@sema-agent/settings-schema 10.1.1 → 11.1.0

package/dist/types.js

@@ -1,26 +1,34 @@
 /**
- * Config schema — the single source of truth for what the config center manages.
+ * Config schema — the single source of truth for what web-admin manages.
  *
  * Organized into DOMAINS (one top-level menu each). The UI, the store, and the service-facing API all
  * speak these types. Use zod both to validate UI input AND to derive the TS types (one definition).
  *
  * Detail level is deliberate (the user asked for "详略设计"): `models` is the MVP — fully specified —
- * while `scenarios` / `runtime` carry a real-but-skeletal schema to be fleshed out in later phases
- * (see CHANGELOG.md; `integrations`/`access` were deleted in 0.6.0, EXPERT-REDESIGN §9). Adding a
+ * while `scenarios` carries a real-but-skeletal schema to be fleshed out in later phases
+ * (see CHANGELOG.md; `integrations`/`access` were deleted in 0.6.0, EXPERT-REDESIGN §9; `runtime` was retired in 11.0.0 —
+ * see {@link RETIRED_DOMAINS}). Adding a
  * field is: extend the zod schema here → the form + the effective-config API pick it up.
  *
- * ⚠️ SECURITY BOUNDARY (see the service-integration design note): the config center stores **non-secret**
+ * ⚠️ SECURITY BOUNDARY (see the service-integration design note): web-admin stores **non-secret**
  * config only. A model's API key / a backend token is NEVER stored here as a value — we store the NAME
  * of the env var that holds it (`apiKeyEnv`, `tokenEnv`), and the agent-service reads the real secret
  * from its own environment. So a leak of this DB never leaks a credential. This is **enforced** by the
  * `ENV_NAME` schema (regex) on every `*Env` field — a pasted secret value is rejected, not just discouraged.
  */
 import { z } from "zod";
+import { INTEGER } from "./integer.js";
 import { MAX_EXTRA_BODY_DEPTH } from "./hash.js"; // reconcile the extraBody depth cap with the hash cap (R18)
 import { DispatchPolicy, FLEET_GENERATION_ENV, FLEET_SCOPE_ENV } from "./fleet.js"; // WorkerSpec.fleet.dispatch (scheduling framework D3)
-import { carriesUserinfo, percentLayers } from "./secret-scan.js"; // package-private normalization + the userinfo judgement (not in the barrel)
-import { EXECUTION_LANES, EXECUTION_LANE_WORDS, MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "./execution-lanes.js"; // 7.0.0 M-R2: the lane / store vocabulary (one exported table)
-import { LANE_ENV_OWNER, MIGRATION_SIGNPOST, isMigratableEnvKey, laneEnvSeat, laneRowOf } from "./execution-lane-index.js"; // package-private indexes derived from that table (not in the barrel)
+import { isLoopbackAuthHost } from "./loopback.js";
+import { httpUrlFlaws, httpUrlRule } from "./url-shape.js"; // 11.0.0: THE URL shape judge // 11.0.0: the one narrow「本机」predicate (auth relaxation)
+import { secretScanForms } from "./secret-scan.js"; // package-private normalization — the one set of forms both scanners read (not in the barrel)
+import { WEB_ADMIN_ENV } from "./web-admin-env.js"; // the three connection keys the config renderer writes are reserved worker env
+import { retiredEnvRefusal } from "./retired-envs.js"; // the worker env write gate asks the retired-env tombstone table too (one table, one refusal sentence)
+import { Sha256Digest } from "./sha256.js"; // the one `sha256:<hex>` digest form
+import { EXECUTION_LANES, EXECUTION_LANE_WORDS, MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS, retiredLaneWordRefusal } from "./execution-lanes.js"; // 7.0.0 M-R2: the lane / store vocabulary (one exported table)
+import { LANE_ENV_OWNER, isMigratableEnvKey, laneEnvSeat, laneRowOf } from "./execution-lane-index.js"; // package-private indexes derived from that table (not in the barrel)
+import { migrationSignpost, retiredFormSentence, retiredKey } from "./retired-form.js"; // 11.0.0: the ONE retired-form sentence + key tombstone (package-private)
 // COARSE, best-effort literal-secret SHAPE detector (NOT exhaustive — the real boundary is the env-NAME schema
 // on structured fields). Rejected in free-form value fields (worker `env`, model `extraBody`), URL components,
 // AND as an env-NAME value (an AWS key id is a valid env-NAME charset yet is a secret VALUE, not a NAME). Case-
@@ -30,9 +38,8 @@ import { LANE_ENV_OWNER, MIGRATION_SIGNPOST, isMigratableEnvKey, laneEnvSeat, la
 // 0.1.32: this is the root fix for the public-key false-positive — replaces the 0.1.31 name-based exemption,
 // which review flagged as a bypass (a private key misnamed `*_PUBKEY` skipped scanning entirely).
 /** A private-key PEM header (`-----BEGIN [RSA |EC |OPENSSH |ENCRYPTED ]PRIVATE KEY`), unanchored — the ONE definition
- *  of that shape, read ANYWHERE in a string by BOTH judges: the validation detector {@link containsSecretToken}
- *  (`scanForSecret`, on every percent layer — 10.0.0) and the display redactor `redactSecrets` (config-fns, on every display-side
- *  normalized form). {@link SECRET_LITERAL_RE} is also composed from it (anchored, as one of its branches — the exported per-token
+ *  of that shape, read ANYWHERE in a string by BOTH sides of the one scanner: the validation detector {@link containsSecretToken}
+ *  (`scanForSecret`, 10.0.0) and the display redactor `redactSecrets` (config-fns) — on the same normalized forms since 11.0.0. {@link SECRET_LITERAL_RE} is also composed from it (anchored, as one of its branches — the exported per-token
  *  literal shape). The header carries spaces, so the token-splitting passes can never isolate it; before 10.0.0 the validation side
  *  therefore saw it only at the very start of a string, and a PEM behind a newline, a `key: ` prefix or any other text rode past
  *  every free-text write port while the display side already withheld it (a `key=`-prefixed percent-encoded
@@ -63,6 +70,11 @@ function scanForSecret(s) {
     // the token; the JWT dot is handled above). R12. */
     if (/(?:^|[^A-Za-z0-9_-])(?:bearer|basic)[ \t]+\S{8,4096}/i.test(s))
         return true;
+    // The same scheme followed by an ENCODED space (`+` form-encoding, `%20` percent-encoding) and any token at all (S-797, 11.0.0):
+    // an encoded space is the mark of an encoded header VALUE (`note:Basic+dTpw`, `x-Bearer%20abc123`), not prose, so the 8-char floor
+    // the plain-space arm keeps against prose (`Basic auth`) does not apply. The boundary admits `-` / `_` (`x-Bearer%20…`). Bounded.
+    if (/(?:^|[^A-Za-z0-9])(?:bearer|basic)(?:\+|%20)[^\s+%]{1,4096}/i.test(s))
+        return true;
     // a JWT (3 dot-joined base64url segments, header starts `eyJ`) searched anywhere — so a mid-string one
     // survives the tokenizer's dot-split. ReDoS-SAFE: a token-boundary prefix `(?:^|[^A-Za-z0-9_-])` (one start
     // per word, so `"eyJ".repeat(n)` is a single anchored start = linear, not the quadratic an unanchored scan
@@ -81,18 +93,43 @@ function scanForSecret(s) {
  *  fs path — so the worker dies at exec/boot, not at config edit. A NUL is never legitimate in a command / path
  *  / host / image, so reject it on every exec-bound string field (mcp stdio + the whole remoteExec contract). R20. */
 export const hasNul = (s) => s.includes("\0");
-/** Does `s` contain a secret-shaped token? Scans every percent layer of it — the raw string AND up to three tolerant
- *  percent-decoded layers (a secret can hide as `%73%6B-…`; the ONE definition of those layers is `percentLayers` in the
- *  package-private `./secret-scan`) — so mcp args / execution coords / URL components all get uniform percent-decode coverage.
- *  Tokenized + JWT-aware (see scanForSecret), plus a private-key PEM header read ANYWHERE in any layer ({@link PRIVATE_KEY_PEM_HEADER},
- *  10.0.0 — the display redactor reads the same regex). Shared by every free-text write port (NON_SECRET_URL, mcp stdio, execution coords, ssh login, worker env, …). Round-4/5/11. (6.3.0 moved
- *  the decode loop out, unchanged in result — same layers, same bound, same verdict — and made it exception-free; the
- *  display-side readings the redactor also judges are not this detector's.) We do NOT fail-closed on a bare `%` — that
- *  would false-reject legit values like `100%` / `%s`. A secret glued to a malformed escape (`%ZZsk-`) is an accepted
- *  coarse-heuristic gap (no consumer reconstructs it; the real guarantee is the env-NAME boundary on structured fields).
- *  R11/R13/R14. */
+/** The one rendering of a quoted sentence: `template[0] + show(operands[0]) + template[1] + … + template[n]`. `show` defaults to
+ *  the value as written (that is how `message` is minted); a sanitizer / log boundary passes its own. */
+export function renderQuotedSentence(p, show = String) {
+    return p.template.reduce((out, part, i) => (i === 0 ? part : `${out}${show(p.operands[i - 1])}${part}`), "");
+}
+const fixed = (text) => ({ fixedText: text });
+/** Mint a custom issue's `message` + `params` from a tagged template (`buildQuotedIssue\`duplicate model "${name}"\``): every
+ *  interpolation is an operand unless wrapped in {@link fixed} (then it is template text). The ONE minting point of quoted
+ *  sentences in this file — a template literal written straight into `message` would put a value into a sentence with no record
+ *  of where it is (a source gate pins that none is left). */
+function buildQuotedIssue(strings, ...parts) {
+    const template = [strings[0]];
+    const operands = [];
+    parts.forEach((part, i) => {
+        if (typeof part === "object")
+            template[template.length - 1] += part.fixedText + strings[i + 1];
+        else {
+            operands.push(part);
+            template.push(strings[i + 1]);
+        }
+    });
+    const params = { template, operands };
+    return { message: renderQuotedSentence(params), params };
+}
+/** Does `s` contain a secret-shaped token? —— **the one scanner** (11.0.0, S-1274): the write side (this detector, behind every
+ *  free-text write port — NON_SECRET_URL, mcp stdio, execution coords, ssh login, worker env, extraBody, …) and the display side
+ *  (`redactSecrets`) read the SAME normalized forms ({@link secretScanForms} in the package-private `./secret-scan`: the raw string,
+ *  up to three tolerant percent-decoded layers, each layer's boundary reading, each of those read the form-encoded way with `+` as a
+ *  space) through the SAME shape table ({@link scanForSecret}). A string whose normalization did not finish (a fourth layer would
+ *  still decode something) counts as secret-shaped: what cannot be normalized is not judged clean. Before 11.0.0 this detector read
+ *  only the percent layers, so a header spelled only in a deeper layer or with `+` for its spaces passed write validation while the
+ *  display side withheld it. We do NOT fail-closed on a bare `%` — that would false-reject legit values like `100%` / `%s`. A secret
+ *  glued to a malformed escape (`%ZZsk-`) is an accepted coarse-heuristic gap (the real guarantee is the env-NAME boundary on
+ *  structured fields). R11/R13/R14. */
 export function containsSecretToken(s) {
-    return percentLayers(s).some((form) => scanForSecret(form));
+    const scan = secretScanForms(s);
+    return scan.unresolved || scan.forms.some((form) => scanForSecret(form));
 }
 /** Scan a URL's PATH + query + fragment (KEYS and values, decoded, tokenized) for a secret-shaped literal.
  *  Userinfo is handled separately (NON_SECRET_URL bans it; the ssh username is scanned by `containsSecretToken`). Round-4/5. */
@@ -126,24 +163,57 @@ export function urlQueryFragmentHasSecret(u) {
     }
     return false;
 }
-// A URL that must NOT embed credentials in userinfo (`https://user:pass@host`) or smuggle a secret-shaped value
-// into the query/fragment — those would store a secret VALUE in the config + ship it on /effective (defeating
-// the env-NAME boundary). Must be an http(s) URL with a host (the scheme check rejects file://host/… /
-// javascript://host/… that DO carry a host). Round 2-5 hardening.
-export const NON_SECRET_URL = z
-    .string()
-    .url()
-    .refine((s) => {
-    try {
-        const u = new URL(s);
-        if (!(u.protocol === "http:" || u.protocol === "https:") || !u.host || carriesUserinfo(u))
-            return false;
-        return !urlQueryFragmentHasSecret(u);
-    }
-    catch {
-        return true; // already passed .url(); unreachable in practice
+/** The parts every {@link NON_SECRET_URL} seat forbids: userinfo (a credential in the URL — it would store a secret VALUE in the
+ *  config and ship it on /effective, defeating the env-NAME boundary) and a fragment (never sent; anything a consumer appends
+ *  after it is dropped with it — the engine and server refuse a model route root that carries one, so a stored one only fails
+ *  later, on the worker). A query is a legitimate request parameter (`?api-version=…`) and stays. */
+const NON_SECRET_URL_FORBIDS = ["userinfo", "fragment"];
+/** The refusal sentence of one flaw at a {@link NON_SECRET_URL} seat: the judge's rule sentence, and — for the one flaw that stored data
+ *  can carry from before 11.0.0 (a fragment) at a seat the one-time migration reaches — the signpost to the migration that strips
+ *  it, joined the way the other signposted refusals join it (`<rule>; <signpost>`). Closed over the judge's flaw words: a new word is
+ *  a compile error here. */
+function nonSecretUrlSentence(flaw, reachedByMigration) {
+    switch (flaw) {
+        case "fragment":
+            return reachedByMigration ? `${httpUrlRule(flaw)}; ${migrationSignpost("SS-M7", "11.0.0")}` : httpUrlRule(flaw);
+        case "not-http-url":
+        case "userinfo":
+        case "query":
+            return httpUrlRule(flaw);
+        default: {
+            const unhandled = flaw;
+            throw new Error("nonSecretUrlSentence: unhandled flaw word", { cause: unhandled });
+        }
     }
-}, "must be an http(s) URL with a host and NO credentials in the userinfo/query/fragment — secrets go in the *Env (env-NAME) fields");
+}
+/** One judge, two seat kinds — the only difference is the fragment refusal's migration signpost. `reachedByMigration` = the seat sits in a
+ *  stored domain document, which the one-time migration SS-M7 rewrites (it finds its seats by this schema's identity, so "carries the
+ *  signpost" and "is rewritten by SS-M7" cannot drift apart). */
+function createNonSecretUrl(reachedByMigration) {
+    return z.string().superRefine((s, ctx) => {
+        const flaws = httpUrlFlaws(s, NON_SECRET_URL_FORBIDS);
+        for (const flaw of flaws)
+            ctx.addIssue({ code: "custom", message: nonSecretUrlSentence(flaw, reachedByMigration), params: { flaw } });
+        if (flaws.length === 0 && urlQueryFragmentHasSecret(new URL(s))) {
+            ctx.addIssue({ code: "custom", message: "must not carry a secret-shaped value in its path or query — secrets go in the *Env (env-NAME) fields" });
+        }
+    });
+}
+/** A URL handed to `fetch` that carries no credential: judged by THE URL shape judge ({@link httpUrlFlaws}, `./url-shape`) — a
+ *  hierarchical http(s) URL with neither userinfo nor a fragment (an empty `#` included, 11.0.0) — and with no secret-shaped value
+ *  in its path or query ({@link urlQueryFragmentHasSecret}). One issue per flaw, its message the judge's rule sentence (no value
+ *  echoed; a fragment's also names its migration, {@link nonSecretUrlSentence}); `params.flaw` carries the rule word.
+ *
+ *  This is the seat of every URL in a stored DOMAIN document (models `baseUrl`, mcp `url`, `sessionMirror.engineUrl`, workers
+ *  `gitApiBaseUrl`). A URL outside the domain documents — `remote-exec.json`'s endpoints, the web-admin credential envelope's
+ *  `issuer` — uses {@link NON_SECRET_URL_NO_MIGRATION}.
+ *
+ *  The value is kept EXACTLY as written: nothing here trims or normalizes it (zod's own `.url()` would hand back a rewritten string). */
+export const NON_SECRET_URL = createNonSecretUrl(true);
+/** {@link NON_SECRET_URL}'s judge for a seat no one-time migration reaches (not a domain document): identical rules and rule
+ *  sentences, but a fragment's refusal carries no migration signpost — pointing at a migration that cannot rewrite the value would
+ *  send the operator to a command that does nothing for it. */
+export const NON_SECRET_URL_NO_MIGRATION = createNonSecretUrl(false);
 /** Validate a free-form `extraBody`: returns true = UNSAFE (reject). A GETTER-FREE, descriptor-based, bounded
  *  walk that rejects — WITHOUT ever invoking a getter (a malicious getter could throw a secret-bearing message,
  *  or return different values across the validate vs persist JSON.stringify calls) — anything that isn't plain
@@ -228,19 +298,19 @@ function vetFreeFormJson(v, field) {
         rawUnsafe = extraBodyUnsafe(v);
     }
     catch {
-        return { ok: false, message: `${field} could not be validated (reflective access threw)` }; // R11
+        return { ok: false, ...buildQuotedIssue `${fixed(field)} could not be validated (reflective access threw)` }; // R11
     }
     if (rawUnsafe)
-        return { ok: false, message: `${field}: a key/value is a secret shape, non-JSON (Infinity/function/Map), an accessor, cyclic, or too deep` };
+        return { ok: false, ...buildQuotedIssue `${fixed(field)}: a key/value is a secret shape, non-JSON (Infinity/function/Map), an accessor, cyclic, or too deep` };
     let clone;
     try {
         clone = JSON.parse(JSON.stringify(v)); // the ONLY serialization — its result is what we scan AND persist
     }
     catch {
-        return { ok: false, message: `${field} is not JSON-serializable` };
+        return { ok: false, ...buildQuotedIssue `${fixed(field)} is not JSON-serializable` };
     }
     if (extraBodyUnsafe(clone))
-        return { ok: false, message: `${field}: its serialized form carries a secret` };
+        return { ok: false, ...buildQuotedIssue `${fixed(field)}: its serialized form carries a secret` };
     return { ok: true, value: clone };
 }
 /** The transform of every **parse-transparent free-form** key (`z.unknown().optional().transform(createFreeFormTransform(field))`:
@@ -253,7 +323,7 @@ function createFreeFormTransform(field) {
             return undefined;
         const vetted = vetFreeFormJson(v, field);
         if (!vetted.ok) {
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: vetted.message });
+            ctx.addIssue({ code: "custom", message: vetted.message, params: vetted.params });
             return z.NEVER;
         }
         return vetted.value;
@@ -264,14 +334,14 @@ function createFreeFormTransform(field) {
 export const K8S_QUANTITY = z.string().regex(/^\d+(\.\d+)?(m|[kKMGTPE]i?)?$/, 'must be a k8s quantity like "250m", "512Mi", "1Gi"');
 /** A TCP port: 1–65535. ONE shared schema so every port field (workers.runtime.store.db.port, ssh.port, …) bounds
  *  the SAME way — a port of 65536/0/-1 is config corruption, reject it at validation, not at connect time. R16. */
-export const TCP_PORT = z.number().int().positive().max(65535);
+export const TCP_PORT = INTEGER.positive().max(65535);
 /** Per-1M-token price ($/Mtok). Maps to the service's MODEL_COST_INPUT/OUTPUT/CACHE_READ/CACHE_WRITE
  *  (budget.ts buildPricing → per-principal cost gate). Lives on the models catalog (ModelEntry.cost) — the
  *  single pricing source (worker.model, the old second consumer, was deleted in 0.7.0). A free model declares
  *  0s (core 1.26: missing cost ≠ cheapest). */
-// `.finite()` on every $/Mtok field: `z.number().nonnegative()` accepts Infinity (Infinity >= 0), which then
-// JSON.stringify's to `null` on write → a later read fails "expected number, received null" (fail-closed at the
-// WRONG time). `.int()` fields are already Infinity-safe (Infinity isn't an integer). Round-4.
+// `.finite()` on every $/Mtok field states the rule HERE rather than leaning on whether the library's `number()` admits
+// Infinity (zod 3's did): a non-finite number JSON.stringify's to `null` on write → a later read fails "expected number,
+// received null" (fail-closed at the WRONG time). Integer fields ({@link INTEGER}) are Infinity-safe by their own rule. Round-4.
 export const ModelCost = z.object({
     input: z.number().finite().nonnegative(),
     output: z.number().finite().nonnegative(),
@@ -282,12 +352,12 @@ export const ModelCost = z.object({
 // Maps 1:1 onto the worker service's config.models / config.roles / @-model allowlist (core 1.24 role
 // map). `name` is the catalog key AND the `@name` handle; `id` is the gateway's model id.
 // ── sealed-box 密钥托管(0.10.5,产品拍板铁律修订:「不存 secret 值」精化为「不存**可解明文**」)──
-// center 可存"不可解密的密文":浏览器端用执行域公钥 libsodium sealed-box(crypto_box_seal,X25519+
-// XSalsa20-Poly1305)加密后提交,center 无私钥永远解不开;caps/config 原样下发,执行侧私钥解密注入 env。
-// 明文 key 绝不出浏览器 = center 服务端代码路径里绝不出现明文。
+// web-admin 可存"不可解密的密文":浏览器端用执行域公钥 libsodium sealed-box(crypto_box_seal,X25519+
+// XSalsa20-Poly1305)加密后提交,web-admin 无私钥永远解不开;caps/config 原样下发,执行侧私钥解密注入 env。
+// 明文 key 绝不出浏览器 = web-admin 服务端代码路径里绝不出现明文。
 /** sealed-box 算法标识(v1 唯一取值)。z.literal 钉死:换算法=换值=显式契约演进,不许静默漂移。 */
 export const SEALED_BOX_ALG = "libsodium-sealedbox-x25519";
-/** base64 形状底线(标准字母表,可带 padding)。**只校验形状不校验内容**——center 是托管方不是消费方,
+/** base64 形状底线(标准字母表,可带 padding)。**只校验形状不校验内容**——web-admin 是托管方不是消费方,
  *  解密/解不开是执行侧运行时的事;这里只挡"根本不是 base64"的写入事故。 */
 export const BASE64_SHAPE = /^[A-Za-z0-9+/]+={0,2}$/;
 /** 接入模型的 sealed-box 托管密文(默认模式「直接贴 key」的存储形态)。
@@ -295,19 +365,19 @@ export const BASE64_SHAPE = /^[A-Za-z0-9+/]+={0,2}$/;
  *    真实 API key ≤ 几百字节;`.max(8192)` 只防 blob 滥用,不是格式承诺。
  *  - `publicKeyId`:加密时用的执行域公钥 id(指向 execution.publicKeys[].publicKeyId)——执行侧凭它选私钥;
  *    轮换后旧密文仍带旧 id,可解性由执行侧留存的旧私钥决定。
- *  - **write-only 纪律(消费方约定)**:center 的 GET 面永不回 ciphertext 本体(只回 publicKeyId+设置
+ *  - **write-only 纪律(消费方约定)**:web-admin 的 GET 面永不回 ciphertext 本体(只回 publicKeyId+设置
  *    时间);密文字段绝不进任何日志。schema 层不执法读面,这是 API 层的契约义务。
  *  - **与 `apiKeyEnv` 的互斥语义**:见 ModelEntry.sealedApiKey JSDoc(两者都设 = sealed 优先)。 */
 export const SealedApiKey = z.object({
-    /** sealed-box 密文,base64(形状校验 only——内容对 center 永远不透明)。 */
+    /** sealed-box 密文,base64(形状校验 only——内容对 web-admin 永远不透明)。 */
     ciphertext: z.string().min(1).max(8192).regex(BASE64_SHAPE, "ciphertext must be base64"),
     /** 加密所用执行域公钥的 id(execution.publicKeys 登记表的键)。 */
     publicKeyId: z.string().min(1).max(128),
     /** 算法标识,v1 恒为 {@link SEALED_BOX_ALG}。 */
     alg: z.literal(SEALED_BOX_ALG),
-    /** 密文设置时刻(ISO)。center 写面 server 端盖章(projects.registeredAt 同款纪律);write-only
+    /** 密文设置时刻(ISO)。web-admin 写面 server 端盖章(projects.registeredAt 同款纪律);write-only
      *  的 masked GET 面靠它+publicKeyId 展示「已于 X 设置」——密文本体永不回读。optional:执行侧
-     *  解密不依赖它,非 center 写面(本地 TOC 手写配置)缺省合法。 */
+     *  解密不依赖它,非 web-admin 写面(本地 TOC 手写配置)缺省合法。 */
     setAt: z.string().min(1).optional(),
 });
 /**
@@ -367,6 +437,10 @@ export const PARSE_TRANSPARENT_KEYS = [
         why: "它的形由同一条 override 的 `key` 决定(一个 key 一种形),执法点在读那个 key 的消费方;在这里写死形等于把所有可覆盖键的形表搬进本包。",
     },
 ];
+/** A catalog model's price / capability tier — fuels core 1.25 `selectModel({ tier })` role resolution. ONE closed set for both
+ *  places that name it (`ModelEntry.tier`, `RoleTarget.select.tier`). Not the tier-group ladder of {@link TierBindings}
+ *  (`ultra` … `lite`), which binds model NAMES to rungs. */
+export const ModelTier = z.enum(["cheap", "standard", "premium"]);
 export const ModelEntry = z.object({
     /** Catalog key + `@name` mention handle (stable, url/word-safe), e.g. "model-a". */
     name: z.string().min(1).regex(/^[a-z0-9][a-z0-9._-]*$/i, "letters/digits/._- , no spaces"),
@@ -384,27 +458,26 @@ export const ModelEntry = z.object({
      *  专家模式(env-NAME 引用,web 面折叠进「高级」);默认模式见 {@link ModelEntry}.sealedApiKey。 */
     apiKeyEnv: ENV_NAME.optional(),
     /** sealed-box 托管密文(0.10.5 默认模式「直接贴 key」;形状见 {@link SealedApiKey})。
-     *  **互斥语义(两者都设 = sealed 优先)**:`sealedApiKey` 与 `apiKeyEnv` 语义互斥——执行侧注入 env 时
-     *  sealed 解密值**压过** apiKeyEnv 引用(用户从专家模式切回默认贴 key 后,残留的 env-NAME 不得抢线)。
-     *  刻意不 schema 层拒双设(拒了=切模式必须先清旧字段,UI/迁移两头找病;优先级裁决比互斥禁令便宜)。
-     *  ABSENT = 未托管(纯 env-NAME 现状),零迁移。 */
+     *  **二选一**(11.0.0):一个模型的钥匙只有一种写法 —— `sealedApiKey` 与 `apiKeyEnv` 同设 ⇒ 本条目被拒(读写同一只判据,见本
+     *  schema 的 superRefine)。切换写法的写者负责清掉另一字段。11.0.0 之前存下的双设条目由一次性迁移 SS-M5 改写(删 `apiKeyEnv`
+     *  = 当年的生效读法「sealed 赢」)。ABSENT = 未托管(纯 env-NAME 现状)。 */
     sealedApiKey: SealedApiKey.optional(),
     /** Price/capability tier — fuels core 1.25 `selectModel({ tier })` role resolution. */
-    tier: z.enum(["cheap", "standard", "premium"]).default("standard"),
+    tier: ModelTier.default("standard"),
     reasoning: z.boolean().default(false),
     vision: z.boolean().default(false),
-    contextWindow: z.number().int().positive().optional(),
-    maxTokens: z.number().int().positive().optional(),
-    /** Auto-compaction trigger threshold (tokens) for this model — center 显式下发时本地 FileConfigStore
+    contextWindow: INTEGER.positive().optional(),
+    maxTokens: INTEGER.positive().optional(),
+    /** Auto-compaction trigger threshold (tokens) for this model — web-admin 显式下发时本地 FileConfigStore
      *  lane 必须原样保真(0.10.10:strip 导致 parse 期即丢)。消费方=壳/引擎的 compaction
      *  配置(safety-merge autoCompaction seam);ABSENT = 消费方自身默认,零迁移。 */
-    autoCompactTokens: z.number().int().positive().optional(),
+    autoCompactTokens: INTEGER.positive().optional(),
     /** Chars-per-token estimate for local token estimation (may be fractional, e.g. 3.5;CJK-heavy 模型
      *  比英文低)。与 autoCompactTokens 同班车(0.10.10 [830]④a);ABSENT = 消费方自身默认,零迁移。 */
     charsPerToken: z.number().finite().positive().optional(),
     /** Per-model prompt-guidance lines(装配 behavior 槽的 per-model 缓解句)。形对齐 core 消费面
      *  `model.promptGuidance?: string[]`(engine/llm types;prompt-assembly 战役起装配位固定于
-     *  volatile 尾前)。web/center models 域先行小切片(不等 pack 大架构)。Non-secret model
+     *  volatile 尾前)。web/web-admin models 域先行小切片(不等 pack 大架构)。Non-secret model
      *  metadata(cost/tier 同类);ABSENT = 无 per-model 句,零迁移。 */
     promptGuidance: z.array(z.string()).optional(),
     /** $/Mtok. A genuinely-free model still declares 0s (core 1.26: missing cost ≠ cheapest). */
@@ -430,12 +503,12 @@ export const ModelEntry = z.object({
             return undefined;
         const proto = typeof v === "object" && v !== null ? Object.getPrototypeOf(v) : undefined;
         if (typeof v !== "object" || v === null || Array.isArray(v) || (proto !== Object.prototype && proto !== null)) {
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: "extraBody must be a plain JSON object" });
+            ctx.addIssue({ code: "custom", message: "extraBody must be a plain JSON object" });
             return z.NEVER;
         }
         const vetted = vetFreeFormJson(v, "extraBody");
         if (!vetted.ok) {
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: vetted.message });
+            ctx.addIssue({ code: "custom", message: vetted.message, params: vetted.params });
             return z.NEVER;
         }
         return vetted.value;
@@ -481,7 +554,10 @@ export const ModelEntry = z.object({
     // suggested this; enforce it in the SCHEMA so a direct PUT / local TOC config can't ship a mis-paired model.
     // (provider:"anthropic" must set api explicitly; gateway/vllm keep the openai-completions default.) Round-4.
     if ((m.provider === "anthropic") !== (m.api === "anthropic-messages"))
-        ctx.addIssue({ code: z.ZodIssueCode.custom, message: `provider "${m.provider}" + api "${m.api}" mismatch — provider:"anthropic" ⟺ api:"anthropic-messages"`, path: ["api"] });
+        ctx.addIssue({ code: "custom", ...buildQuotedIssue `provider "${m.provider}" + api "${m.api}" mismatch — provider:"anthropic" ⟺ api:"anthropic-messages"`, path: ["api"] });
+    // 钥匙二选一(11.0.0):同设 = 两个答案回答「这个模型用哪把钥匙」。此前「sealed 压过 env」只活在注里与消费方三处优先级臂上。
+    if (m.sealedApiKey !== undefined && m.apiKeyEnv !== undefined)
+        ctx.addIssue({ code: "custom", ...buildQuotedIssue `sealedApiKey and apiKeyEnv are both set — a model's key has ONE form: keep sealedApiKey (a pasted key) or apiKeyEnv (an env-NAME), not both; ${fixed(migrationSignpost("SS-M5", "11.0.0"))}`, path: ["apiKeyEnv"] });
 });
 // `verifier` (2026-06-11, SERVICE-RESPONSE-…-PHASE2): real consumer = core's verification gate
 // (runWithVerification/resumeWithVerification resolve the verifier sub-task model via this role). Fallback
@@ -498,11 +574,26 @@ export const ModelRole = z.enum(["default", "summarize", "subagent", "team", "sy
 /** A role resolves either to a model NAME, or by capability/price (core 1.25 `{ select }`). */
 export const RoleTarget = z.union([
     z.object({ model: z.string().min(1) }),
-    z.object({ select: z.object({ tier: z.enum(["cheap", "standard", "premium"]).optional(), needs: z.array(z.enum(["vision", "reasoning"])).optional(), prefer: z.enum(["cheapest", "premium"]).optional() }) }),
+    z.object({ select: z.object({ tier: ModelTier.optional(), needs: z.array(z.enum(["vision", "reasoning"])).optional(), prefer: z.enum(["cheapest", "premium"]).optional() }) }),
 ]);
-// ── sema 档位(tiers)与档位组(tier groups)──(center 半场, core 1.265 档位车) ──────
-// core 侧接缝 = `RunnerDeps.tiers`(档位词→模型绑定的**单表**, catalog 单点增广 expandTiers);center 侧
-// 把「多套命名预配置」存成 tierGroups,下发时只解析 ACTIVE 那一套成单表(组切换=center 换表下发,零新
+/** {@link AtMention} 的模式闭集:`all` = 每个启用的模型都可 `@`;`none` = 一个都不许;`only` = 只许 `models` 里点名的那几个。 */
+export const AT_MENTION_MODES = ["all", "none", "only"];
+/** 「`@` 能点名哪些模型」(11.0.0,取代 `atModelAllowlist`)。义由 `mode` 说,不由数组空不空说:旧形一个数组靠「缺席 / 空 / 非空」
+ *  三种在场性背三种义,「一个都不许」表达不了,三个消费方各写了一只绕行。`only` 的名单至少一个名(空名单的义就是 `none`,一个义一种写法)。
+ *  全局位(`models.atMention`)缺省 `{mode:"all"}`;roster 位(`rosters[].atMention`)缺席 = 继承全局。收窄到某台 worker 的模型集
+ *  用 {@link narrowAtMention}(`./resolve-roster`)—— 一只读法。 */
+export const AtMention = z.discriminatedUnion("mode", [
+    z.object({ mode: z.literal("all") }),
+    z.object({ mode: z.literal("none") }),
+    z.object({ mode: z.literal("only"), models: z.array(z.string().min(1)).min(1) }),
+]);
+/** `models.default` 的墓碑(11.0.0,N-7):缺省模型只有 `roles.default` 一位。 */
+const MODELS_DEFAULT_RETIRED = { retiredIn: "11.0.0", now: "roles.default ({model:<catalog name>}) — the one default-model seat", migration: "SS-M9" };
+/** `atModelAllowlist` 的墓碑(11.0.0):全局位与 roster 位同一行。 */
+const AT_MODEL_ALLOWLIST_RETIRED = { retiredIn: "11.0.0", now: "atMention ({mode:\"all\"} | {mode:\"none\"} | {mode:\"only\",models:[…]})", migration: "SS-M6" };
+// ── sema 档位(tiers)与档位组(tier groups)──(web-admin 半场, core 1.265 档位车) ──────
+// core 侧接缝 = `RunnerDeps.tiers`(档位词→模型绑定的**单表**, catalog 单点增广 expandTiers);web-admin 侧
+// 把「多套命名预配置」存成 tierGroups,下发时只解析 ACTIVE 那一套成单表(组切换=web-admin 换表下发,零新
 // 引擎机制)。与 `ModelEntry.tier`(cheap/standard/premium 价格分级, core 1.25 selectModel)是两回事——
 // 那是能力/价格元数据,这是用户面的模型预配置绑定;词表也不同(max/pro/flash/lite + ultra 预留)。
 /** 档位词→catalog 模型 `name` 的绑定。值=目录键(string 引用,不 enum——开放性照 execution
@@ -519,23 +610,25 @@ export const TierBindings = z.object({
 export const TierGroup = z.object({
     /** Group key (same charset as catalog names), e.g. "daily" / "heavy". */
     name: z.string().min(1).regex(/^[a-z0-9][a-z0-9._-]*$/i, "letters/digits/._- , no spaces"),
-    tiers: TierBindings.default({}),
+    tiers: TierBindings.prefault({}),
     notes: z.string().optional(),
 });
 export const ModelsConfig = z
     .object({
-    models: z.array(ModelEntry).default([]),
-    /** 结构级显式默认模型 = catalog `name`(目录键)。与 `roles.default`(角色词)是两回事——消费方
-     *  (server resolveDefaultModelName)以本键为第一优先级,先于 roles/档位绑定;
-     *  ABSENT = 沿既有 roles/档位 fallback 链,存量 doc 零迁移。悬空 ref 写入时 fail-loud(见下
-     *  superRefine);未经 schema 的本地/存量 lane 由消费方 warn 降级(与 activeTierGroup 双层姿势一致)。 */
-    default: z.string().min(1).optional(),
-    /** role → target. Unset roles fall back to `default` (core fallback chain). */
-    roles: z.record(ModelRole, RoleTarget).default({}),
-    /** Which model names an end user may `@`-mention. Empty/undefined → all enabled models. */
-    atModelAllowlist: z.array(z.string()).optional(),
+    models: z.array(ModelEntry).prefault([]),
+    /** role → target. Unset roles fall back to `default` (core fallback chain). `roles.default` is THE default model — the one seat
+     *  (11.0.0, N-7: the structural `models.default` key is retired; it and `roles.default` used to answer the same question twice,
+     *  the main task ran the first and the core `default` role resolved the second). Which catalog entry is the default is
+     *  `resolveCatalogDefaultModel` (`./default-model`; a `{select}` default is handed back as-is for the engine to resolve). A stored
+     *  `default` key is moved here by the one-time migration SS-M9. */
+    roles: z.partialRecord(ModelRole, RoleTarget).prefault({}),
+    /** Which model names an end user may `@`-mention({@link AtMention});缺省 `{mode:"all"}`。 */
+    atMention: AtMention.prefault({ mode: "all" }),
+    /** retired 键墓碑(11.0.0):在场即拒,拒句点名一次性迁移 SS-M6。 */
+    atModelAllowlist: retiredKey("atModelAllowlist", AT_MODEL_ALLOWLIST_RETIRED),
+    default: retiredKey("models.default", MODELS_DEFAULT_RETIRED),
     /** 命名档位组预配置。只有 ACTIVE 组的绑定表会下发为引擎的 tiers 单表。 */
-    tierGroups: z.array(TierGroup).default([]),
+    tierGroups: z.array(TierGroup).prefault([]),
     /** 当前生效的档位组 name。未设(或无组)→ 不下发 tiers,引擎档位层恒惰性。 */
     activeTierGroup: z.string().optional(),
 })
@@ -548,53 +641,50 @@ export const ModelsConfig = z
     const seen = new Set();
     cfg.models.forEach((m, i) => {
         if (seen.has(m.name))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate model "${m.name}" — the catalog key (and @-handle) must be unique`, path: ["models", i, "name"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate model "${m.name}" — the catalog key (and @-handle) must be unique`, path: ["models", i, "name"] });
         seen.add(m.name);
     });
     // Catalog self-references must resolve to a real model — a dangling global `roles.{role}.model` or an
-    // `atModelAllowlist` name not in `models` ships a broken wire (the global /effective path uses eff.models
-    // directly, with no roster filter). This lived ONLY in refIntegrityIssues (sema-registry) — but the schema
+    // `atMention.models` name not in `models` ships a broken wire (the global /effective path uses eff.models
+    // directly, with no roster filter). This lived ONLY in refIntegrityIssues (web-admin) — but the schema
     // is the only guard for a local TOC config / a direct PUT. Round-4 (reproduced).
     const names = new Set(cfg.models.map((m) => m.name));
     for (const [role, t] of Object.entries(cfg.roles ?? {})) {
         if (t && "model" in t && !names.has(t.model))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `role "${role}" → model "${t.model}" is not in the catalog`, path: ["roles", role, "model"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `role "${role}" → model "${t.model}" is not in the catalog`, path: ["roles", role, "model"] });
     }
-    (cfg.atModelAllowlist ?? []).forEach((n, i) => {
-        if (!names.has(n))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `atModelAllowlist["${n}"] is not in the catalog`, path: ["atModelAllowlist", i] });
-    });
-    // 结构级 default 悬空检测(照上面 roles/allowlist 同款,写入时 fail-loud;消费方对未经 schema 的
-    // 存量/本地 lane 仍 warn 降级——与 activeTierGroup 的「写面 fail-loud + 读面 graceful」双层姿势一致)。
-    if (cfg.default !== undefined && !names.has(cfg.default)) {
-        ctx.addIssue({ code: z.ZodIssueCode.custom, message: `default "${cfg.default}" is not in the catalog`, path: ["default"] });
+    if (cfg.atMention.mode === "only") {
+        cfg.atMention.models.forEach((n, i) => {
+            if (!names.has(n))
+                ctx.addIssue({ code: "custom", ...buildQuotedIssue `atMention.models["${n}"] is not in the catalog`, path: ["atMention", "models", i] });
+        });
     }
     // 档位组 ref 完整性(照上面 roles/allowlist 悬空检测同款):组名去重 + 绑定必须命中 catalog +
     // activeTierGroup 必须命中某组(悬空 active = 下发面从「换表」静默滑成「无表」,写入时 fail-loud)。
     const groupSeen = new Set();
     cfg.tierGroups.forEach((g, i) => {
         if (groupSeen.has(g.name))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate tier group "${g.name}"`, path: ["tierGroups", i, "name"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate tier group "${g.name}"`, path: ["tierGroups", i, "name"] });
         groupSeen.add(g.name);
         for (const [tier, model] of Object.entries(g.tiers)) {
             if (typeof model === "string" && !names.has(model))
-                ctx.addIssue({ code: z.ZodIssueCode.custom, message: `tier group "${g.name}" ${tier} → model "${model}" is not in the catalog`, path: ["tierGroups", i, "tiers", tier] });
+                ctx.addIssue({ code: "custom", ...buildQuotedIssue `tier group "${g.name}" ${tier} → model "${model}" is not in the catalog`, path: ["tierGroups", i, "tiers", tier] });
         }
     });
     if (cfg.activeTierGroup !== undefined && !groupSeen.has(cfg.activeTierGroup)) {
-        ctx.addIssue({ code: z.ZodIssueCode.custom, message: `activeTierGroup "${cfg.activeTierGroup}" is not a tier group name`, path: ["activeTierGroup"] });
+        ctx.addIssue({ code: "custom", ...buildQuotedIssue `activeTierGroup "${cfg.activeTierGroup}" is not a tier group name`, path: ["activeTierGroup"] });
     }
 });
 // ── Domain: rosters (per-worker model roster — the multi-roster design note) ───────────
 // A named VIEW over the global `models` catalog: which models a worker exposes + its role map + @-allowlist.
 // A worker references one by name (WorkerSpec.roster); GET /effective?worker=<name> resolves it. Models stay
 // single-sourced in the `models` domain — a roster only references them by name (cross-domain ref checked at
-// resolution/PUT, see the multi-roster design note §6). This is what lets one sema-registry serve heterogeneous
+// resolution/PUT, see the multi-roster design note §6). This is what lets one web-admin serve heterogeneous
 // instances (OA vs review 各持异构模型) instead of a single global roster.
 export const RosterEntry = z.object({
     name: z.string().min(1).regex(/^[a-z0-9][a-z0-9._-]*$/i, "letters/digits/._- , no spaces"),
     /** Catalog model names this roster exposes (must exist in models.models[].name). Empty = the full catalog. */
-    models: z.array(z.string().min(1)).default([]),
+    models: z.array(z.string().min(1)).prefault([]),
     /**
      * 主模型角色标记(0.6.3, E3)——catalog model NAME。worker.model 废除后 service 从 roster
      * 解析 boot 主模型的归宿位:解析语义(resolve-roster)= primary 喂 `default`/`team`/`synthesize` 三角色、
@@ -605,18 +695,20 @@ export const RosterEntry = z.object({
     /** cheap 模型角色标记(同上;worker.model.cheapId 的迁移归宿,§3②)。 */
     cheapModel: z.string().min(1).optional(),
     /** Role map override; unset roles fall back to marker-derived roles, then the global models.roles. */
-    roles: z.record(ModelRole, RoleTarget).optional(),
-    /** @-mention allowlist override; unset → inherits the global models.atModelAllowlist. */
-    atModelAllowlist: z.array(z.string()).optional(),
+    roles: z.partialRecord(ModelRole, RoleTarget).optional(),
+    /** `@` 点名覆盖({@link AtMention});缺席 = 继承全局 `models.atMention`。 */
+    atMention: AtMention.optional(),
+    /** retired 键墓碑(11.0.0):在场即拒,拒句点名一次性迁移 SS-M6。 */
+    atModelAllowlist: retiredKey("atModelAllowlist", AT_MODEL_ALLOWLIST_RETIRED),
     notes: z.string().optional(),
 });
 export const RostersConfig = z
-    .object({ rosters: z.array(RosterEntry).default([]) })
+    .object({ rosters: z.array(RosterEntry).prefault([]) })
     .superRefine((cfg, ctx) => {
     const seen = new Set();
     cfg.rosters.forEach((r, i) => {
         if (seen.has(r.name))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate roster "${r.name}"`, path: ["rosters", i, "name"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate roster "${r.name}"`, path: ["rosters", i, "name"] });
         seen.add(r.name);
         // intra-roster consistency: a role target / an @-allowlist entry pinned to a model NAME must be one
         // this roster exposes (when it's a subset). Cross-domain (the name exists in the catalog) is checked at
@@ -627,39 +719,41 @@ export const RostersConfig = z
             // 0.6.3 markers: same subset-consistency line as roles/@-allowlist — a marker naming a model this
             // roster doesn't expose would derive a dangling role (dropped at resolution, but reject loudly at PUT).
             if (r.primaryModel && !allowed.has(r.primaryModel)) {
-                ctx.addIssue({ code: z.ZodIssueCode.custom, message: `roster "${r.name}" primaryModel → "${r.primaryModel}" not in roster.models`, path: ["rosters", i, "primaryModel"] });
+                ctx.addIssue({ code: "custom", ...buildQuotedIssue `roster "${r.name}" primaryModel → "${r.primaryModel}" not in roster.models`, path: ["rosters", i, "primaryModel"] });
             }
             if (r.cheapModel && !allowed.has(r.cheapModel)) {
-                ctx.addIssue({ code: z.ZodIssueCode.custom, message: `roster "${r.name}" cheapModel → "${r.cheapModel}" not in roster.models`, path: ["rosters", i, "cheapModel"] });
+                ctx.addIssue({ code: "custom", ...buildQuotedIssue `roster "${r.name}" cheapModel → "${r.cheapModel}" not in roster.models`, path: ["rosters", i, "cheapModel"] });
             }
             for (const [role, target] of Object.entries(r.roles ?? {})) {
                 if (target && "model" in target && !allowed.has(target.model)) {
-                    ctx.addIssue({ code: z.ZodIssueCode.custom, message: `roster "${r.name}" role.${role} → "${target.model}" not in roster.models`, path: ["rosters", i, "roles", role] });
+                    ctx.addIssue({ code: "custom", ...buildQuotedIssue `roster "${r.name}" role.${role} → "${target.model}" not in roster.models`, path: ["rosters", i, "roles", role] });
                 }
             }
-            (r.atModelAllowlist ?? []).forEach((name, j) => {
-                if (!allowed.has(name))
-                    ctx.addIssue({ code: z.ZodIssueCode.custom, message: `roster "${r.name}" atModelAllowlist "${name}" not in roster.models`, path: ["rosters", i, "atModelAllowlist", j] });
-            });
+            if (r.atMention?.mode === "only") {
+                r.atMention.models.forEach((name, j) => {
+                    if (!allowed.has(name))
+                        ctx.addIssue({ code: "custom", ...buildQuotedIssue `roster "${r.name}" atMention.models "${name}" not in roster.models`, path: ["rosters", i, "atMention", "models", j] });
+                });
+            }
         }
     });
 });
 // ── Domain: scenarios (场景组合配置化 — ASK-CENTER-2026-06-11-SCENARIOS, v1) ───────────────────────────
-// "组合即配置、能力钉死在部署": the center COMPOSES scenarios from the toolsets the deployment registers —
+// "组合即配置、能力钉死在部署": web-admin COMPOSES scenarios from the toolsets the deployment registers —
 // it can never mint a new capability (a new toolset = a service code change, deliberately expensive). The
 // service overlays these onto its built-in scenario table at boot; SAME NAME OVERRIDES the built-in (产品拍板
 // ①, the worker logs `sema_registry_scenarios.shadowsBuiltin` as the audit hook). Invalid entries are
 // skipped+warned worker-side, never fail boot. restart-to-apply like skills/mcp (产品拍板 ③).
 // The old skeletal roles/tools fields are gone (never stored anywhere, zero consumers, no migration).
 export const ScenarioEntry = z.object({
-    /** Scenario name — may equal a built-in name (then the center definition SHADOWS it). */
+    /** Scenario name — may equal a built-in name (then web-admin definition SHADOWS it). */
     name: z.string().regex(/^[a-z][a-z0-9-]{1,31}$/, "lowercase slug, 2-32 chars (a-z, 0-9, -)"),
     /** Toolset key from the SERVICE's registry (v1: "none" | "repo-readonly"). Deliberately a shaped string,
-     *  not an enum: the worker registry is the authority (unknown → skip+warn there), so the center never needs
+     *  not an enum: the worker registry is the authority (unknown → skip+warn there), so web-admin never needs
      *  a release just to NAME a toolset a newer service ships. */
     toolset: z.string().regex(/^[a-z][a-z0-9-]{0,63}$/, "toolset key (lowercase slug)"),
     // ScenarioEntry.prompt 已废弃(产品裁定 2026-07-17,[ref]③a;第二评审独立同判「second
-    // registry field would become an ambiguous precedence channel」):配置域 prompt 单入口=center
+    // registry field would become an ambiguous precedence channel」):配置域 prompt 单入口=web-admin
     // prompts binding(scenario 维度);引擎 API 层 TaskSpec.systemPrompt 保留(不同层,勿混)。
     // 现网无用户直删;z.object 非 strict ⇒ 存量数据带 prompt 被 strip,parse 不炸。
     // 落日(2.0.0):本条是**纯墓碑**(零代码,靠 strip 生效),没有要删的兼容码;它留在这里的唯一作用
@@ -669,12 +763,12 @@ export const ScenarioEntry = z.object({
     notes: z.string().optional(),
 });
 export const ScenarioConfig = z
-    .object({ scenarios: z.array(ScenarioEntry).default([]) })
+    .object({ scenarios: z.array(ScenarioEntry).prefault([]) })
     .superRefine((cfg, ctx) => {
     const seen = new Set();
     cfg.scenarios.forEach((sc, i) => {
         if (seen.has(sc.name))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate scenario "${sc.name}"`, path: ["scenarios", i, "name"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate scenario "${sc.name}"`, path: ["scenarios", i, "name"] });
         seen.add(sc.name);
     });
 });
@@ -699,7 +793,7 @@ export const SystemEntry = z.object({
     name: z.string().regex(/^[a-z][a-z0-9-]{1,31}$/, "lowercase slug, 2-32 chars (a-z, 0-9, -)"),
     /** Workers this system may call — its token lands in each one's SERVICE_AUTH_TOKENS CSV (S2).
      *  Cross-domain ref-checked against the workers domain. */
-    callsWorkers: z.array(z.string().min(1)).default([]),
+    callsWorkers: z.array(z.string().min(1)).prefault([]),
     /** Where the orchestrator delivers this system's credential (the CALLER's secret). v1: a BARE secret name
      *  in the orchestrator's OWN namespace (no "ns/name" — cross-namespace = an RBAC expansion, deferred until
      *  a real need). Optional: a system without deliverTo gets a minted token visible only via out-of-band ops. */
@@ -722,21 +816,21 @@ export const SystemEntry = z.object({
     rotateNonce: z.string().max(64).optional(),
     /** Overlap window (seconds) during rotation before the OLD token is retired. Absent → orchestrator default
      *  (service AI to confirm; S3). */
-    rotateGraceSec: z.number().int().positive().optional(),
+    rotateGraceSec: INTEGER.positive().optional(),
     enabled: z.boolean().default(true),
     notes: z.string().optional(),
 });
 export const SystemsConfig = z
-    .object({ systems: z.array(SystemEntry).default([]) })
+    .object({ systems: z.array(SystemEntry).prefault([]) })
     .superRefine((cfg, ctx) => {
     const seen = new Set();
     const targets = new Map(); // "secret\0key" -> index of first ENABLED claimant
     cfg.systems.forEach((sys, i) => {
         if (seen.has(sys.name))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate system "${sys.name}"`, path: ["systems", i, "name"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate system "${sys.name}"`, path: ["systems", i, "name"] });
         seen.add(sys.name);
         if (sys.deliverTo && DELIVER_DENYLIST.has(sys.deliverTo.k8sSecret)) {
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `deliverTo.k8sSecret "${sys.deliverTo.k8sSecret}" is a PLATFORM credential surface — refused (红线1)`, path: ["systems", i, "deliverTo", "k8sSecret"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `deliverTo.k8sSecret "${sys.deliverTo.k8sSecret}" is a PLATFORM credential surface — refused (红线1)`, path: ["systems", i, "deliverTo", "k8sSecret"] });
         }
         // Cross-system deliverTo collision (S3 设计 §4.5, council DESIGN-4): two enabled systems writing the
         // same {secret,key} would silently overwrite each other (same SSA fieldManager). Save-time half; the
@@ -745,7 +839,7 @@ export const SystemsConfig = z
             const t = `${sys.deliverTo.k8sSecret}\0${sys.deliverTo.key}`;
             const prior = targets.get(t);
             if (prior !== undefined) {
-                ctx.addIssue({ code: z.ZodIssueCode.custom, message: `deliverTo target "${sys.deliverTo.k8sSecret}/${sys.deliverTo.key}" already claimed by system "${cfg.systems[prior].name}" — one credential per delivery slot`, path: ["systems", i, "deliverTo"] });
+                ctx.addIssue({ code: "custom", ...buildQuotedIssue `deliverTo target "${sys.deliverTo.k8sSecret}/${sys.deliverTo.key}" already claimed by system "${cfg.systems[prior].name}" — one credential per delivery slot`, path: ["systems", i, "deliverTo"] });
             }
             else {
                 targets.set(t, i);
@@ -773,30 +867,28 @@ export const SystemStatusEntry = z.object({
     reason: z.string().max(500).optional(),
     updatedAt: z.string(),
 });
-// ── Domain: runtime (限额残余 — API/CLI-only, EXPERT-REDESIGN §5) ─────────────────
-// 0.6.0 (runtime 域废除拆三刀): the governance trio (autonomy/commandPolicy/approvalRequire) moved OUT into
-// the new `governance` domain; the legacy-skeletal `approvalDeny`/`runStaleSec` (service never read them) are
-// DELETED outright. What remains = the fleet cost/rate LIMIT residue — kept API/CLI-only (the web renders NO
-// runtime surface; the "runtime" UI concept is abolished).
-// WIRE TRANSITION — **DONE, 0.7.1**: the 0.6.0-era 双写 (buildEffective mirroring the governance keys into the
-// runtime slot until the service switched) was WITHDRAWN once service 1.150.0 confirmed it reads `eff.governance`
-// (§5 收账). Today the runtime slot carries the limit residue ONLY, and `governance` is the sole wire position of
-// the 6 gates. The transitional `RuntimeWire` alias was deleted in #282 件3 (三消费仓 grep -w 零命中) — the READ
-// direction的 legacy lift (never-set governance domain ← old runtime doc, {@link GOVERNANCE_MIRROR_KEYS}) is a
-// different mechanism and stays.
-export const RuntimeConfig = z.object({
-    // `.optional()` on every gate (settled discipline): ABSENT = "the center isn't managing this — keep your
-    // env value"; present — INCLUDING an explicit 0 — overrides (publishable "gate OFF"). A default here would
-    // silently override a deployment's env.
-    rateLimitPerMin: z.number().int().nonnegative().optional(),
-    // Fleet-level cost governance (SERVICE-RESPONSE-2026-06-11-PHASE2). All restart-to-apply, none secret.
-    // Per-worker WorkerSpec.runtime.maxPrincipalCostUsd (injected env) outranks this fleet default — precedence
-    // is the consumer's, documented in SERVICE-INTEGRATION.
-    maxTaskCostUsd: z.number().finite().nonnegative().optional(),
-    maxTaskTokens: z.number().int().nonnegative().optional(),
-    maxPrincipalCostUsd: z.number().finite().nonnegative().optional(),
-    costQuotaWindowSec: z.number().int().positive().optional(),
-});
+// ── retired 域(11.0.0)─────────────────────────────────────────────────────────────────────────────
+// `runtime` 域retired:0.6.0 起它只剩五个限额键,而 `limits`(0.19.0)全覆盖那五个键 —— 同一个限额两处可发布、判据不同、「limits 赢」
+// 只活在消费方的注里;0.5 期的 runtime 文档还带着治理三闸,读侧靠一只「governance 从未设过就抬升」的臂接住。11.0.0 两件都收:
+// 五个限额键只在 `limits`,治理三闸只在 `governance`;存量由一次性迁移 SS-M1 改写(`./one-time-migrations`)。
+/** retired 域的**墓碑表**:域名 → retired版本 / 事实今天住哪 / 改写存量的一次性迁移。读存储文档的每个读者同判(`parseDomain` 拒写、`buildEffective`
+ *  向店要retired 域、`readEffectiveWire` 看 wire、`FileConfigStore` 与 `readBundle` 读 `config.d/<名>.json`):文档**带事实**(在场且不是 `{}`)⇒ 响亮拒
+ *  (`RetiredDomainError`,句子点名迁移 id);缺席或 `{}`(没有可丢的事实)⇒ 不理会。墓碑是拒,不是读法 —— 它不把旧文档读成任何值。 */
+export const RETIRED_DOMAINS = {
+    runtime: {
+        retiredIn: "11.0.0",
+        now: "governance (autonomy / commandPolicy / approvalRequire) and limits (rateLimitPerMin / maxTaskCostUsd / maxTaskTokens / maxPrincipalCostUsd / costQuotaWindowSec)",
+        migration: "SS-M1",
+    },
+};
+/** 是不是一个retired 域名(墓碑表成员)。 */
+export function isRetiredDomainName(x) {
+    return typeof x === "string" && Object.prototype.hasOwnProperty.call(RETIRED_DOMAINS, x);
+}
+/** 一个retired 域的拒句(读写两面同一句)。 */
+export function retiredDomainSentence(domain) {
+    return retiredFormSentence(`the "${domain}" config domain`, RETIRED_DOMAINS[domain]);
+}
 // ── Domain: limits (cost/限流族的热更新发布位 — 0.19.0, 消费方 #322 批1) ──────
 // 为什么是**新顶层域**而不是往 `runtime` 里加键(消费方亲验,不是推测):`RuntimeConfig` 是 zod 默认的
 // `"strip"` 对象,`runtime` 文档里的未知键在两条腿上都被剥掉(实测 `{rateLimitPerMin:7,
@@ -805,10 +897,9 @@ export const RuntimeConfig = z.object({
 // 域表是闭集)读不到**:`config.d/limits.json` 根本不进 effective,且零告警。本域 = 那个缺口的源头修复
 // (CLI/桌面单机形正是热更新战役的主诉求形)。同族先例:governance 当年也是从 runtime 拆成独立顶层域。
 //
-// 与 `runtime` 的关系(刻意不合并,也刻意不删旧位):五个限额键(rateLimitPerMin / maxTaskCostUsd /
-// maxTaskTokens / maxPrincipalCostUsd / costQuotaWindowSec)两个位都可能出现。**优先级归消费方**并已
-// 成文(server:新位 `limits` 赢,旧位是过渡读法);本包两位都如实解析,不在契约层替消费方折叠——
-// 折叠会让「旧位有值、新位撤键」这类过渡态在两个消费者之间产生两种答案。
+// 五个限额键(rateLimitPerMin / maxTaskCostUsd / maxTaskTokens / maxPrincipalCostUsd / costQuotaWindowSec)11.0.0 起只住这里:
+// 旧位 `runtime` 域已retired(墓碑见 {@link RETIRED_DOMAINS};存量由一次性迁移 SS-M1 搬进本域,本域已有该键则旧值丢弃 —— 那是当年消费方
+// 「新位赢」的生效读法)。
 //
 // 判据分工(**宽进严出**,与既有域一致):本域只判**结构**——类型、有限数、数组/记录的元素类型。
 // 业务域值(下限、`0` 关断哨兵、跨键不变量如「窗长必 > 0」「runStaleSec 必严格大于心跳」)的判据属主
@@ -828,7 +919,7 @@ export const InfraCostRates = z
 })
     .passthrough();
 export const LimitsConfig = z.object({
-    // `.optional()` 无默认,与 RuntimeConfig 同纪律:ABSENT = 「center 不管这一键」⇒ 消费方回自己的 env 底;
+    // `.optional()` 无默认:ABSENT = 「web-admin 不管这一键」⇒ 消费方回自己的 env 底;
     // 显式值(**包括 0**)= 发布了一个真值(0 多半是「关断哨兵」,语义归消费方)。给默认值 = 静默覆盖部署。
     /** 每 principal 每分钟请求上限。 */
     rateLimitPerMin: z.number().finite().optional(),
@@ -871,7 +962,7 @@ export const LimitsConfig = z.object({
     //  · 默认的 strip 会把这个窗口变成**键被静默剥掉 ⇒ 那条天花板悄悄回落到部署 env 底** —— 正是本域
     //    要根治的那种病换了个位置复发。已知键照旧严判结构(坏值 ⇒ 本域 throw 档 ⇒ 消费方 fail-static
     //    在上一份好配置);未知键原样承运,由消费方(键表在它手里)决定认或不认。
-    //  · 附带收益:老编辑器(TOC)写回新 center 的 limits 文档时不会把自己不认识的键写没了(strip 语义下
+    //  · 附带收益:老编辑器(TOC)写回新 web-admin 的 limits 文档时不会把自己不认识的键写没了(strip 语义下
     //    writeDomainFile 会真的丢键)。
     //  · **承运 ≠ 沉默**(对抗复审 复审 round2 F2):未知成员会被 `"unknown-keys-carried"` 警告逐个点名
     //    (config-fns 的已知键表由本 schema 的 shape 单源派生)——拼错的键名于是有人说,而值仍然到得了
@@ -882,13 +973,13 @@ export const LimitsConfig = z.object({
 // ── Domain: governance (治理三件 — split out of runtime, EXPERT-REDESIGN §5) ──────
 // The governance trio an operator tunes via publish: autonomy ladder + command guardrails + approval-required
 // tools. NOT下沉 — gets its own admin tab (E5 form; E1 ships a transitional generic editor). Same `.optional()`
-// no-default discipline as the six gates: ABSENT = center 不管这项(keep env / 消费者默认),present 才生效。
+// no-default discipline as the six gates: ABSENT = web-admin 不管这项(keep env / 消费者默认),present 才生效。
 export const GovernanceConfig = z.object({
     // autonomy:一个跨 knob 的安全总开关 / 放权梯度(普通用户敢用 + 专业用户放权)。
     //   read-only(只读规划,不落改)| ask(每个放权动作问)| plan(plan-review 门)| auto(放开)。
     // ⚠️ 消费侧(service)把它**展开**到 core 已有三原语(handsReadOnly / shellGate+onAsk / plan_review),
     //   经 core 的收紧-only `tightenTaskSpec` 合并。core 裁决:不在 core 加并行 autonomy 枚举(双实现陷阱),
-    //   不静默覆盖调用者已设安全字段(auto 模式尤其不能静默清门控)。详见 sema-registry docs/CONFIG-RESEARCH §10。
+    //   不静默覆盖调用者已设安全字段(auto 模式尤其不能静默清门控)。详见 web-admin docs/CONFIG-RESEARCH §10。
     autonomy: z.enum(["read-only", "ask", "plan", "auto"]).optional(),
     // commandPolicy:命令级 allow/ask/deny 护栏(remoteExec 管"在哪跑",这管"能跑什么命令")。每条 = 一个
     //   **精确 argv[0] 命令名** → 决策;**DENY-WINS**(冲突 deny 赢,与 core `combinePolicies` 一致,NOT last-match-wins)。
@@ -899,8 +990,7 @@ export const GovernanceConfig = z.object({
     // ⚠️ COARSE / 非沙箱:只匹配 leading simple-command 名(经 core `parseLeadingCommandName` fail-closed 解析器);
     //   `$(...)` / `sh -c` / `env` / `xargs` / `find -exec` / `python -c` / 子命令都绕得过——是 egress/irreversibility
     //   安全轴之下的**纵深防御,绝非唯一隔离**(真隔离靠 executionEnv sandbox)。消费侧(service)必须经
-    //   `combinePolicies(部署默认, 本策略)` 编译进 `TaskSpec.toolPolicy`,绝不裸覆盖清掉部署级护栏;`shellGate:
-    //   "classify"` 下普通 ask 会被 irreversibility 提升为不可预算的 irreversible_ask。core 建
+    //   `combinePolicies(部署默认, 本策略)` 编译进 `TaskSpec.toolPolicy`,绝不裸覆盖清掉部署级护栏。core 建
     //   `createCoarseCommandNamePolicy` 消费它(config-research §10)。
     commandPolicy: z
         .array(z.object({
@@ -915,13 +1005,9 @@ export const GovernanceConfig = z.object({
         decision: z.enum(["allow", "ask", "deny"]),
     }))
         .optional(),
-    /** Tool names needing operator approval (F4). Moved verbatim from runtime (same ABSENT/explicit-[] semantics). */
+    /** Tool names needing operator approval (F4). ABSENT = web-admin 不管;显式 `[]` = 一个都不需要审批。 */
     approvalRequire: z.array(z.string()).optional(),
 });
-/** The governance trio keys. 0.7.1:写出方向的 runtime 双写镜像已撤(service 1.150.0 已切新位,
- *  回执确认)——此常量今日唯一职责=READ 方向的 legacy lift(governance 域从未设时从旧 runtime 文档抬升,
- *  config-fns legacyGovernanceFromRuntime),单一键源防逐键漂移。 */
-export const GOVERNANCE_MIRROR_KEYS = ["autonomy", "commandPolicy", "approvalRequire"];
 // ── integrations domain: DELETED in 0.6.0 (EXPERT-REDESIGN §9 — 零消费者实锤:service 明确排除,OA/Gitea
 // 实走 worker.env)。“按 scope connect GitHub” 是 backlog 的全新设计,不复用此形状。
 // ── access domain: DELETED in 0.6.0 (EXPERT-REDESIGN §9 — 彻底删除不留兼容;唯一消费者 agent-client portal
@@ -933,25 +1019,25 @@ export const GOVERNANCE_MIRROR_KEYS = ["autonomy", "commandPolicy", "approvalReq
 // every principal's tier/budget to a worker), and `/effective?principal=` resolves the per-principal view
 // (effective = worker-base ∩ tier⊕roles ∩ time-bounded overrides; intersection = either side's "deny" wins).
 // Minimal records — never raw usage numbers (those live in the data plane / telemetry).
-/** Token budget — LiteLLM-interop vocab + the center-specific DEGRADE mode + a per-RUN admission gate. */
+/** Token budget — LiteLLM-interop vocab + web-admin-specific DEGRADE mode + a per-RUN admission gate. */
 export const EntitlementBudget = z.object({
-    /** soft = alert only · hard = pre-call block · degrade = fall back to a cheaper model (center-specific). */
+    /** soft = alert only · hard = pre-call block · degrade = fall back to a cheaper model (web-admin-specific). */
     mode: z.enum(["soft", "hard", "degrade"]).optional(),
     // .finite() on every $/USD float: z.number().nonnegative() accepts Infinity, which JSON.stringify's to null on
     // persist → a later strict reparse throws (fail-open on write, fail-hard on read). Same discipline as ModelCost.
     maxBudgetUsd: z.number().finite().nonnegative().optional(),
     budgetDuration: z.string().optional(), // e.g. "30d"
-    tpmLimit: z.number().int().nonnegative().optional(),
-    rpmLimit: z.number().int().nonnegative().optional(),
-    maxParallelRequests: z.number().int().nonnegative().optional(),
-    perModel: z.record(z.string(), z.object({ maxBudgetUsd: z.number().finite().nonnegative().optional(), tpmLimit: z.number().int().nonnegative().optional(), rpmLimit: z.number().int().nonnegative().optional() })).optional(),
+    tpmLimit: INTEGER.nonnegative().optional(),
+    rpmLimit: INTEGER.nonnegative().optional(),
+    maxParallelRequests: INTEGER.nonnegative().optional(),
+    perModel: z.record(z.string(), z.object({ maxBudgetUsd: z.number().finite().nonnegative().optional(), tpmLimit: INTEGER.nonnegative().optional(), rpmLimit: INTEGER.nonnegative().optional() })).optional(),
     /** Per-RUN admission gate (agentic-runaway guard, §3.3 🔴) — period budgets can't stop ONE runaway run. */
     maxRunCostUsd: z.number().finite().nonnegative().optional(),
-    maxIterations: z.number().int().positive().optional(),
+    maxIterations: INTEGER.positive().optional(),
     /** WHERE this budget is enforced (scheduling framework D4, 产品拍板 2026-07-04): `local` = worker-only
-     *  (per-instance or shared-DB — today's posture) · `lease` = AP pre-authorized QuotaLease from center +
+     *  (per-instance or shared-DB — today's posture) · `lease` = AP pre-authorized QuotaLease from web-admin +
      *  after-the-fact reconciliation (default for sema-managed fleets) · `central` = CP pre-call check against
-     *  center (strict tenants; slow but exact). ABSENT = local. Orthogonal to `mode` (what happens on breach). */
+     *  web-admin (strict tenants; slow but exact). ABSENT = local. Orthogonal to `mode` (what happens on breach). */
     enforcement: z.enum(["local", "lease", "central"]).optional(),
 });
 /** Token 双窗额度(配额轴, EXPERT-REDESIGN §4 — Claude 式 5h 滚动窗 + 自然周窗),单位=加权 tokens
@@ -961,9 +1047,9 @@ export const EntitlementBudget = z.object({
  *  更严;tokenQuota 不参与 budget 的 min-of-budgets 归并。任一窗耗尽即拒(CC 式拒绝+恢复时间,E4)。 */
 export const TokenQuota = z.object({
     /** 5h 滚动窗额度(加权 tokens)。ABSENT = 此窗不设限。 */
-    fiveHourTokens: z.number().int().nonnegative().optional(),
+    fiveHourTokens: INTEGER.nonnegative().optional(),
     /** 自然周窗额度(加权 tokens)。ABSENT = 此窗不设限。 */
-    weeklyTokens: z.number().int().nonnegative().optional(),
+    weeklyTokens: INTEGER.nonnegative().optional(),
 });
 /** 预算组(共享钱池,§4-1)——与个人 budget 双轨并行:一笔花费计入个人轨 + 所有所属池;多池并存取最先
  *  耗尽;tokens 配额轴(TokenQuota)与它是两轨,先到顶者生效。成员条目带 `memberSince`:池只聚合入组时刻
@@ -982,60 +1068,60 @@ export const BudgetGroup = z.object({
         .object({
         /** instance-level group ids(registry `groups` 表——store 对象,zod 看不见,存在性同 groupBindings
          *  先例不做 schema 校验,dangling 由 UI 标红)。 */
-        groups: z.array(BudgetGroupMember.extend({ group: z.string().min(1) })).default([]),
-        principals: z.array(BudgetGroupMember.extend({ principal: z.string().min(1) })).default([]),
+        groups: z.array(BudgetGroupMember.extend({ group: z.string().min(1) })).prefault([]),
+        principals: z.array(BudgetGroupMember.extend({ principal: z.string().min(1) })).prefault([]),
     })
-        .default({ groups: [], principals: [] }),
+        .prefault({ groups: [], principals: [] }),
 });
 /** 生效场景分配(§7,与配额同一挂载心智):全局默认 + 按组 + 按用户三层;解析优先级=用户 > 组 > 全局默认
- *  > worker 级 runtime.scenario 兜底(引擎兜底行为待 ask② 确认)。`scenario` 是场景 NAME——可指 center
+ *  > worker 级 runtime.scenario 兜底(引擎兜底行为待 ask② 确认)。`scenario` 是场景 NAME——可指 web-admin
  *  scenarios 域条目,也可指 service 内建场景名(内建不在域里,故**不做** cross-domain 存在性硬校验,
  *  dangling 由 UI 标注)。 */
 export const ScenarioAssignments = z.object({
     /** 全局默认场景名。ABSENT = 不设全局默认(落到 worker 级 runtime.scenario / 引擎内建)。 */
     default: z.string().min(1).optional(),
-    groups: z.array(z.object({ group: z.string().min(1), scenario: z.string().min(1) })).default([]),
-    principals: z.array(z.object({ principal: z.string().min(1), scenario: z.string().min(1) })).default([]),
+    groups: z.array(z.object({ group: z.string().min(1), scenario: z.string().min(1) })).prefault([]),
+    principals: z.array(z.object({ principal: z.string().min(1), scenario: z.string().min(1) })).prefault([]),
 });
 /** Org-forced-off runtime ceilings (gate②). ABSENT = no ceiling (local controls); `false` = org-disabled
  *  fleet-wide. Only ever pushes the "off" ceiling — never force-enables (monotone tighten-only). */
 export const EntitlementRuntimeCaps = z.object({
     allowBypassPermissions: z.boolean().optional(),
     allowAutoMode: z.boolean().optional(),
-    /** Per-principal governance of the workflow/ultracode capability (K-2, 产品拍板 2026-06-28). center treats this as
+    /** Per-principal governance of the workflow/ultracode capability (K-2, 产品拍板 2026-06-28). web-admin treats this as
      *  the "准不准" axis; the engine separately advertises "能不能" (Capabilities.workflows). The shell enables
      *  ultracode/workflows iff engine-capable ∧ principal-entitled. Like the others: ABSENT = no ceiling,
      *  `false` = org-disabled fleet-wide (tighten-only false-wins; never force-enables). Full server-side
      *  enforcement awaits core adding a per-principal authz axis that consumes this; until then it gates the shell UI. */
     allowWorkflows: z.boolean().optional(),
-    /** Per-principal governance of the Fork (fork-session) tool — center's "准不准" axis, mirroring allowWorkflows.
+    /** Per-principal governance of the Fork (fork-session) tool — web-admin's "准不准" axis, mirroring allowWorkflows.
      *  The engine advertises "能不能" separately; a Fork is admitted iff engine-capable ∧ principal-entitled. Like the
      *  others: ABSENT = no ceiling (Fork allowed), `false` = org-disabled fleet-wide (tighten-only false-wins; never
      *  force-enables). core (RuntimeCaps.allowFork, prepare-task) consumes this per-principal: `allowFork === false`
      *  → Fork DENIED, else allowed. */
     allowFork: z.boolean().optional(),
     /** Per-principal governance of observer agents (core 1.270.0/1.273.0 OBS-2) —
-     *  center's "准不准" axis for the AgentDefinition.observer pairing surface. ⚠️ core's consumption polarity is
+     *  web-admin's "准不准" axis for the AgentDefinition.observer pairing surface. ⚠️ core's consumption polarity is
      *  INVERTED vs the other allow* caps: the engine is `=== true` explicit opt-in (default OFF — an undefined cap
      *  ships dark), so this key is the ENABLE line, not just a ceiling. Three-state semantics (ABSENT ≠ false):
-     *  ABSENT = center says nothing → key NOT emitted on the wire (core stays the SOLE default source; service's
+     *  ABSENT = web-admin says nothing → key NOT emitted on the wire (core stays the SOLE default source; service's
      *  toCoreRuntimeCaps must not backfill a missing key into an explicit verdict — that would poison the
      *  env-baseline compose order); `true` = explicitly enable observer agents for this principal; `false` =
-     *  explicit org deny — overrides the node-level env baseline EXPERIMENTAL_OBSERVER_AGENTS (center speaks →
-     *  center wins). On compose across bundles, `false` (deny) still wins — see RUNTIME_CAP_STRICT; core's
+     *  explicit org deny — overrides the node-level env baseline EXPERIMENTAL_OBSERVER_AGENTS (web-admin speaks →
+     *  web-admin wins). On compose across bundles, `false` (deny) still wins — see RUNTIME_CAP_STRICT; core's
      *  `=== true` opt-in check is orthogonal to that merge polarity. */
     allowObservers: z.boolean().optional(),
     /** Per-principal ARM switch for the auto-mode CLASSIFIER (core 1.276 批2 seam `RuntimeCaps.autoMode`, 板
      *  A surviving permission `ask` is routed to the small-model security classifier before any
      *  human/durable resolution). ⚠️ Same INVERTED consumption polarity as `allowObservers`: core is `=== true`
      *  explicit opt-in, default OFF — this key is the ENABLE line, not just a ceiling. Three-state semantics
-     *  (ABSENT ≠ false): ABSENT = center says nothing → key NOT emitted on the wire (core stays the SOLE default
+     *  (ABSENT ≠ false): ABSENT = web-admin says nothing → key NOT emitted on the wire (core stays the SOLE default
      *  source — never backfill absence into an explicit verdict); `true` = explicitly arm the classifier for this
      *  principal (a no-op on a deployment without a wired classify leg — the capability gate lives in core);
      *  `false` = explicit org deny. On compose across bundles `false` (deny) wins — see RUNTIME_CAP_STRICT;
      *  core's `=== true` opt-in check is orthogonal to that merge polarity. DIVISION OF LABOR vs
      *  {@link allowAutoMode}: `allowAutoMode` is the 准入 may-I ceiling on the USER-facing auto permission mode
-     *  (shell/settings face, tighten-only); `autoMode` is center's 部署 arm decision for the server-side
+     *  (shell/settings face, tighten-only); `autoMode` is web-admin's 部署 arm decision for the server-side
      *  classifier leg itself. */
     autoMode: z.boolean().optional(),
     allowUltracode: z.boolean().optional(),
@@ -1043,18 +1129,18 @@ export const EntitlementRuntimeCaps = z.object({
      *  (design/383 §3.1): may this principal declare `memory.capture: "off"` for a run? `false` = the deployment
      *  REQUIRES capture for this principal (compliance / knowledge retention) — the declaration is refused, terminal
      *  (`memory.capture_optout_denied`). `true` = explicitly no per-principal restriction. Three-state, ABSENT ≠ false:
-     *  ABSENT = center says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
+     *  ABSENT = web-admin says nothing → key NOT emitted on the wire (never coined into a verdict). The consumer's
      *  fault-transit contract for THIS member runs opposite to the `{allowWorkflows:false}` degrade habit: a resolver
      *  FAULT must surface as ABSENT (or a throw), never as a stand-in `false` — on the privacy axis "deny" is the
      *  IRREVERSIBLE side (capturing a session the user said not to capture), so the default/`open` posture reads a
      *  fault as "opt-out honoured + named disclosure", and a `governed` posture reads it as "verdict missing ⇒
-     *  refuse the run". The consumer composes this key from its own local grant store FIRST and the center value
+     *  refuse the run". The consumer composes this key from its own local grant store FIRST and web-admin value
      *  second. Compose polarity across bundles is the allow* family's: `false` (capture required) wins — see
-     *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: the center value
+     *  RUNTIME_CAP_STRICT; the consumer's posture arms are orthogonal to that merge. Consumer-side: web-admin value
      *  reaches the engine caps only once the consumer's cap mapping picks this member up; until then its local grant
      *  store is the sole verdict source (the key parses and is carried on the wire from this version on). */
     allowMemoryOptOut: z.boolean().optional(),
-    /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
+    /** Force this principal's run onto durable-approval (per-tool gate) — web-admin's fleet-wide handle for CC-faithful
      *  per-tool interception (K-3, core confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
      *  here `true` is the STRICT/tightening value (forcing the gate ON), so it wins on compose — see RUNTIME_CAP_STRICT.
      *  ABSENT = no fleet override (local/default resolution decides). Server-side enforcement = core's per-principal axis. */
@@ -1106,7 +1192,7 @@ export const EntitlementOverride = z
     key: z.string().min(1),
     /** The override's value — its SHAPE follows its `key`, so it is parse-transparent here and validated by
      *  whoever enforces that key: {@link PARSE_TRANSPARENT_KEYS} (`entitlement.subjects[].overrides[].value`). */
-    value: z.unknown(),
+    value: z.unknown().optional(),
     effectiveFrom: z.string().optional(),
     effectiveUntil: z.string().optional(),
     approvedBy: z.string().min(1),
@@ -1118,15 +1204,15 @@ export const EntitlementOverride = z
     // by env-NAME, never inline. (Budget overrides are numbers/enums, so this never fires on the v1 use.)
     const s = typeof o.value === "string" ? o.value : o.value == null ? "" : JSON.stringify(o.value);
     if (s && containsSecretToken(s))
-        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "override.value appears to contain a secret token — overrides are persisted + audited; reference secrets by env-NAME, never inline a value", path: ["value"] });
+        ctx.addIssue({ code: "custom", message: "override.value appears to contain a secret token — overrides are persisted + audited; reference secrets by env-NAME, never inline a value", path: ["value"] });
 });
 export const EntitlementSubject = z.object({
     principal: z.string().min(1),
     displayName: z.string().optional(),
     tierId: z.string().optional(),
     /** Additional tier ids composed on top of `tierId` (union of allows, min of budgets) — the "role combo". */
-    roles: z.array(z.string()).default([]),
-    overrides: z.array(EntitlementOverride).default([]),
+    roles: z.array(z.string()).prefault([]),
+    overrides: z.array(EntitlementOverride).prefault([]),
     /** 用户层 token 双窗额度(最具体层,压过组与全局默认——极性见 {@link TokenQuota})。 */
     tokenQuota: TokenQuota.optional(),
 });
@@ -1141,7 +1227,7 @@ export const EntitlementGroupBinding = z.object({
     group: z.string().min(1),
     tierId: z.string().optional(),
     /** Additional tier ids composed on top of `tierId` — same "role combo" shape as EntitlementSubject. */
-    roles: z.array(z.string()).default([]),
+    roles: z.array(z.string()).prefault([]),
     /** 组层 token 双窗额度(同层多组命中取更严;被用户层压过——极性见 {@link TokenQuota})。 */
     tokenQuota: TokenQuota.optional(),
 });
@@ -1158,12 +1244,12 @@ export const EntitlementConfig = z
         tokenQuota: TokenQuota.optional(),
     })
         .optional(),
-    tiers: z.array(EntitlementTier).default([]),
-    subjects: z.array(EntitlementSubject).default([]),
+    tiers: z.array(EntitlementTier).prefault([]),
+    subjects: z.array(EntitlementSubject).prefault([]),
     /** Group bindings (W4, additive 0.4.0) — bind an instance-level GROUP to a tier ⊕ roles combo. */
-    groupBindings: z.array(EntitlementGroupBinding).default([]),
+    groupBindings: z.array(EntitlementGroupBinding).prefault([]),
     /** 预算组(共享钱池,0.6.0 §4)——见 {@link BudgetGroup}。 */
-    budgetGroups: z.array(BudgetGroup).default([]),
+    budgetGroups: z.array(BudgetGroup).prefault([]),
     /** 生效场景分配(0.6.0 §7)——见 {@link ScenarioAssignments}。 */
     scenarioAssignments: ScenarioAssignments.optional(),
 })
@@ -1171,53 +1257,53 @@ export const EntitlementConfig = z
     const tierIds = new Set();
     cfg.tiers.forEach((t, i) => {
         if (tierIds.has(t.id))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate tier id "${t.id}"`, path: ["tiers", i, "id"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate tier id "${t.id}"`, path: ["tiers", i, "id"] });
         tierIds.add(t.id);
     });
     const seenPools = new Set();
     cfg.budgetGroups.forEach((b, i) => {
         if (seenPools.has(b.id))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate budget group id "${b.id}"`, path: ["budgetGroups", i, "id"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate budget group id "${b.id}"`, path: ["budgetGroups", i, "id"] });
         seenPools.add(b.id);
     });
     const seenGroups = new Set();
     cfg.groupBindings.forEach((g, i) => {
         if (seenGroups.has(g.group))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate group binding "${g.group}"`, path: ["groupBindings", i, "group"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate group binding "${g.group}"`, path: ["groupBindings", i, "group"] });
         seenGroups.add(g.group);
         if (g.tierId && !tierIds.has(g.tierId))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `group binding "${g.group}" → unknown tier "${g.tierId}"`, path: ["groupBindings", i, "tierId"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `group binding "${g.group}" → unknown tier "${g.tierId}"`, path: ["groupBindings", i, "tierId"] });
         g.roles.forEach((r, j) => { if (!tierIds.has(r))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `group binding "${g.group}" → unknown role/tier "${r}"`, path: ["groupBindings", i, "roles", j] }); });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `group binding "${g.group}" → unknown role/tier "${r}"`, path: ["groupBindings", i, "roles", j] }); });
     });
     const seen = new Set();
     cfg.subjects.forEach((s, i) => {
         if (seen.has(s.principal))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate subject principal "${s.principal}"`, path: ["subjects", i, "principal"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate subject principal "${s.principal}"`, path: ["subjects", i, "principal"] });
         seen.add(s.principal);
         if (s.tierId && !tierIds.has(s.tierId))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `subject "${s.principal}" → unknown tier "${s.tierId}"`, path: ["subjects", i, "tierId"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `subject "${s.principal}" → unknown tier "${s.tierId}"`, path: ["subjects", i, "tierId"] });
         s.roles.forEach((r, j) => { if (!tierIds.has(r))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `subject "${s.principal}" → unknown role/tier "${r}"`, path: ["subjects", i, "roles", j] }); });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `subject "${s.principal}" → unknown role/tier "${r}"`, path: ["subjects", i, "roles", j] }); });
         s.overrides.forEach((o, j) => { if (o.principal !== s.principal)
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `override.principal "${o.principal}" must equal subject "${s.principal}"`, path: ["subjects", i, "overrides", j, "principal"] }); });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `override.principal "${o.principal}" must equal subject "${s.principal}"`, path: ["subjects", i, "overrides", j, "principal"] }); });
     });
 });
-/** design/170 件A:`?principal=` caps wire 上的 org 记忆解析段(center 铸、server 消费,两侧共此同源锚)。
- *  段级三值语义:**键整体缺席**=center 不支持该段(能力握手,消费方按「取不到」瞬时处理,不判终局);
+/** design/170 件A:`?principal=` caps wire 上的 org 记忆解析段(web-admin 铸、server 消费,两侧共此同源锚)。
+ *  段级三值语义:**键整体缺席**=web-admin 不支持该段(能力握手,消费方按「取不到」瞬时处理,不判终局);
  *  **`scopes: {}` 空表**=取数成功的负结果(该 principal 零 org 授权,终局);**有表**=逐条目判。
  *  `gen`=单调世代号(publish 模式=globalRevision,live 模式=store version;消费方拒退挂此,防线为
- *  进程生命周期内的 LB 陈旧副本——重启后无高水位=接受 center 当刻值,center 是真源)。 */
+ *  进程生命周期内的 LB 陈旧副本——重启后无高水位=接受 web-admin 当刻值,web-admin 是真源)。 */
 export const PrincipalOrgMemoryWire = z
     .object({
-    gen: z.number().int().nonnegative(),
+    gen: INTEGER.nonnegative(),
     scopes: z.record(z.string().regex(/^org:\S+$/, "orgMemory scope must be an `org:` scope string"), z.object({ write: z.boolean().optional() }).strict()),
 })
     .strict();
-/** `?principal=` caps wire **整体**的读边界 schema(center 铸、server 消费同源锚;产品令 2026-08-05:
+/** `?principal=` caps wire **整体**的读边界 schema(web-admin 铸、server 消费同源锚;产品令 2026-08-05:
  *  网络边界读入必 schema,禁裸 as-cast)。**逐面容错极性是裁定过的语义**,严格化会翻转极性的面在此
  *  显式保持宽读(每面注明所依裁定),不许硬转严:
- *  - `runtimeCaps`/`budget`(治理面,fail-closed):严格校验已知键 + **passthrough 未知键**——新 center
+ *  - `runtimeCaps`/`budget`(治理面,fail-closed):严格校验已知键 + **passthrough 未知键**——新 web-admin
  *    的新 cap 键必须原样透传给 core(老 server 剥键=静默放松治理);值漂移 ⇒ 整体 parse 失败 ⇒ 消费端
  *    fail-close(「outage 绝不静默 GRANT」的既裁方向)。
  *  - `scenario`/`allowlist`/`execution`(能力面,fail-open,[565]/[580] 裁定):保持 `unknown` 宽读,
@@ -1268,18 +1354,15 @@ export const ActorAssertionWire = z
 /** sessionMirror TARGET url 的底线传输校验(0.10.1;0.10.2 加 trim 前置):**https,或 loopback http**
  *  (本机第二引擎/dev)。与壳 `evaluateEngineRouting`(shell-host engineTarget.ts,S1 路由闸)语义对齐:
  *  镜像上行带会话内容+Bearer 凭证,非 loopback 明文 http = 凭证与会话数据裸奔——**写侧 schema 层就拒**
- *  (fail-loud 比读侧执法更早;center 编辑面存不进去,壳读侧闸只兜手改存储的漏网)。基线复用
- *  {@link NON_SECRET_URL}(禁 userinfo 凭证/禁 query/fragment 夹带 secret-shaped 值)。loopback 判定与壳
- *  isLoopbackEngineUrl 逐字同表:127.0.0.1 / localhost / ::1 / [::1](URL.hostname 对 IPv6 带方括号,
- *  两写法都收)。**trim 前置(0.10.2,附B 三单合评审 M-1)**:前导/尾随空白先归一再验且存储值即 trim
+ *  (fail-loud 比读侧执法更早;web-admin 编辑面存不进去,壳读侧闸只兜手改存储的漏网)。基线复用
+ *  {@link NON_SECRET_URL}(禁 userinfo 凭证/禁 query/fragment 夹带 secret-shaped 值)。loopback 判定 = 鉴权放宽那一只
+ *  {@link isLoopbackAuthHost}(11.0.0 起;明文 http 带凭据是放宽,窄是安全方向 —— 壳的同一判定改读同一只)。
+ *  **trim 前置(0.10.2,附B 三单合评审 M-1)**:前导/尾随空白先归一再验且存储值即 trim
  *  后值——否则 " https://…" 写侧收(new URL 容忍前导空白)而壳读侧逐字符比对拒 = 全员镜像静默 degraded。 */
 export const SESSION_MIRROR_ENGINE_URL = z.string().trim().pipe(NON_SECRET_URL).refine((s) => {
     try {
         const u = new URL(s);
-        if (u.protocol === "https:")
-            return true;
-        const h = u.hostname;
-        return h === "127.0.0.1" || h === "localhost" || h === "::1" || h === "[::1]";
+        return u.protocol === "https:" || isLoopbackAuthHost(u.hostname);
     }
     catch {
         return true; // already passed NON_SECRET_URL; unreachable in practice
@@ -1298,7 +1381,7 @@ export const SESSION_MIRROR_ENGINE_URL = z.string().trim().pipe(NON_SECRET_URL).
  *  - `required:true` = **org 治理强制**:会话镜像默认开且不可关,且**本地覆盖不生效——既不能改目标
  *    也不能关闭(org 压一切;附B 三单合评审 MAJOR-1 勘误:治理态下本地 --target 完全被忽略)**
  *    (审计场景;壳复用 CC managed-settings 锁定报错串——S3 execution 沙箱锁完全同构先例)。
- *  整个 sessionMirror **optional,缺省 INERT**(无下发=老 center/老壳/0.8-0.10 存量 execution 文档
+ *  整个 sessionMirror **optional,缺省 INERT**(无下发=老 web-admin/老壳/0.8-0.10 存量 execution 文档
  *  零行为差、零迁移)。⚠️ ENFORCEMENT HONESTY 同域头注:required 的锁今天也是 CLIENT-SIDE 执法。
  *  开放演化:v2 可能加 audit 字段类(保留窗/脱敏面等)——本对象刻意**不 .strict()**(zod 默认 strip
  *  未知键:v2 文档被 v1 消费者读到=未知键剥除,forward-compatible;加字段恒 additive patch)。 */
@@ -1309,7 +1392,7 @@ export const SessionMirrorPolicy = z.object({
     required: z.boolean().default(false),
 });
 /** 执行域 sealed-box 加密公钥登记(0.10.5,密钥托管线;挂 execution 域=「执行环境的属性」循
- *  sessionMirror 收编先例,零新域)。center **只登记公钥**——私钥由执行侧(service worker/引擎)
+ *  sessionMirror 收编先例,零新域)。web-admin **只登记公钥**——私钥由执行侧(service worker/引擎)
  *  生成并持有,永不上行;浏览器端用这里的公钥 crypto_box_seal 加密模型 key(见 {@link SealedApiKey})。
  *  X25519 公钥恒 32 字节 → base64 恒 43 字符 + "=",regex 钉死(错长度=根本不是 X25519 公钥,写侧
  *  fail-loud 比执行侧解密失败早得多)。 */
@@ -1318,11 +1401,11 @@ export const ExecutionPublicKey = z.object({
     publicKeyId: z.string().min(1).max(128),
     /** X25519 公钥,base64(32 字节 → 恒 44 字符含 padding)。 */
     publicKey: z.string().regex(/^[A-Za-z0-9+/]{43}=$/, "publicKey must be a base64 X25519 public key (32 bytes)"),
-    /** 登记时刻(ISO)。center 写面 server 端盖章(projects.registeredAt 同款纪律)。 */
+    /** 登记时刻(ISO)。web-admin 写面 server 端盖章(projects.registeredAt 同款纪律)。 */
     createdAt: z.string().min(1),
     notes: z.string().optional(),
     /** 归属 worker 标识(0.10.9,service 合意)。**取值 = 上报方 worker 的
-     *  `SEMA_REGISTRY_WORKER` env**(service 上报载荷带 `workerId`;该 env 未配 = 单 worker 部署,
+     *  `SEMA_WEB_ADMIN_WORKER` env**(service 上报载荷带 `workerId`;该 env 未配 = 单 worker 部署,
      *  上报省略本字段)。多 worker 部署下 seal 侧凭它按**目标 worker** 选钥(A worker 的密文只有
      *  A 的私钥能解——选错钥 = 执行侧解密失败,晚且难查);ABSENT = 未绑定,seal 侧 fallback
      *  newest(仅适合单 worker 部署)。optional additive:存量登记条目零迁移。 */
@@ -1336,8 +1419,8 @@ export const ExecutionPolicy = z.object({
      *  must not be a BREAKING schema change (promised to the service). The closed set of lanes a worker can
      *  declare is `EXECUTION_LANE_WORDS` (`execution-lanes.ts`, 7.0.0) — read it there, not from a copy in this
      *  comment. Unknown strings are consumer-defined. */
-    allowedLanes: z.array(z.string().min(1)).default(["host"]),
-    /** Org 默认会话镜像目标(0.10.1,附B 两层)。ABSENT = INERT(center 未管镜像,壳解析序里本腿为空)。
+    allowedLanes: z.array(z.string().min(1)).prefault(["host"]),
+    /** Org 默认会话镜像目标(0.10.1,附B 两层)。ABSENT = INERT(web-admin 未管镜像,壳解析序里本腿为空)。
      *  读损档随域(DOMAIN_READ_FALLBACK.execution="throw" 已覆盖:损坏绝不静默退默认放权)。 */
     sessionMirror: SessionMirrorPolicy.optional(),
     /** 执行域 sealed-box 公钥登记表(0.10.5)。**optional 无 default,ABSENT = 未登记**(0.8–0.10 存量
@@ -1349,7 +1432,7 @@ export const ExecutionPolicy = z.object({
     const seen = new Set();
     (p.publicKeys ?? []).forEach((k, i) => {
         if (seen.has(k.publicKeyId))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate publicKeyId "${k.publicKeyId}"`, path: ["publicKeys", i, "publicKeyId"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate publicKeyId "${k.publicKeyId}"`, path: ["publicKeys", i, "publicKeyId"] });
         seen.add(k.publicKeyId);
     });
 });
@@ -1358,11 +1441,11 @@ export const ExecutionPolicy = z.object({
 // 登记簿(索引/展示/审计)+ 无仓 project 的 projectId 铸造权威。铸造离线自由、使用时注册执法
 // 佐证:执法位在 service worker(派生 `proj:*` 可读 scope 前查 `(tenant,projectId)`
 // 已注册),本域只是它查的那张表——登记簿**不读 marker 文件、不镜像 marker schema**(已确认)。
-// 复合键 `(tenant, projectId)` 的 tenant 半边由 center 的 SCOPE 轴承载(api/scopes.ts:每 scope 一份
+// 复合键 `(tenant, projectId)` 的 tenant 半边由 web-admin 的 SCOPE 轴承载(api/scopes.ts:每 scope 一份
 // 独立域文档),域内 Record 键=projectId only;fork 后同一 projectId 合法存在于两个 scope,互不相见。
 /** projectId 形状:lowercase 规范 UUID。**宽读严写**(core 口径):读面/claim 收 generic
  *  UUID(外部/历史铸造的 v4 也认——marker 是身份不是格式声明);铸造侧(core formatProjectMarker /
- *  center mint 端点)统一产 **uuidv7**。36 字符,天然满足 design/142 §1.2 段编码 64 上限。
+ *  web-admin mint 端点)统一产 **uuidv7**。36 字符,天然满足 design/142 §1.2 段编码 64 上限。
  *  SINGLE-SOURCE 纪律:本常量是引擎那条正则的**自持镜像**(本仓不带引擎运行时依赖轴),对拍走 dev-only
  *  conformance(never a runtime import,EffectiveKey/coreTypes 先例)。
  *  2.0.0:drift-lock 已建(`test/upstream-drift.test.ts` ③)—— pattern 必须与引擎逐字相同,唯一成文的差是
@@ -1382,23 +1465,23 @@ export const ProjectRegistration = z.object({
         .max(512)
         .refine((s) => !/\s/.test(s) && !s.includes("://"), "must be a NORMALIZED remote (host/path — no scheme, no whitespace)"))
         .max(16)
-        .default([]),
+        .prefault([]),
     /** 该项目会话的默认记忆 scope 词表。OPEN value domain — z.string(),不 enum(纪律:加词
      *  不得 BREAKING)。方向(S4 细化):消费方=service memoryScope 派生(作 TaskSpec.
      *  memory.scopes 种子),形态=v2 scope 键字符串(过 core parseScopeKey 校验;known 词根:`proj` /
      *  `userproj`)。未知串=消费者自定义;空数组=不下发默认。本域只登记不解释,零耦合。 */
-    defaultScopes: z.array(z.string().min(1)).default([]),
-    /** 登记人 principal(审计锚;center 写面自动填 caller,不信客户端提交)。 */
+    defaultScopes: z.array(z.string().min(1)).prefault([]),
+    /** 登记人 principal(审计锚;web-admin 写面自动填 caller,不信客户端提交)。 */
     registeredBy: z.string().min(1),
-    /** 登记时刻(ISO)。center 写面 server 端盖章。 */
+    /** 登记时刻(ISO)。web-admin 写面 server 端盖章。 */
     registeredAt: z.string().min(1),
     notes: z.string().optional(),
 });
 export const ProjectsConfig = z
     .object({
-    /** 键=projectId({@link PROJECT_ID_REGEX},generic lowercase UUID——宽读);tenant 半边=center
+    /** 键=projectId({@link PROJECT_ID_REGEX},generic lowercase UUID——宽读);tenant 半边=web-admin
      *  scope 轴(不进域文档,见域头注)。 */
-    projects: z.record(z.string().regex(PROJECT_ID_REGEX, "projectId must be a lowercase canonical UUID"), ProjectRegistration).default({}),
+    projects: z.record(z.string().regex(PROJECT_ID_REGEX, "projectId must be a lowercase canonical UUID"), ProjectRegistration).prefault({}),
 })
     .superRefine((cfg, ctx) => {
     // 同 scope 内一条 remote 只许属于一个 project——「remote → projectId」找回阶梯(design/142
@@ -1409,7 +1492,7 @@ export const ProjectsConfig = z
         for (const [i, r] of reg.gitRemotes.entries()) {
             const prev = seen.get(r);
             if (prev !== undefined && prev !== pid) {
-                ctx.addIssue({ code: z.ZodIssueCode.custom, message: `remote "${r}" already registered to project "${prev}"`, path: ["projects", pid, "gitRemotes", i] });
+                ctx.addIssue({ code: "custom", ...buildQuotedIssue `remote "${r}" already registered to project "${prev}"`, path: ["projects", pid, "gitRemotes", i] });
             }
             seen.set(r, pid);
         }
@@ -1420,7 +1503,7 @@ export const ProjectsConfig = z
 // Unified shape = slots × topology × rounds × finalizer. COMPLETELY separate from rosters (拍板): a slot
 // member's `modelRef` points at the models CATALOG (`ModelEntry.name`, the key — NOT the gateway modelId,
 // NOT a roster); roster churn never touches a template. Execution lives service-side ("collab spec →
-// workflow/team run" translation layer); the center owns the template CONFIG only.
+// workflow/team run" translation layer); web-admin owns the template CONFIG only.
 export const CollabTopology = z.enum(["star", "ring", "layered", "pair", "blackboard"]);
 export const CollabFinalizerType = z.enum(["judge", "vote", "fuse", "verify", "summarize", "none"]);
 export const CollabEarlyStop = z.enum(["consensus", "stability", "judge_call", "verify_pass"]);
@@ -1444,7 +1527,7 @@ const CollabSlot = z.object({
     rolePrompt: z.string().max(2000).optional(),
     /** 1 = exactly one member; "N" = the slot accepts multiple members (异构评审团). */
     cardinality: z.union([z.literal(1), z.literal("N")]).default(1),
-    members: z.array(CollabMember).default([]),
+    members: z.array(CollabMember).prefault([]),
     /** Tool names available to this slot's members (the old team `scenario` binding migrates here). */
     tools: z.array(z.string().min(1)).optional(),
 });
@@ -1457,7 +1540,7 @@ const CollabTemplate = z.object({
     slots: z.array(CollabSlot).min(1),
     /** `max` is ALWAYS the safety cap (blackboard topology: event/round cap — required, 防跑飞);
      *  `earlyStop: "verify_pass"` carries the architect pair's "verified → stop" loop. */
-    rounds: z.object({ max: z.number().int().positive(), earlyStop: CollabEarlyStop.optional() }),
+    rounds: z.object({ max: INTEGER.positive(), earlyStop: CollabEarlyStop.optional() }),
     finalizer: z.object({
         type: CollabFinalizerType,
         /** Slot id the finalizer anchors to (e.g. the judge slot). Meaningless for type "none". */
@@ -1468,10 +1551,10 @@ const CollabTemplate = z.object({
         kind: z.enum(["transcript", "blackboard"]).default("transcript"),
         persistence: CollabPersistence.default("session"),
     })
-        .default({}),
+        .prefault({}),
     /** 多模型烧钱必须有闸 (拍板): the budget object is REQUIRED and at least one axis must be set. */
     budget: z.object({
-        maxTokens: z.number().int().positive().optional(),
+        maxTokens: INTEGER.positive().optional(),
         maxCost: z.number().finite().positive().optional(),
     }),
     enabled: z.boolean().default(true),
@@ -1480,34 +1563,34 @@ const CollabTemplate = z.object({
     const slotIds = new Set();
     t.slots.forEach((s, i) => {
         if (slotIds.has(s.id))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate slot id "${s.id}"`, path: ["slots", i, "id"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate slot id "${s.id}"`, path: ["slots", i, "id"] });
         slotIds.add(s.id);
         if (s.cardinality === 1 && s.members.length > 1)
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `slot "${s.id}" has cardinality 1 but ${s.members.length} members`, path: ["slots", i, "members"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `slot "${s.id}" has cardinality 1 but ${s.members.length} members`, path: ["slots", i, "members"] });
     });
     if (t.finalizer.type === "none") {
         if (t.finalizer.slot !== undefined)
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `finalizer type "none" must not anchor a slot`, path: ["finalizer", "slot"] });
+            ctx.addIssue({ code: "custom", message: `finalizer type "none" must not anchor a slot`, path: ["finalizer", "slot"] });
     }
     else if (t.finalizer.slot !== undefined && !slotIds.has(t.finalizer.slot)) {
-        ctx.addIssue({ code: z.ZodIssueCode.custom, message: `finalizer.slot "${t.finalizer.slot}" is not a slot id of this template`, path: ["finalizer", "slot"] });
+        ctx.addIssue({ code: "custom", ...buildQuotedIssue `finalizer.slot "${t.finalizer.slot}" is not a slot id of this template`, path: ["finalizer", "slot"] });
     }
     if (t.budget.maxTokens === undefined && t.budget.maxCost === undefined) {
-        ctx.addIssue({ code: z.ZodIssueCode.custom, message: `template "${t.id}": budget needs at least one of maxTokens/maxCost (多模型烧钱必须有闸)`, path: ["budget"] });
+        ctx.addIssue({ code: "custom", ...buildQuotedIssue `template "${t.id}": budget needs at least one of maxTokens/maxCost (多模型烧钱必须有闸)`, path: ["budget"] });
     }
 });
-export const CollabConfig = z.object({ templates: z.array(CollabTemplate).default([]) }).superRefine((cfg, ctx) => {
+export const CollabConfig = z.object({ templates: z.array(CollabTemplate).prefault([]) }).superRefine((cfg, ctx) => {
     // `id` is the template's reference key — dedup like every other keyed domain (two same-id templates
     // shipping → the resolver silently takes the first; same failure class the old teams dedup fixed).
     const seen = new Set();
     cfg.templates.forEach((t, i) => {
         if (seen.has(t.id))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate collab template "${t.id}" — the template key must be unique`, path: ["templates", i, "id"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate collab template "${t.id}" — the template key must be unique`, path: ["templates", i, "id"] });
         seen.add(t.id);
     });
 });
 // ── Domain: workers (声明式编排 — service design/22, the orchestrator design note) ──────
-// 每个 worker = 一个 worker 服务实例的声明（一份 env profile）。sema-registry 存 DESIRED（逻辑参数
+// 每个 worker = 一个 worker 服务实例的声明（一份 env profile）。web-admin 存 DESIRED（逻辑参数
 // + secret 的 env-NAME 引用，**绝不存 secret 值**）；一个 per-host reconciler 拉取后在宿主机本地解析
 // secret → 渲染 docker compose → up/down 收敛。worker spec ↔ service env 的精确映射见 worker-env.ts。
 //
@@ -1520,7 +1603,7 @@ const DURATION = z.string().regex(/^\d+(s|m|h|d)$/, 'duration like "30m", "2h",
 // 生命周期 (design/25 §3 决策 3/4)。owner/purpose 用于配额 + 级联清理 + 审计；dependsOn 防级联雪崩。
 export const WorkerLifecycle = z.object({
     kind: z.enum(["persistent", "ephemeral"]).default("persistent"),
-    /** ephemeral: 绝对存活时长，自 sema-registry 首次见到起算（防时钟漂移），到期硬移除。 */
+    /** ephemeral: 绝对存活时长，自 web-admin 首次见到起算（防时钟漂移），到期硬移除。 */
     ttl: DURATION.optional(),
     /** 无活动多久 → 告警（MVP 只告警，不自动 disable）。数据源 = 反代 metrics。 */
     idleTimeout: DURATION.optional(),
@@ -1530,6 +1613,9 @@ export const WorkerLifecycle = z.object({
     /** 依赖的其它 worker name —— sweeper 移除前查依赖，不孤儿化仍被依赖的 worker。 */
     dependsOn: z.array(z.string().min(1)).optional(),
 });
+/** 7.0.0 删除的 worker 字段(6.x 存储形)→ 它的新位。墓碑字段写在每个旧键原来所在的对象里({@link retiredKey}):在场即拒、拒句点名
+ *  一次性迁移 SS-M4 —— 不让一行旧数据以「什么都没声明」的样子过闸(zod 会静默剥掉不认识的键)。 */
+const sixXField = (now) => ({ retiredIn: "7.0.0", now, migration: "SS-M4" });
 const WorkerSecretRefs = z.object({
     /** NAME of the host env var holding the model API key → service MODEL_API_KEY (或 anthropic 时 ANTHROPIC_API_KEY). */
     apiKeyEnv: ENV_NAME,
@@ -1540,6 +1626,7 @@ const WorkerSecretRefs = z.object({
     /** 7.0.0:SQL 店的口令 → `MYSQL_PASSWORD` / `PG_PASSWORD`(渲染器按 `runtime.store.backend` 选名族)。
      *  在场 ⇔ `runtime.store.backend` ∈ {mysql, pg}(WorkerSpec 层判,与 `runtime.store.db` 同一条规则)。取代 6.x 的 `tidbPasswordEnv`。 */
     dbPasswordEnv: ENV_NAME.optional(),
+    tidbPasswordEnv: retiredKey("secretRefs.tidbPasswordEnv", sixXField("secretRefs.dbPasswordEnv")),
 });
 /**
  * 每个**保留** env 名 → WorkerSpec 里产出它的那个结构字段(唯一写位)。`env` / `secretEnv` 逃生口拒这些名,拒因指路到这里写的字段
@@ -1552,12 +1639,26 @@ const WorkerSecretRefs = z.object({
  * 7.0.0 增删(M-R2 结构块):
  *  · **加** `REMOTE_EXEC` / `REQUIRE_EXECUTION_LANE` + 车道表({@link EXECUTION_LANES})里**全部**车道 env 名 —— 车道有了结构位
  *    `runtime.execution`,逃生口再能设车道就是两把尺。这是对 0.1.30「执行基座键不保留」的**反转**:当年不保留是因为没有结构位
- *    (活舰队 direct = k8s、canary = e2b 只能在 `worker.env` 里设);存量行由一次性迁移 `migrateWorkersDomain` 搬进结构块。
+ *    (活舰队 direct = k8s、canary = e2b 只能在 `worker.env` 里设);存量行由一次性迁移 SS-M4 搬进结构块。
  *    别的域也读的名(`MINIO_*`、`LOG_LEVEL`、`REMOTE_EXEC_HOME_DIR`)不在车道表里,照旧不保留。
  *  · **加** `DB_BACKEND` / `MEMORY_ENGINE` / `MEMORY_ENGINE_BACKEND` —— `runtime.store` 产出它们。
- *  · **删** `MEMORY_BACKEND`(引擎从不读的死名,渲染器不再产出)与 `TIDB_*` 族(引擎的墓碑名,见之拒启;结构字段不再产出它们 ——
- *    墓碑名由引擎导出的墓碑表把关,不是本表的职责)。MYSQL_* / PG_* 两族归 `runtime.store.db` + `secretRefs.dbPasswordEnv`。
+ *  · **删** `MEMORY_BACKEND`(引擎从不读的死名,渲染器不再产出)与 `TIDB_*` 族(引擎的墓碑名,见之拒启;结构字段不再产出它们)。
+ *    MYSQL_* / PG_* 两族归 `runtime.store.db` + `secretRefs.dbPasswordEnv`。
+ *
+ * `env` / `secretEnv` 的写闸问**两张表**,各答一个问题:本表答「这个现名归哪个结构字段」(拒句指路到那个字段);墓碑表 `RETIRED_ENVS`
+ * (`./retired-envs`)答「这个旧名已退役」(拒句就是墓碑句 `retiredEnvRefusal` 本身,引擎起服、壳、web-admin 读同一张表同一句)。墓碑名不进本表。
+ *
+ * 11.0.0:本表与 `RETIRED_ENVS` 的旧名集合零交集 —— `ANTHROPIC_BASEURL`(墓碑名)换成现名 `ANTHROPIC_BASE_URL`;渲染器写的 web-admin 连接三键
+ * 入表,同 fleet 成员身份两键的「渲染器写、不可配」。**规则一条:渲染器写的名字是保留名**(运维不可在 `env` / `secretEnv` 里自写)。改名窗里渲染器
+ * 按目标引擎版本写名,对还读上一代名的引擎写的是 `SEMA_REGISTRY_URL` / `SEMA_REGISTRY_WORKER` / `SEMA_REGISTRY_TOKEN`,所以这三名与现名三键同一组、
+ * 同一句拒(指路同一处)。老三名在引擎换读现名的那一版随之搬去墓碑表(同一提交);保留表与墓碑表零交集的钉会逼这一步。
  */
+/** web-admin 连接三键的唯一写位(渲染器;没有 WorkerSpec 字段)—— 现名与上一代名指路同一句。 */
+const WEB_ADMIN_CONNECTION_SEAT = {
+    url: "(set by the config renderer from the web-admin base URL — not configurable)",
+    worker: "(set by the config renderer from the worker's name — not configurable)",
+    token: "(set by the config renderer from the worker's pull token — not configurable)",
+};
 const RESERVED_ENV_FIELD = Object.freeze({
     PORT: "(fixed at 8090 — not configurable)", MODEL_PROVIDER: "model.provider", MODEL_ID: "model.modelId",
     MODEL_REASONING: "model.reasoning", MODEL_CHEAP_ID: "model.cheapId", MODEL_MAX_TOKENS: "model.maxTokens",
@@ -1565,7 +1666,7 @@ const RESERVED_ENV_FIELD = Object.freeze({
     MODEL_COST_CACHE_READ: "model.cost.cacheRead", MODEL_COST_CACHE_WRITE: "model.cost.cacheWrite",
     MAX_PRINCIPAL_COST_USD: "runtime.maxPrincipalCostUsd", REQUIRE_PRINCIPAL: "runtime.requirePrincipal", RATE_LIMIT_RPM: "runtime.rateLimitRpm",
     DEFAULT_SCENARIO: "runtime.scenario", GIT_API_BASEURL: "coords.gitApiBaseUrl", MODEL_GATEWAY_BASEURL: "model.gatewayBaseUrl",
-    ANTHROPIC_BASEURL: "model.gatewayBaseUrl", MODEL_API_KEY: "secretRefs.apiKeyEnv", ANTHROPIC_API_KEY: "secretRefs.apiKeyEnv",
+    ANTHROPIC_BASE_URL: "model.gatewayBaseUrl", MODEL_API_KEY: "secretRefs.apiKeyEnv", ANTHROPIC_API_KEY: "secretRefs.apiKeyEnv",
     SERVICE_AUTH_TOKEN: "secretRefs.serviceAuthTokenEnv", GIT_API_TOKEN: "secretRefs.gitTokenEnv",
     // ── runtime.store(7.0.0)
     DB_BACKEND: "runtime.store.backend", SESSION_BACKEND: "runtime.store.session",
@@ -1579,6 +1680,11 @@ const RESERVED_ENV_FIELD = Object.freeze({
     // ── fleet 成员身份两键:渲染器按该 worker 的代际写 generation(引擎读回并回声成 EngineSignal.generation)、按该 worker 令牌绑定的 scope 写 scope(引擎读作自身身份的 scope)—— 没有 WorkerSpec 字段能写它们
     [FLEET_GENERATION_ENV]: "(set by the config renderer from the worker's generation — not configurable)",
     [FLEET_SCOPE_ENV]: "(set by the config renderer from the worker's scope — not configurable)",
+    // ── web-admin 连接三键:渲染器给每台 worker 写 web-admin 根 URL、worker 名与该 worker 的拉取令牌 —— 没有 WorkerSpec 字段能写它们;
+    //    现名与渲染器对老引擎写的上一代名同一组(见表头注)
+    [WEB_ADMIN_ENV.url]: WEB_ADMIN_CONNECTION_SEAT.url, SEMA_REGISTRY_URL: WEB_ADMIN_CONNECTION_SEAT.url,
+    [WEB_ADMIN_ENV.worker]: WEB_ADMIN_CONNECTION_SEAT.worker, SEMA_REGISTRY_WORKER: WEB_ADMIN_CONNECTION_SEAT.worker,
+    [WEB_ADMIN_ENV.token]: WEB_ADMIN_CONNECTION_SEAT.token, SEMA_REGISTRY_TOKEN: WEB_ADMIN_CONNECTION_SEAT.token,
     REQUIRE_EXECUTION_LANE: "runtime.execution.lane (the renderer emits REQUIRE_EXECUTION_LANE=true for every declared lane)",
     ...Object.fromEntries([...LANE_ENV_OWNER].map(([name, owner]) => [name, laneEnvSeat(name, owner)])),
 });
@@ -1588,14 +1694,20 @@ export const RESERVED_WORKER_ENV = new Set(Object.keys(RESERVED_ENV_FIELD));
 /**
  * 保留名被 `env` / `secretEnv` 逃生口设置时的拒因:点名键 + 它的唯一写位。句尾恒是「set it via <字段>」(下游按它抽归属字段,不动)。
  * **迁移指路只有一条规则(7.0.1)**:这个键「旧形 ⇒ 迁移能搬」({@link isMigratableEnvKey},与迁移自己识别的键集同一只谓词)就在键名后
- * 带 {@link MIGRATION_SIGNPOST};搬不了的保留名(`PORT` / `MODEL_*` / `MYSQL_*` …)不带 —— 指一条跑了也没用的命令比不指更糟。
+ * 带同一句迁移指路(一次性迁移 SS-M4,`migrationSignpost`);搬不了的保留名(`PORT` / `MODEL_*` / `MYSQL_*` …)不带 —— 指一条跑了也没用的迁移比不指更糟。
  */
-function reservedKeyMessage(slot, key) {
-    const signpost = isMigratableEnvKey(key) ? ` (${MIGRATION_SIGNPOST})` : "";
-    return `${slot} cannot set reserved key "${key}"${signpost} — set it via ${RESERVED_ENV_FIELD[key]}`;
+function reservedKeyIssue(slot, key) {
+    const signpost = isMigratableEnvKey(key) ? " (" + migrationSignpost("SS-M4", "7.0.0") + ")" : "";
+    return buildQuotedIssue `${fixed(slot)} cannot set reserved key "${key}"${fixed(signpost)} — set it via ${fixed(RESERVED_ENV_FIELD[key])}`;
+}
+/** 逃生口里有墓碑表的旧名 ⇒ 一条 issue,句子是墓碑句本身(`retiredEnvRefusal` —— 唯一铸点,本包不另拼;句里只有表里的名,不回显值)。 */
+function retiredEnvIssue(rec, ctx) {
+    const refusal = retiredEnvRefusal(rec);
+    if (refusal !== undefined)
+        ctx.addIssue({ code: "custom", ...buildQuotedIssue `${fixed(refusal)}` });
 }
 // ── 7.0.0 M-R2:`runtime.execution` / `runtime.store` 两个结构块 ─────────────────────────────────────────────
-// 词表只有一个正本(`execution-lanes.ts` 的导出表):本包写闸(`WorkerSpec.safeParse`)、中心渲染器、引擎起服三处读同一张表。
+// 词表只有一个正本(`execution-lanes.ts` 的导出表):本包写闸(`WorkerSpec.safeParse`)、web-admin 渲染器、引擎起服三处读同一张表。
 // 拒因都在 zod issue 里(`path` 指到要改的字段、`message` 带出路)—— schema 本身是唯一判据,不另导出拒因函数。
 /** 一个非密字面值(车道坐标 / SQL 坐标):≤2048,不像密钥(与 `env` 逃生口同一条判据 —— 密钥走 env-NAME 引用)。 */
 const nonSecretLiteral = (minLength) => z
@@ -1613,47 +1725,47 @@ const nonSecretLiteral = (minLength) => z
  */
 const ExecutionBlock = z
     .object({
-    lane: z.enum(EXECUTION_LANE_WORDS),
-    coords: z.record(ENV_NAME, nonSecretLiteral(0)).default({}),
-    secretRefs: z.record(ENV_NAME, ENV_NAME).default({}),
+    lane: z.enum(EXECUTION_LANE_WORDS, { error: (iss) => retiredLaneWordRefusal(iss.input) }), // a retired lane word gets its way out
+    coords: z.record(ENV_NAME, nonSecretLiteral(0)).prefault({}),
+    secretRefs: z.record(ENV_NAME, ENV_NAME).prefault({}),
 })
     .superRefine((x, ctx) => {
     const row = laneRowOf(x.lane);
-    const issue = (slot, key, message) => ctx.addIssue({ code: z.ZodIssueCode.custom, path: [slot, key], message });
+    const issue = (slot, key, q) => ctx.addIssue({ code: "custom", path: [slot, key], ...q });
     const owned = (secret) => (secret ? [...row.requiredSecretEnv, ...row.optionalSecretEnv] : [...row.requiredEnv, ...row.optionalEnv]);
     const judgeKey = (slot, key) => {
         const wantSecret = slot === "secretRefs";
         const owner = LANE_ENV_OWNER.get(key);
         if (owner === undefined) {
             const allowed = owned(wantSecret);
-            issue(slot, key, `${key} is not ${wantSecret ? "a secret" : "a coordinate"} of any execution lane — lane "${x.lane}" takes ${slot} ${allowed.length > 0 ? allowed.join(", ") : "(none)"}`);
+            issue(slot, key, buildQuotedIssue `${key} is not ${fixed(wantSecret ? "a secret" : "a coordinate")} of any execution lane — lane "${x.lane}" takes ${fixed(slot)} ${fixed(allowed.length > 0 ? allowed.join(", ") : "(none)")}`);
             return false;
         }
         if (owner.lane !== x.lane) {
-            issue(slot, key, `${key} belongs to lane "${owner.lane}", not "${x.lane}" — remove it, or set runtime.execution.lane to "${owner.lane}"`);
+            issue(slot, key, buildQuotedIssue `${key} belongs to lane "${fixed(owner.lane)}", not "${x.lane}" — remove it, or set runtime.execution.lane to "${fixed(owner.lane)}"`);
             return false;
         }
         if (owner.secret !== wantSecret) {
             issue(slot, key, owner.secret
-                ? `${key} is a secret of lane "${x.lane}" — put it in runtime.execution.secretRefs as an env-NAME (never a value in coords)`
-                : `${key} is a non-secret coordinate of lane "${x.lane}" — write its value in runtime.execution.coords`);
+                ? buildQuotedIssue `${key} is a secret of lane "${x.lane}" — put it in runtime.execution.secretRefs as an env-NAME (never a value in coords)`
+                : buildQuotedIssue `${key} is a non-secret coordinate of lane "${x.lane}" — write its value in runtime.execution.coords`);
             return false;
         }
         return true;
     };
     for (const [key, value] of Object.entries(x.coords)) {
         if (judgeKey("coords", key) && value === "" && LANE_ENV_OWNER.get(key)?.required === true) {
-            issue("coords", key, `required coordinate ${key} of lane "${x.lane}" is empty — the engine reads an empty value as unset and refuses to start`);
+            issue("coords", key, buildQuotedIssue `required coordinate ${key} of lane "${x.lane}" is empty — the engine reads an empty value as unset and refuses to start`);
         }
     }
     for (const key of Object.keys(x.secretRefs))
         judgeKey("secretRefs", key);
     for (const key of row.requiredEnv)
         if (!Object.hasOwn(x.coords, key))
-            issue("coords", key, `lane "${x.lane}" requires coords.${key} (the engine refuses to start without it)`);
+            issue("coords", key, buildQuotedIssue `lane "${x.lane}" requires coords.${key} (the engine refuses to start without it)`);
     for (const key of row.requiredSecretEnv)
         if (!Object.hasOwn(x.secretRefs, key))
-            issue("secretRefs", key, `lane "${x.lane}" requires secretRefs.${key} — the host env-NAME holding it`);
+            issue("secretRefs", key, buildQuotedIssue `lane "${x.lane}" requires secretRefs.${key} — the host env-NAME holding it`);
 });
 /** `MEMORY_ENGINE` 的两个词(引擎目录行的 `enumValues`;引擎还认 true/false/1/0… 两族同义词,结构位只收规范词)。 */
 const MEMORY_ENGINE_SWITCH = ["on", "off"];
@@ -1675,7 +1787,7 @@ const StoreBlock = z.object({
         engine: z.enum(MEMORY_ENGINE_SWITCH).default("on"),
         backend: z.enum(MEMORY_ENGINE_BACKENDS).default("file"),
     })
-        .default({}),
+        .prefault({}),
     /** SQL 服务器坐标(中立,一份;名族由 `backend` 决定)。 */
     db: z
         .object({
@@ -1686,40 +1798,8 @@ const StoreBlock = z.object({
     })
         .optional(),
 });
-/** 7.0.0 删除的字段 → 它的新位。**迁移窗口代码**:与 `migrateWorkersDomain` 同窗删除(只为未迁移的旧形读到即响亮拒,而不是被
- *  zod 静默剥掉 —— 剥掉的话,一行旧数据会以「什么都没声明」的样子过闸)。 */
-const RETIRED_WORKER_FIELDS = [
-    { parent: "runtime", key: "sessionBackend", now: "runtime.store.session" },
-    { parent: "runtime", key: "memoryBackend", now: "runtime.store.memory — the old field never reached the engine" },
-    { parent: "runtime", key: "db", now: "runtime.store.db.database" },
-    { parent: "coords", key: "tidbHost", now: "runtime.store.db.host" },
-    { parent: "coords", key: "tidbPort", now: "runtime.store.db.port" },
-    { parent: "coords", key: "tidbUser", now: "runtime.store.db.user" },
-    { parent: "secretRefs", key: "tidbPasswordEnv", now: "secretRefs.dbPasswordEnv" },
-];
-/** 一个对象的**自有数据属性**值(不触发访问器;不是普通对象 ⇒ undefined)。 */
-function ownDataValue(obj, key) {
-    if (obj === null || typeof obj !== "object" || Array.isArray(obj))
-        return undefined;
-    const d = Object.getOwnPropertyDescriptor(obj, key);
-    return d !== undefined && "value" in d ? d.value : undefined;
-}
-function retiredWorkerFieldIssues(raw, ctx) {
-    for (const { parent, key, now } of RETIRED_WORKER_FIELDS) {
-        const container = ownDataValue(raw, parent);
-        if (container !== null && typeof container === "object" && !Array.isArray(container) && Object.hasOwn(container, key)) {
-            ctx.addIssue({
-                code: z.ZodIssueCode.custom,
-                path: [parent, key],
-                message: `${parent}.${key} was removed in 7.0.0 (now ${now}) — ${MIGRATION_SIGNPOST}`,
-            });
-        }
-    }
-    return raw;
-}
-/** 一台 worker 的名字(唯一 → 容器名 / compose project / 缺省路由键)—— **唯一**的名字判据。中心在租约 / 用量 /
- *  discovery `?worker=` 等面上校验外部传来的 worker 名时读它(不抄窄正则)。7.0.0 起单独导出:`WorkerSpec` 不再是普通
- *  对象 schema(预处理 + 跨字段判据),`WorkerSpec.shape.name` 不复存在。 */
+/** 一台 worker 的名字(唯一 → 容器名 / compose project / 缺省路由键)—— **唯一**的名字判据。web-admin 在租约 / 用量 /
+ *  discovery `?worker=` 等面上校验外部传来的 worker 名时读它(不抄窄正则)。 */
 export const WORKER_NAME = z.string().min(1).regex(/^[a-z0-9][a-z0-9-]*$/, "lowercase letters/digits/-, no spaces");
 const WorkerSpecObject = z.object({
     /** 唯一 → 容器名 / compose project. */
@@ -1739,7 +1819,7 @@ const WorkerSpecObject = z.object({
      *  Hash-INCLUDED → a change re-applies the Deployment (k8s scales IN PLACE via SSA, no pod destruction). The
      *  docker backend is single-container: it warns and runs 1 if this is >1. Capped at 100 (resource-exhaustion
      *  guard — a typo'd 1e6 mustn't try to schedule a million pods; raise the cap if a real workload needs it). */
-    replicas: z.number().int().positive().max(100).optional(),
+    replicas: INTEGER.positive().max(100).optional(),
     /** AUTOSCALING (k8s backend, HPA) — declare bounds and let the cluster's HorizontalPodAutoscaler own the
      *  replica count (autoscaling/v2, CPU utilization; prove-before-scale 解禁 2026-06-13). Mutually exclusive
      *  with `replicas` (WorkersConfig rejects both — two owners of the same knob WILL fight). The orchestrator
@@ -1750,10 +1830,10 @@ const WorkerSpecObject = z.object({
      *  single-container, warns + ignores. Hash-INCLUDED; absent → no HPA, today's behaviour (zero churn). */
     autoscaling: z
         .object({
-        minReplicas: z.number().int().positive().max(100),
-        maxReplicas: z.number().int().positive().max(100),
+        minReplicas: INTEGER.positive().max(100),
+        maxReplicas: INTEGER.positive().max(100),
         /** Target average CPU utilization %, vs resources.requests.cpu. Absent → backend default 80. */
-        targetCpuPercent: z.number().int().min(10).max(95).optional(),
+        targetCpuPercent: INTEGER.min(10).max(95).optional(),
     })
         .refine((a) => a.maxReplicas >= a.minReplicas, { message: "maxReplicas must be >= minReplicas" })
         .optional(),
@@ -1770,19 +1850,19 @@ const WorkerSpecObject = z.object({
      *  hash-INCLUDED like every spec field — absent → contract defaults (zero churn on existing fleets). */
     fleet: z
         .object({
-        /** Per-worker dispatch policy consumed by center `/api/dispatch` (D3: the gateway hop is optional;
+        /** Per-worker dispatch policy consumed by web-admin `/api/dispatch` (D3: the gateway hop is optional;
          *  only affects traffic routed through it). Absent → contract defaults (round-robin, affinity on). */
         dispatch: DispatchPolicy.optional(),
         /** D1 per-worker drain-grace override → delivered to the container as env `DRAIN_GRACE_MS`
          *  (worker-side default 600s, floor 10s). */
-        drainGraceMs: z.number().int().positive().optional(),
+        drainGraceMs: INTEGER.positive().optional(),
     })
         .optional(),
     // `model` DELETED in 0.7.0 (EXPERT-REDESIGN §3 拍板 + E3 迁移闭环 — a2 存量 5 worker 已迁移目录+roster
     // 标记,E3):模型/网关配置单一真源=models 目录,worker 经 `roster` 引用;主/cheap boot env
     // 归宿=roster.primaryModel/cheapModel 标记(0.6.3,service 已承接)。pre-0.7 存量 JSON 里的
     // `model` 键被 parse 静默剥除(zod strips unknown)→ workerSpecHash 变化=一次性重建;迁移工具输入=
-    // 冻结的 LegacyWorkerModel(migrate.ts),必须在升级 0.7 前跑完(a2 已闭环,E3)。
+    // 冻结的旧 worker.model 形(0.5 → 0.7 迁移工具,11.0.0 随 `./migrate` 出口删除),必须在升级 0.7 前跑完(a2 已闭环,E3)。
     /** 运行时 (非 secret). 映射到 service REQUIRE_PRINCIPAL / RATE_LIMIT_RPM / … 与两个结构块(7.0.0)。 */
     runtime: z.object({
         /** 7.0.0 执行车道块(见 `ExecutionBlock`)。enabled 的 worker 必填(WorkerSpec 层判);停用的可缺。 */
@@ -1791,52 +1871,61 @@ const WorkerSpecObject = z.object({
         store: StoreBlock.optional(),
         scenario: z.string().optional(), // DEFAULT_SCENARIO
         requirePrincipal: z.boolean().default(false),
-        rateLimitRpm: z.number().int().nonnegative().default(0),
+        rateLimitRpm: INTEGER.nonnegative().default(0),
         /** Per-principal cumulative cost CAP (USD) → MAX_PRINCIPAL_COST_USD → the service's cost gate ENFORCEMENT
          *  (over-cap → 429). Pairs with model.cost (which only ATTRIBUTES cost). ABSENT → no env → the service
          *  defaults to 0 = off (today's behaviour); EXPLICIT 0 emits "0" = block-all and is HASH-DISTINCT from
          *  absent (so the guard is `!= null`, not `> 0` — the two carry different caller intent). Optional + NO
          *  default → absent never materialises → no spec-hash churn. Hash-included (read at boot → cap change recreates). */
         maxPrincipalCostUsd: z.number().finite().nonnegative().optional(),
+        sessionBackend: retiredKey("runtime.sessionBackend", sixXField("runtime.store.session")),
+        memoryBackend: retiredKey("runtime.memoryBackend", sixXField("runtime.store.memory — the old field never reached the engine")),
+        db: retiredKey("runtime.db", sixXField("runtime.store.db.database")),
     }),
-    /** 物理坐标 (非 secret). 映射到 GIT_API_BASEURL。7.0.0 起 SQL 坐标在 `runtime.store.db`(`tidb*` 三键删除)。 */
+    /** 物理坐标 (非 secret). 映射到 GIT_API_BASEURL。7.0.0 起 SQL 坐标在 `runtime.store.db`(`tidb*` 三键删除,墓碑在下)。 */
     coords: z
         .object({
         gitApiBaseUrl: NON_SECRET_URL.optional().or(z.literal("")),
+        tidbHost: retiredKey("coords.tidbHost", sixXField("runtime.store.db.host")),
+        tidbPort: retiredKey("coords.tidbPort", sixXField("runtime.store.db.port")),
+        tidbUser: retiredKey("coords.tidbUser", sixXField("runtime.store.db.user")),
     })
-        .default({}),
+        .prefault({}),
     secretRefs: WorkerSecretRefs,
     /**
      * 通用 env 透传（逃生口）——给**没有专属结构化字段**的 service env 用，让任意 worker 声明自己的 app 专属变量
-     * （如 OA 的 `OA_API_BASEURL`），不必为每个变量改契约。值是**字面非密值**（≤2048,且拒绝明显的密钥串——密钥走
+     * （如某个应用的 `MY_APP_BASEURL`），不必为每个变量改契约。值是**字面非密值**（≤2048,且拒绝明显的密钥串——密钥走
      * `secretEnv`）。**只能加结构化字段没产生的键**：`RESERVED_WORKER_ENV` 里的键(PORT、MODEL_x、gateway、auth、
-     * secret 名…)被拒,防 env 改路由/关鉴权/遮蔽密钥(council)。可覆盖非保留键(如 LOG_LEVEL)。hash-included(改它重建)。
+     * secret 名…)被拒,防 env 改路由/关鉴权/遮蔽密钥(council);墓碑表 `RETIRED_ENVS` 里的旧名被拒(引擎见之拒启;空串 = 未设,同引擎)。
+     * 可覆盖非保留键(如 LOG_LEVEL)。hash-included(改它重建)。
      */
     env: z
         .record(ENV_NAME, z.string().max(2048))
         .superRefine((rec, ctx) => {
+        retiredEnvIssue(rec, ctx);
         for (const [k, v] of Object.entries(rec)) {
             if (RESERVED_WORKER_ENV.has(k))
-                ctx.addIssue({ code: "custom", message: reservedKeyMessage("env", k) });
+                ctx.addIssue({ code: "custom", ...reservedKeyIssue("env", k) });
             // 0.1.32: NO name exemption — a PUBLIC key is allowed because SECRET_LITERAL_RE now only flags PRIVATE keys
             // (root fix), so a literal private key / token in env (ANY name, incl `*_PUBKEY`) is still rejected.
             if (containsSecretToken(v))
-                ctx.addIssue({ code: "custom", message: `env["${k}"] looks like a literal secret — put secrets in secretEnv (an env-NAME), never a value in env` }); // tokenized (mid-string too). R8
+                ctx.addIssue({ code: "custom", ...buildQuotedIssue `env["${k}"] looks like a literal secret — put secrets in secretEnv (an env-NAME), never a value in env` }); // tokenized (mid-string too). R8
         }
     })
         .optional(),
     /**
      * 通用**密钥** env 透传：`{ service 的环境变量名 → 宿主机 env-NAME }`。编排器把宿主机 env-NAME 从它的 secret 源
-     * 解析成真值、经 secretKeyRef 注入——**sema-registry 只存名、绝不存值**（同 `secretRefs` 边界，值也是 `ENV_NAME`
-     * 故无法粘贴真值）。给 app 专属令牌用（如 `OA_SERVICE_TOKEN` → 某 env-名）。在 reconciler 里于 `env` 之后解析，
-     * 故密钥永不被 `env` 同名键遮蔽。`RESERVED_WORKER_ENV` 里的键被拒（那些结构化 secret 走 `secretRefs`）。
+     * 解析成真值、经 secretKeyRef 注入——**web-admin 只存名、绝不存值**（同 `secretRefs` 边界，值也是 `ENV_NAME`
+     * 故无法粘贴真值）。给 app 专属令牌用（如 `MY_APP_TOKEN` → 某 env-名）。在 reconciler 里于 `env` 之后解析，
+     * 故密钥永不被 `env` 同名键遮蔽。`RESERVED_WORKER_ENV` 里的键被拒（那些结构化 secret 走 `secretRefs`）;墓碑表 `RETIRED_ENVS` 里的旧名被拒。
      */
     secretEnv: z
         .record(ENV_NAME, ENV_NAME)
         .superRefine((rec, ctx) => {
+        retiredEnvIssue(rec, ctx);
         for (const k of Object.keys(rec))
             if (RESERVED_WORKER_ENV.has(k))
-                ctx.addIssue({ code: "custom", message: reservedKeyMessage("secretEnv", k) });
+                ctx.addIssue({ code: "custom", ...reservedKeyIssue("secretEnv", k) });
     })
         .optional(),
     /** Opaque recreate trigger (hash-INCLUDED): bump it to force the reconciler to recreate the worker — e.g. to
@@ -1845,19 +1934,19 @@ const WorkerSpecObject = z.object({
     recreateNonce: z.string().max(64).optional(),
     /**
      * 生命周期 (v2②, design/25 §3)。可选——不填 = `persistent`（默认安全，绝不被 GC 误杀）。
-     * **reconciler 不读这个字段**（保持纯收敛）；TTL/idle 决策全在 sema-registry 侧 sweeper：到期就把 worker
+     * **reconciler 不读这个字段**（保持纯收敛）；TTL/idle 决策全在 web-admin 侧 sweeper：到期就把 worker
      * 从 desired 移除，reconciler 声明式自然 teardown。`ttl`/`idleTimeout` 用时长串（"30m"/"2h"/"7d"）。
      */
     lifecycle: WorkerLifecycle.optional(),
     /**
-     * 多主机调度 (可选, 非 breaking — reconciler 不读)。`auto:true` → sema-registry 的 placement 按容量/标签约束
-     * 给它挑一台 host 并写回具体 `host`（reconciler 仍按具体 host 认领，契约不变）。`requires` = host 必须具备的
-     * 全部标签（hosts 域声明）。不填 = 手动指定 host（运维自己负责）。
+     * 多主机调度(可选)。`placement.auto` 判 `host` 是**钉**还是**提示**:`auto:false`(缺省)⇒ `host` 是钉 —— 运维指定的那一台,
+     * 只在那台起;`auto:true` ⇒ web-admin 的排布按容量 / 标签约束挑一台写回 `host`,那是提示,排布可改挑。`requires` = host 必须具备的
+     * 全部标签(hosts 域声明)。不加单独的「钉」字段:钉 / 提示已由 `placement.auto` 编码,再加一个字段 = 同一事实两处写。
      */
     placement: z
         .object({
         auto: z.boolean().default(false),
-        requires: z.array(z.string().min(1)).default([]),
+        requires: z.array(z.string().min(1)).prefault([]),
         /** SOFT anti-affinity group: auto workers sharing this key are spread across hosts when possible
          *  (preferred, never blocks placement — the scheduling design note). 不填 = 无 spread 约束。 */
         spread: z.string().min(1).optional(),
@@ -1865,7 +1954,7 @@ const WorkerSpecObject = z.object({
         .optional(),
     /**
      * per-worker roster 引用 (the multi-roster design note)。指向 `rosters` 域里一个命名 roster；该 worker 的 service 拉
-     * `GET /api/config/effective?worker=<name>` 时,sema-registry 用这个 roster 解析它专属的 models/roles/@白名单。
+     * `GET /api/config/effective?worker=<name>` 时,web-admin 用这个 roster 解析它专属的 models/roles/@白名单。
      * 不填 → 该 worker 拿全局 models（向后兼容）。**不进 `workerSpecHash`**（改 roster 只让 service 重拉、不重建容器）。
      */
     roster: z.string().min(1).optional(),
@@ -1875,29 +1964,26 @@ const WorkerSpecObject = z.object({
 });
 /** 跨字段判据(G1 / G2 / host∧多副本 / store 四条)。每条一个 issue,`path` 指到要改的字段。 */
 function workerSpecIssues(w, ctx) {
-    const issue = (path, message) => ctx.addIssue({ code: z.ZodIssueCode.custom, path, message });
+    const issue = (path, q) => ctx.addIssue({ code: "custom", path, ...q });
     const { execution, store, requirePrincipal } = w.runtime;
     // G1:enabled 的 worker 必须声明车道与店(停用的不渲染,可缺)。
     if (w.enabled && execution === undefined) {
-        issue(["runtime", "execution", "lane"], `an enabled worker must declare its execution lane — runtime.execution.lane: ${EXECUTION_LANE_WORDS.join(" | ")}. ` +
-            `Without one it would boot with no hands and still report tasks completed; there is no "no hands" lane — disable the worker instead`);
+        issue(["runtime", "execution", "lane"], buildQuotedIssue `an enabled worker must declare its execution lane — runtime.execution.lane: ${fixed(EXECUTION_LANE_WORDS.join(" | "))}. Without one it would boot with no hands and still report tasks completed; there is no "no hands" lane — disable the worker instead`);
     }
     if (w.enabled && store === undefined) {
-        issue(["runtime", "store", "backend"], `an enabled worker must declare its store — runtime.store.backend: ${STORE_BACKENDS.join(" | ")}`);
+        issue(["runtime", "store", "backend"], buildQuotedIssue `an enabled worker must declare its store — runtime.store.backend: ${fixed(STORE_BACKENDS.join(" | "))}`);
     }
     if (execution !== undefined) {
         // G2:多租户姿态不许跑不分租户的车道;出路按表现算(不手写第五份词表)。
         if (requirePrincipal && laneRowOf(execution.lane).tenantSeparation === "single-user-only") {
             const outlets = EXECUTION_LANES.filter((r) => r.tenantSeparation === "supported").map((r) => r.lane);
-            issue(["runtime", "execution", "lane"], `runtime.requirePrincipal=true (multi-tenant posture) with the "${execution.lane}" execution lane runs every tenant's Bash on one shared target — ` +
-                `this lane does not separate tenants; set runtime.execution.lane to ${outlets.join(" / ")}, or set runtime.requirePrincipal=false for a single-user worker`);
+            issue(["runtime", "execution", "lane"], buildQuotedIssue `runtime.requirePrincipal=true (multi-tenant posture) with the "${execution.lane}" execution lane runs every tenant's Bash on one shared target — this lane does not separate tenants; set runtime.execution.lane to ${fixed(outlets.join(" / "))}, or set runtime.requirePrincipal=false for a single-user worker`);
         }
         // host ∧ 多副本:副本数有两个旋钮(replicas / autoscaling.maxReplicas,二者互斥),一条规则看「最多几个副本」。
         if (execution.lane === "host") {
             const [path, replicas] = w.autoscaling !== undefined ? [["autoscaling", "maxReplicas"], w.autoscaling.maxReplicas] : [["replicas"], w.replicas ?? 1];
             if (replicas > 1) {
-                issue(path, `the "host" execution lane runs tools on each replica's own filesystem — ${replicas} replicas would hold ${replicas} different workspaces behind one route, ` +
-                    `so a session's next turn can land where its files are not. Keep a single replica, or choose a lane other than "host"`);
+                issue(path, buildQuotedIssue `the "host" execution lane runs tools on each replica's own filesystem — ${replicas} replicas would hold ${replicas} different workspaces behind one route, so a session's next turn can land where its files are not. Keep a single replica, or choose a lane other than "host"`);
             }
         }
     }
@@ -1913,46 +1999,42 @@ function workerSpecIssues(w, ctx) {
     // 写闸判不了 —— 那一条只在起服拒。
     if (execution?.lane === "device" && store !== undefined && !sqlPoolOpens) {
         if (!sql) {
-            issue(["runtime", "store", "backend"], `the "device" execution lane keeps its device registry, session↔device binding and audit trail in SQL — store.backend "${store.backend}" has none ` +
-                `(the engine refuses to start: device-durable-store); set store.backend to mysql | pg`);
+            issue(["runtime", "store", "backend"], buildQuotedIssue `the "device" execution lane keeps its device registry, session↔device binding and audit trail in SQL — store.backend "${store.backend}" has none (the engine refuses to start: device-durable-store); set store.backend to mysql | pg`);
         }
         else {
-            issue(["runtime", "store", "session"], `the "device" execution lane needs the SQL store actually built — store.session "memory" builds no SQL coordinates ` +
-                `(the engine refuses to start: device-durable-store); set store.session to auto | mysql`);
+            issue(["runtime", "store", "session"], buildQuotedIssue `the "device" execution lane needs the SQL store actually built — store.session "memory" builds no SQL coordinates (the engine refuses to start: device-durable-store); set store.session to auto | mysql`);
         }
     }
     if (store !== undefined) {
         // ⑧ session mysql 要一个 durable 会话店,memory 后端一只都不建(`plugins/session-store.ts:17`「a DB session backend requires a store backend」)。
         if (store.session === "mysql" && store.backend === "memory") {
-            issue(["runtime", "store", "session"], `store.session "mysql" asks for a durable session store, but store.backend "memory" builds none (the engine refuses to start: a DB session backend requires a store backend); ` +
-                `set store.session to auto | memory, or store.backend to mysql | pg | local`);
+            issue(["runtime", "store", "session"], buildQuotedIssue `store.session "mysql" asks for a durable session store, but store.backend "memory" builds none (the engine refuses to start: a DB session backend requires a store backend); set store.session to auto | memory, or store.backend to mysql | pg | local`);
         }
         // ⑨ 记忆引擎开 ∧ 方言 pg / tidb ⇒ 引擎绑 SQL 池(`boot/stores.ts:209` / `:232` / `:300`);session memory 时池不开 ⇒ 起服拒。
         if (store.memory.engine === "on" && MEMORY_BACKEND_NEEDS_STORE[store.memory.backend] !== undefined && sql && !sqlPoolOpens) {
-            issue(["runtime", "store", "session"], `store.memory.backend "${store.memory.backend}" binds the SQL pool, but store.session "memory" never opens it (the engine refuses to start half-configured); ` +
-                `set store.session to auto | mysql, or store.memory.backend to file, or store.memory.engine to off`);
+            issue(["runtime", "store", "session"], buildQuotedIssue `store.memory.backend "${store.memory.backend}" binds the SQL pool, but store.session "memory" never opens it (the engine refuses to start half-configured); set store.session to auto | mysql, or store.memory.backend to file, or store.memory.engine to off`);
         }
     }
     if (store !== undefined) {
         if (sql && store.db === undefined)
-            issue(["runtime", "store", "db"], `store.backend "${store.backend}" needs runtime.store.db {host, port, user, database}`);
+            issue(["runtime", "store", "db"], buildQuotedIssue `store.backend "${store.backend}" needs runtime.store.db {host, port, user, database}`);
         if (!sql && store.db !== undefined)
-            issue(["runtime", "store", "db"], `store.backend "${store.backend}" uses no SQL server — remove runtime.store.db, or set store.backend to mysql | pg`);
+            issue(["runtime", "store", "db"], buildQuotedIssue `store.backend "${store.backend}" uses no SQL server — remove runtime.store.db, or set store.backend to mysql | pg`);
         const needs = MEMORY_BACKEND_NEEDS_STORE[store.memory.backend];
         if (needs !== undefined && store.backend !== needs) {
-            issue(["runtime", "store", "memory", "backend"], `store.memory.backend "${store.memory.backend}" keeps memory in the ${needs} store — it needs store.backend "${needs}" (got "${store.backend}")`);
+            issue(["runtime", "store", "memory", "backend"], buildQuotedIssue `store.memory.backend "${store.memory.backend}" keeps memory in the ${fixed(needs)} store — it needs store.backend "${fixed(needs)}" (got "${store.backend}")`);
         }
         if (requirePrincipal && !sql) {
-            issue(["runtime", "store", "backend"], `runtime.requirePrincipal=true (multi-tenant posture) needs a SQL store — store.backend "${store.backend}" has no tenant isolation; set store.backend to mysql | pg`);
+            issue(["runtime", "store", "backend"], buildQuotedIssue `runtime.requirePrincipal=true (multi-tenant posture) needs a SQL store — store.backend "${store.backend}" has no tenant isolation; set store.backend to mysql | pg`);
         }
     }
     if (sql && w.secretRefs.dbPasswordEnv === undefined)
-        issue(["secretRefs", "dbPasswordEnv"], `a SQL store (runtime.store.backend mysql | pg) needs secretRefs.dbPasswordEnv — the host env-NAME holding the database password`);
+        issue(["secretRefs", "dbPasswordEnv"], buildQuotedIssue `a SQL store (runtime.store.backend mysql | pg) needs secretRefs.dbPasswordEnv — the host env-NAME holding the database password`);
     if (!sql && w.secretRefs.dbPasswordEnv !== undefined)
-        issue(["secretRefs", "dbPasswordEnv"], `secretRefs.dbPasswordEnv is set but there is no SQL store (runtime.store.backend mysql | pg) — remove it`);
+        issue(["secretRefs", "dbPasswordEnv"], buildQuotedIssue `secretRefs.dbPasswordEnv is set but there is no SQL store (runtime.store.backend mysql | pg) — remove it`);
 }
 /** 一台 worker 的声明。写闸 = `WorkerSpec.safeParse`(7.0.0 删除项读到即拒 + 两个结构块 + 跨字段判据)。 */
-export const WorkerSpec = z.preprocess(retiredWorkerFieldIssues, WorkerSpecObject.superRefine(workerSpecIssues));
+export const WorkerSpec = WorkerSpecObject.superRefine(workerSpecIssues);
 /** Effective route key for a worker = explicit routePrefix, else its name. */
 export function workerRouteKey(w) {
     return w.routePrefix ?? w.name;
@@ -1967,27 +2049,27 @@ export const WORKER_RESOURCE_PRESETS = {
     L: { requests: { cpu: "1", memory: "2Gi" }, limits: { cpu: "4", memory: "4Gi" } },
 };
 export const WorkersConfig = z
-    .object({ workers: z.array(WorkerSpec).default([]) })
+    .object({ workers: z.array(WorkerSpec).prefault([]) })
     .superRefine((cfg, ctx) => {
     // worker `name` and effective routePrefix must each be unique across the fleet (design/25 决策7:
-    // routePrefix 唯一性 sema-registry 提交时校验). Dup name → container-name clash; dup route → ambiguous
+    // routePrefix 唯一性 web-admin 提交时校验). Dup name → container-name clash; dup route → ambiguous
     // reverse-proxy routing.
     const names = new Set();
     const routes = new Set();
     cfg.workers.forEach((w, i) => {
         if (names.has(w.name))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate worker name "${w.name}"`, path: ["workers", i, "name"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate worker name "${w.name}"`, path: ["workers", i, "name"] });
         names.add(w.name);
         const route = workerRouteKey(w);
         // point the error at the field that actually set the route (explicit routePrefix, else the name fallback).
         const routeField = w.routePrefix !== undefined ? "routePrefix" : "name";
         if (routes.has(route))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate routePrefix "${route}" (collides with another worker's routePrefix/name)`, path: ["workers", i, routeField] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate routePrefix "${route}" (collides with another worker's routePrefix/name)`, path: ["workers", i, routeField] });
         routes.add(route);
         // replicas + autoscaling = two owners of the same knob (the orchestrator's SSA vs the HPA controller
         // would endlessly fight over spec.replicas) → reject at save, not at reconcile.
         if (w.replicas !== undefined && w.autoscaling) {
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: "replicas and autoscaling are mutually exclusive — the HPA owns the replica count when autoscaling is set", path: ["workers", i, "autoscaling"] });
+            ctx.addIssue({ code: "custom", message: "replicas and autoscaling are mutually exclusive — the HPA owns the replica count when autoscaling is set", path: ["workers", i, "autoscaling"] });
         }
     });
 });
@@ -2004,9 +2086,9 @@ export const WorkerStatus = z.object({
     name: z.string().min(1),
     host: z.string().min(1), // 哪个 reconciler 上报的
     phase: z.enum(["Pending", "Running", "Failed", "Unknown"]),
-    conditions: z.array(WorkerCondition).default([]),
+    conditions: z.array(WorkerCondition).prefault([]),
     /** reconciler 处理时的 effective `version` — admin 改 spec 后 version 变,据此判断 status 是否陈旧. */
-    observedVersion: z.number().int().nonnegative(),
+    observedVersion: INTEGER.nonnegative(),
     /** reconciler 算的逻辑 spec hash (漂移检测 + 防振荡, design/22 失败模式#1). */
     observedSpecHash: z.string().optional(),
     message: z.string().optional(),
@@ -2018,20 +2100,22 @@ export const WorkerStatus = z.object({
 //   - `capacity` DELETED —— 可放性改由探测值折算(HostStatus.probes − Σ已排 worker requests;计数制→资源制
 //     是探测数据齐备后的**独立开关**,E2 placement 承接,切换前沿用计数制兜底、不按票数)。
 //   - `approved` NEW —— 默认 false = 待批(不参与自动排布;enforcement 随 E2 placement 生效,E1 只落契约)。
-//     存量迁移 = grandfathering 批量回填 approved:true(migrate.ts),存量机器不出现排布空窗(§11-9)。
-/** DNS-label bound on a host NAME (0.8.0 tightening; single source — schema + the 0.8.1 read-path
- *  grandfather clamp in config-fns both use it, so the two can never drift). */
+//     存量迁移 = grandfathering 批量回填 approved:true(0.5 → 0.6 迁移工具,11.0.0 随 `./migrate` 出口删除),存量机器不出现排布空窗(§11-9)。
+/** DNS-label bound on a host NAME (0.8.0 tightening; single source — the schema and the one-time migration SS-M2 that
+ *  rewrites 0.7-era stored data over it both read this constant). */
 export const HOST_NAME_MAX = 63;
 /** Ceiling on the hosts ARRAY (0.8.0 tightening; same single-source rule as {@link HOST_NAME_MAX}). */
 export const HOSTS_ARRAY_MAX = 1024;
+/** 两条上界的拒句尾:0.8.0 之前存下的超界数据由一次性迁移 SS-M2 改写(11.0.0 起读侧不再夹紧)。 */
+const HOSTS_BOUND_SIGNPOST = migrationSignpost("SS-M2", "0.8.0");
 export const HostEntry = z.object({
-    // .max(HOST_NAME_MAX=63) = DNS-label bound (E2 F3③ 挂账收账, 0.8.0): center-side probe clamp stays as双保险.
-    name: z.string().min(1).max(HOST_NAME_MAX).regex(/^[a-z0-9][a-z0-9-]*$/, "lowercase letters/digits/-, no spaces"),
+    // .max(HOST_NAME_MAX=63) = DNS-label bound (E2 F3③ 挂账收账, 0.8.0): web-admin-side probe clamp stays as双保险.
+    name: z.string().min(1).max(HOST_NAME_MAX, `host name longer than ${HOST_NAME_MAX} characters (a DNS label) — ${HOSTS_BOUND_SIGNPOST}`).regex(/^[a-z0-9][a-z0-9-]*$/, "lowercase letters/digits/-, no spaces"),
     /** 待批准入编状态机(§2-3):自注册/新登记默认 false = 待批,不参与自动排布;admin 批准(走 publish)→
      *  true 参排(enforcement 随 E2)。既有 worker 不受影响(reconciler 仍按具体 host 认领)。 */
     approved: z.boolean().default(false),
     /** 调度标签（如 "gpu"/"region-us"），worker 的 `placement.requires` 据此匹配。 */
-    labels: z.array(z.string().min(1)).default([]),
+    labels: z.array(z.string().min(1)).prefault([]),
     /** 关闭 = 完全不可调度（既有 worker 仍由 reconciler 管，但 placement 视它不可用）。 */
     enabled: z.boolean().default(true),
     /** drain = 不再往这台**新**放 worker（既有的留着），用于下线前腾空。 */
@@ -2039,16 +2123,15 @@ export const HostEntry = z.object({
     notes: z.string().optional(),
 });
 export const HostsConfig = z
-    // .max(HOSTS_ARRAY_MAX=1024) hosts (E2 F3③ 挂账收账, 0.8.0) — a fleet registry, not a datacenter inventory;
-    // an absurdly long array is a poisoned publish, fail-loud at save time. READ path: 0.7-era stored data that
-    // exceeds these 0.8 bounds is GRANDFATHERED (clamped + warned, never thrown) inside buildEffective —
-    // see grandfatherHostsRead in config-fns (0.8.1, S3 M-1: 收紧不毁存量,E2 血训).
-    .object({ hosts: z.array(HostEntry).max(HOSTS_ARRAY_MAX).default([]) })
+    // .max(HOSTS_ARRAY_MAX=1024) hosts (E2 F3③ 挂账收账, 0.8.0) — a fleet host registry, not a datacenter inventory;
+    // an absurdly long array is a poisoned publish, fail-loud at save time. The read path judges with the same schema
+    // (11.0.0: the 0.8.1 read-side clamp is gone; 0.7-era stored data over these bounds is rewritten once by SS-M2).
+    .object({ hosts: z.array(HostEntry).max(HOSTS_ARRAY_MAX, `more than ${HOSTS_ARRAY_MAX} hosts — ${HOSTS_BOUND_SIGNPOST}`).prefault([]) })
     .superRefine((cfg, ctx) => {
     const seen = new Set();
     cfg.hosts.forEach((h, i) => {
         if (seen.has(h.name))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate host "${h.name}"`, path: ["hosts", i, "name"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate host "${h.name}"`, path: ["hosts", i, "name"] });
         seen.add(h.name);
     });
 });
@@ -2058,28 +2141,28 @@ export const HostsConfig = z
 // (仅身份字段 {name, approved:false},幂等一条,来源 token 记审计——EXPERT-REDESIGN §2-1/§11-4)。E2
 // placement 的资源制折算消费它(可分配 = probes − Σ已排 worker requests);从未上报的机器不参与自动排布。
 // Sanity ceilings (E2 F3③ 挂账收账, 0.8.0): a forged/absurd probe (cpuCores=1e12) would suck every auto
-// worker onto one host. Ceilings MIRROR center's probeCapacities clamp (PROBE_CPU_CORES_CEILING=4096 /
-// PROBE_MEM_BYTES_CEILING=2^50=1PiB) — schema now fail-louds at report time; center's clamp stays 双保险.
+// worker onto one host. Ceilings MIRROR web-admin's probeCapacities clamp (PROBE_CPU_CORES_CEILING=4096 /
+// PROBE_MEM_BYTES_CEILING=2^50=1PiB) — schema now fail-louds at report time; web-admin's clamp stays 双保险.
 export const PROBE_CPU_CORES_MAX = 4096;
 export const PROBE_MEM_BYTES_MAX = 2 ** 50; // 1 PiB
 export const HostProbes = z.object({
     /** 探测到的 CPU 核数(docker info NCPU / k8s node allocatable cpu)。可为小数(k8s allocatable 如 3.9)。 */
     cpuCores: z.number().finite().positive().max(PROBE_CPU_CORES_MAX),
     /** 探测到的内存字节数(docker info MemTotal / k8s node allocatable memory)。 */
-    memBytes: z.number().int().positive().max(PROBE_MEM_BYTES_MAX),
+    memBytes: INTEGER.positive().max(PROBE_MEM_BYTES_MAX),
     /** 当前跑着的容器数(docker info ContainersRunning / k8s node 上本 fleet 的 pod 数)。 */
-    containersRunning: z.number().int().nonnegative(),
+    containersRunning: INTEGER.nonnegative(),
     /** k8s backend 补充:node 名 + allocatable(与顶层同单位——cpuCores 核数 / memBytes 字节)。docker 无此段。 */
     k8sNode: z
         .object({
         name: z.string().min(1),
-        allocatable: z.object({ cpuCores: z.number().finite().positive().max(PROBE_CPU_CORES_MAX).optional(), memBytes: z.number().int().positive().max(PROBE_MEM_BYTES_MAX).optional() }).optional(),
+        allocatable: z.object({ cpuCores: z.number().finite().positive().max(PROBE_CPU_CORES_MAX).optional(), memBytes: INTEGER.positive().max(PROBE_MEM_BYTES_MAX).optional() }).optional(),
     })
         .optional(),
 });
 export const HostStatus = z.object({
     /** host name(hosts 域 HostEntry.name / ORCH_HOST_ID 同字符集,同 .max(HOST_NAME_MAX=63) DNS-label bound)。
-     *  status 上报是 WRITE 路径 → fail-loud 保持(有意设计,S3 M-1 订正注记:center hosts/status PUT 无独立
+     *  status 上报是 WRITE 路径 → fail-loud 保持(有意设计,S3 M-1 订正注记:web-admin hosts/status PUT 无独立
      *  probe 上限,schema 即闸;读路径 grandfather 只涉 config-hosts 域,不涉此处)。 */
     host: z.string().min(1).max(HOST_NAME_MAX).regex(/^[a-z0-9][a-z0-9-]*$/, "lowercase letters/digits/-, no spaces"),
     backend: z.enum(["docker", "k8s"]),
@@ -2090,7 +2173,7 @@ export const HostStatus = z.object({
 // ── Domain: skills (中心化 skill 分发 — the mcp/skills design note, Roadmap B1) ─────────
 // A skill is a prompt-level capability: frontmatter (name/description/scenarios) + markdown `content`
 // the service feeds into the agent's model context when the skill is invoked (core progressive disclosure
-// — NOT the base system prompt). Still centrally-delivered agent instructions. The center stores the FULL skill
+// — NOT the base system prompt). Still centrally-delivered agent instructions. Web-admin stores the FULL skill
 // (incl. content, admin-edited); /effective ships a MANIFEST (content → contentHash) and the service
 // lazily pulls the body by hash (slice 2). Targeting is by `scenarios[]`, filtered service-side exactly
 // like the in-image `skillsForScenario` (the mcp/skills design note §3.1, §6 Q2). Applied at service boot/reconcile,
@@ -2098,27 +2181,27 @@ export const HostStatus = z.object({
 // (injected into the model on invoke) → writing this domain is gated to `publisher` + the publish gate
 // (§3.3, DOMAIN_WRITE_ROLE in store.ts).
 export const SkillSpec = z.object({
-    /** Catalog key — must match the in-image SKILLS_DIR name to OVERRIDE it (§6 Q4 中心按名覆盖). */
+    /** Catalog key — must match the in-image SKILLS_DIR name to OVERRIDE it (§6 Q4 web-admin 按名覆盖). */
     name: z.string().min(1).regex(/^[a-z0-9][a-z0-9._-]*$/i, "letters/digits/._- , no spaces"),
     /** One-line summary (frontmatter `description`) — surfaced to the model for skill selection. */
     description: z.string().default(""),
     /** Scenarios this skill applies to; empty = all scenarios (service-side filter, same as skillsForScenario). */
-    scenarios: z.array(z.string().min(1)).default([]),
+    scenarios: z.array(z.string().min(1)).prefault([]),
     /** Per-roster targeting (v2, the mcp/skills design note §6 Q2): roster NAMEs this skill is for. Empty = all rosters.
      *  Filtered at GET /effective?worker=<name> by the worker's roster; the unscoped global pull ships all. */
-    rosters: z.array(z.string().min(1)).default([]),
+    rosters: z.array(z.string().min(1)).prefault([]),
     /** The markdown body injected into the model context on invoke (progressive disclosure). Stored in full here; shipped as a hash in /effective. */
     content: z.string().default(""),
     enabled: z.boolean().default(true),
     notes: z.string().optional(),
 });
 export const SkillsConfig = z
-    .object({ skills: z.array(SkillSpec).default([]) })
+    .object({ skills: z.array(SkillSpec).prefault([]) })
     .superRefine((cfg, ctx) => {
     const seen = new Set();
     cfg.skills.forEach((s, i) => {
         if (seen.has(s.name))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate skill "${s.name}"`, path: ["skills", i, "name"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate skill "${s.name}"`, path: ["skills", i, "name"] });
         seen.add(s.name);
     });
 });
@@ -2126,15 +2209,15 @@ export const SkillsConfig = z
  *  (`readEffectiveWire`). Derived from {@link SkillSpec} exactly like {@link SkillManifestEntry} is (omit
  *  `content` / require `contentHash`) so schema, entry type and interface can never drift apart. Only
  *  `min(1)` on contentHash: the hash is the service's PULL KEY for the content endpoint, its exact format
- *  is the center's writing concern — re-pinning it here would make an old reader reject a newer center's
+ *  is web-admin's writing concern — re-pinning it here would make an old reader reject a newer web-admin's
  *  legal hash scheme. */
 export const SkillsManifestSchema = z.object({
-    skills: z.array(SkillSpec.omit({ content: true }).extend({ contentHash: z.string().min(1) })).default([]),
+    skills: z.array(SkillSpec.omit({ content: true }).extend({ contentHash: z.string().min(1) })).prefault([]),
 });
 // ── Domain: mcp (MCP server 注册表 — the mcp/skills design note, Roadmap B1) ────────────
-// sema-registry = an MCP-server REGISTRY: a scenario mounts a subset by `scenarios[]`. Maps onto core's
+// web-admin = an MCP-server REGISTRY: a scenario mounts a subset by `scenarios[]`. Maps onto core's
 // `McpServerSpec = { name, transport: {kind:"stdio",command,args?,env?} | {kind:"http",url,headers?}, allowTools?, contentOrigin?, source? }`.
-// SECRET BOUNDARY (§3.1, design/15): a transport's env/header VALUES may be secret → the center stores only
+// SECRET BOUNDARY (§3.1, design/15): a transport's env/header VALUES may be secret → web-admin stores only
 // env-NAME references (`envRefs`/`headerRefs`: target-key → an ENV_NAME in the SERVICE's env). The service's
 // `resolveSpec` reads the real values from its own environment — this DB never holds a credential. Like
 // skills, MCP is applied at boot/reconcile (not hot) and writing is gated to `publisher` + the publish gate.
@@ -2184,12 +2267,10 @@ export const McpTransport = z.discriminatedUnion("kind", [
     }),
 ]);
 /** The closed word table for {@link McpServerSpec}.contentOrigin — a MIRROR literal of the engine's
- *  `ToolContentOrigin`. This package deliberately carries no engine dependency axis (the same ruling that made
- *  PROMPT_ARTIFACT_LIMITS a mirror constant), so the cross-package enforcement point is NOT here: the consumer
- *  compile-pins its own copy against the engine type in both directions (AssertNever pair), and on picking this
- *  package up it should add a same-source assertion against THIS table too — it is the one repo holding both
- *  dependencies. Inside this repo the table is pinned as a literal only (a drift surfaces at the consumer's
- *  pickup gate, never silently on the wire — an out-of-table word is rejected at parse on both sides). */
+ *  `ToolContentOrigin`. This package carries no engine RUNTIME dependency (the same ruling that made
+ *  PROMPT_ARTIFACT_LIMITS a mirror constant); the mirror is pinned HERE, by its owner: the upstream drift gate
+ *  (group ⑥) asserts at compile time that this union and the engine type are the same in both directions, against the
+ *  engine the devDependency pins. Consumers import this table — they keep no copy of their own. */
 export const MCP_CONTENT_ORIGINS = ["local", "execution", "external"];
 export const McpServerSpec = z.object({
     name: z.string().min(1).regex(/^[a-z0-9][a-z0-9._-]*$/i, "letters/digits/._- , no spaces"),
@@ -2197,10 +2278,10 @@ export const McpServerSpec = z.object({
     /** Allowlist of tool names exposed from this server (core `allowTools`). Empty/undefined = all. */
     allowTools: z.array(z.string().min(1)).optional(),
     /** Scenarios this server is mounted in; empty = all (service-side filter, same as skills). */
-    scenarios: z.array(z.string().min(1)).default([]),
+    scenarios: z.array(z.string().min(1)).prefault([]),
     /** Per-roster targeting (v2): roster NAMEs this server is for. Empty = all rosters. Filtered at
      *  GET /effective?worker=<name> by the worker's roster; the unscoped global pull ships all. */
-    rosters: z.array(z.string().min(1)).default([]),
+    rosters: z.array(z.string().min(1)).prefault([]),
     enabled: z.boolean().default(true),
     /** Per-server opt-in for INBOUND MCP elicitation (core `McpServerSpec.elicitation`, design/99 §E23). Default
      *  OFF = fail-closed: only an opted-in server may prompt the user mid-tool-call. Service forwards this into the
@@ -2245,19 +2326,19 @@ export const McpServerSpec = z.object({
     notes: z.string().optional(),
 });
 export const McpConfig = z
-    .object({ servers: z.array(McpServerSpec).default([]) })
+    .object({ servers: z.array(McpServerSpec).prefault([]) })
     .superRefine((cfg, ctx) => {
     const seen = new Set();
     cfg.servers.forEach((s, i) => {
         if (seen.has(s.name))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate mcp server "${s.name}"`, path: ["servers", i, "name"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate mcp server "${s.name}"`, path: ["servers", i, "name"] });
         seen.add(s.name);
     });
 });
 // ── Domain: plugins (plugin SOURCE REFERENCES — C2 plugins 上云, additive 0.5.0) ──────────────────────────
 // The cloud stores WHERE a plugin comes from, NEVER its content (产品拍板): {name, source, version/sha pin}.
 // The consuming shell materializes the plugin locally from the ref (git clone / marketplace install) — the
-// registry never hosts executable plugin bytes, so there is nothing here to content-scan or lazily serve.
+// web-admin never hosts executable plugin bytes, so there is nothing here to content-scan or lazily serve.
 // Plugins are an EXECUTABLE surface (commands/hooks/MCP ride in) → write-gated to `publisher` like skills/
 // mcp (DOMAIN_WRITE_ROLE) and capped per-principal by entitlement `visiblePlugins` (deny-wins, same
 // mechanics as visibleMcp/visibleSkills — B1: a personal plugin ref is a net-new capability).
@@ -2274,18 +2355,18 @@ export const PLUGIN_ORIGIN = z
     .min(1)
     .refine((s) => !containsSecretToken(s), "plugin source must not contain a secret literal — private remotes authenticate via the consuming machine's git credentials, never an inline token")
     .refine((s) => !hasNul(s), "plugin source must not contain a NUL byte")
-    .refine((s) => /^https:\/\//i.test(s), "plugin source must be an https:// URL (contract: https-only; ssh/scp/git/file/plain-http and owner/repo shorthand are not accepted — domestic mirrors ride an https mirror domain via PLUGINS_ALLOW_HOSTS)")
-    .refine((s) => {
-    if (!/^https:\/\//i.test(s))
-        return true; // 已被上一条拒;避免对非 URL 再报一条噪声
-    try {
-        const u = new URL(s);
-        return !carriesUserinfo(u) && !urlQueryFragmentHasSecret(u);
+    .superRefine((s, ctx) => {
+    // The shape is THE URL judge's ({@link httpUrlFlaws}); this seat adds two rules of its own: https only, and spelled in full
+    // (`https://…` as written — git reads the raw string, and WHATWG's repair of `https:host/x` into `https://host/x` is not git's).
+    const flaws = httpUrlFlaws(s, ["userinfo"]);
+    if (flaws.includes("not-http-url") || new URL(s).protocol !== "https:" || s.slice(0, 8).toLowerCase() !== "https://") {
+        ctx.addIssue({ code: "custom", message: "plugin source must be an https:// URL (contract: https-only; ssh/scp/git/file/plain-http and owner/repo shorthand are not accepted — domestic mirrors ride an https mirror domain via PLUGINS_ALLOW_HOSTS)" });
+        return;
     }
-    catch {
-        return false; // claims to be https but does not parse → reject
+    if (flaws.includes("userinfo") || urlQueryFragmentHasSecret(new URL(s))) {
+        ctx.addIssue({ code: "custom", message: "an https plugin source must not embed credentials (userinfo) or a secret-bearing query/fragment" });
     }
-}, "an https plugin source must not embed credentials (userinfo) or a secret-bearing query/fragment");
+});
 /** A full 40-hex git commit SHA — the ONLY pin form the supply-side treats as 钉死 (a branch/tag `version`
  *  is a moving ref; only a commit pin makes the materialized bytes reproducible). */
 export const GIT_COMMIT_SHA = z.string().regex(/^[a-f0-9]{40}$/, "must be a full 40-character lowercase git commit SHA");
@@ -2316,37 +2397,40 @@ export const PluginSpec = z.object({
     notes: z.string().optional(),
 });
 export const PluginsConfig = z
-    .object({ plugins: z.array(PluginSpec).default([]) })
+    .object({ plugins: z.array(PluginSpec).prefault([]) })
     .superRefine((cfg, ctx) => {
     const seen = new Set();
     cfg.plugins.forEach((p, i) => {
         if (seen.has(p.name))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `duplicate plugin "${p.name}"`, path: ["plugins", i, "name"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `duplicate plugin "${p.name}"`, path: ["plugins", i, "name"] });
         seen.add(p.name);
     });
 });
 // ── The domain registry ───────────────────────────────────────────────────────
-// ═══ prompts 域(center prompts 战役 v1;[ref] 五定夺/[1051] 产品终稿/[1057] M2 下发形)═══
+// ═══ prompts 域(web-admin prompts 战役 v1;[ref] 五定夺/[1051] 产品终稿/[1057] M2 下发形)═══
 // schema=编译目标非用户界面([1051]⓪):三卡(角色卡/场景说明/行为守则)是 web UI 编译层心智,
-// 本契约只承载编译产物(typed 声明)与 binding。单真源纪律:存储/解析在 center(sema-web),
+// 本契约只承载编译产物(typed 声明)与 binding。单真源纪律:存储/解析在 web-admin(sema-web),
 // 消费投影在 server(声明数组逐字喂 core typed stableBlocks 钩子),schema 恒在本仓(零第二份)。
+/** 提示声明的槽位闭集(core `PromptTextDeclaration.slot` 同形):identity = 角色卡、scenario = 场景说明、behavior = 行为守则。
+ *  declaration 轴与 catalog 轴({@link PromptArtifactSection})共用这一只。 */
+export const PromptSlot = z.enum(["identity", "scenario", "behavior"]);
 /** core `PromptTextDeclaration` 的契约层同形(core prompts/default.d.ts 逐字:id/slot 闭集/text)。
  *  slot ↔ 三卡:identity=角色卡、scenario=场景说明、behavior=行为守则([1051]①)。 */
 export const PromptTextDeclaration = z.object({
     id: z.string().min(1).max(128),
-    slot: z.enum(["identity", "scenario", "behavior"]),
+    slot: PromptSlot,
     text: z.string().max(65536),
     /** core 1.315 opt-in 逐 section 对账锚([1062]①):声明方对 `text` 铸 sha256,core 校验后逐字
      *  透传进 manifest `contentHash`(错值丢弃+warn,core 永不自算非盐化 digest)。缺省=退化为
      *  整包 contentDigest 对账。契约层显式声明防非 strict parse strip 断锚([1062]③)。 */
-    contentHash: z.string().regex(/^sha256:[0-9a-f]{64}$/).optional(),
+    contentHash: Sha256Digest.optional(),
 });
 /** 三维 binding([ref]①a:v1=global/worker/scenario,砍 model 维——per-model 微调走
- *  ModelEntry.promptGuidance 专用通道)。covering 语义([1050]①b,解析只在 center 一处):
+ *  ModelEntry.promptGuidance 专用通道)。covering 语义([1050]①b,解析只在 web-admin 一处):
  *  同 slot **层间整体替换**(胜出层该 slot 声明数组整体替换低层同 slot 全部条目;层内数组保序,
  *  与 core assemble「declaration order preserved」无缝);层序 scenario > worker > global。
  *  发布即物化([1051]②a):declarations 是 publish 时物化的不可变声明(意图层/编译器版本归
- *  center 编辑面存储,非跨仓契约面)。 */
+ *  web-admin 编辑面存储,非跨仓契约面)。 */
 export const PromptBinding = z.object({
     /** 绑定层。 */
     level: z.enum(["global", "worker", "scenario"]),
@@ -2372,8 +2456,8 @@ export const PromptBinding = z.object({
 // (overlays/profiles/modelPolicies/bindings)是后续 additive 切片,本轴到时 additive 扩,零迁移。
 // 单真源纪律:server 候选门用 core 导出的 `verifyPromptArtifact`(digest 复算+上限+range 全管线),
 // 本 zod 只是**传输门**(防 DoS/坏形早拒);上限=[[镜像常量]],见 PROMPT_ARTIFACT_LIMITS。
-/** core `ARTIFACT_LIMITS` 的镜像常量([1247]②/[1254] 拍:web/registry-core 不加 core 依赖轴 ⇒ 镜像
- *  + **server 仓 CI 对表钉「逐键 === core 导出」**——改上限必须同 PR 动两处+过钉,三门数值恒等自证)。 */
+/** core `ARTIFACT_LIMITS` 的镜像常量(本包不加 core 运行期依赖轴 ⇒ 镜像)。对表钉住在**镜像的属主**这里:上游漂移门 ⑤ 逐键
+ *  === devDependency 钉住的那只 core 的导出 —— 改上限必须同版动两处、过钉。 */
 export const PROMPT_ARTIFACT_LIMITS = {
     maxSections: 64,
     maxSectionBytes: 32_000,
@@ -2386,9 +2470,9 @@ export const PROMPT_ARTIFACT_LIMITS = {
  *  为 UTF-16 码元数,core verify 按 UTF-8 字节复核——传输门宽、语义门准)。 */
 export const PromptArtifactSection = z.object({
     id: z.string().min(1).max(PROMPT_ARTIFACT_LIMITS.maxIdLength).regex(/^[a-z0-9][a-z0-9/._-]*$/),
-    slot: z.enum(["identity", "scenario", "behavior"]),
+    slot: PromptSlot,
     text: z.string().min(1).max(PROMPT_ARTIFACT_LIMITS.maxSectionBytes),
-    contentHash: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+    contentHash: Sha256Digest,
 });
 /** core `PromptCatalogSnapshot` 同形。packId=逻辑名(如 `center:acme@3`),历史身份恒在 digest。 */
 export const PromptCatalogSnapshot = z.object({
@@ -2401,7 +2485,7 @@ export const PromptCatalogSnapshot = z.object({
 export const PromptEpochArtifactPayload = z.object({
     schemaVersion: z.literal(1),
     assemblyApi: z.literal(1),
-    catalogDigest: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+    catalogDigest: Sha256Digest,
     compatibleCore: z
         .object({
         minCore: z.string().regex(/^\d+\.\d+\.\d+$/).optional(),
@@ -2418,16 +2502,16 @@ export const PromptEpochArtifactPayload = z.object({
 export const PublishedPromptArtifactEnvelope = z.object({
     artifact: z.object({
         payload: PromptEpochArtifactPayload,
-        artifactDigest: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+        artifactDigest: Sha256Digest,
     }),
     sourceRevision: z.string().min(1).max(256),
 });
-/** prompts 域存储形 v1(center 存储真形;[1043] PromptCatalogPayload 的 v1 最小面)。
+/** prompts 域存储形 v1(web-admin 存储真形;[1043] PromptCatalogPayload 的 v1 最小面)。
  *  overlays/profiles/modelPolicies = 协议 §5.1 的后续 additive 面,留位不预设形(等 core S6
  *  catalog schema 班车,additive 补键零迁移)。 */
 export const PromptsConfig = z.object({
-    bindings: z.array(PromptBinding).max(256).default([]),
-    /** catalog 轴存储位(0.10.20,[985]a):center 发布门铸好的 immutable envelope 原样存(发布即
+    bindings: z.array(PromptBinding).max(256).prefault([]),
+    /** catalog 轴存储位(0.10.20,[985]a):web-admin 发布门铸好的 immutable envelope 原样存(发布即
      *  物化,店内零解析);local FileConfigStore lane 的 config.d/prompts.json 也可直接携带——catalog
      *  免 covering 解析,两 lane 自此同形(结束 local lane prompts 不透传的过渡态,[1234]① 位)。 */
     catalog: PublishedPromptArtifactEnvelope.optional(),
@@ -2438,17 +2522,22 @@ export const PromptsConfig = z.object({
  *  `promptsContentDigest`);sections=covering 已走完的基线终形(worker/core 零解析义务);
  *  scenarioOverrides[s]=该场景完整重算终形(整包替换非增量),无键=用基线;fail-closed=
  *  publish 闸关时整个 key 不出现。 */
+/** prompts 包身份 `packId` 的前缀(铸点 `promptsContentDigest` 与判官 {@link PromptPackId} 都引它)。值落在引擎的会话记录里、是
+ *  epoch 不误重 pin 的依据,所以值本身不随叫法归一改(换前缀 = 每条活会话的提示包身份翻一次,要引擎先读 epoch 判据)。 */
+export const PROMPT_PACK_ID_PREFIX = "center:";
+/** prompts 包身份的形:前缀 + 内容摘要的前 12 位小写 hex(纯内容寻址:同内容重发布 = 同 packId)。判它的每一处都引这一只。 */
+export const PromptPackId = z.string().regex(new RegExp(`^${PROMPT_PACK_ID_PREFIX}[0-9a-f]{12}$`));
 export const EffectivePrompts = z.object({
-    packId: z.string().regex(/^center:[0-9a-f]{12}$/),
-    contentDigest: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+    packId: PromptPackId,
+    contentDigest: Sha256Digest,
     sections: z.array(PromptTextDeclaration),
     scenarioOverrides: z.record(z.string(), z.array(PromptTextDeclaration)).optional(),
 });
 /** effective 下发形 v2(双轴,[985]a §1/[1242] Q1 裁:单 domain 单键、两轴是过渡窗内的两种表达)。
  *  declarations=现行 A 形(centerPromptProvider 继续消费);catalog=B 形(core S1 verify 管线的输入,
  *  server 原样交 core 不解释)。至少一轴必须在场(空对象=坏形);催收面语义照旧=publish 闸关时整个
- *  `prompts` key 消失(fail-closed)。存量兼容:server 候选门同时认本形与 legacy 平铺 EffectivePrompts
- *  (center 停发平铺后自然退役,server 零改动)。 */
+ *  `prompts` key 消失(fail-closed)。引擎的候选门**只认本形**:没有 `schemaVersion` 的平铺 {@link EffectivePrompts} 体被响亮拒
+ *  (整个 prompts 面不采用,落最后一份好配置 / 内置)。 */
 export const EffectivePromptsWire = z
     .object({
     schemaVersion: z.literal(1),
@@ -2467,18 +2556,17 @@ export const DOMAIN_SCHEMAS = {
     collab: CollabConfig, // 0.7.0: replaces `teams` (EXPERT-REDESIGN §8/§9 同批换刀 — no editing gap)
     workers: WorkersConfig,
     hosts: HostsConfig,
-    runtime: RuntimeConfig,
     governance: GovernanceConfig,
     entitlement: EntitlementConfig,
     execution: ExecutionPolicy, // 0.8.0: S3 execution-lane policy (scope 级; client-advisory until service gate)
     projects: ProjectsConfig, // 0.10.0: 142-S3 project identity ledger + 无仓铸造权威 (scope=tenant 轴; NOT portable — 租户身份数据)
-    prompts: PromptsConfig, // 0.10.18: center prompts 战役 v1([ref] 五定夺/产品终稿/M2 下发形;写门/store 携带解锁=[1064]②)
+    prompts: PromptsConfig, // 0.10.18: web-admin prompts 战役 v1([ref] 五定夺/产品终稿/M2 下发形;写门/store 携带解锁=[1064]②)
     limits: LimitsConfig, // 0.19.0: cost/限流族热更新发布位(消费方 #322 批1;本地腿闭集缺口的源头修复)
     // integrations + access: DELETED in 0.6.0 (EXPERT-REDESIGN §9) — parseDomain/effective/路由随之 404。
 };
 // ── Effective-config PROVENANCE (the unified shape TOC `sema config --effective` and TOB `/effective?principal=`
 //    step-5 trace both emit, so "why is this value what it is" renders identically across both seats). Settled
-//    via the center control-plane design gate③ (see the center control-plane design note §R2-T/§10). A pure
+//    via web-admin control-plane design gate③ (see web-admin control-plane design note §R2-T/§10). A pure
 //    CONTRACT type — no runtime dep on the engine; the axis VALUES (enforcement/lockBehavior) mirror @sema-agent/
 //    core's safety vocabulary, validated by a dev-only conformance test (never a runtime import).
 /** One provenance source in a key's resolution trail. Two orthogonal axes: the TOC file LAYER, or the TOB
@@ -2497,7 +2585,7 @@ export const SettingSource = z.discriminatedUnion("axis", [
  *  `lockBehavior` (BEHAVIOR / what the managed layer does) is orthogonal, only meaningful under managed enforcement. */
 export const EffectiveKey = z.object({
     key: z.string(),
-    value: z.unknown(),
+    value: z.unknown().optional(),
     winningSource: SettingSource,
     locked: z.boolean(),
     enforcement: z.enum(["gate", "server", "resolver", "client"]),