@sema-agent/settings-schema 10.1.1 → 11.0.0

package/dist/fleet.js

@@ -1,5 +1,5 @@
 /**
- * @sema-agent/settings-schema/fleet — the PURE scheduling/fleet contract for the sema-center control plane
+ * @sema-agent/settings-schema/fleet — the PURE scheduling/fleet contract for the web-admin control plane
  * (design: the cc-parity control-plane scheduling design note, 产品拍板 2026-07-04 — "one contract, three orchestrators").
  *
  * Seven domains (rolling update / discovery / traffic / failover / LB / quota / token governance) are ONE
@@ -7,7 +7,7 @@
  * but all three read THESE shapes:
  *   - TOC shell (engineLifecycleManager): health readiness + upgrade classification + local blue-green demo
  *   - TOB (user k8s / fixed baseurl):     preStop→drain semantics + readiness probe = !draining
- *   - center (orchestrator reconciler):   instance discovery table + /api/dispatch gateway + rolling primitive
+ *   - web-admin (orchestrator reconciler):   instance discovery table + /api/dispatch gateway + rolling primitive
  *
  * 🔴 Contract discipline (same rules as scheduler-store):
  *   - ABSTRACT: types + zod wire shapes + PURE decision functions. ZERO IO, ZERO node:* — browser-safe barrel.
@@ -18,19 +18,20 @@
  *     the skeleton does not move).
  */
 import { z } from "zod";
+import { INTEGER } from "./integer.js";
 import { fnv1a64 } from "./hash.js";
-// ── The center's fleet endpoints (paths, one spelling) ─────────────────────────────────────────────────────
+// ── Web-admin's fleet endpoints (paths, one spelling) ─────────────────────────────────────────────────────
 /**
- * The center's `/api/fleet/*` endpoints that are addressed from outside the center, relative to its origin. ONE spelling: whoever
- * calls one (the engine, the executor) and whoever serves or routes it (the center, the deployment's Service / Ingress) imports it
+ * Web-admin's `/api/fleet/*` endpoints that are addressed from outside web-admin, relative to its origin. ONE spelling: whoever
+ * calls one (the engine, the executor) and whoever serves or routes it (web-admin, the deployment's Service / Ingress) imports it
  * here — nobody writes the string. Membership rule: an endpoint is here iff this package types its body, or it belongs to the
- * liveness group ({@link FLEET_LIVE_PATHS}); a center-internal route is not.
- *  - `instances` — `POST` = the heartbeat ({@link InstanceAnnouncement}; its 2xx reply carries the center's
- *    {@link CenterCapabilities} under {@link HEARTBEAT_REPLY_CAPABILITIES_KEY}), `DELETE` = the goodbye ({@link InstanceDeregistration}).
+ * liveness group ({@link FLEET_LIVE_PATHS}); a web-admin-internal route is not.
+ *  - `instances` — `POST` = the heartbeat ({@link InstanceAnnouncement}; its 2xx reply carries web-admin's
+ *    {@link WebAdminCapabilities} under {@link HEARTBEAT_REPLY_CAPABILITIES_KEY}), `DELETE` = the goodbye ({@link InstanceDeregistration}).
  *  - `usage` — `POST` a {@link UsageReport}.
  *  - `quotaLeases` — the quota lease ({@link QuotaLease}).
  *  - `servingLease` — `POST` a {@link ServingLeaseRequest}, answered with a {@link ServingLeaseResponse}.
- *  - `hostPlanner` — `GET` one host's planner record, for the executor (its body is the center's and the executor's contract, not
+ *  - `hostPlanner` — `GET` one host's planner record, for the executor (its body is web-admin's and the executor's contract, not
  *    this package's; it is here because the deployment routes it as a member of the liveness group).
  * Notation: a value is a path TEMPLATE — a parameter is a whole segment written `{name}` (`hostPlanner` ends in `/{host}`, filled
  * with the URL-encoded host id); the other values have none and are the path itself. A prefix router (an Ingress rule) takes the
@@ -44,8 +45,8 @@ export const FLEET_PATHS = {
     hostPlanner: "/api/fleet/live/host-planner/{host}",
 };
 /**
- * The LIVENESS group — the fleet endpoints a center answers without its readiness gate and without its config-governance gates
- * (they read no config domain and take service credentials only), so that a center whose management face is refused never turns
+ * The LIVENESS group — the fleet endpoints a web-admin answers without its readiness gate and without its config-governance gates
+ * (they read no config domain and take service credentials only), so that a web-admin whose management face is refused never turns
  * into a fleet that gets no answers. A deployment routes exactly these past the readiness gate (on Kubernetes: a second Service
  * with `publishNotReadyAddresses`, and the Ingress rules for them point at it). Membership is THIS list, not a path prefix — the
  * heartbeat predates the `/api/fleet/live/` prefix; every {@link FLEET_PATHS} entry under that prefix is a member. The
@@ -62,7 +63,7 @@ export const FLEET_LIVE_PATHS = [FLEET_PATHS.instances, FLEET_PATHS.servingLease
 export const DRAIN_PHASES = ["running", "draining", "drained"];
 /** Shipped default (server 1.96.0): generous by design — the only unrecoverable loss on restart is the
  *  interactive turn currently streaming, so we wait long rather than cut short. Deployments override via
- *  DRAIN_GRACE_MS; center overrides per-worker through the worker spec. */
+ *  DRAIN_GRACE_MS; web-admin overrides per-worker through the worker spec. */
 export const DEFAULT_DRAIN_GRACE_MS = 600_000;
 /** Hard floor — a grace below this is treated as this (protects against a fat-fingered 0). */
 export const DRAIN_GRACE_FLOOR_MS = 10_000;
@@ -78,14 +79,14 @@ export function drainVerdict(s) {
     return s.nowMs - s.startedMs >= grace ? "exit_forced" : "wait";
 }
 /** A wall-clock instant as epoch milliseconds — one quantity, one rule, wherever the fleet contract carries a point in time. */
-const EpochMs = z.number().int().nonnegative();
-/** A config-center version — a finite number, judged the way `readEffectiveWire` judges one. One quantity, one rule, wherever the
+const EpochMs = INTEGER.nonnegative();
+/** A web-admin config version — a finite number, judged the way `readEffectiveWire` judges one. One quantity, one rule, wherever the
  *  fleet contract carries it: {@link RestartSignal}`.version` and {@link EngineSignal}'s version-ledger keys. */
 const ConfigVersion = z.number().finite();
 /**
  * A generation is a non-negative integer written as its CANONICAL decimal string: `"0"`, `"7"`, `"10"` — no sign, no
  * leading zero (`"07"` is not a generation), no fraction, no whitespace, ASCII digits only, and a string, never a number.
- * One spelling per value, so equality is string equality and the order is numeric ({@link compareGeneration}) — the center's
+ * One spelling per value, so equality is string equality and the order is numeric ({@link compareGeneration}) — web-admin's
  * persisted generation floor and every "is this generation below the floor" judgement rest on that order. The renderer writes
  * the value into {@link FLEET_GENERATION_ENV}; an env value that is present but not canonical is a misconfiguration to refuse
  * loudly, not an absent generation (absence is what marks a non-member). Wherever a wire shape here carries a generation
@@ -93,6 +94,11 @@ const ConfigVersion = z.number().finite();
  * this one predicate.
  */
 const CANONICAL_GENERATION = /^(?:0|[1-9][0-9]*)$/;
+/** Drain action id grammar — one identifier shape for the drain request's `actionId` and the `EngineDraining.actionId` it echoes
+ *  (the engine republishes it on the unauthenticated `/health` face, so it must never carry free text): 1–128 chars, first
+ *  alphanumeric, then alphanumerics / `.` / `_` / `:` / `-`. Readers and writers share this one constant. */
+export const DRAIN_ACTION_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const drainActionId = () => z.string().regex(DRAIN_ACTION_ID, "actionId must be an identifier (1–128 chars: alphanumerics, '.', '_', ':', '-'; no spaces or free text)");
 export function isCanonicalGeneration(value) {
     return typeof value === "string" && CANONICAL_GENERATION.test(value);
 }
@@ -113,15 +119,15 @@ const Generation = z.string().refine(isCanonicalGeneration, { message: "a genera
 /**
  * The serving lease as the ENGINE holds it — a CLOSED set of four words, owned here (the engine's vocabulary, word for word;
  * a reader that switches on it exhaustively is told by the compiler when a word is added):
- *  - `none` — the lease is not in effect: the center has declared no {@link CenterCapabilities}`.servingLease` ({@link readCapabilityReading}
- *    says `undeclared` — an older center — or `declared` without the bit). The engine behaves exactly as an engine without a lease —
+ *  - `none` — the lease is not in effect: web-admin has declared no {@link WebAdminCapabilities}`.servingLease` ({@link readCapabilityReading}
+ *    says `undeclared` — an older web-admin — or `declared` without the bit). The engine behaves exactly as an engine without a lease —
  *    no renewals, no fence. A reply that cannot be read (`unreadable`) is not a reading: it does not move the engine into or out of
  *    `none` — it keeps the state it had.
  *  - `granted` — the engine holds a lease; `leaseUntil` says until when (epoch ms, the engine's own computation from the
  *    granted `ttlMs`, see {@link ServingLeaseResponse}).
- *  - `expired` — the lease is in effect but no grant is valid right now (the center is unreachable, answered `unknown`, or has
+ *  - `expired` — the lease is in effect but no grant is valid right now (web-admin is unreachable, answered `unknown`, or has
  *    not granted one yet): the engine keeps serving until its own outage allowance runs out. Not a denial.
- *  - `denied` — the center denied this instance on positive evidence (the `denied` verdict): sticky; the engine is draining and
+ *  - `denied` — web-admin denied this instance on positive evidence (the `denied` verdict): sticky; the engine is draining and
  *    stops at its deadline.
  * Only a fleet member says it: an engine without a generation has no lease and carries no `leaseState` at all (there is no
  * fifth word for "not a member" — absence is that).
@@ -129,10 +135,10 @@ const Generation = z.string().refine(isCanonicalGeneration, { message: "a genera
 export const LEASE_STATES = ["none", "granted", "expired", "denied"];
 export const LeaseState = z.enum(LEASE_STATES);
 /**
- * "This instance must restart to apply config" — the engine's OWN observation (S-741), defined ONCE for both exits that
- * carry it: the fleet heartbeat ({@link InstanceAnnouncement}`.restart`, typed) and GET /health (`restart`, read through
- * {@link readRestartSignal} — {@link InstanceHealth} keeps carrying it untyped, see there). One mint point, two exits —
- * never a second judgement.
+ * "This instance must restart to apply config" — the engine's OWN observation (S-741), defined ONCE. It is part of the engine's
+ * state, so it rides inside {@link EngineSignal} (`restart`) on both exits — the fleet heartbeat and GET /health — and is read
+ * there and only there: `readEngineSignal(body)?.restart`, or `engineSignal?.restart` on a parsed heartbeat / health body. The
+ * flat `restart` key the two bodies still carry is the pre-11 dialect (see {@link EngineSignal}); nothing reads it.
  *
  * Shape = what the server already ships on /health (`restart: { reasons, version, since }`, plus the optional `withheld`
  * qualifier below). PRESENCE is the signal:
@@ -140,7 +146,7 @@ export const LeaseState = z.enum(LEASE_STATES);
  * to presence is redundant, and two spellings of one fact drift).
  *  - `reasons` — which restart-to-apply slices differ from the value baked at boot (the vocabulary is the engine's;
  *    the contract only guarantees non-empty words, at least one).
- *  - `version` — the config-center version that currently differs from boot (the LATEST seen — it moves forward with
+ *  - `version` — the web-admin config version that currently differs from boot (the LATEST seen — it moves forward with
  *    later publishes, so a "one restart per version" dedupe bounds restarts per config version, not per reason set).
  *    Judged exactly as `readEffectiveWire` judges a config version (a finite number, `ConfigVersion`) — one quantity, one rule;
  *    {@link EngineSignal}'s two version-ledger keys use the same one.
@@ -177,7 +183,7 @@ function judgeSignalBody(body, pick, schema) {
 }
 /**
  * The reader behind every wire-shape read in this file that has no use for a reason: the engine-owned signals on /health
- * ({@link readRestartSignal}, {@link readModelRefusals}, {@link readEngineSignal}) and the request / reply bodies of the
+ * ({@link readEngineSignal}, {@link readModelRefusals}) and the request / reply bodies of the
  * fleet endpoints ({@link readServingLeaseRequest}, {@link readServingLeaseResponse}, {@link readDrainRequest},
  * {@link readDrainReceipt}). Shape mismatch, a non-object body, even a throwing accessor ⇒ `undefined` — never throws.
  */
@@ -187,17 +193,9 @@ function readSignalBody(body, pick, schema) {
 }
 /** `pick` for a shape whose keys sit flat on the body itself (as opposed to under one key of it). */
 const wholeBody = (body) => body;
-/**
- * The /health exit of {@link RestartSignal}: `health.restart` judged against the one shape. Shape mismatch, a missing
- * key, a non-object body, even a throwing accessor ⇒ `undefined` — never throws (a probe must not die on one odd body).
- * Presence law: only `restart` counts; the top-level `restartRequired` boolean the server also ships is not read.
- */
-export function readRestartSignal(health) {
-    return readSignalBody(health, (h) => h.restart, RestartSignal);
-}
 /**
  * The model-refusal cause codes (S-768) — CLOSED sets, owned HERE, never a hand-copied second list. Adding a code is
- * one edit in this file; who goes red at compile time: a reader that switches on the code exhaustively (a center), and
+ * one edit in this file; who goes red at compile time: a reader that switches on the code exhaustively (a web-admin), and
  * a producer only where it holds a table KEYED BY the code (an exhaustive `switch` over the code, or a
  * `Record<ModelEntryRefusalCode, …>`) — a producer table that merely `satisfies` these codes as values proves a subset,
  * not equality, and stays green.
@@ -296,44 +294,160 @@ export function readModelRefusals(body) {
         return undefined;
     return plane === undefined ? { entries } : { entries, plane };
 }
-/** The `/health` self-description every orchestrator reads (shipped shape, server 1.96.0). Liveness and
- *  readiness are deliberately SPLIT: `status` stays ok while draining (the process is alive); routability is
- *  `isReadyForTraffic`. Unknown fields pass through — health is a self-description, not a closed record. */
+// ── The engine's own signal and its one carrier key ─────────────────────────────────────────────────────────
+/**
+ * The engine's draining fact — ONE object wherever the engine says "I am draining": inside {@link EngineSignal}`.draining`
+ * and as the body of a {@link DrainReceipt}.
+ *  - `actionId` — the action that put the engine into draining (idempotency key of the drain request).
+ *  - `since` — epoch ms when draining began; it does not move when the same action repeats.
+ *  - `deadlineAt` — epoch ms by which the engine stops on its own.
+ */
+export const EngineDraining = z.object({
+    actionId: drainActionId(),
+    since: EpochMs,
+    deadlineAt: EpochMs,
+});
+/**
+ * Everything the ENGINE itself mints about its own state, as one object. One mint point on the engine; it rides BOTH exits —
+ * the `/health` self-description ({@link InstanceHealth}) and the fleet heartbeat ({@link InstanceAnnouncement}) — WHOLE, under
+ * the one key {@link ENGINE_SIGNAL_KEY}. Readers read it there and only there: {@link readEngineSignal} for a body,
+ * `engineSignal` on a parsed heartbeat / health body; the readiness / routing judges ({@link judgeReadiness},
+ * {@link judgeRoutability}) read nothing else.
+ *
+ * One fact, one place on a body: the engine's STATE is this object; the row's IDENTITY (`instanceId`, `worker`, `address`,
+ * `version`, `heartbeatMs`) is the body's top level and is not repeated here. The flat keys of this object's names that the two
+ * bodies still carry (`ready`, `draining` as a boolean + `drainingSince`, `restart`, `generation`, `leaseState`, `leaseUntil`)
+ * are the pre-11 flat dialect: sent during its contraction window for readers that predate this key, unchanged in shape, read by
+ * nothing in this package; their removal is registered (`ONE_TIME_MIGRATIONS` row `SS-W1`).
+ *
+ * Nested under one key, not flat on the body: the boolean dialect (`draining: boolean` + `drainingSince`, {@link InstanceHealth} /
+ * {@link InstanceAnnouncement}) is still sent during its contraction window while `draining` here is an OBJECT — one key cannot hold
+ * both, and a flat object `draining` would make every reader still on the boolean refuse a draining engine's heartbeat. Nested, an
+ * older reader never sees it (the heartbeat shape strips unknown keys; `/health` is an open record) and a newer one reads only it.
+ *
+ *  - `ready` — always said (never "absent while ready"): the engine can take new work right now.
+ *  - `draining` — present ⇔ draining ({@link EngineDraining}).
+ *  - `restart` — the one {@link RestartSignal}, same schema object, no copy.
+ *  - `generation` — echo of the env the config renderer set on this instance ({@link FLEET_GENERATION_ENV}), a canonical
+ *    decimal string ({@link isCanonicalGeneration}). Absent ⇔ not a fleet member (a single-machine engine): it takes no lease
+ *    and is not fenced.
+ *  - `leaseState` — the serving lease as the engine holds it ({@link LeaseState}: `none` / `granted` / `expired` / `denied`);
+ *    present ⇔ fleet member (the engine says it on every beat once it has a generation).
+ *  - `leaseUntil` — epoch ms until which the engine holds its serving lease, as the engine computed it from the last
+ *    `ttlMs` it was granted ({@link ServingLeaseResponse}); present ⇔ `leaseState` is `granted`.
+ *  - `configTargetVersion` / `configAppliedVersion` — the web-admin config version the engine was told to converge on, and the
+ *    one it has applied: numbers, as the engine mints them (finite, the same rule as {@link RestartSignal}`.version`; equal ⇔ converged).
+ *
+ * Reading: the default strip — only these keys come out. A shape violation in ANY key makes the whole signal `undefined` (it is
+ * never "the rest of it"). `undefined` means "no signal this reader can say" — an engine that does not carry the key, or a
+ * malformed one — and is NEVER "ready": the judges answer `no-engine-signal`.
+ */
+export const EngineSignal = z.object({
+    ready: z.boolean(),
+    draining: EngineDraining.optional(),
+    restart: RestartSignal.optional(),
+    generation: Generation.optional(),
+    leaseState: LeaseState.optional(),
+    leaseUntil: EpochMs.optional(),
+    configTargetVersion: ConfigVersion.optional(),
+    configAppliedVersion: ConfigVersion.optional(),
+});
+/** The one key {@link EngineSignal} rides under, on the `/health` body and on the heartbeat body alike. Both sides import THIS
+ *  constant; neither spells the key. */
+export const ENGINE_SIGNAL_KEY = "engineSignal";
+/**
+ * The reader of {@link EngineSignal} on a body — and so of every part of it (`readEngineSignal(body)?.restart` is THE restart
+ * reading): the value under {@link ENGINE_SIGNAL_KEY}, judged by the same guarded body reader as {@link readModelRefusals}, so the
+ * same odd input gets the same answer from both. A missing key, shape mismatch (a missing `ready` included), a non-object body,
+ * even a throwing accessor ⇒ `undefined` — never throws. Keys of the signal's names lying flat on the body are NOT read (the flat
+ * dialect; the carrier is the one key).
+ */
+export function readEngineSignal(body) {
+    return readSignalBody(body, (b) => b[ENGINE_SIGNAL_KEY], EngineSignal);
+}
+/** The `/health` self-description every orchestrator reads. Liveness and readiness are deliberately SPLIT: `status` stays ok while
+ *  draining (the process is alive); readiness is {@link judgeReadiness} over the engine signal the body carries under
+ *  {@link ENGINE_SIGNAL_KEY}. Unknown fields pass through — health is a self-description, not a closed record: `modelRefusals`
+ *  rides it untyped and is read with {@link readModelRefusals}; the flat dialect keys other than the boolean pair (`ready`,
+ *  `restart`, `generation`, `leaseState`, `leaseUntil`) ride it untyped too and are read by nothing. */
 export const InstanceHealth = z
     .object({
+    /** The instance's identity: the engine's OWN per-process id, minted by the engine every time the process starts (never read
+     *  from env: replicas of one Deployment share one env, and a restarted container reuses its env, so env cannot tell two
+     *  processes apart). The same value as the heartbeat's {@link InstanceAnnouncement}`.instanceId`. */
     instanceId: z.string().min(1),
     /** build self-description — "did the restart actually land new code" (upgrade classification) */
     version: z.string().min(1),
-    /** absent = not draining */
+    /** @deprecated Flat engine-state dialect (the boolean draining), sent during its contraction window for readers that predate
+     *  {@link ENGINE_SIGNAL_KEY}; read nothing off it — draining is {@link EngineSignal}`.draining`. Removal registered
+     *  (`ONE_TIME_MIGRATIONS` row `SS-W1`). */
     draining: z.boolean().optional(),
-    /** epoch ms, present iff draining */
+    /** @deprecated Flat engine-state dialect (pairs with the boolean `draining`: epoch ms, present iff draining); same window —
+     *  read {@link EngineSignal}`.draining.since` instead. */
     drainingSince: z.number().optional(),
-    // S-741: the server's `restart` (and its redundant top-level `restartRequired` boolean) ride the passthrough
-    // UNTYPED on purpose — typing `restart` here would turn today's lenient read into a strict one (a /health body with
-    // an odd `restart` would stop parsing), which is a MAJOR by this package's release rules. Read it with
-    // {@link readRestartSignal}. Typing it on this schema is an item for the next major.
-    // S-768: `modelRefusals` rides the passthrough untyped for the same reason — read it with {@link readModelRefusals}.
+    /** The engine's {@link EngineSignal}, whole — the one place its state is read off `/health`. Read exactly as
+     *  {@link readEngineSignal} reads it: a value that breaks the shape is ABSENT (`.catch`), never a refused body — and an absent
+     *  signal is `no-engine-signal`, never ready. The key may then be present with the value `undefined`. */
+    [ENGINE_SIGNAL_KEY]: EngineSignal.optional().catch(undefined),
 })
     .passthrough();
-/** Readiness = the routability predicate (k8s readiness probe, gateway health filter, shell seam switch).
- *  Its input is the boolean-`draining` dialect of {@link InstanceHealth}. An {@link EngineSignal} types `draining` as an
- *  object, so it does not typecheck here (on purpose: `!== true` would read an object-valued `draining` as "ready").
- *  The next major retires the boolean pair (`draining` / `drainingSince`) and gives both this predicate and
- *  {@link isRoutable} `EngineSignal` as their input. */
-export function isReadyForTraffic(h) {
-    return h.draining !== true;
+/** Why an instance is not routable — a CLOSED set, in the order the judges check:
+ *  - `no-engine-signal` — no {@link EngineSignal} to read (an engine that does not carry it, or a malformed one). Never "ready".
+ *  - `stale` — silent past its declared heartbeat cadence × {@link STALE_HEARTBEAT_MULTIPLIER} (stored rows only).
+ *  - `observer-not-ready` — the reconciler's own observation vetoes it (stored rows only; the SECOND source, AND-merged).
+ *  - `draining` — the engine says it is draining.
+ *  - `not-ready` — the engine says it is not ready. */
+export const NOT_ROUTABLE_CODES = ["no-engine-signal", "stale", "observer-not-ready", "draining", "not-ready"];
+const notRoutable = (code) => {
+    switch (code) {
+        case "no-engine-signal":
+            return {
+                routable: false,
+                code,
+                why: `no engine signal: the engine predates ${ENGINE_SIGNAL_KEY}, or sent a malformed one — never routed to; its flat ready / draining keys are not read in its place`,
+            };
+        case "stale":
+            return { routable: false, code, why: `silent past ${STALE_HEARTBEAT_MULTIPLIER}× its declared heartbeat cadence` };
+        case "observer-not-ready":
+            return { routable: false, code, why: "the reconciler observes it not ready" };
+        case "draining":
+            return { routable: false, code, why: "the engine says it is draining" };
+        case "not-ready":
+            return { routable: false, code, why: "the engine says it is not ready" };
+        default: {
+            const unhandled = code;
+            throw new Error(`unhandled not-routable code ${String(unhandled)}`);
+        }
+    }
+};
+/** Readiness — the ONE judge of "may new work go to this engine", from the engine's own signal only (k8s readiness probe,
+ *  gateway health filter, shell seam switch): ready ⇔ a signal is present, says `ready`, and is not draining. Pass
+ *  {@link readEngineSignal}`(healthBody)`; `undefined` (no signal) is `no-engine-signal`, never ready. */
+export function judgeReadiness(signal) {
+    if (signal === undefined)
+        return notRoutable("no-engine-signal");
+    if (signal.draining !== undefined)
+        return notRoutable("draining");
+    if (!signal.ready)
+        return notRoutable("not-ready");
+    return { routable: true };
+}
+/** {@link judgeReadiness} as a boolean (the same judge, no second reading). */
+export function isReadyForTraffic(signal) {
+    return judgeReadiness(signal).routable;
 }
 // ── Domain 2: instance discovery (worker announces itself; reconciler observation is the SECOND source) ───
-/** Heartbeat cadence the announcement declares (center judges staleness against the DECLARED cadence, so a
+/** Heartbeat cadence the announcement declares (web-admin judges staleness against the DECLARED cadence, so a
  *  slow-heartbeat worker is not falsely reaped). */
 export const DEFAULT_HEARTBEAT_MS = 30_000;
 /** An instance is stale once silent for this many missed heartbeats (aligned with the reconciler's own
  *  stale window: 2× cadence, not a fixed wall-clock). */
 export const STALE_HEARTBEAT_MULTIPLIER = 2;
-/** Register/heartbeat upsert (worker → center, D2: worker-active). ONE shape for both — registration is the
+/** Register/heartbeat upsert (worker → web-admin, D2: worker-active). ONE shape for both — registration is the
  *  first heartbeat; every heartbeat re-announces the full row (idempotent upsert, no drift between a
- *  "register" and a "renew" schema). `draining:true` is the instance SELF-removing from the routable set the
- *  moment the stop signal lands — faster than any observer.
+ *  "register" and a "renew" schema). The engine's {@link EngineSignal} rides it whole under {@link ENGINE_SIGNAL_KEY}: a signal
+ *  saying "draining" is the instance SELF-removing from the routable set the moment the stop signal lands — faster than any
+ *  observer.
  *  Scope: the body carries NO `scope` — this shape has no such key, and one sent anyway is stripped. The row lands in the scope
  *  the CREDENTIAL names: under a per-worker token, the scope the token binds (a `?scope=` query parameter, when given, must equal
  *  it); under the shared token, the `?scope=` query parameter, absent ⇒ `"global"`. */
@@ -344,14 +458,16 @@ export const InstanceAnnouncement = z.object({
     /** reachable base URL for the deployment form: k8s pod IP:port / docker net alias / 127.0.0.1:<engine.port> */
     address: z.string().min(1),
     version: z.string().min(1),
-    /** self-declared readiness: model roster landed AND not draining (server ≥7.102.0; older engines: !draining only) */
+    /** @deprecated Flat engine-state dialect (self-declared readiness), sent during its contraction window for readers that
+     *  predate {@link ENGINE_SIGNAL_KEY}; read nothing off it — readiness is {@link EngineSignal}`.ready`. Removal registered
+     *  (`ONE_TIME_MIGRATIONS` row `SS-W1`). */
     ready: z.boolean(),
+    /** @deprecated Flat engine-state dialect (the boolean draining), same window; read nothing off it — draining is
+     *  {@link EngineSignal}`.draining`. */
     draining: z.boolean().default(false),
-    heartbeatMs: z.number().int().positive().default(DEFAULT_HEARTBEAT_MS),
-    /** S-741: present ⇔ this instance must restart to apply config — the SAME {@link RestartSignal} /health carries,
-     *  minted by the same getter (self-reported: a worker-scoped credential can only report for its own worker).
-     *  Every heartbeat re-announces the full row, so a later heartbeat WITHOUT it means "no longer required" — the
-     *  stored row ({@link InstanceRegistration}) is replaced, never merged. */
+    heartbeatMs: INTEGER.positive().default(DEFAULT_HEARTBEAT_MS),
+    /** @deprecated Flat engine-state dialect (the restart signal), same window; read nothing off it — the restart signal is
+     *  {@link EngineSignal}`.restart`. Its shape is unchanged for the window: a malformed one still refuses the heartbeat, as before. */
     restart: RestartSignal.optional(),
     /** S-768: present ⇔ this instance has at least one reportable model refusal — the SAME {@link ModelRefusalsWire} /health
      *  carries, minted by the same getter; read it with {@link readModelRefusals}`(announcement)` (never off this field
@@ -364,20 +480,21 @@ export const InstanceAnnouncement = z.object({
      *  ABSENT (`.catch`) — it never fails the announcement, so it can never make a healthy instance unroutable (unlike
      *  `restart`, whose shape still gates the row). The key may then be present with the value `undefined`. */
     modelRefusals: ModelRefusalsWire.optional().catch(undefined),
-    /** Fleet membership and the lease reading, flat on the heartbeat body under the names and values {@link EngineSignal} gives
-     *  them (one mint point on the engine; this shape reuses that shape's schemas, not copies):
-     *  - `generation` — the canonical decimal generation ({@link isCanonicalGeneration}); present ⇔ the instance is a fleet member.
-     *  - `leaseState` — {@link LeaseState}; present ⇔ fleet member.
-     *  - `leaseUntil` — epoch ms until which the held lease runs; present ⇔ `leaseState` is `granted`.
-     *  The presence law between the three is the engine's; this shape does not judge it across keys. Every heartbeat re-announces
-     *  the full row, so a later heartbeat without a key means the engine no longer says it (the stored row is replaced, never merged).
-     *  Failure direction = meaning direction: these are evidence a center keeps, never routing input — a value that breaks its schema
-     *  drops that ONE key to ABSENT (`.catch`) and the heartbeat is still accepted, so a lease word a newer engine adds can never make
-     *  an older center refuse every heartbeat of that engine. A dropped key reads exactly like an unsaid one; the key may then be
-     *  present with the value `undefined`. */
+    /** @deprecated Flat engine-state dialect (fleet membership), same window; read nothing off it — it is
+     *  {@link EngineSignal}`.generation`. Shape unchanged for the window (a value that breaks it drops to absent, as before). */
     generation: Generation.optional().catch(undefined),
+    /** @deprecated Flat engine-state dialect (the lease state), same window; read nothing off it — it is {@link EngineSignal}`.leaseState`. */
     leaseState: LeaseState.optional().catch(undefined),
+    /** @deprecated Flat engine-state dialect (the lease deadline), same window; read nothing off it — it is {@link EngineSignal}`.leaseUntil`. */
     leaseUntil: EpochMs.optional().catch(undefined),
+    /** The engine's {@link EngineSignal}, whole — the one place its state is read off a heartbeat (the routing judge
+     *  {@link judgeRoutability} reads nothing else). Every heartbeat re-announces the full row, so a later heartbeat whose signal
+     *  no longer says a part (`restart`, a lease key) means the engine no longer says it — the stored row is replaced, never merged.
+     *  Read exactly as {@link readEngineSignal} reads it off any body: a value that breaks the shape is ABSENT (`.catch`), never a
+     *  refused heartbeat — and an absent signal is `no-engine-signal`, never routable, so the failure lands on the routing axis
+     *  closed, while the rest of the row (restart, refusals, membership evidence) is still kept. The key may then be present with
+     *  the value `undefined`. */
+    [ENGINE_SIGNAL_KEY]: EngineSignal.optional().catch(undefined),
 });
 /** Explicit goodbye (stop signal handler) — removes the row immediately instead of waiting out staleness. */
 export const InstanceDeregistration = z.object({
@@ -385,108 +502,44 @@ export const InstanceDeregistration = z.object({
     worker: z.string().min(1),
     reason: z.enum(["draining", "shutdown", "superseded"]).optional(),
 });
-/** The stored discovery-table row = last announcement + center-side bookkeeping. `observedReady` is the
+/** The stored discovery-table row = last announcement + web-admin-side bookkeeping. `observedReady` is the
  *  reconciler's observation (phase Running) — the SECOND source; absent where no reconciler exists (TOC/TOB). */
 export const InstanceRegistration = InstanceAnnouncement.extend({
-    registeredMs: z.number().int().nonnegative(),
-    lastSeenMs: z.number().int().nonnegative(),
+    registeredMs: INTEGER.nonnegative(),
+    lastSeenMs: INTEGER.nonnegative(),
     observedReady: z.boolean().optional(),
 });
 /** Silent past the declared cadence × multiplier ⇒ stale (auto-removed from the routable set). */
 export function isInstanceStale(r, nowMs) {
     return nowMs - r.lastSeenMs > STALE_HEARTBEAT_MULTIPLIER * r.heartbeatMs;
 }
-/** Health fusion: routable ⇔ self-declared ready ∧ not draining ∧ not stale ∧ observer does not veto.
- *  Two sources merge as an AND — EITHER source's "not ready" removes the instance (fail-closed).
- *  Its input is the stored heartbeat row (boolean `draining`); it moves to {@link EngineSignal} in the same major as
- *  {@link isReadyForTraffic}. */
+/** Health fusion — the ONE judge of "may dispatch route to this stored instance": a signal is present ∧ the row is not stale ∧
+ *  the observer does not veto ∧ the engine's own readiness ({@link judgeReadiness} over the row's {@link EngineSignal}). Two sources
+ *  merge as an AND — EITHER source's "not ready" removes the instance (fail-closed). The row's boolean `draining` is not read. */
+export function judgeRoutability(r, nowMs) {
+    const signal = r[ENGINE_SIGNAL_KEY];
+    if (signal === undefined)
+        return notRoutable("no-engine-signal");
+    if (isInstanceStale(r, nowMs))
+        return notRoutable("stale");
+    if (r.observedReady === false)
+        return notRoutable("observer-not-ready");
+    return judgeReadiness(signal);
+}
+/** {@link judgeRoutability} as a boolean (the same judge, no second reading). */
 export function isRoutable(r, nowMs) {
-    return r.ready && !r.draining && r.observedReady !== false && !isInstanceStale(r, nowMs);
+    return judgeRoutability(r, nowMs).routable;
 }
 export function routableInstances(rs, nowMs) {
     return rs.filter((r) => isRoutable(r, nowMs));
 }
-// ── Domain 2b: the engine's own signal, the serving lease, the drain endpoint ─────────────────────────────
-/**
- * The engine's draining fact — ONE object wherever the engine says "I am draining": inside {@link EngineSignal}`.draining`
- * and as the body of a {@link DrainReceipt}.
- *  - `actionId` — the action that put the engine into draining (idempotency key of the drain request).
- *  - `since` — epoch ms when draining began; it does not move when the same action repeats.
- *  - `deadlineAt` — epoch ms by which the engine stops on its own.
- */
-export const EngineDraining = z.object({
-    actionId: z.string().min(1),
-    since: EpochMs,
-    deadlineAt: EpochMs,
-});
-/**
- * Everything the ENGINE itself mints about its own state, as one object — the closed form of the engine-owned subset of the
- * /health self-description ({@link InstanceHealth} is that self-description: an open record, `.passthrough()`, which also
- * carries what the host adds — build, pid, port, store posture). One mint point on the engine; {@link readEngineSignal} reads
- * this shape off a body whose keys sit flat on it (no wrapper key).
- *
- * Where it rides today: on NEITHER exit whole. The heartbeat ({@link InstanceAnnouncement}) and `/health` ({@link InstanceHealth})
- * still speak the 8.0 dialect for the keys they share with this shape, in two ways:
- *  1. `draining` is a BOOLEAN there, not the {@link EngineDraining} object. The heartbeat always carries it (`false` included);
- *     `/health` carries `draining: true` only while draining.
- *  2. `/health` carries `ready` only while NOT ready (`ready: false`); a ready engine's `/health` body has no `ready` key.
- * So `readEngineSignal` over a heartbeat body is always `undefined` (point 1), and over a `/health` body it is `undefined` whenever
- * either applies. What does ride both exits flat, under these names and with these values: `restart`, `instanceId`
- * and the fleet-membership keys `generation` / `leaseState` / `leaseUntil` — on the heartbeat, read them off the parsed
- * {@link InstanceAnnouncement} (which types all five). The next major retires the boolean pair (`draining` / `drainingSince`),
- * has both exits carry this shape whole and moves {@link isReadyForTraffic} / {@link isRoutable} onto it; until then this is
- * the target form, and `readEngineSignal` is the reader for a body that already speaks it.
- *
- *  - `ready` — always said (never "absent while ready"): the engine can take new work right now.
- *  - `draining` — present ⇔ draining ({@link EngineDraining}). NOTE the dialect: {@link InstanceHealth}`.draining` and
- *    {@link InstanceAnnouncement}`.draining` are BOOLEANS (the 8.0 dialect, kept untouched); here it is an object. A body
- *    whose `draining` is a boolean is therefore not an `EngineSignal` and reads as `undefined`.
- *  - `restart` — the one {@link RestartSignal}, same schema object, no copy.
- *  - `generation` — echo of the env the config renderer set on this instance ({@link FLEET_GENERATION_ENV}), a canonical
- *    decimal string ({@link isCanonicalGeneration}). Absent ⇔ not a fleet member (a single-machine engine): it takes no lease
- *    and is not fenced.
- *  - `instanceId` — the engine's OWN process identity, minted by the engine every time the process starts (never read from
- *    env: replicas of one Deployment share one env, and a restarted container reuses its env, so env cannot tell two
- *    processes apart). It is present on a standalone engine too — only `generation` marks fleet membership.
- *  - `leaseState` — the serving lease as the engine holds it ({@link LeaseState}: `none` / `granted` / `expired` / `denied`);
- *    present ⇔ fleet member (the engine says it on every beat once it has a generation).
- *  - `leaseUntil` — epoch ms until which the engine holds its serving lease, as the engine computed it from the last
- *    `ttlMs` it was granted ({@link ServingLeaseResponse}); present ⇔ `leaseState` is `granted`.
- *  - `configTargetVersion` / `configAppliedVersion` — the config-center version the engine was told to converge on, and the
- *    one it has applied: numbers, as the engine mints them (finite, the same rule as {@link RestartSignal}`.version`; equal ⇔ converged).
- *
- * Reading: `EngineSignal` is parsed with the default strip — a whole /health body goes in, only these keys come out. A
- * shape violation in ANY key makes the whole signal `undefined` (it is never "the rest of it"). `undefined` means "no
- * signal this reader can say" — an engine that predates the keys, or a malformed body — and is NEVER "ready": a caller on
- * the routing axis treats it as not routable unless it deliberately falls back to the boolean dialect of
- * {@link InstanceHealth}.
- */
-export const EngineSignal = z.object({
-    ready: z.boolean(),
-    draining: EngineDraining.optional(),
-    restart: RestartSignal.optional(),
-    generation: Generation.optional(),
-    instanceId: z.string().min(1).optional(),
-    leaseState: LeaseState.optional(),
-    leaseUntil: EpochMs.optional(),
-    configTargetVersion: ConfigVersion.optional(),
-    configAppliedVersion: ConfigVersion.optional(),
-});
-/**
- * The reader of {@link EngineSignal}: the shape's keys, flat on the given body, judged by the same guarded body reader as
- * {@link readRestartSignal} and {@link readModelRefusals}, so the same odd input gets the same answer from all three. Shape
- * mismatch, a missing `ready`, a non-object body, even a throwing accessor ⇒ `undefined` — never throws. See {@link EngineSignal}
- * for what `undefined` means (not "ready") and for why today's heartbeat and `/health` bodies read as `undefined` here.
- */
-export function readEngineSignal(health) {
-    return readSignalBody(health, wholeBody, EngineSignal);
-}
+// ── Domain 2b: the serving lease, the drain endpoint ─────────────────────────────
 /**
  * The env name a fleet member's generation travels under — the config renderer sets it, the engine reads it back and echoes
  * it as {@link EngineSignal}`.generation`. Both sides import THIS constant; neither spells the name. The value is the
  * generation this instance belongs to (opaque string); absent from the engine's env ⇔ not a fleet member (the standalone
  * form). There is deliberately NO env name for the instance id: an instance's identity is minted by the engine per process
- * ({@link EngineSignal}`.instanceId`), and env cannot carry it (see there).
+ * ({@link InstanceHealth}`.instanceId`), and env cannot carry it (see there).
  */
 export const FLEET_GENERATION_ENV = "FLEET_GENERATION";
 /**
@@ -498,19 +551,19 @@ export const FLEET_GENERATION_ENV = "FLEET_GENERATION";
  * {@link ServingLeaseRequest} and {@link InstanceAnnouncement}; nothing in the engine's env does); the engine's own identity
  * scope is the one the renderer gave in this env; that the two are the same value is the renderer's obligation.
  * The engine never derives it from the token's format (a token is opaque to it, and a format guess would be a second source
- * that can disagree with the scope the center binds). Absent from the engine's env ⇒ the default scope, {@link GLOBAL_SCOPE} (`api/scopes`) —
- * the same default the center reads where nothing names a scope; this note does not restate the value. Like
+ * that can disagree with the scope web-admin binds). Absent from the engine's env ⇒ the default scope, {@link GLOBAL_SCOPE} (`api/scopes`) —
+ * the same default web-admin reads where nothing names a scope; this note does not restate the value. Like
  * {@link FLEET_GENERATION_ENV} it is a reserved worker env name (`WorkerSpec.env` / `secretEnv` cannot set it).
  */
 export const FLEET_SCOPE_ENV = "FLEET_SCOPE";
 /**
  * The serving lease — the ONE fence between a superseded generation and the traffic it must stop taking. A fleet-member
- * engine renews it with the center; the center answers per the lifecycle object it holds for that instance. Three constants
+ * engine renews it with web-admin; web-admin answers per the lifecycle object it holds for that instance. Three constants
  * fix the clock, all in ms:
  *  - {@link SERVING_LEASE_TTL_DEFAULT_MS} — the lease length when the operator sets none (10 min).
  *  - {@link SERVING_LEASE_TTL_FLOOR_MS} — the shortest lease there is: a configured TTL below it is treated as it (1 min),
  *    the same way {@link DRAIN_GRACE_FLOOR_MS} protects a fat-fingered grace.
- *  - {@link SERVING_LEASE_DRIFT_MARGIN_MS} — the center's clock-skew allowance: it adds this to a lease's recorded expiry
+ *  - {@link SERVING_LEASE_DRIFT_MARGIN_MS} — web-admin's clock-skew allowance: it adds this to a lease's recorded expiry
  *    before it counts that lease as over. It is DERIVED from {@link DEFAULT_HEARTBEAT_MS} (one cadence, one number), never a
  *    second constant that could drift from it.
  */
@@ -522,7 +575,7 @@ export const SERVING_LEASE_DRIFT_MARGIN_MS = DEFAULT_HEARTBEAT_MS;
  * {@link SERVING_LEASE_TTL_DEFAULT_MS}; a number below {@link SERVING_LEASE_TTL_FLOOR_MS} (zero and negatives included) ⇒ the
  * floor; otherwise the number, truncated to whole ms, with no ceiling. It is for the ISSUING side's configuration. A reply's
  * `ttlMs` is used exactly as granted and is never clamped upward — an engine that stretched a short grant to the floor would
- * hold the lease past what the center recorded, which is the one thing the fence exists to prevent.
+ * hold the lease past what web-admin recorded, which is the one thing the fence exists to prevent.
  */
 export function clampServingLeaseTtlMs(configuredMs) {
     if (typeof configuredMs !== "number" || !Number.isFinite(configuredMs))
@@ -530,13 +583,13 @@ export function clampServingLeaseTtlMs(configuredMs) {
     return Math.max(SERVING_LEASE_TTL_FLOOR_MS, Math.floor(configuredMs));
 }
 /**
- * Engine → center: "may this instance keep serving?" The identity triple names the instance exactly — a lease is never
+ * Engine → web-admin: "may this instance keep serving?" The identity triple names the instance exactly — a lease is never
  * asked for by worker name alone. `generation` is the env echo ({@link FLEET_GENERATION_ENV}); `instanceId` is the engine's
- * own per-process identity ({@link EngineSignal}`.instanceId`), so a restarted process is a NEW instance to the center.
+ * own per-process identity ({@link InstanceHealth}`.instanceId`), so a restarted process is a NEW instance to web-admin.
  * `scope` — the tenant scope the lease is asked in. A renewal is taken on a PER-WORKER token only — the credential binds
  * (scope, worker) — so the credential decides the scope and this field can only agree: absent = the scope the token binds; present
  * ⇒ it must equal that scope (a mismatch is refused, never rewritten either way). The shared token may not renew a lease at all
- * (the center answers 403). Only fleet members ask: an engine without a generation (the standalone form) has no lease and sends
+ * (web-admin answers 403). Only fleet members ask: an engine without a generation (the standalone form) has no lease and sends
  * nothing.
  */
 export const ServingLeaseRequest = z.object({
@@ -548,32 +601,32 @@ export const ServingLeaseRequest = z.object({
 /**
  * Why a lease is refused — a CLOSED set of exactly two words, owned here:
  *  - `superseded` — a newer generation of this worker has taken over; this instance is the old one.
- *  - `retired` — the center has retired this instance (or the worker it belongs to).
+ *  - `retired` — web-admin has retired this instance (or the worker it belongs to).
  * Only {@link ServingLeaseResponse}'s `denied` arm carries a reason; `unknown` has none, by shape.
  */
 export const SERVING_LEASE_DENIED_REASONS = ["superseded", "retired"];
 export const ServingLeaseDeniedReason = z.enum(SERVING_LEASE_DENIED_REASONS);
-const ServingLeaseGranted = z.object({ verdict: z.literal("granted"), ttlMs: z.number().int().positive() });
+const ServingLeaseGranted = z.object({ verdict: z.literal("granted"), ttlMs: INTEGER.positive() });
 const ServingLeaseDenied = z.object({ verdict: z.literal("denied"), reason: ServingLeaseDeniedReason });
 const ServingLeaseUnknown = z.object({ verdict: z.literal("unknown") });
 /**
- * Center → engine: the verdict, a CLOSED set of three words ({@link SERVING_LEASE_VERDICTS}) — the arms of one
+ * Web-admin → engine: the verdict, a CLOSED set of three words ({@link SERVING_LEASE_VERDICTS}) — the arms of one
  * discriminated union, so a reader that switches on `verdict` is told by the compiler when a word is added.
  *  - `granted` — keep serving; `ttlMs` is how long the lease lasts, a DURATION, never a wall-clock instant: the engine counts
- *    it from the instant it SENT the request, on its own monotonic clock (`expiresAt = sendAt + ttlMs`), and the center keeps
+ *    it from the instant it SENT the request, on its own monotonic clock (`expiresAt = sendAt + ttlMs`), and web-admin keeps
  *    its own expiry from its store time — the two sides never compare clocks, so no clock agreement is needed.
  *  - `denied` — this instance must stop: `reason` is {@link ServingLeaseDeniedReason}. The ONLY arm that obliges an engine to
- *    stop serving, and it is issued on POSITIVE evidence only: the center keeps, per (scope, worker), a persisted generation
+ *    stop serving, and it is issued on POSITIVE evidence only: web-admin keeps, per (scope, worker), a persisted generation
  *    floor that is never garbage-collected, and a request whose generation lies below it is `superseded`; `retired` likewise
- *    rests on a record the center holds. A center that merely holds no such record does not deny — it answers `unknown`.
- *  - `unknown` — the center holds no lifecycle object for this instance right now (restoring its store, migrating scopes, not
+ *    rests on a record web-admin holds. A web-admin that merely holds no such record does not deny — it answers `unknown`.
+ *  - `unknown` — web-admin holds no lifecycle object for this instance right now (restoring its store, migrating scopes, not
  *    yet claimed). It says NOTHING about whether the instance should serve, so it is not a kind of `denied` and absence of the
  *    object NEVER turns into a denial: it carries no reason, and an engine never drains on it. To the engine it is the same
- *    case as an unreachable center.
- * This is the law for what a center SENDS. A reader does not apply it to `reason`: {@link readServingLeaseResponse} judges by
+ *    case as an unreachable web-admin.
+ * This is the law for what a web-admin SENDS. A reader does not apply it to `reason`: {@link readServingLeaseResponse} judges by
  * the `verdict` key and keeps a `denied` a `denied` even when its reason is outside the set ({@link ServingLeaseReading}). A
  * reply whose `verdict` itself is outside the three words (or a `granted` with no valid `ttlMs`) is not a verdict at all and
- * reads as `undefined` — an unreachable center, never `denied`, never `granted`.
+ * reads as `undefined` — an unreachable web-admin, never `denied`, never `granted`.
  */
 export const ServingLeaseResponse = z.discriminatedUnion("verdict", [ServingLeaseGranted, ServingLeaseDenied, ServingLeaseUnknown]);
 /** The reason word a READER puts in place of a `denied` reason it cannot place (outside {@link SERVING_LEASE_DENIED_REASONS},
@@ -584,14 +637,14 @@ const isServingLeaseDeniedReason = (w) => SERVING_LEASE_DENIED_REASONS.includes(
  *  can place is kept, anything else becomes {@link SERVING_LEASE_UNKNOWN_REASON}. The arm is still `denied`. */
 const ServingLeaseDeniedRead = z.object({
     verdict: z.literal("denied"),
-    reason: z.unknown().transform((r) => (isServingLeaseDeniedReason(r) ? r : SERVING_LEASE_UNKNOWN_REASON)),
+    reason: z.unknown().optional().transform((r) => (isServingLeaseDeniedReason(r) ? r : SERVING_LEASE_UNKNOWN_REASON)),
 });
 /** The read face of {@link ServingLeaseResponse} — same three arms, with the `denied` arm tolerant about `reason`. */
 const ServingLeaseReadFace = z.discriminatedUnion("verdict", [ServingLeaseGranted, ServingLeaseDeniedRead, ServingLeaseUnknown]);
 /** The verdict words as a runtime list. `satisfies` bites a word the union does not have; the converse (a union arm missing
  *  from this list) is pinned by a test that reads the union's discriminators. */
 export const SERVING_LEASE_VERDICTS = ["granted", "denied", "unknown"];
-/** Center side: the request body of a serving-lease renewal. Shape mismatch / non-object / throwing accessor ⇒ `undefined`,
+/** Web-admin side: the request body of a serving-lease renewal. Shape mismatch / non-object / throwing accessor ⇒ `undefined`,
  *  never throws (same guarded reader as every other read in this file). */
 export function readServingLeaseRequest(body) {
     return readSignalBody(body, wholeBody, ServingLeaseRequest);
@@ -599,53 +652,53 @@ export function readServingLeaseRequest(body) {
 /** Engine side: the reply to a renewal, judged by its `verdict` key: `granted` needs a valid `ttlMs`, `denied` is `denied`
  *  whatever its `reason` (see {@link ServingLeaseReading}), `unknown` is `unknown`. A non-object, a throwing accessor, a
  *  `verdict` outside the three words or a `granted` without a valid `ttlMs` ⇒ `undefined`, never throws — and `undefined`
- *  is read like an unreachable center, never like `denied` and never like `granted`. */
+ *  is read like an unreachable web-admin, never like `denied` and never like `granted`. */
 export function readServingLeaseResponse(body) {
     return readSignalBody(body, wholeBody, ServingLeaseReadFace);
 }
 /**
- * What the CENTER says it can do: capability bits an engine reads before it starts using a center-side endpoint.
- *  - `servingLease` — the center answers serving-lease renewals ({@link ServingLeaseRequest} / {@link ServingLeaseResponse}).
+ * What web-admin says it can do: capability bits an engine reads before it starts using a web-admin-side endpoint.
+ *  - `servingLease` — web-admin answers serving-lease renewals ({@link ServingLeaseRequest} / {@link ServingLeaseResponse}).
  *
  * A bit is `true` or absent — one spelling for "not supported" (there is no `false`). An absent bit — in a declared object, or
- * because the center declares nothing at all (an older center) — means the center does not support the lease, and the engine then
- * neither renews a lease nor is fenced by one: this is the compatibility gate that lets an executor ship ahead of the center
- * without pushing running engines into lease expiry. It is a gate, not a verdict — nothing in this shape says "the center refuses
+ * because web-admin declares nothing at all (an older web-admin) — means web-admin does not support the lease, and the engine then
+ * neither renews a lease nor is fenced by one: this is the compatibility gate that lets an executor ship ahead of web-admin
+ * without pushing running engines into lease expiry. It is a gate, not a verdict — nothing in this shape says "web-admin refuses
  * leases". Read a heartbeat reply with {@link readCapabilityReading} and start the lease client only on a `declared` reading whose
  * `capabilities.servingLease === true`.
- * Unknown bits are stripped (a newer center's extra bits never break an older reader); a known bit whose value is not `true` breaks
+ * Unknown bits are stripped (a newer web-admin's extra bits never break an older reader); a known bit whose value is not `true` breaks
  * the declaration — and a broken declaration is NOT an absent one: the reply reads as `unreadable`, which is not a reading (the engine
  * keeps the state it had; see {@link readCapabilityReading}).
  * It rides in ONE place: the heartbeat's 2xx reply ({@link FLEET_PATHS}`.instances`), under {@link HEARTBEAT_REPLY_CAPABILITIES_KEY}.
- * The center answers the bits per CALLER CREDENTIAL: under a per-worker token, by what the center supports; under the shared token
+ * Web-admin answers the bits per CALLER CREDENTIAL: under a per-worker token, by what web-admin supports; under the shared token
  * `servingLease` is always absent (the serving-lease endpoint takes per-worker tokens only, so announcing it there would only push
  * that caller into the unreachable arm).
  */
-export const CenterCapabilities = z.object({
+export const WebAdminCapabilities = z.object({
     servingLease: z.literal(true).optional(),
 });
 /**
- * The key of the heartbeat's 2xx reply body under which the center puts its {@link CenterCapabilities} — the object's only carrier.
- * The center writes `{ …, [HEARTBEAT_REPLY_CAPABILITIES_KEY]: caps }`; the engine reads the whole reply with
+ * The key of the heartbeat's 2xx reply body under which web-admin puts its {@link WebAdminCapabilities} — the object's only carrier.
+ * Web-admin writes `{ …, [HEARTBEAT_REPLY_CAPABILITIES_KEY]: caps }`; the engine reads the whole reply with
  * `readCapabilityReading(reply)` — the key lookup lives in the reader, one carrier one reader — and only on a 2xx (a failed heartbeat
  * says nothing about the bits). Nested, not flat: the reply's own keys and the capability bits never share a namespace.
- * A reply without the key is an older center — no capability said (`undeclared`). A reply with the key present with a value that
+ * A reply without the key is an older web-admin — no capability said (`undeclared`). A reply with the key present with a value that
  * breaks the shape is NOT "without the key" — it is `unreadable`, and an unreadable reply says nothing: neither declared nor undeclared.
  */
 export const HEARTBEAT_REPLY_CAPABILITIES_KEY = "capabilities";
 /** The reply body as far as the capability carrier is concerned: the one key, optional, nothing else (the reply's other keys are stripped). */
-const CapabilitiesCarrier = z.object({ [HEARTBEAT_REPLY_CAPABILITIES_KEY]: CenterCapabilities.optional() });
+const CapabilitiesCarrier = z.object({ [HEARTBEAT_REPLY_CAPABILITIES_KEY]: WebAdminCapabilities.optional() });
 /**
- * Engine side: what one heartbeat reply says about the center's capabilities. The input is the heartbeat's whole 2xx reply body
+ * Engine side: what one heartbeat reply says about web-admin's capabilities. The input is the heartbeat's whole 2xx reply body
  * (the key lookup lives here — one carrier, one reader), the output one of three readings:
- *  - `declared` — the key ({@link HEARTBEAT_REPLY_CAPABILITIES_KEY}) is present and its value passes {@link CenterCapabilities};
+ *  - `declared` — the key ({@link HEARTBEAT_REPLY_CAPABILITIES_KEY}) is present and its value passes {@link WebAdminCapabilities};
  *    `capabilities` is the parsed object (unknown bits stripped, an absent bit stays absent).
- *  - `undeclared` — the reply is an object and the key is absent: an older center, which has said nothing about capabilities.
+ *  - `undeclared` — the reply is an object and the key is absent: an older web-admin, which has said nothing about capabilities.
  *    (`undefined` as the key's value is what JSON cannot carry; it reads as the key being absent.)
  *  - `unreadable` — the reply is not an object (`why: "not-an-object"`), or the key is present but its value is not a
- *    {@link CenterCapabilities} (`why: "invalid-capabilities"`; an accessor that throws reads the same way).
+ *    {@link WebAdminCapabilities} (`why: "invalid-capabilities"`; an accessor that throws reads the same way).
  * Only `declared` and `undeclared` are readings. `unreadable` is not a reading: on the fence axis a malformed declaration must not
- * read as "the center declared nothing", so the engine acts on it as on no reply at all — it keeps the state it last had (before
+ * read as "web-admin declared nothing", so the engine acts on it as on no reply at all — it keeps the state it last had (before
  * any reading: no lease) and leaves its clocks, the lease expiry and the outage allowance, as they were. Start the lease client only
  * on `declared` with `capabilities.servingLease === true`. Never throws; judged by the same one guarded body judgement as every
  * other reader here.
@@ -669,8 +722,8 @@ export function readCapabilityReading(reply) {
 }
 /**
  * The drain endpoint's request: "put this instance into draining, by this deadline". One persisted action, one validation,
- * whether the center calls directly or an executor retries it. Two lanes, one shape: on the Docker lane (and for a direct
- * call from the center) this HTTP request is how an instance is drained; on the Kubernetes lane no per-pod HTTP call is made
+ * whether web-admin calls directly or an executor retries it. Two lanes, one shape: on the Docker lane (and for a direct
+ * call from web-admin) this HTTP request is how an instance is drained; on the Kubernetes lane no per-pod HTTP call is made
  * (per-pod addressing and RBAC make it the wrong tool) — an instance is drained by its serving lease being denied
  * ({@link ServingLeaseResponse}), after which the engine puts itself into draining.
  *  - `actionId` — idempotency key: the same id again echoes the first answer ({@link DrainReceipt}`.state` =
@@ -678,14 +731,14 @@ export function readCapabilityReading(reply) {
  *  - the identity — `scope?` / `worker` / `expectedGeneration?` / `instanceId?` — names WHICH instance the action is for. The
  *    engine compares it field by field against its own, absent against absent: an engine that is not a fleet member has no
  *    generation, so a request with no `expectedGeneration` is the standalone form, not a wildcard; `instanceId`, when given,
- *    is the engine's own per-process identity ({@link EngineSignal}`.instanceId`). A mismatch is the endpoint's refusal, not
+ *    is the engine's own per-process identity ({@link InstanceHealth}`.instanceId`). A mismatch is the endpoint's refusal, not
  *    this shape's: this schema only says what a well-formed request looks like.
  *  - `deadlineAt` — epoch ms by which the engine stops on its own.
- *  - `term` — the claim term the sending executor holds for this action (center-issued, opaque); absent where no executor
+ *  - `term` — the claim term the sending executor holds for this action (web-admin-issued, opaque); absent where no executor
  *    sits in between (a direct call, a hand-issued action).
  */
 export const DrainRequest = z.object({
-    actionId: z.string().min(1),
+    actionId: drainActionId(),
     scope: z.string().min(1).optional(),
     worker: z.string().min(1),
     expectedGeneration: Generation.optional(),
@@ -710,7 +763,7 @@ export function readDrainReceipt(body) {
 }
 // ── Domain 3: dispatch policy (traffic + failover + LB — three domains, one gateway) ──────────────────────
 export const DISPATCH_STRATEGIES = ["round-robin", "least-inflight", "consistent-hash"];
-/** Per-worker dispatch policy (center-configured; the gateway is OPTIONAL — D3: TOC/self-maintained TOB go
+/** Per-worker dispatch policy (web-admin-configured; the gateway is OPTIONAL — D3: TOC/self-maintained TOB go
  *  direct, sema-managed fleets route through /api/dispatch). Strategy is an enum on purpose: a new LB
  *  algorithm is a new value, not a new skeleton. */
 export const DispatchPolicy = z.object({
@@ -720,9 +773,9 @@ export const DispatchPolicy = z.object({
      *  instance dies, the run resumes elsewhere via resumeFromRunId (affinity avoids the gap; resume bounds it). */
     sessionAffinity: z.boolean().default(true),
     /** gateway-level concurrency gate (per worker) */
-    maxInflight: z.number().int().positive().optional(),
+    maxInflight: INTEGER.positive().optional(),
     /** per-actor fairness gate */
-    perActorMaxInflight: z.number().int().positive().optional(),
+    perActorMaxInflight: INTEGER.positive().optional(),
     /** cost clamp applied to submissions passing the gateway */
     maxCostUsd: z.number().finite().nonnegative().optional(),
 });
@@ -765,8 +818,8 @@ export function pickInstance(policy, candidates, opts = {}) {
     }
 }
 // ── Domain 4: quota lease (D4: AP by default — pre-authorized grant + reconciliation, CP is per-tier opt-in) ─
-/** A pre-authorized slice of a principal's global budget, granted by center to ONE worker: the worker deducts
- *  locally (no per-call round-trip), renews when running low, and center reconciles reported consumption
+/** A pre-authorized slice of a principal's global budget, granted by web-admin to ONE worker: the worker deducts
+ *  locally (no per-call round-trip), renews when running low, and web-admin reconciles reported consumption
  *  against the grant after the fact — the roaming/CDN pattern.
  *
  *  0.6.1 双轴 slice(EXPERT-REDESIGN §4-2/§4-6, service 回执"发布即接单"):slice = **{weightedTokens,
@@ -783,17 +836,17 @@ export const QuotaLease = z.object({
     /** granted dimensions — either or both; a dimension absent = not governed by this lease.
      *  `weightedTokens` = 加权 tokens(配额轴)。 */
     grant: z.object({
-        weightedTokens: z.number().int().nonnegative().optional(),
-        costMicroUsd: z.number().int().nonnegative().optional(),
+        weightedTokens: INTEGER.nonnegative().optional(),
+        costMicroUsd: INTEGER.nonnegative().optional(),
     }),
     consumed: z
         .object({
-        weightedTokens: z.number().int().nonnegative().default(0),
-        costMicroUsd: z.number().int().nonnegative().default(0),
+        weightedTokens: INTEGER.nonnegative().default(0),
+        costMicroUsd: INTEGER.nonnegative().default(0),
     })
-        .default({ weightedTokens: 0, costMicroUsd: 0 }),
-    issuedMs: z.number().int().nonnegative(),
-    expiresMs: z.number().int().nonnegative(),
+        .prefault({ weightedTokens: 0, costMicroUsd: 0 }),
+    issuedMs: INTEGER.nonnegative(),
+    expiresMs: INTEGER.nonnegative(),
 });
 /** Remaining per granted dimension; null = the dimension is not governed by this lease. Never negative. */
 export function leaseRemaining(l) {
@@ -822,7 +875,7 @@ export function shouldRenewLease(l, nowMs, opts = {}) {
     const life = l.expiresMs - l.issuedMs;
     return life > 0 && (nowMs - l.issuedMs) / life >= f;
 }
-/** Reconciliation (center side): consumption is MONOTONE — the reconciled row takes the max of what center
+/** Reconciliation (web-admin side): consumption is MONOTONE — the reconciled row takes the max of what web-admin
  *  believed and what the worker reported (a lost report can only under-count, never roll back).
  *  0.7.1:legacy `tokens` report alias removed with the QuotaLease shim(同一收账点,service 回执). */
 export function reconcileLease(l, reported) {
@@ -834,7 +887,7 @@ export function reconcileLease(l, reported) {
         },
     };
 }
-// ── Domain 5: usage report (worker → center — the metering feed the global view aggregates) ───────────────
+// ── Domain 5: usage report (worker → web-admin — the metering feed the global view aggregates) ───────────────
 /** One principal×model line in a report window(worker 的 fleet 批报腿累计)。0.12.1 语义澄清:早年注写
  *  「mirrors the worker's modelUsageTracker accumulation」——engine 3.0 计量语义统一后该说法失真:worker 的
  *  per-task modelUsage 面存**未命中输入分量**(与 cacheRead/Write 分列),而**本面 `inputTokens` 是归一化
@@ -843,29 +896,29 @@ export const UsageEntry = z.object({
     principal: z.string().min(1),
     model: z.string().min(1),
     /** 归一化总输入 token(含 cache 读/写),非未命中分量——见类型头注。 */
-    inputTokens: z.number().int().nonnegative(),
-    outputTokens: z.number().int().nonnegative(),
+    inputTokens: INTEGER.nonnegative(),
+    outputTokens: INTEGER.nonnegative(),
     /** 0.11.0 起 optional(RB-368 生态半场,跨仓记录在案):unpriced 部署(模型无价目)对 cost
-     *  只有「未知」这个业务态,required 逼 worker 编 0 = center 账面一个**精确的谎**。缺席=未知;
+     *  只有「未知」这个业务态,required 逼 worker 编 0 = web-admin 账面一个**精确的谎**。缺席=未知;
      *  聚合面以 {@link AggregatedPrincipalUsage.costUnknown} 补偿(已知和=显式下界)。写了键 = producer
      *  声称自己知道(0 就是真 0)。 */
-    costMicroUsd: z.number().int().nonnegative().optional(),
-    runs: z.number().int().nonnegative().optional(),
+    costMicroUsd: INTEGER.nonnegative().optional(),
+    runs: INTEGER.nonnegative().optional(),
     /** 加权 tokens(配额轴计账值,EXPERT-REDESIGN §4-1):=(input+output)×记账时的 quotaWeight,
      *  **weight-at-burn 持久化**——倍率 publish 只影响此后记账,不回算窗口内历史(余量/恢复时间不跳变)。
      *  0.6.0 additive optional:旧 worker 不报 → 聚合按 quotaWeight=1 兜底折算。 */
-    weightedTokens: z.number().int().nonnegative().optional(),
-    /** 记账时固化的该模型 quotaWeight(审计口径,与 weightedTokens 同时点)——lease 扣减与 registry 聚合两
+    weightedTokens: INTEGER.nonnegative().optional(),
+    /** 记账时固化的该模型 quotaWeight(审计口径,与 weightedTokens 同时点)——lease 扣减与 web-admin 聚合两
      *  路径按同一时点折算(同口径,§11-1)。 */
     quotaWeightAtUse: z.number().finite().nonnegative().optional(),
 });
-/** Periodic batch (worker → center POST). Windows are half-open [start, end) so adjacent batches never
+/** Periodic batch (worker → web-admin POST). Windows are half-open [start, end) so adjacent batches never
  *  double-count a boundary instant. */
 export const UsageReport = z.object({
     worker: z.string().min(1),
     instanceId: z.string().min(1),
-    windowStartMs: z.number().int().nonnegative(),
-    windowEndMs: z.number().int().nonnegative(),
+    windowStartMs: INTEGER.nonnegative(),
+    windowEndMs: INTEGER.nonnegative(),
     entries: z.array(UsageEntry),
 });
 /** 额度清零事件(EXPERT-REDESIGN §4-4,契约随 E1 冻结、E4 消费):申请刷新获批即写一条;5h/周双窗聚合
@@ -886,7 +939,7 @@ export const QuotaResetEvent = z.object({
 function entryWeightedTokens(e) {
     return e.weightedTokens ?? Math.round((e.inputTokens + e.outputTokens) * (e.quotaWeightAtUse ?? 1));
 }
-/** Center-side fold: per-principal totals ACROSS workers/instances (the "one user, many workers, one bill"
+/** Web-admin-side fold: per-principal totals ACROSS workers/instances (the "one user, many workers, one bill"
  *  view). Pure — storage/dedup of replayed batches is the caller's concern (key batches by
  *  worker+instanceId+windowStartMs). */
 export function aggregateUsage(reports) {