@whyshu/argent-engine 0.0.0-stage → 0.6.1

package/engine/configs/_aliases.proposed.json

@@ -0,0 +1,651 @@
+{
+  "_doc": "别名提案（未生效，待批 2 实现）—— 同一语义只允许一个 canonical key；本文件把跨面/历史别名**登记**下来，供批 2 的**统一解析器**解释。⛔ 本文件不是 configs/<域>.json 那样的可配项声明：文件名以 `_` 开头 ⇒ core/lib/config-catalog.mjs 的 CATALOG_FILE_RE(/^[A-Za-z0-9][A-Za-z0-9_-]*\\.json$/) **不匹配**，目录加载器会跳过它（不会被当成一个配置域、不会进设置页载荷）。",
+  "_schema": "argent-config-aliases/1",
+  "_generatedAt": "2026-10-09",
+  "_author": "配置别名清单调查（批 2 只读前置）",
+  "_shape": {
+    "canonical": "规范 key —— 该语义**唯一允许被写**的那个（多数是 configs/*.json / verticals/*/config.json 里已声明的 key；标 (新) = 建议批 2 新增声明）",
+    "level": "canonical 的主来源载体：env | envfile | json（machine/CLI 另见 carriers）",
+    "names": "别名 / 历史名 / 撞名的同名键（**只读解析**，⛔ 不得双向写）",
+    "readers": "读取点，逐个列 `文件:行`（⛔ 不是文件名）",
+    "carriers": "该语义实际被写/被读的载体：进程 env / envfile(哪个文件) / config.json / plist / credentials / CLI 参数",
+    "action": "alias=登记别名并统一解析 | merge=多名字收敛到一个 canonical（要改读取点） | deprecate=废弃该名并**出声告警**（静默失效是禁止项）",
+    "riskLevel": "P0(已致事故/高概率致事故) | P1(两处都有值会分叉) | P2(声明面不一致/僵尸键) | P3(仅登记，现状无害)",
+    "risk": "风险类型 + **两处都有值会怎样**（谁赢 / 是否与声明一致 / 是否静默）",
+    "evidence": "为什么这么判 —— 只写可复核的事实（行号 / 生产实测的**键名与相等性**，⛔ 绝不含任何值本身）"
+  },
+  "_rules": [
+    "① 同一语义只允许一个 canonical key；别名**只做只读解析**（读旧名 → 报 canonical），⛔ 不做双向写（写别名=制造第二真源）。",
+    "② 解析器只有一处实现（建议落在 core/lib/config-catalog.mjs 的读取链上，或紧邻的一个 resolveAlias()），⛔ 禁止两个读取点各自解释；每个读取点必须**如实播报\"这次是从哪个名字取到的\"**（沿用 scripts/orchestrator.py:407 `_done_card_sink` 的\"群来源 XXX\"口径）。",
+    "③ 命中别名一律出声（日志/卡片/诊断一行），且**凡降级路径都要有断言证明它没被走到**（本项目已有两次\"静默 fallback 产出错值\"事故：flow_registry 降级、反斜杠键绕过锁比对）。"
+  ],
+  "_gates": [
+    "新增门禁建议：`别名↔声明双向对账` —— (a) 本表每条 canonical 必须能在 configs/*.json 或 verticals/*/config.json 里找到声明；(b) 每个 name 必须能在代码里找到 ≥1 个 readers 行（否则是僵尸名，应转 deprecate）；(c) 声明里两个 key **不得归一成同一个 env 名**（沿用 check-config-catalog 门禁①(c)）。",
+    "反证：注入『别名无人读』『canonical 无声明』『两个 canonical 归一撞名』三种假象，门禁必须逐条判红。"
+  ],
+  "aliases": [
+    {
+      "canonical": "notify.alert.chat_id",
+      "level": "json",
+      "names": [
+        "mlDailyAlertChatId",
+        "FULL_INTERNAL_CHAT_ID",
+        "ML_DAILY_ALERT_CHAT_ID",
+        "FEISHU_CHAT_ID"
+      ],
+      "readers": [
+        "scripts/feishu-card.mjs:176",
+        "scripts/daily-report.mjs:1006",
+        "scripts/orchestrator.py:7756",
+        "scripts/orchestrator.py:421",
+        "scripts/orchestrator.py:7993",
+        "scripts/orchestrator.py:8014",
+        "scripts/orchestrator.py:8056",
+        "scripts/orchestrator.py:12230",
+        "scripts/orchestrator.py:12329",
+        "scripts/customer-readiness.sh:71",
+        "plugins/argent-flow/src/index.js:114",
+        "plugins/argent-flow/src/index.js:797"
+      ],
+      "carriers": [
+        "config.json#mlDailyAlertChatId",
+        "envfile:fulfillment.env#FULL_INTERNAL_CHAT_ID",
+        "envfile:fulfillment.env#FEISHU_CHAT_ID",
+        "env:ML_DAILY_ALERT_CHAT_ID",
+        "CLI:--to internal|daily|oc_…"
+      ],
+      "action": "merge",
+      "riskLevel": "P0",
+      "risk": "同义不同名（**已致事故**）+ 同名不同义。两处都有值：FULL 卡片链 = `FULL_INTERNAL_CHAT_ID` → `feishuChatId`（**从不读 `mlDailyAlertChatId`**）；日报告警链 = `ML_DAILY_ALERT_CHAT_ID` → `mlDailyAlertChatId` → 硬编码常量 （代码内 hard-coded 的 `oc_` 群常量）。两条链互不知情 ⇒ 改一处只有一半生效、零告警。与声明一致：两个名字各有自己的声明（notify.full.internal_chat_id / notify.daily.alert_chat_id），**声明面本身就承认了两个 key 描述同一件事**。",
+      "evidence": "2026-10-09 真实事故：FULL 失败通知发不出去——同一语义散落 fulfillment.env 与 config.json 两处，被不同代码读取。客户机（生产）实测：`FULL_INTERNAL_CHAT_ID`、`mlDailyAlertChatId`、`feishuChatId` **三个名字同时有值且值相同**（同一 35 字符 oc_ 群）；开发机实测 `mlDailyAlertChatId` **未设**、只有 `FULL_INTERNAL_CHAT_ID` ⇒ 日报侧退到硬编码常量（恰好同群，纯属巧合）。声明位置：configs/notify.json#notify.full.internal_chat_id（binding envfile fulfillment.env FULL_INTERNAL_CHAT_ID）、configs/notify.json#notify.daily.alert_chat_id（binding json mlDailyAlertChatId）；设置页把它们放在**两个不同的面板**（verticals/mercadolibre/manifest.json 的 mercadolibre.full 面板 `fullInternalChatId` 与 mercadolibre.daily-report 面板 `mlDailyAlertChatId`）⇒ 操作者以为是两件事。"
+    },
+    {
+      "canonical": "notify.alert.profile",
+      "level": "json",
+      "names": [
+        "mlDailyAlertProfile",
+        "ML_DAILY_ALERT_PROFILE",
+        "FULL_INTERNAL_PROFILE",
+        "NOTIFY_PROFILE"
+      ],
+      "readers": [
+        "scripts/daily-report.mjs:1007",
+        "scripts/orchestrator.py:7767",
+        "scripts/orchestrator.py:7997",
+        "scripts/orchestrator.py:8018",
+        "scripts/orchestrator.py:8064",
+        "scripts/orchestrator.py:12237",
+        "scripts/orchestrator.py:12330",
+        "scripts/feishu-card.mjs:177",
+        "scripts/orchestrator.py:432"
+      ],
+      "carriers": [
+        "config.json#mlDailyAlertProfile",
+        "env:ML_DAILY_ALERT_PROFILE",
+        "env:FULL_INTERNAL_PROFILE",
+        "envfile:fulfillment.env#NOTIFY_PROFILE",
+        "envfile:fulfillment.env#LARK_PROFILE"
+      ],
+      "action": "merge",
+      "riskLevel": "P0",
+      "risk": "同义不同名 + **解析链在同一语义内不统一**。两处都有值：`FULL_INTERNAL_PROFILE` 只在**进程 env** 生效（5 处用 `os.environ.get`），写进 `fulfillment.env` **静默无效**并回落到代码内硬编码的主 Bot profile；而紧邻的 `FULL_INTERNAL_CHAT_ID` 却走 `_profile_from_deploy()`（env → envfile）⇒ **同一处的两个键、两条解析链**。",
+      "evidence": "scripts/orchestrator.py:4035 `_profile_from_deploy(key,default)` = `os.environ` → `fulfillment.env`；但 `FULL_INTERNAL_PROFILE` 的 5 个读取点（7767/7997/8018/8064/12237/12330）全部写成 `os.environ.get(\"FULL_INTERNAL_PROFILE\", \"\") or \"<代码内硬编码的主 Bot profile>\"`，**绕过了 envfile**；同一函数体内的 `FULL_INTERNAL_CHAT_ID` 走 `_profile_from_deploy`（7756/7993/8014/8056/12230/12329）。客户机（生产）实测 `mlDailyAlertProfile` 有值；`FULL_INTERNAL_PROFILE` 不在 fulfillment.env 键名清单里。"
+    },
+    {
+      "canonical": "notify.daily.chat_id",
+      "level": "json",
+      "names": [
+        "ML_DAILY_CHAT_ID"
+      ],
+      "readers": [
+        "scripts/daily-report.mjs:985",
+        "scripts/feishu-card.mjs:173",
+        "scripts/flow_preflight.py:274"
+      ],
+      "carriers": [
+        "config.json#mlDailyChatId",
+        "envfile:daily-report.env#ML_DAILY_CHAT_ID",
+        "env:ML_DAILY_CHAT_ID"
+      ],
+      "action": "alias",
+      "riskLevel": "P1",
+      "risk": "同义不同名 + **两个读取点的优先级相反**。`scripts/daily-report.mjs:985` 用 `pick(cfg, env, 'mlDailyChatId', 'ML_DAILY_CHAT_ID', …)` ⇒ `cfg ?? env` = **config.json 赢**；`scripts/feishu-card.mjs:173` 与 `scripts/flow_preflight.py:274` 写成 `env || cfg` = **env 赢**。两处都有值且不等 ⇒ **日报正文与卡片发到两个不同的群**，且两边日志都显示成功。",
+      "evidence": "scripts/daily-report.mjs:902-904 定义 `pick(cfg,env,cfgKey,envKey,def)` = `cfg[cfgKey] ?? env[envKey]`（cfg 优先）；scripts/feishu-card.mjs:173 `dailyEnv.ML_DAILY_CHAT_ID || cfg.mlDailyChatId`（env 优先）；scripts/flow_preflight.py:274 `de.get(\"ML_DAILY_CHAT_ID\") or cfgj.get(\"mlDailyChatId\")`（env 优先）。客户机实测：`ML_DAILY_CHAT_ID` 有值、`mlDailyChatId` **未设** ⇒ 今天不冲突；开发机相反（`mlDailyChatId` 有值、daily-report.env 亦有 ML_DAILY_CHAT_ID ⇒ 实测同值）。docs/本机接班运行清单.md:362 已记录过『config.json 优先于 env，只改 env 会\"配了等于没配\"』。"
+    },
+    {
+      "canonical": "ml.full.base_token",
+      "level": "envfile",
+      "names": [
+        "FULL_BASE_TOKEN",
+        "FEISHU_BASE_TOKEN",
+        "BASE_TOKEN"
+      ],
+      "readers": [
+        "scripts/orchestrator.py:1002",
+        "scripts/orchestrator.py:1005",
+        "scripts/orchestrator.py:829",
+        "scripts/orchestrator.py:840",
+        "scripts/orchestrator.py:842",
+        "scripts/lip_table.py:154",
+        "scripts/invoice_lip_runner.py:83",
+        "scripts/wenyao-fixture-export.py:28",
+        "scripts/invoice_carrier_notice.py:233",
+        "scripts/poll-fulfillment.sh:135",
+        "scripts/poll-fulfillment.sh:160",
+        "scripts/invoice-table.sh:16",
+        "scripts/invoice-table.sh:24",
+        "scripts/invoice-table.sh:27",
+        "scripts/invoice-table.sh:29",
+        "scripts/init-ml.sh:1482",
+        "scripts/init-ml.sh:1485",
+        "scripts/init-ml.sh:1847",
+        "scripts/base-bootstrap.sh:191",
+        "scripts/sku_translate.py:19"
+      ],
+      "carriers": [
+        "envfile:fulfillment.env#FULL_BASE_TOKEN",
+        "envfile:fulfillment.env#FEISHU_BASE_TOKEN",
+        "envfile:fulfillment.env#BASE_TOKEN"
+      ],
+      "action": "merge",
+      "riskLevel": "P0",
+      "risk": "**同名不同义（最危险的一种）**：`FULL_BASE_TOKEN` 与 `FEISHU_BASE_TOKEN` 在**生产机上指向两张不同的 Base**（实测值不同），不是别名而是两个对象；`BASE_TOKEN` 是 `FEISHU_BASE_TOKEN` 的复制品。两处都有值：读哪个由 `FULL_TABLE_MODE` 决定（lip→FULL_*，legacy→FEISHU_*），而 mode 又由『FULL_* 是否存在』**推断** ⇒ **往 env 里加一对 FULL_* 会静默改变读哪张表**。与声明一致：只有 FULL_* 与 FEISHU_* 被声明（ml.full.base_token / ml.invoice.fallback_base_token），`BASE_TOKEN` **一个字都没声明**。",
+      "evidence": "scripts/orchestrator.py:995-1006 按 mode 二选一；:833-846 `resolve_table_mode()` 在 `FULL_TABLE_MODE` 未显式时用 `FULL_BASE_TOKEN && FULL_TABLE_ID` 推断。scripts/invoice-table.sh:27 只回退 `FEISHU_BASE_TOKEN`；scripts/sku_translate.py:19 把 Base token 硬编码成字面量。客户机（生产）实测三键**同时有值**且 `FULL_BASE_TOKEN` ≠ `FEISHU_BASE_TOKEN`、`FEISHU_BASE_TOKEN` == `BASE_TOKEN`；开发机实测三者互不相同（3 张表）。声明：verticals/mercadolibre/config.json#ml.full.base_token（envfile fulfillment.env FULL_BASE_TOKEN）、#ml.invoice.fallback_base_token（envfile fulfillment.env FEISHU_BASE_TOKEN）。"
+    },
+    {
+      "canonical": "ml.full.table_id",
+      "level": "envfile",
+      "names": [
+        "FULL_TABLE_ID",
+        "FEISHU_TABLE_ID",
+        "TABLE_ID"
+      ],
+      "readers": [
+        "scripts/orchestrator.py:1003",
+        "scripts/orchestrator.py:1006",
+        "scripts/orchestrator.py:840",
+        "scripts/orchestrator.py:842",
+        "scripts/orchestrator.py:6126",
+        "scripts/orchestrator.py:6157",
+        "scripts/lip_table.py:155",
+        "scripts/invoice_lip_runner.py:84",
+        "scripts/wenyao-fixture-export.py:29",
+        "scripts/invoice_carrier_notice.py:233",
+        "scripts/poll-fulfillment.sh:135",
+        "scripts/poll-fulfillment.sh:161",
+        "scripts/init-ml.sh:1483",
+        "scripts/init-ml.sh:1486",
+        "scripts/init-ml.sh:1821",
+        "scripts/init-ml.sh:1848",
+        "scripts/base-bootstrap.sh:210"
+      ],
+      "carriers": [
+        "envfile:fulfillment.env#FULL_TABLE_ID",
+        "envfile:fulfillment.env#FEISHU_TABLE_ID",
+        "envfile:fulfillment.env#TABLE_ID"
+      ],
+      "action": "merge",
+      "riskLevel": "P0",
+      "risk": "与 `ml.full.base_token` 完全同构（同一个 'lip vs legacy 两套表' 命名族的另一半）。两处都有值：`FULL_TABLE_ID` 与 `FEISHU_TABLE_ID` 在生产机上是**两张不同表**的 id；`TABLE_ID` == `FEISHU_TABLE_ID`。认领/回写落到哪张表由 mode 决定，**mode 又是被推断出来的** ⇒ 票会静默进错表。",
+      "evidence": "scripts/orchestrator.py:1003/1006；:6126/:6157 报错文案写死 `FEISHU_BASE_TOKEN/FEISHU_TABLE_ID`（lip 模式下这句是**误导性的**）。客户机实测三键同时有值、`FULL_TABLE_ID` ≠ `FEISHU_TABLE_ID`（同为 16 字符 tbl…）、`FEISHU_TABLE_ID` == `TABLE_ID`；开发机三者互不相同。声明：verticals/mercadolibre/config.json#ml.full.table_id、#ml.invoice.fallback_table_id。"
+    },
+    {
+      "canonical": "ml.full.table_mode",
+      "level": "envfile",
+      "names": [
+        "FULL_TABLE_MODE",
+        "（隐式推断值 lip|legacy，无键）"
+      ],
+      "readers": [
+        "scripts/orchestrator.py:832",
+        "scripts/orchestrator.py:835",
+        "scripts/orchestrator.py:840",
+        "scripts/orchestrator.py:842",
+        "scripts/orchestrator.py:997"
+      ],
+      "carriers": [
+        "envfile:fulfillment.env#FULL_TABLE_MODE",
+        "env:FULL_TABLE_MODE"
+      ],
+      "action": "alias",
+      "riskLevel": "P1",
+      "risk": "同义不同名：该语义有**两种取值来源** —— 显式键 `FULL_TABLE_MODE`，或\"从别的键在不在\"推断出来。两处都有值：显式键优先（`os.environ` → envfile 里的键都算），推断只在显式键缺失时生效。真正的风险不是分叉，而是**推断让\"存在性\"变成了隐式配置**（加/删 FULL_* 会改读表，且不写任何日志）。",
+      "evidence": "scripts/orchestrator.py:833-846 `resolve_table_mode()`；:995 `os.environ.get(\"FULL_TABLE_MODE\")` 优先于 `resolve_table_mode(env)`。客户机实测 `FULL_TABLE_MODE=lip`（显式，已设）。建议：批 2 把『推断』登记为一条 alias 规则并**强制留痕**（\"未设 FULL_TABLE_MODE，按 FULL_* 存在性推断为 lip\"）。"
+    },
+    {
+      "canonical": "notify.flow.lark_profile",
+      "level": "envfile",
+      "names": [
+        "LARK_PROFILE",
+        "FULL_LARK_PROFILE"
+      ],
+      "readers": [
+        "scripts/orchestrator.py:4053",
+        "scripts/lip_table.py:153",
+        "scripts/flow_preflight.py:236",
+        "scripts/lib/customer-env.mjs:5",
+        "scripts/customer-config-migrate.mjs:168",
+        "scripts/flow-scaffold.py:135",
+        "verticals/mercadolibre/flows.json:79",
+        "verticals/mercadolibre/flows.json:254",
+        "verticals/mercadolibre/flows.json:473"
+      ],
+      "carriers": [
+        "envfile:fulfillment.env#LARK_PROFILE",
+        "envfile:fulfillment.env#FULL_LARK_PROFILE",
+        "envfile:daily-report.env#LARK_PROFILE（⚠️ 同名不同义，见 note）"
+      ],
+      "action": "merge",
+      "riskLevel": "P0",
+      "risk": "**同名不同义（跨文件）**：`LARK_PROFILE` 这个名字在 `fulfillment.env` 里是\"流程**读表**身份\"，在 `daily-report.env` 里是\"日报**推送**身份\"，**生产机实测两个文件里的值不同**。谁按名字统一处理、不按文件区分，就会把读表身份拿去发消息（或反之）。同义不同名：`FULL_LARK_PROFILE` 与 `fulfillment.env#LARK_PROFILE` 是同一件事（flows.json 的 `identityEnv` 声明的是前者）。两处都有值：`scripts/lip_table.py:153` 是 `LARK_PROFILE or FULL_LARK_PROFILE or 'lip-customer'` ⇒ **LARK_PROFILE 赢**；生产机两者同值（暂不冲突）。",
+      "evidence": "scripts/lip_table.py:153；scripts/flow_preflight.py:236 `envs.get(\"FULL_LARK_PROFILE\") or envs.get(\"LARK_PROFILE\")`（**顺序与 lip_table 相反！**）；scripts/feishu-card.mjs:169-170 分开读两个文件（`fullEnv` / `dailyEnv`）—— 这一处是对的，但正说明\"同名不同义\"真实存在。客户机实测：`fulfillment.env#LARK_PROFILE` == `FULL_LARK_PROFILE`（同值，均为 20 字符的 cli_ 前缀 profile），而 `daily-report.env#LARK_PROFILE` **是另一个值**（8 字符的 ml- 前缀 profile）⇒ DIFFERENT-VALUE。声明：configs/notify.json#notify.flow.lark_profile 绑 `fulfillment.env#LARK_PROFILE`，**没有** `FULL_LARK_PROFILE` 的声明（它只活在 verticals/mercadolibre/flows.json 的 identityEnv 里）⇒ **声明面分裂**。"
+    },
+    {
+      "canonical": "notify.flow.profile",
+      "level": "envfile",
+      "names": [
+        "NOTIFY_PROFILE",
+        "FULL_DONE_PROFILE"
+      ],
+      "readers": [
+        "scripts/orchestrator.py:4060",
+        "scripts/orchestrator.py:432",
+        "scripts/feishu-card.mjs:171",
+        "scripts/feishu-card.mjs:177",
+        "scripts/customer-readiness.sh:71"
+      ],
+      "carriers": [
+        "envfile:fulfillment.env#NOTIFY_PROFILE",
+        "envfile:fulfillment.env#FULL_DONE_PROFILE"
+      ],
+      "action": "alias",
+      "riskLevel": "P2",
+      "risk": "同义不同名（完成卡专用 vs 通用通知身份）。两处都有值：`FULL_DONE_PROFILE` 赢（orchestrator.py:432 的链是 `FULL_DONE_PROFILE → FULL_INTERNAL_PROFILE → NOTIFY_PROFILE → LARK_PROFILE`）；而 `scripts/feishu-card.mjs:177` 的链是 `NOTIFY_PROFILE || cfg.mlDailyAlertProfile || '<代码内硬编码的主 Bot profile>'` ⇒ **同一个「internal 卡片用哪个身份」语义，两条链的候选集完全不同**（orchestrator 看 FULL_*，feishu-card 看 mlDailyAlert*）。",
+      "evidence": "scripts/orchestrator.py:418-437 `_done_card_sink()` 自述是\"解析链唯一入口\"，但 scripts/feishu-card.mjs:176-177 是**第二份实现**（FULL 失败卡片走这里，见 plugins/argent-flow/src/index.js:797）。客户机实测 `NOTIFY_PROFILE` 有值且 ≠ `LARK_PROFILE`（14 字符 ml-… vs 20 字符 cli_…）。"
+    },
+    {
+      "canonical": "account.portal.phone",
+      "level": "envfile",
+      "names": [
+        "WENYAO_PHONE",
+        "fflUser"
+      ],
+      "readers": [
+        "scripts/wenyao_login.py:121",
+        "scripts/wenyao_attach.py:107",
+        "scripts/wenyao-browser.sh:33",
+        "scripts/wenyao-login.sh:30"
+      ],
+      "carriers": [
+        "envfile:wenyao.env#WENYAO_PHONE",
+        "config.json#fflUser"
+      ],
+      "action": "deprecate",
+      "riskLevel": "P0",
+      "risk": "**僵尸键**（有值、有 UI 印象、零读取点）。两处都有值：`wenyao.env` 赢（因为 `fflUser` **根本没人读**）；改 `config.json#fflUser` 完全无效且**零提示**。与声明一致：`account.portal.phone` 只声明了 `wenyao.env#WENYAO_PHONE`，`fflUser` 未声明、也未出现在任何设置页字段里 ⇒ 它是历史安装器写下的孤儿。",
+      "evidence": "全仓库 `grep -rn 'fflUser'` 命中 = docs（本机接班运行清单.md:23/99 已把它记为待确认的\"C8 文鳐门户凭据口径\"）+ 客户机 config.json，**没有任何 .py/.mjs/.js/.sh 读取点**。客户机（生产）实测 `fflUser`/`fflPass` 同时有值，且 `fflUser == WENYAO_PHONE`、`fflPass == WENYAO_PASSWORD`（当前同值 ⇒ 侥幸一致）。"
+    },
+    {
+      "canonical": "account.carrier.user",
+      "level": "json",
+      "names": [
+        "xhInvoiceUser",
+        "xinzhonghang.user"
+      ],
+      "readers": [
+        "scripts/invoice_runner.py:93"
+      ],
+      "carriers": [
+        "config.json#xhInvoiceUser",
+        "config.json#xhInvoicePass",
+        "machine:invoice-mapping.json#xinzhonghang.user"
+      ],
+      "action": "merge",
+      "riskLevel": "P1",
+      "risk": "同义不同名（同一门户账号两个落点）。两处都有值：**不会互相同步** —— `scripts/invoice_runner.py:93` 读 `config.json#xhInvoiceUser`，而 `invoice-mapping.json#xinzhonghang.user` 目前**只有人读**（装机文档 docs/装机单页.md:59 把它写成\"账号\"落点，密码却指向 config.json）。⇒ 操作者按文档改了一处，登录用的是另一处。",
+      "evidence": "scripts/invoice_runner.py:93 `return c.get(\"xhInvoiceUser\", \"\"), c.get(\"xhInvoicePass\", \"\")`。客户机（生产）实测：`config.json` 有 `xhInvoiceUser`/`xhInvoicePass`，且 `invoice-mapping.json` 顶层含 `xinzhonghang` 子键 `{url,user}` ⇒ **同一账号同时存在于两个文件**。声明：configs/account.json#account.carrier.user/password 只绑 `config.json`，`invoice-mapping.json#xinzhonghang.user` 未声明。 ⚠️ `invoice-mapping.json#xinzhonghang.user` **全仓 0 读取点**（只有 docs/装机单页.md:59 把它写成\"账号\"落点）⇒ 本组的真正问题是\"文档指向一个没人读的落点\"。"
+    },
+    {
+      "canonical": "host.data_dir",
+      "level": "machine",
+      "names": [
+        "ARGENT_DATA_DIR",
+        "ARGENT_DATA_HOME",
+        "DSH_HOME"
+      ],
+      "readers": [
+        "core/lib/argent-datadir.mjs:135",
+        "core/lib/argent-datadir.mjs:136",
+        "core/lib/argent-datadir.mjs:141",
+        "scripts/lib/argent_datadir.py:173",
+        "scripts/lib/argent_datadir.py:181",
+        "scripts/daily-report.mjs:96",
+        "scripts/daily-report-inbox.py:48",
+        "scripts/daily-report-inbox.py:93",
+        "scripts/init-ml.sh:45",
+        "scripts/daily-report.sh:19",
+        "core/mcp/server.mjs:108"
+      ],
+      "carriers": [
+        "env:ARGENT_DATA_DIR",
+        "env:DSH_HOME",
+        "env:ARGENT_DATA_HOME（⚠️ 内核不认）"
+      ],
+      "action": "deprecate",
+      "riskLevel": "P1",
+      "risk": "同义不同名，且**其中一个名字内核根本不认**。内核三级链只认 `ARGENT_DATA_DIR` → `$DSH_HOME/argent` → `~/.dsh/argent`；`ARGENT_DATA_HOME` 只在 4 个**旧脚本**里被当成别名优先读。两处都有值：设了 `ARGENT_DATA_HOME=X` 而没设 `ARGENT_DATA_DIR` ⇒ **日报读/写 X，内核读 ~/.dsh/argent** ⇒ 日报拿到的 config.json 与引擎写的不是同一份，两侧都\"成功\"，无任何报错。",
+      "evidence": "core/lib/argent-datadir.mjs:60-62 只导出 `ENV_DATA_DIR='ARGENT_DATA_DIR'` / `ENV_DSH_HOME='DSH_HOME'`（全文无 ARGENT_DATA_HOME）；scripts/lib/argent_datadir.py:63-65 同。别名读取点：scripts/daily-report.mjs:96 `process.env.ARGENT_DATA_HOME || DATA_DIR`、scripts/daily-report-inbox.py:48/93、scripts/init-ml.sh:45、scripts/daily-report.sh:19。scripts/tests/argent-datadir-parity.test.mjs:419/425-427 已把这两条登记为 **pending 缺口**（理由即\"历史别名\"）⇒ 本组的建议动作是把它从\"测试内登记\"升级为\"**机器可读的别名登记 + 命中即出声**\"。"
+    },
+    {
+      "canonical": "host.python",
+      "level": "env",
+      "names": [
+        "ARGENT_PY",
+        "ARGENT_PYTHON"
+      ],
+      "readers": [
+        "core/lib/python.mjs:75",
+        "plugins/argent-core/src/index.js:38",
+        "plugins/argent-ml/src/index.js:60",
+        "plugins/argent-flow/src/index.js:50",
+        "scripts/check-sop-consistency.mjs:33",
+        "scripts/wenyao-invoice-writeback.mjs:62",
+        "scripts/python-runtime.sh:65",
+        "scripts/poll-fulfillment.sh:96",
+        "scripts/check-billing-mode.sh:77",
+        "scripts/flow-timers.sh:29"
+      ],
+      "carriers": [
+        "env:ARGENT_PY",
+        "env:ARGENT_PYTHON",
+        "plist:ARGENT_PY（flow-trigger×4 / ziniao-keepalive / usage-anchor）"
+      ],
+      "action": "alias",
+      "riskLevel": "P0",
+      "risk": "同义不同名 **且只被一部分读取点接受**。两处都有值：`core/lib/python.mjs:75`、3 个插件、2 个脚本认两个名字；但 `scripts/python-runtime.sh:65`、`scripts/poll-fulfillment.sh:96`、`scripts/check-billing-mode.sh:77`、`scripts/flow-timers.sh:29` **只认 `ARGENT_PY`**。⇒ 设 `ARGENT_PYTHON` 表现为\"插件通路生效、脚本通路回落默认 venv\"，在客户机上默认 venv 可能不存在 ⇒ **一半能用一半静默失败**。",
+      "evidence": "插件侧注释已自陈此坑：plugins/argent-flow/src/index.js:42『插件侧原来只读 ARGENT_PYTHON ⇒ 客户机按脚本口径设了 ARGENT_PY，失败回路仍走默认值』；docs/archive/客户机上线核对清单.md:36/88 记录过同一事故。客户机（生产）实测 4 个 flow-trigger plist 与 ziniao-keepalive plist 都注入 `ARGENT_PY`；`ARGENT_PYTHON` 未出现。声明：configs/host.json#host.python 绑 env `ARGENT_PY`（`ARGENT_PYTHON` **未声明**）。"
+    },
+    {
+      "canonical": "host.argent_home",
+      "level": "env",
+      "names": [
+        "ARGENT_DISH_HOME",
+        "ARGENT_HOME"
+      ],
+      "readers": [
+        "scripts/argent-upgrade.mjs:48",
+        "scripts/install-one-shot.mjs:106",
+        "scripts/sync-plugins.sh:11",
+        "scripts/flow-trigger-wake.mjs:55",
+        "scripts/pack-plugins.mjs:20",
+        "plugins/argent-gateway/src/index.js:997"
+      ],
+      "carriers": [
+        "env:ARGENT_DISH_HOME",
+        "env:ARGENT_HOME",
+        "默认 ~/.argent-dsh"
+      ],
+      "action": "alias",
+      "riskLevel": "P2",
+      "risk": "同义不同名，同样是\"**部分读取点才认别名**\"。两处都有值：`scripts/argent-upgrade.mjs:48` / `install-one-shot.mjs:106` 认两个；`scripts/sync-plugins.sh:11`、`flow-trigger-wake.mjs:55`、`pack-plugins.mjs:20`、`plugins/argent-gateway/src/index.js:997` 各只认一个 ⇒ 设了另一个名字的机器上，升级器认的树与投递脚本认的树**不是同一棵**。",
+      "evidence": "docs/Argent-0.3-ArgentCore-宿主无关能力层-设计与操作方案.md:156 已把这条记为已修的历史缺陷（\"安装器与升级器各用一个名字 ⇒ 设一个不影响另一个（已统一别名）\"），但**只统一了两个文件**；docs/Argent-0.3.0-验收清单.md:71 仍把 `ARGENT_DISH_HOME` vs `ARGENT_HOME` 名字不一致列为遗留项。两组名字**都不是** configs/*.json 的声明项（host 域可补）。"
+    },
+    {
+      "canonical": "advanced.telemetry.opt_in",
+      "level": "json",
+      "names": [
+        "telemetryOptIn",
+        "telemetryConsent",
+        "ARGENT_TELEMETRY_OFF"
+      ],
+      "readers": [
+        "plugins/argent-core/src/index.js:457",
+        "plugins/argent-core/src/index.js:484",
+        "plugins/argent-core/src/index.js:1491",
+        "scripts/telemetry.py:281",
+        "scripts/telemetry.py:276",
+        "scripts/telemetry.py:663",
+        "plugins/argent-skin/dist/client.js:2110",
+        "plugins/argent-skin/dist/client.js:2113",
+        "plugins/argent-skin/dist/client.js:2117"
+      ],
+      "carriers": [
+        "config.json#telemetryOptIn（布尔，唯一判据）",
+        "config.json#telemetryConsent（对象：granted/at/source/version，**只是证据**）",
+        "env:ARGENT_TELEMETRY_OFF（测试/离线硬关）"
+      ],
+      "action": "alias",
+      "riskLevel": "P2",
+      "risk": "伴生双写但**只有一个参与判断**。两处都有值：判断永远看 `telemetryOptIn`；把 `telemetryConsent.granted` 改成 false **没有任何效果**（它是 install-argent.mjs 写的同意留痕），而它长得更像\"同意开关\" ⇒ 改错对象的概率高。",
+      "evidence": "install-argent.mjs:1129-1130 是**唯一**同时写两处的地方（`cfg.telemetryOptIn = granted` + `cfg.telemetryConsent = {granted, at, source, version}`）；读取点只读 `telemetryOptIn`（plugins/argent-core/src/index.js:484、scripts/telemetry.py:134、plugins/argent-skin/dist/client.js:2057）。客户机（生产）实测两个键**同时有值**（`telemetryOptIn` 布尔、`telemetryConsent` 对象）。 ⚠️ `plugins/argent-skin/dist/client.js` 是**打包产物**（每天在改）⇒ 该处的行号只是快照，定位请用符号名 `telemetryOptIn` / `ConfigCenter`，⛔ 不要死记行号。"
+    },
+    {
+      "canonical": "advanced.registry.mode",
+      "level": "env",
+      "names": [
+        "ARGENT_REGISTRY_MODE"
+      ],
+      "readers": [
+        "scripts/flow_registry.py:73",
+        "scripts/flow_registry.py:294",
+        "scripts/flow_registry.py:298"
+      ],
+      "carriers": [
+        "env:ARGENT_REGISTRY_MODE",
+        "CLI:--mode"
+      ],
+      "action": "merge",
+      "riskLevel": "P0",
+      "risk": "**声明枚举与实现取值零交集**。configs/advanced.json 声明 `enum: [merged, base, projection]`，实现只认 `('merged','legacy')`，**其余一律静默按 merged**。⇒ 照目录配 `base`（意即\"只读 base\"）会得到**相反的 merged**；配 `projection` 同样是 merged。`advanced.registry.mode` 因此是一个**假配置项**：配了等于没配、且方向可能相反、零报错零日志。",
+      "evidence": "scripts/flow_registry.py:72-74 `m = (os.environ.get('ARGENT_REGISTRY_MODE') or 'merged').strip().lower(); return m if m in ('merged','legacy') else 'merged'`；:294 `choices=('merged','legacy')`。声明：configs/advanced.json#advanced.registry.mode `validation.enum = [\"merged\",\"base\",\"projection\"]`。这是本项目已记录过的\"静默 fallback 产出错值\"家族（AGENTS.md 同日两次事故）的第七个实例。"
+    },
+    {
+      "canonical": "notify.full.mode",
+      "level": "envfile",
+      "names": [
+        "FULL_NOTIFY_MODE"
+      ],
+      "readers": [
+        "scripts/orchestrator.py:357",
+        "scripts/orchestrator.py:362",
+        "scripts/orchestrator.py:366",
+        "scripts/orchestrator.py:368",
+        "scripts/orchestrator.py:380"
+      ],
+      "carriers": [
+        "envfile:fulfillment.env#FULL_NOTIFY_MODE",
+        "env:FULL_NOTIFY_MODE"
+      ],
+      "action": "merge",
+      "riskLevel": "P1",
+      "risk": "**三个声明面取值不一致**（同一个枚举）。实现 `NOTIFY_MODES = ('final','facts','feishu')`；设置页 options 三值；configs/notify.json 的 `validation.enum` **只有 `['final','feishu']`（漏 `facts`）**。⇒ 设置页可选 `facts`，而配置目录门禁/校验会判它非法；反之若批 2 以目录为准收紧，`facts` 会被静默降级成 `final`（\"只记事实、不发步骤\"变成\"发完成卡\"）。",
+      "evidence": "scripts/orchestrator.py:357-368（`NOTIFY_MODES = (\"final\", \"facts\", \"feishu\")`，非法值 `return \"final\"`）；configs/notify.json#notify.full.mode `validation.enum = [\"final\",\"feishu\"]`；verticals/mercadolibre/manifest.json 面板 `fullNotifyMode.options = [\"final\",\"facts\",\"feishu\"]`。"
+    },
+    {
+      "canonical": "host.path.stores_json",
+      "level": "env",
+      "names": [
+        "STORES_JSON",
+        "ML_API_STORES_JSON"
+      ],
+      "readers": [
+        "scripts/orchestrator.py:863",
+        "scripts/orchestrator.py:871",
+        "scripts/orchestrator.py:882",
+        "scripts/orchestrator.py:12101",
+        "scripts/poll-fulfillment.sh:71",
+        "scripts/poll-fulfillment.sh:77",
+        "scripts/poll-fulfillment.sh:85",
+        "scripts/poll-fulfillment.sh:177",
+        "scripts/daily-report.mjs:67",
+        "plugins/argent-core/src/index.js:1400",
+        "verticals/mercadolibre/manifest.json:172"
+      ],
+      "carriers": [
+        "env:STORES_JSON",
+        "env:ML_API_STORES_JSON",
+        "machine:stores.json（紫鸟环境名→店映射）",
+        "machine:ml-api-stores.json（ML OAuth 每店凭据）"
+      ],
+      "action": "alias",
+      "riskLevel": "P1",
+      "risk": "**名字近似但语义不同**（这一组的正确动作是\"登记为两个语义\"，⛔ 不是合并）—— 两者都是\"店铺文件\"：`STORES_JSON` = 紫鸟环境名↔店铺映射（default `~/.dsh/argent/stores.json`）；`ML_API_STORES_JSON` = 美客多官方 API 的每店 OAuth 凭据（default `<数据目录>/ml-api-stores.json`）。两处都有值：**互不影响**（各读各的），所以\"设了一个就以为够了\"是最可能的误操作 —— 只设 `STORES_JSON` ⇒ 日报侧读不到 API 凭据、静默按\"未授权 0 店\"处理。",
+      "evidence": "scripts/orchestrator.py:863-871（`os.environ.get(\"STORES_JSON\")`，缺省 `~/.dsh/argent/stores.json`）；scripts/daily-report.mjs:67 与 plugins/argent-core/src/index.js:1400（`process.env.ML_API_STORES_JSON || join(DATA_DIR,'ml-api-stores.json')`）。客户机（生产）实测：`STORES_JSON` 有值（指向 `<数据目录>/stores.json`）、`ML_API_STORES_JSON` **未设**；两个文件在客户机与开发机上**都存在**。声明：configs/host.json#host.path.stores_json 绑 `STORES_JSON`；verticals/mercadolibre/config.json#ml.api.stores_file 绑 `ML_API_STORES_JSON`。"
+    },
+    {
+      "canonical": "notify.feishu.chat_id",
+      "level": "json",
+      "names": [
+        "feishuChatId",
+        "FEISHU_CHAT_ID"
+      ],
+      "readers": [
+        "scripts/feishu-card.mjs:176",
+        "scripts/orchestrator.py:1014",
+        "scripts/orchestrator.py:418",
+        "scripts/orchestrator.py:430",
+        "scripts/init-ml.sh:1734",
+        "scripts/init-ml.sh:1786"
+      ],
+      "carriers": [
+        "config.json#feishuChatId",
+        "envfile:fulfillment.env#FEISHU_CHAT_ID"
+      ],
+      "action": "alias",
+      "riskLevel": "P1",
+      "risk": "同义不同名 + **兜底链的第三级落在不同载体**。`scripts/feishu-card.mjs:176` 的兜底 = `FULL_INTERNAL_CHAT_ID || cfg.feishuChatId`（**config.json**）；`scripts/orchestrator.py:430` 的兜底 = `cfg.feishu_chat`，而 `cfg.feishu_chat` 来自 `pick(\"FEISHU_CHAT_ID\")`（**envfile/env**）。两处都有值且不等 ⇒ 同一次告警，**卡片走 cfg 的群、orchestrator 的完成卡走 env 的群**。开发机实测两者**值不同**（两个不同的群 id）⇒ 此刻就是分叉状态。",
+      "evidence": "scripts/feishu-card.mjs:176；scripts/orchestrator.py:1014 `feishu_chat=pick(\"FEISHU_CHAT_ID\")` + :430 回退文案『⚠️ FEISHU_CHAT_ID（回退）』。开发机实测 `FEISHU_CHAT_ID`(env) ≠ `feishuChatId`(cfg)；客户机实测两者同值。声明：configs/notify.json#notify.feishu.chat_id 绑 `config.json#feishuChatId`；**`fulfillment.env#FEISHU_CHAT_ID` 未声明**。"
+    },
+    {
+      "canonical": "account.feishu.user_id",
+      "level": "envfile",
+      "names": [
+        "FEISHU_USER_ID",
+        "FEISHU_OWNER_OPENID"
+      ],
+      "readers": [
+        "scripts/orchestrator.py:1013",
+        "scripts/base-bootstrap.sh:536",
+        "scripts/base-bootstrap.sh:540",
+        "scripts/init-ml.sh:1734"
+      ],
+      "carriers": [
+        "envfile:fulfillment.env#FEISHU_USER_ID",
+        "envfile:fulfillment.env#FEISHU_OWNER_OPENID"
+      ],
+      "action": "alias",
+      "riskLevel": "P2",
+      "risk": "同义不同名，且其中一个**只写不读**。两处都有值：`FEISHU_USER_ID` 赢（它是唯一读取点 `scripts/orchestrator.py:1013` 读的名字）；`FEISHU_OWNER_OPENID` 由 `scripts/base-bootstrap.sh:536` 写入、`init-ml.sh:1734` 只做存在性判断，**没有任何读取点** ⇒ 改它无效。",
+      "evidence": "客户机（生产）实测两键**同时有值且值相同**（35 字符 ou_…）。声明：configs/account.json#account.feishu.user_id 只绑 `fulfillment.env#FEISHU_USER_ID`；`FEISHU_OWNER_OPENID` 未声明（docs/本机接班运行清单.md:95 把它与 FULL_INTERNAL_CHAT_ID 并列为\"C4 缺项\"）。"
+    },
+    {
+      "canonical": "ml.daily.hour",
+      "level": "json",
+      "names": [
+        "mlDailyTime",
+        "REPORT_TIME",
+        "mlDailyTopN",
+        "TOP_N",
+        "mlDailyWebhook",
+        "FEISHU_WEBHOOK_URL"
+      ],
+      "readers": [
+        "scripts/daily-report.mjs:1308",
+        "scripts/daily-report.mjs:1228",
+        "scripts/daily-report.mjs:1265",
+        "scripts/daily-report.mjs:1386",
+        "scripts/daily-report.mjs:988",
+        "scripts/daily-report-inbox.py:88",
+        "scripts/daily-report-inbox.py:100",
+        "scripts/daily-report-inbox.py:108"
+      ],
+      "carriers": [
+        "config.json#mlDailyTime/mlDailyTopN/mlDailyWebhook",
+        "envfile:daily-report.env#REPORT_TIME/TOP_N/FEISHU_WEBHOOK_URL"
+      ],
+      "action": "alias",
+      "riskLevel": "P1",
+      "risk": "同义不同名（**短别名**）+ **装机脚本会把两处都写上**。`scripts/init-ml.sh:1365/1373/1360` 生成 `REPORT_TIME=08:00` / `TOP_N=5` / `FEISHU_WEBHOOK_URL=` 到 daily-report.env，而 config.json 里同时有 `mlDailyTime/mlDailyTopN/mlDailyWebhook`。两处都有值：`pick()` 是 **cfg 优先** ⇒ **env 侧短别名静默失效**（新装机即处于此状态）。与声明一致：目录只声明了 json 侧三键；契约 §7.7 把\"短别名\"整类**有意排除在配置面之外**（理由：排障旋钮）—— 但\"排除\"不等于\"没人会去配它\"，故仍需登记 + 命中即出声。",
+      "evidence": "scripts/daily-report.mjs:902-904（pick = cfg ?? env）；:1308 `pick(cfg, env, 'mlDailyTime','REPORT_TIME','08:00')`；:1228/:1265/:1386 同构；:988 `cfg.mlDailyWebhook || env.FEISHU_WEBHOOK_URL`。scripts/daily-report-inbox.py:88-108 是**第二份实现**（注释自陈\"与 daily-report.mjs 同一条读取链\"）。客户机（生产）实测 daily-report.env 里**没有**这三个短别名（键名清单只有 LARK_PROFILE/ML_APP_ID/ML_APP_SECRET/ML_DAILY_CHAT_ID）⇒ 今天不冲突，**新装机才会**。声明：configs/notify.json#notify.daily.webhook、verticals/mercadolibre/config.json#ml.daily.hour / #ml.daily.top_n；docs/Argent-宿主适配契约.md:739（§7.7）明写短别名不纳入。"
+    },
+    {
+      "canonical": "advanced.pause.flow",
+      "level": "machine",
+      "names": [
+        "PAUSE_POLL",
+        "PAUSE_FLOW_TRIGGER",
+        "PAUSE_INVOICE",
+        "PAUSE_DAILY_REPORT",
+        "verticals/<id>/PAUSE.<flow>"
+      ],
+      "readers": [
+        "scripts/flow_config.py:298",
+        "scripts/flow_config.py:565",
+        "scripts/flow_config.py:574",
+        "scripts/flow-trigger.sh:72",
+        "scripts/flow-trigger.sh:75",
+        "scripts/flow-trigger.sh:90",
+        "scripts/flow-trigger.sh:94",
+        "scripts/poll-fulfillment.sh:5",
+        "scripts/poll-invoice.sh:18"
+      ],
+      "carriers": [
+        "machine:<数据目录>/verticals/<id>/PAUSE.<flow>（规范）",
+        "machine:<数据目录>/PAUSE_POLL|PAUSE_FLOW_TRIGGER|PAUSE_INVOICE|PAUSE_DAILY_REPORT（legacy 平铺）",
+        "machine:<数据目录>/PAUSE_FLOW_WATCH（失败回路，另一个语义）"
+      ],
+      "action": "merge",
+      "riskLevel": "P2",
+      "risk": "**同一个语义三代名字，声明只覆盖一半**。规范名 = `verticals/mercadolibre/PAUSE.<flow>`（4 条，`flow-trigger.sh:72/90` 读）；legacy 平铺名 4 条（`pauseSwitchLegacy` 声明在 verticals/mercadolibre/flows.json：full→PAUSE_POLL、wenyao-invoice→PAUSE_FLOW_TRIGGER、xzh-invoice→PAUSE_INVOICE、daily-report→PAUSE_DAILY_REPORT；`flow-trigger.sh:75/94` 也读）。而 configs/advanced.json 只声明了 3 条 **machine 文件**：`PAUSE_POLL`、`PAUSE_INVOICE`、`PAUSE_FLOW_WATCH` —— **规范名一条没声明**，legacy 里 `PAUSE_FLOW_TRIGGER`/`PAUSE_DAILY_REPORT` 两条也没声明，且 `PAUSE_FLOW_WATCH` 根本不是暂停开关族（是失败回路总闸）。两处都有值：两条都查、**任一存在即停**（OR 语义，安全方向）⇒ 不会静默解停，但\"哪些开关真的管用\"从声明面看不出来。",
+      "evidence": "scripts/flow_config.py:298 `'pauseSwitch': 'PAUSE_FLOW_' + flow_id.upper().replace('-','_')`；:565-574 注释\"迁移期兜底……旧开关仍生效\"；scripts/flow-trigger.sh:72-95 两条都查。客户机（生产）实测**无任何 PAUSE_\\* 文件**（= 4 条流程全活，正确姿态）。"
+    },
+    {
+      "canonical": "ml.ziniao.wd_port",
+      "level": "envfile",
+      "names": [
+        "ZINIAO_WD_PORT（envfile）",
+        "ZINIAO_WD_PORT（plist）"
+      ],
+      "readers": [
+        "scripts/orchestrator.py:1018",
+        "scripts/ziniao-keepalive.sh:35",
+        "scripts/ziniao-keepalive.sh:154"
+      ],
+      "carriers": [
+        "envfile:ziniao-webdriver.env#ZINIAO_WD_PORT",
+        "plist:com.whyshu.ziniao-keepalive.plist#ZINIAO_WD_PORT"
+      ],
+      "action": "alias",
+      "riskLevel": "P1",
+      "risk": "同义不同名（**跨载体撞名**）：同一个键名同时存在于业务 env 文件与 launchd plist。两处都有值：`scripts/orchestrator.py:1019` 的 `pick_int()` = `os.environ.get(name) or envfile` ⇒ **plist 的进程环境变量赢**；而 keepalive 脚本自己读 plist 值去守护端口。⇒ 两处不等时，**守护进程守的端口 ≠ 流程连的端口**，表现为 CDP 连接失败（而不是配置错误）。与声明一致：业务线目录（verticals/mercadolibre/config.json）**没有**这一项，只有 manifest 的 settingsPanel 字段 `ziniaoWdPort`（写 `ziniao-webdriver.env`）⇒ plist 那一份完全在配置面之外。",
+      "evidence": "scripts/ziniao-keepalive.sh:155 把 ZINIAO_WD_PORT 写进生成的 plist（`scripts/ziniao-keepalive.sh install`）。客户机（生产）实测：`ziniao-webdriver.env` 与 `com.whyshu.ziniao-keepalive.plist` **两处都有该键且值相同**（均为 5 位数字端口）⇒ 当前一致。"
+    },
+    {
+      "canonical": "account.whyshu.api_key",
+      "level": "envfile",
+      "names": [
+        "WHYSHU_API_KEY（whyshu.env）",
+        "WHYSHU_API_KEY（~/.dsh/.credentials.yaml#refs）",
+        "WHYSHU_API_KEY（进程 env）"
+      ],
+      "readers": [
+        "scripts/check-model-auth.py:203",
+        "scripts/check-model-auth.py:204",
+        "scripts/check-model-auth.py:205",
+        "scripts/check-model-auth.py:207",
+        "scripts/provider-switch.sh:59",
+        "scripts/provider-switch.sh:69",
+        "scripts/provider-switch.sh:79"
+      ],
+      "carriers": [
+        "envfile:<数据目录>/whyshu.env#WHYSHU_API_KEY",
+        "credentials:~/.dsh/.credentials.yaml#refs.WHYSHU_API_KEY",
+        "env:WHYSHU_API_KEY"
+      ],
+      "action": "alias",
+      "riskLevel": "P1",
+      "risk": "同义不同名（**三载体同键名**）。两处都有值：`scripts/check-model-auth.py:203-207` 把三源**并列**（进程 env → `$DSH_HOME/.credentials.yaml` → `~/.dsh/.credentials.yaml` → `whyshu.env`）—— 这一处是对的，但它自己就是\"多源解析\"的第二份实现；其他读该键的地方（auth 提供方、install-argent `--sync-models`）各按各的兜底。**已致事故**：该槽被写成官方 DeepSeek Key（与 DEEPSEEK_API_KEY 同 sha）⇒ 问述 provider 报 \"API key is invalid\"（服务端 401）。",
+      "evidence": "客户机（生产）实测：`~/.dsh/.credentials.yaml` 顶层段 = `[version, refs, records]`，refs 键名 = `[DEEPSEEK_API_KEY, WHYSHU_API_KEY]`；`<数据目录>/whyshu.env` **不存在** ⇒ 生产走 credentials 单载体。开发机 `whyshu.env` 存在（另有 credentials）⇒ 两机载体姿态不同。声明：configs/account.json#account.whyshu.api_key 绑 `whyshu.env#WHYSHU_API_KEY` —— **credentials 那一份不在任何声明里**。"
+    }
+  ]
+}