@sema-agent/settings-schema 6.3.0 → 7.0.0

package/dist/types.d.ts

@@ -56,7 +56,7 @@ export declare function extraBodyUnsafe(v: unknown): boolean;
 /** A k8s resource quantity ("250m", "1", "0.5", "512Mi", "1Gi", "128M") — catches garbage at config-submit
  *  rather than surfacing as a reconcile ApplyError at the apiserver (consistent with ENV_NAME/DURATION guards). */
 export declare const K8S_QUANTITY: z.ZodString;
-/** A TCP port: 1–65535. ONE shared schema so every port field (workers.coords.tidbPort, ssh.port, …) bounds
+/** A TCP port: 1–65535. ONE shared schema so every port field (workers.runtime.store.db.port, ssh.port, …) bounds
  *  the SAME way — a port of 65536/0/-1 is config corruption, reject it at validation, not at connect time. R16. */
 export declare const TCP_PORT: z.ZodNumber;
 /** Per-1M-token price ($/Mtok). Maps to the service's MODEL_COST_INPUT/OUTPUT/CACHE_READ/CACHE_WRITE
@@ -117,7 +117,8 @@ export declare const SealedApiKey: z.ZodObject<{
 export type SealedApiKey = z.infer<typeof SealedApiKey>;
 /** 谁来校验一个**解析透明键**的形。闭集:新增一员要在这里加词,穷举消费方即编译红。
  *  · `engine-ingest` —— 引擎摄入侧单点校验(不合形的那一条不挂并通告一次);
- *  · `consumer`      —— 消费方的投影/执法点(丢掉坏的那一个键、保留其宿主条目、记账)。 */
+ *  · `consumer`      —— 消费方的投影/执法点。坏值怎么处置(只丢那一个键 / 整条宿主条目不可用)是那个执法点自己的
+ *                      契约,写在登记行的 `why` 里 —— 本包不替它定。 */
 export type ParseTransparentValidator = "engine-ingest" | "consumer";
 /** {@link PARSE_TRANSPARENT_KEYS} 的一行。 */
 export interface ParseTransparentKey {
@@ -247,6 +248,16 @@ export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
      *  deep to hash later. That is not shape validation — it is the boundary every free-form value must clear to
      *  enter the persisted config and `stableHash` (R18). */
     compat: z.ZodEffects<z.ZodOptional<z.ZodUnknown>, unknown, unknown>;
+    /** Per-model extra request headers, deployment ↔ provider (e.g. `{"anthropic-beta": "context-1m-2025-08-07"}` on an
+     *  `anthropic-messages` entry). Real need: a beta that a shell passes as `--betas` / `ANTHROPIC_BETAS` never reaches the
+     *  request the engine sends; the catalog entry is the deployment-level seat for it — and without this key the entry's
+     *  declaration is stripped at parse on every read leg, so it never reaches the consumer at all.
+     *  ABSENT = key not minted = today's behaviour, zero migration.
+     *
+     *  **Parse-transparent** — who validates the shape, and why not here: {@link PARSE_TRANSPARENT_KEYS}
+     *  (`models.models[].headers`). The ONE rejection that remains is the free-form SAFETY judgment shared with `compat` /
+     *  `extraBody` ({@link vetFreeFormJson}). */
+    headers: z.ZodEffects<z.ZodOptional<z.ZodUnknown>, unknown, unknown>;
     /** 配额倍率(EXPERT-REDESIGN §4-1):该模型烧 token 双窗额度的倍率,默认 1。折算时点=weight-at-burn
      *  (记账时固化到 UsageEntry.quotaWeightAtUse/weightedTokens):改倍率只影响此后记账,不回算窗口内历史。 */
     quotaWeight: z.ZodDefault<z.ZodNumber>;
@@ -283,6 +294,7 @@ export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
     } | undefined;
     extraBody?: Record<string, unknown> | undefined;
     compat?: unknown;
+    headers?: unknown;
     notes?: string | undefined;
 }, {
     id: string;
@@ -313,6 +325,7 @@ export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
     } | undefined;
     extraBody?: unknown;
     compat?: unknown;
+    headers?: unknown;
     quotaWeight?: number | undefined;
     enabled?: boolean | undefined;
     notes?: string | undefined;
@@ -347,6 +360,7 @@ export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
     } | undefined;
     extraBody?: Record<string, unknown> | undefined;
     compat?: unknown;
+    headers?: unknown;
     notes?: string | undefined;
 }, {
     id: string;
@@ -377,6 +391,7 @@ export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
     } | undefined;
     extraBody?: unknown;
     compat?: unknown;
+    headers?: unknown;
     quotaWeight?: number | undefined;
     enabled?: boolean | undefined;
     notes?: string | undefined;
@@ -585,6 +600,16 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
          *  deep to hash later. That is not shape validation — it is the boundary every free-form value must clear to
          *  enter the persisted config and `stableHash` (R18). */
         compat: z.ZodEffects<z.ZodOptional<z.ZodUnknown>, unknown, unknown>;
+        /** Per-model extra request headers, deployment ↔ provider (e.g. `{"anthropic-beta": "context-1m-2025-08-07"}` on an
+         *  `anthropic-messages` entry). Real need: a beta that a shell passes as `--betas` / `ANTHROPIC_BETAS` never reaches the
+         *  request the engine sends; the catalog entry is the deployment-level seat for it — and without this key the entry's
+         *  declaration is stripped at parse on every read leg, so it never reaches the consumer at all.
+         *  ABSENT = key not minted = today's behaviour, zero migration.
+         *
+         *  **Parse-transparent** — who validates the shape, and why not here: {@link PARSE_TRANSPARENT_KEYS}
+         *  (`models.models[].headers`). The ONE rejection that remains is the free-form SAFETY judgment shared with `compat` /
+         *  `extraBody` ({@link vetFreeFormJson}). */
+        headers: z.ZodEffects<z.ZodOptional<z.ZodUnknown>, unknown, unknown>;
         /** 配额倍率(EXPERT-REDESIGN §4-1):该模型烧 token 双窗额度的倍率,默认 1。折算时点=weight-at-burn
          *  (记账时固化到 UsageEntry.quotaWeightAtUse/weightedTokens):改倍率只影响此后记账,不回算窗口内历史。 */
         quotaWeight: z.ZodDefault<z.ZodNumber>;
@@ -621,6 +646,7 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         extraBody?: Record<string, unknown> | undefined;
         compat?: unknown;
+        headers?: unknown;
         notes?: string | undefined;
     }, {
         id: string;
@@ -651,6 +677,7 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         extraBody?: unknown;
         compat?: unknown;
+        headers?: unknown;
         quotaWeight?: number | undefined;
         enabled?: boolean | undefined;
         notes?: string | undefined;
@@ -685,6 +712,7 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         extraBody?: Record<string, unknown> | undefined;
         compat?: unknown;
+        headers?: unknown;
         notes?: string | undefined;
     }, {
         id: string;
@@ -715,6 +743,7 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         extraBody?: unknown;
         compat?: unknown;
+        headers?: unknown;
         quotaWeight?: number | undefined;
         enabled?: boolean | undefined;
         notes?: string | undefined;
@@ -839,6 +868,7 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         extraBody?: Record<string, unknown> | undefined;
         compat?: unknown;
+        headers?: unknown;
         notes?: string | undefined;
     }[];
     roles: Partial<Record<"default" | "summarize" | "subagent" | "team" | "synthesize" | "verifier" | "classifier" | "consolidate", {
@@ -894,6 +924,7 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         extraBody?: unknown;
         compat?: unknown;
+        headers?: unknown;
         quotaWeight?: number | undefined;
         enabled?: boolean | undefined;
         notes?: string | undefined;
@@ -953,6 +984,7 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         extraBody?: Record<string, unknown> | undefined;
         compat?: unknown;
+        headers?: unknown;
         notes?: string | undefined;
     }[];
     roles: Partial<Record<"default" | "summarize" | "subagent" | "team" | "synthesize" | "verifier" | "classifier" | "consolidate", {
@@ -1008,6 +1040,7 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         extraBody?: unknown;
         compat?: unknown;
+        headers?: unknown;
         quotaWeight?: number | undefined;
         enabled?: boolean | undefined;
         notes?: string | undefined;
@@ -4715,8 +4748,9 @@ export declare const ExecutionPolicy: z.ZodEffects<z.ZodObject<{
      *  shell locks sandbox-enabled by policy; user settings can't turn it off — CC 同款语义). */
     required: z.ZodDefault<z.ZodBoolean>;
     /** Which execution lanes are allowed. OPEN value domain — z.string(), NEVER an enum: adding a lane
-     *  must not be a BREAKING schema change (promised to the service). Known lanes
-     *  today: `host` / `e2b` / `k8s` / `ssh` / `adb` / `local-docker`. Unknown strings are consumer-defined. */
+     *  must not be a BREAKING schema change (promised to the service). The closed set of lanes a worker can
+     *  declare is `EXECUTION_LANE_WORDS` (`execution-lanes.ts`, 7.0.0) — read it there, not from a copy in this
+     *  comment. Unknown strings are consumer-defined. */
     allowedLanes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
     /** Org 默认会话镜像目标(0.10.1,附B 两层)。ABSENT = INERT(center 未管镜像,壳解析序里本腿为空)。
      *  读损档随域(DOMAIN_READ_FALLBACK.execution="throw" 已覆盖:损坏绝不静默退默认放权)。 */
@@ -5569,26 +5603,15 @@ export declare const WorkerLifecycle: z.ZodObject<{
     dependsOn?: string[] | undefined;
 }>;
 export type WorkerLifecycle = z.infer<typeof WorkerLifecycle>;
-/**
- * Env keys the structured WorkerSpec fields already produce (worker-env.ts) — the general `env`/`secretEnv`
- * passthrough may NOT set these (use the dedicated field). Blocks the council's two escape-hatch risks:
- * redirecting model/traffic or disabling auth (PORT, MODEL_x, SESSION_BACKEND, REQUIRE_PRINCIPAL, gateway), and
- * shadowing a projected secret with a literal (MODEL_API_KEY, SERVICE_AUTH_TOKEN, …). LOG_LEVEL is intentionally
- * NOT reserved (benign, overridable for debugging). Keep in sync with workerToServiceEnv.
- *
- * ⚠️ SCOPE (0.1.30, after the R22→0.1.29 detour): this ONLY blocks keys that have a DEDICATED structured field
- * or secretRef — so an operator is steered to that field instead of duplicating/shadowing it via env. It does
- * NOT block the per-worker EXECUTION-SUBSTRATE config an operator legitimately sets via worker.env, which the
- * live fleet relies on: `REMOTE_EXEC` (direct=k8s, canary=e2b set it HERE), `K8S_*` (SANDBOX_IMAGE/NAMESPACE/
- * RUNTIME_CLASS/…), `E2B_*`, `MINIO_*`, `SSH_*`, `ADB_*`. worker.env is the OPERATOR's per-worker deployment env
- * (publisher-gated, projected by the orchestrator to the worker pod) — NOT untrusted-task-controlled, so there
- * is no "sandbox escape" to block here. R22 wrongly added those substrate keys treating worker.env as
- * task-controlled; it would have REJECTED the live direct/canary workers on deploy. Reverted in 0.1.30. (Literal
- * SECRET values pasted into env are still caught separately by containsSecretToken; substrate CREDS belong in
- * secretEnv as env-NAME refs.)
- */
+/** 结构化 WorkerSpec 字段已经产出的 env 名 —— 通用 `env` / `secretEnv` 逃生口**不许**设它们(用专属字段)。由
+ *  `RESERVED_ENV_FIELD`(名 → 唯一写位)的键派生;增删理由见那张表的头注。 */
 export declare const RESERVED_WORKER_ENV: Set<string>;
-export declare const WorkerSpec: z.ZodObject<{
+/** 一台 worker 的名字(唯一 → 容器名 / compose project / 缺省路由键)—— **唯一**的名字判据。中心在租约 / 用量 /
+ *  discovery `?worker=` 等面上校验外部传来的 worker 名时读它(不抄窄正则)。7.0.0 起单独导出:`WorkerSpec` 不再是普通
+ *  对象 schema(预处理 + 跨字段判据),`WorkerSpec.shape.name` 不复存在。 */
+export declare const WORKER_NAME: z.ZodString;
+/** 一台 worker 的声明。写闸 = `WorkerSpec.safeParse`(7.0.0 删除项读到即拒 + 两个结构块 + 跨字段判据)。 */
+export declare const WorkerSpec: z.ZodEffects<z.ZodEffects<z.ZodObject<{
     /** 唯一 → 容器名 / compose project. */
     name: z.ZodString;
     enabled: z.ZodDefault<z.ZodBoolean>;
@@ -5645,39 +5668,39 @@ export declare const WorkerSpec: z.ZodObject<{
             cpu: z.ZodOptional<z.ZodString>;
             memory: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
-            cpu?: string | undefined;
             memory?: string | undefined;
-        }, {
             cpu?: string | undefined;
+        }, {
             memory?: string | undefined;
+            cpu?: string | undefined;
         }>>;
         limits: z.ZodOptional<z.ZodObject<{
             cpu: z.ZodOptional<z.ZodString>;
             memory: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
-            cpu?: string | undefined;
             memory?: string | undefined;
-        }, {
             cpu?: string | undefined;
+        }, {
             memory?: string | undefined;
+            cpu?: string | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
         requests?: {
-            cpu?: string | undefined;
             memory?: string | undefined;
+            cpu?: string | undefined;
         } | undefined;
         limits?: {
-            cpu?: string | undefined;
             memory?: string | undefined;
+            cpu?: string | undefined;
         } | undefined;
     }, {
         requests?: {
-            cpu?: string | undefined;
             memory?: string | undefined;
+            cpu?: string | undefined;
         } | undefined;
         limits?: {
-            cpu?: string | undefined;
             memory?: string | undefined;
+            cpu?: string | undefined;
         } | undefined;
     }>>;
     /** Scheduling-framework knobs (CONTROL-PLANE-SCHEDULING-DESIGN, 产品拍板 D1/D3 2026-07-04). Optional and
@@ -5726,11 +5749,88 @@ export declare const WorkerSpec: z.ZodObject<{
         } | undefined;
         drainGraceMs?: number | undefined;
     }>>;
-    /** 运行时 (非 secret). 映射到 service SESSION_BACKEND/REQUIRE_PRINCIPAL/RATE_LIMIT_RPM/… */
+    /** 运行时 (非 secret). 映射到 service REQUIRE_PRINCIPAL / RATE_LIMIT_RPM / … 与两个结构块(7.0.0)。 */
     runtime: z.ZodObject<{
-        sessionBackend: z.ZodDefault<z.ZodEnum<["tidb", "memory", "auto"]>>;
-        memoryBackend: z.ZodDefault<z.ZodEnum<["off", "memory", "tidb"]>>;
-        db: z.ZodOptional<z.ZodString>;
+        /** 7.0.0 执行车道块(见 `ExecutionBlock`)。enabled 的 worker 必填(WorkerSpec 层判);停用的可缺。 */
+        execution: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+            lane: z.ZodEnum<["host", "e2b", "k8s", "ssh", "adb", "local-docker", "device"]>;
+            coords: z.ZodDefault<z.ZodRecord<z.ZodEffects<z.ZodString, string, string>, z.ZodEffects<z.ZodString, string, string>>>;
+            secretRefs: z.ZodDefault<z.ZodRecord<z.ZodEffects<z.ZodString, string, string>, z.ZodEffects<z.ZodString, string, string>>>;
+        }, "strip", z.ZodTypeAny, {
+            lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+            secretRefs: Record<string, string>;
+            coords: Record<string, string>;
+        }, {
+            lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+            secretRefs?: Record<string, string> | undefined;
+            coords?: Record<string, string> | undefined;
+        }>, {
+            lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+            secretRefs: Record<string, string>;
+            coords: Record<string, string>;
+        }, {
+            lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+            secretRefs?: Record<string, string> | undefined;
+            coords?: Record<string, string> | undefined;
+        }>>;
+        /** 7.0.0 存储块(见 `StoreBlock`)。enabled 的 worker 必填(WorkerSpec 层判);停用的可缺。 */
+        store: z.ZodOptional<z.ZodObject<{
+            backend: z.ZodEnum<["mysql", "pg", "local", "memory"]>;
+            session: z.ZodDefault<z.ZodEnum<["memory", "mysql", "auto"]>>;
+            memory: z.ZodDefault<z.ZodObject<{
+                engine: z.ZodDefault<z.ZodEnum<["on", "off"]>>;
+                backend: z.ZodDefault<z.ZodEnum<["file", "pg", "tidb"]>>;
+            }, "strip", z.ZodTypeAny, {
+                backend: "pg" | "file" | "tidb";
+                engine: "on" | "off";
+            }, {
+                backend?: "pg" | "file" | "tidb" | undefined;
+                engine?: "on" | "off" | undefined;
+            }>>;
+            /** SQL 服务器坐标(中立,一份;名族由 `backend` 决定)。 */
+            db: z.ZodOptional<z.ZodObject<{
+                host: z.ZodEffects<z.ZodString, string, string>;
+                port: z.ZodNumber;
+                user: z.ZodEffects<z.ZodString, string, string>;
+                database: z.ZodEffects<z.ZodString, string, string>;
+            }, "strip", z.ZodTypeAny, {
+                host: string;
+                port: number;
+                user: string;
+                database: string;
+            }, {
+                host: string;
+                port: number;
+                user: string;
+                database: string;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            memory: {
+                backend: "pg" | "file" | "tidb";
+                engine: "on" | "off";
+            };
+            session: "mysql" | "memory" | "auto";
+            backend: "mysql" | "pg" | "local" | "memory";
+            db?: {
+                host: string;
+                port: number;
+                user: string;
+                database: string;
+            } | undefined;
+        }, {
+            backend: "mysql" | "pg" | "local" | "memory";
+            memory?: {
+                backend?: "pg" | "file" | "tidb" | undefined;
+                engine?: "on" | "off" | undefined;
+            } | undefined;
+            session?: "mysql" | "memory" | "auto" | undefined;
+            db?: {
+                host: string;
+                port: number;
+                user: string;
+                database: string;
+            } | undefined;
+        }>>;
         scenario: z.ZodOptional<z.ZodString>;
         requirePrincipal: z.ZodDefault<z.ZodBoolean>;
         rateLimitRpm: z.ZodDefault<z.ZodNumber>;
@@ -5741,38 +5841,61 @@ export declare const WorkerSpec: z.ZodObject<{
          *  default → absent never materialises → no spec-hash churn. Hash-included (read at boot → cap change recreates). */
         maxPrincipalCostUsd: z.ZodOptional<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
-        sessionBackend: "memory" | "tidb" | "auto";
-        memoryBackend: "memory" | "tidb" | "off";
         requirePrincipal: boolean;
         rateLimitRpm: number;
-        db?: string | undefined;
+        execution?: {
+            lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+            secretRefs: Record<string, string>;
+            coords: Record<string, string>;
+        } | undefined;
+        store?: {
+            memory: {
+                backend: "pg" | "file" | "tidb";
+                engine: "on" | "off";
+            };
+            session: "mysql" | "memory" | "auto";
+            backend: "mysql" | "pg" | "local" | "memory";
+            db?: {
+                host: string;
+                port: number;
+                user: string;
+                database: string;
+            } | undefined;
+        } | undefined;
         scenario?: string | undefined;
         maxPrincipalCostUsd?: number | undefined;
     }, {
-        sessionBackend?: "memory" | "tidb" | "auto" | undefined;
-        memoryBackend?: "memory" | "tidb" | "off" | undefined;
-        db?: string | undefined;
+        execution?: {
+            lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+            secretRefs?: Record<string, string> | undefined;
+            coords?: Record<string, string> | undefined;
+        } | undefined;
+        store?: {
+            backend: "mysql" | "pg" | "local" | "memory";
+            memory?: {
+                backend?: "pg" | "file" | "tidb" | undefined;
+                engine?: "on" | "off" | undefined;
+            } | undefined;
+            session?: "mysql" | "memory" | "auto" | undefined;
+            db?: {
+                host: string;
+                port: number;
+                user: string;
+                database: string;
+            } | undefined;
+        } | undefined;
         scenario?: string | undefined;
         requirePrincipal?: boolean | undefined;
         rateLimitRpm?: number | undefined;
         maxPrincipalCostUsd?: number | undefined;
     }>;
-    /** 物理坐标 (非 secret). 映射到 GIT_API_BASEURL / TIDB_HOST 等. */
+    /** 物理坐标 (非 secret). 映射到 GIT_API_BASEURL。7.0.0 起 SQL 坐标在 `runtime.store.db`(`tidb*` 三键删除)。 */
     coords: z.ZodDefault<z.ZodObject<{
         gitApiBaseUrl: z.ZodUnion<[z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>, z.ZodLiteral<"">]>;
-        tidbHost: z.ZodOptional<z.ZodString>;
-        tidbPort: z.ZodOptional<z.ZodNumber>;
-        tidbUser: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         gitApiBaseUrl?: string | undefined;
-        tidbHost?: string | undefined;
-        tidbPort?: number | undefined;
-        tidbUser?: string | undefined;
     }, {
         gitApiBaseUrl?: string | undefined;
-        tidbHost?: string | undefined;
-        tidbPort?: number | undefined;
-        tidbUser?: string | undefined;
     }>>;
     secretRefs: z.ZodObject<{
         /** NAME of the host env var holding the model API key → service MODEL_API_KEY (或 anthropic 时 ANTHROPIC_API_KEY). */
@@ -5781,18 +5904,19 @@ export declare const WorkerSpec: z.ZodObject<{
         serviceAuthTokenEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
         /** → GIT_API_TOKEN (只读，读被评审 repo). */
         gitTokenEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-        /** → TIDB_PASSWORD. */
-        tidbPasswordEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        /** 7.0.0:SQL 店的口令 → `MYSQL_PASSWORD` / `PG_PASSWORD`(渲染器按 `runtime.store.backend` 选名族)。
+         *  在场 ⇔ `runtime.store.backend` ∈ {mysql, pg}(WorkerSpec 层判,与 `runtime.store.db` 同一条规则)。取代 6.x 的 `tidbPasswordEnv`。 */
+        dbPasswordEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     }, "strip", z.ZodTypeAny, {
         apiKeyEnv: string;
         serviceAuthTokenEnv?: string | undefined;
         gitTokenEnv?: string | undefined;
-        tidbPasswordEnv?: string | undefined;
+        dbPasswordEnv?: string | undefined;
     }, {
         apiKeyEnv: string;
         serviceAuthTokenEnv?: string | undefined;
         gitTokenEnv?: string | undefined;
-        tidbPasswordEnv?: string | undefined;
+        dbPasswordEnv?: string | undefined;
     }>;
     /**
      * 通用 env 透传（逃生口）——给**没有专属结构化字段**的 service env 用，让任意 worker 声明自己的 app 专属变量
@@ -5873,32 +5997,130 @@ export declare const WorkerSpec: z.ZodObject<{
     signature: z.ZodOptional<z.ZodString>;
     notes: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
+    host: string;
+    secretRefs: {
+        apiKeyEnv: string;
+        serviceAuthTokenEnv?: string | undefined;
+        gitTokenEnv?: string | undefined;
+        dbPasswordEnv?: string | undefined;
+    };
+    coords: {
+        gitApiBaseUrl?: string | undefined;
+    };
     name: string;
     enabled: boolean;
-    host: string;
     image: string;
     runtime: {
-        sessionBackend: "memory" | "tidb" | "auto";
-        memoryBackend: "memory" | "tidb" | "off";
         requirePrincipal: boolean;
         rateLimitRpm: number;
-        db?: string | undefined;
+        execution?: {
+            lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+            secretRefs: Record<string, string>;
+            coords: Record<string, string>;
+        } | undefined;
+        store?: {
+            memory: {
+                backend: "pg" | "file" | "tidb";
+                engine: "on" | "off";
+            };
+            session: "mysql" | "memory" | "auto";
+            backend: "mysql" | "pg" | "local" | "memory";
+            db?: {
+                host: string;
+                port: number;
+                user: string;
+                database: string;
+            } | undefined;
+        } | undefined;
         scenario?: string | undefined;
         maxPrincipalCostUsd?: number | undefined;
     };
-    coords: {
-        gitApiBaseUrl?: string | undefined;
-        tidbHost?: string | undefined;
-        tidbPort?: number | undefined;
-        tidbUser?: string | undefined;
-    };
+    notes?: string | undefined;
+    routePrefix?: string | undefined;
+    replicas?: number | undefined;
+    autoscaling?: {
+        minReplicas: number;
+        maxReplicas: number;
+        targetCpuPercent?: number | undefined;
+    } | undefined;
+    resources?: {
+        requests?: {
+            memory?: string | undefined;
+            cpu?: string | undefined;
+        } | undefined;
+        limits?: {
+            memory?: string | undefined;
+            cpu?: string | undefined;
+        } | undefined;
+    } | undefined;
+    fleet?: {
+        dispatch?: {
+            strategy: "round-robin" | "least-inflight" | "consistent-hash";
+            sessionAffinity: boolean;
+            maxInflight?: number | undefined;
+            perActorMaxInflight?: number | undefined;
+            maxCostUsd?: number | undefined;
+        } | undefined;
+        drainGraceMs?: number | undefined;
+    } | undefined;
+    env?: Record<string, string> | undefined;
+    secretEnv?: Record<string, string> | undefined;
+    recreateNonce?: string | undefined;
+    lifecycle?: {
+        kind: "persistent" | "ephemeral";
+        ttl?: string | undefined;
+        idleTimeout?: string | undefined;
+        owner?: string | undefined;
+        purpose?: string | undefined;
+        dependsOn?: string[] | undefined;
+    } | undefined;
+    placement?: {
+        auto: boolean;
+        requires: string[];
+        spread?: string | undefined;
+    } | undefined;
+    roster?: string | undefined;
+    signature?: string | undefined;
+}, {
     secretRefs: {
         apiKeyEnv: string;
         serviceAuthTokenEnv?: string | undefined;
         gitTokenEnv?: string | undefined;
-        tidbPasswordEnv?: string | undefined;
+        dbPasswordEnv?: string | undefined;
     };
+    name: string;
+    runtime: {
+        execution?: {
+            lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+            secretRefs?: Record<string, string> | undefined;
+            coords?: Record<string, string> | undefined;
+        } | undefined;
+        store?: {
+            backend: "mysql" | "pg" | "local" | "memory";
+            memory?: {
+                backend?: "pg" | "file" | "tidb" | undefined;
+                engine?: "on" | "off" | undefined;
+            } | undefined;
+            session?: "mysql" | "memory" | "auto" | undefined;
+            db?: {
+                host: string;
+                port: number;
+                user: string;
+                database: string;
+            } | undefined;
+        } | undefined;
+        scenario?: string | undefined;
+        requirePrincipal?: boolean | undefined;
+        rateLimitRpm?: number | undefined;
+        maxPrincipalCostUsd?: number | undefined;
+    };
+    host?: string | undefined;
+    coords?: {
+        gitApiBaseUrl?: string | undefined;
+    } | undefined;
+    enabled?: boolean | undefined;
     notes?: string | undefined;
+    image?: string | undefined;
     routePrefix?: string | undefined;
     replicas?: number | undefined;
     autoscaling?: {
@@ -5908,12 +6130,97 @@ export declare const WorkerSpec: z.ZodObject<{
     } | undefined;
     resources?: {
         requests?: {
-            cpu?: string | undefined;
             memory?: string | undefined;
+            cpu?: string | undefined;
         } | undefined;
         limits?: {
+            memory?: string | undefined;
+            cpu?: string | undefined;
+        } | undefined;
+    } | undefined;
+    fleet?: {
+        dispatch?: {
+            strategy?: "round-robin" | "least-inflight" | "consistent-hash" | undefined;
+            sessionAffinity?: boolean | undefined;
+            maxInflight?: number | undefined;
+            perActorMaxInflight?: number | undefined;
+            maxCostUsd?: number | undefined;
+        } | undefined;
+        drainGraceMs?: number | undefined;
+    } | undefined;
+    env?: Record<string, string> | undefined;
+    secretEnv?: Record<string, string> | undefined;
+    recreateNonce?: string | undefined;
+    lifecycle?: {
+        kind?: "persistent" | "ephemeral" | undefined;
+        ttl?: string | undefined;
+        idleTimeout?: string | undefined;
+        owner?: string | undefined;
+        purpose?: string | undefined;
+        dependsOn?: string[] | undefined;
+    } | undefined;
+    placement?: {
+        auto?: boolean | undefined;
+        requires?: string[] | undefined;
+        spread?: string | undefined;
+    } | undefined;
+    roster?: string | undefined;
+    signature?: string | undefined;
+}>, {
+    host: string;
+    secretRefs: {
+        apiKeyEnv: string;
+        serviceAuthTokenEnv?: string | undefined;
+        gitTokenEnv?: string | undefined;
+        dbPasswordEnv?: string | undefined;
+    };
+    coords: {
+        gitApiBaseUrl?: string | undefined;
+    };
+    name: string;
+    enabled: boolean;
+    image: string;
+    runtime: {
+        requirePrincipal: boolean;
+        rateLimitRpm: number;
+        execution?: {
+            lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+            secretRefs: Record<string, string>;
+            coords: Record<string, string>;
+        } | undefined;
+        store?: {
+            memory: {
+                backend: "pg" | "file" | "tidb";
+                engine: "on" | "off";
+            };
+            session: "mysql" | "memory" | "auto";
+            backend: "mysql" | "pg" | "local" | "memory";
+            db?: {
+                host: string;
+                port: number;
+                user: string;
+                database: string;
+            } | undefined;
+        } | undefined;
+        scenario?: string | undefined;
+        maxPrincipalCostUsd?: number | undefined;
+    };
+    notes?: string | undefined;
+    routePrefix?: string | undefined;
+    replicas?: number | undefined;
+    autoscaling?: {
+        minReplicas: number;
+        maxReplicas: number;
+        targetCpuPercent?: number | undefined;
+    } | undefined;
+    resources?: {
+        requests?: {
+            memory?: string | undefined;
             cpu?: string | undefined;
+        } | undefined;
+        limits?: {
             memory?: string | undefined;
+            cpu?: string | undefined;
         } | undefined;
     } | undefined;
     fleet?: {
@@ -5945,25 +6252,44 @@ export declare const WorkerSpec: z.ZodObject<{
     roster?: string | undefined;
     signature?: string | undefined;
 }, {
+    secretRefs: {
+        apiKeyEnv: string;
+        serviceAuthTokenEnv?: string | undefined;
+        gitTokenEnv?: string | undefined;
+        dbPasswordEnv?: string | undefined;
+    };
     name: string;
     runtime: {
-        sessionBackend?: "memory" | "tidb" | "auto" | undefined;
-        memoryBackend?: "memory" | "tidb" | "off" | undefined;
-        db?: string | undefined;
+        execution?: {
+            lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+            secretRefs?: Record<string, string> | undefined;
+            coords?: Record<string, string> | undefined;
+        } | undefined;
+        store?: {
+            backend: "mysql" | "pg" | "local" | "memory";
+            memory?: {
+                backend?: "pg" | "file" | "tidb" | undefined;
+                engine?: "on" | "off" | undefined;
+            } | undefined;
+            session?: "mysql" | "memory" | "auto" | undefined;
+            db?: {
+                host: string;
+                port: number;
+                user: string;
+                database: string;
+            } | undefined;
+        } | undefined;
         scenario?: string | undefined;
         requirePrincipal?: boolean | undefined;
         rateLimitRpm?: number | undefined;
         maxPrincipalCostUsd?: number | undefined;
     };
-    secretRefs: {
-        apiKeyEnv: string;
-        serviceAuthTokenEnv?: string | undefined;
-        gitTokenEnv?: string | undefined;
-        tidbPasswordEnv?: string | undefined;
-    };
+    host?: string | undefined;
+    coords?: {
+        gitApiBaseUrl?: string | undefined;
+    } | undefined;
     enabled?: boolean | undefined;
     notes?: string | undefined;
-    host?: string | undefined;
     image?: string | undefined;
     routePrefix?: string | undefined;
     replicas?: number | undefined;
@@ -5974,12 +6300,12 @@ export declare const WorkerSpec: z.ZodObject<{
     } | undefined;
     resources?: {
         requests?: {
-            cpu?: string | undefined;
             memory?: string | undefined;
+            cpu?: string | undefined;
         } | undefined;
         limits?: {
-            cpu?: string | undefined;
             memory?: string | undefined;
+            cpu?: string | undefined;
         } | undefined;
     } | undefined;
     fleet?: {
@@ -5992,12 +6318,6 @@ export declare const WorkerSpec: z.ZodObject<{
         } | undefined;
         drainGraceMs?: number | undefined;
     } | undefined;
-    coords?: {
-        gitApiBaseUrl?: string | undefined;
-        tidbHost?: string | undefined;
-        tidbPort?: number | undefined;
-        tidbUser?: string | undefined;
-    } | undefined;
     env?: Record<string, string> | undefined;
     secretEnv?: Record<string, string> | undefined;
     recreateNonce?: string | undefined;
@@ -6016,32 +6336,117 @@ export declare const WorkerSpec: z.ZodObject<{
     } | undefined;
     roster?: string | undefined;
     signature?: string | undefined;
-}>;
-export type WorkerSpec = z.infer<typeof WorkerSpec>;
-/** Effective route key for a worker = explicit routePrefix, else its name. */
-export declare function workerRouteKey(w: {
-    name: string;
-    routePrefix?: string;
-}): string;
-/** S/M/L 资源套餐常量(EXPERT-REDESIGN §3 四问③,E1 定档)——workers 向导的规格套餐与 E2 placement 的
- *  默认折算**同源引用这一份**(worker 无 requests 时按 S 折算,§2-4)。值为 k8s quantity 串,直接落
- *  `WorkerSpec.resources`;「自定义」= 不用套餐、直接写 resources。定档口径:S=轻量单副本(默认档,略高于
- *  backend 兜底 50m/128Mi 的真实工作水位);M=常规编码 agent;L=重载(大 repo/多并发 turn)。 */
-export declare const WORKER_RESOURCE_PRESETS: {
-    readonly S: {
-        readonly requests: {
-            readonly cpu: "250m";
-            readonly memory: "512Mi";
-        };
-        readonly limits: {
-            readonly cpu: "1";
-            readonly memory: "1Gi";
-        };
+}>, {
+    host: string;
+    secretRefs: {
+        apiKeyEnv: string;
+        serviceAuthTokenEnv?: string | undefined;
+        gitTokenEnv?: string | undefined;
+        dbPasswordEnv?: string | undefined;
     };
-    readonly M: {
-        readonly requests: {
-            readonly cpu: "500m";
-            readonly memory: "1Gi";
+    coords: {
+        gitApiBaseUrl?: string | undefined;
+    };
+    name: string;
+    enabled: boolean;
+    image: string;
+    runtime: {
+        requirePrincipal: boolean;
+        rateLimitRpm: number;
+        execution?: {
+            lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+            secretRefs: Record<string, string>;
+            coords: Record<string, string>;
+        } | undefined;
+        store?: {
+            memory: {
+                backend: "pg" | "file" | "tidb";
+                engine: "on" | "off";
+            };
+            session: "mysql" | "memory" | "auto";
+            backend: "mysql" | "pg" | "local" | "memory";
+            db?: {
+                host: string;
+                port: number;
+                user: string;
+                database: string;
+            } | undefined;
+        } | undefined;
+        scenario?: string | undefined;
+        maxPrincipalCostUsd?: number | undefined;
+    };
+    notes?: string | undefined;
+    routePrefix?: string | undefined;
+    replicas?: number | undefined;
+    autoscaling?: {
+        minReplicas: number;
+        maxReplicas: number;
+        targetCpuPercent?: number | undefined;
+    } | undefined;
+    resources?: {
+        requests?: {
+            memory?: string | undefined;
+            cpu?: string | undefined;
+        } | undefined;
+        limits?: {
+            memory?: string | undefined;
+            cpu?: string | undefined;
+        } | undefined;
+    } | undefined;
+    fleet?: {
+        dispatch?: {
+            strategy: "round-robin" | "least-inflight" | "consistent-hash";
+            sessionAffinity: boolean;
+            maxInflight?: number | undefined;
+            perActorMaxInflight?: number | undefined;
+            maxCostUsd?: number | undefined;
+        } | undefined;
+        drainGraceMs?: number | undefined;
+    } | undefined;
+    env?: Record<string, string> | undefined;
+    secretEnv?: Record<string, string> | undefined;
+    recreateNonce?: string | undefined;
+    lifecycle?: {
+        kind: "persistent" | "ephemeral";
+        ttl?: string | undefined;
+        idleTimeout?: string | undefined;
+        owner?: string | undefined;
+        purpose?: string | undefined;
+        dependsOn?: string[] | undefined;
+    } | undefined;
+    placement?: {
+        auto: boolean;
+        requires: string[];
+        spread?: string | undefined;
+    } | undefined;
+    roster?: string | undefined;
+    signature?: string | undefined;
+}, unknown>;
+export type WorkerSpec = z.infer<typeof WorkerSpec>;
+/** Effective route key for a worker = explicit routePrefix, else its name. */
+export declare function workerRouteKey(w: {
+    name: string;
+    routePrefix?: string;
+}): string;
+/** S/M/L 资源套餐常量(EXPERT-REDESIGN §3 四问③,E1 定档)——workers 向导的规格套餐与 E2 placement 的
+ *  默认折算**同源引用这一份**(worker 无 requests 时按 S 折算,§2-4)。值为 k8s quantity 串,直接落
+ *  `WorkerSpec.resources`;「自定义」= 不用套餐、直接写 resources。定档口径:S=轻量单副本(默认档,略高于
+ *  backend 兜底 50m/128Mi 的真实工作水位);M=常规编码 agent;L=重载(大 repo/多并发 turn)。 */
+export declare const WORKER_RESOURCE_PRESETS: {
+    readonly S: {
+        readonly requests: {
+            readonly cpu: "250m";
+            readonly memory: "512Mi";
+        };
+        readonly limits: {
+            readonly cpu: "1";
+            readonly memory: "1Gi";
+        };
+    };
+    readonly M: {
+        readonly requests: {
+            readonly cpu: "500m";
+            readonly memory: "1Gi";
         };
         readonly limits: {
             readonly cpu: "2";
@@ -6061,7 +6466,7 @@ export declare const WORKER_RESOURCE_PRESETS: {
 };
 export type WorkerResourcePreset = keyof typeof WORKER_RESOURCE_PRESETS;
 export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
-    workers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+    workers: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodEffects<z.ZodObject<{
         /** 唯一 → 容器名 / compose project. */
         name: z.ZodString;
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -6118,39 +6523,39 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
                 cpu: z.ZodOptional<z.ZodString>;
                 memory: z.ZodOptional<z.ZodString>;
             }, "strip", z.ZodTypeAny, {
-                cpu?: string | undefined;
                 memory?: string | undefined;
-            }, {
                 cpu?: string | undefined;
+            }, {
                 memory?: string | undefined;
+                cpu?: string | undefined;
             }>>;
             limits: z.ZodOptional<z.ZodObject<{
                 cpu: z.ZodOptional<z.ZodString>;
                 memory: z.ZodOptional<z.ZodString>;
             }, "strip", z.ZodTypeAny, {
-                cpu?: string | undefined;
                 memory?: string | undefined;
-            }, {
                 cpu?: string | undefined;
+            }, {
                 memory?: string | undefined;
+                cpu?: string | undefined;
             }>>;
         }, "strip", z.ZodTypeAny, {
             requests?: {
-                cpu?: string | undefined;
                 memory?: string | undefined;
+                cpu?: string | undefined;
             } | undefined;
             limits?: {
-                cpu?: string | undefined;
                 memory?: string | undefined;
+                cpu?: string | undefined;
             } | undefined;
         }, {
             requests?: {
-                cpu?: string | undefined;
                 memory?: string | undefined;
+                cpu?: string | undefined;
             } | undefined;
             limits?: {
-                cpu?: string | undefined;
                 memory?: string | undefined;
+                cpu?: string | undefined;
             } | undefined;
         }>>;
         /** Scheduling-framework knobs (CONTROL-PLANE-SCHEDULING-DESIGN, 产品拍板 D1/D3 2026-07-04). Optional and
@@ -6199,11 +6604,88 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
             } | undefined;
             drainGraceMs?: number | undefined;
         }>>;
-        /** 运行时 (非 secret). 映射到 service SESSION_BACKEND/REQUIRE_PRINCIPAL/RATE_LIMIT_RPM/… */
+        /** 运行时 (非 secret). 映射到 service REQUIRE_PRINCIPAL / RATE_LIMIT_RPM / … 与两个结构块(7.0.0)。 */
         runtime: z.ZodObject<{
-            sessionBackend: z.ZodDefault<z.ZodEnum<["tidb", "memory", "auto"]>>;
-            memoryBackend: z.ZodDefault<z.ZodEnum<["off", "memory", "tidb"]>>;
-            db: z.ZodOptional<z.ZodString>;
+            /** 7.0.0 执行车道块(见 `ExecutionBlock`)。enabled 的 worker 必填(WorkerSpec 层判);停用的可缺。 */
+            execution: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+                lane: z.ZodEnum<["host", "e2b", "k8s", "ssh", "adb", "local-docker", "device"]>;
+                coords: z.ZodDefault<z.ZodRecord<z.ZodEffects<z.ZodString, string, string>, z.ZodEffects<z.ZodString, string, string>>>;
+                secretRefs: z.ZodDefault<z.ZodRecord<z.ZodEffects<z.ZodString, string, string>, z.ZodEffects<z.ZodString, string, string>>>;
+            }, "strip", z.ZodTypeAny, {
+                lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                secretRefs: Record<string, string>;
+                coords: Record<string, string>;
+            }, {
+                lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                secretRefs?: Record<string, string> | undefined;
+                coords?: Record<string, string> | undefined;
+            }>, {
+                lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                secretRefs: Record<string, string>;
+                coords: Record<string, string>;
+            }, {
+                lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                secretRefs?: Record<string, string> | undefined;
+                coords?: Record<string, string> | undefined;
+            }>>;
+            /** 7.0.0 存储块(见 `StoreBlock`)。enabled 的 worker 必填(WorkerSpec 层判);停用的可缺。 */
+            store: z.ZodOptional<z.ZodObject<{
+                backend: z.ZodEnum<["mysql", "pg", "local", "memory"]>;
+                session: z.ZodDefault<z.ZodEnum<["memory", "mysql", "auto"]>>;
+                memory: z.ZodDefault<z.ZodObject<{
+                    engine: z.ZodDefault<z.ZodEnum<["on", "off"]>>;
+                    backend: z.ZodDefault<z.ZodEnum<["file", "pg", "tidb"]>>;
+                }, "strip", z.ZodTypeAny, {
+                    backend: "pg" | "file" | "tidb";
+                    engine: "on" | "off";
+                }, {
+                    backend?: "pg" | "file" | "tidb" | undefined;
+                    engine?: "on" | "off" | undefined;
+                }>>;
+                /** SQL 服务器坐标(中立,一份;名族由 `backend` 决定)。 */
+                db: z.ZodOptional<z.ZodObject<{
+                    host: z.ZodEffects<z.ZodString, string, string>;
+                    port: z.ZodNumber;
+                    user: z.ZodEffects<z.ZodString, string, string>;
+                    database: z.ZodEffects<z.ZodString, string, string>;
+                }, "strip", z.ZodTypeAny, {
+                    host: string;
+                    port: number;
+                    user: string;
+                    database: string;
+                }, {
+                    host: string;
+                    port: number;
+                    user: string;
+                    database: string;
+                }>>;
+            }, "strip", z.ZodTypeAny, {
+                memory: {
+                    backend: "pg" | "file" | "tidb";
+                    engine: "on" | "off";
+                };
+                session: "mysql" | "memory" | "auto";
+                backend: "mysql" | "pg" | "local" | "memory";
+                db?: {
+                    host: string;
+                    port: number;
+                    user: string;
+                    database: string;
+                } | undefined;
+            }, {
+                backend: "mysql" | "pg" | "local" | "memory";
+                memory?: {
+                    backend?: "pg" | "file" | "tidb" | undefined;
+                    engine?: "on" | "off" | undefined;
+                } | undefined;
+                session?: "mysql" | "memory" | "auto" | undefined;
+                db?: {
+                    host: string;
+                    port: number;
+                    user: string;
+                    database: string;
+                } | undefined;
+            }>>;
             scenario: z.ZodOptional<z.ZodString>;
             requirePrincipal: z.ZodDefault<z.ZodBoolean>;
             rateLimitRpm: z.ZodDefault<z.ZodNumber>;
@@ -6214,38 +6696,61 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
              *  default → absent never materialises → no spec-hash churn. Hash-included (read at boot → cap change recreates). */
             maxPrincipalCostUsd: z.ZodOptional<z.ZodNumber>;
         }, "strip", z.ZodTypeAny, {
-            sessionBackend: "memory" | "tidb" | "auto";
-            memoryBackend: "memory" | "tidb" | "off";
             requirePrincipal: boolean;
             rateLimitRpm: number;
-            db?: string | undefined;
+            execution?: {
+                lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                secretRefs: Record<string, string>;
+                coords: Record<string, string>;
+            } | undefined;
+            store?: {
+                memory: {
+                    backend: "pg" | "file" | "tidb";
+                    engine: "on" | "off";
+                };
+                session: "mysql" | "memory" | "auto";
+                backend: "mysql" | "pg" | "local" | "memory";
+                db?: {
+                    host: string;
+                    port: number;
+                    user: string;
+                    database: string;
+                } | undefined;
+            } | undefined;
             scenario?: string | undefined;
             maxPrincipalCostUsd?: number | undefined;
         }, {
-            sessionBackend?: "memory" | "tidb" | "auto" | undefined;
-            memoryBackend?: "memory" | "tidb" | "off" | undefined;
-            db?: string | undefined;
+            execution?: {
+                lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                secretRefs?: Record<string, string> | undefined;
+                coords?: Record<string, string> | undefined;
+            } | undefined;
+            store?: {
+                backend: "mysql" | "pg" | "local" | "memory";
+                memory?: {
+                    backend?: "pg" | "file" | "tidb" | undefined;
+                    engine?: "on" | "off" | undefined;
+                } | undefined;
+                session?: "mysql" | "memory" | "auto" | undefined;
+                db?: {
+                    host: string;
+                    port: number;
+                    user: string;
+                    database: string;
+                } | undefined;
+            } | undefined;
             scenario?: string | undefined;
             requirePrincipal?: boolean | undefined;
             rateLimitRpm?: number | undefined;
             maxPrincipalCostUsd?: number | undefined;
         }>;
-        /** 物理坐标 (非 secret). 映射到 GIT_API_BASEURL / TIDB_HOST 等. */
+        /** 物理坐标 (非 secret). 映射到 GIT_API_BASEURL。7.0.0 起 SQL 坐标在 `runtime.store.db`(`tidb*` 三键删除)。 */
         coords: z.ZodDefault<z.ZodObject<{
             gitApiBaseUrl: z.ZodUnion<[z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>, z.ZodLiteral<"">]>;
-            tidbHost: z.ZodOptional<z.ZodString>;
-            tidbPort: z.ZodOptional<z.ZodNumber>;
-            tidbUser: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
             gitApiBaseUrl?: string | undefined;
-            tidbHost?: string | undefined;
-            tidbPort?: number | undefined;
-            tidbUser?: string | undefined;
         }, {
             gitApiBaseUrl?: string | undefined;
-            tidbHost?: string | undefined;
-            tidbPort?: number | undefined;
-            tidbUser?: string | undefined;
         }>>;
         secretRefs: z.ZodObject<{
             /** NAME of the host env var holding the model API key → service MODEL_API_KEY (或 anthropic 时 ANTHROPIC_API_KEY). */
@@ -6254,18 +6759,19 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
             serviceAuthTokenEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
             /** → GIT_API_TOKEN (只读，读被评审 repo). */
             gitTokenEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-            /** → TIDB_PASSWORD. */
-            tidbPasswordEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+            /** 7.0.0:SQL 店的口令 → `MYSQL_PASSWORD` / `PG_PASSWORD`(渲染器按 `runtime.store.backend` 选名族)。
+             *  在场 ⇔ `runtime.store.backend` ∈ {mysql, pg}(WorkerSpec 层判,与 `runtime.store.db` 同一条规则)。取代 6.x 的 `tidbPasswordEnv`。 */
+            dbPasswordEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
         }, "strip", z.ZodTypeAny, {
             apiKeyEnv: string;
             serviceAuthTokenEnv?: string | undefined;
             gitTokenEnv?: string | undefined;
-            tidbPasswordEnv?: string | undefined;
+            dbPasswordEnv?: string | undefined;
         }, {
             apiKeyEnv: string;
             serviceAuthTokenEnv?: string | undefined;
             gitTokenEnv?: string | undefined;
-            tidbPasswordEnv?: string | undefined;
+            dbPasswordEnv?: string | undefined;
         }>;
         /**
          * 通用 env 透传（逃生口）——给**没有专属结构化字段**的 service env 用，让任意 worker 声明自己的 app 专属变量
@@ -6346,31 +6852,44 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
         signature: z.ZodOptional<z.ZodString>;
         notes: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
+        host: string;
+        secretRefs: {
+            apiKeyEnv: string;
+            serviceAuthTokenEnv?: string | undefined;
+            gitTokenEnv?: string | undefined;
+            dbPasswordEnv?: string | undefined;
+        };
+        coords: {
+            gitApiBaseUrl?: string | undefined;
+        };
         name: string;
         enabled: boolean;
-        host: string;
         image: string;
         runtime: {
-            sessionBackend: "memory" | "tidb" | "auto";
-            memoryBackend: "memory" | "tidb" | "off";
             requirePrincipal: boolean;
             rateLimitRpm: number;
-            db?: string | undefined;
+            execution?: {
+                lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                secretRefs: Record<string, string>;
+                coords: Record<string, string>;
+            } | undefined;
+            store?: {
+                memory: {
+                    backend: "pg" | "file" | "tidb";
+                    engine: "on" | "off";
+                };
+                session: "mysql" | "memory" | "auto";
+                backend: "mysql" | "pg" | "local" | "memory";
+                db?: {
+                    host: string;
+                    port: number;
+                    user: string;
+                    database: string;
+                } | undefined;
+            } | undefined;
             scenario?: string | undefined;
             maxPrincipalCostUsd?: number | undefined;
         };
-        coords: {
-            gitApiBaseUrl?: string | undefined;
-            tidbHost?: string | undefined;
-            tidbPort?: number | undefined;
-            tidbUser?: string | undefined;
-        };
-        secretRefs: {
-            apiKeyEnv: string;
-            serviceAuthTokenEnv?: string | undefined;
-            gitTokenEnv?: string | undefined;
-            tidbPasswordEnv?: string | undefined;
-        };
         notes?: string | undefined;
         routePrefix?: string | undefined;
         replicas?: number | undefined;
@@ -6381,12 +6900,12 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         resources?: {
             requests?: {
-                cpu?: string | undefined;
                 memory?: string | undefined;
+                cpu?: string | undefined;
             } | undefined;
             limits?: {
-                cpu?: string | undefined;
                 memory?: string | undefined;
+                cpu?: string | undefined;
             } | undefined;
         } | undefined;
         fleet?: {
@@ -6418,25 +6937,44 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
         roster?: string | undefined;
         signature?: string | undefined;
     }, {
+        secretRefs: {
+            apiKeyEnv: string;
+            serviceAuthTokenEnv?: string | undefined;
+            gitTokenEnv?: string | undefined;
+            dbPasswordEnv?: string | undefined;
+        };
         name: string;
         runtime: {
-            sessionBackend?: "memory" | "tidb" | "auto" | undefined;
-            memoryBackend?: "memory" | "tidb" | "off" | undefined;
-            db?: string | undefined;
+            execution?: {
+                lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                secretRefs?: Record<string, string> | undefined;
+                coords?: Record<string, string> | undefined;
+            } | undefined;
+            store?: {
+                backend: "mysql" | "pg" | "local" | "memory";
+                memory?: {
+                    backend?: "pg" | "file" | "tidb" | undefined;
+                    engine?: "on" | "off" | undefined;
+                } | undefined;
+                session?: "mysql" | "memory" | "auto" | undefined;
+                db?: {
+                    host: string;
+                    port: number;
+                    user: string;
+                    database: string;
+                } | undefined;
+            } | undefined;
             scenario?: string | undefined;
             requirePrincipal?: boolean | undefined;
             rateLimitRpm?: number | undefined;
             maxPrincipalCostUsd?: number | undefined;
         };
-        secretRefs: {
-            apiKeyEnv: string;
-            serviceAuthTokenEnv?: string | undefined;
-            gitTokenEnv?: string | undefined;
-            tidbPasswordEnv?: string | undefined;
-        };
+        host?: string | undefined;
+        coords?: {
+            gitApiBaseUrl?: string | undefined;
+        } | undefined;
         enabled?: boolean | undefined;
         notes?: string | undefined;
-        host?: string | undefined;
         image?: string | undefined;
         routePrefix?: string | undefined;
         replicas?: number | undefined;
@@ -6447,12 +6985,12 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         resources?: {
             requests?: {
-                cpu?: string | undefined;
                 memory?: string | undefined;
+                cpu?: string | undefined;
             } | undefined;
             limits?: {
-                cpu?: string | undefined;
                 memory?: string | undefined;
+                cpu?: string | undefined;
             } | undefined;
         } | undefined;
         fleet?: {
@@ -6465,12 +7003,6 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
             } | undefined;
             drainGraceMs?: number | undefined;
         } | undefined;
-        coords?: {
-            gitApiBaseUrl?: string | undefined;
-            tidbHost?: string | undefined;
-            tidbPort?: number | undefined;
-            tidbUser?: string | undefined;
-        } | undefined;
         env?: Record<string, string> | undefined;
         secretEnv?: Record<string, string> | undefined;
         recreateNonce?: string | undefined;
@@ -6489,34 +7021,45 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         roster?: string | undefined;
         signature?: string | undefined;
-    }>, "many">>;
-}, "strip", z.ZodTypeAny, {
-    workers: {
+    }>, {
+        host: string;
+        secretRefs: {
+            apiKeyEnv: string;
+            serviceAuthTokenEnv?: string | undefined;
+            gitTokenEnv?: string | undefined;
+            dbPasswordEnv?: string | undefined;
+        };
+        coords: {
+            gitApiBaseUrl?: string | undefined;
+        };
         name: string;
         enabled: boolean;
-        host: string;
         image: string;
         runtime: {
-            sessionBackend: "memory" | "tidb" | "auto";
-            memoryBackend: "memory" | "tidb" | "off";
             requirePrincipal: boolean;
             rateLimitRpm: number;
-            db?: string | undefined;
+            execution?: {
+                lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                secretRefs: Record<string, string>;
+                coords: Record<string, string>;
+            } | undefined;
+            store?: {
+                memory: {
+                    backend: "pg" | "file" | "tidb";
+                    engine: "on" | "off";
+                };
+                session: "mysql" | "memory" | "auto";
+                backend: "mysql" | "pg" | "local" | "memory";
+                db?: {
+                    host: string;
+                    port: number;
+                    user: string;
+                    database: string;
+                } | undefined;
+            } | undefined;
             scenario?: string | undefined;
             maxPrincipalCostUsd?: number | undefined;
         };
-        coords: {
-            gitApiBaseUrl?: string | undefined;
-            tidbHost?: string | undefined;
-            tidbPort?: number | undefined;
-            tidbUser?: string | undefined;
-        };
-        secretRefs: {
-            apiKeyEnv: string;
-            serviceAuthTokenEnv?: string | undefined;
-            gitTokenEnv?: string | undefined;
-            tidbPasswordEnv?: string | undefined;
-        };
         notes?: string | undefined;
         routePrefix?: string | undefined;
         replicas?: number | undefined;
@@ -6527,12 +7070,12 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         resources?: {
             requests?: {
-                cpu?: string | undefined;
                 memory?: string | undefined;
+                cpu?: string | undefined;
             } | undefined;
             limits?: {
-                cpu?: string | undefined;
                 memory?: string | undefined;
+                cpu?: string | undefined;
             } | undefined;
         } | undefined;
         fleet?: {
@@ -6563,28 +7106,45 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         roster?: string | undefined;
         signature?: string | undefined;
-    }[];
-}, {
-    workers?: {
+    }, {
+        secretRefs: {
+            apiKeyEnv: string;
+            serviceAuthTokenEnv?: string | undefined;
+            gitTokenEnv?: string | undefined;
+            dbPasswordEnv?: string | undefined;
+        };
         name: string;
         runtime: {
-            sessionBackend?: "memory" | "tidb" | "auto" | undefined;
-            memoryBackend?: "memory" | "tidb" | "off" | undefined;
-            db?: string | undefined;
+            execution?: {
+                lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                secretRefs?: Record<string, string> | undefined;
+                coords?: Record<string, string> | undefined;
+            } | undefined;
+            store?: {
+                backend: "mysql" | "pg" | "local" | "memory";
+                memory?: {
+                    backend?: "pg" | "file" | "tidb" | undefined;
+                    engine?: "on" | "off" | undefined;
+                } | undefined;
+                session?: "mysql" | "memory" | "auto" | undefined;
+                db?: {
+                    host: string;
+                    port: number;
+                    user: string;
+                    database: string;
+                } | undefined;
+            } | undefined;
             scenario?: string | undefined;
             requirePrincipal?: boolean | undefined;
             rateLimitRpm?: number | undefined;
             maxPrincipalCostUsd?: number | undefined;
         };
-        secretRefs: {
-            apiKeyEnv: string;
-            serviceAuthTokenEnv?: string | undefined;
-            gitTokenEnv?: string | undefined;
-            tidbPasswordEnv?: string | undefined;
-        };
+        host?: string | undefined;
+        coords?: {
+            gitApiBaseUrl?: string | undefined;
+        } | undefined;
         enabled?: boolean | undefined;
         notes?: string | undefined;
-        host?: string | undefined;
         image?: string | undefined;
         routePrefix?: string | undefined;
         replicas?: number | undefined;
@@ -6595,12 +7155,12 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         resources?: {
             requests?: {
-                cpu?: string | undefined;
                 memory?: string | undefined;
+                cpu?: string | undefined;
             } | undefined;
             limits?: {
-                cpu?: string | undefined;
                 memory?: string | undefined;
+                cpu?: string | undefined;
             } | undefined;
         } | undefined;
         fleet?: {
@@ -6613,12 +7173,6 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
             } | undefined;
             drainGraceMs?: number | undefined;
         } | undefined;
-        coords?: {
-            gitApiBaseUrl?: string | undefined;
-            tidbHost?: string | undefined;
-            tidbPort?: number | undefined;
-            tidbUser?: string | undefined;
-        } | undefined;
         env?: Record<string, string> | undefined;
         secretEnv?: Record<string, string> | undefined;
         recreateNonce?: string | undefined;
@@ -6637,34 +7191,45 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         roster?: string | undefined;
         signature?: string | undefined;
-    }[] | undefined;
-}>, {
-    workers: {
+    }>, {
+        host: string;
+        secretRefs: {
+            apiKeyEnv: string;
+            serviceAuthTokenEnv?: string | undefined;
+            gitTokenEnv?: string | undefined;
+            dbPasswordEnv?: string | undefined;
+        };
+        coords: {
+            gitApiBaseUrl?: string | undefined;
+        };
         name: string;
         enabled: boolean;
-        host: string;
         image: string;
         runtime: {
-            sessionBackend: "memory" | "tidb" | "auto";
-            memoryBackend: "memory" | "tidb" | "off";
             requirePrincipal: boolean;
             rateLimitRpm: number;
-            db?: string | undefined;
+            execution?: {
+                lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                secretRefs: Record<string, string>;
+                coords: Record<string, string>;
+            } | undefined;
+            store?: {
+                memory: {
+                    backend: "pg" | "file" | "tidb";
+                    engine: "on" | "off";
+                };
+                session: "mysql" | "memory" | "auto";
+                backend: "mysql" | "pg" | "local" | "memory";
+                db?: {
+                    host: string;
+                    port: number;
+                    user: string;
+                    database: string;
+                } | undefined;
+            } | undefined;
             scenario?: string | undefined;
             maxPrincipalCostUsd?: number | undefined;
         };
-        coords: {
-            gitApiBaseUrl?: string | undefined;
-            tidbHost?: string | undefined;
-            tidbPort?: number | undefined;
-            tidbUser?: string | undefined;
-        };
-        secretRefs: {
-            apiKeyEnv: string;
-            serviceAuthTokenEnv?: string | undefined;
-            gitTokenEnv?: string | undefined;
-            tidbPasswordEnv?: string | undefined;
-        };
         notes?: string | undefined;
         routePrefix?: string | undefined;
         replicas?: number | undefined;
@@ -6675,12 +7240,12 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         resources?: {
             requests?: {
-                cpu?: string | undefined;
                 memory?: string | undefined;
+                cpu?: string | undefined;
             } | undefined;
             limits?: {
-                cpu?: string | undefined;
                 memory?: string | undefined;
+                cpu?: string | undefined;
             } | undefined;
         } | undefined;
         fleet?: {
@@ -6711,29 +7276,137 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         roster?: string | undefined;
         signature?: string | undefined;
-    }[];
-}, {
-    workers?: {
+    }, unknown>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    workers: {
+        host: string;
+        secretRefs: {
+            apiKeyEnv: string;
+            serviceAuthTokenEnv?: string | undefined;
+            gitTokenEnv?: string | undefined;
+            dbPasswordEnv?: string | undefined;
+        };
+        coords: {
+            gitApiBaseUrl?: string | undefined;
+        };
         name: string;
+        enabled: boolean;
+        image: string;
         runtime: {
-            sessionBackend?: "memory" | "tidb" | "auto" | undefined;
-            memoryBackend?: "memory" | "tidb" | "off" | undefined;
-            db?: string | undefined;
+            requirePrincipal: boolean;
+            rateLimitRpm: number;
+            execution?: {
+                lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                secretRefs: Record<string, string>;
+                coords: Record<string, string>;
+            } | undefined;
+            store?: {
+                memory: {
+                    backend: "pg" | "file" | "tidb";
+                    engine: "on" | "off";
+                };
+                session: "mysql" | "memory" | "auto";
+                backend: "mysql" | "pg" | "local" | "memory";
+                db?: {
+                    host: string;
+                    port: number;
+                    user: string;
+                    database: string;
+                } | undefined;
+            } | undefined;
             scenario?: string | undefined;
-            requirePrincipal?: boolean | undefined;
-            rateLimitRpm?: number | undefined;
             maxPrincipalCostUsd?: number | undefined;
         };
+        notes?: string | undefined;
+        routePrefix?: string | undefined;
+        replicas?: number | undefined;
+        autoscaling?: {
+            minReplicas: number;
+            maxReplicas: number;
+            targetCpuPercent?: number | undefined;
+        } | undefined;
+        resources?: {
+            requests?: {
+                memory?: string | undefined;
+                cpu?: string | undefined;
+            } | undefined;
+            limits?: {
+                memory?: string | undefined;
+                cpu?: string | undefined;
+            } | undefined;
+        } | undefined;
+        fleet?: {
+            dispatch?: {
+                strategy: "round-robin" | "least-inflight" | "consistent-hash";
+                sessionAffinity: boolean;
+                maxInflight?: number | undefined;
+                perActorMaxInflight?: number | undefined;
+                maxCostUsd?: number | undefined;
+            } | undefined;
+            drainGraceMs?: number | undefined;
+        } | undefined;
+        env?: Record<string, string> | undefined;
+        secretEnv?: Record<string, string> | undefined;
+        recreateNonce?: string | undefined;
+        lifecycle?: {
+            kind: "persistent" | "ephemeral";
+            ttl?: string | undefined;
+            idleTimeout?: string | undefined;
+            owner?: string | undefined;
+            purpose?: string | undefined;
+            dependsOn?: string[] | undefined;
+        } | undefined;
+        placement?: {
+            auto: boolean;
+            requires: string[];
+            spread?: string | undefined;
+        } | undefined;
+        roster?: string | undefined;
+        signature?: string | undefined;
+    }[];
+}, {
+    workers?: unknown[] | undefined;
+}>, {
+    workers: {
+        host: string;
         secretRefs: {
             apiKeyEnv: string;
             serviceAuthTokenEnv?: string | undefined;
             gitTokenEnv?: string | undefined;
-            tidbPasswordEnv?: string | undefined;
+            dbPasswordEnv?: string | undefined;
+        };
+        coords: {
+            gitApiBaseUrl?: string | undefined;
+        };
+        name: string;
+        enabled: boolean;
+        image: string;
+        runtime: {
+            requirePrincipal: boolean;
+            rateLimitRpm: number;
+            execution?: {
+                lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                secretRefs: Record<string, string>;
+                coords: Record<string, string>;
+            } | undefined;
+            store?: {
+                memory: {
+                    backend: "pg" | "file" | "tidb";
+                    engine: "on" | "off";
+                };
+                session: "mysql" | "memory" | "auto";
+                backend: "mysql" | "pg" | "local" | "memory";
+                db?: {
+                    host: string;
+                    port: number;
+                    user: string;
+                    database: string;
+                } | undefined;
+            } | undefined;
+            scenario?: string | undefined;
+            maxPrincipalCostUsd?: number | undefined;
         };
-        enabled?: boolean | undefined;
         notes?: string | undefined;
-        host?: string | undefined;
-        image?: string | undefined;
         routePrefix?: string | undefined;
         replicas?: number | undefined;
         autoscaling?: {
@@ -6743,35 +7416,29 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
         } | undefined;
         resources?: {
             requests?: {
-                cpu?: string | undefined;
                 memory?: string | undefined;
+                cpu?: string | undefined;
             } | undefined;
             limits?: {
-                cpu?: string | undefined;
                 memory?: string | undefined;
+                cpu?: string | undefined;
             } | undefined;
         } | undefined;
         fleet?: {
             dispatch?: {
-                strategy?: "round-robin" | "least-inflight" | "consistent-hash" | undefined;
-                sessionAffinity?: boolean | undefined;
+                strategy: "round-robin" | "least-inflight" | "consistent-hash";
+                sessionAffinity: boolean;
                 maxInflight?: number | undefined;
                 perActorMaxInflight?: number | undefined;
                 maxCostUsd?: number | undefined;
             } | undefined;
             drainGraceMs?: number | undefined;
         } | undefined;
-        coords?: {
-            gitApiBaseUrl?: string | undefined;
-            tidbHost?: string | undefined;
-            tidbPort?: number | undefined;
-            tidbUser?: string | undefined;
-        } | undefined;
         env?: Record<string, string> | undefined;
         secretEnv?: Record<string, string> | undefined;
         recreateNonce?: string | undefined;
         lifecycle?: {
-            kind?: "persistent" | "ephemeral" | undefined;
+            kind: "persistent" | "ephemeral";
             ttl?: string | undefined;
             idleTimeout?: string | undefined;
             owner?: string | undefined;
@@ -6779,13 +7446,15 @@ export declare const WorkersConfig: z.ZodEffects<z.ZodObject<{
             dependsOn?: string[] | undefined;
         } | undefined;
         placement?: {
-            auto?: boolean | undefined;
-            requires?: string[] | undefined;
+            auto: boolean;
+            requires: string[];
             spread?: string | undefined;
         } | undefined;
         roster?: string | undefined;
         signature?: string | undefined;
-    }[] | undefined;
+    }[];
+}, {
+    workers?: unknown[] | undefined;
 }>;
 export type WorkersConfig = z.infer<typeof WorkersConfig>;
 export declare const WorkerCondition: z.ZodObject<{
@@ -6838,8 +7507,8 @@ export declare const WorkerStatus: z.ZodObject<{
     message: z.ZodOptional<z.ZodString>;
     updatedAt: z.ZodString;
 }, "strip", z.ZodTypeAny, {
-    name: string;
     host: string;
+    name: string;
     phase: "Unknown" | "Pending" | "Running" | "Failed";
     updatedAt: string;
     conditions: {
@@ -6853,8 +7522,8 @@ export declare const WorkerStatus: z.ZodObject<{
     message?: string | undefined;
     observedSpecHash?: string | undefined;
 }, {
-    name: string;
     host: string;
+    name: string;
     phase: "Unknown" | "Pending" | "Running" | "Failed";
     updatedAt: string;
     observedVersion: number;
@@ -7093,7 +7762,7 @@ export declare const HostStatus: z.ZodObject<{
     ts: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     host: string;
-    backend: "docker" | "k8s";
+    backend: "k8s" | "docker";
     probes: {
         cpuCores: number;
         memBytes: number;
@@ -7109,7 +7778,7 @@ export declare const HostStatus: z.ZodObject<{
     ts: string;
 }, {
     host: string;
-    backend: "docker" | "k8s";
+    backend: "k8s" | "docker";
     probes: {
         cpuCores: number;
         memBytes: number;
@@ -9501,6 +10170,16 @@ export declare const DOMAIN_SCHEMAS: {
              *  deep to hash later. That is not shape validation — it is the boundary every free-form value must clear to
              *  enter the persisted config and `stableHash` (R18). */
             compat: z.ZodEffects<z.ZodOptional<z.ZodUnknown>, unknown, unknown>;
+            /** Per-model extra request headers, deployment ↔ provider (e.g. `{"anthropic-beta": "context-1m-2025-08-07"}` on an
+             *  `anthropic-messages` entry). Real need: a beta that a shell passes as `--betas` / `ANTHROPIC_BETAS` never reaches the
+             *  request the engine sends; the catalog entry is the deployment-level seat for it — and without this key the entry's
+             *  declaration is stripped at parse on every read leg, so it never reaches the consumer at all.
+             *  ABSENT = key not minted = today's behaviour, zero migration.
+             *
+             *  **Parse-transparent** — who validates the shape, and why not here: {@link PARSE_TRANSPARENT_KEYS}
+             *  (`models.models[].headers`). The ONE rejection that remains is the free-form SAFETY judgment shared with `compat` /
+             *  `extraBody` ({@link vetFreeFormJson}). */
+            headers: z.ZodEffects<z.ZodOptional<z.ZodUnknown>, unknown, unknown>;
             /** 配额倍率(EXPERT-REDESIGN §4-1):该模型烧 token 双窗额度的倍率,默认 1。折算时点=weight-at-burn
              *  (记账时固化到 UsageEntry.quotaWeightAtUse/weightedTokens):改倍率只影响此后记账,不回算窗口内历史。 */
             quotaWeight: z.ZodDefault<z.ZodNumber>;
@@ -9537,6 +10216,7 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             extraBody?: Record<string, unknown> | undefined;
             compat?: unknown;
+            headers?: unknown;
             notes?: string | undefined;
         }, {
             id: string;
@@ -9567,6 +10247,7 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             extraBody?: unknown;
             compat?: unknown;
+            headers?: unknown;
             quotaWeight?: number | undefined;
             enabled?: boolean | undefined;
             notes?: string | undefined;
@@ -9601,6 +10282,7 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             extraBody?: Record<string, unknown> | undefined;
             compat?: unknown;
+            headers?: unknown;
             notes?: string | undefined;
         }, {
             id: string;
@@ -9631,6 +10313,7 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             extraBody?: unknown;
             compat?: unknown;
+            headers?: unknown;
             quotaWeight?: number | undefined;
             enabled?: boolean | undefined;
             notes?: string | undefined;
@@ -9755,6 +10438,7 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             extraBody?: Record<string, unknown> | undefined;
             compat?: unknown;
+            headers?: unknown;
             notes?: string | undefined;
         }[];
         roles: Partial<Record<"default" | "summarize" | "subagent" | "team" | "synthesize" | "verifier" | "classifier" | "consolidate", {
@@ -9810,6 +10494,7 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             extraBody?: unknown;
             compat?: unknown;
+            headers?: unknown;
             quotaWeight?: number | undefined;
             enabled?: boolean | undefined;
             notes?: string | undefined;
@@ -9869,6 +10554,7 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             extraBody?: Record<string, unknown> | undefined;
             compat?: unknown;
+            headers?: unknown;
             notes?: string | undefined;
         }[];
         roles: Partial<Record<"default" | "summarize" | "subagent" | "team" | "synthesize" | "verifier" | "classifier" | "consolidate", {
@@ -9924,6 +10610,7 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             extraBody?: unknown;
             compat?: unknown;
+            headers?: unknown;
             quotaWeight?: number | undefined;
             enabled?: boolean | undefined;
             notes?: string | undefined;
@@ -11063,7 +11750,7 @@ export declare const DOMAIN_SCHEMAS: {
         }[] | undefined;
     }>;
     readonly workers: z.ZodEffects<z.ZodObject<{
-        workers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        workers: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodEffects<z.ZodObject<{
             /** 唯一 → 容器名 / compose project. */
             name: z.ZodString;
             enabled: z.ZodDefault<z.ZodBoolean>;
@@ -11120,39 +11807,39 @@ export declare const DOMAIN_SCHEMAS: {
                     cpu: z.ZodOptional<z.ZodString>;
                     memory: z.ZodOptional<z.ZodString>;
                 }, "strip", z.ZodTypeAny, {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
-                }, {
                     cpu?: string | undefined;
+                }, {
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 }>>;
                 limits: z.ZodOptional<z.ZodObject<{
                     cpu: z.ZodOptional<z.ZodString>;
                     memory: z.ZodOptional<z.ZodString>;
                 }, "strip", z.ZodTypeAny, {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
-                }, {
                     cpu?: string | undefined;
+                }, {
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 }>>;
             }, "strip", z.ZodTypeAny, {
                 requests?: {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 } | undefined;
                 limits?: {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 } | undefined;
             }, {
                 requests?: {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 } | undefined;
                 limits?: {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 } | undefined;
             }>>;
             /** Scheduling-framework knobs (CONTROL-PLANE-SCHEDULING-DESIGN, 产品拍板 D1/D3 2026-07-04). Optional and
@@ -11201,11 +11888,88 @@ export declare const DOMAIN_SCHEMAS: {
                 } | undefined;
                 drainGraceMs?: number | undefined;
             }>>;
-            /** 运行时 (非 secret). 映射到 service SESSION_BACKEND/REQUIRE_PRINCIPAL/RATE_LIMIT_RPM/… */
+            /** 运行时 (非 secret). 映射到 service REQUIRE_PRINCIPAL / RATE_LIMIT_RPM / … 与两个结构块(7.0.0)。 */
             runtime: z.ZodObject<{
-                sessionBackend: z.ZodDefault<z.ZodEnum<["tidb", "memory", "auto"]>>;
-                memoryBackend: z.ZodDefault<z.ZodEnum<["off", "memory", "tidb"]>>;
-                db: z.ZodOptional<z.ZodString>;
+                /** 7.0.0 执行车道块(见 `ExecutionBlock`)。enabled 的 worker 必填(WorkerSpec 层判);停用的可缺。 */
+                execution: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+                    lane: z.ZodEnum<["host", "e2b", "k8s", "ssh", "adb", "local-docker", "device"]>;
+                    coords: z.ZodDefault<z.ZodRecord<z.ZodEffects<z.ZodString, string, string>, z.ZodEffects<z.ZodString, string, string>>>;
+                    secretRefs: z.ZodDefault<z.ZodRecord<z.ZodEffects<z.ZodString, string, string>, z.ZodEffects<z.ZodString, string, string>>>;
+                }, "strip", z.ZodTypeAny, {
+                    lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                    secretRefs: Record<string, string>;
+                    coords: Record<string, string>;
+                }, {
+                    lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                    secretRefs?: Record<string, string> | undefined;
+                    coords?: Record<string, string> | undefined;
+                }>, {
+                    lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                    secretRefs: Record<string, string>;
+                    coords: Record<string, string>;
+                }, {
+                    lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                    secretRefs?: Record<string, string> | undefined;
+                    coords?: Record<string, string> | undefined;
+                }>>;
+                /** 7.0.0 存储块(见 `StoreBlock`)。enabled 的 worker 必填(WorkerSpec 层判);停用的可缺。 */
+                store: z.ZodOptional<z.ZodObject<{
+                    backend: z.ZodEnum<["mysql", "pg", "local", "memory"]>;
+                    session: z.ZodDefault<z.ZodEnum<["memory", "mysql", "auto"]>>;
+                    memory: z.ZodDefault<z.ZodObject<{
+                        engine: z.ZodDefault<z.ZodEnum<["on", "off"]>>;
+                        backend: z.ZodDefault<z.ZodEnum<["file", "pg", "tidb"]>>;
+                    }, "strip", z.ZodTypeAny, {
+                        backend: "pg" | "file" | "tidb";
+                        engine: "on" | "off";
+                    }, {
+                        backend?: "pg" | "file" | "tidb" | undefined;
+                        engine?: "on" | "off" | undefined;
+                    }>>;
+                    /** SQL 服务器坐标(中立,一份;名族由 `backend` 决定)。 */
+                    db: z.ZodOptional<z.ZodObject<{
+                        host: z.ZodEffects<z.ZodString, string, string>;
+                        port: z.ZodNumber;
+                        user: z.ZodEffects<z.ZodString, string, string>;
+                        database: z.ZodEffects<z.ZodString, string, string>;
+                    }, "strip", z.ZodTypeAny, {
+                        host: string;
+                        port: number;
+                        user: string;
+                        database: string;
+                    }, {
+                        host: string;
+                        port: number;
+                        user: string;
+                        database: string;
+                    }>>;
+                }, "strip", z.ZodTypeAny, {
+                    memory: {
+                        backend: "pg" | "file" | "tidb";
+                        engine: "on" | "off";
+                    };
+                    session: "mysql" | "memory" | "auto";
+                    backend: "mysql" | "pg" | "local" | "memory";
+                    db?: {
+                        host: string;
+                        port: number;
+                        user: string;
+                        database: string;
+                    } | undefined;
+                }, {
+                    backend: "mysql" | "pg" | "local" | "memory";
+                    memory?: {
+                        backend?: "pg" | "file" | "tidb" | undefined;
+                        engine?: "on" | "off" | undefined;
+                    } | undefined;
+                    session?: "mysql" | "memory" | "auto" | undefined;
+                    db?: {
+                        host: string;
+                        port: number;
+                        user: string;
+                        database: string;
+                    } | undefined;
+                }>>;
                 scenario: z.ZodOptional<z.ZodString>;
                 requirePrincipal: z.ZodDefault<z.ZodBoolean>;
                 rateLimitRpm: z.ZodDefault<z.ZodNumber>;
@@ -11216,38 +11980,61 @@ export declare const DOMAIN_SCHEMAS: {
                  *  default → absent never materialises → no spec-hash churn. Hash-included (read at boot → cap change recreates). */
                 maxPrincipalCostUsd: z.ZodOptional<z.ZodNumber>;
             }, "strip", z.ZodTypeAny, {
-                sessionBackend: "memory" | "tidb" | "auto";
-                memoryBackend: "memory" | "tidb" | "off";
                 requirePrincipal: boolean;
                 rateLimitRpm: number;
-                db?: string | undefined;
+                execution?: {
+                    lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                    secretRefs: Record<string, string>;
+                    coords: Record<string, string>;
+                } | undefined;
+                store?: {
+                    memory: {
+                        backend: "pg" | "file" | "tidb";
+                        engine: "on" | "off";
+                    };
+                    session: "mysql" | "memory" | "auto";
+                    backend: "mysql" | "pg" | "local" | "memory";
+                    db?: {
+                        host: string;
+                        port: number;
+                        user: string;
+                        database: string;
+                    } | undefined;
+                } | undefined;
                 scenario?: string | undefined;
                 maxPrincipalCostUsd?: number | undefined;
             }, {
-                sessionBackend?: "memory" | "tidb" | "auto" | undefined;
-                memoryBackend?: "memory" | "tidb" | "off" | undefined;
-                db?: string | undefined;
+                execution?: {
+                    lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                    secretRefs?: Record<string, string> | undefined;
+                    coords?: Record<string, string> | undefined;
+                } | undefined;
+                store?: {
+                    backend: "mysql" | "pg" | "local" | "memory";
+                    memory?: {
+                        backend?: "pg" | "file" | "tidb" | undefined;
+                        engine?: "on" | "off" | undefined;
+                    } | undefined;
+                    session?: "mysql" | "memory" | "auto" | undefined;
+                    db?: {
+                        host: string;
+                        port: number;
+                        user: string;
+                        database: string;
+                    } | undefined;
+                } | undefined;
                 scenario?: string | undefined;
                 requirePrincipal?: boolean | undefined;
                 rateLimitRpm?: number | undefined;
                 maxPrincipalCostUsd?: number | undefined;
             }>;
-            /** 物理坐标 (非 secret). 映射到 GIT_API_BASEURL / TIDB_HOST 等. */
+            /** 物理坐标 (非 secret). 映射到 GIT_API_BASEURL。7.0.0 起 SQL 坐标在 `runtime.store.db`(`tidb*` 三键删除)。 */
             coords: z.ZodDefault<z.ZodObject<{
                 gitApiBaseUrl: z.ZodUnion<[z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>, z.ZodLiteral<"">]>;
-                tidbHost: z.ZodOptional<z.ZodString>;
-                tidbPort: z.ZodOptional<z.ZodNumber>;
-                tidbUser: z.ZodOptional<z.ZodString>;
             }, "strip", z.ZodTypeAny, {
                 gitApiBaseUrl?: string | undefined;
-                tidbHost?: string | undefined;
-                tidbPort?: number | undefined;
-                tidbUser?: string | undefined;
             }, {
                 gitApiBaseUrl?: string | undefined;
-                tidbHost?: string | undefined;
-                tidbPort?: number | undefined;
-                tidbUser?: string | undefined;
             }>>;
             secretRefs: z.ZodObject<{
                 /** NAME of the host env var holding the model API key → service MODEL_API_KEY (或 anthropic 时 ANTHROPIC_API_KEY). */
@@ -11256,18 +12043,19 @@ export declare const DOMAIN_SCHEMAS: {
                 serviceAuthTokenEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
                 /** → GIT_API_TOKEN (只读，读被评审 repo). */
                 gitTokenEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-                /** → TIDB_PASSWORD. */
-                tidbPasswordEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+                /** 7.0.0:SQL 店的口令 → `MYSQL_PASSWORD` / `PG_PASSWORD`(渲染器按 `runtime.store.backend` 选名族)。
+                 *  在场 ⇔ `runtime.store.backend` ∈ {mysql, pg}(WorkerSpec 层判,与 `runtime.store.db` 同一条规则)。取代 6.x 的 `tidbPasswordEnv`。 */
+                dbPasswordEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
             }, "strip", z.ZodTypeAny, {
                 apiKeyEnv: string;
                 serviceAuthTokenEnv?: string | undefined;
                 gitTokenEnv?: string | undefined;
-                tidbPasswordEnv?: string | undefined;
+                dbPasswordEnv?: string | undefined;
             }, {
                 apiKeyEnv: string;
                 serviceAuthTokenEnv?: string | undefined;
                 gitTokenEnv?: string | undefined;
-                tidbPasswordEnv?: string | undefined;
+                dbPasswordEnv?: string | undefined;
             }>;
             /**
              * 通用 env 透传（逃生口）——给**没有专属结构化字段**的 service env 用，让任意 worker 声明自己的 app 专属变量
@@ -11348,31 +12136,44 @@ export declare const DOMAIN_SCHEMAS: {
             signature: z.ZodOptional<z.ZodString>;
             notes: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
+            host: string;
+            secretRefs: {
+                apiKeyEnv: string;
+                serviceAuthTokenEnv?: string | undefined;
+                gitTokenEnv?: string | undefined;
+                dbPasswordEnv?: string | undefined;
+            };
+            coords: {
+                gitApiBaseUrl?: string | undefined;
+            };
             name: string;
             enabled: boolean;
-            host: string;
             image: string;
             runtime: {
-                sessionBackend: "memory" | "tidb" | "auto";
-                memoryBackend: "memory" | "tidb" | "off";
                 requirePrincipal: boolean;
                 rateLimitRpm: number;
-                db?: string | undefined;
+                execution?: {
+                    lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                    secretRefs: Record<string, string>;
+                    coords: Record<string, string>;
+                } | undefined;
+                store?: {
+                    memory: {
+                        backend: "pg" | "file" | "tidb";
+                        engine: "on" | "off";
+                    };
+                    session: "mysql" | "memory" | "auto";
+                    backend: "mysql" | "pg" | "local" | "memory";
+                    db?: {
+                        host: string;
+                        port: number;
+                        user: string;
+                        database: string;
+                    } | undefined;
+                } | undefined;
                 scenario?: string | undefined;
                 maxPrincipalCostUsd?: number | undefined;
             };
-            coords: {
-                gitApiBaseUrl?: string | undefined;
-                tidbHost?: string | undefined;
-                tidbPort?: number | undefined;
-                tidbUser?: string | undefined;
-            };
-            secretRefs: {
-                apiKeyEnv: string;
-                serviceAuthTokenEnv?: string | undefined;
-                gitTokenEnv?: string | undefined;
-                tidbPasswordEnv?: string | undefined;
-            };
             notes?: string | undefined;
             routePrefix?: string | undefined;
             replicas?: number | undefined;
@@ -11383,12 +12184,12 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             resources?: {
                 requests?: {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 } | undefined;
                 limits?: {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 } | undefined;
             } | undefined;
             fleet?: {
@@ -11420,25 +12221,44 @@ export declare const DOMAIN_SCHEMAS: {
             roster?: string | undefined;
             signature?: string | undefined;
         }, {
+            secretRefs: {
+                apiKeyEnv: string;
+                serviceAuthTokenEnv?: string | undefined;
+                gitTokenEnv?: string | undefined;
+                dbPasswordEnv?: string | undefined;
+            };
             name: string;
             runtime: {
-                sessionBackend?: "memory" | "tidb" | "auto" | undefined;
-                memoryBackend?: "memory" | "tidb" | "off" | undefined;
-                db?: string | undefined;
+                execution?: {
+                    lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                    secretRefs?: Record<string, string> | undefined;
+                    coords?: Record<string, string> | undefined;
+                } | undefined;
+                store?: {
+                    backend: "mysql" | "pg" | "local" | "memory";
+                    memory?: {
+                        backend?: "pg" | "file" | "tidb" | undefined;
+                        engine?: "on" | "off" | undefined;
+                    } | undefined;
+                    session?: "mysql" | "memory" | "auto" | undefined;
+                    db?: {
+                        host: string;
+                        port: number;
+                        user: string;
+                        database: string;
+                    } | undefined;
+                } | undefined;
                 scenario?: string | undefined;
                 requirePrincipal?: boolean | undefined;
                 rateLimitRpm?: number | undefined;
                 maxPrincipalCostUsd?: number | undefined;
             };
-            secretRefs: {
-                apiKeyEnv: string;
-                serviceAuthTokenEnv?: string | undefined;
-                gitTokenEnv?: string | undefined;
-                tidbPasswordEnv?: string | undefined;
-            };
+            host?: string | undefined;
+            coords?: {
+                gitApiBaseUrl?: string | undefined;
+            } | undefined;
             enabled?: boolean | undefined;
             notes?: string | undefined;
-            host?: string | undefined;
             image?: string | undefined;
             routePrefix?: string | undefined;
             replicas?: number | undefined;
@@ -11449,12 +12269,12 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             resources?: {
                 requests?: {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 } | undefined;
                 limits?: {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 } | undefined;
             } | undefined;
             fleet?: {
@@ -11467,12 +12287,6 @@ export declare const DOMAIN_SCHEMAS: {
                 } | undefined;
                 drainGraceMs?: number | undefined;
             } | undefined;
-            coords?: {
-                gitApiBaseUrl?: string | undefined;
-                tidbHost?: string | undefined;
-                tidbPort?: number | undefined;
-                tidbUser?: string | undefined;
-            } | undefined;
             env?: Record<string, string> | undefined;
             secretEnv?: Record<string, string> | undefined;
             recreateNonce?: string | undefined;
@@ -11491,34 +12305,45 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             roster?: string | undefined;
             signature?: string | undefined;
-        }>, "many">>;
-    }, "strip", z.ZodTypeAny, {
-        workers: {
+        }>, {
+            host: string;
+            secretRefs: {
+                apiKeyEnv: string;
+                serviceAuthTokenEnv?: string | undefined;
+                gitTokenEnv?: string | undefined;
+                dbPasswordEnv?: string | undefined;
+            };
+            coords: {
+                gitApiBaseUrl?: string | undefined;
+            };
             name: string;
             enabled: boolean;
-            host: string;
             image: string;
             runtime: {
-                sessionBackend: "memory" | "tidb" | "auto";
-                memoryBackend: "memory" | "tidb" | "off";
                 requirePrincipal: boolean;
                 rateLimitRpm: number;
-                db?: string | undefined;
+                execution?: {
+                    lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                    secretRefs: Record<string, string>;
+                    coords: Record<string, string>;
+                } | undefined;
+                store?: {
+                    memory: {
+                        backend: "pg" | "file" | "tidb";
+                        engine: "on" | "off";
+                    };
+                    session: "mysql" | "memory" | "auto";
+                    backend: "mysql" | "pg" | "local" | "memory";
+                    db?: {
+                        host: string;
+                        port: number;
+                        user: string;
+                        database: string;
+                    } | undefined;
+                } | undefined;
                 scenario?: string | undefined;
                 maxPrincipalCostUsd?: number | undefined;
             };
-            coords: {
-                gitApiBaseUrl?: string | undefined;
-                tidbHost?: string | undefined;
-                tidbPort?: number | undefined;
-                tidbUser?: string | undefined;
-            };
-            secretRefs: {
-                apiKeyEnv: string;
-                serviceAuthTokenEnv?: string | undefined;
-                gitTokenEnv?: string | undefined;
-                tidbPasswordEnv?: string | undefined;
-            };
             notes?: string | undefined;
             routePrefix?: string | undefined;
             replicas?: number | undefined;
@@ -11529,12 +12354,12 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             resources?: {
                 requests?: {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 } | undefined;
                 limits?: {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 } | undefined;
             } | undefined;
             fleet?: {
@@ -11565,28 +12390,45 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             roster?: string | undefined;
             signature?: string | undefined;
-        }[];
-    }, {
-        workers?: {
+        }, {
+            secretRefs: {
+                apiKeyEnv: string;
+                serviceAuthTokenEnv?: string | undefined;
+                gitTokenEnv?: string | undefined;
+                dbPasswordEnv?: string | undefined;
+            };
             name: string;
             runtime: {
-                sessionBackend?: "memory" | "tidb" | "auto" | undefined;
-                memoryBackend?: "memory" | "tidb" | "off" | undefined;
-                db?: string | undefined;
+                execution?: {
+                    lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                    secretRefs?: Record<string, string> | undefined;
+                    coords?: Record<string, string> | undefined;
+                } | undefined;
+                store?: {
+                    backend: "mysql" | "pg" | "local" | "memory";
+                    memory?: {
+                        backend?: "pg" | "file" | "tidb" | undefined;
+                        engine?: "on" | "off" | undefined;
+                    } | undefined;
+                    session?: "mysql" | "memory" | "auto" | undefined;
+                    db?: {
+                        host: string;
+                        port: number;
+                        user: string;
+                        database: string;
+                    } | undefined;
+                } | undefined;
                 scenario?: string | undefined;
                 requirePrincipal?: boolean | undefined;
                 rateLimitRpm?: number | undefined;
                 maxPrincipalCostUsd?: number | undefined;
             };
-            secretRefs: {
-                apiKeyEnv: string;
-                serviceAuthTokenEnv?: string | undefined;
-                gitTokenEnv?: string | undefined;
-                tidbPasswordEnv?: string | undefined;
-            };
+            host?: string | undefined;
+            coords?: {
+                gitApiBaseUrl?: string | undefined;
+            } | undefined;
             enabled?: boolean | undefined;
             notes?: string | undefined;
-            host?: string | undefined;
             image?: string | undefined;
             routePrefix?: string | undefined;
             replicas?: number | undefined;
@@ -11597,12 +12439,12 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             resources?: {
                 requests?: {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 } | undefined;
                 limits?: {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 } | undefined;
             } | undefined;
             fleet?: {
@@ -11615,12 +12457,6 @@ export declare const DOMAIN_SCHEMAS: {
                 } | undefined;
                 drainGraceMs?: number | undefined;
             } | undefined;
-            coords?: {
-                gitApiBaseUrl?: string | undefined;
-                tidbHost?: string | undefined;
-                tidbPort?: number | undefined;
-                tidbUser?: string | undefined;
-            } | undefined;
             env?: Record<string, string> | undefined;
             secretEnv?: Record<string, string> | undefined;
             recreateNonce?: string | undefined;
@@ -11639,33 +12475,131 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             roster?: string | undefined;
             signature?: string | undefined;
-        }[] | undefined;
-    }>, {
-        workers: {
+        }>, {
+            host: string;
+            secretRefs: {
+                apiKeyEnv: string;
+                serviceAuthTokenEnv?: string | undefined;
+                gitTokenEnv?: string | undefined;
+                dbPasswordEnv?: string | undefined;
+            };
+            coords: {
+                gitApiBaseUrl?: string | undefined;
+            };
             name: string;
             enabled: boolean;
-            host: string;
             image: string;
             runtime: {
-                sessionBackend: "memory" | "tidb" | "auto";
-                memoryBackend: "memory" | "tidb" | "off";
                 requirePrincipal: boolean;
                 rateLimitRpm: number;
-                db?: string | undefined;
+                execution?: {
+                    lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                    secretRefs: Record<string, string>;
+                    coords: Record<string, string>;
+                } | undefined;
+                store?: {
+                    memory: {
+                        backend: "pg" | "file" | "tidb";
+                        engine: "on" | "off";
+                    };
+                    session: "mysql" | "memory" | "auto";
+                    backend: "mysql" | "pg" | "local" | "memory";
+                    db?: {
+                        host: string;
+                        port: number;
+                        user: string;
+                        database: string;
+                    } | undefined;
+                } | undefined;
                 scenario?: string | undefined;
                 maxPrincipalCostUsd?: number | undefined;
             };
-            coords: {
-                gitApiBaseUrl?: string | undefined;
-                tidbHost?: string | undefined;
-                tidbPort?: number | undefined;
-                tidbUser?: string | undefined;
-            };
+            notes?: string | undefined;
+            routePrefix?: string | undefined;
+            replicas?: number | undefined;
+            autoscaling?: {
+                minReplicas: number;
+                maxReplicas: number;
+                targetCpuPercent?: number | undefined;
+            } | undefined;
+            resources?: {
+                requests?: {
+                    memory?: string | undefined;
+                    cpu?: string | undefined;
+                } | undefined;
+                limits?: {
+                    memory?: string | undefined;
+                    cpu?: string | undefined;
+                } | undefined;
+            } | undefined;
+            fleet?: {
+                dispatch?: {
+                    strategy: "round-robin" | "least-inflight" | "consistent-hash";
+                    sessionAffinity: boolean;
+                    maxInflight?: number | undefined;
+                    perActorMaxInflight?: number | undefined;
+                    maxCostUsd?: number | undefined;
+                } | undefined;
+                drainGraceMs?: number | undefined;
+            } | undefined;
+            env?: Record<string, string> | undefined;
+            secretEnv?: Record<string, string> | undefined;
+            recreateNonce?: string | undefined;
+            lifecycle?: {
+                kind: "persistent" | "ephemeral";
+                ttl?: string | undefined;
+                idleTimeout?: string | undefined;
+                owner?: string | undefined;
+                purpose?: string | undefined;
+                dependsOn?: string[] | undefined;
+            } | undefined;
+            placement?: {
+                auto: boolean;
+                requires: string[];
+                spread?: string | undefined;
+            } | undefined;
+            roster?: string | undefined;
+            signature?: string | undefined;
+        }, unknown>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        workers: {
+            host: string;
             secretRefs: {
                 apiKeyEnv: string;
                 serviceAuthTokenEnv?: string | undefined;
                 gitTokenEnv?: string | undefined;
-                tidbPasswordEnv?: string | undefined;
+                dbPasswordEnv?: string | undefined;
+            };
+            coords: {
+                gitApiBaseUrl?: string | undefined;
+            };
+            name: string;
+            enabled: boolean;
+            image: string;
+            runtime: {
+                requirePrincipal: boolean;
+                rateLimitRpm: number;
+                execution?: {
+                    lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                    secretRefs: Record<string, string>;
+                    coords: Record<string, string>;
+                } | undefined;
+                store?: {
+                    memory: {
+                        backend: "pg" | "file" | "tidb";
+                        engine: "on" | "off";
+                    };
+                    session: "mysql" | "memory" | "auto";
+                    backend: "mysql" | "pg" | "local" | "memory";
+                    db?: {
+                        host: string;
+                        port: number;
+                        user: string;
+                        database: string;
+                    } | undefined;
+                } | undefined;
+                scenario?: string | undefined;
+                maxPrincipalCostUsd?: number | undefined;
             };
             notes?: string | undefined;
             routePrefix?: string | undefined;
@@ -11677,12 +12611,12 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             resources?: {
                 requests?: {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 } | undefined;
                 limits?: {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 } | undefined;
             } | undefined;
             fleet?: {
@@ -11715,27 +12649,48 @@ export declare const DOMAIN_SCHEMAS: {
             signature?: string | undefined;
         }[];
     }, {
-        workers?: {
-            name: string;
-            runtime: {
-                sessionBackend?: "memory" | "tidb" | "auto" | undefined;
-                memoryBackend?: "memory" | "tidb" | "off" | undefined;
-                db?: string | undefined;
-                scenario?: string | undefined;
-                requirePrincipal?: boolean | undefined;
-                rateLimitRpm?: number | undefined;
-                maxPrincipalCostUsd?: number | undefined;
-            };
+        workers?: unknown[] | undefined;
+    }>, {
+        workers: {
+            host: string;
             secretRefs: {
                 apiKeyEnv: string;
                 serviceAuthTokenEnv?: string | undefined;
                 gitTokenEnv?: string | undefined;
-                tidbPasswordEnv?: string | undefined;
+                dbPasswordEnv?: string | undefined;
+            };
+            coords: {
+                gitApiBaseUrl?: string | undefined;
+            };
+            name: string;
+            enabled: boolean;
+            image: string;
+            runtime: {
+                requirePrincipal: boolean;
+                rateLimitRpm: number;
+                execution?: {
+                    lane: "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device";
+                    secretRefs: Record<string, string>;
+                    coords: Record<string, string>;
+                } | undefined;
+                store?: {
+                    memory: {
+                        backend: "pg" | "file" | "tidb";
+                        engine: "on" | "off";
+                    };
+                    session: "mysql" | "memory" | "auto";
+                    backend: "mysql" | "pg" | "local" | "memory";
+                    db?: {
+                        host: string;
+                        port: number;
+                        user: string;
+                        database: string;
+                    } | undefined;
+                } | undefined;
+                scenario?: string | undefined;
+                maxPrincipalCostUsd?: number | undefined;
             };
-            enabled?: boolean | undefined;
             notes?: string | undefined;
-            host?: string | undefined;
-            image?: string | undefined;
             routePrefix?: string | undefined;
             replicas?: number | undefined;
             autoscaling?: {
@@ -11745,35 +12700,29 @@ export declare const DOMAIN_SCHEMAS: {
             } | undefined;
             resources?: {
                 requests?: {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 } | undefined;
                 limits?: {
-                    cpu?: string | undefined;
                     memory?: string | undefined;
+                    cpu?: string | undefined;
                 } | undefined;
             } | undefined;
             fleet?: {
                 dispatch?: {
-                    strategy?: "round-robin" | "least-inflight" | "consistent-hash" | undefined;
-                    sessionAffinity?: boolean | undefined;
+                    strategy: "round-robin" | "least-inflight" | "consistent-hash";
+                    sessionAffinity: boolean;
                     maxInflight?: number | undefined;
                     perActorMaxInflight?: number | undefined;
                     maxCostUsd?: number | undefined;
                 } | undefined;
                 drainGraceMs?: number | undefined;
             } | undefined;
-            coords?: {
-                gitApiBaseUrl?: string | undefined;
-                tidbHost?: string | undefined;
-                tidbPort?: number | undefined;
-                tidbUser?: string | undefined;
-            } | undefined;
             env?: Record<string, string> | undefined;
             secretEnv?: Record<string, string> | undefined;
             recreateNonce?: string | undefined;
             lifecycle?: {
-                kind?: "persistent" | "ephemeral" | undefined;
+                kind: "persistent" | "ephemeral";
                 ttl?: string | undefined;
                 idleTimeout?: string | undefined;
                 owner?: string | undefined;
@@ -11781,13 +12730,15 @@ export declare const DOMAIN_SCHEMAS: {
                 dependsOn?: string[] | undefined;
             } | undefined;
             placement?: {
-                auto?: boolean | undefined;
-                requires?: string[] | undefined;
+                auto: boolean;
+                requires: string[];
                 spread?: string | undefined;
             } | undefined;
             roster?: string | undefined;
             signature?: string | undefined;
-        }[] | undefined;
+        }[];
+    }, {
+        workers?: unknown[] | undefined;
     }>;
     readonly hosts: z.ZodEffects<z.ZodObject<{
         hosts: z.ZodDefault<z.ZodArray<z.ZodObject<{
@@ -13149,8 +14100,9 @@ export declare const DOMAIN_SCHEMAS: {
          *  shell locks sandbox-enabled by policy; user settings can't turn it off — CC 同款语义). */
         required: z.ZodDefault<z.ZodBoolean>;
         /** Which execution lanes are allowed. OPEN value domain — z.string(), NEVER an enum: adding a lane
-         *  must not be a BREAKING schema change (promised to the service). Known lanes
-         *  today: `host` / `e2b` / `k8s` / `ssh` / `adb` / `local-docker`. Unknown strings are consumer-defined. */
+         *  must not be a BREAKING schema change (promised to the service). The closed set of lanes a worker can
+         *  declare is `EXECUTION_LANE_WORDS` (`execution-lanes.ts`, 7.0.0) — read it there, not from a copy in this
+         *  comment. Unknown strings are consumer-defined. */
         allowedLanes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         /** Org 默认会话镜像目标(0.10.1,附B 两层)。ABSENT = INERT(center 未管镜像,壳解析序里本腿为空)。
          *  读损档随域(DOMAIN_READ_FALLBACK.execution="throw" 已覆盖:损坏绝不静默退默认放权)。 */