@sema-agent/server 7.99.0 → 7.101.0

package/dist/boot/config-center.js

@@ -18,10 +18,18 @@ import { createConfigProvider, raceBootFetch, BOOT_FETCH_DEFERRED } from "../con
 import { executionLaneCaps, executionLaneOf } from "../execution-lane-caps.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
-import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, planeHasActiveTiers, fetchPromptArtifact } from "../config-center/facade.js";
+import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, buildEnvOnlyModelPlane, fetchPromptArtifact } from "../config-center/facade.js";
 import { createMcpRevocationLedger, enabledMcpEntries } from "../config-center/mcp-revocation.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
-import { createConfigApplyLedger } from "../config-center/apply-ledger.js";
+import { createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../config-center/apply-ledger.js";
+function lkgReadNote(scope) {
+    switch (scope) {
+        case "whole":
+            return "booting from the persisted last-known-good (all restart-to-apply faces included) — the live pull continues in the background and reconciles on arrival";
+        case "model-plane":
+            return "the live candidate's model plane was refused at boot — the persisted last-known-good supplies the model plane only (catalog and the collab templates that reference it); every other group and every restart-to-apply face stays the live candidate's";
+    }
+}
 export async function createConfigCenterRuntime(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
     let ccEtag;
@@ -114,6 +122,18 @@ export async function createConfigCenterRuntime(ctx) {
         : undefined;
     const rosterGateArmed = isRosterGateArmed(cc);
     const modelReadyState = { ready: !rosterGateArmed };
+    const warnDroppedEntries = (r, phase) => {
+        for (const d of r.droppedEntries ?? []) {
+            logger.warn("config_entry_dropped", {
+                domain: d.domain,
+                entry: d.entry,
+                error: d.error,
+                version: r.effective.version,
+                phase,
+                note: "this one entry failed its domain schema and was dropped on its own — the rest of the candidate applies (per-entry tolerance); fix the named entry to bring it back",
+            });
+        }
+    };
     const markRosterLanded = (eff) => {
         if (!modelReadyState.ready && (eff.models?.models ?? []).some((m) => m.enabled !== false)) {
             modelReadyState.ready = true;
@@ -312,7 +332,7 @@ export async function createConfigCenterRuntime(ctx) {
     };
     if (configProvider) {
         const dryRun = cc?.dryRun ?? false;
-        const bootFromLkg = async (why) => {
+        const bootFromLkg = async (why, scope) => {
             if (!lkgEnabled || dryRun)
                 return null;
             const identity = currentIdentity();
@@ -344,7 +364,7 @@ export async function createConfigCenterRuntime(ctx) {
                 logger.warn("config_lkg_unusable", { path: lkgPath, reason: "center credential identity changed while the LKG was being read — not used", note: "env fallback serves; the current identity's next pull re-establishes its own LKG" });
                 return null;
             }
-            logger.info("config_loaded_lkg", { path: lkgPath, savedAt: read.lkg.savedAt, why, note: "booting from the persisted last-known-good (all restart-to-apply faces included) — the live pull continues in the background and reconciles on arrival" });
+            logger.info("config_loaded_lkg", { path: lkgPath, savedAt: read.lkg.savedAt, why, scope, note: lkgReadNote(scope) });
             const lkgEffective = read.lkg.effective;
             candidateIdentity.set(lkgEffective, identity);
             bindValidator(read.lkg.etag, identity);
@@ -353,18 +373,31 @@ export async function createConfigCenterRuntime(ctx) {
         const bootApplyLkgInline = async (lkgR) => {
             const lkgGen = generationOf(lkgR.effective.version);
             applyLedger.seenTarget(lkgGen, lkgR.effective.version);
-            applyEffective(config, lkgR.effective, logger, { sealedKeys, generation: lkgGen, report: (rep) => applyLedger.recordApply(rep) });
+            let lkgReport;
+            applyEffective(config, lkgR.effective, logger, {
+                leg: "boot",
+                sealedKeys,
+                generation: lkgGen,
+                report: (rep) => {
+                    lkgReport = rep;
+                    applyLedger.recordApply(rep);
+                },
+            });
             applyLedger.applied(lkgGen, lkgR.effective.version);
             await adoptCenterPrompts(lkgR.effective, "boot-lkg");
-            markRosterLanded(lkgR.effective);
+            const lkgPlane = modelPlaneCommitted(lkgReport);
+            if (lkgPlane)
+                markRosterLanded(lkgR.effective);
             effective = lkgR.effective;
-            appliedPlaneEff = lkgR.effective;
+            if (lkgPlane)
+                appliedPlaneEff = lkgR.effective;
             latestEffective = lkgR.effective;
             if (lkgR.etag !== undefined)
                 ccEtag = lkgR.etag;
             const cfgModels = (lkgR.effective.models?.models ?? []).filter((m) => m.enabled !== false).length;
             logger.info("config_loaded", { source: "lkg", version: lkgR.effective.version, worker: cc?.worker ?? "(global)", models: cfgModels });
         };
+        let bootApplyPhase = false;
         try {
             const bootFetch = pullEffective(configProvider, undefined);
             const raced = await raceBootFetch(bootFetch, config.configBootFetchBudgetMs);
@@ -372,7 +405,7 @@ export async function createConfigCenterRuntime(ctx) {
             if (raced === BOOT_FETCH_DEFERRED) {
                 bootConfigPending = bootFetch;
                 bootFetch.catch(() => { });
-                lkgFallback = await bootFromLkg("boot fetch deferred (budget exceeded)");
+                lkgFallback = await bootFromLkg("boot fetch deferred (budget exceeded)", "whole");
                 lkgBooted = lkgFallback !== null;
                 logger.warn("config_boot_fetch_deferred", {
                     source: configProvider.kind,
@@ -394,11 +427,13 @@ export async function createConfigCenterRuntime(ctx) {
             }
             const r = raced === BOOT_FETCH_DEFERRED ? null : raced;
             if (r) {
+                bootApplyPhase = true;
                 const bootPromptsRaw = r.effective.prompts;
                 const bootPromptsOk = bootPromptsRaw === undefined || validatePromptsDomain(bootPromptsRaw).ok;
                 let bootClean = (r.domainErrors ?? []).length === 0 && bootPromptsOk;
                 for (const de of r.domainErrors ?? [])
                     logger.warn("config_domain_invalid", { domain: de.domain, error: de.error, note: "tolerated at BOOT (corrupt file → schema defaults; dangling ref → reported as-is); the refresh path rejects such a candidate whole and keeps the LKG (§9.5-5)" });
+                warnDroppedEntries(r, "boot");
                 if (dryRun) {
                     logEffectiveDiff(config, r.effective, logger);
                     if (bootClean)
@@ -409,6 +444,7 @@ export async function createConfigCenterRuntime(ctx) {
                     applyLedger.seenTarget(bootGen, r.effective.version);
                     let bootReport;
                     applyEffective(config, r.effective, logger, {
+                        leg: "boot",
                         sealedKeys,
                         generation: bootGen,
                         report: (rep) => {
@@ -422,9 +458,23 @@ export async function createConfigCenterRuntime(ctx) {
                     if (bootClean)
                         ccEtag = r.etag;
                     await adoptCenterPrompts(r.effective, "boot");
-                    markRosterLanded(r.effective);
-                    effective = r.effective;
-                    appliedPlaneEff = r.effective;
+                    let bootPlaneEff = modelPlaneCommitted(bootReport) ? r.effective : undefined;
+                    if (bootPlaneEff === undefined) {
+                        const lkgPlane = await bootFromLkg("boot candidate's model plane was refused", "model-plane");
+                        if (lkgPlane) {
+                            let planeReport;
+                            applyEffective(config, withModelPlaneOf(r.effective, lkgPlane.effective), logger, { leg: "boot", sealedKeys, generation: bootGen, report: (rep) => (planeReport = rep) });
+                            if (modelPlaneCommitted(planeReport)) {
+                                bootPlaneEff = lkgPlane.effective;
+                                logger.warn("config_model_plane_from_lkg", { version: r.effective.version, lkgVersion: lkgPlane.effective.version, note: "the live candidate's model plane was refused at boot — serving the LKG's model plane (catalog and the collab templates that reference it) with the live candidate's other groups; the refresh cadence re-judges the candidate" });
+                            }
+                        }
+                    }
+                    if (bootPlaneEff !== undefined)
+                        markRosterLanded(bootPlaneEff);
+                    effective = bootPlaneEff === r.effective ? r.effective : withModelPlaneOf(r.effective, bootPlaneEff ?? buildEnvOnlyModelPlane());
+                    if (bootPlaneEff !== undefined)
+                        appliedPlaneEff = bootPlaneEff;
                     if (bootClean)
                         latestEffective = r.effective;
                     if (bootClean && !lkgBooted)
@@ -434,23 +484,30 @@ export async function createConfigCenterRuntime(ctx) {
                     logger.info("config_loaded", { source: configProvider.kind, version: r.effective.version, worker: cc?.worker ?? "(global)", models: cfgModels, ...cfgDir });
                     if (configProvider.kind === "local" && cfgModels === 0) {
                         const modelsDomainErr = (r.domainErrors ?? []).find((de) => de.domain === "models");
+                        const modelsDropped = (r.droppedEntries ?? []).filter((d) => d.domain === "models");
                         const totalModels = (r.effective.models?.models ?? []).length;
                         logger.warn("config_local_no_models", {
                             ...cfgDir,
                             ...(modelsDomainErr ? { domainError: modelsDomainErr.error } : {}),
+                            ...(modelsDropped.length > 0 ? { droppedEntries: modelsDropped.map((d) => d.entry) } : {}),
                             hint: modelsDomainErr
                                 ? "config.d/models.json 在场但 models 域判形失败落 default(真因见本行 domainError)— 模型继续走 env 兜底"
-                                : totalModels > 0
-                                    ? `config.d/models.json 有 ${totalModels} 条模型但全部 enabled:false — 模型继续走 env 兜底`
-                                    : "config.d/models.json 空或 CONFIG_LOCAL_DIR 指错目录(选目录旋钮是 CONFIG_LOCAL_DIR,不是 LOCAL_DATA_ROOT)— 模型继续走 env 兜底",
+                                : modelsDropped.length > 0 && totalModels === 0
+                                    ? "config.d/models.json 的条目全部被逐条丢弃(逐条真因见 config_entry_dropped)— 模型继续走 env 兜底"
+                                    : totalModels > 0
+                                        ? `config.d/models.json 有 ${totalModels} 条模型但全部 enabled:false — 模型继续走 env 兜底`
+                                        : "config.d/models.json 空或 CONFIG_LOCAL_DIR 指错目录(选目录旋钮是 CONFIG_LOCAL_DIR,不是 LOCAL_DATA_ROOT)— 模型继续走 env 兜底",
                         });
                     }
                 }
             }
         }
         catch (err) {
-            logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
-            const lkgFallback = await bootFromLkg(`boot fetch failed: ${String(err).slice(0, 120)}`);
+            if (bootApplyPhase)
+                logger.warn("config_apply_refused", { source: configProvider.kind, err: String(err), note: "the pulled candidate failed to apply at boot — falling back to the LKG / env; this is not a reachability failure" });
+            else
+                logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
+            const lkgFallback = await bootFromLkg(`${bootApplyPhase ? "boot apply refused" : "boot fetch failed"}: ${String(err).slice(0, 120)}`, "whole");
             if (lkgFallback) {
                 lkgBooted = true;
                 try {
@@ -474,8 +531,10 @@ export async function createConfigCenterRuntime(ctx) {
     let keyResolver;
     const mcpRevocations = createMcpRevocationLedger((ev) => logger.info("mcp_revocation_ledger", { ...(ev.revoked.length > 0 ? { revoked: ev.revoked } : {}), ...(ev.restored.length > 0 ? { restored: ev.restored } : {}) }));
     let mcpRevocationWired = false;
-    const restartCtx = () => ({
+    const restartCtx = (consolidationSeat) => ({
         ...(config.degrade?.reactive ? { reactiveDegradeTo: config.degrade.to } : {}),
+        pluginsAllowHosts: config.pluginsAllowHosts,
+        ...(consolidationSeat !== undefined ? { consolidationSeat } : {}),
         ...(readFaceEnvHeld.length > 0 ? { readFaceEnvHeld } : {}),
         ...(mcpRevocationWired && mcpRevocations.hasBaseline() ? { mcpRevocationLive: true } : {}),
     });
@@ -485,10 +544,6 @@ export async function createConfigCenterRuntime(ctx) {
         const { faceChanged } = applyCenterReadFace(config, eff, logger, { phase: "live", baseline: readFaceBaseline });
         if (!faceChanged)
             return;
-        if (swap === undefined) {
-            logger.warn("read_face_swap_unwired", { face: config.readFace ?? null, phase, note: "the center's read FACE changed but no Runner swap door was wired — the value landed in config while the engine keeps the seat it booted with" });
-            return;
-        }
         try {
             swap({ readFace: config.readFace });
             logger.info("read_face_swapped", { from: before ?? null, to: config.readFace ?? null, phase, note: "hot seat (core swapDeps) — legs that already prepared keep the face they prepared under" });
@@ -644,7 +699,7 @@ export async function createConfigCenterRuntime(ctx) {
             }
         },
         startRefreshLoop(a) {
-            const { runnerTierFrozen, pricing, limitSync, swapRunnerDeps, ceilingVerdict } = a;
+            const { pricing, limitSync, swapRunnerDeps, ceilingVerdict, consolidationSeat, checkpointStorePresent } = a;
             if (configProvider) {
                 const ccRef = config.configCenter;
                 let refreshInFlight = false;
@@ -662,14 +717,14 @@ export async function createConfigCenterRuntime(ctx) {
                         if (r === null && planeDeferredNoHandoff) {
                             const skillsDebt = (planeDeferredNoHandoff.blocked ?? []).includes("skills");
                             const promoted = lkgSurvivesRestart || skillsDebt ? await persistLkgDurable(planeDeferredNoHandoff.candidate, planeDeferredNoHandoff.candidateEtag) : false;
-                            const skillsProofPromotion = !promoted && !lkgSurvivesRestart && skillsDebt && lastPrewarmBodiesVerified && planeDeferredNoHandoff.planeDeferred !== true;
+                            const skillsProofPromotion = !promoted && !lkgSurvivesRestart && skillsDebt && lastPrewarmBodiesVerified;
                             if (skillsProofPromotion) {
                                 pendingRestart = { restartRequired: true, reasons: ["skills"], version: planeDeferredNoHandoff.version, since: Date.now() };
                                 logger.info("config_boot_skill_debt_promoted", { version: planeDeferredNoHandoff.version, note: "skill bodies verified on a source-confirmed-current candidate — the withheld skills restart is now published (non-durable lane, repair proven)" });
                                 planeDeferredNoHandoff = undefined;
                             }
                             else if (promoted) {
-                                const promotedReasons = [...new Set([...(planeDeferredNoHandoff.blocked ?? []), ...(planeDeferredNoHandoff.planeDeferred ? ["models-tiers"] : [])])];
+                                const promotedReasons = [...new Set(planeDeferredNoHandoff.blocked ?? [])];
                                 if (promotedReasons.length > 0) {
                                     pendingRestart = { restartRequired: true, reasons: promotedReasons, version: planeDeferredNoHandoff.version, since: Date.now() };
                                 }
@@ -697,6 +752,7 @@ export async function createConfigCenterRuntime(ctx) {
                                             ...(r.domainErrors ?? []).map((de) => ({ domain: de.domain, error: de.error })),
                                             ...(promptsGate.ok ? [] : [{ domain: "prompts", error: promptsGate.error }]),
                                         ],
+                                        ...(r.droppedEntries !== undefined ? { droppedEntries: r.droppedEntries } : {}),
                                         lkgVersion: latestEffective?.version ?? "(env)",
                                         note: "candidate rejected whole (§9.5-5) — live config keeps the last-known-good; fix the named files to unblock",
                                     });
@@ -704,24 +760,24 @@ export async function createConfigCenterRuntime(ctx) {
                                 return "ok";
                             }
                             lastRejectedCandidate = undefined;
+                            warnDroppedEntries(r, "refresh");
                             if (ccRef?.dryRun) {
                                 logEffectiveDiff(config, r.effective, logger);
                                 ccEtag = r.etag;
                             }
                             else {
                                 const planeChanged = modelPlaneChanged(appliedPlaneEff, r.effective);
-                                const planeDeferred = swapRunnerDeps === undefined && (runnerTierFrozen || planeHasActiveTiers(r.effective)) && planeChanged;
                                 let applyReport;
                                 const committed = applyEffective(config, r.effective, logger, {
-                                    teamsOnly: true,
+                                    leg: "hot",
+                                    checkpointStorePresent,
                                     sealedKeys,
                                     generation: tickGen,
                                     report: (rep) => {
                                         applyReport = rep;
                                         applyLedger.recordApply(rep);
                                     },
-                                    ...(planeDeferred ? { deferModelPlane: true } : {}),
-                                    ...(swapRunnerDeps !== undefined && planeChanged ? { swapPlane: swapRunnerDeps } : {}),
+                                    ...(planeChanged ? { swapPlane: swapRunnerDeps } : {}),
                                 });
                                 if (!committed)
                                     return "ok";
@@ -732,57 +788,40 @@ export async function createConfigCenterRuntime(ctx) {
                                 mcpRevocations.applyEnabledEntries(enabledMcpEntries(r.effective.mcp));
                                 applyLiveReadFace(r.effective, swapRunnerDeps, "refresh");
                                 applyLedger.applied(tickGen, r.effective.version);
-                                if (planeDeferred) {
-                                    logger.warn("models_tiers_plane_deferred", { version: r.effective.version, note: "tier-frozen Runner: the changed model plane (models/roles/tiers/default) is NOT hot-applied — admission stays on the Runner's generation; restart applies the new plane (models-tiers restart signal rides /health)" });
-                                }
-                                else {
+                                const tickPlane = modelPlaneCommitted(applyReport);
+                                if (tickPlane)
                                     appliedPlaneEff = r.effective;
-                                    planeDeferredNoHandoff = undefined;
-                                }
+                                planeDeferredNoHandoff = undefined;
                                 await adoptCenterPrompts(r.effective, "refresh");
-                                if (!planeDeferred)
+                                if (tickPlane)
                                     markRosterLanded(r.effective);
                                 const fullyApplied = applyReport?.fullyApplied !== false;
                                 if (!fullyApplied) {
+                                    ccEtag = undefined;
+                                    const refused = applyReport ? refusedGroups(applyReport) : [];
                                     logger.warn("config_candidate_partially_applied", {
                                         version: r.effective.version,
-                                        rejected: applyReport?.limits.rejected?.keys ?? [],
+                                        rejected: refused.flatMap((g) => g.keys),
+                                        groups: refused.map((g) => g.group),
                                         note: "a group of this candidate was refused — the live config keeps serving the prior values for it; the LKG and the ETag stay on the last FULLY applied generation (this tree is re-judged next tick)",
                                     });
                                     return "ok";
                                 }
                                 const lkgPersisted = await persistLkgDurable(r.effective, r.etag);
-                                const reasons = restartReasons(effective, r.effective, restartCtx());
-                                if (swapRunnerDeps !== undefined) {
-                                    const mi = reasons.indexOf("models-tiers");
-                                    if (mi >= 0)
-                                        reasons.splice(mi, 1);
-                                }
+                                const reasons = restartReasons(effective, r.effective, restartCtx(consolidationSeat?.read()));
                                 const skillsChangeDetected = reasons.includes("skills");
                                 if (bootSkillStale && !skillsChangeDetected)
                                     reasons.push("skills");
-                                if (planeDeferred) {
-                                    if (lkgPersisted) {
-                                        if (!reasons.includes("models-tiers"))
-                                            reasons.push("models-tiers");
-                                        planeDeferredNoHandoff = undefined;
-                                    }
-                                    else {
-                                        const blocked = reasons.splice(0, reasons.length);
-                                        planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), ...(blocked.length > 0 ? { blocked } : {}), planeDeferred: true, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
-                                        logger.warn("models_tiers_deferred_no_handoff", { version: r.effective.version, blockedReasons: blocked, note: "plane deferred but no NEXT-BOOT handoff (LKG disabled/unwritable, or storage not declared restart-surviving — set CONFIG_LKG_DURABLE=true) — the WHOLE restart signal is withheld (it would loop); the old generation keeps serving" });
-                                    }
-                                }
-                                else if (lkgSurvivesRestart && !lkgPersisted) {
+                                if (lkgSurvivesRestart && !lkgPersisted) {
                                     const blocked = reasons.splice(0, reasons.length);
-                                    planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), blocked, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
+                                    planeDeferredNoHandoff = { version: r.effective.version, since: Date.now(), blocked, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
                                     logger.warn("restart_candidate_publication_incomplete", { version: r.effective.version, blockedReasons: blocked, note: "durable LKG declared but the candidate's publication is incomplete (skill bodies unverified) — restart signal withheld; retried every tick until the cache completes" });
                                 }
-                                else if (!planeDeferred && !lkgSurvivesRestart && bootSkillStale && !skillsChangeDetected && !lastPrewarmBodiesVerified) {
+                                else if (!lkgSurvivesRestart && bootSkillStale && !skillsChangeDetected && !lastPrewarmBodiesVerified) {
                                     const i = reasons.indexOf("skills");
                                     if (i >= 0) {
                                         reasons.splice(i, 1);
-                                        planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), blocked: ["skills"], candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
+                                        planeDeferredNoHandoff = { version: r.effective.version, since: Date.now(), blocked: ["skills"], candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
                                         logger.warn("config_boot_skill_debt_withheld", { version: r.effective.version, note: "boot skill debt still unproven on a non-durable deployment (body cache does not verify) — skills restart withheld this tick; re-verified each tick and published once the bodies prove fetchable" });
                                     }
                                 }
@@ -797,7 +836,7 @@ export async function createConfigCenterRuntime(ctx) {
                                 }
                                 logger.info("sema_registry_refreshed", {
                                     version: r.effective.version,
-                                    note: "collab + runtime governance + limits + models/roles/roster hot-applied; skills/mcp/runtime-gates(approvalRequire)/scenarios are restart-to-apply",
+                                    note: "collab + runtime governance (incl. approvalRequire) + limits + models/roles/roster hot-applied; skills/mcp/a2a/scenarios are restart-to-apply",
                                     ...(pendingRestart ? { restartRequired: true, restartReasons: pendingRestart.reasons } : {}),
                                 });
                                 latestEffective = r.effective;
@@ -848,28 +887,29 @@ export async function createConfigCenterRuntime(ctx) {
                         logger.warn("config_boot_deferred_candidate_rejected", {
                             version: r.effective.version,
                             errors: [...(r.domainErrors ?? []).map((de) => ({ domain: de.domain, error: de.error })), ...(promptsGate.ok ? [] : [{ domain: "prompts", error: promptsGate.error }])],
+                            ...(r.droppedEntries !== undefined ? { droppedEntries: r.droppedEntries } : {}),
                             note: "late boot pull carried an invalid candidate — env fallback keeps serving; the refresh cadence re-judges the same tree (etag not advanced)",
                         });
                         return;
                     }
+                    warnDroppedEntries(r, "boot-deferred");
                     if (ccRef?.dryRun) {
                         logEffectiveDiff(config, r.effective, logger);
                         ccEtag = r.etag;
                         return;
                     }
                     const planeChangedLate = modelPlaneChanged(appliedPlaneEff, r.effective);
-                    const planeDeferredLate = swapRunnerDeps === undefined && (runnerTierFrozen || planeHasActiveTiers(r.effective)) && planeChangedLate;
                     let applyReportLate;
                     const committedLate = applyEffective(config, r.effective, logger, {
-                        teamsOnly: true,
+                        leg: "hot",
+                        checkpointStorePresent,
                         sealedKeys,
                         generation: lateGen,
                         report: (rep) => {
                             applyReportLate = rep;
                             applyLedger.recordApply(rep);
                         },
-                        ...(planeDeferredLate ? { deferModelPlane: true } : {}),
-                        ...(swapRunnerDeps !== undefined && planeChangedLate ? { swapPlane: swapRunnerDeps } : {}),
+                        ...(planeChangedLate ? { swapPlane: swapRunnerDeps } : {}),
                     });
                     if (!committedLate)
                         return;
@@ -879,20 +919,21 @@ export async function createConfigCenterRuntime(ctx) {
                     ceilingVerdict?.judge();
                     applyLiveReadFace(r.effective, swapRunnerDeps, "boot-deferred");
                     applyLedger.applied(lateGen, r.effective.version);
-                    if (planeDeferredLate)
-                        logger.warn("models_tiers_plane_deferred", { version: r.effective.version, note: "tier-frozen Runner (env tiers): the late-boot center model plane is NOT hot-applied — restart applies it" });
-                    else {
+                    const latePlane = modelPlaneCommitted(applyReportLate);
+                    if (latePlane)
                         appliedPlaneEff = r.effective;
-                        planeDeferredNoHandoff = undefined;
-                    }
+                    planeDeferredNoHandoff = undefined;
                     await adoptCenterPrompts(r.effective, "boot-deferred");
-                    if (!planeDeferredLate)
+                    if (latePlane)
                         markRosterLanded(r.effective);
                     const fullyAppliedLate = applyReportLate?.fullyApplied !== false;
                     if (!fullyAppliedLate) {
+                        ccEtag = undefined;
+                        const refusedLate = applyReportLate ? refusedGroups(applyReportLate) : [];
                         logger.warn("config_candidate_partially_applied", {
                             version: r.effective.version,
-                            rejected: applyReportLate?.limits.rejected?.keys ?? [],
+                            rejected: refusedLate.flatMap((g) => g.keys),
+                            groups: refusedLate.map((g) => g.group),
                             note: "late-boot candidate had a refused group — the LKG/ETag stay on the last FULLY applied generation; the refresh cadence re-judges the same tree",
                         });
                         return;
@@ -901,27 +942,10 @@ export async function createConfigCenterRuntime(ctx) {
                     latestEffective = r.effective;
                     ccEtag = r.etag;
                     const lkgPersistedLate = await persistLkgDurable(r.effective, r.etag);
-                    const reasons = restartReasons(undefined, r.effective, restartCtx());
-                    if (swapRunnerDeps !== undefined) {
-                        const miLate = reasons.indexOf("models-tiers");
-                        if (miLate >= 0)
-                            reasons.splice(miLate, 1);
-                    }
-                    if (planeDeferredLate) {
-                        if (lkgPersistedLate) {
-                            if (!reasons.includes("models-tiers"))
-                                reasons.push("models-tiers");
-                            planeDeferredNoHandoff = undefined;
-                        }
-                        else {
-                            const blocked = reasons.splice(0, reasons.length);
-                            planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), ...(blocked.length > 0 ? { blocked } : {}), planeDeferred: true, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
-                            logger.warn("models_tiers_deferred_no_handoff", { version: r.effective.version, blockedReasons: blocked, note: "late-boot plane deferred but no NEXT-BOOT handoff (see CONFIG_LKG_DURABLE) — the WHOLE restart signal is withheld (it would loop); old generation keeps serving" });
-                        }
-                    }
-                    else if (planeDeferredLate === false && lkgSurvivesRestart && !lkgPersistedLate) {
+                    const reasons = restartReasons(undefined, r.effective, restartCtx(consolidationSeat?.read()));
+                    if (lkgSurvivesRestart && !lkgPersistedLate) {
                         const blocked = reasons.splice(0, reasons.length);
-                        planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), blocked, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
+                        planeDeferredNoHandoff = { version: r.effective.version, since: Date.now(), blocked, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
                         logger.warn("restart_candidate_publication_incomplete", { version: r.effective.version, blockedReasons: blocked, note: "late-boot candidate publication incomplete on a durable-declared deployment — restart signal withheld; retried every tick" });
                     }
                     if (reasons.length > 0)

package/dist/boot/execution-env.d.ts

@@ -1,4 +1,3 @@
-import { NodeLspManager } from "@sema-agent/core";
 import { TaskEnvRegistry } from "../capabilities/sandbox-file-send.js";
 import { SessionEnvironmentSelection } from "../capabilities/select-environment-tool.js";
 import type { ServiceConfig } from "../config.js";
@@ -67,6 +66,6 @@ export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     worktreeReap: (() => Promise<void>) | undefined;
     sendUserFileTaskEnvs: TaskEnvRegistry | undefined;
-    lspManager: import("../lsp/manager.js").E2bLspManager | NodeLspManager | undefined;
+    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
 };
 //# sourceMappingURL=execution-env.d.ts.map

package/dist/boot/execution-env.js

@@ -1,6 +1,6 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { NodeLspManager } from "@sema-agent/core";
+import { createHostLspManager } from "../host-lsp-manager.js";
 import { sandboxSendLaneEnabled, TaskEnvRegistry } from "../capabilities/sandbox-file-send.js";
 import { SessionEnvironmentSelection } from "../capabilities/select-environment-tool.js";
 import { createE2bLspManager } from "../lsp/e2b-manager.js";
@@ -29,6 +29,24 @@ function boundedSessionSetter(map, maxEntries) {
             map.delete(map.keys().next().value);
     };
 }
+function forwardedSandboxEnvKeys(remoteExec) {
+    switch (remoteExec.provider) {
+        case "e2b":
+            return Object.keys(remoteExec.sandboxEnv ?? {}).sort();
+        case "local-docker":
+            return Object.keys(remoteExec.env ?? {}).sort();
+        case "k8s":
+        case "ssh":
+        case "adb":
+        case "host":
+        case "device":
+            return [];
+        default: {
+            const unreachable = remoteExec;
+            throw new Error(`unhandled remote-exec provider: ${String(unreachable.provider)}`);
+        }
+    }
+}
 const MAX_CWD_SESSIONS = 4096;
 export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
     const perSessionCwd = new Map();
@@ -275,7 +293,7 @@ export function createExecutionEnv(ctx) {
             config.remoteExec.provider === "local-docker";
         const suspendable = config.remoteExec.provider === "e2b" ||
             (config.remoteExec.provider === "k8s" && !!config.remoteExec.s3Snapshot);
-        const sandboxEnvKeys = config.remoteExec.provider === "e2b" ? Object.keys(config.remoteExec.sandboxEnv ?? {}) : [];
+        const sandboxEnvKeys = forwardedSandboxEnvKeys(config.remoteExec);
         logger.info("remote_exec_enabled", { provider: config.remoteExec.provider, isolated, suspendable, ...(sandboxEnvKeys.length > 0 ? { sandboxEnvKeys } : {}) });
         if (!isolated)
             logger.warn("remote_exec_real_system", { provider: config.remoteExec.provider, note: "non-isolated target — actions are permanent; rely on the policy gate + HITL (design/61 §5)" });
@@ -290,7 +308,7 @@ export function createExecutionEnv(ctx) {
         })
         :
             lspProvider === "host" && config.lspHostEnabled && config.requirePrincipal !== true
-                ? new NodeLspManager({ log: (event, fields) => logger.info(event, fields) })
+                ? createHostLspManager(config, (event, fields) => logger.info(event, fields))
                 : undefined;
     if (lspManager)
         logger.info("lsp_enabled", { provider: lspProvider });

package/dist/boot/leader.js

@@ -1,6 +1,7 @@
 import { createLeaderEndpoint } from "../leader/endpoint.js";
 import { createLeaderRunner } from "../leader/wire.js";
 import { buildDeploymentPostureSeats } from "./runner-deps.js";
+import { hasApprovalListIntent } from "../approval.js";
 export function leaderK8sMinioGap(leaderEnabled, leaderProvider, hasS3) {
     if (!(leaderEnabled && leaderProvider === "k8s" && !hasS3))
         return null;
@@ -67,16 +68,18 @@ export function createLeaderFace(ctx) {
             ...(toolResultStore ? { toolResultStore } : {}),
             ...(leaderProvider === "k8s" ? { workspace: "/workspace" } : {}),
             sessionStore,
-            ...(checkpointStore && config.approvalRequire.length > 0
+            ...(checkpointStore
                 ? {
-                    durable: {
-                        checkpointStore,
-                        requireApproval: config.approvalRequire,
-                        deny: config.approvalDeny,
-                        autoBudget: config.approvalAutoBudget,
-                        neverAuto: config.approvalNeverAuto,
-                        ...(config.approvalTimeoutSec > 0 ? { ttlMs: config.approvalTimeoutSec * 1000 } : {}),
-                    },
+                    durable: () => hasApprovalListIntent(config)
+                        ? {
+                            checkpointStore,
+                            requireApproval: config.approvalRequire,
+                            deny: config.approvalDeny,
+                            autoBudget: config.approvalAutoBudget,
+                            neverAuto: config.approvalNeverAuto,
+                            ...(config.approvalTimeoutSec > 0 ? { ttlMs: config.approvalTimeoutSec * 1000 } : {}),
+                        }
+                        : undefined,
                 }
                 : {}),
         }), {

package/dist/boot/memory-consolidation.d.ts

@@ -1,3 +1,4 @@
+import type { RestartSliceCtx } from "../config-center/restart-signal.js";
 import { type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type MemoryBackend, type MemoryConsolidationDriverDeps, type RunMemoryConsolidationOptions, type SessionCaptureRecordStore } from "@sema-agent/core";
 /** D3 投影的座标签闭集。`role:<name>` 里的 name 只可能是 core 的 role 链两跳之一。 */
 export type ConsolidationSeatLabel = "explicit" | "role:consolidate" | "role:summarize";
@@ -30,6 +31,43 @@ export interface ConsolidationDriverSeat {
  * (探针只构造闭包、不发任何请求、无副作用。)
  */
 export declare function resolveConsolidationDriverSeat(deps: MemoryConsolidationDriverDeps): ConsolidationDriverSeat;
+/**
+ * S-668 波 0([ref] §3)—— 整理驱动席的 **restart 读数**。过渡件:**波 1 转热后删**(那时每轮 run 起手
+ * 现取当前代的席,不再有 boot 烤死的席,这只表也就没有要比的东西了)。
+ *
+ * ## 为什么要它
+ *
+ * 席位在 boot 期解析一次(本模块头注「座在启动期解析一次」),core 的解析器把它选中的那只 `Model` 对象焊进
+ * chat 闭包。refresh 拍对模型面的热换(`mutateInPlace` + `swapDeps`)换的是目录里的**值**,够不到那只对象
+ * ⇒ 中心改了 roles / 档位绑定 / 那条目录条目之后,整理跑仍打 boot 那一代。修前没有任何一片签它 —— 它唯一
+ * 沾边的 `models-tiers` 片在生产上恒被摘除(今已退役)—— 于是这块是「静默冷」:既不热应用、也不报重启。
+ *
+ * ## 读法:问 core 的**同一只**解析器,不抄它的 role 链
+ *
+ * 席位 = `consolidate → summarize(含 flash 档位缺省)` 那条链对「env 角色底 + 中心目录 + 档位表」解出来的
+ * 那只 Model;本层抄一份链就是第二真源({@link seatLabel} 注里同一条理由)。做法:拿活配置调
+ * `resolveMemoryConsolidationDriver`,brain 与 per-model 凭据席都换成探针,再调一次它交回的 `chat` ——
+ * core 的 chat 第一件事就是拿**它选中的那只 Model** 问凭据席(`deps.getApiKeyAndHeaders?.(resolved)`,在
+ * 第一个 await 之前同步求值),探针在那一刻记下它并抛停:零请求、零副作用。
+ * ⚠️ 这一步依赖 core chat 闭包的**行为次序**:哪天 core 改成先做别的再问凭据席,探针就截不到 —— 那一刻本函数
+ * **响亮抛**(boot 期抛 = 阀门开着的部署拒启,句子说清原因),不退化成「读不到就当没变」(那正是本件要消灭的
+ * 静默)。钉:test/memory-consolidation-driver.test.ts 的探针格对真 core 跑,提货批当场红。
+ *
+ * ## 指纹里有什么
+ *
+ * 整只 Model 减掉 `cost`:整理跑只读 usage 的 token 数、零处读价目(core 7.29.0 的 driver 实现零 `cost` /
+ * `pricing` 读点),纯改价不该造一次重启。解不出来(中心撤掉了 consolidate / summarize 两跳)⇒ 记成
+ * `{ unresolvable: <core 原句> }`,与 boot 那只不等 ⇒ 签重启;重启会在 D1 拒启、把同一句原句写进拒因 ——
+ * 那正是运维该看见的话,比「这台还在用一只中心已经撤掉的席」诚实。
+ */
+export interface ConsolidationSeatWatch {
+    /** boot 烤进去的席 vs 活配置此刻会解出的席(`restartReasons` 的 `memory-consolidation` 片两侧读数)。 */
+    read(): NonNullable<RestartSliceCtx["consolidationSeat"]>;
+}
+/** 解席的输入面 = boot 期真席用的同三件(活引用:refresh 就地换代,`read()` 每次现取)。 */
+export type ConsolidationSeatPlane = Pick<MemoryConsolidationDriverDeps, "models" | "tiers" | "roles">;
+/** `create*`:返回带捕获状态(boot 那只指纹)的活对象。须在真席解析的**同一时刻**调(同一份输入)。 */
+export declare function createConsolidationSeatWatch(plane: () => ConsolidationSeatPlane): ConsolidationSeatWatch;
 /**
  * **每 scope 单飞**(codex 交叉复审 [high],验真后修)—— 同一 scope 上在飞的那一轮被后来者**并入**,
  * 而不是各起一轮。`create*`:返回带状态的活对象。