@sema-agent/server 7.44.0 → 7.45.0-rc.1

package/README.md

@@ -153,6 +153,8 @@ The server is configured entirely through environment variables. The most import
 | `DB_BACKEND` | `local`* | `mysql` (any MySQL-protocol DB: MySQL/TiDB/MariaDB) / `pg` (PostgreSQL) / `local` (file-backed, no DB) / `memory` (explicit in-memory: nothing survives a restart, durable-runs faces 501). *Bare boot (no DB env at all) defaults to `local` so a single-user machine keeps its runs across restarts; any SQL signal (`SESSION_BACKEND` or `TIDB_/MYSQL_/PG_HOST`) keeps the `mysql` engine default, and `REQUIRE_PRINCIPAL=true` bare boots stay `memory` (the local file store has no tenant isolation — a warning says so). A DEFAULT-derived `local` that cannot create its data root degrades to memory with a warning + the `store_backend_degraded` gauge; an EXPLICIT `DB_BACKEND=local` fails loud instead. Setting `mysql`/`pg` explicitly also switches sessions to durable |
 | `SESSION_BACKEND` | `memory`* | `memory` / `mysql` (durable session center) / `auto`. *Defaults to durable when `DB_BACKEND` is explicitly `mysql`/`pg` |
 | `REMOTE_EXEC` | unset | Sandbox execution lane: `host` / `local-docker` / `e2b` / `k8s` / `ssh` / `adb`; unset = in-process stub (with `CONFIG_PROVIDER=local` the default becomes `host`). Naming a lane without its required env (e.g. `e2b` without `E2B_API_KEY`) or an unrecognized value **refuses to start** — no silent downgrade to the host/in-process lane (#157 fail-closed) |
+| `SSH_HOST_FINGERPRINT` / `SSH_KNOWN_HOSTS` | unset | **SSH lane host-key verification** (`REMOTE_EXEC=ssh` only). `SSH_HOST_FINGERPRINT` = the host key's SHA256 base64 fingerprint (`SHA256:` prefix and `=` padding both optional); `SSH_KNOWN_HOSTS` = a path to a `known_hosts` file, matched literally on `host` / `[host]:port`. **Either one present ⇒ strict verification, a mismatch REFUSES the connection** (the error carries both fingerprints plus an `ssh-keyscan` line); both set ⇒ both must pass. **Both unset ⇒ a loud per-connection warning (`ssh_host_key_unverified`, man-in-the-middle risk) and the connection proceeds** — the deliberate posture for the batch-deploy lane, registered as a P-DEBT fail-open (`docs/FAIL-OPEN-CENSUS.md`). A malformed fingerprint or an unreadable `known_hosts` path **refuses to start**. Not supported in `known_hosts`, on purpose: hashed (`\|1\|…`) lines, wildcard patterns, `@cert-authority` — all skipped, so a host whose only entries are those is REFUSED (`@revoked` is honored and wins over any plain line, whatever the order) |
+| `HOOKS_TIMEOUT_MS` | unset (engine default 600000) | Per-invocation time bound for every hook seat (core `Hooks.timeoutMs`). Unset = the engine's own default (this server does not copy upstream defaults). `0` is honored as written (every seat expires immediately). A non-integer, negative, or above-`setTimeout`-ceiling (2147483647) value **refuses to start** |
 | `CONFIG_PROVIDER` | unset | Config source: `local` (file-backed `config.d/`, single machine) / `remote` (registry control plane) |
 | `DEFAULT_SCENARIO` | `code` | Default scenario when the request body names none |
 | `SANDBOX_PKG_SOURCE` | `global` | Package sources inside sandboxes: `global` (official upstreams) / `cn` (China mirrors) / `custom` / `none` |

package/README.zh-CN.md

@@ -142,6 +142,8 @@ curl -s localhost:8090/v1/tasks -H "Authorization: Bearer <SERVICE_AUTH_TOKEN>"
 | `DB_BACKEND` | `local`* | SQL 引擎:`mysql`(任何 MySQL 协议库:MySQL/TiDB/MariaDB —— TiDB 走这个值,**没有** `tidb` 别名,写它启动即拒)/ `pg`(PostgreSQL)/ `local`(免 DB 文件持久化)/ `memory`(显式纯内存)。显式设置 `mysql`/`pg` 时 session 自动转 durable。*单租户裸 boot 缺省 `local`;`REQUIRE_PRINCIPAL=true` 的多租户裸 boot 缺省 `memory`(local 与多租户互斥) |
 | `SESSION_BACKEND` | `memory`* | `memory` / `mysql`(durable 会话中心)/ `auto`。*显式 `DB_BACKEND=mysql/pg` 时默认转 durable |
 | `REMOTE_EXEC` | 未设 | 沙箱执行通道:`host` / `local-docker` / `e2b` / `k8s` / `ssh` / `adb`;未设 = 进程内 stub(`CONFIG_PROVIDER=local` 时缺省转 `host`)。点名了通道但必需 env 不全(如 `e2b` 缺 `E2B_API_KEY`)或值不在闭集内 ⇒ **启动即拒**——不再静默降级到 host/进程内通道(#157 fail-closed) |
+| `SSH_HOST_FINGERPRINT` / `SSH_KNOWN_HOSTS` | 未设 | **SSH 通道主机密钥校验**(仅 `REMOTE_EXEC=ssh`)。前者 = 主机公钥的 SHA256 base64 指纹(`SHA256:` 前缀与 `=` 填充都可选);后者 = `known_hosts` 文件路径,按 `host` / `[host]:port` **逐字**匹配行。**任一在场 ⇒ 严格校验,不符即拒连**(拒因带两半指纹 + `ssh-keyscan` 取指纹指路一行);两只同时在场 ⇒ 合取(都要过)。**两只全缺席 ⇒ 每连接一条响亮 warn(`ssh_host_key_unverified`,中间人风险)后照常连** —— 批量部署通道的既定姿态,已登记为 P-DEBT fail-open(`docs/FAIL-OPEN-CENSUS.md`)。指纹拼错 / `known_hosts` 路径读不到 ⇒ **启动即拒**。`known_hosts` 里**刻意不支持**:hashed(`\|1\|…`)行、通配符 pattern、`@cert-authority` —— 一律跳过,于是只有这些条目的主机会被**拒连**(`@revoked` 照常生效,且无论写在哪一行都优先于普通匹配行) |
+| `HOOKS_TIMEOUT_MS` | 未设(引擎缺省 600000) | 每一只 hook 席位**单次调用**的时间上限(core `Hooks.timeoutMs`)。未设 = 用引擎自己的缺省(本服务不复制上游默认值)。`0` **按字面生效**(每个席位立即到期)。非整数 / 负数 / 超 `setTimeout` 上限(2147483647)⇒ **启动即拒** |
 | `CONFIG_PROVIDER` | 未设 | 配置来源:`local`(单机文件 `config.d/`)/ `remote`(registry 控制面) |
 | `DEFAULT_SCENARIO` | `code` | 请求体未指定场景时的缺省场景 |
 | `SANDBOX_PKG_SOURCE` | `global` | 沙箱内装包源:`global`(官方源)/ `cn`(国内镜像)/ `custom` / `none` |

package/USAGE.md

@@ -143,6 +143,7 @@ MODEL_ID=<your-model-name>  MODEL_CHEAP_ID=<your-cheap-model-name>
 - 调用方可在 `objective` 里 `@<模型名>` 选模型,**只认已配置的名单**(`MODEL_ID` / `MODEL_CHEAP_ID`)——注入不了 `baseUrl`/`apiKey`;无 `@` → 默认模型。
 - **`GET /v1/models`**(带 Bearer)→ `{models:[{name,id,provider,reasoning,vision}],default}`,只含名字/能力、**不含密钥** —— 消费方(如 OA)拿它做 `@` 自动补全下拉的数据源。
 - 不设 `MODEL_CHEAP_ID` → 所有角色 = 主模型(行为不变)。详见 `design/19`。
+- **1M 双窗**(`autoCompactTokens`):`967000` 只发给 **claude-sonnet-5 系 id ∧ 窗 ≥1M**(CC 的 per-model 值,不是窗宽几何)。其他 ≥1M 模型要双窗触发点请显式配 —— 主槽 `MODEL_AUTO_COMPACT_TOKENS=<tokens>`、cheap 槽 `MODEL_CHEAP_AUTO_COMPACT_TOKENS=<tokens>`(**两槽各配各的**:主槽的值按主模型 id/窗声明,不会外溢到 cheap)。不配 → core 按整窗的 `W-33000` 平几何触发,boot 期发 `auto_compact_window_not_derived_1m` warn 点名槽位(`slot=main|cheap`)。⚠️ cheap 槽不设 `MODEL_CHEAP_CONTEXT_WINDOW` 时**继承主模型的窗**,主模型是 1M 则 cheap 也按 1M 计。取值范围:**必须低于该槽的物理窗**(CC 的形是 `窗-33000`)—— 高于物理窗 = 触发点永远到不了 = autocompact 事实上关掉、改由破坏性 guard 砍历史;配高了照配的落但 boot 期发 `auto_compact_tokens_above_context_window` warn(不拒启、不夹紧)。
 
 **可选 — 开发者模式 building blocks（core 1.43，默认中立）**
 ```bash
@@ -443,7 +444,15 @@ READ_DENY_PATTERNS='[{"pattern":"**/secrets/**"},{"pattern":".ssh","caseSensitiv
   restart 才生效),但**从 enabled 集删除一个服务器即时生效**——refresh 拍收货后,被删服务器的
   MCP 调用当场按 coded 拒绝 `mcp.server_revoked` 结算(known-not-executed,引擎每次派发前探询
   台账,不缓存)。因此 `/health` 的 `restart.reasons` 对**纯删除向**不再报 `mcp`(签了就是为一个
-  已生效的变更滚动重启 fleet);删除+新增/改址混合拍照签。重新把服务器加回 enabled 集=解除撤销。
+  已生效的变更滚动重启 fleet);删除+新增/改址混合拍照签。
+  **恢复=指纹判,不是名字判**:把服务器加回 enabled 集,只有当**整条目与 boot 那一份逐字同形**
+  (全字段指纹,`enabled` 键也算一位)时才解除撤销。三形**保持 revoked**、只能候 restart 收敛:
+  ①改址/改配置后同名加回(复活的会是 boot 冻结的**旧** mount,新形要 restart 才装上 ⇒ fail-closed);
+  ②boot 条目本没写 `enabled` 键、却用 `enabled:false → true` 开关切回(带上这个键就已经不同形了;
+  想走开关撤销/恢复,boot 那份条目里就要显式写 `enabled: true`);③boot 期压根没铸出 baseline
+  (中心迟到到货 / boot 超时 ⇒ mount 集=env 集),那台机器整条中心撤销语义不适用,恒不解除。
+  ①②两形 `/health` 的 `restart.reasons` 会签 `mcp`,按信号滚动重启即收敛;判「解除了没有」看下面那个
+  被撤名单,别按「我加回去了」推断。
   当前被撤名单可从 `GET /v1/diagnostics/wiring` 的 `mcpRevocations.revoked` 读(`null`=本进程无
   配置管道);`GET /v1/sessions/:id/mcp` 面板与执行面同一台账(被撤服务器的工具不再展示)。
   纯 env 配置的 `MCP_SERVERS` 部署无中心撤销语义,行为逐字不变。

package/dist/approval-card.d.ts

@@ -176,6 +176,7 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         requiresRealApproval: z.ZodBoolean;
     }, z.core.$strict>;
     governanceForced: z.ZodOptional<z.ZodLiteral<true>>;
+    inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
     persistedRuleShadowed: z.ZodOptional<z.ZodString>;
     ruleSuggestions: z.ZodOptional<z.ZodArray<z.ZodObject<{
         rule: z.ZodString;
@@ -238,6 +239,7 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             requiresRealApproval: z.ZodBoolean;
         }, z.core.$strict>;
         governanceForced: z.ZodOptional<z.ZodLiteral<true>>;
+        inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
         persistedRuleShadowed: z.ZodOptional<z.ZodString>;
         ruleSuggestions: z.ZodOptional<z.ZodArray<z.ZodObject<{
             rule: z.ZodString;
@@ -304,6 +306,9 @@ export interface ApprovalCardSource {
     /** [2942]/[2943]:治理来源标 —— 与 wire 帧**同一份素材**(`ToolApprovalFrame` 结构上满足本接口),
      *  于是 live 帧 / `card_json` / 重放帧三面同源,不是三处各判一遍。 */
     governanceForced?: true;
+    /** E-14:bidi 在场位 —— 与 wire 帧**同一份素材**(`ToolApprovalFrame` 结构上满足本接口)⇒ live 帧 /
+     *  `approval_request` / `card_json` / 重放帧四面同源,不是四处各扫一遍。 */
+    inputHasBidi?: true;
     /** #144(core 5.25.0):被越级的持久规则原文 —— **已 redactSecrets**(发帧点做,本模块只 clip)。
      *  与 wire 帧**同一份素材**(`ToolApprovalFrame` 结构上满足本接口)⇒ live 帧 / `card_json` / 重放帧三面同源。 */
     persistedRuleShadowed?: string;

package/dist/approval-card.js

@@ -127,6 +127,7 @@ export const ApprovalCardSchema = z
     })
         .strict(),
     governanceForced: z.literal(true).optional(),
+    inputHasBidi: z.literal(true).optional(),
     persistedRuleShadowed: z.string().max(MAX_RULE_TEXT_CHARS).optional(),
     ruleSuggestions: z.array(RuleSuggestionSchema).max(MAX_RULE_SUGGESTIONS).optional(),
     probeCause: ProbeCauseSchema.optional(),
@@ -184,6 +185,7 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
             requiresRealApproval,
         },
         ...(source.governanceForced === true ? { governanceForced: true } : {}),
+        ...(source.inputHasBidi === true ? { inputHasBidi: true } : {}),
         ...(shadowedRule !== undefined && shadowedRule !== "" ? { persistedRuleShadowed: shadowedRule } : {}),
         ...(probeCause !== undefined ? { probeCause } : {}),
         ...(ruleEvidence !== undefined ? { ruleEvidence } : {}),

package/dist/boot/config-center.js

@@ -35,6 +35,16 @@ export async function createConfigCenterRuntime(ctx) {
         }
         return generationOrdinal;
     };
+    const reserveArrivalGeneration = () => {
+        generationOrdinal += 1;
+        lastGenerationVersion = undefined;
+        return generationOrdinal;
+    };
+    const useArrivalGeneration = (version, ticket) => {
+        if (ticket === generationOrdinal)
+            lastGenerationVersion = version;
+        return ticket;
+    };
     let manualRefresh;
     let appliedPlaneEff;
     let planeDeferredNoHandoff;
@@ -459,7 +469,7 @@ export async function createConfigCenterRuntime(ctx) {
             if (configProvider) {
                 const ccRef = config.configCenter;
                 let refreshInFlight = false;
-                const refreshTick = async (prefetched) => {
+                const refreshTick = async (arrival) => {
                     if (refreshInFlight)
                         return "ok";
                     refreshInFlight = true;
@@ -469,7 +479,7 @@ export async function createConfigCenterRuntime(ctx) {
                             metrics.inc("models_tiers_plane_deferred_stuck_total");
                             logger.warn("models_tiers_deferred_no_handoff", { version: planeDeferredNoHandoff.version, since: planeDeferredNoHandoff.since, note: "candidate still retained without a next-boot handoff — mount restart-surviving LKG storage + CONFIG_LKG_DURABLE=true, or restart manually after ensuring the candidate is re-pulled at boot" });
                         }
-                        const r = prefetched !== undefined ? prefetched : await configProvider.fetchEffective(ccEtag);
+                        const r = arrival !== undefined ? arrival.result : await configProvider.fetchEffective(ccEtag);
                         if (r === null && planeDeferredNoHandoff) {
                             const skillsDebt = (planeDeferredNoHandoff.blocked ?? []).includes("skills");
                             const promoted = lkgSurvivesRestart || skillsDebt ? await persistLkgDurable(planeDeferredNoHandoff.candidate, planeDeferredNoHandoff.candidateEtag) : false;
@@ -489,7 +499,7 @@ export async function createConfigCenterRuntime(ctx) {
                             }
                         }
                         if (r) {
-                            const tickGen = generationOf(r.effective.version);
+                            const tickGen = arrival !== undefined ? useArrivalGeneration(r.effective.version, arrival.ordinal) : generationOf(r.effective.version);
                             applyLedger.seenTarget(tickGen, r.effective.version);
                             const promptsRaw = r.effective.prompts;
                             const promptsGate = promptsRaw !== undefined ? validatePromptsDomain(promptsRaw) : { ok: true };
@@ -624,10 +634,10 @@ export async function createConfigCenterRuntime(ctx) {
                     return "ok";
                 };
                 let inFlight;
-                const runTick = (prefetched) => {
+                const runTick = (arrival) => {
                     if (inFlight)
                         return inFlight;
-                    const p = refreshTick(prefetched).finally(() => {
+                    const p = refreshTick(arrival).finally(() => {
                         inFlight = undefined;
                     });
                     inFlight = p;
@@ -636,21 +646,20 @@ export async function createConfigCenterRuntime(ctx) {
                 manualRefresh = runTick;
                 ccTimer = setInterval(() => void runTick(), 60_000);
                 ccTimer.unref?.();
-                const deferredBootApply = async (r) => {
+                const deferredBootApply = async (r, arrivalGen) => {
                     if (!r)
                         return;
                     if (refreshInFlight)
                         return;
                     refreshInFlight = true;
                     try {
-                        await deferredBootApplyInner(r);
+                        await deferredBootApplyInner(r, useArrivalGeneration(r.effective.version, arrivalGen));
                     }
                     finally {
                         refreshInFlight = false;
                     }
                 };
-                const deferredBootApplyInner = async (r) => {
-                    const lateGen = generationOf(r.effective.version);
+                const deferredBootApplyInner = async (r, lateGen) => {
                     applyLedger.seenTarget(lateGen, r.effective.version);
                     const promptsRaw = r.effective.prompts;
                     const promptsGate = promptsRaw !== undefined ? validatePromptsDomain(promptsRaw) : { ok: true };
@@ -736,8 +745,10 @@ export async function createConfigCenterRuntime(ctx) {
                         pendingRestart = { restartRequired: true, reasons, version: r.effective.version, since: Date.now() };
                     logger.info("config_loaded_deferred", { source: configProvider.kind, version: r.effective.version, models: (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length, ...(reasons.length > 0 ? { restartRequired: true, restartReasons: reasons } : {}) });
                 };
-                if (bootConfigPending)
-                    void bootConfigPending.then((r) => void (lkgBooted ? runTick(r) : deferredBootApply(r)), () => { });
+                if (bootConfigPending) {
+                    const arrivalGen = reserveArrivalGeneration();
+                    void bootConfigPending.then((r) => void (lkgBooted ? runTick({ result: r, ordinal: arrivalGen }) : deferredBootApply(r, arrivalGen)), () => { });
+                }
             }
         },
         stopRefreshLoop() {

package/dist/boot/execution-env.js

@@ -82,6 +82,7 @@ export function createExecutionEnv(ctx) {
             privateKey: config.remoteExec.privateKey,
             ...(config.remoteExec.port != null ? { port: config.remoteExec.port } : {}),
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
+            ...(config.remoteExec.hostKey !== undefined ? { hostKey: config.remoteExec.hostKey } : {}),
         });
     }
     else if (config.remoteExec?.provider === "adb") {

package/dist/boot/shutdown.d.ts

@@ -12,6 +12,9 @@
  *     "第二个信号"的语义读数。
  *  3. `clearInterval(reaper)` 必须是 hardShutdown 的第一件事(在 `server.close()` 之前),否则
  *     收尾期还会有 reaper tick 打向正在关闭的池。
+ *  4. **进程级监听一律成对**(A-070 二轮件4):本函数装的五只(三信号 + #320① 双钩)只能经返回的
+ *     {@link ShutdownHandle} 摘 —— 调用方手写「摘三信号」的收尾会把双钩漏在进程上,而陈旧的那只
+ *     rejection 钩仍握着 `process.exit(1)`,会对后续无关的 rejection 把进程打掉。
  */
 import { Runner, type RunnerDeps } from "@sema-agent/core";
 import type { ServiceConfig } from "../config.js";
@@ -73,6 +76,19 @@ export interface ShutdownCtx {
         stopRefreshLoop(): void;
     } | undefined;
 }
-/** 注册 SIGTERM/SIGINT/SIGHUP 收尾链。**必须在 listen 之后调用**(见文件头「位置即契约」)。 */
-export declare function installShutdownHandlers(ctx: ShutdownCtx): void;
+/**
+ * `installShutdownHandlers` 的**摘除把手**(A-070 二轮重扫件4)。
+ *
+ * 存在理由:本函数装的是**进程级**监听(三信号 + #320① 双钩),而进程级注册表是全局单例 —— 一个进程里
+ * 装两次就是两套 handler 同时在场。生产进程只装一次、装到死,所以这把手服务的是**同进程内反复装配**的
+ * 那一族调用方(测试):此前它们各自手写「只摘三信号」的收尾,双钩每次净泄漏两只,而陈旧 handler 会对
+ * **后续无关**的 rejection 执行 `process.exit(1)`。注册/摘除配对因此必须由装配方给,不许调用方各猜一份。
+ */
+export interface ShutdownHandle {
+    /** 摘除**本次调用**注册的全部进程级监听(三信号 + 双钩)并停掉本次装的 parent 监视腿。幂等。 */
+    dispose(): void;
+}
+/** 注册 SIGTERM/SIGINT/SIGHUP 收尾链。**必须在 listen 之后调用**(见文件头「位置即契约」)。
+ *  返回 {@link ShutdownHandle} —— 同进程内反复装配的调用方(测试)必须用它收尾。 */
+export declare function installShutdownHandlers(ctx: ShutdownCtx): ShutdownHandle;
 //# sourceMappingURL=shutdown.d.ts.map

package/dist/boot/shutdown.js

@@ -2,6 +2,7 @@ import { Runner, defaultTaskRegistry } from "@sema-agent/core";
 import { writeCrashLast, clearCrashLast, readCrashLast } from "./crash-last.js";
 import { createSighupIdleHandler } from "../sighup-idle.js";
 import { createParentWatch } from "../parent-watch.js";
+import { isScriptRealmRejection, describeRejectionReason } from "../orchestration/hardened-vm-runner.js";
 export function installShutdownHandlers(ctx) {
     const { config, logger, server, reaper, fleetReconcile, retentionLane, releaseRetentionLease, otelExporter, breakerState, costQuota, rateLimiter, runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState, storeLiveProbe, configCenter, version, } = ctx;
     const dataRoot = config.localDataRoot;
@@ -14,16 +15,34 @@ export function installShutdownHandlers(ctx) {
         if (dataRoot)
             writeCrashLast(dataRoot, { version, inflight: drainState.inflight?.(), err });
     };
-    process.on("uncaughtException", (err) => {
-        writeLastWords(err);
-        console.error(err);
-        process.exit(1);
-    });
-    process.on("unhandledRejection", (err) => {
-        writeLastWords(err);
-        console.error(err);
-        process.exit(1);
-    });
+    const onUncaughtException = (err) => {
+        try {
+            writeLastWords(err);
+            console.error(err);
+        }
+        finally {
+            process.exit(1);
+        }
+    };
+    process.on("uncaughtException", onUncaughtException);
+    const onUnhandledRejection = (err, promise) => {
+        if (isScriptRealmRejection(promise)) {
+            try {
+                logger.warn("unhandled_rejection_script_realm_contained", { reason: describeRejectionReason(err) });
+            }
+            catch {
+            }
+            return;
+        }
+        try {
+            writeLastWords(err);
+            console.error(err);
+        }
+        finally {
+            process.exit(1);
+        }
+    };
+    process.on("unhandledRejection", onUnhandledRejection);
     let closing = false;
     let parentWatch;
     const hardShutdown = () => {
@@ -74,6 +93,7 @@ export function installShutdownHandlers(ctx) {
         forceClose.unref?.();
     };
     let draining = false;
+    let drainTick;
     const drainThenShutdown = () => {
         if (closing)
             return;
@@ -98,14 +118,16 @@ export function installShutdownHandlers(ctx) {
             const elapsed = Math.round(performance.now() - t0);
             if (n === 0 || elapsed >= config.drainGraceMs) {
                 clearInterval(tick);
+                drainTick = undefined;
                 logger.info("drain_complete", { inflight: n, elapsedMs: elapsed, timedOut: n > 0 });
                 hardShutdown();
             }
         }, 1_000);
+        drainTick = tick;
     };
     process.on("SIGTERM", drainThenShutdown);
     process.on("SIGINT", hardShutdown);
-    process.on("SIGHUP", createSighupIdleHandler({
+    const onSighup = createSighupIdleHandler({
         inflight: () => drainState.inflight?.() ?? 0,
         lastActivityAt: () => drainState.lastActivityAt?.() ?? 0,
         isStopped: () => closing || draining,
@@ -113,7 +135,8 @@ export function installShutdownHandlers(ctx) {
         shutdown: hardShutdown,
         idleGraceMs: config.sighupIdleGraceMs,
         log: (event, fields) => logger.info(event, fields),
-    }));
+    });
+    process.on("SIGHUP", onSighup);
     if (config.parentPid !== undefined) {
         parentWatch = createParentWatch({
             pid: config.parentPid,
@@ -122,5 +145,24 @@ export function installShutdownHandlers(ctx) {
             log: (event, fields) => logger.info(event, fields),
         });
     }
+    let disposed = false;
+    return {
+        dispose: () => {
+            if (disposed)
+                return;
+            disposed = true;
+            process.removeListener("uncaughtException", onUncaughtException);
+            process.removeListener("unhandledRejection", onUnhandledRejection);
+            process.removeListener("SIGTERM", drainThenShutdown);
+            process.removeListener("SIGINT", hardShutdown);
+            process.removeListener("SIGHUP", onSighup);
+            onSighup.stop();
+            if (drainTick !== undefined) {
+                clearInterval(drainTick);
+                drainTick = undefined;
+            }
+            parentWatch?.stop();
+        },
+    };
 }
 //# sourceMappingURL=shutdown.js.map

package/dist/boot/side-query-lane.d.ts

@@ -35,22 +35,25 @@
  * 网关账号去打这只模型的上游,正是毒丸机制存在的理由(CLAUDE.md #157 安全轴 fail-closed)。换装后
  * 这条语义由 core 承载得更彻底:座位抛 ⇒ `runSideQuery` 的 `await` 直接上抛,brain 一个字节都没发。
  *
- * ## 具名残余:**无 per-model key 的 off-route 模型仍收网关 key**(codex R1-F1,逐条评估后如实留)
+ * ## 具名残余已在**源头**清偿(core 5.57.0,#345 提货批)—— 本席的 P-DEBT 腿随之撤线
  *
- * 判据本身没变(座位到货也没改它):`undefined` ⇒ 座位不给凭据 ⇒ core 用网关 key,即使这只模型的
- * `baseUrl` 指向别家。为什么**不**在本批把它改成 fail-closed(逐条,而不是"先不管"):
- *  ① **与主推理链同语义**才是当前的正确性基准 —— 任务面(core 每次调 `getApiKeyAndHeaders`,返回
- *     `undefined` 即网关 key)在**同一个** catalog、**同一批**模型上就是这个姿势。只把 side-query 收严,
- *     等于让同一只模型「跑任务能用、问一句就 401」,而任务面才是量大的那一面 —— 半边收严的覆盖比
- *     统一的宽松更难排障。
- *  ② **谁被伤到**:`baseUrl` 是**运维**在 config-center 里自己写的(不是用户输入,用户只能在
- *     `atModelAllowlist` 里点名单内的模型)。"同一账号多网关主机/多区域"是既有且正当的部署形,
- *     它今天靠网关 key 工作;无版本协商地收严 = 这类部署当场 401,而且没有旋钮可回退。
- *  ③ hook 面(`hooks/hook-llm.ts`)确实是 fail-closed 的,但它的辖域是 **hook roster**(运维给钩子挑的
- *     模型),不是用户可点的整本目录;两者的收严代价不同量级。
- * ⇒ 本批**不改行为**,把它作为**跨面语义问题**上报(要收严就三面一起收严、带旋钮、走表态制),
- *   而不是在这一面偷偷收严。真要收严时的正解:按 `normUrl` 比对 `gatewayBaseUrl`(+fallback 列表)
- *   与 anthropic 路由,off-route ∧ 无 per-model key ⇒ 拒发,并同批改任务面。
+ * 曾经的具名残余是「无 per-model key 的 **off-route** 模型仍收网关 key」(codex R1-F1):座位回
+ * `undefined` ⇒ core 用网关 key,而选路仍按 `model.baseUrl` ⇒ 这一次调用真把共享网关凭据发给了别家
+ * 主机。当年**刻意不在本面收严**,理由是「与主推理链逐字同语义,单面收严 = 同一只模型跑任务能用、
+ * 问一句 401」,收严件挂在跨面件 #309;补偿是一条 `P-DEBT` 计数(census 第 32 行)。
+ *
+ * core 5.57.0 把这件事**在唯一正确的层**做了:`adjudicateModelRoute`(`brain/route-adjudicator.ts`)
+ * 是配对法的单一实现,三只一方 brain(openai / anthropic / open-responses)在 `buildRequest` 里逐次
+ * 复判 —— 部署声明了 `config.baseUrl` 而 entry URL 不在那个根上、凭据又只有部署级那一份 ⇒
+ * `route.credential_mismatch` 响亮拒;连部署级凭据都没有 ⇒ `route.credential_missing`。**三面同批**
+ * (主推理链 / side-query / WebFetch 摘要走的是同一只 brain 栈),旋钮 = 给模型自己的凭据、或不声明
+ * `config.baseUrl`(core 的 `"unpinned"` 快速起步姿态)。⇒ #309 要的「三面同批 + 旋钮」由上游一次交齐。
+ *
+ * 于是本席的 `isOffRouteBaseUrl` + `recordFailOpen("server.model-key.off-route-model-uses-gateway-key")`
+ * 两件**一并撤线**:那条计数的语义是「这一次调用真把网关凭据发给了别家」,而在 5.57 上那次调用根本
+ * 发不出去(core 在 brain 的 request gate 上先拒)—— 留着它只会在遥测里记一条与事实相反的债。
+ * 撤线同批:`docs/FAIL-OPEN-CENSUS.md` 第 32 行改终态、`observability/fail-open.ts` 销 tag。
+ * 新语义的钉在 `test/side-query-key-plane.test.ts`(off-root 拒格 + 同根回落格)。
  */
 import { type Brain, type SideQueryResult, type SideQuerySpec } from "@sema-agent/core";
 import type { ServiceConfig } from "../config-types.js";
@@ -63,18 +66,6 @@ export type KeyResolver = ((model: ModelKeyRef) => Promise<{
 export type PerModelAuthSeat = NonNullable<SideQuerySpec["getApiKeyAndHeaders"]>;
 /** side-query 执行席:HTTP 路由(`routes/side-query.ts`)唯一的 brain 出口。 */
 export type SideQueryLane = (spec: SideQuerySpec) => Promise<SideQueryResult>;
-/**
- * 「这只模型的 baseUrl 打的是**别家**主机吗」—— core 的选路规则是 `model.baseUrl || config.baseUrl`,
- * 所以只有 `model.baseUrl` 非空时才可能离开本部署网关。比较按 URL 归一(`new URL` 小写 host、丢默认端口、
- * 去尾斜杠),裸字符串比会在 host 大小写/默认端口写法上假阴。
- *
- * 参照系缺席(`gatewayBaseUrl` 未给)⇒ 回 `false`:判不了就不判,别猜。
- *
- * ⚠️ `hooks/hook-llm.ts` 有一只逐字同形的内联归一器(它用同一判据做 **fail-closed 拒发**,本函数只
- * 做**计数**)。两处合一属跨面收严件 #309 的射程(那时三面同批换判据),本批刻意不动 hook 面的 fail-closed
- * 门 —— 在只改可观测性的批里重写另一条安全轴的门,风险与收益不对等。
- */
-export declare function isOffRouteBaseUrl(modelBaseUrl: string | undefined, gatewayBaseUrl: string | undefined): boolean;
 export interface SideQueryLaneCtx {
     /** 与 `RunnerDeps.brain` **同一只**实例(#341 换装后本席不再包它 —— key 走 spec 座位)。 */
     brain: Brain;
@@ -95,19 +86,15 @@ export interface SideQueryLaneCtx {
  *  · resolver 抛(sealed key 中毒)⇒ **上抛**,`runSideQuery` 的 `await` 直接把它扔给调用方,
  *    本次调用整体失败,一个字节都不发。
  *
- * 🔴 A-057.59 [PARTIAL high](2026-08-19;#341 换装后**处置不变**)—— 「无 per-model key 的 off-route
- * 模型仍收网关 key」这条具名残余**行为不变**(逐条理由见模块顶注「具名残余」段;core 的座位是
- * 「absent ⇒ construction-time credentials apply」,与主推理链
- * `dist/engine/harness/agent-harness.js` 的 `auth?.apiKey !== undefined` 臂逐字同语义,座位到货并没有
- * 改变这条残余,所以 `P-DEBT` 计数**不可销**),但**每次调用零留痕**这一半是要清偿的存量欠账:
- * config-apply 期那条 `sema_registry_model_key_env_missing` warn 只覆盖「声明了 env 名却没设」,覆盖不到
- * 「压根没配 per-model key 的 off-route 模型」,而后者才是真发生外泄的那一形。按 CLAUDE.md #157
- * 「一时改不动的 P 类记 `P-DEBT`」补计数:命中条件 = **解不出 per-model key ∧ 该模型的 baseUrl 不是本
- * 部署网关** ⇒ 这一次调用真把网关凭据发给了别家主机。`gatewayBaseUrl` 缺席(调用方没给参照系)⇒ 不计
- * (不猜),与「宁可漏计不可错计」同向。
+ * 🔴 A-057.59 [PARTIAL high](2026-08-19 立;**2026-08-24 / core 5.57.0 源头清偿,本席腿撤线**)——
+ * 「无 per-model key 的 off-route 模型仍收网关 key」这条具名残余的收严件曾挂在跨面件 #309,补偿是一条
+ * `P-DEBT` 计数。core 5.57.0 的 `adjudicateModelRoute` 在**三只一方 brain 的 request gate** 上把它改成
+ * 响亮拒(`route.credential_mismatch` / `route.credential_missing`),三面同批、旋钮成文 ⇒ 那条计数的
+ * 前提(「这一次调用真把网关凭据发给了别家」)不再成立,`isOffRouteBaseUrl` 与 `recordFailOpen` 一并
+ * 撤线(逐条理由见模块顶注)。本座位从此**只做一件事**:按模型解 per-model 凭据,解不出就交回
+ * `undefined` 让 core 按它自己的配对法判。
  */
 export declare function createPerModelAuthSeat(getKeyResolver: () => KeyResolver, opts?: {
-    readonly gatewayBaseUrl?: string;
     readonly upstream?: SideQuerySpec["getApiKeyAndHeaders"];
 }): PerModelAuthSeat;
 /**
@@ -124,21 +111,19 @@ export declare function createPerModelAuthSeat(getKeyResolver: () => KeyResolver
  * `complete` 在场时同样包一层:core 的 `Brain.complete` 是 compaction/摘要腿的直调口(WebFetch 摘要器
  * 正是**优先**走它),漏包等于给同一个病留第二条路。
  */
-export declare function createPerModelKeyBrain(brain: Brain, getKeyResolver: () => KeyResolver, opts?: {
-    readonly gatewayBaseUrl?: string;
-}): Brain;
+export declare function createPerModelKeyBrain(brain: Brain, getKeyResolver: () => KeyResolver): Brain;
 /**
  * 装配 side-query 执行席 = 真 `runSideQuery` + core 的 per-model auth 座,models/roles 与 Runner 同源。
  *
- * **按调用**取三件活值(`models` / `getKeyResolver` / `gatewayBaseUrl`),因为它们是**同一次** center
- * 下发里成对换代的(#303 codex R1-F2:目录与密钥表零 await 窗成对换代):
+ * **按调用**取两件活值(`models` / `getKeyResolver`),因为它们是**同一次** center 下发里成对换代的
+ * (#303 codex R1-F2:目录与密钥表零 await 窗成对换代):
  *  · `models` = `expandTiers(config.models, config.tiers)` —— 档位词 / CC 别名(`flash`/`opus`/…)在
  *    side-query 上照常可选路(core 的 `Runner` 构造时做同一件事),且 `Runner` 那次展开是**构造时快照**,
  *    而本路由的模型白名单门(`routes/side-query.ts` 的 `isModelAllowlisted`)按请求现算同一张增广目录 ——
  *    两边取同一份才不会出现「名单放行、选路说不认识」的分歧;
- *  · `getKeyResolver()` —— 热应用整个换 resolver 引用,活取才跟得上(装配时快照 = 旧 key 用到重启);
- *  · `config.gatewayBaseUrl` —— off-route 判据的参照系。装配时快照会让「换网关那一刻起,这次调用把网关
- *    凭据发给了别家」在遥测里永久失明(钉:`test/side-query-key-plane.test.ts` 的活取钉)。
+ *  · `getKeyResolver()` —— 热应用整个换 resolver 引用,活取才跟得上(装配时快照 = 旧 key 用到重启)。
+ * (第三件 `config.gatewayBaseUrl` 曾是 off-route 记债判据的参照系,core 5.57.0 起判据整只上收 core 的
+ *  配对裁决器 —— 而 core 拿的是 brain 构造时那份 `config.baseUrl`,与本席无关,见顶注撤线段。)
  *
  * `spec` 自带的 `getApiKeyAndHeaders`(嵌入方/装饰器)**不被覆盖** —— 它作为 `upstream` 折进本席,
  * 每次调用先问它,它没意见时才由本席按模型解(见 `createPerModelAuthSeat` 顶注第一条臂)。

package/dist/boot/side-query-lane.js

@@ -1,26 +1,15 @@
 import { expandTiers, runSideQuery } from "@sema-agent/core";
-import { recordFailOpen } from "../observability/fail-open.js";
-export function isOffRouteBaseUrl(modelBaseUrl, gatewayBaseUrl) {
-    if (!modelBaseUrl || !gatewayBaseUrl)
-        return false;
-    const norm = (u) => URL.canParse(u) ? ((x) => `${x.protocol}//${x.host}${x.pathname.replace(/\/+$/, "")}`)(new URL(u)) : u.replace(/\/+$/, "");
-    return norm(modelBaseUrl) !== norm(gatewayBaseUrl);
-}
 export function createPerModelAuthSeat(getKeyResolver, opts = {}) {
     return async (model) => {
         const resolve = getKeyResolver();
         const given = await opts.upstream?.(model);
         if (given?.apiKey !== undefined)
             return given;
-        const resolved = resolve ? await resolve({ name: model.name }) : undefined;
-        if (resolved === undefined && isOffRouteBaseUrl(model.baseUrl, opts.gatewayBaseUrl)) {
-            recordFailOpen("server.model-key.off-route-model-uses-gateway-key", model.name);
-        }
-        return resolved;
+        return resolve ? await resolve({ name: model.name }) : undefined;
     };
 }
-export function createPerModelKeyBrain(brain, getKeyResolver, opts = {}) {
-    const seat = createPerModelAuthSeat(getKeyResolver, opts);
+export function createPerModelKeyBrain(brain, getKeyResolver) {
+    const seat = createPerModelAuthSeat(getKeyResolver);
     const keyFor = async (model, given) => {
         if (given !== undefined)
             return given;
@@ -47,7 +36,6 @@ export function createSideQueryLane(ctx) {
     return (spec) => runSideQuery({
         ...spec,
         getApiKeyAndHeaders: createPerModelAuthSeat(ctx.getKeyResolver, {
-            ...(ctx.config.gatewayBaseUrl !== undefined ? { gatewayBaseUrl: ctx.config.gatewayBaseUrl } : {}),
             ...(spec.getApiKeyAndHeaders !== undefined ? { upstream: spec.getApiKeyAndHeaders } : {}),
         }),
     }, {

package/dist/boot/webfetch-summarize-lane.d.ts

@@ -23,8 +23,9 @@
  *
  * brain 换成 `createPerModelKeyBrain(brain, getKeyResolver)`:
  *  · 有 per-model key ⇒ 注入 `options.apiKey`,请求带模型自己的凭据;
- *  · 无 ⇒ 不注入 ⇒ 回落网关 key(与主推理链/side-query 逐字同语义,additive 契约;该残余的成文与
- *    跨面收严件见 side-query-lane.ts 顶注「具名残余」段与 A-057.59);
+ *  · 无 ⇒ 不注入 ⇒ 交回 core 按它自己的 key↔URL 配对法判(core 5.57.0 起:部署根声明了而 entry URL
+ *    不在那个根上 ⇒ `route.credential_mismatch` 响亮拒;未声明部署根 = `"unpinned"` 快速起步姿态 ⇒
+ *    照旧回落网关 key。A-057.59 的具名残余与其 P-DEBT 腿已在源头清偿,见 side-query-lane.ts 顶注);
  *  · 毒丸 ⇒ **上抛**,一个字节都不发(CLAUDE.md #157 安全轴 fail-closed)。
  * wrapper 只包本席这一只引用,`RunnerDeps.brain` 零扰动(与 side-query 席同形)。
  *

package/dist/boot/webfetch-summarize-lane.js

@@ -1,7 +1,7 @@
 import { createWebFetchSummarizer, resolveTaskModel as coreResolveTaskModel } from "@sema-agent/core";
 import { createPerModelKeyBrain } from "./side-query-lane.js";
 export function createWebFetchSummarizeLane(ctx) {
-    const brain = createPerModelKeyBrain(ctx.brain, ctx.getKeyResolver, { gatewayBaseUrl: ctx.config.gatewayBaseUrl });
+    const brain = createPerModelKeyBrain(ctx.brain, ctx.getKeyResolver);
     return async (content, prompt, signal) => {
         const model = (() => {
             try {

package/dist/brain.js

@@ -1,5 +1,16 @@
 import { createAnthropicBrain, createCircuitBreakerBrain, createDegradingBrain, createFailoverBrain, createOpenAIBrain, createRoutingBrain, } from "@sema-agent/core";
+import { normalizeBaseUrl } from "@sema-agent/core";
 import { resolveModelApiKey } from "./key-resolver.js";
+import { isSealedKeyPoison } from "./sealed-key.js";
+import { recordFailOpen } from "./observability/fail-open.js";
+function isOffDeploymentRoot(baseUrl, config) {
+    if (!baseUrl)
+        return false;
+    const entry = normalizeBaseUrl(baseUrl);
+    if (entry === "")
+        return false;
+    return ![config.gatewayBaseUrl, ...config.gatewayFallbackUrls].some((u) => normalizeBaseUrl(u) === entry);
+}
 export const FAST_FAIL_MAX_RETRIES = 2;
 const DEFAULT_RESILIENCE = {
     connectTimeoutMs: 30_000,
@@ -70,6 +81,15 @@ export function createBrain(config, deps = {}) {
                     resolveModelApiKey(degradeTo, config.modelApiKeyEnv ?? {}, process.env, config.modelApiKeys ?? {});
                 return own ?? config.gatewayApiKey;
             };
+            const hopBorrowsGatewayKey = () => {
+                const keys = config.modelApiKeys ?? {};
+                if (isSealedKeyPoison(keys[fallbackModel.name]) || isSealedKeyPoison(keys[degradeTo]))
+                    return false;
+                const own = resolveModelApiKey(fallbackModel.name, config.modelApiKeyEnv ?? {}, process.env, keys) ??
+                    resolveModelApiKey(degradeTo, config.modelApiKeyEnv ?? {}, process.env, keys);
+                return own === undefined && config.gatewayApiKey !== undefined && isOffDeploymentRoot(fallbackModel.baseUrl, config);
+            };
+            const anthropicLaneHop = fallbackModel.provider === "anthropic" && anthropicBrain !== undefined;
             const fallback = fallbackModel.provider === "anthropic" && anthropicBrain
                 ?
                     anthropicBrain
@@ -82,7 +102,18 @@ export function createBrain(config, deps = {}) {
                     fetchImpl,
                     ...timeouts,
                 });
-            brain = createDegradingBrain({ primary: brain, fallbacks: [{ brain: fallback, model: fallbackModel }], downgradeOn: config.degrade.downgradeOn });
+            const fallbackWithDebtProbe = anthropicLaneHop
+                ? fallback
+                : {
+                    stream: (m, c, o) => {
+                        if (hopBorrowsGatewayKey())
+                            recordFailOpen("server.model-key.degrade-hop-borrows-gateway-key", fallbackModel.name);
+                        return fallback.stream(m, c, o);
+                    },
+                    ...(fallback.adjudicateRoute !== undefined ? { adjudicateRoute: (m, a) => fallback.adjudicateRoute?.(m, a) } : {}),
+                    ...(fallback.complete !== undefined ? { complete: (m, c, o) => fallback.complete(m, c, o) } : {}),
+                };
+            brain = createDegradingBrain({ primary: brain, fallbacks: [{ brain: fallbackWithDebtProbe, model: fallbackModel }], downgradeOn: config.degrade.downgradeOn });
         }
     }
     return brain;

package/dist/config-center/apply-effective.js

@@ -85,7 +85,8 @@ export function applyEffective(config, eff, logger, opts = {}) {
     const staged = stageEffective(config, eff, logger, opts);
     const gen = opts.generation ?? staged.version;
     const live = appliedGeneration.get(config);
-    if (staged.version > 0 && live !== undefined && gen < live) {
+    const ordered = opts.generation !== undefined || staged.version > 0;
+    if (ordered && live !== undefined && gen < live) {
         logger?.warn("sema_registry_stale_generation_refused", { staged: staged.version, stagedOrdinal: gen, live, note: "an older staged generation must not overwrite a newer committed one — refused whole; next poll replays" });
         return false;
     }
@@ -103,7 +104,7 @@ export function applyEffective(config, eff, logger, opts = {}) {
         }
     }
     commitStaged(config, staged);
-    if (staged.version > 0)
+    if (ordered)
         appliedGeneration.set(config, gen);
     opts.report?.({
         version: staged.version,