODEL_AUTO_COMPACT_TOKENS");
     if (applyAutoCompactWindow(model, mainAct) === "removed-1m") {
         CONFIG_NOTICES.push({
@@ -969,89 +581,50 @@ function parseModelDomain() {
             },
         });
     }
-    // cheap 槽走同一 id 表(自己的 id 自己查;sonnet 专属值不给非 sonnet cheap);无独立 env 旋钮——
-    // 1M cheap 罕见,需要时用 center roster 显式 autoCompactTokens。spread 脏字段照旧被删。
     if (cheapModel)
         applyAutoCompactWindow(cheapModel);
     const models = { default: model, [model.id]: model };
     if (cheapModel)
         models[cheapModel.id] = cheapModel;
     const cheapRef = cheapModel ? cheapModel.id : "default";
-    // M1(接入审计 2026-07-08):core verify 契约(verify.d.ts)把「verifier 必须异于 implementer」定为
-    // 🔴 部署契约——verifier 落 default(=implementer)时对抗验证者自评自批,去相关性名存实亡。
-    // `MODEL_VERIFIER=<catalog 模型 id>` 真兑现旧注释的 "operator can override"(此前只有注释没有机制);
-    // 值必须命中 catalog,typo 回落 default 并由 main.ts boot warn 曝光(连同"单模型部署未配 verifier"一起)。
     const verifierEnv = process.env.MODEL_VERIFIER;
     const verifierRef = verifierEnv && models[verifierEnv] ? verifierEnv : "default";
-    // rosterMarkerRoles 收敛(0.7 worker.model 真删同车):role→tier 的名单语义
-    // 单一来源 = registry-core 的 roster 标记常量(0.6.3 契约:ROSTER_PRIMARY_ROLES=["default","team","synthesize"],
-    // ROSTER_CHEAP_ROLES=["subagent","summarize"])——service 不再自带第二份「哪些 role 吃 cheap/primary」清单
-    // (双源并存期空转结束)。值仍指我方 catalog ref(cheap 槽未配 ⇒ cheapRef="default" 全落主模型,行为不变);
-    // `verifier` 是 service 专有 role(core verify 契约),不在 roster 标记语义内,保留显式。
     const roles = {
-        verifier: verifierRef, // adversarial verification gate (1.44) — MODEL_VERIFIER 指异构模型,未设=default(见 boot warn)
+        verifier: verifierRef,
     };
     for (const r of ROSTER_PRIMARY_ROLES)
         roles[r] = "default";
     for (const r of ROSTER_CHEAP_ROLES)
         roles[r] = cheapRef;
-    // Developer-mode role preset (core 1.43, opt-in, default-neutral): attach the de-branded
-    // CODE_AGENT_PROMPT to the named roles via RoleSpec.systemPrompt — those roles run a coding prompt
-    // (when the task doesn't supply its own systemPrompt) while every other role keeps the neutral
-    // default. `MODEL_CODE_ROLES` unset → no change. e.g. MODEL_CODE_ROLES=default,subagent.
     for (const r of csv("MODEL_CODE_ROLES")) {
         const role = r;
         const cur = roles[role];
         if (cur === undefined)
-            continue; // only decorate roles we actually define
-        // our role targets are model-name strings; keep an object target's fields if config ever sets one.
+            continue;
         roles[role] =
             typeof cur === "string"
                 ? { model: cur, systemPrompt: CODE_AGENT_PROMPT }
                 : { ...cur, systemPrompt: CODE_AGENT_PROMPT };
     }
-    // A2:词表验证**无条件**执行(此前它挂在下面 `MODEL_DEGRADE_TO ? {...}` 三元的真臂里,TO 缺席时
-    // parseDegradeOn 根本不可达 ⇒ 拼错词静默无效),而 USAGE.md 的「拼错词 boot 拒启,不静默忽略」是对
-    // MODEL_DEGRADE_ON 本身的无条件承诺:设了就验。TO 缺席 + ON 合法 ⇒ 照旧不装配 degrade(行为不变),
-    // 也不报错——ON 只是把那份已在的意图写下来,不是把 degrade 打开。
     const degradeOn = parseDegradeOn(csv("MODEL_DEGRADE_ON"));
     return {
         gatewayBaseUrl,
         gatewayApiKey: process.env.MODEL_API_KEY,
         gatewayFallbackUrls: csv("MODEL_GATEWAY_FALLBACK_URLS"),
-        // 缺席**不铸键**(不是铸个 2):见 config-types 的 `gatewayMaxRetries` 顶注 —— 缺席时 brain.ts 不把
-        // 这个字段传给引擎,引擎默认当家。铸个默认值等于把「server 钉死引擎默认」这个病换个地方犯。
         ...(process.env.GATEWAY_MAX_RETRIES ? { gatewayMaxRetries: numEnvBounded("GATEWAY_MAX_RETRIES", "2", 0, 20) } : {}),
-        // Anthropic-compatible-ecosystem env compat (2026-07-03): the route now assembles when EITHER credential
-        // is present — `ANTHROPIC_API_KEY` (x-api-key) or `ANTHROPIC_AUTH_TOKEN` (Authorization: Bearer; many such
-        // providers accept only this). AUTH_TOKEN wins when both are set. Base URL reads the widely-adopted
-        // standard name `ANTHROPIC_BASE_URL` too — the explicit sema name (no underscore) wins on a conflict.
-        // F8: alias selection via `firstSetEnv` ("" = unset) — the SAME helper the provider inference above
-        // consumes, so an empty first alias can neither suppress the route nor shadow the fallback base URL.
         anthropic: firstSetEnv("ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN")
             ? {
                 apiKey: firstSetEnv("ANTHROPIC_API_KEY"),
                 authToken: firstSetEnv("ANTHROPIC_AUTH_TOKEN"),
                 baseUrl: firstSetEnv("ANTHROPIC_BASE_URL"),
                 version: process.env.ANTHROPIC_VERSION,
-                cacheBreakpoints: boolEnv("ANTHROPIC_CACHE_BREAKPOINTS", true), // #245
-                ...(process.env.ANTHROPIC_MAX_RETRIES ? { maxRetries: numEnv("ANTHROPIC_MAX_RETRIES", "2") } : {}), // A1 同族:NaN 会把 SDK 重试面折没
+                cacheBreakpoints: boolEnv("ANTHROPIC_CACHE_BREAKPOINTS", true),
+                ...(process.env.ANTHROPIC_MAX_RETRIES ? { maxRetries: numEnv("ANTHROPIC_MAX_RETRIES", "2") } : {}),
             }
             : undefined,
         resilience: {
-            // BEHAVIOR CHANGE ([880] stall-watchdog audit): connect/firstToken default ON. core's idle
-            // timer only arms AFTER the first token (bumpIdle lives in sawContentToken), so with these
-            // two off a stream that opens but never emits hangs unbounded — the one true blind spot the
-            // fleet audit found. Values follow the [880] recommendation; =0 restores off.
-            // 鲁棒性批1 A1(2026-08-03):这五个是 TASK_TIMEOUT_SEC 同族的**危险方向**键——NaN 在 core 的
-            // `if (x && x > 0)` 门下判假 ⇒ 看门狗/熔断静默关(设了收紧值反而更松)。当年 gap-sweep 的棘轮
-            // 正则只抓 process.env 直读拼法,这批「裸 Number 包 env() helper」从盲区漏网;门已补第二正则。
             connectTimeoutMs: numEnv("MODEL_CONNECT_TIMEOUT_MS", "30000"),
             firstTokenTimeoutMs: numEnv("MODEL_FIRST_TOKEN_TIMEOUT_MS", "120000"),
-            // BEHAVIOR CHANGE (CC 196 parity): mid-stream stall watchdog default ON at 5min —
-            // after output starts, 5min of zero deltas cancels the stream as a retryable [network] failure
-            // (retry/failover recovers; without it a hung gateway pins the turn until the user Escapes).
-            // MODEL_IDLE_TIMEOUT_MS=0 restores off.
             idleTimeoutMs: numEnv("MODEL_IDLE_TIMEOUT_MS", "300000"),
             circuitBreaker: boolEnv("MODEL_CIRCUIT_BREAKER", false),
             failureThreshold: numEnv("MODEL_CB_FAILURE_THRESHOLD", "5"),
@@ -1059,46 +632,25 @@ function parseModelDomain() {
         },
         model,
         models,
-        modelApiKeyEnv: {}, // env path has a single gateway key; sema-registry populates per-model overrides
-        modelApiKeys: {}, // sealed-box 解封产物(内存-only 明文):env lane 恒空;applyEffective 解封填充
-        modelQuotaWeights: {}, // weight-at-burn 表:env lane 恒空(weight=1 兜底);registry apply 填充
-        tiers: {}, // 档位表:env lane 恒空(INERT);applyEffective 从 models.tierGroups 解析填充(保引用)
-        projects: {}, // 142-S4 项目登记簿:env lane 恒空(INERT);applyEffective 从 projects 域填充(保引用)
+        modelApiKeyEnv: {},
+        modelApiKeys: {},
+        modelQuotaWeights: {},
+        tiers: {},
+        projects: {},
         roles,
-        // #233 / A-002.8 `@`-mention 允许名单:env lane 恒空(INERT = 全放行,ship-dark 缺省 = 旧行为);
-        // applyEffective 从 models.atModelAllowlist 整表重算填充(非粘,见 config-types.ts 键注)。
-        // 刻意**没有** env 腿:名单是 center 治理面的字段(registry-core 侧还有 name⊆catalog 的 cross-domain
-        // 校验),给它开一条 env 后门 = 两个写者一个语义面,而 env 侧没有那道校验。
         atModelAllowlist: [],
         cascadeLadder: csv("MODEL_CASCADE_LADDER"),
         degrade: process.env.MODEL_DEGRADE_TO
             ? {
                 to: env("MODEL_DEGRADE_TO"),
-                // #210 A 档:本族里最必须拒的一条 —— NaN 阈值让 `spent/budget >= atCostFraction` 恒假,**降级
-                // 整条永久静默关闭**,而 operator 恰恰是配了 MODEL_DEGRADE_TO 才走到这里(他确信降级开着)。
-                // 不加 [0,1] 上下界:>1 是「实际上别降级」的合法表达,收窄会破已配了它的存量部署,而律条要治的
-                // 是坏值静默,不是把区间一起收了。
                 atCostFraction: numEnv("MODEL_DEGRADE_AT_COST_FRACTION", "0.7"),
                 reactive: boolEnv("MODEL_DEGRADE_REACTIVE", false),
-                // core 5.1.0([2390]②):词表=DegradeReason 全集;缺席时 core 默认含 server_error(默认门变宽),
-                // 本 env 是运维收窄/放宽的唯一旋钮。拼错词 boot 响亮拒——盲铸静默折无效成员是 TASK_TIMEOUT_SEC 同族病。
-                // (验词在上方无条件做掉了,见 A2 注;这里只是取用已验过的结果。)
                 downgradeOn: degradeOn,
-                // vision precheck (adversarial-review finding): the degrade TARGET is an external gateway
-                // model NOT in config.models, so resolveSpec's precheck (which only sees the picked model) can't see its
-                // vision capability — a vision-capable main + text-only degrade target would let images reach the text-only
-                // gateway as the opaque 400 the precheck prevents, AFTER admission, at runtime degrade. Declare it via
-                // MODEL_DEGRADE_TO_VISION (strict "true"). DEFAULT false = assume the cheaper degrade target is text-only
-                // (the common case, e.g. deepseek), so resolveSpec drops degrade for image-carrying tasks (main.ts).
                 toSupportsImages: boolEnv("MODEL_DEGRADE_TO_VISION", false),
             }
             : undefined,
     };
 }
-/** 域:approval(审批/HITL 门)—— 审批名单与预算、durable 面、直连门开关与钥、敏感写门、elicitation。
- *  注:直连门的**激活**(directDoorActive)与 D-G §3 半开门不变量是跨域合取,留在装配层。 */
-/** MODEL_DEGRADE_ON 词表=core `DegradeReason` 全集(集合用该类型铸=锁步:core 删词此处 tsc 红,加词这里
- *  补一个词即可)。非法词 boot 响亮拒——盲铸静默折无效成员与 TASK_TIMEOUT_SEC 非法值折「无超时」同族。 */
 const DEGRADE_ON_WORDS = new Set(["breaker_open", "rate_limit", "budget", "server_error", "last_resort"]);
 function parseDegradeOn(words) {
     if (words.length === 0)
@@ -1109,19 +661,6 @@ function parseDegradeOn(words) {
     }
     return words;
 }
-/**
- * #186 — the CC-rule-form arm, split out because it is the ONE arm that also judges an **allow** list.
- *
- * The general "unmatchable name" judgment deliberately spares `allow` (a mistyped live name leaves the allowlist
- * effectively empty ⇒ everything is denied ⇒ fail-CLOSED and immediately visible). A CC-form entry is a different
- * animal: `allow: ["Bash(ps:*)"]` is what a CC user writes to get FEWER prompts, and what they actually get is
- * "only a tool literally named `Bash(ps:*)` may run" ⇒ Bash unavailable, with no warning anywhere. That is a
- * spelling-FAMILY error, not a typo, so it is refused on every list — with the two knobs that really do the job.
- *
- * 🔴 CC 形语义(参数级规则)**已裁不支持,此为终态**(clay 终裁 2026-08-16,sema-comms
- * audits/CLAY-RULINGS.md R-9;历史上已裁多遍,禁再上问)——响亮拒+指路即本面的完整承诺。
- * 判据只认括号的在场,残形(`Bash(ps`)同样拒——半个括号一样永不匹配活名。
- */
 function ccRuleFormGuidance(name) {
     if (!name.includes("(") && !name.includes(")"))
         return undefined;
@@ -1154,8 +693,6 @@ export function findUnmatchableToolNames(names) {
         }
         const ns = protocolOf(name);
         if (ns === undefined) {
-            // 5.3.0 协议表两行起,短名归属不再唯一(figma__x 可能是 mcp 短形或 a2a 短形)——指引枚举全表
-            // 前缀(与 core 5.3.0 自侧同族修同口径),不再手写死 mcp__。
             if (name.includes("__"))
                 out.push({ name, guidance: `pre-prefix short form — the live name carries a protocol prefix: ${PROTOCOL_TABLE.map((e) => `${e.prefix}${name}`).join(" or ")}` });
             continue;
@@ -1166,38 +703,14 @@ export function findUnmatchableToolNames(names) {
     }
     return out;
 }
-/** {@link findUnmatchableToolNames} 的成句形——三条腿的文案同源(只有前缀/出口不同)。 */
 export function formatUnmatchableToolNames(source, bad) {
     return (`${source} names tool(s) that can never match a live tool (these lists are RAW whole-name comparisons — core 5.0.0 RB-476 removed the alias/auto-prefix folds): ` +
         bad.map((b) => `${b.name} → ${b.guidance}`).join("; "));
 }
-/**
- * #151 流内审批协议(design/172)的九键段(车3 刀 3a 五键 + 车5 收敛器四键)。
- *
- * **总开关默认 true**(clay 裁 2026-08-08 走 (a),#164 翻真验证后)。⚠️ 版本坐标:翻转**已在树上生效**,
- * 发布线上它落在 7.4.0 之后的下一个发布(CHANGELOG `Unreleased` 段,预计 7.5.0)—— 所以一台自报 7.4.0
- * 的**已发布** worker 仍是 OFF,而拿 main 构建的 worker 已是 ON。别只按 `/health` 的版本号推默认。显式
- * `STREAM_APPROVAL_ENABLED=false` 是**唯一干净还原键** ⇒ 全链逐字回到翻转前行为(不发
- * approval_request、不落 ask 行、不起收敛器腿、窗仍是 `DEFAULT_APPROVAL_TTL_MS`)。同一裁定把窗默认
- * 从 60s 抬到 300000(= `DEFAULT_APPROVAL_TTL_MS` 的 5min),于是「开协议」不再顺带把窗砍短 ——
- * 当年默认 false + 60s 窗那一版的「谁需要 / 谁被伤 / 什么补偿」成文记录在 `config-types.ts` 的
- * `ServiceConfigFlat.streamApproval` 注里(读它时记得它记的是**翻转前**的前提)。
- * 窗/帽四键沿用 `numEnv` fail-loud 形(坏形启动期炸,不静默折 NaN);
- * 车5 的四键一律 **`numEnvBounded`**(§9 C6:batch 整数 ≥1 有上帽,grace/TTL 非负有界)——它们直接
- * 决定 reaper 每 tick 的库压与「多久算遗孤」,一个手滑的 `0` 或 `1e12` 都是运维事故面。
- *
- * 🔴 跨旋钮不变量(§9 C6,`#157` 三分类 P 族姿势):**`WINDOW + ADHOC_GRACE < ORPHAN_TTL`**。破坏形
- * **拒启** —— 判据 4 在 `expiresAtMs + ADHOC_GRACE` 触发而 `expiresAtMs ≈ createdAtMs + WINDOW`,判据 5
- * 在 `createdAtMs + ORPHAN_TTL` 触发;不等式不成立时判据 5 会先于判据 4 到,一条 adhoc 腿拿到的归因就成了
- * `orphan_ttl_exceeded`(「遗孤兜底」)而不是 `adhoc_leg_no_durable_domain`(「结构上无对账域」),
- * 审计面从此读不出真实成因。⚠️ **窗那一项不能省**(本注上一版只写 `ADHOC_GRACE < ORPHAN_TTL`,与下方
- * 真校验和它的 codex C7 论证矛盾):只比宽限会漏掉窗,例如 WINDOW 与 ORPHAN_TTL 等长时校验放行但遗孤
- * 兜底必定先到。默认值(300s + 60s vs 7d)自然满足;只有显式改坏才会撞上。
- */
 function streamApprovalConfig() {
     const cfg = {
-        enabled: boolEnv("STREAM_APPROVAL_ENABLED", true), // clay 裁 2026-08-08 走 (a):#164 翻真验证后默认 ON;false=唯一干净还原键
-        windowMs: numEnv("STREAM_ASK_WINDOW_MS", "300000"), // 同裁抬 5min:「窗变短」从翻真里摘出,与 sync 腿既有活卡窗对齐
+        enabled: boolEnv("STREAM_APPROVAL_ENABLED", true),
+        windowMs: numEnv("STREAM_ASK_WINDOW_MS", "300000"),
         replayMax: numEnv("STREAM_APPROVAL_REPLAY_MAX", "50"),
         admitMaxPerTask: numEnv("STREAM_APPROVAL_ADMIT_MAX_PER_TASK", "32"),
         admitMaxPerOwner: numEnv("STREAM_APPROVAL_ADMIT_MAX_PER_OWNER", "256"),
@@ -1206,30 +719,14 @@ function streamApprovalConfig() {
         adhocGraceMs: numEnvBounded("STREAM_APPROVAL_ADHOC_GRACE_MS", "60000", 0, 86_400_000),
         orphanTtlMs: numEnvBounded("STREAM_APPROVAL_ORPHAN_TTL_MS", String(7 * 24 * 60 * 60 * 1000), 60_000, 90 * 24 * 60 * 60 * 1000),
     };
-    // 🔴 不变量的**正确形**(codex 交叉复审 C7,2026-08-06 验真):两条臂量的不是同一个起点 ——
-    // 判据 4 在 `expiresAtMs + ADHOC_GRACE` 触发,而 `expiresAtMs ≈ createdAtMs + WINDOW`;判据 5 在
-    // `createdAtMs + ORPHAN_TTL` 触发。只比 `ADHOC_GRACE < ORPHAN_TTL` 会漏掉窗:例如 WINDOW 与
-    // ORPHAN_TTL 等长时校验放行,但遗孤兜底必定先到,adhoc 腿的归因被写成 `orphan_ttl_exceeded`。
-    // 正确判据 = `WINDOW + ADHOC_GRACE < ORPHAN_TTL`(两边都是有界有限值,不会溢出)。
     if (cfg.windowMs + cfg.adhocGraceMs >= cfg.orphanTtlMs) {
         throw new Error(`env STREAM_ASK_WINDOW_MS=${cfg.windowMs} + STREAM_APPROVAL_ADHOC_GRACE_MS=${cfg.adhocGraceMs} must be STRICTLY LESS than STREAM_APPROVAL_ORPHAN_TTL_MS=${cfg.orphanTtlMs} — the adhoc arm fires at (createdAt + window + grace) while the orphan backstop fires at (createdAt + ttl); if the backstop wins, every adhoc-leg row is attributed "orphan_ttl_exceeded" instead of "adhoc_leg_no_durable_domain" (attribution honesty, design/172 §6.1)`);
     }
-    // 整数门(batch 是行数,不是时长):`numEnvBounded` 只管区间,`200.5` 会一路走到 SQL `LIMIT` 上。
     if (!Number.isInteger(cfg.reconcileBatch)) {
         throw new Error(`env STREAM_APPROVAL_RECONCILE_BATCH=${cfg.reconcileBatch} must be an INTEGER row count`);
     }
     return cfg;
 }
-/**
- * #280 R-13 C —— `UNATTENDED_APPROVAL_POLICY` 的闭集解析(#210 A 档:坏值**拒启**)。
- *
- * 词表 = `park`(缺省)| `deny`,**逐字精确匹配**(小写、两侧空白裁掉):`PARK` / `Deny` / `true` / `off`
- * 一律落到拒启臂 —— 与 `MANUAL_MODE_SHELL_GATE` 同姿势,理由逐字同(「看起来被接受了」= 它其实什么都没做,
- * 而这条轴决定的是权限门在无人值守时的终局方向,静默失效是运维面最贵的那一类)。
- * ⚠️ 与 `MANUAL_MODE_SHELL_GATE` 的一处**刻意不同**:本键**没有** `off` 词。它的两个值都是真姿态
- * (park / deny),不存在「这个旋钮不参与」的第三态;空串/未设 = 缺省 `park`,那是文档化的出厂姿态,
- * 不是「关掉」。语义与射程成文见 `config-types.ts` 的域注。
- */
 function unattendedApprovalPolicyEnv() {
     const raw = (process.env.UNATTENDED_APPROVAL_POLICY ?? "").trim();
     if (raw === "")
@@ -1242,16 +739,10 @@ function unattendedApprovalPolicyEnv() {
         `Refusing to boot rather than treating a misspelled value as "unset": that runs the deployment on a policy the operator did not choose, with no trace anywhere`);
 }
 function parseApprovalDomain(ctx) {
-    const { postureOn } = ctx; // 跨域入参②:posture 三态(single-user turnkey ⇒ HITL 面默认 ON)
-    // design/80 D-G: the direct-connect approval door anchors (all must be present to ACTIVATE; fail-closed).
+    const { postureOn } = ctx;
     const directApprovalDoor = boolEnv("DIRECT_APPROVAL_DOOR", false);
     const dgHmacKeys = parseApprovalHmacKeys(process.env.APPROVAL_HMAC_KEYS, announceKeySetRejection("APPROVAL_HMAC_KEYS"));
-    // DURABLE_APPROVAL 既是本域字段,也是直连门的硬前置 —— 那条前置的理由与断言在装配层的跨域不变量段。
     const durableApproval = boolEnv("DURABLE_APPROVAL", false);
-    // [2380] core 5.0.0 RB-476:approval 名单里「永不匹配」的名字**装配期拒启**(带修正指引)。core 自己的
-    // prepare 门(config.legacy_tool_name)在提交期才响——boot 期先拒,部署带失效名单不启动而不是首任务炸。
-    // 名单 RAW 直传(canonicalToolName 折叠面已随 core 退役,见 approval.ts);判据单点见
-    // {@link findUnmatchableToolNames}(env / 中心下发 / per-request 三腿共用同一条)。
     const rejectUnmatchableToolNames = (envName, names) => {
         const bad = findUnmatchableToolNames(names);
         if (bad.length > 0)
@@ -1263,14 +754,11 @@ function parseApprovalDomain(ctx) {
         approvalDeny: rejectUnmatchableToolNames("APPROVAL_DENY", csv("APPROVAL_DENY")),
         durableApproval,
         resourceSuspend: boolEnv("RESOURCE_SUSPEND", false),
-        // #210 B 档:夹取行为逐字保留(存量部署配了越界值不该拒启),但夹取当场点名(env+原值+采用值)。
-        resourceSuspendTtlSec: clampEnvWithWarn("RESOURCE_SUSPEND_TTL_SEC", "0", 0), // 0 ⇒ core default (30d)
-        approvalAutoBudget: clampEnvWithWarn("APPROVAL_AUTO_BUDGET", "0", 0, 10000), // clamp [0,10000]; 0 = off
+        resourceSuspendTtlSec: clampEnvWithWarn("RESOURCE_SUSPEND_TTL_SEC", "0", 0),
+        approvalAutoBudget: clampEnvWithWarn("APPROVAL_AUTO_BUDGET", "0", 0, 10000),
         approvalNeverAuto: rejectUnmatchableToolNames("APPROVAL_NEVER_AUTO", csv("APPROVAL_NEVER_AUTO")),
-        approvalHmacKeys: dgHmacKeys, // D-G: WIRED (see the field's JSDoc); empty ⇒ inactive, not unimplemented
+        approvalHmacKeys: dgHmacKeys,
         directApprovalDoor,
-        // ③ sensitive-path write deny set: unset = core's recommended set; explicit value = full replacement
-        // (comma-separated); "off"/empty = disabled. Set curation is core's (成文 core-side); server passes through.
         sensitiveWritePatterns: ((raw) => {
             if (raw === undefined)
                 return [...RECOMMENDED_SENSITIVE_PATTERNS];
@@ -1279,23 +767,6 @@ function parseApprovalDomain(ctx) {
                 return [];
             return trimmed.split(",").map((p) => p.trim()).filter((p) => p.length > 0);
         })(process.env.SENSITIVE_WRITE_PATTERNS),
-        // [1557]§四 → #153: opt-in only — the two real gate shapes ride; `off`/empty/unset leave the field ABSENT
-        // (no key on the config object at all), so `applyRuntimeGovernance` never receives the knob and THIS knob
-        // contributes nothing to the governance pass. Note that pass can still set `TaskSpec.shellGate` on its own
-        // account — `AUTONOMY=ask` derives "always" independently, and (design/201) an explicit client permission
-        // mode now supplies the BASE档 this knob tightens from.
-        //
-        // design/201 §4 —— 词表与非法值:合法值 = `always | classify | off | 空串/未设`,**其余 boot 拒启**。
-        // 动机是把**既有**风险变响亮而不是防将来:改前任何手滑值(`clasify`/`true`/`ON`)与未设置等效,
-        // 于是「我配了闸」的部署实际在无闸运行,且这件事零留痕。同层先例=`rejectUnmatchableToolNames`
-        // (上方,解析层拒启;#177 的 `assertGuardPatternsUsable` 在 deployment-governance 层,不是本层)。
-        //
-        // 🔴 **与兄弟旋钮的语义不对称是刻意的,禁止将来"统一"**:`SENSITIVE_WRITE_PATTERNS=off` 是一根
-        // **真放松杆**(清空 server 自己的产品默认推荐集 —— off = 对那份默认的显式退出);
-        // `MANUAL_MODE_SHELL_GATE=off` 是 **no-op**(归一成键缺席),因为本键的缺省不属于 server 产品默认,
-        // 而属于**车道翻译轴**(design/201 的 permissionMode 表),env 在这条轴上只有收紧半场、没有放松方向。
-        // 把 off 做成"关闸"就等于给部署级旋钮开一条放松通道,那正是 #153 修掉的病。所以 off 不静默:
-        // 归一的同时发一条 boot 诊断行(下面的 CONFIG_NOTICES),让运维不会按兄弟旋钮的直觉误读。
         ...((raw) => {
             const trimmed = (raw ?? "").trim();
             if (trimmed === "always" || trimmed === "classify")
@@ -1319,7 +790,7 @@ function parseApprovalDomain(ctx) {
                 `Refusing to boot rather than treating a misspelled value as "unset": that silently ran the deployment with NO shell gate while the operator believed one was configured`);
         })(process.env.MANUAL_MODE_SHELL_GATE),
         mcpElicitation: {
-            enabled: boolEnv("MCP_ELICITATION_ENABLED", false), // E23 inbound elicitation; default OFF (fail-closed)
+            enabled: boolEnv("MCP_ELICITATION_ENABLED", false),
             throttle: {
                 maxConcurrentPerRun: numEnvBounded("MCP_ELICITATION_MAX_CONCURRENT", String(DEFAULT_ELICITATION_THROTTLE.maxConcurrentPerRun), 1, 64),
                 maxTotalPerRun: numEnvBounded("MCP_ELICITATION_MAX_TOTAL", String(DEFAULT_ELICITATION_THROTTLE.maxTotalPerRun), 1, 10_000),
@@ -1327,54 +798,21 @@ function parseApprovalDomain(ctx) {
                 ttlMs: numEnvBounded("MCP_ELICITATION_TTL_MS", String(DEFAULT_ELICITATION_THROTTLE.ttlMs), 1_000, 3_600_000),
             },
         },
-        askQuestionEnabled: postureOn("ASK_QUESTION_ENABLED"), // §4④ AskUserQuestion live HITL; posture-gated (single-user → ON)
-        // #166 裁2:AskUserQuestion 裁量窗三旋钮,姿势照 MCP_ELICITATION_* 抄(bounded ⇒ 越界启动期拒,不静默
-        // 夹取)。默认值 = 协调器出厂窗逐字(纯旋钮化,零行为改动)。
+        askQuestionEnabled: postureOn("ASK_QUESTION_ENABLED"),
         questionThrottle: {
             maxConcurrentPerRun: numEnvBounded("QUESTION_MAX_CONCURRENT_PER_RUN", String(DEFAULT_QUESTION_THROTTLE.maxConcurrentPerRun), 1, 64),
             maxTotalPerRun: numEnvBounded("QUESTION_MAX_TOTAL_PER_RUN", String(DEFAULT_QUESTION_THROTTLE.maxTotalPerRun), 1, 10_000),
             ttlMs: numEnvBounded("QUESTION_TTL_MS", String(DEFAULT_QUESTION_THROTTLE.ttlMs), 1_000, 3_600_000),
         },
-        toolApprovalEnabled: postureOn("TOOL_APPROVAL_ENABLED"), // [816]/[820]② live tool-approval HITL; posture-gated (single-user → ON), mirrors askQuestion
-        // #154 车二 → #203:持久化权限规则车道的总开关。**默认 ON**(clay [3396] 裁),理由与它此前默认
-        // OFF 的**唯一**前置(撤销面缺席)逐字见 `ServiceApprovalConfig.permissionRulesEnabled`。
-        // **不**做 posture 派生:这条轴与「单用户交钥匙」无关(多租户同样要它),所以它是一条与部署形态
-        // 正交的普通 opt-out 旋钮,而不是 `postureOn` 那一族。
+        toolApprovalEnabled: postureOn("TOOL_APPROVAL_ENABLED"),
         permissionRulesEnabled: boolEnv("PERMISSION_RULES_ENABLED", true),
-        // 🔴 「运维**显式**表过态吗」是与取值分开的一位(同 `dbBackendExplicit` 的姿势)。它只有一个消费者:
-        // boot 期的休眠行审计(`boot/permission-rules-audit.ts`)——对显式开过的部署说「N 条规则随默认 ON
-        // 激活」是假话,那些行本来就是活的。判据与 `boolEnv` 认的字面量集**同源**(只有 "true"/"false"
-        // 算表态;空串按未设,拼错的值走 boolEnv 的告警臂并落回默认 ⇒ 也不算表态)。
-        // #245:显式表态判别随词表放宽——八词任一在场即「显式」(旧形只认 true/false 两词,=1 的显式关/开
-        // 会被当「未表态」滑进派生腿,恰是 operator-knob 病的判别位变体);未知词由本体 boolEnv 先拒启。
         permissionRulesEnabledExplicit: parseBoolWord("PERMISSION_RULES_ENABLED", process.env["PERMISSION_RULES_ENABLED"]) !== undefined,
-        // #151 车2(design/172 §3.3 D3):ToolApprovalCoordinator 窗长三元的安全余量。numEnv fail-loud 形,
-        // 照邻居旋钮(approvalTimeoutSec 等)抄——坏形（非数字)在启动期炸,不静默折成 NaN。
         streamAskWindowMarginMs: numEnv("STREAM_ASK_WINDOW_MARGIN_MS", "10000"),
-        // #151 车3 刀 3a + 车5(design/172 流内审批协议):九键。默认极性 / 窗值 / 解析形 / 跨旋钮不变量
-        // **一处成文** = 本文件 `streamApprovalConfig()` 的头注,这里不复述 —— 复述的两份必然各自漂,这条注
-        // 的上一版正是这么漂的(默认翻 ON 之后它还写着「总开关默认 false」整整一版)。
-        // 三问记录(翻转前那一版)见 config-types.ts 的 StreamApprovalConfig。
         streamApproval: streamApprovalConfig(),
-        // #280 R-13 C:无人值守政策(闭集 park|deny,缺省 park)。语义/三问/射程边界**一处成文** =
-        // `config-types.ts` 的 `unattendedApprovalPolicy` 域注,这里只解析,不复述(复述的两份必然各自漂)。
         unattendedApprovalPolicy: unattendedApprovalPolicyEnv(),
-        // [875]a 成文:0(缺省)= durable HITL 无限期等人,时间型 reapSuspended 不跑;file/memory lane 的回收
-        // 探针只在 DURABLE_APPROVAL=true 时注入(无 durable 的部署两只 suspended 回收器恒 NO-OP,parked 行的
-        // 恢复把手 = POST /v1/runs/:id/cancel,[868]①)。checkpoint 过期驱动的那只不受本旋钮门控。
         approvalTimeoutSec: numEnv("APPROVAL_TIMEOUT_SEC", "0"),
     };
 }
-/**
- * #210:MEMORY_ENGINE 的**双族**闭集(codex 自审 R1-F3 真修,把第一版的 `on|off` 两词放宽)。
- *
- * 病灶只在**关**的那一侧:改前判据 `!== "off"` 让 `OFF` / `false` / `disabled` / `0` 全部读成「开」——
- * operator 明确表达了「关掉记忆面」,引擎却照常往每个任务里注入记忆目录,而且零留痕。这一侧必须响亮。
- *
- * **开**的那一侧则相反:`true` / `1` / `yes` 改前就落在「开」上,意图与结果一致,把它们改成拒启是**纯
- * 粹的新增故障**——一台按 `MEMORY_ENGINE=true` 跑了很久的部署会在升级时 boot 红,而它的配置从来没错过。
- * 所以两族都收进词表,只有**两族都不认得**的词才拒(那种词无从推断意图,静默倒向任何一侧都是猜)。
- */
 const MEMORY_ENGINE_ON_WORDS = ["on", "true", "1", "yes", "enabled"];
 const MEMORY_ENGINE_OFF_WORDS = ["off", "false", "0", "no", "disabled"];
 function parseMemoryEngineWord(word) {
@@ -1387,17 +825,6 @@ function parseMemoryEngineWord(word) {
         `(engine ON, the default) or ${MEMORY_ENGINE_OFF_WORDS.join(" | ")} (engine OFF). ` +
         `An unrecognized value used to read as "on", so a misspelled kill-switch silently kept memory injection running.`);
 }
-/**
- * #217:`MEMORY_PERSISTENCE_CAPABLE` 的**三态**读取(core 5.26.0 `TaskSpec.memoryPersistenceCapable`)。
- *
- * 与 {@link parseMemoryEngineWord} 共用同一份双族词表(operator 面写法一致,别让同一台机器上的两个记忆
- * 旋钮各认一套词),但**多一个态**:缺席/空串 ⇒ `undefined` ⇒ TaskSpec 上整键缺席 ⇒ core 走自己的推断
- * (三态语义的 absent 腿,零迁移)。空串等同未设,与 MEMORY_ENGINE 同理由(compose 的 `${X:-}` 模板天天产它)。
- *
- * 不认得的词 **拒启**而不是回落:这个键是「本部署能不能替用户记住事情」的真值来源,静默倒向任何一侧都
- * 是猜——倒向 `true` 会让一台其实存不下的部署继续给幻觉式回执(#148 原病),倒向 `false` 会让一台真有
- * 自定义持久通道的部署对用户说假话。
- */
 function parseMemoryPersistenceCapable(raw) {
     if (raw === undefined)
         return undefined;
@@ -1413,18 +840,14 @@ function parseMemoryPersistenceCapable(raw) {
         `\`# Memory\` write instruction on a remote execution lane) or ${MEMORY_ENGINE_OFF_WORDS.join(" | ")} (it CANNOT — ` +
         `forces the read-only disclosure). Leave it UNSET to let the engine infer from the mounted roster.`);
 }
-/** #210:SANDBOX_PKG_SOURCE 的闭集校验(词表 = README/MIGRATION 成文的四词)。`none` 由调用点的三元
- *  链先摘走(字段整个缺席),留在这里的只可能是前三词或一个手滑值。 */
 const SANDBOX_PKG_SOURCES = ["global", "cn", "custom", "none"];
 function pkgSourceEnv() {
-    const v = env("SANDBOX_PKG_SOURCE", "global"); // 空串/未设 ⇒ "global"(改前 `|| "global"` 的逐字语义)
+    const v = env("SANDBOX_PKG_SOURCE", "global");
     if (!SANDBOX_PKG_SOURCES.includes(v)) {
         throw new Error(`env SANDBOX_PKG_SOURCE="${v}" must be one of: ${SANDBOX_PKG_SOURCES.join(", ")}`);
     }
     return v;
 }
-/** #210:TOC 同步腿的一条**条数上限**。未设 ⇒ 键缺席(core 默认,改前行为);设了就必须是 ≥1 的整数,
- *  否则 boot 拒 —— 「设了上限却静默丢弃」等价于「无上限」,方向与 operator 的意图相反。 */
 function syncEntryCap(name, field) {
     const raw = process.env[name];
     if (raw === undefined || raw === "")
@@ -1434,28 +857,11 @@ function syncEntryCap(name, field) {
         throw new Error(`env ${name}="${raw}" must be an integer >= 1 (it is an entries-per-batch cap; an ignored cap means NO cap)`);
     return { [field]: n };
 }
-/**
- * #219(黑板 [3617]):`SEMA_PARENT_PID` —— 引擎 parent 监视的**唯一**开关(壳侧 cli 已确认这个名字)。
- *
- * 三态,与 `syncEntryCap` 同族(#210 A 档「坏值拒启」):
- *  · 未设 / 空串 ⇒ **键缺席**,整件不装配(opt-in;存量部署逐字零变化,零 warn);
- *  · 正整数 ⇒ 原样进配置;
- *  · 其余(0 / 负数 / 小数 / 非数字 / 带单位后缀)⇒ **拒启**并指路。
- *
- * 为什么坏值不静默回默认:本键的"默认"就是**整件不装配**,于是静默回默认 = operator 设了监视、进程
- * 照常起、监视根本不在 —— 恰恰是这个键要防的那类"孤儿引擎"在无人知晓的情况下继续发生。而且坏值的
- * 另一半后果更隐蔽:`0` 在 `process.kill(0, 0)` 里的语义是**当前进程组**(探活恒成功=监视永不触发),
- * 负数是**进程组** id(探到的根本不是父进程);这两个值不是"差一点对",是语义完全不同的另一件事。
- */
 function parentPidEnv() {
     const raw = process.env.SEMA_PARENT_PID;
     if (raw === undefined || raw.trim() === "")
         return {};
     const n = Number(raw);
-    // 上界 = int32 最大值:`process.kill` 的 pid 形参是 int32,`2147483648` 抛的是 `ERR_INVALID_ARG_TYPE`
-    // 而**不是** ESRCH(codex 复审 M,实测证实)。落在探活的"未知 errno ⇒ 保守判活"支上,后果是:配置
-    // 过了校验、`parent_watch_armed` 照打、之后每一拍都被当成"父还活着" —— 监视永久失效。校验面必须只
-    // 放行 process.kill 真吃得下的范围,才对得起"设了就一定在监视"这句承诺。
     if (!Number.isInteger(n) || n < 1 || n > 2_147_483_647) {
         throw new Error(`env SEMA_PARENT_PID="${raw}" must be a POSITIVE INTEGER process id in [1, 2147483647] — it is the pid this ` +
             `engine watches (the shell/supervisor that spawned it); 0 and negatives mean "process GROUP" to ` +
@@ -1464,28 +870,7 @@ function parentPidEnv() {
     }
     return { parentPid: n };
 }
-/**
- * #228(黑板 [3590]/[3606] 两裁):`MEMORY_EMBEDDER_*` 族 —— 记忆检索向量面的**唯一**开关。
- *
- * 三态(与 `MEMORY_SYNC_*` 半配拒启同族):
- *  · 三键全缺席 ⇒ `undefined`,不注入 embedder,现状零变化(检索恒 lexical 词面档);
- *  · 半配(1~2 键)⇒ **拒启并点名缺哪几键**(REQUIRED_ENVS_BY_LANE 的报文形)。静默忽略的后果不是
- *    功能缺席,而是 operator 以为向量面开着——检索照常出结果,差异只在答案质量里,零日志;
- *  · 坏值(URL 不合法 / 非 http(s) / DIM 非正整数 / TIMEOUT 非法或越界)⇒ 拒启带指路(#210 A 档)。
- *
- * 另两条门(都是「配了但永远不生效」的死旋钮形,一律拒启而非 warn):
- *  · `MEMORY_ENGINE_BACKEND` 必须是 `pg` —— tidb 记忆后端 v1 无向量档(传 embedder 它自己 fail-loud
- *    拒),file 引擎没有 embedder 接缝;
- *  · 记忆引擎本身必须开着(`MEMORY_ENGINE != off`)。
- *
- * 维度守卫的**位置**(诚实记档):本仓建 pg 记忆表时不传 `memoryVector`(见 boot/stores.ts 的
- * `ensurePgMemoryEngineSchema(q)`),即 embedding 列是 `jsonb`、schema 侧**没有可对表的维度常量**;
- * 所以 boot 期能做的只有「DIM 是正整数」,真正的维度守卫在写入路径两处:① 本仓 embedder 拿到长度
- * 不符的响应直接抛(绝不截断/补零);② `PgMemoryEngineBackend.embeddingParam` 对长度不符的向量返回
- * null(该行退回词面档,不写坏向量)。
- */
 function parseMemoryEmbedder(ctx) {
-    // 空串 = 未设(compose `${X:-}` 模板天天产它,本仓一律同判)
     const endpoint = process.env.MEMORY_EMBEDDER_ENDPOINT || undefined;
     const model = process.env.MEMORY_EMBEDDER_MODEL || undefined;
     const dimRaw = process.env.MEMORY_EMBEDDER_DIM || undefined;
@@ -1498,14 +883,11 @@ function parseMemoryEmbedder(ctx) {
     ];
     const missing = trio.filter(([, v]) => v === undefined).map(([name]) => name);
     if (missing.length === 3) {
-        // 三键全缺席 = 文档化的默认姿态(不注入)。但**从属**两键单独在场 = 同款半配陷阱:operator 调了
-        // 超时/配了 key,却一个向量都不会算(MEMORY_SYNC_TOKEN/SCOPE 无 URL 对称拒启的同款先例)。
         if (timeoutRaw !== undefined || apiKey !== undefined) {
             throw new Error(`MEMORY_EMBEDDER_TIMEOUT_MS/MEMORY_EMBEDDER_API_KEY are set but the embedder itself is not configured — refusing to start half-configured (set MEMORY_EMBEDDER_ENDPOINT, MEMORY_EMBEDDER_MODEL and MEMORY_EMBEDDER_DIM to enable the memory vector plane, or unset the other MEMORY_EMBEDDER_* keys)`);
         }
         return undefined;
     }
-    // 三键缺任一(TS 也靠这一支收窄,不需要非空断言)
     if (endpoint === undefined || model === undefined || dimRaw === undefined) {
         throw new Error(`MEMORY_EMBEDDER_* is half-configured — missing ${missing.join(", ")}. The memory vector plane needs all three of MEMORY_EMBEDDER_ENDPOINT, MEMORY_EMBEDDER_MODEL, MEMORY_EMBEDDER_DIM; refusing to start rather than silently running lexical-only retrieval while the deployment believes vectors are on (#228).`);
     }
@@ -1517,9 +899,6 @@ function parseMemoryEmbedder(ctx) {
     if (proto !== "http:" && proto !== "https:") {
         throw new Error(`MEMORY_EMBEDDER_ENDPOINT="${endpoint}" must be http(s) (got "${proto}") — the embedder leg is an HTTP POST to an OpenAI-compatible /embeddings face`);
     }
-    // URL 里的 userinfo 一律拒(codex 二轮 F1):`https://user:pass@host/v1` 形把凭据种进一个会被
-    // 传输层错误、日志、PatchReport 冲突文案反复复制的字符串里 —— 脱敏只能事后擦,拒收才是源头。
-    // 需要 auth 就走 MEMORY_EMBEDDER_API_KEY(Bearer 头,不进 URL)。
     if (parsedEndpoint.username !== "" || parsedEndpoint.password !== "") {
         throw new Error("MEMORY_EMBEDDER_ENDPOINT must not carry credentials in the URL (user:password@host) — URL userinfo leaks into transport errors, logs and memory conflict reports. Use MEMORY_EMBEDDER_API_KEY (sent as a Bearer header) instead.");
     }
@@ -1537,48 +916,19 @@ function parseMemoryEmbedder(ctx) {
         endpoint,
         model,
         dimensions,
-        // 活性保护:挂死的 embedder 会把整条记忆写入路径吊住(undici 默认 headers 超时 300s 太钝)。
-        // 下界 1s(比这更短的向量调用只会全轮超时);上界 5min(再长就不是超时保护了)。
         timeoutMs: numEnvBounded("MEMORY_EMBEDDER_TIMEOUT_MS", "30000", 1000, 300_000),
         ...(apiKey !== undefined ? { apiKey } : {}),
     };
 }
-/** 域:memory(记忆面 + TOC 同步腿)—— 记忆引擎开关/方言/根目录、scope 缺省、同步 client 三键、项目记忆。 */
 function parseMemoryDomain(ctx) {
-    const { requirePrincipal } = ctx; // 跨域入参①:多租户下记忆面 DARK(scope 缺省不铸)
-    // design/138 S1 (clay 2026-07-08): long-term memory = the injection-first file-based memory ENGINE
-    // (core RunnerDeps.memoryBackend), default ON with MEMORY_ENGINE=off as the explicit kill-switch.
-    // The legacy MEMORY_BACKEND/EMBEDDING_* store plane was dropped without migration (those env vars are
-    // no longer read). Single-user gating lives in main.ts (the engine is never wired multi-tenant).
-    // #210 A 档(黑板 [3425]③):判据从 `!== "off"` 改**闭集**(姿势仿下面的 MEMORY_ENGINE_BACKEND)。
-    // 旧判据的病:任何非 `off` 的字面量都读成「开」—— `MEMORY_ENGINE=OFF` / `=false` / `=disabled` 是
-    // operator 明确表达「关掉记忆面」的三种最常见写法,每一种都让引擎**照常开着**并继续往任务里注入记忆
-    // 目录。这是「拼错的关词 = 静默不关」,与安全轴的词表纪律同族,所以拒启而不是 warn:一个自以为关了
-    // 记忆的部署,和一个明知开着的部署,不是同一个隐私姿态。
-    // ⚠️ 走 `env()` 而不是 `enumEnv()`:后者拿 `??` 取值,会把**空串**当成一个要比对词表的值 —— 而空串
-    // 在本仓一律等同未设(compose 的 `${MEMORY_ENGINE:-}` 模板天天产它),改前 `"" !== "off"` 也确实读成
-    // 「开」。词表化不该顺手把空串变成拒启。
+    const { requirePrincipal } = ctx;
     const memoryEngineEnabled = parseMemoryEngineWord(env("MEMORY_ENGINE", "on"));
-    // S3-TOB(边界重切后的 backend 选择,设计 §1.3):记忆持久面方言。缺省 file=现状零变化;
-    // pg/tidb=DB 真身(零卷主档)——多租户点亮的唯一门(显式 opt-in,复审 F5:绝不静默翻转)。
     const memoryEngineBackendRaw = process.env.MEMORY_ENGINE_BACKEND ?? "file";
     if (!["file", "pg", "tidb"].includes(memoryEngineBackendRaw)) {
         throw new Error(`MEMORY_ENGINE_BACKEND must be file|pg|tidb, got "${memoryEngineBackendRaw}"`);
     }
     const memoryEngineBackend = memoryEngineBackendRaw;
-    // Single-user memory scope (hoisted from the config literal so the sync-scope default below can consume it):
-    // explicit MEMORY_SCOPE always wins; default "local" only when the engine is on AND single-user (see the
-    // literal-site comment on why multi-tenant/engine-off must stay undefined = memory dark).
     const memoryScope = process.env.MEMORY_SCOPE ?? (memoryEngineEnabled && !requirePrincipal ? "local" : undefined);
-    // 142-S2.5-W1: TOC 同步 client 腿的三键(file memory 形态专用)。MEMORY_SYNC_URL 设了=开;
-    // 缺省 undefined=纯本地现状零变化。半配置 fail-loud(memoryEngineBackend 同款姿势,绝不静默降级):
-    //  - URL 有 TOKEN 无 ⇒ throw(中心同步面要 Bearer,缺 token 的“开了但永远 401”是半配置陷阱);
-    //  - TOKEN/SCOPE 有 URL 无 ⇒ throw(operator 显然想开同步,静默不跑=同款陷阱,对称拒启);
-    //  - DB backend(pg/tidb)配了任意同步键 ⇒ throw(中心侧自己就是 POST /v1/memory/sync/:scope 的权威,
-    //    不该再跑 client 腿——两个半场叠在一个进程是拓扑错误)。
-    // scope 缺省 = formatUserScope(memoryScope)(中心侧 owner 门的 user 盘键铸法);memoryScope 本身已是
-    // v2 typed key(user:/org:/proj:/userproj:,只可能来自 operator 显式 MEMORY_SCOPE)则原样直通——
-    // 再包一层会铸出 `user:user%3A...` 双包键(诚实偏离,报告记档)。
     const memorySyncUrl = process.env.MEMORY_SYNC_URL || undefined;
     const memorySyncToken = process.env.MEMORY_SYNC_TOKEN || undefined;
     const memorySyncScopeRaw = process.env.MEMORY_SYNC_SCOPE || undefined;
@@ -1595,17 +945,10 @@ function parseMemoryDomain(ctx) {
         if (memorySyncToken === undefined) {
             throw new Error("MEMORY_SYNC_URL is set but MEMORY_SYNC_TOKEN is not — refusing to start half-configured (the central sync face requires a bearer token)");
         }
-        // A-002.4:前缀判据的**唯一属主**是 memory-scope.ts(此处曾有一份逐字副本;两处咬合用途不同,
-        // 但 core 加第五种 typed 前缀时必须一起动,否则同一个键在「挂 v2 标」和「算不算已是 v2 键」两处
-        // 得出相反答案 ⇒ 这里会把它再包成 `user:user%3A…` 双包键)。
         const scope = memorySyncScopeRaw ?? (memoryScope !== undefined ? (isV2ScopeKey(memoryScope) ? memoryScope : formatUserScope(memoryScope)) : undefined);
         if (scope === undefined) {
             throw new Error("MEMORY_SYNC_URL is set but no sync scope is derivable (memory engine off or multi-tenant without an explicit scope) — set MEMORY_SYNC_SCOPE, or run the single-user file memory engine so MEMORY_SCOPE (default \"local\") provides one");
         }
-        // #210 A 档:两条上限改**拒启**(与本块自己的「半配置 fail-loud」纪律同源)。旧形是
-        // `Number.isInteger(v) && v>=1` 的三态过滤——不满足就**整个键消失**,而键消失 = core 走自己的默认
-        // = 「没有这条上限」。也就是说 operator 设了一条**收紧**用的上限、结果得到的是最松的那一档,而且
-        // 三种手滑(单位后缀 / 小数 / 0)都落到同一个静默出口。
         memorySync = {
             url: memorySyncUrl,
             token: memorySyncToken,
@@ -1614,57 +957,27 @@ function parseMemoryDomain(ctx) {
             ...syncEntryCap("MEMORY_SYNC_MAX_PULL_ENTRIES", "maxPullEntries"),
         };
     }
-    // design/158 B4 ② 的 D 家族四枚里,唯一落在 ServiceConfig 上的就是这枚(其余三枚只在使用点懒读,
-    // 预登记留在 orchestration 域 —— 顺序与改前一致:本枚的弃用通知仍先于那三枚)。
     const projectMemoryEnabled = boolEnvWithLegacyNegated("PROJECT_MEMORY_ENABLED", "PROJECT_MEMORY_DISABLED", true);
-    // design/170 件A(clay 三裁 [2687]):org 记忆准入四旋钮。模式=enumEnv 二值非布尔(N9),默认
-    // enforce(裁2:audit-first 灰度步免除,audit 降级为运维诊断位);TTL/退避窗=numEnvBounded 启动期
-    // 报错(env-numeric-fail-loud 门,F6:optFinitePositiveEnv 的静默回默认恰是要消灭的形)。单机目录
-    // env 表在这里就整段校验(fail-loud 越早越好——一张半坏的授权表比拒绝启动更危险),config 上只存
-    // 原文(纯数据;Map 在装配点重建)。
     const memoryOrgAdmissionMode = enumEnv("MEMORY_ORG_ADMISSION_MODE", "enforce", ["audit", "enforce"]);
-    // 原文存 config(纯数据);整段 fail-loud 校验(parseOrgDirectoryStatic)在装配点——它传递值引
-    // security.js(assertPrincipalShape),而 base config 层禁值引 auth 模块(design/158 A4 分层),
-    // 校验不能放这里。装配点仍在启动期,坏表照样拒启动。
     const memoryOrgDirectoryJson = process.env.MEMORY_ORG_DIRECTORY_JSON || undefined;
     const memoryOrgGrantTtlMs = numEnvBounded("MEMORY_ORG_GRANT_TTL_MS", "60000", 1000, 3_600_000);
     const memoryOrgUnavailableBackoffMs = numEnvBounded("MEMORY_ORG_UNAVAILABLE_BACKOFF_MS", "10000", 500, 600_000);
     return {
         memoryEngineEnabled,
         memoryEngineDir: process.env.MEMORY_ENGINE_DIR || undefined,
-        memoryEngineRemoteLaneAllowed: process.env.MEMORY_ENGINE_REMOTE_LANE === "allow", // N0: fail-closed default
-        // A single-user deployment has no principal, so `memoryScopeFor` falls back to `config.memoryScope` — and if
-        // THAT were unset the resolved scope would be undefined ⇒ resolveSpec builds NO `spec.memory` ⇒ the memory
-        // engine never materializes (the "wired-not-triggered" gap a §4 real test hit on the legacy plane).
-        // Default it to "local" for single-user (REQUIRE_PRINCIPAL !== "true") so TOC local memory works out-of-the-box
-        // (CC-parity). Multi-tenant memory is DARK by design (design/138 S1: the file basement has no tenant isolation —
-        // memoryScopeFor returns undefined there). An explicit MEMORY_SCOPE always wins.
+        memoryEngineRemoteLaneAllowed: process.env.MEMORY_ENGINE_REMOTE_LANE === "allow",
         memoryEngineBackend,
-        memoryScope, // hoisted above (the 142-S2.5-W1 sync-scope default consumes it)
-        // #217:三态 ⇒ 只有真表态才上键(缺席腿必须是**整键缺席**,不是 present-as-undefined —— 后者会被
-        // resolve-spec 原样搬上 TaskSpec,把 core 的「absent = 各自推断」读成一个显式表态)。
+        memoryScope,
         ...((v) => (v !== undefined ? { memoryPersistenceCapable: v } : {}))(parseMemoryPersistenceCapable(process.env.MEMORY_PERSISTENCE_CAPABLE)),
         ...(memorySync ? { memorySync } : {}),
-        // #228:向量面接线(三态解析 + 后端/引擎两门,全在 parseMemoryEmbedder 里 fail-loud)
         ...((v) => (v !== undefined ? { memoryEmbedder: v } : {}))(parseMemoryEmbedder({ memoryEngineBackend, memoryEngineEnabled })),
         memoryOrgAdmissionMode,
-        // #299(core 5.45.0 design/324):委派臂的证据标准。**缺席 = 整键缺席**(不是 present-as-undefined,
-        // 也不是折成 core 的缺省词)—— 本仓不复制上游缺省,上游改缺省之日起这里不会成为第二份真源
-        // (`READ_FACE` 同姿态,#246)。设了就必须是闭集两词之一:坏词在 `enumEnv` 里响亮拒(#210),
-        // 而不是等到 core 的 prepare 门上才炸 —— 部署配错应当在**启动期**被点名,不是第一个任务失败时。
         ...(process.env.MEMORY_DELEGATION_EVIDENCE !== undefined
             ? { memoryDelegationEvidence: enumEnv("MEMORY_DELEGATION_EVIDENCE", "static-face", ["static-face", "attested-only"]) }
             : {}),
-        // #307 件4(core 5.46.0 design/336 §13-3):provenance 总开关。与上一条**逐字同姿态** ——
-        // 缺席=整键缺席(不复制上游缺省),设了就必须是闭集两词之一。坏值在 `enumEnv` 里**启动期**响亮拒:
-        // `false`/`none`/`disabled` 这类"看起来像关掉"的写法若被静默折成缺省,一台自认为「暴露会话零收录」
-        // 的部署其实在照常收录 —— 部署级旋钮坏值禁静默回默认(#210 + operator-knob-must-be-unconditional)。
         ...(process.env.MEMORY_PROVENANCE !== undefined
             ? { memoryProvenance: enumEnv("MEMORY_PROVENANCE", "carry", ["off", "carry"]) }
             : {}),
-        // debt #322-B(core 5.48 C18):委派入口 caps。两 env 各自独立可设;设了=numEnvBounded 启动期
-        // 响亮拒坏值(#210),缺席=键不铸(core 自缺省 CC parity 20/200,不复制上游缺省)。pair 合法性
-        // (concurrent ≤ cumulative)归 core prepare 的 `config.delegation_entry_caps` 门,单判官不复刻。
         ...(process.env.DELEGATION_MAX_CONCURRENT !== undefined || process.env.DELEGATION_MAX_PER_SESSION !== undefined
             ? {
                 delegationEntryCaps: {
@@ -1676,39 +989,16 @@ function parseMemoryDomain(ctx) {
         ...(memoryOrgDirectoryJson !== undefined ? { memoryOrgDirectoryJson } : {}),
         memoryOrgGrantTtlMs,
         memoryOrgUnavailableBackoffMs,
-        projectMemoryEnabled, // design/113 C4 opt-out, flipped positive in design/158 B4 (3.0.0 起 legacy PROJECT_MEMORY_DISABLED = fail-loud 墓碑)
-        syncImportLeaseStaleSec: clampEnvWithWarn("SYNC_IMPORT_LEASE_STALE_SEC", "600", 0), // #210 B 档
+        projectMemoryEnabled,
+        syncImportLeaseStaleSec: clampEnvWithWarn("SYNC_IMPORT_LEASE_STALE_SEC", "600", 0),
     };
 }
-/**
- * design/170 件B/C/D —— 三条**部署治理声明**的 env 解析(auth 域的一段,fail-loud 全在这里)。
- *
- * 三条的词表真源都在 core(`ComplianceProfile` / `ComplianceCapability` / `LOCKED_KEY_REGISTRY`),本函数
- * 只负责「env 文本 → 闭集值」这一步,并且**每一步坏值都拒启**:这三根旋钮全在安全/治理轴上,一个静默
- * 不生效的档位或一个拼错的锁键,是「以为在管、其实没管」——比没配更贵(#210 A 档 + design/170 §3.4)。
- *
- * 半配也拒:`COMPLIANCE_ADDITIONAL_DENIES` 没有 profile 可收紧时是一句无处安放的话,静默丢掉它等于
- * 让 operator 以为多禁了一条(与 `MEMORY_EMBEDDER_*` 的半配拒启同族)。
- */
-/** #270 车2 —— sweep 节律的上界(秒)。`setInterval` 的 delay 是 32 位有符号毫秒(2^31-1);越界会被
- *  Node **重置成 1ms**,理由与拒启判据见调用点。导出供判据与文档单点引用。 */
 export const RETENTION_SWEEP_INTERVAL_MAX_SEC = Math.floor((2 ** 31 - 1) / 1000);
 function parseGovernanceDeclarations() {
     const out = { retentionSweep: { mode: "audit-only", intervalSec: 0 } };
-    /**
-     * codex 对抗复审 F1(high,验真后采纳)——**「未定义」与「定义了但是空」必须分开**。
-     *
-     * 病:模板化部署(k8s manifest、compose 的 `env_file`、`KEY=$(VAR)` 替换)极易产出一个**定义了但值为
-     * 空**的变量。若照本仓其它 env 的惯例把它折成「未设」,一个明明写下了档位/锁声明的部署会**静默**以
-     * 零档位零锁启动 —— 治理面静默失效正是这一族旋钮存在的理由,它不能自己犯这个病。
-     *
-     * 判据因此是:**未定义 = 文档化的缺省姿态(零 warn,#210「缺席不在律内」);已定义但解析不出内容 =
-     * 配错了 ⇒ 拒启 + 指路「要缺省就 unset,别留空」。** 迁移代价为零:三根都是本批新增的旋钮,现存部署
-     * 一个都没设过,所以这条更严的判据不会打到任何在跑的部署。
-     */
     const requireNonBlank = (name, raw) => {
         if (raw === undefined)
-            return undefined; // 未定义 = 缺省姿态
+            return undefined;
         const trimmed = raw.trim();
         if (trimmed === "" || trimmed.split(",").every((t) => t.trim() === "")) {
             throw new Error(`env ${name} is set but empty (or has no parseable value) — a governance declaration that arms nothing must not boot silently. ` +
@@ -1716,7 +1006,6 @@ function parseGovernanceDeclarations() {
         }
         return trimmed;
     };
-    // 件B:合规档位。profile 闭集由 core 的内建 deny 表的键集给出(词表单一真源,不在这里抄一份)。
     const profileRaw = requireNonBlank("COMPLIANCE_PROFILE", process.env.COMPLIANCE_PROFILE) ?? "";
     requireNonBlank("COMPLIANCE_ADDITIONAL_DENIES", process.env.COMPLIANCE_ADDITIONAL_DENIES);
     const denyRaw = csv("COMPLIANCE_ADDITIONAL_DENIES");
@@ -1735,24 +1024,16 @@ function parseGovernanceDeclarations() {
     else if (denyRaw.length > 0) {
         throw new Error("COMPLIANCE_ADDITIONAL_DENIES is set but COMPLIANCE_PROFILE is not — additional denies only ever TIGHTEN a profile's builtin floor, so half of this configuration cannot be applied");
     }
-    // 件C:锁定层声明。校验走 core 的 `resolveLockedKeys`(注册表是它的,未知键抛 config.locked_registry)。
     requireNonBlank("LOCKED_CONFIG_KEYS", process.env.LOCKED_CONFIG_KEYS);
     const lockedRaw = csv("LOCKED_CONFIG_KEYS");
     if (lockedRaw.length > 0) {
-        resolveLockedKeys({ keys: lockedRaw }); // fail-loud;顺序保留交给下一行
+        resolveLockedKeys({ keys: lockedRaw });
         out.lockedConfigKeys = lockedRaw;
     }
-    // 件D:留存期。删数据的旋钮 ⇒ A 档拒启(`0` 合法:立即可删,是可评估的显式表达)。
-    // ⚠️ 空串必须走上面那道门:`Number("")` 是 **0**(有限!)—— 折成「立即可删」比折成「未设」更坏。
     const retentionRaw = requireNonBlank("RETENTION_MAX_AGE_DAYS", process.env.RETENTION_MAX_AGE_DAYS);
     if (retentionRaw !== undefined) {
         out.retentionPolicy = { maxAgeDays: parseNumOrFailNonNegative("RETENTION_MAX_AGE_DAYS", retentionRaw) };
     }
-    // ── #270 车2:执行面的两根旋钮(策略说"保留多久",这两根说"谁在什么节律上按它删")。
-    //
-    // 🔴 灰度档是**闭集**,拼错即拒(#157 词表纪律)。静默落回 `audit-only` 会让运维以为在删而其实没删;
-    //    静默落成另一档就是反方向那件更坏的事。词表从 config-types 的 `RETENTION_MODES` 单点读,
-    //    能力位/审计行的 `mode` 列与它同源。
     const modeRaw = requireNonBlank("RETENTION_MODE", process.env.RETENTION_MODE);
     if (modeRaw !== undefined) {
         if (!RETENTION_MODES.includes(modeRaw)) {
@@ -1762,21 +1043,12 @@ function parseGovernanceDeclarations() {
         }
         out.retentionSweep.mode = modeRaw;
     }
-    // 🔴 节律必须是**非负整数秒**:`Math.round` 掉一个小数会把"配错了"变成"配得有点怪但跑起来了",而
-    //    这条腿是每小时一拍的后台删除活 —— `0.5` 只可能是把毫秒/分钟当成秒写的手滑。`0` 是显式关(默认)。
     const sweepRaw = requireNonBlank("RETENTION_SWEEP_INTERVAL_SEC", process.env.RETENTION_SWEEP_INTERVAL_SEC);
     if (sweepRaw !== undefined) {
         const n = parseNumOrFailNonNegative("RETENTION_SWEEP_INTERVAL_SEC", sweepRaw);
         if (!Number.isInteger(n)) {
             throw new Error(`env RETENTION_SWEEP_INTERVAL_SEC=${n} must be a whole number of seconds (0 = the lane is off)`);
         }
-        // 🔴 上界 = `setInterval` 的 32 位 delay 上限(codex 对抗复审 R1-[high],验真属实)。
-        // 病:delay 超过 2^31-1 ms 时 Node 打一条 `TimeoutOverflowWarning` 并把它**重置成 1ms** —— 一个想
-        // 「约 25 天扫一次」的 enforce 部署于是变成几乎连续扫库,而这条腿每一拍发的都是跨十余张表的
-        // **破坏性**事务。夹取在这里同样是错的补偿(悄悄改小 = 换一个运维没要的策略),拒启才是
-        // ——与 `RETENTION_MAX_AGE_DAYS` 那根「删数据的旋钮不许 NaN 流通」同一条判据。
-        // 顺带这条上界也保住了 TTL 算术:`intervalSec*1000*RETENTION_LEASE_TTL_FACTOR + Date.now()` 在
-        // 本上界内离 `Number.MAX_SAFE_INTEGER` 还差九个数量级。
         if (n > RETENTION_SWEEP_INTERVAL_MAX_SEC) {
             throw new Error(`env RETENTION_SWEEP_INTERVAL_SEC=${n} exceeds ${RETENTION_SWEEP_INTERVAL_MAX_SEC} (setInterval's 32-bit delay ceiling, ~24.8 days) — ` +
                 `Node would silently RESET an overflowing delay to 1ms, turning an "occasional" retention sweep into a nearly continuous stream of ` +
@@ -1786,22 +1058,12 @@ function parseGovernanceDeclarations() {
     }
     return out;
 }
-/** 域:auth(身份/凭证/绑址)—— service token 面、CORS、principal 头与开关、JWT 锚、autonomy、绑址。 */
 function parseAuthDomain(ctx) {
-    const { requirePrincipal } = ctx; // 装配层已解析(它是四个域的共同入参),本域只负责把它落到字段上
-    // design/80 D-G 直连门的 principal-JWT 锚:验签材料属 auth 域,门的激活与半开门不变量在装配层。
+    const { requirePrincipal } = ctx;
     const principalJwtPubkeys = parsePrincipalJwks(process.env.PRINCIPAL_JWT_PUBKEYS, announceKeySetRejection("PRINCIPAL_JWT_PUBKEYS"));
     const principalJwtIss = process.env.PRINCIPAL_JWT_ISS || undefined;
     const principalJwtAud = process.env.PRINCIPAL_JWT_AUD || undefined;
-    // #210:E 类里**唯一升档为拒启**的一条(其余 23 条保留夹取+点名)。理由是夹取方向与旋钮语义相反:
-    // `0` 在这条上是「无上限」的**显式表达**,于是 `Math.max(0, -1)` 把一个想收紧到「负数=全拒」的手滑
-    // 值,悄悄翻译成了整条上限里**最松**的那一档。收紧意图落成最松结果 ⇒ 夹取在这里是错的补偿,拒启才是。
-    // 复用既有原语 `parseNumOrFailNonNegative`(而不是 numEnvBounded 配一个假上界):它说的正是这条旋钮要
-    // 的判据「非负」,报错文案也直说;凭空塞一个上帽是 R2-F2 那一类的同族错。
-    const principalJwtMaxTtlSec = parseNumOrFailNonNegative("PRINCIPAL_JWT_MAX_TTL_SEC", env("PRINCIPAL_JWT_MAX_TTL_SEC", "120")); // 0 = no cap; default ≤120s
-    // Per-system service credentials (token → system name). Parsed as a DOMAIN field (not inline in the return
-    // literal) so the bake boot invariant at the assembly layer can assert the runner-credential→runnerPrincipal
-    // mapping exists.
+    const principalJwtMaxTtlSec = parseNumOrFailNonNegative("PRINCIPAL_JWT_MAX_TTL_SEC", env("PRINCIPAL_JWT_MAX_TTL_SEC", "120"));
     const authTokens = Object.fromEntries((process.env.SERVICE_AUTH_TOKENS ?? "")
         .split(",")
         .map((s) => s.trim())
@@ -1809,8 +1071,6 @@ function parseAuthDomain(ctx) {
         .map((s) => [s.slice(0, s.indexOf("=")).trim(), s.slice(s.indexOf("=") + 1).trim()])
         .filter(([tok, sys]) => tok.length > 0 && sys.length > 0));
     return {
-        // [2354]:HOST 读取臂已删(zsh 恒设 HOST=机器名,不可墓碑——静默不读;cli/桌面 [2053] 起已传
-        // BIND_HOST)。绑址唯一口=BIND_HOST;空串=未设。
         bindHost: process.env.BIND_HOST || undefined,
         bindHostSource: process.env.BIND_HOST ? "BIND_HOST" : undefined,
         authToken: process.env.SERVICE_AUTH_TOKEN,
@@ -1819,11 +1079,7 @@ function parseAuthDomain(ctx) {
         corsOrigins: (process.env.CORS_ORIGIN ?? "").split(",").map((s) => s.trim()).filter(Boolean),
         principalHeader: headerNameEnv("PRINCIPAL_HEADER", "x-agent-principal"),
         requirePrincipal,
-        // Runtime governance second baton (center §10): AUTONOMY env for the env/local path; sema-registry overlays
-        // it (applyRuntimeHot). commandPolicy is structured config — sema-registry-only (no flat env scalar form).
         autonomy: parseAutonomy(process.env.AUTONOMY),
-        // design/170 件B/C/D:三条部署治理声明(解析与 fail-loud 全在 parseGovernanceDeclarations;
-        // 三键都是可选的,未配 = 键不在 = 现存部署逐字零影响)。
         ...parseGovernanceDeclarations(),
         operatorPrincipals: csv("OPERATOR_PRINCIPALS"),
         principalJwtPubkeys,
@@ -1832,53 +1088,25 @@ function parseAuthDomain(ctx) {
         principalJwtMaxTtlSec,
     };
 }
-/** 域:orchestration(编排 + 执行车道)—— remoteExec 五车道/worktree 隔离、leader/router/scheduler/fork、
- *  workflow 与后台 agent 的存留旋钮、沙箱面(pkg 源/env facts/LSP)、烤镜像门。 */
 function parseOrchestrationDomain(ctx) {
-    const { postureOn } = ctx; // 跨域入参②:posture 三态(single-user turnkey ⇒ 自编排/fork/scheduler 默认 ON)
-    // workflowSizeGuideline: CC normalizes unknown→unrestricted (lenient), but an env knob typo
-    // silently degrading to "no guidance" is the half-config trap — fail-loud here (memoryEngineBackend
-    // posture; the ADVISORY nature is core's concern, the env spelling is ours).
+    const { postureOn } = ctx;
     const workflowSizeGuidelineRaw = process.env.WORKFLOW_SIZE_GUIDELINE;
     if (workflowSizeGuidelineRaw !== undefined && !["small", "medium", "large", "unrestricted"].includes(workflowSizeGuidelineRaw)) {
         throw new Error(`WORKFLOW_SIZE_GUIDELINE must be small|medium|large|unrestricted, got "${workflowSizeGuidelineRaw}"`);
     }
     const workflowSizeGuideline = workflowSizeGuidelineRaw;
-    // design/166-T1:治理窗(fail-loud 解析;unset=undefined=关)。
     const usageWindows = parseUsageWindows(process.env.USAGE_WINDOWS);
     const bakeRunnerPrincipal = env("BAKE_RUNNER_PRINCIPAL", "system:bake-runner");
-    // ── design/158 B4 ② — the four knobs whose canonical name went from negative to positive. Only the first
-    // lands on `ServiceConfig`; the other three are read lazily at their use sites (main.ts's LKG gate,
-    // remote-env-host's capability probe and exec path) but are resolved HERE too so that their polarity row and
-    // any legacy-alias deprecation notice are emitted once, at boot, with every other config diagnostic — an
-    // operator must not have to trigger a background shell before being told the name they set is retired.
-    // (家族的第一枚 PROJECT_MEMORY_ENABLED 是 memory 域的字段,已在那里解析 —— 通知顺序不变。)
     configLkgEnabled();
     hostBackgroundShellEnabled();
     hostExecSpoolEnabled();
-    // ── design/158 B4 ③ — LSP: one knob per lane. `LSP_ENABLED` used to drive BOTH the sandbox lane (opt-in,
-    // default OFF — it needs a baked `ai-agent-code-lsp` template) and the host lane (opt-out, default ON — it needs
-    // nothing and degrades to grep/read), i.e. one env name with two OPPOSITE defaults and no way to silence the
-    // host lane without also naming the sandbox knob. `LSP_HOST_ENABLED` now owns the host lane; an explicit
-    // `LSP_ENABLED=false` keeps working as a host opt-out (it was the only one operators ever had) with a notice
-    // naming the replacement, and `LSP_HOST_ENABLED` always wins when set.
     const lspHostEnabled = (() => {
-        // server 3.0.0([1989],不做兼容):`LSP_ENABLED=false` 的 host 腿别名形 = fail-loud 墓碑。
-        // `LSP_ENABLED=true`(沙箱腿 opt-in 正名)不受影响——墓碑只咬「用沙箱名关 host 腿」的旧姿势。
         if (process.env.LSP_ENABLED === "false") {
             throw new Error("LSP_ENABLED=false no longer drives the HOST lane (removed in server 3.0.0) — set LSP_HOST_ENABLED=false " +
                 "for the host lane; LSP_ENABLED remains the SANDBOX-lane opt-in only (migration table in USAGE.md)");
         }
         return boolEnv("LSP_HOST_ENABLED", true);
     })();
-    // ── #157([2755] tag `server.exec-lane.silent-downgrade-to-host`,P 类车道选择)——执行车道的
-    // fail-closed 校验。旧形:REMOTE_EXEC 点名了一条 lane 但必需 env 不全(或值拼错不在闭集里)时,下面
-    // 三元链的合取逐臂失败、静默滑穿到尾部 ⇒ CONFIG_PROVIDER=local 落 host(worker 本机、无隔离)、否则落
-    // in-process stub,且两种跑法的成功回执同形(status=completed,test [2753]§2 实测「在哪儿跑的」对外
-    // 零信息量)。操作员配了沙箱却在真机上跑 = P 类判据表的样板案,必须拒启点名,不静默降级。
-    // 语义边界:REMOTE_EXEC **未设**(或空串,env 管理器的显式「不选」形)不是降级,是文档化的部署姿态
-    // (local ⇒ host 默认,fleet ⇒ stub),照旧;拒启只咬「点了名却配不齐/认不出」。缺失点名要**准**——
-    // 只列缺的件,不列 lane 的全量需求(WORKFLOW_SIZE_GUIDELINE / MEMORY_SYNC_* 半配拒启同族先例)。
     {
         const lane = process.env.REMOTE_EXEC;
         if (lane !== undefined && lane !== "") {
@@ -1903,15 +1131,8 @@ function parseOrchestrationDomain(ctx) {
         }
     }
     return {
-        // #246(core 5.30.0):readFace 部署座席。显式设置才铸(缺席让 core 自默认 roots——server 不复制
-        // 上游默认,上游改默认时不产生第二份真源);坏词响亮拒(#210 旋钮坏值纪律)。铸造在本域=组登记
-        // (ORCHESTRATION_GROUP_KEYS)同域——合并码扫 C7:此前误写在 observability 域函数里,条件展开会
-        // 逃过该函数返回型的多余属性检查,分组闭集校验从此看不见这两键。
         ...(process.env.READ_FACE !== undefined ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]) } : {}),
         ...(process.env.READ_DENY_PATTERNS !== undefined ? { readDenyPatterns: parseReadDenyPatternsEnv(process.env.READ_DENY_PATTERNS) } : {}),
-        // #253 件 G5(core 5.33.0 #245):内建 deny 表的部署管理面。铸造与校验分两步——先按名字表解析
-        // (空串/半空拒启,见 `parseNameListEnv` 顶注),再交 core 的 `resolveReadDenyBuiltins` 判档名/行名
-        // (引擎同一套规则,宿主不自造第二份)。两键各自可单独设:只设 exclude 时 core 用默认档位。
         ...(() => {
             const tiers = process.env.READ_DENY_BUILTIN_TIERS !== undefined ? parseNameListEnv("READ_DENY_BUILTIN_TIERS", process.env.READ_DENY_BUILTIN_TIERS, { emptySentinel: "none" }) : undefined;
             const exclude = process.env.READ_DENY_BUILTIN_EXCLUDE !== undefined ? parseNameListEnv("READ_DENY_BUILTIN_EXCLUDE", process.env.READ_DENY_BUILTIN_EXCLUDE) : undefined;
@@ -1923,50 +1144,28 @@ function parseOrchestrationDomain(ctx) {
                 provider: "e2b",
                 apiKey: process.env.E2B_API_KEY,
                 ...(process.env.E2B_TEMPLATE ? { template: process.env.E2B_TEMPLATE } : {}),
-                ...((n) => (n !== undefined ? { timeoutMs: n } : {}))(optNumEnvStrict("E2B_TIMEOUT_MS")), // #210 A 档(见 optNumEnvStrict)
-                // Idle/liveness bound for a command (default 120s, the hang-fix). A long SILENT build —
-                // gradle's first dependency download produces no output for minutes (gate#2 P1 finding) — looks
-                // like a hang and gets killed; raise this for workers that run such tools. Agents should still
-                // prefer background+poll, but this is the operator escape hatch.
-                ...((n) => (n !== undefined ? { livenessMs: n } : {}))(optNumEnvStrict("E2B_LIVENESS_MS")), // #210 A 档
+                ...((n) => (n !== undefined ? { timeoutMs: n } : {}))(optNumEnvStrict("E2B_TIMEOUT_MS")),
+                ...((n) => (n !== undefined ? { livenessMs: n } : {}))(optNumEnvStrict("E2B_LIVENESS_MS")),
                 ...(process.env.E2B_ALLOW_NET ? { allowInternetAccess: boolEnv("E2B_ALLOW_NET", true) } : {}),
-                // Out-of-band secret/config env injected sandbox-wide (OA Phase-B, design/48 §5 gap 7):
-                // E2B_SANDBOX_ENV is a CSV of THIS worker's OWN env-var NAMES to forward into the sandbox under the
-                // same name (name-only config keeps the secret in the worker's env, never in the spec/center). e.g.
-                // `E2B_SANDBOX_ENV=GIT_TOKEN` → the agent's git can auth via $GIT_TOKEN (GIT_ASKPASS / credential
-                // helper) without the token ever entering the prompt, the command string, or the durable event log.
                 ...(process.env.E2B_SANDBOX_ENV ? { sandboxEnv: resolveEnvForward(process.env.E2B_SANDBOX_ENV) } : {}),
-                // [1452]/[1454] CWD-A:workspace 根显式可配(其余四车道 *_MOUNT_PATH 早有;e2b 此前配置层
-                // 不可达,恒 /home/user)。exec/spawnBackground/fs 三腿同源消费(remote-env-e2b this.cwd)。
-                // ⚠️ 变更纪律(codex 终审 high):resume 契约只回传 snapshotId,恢复的沙箱以**当前**配置值为
-                // cwd——改此值前先 drain 挂起中的 e2b 任务,否则 resumed 任务的 exec 落新根而产物在旧根
-                // (根修=core resumeVM 契约带回 WorkspaceHandle.mountPath,已转 core)。
                 ...(process.env.E2B_MOUNT_PATH ? { mountPath: process.env.E2B_MOUNT_PATH } : {}),
-                // #242(design/242 v1):崩溃遗留沙盒回收腿(boot 一次+reaper 周期)。默认 ON——泄漏=真金
-                // 白银,判据已保守化(活行跳过/无行 10min GRACE/拿不准恒不杀);v1 前置=每部署独立 E2B key
-                // (跨部署异库共用一把 key 的形不支持,发车说明成文)。
                 orphanReclaim: boolEnv("E2B_ORPHAN_RECLAIM", true),
             }
-            : // Kata pod sandbox on our k3s: image required; auth explicit (K8S_API_URL/K8S_TOKEN) or in-cluster SA.
+            :
                 process.env.REMOTE_EXEC === "k8s" && process.env.K8S_SANDBOX_IMAGE
                     ? {
                         provider: "k8s",
                         image: process.env.K8S_SANDBOX_IMAGE,
                         ...(process.env.K8S_API_URL ? { apiUrl: process.env.K8S_API_URL } : {}),
                         ...(process.env.K8S_TOKEN ? { token: process.env.K8S_TOKEN } : {}),
-                        // base64 to survive sema-registry's no-newline secrets API (same constraint as SSH_PRIVATE_KEY).
                         ...(process.env.K8S_CA_CERT_B64 ? { caCert: Buffer.from(process.env.K8S_CA_CERT_B64, "base64").toString("utf8") } : {}),
                         ...(boolEnv("K8S_INSECURE_TLS", false) ? { insecureTls: true } : {}),
                         ...(process.env.K8S_NAMESPACE ? { namespace: process.env.K8S_NAMESPACE } : {}),
                         ...(process.env.K8S_RUNTIME_CLASS != null ? { runtimeClass: process.env.K8S_RUNTIME_CLASS } : {}),
                         ...(process.env.K8S_MOUNT_PATH ? { mountPath: process.env.K8S_MOUNT_PATH } : {}),
-                        ...((n) => (n !== undefined ? { timeoutMs: n } : {}))(optNumEnvStrict("K8S_TIMEOUT_MS")), // #210 A 档
-                        // Resource profile knob (resources are profile data, not mechanism — center/service
-                        // config, never wire-hardcoded). Found live: 25-module gradle integration OOM'd the 2Gi default.
+                        ...((n) => (n !== undefined ? { timeoutMs: n } : {}))(optNumEnvStrict("K8S_TIMEOUT_MS")),
                         ...(process.env.K8S_MEMORY ? { memory: process.env.K8S_MEMORY } : {}),
                         ...(process.env.K8S_CPU ? { cpu: process.env.K8S_CPU } : {}),
-                        // Workspace-durable suspend/resume: adapter-held MinIO creds (secret minio-agent-worker);
-                        // the sandbox only ever sees a presigned URL. All three keys required to enable — else suspendable:false.
                         ...(process.env.MINIO_ENDPOINT && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
                             ? {
                                 s3Snapshot: {
@@ -1976,22 +1175,22 @@ function parseOrchestrationDomain(ctx) {
                                     secretKey: process.env.MINIO_SECRET_KEY,
                                     ...(process.env.MINIO_REGION ? { region: process.env.MINIO_REGION } : {}),
                                     ...(process.env.WORKSPACE_SNAPSHOT_PREFIX ? { keyPrefix: process.env.WORKSPACE_SNAPSHOT_PREFIX } : {}),
-                                    ...((n) => (n !== undefined ? { presignTtlSec: n } : {}))(optNumEnvStrict("WORKSPACE_SNAPSHOT_TTL_SEC")), // #210 A 档:NaN 会签出 X-Amz-Expires=NaN 的死链
+                                    ...((n) => (n !== undefined ? { presignTtlSec: n } : {}))(optNumEnvStrict("WORKSPACE_SNAPSHOT_TTL_SEC")),
                                 },
                             }
                             : {}),
                     }
-                    : // design/61: SSH → a real host. Key from the adapter-held secret env SSH_PRIVATE_KEY (never the workspace).
+                    :
                         process.env.REMOTE_EXEC === "ssh" && process.env.SSH_HOST && process.env.SSH_USER && process.env.SSH_PRIVATE_KEY
                             ? {
                                 provider: "ssh",
                                 host: process.env.SSH_HOST,
                                 username: process.env.SSH_USER,
                                 privateKey: normalizeSshPrivateKey(process.env.SSH_PRIVATE_KEY),
-                                ...((n) => (n !== undefined ? { port: n } : {}))(optNumEnvStrict("SSH_PORT")), // #210 A 档
+                                ...((n) => (n !== undefined ? { port: n } : {}))(optNumEnvStrict("SSH_PORT")),
                                 ...(process.env.SSH_MOUNT_PATH ? { mountPath: process.env.SSH_MOUNT_PATH } : {}),
                             }
-                            : // design/61: ADB → a real device (serial or host:port). adb binary must be on PATH in the image.
+                            :
                                 process.env.REMOTE_EXEC === "adb" && process.env.ADB_SERIAL
                                     ? {
                                         provider: "adb",
@@ -1999,19 +1198,14 @@ function parseOrchestrationDomain(ctx) {
                                         ...(process.env.ADB_PATH ? { adbPath: process.env.ADB_PATH } : {}),
                                         ...(process.env.ADB_MOUNT_PATH ? { mountPath: process.env.ADB_MOUNT_PATH } : {}),
                                     }
-                                    : // DUAL-MODE §5: `host` = run on THIS machine, no container (the TOC default). No required env.
+                                    :
                                         process.env.REMOTE_EXEC === "host"
                                             ? {
                                                 provider: "host",
                                                 ...(process.env.HOST_WORKSPACE_BASE ? { workspaceBase: process.env.HOST_WORKSPACE_BASE } : {}),
-                                                ...((n) => (n !== undefined ? { commandTimeoutMs: n } : {}))(optNumEnvStrict("HOST_COMMAND_TIMEOUT_MS")), // #210 A 档
+                                                ...((n) => (n !== undefined ? { commandTimeoutMs: n } : {}))(optNumEnvStrict("HOST_COMMAND_TIMEOUT_MS")),
                                             }
-                                            : // DUAL-MODE §5: `local-docker` = a per-task container on THIS machine's docker daemon (isolation:true,
-                                                // suspendable:false). DOCKER_IMAGE is REQUIRED — no docker.io default (domestic-images iron rule); a
-                                                // deployment points it at the docker.io/claybobby public pool or its own private registry (SWR
-                                                // deprecated; the in-network Gitea registry container was retired 2026-08, no CN fallback baked
-                                                // in). Secrets are env-NAMEs the worker resolves from its
-                                                // own process.env (DOCKER_SANDBOX_ENV, a CSV of NAMEs) — never the values in the spec/center.
+                                            :
                                                 process.env.REMOTE_EXEC === "local-docker" && process.env.DOCKER_IMAGE
                                                     ? {
                                                         provider: "local-docker",
@@ -2020,31 +1214,19 @@ function parseOrchestrationDomain(ctx) {
                                                         ...(process.env.DOCKER_PATH ? { dockerPath: process.env.DOCKER_PATH } : {}),
                                                         ...(process.env.DOCKER_HOST ? { dockerHost: process.env.DOCKER_HOST } : {}),
                                                         ...(process.env.DOCKER_MEMORY ? { memory: process.env.DOCKER_MEMORY } : {}),
-                                                        ...((n) => (n !== undefined ? { cpus: n } : {}))(optNumEnvStrict("DOCKER_CPUS")), // #210 A 档
-                                                        // 鲁棒性批5 A1(2026-08-05):此前裸 `Number(process.env.DOCKER_PIDS_LIMIT)`——非数字值(如
-                                                        // 手滑的 "512;") → NaN,而消费端(local-docker 执行环境)对 `pidsLimit` 的守卫是
-                                                        // `?? 512`(只挡 null/undefined),NaN 穿透守卫;随后 `NaN > 0` 恒假,`--pids-limit` 整个
-                                                        // 从 docker run 参数里省略——运维以为设了 fork-bomb 背栓,实际背栓被静默卸掉。
-                                                        // optFinitePositiveEnv:非法值回 undefined(消费端默认 512 生效)+ S20 boot 警告。
+                                                        ...((n) => (n !== undefined ? { cpus: n } : {}))(optNumEnvStrict("DOCKER_CPUS")),
                                                         ...((n) => (n !== undefined ? { pidsLimit: n } : {}))(optFinitePositiveEnv("DOCKER_PIDS_LIMIT")),
                                                         ...(boolEnv("DOCKER_DROP_CAPS", false) ? { dropAllCaps: true } : {}),
                                                         ...(process.env.DOCKER_NETWORK
                                                             ? { network: enumEnv("DOCKER_NETWORK", "bridge", ["none", "bridge", "host"]) }
                                                             : {}),
-                                                        ...((n) => (n !== undefined ? { commandTimeoutMs: n } : {}))(optNumEnvStrict("DOCKER_COMMAND_TIMEOUT_MS")), // #210 A 档
+                                                        ...((n) => (n !== undefined ? { commandTimeoutMs: n } : {}))(optNumEnvStrict("DOCKER_COMMAND_TIMEOUT_MS")),
                                                         ...(process.env.DOCKER_SANDBOX_ENV ? { env: resolveEnvForward(process.env.DOCKER_SANDBOX_ENV) } : {}),
                                                     }
-                                                    : // TOC first-run default: in LOCAL config mode (CONFIG_PROVIDER=local — the
-                                                        // single-machine source) with no explicit REMOTE_EXEC, default to the `host` lane so "fill .env
-                                                        // and run" works without the user setting REMOTE_EXEC. Fleet/remote (CONFIG_PROVIDER≠local) keeps
-                                                        // the in-process stub default (REMOTE_EXEC unset = OA/review posture) — unchanged.
+                                                    :
                                                         process.env.CONFIG_PROVIDER === "local"
                                                             ? { provider: "host" }
                                                             : undefined,
-        // SVC-3 git-worktree isolation: opt-in, operator-supplied ONLY. WORKTREE_REPO_ROOT is the trusted base
-        // repo; WORKTREE_ALLOWED_ROOTS (CSV) is the defence-in-depth allowlist (default = [repoRoot]);
-        // WORKTREE_BASE_COMMIT pins the worktree ref (default core HEAD). Enabled only when both the flag and the
-        // repo root are present — a half-set config stays OFF (no silent default repo).
         worktreeIsolation: boolEnv("WORKTREE_ISOLATION_ENABLED", false) && process.env.WORKTREE_REPO_ROOT
             ? {
                 repoRoot: process.env.WORKTREE_REPO_ROOT,
@@ -2056,79 +1238,60 @@ function parseOrchestrationDomain(ctx) {
             : undefined,
         leaderEnabled: boolEnv("LEADER_ENABLED", false),
         leaderFanoutEnabled: boolEnv("LEADER_FANOUT_ENABLED", true),
-        routerEnabled: boolEnv("ROUTER_ENABLED", false), // A value router; default OFF (ship dark, enable after live validation)
-        selfOrchestrationEnabled: postureOn("SELF_ORCHESTRATION_ENABLED"), // posture: single-user turnkey → ON (CC local trust; sandboxed vm); multi-tenant opt-in (RCE-ish, gated)
-        forkEnabled: postureOn("FORK_ENABLED"), // §4 CC /fork posture: single-user turnkey → default-ON for the LLM; multi-tenant honored only with a per-principal entitlement resolver (core enforces allowFork, registry-core 0.1.47; enableForkFromBody)
-        experimentalObserverAgents: boolEnv("EXPERIMENTAL_OBSERVER_AGENTS", false), // observer 开闸线:显式 "true" 才开(实验面,core ships dark——非 postureOn);多租户只认 center caps,env 被忽略(applyObserverEnvOptIn boot warn)
-        schedulerEnabled: postureOn("SCHEDULER_ENABLED"), // R7 自唤醒 posture: single-user turnkey → ON (CC self-wake); multi-tenant routes to center (opt-in)
-        planModeEnabled: boolEnv("PLAN_MODE_ENABLED", true), // EnterPlanMode (core 1.167) model-driven plan; 🆕 default ON (resident — clay), PLAN_MODE_ENABLED=false opts out
+        routerEnabled: boolEnv("ROUTER_ENABLED", false),
+        selfOrchestrationEnabled: postureOn("SELF_ORCHESTRATION_ENABLED"),
+        forkEnabled: postureOn("FORK_ENABLED"),
+        experimentalObserverAgents: boolEnv("EXPERIMENTAL_OBSERVER_AGENTS", false),
+        schedulerEnabled: postureOn("SCHEDULER_ENABLED"),
+        planModeEnabled: boolEnv("PLAN_MODE_ENABLED", true),
         ...(process.env.SCHEDULER_STORE_PATH ? { schedulerStorePath: process.env.SCHEDULER_STORE_PATH } : {}),
-        schedulerSessionWakeup: boolEnv("SCHEDULER_SESSION_WAKEUP", true), // [1009]② host-signal: default ON, the spawning shell opts a daemon-less engine out (PLAN_MODE_ENABLED 同形解析)
-        schedulerSessionLifetime: boolEnv("SCHEDULER_SESSION_LIFETIME", true), // [2436] 同族 host-signal(5.6.0):headless=false ⇒ CronCreate 前门拒 session-lifetime,孤儿不落盘
+        schedulerSessionWakeup: boolEnv("SCHEDULER_SESSION_WAKEUP", true),
+        schedulerSessionLifetime: boolEnv("SCHEDULER_SESSION_LIFETIME", true),
         selfOrchestrationModels: csv("SELF_ORCHESTRATION_MODELS"),
         selfOrchestrationWorkerIsolation: boolEnv("SELF_ORCHESTRATION_WORKER_ISOLATION", false),
         ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}),
-        workflowRunStoreBackend: enumEnv("WORKFLOW_RUN_STORE", "auto", ["auto", "file", "memory"]), // SVC-1 + P1: auto = SQL backend when present (cross-replica), else File
-        workflowOrphanGraceMs: clampEnvWithWarn("WORKFLOW_ORPHAN_GRACE_MS", String(24 * 60 * 60 * 1000), 60_000), // SVC-1: 24h default, floor 1m(#210 B 档:夹取点名)
-        workflowJournalRetentionMs: clampEnvWithWarn("WORKFLOW_JOURNAL_RETENTION_MS", String(7 * 24 * 60 * 60 * 1000), 60_000), // SVC-2: 7d default, floor 1m
-        workflowRunRetentionMs: clampEnvWithWarn("WORKFLOW_RUN_RETENTION_MS", String(30 * 24 * 60 * 60 * 1000), 60_000), // 30d default, floor 1m; SQL twins only
-        ...(usageWindows ? { usageWindows } : {}), // design/166-T1:USAGE_WINDOWS 治理窗(fail-loud 已在 parseUsageWindows)
-        backgroundAgentRetentionMs: clampEnvWithWarn("BG_AGENT_RETENTION_MS", String(7 * 24 * 60 * 60 * 1000), 60_000), // core 1.364: 7d default, floor 1m
-        backgroundAgentStaleRunningMs: clampEnvWithWarn("BG_AGENT_STALE_RUNNING_MS", String(15 * 60_000), 10 * 60_000), // core 契约 ≥10min 硬钳(60s 写者心跳)
-        backgroundAgentParkClaimStaleMs: clampEnvWithWarn("BG_AGENT_PARK_CLAIM_STALE_MS", String(60 * 60_000), 60_000), // [1575] F1 修:default 1h,floor 1m(零/负值都不该让整块清算失活)
-        rosterRetentionMs: clampEnvWithWarn("ROSTER_RETENTION_MS", String(30 * 24 * 60 * 60 * 1000), 60_000), // [1522] MED2: 30d default, floor 1m; SQL twins only
-        leaderRunStaleMs: clampEnvWithWarn("LEADER_RUN_STALE_MS", String(26 * 60 * 60 * 1000), 60_000), // #193 车4 件1(codex R1-high②): 26h default(24h 文档上限+余量), floor 1m
-        // 修8: scratchpad sweep TTL — 0(or negative)= disabled; enabled values floor at 1m (a sub-minute TTL would
-        // race in-flight tasks' scratchpad writes for no operational gain).
-        // #210 B 档,只对**下限夹取**点名:`≤0 ⇒ 0` 是上面那条设计注写明的「显式关本腿」,是 operator 的
-        // 意图本身,不是夹取,warn 它等于给正常配置刷噪声。
+        workflowRunStoreBackend: enumEnv("WORKFLOW_RUN_STORE", "auto", ["auto", "file", "memory"]),
+        workflowOrphanGraceMs: clampEnvWithWarn("WORKFLOW_ORPHAN_GRACE_MS", String(24 * 60 * 60 * 1000), 60_000),
+        workflowJournalRetentionMs: clampEnvWithWarn("WORKFLOW_JOURNAL_RETENTION_MS", String(7 * 24 * 60 * 60 * 1000), 60_000),
+        workflowRunRetentionMs: clampEnvWithWarn("WORKFLOW_RUN_RETENTION_MS", String(30 * 24 * 60 * 60 * 1000), 60_000),
+        ...(usageWindows ? { usageWindows } : {}),
+        backgroundAgentRetentionMs: clampEnvWithWarn("BG_AGENT_RETENTION_MS", String(7 * 24 * 60 * 60 * 1000), 60_000),
+        backgroundAgentStaleRunningMs: clampEnvWithWarn("BG_AGENT_STALE_RUNNING_MS", String(15 * 60_000), 10 * 60_000),
+        backgroundAgentParkClaimStaleMs: clampEnvWithWarn("BG_AGENT_PARK_CLAIM_STALE_MS", String(60 * 60_000), 60_000),
+        rosterRetentionMs: clampEnvWithWarn("ROSTER_RETENTION_MS", String(30 * 24 * 60 * 60 * 1000), 60_000),
+        leaderRunStaleMs: clampEnvWithWarn("LEADER_RUN_STALE_MS", String(26 * 60 * 60 * 1000), 60_000),
         scratchpadSweepTtlMs: ((n, raw) => {
             if (n <= 0)
                 return 0;
             if (n < 60_000) {
-                // ⚠️ `raw` 记**环境原文**而不是 `String(n)`(codex 自审 R1-F4 真修):`1e3` / `+1000` / 带空白的
-                // ` 1000 ` 归一后都是 "1000",而 operator 要在 env 文件里找的正是他写下的那串字符。
                 CONFIG_WARNINGS.push({ env: "SCRATCHPAD_SWEEP_TTL_MS", raw, used: "60000", kind: "clamped" });
                 return 60_000;
             }
             return n;
         })(numEnv("SCRATCHPAD_SWEEP_TTL_MS", String(7 * 24 * 60 * 60 * 1000)), env("SCRATCHPAD_SWEEP_TTL_MS", String(7 * 24 * 60 * 60 * 1000))),
-        // RFC B5 region package-source selector — 🆕 default `global` (clay 拍 2026-07-13 海外为准:官方源 env-first
-        // 对存量镜像即生效);国内部署显式 SANDBOX_PKG_SOURCE=cn;`none` = 完全不注入(旧 unset 行为,字节级不变)。
-        // #210 A 档:补闭集。此前**任何**词都原样透传进沙箱注入层——`SANDBOX_PKG_SOURCE=china`(拼错的
-        // `cn`)在国内部署上得到的是「一个认不出的源名」,注入层认不出就什么都不注入 = 静默回到官方源,
-        // 于是每次 pip/npm 都走境外、任务超时,而 operator 明明"配了国内源"。词表与 README 的四词同源。
-        // ⚠️ 不直接用 `enumEnv`:它把空串当一个**值**去比对词表,而这条旋钮改前是 `|| "global"`(空串=未设,
-        // compose 的 `${VAR:-}` 模板天天产空串)。走 `env(name, "global")` 先把空串归一成缺省,再验词表。
         ...(process.env.SANDBOX_PKG_SOURCE !== "none"
             ? { sandboxPkgSource: pkgSourceEnv() }
             : {}),
-        sessionAutoTitle: boolEnv("SESSION_AUTO_TITLE", true), // session auto-title: default ON (one cheap call per session)
-        selectEnvironmentTool: boolEnv("SELECT_ENVIRONMENT_TOOL", true), // RFC A2: default ON (mount additionally gated on k8s+catalog)
-        envFactsEnabled: boolEnv("SANDBOX_ENV_FACTS", true), // RFC A1: default ON (core 1.240.0 TaskSpec.envFacts; no-facts = no field)
-        toolDeferLongtail: boolEnv("TOOL_DEFER_LONGTAIL", false), // [803]④ defer face: EXPERIMENTAL, default OFF
-        lspEnabled: boolEnv("LSP_ENABLED", false), // sandbox lane: opt-in (needs a baked ai-agent-code-lsp template)
-        lspHostEnabled, // host lane: LSP_HOST_ENABLED, DEFAULT ON (CC-parity, degrades gracefully) — see the derivation above
-        workflowAgentsReadOnly: boolEnv("WORKFLOW_AGENTS_READONLY", false), // [824]① TOB 保守旋钮:默认 off = workflow 子 agent 同权(CC parity)
+        sessionAutoTitle: boolEnv("SESSION_AUTO_TITLE", true),
+        selectEnvironmentTool: boolEnv("SELECT_ENVIRONMENT_TOOL", true),
+        envFactsEnabled: boolEnv("SANDBOX_ENV_FACTS", true),
+        toolDeferLongtail: boolEnv("TOOL_DEFER_LONGTAIL", false),
+        lspEnabled: boolEnv("LSP_ENABLED", false),
+        lspHostEnabled,
+        workflowAgentsReadOnly: boolEnv("WORKFLOW_AGENTS_READONLY", false),
         imageBakes: {
             enabled: boolEnv("IMAGE_BAKES_ENABLED", false),
             runnerPrincipal: bakeRunnerPrincipal,
             registry: process.env.BAKE_IMAGE_REGISTRY || null,
             cacheBase: process.env.BAKE_CACHE_BASE || null,
             defaultBaseRef: process.env.SANDBOX_BASE_REF || null,
-            leaseMs: clampEnvWithWarn("BAKE_LEASE_MS", "90000", 1000), // #210 B 档(四条同族)
+            leaseMs: clampEnvWithWarn("BAKE_LEASE_MS", "90000", 1000),
             staleMs: clampEnvWithWarn("BAKE_STALE_MS", "180000", 1000),
             submitRateMax: clampEnvWithWarn("BAKE_SUBMIT_RATE_MAX", "10", 0),
             submitRateWindowSec: clampEnvWithWarn("BAKE_SUBMIT_RATE_WINDOW_SEC", "60", 1),
         },
     };
 }
-/** 域:limits+http(限额与 HTTP 面)—— 端口、附件/工作区体积与 TTL、成本与速率天花板、排空窗、回收周期。 */
-/**
- * #322:limitsHttp 组里**有下限**的三个数值旋钮的下限值 —— env 腿(夹取+点名)与 center 热腿(整批拒)
- * 共用同一组阈值。判据同源、**处置刻意不同**:env 值是既有部署的存量,夹取不打断服务;center 发布是一次
- * 显式且可重发的动作,拒绝才是有意义的反馈(#123 响亮拒)。
- */
 export const LIMITS_HTTP_FLOORS = {
     attachmentMaxBytes: 1024,
     attachmentUnboundTtlMs: 60_000,
@@ -2136,19 +1299,8 @@ export const LIMITS_HTTP_FLOORS = {
 };
 function parseLimitsHttpDomain() {
     return {
-        // #210 A 档:裸 Number ⇒ NaN 直进 `server.listen(NaN)`(Node 当成 0 = 随机端口),于是服务起来了、
-        // 健康检查在**另一个**端口上、注册进 fleet 的地址是错的,全程零告警。[0,65535] 里 0 是合法的
-        // 「随机端口」(测试在用),不收窄。
         port: numEnvBounded("PORT", "8090", 0, 65535),
-        // D-1 孤儿对象 GC grace(复审 F10;0=关掉本腿,负/坏值走默认)。
-        // #210 C 档(不升拒的理由写在这里,不是复述行为):这条旋钮的坏值后果**轻**——回落到 1h 宽限,方向
-        // 是「更晚回收」,不删多余的东西,不打开任何门;而它落在 D-1 附件面这种存量部署普遍设过的位置上,
-        // 拒启的破坏面明显大于收益。所以保留回默认,补 CONFIG_WARNINGS 点名(原值 + 采用值),让 operator
-        // 排空日志时看得见。`0` 是文档化的「关本腿」,合法且零 warn。
         attachmentOrphanGraceMs: ((raw) => {
-            // ⚠️ 只把 `undefined` 当未设(**不是** `undefined || ""`):改前的判据是 `!== undefined` + `Number("")`
-            // = 0 = 「关本腿」,空串在这条上是一个**已生效的合法值**。加上一条空串归一化会静默把一台已经关了
-            // 孤儿清扫的部署改成 1h 宽限 —— 律条治的是坏值静默,不是顺手改既有语义。
             if (raw === undefined)
                 return 3_600_000;
             const v = Number(raw);
@@ -2157,21 +1309,15 @@ function parseLimitsHttpDomain() {
             CONFIG_WARNINGS.push({ env: "ATTACHMENT_ORPHAN_GRACE_MS", raw, used: "3600000", kind: "invalid-default" });
             return 3_600_000;
         })(process.env.ATTACHMENT_ORPHAN_GRACE_MS),
-        // workspace 浏览面(#3,[1894]①)单文件读上限。
         workspaceFileMaxBytes: optFinitePositiveEnv("WORKSPACE_FILE_MAX_BYTES") ?? 8 * 1024 * 1024,
-        attachmentMaxBytes: clampEnvWithWarn("ATTACHMENT_MAX_BYTES", String(32 * 1024 * 1024), LIMITS_HTTP_FLOORS.attachmentMaxBytes), // #210 B 档
+        attachmentMaxBytes: clampEnvWithWarn("ATTACHMENT_MAX_BYTES", String(32 * 1024 * 1024), LIMITS_HTTP_FLOORS.attachmentMaxBytes),
         ...(process.env.ATTACHMENT_MIME_ALLOWLIST
             ? { attachmentMimeAllowlist: process.env.ATTACHMENT_MIME_ALLOWLIST.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean) }
             : {}),
-        attachmentUnboundTtlMs: clampEnvWithWarn("ATTACHMENT_UNBOUND_TTL_MS", String(24 * 3600 * 1000), LIMITS_HTTP_FLOORS.attachmentUnboundTtlMs), // #210 B 档
+        attachmentUnboundTtlMs: clampEnvWithWarn("ATTACHMENT_UNBOUND_TTL_MS", String(24 * 3600 * 1000), LIMITS_HTTP_FLOORS.attachmentUnboundTtlMs),
         infraCostRates: {
-            // #210 B 档:负单价夹到 0 是对的(负成本会让账面倒扣),但夹取必须点名——不然 operator 只看到
-            // 基建成本恒 0,查不到是自己那个负号被吃掉了。
             toolCallMicroUsd: clampEnvWithWarn("INFRA_COST_TOOL_CALL", "0", 0),
             sandboxSecMicroUsd: clampEnvWithWarn("INFRA_COST_SANDBOX_SEC", "0", 0),
-            // #193 车5(P1-4):per-run 出网计量未建(cost-taxonomy `infraUsageFromEvents` 恒 `egressBytes: 0`),
-            // 该费率设成任何值都恒计 $0。旋钮保留(接真计量是产品件),但设非零必点名——静默会让 operator
-            // 以为出网已计费。接上计量的那批必须同时删掉这条 push(test/config-knob-loudness #193 格看守)。
             egressGbMicroUsd: (() => {
                 const v = clampEnvWithWarn("INFRA_COST_EGRESS_GB", "0", 0);
                 if (v > 0)
@@ -2179,11 +1325,9 @@ function parseLimitsHttpDomain() {
                 return v;
             })(),
         },
-        drainGraceMs: clampEnvWithWarn("DRAIN_GRACE_MS", String(10 * 60 * 1000), LIMITS_HTTP_FLOORS.drainGraceMs), // SIGTERM drain window, default 10min, floor 10s(#210 B 档:把 600 当成"秒"填进来的手滑最常见,夹取后必须点名)
-        sighupIdleGraceMs: clampEnvWithWarn("SIGHUP_IDLE_GRACE_MS", String(120_000), 5_000), // B3: SIGHUP idle-shutdown window, default 2min, floor 5s
-        ...parentPidEnv(), // #219:壳 pid 存活监视,缺席 ⇒ 键缺席 ⇒ 整件不装配
-        // BL-9: numEnv (not bare Number) — a non-numeric typo FAILS at startup instead of becoming NaN, which would
-        // silently DISABLE the operator cost/rate ceiling (every `> ceiling` comparison against NaN is false).
+        drainGraceMs: clampEnvWithWarn("DRAIN_GRACE_MS", String(10 * 60 * 1000), LIMITS_HTTP_FLOORS.drainGraceMs),
+        sighupIdleGraceMs: clampEnvWithWarn("SIGHUP_IDLE_GRACE_MS", String(120_000), 5_000),
+        ...parentPidEnv(),
         rateLimitPerMin: numEnv("RATE_LIMIT_RPM", "0"),
         maxTaskCostUsd: numEnv("MAX_TASK_COST_USD", "0"),
         maxTaskTokens: numEnv("MAX_TASK_TOKENS", "0"),
@@ -2191,25 +1335,21 @@ function parseLimitsHttpDomain() {
         costQuotaWindowSec: numEnv("COST_QUOTA_WINDOW_SEC", "86400"),
         reapIntervalSec: numEnv("REAP_INTERVAL_SEC", "60"),
         runStaleSec: numEnv("REAP_RUN_STALE_SEC", "120"),
-        toolResultTtlSec: numEnv("TOOL_RESULT_TTL_SEC", "86400"), // A2 同族:NaN ⇒ reapOlderThan(NaN) 永不回收且被 .catch 吞
+        toolResultTtlSec: numEnv("TOOL_RESULT_TTL_SEC", "86400"),
     };
 }
-/** 域:observability(可观测)—— 指标/追踪令牌、工具与思考轨迹开关、日志档位、OTLP 出口。 */
 function parseObservabilityDomain() {
     return {
         metricsToken: process.env.METRICS_TOKEN || undefined,
         traceToken: process.env.TRACE_TOKEN || undefined,
         toolTrace: boolEnv("TOOL_TRACE", false),
-        traceThinking: boolEnv("TRACE_THINKING", true), // default ON (clay)
+        traceThinking: boolEnv("TRACE_THINKING", true),
         logLevel: env("LOG_LEVEL", "info"),
         otel: process.env.OTEL_EXPORTER_OTLP_ENDPOINT
             ? {
                 endpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT.replace(/\/$/, ""),
-                // #210 A 档:NaN 周期进 setInterval ⇒ Node 归一成 1ms,出口从「每 15s 一批」变成**每毫秒**一批
-                // (打满 collector 且把本进程 CPU 吃光),而这是一条运维为了"看见"才配的旋钮。
                 intervalMs: numEnv("OTEL_EXPORT_INTERVAL_MS", "15000"),
                 serviceName: env("OTEL_SERVICE_NAME", "sema-server"),
-                // `OTEL_EXPORTER_OTLP_HEADERS` = comma-separated `k=v` pairs (e.g. an auth header).
                 headers: Object.fromEntries(csv("OTEL_EXPORTER_OTLP_HEADERS").map((kv) => {
                     const i = kv.indexOf("=");
                     return i === -1 ? [kv, ""] : [kv.slice(0, i).trim(), kv.slice(i + 1).trim()];
@@ -2218,10 +1358,6 @@ function parseObservabilityDomain() {
             : undefined,
     };
 }
-/** GIT_API_KIND:repo 工具的 Git-host 方言(闭集 gitea|github,缺省 gitea)。
- *  未知词=拒启(安全轴词表纪律);另一坏形也拒启:kind 缺省/gitea 而 BASEURL 指向 github.com——
- *  Gitea 形状(`/api/v1` 前缀、`.diff` 后缀)对 GitHub 恒 404,与其在任务运行时逐调用 loud 404,
- *  不如启动即指路(#123 FLEET_ADVERTISE_ADDRESS 坏形响亮拒同族)。 */
 function parseGitApiKind(raw, baseUrl) {
     const kind = raw ?? "gitea";
     if (!isGitApiKind(kind)) {
@@ -2229,8 +1365,6 @@ function parseGitApiKind(raw, baseUrl) {
     }
     if (!baseUrl)
         return kind;
-    // 配了就必须是合法 URL(USAGE 本就要求带 scheme 的完整 baseURL;坏 URL 此前静默过门、逐调用 fetch
-    // 才炸 —— 启动即拒;codex F3)。尾点主机(api.github.com.)DNS 等价,归一后再比对,防绕过。
     if (!URL.canParse(baseUrl)) {
         throw new Error(`GIT_API_BASEURL="${baseUrl}" is not a valid URL (expected e.g. https://git.example.com)`);
     }
@@ -2241,7 +1375,6 @@ function parseGitApiKind(raw, baseUrl) {
         throw new Error(`GIT_API_BASEURL points at ${host} but GIT_API_KIND is "gitea" — the Gitea API shapes 404 on GitHub. Set GIT_API_KIND=github (base url should be https://api.github.com, or your GHE /api/v3 root).`);
     }
     if (kind === "github") {
-        // 对称校验(codex F3):web 域名/带 path 的 api 根都会让每个仓操作 404,而客户端照建、场景照宣可用。
         if (githubFamily && host !== "api.github.com") {
             throw new Error(`GIT_API_BASEURL host ${host} is the GitHub WEB host — the API root is https://api.github.com (a repo page URL is not an API base).`);
         }
@@ -2254,28 +1387,20 @@ function parseGitApiKind(raw, baseUrl) {
     }
     return kind;
 }
-/** 域:misc-integration(外部集成)—— plugins clone 白名单、git/OA 面、场景与 skill 目录、sema-registry 接入。 */
 function parseIntegrationsDomain() {
     return {
-        // plugins 域 clone host 白名单(契约 [1361]①;缺省 github.com,逗号扩 https 镜像域)。
         pluginsAllowHosts: (process.env.PLUGINS_ALLOW_HOSTS ?? "github.com").split(",").map((h) => h.trim()).filter(Boolean),
-        configBootFetchBudgetMs: clampEnvWithWarn("CONFIG_BOOT_FETCH_BUDGET_MS", "1500", 0), // boot 首拉抢答窗;过窗转后台补齐(clay 2026-07-17:本地 5s 启动=黑洞中心同步等待)。#210 B 档
+        configBootFetchBudgetMs: clampEnvWithWarn("CONFIG_BOOT_FETCH_BUDGET_MS", "1500", 0),
         gitApiBaseUrl: process.env.GIT_API_BASEURL,
         gitApiToken: process.env.GIT_API_TOKEN,
         gitApiKind: parseGitApiKind(process.env.GIT_API_KIND, process.env.GIT_API_BASEURL),
-        // BEHAVIOR CHANGE([891] clay 硬裁定):出厂缺省场景 default→code(CC 编码 persona 蒸馏版)——
-        // 编码产品出厂态对标 CC 出厂态,通用域中性 persona 用 DEFAULT_SCENARIO=default 显式选回。
         defaultScenario: env("DEFAULT_SCENARIO", "code"),
         skillsDir: env("SKILLS_DIR", defaultSkillsDir()),
-        // [2354] clay 令:OA 场景整体退役(oa-tools/oa 场景/OA 轮询审批车道随 5.0.0 全清)——
-        // OA_* env 全族进 RETIRED_ENVS 墓碑(在场即拒启),此处零读取。
-        // sema-registry (control plane) URL/token/worker. The orchestrator renamed the worker-injected env from
-        // [2354]:CONFIG_CENTER_* 双读已删(墓碑在 rejectRetiredEnvs);SEMA_REGISTRY_* 唯一。
         configCenter: process.env.SEMA_REGISTRY_URL
             ? {
                 baseUrl: env("SEMA_REGISTRY_URL"),
                 token: process.env.SEMA_REGISTRY_TOKEN || "",
-                dryRun: boolEnv("SEMA_REGISTRY_DRY_RUN", false), // #245
+                dryRun: boolEnv("SEMA_REGISTRY_DRY_RUN", false),
                 worker: process.env.SEMA_REGISTRY_WORKER || undefined,
             }
             : undefined,
@@ -2284,26 +1409,9 @@ function parseIntegrationsDomain() {
         a2aServe: parseA2aServe(),
     };
 }
-/** 一条已声明 skill 的字段上限(卡是**公网文档**:无界的运维自由文本会让一张卡长到任何大小,而卡由
- *  匿名调用方拉取)。id 短、文案宽,数量有帽。 */
 const A2A_SERVE_MAX_SKILLS = 64;
 const A2A_SERVE_MAX_ID_CHARS = 128;
 const A2A_SERVE_MAX_TEXT_CHARS = 2048;
-/**
- * DESIGN-269 §3.3 车2 —— `A2A_SERVE_*` 域(server-as-peer 总旋钮 + 卡内容声明面)。
- *
- * 姿势(全是既有先例的照抄,不是新发明):
- *  · **默认 OFF**(operator-knob 律:无客户端表态派生腿)。`A2A_SERVE_ENABLED` 走 {@link boolEnv} ⇒
- *    坏词当场拒启(#123/#241-rc2 响亮拒族),不静默回默认。
- *  · OFF ⇒ 返回 `undefined`,而不是一个 `enabled:false` 的块。缺席即 OFF 让「发了卡但拒调」这个半态
- *    在类型上不可表达(设计稿 §3.3 的判词是「卡都不发=对外不存在」)。
- *  · ON 而 `A2A_SERVE_URL` 缺席/坏形 ⇒ **拒启**。理由与 #123 `FLEET_ADVERTISE_ADDRESS` 逐字同族:
- *    ①半配置的部署带病运行比起不来危险(卡上没有 `url`,对端拿到一张打不通的卡,失败点远离原因);
- *    ②可达地址是**运维声明**的,不许自猜——从请求 `Host` 头推导等于让匿名调用方决定我们公网卡上
- *    公告的地址(反射/缓存投毒面),本仓在 fleet 那条腿上已经拒绝过一次同样的诱惑。
- *  · `A2A_SERVE_SKILLS` = JSON 数组,**坏形拒启**(声明面静默丢=部署方以为发出去了、对端看不到,
- *    正是「无声 fail-open」;这里没有可用的降级语义)。
- */
 function parseA2aServe() {
     if (!boolEnv("A2A_SERVE_ENABLED", false))
         return undefined;
@@ -2323,11 +1431,6 @@ function parseA2aServe() {
     if (parsed === undefined || (parsed.protocol !== "http:" && parsed.protocol !== "https:")) {
         throw new Error(`A2A_SERVE_URL must be a parseable http(s) URL (e.g. "https://agent.example.com/v1/a2a"); got ${JSON.stringify(rawUrl)}`);
     }
-    // 🔴 codex 轮2 R2-1(HIGH,验真后修):URL **userinfo** 段拒启。这个值被**逐字**放进 agent card,而卡是
-    // 匿名可拉的公开文档 —— 一个看起来很合理的 Basic-auth 配置手滑(`https://user:pass@host/v1/a2a`)会把
-    // 凭据发给每一个发现请求。方向取**拒启**而不是脱敏:脱敏会让部署方以为自己配的鉴权生效了(实际
-    // 被抹掉),而这条路的鉴权本来就该走**头形**(R-11:RPC 持服务凭据)。同族先例=车1 自审第三镜给
-    // client 侧读面做的 endpoint 脱敏,只是那边是**读别人的**卡、这边是**发我们自己的**卡,故更严。
     if (parsed.username !== "" || parsed.password !== "") {
         throw new Error(`A2A_SERVE_URL must not carry userinfo (credentials before "@") — it is published verbatim on the ANONYMOUSLY readable agent card, so those credentials would be handed to every discovery caller. ` +
             `Inbound authentication on this endpoint is header-shaped (a service credential), not URL-embedded; strip the userinfo and keep the secret in the caller's headers.`);
@@ -2337,14 +1440,9 @@ function parseA2aServe() {
         ...(process.env.A2A_SERVE_DESCRIPTION ? { description: process.env.A2A_SERVE_DESCRIPTION } : {}),
         url: rawUrl,
         skills: parseA2aServeSkills(process.env.A2A_SERVE_SKILLS),
-        // 服务端等待窗。**远小于** core 客户端腿的 10min 总预算(那是调用方的钱包,不是我们的连接池):
-        // 一条 inbound HTTP 请求被按住的每一秒都占着一条连接与一个 socket,而协议自带 `tasks/get` 轮询
-        // 出路,所以窗到期回 `working` 是**正常路径**、不是降级。上限 5min 是硬帽(比它更长请改用轮询)。
         blockingWaitMs: numEnvBounded("A2A_SERVE_BLOCKING_WAIT_MS", "45000", 0, 300_000),
     };
 }
-/** `A2A_SERVE_SKILLS` 的逐条校验。**在场即须合法,否则拒启**——声明面没有「丢掉坏的那条继续跑」的
- *  合法语义:那会让部署方以为自己公告了一个技能而对端根本看不到(静默 fail-open 的教科书形)。 */
 function parseA2aServeSkills(raw) {
     if (raw === undefined || raw.trim() === "")
         return [];
@@ -2433,7 +1531,6 @@ const INTEGRATIONS_GROUP_KEYS = [
     "pluginsAllowHosts", "mcpServers", "a2aPeers", "a2aServe", "configBootFetchBudgetMs", "gitApiBaseUrl", "gitApiToken", "gitApiKind", "defaultScenario",
     "skillsDir", "configCenter", "configProvider", "configLocalDir",
 ];
-/** 组名 → 该组取景的平铺键(introspection 面:测试用它钉「每个平铺键恰好被一组取景」)。 */
 export const CONFIG_GROUP_KEYS = {
     store: STORE_GROUP_KEYS,
     modelPlane: MODEL_PLANE_GROUP_KEYS,
@@ -2445,13 +1542,6 @@ export const CONFIG_GROUP_KEYS = {
     observability: OBSERVABILITY_GROUP_KEYS,
     integrations: INTEGRATIONS_GROUP_KEYS,
 };
-/** 一组的**取景器**:每个键一个 accessor,读的时候才去平铺面取值。
- *  ⚠️ 刻意不是 `{...pick(flat, keys)}` 的快照——快照会在 sema-registry 热应用(`config.model = …`、
- *  `mutateInPlace(config.models, …)`)之后变成一份**静默过期**的旧值;取景器没有第二份存储,故不存在
- *  过期这个状态。`create*` 而非 `build*`:返回的是带行为(accessor)的活对象,不是纯数据。 */
-/** ⚠️ 语义边界(复审 2026-07-30 F4):组视图给**每个注册键**都装访问器,不看平铺面是否真有值——
- *  `"tidb" in config.store` 恒 true、`Object.keys(config.store).length` 恒为注册表长度。本仓的
- *  presence-as-semantics 判定(`"k" in x` / Object.keys 计数)**只能打平铺面**,组视图仅供点号读值。 */
 function createGroupView(flat, keys) {
     const view = {};
     for (const key of keys) {
@@ -2459,13 +1549,6 @@ function createGroupView(flat, keys) {
     }
     return view;
 }
-/** 把九个组视图挂到平铺配置上(**就地**,返回的就是同一个对象——视图必须看着这一个存储处)。
- *
- *  组键是**不可枚举**的:`Object.keys(config)` / `JSON.stringify(config)` / `{...config}` 的平铺面因此
- *  逐字节不变(既有消费点、既有 dump/审计面零影响),代价是 spread 克隆不带组视图——克隆后要用组形,
- *  再过一次本函数(读一个缺席的组是当场 TypeError,不会静默给旧值)。
- *
- *  `loadConfig` 是主调用点;测试夹具(test/helpers/make-config.ts)构造 `ServiceConfigFlat` 后同样过它。 */
 export function attachConfigGroups(flat) {
     const groups = {
         store: createGroupView(flat, STORE_GROUP_KEYS),
@@ -2484,39 +1567,19 @@ export function attachConfigGroups(flat) {
     return flat;
 }
 export function loadConfig() {
-    // #157:落点清槽必须排在**第一条**语句 —— 比下面那组同类复位还早一格,因为 rejectRetiredEnvs 本身会抛,
-    // 而一轮抛出的 loadConfig 绝不能把**上一轮**成功解析的落点留在槽里被下一次排空读成本轮事实
-    // (交叉复审第二轮,2026-08-06)。下面三格同族收集器在这条最早拒启路径上仍有同形残留,那是既有面、
-    // 且都按 warn 排空,不在本件射程内。
     EXEC_LANE_NOTICE = undefined;
-    rejectRetiredEnvs(); // [2354] 退役 env 墓碑:在场即拒启带新名指引
-    CONFIG_WARNINGS.length = 0; // repeated loadConfig() calls (test setup) must not accumulate stale warnings
+    rejectRetiredEnvs();
+    CONFIG_WARNINGS.length = 0;
     CONFIG_NOTICES.length = 0;
-    CONFIG_KNOBS.clear(); // the polarity table describes THIS load, never a previous one's env
-    // Posture gate: single-user turnkey (`REQUIRE_PRINCIPAL !== "true"` = one trusted super-admin on their own
-    // box/tenant, CC's trust model) ⇒ the CC capability set defaults ON, each composed with its infra prereq; multi-tenant
-    // (requirePrincipal) stays opt-in (gated + secured). This is the SAME discriminator LSP's host-default-ON uses,
-    // generalized into one posture switch (the PM's "not per-flag" ask). In `postureOn`, an explicit `X_ENABLED=true/false`
-    // ALWAYS wins; else the default = single-user ∧ infra-ready. 🔒 Multi-tenant (prod) is UNAFFECTED (postureOn → false).
-    // Parsed ONCE here (design/158 B4) instead of re-comparing `process.env.REQUIRE_PRINCIPAL` at the four sites
-    // that needed it — two of which spelled it `!== "true"` and two `=== "true"`, i.e. the same knob read in both
-    // polarities within one function. `boolEnv(x, false)` is value-identical to the old `=== "true"`.
+    CONFIG_KNOBS.clear();
     const requirePrincipal = boolEnv("REQUIRE_PRINCIPAL", false);
     const singleUserTurnkey = !requirePrincipal;
-    // `postureOn` takes the NAME (not the pre-read value) so the knob can register itself in the polarity table —
-    // the posture family is precisely the one whose default is NOT readable from its name, so leaving it out of the
-    // self-report would omit the worst offenders. Its tri-state semantics are unchanged: an explicit literal wins,
-    // anything else (including a typo — deliberately NOT warned here, unlike boolEnv) falls to the posture default.
     const postureOn = (name, infraReady = true) => {
-        // #241-rc2:显式臂与 boolEnv 同词表同拒启(parseBoolWord 单一属主)——三态语义不变
-        // (显式 true/显式 false/未设 ⇒ posture 默认),变的只是「显式」的判读:`=1` 是显式 true,
-        // 未知词拒启而不是静默滑进 posture 默认。
         const explicit = parseBoolWord(name, process.env[name]);
         const value = explicit ?? (singleUserTurnkey && infraReady);
         registerKnob({ name, polarity: "posture", value, source: explicit === undefined ? "posture" : "env" });
         return value;
     };
-    // ── 九域解析(纯解析)。调用次序贴合改前的 env 读序,故 CONFIG_NOTICES 的产出顺序逐条不变。
     const store = parseStoreDomain({ requirePrincipal });
     const modelPlane = parseModelDomain();
     const approval = parseApprovalDomain({ postureOn });
@@ -2526,21 +1589,10 @@ export function loadConfig() {
     const limitsHttp = parseLimitsHttpDomain();
     const observability = parseObservabilityDomain();
     const integrations = parseIntegrationsDomain();
-    // ── CROSS-INVARIANT-REGION:begin ────────────────────────────────────────────────────────────────
-    // 跨域耦合与跨域不变量:两条门(D-G 直连门、bake 门)的判据各自横跨 approval/auth/orchestration 三域,
-    //    任何单域都不足以裁定,故留在装配层(旧名保留,断言与消息逐字不变)。
-    // 🔴 #322:本区内的每一条拒启 throw 必须挂 `CROSS-INVARIANT:<id>` 锚,且 id 在
-    //    `src/config-invariants.ts` 的 CONFIG_CROSS_INVARIANTS 表内 —— 配置改热之后,一条**只活在 boot**
-    //    的不变量就是热路径上的静默漏检。机械门:test/config-hot/batch1-cross-invariants.test.ts(双向)。
     const { directApprovalDoor, durableApproval: dgDurable, approvalHmacKeys: dgHmacKeys } = approval;
     const { principalJwtPubkeys, principalJwtIss, principalJwtAud, operatorPrincipals: dgOperators, authTokens } = auth;
     const { enabled: imageBakesEnabled, runnerPrincipal: bakeRunnerPrincipal } = orchestration.imageBakes;
-    // 🔴 the direct-door crypto gate lives ONLY in the durable (checkpointStore) /decide branch — so DURABLE_APPROVAL
-    // is a HARD precondition. Without it, checkpointStore is undefined and there is NO decide path at all
-    // ([2354] A-5:legacy trusted-header /decide 车道已在 5.0.0 退役——本不变量从「防旁路」变成「防死门」,保留)。
     const directDoorActive = directApprovalDoor && dgDurable && dgHmacKeys.length > 0 && principalJwtPubkeys.length > 0 && !!principalJwtIss && !!principalJwtAud;
-    // 🔴 boot invariant (D-G §3): a half-configured direct door is the WORST state (looks on, verifies nothing) — and
-    // an empty OPERATOR_PRINCIPALS makes isOperator() true-for-all (= cross-tenant escalation). Refuse to start.
     if (directApprovalDoor) {
         const missing = [];
         if (!dgDurable)
@@ -2555,56 +1607,22 @@ export function loadConfig() {
             missing.push("PRINCIPAL_JWT_AUD");
         if (dgOperators.length === 0)
             missing.push("OPERATOR_PRINCIPALS (else isOperator is true-for-all)");
-        // 🔴 F-fix (dim-6): a direct door is inherently MULTI-TENANT (per-task verified JWT principal). Without
-        // REQUIRE_PRINCIPAL=true an absent/invalid principal falls through as ANONYMOUS and the owner/quota checks
-        // degrade to the spoofable header for null-owner rows — refuse a direct door that doesn't require a principal.
         if (!requirePrincipal)
             missing.push("REQUIRE_PRINCIPAL=true (a direct door is multi-tenant; without it an absent principal is anonymous and the spoofable header governs owner/quota checks)");
         if (missing.length) {
-            // CROSS-INVARIANT:direct-door-anchors
             throw new Error(`DIRECT_APPROVAL_DOOR=true but D-G anchors are missing: ${missing.join(", ")} — refusing to start a half-open direct door (design/80 D-G boot invariant)`);
         }
     }
-    // 🔴 boot invariant (#157-①, silent-downgrade-batch-20260805 普查候选 1/2): the BFF multi-tenant durable form
-    // (DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true, direct door OFF) had NO invariant — the D-G one above only
-    // binds when DIRECT_APPROVAL_DOOR=true. On that form the four READ surfaces in approvals-assistant.ts
-    // (GET /v1/approvals, /stream, /v1/assistant/inbox, /tasks) scope by the bare isOperator, whose empty-list
-    // "true-for-all" lets ANY authenticated tenant principal list/subscribe every other tenant's pending queue
-    // (redacted tool-input previews + decide-binding fields) and inspect arbitrary owners via ?owner. The WRITE
-    // surfaces (decide/preempt/resume/plan_review) already use explicitOperatorOk and were never exposed. The
-    // single-tenant legacy semantic (REQUIRE_PRINCIPAL unset — the shared service token IS the operator boundary)
-    // is deliberately preserved: only the multi-tenant form is a hole. Refuse to start it.
     if (dgDurable && requirePrincipal && dgOperators.length === 0) {
-        // CROSS-INVARIANT:operator-principals-required
         throw new Error("DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true but OPERATOR_PRINCIPALS is empty — on a multi-tenant worker the empty operator set makes isOperator() true-for-all, so every authenticated tenant could read every other tenant's pending-approval queue (GET /v1/approvals & siblings). Set OPERATOR_PRINCIPALS, or unset REQUIRE_PRINCIPAL if this is a single-tenant deployment (#157-① boot invariant)");
     }
-    // 🔴 boot invariant (IMAGE-API-DESIGN.md §P2.4a): the bake door is build-host-RCE-capable, and isOperator([],p)
-    // is true-for-all — so enabling bakes with an empty OPERATOR_PRINCIPALS = a WORLD-WRITABLE RCE door. Refuse to
-    // start (never a half-open bake door). The explicit-operator gate in server.ts is the runtime twin of this.
     if (imageBakesEnabled && dgOperators.length === 0) {
-        // CROSS-INVARIANT:bake-operator-principals
         throw new Error("IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host; an empty operator set makes isOperator() true-for-all (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)");
     }
-    // 🔴 boot invariant (IMAGE-API-DESIGN.md §P2.12 / H1): the bake-runner identity is DERIVED from its bearer
-    // credential (token-derived `source`), never a self-asserted header — so a SERVICE_AUTH_TOKENS entry whose
-    // system == BAKE_RUNNER_PRINCIPAL MUST exist, else the runner can never satisfy isRunner and the entire
-    // claim/ingest/heartbeat pipeline is silently dead. Refuse to start a bake door with no runner credential.
     if (imageBakesEnabled && !Object.values(authTokens).includes(bakeRunnerPrincipal)) {
-        // CROSS-INVARIANT:bake-runner-credential
         throw new Error(`IMAGE_BAKES_ENABLED=true but no SERVICE_AUTH_TOKENS entry maps to the runner principal '${bakeRunnerPrincipal}' — the bake-runner authenticates by its credential (token-derived source), so a '<BAKE_RUNNER_TOKEN>=${bakeRunnerPrincipal}' SERVICE_AUTH_TOKENS entry is required or claim/ingest/heartbeat all 403 (IMAGE-API-DESIGN.md §P2.12 boot invariant)`);
     }
-    // 🔴 boot invariant #193 车4 件2(台账 P1-10 / docs/DESIGN-193-CAR4-leader-failclosed.md 件2):leader
-    // 车道的两条「启用即损坏」组合,在 config 层 fail-closed。两门都只在 `LEADER_ENABLED=true` 时可能触发
-    // —— 默认 false ⇒ 现行为逐位不变(负控在 config-validation.test.ts 里钉着)。
-    //
-    // 门①(host 腿 per-worker workspace 未接线):`leader/wire.ts` 里 worker 环境的 workspace 基准是
-    // `cfg.workspace ?? "/home/user"` 这一条**绝对路径**,并贯穿 stageWorkerEnv / provisionIntegrationSandbox /
-    // mkRepair / mkConflictResolver;而 `plugins/remote-env-host.ts` 给每个 host env 分的是**各不相同**的随机
-    // 目录(`sema-host-<id>-<rand>`)——绝对路径不随之走。于是 N 个并发 host worker 全部落在同一个物理目录里
-    // 竞态写 git 状态:不是报错,是**静默数据损坏**。真修(provisionWorker 给每个 worker 传唯一 workspace)
-    // 不在本车;门先行,消灭「启用即损坏」的窗口。
     if (orchestration.leaderEnabled && orchestration.remoteExec?.provider === "host") {
-        // CROSS-INVARIANT:leader-host-lane
         throw new Error("LEADER_ENABLED=true + REMOTE_EXEC=host is refused: the leader wire pins ONE absolute workspace path " +
             "(LEADER_WORKSPACE / the /home/user default) for every sub-worker, while the host adapter gives each env a " +
             "DIFFERENT random directory — so N concurrent host workers would share one physical git worktree and " +
@@ -2612,25 +1630,14 @@ export function loadConfig() {
             "on an isolated lane (REMOTE_EXEC=e2b or k8s), or turn the leader off (unset LEADER_ENABLED) " +
             "(#193 车4 件2 / staleness ledger P1-10 boot invariant)");
     }
-    // 门②(无外部 SQL 持久层):仓级前提是「durable state lives in an external SQL store」。没有 SQL 后端时
-    // leader run 的登记表退化成进程内 Map ⇒ 跨副本 GET 404、重启即失忆、POST 重试直接起**第二次真 git push**。
-    // 「多副本」这件事在 config 层判不了(副本数不是本进程的知识),可判的**代理**就是 durable 前提本身:
-    // 一个没有外部 SQL 店的部署,与 leader run(N worker、最长 24h、真 push)的语义结构性不相容。
     if (orchestration.leaderEnabled && store.dbBackend !== "mysql" && store.dbBackend !== "pg") {
-        // CROSS-INVARIANT:leader-durable-store
         throw new Error(`LEADER_ENABLED=true but DB_BACKEND=${store.dbBackend} (no external SQL store) is refused: a leader run is an ` +
             "N-worker fan-out lasting up to 24h that ends in a REAL git push, and without a durable store its registry is " +
             "a per-process Map — a cross-replica GET 404s, a restart forgets the run, and a retried POST starts a SECOND " +
             "push. Point the service at a durable store (DB_BACKEND=mysql|pg), or turn the leader off (unset LEADER_ENABLED) " +
             "(#193 车4 件2 / staleness ledger P1-9+P1-10 boot invariant)");
     }
-    // ── CROSS-INVARIANT-REGION:end ──────────────────────────────────────────────────────────────────
-    // #157 F 类观测:执行车道落点记账放在这里 —— 九域解析与上面全部跨域不变量都过了之后,即「这一轮
-    // 确实启得起来」才成立的位置(写在 REMOTE_EXEC 解析途中的话,后置拒启会留下一条没启起来的落点)。
     EXEC_LANE_NOTICE = buildExecLaneNotice(orchestration.remoteExec);
-    // 平铺面**单点展开**九域产物(唯一存储处),再挂上九个组视图。组视图是对这同一个对象的取景器,
-    // 不是第二份拷贝 —— 故 `config.limitsHttp.port === config.port` 恒成立,含热应用之后(见
-    // attachConfigGroups / config-types.ts 分组段)。
     return attachConfigGroups({
         ...store,
         ...modelPlane,
@@ -2641,34 +1648,11 @@ export function loadConfig() {
         ...limitsHttp,
         ...observability,
         ...integrations,
-        directDoorActive, // 跨域合取(approval × auth × requirePrincipal),见上
+        directDoorActive,
     });
 }
-/** 有效监听绑址([1934])。**显式 `BIND_HOST`/`HOST` 恒生效**(operator 保留在任何形下明示暴露的
- *  权利);未显式时:**无鉴权写面 ⇒ 127.0.0.1**,其余 ⇒ undefined(Node 默认全接口,既有部署零影响)。
- *
- *  为什么缺省要自己收窄、而不是只加旋钮:桌面形的安全结论原本写着「safe ONLY because HOST is
- *  pinned to 127.0.0.1」,而那个前提在本仓从未成立(HOST 零消费)——把一个没人实现的假设当防线,
- *  是「沉默陷阱」。零凭证 + 全接口 + host lane(用户真机非沙箱)= 同网段任意执行,缺省必须安全。
- *  "无鉴权写面" 的判据与 http 层 503 fail-closed 门同源:allowUnauthedWrites 且**完全没有**凭证
- *  (半配=凭证必须使用,不算无鉴权)。 */
-/**
- * 缝合审 M4:per-request 配速上限旋钮(TASK_TIMEOUT_MAX_SEC / TASK_MAX_OUTPUT_TOKENS_MAX /
- * TASK_MAX_TURNS_MAX)的解析 —— 判据提成函数放到 env 解析的家里。
- *
- * 病:旧码是 `Math.floor(Number(process.env[name] ?? "0"))`,非有限或 ≤0 ⇒ 回 undefined ⇒ **该上限
- * 不设**。而这三个旋钮的全部用途就是给多租部署封顶 caller 自报的配速,于是打错一个字符(`50s`、
- * `5_000`、全角数字)⇒ 封顶静默消失,caller 从此可自报任意 timeout/tokens/turns。fail-open 且零痕迹。
- *
- * 本仓**已经有**为这种情况建的渠道(`CONFIG_WARNINGS` / `drainConfigWarnings`,注释逐字写着
- * 「soft-knob parse rejects … main.ts drains this once after createLogger and warns per entry」),
- * 这三个旋钮没走它。这里只加**可观测性**,不改解析语义:非法值仍不设限(改成拒启会把一个打错字的
- * 运营方整个挡在门外,代价与收益不成比例),但它必须出声。
- *
- * @returns `{}` = 缺席(正常的「不设限」);`{ value }` = 生效;`{ invalid }` = 存在但非法(不设限 + 该告警)。
- */
 export function parseCapEnv(name, raw) {
-    void name; // 名字只为调用方的日志留位;判据本身与旋钮名无关(三个旋钮同一条语义)
+    void name;
     if (raw === undefined)
         return {};
     const n = Math.floor(Number(raw));
@@ -2676,21 +1660,6 @@ export function parseCapEnv(name, raw) {
         return { invalid: raw };
     return { value: n };
 }
-/**
- * 缝合审 M6:数据根与配置根是否分家 —— 判据提成函数,放在 `localDataRoot` 自己的文件里。
- *
- * 两条解析各写各的:数据根吃 `LOCAL_DATA_ROOT`,配置根(`main.ts` 的 `localRoot` / `run-local.ts` 的
- * `root`)不吃。只设 `LOCAL_DATA_ROOT=/data/sema` 的部署因此把 store 数据挪到了 /data/sema,而
- * config.d / remote-exec.json 仍从 `~/.ai-agent` 读 —— 静默分家,而设它的人多半以为改的是「本地数据放哪」。
- *
- * 讽刺处:`main.ts` 那段的标题逐字写着「ONE local root for BOTH … avoids a split-brain」——那条论证
- * 合并了 config provider 与 remoteExec 两个根,**漏了第三个**。
- *
- * 这里**不改解析**(让配置根跟着 `LOCAL_DATA_ROOT` 走,会让现有部署的 config.d 当场失踪 —— 代价比
- * 分家本身大得多)。只回一个「分家了,两个根分别是什么」的事实,由 boot 期打告警,合一旋钮 = `CONFIG_LOCAL_DIR`。
- *
- * @returns 分家时回两个根;一致(或已被 CONFIG_LOCAL_DIR/AGENT_DATA_DIR 统一)时回 undefined。
- */
 export function splitLocalRoots(a) {
     const configRoot = a.configLocalDir ?? a.agentDataDir ?? join(a.home, ".ai-agent");
     if (!a.localDataRoot || a.localDataRoot === configRoot)
@@ -2700,13 +1669,6 @@ export function splitLocalRoots(a) {
 export function resolveBindHost(config) {
     const anyServiceAuth = Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
     const mustNarrow = Boolean(config.allowUnauthedWrites) && !anyServiceAuth;
-    // 缝合审 M5:`bindHost` = `BIND_HOST || HOST`,而 zsh 常设 `HOST=<机器名>` —— 用户从未设过它。
-    // 旧码第一行就是 `if (config.bindHost) return config.bindHost`,于是一个**继承来的** shell 变量
-    // 静默击穿了下面那条无鉴权自收窄:写面无鉴权 + 绑到机器名解析出的 LAN 地址 = 同网段任何人可在
-    // 用户真机上提交任务并执行。触发条件是「什么都没做」,这是它比一般配置错误危险的地方。
-    // [2062]③ 已经识别出「HOST 是暗通道」并加了启动 warn,但那个识别没接到这条判据上 —— 现在接上:
-    // **只在收窄条件成立时**让收窄压过继承的 HOST(`HOST` 在 Node 生态确有绑址惯例,不能当它不存在);
-    // 显式 `BIND_HOST` 恒生效,operator 明示暴露的权利一点不动。main.ts 会为被压过的那次打专门告警。
     if (config.bindHost && !(mustNarrow && config.bindHostSource === "HOST"))
         return config.bindHost;
     return mustNarrow ? "127.0.0.1" : undefined;