@sema-agent/settings-schema 15.1.0 → 16.0.0

package/dist/one-time-migrations.js

@@ -36,8 +36,8 @@
  */
 import { z } from "zod";
 import { outgoingPath, redactSecrets } from "./config-fns.js";
-import { LANE_ENV_OWNER, STORE_ENV_KEYS, isLaneEnvKey } from "./execution-lane-index.js";
-import { EXECUTION_LANE_WORDS, MEMORY_ENGINE_BACKENDS, STORE_BACKENDS } from "./execution-lanes.js";
+import { LANE_ENV_OWNER, LATE_LANE_ENV_KEYS, STORE_ENV_KEYS, isLaneEnvKey } from "./execution-lane-index.js";
+import { EXECUTION_LANE_WORDS, STORE_BACKENDS } from "./execution-lanes.js";
 import { INTEGER } from "./integer.js";
 import { NOT_PLAIN_DATA, UNINSPECTABLE, UninspectableError, captureJson, dataDescriptor, emptyDocument, inspect, ownEntriesOf, ownOrThrow, readDeclaredKey, sentenceOfMinted } from "./own-key-read.js";
 import { isJsonArray, isPlainJsonObject, jsonShapeOf } from "./plain-json-object.js";
@@ -102,9 +102,10 @@ export const ONE_TIME_MIGRATIONS = [
         releasedOn: "2026-10-10",
         removableAfter: "2026-11-09",
         rewrites: "workers: a 6.x row (env.REMOTE_EXEC + lane keys, runtime.sessionBackend / memoryBackend / db, coords.tidb*, secretRefs.tidbPasswordEnv, store " +
-            "keys in env) is rewritten into runtime.execution + runtime.store; a row the step would have to guess for, or that still does not read after the " +
-            "rewrite, is refused and kept verbatim (readWorkersRows holds it on read). Runs last: the rewritten row is judged after every other step's " +
-            "rewrite (SS-M7's fragment strip included)",
+            "keys in env) is rewritten into runtime.execution + runtime.store — since 16.0.0 straight into the 16.0.0 form: the lane lands as " +
+            "runtime.execution.lanes [<lane>], and env MEMORY_ENGINE_BACKEND \"tidb\" lands as store.memory.backend \"mysql\"; a row the step would have to guess for, or that still " +
+            "does not read after the rewrite, is refused and kept verbatim (readWorkersRows holds it on read). Runs last, in one workers-row step with SS-M12 (SS-M12's " +
+            "rewrite first, then this one's): the row is judged once, after both and after every other step's rewrite (SS-M7's fragment strip included)",
         removal: "the next major after the window: delete the SS-M4 step; the 6.x tombstone fields of WorkerSpec and the reserved-env signpost stay — their SS-M4 clause goes",
         afterRemoval: "the 6.x tombstone fields of WorkerSpec and the reserved-env refusal (permanent): a residual 6.x row is held by readWorkersRows, never rewritten",
     },
@@ -204,6 +205,25 @@ export const ONE_TIME_MIGRATIONS = [
             "refuse on it today. Where the engine refuses, the way out is to write config.env-models.json = {\"envModels\":\"replaced\"} in the " +
             "config root; no signpost in this package",
     },
+    {
+        id: "SS-M12",
+        oldForm: "refused",
+        introducedIn: "16.0.0",
+        releasedOn: "2026-10-30",
+        removableAfter: "2026-11-29",
+        rewrites: "workers: a 7.0–15.x row is rewritten into the 16.0.0 form, field by field — runtime.execution.lane L ⇒ runtime.execution.lanes [L] (moved); " +
+            "runtime.store.memory.backend \"tidb\" ⇒ \"mysql\" (rewritten: the same MySQL-family store, now one word with store.backend); DEVICE_RELAY_URL in env " +
+            "(the 15.x write gate took it as a plain env key) ⇒ runtime.execution.coords.DEVICE_RELAY_URL when the row declares the device lane (moved), dropped when " +
+            "it does not (dropped-inert: the engine reads it only on the device lane). Refused and kept verbatim (readWorkersRows holds it on read): a row carrying both " +
+            "lane and lanes, a DEVICE_RELAY_URL on a row that declares the device lane but sets it from a host secret (secretEnv: the value cannot be read) or writes it " +
+            "both in env and in coords, and a row that still does not read after the rewrite — a device row with no DEVICE_RELAY_URL among them (a required coordinate " +
+            "since 16.0.0; the step does not guess between a URL and \"none\"). Runs in one workers-row step with SS-M4, after every pure-rewrite step: this step's " +
+            "rewrite first, then SS-M4's, then one judgement of the row (a refusal of that judgement is filed under the newest migration that rewrote the row)",
+        removal: "the next major after the window: delete the SS-M12 step; the runtime.execution.lane tombstone field, the memory-backend refusal for \"tidb\" and the " +
+            "reserved-env signpost for DEVICE_RELAY_URL stay — their SS-M12 clause goes",
+        afterRemoval: "the runtime.execution.lane tombstone field, the memory-backend refusal for \"tidb\" and the reserved-env refusal for DEVICE_RELAY_URL (permanent): a residual " +
+            "15.x row is refused on write and held by readWorkersRows on read, never rewritten",
+    },
     {
         // 一条 wire 位的删码登记,不是数据迁移(id 在 WIRE_RETIREMENT_IDS,不在收据闭集)。
         id: "SS-W1",
@@ -261,8 +281,10 @@ export function migrateStoredDocuments(docs, opts) {
     for (const [k, v] of entries.value)
         Object.defineProperty(out, k, dataDescriptor(v));
     const receipts = [];
-    // 步序的律:纯改写步在前,拿新 schema 终判改写结果的步(SS-M4)最后 —— 它判的是**全部**改写之后的行,别的步能修好的形(例:SS-M7 剥掉的
-    // fragment)不会先被它拒掉(否则一跑 refused、二跑才过:既不是一次完成,也不幂等)。
+    // 步序的律:纯改写步在前,拿新 schema 终判改写结果的 workers 行步最后 —— 它判的是**全部**改写之后的行,别的步能修好的形(例:SS-M7 剥掉的
+    // fragment)不会先被它拒掉(否则一跑 refused、二跑才过:既不是一次完成,也不幂等)。同一条律落到行内:一行可以同时带 SS-M12 认的形(7.0+ 的单值车道)
+    // 与 SS-M4 认的形(6.x 的店字段),所以两只迁移在**一步**里按行做 —— SS-M12 先改(7.0+ 行 env 里的晚登记车道键 `DEVICE_RELAY_URL` 在 SS-M4 眼里是
+    // 「新旧两形并存」,先由 SS-M12 归位),SS-M4 再改,改完**判一次**;各判各的会互相卡死(一只判「另一只的形还在」而拒)。
     try {
         stepRuntimeDomain(out, opts.coverage, receipts);
         stepHostsBounds(out, receipts);
@@ -272,7 +294,7 @@ export function migrateStoredDocuments(docs, opts) {
         stepModelsDefault(out, receipts);
         stepPromptsAxes(out, receipts);
         stepUrlFragments(out, receipts);
-        stepWorkers6x(out, receipts);
+        stepWorkersRows(out, receipts);
     }
     catch (e) {
         const sentence = sentenceOfMinted(e);
@@ -482,16 +504,21 @@ const MEMORY_ENGINE_OFF_WORDS = ["off", "false", "0", "no", "disabled"];
 const MYSQL_DEFAULT_PORT = 3306;
 const isLaneWord = (v) => typeof v === "string" && EXECUTION_LANE_WORDS.some((w) => w === v);
 const isStoreWord = (v) => typeof v === "string" && STORE_BACKENDS.some((w) => w === v);
-const isMemoryBackendWord = (v) => typeof v === "string" && MEMORY_ENGINE_BACKENDS.some((w) => w === v);
+/** 6.x 引擎收的 `MEMORY_ENGINE_BACKEND` 词 → 今天的词(16.0.0 起 MySQL 族那一只叫 `mysql`,与店词同字)。键 = 6.x 引擎的闭集(它见 `mysql` 拒启)。 */
+const SIX_X_MEMORY_BACKEND = new Map([
+    ["file", "file"],
+    ["pg", "pg"],
+    ["tidb", "mysql"],
+]);
 /** 拒因里只点名形如词的值(短、小写);其余一律不回显(值可能是粘错位置的凭据)。 */
 const describeWord = (v) => (typeof v === "string" && /^[a-z0-9][a-z0-9-]{0,31}$/.test(v) ? `"${v}"` : "(value not shown)");
 const UNCHANGED = { kind: "unchanged" };
 /**
- * 一行的 6.x 改写。规则(每个旧键恰好一种去处):车道 —— `env.REMOTE_EXEC` 是车道词 ⇒ `runtime.execution.lane`,同车道的 env 键 ⇒ `coords`、
+ * 一行的 6.x 改写。规则(每个旧键恰好一种去处):车道 —— `env.REMOTE_EXEC` 是车道词 ⇒ `runtime.execution.lanes`(一元表),同车道的 env 键 ⇒ `coords`、
  * 同车道的 `secretEnv` 密钥 ⇒ `secretRefs`;别车道的键与 `REQUIRE_EXECUTION_LANE` ⇒ 丢(引擎只读被点名车道那一臂);enabled 且无车道 ⇒ 拒
  * (不替运维猜车道)。店 —— `sessionBackend` ⇒ `store.session`(`tidb` ⇒ `mysql`);`memoryBackend` ⇒ 丢(从未到达引擎);`coords.tidb*` +
  * `runtime.db` ⇒ `store.db`(缺端口 ⇒ 3306),`tidbPasswordEnv` ⇒ `dbPasswordEnv`;无 host ⇒ `store.backend = local`;env 里的
- * `DB_BACKEND` / `MEMORY_ENGINE` / `MEMORY_ENGINE_BACKEND` ⇒ 搬进 `store`。表达不了 ⇒ 拒:值写错了栏、不认识的词、新旧两形并存、
+ * `DB_BACKEND` / `MEMORY_ENGINE` / `MEMORY_ENGINE_BACKEND` ⇒ 搬进 `store`(方言 `tidb` ⇒ `mysql`)。表达不了 ⇒ 拒:值写错了栏、不认识的词、新旧两形并存、
  * `DB_BACKEND=pg` 配 MySQL 族坐标。不是 6.x 形的行(没有任何旧键,该有的块都在)⇒ 不动 —— 它读不读得进是 `readWorkersRows` 的事。
  */
 function migrateWorkerRow(row) {
@@ -538,7 +565,7 @@ function migrateWorkerRow(row) {
     if (secretStoreKey !== undefined)
         return refuse(["secretEnv", secretStoreKey], `${secretStoreKey} is set from a host secret — the migration cannot read it; declare runtime.store by hand`);
     if (has(rawSecretEnv, "REMOTE_EXEC"))
-        return refuse(["secretEnv", "REMOTE_EXEC"], "the execution lane is set from a host secret — the migration cannot read it; declare runtime.execution.lane by hand");
+        return refuse(["secretEnv", "REMOTE_EXEC"], "the execution lane is set from a host secret — the migration cannot read it; declare runtime.execution.lanes by hand");
     const needLane = !hasExecution && (enabled || laneTouched);
     const needStore = !hasStore && (enabled || storeTouched);
     // 收尾要问「原来的 env / secretEnv 有没有键」:在拷之前、浅读里问好
@@ -567,7 +594,7 @@ function migrateWorkerRow(row) {
         if (rx === undefined || rx === "") {
             if (enabled) {
                 return refuse(["env", "REMOTE_EXEC"], `an enabled worker names no execution lane (env.REMOTE_EXEC is unset) — it boots with no hands and still reports tasks completed. ` +
-                    `The migration does not guess a lane: set runtime.execution.lane (${EXECUTION_LANE_WORDS.join(" | ")}) by hand, or disable the worker`);
+                    `The migration does not guess a lane: set runtime.execution.lanes (${EXECUTION_LANE_WORDS.join(" | ")}) by hand, or disable the worker`);
             }
             for (const k of envLaneKeys)
                 drop(env, "env", k); // 停用且没点名车道 ⇒ 每个车道键都是惰性的
@@ -576,7 +603,7 @@ function migrateWorkerRow(row) {
         }
         else {
             if (!isLaneWord(rx)) {
-                return refuse(["env", "REMOTE_EXEC"], `env.REMOTE_EXEC ${describeWord(rx)} is not an execution lane (${EXECUTION_LANE_WORDS.join(" | ")}) — the engine refuses to start with it; set runtime.execution.lane by hand`);
+                return refuse(["env", "REMOTE_EXEC"], `env.REMOTE_EXEC ${describeWord(rx)} is not an execution lane (${EXECUTION_LANE_WORDS.join(" | ")}) — the engine refuses to start with it; set runtime.execution.lanes by hand`);
             }
             const lane = rx;
             const laneCoords = emptyDocument();
@@ -615,7 +642,7 @@ function migrateWorkerRow(row) {
                 laneSecretRefs[k] = v;
                 delete secretEnv[k];
             }
-            runtime.execution = { lane, coords: laneCoords, secretRefs: laneSecretRefs };
+            runtime.execution = { lanes: [lane], coords: laneCoords, secretRefs: laneSecretRefs };
         }
     }
     // ── 店
@@ -709,10 +736,11 @@ function migrateWorkerRow(row) {
             }
             const memoryBackendRaw = env.MEMORY_ENGINE_BACKEND;
             if (memoryBackendRaw !== undefined) {
-                if (!isMemoryBackendWord(memoryBackendRaw)) {
-                    return refuse(["env", "MEMORY_ENGINE_BACKEND"], `env.MEMORY_ENGINE_BACKEND ${describeWord(memoryBackendRaw)} is not a memory backend (${MEMORY_ENGINE_BACKENDS.join(" | ")}) — the engine refuses to start with it`);
+                const today = typeof memoryBackendRaw === "string" ? SIX_X_MEMORY_BACKEND.get(memoryBackendRaw) : undefined;
+                if (today === undefined) {
+                    return refuse(["env", "MEMORY_ENGINE_BACKEND"], `env.MEMORY_ENGINE_BACKEND ${describeWord(memoryBackendRaw)} is not a 6.x memory backend (${[...SIX_X_MEMORY_BACKEND.keys()].join(" | ")}) — the engine refused to start with it`);
                 }
-                memory.backend = memoryBackendRaw;
+                memory.backend = today;
                 delete env.MEMORY_ENGINE_BACKEND;
             }
             if (Object.keys(memory).length > 0)
@@ -725,16 +753,95 @@ function migrateWorkerRow(row) {
         delete w.env;
     if (isPlainJsonObject(w.secretEnv) && Object.keys(secretEnv).length === 0 && secretEnvHadKeys)
         delete w.secretEnv;
-    // 改写后的行仍读不进 7.x 形 ⇒ 不写回半成品:拒,原文留盘(读口 `readWorkersRows` 扣下它)。判据与拒句是读口那一只(`workerRowVerdict`)。
-    const verdict = workerRowVerdict(w, "migrated");
-    if (verdict !== undefined)
-        return refuse(verdict.field, verdict.reason);
-    const out = captureJson(w, "ordinary"); // 交出去的是寻常对象(隔离原型的深副本只是工作副本)
-    if (!out.ok)
-        throw new UninspectableError(out.sentence);
-    return { kind: "rewritten", row: out.value, dropped };
+    // 改写后的行还没判:终判在 workers 行步(两只迁移的改写都做完之后判一次,见 `stepWorkersRows`)。
+    return { kind: "rewritten", row: w, dropped };
 }
-function stepWorkers6x(out, receipts) {
+/** SS-M12 认的晚登记车道键(16.0.0 那一批;表在 `execution-lane-index.ts`,这里只取归 SS-M12 的那几个)。 */
+const SS_M12_ENV_KEYS = [...LATE_LANE_ENV_KEYS].filter(([, m]) => m.migration === "SS-M12").map(([k]) => k);
+/**
+ * 一行的 15.x 改写(规则见登记表 SS-M12 行)。只认 7.0+ 行上的三种形 —— `runtime.execution.lane`、`runtime.store.memory.backend: "tidb"`、带 `runtime.execution` 的行
+ * 逃生口里的晚登记车道键 —— 逐字段改,每改一处一张收据。先浅读判要不要迁(没有这三种形的行一个字段都不动、不拷);要迁才拍快照改副本。
+ * 改完的行不在这里判:SS-M4 可能还要改同一行,读侧那一只(`workerRowVerdict`)在 workers 行步里两只都改完之后判一次(`stepWorkersRows`)。
+ */
+function migrateWorkerRow15(row) {
+    const refuse = (field, reason) => ({ kind: "refused", field, reason });
+    const peek = (o, k) => (isPlainJsonObject(o) ? ownOrThrow(o, k) : undefined);
+    const rawRuntime = peek(row, "runtime");
+    const rawExecution = peek(rawRuntime, "execution");
+    const laneOld = has(rawExecution, "lane");
+    const memoryTidb = peek(peek(peek(rawRuntime, "store"), "memory"), "backend") === "tidb";
+    const lateKeysAt = (slot) => (isPlainJsonObject(rawExecution) ? SS_M12_ENV_KEYS.filter((k) => has(peek(row, slot), k)) : []);
+    const late = { env: lateKeysAt("env"), secretEnv: lateKeysAt("secretEnv") };
+    if (!laneOld && !memoryTidb && late.env.length + late.secretEnv.length === 0)
+        return { kind: "unchanged" };
+    if (laneOld && has(rawExecution, "lanes")) {
+        return refuse(["runtime", "execution", "lane"], "declares runtime.execution.lane (the 15.x single lane) AND runtime.execution.lanes (the 16.0.0 lane set) — keep one form; the migration does not pick a winner");
+    }
+    const working = captureJson(row);
+    if (!working.ok)
+        throw new UninspectableError(working.sentence);
+    const w = working.value;
+    const runtime = w.runtime;
+    const changes = [];
+    if (laneOld) {
+        // 换名不换位:`lanes` 落在 `lane` 原来的键序位置上,值是只含旧车道的一元表
+        const before = runtime.execution;
+        const next = emptyDocument();
+        for (const [k, v] of Object.entries(before))
+            Object.defineProperty(next, k === "lane" ? "lanes" : k, dataDescriptor(k === "lane" ? [v] : v));
+        runtime.execution = next;
+        changes.push({ appliedAs: "moved", path: ["runtime", "execution", "lane"], to: ["runtime", "execution", "lanes"] });
+    }
+    if (memoryTidb) {
+        runtime.store.memory.backend = "mysql";
+        changes.push({ appliedAs: "rewritten", path: ["runtime", "store", "memory", "backend"] });
+    }
+    const execution = runtime.execution;
+    if (isPlainJsonObject(execution)) {
+        const lanes = isJsonArray(execution.lanes) ? execution.lanes : [];
+        for (const slot of ["env", "secretEnv"]) {
+            if (late[slot].length === 0)
+                continue;
+            const rec = w[slot];
+            for (const key of late[slot]) {
+                const owner = LANE_ENV_OWNER.get(key);
+                if (owner === undefined)
+                    throw new Error(`SS-M12: ${key} has no lane in the execution lane table (package invariant broken)`);
+                if (!lanes.includes(owner.lane)) {
+                    delete rec[key]; // 这台 worker 不声明那条车道:引擎只在那条车道的臂里读它,从没生效
+                    changes.push({ appliedAs: "dropped-inert", path: [slot, key] });
+                    continue;
+                }
+                if (owner.secret)
+                    return refuse([slot, key], `${key} is a secret of lane "${owner.lane}" — declare it by hand in runtime.execution.secretRefs.${key} (the host env-NAME holding it)`);
+                if (slot === "secretEnv")
+                    return refuse([slot, key], `${key} is a non-secret coordinate of lane "${owner.lane}" but is set from a host secret — the migration cannot read the value; write it in runtime.execution.coords.${key} by hand`);
+                const coords = isPlainJsonObject(execution.coords) ? execution.coords : emptyDocument();
+                if (Object.hasOwn(coords, key))
+                    return refuse([slot, key], `${key} is written both in env and in runtime.execution.coords — keep one (the coordinate); the migration does not pick a winner`);
+                const value = rec[key];
+                if (typeof value !== "string")
+                    return refuse([slot, key], `env.${key} is not a string`);
+                coords[key] = value;
+                execution.coords = coords;
+                delete rec[key];
+                changes.push({ appliedAs: "moved", path: [slot, key], to: ["runtime", "execution", "coords", key] });
+            }
+            if (Object.keys(rec).length === 0)
+                delete w[slot]; // 被搬空的逃生口整键去掉(可选字段;留一个 `{}` 只是噪声)
+        }
+    }
+    // 改写后的行还没判:SS-M4 可能还要改它(6.x 的店字段),终判在 workers 行步(见 `stepWorkersRows`)。
+    return { kind: "rewritten", row: w, changes };
+}
+/**
+ * workers 行步:SS-M12 与 SS-M4 在**一步**里按行做 —— SS-M12 改写(7.0+ 的形)→ SS-M4 改写(6.x 的形)→ 用读侧那一只(`workerRowVerdict`)**判一次**。
+ * 一行两只都可能要改(7.0+ 的单值车道 + 6.x 的店字段);各判各的会互相卡死:先判的那只看见另一只的旧形还在而拒,重跑同样。
+ *  · 形上就改不了(两形并存、值写错了栏……)⇒ 那一只的拒收据,另一只的改写不留(行原样,收据与交回的文档一致);
+ *  · 改完读不进 ⇒ 一张拒收据,记在**改了这一行的最新那只迁移**名下(这一行要抬到的就是它的形),原文留盘(读口 `readWorkersRows` 扣下它);
+ *  · 读得进 ⇒ 写回寻常对象(工作副本隔离原型,只是副本),收据按迁移序:SS-M12 的逐字段收据,再 SS-M4 的 `rewritten` + `dropped-inert`。
+ */
+function stepWorkersRows(out, receipts) {
     const doc = ownOrThrow(out, "workers");
     if (!isPlainJsonObject(doc))
         return;
@@ -746,24 +853,38 @@ function stepWorkers6x(out, receipts) {
     rows.forEach((row, index) => {
         if (!isPlainJsonObject(row) || typeof ownOrThrow(row, "name") !== "string")
             return; // 认不出名字:整域读侧判
-        const r = migrateWorkerRow(row);
-        switch (r.kind) {
-            case "unchanged":
-                return;
-            case "refused":
-                receipts.push(refused("SS-M4", "workers", ["workers", index, ...r.field], r.reason));
-                return;
-            case "rewritten":
-                next ??= [...rows];
-                next[index] = r.row;
-                receipts.push(receipt("SS-M4", "workers", ["workers", index], "rewritten"));
-                for (const field of r.dropped)
-                    receipts.push(receipt("SS-M4", "workers", ["workers", index, ...field], "dropped-inert"));
-                return;
-            default: {
-                const unhandled = r;
-                throw new Error(`SS-M4: unhandled row outcome ${JSON.stringify(unhandled)}`);
-            }
+        const at = (path) => ["workers", index, ...path];
+        const r12 = migrateWorkerRow15(row);
+        if (r12.kind === "refused") {
+            receipts.push(refused("SS-M12", "workers", at(r12.field), r12.reason));
+            return;
+        }
+        const r4 = migrateWorkerRow(r12.kind === "rewritten" ? r12.row : row);
+        if (r4.kind === "refused") {
+            receipts.push(refused("SS-M4", "workers", at(r4.field), r4.reason));
+            return;
+        }
+        if (r12.kind === "unchanged" && r4.kind === "unchanged")
+            return;
+        const final = r4.kind === "rewritten" ? r4.row : r12.row;
+        const verdict = workerRowVerdict(final, "migrated");
+        if (verdict !== undefined) {
+            receipts.push(refused(r12.kind === "rewritten" ? "SS-M12" : "SS-M4", "workers", at(verdict.field), verdict.reason));
+            return;
+        }
+        const written = captureJson(final, "ordinary"); // 交出去的是寻常对象(隔离原型的深副本只是工作副本)
+        if (!written.ok)
+            throw new UninspectableError(written.sentence);
+        next ??= [...rows];
+        next[index] = written.value;
+        if (r12.kind === "rewritten") {
+            for (const c of r12.changes)
+                receipts.push(c.appliedAs === "moved" ? moved("SS-M12", "workers", at(c.path), { document: "workers", path: at(c.to) }) : receipt("SS-M12", "workers", at(c.path), c.appliedAs));
+        }
+        if (r4.kind === "rewritten") {
+            receipts.push(receipt("SS-M4", "workers", ["workers", index], "rewritten"));
+            for (const field of r4.dropped)
+                receipts.push(receipt("SS-M4", "workers", at(field), "dropped-inert"));
         }
     });
     if (next !== undefined)

package/dist/remote-exec.js

@@ -30,15 +30,22 @@ import { z } from "zod";
 import { INTEGER } from "./integer.js";
 import { buildQuotedIssue } from "./quoted-issue.js";
 import { ENV_NAME, K8S_QUANTITY, NON_SECRET_URL, TCP_PORT, containsSecretToken, hasNul } from "./types.js";
-import { retiredLaneWordRefusal } from "./execution-lanes.js";
+import { isBlankCoordinate, retiredLaneWordRefusal } from "./execution-lanes.js";
 import { ownValueOf } from "./own-key-read.js";
 import { isPlainJsonObject } from "./plain-json-object.js";
 /** The name of this contract's document in a `config.d` directory (`config.d/remote-exec.json`) —— the one spelling: the local reader /
  *  writer, the directory migration and the command line name the document by it. It is not a config domain (not in `DOMAIN_SCHEMAS`). */
 export const REMOTE_EXEC_DOCUMENT = "remote-exec";
-/** A non-empty exec-bound string (an image / path / shell / arg the adapter feeds to spawn()/fs). Rejects a NUL
- *  byte uniformly — a NUL validates here but makes Node throw at spawn/boot (fail-OPEN → runtime crash). R20. */
-const execStr = z.string().min(1).refine((s) => !hasNul(s), buildQuotedIssue `must not contain a NUL byte`);
+/** A non-blank exec-bound string (an image / path / shell / arg the adapter feeds to spawn()/fs) — THE one grammar of every string field in this file that
+ *  is not an env-NAME / quantity / URL. Blank = empty or whitespace-only, asked of THE lane-coordinate blank judge (`isBlankCoordinate`, the one the
+ *  write gate asks of every required coordinate): the same deployment statement ("which image", "which namespace") is refused under one reading on
+ *  both surfaces, and an empty string and a whitespace-only one are one refusal with one sentence (no second reading of "empty"). The judge only
+ *  judges — an accepted value is carried verbatim, never trimmed. Rejects a NUL byte uniformly — a NUL validates here but makes Node throw at
+ *  spawn/boot (fail-OPEN → runtime crash). R20. */
+const execStr = z
+    .string()
+    .refine((s) => !isBlankCoordinate(s), buildQuotedIssue `must not be empty or whitespace-only — give it a real value (an optional key can simply be left out)`)
+    .refine((s) => !hasNul(s), buildQuotedIssue `must not contain a NUL byte`);
 /** Container knobs of the `local-docker` lane. `network` defaults to `none` at the adapter (the safe posture for
  *  untrusted code — see the dual-mode design note). */
 const DOCKER_FIELDS = {

package/dist/safety-merge-spec.d.ts

@@ -572,7 +572,7 @@ export declare const SAFETY_MERGE_SPEC: {
         };
         readonly enforcement: "client";
         readonly fail: "open";
-        readonly seam: "MemoryStore";
+        readonly seam: "MemoryEngine";
     };
     readonly autoCompaction: {
         readonly mergeShape: "replace";

package/dist/safety-merge-spec.js

@@ -430,7 +430,7 @@ export const SAFETY_MERGE_SPEC = {
     model: { mergeShape: "replace", minTrust: "session", tighten: { rule: "none" }, enforcement: "client", fail: "open", seam: "RoleSpec / TaskSpec.{model,thinking}" },
     env: { mergeShape: "concat", minTrust: "project", tighten: { rule: "none" }, enforcement: "resolver", fail: "open", seam: "NodeExecutionEnv.shellEnv (later layer overrides same name)" },
     envSecret: { mergeShape: "replace", minTrust: "global", tighten: { rule: "none" }, enforcement: "resolver", fail: "closed", seam: "§7 secret-ref resolution" },
-    memoryScopes: { mergeShape: "concat", minTrust: "global", tighten: { rule: "none" }, enforcement: "client", fail: "open", seam: "MemoryStore" },
+    memoryScopes: { mergeShape: "concat", minTrust: "global", tighten: { rule: "none" }, enforcement: "client", fail: "open", seam: "MemoryEngine" },
     autoCompaction: { mergeShape: "replace", minTrust: "session", tighten: { rule: "none" }, enforcement: "client", fail: "open", seam: "compaction config" },
     ui: { mergeShape: "replace", minTrust: "local", tighten: { rule: "none" }, enforcement: "client", fail: "open", seam: "shell-only (theme/keybindings/statusLine) — never touches the engine" },
     org: { mergeShape: "replace", minTrust: "managed", tighten: { rule: "none" }, enforcement: "server", fail: "closed", seam: "web-admin → governanceBaseline (SSO/SCIM/audit/budget, TOB-only)" },

package/dist/types.d.ts

@@ -506,11 +506,11 @@ export type SystemsConfig = z.infer<typeof SystemsConfig>;
 export declare const SystemStatusEntry: z.ZodObject<{
     name: z.ZodString;
     phase: z.ZodEnum<{
+        refused: "refused";
         bootstrap: "bootstrap";
         steady: "steady";
         rotating: "rotating";
         grace: "grace";
-        refused: "refused";
         "lkg-hold": "lkg-hold";
     }>;
     fp: z.ZodString;
@@ -1427,7 +1427,8 @@ export declare const WorkerSpec: z.ZodObject<{
     }, z.core.$strip>>;
     runtime: z.ZodObject<{
         execution: z.ZodOptional<z.ZodObject<{
-            lane: z.ZodEnum<{
+            lane: z.ZodOptional<z.ZodNever>;
+            lanes: z.ZodArray<z.ZodEnum<{
                 host: "host";
                 e2b: "e2b";
                 k8s: "k8s";
@@ -1435,7 +1436,7 @@ export declare const WorkerSpec: z.ZodObject<{
                 adb: "adb";
                 "local-docker": "local-docker";
                 device: "device";
-            }>;
+            }>>;
             coords: z.ZodPrefault<z.ZodRecord<z.ZodString, z.ZodString>>;
             secretRefs: z.ZodPrefault<z.ZodRecord<z.ZodString, z.ZodString>>;
         }, z.core.$strip>>;
@@ -1458,8 +1459,8 @@ export declare const WorkerSpec: z.ZodObject<{
                 }>>;
                 backend: z.ZodDefault<z.ZodEnum<{
                     file: "file";
+                    mysql: "mysql";
                     pg: "pg";
-                    tidb: "tidb";
                 }>>;
             }, z.core.$strip>>;
             db: z.ZodOptional<z.ZodObject<{
@@ -1595,7 +1596,8 @@ export declare const WorkersConfig: z.ZodObject<{
         }, z.core.$strip>>;
         runtime: z.ZodObject<{
             execution: z.ZodOptional<z.ZodObject<{
-                lane: z.ZodEnum<{
+                lane: z.ZodOptional<z.ZodNever>;
+                lanes: z.ZodArray<z.ZodEnum<{
                     host: "host";
                     e2b: "e2b";
                     k8s: "k8s";
@@ -1603,7 +1605,7 @@ export declare const WorkersConfig: z.ZodObject<{
                     adb: "adb";
                     "local-docker": "local-docker";
                     device: "device";
-                }>;
+                }>>;
                 coords: z.ZodPrefault<z.ZodRecord<z.ZodString, z.ZodString>>;
                 secretRefs: z.ZodPrefault<z.ZodRecord<z.ZodString, z.ZodString>>;
             }, z.core.$strip>>;
@@ -1626,8 +1628,8 @@ export declare const WorkersConfig: z.ZodObject<{
                     }>>;
                     backend: z.ZodDefault<z.ZodEnum<{
                         file: "file";
+                        mysql: "mysql";
                         pg: "pg";
-                        tidb: "tidb";
                     }>>;
                 }, z.core.$strip>>;
                 db: z.ZodOptional<z.ZodObject<{
@@ -1787,7 +1789,8 @@ export declare const HostStatus: z.ZodObject<{
             }, z.core.$strip>>;
         }, z.core.$strip>>;
     }, z.core.$strip>;
-    ts: z.ZodString;
+    ts: z.ZodISODateTime;
+    heartbeatMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 export type HostStatus = z.infer<typeof HostStatus>;
 export declare const SkillSpec: z.ZodObject<{
@@ -2673,7 +2676,8 @@ export declare const DOMAIN_SCHEMAS: {
             }, z.core.$strip>>;
             runtime: z.ZodObject<{
                 execution: z.ZodOptional<z.ZodObject<{
-                    lane: z.ZodEnum<{
+                    lane: z.ZodOptional<z.ZodNever>;
+                    lanes: z.ZodArray<z.ZodEnum<{
                         host: "host";
                         e2b: "e2b";
                         k8s: "k8s";
@@ -2681,7 +2685,7 @@ export declare const DOMAIN_SCHEMAS: {
                         adb: "adb";
                         "local-docker": "local-docker";
                         device: "device";
-                    }>;
+                    }>>;
                     coords: z.ZodPrefault<z.ZodRecord<z.ZodString, z.ZodString>>;
                     secretRefs: z.ZodPrefault<z.ZodRecord<z.ZodString, z.ZodString>>;
                 }, z.core.$strip>>;
@@ -2704,8 +2708,8 @@ export declare const DOMAIN_SCHEMAS: {
                         }>>;
                         backend: z.ZodDefault<z.ZodEnum<{
                             file: "file";
+                            mysql: "mysql";
                             pg: "pg";
-                            tidb: "tidb";
                         }>>;
                     }, z.core.$strip>>;
                     db: z.ZodOptional<z.ZodObject<{