fix: add dev backend-core artifact consumer

scripts/artifact-consumer-dry-run-matrix-test.ts

@@ -90,6 +90,16 @@ const ciCatalog = asRecord(JSON.parse(readFileSync(rootPath("CI.json"), "utf8"))
 const artifacts = asArray(ciCatalog.artifacts, "CI.json.artifacts").map((item, index) => asRecord(item, `CI.json.artifacts[${index}]`));
 const artifactByService = new Map(artifacts.map((item) => [String(item.serviceId), item]));
 
+const backendCoreArtifact = asRecord(artifactByService.get("backend-core"), "CI.json artifact backend-core");
+const backendCoreSource = asRecord(backendCoreArtifact.source, "CI.json artifact backend-core.source");
+const backendCoreImage = asRecord(backendCoreArtifact.image, "CI.json artifact backend-core.image");
+assertCondition(backendCoreArtifact.kind === "source-build", "backend-core producer must be source-build", backendCoreArtifact);
+assertCondition(backendCoreArtifact.status === "supported", "backend-core producer must be supported", backendCoreArtifact);
+assertCondition(backendCoreArtifact.producer === "ci publish-backend-core", "backend-core producer command must be publish-backend-core", backendCoreArtifact);
+assertCondition(backendCoreSource.repo === "https://github.com/pikasTech/unidesk", "backend-core producer source repo mismatch", backendCoreSource);
+assertCondition(backendCoreSource.dockerfile === "src/components/backend-core/Dockerfile", "backend-core producer dockerfile mismatch", backendCoreSource);
+assertCondition(backendCoreImage.repository === "unidesk/backend-core", "backend-core registry repository mismatch", backendCoreImage);
+
 for (const item of serviceCases) {
   const artifact = asRecord(artifactByService.get(item.serviceId), `CI.json artifact ${item.serviceId}`);
   const source = asRecord(artifact.source, `CI.json artifact ${item.serviceId}.source`);
@@ -158,9 +168,72 @@ for (const item of serviceCases) {
   });
 }
 
+const backendCoreDevPlan = asRecord(await runArtifactRegistryCommand([
+  "deploy-service",
+  "--env",
+  "dev",
+  "--service",
+  "backend-core",
+  "--commit",
+  commit,
+  "--dry-run",
+]), "backend-core dev dry-run plan");
+const backendCoreDevTarget = asRecord(backendCoreDevPlan.target, "backend-core dev dry-run target");
+const backendCoreDevLabels = asRecord(backendCoreDevPlan.requiredLabels, "backend-core dev dry-run labels");
+const backendCoreDevRegistry = asRecord(backendCoreDevPlan.registry, "backend-core dev dry-run registry");
+const backendCoreDevBuild = asRecord(backendCoreDevPlan.build, "backend-core dev dry-run build");
+const backendCoreDevSource = asRecord(backendCoreDevPlan.source, "backend-core dev dry-run source");
+const backendCoreDevValidation = asArray(backendCoreDevPlan.validation, "backend-core dev dry-run validation").map(String);
+
+assertCondition(backendCoreDevPlan.ok === true, "backend-core dev dry-run must be ok", backendCoreDevPlan);
+assertCondition(backendCoreDevPlan.dryRun === true && backendCoreDevPlan.mutation === false, "backend-core dev dry-run must be non-mutating", backendCoreDevPlan);
+assertCondition(backendCoreDevPlan.environment === "dev", "backend-core dev dry-run must target dev", backendCoreDevPlan);
+assertCondition(backendCoreDevPlan.serviceId === "backend-core", "backend-core dev service id mismatch", backendCoreDevPlan);
+assertCondition(backendCoreDevPlan.sourceImage === `127.0.0.1:5000/unidesk/backend-core:${commit}`, "backend-core dev source image mismatch", backendCoreDevPlan);
+assertCondition(backendCoreDevRegistry.imageRef === backendCoreDevPlan.sourceImage, "backend-core dev registry imageRef mismatch", backendCoreDevRegistry);
+assertCondition(backendCoreDevRegistry.digest === null, "backend-core dev dry-run must not fake a digest", backendCoreDevRegistry);
+assertCondition(String(backendCoreDevRegistry.digestSource ?? "").includes("manifest HEAD"), "backend-core dev digest source should name manifest HEAD", backendCoreDevRegistry);
+assertCondition(backendCoreDevSource.repo === "https://github.com/pikasTech/unidesk", "backend-core dev source repo mismatch", backendCoreDevSource);
+assertCondition(backendCoreDevSource.commit === commit, "backend-core dev source commit mismatch", backendCoreDevSource);
+assertCondition(backendCoreDevSource.dockerfile === "src/components/backend-core/Dockerfile", "backend-core dev source dockerfile mismatch", backendCoreDevSource);
+assertCondition(backendCoreDevBuild.willCompile === false, "backend-core dev CD dry-run must not compile", backendCoreDevBuild);
+assertCondition(backendCoreDevBuild.willRunCargoBuild === false, "backend-core dev CD dry-run must not run cargo build", backendCoreDevBuild);
+assertCondition(backendCoreDevBuild.willRunDockerBuild === false, "backend-core dev CD dry-run must not run docker build", backendCoreDevBuild);
+assertCondition(backendCoreDevBuild.willRunDockerComposeBuild === false, "backend-core dev CD dry-run must not run docker compose build", backendCoreDevBuild);
+assertCondition(backendCoreDevBuild.producerBoundary === "ci publish-backend-core", "backend-core dev producer boundary mismatch", backendCoreDevBuild);
+assertCondition(backendCoreDevLabels["unidesk.ai/service-id"] === "backend-core", "backend-core dev required service label missing", backendCoreDevLabels);
+assertCondition(backendCoreDevLabels["unidesk.ai/source-commit"] === commit, "backend-core dev required commit label missing", backendCoreDevLabels);
+assertCondition(backendCoreDevLabels["unidesk.ai/dockerfile"] === "src/components/backend-core/Dockerfile", "backend-core dev required dockerfile label missing", backendCoreDevLabels);
+assertCondition(backendCoreDevTarget.kind === "d601-k3s", "backend-core dev target must be D601 k3s", backendCoreDevTarget);
+assertCondition(backendCoreDevTarget.namespace === "unidesk-dev", "backend-core dev namespace mismatch", backendCoreDevTarget);
+assertCondition(backendCoreDevTarget.deployment === "backend-core-dev", "backend-core dev deployment mismatch", backendCoreDevTarget);
+assertCondition(backendCoreDevTarget.service === "backend-core-dev", "backend-core dev service mismatch", backendCoreDevTarget);
+assertCondition(backendCoreDevTarget.stableImage === "unidesk-backend-core:dev", "backend-core dev stable image mismatch", backendCoreDevTarget);
+assertCondition(backendCoreDevTarget.runtimeImage === `unidesk-backend-core:${commit}`, "backend-core dev runtime image mismatch", backendCoreDevTarget);
+assertCondition(backendCoreDevTarget.manifestRepoPath === "src/components/microservices/k3sctl-adapter/k3s/dev/unidesk-dev-core.k8s.yaml", "backend-core dev manifest mismatch", backendCoreDevTarget);
+assertCondition(backendCoreDevValidation.some((line) => line.includes("registry /v2 manifest")), "backend-core dev must plan registry manifest validation", backendCoreDevValidation);
+assertCondition(backendCoreDevValidation.some((line) => line.includes("native k3s containerd")), "backend-core dev must plan containerd import validation", backendCoreDevValidation);
+assertCondition(backendCoreDevValidation.some((line) => line.includes("deploy.commit") && line.includes("deploy.requestedCommit")), "backend-core dev must plan health commit validation", backendCoreDevValidation);
+assertCondition(!JSON.stringify(backendCoreDevPlan).includes("cargo build"), "backend-core dev dry-run must not include cargo build", backendCoreDevPlan);
+assertCondition(!JSON.stringify(backendCoreDevPlan).includes("docker build"), "backend-core dev dry-run must not include docker build", backendCoreDevPlan);
+assertCondition(!JSON.stringify(backendCoreDevPlan).includes("docker compose build"), "backend-core dev dry-run must not include compose build", backendCoreDevPlan);
+assertCondition(!JSON.stringify(backendCoreDevPlan).includes("server rebuild"), "backend-core dev dry-run must not include server rebuild", backendCoreDevPlan);
+
+plans.push({
+  serviceId: "backend-core",
+  environment: "dev",
+  sourceImage: backendCoreDevPlan.sourceImage,
+  deployment: backendCoreDevTarget.deployment,
+  service: backendCoreDevTarget.service,
+  deployCommandShape: backendCoreDevTarget.deployCommandShape,
+});
+
 process.stdout.write(`${JSON.stringify({
   ok: true,
   checks: [
+    "CI.json producer catalog covers backend-core publish-backend-core",
+    "dev backend-core dry-run is a non-mutating D601 k3s artifact consumer",
+    "dev backend-core dry-run exposes registry/source/build boundaries and does not compile",
     "CI.json producer catalog covers the main-server direct artifact services",
     "prod dry-run plans are non-mutating and commit-pinned",
     "dry-run targets only the matching main-server Compose service with --no-build --no-deps --force-recreate",

scripts/deploy-artifact-matrix-contract-test.ts

@@ -41,6 +41,31 @@ assertCondition(findjobTarget.runtimeHost === "D601", "findjob target should be
 assertCondition(findjobTarget.composeService === "server", "findjob compose service should be server", findjobTarget);
 assertCondition(listIncludes(findjobTarget.forbiddenActions, "docker compose build"), "findjob plan should forbid Compose build", findjobTarget);
 
+const backendCoreDev = runDeployPlan("dev", "backend-core");
+const backendCoreArtifact = asRecord(backendCoreDev.artifactConsumer, "backend-core dev artifactConsumer");
+const backendCoreTarget = asRecord(backendCoreDev.target, "backend-core dev target");
+const backendCoreRegistry = asRecord(backendCoreArtifact.registry, "backend-core dev registry");
+const backendCoreSource = asRecord(backendCoreArtifact.source, "backend-core dev source");
+const backendCoreBuild = asRecord(backendCoreArtifact.build, "backend-core dev build");
+assertCondition(backendCoreDev.deploymentPath === "d601-registry-artifact-consumer", "backend-core dev deployment path must be artifact consumer", backendCoreDev);
+assertCondition(backendCoreArtifact.consumerKind === "d601-k3s-managed", "backend-core dev must be a D601 k3s-managed artifact consumer", backendCoreArtifact);
+assertCondition(backendCoreArtifact.noRuntimeSourceBuild === true, "backend-core dev plan must declare no runtime source build", backendCoreArtifact);
+assertCondition(String(backendCoreArtifact.registryImage ?? "").includes("127.0.0.1:5000/unidesk/backend-core:"), "backend-core dev registry image missing", backendCoreArtifact);
+assertCondition(backendCoreRegistry.repository === "unidesk/backend-core", "backend-core dev registry repository mismatch", backendCoreRegistry);
+assertCondition(backendCoreRegistry.digest === null, "backend-core dev plan must not fake digest", backendCoreRegistry);
+assertCondition(String(backendCoreRegistry.digestSource ?? "").includes("manifest HEAD"), "backend-core dev digest source should name manifest HEAD", backendCoreRegistry);
+assertCondition(backendCoreSource.repo === "https://github.com/pikasTech/unidesk", "backend-core dev source repo mismatch", backendCoreSource);
+assertCondition(backendCoreBuild.willCompile === false, "backend-core dev plan must not compile in CD", backendCoreBuild);
+assertCondition(backendCoreBuild.willRunCargoBuild === false, "backend-core dev plan must not run cargo build in CD", backendCoreBuild);
+assertCondition(backendCoreBuild.willRunDockerBuild === false, "backend-core dev plan must not run docker build in CD", backendCoreBuild);
+assertCondition(backendCoreBuild.producerBoundary === "ci publish-backend-core", "backend-core dev producer boundary mismatch", backendCoreBuild);
+assertCondition(backendCoreTarget.namespace === "unidesk-dev", "backend-core dev target namespace should be unidesk-dev", backendCoreTarget);
+assertCondition(backendCoreTarget.deployment === "backend-core-dev", "backend-core dev deployment should be backend-core-dev", backendCoreTarget);
+assertCondition(backendCoreTarget.service === "backend-core-dev", "backend-core dev service should be backend-core-dev", backendCoreTarget);
+assertCondition(backendCoreTarget.targetImage === "unidesk-backend-core:dev", "backend-core dev target image mismatch", backendCoreTarget);
+assertCondition(listIncludes(backendCoreTarget.forbiddenActions, "docker build"), "backend-core dev plan should forbid docker build", backendCoreTarget);
+assertCondition(listIncludes(backendCoreTarget.forbiddenActions, "docker compose build"), "backend-core dev plan should forbid compose build", backendCoreTarget);
+
 const mdtodo = runDeployPlan("prod", "mdtodo");
 const mdtodoArtifact = asRecord(mdtodo.artifactConsumer, "mdtodo artifactConsumer");
 const mdtodoTarget = asRecord(mdtodo.target, "mdtodo target");
@@ -66,6 +91,8 @@ assertCondition(k3sctlTarget.composeService === "k3sctl-adapter", "k3sctl target
 process.stdout.write(`${JSON.stringify({
   ok: true,
   checks: [
+    "deploy plan models dev backend-core as a no-build D601 k3s artifact consumer",
+    "dev backend-core plan exposes registry/source/build boundaries and target metadata",
     "deploy plan distinguishes D601 direct Compose from D601 k3s-managed artifact consumers",
     "deploy plan exposes no-runtime-source-build and forbidden build/public-port actions",
     "met-nonlinear remains runtime-verification-blocked",

scripts/src/artifact-registry.ts

@@ -207,6 +207,32 @@ const artifactConsumerSpecs: Record<string, ArtifactConsumerSpec> = {
       },
     },
   },
+  "dev:backend-core": {
+    serviceId: "backend-core",
+    environment: "dev",
+    kind: "d601-k3s",
+    registryRepository: "unidesk/backend-core",
+    dockerfile: "src/components/backend-core/Dockerfile",
+    prodLiveApply: "enabled",
+    targets: {
+      dev: {
+        targetImage: "unidesk-backend-core:dev",
+        targetCommitImage: (commit: string) => `unidesk-backend-core:${commit}`,
+        deployRef: "origin/master:deploy.json#environments.dev.services.backend-core",
+        k3s: {
+          namespace: "unidesk-dev",
+          manifestRepoPath: "src/components/microservices/k3sctl-adapter/k3s/dev/unidesk-dev-core.k8s.yaml",
+          deploymentName: "backend-core-dev",
+          serviceName: "backend-core-dev",
+          servicePort: 8080,
+          containerName: "backend-core",
+          healthPath: "/health",
+          applySelector: "app.kubernetes.io/name=backend-core",
+          podLabelSelector: "app.kubernetes.io/name=backend-core,app.kubernetes.io/component=core,unidesk.ai/environment=dev",
+        },
+      },
+    },
+  },
   "baidu-netdisk": {
     serviceId: "baidu-netdisk",
     environment: "prod",
@@ -2038,6 +2064,7 @@ function dryRunArtifactConsumerPlan(options: ArtifactRegistryOptions, spec: Arti
   const verificationBlocked = spec.runtimeVerification === "blocked";
   const livePolicy = environment === "prod" ? spec.prodLiveApply : "enabled";
   const sourceImage = artifactImageRef(options, spec, commit);
+  const registryEndpoint = `http://127.0.0.1:${options.port}`;
   const k3sDeployments = target.k3s === undefined
     ? []
     : [
@@ -2059,6 +2086,27 @@ function dryRunArtifactConsumerPlan(options: ArtifactRegistryOptions, spec: Arti
     sourceRepo: sourceRepoFor(options, spec),
     deployRef: deployRefFor(options, spec),
     sourceImage,
+    source: {
+      repo: sourceRepoFor(options, spec),
+      commit,
+      dockerfile: spec.dockerfile,
+    },
+    registry: {
+      endpoint: registryEndpoint,
+      repository: spec.registryRepository,
+      tag: commit,
+      imageRef: sourceImage,
+      digest: null,
+      digestHeader: "Docker-Content-Digest",
+      digestSource: "planned registry manifest HEAD; live apply must read this digest before mutation",
+    },
+    build: {
+      willCompile: false,
+      willRunCargoBuild: false,
+      willRunDockerBuild: false,
+      willRunDockerComposeBuild: false,
+      producerBoundary: spec.serviceId === "backend-core" ? "ci publish-backend-core" : "ci publish-user-service",
+    },
     requiredLabels: {
       "unidesk.ai/service-id": spec.serviceId,
       "unidesk.ai/source-commit": commit,
@@ -2066,7 +2114,8 @@ function dryRunArtifactConsumerPlan(options: ArtifactRegistryOptions, spec: Arti
     },
     registryProbe: {
       method: "HEAD",
-      url: `http://127.0.0.1:${options.port}/v2/${spec.registryRepository}/manifests/${commit}`,
+      url: `${registryEndpoint}/v2/${spec.registryRepository}/manifests/${commit}`,
+      digestHeader: "Docker-Content-Digest",
     },
     boundary: `${environment} CD is artifact-consumer only: verify commit-pinned registry image, pull/import, deploy, then verify live commit/image/health; it never builds source on the runtime target`,
     liveApply: {

scripts/src/check.ts

@@ -367,7 +367,7 @@ export function runChecks(config: UniDeskConfig, options: CheckOptions = default
   if (options.rust) {
     items.push(rustCheckItem());
   } else {
-    items.push(skippedItem("rust:backend-core", "Rust check/build must run on D601 dev deploy or CI, not on the master server", "--rust inside D601 CI with UNIDESK_D601_RUST_CHECK=1"));
+    items.push(skippedItem("rust:backend-core", "Rust check/build must run through D601 CI artifact publication, not on the master server or CD runtime target", "--rust inside D601 CI with UNIDESK_D601_RUST_CHECK=1"));
   }
   return { ok: items.every((item) => item.ok), mode: options.full ? "full" : "basic", options, items };
 }

scripts/src/deploy.ts

@@ -139,9 +139,9 @@ const nativeK3sInstallVersion = "v1.34.1+k3s1";
 const nativeK3sImage = "rancher/k3s:v1.34.1-k3s1";
 const nativeK3sCtrAddress = "/run/k3s/containerd/containerd.sock";
 const unideskRepoUrl = "https://github.com/pikasTech/unidesk";
-const d601MaintenanceDeployAllowedServiceIds = new Set<string>(["backend-core", "k3sctl-adapter"]);
-const devApplySupportedServiceIds = new Set<string>(["backend-core"]);
-const devArtifactConsumerServiceIds = new Set<string>(["baidu-netdisk", "claudeqq", "code-queue", "code-queue-mgr", "decision-center", "findjob", "frontend", "mdtodo", "met-nonlinear", "oa-event-flow", "pipeline", "project-manager", "todo-note"]);
+const d601MaintenanceDeployAllowedServiceIds = new Set<string>(["k3sctl-adapter"]);
+const devApplySupportedServiceIds = new Set<string>();
+const devArtifactConsumerServiceIds = new Set<string>(["backend-core", "baidu-netdisk", "claudeqq", "code-queue", "code-queue-mgr", "decision-center", "findjob", "frontend", "mdtodo", "met-nonlinear", "oa-event-flow", "pipeline", "project-manager", "todo-note"]);
 const devArtifactConsumerProdDesiredFallbackServiceIds = new Set<string>(["code-queue-mgr", "oa-event-flow", "project-manager", "todo-note"]);
 const prodArtifactConsumerServiceIds = new Set<string>(["backend-core", "baidu-netdisk", "claudeqq", "code-queue-mgr", "decision-center", "findjob", "frontend", "k3sctl-adapter", "mdtodo", "met-nonlinear", "oa-event-flow", "pipeline", "project-manager", "todo-note"]);
 const prodForbiddenTargetSideBuildServiceIds = new Set<string>(["backend-core", "baidu-netdisk", "claudeqq", "decision-center", "findjob", "frontend", "k3sctl-adapter", "mdtodo", "met-nonlinear", "pipeline"]);
@@ -212,7 +212,7 @@ export function deployHelp(action: string | undefined = undefined): Record<strin
     actions: {
       check: "Validate desired repo+commit state against live service health and commit markers.",
       plan: "Show desired/live drift, or with --env show the environment-ref dry-run plan without touching runtime resources.",
-      apply: "Start an async target-side reconcile job unless --run-now is explicitly present.",
+      apply: "Start an async deploy/reconcile job unless --run-now is explicitly present.",
       guard: "Run local deployment guards without mutating runtime resources.",
     },
     releaseV1Frontend: {
@@ -223,7 +223,7 @@ export function deployHelp(action: string | undefined = undefined): Record<strin
     },
     options: [
       { name: "--file <path>", default: defaultDeployFile, description: "Desired-state manifest path relative to the repo root. JSON and ESM JS manifests are supported, for example deploy.json or develop.js. Local D601 maintenance apply is limited to approved direct exceptions; Code Queue direct rollout is disabled." },
-      { name: "--env <dev|prod>", description: "Read the named environment from origin/master:deploy.json. Dev apply supports backend-core target-side rollout plus reviewed artifact consumers for frontend, baidu-netdisk, decision-center, mdtodo, claudeqq, dev-only code-queue, project-manager, oa-event-flow, code-queue-mgr, todo-note, findjob, pipeline, and met-nonlinear. Prod apply uses reviewed D601 registry artifact consumers; code-queue has no prod target and gated/incomplete services return structured unsupported or dry-run-only output." },
+      { name: "--env <dev|prod>", description: "Read the named environment from origin/master:deploy.json. Dev apply supports reviewed artifact consumers for backend-core, frontend, baidu-netdisk, decision-center, mdtodo, claudeqq, dev-only code-queue, project-manager, oa-event-flow, code-queue-mgr, todo-note, findjob, pipeline, and met-nonlinear. Prod apply uses reviewed D601 registry artifact consumers; code-queue has no prod target and gated/incomplete services return structured unsupported or dry-run-only output." },
       { name: "--service <id>", description: "Limit reconcile to one service from the manifest." },
       { name: "--commit <full-sha>", description: "Artifact consumer override for one selected --env dev|prod service; the commit-pinned image must already exist in the D601 registry. This is the supported release/v1 frontend validation and rollback shape without editing a local manifest." },
       { name: "--dry-run", description: "Prepare and validate without mutating the target service." },
@@ -2773,7 +2773,7 @@ async function applyOneService(config: UniDeskConfig, service: UniDeskMicroservi
       ok: false,
       serviceId: service.id,
       skipped: true,
-      reason: `D601 target-side deployment is allowed only for k3sctl-adapter and dev backend-core; artifact consumers must use registry CD. ${service.id} is not enabled. Use ci run-dev-e2e for smoke verification.`,
+      reason: `D601 target-side deployment is allowed only for k3sctl-adapter as a control-bridge maintenance path; artifact consumers must use registry CD. ${service.id} is not enabled. Use ci run-dev-e2e for smoke verification.`,
       steps,
     };
   }
@@ -2969,6 +2969,26 @@ function environmentDryRunPlan(
         } : {
           consumerKind: unsupported ? "unsupported" : planKind,
           registryImage: unsupported ? null : `127.0.0.1:5000/unidesk/${service.id}:${service.commitId}`,
+          registry: unsupported ? null : {
+            endpoint: "http://127.0.0.1:5000",
+            repository: `unidesk/${service.id}`,
+            tag: service.commitId,
+            imageRef: `127.0.0.1:5000/unidesk/${service.id}:${service.commitId}`,
+            digest: null,
+            digestSource: "planned registry manifest HEAD; live apply records Docker-Content-Digest before mutation",
+          },
+          source: unsupported ? null : {
+            repo: service.repo,
+            commit: service.commitId,
+            deployRef: `${source.ref}:deploy.json#environments.${environment}.services.${service.id}`,
+          },
+          build: unsupported ? null : {
+            willCompile: planKind === "d601-dev-target-side-build",
+            willRunCargoBuild: false,
+            willRunDockerBuild: planKind === "d601-dev-target-side-build",
+            willRunDockerComposeBuild: false,
+            producerBoundary: service.id === "backend-core" ? "ci publish-backend-core" : "ci publish-user-service",
+          },
           noRuntimeSourceBuild: unsupported || planKind !== "d601-dev-target-side-build",
           dryRunOnly: unsupported || (environment === "prod" && prodArtifactLiveApplyBlockedServiceIds.has(service.id)) || dryRunBlockedReason !== null,
           blockedReason: unsupportedReason ?? dryRunBlockedReason ?? (environment === "prod" ? prodArtifactLiveApplyBlockedServiceIds.get(service.id) ?? null : null),
@@ -3029,7 +3049,7 @@ function blockedD601MaintenanceDeployServices(config: UniDeskConfig, manifest: D
 }
 
 function d601MaintenanceDeployBlockMessage(blocked: string[]): string {
-  return `D601 target-side deployment is enabled only for k3sctl-adapter and dev backend-core; artifact consumers must use registry CD. Blocked services: ${blocked.join(", ")}. Code Queue is dev-only through artifact-registry/deploy --env dev and has no production direct rollout path.`;
+  return `D601 target-side deployment is enabled only for k3sctl-adapter as a control-bridge maintenance path; artifact consumers must use registry CD. Blocked services: ${blocked.join(", ")}. Code Queue is dev-only through artifact-registry/deploy --env dev and has no production direct rollout path.`;
 }
 
 function selectedDevArtifactServices(manifest: DeployManifest, serviceId: string | null): DeployManifestService[] {
@@ -3088,7 +3108,7 @@ function commitOverrideArtifactConsumerError(options: DeployOptions): string | n
   if (options.commitOverride === null) return null;
   if (options.environment === "dev") {
     if (options.serviceId !== null && devArtifactConsumerServiceIds.has(options.serviceId)) return null;
-    return `deploy --commit is supported for --env dev only on reviewed artifact consumers (${Array.from(devArtifactConsumerServiceIds).sort().join(", ")}); it must not switch dev target-side source builds such as backend-core away from deploy.json`;
+    return `deploy --commit is supported for --env dev only on reviewed artifact consumers (${Array.from(devArtifactConsumerServiceIds).sort().join(", ")})`;
   }
   if (options.environment === "prod") {
     if (options.serviceId !== null && prodArtifactConsumerServiceIds.has(options.serviceId)) return null;
@@ -3300,7 +3320,7 @@ export async function runDeployCommand(config: UniDeskConfig | null, args: strin
     }
     const unsupported = unsupportedDevApplyServices(manifest, options.serviceId);
     if (unsupported.length > 0) {
-      throw new Error(`deploy apply --env dev currently supports backend-core target-side rollout plus frontend/baidu-netdisk/decision-center/mdtodo/claudeqq/code-queue/project-manager/oa-event-flow/code-queue-mgr/todo-note/findjob/pipeline/met-nonlinear artifact consumers; unsupported selected services: ${unsupported.join(", ")}. Use ci run-dev-e2e for smoke verification.`);
+      throw new Error(`deploy apply --env dev currently supports backend-core/frontend/baidu-netdisk/decision-center/mdtodo/claudeqq/code-queue/project-manager/oa-event-flow/code-queue-mgr/todo-note/findjob/pipeline/met-nonlinear artifact consumers; unsupported selected services: ${unsupported.join(", ")}. Use ci run-dev-e2e for smoke verification.`);
     }
     const devArtifactServices = selectedDevArtifactServicesWithProdFallback(manifest, options.serviceId);
     const devTargetServices = selectedDevTargetServices(manifest, options.serviceId);