@sema-agent/settings-schema 11.1.0 → 11.3.0

package/dist/types.js

@@ -24,11 +24,15 @@ import { isLoopbackAuthHost } from "./loopback.js";
 import { httpUrlFlaws, httpUrlRule } from "./url-shape.js"; // 11.0.0: THE URL shape judge // 11.0.0: the one narrow「本机」predicate (auth relaxation)
 import { secretScanForms } from "./secret-scan.js"; // package-private normalization — the one set of forms both scanners read (not in the barrel)
 import { WEB_ADMIN_ENV } from "./web-admin-env.js"; // the three connection keys the config renderer writes are reserved worker env
+import { PREVIOUS_WEB_ADMIN_ENV } from "./previous-web-admin-env.js"; // the previous generation's names of those three (the renderer still writes them for engines that read them)
 import { retiredEnvRefusal } from "./retired-envs.js"; // the worker env write gate asks the retired-env tombstone table too (one table, one refusal sentence)
 import { Sha256Digest } from "./sha256.js"; // the one `sha256:<hex>` digest form
 import { EXECUTION_LANES, EXECUTION_LANE_WORDS, MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS, retiredLaneWordRefusal } from "./execution-lanes.js"; // 7.0.0 M-R2: the lane / store vocabulary (one exported table)
 import { LANE_ENV_OWNER, isMigratableEnvKey, laneEnvSeat, laneRowOf } from "./execution-lane-index.js"; // package-private indexes derived from that table (not in the barrel)
 import { migrationSignpost, retiredFormSentence, retiredKey } from "./retired-form.js"; // 11.0.0: the ONE retired-form sentence + key tombstone (package-private)
+import { buildQuotedIssue, fixed } from "./quoted-issue.js"; // THE minting point of custom issues (package-private)
+import { AbsoluteHostPath } from "./host-path.js"; // the one host-path shape judge (a task's cwd and a project's folder / file entries)
+import { RFC3339_DATE_TIME } from "./rfc3339.js"; // the package's one RFC 3339 date-time judge (package-private)
 // COARSE, best-effort literal-secret SHAPE detector (NOT exhaustive — the real boundary is the env-NAME schema
 // on structured fields). Rejected in free-form value fields (worker `env`, model `extraBody`), URL components,
 // AND as an env-NAME value (an AWS key id is a valid env-NAME charset yet is a secret VALUE, not a NAME). Case-
@@ -55,7 +59,7 @@ export const ENV_NAME = z
     // lowercase — the charset above rejects them). The ONE secret shape that IS a valid all-caps env-NAME charset
     // is an AWS access-key id (AKIA…) — block exactly that, WITHOUT false-rejecting legit names like
     // GITHUB_PAT_TOKEN / GHU_TOKEN (which the full SECRET_LITERAL_RE would). Round-5.
-    .refine((s) => !/^AKIA[0-9A-Z]{12,}$/.test(s), "looks like an AWS access-key id, not an env-NAME — put the NAME of the env var here (the value lives in .env)");
+    .refine((s) => !/^AKIA[0-9A-Z]{12,}$/.test(s), buildQuotedIssue `looks like an AWS access-key id, not an env-NAME — put the NAME of the env var here (the value lives in .env)`);
 function scanForSecret(s) {
     // A private-key PEM header ANYWHERE in the string (the one regex the display redactor reads too). The header carries spaces, so
     // neither the start-anchored SECRET_LITERAL_RE below nor the tokenizer at the bottom can see it behind a prefix / newline. 10.0.0.
@@ -93,30 +97,11 @@ function scanForSecret(s) {
  *  fs path — so the worker dies at exec/boot, not at config edit. A NUL is never legitimate in a command / path
  *  / host / image, so reject it on every exec-bound string field (mcp stdio + the whole remoteExec contract). R20. */
 export const hasNul = (s) => s.includes("\0");
-/** The one rendering of a quoted sentence: `template[0] + show(operands[0]) + template[1] + … + template[n]`. `show` defaults to
- *  the value as written (that is how `message` is minted); a sanitizer / log boundary passes its own. */
-export function renderQuotedSentence(p, show = String) {
-    return p.template.reduce((out, part, i) => (i === 0 ? part : `${out}${show(p.operands[i - 1])}${part}`), "");
-}
-const fixed = (text) => ({ fixedText: text });
-/** Mint a custom issue's `message` + `params` from a tagged template (`buildQuotedIssue\`duplicate model "${name}"\``): every
- *  interpolation is an operand unless wrapped in {@link fixed} (then it is template text). The ONE minting point of quoted
- *  sentences in this file — a template literal written straight into `message` would put a value into a sentence with no record
- *  of where it is (a source gate pins that none is left). */
-function buildQuotedIssue(strings, ...parts) {
-    const template = [strings[0]];
-    const operands = [];
-    parts.forEach((part, i) => {
-        if (typeof part === "object")
-            template[template.length - 1] += part.fixedText + strings[i + 1];
-        else {
-            operands.push(part);
-            template.push(strings[i + 1]);
-        }
-    });
-    const params = { template, operands };
-    return { message: renderQuotedSentence(params), params };
-}
+/** The params of a custom issue's sentence and their one rendering live in the package-private minting module `./quoted-issue`
+ *  (one minting point for the whole package); re-exported here unchanged. */
+export { renderQuotedSentence } from "./quoted-issue.js";
+/** The one host-path shape judge (a task's `cwd`, a project's `folder` / `file` entries) lives in its leaf module `./host-path`. */
+export { ABSOLUTE_HOST_PATH_MAX, AbsoluteHostPath, isAbsoluteHostPath } from "./host-path.js";
 /** Does `s` contain a secret-shaped token? —— **the one scanner** (11.0.0, S-1274): the write side (this detector, behind every
  *  free-text write port — NON_SECRET_URL, mcp stdio, execution coords, ssh login, worker env, extraBody, …) and the display side
  *  (`redactSecrets`) read the SAME normalized forms ({@link secretScanForms} in the package-private `./secret-scan`: the raw string,
@@ -168,49 +153,52 @@ export function urlQueryFragmentHasSecret(u) {
  *  after it is dropped with it — the engine and server refuse a model route root that carries one, so a stored one only fails
  *  later, on the worker). A query is a legitimate request parameter (`?api-version=…`) and stays. */
 const NON_SECRET_URL_FORBIDS = ["userinfo", "fragment"];
-/** The refusal sentence of one flaw at a {@link NON_SECRET_URL} seat: the judge's rule sentence, and — for the one flaw that stored data
- *  can carry from before 11.0.0 (a fragment) at a seat the one-time migration reaches — the signpost to the migration that strips
- *  it, joined the way the other signposted refusals join it (`<rule>; <signpost>`). Closed over the judge's flaw words: a new word is
- *  a compile error here. */
-function nonSecretUrlSentence(flaw, reachedByMigration) {
+/** The refusal of one flaw at a {@link NON_SECRET_URL} seat (a {@link QuotedIssue} with no operands — the sentence quotes no value): the
+ *  judge's rule sentence, and — for the one flaw that stored data can carry from before 11.0.0 (a fragment) at a seat the one-time migration
+ *  reaches — the signpost to the migration that strips it, joined the way the other signposted refusals join it (`<rule>; <signpost>`).
+ *  Closed over the judge's flaw words: a new word is a compile error here. */
+function nonSecretUrlIssue(flaw, reachedByMigration) {
     switch (flaw) {
         case "fragment":
-            return reachedByMigration ? `${httpUrlRule(flaw)}; ${migrationSignpost("SS-M7", "11.0.0")}` : httpUrlRule(flaw);
+            return reachedByMigration ? buildQuotedIssue `${fixed(httpUrlRule(flaw))}; ${fixed(migrationSignpost("SS-M7", "11.0.0"))}` : buildQuotedIssue `${fixed(httpUrlRule(flaw))}`;
         case "not-http-url":
         case "userinfo":
         case "query":
-            return httpUrlRule(flaw);
+            return buildQuotedIssue `${fixed(httpUrlRule(flaw))}`;
         default: {
             const unhandled = flaw;
-            throw new Error("nonSecretUrlSentence: unhandled flaw word", { cause: unhandled });
+            throw new Error("nonSecretUrlIssue: unhandled flaw word", { cause: unhandled });
         }
     }
 }
 /** One judge, two seat kinds — the only difference is the fragment refusal's migration signpost. `reachedByMigration` = the seat sits in a
- *  stored domain document, which the one-time migration SS-M7 rewrites (it finds its seats by this schema's identity, so "carries the
+ *  stored document the one-time migration SS-M7 rewrites (it finds its seats by this schema's identity, so "carries the
  *  signpost" and "is rewritten by SS-M7" cannot drift apart). */
 function createNonSecretUrl(reachedByMigration) {
     return z.string().superRefine((s, ctx) => {
         const flaws = httpUrlFlaws(s, NON_SECRET_URL_FORBIDS);
-        for (const flaw of flaws)
-            ctx.addIssue({ code: "custom", message: nonSecretUrlSentence(flaw, reachedByMigration), params: { flaw } });
+        for (const flaw of flaws) {
+            const refusal = nonSecretUrlIssue(flaw, reachedByMigration);
+            ctx.addIssue({ code: "custom", ...refusal, params: { ...refusal.params, flaw } }); // `flaw` = the judge's rule word, beside the sentence's params
+        }
         if (flaws.length === 0 && urlQueryFragmentHasSecret(new URL(s))) {
-            ctx.addIssue({ code: "custom", message: "must not carry a secret-shaped value in its path or query — secrets go in the *Env (env-NAME) fields" });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `must not carry a secret-shaped value in its path or query — secrets go in the *Env (env-NAME) fields` });
         }
     });
 }
 /** A URL handed to `fetch` that carries no credential: judged by THE URL shape judge ({@link httpUrlFlaws}, `./url-shape`) — a
  *  hierarchical http(s) URL with neither userinfo nor a fragment (an empty `#` included, 11.0.0) — and with no secret-shaped value
  *  in its path or query ({@link urlQueryFragmentHasSecret}). One issue per flaw, its message the judge's rule sentence (no value
- *  echoed; a fragment's also names its migration, {@link nonSecretUrlSentence}); `params.flaw` carries the rule word.
+ *  echoed; a fragment's also names its migration, {@link nonSecretUrlIssue}); `params` carries the sentence (`template` / `operands`,
+ *  no operands) and `flaw`, the rule word.
  *
- *  This is the seat of every URL in a stored DOMAIN document (models `baseUrl`, mcp `url`, `sessionMirror.engineUrl`, workers
- *  `gitApiBaseUrl`). A URL outside the domain documents — `remote-exec.json`'s endpoints, the web-admin credential envelope's
- *  `issuer` — uses {@link NON_SECRET_URL_NO_MIGRATION}.
+ *  This is the seat of every URL in a STORED document the one-time migration rewrites: the domain documents (models `baseUrl`, mcp `url`,
+ *  `sessionMirror.engineUrl`, workers `gitApiBaseUrl`) and `config.d/remote-exec.json` (k8s `apiUrl`, `s3Snapshot.endpoint`). A URL
+ *  that is not stored data — the web-admin credential envelope's `issuer`, a wire input — uses {@link NON_SECRET_URL_NO_MIGRATION}.
  *
  *  The value is kept EXACTLY as written: nothing here trims or normalizes it (zod's own `.url()` would hand back a rewritten string). */
 export const NON_SECRET_URL = createNonSecretUrl(true);
-/** {@link NON_SECRET_URL}'s judge for a seat no one-time migration reaches (not a domain document): identical rules and rule
+/** {@link NON_SECRET_URL}'s judge for a seat no one-time migration reaches (not stored data): identical rules and rule
  *  sentences, but a fragment's refusal carries no migration signpost — pointing at a migration that cannot rewrite the value would
  *  send the operator to a command that does nothing for it. */
 export const NON_SECRET_URL_NO_MIGRATION = createNonSecretUrl(false);
@@ -298,19 +286,19 @@ function vetFreeFormJson(v, field) {
         rawUnsafe = extraBodyUnsafe(v);
     }
     catch {
-        return { ok: false, ...buildQuotedIssue `${fixed(field)} could not be validated (reflective access threw)` }; // R11
+        return { ok: false, issue: buildQuotedIssue `${fixed(field)} could not be validated (reflective access threw)` }; // R11
     }
     if (rawUnsafe)
-        return { ok: false, ...buildQuotedIssue `${fixed(field)}: a key/value is a secret shape, non-JSON (Infinity/function/Map), an accessor, cyclic, or too deep` };
+        return { ok: false, issue: buildQuotedIssue `${fixed(field)}: a key/value is a secret shape, non-JSON (Infinity/function/Map), an accessor, cyclic, or too deep` };
     let clone;
     try {
         clone = JSON.parse(JSON.stringify(v)); // the ONLY serialization — its result is what we scan AND persist
     }
     catch {
-        return { ok: false, ...buildQuotedIssue `${fixed(field)} is not JSON-serializable` };
+        return { ok: false, issue: buildQuotedIssue `${fixed(field)} is not JSON-serializable` };
     }
     if (extraBodyUnsafe(clone))
-        return { ok: false, ...buildQuotedIssue `${fixed(field)}: its serialized form carries a secret` };
+        return { ok: false, issue: buildQuotedIssue `${fixed(field)}: its serialized form carries a secret` };
     return { ok: true, value: clone };
 }
 /** The transform of every **parse-transparent free-form** key (`z.unknown().optional().transform(createFreeFormTransform(field))`:
@@ -323,7 +311,7 @@ function createFreeFormTransform(field) {
             return undefined;
         const vetted = vetFreeFormJson(v, field);
         if (!vetted.ok) {
-            ctx.addIssue({ code: "custom", message: vetted.message, params: vetted.params });
+            ctx.addIssue({ code: "custom", ...vetted.issue });
             return z.NEVER;
         }
         return vetted.value;
@@ -503,12 +491,12 @@ export const ModelEntry = z.object({
             return undefined;
         const proto = typeof v === "object" && v !== null ? Object.getPrototypeOf(v) : undefined;
         if (typeof v !== "object" || v === null || Array.isArray(v) || (proto !== Object.prototype && proto !== null)) {
-            ctx.addIssue({ code: "custom", message: "extraBody must be a plain JSON object" });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `extraBody must be a plain JSON object` });
             return z.NEVER;
         }
         const vetted = vetFreeFormJson(v, "extraBody");
         if (!vetted.ok) {
-            ctx.addIssue({ code: "custom", message: vetted.message, params: vetted.params });
+            ctx.addIssue({ code: "custom", ...vetted.issue });
             return z.NEVER;
         }
         return vetted.value;
@@ -807,7 +795,7 @@ export const SystemEntry = z.object({
             // worker that isn't provisioned yet has no Secret to label-check, so a name-level reservation is
             // the only thing closing the "squat on a future worker's credential surface" timing hole (S3 设计
             // §4.4, council DESIGN-6/13). Cost: callers can't use a secret that happens to end in -env.
-            .refine((n) => !n.endsWith("-env"), { message: 'secret names ending in "-env" are reserved for orchestrator worker-credential projections (红线1)' }),
+            .refine((n) => !n.endsWith("-env"), buildQuotedIssue `secret names ending in "-env" are reserved for orchestrator worker-credential projections (红线1)`),
         key: z.string().regex(/^[-._a-zA-Z0-9]+$/, "k8s secret data key").max(253),
     })
         .optional(),
@@ -974,13 +962,23 @@ export const LimitsConfig = z.object({
 // The governance trio an operator tunes via publish: autonomy ladder + command guardrails + approval-required
 // tools. NOT下沉 — gets its own admin tab (E5 form; E1 ships a transitional generic editor). Same `.optional()`
 // no-default discipline as the six gates: ABSENT = web-admin 不管这项(keep env / 消费者默认),present 才生效。
+/** The autonomy ladder —— the closed set as a RUNTIME VALUE (same form as `REF_CHECKED_DOMAINS`): {@link AutonomyMode} (the zod enum)
+ *  and its type are DERIVED from this table, so a consumer that needs the words at runtime (an env parser, a catalog's enum column) imports
+ *  it instead of reaching into `GovernanceConfig.shape.autonomy.unwrap().options` or writing the four words again. */
+export const AUTONOMY_MODES = ["read-only", "ask", "plan", "auto"];
+/** `governance.autonomy`'s enum, derived from {@link AUTONOMY_MODES}. */
+export const AutonomyMode = z.enum(AUTONOMY_MODES);
+/** A `commandPolicy[]` rule's decision —— the closed set as a RUNTIME VALUE; {@link CommandDecision} and its type are DERIVED from it. */
+export const COMMAND_DECISIONS = ["allow", "ask", "deny"];
+/** `commandPolicy[].decision`'s enum, derived from {@link COMMAND_DECISIONS}. */
+export const CommandDecision = z.enum(COMMAND_DECISIONS);
 export const GovernanceConfig = z.object({
     // autonomy:一个跨 knob 的安全总开关 / 放权梯度(普通用户敢用 + 专业用户放权)。
     //   read-only(只读规划,不落改)| ask(每个放权动作问)| plan(plan-review 门)| auto(放开)。
     // ⚠️ 消费侧(service)把它**展开**到 core 已有三原语(handsReadOnly / shellGate+onAsk / plan_review),
     //   经 core 的收紧-only `tightenTaskSpec` 合并。core 裁决:不在 core 加并行 autonomy 枚举(双实现陷阱),
     //   不静默覆盖调用者已设安全字段(auto 模式尤其不能静默清门控)。详见 web-admin docs/CONFIG-RESEARCH §10。
-    autonomy: z.enum(["read-only", "ask", "plan", "auto"]).optional(),
+    autonomy: AutonomyMode.optional(),
     // commandPolicy:命令级 allow/ask/deny 护栏(remoteExec 管"在哪跑",这管"能跑什么命令")。每条 = 一个
     //   **精确 argv[0] 命令名** → 决策;**DENY-WINS**(冲突 deny 赢,与 core `combinePolicies` 一致,NOT last-match-wins)。
     // ⚠️ EXACT,不是 glob(service 裁决①,2026-06-22):core 1.114.0 shipped 的 `createCoarseCommandNamePolicy`
@@ -1002,7 +1000,7 @@ export const GovernanceConfig = z.object({
             .min(1)
             .max(128)
             .regex(/^[A-Za-z0-9._+-]+$/, "exact argv[0] command NAME — letters/digits/._+- only; NO glob (*,?), path (/), spaces or shell fragments — e.g. rm, git, docker-compose"),
-        decision: z.enum(["allow", "ask", "deny"]),
+        decision: CommandDecision,
     }))
         .optional(),
     /** Tool names needing operator approval (F4). ABSENT = web-admin 不管;显式 `[]` = 一个都不需要审批。 */
@@ -1182,7 +1180,7 @@ export const EntitlementTier = z.object({
     /** 🔴 B1 违宪修复(EXPERT-REDESIGN §4-1):tokenQuota **不挂 tier** —— 只挂 defaults/subject/groupBinding。
      *  fail-loud 而非 zod 默认的静默剥除(admin 挂上去以为生效才是最糟的)。 */
     tokenQuota: z
-        .custom(() => false, { message: "tokenQuota does not mount on a tier — mount it on defaults / subjects[] / groupBindings[] (拍板:配额挂用户/组,非访问级别)" })
+        .custom(() => false, buildQuotedIssue `tokenQuota does not mount on a tier — mount it on defaults / subjects[] / groupBindings[] (拍板:配额挂用户/组,非访问级别)`)
         .optional(),
 });
 /** A time-bounded, audited per-principal override (escape hatch above the tier/role defaults). */
@@ -1204,7 +1202,7 @@ export const EntitlementOverride = z
     // by env-NAME, never inline. (Budget overrides are numbers/enums, so this never fires on the v1 use.)
     const s = typeof o.value === "string" ? o.value : o.value == null ? "" : JSON.stringify(o.value);
     if (s && containsSecretToken(s))
-        ctx.addIssue({ code: "custom", message: "override.value appears to contain a secret token — overrides are persisted + audited; reference secrets by env-NAME, never inline a value", path: ["value"] });
+        ctx.addIssue({ code: "custom", ...buildQuotedIssue `override.value appears to contain a secret token — overrides are persisted + audited; reference secrets by env-NAME, never inline a value`, path: ["value"] });
 });
 export const EntitlementSubject = z.object({
     principal: z.string().min(1),
@@ -1367,7 +1365,7 @@ export const SESSION_MIRROR_ENGINE_URL = z.string().trim().pipe(NON_SECRET_URL).
     catch {
         return true; // already passed NON_SECRET_URL; unreachable in practice
     }
-}, "non-loopback sessionMirror.engineUrl must be https — the mirror carries session content + a Bearer credential; plain http across the network is rejected at WRITE time (shell evaluateEngineRouting 同款传输闸)");
+}, buildQuotedIssue `non-loopback sessionMirror.engineUrl must be https — the mirror carries session content + a Bearer credential; plain http across the network is rejected at WRITE time (shell evaluateEngineRouting 同款传输闸)`);
 /** Org 默认会话镜像目标(WEB-SETUP-RECON 附B,产品拍板两层,0.10.1)。**收编进 execution 域**(非独立
  *  域)——142-S3 草案同款尺量:①同一治理轴(org 对「会话数据必须落到受控引擎」的 scope 级管控,与
  *  「任务必须跑在受控 lane」同族;`required` 语义与 {@link ExecutionPolicy}.required 完全同构=壳锁定、
@@ -1452,41 +1450,72 @@ export const ExecutionPolicy = z.object({
  *  flags:本常量刻意**不带** `i`,因为它是登记簿 Record 的**键**,大小写不同的同一个 UUID 会变成两条登记行
  *  (同一 project 双注册);引擎侧是识别语义(读 marker / 找回身份),放宽合理。 */
 export const PROJECT_ID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/** The bounds of a project registration's free-form fields —— the ONE source of these numbers: the schema below reads them, and so do
+ *  the server's project routes and the admin / client forms (they import this, never copy a number). The path bound of `folder` / `file`
+ *  entries is the host-path judge's own ({@link ABSOLUTE_HOST_PATH_MAX}). */
+export const PROJECT_LIMITS = {
+    displayNameMax: 200,
+    goalMax: 2000,
+    contextItemsMax: 64,
+    noteMax: 4000,
+};
+/** A project context item's kind —— the closed set as a RUNTIME VALUE: `folder` / `file` = a host path (judged by the same
+ *  {@link isAbsoluteHostPath} as a task's `cwd`), `note` = free text. */
+export const PROJECT_CONTEXT_ITEM_KINDS = ["folder", "file", "note"];
+/** A project's icon: a token (lowercase letter first, then lowercase letters / digits / `-`, at most 64). Absent = the default icon. */
+export const PROJECT_ICON_REGEX = /^[a-z][a-z0-9-]{0,63}$/;
+/** A project's colour: `#` + six lowercase hex digits. Absent = the default colour. */
+export const PROJECT_COLOR_REGEX = /^#[0-9a-f]{6}$/;
+/** One context item of a project. */
+export const ProjectContextItem = z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("folder"), value: AbsoluteHostPath }),
+    z.object({ kind: z.literal("file"), value: AbsoluteHostPath }),
+    z.object({ kind: z.literal("note"), value: z.string().max(PROJECT_LIMITS.noteMax) }),
+]);
+// 每个字段的 schema 只写一次:登记形({@link ProjectRegistration})与 PATCH 形({@link ProjectRegistrationPatch})都由它们组成。
+const ProjectDisplayName = z.string().min(1).max(PROJECT_LIMITS.displayNameMax);
+/** 归一化 git remotes(`host/path` 形态,design/142 §1.1 归一化规范)。归一化动作发生在 scaffold/调用方,本契约只验底线形状:非空、无空白、
+ *  不含 "://"(出现即证据未归一化,fail-loud)。无仓 project = 空数组合法。`.max(16)` 防登记簿被单条撑爆。 */
+const ProjectGitRemotes = z
+    .array(z
+    .string()
+    .min(1)
+    .max(512)
+    .refine((s) => !/\s/.test(s) && !s.includes("://"), buildQuotedIssue `must be a NORMALIZED remote (host/path — no scheme, no whitespace)`))
+    .max(16);
+/** 该项目会话的默认记忆 scope 词表。OPEN value domain — z.string(),不 enum(纪律:加词不得 BREAKING)。方向(S4 细化):消费方=service
+ *  memoryScope 派生(作 TaskSpec.memory.scopes 种子),形态=v2 scope 键字符串(过 core parseScopeKey 校验;known 词根:`proj` / `userproj`)。
+ *  未知串=消费者自定义;空数组=不下发默认。本域只登记不解释,零耦合。 */
+const ProjectDefaultScopes = z.array(z.string().min(1));
+const ProjectGoal = z.string().max(PROJECT_LIMITS.goalMax);
+const ProjectContextItems = z.array(ProjectContextItem).max(PROJECT_LIMITS.contextItemsMax);
+const ProjectIcon = z.string().regex(PROJECT_ICON_REGEX, "an icon is a token: a lowercase letter, then lowercase letters / digits / -, at most 64");
+const ProjectColor = z.string().regex(PROJECT_COLOR_REGEX, "a colour is # followed by six lowercase hex digits");
 export const ProjectRegistration = z.object({
-    /** 人读名(展示/管理面用;不是身份,改名自由——身份=Record 键 projectId)。 */
-    displayName: z.string().min(1).max(120),
-    /** 归一化 git remotes(`host/path` 形态,design/142 §1.1 归一化规范)。归一化动作发生在 scaffold/
-     *  调用方,本契约只验底线形状:非空、无空白、不含 "://"(出现即证据未归一化,fail-loud)。
-     *  无仓 project = 空数组合法。`.max(16)` 防登记簿被单条撑爆。 */
-    gitRemotes: z
-        .array(z
-        .string()
-        .min(1)
-        .max(512)
-        .refine((s) => !/\s/.test(s) && !s.includes("://"), "must be a NORMALIZED remote (host/path — no scheme, no whitespace)"))
-        .max(16)
-        .prefault([]),
-    /** 该项目会话的默认记忆 scope 词表。OPEN value domain — z.string(),不 enum(纪律:加词
-     *  不得 BREAKING)。方向(S4 细化):消费方=service memoryScope 派生(作 TaskSpec.
-     *  memory.scopes 种子),形态=v2 scope 键字符串(过 core parseScopeKey 校验;known 词根:`proj` /
-     *  `userproj`)。未知串=消费者自定义;空数组=不下发默认。本域只登记不解释,零耦合。 */
-    defaultScopes: z.array(z.string().min(1)).prefault([]),
-    /** 登记人 principal(审计锚;web-admin 写面自动填 caller,不信客户端提交)。 */
+    /** 人读名(展示/管理面用;不是身份,改名自由——身份=Record 键 projectId)。上界 {@link PROJECT_LIMITS}`.displayNameMax`(200;此前 120)。 */
+    displayName: ProjectDisplayName,
+    gitRemotes: ProjectGitRemotes.prefault([]),
+    defaultScopes: ProjectDefaultScopes.prefault([]),
+    /** 登记人 principal(审计锚;web-admin 写面自动填 caller,不信客户端提交)。PATCH 改不了它。 */
     registeredBy: z.string().min(1),
-    /** 登记时刻(ISO)。web-admin 写面 server 端盖章。 */
+    /** 登记时刻(ISO)。web-admin 写面 server 端盖章。PATCH 改不了它。 */
     registeredAt: z.string().min(1),
+    /** 自由备注(与 `goal` 不是一件事)。 */
     notes: z.string().optional(),
-});
-export const ProjectsConfig = z
-    .object({
-    /** 键=projectId({@link PROJECT_ID_REGEX},generic lowercase UUID——宽读);tenant 半边=web-admin
-     *  scope 轴(不进域文档,见域头注)。 */
-    projects: z.record(z.string().regex(PROJECT_ID_REGEX, "projectId must be a lowercase canonical UUID"), ProjectRegistration).prefault({}),
-})
-    .superRefine((cfg, ctx) => {
-    // 同 scope 内一条 remote 只许属于一个 project——「remote → projectId」找回阶梯(design/142
-    // §1.5 ③)与 scaffold 防重铸查询要求该映射在租户内确定;撞了=写入 fail-loud(合法双登记诉求
-    // 出现时再放开,先紧后松 additive)。
+    /** 项目目标(≤ {@link PROJECT_LIMITS}`.goalMax`)。 */
+    goal: ProjectGoal.optional(),
+    /** 项目上下文条目(≤ {@link PROJECT_LIMITS}`.contextItemsMax` 条,见 {@link ProjectContextItem})。 */
+    contextItems: ProjectContextItems.optional(),
+    /** 归档时刻(RFC 3339)。在场 = 已归档;没有硬删(会话行引用项目)。 */
+    archivedAt: RFC3339_DATE_TIME.optional(),
+    /** 图标 token({@link PROJECT_ICON_REGEX})。 */
+    icon: ProjectIcon.optional(),
+    /** 颜色({@link PROJECT_COLOR_REGEX})。 */
+    color: ProjectColor.optional(),
+});
+/** 同 scope 内一条 remote 只许属于一个 project——「remote → projectId」找回阶梯(design/142 §1.5 ③)与 scaffold 防重铸查询要求该映射在
+ *  租户内确定;撞了=写入 fail-loud(合法双登记诉求出现时再放开,先紧后松 additive)。按文档键序走:后出现的那一条被拒、句子点名先占的项目。 */
+function remoteUniquenessIssues(cfg, ctx) {
     const seen = new Map();
     for (const [pid, reg] of Object.entries(cfg.projects)) {
         for (const [i, r] of reg.gitRemotes.entries()) {
@@ -1497,7 +1526,66 @@ export const ProjectsConfig = z
             seen.set(r, pid);
         }
     }
-});
+}
+export const ProjectsConfig = z
+    .object({
+    /** 键=projectId({@link PROJECT_ID_REGEX},generic lowercase UUID——宽读);tenant 半边=web-admin
+     *  scope 轴(不进域文档,见域头注)。 */
+    projects: z.record(z.string().regex(PROJECT_ID_REGEX, "projectId must be a lowercase canonical UUID"), ProjectRegistration).prefault({}),
+})
+    .superRefine(remoteUniquenessIssues);
+/** The PATCH form of one registration: every key a PATCH may change, all optional; `registeredBy` / `registeredAt` (and any key
+ *  the registration does not have) are refused (`.strict()`). An optional key given `null` is cleared (merge-patch: `archivedAt: null`
+ *  un-archives). Each field is the registration's own schema — one bound, one shape. */
+export const ProjectRegistrationPatch = z
+    .object({
+    displayName: ProjectDisplayName.optional(),
+    gitRemotes: ProjectGitRemotes.optional(),
+    defaultScopes: ProjectDefaultScopes.optional(),
+    notes: z.string().nullable().optional(),
+    goal: ProjectGoal.nullable().optional(),
+    contextItems: ProjectContextItems.nullable().optional(),
+    archivedAt: RFC3339_DATE_TIME.nullable().optional(),
+    icon: ProjectIcon.nullable().optional(),
+    color: ProjectColor.nullable().optional(),
+})
+    .strict();
+/**
+ * Apply a PATCH to one registration and judge the whole document with **the same** {@link ProjectsConfig} (the same remote-uniqueness rule a
+ * full write meets — a PATCH has no rule of its own). The patch is judged here by {@link ProjectRegistrationPatch} first — whatever the caller
+ * did before (a request body handed over as is cannot rewrite `registeredBy` / `registeredAt` or carry an unknown key) — and only its parsed
+ * keys are merged. The patched project is judged LAST, so a remote another project already holds is refused on the patched project and the
+ * sentence names the holder, whatever the document's key order; a successful result keeps the document's key order. Every issue path is a
+ * document coordinate (`["projects", <projectId>, …]`), the patch's own included. `projectId` must be registered (the caller answers "no such
+ * project" first) —— otherwise this throws.
+ */
+export function applyProjectPatch(doc, projectId, patch) {
+    const current = Object.prototype.hasOwnProperty.call(doc.projects, projectId) ? doc.projects[projectId] : undefined;
+    if (current === undefined)
+        throw new Error(`applyProjectPatch: project "${projectId}" is not registered in this document`);
+    const parsed = ProjectRegistrationPatch.safeParse(patch);
+    if (!parsed.success) {
+        const issues = parsed.error.issues.map((i) => ({ ...i, path: ["projects", projectId, ...i.path] }));
+        return { success: false, error: new z.ZodError(issues) };
+    }
+    const next = { ...current };
+    for (const [k, v] of Object.entries(parsed.data)) {
+        if (v === undefined)
+            continue;
+        if (v === null)
+            delete next[k];
+        else
+            next[k] = v;
+    }
+    const { [projectId]: _patched, ...others } = doc.projects;
+    const judged = ProjectsConfig.safeParse({ ...doc, projects: { ...others, [projectId]: next } });
+    if (!judged.success)
+        return judged;
+    const ordered = {};
+    for (const pid of Object.keys(doc.projects))
+        ordered[pid] = judged.data.projects[pid];
+    return { ...judged, data: { ...judged.data, projects: ordered } };
+}
 // ── Domain: collab (协作模式 — multi-model collaboration templates, 0.7.0) ─────
 // Replaces the deleted `teams` domain (EXPERT-REDESIGN §8/§9, 五拍裁定 T1-T5).
 // Unified shape = slots × topology × rounds × finalizer. COMPLETELY separate from rosters (拍板): a slot
@@ -1570,7 +1658,7 @@ const CollabTemplate = z.object({
     });
     if (t.finalizer.type === "none") {
         if (t.finalizer.slot !== undefined)
-            ctx.addIssue({ code: "custom", message: `finalizer type "none" must not anchor a slot`, path: ["finalizer", "slot"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `finalizer type "none" must not anchor a slot`, path: ["finalizer", "slot"] });
     }
     else if (t.finalizer.slot !== undefined && !slotIds.has(t.finalizer.slot)) {
         ctx.addIssue({ code: "custom", ...buildQuotedIssue `finalizer.slot "${t.finalizer.slot}" is not a slot id of this template`, path: ["finalizer", "slot"] });
@@ -1645,13 +1733,22 @@ const WorkerSecretRefs = z.object({
  *  · **删** `MEMORY_BACKEND`(引擎从不读的死名,渲染器不再产出)与 `TIDB_*` 族(引擎的墓碑名,见之拒启;结构字段不再产出它们)。
  *    MYSQL_* / PG_* 两族归 `runtime.store.db` + `secretRefs.dbPasswordEnv`。
  *
- * `env` / `secretEnv` 的写闸问**两张表**,各答一个问题:本表答「这个现名归哪个结构字段」(拒句指路到那个字段);墓碑表 `RETIRED_ENVS`
- * (`./retired-envs`)答「这个旧名已退役」(拒句就是墓碑句 `retiredEnvRefusal` 本身,引擎起服、壳、web-admin 读同一张表同一句)。墓碑名不进本表。
+ * `env` / `secretEnv` 的写闸问**两张表**,各答一个问题,互相独立:
+ *  · 本表答「规格作者可不可以自己设这个名」—— 不可以:它归某个结构字段,或归渲染器 / 编排器写,或与渲染器 / 编排器写的名互斥(拒句指路到那个写位);
+ *  · 墓碑表 `RETIRED_ENVS`(`./retired-envs`)答「带着墓碑表的引擎还读不读这个名」—— 不读、见之拒启(拒句就是墓碑句 `retiredEnvRefusal` 本身,引擎起服、壳、web-admin 读同一张表同一句)。
+ * 两个问题的读者不同,答案可以同时为「是」。换名窗里就是这样:更老的引擎内带更老的契约、看不见墓碑表,仍读上一代名,渲染器因此对它们仍写上一代的 URL / WORKER / TOKEN
+ * (TOKEN_FILE 与 TOKEN 互斥,同组同入)—— 这四名对第一个问题答「不可以自设」(本表),对第二个问题答「不读」(墓碑表),写闸交两句:墓碑句在前、保留句在后,各说各的事。
+ * 这是**窗期**形。窗关 —— 渲染器不再对任何目标引擎写上一代名、此后没有引擎要读它们 —— 这四名离开本表,两表回到零交集,那才是终态;窗期交集是个写死的闭集,
+ * 有钉盯着,窗关时那一钉翻回零交集。
  *
- * 11.0.0:本表与 `RETIRED_ENVS` 的旧名集合零交集 —— `ANTHROPIC_BASEURL`(墓碑名)换成现名 `ANTHROPIC_BASE_URL`;渲染器写的 web-admin 连接三键
- * 入表,同 fleet 成员身份两键的「渲染器写、不可配」。**规则一条:渲染器写的名字是保留名**(运维不可在 `env` / `secretEnv` 里自写)。改名窗里渲染器
- * 按目标引擎版本写名,对还读上一代名的引擎写的是 `SEMA_REGISTRY_URL` / `SEMA_REGISTRY_WORKER` / `SEMA_REGISTRY_TOKEN`,所以这三名与现名三键同一组、
- * 同一句拒(指路同一处)。老三名在引擎换读现名的那一版随之搬去墓碑表(同一提交);保留表与墓碑表零交集的钉会逼这一步。
+ * 11.0.0:`ANTHROPIC_BASEURL`(墓碑名)换成现名 `ANTHROPIC_BASE_URL`;渲染器写的 web-admin 连接三键入表,同 fleet 成员身份两键的「渲染器写、不可配」。
+ * **规则一条:渲染器写的名字是保留名**(运维不可在 `env` / `secretEnv` 里自写)。改名窗里渲染器按目标引擎版本写名,对还读上一代名的引擎写的是
+ * 上一代的 URL / WORKER / TOKEN 三名({@link PREVIOUS_WEB_ADMIN_ENV}),所以这三名与现名三键同一组、保留句同一句(指路同一处)。
+ * 上一代八名都是墓碑(引擎换读现名之后,新引擎见之拒启);其中上面几名因窗期而同时留在本表,另外几名(LIVE_URL / WEB_URL / DRY_RUN / ADMIN_TOKEN)没有谁写、也不与谁互斥,只是墓碑。
+ *
+ * 两把凭证的文件键与断言令牌值键也是保留名(同一条规则):断言令牌(`wat_`)的值键归编排器注入;两个文件键(主凭证 `tokenFile`、断言令牌 `assertionTokenFile`)
+ * 只给不经编排器的手接引擎、由运维直设,不经 worker 规格。文件键与同一份凭证的值键互斥(`judgeWebAdminCredentialDeclaration`:一对里两个都设 ⇒ 拒启),
+ * 规格里写了任一个就与注入撞,拒句点名各自的出路({@link WEB_ADMIN_ASSERTION_SEAT}、{@link WEB_ADMIN_OPERATOR_FILE_SEAT});上一代的 `tokenFile` 与老三名同组同入。
  */
 /** web-admin 连接三键的唯一写位(渲染器;没有 WorkerSpec 字段)—— 现名与上一代名指路同一句。 */
 const WEB_ADMIN_CONNECTION_SEAT = {
@@ -1659,6 +1756,12 @@ const WEB_ADMIN_CONNECTION_SEAT = {
     worker: "(set by the config renderer from the worker's name — not configurable)",
     token: "(set by the config renderer from the worker's pull token — not configurable)",
 };
+/** web-admin 凭证的出路:值键由编排器注入;文件键由运维直设(只给不经编排器的手接引擎),不进 worker 规格。没有 WorkerSpec 字段能写它们。
+ *  两把凭证(主凭证 `token` / `tokenFile`、断言令牌 `assertionToken` / `assertionTokenFile`)同一条规则 —— 文件键与同一份凭证的值键互斥,所以文件键同一句出路。 */
+const WEB_ADMIN_ASSERTION_SEAT = {
+    token: "(injected by the orchestrator from the worker's assertion token — not configurable)",
+};
+const WEB_ADMIN_OPERATOR_FILE_SEAT = "(set directly by the operator on a hand-wired engine that is not managed by the orchestrator — never in a worker spec — not configurable)";
 const RESERVED_ENV_FIELD = Object.freeze({
     PORT: "(fixed at 8090 — not configurable)", MODEL_PROVIDER: "model.provider", MODEL_ID: "model.modelId",
     MODEL_REASONING: "model.reasoning", MODEL_CHEAP_ID: "model.cheapId", MODEL_MAX_TOKENS: "model.maxTokens",
@@ -1682,9 +1785,14 @@ const RESERVED_ENV_FIELD = Object.freeze({
     [FLEET_SCOPE_ENV]: "(set by the config renderer from the worker's scope — not configurable)",
     // ── web-admin 连接三键:渲染器给每台 worker 写 web-admin 根 URL、worker 名与该 worker 的拉取令牌 —— 没有 WorkerSpec 字段能写它们;
     //    现名与渲染器对老引擎写的上一代名同一组(见表头注)
-    [WEB_ADMIN_ENV.url]: WEB_ADMIN_CONNECTION_SEAT.url, SEMA_REGISTRY_URL: WEB_ADMIN_CONNECTION_SEAT.url,
-    [WEB_ADMIN_ENV.worker]: WEB_ADMIN_CONNECTION_SEAT.worker, SEMA_REGISTRY_WORKER: WEB_ADMIN_CONNECTION_SEAT.worker,
-    [WEB_ADMIN_ENV.token]: WEB_ADMIN_CONNECTION_SEAT.token, SEMA_REGISTRY_TOKEN: WEB_ADMIN_CONNECTION_SEAT.token,
+    [WEB_ADMIN_ENV.url]: WEB_ADMIN_CONNECTION_SEAT.url, [PREVIOUS_WEB_ADMIN_ENV.url]: WEB_ADMIN_CONNECTION_SEAT.url,
+    [WEB_ADMIN_ENV.worker]: WEB_ADMIN_CONNECTION_SEAT.worker, [PREVIOUS_WEB_ADMIN_ENV.worker]: WEB_ADMIN_CONNECTION_SEAT.worker,
+    [WEB_ADMIN_ENV.token]: WEB_ADMIN_CONNECTION_SEAT.token, [PREVIOUS_WEB_ADMIN_ENV.token]: WEB_ADMIN_CONNECTION_SEAT.token,
+    // ── web-admin 凭证的文件键与断言令牌值键:文件键由运维直设、与同一份凭证的值键互斥 —— 规格里写任一个都与注入撞(主凭证与断言令牌同一规则)。
+    //    上一代的 TOKEN_FILE 与老三名同组同入(换名窗里还读上一代名的引擎读它)。
+    [WEB_ADMIN_ENV.tokenFile]: WEB_ADMIN_OPERATOR_FILE_SEAT, [PREVIOUS_WEB_ADMIN_ENV.tokenFile]: WEB_ADMIN_OPERATOR_FILE_SEAT,
+    [WEB_ADMIN_ENV.assertionToken]: WEB_ADMIN_ASSERTION_SEAT.token,
+    [WEB_ADMIN_ENV.assertionTokenFile]: WEB_ADMIN_OPERATOR_FILE_SEAT,
     REQUIRE_EXECUTION_LANE: "runtime.execution.lane (the renderer emits REQUIRE_EXECUTION_LANE=true for every declared lane)",
     ...Object.fromEntries([...LANE_ENV_OWNER].map(([name, owner]) => [name, laneEnvSeat(name, owner)])),
 });
@@ -1714,7 +1822,7 @@ const nonSecretLiteral = (minLength) => z
     .string()
     .min(minLength)
     .max(2048)
-    .refine((s) => !containsSecretToken(s), "looks like a literal secret — a credential goes in a secretRefs field as an env-NAME, never a value here");
+    .refine((s) => !containsSecretToken(s), buildQuotedIssue `looks like a literal secret — a credential goes in a secretRefs field as an env-NAME, never a value here`);
 /**
  * `runtime.execution` —— 这台 worker 的执行车道(渲染:`REMOTE_EXEC=<lane>` + `REQUIRE_EXECUTION_LANE=true` + coords / secretRefs 逐键)。
  *  - `lane`:{@link EXECUTION_LANE_WORDS} 之一。没有「无手」词。
@@ -1835,7 +1943,7 @@ const WorkerSpecObject = z.object({
         /** Target average CPU utilization %, vs resources.requests.cpu. Absent → backend default 80. */
         targetCpuPercent: INTEGER.min(10).max(95).optional(),
     })
-        .refine((a) => a.maxReplicas >= a.minReplicas, { message: "maxReplicas must be >= minReplicas" })
+        .refine((a) => a.maxReplicas >= a.minReplicas, buildQuotedIssue `maxReplicas must be >= minReplicas`)
         .optional(),
     /** Per-worker resource requests/limits (k8s backend). Optional → the backend's modest default
      *  (requests cpu 50m/mem 128Mi, no limits). Hash-INCLUDED → a change rolls the pods (resources are
@@ -2069,7 +2177,7 @@ export const WorkersConfig = z
         // replicas + autoscaling = two owners of the same knob (the orchestrator's SSA vs the HPA controller
         // would endlessly fight over spec.replicas) → reject at save, not at reconcile.
         if (w.replicas !== undefined && w.autoscaling) {
-            ctx.addIssue({ code: "custom", message: "replicas and autoscaling are mutually exclusive — the HPA owns the replica count when autoscaling is set", path: ["workers", i, "autoscaling"] });
+            ctx.addIssue({ code: "custom", ...buildQuotedIssue `replicas and autoscaling are mutually exclusive — the HPA owns the replica count when autoscaling is set`, path: ["workers", i, "autoscaling"] });
         }
     });
 });
@@ -2230,7 +2338,7 @@ const McpEnvRefs = z.record(ENV_NAME, ENV_NAME); // target ENV key → ENV_NAME
 const HTTP_HEADER_NAME = z
     .string()
     .regex(/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/, "must be an HTTP header NAME")
-    .refine((s) => !containsSecretToken(s), "HTTP header name must not contain a secret literal — credentials go in the env-NAME value, never the header name");
+    .refine((s) => !containsSecretToken(s), buildQuotedIssue `HTTP header name must not contain a secret literal — credentials go in the env-NAME value, never the header name`);
 // Header NAME → ENV_NAME holding its value. Header names are tokens (RFC 7230) — not env-name-shaped.
 const McpHeaderRefs = z.record(HTTP_HEADER_NAME, ENV_NAME);
 export const McpTransport = z.discriminatedUnion("kind", [
@@ -2243,13 +2351,13 @@ export const McpTransport = z.discriminatedUnion("kind", [
         command: z
             .string()
             .min(1)
-            .refine((s) => !containsSecretToken(s), "mcp stdio command must not contain a secret literal — put credentials in envRefs (an env-NAME)")
-            .refine((s) => !hasNul(s), "mcp stdio command must not contain a NUL byte (Node cannot spawn it)"),
+            .refine((s) => !containsSecretToken(s), buildQuotedIssue `mcp stdio command must not contain a secret literal — put credentials in envRefs (an env-NAME)`)
+            .refine((s) => !hasNul(s), buildQuotedIssue `mcp stdio command must not contain a NUL byte (Node cannot spawn it)`),
         args: z
             .array(z
             .string()
-            .refine((s) => !containsSecretToken(s), "mcp stdio arg must not contain a secret literal — put credentials in envRefs (an env-NAME)")
-            .refine((s) => !hasNul(s), "mcp stdio arg must not contain a NUL byte (Node cannot spawn it)"))
+            .refine((s) => !containsSecretToken(s), buildQuotedIssue `mcp stdio arg must not contain a secret literal — put credentials in envRefs (an env-NAME)`)
+            .refine((s) => !hasNul(s), buildQuotedIssue `mcp stdio arg must not contain a NUL byte (Node cannot spawn it)`))
             .optional(),
         /** target ENV key → ENV_NAME in the service env (never a secret value). */
         envRefs: McpEnvRefs.optional(),
@@ -2353,18 +2461,18 @@ export const McpConfig = z
 export const PLUGIN_ORIGIN = z
     .string()
     .min(1)
-    .refine((s) => !containsSecretToken(s), "plugin source must not contain a secret literal — private remotes authenticate via the consuming machine's git credentials, never an inline token")
-    .refine((s) => !hasNul(s), "plugin source must not contain a NUL byte")
+    .refine((s) => !containsSecretToken(s), buildQuotedIssue `plugin source must not contain a secret literal — private remotes authenticate via the consuming machine's git credentials, never an inline token`)
+    .refine((s) => !hasNul(s), buildQuotedIssue `plugin source must not contain a NUL byte`)
     .superRefine((s, ctx) => {
     // The shape is THE URL judge's ({@link httpUrlFlaws}); this seat adds two rules of its own: https only, and spelled in full
     // (`https://…` as written — git reads the raw string, and WHATWG's repair of `https:host/x` into `https://host/x` is not git's).
     const flaws = httpUrlFlaws(s, ["userinfo"]);
     if (flaws.includes("not-http-url") || new URL(s).protocol !== "https:" || s.slice(0, 8).toLowerCase() !== "https://") {
-        ctx.addIssue({ code: "custom", message: "plugin source must be an https:// URL (contract: https-only; ssh/scp/git/file/plain-http and owner/repo shorthand are not accepted — domestic mirrors ride an https mirror domain via PLUGINS_ALLOW_HOSTS)" });
+        ctx.addIssue({ code: "custom", ...buildQuotedIssue `plugin source must be an https:// URL (contract: https-only; ssh/scp/git/file/plain-http and owner/repo shorthand are not accepted — domestic mirrors ride an https mirror domain via PLUGINS_ALLOW_HOSTS)` });
         return;
     }
     if (flaws.includes("userinfo") || urlQueryFragmentHasSecret(new URL(s))) {
-        ctx.addIssue({ code: "custom", message: "an https plugin source must not embed credentials (userinfo) or a secret-bearing query/fragment" });
+        ctx.addIssue({ code: "custom", ...buildQuotedIssue `an https plugin source must not embed credentials (userinfo) or a secret-bearing query/fragment` });
     }
 });
 /** A full 40-hex git commit SHA — the ONLY pin form the supply-side treats as 钉死 (a branch/tag `version`
@@ -2413,7 +2521,9 @@ export const PluginsConfig = z
 // 消费投影在 server(声明数组逐字喂 core typed stableBlocks 钩子),schema 恒在本仓(零第二份)。
 /** 提示声明的槽位闭集(core `PromptTextDeclaration.slot` 同形):identity = 角色卡、scenario = 场景说明、behavior = 行为守则。
  *  declaration 轴与 catalog 轴({@link PromptArtifactSection})共用这一只。 */
-export const PromptSlot = z.enum(["identity", "scenario", "behavior"]);
+export const PROMPT_SLOTS = ["identity", "scenario", "behavior"];
+/** The slot enum, DERIVED from {@link PROMPT_SLOTS} (the runtime member table —— same form as `REF_CHECKED_DOMAINS`). */
+export const PromptSlot = z.enum(PROMPT_SLOTS);
 /** core `PromptTextDeclaration` 的契约层同形(core prompts/default.d.ts 逐字:id/slot 闭集/text)。
  *  slot ↔ 三卡:identity=角色卡、scenario=场景说明、behavior=行为守则([1051]①)。 */
 export const PromptTextDeclaration = z.object({
@@ -2444,11 +2554,11 @@ export const PromptBinding = z.object({
     notes: z.string().optional(),
 }).superRefine((b, ctx) => {
     if (b.level === "worker" && !b.worker)
-        ctx.addIssue({ code: "custom", message: "level=worker requires `worker`" });
+        ctx.addIssue({ code: "custom", ...buildQuotedIssue `level=worker requires \`worker\`` });
     if (b.level === "scenario" && !b.scenario)
-        ctx.addIssue({ code: "custom", message: "level=scenario requires `scenario`" });
+        ctx.addIssue({ code: "custom", ...buildQuotedIssue `level=scenario requires \`scenario\`` });
     if (b.level === "global" && (b.worker || b.scenario))
-        ctx.addIssue({ code: "custom", message: "level=global must not carry a selector" });
+        ctx.addIssue({ code: "custom", ...buildQuotedIssue `level=global must not carry a selector` });
 });
 // ═══ prompts 域 catalog 轴(0.10.20;[ref]a/[1242]/[1248] 过轮定稿;core design/148 S1 seam)═══
 // 形 = core 1.336+ 的 `PublishedPromptArtifactEnvelope`(sema-core src/prompt-assembly/artifact.ts,
@@ -2544,7 +2654,7 @@ export const EffectivePromptsWire = z
     declarations: EffectivePrompts.optional(),
     catalog: PublishedPromptArtifactEnvelope.optional(),
 })
-    .refine((w) => w.declarations !== undefined || w.catalog !== undefined, { message: "at least one axis (declarations|catalog) required" });
+    .refine((w) => w.declarations !== undefined || w.catalog !== undefined, buildQuotedIssue `at least one axis (declarations|catalog) required`);
 export const DOMAIN_SCHEMAS = {
     models: ModelsConfig,
     rosters: RostersConfig,