@sema-agent/server 7.43.0 → 7.44.0

package/dist/main.js

@@ -9,7 +9,7 @@ import { subagentSendUserFileExtraTools } from "./capabilities/send-user-file-to
 import { brainSummary } from "./brain.js";
 import { loadConfig, logConfigDiagnostics, resolveBindHost, splitLocalRoots, parseCapEnv, numEnv } from "./config.js";
 import { cardRuleScopeRoot } from "./task-cwd.js";
-import { isPricingConfigured } from "./budget.js"; // 缝合审 M3:capabilities.pricingConfigured 的单一真源判据
+import { isPricingConfigured } from "./budget.js";
 import { drainNumEnvWarnings } from "./plugins/remote-shell.js";
 import { ensureChildSessionDurableWithPromotion } from "./plugins/session-store.js";
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
@@ -45,13 +45,13 @@ import { createConfigCenterRuntime } from "./boot/config-center.js";
 import { createResolveSpec } from "./boot/resolve-spec.js";
 import { createParkedReviveInheritedGate } from "./boot/parked-revive-gate.js";
 import { startReapers } from "./boot/reapers.js";
-import { assertRetentionLaneWirable, startRetentionLane, RETENTION_LEASE_TTL_FACTOR } from "./boot/retention-lane.js"; // #270 车2
+import { assertRetentionLaneWirable, startRetentionLane, RETENTION_LEASE_TTL_FACTOR } from "./boot/retention-lane.js";
 import { startFleetReconciler } from "./fleet/fleet-reconciler.js";
 import { openStores } from "./boot/stores.js";
 import { runAdoptionBootScan } from "./boot/adoption.js";
 import { auditDormantPermissionRules } from "./boot/permission-rules-audit.js";
 import { createBudgetAndTracing } from "./boot/budget-tracing.js";
-import { createLimitSync } from "./boot/limit-sync.js"; // #322 批1:限额座的换代口(恒构造 + 关断哨兵)
+import { createLimitSync } from "./boot/limit-sync.js";
 import { createSideQueryLane } from "./boot/side-query-lane.js";
 import { createWebFetchSummarizeLane } from "./boot/webfetch-summarize-lane.js";
 import { createRuleConsentLane } from "./rules-consent.js";
@@ -67,8 +67,6 @@ import { createSessionFaces } from "./boot/session-faces.js";
 import { createLeaderFace } from "./boot/leader.js";
 import { assertStaticWiringConsistent } from "./http/routes/diagnostics.js";
 import { installShutdownHandlers } from "./boot/shutdown.js";
-/** Service version for GET /v1/capabilities — read from the package.json shipped next to src/ in the
- *  image (Dockerfile COPYs it). Best-effort: an unreadable file reports "unknown", never crashes boot. */
 function serviceVersion() {
     try {
         const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
@@ -78,93 +76,30 @@ function serviceVersion() {
         return "unknown";
     }
 }
-/**
- * Service entrypoint. **装配次序表**(design/158 A10)。
- *
- * 各 boot 段已按内聚下沉到 `src/boot/*.ts` 叶子(纯搬运,逐字);本函数保留的是**顺序本身**——
- * 谁先谁后是行为(env 读取时序、诊断排空点、信号注册时点、工厂装饰顺序),每个叶子的文件头
- * 都写明了它那条「位置即契约」。当前次序:
- *
- *   loadConfig → logger/metrics → 诊断排空(logConfigDiagnostics + drainNumEnvWarnings)
- *     → boot/config-center(sealed-key/provider/prompt-epoch 店/effective 拉取/LKG 兜底/tolerant apply)
- *     → boot/config-center.applyLocalRemoteExec(local 形 config.d/remote-exec.json 覆写)
- *     → boot/stores(StoreBackend + memory + 四个 durable 店 + sessionStore + 拒启断言)
- *     → boot/budget-tracing(brain/pricing/quota/tracer)
- *     → boot/execution-env(remote-exec 工厂链 + LSP)
- *     → toolTracer/deploymentHooks
- *     → boot/workflow-orchestration → boot/coordinators → boot/runtime-caps
- *     → boot/runner-deps → new Runner → hook LLM/agent → subRunner
- *     → runStore/anchors/approval 面 → skills → boot/config-center.applyCenterCapabilities
- *       (center skills/plugins/boot-LKG/mcp)→ buildScenarios → .applyCenterScenarios
- *     → boot/reapers → OTLP → boot/config-center.startRefreshLoop → .initKeyResolver
- *     → boot/session-faces → boot/leader → ServiceDeps 七组 → boot/resolve-spec
- *     → createHttpServer → listen → fleet client → boot/shutdown(必须最后:信号注册时点即契约)
- *
- * A10 尾刀(config-center):`ccEtag/effective/latestEffective/appliedPlaneEff/planeDeferredNoHandoff/
- * pendingRestart/bootSkillStale/keyResolver/centerPrompts/…` 这组跨段可变状态,已整体搬进
- * `boot/config-center.ts` 那只工厂的**闭包**(仍是 `let`,每一处读写的文本与次序逐字未改 ——
- * codex R10–R38 的重启风暴判据全部按原样保留);main 只经窄口读:`getKeyResolver/getCenterPrompts/
- * modelReady/restartState/planeDeferredState/promptSource`,与本目录既有的晚绑 getter 惯例同款。
- *
- * Wires the three planes:
- *   Brain   = external LLM gateway (createBrain)
- *   Session = pluggable store (TiDB durable event-log center, or in-memory)
- *   Hands   = tools/MCP injected per request in resolveSpec (deployment-owned)
- * Persistence (L1 sessions + L2 memory) lives in the external TiDB center; this container is stateless.
- */
 async function main() {
     const config = loadConfig();
-    // ── CROSS-INVARIANT-REGION:begin ────────────────────────────────────────────────────────────────
-    // Liveness invariant: the running instance refreshes updated_at every HEARTBEAT_MS; the reaper fails
-    // a run whose updated_at is older than runStaleSec. If the stale window were ≤ the heartbeat, the
-    // reaper would race a perfectly alive run. Fail fast on a misconfiguration instead of reaping live work.
-    // #322:判据本体已搬进 `config-invariants.ts` 的单源表 —— 热路径(config-center stage)跑的是**同一条**,
-    // 所以一个过小的 runStaleSec 既不能从 env 起服,也不能从中心热发布进来(禁手抄第二份判据)。
     if (config.runStaleSec * 1000 <= HEARTBEAT_MS) {
-        // CROSS-INVARIANT:run-stale-heartbeat
         throw new Error(`REAP_RUN_STALE_SEC (${config.runStaleSec}s) must exceed the ${HEARTBEAT_MS / 1000}s liveness heartbeat`);
     }
-    // ── CROSS-INVARIANT-REGION:end ──────────────────────────────────────────────────────────────────
     const logger = createLogger(config.logLevel);
     const metrics = createMetrics();
-    // #157 fail-open 治理:把 logger/metrics 接到进程级 failOpen 记录器上(见 observability/fail-open.ts)。
-    // 排在这里而不是更晚:兜底臂遍布装配链,越早接上,越少的 fail-open 只剩探针行没有结构化痕迹。
-    // 装配前已累计的计数与已喊过的 tag 由 install 继承,不重置也不重喊。
     installFailOpenRecorder({ logger, metrics });
-    // A-033.3(#256):同一处接上密钥形 env 剥除的留痕面(core `scrubSecretEnv` 的 findings 收集器半场)。
-    // 同因排在这里:两条剥除腿(host shell 继承 env / project-memory 的 git 子进程)都在没有观测句柄的深处。
     installSecretEnvScrubRecorder({ logger, metrics });
-    // S20 (SILENT-FALLBACK P1) + [792]④ boot notices: config parsing runs before the logger exists — drain both
-    // pre-logger collectors via the shared helper (F10: run-local uses the same one, so entrypoints can't drift).
     logConfigDiagnostics(logger);
-    // design/158 B4 交接小件:plugins 数值旋钮(HOST_BG_*/K8S_BG_*/E2B_*,模块级 import 时读)的非法
-    // 字面量告警——通道在 remote-shell.ts 自带(不造 plugins→config 依赖边),与上面同一 boot 诊断点排空。
     for (const w of drainNumEnvWarnings())
         logger.warn("config_env_invalid_using_default", { env: w.env, raw: w.raw });
-    // M1(接入审计 2026-07-08):core verify 契约=verifier 必须异于 implementer(去相关性是 🔴 部署契约)。
-    // verifier 角色落 "default" 时对抗验证者=实现者自评自批——比无验证更糟(假安全感)。曝光而非静默:
-    // 单模型部署配 MODEL_VERIFIER 指异构模型即消警(typo/不在 catalog 同样落到这里)。
     if ((config.roles?.verifier ?? "default") === "default") {
         logger.warn("verify_decorrelation_unavailable", {
             hint: "verifier role = default (= implementer) — adversarial verification grades its own work; set MODEL_VERIFIER=<catalog model id> to a heterogeneous model",
             ...(process.env.MODEL_VERIFIER ? { rejected: process.env.MODEL_VERIFIER, reason: "not in catalog" } : {}),
         });
     }
-    // S24: redaction rewrites by pattern; LOW: web-search non-array payloads by provider.
     setRedactionObserver((pattern, n) => metrics.inc("redactions_applied_total", { pattern }, n));
     setWebSearchBadPayloadObserver((provider) => {
         metrics.inc("web_search_bad_payload_total", { provider });
         logger.warn("web_search_non_array_payload", { provider });
     });
-    // 🔴 ONE local root for BOTH the config provider (models/skills/mcp) AND the remoteExec loader (avoids a
-    // split-brain — createConfigProvider defaulted to process.cwd() while loadRemoteExec used
-    // AGENT_DATA_DIR, so config.d and remote-exec.json could resolve to DIFFERENT directories). run-local already
-    // computes this once; main.ts now does too. Shared with the config-center runtime and every boot leaf below.
     const localRoot = config.configLocalDir ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");
-    // 缝合审 M6:上面这条论证合并了 config provider 与 remoteExec 两个根,**漏了第三个** —— store 的
-    // 数据根另有一条解析(config.ts 的 `localDataRoot`,它吃 `LOCAL_DATA_ROOT` 而这里不吃)。只设
-    // LOCAL_DATA_ROOT 的部署因此数据在一处、config.d/remote-exec.json 在另一处,而且**一声不响**。
-    // 不改解析(改了现有部署的 config.d 会当场失踪),改成说出来 + 给合一旋钮。
     const rootsSplit = splitLocalRoots({
         localDataRoot: config.localDataRoot,
         configLocalDir: config.configLocalDir,
@@ -177,49 +112,17 @@ async function main() {
             note: "LOCAL_DATA_ROOT moved the local backend's DATA root, but config.d / remote-exec.json are still read from the config root (LOCAL_DATA_ROOT is not consulted there). If you meant to move both, set CONFIG_LOCAL_DIR to the same directory.",
         });
     }
-    // design/158 A10 尾刀:config-center 的 boot 半场(sealed-key 托管 → provider → prompt-epoch 店 →
-    // effective 拉取 / LKG 兜底 / tolerant apply)搬到 src/boot/config-center.ts。该段与 refresh 循环共享的
-    // 12 个跨段可变 `let` 现在是那只工厂的闭包私有字段(每一处读写的文本与次序逐字保留,见该文件头注);
-    // main 只经窄口读:getKeyResolver/getCenterPrompts/modelReady/restartState/planeDeferredState/promptSource。
-    // ⚠️ 位置即契约:必须在 openStores 之前 —— models/roles/teams 要在 Runner/持久层建起来之前应用进 config。
     const configCenter = await createConfigCenterRuntime({ config, logger, metrics, localRoot });
-    // design/158 A10 尾刀:local 形的 config.d/remote-exec.json 覆写搬到 boot/config-center.ts(逐字)。
-    // ⚠️ 位置即契约:就地改写 config.remoteExec,必须早于 createExecutionEnv 这个消费点。
     await configCenter.applyLocalRemoteExec();
-    // design/158 A10:持久层装配搬到 src/boot/stores.ts(逐字)。⚠️ 该段就地归一 `config.sessionBackend`
-    // 且承载三条 fail-loud 拒启断言 —— 位置即契约,理由见该文件头注。
     const { backend, storeBackendDegraded, memoryEngine, memorySyncCursors, rosterStore, backgroundAgentStore, taskAttachmentStore, mailboxStore, memoryExportBackend, memorySyncRunner, sessionStore, breakerState, usageWindowStore, memoryPosture, taskListLane, } = await openStores({ config, logger, metrics, localRoot });
-    // design/183 I6(server 同族):**每副本 boot 必查**收编日志的在飞行 —— 续跑或响亮留痕,禁静默跳过。
-    // 位置:store 开完之后(要 backend)、任何路由装配之前(半迁移状态绝不带进服务期)。判据与「为什么
-    // 是续跑而不是拒启」见 boot/adoption.ts 顶注。
-    // #264 v2-c:治理携出 bundle 两面(POST /v1/memory/{export,import})的引擎接线。**一次**构造、两口共用
-    // —— 与 orgMemoryDirectory / sharedMemoryStore 同姿势(一个进程对同一件事只有一个实例)。
-    // 引擎为什么在这里现构、以及「这两条路径是店级的、不读挂载树」的亲读依据,全文见 memory-bundle-engine.ts。
-    // 缺席(记忆引擎未接线)⇒ 两口 501 `capability.memory_engine_required`。
     const memoryBundleFaces = memoryEngine ? createMemoryBundleFaces(memoryEngine) : undefined;
     const adoptionBoot = await runAdoptionBootScan({ backend, logger });
     if (adoptionBoot.scanned > 0 || adoptionBoot.error !== undefined) {
         logger.info("adoption_boot_scan", { ...adoptionBoot });
     }
-    // design/158 A10:计费/追踪/预算装配搬到 src/boot/budget-tracing.ts(逐字;tracer 与 side-query 同 sink 实例的
-    // 「同段构造」契约见该文件头注)。
     const { brain, pricing, counterDegradeHook, costQuota, modelUsageTracker, promptManifestTracker, fleetUsage, fleetLease, tracer, sideQueryAccounting, toolResultStore, sessionPolicyStore, fileSnapshotStore, } = createBudgetAndTracing({ config, logger, metrics, backend, breakerState });
-    // #154 车二:持久化权限规则店(core 5.18.0 design/179 + 5.22.0 design/182)。三面一束 —— 规则桶
-    // provider 上 `RunnerDeps.permissionRuleStore`(引擎据它铸 ruleSuggestions + 把 manifest 的
-    // `permissionRules.storeWired` 报成真),审批记录 + 导入票喂同意车道(HTTP 两口的属主)。
-    // 缺席(local 车道 / 无 backend)⇒ 诚实缺席:storeWired:false、帧上零候选、两口 501。
-    // 🔴 总开关在最前(codex round7 [high] 一):关 ⇒ 整条车道根本不装配(店/车道/帧键/两口一起消失)。
     const permissionRuleStores = config.permissionRulesEnabled && backend ? backend.permissionRule() : undefined;
     const ruleConsent = permissionRuleStores ? createRuleConsentLane(permissionRuleStores) : undefined;
-    // 🔴 A-010.10(验真后修):**旋钮开着却上不了场 ⇒ 打一行**,与同族旋钮 `STREAM_APPROVAL_ENABLED` 的
-    // `stream_approval_disabled` 一行(`boot/coordinators.ts`)对称。
-    // 此前这一格全程静默:`PERMISSION_RULES_ENABLED=true` 的部署若没有 backend、或 backend 没实装规则店,
-    // 车道就悄悄整条不装配 —— 运维看到的是「设了旋钮,可 `/v1/rules` 恒 501、卡上恒无候选」,而启动日志
-    // 里一个字都没有。判据逐字照那条先例:①**info 不是 warn**(这是合法部署形,不是配置错误);
-    // ②旋钮本来就没开的部署**不打**(显式关掉的人自己知道为什么,一行噪音零信息);
-    // ③原因写成机读位(哪一项不成立),不是一句人话。
-    // 与紧随其后的 `auditDormantPermissionRules` 是两件事、互不遮蔽:那条说的是「车道上了场,并且库里有
-    // 既有桶被默认 ON 唤醒」,这条说的是「车道压根没上场」——两者的合取恒假,永远只会打其中一行。
     if (config.permissionRulesEnabled && permissionRuleStores === undefined) {
         logger.info("permission_rules_lane_unavailable", {
             knob: "PERMISSION_RULES_ENABLED",
@@ -228,107 +131,38 @@ async function main() {
             note: "PERMISSION_RULES_ENABLED is on but no permission-rule store is wired — /v1/rules/* answer 501, approval cards carry no rule suggestions, and respond's persistRule is refused with rule_lane_unavailable",
         });
     }
-    // #203 §3(设计稿 v2 F4 残余):默认 ON 会把**既有**规则桶一并唤醒 —— 在启动日志里把它说出来。
-    // 三条判据(店缺席 / 零桶 / 运维显式表过态 ⇒ 都不打行)与失败方向(数不出来只 warn,绝不拒启、
-    // 也绝不编一个 0)逐字见 `boot/permission-rules-audit.ts`。
     await auditDormantPermissionRules({ stores: permissionRuleStores, logger, explicit: config.permissionRulesEnabledExplicit });
-    // design/158 A10:执行环境装配搬到 src/boot/execution-env.ts(逐字)。
-    // ⚠️ 工厂装饰顺序=行为(scratchpad → worktree → SendUserFile 登记 → 附件物化最外层),见该文件头注。
     const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore });
-    // prove-before-scale stopgap: a no-op tool tracer (logs every tool call incl. resumed legs that
-    // /events hides) so we can diagnose single-agent coding behaviour. Off unless TOOL_TRACE=true.
     const toolTracer = config.toolTrace ? createToolTracer(logger) : undefined;
     if (toolTracer)
         logger.info("tool_trace_enabled", {});
-    // Goal B4 (2026-07-08): the ALWAYS-ON gate-deny meter (`permission_denied_total{source}`) — an
-    // operational/security signal that must not sit behind the TOOL_TRACE diagnostic switch. Composed
-    // UNDER the tracer (deployment slot order: meter first, tracer second — composeHooks double-runs the
-    // void permissionDenied slot); this composite is what every hooks site below uses as the deployment
-    // baseline, so a task-hooks fold (resolveSpec) shadows neither.
     const deploymentHooks = toolTracer ? composeHooks(createPermissionDeniedMeter(metrics), toolTracer) : createPermissionDeniedMeter(metrics);
-    // design/158 A10:workflow 编排面搬到 src/boot/workflow-orchestration.ts(逐字;构造次序契约见该文件头注)。
     const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
-    // #329:PARKED 行迟到决议的赎回席 —— **晚绑** holder(席本体是 `createHttpServer` 的产物,而协调器段
-    // 按其自身的次序契约必须排在它之前;同款先例 = 下方 reaper 的 `runDenySweep`)。接线在 server 造出来
-    // 之后一行,那里同时是**直连门**的 fail-closed 判定点(理由写在赋值处)。
     let parkedAskRedeem;
-    // design/158 A10:活体协调器 + SendUserFile 工具面搬到 src/boot/coordinators.ts(逐字;durableEnabled 的
-    // 「必须早于 runnerDeps 求值」次序契约见该文件头注)。
     const { elicitation, question, toolApproval, durableEnabled, streamApprovalGate, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec } = createLiveCoordinators({
         config, logger, backend, sendUserFileTaskEnvs, ruleConsent,
         getParkedRedeem: () => parkedAskRedeem,
-        // #295(F-1,[4512] 修向 (b')):卡批「不再询问」的 project root——语义单点见 task-cwd.ts
-        // `cardRuleScopeRoot` 顶注(session 注册 cwd ?? in-process 单用户形 process.cwd();其余 undefined)。
         ruleScopeRootFor: (sessionId) => cardRuleScopeRoot(sessionId !== undefined ? perSessionCwd.get(sessionId) : undefined, config),
     });
-    // design/158 A10:per-principal caps 段搬到 src/boot/runtime-caps.ts(逐字)。
     const { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver } = createRuntimeCaps({ config, logger });
-    // design/170 件A(#148 件3③):org 记忆准入装配(目录源三态选择+C12 能力探测,坏配置在此拒启动)。
     const orgMemoryAdmission = createOrgMemoryAdmissionWiring({ config, logger, metrics });
-    // design/177 —— org 共享记忆库(memory_list/memory_read + `/v1/shared-memory/*` 只读面)。
-    // 🔴 铸它的合取式是**唯一**的挂载条件,模型面与 HTTP 面共用:
-    //   ① SQL 供给面在场(`backend.sharedMemoryStore` —— local 车道诚实缺席,理由在 store-backend.ts);
-    //   ② org 折叠面在场(目录源)—— 没有成员性判据的共享读面只能全放或全拒,两个都比"这个面不存在"差。
-    // deployment-origin scope 只在**无租户边界**的部署里授予:多租户下一条部署级声明会同时授予每一个
-    // principal,那是跨租户读而不是配置便利(org-memory.ts 的 N2 同判)。择净在这一行,授权模块只忠实使用。
     const sharedMemoryStore = orgMemoryAdmission.directory !== undefined
         ? backend?.sharedMemoryStore?.(createSharedMemoryScopeAuthorizer({
             directory: orgMemoryAdmission.directory,
-            // 🔴 A-057.40:递的是**取值口**不是值 —— `config.projects` 由 config-center 就地热应用,
-            // boot 期快照会让新登记的 org 库变成终局式空集、让已撤销的 scope 继续被放行(后者是
-            // fail-open,且 projects 不在 RESTART_SLICES 里 ⇒ /health 一句提示都没有)。多租户择净
-            // 仍留在这一行(那是部署形态判据,boot 期定死,不随热应用变)。
             deploymentScopes: config.requirePrincipal === true ? () => [] : orgMemoryAdmission.deploymentMemoryScopesLive,
         }))
         : undefined;
     if (sharedMemoryStore)
         logger.info("shared_memory_stores_enabled", { backend: backend?.kind });
-    // 🔴 codex 复审(#196 finding-2b):`toolResultStore` 在**无 backend** 形下是 undefined,而 core 的
-    // Runner 构造函数会在缺席时**每只各自私建**一份 `RunnerSharedToolResultStore`(runtask.js
-    // `if (!this.deps.toolResultStore)`)。本部署有多只 Runner(主 / subRunner / hookAgent / #196 的两只无手
-    // 孪生),私建 ⇒ 每只一个独立店 ⇒ A 车道 offload 出去的 `ReadToolResult` 引用在 B 车道解引用不到
-    // (fork 子任务跨 runner 读父的 offload 是既有可达形,#196 的车道分家又多了一条)。这里显式铸**一份**
-    // 共享兜底(参数与 core 私建那只逐字相同:`RunnerSharedToolResultStore` 是 `InMemoryToolResultStore`
-    // 的空子类,cap 64M chars),只喂 Runner 侧。
-    // ⚠️ 刻意**不动** `toolResultStore` 本身:那个键的「present ⇔ durable 后端在场」语义还管着 E21 purge、
-    // reaper 清扫、leader 装配与 /health 的接线自述(改它会让无 backend 的部署自述成 "shared(sql)" = 谎)。
     const runnerOffloadStore = toolResultStore ?? new InMemoryToolResultStore({ maxTotalChars: 64_000_000 });
-    // 交接件⑤:commit 尾注署名座**算一次**,主/sub 两只 Runner 经共享基座同源。
-    // [931]① clay 拍(core 1.300 BREAKING:缺省不署 Co-Authored-By,署名=产品身份资产归部署):
-    // branded 形态(local provider = Sema 产品线,scenarios brandIdentity 同判据)commit 尾注接 Sema 署名;
-    // 非 brand 部署维持 core 新缺省(不署)。判据逐字不变,变的只是它现在**也**喂给 subRunner ——
-    // 一个被委派的子代提交进的是同一个仓、代表同一个部署,它的 commit 少一行 trailer 没有理由。
     const commitHands = config.configProvider === "local" ? { commitCoAuthor: "Sema <noreply@vivi-ai.com>" } : undefined;
-    // checkpointStore 构造(只依赖 backend/config——顺序安全;DURABLE_APPROVAL 仍是唯一门,ALL three
-    // backends carry checkpoint(),local = core FileCheckpointStore + service half)。四个消费点同一实例:
-    // 主 runner 的 per-task spec 面(resolveSpec durableEnabled 分支)、scenarioDeps(subagent spawn 面
-    // forwardDurableApproval)、subRunner deps(子代执行面 suspendAsk——[1584] 接线,裁定见 subRunner 构造
-    // 内注),以及紧随其下的 design/170 件D 留存能力校验(它要读这只店的 `retention` 声明位)。
-    // ⚠️ 位置即契约:必须早于 `createGovernanceSeams`(件D 校验的对象之一)与 `createRunnerDeps`。
     const checkpointStore = backend?.checkpoint && config.durableApproval ? backend.checkpoint(logger) : undefined;
-    // design/170 件B/C/D(#252 件1):三个部署治理座席 + 两条拒启判据(锁的装配相容性、留存能力校验)。
-    // ⚠️ 位置即契约:必须在 store 三件都构造完之后(件D 校验读它们的 `retention` 声明)、`new Runner` 之前
-    // (座席进 RunnerDeps);拒启在这里发生 = 还没开始服务。
-    // #270 —— 托管留存的**执行面装配**(设计稿 §7)。⚠️ 位置即契约:必须在 `createGovernanceSeams` 之前
-    //  (件① 的 `retentionExecutorWired` 是它的入参),也必须在 store 三件构造完之后(自持门要读它们的
-    //  声明位)。两只店都是 **SQL 后端专有**,`local`/无 backend 上恒 undefined —— 那正是 lane 自持门
-    //  在 `RETENTION_SWEEP_INTERVAL_SEC>0` 时拒启的那一支。
-    //
-    //  `taskAttachmentTable` 如实告知(车1 交接件③):它是「boot 真的 ensure 过那张表吗」的事实,
-    //  不是一个默认值 —— 无对象存储的部署上附件面整段不接线、表不建,一条盲发的 DELETE 会以
-    //  unknown-table 打红整轮 sweep(理由逐字见 retention-store-sql.ts 的 `SqlRetentionStoreOptions`)。
-    //  `taskListTables`(#318)同姿势但事实不同:`boot/task-list-lane.ts` 在**任何** SQL 后端上都无条件
-    //  ensure 那两张表(不像附件那样挂在对象存储配置上),所以这里的如实答案就是「车道落在 SQL 臂上」。
     const retentionExecutor = backend?.retention?.({ taskAttachmentTable: taskAttachmentStore !== undefined, taskListTables: taskListLane.backend !== "memory", logger });
     const retentionLaneStore = backend?.retentionLane?.();
-    // lane **自持**的 boot 不变式(件④;codex F3)——与下面 core 的 `assertRetentionCapability` 是两道门,
-    // 各答各的问题,本道**不看 locked**。判据与三条拒启臂逐字见 `boot/retention-lane.ts`。
     assertRetentionLaneWirable({
         intervalSec: config.retentionSweep.intervalSec,
         policy: config.retentionPolicy,
         executor: retentionExecutor,
-        // 与件D 校验**同一份**店清单(下面 `retentionStores` 那三行的同源读点):两道门看的是同一批真身,
-        // 一门放行另一门拒的分歧才有意义,而"看的不是同一批店"造成的分歧只是 bug。
         stores: [
             { name: "sessionStore", store: sessionStore },
             { name: "checkpointStore", store: checkpointStore },
@@ -339,25 +173,13 @@ async function main() {
     const governanceSeams = createGovernanceSeams({
         config,
         logger,
-        // 件D 的首批治理对象(design/170 §5.1 点名的三族)。**喂真身**:这道校验的全部价值就是读真店上的
-        // 声明位,喂一个"我以为装了什么"的替身等于把校验变成自证。`store: undefined` 的行由 core 跳过。
         retentionStores: [
             { name: "sessionStore", store: sessionStore },
             { name: "checkpointStore", store: checkpointStore },
-            // 🔴 R2-F3(codex 对抗复审,验真后修):喂 **Runner 真用的那一只**(`runnerOffloadStore`),不是
-            // `toolResultStore` —— 后者缺席时 Runner 拿的是本文件铸的 InMemory 兜底,而那只店同样受留存策略管辖。
-            // 喂错实例 = 校验漏掉了真正在跑的那一个,正是「校验读的不是真身」这类假绿。
             { name: "toolResultStore", store: runnerOffloadStore },
         ],
-        // 🔴 件①(车1 交接件,codex R2-[critical] 的修复面):**本 build 真的接了执行器吗**。
-        // core 的 `assertRetentionCapability` 只读店的声明位,而三只 SQL 店从车1 起就诚实地声明了
-        // `"managed"` —— 于是那道门会为一台**没有任何东西在删**的机器放行 locked policy。这一位问的是
-        // 另一个问题:有没有东西真会删。合取式逐字 = 上面那道自持门放行之后 lane 真的会起的条件。
         retentionExecutorWired: config.retentionSweep.intervalSec > 0 && retentionExecutor !== undefined && retentionLaneStore !== undefined,
     });
-    // design/158 A10:RunnerDeps 装配段搬到 src/boot/runner-deps.ts(逐字;runStore 晚绑改取值,见该文件头注)。
-    // #324:撤销台账席取一次、两处(主 runnerDeps + subRunner 共享基座)同一引用。takeMcpRevocations 的
-    // 取走动作同时打开 restart-signal 的删除向豁免(承接与豁免绑定,见 config-center 的方法注)。
     const mcpRevocations = configCenter.takeMcpRevocations();
     const runnerDeps = createRunnerDeps({
         hands: commitHands,
@@ -373,77 +195,9 @@ async function main() {
         getRunStore: () => runStore,
     });
     const runner = new Runner(runnerDeps);
-    // #196:`runner` 的无手孪生 —— 同 deps 同实例(sessionStore/toolResultStore/checkpointStore… 全共享,
-    // `Runner.sessions` 就是传进去的那只 store,两只 Runner 不会各持一份会话缓存),唯独不挂
-    // `executionEnvFactory`。core 的 `handsEnabled = ownedEnv || deps.executionEnv` 是 **per-Runner** 合同,
-    // 单 runner 服务全场景时结构上无法逐场景兑现 —— 这只孪生就是兑现它的那一半(设计小票 §2a)。
-    // 声明 hands:"none" 的场景(scan / code-review 两腿 / discuss / center overlay)在 HTTP 执行点被路由到这里。
-    //
-    // 🔴 两条**已知边界**(codex 复审 2026-08-09 两轮提出,逐条亲验 core dist 后如实记账;两条的部署条件
-    //     互不相同 —— 不要把它们并成一句)。
-    //
-    //  ① 会话锁是 **per-Runner** 的(core runtask.js 的 `sessionLocks` Map,每只 Runner 一份)。
-    //     **条件:无 store backend 的部署形**。有 runStore 时同会话并发提交被服务端的 run 认领挡成 409
-    //     (routes/tasks.ts:317 / routes/runs.ts:335 的 `createRun` 认领),两车道并发结构上不可达;无
-    //     backend 的部署没有那道认领,同一 sessionId 上「一条 full + 一条 none」并发就失去了修前由单
-    //     Runner 提供的串行化。同类缺口本就存在(subRunner 经 ForkRoutingSessionStore 也会碰宿主会话),
-    //     本件让它多一条可达路径。补偿:配任一 backend(含 `DB_BACKEND=local`)即恢复认领。
-    //
-    //  ② 升级窗的旧 checkpoint。**条件恰恰相反:必须有 checkpointStore**(= 有 backend + DURABLE_APPROVAL),
-    //     且部署在 REMOTE_EXEC 车道上 —— 修前建立的 hands=none 场景 durable checkpoint 会带 workspaceHandle
-    //     (可挂起 env 的快照形,以及**非**可挂起远端 env 的 `restoreMode:"park_only"` 形,两者都算;审批 park
-    //     与 resource suspend 都会写),续跑时被路由到这只无手 Runner,core 在 **CAS 之前**抛
-    //     `CheckpointError("checkpoint.unsupported_version", "checkpoint has a remote workspaceHandle but no
-    //     RunnerDeps.executionEnvFactory is wired to rebuild the env")`(runtask.js:3704)。
-    //     🟢 **裁定已翻新(#209 件2,core 5.25.0 提货批 [3443]):本形现在归 RETRIABLE。**
-    //     沿革留档(免下次重开同一个问题):该码在 core 上共三个铸点 —— 本形 / 版本超上限 / org 治理行
-    //     落到无 `permissionRuleOrg` 接线的 worker —— 三形都是 PRE-CAS、卡一律留 pending,但**可恢复性
-    //     不同**;#205 当时 core **不给判别式**(同码、`detail` 同样缺席),两版下游修法各被一轮 codex
-    //     对抗复审验伪(①三形一律 retriable ②按 `gate.realApproval` 分流),按「源头修复禁下游旁路」全
-    //     回退、维持 TERMINAL,并把判别式列成上游请托([3434] 请托 1)。
-    //     请托已兑现:core 5.25.0 给三个铸点各带 `CheckpointError.detail.reason`,本形 = `env_factory_missing`,
-    //     d.ts 逐字「retryable on a factory-wired worker」。⇒ `http/server.ts` 的分类表现在**读词表**判
-    //     (`WORKER_SWAP_REDEEMABLE`,闭集、core 加词 tsc 红),不做形状推断;本形的行**重新 park
-    //     suspended**、那条仍 pending 的卡不再被孤儿化(#205 登记的孤儿代价至此销账)。
-    //     ⚠️ 与旧裁定的差别在**代价的方向**,如实说清:修前拿「释放 task_active」换「卡变死件(下一次
-    //     /decide → 404,只能等 `terminal_at_ms`)」;修后行停在 suspended 攥着会话锁,与它 park 时逐字
-    //     相同,直到运维给这条车道接上 `executionEnvFactory`(或把该场景路由回有手 Runner)。#205 当年
-    //     驳掉 blanket-retriable 的那条理由(`handsLanes.laneOf(spec)` 按场景判 ⇒ 换副本重投必同样失败)
-    //     仍然成立,但它说的是「换个副本再点一次没用」,而 core 的词说的是「接上 factory 的 worker 兑得掉」
-    //     —— 那是一次**运维动作**,与 `governed_unwired` 要求接 `permissionRuleOrg` 完全同族。
-    //     升级窗仍是**响亮的**(409 + 该 errorCode + `retriable: true`),不是静默损坏;发车说明照写。
-    //     论证与钉:`http/server.ts` 分类表下方那段 + `test/durable-resume-http.test.ts` 的「#209 件2」六格。
-    //     ⚠️ 未覆盖登记(原样保留):本形需要「真 durable 店 + 带 workspaceHandle 的旧 checkpoint」才能
-    //     驱动,真店端到端仍属真双库/迁移测试面,未建。
     const handslessRunner = new Runner(withoutExecutionEnv(runnerDeps));
-    // codex R10: TRUE ⇒ the Runner just froze a PRIVATE tier-expanded catalog copy (core runtask.js constructor,
-    // dist-read) — in-place model-plane mutation no longer reaches it, so refresh-time plane changes must be
-    // DEFERRED to restart (see appliedPlaneEff / applyEffective deferModelPlane). Captured HERE, at the same
-    // config generation the constructor read.
     const runnerTierFrozen = Object.keys(config.tiers).length > 0;
-    // hooks 阶段三b(design/HOOKS-PHASE3B-PROMPT-AGENT.md):prompt/agent 条目的模型调用载体。
-    //  - hookLlm(prompt 条目)= 直连网关一次非流式 completion——一次判定调用不起 core task(重炮打蚊子
-    //    且引入可重入面);系统注入=事件分档(A-065 P3-10 订正,旧句「无系统注入」已过期):Stop/SubagentStop
-    //    注入 CC 逐字系统提示(cc-stop-prompt.ts,hook-runner.ts 的 extra.system),其余事件无注入。
-    //    agent 条目现状零系统注入=A-065 P2-5 立案中(UNANCHORED,CC 该臂有自己的两档提示)。默认模型=
-    //    summarize 角色(cheap tier,
-    //    council/压缩同款;缺角色→主模型);entry.model 覆盖须命中部署 catalog(单用户=自家目录全开,与
-    //    workflow 模型 allowlist 同纪律),未命中=该条目 fail(非阻断记账)。费用不折 task budget(hook=
-    //    部署策略面开销;hook_llm_calls_total/hook_llm_cost 由 metrics 记)。
-    //  - hookAgent(agent 条目)= runner.runTask 读-only 子代理:handsReadOnly + enableFork:false +
-    //    不装 hooks(🔴 可重入禁——结构性:这个 spec 永不携带 TaskSpec.hooks)+ maxTurns 10 + maxCostUsd
-    //    0.05 独立小预算,影响范围受限(CC 该臂 M=50 步,收窄=已声明理由的正当偏离)。系统提示=CC
-    //    hook_agent 两档逐字(cc-agent-hook-prompt.ts,A-065 P2-5 修;hook-runner 按事件铸、此处消费进
-    //    spec.systemPrompt 整替形)。final result 文本即输出(与 prompt 同一 SyncHookOutput 决策面)。
-    // hookModelFor/hookLlm 抽到 src/hooks/hook-llm.ts(可注入 fetch/keyResolver ⇒ 可单测):api 形分派
-    // (openai /chat/completions 与 anthropic /v1/messages 双腿)、缺省 baseUrl 按 api 分家、per-model key
-    // 恒胜 + foreign-no-key 连 prompt 都不发的 fail-closed 纪律,全在该模块内(注释含 audit 原文)。
-    // getKeyResolver 取函数:keyResolver 住在 config-center 运行时的闭包里,registry 热应用会整个换引用,
-    // 这里必须每次现取。
     const { hookModelFor, hookLlm } = createHookLlm({ config, getKeyResolver: () => configCenter.getKeyResolver(), metrics });
-    // hook agent 的 session 绝不进 durable store——每次 runTask 会写 session_meta 且无人
-    // 清理(reaper 只扫 staging orphan),cap=4/事件 × 长会话=无主行堆积。专用 Runner 覆盖 sessionStore 为
-    // 进程内 TTL 店(1h 短 TTL,hook 子代理无 resume 语义,行随进程/TTL 消失);其余 deps 原样共享。
     const hookAgentRunner = new Runner({ ...runnerDeps, sessionStore: new TtlSessionStore({ defaultTtlDays: 1 / 24 }) });
     const hookAgent = async ({ prompt, model, timeoutMs, system }) => {
         const pick = hookModelFor(model);
@@ -454,19 +208,11 @@ async function main() {
                 objective: prompt,
                 sessionId: uuidv7(),
                 model: pick.catalogRef,
-                // A-065 P2-5:CC hook_agent 评估者系统提示(cc-agent-hook-prompt.ts 两档,hook-runner 按事件铸)。
-                // 整替形与 CC 对齐(CC 该臂 systemPrompt=O 整段)。maxOutputTokens 座刻意不消费:agent 载体
-                // 的输出预算=limits(maxTurns/maxCostUsd),非单次 completion 概念。
                 ...(system !== undefined ? { systemPrompt: system } : {}),
                 handsReadOnly: true,
                 enableFork: false,
-                // core 5.8.0:预算四键全入 limits(顶层 maxCostUsd 删);timeoutSec(秒)→ maxWalltimeMs(毫秒,原生同单位)
                 limits: { maxTurns: 10, maxCostUsd: 0.05, maxWalltimeMs: Math.max(30_000, timeoutMs) },
-                // spec 无 toolPolicy → core `hasEffectAwareGate` 为假 → 每次 agent hook 触发一条
-                // error 级 UNGATED 警告(非致命但纯噪声)。挂已裁决的 auto-accept 基线(与 singleUserAutoAcceptBaseline
-                // 同构;hook 子代理本就 handsReadOnly + 单用户信任面,auto-accept 是既定姿态,只是让闸机制在场)。
                 toolPolicy: createAllowDenyPolicy({}),
-                // 🔴 可重入禁:此 spec 不带 hooks 字段(deps.hooks 是部署观测 tracer,void 观察者,无决策面)。
             });
             metrics.inc("hook_llm_calls_total", { type: "agent" });
             if (result.status !== "completed")
@@ -478,15 +224,12 @@ async function main() {
         }
     };
     const clipHookErr = (s) => (s ?? "").slice(0, 300);
-    // Auto session titles — fire-and-forget at first
-    // submit, one cheap hookLlm call (summarize role → MODEL_CHEAP_ID when configured), write-once via the session
-    // store's setTitleIfNull (SQL twins + local sidecar carry it; the memory dev store doesn't → titler dark, honest).
     const titleCapable = sessionStore;
     const sessionTitler = config.sessionAutoTitle && titleCapable.setTitleIfNull && titleCapable.probeTitle
         ? createSessionTitler({
             setTitleIfNull: titleCapable.setTitleIfNull.bind(sessionStore),
             probeTitle: titleCapable.probeTitle.bind(sessionStore),
-            redact: redactSecrets, // audit 2026-07-13: scrub a model-echoed secret before persist/list/log
+            redact: redactSecrets,
             llm: (o) => hookLlm({ prompt: o.prompt, timeoutMs: o.timeoutMs, model: o.model }),
             logger,
             metrics,
@@ -494,60 +237,14 @@ async function main() {
         : undefined;
     if (sessionTitler)
         logger.info("session_auto_title_enabled", {});
-    // ① workflowsCapability SINGLE-SOURCE (core 1.155 `workflowsCapability(deps)`; ruling = SPLIT two caps):
-    // `capabilities.workflows` = core's own truth (`workflowScriptRunner.safeForUntrustedScripts` ∧ governance), boot-
-    // computed from the SAME RunnerDeps the engine uses = the ENGINE-CAN axis ("can the engine self-orchestrate /
-    // ultracode"), ORTHOGONAL to the durable-LIST axis (`Boolean(workflowRunStore)`, surfaced as `workflowsList`).
-    // ⚠️ Today these COINCIDE — `workflowRunStore` is built iff self-orch (InMemory/File, ~L527), the same gate that
-    // wires the safe runner — so this is core's FORWARD-LOOKING contract, not a live-divergence fix (the earlier
-    // "memory backend diverges" premise was wrong; double-review caught it — see the cap site in http/server.ts).
-    // Static per deployment (deps are boot-fixed).
     const workflowsCapable = workflowsCapability(runnerDeps);
-    // Sub-task runner (code-review council lenses/arbiter, subagent/discussion children). [1364]①/[1367]①(core
-    // 1.350 fork 终修的部署要求):fork 子任务带 `requireExistingSession:true` 在这里执行而源会话在 HOST 店
-    // ——拆店=响亮 `resume.session_not_found`(cli fork 案的 server 半场)。但整店共享被 codex 判两 high
-    // (普通子任务铸 committed durable 会话:无 reaper 覆盖=无界增长+污染 /v1/sessions 枚举),故走
-    // ForkRoutingSessionStore:fork/resume 形(requireExisting)→ host 店优先,普通子任务 → 私有 TTL 店
-    // (throwaway 姿势保留)。hookAgentRunner 仍保独立 TtlSessionStore(1h)——纯瞬态 hook 车道,与 fork 无关。
-    // CC-parity (CRITICAL — 子代理 hands, root cause is the service spawn path): the subagent delegation
-    // tool runs child tasks on THIS subRunner. Without executionEnvFactory the child's `handsEnabled` (= ownedEnv ||
-    // deps.executionEnv, prepare-task) is FALSE → the child gets NO hands (Bash/Read/Edit) and can't run `pwd` — the
-    // "subagent couldn't run pwd" defect hit in real TUI use. core's createSubagentTool gives hands when the env is
-    // wired (gate3: opts.tools:[] still yields Bash), so the fix is to give the subRunner the SAME executionEnvFactory +
-    // lspManager as the main runner. Deliberately NOT inherited: selfOrchestration (no recursive workflow spawn),
-    // scheduler, memory, fileSnapshot, runtimeCaps — a delegated child is a short focused task, not a full session.
-    // codex-2 F1:promptSource 必须随子代——core 1.341 把父的 centerArtifactDigest 传给委派子任务并在子
-    // runner 上按 digest 解析;缺席=每个 catalog 任务的 Agent 子代 fail-loud prompt_snapshot_unavailable。
-    // backgroundAgentStore(1.248 复审 F2):core prepare-task 给每个 task 的 TaskOutput/TaskStop/
-    // AgentTranscript 装 durable 臂用的是所在 runner 的 deps——子代任务跑在 subRunner 上,缺席=子代读
-    // 工具无 durable 回落(第三消费点,与 RunnerDeps/scenarioDeps 同一实例)。
-    // [1543]§三族A(core 穿透审查,历史欠账键批——主 runner 挂了、subRunner 漏挂 = 子代 lane 静默降级;
-    // 全部直引 runnerDeps 同一实例,双点永不漂移):
-    //  - tiers(H):模型目录双 runner 分叉——tier 词 AgentDefinition 在子代 lane 抛 unknown_model、Agent
-    //    model 参数("opus")静默 modelNote 降级、S3c revive 臂 row.model 记 tier 词时复活换模型。
-    //  - rosterStore(M):具名 spawn 不落 durable 名册 → tier-3 按名复活从子代不可达。
-    //  - onBackgroundChildEvent(M):子代触发的 revive/孙代对 fleet 流全盲(同一 publisher 实例=单管道)。
-    //  - loadProjectMemory/probeInstructionSources(M):委派子代 project-blind(core types 已为子代 ctx
-    //    设计 isSubagent/agentName;门禁条件随 runnerDeps 条件键自动一致)。
-    //  - hooks/onError/toolResultStore/sessionPolicyStore(L):子代进 tracer/计量;best-effort 故障不静默;
-    //    fork 子代跨 wake 保 offload 引用;fork 形(有 sessionId)会话规则可达。
-    // 1877 注释的「Deliberately NOT inherited」清单(selfOrchestration/scheduler/memory/fileSnapshot/
-    // runtimeCaps)不变——本批只补漏配,不动裁定。
-    // (checkpointStore 的构造已再上移到 RunnerDeps 装配之前 —— design/170 件D 的留存能力校验要把它与
-    //  session/tool-result 一起交给 core 的 `assertRetentionCapability`,而那道校验必须在拒启窗内跑完。)
-    // [1593] 提名成变量:parked 子代的 ensureChildSessionDurable 晋升半场要拿它做 promoteToHost
-    // (子会话住私有 TTL 店,park 前整树拷进 host durable 店——只查不迁的 1.263 形在拆店生产形下恒
-    // 否决 park,cli 真机 14ms~2s expired 即此)。
     const subRunnerSessions = new ForkRoutingSessionStore(sessionStore, new TtlSessionStore({ defaultTtlDays: 1 / 24 }));
     const subRunnerDeps = {
-        // [1543]§三族A 结构性根治(design/158 冲刺尾件):与主 runnerDeps 重复的 ~15 键统一走
-        // createSharedRunnerDeps 展开——「双点挂载」从人工纪律变结构性保证(新共享键漏配其一=不可能,
-        // 基座只有一份)。差异键在展开后显式列出,每个都有为何不同的理由(见 boot/runner-deps.ts 头注)。
         ...createSharedRunnerDeps({
             config,
-            logger, // #240②:onNotice 席落共享基座 ⇒ 两 Runner 同源(EngineNotice→logger.warn)
-            hands: commitHands, // 交接件⑤:与主 runner 同一个值(基座保证同源)
-            mcpRevocations, // #324:与主 runner 同一台账实例(委托子代腿的 MCP 撤销同源生效)
+            logger,
+            hands: commitHands,
+            mcpRevocations,
             brain,
             pricing,
             tracer,
@@ -562,61 +259,24 @@ async function main() {
             sessionPolicyStore,
             usageWindowStore,
             orgMemoryAdmission,
-            governanceSeams, // design/170 件B/C/D:与主 runner 同一份座席(子代平面同受档位/锁约束)
-            sharedMemoryStores: sharedMemoryStore ? sharedMemoryStore : undefined, // design/177:与主 runner 同实例
+            governanceSeams,
+            sharedMemoryStores: sharedMemoryStore ? sharedMemoryStore : undefined,
         }),
-        // ── 以下为 subRunner 差异键(不在共享基座;逐个有因)──────────────────────────────────────
-        sessionStore: subRunnerSessions, // 子代转录=私有短 TTL fork 路由店,生命周期异于宿主 durable 店
+        sessionStore: subRunnerSessions,
         onBackgroundChildEvent: runnerDeps.onBackgroundChildEvent ? runnerDeps.onBackgroundChildEvent : undefined,
         loadProjectMemory: runnerDeps.loadProjectMemory ? runnerDeps.loadProjectMemory : undefined,
         probeInstructionSources: runnerDeps.probeInstructionSources ? runnerDeps.probeInstructionSources : undefined,
         onError: runnerDeps.onError ? runnerDeps.onError : undefined,
-        // checkpointStore = 子代**执行面**的 park 设施([1582] cli TiDB 真验撞获缺口,[1584] core 定谳
-        // 接线步):core prepare-task `spec.checkpointStore ?? deps.checkpointStore` 里 spec 侧永不被
-        // subagent 设置,子代 suspendAsk 全靠这里——缺席 = 具名 bg 子代的 gated ask 只能 deny+continue,
-        // checkpoint 表零行(cli T2 复现原话「denied by an approval constraint」)。必须与 scenarioDeps
-        // (spawn 面 forwardDurableApproval 判定)**同一实例**:claim/expire/consumeParkedFlip 都作用于
-        // 同一行。旧 [1546] HIGH-2 撤载(「core 不转发 durableApproval + SAFETY ask 会 park 出搁浅
-        // checkpoint」)的前提被 core 1.388 件4(转发臂)消除,搁浅顾虑由件1-4+1.389 逐项闭合:watcher
-        // park 翻行 + reap 豁免 + reconciliation 兜孤儿;unattended SAFETY park 恒带缺省 deadline;
-        // TaskStop on parked 走 expire CAS 仲裁(1.389 F-1);/decide 可赎回。行为钉 =
-        // test/subagent-park-wiring.test.ts(SOURCE PIN + park 全链 + 旧形反向控制)。
         checkpointStore: checkpointStore ? checkpointStore : undefined,
     };
     const subRunner = new Runner(subRunnerDeps);
-    // #196:`subRunner` 的无手孪生(同一份 deps 字面量摘掉 executionEnvFactory —— 差异面只有这一处,
-    // 结构上不可能漂移)。council 的 lens/arbiter、discuss 的成员/synthesizer 走它:那些子任务的人格声明
-    // 里一件工具都没有,却在修前照拿全量可写手(设计小票 §1 里最意外的一支)。
-    // ⚠️ 与主 subRunner 共享 `subRunnerSessions` 与 `checkpointStore` 同实例 —— park/fork 的行是同一批。
     const handslessSubRunner = new Runner(withoutExecutionEnv(subRunnerDeps));
-    // S6: resolve identity + owned session from the authenticated channel (never the body).
     const authorize = createAuthorizer(config, sessionStore);
-    // S1/S2: durable async run registry + replayable event log (TiDB-backed).
     const runStore = backend ? backend.run() : undefined;
-    // E18 resume-at: the eventId→entryId anchor map. REQUIRED on every backend (works local — needs only the session
-    // tree + this map, no cloud-only checkpoint), so the only undefined case is the env-only/no-backend deploy (which
-    // also has no async runs — consistent). The shell sends body.resumeAt=eventId; resolveSpec resolves it here.
     const resumeAnchorStore = backend ? backend.resumeAnchor() : undefined;
-    // Per-session approval exemption ("本会话不再询问") — REQUIRED on every backend like the anchor
-    // map; undefined only on the env-only/no-backend deploy (which has no durable approvals either — consistent).
     const approvalExemptionStore = backend ? backend.approvalExemption() : undefined;
     const instanceId = uuidv7();
-    // Per-task wall-clock override (seconds). 0/absent = keep the tenancy default (see taskWallClockSec:
-    // 2400s, 3600s for the big lane = council/debate/discuss) —
-    // the override only ever RAISES (Math.max at the use site), so a misconfigured low value cannot shrink
-    // the council budget.
-    // 🔴 2026-08-01 env fail-loud 族:原为 `Math.max(0, Math.floor(Number(env ?? "0")) || 0)` ——
-    // `TASK_TIMEOUT_SEC="3600s"`(带单位后缀,运维最常见的写法)得 NaN,再被 `|| 0` 折成 0,
-    // 而 0 在这里的语义是**无超时**。运维以为设了一小时上限,实际把超时关掉了,方向恰好相反,
-    // 且启动期零提示。改走 numEnv:非法值当场 fail-loud 并指名键与实际值。
-    // (numEnv 的注释早就预言了这个失败模式,只是它没 export、跨文件够不到,于是这两处手写了。)
     const taskTimeoutSec = Math.max(0, Math.floor(numEnv("TASK_TIMEOUT_SEC", "0")));
-    // [854]④ per-request 配速的运营方上限旋钮(可选;缺省不设=不封顶):body.limits 每键各自被对应旋钮
-    // Math.min 封顶(normalizeLimits)。多租部署想约束 caller 自报配速时才设;单用户 turnkey 通常留空。
-    // ⚠️ 语义=只钳「显式请求值」,不是全队默认限额:body 缺席(或重放体里的非法值被 defensive DROP)⇒ 该键
-    // 不设限,与升级前行为同形——要给所有任务强加限额是另一个旋钮(未建),别指望这三个(交叉评审 F1 判读)。
-    // 缝合审 M4:非法值仍 fail-open(不设限),但**必须出声** —— 这三个旋钮的全部用途就是封顶,
-    // 打错一个字符让封顶静默消失是它最坏的失败形。判据单一真源在 config.ts 的 parseCapEnv。
     const capEnv = (name) => {
         const r = parseCapEnv(name, process.env[name]);
         if (r.invalid !== undefined) {
@@ -633,41 +293,11 @@ async function main() {
         maxOutputTokens: capEnv("TASK_MAX_OUTPUT_TOKENS_MAX"),
         maxTurns: capEnv("TASK_MAX_TURNS_MAX"),
     };
-    // [2354]/[2356] A-5(5.0.0):F4 轮询门(approvalStore pending 行)整体退役——durable checkpoint 是唯一门形。
-    // Finding #2 (edge case): the single-user auto-accept tool-policy BASELINE applies ONLY when the operator
-    // expressed NO gate intent. If they SET approval flags (APPROVAL_REQUIRE/APPROVAL_DENY/DURABLE_APPROVAL) but no
-    // backing store is wired (e.g. DB_BACKEND=local → no checkpointStore ⇒ durableEnabled
-    // false), that is a MISCONFIG — do NOT mask it with allow-all; leave toolPolicy undefined. So the baseline needs
-    // single-user turnkey ∧ zero expressed gate intent.
-    // 🔴 #177 后本段的**信号面**已换人(原文「so core's UNGATED warning still surfaces it」已过期):守卫集
-    // (SENSITIVE_WRITE_PATTERNS,缺省非空)现在从 governance 拍无条件铸一条 DENY 基线 ⇒ 缺省部署的
-    // `spec.toolPolicy` 恒在场 ⇒ core 的 `hasEffectAwareGate`(prepare-task,判据是 policyLayers.length>0)
-    // 恒为真,那条 UNGATED onError 不再触发。补偿件在 boot/resolve-spec.ts:同一形(durable 门关 ∧ 单用户
-    // 基线不适用 ∧ 守卫集开)在 boot 期发一次 `tool_policy_only_sensitive_baseline` warn,把「守卫段之外
-    // 无裁决」这件事按我们自己的话说出来。本行留 `undefined` 仍是对的(不拿 allow-all 掩盖 misconfig),
-    // 只是它不再是那条信号的产地。
-    // 单源在 approval.ts(与 inv#2 同文件)—— 这里原是内联的三格枚举,漏了 approvalNeverAuto,详见该函数顶注。
     const operatorGateIntent = hasOperatorGateIntent(config);
-    // D3-F1(全窗复审,HIGH):门意图已表达但唯一门形(durable)不可服务 ⇒ boot 拒启带双出路指引。
-    // 5.0.0 前这形走轮询门真拦;退役后若只留 core 每任务 warn=原先拦、现在放,升级存量静默失守。
     assertGateIntentServiceable(config, checkpointStore !== undefined);
     const singleUserAutoAcceptBaseline = config.requirePrincipal !== true && !operatorGateIntent;
-    // design/45 durable-checkpoint (core 1.67): opt-in (DURABLE_APPROVAL + a pool). When on, F4 uses durable
-    // suspend/resume instead of the poll gate — a gated `ask` suspends the task (status:"suspended" + checkpoint)
-    // and an operator resumes it on any replica. Default off → unchanged poll-policy.
-    // checkpointStore 构造已上移到 subRunner 之前([1535] server 半场:子代 park 设施);本行原位注释保留。
-    // TOC integration ask③ (INTEGRATION-DESIGN §11): reclaim runs orphaned by a previous host-lane engine
-    // process (orphaned `running` → failed + release its EEXIST-blocking claim; exclude resume-in-progress rows). The
-    // logic + its null-safety (runStore undefined on the env-only/no-backend lane) live in the unit-tested
-    // `reclaimOrphansAtBoot` helper — extracted after a workflow re-review caught a boot crash there (HIGH, 1.49.0).
     await reclaimOrphansAtBoot(runStore, checkpointStore, logger);
-    // Sandbox-image-pool index (IMAGE-API-DESIGN.md §2): enables /v1/images* query + select. TiDB-backed projection
-    // of the bake manifests + publish lifecycle. Present whenever a pool is — read-only catalog until P2/P3 bakes.
-    const imageIndex = backend?.imageIndex ? backend.imageIndex() : undefined; // local omits imageIndex() → sandbox-image-pool is cloud/fleet-only
-    // RFC A2 (A 切片先行): the model-facing SelectEnvironment tool — mounted via spec.tools
-    // (RFC 判定②(a)) whenever the per-task image chain is actually usable (k8s backend + image catalog), opt-out
-    // via SELECT_ENVIRONMENT_TOOL=false. Viewer scope is rebuilt per-execute from the Runner-threaded read-only
-    // ctx.principal (auth-channel-derived — a tool argument can never widen visibility).
+    const imageIndex = backend?.imageIndex ? backend.imageIndex() : undefined;
     const selectEnvTool = config.selectEnvironmentTool && config.remoteExec?.provider === "k8s" && imageIndex
         ? selectEnvironmentTool({
             catalog: imageIndex,
@@ -675,28 +305,11 @@ async function main() {
             viewerFor: (principal) => ({ operator: explicitOperatorOk(principal, config.operatorPrincipals), tenantId: principal ?? null }),
         })
         : undefined;
-    // Sandbox-image-pool BAKE control plane (IMAGE-API-DESIGN.md §P2): enables /v1/images/bakes* when a pool exists
-    // AND IMAGE_BAKES_ENABLED. The config boot-invariant already fail-fasts an empty OPERATOR_PRINCIPALS (a
-    // world-writable build-host-RCE door). image-api stays the UNPRIVILEGED controller; the privileged build runs
-    // on the sema-registry-managed bake-runner worker on build-host (it claims + ingests over the internal routes).
-    const imageBakes = backend?.imageBake && config.imageBakes.enabled ? backend.imageBake() : undefined; // local omits imageBake() → cloud/fleet-only
+    const imageBakes = backend?.imageBake && config.imageBakes.enabled ? backend.imageBake() : undefined;
     if (imageBakes)
         logger.info("image_bakes_enabled", { operators: config.operatorPrincipals.length, runner: config.imageBakes.runnerPrincipal });
-    // Durable HITL surface = checkpointStore ALONE (DURABLE_APPROVAL=true). It mounts AskUserQuestion-suspend (the
-    // agent asks the human + the portal approval center) AND the resumable checkpoint. The F4 TOOL-APPROVAL
-    // gate is an ADDITIVE layer driven by APPROVAL_REQUIRE — empty = no tool is gated, but AskUserQuestion HITL
-    // still works. (Decoupled 2026-06-13: previously these were coupled, forcing a placeholder APPROVAL_REQUIRE
-    // to get HITL — clay: OA writes don't gate (OA-backend RBAC is the authority), but portal HITL must work.)
-    // durableEnabled 已在 runnerDeps 前按同一条件求值([1.294 G1] 前置声明处)——checkpointStore 构造条件与其
-    // 同源,恒有 durableEnabled === !!checkpointStore。
     if (durableEnabled)
         logger.info("durable_approval_enabled", { toolApprovalGate: config.approvalRequire.length });
-    // DESIGN-269 车2 件3 —— server-as-peer 上场的**感知链路**(#266 memory_persistence_capable_auto_declared
-    // 同族纪律:一条对外暴露面上了线,必须在 boot 日志里一眼可核)。这行是 `A2A_SERVE_ENABLED=true` **唯一**
-    // 的启动期回声:运维据此确认「这台机现在对外是一个 A2A agent、卡在这个路径上、公告的是这个 URL、
-    // 声明了几条 skill」。OFF(默认)⇒ 一个字都不发,零噪声。
-    // ⚠️ 半配置的诚实:开了旋钮却没有 durable run store 时,两个 RPC 方法会回具名 -32004 —— 那不是静默
-    // 降级,但它发生在**调用时**,而运维想在启动时就知道。所以这一行连带把 runStore 在不在场说出来。
     if (config.a2aServe) {
         logger.info("a2a_serve_enabled", {
             card: "/.well-known/agent-card.json",
@@ -704,89 +317,41 @@ async function main() {
             advertisedUrl: config.a2aServe.url,
             skills: config.a2aServe.skills.length,
             blockingWaitMs: config.a2aServe.blockingWaitMs,
-            // false = 卡照发(发现面不依赖 store),但 message/send 与 tasks/get 会回 -32004 UnsupportedOperation。
             tasksUsable: runStore !== undefined,
         });
     }
-    // 修4(三路复审 W3):the fs-write ask gate (resolveSpec, applyTaskSettings wiring below) mounts purely off the
-    // host-semantics lane — DELIBERATELY decoupled from any approval face, so no assembly path is ever gateless:
-    // with no live coordinator and no durable park, a permissionMode default/auto Write/Edit ask fail-closed
-    // auto-denies via core resolveAsk (onAsk absent ⇒ headless auto-deny, loud in-transcript). What that posture
-    // must NOT be is silent at boot: an operator who explicitly set TOOL_APPROVAL_ENABLED=false (or a multi-tenant
-    // default) would otherwise read the resulting hand-tool denials as an outage. Warn once, at boot.
     if ((config.remoteExec === undefined || config.remoteExec.provider === "host") && !toolApproval && !durableEnabled) {
         logger.warn("fs_write_gate_no_responder", {
             hint: "host-semantics lane with no approval face: permissionMode default/auto Write/Edit asks will auto-deny (fail-closed); wire TOOL_APPROVAL_ENABLED=true or DURABLE_APPROVAL=true to answer them",
         });
     }
-    // [1245]/[1248]② the workflow ask leg attaches on EVERY lane (not fs-dependent — see createWorkflowAskPolicy),
-    // so a sandbox-lane deployment running self-orchestration with no approval face hits the same fail-closed
-    // auto-deny class. Same loud-at-boot posture; host lanes are already covered by the broader warn above.
     if (config.selfOrchestrationEnabled && config.remoteExec !== undefined && config.remoteExec.provider !== "host" && !toolApproval && !durableEnabled) {
         logger.warn("workflow_gate_no_responder", {
             hint: "self-orchestration with no approval face: permissionMode default/auto/acceptEdits run_workflow asks will auto-deny (fail-closed); wire TOOL_APPROVAL_ENABLED=true or DURABLE_APPROVAL=true to answer them",
         });
     }
-    // Finding #2: a single-user turnkey worker with no explicit approval/durable/commandPolicy gets an
-    // ADJUDICATED auto-accept tool-policy BASELINE (createAllowDenyPolicy — a PRESENT effect-aware policy, so core's
-    // write-capable hand tools are never UNGATED / unadjudicated). Log the posture so the auto-accept is OBSERVABLE,
-    // not silent; tighten irreversible ops via APPROVAL_REQUIRE / AUTONOMY / commandPolicy (layered tighten-only).
     if (singleUserAutoAcceptBaseline) {
-        // Blanket auto-accept over ALL write/hand/MCP tool surfaces (core's per-surface UNGATED enumeration — hand band /
-        // destructive-MCP / first-party-write — is suppressed for single-user turnkey by design). Log it so the posture is
-        // observable; tighten (which also re-surfaces per-surface gating) via APPROVAL_REQUIRE / AUTONOMY / commandPolicy.
         logger.info("tool_policy_single_user_default", {
             posture: "adjudicated auto-accept — ALL write/hand/MCP tool surfaces auto-allowed (core per-surface UNGATED enumeration suppressed for single-user turnkey)",
             tighten: "APPROVAL_REQUIRE / AUTONOMY / commandPolicy (re-surfaces + gates specific surfaces)",
         });
     }
-    // D-G: a boot-time signal that this worker is in crypto-bound direct-door mode (trusted-header path disabled).
-    // Pairs with the /health directDoorActive field for the DG-M2 go-live runbook (a positive go signal, not just
-    // a behavioral 401). The boot invariant in config.ts already fail-fasts a half-configured direct door.
     if (config.directDoorActive)
         logger.info("direct_door_active", { iss: config.principalJwtIss, aud: config.principalJwtAud, operators: config.operatorPrincipals.length });
-    // CC-parity (adversarial-review finding): a MULTI-TENANT deployment running self-orchestration WITHOUT worker
-    // isolation is an availability risk — the in-process hardened VM is ESCAPE-isolated but NOT RESOURCE-isolated, so an
-    // entitled tenant's workflow script can starve the host event loop (microtask loop / OOM), affecting every tenant
-    // (src/orchestration/hardened-vm-runner.ts documents this). Loud boot warning so the operator sets
-    // SELF_ORCHESTRATION_WORKER_ISOLATION=true. (Single-user is unaffected — the one principal owns its own worker.)
     if (config.requirePrincipal && config.selfOrchestrationEnabled && !config.selfOrchestrationWorkerIsolation)
         logger.warn("self_orchestration_no_worker_isolation", { detail: "multi-tenant self-orchestration without SELF_ORCHESTRATION_WORKER_ISOLATION=true — a tenant workflow can starve the host event loop (availability risk). Set it to enable worker_thread resource isolation." });
-    // 🔒 (systematic-audit HIGH fix, defense-in-depth): a multi-tenant deployment (requirePrincipal) with NO service/trace
-    // token now correctly fails CLOSED — fleet/trace/session-list are owner-gated, never fleet-wide (isFleetWide, server.ts).
-    // Warn the operator: without SERVICE_AUTH_TOKEN/authTokens/TRACE_TOKEN those endpoints only ever return the caller's own
-    // rows (safe, but may surprise an operator expecting cross-tenant ops visibility — set a token for ops-relay).
     if (config.requirePrincipal && !config.authToken && Object.keys(config.authTokens ?? {}).length === 0 && !config.traceToken)
         logger.warn("multi_tenant_no_service_token", { detail: "REQUIRE_PRINCIPAL is on but no SERVICE_AUTH_TOKEN/authTokens/TRACE_TOKEN — fleet/trace/session-list are owner-gated only (never fleet-wide, tenant-isolation safe). Set a token for cross-tenant ops visibility." });
-    // Rate limiter: TiDB-backed (cross-replica SOFT limit, same write-behind counter as the cost quota)
-    // when a pool exists, else in-memory per-replica. Both satisfy RateGate. (design/30 P0-2)
-    //
-    // 🔴 #322 批1:与 costQuota 同一条改造(恒构造 + 0=关断哨兵)——修前 `rateLimitPerMin > 0` 才构造,
-    // 默认部署零实例,于是热改 0→N 无座可 set。恒构造之后 0↔N 是纯值变(boot/limit-sync.ts 一次 setLimits),
-    // 关断态由座位自己表达:恒放行、不记窗、SQL 腿不起刷新环(零 SQL)。
-    const rateLimiter = backend?.rateLimiter // local omits rateLimiter() → in-memory per-process RateLimiter (single-replica)
+    const rateLimiter = backend?.rateLimiter
         ? backend.rateLimiter(config.rateLimitPerMin, counterDegradeHook).startRefresh()
         : new RateLimiter(config.rateLimitPerMin);
-    // Capability layer: scenario → {tools (+ subagent roster), prompt, skills}. Heavy bits (skills,
-    // git client) are built ONCE here; per request we only select a scenario and bind coordinates.
     let skills = loadSkills(config.skillsDir);
-    // design/158 A10 尾刀:center skills overlay + plugins 消费 + boot LKG 落盘/skill-stale 判定 + mcp
-    // 解析搬到 boot/config-center.ts(逐字)。⚠️ 位置即契约:loadSkills 之后、buildScenarios 之前 ——
-    // LKG 落盘点必须晚于 skill 正文装载(F7/codex R26),plugins 让位判据要求 plugins 晚于 center 直发 skills。
     skills = await configCenter.applyCenterCapabilities(skills);
     const repoClient = config.gitApiBaseUrl ? createRepoClient(config.gitApiKind, config.gitApiBaseUrl, config.gitApiToken) : undefined;
-    // CC-parity: deployment-injected WebSearch backend (the leg core leaves open). Absent WEB_SEARCH_PROVIDER →
-    // undefined → the default scenario doesn't assemble the WebSearch tool. The API key stays in the backend closure.
     const webSearchCfg = webSearchConfigFromEnv();
     const webSearch = webSearchCfg ? createWebSearchBackend(webSearchCfg) : undefined;
     if (webSearch)
         logger.info(`WebSearch enabled (provider=${webSearchCfg.provider}, maxResults=${webSearch.maxResults})`);
-    // #81④ 探活(boot 期一次性,**默认 OFF**):部署方此前只能靠「跑一个真任务」验证搜索配没配对 ——
-    // cli 的一键装 SearXNG 向导([2226] 裁 1)装完那一步正需要这个。消费 core 的 `probeSearchBackend`
-    // (不自铸第二真源,与 searxng adapter 同一条纪律)。
-    // 🔴 **失败只 warn,不拒启**:搜索是可选工具,配错不该挡住整个服务(功能型能力缺席 ⇒ 降级;
-    //    与本仓「保护型 ⇒ fail-closed」的方向判据是同一条判据的两面)。
-    // 🔴 **不 await**:探活是一次真出网,让它拖住 boot 就是把一个可选工具变成启动路径上的依赖。
     if (webSearch && shouldProbeWebSearchOnBoot()) {
         void probeSearchBackend(webSearch.search, { timeoutMs: 10_000 })
             .then((r) => {
@@ -797,56 +362,16 @@ async function main() {
         })
             .catch((e) => logger.warn("web_search_probe_failed", { provider: webSearchCfg.provider, error: e instanceof Error ? e.message : String(e) }));
     }
-    // core 1.382([1561] 提货单①②,design/153 parked 状态机)「同车必接」的 ensureChildSessionDurable 挂点:
-    // 只在 checkpointStore 真在场时构造(与 core parkEligible 门「两者全在场才成立」的判据同源——checkpoint
-    // 不在场时构造这个闭包毫无意义,连带把「local/无 durable backend 部署不该跑这条 acquire/release」的
-    // 边界直接编码进构造条件,不用额外判断)。实现体拆到 `ensureSessionDurable`(session-store.ts,可独立
-    // 测试;双复审②抓的 F-7 同族空壳缺口——host 店可能存在 `register()` 留下的零内容 session_meta 行——
-    // 的校验也在那边)。
-    // 🔴 [1575] F3 修(cli 复查,红先行确认真红):`checkpointStore` 在场 ⇏ `sessionStore` 就是 TiDB 真店
-    // ——这是两个独立 config 轴(DB_BACKEND 供 checkpoint/runs 等用途 vs SESSION_BACKEND 单独控 session
-    // 落哪),`SESSION_BACKEND` 显式留在默认值时 `sessionStore` 是纯内存 `TtlSessionStore`(无 repo 构造,
-    // core `release()` 语义在该形态下是**整删会话**,不是"归还租约")——探针的 finally release 会销毁它
-    // 刚证明存在的会话。追加门 `config.sessionBackend === "tidb"`(此刻已被前面装配区从 "auto" 归一,
-    // 恒是 "tidb"|"memory" 二选一,时序安全):唯一保留可达的店形正是 release() 真安全的那种
-    // (TiDBSessionStore.release 逐字注释「Durable history is retained; just drop any in-flight cache
-    // entry」)。非 tidb 场景下 undefined = 子代按 pre-153 settle failed,零回归(与 checkpointStore 缺席
-    // 同一处置)。
-    // [1593] 只查不迁 → 主动晋升(cli TiDB 真机撞获:bg 子会话住 subRunner 私有 TTL 店、从不在 host 店,
-    // 旧形恒 veto → core 当场 expire checkpoint(14ms~2s)+ settle failed,赎回窗口不存在)。晋升链=
-    // 快查 host → promoteToHost(整树拷贝+私店 forget+路由记 host)→ 同一严检复验(leaf 非空);任何
-    // 一步失败仍如实 veto(pre-153 行为,不放大)。tidb 门与 F3 裁定不变。
     const ensureChildSessionDurable = checkpointStore && config.sessionBackend === "tidb" ? (sessionId) => ensureChildSessionDurableWithPromotion(sessionStore, subRunnerSessions, sessionId) : undefined;
-    // [1900]/[1904] WebFetch 摘要器:core 工厂 + summarize 角色模型(cheap tier;resolveTaskModel 自带
-    // 默认回落——与压缩线同族档位,不新造)。构造一次全场景共享;多租户形 WebFetch 整体被 filter,
-    // 本注入无效化由 scenarios 现行为保证。惰性解析 / fail-soft(E-MED-2/E-MED-3)与本席的 key plane
-    // (A-057.5:#303 的第四条直发面)都在 `boot/webfetch-summarize-lane.ts`,顶注写着全部判据与红先读数。
     const webFetchSummarize = createWebFetchSummarizeLane({ brain, config, getKeyResolver: () => configCenter.getKeyResolver(), logger });
-    // design/158 S4:标注 `: ScenarioDeps` —— 无标注的字面量连自己的键名都不校验(打错/多写一个键
-    // 只是多一个没人读的属性,编译期无声),这是 1.304 落错家那一族的另一半土壤。
     const scenarioDeps = {
         runner, subRunner, handslessSubRunner, model: "default", skills, repoClient, requirePrincipal: config.requirePrincipal,
         webSearch: webSearch ? webSearch : undefined, metrics, logger, webFetchSummarize,
-        // core 1.364 写半场:与 RunnerDeps.backgroundAgentStore 同实例(组装区注释;半接=静默死特性)。
         backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
-        // core 1.382 parked 状态机「同车必接」一对——checkpointStore 与 main runner 的 checkpointStore(subRunner
-        // 构造区上方 const)同实例;ensureChildSessionDurable 见上方构造闭包注释。
         checkpointStore: checkpointStore ? checkpointStore : undefined,
         ensureChildSessionDurable: ensureChildSessionDurable ? ensureChildSessionDurable : undefined,
-        // #318([4659] F2 → [4692] 定谳):会话级任务清单店解析器(boot/task-list-lane.ts 的产物,
-        // openStores 里按后端三态构造一次)。修前不接这一键 ⇒ core 每 turn 铸一只私有内存店。
         taskListStoreFor: taskListLane.storeFor,
         brandIdentity: config.configProvider === "local",
-        // core 1.287 extraTools seam ([802]③ server half): SendUserFile reaches the delegated-child roster. SAME
-        // existence gate as the top-level mount (the one sendUserFileToolSpec built above — lane/tenancy/config
-        // posture already encoded in its presence). The spec is execute-time late-bound (ctx.taskId →
-        // TaskEnvRegistry lookup; emit via ALS to the top-level frame tail), so returning the SAME instance per
-        // spawn is correct — per-spawn state lives in the registry, not the spec ([797] confirmed with core).
-        // codex F1/F2 gates (subagentSendUserFileExtraTools): (F1) the subRunner carries no toolPolicy and core
-        // does not propagate the parent's policy into child specs, so an APPROVAL_DENY/ask-gated SendUserFile was
-        // reachable from delegated children — the factory now pre-checks the LIVE deployment approval face
-        // (deny/require/neverAuto, canonical-space) and injects nothing when gated (conservative stopgap until a
-        // core child-policy seam lands); (F2) read-only builtin agents (Explore/Plan) never receive the tool.
         subagentExtraTools: sendUserFileToolSpec
             ? subagentSendUserFileExtraTools({
                 spec: sendUserFileToolSpec,
@@ -855,34 +380,7 @@ async function main() {
             : undefined,
     };
     const scenarios = buildScenarios(scenarioDeps);
-    // design/153 件3d:/decide parked 赎回腿的裸 Agent 工具——boot 期从**内建 default** 场景工厂取一份
-    // (必须在 center overlay 盖名之前取:赎回腿要的是与 spawn 同源的生产装配,subRunner/bg opts/
-    // checkpointStore 同实例天然成立;per-request 项如 webSearch 对 revive 无关——objective 在 core
-    // driveParkedResume 里被丢弃)。checkpointStore/agentStore 任一缺席 = park 本就不可达,分支不接线。
-    // #318:这条取用**刻意不带** ScenarioContext —— boot 期没有任何一条真会话,给它编一个假 sessionId
-    // 会在清单表里铸出一份无人认领的分区。它只取裸 Agent 工具,task-list 家族在这份 bundle 里根本不被
-    // 消费([4692]③ 已核),缺席 = 修前字节形。
-    // A-067 C3-3(F1b):裸 "Agent" 字面量换 core 单源常量——runtime-governance.ts 同概念已用
-    // DEFAULT_SUBAGENT_TOOL_NAME(5.0.0 RB-476 旧名 "Task" 改名史=这个字面量真漂过一次)。
     const parkedReviveTool = checkpointStore && backgroundAgentStore ? scenarios.default?.({})?.tools.find((t) => t.name === DEFAULT_SUBAGENT_TOOL_NAME) : undefined;
-    // [1596]/[1597] 跨副本父约束重供席工厂:host 任务的 toolPolicy 解析槽按**当前**部署配置重建
-    // 「部署 ⊇ 操作员」两层完整链(design/181 件二收编;实现与全部理由在 boot/parked-revive-gate.ts,
-    // 提出去的唯一理由是 main.ts 顶层 `void main()` 让那条腿的运行期语义在原地一格都钉不住)。
-    // 构造条件逐字保持:裸 Agent 工具在场 ∧ 部署真开了 durable 审批。
-    // `approverSeat`:与 `RunnerDeps.onAsk` **同一个具名工厂**(单一属主,禁在此处手搓等价闭包)。core
-    // 5.22.0 起链条目的 `durableMandate` 位进了摘要,而该位的判据正是这只席位在不在场——两处若不同源,
-    // 赎回腿算出的摘要与 park 记的对不上,跨副本赎回整条腿被 pre-CAS 拒(见 parked-revive-gate.ts
-    // `mandatePostureOf`)。此处新铸的转发闭包与 runnerDeps 那只行为逐字相同(都只转 `toolApproval.ask`),
-    // 摘要只看在场性;仅 core 的 hook 席位去重按函数身份判,那一侧的身份未命中是**多筛一次**(core 自述
-    // 的保守方向),不是漏筛。
-    // A-010.1 同族的另外两位(`resolveRuntimeCaps` / `autoModeSeatMounted`):5.22.0 的摘要卷进的是**三**位
-    // 决议链元数据,其中 `autoModeArmed` 与 `durableMandate` 的 `forceDurableGate` 项都由 per-principal 的
-    // `RuntimeCaps` 决定。两处必须与 core 看到的**同一只**事实源接线,否则同样是「park 记 true 而赎回腿供
-    // false ⇒ 摘要恒不匹配 ⇒ 这批 principal 的卡永不可赎」:
-    //  · `resolveRuntimeCaps` = 递给 `RunnerDeps.runtimeCapsResolver` 的同一只(单一属主 boot/runtime-caps.ts);
-    //  · `autoModeSeatMounted` = **读** runnerDeps 上那一位,不写字面 `true` —— core 的武装式是
-    //    `runtimeCaps.autoMode === true ∧ deps.autoMode !== undefined`,第二个半场的真值只有 runnerDeps 知道,
-    //    在此处手抄 `true` 会在 runner-deps 那边改成有条件挂载的那一天静默错供一位。
     const parkedReviveInheritedGate = parkedReviveTool && config.durableApproval
         ? createParkedReviveInheritedGate({
             config, question, approvalExemptionStore, logger, localRoot,
@@ -891,20 +389,11 @@ async function main() {
             autoModeSeatMounted: runnerDeps.autoMode !== undefined,
         })
         : undefined;
-    // 场景详情:内建 details 必须在 overlay 合并【前】构建(探针要打纯内建工厂,不是被 center 顶掉的);
-    // center details 随 overlay 同判定源盖同名——source 语义与 selectScenario 实际取用永一致(约定①)。
     const scenarioDetails = builtinScenarioDetails(scenarios, scenarioDeps);
-    const builtinScenarioNames = Object.keys(scenarioDetails); // overlay 前捕获(六内建名)
-    // design/158 A10 尾刀:center 声明场景 overlay 搬到 boot/config-center.ts(逐字)。⚠️ 位置即契约:
-    // 必须在内建 details + 六内建名捕获之后 —— 探针要打纯内建工厂,不是被 center 顶掉的。
+    const builtinScenarioNames = Object.keys(scenarioDetails);
     configCenter.applyCenterScenarios({ scenarioDeps, scenarios, scenarioDetails, builtinScenarioNames });
     logger.info("capabilities", { skills: skills.length, scenarios: Object.keys(scenarios), repoTools: Boolean(repoClient) });
-    // Background reapers: recover runs whose instance died, expire never-answered approvals, sweep
-    // rate windows. Unref'd so they never hold the process open.
-    // design/80 D-D (SLA-timer): the deny-sweep reuses the server's resumeCheckpoint, so it is wired in AFTER
-    // createHttpServer returns it (below) via this holder — the reaper is defined before the server.
     let runDenySweep;
-    // design/158 A10:reaper 段搬到 src/boot/reapers.ts(逐字;deny-sweep 晚绑改取值,见该文件头注)。
     const reaper = startReapers({
         config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore,
         rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap,
@@ -912,11 +401,6 @@ async function main() {
         backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores,
         getRunDenySweep: () => runDenySweep,
     });
-    // #270 车2 —— 托管留存 sweep lane(**独立**定时器,不折进上面那条维护 tick;理由逐字见
-    // `boot/retention-lane.ts` 的文件头:那二十条腿全都容忍多副本,而本 lane 必须单执行者)。
-    // 两只店在场性已由上面的自持门保证(interval>0 而店缺席 ⇒ 那道门已经拒启了);这里的
-    // `&&` 只是把类型收窄出来,不是第二道门。
-    /** 租约 TTL = 2× sweep 间隔(§3)。抢租与每 domain 的续租共用同一个值 —— 两处手抄迟早只改一处。 */
     const ttlMs = config.retentionSweep.intervalSec * 1000 * RETENTION_LEASE_TTL_FACTOR;
     const retentionLaneStarted = retentionExecutor !== undefined && retentionLaneStore !== undefined && config.retentionPolicy !== undefined
         ? startRetentionLane({
@@ -924,20 +408,15 @@ async function main() {
             policy: config.retentionPolicy,
             mode: config.retentionSweep.mode,
             executor: retentionExecutor,
-            // 租约 holder = 本副本的 `instanceId`(与 run 行的 claim 同一个身份):审计行里的 holder/token
-            // 于是能直接对上"哪台副本跑的那一轮"。
             lease: {
                 acquire: async () => {
                     const claim = await retentionLaneStore.acquire(instanceId, ttlMs, Date.now());
                     return claim.held ? { held: true, fencingToken: claim.fencingToken } : { held: false };
                 },
-                // 复核**并续租**(一条 CAS)——续租的机会只有这一处:重入守卫会跳过下一 tick(理由逐字见
-                // `boot/retention-lane.ts` 的 `startRetentionLane` 头注与店侧 `renew` 的顶注)。
                 renew: (fencingToken) => retentionLaneStore.renew(instanceId, fencingToken, ttlMs, Date.now()),
                 release: () => retentionLaneStore.release(instanceId),
             },
             audit: { append: (row) => retentionLaneStore.appendAudit(row, Date.now()) },
-            // 省调预检(§5 v1.3:**不承重** —— 承重判在店事务内的哨兵行锁上)。
             holdInForce: (domain) => retentionLaneStore.holdInForce(domain),
             logger,
             metrics,
@@ -952,25 +431,14 @@ async function main() {
             holder: instanceId,
         });
     }
-    // Optional OTLP/HTTP metrics export (1.37). Periodically pushes the registry to an OTel collector;
-    // best-effort (a collector outage is logged, never affects serving). /metrics stays available too.
     const otelExporter = config.otel
         ? startOtlpExporter(metrics, {
             ...config.otel,
             onError: (err) => logger.warn("otel_export_failed", { err: String(err) }),
         })
         : undefined;
-    // design/158 A10 尾刀:60s refresh 循环 + boot-deferred 到货续接搬到 boot/config-center.ts(逐字)。
-    // ⚠️ 位置即契约:必须在 new Runner 之后 —— runnerTierFrozen 与构造函数读的是同一 config 代际。
-    // #322 批1:限额座的换代口(恒构造的两只座 —— rateLimiter 上面建、costQuota 在 budget-tracing 段建)。
-    // boot 期先 sync 一次:让「上一代读数」落位,于是第一次真变更才会留 `limit_gates_reloaded` 那一行。
     const limitSync = createLimitSync({ config, rateGate: rateLimiter, quota: costQuota, logger });
     limitSync.sync();
-    // core 5.49 `Runner.swapModels` 接缝([4775]①,models-tiers defer 臂退役):plane 候选在 commit 前
-    // 喂给**全部** boot 单例 Runner 原子换代。五实例必须同代——swap 替代 restart 后,漏换的长命 Runner
-    // 会永久停在旧代(比 defer+restart 更糟);leader lane 的 Runner 是逐调用现构(读 config.models 活
-    // 引用),不在此列。校验对同一候选输入是确定性的:首个 swap 抛 ⇒ 零实例换装、候选整拒;首个成功后
-    // 后继实例抛=结构性不可达,若真发生则 error 留痕后照抛(下一拍幂等重 swap 收敛)。
     const bootRunners = [
         ["runner", runner],
         ["handsless", handslessRunner],
@@ -992,23 +460,14 @@ async function main() {
         }
     };
     configCenter.startRefreshLoop({ runnerTierFrozen, pricing, limitSync, swapRunnerModels });
-    // design/158 A10 尾刀:per-model key resolver 首建(+ Bearer 网关组合告警)搬到 boot/config-center.ts。
-    // ⚠️ 位置即契约:首建读的必须是 boot apply **之后**的 config.modelApiKeyEnv/modelApiKeys。
     configCenter.initKeyResolver();
-    // design/158 A10:session 只读/删除面搬到 src/boot/session-faces.ts(逐字;watch→purge 次序即契约,见该文件头注)。
     const { ownerAware, sessionAudit, sessionWatchRegistry, purgeSession, instrumentDegenerate, planCacheProbe } = createSessionFaces({
         config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore,
         resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileSnapshotStore,
         workflowCompletionInbox, taskListLane,
     });
-    // design/158 A10:leader 段搬到 src/boot/leader.ts(逐字)。
     const leaderEndpoint = createLeaderFace({ config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, governanceSeams, backend });
-    // Graceful drain: shared mutable state — SIGTERM flips `draining` (shutdown below), createHttpServer
-    // assigns `inflight` (live leg count on this instance), /health + the submit 503 gate read it.
     const drainState = { draining: false };
-    // 鉴权桥(registry-core api/auth-bridge):SEMA_REGISTRY_URL 在位即点亮(零新配置——worker 已信
-    // registry 的 effective config,同一信任根延伸到其 JWKS);split 部署用 AUTH_BRIDGE_ISSUER/JWKS_URL/AUDIENCE
-    // 显式覆盖。缺 registry(纯 env 部署)=分支不存在,bearer 行为与今天字节一致。
     const authBridgeIssuer = process.env.AUTH_BRIDGE_ISSUER || config.configCenter?.baseUrl;
     const registryJwtVerifier = authBridgeIssuer
         ? createRegistryJwtVerifier({
@@ -1021,238 +480,129 @@ async function main() {
         : undefined;
     if (registryJwtVerifier)
         logger.info("auth_bridge_enabled", { issuer: authBridgeIssuer });
-    // asyncRewake wake 管道 holder:server 启动时装 deliver(session→本副本活流 steer);createTaskHooks 的
-    // ctx.wake 闭包经它投递(main 建壳/server 填实,双向不循环依赖)。
     const hookWakeBus = {};
-    // ═══════════ #154 件二:启动期静态装配自检(coordinators 构造后、listen 之前)═══════════
-    // core 的 `describeStaticWiring` 与本仓的装配谓词是**两个独立实现**在回答同一组问题。答案矛盾 =
-    // 装配谎言(不是「配置不理想」:是服务端对自己接了什么线有两套互斥说法),fail-loud 拒启 ——
-    // 与 memory+durable 两条既有拒启同族。判据本体在 http/routes/diagnostics.ts(诊断读面与拒启判据同源)。
-    //
-    // specTemplate = resolve-spec 对**每一条**任务腿都会盖的那两个 durable 键(它的 durableEnabled 分支)。
-    // 静态半场只读它们的**在场性**(`parkDurableApprovalOptIn = spec.durableApproval !== undefined`),
-    // 所以这里给的是那个形,而不是某条腿的 principal 真值。
     const wiringSpecTemplate = durableEnabled
         ? { checkpointStore, durableApproval: { scope: encodeCheckpointScope(undefined) } }
         : {};
     const staticWiring = describeStaticWiring(runnerDeps, wiringSpecTemplate);
-    // `parkFacility` 传的必须是**协调器真喂给 `resolveStreamApprovalGate` 的那个实参**(durableEnabled),
-    // 不是在这里重算一遍 —— 重算会把「两个站点算出了不同答案」这件正要被查的事抹平。
     assertStaticWiringConsistent({ manifest: staticWiring, parkFacility: durableEnabled, backendKind: backend?.kind }, logger);
-    // operator 日志面(**非 wire**)。`configFingerprint` 只有 effective 半场才铸(core 按腿算),静态半场
-    // 没有这一位 ⇒ 诚实报 null,不自造一个服务端哈希(那会是一个要跨仓对表的新语义)。
     logger.info("wiring_static", {
         fingerprint: staticWiring.configFingerprint ?? null,
         parkEffective: staticWiring.parkLane.effective,
         sessionDurability: staticWiring.session.store,
         posture: staticWiring.interaction.posture,
         streamApproval: streamApprovalGate.active ? "active" : streamApprovalGate.reason,
-        // debt #292-manifest:C18 部署级读数上 operator 日志——`full` = agent 行店在线 ∧ session 店
-        // 声明 subagent placement 分区 durable(ForkRoutingSessionStore 从 host 透传声明)。诊断端点
-        // GET /v1/diagnostics/wiring 携带全量 manifest,这里只投这枚部署级结论。
         subagentTranscripts: staticWiring.fleet.subagentTranscripts,
     });
-    // ═══════════ design/158 A8:ServiceDeps 分组装配(七组窄接口)═══════════
-    // 每组一个**带类型标注**的中间 const —— 标注位触发 TS 多余属性检查,键放错组当场编译红。
-    // (平铺形做不到:69 键的全可选面里任何键名都「属于」它,于是键落错家/从未接线只能靠源码钉
-    // 逐个盯 —— 1.300/1.301/1.304/1.307/1.310 五起真缺陷都是这个病族。)组形状门见
-    // test/deps-literal-shape-gate.test.ts;消费点仍读平铺 `deps.x`(createHttpServer 入口摊平)。
-    /** durable 持久面(键 present ⇔ 路由/能力位在场;absent ⇒ 501 诚实缺席) */
     const stores = {
         runStore,
-        resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined, // E18 resume-at eventId→entryId map (tidb/pg/local)
-        approvalExemptionStore: approvalExemptionStore ? approvalExemptionStore : undefined, // decide remember="session" + list/revoke
+        resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
+        approvalExemptionStore: approvalExemptionStore ? approvalExemptionStore : undefined,
         checkpointStore,
-        sessionPolicyStore: sessionPolicyStore ? sessionPolicyStore : undefined, // E6 operator session-rule store (PUT/GET /v1/sessions/:id/policy)
-        ruleConsent, // #154 车二:CC settings 导入两口的属主(缺席 ⇒ 两口 501)
-        // E19 cap: core's gate-split (1.134.0) REMOVED the isRemoteExecutionEnv skip — core now snapshots each
-        // completed turn + restores on resumeAt for ANY ExecutionEnv when fileSnapshotStore is wired (captureManifest/
-        // applyManifest run over any env's FileSystem ops; a 30s timeout bounds a slow remote walk). So rewind works for
-        // host/e2b/k8s/ssh/adb/local-docker AND the in-process worker → advertise `rewindFiles` whenever the store is wired.
+        sessionPolicyStore: sessionPolicyStore ? sessionPolicyStore : undefined,
+        ruleConsent,
         fileSnapshotStore: fileSnapshotStore ? fileSnapshotStore : undefined,
-        // [3321] tool-results 读面(GET /v1/tasks/:id/tool-results/:ref)的数据源。传的是 **durable** 的那一只
-        // (`toolResultStore`,present ⇔ 有 store backend),**不是** Runner 侧的内存兜底 `runnerOffloadStore`:
-        // 无 backend 部署里那只是进程内的、跨副本读不到的,把它接上读面只会让调用方读到「有时有有时无」。
-        // undefined ⇒ 路由 404 同形(理由见 ServiceStoreDeps.toolResultStore 的头注)。
         toolResultStore,
-        taskAttachmentStore: taskAttachmentStore ? taskAttachmentStore : undefined, // D-1 上传/取回/删除三动词面
-        // design/153 件3d(/decide parked 赎回腿):durable bg 行店 + boot 裸 Agent 工具,与 RunnerDeps/
-        // scenarioDeps 同实例(claim/expire/consumeParkedFlip 作用于同一行)。任一缺席=分支不存在。
+        taskAttachmentStore: taskAttachmentStore ? taskAttachmentStore : undefined,
         backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
-        // §0.5 session-ownership: the durable session abstraction (SessionRepo-style list/fork/delete) + the delete
-        // coordinator. `ownerAware` is the (possibly cache-wrapped) session store; both delegate to the DB-backed
-        // TiDB/PG store. Undefined-safe: on an in-memory dev store these carry no SessionRepo ops → the routes 501.
         sessionStorage: ownerAware,
         workflowRunStore: workflowRunStore ? workflowRunStore : undefined,
-        workflowJournalStore: workflowJournalStore ? workflowJournalStore : undefined, // [1402] journal 读面(GET /v1/workflows/:id/journal 数据源,与 runner 同实例)
+        workflowJournalStore: workflowJournalStore ? workflowJournalStore : undefined,
         imageIndex,
         imageBakes,
-        outcomeSink: outcomeSink ? outcomeSink : undefined, // P2: GET /v1/outcomes 读面(design/73 §7.2 仪表盘底料)
-        sendFileLedger: sendFileLedger ? sendFileLedger : undefined, // SendUserFile 账本读面:GET /v1/sendfile-links(owner-scope 镜像 sessions list)
-        // 2c session-sync (P1d): the WHOLE backend, because the /v1/sessions/:id/sync/* routes fan out across session
-        // entries + fileSnapshot + sessionPolicy + resumeAnchor, which must come from ONE backend in the §8 atomic
-        // order. (2026-07-29 纠正:原写「so the routes can call exportSession/importSession」——路由早已是流式实现,
-        // 不调那两个整包编排器;它们现为 test-only,判定见 src/session-sync.ts 顶注。理由不变,指路改对。)
-        // Undefined-safe: the env-only/no-backend worker 501s the routes.
+        outcomeSink: outcomeSink ? outcomeSink : undefined,
+        sendFileLedger: sendFileLedger ? sendFileLedger : undefined,
         backend: backend ? backend : undefined,
     };
-    // [3193] 病理1:fleet 快照的 recovery 屏障(deferred 形,声明先于 deps 装配、落定在下方 recover 块——
-    // 对装配顺序鲁棒;无 notify gate 的部署在 recover 块 else 臂立即落)。
     let resolveFleetRecovery;
     const fleetRecoveryDone = new Promise((r) => { resolveFleetRecovery = r; });
-    /** 进程内活体协调面(本副本 only,重启即空:HITL 协调器/可 steer 句柄注册表/总线/收件箱) */
     const coordinators = {
-        elicitation: elicitation ? elicitation : undefined, // E23: live-only inbound-elicitation coordinator (respond route + ALS wraps)
-        question: question ? question : undefined, // §4④: AskUserQuestion live coordinator (respond route + ALS wraps on streaming legs)
-        toolApproval: toolApproval ? toolApproval : undefined, // [816]/[820]②: live tool-approval coordinator (respond route + ALS wrap on the sync streaming leg)
-        workflowAgentRegistry: workflowAgentRegistry ? workflowAgentRegistry : undefined, // SVC-5: steerable workflow-agent handle registry
-        subagentSteerRegistry, // C2 (core 1.219): steerable Task-subagent handle registry (POST /v1/runs/:id/subagents/:target/steer)
-        workflowCompletionInbox: workflowCompletionInbox ? workflowCompletionInbox : undefined, // P1 ①②: drain → workflow_complete frame on stream-open
+        elicitation: elicitation ? elicitation : undefined,
+        question: question ? question : undefined,
+        toolApproval: toolApproval ? toolApproval : undefined,
+        workflowAgentRegistry: workflowAgentRegistry ? workflowAgentRegistry : undefined,
+        subagentSteerRegistry,
+        workflowCompletionInbox: workflowCompletionInbox ? workflowCompletionInbox : undefined,
         fleetBus,
-        fleetRecoveryDone, // [3193] 病理1:快照组装的有界等待信号(recover 块落定)
-        // [1196] session 级 SSE 订阅:watch registry(N 订阅共享一条探针,自适应拍距,无订阅即停)。谓词与
-        // /head 探针同门(getLeafId+ownerOf);缺 store 面不建=路由 501+capabilities.sessionEvents=false。
-        sessionWatch: sessionWatchRegistry ? sessionWatchRegistry : undefined, // [1196] 建于 purgeSession 之前(delete 即 dropSession 的同副本围栏)
+        fleetRecoveryDone,
+        sessionWatch: sessionWatchRegistry ? sessionWatchRegistry : undefined,
         hookWakeBus,
-        sendUserFile: sendUserFileEmitter ? sendUserFileEmitter : undefined, // SendUserFile 切片2:file_link 帧 ALS(bg/sync 腿 wrap)
+        sendUserFile: sendUserFileEmitter ? sendUserFileEmitter : undefined,
         leaderEndpoint,
-        sessionTitler: sessionTitler ? sessionTitler : undefined, // fire-and-forget auto-title at first submit
+        sessionTitler: sessionTitler ? sessionTitler : undefined,
     };
-    /** 函数/构件缝(main 把跨子系统的动作编译成一个可调用面交给路由) */
     const seams = {
         sessionAudit,
         purgeSession: purgeSession ? purgeSession : undefined,
-        // [1488]③(b): bg agent-handle read face — GET /v1/runs/:id/subagents/:handle/output → the same registry
-        // face the TaskOutput tool reads (defaultTaskRegistry is the process singleton every run leg registers
-        // its background children into). Access tuple is derived from the run row in server.ts, never the caller.
-        // codex R2: kind-gated BEFORE the poll (backgroundAgentOutput) — generic pollTask has side effects on
-        // other kinds (workflow onServedTerminal ack, bash output-cursor advance).
         subagentTaskOutput: (handle, access) => backgroundAgentOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
-        // [1499] CC TaskOutput/TaskStop 人侧对位 — the GENERIC task-handle verbs over the same registry singleton
-        // (kind gate at the seam: bash/monitor/agent pass, workflow refused — journal face owns it).
         taskHandleOutput: (handle, access) => taskHandleOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
         taskHandleStop: (handle, access) => taskHandleStop(defaultTaskRegistry, handle, access, backgroundAgentStore),
-        // 142-S5 §1.4: GET /v1/memory/export 数据源(DB memory plane only;file 形态 route 501)。
         memoryExport: memoryExportBackend ? (scope) => exportMemoryScope(memoryExportBackend, scope) : undefined,
-        // 142-S2.5: POST /v1/memory/sync/:scope 执行位(同一 DB entry plane + sync_cursors 游标面;
-        // plan 随数据走——core 纯函数在 performMemorySync 内直调,file 形态 route 501)。
         memorySync: memoryExportBackend && memorySyncCursors
             ? (scope, syncReq) => performMemorySync(memoryExportBackend, memorySyncCursors, scope, syncReq)
             : undefined,
-        // #264 v2-c(core 5.40.0):治理携出 bundle 的两口 —— POST /v1/memory/export · POST /v1/memory/import。
-        // 数据源是**装配好的记忆引擎本体**(不是 memoryExportBackend 那条 DB entry plane):bundle 是引擎
-        // 的单锁复合面(条目 + 托管链 + 挑战 + lineage + 污染标记同一个 epoch),不是条目读的超集。
-        // 🔴 两口共用一个在场判据,因为它们是同一个引擎面的两半(半挂 = 导得出导不进,而这条产品面的全部
-        // 意义就是那趟往返)。判据是**两项**:引擎在场 ∧ 其后端实现了 bundle 复合面 —— 后者由
-        // createMemoryBundleFaces 在**挂载期**判(返回 undefined ⇒ 两口不挂、能力位翻假、打上去诚实 501),
-        // 而不是照常挂着让每次调用确定性 409(codex 对抗复审 [medium] 驳回的那一版:一个恒假的 yes)。
-        // 绝不在本层为缺面的后端现造替代实现——理由逐字见 routes/memory-bundle.ts 的「能力面的诚实形」。
         memoryBundleExport: memoryBundleFaces ? memoryBundleFaces.exportScopes : undefined,
         memoryBundleImport: memoryBundleFaces ? memoryBundleFaces.importBundle : undefined,
-        // design/170 件A §7 收编:memory-policy 面的 `org:` 属主门与 core 准入 seam 读**同一个**目录实例
-        // (`createOrgMemoryAdmissionWiring` 的产物),两面因此共享 TTL 缓存/退避窗/gen 高水位 —— 一个进程
-        // 对「谁属于 org:acme」只有一个答案。缺席(无 center 且无 env 表)⇒ 策略面 `org:` 键仍 operator-only。
         orgMemoryDirectory: orgMemoryAdmission.directory,
-        // design/177:HTTP 只读面与模型面共用**同一个** provider 实例 —— 两面看到的库集合按定义一致,
-        // 不可能出现「壳能读到模型读不到的库」。缺席 ⇒ `/v1/shared-memory/*` 整域不挂载(见 server.ts 域头)。
         sharedMemoryStore: sharedMemoryStore ? sharedMemoryStore : undefined,
-        // sessionMirror 观测面(server 非执法端,论证在 ServiceDeps.sessionMirrorRuling):
-        // 与 executionRuling 同车同缓存(零额外 center RTT);无 center/dry-run ⇒ 不接线,观测面暗、零行为差。
         sessionMirrorRuling: principalCaps
             ? async (p) => (await principalCaps.executionRuling(p))?.sessionMirror
             : undefined,
         instrumentDegenerate,
-        sideQueryAccounting, // [1469] side-query 四路 sink 记账(与 tracer 同源装配)
+        sideQueryAccounting,
         parkedReviveTool: parkedReviveTool ? parkedReviveTool : undefined,
-        // design/158 S2(F-1)修:工厂在 :2308 造好、server.ts 消费分支在等,但从未进本实参段——HIGH-1
-        // 同族第二例(条件 spread 的键从不接线,编译期无声)。缺席后果=带 requiresParentConstraint 的
-        // parked checkpoint 重启后恒被 core pre-CAS 门拒,**不可赎回**。接线钉:test/parked-revive-gate-wiring.test.ts。
         parkedReviveInheritedGate: parkedReviveInheritedGate ? parkedReviveInheritedGate : undefined,
     };
-    /** 可观测面(全体 fail-open,观测失败绝不改业务面行为) */
     const observability = {
         logger,
         metrics,
-        modelUsage: modelUsageTracker, // E8: shared with createTracer above → runs drain it into the modelUsage echo
-        promptManifests: promptManifestTracker, // [998]②: shared with createTracer → the durable legs drain prompt_assembled events
+        modelUsage: modelUsageTracker,
+        promptManifests: promptManifestTracker,
         planCacheProbe,
     };
-    /** 准入/治理面(每件都是拒绝的权力;缺席 = 该道门不存在,不是「默认放行的门」) */
     const governance = {
         authorize,
         registryJwtVerifier: registryJwtVerifier ? registryJwtVerifier : undefined,
         rateLimiter,
         costQuota,
-        fleetLease: fleetLease ? fleetLease : undefined, // lease admission 门(提交面,镜像 quotaExceeded)
-        usageWindowStore: usageWindowStore ? usageWindowStore : undefined, // design/166-T1:治理窗 pre-admission(与 RunnerDeps 同店同键)
+        fleetLease: fleetLease ? fleetLease : undefined,
+        usageWindowStore: usageWindowStore ? usageWindowStore : undefined,
     };
-    // B1 活体 store 探测环(门与判据见 store-live-probe.ts 头注;探针原语=既有 S10 dbNowMs 真 DB 往返)
     const storeLiveProbe = backend && backend.kind !== "local" && backend.dbNowMs && config.storeProbeIntervalMs > 0
         ? createStoreLiveProbe({ probe: () => backend.dbNowMs(), intervalMs: config.storeProbeIntervalMs, logger })
         : undefined;
-    /** 部署自述面(/health + /v1/capabilities + 提交前置门读的部署事实;多为 live getter) */
     const deployment = {
-        // 海外 pilot 实机发现:/health 曾 verbatim 回显 sessionBackend 枚举——auto/DB_BACKEND 收编把它
-        // coerce 成 LABEL "tidb"(泛指 durable),pg 部署上误读成 SQL-TiDB 带偏排障。回显有效 store(与 listening
-        // 日志 session 标签同款诚实修)。
         sessionStoreLabel: config.sessionBackend === "tidb" && backend ? `durable(${backend.kind})` : config.sessionBackend,
-        modelReady: () => configCenter.modelReady(), // boot ready 门:roster 未落地=计费提交 503+health ready:false
-        scenarioDetails, // 场景详情只读面(内建+center 同判定源)
-        workflowsCapable, // ① core split: capabilities.workflows = engine-can (workflowsCapability); workflowsList = store (below)
-        staticWiring, // #154 件三:GET /v1/diagnostics/wiring 的 static 半场(与上面的拒启自检同一份产物)
-        memoryPosture, // #252 件2/件3:记忆面姿态(boot/stores.ts 的单一推导点;诊断面全量 + 能力位窄投影)
+        modelReady: () => configCenter.modelReady(),
+        scenarioDetails,
+        workflowsCapable,
+        staticWiring,
+        memoryPosture,
         instanceId,
-        // Capability discovery: the deployment facts only main knows. Store-derived booleans
-        // (asyncRuns/artifacts/approvals/leader) are computed inside the server from the deps themselves.
-        // pricingConfigured disambiguates costMicroUsd=0 ("free run" vs "MODEL_COST_* not configured") —
-        // it is worker-level config, so one flag here beats decorating every result's stats.
         capabilities: {
             version: serviceVersion(),
             scenarios: Object.keys(scenarios),
-            // 缝合审 M3:**getter,不是 boot 快照** —— `pricing` 是被 config-center 就地热改的同一个引用
-            // (`boot/config-center.ts` 的 `mutateInPlace(pricing, buildPricing(config.models))`)。算成快照的话,
-            // 运维加上/撤掉价目表之后这个键还报旧值,而它的全部用途就是给消费端消歧「0 = 免费跑 vs 没配价目表」——
-            // 报错了就把消歧信号变成误导信号。判据单一真源在 `budget.ts` 的 `isPricingConfigured`。
-            // (同一字面量里紧邻的 `restartState` 已经是 live getter 并写着为什么;这个兄弟键当时漏了。)
             get pricingConfigured() {
                 return isPricingConfigured(pricing);
             },
         },
-        // center: orchestrator polls GET /health for this — set by the sema-registry refresh loop when a
-        // pull's restart-to-apply slices differ from boot. A live getter (not a snapshot) so /health always reads current.
         restartState: () => configCenter.restartState(),
-        planeDeferredState: () => configCenter.planeDeferredState(), // codex R18: /health.modelPlaneDeferred (stuck-deferred plane, no handoff)
-        configApplyState: () => configCenter.configApplyState(), // #322 世代账:/health 三键 + 诊断 configApply 段(同一份读数)
-        mcpRevocations, // #324:GET /v1/sessions/:id/mcp 展示面与引擎执行面同一台账
-        mcpRevocationState: () => configCenter.mcpRevocationState(), // #324:诊断端点撤销名单投影
-        configRefreshNow: () => configCenter.refreshNow(), // #322 追加件:POST /v1/admin/config/refresh(触发既有拍,在飞则 join)
-        // shared drain state — SIGTERM flips `draining`, createServer assigns `inflight`, /health mirrors it.
+        planeDeferredState: () => configCenter.planeDeferredState(),
+        configApplyState: () => configCenter.configApplyState(),
+        mcpRevocations,
+        mcpRevocationState: () => configCenter.mcpRevocationState(),
+        configRefreshNow: () => configCenter.refreshNow(),
         drainState,
-        storeDegraded: storeBackendDegraded, // S5: /health twin of the store_backend_degraded gauge
-        // B1 活体 store 探测:后台缓存环(座注见 http/server.ts storeLiveState;环判据见 store-live-probe.ts)。
-        // 门 = SQL 后端 ∧ dbNowMs 在场 ∧ 旋钮>0;local/memory 恒不挂(/health 形状不变)。timer 全 unref,
-        // 进程退出零阻塞;pool 生命周期归 backend.close()。直键非条件展开(deps-literal-shape 门:条件
-        // 展开旁路多余属性检查——E-HIGH-1 死键病族)。
+        storeDegraded: storeBackendDegraded,
         storeLiveState: storeLiveProbe ? () => storeLiveProbe.state() : undefined,
     };
-    /** 数值旋钮(缺省写在消费点,此处只承载覆写) */
     const knobs = {
-        // (a) SQL 默认店的 per-blob 帽 → PUT /sync/blobs 前置 413(与 SqlBlobBackend 方言默认同源:
-        // 显式 env > tidb 的 6MiB entry-限默认;pg 默认无帽=不前置)。
-        // 🔴 复审 2026-07-28(E-HIGH-1)修:此键是 **ServiceDeps** 字段,原先被 spread 进 `runnerDeps`
-        // (core 的 RunnerDeps 无此字段,条件 spread 绕过 TS 多余属性检查 ⇒ 编译期无声)⇒ HTTP 面恒
-        // undefined、413 前置是死枝、超帽仍走 502。落错家的死键病族(verify-cost 先例)——接线钉见
-        // test/deps-literal-shape-gate.test.ts(2026-07-28 那批复审文件已按仓规折进主题文件,钉本体在 E-HIGH-1 那个 describe)。
         snapshotBlobSqlCapBytes: backend && backend.kind !== "local" && !config.snapshotBlobStore
             ? (config.snapshotBlobSqlMaxBytes ?? (backend.kind === "mysql" ? SQL_BLOB_DEFAULT_MAX_BYTES : undefined))
             : undefined,
-        // 帽只在 watch 面在场时才有意义(缺席时路由 501,读不到它)——保持与原条件段同门,不单独接线。
         sessionEventsMaxConnections: sessionWatchRegistry ? posIntEnv(process.env.SESSION_EVENTS_MAX_CONNS, 256, 100_000) : undefined,
     };
-    // #196:hands lane 登记簿 —— resolveSpec 登记本请求场景的表态,HTTP 执行点凭 spec 取回选 Runner。
-    // 两处**同一实例**(交给 createResolveSpec 与 runnerFor 闭包),配对由这一行结构性保证。
     const handsLanes = createHandsLaneRegistry();
-    // design/158 A10:resolveSpec 段搬到 src/boot/resolve-spec.ts(逐字;两处活引用改取值,见该文件头注)。
     const resolveSpec = createResolveSpec({
         handsLanes,
         config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver,
@@ -1263,35 +613,17 @@ async function main() {
         selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore,
         singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage,
         sessionEnvSelection,
-        lockedKeys: governanceSeams.lockedKeys, // design/170 件C:同步拒面判据(与 RunnerDeps.lockedConfig 同源)
-        liveQuestionFace: question, // #152:活体问答面在场 ⇒ durable question 门按活流分腿(见 ResolveSpecCtx 注)
+        lockedKeys: governanceSeams.lockedKeys,
+        liveQuestionFace: question,
     });
-    // #196:执行点选路。resolveSpec 已按场景判别位登记 lane;`full` 恒回主 runner(修前行为逐字不变)。
     const runnerFor = (spec) => pickHandsRunner(handsLanes.laneOf(spec), { full: runner, handsless: handslessRunner });
-    // #303:side-query 执行席 —— **不是** runner.sideQuery(core 的 SideQuerySpec 无 key 座位,那条路恒把
-    // 网关 key 发到模型自己的 baseUrl)。key plane 第三面在此接线,取的是与另两面(任务面
-    // boot/resolve-spec.ts、hook 面 hooks/hook-llm.ts)**同一只**活引用 getKeyResolver;brain 与
-    // RunnerDeps.brain 同实例(wrapper 在外层包,主推理链零扰动)。
     const sideQuery = createSideQueryLane({ brain, config, getKeyResolver: () => configCenter.getKeyResolver() });
     const server = createHttpServer({ runner, runnerFor, sideQuery, config, resolveSpec, stores, coordinators, seams, observability, governance, deployment, knobs });
-    // D-D SLA-timer: wire the server's deny-sweep into the reaper holder declared above (the reaper is defined
-    // before the server, so it calls through this late-bound reference).
     runDenySweep = server.denyExpiredApprovals;
-    // #329:PARKED 迟到决议的赎回席接线(晚绑 holder,见其声明处)。
-    // 🔴 **直连门部署上刻意不接**(fail-closed,#157 无静默 fail-open):`directDoorActive` 的形下
-    // `/v1/approvals/:sessionId/decide` 要求每条决议携密码学信封(签名 principal JWT + cnf.bnd + HMAC over
-    // 决议内容),而 live 回决腿 `POST /v1/tool-approvals/:id/respond` 的门只有 principal —— 把赎回席接上去
-    // 等于给这类部署开一条**免信封**的 gate 决议口(信封正是为「BFF 被攻陷也不能替人批」而立的)。缺席 ⇒
-    // 那条臂逐字回落修前 404,壳按既有 durable gate 流程走(行的 410 体已带 sessionId 指路)。
-    // 收紧方向、不改任何已有腿:非直连门部署(绝大多数)照常受益。
     if (!config.directDoorActive)
         parkedAskRedeem = server.redeemParkedAsk;
     else
         logger.info("parked_late_decision_disabled", { reason: "direct_door_requires_signed_decision_envelope" });
-    // #261:fleet 总线存活对账腿。⚠️ 位置即契约 —— 必须在 `createHttpServer` **之后**:活体谓词
-    // (`inflightRuns` ∪ `steerableRuns` 的探针)是 server 造出来的,而 reaper 段按其自身的位置契约必须在
-    // server 之前起,所以本腿独立起表(60s 档,unref;判据/五条界全在 fleet-reconciler.ts)。
-    // 零写 durable:窄口 `getRun`/`get` 两个读方法,判死属主仍是 reaper。
     const fleetReconcile = startFleetReconciler({
         bus: fleetBus,
         isLiveOnThisReplica: server.isRunLiveOnThisReplica,
@@ -1301,15 +633,7 @@ async function main() {
         logger,
         metrics,
     });
-    // [1934]:绑址旋钮 + 无鉴权自收窄(理由见 resolveBindHost 顶注)。undefined = Node 默认全接口。
     const bindHost = resolveBindHost(config);
-    // [2062]③ HOST 继承暗通道告警:zsh 常把 HOST 设成机器名,`{...process.env}` 起底的壳会静默继承给
-    // 引擎——bind 面被 shell 环境暗配而部署者不知情(HOST=机器名解析到 LAN 口时=静默扩暴露面)。
-    // 🔴 [2067]③ 次序承重:必须在 listen **之前**打——HOST=不可解析名时 listen 直接 ENOTFOUND 崩溃,
-    // 恰是「继承 HOST 把 boot 弄崩」这个最需要解释的场景;warn 在 listen 后=诊断在崩溃里缺席,用户只见
-    // 裸 getaddrinfo 栈(cli 真机取证)。
-    // 缝合审 M5:收窄现在会**压过**继承的 HOST(见 resolveBindHost)。分两臂 —— 否则这条 warn 打的
-    // `bindHost` 已是收窄后的 127.0.0.1,而 note 还说「came from the HOST env var」,自己变成一句谎。
     if (config.bindHostSource === "HOST" && bindHost !== config.bindHost) {
         logger.warn("bind_host_from_HOST_env_overridden", {
             bindHost,
@@ -1323,20 +647,15 @@ async function main() {
             note: "the bind address came from the HOST env var (not BIND_HOST). Shells like zsh commonly set HOST to the machine name — if you did not set it yourself, this may be an inherited shell variable silently configuring the bind face. Set BIND_HOST explicitly to silence this warning.",
         });
     }
-    // 缝合审 M8:listen 期的 rejecter 必须**具名**,因为它必须在 listen 结束后被摘掉。留着不摘的话,
-    // 运行期第一个 server-level error 会喂给一个已 settle 的 Promise(reject = no-op)⇒ 零日志零抛;
-    // 而 `once` 自摘之后,第二个 error 才 uncaught 崩进程 —— 这条缺口吃掉的恰好是**第一个**证据,
-    // 而第一个证据往往是唯一能解释后面那次崩溃的东西。
     let onListenError;
     try {
         await new Promise((resolve, reject) => {
-            onListenError = reject; // listen 失败(ENOTFOUND/EADDRINUSE…)不吊死这个 Promise
+            onListenError = reject;
             server.once("error", onListenError);
             bindHost ? server.listen(config.port, bindHost, resolve) : server.listen(config.port, resolve);
         });
     }
     catch (e) {
-        // [2067]③:崩溃路径自带来源诊断——不可解析的 HOST 继承名在这里最常见。
         logger.error("listen_failed", {
             port: config.port,
             bindHost: bindHost ?? "0.0.0.0/::(all interfaces)",
@@ -1347,8 +666,6 @@ async function main() {
         throw e;
     }
     finally {
-        // listen 结束(成功或失败)即摘。换上持久 handler:server-level error 之后进程通常仍能服务,
-        // 崩掉整个副本太重 —— 但绝不能无声。
         if (onListenError)
             server.removeListener("error", onListenError);
     }
@@ -1358,9 +675,6 @@ async function main() {
             ...("code" in e ? { code: String(e.code) } : {}),
         });
     });
-    // fleet worker 接线(announce/heartbeat + usage 批报;lease 消费后一拍):boot 完成后
-    // 注册(=首次心跳)。门 = center lane 配置 ∧ FLEET_ADVERTISE_ADDRESS 显式声明(不自猜可达地址);任一缺 → undefined
-    // = 非 fleet 部署零行为。draining 翻转的即刻 announce 在 drainThenShutdown;退出 DELETE 在 hardShutdown。
     const fleetClient = startFleetClientFromEnv(config, {
         instanceId,
         version: serviceVersion(),
@@ -1370,9 +684,6 @@ async function main() {
     });
     if (fleetClient)
         logger.info("fleet_client_started", { worker: config.configCenter?.worker, address: process.env.FLEET_ADVERTISE_ADDRESS });
-    // 缝合审 M7:这是**唯一**一处 `listening`。此前 listen 成功处还有第二条同名事件(只带
-    // port/bindHost/note),日志消费方 grep "listening" 会撞见两条键集不同的同名事件,按前一条解析
-    // 部署快照的人拿到残缺形。bindHost + loopback 收窄 note 并进这里,别再另起一行。
     logger.info("listening", {
         port: config.port,
         bindHost: bindHost ?? "0.0.0.0/::(all interfaces)",
@@ -1381,44 +692,28 @@ async function main() {
             : {}),
         model: config.model.id,
         brain: brainSummary(config),
-        // shared = cross-replica TiDB breaker state; in-process = core's per-replica Map; off = breaker disabled
-        breakerState: config.resilience.circuitBreaker ? (breakerState ? `shared(${backend.kind})` : "in-process") : "off", // 1.108: was hard-coded "shared(tidb)" — lied under DB_BACKEND=pg
-        // On DB_BACKEND=local the wiring coerces sessionBackend to the LABEL "tidb" (meaning "the
-        // backend's durable store, generically") — printing it verbatim read as a SQL deployment on a file-everything
-        // box. Print the effective store instead (same honesty fix as breakerState above).
+        breakerState: config.resilience.circuitBreaker ? (breakerState ? `shared(${backend.kind})` : "in-process") : "off",
         session: config.sessionBackend === "tidb" && backend ? `durable(${backend.kind})` : config.sessionBackend,
-        // design/138 S1: the file-based memory engine (single-user only); "off" = MEMORY_ENGINE=off or multi-tenant.
         memory: memoryEngine ? `engine(${memoryEngine.root})` : "off",
         instanceId,
         rateLimitPerMin: config.rateLimitPerMin,
         rateLimit: config.rateLimitPerMin > 0 ? counterStoreLabel(backend?.rateLimiter, backend?.kind) : "off",
         maxPrincipalCostUsd: config.maxPrincipalCostUsd || null,
         costQuota: config.maxPrincipalCostUsd > 0 ? counterStoreLabel(backend?.costQuota, backend?.kind) : "off",
-        // durable offload store for large tool results (cross-replica wake); else core's in-process default
         toolResultStore: toolResultStore ? (backend?.kind === "local" ? "file(local)" : "shared(sql)") : "in-process",
         otel: config.otel ? config.otel.endpoint : null,
-        perModelKeys: Object.keys(config.modelApiKeyEnv).length, // models with their own upstream key (else gateway)
+        perModelKeys: Object.keys(config.modelApiKeyEnv).length,
         sealedModelKeys: Object.values(config.modelApiKeys).filter((v) => typeof v === "string").length,
-        sealedPoisonedModels: Object.values(config.modelApiKeys).filter((v) => typeof v !== "string").length, // sealed-box custody keys unsealed (count only — values never log)
-        // SVC-1: durable workflow record + at-least-once notify backend (file = crash-safe ledger; memory = ephemeral)
+        sealedPoisonedModels: Object.values(config.modelApiKeys).filter((v) => typeof v !== "string").length,
         workflowRunStore: config.selfOrchestrationEnabled
             ? config.workflowRunStoreBackend === "memory"
                 ? "in-process"
                 : sqlWorkflowRunStore
-                    ? `db(${backend.kind})` // P1: cross-replica twin active
+                    ? `db(${backend.kind})`
                     : "file"
             : "off",
     });
-    // SVC-1 at-least-once notify — CRASH-RECOVERY sweep: once at boot, re-derive every un-acked (started-but-not-
-    // delivered) workflow's terminal state from the durable run store and re-deliver the completion notify that a
-    // prior replica crash dropped (idempotent on the receiver). Fire-and-forget AFTER listen so startup isn't
-    // blocked on it (recovery only re-fires completion notifications — independent of serving new requests). A
-    // sweep throw is logged, never fatal.
     if (workflowNotifyGate) {
-        // [2995]/[2999] opts 单点合成在 workflow-orchestration(可见性回灌 + replica-local 形 boot 孤儿判死)。
-        // [3193] 病理1:recover 收官(成败皆算)即落 fleet 快照屏障——「serving 不等 recovery」对**提交请求**
-        // 仍成立,但 fleet 快照组装现在对它做有界等待(routes/fleet.ts,3s cap):SIGKILL 后壳重连不再
-        // 与 boot 判死赛跑(cli [3193] 插桩实证的竞态)。
         void workflowNotifyGate
             .recover(workflowRecoverOpts)
             .then((tally) => logger.info("workflow_notify_recovered", tally))
@@ -1428,14 +723,11 @@ async function main() {
     else {
         resolveFleetRecovery();
     }
-    // design/158 A10:收尾段搬到 src/boot/shutdown.ts(逐字)。⚠️ 调用点必须留在 listen 之后 —— 位置即契约,
-    // 理由(信号注册时点/三信号相对次序/clearInterval 先于 server.close)见该文件头注。
     installShutdownHandlers({
         config, logger, server, reaper, fleetReconcile, otelExporter, breakerState, costQuota, rateLimiter,
-        version: serviceVersion(), // #320①:崩溃遗言的 version 键(与 capabilities.version 同源)
+        version: serviceVersion(),
         runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState,
-        storeLiveProbe, configCenter, // #131-2:两个漏网的进程级后台环进收尾链
-        // #270 车2:留存 lane 的定时器 + 主动让租(收尾契约 3 同族,理由见 shutdown.ts 的两条注)。
+        storeLiveProbe, configCenter,
         retentionLane: retentionLaneStarted,
         releaseRetentionLease: retentionLaneStore !== undefined ? () => retentionLaneStore.release(instanceId) : undefined,
     });