@sema-agent/settings-schema 10.1.0 → 11.0.0

package/dist/prompts-digest.d.ts

@@ -8,7 +8,7 @@ export declare function promptsContentDigest(payload: {
     contentDigest: string;
     packId: string;
     /** [1062]③ 顺带:逐 section 对 `text` 铸的 contentHash(与 core 1.315 校验语义同刻度=
-     *  sha256(text));元素无 string text 位=undefined。center 物化流程=先把这些写回
+     *  sha256(text));元素无 string text 位=undefined。web-admin 物化流程=先把这些写回
      *  declaration.contentHash,再对含 hash 的终形铸整包 digest(本函数对入参原样铸,两步自洽)。 */
     sectionHashes: Array<string | undefined>;
 };

package/dist/prompts-digest.js

@@ -1,7 +1,7 @@
 /**
  * @sema-agent/settings-schema/node — prompts 下发包的**内容摘要**([1057]①/[1062]③)。
  *
- * 这两只是跨仓**对账锚**:center 铸、server 透传、core 的 manifest 归因**独立复算**,三方算出同一个值才
+ * 这两只是跨仓**对账锚**:web-admin 铸、server 透传、core 的 manifest 归因**独立复算**,三方算出同一个值才
  * 对得上账([1050]② operator 对账位)。所以它们只有一件事要守:**一个刻度**。
  *
  * 4.0.0 从 `scheduler-store-node.ts` 搬到这里(不 breaking —— 仍挂在 `./node` 这条 subpath 上,消费方的
@@ -16,6 +16,7 @@
  */
 import { stableStringify } from './hash.js';
 import { sha256Hex } from './sha256.js';
+import { PROMPT_PACK_ID_PREFIX } from './types.js';
 /**
  * 本模块**唯一**的 sha256 铸点:一段 utf8 文本 → `{ hex, anchor }`。`anchor` = 出门形 `sha256:<hex>`
  * (自描述算法,与 skills 的内容地址同形),`hex` 给需要裸 hex 的那一处(packId 取前 12 位)。
@@ -40,7 +41,7 @@ export function promptsContentDigest(payload) {
             return typeof t === 'string' ? sectionContentHash(t) : undefined;
         })
         : [];
-    return { contentDigest: anchor, packId: `center:${hex.slice(0, 12)}`, sectionHashes };
+    return { contentDigest: anchor, packId: `${PROMPT_PACK_ID_PREFIX}${hex.slice(0, 12)}`, sectionHashes };
 }
 /** 逐 section 对账锚(core 1.315 `PromptTextDeclaration.contentHash` 同刻度):sha256(text)。 */
 export function sectionContentHash(text) {

package/dist/reader.d.ts

@@ -2,9 +2,9 @@ import type { DomainConfig, DomainName, EffectiveConfig } from "./types.js";
 /**
  * The MINIMAL read surface a consumer needs to resolve config — a local file source (FileConfigStore), the
  * TOC desktop, or a test fixture implements this WITHOUT stubbing the ~32 publish/RBAC/worker-status/lifecycle
- * methods of sema-registry's full ConfigStore.
+ * methods of web-admin's full ConfigStore.
  *
- * sema-registry's fat `ConfigStore` should `extends ConfigReader` (every store impl already has all three
+ * web-admin's fat `ConfigStore` should `extends ConfigReader` (every store impl already has all three
  * methods, so the extension is satisfied automatically). The signatures here MUST match store.ts exactly
  * (incl. the `<K extends DomainName>` generic and the `| undefined` on getDomain) or that `extends` fails.
  */

package/dist/remote-exec.d.ts

@@ -17,7 +17,8 @@
  * vocabulary; `test/execution-lanes-7.0.0.test.ts` pins `provider ⊆ EXECUTION_LANE_WORDS`, at runtime and at compile time).
  * The `remote-docker` variant was DELETED (zero aliases): no engine read point ever turned that word into a running lane
  * (the engine refuses `REMOTE_EXEC=remote-docker` at boot and only warned "unwired" when this file named it). A remote
- * docker daemon is the `local-docker` lane pointed at it (`DOCKER_HOST` — in a WorkerSpec, `runtime.execution.coords`).
+ * docker daemon is the `local-docker` lane pointed at it (`DOCKER_HOST` — in a WorkerSpec, `runtime.execution.coords`); the word
+ * itself sits in the lane-word tombstone `RETIRED_LANE_WORDS`, so a file still naming it is refused with that way out.
  *
  * SECRET BOUNDARY (identical to the rest of the contract): every secret VALUE the consumer reads from its own
  * env (E2B_API_KEY, K8S_TOKEN, SSH_PRIVATE_KEY, MINIO_*) is carried here as an env-NAME ref (the `ENV_NAME` regex
@@ -26,208 +27,65 @@
  * ONLY; the service owns the adapter implementations.
  */
 import { z } from "zod";
-export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<"provider", [z.ZodObject<{
+export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<[z.ZodObject<{
     provider: z.ZodLiteral<"host">;
-    /** Working ROOT for the agent's tools; absent = the workspace/cwd. (≡ the worker service's resolved
-     *  `workspaceBase` — the adapter runs each task under `<workdir>/ai-agent-host-<id>`.) */
-    workdir: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    /** Optional writable-path allowlist bounding what the host-exec tools may touch (defence for a TOC box). */
-    allowedPaths: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
-    /** Shell to spawn (absent = the platform default). */
-    shell: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    /** Per-COMMAND timeout (ms) for the host lane — host is long-lived so this bounds a single exec, not the
-     *  task (mirrors e2b/k8s `timeoutMs`; = the worker service's `commandTimeoutMs`). Absent = adapter default. */
+    workdir: z.ZodOptional<z.ZodString>;
+    allowedPaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    shell: z.ZodOptional<z.ZodString>;
     commandTimeoutMs: z.ZodOptional<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    provider: "host";
-    workdir?: string | undefined;
-    allowedPaths?: string[] | undefined;
-    shell?: string | undefined;
-    commandTimeoutMs?: number | undefined;
-}, {
-    provider: "host";
-    workdir?: string | undefined;
-    allowedPaths?: string[] | undefined;
-    shell?: string | undefined;
-    commandTimeoutMs?: number | undefined;
-}>, z.ZodObject<{
-    image: z.ZodEffects<z.ZodString, string, string>;
-    memory: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+}, z.core.$strip>, z.ZodObject<{
+    image: z.ZodString;
+    memory: z.ZodOptional<z.ZodString>;
     cpus: z.ZodOptional<z.ZodNumber>;
-    network: z.ZodOptional<z.ZodEnum<["none", "bridge", "host"]>>;
-    workdir: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    mountPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    network: z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        host: "host";
+        bridge: "bridge";
+    }>>;
+    workdir: z.ZodOptional<z.ZodString>;
+    mountPath: z.ZodOptional<z.ZodString>;
     provider: z.ZodLiteral<"local-docker">;
-}, "strip", z.ZodTypeAny, {
-    provider: "local-docker";
-    image: string;
-    memory?: string | undefined;
-    workdir?: string | undefined;
-    cpus?: number | undefined;
-    network?: "none" | "host" | "bridge" | undefined;
-    mountPath?: string | undefined;
-}, {
-    provider: "local-docker";
-    image: string;
-    memory?: string | undefined;
-    workdir?: string | undefined;
-    cpus?: number | undefined;
-    network?: "none" | "host" | "bridge" | undefined;
-    mountPath?: string | undefined;
-}>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     provider: z.ZodLiteral<"e2b">;
-    /** env-NAME holding the E2B API key (service: E2B_API_KEY). NEVER the key. */
-    apiKeyEnv: z.ZodEffects<z.ZodString, string, string>;
-    /** E2B template id (service: E2B_TEMPLATE). */
-    template: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    apiKeyEnv: z.ZodString;
+    template: z.ZodOptional<z.ZodString>;
     timeoutMs: z.ZodOptional<z.ZodNumber>;
-    /** Idle/liveness bound for a command (service: E2B_LIVENESS_MS, the [49] hang-fix). */
     livenessMs: z.ZodOptional<z.ZodNumber>;
     allowInternetAccess: z.ZodOptional<z.ZodBoolean>;
-    /** Which of THIS process's env-NAMEs to forward into the sandbox (service: E2B_SANDBOX_ENV, a CSV of NAMEs). */
-    sandboxEnv: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
-}, "strip", z.ZodTypeAny, {
-    provider: "e2b";
-    apiKeyEnv: string;
-    template?: string | undefined;
-    timeoutMs?: number | undefined;
-    livenessMs?: number | undefined;
-    allowInternetAccess?: boolean | undefined;
-    sandboxEnv?: string[] | undefined;
-}, {
-    provider: "e2b";
-    apiKeyEnv: string;
-    template?: string | undefined;
-    timeoutMs?: number | undefined;
-    livenessMs?: number | undefined;
-    allowInternetAccess?: boolean | undefined;
-    sandboxEnv?: string[] | undefined;
-}>, z.ZodObject<{
+    sandboxEnv: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
     provider: z.ZodLiteral<"k8s">;
-    /** Sandbox container image (service: K8S_SANDBOX_IMAGE). Required so a run is reproducible. */
-    image: z.ZodEffects<z.ZodString, string, string>;
-    /** Kube API URL (service: K8S_API_URL); absent → in-cluster service account. NO embedded credentials. */
-    apiUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    /** env-NAME holding the kube bearer token (service: K8S_TOKEN). NEVER the token. */
-    tokenEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    /** env-NAME holding the base64 CA cert (service: K8S_CA_CERT_B64). NEVER the cert bytes. */
-    caCertEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    image: z.ZodString;
+    apiUrl: z.ZodOptional<z.ZodString>;
+    tokenEnv: z.ZodOptional<z.ZodString>;
+    caCertEnv: z.ZodOptional<z.ZodString>;
     insecureTls: z.ZodOptional<z.ZodBoolean>;
-    namespace: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    runtimeClass: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    mountPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    namespace: z.ZodOptional<z.ZodString>;
+    runtimeClass: z.ZodOptional<z.ZodString>;
+    mountPath: z.ZodOptional<z.ZodString>;
     timeoutMs: z.ZodOptional<z.ZodNumber>;
-    /** Sandbox pod resource limits (service: K8S_MEMORY / K8S_CPU; adapter defaults 2Gi / 1 cpu). */
     memory: z.ZodOptional<z.ZodString>;
     cpu: z.ZodOptional<z.ZodString>;
-    /** Workspace-durable suspend/resume via MinIO/S3 (service: MINIO_*). Creds are env-NAME refs; the sandbox
-     *  only ever sees a presigned URL. accessKeyEnv + secretKeyEnv required to enable (mirrors the service's
-     *  "all three of endpoint/access/secret required" gate). */
     s3Snapshot: z.ZodOptional<z.ZodObject<{
-        endpoint: z.ZodEffects<z.ZodString, string, string>;
-        bucket: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-        accessKeyEnv: z.ZodEffects<z.ZodString, string, string>;
-        secretKeyEnv: z.ZodEffects<z.ZodString, string, string>;
-        region: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-        keyPrefix: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        endpoint: z.ZodString;
+        bucket: z.ZodOptional<z.ZodString>;
+        accessKeyEnv: z.ZodString;
+        secretKeyEnv: z.ZodString;
+        region: z.ZodOptional<z.ZodString>;
+        keyPrefix: z.ZodOptional<z.ZodString>;
         presignTtlSec: z.ZodOptional<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        endpoint: string;
-        accessKeyEnv: string;
-        secretKeyEnv: string;
-        bucket?: string | undefined;
-        region?: string | undefined;
-        keyPrefix?: string | undefined;
-        presignTtlSec?: number | undefined;
-    }, {
-        endpoint: string;
-        accessKeyEnv: string;
-        secretKeyEnv: string;
-        bucket?: string | undefined;
-        region?: string | undefined;
-        keyPrefix?: string | undefined;
-        presignTtlSec?: number | undefined;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    provider: "k8s";
-    image: string;
-    memory?: string | undefined;
-    cpu?: string | undefined;
-    mountPath?: string | undefined;
-    timeoutMs?: number | undefined;
-    apiUrl?: string | undefined;
-    tokenEnv?: string | undefined;
-    caCertEnv?: string | undefined;
-    insecureTls?: boolean | undefined;
-    namespace?: string | undefined;
-    runtimeClass?: string | undefined;
-    s3Snapshot?: {
-        endpoint: string;
-        accessKeyEnv: string;
-        secretKeyEnv: string;
-        bucket?: string | undefined;
-        region?: string | undefined;
-        keyPrefix?: string | undefined;
-        presignTtlSec?: number | undefined;
-    } | undefined;
-}, {
-    provider: "k8s";
-    image: string;
-    memory?: string | undefined;
-    cpu?: string | undefined;
-    mountPath?: string | undefined;
-    timeoutMs?: number | undefined;
-    apiUrl?: string | undefined;
-    tokenEnv?: string | undefined;
-    caCertEnv?: string | undefined;
-    insecureTls?: boolean | undefined;
-    namespace?: string | undefined;
-    runtimeClass?: string | undefined;
-    s3Snapshot?: {
-        endpoint: string;
-        accessKeyEnv: string;
-        secretKeyEnv: string;
-        bucket?: string | undefined;
-        region?: string | undefined;
-        keyPrefix?: string | undefined;
-        presignTtlSec?: number | undefined;
-    } | undefined;
-}>, z.ZodObject<{
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
     provider: z.ZodLiteral<"ssh">;
-    host: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+    host: z.ZodString;
     port: z.ZodOptional<z.ZodNumber>;
-    username: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
-    /** env-NAME holding the SSH private key (service: SSH_PRIVATE_KEY). NEVER the key value. */
-    privateKeyEnv: z.ZodEffects<z.ZodString, string, string>;
-    mountPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-}, "strip", z.ZodTypeAny, {
-    host: string;
-    provider: "ssh";
-    username: string;
-    privateKeyEnv: string;
-    port?: number | undefined;
-    mountPath?: string | undefined;
-}, {
-    host: string;
-    provider: "ssh";
-    username: string;
-    privateKeyEnv: string;
-    port?: number | undefined;
-    mountPath?: string | undefined;
-}>, z.ZodObject<{
+    username: z.ZodString;
+    privateKeyEnv: z.ZodString;
+    mountPath: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
     provider: z.ZodLiteral<"adb">;
-    serial: z.ZodEffects<z.ZodString, string, string>;
-    adbPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    mountPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-}, "strip", z.ZodTypeAny, {
-    provider: "adb";
-    serial: string;
-    mountPath?: string | undefined;
-    adbPath?: string | undefined;
-}, {
-    provider: "adb";
-    serial: string;
-    mountPath?: string | undefined;
-    adbPath?: string | undefined;
-}>]>;
+    serial: z.ZodString;
+    adbPath: z.ZodOptional<z.ZodString>;
+    mountPath: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "provider">;
 export type RemoteExecSpec = z.infer<typeof RemoteExecSpec>;

package/dist/remote-exec.js

@@ -17,7 +17,8 @@
  * vocabulary; `test/execution-lanes-7.0.0.test.ts` pins `provider ⊆ EXECUTION_LANE_WORDS`, at runtime and at compile time).
  * The `remote-docker` variant was DELETED (zero aliases): no engine read point ever turned that word into a running lane
  * (the engine refuses `REMOTE_EXEC=remote-docker` at boot and only warned "unwired" when this file named it). A remote
- * docker daemon is the `local-docker` lane pointed at it (`DOCKER_HOST` — in a WorkerSpec, `runtime.execution.coords`).
+ * docker daemon is the `local-docker` lane pointed at it (`DOCKER_HOST` — in a WorkerSpec, `runtime.execution.coords`); the word
+ * itself sits in the lane-word tombstone `RETIRED_LANE_WORDS`, so a file still naming it is refused with that way out.
  *
  * SECRET BOUNDARY (identical to the rest of the contract): every secret VALUE the consumer reads from its own
  * env (E2B_API_KEY, K8S_TOKEN, SSH_PRIVATE_KEY, MINIO_*) is carried here as an env-NAME ref (the `ENV_NAME` regex
@@ -26,7 +27,9 @@
  * ONLY; the service owns the adapter implementations.
  */
 import { z } from "zod";
+import { INTEGER } from "./integer.js";
 import { ENV_NAME, K8S_QUANTITY, NON_SECRET_URL, TCP_PORT, containsSecretToken, hasNul } from "./types.js";
+import { retiredLaneWordRefusal } from "./execution-lanes.js";
 /** A non-empty exec-bound string (an image / path / shell / arg the adapter feeds to spawn()/fs). Rejects a NUL
  *  byte uniformly — a NUL validates here but makes Node throw at spawn/boot (fail-OPEN → runtime crash). R20. */
 const execStr = z.string().min(1).refine((s) => !hasNul(s), "must not contain a NUL byte");
@@ -56,7 +59,7 @@ export const RemoteExecSpec = z.discriminatedUnion("provider", [
         shell: execStr.optional(),
         /** Per-COMMAND timeout (ms) for the host lane — host is long-lived so this bounds a single exec, not the
          *  task (mirrors e2b/k8s `timeoutMs`; = the worker service's `commandTimeoutMs`). Absent = adapter default. */
-        commandTimeoutMs: z.number().int().positive().optional(),
+        commandTimeoutMs: INTEGER.positive().optional(),
     }),
     // ── local-docker: containers on this machine's docker (isolated; enables parallel fan-out). No secrets
     //    (local docker.sock). Service implements this fast-follow after host.
@@ -68,9 +71,9 @@ export const RemoteExecSpec = z.discriminatedUnion("provider", [
         apiKeyEnv: ENV_NAME,
         /** E2B template id (service: E2B_TEMPLATE). */
         template: execStr.optional(),
-        timeoutMs: z.number().int().positive().optional(),
+        timeoutMs: INTEGER.positive().optional(),
         /** Idle/liveness bound for a command (service: E2B_LIVENESS_MS, the [49] hang-fix). */
-        livenessMs: z.number().int().positive().optional(),
+        livenessMs: INTEGER.positive().optional(),
         allowInternetAccess: z.boolean().optional(),
         /** Which of THIS process's env-NAMEs to forward into the sandbox (service: E2B_SANDBOX_ENV, a CSV of NAMEs). */
         sandboxEnv: z.array(ENV_NAME).optional(),
@@ -90,7 +93,7 @@ export const RemoteExecSpec = z.discriminatedUnion("provider", [
         namespace: execStr.optional(),
         runtimeClass: execStr.optional(),
         mountPath: execStr.optional(),
-        timeoutMs: z.number().int().positive().optional(),
+        timeoutMs: INTEGER.positive().optional(),
         /** Sandbox pod resource limits (service: K8S_MEMORY / K8S_CPU; adapter defaults 2Gi / 1 cpu). */
         memory: K8S_QUANTITY.optional(),
         cpu: K8S_QUANTITY.optional(),
@@ -105,7 +108,7 @@ export const RemoteExecSpec = z.discriminatedUnion("provider", [
             secretKeyEnv: ENV_NAME,
             region: execStr.optional(),
             keyPrefix: execStr.optional(),
-            presignTtlSec: z.number().int().positive().optional(),
+            presignTtlSec: INTEGER.positive().optional(),
         })
             .optional(),
     }),
@@ -128,4 +131,7 @@ export const RemoteExecSpec = z.discriminatedUnion("provider", [
         adbPath: execStr.optional(),
         mountPath: execStr.optional(),
     }),
-]);
+], {
+    // A retired lane word as `provider` (no matching discriminator) gets the tombstone's way out; any other miss keeps zod's sentence.
+    error: (iss) => (iss.code === "invalid_union" && iss.input !== null && typeof iss.input === "object" ? retiredLaneWordRefusal(iss.input.provider) : undefined),
+});

package/dist/resolve-roster.d.ts

@@ -1,13 +1,17 @@
 /**
  * Per-worker roster resolution (the multi-roster design note). Turns the GLOBAL effective config + a worker name
  * into THAT worker's effective config: its `models` domain is the roster's view (model subset + role-map +
- * @-allowlist override), everything else stays global. The `rosters` domain is control-plane-only and is
+ * `atMention` override), everything else stays global. The `rosters` domain is control-plane-only and is
  * always stripped from the wire payload (no /effective consumer reads it).
  *
  * Pure (no I/O) → unit-testable. Tolerant of dangling refs (unknown worker / missing roster → global
- * fallback); strict referential integrity is enforced at PUT time (the [domain] route), not here.
+ * fallback; a roster entry naming no catalog model is dropped) — but not silent (11.0.0, S-1066 ③): whether a reference resolves
+ * is THE judge's call ({@link danglingRefs}, the same one the write seat refuses with), and the dangling references this
+ * resolution consulted come back as {@link ResolvedEffective.refIssues}. Strict refusal stays at PUT time (`refIntegrityIssues`);
+ * a local `config.d` never passes a write seat, which is why the read side still has to drop.
  */
-import type { EffectiveConfig, EffectiveWire, ModelRole, RoleTarget, RosterEntry } from "./types.js";
+import type { AtMention, EffectiveConfig, EffectiveWire, ModelRole, RoleTarget, RosterEntry } from "./types.js";
+import { type RefIssue } from "./cross-domain.js";
 /** primaryModel 标记喂的角色族(§3)。 */
 export declare const ROSTER_PRIMARY_ROLES: readonly ["default", "team", "synthesize"];
 /** cheapModel 标记喂的角色族(§3)。 */
@@ -16,6 +20,12 @@ export declare const ROSTER_CHEAP_ROLES: readonly ["subagent", "summarize"];
  *  models.roles(合并点见 {@link resolveEffectiveForWorker})。wire 形状不变——service 零改仍兼容,
  *  收敛后直接读标记亦可(effective 的 rosters 域不上 wire,标记经此物化进 models.roles)。 */
 export declare function rosterMarkerRoles(r: Pick<RosterEntry, "primaryModel" | "cheapModel">): Partial<Record<ModelRole, RoleTarget>>;
+/**
+ * 「`@` 能点名哪些模型」收窄到一组**可用**模型名上(纯函数;一只读法 —— roster 解析与任何别的收窄面,如按 principal 收窄,都调它)。
+ * `all` / `none` 原样;`only` 剔掉不在 `available` 里的名,剔空 ⇒ `{mode:"none"}`(管理员只许那几个,而这里一个都没有 = 一个都不许;
+ * 11.0.0 之前的数组形表达不了这一态,只好原样留着悬空名单,让消费方的成员判据兜底)。没有任何名被剔 ⇒ 返回**原对象**。
+ */
+export declare function narrowAtMention(atMention: AtMention, available: ReadonlySet<string>): AtMention;
 export interface ResolvedEffective {
     /** The wire payload: `models` resolved for the worker, `rosters` stripped, `skills` shipped as a manifest. */
     config: EffectiveWire;
@@ -24,5 +34,10 @@ export interface ResolvedEffective {
     /** Quoted ETag. Global path = `"v<version>"` (today's behaviour). Scoped path = content hash (excludes
      *  version/updatedAt) so an unrelated roster change at a new version doesn't churn this worker's cache. */
     etag: string;
+    /** The dangling references this resolution consulted, as THE judge ({@link danglingRefs}) sees them (11.0.0, S-1066 ③): the
+     *  worker's own roster reference and every model reference of its roster. Each is something the resolution left out (a roster
+     *  that does not exist ⇒ global fallback; a roster model / role / marker / @-name naming no catalog model ⇒ dropped). A caller
+     *  logs them (or surfaces them); before 11.0.0 they vanished silently. Global pull (no worker) ⇒ empty. */
+    refIssues: readonly RefIssue[];
 }
 export declare function resolveEffectiveForWorker(eff: EffectiveConfig, worker: string | null | undefined): ResolvedEffective;

package/dist/resolve-roster.js

@@ -1,10 +1,11 @@
 import { stableHash } from "./hash.js";
+import { danglingRefs } from "./cross-domain.js";
 import { toSkillsManifest } from "./skills-manifest.js";
 // ── 主/cheap 角色标记语义(0.6.3, E3)────────────────────────────────
 // service 现有 ModelRoles 口径:default/team/synthesize→主、subagent/summarize→cheap。1.8.0 起 `classifier`/`consolidate`
 // 同 `verifier` 一样**不派生**(归 cheap 会盖掉 models.tiers 档位与 core 兜底链)。`verifier` 刻意
 // 不派生(unset→core 的 default 兜底链,与 service 语义一致)。常量导出=单一语义源,service 收敛小单与
-// center 表单同源引用,别第二份。
+// web-admin 表单同源引用,别第二份。
 /** primaryModel 标记喂的角色族(§3)。 */
 export const ROSTER_PRIMARY_ROLES = ["default", "team", "synthesize"];
 /** cheapModel 标记喂的角色族(§3)。 */
@@ -22,6 +23,19 @@ export function rosterMarkerRoles(r) {
             out[role] = { model: r.cheapModel };
     return out;
 }
+/**
+ * 「`@` 能点名哪些模型」收窄到一组**可用**模型名上(纯函数;一只读法 —— roster 解析与任何别的收窄面,如按 principal 收窄,都调它)。
+ * `all` / `none` 原样;`only` 剔掉不在 `available` 里的名,剔空 ⇒ `{mode:"none"}`(管理员只许那几个,而这里一个都没有 = 一个都不许;
+ * 11.0.0 之前的数组形表达不了这一态,只好原样留着悬空名单,让消费方的成员判据兜底)。没有任何名被剔 ⇒ 返回**原对象**。
+ */
+export function narrowAtMention(atMention, available) {
+    if (atMention.mode !== "only")
+        return atMention;
+    const kept = atMention.models.filter((n) => available.has(n));
+    if (kept.length === atMention.models.length)
+        return atMention;
+    return kept.length > 0 ? { mode: "only", models: kept } : { mode: "none" };
+}
 /** Per-roster targeting (v2): keep items whose `rosters` is empty (= all rosters) or includes `rosterName`.
  *  `rosterName: null` = the unscoped/global pull → no filtering (ship all). */
 function forRoster(items, rosterName) {
@@ -32,10 +46,7 @@ function forRoster(items, rosterName) {
 /** Shape the wire payload: swap in the resolved `models`, empty the control-plane-only `rosters` domain
  *  (never shipped on the wire), ship `skills` as a manifest (content → contentHash), and filter
  *  skills + mcp by the worker's roster (`rosterName: null` on the global path = no filter).
- *  (The `access` domain was deleted outright in 0.6.0 — its strip here went with it, EXPERT-REDESIGN §9.
- *  `runtime` rides the wire as {@link EffectiveConfig}'s `runtime` slot — the LIMIT RESIDUE only (the 0.6.0
- *  governance 双写镜像 was withdrawn in 0.7.1; the transitional `RuntimeWire` alias deleted in #282 件3) —
- *  built upstream in buildEffective; nothing to reshape here.) */
+ *  (The `access` domain was deleted outright in 0.6.0 — its strip here went with it, EXPERT-REDESIGN §9.) */
 function shipped(eff, models, rosterName) {
     return {
         ...eff,
@@ -50,22 +61,23 @@ function shipped(eff, models, rosterName) {
 }
 export function resolveEffectiveForWorker(eff, worker) {
     if (!worker) {
-        return { config: shipped(eff, eff.models, null), rosterLabel: "global", etag: `"v${eff.version}"` };
+        return { config: shipped(eff, eff.models, null), rosterLabel: "global", etag: `"v${eff.version}"`, refIssues: [] };
     }
     const w = eff.workers.workers.find((x) => x.name === worker);
     const roster = w?.roster ? eff.rosters.rosters.find((r) => r.name === w.roster) : undefined;
+    // THE judge's conclusion, narrowed to the references this resolution reads: the worker's, and its roster's.
+    const refIssues = danglingRefs(eff).filter((i) => (i.referrer.domain === "workers" && i.referrer.name === worker) || (roster !== undefined && i.referrer.domain === "rosters" && i.referrer.name === roster.name));
     if (!roster) {
-        // unknown worker / worker without a roster / dangling roster ref → global fallback (diagnosable).
-        return { config: shipped(eff, eff.models, null), rosterLabel: "global(fallback)", etag: `"v${eff.version}"` };
+        // unknown worker / worker without a roster / dangling roster ref → global fallback (diagnosable; the dangling ref is in refIssues).
+        return { config: shipped(eff, eff.models, null), rosterLabel: "global(fallback)", etag: `"v${eff.version}"`, refIssues };
     }
     const allow = roster.models.length ? new Set(roster.models) : null; // empty roster.models = full catalog
     const resolvedModels = allow ? eff.models.models.filter((m) => allow.has(m.name)) : eff.models.models;
-    // Defence-in-depth: the shipped @-allowlist must only name models actually in this worker's
-    // set — otherwise a roster that restricts `models` but keeps a stale allowlist ships an inconsistent config.
-    // Validation also blocks this at PUT, but filter here so resolution is self-consistent regardless. Keep
-    // `undefined` (no override + no global) as-is = "all enabled models are @-mentionable".
+    // Defence-in-depth: the shipped `atMention` must only name models actually in this worker's set — otherwise a
+    // roster that restricts `models` but keeps a stale `only` list ships an inconsistent config. Validation also blocks
+    // this at PUT, but narrow here so resolution is self-consistent regardless ({@link narrowAtMention}). A roster
+    // without its own `atMention` inherits the global one.
     const finalNames = new Set(resolvedModels.map((m) => m.name));
-    const srcAllowlist = roster.atModelAllowlist ?? eff.models.atModelAllowlist;
     // Same defence for `roles` as for the @-allowlist (the MORE load-bearing one — roles drive real model
     // selection, not just @-mention). A `{model}`-form role pointing at a model NOT in this worker's set (an
     // inherited global default under a `models` subset, or a stale role after a catalog deletion — PUT does no
@@ -80,30 +92,21 @@ export function resolveEffectiveForWorker(eff, worker) {
     // after a catalog change still falls through the dangling-{model} drop below (defence-in-depth).
     const srcRoles = { ...eff.models.roles, ...rosterMarkerRoles(roster), ...(roster.roles ?? {}) };
     const roles = Object.fromEntries(Object.entries(srcRoles).filter(([, t]) => !(t && "model" in t) || finalNames.has(t.model)));
-    // @-allowlist: drop names not in this worker's model set (consistency) — BUT if a NON-EMPTY allowlist would
-    // filter to EMPTY (the worker exposes none of the allowlisted models), DON'T ship `[]`: empty means "ALL
-    // @-mentionable" (contract, types.ts), which would INVERT the admin's restriction into permissive. Keep the
-    // source instead — the consumer also gates on model membership, so nothing the worker lacks becomes
-    // mentionable; the restriction is preserved (a dangling allowlist name simply never matches). Round-5.
-    const filteredAllow = srcAllowlist?.filter((n) => finalNames.has(n));
     // 档位组(0.9.0):直通 + 逐档悬空-drop(照上面 roles 的 dangling-{model} drop 先例)——roster 收窄后
     // 组内绑到本 worker 模型集之外的档剔除,引擎侧「未绑档沿链降档 fail-open」接手,与 roles
-    // drop→core fallback 同构。组名/active 选择不动(组是 center 侧抽象,per-worker 只影响绑定可见性)。
+    // drop→core fallback 同构。组名/active 选择不动(组是 web-admin 侧抽象,per-worker 只影响绑定可见性)。
     const tierGroups = eff.models.tierGroups.map((g) => ({
         ...g,
         tiers: Object.fromEntries(Object.entries(g.tiers).filter(([, m]) => typeof m !== "string" || finalNames.has(m))),
     }));
     const models = {
         models: resolvedModels,
-        // 结构级 default(0.10.11):直通 + 集外悬空-drop(照下方 roles 的 dangling-{model} drop 先例)——
-        // roster 收窄后 default 指到本 worker 模型集之外 ⇒ 剔除,消费方 fallback 链(roles/档位)接手。
-        default: eff.models.default !== undefined && finalNames.has(eff.models.default) ? eff.models.default : undefined,
         roles,
-        atModelAllowlist: srcAllowlist && srcAllowlist.length > 0 && filteredAllow && filteredAllow.length === 0 ? srcAllowlist : filteredAllow,
+        atMention: narrowAtMention(roster.atMention ?? eff.models.atMention, finalNames),
         tierGroups,
         activeTierGroup: eff.models.activeTierGroup,
     };
     const config = shipped(eff, models, roster.name);
     const { version: _v, updatedAt: _u, ...content } = config;
-    return { config, rosterLabel: roster.name, etag: `"${stableHash(content)}"` };
+    return { config, rosterLabel: roster.name, etag: `"${stableHash(content)}"`, refIssues };
 }

package/dist/retired-envs.d.ts

@@ -0,0 +1,24 @@
+/** 一行墓碑。族词在第三元;`replaced` 多一元「值语义怎么变了」。 */
+export type RetiredEnv = readonly [old: string, to: string, kind: "renamed"] | readonly [old: string, to: string, kind: "replaced", why: string] | readonly [old: string, why: string, kind: "removed"];
+export type RetiredEnvKind = RetiredEnv[2];
+/** 墓碑拒启码(机读;拒句方括号里)。 */
+export declare const RETIRED_ENV_REFUSAL_CODE = "config.env_key_retired";
+export declare const RETIRED_ENVS: readonly RetiredEnv[];
+/** 墓碑表的 wire 投影一行(目录 wire 的 `retired[]`):按族定形 —— renamed 只带 `replacement`;replaced 带 `replacement` + `reason`
+ *  (值语义怎么变了);removed 只带 `reason`(能力为什么没了)。 */
+export interface RetiredEnvWire {
+    readonly name: string;
+    readonly kind: RetiredEnvKind;
+    readonly replacement?: string;
+    readonly reason?: string;
+}
+/** 墓碑表 → wire 投影(纯数据)。**同一张表、同序**;族是闭集,穷举 switch(加一族不写这里 ⇒ 编译红)。 */
+export declare function buildRetiredEnvWire(): RetiredEnvWire[];
+/**
+ * 读给它的 env 记录,判有没有退役名在场 —— 拒启句的**唯一铸点**:有 ⇒ 整句(带 {@link RETIRED_ENV_REFUSAL_CODE};族序 renamed →
+ * replaced → removed,族内按表序;只点名键、从不回显值);没有 ⇒ `undefined`。空串 = 未设。
+ *
+ * 纯函数:不读 `process.env`(读方传自己要判的那份 env —— 引擎起服传进程 env,壳传它要交给子进程的那份,web-admin 传它要渲染的
+ * worker env);拒不拒(抛 / 退出码 / 400)是读方的事。
+ */
+export declare function retiredEnvRefusal(env: Readonly<Record<string, string | undefined>>): string | undefined;