@sema-agent/server 7.99.0 → 7.101.0

package/dist/config-center/apply-ledger.js

@@ -1,3 +1,13 @@
+export const CONFIG_APPLY_GROUPS = ["limitsHttp", "approvalGate", "modelPlane"];
+export function refusedGroups(report) {
+    return CONFIG_APPLY_GROUPS.flatMap((group) => {
+        const r = report.groups[group].rejected;
+        return r ? [{ group, keys: r.keys, reason: r.reason }] : [];
+    });
+}
+export function modelPlaneCommitted(report) {
+    return report !== undefined && report.groups.modelPlane.rejected === undefined;
+}
 export function createConfigApplyLedger(now = () => Date.now()) {
     let targetOrd = 0;
     let appliedOrd = 0;
@@ -6,6 +16,21 @@ export function createConfigApplyLedger(now = () => Date.now()) {
     const rejectedOrds = new Set();
     let divergedSince;
     const groups = {};
+    const nextGroupState = (prev, r, version) => {
+        if (r.rejected) {
+            return {
+                appliedVersion: prev?.appliedVersion ?? 0,
+                ...(prev?.deferredKeys ? { deferredKeys: prev.deferredKeys } : {}),
+                lastRejected: { keys: [...r.rejected.keys], reason: r.rejected.reason, version, at: now() },
+                ...(r.rejected.restartReason ? { deferredKeys: r.rejected.keys.map((key) => ({ key, reason: r.rejected.restartReason })) } : {}),
+            };
+        }
+        return {
+            appliedVersion: version,
+            ...(r.deferred && r.deferred.length > 0 ? { deferredKeys: r.deferred.map((d) => ({ key: d.key, reason: d.reason })) } : {}),
+            ...(prev?.lastRejected ? { lastRejected: prev.lastRejected } : {}),
+        };
+    };
     const reconcile = () => {
         if (targetOrd === appliedOrd)
             divergedSince = undefined;
@@ -32,28 +57,13 @@ export function createConfigApplyLedger(now = () => Date.now()) {
             reconcile();
         },
         recordApply(report) {
-            const prev = groups.limitsHttp;
             const ord = report.ordinal ?? report.version;
-            if (report.limits.rejected)
+            if (refusedGroups(report).length > 0)
                 rejectedOrds.add(ord);
             else
                 rejectedOrds.delete(ord);
-            if (report.limits.rejected) {
-                groups.limitsHttp = {
-                    appliedVersion: prev?.appliedVersion ?? 0,
-                    ...(prev?.deferredKeys ? { deferredKeys: prev.deferredKeys } : {}),
-                    lastRejected: { keys: [...report.limits.rejected.keys], reason: report.limits.rejected.reason, version: report.version, at: now() },
-                    ...(report.limits.rejected.restartReason
-                        ? { deferredKeys: report.limits.rejected.keys.map((key) => ({ key, reason: report.limits.rejected.restartReason })) }
-                        : {}),
-                };
-                return;
-            }
-            groups.limitsHttp = {
-                appliedVersion: report.version,
-                ...(report.limits.deferred && report.limits.deferred.length > 0 ? { deferredKeys: report.limits.deferred.map((d) => ({ key: d.key, reason: d.reason })) } : {}),
-                ...(prev?.lastRejected ? { lastRejected: prev.lastRejected } : {}),
-            };
+            for (const g of CONFIG_APPLY_GROUPS)
+                groups[g] = nextGroupState(groups[g], report.groups[g], report.version);
         },
         view() {
             const stale = divergedSince !== undefined ? now() - divergedSince : undefined;

package/dist/config-center/facade.d.ts

@@ -25,14 +25,20 @@
  *     reference. Both brains re-resolve `model.baseUrl || config.baseUrl` inside `buildRequest()` on every
  *     call (core 2.1.0 `brain/openai.js` + `brain/anthropic.js`), so a moved gateway takes effect on the
  *     next task with no restart.
- *   - the same plane under a **tier-frozen** Runner — deferred, not hot: core expands a PRIVATE catalog copy
- *     at construction, so `main` defers the whole plane and the `models-tiers` restart slice signals.
- *   - **`degrade-route`** — the one genuinely boot-frozen catalog consumer left: reactive degrade
+ *   - tiers (and the whole plane under an active tier table) — **HOT** as well: core expands a PRIVATE catalog
+ *     copy at Runner construction, and the refresh loop swaps every changed plane into all boot Runners before
+ *     commit (`Runner.swapDeps`, core 7.10.0; production always wires it). The old "tier-frozen ⇒ defer to restart"
+ *     arm and its `models-tiers` restart slice retired in S-668 波 0 — `/v1/models` and tier-word routing move on
+ *     the same tick.
+ *   - **`degrade-route`** — one of the two genuinely boot-frozen catalog consumers left (the other is the
+ *     memory-consolidation driver seat, last bullet): reactive degrade
  *     (`MODEL_DEGRADE_REACTIVE`) bakes the target Model + its gateway + its key into the brain composition
  *     at boot. It cannot be hot-applied without rebuilding the brain, so it is registered on the existing
  *     restartRequired /health contract instead (see `restart-signal.ts`). Fail-loud beats serving a stale
  *     gateway silently on the rate-limit path.
- *   - skills/mcp/scenarios/runtime-gates — restart-to-apply by construction (baked into the boot wiring).
+ *   - skills(+plugins)/mcp/a2a/scenarios — restart-to-apply by construction (baked into the boot
+ *     wiring); so is the memory-consolidation driver's model seat (`memory-consolidation` slice, S-668 波 0).
+ *     (`governance.approvalRequire` left this list in S-668 波 2 — its own staged group, hot on both legs.)
  *
  * ([ref] A13, internal-lossless) This module is now a FACADE: the implementation lives
  * alongside it in `src/config-center/` split by responsibility group (HTTP client / EffectiveConfig
@@ -42,8 +48,8 @@
  * importers to update, which was done in the same commit.
  */
 export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
-export { mutateInPlace, applyEffective, type ApplyReport, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, } from "./apply-effective.js";
-export { restartReasons, planeHasActiveTiers, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type RestartSignal, } from "./restart-signal.js";
+export { mutateInPlace, applyEffective, type ApplyReport, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, MODEL_PLANE_DOMAINS, type ModelPlaneDomain, type ModelPlaneOf, withModelPlaneOf, buildEnvOnlyModelPlane, } from "./apply-effective.js";
+export { restartReasons, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type RestartSignal, } from "./restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
 export { applyCenterReadFace, CENTER_READ_FACE_LIVE_KEYS, type CenterReadFaceApply, type CenterReadFaceReport, type ReadFaceBaseline } from "./read-face.js";
 export type { CenterSkillManifest, CenterMcpServer, CenterA2aPeer, CenterModel, CenterReadFace, EffectiveConfig, ExecutionRuling, SessionMirrorRuling, } from "./types.js";

package/dist/config-center/facade.js

@@ -1,6 +1,6 @@
 export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
-export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, } from "./apply-effective.js";
-export { restartReasons, planeHasActiveTiers, modelPlaneChanged, } from "./restart-signal.js";
+export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, MODEL_PLANE_DOMAINS, withModelPlaneOf, buildEnvOnlyModelPlane, } from "./apply-effective.js";
+export { restartReasons, modelPlaneChanged, } from "./restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
 export { applyCenterReadFace, CENTER_READ_FACE_LIVE_KEYS } from "./read-face.js";
 //# sourceMappingURL=facade.js.map

package/dist/config-center/hot-keys-registry.d.ts

@@ -6,7 +6,7 @@
  * 键 → 组 → 换代手法 → **参数化用例 ID**(不是文件名——文件名粒度挡不住「文件在、用例没了」)。
  *
  * 机器门在 test/config-hot/batch1-hot-keys-registry.test.ts:登记为热却没有三断言用例 = 红;
- * 表的键集与 stage 真正消费的键集(`BATCH1_LIMIT_KEYS`)不等 = 红。
+ * 表的键集与 stage 真正消费的键集(`BATCH1_LIMIT_KEYS` ∪ `APPROVAL_GROUP_KEYS`)不等 = 红。
  *
  * ⚠️ 本表**只登记已落地的批**。批2-4 的键在各自批次里追加(设计稿 §6),不提前写进来 —— 一个「登记为热
  * 但没接线」的条目正是本表要消灭的那种谎。
@@ -27,8 +27,8 @@ export interface HotKeyEntry {
     readonly key: keyof ServiceConfigFlat;
     readonly group: keyof ServiceConfigGroups;
     readonly form: HotKeyForm;
-    /** 落地批次(设计稿 §6 的批号)。 */
-    readonly batch: 1;
+    /** 落地批次:1 = [ref] 批1(limitsHttp 组);2 = S-668 波 2(审批组 —— [ref] §6 原排的「批2」)。 */
+    readonly batch: 1 | 2;
     readonly cases: HotKeyCases;
 }
 /**
@@ -57,6 +57,13 @@ export declare const DEFERRED_LIMIT_KEYS: ReadonlyArray<{
     readonly restartReason: string;
     readonly why: string;
 }>;
-/** 热键表 = 批1 消费键集**减去**显式 deferred 的那些(表只登记真的热的键)。 */
+/**
+ * S-668 波 2([ref] §3)—— **审批组**真正接线的键:`apply-effective.ts` 的 `stageApprovalGate` 消费、报告(世代账
+ * `groups.approvalGate`)与拒绝(拒因的键名)都取这一张表。换代手法 A′:消费点本就逐请求现读活 config(审批基线 /
+ * SendUserFile 子代闸 / 会话与记忆读面 / parked 赎回),leader 腿与单用户基线改成现读之后,热只差 refresh 腿的写口。
+ */
+export declare const APPROVAL_GROUP_KEYS: readonly ["approvalRequire"];
+export type ApprovalGroupKey = (typeof APPROVAL_GROUP_KEYS)[number];
+/** 热键表 = 批1 消费键集**减去**显式 deferred 的那些 + 审批组(表只登记真的热的键)。 */
 export declare const HOT_KEYS_REGISTRY: readonly HotKeyEntry[];
 //# sourceMappingURL=hot-keys-registry.d.ts.map

package/dist/config-center/hot-keys-registry.js

@@ -29,11 +29,15 @@ export const DEFERRED_LIMIT_KEYS = [
     },
 ];
 const DEFERRED_KEYS = new Set(DEFERRED_LIMIT_KEYS.map((d) => d.key));
-export const HOT_KEYS_REGISTRY = BATCH1_LIMIT_KEYS.filter((key) => !DEFERRED_KEYS.has(key)).map((key) => ({
-    key,
-    group: "limitsHttp",
-    form: (B_SETTER_KEYS.includes(key) ? "B-setter" : "A-prime"),
-    batch: 1,
-    cases: cases(key),
-}));
+export const APPROVAL_GROUP_KEYS = ["approvalRequire"];
+export const HOT_KEYS_REGISTRY = [
+    ...BATCH1_LIMIT_KEYS.filter((key) => !DEFERRED_KEYS.has(key)).map((key) => ({
+        key,
+        group: "limitsHttp",
+        form: (B_SETTER_KEYS.includes(key) ? "B-setter" : "A-prime"),
+        batch: 1,
+        cases: cases(key),
+    })),
+    ...APPROVAL_GROUP_KEYS.map((key) => ({ key, group: "approval", form: "A-prime", batch: 2, cases: cases(key) })),
+];
 //# sourceMappingURL=hot-keys-registry.js.map

package/dist/config-center/http-client.d.ts

@@ -1,11 +1,13 @@
 import { type EffectiveReadWarning, type EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
 import type { ScenarioRuling } from "../capabilities/scenarios.js";
 import type { EffectiveConfig, ExecutionRuling } from "./types.js";
+import { type DroppedConfigEntry } from "./read-warnings.js";
 import { type CenterEndpoint } from "./center-request.js";
 /** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error, and on a
  *  payload that is not an effective config at all(非对象 / version 非有限数 / gate 域坏形——[ref] 裁B)。
  *  `domainErrors`:坏 catalog 域(schema default 已落)逐域单列——与本地腿 `FetchEffectiveResult` 同键同义,
- *  boot/refresh 的候选门直接消费。
+ *  boot/refresh 的候选门直接消费。`droppedEntries`(S-704 ②):schema 逐条丢掉的条目(坐标 + 字段诊断)——
+ *  **不**进候选门,调用方响亮点名、其余照用(分面单点 `splitFoldedReadWarnings`,与本地腿同一只)。
  *
  *  `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),与本地腿同键同义。折叠是**有损**的——
  *  `hosts-grandfathered` / `legacy-governance-lifted` 两员按律折成 `null`(值已被收编接受,见
@@ -24,6 +26,7 @@ export declare function fetchEffective(center: CenterEndpoint, etag: string | un
         domain: string;
         error: string;
     }>;
+    droppedEntries?: DroppedConfigEntry[];
     readWarnings: readonly EffectiveReadWarning[];
     credentialIdentity: string;
 } | null>;

package/dist/config-center/http-client.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { readEffectiveWire, PrincipalCapsWire } from "@sema-agent/settings-schema";
 import { centerPromptsFromEffective } from "../prompts-domain-validate.js";
-import { foldEffectiveReadWarning } from "./read-warnings.js";
+import { splitFoldedReadWarnings, withDroppedIdentities } from "./read-warnings.js";
 import { centerFetch } from "./center-request.js";
 import { answerStillCurrent } from "../center-credential.js";
 const CENTER_PULL_TIMEOUT_MS = 8000;
@@ -12,20 +12,25 @@ export async function fetchEffective(center, etag, fetchImpl = fetch, worker) {
     if (!res.ok)
         throw new Error(`config-center HTTP ${res.status}`);
     const warnings = [];
-    const wire = readEffectiveWire(await res.json(), (w) => warnings.push(w));
+    const body = await res.json();
+    const wire = readEffectiveWire(body, (w) => warnings.push(w));
     const centerPrompts = centerPromptsFromEffective(wire);
     if (centerPrompts === undefined)
         delete wire.prompts;
     else
         wire.prompts = centerPrompts;
-    const domainErrors = [];
-    for (const w of warnings) {
-        const f = foldEffectiveReadWarning(w);
-        if (f !== null)
-            domainErrors.push(f);
-    }
-    const effective = wire;
-    return { effective, etag: res.headers.get("etag") ?? undefined, readWarnings: warnings, credentialIdentity: identity, ...(domainErrors.length > 0 ? { domainErrors } : {}) };
+    const rawModels = typeof body === "object" && body !== null && !Array.isArray(body) ? body.models : undefined;
+    const parsedModels = wire.models?.models;
+    const { domainErrors, droppedEntries, droppedIdentities } = splitFoldedReadWarnings(warnings, { raw: rawModels, parsed: Array.isArray(parsedModels) ? parsedModels : undefined });
+    const effective = withDroppedIdentities(wire, droppedIdentities);
+    return {
+        effective,
+        etag: res.headers.get("etag") ?? undefined,
+        readWarnings: warnings,
+        credentialIdentity: identity,
+        ...(domainErrors.length > 0 ? { domainErrors } : {}),
+        ...(droppedEntries.length > 0 ? { droppedEntries } : {}),
+    };
 }
 export async function fetchPrincipalCaps(center, principal, etag, fetchImpl = fetch, worker) {
     const raw = await requestPrincipalView(center, principal, etag, fetchImpl, worker);

package/dist/config-center/read-warnings.d.ts

@@ -10,20 +10,129 @@
  * 截断:schema 的键列表有界(64),超界带 `truncatedFrom`(真实总数)——文案如实带上,消费方永远不把有界列表当穷举。
  * 词表是闭集:`switch` 穷举 `kind`,schema 加新 kind 这里编译红,不会静默漏臂。
  *
- * **归族只有一条判据**(下游只有一个消费者——候选门:非空 ⇒ 这棵树整拒、保 LKG):
- * 运维**写了而没生效**的 ⇒ 候选门错误;值**已被收编接受**(写了、生效了、只是换了个位置或被夹住)⇒ 不入诊断面。
- * settings-schema 2.0.0 的两员新告警各自入族,没有新开第三档:`entry-dropped`(逐条容错丢掉的那条条目——
- * 运维写下的模型/服务器没进目录,与 `domain-defaulted` 是同一件事的细/粗两档)归前者;
- * `legacy-governance-lifted`(0.5 期 runtime 文档里的治理三闸被抬进 governance 域)归后者——那几个键**生效了**
+ * **归族判据两问**(下游两个消费者:候选门 = 非空 ⇒ 这棵树整拒、保 LKG;逐条丢弃面 = 响亮点名、其余照用):
+ *  ① 值**已被收编接受**(写了、生效了、只是换了个位置或被夹住)⇒ 不入诊断面(`null`);
+ *  ② 写了没生效的,按**失效的颗粒**分:丢的是**一条条目**(`entry-dropped`)⇒ `scope:"entry"` —— 这条条目单独
+ *     不在,同域其余条目照用,候选**不**因它整拒;丢的是一个域 / 一组键 / 一个文件 ⇒ `scope:"domain"` —— 候选门错误。
+ *
+ * 🔴 S-704 ②(2026-09-24,凭据轴):此前 `entry-dropped` 归「候选门错误」(settings-schema 2.0.0 提货时的归族),于是
+ * schema 的**逐条容错**在本仓的 refresh / 迟到 boot 两条腿上被**还原成整份拒** —— 目录里一条 `contextWindow:"abc"`
+ * 就让整份目录停在上一代;而上一代若还是 env(boot 拉取失败 / 超窗且无 LKG),env 模型就一直服务、env 钥匙一直被送到
+ * 网关缺省端点(红先实测:`config_candidate_rejected` + env 模型继续服务)。粒度对了规则反而更少:颗粒是条目的失效
+ * 留在条目上,只有颗粒更粗的失效才动候选。
+ * `legacy-governance-lifted`(0.5 期 runtime 文档里的治理三闸被抬进 governance 域)归①——那几个键**生效了**
  * (`buildEffective` 用抬升结果解析 governance),把它折成错误会让一份合法的 0.5 期存量配置每一次 refresh 都被
  * 候选门整拒,而它在 1.10.0 上零告警零 domainErrors(亲验读数)。兼容臂的关窗观测归属主(settings-schema 的
  * `onWarning` 流),不借候选门这条带副作用的通道传信息。
  */
-import { type EffectiveReadWarning } from "@sema-agent/settings-schema";
+import { type ConfigPath, type EffectiveReadWarning } from "@sema-agent/settings-schema";
+/** 折叠产物:`scope` 决定消费方做什么 —— `"domain"` 进候选门(`domainErrors`),`"entry"` 进逐条丢弃面(`droppedEntries`)。 */
 export type FoldedReadWarning = {
+    readonly scope: "domain";
+    readonly domain: string;
+    readonly error: string;
+} | {
+    readonly scope: "entry";
+    readonly domain: string;
+    readonly entry: string;
+    readonly error: string;
+};
+/** 逐条丢弃面的一行(两条读腿的 `droppedEntries` 同形):`entry` = 被丢那条的出门形坐标(`models.1`),`error` = 哪些字段、为什么。 */
+export type DroppedConfigEntry = {
     readonly domain: string;
+    readonly entry: string;
     readonly error: string;
 };
+/**
+ * zod 形的错误 → 一行可读的字段诊断(`contextWindow: expected number, received string; api: custom`)。
+ * **只读**每条 issue 的 `path`(键名)与 `code`,`invalid_type` 臂另读 `expected` / `received`(两者都是**类型词**)——
+ * 刻意不读 `message`(自定义 refine 的 message 可以回声值)与 `invalid_enum_value` 等臂的 `received`(那是原值)。
+ * 读不出 issues 形 ⇒ `undefined`(调用方退回既有文案)。模型面 stage 的逐条判据与本折叠点共用这一只(一个刻度)。
+ */
+export declare function describeSchemaIssues(error: unknown): string | undefined;
+/**
+ * zod 形错误 → 坏字段的**键路径**(去重保序;`(entry)` = 整条)。与 {@link describeSchemaIssues} 同一只读法(只读 `path`),
+ * 不含值。模型面 stage 的逐条判据(`judgeCatalogEntry`)与本折叠点的被丢条目身份共用这一只 —— 一个刻度。
+ */
+export declare function describeSchemaIssueFields(error: unknown): string[];
 /** null = 不入诊断面(`hosts-grandfathered` / `legacy-governance-lifted`:值已被收编接受,与本地店同口径)。 */
 export declare function foldEffectiveReadWarning(w: EffectiveReadWarning): FoldedReadWarning | null;
+/**
+ * 🔴 S-712 —— 一条被 schema 逐条丢掉的**启用**目录条目的身份(模型面墓碑的来源;载体 = `EffectiveConfig.models.droppedIdentities`,
+ * 随 effective 走 —— 盘上 LKG 从同一个对象落盘,重启从 LKG 起服墓碑不丢)。
+ *
+ * 为什么要交出身份:条目被丢之后它的名字从目录里消失,而档位增广(core `expandTiers`)会把一个**空出来的**档位词 / CC 别名
+ * (条目恰好叫 `sonnet` / `pro` …)重新铸到另一条条目上 —— 显式点它的请求与点名它的角色绑定就这样被静默换了目的地
+ * (gpt-6 腿 F2 / F3,真复现)。身份进 `modelRefusals` 之后,不变量 `refused-names-not-minted` 才判得到它。
+ *
+ * 🔐 纯身份,不含值:`name` / `id` / `provider` 只取**字符串**(条目自己写的词,本就进日志与拒因句),`fields` 是坏字段的
+ * **键路径**,`issues` 是 {@link describeSchemaIssues} 的一行(键名 + 类型词)—— 被丢条目的原值(可能是一段贴错位置的凭据)
+ * 绝不进载体、日志、LKG 与 400 拒因句。
+ */
+export interface DroppedModelIdentity {
+    /** 出门形坐标(`models.1`),与同一次读的 `droppedEntries[].entry` 同一串。 */
+    readonly entry: string;
+    /** 条目写的 `name`。**缺席 = 身份证明不了**(只剩一形:原文档与本次解析对不上 / 坐标在原文档里不存在,见 {@link droppedEntryIdentity})
+     *  ⇒ 模型面整组拒:证明不了的名字无从证明它不被增广铸出。原文档那一格读到了却没有字符串名的行**不进**载体(没有可保留的名字,
+     *  与停用同处置 —— 7.101.0 验修轮 V-2)。 */
+    readonly name?: string;
+    readonly id?: string;
+    readonly provider?: string;
+    readonly fields: readonly string[];
+    readonly issues: string;
+}
+/** 本次读的模型域**原文**与**解析产物**(两腿各自手里都有这两件:远端 = 响应体与 `readEffectiveWire` 输出;本地 = 盘上
+ *  `config.d/models.json` 与 `FileConfigStore` 输出)。 */
+export interface ModelsDomainSource {
+    /** 模型域的原始文档(`{ models: [...], roles, … }`);读不到 ⇒ `undefined`(身份一律证明不了)。 */
+    readonly raw: unknown;
+    /** 同一次读解析后幸存的条目(schema 逐条丢弃之后的 `models.models`)。 */
+    readonly parsed: readonly unknown[] | undefined;
+}
+/**
+ * 一条被丢行在原文档里那一格的读数 —— **三态**(7.101.0 验修轮 V-2,规则变小:「读不出」只剩一种含义):
+ *  · `named`:格读到了、`name` 是字符串 ⇒ 身份已定(启用的铸墓碑,停用的不是);
+ *  · `nameless`:格读到了、没有字符串 `name`(`null` / 数 / 整格不是对象)⇒ 身份**也**已定:**没有可保留的名字** —— 请求、
+ *    `@`-mention、角色绑定都点不到一个非字符串名,档位增广也铸不出它 ⇒ 与 `enabled:false` 同处置(不是墓碑、不拒组);
+ *  · `undefined`(由 {@link droppedEntryIdentity} 答):格读不到 —— 坐标在原文档里不存在;调用方在原文档与本次解析对不上
+ *    (`sameRead` 假)时根本不来读 ⇒ 两者同是「身份证明不了」,交一条不带 `name` 的载体(模型面据此整组拒)。
+ * 此前 `nameless` 被折进「读不出」⇒ 一行 `{ name: null }` 的坏行(哪怕是停用的)就让整个模型面被拒(codex 验修腿 V-2,boot 腿对
+ * v7.100.0 的窄回归:那时 boot 对同一文档宽容采纳幸存条目)。
+ */
+export type DroppedEntryCell = {
+    readonly kind: "named";
+    readonly name: string;
+    readonly id?: string;
+    readonly provider?: string;
+    readonly enabled: boolean;
+} | {
+    readonly kind: "nameless";
+};
+/**
+ * 🔴 S-712 **唯一**的身份读法:按告警坐标(`path`,模型域文档内的段坐标 —— settings-schema 已把它回写成原文档坐标)回读
+ * 原文档那一格,答 {@link DroppedEntryCell} 三态之一;坐标在原文档里走不通 ⇒ `undefined`(格读不到)。字符串才算
+ * (`name` / `id` / `provider`),`enabled` 只认字面 `false` 为停用。
+ * settings-schema 6.1.0 的 `entry-dropped` 自带 `name` / `id` 到货后,本函数改读告警(同一只函数,换数据源),原文档入参随之删除。
+ */
+export declare function droppedEntryIdentity(rawDoc: unknown, path: ConfigPath): DroppedEntryCell | undefined;
+/**
+ * 两条读腿(远端 `http-client.ts` / 本地 `config-provider.ts`)共用的**分面单点**:折叠产物按 `scope` 分进候选门
+ * (`domainErrors`)与逐条丢弃面(`droppedEntries`)。`switch` 穷举 —— 加一种 scope 不补臂 = 编译红,两腿不会各分各的。
+ * 文案**未脱敏**:进日志流之前各腿在自己的产出边界上过 `redactConfigError`(与 `domainErrors` 同一道)。
+ * S-712:同一次折叠把被丢**模型目录条目**的身份交出(`droppedIdentities`,见 {@link DroppedModelIdentity}),按 {@link DroppedEntryCell}
+ * 三态分流:有名且启用 ⇒ 墓碑;停用的、没有字符串名的 ⇒ 不进载体(停用 = 不在目录,与 7.100.0 同义;无名 = 没有可保留的名字);
+ * 格读不到 / 原文档对不上 ⇒ 不带 `name` 的载体(证明不了)。坏行本身照样走 `droppedEntries`(坐标 + 字段,不带值)。
+ */
+export declare function splitFoldedReadWarnings(warnings: readonly EffectiveReadWarning[], models: ModelsDomainSource): {
+    domainErrors: Array<{
+        domain: string;
+        error: string;
+    }>;
+    droppedEntries: DroppedConfigEntry[];
+    droppedIdentities: DroppedModelIdentity[];
+};
+/** S-712:把本次读交出的被丢身份挂上 effective 的模型域(两腿同一只;空 ⇒ 不挂键)。 */
+export declare function withDroppedIdentities<E extends {
+    models?: object;
+}>(effective: E, droppedIdentities: readonly DroppedModelIdentity[]): E;
 //# sourceMappingURL=read-warnings.d.ts.map

package/dist/config-center/read-warnings.js

@@ -1,4 +1,33 @@
 import { formatConfigPath } from "@sema-agent/settings-schema";
+export function describeSchemaIssues(error) {
+    const issues = schemaIssuesOf(error);
+    if (issues === undefined)
+        return undefined;
+    return issues
+        .map((raw) => {
+        const i = (typeof raw === "object" && raw !== null ? raw : {});
+        const field = Array.isArray(i.path) && i.path.length > 0 ? i.path.map(String).join(".") : "(entry)";
+        const what = i.code === "invalid_type" && typeof i.expected === "string" && typeof i.received === "string"
+            ? `expected ${i.expected}, received ${i.received}`
+            : typeof i.code === "string"
+                ? i.code
+                : "invalid";
+        return `${field}: ${what}`;
+    })
+        .join("; ");
+}
+function schemaIssuesOf(error) {
+    const issues = typeof error === "object" && error !== null ? error.issues : undefined;
+    return Array.isArray(issues) && issues.length > 0 ? issues : undefined;
+}
+export function describeSchemaIssueFields(error) {
+    const issues = schemaIssuesOf(error) ?? [];
+    const fields = issues.map((raw) => {
+        const p = typeof raw === "object" && raw !== null ? raw.path : undefined;
+        return Array.isArray(p) && p.length > 0 ? p.map(String).join(".") : "(entry)";
+    });
+    return [...new Set(fields)];
+}
 const MAX_ERROR_CHARS = 600;
 const cap = (s) => s.slice(0, MAX_ERROR_CHARS);
 const errorText = (e) => (e instanceof Error ? e.message : String(e));
@@ -24,19 +53,100 @@ export function foldEffectiveReadWarning(w) {
         case "legacy-governance-lifted":
             return null;
         case "domain-defaulted":
-            return { domain: w.domain, error: cap(errorText(w.error)) };
+            return { scope: "domain", domain: w.domain, error: cap(errorText(w.error)) };
         case "entry-dropped":
-            return { domain: w.domain, error: cap(`entry dropped by domain schema: ${formatConfigPath(w.path)} (${errorText(w.error)})`) };
+            return { scope: "entry", domain: w.domain, entry: formatConfigPath(w.path), error: cap(`entry dropped by domain schema: ${describeSchemaIssues(w.error) ?? errorText(w.error)}`) };
         case "unknown-keys-dropped":
-            return { domain: w.domain, error: keyList("unknown keys dropped by domain schema: ", w.keys, w.truncatedFrom) };
+            return { scope: "domain", domain: w.domain, error: keyList("unknown keys dropped by domain schema: ", w.keys, w.truncatedFrom) };
         case "unknown-keys-carried":
-            return { domain: w.domain, error: keyList("unknown keys carried to consumer (spelling?): ", w.keys, w.truncatedFrom) };
+            return { scope: "domain", domain: w.domain, error: keyList("unknown keys carried to consumer (spelling?): ", w.keys, w.truncatedFrom) };
         case "unread-config-file":
-            return { domain: w.domain ?? "config.d", error: cap(`unread config file ${w.file} (${w.why})`) };
+            return { scope: "domain", domain: w.domain ?? "config.d", error: cap(`unread config file ${w.file} (${w.why})`) };
         default: {
             const never = w;
             throw new Error(`unhandled EffectiveReadWarning kind: ${JSON.stringify(never)}`);
         }
     }
 }
+const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+export function droppedEntryIdentity(rawDoc, path) {
+    let at = rawDoc;
+    for (const seg of path) {
+        if (typeof seg === "number") {
+            if (!Array.isArray(at) || !Number.isInteger(seg) || seg < 0 || seg >= at.length)
+                return undefined;
+            at = at[seg];
+        }
+        else {
+            if (!isRecord(at) || !Object.hasOwn(at, seg))
+                return undefined;
+            at = at[seg];
+        }
+    }
+    if (!isRecord(at) || typeof at.name !== "string")
+        return { kind: "nameless" };
+    return { kind: "named", name: at.name, ...(typeof at.id === "string" ? { id: at.id } : {}), ...(typeof at.provider === "string" ? { provider: at.provider } : {}), enabled: at.enabled !== false };
+}
+function isModelEntryDrop(w) {
+    return w.kind === "entry-dropped" && w.domain === "models" && w.path.length === 2 && w.path[0] === "models" && typeof w.path[1] === "number";
+}
+function sameRead(source, dropped) {
+    const rawModels = isRecord(source.raw) ? source.raw.models : undefined;
+    if (!Array.isArray(rawModels) || source.parsed === undefined)
+        return false;
+    if ([...dropped].some((i) => i >= rawModels.length))
+        return false;
+    const survivors = rawModels.filter((_, i) => !dropped.has(i));
+    return survivors.length === source.parsed.length && survivors.every((s, k) => isRecord(s) && isRecord(source.parsed[k]) && s.name === source.parsed[k].name);
+}
+export function splitFoldedReadWarnings(warnings, models) {
+    const domainErrors = [];
+    const droppedEntries = [];
+    for (const w of warnings) {
+        const f = foldEffectiveReadWarning(w);
+        if (f === null)
+            continue;
+        switch (f.scope) {
+            case "domain":
+                domainErrors.push({ domain: f.domain, error: f.error });
+                break;
+            case "entry":
+                droppedEntries.push({ domain: f.domain, entry: f.entry, error: f.error });
+                break;
+            default: {
+                const never = f;
+                throw new Error(`unhandled folded read-warning scope: ${JSON.stringify(never)}`);
+            }
+        }
+    }
+    const modelDrops = warnings.filter(isModelEntryDrop);
+    const readable = sameRead(models, new Set(modelDrops.map((w) => w.path[1])));
+    const droppedIdentities = [];
+    for (const w of modelDrops) {
+        const unproven = { entry: formatConfigPath(w.path), fields: describeSchemaIssueFields(w.error), issues: describeSchemaIssues(w.error) ?? "(schema issues unreadable)" };
+        const cell = readable ? droppedEntryIdentity(models.raw, w.path) : undefined;
+        if (cell === undefined) {
+            droppedIdentities.push(unproven);
+            continue;
+        }
+        switch (cell.kind) {
+            case "nameless":
+                break;
+            case "named":
+                if (cell.enabled)
+                    droppedIdentities.push({ ...unproven, name: cell.name, ...(cell.id !== undefined ? { id: cell.id } : {}), ...(cell.provider !== undefined ? { provider: cell.provider } : {}) });
+                break;
+            default: {
+                const never = cell;
+                throw new Error(`unhandled dropped-entry cell: ${JSON.stringify(never)}`);
+            }
+        }
+    }
+    return { domainErrors, droppedEntries, droppedIdentities };
+}
+export function withDroppedIdentities(effective, droppedIdentities) {
+    if (droppedIdentities.length === 0 || effective.models === undefined)
+        return effective;
+    return { ...effective, models: { ...effective.models, droppedIdentities: [...droppedIdentities] } };
+}
 //# sourceMappingURL=read-warnings.js.map

package/dist/config-center/restart-signal.d.ts

@@ -1,5 +1,5 @@
 import type { EffectiveConfig } from "./types.js";
-export type RestartSlice = "skills" | "mcp" | "a2a" | "scenarios" | "runtime-gates" | "models-tiers" | "degrade-route" | "read-face";
+export type RestartSlice = "skills" | "mcp" | "a2a" | "scenarios" | "degrade-route" | "read-face" | "memory-consolidation";
 /** What the CALLER must contribute about boot-baked catalog consumers that live OUTSIDE the Runner — the
  *  slices cannot see them, because they are configured from env (`ServiceConfig`), not from the center's
  *  EffectiveConfig. Absent/empty = that lane is off ⇒ its slice is inert (null on both sides). */
@@ -18,6 +18,18 @@ export interface RestartSliceCtx {
      *  新增/改址/域整体出现或消失仍签(新 mount / 改址只能 restart 才生效)。缺席/false = 旧语义照签
      *  (fail-closed:没接席的部署里删除向没人承接,restart 是它唯一的生效路径)。 */
     mcpRevocationLive?: boolean;
+    /** S-668 波 0(过渡;**波 1 转热后删**):记忆整理驱动席的两侧读数 —— `baked` = boot 期 core 解析器选中的
+     *  那只 Model 的指纹,`current` = 同一只解析器对本拍活配置再解一次的指纹(读法见
+     *  boot/memory-consolidation.ts `createConsolidationSeatWatch`)。缺席 = 阀门关着(`MEMORY_CONSOLIDATION_DRIVER`
+     *  不是 on,或记忆引擎没接线)⇒ 没有 boot 烤死的席 ⇒ `memory-consolidation` 片恒不签。 */
+    consolidationSeat?: {
+        readonly baked: unknown;
+        readonly current: unknown;
+    };
+    /** S-668 波 0(codex r1 [medium]):插件 host 白名单(env `PLUGINS_ALLOW_HOSTS`,boot 常量)—— 白名单外的声明
+     *  装载器整条跳过,它们的变化不是重启理由。生产 `restartCtx` 恒传 `config.pluginsAllowHosts`;缺席(单元调用)
+     *  = 装载器的出厂名单 `DEFAULT_PLUGIN_ALLOW_HOSTS`。 */
+    pluginsAllowHosts?: readonly string[];
 }
 /** Structured restart signal an orchestrator consumes (GET /health → `restart`). Change-detected against the
  *  process's BOOT config, NOT presence — so it stays absent when nothing baked-at-boot changed (presence would
@@ -46,18 +58,13 @@ export declare function stableStringify(v: unknown): string;
  *  can auto rolling-restart on a non-empty result WITHOUT a restart loop, because the comparison is always
  *  against boot (a refresh that re-fires the same diff is idempotent, not a fresh trigger). */
 export declare function restartReasons(boot: EffectiveConfig | undefined, current: EffectiveConfig, ctx?: RestartSliceCtx): RestartSlice[];
-/** codex R10 (models-tiers 窗收口): TRUE when the MODEL PLANE (enabled models + active tier table + resolved
- *  default) of `next` differs from the last-APPLIED plane `prev`. Under a tier-frozen Runner (tiers non-empty at
- *  construction → private expanded copy) main.ts DEFERS the whole plane mutation until restart when this is true —
- *  admission (/v1/models, the catalog gates) and the Runner then stay on ONE generation through the restart
- *  window, so a same-key retarget can never silently route/bill the stale Model object. `prev === undefined`
- *  (env-boot plane, no EffectiveConfig to compare) is conservatively "changed" — one deferred adoption + restart
- *  converges. Deliberately NOT gated on tier activity of either side (unlike the restart slice): a frozen Runner
- *  goes stale on ANY plane change, including a tiers-off flip. */
-/** codex R12: TRUE when this candidate resolves an ACTIVE tier table. Used by main.ts's defer predicate — a
- *  tier-less-booted Runner never re-runs expandTiers, so hot-applying an ARRIVING tier table splits admission
- *  (tier words pass the expanded gate) from execution (core throws "Unknown model ref"). Hot-apply of the model
- *  plane is safe only when BOTH the constructed generation and the candidate are tier-less. */
-export declare function planeHasActiveTiers(eff: EffectiveConfig): boolean;
+/** The refresh loop's SWAP gate: TRUE when the MODEL PLANE (enabled models + active tier table + resolved
+ *  default) of `next` differs from `prev`, the last plane handed to `swapRunnerDeps` — only then does the tick
+ *  pass `swapPlane` to applyEffective, so a candidate that moved only hot fields (pricing values / quota weights /
+ *  the `enabled:true` spelling, see catalogEntryFingerprint) or nothing on the plane swaps nothing. `prev ===
+ *  undefined` (env-boot plane, no EffectiveConfig to compare) is conservatively "changed": the first center plane
+ *  always swaps. Not gated on tier activity: a Runner's expanded catalog goes stale on ANY plane change,
+ *  including a tiers-off flip, and the default entry rides the fingerprint because the Runner's copy carries its
+ *  own `default` (codex R8; SAME resolver as applyEffective — resolveDefaultModelName, single source). */
 export declare function modelPlaneChanged(prev: EffectiveConfig | undefined, next: EffectiveConfig): boolean;
 //# sourceMappingURL=restart-signal.d.ts.map