@sema-agent/settings-schema 10.1.1 → 11.1.0

package/dist/fleet.d.ts

@@ -1,5 +1,5 @@
 /**
- * @sema-agent/settings-schema/fleet — the PURE scheduling/fleet contract for the sema-center control plane
+ * @sema-agent/settings-schema/fleet — the PURE scheduling/fleet contract for the web-admin control plane
  * (design: the cc-parity control-plane scheduling design note, 产品拍板 2026-07-04 — "one contract, three orchestrators").
  *
  * Seven domains (rolling update / discovery / traffic / failover / LB / quota / token governance) are ONE
@@ -7,7 +7,7 @@
  * but all three read THESE shapes:
  *   - TOC shell (engineLifecycleManager): health readiness + upgrade classification + local blue-green demo
  *   - TOB (user k8s / fixed baseurl):     preStop→drain semantics + readiness probe = !draining
- *   - center (orchestrator reconciler):   instance discovery table + /api/dispatch gateway + rolling primitive
+ *   - web-admin (orchestrator reconciler):   instance discovery table + /api/dispatch gateway + rolling primitive
  *
  * 🔴 Contract discipline (same rules as scheduler-store):
  *   - ABSTRACT: types + zod wire shapes + PURE decision functions. ZERO IO, ZERO node:* — browser-safe barrel.
@@ -19,16 +19,16 @@
  */
 import { z } from "zod";
 /**
- * The center's `/api/fleet/*` endpoints that are addressed from outside the center, relative to its origin. ONE spelling: whoever
- * calls one (the engine, the executor) and whoever serves or routes it (the center, the deployment's Service / Ingress) imports it
+ * Web-admin's `/api/fleet/*` endpoints that are addressed from outside web-admin, relative to its origin. ONE spelling: whoever
+ * calls one (the engine, the executor) and whoever serves or routes it (web-admin, the deployment's Service / Ingress) imports it
  * here — nobody writes the string. Membership rule: an endpoint is here iff this package types its body, or it belongs to the
- * liveness group ({@link FLEET_LIVE_PATHS}); a center-internal route is not.
- *  - `instances` — `POST` = the heartbeat ({@link InstanceAnnouncement}; its 2xx reply carries the center's
- *    {@link CenterCapabilities} under {@link HEARTBEAT_REPLY_CAPABILITIES_KEY}), `DELETE` = the goodbye ({@link InstanceDeregistration}).
+ * liveness group ({@link FLEET_LIVE_PATHS}); a web-admin-internal route is not.
+ *  - `instances` — `POST` = the heartbeat ({@link InstanceAnnouncement}; its 2xx reply carries web-admin's
+ *    {@link WebAdminCapabilities} under {@link HEARTBEAT_REPLY_CAPABILITIES_KEY}), `DELETE` = the goodbye ({@link InstanceDeregistration}).
  *  - `usage` — `POST` a {@link UsageReport}.
  *  - `quotaLeases` — the quota lease ({@link QuotaLease}).
  *  - `servingLease` — `POST` a {@link ServingLeaseRequest}, answered with a {@link ServingLeaseResponse}.
- *  - `hostPlanner` — `GET` one host's planner record, for the executor (its body is the center's and the executor's contract, not
+ *  - `hostPlanner` — `GET` one host's planner record, for the executor (its body is web-admin's and the executor's contract, not
  *    this package's; it is here because the deployment routes it as a member of the liveness group).
  * Notation: a value is a path TEMPLATE — a parameter is a whole segment written `{name}` (`hostPlanner` ends in `/{host}`, filled
  * with the URL-encoded host id); the other values have none and are the path itself. A prefix router (an Ingress rule) takes the
@@ -42,8 +42,8 @@ export declare const FLEET_PATHS: {
     readonly hostPlanner: "/api/fleet/live/host-planner/{host}";
 };
 /**
- * The LIVENESS group — the fleet endpoints a center answers without its readiness gate and without its config-governance gates
- * (they read no config domain and take service credentials only), so that a center whose management face is refused never turns
+ * The LIVENESS group — the fleet endpoints a web-admin answers without its readiness gate and without its config-governance gates
+ * (they read no config domain and take service credentials only), so that a web-admin whose management face is refused never turns
  * into a fleet that gets no answers. A deployment routes exactly these past the readiness gate (on Kubernetes: a second Service
  * with `publishNotReadyAddresses`, and the Ingress rules for them point at it). Membership is THIS list, not a path prefix — the
  * heartbeat predates the `/api/fleet/live/` prefix; every {@link FLEET_PATHS} entry under that prefix is a member. The
@@ -60,7 +60,7 @@ export declare const DRAIN_PHASES: readonly ["running", "draining", "drained"];
 export type DrainPhase = (typeof DRAIN_PHASES)[number];
 /** Shipped default (server 1.96.0): generous by design — the only unrecoverable loss on restart is the
  *  interactive turn currently streaming, so we wait long rather than cut short. Deployments override via
- *  DRAIN_GRACE_MS; center overrides per-worker through the worker spec. */
+ *  DRAIN_GRACE_MS; web-admin overrides per-worker through the worker spec. */
 export declare const DEFAULT_DRAIN_GRACE_MS = 600000;
 /** Hard floor — a grace below this is treated as this (protects against a fat-fingered 0). */
 export declare const DRAIN_GRACE_FLOOR_MS = 10000;
@@ -81,6 +81,10 @@ export type DrainVerdict = "wait" | "exit_clean" | "exit_forced";
 /** The drain state machine's single decision point: keep waiting, exit clean (drained), or force the exit
  *  (grace exhausted with legs still in flight — durable legs resume cross-instance via resumeFromRunId). */
 export declare function drainVerdict(s: DrainSnapshot): DrainVerdict;
+/** Drain action id grammar — one identifier shape for the drain request's `actionId` and the `EngineDraining.actionId` it echoes
+ *  (the engine republishes it on the unauthenticated `/health` face, so it must never carry free text): 1–128 chars, first
+ *  alphanumeric, then alphanumerics / `.` / `_` / `:` / `-`. Readers and writers share this one constant. */
+export declare const DRAIN_ACTION_ID: RegExp;
 export declare function isCanonicalGeneration(value: unknown): value is string;
 /** Numeric order of two canonical generations: `-1` when `a` is older than `b`, `0` when equal, `1` when newer — `"9"` is
  *  older than `"10"`; any number of digits. Throws a `TypeError` on an input that is not canonical (a comparison that quietly
@@ -90,27 +94,32 @@ export declare function compareGeneration(a: string, b: string): -1 | 0 | 1;
 /**
  * The serving lease as the ENGINE holds it — a CLOSED set of four words, owned here (the engine's vocabulary, word for word;
  * a reader that switches on it exhaustively is told by the compiler when a word is added):
- *  - `none` — the lease is not in effect: the center has declared no {@link CenterCapabilities}`.servingLease` ({@link readCapabilityReading}
- *    says `undeclared` — an older center — or `declared` without the bit). The engine behaves exactly as an engine without a lease —
+ *  - `none` — the lease is not in effect: web-admin has declared no {@link WebAdminCapabilities}`.servingLease` ({@link readCapabilityReading}
+ *    says `undeclared` — an older web-admin — or `declared` without the bit). The engine behaves exactly as an engine without a lease —
  *    no renewals, no fence. A reply that cannot be read (`unreadable`) is not a reading: it does not move the engine into or out of
  *    `none` — it keeps the state it had.
  *  - `granted` — the engine holds a lease; `leaseUntil` says until when (epoch ms, the engine's own computation from the
  *    granted `ttlMs`, see {@link ServingLeaseResponse}).
- *  - `expired` — the lease is in effect but no grant is valid right now (the center is unreachable, answered `unknown`, or has
+ *  - `expired` — the lease is in effect but no grant is valid right now (web-admin is unreachable, answered `unknown`, or has
  *    not granted one yet): the engine keeps serving until its own outage allowance runs out. Not a denial.
- *  - `denied` — the center denied this instance on positive evidence (the `denied` verdict): sticky; the engine is draining and
+ *  - `denied` — web-admin denied this instance on positive evidence (the `denied` verdict): sticky; the engine is draining and
  *    stops at its deadline.
  * Only a fleet member says it: an engine without a generation has no lease and carries no `leaseState` at all (there is no
  * fifth word for "not a member" — absence is that).
  */
 export declare const LEASE_STATES: readonly ["none", "granted", "expired", "denied"];
-export declare const LeaseState: z.ZodEnum<["none", "granted", "expired", "denied"]>;
+export declare const LeaseState: z.ZodEnum<{
+    none: "none";
+    granted: "granted";
+    expired: "expired";
+    denied: "denied";
+}>;
 export type LeaseState = z.infer<typeof LeaseState>;
 /**
- * "This instance must restart to apply config" — the engine's OWN observation (S-741), defined ONCE for both exits that
- * carry it: the fleet heartbeat ({@link InstanceAnnouncement}`.restart`, typed) and GET /health (`restart`, read through
- * {@link readRestartSignal} — {@link InstanceHealth} keeps carrying it untyped, see there). One mint point, two exits —
- * never a second judgement.
+ * "This instance must restart to apply config" — the engine's OWN observation (S-741), defined ONCE. It is part of the engine's
+ * state, so it rides inside {@link EngineSignal} (`restart`) on both exits — the fleet heartbeat and GET /health — and is read
+ * there and only there: `readEngineSignal(body)?.restart`, or `engineSignal?.restart` on a parsed heartbeat / health body. The
+ * flat `restart` key the two bodies still carry is the pre-11 dialect (see {@link EngineSignal}); nothing reads it.
  *
  * Shape = what the server already ships on /health (`restart: { reasons, version, since }`, plus the optional `withheld`
  * qualifier below). PRESENCE is the signal:
@@ -118,7 +127,7 @@ export type LeaseState = z.infer<typeof LeaseState>;
  * to presence is redundant, and two spellings of one fact drift).
  *  - `reasons` — which restart-to-apply slices differ from the value baked at boot (the vocabulary is the engine's;
  *    the contract only guarantees non-empty words, at least one).
- *  - `version` — the config-center version that currently differs from boot (the LATEST seen — it moves forward with
+ *  - `version` — the web-admin config version that currently differs from boot (the LATEST seen — it moves forward with
  *    later publishes, so a "one restart per version" dedupe bounds restarts per config version, not per reason set).
  *    Judged exactly as `readEffectiveWire` judges a config version (a finite number, `ConfigVersion`) — one quantity, one rule;
  *    {@link EngineSignal}'s two version-ledger keys use the same one.
@@ -129,31 +138,15 @@ export type LeaseState = z.infer<typeof LeaseState>;
  *    it. It is a qualifier INSIDE the restart signal, never a signal of its own: it exists only where `restart` does.
  */
 export declare const RestartSignal: z.ZodObject<{
-    reasons: z.ZodArray<z.ZodString, "many">;
+    reasons: z.ZodArray<z.ZodString>;
     version: z.ZodNumber;
     since: z.ZodNumber;
     withheld: z.ZodOptional<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    reasons: string[];
-    version: number;
-    since: number;
-    withheld?: boolean | undefined;
-}, {
-    reasons: string[];
-    version: number;
-    since: number;
-    withheld?: boolean | undefined;
-}>;
+}, z.core.$strip>;
 export type RestartSignal = z.infer<typeof RestartSignal>;
-/**
- * The /health exit of {@link RestartSignal}: `health.restart` judged against the one shape. Shape mismatch, a missing
- * key, a non-object body, even a throwing accessor ⇒ `undefined` — never throws (a probe must not die on one odd body).
- * Presence law: only `restart` counts; the top-level `restartRequired` boolean the server also ships is not read.
- */
-export declare function readRestartSignal(health: unknown): RestartSignal | undefined;
 /**
  * The model-refusal cause codes (S-768) — CLOSED sets, owned HERE, never a hand-copied second list. Adding a code is
- * one edit in this file; who goes red at compile time: a reader that switches on the code exhaustively (a center), and
+ * one edit in this file; who goes red at compile time: a reader that switches on the code exhaustively (a web-admin), and
  * a producer only where it holds a table KEYED BY the code (an exhaustive `switch` over the code, or a
  * `Record<ModelEntryRefusalCode, …>`) — a producer table that merely `satisfies` these codes as values proves a subset,
  * not equality, and stays green.
@@ -175,10 +168,18 @@ export declare function readRestartSignal(health: unknown): RestartSignal | unde
  *    (invariant `model-route-endpoint`, judged by the model-plane stage in `src/config-center/apply-effective.ts:664-665`).
  */
 export declare const MODEL_ENTRY_REFUSAL_CODES: readonly ["config.model_no_brain", "config.model_entry_invalid"];
-export declare const ModelEntryRefusalCode: z.ZodEnum<["config.model_no_brain", "config.model_entry_invalid"]>;
+export declare const ModelEntryRefusalCode: z.ZodEnum<{
+    "config.model_no_brain": "config.model_no_brain";
+    "config.model_entry_invalid": "config.model_entry_invalid";
+}>;
 export type ModelEntryRefusalCode = z.infer<typeof ModelEntryRefusalCode>;
 export declare const MODEL_PLANE_REFUSAL_CODES: readonly ["config.default_model_missing", "config.model_refused_name_minted", "config.model_route_endpoint_missing", "config.gateway_fallback_without_primary"];
-export declare const ModelPlaneRefusalCode: z.ZodEnum<["config.default_model_missing", "config.model_refused_name_minted", "config.model_route_endpoint_missing", "config.gateway_fallback_without_primary"]>;
+export declare const ModelPlaneRefusalCode: z.ZodEnum<{
+    "config.default_model_missing": "config.default_model_missing";
+    "config.model_refused_name_minted": "config.model_refused_name_minted";
+    "config.model_route_endpoint_missing": "config.model_route_endpoint_missing";
+    "config.gateway_fallback_without_primary": "config.gateway_fallback_without_primary";
+}>;
 export type ModelPlaneRefusalCode = z.infer<typeof ModelPlaneRefusalCode>;
 /**
  * "This instance does not serve part (or all) of the model catalog it was handed" — the engine's OWN per-host verdict
@@ -221,22 +222,10 @@ export type ModelPlaneRefusalCode = z.infer<typeof ModelPlaneRefusalCode>;
  * law — "none" has exactly one spelling, the absent key. Inside, "no entry refusals" is spelled `entries: {}` (the key is
  * required) — one spelling at each level.
  */
-export declare const ModelRefusalsWire: z.ZodEffects<z.ZodObject<{
+export declare const ModelRefusalsWire: z.ZodObject<{
     entries: z.ZodRecord<z.ZodString, z.ZodString>;
     plane: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    entries: Record<string, string>;
-    plane?: string | undefined;
-}, {
-    entries: Record<string, string>;
-    plane?: string | undefined;
-}>, {
-    entries: Record<string, string>;
-    plane?: string | undefined;
-}, {
-    entries: Record<string, string>;
-    plane?: string | undefined;
-}>;
+}, z.core.$strip>;
 export type ModelRefusalsWire = z.infer<typeof ModelRefusalsWire>;
 /** {@link ModelRefusalsWire} narrowed to the closed code sets — the return type of {@link readModelRefusals}. */
 export type ModelRefusalsSignal = {
@@ -252,466 +241,297 @@ export type ModelRefusalsSignal = {
  * at all — it answers the key only and never judges the engine's version (see {@link InstanceAnnouncement}`.modelRefusals`).
  */
 export declare function readModelRefusals(body: unknown): ModelRefusalsSignal | undefined;
-/** The `/health` self-description every orchestrator reads (shipped shape, server 1.96.0). Liveness and
- *  readiness are deliberately SPLIT: `status` stays ok while draining (the process is alive); routability is
- *  `isReadyForTraffic`. Unknown fields pass through — health is a self-description, not a closed record. */
+/**
+ * The engine's draining fact — ONE object wherever the engine says "I am draining": inside {@link EngineSignal}`.draining`
+ * and as the body of a {@link DrainReceipt}.
+ *  - `actionId` — the action that put the engine into draining (idempotency key of the drain request).
+ *  - `since` — epoch ms when draining began; it does not move when the same action repeats.
+ *  - `deadlineAt` — epoch ms by which the engine stops on its own.
+ */
+export declare const EngineDraining: z.ZodObject<{
+    actionId: z.ZodString;
+    since: z.ZodNumber;
+    deadlineAt: z.ZodNumber;
+}, z.core.$strip>;
+export type EngineDraining = z.infer<typeof EngineDraining>;
+/**
+ * Everything the ENGINE itself mints about its own state, as one object. One mint point on the engine; it rides BOTH exits —
+ * the `/health` self-description ({@link InstanceHealth}) and the fleet heartbeat ({@link InstanceAnnouncement}) — WHOLE, under
+ * the one key {@link ENGINE_SIGNAL_KEY}. Readers read it there and only there: {@link readEngineSignal} for a body,
+ * `engineSignal` on a parsed heartbeat / health body; the readiness / routing judges ({@link judgeReadiness},
+ * {@link judgeRoutability}) read nothing else.
+ *
+ * One fact, one place on a body: the engine's STATE is this object; the row's IDENTITY (`instanceId`, `worker`, `address`,
+ * `version`, `heartbeatMs`) is the body's top level and is not repeated here. The flat keys of this object's names that the two
+ * bodies still carry (`ready`, `draining` as a boolean + `drainingSince`, `restart`, `generation`, `leaseState`, `leaseUntil`)
+ * are the pre-11 flat dialect: sent during its contraction window for readers that predate this key, unchanged in shape, read by
+ * nothing in this package; their removal is registered (`ONE_TIME_MIGRATIONS` row `SS-W1`).
+ *
+ * Nested under one key, not flat on the body: the boolean dialect (`draining: boolean` + `drainingSince`, {@link InstanceHealth} /
+ * {@link InstanceAnnouncement}) is still sent during its contraction window while `draining` here is an OBJECT — one key cannot hold
+ * both, and a flat object `draining` would make every reader still on the boolean refuse a draining engine's heartbeat. Nested, an
+ * older reader never sees it (the heartbeat shape strips unknown keys; `/health` is an open record) and a newer one reads only it.
+ *
+ *  - `ready` — always said (never "absent while ready"): the engine can take new work right now.
+ *  - `draining` — present ⇔ draining ({@link EngineDraining}).
+ *  - `restart` — the one {@link RestartSignal}, same schema object, no copy.
+ *  - `generation` — echo of the env the config renderer set on this instance ({@link FLEET_GENERATION_ENV}), a canonical
+ *    decimal string ({@link isCanonicalGeneration}). Absent ⇔ not a fleet member (a single-machine engine): it takes no lease
+ *    and is not fenced.
+ *  - `leaseState` — the serving lease as the engine holds it ({@link LeaseState}: `none` / `granted` / `expired` / `denied`);
+ *    present ⇔ fleet member (the engine says it on every beat once it has a generation).
+ *  - `leaseUntil` — epoch ms until which the engine holds its serving lease, as the engine computed it from the last
+ *    `ttlMs` it was granted ({@link ServingLeaseResponse}); present ⇔ `leaseState` is `granted`.
+ *  - `configTargetVersion` / `configAppliedVersion` — the web-admin config version the engine was told to converge on, and the
+ *    one it has applied: numbers, as the engine mints them (finite, the same rule as {@link RestartSignal}`.version`; equal ⇔ converged).
+ *
+ * Reading: the default strip — only these keys come out. A shape violation in ANY key makes the whole signal `undefined` (it is
+ * never "the rest of it"). `undefined` means "no signal this reader can say" — an engine that does not carry the key, or a
+ * malformed one — and is NEVER "ready": the judges answer `no-engine-signal`.
+ */
+export declare const EngineSignal: z.ZodObject<{
+    ready: z.ZodBoolean;
+    draining: z.ZodOptional<z.ZodObject<{
+        actionId: z.ZodString;
+        since: z.ZodNumber;
+        deadlineAt: z.ZodNumber;
+    }, z.core.$strip>>;
+    restart: z.ZodOptional<z.ZodObject<{
+        reasons: z.ZodArray<z.ZodString>;
+        version: z.ZodNumber;
+        since: z.ZodNumber;
+        withheld: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    generation: z.ZodOptional<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>;
+    leaseState: z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        granted: "granted";
+        expired: "expired";
+        denied: "denied";
+    }>>;
+    leaseUntil: z.ZodOptional<z.ZodNumber>;
+    configTargetVersion: z.ZodOptional<z.ZodNumber>;
+    configAppliedVersion: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type EngineSignal = z.infer<typeof EngineSignal>;
+/** The one key {@link EngineSignal} rides under, on the `/health` body and on the heartbeat body alike. Both sides import THIS
+ *  constant; neither spells the key. */
+export declare const ENGINE_SIGNAL_KEY = "engineSignal";
+/**
+ * The reader of {@link EngineSignal} on a body — and so of every part of it (`readEngineSignal(body)?.restart` is THE restart
+ * reading): the value under {@link ENGINE_SIGNAL_KEY}, judged by the same guarded body reader as {@link readModelRefusals}, so the
+ * same odd input gets the same answer from both. A missing key, shape mismatch (a missing `ready` included), a non-object body,
+ * even a throwing accessor ⇒ `undefined` — never throws. Keys of the signal's names lying flat on the body are NOT read (the flat
+ * dialect; the carrier is the one key).
+ */
+export declare function readEngineSignal(body: unknown): EngineSignal | undefined;
+/** The `/health` self-description every orchestrator reads. Liveness and readiness are deliberately SPLIT: `status` stays ok while
+ *  draining (the process is alive); readiness is {@link judgeReadiness} over the engine signal the body carries under
+ *  {@link ENGINE_SIGNAL_KEY}. Unknown fields pass through — health is a self-description, not a closed record: `modelRefusals`
+ *  rides it untyped and is read with {@link readModelRefusals}; the flat dialect keys other than the boolean pair (`ready`,
+ *  `restart`, `generation`, `leaseState`, `leaseUntil`) ride it untyped too and are read by nothing. */
 export declare const InstanceHealth: z.ZodObject<{
     instanceId: z.ZodString;
-    /** build self-description — "did the restart actually land new code" (upgrade classification) */
-    version: z.ZodString;
-    /** absent = not draining */
-    draining: z.ZodOptional<z.ZodBoolean>;
-    /** epoch ms, present iff draining */
-    drainingSince: z.ZodOptional<z.ZodNumber>;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    instanceId: z.ZodString;
-    /** build self-description — "did the restart actually land new code" (upgrade classification) */
-    version: z.ZodString;
-    /** absent = not draining */
-    draining: z.ZodOptional<z.ZodBoolean>;
-    /** epoch ms, present iff draining */
-    drainingSince: z.ZodOptional<z.ZodNumber>;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    instanceId: z.ZodString;
-    /** build self-description — "did the restart actually land new code" (upgrade classification) */
     version: z.ZodString;
-    /** absent = not draining */
     draining: z.ZodOptional<z.ZodBoolean>;
-    /** epoch ms, present iff draining */
     drainingSince: z.ZodOptional<z.ZodNumber>;
-}, z.ZodTypeAny, "passthrough">>;
+    engineSignal: z.ZodCatch<z.ZodOptional<z.ZodObject<{
+        ready: z.ZodBoolean;
+        draining: z.ZodOptional<z.ZodObject<{
+            actionId: z.ZodString;
+            since: z.ZodNumber;
+            deadlineAt: z.ZodNumber;
+        }, z.core.$strip>>;
+        restart: z.ZodOptional<z.ZodObject<{
+            reasons: z.ZodArray<z.ZodString>;
+            version: z.ZodNumber;
+            since: z.ZodNumber;
+            withheld: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        generation: z.ZodOptional<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>;
+        leaseState: z.ZodOptional<z.ZodEnum<{
+            none: "none";
+            granted: "granted";
+            expired: "expired";
+            denied: "denied";
+        }>>;
+        leaseUntil: z.ZodOptional<z.ZodNumber>;
+        configTargetVersion: z.ZodOptional<z.ZodNumber>;
+        configAppliedVersion: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>>;
+}, z.core.$loose>;
 export type InstanceHealth = z.infer<typeof InstanceHealth>;
-/** Readiness = the routability predicate (k8s readiness probe, gateway health filter, shell seam switch).
- *  Its input is the boolean-`draining` dialect of {@link InstanceHealth}. An {@link EngineSignal} types `draining` as an
- *  object, so it does not typecheck here (on purpose: `!== true` would read an object-valued `draining` as "ready").
- *  The next major retires the boolean pair (`draining` / `drainingSince`) and gives both this predicate and
- *  {@link isRoutable} `EngineSignal` as their input. */
-export declare function isReadyForTraffic(h: Pick<InstanceHealth, "draining">): boolean;
-/** Heartbeat cadence the announcement declares (center judges staleness against the DECLARED cadence, so a
+/** Why an instance is not routable — a CLOSED set, in the order the judges check:
+ *  - `no-engine-signal` — no {@link EngineSignal} to read (an engine that does not carry it, or a malformed one). Never "ready".
+ *  - `stale` — silent past its declared heartbeat cadence × {@link STALE_HEARTBEAT_MULTIPLIER} (stored rows only).
+ *  - `observer-not-ready` — the reconciler's own observation vetoes it (stored rows only; the SECOND source, AND-merged).
+ *  - `draining` — the engine says it is draining.
+ *  - `not-ready` — the engine says it is not ready. */
+export declare const NOT_ROUTABLE_CODES: readonly ["no-engine-signal", "stale", "observer-not-ready", "draining", "not-ready"];
+export type NotRoutableCode = (typeof NOT_ROUTABLE_CODES)[number];
+/** A judge's verdict: routable, or not with a closed-set code and one sentence for logs / operator surfaces. */
+export type RoutingVerdict = {
+    routable: true;
+} | {
+    routable: false;
+    code: NotRoutableCode;
+    why: string;
+};
+/** Readiness — the ONE judge of "may new work go to this engine", from the engine's own signal only (k8s readiness probe,
+ *  gateway health filter, shell seam switch): ready ⇔ a signal is present, says `ready`, and is not draining. Pass
+ *  {@link readEngineSignal}`(healthBody)`; `undefined` (no signal) is `no-engine-signal`, never ready. */
+export declare function judgeReadiness(signal: EngineSignal | undefined): RoutingVerdict;
+/** {@link judgeReadiness} as a boolean (the same judge, no second reading). */
+export declare function isReadyForTraffic(signal: EngineSignal | undefined): boolean;
+/** Heartbeat cadence the announcement declares (web-admin judges staleness against the DECLARED cadence, so a
  *  slow-heartbeat worker is not falsely reaped). */
 export declare const DEFAULT_HEARTBEAT_MS = 30000;
 /** An instance is stale once silent for this many missed heartbeats (aligned with the reconciler's own
  *  stale window: 2× cadence, not a fixed wall-clock). */
 export declare const STALE_HEARTBEAT_MULTIPLIER = 2;
-/** Register/heartbeat upsert (worker → center, D2: worker-active). ONE shape for both — registration is the
+/** Register/heartbeat upsert (worker → web-admin, D2: worker-active). ONE shape for both — registration is the
  *  first heartbeat; every heartbeat re-announces the full row (idempotent upsert, no drift between a
- *  "register" and a "renew" schema). `draining:true` is the instance SELF-removing from the routable set the
- *  moment the stop signal lands — faster than any observer.
+ *  "register" and a "renew" schema). The engine's {@link EngineSignal} rides it whole under {@link ENGINE_SIGNAL_KEY}: a signal
+ *  saying "draining" is the instance SELF-removing from the routable set the moment the stop signal lands — faster than any
+ *  observer.
  *  Scope: the body carries NO `scope` — this shape has no such key, and one sent anyway is stripped. The row lands in the scope
  *  the CREDENTIAL names: under a per-worker token, the scope the token binds (a `?scope=` query parameter, when given, must equal
  *  it); under the shared token, the `?scope=` query parameter, absent ⇒ `"global"`. */
 export declare const InstanceAnnouncement: z.ZodObject<{
     instanceId: z.ZodString;
-    /** worker (deployment) this instance belongs to — the dispatch key */
     worker: z.ZodString;
-    /** reachable base URL for the deployment form: k8s pod IP:port / docker net alias / 127.0.0.1:<engine.port> */
     address: z.ZodString;
     version: z.ZodString;
-    /** self-declared readiness: model roster landed AND not draining (server ≥7.102.0; older engines: !draining only) */
     ready: z.ZodBoolean;
     draining: z.ZodDefault<z.ZodBoolean>;
     heartbeatMs: z.ZodDefault<z.ZodNumber>;
-    /** S-741: present ⇔ this instance must restart to apply config — the SAME {@link RestartSignal} /health carries,
-     *  minted by the same getter (self-reported: a worker-scoped credential can only report for its own worker).
-     *  Every heartbeat re-announces the full row, so a later heartbeat WITHOUT it means "no longer required" — the
-     *  stored row ({@link InstanceRegistration}) is replaced, never merged. */
     restart: z.ZodOptional<z.ZodObject<{
-        reasons: z.ZodArray<z.ZodString, "many">;
+        reasons: z.ZodArray<z.ZodString>;
         version: z.ZodNumber;
         since: z.ZodNumber;
         withheld: z.ZodOptional<z.ZodBoolean>;
-    }, "strip", z.ZodTypeAny, {
-        reasons: string[];
-        version: number;
-        since: number;
-        withheld?: boolean | undefined;
-    }, {
-        reasons: string[];
-        version: number;
-        since: number;
-        withheld?: boolean | undefined;
-    }>>;
-    /** S-768: present ⇔ this instance has at least one reportable model refusal — the SAME {@link ModelRefusalsWire} /health
-     *  carries, minted by the same getter; read it with {@link readModelRefusals}`(announcement)` (never off this field
-     *  directly: the field is the open wire form, the reader narrows to the closed sets). Every heartbeat re-announces the
-     *  full row, so a later heartbeat WITHOUT it means "no reportable refusals any more" (the stored row is replaced, never
-     *  merged). Reading absence: from an engine that reports this key, absent = none reportable; an engine that predates
-     *  the key never sends it, so there absence is UNKNOWN, not "none" — tell the two apart by the announced `version`.
-     *  Failure direction = meaning direction (this is a diagnostic key): a code this package version does not know passes
-     *  (it is "not said" to the reader), and a value that breaks the {@link ModelRefusalsWire} shape law is dropped to
-     *  ABSENT (`.catch`) — it never fails the announcement, so it can never make a healthy instance unroutable (unlike
-     *  `restart`, whose shape still gates the row). The key may then be present with the value `undefined`. */
-    modelRefusals: z.ZodCatch<z.ZodOptional<z.ZodEffects<z.ZodObject<{
+    }, z.core.$strip>>;
+    modelRefusals: z.ZodCatch<z.ZodOptional<z.ZodObject<{
         entries: z.ZodRecord<z.ZodString, z.ZodString>;
         plane: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        entries: Record<string, string>;
-        plane?: string | undefined;
-    }, {
-        entries: Record<string, string>;
-        plane?: string | undefined;
-    }>, {
-        entries: Record<string, string>;
-        plane?: string | undefined;
-    }, {
-        entries: Record<string, string>;
-        plane?: string | undefined;
+    }, z.core.$strip>>>;
+    generation: z.ZodCatch<z.ZodOptional<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>>;
+    leaseState: z.ZodCatch<z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        granted: "granted";
+        expired: "expired";
+        denied: "denied";
     }>>>;
-    /** Fleet membership and the lease reading, flat on the heartbeat body under the names and values {@link EngineSignal} gives
-     *  them (one mint point on the engine; this shape reuses that shape's schemas, not copies):
-     *  - `generation` — the canonical decimal generation ({@link isCanonicalGeneration}); present ⇔ the instance is a fleet member.
-     *  - `leaseState` — {@link LeaseState}; present ⇔ fleet member.
-     *  - `leaseUntil` — epoch ms until which the held lease runs; present ⇔ `leaseState` is `granted`.
-     *  The presence law between the three is the engine's; this shape does not judge it across keys. Every heartbeat re-announces
-     *  the full row, so a later heartbeat without a key means the engine no longer says it (the stored row is replaced, never merged).
-     *  Failure direction = meaning direction: these are evidence a center keeps, never routing input — a value that breaks its schema
-     *  drops that ONE key to ABSENT (`.catch`) and the heartbeat is still accepted, so a lease word a newer engine adds can never make
-     *  an older center refuse every heartbeat of that engine. A dropped key reads exactly like an unsaid one; the key may then be
-     *  present with the value `undefined`. */
-    generation: z.ZodCatch<z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>>;
-    leaseState: z.ZodCatch<z.ZodOptional<z.ZodEnum<["none", "granted", "expired", "denied"]>>>;
     leaseUntil: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
-}, "strip", z.ZodTypeAny, {
-    draining: boolean;
-    version: string;
-    instanceId: string;
-    worker: string;
-    address: string;
-    ready: boolean;
-    heartbeatMs: number;
-    restart?: {
-        reasons: string[];
-        version: number;
-        since: number;
-        withheld?: boolean | undefined;
-    } | undefined;
-    modelRefusals?: {
-        entries: Record<string, string>;
-        plane?: string | undefined;
-    } | undefined;
-    generation?: string | undefined;
-    leaseState?: "none" | "granted" | "expired" | "denied" | undefined;
-    leaseUntil?: number | undefined;
-}, {
-    version: string;
-    instanceId: string;
-    worker: string;
-    address: string;
-    ready: boolean;
-    draining?: boolean | undefined;
-    restart?: {
-        reasons: string[];
-        version: number;
-        since: number;
-        withheld?: boolean | undefined;
-    } | undefined;
-    modelRefusals?: unknown;
-    heartbeatMs?: number | undefined;
-    generation?: unknown;
-    leaseState?: unknown;
-    leaseUntil?: unknown;
-}>;
+    engineSignal: z.ZodCatch<z.ZodOptional<z.ZodObject<{
+        ready: z.ZodBoolean;
+        draining: z.ZodOptional<z.ZodObject<{
+            actionId: z.ZodString;
+            since: z.ZodNumber;
+            deadlineAt: z.ZodNumber;
+        }, z.core.$strip>>;
+        restart: z.ZodOptional<z.ZodObject<{
+            reasons: z.ZodArray<z.ZodString>;
+            version: z.ZodNumber;
+            since: z.ZodNumber;
+            withheld: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        generation: z.ZodOptional<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>;
+        leaseState: z.ZodOptional<z.ZodEnum<{
+            none: "none";
+            granted: "granted";
+            expired: "expired";
+            denied: "denied";
+        }>>;
+        leaseUntil: z.ZodOptional<z.ZodNumber>;
+        configTargetVersion: z.ZodOptional<z.ZodNumber>;
+        configAppliedVersion: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
 export type InstanceAnnouncement = z.infer<typeof InstanceAnnouncement>;
 /** Explicit goodbye (stop signal handler) — removes the row immediately instead of waiting out staleness. */
 export declare const InstanceDeregistration: z.ZodObject<{
     instanceId: z.ZodString;
     worker: z.ZodString;
-    reason: z.ZodOptional<z.ZodEnum<["draining", "shutdown", "superseded"]>>;
-}, "strip", z.ZodTypeAny, {
-    instanceId: string;
-    worker: string;
-    reason?: "draining" | "shutdown" | "superseded" | undefined;
-}, {
-    instanceId: string;
-    worker: string;
-    reason?: "draining" | "shutdown" | "superseded" | undefined;
-}>;
+    reason: z.ZodOptional<z.ZodEnum<{
+        draining: "draining";
+        shutdown: "shutdown";
+        superseded: "superseded";
+    }>>;
+}, z.core.$strip>;
 export type InstanceDeregistration = z.infer<typeof InstanceDeregistration>;
-/** The stored discovery-table row = last announcement + center-side bookkeeping. `observedReady` is the
+/** The stored discovery-table row = last announcement + web-admin-side bookkeeping. `observedReady` is the
  *  reconciler's observation (phase Running) — the SECOND source; absent where no reconciler exists (TOC/TOB). */
 export declare const InstanceRegistration: z.ZodObject<{
     instanceId: z.ZodString;
-    /** worker (deployment) this instance belongs to — the dispatch key */
     worker: z.ZodString;
-    /** reachable base URL for the deployment form: k8s pod IP:port / docker net alias / 127.0.0.1:<engine.port> */
     address: z.ZodString;
     version: z.ZodString;
-    /** self-declared readiness: model roster landed AND not draining (server ≥7.102.0; older engines: !draining only) */
     ready: z.ZodBoolean;
     draining: z.ZodDefault<z.ZodBoolean>;
     heartbeatMs: z.ZodDefault<z.ZodNumber>;
-    /** S-741: present ⇔ this instance must restart to apply config — the SAME {@link RestartSignal} /health carries,
-     *  minted by the same getter (self-reported: a worker-scoped credential can only report for its own worker).
-     *  Every heartbeat re-announces the full row, so a later heartbeat WITHOUT it means "no longer required" — the
-     *  stored row ({@link InstanceRegistration}) is replaced, never merged. */
     restart: z.ZodOptional<z.ZodObject<{
-        reasons: z.ZodArray<z.ZodString, "many">;
+        reasons: z.ZodArray<z.ZodString>;
         version: z.ZodNumber;
         since: z.ZodNumber;
         withheld: z.ZodOptional<z.ZodBoolean>;
-    }, "strip", z.ZodTypeAny, {
-        reasons: string[];
-        version: number;
-        since: number;
-        withheld?: boolean | undefined;
-    }, {
-        reasons: string[];
-        version: number;
-        since: number;
-        withheld?: boolean | undefined;
-    }>>;
-    /** S-768: present ⇔ this instance has at least one reportable model refusal — the SAME {@link ModelRefusalsWire} /health
-     *  carries, minted by the same getter; read it with {@link readModelRefusals}`(announcement)` (never off this field
-     *  directly: the field is the open wire form, the reader narrows to the closed sets). Every heartbeat re-announces the
-     *  full row, so a later heartbeat WITHOUT it means "no reportable refusals any more" (the stored row is replaced, never
-     *  merged). Reading absence: from an engine that reports this key, absent = none reportable; an engine that predates
-     *  the key never sends it, so there absence is UNKNOWN, not "none" — tell the two apart by the announced `version`.
-     *  Failure direction = meaning direction (this is a diagnostic key): a code this package version does not know passes
-     *  (it is "not said" to the reader), and a value that breaks the {@link ModelRefusalsWire} shape law is dropped to
-     *  ABSENT (`.catch`) — it never fails the announcement, so it can never make a healthy instance unroutable (unlike
-     *  `restart`, whose shape still gates the row). The key may then be present with the value `undefined`. */
-    modelRefusals: z.ZodCatch<z.ZodOptional<z.ZodEffects<z.ZodObject<{
+    }, z.core.$strip>>;
+    modelRefusals: z.ZodCatch<z.ZodOptional<z.ZodObject<{
         entries: z.ZodRecord<z.ZodString, z.ZodString>;
         plane: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        entries: Record<string, string>;
-        plane?: string | undefined;
-    }, {
-        entries: Record<string, string>;
-        plane?: string | undefined;
-    }>, {
-        entries: Record<string, string>;
-        plane?: string | undefined;
-    }, {
-        entries: Record<string, string>;
-        plane?: string | undefined;
+    }, z.core.$strip>>>;
+    generation: z.ZodCatch<z.ZodOptional<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>>;
+    leaseState: z.ZodCatch<z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        granted: "granted";
+        expired: "expired";
+        denied: "denied";
     }>>>;
-    /** Fleet membership and the lease reading, flat on the heartbeat body under the names and values {@link EngineSignal} gives
-     *  them (one mint point on the engine; this shape reuses that shape's schemas, not copies):
-     *  - `generation` — the canonical decimal generation ({@link isCanonicalGeneration}); present ⇔ the instance is a fleet member.
-     *  - `leaseState` — {@link LeaseState}; present ⇔ fleet member.
-     *  - `leaseUntil` — epoch ms until which the held lease runs; present ⇔ `leaseState` is `granted`.
-     *  The presence law between the three is the engine's; this shape does not judge it across keys. Every heartbeat re-announces
-     *  the full row, so a later heartbeat without a key means the engine no longer says it (the stored row is replaced, never merged).
-     *  Failure direction = meaning direction: these are evidence a center keeps, never routing input — a value that breaks its schema
-     *  drops that ONE key to ABSENT (`.catch`) and the heartbeat is still accepted, so a lease word a newer engine adds can never make
-     *  an older center refuse every heartbeat of that engine. A dropped key reads exactly like an unsaid one; the key may then be
-     *  present with the value `undefined`. */
-    generation: z.ZodCatch<z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>>;
-    leaseState: z.ZodCatch<z.ZodOptional<z.ZodEnum<["none", "granted", "expired", "denied"]>>>;
     leaseUntil: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
-} & {
+    engineSignal: z.ZodCatch<z.ZodOptional<z.ZodObject<{
+        ready: z.ZodBoolean;
+        draining: z.ZodOptional<z.ZodObject<{
+            actionId: z.ZodString;
+            since: z.ZodNumber;
+            deadlineAt: z.ZodNumber;
+        }, z.core.$strip>>;
+        restart: z.ZodOptional<z.ZodObject<{
+            reasons: z.ZodArray<z.ZodString>;
+            version: z.ZodNumber;
+            since: z.ZodNumber;
+            withheld: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        generation: z.ZodOptional<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>;
+        leaseState: z.ZodOptional<z.ZodEnum<{
+            none: "none";
+            granted: "granted";
+            expired: "expired";
+            denied: "denied";
+        }>>;
+        leaseUntil: z.ZodOptional<z.ZodNumber>;
+        configTargetVersion: z.ZodOptional<z.ZodNumber>;
+        configAppliedVersion: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>>;
     registeredMs: z.ZodNumber;
     lastSeenMs: z.ZodNumber;
     observedReady: z.ZodOptional<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    draining: boolean;
-    version: string;
-    instanceId: string;
-    worker: string;
-    address: string;
-    ready: boolean;
-    heartbeatMs: number;
-    registeredMs: number;
-    lastSeenMs: number;
-    restart?: {
-        reasons: string[];
-        version: number;
-        since: number;
-        withheld?: boolean | undefined;
-    } | undefined;
-    modelRefusals?: {
-        entries: Record<string, string>;
-        plane?: string | undefined;
-    } | undefined;
-    generation?: string | undefined;
-    leaseState?: "none" | "granted" | "expired" | "denied" | undefined;
-    leaseUntil?: number | undefined;
-    observedReady?: boolean | undefined;
-}, {
-    version: string;
-    instanceId: string;
-    worker: string;
-    address: string;
-    ready: boolean;
-    registeredMs: number;
-    lastSeenMs: number;
-    draining?: boolean | undefined;
-    restart?: {
-        reasons: string[];
-        version: number;
-        since: number;
-        withheld?: boolean | undefined;
-    } | undefined;
-    modelRefusals?: unknown;
-    heartbeatMs?: number | undefined;
-    generation?: unknown;
-    leaseState?: unknown;
-    leaseUntil?: unknown;
-    observedReady?: boolean | undefined;
-}>;
+}, z.core.$strip>;
 export type InstanceRegistration = z.infer<typeof InstanceRegistration>;
 /** Silent past the declared cadence × multiplier ⇒ stale (auto-removed from the routable set). */
 export declare function isInstanceStale(r: Pick<InstanceRegistration, "lastSeenMs" | "heartbeatMs">, nowMs: number): boolean;
-/** Health fusion: routable ⇔ self-declared ready ∧ not draining ∧ not stale ∧ observer does not veto.
- *  Two sources merge as an AND — EITHER source's "not ready" removes the instance (fail-closed).
- *  Its input is the stored heartbeat row (boolean `draining`); it moves to {@link EngineSignal} in the same major as
- *  {@link isReadyForTraffic}. */
+/** Health fusion — the ONE judge of "may dispatch route to this stored instance": a signal is present ∧ the row is not stale ∧
+ *  the observer does not veto ∧ the engine's own readiness ({@link judgeReadiness} over the row's {@link EngineSignal}). Two sources
+ *  merge as an AND — EITHER source's "not ready" removes the instance (fail-closed). The row's boolean `draining` is not read. */
+export declare function judgeRoutability(r: InstanceRegistration, nowMs: number): RoutingVerdict;
+/** {@link judgeRoutability} as a boolean (the same judge, no second reading). */
 export declare function isRoutable(r: InstanceRegistration, nowMs: number): boolean;
 export declare function routableInstances(rs: InstanceRegistration[], nowMs: number): InstanceRegistration[];
-/**
- * The engine's draining fact — ONE object wherever the engine says "I am draining": inside {@link EngineSignal}`.draining`
- * and as the body of a {@link DrainReceipt}.
- *  - `actionId` — the action that put the engine into draining (idempotency key of the drain request).
- *  - `since` — epoch ms when draining began; it does not move when the same action repeats.
- *  - `deadlineAt` — epoch ms by which the engine stops on its own.
- */
-export declare const EngineDraining: z.ZodObject<{
-    actionId: z.ZodString;
-    since: z.ZodNumber;
-    deadlineAt: z.ZodNumber;
-}, "strip", z.ZodTypeAny, {
-    since: number;
-    actionId: string;
-    deadlineAt: number;
-}, {
-    since: number;
-    actionId: string;
-    deadlineAt: number;
-}>;
-export type EngineDraining = z.infer<typeof EngineDraining>;
-/**
- * Everything the ENGINE itself mints about its own state, as one object — the closed form of the engine-owned subset of the
- * /health self-description ({@link InstanceHealth} is that self-description: an open record, `.passthrough()`, which also
- * carries what the host adds — build, pid, port, store posture). One mint point on the engine; {@link readEngineSignal} reads
- * this shape off a body whose keys sit flat on it (no wrapper key).
- *
- * Where it rides today: on NEITHER exit whole. The heartbeat ({@link InstanceAnnouncement}) and `/health` ({@link InstanceHealth})
- * still speak the 8.0 dialect for the keys they share with this shape, in two ways:
- *  1. `draining` is a BOOLEAN there, not the {@link EngineDraining} object. The heartbeat always carries it (`false` included);
- *     `/health` carries `draining: true` only while draining.
- *  2. `/health` carries `ready` only while NOT ready (`ready: false`); a ready engine's `/health` body has no `ready` key.
- * So `readEngineSignal` over a heartbeat body is always `undefined` (point 1), and over a `/health` body it is `undefined` whenever
- * either applies. What does ride both exits flat, under these names and with these values: `restart`, `instanceId`
- * and the fleet-membership keys `generation` / `leaseState` / `leaseUntil` — on the heartbeat, read them off the parsed
- * {@link InstanceAnnouncement} (which types all five). The next major retires the boolean pair (`draining` / `drainingSince`),
- * has both exits carry this shape whole and moves {@link isReadyForTraffic} / {@link isRoutable} onto it; until then this is
- * the target form, and `readEngineSignal` is the reader for a body that already speaks it.
- *
- *  - `ready` — always said (never "absent while ready"): the engine can take new work right now.
- *  - `draining` — present ⇔ draining ({@link EngineDraining}). NOTE the dialect: {@link InstanceHealth}`.draining` and
- *    {@link InstanceAnnouncement}`.draining` are BOOLEANS (the 8.0 dialect, kept untouched); here it is an object. A body
- *    whose `draining` is a boolean is therefore not an `EngineSignal` and reads as `undefined`.
- *  - `restart` — the one {@link RestartSignal}, same schema object, no copy.
- *  - `generation` — echo of the env the config renderer set on this instance ({@link FLEET_GENERATION_ENV}), a canonical
- *    decimal string ({@link isCanonicalGeneration}). Absent ⇔ not a fleet member (a single-machine engine): it takes no lease
- *    and is not fenced.
- *  - `instanceId` — the engine's OWN process identity, minted by the engine every time the process starts (never read from
- *    env: replicas of one Deployment share one env, and a restarted container reuses its env, so env cannot tell two
- *    processes apart). It is present on a standalone engine too — only `generation` marks fleet membership.
- *  - `leaseState` — the serving lease as the engine holds it ({@link LeaseState}: `none` / `granted` / `expired` / `denied`);
- *    present ⇔ fleet member (the engine says it on every beat once it has a generation).
- *  - `leaseUntil` — epoch ms until which the engine holds its serving lease, as the engine computed it from the last
- *    `ttlMs` it was granted ({@link ServingLeaseResponse}); present ⇔ `leaseState` is `granted`.
- *  - `configTargetVersion` / `configAppliedVersion` — the config-center version the engine was told to converge on, and the
- *    one it has applied: numbers, as the engine mints them (finite, the same rule as {@link RestartSignal}`.version`; equal ⇔ converged).
- *
- * Reading: `EngineSignal` is parsed with the default strip — a whole /health body goes in, only these keys come out. A
- * shape violation in ANY key makes the whole signal `undefined` (it is never "the rest of it"). `undefined` means "no
- * signal this reader can say" — an engine that predates the keys, or a malformed body — and is NEVER "ready": a caller on
- * the routing axis treats it as not routable unless it deliberately falls back to the boolean dialect of
- * {@link InstanceHealth}.
- */
-export declare const EngineSignal: z.ZodObject<{
-    ready: z.ZodBoolean;
-    draining: z.ZodOptional<z.ZodObject<{
-        actionId: z.ZodString;
-        since: z.ZodNumber;
-        deadlineAt: z.ZodNumber;
-    }, "strip", z.ZodTypeAny, {
-        since: number;
-        actionId: string;
-        deadlineAt: number;
-    }, {
-        since: number;
-        actionId: string;
-        deadlineAt: number;
-    }>>;
-    restart: z.ZodOptional<z.ZodObject<{
-        reasons: z.ZodArray<z.ZodString, "many">;
-        version: z.ZodNumber;
-        since: z.ZodNumber;
-        withheld: z.ZodOptional<z.ZodBoolean>;
-    }, "strip", z.ZodTypeAny, {
-        reasons: string[];
-        version: number;
-        since: number;
-        withheld?: boolean | undefined;
-    }, {
-        reasons: string[];
-        version: number;
-        since: number;
-        withheld?: boolean | undefined;
-    }>>;
-    generation: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    instanceId: z.ZodOptional<z.ZodString>;
-    leaseState: z.ZodOptional<z.ZodEnum<["none", "granted", "expired", "denied"]>>;
-    leaseUntil: z.ZodOptional<z.ZodNumber>;
-    configTargetVersion: z.ZodOptional<z.ZodNumber>;
-    configAppliedVersion: z.ZodOptional<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    ready: boolean;
-    draining?: {
-        since: number;
-        actionId: string;
-        deadlineAt: number;
-    } | undefined;
-    restart?: {
-        reasons: string[];
-        version: number;
-        since: number;
-        withheld?: boolean | undefined;
-    } | undefined;
-    instanceId?: string | undefined;
-    generation?: string | undefined;
-    leaseState?: "none" | "granted" | "expired" | "denied" | undefined;
-    leaseUntil?: number | undefined;
-    configTargetVersion?: number | undefined;
-    configAppliedVersion?: number | undefined;
-}, {
-    ready: boolean;
-    draining?: {
-        since: number;
-        actionId: string;
-        deadlineAt: number;
-    } | undefined;
-    restart?: {
-        reasons: string[];
-        version: number;
-        since: number;
-        withheld?: boolean | undefined;
-    } | undefined;
-    instanceId?: string | undefined;
-    generation?: string | undefined;
-    leaseState?: "none" | "granted" | "expired" | "denied" | undefined;
-    leaseUntil?: number | undefined;
-    configTargetVersion?: number | undefined;
-    configAppliedVersion?: number | undefined;
-}>;
-export type EngineSignal = z.infer<typeof EngineSignal>;
-/**
- * The reader of {@link EngineSignal}: the shape's keys, flat on the given body, judged by the same guarded body reader as
- * {@link readRestartSignal} and {@link readModelRefusals}, so the same odd input gets the same answer from all three. Shape
- * mismatch, a missing `ready`, a non-object body, even a throwing accessor ⇒ `undefined` — never throws. See {@link EngineSignal}
- * for what `undefined` means (not "ready") and for why today's heartbeat and `/health` bodies read as `undefined` here.
- */
-export declare function readEngineSignal(health: unknown): EngineSignal | undefined;
 /**
  * The env name a fleet member's generation travels under — the config renderer sets it, the engine reads it back and echoes
  * it as {@link EngineSignal}`.generation`. Both sides import THIS constant; neither spells the name. The value is the
  * generation this instance belongs to (opaque string); absent from the engine's env ⇔ not a fleet member (the standalone
  * form). There is deliberately NO env name for the instance id: an instance's identity is minted by the engine per process
- * ({@link EngineSignal}`.instanceId`), and env cannot carry it (see there).
+ * ({@link InstanceHealth}`.instanceId`), and env cannot carry it (see there).
  */
 export declare const FLEET_GENERATION_ENV = "FLEET_GENERATION";
 /**
@@ -723,19 +543,19 @@ export declare const FLEET_GENERATION_ENV = "FLEET_GENERATION";
  * {@link ServingLeaseRequest} and {@link InstanceAnnouncement}; nothing in the engine's env does); the engine's own identity
  * scope is the one the renderer gave in this env; that the two are the same value is the renderer's obligation.
  * The engine never derives it from the token's format (a token is opaque to it, and a format guess would be a second source
- * that can disagree with the scope the center binds). Absent from the engine's env ⇒ the default scope, {@link GLOBAL_SCOPE} (`api/scopes`) —
- * the same default the center reads where nothing names a scope; this note does not restate the value. Like
+ * that can disagree with the scope web-admin binds). Absent from the engine's env ⇒ the default scope, {@link GLOBAL_SCOPE} (`api/scopes`) —
+ * the same default web-admin reads where nothing names a scope; this note does not restate the value. Like
  * {@link FLEET_GENERATION_ENV} it is a reserved worker env name (`WorkerSpec.env` / `secretEnv` cannot set it).
  */
 export declare const FLEET_SCOPE_ENV = "FLEET_SCOPE";
 /**
  * The serving lease — the ONE fence between a superseded generation and the traffic it must stop taking. A fleet-member
- * engine renews it with the center; the center answers per the lifecycle object it holds for that instance. Three constants
+ * engine renews it with web-admin; web-admin answers per the lifecycle object it holds for that instance. Three constants
  * fix the clock, all in ms:
  *  - {@link SERVING_LEASE_TTL_DEFAULT_MS} — the lease length when the operator sets none (10 min).
  *  - {@link SERVING_LEASE_TTL_FLOOR_MS} — the shortest lease there is: a configured TTL below it is treated as it (1 min),
  *    the same way {@link DRAIN_GRACE_FLOOR_MS} protects a fat-fingered grace.
- *  - {@link SERVING_LEASE_DRIFT_MARGIN_MS} — the center's clock-skew allowance: it adds this to a lease's recorded expiry
+ *  - {@link SERVING_LEASE_DRIFT_MARGIN_MS} — web-admin's clock-skew allowance: it adds this to a lease's recorded expiry
  *    before it counts that lease as over. It is DERIVED from {@link DEFAULT_HEARTBEAT_MS} (one cadence, one number), never a
  *    second constant that could drift from it.
  */
@@ -747,177 +567,137 @@ export declare const SERVING_LEASE_DRIFT_MARGIN_MS = 30000;
  * {@link SERVING_LEASE_TTL_DEFAULT_MS}; a number below {@link SERVING_LEASE_TTL_FLOOR_MS} (zero and negatives included) ⇒ the
  * floor; otherwise the number, truncated to whole ms, with no ceiling. It is for the ISSUING side's configuration. A reply's
  * `ttlMs` is used exactly as granted and is never clamped upward — an engine that stretched a short grant to the floor would
- * hold the lease past what the center recorded, which is the one thing the fence exists to prevent.
+ * hold the lease past what web-admin recorded, which is the one thing the fence exists to prevent.
  */
 export declare function clampServingLeaseTtlMs(configuredMs: number | undefined): number;
 /**
- * Engine → center: "may this instance keep serving?" The identity triple names the instance exactly — a lease is never
+ * Engine → web-admin: "may this instance keep serving?" The identity triple names the instance exactly — a lease is never
  * asked for by worker name alone. `generation` is the env echo ({@link FLEET_GENERATION_ENV}); `instanceId` is the engine's
- * own per-process identity ({@link EngineSignal}`.instanceId`), so a restarted process is a NEW instance to the center.
+ * own per-process identity ({@link InstanceHealth}`.instanceId`), so a restarted process is a NEW instance to web-admin.
  * `scope` — the tenant scope the lease is asked in. A renewal is taken on a PER-WORKER token only — the credential binds
  * (scope, worker) — so the credential decides the scope and this field can only agree: absent = the scope the token binds; present
  * ⇒ it must equal that scope (a mismatch is refused, never rewritten either way). The shared token may not renew a lease at all
- * (the center answers 403). Only fleet members ask: an engine without a generation (the standalone form) has no lease and sends
+ * (web-admin answers 403). Only fleet members ask: an engine without a generation (the standalone form) has no lease and sends
  * nothing.
  */
 export declare const ServingLeaseRequest: z.ZodObject<{
     worker: z.ZodString;
     scope: z.ZodOptional<z.ZodString>;
-    generation: z.ZodEffects<z.ZodString, string, string>;
+    generation: z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
     instanceId: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    instanceId: string;
-    worker: string;
-    generation: string;
-    scope?: string | undefined;
-}, {
-    instanceId: string;
-    worker: string;
-    generation: string;
-    scope?: string | undefined;
-}>;
+}, z.core.$strip>;
 export type ServingLeaseRequest = z.infer<typeof ServingLeaseRequest>;
 /**
  * Why a lease is refused — a CLOSED set of exactly two words, owned here:
  *  - `superseded` — a newer generation of this worker has taken over; this instance is the old one.
- *  - `retired` — the center has retired this instance (or the worker it belongs to).
+ *  - `retired` — web-admin has retired this instance (or the worker it belongs to).
  * Only {@link ServingLeaseResponse}'s `denied` arm carries a reason; `unknown` has none, by shape.
  */
 export declare const SERVING_LEASE_DENIED_REASONS: readonly ["superseded", "retired"];
-export declare const ServingLeaseDeniedReason: z.ZodEnum<["superseded", "retired"]>;
+export declare const ServingLeaseDeniedReason: z.ZodEnum<{
+    superseded: "superseded";
+    retired: "retired";
+}>;
 export type ServingLeaseDeniedReason = z.infer<typeof ServingLeaseDeniedReason>;
 /**
- * Center → engine: the verdict, a CLOSED set of three words ({@link SERVING_LEASE_VERDICTS}) — the arms of one
+ * Web-admin → engine: the verdict, a CLOSED set of three words ({@link SERVING_LEASE_VERDICTS}) — the arms of one
  * discriminated union, so a reader that switches on `verdict` is told by the compiler when a word is added.
  *  - `granted` — keep serving; `ttlMs` is how long the lease lasts, a DURATION, never a wall-clock instant: the engine counts
- *    it from the instant it SENT the request, on its own monotonic clock (`expiresAt = sendAt + ttlMs`), and the center keeps
+ *    it from the instant it SENT the request, on its own monotonic clock (`expiresAt = sendAt + ttlMs`), and web-admin keeps
  *    its own expiry from its store time — the two sides never compare clocks, so no clock agreement is needed.
  *  - `denied` — this instance must stop: `reason` is {@link ServingLeaseDeniedReason}. The ONLY arm that obliges an engine to
- *    stop serving, and it is issued on POSITIVE evidence only: the center keeps, per (scope, worker), a persisted generation
+ *    stop serving, and it is issued on POSITIVE evidence only: web-admin keeps, per (scope, worker), a persisted generation
  *    floor that is never garbage-collected, and a request whose generation lies below it is `superseded`; `retired` likewise
- *    rests on a record the center holds. A center that merely holds no such record does not deny — it answers `unknown`.
- *  - `unknown` — the center holds no lifecycle object for this instance right now (restoring its store, migrating scopes, not
+ *    rests on a record web-admin holds. A web-admin that merely holds no such record does not deny — it answers `unknown`.
+ *  - `unknown` — web-admin holds no lifecycle object for this instance right now (restoring its store, migrating scopes, not
  *    yet claimed). It says NOTHING about whether the instance should serve, so it is not a kind of `denied` and absence of the
  *    object NEVER turns into a denial: it carries no reason, and an engine never drains on it. To the engine it is the same
- *    case as an unreachable center.
- * This is the law for what a center SENDS. A reader does not apply it to `reason`: {@link readServingLeaseResponse} judges by
+ *    case as an unreachable web-admin.
+ * This is the law for what a web-admin SENDS. A reader does not apply it to `reason`: {@link readServingLeaseResponse} judges by
  * the `verdict` key and keeps a `denied` a `denied` even when its reason is outside the set ({@link ServingLeaseReading}). A
  * reply whose `verdict` itself is outside the three words (or a `granted` with no valid `ttlMs`) is not a verdict at all and
- * reads as `undefined` — an unreachable center, never `denied`, never `granted`.
+ * reads as `undefined` — an unreachable web-admin, never `denied`, never `granted`.
  */
-export declare const ServingLeaseResponse: z.ZodDiscriminatedUnion<"verdict", [z.ZodObject<{
+export declare const ServingLeaseResponse: z.ZodDiscriminatedUnion<[z.ZodObject<{
     verdict: z.ZodLiteral<"granted">;
     ttlMs: z.ZodNumber;
-}, "strip", z.ZodTypeAny, {
-    verdict: "granted";
-    ttlMs: number;
-}, {
-    verdict: "granted";
-    ttlMs: number;
-}>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     verdict: z.ZodLiteral<"denied">;
-    reason: z.ZodEnum<["superseded", "retired"]>;
-}, "strip", z.ZodTypeAny, {
-    reason: "superseded" | "retired";
-    verdict: "denied";
-}, {
-    reason: "superseded" | "retired";
-    verdict: "denied";
-}>, z.ZodObject<{
+    reason: z.ZodEnum<{
+        superseded: "superseded";
+        retired: "retired";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
     verdict: z.ZodLiteral<"unknown">;
-}, "strip", z.ZodTypeAny, {
-    verdict: "unknown";
-}, {
-    verdict: "unknown";
-}>]>;
+}, z.core.$strip>], "verdict">;
 export type ServingLeaseResponse = z.infer<typeof ServingLeaseResponse>;
 /** The reason word a READER puts in place of a `denied` reason it cannot place (outside {@link SERVING_LEASE_DENIED_REASONS},
  *  missing, not a string). Read-face only: a producer never sends it, and the strict {@link ServingLeaseResponse} refuses it. */
 export declare const SERVING_LEASE_UNKNOWN_REASON = "unknown_reason";
 /** The read face of {@link ServingLeaseResponse} — same three arms, with the `denied` arm tolerant about `reason`. */
-declare const ServingLeaseReadFace: z.ZodDiscriminatedUnion<"verdict", [z.ZodObject<{
+declare const ServingLeaseReadFace: z.ZodDiscriminatedUnion<[z.ZodObject<{
     verdict: z.ZodLiteral<"granted">;
     ttlMs: z.ZodNumber;
-}, "strip", z.ZodTypeAny, {
-    verdict: "granted";
-    ttlMs: number;
-}, {
-    verdict: "granted";
-    ttlMs: number;
-}>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     verdict: z.ZodLiteral<"denied">;
-    reason: z.ZodEffects<z.ZodUnknown, "superseded" | "retired" | "unknown_reason", unknown>;
-}, "strip", z.ZodTypeAny, {
-    reason: "superseded" | "retired" | "unknown_reason";
-    verdict: "denied";
-}, {
-    verdict: "denied";
-    reason?: unknown;
-}>, z.ZodObject<{
+    reason: z.ZodPipe<z.ZodOptional<z.ZodUnknown>, z.ZodTransform<"superseded" | "retired" | "unknown_reason", unknown>>;
+}, z.core.$strip>, z.ZodObject<{
     verdict: z.ZodLiteral<"unknown">;
-}, "strip", z.ZodTypeAny, {
-    verdict: "unknown";
-}, {
-    verdict: "unknown";
-}>]>;
+}, z.core.$strip>], "verdict">;
 /** The verdict words as a runtime list. `satisfies` bites a word the union does not have; the converse (a union arm missing
  *  from this list) is pinned by a test that reads the union's discriminators. */
 export declare const SERVING_LEASE_VERDICTS: readonly ["granted", "denied", "unknown"];
-/** Center side: the request body of a serving-lease renewal. Shape mismatch / non-object / throwing accessor ⇒ `undefined`,
+/** Web-admin side: the request body of a serving-lease renewal. Shape mismatch / non-object / throwing accessor ⇒ `undefined`,
  *  never throws (same guarded reader as every other read in this file). */
 export declare function readServingLeaseRequest(body: unknown): ServingLeaseRequest | undefined;
 /**
  * What {@link readServingLeaseResponse} returns: {@link ServingLeaseResponse} plus the one thing a reader adds — a `denied`
  * whose reason it could not place carries {@link SERVING_LEASE_UNKNOWN_REASON}. Two faces on purpose (the failure direction
- * must match the meaning): the strict wire law says what a center may SEND (a closed two-word reason set); the reader judges
- * by the `verdict` key alone, so a center that learns a third reason word cannot make an older engine read `denied` as
+ * must match the meaning): the strict wire law says what a web-admin may SEND (a closed two-word reason set); the reader judges
+ * by the `verdict` key alone, so a web-admin that learns a third reason word cannot make an older engine read `denied` as
  * `undefined` and keep serving. Branch on `verdict`; `reason` is for the log line.
  */
 export type ServingLeaseReading = z.output<typeof ServingLeaseReadFace>;
 /** Engine side: the reply to a renewal, judged by its `verdict` key: `granted` needs a valid `ttlMs`, `denied` is `denied`
  *  whatever its `reason` (see {@link ServingLeaseReading}), `unknown` is `unknown`. A non-object, a throwing accessor, a
  *  `verdict` outside the three words or a `granted` without a valid `ttlMs` ⇒ `undefined`, never throws — and `undefined`
- *  is read like an unreachable center, never like `denied` and never like `granted`. */
+ *  is read like an unreachable web-admin, never like `denied` and never like `granted`. */
 export declare function readServingLeaseResponse(body: unknown): ServingLeaseReading | undefined;
 /**
- * What the CENTER says it can do: capability bits an engine reads before it starts using a center-side endpoint.
- *  - `servingLease` — the center answers serving-lease renewals ({@link ServingLeaseRequest} / {@link ServingLeaseResponse}).
+ * What web-admin says it can do: capability bits an engine reads before it starts using a web-admin-side endpoint.
+ *  - `servingLease` — web-admin answers serving-lease renewals ({@link ServingLeaseRequest} / {@link ServingLeaseResponse}).
  *
  * A bit is `true` or absent — one spelling for "not supported" (there is no `false`). An absent bit — in a declared object, or
- * because the center declares nothing at all (an older center) — means the center does not support the lease, and the engine then
- * neither renews a lease nor is fenced by one: this is the compatibility gate that lets an executor ship ahead of the center
- * without pushing running engines into lease expiry. It is a gate, not a verdict — nothing in this shape says "the center refuses
+ * because web-admin declares nothing at all (an older web-admin) — means web-admin does not support the lease, and the engine then
+ * neither renews a lease nor is fenced by one: this is the compatibility gate that lets an executor ship ahead of web-admin
+ * without pushing running engines into lease expiry. It is a gate, not a verdict — nothing in this shape says "web-admin refuses
  * leases". Read a heartbeat reply with {@link readCapabilityReading} and start the lease client only on a `declared` reading whose
  * `capabilities.servingLease === true`.
- * Unknown bits are stripped (a newer center's extra bits never break an older reader); a known bit whose value is not `true` breaks
+ * Unknown bits are stripped (a newer web-admin's extra bits never break an older reader); a known bit whose value is not `true` breaks
  * the declaration — and a broken declaration is NOT an absent one: the reply reads as `unreadable`, which is not a reading (the engine
  * keeps the state it had; see {@link readCapabilityReading}).
  * It rides in ONE place: the heartbeat's 2xx reply ({@link FLEET_PATHS}`.instances`), under {@link HEARTBEAT_REPLY_CAPABILITIES_KEY}.
- * The center answers the bits per CALLER CREDENTIAL: under a per-worker token, by what the center supports; under the shared token
+ * Web-admin answers the bits per CALLER CREDENTIAL: under a per-worker token, by what web-admin supports; under the shared token
  * `servingLease` is always absent (the serving-lease endpoint takes per-worker tokens only, so announcing it there would only push
  * that caller into the unreachable arm).
  */
-export declare const CenterCapabilities: z.ZodObject<{
+export declare const WebAdminCapabilities: z.ZodObject<{
     servingLease: z.ZodOptional<z.ZodLiteral<true>>;
-}, "strip", z.ZodTypeAny, {
-    servingLease?: true | undefined;
-}, {
-    servingLease?: true | undefined;
-}>;
-export type CenterCapabilities = z.infer<typeof CenterCapabilities>;
+}, z.core.$strip>;
+export type WebAdminCapabilities = z.infer<typeof WebAdminCapabilities>;
 /**
- * The key of the heartbeat's 2xx reply body under which the center puts its {@link CenterCapabilities} — the object's only carrier.
- * The center writes `{ …, [HEARTBEAT_REPLY_CAPABILITIES_KEY]: caps }`; the engine reads the whole reply with
+ * The key of the heartbeat's 2xx reply body under which web-admin puts its {@link WebAdminCapabilities} — the object's only carrier.
+ * Web-admin writes `{ …, [HEARTBEAT_REPLY_CAPABILITIES_KEY]: caps }`; the engine reads the whole reply with
  * `readCapabilityReading(reply)` — the key lookup lives in the reader, one carrier one reader — and only on a 2xx (a failed heartbeat
  * says nothing about the bits). Nested, not flat: the reply's own keys and the capability bits never share a namespace.
- * A reply without the key is an older center — no capability said (`undeclared`). A reply with the key present with a value that
+ * A reply without the key is an older web-admin — no capability said (`undeclared`). A reply with the key present with a value that
  * breaks the shape is NOT "without the key" — it is `unreadable`, and an unreadable reply says nothing: neither declared nor undeclared.
  */
 export declare const HEARTBEAT_REPLY_CAPABILITIES_KEY = "capabilities";
-/** What one heartbeat reply says about the center's capabilities — three readings of the reply, see {@link readCapabilityReading}. */
+/** What one heartbeat reply says about web-admin's capabilities — three readings of the reply, see {@link readCapabilityReading}. */
 export type CapabilityReading = {
     kind: "declared";
-    capabilities: CenterCapabilities;
+    capabilities: WebAdminCapabilities;
 } | {
     kind: "undeclared";
 } | {
@@ -925,16 +705,16 @@ export type CapabilityReading = {
     why: "not-an-object" | "invalid-capabilities";
 };
 /**
- * Engine side: what one heartbeat reply says about the center's capabilities. The input is the heartbeat's whole 2xx reply body
+ * Engine side: what one heartbeat reply says about web-admin's capabilities. The input is the heartbeat's whole 2xx reply body
  * (the key lookup lives here — one carrier, one reader), the output one of three readings:
- *  - `declared` — the key ({@link HEARTBEAT_REPLY_CAPABILITIES_KEY}) is present and its value passes {@link CenterCapabilities};
+ *  - `declared` — the key ({@link HEARTBEAT_REPLY_CAPABILITIES_KEY}) is present and its value passes {@link WebAdminCapabilities};
  *    `capabilities` is the parsed object (unknown bits stripped, an absent bit stays absent).
- *  - `undeclared` — the reply is an object and the key is absent: an older center, which has said nothing about capabilities.
+ *  - `undeclared` — the reply is an object and the key is absent: an older web-admin, which has said nothing about capabilities.
  *    (`undefined` as the key's value is what JSON cannot carry; it reads as the key being absent.)
  *  - `unreadable` — the reply is not an object (`why: "not-an-object"`), or the key is present but its value is not a
- *    {@link CenterCapabilities} (`why: "invalid-capabilities"`; an accessor that throws reads the same way).
+ *    {@link WebAdminCapabilities} (`why: "invalid-capabilities"`; an accessor that throws reads the same way).
  * Only `declared` and `undeclared` are readings. `unreadable` is not a reading: on the fence axis a malformed declaration must not
- * read as "the center declared nothing", so the engine acts on it as on no reply at all — it keeps the state it last had (before
+ * read as "web-admin declared nothing", so the engine acts on it as on no reply at all — it keeps the state it last had (before
  * any reading: no lease) and leaves its clocks, the lease expiry and the outage allowance, as they were. Start the lease client only
  * on `declared` with `capabilities.servingLease === true`. Never throws; judged by the same one guarded body judgement as every
  * other reader here.
@@ -942,8 +722,8 @@ export type CapabilityReading = {
 export declare function readCapabilityReading(reply: unknown): CapabilityReading;
 /**
  * The drain endpoint's request: "put this instance into draining, by this deadline". One persisted action, one validation,
- * whether the center calls directly or an executor retries it. Two lanes, one shape: on the Docker lane (and for a direct
- * call from the center) this HTTP request is how an instance is drained; on the Kubernetes lane no per-pod HTTP call is made
+ * whether web-admin calls directly or an executor retries it. Two lanes, one shape: on the Docker lane (and for a direct
+ * call from web-admin) this HTTP request is how an instance is drained; on the Kubernetes lane no per-pod HTTP call is made
  * (per-pod addressing and RBAC make it the wrong tool) — an instance is drained by its serving lease being denied
  * ({@link ServingLeaseResponse}), after which the engine puts itself into draining.
  *  - `actionId` — idempotency key: the same id again echoes the first answer ({@link DrainReceipt}`.state` =
@@ -951,42 +731,29 @@ export declare function readCapabilityReading(reply: unknown): CapabilityReading
  *  - the identity — `scope?` / `worker` / `expectedGeneration?` / `instanceId?` — names WHICH instance the action is for. The
  *    engine compares it field by field against its own, absent against absent: an engine that is not a fleet member has no
  *    generation, so a request with no `expectedGeneration` is the standalone form, not a wildcard; `instanceId`, when given,
- *    is the engine's own per-process identity ({@link EngineSignal}`.instanceId`). A mismatch is the endpoint's refusal, not
+ *    is the engine's own per-process identity ({@link InstanceHealth}`.instanceId`). A mismatch is the endpoint's refusal, not
  *    this shape's: this schema only says what a well-formed request looks like.
  *  - `deadlineAt` — epoch ms by which the engine stops on its own.
- *  - `term` — the claim term the sending executor holds for this action (center-issued, opaque); absent where no executor
+ *  - `term` — the claim term the sending executor holds for this action (web-admin-issued, opaque); absent where no executor
  *    sits in between (a direct call, a hand-issued action).
  */
 export declare const DrainRequest: z.ZodObject<{
     actionId: z.ZodString;
     scope: z.ZodOptional<z.ZodString>;
     worker: z.ZodString;
-    expectedGeneration: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    expectedGeneration: z.ZodOptional<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>;
     instanceId: z.ZodOptional<z.ZodString>;
     deadlineAt: z.ZodNumber;
     term: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    worker: string;
-    actionId: string;
-    deadlineAt: number;
-    instanceId?: string | undefined;
-    scope?: string | undefined;
-    expectedGeneration?: string | undefined;
-    term?: string | undefined;
-}, {
-    worker: string;
-    actionId: string;
-    deadlineAt: number;
-    instanceId?: string | undefined;
-    scope?: string | undefined;
-    expectedGeneration?: string | undefined;
-    term?: string | undefined;
-}>;
+}, z.core.$strip>;
 export type DrainRequest = z.infer<typeof DrainRequest>;
 /** What a drain request leaves the engine in: `draining` — this call put it into draining; `already_draining` — it already was
  *  (the same action repeated), and the receipt reports the first call's facts. */
 export declare const DRAIN_RECEIPT_STATES: readonly ["draining", "already_draining"];
-export declare const DrainReceiptState: z.ZodEnum<["draining", "already_draining"]>;
+export declare const DrainReceiptState: z.ZodEnum<{
+    draining: "draining";
+    already_draining: "already_draining";
+}>;
 export type DrainReceiptState = z.infer<typeof DrainReceiptState>;
 /** The drain endpoint's answer: the engine's draining fact ({@link EngineDraining} — the same object {@link EngineSignal}
  *  carries as `draining`, extended, not copied) plus how this call found the engine. */
@@ -994,19 +761,11 @@ export declare const DrainReceipt: z.ZodObject<{
     actionId: z.ZodString;
     since: z.ZodNumber;
     deadlineAt: z.ZodNumber;
-} & {
-    state: z.ZodEnum<["draining", "already_draining"]>;
-}, "strip", z.ZodTypeAny, {
-    since: number;
-    actionId: string;
-    deadlineAt: number;
-    state: "draining" | "already_draining";
-}, {
-    since: number;
-    actionId: string;
-    deadlineAt: number;
-    state: "draining" | "already_draining";
-}>;
+    state: z.ZodEnum<{
+        draining: "draining";
+        already_draining: "already_draining";
+    }>;
+}, z.core.$strip>;
 export type DrainReceipt = z.infer<typeof DrainReceipt>;
 /** Engine side: the request body of the drain endpoint. Shape mismatch / non-object / throwing accessor ⇒ `undefined`, never throws. */
 export declare function readDrainRequest(body: unknown): DrainRequest | undefined;
@@ -1014,34 +773,20 @@ export declare function readDrainRequest(body: unknown): DrainRequest | undefine
 export declare function readDrainReceipt(body: unknown): DrainReceipt | undefined;
 export declare const DISPATCH_STRATEGIES: readonly ["round-robin", "least-inflight", "consistent-hash"];
 export type DispatchStrategy = (typeof DISPATCH_STRATEGIES)[number];
-/** Per-worker dispatch policy (center-configured; the gateway is OPTIONAL — D3: TOC/self-maintained TOB go
+/** Per-worker dispatch policy (web-admin-configured; the gateway is OPTIONAL — D3: TOC/self-maintained TOB go
  *  direct, sema-managed fleets route through /api/dispatch). Strategy is an enum on purpose: a new LB
  *  algorithm is a new value, not a new skeleton. */
 export declare const DispatchPolicy: z.ZodObject<{
-    strategy: z.ZodDefault<z.ZodEnum<["round-robin", "least-inflight", "consistent-hash"]>>;
-    /** live-steer legs must return to their instance (cross-replica live-steer is 409 by design) — when true,
-     *  a request carrying an affinity key pins via consistent hash regardless of `strategy`. If the pinned
-     *  instance dies, the run resumes elsewhere via resumeFromRunId (affinity avoids the gap; resume bounds it). */
+    strategy: z.ZodDefault<z.ZodEnum<{
+        "round-robin": "round-robin";
+        "least-inflight": "least-inflight";
+        "consistent-hash": "consistent-hash";
+    }>>;
     sessionAffinity: z.ZodDefault<z.ZodBoolean>;
-    /** gateway-level concurrency gate (per worker) */
     maxInflight: z.ZodOptional<z.ZodNumber>;
-    /** per-actor fairness gate */
     perActorMaxInflight: z.ZodOptional<z.ZodNumber>;
-    /** cost clamp applied to submissions passing the gateway */
     maxCostUsd: z.ZodOptional<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    strategy: "round-robin" | "least-inflight" | "consistent-hash";
-    sessionAffinity: boolean;
-    maxInflight?: number | undefined;
-    perActorMaxInflight?: number | undefined;
-    maxCostUsd?: number | undefined;
-}, {
-    strategy?: "round-robin" | "least-inflight" | "consistent-hash" | undefined;
-    sessionAffinity?: boolean | undefined;
-    maxInflight?: number | undefined;
-    perActorMaxInflight?: number | undefined;
-    maxCostUsd?: number | undefined;
-}>;
+}, z.core.$strip>;
 export type DispatchPolicy = z.infer<typeof DispatchPolicy>;
 /** 🔴 Submit idempotency — the precondition that makes failover re-routing SAFE: a new-run submission MUST
  *  carry the client-minted durable taskId, and the server dedupes on it. Without this, "landed but the
@@ -1066,8 +811,8 @@ export declare function pickInstance(policy: DispatchPolicy, candidates: Dispatc
     cursor?: number;
     affinityKey?: string;
 }): DispatchCandidate | null;
-/** A pre-authorized slice of a principal's global budget, granted by center to ONE worker: the worker deducts
- *  locally (no per-call round-trip), renews when running low, and center reconciles reported consumption
+/** A pre-authorized slice of a principal's global budget, granted by web-admin to ONE worker: the worker deducts
+ *  locally (no per-call round-trip), renews when running low, and web-admin reconciles reported consumption
  *  against the grant after the fact — the roaming/CDN pattern.
  *
  *  0.6.1 双轴 slice(EXPERT-REDESIGN §4-2/§4-6, service 回执"发布即接单"):slice = **{weightedTokens,
@@ -1081,59 +826,17 @@ export declare const QuotaLease: z.ZodObject<{
     leaseId: z.ZodString;
     principal: z.ZodString;
     worker: z.ZodString;
-    /** granted dimensions — either or both; a dimension absent = not governed by this lease.
-     *  `weightedTokens` = 加权 tokens(配额轴)。 */
     grant: z.ZodObject<{
         weightedTokens: z.ZodOptional<z.ZodNumber>;
         costMicroUsd: z.ZodOptional<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        weightedTokens?: number | undefined;
-        costMicroUsd?: number | undefined;
-    }, {
-        weightedTokens?: number | undefined;
-        costMicroUsd?: number | undefined;
-    }>;
-    consumed: z.ZodDefault<z.ZodObject<{
+    }, z.core.$strip>;
+    consumed: z.ZodPrefault<z.ZodObject<{
         weightedTokens: z.ZodDefault<z.ZodNumber>;
         costMicroUsd: z.ZodDefault<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        weightedTokens: number;
-        costMicroUsd: number;
-    }, {
-        weightedTokens?: number | undefined;
-        costMicroUsd?: number | undefined;
-    }>>;
+    }, z.core.$strip>>;
     issuedMs: z.ZodNumber;
     expiresMs: z.ZodNumber;
-}, "strip", z.ZodTypeAny, {
-    worker: string;
-    leaseId: string;
-    principal: string;
-    grant: {
-        weightedTokens?: number | undefined;
-        costMicroUsd?: number | undefined;
-    };
-    consumed: {
-        weightedTokens: number;
-        costMicroUsd: number;
-    };
-    issuedMs: number;
-    expiresMs: number;
-}, {
-    worker: string;
-    leaseId: string;
-    principal: string;
-    grant: {
-        weightedTokens?: number | undefined;
-        costMicroUsd?: number | undefined;
-    };
-    issuedMs: number;
-    expiresMs: number;
-    consumed?: {
-        weightedTokens?: number | undefined;
-        costMicroUsd?: number | undefined;
-    } | undefined;
-}>;
+}, z.core.$strip>;
 export type QuotaLease = z.infer<typeof QuotaLease>;
 /** Remaining per granted dimension; null = the dimension is not governed by this lease. Never negative. */
 export declare function leaseRemaining(l: QuotaLease): {
@@ -1149,7 +852,7 @@ export declare function leaseExhausted(l: QuotaLease, nowMs: number): boolean;
 export declare function shouldRenewLease(l: QuotaLease, nowMs: number, opts?: {
     renewAtFraction?: number;
 }): boolean;
-/** Reconciliation (center side): consumption is MONOTONE — the reconciled row takes the max of what center
+/** Reconciliation (web-admin side): consumption is MONOTONE — the reconciled row takes the max of what web-admin
  *  believed and what the worker reported (a lost report can only under-count, never roll back).
  *  0.7.1:legacy `tokens` report alias removed with the QuotaLease shim(同一收账点,service 回执). */
 export declare function reconcileLease(l: QuotaLease, reported: {
@@ -1163,43 +866,15 @@ export declare function reconcileLease(l: QuotaLease, reported: {
 export declare const UsageEntry: z.ZodObject<{
     principal: z.ZodString;
     model: z.ZodString;
-    /** 归一化总输入 token(含 cache 读/写),非未命中分量——见类型头注。 */
     inputTokens: z.ZodNumber;
     outputTokens: z.ZodNumber;
-    /** 0.11.0 起 optional(RB-368 生态半场,跨仓记录在案):unpriced 部署(模型无价目)对 cost
-     *  只有「未知」这个业务态,required 逼 worker 编 0 = center 账面一个**精确的谎**。缺席=未知;
-     *  聚合面以 {@link AggregatedPrincipalUsage.costUnknown} 补偿(已知和=显式下界)。写了键 = producer
-     *  声称自己知道(0 就是真 0)。 */
     costMicroUsd: z.ZodOptional<z.ZodNumber>;
     runs: z.ZodOptional<z.ZodNumber>;
-    /** 加权 tokens(配额轴计账值,EXPERT-REDESIGN §4-1):=(input+output)×记账时的 quotaWeight,
-     *  **weight-at-burn 持久化**——倍率 publish 只影响此后记账,不回算窗口内历史(余量/恢复时间不跳变)。
-     *  0.6.0 additive optional:旧 worker 不报 → 聚合按 quotaWeight=1 兜底折算。 */
     weightedTokens: z.ZodOptional<z.ZodNumber>;
-    /** 记账时固化的该模型 quotaWeight(审计口径,与 weightedTokens 同时点)——lease 扣减与 registry 聚合两
-     *  路径按同一时点折算(同口径,§11-1)。 */
     quotaWeightAtUse: z.ZodOptional<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    principal: string;
-    model: string;
-    inputTokens: number;
-    outputTokens: number;
-    weightedTokens?: number | undefined;
-    costMicroUsd?: number | undefined;
-    runs?: number | undefined;
-    quotaWeightAtUse?: number | undefined;
-}, {
-    principal: string;
-    model: string;
-    inputTokens: number;
-    outputTokens: number;
-    weightedTokens?: number | undefined;
-    costMicroUsd?: number | undefined;
-    runs?: number | undefined;
-    quotaWeightAtUse?: number | undefined;
-}>;
+}, z.core.$strip>;
 export type UsageEntry = z.infer<typeof UsageEntry>;
-/** Periodic batch (worker → center POST). Windows are half-open [start, end) so adjacent batches never
+/** Periodic batch (worker → web-admin POST). Windows are half-open [start, end) so adjacent batches never
  *  double-count a boundary instant. */
 export declare const UsageReport: z.ZodObject<{
     worker: z.ZodString;
@@ -1209,72 +884,14 @@ export declare const UsageReport: z.ZodObject<{
     entries: z.ZodArray<z.ZodObject<{
         principal: z.ZodString;
         model: z.ZodString;
-        /** 归一化总输入 token(含 cache 读/写),非未命中分量——见类型头注。 */
         inputTokens: z.ZodNumber;
         outputTokens: z.ZodNumber;
-        /** 0.11.0 起 optional(RB-368 生态半场,跨仓记录在案):unpriced 部署(模型无价目)对 cost
-         *  只有「未知」这个业务态,required 逼 worker 编 0 = center 账面一个**精确的谎**。缺席=未知;
-         *  聚合面以 {@link AggregatedPrincipalUsage.costUnknown} 补偿(已知和=显式下界)。写了键 = producer
-         *  声称自己知道(0 就是真 0)。 */
         costMicroUsd: z.ZodOptional<z.ZodNumber>;
         runs: z.ZodOptional<z.ZodNumber>;
-        /** 加权 tokens(配额轴计账值,EXPERT-REDESIGN §4-1):=(input+output)×记账时的 quotaWeight,
-         *  **weight-at-burn 持久化**——倍率 publish 只影响此后记账,不回算窗口内历史(余量/恢复时间不跳变)。
-         *  0.6.0 additive optional:旧 worker 不报 → 聚合按 quotaWeight=1 兜底折算。 */
         weightedTokens: z.ZodOptional<z.ZodNumber>;
-        /** 记账时固化的该模型 quotaWeight(审计口径,与 weightedTokens 同时点)——lease 扣减与 registry 聚合两
-         *  路径按同一时点折算(同口径,§11-1)。 */
         quotaWeightAtUse: z.ZodOptional<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        principal: string;
-        model: string;
-        inputTokens: number;
-        outputTokens: number;
-        weightedTokens?: number | undefined;
-        costMicroUsd?: number | undefined;
-        runs?: number | undefined;
-        quotaWeightAtUse?: number | undefined;
-    }, {
-        principal: string;
-        model: string;
-        inputTokens: number;
-        outputTokens: number;
-        weightedTokens?: number | undefined;
-        costMicroUsd?: number | undefined;
-        runs?: number | undefined;
-        quotaWeightAtUse?: number | undefined;
-    }>, "many">;
-}, "strip", z.ZodTypeAny, {
-    entries: {
-        principal: string;
-        model: string;
-        inputTokens: number;
-        outputTokens: number;
-        weightedTokens?: number | undefined;
-        costMicroUsd?: number | undefined;
-        runs?: number | undefined;
-        quotaWeightAtUse?: number | undefined;
-    }[];
-    instanceId: string;
-    worker: string;
-    windowStartMs: number;
-    windowEndMs: number;
-}, {
-    entries: {
-        principal: string;
-        model: string;
-        inputTokens: number;
-        outputTokens: number;
-        weightedTokens?: number | undefined;
-        costMicroUsd?: number | undefined;
-        runs?: number | undefined;
-        quotaWeightAtUse?: number | undefined;
-    }[];
-    instanceId: string;
-    worker: string;
-    windowStartMs: number;
-    windowEndMs: number;
-}>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type UsageReport = z.infer<typeof UsageReport>;
 /** 额度清零事件(EXPERT-REDESIGN §4-4,契约随 E1 冻结、E4 消费):申请刷新获批即写一条;5h/周双窗聚合
  *  **只计最后一次 reset 之后**的 usage 报文(usage_report 是计费审计事实,全量留存,绝不删)。拒绝逻辑/
@@ -1282,25 +899,10 @@ export type UsageReport = z.infer<typeof UsageReport>;
 export declare const QuotaResetEvent: z.ZodObject<{
     id: z.ZodString;
     principal: z.ZodString;
-    /** 清零生效时刻(ISO)——双窗聚合的下边界。 */
     reset_at: z.ZodString;
-    /** 批准人(console username)。 */
     decided_by: z.ZodString;
-    /** 关联的 quota_refresh_request id;admin 直接清零(无申请)时可缺。 */
     request_id: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    principal: string;
-    id: string;
-    reset_at: string;
-    decided_by: string;
-    request_id?: string | undefined;
-}, {
-    principal: string;
-    id: string;
-    reset_at: string;
-    decided_by: string;
-    request_id?: string | undefined;
-}>;
+}, z.core.$strip>;
 export type QuotaResetEvent = z.infer<typeof QuotaResetEvent>;
 export interface AggregatedPrincipalUsage {
     inputTokens: number;
@@ -1327,7 +929,7 @@ export interface AggregatedPrincipalUsage {
         weightedTokens: number;
     }>;
 }
-/** Center-side fold: per-principal totals ACROSS workers/instances (the "one user, many workers, one bill"
+/** Web-admin-side fold: per-principal totals ACROSS workers/instances (the "one user, many workers, one bill"
  *  view). Pure — storage/dedup of replayed batches is the caller's concern (key batches by
  *  worker+instanceId+windowStartMs). */
 export declare function aggregateUsage(reports: UsageReport[]): Record<string, AggregatedPrincipalUsage>;