@sema-agent/settings-schema 15.1.0 → 16.0.0

package/dist/file-store.js

@@ -14,6 +14,8 @@
  *  - A MISSING file (ENOENT) → the domain is absent → schema defaults fill in (parseDomain tolerates undefined).
  *    A present-but-EMPTY/whitespace file is a half-write → THROW (fail-closed, like remote-exec); to mean
  *    "absent/defaults" the file must be missing, not empty. A valid `{}` object IS a set domain (→ defaults).
+ *  - `read()` (16.0.0) is the ONE read that answers both ways: the effective config + its read warnings as data when every
+ *    document reads, or the typed refusal list of the whole directory + its version when one does not — every document read once.
  *  - Non-portable domains are OMITTED on a single machine and resolve to their schema defaults (`{workers:[]}`
  *    etc.) — no stubbing needed. 逐域为什么被排除见 {@link NON_PORTABLE_DOMAIN_REASONS}(禁裸排除)。
  *  - A RETIRED domain's file (`config.d/runtime.json`, see `RETIRED_DOMAINS`) is read only for its tombstone: carrying facts ⇒
@@ -24,16 +26,13 @@
  *    "skip re-apply if version unchanged" works locally. `getEffective().updatedAt` = the max file mtime,
  *    passed EXPLICITLY into buildEffective (the determinism refactor) so identical files ⇒ identical bytes.
  */
-import { readdir, readFile, stat } from "node:fs/promises";
+import { readdir, stat } from "node:fs/promises";
 import path from "node:path";
-import { buildEffective, DOMAIN_READ_FALLBACK, parseDomainLoud } from "./config-fns.js";
-import { configDPath, readConfigDFile, refuseRetiredDomainFiles } from "./config-d-file.js";
-import { stableHash } from "./hash.js";
+import { RetiredDomainError, buildEffective, DOMAIN_READ_FALLBACK, parseDomainLoud, refuseRetiredDomain } from "./config-fns.js";
+import { RETIRED_DOMAIN_NAMES, configDPath, configDVersionOf, corruptDocumentRaw, readConfigDFile, readConfigDFileReading, refuseRetiredDomainFiles } from "./config-d-file.js";
 import { PORTABLE_DOMAINS } from "./portable-domains.js";
 import { REMOTE_EXEC_DOCUMENT } from "./remote-exec.js";
-import { RETIRED_DOMAINS, isDomainName, isRetiredDomainName } from "./types.js";
-/** The retired domain names (`RETIRED_DOMAINS` keys) — read from `config.d/` for their tombstone only. */
-const RETIRED_DOMAIN_NAMES = Object.keys(RETIRED_DOMAINS);
+import { isDomainName, isRetiredDomainName } from "./types.js";
 // 便携域表的定义住在纯叶 ./portable-domains.ts(14.6.0;零 node 依赖,主桶模块可 import);这里原名转出口,`./node` 子路径逐名不变。
 export { NON_PORTABLE_DOMAIN_REASONS, PORTABLE_DOMAINS } from "./portable-domains.js";
 /** `config.d/` 里**合法存在但不是域文档**的文件名(不进 `"unread-config-file"` 告警)。`remote-exec`
@@ -87,6 +86,11 @@ export class FileConfigStore {
         const onWarning = this.opts.onWarning;
         if (!onWarning)
             return;
+        for (const w of await this.#unreadFiles())
+            onWarning(w);
+    }
+    /** {@link #warnUnreadFiles} 的扫描本体:没人读的 `*.json` 逐个一条告警(单读口 `read()` 把它们交成数据,所以它总扫)。 */
+    async #unreadFiles() {
         let names;
         try {
             names = await readdir(path.join(this.root, "config.d"));
@@ -94,8 +98,9 @@ export class FileConfigStore {
         catch {
             // 目录读不了(不存在 / 只有 x 没有 r 的目录权限)⇒ 本次扫不了,**不抛**:这条是尽力而为的审计线,
             // 绝不能把一次本来能成功的 getEffective 拖成失败(域文件本身仍按名逐个打开,该失败的自然会失败)。
-            return;
+            return [];
         }
+        const out = [];
         for (const name of names) {
             if (name.startsWith(".") || !name.endsWith(".json") || NON_DOMAIN_CONFIG_FILES.has(name))
                 continue;
@@ -104,10 +109,11 @@ export class FileConfigStore {
                 continue; // 真被读的域
             if (isRetiredDomainName(base))
                 continue; // retired 域:由墓碑判(带事实 ⇒ getEffective 抛),不是「没人读的文件」
-            onWarning(isDomainName(base)
+            out.push(isDomainName(base)
                 ? { kind: "unread-config-file", file: name, domain: base, why: "non-portable-domain" }
                 : { kind: "unread-config-file", file: name, why: "not-a-domain" });
         }
+        return out;
     }
     /** Raw (unparsed) values for every PORTABLE domain and every retired domain (the latter for the tombstone), keyed by
      *  name (absent → undefined). Both feed the version hash: a retired file appearing / changing flips `getEffective`
@@ -136,22 +142,24 @@ export class FileConfigStore {
     }
     /** Read+parse one domain (validated, defaults filled), or `undefined` if the domain is ABSENT — matching
      *  the {@link ConfigReader} contract (reader.ts: absent domain → undefined) and the server stores'
-     *  `has(domain) ? parse : undefined`. A present-but-empty file (`{}` / whitespace) IS a set domain → parsed
-     *  with defaults; a missing file is absence → undefined. (getEffective still fills defaults for absent
-     *  domains; getDomain is the per-domain "was this ever set?" probe.) */
+     *  `has(domain) ? parse : undefined`. Only a MISSING file (ENOENT) is absence → undefined. A present `{}` IS a set
+     *  domain → parsed with defaults. A present file that is empty or whitespace-only (a half-write) throws as a corrupt file,
+     *  as do bad JSON, a non-object, an unreadable file and one nested too deep (the same reading as getEffective / readBundle).
+     *  (getEffective still fills defaults for absent domains; getDomain is the per-domain "was this ever set?" probe.) */
     async getDomain(domain) {
         await refuseRetiredDomainFiles(this.root); // every read entry asks the tombstone first (exportBundle reads through here)
         const raw = await this.#readDomainRaw(domain);
         if (raw === undefined)
-            return undefined; // missing/empty file → domain absent (not schema defaults)
+            return undefined; // missing file (ENOENT) → domain absent (not schema defaults); a corrupt file threw above
         // 0.19.0(对抗复审 复审 round2 F3):与 buildEffective **同一条** parse-and-warn 判据。此前本方法直接
         // parseDomain,于是 `exportBundle`(它就是逐域走 getDomain 读的)会把一份携带未知键的域**静默剥**
         // 成一份"干净"的 bundle —— 再 import 回去就是一次持久的配置丢失,全程零告警。
         return parseDomainLoud(domain, raw, this.opts.onWarning);
     }
-    /** Content hash of a raws snapshot → a stable u53-ish version number (≤ Number.MAX_SAFE_INTEGER). */
+    /** Content hash of a raws snapshot → a stable u53-ish version number (≤ Number.MAX_SAFE_INTEGER). The one reading is `configDVersionOf`
+     *  (`./config-d-file`) — `read()` asks the same function, so a clean tree has the same version from either. */
     #versionOf(raws) {
-        return parseInt(stableHash(raws).slice(0, 13), 16); // 13 hex digits ≤ 2^52, safely within u53
+        return configDVersionOf(raws);
     }
     async getEffective(opts) {
         // Every read entry asks the tombstone first (the same check getDomain runs); what it read (absent / `{}`) joins the version hash.
@@ -170,26 +178,19 @@ export class FileConfigStore {
         const hashRaws = { ...retired };
         const domainErrors = [];
         await Promise.all(PORTABLE_DOMAINS.map(async (d) => {
-            try {
-                const v = await this.#readDomainRaw(d);
+            // 与严读同一只文件读法(读数):被拒的读数交 `thrown`(gate 域原样抛)或 `error` 句(其余域单列进 domainErrors)—— 坏文件的指纹就是这一次读到的字节,不是事后的第二次读。
+            const reading = await readConfigDFileReading(this.root, d);
+            if (reading.status !== "refused") {
+                const v = reading.status === "present" ? reading.value : undefined;
                 raws[d] = v;
                 hashRaws[d] = v;
+                return;
             }
-            catch (e) {
-                if (DOMAIN_READ_FALLBACK[d] === "throw")
-                    throw e; // gate 域:READ 容错也不放宽 fail-loud
-                domainErrors.push({ domain: d, error: e instanceof Error ? e.message : String(e) });
-                raws[d] = undefined; // buildEffective 按 absent → schema default 落(fail-closed)
-                // 哨兵进 hash:用文件文本 hash 区分不同坏内容;读不回文本(竞态删除等)退回错误文案。
-                let textHash;
-                try {
-                    textHash = stableHash((await readFile(this.domainPath(d), "utf8")).trim());
-                }
-                catch {
-                    textHash = stableHash(e instanceof Error ? e.message : String(e));
-                }
-                hashRaws[d] = { __corruptDomainFile: textHash };
-            }
+            if (DOMAIN_READ_FALLBACK[d] === "throw")
+                throw reading.thrown; // gate 域:READ 容错也不放宽 fail-loud
+            domainErrors.push({ domain: d, error: reading.error });
+            raws[d] = undefined; // buildEffective 按 absent → schema default 落(fail-closed)
+            hashRaws[d] = corruptDocumentRaw(reading); // 哨兵进 hash:不同坏内容不同数(见 corruptDocumentRaw)
         }));
         const updatedAt = await this.#maxMtimeIso();
         const effective = buildEffective(this.#versionOf(hashRaws), (d) => raws[d], updatedAt, this.opts.onWarning);
@@ -200,4 +201,60 @@ export class FileConfigStore {
     async getVersion() {
         return this.#versionOf(await this.#readAllRaw());
     }
+    /**
+     * **单读口**(16.0.0):一次读整棵 `config.d`(全部便携域 + retired 域的墓碑文档,每份只读一次),交一个结局({@link FileConfigRead})——
+     *  · 每份文档在文件层都读得进 ⇒ `effective`:与严读 `getEffective()` 逐位同;读侧告警交成数据(没人读的文件 + 装配告警,不经 `onWarning`);
+     *  · 有文档在文件层被拒(空 / 坏 JSON / 不是对象 / 读不出 / 过深;带事实的 retired 域文档是墓碑拒,带迁移编号)⇒ `refused`:整棵目录的拒单与这一次读到的内容版本。
+     * 严读与 `readBundle` 读的是同一只文件读法(`./config-d-file` 的读数)—— 同一种坏形同一个词、同一句话;区别只在渲染:严读遇到第一份坏文档就抛,本方法把整个目录读完、逐份交出。
+     * 文件层之外的拒(读得出、过不了门控域的 schema)照严读抛 —— 那是判形,不在拒单里。拒单、版本、effective、告警都出自这一次读到的字节:没有「先抛、再重探」的第二次读。
+     */
+    async read() {
+        const documents = [...RETIRED_DOMAIN_NAMES, ...PORTABLE_DOMAINS];
+        const [readings, unread] = await Promise.all([Promise.all(documents.map((d) => readConfigDFileReading(this.root, d))), this.#unreadFiles()]);
+        const raws = {};
+        const refusals = [];
+        documents.forEach((document, i) => {
+            const reading = readings[i];
+            switch (reading.status) {
+                case "absent":
+                    raws[document] = undefined;
+                    return;
+                case "refused":
+                    raws[document] = corruptDocumentRaw(reading);
+                    refusals.push({ document, reason: reading.reason, error: reading.error });
+                    return;
+                case "present":
+                    raws[document] = reading.value;
+                    if (isRetiredDomainName(document)) {
+                        const tombstone = tombstoneOf(document, reading.value);
+                        if (tombstone !== undefined)
+                            refusals.push(tombstone);
+                    }
+                    return;
+                default: {
+                    const unhandled = reading;
+                    throw new Error(`FileConfigStore.read: unhandled reading ${String(unhandled)}`);
+                }
+            }
+        });
+        const version = this.#versionOf(raws);
+        if (refusals.length > 0)
+            return { kind: "refused", refusals, version, warnings: unread };
+        const warnings = [...unread];
+        const updatedAt = await this.#maxMtimeIso();
+        const effective = buildEffective(version, (d) => raws[d], updatedAt, (w) => warnings.push(w));
+        return { kind: "effective", effective, warnings };
+    }
+}
+/** 墓碑判一次(与严读同一只判官 `refuseRetiredDomain`、同一句):retired 域文档带事实 ⇒ 一条 `retired_domain` 拒;缺席 / `{}` ⇒ `undefined`。 */
+function tombstoneOf(domain, raw) {
+    try {
+        refuseRetiredDomain(domain, raw);
+        return undefined;
+    }
+    catch (e) {
+        if (e instanceof RetiredDomainError)
+            return { document: e.domain, reason: "retired_domain", error: e.message, migration: e.migration };
+        throw e;
+    }
 }

package/dist/fleet.d.ts

@@ -166,12 +166,13 @@ export type RestartSignal = z.infer<typeof RestartSignal>;
  *    `config.gateway_fallback_without_primary` — fallback gateways are declared without a primary;
  *    `config.catalog_replaces_env_models` ({@link CATALOG_REPLACES_ENV_MODELS_CODE}) — on the LOCAL config leg, a candidate that
  *    manages the model plane would replace a declared env model table (`MODEL_ID` …) while the config root's decision document
- *    (`config.env-models.json`, read by `readEnvModelsDecision`) does not say `replaced` — the env models keep serving;
- *    `config.summarize_model_missing` ({@link SUMMARIZE_MODEL_MISSING_CODE}) — the summarize role, which every task resolves,
- *    would land on no servable entry (every task would be refused after adoption).
+ *    (`config.env-models.json`, read by `readEnvModelsDecision`) does not say `replaced` — the env models keep serving.
  *    Source (engine): the first two in `src/model-entry-refusal.ts`, the next two in `src/model-route-endpoint.ts:40,42`
  *    (invariant `model-route-endpoint`, judged by the model-plane stage in `src/config-center/apply-effective.ts:664-665`); the
- *    last two are named HERE first (the code is a contract word: this package names it and exports the two constants for the engine to read; the engine does not mint them today).
+ *    last one is named HERE first (the code is a contract word: this package names it and exports the constant for the engine to read; the engine does not mint it today).
+ *    16.0.0 retired `config.summarize_model_missing` (and its constant) from this set: a role seat naming an entry the catalog does not serve
+ *    reads as unset (it falls back down the role chain and the engine says so once) — no reading refuses a model plane for it, so it was never
+ *    an engine group refusal. A reader still holding it gets it dropped by {@link readModelRefusals} like any code outside the set.
  */
 export declare const MODEL_ENTRY_REFUSAL_CODES: readonly ["config.model_no_brain", "config.model_entry_invalid"];
 export declare const ModelEntryRefusalCode: z.ZodEnum<{
@@ -181,12 +182,9 @@ export declare const ModelEntryRefusalCode: z.ZodEnum<{
 export type ModelEntryRefusalCode = z.infer<typeof ModelEntryRefusalCode>;
 /** The env-model-table confirmation gate's group-refusal code (see {@link MODEL_PLANE_REFUSAL_CODES}). */
 export declare const CATALOG_REPLACES_ENV_MODELS_CODE: "config.catalog_replaces_env_models";
-/** The summarize invariant's group-refusal code (see {@link MODEL_PLANE_REFUSAL_CODES}); a writer's plan answers `fix_first` with it. */
-export declare const SUMMARIZE_MODEL_MISSING_CODE: "config.summarize_model_missing";
-export declare const MODEL_PLANE_REFUSAL_CODES: readonly ["config.default_model_missing", "config.model_refused_name_minted", "config.model_route_endpoint_missing", "config.gateway_fallback_without_primary", "config.catalog_replaces_env_models", "config.summarize_model_missing"];
+export declare const MODEL_PLANE_REFUSAL_CODES: readonly ["config.default_model_missing", "config.model_refused_name_minted", "config.model_route_endpoint_missing", "config.gateway_fallback_without_primary", "config.catalog_replaces_env_models"];
 export declare const ModelPlaneRefusalCode: z.ZodEnum<{
     "config.catalog_replaces_env_models": "config.catalog_replaces_env_models";
-    "config.summarize_model_missing": "config.summarize_model_missing";
     "config.default_model_missing": "config.default_model_missing";
     "config.model_refused_name_minted": "config.model_refused_name_minted";
     "config.model_route_endpoint_missing": "config.model_route_endpoint_missing";

package/dist/fleet.js

@@ -234,26 +234,24 @@ function readSignalBody(body, pick, schema) {
  *    `config.gateway_fallback_without_primary` — fallback gateways are declared without a primary;
  *    `config.catalog_replaces_env_models` ({@link CATALOG_REPLACES_ENV_MODELS_CODE}) — on the LOCAL config leg, a candidate that
  *    manages the model plane would replace a declared env model table (`MODEL_ID` …) while the config root's decision document
- *    (`config.env-models.json`, read by `readEnvModelsDecision`) does not say `replaced` — the env models keep serving;
- *    `config.summarize_model_missing` ({@link SUMMARIZE_MODEL_MISSING_CODE}) — the summarize role, which every task resolves,
- *    would land on no servable entry (every task would be refused after adoption).
+ *    (`config.env-models.json`, read by `readEnvModelsDecision`) does not say `replaced` — the env models keep serving.
  *    Source (engine): the first two in `src/model-entry-refusal.ts`, the next two in `src/model-route-endpoint.ts:40,42`
  *    (invariant `model-route-endpoint`, judged by the model-plane stage in `src/config-center/apply-effective.ts:664-665`); the
- *    last two are named HERE first (the code is a contract word: this package names it and exports the two constants for the engine to read; the engine does not mint them today).
+ *    last one is named HERE first (the code is a contract word: this package names it and exports the constant for the engine to read; the engine does not mint it today).
+ *    16.0.0 retired `config.summarize_model_missing` (and its constant) from this set: a role seat naming an entry the catalog does not serve
+ *    reads as unset (it falls back down the role chain and the engine says so once) — no reading refuses a model plane for it, so it was never
+ *    an engine group refusal. A reader still holding it gets it dropped by {@link readModelRefusals} like any code outside the set.
  */
 export const MODEL_ENTRY_REFUSAL_CODES = ["config.model_no_brain", "config.model_entry_invalid"];
 export const ModelEntryRefusalCode = z.enum(MODEL_ENTRY_REFUSAL_CODES);
 /** The env-model-table confirmation gate's group-refusal code (see {@link MODEL_PLANE_REFUSAL_CODES}). */
 export const CATALOG_REPLACES_ENV_MODELS_CODE = "config.catalog_replaces_env_models";
-/** The summarize invariant's group-refusal code (see {@link MODEL_PLANE_REFUSAL_CODES}); a writer's plan answers `fix_first` with it. */
-export const SUMMARIZE_MODEL_MISSING_CODE = "config.summarize_model_missing";
 export const MODEL_PLANE_REFUSAL_CODES = [
     "config.default_model_missing",
     "config.model_refused_name_minted",
     "config.model_route_endpoint_missing",
     "config.gateway_fallback_without_primary",
     CATALOG_REPLACES_ENV_MODELS_CODE,
-    SUMMARIZE_MODEL_MISSING_CODE,
 ];
 export const ModelPlaneRefusalCode = z.enum(MODEL_PLANE_REFUSAL_CODES);
 /**

package/dist/hooks.d.ts

@@ -78,8 +78,8 @@ export declare const HookEventName: z.ZodEnum<{
 }>;
 export type HookEventName = z.infer<typeof HookEventName>;
 export declare const HookOwner: z.ZodEnum<{
-    engine: "engine";
     shell: "shell";
+    engine: "engine";
 }>;
 export type HookOwner = z.infer<typeof HookOwner>;
 /**

package/dist/index.d.ts

@@ -4,7 +4,9 @@
  */
 export * from "./types.js";
 export * from "./execution-lanes.js";
+export * from "./config-document-refusal.js";
 export * from "./url-shape.js";
+export * from "./device-relay.js";
 export * from "./url-credential.js";
 export * from "./default-model.js";
 export { catalogManagesModelPlane, enabledEntryCount } from "./catalog-manages.js";
@@ -47,4 +49,3 @@ export * from "./control-and-bidi.js";
 export * from "./mcp-request-entry.js";
 export { REMOTE_MCP_SERVER_NAME_PREFIX } from "./mcp-server-name.js";
 export * from "./center-refs.js";
-export { isBlankCoordinate } from "./execution-lane-index.js";

package/dist/index.js

@@ -3,8 +3,10 @@
  * web-admin, the worker service, and the TOC desktop/CLI.
  */
 export * from "./types.js";
-export * from "./execution-lanes.js"; // 7.0.0 M-R2: the ONE lane / store vocabulary (EXECUTION_LANE_WORDS / EXECUTION_LANES / STORE_BACKENDS / SESSION_BACKENDS / MEMORY_ENGINE_BACKENDS) — pure data, browser-safe
-export * from "./url-shape.js"; // 11.0.0: THE URL shape judge (httpUrlFlaws / httpUrlRule / isHierarchicalUrl), pure/browser-safe
+export * from "./execution-lanes.js"; // 7.0.0 M-R2: the ONE lane / store vocabulary (EXECUTION_LANE_WORDS / EXECUTION_LANES / STORE_BACKENDS / SESSION_BACKENDS / MEMORY_ENGINE_BACKENDS) + THE lane-coordinate blank judge isBlankCoordinate (empty or whitespace-only = absent; the write gate and every consumer ask this one function; whether a key is set, and whether an optional key may be empty, stays the caller's call; the same function object as on the `./execution-lanes` subpath) — a zero-import leaf, pure/browser-safe
+export * from "./config-document-refusal.js"; // 15.2.0: the typed refusal of one config.d document (CONFIG_DOCUMENT_REFUSAL_REASONS = empty / invalid_json / not_object / io / retired_domain; ConfigDocumentRefusal { document, reason, error } + the tombstone arm's migration) — the reading is `inspectBundle` in ./node; pure/browser-safe
+export * from "./url-shape.js"; // 11.0.0: THE URL shape judge (httpUrlFlaws / httpUrlRule / isHierarchicalUrl; 16.0.0 + wsUrlFlaws), pure/browser-safe
+export * from "./device-relay.js"; // 16.0.0: THE value grammar of the device lane's DEVICE_RELAY_URL (DEVICE_RELAY_NONE / deviceRelayFlaws / DEVICE_RELAY_RULE), pure/browser-safe
 export * from "./url-credential.js"; // 14.5.0: THE "does this URL carry a credential" judge (findUrlCredential / findUrlUserinfo / URL_CREDENTIAL_REASONS / CREDENTIAL_PARAM_NAMES …), pure/browser-safe
 export * from "./default-model.js"; // 11.0.0: THE catalog-default resolver (roles.default → active tier ladder → fallback), pure/browser-safe
 export { catalogManagesModelPlane, enabledEntryCount } from "./catalog-manages.js"; // THE "does this models document manage the model plane" judge (raw half: at least one entry not explicitly disabled) + the log count it is derived from, pure/browser-safe
@@ -47,7 +49,6 @@ export * from "./control-and-bidi.js"; // the one-line echo strip set (C0 + DEL
 export * from "./mcp-request-entry.js"; // 14.0.0: the request-plane MCP entry judges (isUsableWireName / isContentOriginWord / readMcpIdentityHeaders / readRequestMcpTransport + the value-shape describers) — one reading for the service legs and the shell pre-check, pure/browser-safe
 export { REMOTE_MCP_SERVER_NAME_PREFIX } from "./mcp-server-name.js"; // the MCP server-name prefix reserved for the remote MCP servers a device executor offers (mount name = prefix + the executor's server name); the predicate and its sentence stay package-private — the request plane's MCP name judges (isUsableMcpServerName / describeBadMcpServerName) read them; the config plane's McpServerSpec.name accepts the prefix (refusing it would be a validation tightening — a major), pure/browser-safe
 export * from "./center-refs.js"; // resolveCenterRefs(refs, lookup) — THE center-roster reference resolver: one verdict word per member (missing_name / not_a_string / read_threw, CENTER_REF_FAULTS), one whole verdict (resolved / unresolved / refs_unreadable, CENTER_REFS_VERDICTS); the refs record is read by the public readPlainStringRecord, the lookup is the caller's, it reads no process.env; pure/browser-safe
-export { isBlankCoordinate } from "./execution-lane-index.js"; // THE lane-coordinate blank judge (empty or whitespace-only = absent; the write gate and every consumer ask this one function; whether a key is set, and whether an optional key may be empty, stays the caller's call); named: the lane tables' derived indexes stay package-private, pure/browser-safe
 // NOTE: the Node-fs-backed helpers (FileConfigStore + the file editor) are NOT in this barrel — they pull
 // `node:fs`/`node:path` and would break a browser/client bundle that only wants the contract (e.g.
 // web-admin's client components import the zod types through here). Import them from the Node-only

package/dist/migration-receipt.d.ts

@@ -7,7 +7,7 @@ import type { REMOTE_EXEC_DOCUMENT } from "./remote-exec.js";
 import type { DomainName, RetiredDomainName } from "./types.js";
 /** 本版登记的一次性**数据**迁移 id(闭集;每个 id 在 `ONE_TIME_MIGRATIONS` 登记表里恰一行)。收据只许这些 id —— 同表登记的 wire 删码位
  *  (`WIRE_RETIREMENT_IDS`,`./one-time-migrations`)不改任何存储形,铸不出收据,不在本集。 */
-export declare const ONE_TIME_MIGRATION_IDS: readonly ["SS-M1", "SS-M2", "SS-M3", "SS-M4", "SS-M5", "SS-M6", "SS-M7", "SS-M8", "SS-M9", "SS-M10", "SS-M11"];
+export declare const ONE_TIME_MIGRATION_IDS: readonly ["SS-M1", "SS-M2", "SS-M3", "SS-M4", "SS-M5", "SS-M6", "SS-M7", "SS-M8", "SS-M9", "SS-M10", "SS-M11", "SS-M12"];
 export type OneTimeMigrationId = (typeof ONE_TIME_MIGRATION_IDS)[number];
 /**
  * 一条收据说迁移**对一个坐标做了什么**(闭集,每词一义):

package/dist/migration-receipt.js

@@ -1,6 +1,6 @@
 /** 本版登记的一次性**数据**迁移 id(闭集;每个 id 在 `ONE_TIME_MIGRATIONS` 登记表里恰一行)。收据只许这些 id —— 同表登记的 wire 删码位
  *  (`WIRE_RETIREMENT_IDS`,`./one-time-migrations`)不改任何存储形,铸不出收据,不在本集。 */
-export const ONE_TIME_MIGRATION_IDS = ["SS-M1", "SS-M2", "SS-M3", "SS-M4", "SS-M5", "SS-M6", "SS-M7", "SS-M8", "SS-M9", "SS-M10", "SS-M11"];
+export const ONE_TIME_MIGRATION_IDS = ["SS-M1", "SS-M2", "SS-M3", "SS-M4", "SS-M5", "SS-M6", "SS-M7", "SS-M8", "SS-M9", "SS-M10", "SS-M11", "SS-M12"];
 /**
  * 一条收据说迁移**对一个坐标做了什么**(闭集,每词一义):
  *  - `moved`            — 值搬到新位(`to`),义不变;

package/dist/one-time-migrations.d.ts

@@ -41,7 +41,7 @@ export type StoredDocuments = Readonly<Partial<Record<DomainName | RetiredDomain
 export interface StoredDocumentsMigration {
     /** 迁移后的文档集:没改的文档是**同一引用**;被移除的(retired 域)不在;新建的(例:迁出的 `governance` / `limits`)在。 */
     readonly docs: Readonly<Record<string, unknown>>;
-    /** 逐条收据(步序 SS-M1 → SS-M2 → SS-M5 → SS-M6 → SS-M8 → SS-M9 → SS-M10 → SS-M7 → SS-M4:纯改写步在前,用新 schema 终判的 SS-M4 最后;步内按坐标)。
+    /** 逐条收据(步序 SS-M1 → SS-M2 → SS-M5 → SS-M6 → SS-M8 → SS-M9 → SS-M10 → SS-M7 → workers 行步〔SS-M12 改写 → SS-M4 改写 → 一次终判〕:纯改写步在前,用新 schema 终判的 workers 行步最后;步内按坐标)。
      *  只有 `refused` 的收据 = 什么都没改。 */
     readonly receipts: readonly MigrationReceipt[];
 }