@sema-agent/settings-schema 14.7.0 → 15.0.0

package/dist/execution-lane-index.d.ts

@@ -22,6 +22,12 @@ export interface LaneEnvOwner {
 }
 /** 车道 env 名 → 归属。四栏两两不交、跨车道不交(`test/execution-lanes-7.0.0.test.ts` 钉),所以每个名恰好一个归属。 */
 export declare const LANE_ENV_OWNER: ReadonlyMap<string, LaneEnvOwner>;
+/**
+ * 必需坐标的值算不算「缺」的**唯一判官**:空串,或只含空白(`String.prototype.trim` 认的空白:空格 / 制表 / 换行 / 不换行空格 / 字节序标记 …),都按缺席论。
+ * 写闸对所有车道、所有必需坐标同判这一只;它只判「是不是空白」,不 trim 值、不管值的格式(格式不在这一条的范围)。可选坐标不走它 ——
+ * 个别可选坐标上空串有语义(如 `K8S_RUNTIME_CLASS` 的空串 = 不用 Kata)。
+ */
+export declare function isBlankCoordinate(value: string): boolean;
 /** 一个车道 env 名在 WorkerSpec 里的**唯一写位**(保留键的拒因指路用它)。 */
 export declare function laneEnvSeat(name: string, owner: LaneEnvOwner): string;
 /** 车道块的两个特殊键(不在车道表里,但归车道块:迁移把 `REMOTE_EXEC` 搬成 `runtime.execution.lane`、`REQUIRE_EXECUTION_LANE` 丢弃)。 */

package/dist/execution-lane-index.js

@@ -24,6 +24,14 @@ export const LANE_ENV_OWNER = new Map(EXECUTION_LANES.flatMap((r) => {
     const own = (names, secret, required) => names.map((k) => [k, { lane: r.lane, secret, required }]);
     return [...own(r.requiredEnv, false, true), ...own(r.optionalEnv, false, false), ...own(r.requiredSecretEnv, true, true), ...own(r.optionalSecretEnv, true, false)];
 }));
+/**
+ * 必需坐标的值算不算「缺」的**唯一判官**:空串,或只含空白(`String.prototype.trim` 认的空白:空格 / 制表 / 换行 / 不换行空格 / 字节序标记 …),都按缺席论。
+ * 写闸对所有车道、所有必需坐标同判这一只;它只判「是不是空白」,不 trim 值、不管值的格式(格式不在这一条的范围)。可选坐标不走它 ——
+ * 个别可选坐标上空串有语义(如 `K8S_RUNTIME_CLASS` 的空串 = 不用 Kata)。
+ */
+export function isBlankCoordinate(value) {
+    return value.trim() === "";
+}
 /** 一个车道 env 名在 WorkerSpec 里的**唯一写位**(保留键的拒因指路用它)。 */
 export function laneEnvSeat(name, owner) {
     return `runtime.execution.${owner.secret ? "secretRefs" : "coords"}.${name}`;

package/dist/execution-lanes.d.ts

@@ -17,7 +17,8 @@
  *  · `tenantSeparation`:同文件 `executionLaneCaps` 每臂的 `tenantSeparation` 位(:209 host / :230 e2b / :249 k8s /
  *    :269 ssh / :288 adb / :308 local-docker / :327 device)。`tenantSeparationBasis`(11.0.0):分租户的那几臂凭什么分 ——
  *    e2b / k8s / local-docker 每任务一只隔离目标(`isolation`),device 是发起者自己的设备(`principal-binding`)。
- *  · `requiredEnv ∪ requiredSecretEnv`:`src/config.ts` `REQUIRED_ENVS_BY_LANE`(:1054)逐字;按 `src/config-catalog.ts`
+ *  · `requiredEnv ∪ requiredSecretEnv`:这条车道缺了就起不了服的键。最初逐字抄自 `src/config.ts` 的手写表 `REQUIRED_ENVS_BY_LANE`(:1054),
+ *    那张手写表已退役 —— 服务端的必需 env 门按本表行的这两栏拒启,部署面的车道清单读同一行,所以今天**本表就是**必需键的唯一来源。按 `src/config-catalog.ts`
  *    该键那一行的值类型分栏 —— 类型 `secret` / `opaque`(目录自己「绝不回显值」的两类)进 `*SecretEnv`,其余进 `*Env`。
  *  · `optionalEnv ∪ optionalSecretEnv`:`src/config.ts` `parseOrchestrationDomain` 的 `REMOTE_EXEC` 三元链里**该车道那一臂**
  *    读的 env 名(:3925 e2b / :3957 k8s / :3991 ssh / :4006 adb / :4014 host / :4026 local-docker / :4055 device;

package/dist/execution-lanes.js

@@ -17,7 +17,8 @@
  *  · `tenantSeparation`:同文件 `executionLaneCaps` 每臂的 `tenantSeparation` 位(:209 host / :230 e2b / :249 k8s /
  *    :269 ssh / :288 adb / :308 local-docker / :327 device)。`tenantSeparationBasis`(11.0.0):分租户的那几臂凭什么分 ——
  *    e2b / k8s / local-docker 每任务一只隔离目标(`isolation`),device 是发起者自己的设备(`principal-binding`)。
- *  · `requiredEnv ∪ requiredSecretEnv`:`src/config.ts` `REQUIRED_ENVS_BY_LANE`(:1054)逐字;按 `src/config-catalog.ts`
+ *  · `requiredEnv ∪ requiredSecretEnv`:这条车道缺了就起不了服的键。最初逐字抄自 `src/config.ts` 的手写表 `REQUIRED_ENVS_BY_LANE`(:1054),
+ *    那张手写表已退役 —— 服务端的必需 env 门按本表行的这两栏拒启,部署面的车道清单读同一行,所以今天**本表就是**必需键的唯一来源。按 `src/config-catalog.ts`
  *    该键那一行的值类型分栏 —— 类型 `secret` / `opaque`(目录自己「绝不回显值」的两类)进 `*SecretEnv`,其余进 `*Env`。
  *  · `optionalEnv ∪ optionalSecretEnv`:`src/config.ts` `parseOrchestrationDomain` 的 `REMOTE_EXEC` 三元链里**该车道那一臂**
  *    读的 env 名(:3925 e2b / :3957 k8s / :3991 ssh / :4006 adb / :4014 host / :4026 local-docker / :4055 device;
@@ -71,16 +72,17 @@ const LANE_ROWS = {
         optionalSecretEnv: ["E2B_SANDBOX_ENV"],
     },
     /** server `config.ts` :3957 臂;`K8S_TOKEN` 目录 :412 类型 `secret`、`K8S_CA_CERT_B64` :403 类型 `opaque`;
-     *  `execution-lane-caps.ts` :249 `supported`(每任务一只 pod)。`MINIO_*` 刻意不收(见文件头)。 */
+     *  `execution-lane-caps.ts` :249 `supported`(每任务一只 pod)。`MINIO_*` 刻意不收(见文件头)。
+     *  `K8S_NAMESPACE`(沙箱 pod 所在的命名空间)是**必需**坐标:pod 住哪是部署自己的声明,表不替它留缺省;服务端的必需 env 门按本行 `requiredEnv` 拒启,
+     *  所以这里没有「可选」一说。 */
     k8s: {
         tenantSeparation: "supported",
         tenantSeparationBasis: "isolation",
-        requiredEnv: ["K8S_SANDBOX_IMAGE"],
+        requiredEnv: ["K8S_SANDBOX_IMAGE", "K8S_NAMESPACE"],
         requiredSecretEnv: [],
         optionalEnv: [
             "K8S_API_URL",
             "K8S_INSECURE_TLS",
-            "K8S_NAMESPACE",
             "K8S_RUNTIME_CLASS",
             "K8S_MOUNT_PATH",
             "K8S_TIMEOUT_MS",

package/dist/fleet.d.ts

@@ -163,9 +163,15 @@ export type RestartSignal = z.infer<typeof RestartSignal>;
  *    `config.model_refused_name_minted` — a refused entry's name would be re-minted onto another entry by the
  *    tier / alias expansion (or the dropped-entry carrier cannot prove it would not be);
  *    `config.model_route_endpoint_missing` — an openai-compatible route of the candidate resolves to no endpoint;
- *    `config.gateway_fallback_without_primary` — fallback gateways are declared without a primary.
- *    Source (engine): the first two in `src/model-entry-refusal.ts`, the last two in `src/model-route-endpoint.ts:40,42`
- *    (invariant `model-route-endpoint`, judged by the model-plane stage in `src/config-center/apply-effective.ts:664-665`).
+ *    `config.gateway_fallback_without_primary` — fallback gateways are declared without a primary;
+ *    `config.catalog_replaces_env_models` ({@link CATALOG_REPLACES_ENV_MODELS_CODE}) — on the LOCAL config leg, a candidate that
+ *    manages the model plane would replace a declared env model table (`MODEL_ID` …) while the config root's decision document
+ *    (`config.env-models.json`, read by `readEnvModelsDecision`) does not say `replaced` — the env models keep serving;
+ *    `config.summarize_model_missing` ({@link SUMMARIZE_MODEL_MISSING_CODE}) — the summarize role, which every task resolves,
+ *    would land on no servable entry (every task would be refused after adoption).
+ *    Source (engine): the first two in `src/model-entry-refusal.ts`, the next two in `src/model-route-endpoint.ts:40,42`
+ *    (invariant `model-route-endpoint`, judged by the model-plane stage in `src/config-center/apply-effective.ts:664-665`); the
+ *    last two are named HERE first (the code is a contract word: this package names it and exports the two constants for the engine to read; the engine does not mint them today).
  */
 export declare const MODEL_ENTRY_REFUSAL_CODES: readonly ["config.model_no_brain", "config.model_entry_invalid"];
 export declare const ModelEntryRefusalCode: z.ZodEnum<{
@@ -173,8 +179,14 @@ export declare const ModelEntryRefusalCode: z.ZodEnum<{
     "config.model_entry_invalid": "config.model_entry_invalid";
 }>;
 export type ModelEntryRefusalCode = z.infer<typeof ModelEntryRefusalCode>;
-export declare const MODEL_PLANE_REFUSAL_CODES: readonly ["config.default_model_missing", "config.model_refused_name_minted", "config.model_route_endpoint_missing", "config.gateway_fallback_without_primary"];
+/** The env-model-table confirmation gate's group-refusal code (see {@link MODEL_PLANE_REFUSAL_CODES}). */
+export declare const CATALOG_REPLACES_ENV_MODELS_CODE: "config.catalog_replaces_env_models";
+/** The summarize invariant's group-refusal code (see {@link MODEL_PLANE_REFUSAL_CODES}); a writer's plan answers `fix_first` with it. */
+export declare const SUMMARIZE_MODEL_MISSING_CODE: "config.summarize_model_missing";
+export declare const MODEL_PLANE_REFUSAL_CODES: readonly ["config.default_model_missing", "config.model_refused_name_minted", "config.model_route_endpoint_missing", "config.gateway_fallback_without_primary", "config.catalog_replaces_env_models", "config.summarize_model_missing"];
 export declare const ModelPlaneRefusalCode: z.ZodEnum<{
+    "config.catalog_replaces_env_models": "config.catalog_replaces_env_models";
+    "config.summarize_model_missing": "config.summarize_model_missing";
     "config.default_model_missing": "config.default_model_missing";
     "config.model_refused_name_minted": "config.model_refused_name_minted";
     "config.model_route_endpoint_missing": "config.model_route_endpoint_missing";
@@ -566,9 +578,15 @@ export declare const FLEET_ADVERTISE_ADDRESS_ENV = "FLEET_ADVERTISE_ADDRESS";
  *  - {@link SERVING_LEASE_TTL_DEFAULT_MS} — the lease length when the operator sets none (10 min).
  *  - {@link SERVING_LEASE_TTL_FLOOR_MS} — the shortest lease there is: a configured TTL below it is treated as it (1 min),
  *    the same way {@link DRAIN_GRACE_FLOOR_MS} protects a fat-fingered grace.
- *  - {@link SERVING_LEASE_DRIFT_MARGIN_MS} — web-admin's clock-skew allowance: it adds this to a lease's recorded expiry
- *    before it counts that lease as over. It is DERIVED from {@link DEFAULT_HEARTBEAT_MS} (one cadence, one number), never a
- *    second constant that could drift from it.
+ *  - {@link SERVING_LEASE_DRIFT_MARGIN_MS} — the clock-skew allowance for reading a lease deadline an engine REPORTS. The engine
+ *    says `EngineSignal.leaseUntil` (epoch ms: its own computation from the granted `ttlMs`, on its own clock); a reader that asks
+ *    "does this member's lease still hold?" compares that instant with ITS OWN now — two clocks that need not agree — so it counts
+ *    the lease as held only while `leaseUntil >= now + SERVING_LEASE_DRIFT_MARGIN_MS`. That is the conservative direction: a skew
+ *    up to the margin can make a lease that still holds read as short, never one that is over read as held. It is an allowance for
+ *    reading a reported deadline, not part of the lease clock: the engine enforces the lease on its own monotonic clock and
+ *    web-admin keeps its own expiry from its store time (see {@link ServingLeaseResponse}) — the two sides never compare clocks
+ *    to enforce. It is DERIVED from {@link DEFAULT_HEARTBEAT_MS} (one cadence, one number), never a second constant that could
+ *    drift from it.
  */
 export declare const SERVING_LEASE_TTL_DEFAULT_MS = 600000;
 export declare const SERVING_LEASE_TTL_FLOOR_MS = 60000;

package/dist/fleet.js

@@ -231,17 +231,29 @@ function readSignalBody(body, pick, schema) {
  *    `config.model_refused_name_minted` — a refused entry's name would be re-minted onto another entry by the
  *    tier / alias expansion (or the dropped-entry carrier cannot prove it would not be);
  *    `config.model_route_endpoint_missing` — an openai-compatible route of the candidate resolves to no endpoint;
- *    `config.gateway_fallback_without_primary` — fallback gateways are declared without a primary.
- *    Source (engine): the first two in `src/model-entry-refusal.ts`, the last two in `src/model-route-endpoint.ts:40,42`
- *    (invariant `model-route-endpoint`, judged by the model-plane stage in `src/config-center/apply-effective.ts:664-665`).
+ *    `config.gateway_fallback_without_primary` — fallback gateways are declared without a primary;
+ *    `config.catalog_replaces_env_models` ({@link CATALOG_REPLACES_ENV_MODELS_CODE}) — on the LOCAL config leg, a candidate that
+ *    manages the model plane would replace a declared env model table (`MODEL_ID` …) while the config root's decision document
+ *    (`config.env-models.json`, read by `readEnvModelsDecision`) does not say `replaced` — the env models keep serving;
+ *    `config.summarize_model_missing` ({@link SUMMARIZE_MODEL_MISSING_CODE}) — the summarize role, which every task resolves,
+ *    would land on no servable entry (every task would be refused after adoption).
+ *    Source (engine): the first two in `src/model-entry-refusal.ts`, the next two in `src/model-route-endpoint.ts:40,42`
+ *    (invariant `model-route-endpoint`, judged by the model-plane stage in `src/config-center/apply-effective.ts:664-665`); the
+ *    last two are named HERE first (the code is a contract word: this package names it and exports the two constants for the engine to read; the engine does not mint them today).
  */
 export const MODEL_ENTRY_REFUSAL_CODES = ["config.model_no_brain", "config.model_entry_invalid"];
 export const ModelEntryRefusalCode = z.enum(MODEL_ENTRY_REFUSAL_CODES);
+/** The env-model-table confirmation gate's group-refusal code (see {@link MODEL_PLANE_REFUSAL_CODES}). */
+export const CATALOG_REPLACES_ENV_MODELS_CODE = "config.catalog_replaces_env_models";
+/** The summarize invariant's group-refusal code (see {@link MODEL_PLANE_REFUSAL_CODES}); a writer's plan answers `fix_first` with it. */
+export const SUMMARIZE_MODEL_MISSING_CODE = "config.summarize_model_missing";
 export const MODEL_PLANE_REFUSAL_CODES = [
     "config.default_model_missing",
     "config.model_refused_name_minted",
     "config.model_route_endpoint_missing",
     "config.gateway_fallback_without_primary",
+    CATALOG_REPLACES_ENV_MODELS_CODE,
+    SUMMARIZE_MODEL_MISSING_CODE,
 ];
 export const ModelPlaneRefusalCode = z.enum(MODEL_PLANE_REFUSAL_CODES);
 /**
@@ -594,9 +606,15 @@ export const FLEET_ADVERTISE_ADDRESS_ENV = "FLEET_ADVERTISE_ADDRESS";
  *  - {@link SERVING_LEASE_TTL_DEFAULT_MS} — the lease length when the operator sets none (10 min).
  *  - {@link SERVING_LEASE_TTL_FLOOR_MS} — the shortest lease there is: a configured TTL below it is treated as it (1 min),
  *    the same way {@link DRAIN_GRACE_FLOOR_MS} protects a fat-fingered grace.
- *  - {@link SERVING_LEASE_DRIFT_MARGIN_MS} — web-admin's clock-skew allowance: it adds this to a lease's recorded expiry
- *    before it counts that lease as over. It is DERIVED from {@link DEFAULT_HEARTBEAT_MS} (one cadence, one number), never a
- *    second constant that could drift from it.
+ *  - {@link SERVING_LEASE_DRIFT_MARGIN_MS} — the clock-skew allowance for reading a lease deadline an engine REPORTS. The engine
+ *    says `EngineSignal.leaseUntil` (epoch ms: its own computation from the granted `ttlMs`, on its own clock); a reader that asks
+ *    "does this member's lease still hold?" compares that instant with ITS OWN now — two clocks that need not agree — so it counts
+ *    the lease as held only while `leaseUntil >= now + SERVING_LEASE_DRIFT_MARGIN_MS`. That is the conservative direction: a skew
+ *    up to the margin can make a lease that still holds read as short, never one that is over read as held. It is an allowance for
+ *    reading a reported deadline, not part of the lease clock: the engine enforces the lease on its own monotonic clock and
+ *    web-admin keeps its own expiry from its store time (see {@link ServingLeaseResponse}) — the two sides never compare clocks
+ *    to enforce. It is DERIVED from {@link DEFAULT_HEARTBEAT_MS} (one cadence, one number), never a second constant that could
+ *    drift from it.
  */
 export const SERVING_LEASE_TTL_DEFAULT_MS = 600_000;
 export const SERVING_LEASE_TTL_FLOOR_MS = 60_000;

package/dist/index.d.ts

@@ -7,6 +7,9 @@ export * from "./execution-lanes.js";
 export * from "./url-shape.js";
 export * from "./url-credential.js";
 export * from "./default-model.js";
+export { catalogManagesModelPlane, enabledEntryCount } from "./catalog-manages.js";
+export { DEFAULT_MODEL_KEY, ENV_MODEL_TABLE_KEYS, buildEnvModelBaseline, envModelTableDeclared, envModelTableWriteRefusal, mintedCheapId, planEnvModelTableWrite, readEnvModelSlots, type EnvCheapSlot, type EnvModelBaseline, type EnvModelTableEntry, type EnvModelTableKey, type EnvModelTableLanding, type EnvModelTableReceipt, type EnvModelTableRoleRow, type EnvModelTableTarget, type EnvModelTableWriteInput, type EnvModelTableWriteIntent, type EnvModelTableWritePlan, type EnvRoleBinding, type EnvSnapshot, } from "./env-model-table.js";
+export { CONFIG_ROOT_DOCUMENTS, ENV_MODELS_DECISIONS, ENV_MODELS_DOCUMENT, ROOT_DOCUMENT_UNREADABLE_REASONS, envModelsDecisionTag, type ConfigRootDocument, type EnvModelsDecision, type EnvModelsDecisionWord, type MarkedMigrationId, type MigrationMarker, type RootDocumentUnreadableReason } from "./config-root-documents.js";
 export * from "./loopback.js";
 export * from "./hash.js";
 export * from "./sha256.js";
@@ -42,3 +45,5 @@ export * from "./mcp-server-policy.js";
 export * from "./ui-language.js";
 export * from "./control-and-bidi.js";
 export * from "./mcp-request-entry.js";
+export { REMOTE_MCP_SERVER_NAME_PREFIX } from "./mcp-server-name.js";
+export * from "./center-refs.js";

package/dist/index.js

@@ -7,6 +7,9 @@ export * from "./execution-lanes.js"; // 7.0.0 M-R2: the ONE lane / store vocabu
 export * from "./url-shape.js"; // 11.0.0: THE URL shape judge (httpUrlFlaws / httpUrlRule / isHierarchicalUrl), pure/browser-safe
 export * from "./url-credential.js"; // 14.5.0: THE "does this URL carry a credential" judge (findUrlCredential / findUrlUserinfo / URL_CREDENTIAL_REASONS / CREDENTIAL_PARAM_NAMES …), pure/browser-safe
 export * from "./default-model.js"; // 11.0.0: THE catalog-default resolver (roles.default → active tier ladder → fallback), pure/browser-safe
+export { catalogManagesModelPlane, enabledEntryCount } from "./catalog-manages.js"; // THE "does this models document manage the model plane" judge (raw half: at least one entry not explicitly disabled) + the log count it is derived from, pure/browser-safe
+export { DEFAULT_MODEL_KEY, ENV_MODEL_TABLE_KEYS, buildEnvModelBaseline, envModelTableDeclared, envModelTableWriteRefusal, mintedCheapId, planEnvModelTableWrite, readEnvModelSlots, } from "./env-model-table.js"; // the env model table (MODEL_ID / MODEL_CHEAP_ID) read once: readEnvModelSlots / envModelTableDeclared / buildEnvModelBaseline + the writer's plan planEnvModelTableWrite (receipt by id, confirmKey) + envModelTableWriteRefusal, pure/browser-safe (named: the env snapshot helper stays package-private)
+export { CONFIG_ROOT_DOCUMENTS, ENV_MODELS_DECISIONS, ENV_MODELS_DOCUMENT, ROOT_DOCUMENT_UNREADABLE_REASONS, envModelsDecisionTag } from "./config-root-documents.js"; // the config-root documents (config.env-models.json + the per-id migration marker config.migration.<id>.json): names + closed answer tables + the one tagged identity of a decision reading (envModelsDecisionTag); the readers / writer are in ./node
 export * from "./loopback.js"; // 11.0.0: the two「本机」predicates (auth relaxation — narrow / connection routing — wide), pure/browser-safe
 export * from "./hash.js";
 export * from "./sha256.js";
@@ -42,6 +45,8 @@ export * from "./mcp-server-policy.js"; // 13.0.0 (U6): mcpServerPolicyVerdict
 export * from "./ui-language.js"; // 13.0.0 (S-1592): the UI-language settings fragment (semaUiLanguage, en | zh, category ui, user settings) + readUiLanguage, pure/browser-safe
 export * from "./control-and-bidi.js"; // the one-line echo strip set (C0 + DEL + the 12 Bidi_Control code points) — CONTROL_AND_BIDI_CHARS (the class, as regex source text) + stripControlAndBidi / hasControlOrBidi, pure/browser-safe
 export * from "./mcp-request-entry.js"; // 14.0.0: the request-plane MCP entry judges (isUsableWireName / isContentOriginWord / readMcpIdentityHeaders / readRequestMcpTransport + the value-shape describers) — one reading for the service legs and the shell pre-check, pure/browser-safe
+export { REMOTE_MCP_SERVER_NAME_PREFIX } from "./mcp-server-name.js"; // the MCP server-name prefix reserved for the remote MCP servers a device executor offers (mount name = prefix + the executor's server name); the predicate and its sentence stay package-private — the request plane's MCP name judges (isUsableMcpServerName / describeBadMcpServerName) read them; the config plane's McpServerSpec.name accepts the prefix (refusing it would be a validation tightening — a major), pure/browser-safe
+export * from "./center-refs.js"; // resolveCenterRefs(refs, lookup) — THE center-roster reference resolver: one verdict word per member (missing_name / not_a_string / read_threw, CENTER_REF_FAULTS), one whole verdict (resolved / unresolved / refs_unreadable, CENTER_REFS_VERDICTS); the refs record is read by the public readPlainStringRecord, the lookup is the caller's, it reads no process.env; pure/browser-safe
 // NOTE: the Node-fs-backed helpers (FileConfigStore + the file editor) are NOT in this barrel — they pull
 // `node:fs`/`node:path` and would break a browser/client bundle that only wants the contract (e.g.
 // web-admin's client components import the zod types through here). Import them from the Node-only

package/dist/mcp-request-entry.d.ts

@@ -31,6 +31,16 @@ export declare function isUsableWireName(v: unknown): v is string;
  * (制表 / 换行这类控制空白在回显里被剥掉,所以看得出是空白靠这个种类词,不靠引号里的样子);两件事并存 ⇒ 一句说全(`N chars > 128, leading or trailing whitespace`)。
  */
 export declare function describeBadWireName(v: unknown): string;
+/**
+ * 这个 MCP 服务器名能用吗:{@link isUsableWireName} 再加一臂 —— 不在保留给设备执行端远程 MCP 服务器的 `remote-` 命名空间里(`./mcp-server-name`,字面前缀比较)。
+ * 只多这一臂:线上名的判据(非空、长界、首尾空白)一字不改,别的输入两只判官逐项同答。A2A 对端名只用 {@link isUsableWireName}(它的工具名前缀是 `a2a__`,不在这个命名空间里)。
+ */
+export declare function isUsableMcpServerName(v: unknown): v is string;
+/**
+ * 坏 MCP 服务器名的**可打印**摘要:线上名本身就坏 ⇒ 与 {@link describeBadWireName} 逐字同(长界这类线上名的事实先说,不被保留臂盖掉);
+ * 线上名好而落在保留命名空间里 ⇒ 引号形的回显加那一句原因。
+ */
+export declare function describeBadMcpServerName(v: unknown): string;
 /**
  * 在内容出处词表({@link MCP_CONTENT_ORIGINS})内吗。严判:非串与大小写不符(`"LOCAL"`)一律不在 —— 引擎的词是字面量联合、不做规范化;
  * 替它「宽容一下」等于自造第二份值域语义,而这条轴上宽容的方向恰好是**放宽信任**(把一个写坏的声明读成 `"local"`)。
@@ -46,7 +56,14 @@ export declare function readMcpIdentityHeaders(transport: Record<string, unknown
     principalHeader?: string;
     assertionHeader?: string;
 };
-/** 请求面一条 MCP 条目的传输形:引擎的传输形,http 形多一个承载的 `assertionHeader`(引擎的 http 传输没有这个座;交给引擎之前由消费方剥掉)。 */
+/**
+ * 请求面一条 MCP 条目的传输形。与引擎传输形的关系逐键一句(处置表,对拍 = 上游漂移门 ⑧):
+ *  · `kind` / `command` / `args` / `url` / `principalHeader` —— 与引擎同键同型;
+ *  · `env` / `headers` —— 请求带来的**字面件**:引擎的声明不带值(一台服务器的凭据头 / 子进程环境由部署的对端座每次发送时答),
+ *    所以这两把键交给引擎之前由消费方从声明里拿走、按它自己的对端座答;
+ *  · `assertionHeader` —— 本包承载,引擎的 http 传输没有这个座(交给引擎之前由消费方剥掉);
+ *  · 引擎的 `credentials`(不透明的凭据引用)—— 请求面不收:读器不读它。
+ */
 export type RequestMcpTransport = {
     kind: "stdio";
     command: string;
@@ -62,18 +79,18 @@ export type RequestMcpTransport = {
 /**
  * 条目内一处坏形:`path` = 条目内的键路径(`transport.url`),`reason` = 判官的原因句(只说形与词表,不回显值)。
  *
- * `env` / `headers` 这两张「名 → 串」记录上的坏形另带两格机读位,调用方分流不必解析句子:`fault` = 闭集词 ——
- *  · `not_plain_record`:这个键的值不是纯数据记录(不是对象 / 数组 / `null`,或不是朴素 JSON 对象 —— 原型链比座位的判据长:`Map`、`Set`、类实例);整张记录不交;
- *  · `member_not_string`:有一个成员的值不是串(或访问器抛了);整张记录不交,`member` 点名它;
+ * `env` / `headers` 这两张「名 → 串」记录上的坏形另带两格机读位,调用方分流不必解析句子:`fault` = 闭集词({@link PLAIN_STRING_RECORD_FAULTS},与公开的记录读器 {@link readPlainStringRecord} 同一张表)——
+ *  · `not_plain_record`:这个键的值不是纯数据记录(不是对象 / 数组 / `null`,或不是朴素 JSON 对象 —— 原型链比座位的判据长:`Map`、`Set`、类实例;读形状就抛的对象同);整张记录不交;
+ *  · `member_not_string`:有一个成员的值不是串,或它读不出(它的访问器抛了,或读它的描述符时代理陷阱抛了);整张记录不交,`member` 点名它,两种情形句子分说;
  *  · `member_name_reserved`:有一个成员叫 `__proto__`(引擎的声明收据拒这个名)。成员的值是串 ⇒ 只剔这个成员、其余照交,`path` 是成员级(`transport.env.__proto__`);
- *    成员的值也不是串 ⇒ 整张记录不交,`path` 是键级,句子一次说全两件事 —— 名坏优先、值坏并列,所以词仍是 `member_name_reserved`。
+ *    成员的值也不是串(或读不出)⇒ 整张记录不交,`path` 是键级,句子一次说全两件事 —— 名坏优先、值坏并列,所以词仍是 `member_name_reserved`。
  * `member` 是成员名的**回显形**(剥控制与双向字符、截 64 字加 `…`),可直接进日志与句子,不是回查原对象的键。其余的坏形(`args` / `url` / `principalHeader` / ……)两格都不带。
  */
 export interface McpEntryKeyIssue {
     readonly path: string;
     readonly reason: string;
     readonly member?: string;
-    readonly fault?: "not_plain_record" | "member_not_string" | "member_name_reserved";
+    readonly fault?: PlainStringRecordFault;
 }
 /** {@link readRequestMcpTransport} 的结果:`ok:false` = 硬坏形(这条 server 无从挂载);`ok:true` 的 `lost` = 读器**丢掉**的可选子键(server 照挂、少一个声明)。 */
 export type RequestMcpTransportRead = {
@@ -95,3 +112,38 @@ export type RequestMcpTransportRead = {
  * url 的拒句不回显值:它常规地带凭据(userinfo)。
  */
 export declare function readRequestMcpTransport(t: unknown): RequestMcpTransportRead;
+/**
+ * 引擎的声明收据不收的成员名(core `mcp-server-spec`:按赋值拷贝它会变成原型):JSON 文本铸得出这个**自有**键,对象字面量写不出。
+ * 公开,因为读器交出 `reservedMember: true` 时消费方要点名它 —— 名字只在这里定一次。
+ */
+export declare const PLAIN_STRING_RECORD_RESERVED_MEMBER = "__proto__";
+/**
+ * 「名 → 串」记录读不交(或交时点名保留名)的**原因词**,闭集,三个词、一张表:
+ * 整张一词(`not_plain_record`)· 成员级一词(`member_not_string`:值读成了别的种类,或读成员时抛了 —— 句子分说)· 名字级一词(`member_name_reserved`)。
+ * 词的意义逐词写在 {@link McpEntryKeyIssue}。消费方按词分派,不读句子;读器的读数 {@link PlainStringRecordRead} 与传输条目的机读位 {@link McpEntryKeyIssue} 的 `fault` 都由这一张表推出。
+ * 多一个词而消费方的穷尽 `switch` 不补 ⇒ 编译红(提货成本,不是静默)。
+ */
+export declare const PLAIN_STRING_RECORD_FAULTS: readonly ["not_plain_record", "member_not_string", "member_name_reserved"];
+export type PlainStringRecordFault = (typeof PLAIN_STRING_RECORD_FAULTS)[number];
+/**
+ * {@link readPlainStringRecord} 的读数:`ok:false` = 记录不交(`fault` = 原因词;`detail` 是接在 `must be a plain object of string values — ` 后面的句子;坏在某个成员时 `member` 点名它的回显形);
+ * `ok:true` = 交出去的纯数据副本,`reservedMember` = 记录里有一个名叫 {@link PLAIN_STRING_RECORD_RESERVED_MEMBER} 的成员(它没进副本)。
+ */
+export type PlainStringRecordRead = {
+    readonly ok: true;
+    readonly record: Record<string, string>;
+    readonly reservedMember: boolean;
+} | {
+    readonly ok: false;
+    readonly detail: string;
+    readonly fault: PlainStringRecordFault;
+    readonly member?: string;
+};
+/**
+ * 读一份「名 → 串」记录 —— **公开读口**:传输读器读 `env` / `headers` 用的就是它,消费方读自己的「名 → 串」记录(中心名册的引用表)调同一只,不抄镜像。从不抛。记录交不交:是朴素 JSON 对象(座位的判据,见 `./plain-json-object`:原型是 `null`,或原型自己的原型是 `null`;纯数据 —— `Map`、`Set`、类实例、建在原型上的记录都不是),
+ * 且每个成员的值都是串。成员 = `Object.getOwnPropertyNames` 的每一个名字(不可枚举的也算 —— 引擎的收据按全部自有属性名读),值经内核 `readKey` 读(一份描述符:数据属性取值,访问器调一次,不问 `get` 陷阱;访问器或描述符 trap 抛了同判为坏 —— 词与「值不是串」同是 `member_not_string`,句子说读不出)。
+ * 读原型与成员名时代理 trap 抛了 ⇒ 整张不交(读器对调用方递来的任何对象都不抛;`JSON` 存体里不会有代理,这条只落在直接调读器的嵌入方身上)。
+ * 交出去的是副本(原型 `Object.prototype`、成员全可枚举),调用方的对象不被交出去、也不被改;名叫 `__proto__` 的成员不进副本,`reservedMember` 记下它。
+ * 名叫 `__proto__` 而值也坏的成员,句子一次说全两件事(名坏在前、值坏并列):调用方照值改完再撞第二条是两步才改对。
+ */
+export declare function readPlainStringRecord(v: unknown): PlainStringRecordRead;

package/dist/mcp-request-entry.js

@@ -14,19 +14,22 @@
  *
  * ## 依赖的引擎事实(镜像 + 漂移门)
  *  · 申报名的线长界 {@link TOOL_WIRE_NAME_MAX_CHARS} = 引擎同名常量(值级对拍:上游漂移门 ⑧);
- *  · 请求面传输形 {@link RequestMcpTransport} = 引擎 MCP 条目的传输形,http 形多一个本包承载的 `assertionHeader`(编译期双向对拍:门 ⑧);
+ *  · 请求面传输形 {@link RequestMcpTransport} 对引擎 MCP 条目的传输形是一张处置表,两边每个键恰好一行(编译期两向对拍:门 ⑧)——
+ *    `kind` / `command` / `args` / `url` / `principalHeader` 与引擎同键同型;`env` / `headers` 是请求带来的字面件(引擎的声明不带值);
+ *    `assertionHeader` 本包承载(引擎没有这个座);引擎的 `credentials`(不透明的凭据引用)请求面不收;
  *  · 内容出处词表 = {@link MCP_CONTENT_ORIGINS}(已有的镜像,门 ⑥);
  *  · url 前缀守卫 = `./url-shape` 的 `startsWithHttpScheme`(本包判 URL 的正则只在那一个模块)。它只看前缀,不是形判官 —— 同一个串两口可以答得不同,两张分歧表与收口形(S-2106)写在 `./url-shape` 头注「第二个答案」。
  *
  * ## 与配置面的关系(如实)
  * 配置面的 MCP 条目(`McpServerSpec`,部署声明:凭据只许 env-NAME 引用)与请求面(提交体:可带字面凭据 `env` / `headers`)是两份契约,本模块只管后者。
  * 两份契约对「名」与「url」今天给的判据不同(配置面:名按字符集、url 按 `NON_SECRET_URL`;请求面:名按长度界、url 按 http(s) 前缀),本版刻意不动
- * (语义逐字搬),是一项已知待收的分歧。
+ * (语义逐字搬),是一项已知待收的分歧。`remote-` 保留前缀这一臂也只在请求面(`isUsableMcpServerName`):配置面 `McpServerSpec.name` 不拒它(此前合法的名被拒是校验收紧,归 major,不在 minor 里落),是又一处两面不齐的已知分歧。
  */
 import { echoCallerText } from "./caller-text-echo.js";
 import { UNINSPECTABLE, captureStringArray, dataDescriptor, inspect, ownEntriesOf, ownFieldsOf, ownValueOf, readKey } from "./own-key-read.js";
 import { isJsonArray, isPlainJsonObject, jsonShapeOf } from "./plain-json-object.js";
 import { MCP_CONTENT_ORIGINS } from "./types.js";
+import { RESERVED_MCP_SERVER_NAME_REASON, isReservedMcpServerName } from "./mcp-server-name.js";
 import { startsWithHttpScheme } from "./url-shape.js";
 // ── 值的种类描述(拒句只说「你写的是什么形」,不回显值:值可能带凭据、可能任意长)──────────────────────────────────────
 /** 值的**种类词**(不回显值本身):`null` / `array` / `typeof` 词(`object` / `function` / `string` …);读不出的对象 ⇒ 全包唯一的那一句。形状只问座位(总,不抛):两只坏值描述器共用这一只。 */
@@ -97,7 +100,7 @@ export function isStringRecord(v) {
     if (!isPlainJsonObject(v))
         return false;
     const entries = ownEntriesOf(v);
-    return entries.ok && entries.value.every(([name, value]) => name !== RESERVED_MEMBER_NAME && typeof value === "string");
+    return entries.ok && entries.value.every(([name, value]) => name !== PLAIN_STRING_RECORD_RESERVED_MEMBER && typeof value === "string");
 }
 // ── 调用方写的串的回显口径 ──────────────────────────────────────────────────────────────────────────
 /** 句子里点名一个值的写法:{@link echoCallerText} 外加一对双引号;内部的引号与反斜杠逐字(不转义)。 */
@@ -136,6 +139,23 @@ export function describeBadWireName(v) {
         return `${head} (${tooLong})`;
     return `${head} (${v.length > TOOL_WIRE_NAME_MAX_CHARS ? `${tooLong}, ` : ""}leading or trailing whitespace)`;
 }
+// ── MCP 服务器名(线上名 + 保留命名空间)──────────────────────────────────────────────────────────────────
+/**
+ * 这个 MCP 服务器名能用吗:{@link isUsableWireName} 再加一臂 —— 不在保留给设备执行端远程 MCP 服务器的 `remote-` 命名空间里(`./mcp-server-name`,字面前缀比较)。
+ * 只多这一臂:线上名的判据(非空、长界、首尾空白)一字不改,别的输入两只判官逐项同答。A2A 对端名只用 {@link isUsableWireName}(它的工具名前缀是 `a2a__`,不在这个命名空间里)。
+ */
+export function isUsableMcpServerName(v) {
+    return isUsableWireName(v) && !isReservedMcpServerName(v);
+}
+/**
+ * 坏 MCP 服务器名的**可打印**摘要:线上名本身就坏 ⇒ 与 {@link describeBadWireName} 逐字同(长界这类线上名的事实先说,不被保留臂盖掉);
+ * 线上名好而落在保留命名空间里 ⇒ 引号形的回显加那一句原因。
+ */
+export function describeBadMcpServerName(v) {
+    if (!isUsableWireName(v))
+        return describeBadWireName(v);
+    return `${quotedCallerText(v)} (${RESERVED_MCP_SERVER_NAME_REASON})`;
+}
 // ── 内容出处词 ──────────────────────────────────────────────────────────────────────────────────────
 const CONTENT_ORIGIN_WORDS = new Set(MCP_CONTENT_ORIGINS);
 /**
@@ -303,9 +323,19 @@ function snapshotTransport(tr) {
     return { ok: true, value: { kind: "other", value: kind.value } };
 }
 // ── 「名 → 串」记录的读法(`env` / `headers`)────────────────────────────────────────────────────────
-/** 引擎的声明收据不收的成员名(core `mcp-server-spec`:按赋值拷贝它会变成原型):JSON 文本铸得出这个**自有**键,对象字面量写不出。 */
-const RESERVED_MEMBER_NAME = "__proto__";
-const RESERVED_MEMBER_FAULT = `no member of a declaration may be named "${RESERVED_MEMBER_NAME}"`;
+/**
+ * 引擎的声明收据不收的成员名(core `mcp-server-spec`:按赋值拷贝它会变成原型):JSON 文本铸得出这个**自有**键,对象字面量写不出。
+ * 公开,因为读器交出 `reservedMember: true` 时消费方要点名它 —— 名字只在这里定一次。
+ */
+export const PLAIN_STRING_RECORD_RESERVED_MEMBER = "__proto__";
+const RESERVED_MEMBER_FAULT = `no member of a declaration may be named "${PLAIN_STRING_RECORD_RESERVED_MEMBER}"`;
+/**
+ * 「名 → 串」记录读不交(或交时点名保留名)的**原因词**,闭集,三个词、一张表:
+ * 整张一词(`not_plain_record`)· 成员级一词(`member_not_string`:值读成了别的种类,或读成员时抛了 —— 句子分说)· 名字级一词(`member_name_reserved`)。
+ * 词的意义逐词写在 {@link McpEntryKeyIssue}。消费方按词分派,不读句子;读器的读数 {@link PlainStringRecordRead} 与传输条目的机读位 {@link McpEntryKeyIssue} 的 `fault` 都由这一张表推出。
+ * 多一个词而消费方的穷尽 `switch` 不补 ⇒ 编译红(提货成本,不是静默)。
+ */
+export const PLAIN_STRING_RECORD_FAULTS = ["not_plain_record", "member_not_string", "member_name_reserved"];
 /** 记录不交时 `detail` 的前半句:它是哪一种不朴素(null / 数组 / 原始值各一句,对象里的非朴素一句)。`shape` 穷举 —— 新词不补 = 编译红。 */
 function notPlainDetail(shape, v) {
     switch (shape) {
@@ -328,13 +358,13 @@ function notPlainDetail(shape, v) {
     }
 }
 /**
- * 读一份「名 → 串」记录。记录交不交:是朴素 JSON 对象(座位的判据,见 `./plain-json-object`:原型是 `null`,或原型自己的原型是 `null`;纯数据 —— `Map`、`Set`、类实例、建在原型上的记录都不是),
- * 且每个成员的值都是串。成员 = `Object.getOwnPropertyNames` 的每一个名字(不可枚举的也算 —— 引擎的收据按全部自有属性名读),值经内核 `readKey` 读(一份描述符:数据属性取值,访问器调一次,不问 `get` 陷阱;访问器或描述 trap 抛了同判为坏)。
+ * 读一份「名 → 串」记录 —— **公开读口**:传输读器读 `env` / `headers` 用的就是它,消费方读自己的「名 → 串」记录(中心名册的引用表)调同一只,不抄镜像。从不抛。记录交不交:是朴素 JSON 对象(座位的判据,见 `./plain-json-object`:原型是 `null`,或原型自己的原型是 `null`;纯数据 —— `Map`、`Set`、类实例、建在原型上的记录都不是),
+ * 且每个成员的值都是串。成员 = `Object.getOwnPropertyNames` 的每一个名字(不可枚举的也算 —— 引擎的收据按全部自有属性名读),值经内核 `readKey` 读(一份描述符:数据属性取值,访问器调一次,不问 `get` 陷阱;访问器或描述符 trap 抛了同判为坏 —— 词与「值不是串」同是 `member_not_string`,句子说读不出)。
  * 读原型与成员名时代理 trap 抛了 ⇒ 整张不交(读器对调用方递来的任何对象都不抛;`JSON` 存体里不会有代理,这条只落在直接调读器的嵌入方身上)。
  * 交出去的是副本(原型 `Object.prototype`、成员全可枚举),调用方的对象不被交出去、也不被改;名叫 `__proto__` 的成员不进副本,`reservedMember` 记下它。
  * 名叫 `__proto__` 而值也坏的成员,句子一次说全两件事(名坏在前、值坏并列):调用方照值改完再撞第二条是两步才改对。
  */
-function readPlainStringRecord(v) {
+export function readPlainStringRecord(v) {
     // 形状归座位旁的分类(不在这里再推一遍;座位总 —— 读形状就抛的对象答 `uninspectable`)。成员名的读取(`ownKeys` 陷阱抛)读不出的对象也不是纯数据。
     // 读器不抛出去 —— 重放存量提交体的腿被一次抛错砖死比整键不交糟,而「整键不交」是响亮的(进 `lost`)。检视律与句都在 `inspect`。
     const shape = jsonShapeOf(v);
@@ -355,15 +385,17 @@ function readPlainStringRecord(v) {
         const value = read.presence === "own" ? read.value : undefined;
         if (unreadable || typeof value !== "string") {
             const valueFault = unreadable ? "could not be read (its getter threw)" : `must be a string — got ${describeValueShape(value)}`;
-            const reserved = name === RESERVED_MEMBER_NAME;
+            const reserved = name === PLAIN_STRING_RECORD_RESERVED_MEMBER;
+            // 词:名坏优先(句子里值坏并列说全);名没问题时,读不出与值不是串同词,句子分说
+            const fault = reserved ? "member_name_reserved" : "member_not_string";
             return {
                 ok: false,
-                fault: reserved ? "member_name_reserved" : "member_not_string",
+                fault,
                 member: echoCallerText(name),
                 detail: `its member "${echoCallerText(name)}" ${reserved ? `is not allowed (${RESERVED_MEMBER_FAULT}) and its value ${valueFault}` : valueFault}`,
             };
         }
-        if (name === RESERVED_MEMBER_NAME)
+        if (name === PLAIN_STRING_RECORD_RESERVED_MEMBER)
             reservedMember = true;
         else
             Object.defineProperty(members, name, dataDescriptor(value));
@@ -388,6 +420,6 @@ function readTransportRecord(path, raw) {
     }
     return {
         record: read.record,
-        issues: read.reservedMember ? [{ path: `${path}.${RESERVED_MEMBER_NAME}`, reason: RESERVED_MEMBER_FAULT, member: RESERVED_MEMBER_NAME, fault: "member_name_reserved" }] : [],
+        issues: read.reservedMember ? [{ path: `${path}.${PLAIN_STRING_RECORD_RESERVED_MEMBER}`, reason: RESERVED_MEMBER_FAULT, member: PLAIN_STRING_RECORD_RESERVED_MEMBER, fault: "member_name_reserved" }] : [],
     };
 }

package/dist/mcp-server-name.d.ts

@@ -0,0 +1,17 @@
+/**
+ * MCP 服务器名的保留命名空间 —— 一处定义,请求面的 MCP 名判官(`isUsableMcpServerName` / `describeBadMcpServerName`)读同一个谓词、说同一句原因。
+ * 配置面 `McpServerSpec.name` **不读**它(受理以这个前缀起头的名):此前合法的名被拒是校验收紧,按发版纪律归 major。
+ * 纯数据 + 纯函数,浏览器安全(叶模块:不 import 本包别的模块)。
+ *
+ * 设备执行端(device executor)提供的远程 MCP 服务器以 `remote-<名>` 挂载,工具名 `mcp__remote-<名>__<工具>`。部署声明的、请求带来的 MCP 条目若也用这个前缀,
+ * 一台它们声明的服务器就与一台设备上的服务器同名、落进同一个工具名命名空间 —— 所以这个前缀只归设备挂载。
+ *
+ * 比较按**字面**(区分大小写、不规范化):引擎铸工具名前缀时保留大小写、只把 `[A-Za-z0-9_-]` 之外的字符换成 `_`,`remote-` 这七个字符原样保留 ——
+ * 所以「名字以 `remote-` 起头」恰好等于「铸出的命名空间段以 `remote-` 起头」;`Remote-x` 铸成 `mcp__Remote-x__`,不在这个命名空间里。
+ */
+/** 保留给设备执行端远程 MCP 服务器的名字前缀(挂载名 = 这个前缀 + 设备声明的服务器名)。 */
+export declare const REMOTE_MCP_SERVER_NAME_PREFIX = "remote-";
+/** 这个 MCP 服务器名落在保留命名空间里吗(字面前缀比较)。 */
+export declare function isReservedMcpServerName(name: string): boolean;
+/** 保留前缀的原因句(不回显名字 —— 回显由读它的那一面按自己的口径加)。 */
+export declare const RESERVED_MCP_SERVER_NAME_REASON = "the \"remote-\" prefix is reserved for the remote MCP servers a device executor offers";

package/dist/mcp-server-name.js

@@ -0,0 +1,19 @@
+/**
+ * MCP 服务器名的保留命名空间 —— 一处定义,请求面的 MCP 名判官(`isUsableMcpServerName` / `describeBadMcpServerName`)读同一个谓词、说同一句原因。
+ * 配置面 `McpServerSpec.name` **不读**它(受理以这个前缀起头的名):此前合法的名被拒是校验收紧,按发版纪律归 major。
+ * 纯数据 + 纯函数,浏览器安全(叶模块:不 import 本包别的模块)。
+ *
+ * 设备执行端(device executor)提供的远程 MCP 服务器以 `remote-<名>` 挂载,工具名 `mcp__remote-<名>__<工具>`。部署声明的、请求带来的 MCP 条目若也用这个前缀,
+ * 一台它们声明的服务器就与一台设备上的服务器同名、落进同一个工具名命名空间 —— 所以这个前缀只归设备挂载。
+ *
+ * 比较按**字面**(区分大小写、不规范化):引擎铸工具名前缀时保留大小写、只把 `[A-Za-z0-9_-]` 之外的字符换成 `_`,`remote-` 这七个字符原样保留 ——
+ * 所以「名字以 `remote-` 起头」恰好等于「铸出的命名空间段以 `remote-` 起头」;`Remote-x` 铸成 `mcp__Remote-x__`,不在这个命名空间里。
+ */
+/** 保留给设备执行端远程 MCP 服务器的名字前缀(挂载名 = 这个前缀 + 设备声明的服务器名)。 */
+export const REMOTE_MCP_SERVER_NAME_PREFIX = "remote-";
+/** 这个 MCP 服务器名落在保留命名空间里吗(字面前缀比较)。 */
+export function isReservedMcpServerName(name) {
+    return name.startsWith(REMOTE_MCP_SERVER_NAME_PREFIX);
+}
+/** 保留前缀的原因句(不回显名字 —— 回显由读它的那一面按自己的口径加)。 */
+export const RESERVED_MCP_SERVER_NAME_REASON = `the "${REMOTE_MCP_SERVER_NAME_PREFIX}" prefix is reserved for the remote MCP servers a device executor offers`;

package/dist/migration-receipt.d.ts

@@ -2,11 +2,12 @@
  * 一次性迁移的**收据形**与两张闭集(11.0.0)—— 叶子模块(运行期零依赖;只有型导入),由 `./one-time-migrations` 再导出(不进主桶)。
  * 单拆出来只为一件事:调度店的读口(`./scheduler-store`,轻、浏览器安全)要在告警里带收据,不该为一个型把整套域 schema 拉进来。
  */
+import type { ENV_MODELS_DOCUMENT } from "./config-root-documents.js";
 import type { REMOTE_EXEC_DOCUMENT } from "./remote-exec.js";
 import type { DomainName, RetiredDomainName } from "./types.js";
 /** 本版登记的一次性**数据**迁移 id(闭集;每个 id 在 `ONE_TIME_MIGRATIONS` 登记表里恰一行)。收据只许这些 id —— 同表登记的 wire 删码位
  *  (`WIRE_RETIREMENT_IDS`,`./one-time-migrations`)不改任何存储形,铸不出收据,不在本集。 */
-export declare const ONE_TIME_MIGRATION_IDS: readonly ["SS-M1", "SS-M2", "SS-M3", "SS-M4", "SS-M5", "SS-M6", "SS-M7", "SS-M8", "SS-M9", "SS-M10"];
+export declare const ONE_TIME_MIGRATION_IDS: readonly ["SS-M1", "SS-M2", "SS-M3", "SS-M4", "SS-M5", "SS-M6", "SS-M7", "SS-M8", "SS-M9", "SS-M10", "SS-M11"];
 export type OneTimeMigrationId = (typeof ONE_TIME_MIGRATION_IDS)[number];
 /**
  * 一条收据说迁移**对一个坐标做了什么**(闭集,每词一义):
@@ -14,12 +15,15 @@ export type OneTimeMigrationId = (typeof ONE_TIME_MIGRATION_IDS)[number];
  *  - `rewritten`        — 同一坐标上的值换成今天的生效读法(例:URL 剥掉从不上线的 fragment、调度行的 durable 键重铸、6.x 的 worker 行换新形);
  *  - `dropped-shadowed` — 删掉;它从来没生效过,因为另一个位赢了(例:`governance` 已设时 `runtime` 上的治理旧键、`sealedApiKey` 在场时的 `apiKeyEnv`);
  *  - `dropped-inert`    — 删掉;今天的读法本就不让它生效(例:超界的主机条目、引擎从不读的旧字段、空的retired 域文档);
- *  - `refused`          — 不改:要改就得替运维猜(或旧文档今天本就读不进);原样留着,读侧照旧响亮拒,`reason` 说为什么。
+ *  - `refused`          — 不改:要改就得替运维猜(或旧文档今天本就读不进);原样留着,读侧照旧响亮拒,`reason` 说为什么;
+ *  - `minted`           — 在**缺席处**写下一份新事实(一份部署决定),不改任何已有的值 —— 只有 SS-M11 铸(配置根的 `config.env-models.json`:
+ *                         升级前「管模型面的目录整表顶替 env 模型」的读法,写成 `replaced`;不存在才建)。
  */
-export declare const MIGRATION_APPLIED_AS: readonly ["moved", "rewritten", "dropped-shadowed", "dropped-inert", "refused"];
+export declare const MIGRATION_APPLIED_AS: readonly ["moved", "rewritten", "dropped-shadowed", "dropped-inert", "refused", "minted"];
 export type MigrationAppliedAs = (typeof MIGRATION_APPLIED_AS)[number];
-/** 收据指向的那份文档:配置域名、retired 域名(`runtime`)、`config.d/remote-exec.json`(`remote-exec`),或调度店(`scheduler-store`)。 */
-export type MigrationDocument = DomainName | RetiredDomainName | typeof REMOTE_EXEC_DOCUMENT | "scheduler-store";
+/** 收据指向的那份文档:配置域名、retired 域名(`runtime`)、`config.d/remote-exec.json`(`remote-exec`)、调度店(`scheduler-store`),
+ *  或配置根上的 env 模型表决定(`config.env-models`,SS-M11 铸)。 */
+export type MigrationDocument = DomainName | RetiredDomainName | typeof REMOTE_EXEC_DOCUMENT | "scheduler-store" | typeof ENV_MODELS_DOCUMENT;
 /** 文档里的段坐标(字符串段 = 对象键,数字段 = 数组下标;与告警坐标同一形)。 */
 export type MigrationPath = readonly (string | number)[];
 interface ReceiptBase {
@@ -35,7 +39,7 @@ export type MigrationReceipt = (ReceiptBase & {
         readonly path: MigrationPath;
     };
 }) | (ReceiptBase & {
-    readonly appliedAs: "rewritten" | "dropped-shadowed" | "dropped-inert";
+    readonly appliedAs: "rewritten" | "dropped-shadowed" | "dropped-inert" | "minted";
 }) | (ReceiptBase & {
     readonly appliedAs: "refused";
     readonly reason: string;

package/dist/migration-receipt.js

@@ -1,12 +1,14 @@
 /** 本版登记的一次性**数据**迁移 id(闭集;每个 id 在 `ONE_TIME_MIGRATIONS` 登记表里恰一行)。收据只许这些 id —— 同表登记的 wire 删码位
  *  (`WIRE_RETIREMENT_IDS`,`./one-time-migrations`)不改任何存储形,铸不出收据,不在本集。 */
-export const ONE_TIME_MIGRATION_IDS = ["SS-M1", "SS-M2", "SS-M3", "SS-M4", "SS-M5", "SS-M6", "SS-M7", "SS-M8", "SS-M9", "SS-M10"];
+export const ONE_TIME_MIGRATION_IDS = ["SS-M1", "SS-M2", "SS-M3", "SS-M4", "SS-M5", "SS-M6", "SS-M7", "SS-M8", "SS-M9", "SS-M10", "SS-M11"];
 /**
  * 一条收据说迁移**对一个坐标做了什么**(闭集,每词一义):
  *  - `moved`            — 值搬到新位(`to`),义不变;
  *  - `rewritten`        — 同一坐标上的值换成今天的生效读法(例:URL 剥掉从不上线的 fragment、调度行的 durable 键重铸、6.x 的 worker 行换新形);
  *  - `dropped-shadowed` — 删掉;它从来没生效过,因为另一个位赢了(例:`governance` 已设时 `runtime` 上的治理旧键、`sealedApiKey` 在场时的 `apiKeyEnv`);
  *  - `dropped-inert`    — 删掉;今天的读法本就不让它生效(例:超界的主机条目、引擎从不读的旧字段、空的retired 域文档);
- *  - `refused`          — 不改:要改就得替运维猜(或旧文档今天本就读不进);原样留着,读侧照旧响亮拒,`reason` 说为什么。
+ *  - `refused`          — 不改:要改就得替运维猜(或旧文档今天本就读不进);原样留着,读侧照旧响亮拒,`reason` 说为什么;
+ *  - `minted`           — 在**缺席处**写下一份新事实(一份部署决定),不改任何已有的值 —— 只有 SS-M11 铸(配置根的 `config.env-models.json`:
+ *                         升级前「管模型面的目录整表顶替 env 模型」的读法,写成 `replaced`;不存在才建)。
  */
-export const MIGRATION_APPLIED_AS = ["moved", "rewritten", "dropped-shadowed", "dropped-inert", "refused"];
+export const MIGRATION_APPLIED_AS = ["moved", "rewritten", "dropped-shadowed", "dropped-inert", "refused", "minted"];

package/dist/node.d.ts

@@ -12,3 +12,4 @@ export * from "./scheduler-store-node.js";
 export { migrateConfigDirectory, migrateConfigDocuments, // 14.5.0:同一段「迁 → 整域终判」的同步口(入参是已有的存量文档,无 io)—— 目录形调的就是它的内核
 type ConfigDirectoryDocument, type ConfigDirectoryIo, type ConfigDirectoryMigration, type ConfigDirectoryRefusal, type ConfigDocumentsMigration, type MigrateConfigDirectoryOptions, type MigrateConfigDocumentsOptions, } from "./config-dir-migration.js";
 export { nodeConfigDirectoryIo } from "./config-dir-io.js";
+export { migrateEnvModelsDecision, nodeConfigRootIo, readEnvModelsDecision, readMigrationMarker, writeEnvModelsDecision, type ConfigRootIo, type EnvModelsDecisionWrite, type EnvModelsMigration, type EnvModelsMint, } from "./config-root-node.js";

package/dist/node.js

@@ -13,3 +13,5 @@ export * from "./scheduler-store-node.js"; // R7 self-wake scheduler store — f
 export { migrateConfigDirectory, migrateConfigDocuments, // 14.5.0:同一段「迁 → 整域终判」的同步口(入参是已有的存量文档,无 io)—— 目录形调的就是它的内核
  } from "./config-dir-migration.js";
 export { nodeConfigDirectoryIo } from "./config-dir-io.js"; // 上面那只函数的真 I/O 绑定:node:fs + 本包唯一的原子写器(config-document 模式规则)
+// 配置根上的决定文档(config.env-models.json)与按 id 的运行记录(config.migration.<id>.json)的两只读者、决定文档的唯一写函数(运行记录由迁移独占创建),与一次性迁移 SS-M11 的迁移体(名字与闭集答案表在包根)。显式列名。
+export { migrateEnvModelsDecision, nodeConfigRootIo, readEnvModelsDecision, readMigrationMarker, writeEnvModelsDecision, } from "./config-root-node.js";

package/dist/one-time-migrations.d.ts

@@ -14,8 +14,10 @@ export interface OneTimeMigrationWindow {
      *   · `refused`           — 读写两面拒,拒句点名本行 id(经 `migrationSignpost` 铸;钉:每个 `refused` 行的 id 在 `src/` 至少一处铸点,
      *                           且非 `refused` 行零铸点);
      *   · `rewritten-on-read` — 读时改写、不拒(SS-M3:调度店的下一个写者落盘),没有拒句可点名;
-     *   · `not-stored`        — 没有存储形(wire 删码位),谈不上拒。 */
-    readonly oldForm: "refused" | "rewritten-on-read" | "not-stored";
+     *   · `not-stored`        — 没有存储形(wire 删码位),谈不上拒;
+     *   · `read-as-default`   — 旧形是一份文档的**缺席**(SS-M11:配置根上没有 `config.env-models.json`),读者按它的缺省读(`kept`),不拒、没有拒句可点名 ——
+     *                           缺省读出来的后果由读者自己的响亮臂说(引擎的模型面组拒句点名出路)。 */
+    readonly oldForm: "refused" | "rewritten-on-read" | "not-stored" | "read-as-default";
     /** 引入这条迁移的版本。 */
     readonly introducedIn: string;
     /** 该版本在 npm 上的发布日(UTC 日历日 YYYY-MM-DD)。`null` = 未发布形,由抬 `package.json` 到 `introducedIn` 的发布准备提交回填。 */